]> git.ipfire.org Git - thirdparty/grsecurity-scrape.git/blob - test/grsecurity-3.0-3.14.5-201406051310.patch
projects / thirdparty / grsecurity-scrape.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Auto commit, 1 new patch{es}.
[thirdparty/grsecurity-scrape.git] / test / grsecurity-3.0-3.14.5-201406051310.patch
1 diff --git a/Documentation/dontdiff b/Documentation/dontdiff
2 index b89a739..e289b9b 100644
3 --- a/Documentation/dontdiff
4 +++ b/Documentation/dontdiff
5 @@ -2,9 +2,11 @@
6 *.aux
7 *.bin
8 *.bz2
9 +*.c.[012]*.*
10 *.cis
11 *.cpio
12 *.csp
13 +*.dbg
14 *.dsp
15 *.dvi
16 *.elf
17 @@ -14,6 +16,7 @@
18 *.gcov
19 *.gen.S
20 *.gif
21 +*.gmo
22 *.grep
23 *.grp
24 *.gz
25 @@ -48,14 +51,17 @@
26 *.tab.h
27 *.tex
28 *.ver
29 +*.vim
30 *.xml
31 *.xz
32 *_MODULES
33 +*_reg_safe.h
34 *_vga16.c
35 *~
36 \#*#
37 *.9
38 -.*
39 +.[^g]*
40 +.gen*
41 .*.d
42 .mm
43 53c700_d.h
44 @@ -69,9 +75,11 @@ Image
45 Module.markers
46 Module.symvers
47 PENDING
48 +PERF*
49 SCCS
50 System.map*
51 TAGS
52 +TRACEEVENT-CFLAGS
53 aconf
54 af_names.h
55 aic7*reg.h*
56 @@ -80,6 +88,7 @@ aic7*seq.h*
57 aicasm
58 aicdb.h*
59 altivec*.c
60 +ashldi3.S
61 asm-offsets.h
62 asm_offsets.h
63 autoconf.h*
64 @@ -92,32 +101,40 @@ bounds.h
65 bsetup
66 btfixupprep
67 build
68 +builtin-policy.h
69 bvmlinux
70 bzImage*
71 capability_names.h
72 capflags.c
73 classlist.h*
74 +clut_vga16.c
75 +common-cmds.h
76 comp*.log
77 compile.h*
78 conf
79 config
80 config-*
81 config_data.h*
82 +config.c
83 config.mak
84 config.mak.autogen
85 +config.tmp
86 conmakehash
87 consolemap_deftbl.c*
88 cpustr.h
89 crc32table.h*
90 cscope.*
91 defkeymap.c
92 +devicetable-offsets.h
93 devlist.h*
94 dnotify_test
95 docproc
96 dslm
97 +dtc-lexer.lex.c
98 elf2ecoff
99 elfconfig.h*
100 evergreen_reg_safe.h
101 +exception_policy.conf
102 fixdep
103 flask.h
104 fore200e_mkfirm
105 @@ -125,12 +142,15 @@ fore200e_pca_fw.c*
106 gconf
107 gconf.glade.h
108 gen-devlist
109 +gen-kdb_cmds.c
110 gen_crc32table
111 gen_init_cpio
112 generated
113 genheaders
114 genksyms
115 *_gray256.c
116 +hash
117 +hid-example
118 hpet_example
119 hugepage-mmap
120 hugepage-shm
121 @@ -145,14 +165,14 @@ int32.c
122 int4.c
123 int8.c
124 kallsyms
125 -kconfig
126 +kern_constants.h
127 keywords.c
128 ksym.c*
129 ksym.h*
130 kxgettext
131 lex.c
132 lex.*.c
133 -linux
134 +lib1funcs.S
135 logo_*.c
136 logo_*_clut224.c
137 logo_*_mono.c
138 @@ -162,14 +182,15 @@ mach-types.h
139 machtypes.h
140 map
141 map_hugetlb
142 -media
143 mconf
144 +mdp
145 miboot*
146 mk_elfconfig
147 mkboot
148 mkbugboot
149 mkcpustr
150 mkdep
151 +mkpiggy
152 mkprep
153 mkregtable
154 mktables
155 @@ -185,6 +206,8 @@ oui.c*
156 page-types
157 parse.c
158 parse.h
159 +parse-events*
160 +pasyms.h
161 patches*
162 pca200e.bin
163 pca200e_ecd.bin2
164 @@ -194,6 +217,7 @@ perf-archive
165 piggyback
166 piggy.gzip
167 piggy.S
168 +pmu-*
169 pnmtologo
170 ppc_defs.h*
171 pss_boot.h
172 @@ -203,7 +227,12 @@ r200_reg_safe.h
173 r300_reg_safe.h
174 r420_reg_safe.h
175 r600_reg_safe.h
176 +randomize_layout_hash.h
177 +randomize_layout_seed.h
178 +realmode.lds
179 +realmode.relocs
180 recordmcount
181 +regdb.c
182 relocs
183 rlim_names.h
184 rn50_reg_safe.h
185 @@ -213,8 +242,12 @@ series
186 setup
187 setup.bin
188 setup.elf
189 +signing_key*
190 +size_overflow_hash.h
191 sImage
192 +slabinfo
193 sm_tbl*
194 +sortextable
195 split-include
196 syscalltab.h
197 tables.c
198 @@ -224,6 +257,7 @@ tftpboot.img
199 timeconst.h
200 times.h*
201 trix_boot.h
202 +user_constants.h
203 utsrelease.h*
204 vdso-syms.lds
205 vdso.lds
206 @@ -235,13 +269,17 @@ vdso32.lds
207 vdso32.so.dbg
208 vdso64.lds
209 vdso64.so.dbg
210 +vdsox32.lds
211 +vdsox32-syms.lds
212 version.h*
213 vmImage
214 vmlinux
215 vmlinux-*
216 vmlinux.aout
217 vmlinux.bin.all
218 +vmlinux.bin.bz2
219 vmlinux.lds
220 +vmlinux.relocs
221 vmlinuz
222 voffset.h
223 vsyscall.lds
224 @@ -249,9 +287,12 @@ vsyscall_32.lds
225 wanxlfw.inc
226 uImage
227 unifdef
228 +utsrelease.h
229 wakeup.bin
230 wakeup.elf
231 wakeup.lds
232 +x509*
233 zImage*
234 zconf.hash.c
235 +zconf.lex.c
236 zoffset.h
237 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
238 index 7116fda..d8ed6e8 100644
239 --- a/Documentation/kernel-parameters.txt
240 +++ b/Documentation/kernel-parameters.txt
241 @@ -1084,6 +1084,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
242 Format: <unsigned int> such that (rxsize & ~0x1fffc0) == 0.
243 Default: 1024
244
245 + grsec_proc_gid= [GRKERNSEC_PROC_USERGROUP] Chooses GID to
246 + ignore grsecurity's /proc restrictions
247 +
248 +
249 hashdist= [KNL,NUMA] Large hashes allocated during boot
250 are distributed across NUMA nodes. Defaults on
251 for 64-bit NUMA, off otherwise.
252 @@ -2080,6 +2084,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
253 noexec=on: enable non-executable mappings (default)
254 noexec=off: disable non-executable mappings
255
256 + nopcid [X86-64]
257 + Disable PCID (Process-Context IDentifier) even if it
258 + is supported by the processor.
259 +
260 nosmap [X86]
261 Disable SMAP (Supervisor Mode Access Prevention)
262 even if it is supported by processor.
263 @@ -2347,6 +2355,25 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
264 the specified number of seconds. This is to be used if
265 your oopses keep scrolling off the screen.
266
267 + pax_nouderef [X86] disables UDEREF. Most likely needed under certain
268 + virtualization environments that don't cope well with the
269 + expand down segment used by UDEREF on X86-32 or the frequent
270 + page table updates on X86-64.
271 +
272 + pax_sanitize_slab=
273 + 0/1 to disable/enable slab object sanitization (enabled by
274 + default).
275 +
276 + pax_softmode= 0/1 to disable/enable PaX softmode on boot already.
277 +
278 + pax_extra_latent_entropy
279 + Enable a very simple form of latent entropy extraction
280 + from the first 4GB of memory as the bootmem allocator
281 + passes the memory pages to the buddy allocator.
282 +
283 + pax_weakuderef [X86-64] enables the weaker but faster form of UDEREF
284 + when the processor supports PCID.
285 +
286 pcbit= [HW,ISDN]
287
288 pcd. [PARIDE]
289 diff --git a/Makefile b/Makefile
290 index fa77b0b..dadf5fd 100644
291 --- a/Makefile
292 +++ b/Makefile
293 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
294
295 HOSTCC = gcc
296 HOSTCXX = g++
297 -HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
298 -HOSTCXXFLAGS = -O2
299 +HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
300 +HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
301 +HOSTCXXFLAGS = -O2 -Wall -W -Wno-array-bounds
302
303 # Decide whether to build built-in, modular, or both.
304 # Normally, just do built-in.
305 @@ -423,8 +424,8 @@ export RCS_TAR_IGNORE := --exclude SCCS --exclude BitKeeper --exclude .svn \
306 # Rules shared between *config targets and build targets
307
308 # Basic helpers built in scripts/
309 -PHONY += scripts_basic
310 -scripts_basic:
311 +PHONY += scripts_basic gcc-plugins
312 +scripts_basic: gcc-plugins
313 $(Q)$(MAKE) $(build)=scripts/basic
314 $(Q)rm -f .tmp_quiet_recordmcount
315
316 @@ -585,6 +586,72 @@ else
317 KBUILD_CFLAGS += -O2
318 endif
319
320 +ifndef DISABLE_PAX_PLUGINS
321 +ifeq ($(call cc-ifversion, -ge, 0408, y), y)
322 +PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCXX)" "$(HOSTCXX)" "$(CC)")
323 +else
324 +PLUGINCC := $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(HOSTCXX)" "$(CC)")
325 +endif
326 +ifneq ($(PLUGINCC),)
327 +ifdef CONFIG_PAX_CONSTIFY_PLUGIN
328 +CONSTIFY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN
329 +endif
330 +ifdef CONFIG_PAX_MEMORY_STACKLEAK
331 +STACKLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -DSTACKLEAK_PLUGIN
332 +STACKLEAK_PLUGIN_CFLAGS += -fplugin-arg-stackleak_plugin-track-lowest-sp=100
333 +endif
334 +ifdef CONFIG_KALLOCSTAT_PLUGIN
335 +KALLOCSTAT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so
336 +endif
337 +ifdef CONFIG_PAX_KERNEXEC_PLUGIN
338 +KERNEXEC_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so
339 +KERNEXEC_PLUGIN_CFLAGS += -fplugin-arg-kernexec_plugin-method=$(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD) -DKERNEXEC_PLUGIN
340 +KERNEXEC_PLUGIN_AFLAGS := -DKERNEXEC_PLUGIN
341 +endif
342 +ifdef CONFIG_GRKERNSEC_RANDSTRUCT
343 +RANDSTRUCT_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/randomize_layout_plugin.so -DRANDSTRUCT_PLUGIN
344 +ifdef CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE
345 +RANDSTRUCT_PLUGIN_CFLAGS += -fplugin-arg-randomize_layout_plugin-performance-mode
346 +endif
347 +endif
348 +ifdef CONFIG_CHECKER_PLUGIN
349 +ifeq ($(call cc-ifversion, -ge, 0406, y), y)
350 +CHECKER_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN
351 +endif
352 +endif
353 +COLORIZE_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/colorize_plugin.so
354 +ifdef CONFIG_PAX_SIZE_OVERFLOW
355 +SIZE_OVERFLOW_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/size_overflow_plugin/size_overflow_plugin.so -DSIZE_OVERFLOW_PLUGIN
356 +endif
357 +ifdef CONFIG_PAX_LATENT_ENTROPY
358 +LATENT_ENTROPY_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/latent_entropy_plugin.so -DLATENT_ENTROPY_PLUGIN
359 +endif
360 +ifdef CONFIG_PAX_MEMORY_STRUCTLEAK
361 +STRUCTLEAK_PLUGIN_CFLAGS := -fplugin=$(objtree)/tools/gcc/structleak_plugin.so -DSTRUCTLEAK_PLUGIN
362 +endif
363 +GCC_PLUGINS_CFLAGS := $(CONSTIFY_PLUGIN_CFLAGS) $(STACKLEAK_PLUGIN_CFLAGS) $(KALLOCSTAT_PLUGIN_CFLAGS)
364 +GCC_PLUGINS_CFLAGS += $(KERNEXEC_PLUGIN_CFLAGS) $(CHECKER_PLUGIN_CFLAGS) $(COLORIZE_PLUGIN_CFLAGS)
365 +GCC_PLUGINS_CFLAGS += $(SIZE_OVERFLOW_PLUGIN_CFLAGS) $(LATENT_ENTROPY_PLUGIN_CFLAGS) $(STRUCTLEAK_PLUGIN_CFLAGS)
366 +GCC_PLUGINS_CFLAGS += $(RANDSTRUCT_PLUGIN_CFLAGS)
367 +GCC_PLUGINS_AFLAGS := $(KERNEXEC_PLUGIN_AFLAGS)
368 +export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS CONSTIFY_PLUGIN LATENT_ENTROPY_PLUGIN_CFLAGS
369 +ifeq ($(KBUILD_EXTMOD),)
370 +gcc-plugins:
371 + $(Q)$(MAKE) $(build)=tools/gcc
372 +else
373 +gcc-plugins: ;
374 +endif
375 +else
376 +gcc-plugins:
377 +ifeq ($(call cc-ifversion, -ge, 0405, y), y)
378 + $(error Your gcc installation does not support plugins. If the necessary headers for plugin support are missing, they should be installed. On Debian, apt-get install gcc-<ver>-plugin-dev. If you choose to ignore this error and lessen the improvements provided by this patch, re-run make with the DISABLE_PAX_PLUGINS=y argument.))
379 +else
380 + $(Q)echo "warning, your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least"
381 +endif
382 + $(Q)echo "PAX_MEMORY_STACKLEAK, constification, PAX_LATENT_ENTROPY and other features will be less secure. PAX_SIZE_OVERFLOW will not be active."
383 +endif
384 +endif
385 +
386 include $(srctree)/arch/$(SRCARCH)/Makefile
387
388 ifdef CONFIG_READABLE_ASM
389 @@ -779,7 +846,7 @@ export mod_sign_cmd
390
391
392 ifeq ($(KBUILD_EXTMOD),)
393 -core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
394 +core-y += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
395
396 vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
397 $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
398 @@ -828,6 +895,8 @@ endif
399
400 # The actual objects are generated when descending,
401 # make sure no implicit rule kicks in
402 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
403 +$(filter-out $(init-y),$(vmlinux-deps)): KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
404 $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
405
406 # Handle descending into subdirectories listed in $(vmlinux-dirs)
407 @@ -837,7 +906,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
408 # Error messages still appears in the original language
409
410 PHONY += $(vmlinux-dirs)
411 -$(vmlinux-dirs): prepare scripts
412 +$(vmlinux-dirs): gcc-plugins prepare scripts
413 $(Q)$(MAKE) $(build)=$@
414
415 define filechk_kernel.release
416 @@ -880,10 +949,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
417
418 archprepare: archheaders archscripts prepare1 scripts_basic
419
420 +prepare0: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
421 +prepare0: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
422 prepare0: archprepare FORCE
423 $(Q)$(MAKE) $(build)=.
424
425 # All the preparing..
426 +prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
427 prepare: prepare0
428
429 # Generate some files
430 @@ -991,6 +1063,8 @@ all: modules
431 # using awk while concatenating to the final file.
432
433 PHONY += modules
434 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
435 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
436 modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
437 $(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
438 @$(kecho) ' Building modules, stage 2.';
439 @@ -1006,7 +1080,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
440
441 # Target to prepare building external modules
442 PHONY += modules_prepare
443 -modules_prepare: prepare scripts
444 +modules_prepare: gcc-plugins prepare scripts
445
446 # Target to install modules
447 PHONY += modules_install
448 @@ -1072,7 +1146,10 @@ MRPROPER_FILES += .config .config.old .version .old_version $(version_h) \
449 Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
450 signing_key.priv signing_key.x509 x509.genkey \
451 extra_certificates signing_key.x509.keyid \
452 - signing_key.x509.signer
453 + signing_key.x509.signer \
454 + tools/gcc/size_overflow_plugin/size_overflow_hash_aux.h \
455 + tools/gcc/size_overflow_plugin/size_overflow_hash.h \
456 + tools/gcc/randomize_layout_seed.h
457
458 # clean - Delete most, but leave enough to build external modules
459 #
460 @@ -1112,6 +1189,7 @@ distclean: mrproper
461 \( -name '*.orig' -o -name '*.rej' -o -name '*~' \
462 -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
463 -o -name '.*.rej' \
464 + -o -name '.*.rej' -o -name '*.so' \
465 -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
466 -type f -print | xargs rm -f
467
468 @@ -1273,6 +1351,8 @@ PHONY += $(module-dirs) modules
469 $(module-dirs): crmodverdir $(objtree)/Module.symvers
470 $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
471
472 +modules: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
473 +modules: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
474 modules: $(module-dirs)
475 @$(kecho) ' Building modules, stage 2.';
476 $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
477 @@ -1412,17 +1492,21 @@ else
478 target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
479 endif
480
481 -%.s: %.c prepare scripts FORCE
482 +%.s: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
483 +%.s: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
484 +%.s: %.c gcc-plugins prepare scripts FORCE
485 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
486 %.i: %.c prepare scripts FORCE
487 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
488 -%.o: %.c prepare scripts FORCE
489 +%.o: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
490 +%.o: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
491 +%.o: %.c gcc-plugins prepare scripts FORCE
492 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
493 %.lst: %.c prepare scripts FORCE
494 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
495 -%.s: %.S prepare scripts FORCE
496 +%.s: %.S gcc-plugins prepare scripts FORCE
497 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
498 -%.o: %.S prepare scripts FORCE
499 +%.o: %.S gcc-plugins prepare scripts FORCE
500 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
501 %.symtypes: %.c prepare scripts FORCE
502 $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
503 @@ -1432,11 +1516,15 @@ endif
504 $(cmd_crmodverdir)
505 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
506 $(build)=$(build-dir)
507 -%/: prepare scripts FORCE
508 +%/: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
509 +%/: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
510 +%/: gcc-plugins prepare scripts FORCE
511 $(cmd_crmodverdir)
512 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
513 $(build)=$(build-dir)
514 -%.ko: prepare scripts FORCE
515 +%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
516 +%.ko: KBUILD_AFLAGS += $(GCC_PLUGINS_AFLAGS)
517 +%.ko: gcc-plugins prepare scripts FORCE
518 $(cmd_crmodverdir)
519 $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
520 $(build)=$(build-dir) $(@:.ko=.o)
521 diff --git a/arch/alpha/include/asm/atomic.h b/arch/alpha/include/asm/atomic.h
522 index 78b03ef..da28a51 100644
523 --- a/arch/alpha/include/asm/atomic.h
524 +++ b/arch/alpha/include/asm/atomic.h
525 @@ -292,6 +292,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
526 #define atomic_dec(v) atomic_sub(1,(v))
527 #define atomic64_dec(v) atomic64_sub(1,(v))
528
529 +#define atomic64_read_unchecked(v) atomic64_read(v)
530 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
531 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
532 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
533 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
534 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
535 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
536 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
537 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
538 +
539 #define smp_mb__before_atomic_dec() smp_mb()
540 #define smp_mb__after_atomic_dec() smp_mb()
541 #define smp_mb__before_atomic_inc() smp_mb()
542 diff --git a/arch/alpha/include/asm/cache.h b/arch/alpha/include/asm/cache.h
543 index ad368a9..fbe0f25 100644
544 --- a/arch/alpha/include/asm/cache.h
545 +++ b/arch/alpha/include/asm/cache.h
546 @@ -4,19 +4,19 @@
547 #ifndef __ARCH_ALPHA_CACHE_H
548 #define __ARCH_ALPHA_CACHE_H
549
550 +#include <linux/const.h>
551
552 /* Bytes per L1 (data) cache line. */
553 #if defined(CONFIG_ALPHA_GENERIC) || defined(CONFIG_ALPHA_EV6)
554 -# define L1_CACHE_BYTES 64
555 # define L1_CACHE_SHIFT 6
556 #else
557 /* Both EV4 and EV5 are write-through, read-allocate,
558 direct-mapped, physical.
559 */
560 -# define L1_CACHE_BYTES 32
561 # define L1_CACHE_SHIFT 5
562 #endif
563
564 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
565 #define SMP_CACHE_BYTES L1_CACHE_BYTES
566
567 #endif
568 diff --git a/arch/alpha/include/asm/elf.h b/arch/alpha/include/asm/elf.h
569 index 968d999..d36b2df 100644
570 --- a/arch/alpha/include/asm/elf.h
571 +++ b/arch/alpha/include/asm/elf.h
572 @@ -91,6 +91,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
573
574 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x1000000)
575
576 +#ifdef CONFIG_PAX_ASLR
577 +#define PAX_ELF_ET_DYN_BASE (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
578 +
579 +#define PAX_DELTA_MMAP_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
580 +#define PAX_DELTA_STACK_LEN (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
581 +#endif
582 +
583 /* $0 is set by ld.so to a pointer to a function which might be
584 registered using atexit. This provides a mean for the dynamic
585 linker to call DT_FINI functions for shared libraries that have
586 diff --git a/arch/alpha/include/asm/pgalloc.h b/arch/alpha/include/asm/pgalloc.h
587 index aab14a0..b4fa3e7 100644
588 --- a/arch/alpha/include/asm/pgalloc.h
589 +++ b/arch/alpha/include/asm/pgalloc.h
590 @@ -29,6 +29,12 @@ pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
591 pgd_set(pgd, pmd);
592 }
593
594 +static inline void
595 +pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
596 +{
597 + pgd_populate(mm, pgd, pmd);
598 +}
599 +
600 extern pgd_t *pgd_alloc(struct mm_struct *mm);
601
602 static inline void
603 diff --git a/arch/alpha/include/asm/pgtable.h b/arch/alpha/include/asm/pgtable.h
604 index d8f9b7e..f6222fa 100644
605 --- a/arch/alpha/include/asm/pgtable.h
606 +++ b/arch/alpha/include/asm/pgtable.h
607 @@ -102,6 +102,17 @@ struct vm_area_struct;
608 #define PAGE_SHARED __pgprot(_PAGE_VALID | __ACCESS_BITS)
609 #define PAGE_COPY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
610 #define PAGE_READONLY __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
611 +
612 +#ifdef CONFIG_PAX_PAGEEXEC
613 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
614 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
615 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
616 +#else
617 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
618 +# define PAGE_COPY_NOEXEC PAGE_COPY
619 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
620 +#endif
621 +
622 #define PAGE_KERNEL __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
623
624 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
625 diff --git a/arch/alpha/kernel/module.c b/arch/alpha/kernel/module.c
626 index 2fd00b7..cfd5069 100644
627 --- a/arch/alpha/kernel/module.c
628 +++ b/arch/alpha/kernel/module.c
629 @@ -160,7 +160,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, const char *strtab,
630
631 /* The small sections were sorted to the end of the segment.
632 The following should definitely cover them. */
633 - gp = (u64)me->module_core + me->core_size - 0x8000;
634 + gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
635 got = sechdrs[me->arch.gotsecindex].sh_addr;
636
637 for (i = 0; i < n; i++) {
638 diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
639 index 1402fcc..0b1abd2 100644
640 --- a/arch/alpha/kernel/osf_sys.c
641 +++ b/arch/alpha/kernel/osf_sys.c
642 @@ -1298,10 +1298,11 @@ SYSCALL_DEFINE1(old_adjtimex, struct timex32 __user *, txc_p)
643 generic version except that we know how to honor ADDR_LIMIT_32BIT. */
644
645 static unsigned long
646 -arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
647 - unsigned long limit)
648 +arch_get_unmapped_area_1(struct file *filp, unsigned long addr, unsigned long len,
649 + unsigned long limit, unsigned long flags)
650 {
651 struct vm_unmapped_area_info info;
652 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
653
654 info.flags = 0;
655 info.length = len;
656 @@ -1309,6 +1310,7 @@ arch_get_unmapped_area_1(unsigned long addr, unsigned long len,
657 info.high_limit = limit;
658 info.align_mask = 0;
659 info.align_offset = 0;
660 + info.threadstack_offset = offset;
661 return vm_unmapped_area(&info);
662 }
663
664 @@ -1341,20 +1343,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
665 merely specific addresses, but regions of memory -- perhaps
666 this feature should be incorporated into all ports? */
667
668 +#ifdef CONFIG_PAX_RANDMMAP
669 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
670 +#endif
671 +
672 if (addr) {
673 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
674 + addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(addr), len, limit, flags);
675 if (addr != (unsigned long) -ENOMEM)
676 return addr;
677 }
678
679 /* Next, try allocating at TASK_UNMAPPED_BASE. */
680 - addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
681 - len, limit);
682 + addr = arch_get_unmapped_area_1 (filp, PAGE_ALIGN(current->mm->mmap_base), len, limit, flags);
683 +
684 if (addr != (unsigned long) -ENOMEM)
685 return addr;
686
687 /* Finally, try allocating in low memory. */
688 - addr = arch_get_unmapped_area_1 (PAGE_SIZE, len, limit);
689 + addr = arch_get_unmapped_area_1 (filp, PAGE_SIZE, len, limit, flags);
690
691 return addr;
692 }
693 diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
694 index 98838a0..b304fb4 100644
695 --- a/arch/alpha/mm/fault.c
696 +++ b/arch/alpha/mm/fault.c
697 @@ -53,6 +53,124 @@ __load_new_mm_context(struct mm_struct *next_mm)
698 __reload_thread(pcb);
699 }
700
701 +#ifdef CONFIG_PAX_PAGEEXEC
702 +/*
703 + * PaX: decide what to do with offenders (regs->pc = fault address)
704 + *
705 + * returns 1 when task should be killed
706 + * 2 when patched PLT trampoline was detected
707 + * 3 when unpatched PLT trampoline was detected
708 + */
709 +static int pax_handle_fetch_fault(struct pt_regs *regs)
710 +{
711 +
712 +#ifdef CONFIG_PAX_EMUPLT
713 + int err;
714 +
715 + do { /* PaX: patched PLT emulation #1 */
716 + unsigned int ldah, ldq, jmp;
717 +
718 + err = get_user(ldah, (unsigned int *)regs->pc);
719 + err |= get_user(ldq, (unsigned int *)(regs->pc+4));
720 + err |= get_user(jmp, (unsigned int *)(regs->pc+8));
721 +
722 + if (err)
723 + break;
724 +
725 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
726 + (ldq & 0xFFFF0000U) == 0xA77B0000U &&
727 + jmp == 0x6BFB0000U)
728 + {
729 + unsigned long r27, addr;
730 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
731 + unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
732 +
733 + addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
734 + err = get_user(r27, (unsigned long *)addr);
735 + if (err)
736 + break;
737 +
738 + regs->r27 = r27;
739 + regs->pc = r27;
740 + return 2;
741 + }
742 + } while (0);
743 +
744 + do { /* PaX: patched PLT emulation #2 */
745 + unsigned int ldah, lda, br;
746 +
747 + err = get_user(ldah, (unsigned int *)regs->pc);
748 + err |= get_user(lda, (unsigned int *)(regs->pc+4));
749 + err |= get_user(br, (unsigned int *)(regs->pc+8));
750 +
751 + if (err)
752 + break;
753 +
754 + if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
755 + (lda & 0xFFFF0000U) == 0xA77B0000U &&
756 + (br & 0xFFE00000U) == 0xC3E00000U)
757 + {
758 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
759 + unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
760 + unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
761 +
762 + regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
763 + regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
764 + return 2;
765 + }
766 + } while (0);
767 +
768 + do { /* PaX: unpatched PLT emulation */
769 + unsigned int br;
770 +
771 + err = get_user(br, (unsigned int *)regs->pc);
772 +
773 + if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
774 + unsigned int br2, ldq, nop, jmp;
775 + unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
776 +
777 + addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
778 + err = get_user(br2, (unsigned int *)addr);
779 + err |= get_user(ldq, (unsigned int *)(addr+4));
780 + err |= get_user(nop, (unsigned int *)(addr+8));
781 + err |= get_user(jmp, (unsigned int *)(addr+12));
782 + err |= get_user(resolver, (unsigned long *)(addr+16));
783 +
784 + if (err)
785 + break;
786 +
787 + if (br2 == 0xC3600000U &&
788 + ldq == 0xA77B000CU &&
789 + nop == 0x47FF041FU &&
790 + jmp == 0x6B7B0000U)
791 + {
792 + regs->r28 = regs->pc+4;
793 + regs->r27 = addr+16;
794 + regs->pc = resolver;
795 + return 3;
796 + }
797 + }
798 + } while (0);
799 +#endif
800 +
801 + return 1;
802 +}
803 +
804 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
805 +{
806 + unsigned long i;
807 +
808 + printk(KERN_ERR "PAX: bytes at PC: ");
809 + for (i = 0; i < 5; i++) {
810 + unsigned int c;
811 + if (get_user(c, (unsigned int *)pc+i))
812 + printk(KERN_CONT "???????? ");
813 + else
814 + printk(KERN_CONT "%08x ", c);
815 + }
816 + printk("\n");
817 +}
818 +#endif
819
820 /*
821 * This routine handles page faults. It determines the address,
822 @@ -133,8 +251,29 @@ retry:
823 good_area:
824 si_code = SEGV_ACCERR;
825 if (cause < 0) {
826 - if (!(vma->vm_flags & VM_EXEC))
827 + if (!(vma->vm_flags & VM_EXEC)) {
828 +
829 +#ifdef CONFIG_PAX_PAGEEXEC
830 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
831 + goto bad_area;
832 +
833 + up_read(&mm->mmap_sem);
834 + switch (pax_handle_fetch_fault(regs)) {
835 +
836 +#ifdef CONFIG_PAX_EMUPLT
837 + case 2:
838 + case 3:
839 + return;
840 +#endif
841 +
842 + }
843 + pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
844 + do_group_exit(SIGKILL);
845 +#else
846 goto bad_area;
847 +#endif
848 +
849 + }
850 } else if (!cause) {
851 /* Allow reads even for write-only mappings */
852 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
853 diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
854 index 44298ad..29a20c0 100644
855 --- a/arch/arm/Kconfig
856 +++ b/arch/arm/Kconfig
857 @@ -1862,7 +1862,7 @@ config ALIGNMENT_TRAP
858
859 config UACCESS_WITH_MEMCPY
860 bool "Use kernel mem{cpy,set}() for {copy_to,clear}_user()"
861 - depends on MMU
862 + depends on MMU && !PAX_MEMORY_UDEREF
863 default y if CPU_FEROCEON
864 help
865 Implement faster copy_to_user and clear_user methods for CPU
866 @@ -2125,6 +2125,7 @@ config XIP_PHYS_ADDR
867 config KEXEC
868 bool "Kexec system call (EXPERIMENTAL)"
869 depends on (!SMP || PM_SLEEP_SMP)
870 + depends on !GRKERNSEC_KMEM
871 help
872 kexec is a system call that implements the ability to shutdown your
873 current kernel, and to start another kernel. It is like a reboot
874 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
875 index 62d2cb5..09d45e3 100644
876 --- a/arch/arm/include/asm/atomic.h
877 +++ b/arch/arm/include/asm/atomic.h
878 @@ -18,17 +18,35 @@
879 #include <asm/barrier.h>
880 #include <asm/cmpxchg.h>
881
882 +#ifdef CONFIG_GENERIC_ATOMIC64
883 +#include <asm-generic/atomic64.h>
884 +#endif
885 +
886 #define ATOMIC_INIT(i) { (i) }
887
888 #ifdef __KERNEL__
889
890 +#define _ASM_EXTABLE(from, to) \
891 +" .pushsection __ex_table,\"a\"\n"\
892 +" .align 3\n" \
893 +" .long " #from ", " #to"\n" \
894 +" .popsection"
895 +
896 /*
897 * On ARM, ordinary assignment (str instruction) doesn't clear the local
898 * strex/ldrex monitor on some implementations. The reason we can use it for
899 * atomic_set() is the clrex or dummy strex done on every exception return.
900 */
901 #define atomic_read(v) (*(volatile int *)&(v)->counter)
902 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
903 +{
904 + return v->counter;
905 +}
906 #define atomic_set(v,i) (((v)->counter) = (i))
907 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
908 +{
909 + v->counter = i;
910 +}
911
912 #if __LINUX_ARM_ARCH__ >= 6
913
914 @@ -44,6 +62,36 @@ static inline void atomic_add(int i, atomic_t *v)
915
916 prefetchw(&v->counter);
917 __asm__ __volatile__("@ atomic_add\n"
918 +"1: ldrex %1, [%3]\n"
919 +" adds %0, %1, %4\n"
920 +
921 +#ifdef CONFIG_PAX_REFCOUNT
922 +" bvc 3f\n"
923 +"2: bkpt 0xf103\n"
924 +"3:\n"
925 +#endif
926 +
927 +" strex %1, %0, [%3]\n"
928 +" teq %1, #0\n"
929 +" bne 1b"
930 +
931 +#ifdef CONFIG_PAX_REFCOUNT
932 +"\n4:\n"
933 + _ASM_EXTABLE(2b, 4b)
934 +#endif
935 +
936 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
937 + : "r" (&v->counter), "Ir" (i)
938 + : "cc");
939 +}
940 +
941 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
942 +{
943 + unsigned long tmp;
944 + int result;
945 +
946 + prefetchw(&v->counter);
947 + __asm__ __volatile__("@ atomic_add_unchecked\n"
948 "1: ldrex %0, [%3]\n"
949 " add %0, %0, %4\n"
950 " strex %1, %0, [%3]\n"
951 @@ -62,6 +110,42 @@ static inline int atomic_add_return(int i, atomic_t *v)
952 smp_mb();
953
954 __asm__ __volatile__("@ atomic_add_return\n"
955 +"1: ldrex %1, [%3]\n"
956 +" adds %0, %1, %4\n"
957 +
958 +#ifdef CONFIG_PAX_REFCOUNT
959 +" bvc 3f\n"
960 +" mov %0, %1\n"
961 +"2: bkpt 0xf103\n"
962 +"3:\n"
963 +#endif
964 +
965 +" strex %1, %0, [%3]\n"
966 +" teq %1, #0\n"
967 +" bne 1b"
968 +
969 +#ifdef CONFIG_PAX_REFCOUNT
970 +"\n4:\n"
971 + _ASM_EXTABLE(2b, 4b)
972 +#endif
973 +
974 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
975 + : "r" (&v->counter), "Ir" (i)
976 + : "cc");
977 +
978 + smp_mb();
979 +
980 + return result;
981 +}
982 +
983 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
984 +{
985 + unsigned long tmp;
986 + int result;
987 +
988 + smp_mb();
989 +
990 + __asm__ __volatile__("@ atomic_add_return_unchecked\n"
991 "1: ldrex %0, [%3]\n"
992 " add %0, %0, %4\n"
993 " strex %1, %0, [%3]\n"
994 @@ -83,6 +167,36 @@ static inline void atomic_sub(int i, atomic_t *v)
995
996 prefetchw(&v->counter);
997 __asm__ __volatile__("@ atomic_sub\n"
998 +"1: ldrex %1, [%3]\n"
999 +" subs %0, %1, %4\n"
1000 +
1001 +#ifdef CONFIG_PAX_REFCOUNT
1002 +" bvc 3f\n"
1003 +"2: bkpt 0xf103\n"
1004 +"3:\n"
1005 +#endif
1006 +
1007 +" strex %1, %0, [%3]\n"
1008 +" teq %1, #0\n"
1009 +" bne 1b"
1010 +
1011 +#ifdef CONFIG_PAX_REFCOUNT
1012 +"\n4:\n"
1013 + _ASM_EXTABLE(2b, 4b)
1014 +#endif
1015 +
1016 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1017 + : "r" (&v->counter), "Ir" (i)
1018 + : "cc");
1019 +}
1020 +
1021 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
1022 +{
1023 + unsigned long tmp;
1024 + int result;
1025 +
1026 + prefetchw(&v->counter);
1027 + __asm__ __volatile__("@ atomic_sub_unchecked\n"
1028 "1: ldrex %0, [%3]\n"
1029 " sub %0, %0, %4\n"
1030 " strex %1, %0, [%3]\n"
1031 @@ -101,11 +215,25 @@ static inline int atomic_sub_return(int i, atomic_t *v)
1032 smp_mb();
1033
1034 __asm__ __volatile__("@ atomic_sub_return\n"
1035 -"1: ldrex %0, [%3]\n"
1036 -" sub %0, %0, %4\n"
1037 +"1: ldrex %1, [%3]\n"
1038 +" subs %0, %1, %4\n"
1039 +
1040 +#ifdef CONFIG_PAX_REFCOUNT
1041 +" bvc 3f\n"
1042 +" mov %0, %1\n"
1043 +"2: bkpt 0xf103\n"
1044 +"3:\n"
1045 +#endif
1046 +
1047 " strex %1, %0, [%3]\n"
1048 " teq %1, #0\n"
1049 " bne 1b"
1050 +
1051 +#ifdef CONFIG_PAX_REFCOUNT
1052 +"\n4:\n"
1053 + _ASM_EXTABLE(2b, 4b)
1054 +#endif
1055 +
1056 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1057 : "r" (&v->counter), "Ir" (i)
1058 : "cc");
1059 @@ -138,6 +266,28 @@ static inline int atomic_cmpxchg(atomic_t *ptr, int old, int new)
1060 return oldval;
1061 }
1062
1063 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *ptr, int old, int new)
1064 +{
1065 + unsigned long oldval, res;
1066 +
1067 + smp_mb();
1068 +
1069 + do {
1070 + __asm__ __volatile__("@ atomic_cmpxchg_unchecked\n"
1071 + "ldrex %1, [%3]\n"
1072 + "mov %0, #0\n"
1073 + "teq %1, %4\n"
1074 + "strexeq %0, %5, [%3]\n"
1075 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1076 + : "r" (&ptr->counter), "Ir" (old), "r" (new)
1077 + : "cc");
1078 + } while (res);
1079 +
1080 + smp_mb();
1081 +
1082 + return oldval;
1083 +}
1084 +
1085 #else /* ARM_ARCH_6 */
1086
1087 #ifdef CONFIG_SMP
1088 @@ -156,7 +306,17 @@ static inline int atomic_add_return(int i, atomic_t *v)
1089
1090 return val;
1091 }
1092 +
1093 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
1094 +{
1095 + return atomic_add_return(i, v);
1096 +}
1097 +
1098 #define atomic_add(i, v) (void) atomic_add_return(i, v)
1099 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
1100 +{
1101 + (void) atomic_add_return(i, v);
1102 +}
1103
1104 static inline int atomic_sub_return(int i, atomic_t *v)
1105 {
1106 @@ -171,6 +331,10 @@ static inline int atomic_sub_return(int i, atomic_t *v)
1107 return val;
1108 }
1109 #define atomic_sub(i, v) (void) atomic_sub_return(i, v)
1110 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
1111 +{
1112 + (void) atomic_sub_return(i, v);
1113 +}
1114
1115 static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1116 {
1117 @@ -186,9 +350,18 @@ static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
1118 return ret;
1119 }
1120
1121 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
1122 +{
1123 + return atomic_cmpxchg(v, old, new);
1124 +}
1125 +
1126 #endif /* __LINUX_ARM_ARCH__ */
1127
1128 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
1129 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
1130 +{
1131 + return xchg(&v->counter, new);
1132 +}
1133
1134 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1135 {
1136 @@ -201,11 +374,27 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
1137 }
1138
1139 #define atomic_inc(v) atomic_add(1, v)
1140 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
1141 +{
1142 + atomic_add_unchecked(1, v);
1143 +}
1144 #define atomic_dec(v) atomic_sub(1, v)
1145 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
1146 +{
1147 + atomic_sub_unchecked(1, v);
1148 +}
1149
1150 #define atomic_inc_and_test(v) (atomic_add_return(1, v) == 0)
1151 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
1152 +{
1153 + return atomic_add_return_unchecked(1, v) == 0;
1154 +}
1155 #define atomic_dec_and_test(v) (atomic_sub_return(1, v) == 0)
1156 #define atomic_inc_return(v) (atomic_add_return(1, v))
1157 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
1158 +{
1159 + return atomic_add_return_unchecked(1, v);
1160 +}
1161 #define atomic_dec_return(v) (atomic_sub_return(1, v))
1162 #define atomic_sub_and_test(i, v) (atomic_sub_return(i, v) == 0)
1163
1164 @@ -221,6 +410,14 @@ typedef struct {
1165 long long counter;
1166 } atomic64_t;
1167
1168 +#ifdef CONFIG_PAX_REFCOUNT
1169 +typedef struct {
1170 + long long counter;
1171 +} atomic64_unchecked_t;
1172 +#else
1173 +typedef atomic64_t atomic64_unchecked_t;
1174 +#endif
1175 +
1176 #define ATOMIC64_INIT(i) { (i) }
1177
1178 #ifdef CONFIG_ARM_LPAE
1179 @@ -237,6 +434,19 @@ static inline long long atomic64_read(const atomic64_t *v)
1180 return result;
1181 }
1182
1183 +static inline long long atomic64_read_unchecked(const atomic64_unchecked_t *v)
1184 +{
1185 + long long result;
1186 +
1187 + __asm__ __volatile__("@ atomic64_read_unchecked\n"
1188 +" ldrd %0, %H0, [%1]"
1189 + : "=&r" (result)
1190 + : "r" (&v->counter), "Qo" (v->counter)
1191 + );
1192 +
1193 + return result;
1194 +}
1195 +
1196 static inline void atomic64_set(atomic64_t *v, long long i)
1197 {
1198 __asm__ __volatile__("@ atomic64_set\n"
1199 @@ -245,6 +455,15 @@ static inline void atomic64_set(atomic64_t *v, long long i)
1200 : "r" (&v->counter), "r" (i)
1201 );
1202 }
1203 +
1204 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
1205 +{
1206 + __asm__ __volatile__("@ atomic64_set_unchecked\n"
1207 +" strd %2, %H2, [%1]"
1208 + : "=Qo" (v->counter)
1209 + : "r" (&v->counter), "r" (i)
1210 + );
1211 +}
1212 #else
1213 static inline long long atomic64_read(const atomic64_t *v)
1214 {
1215 @@ -259,6 +478,19 @@ static inline long long atomic64_read(const atomic64_t *v)
1216 return result;
1217 }
1218
1219 +static inline long long atomic64_read_unchecked(const atomic64_unchecked_t *v)
1220 +{
1221 + long long result;
1222 +
1223 + __asm__ __volatile__("@ atomic64_read_unchecked\n"
1224 +" ldrexd %0, %H0, [%1]"
1225 + : "=&r" (result)
1226 + : "r" (&v->counter), "Qo" (v->counter)
1227 + );
1228 +
1229 + return result;
1230 +}
1231 +
1232 static inline void atomic64_set(atomic64_t *v, long long i)
1233 {
1234 long long tmp;
1235 @@ -273,6 +505,21 @@ static inline void atomic64_set(atomic64_t *v, long long i)
1236 : "r" (&v->counter), "r" (i)
1237 : "cc");
1238 }
1239 +
1240 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
1241 +{
1242 + long long tmp;
1243 +
1244 + prefetchw(&v->counter);
1245 + __asm__ __volatile__("@ atomic64_set_unchecked\n"
1246 +"1: ldrexd %0, %H0, [%2]\n"
1247 +" strexd %0, %3, %H3, [%2]\n"
1248 +" teq %0, #0\n"
1249 +" bne 1b"
1250 + : "=&r" (tmp), "=Qo" (v->counter)
1251 + : "r" (&v->counter), "r" (i)
1252 + : "cc");
1253 +}
1254 #endif
1255
1256 static inline void atomic64_add(long long i, atomic64_t *v)
1257 @@ -284,6 +531,37 @@ static inline void atomic64_add(long long i, atomic64_t *v)
1258 __asm__ __volatile__("@ atomic64_add\n"
1259 "1: ldrexd %0, %H0, [%3]\n"
1260 " adds %Q0, %Q0, %Q4\n"
1261 +" adcs %R0, %R0, %R4\n"
1262 +
1263 +#ifdef CONFIG_PAX_REFCOUNT
1264 +" bvc 3f\n"
1265 +"2: bkpt 0xf103\n"
1266 +"3:\n"
1267 +#endif
1268 +
1269 +" strexd %1, %0, %H0, [%3]\n"
1270 +" teq %1, #0\n"
1271 +" bne 1b"
1272 +
1273 +#ifdef CONFIG_PAX_REFCOUNT
1274 +"\n4:\n"
1275 + _ASM_EXTABLE(2b, 4b)
1276 +#endif
1277 +
1278 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1279 + : "r" (&v->counter), "r" (i)
1280 + : "cc");
1281 +}
1282 +
1283 +static inline void atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
1284 +{
1285 + long long result;
1286 + unsigned long tmp;
1287 +
1288 + prefetchw(&v->counter);
1289 + __asm__ __volatile__("@ atomic64_add_unchecked\n"
1290 +"1: ldrexd %0, %H0, [%3]\n"
1291 +" adds %Q0, %Q0, %Q4\n"
1292 " adc %R0, %R0, %R4\n"
1293 " strexd %1, %0, %H0, [%3]\n"
1294 " teq %1, #0\n"
1295 @@ -303,6 +581,44 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
1296 __asm__ __volatile__("@ atomic64_add_return\n"
1297 "1: ldrexd %0, %H0, [%3]\n"
1298 " adds %Q0, %Q0, %Q4\n"
1299 +" adcs %R0, %R0, %R4\n"
1300 +
1301 +#ifdef CONFIG_PAX_REFCOUNT
1302 +" bvc 3f\n"
1303 +" mov %0, %1\n"
1304 +" mov %H0, %H1\n"
1305 +"2: bkpt 0xf103\n"
1306 +"3:\n"
1307 +#endif
1308 +
1309 +" strexd %1, %0, %H0, [%3]\n"
1310 +" teq %1, #0\n"
1311 +" bne 1b"
1312 +
1313 +#ifdef CONFIG_PAX_REFCOUNT
1314 +"\n4:\n"
1315 + _ASM_EXTABLE(2b, 4b)
1316 +#endif
1317 +
1318 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1319 + : "r" (&v->counter), "r" (i)
1320 + : "cc");
1321 +
1322 + smp_mb();
1323 +
1324 + return result;
1325 +}
1326 +
1327 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
1328 +{
1329 + long long result;
1330 + unsigned long tmp;
1331 +
1332 + smp_mb();
1333 +
1334 + __asm__ __volatile__("@ atomic64_add_return_unchecked\n"
1335 +"1: ldrexd %0, %H0, [%3]\n"
1336 +" adds %Q0, %Q0, %Q4\n"
1337 " adc %R0, %R0, %R4\n"
1338 " strexd %1, %0, %H0, [%3]\n"
1339 " teq %1, #0\n"
1340 @@ -325,6 +641,37 @@ static inline void atomic64_sub(long long i, atomic64_t *v)
1341 __asm__ __volatile__("@ atomic64_sub\n"
1342 "1: ldrexd %0, %H0, [%3]\n"
1343 " subs %Q0, %Q0, %Q4\n"
1344 +" sbcs %R0, %R0, %R4\n"
1345 +
1346 +#ifdef CONFIG_PAX_REFCOUNT
1347 +" bvc 3f\n"
1348 +"2: bkpt 0xf103\n"
1349 +"3:\n"
1350 +#endif
1351 +
1352 +" strexd %1, %0, %H0, [%3]\n"
1353 +" teq %1, #0\n"
1354 +" bne 1b"
1355 +
1356 +#ifdef CONFIG_PAX_REFCOUNT
1357 +"\n4:\n"
1358 + _ASM_EXTABLE(2b, 4b)
1359 +#endif
1360 +
1361 + : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1362 + : "r" (&v->counter), "r" (i)
1363 + : "cc");
1364 +}
1365 +
1366 +static inline void atomic64_sub_unchecked(long long i, atomic64_unchecked_t *v)
1367 +{
1368 + long long result;
1369 + unsigned long tmp;
1370 +
1371 + prefetchw(&v->counter);
1372 + __asm__ __volatile__("@ atomic64_sub_unchecked\n"
1373 +"1: ldrexd %0, %H0, [%3]\n"
1374 +" subs %Q0, %Q0, %Q4\n"
1375 " sbc %R0, %R0, %R4\n"
1376 " strexd %1, %0, %H0, [%3]\n"
1377 " teq %1, #0\n"
1378 @@ -344,16 +691,29 @@ static inline long long atomic64_sub_return(long long i, atomic64_t *v)
1379 __asm__ __volatile__("@ atomic64_sub_return\n"
1380 "1: ldrexd %0, %H0, [%3]\n"
1381 " subs %Q0, %Q0, %Q4\n"
1382 -" sbc %R0, %R0, %R4\n"
1383 +" sbcs %R0, %R0, %R4\n"
1384 +
1385 +#ifdef CONFIG_PAX_REFCOUNT
1386 +" bvc 3f\n"
1387 +" mov %0, %1\n"
1388 +" mov %H0, %H1\n"
1389 +"2: bkpt 0xf103\n"
1390 +"3:\n"
1391 +#endif
1392 +
1393 " strexd %1, %0, %H0, [%3]\n"
1394 " teq %1, #0\n"
1395 " bne 1b"
1396 +
1397 +#ifdef CONFIG_PAX_REFCOUNT
1398 +"\n4:\n"
1399 + _ASM_EXTABLE(2b, 4b)
1400 +#endif
1401 +
1402 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1403 : "r" (&v->counter), "r" (i)
1404 : "cc");
1405
1406 - smp_mb();
1407 -
1408 return result;
1409 }
1410
1411 @@ -382,6 +742,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
1412 return oldval;
1413 }
1414
1415 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, long long old,
1416 + long long new)
1417 +{
1418 + long long oldval;
1419 + unsigned long res;
1420 +
1421 + smp_mb();
1422 +
1423 + do {
1424 + __asm__ __volatile__("@ atomic64_cmpxchg_unchecked\n"
1425 + "ldrexd %1, %H1, [%3]\n"
1426 + "mov %0, #0\n"
1427 + "teq %1, %4\n"
1428 + "teqeq %H1, %H4\n"
1429 + "strexdeq %0, %5, %H5, [%3]"
1430 + : "=&r" (res), "=&r" (oldval), "+Qo" (ptr->counter)
1431 + : "r" (&ptr->counter), "r" (old), "r" (new)
1432 + : "cc");
1433 + } while (res);
1434 +
1435 + smp_mb();
1436 +
1437 + return oldval;
1438 +}
1439 +
1440 static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
1441 {
1442 long long result;
1443 @@ -406,20 +791,34 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
1444 static inline long long atomic64_dec_if_positive(atomic64_t *v)
1445 {
1446 long long result;
1447 - unsigned long tmp;
1448 + u64 tmp;
1449
1450 smp_mb();
1451
1452 __asm__ __volatile__("@ atomic64_dec_if_positive\n"
1453 -"1: ldrexd %0, %H0, [%3]\n"
1454 -" subs %Q0, %Q0, #1\n"
1455 -" sbc %R0, %R0, #0\n"
1456 +"1: ldrexd %1, %H1, [%3]\n"
1457 +" subs %Q0, %Q1, #1\n"
1458 +" sbcs %R0, %R1, #0\n"
1459 +
1460 +#ifdef CONFIG_PAX_REFCOUNT
1461 +" bvc 3f\n"
1462 +" mov %Q0, %Q1\n"
1463 +" mov %R0, %R1\n"
1464 +"2: bkpt 0xf103\n"
1465 +"3:\n"
1466 +#endif
1467 +
1468 " teq %R0, #0\n"
1469 -" bmi 2f\n"
1470 +" bmi 4f\n"
1471 " strexd %1, %0, %H0, [%3]\n"
1472 " teq %1, #0\n"
1473 " bne 1b\n"
1474 -"2:"
1475 +"4:\n"
1476 +
1477 +#ifdef CONFIG_PAX_REFCOUNT
1478 + _ASM_EXTABLE(2b, 4b)
1479 +#endif
1480 +
1481 : "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
1482 : "r" (&v->counter)
1483 : "cc");
1484 @@ -442,13 +841,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
1485 " teq %0, %5\n"
1486 " teqeq %H0, %H5\n"
1487 " moveq %1, #0\n"
1488 -" beq 2f\n"
1489 +" beq 4f\n"
1490 " adds %Q0, %Q0, %Q6\n"
1491 -" adc %R0, %R0, %R6\n"
1492 +" adcs %R0, %R0, %R6\n"
1493 +
1494 +#ifdef CONFIG_PAX_REFCOUNT
1495 +" bvc 3f\n"
1496 +"2: bkpt 0xf103\n"
1497 +"3:\n"
1498 +#endif
1499 +
1500 " strexd %2, %0, %H0, [%4]\n"
1501 " teq %2, #0\n"
1502 " bne 1b\n"
1503 -"2:"
1504 +"4:\n"
1505 +
1506 +#ifdef CONFIG_PAX_REFCOUNT
1507 + _ASM_EXTABLE(2b, 4b)
1508 +#endif
1509 +
1510 : "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
1511 : "r" (&v->counter), "r" (u), "r" (a)
1512 : "cc");
1513 @@ -461,10 +872,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
1514
1515 #define atomic64_add_negative(a, v) (atomic64_add_return((a), (v)) < 0)
1516 #define atomic64_inc(v) atomic64_add(1LL, (v))
1517 +#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1LL, (v))
1518 #define atomic64_inc_return(v) atomic64_add_return(1LL, (v))
1519 +#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1LL, (v))
1520 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
1521 #define atomic64_sub_and_test(a, v) (atomic64_sub_return((a), (v)) == 0)
1522 #define atomic64_dec(v) atomic64_sub(1LL, (v))
1523 +#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1LL, (v))
1524 #define atomic64_dec_return(v) atomic64_sub_return(1LL, (v))
1525 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
1526 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
1527 diff --git a/arch/arm/include/asm/cache.h b/arch/arm/include/asm/cache.h
1528 index 75fe66b..ba3dee4 100644
1529 --- a/arch/arm/include/asm/cache.h
1530 +++ b/arch/arm/include/asm/cache.h
1531 @@ -4,8 +4,10 @@
1532 #ifndef __ASMARM_CACHE_H
1533 #define __ASMARM_CACHE_H
1534
1535 +#include <linux/const.h>
1536 +
1537 #define L1_CACHE_SHIFT CONFIG_ARM_L1_CACHE_SHIFT
1538 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
1539 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
1540
1541 /*
1542 * Memory returned by kmalloc() may be used for DMA, so we must make
1543 @@ -24,5 +26,6 @@
1544 #endif
1545
1546 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
1547 +#define __read_only __attribute__ ((__section__(".data..read_only")))
1548
1549 #endif
1550 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
1551 index 8b8b616..d973d24 100644
1552 --- a/arch/arm/include/asm/cacheflush.h
1553 +++ b/arch/arm/include/asm/cacheflush.h
1554 @@ -116,7 +116,7 @@ struct cpu_cache_fns {
1555 void (*dma_unmap_area)(const void *, size_t, int);
1556
1557 void (*dma_flush_range)(const void *, const void *);
1558 -};
1559 +} __no_const;
1560
1561 /*
1562 * Select the calling method
1563 diff --git a/arch/arm/include/asm/checksum.h b/arch/arm/include/asm/checksum.h
1564 index 5233151..87a71fa 100644
1565 --- a/arch/arm/include/asm/checksum.h
1566 +++ b/arch/arm/include/asm/checksum.h
1567 @@ -37,7 +37,19 @@ __wsum
1568 csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum);
1569
1570 __wsum
1571 -csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
1572 +__csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr);
1573 +
1574 +static inline __wsum
1575 +csum_partial_copy_from_user(const void __user *src, void *dst, int len, __wsum sum, int *err_ptr)
1576 +{
1577 + __wsum ret;
1578 + pax_open_userland();
1579 + ret = __csum_partial_copy_from_user(src, dst, len, sum, err_ptr);
1580 + pax_close_userland();
1581 + return ret;
1582 +}
1583 +
1584 +
1585
1586 /*
1587 * Fold a partial checksum without adding pseudo headers
1588 diff --git a/arch/arm/include/asm/cmpxchg.h b/arch/arm/include/asm/cmpxchg.h
1589 index df2fbba..63fe3e1 100644
1590 --- a/arch/arm/include/asm/cmpxchg.h
1591 +++ b/arch/arm/include/asm/cmpxchg.h
1592 @@ -102,6 +102,8 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr, int size
1593
1594 #define xchg(ptr,x) \
1595 ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1596 +#define xchg_unchecked(ptr,x) \
1597 + ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr))))
1598
1599 #include <asm-generic/cmpxchg-local.h>
1600
1601 diff --git a/arch/arm/include/asm/domain.h b/arch/arm/include/asm/domain.h
1602 index 6ddbe44..b5e38b1 100644
1603 --- a/arch/arm/include/asm/domain.h
1604 +++ b/arch/arm/include/asm/domain.h
1605 @@ -48,18 +48,37 @@
1606 * Domain types
1607 */
1608 #define DOMAIN_NOACCESS 0
1609 -#define DOMAIN_CLIENT 1
1610 #ifdef CONFIG_CPU_USE_DOMAINS
1611 +#define DOMAIN_USERCLIENT 1
1612 +#define DOMAIN_KERNELCLIENT 1
1613 #define DOMAIN_MANAGER 3
1614 +#define DOMAIN_VECTORS DOMAIN_USER
1615 #else
1616 +
1617 +#ifdef CONFIG_PAX_KERNEXEC
1618 #define DOMAIN_MANAGER 1
1619 +#define DOMAIN_KERNEXEC 3
1620 +#else
1621 +#define DOMAIN_MANAGER 1
1622 +#endif
1623 +
1624 +#ifdef CONFIG_PAX_MEMORY_UDEREF
1625 +#define DOMAIN_USERCLIENT 0
1626 +#define DOMAIN_UDEREF 1
1627 +#define DOMAIN_VECTORS DOMAIN_KERNEL
1628 +#else
1629 +#define DOMAIN_USERCLIENT 1
1630 +#define DOMAIN_VECTORS DOMAIN_USER
1631 +#endif
1632 +#define DOMAIN_KERNELCLIENT 1
1633 +
1634 #endif
1635
1636 #define domain_val(dom,type) ((type) << (2*(dom)))
1637
1638 #ifndef __ASSEMBLY__
1639
1640 -#ifdef CONFIG_CPU_USE_DOMAINS
1641 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
1642 static inline void set_domain(unsigned val)
1643 {
1644 asm volatile(
1645 @@ -68,15 +87,7 @@ static inline void set_domain(unsigned val)
1646 isb();
1647 }
1648
1649 -#define modify_domain(dom,type) \
1650 - do { \
1651 - struct thread_info *thread = current_thread_info(); \
1652 - unsigned int domain = thread->cpu_domain; \
1653 - domain &= ~domain_val(dom, DOMAIN_MANAGER); \
1654 - thread->cpu_domain = domain | domain_val(dom, type); \
1655 - set_domain(thread->cpu_domain); \
1656 - } while (0)
1657 -
1658 +extern void modify_domain(unsigned int dom, unsigned int type);
1659 #else
1660 static inline void set_domain(unsigned val) { }
1661 static inline void modify_domain(unsigned dom, unsigned type) { }
1662 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
1663 index f4b46d3..abc9b2b 100644
1664 --- a/arch/arm/include/asm/elf.h
1665 +++ b/arch/arm/include/asm/elf.h
1666 @@ -114,7 +114,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
1667 the loader. We need to make sure that it is out of the way of the program
1668 that it will "exec", and that there is sufficient room for the brk. */
1669
1670 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
1671 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
1672 +
1673 +#ifdef CONFIG_PAX_ASLR
1674 +#define PAX_ELF_ET_DYN_BASE 0x00008000UL
1675 +
1676 +#define PAX_DELTA_MMAP_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1677 +#define PAX_DELTA_STACK_LEN ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
1678 +#endif
1679
1680 /* When the program starts, a1 contains a pointer to a function to be
1681 registered with atexit, as per the SVR4 ABI. A value of 0 means we
1682 @@ -124,10 +131,6 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
1683 extern void elf_set_personality(const struct elf32_hdr *);
1684 #define SET_PERSONALITY(ex) elf_set_personality(&(ex))
1685
1686 -struct mm_struct;
1687 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1688 -#define arch_randomize_brk arch_randomize_brk
1689 -
1690 #ifdef CONFIG_MMU
1691 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
1692 struct linux_binprm;
1693 diff --git a/arch/arm/include/asm/fncpy.h b/arch/arm/include/asm/fncpy.h
1694 index de53547..52b9a28 100644
1695 --- a/arch/arm/include/asm/fncpy.h
1696 +++ b/arch/arm/include/asm/fncpy.h
1697 @@ -81,7 +81,9 @@
1698 BUG_ON((uintptr_t)(dest_buf) & (FNCPY_ALIGN - 1) || \
1699 (__funcp_address & ~(uintptr_t)1 & (FNCPY_ALIGN - 1))); \
1700 \
1701 + pax_open_kernel(); \
1702 memcpy(dest_buf, (void const *)(__funcp_address & ~1), size); \
1703 + pax_close_kernel(); \
1704 flush_icache_range((unsigned long)(dest_buf), \
1705 (unsigned long)(dest_buf) + (size)); \
1706 \
1707 diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
1708 index 2aff798..099eb15 100644
1709 --- a/arch/arm/include/asm/futex.h
1710 +++ b/arch/arm/include/asm/futex.h
1711 @@ -45,6 +45,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1712 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
1713 return -EFAULT;
1714
1715 + pax_open_userland();
1716 +
1717 smp_mb();
1718 __asm__ __volatile__("@futex_atomic_cmpxchg_inatomic\n"
1719 "1: ldrex %1, [%4]\n"
1720 @@ -60,6 +62,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1721 : "cc", "memory");
1722 smp_mb();
1723
1724 + pax_close_userland();
1725 +
1726 *uval = val;
1727 return ret;
1728 }
1729 @@ -90,6 +94,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1730 if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
1731 return -EFAULT;
1732
1733 + pax_open_userland();
1734 +
1735 __asm__ __volatile__("@futex_atomic_cmpxchg_inatomic\n"
1736 "1: " TUSER(ldr) " %1, [%4]\n"
1737 " teq %1, %2\n"
1738 @@ -100,6 +106,8 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
1739 : "r" (oldval), "r" (newval), "r" (uaddr), "Ir" (-EFAULT)
1740 : "cc", "memory");
1741
1742 + pax_close_userland();
1743 +
1744 *uval = val;
1745 return ret;
1746 }
1747 @@ -122,6 +130,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
1748 return -EFAULT;
1749
1750 pagefault_disable(); /* implies preempt_disable() */
1751 + pax_open_userland();
1752
1753 switch (op) {
1754 case FUTEX_OP_SET:
1755 @@ -143,6 +152,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
1756 ret = -ENOSYS;
1757 }
1758
1759 + pax_close_userland();
1760 pagefault_enable(); /* subsumes preempt_enable() */
1761
1762 if (!ret) {
1763 diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
1764 index 83eb2f7..ed77159 100644
1765 --- a/arch/arm/include/asm/kmap_types.h
1766 +++ b/arch/arm/include/asm/kmap_types.h
1767 @@ -4,6 +4,6 @@
1768 /*
1769 * This is the "bare minimum". AIO seems to require this.
1770 */
1771 -#define KM_TYPE_NR 16
1772 +#define KM_TYPE_NR 17
1773
1774 #endif
1775 diff --git a/arch/arm/include/asm/mach/dma.h b/arch/arm/include/asm/mach/dma.h
1776 index 9e614a1..3302cca 100644
1777 --- a/arch/arm/include/asm/mach/dma.h
1778 +++ b/arch/arm/include/asm/mach/dma.h
1779 @@ -22,7 +22,7 @@ struct dma_ops {
1780 int (*residue)(unsigned int, dma_t *); /* optional */
1781 int (*setspeed)(unsigned int, dma_t *, int); /* optional */
1782 const char *type;
1783 -};
1784 +} __do_const;
1785
1786 struct dma_struct {
1787 void *addr; /* single DMA address */
1788 diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h
1789 index f98c7f3..e5c626d 100644
1790 --- a/arch/arm/include/asm/mach/map.h
1791 +++ b/arch/arm/include/asm/mach/map.h
1792 @@ -23,17 +23,19 @@ struct map_desc {
1793
1794 /* types 0-3 are defined in asm/io.h */
1795 enum {
1796 - MT_UNCACHED = 4,
1797 - MT_CACHECLEAN,
1798 - MT_MINICLEAN,
1799 + MT_UNCACHED_RW = 4,
1800 + MT_CACHECLEAN_RO,
1801 + MT_MINICLEAN_RO,
1802 MT_LOW_VECTORS,
1803 MT_HIGH_VECTORS,
1804 - MT_MEMORY_RWX,
1805 + __MT_MEMORY_RWX,
1806 MT_MEMORY_RW,
1807 - MT_ROM,
1808 - MT_MEMORY_RWX_NONCACHED,
1809 + MT_MEMORY_RX,
1810 + MT_ROM_RX,
1811 + MT_MEMORY_RW_NONCACHED,
1812 + MT_MEMORY_RX_NONCACHED,
1813 MT_MEMORY_RW_DTCM,
1814 - MT_MEMORY_RWX_ITCM,
1815 + MT_MEMORY_RX_ITCM,
1816 MT_MEMORY_RW_SO,
1817 MT_MEMORY_DMA_READY,
1818 };
1819 diff --git a/arch/arm/include/asm/outercache.h b/arch/arm/include/asm/outercache.h
1820 index f94784f..9a09a4a 100644
1821 --- a/arch/arm/include/asm/outercache.h
1822 +++ b/arch/arm/include/asm/outercache.h
1823 @@ -35,7 +35,7 @@ struct outer_cache_fns {
1824 #endif
1825 void (*set_debug)(unsigned long);
1826 void (*resume)(void);
1827 -};
1828 +} __no_const;
1829
1830 extern struct outer_cache_fns outer_cache;
1831
1832 diff --git a/arch/arm/include/asm/page.h b/arch/arm/include/asm/page.h
1833 index 4355f0e..cd9168e 100644
1834 --- a/arch/arm/include/asm/page.h
1835 +++ b/arch/arm/include/asm/page.h
1836 @@ -23,6 +23,7 @@
1837
1838 #else
1839
1840 +#include <linux/compiler.h>
1841 #include <asm/glue.h>
1842
1843 /*
1844 @@ -114,7 +115,7 @@ struct cpu_user_fns {
1845 void (*cpu_clear_user_highpage)(struct page *page, unsigned long vaddr);
1846 void (*cpu_copy_user_highpage)(struct page *to, struct page *from,
1847 unsigned long vaddr, struct vm_area_struct *vma);
1848 -};
1849 +} __no_const;
1850
1851 #ifdef MULTI_USER
1852 extern struct cpu_user_fns cpu_user;
1853 diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
1854 index 78a7793..e3dc06c 100644
1855 --- a/arch/arm/include/asm/pgalloc.h
1856 +++ b/arch/arm/include/asm/pgalloc.h
1857 @@ -17,6 +17,7 @@
1858 #include <asm/processor.h>
1859 #include <asm/cacheflush.h>
1860 #include <asm/tlbflush.h>
1861 +#include <asm/system_info.h>
1862
1863 #define check_pgt_cache() do { } while (0)
1864
1865 @@ -43,6 +44,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1866 set_pud(pud, __pud(__pa(pmd) | PMD_TYPE_TABLE));
1867 }
1868
1869 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1870 +{
1871 + pud_populate(mm, pud, pmd);
1872 +}
1873 +
1874 #else /* !CONFIG_ARM_LPAE */
1875
1876 /*
1877 @@ -51,6 +57,7 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
1878 #define pmd_alloc_one(mm,addr) ({ BUG(); ((pmd_t *)2); })
1879 #define pmd_free(mm, pmd) do { } while (0)
1880 #define pud_populate(mm,pmd,pte) BUG()
1881 +#define pud_populate_kernel(mm,pmd,pte) BUG()
1882
1883 #endif /* CONFIG_ARM_LPAE */
1884
1885 @@ -128,6 +135,19 @@ static inline void pte_free(struct mm_struct *mm, pgtable_t pte)
1886 __free_page(pte);
1887 }
1888
1889 +static inline void __section_update(pmd_t *pmdp, unsigned long addr, pmdval_t prot)
1890 +{
1891 +#ifdef CONFIG_ARM_LPAE
1892 + pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
1893 +#else
1894 + if (addr & SECTION_SIZE)
1895 + pmdp[1] = __pmd(pmd_val(pmdp[1]) | prot);
1896 + else
1897 + pmdp[0] = __pmd(pmd_val(pmdp[0]) | prot);
1898 +#endif
1899 + flush_pmd_entry(pmdp);
1900 +}
1901 +
1902 static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t pte,
1903 pmdval_t prot)
1904 {
1905 @@ -157,7 +177,7 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)
1906 static inline void
1907 pmd_populate(struct mm_struct *mm, pmd_t *pmdp, pgtable_t ptep)
1908 {
1909 - __pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE);
1910 + __pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE | __supported_pmd_mask);
1911 }
1912 #define pmd_pgtable(pmd) pmd_page(pmd)
1913
1914 diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
1915 index 5cfba15..f415e1a 100644
1916 --- a/arch/arm/include/asm/pgtable-2level-hwdef.h
1917 +++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
1918 @@ -20,12 +20,15 @@
1919 #define PMD_TYPE_FAULT (_AT(pmdval_t, 0) << 0)
1920 #define PMD_TYPE_TABLE (_AT(pmdval_t, 1) << 0)
1921 #define PMD_TYPE_SECT (_AT(pmdval_t, 2) << 0)
1922 +#define PMD_PXNTABLE (_AT(pmdval_t, 1) << 2) /* v7 */
1923 #define PMD_BIT4 (_AT(pmdval_t, 1) << 4)
1924 #define PMD_DOMAIN(x) (_AT(pmdval_t, (x)) << 5)
1925 #define PMD_PROTECTION (_AT(pmdval_t, 1) << 9) /* v5 */
1926 +
1927 /*
1928 * - section
1929 */
1930 +#define PMD_SECT_PXN (_AT(pmdval_t, 1) << 0) /* v7 */
1931 #define PMD_SECT_BUFFERABLE (_AT(pmdval_t, 1) << 2)
1932 #define PMD_SECT_CACHEABLE (_AT(pmdval_t, 1) << 3)
1933 #define PMD_SECT_XN (_AT(pmdval_t, 1) << 4) /* v6 */
1934 @@ -37,6 +40,7 @@
1935 #define PMD_SECT_nG (_AT(pmdval_t, 1) << 17) /* v6 */
1936 #define PMD_SECT_SUPER (_AT(pmdval_t, 1) << 18) /* v6 */
1937 #define PMD_SECT_AF (_AT(pmdval_t, 0))
1938 +#define PMD_SECT_RDONLY (_AT(pmdval_t, 0))
1939
1940 #define PMD_SECT_UNCACHED (_AT(pmdval_t, 0))
1941 #define PMD_SECT_BUFFERED (PMD_SECT_BUFFERABLE)
1942 @@ -66,6 +70,7 @@
1943 * - extended small page/tiny page
1944 */
1945 #define PTE_EXT_XN (_AT(pteval_t, 1) << 0) /* v6 */
1946 +#define PTE_EXT_PXN (_AT(pteval_t, 1) << 2) /* v7 */
1947 #define PTE_EXT_AP_MASK (_AT(pteval_t, 3) << 4)
1948 #define PTE_EXT_AP0 (_AT(pteval_t, 1) << 4)
1949 #define PTE_EXT_AP1 (_AT(pteval_t, 2) << 4)
1950 diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
1951 index 219ac88..73ec32a 100644
1952 --- a/arch/arm/include/asm/pgtable-2level.h
1953 +++ b/arch/arm/include/asm/pgtable-2level.h
1954 @@ -126,6 +126,9 @@
1955 #define L_PTE_SHARED (_AT(pteval_t, 1) << 10) /* shared(v6), coherent(xsc3) */
1956 #define L_PTE_NONE (_AT(pteval_t, 1) << 11)
1957
1958 +/* Two-level page tables only have PXN in the PGD, not in the PTE. */
1959 +#define L_PTE_PXN (_AT(pteval_t, 0))
1960 +
1961 /*
1962 * These are the memory types, defined to be compatible with
1963 * pre-ARMv6 CPUs cacheable and bufferable bits: XXCB
1964 diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
1965 index 626989f..9d67a33 100644
1966 --- a/arch/arm/include/asm/pgtable-3level-hwdef.h
1967 +++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
1968 @@ -75,6 +75,7 @@
1969 #define PTE_EXT_SHARED (_AT(pteval_t, 3) << 8) /* SH[1:0], inner shareable */
1970 #define PTE_EXT_AF (_AT(pteval_t, 1) << 10) /* Access Flag */
1971 #define PTE_EXT_NG (_AT(pteval_t, 1) << 11) /* nG */
1972 +#define PTE_EXT_PXN (_AT(pteval_t, 1) << 53) /* PXN */
1973 #define PTE_EXT_XN (_AT(pteval_t, 1) << 54) /* XN */
1974
1975 /*
1976 diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
1977 index 85c60ad..b0bbd7e 100644
1978 --- a/arch/arm/include/asm/pgtable-3level.h
1979 +++ b/arch/arm/include/asm/pgtable-3level.h
1980 @@ -82,6 +82,7 @@
1981 #define L_PTE_RDONLY (_AT(pteval_t, 1) << 7) /* AP[2] */
1982 #define L_PTE_SHARED (_AT(pteval_t, 3) << 8) /* SH[1:0], inner shareable */
1983 #define L_PTE_YOUNG (_AT(pteval_t, 1) << 10) /* AF */
1984 +#define L_PTE_PXN (_AT(pteval_t, 1) << 53) /* PXN */
1985 #define L_PTE_XN (_AT(pteval_t, 1) << 54) /* XN */
1986 #define L_PTE_DIRTY (_AT(pteval_t, 1) << 55) /* unused */
1987 #define L_PTE_SPECIAL (_AT(pteval_t, 1) << 56) /* unused */
1988 @@ -95,6 +96,7 @@
1989 /*
1990 * To be used in assembly code with the upper page attributes.
1991 */
1992 +#define L_PTE_PXN_HIGH (1 << (53 - 32))
1993 #define L_PTE_XN_HIGH (1 << (54 - 32))
1994 #define L_PTE_DIRTY_HIGH (1 << (55 - 32))
1995
1996 diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
1997 index 7d59b52..27a12f8 100644
1998 --- a/arch/arm/include/asm/pgtable.h
1999 +++ b/arch/arm/include/asm/pgtable.h
2000 @@ -33,6 +33,9 @@
2001 #include <asm/pgtable-2level.h>
2002 #endif
2003
2004 +#define ktla_ktva(addr) (addr)
2005 +#define ktva_ktla(addr) (addr)
2006 +
2007 /*
2008 * Just any arbitrary offset to the start of the vmalloc VM area: the
2009 * current 8MB value just means that there will be a 8MB "hole" after the
2010 @@ -48,6 +51,9 @@
2011 #define LIBRARY_TEXT_START 0x0c000000
2012
2013 #ifndef __ASSEMBLY__
2014 +extern pteval_t __supported_pte_mask;
2015 +extern pmdval_t __supported_pmd_mask;
2016 +
2017 extern void __pte_error(const char *file, int line, pte_t);
2018 extern void __pmd_error(const char *file, int line, pmd_t);
2019 extern void __pgd_error(const char *file, int line, pgd_t);
2020 @@ -56,6 +62,48 @@ extern void __pgd_error(const char *file, int line, pgd_t);
2021 #define pmd_ERROR(pmd) __pmd_error(__FILE__, __LINE__, pmd)
2022 #define pgd_ERROR(pgd) __pgd_error(__FILE__, __LINE__, pgd)
2023
2024 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
2025 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
2026 +
2027 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2028 +#include <asm/domain.h>
2029 +#include <linux/thread_info.h>
2030 +#include <linux/preempt.h>
2031 +
2032 +static inline int test_domain(int domain, int domaintype)
2033 +{
2034 + return ((current_thread_info()->cpu_domain) & domain_val(domain, 3)) == domain_val(domain, domaintype);
2035 +}
2036 +#endif
2037 +
2038 +#ifdef CONFIG_PAX_KERNEXEC
2039 +static inline unsigned long pax_open_kernel(void) {
2040 +#ifdef CONFIG_ARM_LPAE
2041 + /* TODO */
2042 +#else
2043 + preempt_disable();
2044 + BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC));
2045 + modify_domain(DOMAIN_KERNEL, DOMAIN_KERNEXEC);
2046 +#endif
2047 + return 0;
2048 +}
2049 +
2050 +static inline unsigned long pax_close_kernel(void) {
2051 +#ifdef CONFIG_ARM_LPAE
2052 + /* TODO */
2053 +#else
2054 + BUG_ON(test_domain(DOMAIN_KERNEL, DOMAIN_MANAGER));
2055 + /* DOMAIN_MANAGER = "client" under KERNEXEC */
2056 + modify_domain(DOMAIN_KERNEL, DOMAIN_MANAGER);
2057 + preempt_enable_no_resched();
2058 +#endif
2059 + return 0;
2060 +}
2061 +#else
2062 +static inline unsigned long pax_open_kernel(void) { return 0; }
2063 +static inline unsigned long pax_close_kernel(void) { return 0; }
2064 +#endif
2065 +
2066 /*
2067 * This is the lowest virtual address we can permit any user space
2068 * mapping to be mapped at. This is particularly important for
2069 @@ -75,8 +123,8 @@ extern void __pgd_error(const char *file, int line, pgd_t);
2070 /*
2071 * The pgprot_* and protection_map entries will be fixed up in runtime
2072 * to include the cachable and bufferable bits based on memory policy,
2073 - * as well as any architecture dependent bits like global/ASID and SMP
2074 - * shared mapping bits.
2075 + * as well as any architecture dependent bits like global/ASID, PXN,
2076 + * and SMP shared mapping bits.
2077 */
2078 #define _L_PTE_DEFAULT L_PTE_PRESENT | L_PTE_YOUNG
2079
2080 @@ -262,7 +310,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
2081 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
2082 {
2083 const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
2084 - L_PTE_NONE | L_PTE_VALID;
2085 + L_PTE_NONE | L_PTE_VALID | __supported_pte_mask;
2086 pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
2087 return pte;
2088 }
2089 diff --git a/arch/arm/include/asm/psci.h b/arch/arm/include/asm/psci.h
2090 index c4ae171..ea0c0c2 100644
2091 --- a/arch/arm/include/asm/psci.h
2092 +++ b/arch/arm/include/asm/psci.h
2093 @@ -29,7 +29,7 @@ struct psci_operations {
2094 int (*cpu_off)(struct psci_power_state state);
2095 int (*cpu_on)(unsigned long cpuid, unsigned long entry_point);
2096 int (*migrate)(unsigned long cpuid);
2097 -};
2098 +} __no_const;
2099
2100 extern struct psci_operations psci_ops;
2101 extern struct smp_operations psci_smp_ops;
2102 diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h
2103 index 22a3b9b..7f214ee 100644
2104 --- a/arch/arm/include/asm/smp.h
2105 +++ b/arch/arm/include/asm/smp.h
2106 @@ -112,7 +112,7 @@ struct smp_operations {
2107 int (*cpu_disable)(unsigned int cpu);
2108 #endif
2109 #endif
2110 -};
2111 +} __no_const;
2112
2113 /*
2114 * set platform specific SMP operations
2115 diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
2116 index 71a06b2..8bb9ae1 100644
2117 --- a/arch/arm/include/asm/thread_info.h
2118 +++ b/arch/arm/include/asm/thread_info.h
2119 @@ -88,9 +88,9 @@ struct thread_info {
2120 .flags = 0, \
2121 .preempt_count = INIT_PREEMPT_COUNT, \
2122 .addr_limit = KERNEL_DS, \
2123 - .cpu_domain = domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
2124 - domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
2125 - domain_val(DOMAIN_IO, DOMAIN_CLIENT), \
2126 + .cpu_domain = domain_val(DOMAIN_USER, DOMAIN_USERCLIENT) | \
2127 + domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT) | \
2128 + domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT), \
2129 .restart_block = { \
2130 .fn = do_no_restart_syscall, \
2131 }, \
2132 @@ -157,7 +157,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
2133 #define TIF_SYSCALL_AUDIT 9
2134 #define TIF_SYSCALL_TRACEPOINT 10
2135 #define TIF_SECCOMP 11 /* seccomp syscall filtering active */
2136 -#define TIF_NOHZ 12 /* in adaptive nohz mode */
2137 +/* within 8 bits of TIF_SYSCALL_TRACE
2138 + * to meet flexible second operand requirements
2139 + */
2140 +#define TIF_GRSEC_SETXID 12
2141 +#define TIF_NOHZ 13 /* in adaptive nohz mode */
2142 #define TIF_USING_IWMMXT 17
2143 #define TIF_MEMDIE 18 /* is terminating due to OOM killer */
2144 #define TIF_RESTORE_SIGMASK 20
2145 @@ -170,10 +174,11 @@ extern int vfp_restore_user_hwstate(struct user_vfp __user *,
2146 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
2147 #define _TIF_SECCOMP (1 << TIF_SECCOMP)
2148 #define _TIF_USING_IWMMXT (1 << TIF_USING_IWMMXT)
2149 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
2150
2151 /* Checks for any syscall work in entry-common.S */
2152 #define _TIF_SYSCALL_WORK (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
2153 - _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP)
2154 + _TIF_SYSCALL_TRACEPOINT | _TIF_SECCOMP | _TIF_GRSEC_SETXID)
2155
2156 /*
2157 * Change these and you break ASM code in entry-common.S
2158 diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
2159 index 72abdc5..35acac1 100644
2160 --- a/arch/arm/include/asm/uaccess.h
2161 +++ b/arch/arm/include/asm/uaccess.h
2162 @@ -18,6 +18,7 @@
2163 #include <asm/domain.h>
2164 #include <asm/unified.h>
2165 #include <asm/compiler.h>
2166 +#include <asm/pgtable.h>
2167
2168 #if __LINUX_ARM_ARCH__ < 6
2169 #include <asm-generic/uaccess-unaligned.h>
2170 @@ -70,11 +71,38 @@ extern int __put_user_bad(void);
2171 static inline void set_fs(mm_segment_t fs)
2172 {
2173 current_thread_info()->addr_limit = fs;
2174 - modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
2175 + modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_KERNELCLIENT : DOMAIN_MANAGER);
2176 }
2177
2178 #define segment_eq(a,b) ((a) == (b))
2179
2180 +#define __HAVE_ARCH_PAX_OPEN_USERLAND
2181 +#define __HAVE_ARCH_PAX_CLOSE_USERLAND
2182 +
2183 +static inline void pax_open_userland(void)
2184 +{
2185 +
2186 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2187 + if (segment_eq(get_fs(), USER_DS)) {
2188 + BUG_ON(test_domain(DOMAIN_USER, DOMAIN_UDEREF));
2189 + modify_domain(DOMAIN_USER, DOMAIN_UDEREF);
2190 + }
2191 +#endif
2192 +
2193 +}
2194 +
2195 +static inline void pax_close_userland(void)
2196 +{
2197 +
2198 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2199 + if (segment_eq(get_fs(), USER_DS)) {
2200 + BUG_ON(test_domain(DOMAIN_USER, DOMAIN_NOACCESS));
2201 + modify_domain(DOMAIN_USER, DOMAIN_NOACCESS);
2202 + }
2203 +#endif
2204 +
2205 +}
2206 +
2207 #define __addr_ok(addr) ({ \
2208 unsigned long flag; \
2209 __asm__("cmp %2, %0; movlo %0, #0" \
2210 @@ -150,8 +178,12 @@ extern int __get_user_4(void *);
2211
2212 #define get_user(x,p) \
2213 ({ \
2214 + int __e; \
2215 might_fault(); \
2216 - __get_user_check(x,p); \
2217 + pax_open_userland(); \
2218 + __e = __get_user_check(x,p); \
2219 + pax_close_userland(); \
2220 + __e; \
2221 })
2222
2223 extern int __put_user_1(void *, unsigned int);
2224 @@ -195,8 +227,12 @@ extern int __put_user_8(void *, unsigned long long);
2225
2226 #define put_user(x,p) \
2227 ({ \
2228 + int __e; \
2229 might_fault(); \
2230 - __put_user_check(x,p); \
2231 + pax_open_userland(); \
2232 + __e = __put_user_check(x,p); \
2233 + pax_close_userland(); \
2234 + __e; \
2235 })
2236
2237 #else /* CONFIG_MMU */
2238 @@ -220,6 +256,7 @@ static inline void set_fs(mm_segment_t fs)
2239
2240 #endif /* CONFIG_MMU */
2241
2242 +#define access_ok_noprefault(type,addr,size) access_ok((type),(addr),(size))
2243 #define access_ok(type,addr,size) (__range_ok(addr,size) == 0)
2244
2245 #define user_addr_max() \
2246 @@ -237,13 +274,17 @@ static inline void set_fs(mm_segment_t fs)
2247 #define __get_user(x,ptr) \
2248 ({ \
2249 long __gu_err = 0; \
2250 + pax_open_userland(); \
2251 __get_user_err((x),(ptr),__gu_err); \
2252 + pax_close_userland(); \
2253 __gu_err; \
2254 })
2255
2256 #define __get_user_error(x,ptr,err) \
2257 ({ \
2258 + pax_open_userland(); \
2259 __get_user_err((x),(ptr),err); \
2260 + pax_close_userland(); \
2261 (void) 0; \
2262 })
2263
2264 @@ -319,13 +360,17 @@ do { \
2265 #define __put_user(x,ptr) \
2266 ({ \
2267 long __pu_err = 0; \
2268 + pax_open_userland(); \
2269 __put_user_err((x),(ptr),__pu_err); \
2270 + pax_close_userland(); \
2271 __pu_err; \
2272 })
2273
2274 #define __put_user_error(x,ptr,err) \
2275 ({ \
2276 + pax_open_userland(); \
2277 __put_user_err((x),(ptr),err); \
2278 + pax_close_userland(); \
2279 (void) 0; \
2280 })
2281
2282 @@ -425,11 +470,44 @@ do { \
2283
2284
2285 #ifdef CONFIG_MMU
2286 -extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
2287 -extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
2288 +extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
2289 +extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
2290 +
2291 +static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
2292 +{
2293 + unsigned long ret;
2294 +
2295 + check_object_size(to, n, false);
2296 + pax_open_userland();
2297 + ret = ___copy_from_user(to, from, n);
2298 + pax_close_userland();
2299 + return ret;
2300 +}
2301 +
2302 +static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
2303 +{
2304 + unsigned long ret;
2305 +
2306 + check_object_size(from, n, true);
2307 + pax_open_userland();
2308 + ret = ___copy_to_user(to, from, n);
2309 + pax_close_userland();
2310 + return ret;
2311 +}
2312 +
2313 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
2314 -extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
2315 +extern unsigned long __must_check ___clear_user(void __user *addr, unsigned long n);
2316 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
2317 +
2318 +static inline unsigned long __must_check __clear_user(void __user *addr, unsigned long n)
2319 +{
2320 + unsigned long ret;
2321 + pax_open_userland();
2322 + ret = ___clear_user(addr, n);
2323 + pax_close_userland();
2324 + return ret;
2325 +}
2326 +
2327 #else
2328 #define __copy_from_user(to,from,n) (memcpy(to, (void __force *)from, n), 0)
2329 #define __copy_to_user(to,from,n) (memcpy((void __force *)to, from, n), 0)
2330 @@ -438,6 +516,9 @@ extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned l
2331
2332 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2333 {
2334 + if ((long)n < 0)
2335 + return n;
2336 +
2337 if (access_ok(VERIFY_READ, from, n))
2338 n = __copy_from_user(to, from, n);
2339 else /* security hole - plug it */
2340 @@ -447,6 +528,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
2341
2342 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2343 {
2344 + if ((long)n < 0)
2345 + return n;
2346 +
2347 if (access_ok(VERIFY_WRITE, to, n))
2348 n = __copy_to_user(to, from, n);
2349 return n;
2350 diff --git a/arch/arm/include/uapi/asm/ptrace.h b/arch/arm/include/uapi/asm/ptrace.h
2351 index 5af0ed1..cea83883 100644
2352 --- a/arch/arm/include/uapi/asm/ptrace.h
2353 +++ b/arch/arm/include/uapi/asm/ptrace.h
2354 @@ -92,7 +92,7 @@
2355 * ARMv7 groups of PSR bits
2356 */
2357 #define APSR_MASK 0xf80f0000 /* N, Z, C, V, Q and GE flags */
2358 -#define PSR_ISET_MASK 0x01000010 /* ISA state (J, T) mask */
2359 +#define PSR_ISET_MASK 0x01000020 /* ISA state (J, T) mask */
2360 #define PSR_IT_MASK 0x0600fc00 /* If-Then execution state mask */
2361 #define PSR_ENDIAN_MASK 0x00000200 /* Endianness state mask */
2362
2363 diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
2364 index 85e664b..419a1cd 100644
2365 --- a/arch/arm/kernel/armksyms.c
2366 +++ b/arch/arm/kernel/armksyms.c
2367 @@ -55,7 +55,7 @@ EXPORT_SYMBOL(arm_delay_ops);
2368
2369 /* networking */
2370 EXPORT_SYMBOL(csum_partial);
2371 -EXPORT_SYMBOL(csum_partial_copy_from_user);
2372 +EXPORT_SYMBOL(__csum_partial_copy_from_user);
2373 EXPORT_SYMBOL(csum_partial_copy_nocheck);
2374 EXPORT_SYMBOL(__csum_ipv6_magic);
2375
2376 @@ -91,9 +91,9 @@ EXPORT_SYMBOL(__memzero);
2377 #ifdef CONFIG_MMU
2378 EXPORT_SYMBOL(copy_page);
2379
2380 -EXPORT_SYMBOL(__copy_from_user);
2381 -EXPORT_SYMBOL(__copy_to_user);
2382 -EXPORT_SYMBOL(__clear_user);
2383 +EXPORT_SYMBOL(___copy_from_user);
2384 +EXPORT_SYMBOL(___copy_to_user);
2385 +EXPORT_SYMBOL(___clear_user);
2386
2387 EXPORT_SYMBOL(__get_user_1);
2388 EXPORT_SYMBOL(__get_user_2);
2389 diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
2390 index 1879e8d..b2207fc 100644
2391 --- a/arch/arm/kernel/entry-armv.S
2392 +++ b/arch/arm/kernel/entry-armv.S
2393 @@ -47,6 +47,87 @@
2394 9997:
2395 .endm
2396
2397 + .macro pax_enter_kernel
2398 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2399 + @ make aligned space for saved DACR
2400 + sub sp, sp, #8
2401 + @ save regs
2402 + stmdb sp!, {r1, r2}
2403 + @ read DACR from cpu_domain into r1
2404 + mov r2, sp
2405 + @ assume 8K pages, since we have to split the immediate in two
2406 + bic r2, r2, #(0x1fc0)
2407 + bic r2, r2, #(0x3f)
2408 + ldr r1, [r2, #TI_CPU_DOMAIN]
2409 + @ store old DACR on stack
2410 + str r1, [sp, #8]
2411 +#ifdef CONFIG_PAX_KERNEXEC
2412 + @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2413 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2414 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2415 +#endif
2416 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2417 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2418 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2419 +#endif
2420 + @ write r1 to current_thread_info()->cpu_domain
2421 + str r1, [r2, #TI_CPU_DOMAIN]
2422 + @ write r1 to DACR
2423 + mcr p15, 0, r1, c3, c0, 0
2424 + @ instruction sync
2425 + instr_sync
2426 + @ restore regs
2427 + ldmia sp!, {r1, r2}
2428 +#endif
2429 + .endm
2430 +
2431 + .macro pax_open_userland
2432 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2433 + @ save regs
2434 + stmdb sp!, {r0, r1}
2435 + @ read DACR from cpu_domain into r1
2436 + mov r0, sp
2437 + @ assume 8K pages, since we have to split the immediate in two
2438 + bic r0, r0, #(0x1fc0)
2439 + bic r0, r0, #(0x3f)
2440 + ldr r1, [r0, #TI_CPU_DOMAIN]
2441 + @ set current DOMAIN_USER to DOMAIN_CLIENT
2442 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2443 + orr r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
2444 + @ write r1 to current_thread_info()->cpu_domain
2445 + str r1, [r0, #TI_CPU_DOMAIN]
2446 + @ write r1 to DACR
2447 + mcr p15, 0, r1, c3, c0, 0
2448 + @ instruction sync
2449 + instr_sync
2450 + @ restore regs
2451 + ldmia sp!, {r0, r1}
2452 +#endif
2453 + .endm
2454 +
2455 + .macro pax_close_userland
2456 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2457 + @ save regs
2458 + stmdb sp!, {r0, r1}
2459 + @ read DACR from cpu_domain into r1
2460 + mov r0, sp
2461 + @ assume 8K pages, since we have to split the immediate in two
2462 + bic r0, r0, #(0x1fc0)
2463 + bic r0, r0, #(0x3f)
2464 + ldr r1, [r0, #TI_CPU_DOMAIN]
2465 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2466 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2467 + @ write r1 to current_thread_info()->cpu_domain
2468 + str r1, [r0, #TI_CPU_DOMAIN]
2469 + @ write r1 to DACR
2470 + mcr p15, 0, r1, c3, c0, 0
2471 + @ instruction sync
2472 + instr_sync
2473 + @ restore regs
2474 + ldmia sp!, {r0, r1}
2475 +#endif
2476 + .endm
2477 +
2478 .macro pabt_helper
2479 @ PABORT handler takes pt_regs in r2, fault address in r4 and psr in r5
2480 #ifdef MULTI_PABORT
2481 @@ -89,11 +170,15 @@
2482 * Invalid mode handlers
2483 */
2484 .macro inv_entry, reason
2485 +
2486 + pax_enter_kernel
2487 +
2488 sub sp, sp, #S_FRAME_SIZE
2489 ARM( stmib sp, {r1 - lr} )
2490 THUMB( stmia sp, {r0 - r12} )
2491 THUMB( str sp, [sp, #S_SP] )
2492 THUMB( str lr, [sp, #S_LR] )
2493 +
2494 mov r1, #\reason
2495 .endm
2496
2497 @@ -149,7 +234,11 @@ ENDPROC(__und_invalid)
2498 .macro svc_entry, stack_hole=0
2499 UNWIND(.fnstart )
2500 UNWIND(.save {r0 - pc} )
2501 +
2502 + pax_enter_kernel
2503 +
2504 sub sp, sp, #(S_FRAME_SIZE + \stack_hole - 4)
2505 +
2506 #ifdef CONFIG_THUMB2_KERNEL
2507 SPFIX( str r0, [sp] ) @ temporarily saved
2508 SPFIX( mov r0, sp )
2509 @@ -164,7 +253,12 @@ ENDPROC(__und_invalid)
2510 ldmia r0, {r3 - r5}
2511 add r7, sp, #S_SP - 4 @ here for interlock avoidance
2512 mov r6, #-1 @ "" "" "" ""
2513 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2514 + @ offset sp by 8 as done in pax_enter_kernel
2515 + add r2, sp, #(S_FRAME_SIZE + \stack_hole + 4)
2516 +#else
2517 add r2, sp, #(S_FRAME_SIZE + \stack_hole - 4)
2518 +#endif
2519 SPFIX( addeq r2, r2, #4 )
2520 str r3, [sp, #-4]! @ save the "real" r0 copied
2521 @ from the exception stack
2522 @@ -317,6 +411,9 @@ ENDPROC(__pabt_svc)
2523 .macro usr_entry
2524 UNWIND(.fnstart )
2525 UNWIND(.cantunwind ) @ don't unwind the user space
2526 +
2527 + pax_enter_kernel_user
2528 +
2529 sub sp, sp, #S_FRAME_SIZE
2530 ARM( stmib sp, {r1 - r12} )
2531 THUMB( stmia sp, {r0 - r12} )
2532 @@ -416,7 +513,9 @@ __und_usr:
2533 tst r3, #PSR_T_BIT @ Thumb mode?
2534 bne __und_usr_thumb
2535 sub r4, r2, #4 @ ARM instr at LR - 4
2536 + pax_open_userland
2537 1: ldrt r0, [r4]
2538 + pax_close_userland
2539 ARM_BE8(rev r0, r0) @ little endian instruction
2540
2541 @ r0 = 32-bit ARM instruction which caused the exception
2542 @@ -450,11 +549,15 @@ __und_usr_thumb:
2543 */
2544 .arch armv6t2
2545 #endif
2546 + pax_open_userland
2547 2: ldrht r5, [r4]
2548 + pax_close_userland
2549 ARM_BE8(rev16 r5, r5) @ little endian instruction
2550 cmp r5, #0xe800 @ 32bit instruction if xx != 0
2551 blo __und_usr_fault_16 @ 16bit undefined instruction
2552 + pax_open_userland
2553 3: ldrht r0, [r2]
2554 + pax_close_userland
2555 ARM_BE8(rev16 r0, r0) @ little endian instruction
2556 add r2, r2, #2 @ r2 is PC + 2, make it PC + 4
2557 str r2, [sp, #S_PC] @ it's a 2x16bit instr, update
2558 @@ -484,7 +587,8 @@ ENDPROC(__und_usr)
2559 */
2560 .pushsection .fixup, "ax"
2561 .align 2
2562 -4: mov pc, r9
2563 +4: pax_close_userland
2564 + mov pc, r9
2565 .popsection
2566 .pushsection __ex_table,"a"
2567 .long 1b, 4b
2568 @@ -694,7 +798,7 @@ ENTRY(__switch_to)
2569 THUMB( str lr, [ip], #4 )
2570 ldr r4, [r2, #TI_TP_VALUE]
2571 ldr r5, [r2, #TI_TP_VALUE + 4]
2572 -#ifdef CONFIG_CPU_USE_DOMAINS
2573 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2574 ldr r6, [r2, #TI_CPU_DOMAIN]
2575 #endif
2576 switch_tls r1, r4, r5, r3, r7
2577 @@ -703,7 +807,7 @@ ENTRY(__switch_to)
2578 ldr r8, =__stack_chk_guard
2579 ldr r7, [r7, #TSK_STACK_CANARY]
2580 #endif
2581 -#ifdef CONFIG_CPU_USE_DOMAINS
2582 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2583 mcr p15, 0, r6, c3, c0, 0 @ Set domain register
2584 #endif
2585 mov r5, r0
2586 diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
2587 index a2dcafd..1048b5a 100644
2588 --- a/arch/arm/kernel/entry-common.S
2589 +++ b/arch/arm/kernel/entry-common.S
2590 @@ -10,18 +10,46 @@
2591
2592 #include <asm/unistd.h>
2593 #include <asm/ftrace.h>
2594 +#include <asm/domain.h>
2595 #include <asm/unwind.h>
2596
2597 +#include "entry-header.S"
2598 +
2599 #ifdef CONFIG_NEED_RET_TO_USER
2600 #include <mach/entry-macro.S>
2601 #else
2602 .macro arch_ret_to_user, tmp1, tmp2
2603 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2604 + @ save regs
2605 + stmdb sp!, {r1, r2}
2606 + @ read DACR from cpu_domain into r1
2607 + mov r2, sp
2608 + @ assume 8K pages, since we have to split the immediate in two
2609 + bic r2, r2, #(0x1fc0)
2610 + bic r2, r2, #(0x3f)
2611 + ldr r1, [r2, #TI_CPU_DOMAIN]
2612 +#ifdef CONFIG_PAX_KERNEXEC
2613 + @ set type of DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2614 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2615 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2616 +#endif
2617 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2618 + @ set current DOMAIN_USER to DOMAIN_UDEREF
2619 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2620 + orr r1, r1, #(domain_val(DOMAIN_USER, DOMAIN_UDEREF))
2621 +#endif
2622 + @ write r1 to current_thread_info()->cpu_domain
2623 + str r1, [r2, #TI_CPU_DOMAIN]
2624 + @ write r1 to DACR
2625 + mcr p15, 0, r1, c3, c0, 0
2626 + @ instruction sync
2627 + instr_sync
2628 + @ restore regs
2629 + ldmia sp!, {r1, r2}
2630 +#endif
2631 .endm
2632 #endif
2633
2634 -#include "entry-header.S"
2635 -
2636 -
2637 .align 5
2638 /*
2639 * This is the fast syscall return path. We do as little as
2640 @@ -411,6 +439,12 @@ ENTRY(vector_swi)
2641 USER( ldr scno, [lr, #-4] ) @ get SWI instruction
2642 #endif
2643
2644 + /*
2645 + * do this here to avoid a performance hit of wrapping the code above
2646 + * that directly dereferences userland to parse the SWI instruction
2647 + */
2648 + pax_enter_kernel_user
2649 +
2650 adr tbl, sys_call_table @ load syscall table pointer
2651
2652 #if defined(CONFIG_OABI_COMPAT)
2653 diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
2654 index 39f89fb..d612bd9 100644
2655 --- a/arch/arm/kernel/entry-header.S
2656 +++ b/arch/arm/kernel/entry-header.S
2657 @@ -184,6 +184,60 @@
2658 msr cpsr_c, \rtemp @ switch back to the SVC mode
2659 .endm
2660
2661 + .macro pax_enter_kernel_user
2662 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2663 + @ save regs
2664 + stmdb sp!, {r0, r1}
2665 + @ read DACR from cpu_domain into r1
2666 + mov r0, sp
2667 + @ assume 8K pages, since we have to split the immediate in two
2668 + bic r0, r0, #(0x1fc0)
2669 + bic r0, r0, #(0x3f)
2670 + ldr r1, [r0, #TI_CPU_DOMAIN]
2671 +#ifdef CONFIG_PAX_MEMORY_UDEREF
2672 + @ set current DOMAIN_USER to DOMAIN_NOACCESS
2673 + bic r1, r1, #(domain_val(DOMAIN_USER, 3))
2674 +#endif
2675 +#ifdef CONFIG_PAX_KERNEXEC
2676 + @ set current DOMAIN_KERNEL to DOMAIN_KERNELCLIENT
2677 + bic r1, r1, #(domain_val(DOMAIN_KERNEL, 3))
2678 + orr r1, r1, #(domain_val(DOMAIN_KERNEL, DOMAIN_KERNELCLIENT))
2679 +#endif
2680 + @ write r1 to current_thread_info()->cpu_domain
2681 + str r1, [r0, #TI_CPU_DOMAIN]
2682 + @ write r1 to DACR
2683 + mcr p15, 0, r1, c3, c0, 0
2684 + @ instruction sync
2685 + instr_sync
2686 + @ restore regs
2687 + ldmia sp!, {r0, r1}
2688 +#endif
2689 + .endm
2690 +
2691 + .macro pax_exit_kernel
2692 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
2693 + @ save regs
2694 + stmdb sp!, {r0, r1}
2695 + @ read old DACR from stack into r1
2696 + ldr r1, [sp, #(8 + S_SP)]
2697 + sub r1, r1, #8
2698 + ldr r1, [r1]
2699 +
2700 + @ write r1 to current_thread_info()->cpu_domain
2701 + mov r0, sp
2702 + @ assume 8K pages, since we have to split the immediate in two
2703 + bic r0, r0, #(0x1fc0)
2704 + bic r0, r0, #(0x3f)
2705 + str r1, [r0, #TI_CPU_DOMAIN]
2706 + @ write r1 to DACR
2707 + mcr p15, 0, r1, c3, c0, 0
2708 + @ instruction sync
2709 + instr_sync
2710 + @ restore regs
2711 + ldmia sp!, {r0, r1}
2712 +#endif
2713 + .endm
2714 +
2715 #ifndef CONFIG_THUMB2_KERNEL
2716 .macro svc_exit, rpsr, irq = 0
2717 .if \irq != 0
2718 @@ -203,6 +257,9 @@
2719 blne trace_hardirqs_off
2720 #endif
2721 .endif
2722 +
2723 + pax_exit_kernel
2724 +
2725 msr spsr_cxsf, \rpsr
2726 #if defined(CONFIG_CPU_V6)
2727 ldr r0, [sp]
2728 @@ -266,6 +323,9 @@
2729 blne trace_hardirqs_off
2730 #endif
2731 .endif
2732 +
2733 + pax_exit_kernel
2734 +
2735 ldr lr, [sp, #S_SP] @ top of the stack
2736 ldrd r0, r1, [sp, #S_LR] @ calling lr and pc
2737 clrex @ clear the exclusive monitor
2738 diff --git a/arch/arm/kernel/fiq.c b/arch/arm/kernel/fiq.c
2739 index 918875d..cd5fa27 100644
2740 --- a/arch/arm/kernel/fiq.c
2741 +++ b/arch/arm/kernel/fiq.c
2742 @@ -87,7 +87,10 @@ void set_fiq_handler(void *start, unsigned int length)
2743 void *base = vectors_page;
2744 unsigned offset = FIQ_OFFSET;
2745
2746 + pax_open_kernel();
2747 memcpy(base + offset, start, length);
2748 + pax_close_kernel();
2749 +
2750 if (!cache_is_vipt_nonaliasing())
2751 flush_icache_range((unsigned long)base + offset, offset +
2752 length);
2753 diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S
2754 index f5f381d..a6f36a1 100644
2755 --- a/arch/arm/kernel/head.S
2756 +++ b/arch/arm/kernel/head.S
2757 @@ -437,7 +437,7 @@ __enable_mmu:
2758 mov r5, #(domain_val(DOMAIN_USER, DOMAIN_MANAGER) | \
2759 domain_val(DOMAIN_KERNEL, DOMAIN_MANAGER) | \
2760 domain_val(DOMAIN_TABLE, DOMAIN_MANAGER) | \
2761 - domain_val(DOMAIN_IO, DOMAIN_CLIENT))
2762 + domain_val(DOMAIN_IO, DOMAIN_KERNELCLIENT))
2763 mcr p15, 0, r5, c3, c0, 0 @ load domain access register
2764 mcr p15, 0, r4, c2, c0, 0 @ load page table pointer
2765 #endif
2766 diff --git a/arch/arm/kernel/module.c b/arch/arm/kernel/module.c
2767 index 45e4781..8eac93d 100644
2768 --- a/arch/arm/kernel/module.c
2769 +++ b/arch/arm/kernel/module.c
2770 @@ -38,12 +38,39 @@
2771 #endif
2772
2773 #ifdef CONFIG_MMU
2774 -void *module_alloc(unsigned long size)
2775 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
2776 {
2777 + if (!size || PAGE_ALIGN(size) > MODULES_END - MODULES_VADDR)
2778 + return NULL;
2779 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
2780 - GFP_KERNEL, PAGE_KERNEL_EXEC, NUMA_NO_NODE,
2781 + GFP_KERNEL, prot, NUMA_NO_NODE,
2782 __builtin_return_address(0));
2783 }
2784 +
2785 +void *module_alloc(unsigned long size)
2786 +{
2787 +
2788 +#ifdef CONFIG_PAX_KERNEXEC
2789 + return __module_alloc(size, PAGE_KERNEL);
2790 +#else
2791 + return __module_alloc(size, PAGE_KERNEL_EXEC);
2792 +#endif
2793 +
2794 +}
2795 +
2796 +#ifdef CONFIG_PAX_KERNEXEC
2797 +void module_free_exec(struct module *mod, void *module_region)
2798 +{
2799 + module_free(mod, module_region);
2800 +}
2801 +EXPORT_SYMBOL(module_free_exec);
2802 +
2803 +void *module_alloc_exec(unsigned long size)
2804 +{
2805 + return __module_alloc(size, PAGE_KERNEL_EXEC);
2806 +}
2807 +EXPORT_SYMBOL(module_alloc_exec);
2808 +#endif
2809 #endif
2810
2811 int
2812 diff --git a/arch/arm/kernel/patch.c b/arch/arm/kernel/patch.c
2813 index 07314af..c46655c 100644
2814 --- a/arch/arm/kernel/patch.c
2815 +++ b/arch/arm/kernel/patch.c
2816 @@ -18,6 +18,7 @@ void __kprobes __patch_text(void *addr, unsigned int insn)
2817 bool thumb2 = IS_ENABLED(CONFIG_THUMB2_KERNEL);
2818 int size;
2819
2820 + pax_open_kernel();
2821 if (thumb2 && __opcode_is_thumb16(insn)) {
2822 *(u16 *)addr = __opcode_to_mem_thumb16(insn);
2823 size = sizeof(u16);
2824 @@ -39,6 +40,7 @@ void __kprobes __patch_text(void *addr, unsigned int insn)
2825 *(u32 *)addr = insn;
2826 size = sizeof(u32);
2827 }
2828 + pax_close_kernel();
2829
2830 flush_icache_range((uintptr_t)(addr),
2831 (uintptr_t)(addr) + size);
2832 diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
2833 index 92f7b15..7048500 100644
2834 --- a/arch/arm/kernel/process.c
2835 +++ b/arch/arm/kernel/process.c
2836 @@ -217,6 +217,7 @@ void machine_power_off(void)
2837
2838 if (pm_power_off)
2839 pm_power_off();
2840 + BUG();
2841 }
2842
2843 /*
2844 @@ -230,7 +231,7 @@ void machine_power_off(void)
2845 * executing pre-reset code, and using RAM that the primary CPU's code wishes
2846 * to use. Implementing such co-ordination would be essentially impossible.
2847 */
2848 -void machine_restart(char *cmd)
2849 +__noreturn void machine_restart(char *cmd)
2850 {
2851 local_irq_disable();
2852 smp_send_stop();
2853 @@ -253,8 +254,8 @@ void __show_regs(struct pt_regs *regs)
2854
2855 show_regs_print_info(KERN_DEFAULT);
2856
2857 - print_symbol("PC is at %s\n", instruction_pointer(regs));
2858 - print_symbol("LR is at %s\n", regs->ARM_lr);
2859 + printk("PC is at %pA\n", (void *)instruction_pointer(regs));
2860 + printk("LR is at %pA\n", (void *)regs->ARM_lr);
2861 printk("pc : [<%08lx>] lr : [<%08lx>] psr: %08lx\n"
2862 "sp : %08lx ip : %08lx fp : %08lx\n",
2863 regs->ARM_pc, regs->ARM_lr, regs->ARM_cpsr,
2864 @@ -425,12 +426,6 @@ unsigned long get_wchan(struct task_struct *p)
2865 return 0;
2866 }
2867
2868 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2869 -{
2870 - unsigned long range_end = mm->brk + 0x02000000;
2871 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
2872 -}
2873 -
2874 #ifdef CONFIG_MMU
2875 #ifdef CONFIG_KUSER_HELPERS
2876 /*
2877 @@ -446,7 +441,7 @@ static struct vm_area_struct gate_vma = {
2878
2879 static int __init gate_vma_init(void)
2880 {
2881 - gate_vma.vm_page_prot = PAGE_READONLY_EXEC;
2882 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
2883 return 0;
2884 }
2885 arch_initcall(gate_vma_init);
2886 @@ -472,41 +467,16 @@ int in_gate_area_no_mm(unsigned long addr)
2887
2888 const char *arch_vma_name(struct vm_area_struct *vma)
2889 {
2890 - return is_gate_vma(vma) ? "[vectors]" :
2891 - (vma->vm_mm && vma->vm_start == vma->vm_mm->context.sigpage) ?
2892 - "[sigpage]" : NULL;
2893 + return is_gate_vma(vma) ? "[vectors]" : NULL;
2894 }
2895
2896 -static struct page *signal_page;
2897 -extern struct page *get_signal_page(void);
2898 -
2899 int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
2900 {
2901 struct mm_struct *mm = current->mm;
2902 - unsigned long addr;
2903 - int ret;
2904 -
2905 - if (!signal_page)
2906 - signal_page = get_signal_page();
2907 - if (!signal_page)
2908 - return -ENOMEM;
2909
2910 down_write(&mm->mmap_sem);
2911 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
2912 - if (IS_ERR_VALUE(addr)) {
2913 - ret = addr;
2914 - goto up_fail;
2915 - }
2916 -
2917 - ret = install_special_mapping(mm, addr, PAGE_SIZE,
2918 - VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
2919 - &signal_page);
2920 -
2921 - if (ret == 0)
2922 - mm->context.sigpage = addr;
2923 -
2924 - up_fail:
2925 + mm->context.sigpage = (PAGE_OFFSET + (get_random_int() % 0x3FFEFFE0)) & 0xFFFFFFFC;
2926 up_write(&mm->mmap_sem);
2927 - return ret;
2928 + return 0;
2929 }
2930 #endif
2931 diff --git a/arch/arm/kernel/psci.c b/arch/arm/kernel/psci.c
2932 index 4693188..4596c5e 100644
2933 --- a/arch/arm/kernel/psci.c
2934 +++ b/arch/arm/kernel/psci.c
2935 @@ -24,7 +24,7 @@
2936 #include <asm/opcodes-virt.h>
2937 #include <asm/psci.h>
2938
2939 -struct psci_operations psci_ops;
2940 +struct psci_operations psci_ops __read_only;
2941
2942 static int (*invoke_psci_fn)(u32, u32, u32, u32);
2943
2944 diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
2945 index 0dd3b79..e018f64 100644
2946 --- a/arch/arm/kernel/ptrace.c
2947 +++ b/arch/arm/kernel/ptrace.c
2948 @@ -929,10 +929,19 @@ static int tracehook_report_syscall(struct pt_regs *regs,
2949 return current_thread_info()->syscall;
2950 }
2951
2952 +#ifdef CONFIG_GRKERNSEC_SETXID
2953 +extern void gr_delayed_cred_worker(void);
2954 +#endif
2955 +
2956 asmlinkage int syscall_trace_enter(struct pt_regs *regs, int scno)
2957 {
2958 current_thread_info()->syscall = scno;
2959
2960 +#ifdef CONFIG_GRKERNSEC_SETXID
2961 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
2962 + gr_delayed_cred_worker();
2963 +#endif
2964 +
2965 /* Do the secure computing check first; failures should be fast. */
2966 if (secure_computing(scno) == -1)
2967 return -1;
2968 diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
2969 index 1e8b030..37c3022 100644
2970 --- a/arch/arm/kernel/setup.c
2971 +++ b/arch/arm/kernel/setup.c
2972 @@ -100,21 +100,23 @@ EXPORT_SYMBOL(system_serial_high);
2973 unsigned int elf_hwcap __read_mostly;
2974 EXPORT_SYMBOL(elf_hwcap);
2975
2976 +pteval_t __supported_pte_mask __read_only;
2977 +pmdval_t __supported_pmd_mask __read_only;
2978
2979 #ifdef MULTI_CPU
2980 -struct processor processor __read_mostly;
2981 +struct processor processor __read_only;
2982 #endif
2983 #ifdef MULTI_TLB
2984 -struct cpu_tlb_fns cpu_tlb __read_mostly;
2985 +struct cpu_tlb_fns cpu_tlb __read_only;
2986 #endif
2987 #ifdef MULTI_USER
2988 -struct cpu_user_fns cpu_user __read_mostly;
2989 +struct cpu_user_fns cpu_user __read_only;
2990 #endif
2991 #ifdef MULTI_CACHE
2992 -struct cpu_cache_fns cpu_cache __read_mostly;
2993 +struct cpu_cache_fns cpu_cache __read_only;
2994 #endif
2995 #ifdef CONFIG_OUTER_CACHE
2996 -struct outer_cache_fns outer_cache __read_mostly;
2997 +struct outer_cache_fns outer_cache __read_only;
2998 EXPORT_SYMBOL(outer_cache);
2999 #endif
3000
3001 @@ -247,9 +249,13 @@ static int __get_cpu_architecture(void)
3002 asm("mrc p15, 0, %0, c0, c1, 4"
3003 : "=r" (mmfr0));
3004 if ((mmfr0 & 0x0000000f) >= 0x00000003 ||
3005 - (mmfr0 & 0x000000f0) >= 0x00000030)
3006 + (mmfr0 & 0x000000f0) >= 0x00000030) {
3007 cpu_arch = CPU_ARCH_ARMv7;
3008 - else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
3009 + if ((mmfr0 & 0x0000000f) == 0x00000005 || (mmfr0 & 0x0000000f) == 0x00000004) {
3010 + __supported_pte_mask |= L_PTE_PXN;
3011 + __supported_pmd_mask |= PMD_PXNTABLE;
3012 + }
3013 + } else if ((mmfr0 & 0x0000000f) == 0x00000002 ||
3014 (mmfr0 & 0x000000f0) == 0x00000020)
3015 cpu_arch = CPU_ARCH_ARMv6;
3016 else
3017 diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
3018 index 04d6388..5115238 100644
3019 --- a/arch/arm/kernel/signal.c
3020 +++ b/arch/arm/kernel/signal.c
3021 @@ -23,8 +23,6 @@
3022
3023 extern const unsigned long sigreturn_codes[7];
3024
3025 -static unsigned long signal_return_offset;
3026 -
3027 #ifdef CONFIG_CRUNCH
3028 static int preserve_crunch_context(struct crunch_sigframe __user *frame)
3029 {
3030 @@ -395,8 +393,7 @@ setup_return(struct pt_regs *regs, struct ksignal *ksig,
3031 * except when the MPU has protected the vectors
3032 * page from PL0
3033 */
3034 - retcode = mm->context.sigpage + signal_return_offset +
3035 - (idx << 2) + thumb;
3036 + retcode = mm->context.sigpage + (idx << 2) + thumb;
3037 } else
3038 #endif
3039 {
3040 @@ -600,33 +597,3 @@ do_work_pending(struct pt_regs *regs, unsigned int thread_flags, int syscall)
3041 } while (thread_flags & _TIF_WORK_MASK);
3042 return 0;
3043 }
3044 -
3045 -struct page *get_signal_page(void)
3046 -{
3047 - unsigned long ptr;
3048 - unsigned offset;
3049 - struct page *page;
3050 - void *addr;
3051 -
3052 - page = alloc_pages(GFP_KERNEL, 0);
3053 -
3054 - if (!page)
3055 - return NULL;
3056 -
3057 - addr = page_address(page);
3058 -
3059 - /* Give the signal return code some randomness */
3060 - offset = 0x200 + (get_random_int() & 0x7fc);
3061 - signal_return_offset = offset;
3062 -
3063 - /*
3064 - * Copy signal return handlers into the vector page, and
3065 - * set sigreturn to be a pointer to these.
3066 - */
3067 - memcpy(addr + offset, sigreturn_codes, sizeof(sigreturn_codes));
3068 -
3069 - ptr = (unsigned long)addr + offset;
3070 - flush_icache_range(ptr, ptr + sizeof(sigreturn_codes));
3071 -
3072 - return page;
3073 -}
3074 diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
3075 index b7b4c86..47c4f77 100644
3076 --- a/arch/arm/kernel/smp.c
3077 +++ b/arch/arm/kernel/smp.c
3078 @@ -73,7 +73,7 @@ enum ipi_msg_type {
3079
3080 static DECLARE_COMPLETION(cpu_running);
3081
3082 -static struct smp_operations smp_ops;
3083 +static struct smp_operations smp_ops __read_only;
3084
3085 void __init smp_set_ops(struct smp_operations *ops)
3086 {
3087 diff --git a/arch/arm/kernel/tcm.c b/arch/arm/kernel/tcm.c
3088 index 7a3be1d..b00c7de 100644
3089 --- a/arch/arm/kernel/tcm.c
3090 +++ b/arch/arm/kernel/tcm.c
3091 @@ -61,7 +61,7 @@ static struct map_desc itcm_iomap[] __initdata = {
3092 .virtual = ITCM_OFFSET,
3093 .pfn = __phys_to_pfn(ITCM_OFFSET),
3094 .length = 0,
3095 - .type = MT_MEMORY_RWX_ITCM,
3096 + .type = MT_MEMORY_RX_ITCM,
3097 }
3098 };
3099
3100 @@ -267,7 +267,9 @@ no_dtcm:
3101 start = &__sitcm_text;
3102 end = &__eitcm_text;
3103 ram = &__itcm_start;
3104 + pax_open_kernel();
3105 memcpy(start, ram, itcm_code_sz);
3106 + pax_close_kernel();
3107 pr_debug("CPU ITCM: copied code from %p - %p\n",
3108 start, end);
3109 itcm_present = true;
3110 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
3111 index 172ee18..ce4ec3d 100644
3112 --- a/arch/arm/kernel/traps.c
3113 +++ b/arch/arm/kernel/traps.c
3114 @@ -62,7 +62,7 @@ static void dump_mem(const char *, const char *, unsigned long, unsigned long);
3115 void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
3116 {
3117 #ifdef CONFIG_KALLSYMS
3118 - printk("[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
3119 + printk("[<%08lx>] (%pA) from [<%08lx>] (%pA)\n", where, (void *)where, from, (void *)from);
3120 #else
3121 printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
3122 #endif
3123 @@ -264,6 +264,8 @@ static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
3124 static int die_owner = -1;
3125 static unsigned int die_nest_count;
3126
3127 +extern void gr_handle_kernel_exploit(void);
3128 +
3129 static unsigned long oops_begin(void)
3130 {
3131 int cpu;
3132 @@ -306,6 +308,9 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
3133 panic("Fatal exception in interrupt");
3134 if (panic_on_oops)
3135 panic("Fatal exception");
3136 +
3137 + gr_handle_kernel_exploit();
3138 +
3139 if (signr)
3140 do_exit(signr);
3141 }
3142 @@ -642,7 +647,9 @@ asmlinkage int arm_syscall(int no, struct pt_regs *regs)
3143 * The user helper at 0xffff0fe0 must be used instead.
3144 * (see entry-armv.S for details)
3145 */
3146 + pax_open_kernel();
3147 *((unsigned int *)0xffff0ff0) = regs->ARM_r0;
3148 + pax_close_kernel();
3149 }
3150 return 0;
3151
3152 @@ -899,7 +906,11 @@ void __init early_trap_init(void *vectors_base)
3153 kuser_init(vectors_base);
3154
3155 flush_icache_range(vectors, vectors + PAGE_SIZE * 2);
3156 - modify_domain(DOMAIN_USER, DOMAIN_CLIENT);
3157 +
3158 +#ifndef CONFIG_PAX_MEMORY_UDEREF
3159 + modify_domain(DOMAIN_USER, DOMAIN_USERCLIENT);
3160 +#endif
3161 +
3162 #else /* ifndef CONFIG_CPU_V7M */
3163 /*
3164 * on V7-M there is no need to copy the vector table to a dedicated
3165 diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
3166 index 7bcee5c..e2f3249 100644
3167 --- a/arch/arm/kernel/vmlinux.lds.S
3168 +++ b/arch/arm/kernel/vmlinux.lds.S
3169 @@ -8,7 +8,11 @@
3170 #include <asm/thread_info.h>
3171 #include <asm/memory.h>
3172 #include <asm/page.h>
3173 -
3174 +
3175 +#ifdef CONFIG_PAX_KERNEXEC
3176 +#include <asm/pgtable.h>
3177 +#endif
3178 +
3179 #define PROC_INFO \
3180 . = ALIGN(4); \
3181 VMLINUX_SYMBOL(__proc_info_begin) = .; \
3182 @@ -34,7 +38,7 @@
3183 #endif
3184
3185 #if (defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)) || \
3186 - defined(CONFIG_GENERIC_BUG)
3187 + defined(CONFIG_GENERIC_BUG) || defined(CONFIG_PAX_REFCOUNT)
3188 #define ARM_EXIT_KEEP(x) x
3189 #define ARM_EXIT_DISCARD(x)
3190 #else
3191 @@ -90,6 +94,11 @@ SECTIONS
3192 _text = .;
3193 HEAD_TEXT
3194 }
3195 +
3196 +#ifdef CONFIG_PAX_KERNEXEC
3197 + . = ALIGN(1<<SECTION_SHIFT);
3198 +#endif
3199 +
3200 .text : { /* Real text segment */
3201 _stext = .; /* Text and read-only data */
3202 __exception_text_start = .;
3203 @@ -112,6 +121,8 @@ SECTIONS
3204 ARM_CPU_KEEP(PROC_INFO)
3205 }
3206
3207 + _etext = .; /* End of text section */
3208 +
3209 RO_DATA(PAGE_SIZE)
3210
3211 . = ALIGN(4);
3212 @@ -142,7 +153,9 @@ SECTIONS
3213
3214 NOTES
3215
3216 - _etext = .; /* End of text and rodata section */
3217 +#ifdef CONFIG_PAX_KERNEXEC
3218 + . = ALIGN(1<<SECTION_SHIFT);
3219 +#endif
3220
3221 #ifndef CONFIG_XIP_KERNEL
3222 . = ALIGN(PAGE_SIZE);
3223 @@ -220,6 +233,11 @@ SECTIONS
3224 . = PAGE_OFFSET + TEXT_OFFSET;
3225 #else
3226 __init_end = .;
3227 +
3228 +#ifdef CONFIG_PAX_KERNEXEC
3229 + . = ALIGN(1<<SECTION_SHIFT);
3230 +#endif
3231 +
3232 . = ALIGN(THREAD_SIZE);
3233 __data_loc = .;
3234 #endif
3235 diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
3236 index bd18bb8..87ede26 100644
3237 --- a/arch/arm/kvm/arm.c
3238 +++ b/arch/arm/kvm/arm.c
3239 @@ -57,7 +57,7 @@ static unsigned long hyp_default_vectors;
3240 static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
3241
3242 /* The VMID used in the VTTBR */
3243 -static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
3244 +static atomic64_unchecked_t kvm_vmid_gen = ATOMIC64_INIT(1);
3245 static u8 kvm_next_vmid;
3246 static DEFINE_SPINLOCK(kvm_vmid_lock);
3247
3248 @@ -408,7 +408,7 @@ void force_vm_exit(const cpumask_t *mask)
3249 */
3250 static bool need_new_vmid_gen(struct kvm *kvm)
3251 {
3252 - return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
3253 + return unlikely(kvm->arch.vmid_gen != atomic64_read_unchecked(&kvm_vmid_gen));
3254 }
3255
3256 /**
3257 @@ -441,7 +441,7 @@ static void update_vttbr(struct kvm *kvm)
3258
3259 /* First user of a new VMID generation? */
3260 if (unlikely(kvm_next_vmid == 0)) {
3261 - atomic64_inc(&kvm_vmid_gen);
3262 + atomic64_inc_unchecked(&kvm_vmid_gen);
3263 kvm_next_vmid = 1;
3264
3265 /*
3266 @@ -458,7 +458,7 @@ static void update_vttbr(struct kvm *kvm)
3267 kvm_call_hyp(__kvm_flush_vm_context);
3268 }
3269
3270 - kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
3271 + kvm->arch.vmid_gen = atomic64_read_unchecked(&kvm_vmid_gen);
3272 kvm->arch.vmid = kvm_next_vmid;
3273 kvm_next_vmid++;
3274
3275 diff --git a/arch/arm/lib/clear_user.S b/arch/arm/lib/clear_user.S
3276 index 14a0d98..7771a7d 100644
3277 --- a/arch/arm/lib/clear_user.S
3278 +++ b/arch/arm/lib/clear_user.S
3279 @@ -12,14 +12,14 @@
3280
3281 .text
3282
3283 -/* Prototype: int __clear_user(void *addr, size_t sz)
3284 +/* Prototype: int ___clear_user(void *addr, size_t sz)
3285 * Purpose : clear some user memory
3286 * Params : addr - user memory address to clear
3287 * : sz - number of bytes to clear
3288 * Returns : number of bytes NOT cleared
3289 */
3290 ENTRY(__clear_user_std)
3291 -WEAK(__clear_user)
3292 +WEAK(___clear_user)
3293 stmfd sp!, {r1, lr}
3294 mov r2, #0
3295 cmp r1, #4
3296 @@ -44,7 +44,7 @@ WEAK(__clear_user)
3297 USER( strnebt r2, [r0])
3298 mov r0, #0
3299 ldmfd sp!, {r1, pc}
3300 -ENDPROC(__clear_user)
3301 +ENDPROC(___clear_user)
3302 ENDPROC(__clear_user_std)
3303
3304 .pushsection .fixup,"ax"
3305 diff --git a/arch/arm/lib/copy_from_user.S b/arch/arm/lib/copy_from_user.S
3306 index 66a477a..bee61d3 100644
3307 --- a/arch/arm/lib/copy_from_user.S
3308 +++ b/arch/arm/lib/copy_from_user.S
3309 @@ -16,7 +16,7 @@
3310 /*
3311 * Prototype:
3312 *
3313 - * size_t __copy_from_user(void *to, const void *from, size_t n)
3314 + * size_t ___copy_from_user(void *to, const void *from, size_t n)
3315 *
3316 * Purpose:
3317 *
3318 @@ -84,11 +84,11 @@
3319
3320 .text
3321
3322 -ENTRY(__copy_from_user)
3323 +ENTRY(___copy_from_user)
3324
3325 #include "copy_template.S"
3326
3327 -ENDPROC(__copy_from_user)
3328 +ENDPROC(___copy_from_user)
3329
3330 .pushsection .fixup,"ax"
3331 .align 0
3332 diff --git a/arch/arm/lib/copy_page.S b/arch/arm/lib/copy_page.S
3333 index 6ee2f67..d1cce76 100644
3334 --- a/arch/arm/lib/copy_page.S
3335 +++ b/arch/arm/lib/copy_page.S
3336 @@ -10,6 +10,7 @@
3337 * ASM optimised string functions
3338 */
3339 #include <linux/linkage.h>
3340 +#include <linux/const.h>
3341 #include <asm/assembler.h>
3342 #include <asm/asm-offsets.h>
3343 #include <asm/cache.h>
3344 diff --git a/arch/arm/lib/copy_to_user.S b/arch/arm/lib/copy_to_user.S
3345 index d066df6..df28194 100644
3346 --- a/arch/arm/lib/copy_to_user.S
3347 +++ b/arch/arm/lib/copy_to_user.S
3348 @@ -16,7 +16,7 @@
3349 /*
3350 * Prototype:
3351 *
3352 - * size_t __copy_to_user(void *to, const void *from, size_t n)
3353 + * size_t ___copy_to_user(void *to, const void *from, size_t n)
3354 *
3355 * Purpose:
3356 *
3357 @@ -88,11 +88,11 @@
3358 .text
3359
3360 ENTRY(__copy_to_user_std)
3361 -WEAK(__copy_to_user)
3362 +WEAK(___copy_to_user)
3363
3364 #include "copy_template.S"
3365
3366 -ENDPROC(__copy_to_user)
3367 +ENDPROC(___copy_to_user)
3368 ENDPROC(__copy_to_user_std)
3369
3370 .pushsection .fixup,"ax"
3371 diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S
3372 index 7d08b43..f7ca7ea 100644
3373 --- a/arch/arm/lib/csumpartialcopyuser.S
3374 +++ b/arch/arm/lib/csumpartialcopyuser.S
3375 @@ -57,8 +57,8 @@
3376 * Returns : r0 = checksum, [[sp, #0], #0] = 0 or -EFAULT
3377 */
3378
3379 -#define FN_ENTRY ENTRY(csum_partial_copy_from_user)
3380 -#define FN_EXIT ENDPROC(csum_partial_copy_from_user)
3381 +#define FN_ENTRY ENTRY(__csum_partial_copy_from_user)
3382 +#define FN_EXIT ENDPROC(__csum_partial_copy_from_user)
3383
3384 #include "csumpartialcopygeneric.S"
3385
3386 diff --git a/arch/arm/lib/delay.c b/arch/arm/lib/delay.c
3387 index 5306de3..aed6d03 100644
3388 --- a/arch/arm/lib/delay.c
3389 +++ b/arch/arm/lib/delay.c
3390 @@ -28,7 +28,7 @@
3391 /*
3392 * Default to the loop-based delay implementation.
3393 */
3394 -struct arm_delay_ops arm_delay_ops = {
3395 +struct arm_delay_ops arm_delay_ops __read_only = {
3396 .delay = __loop_delay,
3397 .const_udelay = __loop_const_udelay,
3398 .udelay = __loop_udelay,
3399 diff --git a/arch/arm/lib/uaccess_with_memcpy.c b/arch/arm/lib/uaccess_with_memcpy.c
3400 index 3e58d71..029817c 100644
3401 --- a/arch/arm/lib/uaccess_with_memcpy.c
3402 +++ b/arch/arm/lib/uaccess_with_memcpy.c
3403 @@ -136,7 +136,7 @@ out:
3404 }
3405
3406 unsigned long
3407 -__copy_to_user(void __user *to, const void *from, unsigned long n)
3408 +___copy_to_user(void __user *to, const void *from, unsigned long n)
3409 {
3410 /*
3411 * This test is stubbed out of the main function above to keep
3412 @@ -190,7 +190,7 @@ out:
3413 return n;
3414 }
3415
3416 -unsigned long __clear_user(void __user *addr, unsigned long n)
3417 +unsigned long ___clear_user(void __user *addr, unsigned long n)
3418 {
3419 /* See rational for this in __copy_to_user() above. */
3420 if (n < 64)
3421 diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
3422 index f7ca97b..3d7e719 100644
3423 --- a/arch/arm/mach-at91/setup.c
3424 +++ b/arch/arm/mach-at91/setup.c
3425 @@ -81,7 +81,7 @@ void __init at91_init_sram(int bank, unsigned long base, unsigned int length)
3426
3427 desc->pfn = __phys_to_pfn(base);
3428 desc->length = length;
3429 - desc->type = MT_MEMORY_RWX_NONCACHED;
3430 + desc->type = MT_MEMORY_RW_NONCACHED;
3431
3432 pr_info("AT91: sram at 0x%lx of 0x%x mapped at 0x%lx\n",
3433 base, length, desc->virtual);
3434 diff --git a/arch/arm/mach-kirkwood/common.c b/arch/arm/mach-kirkwood/common.c
3435 index f3407a5..bd4256f 100644
3436 --- a/arch/arm/mach-kirkwood/common.c
3437 +++ b/arch/arm/mach-kirkwood/common.c
3438 @@ -156,7 +156,16 @@ static void clk_gate_fn_disable(struct clk_hw *hw)
3439 clk_gate_ops.disable(hw);
3440 }
3441
3442 -static struct clk_ops clk_gate_fn_ops;
3443 +static int clk_gate_fn_is_enabled(struct clk_hw *hw)
3444 +{
3445 + return clk_gate_ops.is_enabled(hw);
3446 +}
3447 +
3448 +static struct clk_ops clk_gate_fn_ops = {
3449 + .enable = clk_gate_fn_enable,
3450 + .disable = clk_gate_fn_disable,
3451 + .is_enabled = clk_gate_fn_is_enabled,
3452 +};
3453
3454 static struct clk __init *clk_register_gate_fn(struct device *dev,
3455 const char *name,
3456 @@ -190,14 +199,6 @@ static struct clk __init *clk_register_gate_fn(struct device *dev,
3457 gate_fn->fn_en = fn_en;
3458 gate_fn->fn_dis = fn_dis;
3459
3460 - /* ops is the gate ops, but with our enable/disable functions */
3461 - if (clk_gate_fn_ops.enable != clk_gate_fn_enable ||
3462 - clk_gate_fn_ops.disable != clk_gate_fn_disable) {
3463 - clk_gate_fn_ops = clk_gate_ops;
3464 - clk_gate_fn_ops.enable = clk_gate_fn_enable;
3465 - clk_gate_fn_ops.disable = clk_gate_fn_disable;
3466 - }
3467 -
3468 clk = clk_register(dev, &gate_fn->gate.hw);
3469
3470 if (IS_ERR(clk))
3471 diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
3472 index aead77a..a2253fa 100644
3473 --- a/arch/arm/mach-omap2/board-n8x0.c
3474 +++ b/arch/arm/mach-omap2/board-n8x0.c
3475 @@ -568,7 +568,7 @@ static int n8x0_menelaus_late_init(struct device *dev)
3476 }
3477 #endif
3478
3479 -static struct menelaus_platform_data n8x0_menelaus_platform_data __initdata = {
3480 +static struct menelaus_platform_data n8x0_menelaus_platform_data __initconst = {
3481 .late_init = n8x0_menelaus_late_init,
3482 };
3483
3484 diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
3485 index ab43755..ccfa231 100644
3486 --- a/arch/arm/mach-omap2/gpmc.c
3487 +++ b/arch/arm/mach-omap2/gpmc.c
3488 @@ -148,7 +148,6 @@ struct omap3_gpmc_regs {
3489 };
3490
3491 static struct gpmc_client_irq gpmc_client_irq[GPMC_NR_IRQ];
3492 -static struct irq_chip gpmc_irq_chip;
3493 static int gpmc_irq_start;
3494
3495 static struct resource gpmc_mem_root;
3496 @@ -716,6 +715,18 @@ static void gpmc_irq_noop(struct irq_data *data) { }
3497
3498 static unsigned int gpmc_irq_noop_ret(struct irq_data *data) { return 0; }
3499
3500 +static struct irq_chip gpmc_irq_chip = {
3501 + .name = "gpmc",
3502 + .irq_startup = gpmc_irq_noop_ret,
3503 + .irq_enable = gpmc_irq_enable,
3504 + .irq_disable = gpmc_irq_disable,
3505 + .irq_shutdown = gpmc_irq_noop,
3506 + .irq_ack = gpmc_irq_noop,
3507 + .irq_mask = gpmc_irq_noop,
3508 + .irq_unmask = gpmc_irq_noop,
3509 +
3510 +};
3511 +
3512 static int gpmc_setup_irq(void)
3513 {
3514 int i;
3515 @@ -730,15 +741,6 @@ static int gpmc_setup_irq(void)
3516 return gpmc_irq_start;
3517 }
3518
3519 - gpmc_irq_chip.name = "gpmc";
3520 - gpmc_irq_chip.irq_startup = gpmc_irq_noop_ret;
3521 - gpmc_irq_chip.irq_enable = gpmc_irq_enable;
3522 - gpmc_irq_chip.irq_disable = gpmc_irq_disable;
3523 - gpmc_irq_chip.irq_shutdown = gpmc_irq_noop;
3524 - gpmc_irq_chip.irq_ack = gpmc_irq_noop;
3525 - gpmc_irq_chip.irq_mask = gpmc_irq_noop;
3526 - gpmc_irq_chip.irq_unmask = gpmc_irq_noop;
3527 -
3528 gpmc_client_irq[0].bitmask = GPMC_IRQ_FIFOEVENTENABLE;
3529 gpmc_client_irq[1].bitmask = GPMC_IRQ_COUNT_EVENT;
3530
3531 diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3532 index 667915d..2ee1219 100644
3533 --- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3534 +++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
3535 @@ -84,7 +84,7 @@ struct cpu_pm_ops {
3536 int (*finish_suspend)(unsigned long cpu_state);
3537 void (*resume)(void);
3538 void (*scu_prepare)(unsigned int cpu_id, unsigned int cpu_state);
3539 -};
3540 +} __no_const;
3541
3542 static DEFINE_PER_CPU(struct omap4_cpu_pm_info, omap4_pm_info);
3543 static struct powerdomain *mpuss_pd;
3544 @@ -102,7 +102,7 @@ static void dummy_cpu_resume(void)
3545 static void dummy_scu_prepare(unsigned int cpu_id, unsigned int cpu_state)
3546 {}
3547
3548 -struct cpu_pm_ops omap_pm_ops = {
3549 +static struct cpu_pm_ops omap_pm_ops __read_only = {
3550 .finish_suspend = default_finish_suspend,
3551 .resume = dummy_cpu_resume,
3552 .scu_prepare = dummy_scu_prepare,
3553 diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c
3554 index 3664562..72f85c6 100644
3555 --- a/arch/arm/mach-omap2/omap-wakeupgen.c
3556 +++ b/arch/arm/mach-omap2/omap-wakeupgen.c
3557 @@ -343,7 +343,7 @@ static int irq_cpu_hotplug_notify(struct notifier_block *self,
3558 return NOTIFY_OK;
3559 }
3560
3561 -static struct notifier_block __refdata irq_hotplug_notifier = {
3562 +static struct notifier_block irq_hotplug_notifier = {
3563 .notifier_call = irq_cpu_hotplug_notify,
3564 };
3565
3566 diff --git a/arch/arm/mach-omap2/omap_device.c b/arch/arm/mach-omap2/omap_device.c
3567 index 01ef59d..32ae28a8 100644
3568 --- a/arch/arm/mach-omap2/omap_device.c
3569 +++ b/arch/arm/mach-omap2/omap_device.c
3570 @@ -510,7 +510,7 @@ void omap_device_delete(struct omap_device *od)
3571 struct platform_device __init *omap_device_build(const char *pdev_name,
3572 int pdev_id,
3573 struct omap_hwmod *oh,
3574 - void *pdata, int pdata_len)
3575 + const void *pdata, int pdata_len)
3576 {
3577 struct omap_hwmod *ohs[] = { oh };
3578
3579 @@ -538,7 +538,7 @@ struct platform_device __init *omap_device_build(const char *pdev_name,
3580 struct platform_device __init *omap_device_build_ss(const char *pdev_name,
3581 int pdev_id,
3582 struct omap_hwmod **ohs,
3583 - int oh_cnt, void *pdata,
3584 + int oh_cnt, const void *pdata,
3585 int pdata_len)
3586 {
3587 int ret = -ENOMEM;
3588 diff --git a/arch/arm/mach-omap2/omap_device.h b/arch/arm/mach-omap2/omap_device.h
3589 index 78c02b3..c94109a 100644
3590 --- a/arch/arm/mach-omap2/omap_device.h
3591 +++ b/arch/arm/mach-omap2/omap_device.h
3592 @@ -72,12 +72,12 @@ int omap_device_idle(struct platform_device *pdev);
3593 /* Core code interface */
3594
3595 struct platform_device *omap_device_build(const char *pdev_name, int pdev_id,
3596 - struct omap_hwmod *oh, void *pdata,
3597 + struct omap_hwmod *oh, const void *pdata,
3598 int pdata_len);
3599
3600 struct platform_device *omap_device_build_ss(const char *pdev_name, int pdev_id,
3601 struct omap_hwmod **oh, int oh_cnt,
3602 - void *pdata, int pdata_len);
3603 + const void *pdata, int pdata_len);
3604
3605 struct omap_device *omap_device_alloc(struct platform_device *pdev,
3606 struct omap_hwmod **ohs, int oh_cnt);
3607 diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
3608 index 66c60fe..c78950d 100644
3609 --- a/arch/arm/mach-omap2/omap_hwmod.c
3610 +++ b/arch/arm/mach-omap2/omap_hwmod.c
3611 @@ -194,10 +194,10 @@ struct omap_hwmod_soc_ops {
3612 int (*init_clkdm)(struct omap_hwmod *oh);
3613 void (*update_context_lost)(struct omap_hwmod *oh);
3614 int (*get_context_lost)(struct omap_hwmod *oh);
3615 -};
3616 +} __no_const;
3617
3618 /* soc_ops: adapts the omap_hwmod code to the currently-booted SoC */
3619 -static struct omap_hwmod_soc_ops soc_ops;
3620 +static struct omap_hwmod_soc_ops soc_ops __read_only;
3621
3622 /* omap_hwmod_list contains all registered struct omap_hwmods */
3623 static LIST_HEAD(omap_hwmod_list);
3624 diff --git a/arch/arm/mach-omap2/powerdomains43xx_data.c b/arch/arm/mach-omap2/powerdomains43xx_data.c
3625 index 95fee54..cfa9cf1 100644
3626 --- a/arch/arm/mach-omap2/powerdomains43xx_data.c
3627 +++ b/arch/arm/mach-omap2/powerdomains43xx_data.c
3628 @@ -10,6 +10,7 @@
3629
3630 #include <linux/kernel.h>
3631 #include <linux/init.h>
3632 +#include <asm/pgtable.h>
3633
3634 #include "powerdomain.h"
3635
3636 @@ -129,7 +130,9 @@ static int am43xx_check_vcvp(void)
3637
3638 void __init am43xx_powerdomains_init(void)
3639 {
3640 - omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
3641 + pax_open_kernel();
3642 + *(void **)&omap4_pwrdm_operations.pwrdm_has_voltdm = am43xx_check_vcvp;
3643 + pax_close_kernel();
3644 pwrdm_register_platform_funcs(&omap4_pwrdm_operations);
3645 pwrdm_register_pwrdms(powerdomains_am43xx);
3646 pwrdm_complete_init();
3647 diff --git a/arch/arm/mach-omap2/wd_timer.c b/arch/arm/mach-omap2/wd_timer.c
3648 index d15c7bb..b2d1f0c 100644
3649 --- a/arch/arm/mach-omap2/wd_timer.c
3650 +++ b/arch/arm/mach-omap2/wd_timer.c
3651 @@ -110,7 +110,9 @@ static int __init omap_init_wdt(void)
3652 struct omap_hwmod *oh;
3653 char *oh_name = "wd_timer2";
3654 char *dev_name = "omap_wdt";
3655 - struct omap_wd_timer_platform_data pdata;
3656 + static struct omap_wd_timer_platform_data pdata = {
3657 + .read_reset_sources = prm_read_reset_sources
3658 + };
3659
3660 if (!cpu_class_is_omap2() || of_have_populated_dt())
3661 return 0;
3662 @@ -121,8 +123,6 @@ static int __init omap_init_wdt(void)
3663 return -EINVAL;
3664 }
3665
3666 - pdata.read_reset_sources = prm_read_reset_sources;
3667 -
3668 pdev = omap_device_build(dev_name, id, oh, &pdata,
3669 sizeof(struct omap_wd_timer_platform_data));
3670 WARN(IS_ERR(pdev), "Can't build omap_device for %s:%s.\n",
3671 diff --git a/arch/arm/mach-tegra/cpuidle-tegra20.c b/arch/arm/mach-tegra/cpuidle-tegra20.c
3672 index b82dcae..44ee5b6 100644
3673 --- a/arch/arm/mach-tegra/cpuidle-tegra20.c
3674 +++ b/arch/arm/mach-tegra/cpuidle-tegra20.c
3675 @@ -180,7 +180,7 @@ static int tegra20_idle_lp2_coupled(struct cpuidle_device *dev,
3676 bool entered_lp2 = false;
3677
3678 if (tegra_pending_sgi())
3679 - ACCESS_ONCE(abort_flag) = true;
3680 + ACCESS_ONCE_RW(abort_flag) = true;
3681
3682 cpuidle_coupled_parallel_barrier(dev, &abort_barrier);
3683
3684 diff --git a/arch/arm/mach-ux500/setup.h b/arch/arm/mach-ux500/setup.h
3685 index 2dea8b5..6499da2 100644
3686 --- a/arch/arm/mach-ux500/setup.h
3687 +++ b/arch/arm/mach-ux500/setup.h
3688 @@ -33,13 +33,6 @@ extern void ux500_timer_init(void);
3689 .type = MT_DEVICE, \
3690 }
3691
3692 -#define __MEM_DEV_DESC(x, sz) { \
3693 - .virtual = IO_ADDRESS(x), \
3694 - .pfn = __phys_to_pfn(x), \
3695 - .length = sz, \
3696 - .type = MT_MEMORY_RWX, \
3697 -}
3698 -
3699 extern struct smp_operations ux500_smp_ops;
3700 extern void ux500_cpu_die(unsigned int cpu);
3701
3702 diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
3703 index ca8ecde..58ba893 100644
3704 --- a/arch/arm/mm/Kconfig
3705 +++ b/arch/arm/mm/Kconfig
3706 @@ -446,6 +446,7 @@ config CPU_32v5
3707
3708 config CPU_32v6
3709 bool
3710 + select CPU_USE_DOMAINS if CPU_V6 && MMU && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
3711 select TLS_REG_EMUL if !CPU_32v6K && !MMU
3712
3713 config CPU_32v6K
3714 @@ -600,6 +601,7 @@ config CPU_CP15_MPU
3715
3716 config CPU_USE_DOMAINS
3717 bool
3718 + depends on !ARM_LPAE && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
3719 help
3720 This option enables or disables the use of domain switching
3721 via the set_fs() function.
3722 @@ -799,6 +801,7 @@ config NEED_KUSER_HELPERS
3723 config KUSER_HELPERS
3724 bool "Enable kuser helpers in vector page" if !NEED_KUSER_HELPERS
3725 default y
3726 + depends on !(CPU_V6 || CPU_V6K || CPU_V7) || GRKERNSEC_OLD_ARM_USERLAND
3727 help
3728 Warning: disabling this option may break user programs.
3729
3730 @@ -811,7 +814,7 @@ config KUSER_HELPERS
3731 See Documentation/arm/kernel_user_helpers.txt for details.
3732
3733 However, the fixed address nature of these helpers can be used
3734 - by ROP (return orientated programming) authors when creating
3735 + by ROP (Return Oriented Programming) authors when creating
3736 exploits.
3737
3738 If all of the binaries and libraries which run on your platform
3739 diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
3740 index 9240364..a2b8cf3 100644
3741 --- a/arch/arm/mm/alignment.c
3742 +++ b/arch/arm/mm/alignment.c
3743 @@ -212,10 +212,12 @@ union offset_union {
3744 #define __get16_unaligned_check(ins,val,addr) \
3745 do { \
3746 unsigned int err = 0, v, a = addr; \
3747 + pax_open_userland(); \
3748 __get8_unaligned_check(ins,v,a,err); \
3749 val = v << ((BE) ? 8 : 0); \
3750 __get8_unaligned_check(ins,v,a,err); \
3751 val |= v << ((BE) ? 0 : 8); \
3752 + pax_close_userland(); \
3753 if (err) \
3754 goto fault; \
3755 } while (0)
3756 @@ -229,6 +231,7 @@ union offset_union {
3757 #define __get32_unaligned_check(ins,val,addr) \
3758 do { \
3759 unsigned int err = 0, v, a = addr; \
3760 + pax_open_userland(); \
3761 __get8_unaligned_check(ins,v,a,err); \
3762 val = v << ((BE) ? 24 : 0); \
3763 __get8_unaligned_check(ins,v,a,err); \
3764 @@ -237,6 +240,7 @@ union offset_union {
3765 val |= v << ((BE) ? 8 : 16); \
3766 __get8_unaligned_check(ins,v,a,err); \
3767 val |= v << ((BE) ? 0 : 24); \
3768 + pax_close_userland(); \
3769 if (err) \
3770 goto fault; \
3771 } while (0)
3772 @@ -250,6 +254,7 @@ union offset_union {
3773 #define __put16_unaligned_check(ins,val,addr) \
3774 do { \
3775 unsigned int err = 0, v = val, a = addr; \
3776 + pax_open_userland(); \
3777 __asm__( FIRST_BYTE_16 \
3778 ARM( "1: "ins" %1, [%2], #1\n" ) \
3779 THUMB( "1: "ins" %1, [%2]\n" ) \
3780 @@ -269,6 +274,7 @@ union offset_union {
3781 " .popsection\n" \
3782 : "=r" (err), "=&r" (v), "=&r" (a) \
3783 : "0" (err), "1" (v), "2" (a)); \
3784 + pax_close_userland(); \
3785 if (err) \
3786 goto fault; \
3787 } while (0)
3788 @@ -282,6 +288,7 @@ union offset_union {
3789 #define __put32_unaligned_check(ins,val,addr) \
3790 do { \
3791 unsigned int err = 0, v = val, a = addr; \
3792 + pax_open_userland(); \
3793 __asm__( FIRST_BYTE_32 \
3794 ARM( "1: "ins" %1, [%2], #1\n" ) \
3795 THUMB( "1: "ins" %1, [%2]\n" ) \
3796 @@ -311,6 +318,7 @@ union offset_union {
3797 " .popsection\n" \
3798 : "=r" (err), "=&r" (v), "=&r" (a) \
3799 : "0" (err), "1" (v), "2" (a)); \
3800 + pax_close_userland(); \
3801 if (err) \
3802 goto fault; \
3803 } while (0)
3804 diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
3805 index 7abde2c..9df495f 100644
3806 --- a/arch/arm/mm/cache-l2x0.c
3807 +++ b/arch/arm/mm/cache-l2x0.c
3808 @@ -46,7 +46,7 @@ struct l2x0_of_data {
3809 void (*setup)(const struct device_node *, u32 *, u32 *);
3810 void (*save)(void);
3811 struct outer_cache_fns outer_cache;
3812 -};
3813 +} __do_const;
3814
3815 static bool of_init = false;
3816
3817 diff --git a/arch/arm/mm/context.c b/arch/arm/mm/context.c
3818 index 6eb97b3..ac509f6 100644
3819 --- a/arch/arm/mm/context.c
3820 +++ b/arch/arm/mm/context.c
3821 @@ -43,7 +43,7 @@
3822 #define NUM_USER_ASIDS ASID_FIRST_VERSION
3823
3824 static DEFINE_RAW_SPINLOCK(cpu_asid_lock);
3825 -static atomic64_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
3826 +static atomic64_unchecked_t asid_generation = ATOMIC64_INIT(ASID_FIRST_VERSION);
3827 static DECLARE_BITMAP(asid_map, NUM_USER_ASIDS);
3828
3829 static DEFINE_PER_CPU(atomic64_t, active_asids);
3830 @@ -182,7 +182,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
3831 {
3832 static u32 cur_idx = 1;
3833 u64 asid = atomic64_read(&mm->context.id);
3834 - u64 generation = atomic64_read(&asid_generation);
3835 + u64 generation = atomic64_read_unchecked(&asid_generation);
3836
3837 if (asid != 0 && is_reserved_asid(asid)) {
3838 /*
3839 @@ -203,7 +203,7 @@ static u64 new_context(struct mm_struct *mm, unsigned int cpu)
3840 */
3841 asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, cur_idx);
3842 if (asid == NUM_USER_ASIDS) {
3843 - generation = atomic64_add_return(ASID_FIRST_VERSION,
3844 + generation = atomic64_add_return_unchecked(ASID_FIRST_VERSION,
3845 &asid_generation);
3846 flush_context(cpu);
3847 asid = find_next_zero_bit(asid_map, NUM_USER_ASIDS, 1);
3848 @@ -234,14 +234,14 @@ void check_and_switch_context(struct mm_struct *mm, struct task_struct *tsk)
3849 cpu_set_reserved_ttbr0();
3850
3851 asid = atomic64_read(&mm->context.id);
3852 - if (!((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS)
3853 + if (!((asid ^ atomic64_read_unchecked(&asid_generation)) >> ASID_BITS)
3854 && atomic64_xchg(&per_cpu(active_asids, cpu), asid))
3855 goto switch_mm_fastpath;
3856
3857 raw_spin_lock_irqsave(&cpu_asid_lock, flags);
3858 /* Check that our ASID belongs to the current generation. */
3859 asid = atomic64_read(&mm->context.id);
3860 - if ((asid ^ atomic64_read(&asid_generation)) >> ASID_BITS) {
3861 + if ((asid ^ atomic64_read_unchecked(&asid_generation)) >> ASID_BITS) {
3862 asid = new_context(mm, cpu);
3863 atomic64_set(&mm->context.id, asid);
3864 }
3865 diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
3866 index eb8830a..5360ce7 100644
3867 --- a/arch/arm/mm/fault.c
3868 +++ b/arch/arm/mm/fault.c
3869 @@ -25,6 +25,7 @@
3870 #include <asm/system_misc.h>
3871 #include <asm/system_info.h>
3872 #include <asm/tlbflush.h>
3873 +#include <asm/sections.h>
3874
3875 #include "fault.h"
3876
3877 @@ -138,6 +139,31 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
3878 if (fixup_exception(regs))
3879 return;
3880
3881 +#ifdef CONFIG_PAX_MEMORY_UDEREF
3882 + if (addr < TASK_SIZE) {
3883 + if (current->signal->curr_ip)
3884 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
3885 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3886 + else
3887 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", current->comm, task_pid_nr(current),
3888 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3889 + }
3890 +#endif
3891 +
3892 +#ifdef CONFIG_PAX_KERNEXEC
3893 + if ((fsr & FSR_WRITE) &&
3894 + (((unsigned long)_stext <= addr && addr < init_mm.end_code) ||
3895 + (MODULES_VADDR <= addr && addr < MODULES_END)))
3896 + {
3897 + if (current->signal->curr_ip)
3898 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
3899 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
3900 + else
3901 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", current->comm, task_pid_nr(current),
3902 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
3903 + }
3904 +#endif
3905 +
3906 /*
3907 * No handler, we'll have to terminate things with extreme prejudice.
3908 */
3909 @@ -174,6 +200,13 @@ __do_user_fault(struct task_struct *tsk, unsigned long addr,
3910 }
3911 #endif
3912
3913 +#ifdef CONFIG_PAX_PAGEEXEC
3914 + if (fsr & FSR_LNX_PF) {
3915 + pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
3916 + do_group_exit(SIGKILL);
3917 + }
3918 +#endif
3919 +
3920 tsk->thread.address = addr;
3921 tsk->thread.error_code = fsr;
3922 tsk->thread.trap_no = 14;
3923 @@ -401,6 +434,33 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
3924 }
3925 #endif /* CONFIG_MMU */
3926
3927 +#ifdef CONFIG_PAX_PAGEEXEC
3928 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
3929 +{
3930 + long i;
3931 +
3932 + printk(KERN_ERR "PAX: bytes at PC: ");
3933 + for (i = 0; i < 20; i++) {
3934 + unsigned char c;
3935 + if (get_user(c, (__force unsigned char __user *)pc+i))
3936 + printk(KERN_CONT "?? ");
3937 + else
3938 + printk(KERN_CONT "%02x ", c);
3939 + }
3940 + printk("\n");
3941 +
3942 + printk(KERN_ERR "PAX: bytes at SP-4: ");
3943 + for (i = -1; i < 20; i++) {
3944 + unsigned long c;
3945 + if (get_user(c, (__force unsigned long __user *)sp+i))
3946 + printk(KERN_CONT "???????? ");
3947 + else
3948 + printk(KERN_CONT "%08lx ", c);
3949 + }
3950 + printk("\n");
3951 +}
3952 +#endif
3953 +
3954 /*
3955 * First Level Translation Fault Handler
3956 *
3957 @@ -548,9 +608,22 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
3958 const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
3959 struct siginfo info;
3960
3961 +#ifdef CONFIG_PAX_MEMORY_UDEREF
3962 + if (addr < TASK_SIZE && is_domain_fault(fsr)) {
3963 + if (current->signal->curr_ip)
3964 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
3965 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3966 + else
3967 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to access userland memory at %08lx\n", current->comm, task_pid_nr(current),
3968 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()), addr);
3969 + goto die;
3970 + }
3971 +#endif
3972 +
3973 if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
3974 return;
3975
3976 +die:
3977 printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
3978 inf->name, fsr, addr);
3979
3980 @@ -574,15 +647,98 @@ hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *
3981 ifsr_info[nr].name = name;
3982 }
3983
3984 +asmlinkage int sys_sigreturn(struct pt_regs *regs);
3985 +asmlinkage int sys_rt_sigreturn(struct pt_regs *regs);
3986 +
3987 asmlinkage void __exception
3988 do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
3989 {
3990 const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
3991 struct siginfo info;
3992 + unsigned long pc = instruction_pointer(regs);
3993 +
3994 + if (user_mode(regs)) {
3995 + unsigned long sigpage = current->mm->context.sigpage;
3996 +
3997 + if (sigpage <= pc && pc < sigpage + 7*4) {
3998 + if (pc < sigpage + 3*4)
3999 + sys_sigreturn(regs);
4000 + else
4001 + sys_rt_sigreturn(regs);
4002 + return;
4003 + }
4004 + if (pc == 0xffff0f60UL) {
4005 + /*
4006 + * PaX: __kuser_cmpxchg64 emulation
4007 + */
4008 + // TODO
4009 + //regs->ARM_pc = regs->ARM_lr;
4010 + //return;
4011 + }
4012 + if (pc == 0xffff0fa0UL) {
4013 + /*
4014 + * PaX: __kuser_memory_barrier emulation
4015 + */
4016 + // dmb(); implied by the exception
4017 + regs->ARM_pc = regs->ARM_lr;
4018 + return;
4019 + }
4020 + if (pc == 0xffff0fc0UL) {
4021 + /*
4022 + * PaX: __kuser_cmpxchg emulation
4023 + */
4024 + // TODO
4025 + //long new;
4026 + //int op;
4027 +
4028 + //op = FUTEX_OP_SET << 28;
4029 + //new = futex_atomic_op_inuser(op, regs->ARM_r2);
4030 + //regs->ARM_r0 = old != new;
4031 + //regs->ARM_pc = regs->ARM_lr;
4032 + //return;
4033 + }
4034 + if (pc == 0xffff0fe0UL) {
4035 + /*
4036 + * PaX: __kuser_get_tls emulation
4037 + */
4038 + regs->ARM_r0 = current_thread_info()->tp_value[0];
4039 + regs->ARM_pc = regs->ARM_lr;
4040 + return;
4041 + }
4042 + }
4043 +
4044 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
4045 + else if (is_domain_fault(ifsr) || is_xn_fault(ifsr)) {
4046 + if (current->signal->curr_ip)
4047 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", &current->signal->curr_ip, current->comm, task_pid_nr(current),
4048 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
4049 + pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
4050 + else
4051 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to execute %s memory at %08lx\n", current->comm, task_pid_nr(current),
4052 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()),
4053 + pc >= TASK_SIZE ? "non-executable kernel" : "userland", pc);
4054 + goto die;
4055 + }
4056 +#endif
4057 +
4058 +#ifdef CONFIG_PAX_REFCOUNT
4059 + if (fsr_fs(ifsr) == FAULT_CODE_DEBUG) {
4060 + unsigned int bkpt;
4061 +
4062 + if (!probe_kernel_address(pc, bkpt) && cpu_to_le32(bkpt) == 0xe12f1073) {
4063 + current->thread.error_code = ifsr;
4064 + current->thread.trap_no = 0;
4065 + pax_report_refcount_overflow(regs);
4066 + fixup_exception(regs);
4067 + return;
4068 + }
4069 + }
4070 +#endif
4071
4072 if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
4073 return;
4074
4075 +die:
4076 printk(KERN_ALERT "Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
4077 inf->name, ifsr, addr);
4078
4079 diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h
4080 index cf08bdf..772656c 100644
4081 --- a/arch/arm/mm/fault.h
4082 +++ b/arch/arm/mm/fault.h
4083 @@ -3,6 +3,7 @@
4084
4085 /*
4086 * Fault status register encodings. We steal bit 31 for our own purposes.
4087 + * Set when the FSR value is from an instruction fault.
4088 */
4089 #define FSR_LNX_PF (1 << 31)
4090 #define FSR_WRITE (1 << 11)
4091 @@ -22,6 +23,17 @@ static inline int fsr_fs(unsigned int fsr)
4092 }
4093 #endif
4094
4095 +/* valid for LPAE and !LPAE */
4096 +static inline int is_xn_fault(unsigned int fsr)
4097 +{
4098 + return ((fsr_fs(fsr) & 0x3c) == 0xc);
4099 +}
4100 +
4101 +static inline int is_domain_fault(unsigned int fsr)
4102 +{
4103 + return ((fsr_fs(fsr) & 0xD) == 0x9);
4104 +}
4105 +
4106 void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
4107 unsigned long search_exception_table(unsigned long addr);
4108
4109 diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
4110 index 804d615..fcec50a 100644
4111 --- a/arch/arm/mm/init.c
4112 +++ b/arch/arm/mm/init.c
4113 @@ -30,6 +30,8 @@
4114 #include <asm/setup.h>
4115 #include <asm/tlb.h>
4116 #include <asm/fixmap.h>
4117 +#include <asm/system_info.h>
4118 +#include <asm/cp15.h>
4119
4120 #include <asm/mach/arch.h>
4121 #include <asm/mach/map.h>
4122 @@ -625,7 +627,46 @@ void free_initmem(void)
4123 {
4124 #ifdef CONFIG_HAVE_TCM
4125 extern char __tcm_start, __tcm_end;
4126 +#endif
4127
4128 +#ifdef CONFIG_PAX_KERNEXEC
4129 + unsigned long addr;
4130 + pgd_t *pgd;
4131 + pud_t *pud;
4132 + pmd_t *pmd;
4133 + int cpu_arch = cpu_architecture();
4134 + unsigned int cr = get_cr();
4135 +
4136 + if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
4137 + /* make pages tables, etc before .text NX */
4138 + for (addr = PAGE_OFFSET; addr < (unsigned long)_stext; addr += SECTION_SIZE) {
4139 + pgd = pgd_offset_k(addr);
4140 + pud = pud_offset(pgd, addr);
4141 + pmd = pmd_offset(pud, addr);
4142 + __section_update(pmd, addr, PMD_SECT_XN);
4143 + }
4144 + /* make init NX */
4145 + for (addr = (unsigned long)__init_begin; addr < (unsigned long)_sdata; addr += SECTION_SIZE) {
4146 + pgd = pgd_offset_k(addr);
4147 + pud = pud_offset(pgd, addr);
4148 + pmd = pmd_offset(pud, addr);
4149 + __section_update(pmd, addr, PMD_SECT_XN);
4150 + }
4151 + /* make kernel code/rodata RX */
4152 + for (addr = (unsigned long)_stext; addr < (unsigned long)__init_begin; addr += SECTION_SIZE) {
4153 + pgd = pgd_offset_k(addr);
4154 + pud = pud_offset(pgd, addr);
4155 + pmd = pmd_offset(pud, addr);
4156 +#ifdef CONFIG_ARM_LPAE
4157 + __section_update(pmd, addr, PMD_SECT_RDONLY);
4158 +#else
4159 + __section_update(pmd, addr, PMD_SECT_APX|PMD_SECT_AP_WRITE);
4160 +#endif
4161 + }
4162 + }
4163 +#endif
4164 +
4165 +#ifdef CONFIG_HAVE_TCM
4166 poison_init_mem(&__tcm_start, &__tcm_end - &__tcm_start);
4167 free_reserved_area(&__tcm_start, &__tcm_end, -1, "TCM link");
4168 #endif
4169 diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
4170 index f9c32ba..8540068 100644
4171 --- a/arch/arm/mm/ioremap.c
4172 +++ b/arch/arm/mm/ioremap.c
4173 @@ -392,9 +392,9 @@ __arm_ioremap_exec(phys_addr_t phys_addr, size_t size, bool cached)
4174 unsigned int mtype;
4175
4176 if (cached)
4177 - mtype = MT_MEMORY_RWX;
4178 + mtype = MT_MEMORY_RX;
4179 else
4180 - mtype = MT_MEMORY_RWX_NONCACHED;
4181 + mtype = MT_MEMORY_RX_NONCACHED;
4182
4183 return __arm_ioremap_caller(phys_addr, size, mtype,
4184 __builtin_return_address(0));
4185 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
4186 index 5e85ed3..b10a7ed 100644
4187 --- a/arch/arm/mm/mmap.c
4188 +++ b/arch/arm/mm/mmap.c
4189 @@ -59,6 +59,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4190 struct vm_area_struct *vma;
4191 int do_align = 0;
4192 int aliasing = cache_is_vipt_aliasing();
4193 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
4194 struct vm_unmapped_area_info info;
4195
4196 /*
4197 @@ -81,6 +82,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4198 if (len > TASK_SIZE)
4199 return -ENOMEM;
4200
4201 +#ifdef CONFIG_PAX_RANDMMAP
4202 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4203 +#endif
4204 +
4205 if (addr) {
4206 if (do_align)
4207 addr = COLOUR_ALIGN(addr, pgoff);
4208 @@ -88,8 +93,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4209 addr = PAGE_ALIGN(addr);
4210
4211 vma = find_vma(mm, addr);
4212 - if (TASK_SIZE - len >= addr &&
4213 - (!vma || addr + len <= vma->vm_start))
4214 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
4215 return addr;
4216 }
4217
4218 @@ -99,6 +103,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
4219 info.high_limit = TASK_SIZE;
4220 info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
4221 info.align_offset = pgoff << PAGE_SHIFT;
4222 + info.threadstack_offset = offset;
4223 return vm_unmapped_area(&info);
4224 }
4225
4226 @@ -112,6 +117,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4227 unsigned long addr = addr0;
4228 int do_align = 0;
4229 int aliasing = cache_is_vipt_aliasing();
4230 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
4231 struct vm_unmapped_area_info info;
4232
4233 /*
4234 @@ -132,6 +138,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4235 return addr;
4236 }
4237
4238 +#ifdef CONFIG_PAX_RANDMMAP
4239 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4240 +#endif
4241 +
4242 /* requesting a specific address */
4243 if (addr) {
4244 if (do_align)
4245 @@ -139,8 +149,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4246 else
4247 addr = PAGE_ALIGN(addr);
4248 vma = find_vma(mm, addr);
4249 - if (TASK_SIZE - len >= addr &&
4250 - (!vma || addr + len <= vma->vm_start))
4251 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
4252 return addr;
4253 }
4254
4255 @@ -150,6 +159,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
4256 info.high_limit = mm->mmap_base;
4257 info.align_mask = do_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
4258 info.align_offset = pgoff << PAGE_SHIFT;
4259 + info.threadstack_offset = offset;
4260 addr = vm_unmapped_area(&info);
4261
4262 /*
4263 @@ -173,6 +183,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4264 {
4265 unsigned long random_factor = 0UL;
4266
4267 +#ifdef CONFIG_PAX_RANDMMAP
4268 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
4269 +#endif
4270 +
4271 /* 8 bits of randomness in 20 address space bits */
4272 if ((current->flags & PF_RANDOMIZE) &&
4273 !(current->personality & ADDR_NO_RANDOMIZE))
4274 @@ -180,9 +194,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
4275
4276 if (mmap_is_legacy()) {
4277 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
4278 +
4279 +#ifdef CONFIG_PAX_RANDMMAP
4280 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4281 + mm->mmap_base += mm->delta_mmap;
4282 +#endif
4283 +
4284 mm->get_unmapped_area = arch_get_unmapped_area;
4285 } else {
4286 mm->mmap_base = mmap_base(random_factor);
4287 +
4288 +#ifdef CONFIG_PAX_RANDMMAP
4289 + if (mm->pax_flags & MF_PAX_RANDMMAP)
4290 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
4291 +#endif
4292 +
4293 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
4294 }
4295 }
4296 diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
4297 index b68c6b2..f66c492 100644
4298 --- a/arch/arm/mm/mmu.c
4299 +++ b/arch/arm/mm/mmu.c
4300 @@ -39,6 +39,22 @@
4301 #include "mm.h"
4302 #include "tcm.h"
4303
4304 +#if defined(CONFIG_CPU_USE_DOMAINS) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
4305 +void modify_domain(unsigned int dom, unsigned int type)
4306 +{
4307 + struct thread_info *thread = current_thread_info();
4308 + unsigned int domain = thread->cpu_domain;
4309 + /*
4310 + * DOMAIN_MANAGER might be defined to some other value,
4311 + * use the arch-defined constant
4312 + */
4313 + domain &= ~domain_val(dom, 3);
4314 + thread->cpu_domain = domain | domain_val(dom, type);
4315 + set_domain(thread->cpu_domain);
4316 +}
4317 +EXPORT_SYMBOL(modify_domain);
4318 +#endif
4319 +
4320 /*
4321 * empty_zero_page is a special page that is used for
4322 * zero-initialized data and COW.
4323 @@ -235,7 +251,15 @@ __setup("noalign", noalign_setup);
4324 #define PROT_PTE_S2_DEVICE PROT_PTE_DEVICE
4325 #define PROT_SECT_DEVICE PMD_TYPE_SECT|PMD_SECT_AP_WRITE
4326
4327 -static struct mem_type mem_types[] = {
4328 +#ifdef CONFIG_PAX_KERNEXEC
4329 +#define L_PTE_KERNEXEC L_PTE_RDONLY
4330 +#define PMD_SECT_KERNEXEC PMD_SECT_RDONLY
4331 +#else
4332 +#define L_PTE_KERNEXEC L_PTE_DIRTY
4333 +#define PMD_SECT_KERNEXEC PMD_SECT_AP_WRITE
4334 +#endif
4335 +
4336 +static struct mem_type mem_types[] __read_only = {
4337 [MT_DEVICE] = { /* Strongly ordered / ARMv6 shared device */
4338 .prot_pte = PROT_PTE_DEVICE | L_PTE_MT_DEV_SHARED |
4339 L_PTE_SHARED,
4340 @@ -264,19 +288,19 @@ static struct mem_type mem_types[] = {
4341 .prot_sect = PROT_SECT_DEVICE,
4342 .domain = DOMAIN_IO,
4343 },
4344 - [MT_UNCACHED] = {
4345 + [MT_UNCACHED_RW] = {
4346 .prot_pte = PROT_PTE_DEVICE,
4347 .prot_l1 = PMD_TYPE_TABLE,
4348 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4349 .domain = DOMAIN_IO,
4350 },
4351 - [MT_CACHECLEAN] = {
4352 - .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4353 + [MT_CACHECLEAN_RO] = {
4354 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN | PMD_SECT_RDONLY,
4355 .domain = DOMAIN_KERNEL,
4356 },
4357 #ifndef CONFIG_ARM_LPAE
4358 - [MT_MINICLEAN] = {
4359 - .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN | PMD_SECT_MINICACHE,
4360 + [MT_MINICLEAN_RO] = {
4361 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_MINICACHE | PMD_SECT_XN | PMD_SECT_RDONLY,
4362 .domain = DOMAIN_KERNEL,
4363 },
4364 #endif
4365 @@ -284,15 +308,15 @@ static struct mem_type mem_types[] = {
4366 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4367 L_PTE_RDONLY,
4368 .prot_l1 = PMD_TYPE_TABLE,
4369 - .domain = DOMAIN_USER,
4370 + .domain = DOMAIN_VECTORS,
4371 },
4372 [MT_HIGH_VECTORS] = {
4373 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4374 L_PTE_USER | L_PTE_RDONLY,
4375 .prot_l1 = PMD_TYPE_TABLE,
4376 - .domain = DOMAIN_USER,
4377 + .domain = DOMAIN_VECTORS,
4378 },
4379 - [MT_MEMORY_RWX] = {
4380 + [__MT_MEMORY_RWX] = {
4381 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
4382 .prot_l1 = PMD_TYPE_TABLE,
4383 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4384 @@ -305,17 +329,30 @@ static struct mem_type mem_types[] = {
4385 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4386 .domain = DOMAIN_KERNEL,
4387 },
4388 - [MT_ROM] = {
4389 - .prot_sect = PMD_TYPE_SECT,
4390 + [MT_MEMORY_RX] = {
4391 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC,
4392 + .prot_l1 = PMD_TYPE_TABLE,
4393 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4394 + .domain = DOMAIN_KERNEL,
4395 + },
4396 + [MT_ROM_RX] = {
4397 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_RDONLY,
4398 .domain = DOMAIN_KERNEL,
4399 },
4400 - [MT_MEMORY_RWX_NONCACHED] = {
4401 + [MT_MEMORY_RW_NONCACHED] = {
4402 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4403 L_PTE_MT_BUFFERABLE,
4404 .prot_l1 = PMD_TYPE_TABLE,
4405 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
4406 .domain = DOMAIN_KERNEL,
4407 },
4408 + [MT_MEMORY_RX_NONCACHED] = {
4409 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC |
4410 + L_PTE_MT_BUFFERABLE,
4411 + .prot_l1 = PMD_TYPE_TABLE,
4412 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4413 + .domain = DOMAIN_KERNEL,
4414 + },
4415 [MT_MEMORY_RW_DTCM] = {
4416 .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
4417 L_PTE_XN,
4418 @@ -323,9 +360,10 @@ static struct mem_type mem_types[] = {
4419 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
4420 .domain = DOMAIN_KERNEL,
4421 },
4422 - [MT_MEMORY_RWX_ITCM] = {
4423 - .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY,
4424 + [MT_MEMORY_RX_ITCM] = {
4425 + .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_KERNEXEC,
4426 .prot_l1 = PMD_TYPE_TABLE,
4427 + .prot_sect = PMD_TYPE_SECT | PMD_SECT_KERNEXEC,
4428 .domain = DOMAIN_KERNEL,
4429 },
4430 [MT_MEMORY_RW_SO] = {
4431 @@ -534,9 +572,14 @@ static void __init build_mem_type_table(void)
4432 * Mark cache clean areas and XIP ROM read only
4433 * from SVC mode and no access from userspace.
4434 */
4435 - mem_types[MT_ROM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4436 - mem_types[MT_MINICLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4437 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4438 + mem_types[MT_ROM_RX].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4439 +#ifdef CONFIG_PAX_KERNEXEC
4440 + mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4441 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4442 + mem_types[MT_MEMORY_RX_ITCM].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4443 +#endif
4444 + mem_types[MT_MINICLEAN_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4445 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_APX|PMD_SECT_AP_WRITE;
4446 #endif
4447
4448 if (is_smp()) {
4449 @@ -552,13 +595,17 @@ static void __init build_mem_type_table(void)
4450 mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_SHARED;
4451 mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_S;
4452 mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_SHARED;
4453 - mem_types[MT_MEMORY_RWX].prot_sect |= PMD_SECT_S;
4454 - mem_types[MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED;
4455 + mem_types[__MT_MEMORY_RWX].prot_sect |= PMD_SECT_S;
4456 + mem_types[__MT_MEMORY_RWX].prot_pte |= L_PTE_SHARED;
4457 mem_types[MT_MEMORY_RW].prot_sect |= PMD_SECT_S;
4458 mem_types[MT_MEMORY_RW].prot_pte |= L_PTE_SHARED;
4459 + mem_types[MT_MEMORY_RX].prot_sect |= PMD_SECT_S;
4460 + mem_types[MT_MEMORY_RX].prot_pte |= L_PTE_SHARED;
4461 mem_types[MT_MEMORY_DMA_READY].prot_pte |= L_PTE_SHARED;
4462 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_S;
4463 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_pte |= L_PTE_SHARED;
4464 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= PMD_SECT_S;
4465 + mem_types[MT_MEMORY_RW_NONCACHED].prot_pte |= L_PTE_SHARED;
4466 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_S;
4467 + mem_types[MT_MEMORY_RX_NONCACHED].prot_pte |= L_PTE_SHARED;
4468 }
4469 }
4470
4471 @@ -569,15 +616,20 @@ static void __init build_mem_type_table(void)
4472 if (cpu_arch >= CPU_ARCH_ARMv6) {
4473 if (cpu_arch >= CPU_ARCH_ARMv7 && (cr & CR_TRE)) {
4474 /* Non-cacheable Normal is XCB = 001 */
4475 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |=
4476 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |=
4477 + PMD_SECT_BUFFERED;
4478 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |=
4479 PMD_SECT_BUFFERED;
4480 } else {
4481 /* For both ARMv6 and non-TEX-remapping ARMv7 */
4482 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |=
4483 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |=
4484 + PMD_SECT_TEX(1);
4485 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |=
4486 PMD_SECT_TEX(1);
4487 }
4488 } else {
4489 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4490 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4491 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= PMD_SECT_BUFFERABLE;
4492 }
4493
4494 #ifdef CONFIG_ARM_LPAE
4495 @@ -593,6 +645,8 @@ static void __init build_mem_type_table(void)
4496 vecs_pgprot |= PTE_EXT_AF;
4497 #endif
4498
4499 + user_pgprot |= __supported_pte_mask;
4500 +
4501 for (i = 0; i < 16; i++) {
4502 pteval_t v = pgprot_val(protection_map[i]);
4503 protection_map[i] = __pgprot(v | user_pgprot);
4504 @@ -610,21 +664,24 @@ static void __init build_mem_type_table(void)
4505
4506 mem_types[MT_LOW_VECTORS].prot_l1 |= ecc_mask;
4507 mem_types[MT_HIGH_VECTORS].prot_l1 |= ecc_mask;
4508 - mem_types[MT_MEMORY_RWX].prot_sect |= ecc_mask | cp->pmd;
4509 - mem_types[MT_MEMORY_RWX].prot_pte |= kern_pgprot;
4510 + mem_types[__MT_MEMORY_RWX].prot_sect |= ecc_mask | cp->pmd;
4511 + mem_types[__MT_MEMORY_RWX].prot_pte |= kern_pgprot;
4512 mem_types[MT_MEMORY_RW].prot_sect |= ecc_mask | cp->pmd;
4513 mem_types[MT_MEMORY_RW].prot_pte |= kern_pgprot;
4514 + mem_types[MT_MEMORY_RX].prot_sect |= ecc_mask | cp->pmd;
4515 + mem_types[MT_MEMORY_RX].prot_pte |= kern_pgprot;
4516 mem_types[MT_MEMORY_DMA_READY].prot_pte |= kern_pgprot;
4517 - mem_types[MT_MEMORY_RWX_NONCACHED].prot_sect |= ecc_mask;
4518 - mem_types[MT_ROM].prot_sect |= cp->pmd;
4519 + mem_types[MT_MEMORY_RW_NONCACHED].prot_sect |= ecc_mask;
4520 + mem_types[MT_MEMORY_RX_NONCACHED].prot_sect |= ecc_mask;
4521 + mem_types[MT_ROM_RX].prot_sect |= cp->pmd;
4522
4523 switch (cp->pmd) {
4524 case PMD_SECT_WT:
4525 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_WT;
4526 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_WT;
4527 break;
4528 case PMD_SECT_WB:
4529 case PMD_SECT_WBWA:
4530 - mem_types[MT_CACHECLEAN].prot_sect |= PMD_SECT_WB;
4531 + mem_types[MT_CACHECLEAN_RO].prot_sect |= PMD_SECT_WB;
4532 break;
4533 }
4534 pr_info("Memory policy: %sData cache %s\n",
4535 @@ -842,7 +899,7 @@ static void __init create_mapping(struct map_desc *md)
4536 return;
4537 }
4538
4539 - if ((md->type == MT_DEVICE || md->type == MT_ROM) &&
4540 + if ((md->type == MT_DEVICE || md->type == MT_ROM_RX) &&
4541 md->virtual >= PAGE_OFFSET &&
4542 (md->virtual < VMALLOC_START || md->virtual >= VMALLOC_END)) {
4543 printk(KERN_WARNING "BUG: mapping for 0x%08llx"
4544 @@ -1257,18 +1314,15 @@ void __init arm_mm_memblock_reserve(void)
4545 * called function. This means you can't use any function or debugging
4546 * method which may touch any device, otherwise the kernel _will_ crash.
4547 */
4548 +
4549 +static char vectors[PAGE_SIZE * 2] __read_only __aligned(PAGE_SIZE);
4550 +
4551 static void __init devicemaps_init(const struct machine_desc *mdesc)
4552 {
4553 struct map_desc map;
4554 unsigned long addr;
4555 - void *vectors;
4556
4557 - /*
4558 - * Allocate the vector page early.
4559 - */
4560 - vectors = early_alloc(PAGE_SIZE * 2);
4561 -
4562 - early_trap_init(vectors);
4563 + early_trap_init(&vectors);
4564
4565 for (addr = VMALLOC_START; addr; addr += PMD_SIZE)
4566 pmd_clear(pmd_off_k(addr));
4567 @@ -1281,7 +1335,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4568 map.pfn = __phys_to_pfn(CONFIG_XIP_PHYS_ADDR & SECTION_MASK);
4569 map.virtual = MODULES_VADDR;
4570 map.length = ((unsigned long)_etext - map.virtual + ~SECTION_MASK) & SECTION_MASK;
4571 - map.type = MT_ROM;
4572 + map.type = MT_ROM_RX;
4573 create_mapping(&map);
4574 #endif
4575
4576 @@ -1292,14 +1346,14 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4577 map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS);
4578 map.virtual = FLUSH_BASE;
4579 map.length = SZ_1M;
4580 - map.type = MT_CACHECLEAN;
4581 + map.type = MT_CACHECLEAN_RO;
4582 create_mapping(&map);
4583 #endif
4584 #ifdef FLUSH_BASE_MINICACHE
4585 map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS + SZ_1M);
4586 map.virtual = FLUSH_BASE_MINICACHE;
4587 map.length = SZ_1M;
4588 - map.type = MT_MINICLEAN;
4589 + map.type = MT_MINICLEAN_RO;
4590 create_mapping(&map);
4591 #endif
4592
4593 @@ -1308,7 +1362,7 @@ static void __init devicemaps_init(const struct machine_desc *mdesc)
4594 * location (0xffff0000). If we aren't using high-vectors, also
4595 * create a mapping at the low-vectors virtual address.
4596 */
4597 - map.pfn = __phys_to_pfn(virt_to_phys(vectors));
4598 + map.pfn = __phys_to_pfn(virt_to_phys(&vectors));
4599 map.virtual = 0xffff0000;
4600 map.length = PAGE_SIZE;
4601 #ifdef CONFIG_KUSER_HELPERS
4602 @@ -1365,8 +1419,10 @@ static void __init kmap_init(void)
4603 static void __init map_lowmem(void)
4604 {
4605 struct memblock_region *reg;
4606 +#ifndef CONFIG_PAX_KERNEXEC
4607 unsigned long kernel_x_start = round_down(__pa(_stext), SECTION_SIZE);
4608 unsigned long kernel_x_end = round_up(__pa(__init_end), SECTION_SIZE);
4609 +#endif
4610
4611 /* Map all the lowmem memory banks. */
4612 for_each_memblock(memory, reg) {
4613 @@ -1379,11 +1435,48 @@ static void __init map_lowmem(void)
4614 if (start >= end)
4615 break;
4616
4617 +#ifdef CONFIG_PAX_KERNEXEC
4618 + map.pfn = __phys_to_pfn(start);
4619 + map.virtual = __phys_to_virt(start);
4620 + map.length = end - start;
4621 +
4622 + if (map.virtual <= (unsigned long)_stext && ((unsigned long)_end < (map.virtual + map.length))) {
4623 + struct map_desc kernel;
4624 + struct map_desc initmap;
4625 +
4626 + /* when freeing initmem we will make this RW */
4627 + initmap.pfn = __phys_to_pfn(__pa(__init_begin));
4628 + initmap.virtual = (unsigned long)__init_begin;
4629 + initmap.length = _sdata - __init_begin;
4630 + initmap.type = __MT_MEMORY_RWX;
4631 + create_mapping(&initmap);
4632 +
4633 + /* when freeing initmem we will make this RX */
4634 + kernel.pfn = __phys_to_pfn(__pa(_stext));
4635 + kernel.virtual = (unsigned long)_stext;
4636 + kernel.length = __init_begin - _stext;
4637 + kernel.type = __MT_MEMORY_RWX;
4638 + create_mapping(&kernel);
4639 +
4640 + if (map.virtual < (unsigned long)_stext) {
4641 + map.length = (unsigned long)_stext - map.virtual;
4642 + map.type = __MT_MEMORY_RWX;
4643 + create_mapping(&map);
4644 + }
4645 +
4646 + map.pfn = __phys_to_pfn(__pa(_sdata));
4647 + map.virtual = (unsigned long)_sdata;
4648 + map.length = end - __pa(_sdata);
4649 + }
4650 +
4651 + map.type = MT_MEMORY_RW;
4652 + create_mapping(&map);
4653 +#else
4654 if (end < kernel_x_start || start >= kernel_x_end) {
4655 map.pfn = __phys_to_pfn(start);
4656 map.virtual = __phys_to_virt(start);
4657 map.length = end - start;
4658 - map.type = MT_MEMORY_RWX;
4659 + map.type = __MT_MEMORY_RWX;
4660
4661 create_mapping(&map);
4662 } else {
4663 @@ -1400,7 +1493,7 @@ static void __init map_lowmem(void)
4664 map.pfn = __phys_to_pfn(kernel_x_start);
4665 map.virtual = __phys_to_virt(kernel_x_start);
4666 map.length = kernel_x_end - kernel_x_start;
4667 - map.type = MT_MEMORY_RWX;
4668 + map.type = __MT_MEMORY_RWX;
4669
4670 create_mapping(&map);
4671
4672 @@ -1413,6 +1506,7 @@ static void __init map_lowmem(void)
4673 create_mapping(&map);
4674 }
4675 }
4676 +#endif
4677 }
4678 }
4679
4680 diff --git a/arch/arm/plat-iop/setup.c b/arch/arm/plat-iop/setup.c
4681 index 5b217f4..c23f40e 100644
4682 --- a/arch/arm/plat-iop/setup.c
4683 +++ b/arch/arm/plat-iop/setup.c
4684 @@ -24,7 +24,7 @@ static struct map_desc iop3xx_std_desc[] __initdata = {
4685 .virtual = IOP3XX_PERIPHERAL_VIRT_BASE,
4686 .pfn = __phys_to_pfn(IOP3XX_PERIPHERAL_PHYS_BASE),
4687 .length = IOP3XX_PERIPHERAL_SIZE,
4688 - .type = MT_UNCACHED,
4689 + .type = MT_UNCACHED_RW,
4690 },
4691 };
4692
4693 diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
4694 index a5bc92d..0bb4730 100644
4695 --- a/arch/arm/plat-omap/sram.c
4696 +++ b/arch/arm/plat-omap/sram.c
4697 @@ -93,6 +93,8 @@ void __init omap_map_sram(unsigned long start, unsigned long size,
4698 * Looks like we need to preserve some bootloader code at the
4699 * beginning of SRAM for jumping to flash for reboot to work...
4700 */
4701 + pax_open_kernel();
4702 memset_io(omap_sram_base + omap_sram_skip, 0,
4703 omap_sram_size - omap_sram_skip);
4704 + pax_close_kernel();
4705 }
4706 diff --git a/arch/arm/plat-samsung/include/plat/dma-ops.h b/arch/arm/plat-samsung/include/plat/dma-ops.h
4707 index ce6d763..cfea917 100644
4708 --- a/arch/arm/plat-samsung/include/plat/dma-ops.h
4709 +++ b/arch/arm/plat-samsung/include/plat/dma-ops.h
4710 @@ -47,7 +47,7 @@ struct samsung_dma_ops {
4711 int (*started)(unsigned ch);
4712 int (*flush)(unsigned ch);
4713 int (*stop)(unsigned ch);
4714 -};
4715 +} __no_const;
4716
4717 extern void *samsung_dmadev_get_ops(void);
4718 extern void *s3c_dma_get_ops(void);
4719 diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
4720 index 6c0f684..5faea9d 100644
4721 --- a/arch/arm64/include/asm/uaccess.h
4722 +++ b/arch/arm64/include/asm/uaccess.h
4723 @@ -99,6 +99,7 @@ static inline void set_fs(mm_segment_t fs)
4724 flag; \
4725 })
4726
4727 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
4728 #define access_ok(type, addr, size) __range_ok(addr, size)
4729 #define user_addr_max get_fs
4730
4731 diff --git a/arch/avr32/include/asm/cache.h b/arch/avr32/include/asm/cache.h
4732 index c3a58a1..78fbf54 100644
4733 --- a/arch/avr32/include/asm/cache.h
4734 +++ b/arch/avr32/include/asm/cache.h
4735 @@ -1,8 +1,10 @@
4736 #ifndef __ASM_AVR32_CACHE_H
4737 #define __ASM_AVR32_CACHE_H
4738
4739 +#include <linux/const.h>
4740 +
4741 #define L1_CACHE_SHIFT 5
4742 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
4743 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4744
4745 /*
4746 * Memory returned by kmalloc() may be used for DMA, so we must make
4747 diff --git a/arch/avr32/include/asm/elf.h b/arch/avr32/include/asm/elf.h
4748 index d232888..87c8df1 100644
4749 --- a/arch/avr32/include/asm/elf.h
4750 +++ b/arch/avr32/include/asm/elf.h
4751 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpregset_t;
4752 the loader. We need to make sure that it is out of the way of the program
4753 that it will "exec", and that there is sufficient room for the brk. */
4754
4755 -#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
4756 +#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
4757
4758 +#ifdef CONFIG_PAX_ASLR
4759 +#define PAX_ELF_ET_DYN_BASE 0x00001000UL
4760 +
4761 +#define PAX_DELTA_MMAP_LEN 15
4762 +#define PAX_DELTA_STACK_LEN 15
4763 +#endif
4764
4765 /* This yields a mask that user programs can use to figure out what
4766 instruction set this CPU supports. This could be done in user space,
4767 diff --git a/arch/avr32/include/asm/kmap_types.h b/arch/avr32/include/asm/kmap_types.h
4768 index 479330b..53717a8 100644
4769 --- a/arch/avr32/include/asm/kmap_types.h
4770 +++ b/arch/avr32/include/asm/kmap_types.h
4771 @@ -2,9 +2,9 @@
4772 #define __ASM_AVR32_KMAP_TYPES_H
4773
4774 #ifdef CONFIG_DEBUG_HIGHMEM
4775 -# define KM_TYPE_NR 29
4776 +# define KM_TYPE_NR 30
4777 #else
4778 -# define KM_TYPE_NR 14
4779 +# define KM_TYPE_NR 15
4780 #endif
4781
4782 #endif /* __ASM_AVR32_KMAP_TYPES_H */
4783 diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
4784 index 0eca933..eb78c7b 100644
4785 --- a/arch/avr32/mm/fault.c
4786 +++ b/arch/avr32/mm/fault.c
4787 @@ -41,6 +41,23 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
4788
4789 int exception_trace = 1;
4790
4791 +#ifdef CONFIG_PAX_PAGEEXEC
4792 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
4793 +{
4794 + unsigned long i;
4795 +
4796 + printk(KERN_ERR "PAX: bytes at PC: ");
4797 + for (i = 0; i < 20; i++) {
4798 + unsigned char c;
4799 + if (get_user(c, (unsigned char *)pc+i))
4800 + printk(KERN_CONT "???????? ");
4801 + else
4802 + printk(KERN_CONT "%02x ", c);
4803 + }
4804 + printk("\n");
4805 +}
4806 +#endif
4807 +
4808 /*
4809 * This routine handles page faults. It determines the address and the
4810 * problem, and then passes it off to one of the appropriate routines.
4811 @@ -176,6 +193,16 @@ bad_area:
4812 up_read(&mm->mmap_sem);
4813
4814 if (user_mode(regs)) {
4815 +
4816 +#ifdef CONFIG_PAX_PAGEEXEC
4817 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
4818 + if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
4819 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
4820 + do_group_exit(SIGKILL);
4821 + }
4822 + }
4823 +#endif
4824 +
4825 if (exception_trace && printk_ratelimit())
4826 printk("%s%s[%d]: segfault at %08lx pc %08lx "
4827 "sp %08lx ecr %lu\n",
4828 diff --git a/arch/blackfin/include/asm/cache.h b/arch/blackfin/include/asm/cache.h
4829 index 568885a..f8008df 100644
4830 --- a/arch/blackfin/include/asm/cache.h
4831 +++ b/arch/blackfin/include/asm/cache.h
4832 @@ -7,6 +7,7 @@
4833 #ifndef __ARCH_BLACKFIN_CACHE_H
4834 #define __ARCH_BLACKFIN_CACHE_H
4835
4836 +#include <linux/const.h>
4837 #include <linux/linkage.h> /* for asmlinkage */
4838
4839 /*
4840 @@ -14,7 +15,7 @@
4841 * Blackfin loads 32 bytes for cache
4842 */
4843 #define L1_CACHE_SHIFT 5
4844 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
4845 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4846 #define SMP_CACHE_BYTES L1_CACHE_BYTES
4847
4848 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
4849 diff --git a/arch/cris/include/arch-v10/arch/cache.h b/arch/cris/include/arch-v10/arch/cache.h
4850 index aea2718..3639a60 100644
4851 --- a/arch/cris/include/arch-v10/arch/cache.h
4852 +++ b/arch/cris/include/arch-v10/arch/cache.h
4853 @@ -1,8 +1,9 @@
4854 #ifndef _ASM_ARCH_CACHE_H
4855 #define _ASM_ARCH_CACHE_H
4856
4857 +#include <linux/const.h>
4858 /* Etrax 100LX have 32-byte cache-lines. */
4859 -#define L1_CACHE_BYTES 32
4860 #define L1_CACHE_SHIFT 5
4861 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4862
4863 #endif /* _ASM_ARCH_CACHE_H */
4864 diff --git a/arch/cris/include/arch-v32/arch/cache.h b/arch/cris/include/arch-v32/arch/cache.h
4865 index 7caf25d..ee65ac5 100644
4866 --- a/arch/cris/include/arch-v32/arch/cache.h
4867 +++ b/arch/cris/include/arch-v32/arch/cache.h
4868 @@ -1,11 +1,12 @@
4869 #ifndef _ASM_CRIS_ARCH_CACHE_H
4870 #define _ASM_CRIS_ARCH_CACHE_H
4871
4872 +#include <linux/const.h>
4873 #include <arch/hwregs/dma.h>
4874
4875 /* A cache-line is 32 bytes. */
4876 -#define L1_CACHE_BYTES 32
4877 #define L1_CACHE_SHIFT 5
4878 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4879
4880 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
4881
4882 diff --git a/arch/frv/include/asm/atomic.h b/arch/frv/include/asm/atomic.h
4883 index b86329d..6709906 100644
4884 --- a/arch/frv/include/asm/atomic.h
4885 +++ b/arch/frv/include/asm/atomic.h
4886 @@ -186,6 +186,16 @@ static inline void atomic64_dec(atomic64_t *v)
4887 #define atomic64_cmpxchg(v, old, new) (__cmpxchg_64(old, new, &(v)->counter))
4888 #define atomic64_xchg(v, new) (__xchg_64(new, &(v)->counter))
4889
4890 +#define atomic64_read_unchecked(v) atomic64_read(v)
4891 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
4892 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
4893 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
4894 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
4895 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
4896 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
4897 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
4898 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
4899 +
4900 static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
4901 {
4902 int c, old;
4903 diff --git a/arch/frv/include/asm/cache.h b/arch/frv/include/asm/cache.h
4904 index 2797163..c2a401d 100644
4905 --- a/arch/frv/include/asm/cache.h
4906 +++ b/arch/frv/include/asm/cache.h
4907 @@ -12,10 +12,11 @@
4908 #ifndef __ASM_CACHE_H
4909 #define __ASM_CACHE_H
4910
4911 +#include <linux/const.h>
4912
4913 /* bytes per L1 cache line */
4914 #define L1_CACHE_SHIFT (CONFIG_FRV_L1_CACHE_SHIFT)
4915 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
4916 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4917
4918 #define __cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
4919 #define ____cacheline_aligned __attribute__((aligned(L1_CACHE_BYTES)))
4920 diff --git a/arch/frv/include/asm/kmap_types.h b/arch/frv/include/asm/kmap_types.h
4921 index 43901f2..0d8b865 100644
4922 --- a/arch/frv/include/asm/kmap_types.h
4923 +++ b/arch/frv/include/asm/kmap_types.h
4924 @@ -2,6 +2,6 @@
4925 #ifndef _ASM_KMAP_TYPES_H
4926 #define _ASM_KMAP_TYPES_H
4927
4928 -#define KM_TYPE_NR 17
4929 +#define KM_TYPE_NR 18
4930
4931 #endif
4932 diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c
4933 index 836f147..4cf23f5 100644
4934 --- a/arch/frv/mm/elf-fdpic.c
4935 +++ b/arch/frv/mm/elf-fdpic.c
4936 @@ -61,6 +61,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
4937 {
4938 struct vm_area_struct *vma;
4939 struct vm_unmapped_area_info info;
4940 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
4941
4942 if (len > TASK_SIZE)
4943 return -ENOMEM;
4944 @@ -73,8 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
4945 if (addr) {
4946 addr = PAGE_ALIGN(addr);
4947 vma = find_vma(current->mm, addr);
4948 - if (TASK_SIZE - len >= addr &&
4949 - (!vma || addr + len <= vma->vm_start))
4950 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
4951 goto success;
4952 }
4953
4954 @@ -85,6 +85,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
4955 info.high_limit = (current->mm->start_stack - 0x00200000);
4956 info.align_mask = 0;
4957 info.align_offset = 0;
4958 + info.threadstack_offset = offset;
4959 addr = vm_unmapped_area(&info);
4960 if (!(addr & ~PAGE_MASK))
4961 goto success;
4962 diff --git a/arch/hexagon/include/asm/cache.h b/arch/hexagon/include/asm/cache.h
4963 index f4ca594..adc72fd6 100644
4964 --- a/arch/hexagon/include/asm/cache.h
4965 +++ b/arch/hexagon/include/asm/cache.h
4966 @@ -21,9 +21,11 @@
4967 #ifndef __ASM_CACHE_H
4968 #define __ASM_CACHE_H
4969
4970 +#include <linux/const.h>
4971 +
4972 /* Bytes per L1 cache line */
4973 -#define L1_CACHE_SHIFT (5)
4974 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
4975 +#define L1_CACHE_SHIFT 5
4976 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
4977
4978 #define __cacheline_aligned __aligned(L1_CACHE_BYTES)
4979 #define ____cacheline_aligned __aligned(L1_CACHE_BYTES)
4980 diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
4981 index 0c8e553..112d734 100644
4982 --- a/arch/ia64/Kconfig
4983 +++ b/arch/ia64/Kconfig
4984 @@ -544,6 +544,7 @@ source "drivers/sn/Kconfig"
4985 config KEXEC
4986 bool "kexec system call"
4987 depends on !IA64_HP_SIM && (!SMP || HOTPLUG_CPU)
4988 + depends on !GRKERNSEC_KMEM
4989 help
4990 kexec is a system call that implements the ability to shutdown your
4991 current kernel, and to start another kernel. It is like a reboot
4992 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
4993 index 6e6fe18..a6ae668 100644
4994 --- a/arch/ia64/include/asm/atomic.h
4995 +++ b/arch/ia64/include/asm/atomic.h
4996 @@ -208,6 +208,16 @@ atomic64_add_negative (__s64 i, atomic64_t *v)
4997 #define atomic64_inc(v) atomic64_add(1, (v))
4998 #define atomic64_dec(v) atomic64_sub(1, (v))
4999
5000 +#define atomic64_read_unchecked(v) atomic64_read(v)
5001 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
5002 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
5003 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
5004 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
5005 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
5006 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
5007 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
5008 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
5009 +
5010 /* Atomic operations are already serializing */
5011 #define smp_mb__before_atomic_dec() barrier()
5012 #define smp_mb__after_atomic_dec() barrier()
5013 diff --git a/arch/ia64/include/asm/cache.h b/arch/ia64/include/asm/cache.h
5014 index 988254a..e1ee885 100644
5015 --- a/arch/ia64/include/asm/cache.h
5016 +++ b/arch/ia64/include/asm/cache.h
5017 @@ -1,6 +1,7 @@
5018 #ifndef _ASM_IA64_CACHE_H
5019 #define _ASM_IA64_CACHE_H
5020
5021 +#include <linux/const.h>
5022
5023 /*
5024 * Copyright (C) 1998-2000 Hewlett-Packard Co
5025 @@ -9,7 +10,7 @@
5026
5027 /* Bytes per L1 (data) cache line. */
5028 #define L1_CACHE_SHIFT CONFIG_IA64_L1_CACHE_SHIFT
5029 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5030 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5031
5032 #ifdef CONFIG_SMP
5033 # define SMP_CACHE_SHIFT L1_CACHE_SHIFT
5034 diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
5035 index 5a83c5c..4d7f553 100644
5036 --- a/arch/ia64/include/asm/elf.h
5037 +++ b/arch/ia64/include/asm/elf.h
5038 @@ -42,6 +42,13 @@
5039 */
5040 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x800000000UL)
5041
5042 +#ifdef CONFIG_PAX_ASLR
5043 +#define PAX_ELF_ET_DYN_BASE (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
5044 +
5045 +#define PAX_DELTA_MMAP_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
5046 +#define PAX_DELTA_STACK_LEN (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
5047 +#endif
5048 +
5049 #define PT_IA_64_UNWIND 0x70000001
5050
5051 /* IA-64 relocations: */
5052 diff --git a/arch/ia64/include/asm/pgalloc.h b/arch/ia64/include/asm/pgalloc.h
5053 index 5767cdf..7462574 100644
5054 --- a/arch/ia64/include/asm/pgalloc.h
5055 +++ b/arch/ia64/include/asm/pgalloc.h
5056 @@ -39,6 +39,12 @@ pgd_populate(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
5057 pgd_val(*pgd_entry) = __pa(pud);
5058 }
5059
5060 +static inline void
5061 +pgd_populate_kernel(struct mm_struct *mm, pgd_t * pgd_entry, pud_t * pud)
5062 +{
5063 + pgd_populate(mm, pgd_entry, pud);
5064 +}
5065 +
5066 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
5067 {
5068 return quicklist_alloc(0, GFP_KERNEL, NULL);
5069 @@ -57,6 +63,12 @@ pud_populate(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
5070 pud_val(*pud_entry) = __pa(pmd);
5071 }
5072
5073 +static inline void
5074 +pud_populate_kernel(struct mm_struct *mm, pud_t * pud_entry, pmd_t * pmd)
5075 +{
5076 + pud_populate(mm, pud_entry, pmd);
5077 +}
5078 +
5079 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
5080 {
5081 return quicklist_alloc(0, GFP_KERNEL, NULL);
5082 diff --git a/arch/ia64/include/asm/pgtable.h b/arch/ia64/include/asm/pgtable.h
5083 index 7935115..c0eca6a 100644
5084 --- a/arch/ia64/include/asm/pgtable.h
5085 +++ b/arch/ia64/include/asm/pgtable.h
5086 @@ -12,7 +12,7 @@
5087 * David Mosberger-Tang <davidm@hpl.hp.com>
5088 */
5089
5090 -
5091 +#include <linux/const.h>
5092 #include <asm/mman.h>
5093 #include <asm/page.h>
5094 #include <asm/processor.h>
5095 @@ -142,6 +142,17 @@
5096 #define PAGE_READONLY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5097 #define PAGE_COPY __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5098 #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
5099 +
5100 +#ifdef CONFIG_PAX_PAGEEXEC
5101 +# define PAGE_SHARED_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
5102 +# define PAGE_READONLY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5103 +# define PAGE_COPY_NOEXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
5104 +#else
5105 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
5106 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
5107 +# define PAGE_COPY_NOEXEC PAGE_COPY
5108 +#endif
5109 +
5110 #define PAGE_GATE __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
5111 #define PAGE_KERNEL __pgprot(__DIRTY_BITS | _PAGE_PL_0 | _PAGE_AR_RWX)
5112 #define PAGE_KERNELRX __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
5113 diff --git a/arch/ia64/include/asm/spinlock.h b/arch/ia64/include/asm/spinlock.h
5114 index 45698cd..e8e2dbc 100644
5115 --- a/arch/ia64/include/asm/spinlock.h
5116 +++ b/arch/ia64/include/asm/spinlock.h
5117 @@ -71,7 +71,7 @@ static __always_inline void __ticket_spin_unlock(arch_spinlock_t *lock)
5118 unsigned short *p = (unsigned short *)&lock->lock + 1, tmp;
5119
5120 asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
5121 - ACCESS_ONCE(*p) = (tmp + 2) & ~1;
5122 + ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
5123 }
5124
5125 static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
5126 diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
5127 index 449c8c0..3d4b1e9 100644
5128 --- a/arch/ia64/include/asm/uaccess.h
5129 +++ b/arch/ia64/include/asm/uaccess.h
5130 @@ -70,6 +70,7 @@
5131 && ((segment).seg == KERNEL_DS.seg \
5132 || likely(REGION_OFFSET((unsigned long) (addr)) < RGN_MAP_LIMIT))); \
5133 })
5134 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
5135 #define access_ok(type, addr, size) __access_ok((addr), (size), get_fs())
5136
5137 /*
5138 @@ -240,12 +241,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
5139 static inline unsigned long
5140 __copy_to_user (void __user *to, const void *from, unsigned long count)
5141 {
5142 + if (count > INT_MAX)
5143 + return count;
5144 +
5145 + if (!__builtin_constant_p(count))
5146 + check_object_size(from, count, true);
5147 +
5148 return __copy_user(to, (__force void __user *) from, count);
5149 }
5150
5151 static inline unsigned long
5152 __copy_from_user (void *to, const void __user *from, unsigned long count)
5153 {
5154 + if (count > INT_MAX)
5155 + return count;
5156 +
5157 + if (!__builtin_constant_p(count))
5158 + check_object_size(to, count, false);
5159 +
5160 return __copy_user((__force void __user *) to, from, count);
5161 }
5162
5163 @@ -255,10 +268,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
5164 ({ \
5165 void __user *__cu_to = (to); \
5166 const void *__cu_from = (from); \
5167 - long __cu_len = (n); \
5168 + unsigned long __cu_len = (n); \
5169 \
5170 - if (__access_ok(__cu_to, __cu_len, get_fs())) \
5171 + if (__cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs())) { \
5172 + if (!__builtin_constant_p(n)) \
5173 + check_object_size(__cu_from, __cu_len, true); \
5174 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len); \
5175 + } \
5176 __cu_len; \
5177 })
5178
5179 @@ -266,11 +282,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
5180 ({ \
5181 void *__cu_to = (to); \
5182 const void __user *__cu_from = (from); \
5183 - long __cu_len = (n); \
5184 + unsigned long __cu_len = (n); \
5185 \
5186 __chk_user_ptr(__cu_from); \
5187 - if (__access_ok(__cu_from, __cu_len, get_fs())) \
5188 + if (__cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs())) { \
5189 + if (!__builtin_constant_p(n)) \
5190 + check_object_size(__cu_to, __cu_len, false); \
5191 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len); \
5192 + } \
5193 __cu_len; \
5194 })
5195
5196 diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
5197 index 24603be..948052d 100644
5198 --- a/arch/ia64/kernel/module.c
5199 +++ b/arch/ia64/kernel/module.c
5200 @@ -307,8 +307,7 @@ plt_target (struct plt_entry *plt)
5201 void
5202 module_free (struct module *mod, void *module_region)
5203 {
5204 - if (mod && mod->arch.init_unw_table &&
5205 - module_region == mod->module_init) {
5206 + if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
5207 unw_remove_unwind_table(mod->arch.init_unw_table);
5208 mod->arch.init_unw_table = NULL;
5209 }
5210 @@ -494,15 +493,39 @@ module_frob_arch_sections (Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, char *secstrings,
5211 }
5212
5213 static inline int
5214 +in_init_rx (const struct module *mod, uint64_t addr)
5215 +{
5216 + return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
5217 +}
5218 +
5219 +static inline int
5220 +in_init_rw (const struct module *mod, uint64_t addr)
5221 +{
5222 + return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
5223 +}
5224 +
5225 +static inline int
5226 in_init (const struct module *mod, uint64_t addr)
5227 {
5228 - return addr - (uint64_t) mod->module_init < mod->init_size;
5229 + return in_init_rx(mod, addr) || in_init_rw(mod, addr);
5230 +}
5231 +
5232 +static inline int
5233 +in_core_rx (const struct module *mod, uint64_t addr)
5234 +{
5235 + return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
5236 +}
5237 +
5238 +static inline int
5239 +in_core_rw (const struct module *mod, uint64_t addr)
5240 +{
5241 + return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
5242 }
5243
5244 static inline int
5245 in_core (const struct module *mod, uint64_t addr)
5246 {
5247 - return addr - (uint64_t) mod->module_core < mod->core_size;
5248 + return in_core_rx(mod, addr) || in_core_rw(mod, addr);
5249 }
5250
5251 static inline int
5252 @@ -685,7 +708,14 @@ do_reloc (struct module *mod, uint8_t r_type, Elf64_Sym *sym, uint64_t addend,
5253 break;
5254
5255 case RV_BDREL:
5256 - val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
5257 + if (in_init_rx(mod, val))
5258 + val -= (uint64_t) mod->module_init_rx;
5259 + else if (in_init_rw(mod, val))
5260 + val -= (uint64_t) mod->module_init_rw;
5261 + else if (in_core_rx(mod, val))
5262 + val -= (uint64_t) mod->module_core_rx;
5263 + else if (in_core_rw(mod, val))
5264 + val -= (uint64_t) mod->module_core_rw;
5265 break;
5266
5267 case RV_LTV:
5268 @@ -820,15 +850,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs, const char *strtab, unsigned int symind
5269 * addresses have been selected...
5270 */
5271 uint64_t gp;
5272 - if (mod->core_size > MAX_LTOFF)
5273 + if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
5274 /*
5275 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
5276 * at the end of the module.
5277 */
5278 - gp = mod->core_size - MAX_LTOFF / 2;
5279 + gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
5280 else
5281 - gp = mod->core_size / 2;
5282 - gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
5283 + gp = (mod->core_size_rx + mod->core_size_rw) / 2;
5284 + gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
5285 mod->arch.gp = gp;
5286 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
5287 }
5288 diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
5289 index ab33328..f39506c 100644
5290 --- a/arch/ia64/kernel/palinfo.c
5291 +++ b/arch/ia64/kernel/palinfo.c
5292 @@ -980,7 +980,7 @@ static int palinfo_cpu_callback(struct notifier_block *nfb,
5293 return NOTIFY_OK;
5294 }
5295
5296 -static struct notifier_block __refdata palinfo_cpu_notifier =
5297 +static struct notifier_block palinfo_cpu_notifier =
5298 {
5299 .notifier_call = palinfo_cpu_callback,
5300 .priority = 0,
5301 diff --git a/arch/ia64/kernel/sys_ia64.c b/arch/ia64/kernel/sys_ia64.c
5302 index 41e33f8..65180b2a 100644
5303 --- a/arch/ia64/kernel/sys_ia64.c
5304 +++ b/arch/ia64/kernel/sys_ia64.c
5305 @@ -28,6 +28,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5306 unsigned long align_mask = 0;
5307 struct mm_struct *mm = current->mm;
5308 struct vm_unmapped_area_info info;
5309 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
5310
5311 if (len > RGN_MAP_LIMIT)
5312 return -ENOMEM;
5313 @@ -43,6 +44,13 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5314 if (REGION_NUMBER(addr) == RGN_HPAGE)
5315 addr = 0;
5316 #endif
5317 +
5318 +#ifdef CONFIG_PAX_RANDMMAP
5319 + if (mm->pax_flags & MF_PAX_RANDMMAP)
5320 + addr = mm->free_area_cache;
5321 + else
5322 +#endif
5323 +
5324 if (!addr)
5325 addr = TASK_UNMAPPED_BASE;
5326
5327 @@ -61,6 +69,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len
5328 info.high_limit = TASK_SIZE;
5329 info.align_mask = align_mask;
5330 info.align_offset = 0;
5331 + info.threadstack_offset = offset;
5332 return vm_unmapped_area(&info);
5333 }
5334
5335 diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
5336 index 84f8a52..7c76178 100644
5337 --- a/arch/ia64/kernel/vmlinux.lds.S
5338 +++ b/arch/ia64/kernel/vmlinux.lds.S
5339 @@ -192,7 +192,7 @@ SECTIONS {
5340 /* Per-cpu data: */
5341 . = ALIGN(PERCPU_PAGE_SIZE);
5342 PERCPU_VADDR(SMP_CACHE_BYTES, PERCPU_ADDR, :percpu)
5343 - __phys_per_cpu_start = __per_cpu_load;
5344 + __phys_per_cpu_start = per_cpu_load;
5345 /*
5346 * ensure percpu data fits
5347 * into percpu page size
5348 diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
5349 index 7225dad..2a7c8256 100644
5350 --- a/arch/ia64/mm/fault.c
5351 +++ b/arch/ia64/mm/fault.c
5352 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned long address)
5353 return pte_present(pte);
5354 }
5355
5356 +#ifdef CONFIG_PAX_PAGEEXEC
5357 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
5358 +{
5359 + unsigned long i;
5360 +
5361 + printk(KERN_ERR "PAX: bytes at PC: ");
5362 + for (i = 0; i < 8; i++) {
5363 + unsigned int c;
5364 + if (get_user(c, (unsigned int *)pc+i))
5365 + printk(KERN_CONT "???????? ");
5366 + else
5367 + printk(KERN_CONT "%08x ", c);
5368 + }
5369 + printk("\n");
5370 +}
5371 +#endif
5372 +
5373 # define VM_READ_BIT 0
5374 # define VM_WRITE_BIT 1
5375 # define VM_EXEC_BIT 2
5376 @@ -151,8 +168,21 @@ retry:
5377 if (((isr >> IA64_ISR_R_BIT) & 1UL) && (!(vma->vm_flags & (VM_READ | VM_WRITE))))
5378 goto bad_area;
5379
5380 - if ((vma->vm_flags & mask) != mask)
5381 + if ((vma->vm_flags & mask) != mask) {
5382 +
5383 +#ifdef CONFIG_PAX_PAGEEXEC
5384 + if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
5385 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
5386 + goto bad_area;
5387 +
5388 + up_read(&mm->mmap_sem);
5389 + pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
5390 + do_group_exit(SIGKILL);
5391 + }
5392 +#endif
5393 +
5394 goto bad_area;
5395 + }
5396
5397 /*
5398 * If for any reason at all we couldn't handle the fault, make
5399 diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
5400 index 68232db..6ca80af 100644
5401 --- a/arch/ia64/mm/hugetlbpage.c
5402 +++ b/arch/ia64/mm/hugetlbpage.c
5403 @@ -154,6 +154,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
5404 unsigned long pgoff, unsigned long flags)
5405 {
5406 struct vm_unmapped_area_info info;
5407 + unsigned long offset = gr_rand_threadstack_offset(current->mm, file, flags);
5408
5409 if (len > RGN_MAP_LIMIT)
5410 return -ENOMEM;
5411 @@ -177,6 +178,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, u
5412 info.high_limit = HPAGE_REGION_BASE + RGN_MAP_LIMIT;
5413 info.align_mask = PAGE_MASK & (HPAGE_SIZE - 1);
5414 info.align_offset = 0;
5415 + info.threadstack_offset = offset;
5416 return vm_unmapped_area(&info);
5417 }
5418
5419 diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
5420 index 25c3502..560dae7 100644
5421 --- a/arch/ia64/mm/init.c
5422 +++ b/arch/ia64/mm/init.c
5423 @@ -120,6 +120,19 @@ ia64_init_addr_space (void)
5424 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
5425 vma->vm_end = vma->vm_start + PAGE_SIZE;
5426 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
5427 +
5428 +#ifdef CONFIG_PAX_PAGEEXEC
5429 + if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
5430 + vma->vm_flags &= ~VM_EXEC;
5431 +
5432 +#ifdef CONFIG_PAX_MPROTECT
5433 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
5434 + vma->vm_flags &= ~VM_MAYEXEC;
5435 +#endif
5436 +
5437 + }
5438 +#endif
5439 +
5440 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
5441 down_write(&current->mm->mmap_sem);
5442 if (insert_vm_struct(current->mm, vma)) {
5443 diff --git a/arch/m32r/include/asm/cache.h b/arch/m32r/include/asm/cache.h
5444 index 40b3ee9..8c2c112 100644
5445 --- a/arch/m32r/include/asm/cache.h
5446 +++ b/arch/m32r/include/asm/cache.h
5447 @@ -1,8 +1,10 @@
5448 #ifndef _ASM_M32R_CACHE_H
5449 #define _ASM_M32R_CACHE_H
5450
5451 +#include <linux/const.h>
5452 +
5453 /* L1 cache line size */
5454 #define L1_CACHE_SHIFT 4
5455 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5456 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5457
5458 #endif /* _ASM_M32R_CACHE_H */
5459 diff --git a/arch/m32r/lib/usercopy.c b/arch/m32r/lib/usercopy.c
5460 index 82abd15..d95ae5d 100644
5461 --- a/arch/m32r/lib/usercopy.c
5462 +++ b/arch/m32r/lib/usercopy.c
5463 @@ -14,6 +14,9 @@
5464 unsigned long
5465 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
5466 {
5467 + if ((long)n < 0)
5468 + return n;
5469 +
5470 prefetch(from);
5471 if (access_ok(VERIFY_WRITE, to, n))
5472 __copy_user(to,from,n);
5473 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
5474 unsigned long
5475 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
5476 {
5477 + if ((long)n < 0)
5478 + return n;
5479 +
5480 prefetchw(to);
5481 if (access_ok(VERIFY_READ, from, n))
5482 __copy_user_zeroing(to,from,n);
5483 diff --git a/arch/m68k/include/asm/cache.h b/arch/m68k/include/asm/cache.h
5484 index 0395c51..5f26031 100644
5485 --- a/arch/m68k/include/asm/cache.h
5486 +++ b/arch/m68k/include/asm/cache.h
5487 @@ -4,9 +4,11 @@
5488 #ifndef __ARCH_M68K_CACHE_H
5489 #define __ARCH_M68K_CACHE_H
5490
5491 +#include <linux/const.h>
5492 +
5493 /* bytes per L1 cache line */
5494 #define L1_CACHE_SHIFT 4
5495 -#define L1_CACHE_BYTES (1<< L1_CACHE_SHIFT)
5496 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5497
5498 #define ARCH_DMA_MINALIGN L1_CACHE_BYTES
5499
5500 diff --git a/arch/metag/mm/hugetlbpage.c b/arch/metag/mm/hugetlbpage.c
5501 index 0424315..defcca9 100644
5502 --- a/arch/metag/mm/hugetlbpage.c
5503 +++ b/arch/metag/mm/hugetlbpage.c
5504 @@ -205,6 +205,7 @@ hugetlb_get_unmapped_area_new_pmd(unsigned long len)
5505 info.high_limit = TASK_SIZE;
5506 info.align_mask = PAGE_MASK & HUGEPT_MASK;
5507 info.align_offset = 0;
5508 + info.threadstack_offset = 0;
5509 return vm_unmapped_area(&info);
5510 }
5511
5512 diff --git a/arch/microblaze/include/asm/cache.h b/arch/microblaze/include/asm/cache.h
5513 index 4efe96a..60e8699 100644
5514 --- a/arch/microblaze/include/asm/cache.h
5515 +++ b/arch/microblaze/include/asm/cache.h
5516 @@ -13,11 +13,12 @@
5517 #ifndef _ASM_MICROBLAZE_CACHE_H
5518 #define _ASM_MICROBLAZE_CACHE_H
5519
5520 +#include <linux/const.h>
5521 #include <asm/registers.h>
5522
5523 #define L1_CACHE_SHIFT 5
5524 /* word-granular cache in microblaze */
5525 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
5526 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
5527
5528 #define SMP_CACHE_BYTES L1_CACHE_BYTES
5529
5530 diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
5531 index 95fa1f1..56a6fa2 100644
5532 --- a/arch/mips/Kconfig
5533 +++ b/arch/mips/Kconfig
5534 @@ -2298,6 +2298,7 @@ source "kernel/Kconfig.preempt"
5535
5536 config KEXEC
5537 bool "Kexec system call"
5538 + depends on !GRKERNSEC_KMEM
5539 help
5540 kexec is a system call that implements the ability to shutdown your
5541 current kernel, and to start another kernel. It is like a reboot
5542 diff --git a/arch/mips/cavium-octeon/dma-octeon.c b/arch/mips/cavium-octeon/dma-octeon.c
5543 index 02f2444..506969c 100644
5544 --- a/arch/mips/cavium-octeon/dma-octeon.c
5545 +++ b/arch/mips/cavium-octeon/dma-octeon.c
5546 @@ -199,7 +199,7 @@ static void octeon_dma_free_coherent(struct device *dev, size_t size,
5547 if (dma_release_from_coherent(dev, order, vaddr))
5548 return;
5549
5550 - swiotlb_free_coherent(dev, size, vaddr, dma_handle);
5551 + swiotlb_free_coherent(dev, size, vaddr, dma_handle, attrs);
5552 }
5553
5554 static dma_addr_t octeon_unity_phys_to_dma(struct device *dev, phys_addr_t paddr)
5555 diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
5556 index 7eed2f2..c4e385d 100644
5557 --- a/arch/mips/include/asm/atomic.h
5558 +++ b/arch/mips/include/asm/atomic.h
5559 @@ -21,15 +21,39 @@
5560 #include <asm/cmpxchg.h>
5561 #include <asm/war.h>
5562
5563 +#ifdef CONFIG_GENERIC_ATOMIC64
5564 +#include <asm-generic/atomic64.h>
5565 +#endif
5566 +
5567 #define ATOMIC_INIT(i) { (i) }
5568
5569 +#ifdef CONFIG_64BIT
5570 +#define _ASM_EXTABLE(from, to) \
5571 +" .section __ex_table,\"a\"\n" \
5572 +" .dword " #from ", " #to"\n" \
5573 +" .previous\n"
5574 +#else
5575 +#define _ASM_EXTABLE(from, to) \
5576 +" .section __ex_table,\"a\"\n" \
5577 +" .word " #from ", " #to"\n" \
5578 +" .previous\n"
5579 +#endif
5580 +
5581 /*
5582 * atomic_read - read atomic variable
5583 * @v: pointer of type atomic_t
5584 *
5585 * Atomically reads the value of @v.
5586 */
5587 -#define atomic_read(v) (*(volatile int *)&(v)->counter)
5588 +static inline int atomic_read(const atomic_t *v)
5589 +{
5590 + return (*(volatile const int *) &v->counter);
5591 +}
5592 +
5593 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5594 +{
5595 + return (*(volatile const int *) &v->counter);
5596 +}
5597
5598 /*
5599 * atomic_set - set atomic variable
5600 @@ -38,7 +62,15 @@
5601 *
5602 * Atomically sets the value of @v to @i.
5603 */
5604 -#define atomic_set(v, i) ((v)->counter = (i))
5605 +static inline void atomic_set(atomic_t *v, int i)
5606 +{
5607 + v->counter = i;
5608 +}
5609 +
5610 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5611 +{
5612 + v->counter = i;
5613 +}
5614
5615 /*
5616 * atomic_add - add integer to atomic variable
5617 @@ -47,7 +79,67 @@
5618 *
5619 * Atomically adds @i to @v.
5620 */
5621 -static __inline__ void atomic_add(int i, atomic_t * v)
5622 +static __inline__ void atomic_add(int i, atomic_t *v)
5623 +{
5624 + int temp;
5625 +
5626 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
5627 + __asm__ __volatile__(
5628 + " .set mips3 \n"
5629 + "1: ll %0, %1 # atomic_add \n"
5630 +#ifdef CONFIG_PAX_REFCOUNT
5631 + /* Exception on overflow. */
5632 + "2: add %0, %2 \n"
5633 +#else
5634 + " addu %0, %2 \n"
5635 +#endif
5636 + " sc %0, %1 \n"
5637 + " beqzl %0, 1b \n"
5638 +#ifdef CONFIG_PAX_REFCOUNT
5639 + "3: \n"
5640 + _ASM_EXTABLE(2b, 3b)
5641 +#endif
5642 + " .set mips0 \n"
5643 + : "=&r" (temp), "+m" (v->counter)
5644 + : "Ir" (i));
5645 + } else if (kernel_uses_llsc) {
5646 + __asm__ __volatile__(
5647 + " .set mips3 \n"
5648 + "1: ll %0, %1 # atomic_add \n"
5649 +#ifdef CONFIG_PAX_REFCOUNT
5650 + /* Exception on overflow. */
5651 + "2: add %0, %2 \n"
5652 +#else
5653 + " addu %0, %2 \n"
5654 +#endif
5655 + " sc %0, %1 \n"
5656 + " beqz %0, 1b \n"
5657 +#ifdef CONFIG_PAX_REFCOUNT
5658 + "3: \n"
5659 + _ASM_EXTABLE(2b, 3b)
5660 +#endif
5661 + " .set mips0 \n"
5662 + : "=&r" (temp), "+m" (v->counter)
5663 + : "Ir" (i));
5664 + } else {
5665 + unsigned long flags;
5666 +
5667 + raw_local_irq_save(flags);
5668 + __asm__ __volatile__(
5669 +#ifdef CONFIG_PAX_REFCOUNT
5670 + /* Exception on overflow. */
5671 + "1: add %0, %1 \n"
5672 + "2: \n"
5673 + _ASM_EXTABLE(1b, 2b)
5674 +#else
5675 + " addu %0, %1 \n"
5676 +#endif
5677 + : "+r" (v->counter) : "Ir" (i));
5678 + raw_local_irq_restore(flags);
5679 + }
5680 +}
5681 +
5682 +static __inline__ void atomic_add_unchecked(int i, atomic_unchecked_t *v)
5683 {
5684 if (kernel_uses_llsc && R10000_LLSC_WAR) {
5685 int temp;
5686 @@ -90,7 +182,67 @@ static __inline__ void atomic_add(int i, atomic_t * v)
5687 *
5688 * Atomically subtracts @i from @v.
5689 */
5690 -static __inline__ void atomic_sub(int i, atomic_t * v)
5691 +static __inline__ void atomic_sub(int i, atomic_t *v)
5692 +{
5693 + int temp;
5694 +
5695 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
5696 + __asm__ __volatile__(
5697 + " .set mips3 \n"
5698 + "1: ll %0, %1 # atomic64_sub \n"
5699 +#ifdef CONFIG_PAX_REFCOUNT
5700 + /* Exception on overflow. */
5701 + "2: sub %0, %2 \n"
5702 +#else
5703 + " subu %0, %2 \n"
5704 +#endif
5705 + " sc %0, %1 \n"
5706 + " beqzl %0, 1b \n"
5707 +#ifdef CONFIG_PAX_REFCOUNT
5708 + "3: \n"
5709 + _ASM_EXTABLE(2b, 3b)
5710 +#endif
5711 + " .set mips0 \n"
5712 + : "=&r" (temp), "+m" (v->counter)
5713 + : "Ir" (i));
5714 + } else if (kernel_uses_llsc) {
5715 + __asm__ __volatile__(
5716 + " .set mips3 \n"
5717 + "1: ll %0, %1 # atomic64_sub \n"
5718 +#ifdef CONFIG_PAX_REFCOUNT
5719 + /* Exception on overflow. */
5720 + "2: sub %0, %2 \n"
5721 +#else
5722 + " subu %0, %2 \n"
5723 +#endif
5724 + " sc %0, %1 \n"
5725 + " beqz %0, 1b \n"
5726 +#ifdef CONFIG_PAX_REFCOUNT
5727 + "3: \n"
5728 + _ASM_EXTABLE(2b, 3b)
5729 +#endif
5730 + " .set mips0 \n"
5731 + : "=&r" (temp), "+m" (v->counter)
5732 + : "Ir" (i));
5733 + } else {
5734 + unsigned long flags;
5735 +
5736 + raw_local_irq_save(flags);
5737 + __asm__ __volatile__(
5738 +#ifdef CONFIG_PAX_REFCOUNT
5739 + /* Exception on overflow. */
5740 + "1: sub %0, %1 \n"
5741 + "2: \n"
5742 + _ASM_EXTABLE(1b, 2b)
5743 +#else
5744 + " subu %0, %1 \n"
5745 +#endif
5746 + : "+r" (v->counter) : "Ir" (i));
5747 + raw_local_irq_restore(flags);
5748 + }
5749 +}
5750 +
5751 +static __inline__ void atomic_sub_unchecked(long i, atomic_unchecked_t *v)
5752 {
5753 if (kernel_uses_llsc && R10000_LLSC_WAR) {
5754 int temp;
5755 @@ -129,7 +281,93 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
5756 /*
5757 * Same as above, but return the result value
5758 */
5759 -static __inline__ int atomic_add_return(int i, atomic_t * v)
5760 +static __inline__ int atomic_add_return(int i, atomic_t *v)
5761 +{
5762 + int result;
5763 + int temp;
5764 +
5765 + smp_mb__before_llsc();
5766 +
5767 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
5768 + __asm__ __volatile__(
5769 + " .set mips3 \n"
5770 + "1: ll %1, %2 # atomic_add_return \n"
5771 +#ifdef CONFIG_PAX_REFCOUNT
5772 + "2: add %0, %1, %3 \n"
5773 +#else
5774 + " addu %0, %1, %3 \n"
5775 +#endif
5776 + " sc %0, %2 \n"
5777 + " beqzl %0, 1b \n"
5778 +#ifdef CONFIG_PAX_REFCOUNT
5779 + " b 4f \n"
5780 + " .set noreorder \n"
5781 + "3: b 5f \n"
5782 + " move %0, %1 \n"
5783 + " .set reorder \n"
5784 + _ASM_EXTABLE(2b, 3b)
5785 +#endif
5786 + "4: addu %0, %1, %3 \n"
5787 +#ifdef CONFIG_PAX_REFCOUNT
5788 + "5: \n"
5789 +#endif
5790 + " .set mips0 \n"
5791 + : "=&r" (result), "=&r" (temp), "+m" (v->counter)
5792 + : "Ir" (i));
5793 + } else if (kernel_uses_llsc) {
5794 + __asm__ __volatile__(
5795 + " .set mips3 \n"
5796 + "1: ll %1, %2 # atomic_add_return \n"
5797 +#ifdef CONFIG_PAX_REFCOUNT
5798 + "2: add %0, %1, %3 \n"
5799 +#else
5800 + " addu %0, %1, %3 \n"
5801 +#endif
5802 + " sc %0, %2 \n"
5803 + " bnez %0, 4f \n"
5804 + " b 1b \n"
5805 +#ifdef CONFIG_PAX_REFCOUNT
5806 + " .set noreorder \n"
5807 + "3: b 5f \n"
5808 + " move %0, %1 \n"
5809 + " .set reorder \n"
5810 + _ASM_EXTABLE(2b, 3b)
5811 +#endif
5812 + "4: addu %0, %1, %3 \n"
5813 +#ifdef CONFIG_PAX_REFCOUNT
5814 + "5: \n"
5815 +#endif
5816 + " .set mips0 \n"
5817 + : "=&r" (result), "=&r" (temp), "+m" (v->counter)
5818 + : "Ir" (i));
5819 + } else {
5820 + unsigned long flags;
5821 +
5822 + raw_local_irq_save(flags);
5823 + __asm__ __volatile__(
5824 + " lw %0, %1 \n"
5825 +#ifdef CONFIG_PAX_REFCOUNT
5826 + /* Exception on overflow. */
5827 + "1: add %0, %2 \n"
5828 +#else
5829 + " addu %0, %2 \n"
5830 +#endif
5831 + " sw %0, %1 \n"
5832 +#ifdef CONFIG_PAX_REFCOUNT
5833 + /* Note: Dest reg is not modified on overflow */
5834 + "2: \n"
5835 + _ASM_EXTABLE(1b, 2b)
5836 +#endif
5837 + : "=&r" (result), "+m" (v->counter) : "Ir" (i));
5838 + raw_local_irq_restore(flags);
5839 + }
5840 +
5841 + smp_llsc_mb();
5842 +
5843 + return result;
5844 +}
5845 +
5846 +static __inline__ int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5847 {
5848 int result;
5849
5850 @@ -178,7 +416,93 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
5851 return result;
5852 }
5853
5854 -static __inline__ int atomic_sub_return(int i, atomic_t * v)
5855 +static __inline__ int atomic_sub_return(int i, atomic_t *v)
5856 +{
5857 + int result;
5858 + int temp;
5859 +
5860 + smp_mb__before_llsc();
5861 +
5862 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
5863 + __asm__ __volatile__(
5864 + " .set mips3 \n"
5865 + "1: ll %1, %2 # atomic_sub_return \n"
5866 +#ifdef CONFIG_PAX_REFCOUNT
5867 + "2: sub %0, %1, %3 \n"
5868 +#else
5869 + " subu %0, %1, %3 \n"
5870 +#endif
5871 + " sc %0, %2 \n"
5872 + " beqzl %0, 1b \n"
5873 +#ifdef CONFIG_PAX_REFCOUNT
5874 + " b 4f \n"
5875 + " .set noreorder \n"
5876 + "3: b 5f \n"
5877 + " move %0, %1 \n"
5878 + " .set reorder \n"
5879 + _ASM_EXTABLE(2b, 3b)
5880 +#endif
5881 + "4: subu %0, %1, %3 \n"
5882 +#ifdef CONFIG_PAX_REFCOUNT
5883 + "5: \n"
5884 +#endif
5885 + " .set mips0 \n"
5886 + : "=&r" (result), "=&r" (temp), "=m" (v->counter)
5887 + : "Ir" (i), "m" (v->counter)
5888 + : "memory");
5889 + } else if (kernel_uses_llsc) {
5890 + __asm__ __volatile__(
5891 + " .set mips3 \n"
5892 + "1: ll %1, %2 # atomic_sub_return \n"
5893 +#ifdef CONFIG_PAX_REFCOUNT
5894 + "2: sub %0, %1, %3 \n"
5895 +#else
5896 + " subu %0, %1, %3 \n"
5897 +#endif
5898 + " sc %0, %2 \n"
5899 + " bnez %0, 4f \n"
5900 + " b 1b \n"
5901 +#ifdef CONFIG_PAX_REFCOUNT
5902 + " .set noreorder \n"
5903 + "3: b 5f \n"
5904 + " move %0, %1 \n"
5905 + " .set reorder \n"
5906 + _ASM_EXTABLE(2b, 3b)
5907 +#endif
5908 + "4: subu %0, %1, %3 \n"
5909 +#ifdef CONFIG_PAX_REFCOUNT
5910 + "5: \n"
5911 +#endif
5912 + " .set mips0 \n"
5913 + : "=&r" (result), "=&r" (temp), "+m" (v->counter)
5914 + : "Ir" (i));
5915 + } else {
5916 + unsigned long flags;
5917 +
5918 + raw_local_irq_save(flags);
5919 + __asm__ __volatile__(
5920 + " lw %0, %1 \n"
5921 +#ifdef CONFIG_PAX_REFCOUNT
5922 + /* Exception on overflow. */
5923 + "1: sub %0, %2 \n"
5924 +#else
5925 + " subu %0, %2 \n"
5926 +#endif
5927 + " sw %0, %1 \n"
5928 +#ifdef CONFIG_PAX_REFCOUNT
5929 + /* Note: Dest reg is not modified on overflow */
5930 + "2: \n"
5931 + _ASM_EXTABLE(1b, 2b)
5932 +#endif
5933 + : "=&r" (result), "+m" (v->counter) : "Ir" (i));
5934 + raw_local_irq_restore(flags);
5935 + }
5936 +
5937 + smp_llsc_mb();
5938 +
5939 + return result;
5940 +}
5941 +static __inline__ int atomic_sub_return_unchecked(int i, atomic_unchecked_t *v)
5942 {
5943 int result;
5944
5945 @@ -238,7 +562,7 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
5946 * Atomically test @v and subtract @i if @v is greater or equal than @i.
5947 * The function returns the old value of @v minus @i.
5948 */
5949 -static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
5950 +static __inline__ int atomic_sub_if_positive(int i, atomic_t *v)
5951 {
5952 int result;
5953
5954 @@ -295,8 +619,26 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
5955 return result;
5956 }
5957
5958 -#define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
5959 -#define atomic_xchg(v, new) (xchg(&((v)->counter), (new)))
5960 +static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
5961 +{
5962 + return cmpxchg(&v->counter, old, new);
5963 +}
5964 +
5965 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old,
5966 + int new)
5967 +{
5968 + return cmpxchg(&(v->counter), old, new);
5969 +}
5970 +
5971 +static inline int atomic_xchg(atomic_t *v, int new)
5972 +{
5973 + return xchg(&v->counter, new);
5974 +}
5975 +
5976 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
5977 +{
5978 + return xchg(&(v->counter), new);
5979 +}
5980
5981 /**
5982 * __atomic_add_unless - add unless the number is a given value
5983 @@ -324,6 +666,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
5984
5985 #define atomic_dec_return(v) atomic_sub_return(1, (v))
5986 #define atomic_inc_return(v) atomic_add_return(1, (v))
5987 +static __inline__ int atomic_inc_return_unchecked(atomic_unchecked_t *v)
5988 +{
5989 + return atomic_add_return_unchecked(1, v);
5990 +}
5991
5992 /*
5993 * atomic_sub_and_test - subtract value from variable and test result
5994 @@ -345,6 +691,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
5995 * other cases.
5996 */
5997 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
5998 +static __inline__ int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
5999 +{
6000 + return atomic_add_return_unchecked(1, v) == 0;
6001 +}
6002
6003 /*
6004 * atomic_dec_and_test - decrement by 1 and test
6005 @@ -369,6 +719,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6006 * Atomically increments @v by 1.
6007 */
6008 #define atomic_inc(v) atomic_add(1, (v))
6009 +static __inline__ void atomic_inc_unchecked(atomic_unchecked_t *v)
6010 +{
6011 + atomic_add_unchecked(1, v);
6012 +}
6013
6014 /*
6015 * atomic_dec - decrement and test
6016 @@ -377,6 +731,10 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6017 * Atomically decrements @v by 1.
6018 */
6019 #define atomic_dec(v) atomic_sub(1, (v))
6020 +static __inline__ void atomic_dec_unchecked(atomic_unchecked_t *v)
6021 +{
6022 + atomic_sub_unchecked(1, v);
6023 +}
6024
6025 /*
6026 * atomic_add_negative - add and test if negative
6027 @@ -398,14 +756,30 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6028 * @v: pointer of type atomic64_t
6029 *
6030 */
6031 -#define atomic64_read(v) (*(volatile long *)&(v)->counter)
6032 +static inline long atomic64_read(const atomic64_t *v)
6033 +{
6034 + return (*(volatile const long *) &v->counter);
6035 +}
6036 +
6037 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
6038 +{
6039 + return (*(volatile const long *) &v->counter);
6040 +}
6041
6042 /*
6043 * atomic64_set - set atomic variable
6044 * @v: pointer of type atomic64_t
6045 * @i: required value
6046 */
6047 -#define atomic64_set(v, i) ((v)->counter = (i))
6048 +static inline void atomic64_set(atomic64_t *v, long i)
6049 +{
6050 + v->counter = i;
6051 +}
6052 +
6053 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
6054 +{
6055 + v->counter = i;
6056 +}
6057
6058 /*
6059 * atomic64_add - add integer to atomic variable
6060 @@ -414,7 +788,66 @@ static __inline__ int __atomic_add_unless(atomic_t *v, int a, int u)
6061 *
6062 * Atomically adds @i to @v.
6063 */
6064 -static __inline__ void atomic64_add(long i, atomic64_t * v)
6065 +static __inline__ void atomic64_add(long i, atomic64_t *v)
6066 +{
6067 + long temp;
6068 +
6069 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6070 + __asm__ __volatile__(
6071 + " .set mips3 \n"
6072 + "1: lld %0, %1 # atomic64_add \n"
6073 +#ifdef CONFIG_PAX_REFCOUNT
6074 + /* Exception on overflow. */
6075 + "2: dadd %0, %2 \n"
6076 +#else
6077 + " daddu %0, %2 \n"
6078 +#endif
6079 + " scd %0, %1 \n"
6080 + " beqzl %0, 1b \n"
6081 +#ifdef CONFIG_PAX_REFCOUNT
6082 + "3: \n"
6083 + _ASM_EXTABLE(2b, 3b)
6084 +#endif
6085 + " .set mips0 \n"
6086 + : "=&r" (temp), "+m" (v->counter)
6087 + : "Ir" (i));
6088 + } else if (kernel_uses_llsc) {
6089 + __asm__ __volatile__(
6090 + " .set mips3 \n"
6091 + "1: lld %0, %1 # atomic64_add \n"
6092 +#ifdef CONFIG_PAX_REFCOUNT
6093 + /* Exception on overflow. */
6094 + "2: dadd %0, %2 \n"
6095 +#else
6096 + " daddu %0, %2 \n"
6097 +#endif
6098 + " scd %0, %1 \n"
6099 + " beqz %0, 1b \n"
6100 +#ifdef CONFIG_PAX_REFCOUNT
6101 + "3: \n"
6102 + _ASM_EXTABLE(2b, 3b)
6103 +#endif
6104 + " .set mips0 \n"
6105 + : "=&r" (temp), "+m" (v->counter)
6106 + : "Ir" (i));
6107 + } else {
6108 + unsigned long flags;
6109 +
6110 + raw_local_irq_save(flags);
6111 + __asm__ __volatile__(
6112 +#ifdef CONFIG_PAX_REFCOUNT
6113 + /* Exception on overflow. */
6114 + "1: dadd %0, %1 \n"
6115 + "2: \n"
6116 + _ASM_EXTABLE(1b, 2b)
6117 +#else
6118 + " daddu %0, %1 \n"
6119 +#endif
6120 + : "+r" (v->counter) : "Ir" (i));
6121 + raw_local_irq_restore(flags);
6122 + }
6123 +}
6124 +static __inline__ void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
6125 {
6126 if (kernel_uses_llsc && R10000_LLSC_WAR) {
6127 long temp;
6128 @@ -457,7 +890,67 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
6129 *
6130 * Atomically subtracts @i from @v.
6131 */
6132 -static __inline__ void atomic64_sub(long i, atomic64_t * v)
6133 +static __inline__ void atomic64_sub(long i, atomic64_t *v)
6134 +{
6135 + long temp;
6136 +
6137 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6138 + __asm__ __volatile__(
6139 + " .set mips3 \n"
6140 + "1: lld %0, %1 # atomic64_sub \n"
6141 +#ifdef CONFIG_PAX_REFCOUNT
6142 + /* Exception on overflow. */
6143 + "2: dsub %0, %2 \n"
6144 +#else
6145 + " dsubu %0, %2 \n"
6146 +#endif
6147 + " scd %0, %1 \n"
6148 + " beqzl %0, 1b \n"
6149 +#ifdef CONFIG_PAX_REFCOUNT
6150 + "3: \n"
6151 + _ASM_EXTABLE(2b, 3b)
6152 +#endif
6153 + " .set mips0 \n"
6154 + : "=&r" (temp), "+m" (v->counter)
6155 + : "Ir" (i));
6156 + } else if (kernel_uses_llsc) {
6157 + __asm__ __volatile__(
6158 + " .set mips3 \n"
6159 + "1: lld %0, %1 # atomic64_sub \n"
6160 +#ifdef CONFIG_PAX_REFCOUNT
6161 + /* Exception on overflow. */
6162 + "2: dsub %0, %2 \n"
6163 +#else
6164 + " dsubu %0, %2 \n"
6165 +#endif
6166 + " scd %0, %1 \n"
6167 + " beqz %0, 1b \n"
6168 +#ifdef CONFIG_PAX_REFCOUNT
6169 + "3: \n"
6170 + _ASM_EXTABLE(2b, 3b)
6171 +#endif
6172 + " .set mips0 \n"
6173 + : "=&r" (temp), "+m" (v->counter)
6174 + : "Ir" (i));
6175 + } else {
6176 + unsigned long flags;
6177 +
6178 + raw_local_irq_save(flags);
6179 + __asm__ __volatile__(
6180 +#ifdef CONFIG_PAX_REFCOUNT
6181 + /* Exception on overflow. */
6182 + "1: dsub %0, %1 \n"
6183 + "2: \n"
6184 + _ASM_EXTABLE(1b, 2b)
6185 +#else
6186 + " dsubu %0, %1 \n"
6187 +#endif
6188 + : "+r" (v->counter) : "Ir" (i));
6189 + raw_local_irq_restore(flags);
6190 + }
6191 +}
6192 +
6193 +static __inline__ void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
6194 {
6195 if (kernel_uses_llsc && R10000_LLSC_WAR) {
6196 long temp;
6197 @@ -496,7 +989,93 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
6198 /*
6199 * Same as above, but return the result value
6200 */
6201 -static __inline__ long atomic64_add_return(long i, atomic64_t * v)
6202 +static __inline__ long atomic64_add_return(long i, atomic64_t *v)
6203 +{
6204 + long result;
6205 + long temp;
6206 +
6207 + smp_mb__before_llsc();
6208 +
6209 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6210 + __asm__ __volatile__(
6211 + " .set mips3 \n"
6212 + "1: lld %1, %2 # atomic64_add_return \n"
6213 +#ifdef CONFIG_PAX_REFCOUNT
6214 + "2: dadd %0, %1, %3 \n"
6215 +#else
6216 + " daddu %0, %1, %3 \n"
6217 +#endif
6218 + " scd %0, %2 \n"
6219 + " beqzl %0, 1b \n"
6220 +#ifdef CONFIG_PAX_REFCOUNT
6221 + " b 4f \n"
6222 + " .set noreorder \n"
6223 + "3: b 5f \n"
6224 + " move %0, %1 \n"
6225 + " .set reorder \n"
6226 + _ASM_EXTABLE(2b, 3b)
6227 +#endif
6228 + "4: daddu %0, %1, %3 \n"
6229 +#ifdef CONFIG_PAX_REFCOUNT
6230 + "5: \n"
6231 +#endif
6232 + " .set mips0 \n"
6233 + : "=&r" (result), "=&r" (temp), "+m" (v->counter)
6234 + : "Ir" (i));
6235 + } else if (kernel_uses_llsc) {
6236 + __asm__ __volatile__(
6237 + " .set mips3 \n"
6238 + "1: lld %1, %2 # atomic64_add_return \n"
6239 +#ifdef CONFIG_PAX_REFCOUNT
6240 + "2: dadd %0, %1, %3 \n"
6241 +#else
6242 + " daddu %0, %1, %3 \n"
6243 +#endif
6244 + " scd %0, %2 \n"
6245 + " bnez %0, 4f \n"
6246 + " b 1b \n"
6247 +#ifdef CONFIG_PAX_REFCOUNT
6248 + " .set noreorder \n"
6249 + "3: b 5f \n"
6250 + " move %0, %1 \n"
6251 + " .set reorder \n"
6252 + _ASM_EXTABLE(2b, 3b)
6253 +#endif
6254 + "4: daddu %0, %1, %3 \n"
6255 +#ifdef CONFIG_PAX_REFCOUNT
6256 + "5: \n"
6257 +#endif
6258 + " .set mips0 \n"
6259 + : "=&r" (result), "=&r" (temp), "=m" (v->counter)
6260 + : "Ir" (i), "m" (v->counter)
6261 + : "memory");
6262 + } else {
6263 + unsigned long flags;
6264 +
6265 + raw_local_irq_save(flags);
6266 + __asm__ __volatile__(
6267 + " ld %0, %1 \n"
6268 +#ifdef CONFIG_PAX_REFCOUNT
6269 + /* Exception on overflow. */
6270 + "1: dadd %0, %2 \n"
6271 +#else
6272 + " daddu %0, %2 \n"
6273 +#endif
6274 + " sd %0, %1 \n"
6275 +#ifdef CONFIG_PAX_REFCOUNT
6276 + /* Note: Dest reg is not modified on overflow */
6277 + "2: \n"
6278 + _ASM_EXTABLE(1b, 2b)
6279 +#endif
6280 + : "=&r" (result), "+m" (v->counter) : "Ir" (i));
6281 + raw_local_irq_restore(flags);
6282 + }
6283 +
6284 + smp_llsc_mb();
6285 +
6286 + return result;
6287 +}
6288 +static __inline__ long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
6289 {
6290 long result;
6291
6292 @@ -546,7 +1125,97 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
6293 return result;
6294 }
6295
6296 -static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
6297 +static __inline__ long atomic64_sub_return(long i, atomic64_t *v)
6298 +{
6299 + long result;
6300 + long temp;
6301 +
6302 + smp_mb__before_llsc();
6303 +
6304 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6305 + long temp;
6306 +
6307 + __asm__ __volatile__(
6308 + " .set mips3 \n"
6309 + "1: lld %1, %2 # atomic64_sub_return \n"
6310 +#ifdef CONFIG_PAX_REFCOUNT
6311 + "2: dsub %0, %1, %3 \n"
6312 +#else
6313 + " dsubu %0, %1, %3 \n"
6314 +#endif
6315 + " scd %0, %2 \n"
6316 + " beqzl %0, 1b \n"
6317 +#ifdef CONFIG_PAX_REFCOUNT
6318 + " b 4f \n"
6319 + " .set noreorder \n"
6320 + "3: b 5f \n"
6321 + " move %0, %1 \n"
6322 + " .set reorder \n"
6323 + _ASM_EXTABLE(2b, 3b)
6324 +#endif
6325 + "4: dsubu %0, %1, %3 \n"
6326 +#ifdef CONFIG_PAX_REFCOUNT
6327 + "5: \n"
6328 +#endif
6329 + " .set mips0 \n"
6330 + : "=&r" (result), "=&r" (temp), "=m" (v->counter)
6331 + : "Ir" (i), "m" (v->counter)
6332 + : "memory");
6333 + } else if (kernel_uses_llsc) {
6334 + __asm__ __volatile__(
6335 + " .set mips3 \n"
6336 + "1: lld %1, %2 # atomic64_sub_return \n"
6337 +#ifdef CONFIG_PAX_REFCOUNT
6338 + "2: dsub %0, %1, %3 \n"
6339 +#else
6340 + " dsubu %0, %1, %3 \n"
6341 +#endif
6342 + " scd %0, %2 \n"
6343 + " bnez %0, 4f \n"
6344 + " b 1b \n"
6345 +#ifdef CONFIG_PAX_REFCOUNT
6346 + " .set noreorder \n"
6347 + "3: b 5f \n"
6348 + " move %0, %1 \n"
6349 + " .set reorder \n"
6350 + _ASM_EXTABLE(2b, 3b)
6351 +#endif
6352 + "4: dsubu %0, %1, %3 \n"
6353 +#ifdef CONFIG_PAX_REFCOUNT
6354 + "5: \n"
6355 +#endif
6356 + " .set mips0 \n"
6357 + : "=&r" (result), "=&r" (temp), "=m" (v->counter)
6358 + : "Ir" (i), "m" (v->counter)
6359 + : "memory");
6360 + } else {
6361 + unsigned long flags;
6362 +
6363 + raw_local_irq_save(flags);
6364 + __asm__ __volatile__(
6365 + " ld %0, %1 \n"
6366 +#ifdef CONFIG_PAX_REFCOUNT
6367 + /* Exception on overflow. */
6368 + "1: dsub %0, %2 \n"
6369 +#else
6370 + " dsubu %0, %2 \n"
6371 +#endif
6372 + " sd %0, %1 \n"
6373 +#ifdef CONFIG_PAX_REFCOUNT
6374 + /* Note: Dest reg is not modified on overflow */
6375 + "2: \n"
6376 + _ASM_EXTABLE(1b, 2b)
6377 +#endif
6378 + : "=&r" (result), "+m" (v->counter) : "Ir" (i));
6379 + raw_local_irq_restore(flags);
6380 + }
6381 +
6382 + smp_llsc_mb();
6383 +
6384 + return result;
6385 +}
6386 +
6387 +static __inline__ long atomic64_sub_return_unchecked(long i, atomic64_unchecked_t *v)
6388 {
6389 long result;
6390
6391 @@ -605,7 +1274,7 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
6392 * Atomically test @v and subtract @i if @v is greater or equal than @i.
6393 * The function returns the old value of @v minus @i.
6394 */
6395 -static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
6396 +static __inline__ long atomic64_sub_if_positive(long i, atomic64_t *v)
6397 {
6398 long result;
6399
6400 @@ -662,9 +1331,26 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
6401 return result;
6402 }
6403
6404 -#define atomic64_cmpxchg(v, o, n) \
6405 - ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
6406 -#define atomic64_xchg(v, new) (xchg(&((v)->counter), (new)))
6407 +static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
6408 +{
6409 + return cmpxchg(&v->counter, old, new);
6410 +}
6411 +
6412 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old,
6413 + long new)
6414 +{
6415 + return cmpxchg(&(v->counter), old, new);
6416 +}
6417 +
6418 +static inline long atomic64_xchg(atomic64_t *v, long new)
6419 +{
6420 + return xchg(&v->counter, new);
6421 +}
6422 +
6423 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
6424 +{
6425 + return xchg(&(v->counter), new);
6426 +}
6427
6428 /**
6429 * atomic64_add_unless - add unless the number is a given value
6430 @@ -694,6 +1380,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6431
6432 #define atomic64_dec_return(v) atomic64_sub_return(1, (v))
6433 #define atomic64_inc_return(v) atomic64_add_return(1, (v))
6434 +#define atomic64_inc_return_unchecked(v) atomic64_add_return_unchecked(1, (v))
6435
6436 /*
6437 * atomic64_sub_and_test - subtract value from variable and test result
6438 @@ -715,6 +1402,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6439 * other cases.
6440 */
6441 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
6442 +#define atomic64_inc_and_test_unchecked(v) atomic64_add_return_unchecked(1, (v)) == 0)
6443
6444 /*
6445 * atomic64_dec_and_test - decrement by 1 and test
6446 @@ -739,6 +1427,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6447 * Atomically increments @v by 1.
6448 */
6449 #define atomic64_inc(v) atomic64_add(1, (v))
6450 +#define atomic64_inc_unchecked(v) atomic64_add_unchecked(1, (v))
6451
6452 /*
6453 * atomic64_dec - decrement and test
6454 @@ -747,6 +1436,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
6455 * Atomically decrements @v by 1.
6456 */
6457 #define atomic64_dec(v) atomic64_sub(1, (v))
6458 +#define atomic64_dec_unchecked(v) atomic64_sub_unchecked(1, (v))
6459
6460 /*
6461 * atomic64_add_negative - add and test if negative
6462 diff --git a/arch/mips/include/asm/cache.h b/arch/mips/include/asm/cache.h
6463 index b4db69f..8f3b093 100644
6464 --- a/arch/mips/include/asm/cache.h
6465 +++ b/arch/mips/include/asm/cache.h
6466 @@ -9,10 +9,11 @@
6467 #ifndef _ASM_CACHE_H
6468 #define _ASM_CACHE_H
6469
6470 +#include <linux/const.h>
6471 #include <kmalloc.h>
6472
6473 #define L1_CACHE_SHIFT CONFIG_MIPS_L1_CACHE_SHIFT
6474 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
6475 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
6476
6477 #define SMP_CACHE_SHIFT L1_CACHE_SHIFT
6478 #define SMP_CACHE_BYTES L1_CACHE_BYTES
6479 diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
6480 index d414405..6bb4ba2 100644
6481 --- a/arch/mips/include/asm/elf.h
6482 +++ b/arch/mips/include/asm/elf.h
6483 @@ -398,13 +398,16 @@ extern const char *__elf_platform;
6484 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
6485 #endif
6486
6487 +#ifdef CONFIG_PAX_ASLR
6488 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6489 +
6490 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6491 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6492 +#endif
6493 +
6494 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
6495 struct linux_binprm;
6496 extern int arch_setup_additional_pages(struct linux_binprm *bprm,
6497 int uses_interp);
6498
6499 -struct mm_struct;
6500 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
6501 -#define arch_randomize_brk arch_randomize_brk
6502 -
6503 #endif /* _ASM_ELF_H */
6504 diff --git a/arch/mips/include/asm/exec.h b/arch/mips/include/asm/exec.h
6505 index c1f6afa..38cc6e9 100644
6506 --- a/arch/mips/include/asm/exec.h
6507 +++ b/arch/mips/include/asm/exec.h
6508 @@ -12,6 +12,6 @@
6509 #ifndef _ASM_EXEC_H
6510 #define _ASM_EXEC_H
6511
6512 -extern unsigned long arch_align_stack(unsigned long sp);
6513 +#define arch_align_stack(x) ((x) & ~0xfUL)
6514
6515 #endif /* _ASM_EXEC_H */
6516 diff --git a/arch/mips/include/asm/hw_irq.h b/arch/mips/include/asm/hw_irq.h
6517 index 9e8ef59..1139d6b 100644
6518 --- a/arch/mips/include/asm/hw_irq.h
6519 +++ b/arch/mips/include/asm/hw_irq.h
6520 @@ -10,7 +10,7 @@
6521
6522 #include <linux/atomic.h>
6523
6524 -extern atomic_t irq_err_count;
6525 +extern atomic_unchecked_t irq_err_count;
6526
6527 /*
6528 * interrupt-retrigger: NOP for now. This may not be appropriate for all
6529 diff --git a/arch/mips/include/asm/local.h b/arch/mips/include/asm/local.h
6530 index d44622c..64990d2 100644
6531 --- a/arch/mips/include/asm/local.h
6532 +++ b/arch/mips/include/asm/local.h
6533 @@ -12,15 +12,25 @@ typedef struct
6534 atomic_long_t a;
6535 } local_t;
6536
6537 +typedef struct {
6538 + atomic_long_unchecked_t a;
6539 +} local_unchecked_t;
6540 +
6541 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
6542
6543 #define local_read(l) atomic_long_read(&(l)->a)
6544 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
6545 #define local_set(l, i) atomic_long_set(&(l)->a, (i))
6546 +#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
6547
6548 #define local_add(i, l) atomic_long_add((i), (&(l)->a))
6549 +#define local_add_unchecked(i, l) atomic_long_add_unchecked((i), (&(l)->a))
6550 #define local_sub(i, l) atomic_long_sub((i), (&(l)->a))
6551 +#define local_sub_unchecked(i, l) atomic_long_sub_unchecked((i), (&(l)->a))
6552 #define local_inc(l) atomic_long_inc(&(l)->a)
6553 +#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
6554 #define local_dec(l) atomic_long_dec(&(l)->a)
6555 +#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
6556
6557 /*
6558 * Same as above, but return the result value
6559 @@ -70,6 +80,51 @@ static __inline__ long local_add_return(long i, local_t * l)
6560 return result;
6561 }
6562
6563 +static __inline__ long local_add_return_unchecked(long i, local_unchecked_t * l)
6564 +{
6565 + unsigned long result;
6566 +
6567 + if (kernel_uses_llsc && R10000_LLSC_WAR) {
6568 + unsigned long temp;
6569 +
6570 + __asm__ __volatile__(
6571 + " .set mips3 \n"
6572 + "1:" __LL "%1, %2 # local_add_return \n"
6573 + " addu %0, %1, %3 \n"
6574 + __SC "%0, %2 \n"
6575 + " beqzl %0, 1b \n"
6576 + " addu %0, %1, %3 \n"
6577 + " .set mips0 \n"
6578 + : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
6579 + : "Ir" (i), "m" (l->a.counter)
6580 + : "memory");
6581 + } else if (kernel_uses_llsc) {
6582 + unsigned long temp;
6583 +
6584 + __asm__ __volatile__(
6585 + " .set mips3 \n"
6586 + "1:" __LL "%1, %2 # local_add_return \n"
6587 + " addu %0, %1, %3 \n"
6588 + __SC "%0, %2 \n"
6589 + " beqz %0, 1b \n"
6590 + " addu %0, %1, %3 \n"
6591 + " .set mips0 \n"
6592 + : "=&r" (result), "=&r" (temp), "=m" (l->a.counter)
6593 + : "Ir" (i), "m" (l->a.counter)
6594 + : "memory");
6595 + } else {
6596 + unsigned long flags;
6597 +
6598 + local_irq_save(flags);
6599 + result = l->a.counter;
6600 + result += i;
6601 + l->a.counter = result;
6602 + local_irq_restore(flags);
6603 + }
6604 +
6605 + return result;
6606 +}
6607 +
6608 static __inline__ long local_sub_return(long i, local_t * l)
6609 {
6610 unsigned long result;
6611 @@ -117,6 +172,8 @@ static __inline__ long local_sub_return(long i, local_t * l)
6612
6613 #define local_cmpxchg(l, o, n) \
6614 ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
6615 +#define local_cmpxchg_unchecked(l, o, n) \
6616 + ((long)cmpxchg_local(&((l)->a.counter), (o), (n)))
6617 #define local_xchg(l, n) (atomic_long_xchg((&(l)->a), (n)))
6618
6619 /**
6620 diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
6621 index 5e08bcc..cfedefc 100644
6622 --- a/arch/mips/include/asm/page.h
6623 +++ b/arch/mips/include/asm/page.h
6624 @@ -120,7 +120,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
6625 #ifdef CONFIG_CPU_MIPS32
6626 typedef struct { unsigned long pte_low, pte_high; } pte_t;
6627 #define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
6628 - #define __pte(x) ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
6629 + #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
6630 #else
6631 typedef struct { unsigned long long pte; } pte_t;
6632 #define pte_val(x) ((x).pte)
6633 diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
6634 index b336037..5b874cc 100644
6635 --- a/arch/mips/include/asm/pgalloc.h
6636 +++ b/arch/mips/include/asm/pgalloc.h
6637 @@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
6638 {
6639 set_pud(pud, __pud((unsigned long)pmd));
6640 }
6641 +
6642 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
6643 +{
6644 + pud_populate(mm, pud, pmd);
6645 +}
6646 #endif
6647
6648 /*
6649 diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
6650 index 008324d..f67c239 100644
6651 --- a/arch/mips/include/asm/pgtable.h
6652 +++ b/arch/mips/include/asm/pgtable.h
6653 @@ -20,6 +20,9 @@
6654 #include <asm/io.h>
6655 #include <asm/pgtable-bits.h>
6656
6657 +#define ktla_ktva(addr) (addr)
6658 +#define ktva_ktla(addr) (addr)
6659 +
6660 struct mm_struct;
6661 struct vm_area_struct;
6662
6663 diff --git a/arch/mips/include/asm/smtc_proc.h b/arch/mips/include/asm/smtc_proc.h
6664 index 25da651..ae2a259 100644
6665 --- a/arch/mips/include/asm/smtc_proc.h
6666 +++ b/arch/mips/include/asm/smtc_proc.h
6667 @@ -18,6 +18,6 @@ extern struct smtc_cpu_proc smtc_cpu_stats[NR_CPUS];
6668
6669 /* Count of number of recoveries of "stolen" FPU access rights on 34K */
6670
6671 -extern atomic_t smtc_fpu_recoveries;
6672 +extern atomic_unchecked_t smtc_fpu_recoveries;
6673
6674 #endif /* __ASM_SMTC_PROC_H */
6675 diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
6676 index 24846f9..61c49f0 100644
6677 --- a/arch/mips/include/asm/thread_info.h
6678 +++ b/arch/mips/include/asm/thread_info.h
6679 @@ -116,6 +116,8 @@ static inline struct thread_info *current_thread_info(void)
6680 #define TIF_LOAD_WATCH 25 /* If set, load watch registers */
6681 #define TIF_SYSCALL_TRACEPOINT 26 /* syscall tracepoint instrumentation */
6682 #define TIF_32BIT_FPREGS 27 /* 32-bit floating point registers */
6683 +/* li takes a 32bit immediate */
6684 +#define TIF_GRSEC_SETXID 29 /* update credentials on syscall entry/exit */
6685 #define TIF_SYSCALL_TRACE 31 /* syscall trace active */
6686
6687 #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
6688 @@ -134,13 +136,14 @@ static inline struct thread_info *current_thread_info(void)
6689 #define _TIF_LOAD_WATCH (1<<TIF_LOAD_WATCH)
6690 #define _TIF_32BIT_FPREGS (1<<TIF_32BIT_FPREGS)
6691 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
6692 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
6693
6694 #define _TIF_WORK_SYSCALL_ENTRY (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \
6695 - _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT)
6696 + _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
6697
6698 /* work to do in syscall_trace_leave() */
6699 #define _TIF_WORK_SYSCALL_EXIT (_TIF_NOHZ | _TIF_SYSCALL_TRACE | \
6700 - _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT)
6701 + _TIF_SYSCALL_AUDIT | _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
6702
6703 /* work to do on interrupt/exception return */
6704 #define _TIF_WORK_MASK \
6705 @@ -148,7 +151,7 @@ static inline struct thread_info *current_thread_info(void)
6706 /* work to do on any return to u-space */
6707 #define _TIF_ALLWORK_MASK (_TIF_NOHZ | _TIF_WORK_MASK | \
6708 _TIF_WORK_SYSCALL_EXIT | \
6709 - _TIF_SYSCALL_TRACEPOINT)
6710 + _TIF_SYSCALL_TRACEPOINT | _TIF_GRSEC_SETXID)
6711
6712 /*
6713 * We stash processor id into a COP0 register to retrieve it fast
6714 diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
6715 index f3fa375..3af6637 100644
6716 --- a/arch/mips/include/asm/uaccess.h
6717 +++ b/arch/mips/include/asm/uaccess.h
6718 @@ -128,6 +128,7 @@ extern u64 __ua_limit;
6719 __ok == 0; \
6720 })
6721
6722 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
6723 #define access_ok(type, addr, size) \
6724 likely(__access_ok((addr), (size), __access_mask))
6725
6726 diff --git a/arch/mips/kernel/binfmt_elfn32.c b/arch/mips/kernel/binfmt_elfn32.c
6727 index 1188e00..41cf144 100644
6728 --- a/arch/mips/kernel/binfmt_elfn32.c
6729 +++ b/arch/mips/kernel/binfmt_elfn32.c
6730 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
6731 #undef ELF_ET_DYN_BASE
6732 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
6733
6734 +#ifdef CONFIG_PAX_ASLR
6735 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6736 +
6737 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6738 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6739 +#endif
6740 +
6741 #include <asm/processor.h>
6742 #include <linux/module.h>
6743 #include <linux/elfcore.h>
6744 diff --git a/arch/mips/kernel/binfmt_elfo32.c b/arch/mips/kernel/binfmt_elfo32.c
6745 index 7faf5f2..f3d3cf4 100644
6746 --- a/arch/mips/kernel/binfmt_elfo32.c
6747 +++ b/arch/mips/kernel/binfmt_elfo32.c
6748 @@ -70,6 +70,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_NFPREG];
6749 #undef ELF_ET_DYN_BASE
6750 #define ELF_ET_DYN_BASE (TASK32_SIZE / 3 * 2)
6751
6752 +#ifdef CONFIG_PAX_ASLR
6753 +#define PAX_ELF_ET_DYN_BASE (TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
6754 +
6755 +#define PAX_DELTA_MMAP_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6756 +#define PAX_DELTA_STACK_LEN (TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
6757 +#endif
6758 +
6759 #include <asm/processor.h>
6760
6761 /*
6762 diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
6763 index 2b91fe8..fe4f6b4 100644
6764 --- a/arch/mips/kernel/i8259.c
6765 +++ b/arch/mips/kernel/i8259.c
6766 @@ -205,7 +205,7 @@ spurious_8259A_irq:
6767 printk(KERN_DEBUG "spurious 8259A interrupt: IRQ%d.\n", irq);
6768 spurious_irq_mask |= irqmask;
6769 }
6770 - atomic_inc(&irq_err_count);
6771 + atomic_inc_unchecked(&irq_err_count);
6772 /*
6773 * Theoretically we do not have to handle this IRQ,
6774 * but in Linux this does not cause problems and is
6775 diff --git a/arch/mips/kernel/irq-gt641xx.c b/arch/mips/kernel/irq-gt641xx.c
6776 index 44a1f79..2bd6aa3 100644
6777 --- a/arch/mips/kernel/irq-gt641xx.c
6778 +++ b/arch/mips/kernel/irq-gt641xx.c
6779 @@ -110,7 +110,7 @@ void gt641xx_irq_dispatch(void)
6780 }
6781 }
6782
6783 - atomic_inc(&irq_err_count);
6784 + atomic_inc_unchecked(&irq_err_count);
6785 }
6786
6787 void __init gt641xx_irq_init(void)
6788 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
6789 index d1fea7a..2e591b0 100644
6790 --- a/arch/mips/kernel/irq.c
6791 +++ b/arch/mips/kernel/irq.c
6792 @@ -77,17 +77,17 @@ void ack_bad_irq(unsigned int irq)
6793 printk("unexpected IRQ # %d\n", irq);
6794 }
6795
6796 -atomic_t irq_err_count;
6797 +atomic_unchecked_t irq_err_count;
6798
6799 int arch_show_interrupts(struct seq_file *p, int prec)
6800 {
6801 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
6802 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
6803 return 0;
6804 }
6805
6806 asmlinkage void spurious_interrupt(void)
6807 {
6808 - atomic_inc(&irq_err_count);
6809 + atomic_inc_unchecked(&irq_err_count);
6810 }
6811
6812 void __init init_IRQ(void)
6813 @@ -110,7 +110,10 @@ void __init init_IRQ(void)
6814 #endif
6815 }
6816
6817 +
6818 #ifdef DEBUG_STACKOVERFLOW
6819 +extern void gr_handle_kernel_exploit(void);
6820 +
6821 static inline void check_stack_overflow(void)
6822 {
6823 unsigned long sp;
6824 @@ -126,6 +129,7 @@ static inline void check_stack_overflow(void)
6825 printk("do_IRQ: stack overflow: %ld\n",
6826 sp - sizeof(struct thread_info));
6827 dump_stack();
6828 + gr_handle_kernel_exploit();
6829 }
6830 }
6831 #else
6832 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
6833 index 6ae540e..b7396dc 100644
6834 --- a/arch/mips/kernel/process.c
6835 +++ b/arch/mips/kernel/process.c
6836 @@ -562,15 +562,3 @@ unsigned long get_wchan(struct task_struct *task)
6837 out:
6838 return pc;
6839 }
6840 -
6841 -/*
6842 - * Don't forget that the stack pointer must be aligned on a 8 bytes
6843 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
6844 - */
6845 -unsigned long arch_align_stack(unsigned long sp)
6846 -{
6847 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
6848 - sp -= get_random_int() & ~PAGE_MASK;
6849 -
6850 - return sp & ALMASK;
6851 -}
6852 diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
6853 index 7da9b76..21578be 100644
6854 --- a/arch/mips/kernel/ptrace.c
6855 +++ b/arch/mips/kernel/ptrace.c
6856 @@ -658,6 +658,10 @@ long arch_ptrace(struct task_struct *child, long request,
6857 return ret;
6858 }
6859
6860 +#ifdef CONFIG_GRKERNSEC_SETXID
6861 +extern void gr_delayed_cred_worker(void);
6862 +#endif
6863 +
6864 /*
6865 * Notification of system call entry/exit
6866 * - triggered by current->work.syscall_trace
6867 @@ -674,6 +678,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
6868 tracehook_report_syscall_entry(regs))
6869 ret = -1;
6870
6871 +#ifdef CONFIG_GRKERNSEC_SETXID
6872 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
6873 + gr_delayed_cred_worker();
6874 +#endif
6875 +
6876 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
6877 trace_sys_enter(regs, regs->regs[2]);
6878
6879 diff --git a/arch/mips/kernel/reset.c b/arch/mips/kernel/reset.c
6880 index 07fc524..b9d7f28 100644
6881 --- a/arch/mips/kernel/reset.c
6882 +++ b/arch/mips/kernel/reset.c
6883 @@ -13,6 +13,7 @@
6884 #include <linux/reboot.h>
6885
6886 #include <asm/reboot.h>
6887 +#include <asm/bug.h>
6888
6889 /*
6890 * Urgs ... Too many MIPS machines to handle this in a generic way.
6891 @@ -29,16 +30,19 @@ void machine_restart(char *command)
6892 {
6893 if (_machine_restart)
6894 _machine_restart(command);
6895 + BUG();
6896 }
6897
6898 void machine_halt(void)
6899 {
6900 if (_machine_halt)
6901 _machine_halt();
6902 + BUG();
6903 }
6904
6905 void machine_power_off(void)
6906 {
6907 if (pm_power_off)
6908 pm_power_off();
6909 + BUG();
6910 }
6911 diff --git a/arch/mips/kernel/smtc-proc.c b/arch/mips/kernel/smtc-proc.c
6912 index c10aa84..9ec2e60 100644
6913 --- a/arch/mips/kernel/smtc-proc.c
6914 +++ b/arch/mips/kernel/smtc-proc.c
6915 @@ -31,7 +31,7 @@ unsigned long selfipis[NR_CPUS];
6916
6917 struct smtc_cpu_proc smtc_cpu_stats[NR_CPUS];
6918
6919 -atomic_t smtc_fpu_recoveries;
6920 +atomic_unchecked_t smtc_fpu_recoveries;
6921
6922 static int smtc_proc_show(struct seq_file *m, void *v)
6923 {
6924 @@ -48,7 +48,7 @@ static int smtc_proc_show(struct seq_file *m, void *v)
6925 for(i = 0; i < NR_CPUS; i++)
6926 seq_printf(m, "%d: %ld\n", i, smtc_cpu_stats[i].selfipis);
6927 seq_printf(m, "%d Recoveries of \"stolen\" FPU\n",
6928 - atomic_read(&smtc_fpu_recoveries));
6929 + atomic_read_unchecked(&smtc_fpu_recoveries));
6930 return 0;
6931 }
6932
6933 @@ -73,7 +73,7 @@ void init_smtc_stats(void)
6934 smtc_cpu_stats[i].selfipis = 0;
6935 }
6936
6937 - atomic_set(&smtc_fpu_recoveries, 0);
6938 + atomic_set_unchecked(&smtc_fpu_recoveries, 0);
6939
6940 proc_create("smtc", 0444, NULL, &smtc_proc_fops);
6941 }
6942 diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
6943 index dfc1b91..11a2c07 100644
6944 --- a/arch/mips/kernel/smtc.c
6945 +++ b/arch/mips/kernel/smtc.c
6946 @@ -1359,7 +1359,7 @@ void smtc_soft_dump(void)
6947 }
6948 smtc_ipi_qdump();
6949 printk("%d Recoveries of \"stolen\" FPU\n",
6950 - atomic_read(&smtc_fpu_recoveries));
6951 + atomic_read_unchecked(&smtc_fpu_recoveries));
6952 }
6953
6954
6955 diff --git a/arch/mips/kernel/sync-r4k.c b/arch/mips/kernel/sync-r4k.c
6956 index c24ad5f..9983ab2 100644
6957 --- a/arch/mips/kernel/sync-r4k.c
6958 +++ b/arch/mips/kernel/sync-r4k.c
6959 @@ -20,8 +20,8 @@
6960 #include <asm/mipsregs.h>
6961
6962 static atomic_t count_start_flag = ATOMIC_INIT(0);
6963 -static atomic_t count_count_start = ATOMIC_INIT(0);
6964 -static atomic_t count_count_stop = ATOMIC_INIT(0);
6965 +static atomic_unchecked_t count_count_start = ATOMIC_INIT(0);
6966 +static atomic_unchecked_t count_count_stop = ATOMIC_INIT(0);
6967 static atomic_t count_reference = ATOMIC_INIT(0);
6968
6969 #define COUNTON 100
6970 @@ -68,13 +68,13 @@ void synchronise_count_master(int cpu)
6971
6972 for (i = 0; i < NR_LOOPS; i++) {
6973 /* slaves loop on '!= 2' */
6974 - while (atomic_read(&count_count_start) != 1)
6975 + while (atomic_read_unchecked(&count_count_start) != 1)
6976 mb();
6977 - atomic_set(&count_count_stop, 0);
6978 + atomic_set_unchecked(&count_count_stop, 0);
6979 smp_wmb();
6980
6981 /* this lets the slaves write their count register */
6982 - atomic_inc(&count_count_start);
6983 + atomic_inc_unchecked(&count_count_start);
6984
6985 /*
6986 * Everyone initialises count in the last loop:
6987 @@ -85,11 +85,11 @@ void synchronise_count_master(int cpu)
6988 /*
6989 * Wait for all slaves to leave the synchronization point:
6990 */
6991 - while (atomic_read(&count_count_stop) != 1)
6992 + while (atomic_read_unchecked(&count_count_stop) != 1)
6993 mb();
6994 - atomic_set(&count_count_start, 0);
6995 + atomic_set_unchecked(&count_count_start, 0);
6996 smp_wmb();
6997 - atomic_inc(&count_count_stop);
6998 + atomic_inc_unchecked(&count_count_stop);
6999 }
7000 /* Arrange for an interrupt in a short while */
7001 write_c0_compare(read_c0_count() + COUNTON);
7002 @@ -130,8 +130,8 @@ void synchronise_count_slave(int cpu)
7003 initcount = atomic_read(&count_reference);
7004
7005 for (i = 0; i < NR_LOOPS; i++) {
7006 - atomic_inc(&count_count_start);
7007 - while (atomic_read(&count_count_start) != 2)
7008 + atomic_inc_unchecked(&count_count_start);
7009 + while (atomic_read_unchecked(&count_count_start) != 2)
7010 mb();
7011
7012 /*
7013 @@ -140,8 +140,8 @@ void synchronise_count_slave(int cpu)
7014 if (i == NR_LOOPS-1)
7015 write_c0_count(initcount);
7016
7017 - atomic_inc(&count_count_stop);
7018 - while (atomic_read(&count_count_stop) != 2)
7019 + atomic_inc_unchecked(&count_count_stop);
7020 + while (atomic_read_unchecked(&count_count_stop) != 2)
7021 mb();
7022 }
7023 /* Arrange for an interrupt in a short while */
7024 diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
7025 index e0b4996..6b43ce7 100644
7026 --- a/arch/mips/kernel/traps.c
7027 +++ b/arch/mips/kernel/traps.c
7028 @@ -691,7 +691,18 @@ asmlinkage void do_ov(struct pt_regs *regs)
7029 siginfo_t info;
7030
7031 prev_state = exception_enter();
7032 - die_if_kernel("Integer overflow", regs);
7033 + if (unlikely(!user_mode(regs))) {
7034 +
7035 +#ifdef CONFIG_PAX_REFCOUNT
7036 + if (fixup_exception(regs)) {
7037 + pax_report_refcount_overflow(regs);
7038 + exception_exit(prev_state);
7039 + return;
7040 + }
7041 +#endif
7042 +
7043 + die("Integer overflow", regs);
7044 + }
7045
7046 info.si_code = FPE_INTOVF;
7047 info.si_signo = SIGFPE;
7048 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
7049 index becc42b..9e43d4b 100644
7050 --- a/arch/mips/mm/fault.c
7051 +++ b/arch/mips/mm/fault.c
7052 @@ -28,6 +28,23 @@
7053 #include <asm/highmem.h> /* For VMALLOC_END */
7054 #include <linux/kdebug.h>
7055
7056 +#ifdef CONFIG_PAX_PAGEEXEC
7057 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
7058 +{
7059 + unsigned long i;
7060 +
7061 + printk(KERN_ERR "PAX: bytes at PC: ");
7062 + for (i = 0; i < 5; i++) {
7063 + unsigned int c;
7064 + if (get_user(c, (unsigned int *)pc+i))
7065 + printk(KERN_CONT "???????? ");
7066 + else
7067 + printk(KERN_CONT "%08x ", c);
7068 + }
7069 + printk("\n");
7070 +}
7071 +#endif
7072 +
7073 /*
7074 * This routine handles page faults. It determines the address,
7075 * and the problem, and then passes it off to one of the appropriate
7076 @@ -199,6 +216,14 @@ bad_area:
7077 bad_area_nosemaphore:
7078 /* User mode accesses just cause a SIGSEGV */
7079 if (user_mode(regs)) {
7080 +
7081 +#ifdef CONFIG_PAX_PAGEEXEC
7082 + if (cpu_has_rixi && (mm->pax_flags & MF_PAX_PAGEEXEC) && !write && address == instruction_pointer(regs)) {
7083 + pax_report_fault(regs, (void *)address, (void *)user_stack_pointer(regs));
7084 + do_group_exit(SIGKILL);
7085 + }
7086 +#endif
7087 +
7088 tsk->thread.cp0_badvaddr = address;
7089 tsk->thread.error_code = write;
7090 #if 0
7091 diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
7092 index f1baadd..5472dca 100644
7093 --- a/arch/mips/mm/mmap.c
7094 +++ b/arch/mips/mm/mmap.c
7095 @@ -59,6 +59,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7096 struct vm_area_struct *vma;
7097 unsigned long addr = addr0;
7098 int do_color_align;
7099 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
7100 struct vm_unmapped_area_info info;
7101
7102 if (unlikely(len > TASK_SIZE))
7103 @@ -84,6 +85,11 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7104 do_color_align = 1;
7105
7106 /* requesting a specific address */
7107 +
7108 +#ifdef CONFIG_PAX_RANDMMAP
7109 + if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
7110 +#endif
7111 +
7112 if (addr) {
7113 if (do_color_align)
7114 addr = COLOUR_ALIGN(addr, pgoff);
7115 @@ -91,14 +97,14 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp,
7116 addr = PAGE_ALIGN(addr);
7117
7118 vma = find_vma(mm, addr);
7119 - if (TASK_SIZE - len >= addr &&
7120 - (!vma || addr + len <= vma->vm_start))
7121 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
7122 return addr;
7123 }
7124
7125 info.length = len;
7126 info.align_mask = do_color_align ? (PAGE_MASK & shm_align_mask) : 0;
7127 info.align_offset = pgoff << PAGE_SHIFT;
7128 + info.threadstack_offset = offset;
7129
7130 if (dir == DOWN) {
7131 info.flags = VM_UNMAPPED_AREA_TOPDOWN;
7132 @@ -146,6 +152,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
7133 {
7134 unsigned long random_factor = 0UL;
7135
7136 +#ifdef CONFIG_PAX_RANDMMAP
7137 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7138 +#endif
7139 +
7140 if (current->flags & PF_RANDOMIZE) {
7141 random_factor = get_random_int();
7142 random_factor = random_factor << PAGE_SHIFT;
7143 @@ -157,40 +167,25 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
7144
7145 if (mmap_is_legacy()) {
7146 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
7147 +
7148 +#ifdef CONFIG_PAX_RANDMMAP
7149 + if (mm->pax_flags & MF_PAX_RANDMMAP)
7150 + mm->mmap_base += mm->delta_mmap;
7151 +#endif
7152 +
7153 mm->get_unmapped_area = arch_get_unmapped_area;
7154 } else {
7155 mm->mmap_base = mmap_base(random_factor);
7156 +
7157 +#ifdef CONFIG_PAX_RANDMMAP
7158 + if (mm->pax_flags & MF_PAX_RANDMMAP)
7159 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7160 +#endif
7161 +
7162 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
7163 }
7164 }
7165
7166 -static inline unsigned long brk_rnd(void)
7167 -{
7168 - unsigned long rnd = get_random_int();
7169 -
7170 - rnd = rnd << PAGE_SHIFT;
7171 - /* 8MB for 32bit, 256MB for 64bit */
7172 - if (TASK_IS_32BIT_ADDR)
7173 - rnd = rnd & 0x7ffffful;
7174 - else
7175 - rnd = rnd & 0xffffffful;
7176 -
7177 - return rnd;
7178 -}
7179 -
7180 -unsigned long arch_randomize_brk(struct mm_struct *mm)
7181 -{
7182 - unsigned long base = mm->brk;
7183 - unsigned long ret;
7184 -
7185 - ret = PAGE_ALIGN(base + brk_rnd());
7186 -
7187 - if (ret < mm->brk)
7188 - return mm->brk;
7189 -
7190 - return ret;
7191 -}
7192 -
7193 int __virt_addr_valid(const volatile void *kaddr)
7194 {
7195 return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
7196 diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
7197 index 59cccd9..f39ac2f 100644
7198 --- a/arch/mips/pci/pci-octeon.c
7199 +++ b/arch/mips/pci/pci-octeon.c
7200 @@ -327,8 +327,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
7201
7202
7203 static struct pci_ops octeon_pci_ops = {
7204 - octeon_read_config,
7205 - octeon_write_config,
7206 + .read = octeon_read_config,
7207 + .write = octeon_write_config,
7208 };
7209
7210 static struct resource octeon_pci_mem_resource = {
7211 diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
7212 index 5e36c33..eb4a17b 100644
7213 --- a/arch/mips/pci/pcie-octeon.c
7214 +++ b/arch/mips/pci/pcie-octeon.c
7215 @@ -1792,8 +1792,8 @@ static int octeon_dummy_write_config(struct pci_bus *bus, unsigned int devfn,
7216 }
7217
7218 static struct pci_ops octeon_pcie0_ops = {
7219 - octeon_pcie0_read_config,
7220 - octeon_pcie0_write_config,
7221 + .read = octeon_pcie0_read_config,
7222 + .write = octeon_pcie0_write_config,
7223 };
7224
7225 static struct resource octeon_pcie0_mem_resource = {
7226 @@ -1813,8 +1813,8 @@ static struct pci_controller octeon_pcie0_controller = {
7227 };
7228
7229 static struct pci_ops octeon_pcie1_ops = {
7230 - octeon_pcie1_read_config,
7231 - octeon_pcie1_write_config,
7232 + .read = octeon_pcie1_read_config,
7233 + .write = octeon_pcie1_write_config,
7234 };
7235
7236 static struct resource octeon_pcie1_mem_resource = {
7237 @@ -1834,8 +1834,8 @@ static struct pci_controller octeon_pcie1_controller = {
7238 };
7239
7240 static struct pci_ops octeon_dummy_ops = {
7241 - octeon_dummy_read_config,
7242 - octeon_dummy_write_config,
7243 + .read = octeon_dummy_read_config,
7244 + .write = octeon_dummy_write_config,
7245 };
7246
7247 static struct resource octeon_dummy_mem_resource = {
7248 diff --git a/arch/mips/sgi-ip27/ip27-nmi.c b/arch/mips/sgi-ip27/ip27-nmi.c
7249 index a2358b4..7cead4f 100644
7250 --- a/arch/mips/sgi-ip27/ip27-nmi.c
7251 +++ b/arch/mips/sgi-ip27/ip27-nmi.c
7252 @@ -187,9 +187,9 @@ void
7253 cont_nmi_dump(void)
7254 {
7255 #ifndef REAL_NMI_SIGNAL
7256 - static atomic_t nmied_cpus = ATOMIC_INIT(0);
7257 + static atomic_unchecked_t nmied_cpus = ATOMIC_INIT(0);
7258
7259 - atomic_inc(&nmied_cpus);
7260 + atomic_inc_unchecked(&nmied_cpus);
7261 #endif
7262 /*
7263 * Only allow 1 cpu to proceed
7264 @@ -233,7 +233,7 @@ cont_nmi_dump(void)
7265 udelay(10000);
7266 }
7267 #else
7268 - while (atomic_read(&nmied_cpus) != num_online_cpus());
7269 + while (atomic_read_unchecked(&nmied_cpus) != num_online_cpus());
7270 #endif
7271
7272 /*
7273 diff --git a/arch/mips/sni/rm200.c b/arch/mips/sni/rm200.c
7274 index a046b30..6799527 100644
7275 --- a/arch/mips/sni/rm200.c
7276 +++ b/arch/mips/sni/rm200.c
7277 @@ -270,7 +270,7 @@ spurious_8259A_irq:
7278 "spurious RM200 8259A interrupt: IRQ%d.\n", irq);
7279 spurious_irq_mask |= irqmask;
7280 }
7281 - atomic_inc(&irq_err_count);
7282 + atomic_inc_unchecked(&irq_err_count);
7283 /*
7284 * Theoretically we do not have to handle this IRQ,
7285 * but in Linux this does not cause problems and is
7286 diff --git a/arch/mips/vr41xx/common/icu.c b/arch/mips/vr41xx/common/icu.c
7287 index 41e873b..34d33a7 100644
7288 --- a/arch/mips/vr41xx/common/icu.c
7289 +++ b/arch/mips/vr41xx/common/icu.c
7290 @@ -653,7 +653,7 @@ static int icu_get_irq(unsigned int irq)
7291
7292 printk(KERN_ERR "spurious ICU interrupt: %04x,%04x\n", pend1, pend2);
7293
7294 - atomic_inc(&irq_err_count);
7295 + atomic_inc_unchecked(&irq_err_count);
7296
7297 return -1;
7298 }
7299 diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
7300 index ae0e4ee..e8f0692 100644
7301 --- a/arch/mips/vr41xx/common/irq.c
7302 +++ b/arch/mips/vr41xx/common/irq.c
7303 @@ -64,7 +64,7 @@ static void irq_dispatch(unsigned int irq)
7304 irq_cascade_t *cascade;
7305
7306 if (irq >= NR_IRQS) {
7307 - atomic_inc(&irq_err_count);
7308 + atomic_inc_unchecked(&irq_err_count);
7309 return;
7310 }
7311
7312 @@ -84,7 +84,7 @@ static void irq_dispatch(unsigned int irq)
7313 ret = cascade->get_irq(irq);
7314 irq = ret;
7315 if (ret < 0)
7316 - atomic_inc(&irq_err_count);
7317 + atomic_inc_unchecked(&irq_err_count);
7318 else
7319 irq_dispatch(irq);
7320 if (!irqd_irq_disabled(idata) && chip->irq_unmask)
7321 diff --git a/arch/mn10300/proc-mn103e010/include/proc/cache.h b/arch/mn10300/proc-mn103e010/include/proc/cache.h
7322 index 967d144..db12197 100644
7323 --- a/arch/mn10300/proc-mn103e010/include/proc/cache.h
7324 +++ b/arch/mn10300/proc-mn103e010/include/proc/cache.h
7325 @@ -11,12 +11,14 @@
7326 #ifndef _ASM_PROC_CACHE_H
7327 #define _ASM_PROC_CACHE_H
7328
7329 +#include <linux/const.h>
7330 +
7331 /* L1 cache */
7332
7333 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
7334 #define L1_CACHE_NENTRIES 256 /* number of entries in each way */
7335 -#define L1_CACHE_BYTES 16 /* bytes per entry */
7336 #define L1_CACHE_SHIFT 4 /* shift for bytes per entry */
7337 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
7338 #define L1_CACHE_WAYDISP 0x1000 /* displacement of one way from the next */
7339
7340 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
7341 diff --git a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7342 index bcb5df2..84fabd2 100644
7343 --- a/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7344 +++ b/arch/mn10300/proc-mn2ws0050/include/proc/cache.h
7345 @@ -16,13 +16,15 @@
7346 #ifndef _ASM_PROC_CACHE_H
7347 #define _ASM_PROC_CACHE_H
7348
7349 +#include <linux/const.h>
7350 +
7351 /*
7352 * L1 cache
7353 */
7354 #define L1_CACHE_NWAYS 4 /* number of ways in caches */
7355 #define L1_CACHE_NENTRIES 128 /* number of entries in each way */
7356 -#define L1_CACHE_BYTES 32 /* bytes per entry */
7357 #define L1_CACHE_SHIFT 5 /* shift for bytes per entry */
7358 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT) /* bytes per entry */
7359 #define L1_CACHE_WAYDISP 0x1000 /* distance from one way to the next */
7360
7361 #define L1_CACHE_TAG_VALID 0x00000001 /* cache tag valid bit */
7362 diff --git a/arch/openrisc/include/asm/cache.h b/arch/openrisc/include/asm/cache.h
7363 index 4ce7a01..449202a 100644
7364 --- a/arch/openrisc/include/asm/cache.h
7365 +++ b/arch/openrisc/include/asm/cache.h
7366 @@ -19,11 +19,13 @@
7367 #ifndef __ASM_OPENRISC_CACHE_H
7368 #define __ASM_OPENRISC_CACHE_H
7369
7370 +#include <linux/const.h>
7371 +
7372 /* FIXME: How can we replace these with values from the CPU...
7373 * they shouldn't be hard-coded!
7374 */
7375
7376 -#define L1_CACHE_BYTES 16
7377 #define L1_CACHE_SHIFT 4
7378 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7379
7380 #endif /* __ASM_OPENRISC_CACHE_H */
7381 diff --git a/arch/parisc/include/asm/atomic.h b/arch/parisc/include/asm/atomic.h
7382 index 472886c..00e7df9 100644
7383 --- a/arch/parisc/include/asm/atomic.h
7384 +++ b/arch/parisc/include/asm/atomic.h
7385 @@ -252,6 +252,16 @@ static inline long atomic64_dec_if_positive(atomic64_t *v)
7386 return dec;
7387 }
7388
7389 +#define atomic64_read_unchecked(v) atomic64_read(v)
7390 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
7391 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
7392 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
7393 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
7394 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
7395 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
7396 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
7397 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
7398 +
7399 #endif /* !CONFIG_64BIT */
7400
7401
7402 diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
7403 index 47f11c7..3420df2 100644
7404 --- a/arch/parisc/include/asm/cache.h
7405 +++ b/arch/parisc/include/asm/cache.h
7406 @@ -5,6 +5,7 @@
7407 #ifndef __ARCH_PARISC_CACHE_H
7408 #define __ARCH_PARISC_CACHE_H
7409
7410 +#include <linux/const.h>
7411
7412 /*
7413 * PA 2.0 processors have 64-byte cachelines; PA 1.1 processors have
7414 @@ -15,13 +16,13 @@
7415 * just ruin performance.
7416 */
7417 #ifdef CONFIG_PA20
7418 -#define L1_CACHE_BYTES 64
7419 #define L1_CACHE_SHIFT 6
7420 #else
7421 -#define L1_CACHE_BYTES 32
7422 #define L1_CACHE_SHIFT 5
7423 #endif
7424
7425 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7426 +
7427 #ifndef __ASSEMBLY__
7428
7429 #define SMP_CACHE_BYTES L1_CACHE_BYTES
7430 diff --git a/arch/parisc/include/asm/elf.h b/arch/parisc/include/asm/elf.h
7431 index 3391d06..c23a2cc 100644
7432 --- a/arch/parisc/include/asm/elf.h
7433 +++ b/arch/parisc/include/asm/elf.h
7434 @@ -342,6 +342,13 @@ struct pt_regs; /* forward declaration... */
7435
7436 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE + 0x01000000)
7437
7438 +#ifdef CONFIG_PAX_ASLR
7439 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
7440 +
7441 +#define PAX_DELTA_MMAP_LEN 16
7442 +#define PAX_DELTA_STACK_LEN 16
7443 +#endif
7444 +
7445 /* This yields a mask that user programs can use to figure out what
7446 instruction set this CPU supports. This could be done in user space,
7447 but it's not easy, and we've already done it here. */
7448 diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
7449 index f213f5b..0af3e8e 100644
7450 --- a/arch/parisc/include/asm/pgalloc.h
7451 +++ b/arch/parisc/include/asm/pgalloc.h
7452 @@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
7453 (__u32)(__pa((unsigned long)pmd) >> PxD_VALUE_SHIFT));
7454 }
7455
7456 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
7457 +{
7458 + pgd_populate(mm, pgd, pmd);
7459 +}
7460 +
7461 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
7462 {
7463 pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
7464 @@ -93,6 +98,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
7465 #define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
7466 #define pmd_free(mm, x) do { } while (0)
7467 #define pgd_populate(mm, pmd, pte) BUG()
7468 +#define pgd_populate_kernel(mm, pmd, pte) BUG()
7469
7470 #endif
7471
7472 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
7473 index 22b89d1..ce34230 100644
7474 --- a/arch/parisc/include/asm/pgtable.h
7475 +++ b/arch/parisc/include/asm/pgtable.h
7476 @@ -223,6 +223,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
7477 #define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
7478 #define PAGE_COPY PAGE_EXECREAD
7479 #define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
7480 +
7481 +#ifdef CONFIG_PAX_PAGEEXEC
7482 +# define PAGE_SHARED_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
7483 +# define PAGE_COPY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
7484 +# define PAGE_READONLY_NOEXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
7485 +#else
7486 +# define PAGE_SHARED_NOEXEC PAGE_SHARED
7487 +# define PAGE_COPY_NOEXEC PAGE_COPY
7488 +# define PAGE_READONLY_NOEXEC PAGE_READONLY
7489 +#endif
7490 +
7491 #define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
7492 #define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
7493 #define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
7494 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
7495 index 4006964..fcb3cc2 100644
7496 --- a/arch/parisc/include/asm/uaccess.h
7497 +++ b/arch/parisc/include/asm/uaccess.h
7498 @@ -246,10 +246,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
7499 const void __user *from,
7500 unsigned long n)
7501 {
7502 - int sz = __compiletime_object_size(to);
7503 + size_t sz = __compiletime_object_size(to);
7504 int ret = -EFAULT;
7505
7506 - if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
7507 + if (likely(sz == (size_t)-1 || !__builtin_constant_p(n) || sz >= n))
7508 ret = __copy_from_user(to, from, n);
7509 else
7510 copy_from_user_overflow();
7511 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
7512 index 50dfafc..b9fc230 100644
7513 --- a/arch/parisc/kernel/module.c
7514 +++ b/arch/parisc/kernel/module.c
7515 @@ -98,16 +98,38 @@
7516
7517 /* three functions to determine where in the module core
7518 * or init pieces the location is */
7519 +static inline int in_init_rx(struct module *me, void *loc)
7520 +{
7521 + return (loc >= me->module_init_rx &&
7522 + loc < (me->module_init_rx + me->init_size_rx));
7523 +}
7524 +
7525 +static inline int in_init_rw(struct module *me, void *loc)
7526 +{
7527 + return (loc >= me->module_init_rw &&
7528 + loc < (me->module_init_rw + me->init_size_rw));
7529 +}
7530 +
7531 static inline int in_init(struct module *me, void *loc)
7532 {
7533 - return (loc >= me->module_init &&
7534 - loc <= (me->module_init + me->init_size));
7535 + return in_init_rx(me, loc) || in_init_rw(me, loc);
7536 +}
7537 +
7538 +static inline int in_core_rx(struct module *me, void *loc)
7539 +{
7540 + return (loc >= me->module_core_rx &&
7541 + loc < (me->module_core_rx + me->core_size_rx));
7542 +}
7543 +
7544 +static inline int in_core_rw(struct module *me, void *loc)
7545 +{
7546 + return (loc >= me->module_core_rw &&
7547 + loc < (me->module_core_rw + me->core_size_rw));
7548 }
7549
7550 static inline int in_core(struct module *me, void *loc)
7551 {
7552 - return (loc >= me->module_core &&
7553 - loc <= (me->module_core + me->core_size));
7554 + return in_core_rx(me, loc) || in_core_rw(me, loc);
7555 }
7556
7557 static inline int in_local(struct module *me, void *loc)
7558 @@ -371,13 +393,13 @@ int module_frob_arch_sections(CONST Elf_Ehdr *hdr,
7559 }
7560
7561 /* align things a bit */
7562 - me->core_size = ALIGN(me->core_size, 16);
7563 - me->arch.got_offset = me->core_size;
7564 - me->core_size += gots * sizeof(struct got_entry);
7565 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
7566 + me->arch.got_offset = me->core_size_rw;
7567 + me->core_size_rw += gots * sizeof(struct got_entry);
7568
7569 - me->core_size = ALIGN(me->core_size, 16);
7570 - me->arch.fdesc_offset = me->core_size;
7571 - me->core_size += fdescs * sizeof(Elf_Fdesc);
7572 + me->core_size_rw = ALIGN(me->core_size_rw, 16);
7573 + me->arch.fdesc_offset = me->core_size_rw;
7574 + me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
7575
7576 me->arch.got_max = gots;
7577 me->arch.fdesc_max = fdescs;
7578 @@ -395,7 +417,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
7579
7580 BUG_ON(value == 0);
7581
7582 - got = me->module_core + me->arch.got_offset;
7583 + got = me->module_core_rw + me->arch.got_offset;
7584 for (i = 0; got[i].addr; i++)
7585 if (got[i].addr == value)
7586 goto out;
7587 @@ -413,7 +435,7 @@ static Elf64_Word get_got(struct module *me, unsigned long value, long addend)
7588 #ifdef CONFIG_64BIT
7589 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
7590 {
7591 - Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
7592 + Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
7593
7594 if (!value) {
7595 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
7596 @@ -431,7 +453,7 @@ static Elf_Addr get_fdesc(struct module *me, unsigned long value)
7597
7598 /* Create new one */
7599 fdesc->addr = value;
7600 - fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
7601 + fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
7602 return (Elf_Addr)fdesc;
7603 }
7604 #endif /* CONFIG_64BIT */
7605 @@ -843,7 +865,7 @@ register_unwind_table(struct module *me,
7606
7607 table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
7608 end = table + sechdrs[me->arch.unwind_section].sh_size;
7609 - gp = (Elf_Addr)me->module_core + me->arch.got_offset;
7610 + gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
7611
7612 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
7613 me->arch.unwind_section, table, end, gp);
7614 diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
7615 index 31ffa9b..588a798 100644
7616 --- a/arch/parisc/kernel/sys_parisc.c
7617 +++ b/arch/parisc/kernel/sys_parisc.c
7618 @@ -89,6 +89,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7619 unsigned long task_size = TASK_SIZE;
7620 int do_color_align, last_mmap;
7621 struct vm_unmapped_area_info info;
7622 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
7623
7624 if (len > task_size)
7625 return -ENOMEM;
7626 @@ -106,6 +107,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7627 goto found_addr;
7628 }
7629
7630 +#ifdef CONFIG_PAX_RANDMMAP
7631 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7632 +#endif
7633 +
7634 if (addr) {
7635 if (do_color_align && last_mmap)
7636 addr = COLOR_ALIGN(addr, last_mmap, pgoff);
7637 @@ -124,6 +129,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
7638 info.high_limit = mmap_upper_limit();
7639 info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
7640 info.align_offset = shared_align_offset(last_mmap, pgoff);
7641 + info.threadstack_offset = offset;
7642 addr = vm_unmapped_area(&info);
7643
7644 found_addr:
7645 @@ -143,6 +149,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7646 unsigned long addr = addr0;
7647 int do_color_align, last_mmap;
7648 struct vm_unmapped_area_info info;
7649 + unsigned long offset = gr_rand_threadstack_offset(current->mm, filp, flags);
7650
7651 #ifdef CONFIG_64BIT
7652 /* This should only ever run for 32-bit processes. */
7653 @@ -167,6 +174,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7654 }
7655
7656 /* requesting a specific address */
7657 +#ifdef CONFIG_PAX_RANDMMAP
7658 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
7659 +#endif
7660 +
7661 if (addr) {
7662 if (do_color_align && last_mmap)
7663 addr = COLOR_ALIGN(addr, last_mmap, pgoff);
7664 @@ -184,6 +195,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
7665 info.high_limit = mm->mmap_base;
7666 info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
7667 info.align_offset = shared_align_offset(last_mmap, pgoff);
7668 + info.threadstack_offset = offset;
7669 addr = vm_unmapped_area(&info);
7670 if (!(addr & ~PAGE_MASK))
7671 goto found_addr;
7672 @@ -249,6 +261,13 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
7673 mm->mmap_legacy_base = mmap_legacy_base();
7674 mm->mmap_base = mmap_upper_limit();
7675
7676 +#ifdef CONFIG_PAX_RANDMMAP
7677 + if (mm->pax_flags & MF_PAX_RANDMMAP) {
7678 + mm->mmap_legacy_base += mm->delta_mmap;
7679 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
7680 + }
7681 +#endif
7682 +
7683 if (mmap_is_legacy()) {
7684 mm->mmap_base = mm->mmap_legacy_base;
7685 mm->get_unmapped_area = arch_get_unmapped_area;
7686 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
7687 index 1cd1d0c..44ec918 100644
7688 --- a/arch/parisc/kernel/traps.c
7689 +++ b/arch/parisc/kernel/traps.c
7690 @@ -722,9 +722,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
7691
7692 down_read(&current->mm->mmap_sem);
7693 vma = find_vma(current->mm,regs->iaoq[0]);
7694 - if (vma && (regs->iaoq[0] >= vma->vm_start)
7695 - && (vma->vm_flags & VM_EXEC)) {
7696 -
7697 + if (vma && (regs->iaoq[0] >= vma->vm_start)) {
7698 fault_address = regs->iaoq[0];
7699 fault_space = regs->iasq[0];
7700
7701 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
7702 index 9d08c71..e2b4d20 100644
7703 --- a/arch/parisc/mm/fault.c
7704 +++ b/arch/parisc/mm/fault.c
7705 @@ -15,6 +15,7 @@
7706 #include <linux/sched.h>
7707 #include <linux/interrupt.h>
7708 #include <linux/module.h>
7709 +#include <linux/unistd.h>
7710
7711 #include <asm/uaccess.h>
7712 #include <asm/traps.h>
7713 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, exception_data);
7714 static unsigned long
7715 parisc_acctyp(unsigned long code, unsigned int inst)
7716 {
7717 - if (code == 6 || code == 16)
7718 + if (code == 6 || code == 7 || code == 16)
7719 return VM_EXEC;
7720
7721 switch (inst & 0xf0000000) {
7722 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsigned int inst)
7723 }
7724 #endif
7725
7726 +#ifdef CONFIG_PAX_PAGEEXEC
7727 +/*
7728 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
7729 + *
7730 + * returns 1 when task should be killed
7731 + * 2 when rt_sigreturn trampoline was detected
7732 + * 3 when unpatched PLT trampoline was detected
7733 + */
7734 +static int pax_handle_fetch_fault(struct pt_regs *regs)
7735 +{
7736 +
7737 +#ifdef CONFIG_PAX_EMUPLT
7738 + int err;
7739 +
7740 + do { /* PaX: unpatched PLT emulation */
7741 + unsigned int bl, depwi;
7742 +
7743 + err = get_user(bl, (unsigned int *)instruction_pointer(regs));
7744 + err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
7745 +
7746 + if (err)
7747 + break;
7748 +
7749 + if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
7750 + unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
7751 +
7752 + err = get_user(ldw, (unsigned int *)addr);
7753 + err |= get_user(bv, (unsigned int *)(addr+4));
7754 + err |= get_user(ldw2, (unsigned int *)(addr+8));
7755 +
7756 + if (err)
7757 + break;
7758 +
7759 + if (ldw == 0x0E801096U &&
7760 + bv == 0xEAC0C000U &&
7761 + ldw2 == 0x0E881095U)
7762 + {
7763 + unsigned int resolver, map;
7764 +
7765 + err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
7766 + err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
7767 + if (err)
7768 + break;
7769 +
7770 + regs->gr[20] = instruction_pointer(regs)+8;
7771 + regs->gr[21] = map;
7772 + regs->gr[22] = resolver;
7773 + regs->iaoq[0] = resolver | 3UL;
7774 + regs->iaoq[1] = regs->iaoq[0] + 4;
7775 + return 3;
7776 + }
7777 + }
7778 + } while (0);
7779 +#endif
7780 +
7781 +#ifdef CONFIG_PAX_EMUTRAMP
7782 +
7783 +#ifndef CONFIG_PAX_EMUSIGRT
7784 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
7785 + return 1;
7786 +#endif
7787 +
7788 + do { /* PaX: rt_sigreturn emulation */
7789 + unsigned int ldi1, ldi2, bel, nop;
7790 +
7791 + err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
7792 + err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
7793 + err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
7794 + err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
7795 +
7796 + if (err)
7797 + break;
7798 +
7799 + if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
7800 + ldi2 == 0x3414015AU &&
7801 + bel == 0xE4008200U &&
7802 + nop == 0x08000240U)
7803 + {
7804 + regs->gr[25] = (ldi1 & 2) >> 1;
7805 + regs->gr[20] = __NR_rt_sigreturn;
7806 + regs->gr[31] = regs->iaoq[1] + 16;
7807 + regs->sr[0] = regs->iasq[1];
7808 + regs->iaoq[0] = 0x100UL;
7809 + regs->iaoq[1] = regs->iaoq[0] + 4;
7810 + regs->iasq[0] = regs->sr[2];
7811 + regs->iasq[1] = regs->sr[2];
7812 + return 2;
7813 + }
7814 + } while (0);
7815 +#endif
7816 +
7817 + return 1;
7818 +}
7819 +
7820 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
7821 +{
7822 + unsigned long i;
7823 +
7824 + printk(KERN_ERR "PAX: bytes at PC: ");
7825 + for (i = 0; i < 5; i++) {
7826 + unsigned int c;
7827 + if (get_user(c, (unsigned int *)pc+i))
7828 + printk(KERN_CONT "???????? ");
7829 + else
7830 + printk(KERN_CONT "%08x ", c);
7831 + }
7832 + printk("\n");
7833 +}
7834 +#endif
7835 +
7836 int fixup_exception(struct pt_regs *regs)
7837 {
7838 const struct exception_table_entry *fix;
7839 @@ -210,8 +321,33 @@ retry:
7840
7841 good_area:
7842
7843 - if ((vma->vm_flags & acc_type) != acc_type)
7844 + if ((vma->vm_flags & acc_type) != acc_type) {
7845 +
7846 +#ifdef CONFIG_PAX_PAGEEXEC
7847 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
7848 + (address & ~3UL) == instruction_pointer(regs))
7849 + {
7850 + up_read(&mm->mmap_sem);
7851 + switch (pax_handle_fetch_fault(regs)) {
7852 +
7853 +#ifdef CONFIG_PAX_EMUPLT
7854 + case 3:
7855 + return;
7856 +#endif
7857 +
7858 +#ifdef CONFIG_PAX_EMUTRAMP
7859 + case 2:
7860 + return;
7861 +#endif
7862 +
7863 + }
7864 + pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
7865 + do_group_exit(SIGKILL);
7866 + }
7867 +#endif
7868 +
7869 goto bad_area;
7870 + }
7871
7872 /*
7873 * If for any reason at all we couldn't handle the fault, make
7874 diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
7875 index 957bf34..3430cc8 100644
7876 --- a/arch/powerpc/Kconfig
7877 +++ b/arch/powerpc/Kconfig
7878 @@ -393,6 +393,7 @@ config PPC64_SUPPORTS_MEMORY_FAILURE
7879 config KEXEC
7880 bool "kexec system call"
7881 depends on (PPC_BOOK3S || FSL_BOOKE || (44x && !SMP))
7882 + depends on !GRKERNSEC_KMEM
7883 help
7884 kexec is a system call that implements the ability to shutdown your
7885 current kernel, and to start another kernel. It is like a reboot
7886 diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h
7887 index e3b1d41..8e81edf 100644
7888 --- a/arch/powerpc/include/asm/atomic.h
7889 +++ b/arch/powerpc/include/asm/atomic.h
7890 @@ -523,6 +523,16 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v)
7891 return t1;
7892 }
7893
7894 +#define atomic64_read_unchecked(v) atomic64_read(v)
7895 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
7896 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
7897 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
7898 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
7899 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
7900 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
7901 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
7902 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
7903 +
7904 #endif /* __powerpc64__ */
7905
7906 #endif /* __KERNEL__ */
7907 diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h
7908 index ed0afc1..0332825 100644
7909 --- a/arch/powerpc/include/asm/cache.h
7910 +++ b/arch/powerpc/include/asm/cache.h
7911 @@ -3,6 +3,7 @@
7912
7913 #ifdef __KERNEL__
7914
7915 +#include <linux/const.h>
7916
7917 /* bytes per L1 cache line */
7918 #if defined(CONFIG_8xx) || defined(CONFIG_403GCX)
7919 @@ -22,7 +23,7 @@
7920 #define L1_CACHE_SHIFT 7
7921 #endif
7922
7923 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
7924 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
7925
7926 #define SMP_CACHE_BYTES L1_CACHE_BYTES
7927
7928 diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h
7929 index 935b5e7..7001d2d 100644
7930 --- a/arch/powerpc/include/asm/elf.h
7931 +++ b/arch/powerpc/include/asm/elf.h
7932 @@ -28,8 +28,19 @@
7933 the loader. We need to make sure that it is out of the way of the program
7934 that it will "exec", and that there is sufficient room for the brk. */
7935
7936 -extern unsigned long randomize_et_dyn(unsigned long base);
7937 -#define ELF_ET_DYN_BASE (randomize_et_dyn(0x20000000))
7938 +#define ELF_ET_DYN_BASE (0x20000000)
7939 +
7940 +#ifdef CONFIG_PAX_ASLR
7941 +#define PAX_ELF_ET_DYN_BASE (0x10000000UL)
7942 +
7943 +#ifdef __powerpc64__
7944 +#define PAX_DELTA_MMAP_LEN (is_32bit_task() ? 16 : 28)
7945 +#define PAX_DELTA_STACK_LEN (is_32bit_task() ? 16 : 28)
7946 +#else
7947 +#define PAX_DELTA_MMAP_LEN 15
7948 +#define PAX_DELTA_STACK_LEN 15
7949 +#endif
7950 +#endif
7951
7952 #define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0)
7953
7954 @@ -127,10 +138,6 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
7955 (0x7ff >> (PAGE_SHIFT - 12)) : \
7956 (0x3ffff >> (PAGE_SHIFT - 12)))
7957
7958 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
7959 -#define arch_randomize_brk arch_randomize_brk
7960 -
7961 -
7962 #ifdef CONFIG_SPU_BASE
7963 /* Notes used in ET_CORE. Note name is "SPU/<fd>/<filename>". */
7964 #define NT_SPU 1
7965 diff --git a/arch/powerpc/include/asm/exec.h b/arch/powerpc/include/asm/exec.h
7966 index 8196e9c..d83a9f3 100644
7967 --- a/arch/powerpc/include/asm/exec.h
7968 +++ b/arch/powerpc/include/asm/exec.h
7969 @@ -4,6 +4,6 @@
7970 #ifndef _ASM_POWERPC_EXEC_H
7971 #define _ASM_POWERPC_EXEC_H
7972
7973 -extern unsigned long arch_align_stack(unsigned long sp);
7974 +#define arch_align_stack(x) ((x) & ~0xfUL)
7975
7976 #endif /* _ASM_POWERPC_EXEC_H */
7977 diff --git a/arch/powerpc/include/asm/kmap_types.h b/arch/powerpc/include/asm/kmap_types.h
7978 index 5acabbd..7ea14fa 100644
7979 --- a/arch/powerpc/include/asm/kmap_types.h
7980 +++ b/arch/powerpc/include/asm/kmap_types.h
7981 @@ -10,7 +10,7 @@
7982 * 2 of the License, or (at your option) any later version.
7983 */
7984
7985 -#define KM_TYPE_NR 16
7986 +#define KM_TYPE_NR 17
7987
7988 #endif /* __KERNEL__ */
7989 #endif /* _ASM_POWERPC_KMAP_TYPES_H */
7990 diff --git a/arch/powerpc/include/asm/local.h b/arch/powerpc/include/asm/local.h
7991 index b8da913..60b608a 100644
7992 --- a/arch/powerpc/include/asm/local.h
7993 +++ b/arch/powerpc/include/asm/local.h
7994 @@ -9,15 +9,26 @@ typedef struct
7995 atomic_long_t a;
7996 } local_t;
7997
7998 +typedef struct
7999 +{
8000 + atomic_long_unchecked_t a;
8001 +} local_unchecked_t;
8002 +
8003 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
8004
8005 #define local_read(l) atomic_long_read(&(l)->a)
8006 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
8007 #define local_set(l,i) atomic_long_set(&(l)->a, (i))
8008 +#define local_set_unchecked(l,i) atomic_long_set_unchecked(&(l)->a, (i))
8009
8010 #define local_add(i,l) atomic_long_add((i),(&(l)->a))
8011 +#define local_add_unchecked(i,l) atomic_long_add_unchecked((i),(&(l)->a))
8012 #define local_sub(i,l) atomic_long_sub((i),(&(l)->a))
8013 +#define local_sub_unchecked(i,l) atomic_long_sub_unchecked((i),(&(l)->a))
8014 #define local_inc(l) atomic_long_inc(&(l)->a)
8015 +#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
8016 #define local_dec(l) atomic_long_dec(&(l)->a)
8017 +#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
8018
8019 static __inline__ long local_add_return(long a, local_t *l)
8020 {
8021 @@ -35,6 +46,7 @@ static __inline__ long local_add_return(long a, local_t *l)
8022
8023 return t;
8024 }
8025 +#define local_add_return_unchecked(i, l) atomic_long_add_return_unchecked((i), (&(l)->a))
8026
8027 #define local_add_negative(a, l) (local_add_return((a), (l)) < 0)
8028
8029 @@ -54,6 +66,7 @@ static __inline__ long local_sub_return(long a, local_t *l)
8030
8031 return t;
8032 }
8033 +#define local_sub_return_unchecked(i, l) atomic_long_sub_return_unchecked((i), (&(l)->a))
8034
8035 static __inline__ long local_inc_return(local_t *l)
8036 {
8037 @@ -101,6 +114,8 @@ static __inline__ long local_dec_return(local_t *l)
8038
8039 #define local_cmpxchg(l, o, n) \
8040 (cmpxchg_local(&((l)->a.counter), (o), (n)))
8041 +#define local_cmpxchg_unchecked(l, o, n) \
8042 + (cmpxchg_local(&((l)->a.counter), (o), (n)))
8043 #define local_xchg(l, n) (xchg_local(&((l)->a.counter), (n)))
8044
8045 /**
8046 diff --git a/arch/powerpc/include/asm/mman.h b/arch/powerpc/include/asm/mman.h
8047 index 8565c25..2865190 100644
8048 --- a/arch/powerpc/include/asm/mman.h
8049 +++ b/arch/powerpc/include/asm/mman.h
8050 @@ -24,7 +24,7 @@ static inline unsigned long arch_calc_vm_prot_bits(unsigned long prot)
8051 }
8052 #define arch_calc_vm_prot_bits(prot) arch_calc_vm_prot_bits(prot)
8053
8054 -static inline pgprot_t arch_vm_get_page_prot(unsigned long vm_flags)
8055 +static inline pgprot_t arch_vm_get_page_prot(vm_flags_t vm_flags)
8056 {
8057 return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
8058 }
8059 diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
8060 index 32e4e21..62afb12 100644
8061 --- a/arch/powerpc/include/asm/page.h
8062 +++ b/arch/powerpc/include/asm/page.h
8063 @@ -230,8 +230,9 @@ extern long long virt_phys_offset;
8064 * and needs to be executable. This means the whole heap ends
8065 * up being executable.
8066 */
8067 -#define VM_DATA_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
8068 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8069 +#define VM_DATA_DEFAULT_FLAGS32 \
8070 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
8071 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8072
8073 #define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
8074 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8075 @@ -259,6 +260,9 @@ extern long long virt_phys_offset;
8076 #define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
8077 #endif
8078
8079 +#define ktla_ktva(addr) (addr)
8080 +#define ktva_ktla(addr) (addr)
8081 +
8082 #ifndef CONFIG_PPC_BOOK3S_64
8083 /*
8084 * Use the top bit of the higher-level page table entries to indicate whether
8085 diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h
8086 index 88693ce..ac6f9ab 100644
8087 --- a/arch/powerpc/include/asm/page_64.h
8088 +++ b/arch/powerpc/include/asm/page_64.h
8089 @@ -153,15 +153,18 @@ do { \
8090 * stack by default, so in the absence of a PT_GNU_STACK program header
8091 * we turn execute permission off.
8092 */
8093 -#define VM_STACK_DEFAULT_FLAGS32 (VM_READ | VM_WRITE | VM_EXEC | \
8094 - VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8095 +#define VM_STACK_DEFAULT_FLAGS32 \
8096 + (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
8097 + VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8098
8099 #define VM_STACK_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
8100 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
8101
8102 +#ifndef CONFIG_PAX_PAGEEXEC
8103 #define VM_STACK_DEFAULT_FLAGS \
8104 (is_32bit_task() ? \
8105 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
8106 +#endif
8107
8108 #include <asm-generic/getorder.h>
8109
8110 diff --git a/arch/powerpc/include/asm/pgalloc-64.h b/arch/powerpc/include/asm/pgalloc-64.h
8111 index 4b0be20..c15a27d 100644
8112 --- a/arch/powerpc/include/asm/pgalloc-64.h
8113 +++ b/arch/powerpc/include/asm/pgalloc-64.h
8114 @@ -54,6 +54,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
8115 #ifndef CONFIG_PPC_64K_PAGES
8116
8117 #define pgd_populate(MM, PGD, PUD) pgd_set(PGD, PUD)
8118 +#define pgd_populate_kernel(MM, PGD, PUD) pgd_populate((MM), (PGD), (PUD))
8119
8120 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
8121 {
8122 @@ -71,6 +72,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
8123 pud_set(pud, (unsigned long)pmd);
8124 }
8125
8126 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
8127 +{
8128 + pud_populate(mm, pud, pmd);
8129 +}
8130 +
8131 #define pmd_populate(mm, pmd, pte_page) \
8132 pmd_populate_kernel(mm, pmd, page_address(pte_page))
8133 #define pmd_populate_kernel(mm, pmd, pte) pmd_set(pmd, (unsigned long)(pte))
8134 @@ -173,6 +179,7 @@ extern void __tlb_remove_table(void *_table);
8135 #endif
8136
8137 #define pud_populate(mm, pud, pmd) pud_set(pud, (unsigned long)pmd)
8138 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
8139
8140 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
8141 pte_t *pte)
8142 diff --git a/arch/powerpc/include/asm/pgtable.h b/arch/powerpc/include/asm/pgtable.h
8143 index 3ebb188..e17dddf 100644
8144 --- a/arch/powerpc/include/asm/pgtable.h
8145 +++ b/arch/powerpc/include/asm/pgtable.h
8146 @@ -2,6 +2,7 @@
8147 #define _ASM_POWERPC_PGTABLE_H
8148 #ifdef __KERNEL__
8149
8150 +#include <linux/const.h>
8151 #ifndef __ASSEMBLY__
8152 #include <linux/mmdebug.h>
8153 #include <asm/processor.h> /* For TASK_SIZE */
8154 diff --git a/arch/powerpc/include/asm/pte-hash32.h b/arch/powerpc/include/asm/pte-hash32.h
8155 index 4aad413..85d86bf 100644
8156 --- a/arch/powerpc/include/asm/pte-hash32.h
8157 +++ b/arch/powerpc/include/asm/pte-hash32.h
8158 @@ -21,6 +21,7 @@
8159 #define _PAGE_FILE 0x004 /* when !present: nonlinear file mapping */
8160 #define _PAGE_USER 0x004 /* usermode access allowed */
8161 #define _PAGE_GUARDED 0x008 /* G: prohibit speculative access */
8162 +#define _PAGE_EXEC _PAGE_GUARDED
8163 #define _PAGE_COHERENT 0x010 /* M: enforce memory coherence (SMP systems) */
8164 #define _PAGE_NO_CACHE 0x020 /* I: cache inhibit */
8165 #define _PAGE_WRITETHRU 0x040 /* W: cache write-through */
8166 diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
8167 index ce17815..c5574cc 100644
8168 --- a/arch/powerpc/include/asm/reg.h
8169 +++ b/arch/powerpc/include/asm/reg.h
8170 @@ -249,6 +249,7 @@
8171 #define SPRN_DBCR 0x136 /* e300 Data Breakpoint Control Reg */
8172 #define SPRN_DSISR 0x012 /* Data Storage Interrupt Status Register */
8173 #define DSISR_NOHPTE 0x40000000 /* no translation found */
8174 +#define DSISR_GUARDED 0x10000000 /* fetch from guarded storage */
8175 #define DSISR_PROTFAULT 0x08000000 /* protection fault */
8176 #define DSISR_ISSTORE 0x02000000 /* access was a store */
8177 #define DSISR_DABRMATCH 0x00400000 /* hit data breakpoint */
8178 diff --git a/arch/powerpc/include/asm/smp.h b/arch/powerpc/include/asm/smp.h
8179 index 084e080..9415a3d 100644
8180 --- a/arch/powerpc/include/asm/smp.h
8181 +++ b/arch/powerpc/include/asm/smp.h
8182 @@ -51,7 +51,7 @@ struct smp_ops_t {
8183 int (*cpu_disable)(void);
8184 void (*cpu_die)(unsigned int nr);
8185 int (*cpu_bootable)(unsigned int nr);
8186 -};
8187 +} __no_const;
8188
8189 extern void smp_send_debugger_break(void);
8190 extern void start_secondary_resume(void);
8191 diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h
8192 index b034ecd..af7e31f 100644
8193 --- a/arch/powerpc/include/asm/thread_info.h
8194 +++ b/arch/powerpc/include/asm/thread_info.h
8195 @@ -107,6 +107,8 @@ static inline struct thread_info *current_thread_info(void)
8196 #if defined(CONFIG_PPC64)
8197 #define TIF_ELF2ABI 18 /* function descriptors must die! */
8198 #endif
8199 +/* mask must be expressable within 16 bits to satisfy 'andi' instruction reqs */
8200 +#define TIF_GRSEC_SETXID 6 /* update credentials on syscall entry/exit */
8201
8202 /* as above, but as bit values */
8203 #define _TIF_SYSCALL_TRACE (1<<TIF_SYSCALL_TRACE)
8204 @@ -125,9 +127,10 @@ static inline struct thread_info *current_thread_info(void)
8205 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
8206 #define _TIF_EMULATE_STACK_STORE (1<<TIF_EMULATE_STACK_STORE)
8207 #define _TIF_NOHZ (1<<TIF_NOHZ)
8208 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
8209 #define _TIF_SYSCALL_T_OR_A (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | \
8210 _TIF_SECCOMP | _TIF_SYSCALL_TRACEPOINT | \
8211 - _TIF_NOHZ)
8212 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
8213
8214 #define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
8215 _TIF_NOTIFY_RESUME | _TIF_UPROBE | \
8216 diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
8217 index 9485b43..3bd3c16 100644
8218 --- a/arch/powerpc/include/asm/uaccess.h
8219 +++ b/arch/powerpc/include/asm/uaccess.h
8220 @@ -58,6 +58,7 @@
8221
8222 #endif
8223
8224 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
8225 #define access_ok(type, addr, size) \
8226 (__chk_user_ptr(addr), \
8227 __access_ok((__force unsigned long)(addr), (size), get_fs()))
8228 @@ -318,52 +319,6 @@ do { \
8229 extern unsigned long __copy_tofrom_user(void __user *to,
8230 const void __user *from, unsigned long size);
8231
8232 -#ifndef __powerpc64__
8233 -
8234 -static inline unsigned long copy_from_user(void *to,
8235 - const void __user *from, unsigned long n)
8236 -{
8237 - unsigned long over;
8238 -
8239 - if (access_ok(VERIFY_READ, from, n))
8240 - return __copy_tofrom_user((__force void __user *)to, from, n);
8241 - if ((unsigned long)from < TASK_SIZE) {
8242 - over = (unsigned long)from + n - TASK_SIZE;
8243 - return __copy_tofrom_user((__force void __user *)to, from,
8244 - n - over) + over;
8245 - }
8246 - return n;
8247 -}
8248 -
8249 -static inline unsigned long copy_to_user(void __user *to,
8250 - const void *from, unsigned long n)
8251 -{
8252 - unsigned long over;
8253 -
8254 - if (access_ok(VERIFY_WRITE, to, n))
8255 - return __copy_tofrom_user(to, (__force void __user *)from, n);
8256 - if ((unsigned long)to < TASK_SIZE) {
8257 - over = (unsigned long)to + n - TASK_SIZE;
8258 - return __copy_tofrom_user(to, (__force void __user *)from,
8259 - n - over) + over;
8260 - }
8261 - return n;
8262 -}
8263 -
8264 -#else /* __powerpc64__ */
8265 -
8266 -#define __copy_in_user(to, from, size) \
8267 - __copy_tofrom_user((to), (from), (size))
8268 -
8269 -extern unsigned long copy_from_user(void *to, const void __user *from,
8270 - unsigned long n);
8271 -extern unsigned long copy_to_user(void __user *to, const void *from,
8272 - unsigned long n);
8273 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
8274 - unsigned long n);
8275 -
8276 -#endif /* __powerpc64__ */
8277 -
8278 static inline unsigned long __copy_from_user_inatomic(void *to,
8279 const void __user *from, unsigned long n)
8280 {
8281 @@ -387,6 +342,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
8282 if (ret == 0)
8283 return 0;
8284 }
8285 +
8286 + if (!__builtin_constant_p(n))
8287 + check_object_size(to, n, false);
8288 +
8289 return __copy_tofrom_user((__force void __user *)to, from, n);
8290 }
8291
8292 @@ -413,6 +372,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
8293 if (ret == 0)
8294 return 0;
8295 }
8296 +
8297 + if (!__builtin_constant_p(n))
8298 + check_object_size(from, n, true);
8299 +
8300 return __copy_tofrom_user(to, (__force const void __user *)from, n);
8301 }
8302
8303 @@ -430,6 +393,92 @@ static inline unsigned long __copy_to_user(void __user *to,
8304 return __copy_to_user_inatomic(to, from, size);
8305 }
8306
8307 +#ifndef __powerpc64__
8308 +
8309 +static inline unsigned long __must_check copy_from_user(void *to,
8310 + const void __user *from, unsigned long n)
8311 +{
8312 + unsigned long over;
8313 +
8314 + if ((long)n < 0)
8315 + return n;
8316 +
8317 + if (access_ok(VERIFY_READ, from, n)) {
8318 + if (!__builtin_constant_p(n))
8319 + check_object_size(to, n, false);
8320 + return __copy_tofrom_user((__force void __user *)to, from, n);
8321 + }
8322 + if ((unsigned long)from < TASK_SIZE) {
8323 + over = (unsigned long)from + n - TASK_SIZE;
8324 + if (!__builtin_constant_p(n - over))
8325 + check_object_size(to, n - over, false);
8326 + return __copy_tofrom_user((__force void __user *)to, from,
8327 + n - over) + over;
8328 + }
8329 + return n;
8330 +}
8331 +
8332 +static inline unsigned long __must_check copy_to_user(void __user *to,
8333 + const void *from, unsigned long n)
8334 +{
8335 + unsigned long over;
8336 +
8337 + if ((long)n < 0)
8338 + return n;
8339 +
8340 + if (access_ok(VERIFY_WRITE, to, n)) {
8341 + if (!__builtin_constant_p(n))
8342 + check_object_size(from, n, true);
8343 + return __copy_tofrom_user(to, (__force void __user *)from, n);
8344 + }
8345 + if ((unsigned long)to < TASK_SIZE) {
8346 + over = (unsigned long)to + n - TASK_SIZE;
8347 + if (!__builtin_constant_p(n))
8348 + check_object_size(from, n - over, true);
8349 + return __copy_tofrom_user(to, (__force void __user *)from,
8350 + n - over) + over;
8351 + }
8352 + return n;
8353 +}
8354 +
8355 +#else /* __powerpc64__ */
8356 +
8357 +#define __copy_in_user(to, from, size) \
8358 + __copy_tofrom_user((to), (from), (size))
8359 +
8360 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
8361 +{
8362 + if ((long)n < 0 || n > INT_MAX)
8363 + return n;
8364 +
8365 + if (!__builtin_constant_p(n))
8366 + check_object_size(to, n, false);
8367 +
8368 + if (likely(access_ok(VERIFY_READ, from, n)))
8369 + n = __copy_from_user(to, from, n);
8370 + else
8371 + memset(to, 0, n);
8372 + return n;
8373 +}
8374 +
8375 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
8376 +{
8377 + if ((long)n < 0 || n > INT_MAX)
8378 + return n;
8379 +
8380 + if (likely(access_ok(VERIFY_WRITE, to, n))) {
8381 + if (!__builtin_constant_p(n))
8382 + check_object_size(from, n, true);
8383 + n = __copy_to_user(to, from, n);
8384 + }
8385 + return n;
8386 +}
8387 +
8388 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
8389 + unsigned long n);
8390 +
8391 +#endif /* __powerpc64__ */
8392 +
8393 extern unsigned long __clear_user(void __user *addr, unsigned long size);
8394
8395 static inline unsigned long clear_user(void __user *addr, unsigned long size)
8396 diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
8397 index fcc9a89..07be2bb 100644
8398 --- a/arch/powerpc/kernel/Makefile
8399 +++ b/arch/powerpc/kernel/Makefile
8400 @@ -26,6 +26,8 @@ CFLAGS_REMOVE_ftrace.o = -pg -mno-sched-epilog
8401 CFLAGS_REMOVE_time.o = -pg -mno-sched-epilog
8402 endif
8403
8404 +CFLAGS_REMOVE_prom_init.o += $(LATENT_ENTROPY_PLUGIN_CFLAGS)
8405 +
8406 obj-y := cputable.o ptrace.o syscalls.o \
8407 irq.o align.o signal_32.o pmc.o vdso.o \
8408 process.o systbl.o idle.o \
8409 diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S
8410 index 063b65d..7a26e9d 100644
8411 --- a/arch/powerpc/kernel/exceptions-64e.S
8412 +++ b/arch/powerpc/kernel/exceptions-64e.S
8413 @@ -771,6 +771,7 @@ storage_fault_common:
8414 std r14,_DAR(r1)
8415 std r15,_DSISR(r1)
8416 addi r3,r1,STACK_FRAME_OVERHEAD
8417 + bl .save_nvgprs
8418 mr r4,r14
8419 mr r5,r15
8420 ld r14,PACA_EXGEN+EX_R14(r13)
8421 @@ -779,8 +780,7 @@ storage_fault_common:
8422 cmpdi r3,0
8423 bne- 1f
8424 b .ret_from_except_lite
8425 -1: bl .save_nvgprs
8426 - mr r5,r3
8427 +1: mr r5,r3
8428 addi r3,r1,STACK_FRAME_OVERHEAD
8429 ld r4,_DAR(r1)
8430 bl .bad_page_fault
8431 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
8432 index 38d5073..f00af8d 100644
8433 --- a/arch/powerpc/kernel/exceptions-64s.S
8434 +++ b/arch/powerpc/kernel/exceptions-64s.S
8435 @@ -1584,10 +1584,10 @@ handle_page_fault:
8436 11: ld r4,_DAR(r1)
8437 ld r5,_DSISR(r1)
8438 addi r3,r1,STACK_FRAME_OVERHEAD
8439 + bl .save_nvgprs
8440 bl .do_page_fault
8441 cmpdi r3,0
8442 beq+ 12f
8443 - bl .save_nvgprs
8444 mr r5,r3
8445 addi r3,r1,STACK_FRAME_OVERHEAD
8446 lwz r4,_DAR(r1)
8447 diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
8448 index 1d0848b..d74685f 100644
8449 --- a/arch/powerpc/kernel/irq.c
8450 +++ b/arch/powerpc/kernel/irq.c
8451 @@ -447,6 +447,8 @@ void migrate_irqs(void)
8452 }
8453 #endif
8454
8455 +extern void gr_handle_kernel_exploit(void);
8456 +
8457 static inline void check_stack_overflow(void)
8458 {
8459 #ifdef CONFIG_DEBUG_STACKOVERFLOW
8460 @@ -459,6 +461,7 @@ static inline void check_stack_overflow(void)
8461 printk("do_IRQ: stack overflow: %ld\n",
8462 sp - sizeof(struct thread_info));
8463 dump_stack();
8464 + gr_handle_kernel_exploit();
8465 }
8466 #endif
8467 }
8468 diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
8469 index 6cff040..74ac5d1 100644
8470 --- a/arch/powerpc/kernel/module_32.c
8471 +++ b/arch/powerpc/kernel/module_32.c
8472 @@ -161,7 +161,7 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
8473 me->arch.core_plt_section = i;
8474 }
8475 if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
8476 - printk("Module doesn't contain .plt or .init.plt sections.\n");
8477 + printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
8478 return -ENOEXEC;
8479 }
8480
8481 @@ -191,11 +191,16 @@ static uint32_t do_plt_call(void *location,
8482
8483 DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
8484 /* Init, or core PLT? */
8485 - if (location >= mod->module_core
8486 - && location < mod->module_core + mod->core_size)
8487 + if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
8488 + (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
8489 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
8490 - else
8491 + else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
8492 + (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
8493 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
8494 + else {
8495 + printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
8496 + return ~0UL;
8497 + }
8498
8499 /* Find this entry, or if that fails, the next avail. entry */
8500 while (entry->jump[0]) {
8501 @@ -299,7 +304,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
8502 }
8503 #ifdef CONFIG_DYNAMIC_FTRACE
8504 module->arch.tramp =
8505 - do_plt_call(module->module_core,
8506 + do_plt_call(module->module_core_rx,
8507 (unsigned long)ftrace_caller,
8508 sechdrs, module);
8509 #endif
8510 diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
8511 index 31d0215..206af70 100644
8512 --- a/arch/powerpc/kernel/process.c
8513 +++ b/arch/powerpc/kernel/process.c
8514 @@ -1031,8 +1031,8 @@ void show_regs(struct pt_regs * regs)
8515 * Lookup NIP late so we have the best change of getting the
8516 * above info out without failing
8517 */
8518 - printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
8519 - printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
8520 + printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
8521 + printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
8522 #endif
8523 show_stack(current, (unsigned long *) regs->gpr[1]);
8524 if (!user_mode(regs))
8525 @@ -1554,10 +1554,10 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
8526 newsp = stack[0];
8527 ip = stack[STACK_FRAME_LR_SAVE];
8528 if (!firstframe || ip != lr) {
8529 - printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
8530 + printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
8531 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
8532 if ((ip == rth || ip == mrth) && curr_frame >= 0) {
8533 - printk(" (%pS)",
8534 + printk(" (%pA)",
8535 (void *)current->ret_stack[curr_frame].ret);
8536 curr_frame--;
8537 }
8538 @@ -1577,7 +1577,7 @@ void show_stack(struct task_struct *tsk, unsigned long *stack)
8539 struct pt_regs *regs = (struct pt_regs *)
8540 (sp + STACK_FRAME_OVERHEAD);
8541 lr = regs->link;
8542 - printk("--- Exception: %lx at %pS\n LR = %pS\n",
8543 + printk("--- Exception: %lx at %pA\n LR = %pA\n",
8544 regs->trap, (void *)regs->nip, (void *)lr);
8545 firstframe = 1;
8546 }
8547 @@ -1613,58 +1613,3 @@ void notrace __ppc64_runlatch_off(void)
8548 mtspr(SPRN_CTRLT, ctrl);
8549 }
8550 #endif /* CONFIG_PPC64 */
8551 -
8552 -unsigned long arch_align_stack(unsigned long sp)
8553 -{
8554 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
8555 - sp -= get_random_int() & ~PAGE_MASK;
8556 - return sp & ~0xf;
8557 -}
8558 -
8559 -static inline unsigned long brk_rnd(void)
8560 -{
8561 - unsigned long rnd = 0;
8562 -
8563 - /* 8MB for 32bit, 1GB for 64bit */
8564 - if (is_32bit_task())
8565 - rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
8566 - else
8567 - rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
8568 -
8569 - return rnd << PAGE_SHIFT;
8570 -}
8571 -
8572 -unsigned long arch_randomize_brk(struct mm_struct *mm)
8573 -{
8574 - unsigned long base = mm->brk;
8575 - unsigned long ret;
8576 -
8577 -#ifdef CONFIG_PPC_STD_MMU_64
8578 - /*
8579 - * If we are using 1TB segments and we are allowed to randomise
8580 - * the heap, we can put it above 1TB so it is backed by a 1TB
8581 - * segment. Otherwise the heap will be in the bottom 1TB
8582 - * which always uses 256MB segments and this may result in a
8583 - * performance penalty.
8584 - */
8585 - if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
8586 - base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
8587 -#endif
8588 -
8589 - ret = PAGE_ALIGN(base + brk_rnd());
8590 -
8591 - if (ret < mm->brk)
8592 - return mm->brk;
8593 -
8594 - return ret;
8595 -}
8596 -
8597 -unsigned long randomize_et_dyn(unsigned long base)
8598 -{
8599 - unsigned long ret = PAGE_ALIGN(base + brk_rnd());
8600 -
8601 - if (ret < base)
8602 - return base;
8603 -
8604 - return ret;
8605 -}
8606 diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
8607 index 2e3d2bf..35df241 100644
8608 --- a/arch/powerpc/kernel/ptrace.c
8609 +++ b/arch/powerpc/kernel/ptrace.c
8610 @@ -1762,6 +1762,10 @@ long arch_ptrace(struct task_struct *child, long request,
8611 return ret;
8612 }
8613
8614 +#ifdef CONFIG_GRKERNSEC_SETXID
8615 +extern void gr_delayed_cred_worker(void);
8616 +#endif
8617 +
8618 /*
8619 * We must return the syscall number to actually look up in the table.
8620 * This can be -1L to skip running any syscall at all.
8621 @@ -1774,6 +1778,11 @@ long do_syscall_trace_enter(struct pt_regs *regs)
8622
8623 secure_computing_strict(regs->gpr[0]);
8624
8625 +#ifdef CONFIG_GRKERNSEC_SETXID
8626 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
8627 + gr_delayed_cred_worker();
8628 +#endif
8629 +
8630 if (test_thread_flag(TIF_SYSCALL_TRACE) &&
8631 tracehook_report_syscall_entry(regs))
8632 /*
8633 @@ -1808,6 +1817,11 @@ void do_syscall_trace_leave(struct pt_regs *regs)
8634 {
8635 int step;
8636
8637 +#ifdef CONFIG_GRKERNSEC_SETXID
8638 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
8639 + gr_delayed_cred_worker();
8640 +#endif
8641 +
8642 audit_syscall_exit(regs);
8643
8644 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
8645 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
8646 index 4e47db6..6dcc96e 100644
8647 --- a/arch/powerpc/kernel/signal_32.c
8648 +++ b/arch/powerpc/kernel/signal_32.c
8649 @@ -1013,7 +1013,7 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
8650 /* Save user registers on the stack */
8651 frame = &rt_sf->uc.uc_mcontext;
8652 addr = frame;
8653 - if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
8654 + if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
8655 sigret = 0;
8656 tramp = current->mm->context.vdso_base + vdso32_rt_sigtramp;
8657 } else {
8658 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
8659 index d501dc4..e5a0de0 100644
8660 --- a/arch/powerpc/kernel/signal_64.c
8661 +++ b/arch/powerpc/kernel/signal_64.c
8662 @@ -760,7 +760,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
8663 current->thread.fp_state.fpscr = 0;
8664
8665 /* Set up to return from userspace. */
8666 - if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
8667 + if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
8668 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
8669 } else {
8670 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
8671 diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
8672 index 33cd7a0..d615344 100644
8673 --- a/arch/powerpc/kernel/traps.c
8674 +++ b/arch/powerpc/kernel/traps.c
8675 @@ -142,6 +142,8 @@ static unsigned __kprobes long oops_begin(struct pt_regs *regs)
8676 return flags;
8677 }
8678
8679 +extern void gr_handle_kernel_exploit(void);
8680 +
8681 static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
8682 int signr)
8683 {
8684 @@ -191,6 +193,9 @@ static void __kprobes oops_end(unsigned long flags, struct pt_regs *regs,
8685 panic("Fatal exception in interrupt");
8686 if (panic_on_oops)
8687 panic("Fatal exception");
8688 +
8689 + gr_handle_kernel_exploit();
8690 +
8691 do_exit(signr);
8692 }
8693
8694 diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
8695 index 094e45c..d82b848 100644
8696 --- a/arch/powerpc/kernel/vdso.c
8697 +++ b/arch/powerpc/kernel/vdso.c
8698 @@ -35,6 +35,7 @@
8699 #include <asm/vdso.h>
8700 #include <asm/vdso_datapage.h>
8701 #include <asm/setup.h>
8702 +#include <asm/mman.h>
8703
8704 #undef DEBUG
8705
8706 @@ -221,7 +222,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
8707 vdso_base = VDSO32_MBASE;
8708 #endif
8709
8710 - current->mm->context.vdso_base = 0;
8711 + current->mm->context.vdso_base = ~0UL;
8712
8713 /* vDSO has a problem and was disabled, just don't "enable" it for the
8714 * process
8715 @@ -241,7 +242,7 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
8716 vdso_base = get_unmapped_area(NULL, vdso_base,
8717 (vdso_pages << PAGE_SHIFT) +
8718 ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
8719 - 0, 0);
8720 + 0, MAP_PRIVATE | MAP_EXECUTABLE);
8721 if (IS_ERR_VALUE(vdso_base)) {
8722 rc = vdso_base;
8723 goto fail_mmapsem;
8724 diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
8725 index 3cf541a..ab2d825 100644
8726 --- a/arch/powerpc/kvm/powerpc.c
8727 +++ b/arch/powerpc/kvm/powerpc.c
8728 @@ -1153,7 +1153,7 @@ void kvmppc_init_lpid(unsigned long nr_lpids_param)
8729 }
8730 EXPORT_SYMBOL_GPL(kvmppc_init_lpid);
8731
8732 -int kvm_arch_init(void *opaque)
8733 +int kvm_arch_init(const void *opaque)
8734 {
8735 return 0;
8736 }
8737 diff --git a/arch/powerpc/lib/usercopy_64.c b/arch/powerpc/lib/usercopy_64.c
8738 index 5eea6f3..5d10396 100644
8739 --- a/arch/powerpc/lib/usercopy_64.c
8740 +++ b/arch/powerpc/lib/usercopy_64.c
8741 @@ -9,22 +9,6 @@
8742 #include <linux/module.h>
8743 #include <asm/uaccess.h>
8744
8745 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
8746 -{
8747 - if (likely(access_ok(VERIFY_READ, from, n)))
8748 - n = __copy_from_user(to, from, n);
8749 - else
8750 - memset(to, 0, n);
8751 - return n;
8752 -}
8753 -
8754 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
8755 -{
8756 - if (likely(access_ok(VERIFY_WRITE, to, n)))
8757 - n = __copy_to_user(to, from, n);
8758 - return n;
8759 -}
8760 -
8761 unsigned long copy_in_user(void __user *to, const void __user *from,
8762 unsigned long n)
8763 {
8764 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *to, const void __user *from,
8765 return n;
8766 }
8767
8768 -EXPORT_SYMBOL(copy_from_user);
8769 -EXPORT_SYMBOL(copy_to_user);
8770 EXPORT_SYMBOL(copy_in_user);
8771
8772 diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
8773 index 51ab9e7..7d3c78b 100644
8774 --- a/arch/powerpc/mm/fault.c
8775 +++ b/arch/powerpc/mm/fault.c
8776 @@ -33,6 +33,10 @@
8777 #include <linux/magic.h>
8778 #include <linux/ratelimit.h>
8779 #include <linux/context_tracking.h>
8780 +#include <linux/slab.h>
8781 +#include <linux/pagemap.h>
8782 +#include <linux/compiler.h>
8783 +#include <linux/unistd.h>
8784
8785 #include <asm/firmware.h>
8786 #include <asm/page.h>
8787 @@ -69,6 +73,33 @@ static inline int notify_page_fault(struct pt_regs *regs)
8788 }
8789 #endif
8790
8791 +#ifdef CONFIG_PAX_PAGEEXEC
8792 +/*
8793 + * PaX: decide what to do with offenders (regs->nip = fault address)
8794 + *
8795 + * returns 1 when task should be killed
8796 + */
8797 +static int pax_handle_fetch_fault(struct pt_regs *regs)
8798 +{
8799 + return 1;
8800 +}
8801 +
8802 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
8803 +{
8804 + unsigned long i;
8805 +
8806 + printk(KERN_ERR "PAX: bytes at PC: ");
8807 + for (i = 0; i < 5; i++) {
8808 + unsigned int c;
8809 + if (get_user(c, (unsigned int __user *)pc+i))
8810 + printk(KERN_CONT "???????? ");
8811 + else
8812 + printk(KERN_CONT "%08x ", c);
8813 + }
8814 + printk("\n");
8815 +}
8816 +#endif
8817 +
8818 /*
8819 * Check whether the instruction at regs->nip is a store using
8820 * an update addressing form which will update r1.
8821 @@ -216,7 +247,7 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
8822 * indicate errors in DSISR but can validly be set in SRR1.
8823 */
8824 if (trap == 0x400)
8825 - error_code &= 0x48200000;
8826 + error_code &= 0x58200000;
8827 else
8828 is_write = error_code & DSISR_ISSTORE;
8829 #else
8830 @@ -378,7 +409,7 @@ good_area:
8831 * "undefined". Of those that can be set, this is the only
8832 * one which seems bad.
8833 */
8834 - if (error_code & 0x10000000)
8835 + if (error_code & DSISR_GUARDED)
8836 /* Guarded storage error. */
8837 goto bad_area;
8838 #endif /* CONFIG_8xx */
8839 @@ -393,7 +424,7 @@ good_area:
8840 * processors use the same I/D cache coherency mechanism
8841 * as embedded.
8842 */
8843 - if (error_code & DSISR_PROTFAULT)
8844 + if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
8845 goto bad_area;
8846 #endif /* CONFIG_PPC_STD_MMU */
8847
8848 @@ -483,6 +514,23 @@ bad_area:
8849 bad_area_nosemaphore:
8850 /* User mode accesses cause a SIGSEGV */
8851 if (user_mode(regs)) {
8852 +
8853 +#ifdef CONFIG_PAX_PAGEEXEC
8854 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
8855 +#ifdef CONFIG_PPC_STD_MMU
8856 + if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
8857 +#else
8858 + if (is_exec && regs->nip == address) {
8859 +#endif
8860 + switch (pax_handle_fetch_fault(regs)) {
8861 + }
8862 +
8863 + pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
8864 + do_group_exit(SIGKILL);
8865 + }
8866 + }
8867 +#endif
8868 +
8869 _exception(SIGSEGV, regs, code, address);
8870 goto bail;
8871 }
8872 diff --git a/arch/powerpc/mm/mmap.c b/arch/powerpc/mm/mmap.c
8873 index cb8bdbe..cde4bc7 100644
8874 --- a/arch/powerpc/mm/mmap.c
8875 +++ b/arch/powerpc/mm/mmap.c
8876 @@ -53,10 +53,14 @@ static inline int mmap_is_legacy(void)
8877 return sysctl_legacy_va_layout;
8878 }
8879
8880 -static unsigned long mmap_rnd(void)
8881 +static unsigned long mmap_rnd(struct mm_struct *mm)
8882 {
8883 unsigned long rnd = 0;
8884
8885 +#ifdef CONFIG_PAX_RANDMMAP
8886 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
8887 +#endif
8888 +
8889 if (current->flags & PF_RANDOMIZE) {
8890 /* 8MB for 32bit, 1GB for 64bit */
8891 if (is_32bit_task())
8892 @@ -67,7 +71,7 @@ static unsigned long mmap_rnd(void)
8893 return rnd << PAGE_SHIFT;
8894 }
8895
8896 -static inline unsigned long mmap_base(void)
8897 +static inline unsigned long mmap_base(struct mm_struct *mm)
8898 {
8899 unsigned long gap = rlimit(RLIMIT_STACK);
8900
8901 @@ -76,7 +80,7 @@ static inline unsigned long mmap_base(void)
8902 else if (gap > MAX_GAP)
8903 gap = MAX_GAP;
8904
8905 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
8906 + return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd(mm));
8907 }
8908
8909 /*
8910 @@ -91,9 +95,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
8911 */
8912 if (mmap_is_legacy()) {
8913 mm->mmap_base = TASK_UNMAPPED_BASE;
8914 +
8915 +#ifdef CONFIG_PAX_RANDMMAP
8916 + if (mm->pax_flags & MF_PAX_RANDMMAP)
8917 + mm->mmap_base += mm->delta_mmap;
8918 +#endif
8919 +
8920 mm->get_unmapped_area = arch_get_unmapped_area;
8921 } else {
8922 - mm->mmap_base = mmap_base();
8923 + mm->mmap_base = mmap_base(mm);
8924 +
8925 +#ifdef CONFIG_PAX_RANDMMAP
8926 + if (mm->pax_flags & MF_PAX_RANDMMAP)
8927 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
8928 +#endif
8929 +
8930 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
8931 }
8932 }
8933 diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
8934 index b0c75cc..ef7fb93 100644
8935 --- a/arch/powerpc/mm/slice.c
8936 +++ b/arch/powerpc/mm/slice.c
8937 @@ -103,7 +103,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr,
8938 if ((mm->task_size - len) < addr)
8939 return 0;
8940 vma = find_vma(mm, addr);
8941 - return (!vma || (addr + len) <= vma->vm_start);
8942 + return check_heap_stack_gap(vma, addr, len, 0);
8943 }
8944
8945 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
8946 @@ -277,6 +277,12 @@ static unsigned long slice_find_area_bottomup(struct mm_struct *mm,
8947 info.align_offset = 0;
8948
8949 addr = TASK_UNMAPPED_BASE;
8950 +
8951 +#ifdef CONFIG_PAX_RANDMMAP
8952 + if (mm->pax_flags & MF_PAX_RANDMMAP)
8953 + addr += mm->delta_mmap;
8954 +#endif
8955 +
8956 while (addr < TASK_SIZE) {
8957 info.low_limit = addr;
8958 if (!slice_scan_available(addr, available, 1, &addr))
8959 @@ -410,6 +416,11 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len,
8960 if (fixed && addr > (mm->task_size - len))
8961 return -ENOMEM;
8962
8963 +#ifdef CONFIG_PAX_RANDMMAP
8964 + if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
8965 + addr = 0;
8966 +#endif
8967 +
8968 /* If hint, make sure it matches our alignment restrictions */
8969 if (!fixed && addr) {
8970 addr = _ALIGN_UP(addr, 1ul << pshift);
8971 diff --git a/arch/powerpc/platforms/cell/celleb_scc_pciex.c b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
8972 index 4278acf..67fd0e6 100644
8973 --- a/arch/powerpc/platforms/cell/celleb_scc_pciex.c
8974 +++ b/arch/powerpc/platforms/cell/celleb_scc_pciex.c
8975 @@ -400,8 +400,8 @@ static int scc_pciex_write_config(struct pci_bus *bus, unsigned int devfn,
8976 }
8977
8978 static struct pci_ops scc_pciex_pci_ops = {
8979 - scc_pciex_read_config,
8980 - scc_pciex_write_config,
8981 + .read = scc_pciex_read_config,
8982 + .write = scc_pciex_write_config,
8983 };
8984
8985 static void pciex_clear_intr_all(unsigned int __iomem *base)
8986 diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
8987 index 9098692..3d54cd1 100644
8988 --- a/arch/powerpc/platforms/cell/spufs/file.c
8989 +++ b/arch/powerpc/platforms/cell/spufs/file.c
8990 @@ -280,9 +280,9 @@ spufs_mem_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
8991 return VM_FAULT_NOPAGE;
8992 }
8993
8994 -static int spufs_mem_mmap_access(struct vm_area_struct *vma,
8995 +static ssize_t spufs_mem_mmap_access(struct vm_area_struct *vma,
8996 unsigned long address,
8997 - void *buf, int len, int write)
8998 + void *buf, size_t len, int write)
8999 {
9000 struct spu_context *ctx = vma->vm_file->private_data;
9001 unsigned long offset = address - vma->vm_start;
9002 diff --git a/arch/s390/include/asm/atomic.h b/arch/s390/include/asm/atomic.h
9003 index 1d47061..0714963 100644
9004 --- a/arch/s390/include/asm/atomic.h
9005 +++ b/arch/s390/include/asm/atomic.h
9006 @@ -412,6 +412,16 @@ static inline long long atomic64_dec_if_positive(atomic64_t *v)
9007 #define atomic64_dec_and_test(_v) (atomic64_sub_return(1, _v) == 0)
9008 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
9009
9010 +#define atomic64_read_unchecked(v) atomic64_read(v)
9011 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
9012 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
9013 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
9014 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
9015 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
9016 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
9017 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
9018 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
9019 +
9020 #define smp_mb__before_atomic_dec() smp_mb()
9021 #define smp_mb__after_atomic_dec() smp_mb()
9022 #define smp_mb__before_atomic_inc() smp_mb()
9023 diff --git a/arch/s390/include/asm/cache.h b/arch/s390/include/asm/cache.h
9024 index 4d7ccac..d03d0ad 100644
9025 --- a/arch/s390/include/asm/cache.h
9026 +++ b/arch/s390/include/asm/cache.h
9027 @@ -9,8 +9,10 @@
9028 #ifndef __ARCH_S390_CACHE_H
9029 #define __ARCH_S390_CACHE_H
9030
9031 -#define L1_CACHE_BYTES 256
9032 +#include <linux/const.h>
9033 +
9034 #define L1_CACHE_SHIFT 8
9035 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9036 #define NET_SKB_PAD 32
9037
9038 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9039 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
9040 index 78f4f87..598ce39 100644
9041 --- a/arch/s390/include/asm/elf.h
9042 +++ b/arch/s390/include/asm/elf.h
9043 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
9044 the loader. We need to make sure that it is out of the way of the program
9045 that it will "exec", and that there is sufficient room for the brk. */
9046
9047 -extern unsigned long randomize_et_dyn(unsigned long base);
9048 -#define ELF_ET_DYN_BASE (randomize_et_dyn(STACK_TOP / 3 * 2))
9049 +#define ELF_ET_DYN_BASE (STACK_TOP / 3 * 2)
9050 +
9051 +#ifdef CONFIG_PAX_ASLR
9052 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
9053 +
9054 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
9055 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_31BIT) ? 15 : 26)
9056 +#endif
9057
9058 /* This yields a mask that user programs can use to figure out what
9059 instruction set this CPU supports. */
9060 @@ -222,9 +228,6 @@ struct linux_binprm;
9061 #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
9062 int arch_setup_additional_pages(struct linux_binprm *, int);
9063
9064 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
9065 -#define arch_randomize_brk arch_randomize_brk
9066 -
9067 void *fill_cpu_elf_notes(void *ptr, struct save_area *sa);
9068
9069 #endif
9070 diff --git a/arch/s390/include/asm/exec.h b/arch/s390/include/asm/exec.h
9071 index c4a93d6..4d2a9b4 100644
9072 --- a/arch/s390/include/asm/exec.h
9073 +++ b/arch/s390/include/asm/exec.h
9074 @@ -7,6 +7,6 @@
9075 #ifndef __ASM_EXEC_H
9076 #define __ASM_EXEC_H
9077
9078 -extern unsigned long arch_align_stack(unsigned long sp);
9079 +#define arch_align_stack(x) ((x) & ~0xfUL)
9080
9081 #endif /* __ASM_EXEC_H */
9082 diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
9083 index 79330af..254cf37 100644
9084 --- a/arch/s390/include/asm/uaccess.h
9085 +++ b/arch/s390/include/asm/uaccess.h
9086 @@ -59,6 +59,7 @@ static inline int __range_ok(unsigned long addr, unsigned long size)
9087 __range_ok((unsigned long)(addr), (size)); \
9088 })
9089
9090 +#define access_ok_noprefault(type, addr, size) access_ok((type), (addr), (size))
9091 #define access_ok(type, addr, size) __access_ok(addr, size)
9092
9093 /*
9094 @@ -245,6 +246,10 @@ static inline unsigned long __must_check
9095 copy_to_user(void __user *to, const void *from, unsigned long n)
9096 {
9097 might_fault();
9098 +
9099 + if ((long)n < 0)
9100 + return n;
9101 +
9102 return __copy_to_user(to, from, n);
9103 }
9104
9105 @@ -268,6 +273,9 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
9106 static inline unsigned long __must_check
9107 __copy_from_user(void *to, const void __user *from, unsigned long n)
9108 {
9109 + if ((long)n < 0)
9110 + return n;
9111 +
9112 return uaccess.copy_from_user(n, from, to);
9113 }
9114
9115 @@ -296,10 +304,14 @@ __compiletime_warning("copy_from_user() buffer size is not provably correct")
9116 static inline unsigned long __must_check
9117 copy_from_user(void *to, const void __user *from, unsigned long n)
9118 {
9119 - unsigned int sz = __compiletime_object_size(to);
9120 + size_t sz = __compiletime_object_size(to);
9121
9122 might_fault();
9123 - if (unlikely(sz != -1 && sz < n)) {
9124 +
9125 + if ((long)n < 0)
9126 + return n;
9127 +
9128 + if (unlikely(sz != (size_t)-1 && sz < n)) {
9129 copy_from_user_overflow();
9130 return n;
9131 }
9132 diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
9133 index b89b591..fd9609d 100644
9134 --- a/arch/s390/kernel/module.c
9135 +++ b/arch/s390/kernel/module.c
9136 @@ -169,11 +169,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
9137
9138 /* Increase core size by size of got & plt and set start
9139 offsets for got and plt. */
9140 - me->core_size = ALIGN(me->core_size, 4);
9141 - me->arch.got_offset = me->core_size;
9142 - me->core_size += me->arch.got_size;
9143 - me->arch.plt_offset = me->core_size;
9144 - me->core_size += me->arch.plt_size;
9145 + me->core_size_rw = ALIGN(me->core_size_rw, 4);
9146 + me->arch.got_offset = me->core_size_rw;
9147 + me->core_size_rw += me->arch.got_size;
9148 + me->arch.plt_offset = me->core_size_rx;
9149 + me->core_size_rx += me->arch.plt_size;
9150 return 0;
9151 }
9152
9153 @@ -289,7 +289,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9154 if (info->got_initialized == 0) {
9155 Elf_Addr *gotent;
9156
9157 - gotent = me->module_core + me->arch.got_offset +
9158 + gotent = me->module_core_rw + me->arch.got_offset +
9159 info->got_offset;
9160 *gotent = val;
9161 info->got_initialized = 1;
9162 @@ -312,7 +312,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9163 rc = apply_rela_bits(loc, val, 0, 64, 0);
9164 else if (r_type == R_390_GOTENT ||
9165 r_type == R_390_GOTPLTENT) {
9166 - val += (Elf_Addr) me->module_core - loc;
9167 + val += (Elf_Addr) me->module_core_rw - loc;
9168 rc = apply_rela_bits(loc, val, 1, 32, 1);
9169 }
9170 break;
9171 @@ -325,7 +325,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9172 case R_390_PLTOFF64: /* 16 bit offset from GOT to PLT. */
9173 if (info->plt_initialized == 0) {
9174 unsigned int *ip;
9175 - ip = me->module_core + me->arch.plt_offset +
9176 + ip = me->module_core_rx + me->arch.plt_offset +
9177 info->plt_offset;
9178 #ifndef CONFIG_64BIT
9179 ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
9180 @@ -350,7 +350,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9181 val - loc + 0xffffUL < 0x1ffffeUL) ||
9182 (r_type == R_390_PLT32DBL &&
9183 val - loc + 0xffffffffULL < 0x1fffffffeULL)))
9184 - val = (Elf_Addr) me->module_core +
9185 + val = (Elf_Addr) me->module_core_rx +
9186 me->arch.plt_offset +
9187 info->plt_offset;
9188 val += rela->r_addend - loc;
9189 @@ -372,7 +372,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9190 case R_390_GOTOFF32: /* 32 bit offset to GOT. */
9191 case R_390_GOTOFF64: /* 64 bit offset to GOT. */
9192 val = val + rela->r_addend -
9193 - ((Elf_Addr) me->module_core + me->arch.got_offset);
9194 + ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
9195 if (r_type == R_390_GOTOFF16)
9196 rc = apply_rela_bits(loc, val, 0, 16, 0);
9197 else if (r_type == R_390_GOTOFF32)
9198 @@ -382,7 +382,7 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab,
9199 break;
9200 case R_390_GOTPC: /* 32 bit PC relative offset to GOT. */
9201 case R_390_GOTPCDBL: /* 32 bit PC rel. off. to GOT shifted by 1. */
9202 - val = (Elf_Addr) me->module_core + me->arch.got_offset +
9203 + val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
9204 rela->r_addend - loc;
9205 if (r_type == R_390_GOTPC)
9206 rc = apply_rela_bits(loc, val, 1, 32, 0);
9207 diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
9208 index dd14532..1dfc145 100644
9209 --- a/arch/s390/kernel/process.c
9210 +++ b/arch/s390/kernel/process.c
9211 @@ -242,37 +242,3 @@ unsigned long get_wchan(struct task_struct *p)
9212 }
9213 return 0;
9214 }
9215 -
9216 -unsigned long arch_align_stack(unsigned long sp)
9217 -{
9218 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
9219 - sp -= get_random_int() & ~PAGE_MASK;
9220 - return sp & ~0xf;
9221 -}
9222 -
9223 -static inline unsigned long brk_rnd(void)
9224 -{
9225 - /* 8MB for 32bit, 1GB for 64bit */
9226 - if (is_32bit_task())
9227 - return (get_random_int() & 0x7ffUL) << PAGE_SHIFT;
9228 - else
9229 - return (get_random_int() & 0x3ffffUL) << PAGE_SHIFT;
9230 -}
9231 -
9232 -unsigned long arch_randomize_brk(struct mm_struct *mm)
9233 -{
9234 - unsigned long ret;
9235 -
9236 - ret = PAGE_ALIGN(mm->brk + brk_rnd());
9237 - return (ret > mm->brk) ? ret : mm->brk;
9238 -}
9239 -
9240 -unsigned long randomize_et_dyn(unsigned long base)
9241 -{
9242 - unsigned long ret;
9243 -
9244 - if (!(current->flags & PF_RANDOMIZE))
9245 - return base;
9246 - ret = PAGE_ALIGN(base + brk_rnd());
9247 - return (ret > base) ? ret : base;
9248 -}
9249 diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
9250 index 9b436c2..54fbf0a 100644
9251 --- a/arch/s390/mm/mmap.c
9252 +++ b/arch/s390/mm/mmap.c
9253 @@ -95,9 +95,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9254 */
9255 if (mmap_is_legacy()) {
9256 mm->mmap_base = mmap_base_legacy();
9257 +
9258 +#ifdef CONFIG_PAX_RANDMMAP
9259 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9260 + mm->mmap_base += mm->delta_mmap;
9261 +#endif
9262 +
9263 mm->get_unmapped_area = arch_get_unmapped_area;
9264 } else {
9265 mm->mmap_base = mmap_base();
9266 +
9267 +#ifdef CONFIG_PAX_RANDMMAP
9268 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9269 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
9270 +#endif
9271 +
9272 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
9273 }
9274 }
9275 @@ -170,9 +182,21 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
9276 */
9277 if (mmap_is_legacy()) {
9278 mm->mmap_base = mmap_base_legacy();
9279 +
9280 +#ifdef CONFIG_PAX_RANDMMAP
9281 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9282 + mm->mmap_base += mm->delta_mmap;
9283 +#endif
9284 +
9285 mm->get_unmapped_area = s390_get_unmapped_area;
9286 } else {
9287 mm->mmap_base = mmap_base();
9288 +
9289 +#ifdef CONFIG_PAX_RANDMMAP
9290 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9291 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
9292 +#endif
9293 +
9294 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
9295 }
9296 }
9297 diff --git a/arch/score/include/asm/cache.h b/arch/score/include/asm/cache.h
9298 index ae3d59f..f65f075 100644
9299 --- a/arch/score/include/asm/cache.h
9300 +++ b/arch/score/include/asm/cache.h
9301 @@ -1,7 +1,9 @@
9302 #ifndef _ASM_SCORE_CACHE_H
9303 #define _ASM_SCORE_CACHE_H
9304
9305 +#include <linux/const.h>
9306 +
9307 #define L1_CACHE_SHIFT 4
9308 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9309 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9310
9311 #endif /* _ASM_SCORE_CACHE_H */
9312 diff --git a/arch/score/include/asm/exec.h b/arch/score/include/asm/exec.h
9313 index f9f3cd5..58ff438 100644
9314 --- a/arch/score/include/asm/exec.h
9315 +++ b/arch/score/include/asm/exec.h
9316 @@ -1,6 +1,6 @@
9317 #ifndef _ASM_SCORE_EXEC_H
9318 #define _ASM_SCORE_EXEC_H
9319
9320 -extern unsigned long arch_align_stack(unsigned long sp);
9321 +#define arch_align_stack(x) (x)
9322
9323 #endif /* _ASM_SCORE_EXEC_H */
9324 diff --git a/arch/score/kernel/process.c b/arch/score/kernel/process.c
9325 index a1519ad3..e8ac1ff 100644
9326 --- a/arch/score/kernel/process.c
9327 +++ b/arch/score/kernel/process.c
9328 @@ -116,8 +116,3 @@ unsigned long get_wchan(struct task_struct *task)
9329
9330 return task_pt_regs(task)->cp0_epc;
9331 }
9332 -
9333 -unsigned long arch_align_stack(unsigned long sp)
9334 -{
9335 - return sp;
9336 -}
9337 diff --git a/arch/sh/include/asm/cache.h b/arch/sh/include/asm/cache.h
9338 index ef9e555..331bd29 100644
9339 --- a/arch/sh/include/asm/cache.h
9340 +++ b/arch/sh/include/asm/cache.h
9341 @@ -9,10 +9,11 @@
9342 #define __ASM_SH_CACHE_H
9343 #ifdef __KERNEL__
9344
9345 +#include <linux/const.h>
9346 #include <linux/init.h>
9347 #include <cpu/cache.h>
9348
9349 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
9350 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9351
9352 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
9353
9354 diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c
9355 index 6777177..cb5e44f 100644
9356 --- a/arch/sh/mm/mmap.c
9357 +++ b/arch/sh/mm/mmap.c
9358 @@ -36,6 +36,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9359 struct mm_struct *mm = current->mm;
9360 struct vm_area_struct *vma;
9361 int do_colour_align;
9362 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
9363 struct vm_unmapped_area_info info;
9364
9365 if (flags & MAP_FIXED) {
9366 @@ -55,6 +56,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9367 if (filp || (flags & MAP_SHARED))
9368 do_colour_align = 1;
9369
9370 +#ifdef CONFIG_PAX_RANDMMAP
9371 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9372 +#endif
9373 +
9374 if (addr) {
9375 if (do_colour_align)
9376 addr = COLOUR_ALIGN(addr, pgoff);
9377 @@ -62,14 +67,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
9378 addr = PAGE_ALIGN(addr);
9379
9380 vma = find_vma(mm, addr);
9381 - if (TASK_SIZE - len >= addr &&
9382 - (!vma || addr + len <= vma->vm_start))
9383 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
9384 return addr;
9385 }
9386
9387 info.flags = 0;
9388 info.length = len;
9389 - info.low_limit = TASK_UNMAPPED_BASE;
9390 + info.low_limit = mm->mmap_base;
9391 info.high_limit = TASK_SIZE;
9392 info.align_mask = do_colour_align ? (PAGE_MASK & shm_align_mask) : 0;
9393 info.align_offset = pgoff << PAGE_SHIFT;
9394 @@ -85,6 +89,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9395 struct mm_struct *mm = current->mm;
9396 unsigned long addr = addr0;
9397 int do_colour_align;
9398 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
9399 struct vm_unmapped_area_info info;
9400
9401 if (flags & MAP_FIXED) {
9402 @@ -104,6 +109,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9403 if (filp || (flags & MAP_SHARED))
9404 do_colour_align = 1;
9405
9406 +#ifdef CONFIG_PAX_RANDMMAP
9407 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
9408 +#endif
9409 +
9410 /* requesting a specific address */
9411 if (addr) {
9412 if (do_colour_align)
9413 @@ -112,8 +121,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9414 addr = PAGE_ALIGN(addr);
9415
9416 vma = find_vma(mm, addr);
9417 - if (TASK_SIZE - len >= addr &&
9418 - (!vma || addr + len <= vma->vm_start))
9419 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
9420 return addr;
9421 }
9422
9423 @@ -135,6 +143,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
9424 VM_BUG_ON(addr != -ENOMEM);
9425 info.flags = 0;
9426 info.low_limit = TASK_UNMAPPED_BASE;
9427 +
9428 +#ifdef CONFIG_PAX_RANDMMAP
9429 + if (mm->pax_flags & MF_PAX_RANDMMAP)
9430 + info.low_limit += mm->delta_mmap;
9431 +#endif
9432 +
9433 info.high_limit = TASK_SIZE;
9434 addr = vm_unmapped_area(&info);
9435 }
9436 diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
9437 index be56a24..443328f 100644
9438 --- a/arch/sparc/include/asm/atomic_64.h
9439 +++ b/arch/sparc/include/asm/atomic_64.h
9440 @@ -14,18 +14,40 @@
9441 #define ATOMIC64_INIT(i) { (i) }
9442
9443 #define atomic_read(v) (*(volatile int *)&(v)->counter)
9444 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
9445 +{
9446 + return v->counter;
9447 +}
9448 #define atomic64_read(v) (*(volatile long *)&(v)->counter)
9449 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
9450 +{
9451 + return v->counter;
9452 +}
9453
9454 #define atomic_set(v, i) (((v)->counter) = i)
9455 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
9456 +{
9457 + v->counter = i;
9458 +}
9459 #define atomic64_set(v, i) (((v)->counter) = i)
9460 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
9461 +{
9462 + v->counter = i;
9463 +}
9464
9465 extern void atomic_add(int, atomic_t *);
9466 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
9467 extern void atomic64_add(long, atomic64_t *);
9468 +extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
9469 extern void atomic_sub(int, atomic_t *);
9470 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
9471 extern void atomic64_sub(long, atomic64_t *);
9472 +extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
9473
9474 extern int atomic_add_ret(int, atomic_t *);
9475 +extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
9476 extern long atomic64_add_ret(long, atomic64_t *);
9477 +extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
9478 extern int atomic_sub_ret(int, atomic_t *);
9479 extern long atomic64_sub_ret(long, atomic64_t *);
9480
9481 @@ -33,13 +55,29 @@ extern long atomic64_sub_ret(long, atomic64_t *);
9482 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
9483
9484 #define atomic_inc_return(v) atomic_add_ret(1, v)
9485 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
9486 +{
9487 + return atomic_add_ret_unchecked(1, v);
9488 +}
9489 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
9490 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
9491 +{
9492 + return atomic64_add_ret_unchecked(1, v);
9493 +}
9494
9495 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
9496 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
9497
9498 #define atomic_add_return(i, v) atomic_add_ret(i, v)
9499 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
9500 +{
9501 + return atomic_add_ret_unchecked(i, v);
9502 +}
9503 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
9504 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
9505 +{
9506 + return atomic64_add_ret_unchecked(i, v);
9507 +}
9508
9509 /*
9510 * atomic_inc_and_test - increment and test
9511 @@ -50,6 +88,10 @@ extern long atomic64_sub_ret(long, atomic64_t *);
9512 * other cases.
9513 */
9514 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
9515 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
9516 +{
9517 + return atomic_inc_return_unchecked(v) == 0;
9518 +}
9519 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
9520
9521 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
9522 @@ -59,25 +101,60 @@ extern long atomic64_sub_ret(long, atomic64_t *);
9523 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
9524
9525 #define atomic_inc(v) atomic_add(1, v)
9526 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
9527 +{
9528 + atomic_add_unchecked(1, v);
9529 +}
9530 #define atomic64_inc(v) atomic64_add(1, v)
9531 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
9532 +{
9533 + atomic64_add_unchecked(1, v);
9534 +}
9535
9536 #define atomic_dec(v) atomic_sub(1, v)
9537 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
9538 +{
9539 + atomic_sub_unchecked(1, v);
9540 +}
9541 #define atomic64_dec(v) atomic64_sub(1, v)
9542 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
9543 +{
9544 + atomic64_sub_unchecked(1, v);
9545 +}
9546
9547 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
9548 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
9549
9550 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
9551 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
9552 +{
9553 + return cmpxchg(&v->counter, old, new);
9554 +}
9555 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
9556 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
9557 +{
9558 + return xchg(&v->counter, new);
9559 +}
9560
9561 static inline int __atomic_add_unless(atomic_t *v, int a, int u)
9562 {
9563 - int c, old;
9564 + int c, old, new;
9565 c = atomic_read(v);
9566 for (;;) {
9567 - if (unlikely(c == (u)))
9568 + if (unlikely(c == u))
9569 break;
9570 - old = atomic_cmpxchg((v), c, c + (a));
9571 +
9572 + asm volatile("addcc %2, %0, %0\n"
9573 +
9574 +#ifdef CONFIG_PAX_REFCOUNT
9575 + "tvs %%icc, 6\n"
9576 +#endif
9577 +
9578 + : "=r" (new)
9579 + : "0" (c), "ir" (a)
9580 + : "cc");
9581 +
9582 + old = atomic_cmpxchg(v, c, new);
9583 if (likely(old == c))
9584 break;
9585 c = old;
9586 @@ -88,20 +165,35 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
9587 #define atomic64_cmpxchg(v, o, n) \
9588 ((__typeof__((v)->counter))cmpxchg(&((v)->counter), (o), (n)))
9589 #define atomic64_xchg(v, new) (xchg(&((v)->counter), new))
9590 +static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
9591 +{
9592 + return xchg(&v->counter, new);
9593 +}
9594
9595 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
9596 {
9597 - long c, old;
9598 + long c, old, new;
9599 c = atomic64_read(v);
9600 for (;;) {
9601 - if (unlikely(c == (u)))
9602 + if (unlikely(c == u))
9603 break;
9604 - old = atomic64_cmpxchg((v), c, c + (a));
9605 +
9606 + asm volatile("addcc %2, %0, %0\n"
9607 +
9608 +#ifdef CONFIG_PAX_REFCOUNT
9609 + "tvs %%xcc, 6\n"
9610 +#endif
9611 +
9612 + : "=r" (new)
9613 + : "0" (c), "ir" (a)
9614 + : "cc");
9615 +
9616 + old = atomic64_cmpxchg(v, c, new);
9617 if (likely(old == c))
9618 break;
9619 c = old;
9620 }
9621 - return c != (u);
9622 + return c != u;
9623 }
9624
9625 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
9626 diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
9627 index 5bb6991..5c2132e 100644
9628 --- a/arch/sparc/include/asm/cache.h
9629 +++ b/arch/sparc/include/asm/cache.h
9630 @@ -7,10 +7,12 @@
9631 #ifndef _SPARC_CACHE_H
9632 #define _SPARC_CACHE_H
9633
9634 +#include <linux/const.h>
9635 +
9636 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long long)
9637
9638 #define L1_CACHE_SHIFT 5
9639 -#define L1_CACHE_BYTES 32
9640 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
9641
9642 #ifdef CONFIG_SPARC32
9643 #define SMP_CACHE_BYTES_SHIFT 5
9644 diff --git a/arch/sparc/include/asm/elf_32.h b/arch/sparc/include/asm/elf_32.h
9645 index a24e41f..47677ff 100644
9646 --- a/arch/sparc/include/asm/elf_32.h
9647 +++ b/arch/sparc/include/asm/elf_32.h
9648 @@ -114,6 +114,13 @@ typedef struct {
9649
9650 #define ELF_ET_DYN_BASE (TASK_UNMAPPED_BASE)
9651
9652 +#ifdef CONFIG_PAX_ASLR
9653 +#define PAX_ELF_ET_DYN_BASE 0x10000UL
9654 +
9655 +#define PAX_DELTA_MMAP_LEN 16
9656 +#define PAX_DELTA_STACK_LEN 16
9657 +#endif
9658 +
9659 /* This yields a mask that user programs can use to figure out what
9660 instruction set this cpu supports. This can NOT be done in userspace
9661 on Sparc. */
9662 diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
9663 index 370ca1e..d4f4a98 100644
9664 --- a/arch/sparc/include/asm/elf_64.h
9665 +++ b/arch/sparc/include/asm/elf_64.h
9666 @@ -189,6 +189,13 @@ typedef struct {
9667 #define ELF_ET_DYN_BASE 0x0000010000000000UL
9668 #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
9669
9670 +#ifdef CONFIG_PAX_ASLR
9671 +#define PAX_ELF_ET_DYN_BASE (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
9672 +
9673 +#define PAX_DELTA_MMAP_LEN (test_thread_flag(TIF_32BIT) ? 14 : 28)
9674 +#define PAX_DELTA_STACK_LEN (test_thread_flag(TIF_32BIT) ? 15 : 29)
9675 +#endif
9676 +
9677 extern unsigned long sparc64_elf_hwcap;
9678 #define ELF_HWCAP sparc64_elf_hwcap
9679
9680 diff --git a/arch/sparc/include/asm/pgalloc_32.h b/arch/sparc/include/asm/pgalloc_32.h
9681 index 9b1c36d..209298b 100644
9682 --- a/arch/sparc/include/asm/pgalloc_32.h
9683 +++ b/arch/sparc/include/asm/pgalloc_32.h
9684 @@ -33,6 +33,7 @@ static inline void pgd_set(pgd_t * pgdp, pmd_t * pmdp)
9685 }
9686
9687 #define pgd_populate(MM, PGD, PMD) pgd_set(PGD, PMD)
9688 +#define pgd_populate_kernel(MM, PGD, PMD) pgd_populate((MM), (PGD), (PMD))
9689
9690 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm,
9691 unsigned long address)
9692 diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
9693 index bcfe063..b333142 100644
9694 --- a/arch/sparc/include/asm/pgalloc_64.h
9695 +++ b/arch/sparc/include/asm/pgalloc_64.h
9696 @@ -26,6 +26,7 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
9697 }
9698
9699 #define pud_populate(MM, PUD, PMD) pud_set(PUD, PMD)
9700 +#define pud_populate_kernel(MM, PUD, PMD) pud_populate((MM), (PUD), (PMD))
9701
9702 static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
9703 {
9704 diff --git a/arch/sparc/include/asm/pgtable.h b/arch/sparc/include/asm/pgtable.h
9705 index 59ba6f6..4518128 100644
9706 --- a/arch/sparc/include/asm/pgtable.h
9707 +++ b/arch/sparc/include/asm/pgtable.h
9708 @@ -5,4 +5,8 @@
9709 #else
9710 #include <asm/pgtable_32.h>
9711 #endif
9712 +
9713 +#define ktla_ktva(addr) (addr)
9714 +#define ktva_ktla(addr) (addr)
9715 +
9716 #endif
9717 diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
9718 index 502f632..da1917f 100644
9719 --- a/arch/sparc/include/asm/pgtable_32.h
9720 +++ b/arch/sparc/include/asm/pgtable_32.h
9721 @@ -50,6 +50,9 @@ extern unsigned long calc_highpages(void);
9722 #define PAGE_SHARED SRMMU_PAGE_SHARED
9723 #define PAGE_COPY SRMMU_PAGE_COPY
9724 #define PAGE_READONLY SRMMU_PAGE_RDONLY
9725 +#define PAGE_SHARED_NOEXEC SRMMU_PAGE_SHARED_NOEXEC
9726 +#define PAGE_COPY_NOEXEC SRMMU_PAGE_COPY_NOEXEC
9727 +#define PAGE_READONLY_NOEXEC SRMMU_PAGE_RDONLY_NOEXEC
9728 #define PAGE_KERNEL SRMMU_PAGE_KERNEL
9729
9730 /* Top-level page directory - dummy used by init-mm.
9731 @@ -62,18 +65,18 @@ extern unsigned long ptr_in_current_pgd;
9732
9733 /* xwr */
9734 #define __P000 PAGE_NONE
9735 -#define __P001 PAGE_READONLY
9736 -#define __P010 PAGE_COPY
9737 -#define __P011 PAGE_COPY
9738 +#define __P001 PAGE_READONLY_NOEXEC
9739 +#define __P010 PAGE_COPY_NOEXEC
9740 +#define __P011 PAGE_COPY_NOEXEC
9741 #define __P100 PAGE_READONLY
9742 #define __P101 PAGE_READONLY
9743 #define __P110 PAGE_COPY
9744 #define __P111 PAGE_COPY
9745
9746 #define __S000 PAGE_NONE
9747 -#define __S001 PAGE_READONLY
9748 -#define __S010 PAGE_SHARED
9749 -#define __S011 PAGE_SHARED
9750 +#define __S001 PAGE_READONLY_NOEXEC
9751 +#define __S010 PAGE_SHARED_NOEXEC
9752 +#define __S011 PAGE_SHARED_NOEXEC
9753 #define __S100 PAGE_READONLY
9754 #define __S101 PAGE_READONLY
9755 #define __S110 PAGE_SHARED
9756 diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
9757 index 0f9e945..a949e55 100644
9758 --- a/arch/sparc/include/asm/pgtable_64.h
9759 +++ b/arch/sparc/include/asm/pgtable_64.h
9760 @@ -71,6 +71,23 @@
9761
9762 #include <linux/sched.h>
9763
9764 +extern unsigned long sparc64_valid_addr_bitmap[];
9765 +
9766 +/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
9767 +static inline bool __kern_addr_valid(unsigned long paddr)
9768 +{
9769 + if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL)
9770 + return false;
9771 + return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap);
9772 +}
9773 +
9774 +static inline bool kern_addr_valid(unsigned long addr)
9775 +{
9776 + unsigned long paddr = __pa(addr);
9777 +
9778 + return __kern_addr_valid(paddr);
9779 +}
9780 +
9781 /* Entries per page directory level. */
9782 #define PTRS_PER_PTE (1UL << (PAGE_SHIFT-3))
9783 #define PTRS_PER_PMD (1UL << PMD_BITS)
9784 @@ -79,9 +96,12 @@
9785 /* Kernel has a separate 44bit address space. */
9786 #define FIRST_USER_ADDRESS 0
9787
9788 -#define pte_ERROR(e) __builtin_trap()
9789 -#define pmd_ERROR(e) __builtin_trap()
9790 -#define pgd_ERROR(e) __builtin_trap()
9791 +#define pmd_ERROR(e) \
9792 + pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n", \
9793 + __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0))
9794 +#define pgd_ERROR(e) \
9795 + pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n", \
9796 + __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0))
9797
9798 #endif /* !(__ASSEMBLY__) */
9799
9800 @@ -633,7 +653,7 @@ static inline unsigned long pmd_large(pmd_t pmd)
9801 {
9802 pte_t pte = __pte(pmd_val(pmd));
9803
9804 - return (pte_val(pte) & _PAGE_PMD_HUGE) && pte_present(pte);
9805 + return pte_val(pte) & _PAGE_PMD_HUGE;
9806 }
9807
9808 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
9809 @@ -719,20 +739,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd)
9810 return __pmd(pte_val(pte));
9811 }
9812
9813 -static inline pmd_t pmd_mknotpresent(pmd_t pmd)
9814 -{
9815 - unsigned long mask;
9816 -
9817 - if (tlb_type == hypervisor)
9818 - mask = _PAGE_PRESENT_4V;
9819 - else
9820 - mask = _PAGE_PRESENT_4U;
9821 -
9822 - pmd_val(pmd) &= ~mask;
9823 -
9824 - return pmd;
9825 -}
9826 -
9827 static inline pmd_t pmd_mksplitting(pmd_t pmd)
9828 {
9829 pte_t pte = __pte(pmd_val(pmd));
9830 @@ -757,6 +763,20 @@ static inline int pmd_present(pmd_t pmd)
9831
9832 #define pmd_none(pmd) (!pmd_val(pmd))
9833
9834 +/* pmd_bad() is only called on non-trans-huge PMDs. Our encoding is
9835 + * very simple, it's just the physical address. PTE tables are of
9836 + * size PAGE_SIZE so make sure the sub-PAGE_SIZE bits are clear and
9837 + * the top bits outside of the range of any physical address size we
9838 + * support are clear as well. We also validate the physical itself.
9839 + */
9840 +#define pmd_bad(pmd) ((pmd_val(pmd) & ~PAGE_MASK) || \
9841 + !__kern_addr_valid(pmd_val(pmd)))
9842 +
9843 +#define pud_none(pud) (!pud_val(pud))
9844 +
9845 +#define pud_bad(pud) ((pud_val(pud) & ~PAGE_MASK) || \
9846 + !__kern_addr_valid(pud_val(pud)))
9847 +
9848 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
9849 extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
9850 pmd_t *pmdp, pmd_t pmd);
9851 @@ -790,10 +810,7 @@ static inline unsigned long __pmd_page(pmd_t pmd)
9852 #define pud_page_vaddr(pud) \
9853 ((unsigned long) __va(pud_val(pud)))
9854 #define pud_page(pud) virt_to_page((void *)pud_page_vaddr(pud))
9855 -#define pmd_bad(pmd) (0)
9856 #define pmd_clear(pmdp) (pmd_val(*(pmdp)) = 0UL)
9857 -#define pud_none(pud) (!pud_val(pud))
9858 -#define pud_bad(pud) (0)
9859 #define pud_present(pud) (pud_val(pud) != 0U)
9860 #define pud_clear(pudp) (pud_val(*(pudp)) = 0UL)
9861
9862 @@ -893,6 +910,10 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
9863 extern void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
9864 pmd_t *pmd);
9865
9866 +#define __HAVE_ARCH_PMDP_INVALIDATE
9867 +extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
9868 + pmd_t *pmdp);
9869 +
9870 #define __HAVE_ARCH_PGTABLE_DEPOSIT
9871 extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
9872 pgtable_t pgtable);
9873 @@ -919,18 +940,6 @@ extern unsigned long pte_file(pte_t);
9874 extern pte_t pgoff_to_pte(unsigned long);
9875 #define PTE_FILE_MAX_BITS (64UL - PAGE_SHIFT - 1UL)
9876
9877 -extern unsigned long sparc64_valid_addr_bitmap[];
9878 -
9879 -/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
9880 -static inline bool kern_addr_valid(unsigned long addr)
9881 -{
9882 - unsigned long paddr = __pa(addr);
9883 -
9884 - if ((paddr >> 41UL) != 0UL)
9885 - return false;
9886 - return test_bit(paddr >> 22, sparc64_valid_addr_bitmap);
9887 -}
9888 -
9889 extern int page_in_phys_avail(unsigned long paddr);
9890
9891 /*
9892 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
9893 index 79da178..c2eede8 100644
9894 --- a/arch/sparc/include/asm/pgtsrmmu.h
9895 +++ b/arch/sparc/include/asm/pgtsrmmu.h
9896 @@ -115,6 +115,11 @@
9897 SRMMU_EXEC | SRMMU_REF)
9898 #define SRMMU_PAGE_RDONLY __pgprot(SRMMU_VALID | SRMMU_CACHE | \
9899 SRMMU_EXEC | SRMMU_REF)
9900 +
9901 +#define SRMMU_PAGE_SHARED_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
9902 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
9903 +#define SRMMU_PAGE_RDONLY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
9904 +
9905 #define SRMMU_PAGE_KERNEL __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
9906 SRMMU_DIRTY | SRMMU_REF)
9907
9908 diff --git a/arch/sparc/include/asm/spinlock_64.h b/arch/sparc/include/asm/spinlock_64.h
9909 index 9689176..63c18ea 100644
9910 --- a/arch/sparc/include/asm/spinlock_64.h
9911 +++ b/arch/sparc/include/asm/spinlock_64.h
9912 @@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long fla
9913
9914 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
9915
9916 -static void inline arch_read_lock(arch_rwlock_t *lock)
9917 +static inline void arch_read_lock(arch_rwlock_t *lock)
9918 {
9919 unsigned long tmp1, tmp2;
9920
9921 __asm__ __volatile__ (
9922 "1: ldsw [%2], %0\n"
9923 " brlz,pn %0, 2f\n"
9924 -"4: add %0, 1, %1\n"
9925 +"4: addcc %0, 1, %1\n"
9926 +
9927 +#ifdef CONFIG_PAX_REFCOUNT
9928 +" tvs %%icc, 6\n"
9929 +#endif
9930 +
9931 " cas [%2], %0, %1\n"
9932 " cmp %0, %1\n"
9933 " bne,pn %%icc, 1b\n"
9934 @@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_rwlock_t *lock)
9935 " .previous"
9936 : "=&r" (tmp1), "=&r" (tmp2)
9937 : "r" (lock)
9938 - : "memory");
9939 + : "memory", "cc");
9940 }
9941
9942 -static int inline arch_read_trylock(arch_rwlock_t *lock)
9943 +static inline int arch_read_trylock(arch_rwlock_t *lock)
9944 {
9945 int tmp1, tmp2;
9946
9947 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
9948 "1: ldsw [%2], %0\n"
9949 " brlz,a,pn %0, 2f\n"
9950 " mov 0, %0\n"
9951 -" add %0, 1, %1\n"
9952 +" addcc %0, 1, %1\n"
9953 +
9954 +#ifdef CONFIG_PAX_REFCOUNT
9955 +" tvs %%icc, 6\n"
9956 +#endif
9957 +
9958 " cas [%2], %0, %1\n"
9959 " cmp %0, %1\n"
9960 " bne,pn %%icc, 1b\n"
9961 @@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch_rwlock_t *lock)
9962 return tmp1;
9963 }
9964
9965 -static void inline arch_read_unlock(arch_rwlock_t *lock)
9966 +static inline void arch_read_unlock(arch_rwlock_t *lock)
9967 {
9968 unsigned long tmp1, tmp2;
9969
9970 __asm__ __volatile__(
9971 "1: lduw [%2], %0\n"
9972 -" sub %0, 1, %1\n"
9973 +" subcc %0, 1, %1\n"
9974 +
9975 +#ifdef CONFIG_PAX_REFCOUNT
9976 +" tvs %%icc, 6\n"
9977 +#endif
9978 +
9979 " cas [%2], %0, %1\n"
9980 " cmp %0, %1\n"
9981 " bne,pn %%xcc, 1b\n"
9982 @@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch_rwlock_t *lock)
9983 : "memory");
9984 }
9985
9986 -static void inline arch_write_lock(arch_rwlock_t *lock)
9987 +static inline void arch_write_lock(arch_rwlock_t *lock)
9988 {
9989 unsigned long mask, tmp1, tmp2;
9990
9991 @@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_rwlock_t *lock)
9992 : "memory");
9993 }
9994
9995 -static void inline arch_write_unlock(arch_rwlock_t *lock)
9996 +static inline void arch_write_unlock(arch_rwlock_t *lock)
9997 {
9998 __asm__ __volatile__(
9999 " stw %%g0, [%0]"
10000 @@ -186,7 +201,7 @@ static void inline arch_write_unlock(arch_rwlock_t *lock)
10001 : "memory");
10002 }
10003
10004 -static int inline arch_write_trylock(arch_rwlock_t *lock)
10005 +static inline int arch_write_trylock(arch_rwlock_t *lock)
10006 {
10007 unsigned long mask, tmp1, tmp2, result;
10008
10009 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
10010 index 96efa7a..16858bf 100644
10011 --- a/arch/sparc/include/asm/thread_info_32.h
10012 +++ b/arch/sparc/include/asm/thread_info_32.h
10013 @@ -49,6 +49,8 @@ struct thread_info {
10014 unsigned long w_saved;
10015
10016 struct restart_block restart_block;
10017 +
10018 + unsigned long lowest_stack;
10019 };
10020
10021 /*
10022 diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
10023 index a5f01ac..703b554 100644
10024 --- a/arch/sparc/include/asm/thread_info_64.h
10025 +++ b/arch/sparc/include/asm/thread_info_64.h
10026 @@ -63,6 +63,8 @@ struct thread_info {
10027 struct pt_regs *kern_una_regs;
10028 unsigned int kern_una_insn;
10029
10030 + unsigned long lowest_stack;
10031 +
10032 unsigned long fpregs[0] __attribute__ ((aligned(64)));
10033 };
10034
10035 @@ -188,12 +190,13 @@ register struct thread_info *current_thread_info_reg asm("g6");
10036 #define TIF_NEED_RESCHED 3 /* rescheduling necessary */
10037 /* flag bit 4 is available */
10038 #define TIF_UNALIGNED 5 /* allowed to do unaligned accesses */
10039 -/* flag bit 6 is available */
10040 +#define TIF_GRSEC_SETXID 6 /* update credentials on syscall entry/exit */
10041 #define TIF_32BIT 7 /* 32-bit binary */
10042 #define TIF_NOHZ 8 /* in adaptive nohz mode */
10043 #define TIF_SECCOMP 9 /* secure computing */
10044 #define TIF_SYSCALL_AUDIT 10 /* syscall auditing active */
10045 #define TIF_SYSCALL_TRACEPOINT 11 /* syscall tracepoint instrumentation */
10046 +
10047 /* NOTE: Thread flags >= 12 should be ones we have no interest
10048 * in using in assembly, else we can't use the mask as
10049 * an immediate value in instructions such as andcc.
10050 @@ -213,12 +216,18 @@ register struct thread_info *current_thread_info_reg asm("g6");
10051 #define _TIF_SYSCALL_AUDIT (1<<TIF_SYSCALL_AUDIT)
10052 #define _TIF_SYSCALL_TRACEPOINT (1<<TIF_SYSCALL_TRACEPOINT)
10053 #define _TIF_POLLING_NRFLAG (1<<TIF_POLLING_NRFLAG)
10054 +#define _TIF_GRSEC_SETXID (1<<TIF_GRSEC_SETXID)
10055
10056 #define _TIF_USER_WORK_MASK ((0xff << TI_FLAG_WSAVED_SHIFT) | \
10057 _TIF_DO_NOTIFY_RESUME_MASK | \
10058 _TIF_NEED_RESCHED)
10059 #define _TIF_DO_NOTIFY_RESUME_MASK (_TIF_NOTIFY_RESUME | _TIF_SIGPENDING)
10060
10061 +#define _TIF_WORK_SYSCALL \
10062 + (_TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT | \
10063 + _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ | _TIF_GRSEC_SETXID)
10064 +
10065 +
10066 /*
10067 * Thread-synchronous status.
10068 *
10069 diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
10070 index 2230f80..90916f9 100644
10071 --- a/arch/sparc/include/asm/tsb.h
10072 +++ b/arch/sparc/include/asm/tsb.h
10073 @@ -171,7 +171,8 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
10074 andcc REG1, REG2, %g0; \
10075 be,pt %xcc, 700f; \
10076 sethi %hi(4 * 1024 * 1024), REG2; \
10077 - andn REG1, REG2, REG1; \
10078 + brgez,pn REG1, FAIL_LABEL; \
10079 + andn REG1, REG2, REG1; \
10080 and VADDR, REG2, REG2; \
10081 brlz,pt REG1, PTE_LABEL; \
10082 or REG1, REG2, REG1; \
10083 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
10084 index 0167d26..767bb0c 100644
10085 --- a/arch/sparc/include/asm/uaccess.h
10086 +++ b/arch/sparc/include/asm/uaccess.h
10087 @@ -1,5 +1,6 @@
10088 #ifndef ___ASM_SPARC_UACCESS_H
10089 #define ___ASM_SPARC_UACCESS_H
10090 +
10091 #if defined(__sparc__) && defined(__arch64__)
10092 #include <asm/uaccess_64.h>
10093 #else
10094 diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
10095 index 53a28dd..50c38c3 100644
10096 --- a/arch/sparc/include/asm/uaccess_32.h
10097 +++ b/arch/sparc/include/asm/uaccess_32.h
10098 @@ -250,27 +250,46 @@ extern unsigned long __copy_user(void __user *to, const void __user *from, unsig
10099
10100 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
10101 {
10102 - if (n && __access_ok((unsigned long) to, n))
10103 + if ((long)n < 0)
10104 + return n;
10105 +
10106 + if (n && __access_ok((unsigned long) to, n)) {
10107 + if (!__builtin_constant_p(n))
10108 + check_object_size(from, n, true);
10109 return __copy_user(to, (__force void __user *) from, n);
10110 - else
10111 + } else
10112 return n;
10113 }
10114
10115 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
10116 {
10117 + if ((long)n < 0)
10118 + return n;
10119 +
10120 + if (!__builtin_constant_p(n))
10121 + check_object_size(from, n, true);
10122 +
10123 return __copy_user(to, (__force void __user *) from, n);
10124 }
10125
10126 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
10127 {
10128 - if (n && __access_ok((unsigned long) from, n))
10129 + if ((long)n < 0)
10130 + return n;
10131 +
10132 + if (n && __access_ok((unsigned long) from, n)) {
10133 + if (!__builtin_constant_p(n))
10134 + check_object_size(to, n, false);
10135 return __copy_user((__force void __user *) to, from, n);
10136 - else
10137 + } else
10138 return n;
10139 }
10140
10141 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
10142 {
10143 + if ((long)n < 0)
10144 + return n;
10145 +
10146 return __copy_user((__force void __user *) to, from, n);
10147 }
10148
10149 diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
10150 index ad7e178..c9e7423 100644
10151 --- a/arch/sparc/include/asm/uaccess_64.h
10152 +++ b/arch/sparc/include/asm/uaccess_64.h
10153 @@ -10,6 +10,7 @@
10154 #include <linux/compiler.h>
10155 #include <linux/string.h>
10156 #include <linux/thread_info.h>
10157 +#include <linux/kernel.h>
10158 #include <asm/asi.h>
10159 #include <asm/spitfire.h>
10160 #include <asm-generic/uaccess-unaligned.h>
10161 @@ -214,8 +215,15 @@ extern unsigned long copy_from_user_fixup(void *to, const void __user *from,
10162 static inline unsigned long __must_check
10163 copy_from_user(void *to, const void __user *from, unsigned long size)
10164 {
10165 - unsigned long ret = ___copy_from_user(to, from, size);
10166 + unsigned long ret;
10167
10168 + if ((long)size < 0 || size > INT_MAX)
10169 + return size;
10170 +
10171 + if (!__builtin_constant_p(size))
10172 + check_object_size(to, size, false);
10173 +
10174 + ret = ___copy_from_user(to, from, size);
10175 if (unlikely(ret))
10176 ret = copy_from_user_fixup(to, from, size);
10177
10178 @@ -231,8 +239,15 @@ extern unsigned long copy_to_user_fixup(void __user *to, const void *from,
10179 static inline unsigned long __must_check
10180 copy_to_user(void __user *to, const void *from, unsigned long size)
10181 {
10182 - unsigned long ret = ___copy_to_user(to, from, size);
10183 + unsigned long ret;
10184
10185 + if ((long)size < 0 || size > INT_MAX)
10186 + return size;
10187 +
10188 + if (!__builtin_constant_p(size))
10189 + check_object_size(from, size, true);
10190 +
10191 + ret = ___copy_to_user(to, from, size);
10192 if (unlikely(ret))
10193 ret = copy_to_user_fixup(to, from, size);
10194 return ret;
10195 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
10196 index d15cc17..d0ae796 100644
10197 --- a/arch/sparc/kernel/Makefile
10198 +++ b/arch/sparc/kernel/Makefile
10199 @@ -4,7 +4,7 @@
10200 #
10201
10202 asflags-y := -ansi
10203 -ccflags-y := -Werror
10204 +#ccflags-y := -Werror
10205
10206 extra-y := head_$(BITS).o
10207
10208 diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
10209 index 510baec..9ff2607 100644
10210 --- a/arch/sparc/kernel/process_32.c
10211 +++ b/arch/sparc/kernel/process_32.c
10212 @@ -115,14 +115,14 @@ void show_regs(struct pt_regs *r)
10213
10214 printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx %s\n",
10215 r->psr, r->pc, r->npc, r->y, print_tainted());
10216 - printk("PC: <%pS>\n", (void *) r->pc);
10217 + printk("PC: <%pA>\n", (void *) r->pc);
10218 printk("%%G: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10219 r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
10220 r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
10221 printk("%%O: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10222 r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
10223 r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
10224 - printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
10225 + printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
10226
10227 printk("%%L: %08lx %08lx %08lx %08lx %08lx %08lx %08lx %08lx\n",
10228 rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
10229 @@ -159,7 +159,7 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
10230 rw = (struct reg_window32 *) fp;
10231 pc = rw->ins[7];
10232 printk("[%08lx : ", pc);
10233 - printk("%pS ] ", (void *) pc);
10234 + printk("%pA ] ", (void *) pc);
10235 fp = rw->ins[6];
10236 } while (++count < 16);
10237 printk("\n");
10238 diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
10239 index d7b4967..2edf827 100644
10240 --- a/arch/sparc/kernel/process_64.c
10241 +++ b/arch/sparc/kernel/process_64.c
10242 @@ -161,7 +161,7 @@ static void show_regwindow(struct pt_regs *regs)
10243 printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
10244 rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
10245 if (regs->tstate & TSTATE_PRIV)
10246 - printk("I7: <%pS>\n", (void *) rwk->ins[7]);
10247 + printk("I7: <%pA>\n", (void *) rwk->ins[7]);
10248 }
10249
10250 void show_regs(struct pt_regs *regs)
10251 @@ -170,7 +170,7 @@ void show_regs(struct pt_regs *regs)
10252
10253 printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x %s\n", regs->tstate,
10254 regs->tpc, regs->tnpc, regs->y, print_tainted());
10255 - printk("TPC: <%pS>\n", (void *) regs->tpc);
10256 + printk("TPC: <%pA>\n", (void *) regs->tpc);
10257 printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
10258 regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
10259 regs->u_regs[3]);
10260 @@ -183,7 +183,7 @@ void show_regs(struct pt_regs *regs)
10261 printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
10262 regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
10263 regs->u_regs[15]);
10264 - printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
10265 + printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
10266 show_regwindow(regs);
10267 show_stack(current, (unsigned long *) regs->u_regs[UREG_FP]);
10268 }
10269 @@ -272,7 +272,7 @@ void arch_trigger_all_cpu_backtrace(void)
10270 ((tp && tp->task) ? tp->task->pid : -1));
10271
10272 if (gp->tstate & TSTATE_PRIV) {
10273 - printk(" TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
10274 + printk(" TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
10275 (void *) gp->tpc,
10276 (void *) gp->o7,
10277 (void *) gp->i7,
10278 diff --git a/arch/sparc/kernel/prom_common.c b/arch/sparc/kernel/prom_common.c
10279 index 79cc0d1..ec62734 100644
10280 --- a/arch/sparc/kernel/prom_common.c
10281 +++ b/arch/sparc/kernel/prom_common.c
10282 @@ -144,7 +144,7 @@ static int __init prom_common_nextprop(phandle node, char *prev, char *buf)
10283
10284 unsigned int prom_early_allocated __initdata;
10285
10286 -static struct of_pdt_ops prom_sparc_ops __initdata = {
10287 +static struct of_pdt_ops prom_sparc_ops __initconst = {
10288 .nextprop = prom_common_nextprop,
10289 .getproplen = prom_getproplen,
10290 .getproperty = prom_getproperty,
10291 diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
10292 index c13c9f2..d572c34 100644
10293 --- a/arch/sparc/kernel/ptrace_64.c
10294 +++ b/arch/sparc/kernel/ptrace_64.c
10295 @@ -1060,6 +1060,10 @@ long arch_ptrace(struct task_struct *child, long request,
10296 return ret;
10297 }
10298
10299 +#ifdef CONFIG_GRKERNSEC_SETXID
10300 +extern void gr_delayed_cred_worker(void);
10301 +#endif
10302 +
10303 asmlinkage int syscall_trace_enter(struct pt_regs *regs)
10304 {
10305 int ret = 0;
10306 @@ -1070,6 +1074,11 @@ asmlinkage int syscall_trace_enter(struct pt_regs *regs)
10307 if (test_thread_flag(TIF_NOHZ))
10308 user_exit();
10309
10310 +#ifdef CONFIG_GRKERNSEC_SETXID
10311 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
10312 + gr_delayed_cred_worker();
10313 +#endif
10314 +
10315 if (test_thread_flag(TIF_SYSCALL_TRACE))
10316 ret = tracehook_report_syscall_entry(regs);
10317
10318 @@ -1093,6 +1102,11 @@ asmlinkage void syscall_trace_leave(struct pt_regs *regs)
10319 if (test_thread_flag(TIF_NOHZ))
10320 user_exit();
10321
10322 +#ifdef CONFIG_GRKERNSEC_SETXID
10323 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
10324 + gr_delayed_cred_worker();
10325 +#endif
10326 +
10327 audit_syscall_exit(regs);
10328
10329 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
10330 diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
10331 index b085311..6f885f7 100644
10332 --- a/arch/sparc/kernel/smp_64.c
10333 +++ b/arch/sparc/kernel/smp_64.c
10334 @@ -870,8 +870,8 @@ extern unsigned long xcall_flush_dcache_page_cheetah;
10335 extern unsigned long xcall_flush_dcache_page_spitfire;
10336
10337 #ifdef CONFIG_DEBUG_DCFLUSH
10338 -extern atomic_t dcpage_flushes;
10339 -extern atomic_t dcpage_flushes_xcall;
10340 +extern atomic_unchecked_t dcpage_flushes;
10341 +extern atomic_unchecked_t dcpage_flushes_xcall;
10342 #endif
10343
10344 static inline void __local_flush_dcache_page(struct page *page)
10345 @@ -895,7 +895,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
10346 return;
10347
10348 #ifdef CONFIG_DEBUG_DCFLUSH
10349 - atomic_inc(&dcpage_flushes);
10350 + atomic_inc_unchecked(&dcpage_flushes);
10351 #endif
10352
10353 this_cpu = get_cpu();
10354 @@ -919,7 +919,7 @@ void smp_flush_dcache_page_impl(struct page *page, int cpu)
10355 xcall_deliver(data0, __pa(pg_addr),
10356 (u64) pg_addr, cpumask_of(cpu));
10357 #ifdef CONFIG_DEBUG_DCFLUSH
10358 - atomic_inc(&dcpage_flushes_xcall);
10359 + atomic_inc_unchecked(&dcpage_flushes_xcall);
10360 #endif
10361 }
10362 }
10363 @@ -938,7 +938,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
10364 preempt_disable();
10365
10366 #ifdef CONFIG_DEBUG_DCFLUSH
10367 - atomic_inc(&dcpage_flushes);
10368 + atomic_inc_unchecked(&dcpage_flushes);
10369 #endif
10370 data0 = 0;
10371 pg_addr = page_address(page);
10372 @@ -955,7 +955,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
10373 xcall_deliver(data0, __pa(pg_addr),
10374 (u64) pg_addr, cpu_online_mask);
10375 #ifdef CONFIG_DEBUG_DCFLUSH
10376 - atomic_inc(&dcpage_flushes_xcall);
10377 + atomic_inc_unchecked(&dcpage_flushes_xcall);
10378 #endif
10379 }
10380 __local_flush_dcache_page(page);
10381 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
10382 index 3a8d184..49498a8 100644
10383 --- a/arch/sparc/kernel/sys_sparc_32.c
10384 +++ b/arch/sparc/kernel/sys_sparc_32.c
10385 @@ -52,7 +52,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10386 if (len > TASK_SIZE - PAGE_SIZE)
10387 return -ENOMEM;
10388 if (!addr)
10389 - addr = TASK_UNMAPPED_BASE;
10390 + addr = current->mm->mmap_base;
10391
10392 info.flags = 0;
10393 info.length = len;
10394 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
10395 index beb0b5a..5a153f7 100644
10396 --- a/arch/sparc/kernel/sys_sparc_64.c
10397 +++ b/arch/sparc/kernel/sys_sparc_64.c
10398 @@ -88,13 +88,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10399 struct vm_area_struct * vma;
10400 unsigned long task_size = TASK_SIZE;
10401 int do_color_align;
10402 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
10403 struct vm_unmapped_area_info info;
10404
10405 if (flags & MAP_FIXED) {
10406 /* We do not accept a shared mapping if it would violate
10407 * cache aliasing constraints.
10408 */
10409 - if ((flags & MAP_SHARED) &&
10410 + if ((filp || (flags & MAP_SHARED)) &&
10411 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
10412 return -EINVAL;
10413 return addr;
10414 @@ -109,6 +110,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10415 if (filp || (flags & MAP_SHARED))
10416 do_color_align = 1;
10417
10418 +#ifdef CONFIG_PAX_RANDMMAP
10419 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10420 +#endif
10421 +
10422 if (addr) {
10423 if (do_color_align)
10424 addr = COLOR_ALIGN(addr, pgoff);
10425 @@ -116,22 +121,28 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
10426 addr = PAGE_ALIGN(addr);
10427
10428 vma = find_vma(mm, addr);
10429 - if (task_size - len >= addr &&
10430 - (!vma || addr + len <= vma->vm_start))
10431 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
10432 return addr;
10433 }
10434
10435 info.flags = 0;
10436 info.length = len;
10437 - info.low_limit = TASK_UNMAPPED_BASE;
10438 + info.low_limit = mm->mmap_base;
10439 info.high_limit = min(task_size, VA_EXCLUDE_START);
10440 info.align_mask = do_color_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
10441 info.align_offset = pgoff << PAGE_SHIFT;
10442 + info.threadstack_offset = offset;
10443 addr = vm_unmapped_area(&info);
10444
10445 if ((addr & ~PAGE_MASK) && task_size > VA_EXCLUDE_END) {
10446 VM_BUG_ON(addr != -ENOMEM);
10447 info.low_limit = VA_EXCLUDE_END;
10448 +
10449 +#ifdef CONFIG_PAX_RANDMMAP
10450 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10451 + info.low_limit += mm->delta_mmap;
10452 +#endif
10453 +
10454 info.high_limit = task_size;
10455 addr = vm_unmapped_area(&info);
10456 }
10457 @@ -149,6 +160,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10458 unsigned long task_size = STACK_TOP32;
10459 unsigned long addr = addr0;
10460 int do_color_align;
10461 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
10462 struct vm_unmapped_area_info info;
10463
10464 /* This should only ever run for 32-bit processes. */
10465 @@ -158,7 +170,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10466 /* We do not accept a shared mapping if it would violate
10467 * cache aliasing constraints.
10468 */
10469 - if ((flags & MAP_SHARED) &&
10470 + if ((filp || (flags & MAP_SHARED)) &&
10471 ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
10472 return -EINVAL;
10473 return addr;
10474 @@ -171,6 +183,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10475 if (filp || (flags & MAP_SHARED))
10476 do_color_align = 1;
10477
10478 +#ifdef CONFIG_PAX_RANDMMAP
10479 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10480 +#endif
10481 +
10482 /* requesting a specific address */
10483 if (addr) {
10484 if (do_color_align)
10485 @@ -179,8 +195,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10486 addr = PAGE_ALIGN(addr);
10487
10488 vma = find_vma(mm, addr);
10489 - if (task_size - len >= addr &&
10490 - (!vma || addr + len <= vma->vm_start))
10491 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
10492 return addr;
10493 }
10494
10495 @@ -190,6 +205,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10496 info.high_limit = mm->mmap_base;
10497 info.align_mask = do_color_align ? (PAGE_MASK & (SHMLBA - 1)) : 0;
10498 info.align_offset = pgoff << PAGE_SHIFT;
10499 + info.threadstack_offset = offset;
10500 addr = vm_unmapped_area(&info);
10501
10502 /*
10503 @@ -202,6 +218,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
10504 VM_BUG_ON(addr != -ENOMEM);
10505 info.flags = 0;
10506 info.low_limit = TASK_UNMAPPED_BASE;
10507 +
10508 +#ifdef CONFIG_PAX_RANDMMAP
10509 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10510 + info.low_limit += mm->delta_mmap;
10511 +#endif
10512 +
10513 info.high_limit = STACK_TOP32;
10514 addr = vm_unmapped_area(&info);
10515 }
10516 @@ -258,10 +280,14 @@ unsigned long get_fb_unmapped_area(struct file *filp, unsigned long orig_addr, u
10517 EXPORT_SYMBOL(get_fb_unmapped_area);
10518
10519 /* Essentially the same as PowerPC. */
10520 -static unsigned long mmap_rnd(void)
10521 +static unsigned long mmap_rnd(struct mm_struct *mm)
10522 {
10523 unsigned long rnd = 0UL;
10524
10525 +#ifdef CONFIG_PAX_RANDMMAP
10526 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
10527 +#endif
10528 +
10529 if (current->flags & PF_RANDOMIZE) {
10530 unsigned long val = get_random_int();
10531 if (test_thread_flag(TIF_32BIT))
10532 @@ -274,7 +300,7 @@ static unsigned long mmap_rnd(void)
10533
10534 void arch_pick_mmap_layout(struct mm_struct *mm)
10535 {
10536 - unsigned long random_factor = mmap_rnd();
10537 + unsigned long random_factor = mmap_rnd(mm);
10538 unsigned long gap;
10539
10540 /*
10541 @@ -287,6 +313,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
10542 gap == RLIM_INFINITY ||
10543 sysctl_legacy_va_layout) {
10544 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
10545 +
10546 +#ifdef CONFIG_PAX_RANDMMAP
10547 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10548 + mm->mmap_base += mm->delta_mmap;
10549 +#endif
10550 +
10551 mm->get_unmapped_area = arch_get_unmapped_area;
10552 } else {
10553 /* We know it's 32-bit */
10554 @@ -298,6 +330,12 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
10555 gap = (task_size / 6 * 5);
10556
10557 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
10558 +
10559 +#ifdef CONFIG_PAX_RANDMMAP
10560 + if (mm->pax_flags & MF_PAX_RANDMMAP)
10561 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
10562 +#endif
10563 +
10564 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
10565 }
10566 }
10567 diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S
10568 index 33a17e7..d87fb1f 100644
10569 --- a/arch/sparc/kernel/syscalls.S
10570 +++ b/arch/sparc/kernel/syscalls.S
10571 @@ -52,7 +52,7 @@ sys32_rt_sigreturn:
10572 #endif
10573 .align 32
10574 1: ldx [%g6 + TI_FLAGS], %l5
10575 - andcc %l5, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10576 + andcc %l5, _TIF_WORK_SYSCALL, %g0
10577 be,pt %icc, rtrap
10578 nop
10579 call syscall_trace_leave
10580 @@ -184,7 +184,7 @@ linux_sparc_syscall32:
10581
10582 srl %i3, 0, %o3 ! IEU0
10583 srl %i2, 0, %o2 ! IEU0 Group
10584 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10585 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10586 bne,pn %icc, linux_syscall_trace32 ! CTI
10587 mov %i0, %l5 ! IEU1
10588 5: call %l7 ! CTI Group brk forced
10589 @@ -208,7 +208,7 @@ linux_sparc_syscall:
10590
10591 mov %i3, %o3 ! IEU1
10592 mov %i4, %o4 ! IEU0 Group
10593 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10594 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10595 bne,pn %icc, linux_syscall_trace ! CTI Group
10596 mov %i0, %l5 ! IEU0
10597 2: call %l7 ! CTI Group brk forced
10598 @@ -223,7 +223,7 @@ ret_sys_call:
10599
10600 cmp %o0, -ERESTART_RESTARTBLOCK
10601 bgeu,pn %xcc, 1f
10602 - andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT|_TIF_NOHZ), %g0
10603 + andcc %l0, _TIF_WORK_SYSCALL, %g0
10604 ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc
10605
10606 2:
10607 diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c
10608 index 6629829..036032d 100644
10609 --- a/arch/sparc/kernel/traps_32.c
10610 +++ b/arch/sparc/kernel/traps_32.c
10611 @@ -44,6 +44,8 @@ static void instruction_dump(unsigned long *pc)
10612 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
10613 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
10614
10615 +extern void gr_handle_kernel_exploit(void);
10616 +
10617 void die_if_kernel(char *str, struct pt_regs *regs)
10618 {
10619 static int die_counter;
10620 @@ -76,15 +78,17 @@ void die_if_kernel(char *str, struct pt_regs *regs)
10621 count++ < 30 &&
10622 (((unsigned long) rw) >= PAGE_OFFSET) &&
10623 !(((unsigned long) rw) & 0x7)) {
10624 - printk("Caller[%08lx]: %pS\n", rw->ins[7],
10625 + printk("Caller[%08lx]: %pA\n", rw->ins[7],
10626 (void *) rw->ins[7]);
10627 rw = (struct reg_window32 *)rw->ins[6];
10628 }
10629 }
10630 printk("Instruction DUMP:");
10631 instruction_dump ((unsigned long *) regs->pc);
10632 - if(regs->psr & PSR_PS)
10633 + if(regs->psr & PSR_PS) {
10634 + gr_handle_kernel_exploit();
10635 do_exit(SIGKILL);
10636 + }
10637 do_exit(SIGSEGV);
10638 }
10639
10640 diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
10641 index 4ced92f..965eeed 100644
10642 --- a/arch/sparc/kernel/traps_64.c
10643 +++ b/arch/sparc/kernel/traps_64.c
10644 @@ -77,7 +77,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
10645 i + 1,
10646 p->trapstack[i].tstate, p->trapstack[i].tpc,
10647 p->trapstack[i].tnpc, p->trapstack[i].tt);
10648 - printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
10649 + printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
10650 }
10651 }
10652
10653 @@ -97,6 +97,12 @@ void bad_trap(struct pt_regs *regs, long lvl)
10654
10655 lvl -= 0x100;
10656 if (regs->tstate & TSTATE_PRIV) {
10657 +
10658 +#ifdef CONFIG_PAX_REFCOUNT
10659 + if (lvl == 6)
10660 + pax_report_refcount_overflow(regs);
10661 +#endif
10662 +
10663 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
10664 die_if_kernel(buffer, regs);
10665 }
10666 @@ -115,11 +121,16 @@ void bad_trap(struct pt_regs *regs, long lvl)
10667 void bad_trap_tl1(struct pt_regs *regs, long lvl)
10668 {
10669 char buffer[32];
10670 -
10671 +
10672 if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
10673 0, lvl, SIGTRAP) == NOTIFY_STOP)
10674 return;
10675
10676 +#ifdef CONFIG_PAX_REFCOUNT
10677 + if (lvl == 6)
10678 + pax_report_refcount_overflow(regs);
10679 +#endif
10680 +
10681 dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
10682
10683 sprintf (buffer, "Bad trap %lx at tl>0", lvl);
10684 @@ -1149,7 +1160,7 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
10685 regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
10686 printk("%s" "ERROR(%d): ",
10687 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
10688 - printk("TPC<%pS>\n", (void *) regs->tpc);
10689 + printk("TPC<%pA>\n", (void *) regs->tpc);
10690 printk("%s" "ERROR(%d): M_SYND(%lx), E_SYND(%lx)%s%s\n",
10691 (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
10692 (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
10693 @@ -1756,7 +1767,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
10694 smp_processor_id(),
10695 (type & 0x1) ? 'I' : 'D',
10696 regs->tpc);
10697 - printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
10698 + printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
10699 panic("Irrecoverable Cheetah+ parity error.");
10700 }
10701
10702 @@ -1764,7 +1775,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
10703 smp_processor_id(),
10704 (type & 0x1) ? 'I' : 'D',
10705 regs->tpc);
10706 - printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
10707 + printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
10708 }
10709
10710 struct sun4v_error_entry {
10711 @@ -1837,8 +1848,8 @@ struct sun4v_error_entry {
10712 /*0x38*/u64 reserved_5;
10713 };
10714
10715 -static atomic_t sun4v_resum_oflow_cnt = ATOMIC_INIT(0);
10716 -static atomic_t sun4v_nonresum_oflow_cnt = ATOMIC_INIT(0);
10717 +static atomic_unchecked_t sun4v_resum_oflow_cnt = ATOMIC_INIT(0);
10718 +static atomic_unchecked_t sun4v_nonresum_oflow_cnt = ATOMIC_INIT(0);
10719
10720 static const char *sun4v_err_type_to_str(u8 type)
10721 {
10722 @@ -1930,7 +1941,7 @@ static void sun4v_report_real_raddr(const char *pfx, struct pt_regs *regs)
10723 }
10724
10725 static void sun4v_log_error(struct pt_regs *regs, struct sun4v_error_entry *ent,
10726 - int cpu, const char *pfx, atomic_t *ocnt)
10727 + int cpu, const char *pfx, atomic_unchecked_t *ocnt)
10728 {
10729 u64 *raw_ptr = (u64 *) ent;
10730 u32 attrs;
10731 @@ -1988,8 +1999,8 @@ static void sun4v_log_error(struct pt_regs *regs, struct sun4v_error_entry *ent,
10732
10733 show_regs(regs);
10734
10735 - if ((cnt = atomic_read(ocnt)) != 0) {
10736 - atomic_set(ocnt, 0);
10737 + if ((cnt = atomic_read_unchecked(ocnt)) != 0) {
10738 + atomic_set_unchecked(ocnt, 0);
10739 wmb();
10740 printk("%s: Queue overflowed %d times.\n",
10741 pfx, cnt);
10742 @@ -2046,7 +2057,7 @@ out:
10743 */
10744 void sun4v_resum_overflow(struct pt_regs *regs)
10745 {
10746 - atomic_inc(&sun4v_resum_oflow_cnt);
10747 + atomic_inc_unchecked(&sun4v_resum_oflow_cnt);
10748 }
10749
10750 /* We run with %pil set to PIL_NORMAL_MAX and PSTATE_IE enabled in %pstate.
10751 @@ -2099,7 +2110,7 @@ void sun4v_nonresum_overflow(struct pt_regs *regs)
10752 /* XXX Actually even this can make not that much sense. Perhaps
10753 * XXX we should just pull the plug and panic directly from here?
10754 */
10755 - atomic_inc(&sun4v_nonresum_oflow_cnt);
10756 + atomic_inc_unchecked(&sun4v_nonresum_oflow_cnt);
10757 }
10758
10759 unsigned long sun4v_err_itlb_vaddr;
10760 @@ -2114,9 +2125,9 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
10761
10762 printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
10763 regs->tpc, tl);
10764 - printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
10765 + printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
10766 printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
10767 - printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
10768 + printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
10769 (void *) regs->u_regs[UREG_I7]);
10770 printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
10771 "pte[%lx] error[%lx]\n",
10772 @@ -2138,9 +2149,9 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
10773
10774 printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
10775 regs->tpc, tl);
10776 - printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
10777 + printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
10778 printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
10779 - printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
10780 + printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
10781 (void *) regs->u_regs[UREG_I7]);
10782 printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
10783 "pte[%lx] error[%lx]\n",
10784 @@ -2359,13 +2370,13 @@ void show_stack(struct task_struct *tsk, unsigned long *_ksp)
10785 fp = (unsigned long)sf->fp + STACK_BIAS;
10786 }
10787
10788 - printk(" [%016lx] %pS\n", pc, (void *) pc);
10789 + printk(" [%016lx] %pA\n", pc, (void *) pc);
10790 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
10791 if ((pc + 8UL) == (unsigned long) &return_to_handler) {
10792 int index = tsk->curr_ret_stack;
10793 if (tsk->ret_stack && index >= graph) {
10794 pc = tsk->ret_stack[index - graph].ret;
10795 - printk(" [%016lx] %pS\n", pc, (void *) pc);
10796 + printk(" [%016lx] %pA\n", pc, (void *) pc);
10797 graph++;
10798 }
10799 }
10800 @@ -2383,6 +2394,8 @@ static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
10801 return (struct reg_window *) (fp + STACK_BIAS);
10802 }
10803
10804 +extern void gr_handle_kernel_exploit(void);
10805 +
10806 void die_if_kernel(char *str, struct pt_regs *regs)
10807 {
10808 static int die_counter;
10809 @@ -2411,7 +2424,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
10810 while (rw &&
10811 count++ < 30 &&
10812 kstack_valid(tp, (unsigned long) rw)) {
10813 - printk("Caller[%016lx]: %pS\n", rw->ins[7],
10814 + printk("Caller[%016lx]: %pA\n", rw->ins[7],
10815 (void *) rw->ins[7]);
10816
10817 rw = kernel_stack_up(rw);
10818 @@ -2424,8 +2437,10 @@ void die_if_kernel(char *str, struct pt_regs *regs)
10819 }
10820 user_instruction_dump ((unsigned int __user *) regs->tpc);
10821 }
10822 - if (regs->tstate & TSTATE_PRIV)
10823 + if (regs->tstate & TSTATE_PRIV) {
10824 + gr_handle_kernel_exploit();
10825 do_exit(SIGKILL);
10826 + }
10827 do_exit(SIGSEGV);
10828 }
10829 EXPORT_SYMBOL(die_if_kernel);
10830 diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
10831 index 3c1a7cb..9046547 100644
10832 --- a/arch/sparc/kernel/unaligned_64.c
10833 +++ b/arch/sparc/kernel/unaligned_64.c
10834 @@ -166,17 +166,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
10835 unsigned long compute_effective_address(struct pt_regs *regs,
10836 unsigned int insn, unsigned int rd)
10837 {
10838 + int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
10839 unsigned int rs1 = (insn >> 14) & 0x1f;
10840 unsigned int rs2 = insn & 0x1f;
10841 - int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
10842 + unsigned long addr;
10843
10844 if (insn & 0x2000) {
10845 maybe_flush_windows(rs1, 0, rd, from_kernel);
10846 - return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
10847 + addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
10848 } else {
10849 maybe_flush_windows(rs1, rs2, rd, from_kernel);
10850 - return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
10851 + addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
10852 }
10853 +
10854 + if (!from_kernel && test_thread_flag(TIF_32BIT))
10855 + addr &= 0xffffffff;
10856 +
10857 + return addr;
10858 }
10859
10860 /* This is just to make gcc think die_if_kernel does return... */
10861 @@ -289,7 +295,7 @@ static void log_unaligned(struct pt_regs *regs)
10862 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
10863
10864 if (__ratelimit(&ratelimit)) {
10865 - printk("Kernel unaligned access at TPC[%lx] %pS\n",
10866 + printk("Kernel unaligned access at TPC[%lx] %pA\n",
10867 regs->tpc, (void *) regs->tpc);
10868 }
10869 }
10870 diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
10871 index dbe119b..089c7c1 100644
10872 --- a/arch/sparc/lib/Makefile
10873 +++ b/arch/sparc/lib/Makefile
10874 @@ -2,7 +2,7 @@
10875 #
10876
10877 asflags-y := -ansi -DST_DIV0=0x02
10878 -ccflags-y := -Werror
10879 +#ccflags-y := -Werror
10880
10881 lib-$(CONFIG_SPARC32) += ashrdi3.o
10882 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
10883 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
10884 index 85c233d..68500e0 100644
10885 --- a/arch/sparc/lib/atomic_64.S
10886 +++ b/arch/sparc/lib/atomic_64.S
10887 @@ -17,7 +17,12 @@
10888 ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */
10889 BACKOFF_SETUP(%o2)
10890 1: lduw [%o1], %g1
10891 - add %g1, %o0, %g7
10892 + addcc %g1, %o0, %g7
10893 +
10894 +#ifdef CONFIG_PAX_REFCOUNT
10895 + tvs %icc, 6
10896 +#endif
10897 +
10898 cas [%o1], %g1, %g7
10899 cmp %g1, %g7
10900 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
10901 @@ -27,10 +32,28 @@ ENTRY(atomic_add) /* %o0 = increment, %o1 = atomic_ptr */
10902 2: BACKOFF_SPIN(%o2, %o3, 1b)
10903 ENDPROC(atomic_add)
10904
10905 +ENTRY(atomic_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
10906 + BACKOFF_SETUP(%o2)
10907 +1: lduw [%o1], %g1
10908 + add %g1, %o0, %g7
10909 + cas [%o1], %g1, %g7
10910 + cmp %g1, %g7
10911 + bne,pn %icc, 2f
10912 + nop
10913 + retl
10914 + nop
10915 +2: BACKOFF_SPIN(%o2, %o3, 1b)
10916 +ENDPROC(atomic_add_unchecked)
10917 +
10918 ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */
10919 BACKOFF_SETUP(%o2)
10920 1: lduw [%o1], %g1
10921 - sub %g1, %o0, %g7
10922 + subcc %g1, %o0, %g7
10923 +
10924 +#ifdef CONFIG_PAX_REFCOUNT
10925 + tvs %icc, 6
10926 +#endif
10927 +
10928 cas [%o1], %g1, %g7
10929 cmp %g1, %g7
10930 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
10931 @@ -40,10 +63,28 @@ ENTRY(atomic_sub) /* %o0 = decrement, %o1 = atomic_ptr */
10932 2: BACKOFF_SPIN(%o2, %o3, 1b)
10933 ENDPROC(atomic_sub)
10934
10935 +ENTRY(atomic_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */
10936 + BACKOFF_SETUP(%o2)
10937 +1: lduw [%o1], %g1
10938 + sub %g1, %o0, %g7
10939 + cas [%o1], %g1, %g7
10940 + cmp %g1, %g7
10941 + bne,pn %icc, 2f
10942 + nop
10943 + retl
10944 + nop
10945 +2: BACKOFF_SPIN(%o2, %o3, 1b)
10946 +ENDPROC(atomic_sub_unchecked)
10947 +
10948 ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
10949 BACKOFF_SETUP(%o2)
10950 1: lduw [%o1], %g1
10951 - add %g1, %o0, %g7
10952 + addcc %g1, %o0, %g7
10953 +
10954 +#ifdef CONFIG_PAX_REFCOUNT
10955 + tvs %icc, 6
10956 +#endif
10957 +
10958 cas [%o1], %g1, %g7
10959 cmp %g1, %g7
10960 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
10961 @@ -53,10 +94,29 @@ ENTRY(atomic_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
10962 2: BACKOFF_SPIN(%o2, %o3, 1b)
10963 ENDPROC(atomic_add_ret)
10964
10965 +ENTRY(atomic_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
10966 + BACKOFF_SETUP(%o2)
10967 +1: lduw [%o1], %g1
10968 + addcc %g1, %o0, %g7
10969 + cas [%o1], %g1, %g7
10970 + cmp %g1, %g7
10971 + bne,pn %icc, 2f
10972 + add %g7, %o0, %g7
10973 + sra %g7, 0, %o0
10974 + retl
10975 + nop
10976 +2: BACKOFF_SPIN(%o2, %o3, 1b)
10977 +ENDPROC(atomic_add_ret_unchecked)
10978 +
10979 ENTRY(atomic_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */
10980 BACKOFF_SETUP(%o2)
10981 1: lduw [%o1], %g1
10982 - sub %g1, %o0, %g7
10983 + subcc %g1, %o0, %g7
10984 +
10985 +#ifdef CONFIG_PAX_REFCOUNT
10986 + tvs %icc, 6
10987 +#endif
10988 +
10989 cas [%o1], %g1, %g7
10990 cmp %g1, %g7
10991 bne,pn %icc, BACKOFF_LABEL(2f, 1b)
10992 @@ -69,7 +129,12 @@ ENDPROC(atomic_sub_ret)
10993 ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */
10994 BACKOFF_SETUP(%o2)
10995 1: ldx [%o1], %g1
10996 - add %g1, %o0, %g7
10997 + addcc %g1, %o0, %g7
10998 +
10999 +#ifdef CONFIG_PAX_REFCOUNT
11000 + tvs %xcc, 6
11001 +#endif
11002 +
11003 casx [%o1], %g1, %g7
11004 cmp %g1, %g7
11005 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
11006 @@ -79,10 +144,28 @@ ENTRY(atomic64_add) /* %o0 = increment, %o1 = atomic_ptr */
11007 2: BACKOFF_SPIN(%o2, %o3, 1b)
11008 ENDPROC(atomic64_add)
11009
11010 +ENTRY(atomic64_add_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
11011 + BACKOFF_SETUP(%o2)
11012 +1: ldx [%o1], %g1
11013 + addcc %g1, %o0, %g7
11014 + casx [%o1], %g1, %g7
11015 + cmp %g1, %g7
11016 + bne,pn %xcc, 2f
11017 + nop
11018 + retl
11019 + nop
11020 +2: BACKOFF_SPIN(%o2, %o3, 1b)
11021 +ENDPROC(atomic64_add_unchecked)
11022 +
11023 ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */
11024 BACKOFF_SETUP(%o2)
11025 1: ldx [%o1], %g1
11026 - sub %g1, %o0, %g7
11027 + subcc %g1, %o0, %g7
11028 +
11029 +#ifdef CONFIG_PAX_REFCOUNT
11030 + tvs %xcc, 6
11031 +#endif
11032 +
11033 casx [%o1], %g1, %g7
11034 cmp %g1, %g7
11035 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
11036 @@ -92,10 +175,28 @@ ENTRY(atomic64_sub) /* %o0 = decrement, %o1 = atomic_ptr */
11037 2: BACKOFF_SPIN(%o2, %o3, 1b)
11038 ENDPROC(atomic64_sub)
11039
11040 +ENTRY(atomic64_sub_unchecked) /* %o0 = decrement, %o1 = atomic_ptr */
11041 + BACKOFF_SETUP(%o2)
11042 +1: ldx [%o1], %g1
11043 + subcc %g1, %o0, %g7
11044 + casx [%o1], %g1, %g7
11045 + cmp %g1, %g7
11046 + bne,pn %xcc, 2f
11047 + nop
11048 + retl
11049 + nop
11050 +2: BACKOFF_SPIN(%o2, %o3, 1b)
11051 +ENDPROC(atomic64_sub_unchecked)
11052 +
11053 ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
11054 BACKOFF_SETUP(%o2)
11055 1: ldx [%o1], %g1
11056 - add %g1, %o0, %g7
11057 + addcc %g1, %o0, %g7
11058 +
11059 +#ifdef CONFIG_PAX_REFCOUNT
11060 + tvs %xcc, 6
11061 +#endif
11062 +
11063 casx [%o1], %g1, %g7
11064 cmp %g1, %g7
11065 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
11066 @@ -105,10 +206,29 @@ ENTRY(atomic64_add_ret) /* %o0 = increment, %o1 = atomic_ptr */
11067 2: BACKOFF_SPIN(%o2, %o3, 1b)
11068 ENDPROC(atomic64_add_ret)
11069
11070 +ENTRY(atomic64_add_ret_unchecked) /* %o0 = increment, %o1 = atomic_ptr */
11071 + BACKOFF_SETUP(%o2)
11072 +1: ldx [%o1], %g1
11073 + addcc %g1, %o0, %g7
11074 + casx [%o1], %g1, %g7
11075 + cmp %g1, %g7
11076 + bne,pn %xcc, 2f
11077 + add %g7, %o0, %g7
11078 + mov %g7, %o0
11079 + retl
11080 + nop
11081 +2: BACKOFF_SPIN(%o2, %o3, 1b)
11082 +ENDPROC(atomic64_add_ret_unchecked)
11083 +
11084 ENTRY(atomic64_sub_ret) /* %o0 = decrement, %o1 = atomic_ptr */
11085 BACKOFF_SETUP(%o2)
11086 1: ldx [%o1], %g1
11087 - sub %g1, %o0, %g7
11088 + subcc %g1, %o0, %g7
11089 +
11090 +#ifdef CONFIG_PAX_REFCOUNT
11091 + tvs %xcc, 6
11092 +#endif
11093 +
11094 casx [%o1], %g1, %g7
11095 cmp %g1, %g7
11096 bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
11097 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
11098 index 323335b..ed85ea2 100644
11099 --- a/arch/sparc/lib/ksyms.c
11100 +++ b/arch/sparc/lib/ksyms.c
11101 @@ -100,12 +100,18 @@ EXPORT_SYMBOL(__clear_user);
11102
11103 /* Atomic counter implementation. */
11104 EXPORT_SYMBOL(atomic_add);
11105 +EXPORT_SYMBOL(atomic_add_unchecked);
11106 EXPORT_SYMBOL(atomic_add_ret);
11107 +EXPORT_SYMBOL(atomic_add_ret_unchecked);
11108 EXPORT_SYMBOL(atomic_sub);
11109 +EXPORT_SYMBOL(atomic_sub_unchecked);
11110 EXPORT_SYMBOL(atomic_sub_ret);
11111 EXPORT_SYMBOL(atomic64_add);
11112 +EXPORT_SYMBOL(atomic64_add_unchecked);
11113 EXPORT_SYMBOL(atomic64_add_ret);
11114 +EXPORT_SYMBOL(atomic64_add_ret_unchecked);
11115 EXPORT_SYMBOL(atomic64_sub);
11116 +EXPORT_SYMBOL(atomic64_sub_unchecked);
11117 EXPORT_SYMBOL(atomic64_sub_ret);
11118 EXPORT_SYMBOL(atomic64_dec_if_positive);
11119
11120 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
11121 index 30c3ecc..736f015 100644
11122 --- a/arch/sparc/mm/Makefile
11123 +++ b/arch/sparc/mm/Makefile
11124 @@ -2,7 +2,7 @@
11125 #
11126
11127 asflags-y := -ansi
11128 -ccflags-y := -Werror
11129 +#ccflags-y := -Werror
11130
11131 obj-$(CONFIG_SPARC64) += ultra.o tlb.o tsb.o gup.o
11132 obj-y += fault_$(BITS).o
11133 diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
11134 index 59dbd46..1dd7f5e 100644
11135 --- a/arch/sparc/mm/fault_32.c
11136 +++ b/arch/sparc/mm/fault_32.c
11137 @@ -21,6 +21,9 @@
11138 #include <linux/perf_event.h>
11139 #include <linux/interrupt.h>
11140 #include <linux/kdebug.h>
11141 +#include <linux/slab.h>
11142 +#include <linux/pagemap.h>
11143 +#include <linux/compiler.h>
11144
11145 #include <asm/page.h>
11146 #include <asm/pgtable.h>
11147 @@ -159,6 +162,277 @@ static unsigned long compute_si_addr(struct pt_regs *regs, int text_fault)
11148 return safe_compute_effective_address(regs, insn);
11149 }
11150
11151 +#ifdef CONFIG_PAX_PAGEEXEC
11152 +#ifdef CONFIG_PAX_DLRESOLVE
11153 +static void pax_emuplt_close(struct vm_area_struct *vma)
11154 +{
11155 + vma->vm_mm->call_dl_resolve = 0UL;
11156 +}
11157 +
11158 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
11159 +{
11160 + unsigned int *kaddr;
11161 +
11162 + vmf->page = alloc_page(GFP_HIGHUSER);
11163 + if (!vmf->page)
11164 + return VM_FAULT_OOM;
11165 +
11166 + kaddr = kmap(vmf->page);
11167 + memset(kaddr, 0, PAGE_SIZE);
11168 + kaddr[0] = 0x9DE3BFA8U; /* save */
11169 + flush_dcache_page(vmf->page);
11170 + kunmap(vmf->page);
11171 + return VM_FAULT_MAJOR;
11172 +}
11173 +
11174 +static const struct vm_operations_struct pax_vm_ops = {
11175 + .close = pax_emuplt_close,
11176 + .fault = pax_emuplt_fault
11177 +};
11178 +
11179 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
11180 +{
11181 + int ret;
11182 +
11183 + INIT_LIST_HEAD(&vma->anon_vma_chain);
11184 + vma->vm_mm = current->mm;
11185 + vma->vm_start = addr;
11186 + vma->vm_end = addr + PAGE_SIZE;
11187 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
11188 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
11189 + vma->vm_ops = &pax_vm_ops;
11190 +
11191 + ret = insert_vm_struct(current->mm, vma);
11192 + if (ret)
11193 + return ret;
11194 +
11195 + ++current->mm->total_vm;
11196 + return 0;
11197 +}
11198 +#endif
11199 +
11200 +/*
11201 + * PaX: decide what to do with offenders (regs->pc = fault address)
11202 + *
11203 + * returns 1 when task should be killed
11204 + * 2 when patched PLT trampoline was detected
11205 + * 3 when unpatched PLT trampoline was detected
11206 + */
11207 +static int pax_handle_fetch_fault(struct pt_regs *regs)
11208 +{
11209 +
11210 +#ifdef CONFIG_PAX_EMUPLT
11211 + int err;
11212 +
11213 + do { /* PaX: patched PLT emulation #1 */
11214 + unsigned int sethi1, sethi2, jmpl;
11215 +
11216 + err = get_user(sethi1, (unsigned int *)regs->pc);
11217 + err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
11218 + err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
11219 +
11220 + if (err)
11221 + break;
11222 +
11223 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
11224 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
11225 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
11226 + {
11227 + unsigned int addr;
11228 +
11229 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
11230 + addr = regs->u_regs[UREG_G1];
11231 + addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11232 + regs->pc = addr;
11233 + regs->npc = addr+4;
11234 + return 2;
11235 + }
11236 + } while (0);
11237 +
11238 + do { /* PaX: patched PLT emulation #2 */
11239 + unsigned int ba;
11240 +
11241 + err = get_user(ba, (unsigned int *)regs->pc);
11242 +
11243 + if (err)
11244 + break;
11245 +
11246 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
11247 + unsigned int addr;
11248 +
11249 + if ((ba & 0xFFC00000U) == 0x30800000U)
11250 + addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
11251 + else
11252 + addr = regs->pc + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11253 + regs->pc = addr;
11254 + regs->npc = addr+4;
11255 + return 2;
11256 + }
11257 + } while (0);
11258 +
11259 + do { /* PaX: patched PLT emulation #3 */
11260 + unsigned int sethi, bajmpl, nop;
11261 +
11262 + err = get_user(sethi, (unsigned int *)regs->pc);
11263 + err |= get_user(bajmpl, (unsigned int *)(regs->pc+4));
11264 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
11265 +
11266 + if (err)
11267 + break;
11268 +
11269 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11270 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
11271 + nop == 0x01000000U)
11272 + {
11273 + unsigned int addr;
11274 +
11275 + addr = (sethi & 0x003FFFFFU) << 10;
11276 + regs->u_regs[UREG_G1] = addr;
11277 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
11278 + addr += (((bajmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11279 + else
11280 + addr = regs->pc + ((((bajmpl | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11281 + regs->pc = addr;
11282 + regs->npc = addr+4;
11283 + return 2;
11284 + }
11285 + } while (0);
11286 +
11287 + do { /* PaX: unpatched PLT emulation step 1 */
11288 + unsigned int sethi, ba, nop;
11289 +
11290 + err = get_user(sethi, (unsigned int *)regs->pc);
11291 + err |= get_user(ba, (unsigned int *)(regs->pc+4));
11292 + err |= get_user(nop, (unsigned int *)(regs->pc+8));
11293 +
11294 + if (err)
11295 + break;
11296 +
11297 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11298 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
11299 + nop == 0x01000000U)
11300 + {
11301 + unsigned int addr, save, call;
11302 +
11303 + if ((ba & 0xFFC00000U) == 0x30800000U)
11304 + addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
11305 + else
11306 + addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
11307 +
11308 + err = get_user(save, (unsigned int *)addr);
11309 + err |= get_user(call, (unsigned int *)(addr+4));
11310 + err |= get_user(nop, (unsigned int *)(addr+8));
11311 + if (err)
11312 + break;
11313 +
11314 +#ifdef CONFIG_PAX_DLRESOLVE
11315 + if (save == 0x9DE3BFA8U &&
11316 + (call & 0xC0000000U) == 0x40000000U &&
11317 + nop == 0x01000000U)
11318 + {
11319 + struct vm_area_struct *vma;
11320 + unsigned long call_dl_resolve;
11321 +
11322 + down_read(&current->mm->mmap_sem);
11323 + call_dl_resolve = current->mm->call_dl_resolve;
11324 + up_read(&current->mm->mmap_sem);
11325 + if (likely(call_dl_resolve))
11326 + goto emulate;
11327 +
11328 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
11329 +
11330 + down_write(&current->mm->mmap_sem);
11331 + if (current->mm->call_dl_resolve) {
11332 + call_dl_resolve = current->mm->call_dl_resolve;
11333 + up_write(&current->mm->mmap_sem);
11334 + if (vma)
11335 + kmem_cache_free(vm_area_cachep, vma);
11336 + goto emulate;
11337 + }
11338 +
11339 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
11340 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
11341 + up_write(&current->mm->mmap_sem);
11342 + if (vma)
11343 + kmem_cache_free(vm_area_cachep, vma);
11344 + return 1;
11345 + }
11346 +
11347 + if (pax_insert_vma(vma, call_dl_resolve)) {
11348 + up_write(&current->mm->mmap_sem);
11349 + kmem_cache_free(vm_area_cachep, vma);
11350 + return 1;
11351 + }
11352 +
11353 + current->mm->call_dl_resolve = call_dl_resolve;
11354 + up_write(&current->mm->mmap_sem);
11355 +
11356 +emulate:
11357 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11358 + regs->pc = call_dl_resolve;
11359 + regs->npc = addr+4;
11360 + return 3;
11361 + }
11362 +#endif
11363 +
11364 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
11365 + if ((save & 0xFFC00000U) == 0x05000000U &&
11366 + (call & 0xFFFFE000U) == 0x85C0A000U &&
11367 + nop == 0x01000000U)
11368 + {
11369 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11370 + regs->u_regs[UREG_G2] = addr + 4;
11371 + addr = (save & 0x003FFFFFU) << 10;
11372 + addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
11373 + regs->pc = addr;
11374 + regs->npc = addr+4;
11375 + return 3;
11376 + }
11377 + }
11378 + } while (0);
11379 +
11380 + do { /* PaX: unpatched PLT emulation step 2 */
11381 + unsigned int save, call, nop;
11382 +
11383 + err = get_user(save, (unsigned int *)(regs->pc-4));
11384 + err |= get_user(call, (unsigned int *)regs->pc);
11385 + err |= get_user(nop, (unsigned int *)(regs->pc+4));
11386 + if (err)
11387 + break;
11388 +
11389 + if (save == 0x9DE3BFA8U &&
11390 + (call & 0xC0000000U) == 0x40000000U &&
11391 + nop == 0x01000000U)
11392 + {
11393 + unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
11394 +
11395 + regs->u_regs[UREG_RETPC] = regs->pc;
11396 + regs->pc = dl_resolve;
11397 + regs->npc = dl_resolve+4;
11398 + return 3;
11399 + }
11400 + } while (0);
11401 +#endif
11402 +
11403 + return 1;
11404 +}
11405 +
11406 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
11407 +{
11408 + unsigned long i;
11409 +
11410 + printk(KERN_ERR "PAX: bytes at PC: ");
11411 + for (i = 0; i < 8; i++) {
11412 + unsigned int c;
11413 + if (get_user(c, (unsigned int *)pc+i))
11414 + printk(KERN_CONT "???????? ");
11415 + else
11416 + printk(KERN_CONT "%08x ", c);
11417 + }
11418 + printk("\n");
11419 +}
11420 +#endif
11421 +
11422 static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
11423 int text_fault)
11424 {
11425 @@ -229,6 +503,24 @@ good_area:
11426 if (!(vma->vm_flags & VM_WRITE))
11427 goto bad_area;
11428 } else {
11429 +
11430 +#ifdef CONFIG_PAX_PAGEEXEC
11431 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
11432 + up_read(&mm->mmap_sem);
11433 + switch (pax_handle_fetch_fault(regs)) {
11434 +
11435 +#ifdef CONFIG_PAX_EMUPLT
11436 + case 2:
11437 + case 3:
11438 + return;
11439 +#endif
11440 +
11441 + }
11442 + pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
11443 + do_group_exit(SIGKILL);
11444 + }
11445 +#endif
11446 +
11447 /* Allow reads even for write-only mappings */
11448 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
11449 goto bad_area;
11450 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
11451 index 69bb818..3542236 100644
11452 --- a/arch/sparc/mm/fault_64.c
11453 +++ b/arch/sparc/mm/fault_64.c
11454 @@ -22,6 +22,9 @@
11455 #include <linux/kdebug.h>
11456 #include <linux/percpu.h>
11457 #include <linux/context_tracking.h>
11458 +#include <linux/slab.h>
11459 +#include <linux/pagemap.h>
11460 +#include <linux/compiler.h>
11461
11462 #include <asm/page.h>
11463 #include <asm/pgtable.h>
11464 @@ -75,7 +78,7 @@ static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
11465 printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
11466 regs->tpc);
11467 printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
11468 - printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
11469 + printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
11470 printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
11471 dump_stack();
11472 unhandled_fault(regs->tpc, current, regs);
11473 @@ -96,38 +99,51 @@ static unsigned int get_user_insn(unsigned long tpc)
11474 pte_t *ptep, pte;
11475 unsigned long pa;
11476 u32 insn = 0;
11477 - unsigned long pstate;
11478
11479 - if (pgd_none(*pgdp))
11480 - goto outret;
11481 + if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
11482 + goto out;
11483 pudp = pud_offset(pgdp, tpc);
11484 - if (pud_none(*pudp))
11485 - goto outret;
11486 - pmdp = pmd_offset(pudp, tpc);
11487 - if (pmd_none(*pmdp))
11488 - goto outret;
11489 + if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
11490 + goto out;
11491
11492 /* This disables preemption for us as well. */
11493 - __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
11494 - __asm__ __volatile__("wrpr %0, %1, %%pstate"
11495 - : : "r" (pstate), "i" (PSTATE_IE));
11496 - ptep = pte_offset_map(pmdp, tpc);
11497 - pte = *ptep;
11498 - if (!pte_present(pte))
11499 - goto out;
11500 + local_irq_disable();
11501
11502 - pa = (pte_pfn(pte) << PAGE_SHIFT);
11503 - pa += (tpc & ~PAGE_MASK);
11504 + pmdp = pmd_offset(pudp, tpc);
11505 + if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
11506 + goto out_irq_enable;
11507
11508 - /* Use phys bypass so we don't pollute dtlb/dcache. */
11509 - __asm__ __volatile__("lduwa [%1] %2, %0"
11510 - : "=r" (insn)
11511 - : "r" (pa), "i" (ASI_PHYS_USE_EC));
11512 +#ifdef CONFIG_TRANSPARENT_HUGEPAGE
11513 + if (pmd_trans_huge(*pmdp)) {
11514 + if (pmd_trans_splitting(*pmdp))
11515 + goto out_irq_enable;
11516
11517 + pa = pmd_pfn(*pmdp) << PAGE_SHIFT;
11518 + pa += tpc & ~HPAGE_MASK;
11519 +
11520 + /* Use phys bypass so we don't pollute dtlb/dcache. */
11521 + __asm__ __volatile__("lduwa [%1] %2, %0"
11522 + : "=r" (insn)
11523 + : "r" (pa), "i" (ASI_PHYS_USE_EC));
11524 + } else
11525 +#endif
11526 + {
11527 + ptep = pte_offset_map(pmdp, tpc);
11528 + pte = *ptep;
11529 + if (pte_present(pte)) {
11530 + pa = (pte_pfn(pte) << PAGE_SHIFT);
11531 + pa += (tpc & ~PAGE_MASK);
11532 +
11533 + /* Use phys bypass so we don't pollute dtlb/dcache. */
11534 + __asm__ __volatile__("lduwa [%1] %2, %0"
11535 + : "=r" (insn)
11536 + : "r" (pa), "i" (ASI_PHYS_USE_EC));
11537 + }
11538 + pte_unmap(ptep);
11539 + }
11540 +out_irq_enable:
11541 + local_irq_enable();
11542 out:
11543 - pte_unmap(ptep);
11544 - __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
11545 -outret:
11546 return insn;
11547 }
11548
11549 @@ -153,7 +169,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
11550 }
11551
11552 static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
11553 - unsigned int insn, int fault_code)
11554 + unsigned long fault_addr, unsigned int insn,
11555 + int fault_code)
11556 {
11557 unsigned long addr;
11558 siginfo_t info;
11559 @@ -161,10 +178,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
11560 info.si_code = code;
11561 info.si_signo = sig;
11562 info.si_errno = 0;
11563 - if (fault_code & FAULT_CODE_ITLB)
11564 + if (fault_code & FAULT_CODE_ITLB) {
11565 addr = regs->tpc;
11566 - else
11567 - addr = compute_effective_address(regs, insn, 0);
11568 + } else {
11569 + /* If we were able to probe the faulting instruction, use it
11570 + * to compute a precise fault address. Otherwise use the fault
11571 + * time provided address which may only have page granularity.
11572 + */
11573 + if (insn)
11574 + addr = compute_effective_address(regs, insn, 0);
11575 + else
11576 + addr = fault_addr;
11577 + }
11578 info.si_addr = (void __user *) addr;
11579 info.si_trapno = 0;
11580
11581 @@ -239,7 +264,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
11582 /* The si_code was set to make clear whether
11583 * this was a SEGV_MAPERR or SEGV_ACCERR fault.
11584 */
11585 - do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
11586 + do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
11587 return;
11588 }
11589
11590 @@ -271,6 +296,466 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
11591 show_regs(regs);
11592 }
11593
11594 +#ifdef CONFIG_PAX_PAGEEXEC
11595 +#ifdef CONFIG_PAX_DLRESOLVE
11596 +static void pax_emuplt_close(struct vm_area_struct *vma)
11597 +{
11598 + vma->vm_mm->call_dl_resolve = 0UL;
11599 +}
11600 +
11601 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
11602 +{
11603 + unsigned int *kaddr;
11604 +
11605 + vmf->page = alloc_page(GFP_HIGHUSER);
11606 + if (!vmf->page)
11607 + return VM_FAULT_OOM;
11608 +
11609 + kaddr = kmap(vmf->page);
11610 + memset(kaddr, 0, PAGE_SIZE);
11611 + kaddr[0] = 0x9DE3BFA8U; /* save */
11612 + flush_dcache_page(vmf->page);
11613 + kunmap(vmf->page);
11614 + return VM_FAULT_MAJOR;
11615 +}
11616 +
11617 +static const struct vm_operations_struct pax_vm_ops = {
11618 + .close = pax_emuplt_close,
11619 + .fault = pax_emuplt_fault
11620 +};
11621 +
11622 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
11623 +{
11624 + int ret;
11625 +
11626 + INIT_LIST_HEAD(&vma->anon_vma_chain);
11627 + vma->vm_mm = current->mm;
11628 + vma->vm_start = addr;
11629 + vma->vm_end = addr + PAGE_SIZE;
11630 + vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
11631 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
11632 + vma->vm_ops = &pax_vm_ops;
11633 +
11634 + ret = insert_vm_struct(current->mm, vma);
11635 + if (ret)
11636 + return ret;
11637 +
11638 + ++current->mm->total_vm;
11639 + return 0;
11640 +}
11641 +#endif
11642 +
11643 +/*
11644 + * PaX: decide what to do with offenders (regs->tpc = fault address)
11645 + *
11646 + * returns 1 when task should be killed
11647 + * 2 when patched PLT trampoline was detected
11648 + * 3 when unpatched PLT trampoline was detected
11649 + */
11650 +static int pax_handle_fetch_fault(struct pt_regs *regs)
11651 +{
11652 +
11653 +#ifdef CONFIG_PAX_EMUPLT
11654 + int err;
11655 +
11656 + do { /* PaX: patched PLT emulation #1 */
11657 + unsigned int sethi1, sethi2, jmpl;
11658 +
11659 + err = get_user(sethi1, (unsigned int *)regs->tpc);
11660 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
11661 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
11662 +
11663 + if (err)
11664 + break;
11665 +
11666 + if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
11667 + (sethi2 & 0xFFC00000U) == 0x03000000U &&
11668 + (jmpl & 0xFFFFE000U) == 0x81C06000U)
11669 + {
11670 + unsigned long addr;
11671 +
11672 + regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
11673 + addr = regs->u_regs[UREG_G1];
11674 + addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
11675 +
11676 + if (test_thread_flag(TIF_32BIT))
11677 + addr &= 0xFFFFFFFFUL;
11678 +
11679 + regs->tpc = addr;
11680 + regs->tnpc = addr+4;
11681 + return 2;
11682 + }
11683 + } while (0);
11684 +
11685 + do { /* PaX: patched PLT emulation #2 */
11686 + unsigned int ba;
11687 +
11688 + err = get_user(ba, (unsigned int *)regs->tpc);
11689 +
11690 + if (err)
11691 + break;
11692 +
11693 + if ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30480000U) {
11694 + unsigned long addr;
11695 +
11696 + if ((ba & 0xFFC00000U) == 0x30800000U)
11697 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
11698 + else
11699 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11700 +
11701 + if (test_thread_flag(TIF_32BIT))
11702 + addr &= 0xFFFFFFFFUL;
11703 +
11704 + regs->tpc = addr;
11705 + regs->tnpc = addr+4;
11706 + return 2;
11707 + }
11708 + } while (0);
11709 +
11710 + do { /* PaX: patched PLT emulation #3 */
11711 + unsigned int sethi, bajmpl, nop;
11712 +
11713 + err = get_user(sethi, (unsigned int *)regs->tpc);
11714 + err |= get_user(bajmpl, (unsigned int *)(regs->tpc+4));
11715 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
11716 +
11717 + if (err)
11718 + break;
11719 +
11720 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11721 + ((bajmpl & 0xFFFFE000U) == 0x81C06000U || (bajmpl & 0xFFF80000U) == 0x30480000U) &&
11722 + nop == 0x01000000U)
11723 + {
11724 + unsigned long addr;
11725 +
11726 + addr = (sethi & 0x003FFFFFU) << 10;
11727 + regs->u_regs[UREG_G1] = addr;
11728 + if ((bajmpl & 0xFFFFE000U) == 0x81C06000U)
11729 + addr += (((bajmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
11730 + else
11731 + addr = regs->tpc + ((((bajmpl | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11732 +
11733 + if (test_thread_flag(TIF_32BIT))
11734 + addr &= 0xFFFFFFFFUL;
11735 +
11736 + regs->tpc = addr;
11737 + regs->tnpc = addr+4;
11738 + return 2;
11739 + }
11740 + } while (0);
11741 +
11742 + do { /* PaX: patched PLT emulation #4 */
11743 + unsigned int sethi, mov1, call, mov2;
11744 +
11745 + err = get_user(sethi, (unsigned int *)regs->tpc);
11746 + err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
11747 + err |= get_user(call, (unsigned int *)(regs->tpc+8));
11748 + err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
11749 +
11750 + if (err)
11751 + break;
11752 +
11753 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11754 + mov1 == 0x8210000FU &&
11755 + (call & 0xC0000000U) == 0x40000000U &&
11756 + mov2 == 0x9E100001U)
11757 + {
11758 + unsigned long addr;
11759 +
11760 + regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
11761 + addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
11762 +
11763 + if (test_thread_flag(TIF_32BIT))
11764 + addr &= 0xFFFFFFFFUL;
11765 +
11766 + regs->tpc = addr;
11767 + regs->tnpc = addr+4;
11768 + return 2;
11769 + }
11770 + } while (0);
11771 +
11772 + do { /* PaX: patched PLT emulation #5 */
11773 + unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
11774 +
11775 + err = get_user(sethi, (unsigned int *)regs->tpc);
11776 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
11777 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
11778 + err |= get_user(or1, (unsigned int *)(regs->tpc+12));
11779 + err |= get_user(or2, (unsigned int *)(regs->tpc+16));
11780 + err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
11781 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
11782 + err |= get_user(nop, (unsigned int *)(regs->tpc+28));
11783 +
11784 + if (err)
11785 + break;
11786 +
11787 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11788 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
11789 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
11790 + (or1 & 0xFFFFE000U) == 0x82106000U &&
11791 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
11792 + sllx == 0x83287020U &&
11793 + jmpl == 0x81C04005U &&
11794 + nop == 0x01000000U)
11795 + {
11796 + unsigned long addr;
11797 +
11798 + regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
11799 + regs->u_regs[UREG_G1] <<= 32;
11800 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
11801 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
11802 + regs->tpc = addr;
11803 + regs->tnpc = addr+4;
11804 + return 2;
11805 + }
11806 + } while (0);
11807 +
11808 + do { /* PaX: patched PLT emulation #6 */
11809 + unsigned int sethi, sethi1, sethi2, sllx, or, jmpl, nop;
11810 +
11811 + err = get_user(sethi, (unsigned int *)regs->tpc);
11812 + err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
11813 + err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
11814 + err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
11815 + err |= get_user(or, (unsigned int *)(regs->tpc+16));
11816 + err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
11817 + err |= get_user(nop, (unsigned int *)(regs->tpc+24));
11818 +
11819 + if (err)
11820 + break;
11821 +
11822 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11823 + (sethi1 & 0xFFC00000U) == 0x03000000U &&
11824 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
11825 + sllx == 0x83287020U &&
11826 + (or & 0xFFFFE000U) == 0x8A116000U &&
11827 + jmpl == 0x81C04005U &&
11828 + nop == 0x01000000U)
11829 + {
11830 + unsigned long addr;
11831 +
11832 + regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
11833 + regs->u_regs[UREG_G1] <<= 32;
11834 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
11835 + addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
11836 + regs->tpc = addr;
11837 + regs->tnpc = addr+4;
11838 + return 2;
11839 + }
11840 + } while (0);
11841 +
11842 + do { /* PaX: unpatched PLT emulation step 1 */
11843 + unsigned int sethi, ba, nop;
11844 +
11845 + err = get_user(sethi, (unsigned int *)regs->tpc);
11846 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
11847 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
11848 +
11849 + if (err)
11850 + break;
11851 +
11852 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
11853 + ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
11854 + nop == 0x01000000U)
11855 + {
11856 + unsigned long addr;
11857 + unsigned int save, call;
11858 + unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
11859 +
11860 + if ((ba & 0xFFC00000U) == 0x30800000U)
11861 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
11862 + else
11863 + addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
11864 +
11865 + if (test_thread_flag(TIF_32BIT))
11866 + addr &= 0xFFFFFFFFUL;
11867 +
11868 + err = get_user(save, (unsigned int *)addr);
11869 + err |= get_user(call, (unsigned int *)(addr+4));
11870 + err |= get_user(nop, (unsigned int *)(addr+8));
11871 + if (err)
11872 + break;
11873 +
11874 +#ifdef CONFIG_PAX_DLRESOLVE
11875 + if (save == 0x9DE3BFA8U &&
11876 + (call & 0xC0000000U) == 0x40000000U &&
11877 + nop == 0x01000000U)
11878 + {
11879 + struct vm_area_struct *vma;
11880 + unsigned long call_dl_resolve;
11881 +
11882 + down_read(&current->mm->mmap_sem);
11883 + call_dl_resolve = current->mm->call_dl_resolve;
11884 + up_read(&current->mm->mmap_sem);
11885 + if (likely(call_dl_resolve))
11886 + goto emulate;
11887 +
11888 + vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
11889 +
11890 + down_write(&current->mm->mmap_sem);
11891 + if (current->mm->call_dl_resolve) {
11892 + call_dl_resolve = current->mm->call_dl_resolve;
11893 + up_write(&current->mm->mmap_sem);
11894 + if (vma)
11895 + kmem_cache_free(vm_area_cachep, vma);
11896 + goto emulate;
11897 + }
11898 +
11899 + call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
11900 + if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
11901 + up_write(&current->mm->mmap_sem);
11902 + if (vma)
11903 + kmem_cache_free(vm_area_cachep, vma);
11904 + return 1;
11905 + }
11906 +
11907 + if (pax_insert_vma(vma, call_dl_resolve)) {
11908 + up_write(&current->mm->mmap_sem);
11909 + kmem_cache_free(vm_area_cachep, vma);
11910 + return 1;
11911 + }
11912 +
11913 + current->mm->call_dl_resolve = call_dl_resolve;
11914 + up_write(&current->mm->mmap_sem);
11915 +
11916 +emulate:
11917 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11918 + regs->tpc = call_dl_resolve;
11919 + regs->tnpc = addr+4;
11920 + return 3;
11921 + }
11922 +#endif
11923 +
11924 + /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
11925 + if ((save & 0xFFC00000U) == 0x05000000U &&
11926 + (call & 0xFFFFE000U) == 0x85C0A000U &&
11927 + nop == 0x01000000U)
11928 + {
11929 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11930 + regs->u_regs[UREG_G2] = addr + 4;
11931 + addr = (save & 0x003FFFFFU) << 10;
11932 + addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
11933 +
11934 + if (test_thread_flag(TIF_32BIT))
11935 + addr &= 0xFFFFFFFFUL;
11936 +
11937 + regs->tpc = addr;
11938 + regs->tnpc = addr+4;
11939 + return 3;
11940 + }
11941 +
11942 + /* PaX: 64-bit PLT stub */
11943 + err = get_user(sethi1, (unsigned int *)addr);
11944 + err |= get_user(sethi2, (unsigned int *)(addr+4));
11945 + err |= get_user(or1, (unsigned int *)(addr+8));
11946 + err |= get_user(or2, (unsigned int *)(addr+12));
11947 + err |= get_user(sllx, (unsigned int *)(addr+16));
11948 + err |= get_user(add, (unsigned int *)(addr+20));
11949 + err |= get_user(jmpl, (unsigned int *)(addr+24));
11950 + err |= get_user(nop, (unsigned int *)(addr+28));
11951 + if (err)
11952 + break;
11953 +
11954 + if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
11955 + (sethi2 & 0xFFC00000U) == 0x0B000000U &&
11956 + (or1 & 0xFFFFE000U) == 0x88112000U &&
11957 + (or2 & 0xFFFFE000U) == 0x8A116000U &&
11958 + sllx == 0x89293020U &&
11959 + add == 0x8A010005U &&
11960 + jmpl == 0x89C14000U &&
11961 + nop == 0x01000000U)
11962 + {
11963 + regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
11964 + regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
11965 + regs->u_regs[UREG_G4] <<= 32;
11966 + regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
11967 + regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
11968 + regs->u_regs[UREG_G4] = addr + 24;
11969 + addr = regs->u_regs[UREG_G5];
11970 + regs->tpc = addr;
11971 + regs->tnpc = addr+4;
11972 + return 3;
11973 + }
11974 + }
11975 + } while (0);
11976 +
11977 +#ifdef CONFIG_PAX_DLRESOLVE
11978 + do { /* PaX: unpatched PLT emulation step 2 */
11979 + unsigned int save, call, nop;
11980 +
11981 + err = get_user(save, (unsigned int *)(regs->tpc-4));
11982 + err |= get_user(call, (unsigned int *)regs->tpc);
11983 + err |= get_user(nop, (unsigned int *)(regs->tpc+4));
11984 + if (err)
11985 + break;
11986 +
11987 + if (save == 0x9DE3BFA8U &&
11988 + (call & 0xC0000000U) == 0x40000000U &&
11989 + nop == 0x01000000U)
11990 + {
11991 + unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
11992 +
11993 + if (test_thread_flag(TIF_32BIT))
11994 + dl_resolve &= 0xFFFFFFFFUL;
11995 +
11996 + regs->u_regs[UREG_RETPC] = regs->tpc;
11997 + regs->tpc = dl_resolve;
11998 + regs->tnpc = dl_resolve+4;
11999 + return 3;
12000 + }
12001 + } while (0);
12002 +#endif
12003 +
12004 + do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
12005 + unsigned int sethi, ba, nop;
12006 +
12007 + err = get_user(sethi, (unsigned int *)regs->tpc);
12008 + err |= get_user(ba, (unsigned int *)(regs->tpc+4));
12009 + err |= get_user(nop, (unsigned int *)(regs->tpc+8));
12010 +
12011 + if (err)
12012 + break;
12013 +
12014 + if ((sethi & 0xFFC00000U) == 0x03000000U &&
12015 + (ba & 0xFFF00000U) == 0x30600000U &&
12016 + nop == 0x01000000U)
12017 + {
12018 + unsigned long addr;
12019 +
12020 + addr = (sethi & 0x003FFFFFU) << 10;
12021 + regs->u_regs[UREG_G1] = addr;
12022 + addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
12023 +
12024 + if (test_thread_flag(TIF_32BIT))
12025 + addr &= 0xFFFFFFFFUL;
12026 +
12027 + regs->tpc = addr;
12028 + regs->tnpc = addr+4;
12029 + return 2;
12030 + }
12031 + } while (0);
12032 +
12033 +#endif
12034 +
12035 + return 1;
12036 +}
12037 +
12038 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
12039 +{
12040 + unsigned long i;
12041 +
12042 + printk(KERN_ERR "PAX: bytes at PC: ");
12043 + for (i = 0; i < 8; i++) {
12044 + unsigned int c;
12045 + if (get_user(c, (unsigned int *)pc+i))
12046 + printk(KERN_CONT "???????? ");
12047 + else
12048 + printk(KERN_CONT "%08x ", c);
12049 + }
12050 + printk("\n");
12051 +}
12052 +#endif
12053 +
12054 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
12055 {
12056 enum ctx_state prev_state = exception_enter();
12057 @@ -344,6 +829,29 @@ retry:
12058 if (!vma)
12059 goto bad_area;
12060
12061 +#ifdef CONFIG_PAX_PAGEEXEC
12062 + /* PaX: detect ITLB misses on non-exec pages */
12063 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
12064 + !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
12065 + {
12066 + if (address != regs->tpc)
12067 + goto good_area;
12068 +
12069 + up_read(&mm->mmap_sem);
12070 + switch (pax_handle_fetch_fault(regs)) {
12071 +
12072 +#ifdef CONFIG_PAX_EMUPLT
12073 + case 2:
12074 + case 3:
12075 + return;
12076 +#endif
12077 +
12078 + }
12079 + pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
12080 + do_group_exit(SIGKILL);
12081 + }
12082 +#endif
12083 +
12084 /* Pure DTLB misses do not tell us whether the fault causing
12085 * load/store/atomic was a write or not, it only says that there
12086 * was no match. So in such a case we (carefully) read the
12087 @@ -525,7 +1033,7 @@ do_sigbus:
12088 * Send a sigbus, regardless of whether we were in kernel
12089 * or user mode.
12090 */
12091 - do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
12092 + do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
12093
12094 /* Kernel mode? Handle exceptions or die */
12095 if (regs->tstate & TSTATE_PRIV)
12096 diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
12097 index c4d3da6..1aed043 100644
12098 --- a/arch/sparc/mm/gup.c
12099 +++ b/arch/sparc/mm/gup.c
12100 @@ -73,7 +73,7 @@ static int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
12101 struct page *head, *page, *tail;
12102 int refs;
12103
12104 - if (!pmd_large(pmd))
12105 + if (!(pmd_val(pmd) & _PAGE_VALID))
12106 return 0;
12107
12108 if (write && !pmd_write(pmd))
12109 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
12110 index 9bd9ce8..dc84852 100644
12111 --- a/arch/sparc/mm/hugetlbpage.c
12112 +++ b/arch/sparc/mm/hugetlbpage.c
12113 @@ -25,8 +25,10 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
12114 unsigned long addr,
12115 unsigned long len,
12116 unsigned long pgoff,
12117 - unsigned long flags)
12118 + unsigned long flags,
12119 + unsigned long offset)
12120 {
12121 + struct mm_struct *mm = current->mm;
12122 unsigned long task_size = TASK_SIZE;
12123 struct vm_unmapped_area_info info;
12124
12125 @@ -35,15 +37,22 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *filp,
12126
12127 info.flags = 0;
12128 info.length = len;
12129 - info.low_limit = TASK_UNMAPPED_BASE;
12130 + info.low_limit = mm->mmap_base;
12131 info.high_limit = min(task_size, VA_EXCLUDE_START);
12132 info.align_mask = PAGE_MASK & ~HPAGE_MASK;
12133 info.align_offset = 0;
12134 + info.threadstack_offset = offset;
12135 addr = vm_unmapped_area(&info);
12136
12137 if ((addr & ~PAGE_MASK) && task_size > VA_EXCLUDE_END) {
12138 VM_BUG_ON(addr != -ENOMEM);
12139 info.low_limit = VA_EXCLUDE_END;
12140 +
12141 +#ifdef CONFIG_PAX_RANDMMAP
12142 + if (mm->pax_flags & MF_PAX_RANDMMAP)
12143 + info.low_limit += mm->delta_mmap;
12144 +#endif
12145 +
12146 info.high_limit = task_size;
12147 addr = vm_unmapped_area(&info);
12148 }
12149 @@ -55,7 +64,8 @@ static unsigned long
12150 hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12151 const unsigned long len,
12152 const unsigned long pgoff,
12153 - const unsigned long flags)
12154 + const unsigned long flags,
12155 + const unsigned long offset)
12156 {
12157 struct mm_struct *mm = current->mm;
12158 unsigned long addr = addr0;
12159 @@ -70,6 +80,7 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12160 info.high_limit = mm->mmap_base;
12161 info.align_mask = PAGE_MASK & ~HPAGE_MASK;
12162 info.align_offset = 0;
12163 + info.threadstack_offset = offset;
12164 addr = vm_unmapped_area(&info);
12165
12166 /*
12167 @@ -82,6 +93,12 @@ hugetlb_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12168 VM_BUG_ON(addr != -ENOMEM);
12169 info.flags = 0;
12170 info.low_limit = TASK_UNMAPPED_BASE;
12171 +
12172 +#ifdef CONFIG_PAX_RANDMMAP
12173 + if (mm->pax_flags & MF_PAX_RANDMMAP)
12174 + info.low_limit += mm->delta_mmap;
12175 +#endif
12176 +
12177 info.high_limit = STACK_TOP32;
12178 addr = vm_unmapped_area(&info);
12179 }
12180 @@ -96,6 +113,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
12181 struct mm_struct *mm = current->mm;
12182 struct vm_area_struct *vma;
12183 unsigned long task_size = TASK_SIZE;
12184 + unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
12185
12186 if (test_thread_flag(TIF_32BIT))
12187 task_size = STACK_TOP32;
12188 @@ -111,19 +129,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
12189 return addr;
12190 }
12191
12192 +#ifdef CONFIG_PAX_RANDMMAP
12193 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12194 +#endif
12195 +
12196 if (addr) {
12197 addr = ALIGN(addr, HPAGE_SIZE);
12198 vma = find_vma(mm, addr);
12199 - if (task_size - len >= addr &&
12200 - (!vma || addr + len <= vma->vm_start))
12201 + if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
12202 return addr;
12203 }
12204 if (mm->get_unmapped_area == arch_get_unmapped_area)
12205 return hugetlb_get_unmapped_area_bottomup(file, addr, len,
12206 - pgoff, flags);
12207 + pgoff, flags, offset);
12208 else
12209 return hugetlb_get_unmapped_area_topdown(file, addr, len,
12210 - pgoff, flags);
12211 + pgoff, flags, offset);
12212 }
12213
12214 pte_t *huge_pte_alloc(struct mm_struct *mm,
12215 diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
12216 index eafbc65..5a8070d 100644
12217 --- a/arch/sparc/mm/init_64.c
12218 +++ b/arch/sparc/mm/init_64.c
12219 @@ -188,9 +188,9 @@ unsigned long sparc64_kern_sec_context __read_mostly;
12220 int num_kernel_image_mappings;
12221
12222 #ifdef CONFIG_DEBUG_DCFLUSH
12223 -atomic_t dcpage_flushes = ATOMIC_INIT(0);
12224 +atomic_unchecked_t dcpage_flushes = ATOMIC_INIT(0);
12225 #ifdef CONFIG_SMP
12226 -atomic_t dcpage_flushes_xcall = ATOMIC_INIT(0);
12227 +atomic_unchecked_t dcpage_flushes_xcall = ATOMIC_INIT(0);
12228 #endif
12229 #endif
12230
12231 @@ -198,7 +198,7 @@ inline void flush_dcache_page_impl(struct page *page)
12232 {
12233 BUG_ON(tlb_type == hypervisor);
12234 #ifdef CONFIG_DEBUG_DCFLUSH
12235 - atomic_inc(&dcpage_flushes);
12236 + atomic_inc_unchecked(&dcpage_flushes);
12237 #endif
12238
12239 #ifdef DCACHE_ALIASING_POSSIBLE
12240 @@ -466,10 +466,10 @@ void mmu_info(struct seq_file *m)
12241
12242 #ifdef CONFIG_DEBUG_DCFLUSH
12243 seq_printf(m, "DCPageFlushes\t: %d\n",
12244 - atomic_read(&dcpage_flushes));
12245 + atomic_read_unchecked(&dcpage_flushes));
12246 #ifdef CONFIG_SMP
12247 seq_printf(m, "DCPageFlushesXC\t: %d\n",
12248 - atomic_read(&dcpage_flushes_xcall));
12249 + atomic_read_unchecked(&dcpage_flushes_xcall));
12250 #endif /* CONFIG_SMP */
12251 #endif /* CONFIG_DEBUG_DCFLUSH */
12252 }
12253 diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
12254 index b12cb5e..b89aba2 100644
12255 --- a/arch/sparc/mm/tlb.c
12256 +++ b/arch/sparc/mm/tlb.c
12257 @@ -134,7 +134,7 @@ no_cache_flush:
12258
12259 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
12260 static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
12261 - pmd_t pmd, bool exec)
12262 + pmd_t pmd)
12263 {
12264 unsigned long end;
12265 pte_t *pte;
12266 @@ -142,8 +142,11 @@ static void tlb_batch_pmd_scan(struct mm_struct *mm, unsigned long vaddr,
12267 pte = pte_offset_map(&pmd, vaddr);
12268 end = vaddr + HPAGE_SIZE;
12269 while (vaddr < end) {
12270 - if (pte_val(*pte) & _PAGE_VALID)
12271 + if (pte_val(*pte) & _PAGE_VALID) {
12272 + bool exec = pte_exec(*pte);
12273 +
12274 tlb_batch_add_one(mm, vaddr, exec);
12275 + }
12276 pte++;
12277 vaddr += PAGE_SIZE;
12278 }
12279 @@ -177,19 +180,30 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr,
12280 }
12281
12282 if (!pmd_none(orig)) {
12283 - pte_t orig_pte = __pte(pmd_val(orig));
12284 - bool exec = pte_exec(orig_pte);
12285 -
12286 addr &= HPAGE_MASK;
12287 if (pmd_trans_huge(orig)) {
12288 + pte_t orig_pte = __pte(pmd_val(orig));
12289 + bool exec = pte_exec(orig_pte);
12290 +
12291 tlb_batch_add_one(mm, addr, exec);
12292 tlb_batch_add_one(mm, addr + REAL_HPAGE_SIZE, exec);
12293 } else {
12294 - tlb_batch_pmd_scan(mm, addr, orig, exec);
12295 + tlb_batch_pmd_scan(mm, addr, orig);
12296 }
12297 }
12298 }
12299
12300 +void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address,
12301 + pmd_t *pmdp)
12302 +{
12303 + pmd_t entry = *pmdp;
12304 +
12305 + pmd_val(entry) &= ~_PAGE_VALID;
12306 +
12307 + set_pmd_at(vma->vm_mm, address, pmdp, entry);
12308 + flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE);
12309 +}
12310 +
12311 void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp,
12312 pgtable_t pgtable)
12313 {
12314 diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
12315 index b3692ce..e4517c9 100644
12316 --- a/arch/tile/Kconfig
12317 +++ b/arch/tile/Kconfig
12318 @@ -184,6 +184,7 @@ source "kernel/Kconfig.hz"
12319
12320 config KEXEC
12321 bool "kexec system call"
12322 + depends on !GRKERNSEC_KMEM
12323 ---help---
12324 kexec is a system call that implements the ability to shutdown your
12325 current kernel, and to start another kernel. It is like a reboot
12326 diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
12327 index ad220ee..2f537b3 100644
12328 --- a/arch/tile/include/asm/atomic_64.h
12329 +++ b/arch/tile/include/asm/atomic_64.h
12330 @@ -105,6 +105,16 @@ static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
12331
12332 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
12333
12334 +#define atomic64_read_unchecked(v) atomic64_read(v)
12335 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
12336 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
12337 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
12338 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
12339 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
12340 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
12341 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
12342 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
12343 +
12344 /* Atomic dec and inc don't implement barrier, so provide them if needed. */
12345 #define smp_mb__before_atomic_dec() smp_mb()
12346 #define smp_mb__after_atomic_dec() smp_mb()
12347 diff --git a/arch/tile/include/asm/cache.h b/arch/tile/include/asm/cache.h
12348 index 6160761..00cac88 100644
12349 --- a/arch/tile/include/asm/cache.h
12350 +++ b/arch/tile/include/asm/cache.h
12351 @@ -15,11 +15,12 @@
12352 #ifndef _ASM_TILE_CACHE_H
12353 #define _ASM_TILE_CACHE_H
12354
12355 +#include <linux/const.h>
12356 #include <arch/chip.h>
12357
12358 /* bytes per L1 data cache line */
12359 #define L1_CACHE_SHIFT CHIP_L1D_LOG_LINE_SIZE()
12360 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12361 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12362
12363 /* bytes per L2 cache line */
12364 #define L2_CACHE_SHIFT CHIP_L2_LOG_LINE_SIZE()
12365 diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
12366 index b6cde32..c0cb736 100644
12367 --- a/arch/tile/include/asm/uaccess.h
12368 +++ b/arch/tile/include/asm/uaccess.h
12369 @@ -414,9 +414,9 @@ static inline unsigned long __must_check copy_from_user(void *to,
12370 const void __user *from,
12371 unsigned long n)
12372 {
12373 - int sz = __compiletime_object_size(to);
12374 + size_t sz = __compiletime_object_size(to);
12375
12376 - if (likely(sz == -1 || sz >= n))
12377 + if (likely(sz == (size_t)-1 || sz >= n))
12378 n = _copy_from_user(to, from, n);
12379 else
12380 copy_from_user_overflow();
12381 diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c
12382 index 0cb3bba..7338b2d 100644
12383 --- a/arch/tile/mm/hugetlbpage.c
12384 +++ b/arch/tile/mm/hugetlbpage.c
12385 @@ -212,6 +212,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
12386 info.high_limit = TASK_SIZE;
12387 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
12388 info.align_offset = 0;
12389 + info.threadstack_offset = 0;
12390 return vm_unmapped_area(&info);
12391 }
12392
12393 @@ -229,6 +230,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
12394 info.high_limit = current->mm->mmap_base;
12395 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
12396 info.align_offset = 0;
12397 + info.threadstack_offset = 0;
12398 addr = vm_unmapped_area(&info);
12399
12400 /*
12401 diff --git a/arch/um/Makefile b/arch/um/Makefile
12402 index 36e658a..71a5c5a 100644
12403 --- a/arch/um/Makefile
12404 +++ b/arch/um/Makefile
12405 @@ -72,6 +72,10 @@ USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
12406 $(patsubst -I%,,$(KBUILD_CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
12407 $(filter -I%,$(CFLAGS)) -D_FILE_OFFSET_BITS=64 -idirafter include
12408
12409 +ifdef CONSTIFY_PLUGIN
12410 +USER_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12411 +endif
12412 +
12413 #This will adjust *FLAGS accordingly to the platform.
12414 include $(srctree)/$(ARCH_DIR)/Makefile-os-$(OS)
12415
12416 diff --git a/arch/um/include/asm/cache.h b/arch/um/include/asm/cache.h
12417 index 19e1bdd..3665b77 100644
12418 --- a/arch/um/include/asm/cache.h
12419 +++ b/arch/um/include/asm/cache.h
12420 @@ -1,6 +1,7 @@
12421 #ifndef __UM_CACHE_H
12422 #define __UM_CACHE_H
12423
12424 +#include <linux/const.h>
12425
12426 #if defined(CONFIG_UML_X86) && !defined(CONFIG_64BIT)
12427 # define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
12428 @@ -12,6 +13,6 @@
12429 # define L1_CACHE_SHIFT 5
12430 #endif
12431
12432 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12433 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12434
12435 #endif
12436 diff --git a/arch/um/include/asm/kmap_types.h b/arch/um/include/asm/kmap_types.h
12437 index 2e0a6b1..a64d0f5 100644
12438 --- a/arch/um/include/asm/kmap_types.h
12439 +++ b/arch/um/include/asm/kmap_types.h
12440 @@ -8,6 +8,6 @@
12441
12442 /* No more #include "asm/arch/kmap_types.h" ! */
12443
12444 -#define KM_TYPE_NR 14
12445 +#define KM_TYPE_NR 15
12446
12447 #endif
12448 diff --git a/arch/um/include/asm/page.h b/arch/um/include/asm/page.h
12449 index 5ff53d9..5850cdf 100644
12450 --- a/arch/um/include/asm/page.h
12451 +++ b/arch/um/include/asm/page.h
12452 @@ -14,6 +14,9 @@
12453 #define PAGE_SIZE (_AC(1, UL) << PAGE_SHIFT)
12454 #define PAGE_MASK (~(PAGE_SIZE-1))
12455
12456 +#define ktla_ktva(addr) (addr)
12457 +#define ktva_ktla(addr) (addr)
12458 +
12459 #ifndef __ASSEMBLY__
12460
12461 struct page;
12462 diff --git a/arch/um/include/asm/pgtable-3level.h b/arch/um/include/asm/pgtable-3level.h
12463 index 0032f92..cd151e0 100644
12464 --- a/arch/um/include/asm/pgtable-3level.h
12465 +++ b/arch/um/include/asm/pgtable-3level.h
12466 @@ -58,6 +58,7 @@
12467 #define pud_present(x) (pud_val(x) & _PAGE_PRESENT)
12468 #define pud_populate(mm, pud, pmd) \
12469 set_pud(pud, __pud(_PAGE_TABLE + __pa(pmd)))
12470 +#define pud_populate_kernel(mm, pud, pmd) pud_populate((mm), (pud), (pmd))
12471
12472 #ifdef CONFIG_64BIT
12473 #define set_pud(pudptr, pudval) set_64bit((u64 *) (pudptr), pud_val(pudval))
12474 diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
12475 index eecc414..48adb87 100644
12476 --- a/arch/um/kernel/process.c
12477 +++ b/arch/um/kernel/process.c
12478 @@ -356,22 +356,6 @@ int singlestepping(void * t)
12479 return 2;
12480 }
12481
12482 -/*
12483 - * Only x86 and x86_64 have an arch_align_stack().
12484 - * All other arches have "#define arch_align_stack(x) (x)"
12485 - * in their asm/system.h
12486 - * As this is included in UML from asm-um/system-generic.h,
12487 - * we can use it to behave as the subarch does.
12488 - */
12489 -#ifndef arch_align_stack
12490 -unsigned long arch_align_stack(unsigned long sp)
12491 -{
12492 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
12493 - sp -= get_random_int() % 8192;
12494 - return sp & ~0xf;
12495 -}
12496 -#endif
12497 -
12498 unsigned long get_wchan(struct task_struct *p)
12499 {
12500 unsigned long stack_page, sp, ip;
12501 diff --git a/arch/unicore32/include/asm/cache.h b/arch/unicore32/include/asm/cache.h
12502 index ad8f795..2c7eec6 100644
12503 --- a/arch/unicore32/include/asm/cache.h
12504 +++ b/arch/unicore32/include/asm/cache.h
12505 @@ -12,8 +12,10 @@
12506 #ifndef __UNICORE_CACHE_H__
12507 #define __UNICORE_CACHE_H__
12508
12509 -#define L1_CACHE_SHIFT (5)
12510 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
12511 +#include <linux/const.h>
12512 +
12513 +#define L1_CACHE_SHIFT 5
12514 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
12515
12516 /*
12517 * Memory returned by kmalloc() may be used for DMA, so we must make
12518 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
12519 index 0af5250..59f9597 100644
12520 --- a/arch/x86/Kconfig
12521 +++ b/arch/x86/Kconfig
12522 @@ -126,7 +126,7 @@ config X86
12523 select RTC_LIB
12524 select HAVE_DEBUG_STACKOVERFLOW
12525 select HAVE_IRQ_EXIT_ON_IRQ_STACK if X86_64
12526 - select HAVE_CC_STACKPROTECTOR
12527 + select HAVE_CC_STACKPROTECTOR if X86_64 || !PAX_MEMORY_UDEREF
12528
12529 config INSTRUCTION_DECODER
12530 def_bool y
12531 @@ -251,7 +251,7 @@ config X86_HT
12532
12533 config X86_32_LAZY_GS
12534 def_bool y
12535 - depends on X86_32 && !CC_STACKPROTECTOR
12536 + depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
12537
12538 config ARCH_HWEIGHT_CFLAGS
12539 string
12540 @@ -589,6 +589,7 @@ config SCHED_OMIT_FRAME_POINTER
12541
12542 menuconfig HYPERVISOR_GUEST
12543 bool "Linux guest support"
12544 + depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_GUEST || (GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN)
12545 ---help---
12546 Say Y here to enable options for running Linux under various hyper-
12547 visors. This option enables basic hypervisor detection and platform
12548 @@ -1111,7 +1112,7 @@ choice
12549
12550 config NOHIGHMEM
12551 bool "off"
12552 - depends on !X86_NUMAQ
12553 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12554 ---help---
12555 Linux can use up to 64 Gigabytes of physical memory on x86 systems.
12556 However, the address space of 32-bit x86 processors is only 4
12557 @@ -1148,7 +1149,7 @@ config NOHIGHMEM
12558
12559 config HIGHMEM4G
12560 bool "4GB"
12561 - depends on !X86_NUMAQ
12562 + depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
12563 ---help---
12564 Select this if you have a 32-bit processor and between 1 and 4
12565 gigabytes of physical RAM.
12566 @@ -1201,7 +1202,7 @@ config PAGE_OFFSET
12567 hex
12568 default 0xB0000000 if VMSPLIT_3G_OPT
12569 default 0x80000000 if VMSPLIT_2G
12570 - default 0x78000000 if VMSPLIT_2G_OPT
12571 + default 0x70000000 if VMSPLIT_2G_OPT
12572 default 0x40000000 if VMSPLIT_1G
12573 default 0xC0000000
12574 depends on X86_32
12575 @@ -1605,6 +1606,7 @@ source kernel/Kconfig.hz
12576
12577 config KEXEC
12578 bool "kexec system call"
12579 + depends on !GRKERNSEC_KMEM
12580 ---help---
12581 kexec is a system call that implements the ability to shutdown your
12582 current kernel, and to start another kernel. It is like a reboot
12583 @@ -1756,7 +1758,9 @@ config X86_NEED_RELOCS
12584
12585 config PHYSICAL_ALIGN
12586 hex "Alignment value to which kernel should be aligned"
12587 - default "0x200000"
12588 + default "0x1000000"
12589 + range 0x200000 0x1000000 if PAX_KERNEXEC && X86_PAE
12590 + range 0x400000 0x1000000 if PAX_KERNEXEC && !X86_PAE
12591 range 0x2000 0x1000000 if X86_32
12592 range 0x200000 0x1000000 if X86_64
12593 ---help---
12594 @@ -1836,9 +1840,10 @@ config DEBUG_HOTPLUG_CPU0
12595 If unsure, say N.
12596
12597 config COMPAT_VDSO
12598 - def_bool y
12599 + def_bool n
12600 prompt "Compat VDSO support"
12601 depends on X86_32 || IA32_EMULATION
12602 + depends on !PAX_PAGEEXEC && !PAX_SEGMEXEC && !PAX_KERNEXEC && !PAX_MEMORY_UDEREF
12603 ---help---
12604 Map the 32-bit VDSO to the predictable old-style address too.
12605
12606 diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
12607 index f3aaf23..a1d3c49 100644
12608 --- a/arch/x86/Kconfig.cpu
12609 +++ b/arch/x86/Kconfig.cpu
12610 @@ -319,7 +319,7 @@ config X86_PPRO_FENCE
12611
12612 config X86_F00F_BUG
12613 def_bool y
12614 - depends on M586MMX || M586TSC || M586 || M486
12615 + depends on (M586MMX || M586TSC || M586 || M486) && !PAX_KERNEXEC
12616
12617 config X86_INVD_BUG
12618 def_bool y
12619 @@ -327,7 +327,7 @@ config X86_INVD_BUG
12620
12621 config X86_ALIGNMENT_16
12622 def_bool y
12623 - depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || MELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12624 + depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
12625
12626 config X86_INTEL_USERCOPY
12627 def_bool y
12628 @@ -369,7 +369,7 @@ config X86_CMPXCHG64
12629 # generates cmov.
12630 config X86_CMOV
12631 def_bool y
12632 - depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12633 + depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
12634
12635 config X86_MINIMUM_CPU_FAMILY
12636 int
12637 diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
12638 index 321a52c..3d51a5e 100644
12639 --- a/arch/x86/Kconfig.debug
12640 +++ b/arch/x86/Kconfig.debug
12641 @@ -84,7 +84,7 @@ config X86_PTDUMP
12642 config DEBUG_RODATA
12643 bool "Write protect kernel read-only data structures"
12644 default y
12645 - depends on DEBUG_KERNEL
12646 + depends on DEBUG_KERNEL && BROKEN
12647 ---help---
12648 Mark the kernel read-only data as write-protected in the pagetables,
12649 in order to catch accidental (and incorrect) writes to such const
12650 @@ -102,7 +102,7 @@ config DEBUG_RODATA_TEST
12651
12652 config DEBUG_SET_MODULE_RONX
12653 bool "Set loadable kernel module data as NX and text as RO"
12654 - depends on MODULES
12655 + depends on MODULES && BROKEN
12656 ---help---
12657 This option helps catch unintended modifications to loadable
12658 kernel module's text and read-only data. It also prevents execution
12659 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
12660 index 0dd99ea..4a63d82 100644
12661 --- a/arch/x86/Makefile
12662 +++ b/arch/x86/Makefile
12663 @@ -71,9 +71,6 @@ ifeq ($(CONFIG_X86_32),y)
12664 # CPU-specific tuning. Anything which can be shared with UML should go here.
12665 include $(srctree)/arch/x86/Makefile_32.cpu
12666 KBUILD_CFLAGS += $(cflags-y)
12667 -
12668 - # temporary until string.h is fixed
12669 - KBUILD_CFLAGS += -ffreestanding
12670 else
12671 BITS := 64
12672 UTS_MACHINE := x86_64
12673 @@ -112,6 +109,9 @@ else
12674 KBUILD_CFLAGS += -maccumulate-outgoing-args
12675 endif
12676
12677 +# temporary until string.h is fixed
12678 +KBUILD_CFLAGS += -ffreestanding
12679 +
12680 # Make sure compiler does not have buggy stack-protector support.
12681 ifdef CONFIG_CC_STACKPROTECTOR
12682 cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
12683 @@ -269,3 +269,12 @@ define archhelp
12684 echo ' FDINITRD=file initrd for the booted kernel'
12685 echo ' kvmconfig - Enable additional options for guest kernel support'
12686 endef
12687 +
12688 +define OLD_LD
12689 +
12690 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
12691 +*** Please upgrade your binutils to 2.18 or newer
12692 +endef
12693 +
12694 +archprepare:
12695 + $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
12696 diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
12697 index 878df7e..a803913 100644
12698 --- a/arch/x86/boot/Makefile
12699 +++ b/arch/x86/boot/Makefile
12700 @@ -52,6 +52,9 @@ $(obj)/cpustr.h: $(obj)/mkcpustr FORCE
12701 # ---------------------------------------------------------------------------
12702
12703 KBUILD_CFLAGS := $(USERINCLUDE) $(REALMODE_CFLAGS) -D_SETUP
12704 +ifdef CONSTIFY_PLUGIN
12705 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12706 +endif
12707 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12708 GCOV_PROFILE := n
12709
12710 diff --git a/arch/x86/boot/bitops.h b/arch/x86/boot/bitops.h
12711 index 878e4b9..20537ab 100644
12712 --- a/arch/x86/boot/bitops.h
12713 +++ b/arch/x86/boot/bitops.h
12714 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int nr, const void *addr)
12715 u8 v;
12716 const u32 *p = (const u32 *)addr;
12717
12718 - asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
12719 + asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
12720 return v;
12721 }
12722
12723 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int nr, const void *addr)
12724
12725 static inline void set_bit(int nr, void *addr)
12726 {
12727 - asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
12728 + asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
12729 }
12730
12731 #endif /* BOOT_BITOPS_H */
12732 diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
12733 index 50f8c5e..4f84fff 100644
12734 --- a/arch/x86/boot/boot.h
12735 +++ b/arch/x86/boot/boot.h
12736 @@ -84,7 +84,7 @@ static inline void io_delay(void)
12737 static inline u16 ds(void)
12738 {
12739 u16 seg;
12740 - asm("movw %%ds,%0" : "=rm" (seg));
12741 + asm volatile("movw %%ds,%0" : "=rm" (seg));
12742 return seg;
12743 }
12744
12745 @@ -180,7 +180,7 @@ static inline void wrgs32(u32 v, addr_t addr)
12746 static inline int memcmp(const void *s1, const void *s2, size_t len)
12747 {
12748 u8 diff;
12749 - asm("repe; cmpsb; setnz %0"
12750 + asm volatile("repe; cmpsb; setnz %0"
12751 : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
12752 return diff;
12753 }
12754 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
12755 index 0fcd913..3bb5c42 100644
12756 --- a/arch/x86/boot/compressed/Makefile
12757 +++ b/arch/x86/boot/compressed/Makefile
12758 @@ -16,6 +16,9 @@ KBUILD_CFLAGS += $(cflags-y)
12759 KBUILD_CFLAGS += -mno-mmx -mno-sse
12760 KBUILD_CFLAGS += $(call cc-option,-ffreestanding)
12761 KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
12762 +ifdef CONSTIFY_PLUGIN
12763 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
12764 +endif
12765
12766 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
12767 GCOV_PROFILE := n
12768 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
12769 index a53440e..c3dbf1e 100644
12770 --- a/arch/x86/boot/compressed/efi_stub_32.S
12771 +++ b/arch/x86/boot/compressed/efi_stub_32.S
12772 @@ -46,16 +46,13 @@ ENTRY(efi_call_phys)
12773 * parameter 2, ..., param n. To make things easy, we save the return
12774 * address of efi_call_phys in a global variable.
12775 */
12776 - popl %ecx
12777 - movl %ecx, saved_return_addr(%edx)
12778 - /* get the function pointer into ECX*/
12779 - popl %ecx
12780 - movl %ecx, efi_rt_function_ptr(%edx)
12781 + popl saved_return_addr(%edx)
12782 + popl efi_rt_function_ptr(%edx)
12783
12784 /*
12785 * 3. Call the physical function.
12786 */
12787 - call *%ecx
12788 + call *efi_rt_function_ptr(%edx)
12789
12790 /*
12791 * 4. Balance the stack. And because EAX contain the return value,
12792 @@ -67,15 +64,12 @@ ENTRY(efi_call_phys)
12793 1: popl %edx
12794 subl $1b, %edx
12795
12796 - movl efi_rt_function_ptr(%edx), %ecx
12797 - pushl %ecx
12798 + pushl efi_rt_function_ptr(%edx)
12799
12800 /*
12801 * 10. Push the saved return address onto the stack and return.
12802 */
12803 - movl saved_return_addr(%edx), %ecx
12804 - pushl %ecx
12805 - ret
12806 + jmpl *saved_return_addr(%edx)
12807 ENDPROC(efi_call_phys)
12808 .previous
12809
12810 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
12811 index f45ab7a..ebc015f 100644
12812 --- a/arch/x86/boot/compressed/head_32.S
12813 +++ b/arch/x86/boot/compressed/head_32.S
12814 @@ -119,10 +119,10 @@ preferred_addr:
12815 addl %eax, %ebx
12816 notl %eax
12817 andl %eax, %ebx
12818 - cmpl $LOAD_PHYSICAL_ADDR, %ebx
12819 + cmpl $____LOAD_PHYSICAL_ADDR, %ebx
12820 jge 1f
12821 #endif
12822 - movl $LOAD_PHYSICAL_ADDR, %ebx
12823 + movl $____LOAD_PHYSICAL_ADDR, %ebx
12824 1:
12825
12826 /* Target address to relocate to for decompression */
12827 diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
12828 index b10fa66..5ee0472 100644
12829 --- a/arch/x86/boot/compressed/head_64.S
12830 +++ b/arch/x86/boot/compressed/head_64.S
12831 @@ -94,10 +94,10 @@ ENTRY(startup_32)
12832 addl %eax, %ebx
12833 notl %eax
12834 andl %eax, %ebx
12835 - cmpl $LOAD_PHYSICAL_ADDR, %ebx
12836 + cmpl $____LOAD_PHYSICAL_ADDR, %ebx
12837 jge 1f
12838 #endif
12839 - movl $LOAD_PHYSICAL_ADDR, %ebx
12840 + movl $____LOAD_PHYSICAL_ADDR, %ebx
12841 1:
12842
12843 /* Target address to relocate to for decompression */
12844 @@ -268,10 +268,10 @@ preferred_addr:
12845 addq %rax, %rbp
12846 notq %rax
12847 andq %rax, %rbp
12848 - cmpq $LOAD_PHYSICAL_ADDR, %rbp
12849 + cmpq $____LOAD_PHYSICAL_ADDR, %rbp
12850 jge 1f
12851 #endif
12852 - movq $LOAD_PHYSICAL_ADDR, %rbp
12853 + movq $____LOAD_PHYSICAL_ADDR, %rbp
12854 1:
12855
12856 /* Target address to relocate to for decompression */
12857 @@ -363,8 +363,8 @@ gdt:
12858 .long gdt
12859 .word 0
12860 .quad 0x0000000000000000 /* NULL descriptor */
12861 - .quad 0x00af9a000000ffff /* __KERNEL_CS */
12862 - .quad 0x00cf92000000ffff /* __KERNEL_DS */
12863 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
12864 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
12865 .quad 0x0080890000000000 /* TS descriptor */
12866 .quad 0x0000000000000000 /* TS continued */
12867 gdt_end:
12868 diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
12869 index 196eaf3..c96716d 100644
12870 --- a/arch/x86/boot/compressed/misc.c
12871 +++ b/arch/x86/boot/compressed/misc.c
12872 @@ -218,7 +218,7 @@ void __putstr(const char *s)
12873
12874 void *memset(void *s, int c, size_t n)
12875 {
12876 - int i;
12877 + size_t i;
12878 char *ss = s;
12879
12880 for (i = 0; i < n; i++)
12881 @@ -277,7 +277,7 @@ static void handle_relocations(void *output, unsigned long output_len)
12882 * Calculate the delta between where vmlinux was linked to load
12883 * and where it was actually loaded.
12884 */
12885 - delta = min_addr - LOAD_PHYSICAL_ADDR;
12886 + delta = min_addr - ____LOAD_PHYSICAL_ADDR;
12887 if (!delta) {
12888 debug_putstr("No relocation needed... ");
12889 return;
12890 @@ -347,7 +347,7 @@ static void parse_elf(void *output)
12891 Elf32_Ehdr ehdr;
12892 Elf32_Phdr *phdrs, *phdr;
12893 #endif
12894 - void *dest;
12895 + void *dest, *prev;
12896 int i;
12897
12898 memcpy(&ehdr, output, sizeof(ehdr));
12899 @@ -374,13 +374,16 @@ static void parse_elf(void *output)
12900 case PT_LOAD:
12901 #ifdef CONFIG_RELOCATABLE
12902 dest = output;
12903 - dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
12904 + dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
12905 #else
12906 dest = (void *)(phdr->p_paddr);
12907 #endif
12908 memcpy(dest,
12909 output + phdr->p_offset,
12910 phdr->p_filesz);
12911 + if (i)
12912 + memset(prev, 0xff, dest - prev);
12913 + prev = dest + phdr->p_filesz;
12914 break;
12915 default: /* Ignore other PT_* */ break;
12916 }
12917 @@ -430,7 +433,7 @@ asmlinkage void *decompress_kernel(void *rmode, memptr heap,
12918 error("Destination address too large");
12919 #endif
12920 #ifndef CONFIG_RELOCATABLE
12921 - if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
12922 + if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
12923 error("Wrong destination address");
12924 #endif
12925
12926 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
12927 index 100a9a1..bb3bdb0 100644
12928 --- a/arch/x86/boot/cpucheck.c
12929 +++ b/arch/x86/boot/cpucheck.c
12930 @@ -117,9 +117,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
12931 u32 ecx = MSR_K7_HWCR;
12932 u32 eax, edx;
12933
12934 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12935 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12936 eax &= ~(1 << 15);
12937 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12938 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12939
12940 get_cpuflags(); /* Make sure it really did something */
12941 err = check_cpuflags();
12942 @@ -132,9 +132,9 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
12943 u32 ecx = MSR_VIA_FCR;
12944 u32 eax, edx;
12945
12946 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12947 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12948 eax |= (1<<1)|(1<<7);
12949 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12950 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12951
12952 set_bit(X86_FEATURE_CX8, cpu.flags);
12953 err = check_cpuflags();
12954 @@ -145,12 +145,12 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
12955 u32 eax, edx;
12956 u32 level = 1;
12957
12958 - asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12959 - asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
12960 - asm("cpuid"
12961 + asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
12962 + asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
12963 + asm volatile("cpuid"
12964 : "+a" (level), "=d" (cpu.flags[0])
12965 : : "ecx", "ebx");
12966 - asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12967 + asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
12968
12969 err = check_cpuflags();
12970 }
12971 diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
12972 index ec3b8ba..6a0db1f 100644
12973 --- a/arch/x86/boot/header.S
12974 +++ b/arch/x86/boot/header.S
12975 @@ -416,10 +416,14 @@ setup_data: .quad 0 # 64-bit physical pointer to
12976 # single linked list of
12977 # struct setup_data
12978
12979 -pref_address: .quad LOAD_PHYSICAL_ADDR # preferred load addr
12980 +pref_address: .quad ____LOAD_PHYSICAL_ADDR # preferred load addr
12981
12982 #define ZO_INIT_SIZE (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
12983 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
12984 +#define VO_INIT_SIZE (VO__end - VO__text - __PAGE_OFFSET - ____LOAD_PHYSICAL_ADDR)
12985 +#else
12986 #define VO_INIT_SIZE (VO__end - VO__text)
12987 +#endif
12988 #if ZO_INIT_SIZE > VO_INIT_SIZE
12989 #define INIT_SIZE ZO_INIT_SIZE
12990 #else
12991 diff --git a/arch/x86/boot/memory.c b/arch/x86/boot/memory.c
12992 index db75d07..8e6d0af 100644
12993 --- a/arch/x86/boot/memory.c
12994 +++ b/arch/x86/boot/memory.c
12995 @@ -19,7 +19,7 @@
12996
12997 static int detect_memory_e820(void)
12998 {
12999 - int count = 0;
13000 + unsigned int count = 0;
13001 struct biosregs ireg, oreg;
13002 struct e820entry *desc = boot_params.e820_map;
13003 static struct e820entry buf; /* static so it is zeroed */
13004 diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
13005 index 11e8c6e..fdbb1ed 100644
13006 --- a/arch/x86/boot/video-vesa.c
13007 +++ b/arch/x86/boot/video-vesa.c
13008 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
13009
13010 boot_params.screen_info.vesapm_seg = oreg.es;
13011 boot_params.screen_info.vesapm_off = oreg.di;
13012 + boot_params.screen_info.vesapm_size = oreg.cx;
13013 }
13014
13015 /*
13016 diff --git a/arch/x86/boot/video.c b/arch/x86/boot/video.c
13017 index 43eda28..5ab5fdb 100644
13018 --- a/arch/x86/boot/video.c
13019 +++ b/arch/x86/boot/video.c
13020 @@ -96,7 +96,7 @@ static void store_mode_params(void)
13021 static unsigned int get_entry(void)
13022 {
13023 char entry_buf[4];
13024 - int i, len = 0;
13025 + unsigned int i, len = 0;
13026 int key;
13027 unsigned int v;
13028
13029 diff --git a/arch/x86/crypto/aes-x86_64-asm_64.S b/arch/x86/crypto/aes-x86_64-asm_64.S
13030 index 9105655..41779c1 100644
13031 --- a/arch/x86/crypto/aes-x86_64-asm_64.S
13032 +++ b/arch/x86/crypto/aes-x86_64-asm_64.S
13033 @@ -8,6 +8,8 @@
13034 * including this sentence is retained in full.
13035 */
13036
13037 +#include <asm/alternative-asm.h>
13038 +
13039 .extern crypto_ft_tab
13040 .extern crypto_it_tab
13041 .extern crypto_fl_tab
13042 @@ -70,6 +72,8 @@
13043 je B192; \
13044 leaq 32(r9),r9;
13045
13046 +#define ret pax_force_retaddr; ret
13047 +
13048 #define epilogue(FUNC,r1,r2,r3,r4,r5,r6,r7,r8,r9) \
13049 movq r1,r2; \
13050 movq r3,r4; \
13051 diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
13052 index 477e9d7..c92c7d8 100644
13053 --- a/arch/x86/crypto/aesni-intel_asm.S
13054 +++ b/arch/x86/crypto/aesni-intel_asm.S
13055 @@ -31,6 +31,7 @@
13056
13057 #include <linux/linkage.h>
13058 #include <asm/inst.h>
13059 +#include <asm/alternative-asm.h>
13060
13061 #ifdef __x86_64__
13062 .data
13063 @@ -205,7 +206,7 @@ enc: .octa 0x2
13064 * num_initial_blocks = b mod 4
13065 * encrypt the initial num_initial_blocks blocks and apply ghash on
13066 * the ciphertext
13067 -* %r10, %r11, %r12, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13068 +* %r10, %r11, %r15, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13069 * are clobbered
13070 * arg1, %arg2, %arg3, %r14 are used as a pointer only, not modified
13071 */
13072 @@ -214,8 +215,8 @@ enc: .octa 0x2
13073 .macro INITIAL_BLOCKS_DEC num_initial_blocks TMP1 TMP2 TMP3 TMP4 TMP5 XMM0 XMM1 \
13074 XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
13075 mov arg7, %r10 # %r10 = AAD
13076 - mov arg8, %r12 # %r12 = aadLen
13077 - mov %r12, %r11
13078 + mov arg8, %r15 # %r15 = aadLen
13079 + mov %r15, %r11
13080 pxor %xmm\i, %xmm\i
13081 _get_AAD_loop\num_initial_blocks\operation:
13082 movd (%r10), \TMP1
13083 @@ -223,15 +224,15 @@ _get_AAD_loop\num_initial_blocks\operation:
13084 psrldq $4, %xmm\i
13085 pxor \TMP1, %xmm\i
13086 add $4, %r10
13087 - sub $4, %r12
13088 + sub $4, %r15
13089 jne _get_AAD_loop\num_initial_blocks\operation
13090 cmp $16, %r11
13091 je _get_AAD_loop2_done\num_initial_blocks\operation
13092 - mov $16, %r12
13093 + mov $16, %r15
13094 _get_AAD_loop2\num_initial_blocks\operation:
13095 psrldq $4, %xmm\i
13096 - sub $4, %r12
13097 - cmp %r11, %r12
13098 + sub $4, %r15
13099 + cmp %r11, %r15
13100 jne _get_AAD_loop2\num_initial_blocks\operation
13101 _get_AAD_loop2_done\num_initial_blocks\operation:
13102 movdqa SHUF_MASK(%rip), %xmm14
13103 @@ -443,7 +444,7 @@ _initial_blocks_done\num_initial_blocks\operation:
13104 * num_initial_blocks = b mod 4
13105 * encrypt the initial num_initial_blocks blocks and apply ghash on
13106 * the ciphertext
13107 -* %r10, %r11, %r12, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13108 +* %r10, %r11, %r15, %rax, %xmm5, %xmm6, %xmm7, %xmm8, %xmm9 registers
13109 * are clobbered
13110 * arg1, %arg2, %arg3, %r14 are used as a pointer only, not modified
13111 */
13112 @@ -452,8 +453,8 @@ _initial_blocks_done\num_initial_blocks\operation:
13113 .macro INITIAL_BLOCKS_ENC num_initial_blocks TMP1 TMP2 TMP3 TMP4 TMP5 XMM0 XMM1 \
13114 XMM2 XMM3 XMM4 XMMDst TMP6 TMP7 i i_seq operation
13115 mov arg7, %r10 # %r10 = AAD
13116 - mov arg8, %r12 # %r12 = aadLen
13117 - mov %r12, %r11
13118 + mov arg8, %r15 # %r15 = aadLen
13119 + mov %r15, %r11
13120 pxor %xmm\i, %xmm\i
13121 _get_AAD_loop\num_initial_blocks\operation:
13122 movd (%r10), \TMP1
13123 @@ -461,15 +462,15 @@ _get_AAD_loop\num_initial_blocks\operation:
13124 psrldq $4, %xmm\i
13125 pxor \TMP1, %xmm\i
13126 add $4, %r10
13127 - sub $4, %r12
13128 + sub $4, %r15
13129 jne _get_AAD_loop\num_initial_blocks\operation
13130 cmp $16, %r11
13131 je _get_AAD_loop2_done\num_initial_blocks\operation
13132 - mov $16, %r12
13133 + mov $16, %r15
13134 _get_AAD_loop2\num_initial_blocks\operation:
13135 psrldq $4, %xmm\i
13136 - sub $4, %r12
13137 - cmp %r11, %r12
13138 + sub $4, %r15
13139 + cmp %r11, %r15
13140 jne _get_AAD_loop2\num_initial_blocks\operation
13141 _get_AAD_loop2_done\num_initial_blocks\operation:
13142 movdqa SHUF_MASK(%rip), %xmm14
13143 @@ -1269,7 +1270,7 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst
13144 *
13145 *****************************************************************************/
13146 ENTRY(aesni_gcm_dec)
13147 - push %r12
13148 + push %r15
13149 push %r13
13150 push %r14
13151 mov %rsp, %r14
13152 @@ -1279,8 +1280,8 @@ ENTRY(aesni_gcm_dec)
13153 */
13154 sub $VARIABLE_OFFSET, %rsp
13155 and $~63, %rsp # align rsp to 64 bytes
13156 - mov %arg6, %r12
13157 - movdqu (%r12), %xmm13 # %xmm13 = HashKey
13158 + mov %arg6, %r15
13159 + movdqu (%r15), %xmm13 # %xmm13 = HashKey
13160 movdqa SHUF_MASK(%rip), %xmm2
13161 PSHUFB_XMM %xmm2, %xmm13
13162
13163 @@ -1308,10 +1309,10 @@ ENTRY(aesni_gcm_dec)
13164 movdqa %xmm13, HashKey(%rsp) # store HashKey<<1 (mod poly)
13165 mov %arg4, %r13 # save the number of bytes of plaintext/ciphertext
13166 and $-16, %r13 # %r13 = %r13 - (%r13 mod 16)
13167 - mov %r13, %r12
13168 - and $(3<<4), %r12
13169 + mov %r13, %r15
13170 + and $(3<<4), %r15
13171 jz _initial_num_blocks_is_0_decrypt
13172 - cmp $(2<<4), %r12
13173 + cmp $(2<<4), %r15
13174 jb _initial_num_blocks_is_1_decrypt
13175 je _initial_num_blocks_is_2_decrypt
13176 _initial_num_blocks_is_3_decrypt:
13177 @@ -1361,16 +1362,16 @@ _zero_cipher_left_decrypt:
13178 sub $16, %r11
13179 add %r13, %r11
13180 movdqu (%arg3,%r11,1), %xmm1 # receive the last <16 byte block
13181 - lea SHIFT_MASK+16(%rip), %r12
13182 - sub %r13, %r12
13183 + lea SHIFT_MASK+16(%rip), %r15
13184 + sub %r13, %r15
13185 # adjust the shuffle mask pointer to be able to shift 16-%r13 bytes
13186 # (%r13 is the number of bytes in plaintext mod 16)
13187 - movdqu (%r12), %xmm2 # get the appropriate shuffle mask
13188 + movdqu (%r15), %xmm2 # get the appropriate shuffle mask
13189 PSHUFB_XMM %xmm2, %xmm1 # right shift 16-%r13 butes
13190
13191 movdqa %xmm1, %xmm2
13192 pxor %xmm1, %xmm0 # Ciphertext XOR E(K, Yn)
13193 - movdqu ALL_F-SHIFT_MASK(%r12), %xmm1
13194 + movdqu ALL_F-SHIFT_MASK(%r15), %xmm1
13195 # get the appropriate mask to mask out top 16-%r13 bytes of %xmm0
13196 pand %xmm1, %xmm0 # mask out top 16-%r13 bytes of %xmm0
13197 pand %xmm1, %xmm2
13198 @@ -1399,9 +1400,9 @@ _less_than_8_bytes_left_decrypt:
13199 sub $1, %r13
13200 jne _less_than_8_bytes_left_decrypt
13201 _multiple_of_16_bytes_decrypt:
13202 - mov arg8, %r12 # %r13 = aadLen (number of bytes)
13203 - shl $3, %r12 # convert into number of bits
13204 - movd %r12d, %xmm15 # len(A) in %xmm15
13205 + mov arg8, %r15 # %r13 = aadLen (number of bytes)
13206 + shl $3, %r15 # convert into number of bits
13207 + movd %r15d, %xmm15 # len(A) in %xmm15
13208 shl $3, %arg4 # len(C) in bits (*128)
13209 MOVQ_R64_XMM %arg4, %xmm1
13210 pslldq $8, %xmm15 # %xmm15 = len(A)||0x0000000000000000
13211 @@ -1440,7 +1441,8 @@ _return_T_done_decrypt:
13212 mov %r14, %rsp
13213 pop %r14
13214 pop %r13
13215 - pop %r12
13216 + pop %r15
13217 + pax_force_retaddr
13218 ret
13219 ENDPROC(aesni_gcm_dec)
13220
13221 @@ -1529,7 +1531,7 @@ ENDPROC(aesni_gcm_dec)
13222 * poly = x^128 + x^127 + x^126 + x^121 + 1
13223 ***************************************************************************/
13224 ENTRY(aesni_gcm_enc)
13225 - push %r12
13226 + push %r15
13227 push %r13
13228 push %r14
13229 mov %rsp, %r14
13230 @@ -1539,8 +1541,8 @@ ENTRY(aesni_gcm_enc)
13231 #
13232 sub $VARIABLE_OFFSET, %rsp
13233 and $~63, %rsp
13234 - mov %arg6, %r12
13235 - movdqu (%r12), %xmm13
13236 + mov %arg6, %r15
13237 + movdqu (%r15), %xmm13
13238 movdqa SHUF_MASK(%rip), %xmm2
13239 PSHUFB_XMM %xmm2, %xmm13
13240
13241 @@ -1564,13 +1566,13 @@ ENTRY(aesni_gcm_enc)
13242 movdqa %xmm13, HashKey(%rsp)
13243 mov %arg4, %r13 # %xmm13 holds HashKey<<1 (mod poly)
13244 and $-16, %r13
13245 - mov %r13, %r12
13246 + mov %r13, %r15
13247
13248 # Encrypt first few blocks
13249
13250 - and $(3<<4), %r12
13251 + and $(3<<4), %r15
13252 jz _initial_num_blocks_is_0_encrypt
13253 - cmp $(2<<4), %r12
13254 + cmp $(2<<4), %r15
13255 jb _initial_num_blocks_is_1_encrypt
13256 je _initial_num_blocks_is_2_encrypt
13257 _initial_num_blocks_is_3_encrypt:
13258 @@ -1623,14 +1625,14 @@ _zero_cipher_left_encrypt:
13259 sub $16, %r11
13260 add %r13, %r11
13261 movdqu (%arg3,%r11,1), %xmm1 # receive the last <16 byte blocks
13262 - lea SHIFT_MASK+16(%rip), %r12
13263 - sub %r13, %r12
13264 + lea SHIFT_MASK+16(%rip), %r15
13265 + sub %r13, %r15
13266 # adjust the shuffle mask pointer to be able to shift 16-r13 bytes
13267 # (%r13 is the number of bytes in plaintext mod 16)
13268 - movdqu (%r12), %xmm2 # get the appropriate shuffle mask
13269 + movdqu (%r15), %xmm2 # get the appropriate shuffle mask
13270 PSHUFB_XMM %xmm2, %xmm1 # shift right 16-r13 byte
13271 pxor %xmm1, %xmm0 # Plaintext XOR Encrypt(K, Yn)
13272 - movdqu ALL_F-SHIFT_MASK(%r12), %xmm1
13273 + movdqu ALL_F-SHIFT_MASK(%r15), %xmm1
13274 # get the appropriate mask to mask out top 16-r13 bytes of xmm0
13275 pand %xmm1, %xmm0 # mask out top 16-r13 bytes of xmm0
13276 movdqa SHUF_MASK(%rip), %xmm10
13277 @@ -1663,9 +1665,9 @@ _less_than_8_bytes_left_encrypt:
13278 sub $1, %r13
13279 jne _less_than_8_bytes_left_encrypt
13280 _multiple_of_16_bytes_encrypt:
13281 - mov arg8, %r12 # %r12 = addLen (number of bytes)
13282 - shl $3, %r12
13283 - movd %r12d, %xmm15 # len(A) in %xmm15
13284 + mov arg8, %r15 # %r15 = addLen (number of bytes)
13285 + shl $3, %r15
13286 + movd %r15d, %xmm15 # len(A) in %xmm15
13287 shl $3, %arg4 # len(C) in bits (*128)
13288 MOVQ_R64_XMM %arg4, %xmm1
13289 pslldq $8, %xmm15 # %xmm15 = len(A)||0x0000000000000000
13290 @@ -1704,7 +1706,8 @@ _return_T_done_encrypt:
13291 mov %r14, %rsp
13292 pop %r14
13293 pop %r13
13294 - pop %r12
13295 + pop %r15
13296 + pax_force_retaddr
13297 ret
13298 ENDPROC(aesni_gcm_enc)
13299
13300 @@ -1722,6 +1725,7 @@ _key_expansion_256a:
13301 pxor %xmm1, %xmm0
13302 movaps %xmm0, (TKEYP)
13303 add $0x10, TKEYP
13304 + pax_force_retaddr
13305 ret
13306 ENDPROC(_key_expansion_128)
13307 ENDPROC(_key_expansion_256a)
13308 @@ -1748,6 +1752,7 @@ _key_expansion_192a:
13309 shufps $0b01001110, %xmm2, %xmm1
13310 movaps %xmm1, 0x10(TKEYP)
13311 add $0x20, TKEYP
13312 + pax_force_retaddr
13313 ret
13314 ENDPROC(_key_expansion_192a)
13315
13316 @@ -1768,6 +1773,7 @@ _key_expansion_192b:
13317
13318 movaps %xmm0, (TKEYP)
13319 add $0x10, TKEYP
13320 + pax_force_retaddr
13321 ret
13322 ENDPROC(_key_expansion_192b)
13323
13324 @@ -1781,6 +1787,7 @@ _key_expansion_256b:
13325 pxor %xmm1, %xmm2
13326 movaps %xmm2, (TKEYP)
13327 add $0x10, TKEYP
13328 + pax_force_retaddr
13329 ret
13330 ENDPROC(_key_expansion_256b)
13331
13332 @@ -1894,6 +1901,7 @@ ENTRY(aesni_set_key)
13333 #ifndef __x86_64__
13334 popl KEYP
13335 #endif
13336 + pax_force_retaddr
13337 ret
13338 ENDPROC(aesni_set_key)
13339
13340 @@ -1916,6 +1924,7 @@ ENTRY(aesni_enc)
13341 popl KLEN
13342 popl KEYP
13343 #endif
13344 + pax_force_retaddr
13345 ret
13346 ENDPROC(aesni_enc)
13347
13348 @@ -1974,6 +1983,7 @@ _aesni_enc1:
13349 AESENC KEY STATE
13350 movaps 0x70(TKEYP), KEY
13351 AESENCLAST KEY STATE
13352 + pax_force_retaddr
13353 ret
13354 ENDPROC(_aesni_enc1)
13355
13356 @@ -2083,6 +2093,7 @@ _aesni_enc4:
13357 AESENCLAST KEY STATE2
13358 AESENCLAST KEY STATE3
13359 AESENCLAST KEY STATE4
13360 + pax_force_retaddr
13361 ret
13362 ENDPROC(_aesni_enc4)
13363
13364 @@ -2106,6 +2117,7 @@ ENTRY(aesni_dec)
13365 popl KLEN
13366 popl KEYP
13367 #endif
13368 + pax_force_retaddr
13369 ret
13370 ENDPROC(aesni_dec)
13371
13372 @@ -2164,6 +2176,7 @@ _aesni_dec1:
13373 AESDEC KEY STATE
13374 movaps 0x70(TKEYP), KEY
13375 AESDECLAST KEY STATE
13376 + pax_force_retaddr
13377 ret
13378 ENDPROC(_aesni_dec1)
13379
13380 @@ -2273,6 +2286,7 @@ _aesni_dec4:
13381 AESDECLAST KEY STATE2
13382 AESDECLAST KEY STATE3
13383 AESDECLAST KEY STATE4
13384 + pax_force_retaddr
13385 ret
13386 ENDPROC(_aesni_dec4)
13387
13388 @@ -2331,6 +2345,7 @@ ENTRY(aesni_ecb_enc)
13389 popl KEYP
13390 popl LEN
13391 #endif
13392 + pax_force_retaddr
13393 ret
13394 ENDPROC(aesni_ecb_enc)
13395
13396 @@ -2390,6 +2405,7 @@ ENTRY(aesni_ecb_dec)
13397 popl KEYP
13398 popl LEN
13399 #endif
13400 + pax_force_retaddr
13401 ret
13402 ENDPROC(aesni_ecb_dec)
13403
13404 @@ -2432,6 +2448,7 @@ ENTRY(aesni_cbc_enc)
13405 popl LEN
13406 popl IVP
13407 #endif
13408 + pax_force_retaddr
13409 ret
13410 ENDPROC(aesni_cbc_enc)
13411
13412 @@ -2523,6 +2540,7 @@ ENTRY(aesni_cbc_dec)
13413 popl LEN
13414 popl IVP
13415 #endif
13416 + pax_force_retaddr
13417 ret
13418 ENDPROC(aesni_cbc_dec)
13419
13420 @@ -2550,6 +2568,7 @@ _aesni_inc_init:
13421 mov $1, TCTR_LOW
13422 MOVQ_R64_XMM TCTR_LOW INC
13423 MOVQ_R64_XMM CTR TCTR_LOW
13424 + pax_force_retaddr
13425 ret
13426 ENDPROC(_aesni_inc_init)
13427
13428 @@ -2579,6 +2598,7 @@ _aesni_inc:
13429 .Linc_low:
13430 movaps CTR, IV
13431 PSHUFB_XMM BSWAP_MASK IV
13432 + pax_force_retaddr
13433 ret
13434 ENDPROC(_aesni_inc)
13435
13436 @@ -2640,6 +2660,7 @@ ENTRY(aesni_ctr_enc)
13437 .Lctr_enc_ret:
13438 movups IV, (IVP)
13439 .Lctr_enc_just_ret:
13440 + pax_force_retaddr
13441 ret
13442 ENDPROC(aesni_ctr_enc)
13443
13444 @@ -2766,6 +2787,7 @@ ENTRY(aesni_xts_crypt8)
13445 pxor INC, STATE4
13446 movdqu STATE4, 0x70(OUTP)
13447
13448 + pax_force_retaddr
13449 ret
13450 ENDPROC(aesni_xts_crypt8)
13451
13452 diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
13453 index 246c670..466e2d6 100644
13454 --- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
13455 +++ b/arch/x86/crypto/blowfish-x86_64-asm_64.S
13456 @@ -21,6 +21,7 @@
13457 */
13458
13459 #include <linux/linkage.h>
13460 +#include <asm/alternative-asm.h>
13461
13462 .file "blowfish-x86_64-asm.S"
13463 .text
13464 @@ -149,9 +150,11 @@ ENTRY(__blowfish_enc_blk)
13465 jnz .L__enc_xor;
13466
13467 write_block();
13468 + pax_force_retaddr
13469 ret;
13470 .L__enc_xor:
13471 xor_block();
13472 + pax_force_retaddr
13473 ret;
13474 ENDPROC(__blowfish_enc_blk)
13475
13476 @@ -183,6 +186,7 @@ ENTRY(blowfish_dec_blk)
13477
13478 movq %r11, %rbp;
13479
13480 + pax_force_retaddr
13481 ret;
13482 ENDPROC(blowfish_dec_blk)
13483
13484 @@ -334,6 +338,7 @@ ENTRY(__blowfish_enc_blk_4way)
13485
13486 popq %rbx;
13487 popq %rbp;
13488 + pax_force_retaddr
13489 ret;
13490
13491 .L__enc_xor4:
13492 @@ -341,6 +346,7 @@ ENTRY(__blowfish_enc_blk_4way)
13493
13494 popq %rbx;
13495 popq %rbp;
13496 + pax_force_retaddr
13497 ret;
13498 ENDPROC(__blowfish_enc_blk_4way)
13499
13500 @@ -375,5 +381,6 @@ ENTRY(blowfish_dec_blk_4way)
13501 popq %rbx;
13502 popq %rbp;
13503
13504 + pax_force_retaddr
13505 ret;
13506 ENDPROC(blowfish_dec_blk_4way)
13507 diff --git a/arch/x86/crypto/camellia-aesni-avx-asm_64.S b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13508 index ce71f92..1dce7ec 100644
13509 --- a/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13510 +++ b/arch/x86/crypto/camellia-aesni-avx-asm_64.S
13511 @@ -16,6 +16,7 @@
13512 */
13513
13514 #include <linux/linkage.h>
13515 +#include <asm/alternative-asm.h>
13516
13517 #define CAMELLIA_TABLE_BYTE_LEN 272
13518
13519 @@ -191,6 +192,7 @@ roundsm16_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd:
13520 roundsm16(%xmm0, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7,
13521 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14, %xmm15,
13522 %rcx, (%r9));
13523 + pax_force_retaddr
13524 ret;
13525 ENDPROC(roundsm16_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd)
13526
13527 @@ -199,6 +201,7 @@ roundsm16_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab:
13528 roundsm16(%xmm4, %xmm5, %xmm6, %xmm7, %xmm0, %xmm1, %xmm2, %xmm3,
13529 %xmm12, %xmm13, %xmm14, %xmm15, %xmm8, %xmm9, %xmm10, %xmm11,
13530 %rax, (%r9));
13531 + pax_force_retaddr
13532 ret;
13533 ENDPROC(roundsm16_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab)
13534
13535 @@ -780,6 +783,7 @@ __camellia_enc_blk16:
13536 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14,
13537 %xmm15, (key_table)(CTX, %r8, 8), (%rax), 1 * 16(%rax));
13538
13539 + pax_force_retaddr
13540 ret;
13541
13542 .align 8
13543 @@ -865,6 +869,7 @@ __camellia_dec_blk16:
13544 %xmm8, %xmm9, %xmm10, %xmm11, %xmm12, %xmm13, %xmm14,
13545 %xmm15, (key_table)(CTX), (%rax), 1 * 16(%rax));
13546
13547 + pax_force_retaddr
13548 ret;
13549
13550 .align 8
13551 @@ -904,6 +909,7 @@ ENTRY(camellia_ecb_enc_16way)
13552 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13553 %xmm8, %rsi);
13554
13555 + pax_force_retaddr
13556 ret;
13557 ENDPROC(camellia_ecb_enc_16way)
13558
13559 @@ -932,6 +938,7 @@ ENTRY(camellia_ecb_dec_16way)
13560 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13561 %xmm8, %rsi);
13562
13563 + pax_force_retaddr
13564 ret;
13565 ENDPROC(camellia_ecb_dec_16way)
13566
13567 @@ -981,6 +988,7 @@ ENTRY(camellia_cbc_dec_16way)
13568 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13569 %xmm8, %rsi);
13570
13571 + pax_force_retaddr
13572 ret;
13573 ENDPROC(camellia_cbc_dec_16way)
13574
13575 @@ -1092,6 +1100,7 @@ ENTRY(camellia_ctr_16way)
13576 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13577 %xmm8, %rsi);
13578
13579 + pax_force_retaddr
13580 ret;
13581 ENDPROC(camellia_ctr_16way)
13582
13583 @@ -1234,6 +1243,7 @@ camellia_xts_crypt_16way:
13584 %xmm15, %xmm14, %xmm13, %xmm12, %xmm11, %xmm10, %xmm9,
13585 %xmm8, %rsi);
13586
13587 + pax_force_retaddr
13588 ret;
13589 ENDPROC(camellia_xts_crypt_16way)
13590
13591 diff --git a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13592 index 0e0b886..5a3123c 100644
13593 --- a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13594 +++ b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S
13595 @@ -11,6 +11,7 @@
13596 */
13597
13598 #include <linux/linkage.h>
13599 +#include <asm/alternative-asm.h>
13600
13601 #define CAMELLIA_TABLE_BYTE_LEN 272
13602
13603 @@ -230,6 +231,7 @@ roundsm32_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd:
13604 roundsm32(%ymm0, %ymm1, %ymm2, %ymm3, %ymm4, %ymm5, %ymm6, %ymm7,
13605 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14, %ymm15,
13606 %rcx, (%r9));
13607 + pax_force_retaddr
13608 ret;
13609 ENDPROC(roundsm32_x0_x1_x2_x3_x4_x5_x6_x7_y0_y1_y2_y3_y4_y5_y6_y7_cd)
13610
13611 @@ -238,6 +240,7 @@ roundsm32_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab:
13612 roundsm32(%ymm4, %ymm5, %ymm6, %ymm7, %ymm0, %ymm1, %ymm2, %ymm3,
13613 %ymm12, %ymm13, %ymm14, %ymm15, %ymm8, %ymm9, %ymm10, %ymm11,
13614 %rax, (%r9));
13615 + pax_force_retaddr
13616 ret;
13617 ENDPROC(roundsm32_x4_x5_x6_x7_x0_x1_x2_x3_y4_y5_y6_y7_y0_y1_y2_y3_ab)
13618
13619 @@ -820,6 +823,7 @@ __camellia_enc_blk32:
13620 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14,
13621 %ymm15, (key_table)(CTX, %r8, 8), (%rax), 1 * 32(%rax));
13622
13623 + pax_force_retaddr
13624 ret;
13625
13626 .align 8
13627 @@ -905,6 +909,7 @@ __camellia_dec_blk32:
13628 %ymm8, %ymm9, %ymm10, %ymm11, %ymm12, %ymm13, %ymm14,
13629 %ymm15, (key_table)(CTX), (%rax), 1 * 32(%rax));
13630
13631 + pax_force_retaddr
13632 ret;
13633
13634 .align 8
13635 @@ -948,6 +953,7 @@ ENTRY(camellia_ecb_enc_32way)
13636
13637 vzeroupper;
13638
13639 + pax_force_retaddr
13640 ret;
13641 ENDPROC(camellia_ecb_enc_32way)
13642
13643 @@ -980,6 +986,7 @@ ENTRY(camellia_ecb_dec_32way)
13644
13645 vzeroupper;
13646
13647 + pax_force_retaddr
13648 ret;
13649 ENDPROC(camellia_ecb_dec_32way)
13650
13651 @@ -1046,6 +1053,7 @@ ENTRY(camellia_cbc_dec_32way)
13652
13653 vzeroupper;
13654
13655 + pax_force_retaddr
13656 ret;
13657 ENDPROC(camellia_cbc_dec_32way)
13658
13659 @@ -1184,6 +1192,7 @@ ENTRY(camellia_ctr_32way)
13660
13661 vzeroupper;
13662
13663 + pax_force_retaddr
13664 ret;
13665 ENDPROC(camellia_ctr_32way)
13666
13667 @@ -1349,6 +1358,7 @@ camellia_xts_crypt_32way:
13668
13669 vzeroupper;
13670
13671 + pax_force_retaddr
13672 ret;
13673 ENDPROC(camellia_xts_crypt_32way)
13674
13675 diff --git a/arch/x86/crypto/camellia-x86_64-asm_64.S b/arch/x86/crypto/camellia-x86_64-asm_64.S
13676 index 310319c..db3d7b5 100644
13677 --- a/arch/x86/crypto/camellia-x86_64-asm_64.S
13678 +++ b/arch/x86/crypto/camellia-x86_64-asm_64.S
13679 @@ -21,6 +21,7 @@
13680 */
13681
13682 #include <linux/linkage.h>
13683 +#include <asm/alternative-asm.h>
13684
13685 .file "camellia-x86_64-asm_64.S"
13686 .text
13687 @@ -228,12 +229,14 @@ ENTRY(__camellia_enc_blk)
13688 enc_outunpack(mov, RT1);
13689
13690 movq RRBP, %rbp;
13691 + pax_force_retaddr
13692 ret;
13693
13694 .L__enc_xor:
13695 enc_outunpack(xor, RT1);
13696
13697 movq RRBP, %rbp;
13698 + pax_force_retaddr
13699 ret;
13700 ENDPROC(__camellia_enc_blk)
13701
13702 @@ -272,6 +275,7 @@ ENTRY(camellia_dec_blk)
13703 dec_outunpack();
13704
13705 movq RRBP, %rbp;
13706 + pax_force_retaddr
13707 ret;
13708 ENDPROC(camellia_dec_blk)
13709
13710 @@ -463,6 +467,7 @@ ENTRY(__camellia_enc_blk_2way)
13711
13712 movq RRBP, %rbp;
13713 popq %rbx;
13714 + pax_force_retaddr
13715 ret;
13716
13717 .L__enc2_xor:
13718 @@ -470,6 +475,7 @@ ENTRY(__camellia_enc_blk_2way)
13719
13720 movq RRBP, %rbp;
13721 popq %rbx;
13722 + pax_force_retaddr
13723 ret;
13724 ENDPROC(__camellia_enc_blk_2way)
13725
13726 @@ -510,5 +516,6 @@ ENTRY(camellia_dec_blk_2way)
13727
13728 movq RRBP, %rbp;
13729 movq RXOR, %rbx;
13730 + pax_force_retaddr
13731 ret;
13732 ENDPROC(camellia_dec_blk_2way)
13733 diff --git a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13734 index c35fd5d..2d8c7db 100644
13735 --- a/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13736 +++ b/arch/x86/crypto/cast5-avx-x86_64-asm_64.S
13737 @@ -24,6 +24,7 @@
13738 */
13739
13740 #include <linux/linkage.h>
13741 +#include <asm/alternative-asm.h>
13742
13743 .file "cast5-avx-x86_64-asm_64.S"
13744
13745 @@ -281,6 +282,7 @@ __cast5_enc_blk16:
13746 outunpack_blocks(RR3, RL3, RTMP, RX, RKM);
13747 outunpack_blocks(RR4, RL4, RTMP, RX, RKM);
13748
13749 + pax_force_retaddr
13750 ret;
13751 ENDPROC(__cast5_enc_blk16)
13752
13753 @@ -352,6 +354,7 @@ __cast5_dec_blk16:
13754 outunpack_blocks(RR3, RL3, RTMP, RX, RKM);
13755 outunpack_blocks(RR4, RL4, RTMP, RX, RKM);
13756
13757 + pax_force_retaddr
13758 ret;
13759
13760 .L__skip_dec:
13761 @@ -388,6 +391,7 @@ ENTRY(cast5_ecb_enc_16way)
13762 vmovdqu RR4, (6*4*4)(%r11);
13763 vmovdqu RL4, (7*4*4)(%r11);
13764
13765 + pax_force_retaddr
13766 ret;
13767 ENDPROC(cast5_ecb_enc_16way)
13768
13769 @@ -420,6 +424,7 @@ ENTRY(cast5_ecb_dec_16way)
13770 vmovdqu RR4, (6*4*4)(%r11);
13771 vmovdqu RL4, (7*4*4)(%r11);
13772
13773 + pax_force_retaddr
13774 ret;
13775 ENDPROC(cast5_ecb_dec_16way)
13776
13777 @@ -430,10 +435,10 @@ ENTRY(cast5_cbc_dec_16way)
13778 * %rdx: src
13779 */
13780
13781 - pushq %r12;
13782 + pushq %r14;
13783
13784 movq %rsi, %r11;
13785 - movq %rdx, %r12;
13786 + movq %rdx, %r14;
13787
13788 vmovdqu (0*16)(%rdx), RL1;
13789 vmovdqu (1*16)(%rdx), RR1;
13790 @@ -447,16 +452,16 @@ ENTRY(cast5_cbc_dec_16way)
13791 call __cast5_dec_blk16;
13792
13793 /* xor with src */
13794 - vmovq (%r12), RX;
13795 + vmovq (%r14), RX;
13796 vpshufd $0x4f, RX, RX;
13797 vpxor RX, RR1, RR1;
13798 - vpxor 0*16+8(%r12), RL1, RL1;
13799 - vpxor 1*16+8(%r12), RR2, RR2;
13800 - vpxor 2*16+8(%r12), RL2, RL2;
13801 - vpxor 3*16+8(%r12), RR3, RR3;
13802 - vpxor 4*16+8(%r12), RL3, RL3;
13803 - vpxor 5*16+8(%r12), RR4, RR4;
13804 - vpxor 6*16+8(%r12), RL4, RL4;
13805 + vpxor 0*16+8(%r14), RL1, RL1;
13806 + vpxor 1*16+8(%r14), RR2, RR2;
13807 + vpxor 2*16+8(%r14), RL2, RL2;
13808 + vpxor 3*16+8(%r14), RR3, RR3;
13809 + vpxor 4*16+8(%r14), RL3, RL3;
13810 + vpxor 5*16+8(%r14), RR4, RR4;
13811 + vpxor 6*16+8(%r14), RL4, RL4;
13812
13813 vmovdqu RR1, (0*16)(%r11);
13814 vmovdqu RL1, (1*16)(%r11);
13815 @@ -467,8 +472,9 @@ ENTRY(cast5_cbc_dec_16way)
13816 vmovdqu RR4, (6*16)(%r11);
13817 vmovdqu RL4, (7*16)(%r11);
13818
13819 - popq %r12;
13820 + popq %r14;
13821
13822 + pax_force_retaddr
13823 ret;
13824 ENDPROC(cast5_cbc_dec_16way)
13825
13826 @@ -480,10 +486,10 @@ ENTRY(cast5_ctr_16way)
13827 * %rcx: iv (big endian, 64bit)
13828 */
13829
13830 - pushq %r12;
13831 + pushq %r14;
13832
13833 movq %rsi, %r11;
13834 - movq %rdx, %r12;
13835 + movq %rdx, %r14;
13836
13837 vpcmpeqd RTMP, RTMP, RTMP;
13838 vpsrldq $8, RTMP, RTMP; /* low: -1, high: 0 */
13839 @@ -523,14 +529,14 @@ ENTRY(cast5_ctr_16way)
13840 call __cast5_enc_blk16;
13841
13842 /* dst = src ^ iv */
13843 - vpxor (0*16)(%r12), RR1, RR1;
13844 - vpxor (1*16)(%r12), RL1, RL1;
13845 - vpxor (2*16)(%r12), RR2, RR2;
13846 - vpxor (3*16)(%r12), RL2, RL2;
13847 - vpxor (4*16)(%r12), RR3, RR3;
13848 - vpxor (5*16)(%r12), RL3, RL3;
13849 - vpxor (6*16)(%r12), RR4, RR4;
13850 - vpxor (7*16)(%r12), RL4, RL4;
13851 + vpxor (0*16)(%r14), RR1, RR1;
13852 + vpxor (1*16)(%r14), RL1, RL1;
13853 + vpxor (2*16)(%r14), RR2, RR2;
13854 + vpxor (3*16)(%r14), RL2, RL2;
13855 + vpxor (4*16)(%r14), RR3, RR3;
13856 + vpxor (5*16)(%r14), RL3, RL3;
13857 + vpxor (6*16)(%r14), RR4, RR4;
13858 + vpxor (7*16)(%r14), RL4, RL4;
13859 vmovdqu RR1, (0*16)(%r11);
13860 vmovdqu RL1, (1*16)(%r11);
13861 vmovdqu RR2, (2*16)(%r11);
13862 @@ -540,7 +546,8 @@ ENTRY(cast5_ctr_16way)
13863 vmovdqu RR4, (6*16)(%r11);
13864 vmovdqu RL4, (7*16)(%r11);
13865
13866 - popq %r12;
13867 + popq %r14;
13868
13869 + pax_force_retaddr
13870 ret;
13871 ENDPROC(cast5_ctr_16way)
13872 diff --git a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13873 index e3531f8..e123f35 100644
13874 --- a/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13875 +++ b/arch/x86/crypto/cast6-avx-x86_64-asm_64.S
13876 @@ -24,6 +24,7 @@
13877 */
13878
13879 #include <linux/linkage.h>
13880 +#include <asm/alternative-asm.h>
13881 #include "glue_helper-asm-avx.S"
13882
13883 .file "cast6-avx-x86_64-asm_64.S"
13884 @@ -295,6 +296,7 @@ __cast6_enc_blk8:
13885 outunpack_blocks(RA1, RB1, RC1, RD1, RTMP, RX, RKRF, RKM);
13886 outunpack_blocks(RA2, RB2, RC2, RD2, RTMP, RX, RKRF, RKM);
13887
13888 + pax_force_retaddr
13889 ret;
13890 ENDPROC(__cast6_enc_blk8)
13891
13892 @@ -340,6 +342,7 @@ __cast6_dec_blk8:
13893 outunpack_blocks(RA1, RB1, RC1, RD1, RTMP, RX, RKRF, RKM);
13894 outunpack_blocks(RA2, RB2, RC2, RD2, RTMP, RX, RKRF, RKM);
13895
13896 + pax_force_retaddr
13897 ret;
13898 ENDPROC(__cast6_dec_blk8)
13899
13900 @@ -358,6 +361,7 @@ ENTRY(cast6_ecb_enc_8way)
13901
13902 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13903
13904 + pax_force_retaddr
13905 ret;
13906 ENDPROC(cast6_ecb_enc_8way)
13907
13908 @@ -376,6 +380,7 @@ ENTRY(cast6_ecb_dec_8way)
13909
13910 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13911
13912 + pax_force_retaddr
13913 ret;
13914 ENDPROC(cast6_ecb_dec_8way)
13915
13916 @@ -386,19 +391,20 @@ ENTRY(cast6_cbc_dec_8way)
13917 * %rdx: src
13918 */
13919
13920 - pushq %r12;
13921 + pushq %r14;
13922
13923 movq %rsi, %r11;
13924 - movq %rdx, %r12;
13925 + movq %rdx, %r14;
13926
13927 load_8way(%rdx, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13928
13929 call __cast6_dec_blk8;
13930
13931 - store_cbc_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13932 + store_cbc_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13933
13934 - popq %r12;
13935 + popq %r14;
13936
13937 + pax_force_retaddr
13938 ret;
13939 ENDPROC(cast6_cbc_dec_8way)
13940
13941 @@ -410,20 +416,21 @@ ENTRY(cast6_ctr_8way)
13942 * %rcx: iv (little endian, 128bit)
13943 */
13944
13945 - pushq %r12;
13946 + pushq %r14;
13947
13948 movq %rsi, %r11;
13949 - movq %rdx, %r12;
13950 + movq %rdx, %r14;
13951
13952 load_ctr_8way(%rcx, .Lbswap128_mask, RA1, RB1, RC1, RD1, RA2, RB2, RC2,
13953 RD2, RX, RKR, RKM);
13954
13955 call __cast6_enc_blk8;
13956
13957 - store_ctr_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13958 + store_ctr_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13959
13960 - popq %r12;
13961 + popq %r14;
13962
13963 + pax_force_retaddr
13964 ret;
13965 ENDPROC(cast6_ctr_8way)
13966
13967 @@ -446,6 +453,7 @@ ENTRY(cast6_xts_enc_8way)
13968 /* dst <= regs xor IVs(in dst) */
13969 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13970
13971 + pax_force_retaddr
13972 ret;
13973 ENDPROC(cast6_xts_enc_8way)
13974
13975 @@ -468,5 +476,6 @@ ENTRY(cast6_xts_dec_8way)
13976 /* dst <= regs xor IVs(in dst) */
13977 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
13978
13979 + pax_force_retaddr
13980 ret;
13981 ENDPROC(cast6_xts_dec_8way)
13982 diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
13983 index dbc4339..de6e120 100644
13984 --- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
13985 +++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
13986 @@ -45,6 +45,7 @@
13987
13988 #include <asm/inst.h>
13989 #include <linux/linkage.h>
13990 +#include <asm/alternative-asm.h>
13991
13992 ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
13993
13994 @@ -312,6 +313,7 @@ do_return:
13995 popq %rsi
13996 popq %rdi
13997 popq %rbx
13998 + pax_force_retaddr
13999 ret
14000
14001 ################################################################
14002 diff --git a/arch/x86/crypto/ghash-clmulni-intel_asm.S b/arch/x86/crypto/ghash-clmulni-intel_asm.S
14003 index 185fad4..ff4cd36 100644
14004 --- a/arch/x86/crypto/ghash-clmulni-intel_asm.S
14005 +++ b/arch/x86/crypto/ghash-clmulni-intel_asm.S
14006 @@ -18,6 +18,7 @@
14007
14008 #include <linux/linkage.h>
14009 #include <asm/inst.h>
14010 +#include <asm/alternative-asm.h>
14011
14012 .data
14013
14014 @@ -89,6 +90,7 @@ __clmul_gf128mul_ble:
14015 psrlq $1, T2
14016 pxor T2, T1
14017 pxor T1, DATA
14018 + pax_force_retaddr
14019 ret
14020 ENDPROC(__clmul_gf128mul_ble)
14021
14022 @@ -101,6 +103,7 @@ ENTRY(clmul_ghash_mul)
14023 call __clmul_gf128mul_ble
14024 PSHUFB_XMM BSWAP DATA
14025 movups DATA, (%rdi)
14026 + pax_force_retaddr
14027 ret
14028 ENDPROC(clmul_ghash_mul)
14029
14030 @@ -128,5 +131,6 @@ ENTRY(clmul_ghash_update)
14031 PSHUFB_XMM BSWAP DATA
14032 movups DATA, (%rdi)
14033 .Lupdate_just_ret:
14034 + pax_force_retaddr
14035 ret
14036 ENDPROC(clmul_ghash_update)
14037 diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S
14038 index 9279e0b..c4b3d2c 100644
14039 --- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
14040 +++ b/arch/x86/crypto/salsa20-x86_64-asm_64.S
14041 @@ -1,4 +1,5 @@
14042 #include <linux/linkage.h>
14043 +#include <asm/alternative-asm.h>
14044
14045 # enter salsa20_encrypt_bytes
14046 ENTRY(salsa20_encrypt_bytes)
14047 @@ -789,6 +790,7 @@ ENTRY(salsa20_encrypt_bytes)
14048 add %r11,%rsp
14049 mov %rdi,%rax
14050 mov %rsi,%rdx
14051 + pax_force_retaddr
14052 ret
14053 # bytesatleast65:
14054 ._bytesatleast65:
14055 @@ -889,6 +891,7 @@ ENTRY(salsa20_keysetup)
14056 add %r11,%rsp
14057 mov %rdi,%rax
14058 mov %rsi,%rdx
14059 + pax_force_retaddr
14060 ret
14061 ENDPROC(salsa20_keysetup)
14062
14063 @@ -914,5 +917,6 @@ ENTRY(salsa20_ivsetup)
14064 add %r11,%rsp
14065 mov %rdi,%rax
14066 mov %rsi,%rdx
14067 + pax_force_retaddr
14068 ret
14069 ENDPROC(salsa20_ivsetup)
14070 diff --git a/arch/x86/crypto/serpent-avx-x86_64-asm_64.S b/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14071 index 2f202f4..d9164d6 100644
14072 --- a/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14073 +++ b/arch/x86/crypto/serpent-avx-x86_64-asm_64.S
14074 @@ -24,6 +24,7 @@
14075 */
14076
14077 #include <linux/linkage.h>
14078 +#include <asm/alternative-asm.h>
14079 #include "glue_helper-asm-avx.S"
14080
14081 .file "serpent-avx-x86_64-asm_64.S"
14082 @@ -618,6 +619,7 @@ __serpent_enc_blk8_avx:
14083 write_blocks(RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14084 write_blocks(RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14085
14086 + pax_force_retaddr
14087 ret;
14088 ENDPROC(__serpent_enc_blk8_avx)
14089
14090 @@ -672,6 +674,7 @@ __serpent_dec_blk8_avx:
14091 write_blocks(RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14092 write_blocks(RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14093
14094 + pax_force_retaddr
14095 ret;
14096 ENDPROC(__serpent_dec_blk8_avx)
14097
14098 @@ -688,6 +691,7 @@ ENTRY(serpent_ecb_enc_8way_avx)
14099
14100 store_8way(%rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14101
14102 + pax_force_retaddr
14103 ret;
14104 ENDPROC(serpent_ecb_enc_8way_avx)
14105
14106 @@ -704,6 +708,7 @@ ENTRY(serpent_ecb_dec_8way_avx)
14107
14108 store_8way(%rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14109
14110 + pax_force_retaddr
14111 ret;
14112 ENDPROC(serpent_ecb_dec_8way_avx)
14113
14114 @@ -720,6 +725,7 @@ ENTRY(serpent_cbc_dec_8way_avx)
14115
14116 store_cbc_8way(%rdx, %rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14117
14118 + pax_force_retaddr
14119 ret;
14120 ENDPROC(serpent_cbc_dec_8way_avx)
14121
14122 @@ -738,6 +744,7 @@ ENTRY(serpent_ctr_8way_avx)
14123
14124 store_ctr_8way(%rdx, %rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14125
14126 + pax_force_retaddr
14127 ret;
14128 ENDPROC(serpent_ctr_8way_avx)
14129
14130 @@ -758,6 +765,7 @@ ENTRY(serpent_xts_enc_8way_avx)
14131 /* dst <= regs xor IVs(in dst) */
14132 store_xts_8way(%rsi, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14133
14134 + pax_force_retaddr
14135 ret;
14136 ENDPROC(serpent_xts_enc_8way_avx)
14137
14138 @@ -778,5 +786,6 @@ ENTRY(serpent_xts_dec_8way_avx)
14139 /* dst <= regs xor IVs(in dst) */
14140 store_xts_8way(%rsi, RC1, RD1, RB1, RE1, RC2, RD2, RB2, RE2);
14141
14142 + pax_force_retaddr
14143 ret;
14144 ENDPROC(serpent_xts_dec_8way_avx)
14145 diff --git a/arch/x86/crypto/serpent-avx2-asm_64.S b/arch/x86/crypto/serpent-avx2-asm_64.S
14146 index b222085..abd483c 100644
14147 --- a/arch/x86/crypto/serpent-avx2-asm_64.S
14148 +++ b/arch/x86/crypto/serpent-avx2-asm_64.S
14149 @@ -15,6 +15,7 @@
14150 */
14151
14152 #include <linux/linkage.h>
14153 +#include <asm/alternative-asm.h>
14154 #include "glue_helper-asm-avx2.S"
14155
14156 .file "serpent-avx2-asm_64.S"
14157 @@ -610,6 +611,7 @@ __serpent_enc_blk16:
14158 write_blocks(RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14159 write_blocks(RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14160
14161 + pax_force_retaddr
14162 ret;
14163 ENDPROC(__serpent_enc_blk16)
14164
14165 @@ -664,6 +666,7 @@ __serpent_dec_blk16:
14166 write_blocks(RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14167 write_blocks(RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14168
14169 + pax_force_retaddr
14170 ret;
14171 ENDPROC(__serpent_dec_blk16)
14172
14173 @@ -684,6 +687,7 @@ ENTRY(serpent_ecb_enc_16way)
14174
14175 vzeroupper;
14176
14177 + pax_force_retaddr
14178 ret;
14179 ENDPROC(serpent_ecb_enc_16way)
14180
14181 @@ -704,6 +708,7 @@ ENTRY(serpent_ecb_dec_16way)
14182
14183 vzeroupper;
14184
14185 + pax_force_retaddr
14186 ret;
14187 ENDPROC(serpent_ecb_dec_16way)
14188
14189 @@ -725,6 +730,7 @@ ENTRY(serpent_cbc_dec_16way)
14190
14191 vzeroupper;
14192
14193 + pax_force_retaddr
14194 ret;
14195 ENDPROC(serpent_cbc_dec_16way)
14196
14197 @@ -748,6 +754,7 @@ ENTRY(serpent_ctr_16way)
14198
14199 vzeroupper;
14200
14201 + pax_force_retaddr
14202 ret;
14203 ENDPROC(serpent_ctr_16way)
14204
14205 @@ -772,6 +779,7 @@ ENTRY(serpent_xts_enc_16way)
14206
14207 vzeroupper;
14208
14209 + pax_force_retaddr
14210 ret;
14211 ENDPROC(serpent_xts_enc_16way)
14212
14213 @@ -796,5 +804,6 @@ ENTRY(serpent_xts_dec_16way)
14214
14215 vzeroupper;
14216
14217 + pax_force_retaddr
14218 ret;
14219 ENDPROC(serpent_xts_dec_16way)
14220 diff --git a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14221 index acc066c..1559cc4 100644
14222 --- a/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14223 +++ b/arch/x86/crypto/serpent-sse2-x86_64-asm_64.S
14224 @@ -25,6 +25,7 @@
14225 */
14226
14227 #include <linux/linkage.h>
14228 +#include <asm/alternative-asm.h>
14229
14230 .file "serpent-sse2-x86_64-asm_64.S"
14231 .text
14232 @@ -690,12 +691,14 @@ ENTRY(__serpent_enc_blk_8way)
14233 write_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14234 write_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14235
14236 + pax_force_retaddr
14237 ret;
14238
14239 .L__enc_xor8:
14240 xor_blocks(%rsi, RA1, RB1, RC1, RD1, RK0, RK1, RK2);
14241 xor_blocks(%rax, RA2, RB2, RC2, RD2, RK0, RK1, RK2);
14242
14243 + pax_force_retaddr
14244 ret;
14245 ENDPROC(__serpent_enc_blk_8way)
14246
14247 @@ -750,5 +753,6 @@ ENTRY(serpent_dec_blk_8way)
14248 write_blocks(%rsi, RC1, RD1, RB1, RE1, RK0, RK1, RK2);
14249 write_blocks(%rax, RC2, RD2, RB2, RE2, RK0, RK1, RK2);
14250
14251 + pax_force_retaddr
14252 ret;
14253 ENDPROC(serpent_dec_blk_8way)
14254 diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
14255 index a410950..9dfe7ad 100644
14256 --- a/arch/x86/crypto/sha1_ssse3_asm.S
14257 +++ b/arch/x86/crypto/sha1_ssse3_asm.S
14258 @@ -29,6 +29,7 @@
14259 */
14260
14261 #include <linux/linkage.h>
14262 +#include <asm/alternative-asm.h>
14263
14264 #define CTX %rdi // arg1
14265 #define BUF %rsi // arg2
14266 @@ -75,9 +76,9 @@
14267
14268 push %rbx
14269 push %rbp
14270 - push %r12
14271 + push %r14
14272
14273 - mov %rsp, %r12
14274 + mov %rsp, %r14
14275 sub $64, %rsp # allocate workspace
14276 and $~15, %rsp # align stack
14277
14278 @@ -99,11 +100,12 @@
14279 xor %rax, %rax
14280 rep stosq
14281
14282 - mov %r12, %rsp # deallocate workspace
14283 + mov %r14, %rsp # deallocate workspace
14284
14285 - pop %r12
14286 + pop %r14
14287 pop %rbp
14288 pop %rbx
14289 + pax_force_retaddr
14290 ret
14291
14292 ENDPROC(\name)
14293 diff --git a/arch/x86/crypto/sha256-avx-asm.S b/arch/x86/crypto/sha256-avx-asm.S
14294 index 642f156..51a513c 100644
14295 --- a/arch/x86/crypto/sha256-avx-asm.S
14296 +++ b/arch/x86/crypto/sha256-avx-asm.S
14297 @@ -49,6 +49,7 @@
14298
14299 #ifdef CONFIG_AS_AVX
14300 #include <linux/linkage.h>
14301 +#include <asm/alternative-asm.h>
14302
14303 ## assume buffers not aligned
14304 #define VMOVDQ vmovdqu
14305 @@ -460,6 +461,7 @@ done_hash:
14306 popq %r13
14307 popq %rbp
14308 popq %rbx
14309 + pax_force_retaddr
14310 ret
14311 ENDPROC(sha256_transform_avx)
14312
14313 diff --git a/arch/x86/crypto/sha256-avx2-asm.S b/arch/x86/crypto/sha256-avx2-asm.S
14314 index 9e86944..3795e6a 100644
14315 --- a/arch/x86/crypto/sha256-avx2-asm.S
14316 +++ b/arch/x86/crypto/sha256-avx2-asm.S
14317 @@ -50,6 +50,7 @@
14318
14319 #ifdef CONFIG_AS_AVX2
14320 #include <linux/linkage.h>
14321 +#include <asm/alternative-asm.h>
14322
14323 ## assume buffers not aligned
14324 #define VMOVDQ vmovdqu
14325 @@ -720,6 +721,7 @@ done_hash:
14326 popq %r12
14327 popq %rbp
14328 popq %rbx
14329 + pax_force_retaddr
14330 ret
14331 ENDPROC(sha256_transform_rorx)
14332
14333 diff --git a/arch/x86/crypto/sha256-ssse3-asm.S b/arch/x86/crypto/sha256-ssse3-asm.S
14334 index f833b74..8c62a9e 100644
14335 --- a/arch/x86/crypto/sha256-ssse3-asm.S
14336 +++ b/arch/x86/crypto/sha256-ssse3-asm.S
14337 @@ -47,6 +47,7 @@
14338 ########################################################################
14339
14340 #include <linux/linkage.h>
14341 +#include <asm/alternative-asm.h>
14342
14343 ## assume buffers not aligned
14344 #define MOVDQ movdqu
14345 @@ -471,6 +472,7 @@ done_hash:
14346 popq %rbp
14347 popq %rbx
14348
14349 + pax_force_retaddr
14350 ret
14351 ENDPROC(sha256_transform_ssse3)
14352
14353 diff --git a/arch/x86/crypto/sha512-avx-asm.S b/arch/x86/crypto/sha512-avx-asm.S
14354 index 974dde9..a823ff9 100644
14355 --- a/arch/x86/crypto/sha512-avx-asm.S
14356 +++ b/arch/x86/crypto/sha512-avx-asm.S
14357 @@ -49,6 +49,7 @@
14358
14359 #ifdef CONFIG_AS_AVX
14360 #include <linux/linkage.h>
14361 +#include <asm/alternative-asm.h>
14362
14363 .text
14364
14365 @@ -364,6 +365,7 @@ updateblock:
14366 mov frame_RSPSAVE(%rsp), %rsp
14367
14368 nowork:
14369 + pax_force_retaddr
14370 ret
14371 ENDPROC(sha512_transform_avx)
14372
14373 diff --git a/arch/x86/crypto/sha512-avx2-asm.S b/arch/x86/crypto/sha512-avx2-asm.S
14374 index 568b961..ed20c37 100644
14375 --- a/arch/x86/crypto/sha512-avx2-asm.S
14376 +++ b/arch/x86/crypto/sha512-avx2-asm.S
14377 @@ -51,6 +51,7 @@
14378
14379 #ifdef CONFIG_AS_AVX2
14380 #include <linux/linkage.h>
14381 +#include <asm/alternative-asm.h>
14382
14383 .text
14384
14385 @@ -678,6 +679,7 @@ done_hash:
14386
14387 # Restore Stack Pointer
14388 mov frame_RSPSAVE(%rsp), %rsp
14389 + pax_force_retaddr
14390 ret
14391 ENDPROC(sha512_transform_rorx)
14392
14393 diff --git a/arch/x86/crypto/sha512-ssse3-asm.S b/arch/x86/crypto/sha512-ssse3-asm.S
14394 index fb56855..6edd768 100644
14395 --- a/arch/x86/crypto/sha512-ssse3-asm.S
14396 +++ b/arch/x86/crypto/sha512-ssse3-asm.S
14397 @@ -48,6 +48,7 @@
14398 ########################################################################
14399
14400 #include <linux/linkage.h>
14401 +#include <asm/alternative-asm.h>
14402
14403 .text
14404
14405 @@ -363,6 +364,7 @@ updateblock:
14406 mov frame_RSPSAVE(%rsp), %rsp
14407
14408 nowork:
14409 + pax_force_retaddr
14410 ret
14411 ENDPROC(sha512_transform_ssse3)
14412
14413 diff --git a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14414 index 0505813..b067311 100644
14415 --- a/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14416 +++ b/arch/x86/crypto/twofish-avx-x86_64-asm_64.S
14417 @@ -24,6 +24,7 @@
14418 */
14419
14420 #include <linux/linkage.h>
14421 +#include <asm/alternative-asm.h>
14422 #include "glue_helper-asm-avx.S"
14423
14424 .file "twofish-avx-x86_64-asm_64.S"
14425 @@ -284,6 +285,7 @@ __twofish_enc_blk8:
14426 outunpack_blocks(RC1, RD1, RA1, RB1, RK1, RX0, RY0, RK2);
14427 outunpack_blocks(RC2, RD2, RA2, RB2, RK1, RX0, RY0, RK2);
14428
14429 + pax_force_retaddr
14430 ret;
14431 ENDPROC(__twofish_enc_blk8)
14432
14433 @@ -324,6 +326,7 @@ __twofish_dec_blk8:
14434 outunpack_blocks(RA1, RB1, RC1, RD1, RK1, RX0, RY0, RK2);
14435 outunpack_blocks(RA2, RB2, RC2, RD2, RK1, RX0, RY0, RK2);
14436
14437 + pax_force_retaddr
14438 ret;
14439 ENDPROC(__twofish_dec_blk8)
14440
14441 @@ -342,6 +345,7 @@ ENTRY(twofish_ecb_enc_8way)
14442
14443 store_8way(%r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14444
14445 + pax_force_retaddr
14446 ret;
14447 ENDPROC(twofish_ecb_enc_8way)
14448
14449 @@ -360,6 +364,7 @@ ENTRY(twofish_ecb_dec_8way)
14450
14451 store_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14452
14453 + pax_force_retaddr
14454 ret;
14455 ENDPROC(twofish_ecb_dec_8way)
14456
14457 @@ -370,19 +375,20 @@ ENTRY(twofish_cbc_dec_8way)
14458 * %rdx: src
14459 */
14460
14461 - pushq %r12;
14462 + pushq %r14;
14463
14464 movq %rsi, %r11;
14465 - movq %rdx, %r12;
14466 + movq %rdx, %r14;
14467
14468 load_8way(%rdx, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14469
14470 call __twofish_dec_blk8;
14471
14472 - store_cbc_8way(%r12, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14473 + store_cbc_8way(%r14, %r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14474
14475 - popq %r12;
14476 + popq %r14;
14477
14478 + pax_force_retaddr
14479 ret;
14480 ENDPROC(twofish_cbc_dec_8way)
14481
14482 @@ -394,20 +400,21 @@ ENTRY(twofish_ctr_8way)
14483 * %rcx: iv (little endian, 128bit)
14484 */
14485
14486 - pushq %r12;
14487 + pushq %r14;
14488
14489 movq %rsi, %r11;
14490 - movq %rdx, %r12;
14491 + movq %rdx, %r14;
14492
14493 load_ctr_8way(%rcx, .Lbswap128_mask, RA1, RB1, RC1, RD1, RA2, RB2, RC2,
14494 RD2, RX0, RX1, RY0);
14495
14496 call __twofish_enc_blk8;
14497
14498 - store_ctr_8way(%r12, %r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14499 + store_ctr_8way(%r14, %r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14500
14501 - popq %r12;
14502 + popq %r14;
14503
14504 + pax_force_retaddr
14505 ret;
14506 ENDPROC(twofish_ctr_8way)
14507
14508 @@ -430,6 +437,7 @@ ENTRY(twofish_xts_enc_8way)
14509 /* dst <= regs xor IVs(in dst) */
14510 store_xts_8way(%r11, RC1, RD1, RA1, RB1, RC2, RD2, RA2, RB2);
14511
14512 + pax_force_retaddr
14513 ret;
14514 ENDPROC(twofish_xts_enc_8way)
14515
14516 @@ -452,5 +460,6 @@ ENTRY(twofish_xts_dec_8way)
14517 /* dst <= regs xor IVs(in dst) */
14518 store_xts_8way(%r11, RA1, RB1, RC1, RD1, RA2, RB2, RC2, RD2);
14519
14520 + pax_force_retaddr
14521 ret;
14522 ENDPROC(twofish_xts_dec_8way)
14523 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14524 index 1c3b7ce..02f578d 100644
14525 --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14526 +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
14527 @@ -21,6 +21,7 @@
14528 */
14529
14530 #include <linux/linkage.h>
14531 +#include <asm/alternative-asm.h>
14532
14533 .file "twofish-x86_64-asm-3way.S"
14534 .text
14535 @@ -258,6 +259,7 @@ ENTRY(__twofish_enc_blk_3way)
14536 popq %r13;
14537 popq %r14;
14538 popq %r15;
14539 + pax_force_retaddr
14540 ret;
14541
14542 .L__enc_xor3:
14543 @@ -269,6 +271,7 @@ ENTRY(__twofish_enc_blk_3way)
14544 popq %r13;
14545 popq %r14;
14546 popq %r15;
14547 + pax_force_retaddr
14548 ret;
14549 ENDPROC(__twofish_enc_blk_3way)
14550
14551 @@ -308,5 +311,6 @@ ENTRY(twofish_dec_blk_3way)
14552 popq %r13;
14553 popq %r14;
14554 popq %r15;
14555 + pax_force_retaddr
14556 ret;
14557 ENDPROC(twofish_dec_blk_3way)
14558 diff --git a/arch/x86/crypto/twofish-x86_64-asm_64.S b/arch/x86/crypto/twofish-x86_64-asm_64.S
14559 index a039d21..524b8b2 100644
14560 --- a/arch/x86/crypto/twofish-x86_64-asm_64.S
14561 +++ b/arch/x86/crypto/twofish-x86_64-asm_64.S
14562 @@ -22,6 +22,7 @@
14563
14564 #include <linux/linkage.h>
14565 #include <asm/asm-offsets.h>
14566 +#include <asm/alternative-asm.h>
14567
14568 #define a_offset 0
14569 #define b_offset 4
14570 @@ -265,6 +266,7 @@ ENTRY(twofish_enc_blk)
14571
14572 popq R1
14573 movq $1,%rax
14574 + pax_force_retaddr
14575 ret
14576 ENDPROC(twofish_enc_blk)
14577
14578 @@ -317,5 +319,6 @@ ENTRY(twofish_dec_blk)
14579
14580 popq R1
14581 movq $1,%rax
14582 + pax_force_retaddr
14583 ret
14584 ENDPROC(twofish_dec_blk)
14585 diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
14586 index d21ff89..6da8e6e 100644
14587 --- a/arch/x86/ia32/ia32_aout.c
14588 +++ b/arch/x86/ia32/ia32_aout.c
14589 @@ -153,6 +153,8 @@ static int aout_core_dump(struct coredump_params *cprm)
14590 unsigned long dump_start, dump_size;
14591 struct user32 dump;
14592
14593 + memset(&dump, 0, sizeof(dump));
14594 +
14595 fs = get_fs();
14596 set_fs(KERNEL_DS);
14597 has_dumped = 1;
14598 diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
14599 index 2206757..85cbcfa 100644
14600 --- a/arch/x86/ia32/ia32_signal.c
14601 +++ b/arch/x86/ia32/ia32_signal.c
14602 @@ -218,7 +218,7 @@ asmlinkage long sys32_sigreturn(void)
14603 if (__get_user(set.sig[0], &frame->sc.oldmask)
14604 || (_COMPAT_NSIG_WORDS > 1
14605 && __copy_from_user((((char *) &set.sig) + 4),
14606 - &frame->extramask,
14607 + frame->extramask,
14608 sizeof(frame->extramask))))
14609 goto badframe;
14610
14611 @@ -338,7 +338,7 @@ static void __user *get_sigframe(struct ksignal *ksig, struct pt_regs *regs,
14612 sp -= frame_size;
14613 /* Align the stack pointer according to the i386 ABI,
14614 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
14615 - sp = ((sp + 4) & -16ul) - 4;
14616 + sp = ((sp - 12) & -16ul) - 4;
14617 return (void __user *) sp;
14618 }
14619
14620 @@ -386,7 +386,7 @@ int ia32_setup_frame(int sig, struct ksignal *ksig,
14621 restorer = VDSO32_SYMBOL(current->mm->context.vdso,
14622 sigreturn);
14623 else
14624 - restorer = &frame->retcode;
14625 + restorer = frame->retcode;
14626 }
14627
14628 put_user_try {
14629 @@ -396,7 +396,7 @@ int ia32_setup_frame(int sig, struct ksignal *ksig,
14630 * These are actually not used anymore, but left because some
14631 * gdb versions depend on them as a marker.
14632 */
14633 - put_user_ex(*((u64 *)&code), (u64 __user *)frame->retcode);
14634 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
14635 } put_user_catch(err);
14636
14637 if (err)
14638 @@ -438,7 +438,7 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
14639 0xb8,
14640 __NR_ia32_rt_sigreturn,
14641 0x80cd,
14642 - 0,
14643 + 0
14644 };
14645
14646 frame = get_sigframe(ksig, regs, sizeof(*frame), &fpstate);
14647 @@ -461,16 +461,18 @@ int ia32_setup_rt_frame(int sig, struct ksignal *ksig,
14648
14649 if (ksig->ka.sa.sa_flags & SA_RESTORER)
14650 restorer = ksig->ka.sa.sa_restorer;
14651 + else if (current->mm->context.vdso)
14652 + /* Return stub is in 32bit vsyscall page */
14653 + restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
14654 else
14655 - restorer = VDSO32_SYMBOL(current->mm->context.vdso,
14656 - rt_sigreturn);
14657 + restorer = frame->retcode;
14658 put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
14659
14660 /*
14661 * Not actually used anymore, but left because some gdb
14662 * versions need it.
14663 */
14664 - put_user_ex(*((u64 *)&code), (u64 __user *)frame->retcode);
14665 + put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode);
14666 } put_user_catch(err);
14667
14668 err |= copy_siginfo_to_user32(&frame->info, &ksig->info);
14669 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
14670 index 4299eb0..c0687a7 100644
14671 --- a/arch/x86/ia32/ia32entry.S
14672 +++ b/arch/x86/ia32/ia32entry.S
14673 @@ -15,8 +15,10 @@
14674 #include <asm/irqflags.h>
14675 #include <asm/asm.h>
14676 #include <asm/smap.h>
14677 +#include <asm/pgtable.h>
14678 #include <linux/linkage.h>
14679 #include <linux/err.h>
14680 +#include <asm/alternative-asm.h>
14681
14682 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
14683 #include <linux/elf-em.h>
14684 @@ -62,12 +64,12 @@
14685 */
14686 .macro LOAD_ARGS32 offset, _r9=0
14687 .if \_r9
14688 - movl \offset+16(%rsp),%r9d
14689 + movl \offset+R9(%rsp),%r9d
14690 .endif
14691 - movl \offset+40(%rsp),%ecx
14692 - movl \offset+48(%rsp),%edx
14693 - movl \offset+56(%rsp),%esi
14694 - movl \offset+64(%rsp),%edi
14695 + movl \offset+RCX(%rsp),%ecx
14696 + movl \offset+RDX(%rsp),%edx
14697 + movl \offset+RSI(%rsp),%esi
14698 + movl \offset+RDI(%rsp),%edi
14699 movl %eax,%eax /* zero extension */
14700 .endm
14701
14702 @@ -96,6 +98,32 @@ ENTRY(native_irq_enable_sysexit)
14703 ENDPROC(native_irq_enable_sysexit)
14704 #endif
14705
14706 + .macro pax_enter_kernel_user
14707 + pax_set_fptr_mask
14708 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14709 + call pax_enter_kernel_user
14710 +#endif
14711 + .endm
14712 +
14713 + .macro pax_exit_kernel_user
14714 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14715 + call pax_exit_kernel_user
14716 +#endif
14717 +#ifdef CONFIG_PAX_RANDKSTACK
14718 + pushq %rax
14719 + pushq %r11
14720 + call pax_randomize_kstack
14721 + popq %r11
14722 + popq %rax
14723 +#endif
14724 + .endm
14725 +
14726 + .macro pax_erase_kstack
14727 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
14728 + call pax_erase_kstack
14729 +#endif
14730 + .endm
14731 +
14732 /*
14733 * 32bit SYSENTER instruction entry.
14734 *
14735 @@ -122,12 +150,6 @@ ENTRY(ia32_sysenter_target)
14736 CFI_REGISTER rsp,rbp
14737 SWAPGS_UNSAFE_STACK
14738 movq PER_CPU_VAR(kernel_stack), %rsp
14739 - addq $(KERNEL_STACK_OFFSET),%rsp
14740 - /*
14741 - * No need to follow this irqs on/off section: the syscall
14742 - * disabled irqs, here we enable it straight after entry:
14743 - */
14744 - ENABLE_INTERRUPTS(CLBR_NONE)
14745 movl %ebp,%ebp /* zero extension */
14746 pushq_cfi $__USER32_DS
14747 /*CFI_REL_OFFSET ss,0*/
14748 @@ -135,24 +157,49 @@ ENTRY(ia32_sysenter_target)
14749 CFI_REL_OFFSET rsp,0
14750 pushfq_cfi
14751 /*CFI_REL_OFFSET rflags,0*/
14752 - movl TI_sysenter_return+THREAD_INFO(%rsp,3*8-KERNEL_STACK_OFFSET),%r10d
14753 - CFI_REGISTER rip,r10
14754 + orl $X86_EFLAGS_IF,(%rsp)
14755 + GET_THREAD_INFO(%r11)
14756 + movl TI_sysenter_return(%r11), %r11d
14757 + CFI_REGISTER rip,r11
14758 pushq_cfi $__USER32_CS
14759 /*CFI_REL_OFFSET cs,0*/
14760 movl %eax, %eax
14761 - pushq_cfi %r10
14762 + pushq_cfi %r11
14763 CFI_REL_OFFSET rip,0
14764 pushq_cfi %rax
14765 cld
14766 SAVE_ARGS 0,1,0
14767 + pax_enter_kernel_user
14768 +
14769 +#ifdef CONFIG_PAX_RANDKSTACK
14770 + pax_erase_kstack
14771 +#endif
14772 +
14773 + /*
14774 + * No need to follow this irqs on/off section: the syscall
14775 + * disabled irqs, here we enable it straight after entry:
14776 + */
14777 + ENABLE_INTERRUPTS(CLBR_NONE)
14778 /* no need to do an access_ok check here because rbp has been
14779 32bit zero extended */
14780 +
14781 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14782 + addq pax_user_shadow_base,%rbp
14783 + ASM_PAX_OPEN_USERLAND
14784 +#endif
14785 +
14786 ASM_STAC
14787 1: movl (%rbp),%ebp
14788 _ASM_EXTABLE(1b,ia32_badarg)
14789 ASM_CLAC
14790 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14791 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14792 +
14793 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14794 + ASM_PAX_CLOSE_USERLAND
14795 +#endif
14796 +
14797 + GET_THREAD_INFO(%r11)
14798 + orl $TS_COMPAT,TI_status(%r11)
14799 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
14800 CFI_REMEMBER_STATE
14801 jnz sysenter_tracesys
14802 cmpq $(IA32_NR_syscalls-1),%rax
14803 @@ -162,15 +209,18 @@ sysenter_do_call:
14804 sysenter_dispatch:
14805 call *ia32_sys_call_table(,%rax,8)
14806 movq %rax,RAX-ARGOFFSET(%rsp)
14807 + GET_THREAD_INFO(%r11)
14808 DISABLE_INTERRUPTS(CLBR_NONE)
14809 TRACE_IRQS_OFF
14810 - testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14811 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
14812 jnz sysexit_audit
14813 sysexit_from_sys_call:
14814 - andl $~TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14815 + pax_exit_kernel_user
14816 + pax_erase_kstack
14817 + andl $~TS_COMPAT,TI_status(%r11)
14818 /* clear IF, that popfq doesn't enable interrupts early */
14819 - andl $~0x200,EFLAGS-R11(%rsp)
14820 - movl RIP-R11(%rsp),%edx /* User %eip */
14821 + andl $~X86_EFLAGS_IF,EFLAGS(%rsp)
14822 + movl RIP(%rsp),%edx /* User %eip */
14823 CFI_REGISTER rip,rdx
14824 RESTORE_ARGS 0,24,0,0,0,0
14825 xorq %r8,%r8
14826 @@ -193,6 +243,9 @@ sysexit_from_sys_call:
14827 movl %eax,%esi /* 2nd arg: syscall number */
14828 movl $AUDIT_ARCH_I386,%edi /* 1st arg: audit arch */
14829 call __audit_syscall_entry
14830 +
14831 + pax_erase_kstack
14832 +
14833 movl RAX-ARGOFFSET(%rsp),%eax /* reload syscall number */
14834 cmpq $(IA32_NR_syscalls-1),%rax
14835 ja ia32_badsys
14836 @@ -204,7 +257,7 @@ sysexit_from_sys_call:
14837 .endm
14838
14839 .macro auditsys_exit exit
14840 - testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14841 + testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
14842 jnz ia32_ret_from_sys_call
14843 TRACE_IRQS_ON
14844 ENABLE_INTERRUPTS(CLBR_NONE)
14845 @@ -215,11 +268,12 @@ sysexit_from_sys_call:
14846 1: setbe %al /* 1 if error, 0 if not */
14847 movzbl %al,%edi /* zero-extend that into %edi */
14848 call __audit_syscall_exit
14849 + GET_THREAD_INFO(%r11)
14850 movq RAX-ARGOFFSET(%rsp),%rax /* reload syscall return value */
14851 movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
14852 DISABLE_INTERRUPTS(CLBR_NONE)
14853 TRACE_IRQS_OFF
14854 - testl %edi,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14855 + testl %edi,TI_flags(%r11)
14856 jz \exit
14857 CLEAR_RREGS -ARGOFFSET
14858 jmp int_with_check
14859 @@ -237,7 +291,7 @@ sysexit_audit:
14860
14861 sysenter_tracesys:
14862 #ifdef CONFIG_AUDITSYSCALL
14863 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14864 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
14865 jz sysenter_auditsys
14866 #endif
14867 SAVE_REST
14868 @@ -249,6 +303,9 @@ sysenter_tracesys:
14869 RESTORE_REST
14870 cmpq $(IA32_NR_syscalls-1),%rax
14871 ja int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
14872 +
14873 + pax_erase_kstack
14874 +
14875 jmp sysenter_do_call
14876 CFI_ENDPROC
14877 ENDPROC(ia32_sysenter_target)
14878 @@ -276,19 +333,25 @@ ENDPROC(ia32_sysenter_target)
14879 ENTRY(ia32_cstar_target)
14880 CFI_STARTPROC32 simple
14881 CFI_SIGNAL_FRAME
14882 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
14883 + CFI_DEF_CFA rsp,0
14884 CFI_REGISTER rip,rcx
14885 /*CFI_REGISTER rflags,r11*/
14886 SWAPGS_UNSAFE_STACK
14887 movl %esp,%r8d
14888 CFI_REGISTER rsp,r8
14889 movq PER_CPU_VAR(kernel_stack),%rsp
14890 + SAVE_ARGS 8*6,0,0
14891 + pax_enter_kernel_user
14892 +
14893 +#ifdef CONFIG_PAX_RANDKSTACK
14894 + pax_erase_kstack
14895 +#endif
14896 +
14897 /*
14898 * No need to follow this irqs on/off section: the syscall
14899 * disabled irqs and here we enable it straight after entry:
14900 */
14901 ENABLE_INTERRUPTS(CLBR_NONE)
14902 - SAVE_ARGS 8,0,0
14903 movl %eax,%eax /* zero extension */
14904 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
14905 movq %rcx,RIP-ARGOFFSET(%rsp)
14906 @@ -304,12 +367,25 @@ ENTRY(ia32_cstar_target)
14907 /* no need to do an access_ok check here because r8 has been
14908 32bit zero extended */
14909 /* hardware stack frame is complete now */
14910 +
14911 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14912 + ASM_PAX_OPEN_USERLAND
14913 + movq pax_user_shadow_base,%r8
14914 + addq RSP-ARGOFFSET(%rsp),%r8
14915 +#endif
14916 +
14917 ASM_STAC
14918 1: movl (%r8),%r9d
14919 _ASM_EXTABLE(1b,ia32_badarg)
14920 ASM_CLAC
14921 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14922 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14923 +
14924 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14925 + ASM_PAX_CLOSE_USERLAND
14926 +#endif
14927 +
14928 + GET_THREAD_INFO(%r11)
14929 + orl $TS_COMPAT,TI_status(%r11)
14930 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
14931 CFI_REMEMBER_STATE
14932 jnz cstar_tracesys
14933 cmpq $IA32_NR_syscalls-1,%rax
14934 @@ -319,13 +395,16 @@ cstar_do_call:
14935 cstar_dispatch:
14936 call *ia32_sys_call_table(,%rax,8)
14937 movq %rax,RAX-ARGOFFSET(%rsp)
14938 + GET_THREAD_INFO(%r11)
14939 DISABLE_INTERRUPTS(CLBR_NONE)
14940 TRACE_IRQS_OFF
14941 - testl $_TIF_ALLWORK_MASK,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14942 + testl $_TIF_ALLWORK_MASK,TI_flags(%r11)
14943 jnz sysretl_audit
14944 sysretl_from_sys_call:
14945 - andl $~TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14946 - RESTORE_ARGS 0,-ARG_SKIP,0,0,0
14947 + pax_exit_kernel_user
14948 + pax_erase_kstack
14949 + andl $~TS_COMPAT,TI_status(%r11)
14950 + RESTORE_ARGS 0,-ORIG_RAX,0,0,0
14951 movl RIP-ARGOFFSET(%rsp),%ecx
14952 CFI_REGISTER rip,rcx
14953 movl EFLAGS-ARGOFFSET(%rsp),%r11d
14954 @@ -352,7 +431,7 @@ sysretl_audit:
14955
14956 cstar_tracesys:
14957 #ifdef CONFIG_AUDITSYSCALL
14958 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14959 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%r11)
14960 jz cstar_auditsys
14961 #endif
14962 xchgl %r9d,%ebp
14963 @@ -366,11 +445,19 @@ cstar_tracesys:
14964 xchgl %ebp,%r9d
14965 cmpq $(IA32_NR_syscalls-1),%rax
14966 ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
14967 +
14968 + pax_erase_kstack
14969 +
14970 jmp cstar_do_call
14971 END(ia32_cstar_target)
14972
14973 ia32_badarg:
14974 ASM_CLAC
14975 +
14976 +#ifdef CONFIG_PAX_MEMORY_UDEREF
14977 + ASM_PAX_CLOSE_USERLAND
14978 +#endif
14979 +
14980 movq $-EFAULT,%rax
14981 jmp ia32_sysret
14982 CFI_ENDPROC
14983 @@ -407,19 +494,26 @@ ENTRY(ia32_syscall)
14984 CFI_REL_OFFSET rip,RIP-RIP
14985 PARAVIRT_ADJUST_EXCEPTION_FRAME
14986 SWAPGS
14987 - /*
14988 - * No need to follow this irqs on/off section: the syscall
14989 - * disabled irqs and here we enable it straight after entry:
14990 - */
14991 - ENABLE_INTERRUPTS(CLBR_NONE)
14992 movl %eax,%eax
14993 pushq_cfi %rax
14994 cld
14995 /* note the registers are not zero extended to the sf.
14996 this could be a problem. */
14997 SAVE_ARGS 0,1,0
14998 - orl $TS_COMPAT,TI_status+THREAD_INFO(%rsp,RIP-ARGOFFSET)
14999 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
15000 + pax_enter_kernel_user
15001 +
15002 +#ifdef CONFIG_PAX_RANDKSTACK
15003 + pax_erase_kstack
15004 +#endif
15005 +
15006 + /*
15007 + * No need to follow this irqs on/off section: the syscall
15008 + * disabled irqs and here we enable it straight after entry:
15009 + */
15010 + ENABLE_INTERRUPTS(CLBR_NONE)
15011 + GET_THREAD_INFO(%r11)
15012 + orl $TS_COMPAT,TI_status(%r11)
15013 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r11)
15014 jnz ia32_tracesys
15015 cmpq $(IA32_NR_syscalls-1),%rax
15016 ja ia32_badsys
15017 @@ -442,6 +536,9 @@ ia32_tracesys:
15018 RESTORE_REST
15019 cmpq $(IA32_NR_syscalls-1),%rax
15020 ja int_ret_from_sys_call /* ia32_tracesys has set RAX(%rsp) */
15021 +
15022 + pax_erase_kstack
15023 +
15024 jmp ia32_do_call
15025 END(ia32_syscall)
15026
15027 diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
15028 index 8e0ceec..af13504 100644
15029 --- a/arch/x86/ia32/sys_ia32.c
15030 +++ b/arch/x86/ia32/sys_ia32.c
15031 @@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long offset_low,
15032 */
15033 static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat)
15034 {
15035 - typeof(ubuf->st_uid) uid = 0;
15036 - typeof(ubuf->st_gid) gid = 0;
15037 + typeof(((struct stat64 *)0)->st_uid) uid = 0;
15038 + typeof(((struct stat64 *)0)->st_gid) gid = 0;
15039 SET_UID(uid, from_kuid_munged(current_user_ns(), stat->uid));
15040 SET_GID(gid, from_kgid_munged(current_user_ns(), stat->gid));
15041 if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) ||
15042 diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h
15043 index 372231c..51b537d 100644
15044 --- a/arch/x86/include/asm/alternative-asm.h
15045 +++ b/arch/x86/include/asm/alternative-asm.h
15046 @@ -18,6 +18,45 @@
15047 .endm
15048 #endif
15049
15050 +#ifdef KERNEXEC_PLUGIN
15051 + .macro pax_force_retaddr_bts rip=0
15052 + btsq $63,\rip(%rsp)
15053 + .endm
15054 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
15055 + .macro pax_force_retaddr rip=0, reload=0
15056 + btsq $63,\rip(%rsp)
15057 + .endm
15058 + .macro pax_force_fptr ptr
15059 + btsq $63,\ptr
15060 + .endm
15061 + .macro pax_set_fptr_mask
15062 + .endm
15063 +#endif
15064 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
15065 + .macro pax_force_retaddr rip=0, reload=0
15066 + .if \reload
15067 + pax_set_fptr_mask
15068 + .endif
15069 + orq %r12,\rip(%rsp)
15070 + .endm
15071 + .macro pax_force_fptr ptr
15072 + orq %r12,\ptr
15073 + .endm
15074 + .macro pax_set_fptr_mask
15075 + movabs $0x8000000000000000,%r12
15076 + .endm
15077 +#endif
15078 +#else
15079 + .macro pax_force_retaddr rip=0, reload=0
15080 + .endm
15081 + .macro pax_force_fptr ptr
15082 + .endm
15083 + .macro pax_force_retaddr_bts rip=0
15084 + .endm
15085 + .macro pax_set_fptr_mask
15086 + .endm
15087 +#endif
15088 +
15089 .macro altinstruction_entry orig alt feature orig_len alt_len
15090 .long \orig - .
15091 .long \alt - .
15092 diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h
15093 index 0a3f9c9..c9d081d 100644
15094 --- a/arch/x86/include/asm/alternative.h
15095 +++ b/arch/x86/include/asm/alternative.h
15096 @@ -106,7 +106,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
15097 ".pushsection .discard,\"aw\",@progbits\n" \
15098 DISCARD_ENTRY(1) \
15099 ".popsection\n" \
15100 - ".pushsection .altinstr_replacement, \"ax\"\n" \
15101 + ".pushsection .altinstr_replacement, \"a\"\n" \
15102 ALTINSTR_REPLACEMENT(newinstr, feature, 1) \
15103 ".popsection"
15104
15105 @@ -120,7 +120,7 @@ static inline int alternatives_text_reserved(void *start, void *end)
15106 DISCARD_ENTRY(1) \
15107 DISCARD_ENTRY(2) \
15108 ".popsection\n" \
15109 - ".pushsection .altinstr_replacement, \"ax\"\n" \
15110 + ".pushsection .altinstr_replacement, \"a\"\n" \
15111 ALTINSTR_REPLACEMENT(newinstr1, feature1, 1) \
15112 ALTINSTR_REPLACEMENT(newinstr2, feature2, 2) \
15113 ".popsection"
15114 diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
15115 index 1d2091a..f5074c1 100644
15116 --- a/arch/x86/include/asm/apic.h
15117 +++ b/arch/x86/include/asm/apic.h
15118 @@ -45,7 +45,7 @@ static inline void generic_apic_probe(void)
15119
15120 #ifdef CONFIG_X86_LOCAL_APIC
15121
15122 -extern unsigned int apic_verbosity;
15123 +extern int apic_verbosity;
15124 extern int local_apic_timer_c2_ok;
15125
15126 extern int disable_apic;
15127 diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h
15128 index 20370c6..a2eb9b0 100644
15129 --- a/arch/x86/include/asm/apm.h
15130 +++ b/arch/x86/include/asm/apm.h
15131 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in,
15132 __asm__ __volatile__(APM_DO_ZERO_SEGS
15133 "pushl %%edi\n\t"
15134 "pushl %%ebp\n\t"
15135 - "lcall *%%cs:apm_bios_entry\n\t"
15136 + "lcall *%%ss:apm_bios_entry\n\t"
15137 "setc %%al\n\t"
15138 "popl %%ebp\n\t"
15139 "popl %%edi\n\t"
15140 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_asm(u32 func, u32 ebx_in,
15141 __asm__ __volatile__(APM_DO_ZERO_SEGS
15142 "pushl %%edi\n\t"
15143 "pushl %%ebp\n\t"
15144 - "lcall *%%cs:apm_bios_entry\n\t"
15145 + "lcall *%%ss:apm_bios_entry\n\t"
15146 "setc %%bl\n\t"
15147 "popl %%ebp\n\t"
15148 "popl %%edi\n\t"
15149 diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
15150 index b17f4f4..9620151 100644
15151 --- a/arch/x86/include/asm/atomic.h
15152 +++ b/arch/x86/include/asm/atomic.h
15153 @@ -23,7 +23,18 @@
15154 */
15155 static inline int atomic_read(const atomic_t *v)
15156 {
15157 - return (*(volatile int *)&(v)->counter);
15158 + return (*(volatile const int *)&(v)->counter);
15159 +}
15160 +
15161 +/**
15162 + * atomic_read_unchecked - read atomic variable
15163 + * @v: pointer of type atomic_unchecked_t
15164 + *
15165 + * Atomically reads the value of @v.
15166 + */
15167 +static inline int __intentional_overflow(-1) atomic_read_unchecked(const atomic_unchecked_t *v)
15168 +{
15169 + return (*(volatile const int *)&(v)->counter);
15170 }
15171
15172 /**
15173 @@ -39,6 +50,18 @@ static inline void atomic_set(atomic_t *v, int i)
15174 }
15175
15176 /**
15177 + * atomic_set_unchecked - set atomic variable
15178 + * @v: pointer of type atomic_unchecked_t
15179 + * @i: required value
15180 + *
15181 + * Atomically sets the value of @v to @i.
15182 + */
15183 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
15184 +{
15185 + v->counter = i;
15186 +}
15187 +
15188 +/**
15189 * atomic_add - add integer to atomic variable
15190 * @i: integer value to add
15191 * @v: pointer of type atomic_t
15192 @@ -47,7 +70,29 @@ static inline void atomic_set(atomic_t *v, int i)
15193 */
15194 static inline void atomic_add(int i, atomic_t *v)
15195 {
15196 - asm volatile(LOCK_PREFIX "addl %1,%0"
15197 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
15198 +
15199 +#ifdef CONFIG_PAX_REFCOUNT
15200 + "jno 0f\n"
15201 + LOCK_PREFIX "subl %1,%0\n"
15202 + "int $4\n0:\n"
15203 + _ASM_EXTABLE(0b, 0b)
15204 +#endif
15205 +
15206 + : "+m" (v->counter)
15207 + : "ir" (i));
15208 +}
15209 +
15210 +/**
15211 + * atomic_add_unchecked - add integer to atomic variable
15212 + * @i: integer value to add
15213 + * @v: pointer of type atomic_unchecked_t
15214 + *
15215 + * Atomically adds @i to @v.
15216 + */
15217 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
15218 +{
15219 + asm volatile(LOCK_PREFIX "addl %1,%0\n"
15220 : "+m" (v->counter)
15221 : "ir" (i));
15222 }
15223 @@ -61,7 +106,29 @@ static inline void atomic_add(int i, atomic_t *v)
15224 */
15225 static inline void atomic_sub(int i, atomic_t *v)
15226 {
15227 - asm volatile(LOCK_PREFIX "subl %1,%0"
15228 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
15229 +
15230 +#ifdef CONFIG_PAX_REFCOUNT
15231 + "jno 0f\n"
15232 + LOCK_PREFIX "addl %1,%0\n"
15233 + "int $4\n0:\n"
15234 + _ASM_EXTABLE(0b, 0b)
15235 +#endif
15236 +
15237 + : "+m" (v->counter)
15238 + : "ir" (i));
15239 +}
15240 +
15241 +/**
15242 + * atomic_sub_unchecked - subtract integer from atomic variable
15243 + * @i: integer value to subtract
15244 + * @v: pointer of type atomic_unchecked_t
15245 + *
15246 + * Atomically subtracts @i from @v.
15247 + */
15248 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
15249 +{
15250 + asm volatile(LOCK_PREFIX "subl %1,%0\n"
15251 : "+m" (v->counter)
15252 : "ir" (i));
15253 }
15254 @@ -77,7 +144,7 @@ static inline void atomic_sub(int i, atomic_t *v)
15255 */
15256 static inline int atomic_sub_and_test(int i, atomic_t *v)
15257 {
15258 - GEN_BINARY_RMWcc(LOCK_PREFIX "subl", v->counter, "er", i, "%0", "e");
15259 + GEN_BINARY_RMWcc(LOCK_PREFIX "subl", LOCK_PREFIX "addl", v->counter, "er", i, "%0", "e");
15260 }
15261
15262 /**
15263 @@ -88,7 +155,27 @@ static inline int atomic_sub_and_test(int i, atomic_t *v)
15264 */
15265 static inline void atomic_inc(atomic_t *v)
15266 {
15267 - asm volatile(LOCK_PREFIX "incl %0"
15268 + asm volatile(LOCK_PREFIX "incl %0\n"
15269 +
15270 +#ifdef CONFIG_PAX_REFCOUNT
15271 + "jno 0f\n"
15272 + LOCK_PREFIX "decl %0\n"
15273 + "int $4\n0:\n"
15274 + _ASM_EXTABLE(0b, 0b)
15275 +#endif
15276 +
15277 + : "+m" (v->counter));
15278 +}
15279 +
15280 +/**
15281 + * atomic_inc_unchecked - increment atomic variable
15282 + * @v: pointer of type atomic_unchecked_t
15283 + *
15284 + * Atomically increments @v by 1.
15285 + */
15286 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
15287 +{
15288 + asm volatile(LOCK_PREFIX "incl %0\n"
15289 : "+m" (v->counter));
15290 }
15291
15292 @@ -100,7 +187,27 @@ static inline void atomic_inc(atomic_t *v)
15293 */
15294 static inline void atomic_dec(atomic_t *v)
15295 {
15296 - asm volatile(LOCK_PREFIX "decl %0"
15297 + asm volatile(LOCK_PREFIX "decl %0\n"
15298 +
15299 +#ifdef CONFIG_PAX_REFCOUNT
15300 + "jno 0f\n"
15301 + LOCK_PREFIX "incl %0\n"
15302 + "int $4\n0:\n"
15303 + _ASM_EXTABLE(0b, 0b)
15304 +#endif
15305 +
15306 + : "+m" (v->counter));
15307 +}
15308 +
15309 +/**
15310 + * atomic_dec_unchecked - decrement atomic variable
15311 + * @v: pointer of type atomic_unchecked_t
15312 + *
15313 + * Atomically decrements @v by 1.
15314 + */
15315 +static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
15316 +{
15317 + asm volatile(LOCK_PREFIX "decl %0\n"
15318 : "+m" (v->counter));
15319 }
15320
15321 @@ -114,7 +221,7 @@ static inline void atomic_dec(atomic_t *v)
15322 */
15323 static inline int atomic_dec_and_test(atomic_t *v)
15324 {
15325 - GEN_UNARY_RMWcc(LOCK_PREFIX "decl", v->counter, "%0", "e");
15326 + GEN_UNARY_RMWcc(LOCK_PREFIX "decl", LOCK_PREFIX "incl", v->counter, "%0", "e");
15327 }
15328
15329 /**
15330 @@ -127,7 +234,20 @@ static inline int atomic_dec_and_test(atomic_t *v)
15331 */
15332 static inline int atomic_inc_and_test(atomic_t *v)
15333 {
15334 - GEN_UNARY_RMWcc(LOCK_PREFIX "incl", v->counter, "%0", "e");
15335 + GEN_UNARY_RMWcc(LOCK_PREFIX "incl", LOCK_PREFIX "decl", v->counter, "%0", "e");
15336 +}
15337 +
15338 +/**
15339 + * atomic_inc_and_test_unchecked - increment and test
15340 + * @v: pointer of type atomic_unchecked_t
15341 + *
15342 + * Atomically increments @v by 1
15343 + * and returns true if the result is zero, or false for all
15344 + * other cases.
15345 + */
15346 +static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
15347 +{
15348 + GEN_UNARY_RMWcc_unchecked(LOCK_PREFIX "incl", v->counter, "%0", "e");
15349 }
15350
15351 /**
15352 @@ -141,7 +261,7 @@ static inline int atomic_inc_and_test(atomic_t *v)
15353 */
15354 static inline int atomic_add_negative(int i, atomic_t *v)
15355 {
15356 - GEN_BINARY_RMWcc(LOCK_PREFIX "addl", v->counter, "er", i, "%0", "s");
15357 + GEN_BINARY_RMWcc(LOCK_PREFIX "addl", LOCK_PREFIX "subl", v->counter, "er", i, "%0", "s");
15358 }
15359
15360 /**
15361 @@ -153,6 +273,18 @@ static inline int atomic_add_negative(int i, atomic_t *v)
15362 */
15363 static inline int atomic_add_return(int i, atomic_t *v)
15364 {
15365 + return i + xadd_check_overflow(&v->counter, i);
15366 +}
15367 +
15368 +/**
15369 + * atomic_add_return_unchecked - add integer and return
15370 + * @i: integer value to add
15371 + * @v: pointer of type atomic_unchecked_t
15372 + *
15373 + * Atomically adds @i to @v and returns @i + @v
15374 + */
15375 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
15376 +{
15377 return i + xadd(&v->counter, i);
15378 }
15379
15380 @@ -169,9 +301,18 @@ static inline int atomic_sub_return(int i, atomic_t *v)
15381 }
15382
15383 #define atomic_inc_return(v) (atomic_add_return(1, v))
15384 +static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
15385 +{
15386 + return atomic_add_return_unchecked(1, v);
15387 +}
15388 #define atomic_dec_return(v) (atomic_sub_return(1, v))
15389
15390 -static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
15391 +static inline int __intentional_overflow(-1) atomic_cmpxchg(atomic_t *v, int old, int new)
15392 +{
15393 + return cmpxchg(&v->counter, old, new);
15394 +}
15395 +
15396 +static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
15397 {
15398 return cmpxchg(&v->counter, old, new);
15399 }
15400 @@ -181,6 +322,11 @@ static inline int atomic_xchg(atomic_t *v, int new)
15401 return xchg(&v->counter, new);
15402 }
15403
15404 +static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
15405 +{
15406 + return xchg(&v->counter, new);
15407 +}
15408 +
15409 /**
15410 * __atomic_add_unless - add unless the number is already a given value
15411 * @v: pointer of type atomic_t
15412 @@ -190,14 +336,27 @@ static inline int atomic_xchg(atomic_t *v, int new)
15413 * Atomically adds @a to @v, so long as @v was not already @u.
15414 * Returns the old value of @v.
15415 */
15416 -static inline int __atomic_add_unless(atomic_t *v, int a, int u)
15417 +static inline int __intentional_overflow(-1) __atomic_add_unless(atomic_t *v, int a, int u)
15418 {
15419 - int c, old;
15420 + int c, old, new;
15421 c = atomic_read(v);
15422 for (;;) {
15423 - if (unlikely(c == (u)))
15424 + if (unlikely(c == u))
15425 break;
15426 - old = atomic_cmpxchg((v), c, c + (a));
15427 +
15428 + asm volatile("addl %2,%0\n"
15429 +
15430 +#ifdef CONFIG_PAX_REFCOUNT
15431 + "jno 0f\n"
15432 + "subl %2,%0\n"
15433 + "int $4\n0:\n"
15434 + _ASM_EXTABLE(0b, 0b)
15435 +#endif
15436 +
15437 + : "=r" (new)
15438 + : "0" (c), "ir" (a));
15439 +
15440 + old = atomic_cmpxchg(v, c, new);
15441 if (likely(old == c))
15442 break;
15443 c = old;
15444 @@ -206,6 +365,49 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
15445 }
15446
15447 /**
15448 + * atomic_inc_not_zero_hint - increment if not null
15449 + * @v: pointer of type atomic_t
15450 + * @hint: probable value of the atomic before the increment
15451 + *
15452 + * This version of atomic_inc_not_zero() gives a hint of probable
15453 + * value of the atomic. This helps processor to not read the memory
15454 + * before doing the atomic read/modify/write cycle, lowering
15455 + * number of bus transactions on some arches.
15456 + *
15457 + * Returns: 0 if increment was not done, 1 otherwise.
15458 + */
15459 +#define atomic_inc_not_zero_hint atomic_inc_not_zero_hint
15460 +static inline int atomic_inc_not_zero_hint(atomic_t *v, int hint)
15461 +{
15462 + int val, c = hint, new;
15463 +
15464 + /* sanity test, should be removed by compiler if hint is a constant */
15465 + if (!hint)
15466 + return __atomic_add_unless(v, 1, 0);
15467 +
15468 + do {
15469 + asm volatile("incl %0\n"
15470 +
15471 +#ifdef CONFIG_PAX_REFCOUNT
15472 + "jno 0f\n"
15473 + "decl %0\n"
15474 + "int $4\n0:\n"
15475 + _ASM_EXTABLE(0b, 0b)
15476 +#endif
15477 +
15478 + : "=r" (new)
15479 + : "0" (c));
15480 +
15481 + val = atomic_cmpxchg(v, c, new);
15482 + if (val == c)
15483 + return 1;
15484 + c = val;
15485 + } while (c);
15486 +
15487 + return 0;
15488 +}
15489 +
15490 +/**
15491 * atomic_inc_short - increment of a short integer
15492 * @v: pointer to type int
15493 *
15494 @@ -234,14 +436,37 @@ static inline void atomic_or_long(unsigned long *v1, unsigned long v2)
15495 #endif
15496
15497 /* These are x86-specific, used by some header files */
15498 -#define atomic_clear_mask(mask, addr) \
15499 - asm volatile(LOCK_PREFIX "andl %0,%1" \
15500 - : : "r" (~(mask)), "m" (*(addr)) : "memory")
15501 +static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
15502 +{
15503 + asm volatile(LOCK_PREFIX "andl %1,%0"
15504 + : "+m" (v->counter)
15505 + : "r" (~(mask))
15506 + : "memory");
15507 +}
15508
15509 -#define atomic_set_mask(mask, addr) \
15510 - asm volatile(LOCK_PREFIX "orl %0,%1" \
15511 - : : "r" ((unsigned)(mask)), "m" (*(addr)) \
15512 - : "memory")
15513 +static inline void atomic_clear_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
15514 +{
15515 + asm volatile(LOCK_PREFIX "andl %1,%0"
15516 + : "+m" (v->counter)
15517 + : "r" (~(mask))
15518 + : "memory");
15519 +}
15520 +
15521 +static inline void atomic_set_mask(unsigned int mask, atomic_t *v)
15522 +{
15523 + asm volatile(LOCK_PREFIX "orl %1,%0"
15524 + : "+m" (v->counter)
15525 + : "r" (mask)
15526 + : "memory");
15527 +}
15528 +
15529 +static inline void atomic_set_mask_unchecked(unsigned int mask, atomic_unchecked_t *v)
15530 +{
15531 + asm volatile(LOCK_PREFIX "orl %1,%0"
15532 + : "+m" (v->counter)
15533 + : "r" (mask)
15534 + : "memory");
15535 +}
15536
15537 /* Atomic operations are already serializing on x86 */
15538 #define smp_mb__before_atomic_dec() barrier()
15539 diff --git a/arch/x86/include/asm/atomic64_32.h b/arch/x86/include/asm/atomic64_32.h
15540 index b154de7..bf18a5a 100644
15541 --- a/arch/x86/include/asm/atomic64_32.h
15542 +++ b/arch/x86/include/asm/atomic64_32.h
15543 @@ -12,6 +12,14 @@ typedef struct {
15544 u64 __aligned(8) counter;
15545 } atomic64_t;
15546
15547 +#ifdef CONFIG_PAX_REFCOUNT
15548 +typedef struct {
15549 + u64 __aligned(8) counter;
15550 +} atomic64_unchecked_t;
15551 +#else
15552 +typedef atomic64_t atomic64_unchecked_t;
15553 +#endif
15554 +
15555 #define ATOMIC64_INIT(val) { (val) }
15556
15557 #define __ATOMIC64_DECL(sym) void atomic64_##sym(atomic64_t *, ...)
15558 @@ -37,21 +45,31 @@ typedef struct {
15559 ATOMIC64_DECL_ONE(sym##_386)
15560
15561 ATOMIC64_DECL_ONE(add_386);
15562 +ATOMIC64_DECL_ONE(add_unchecked_386);
15563 ATOMIC64_DECL_ONE(sub_386);
15564 +ATOMIC64_DECL_ONE(sub_unchecked_386);
15565 ATOMIC64_DECL_ONE(inc_386);
15566 +ATOMIC64_DECL_ONE(inc_unchecked_386);
15567 ATOMIC64_DECL_ONE(dec_386);
15568 +ATOMIC64_DECL_ONE(dec_unchecked_386);
15569 #endif
15570
15571 #define alternative_atomic64(f, out, in...) \
15572 __alternative_atomic64(f, f, ASM_OUTPUT2(out), ## in)
15573
15574 ATOMIC64_DECL(read);
15575 +ATOMIC64_DECL(read_unchecked);
15576 ATOMIC64_DECL(set);
15577 +ATOMIC64_DECL(set_unchecked);
15578 ATOMIC64_DECL(xchg);
15579 ATOMIC64_DECL(add_return);
15580 +ATOMIC64_DECL(add_return_unchecked);
15581 ATOMIC64_DECL(sub_return);
15582 +ATOMIC64_DECL(sub_return_unchecked);
15583 ATOMIC64_DECL(inc_return);
15584 +ATOMIC64_DECL(inc_return_unchecked);
15585 ATOMIC64_DECL(dec_return);
15586 +ATOMIC64_DECL(dec_return_unchecked);
15587 ATOMIC64_DECL(dec_if_positive);
15588 ATOMIC64_DECL(inc_not_zero);
15589 ATOMIC64_DECL(add_unless);
15590 @@ -77,6 +95,21 @@ static inline long long atomic64_cmpxchg(atomic64_t *v, long long o, long long n
15591 }
15592
15593 /**
15594 + * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
15595 + * @p: pointer to type atomic64_unchecked_t
15596 + * @o: expected value
15597 + * @n: new value
15598 + *
15599 + * Atomically sets @v to @n if it was equal to @o and returns
15600 + * the old value.
15601 + */
15602 +
15603 +static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
15604 +{
15605 + return cmpxchg64(&v->counter, o, n);
15606 +}
15607 +
15608 +/**
15609 * atomic64_xchg - xchg atomic64 variable
15610 * @v: pointer to type atomic64_t
15611 * @n: value to assign
15612 @@ -112,6 +145,22 @@ static inline void atomic64_set(atomic64_t *v, long long i)
15613 }
15614
15615 /**
15616 + * atomic64_set_unchecked - set atomic64 variable
15617 + * @v: pointer to type atomic64_unchecked_t
15618 + * @n: value to assign
15619 + *
15620 + * Atomically sets the value of @v to @n.
15621 + */
15622 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
15623 +{
15624 + unsigned high = (unsigned)(i >> 32);
15625 + unsigned low = (unsigned)i;
15626 + alternative_atomic64(set, /* no output */,
15627 + "S" (v), "b" (low), "c" (high)
15628 + : "eax", "edx", "memory");
15629 +}
15630 +
15631 +/**
15632 * atomic64_read - read atomic64 variable
15633 * @v: pointer to type atomic64_t
15634 *
15635 @@ -125,6 +174,19 @@ static inline long long atomic64_read(const atomic64_t *v)
15636 }
15637
15638 /**
15639 + * atomic64_read_unchecked - read atomic64 variable
15640 + * @v: pointer to type atomic64_unchecked_t
15641 + *
15642 + * Atomically reads the value of @v and returns it.
15643 + */
15644 +static inline long long __intentional_overflow(-1) atomic64_read_unchecked(atomic64_unchecked_t *v)
15645 +{
15646 + long long r;
15647 + alternative_atomic64(read, "=&A" (r), "c" (v) : "memory");
15648 + return r;
15649 + }
15650 +
15651 +/**
15652 * atomic64_add_return - add and return
15653 * @i: integer value to add
15654 * @v: pointer to type atomic64_t
15655 @@ -139,6 +201,21 @@ static inline long long atomic64_add_return(long long i, atomic64_t *v)
15656 return i;
15657 }
15658
15659 +/**
15660 + * atomic64_add_return_unchecked - add and return
15661 + * @i: integer value to add
15662 + * @v: pointer to type atomic64_unchecked_t
15663 + *
15664 + * Atomically adds @i to @v and returns @i + *@v
15665 + */
15666 +static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
15667 +{
15668 + alternative_atomic64(add_return_unchecked,
15669 + ASM_OUTPUT2("+A" (i), "+c" (v)),
15670 + ASM_NO_INPUT_CLOBBER("memory"));
15671 + return i;
15672 +}
15673 +
15674 /*
15675 * Other variants with different arithmetic operators:
15676 */
15677 @@ -158,6 +235,14 @@ static inline long long atomic64_inc_return(atomic64_t *v)
15678 return a;
15679 }
15680
15681 +static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
15682 +{
15683 + long long a;
15684 + alternative_atomic64(inc_return_unchecked, "=&A" (a),
15685 + "S" (v) : "memory", "ecx");
15686 + return a;
15687 +}
15688 +
15689 static inline long long atomic64_dec_return(atomic64_t *v)
15690 {
15691 long long a;
15692 @@ -182,6 +267,21 @@ static inline long long atomic64_add(long long i, atomic64_t *v)
15693 }
15694
15695 /**
15696 + * atomic64_add_unchecked - add integer to atomic64 variable
15697 + * @i: integer value to add
15698 + * @v: pointer to type atomic64_unchecked_t
15699 + *
15700 + * Atomically adds @i to @v.
15701 + */
15702 +static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
15703 +{
15704 + __alternative_atomic64(add_unchecked, add_return_unchecked,
15705 + ASM_OUTPUT2("+A" (i), "+c" (v)),
15706 + ASM_NO_INPUT_CLOBBER("memory"));
15707 + return i;
15708 +}
15709 +
15710 +/**
15711 * atomic64_sub - subtract the atomic64 variable
15712 * @i: integer value to subtract
15713 * @v: pointer to type atomic64_t
15714 diff --git a/arch/x86/include/asm/atomic64_64.h b/arch/x86/include/asm/atomic64_64.h
15715 index 46e9052..ae45136 100644
15716 --- a/arch/x86/include/asm/atomic64_64.h
15717 +++ b/arch/x86/include/asm/atomic64_64.h
15718 @@ -18,7 +18,19 @@
15719 */
15720 static inline long atomic64_read(const atomic64_t *v)
15721 {
15722 - return (*(volatile long *)&(v)->counter);
15723 + return (*(volatile const long *)&(v)->counter);
15724 +}
15725 +
15726 +/**
15727 + * atomic64_read_unchecked - read atomic64 variable
15728 + * @v: pointer of type atomic64_unchecked_t
15729 + *
15730 + * Atomically reads the value of @v.
15731 + * Doesn't imply a read memory barrier.
15732 + */
15733 +static inline long __intentional_overflow(-1) atomic64_read_unchecked(const atomic64_unchecked_t *v)
15734 +{
15735 + return (*(volatile const long *)&(v)->counter);
15736 }
15737
15738 /**
15739 @@ -34,6 +46,18 @@ static inline void atomic64_set(atomic64_t *v, long i)
15740 }
15741
15742 /**
15743 + * atomic64_set_unchecked - set atomic64 variable
15744 + * @v: pointer to type atomic64_unchecked_t
15745 + * @i: required value
15746 + *
15747 + * Atomically sets the value of @v to @i.
15748 + */
15749 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
15750 +{
15751 + v->counter = i;
15752 +}
15753 +
15754 +/**
15755 * atomic64_add - add integer to atomic64 variable
15756 * @i: integer value to add
15757 * @v: pointer to type atomic64_t
15758 @@ -42,6 +66,28 @@ static inline void atomic64_set(atomic64_t *v, long i)
15759 */
15760 static inline void atomic64_add(long i, atomic64_t *v)
15761 {
15762 + asm volatile(LOCK_PREFIX "addq %1,%0\n"
15763 +
15764 +#ifdef CONFIG_PAX_REFCOUNT
15765 + "jno 0f\n"
15766 + LOCK_PREFIX "subq %1,%0\n"
15767 + "int $4\n0:\n"
15768 + _ASM_EXTABLE(0b, 0b)
15769 +#endif
15770 +
15771 + : "=m" (v->counter)
15772 + : "er" (i), "m" (v->counter));
15773 +}
15774 +
15775 +/**
15776 + * atomic64_add_unchecked - add integer to atomic64 variable
15777 + * @i: integer value to add
15778 + * @v: pointer to type atomic64_unchecked_t
15779 + *
15780 + * Atomically adds @i to @v.
15781 + */
15782 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
15783 +{
15784 asm volatile(LOCK_PREFIX "addq %1,%0"
15785 : "=m" (v->counter)
15786 : "er" (i), "m" (v->counter));
15787 @@ -56,7 +102,29 @@ static inline void atomic64_add(long i, atomic64_t *v)
15788 */
15789 static inline void atomic64_sub(long i, atomic64_t *v)
15790 {
15791 - asm volatile(LOCK_PREFIX "subq %1,%0"
15792 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
15793 +
15794 +#ifdef CONFIG_PAX_REFCOUNT
15795 + "jno 0f\n"
15796 + LOCK_PREFIX "addq %1,%0\n"
15797 + "int $4\n0:\n"
15798 + _ASM_EXTABLE(0b, 0b)
15799 +#endif
15800 +
15801 + : "=m" (v->counter)
15802 + : "er" (i), "m" (v->counter));
15803 +}
15804 +
15805 +/**
15806 + * atomic64_sub_unchecked - subtract the atomic64 variable
15807 + * @i: integer value to subtract
15808 + * @v: pointer to type atomic64_unchecked_t
15809 + *
15810 + * Atomically subtracts @i from @v.
15811 + */
15812 +static inline void atomic64_sub_unchecked(long i, atomic64_unchecked_t *v)
15813 +{
15814 + asm volatile(LOCK_PREFIX "subq %1,%0\n"
15815 : "=m" (v->counter)
15816 : "er" (i), "m" (v->counter));
15817 }
15818 @@ -72,7 +140,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
15819 */
15820 static inline int atomic64_sub_and_test(long i, atomic64_t *v)
15821 {
15822 - GEN_BINARY_RMWcc(LOCK_PREFIX "subq", v->counter, "er", i, "%0", "e");
15823 + GEN_BINARY_RMWcc(LOCK_PREFIX "subq", LOCK_PREFIX "addq", v->counter, "er", i, "%0", "e");
15824 }
15825
15826 /**
15827 @@ -83,6 +151,27 @@ static inline int atomic64_sub_and_test(long i, atomic64_t *v)
15828 */
15829 static inline void atomic64_inc(atomic64_t *v)
15830 {
15831 + asm volatile(LOCK_PREFIX "incq %0\n"
15832 +
15833 +#ifdef CONFIG_PAX_REFCOUNT
15834 + "jno 0f\n"
15835 + LOCK_PREFIX "decq %0\n"
15836 + "int $4\n0:\n"
15837 + _ASM_EXTABLE(0b, 0b)
15838 +#endif
15839 +
15840 + : "=m" (v->counter)
15841 + : "m" (v->counter));
15842 +}
15843 +
15844 +/**
15845 + * atomic64_inc_unchecked - increment atomic64 variable
15846 + * @v: pointer to type atomic64_unchecked_t
15847 + *
15848 + * Atomically increments @v by 1.
15849 + */
15850 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
15851 +{
15852 asm volatile(LOCK_PREFIX "incq %0"
15853 : "=m" (v->counter)
15854 : "m" (v->counter));
15855 @@ -96,7 +185,28 @@ static inline void atomic64_inc(atomic64_t *v)
15856 */
15857 static inline void atomic64_dec(atomic64_t *v)
15858 {
15859 - asm volatile(LOCK_PREFIX "decq %0"
15860 + asm volatile(LOCK_PREFIX "decq %0\n"
15861 +
15862 +#ifdef CONFIG_PAX_REFCOUNT
15863 + "jno 0f\n"
15864 + LOCK_PREFIX "incq %0\n"
15865 + "int $4\n0:\n"
15866 + _ASM_EXTABLE(0b, 0b)
15867 +#endif
15868 +
15869 + : "=m" (v->counter)
15870 + : "m" (v->counter));
15871 +}
15872 +
15873 +/**
15874 + * atomic64_dec_unchecked - decrement atomic64 variable
15875 + * @v: pointer to type atomic64_t
15876 + *
15877 + * Atomically decrements @v by 1.
15878 + */
15879 +static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
15880 +{
15881 + asm volatile(LOCK_PREFIX "decq %0\n"
15882 : "=m" (v->counter)
15883 : "m" (v->counter));
15884 }
15885 @@ -111,7 +221,7 @@ static inline void atomic64_dec(atomic64_t *v)
15886 */
15887 static inline int atomic64_dec_and_test(atomic64_t *v)
15888 {
15889 - GEN_UNARY_RMWcc(LOCK_PREFIX "decq", v->counter, "%0", "e");
15890 + GEN_UNARY_RMWcc(LOCK_PREFIX "decq", LOCK_PREFIX "incq", v->counter, "%0", "e");
15891 }
15892
15893 /**
15894 @@ -124,7 +234,7 @@ static inline int atomic64_dec_and_test(atomic64_t *v)
15895 */
15896 static inline int atomic64_inc_and_test(atomic64_t *v)
15897 {
15898 - GEN_UNARY_RMWcc(LOCK_PREFIX "incq", v->counter, "%0", "e");
15899 + GEN_UNARY_RMWcc(LOCK_PREFIX "incq", LOCK_PREFIX "decq", v->counter, "%0", "e");
15900 }
15901
15902 /**
15903 @@ -138,7 +248,7 @@ static inline int atomic64_inc_and_test(atomic64_t *v)
15904 */
15905 static inline int atomic64_add_negative(long i, atomic64_t *v)
15906 {
15907 - GEN_BINARY_RMWcc(LOCK_PREFIX "addq", v->counter, "er", i, "%0", "s");
15908 + GEN_BINARY_RMWcc(LOCK_PREFIX "addq", LOCK_PREFIX "subq", v->counter, "er", i, "%0", "s");
15909 }
15910
15911 /**
15912 @@ -150,6 +260,18 @@ static inline int atomic64_add_negative(long i, atomic64_t *v)
15913 */
15914 static inline long atomic64_add_return(long i, atomic64_t *v)
15915 {
15916 + return i + xadd_check_overflow(&v->counter, i);
15917 +}
15918 +
15919 +/**
15920 + * atomic64_add_return_unchecked - add and return
15921 + * @i: integer value to add
15922 + * @v: pointer to type atomic64_unchecked_t
15923 + *
15924 + * Atomically adds @i to @v and returns @i + @v
15925 + */
15926 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
15927 +{
15928 return i + xadd(&v->counter, i);
15929 }
15930
15931 @@ -159,6 +281,10 @@ static inline long atomic64_sub_return(long i, atomic64_t *v)
15932 }
15933
15934 #define atomic64_inc_return(v) (atomic64_add_return(1, (v)))
15935 +static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
15936 +{
15937 + return atomic64_add_return_unchecked(1, v);
15938 +}
15939 #define atomic64_dec_return(v) (atomic64_sub_return(1, (v)))
15940
15941 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
15942 @@ -166,6 +292,11 @@ static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
15943 return cmpxchg(&v->counter, old, new);
15944 }
15945
15946 +static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
15947 +{
15948 + return cmpxchg(&v->counter, old, new);
15949 +}
15950 +
15951 static inline long atomic64_xchg(atomic64_t *v, long new)
15952 {
15953 return xchg(&v->counter, new);
15954 @@ -182,17 +313,30 @@ static inline long atomic64_xchg(atomic64_t *v, long new)
15955 */
15956 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
15957 {
15958 - long c, old;
15959 + long c, old, new;
15960 c = atomic64_read(v);
15961 for (;;) {
15962 - if (unlikely(c == (u)))
15963 + if (unlikely(c == u))
15964 break;
15965 - old = atomic64_cmpxchg((v), c, c + (a));
15966 +
15967 + asm volatile("add %2,%0\n"
15968 +
15969 +#ifdef CONFIG_PAX_REFCOUNT
15970 + "jno 0f\n"
15971 + "sub %2,%0\n"
15972 + "int $4\n0:\n"
15973 + _ASM_EXTABLE(0b, 0b)
15974 +#endif
15975 +
15976 + : "=r" (new)
15977 + : "0" (c), "ir" (a));
15978 +
15979 + old = atomic64_cmpxchg(v, c, new);
15980 if (likely(old == c))
15981 break;
15982 c = old;
15983 }
15984 - return c != (u);
15985 + return c != u;
15986 }
15987
15988 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
15989 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
15990 index 9fc1af7..fc71228 100644
15991 --- a/arch/x86/include/asm/bitops.h
15992 +++ b/arch/x86/include/asm/bitops.h
15993 @@ -49,7 +49,7 @@
15994 * a mask operation on a byte.
15995 */
15996 #define IS_IMMEDIATE(nr) (__builtin_constant_p(nr))
15997 -#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((void *)(addr) + ((nr)>>3))
15998 +#define CONST_MASK_ADDR(nr, addr) BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
15999 #define CONST_MASK(nr) (1 << ((nr) & 7))
16000
16001 /**
16002 @@ -205,7 +205,7 @@ static inline void change_bit(long nr, volatile unsigned long *addr)
16003 */
16004 static inline int test_and_set_bit(long nr, volatile unsigned long *addr)
16005 {
16006 - GEN_BINARY_RMWcc(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
16007 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "bts", *addr, "Ir", nr, "%0", "c");
16008 }
16009
16010 /**
16011 @@ -251,7 +251,7 @@ static inline int __test_and_set_bit(long nr, volatile unsigned long *addr)
16012 */
16013 static inline int test_and_clear_bit(long nr, volatile unsigned long *addr)
16014 {
16015 - GEN_BINARY_RMWcc(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
16016 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "btr", *addr, "Ir", nr, "%0", "c");
16017 }
16018
16019 /**
16020 @@ -304,7 +304,7 @@ static inline int __test_and_change_bit(long nr, volatile unsigned long *addr)
16021 */
16022 static inline int test_and_change_bit(long nr, volatile unsigned long *addr)
16023 {
16024 - GEN_BINARY_RMWcc(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
16025 + GEN_BINARY_RMWcc_unchecked(LOCK_PREFIX "btc", *addr, "Ir", nr, "%0", "c");
16026 }
16027
16028 static __always_inline int constant_test_bit(long nr, const volatile unsigned long *addr)
16029 @@ -345,7 +345,7 @@ static int test_bit(int nr, const volatile unsigned long *addr);
16030 *
16031 * Undefined if no bit exists, so code should check against 0 first.
16032 */
16033 -static inline unsigned long __ffs(unsigned long word)
16034 +static inline unsigned long __intentional_overflow(-1) __ffs(unsigned long word)
16035 {
16036 asm("rep; bsf %1,%0"
16037 : "=r" (word)
16038 @@ -359,7 +359,7 @@ static inline unsigned long __ffs(unsigned long word)
16039 *
16040 * Undefined if no zero exists, so code should check against ~0UL first.
16041 */
16042 -static inline unsigned long ffz(unsigned long word)
16043 +static inline unsigned long __intentional_overflow(-1) ffz(unsigned long word)
16044 {
16045 asm("rep; bsf %1,%0"
16046 : "=r" (word)
16047 @@ -373,7 +373,7 @@ static inline unsigned long ffz(unsigned long word)
16048 *
16049 * Undefined if no set bit exists, so code should check against 0 first.
16050 */
16051 -static inline unsigned long __fls(unsigned long word)
16052 +static inline unsigned long __intentional_overflow(-1) __fls(unsigned long word)
16053 {
16054 asm("bsr %1,%0"
16055 : "=r" (word)
16056 @@ -436,7 +436,7 @@ static inline int ffs(int x)
16057 * set bit if value is nonzero. The last (most significant) bit is
16058 * at position 32.
16059 */
16060 -static inline int fls(int x)
16061 +static inline int __intentional_overflow(-1) fls(int x)
16062 {
16063 int r;
16064
16065 @@ -478,7 +478,7 @@ static inline int fls(int x)
16066 * at position 64.
16067 */
16068 #ifdef CONFIG_X86_64
16069 -static __always_inline int fls64(__u64 x)
16070 +static __always_inline long fls64(__u64 x)
16071 {
16072 int bitpos = -1;
16073 /*
16074 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
16075 index 4fa687a..60f2d39 100644
16076 --- a/arch/x86/include/asm/boot.h
16077 +++ b/arch/x86/include/asm/boot.h
16078 @@ -6,10 +6,15 @@
16079 #include <uapi/asm/boot.h>
16080
16081 /* Physical address where kernel should be loaded. */
16082 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
16083 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
16084 + (CONFIG_PHYSICAL_ALIGN - 1)) \
16085 & ~(CONFIG_PHYSICAL_ALIGN - 1))
16086
16087 +#ifndef __ASSEMBLY__
16088 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
16089 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
16090 +#endif
16091 +
16092 /* Minimum kernel alignment, as a power of two */
16093 #ifdef CONFIG_X86_64
16094 #define MIN_KERNEL_ALIGN_LG2 PMD_SHIFT
16095 diff --git a/arch/x86/include/asm/cache.h b/arch/x86/include/asm/cache.h
16096 index 48f99f1..d78ebf9 100644
16097 --- a/arch/x86/include/asm/cache.h
16098 +++ b/arch/x86/include/asm/cache.h
16099 @@ -5,12 +5,13 @@
16100
16101 /* L1 cache line size */
16102 #define L1_CACHE_SHIFT (CONFIG_X86_L1_CACHE_SHIFT)
16103 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
16104 +#define L1_CACHE_BYTES (_AC(1,UL) << L1_CACHE_SHIFT)
16105
16106 #define __read_mostly __attribute__((__section__(".data..read_mostly")))
16107 +#define __read_only __attribute__((__section__(".data..read_only")))
16108
16109 #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
16110 -#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
16111 +#define INTERNODE_CACHE_BYTES (_AC(1,UL) << INTERNODE_CACHE_SHIFT)
16112
16113 #ifdef CONFIG_X86_VSMP
16114 #ifdef CONFIG_SMP
16115 diff --git a/arch/x86/include/asm/cacheflush.h b/arch/x86/include/asm/cacheflush.h
16116 index 9863ee3..4a1f8e1 100644
16117 --- a/arch/x86/include/asm/cacheflush.h
16118 +++ b/arch/x86/include/asm/cacheflush.h
16119 @@ -27,7 +27,7 @@ static inline unsigned long get_page_memtype(struct page *pg)
16120 unsigned long pg_flags = pg->flags & _PGMT_MASK;
16121
16122 if (pg_flags == _PGMT_DEFAULT)
16123 - return -1;
16124 + return ~0UL;
16125 else if (pg_flags == _PGMT_WC)
16126 return _PAGE_CACHE_WC;
16127 else if (pg_flags == _PGMT_UC_MINUS)
16128 diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
16129 index cb4c73b..c473c29 100644
16130 --- a/arch/x86/include/asm/calling.h
16131 +++ b/arch/x86/include/asm/calling.h
16132 @@ -82,103 +82,113 @@ For 32-bit we have the following conventions - kernel is built with
16133 #define RSP 152
16134 #define SS 160
16135
16136 -#define ARGOFFSET R11
16137 -#define SWFRAME ORIG_RAX
16138 +#define ARGOFFSET R15
16139
16140 .macro SAVE_ARGS addskip=0, save_rcx=1, save_r891011=1
16141 - subq $9*8+\addskip, %rsp
16142 - CFI_ADJUST_CFA_OFFSET 9*8+\addskip
16143 - movq_cfi rdi, 8*8
16144 - movq_cfi rsi, 7*8
16145 - movq_cfi rdx, 6*8
16146 + subq $ORIG_RAX-ARGOFFSET+\addskip, %rsp
16147 + CFI_ADJUST_CFA_OFFSET ORIG_RAX-ARGOFFSET+\addskip
16148 + movq_cfi rdi, RDI
16149 + movq_cfi rsi, RSI
16150 + movq_cfi rdx, RDX
16151
16152 .if \save_rcx
16153 - movq_cfi rcx, 5*8
16154 + movq_cfi rcx, RCX
16155 .endif
16156
16157 - movq_cfi rax, 4*8
16158 + movq_cfi rax, RAX
16159
16160 .if \save_r891011
16161 - movq_cfi r8, 3*8
16162 - movq_cfi r9, 2*8
16163 - movq_cfi r10, 1*8
16164 - movq_cfi r11, 0*8
16165 + movq_cfi r8, R8
16166 + movq_cfi r9, R9
16167 + movq_cfi r10, R10
16168 + movq_cfi r11, R11
16169 .endif
16170
16171 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16172 + movq_cfi r12, R12
16173 +#endif
16174 +
16175 .endm
16176
16177 -#define ARG_SKIP (9*8)
16178 +#define ARG_SKIP ORIG_RAX
16179
16180 .macro RESTORE_ARGS rstor_rax=1, addskip=0, rstor_rcx=1, rstor_r11=1, \
16181 rstor_r8910=1, rstor_rdx=1
16182 +
16183 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16184 + movq_cfi_restore R12, r12
16185 +#endif
16186 +
16187 .if \rstor_r11
16188 - movq_cfi_restore 0*8, r11
16189 + movq_cfi_restore R11, r11
16190 .endif
16191
16192 .if \rstor_r8910
16193 - movq_cfi_restore 1*8, r10
16194 - movq_cfi_restore 2*8, r9
16195 - movq_cfi_restore 3*8, r8
16196 + movq_cfi_restore R10, r10
16197 + movq_cfi_restore R9, r9
16198 + movq_cfi_restore R8, r8
16199 .endif
16200
16201 .if \rstor_rax
16202 - movq_cfi_restore 4*8, rax
16203 + movq_cfi_restore RAX, rax
16204 .endif
16205
16206 .if \rstor_rcx
16207 - movq_cfi_restore 5*8, rcx
16208 + movq_cfi_restore RCX, rcx
16209 .endif
16210
16211 .if \rstor_rdx
16212 - movq_cfi_restore 6*8, rdx
16213 + movq_cfi_restore RDX, rdx
16214 .endif
16215
16216 - movq_cfi_restore 7*8, rsi
16217 - movq_cfi_restore 8*8, rdi
16218 + movq_cfi_restore RSI, rsi
16219 + movq_cfi_restore RDI, rdi
16220
16221 - .if ARG_SKIP+\addskip > 0
16222 - addq $ARG_SKIP+\addskip, %rsp
16223 - CFI_ADJUST_CFA_OFFSET -(ARG_SKIP+\addskip)
16224 + .if ORIG_RAX+\addskip > 0
16225 + addq $ORIG_RAX+\addskip, %rsp
16226 + CFI_ADJUST_CFA_OFFSET -(ORIG_RAX+\addskip)
16227 .endif
16228 .endm
16229
16230 - .macro LOAD_ARGS offset, skiprax=0
16231 - movq \offset(%rsp), %r11
16232 - movq \offset+8(%rsp), %r10
16233 - movq \offset+16(%rsp), %r9
16234 - movq \offset+24(%rsp), %r8
16235 - movq \offset+40(%rsp), %rcx
16236 - movq \offset+48(%rsp), %rdx
16237 - movq \offset+56(%rsp), %rsi
16238 - movq \offset+64(%rsp), %rdi
16239 + .macro LOAD_ARGS skiprax=0
16240 + movq R11(%rsp), %r11
16241 + movq R10(%rsp), %r10
16242 + movq R9(%rsp), %r9
16243 + movq R8(%rsp), %r8
16244 + movq RCX(%rsp), %rcx
16245 + movq RDX(%rsp), %rdx
16246 + movq RSI(%rsp), %rsi
16247 + movq RDI(%rsp), %rdi
16248 .if \skiprax
16249 .else
16250 - movq \offset+72(%rsp), %rax
16251 + movq RAX(%rsp), %rax
16252 .endif
16253 .endm
16254
16255 -#define REST_SKIP (6*8)
16256 -
16257 .macro SAVE_REST
16258 - subq $REST_SKIP, %rsp
16259 - CFI_ADJUST_CFA_OFFSET REST_SKIP
16260 - movq_cfi rbx, 5*8
16261 - movq_cfi rbp, 4*8
16262 - movq_cfi r12, 3*8
16263 - movq_cfi r13, 2*8
16264 - movq_cfi r14, 1*8
16265 - movq_cfi r15, 0*8
16266 + movq_cfi rbx, RBX
16267 + movq_cfi rbp, RBP
16268 +
16269 +#ifndef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16270 + movq_cfi r12, R12
16271 +#endif
16272 +
16273 + movq_cfi r13, R13
16274 + movq_cfi r14, R14
16275 + movq_cfi r15, R15
16276 .endm
16277
16278 .macro RESTORE_REST
16279 - movq_cfi_restore 0*8, r15
16280 - movq_cfi_restore 1*8, r14
16281 - movq_cfi_restore 2*8, r13
16282 - movq_cfi_restore 3*8, r12
16283 - movq_cfi_restore 4*8, rbp
16284 - movq_cfi_restore 5*8, rbx
16285 - addq $REST_SKIP, %rsp
16286 - CFI_ADJUST_CFA_OFFSET -(REST_SKIP)
16287 + movq_cfi_restore R15, r15
16288 + movq_cfi_restore R14, r14
16289 + movq_cfi_restore R13, r13
16290 +
16291 +#ifndef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
16292 + movq_cfi_restore R12, r12
16293 +#endif
16294 +
16295 + movq_cfi_restore RBP, rbp
16296 + movq_cfi_restore RBX, rbx
16297 .endm
16298
16299 .macro SAVE_ALL
16300 diff --git a/arch/x86/include/asm/checksum_32.h b/arch/x86/include/asm/checksum_32.h
16301 index f50de69..2b0a458 100644
16302 --- a/arch/x86/include/asm/checksum_32.h
16303 +++ b/arch/x86/include/asm/checksum_32.h
16304 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_generic(const void *src, void *dst,
16305 int len, __wsum sum,
16306 int *src_err_ptr, int *dst_err_ptr);
16307
16308 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
16309 + int len, __wsum sum,
16310 + int *src_err_ptr, int *dst_err_ptr);
16311 +
16312 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
16313 + int len, __wsum sum,
16314 + int *src_err_ptr, int *dst_err_ptr);
16315 +
16316 /*
16317 * Note: when you get a NULL pointer exception here this means someone
16318 * passed in an incorrect kernel address to one of these functions.
16319 @@ -53,7 +61,7 @@ static inline __wsum csum_partial_copy_from_user(const void __user *src,
16320
16321 might_sleep();
16322 stac();
16323 - ret = csum_partial_copy_generic((__force void *)src, dst,
16324 + ret = csum_partial_copy_generic_from_user((__force void *)src, dst,
16325 len, sum, err_ptr, NULL);
16326 clac();
16327
16328 @@ -187,7 +195,7 @@ static inline __wsum csum_and_copy_to_user(const void *src,
16329 might_sleep();
16330 if (access_ok(VERIFY_WRITE, dst, len)) {
16331 stac();
16332 - ret = csum_partial_copy_generic(src, (__force void *)dst,
16333 + ret = csum_partial_copy_generic_to_user(src, (__force void *)dst,
16334 len, sum, NULL, err_ptr);
16335 clac();
16336 return ret;
16337 diff --git a/arch/x86/include/asm/cmpxchg.h b/arch/x86/include/asm/cmpxchg.h
16338 index d47786a..2d8883e 100644
16339 --- a/arch/x86/include/asm/cmpxchg.h
16340 +++ b/arch/x86/include/asm/cmpxchg.h
16341 @@ -14,8 +14,12 @@ extern void __cmpxchg_wrong_size(void)
16342 __compiletime_error("Bad argument size for cmpxchg");
16343 extern void __xadd_wrong_size(void)
16344 __compiletime_error("Bad argument size for xadd");
16345 +extern void __xadd_check_overflow_wrong_size(void)
16346 + __compiletime_error("Bad argument size for xadd_check_overflow");
16347 extern void __add_wrong_size(void)
16348 __compiletime_error("Bad argument size for add");
16349 +extern void __add_check_overflow_wrong_size(void)
16350 + __compiletime_error("Bad argument size for add_check_overflow");
16351
16352 /*
16353 * Constants for operation sizes. On 32-bit, the 64-bit size it set to
16354 @@ -67,6 +71,38 @@ extern void __add_wrong_size(void)
16355 __ret; \
16356 })
16357
16358 +#ifdef CONFIG_PAX_REFCOUNT
16359 +#define __xchg_op_check_overflow(ptr, arg, op, lock) \
16360 + ({ \
16361 + __typeof__ (*(ptr)) __ret = (arg); \
16362 + switch (sizeof(*(ptr))) { \
16363 + case __X86_CASE_L: \
16364 + asm volatile (lock #op "l %0, %1\n" \
16365 + "jno 0f\n" \
16366 + "mov %0,%1\n" \
16367 + "int $4\n0:\n" \
16368 + _ASM_EXTABLE(0b, 0b) \
16369 + : "+r" (__ret), "+m" (*(ptr)) \
16370 + : : "memory", "cc"); \
16371 + break; \
16372 + case __X86_CASE_Q: \
16373 + asm volatile (lock #op "q %q0, %1\n" \
16374 + "jno 0f\n" \
16375 + "mov %0,%1\n" \
16376 + "int $4\n0:\n" \
16377 + _ASM_EXTABLE(0b, 0b) \
16378 + : "+r" (__ret), "+m" (*(ptr)) \
16379 + : : "memory", "cc"); \
16380 + break; \
16381 + default: \
16382 + __ ## op ## _check_overflow_wrong_size(); \
16383 + } \
16384 + __ret; \
16385 + })
16386 +#else
16387 +#define __xchg_op_check_overflow(ptr, arg, op, lock) __xchg_op(ptr, arg, op, lock)
16388 +#endif
16389 +
16390 /*
16391 * Note: no "lock" prefix even on SMP: xchg always implies lock anyway.
16392 * Since this is generally used to protect other memory information, we
16393 @@ -167,6 +203,9 @@ extern void __add_wrong_size(void)
16394 #define xadd_sync(ptr, inc) __xadd((ptr), (inc), "lock; ")
16395 #define xadd_local(ptr, inc) __xadd((ptr), (inc), "")
16396
16397 +#define __xadd_check_overflow(ptr, inc, lock) __xchg_op_check_overflow((ptr), (inc), xadd, lock)
16398 +#define xadd_check_overflow(ptr, inc) __xadd_check_overflow((ptr), (inc), LOCK_PREFIX)
16399 +
16400 #define __add(ptr, inc, lock) \
16401 ({ \
16402 __typeof__ (*(ptr)) __ret = (inc); \
16403 diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
16404 index 59c6c40..5e0b22c 100644
16405 --- a/arch/x86/include/asm/compat.h
16406 +++ b/arch/x86/include/asm/compat.h
16407 @@ -41,7 +41,7 @@ typedef s64 __attribute__((aligned(4))) compat_s64;
16408 typedef u32 compat_uint_t;
16409 typedef u32 compat_ulong_t;
16410 typedef u64 __attribute__((aligned(4))) compat_u64;
16411 -typedef u32 compat_uptr_t;
16412 +typedef u32 __user compat_uptr_t;
16413
16414 struct compat_timespec {
16415 compat_time_t tv_sec;
16416 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
16417 index 5f12968..a383517 100644
16418 --- a/arch/x86/include/asm/cpufeature.h
16419 +++ b/arch/x86/include/asm/cpufeature.h
16420 @@ -203,7 +203,7 @@
16421 #define X86_FEATURE_DECODEASSISTS (8*32+12) /* AMD Decode Assists support */
16422 #define X86_FEATURE_PAUSEFILTER (8*32+13) /* AMD filtered pause intercept */
16423 #define X86_FEATURE_PFTHRESHOLD (8*32+14) /* AMD pause filter threshold */
16424 -
16425 +#define X86_FEATURE_STRONGUDEREF (8*32+31) /* PaX PCID based strong UDEREF */
16426
16427 /* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
16428 #define X86_FEATURE_FSGSBASE (9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
16429 @@ -211,7 +211,7 @@
16430 #define X86_FEATURE_BMI1 (9*32+ 3) /* 1st group bit manipulation extensions */
16431 #define X86_FEATURE_HLE (9*32+ 4) /* Hardware Lock Elision */
16432 #define X86_FEATURE_AVX2 (9*32+ 5) /* AVX2 instructions */
16433 -#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Protection */
16434 +#define X86_FEATURE_SMEP (9*32+ 7) /* Supervisor Mode Execution Prevention */
16435 #define X86_FEATURE_BMI2 (9*32+ 8) /* 2nd group bit manipulation extensions */
16436 #define X86_FEATURE_ERMS (9*32+ 9) /* Enhanced REP MOVSB/STOSB */
16437 #define X86_FEATURE_INVPCID (9*32+10) /* Invalidate Processor Context ID */
16438 @@ -358,6 +358,7 @@ extern const char * const x86_power_flags[32];
16439 #undef cpu_has_centaur_mcr
16440 #define cpu_has_centaur_mcr 0
16441
16442 +#define cpu_has_pcid boot_cpu_has(X86_FEATURE_PCID)
16443 #endif /* CONFIG_X86_64 */
16444
16445 #if __GNUC__ >= 4
16446 @@ -410,7 +411,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
16447
16448 #ifdef CONFIG_X86_DEBUG_STATIC_CPU_HAS
16449 t_warn:
16450 - warn_pre_alternatives();
16451 + if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID)
16452 + warn_pre_alternatives();
16453 return false;
16454 #endif
16455
16456 @@ -430,7 +432,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
16457 ".section .discard,\"aw\",@progbits\n"
16458 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
16459 ".previous\n"
16460 - ".section .altinstr_replacement,\"ax\"\n"
16461 + ".section .altinstr_replacement,\"a\"\n"
16462 "3: movb $1,%0\n"
16463 "4:\n"
16464 ".previous\n"
16465 @@ -467,7 +469,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16466 " .byte 2b - 1b\n" /* src len */
16467 " .byte 4f - 3f\n" /* repl len */
16468 ".previous\n"
16469 - ".section .altinstr_replacement,\"ax\"\n"
16470 + ".section .altinstr_replacement,\"a\"\n"
16471 "3: .byte 0xe9\n .long %l[t_no] - 2b\n"
16472 "4:\n"
16473 ".previous\n"
16474 @@ -500,7 +502,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16475 ".section .discard,\"aw\",@progbits\n"
16476 " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
16477 ".previous\n"
16478 - ".section .altinstr_replacement,\"ax\"\n"
16479 + ".section .altinstr_replacement,\"a\"\n"
16480 "3: movb $0,%0\n"
16481 "4:\n"
16482 ".previous\n"
16483 @@ -514,7 +516,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
16484 ".section .discard,\"aw\",@progbits\n"
16485 " .byte 0xff + (6f-5f) - (4b-3b)\n" /* size check */
16486 ".previous\n"
16487 - ".section .altinstr_replacement,\"ax\"\n"
16488 + ".section .altinstr_replacement,\"a\"\n"
16489 "5: movb $1,%0\n"
16490 "6:\n"
16491 ".previous\n"
16492 diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
16493 index 50d033a..37deb26 100644
16494 --- a/arch/x86/include/asm/desc.h
16495 +++ b/arch/x86/include/asm/desc.h
16496 @@ -4,6 +4,7 @@
16497 #include <asm/desc_defs.h>
16498 #include <asm/ldt.h>
16499 #include <asm/mmu.h>
16500 +#include <asm/pgtable.h>
16501
16502 #include <linux/smp.h>
16503 #include <linux/percpu.h>
16504 @@ -17,6 +18,7 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
16505
16506 desc->type = (info->read_exec_only ^ 1) << 1;
16507 desc->type |= info->contents << 2;
16508 + desc->type |= info->seg_not_present ^ 1;
16509
16510 desc->s = 1;
16511 desc->dpl = 0x3;
16512 @@ -35,19 +37,14 @@ static inline void fill_ldt(struct desc_struct *desc, const struct user_desc *in
16513 }
16514
16515 extern struct desc_ptr idt_descr;
16516 -extern gate_desc idt_table[];
16517 -extern struct desc_ptr debug_idt_descr;
16518 -extern gate_desc debug_idt_table[];
16519 -
16520 -struct gdt_page {
16521 - struct desc_struct gdt[GDT_ENTRIES];
16522 -} __attribute__((aligned(PAGE_SIZE)));
16523 -
16524 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
16525 +extern gate_desc idt_table[IDT_ENTRIES];
16526 +extern const struct desc_ptr debug_idt_descr;
16527 +extern gate_desc debug_idt_table[IDT_ENTRIES];
16528
16529 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
16530 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
16531 {
16532 - return per_cpu(gdt_page, cpu).gdt;
16533 + return cpu_gdt_table[cpu];
16534 }
16535
16536 #ifdef CONFIG_X86_64
16537 @@ -72,8 +69,14 @@ static inline void pack_gate(gate_desc *gate, unsigned char type,
16538 unsigned long base, unsigned dpl, unsigned flags,
16539 unsigned short seg)
16540 {
16541 - gate->a = (seg << 16) | (base & 0xffff);
16542 - gate->b = (base & 0xffff0000) | (((0x80 | type | (dpl << 5)) & 0xff) << 8);
16543 + gate->gate.offset_low = base;
16544 + gate->gate.seg = seg;
16545 + gate->gate.reserved = 0;
16546 + gate->gate.type = type;
16547 + gate->gate.s = 0;
16548 + gate->gate.dpl = dpl;
16549 + gate->gate.p = 1;
16550 + gate->gate.offset_high = base >> 16;
16551 }
16552
16553 #endif
16554 @@ -118,12 +121,16 @@ static inline void paravirt_free_ldt(struct desc_struct *ldt, unsigned entries)
16555
16556 static inline void native_write_idt_entry(gate_desc *idt, int entry, const gate_desc *gate)
16557 {
16558 + pax_open_kernel();
16559 memcpy(&idt[entry], gate, sizeof(*gate));
16560 + pax_close_kernel();
16561 }
16562
16563 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry, const void *desc)
16564 {
16565 + pax_open_kernel();
16566 memcpy(&ldt[entry], desc, 8);
16567 + pax_close_kernel();
16568 }
16569
16570 static inline void
16571 @@ -137,7 +144,9 @@ native_write_gdt_entry(struct desc_struct *gdt, int entry, const void *desc, int
16572 default: size = sizeof(*gdt); break;
16573 }
16574
16575 + pax_open_kernel();
16576 memcpy(&gdt[entry], desc, size);
16577 + pax_close_kernel();
16578 }
16579
16580 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
16581 @@ -210,7 +219,9 @@ static inline void native_set_ldt(const void *addr, unsigned int entries)
16582
16583 static inline void native_load_tr_desc(void)
16584 {
16585 + pax_open_kernel();
16586 asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
16587 + pax_close_kernel();
16588 }
16589
16590 static inline void native_load_gdt(const struct desc_ptr *dtr)
16591 @@ -247,8 +258,10 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
16592 struct desc_struct *gdt = get_cpu_gdt_table(cpu);
16593 unsigned int i;
16594
16595 + pax_open_kernel();
16596 for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
16597 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
16598 + pax_close_kernel();
16599 }
16600
16601 #define _LDT_empty(info) \
16602 @@ -287,7 +300,7 @@ static inline void load_LDT(mm_context_t *pc)
16603 preempt_enable();
16604 }
16605
16606 -static inline unsigned long get_desc_base(const struct desc_struct *desc)
16607 +static inline unsigned long __intentional_overflow(-1) get_desc_base(const struct desc_struct *desc)
16608 {
16609 return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
16610 }
16611 @@ -311,7 +324,7 @@ static inline void set_desc_limit(struct desc_struct *desc, unsigned long limit)
16612 }
16613
16614 #ifdef CONFIG_X86_64
16615 -static inline void set_nmi_gate(int gate, void *addr)
16616 +static inline void set_nmi_gate(int gate, const void *addr)
16617 {
16618 gate_desc s;
16619
16620 @@ -321,14 +334,14 @@ static inline void set_nmi_gate(int gate, void *addr)
16621 #endif
16622
16623 #ifdef CONFIG_TRACING
16624 -extern struct desc_ptr trace_idt_descr;
16625 -extern gate_desc trace_idt_table[];
16626 +extern const struct desc_ptr trace_idt_descr;
16627 +extern gate_desc trace_idt_table[IDT_ENTRIES];
16628 static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
16629 {
16630 write_idt_entry(trace_idt_table, entry, gate);
16631 }
16632
16633 -static inline void _trace_set_gate(int gate, unsigned type, void *addr,
16634 +static inline void _trace_set_gate(int gate, unsigned type, const void *addr,
16635 unsigned dpl, unsigned ist, unsigned seg)
16636 {
16637 gate_desc s;
16638 @@ -348,7 +361,7 @@ static inline void write_trace_idt_entry(int entry, const gate_desc *gate)
16639 #define _trace_set_gate(gate, type, addr, dpl, ist, seg)
16640 #endif
16641
16642 -static inline void _set_gate(int gate, unsigned type, void *addr,
16643 +static inline void _set_gate(int gate, unsigned type, const void *addr,
16644 unsigned dpl, unsigned ist, unsigned seg)
16645 {
16646 gate_desc s;
16647 @@ -371,9 +384,9 @@ static inline void _set_gate(int gate, unsigned type, void *addr,
16648 #define set_intr_gate(n, addr) \
16649 do { \
16650 BUG_ON((unsigned)n > 0xFF); \
16651 - _set_gate(n, GATE_INTERRUPT, (void *)addr, 0, 0, \
16652 + _set_gate(n, GATE_INTERRUPT, (const void *)addr, 0, 0, \
16653 __KERNEL_CS); \
16654 - _trace_set_gate(n, GATE_INTERRUPT, (void *)trace_##addr,\
16655 + _trace_set_gate(n, GATE_INTERRUPT, (const void *)trace_##addr,\
16656 0, 0, __KERNEL_CS); \
16657 } while (0)
16658
16659 @@ -401,19 +414,19 @@ static inline void alloc_system_vector(int vector)
16660 /*
16661 * This routine sets up an interrupt gate at directory privilege level 3.
16662 */
16663 -static inline void set_system_intr_gate(unsigned int n, void *addr)
16664 +static inline void set_system_intr_gate(unsigned int n, const void *addr)
16665 {
16666 BUG_ON((unsigned)n > 0xFF);
16667 _set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
16668 }
16669
16670 -static inline void set_system_trap_gate(unsigned int n, void *addr)
16671 +static inline void set_system_trap_gate(unsigned int n, const void *addr)
16672 {
16673 BUG_ON((unsigned)n > 0xFF);
16674 _set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
16675 }
16676
16677 -static inline void set_trap_gate(unsigned int n, void *addr)
16678 +static inline void set_trap_gate(unsigned int n, const void *addr)
16679 {
16680 BUG_ON((unsigned)n > 0xFF);
16681 _set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
16682 @@ -422,16 +435,16 @@ static inline void set_trap_gate(unsigned int n, void *addr)
16683 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
16684 {
16685 BUG_ON((unsigned)n > 0xFF);
16686 - _set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
16687 + _set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
16688 }
16689
16690 -static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
16691 +static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
16692 {
16693 BUG_ON((unsigned)n > 0xFF);
16694 _set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
16695 }
16696
16697 -static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
16698 +static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
16699 {
16700 BUG_ON((unsigned)n > 0xFF);
16701 _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
16702 @@ -503,4 +516,17 @@ static inline void load_current_idt(void)
16703 else
16704 load_idt((const struct desc_ptr *)&idt_descr);
16705 }
16706 +
16707 +#ifdef CONFIG_X86_32
16708 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
16709 +{
16710 + struct desc_struct d;
16711 +
16712 + if (likely(limit))
16713 + limit = (limit - 1UL) >> PAGE_SHIFT;
16714 + pack_descriptor(&d, base, limit, 0xFB, 0xC);
16715 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
16716 +}
16717 +#endif
16718 +
16719 #endif /* _ASM_X86_DESC_H */
16720 diff --git a/arch/x86/include/asm/desc_defs.h b/arch/x86/include/asm/desc_defs.h
16721 index 278441f..b95a174 100644
16722 --- a/arch/x86/include/asm/desc_defs.h
16723 +++ b/arch/x86/include/asm/desc_defs.h
16724 @@ -31,6 +31,12 @@ struct desc_struct {
16725 unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
16726 unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
16727 };
16728 + struct {
16729 + u16 offset_low;
16730 + u16 seg;
16731 + unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
16732 + unsigned offset_high: 16;
16733 + } gate;
16734 };
16735 } __attribute__((packed));
16736
16737 diff --git a/arch/x86/include/asm/div64.h b/arch/x86/include/asm/div64.h
16738 index ced283a..ffe04cc 100644
16739 --- a/arch/x86/include/asm/div64.h
16740 +++ b/arch/x86/include/asm/div64.h
16741 @@ -39,7 +39,7 @@
16742 __mod; \
16743 })
16744
16745 -static inline u64 div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
16746 +static inline u64 __intentional_overflow(-1) div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
16747 {
16748 union {
16749 u64 v64;
16750 diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
16751 index 9c999c1..3860cb8 100644
16752 --- a/arch/x86/include/asm/elf.h
16753 +++ b/arch/x86/include/asm/elf.h
16754 @@ -243,7 +243,25 @@ extern int force_personality32;
16755 the loader. We need to make sure that it is out of the way of the program
16756 that it will "exec", and that there is sufficient room for the brk. */
16757
16758 +#ifdef CONFIG_PAX_SEGMEXEC
16759 +#define ELF_ET_DYN_BASE ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
16760 +#else
16761 #define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
16762 +#endif
16763 +
16764 +#ifdef CONFIG_PAX_ASLR
16765 +#ifdef CONFIG_X86_32
16766 +#define PAX_ELF_ET_DYN_BASE 0x10000000UL
16767 +
16768 +#define PAX_DELTA_MMAP_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
16769 +#define PAX_DELTA_STACK_LEN (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
16770 +#else
16771 +#define PAX_ELF_ET_DYN_BASE 0x400000UL
16772 +
16773 +#define PAX_DELTA_MMAP_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
16774 +#define PAX_DELTA_STACK_LEN ((test_thread_flag(TIF_ADDR32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
16775 +#endif
16776 +#endif
16777
16778 /* This yields a mask that user programs can use to figure out what
16779 instruction set this CPU supports. This could be done in user space,
16780 @@ -296,16 +314,12 @@ do { \
16781
16782 #define ARCH_DLINFO \
16783 do { \
16784 - if (vdso_enabled) \
16785 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
16786 - (unsigned long)current->mm->context.vdso); \
16787 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
16788 } while (0)
16789
16790 #define ARCH_DLINFO_X32 \
16791 do { \
16792 - if (vdso_enabled) \
16793 - NEW_AUX_ENT(AT_SYSINFO_EHDR, \
16794 - (unsigned long)current->mm->context.vdso); \
16795 + NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso); \
16796 } while (0)
16797
16798 #define AT_SYSINFO 32
16799 @@ -320,7 +334,7 @@ else \
16800
16801 #endif /* !CONFIG_X86_32 */
16802
16803 -#define VDSO_CURRENT_BASE ((unsigned long)current->mm->context.vdso)
16804 +#define VDSO_CURRENT_BASE (current->mm->context.vdso)
16805
16806 #define VDSO_ENTRY \
16807 ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
16808 @@ -336,9 +350,6 @@ extern int x32_setup_additional_pages(struct linux_binprm *bprm,
16809 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
16810 #define compat_arch_setup_additional_pages syscall32_setup_pages
16811
16812 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
16813 -#define arch_randomize_brk arch_randomize_brk
16814 -
16815 /*
16816 * True on X86_32 or when emulating IA32 on X86_64
16817 */
16818 diff --git a/arch/x86/include/asm/emergency-restart.h b/arch/x86/include/asm/emergency-restart.h
16819 index 77a99ac..39ff7f5 100644
16820 --- a/arch/x86/include/asm/emergency-restart.h
16821 +++ b/arch/x86/include/asm/emergency-restart.h
16822 @@ -1,6 +1,6 @@
16823 #ifndef _ASM_X86_EMERGENCY_RESTART_H
16824 #define _ASM_X86_EMERGENCY_RESTART_H
16825
16826 -extern void machine_emergency_restart(void);
16827 +extern void machine_emergency_restart(void) __noreturn;
16828
16829 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
16830 diff --git a/arch/x86/include/asm/floppy.h b/arch/x86/include/asm/floppy.h
16831 index d3d7469..677ef72 100644
16832 --- a/arch/x86/include/asm/floppy.h
16833 +++ b/arch/x86/include/asm/floppy.h
16834 @@ -229,18 +229,18 @@ static struct fd_routine_l {
16835 int (*_dma_setup)(char *addr, unsigned long size, int mode, int io);
16836 } fd_routine[] = {
16837 {
16838 - request_dma,
16839 - free_dma,
16840 - get_dma_residue,
16841 - dma_mem_alloc,
16842 - hard_dma_setup
16843 + ._request_dma = request_dma,
16844 + ._free_dma = free_dma,
16845 + ._get_dma_residue = get_dma_residue,
16846 + ._dma_mem_alloc = dma_mem_alloc,
16847 + ._dma_setup = hard_dma_setup
16848 },
16849 {
16850 - vdma_request_dma,
16851 - vdma_nop,
16852 - vdma_get_dma_residue,
16853 - vdma_mem_alloc,
16854 - vdma_dma_setup
16855 + ._request_dma = vdma_request_dma,
16856 + ._free_dma = vdma_nop,
16857 + ._get_dma_residue = vdma_get_dma_residue,
16858 + ._dma_mem_alloc = vdma_mem_alloc,
16859 + ._dma_setup = vdma_dma_setup
16860 }
16861 };
16862
16863 diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
16864 index cea1c76..6c0d79b 100644
16865 --- a/arch/x86/include/asm/fpu-internal.h
16866 +++ b/arch/x86/include/asm/fpu-internal.h
16867 @@ -124,8 +124,11 @@ static inline void sanitize_i387_state(struct task_struct *tsk)
16868 #define user_insn(insn, output, input...) \
16869 ({ \
16870 int err; \
16871 + pax_open_userland(); \
16872 asm volatile(ASM_STAC "\n" \
16873 - "1:" #insn "\n\t" \
16874 + "1:" \
16875 + __copyuser_seg \
16876 + #insn "\n\t" \
16877 "2: " ASM_CLAC "\n" \
16878 ".section .fixup,\"ax\"\n" \
16879 "3: movl $-1,%[err]\n" \
16880 @@ -134,6 +137,7 @@ static inline void sanitize_i387_state(struct task_struct *tsk)
16881 _ASM_EXTABLE(1b, 3b) \
16882 : [err] "=r" (err), output \
16883 : "0"(0), input); \
16884 + pax_close_userland(); \
16885 err; \
16886 })
16887
16888 @@ -298,7 +302,7 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
16889 "fnclex\n\t"
16890 "emms\n\t"
16891 "fildl %P[addr]" /* set F?P to defined value */
16892 - : : [addr] "m" (tsk->thread.fpu.has_fpu));
16893 + : : [addr] "m" (init_tss[raw_smp_processor_id()].x86_tss.sp0));
16894 }
16895
16896 return fpu_restore_checking(&tsk->thread.fpu);
16897 diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
16898 index b4c1f54..e290c08 100644
16899 --- a/arch/x86/include/asm/futex.h
16900 +++ b/arch/x86/include/asm/futex.h
16901 @@ -12,6 +12,7 @@
16902 #include <asm/smap.h>
16903
16904 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \
16905 + typecheck(u32 __user *, uaddr); \
16906 asm volatile("\t" ASM_STAC "\n" \
16907 "1:\t" insn "\n" \
16908 "2:\t" ASM_CLAC "\n" \
16909 @@ -20,15 +21,16 @@
16910 "\tjmp\t2b\n" \
16911 "\t.previous\n" \
16912 _ASM_EXTABLE(1b, 3b) \
16913 - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
16914 + : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr)) \
16915 : "i" (-EFAULT), "0" (oparg), "1" (0))
16916
16917 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \
16918 + typecheck(u32 __user *, uaddr); \
16919 asm volatile("\t" ASM_STAC "\n" \
16920 "1:\tmovl %2, %0\n" \
16921 "\tmovl\t%0, %3\n" \
16922 "\t" insn "\n" \
16923 - "2:\t" LOCK_PREFIX "cmpxchgl %3, %2\n" \
16924 + "2:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %2\n" \
16925 "\tjnz\t1b\n" \
16926 "3:\t" ASM_CLAC "\n" \
16927 "\t.section .fixup,\"ax\"\n" \
16928 @@ -38,7 +40,7 @@
16929 _ASM_EXTABLE(1b, 4b) \
16930 _ASM_EXTABLE(2b, 4b) \
16931 : "=&a" (oldval), "=&r" (ret), \
16932 - "+m" (*uaddr), "=&r" (tem) \
16933 + "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \
16934 : "r" (oparg), "i" (-EFAULT), "1" (0))
16935
16936 static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
16937 @@ -57,12 +59,13 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
16938
16939 pagefault_disable();
16940
16941 + pax_open_userland();
16942 switch (op) {
16943 case FUTEX_OP_SET:
16944 - __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
16945 + __futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
16946 break;
16947 case FUTEX_OP_ADD:
16948 - __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
16949 + __futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
16950 uaddr, oparg);
16951 break;
16952 case FUTEX_OP_OR:
16953 @@ -77,6 +80,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
16954 default:
16955 ret = -ENOSYS;
16956 }
16957 + pax_close_userland();
16958
16959 pagefault_enable();
16960
16961 diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
16962 index a809121..68c0539 100644
16963 --- a/arch/x86/include/asm/hugetlb.h
16964 +++ b/arch/x86/include/asm/hugetlb.h
16965 @@ -52,6 +52,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
16966 static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
16967 unsigned long addr, pte_t *ptep)
16968 {
16969 + ptep_clear_flush(vma, addr, ptep);
16970 }
16971
16972 static inline int huge_pte_none(pte_t pte)
16973 diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
16974 index 67d69b8..50e4b77 100644
16975 --- a/arch/x86/include/asm/hw_irq.h
16976 +++ b/arch/x86/include/asm/hw_irq.h
16977 @@ -165,8 +165,8 @@ extern void setup_ioapic_dest(void);
16978 extern void enable_IO_APIC(void);
16979
16980 /* Statistics */
16981 -extern atomic_t irq_err_count;
16982 -extern atomic_t irq_mis_count;
16983 +extern atomic_unchecked_t irq_err_count;
16984 +extern atomic_unchecked_t irq_mis_count;
16985
16986 /* EISA */
16987 extern void eisa_set_level_irq(unsigned int irq);
16988 diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h
16989 index a203659..9889f1c 100644
16990 --- a/arch/x86/include/asm/i8259.h
16991 +++ b/arch/x86/include/asm/i8259.h
16992 @@ -62,7 +62,7 @@ struct legacy_pic {
16993 void (*init)(int auto_eoi);
16994 int (*irq_pending)(unsigned int irq);
16995 void (*make_irq)(unsigned int irq);
16996 -};
16997 +} __do_const;
16998
16999 extern struct legacy_pic *legacy_pic;
17000 extern struct legacy_pic null_legacy_pic;
17001 diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
17002 index 91d9c69..dfae7d0 100644
17003 --- a/arch/x86/include/asm/io.h
17004 +++ b/arch/x86/include/asm/io.h
17005 @@ -51,12 +51,12 @@ static inline void name(type val, volatile void __iomem *addr) \
17006 "m" (*(volatile type __force *)addr) barrier); }
17007
17008 build_mmio_read(readb, "b", unsigned char, "=q", :"memory")
17009 -build_mmio_read(readw, "w", unsigned short, "=r", :"memory")
17010 -build_mmio_read(readl, "l", unsigned int, "=r", :"memory")
17011 +build_mmio_read(__intentional_overflow(-1) readw, "w", unsigned short, "=r", :"memory")
17012 +build_mmio_read(__intentional_overflow(-1) readl, "l", unsigned int, "=r", :"memory")
17013
17014 build_mmio_read(__readb, "b", unsigned char, "=q", )
17015 -build_mmio_read(__readw, "w", unsigned short, "=r", )
17016 -build_mmio_read(__readl, "l", unsigned int, "=r", )
17017 +build_mmio_read(__intentional_overflow(-1) __readw, "w", unsigned short, "=r", )
17018 +build_mmio_read(__intentional_overflow(-1) __readl, "l", unsigned int, "=r", )
17019
17020 build_mmio_write(writeb, "b", unsigned char, "q", :"memory")
17021 build_mmio_write(writew, "w", unsigned short, "r", :"memory")
17022 @@ -184,7 +184,7 @@ static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
17023 return ioremap_nocache(offset, size);
17024 }
17025
17026 -extern void iounmap(volatile void __iomem *addr);
17027 +extern void iounmap(const volatile void __iomem *addr);
17028
17029 extern void set_iounmap_nonlazy(void);
17030
17031 @@ -194,6 +194,17 @@ extern void set_iounmap_nonlazy(void);
17032
17033 #include <linux/vmalloc.h>
17034
17035 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
17036 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
17037 +{
17038 + return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
17039 +}
17040 +
17041 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
17042 +{
17043 + return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
17044 +}
17045 +
17046 /*
17047 * Convert a virtual cached pointer to an uncached pointer
17048 */
17049 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
17050 index bba3cf8..06bc8da 100644
17051 --- a/arch/x86/include/asm/irqflags.h
17052 +++ b/arch/x86/include/asm/irqflags.h
17053 @@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
17054 sti; \
17055 sysexit
17056
17057 +#define GET_CR0_INTO_RDI mov %cr0, %rdi
17058 +#define SET_RDI_INTO_CR0 mov %rdi, %cr0
17059 +#define GET_CR3_INTO_RDI mov %cr3, %rdi
17060 +#define SET_RDI_INTO_CR3 mov %rdi, %cr3
17061 +
17062 #else
17063 #define INTERRUPT_RETURN iret
17064 #define ENABLE_INTERRUPTS_SYSEXIT sti; sysexit
17065 diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
17066 index 9454c16..e4100e3 100644
17067 --- a/arch/x86/include/asm/kprobes.h
17068 +++ b/arch/x86/include/asm/kprobes.h
17069 @@ -38,13 +38,8 @@ typedef u8 kprobe_opcode_t;
17070 #define RELATIVEJUMP_SIZE 5
17071 #define RELATIVECALL_OPCODE 0xe8
17072 #define RELATIVE_ADDR_SIZE 4
17073 -#define MAX_STACK_SIZE 64
17074 -#define MIN_STACK_SIZE(ADDR) \
17075 - (((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
17076 - THREAD_SIZE - (unsigned long)(ADDR))) \
17077 - ? (MAX_STACK_SIZE) \
17078 - : (((unsigned long)current_thread_info()) + \
17079 - THREAD_SIZE - (unsigned long)(ADDR)))
17080 +#define MAX_STACK_SIZE 64UL
17081 +#define MIN_STACK_SIZE(ADDR) min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
17082
17083 #define flush_insn_slot(p) do { } while (0)
17084
17085 diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
17086 index 4ad6560..75c7bdd 100644
17087 --- a/arch/x86/include/asm/local.h
17088 +++ b/arch/x86/include/asm/local.h
17089 @@ -10,33 +10,97 @@ typedef struct {
17090 atomic_long_t a;
17091 } local_t;
17092
17093 +typedef struct {
17094 + atomic_long_unchecked_t a;
17095 +} local_unchecked_t;
17096 +
17097 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
17098
17099 #define local_read(l) atomic_long_read(&(l)->a)
17100 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
17101 #define local_set(l, i) atomic_long_set(&(l)->a, (i))
17102 +#define local_set_unchecked(l, i) atomic_long_set_unchecked(&(l)->a, (i))
17103
17104 static inline void local_inc(local_t *l)
17105 {
17106 - asm volatile(_ASM_INC "%0"
17107 + asm volatile(_ASM_INC "%0\n"
17108 +
17109 +#ifdef CONFIG_PAX_REFCOUNT
17110 + "jno 0f\n"
17111 + _ASM_DEC "%0\n"
17112 + "int $4\n0:\n"
17113 + _ASM_EXTABLE(0b, 0b)
17114 +#endif
17115 +
17116 + : "+m" (l->a.counter));
17117 +}
17118 +
17119 +static inline void local_inc_unchecked(local_unchecked_t *l)
17120 +{
17121 + asm volatile(_ASM_INC "%0\n"
17122 : "+m" (l->a.counter));
17123 }
17124
17125 static inline void local_dec(local_t *l)
17126 {
17127 - asm volatile(_ASM_DEC "%0"
17128 + asm volatile(_ASM_DEC "%0\n"
17129 +
17130 +#ifdef CONFIG_PAX_REFCOUNT
17131 + "jno 0f\n"
17132 + _ASM_INC "%0\n"
17133 + "int $4\n0:\n"
17134 + _ASM_EXTABLE(0b, 0b)
17135 +#endif
17136 +
17137 + : "+m" (l->a.counter));
17138 +}
17139 +
17140 +static inline void local_dec_unchecked(local_unchecked_t *l)
17141 +{
17142 + asm volatile(_ASM_DEC "%0\n"
17143 : "+m" (l->a.counter));
17144 }
17145
17146 static inline void local_add(long i, local_t *l)
17147 {
17148 - asm volatile(_ASM_ADD "%1,%0"
17149 + asm volatile(_ASM_ADD "%1,%0\n"
17150 +
17151 +#ifdef CONFIG_PAX_REFCOUNT
17152 + "jno 0f\n"
17153 + _ASM_SUB "%1,%0\n"
17154 + "int $4\n0:\n"
17155 + _ASM_EXTABLE(0b, 0b)
17156 +#endif
17157 +
17158 + : "+m" (l->a.counter)
17159 + : "ir" (i));
17160 +}
17161 +
17162 +static inline void local_add_unchecked(long i, local_unchecked_t *l)
17163 +{
17164 + asm volatile(_ASM_ADD "%1,%0\n"
17165 : "+m" (l->a.counter)
17166 : "ir" (i));
17167 }
17168
17169 static inline void local_sub(long i, local_t *l)
17170 {
17171 - asm volatile(_ASM_SUB "%1,%0"
17172 + asm volatile(_ASM_SUB "%1,%0\n"
17173 +
17174 +#ifdef CONFIG_PAX_REFCOUNT
17175 + "jno 0f\n"
17176 + _ASM_ADD "%1,%0\n"
17177 + "int $4\n0:\n"
17178 + _ASM_EXTABLE(0b, 0b)
17179 +#endif
17180 +
17181 + : "+m" (l->a.counter)
17182 + : "ir" (i));
17183 +}
17184 +
17185 +static inline void local_sub_unchecked(long i, local_unchecked_t *l)
17186 +{
17187 + asm volatile(_ASM_SUB "%1,%0\n"
17188 : "+m" (l->a.counter)
17189 : "ir" (i));
17190 }
17191 @@ -52,7 +116,7 @@ static inline void local_sub(long i, local_t *l)
17192 */
17193 static inline int local_sub_and_test(long i, local_t *l)
17194 {
17195 - GEN_BINARY_RMWcc(_ASM_SUB, l->a.counter, "er", i, "%0", "e");
17196 + GEN_BINARY_RMWcc(_ASM_SUB, _ASM_ADD, l->a.counter, "er", i, "%0", "e");
17197 }
17198
17199 /**
17200 @@ -65,7 +129,7 @@ static inline int local_sub_and_test(long i, local_t *l)
17201 */
17202 static inline int local_dec_and_test(local_t *l)
17203 {
17204 - GEN_UNARY_RMWcc(_ASM_DEC, l->a.counter, "%0", "e");
17205 + GEN_UNARY_RMWcc(_ASM_DEC, _ASM_INC, l->a.counter, "%0", "e");
17206 }
17207
17208 /**
17209 @@ -78,7 +142,7 @@ static inline int local_dec_and_test(local_t *l)
17210 */
17211 static inline int local_inc_and_test(local_t *l)
17212 {
17213 - GEN_UNARY_RMWcc(_ASM_INC, l->a.counter, "%0", "e");
17214 + GEN_UNARY_RMWcc(_ASM_INC, _ASM_DEC, l->a.counter, "%0", "e");
17215 }
17216
17217 /**
17218 @@ -92,7 +156,7 @@ static inline int local_inc_and_test(local_t *l)
17219 */
17220 static inline int local_add_negative(long i, local_t *l)
17221 {
17222 - GEN_BINARY_RMWcc(_ASM_ADD, l->a.counter, "er", i, "%0", "s");
17223 + GEN_BINARY_RMWcc(_ASM_ADD, _ASM_SUB, l->a.counter, "er", i, "%0", "s");
17224 }
17225
17226 /**
17227 @@ -105,6 +169,30 @@ static inline int local_add_negative(long i, local_t *l)
17228 static inline long local_add_return(long i, local_t *l)
17229 {
17230 long __i = i;
17231 + asm volatile(_ASM_XADD "%0, %1\n"
17232 +
17233 +#ifdef CONFIG_PAX_REFCOUNT
17234 + "jno 0f\n"
17235 + _ASM_MOV "%0,%1\n"
17236 + "int $4\n0:\n"
17237 + _ASM_EXTABLE(0b, 0b)
17238 +#endif
17239 +
17240 + : "+r" (i), "+m" (l->a.counter)
17241 + : : "memory");
17242 + return i + __i;
17243 +}
17244 +
17245 +/**
17246 + * local_add_return_unchecked - add and return
17247 + * @i: integer value to add
17248 + * @l: pointer to type local_unchecked_t
17249 + *
17250 + * Atomically adds @i to @l and returns @i + @l
17251 + */
17252 +static inline long local_add_return_unchecked(long i, local_unchecked_t *l)
17253 +{
17254 + long __i = i;
17255 asm volatile(_ASM_XADD "%0, %1;"
17256 : "+r" (i), "+m" (l->a.counter)
17257 : : "memory");
17258 @@ -121,6 +209,8 @@ static inline long local_sub_return(long i, local_t *l)
17259
17260 #define local_cmpxchg(l, o, n) \
17261 (cmpxchg_local(&((l)->a.counter), (o), (n)))
17262 +#define local_cmpxchg_unchecked(l, o, n) \
17263 + (cmpxchg_local(&((l)->a.counter), (o), (n)))
17264 /* Always has a lock prefix */
17265 #define local_xchg(l, n) (xchg(&((l)->a.counter), (n)))
17266
17267 diff --git a/arch/x86/include/asm/mman.h b/arch/x86/include/asm/mman.h
17268 new file mode 100644
17269 index 0000000..2bfd3ba
17270 --- /dev/null
17271 +++ b/arch/x86/include/asm/mman.h
17272 @@ -0,0 +1,15 @@
17273 +#ifndef _X86_MMAN_H
17274 +#define _X86_MMAN_H
17275 +
17276 +#include <uapi/asm/mman.h>
17277 +
17278 +#ifdef __KERNEL__
17279 +#ifndef __ASSEMBLY__
17280 +#ifdef CONFIG_X86_32
17281 +#define arch_mmap_check i386_mmap_check
17282 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags);
17283 +#endif
17284 +#endif
17285 +#endif
17286 +
17287 +#endif /* X86_MMAN_H */
17288 diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
17289 index 5f55e69..e20bfb1 100644
17290 --- a/arch/x86/include/asm/mmu.h
17291 +++ b/arch/x86/include/asm/mmu.h
17292 @@ -9,7 +9,7 @@
17293 * we put the segment information here.
17294 */
17295 typedef struct {
17296 - void *ldt;
17297 + struct desc_struct *ldt;
17298 int size;
17299
17300 #ifdef CONFIG_X86_64
17301 @@ -18,7 +18,19 @@ typedef struct {
17302 #endif
17303
17304 struct mutex lock;
17305 - void *vdso;
17306 + unsigned long vdso;
17307 +
17308 +#ifdef CONFIG_X86_32
17309 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
17310 + unsigned long user_cs_base;
17311 + unsigned long user_cs_limit;
17312 +
17313 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
17314 + cpumask_t cpu_user_cs_mask;
17315 +#endif
17316 +
17317 +#endif
17318 +#endif
17319 } mm_context_t;
17320
17321 #ifdef CONFIG_SMP
17322 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
17323 index be12c53..4d24039 100644
17324 --- a/arch/x86/include/asm/mmu_context.h
17325 +++ b/arch/x86/include/asm/mmu_context.h
17326 @@ -24,6 +24,20 @@ void destroy_context(struct mm_struct *mm);
17327
17328 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
17329 {
17330 +
17331 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17332 + if (!(static_cpu_has(X86_FEATURE_PCID))) {
17333 + unsigned int i;
17334 + pgd_t *pgd;
17335 +
17336 + pax_open_kernel();
17337 + pgd = get_cpu_pgd(smp_processor_id(), kernel);
17338 + for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
17339 + set_pgd_batched(pgd+i, native_make_pgd(0));
17340 + pax_close_kernel();
17341 + }
17342 +#endif
17343 +
17344 #ifdef CONFIG_SMP
17345 if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
17346 this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
17347 @@ -34,16 +48,59 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17348 struct task_struct *tsk)
17349 {
17350 unsigned cpu = smp_processor_id();
17351 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17352 + int tlbstate = TLBSTATE_OK;
17353 +#endif
17354
17355 if (likely(prev != next)) {
17356 #ifdef CONFIG_SMP
17357 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17358 + tlbstate = this_cpu_read(cpu_tlbstate.state);
17359 +#endif
17360 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
17361 this_cpu_write(cpu_tlbstate.active_mm, next);
17362 #endif
17363 cpumask_set_cpu(cpu, mm_cpumask(next));
17364
17365 /* Re-load page tables */
17366 +#ifdef CONFIG_PAX_PER_CPU_PGD
17367 + pax_open_kernel();
17368 +
17369 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17370 + if (static_cpu_has(X86_FEATURE_PCID))
17371 + __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
17372 + else
17373 +#endif
17374 +
17375 + __clone_user_pgds(get_cpu_pgd(cpu, kernel), next->pgd);
17376 + __shadow_user_pgds(get_cpu_pgd(cpu, kernel) + USER_PGD_PTRS, next->pgd);
17377 + pax_close_kernel();
17378 + BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
17379 +
17380 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17381 + if (static_cpu_has(X86_FEATURE_PCID)) {
17382 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
17383 + u64 descriptor[2];
17384 + descriptor[0] = PCID_USER;
17385 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17386 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF)) {
17387 + descriptor[0] = PCID_KERNEL;
17388 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17389 + }
17390 + } else {
17391 + write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
17392 + if (static_cpu_has(X86_FEATURE_STRONGUDEREF))
17393 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
17394 + else
17395 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
17396 + }
17397 + } else
17398 +#endif
17399 +
17400 + load_cr3(get_cpu_pgd(cpu, kernel));
17401 +#else
17402 load_cr3(next->pgd);
17403 +#endif
17404
17405 /* Stop flush ipis for the previous mm */
17406 cpumask_clear_cpu(cpu, mm_cpumask(prev));
17407 @@ -51,9 +108,67 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17408 /* Load the LDT, if the LDT is different: */
17409 if (unlikely(prev->context.ldt != next->context.ldt))
17410 load_LDT_nolock(&next->context);
17411 +
17412 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
17413 + if (!(__supported_pte_mask & _PAGE_NX)) {
17414 + smp_mb__before_clear_bit();
17415 + cpu_clear(cpu, prev->context.cpu_user_cs_mask);
17416 + smp_mb__after_clear_bit();
17417 + cpu_set(cpu, next->context.cpu_user_cs_mask);
17418 + }
17419 +#endif
17420 +
17421 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17422 + if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
17423 + prev->context.user_cs_limit != next->context.user_cs_limit))
17424 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17425 +#ifdef CONFIG_SMP
17426 + else if (unlikely(tlbstate != TLBSTATE_OK))
17427 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17428 +#endif
17429 +#endif
17430 +
17431 }
17432 + else {
17433 +
17434 +#ifdef CONFIG_PAX_PER_CPU_PGD
17435 + pax_open_kernel();
17436 +
17437 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17438 + if (static_cpu_has(X86_FEATURE_PCID))
17439 + __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
17440 + else
17441 +#endif
17442 +
17443 + __clone_user_pgds(get_cpu_pgd(cpu, kernel), next->pgd);
17444 + __shadow_user_pgds(get_cpu_pgd(cpu, kernel) + USER_PGD_PTRS, next->pgd);
17445 + pax_close_kernel();
17446 + BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
17447 +
17448 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
17449 + if (static_cpu_has(X86_FEATURE_PCID)) {
17450 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
17451 + u64 descriptor[2];
17452 + descriptor[0] = PCID_USER;
17453 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17454 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF)) {
17455 + descriptor[0] = PCID_KERNEL;
17456 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_CONTEXT) : "memory");
17457 + }
17458 + } else {
17459 + write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
17460 + if (static_cpu_has(X86_FEATURE_STRONGUDEREF))
17461 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
17462 + else
17463 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
17464 + }
17465 + } else
17466 +#endif
17467 +
17468 + load_cr3(get_cpu_pgd(cpu, kernel));
17469 +#endif
17470 +
17471 #ifdef CONFIG_SMP
17472 - else {
17473 this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK);
17474 BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next);
17475
17476 @@ -70,11 +185,28 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
17477 * tlb flush IPI delivery. We must reload CR3
17478 * to make sure to use no freed page tables.
17479 */
17480 +
17481 +#ifndef CONFIG_PAX_PER_CPU_PGD
17482 load_cr3(next->pgd);
17483 +#endif
17484 +
17485 load_LDT_nolock(&next->context);
17486 +
17487 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
17488 + if (!(__supported_pte_mask & _PAGE_NX))
17489 + cpu_set(cpu, next->context.cpu_user_cs_mask);
17490 +#endif
17491 +
17492 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
17493 +#ifdef CONFIG_PAX_PAGEEXEC
17494 + if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
17495 +#endif
17496 + set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
17497 +#endif
17498 +
17499 }
17500 +#endif
17501 }
17502 -#endif
17503 }
17504
17505 #define activate_mm(prev, next) \
17506 diff --git a/arch/x86/include/asm/module.h b/arch/x86/include/asm/module.h
17507 index e3b7819..b257c64 100644
17508 --- a/arch/x86/include/asm/module.h
17509 +++ b/arch/x86/include/asm/module.h
17510 @@ -5,6 +5,7 @@
17511
17512 #ifdef CONFIG_X86_64
17513 /* X86_64 does not define MODULE_PROC_FAMILY */
17514 +#define MODULE_PROC_FAMILY ""
17515 #elif defined CONFIG_M486
17516 #define MODULE_PROC_FAMILY "486 "
17517 #elif defined CONFIG_M586
17518 @@ -57,8 +58,20 @@
17519 #error unknown processor family
17520 #endif
17521
17522 -#ifdef CONFIG_X86_32
17523 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
17524 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_BTS
17525 +#define MODULE_PAX_KERNEXEC "KERNEXEC_BTS "
17526 +#elif defined(CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR)
17527 +#define MODULE_PAX_KERNEXEC "KERNEXEC_OR "
17528 +#else
17529 +#define MODULE_PAX_KERNEXEC ""
17530 #endif
17531
17532 +#ifdef CONFIG_PAX_MEMORY_UDEREF
17533 +#define MODULE_PAX_UDEREF "UDEREF "
17534 +#else
17535 +#define MODULE_PAX_UDEREF ""
17536 +#endif
17537 +
17538 +#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
17539 +
17540 #endif /* _ASM_X86_MODULE_H */
17541 diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
17542 index 86f9301..b365cda 100644
17543 --- a/arch/x86/include/asm/nmi.h
17544 +++ b/arch/x86/include/asm/nmi.h
17545 @@ -40,11 +40,11 @@ struct nmiaction {
17546 nmi_handler_t handler;
17547 unsigned long flags;
17548 const char *name;
17549 -};
17550 +} __do_const;
17551
17552 #define register_nmi_handler(t, fn, fg, n, init...) \
17553 ({ \
17554 - static struct nmiaction init fn##_na = { \
17555 + static const struct nmiaction init fn##_na = { \
17556 .handler = (fn), \
17557 .name = (n), \
17558 .flags = (fg), \
17559 @@ -52,7 +52,7 @@ struct nmiaction {
17560 __register_nmi_handler((t), &fn##_na); \
17561 })
17562
17563 -int __register_nmi_handler(unsigned int, struct nmiaction *);
17564 +int __register_nmi_handler(unsigned int, const struct nmiaction *);
17565
17566 void unregister_nmi_handler(unsigned int, const char *);
17567
17568 diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
17569 index 775873d..de5f0304 100644
17570 --- a/arch/x86/include/asm/page.h
17571 +++ b/arch/x86/include/asm/page.h
17572 @@ -52,6 +52,7 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
17573 __phys_addr_symbol(__phys_reloc_hide((unsigned long)(x)))
17574
17575 #define __va(x) ((void *)((unsigned long)(x)+PAGE_OFFSET))
17576 +#define __early_va(x) ((void *)((unsigned long)(x)+__START_KERNEL_map - phys_base))
17577
17578 #define __boot_va(x) __va(x)
17579 #define __boot_pa(x) __pa(x)
17580 diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
17581 index 0f1ddee..e2fc3d1 100644
17582 --- a/arch/x86/include/asm/page_64.h
17583 +++ b/arch/x86/include/asm/page_64.h
17584 @@ -7,9 +7,9 @@
17585
17586 /* duplicated to the one in bootmem.h */
17587 extern unsigned long max_pfn;
17588 -extern unsigned long phys_base;
17589 +extern const unsigned long phys_base;
17590
17591 -static inline unsigned long __phys_addr_nodebug(unsigned long x)
17592 +static inline unsigned long __intentional_overflow(-1) __phys_addr_nodebug(unsigned long x)
17593 {
17594 unsigned long y = x - __START_KERNEL_map;
17595
17596 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
17597 index cd6e1610..70f4418 100644
17598 --- a/arch/x86/include/asm/paravirt.h
17599 +++ b/arch/x86/include/asm/paravirt.h
17600 @@ -560,7 +560,7 @@ static inline pmd_t __pmd(pmdval_t val)
17601 return (pmd_t) { ret };
17602 }
17603
17604 -static inline pmdval_t pmd_val(pmd_t pmd)
17605 +static inline __intentional_overflow(-1) pmdval_t pmd_val(pmd_t pmd)
17606 {
17607 pmdval_t ret;
17608
17609 @@ -626,6 +626,18 @@ static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
17610 val);
17611 }
17612
17613 +static inline void set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
17614 +{
17615 + pgdval_t val = native_pgd_val(pgd);
17616 +
17617 + if (sizeof(pgdval_t) > sizeof(long))
17618 + PVOP_VCALL3(pv_mmu_ops.set_pgd_batched, pgdp,
17619 + val, (u64)val >> 32);
17620 + else
17621 + PVOP_VCALL2(pv_mmu_ops.set_pgd_batched, pgdp,
17622 + val);
17623 +}
17624 +
17625 static inline void pgd_clear(pgd_t *pgdp)
17626 {
17627 set_pgd(pgdp, __pgd(0));
17628 @@ -710,6 +722,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
17629 pv_mmu_ops.set_fixmap(idx, phys, flags);
17630 }
17631
17632 +#ifdef CONFIG_PAX_KERNEXEC
17633 +static inline unsigned long pax_open_kernel(void)
17634 +{
17635 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
17636 +}
17637 +
17638 +static inline unsigned long pax_close_kernel(void)
17639 +{
17640 + return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
17641 +}
17642 +#else
17643 +static inline unsigned long pax_open_kernel(void) { return 0; }
17644 +static inline unsigned long pax_close_kernel(void) { return 0; }
17645 +#endif
17646 +
17647 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
17648
17649 static __always_inline void __ticket_lock_spinning(struct arch_spinlock *lock,
17650 @@ -906,7 +933,7 @@ extern void default_banner(void);
17651
17652 #define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
17653 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
17654 -#define PARA_INDIRECT(addr) *%cs:addr
17655 +#define PARA_INDIRECT(addr) *%ss:addr
17656 #endif
17657
17658 #define INTERRUPT_RETURN \
17659 @@ -981,6 +1008,21 @@ extern void default_banner(void);
17660 PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
17661 CLBR_NONE, \
17662 jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
17663 +
17664 +#define GET_CR0_INTO_RDI \
17665 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
17666 + mov %rax,%rdi
17667 +
17668 +#define SET_RDI_INTO_CR0 \
17669 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
17670 +
17671 +#define GET_CR3_INTO_RDI \
17672 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3); \
17673 + mov %rax,%rdi
17674 +
17675 +#define SET_RDI_INTO_CR3 \
17676 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
17677 +
17678 #endif /* CONFIG_X86_32 */
17679
17680 #endif /* __ASSEMBLY__ */
17681 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
17682 index 7549b8b..f0edfda 100644
17683 --- a/arch/x86/include/asm/paravirt_types.h
17684 +++ b/arch/x86/include/asm/paravirt_types.h
17685 @@ -84,7 +84,7 @@ struct pv_init_ops {
17686 */
17687 unsigned (*patch)(u8 type, u16 clobber, void *insnbuf,
17688 unsigned long addr, unsigned len);
17689 -};
17690 +} __no_const __no_randomize_layout;
17691
17692
17693 struct pv_lazy_ops {
17694 @@ -92,13 +92,13 @@ struct pv_lazy_ops {
17695 void (*enter)(void);
17696 void (*leave)(void);
17697 void (*flush)(void);
17698 -};
17699 +} __no_randomize_layout;
17700
17701 struct pv_time_ops {
17702 unsigned long long (*sched_clock)(void);
17703 unsigned long long (*steal_clock)(int cpu);
17704 unsigned long (*get_tsc_khz)(void);
17705 -};
17706 +} __no_const __no_randomize_layout;
17707
17708 struct pv_cpu_ops {
17709 /* hooks for various privileged instructions */
17710 @@ -192,7 +192,7 @@ struct pv_cpu_ops {
17711
17712 void (*start_context_switch)(struct task_struct *prev);
17713 void (*end_context_switch)(struct task_struct *next);
17714 -};
17715 +} __no_const __no_randomize_layout;
17716
17717 struct pv_irq_ops {
17718 /*
17719 @@ -215,7 +215,7 @@ struct pv_irq_ops {
17720 #ifdef CONFIG_X86_64
17721 void (*adjust_exception_frame)(void);
17722 #endif
17723 -};
17724 +} __no_randomize_layout;
17725
17726 struct pv_apic_ops {
17727 #ifdef CONFIG_X86_LOCAL_APIC
17728 @@ -223,7 +223,7 @@ struct pv_apic_ops {
17729 unsigned long start_eip,
17730 unsigned long start_esp);
17731 #endif
17732 -};
17733 +} __no_const __no_randomize_layout;
17734
17735 struct pv_mmu_ops {
17736 unsigned long (*read_cr2)(void);
17737 @@ -313,6 +313,7 @@ struct pv_mmu_ops {
17738 struct paravirt_callee_save make_pud;
17739
17740 void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
17741 + void (*set_pgd_batched)(pgd_t *pudp, pgd_t pgdval);
17742 #endif /* PAGETABLE_LEVELS == 4 */
17743 #endif /* PAGETABLE_LEVELS >= 3 */
17744
17745 @@ -324,7 +325,13 @@ struct pv_mmu_ops {
17746 an mfn. We can tell which is which from the index. */
17747 void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
17748 phys_addr_t phys, pgprot_t flags);
17749 -};
17750 +
17751 +#ifdef CONFIG_PAX_KERNEXEC
17752 + unsigned long (*pax_open_kernel)(void);
17753 + unsigned long (*pax_close_kernel)(void);
17754 +#endif
17755 +
17756 +} __no_randomize_layout;
17757
17758 struct arch_spinlock;
17759 #ifdef CONFIG_SMP
17760 @@ -336,11 +343,14 @@ typedef u16 __ticket_t;
17761 struct pv_lock_ops {
17762 struct paravirt_callee_save lock_spinning;
17763 void (*unlock_kick)(struct arch_spinlock *lock, __ticket_t ticket);
17764 -};
17765 +} __no_randomize_layout;
17766
17767 /* This contains all the paravirt structures: we get a convenient
17768 * number for each function using the offset which we use to indicate
17769 - * what to patch. */
17770 + * what to patch.
17771 + * shouldn't be randomized due to the "NEAT TRICK" in paravirt.c
17772 + */
17773 +
17774 struct paravirt_patch_template {
17775 struct pv_init_ops pv_init_ops;
17776 struct pv_time_ops pv_time_ops;
17777 @@ -349,7 +359,7 @@ struct paravirt_patch_template {
17778 struct pv_apic_ops pv_apic_ops;
17779 struct pv_mmu_ops pv_mmu_ops;
17780 struct pv_lock_ops pv_lock_ops;
17781 -};
17782 +} __no_randomize_layout;
17783
17784 extern struct pv_info pv_info;
17785 extern struct pv_init_ops pv_init_ops;
17786 diff --git a/arch/x86/include/asm/pgalloc.h b/arch/x86/include/asm/pgalloc.h
17787 index c4412e9..90e88c5 100644
17788 --- a/arch/x86/include/asm/pgalloc.h
17789 +++ b/arch/x86/include/asm/pgalloc.h
17790 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(struct mm_struct *mm,
17791 pmd_t *pmd, pte_t *pte)
17792 {
17793 paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
17794 + set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
17795 +}
17796 +
17797 +static inline void pmd_populate_user(struct mm_struct *mm,
17798 + pmd_t *pmd, pte_t *pte)
17799 +{
17800 + paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
17801 set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
17802 }
17803
17804 @@ -108,12 +115,22 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd,
17805
17806 #ifdef CONFIG_X86_PAE
17807 extern void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd);
17808 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
17809 +{
17810 + pud_populate(mm, pudp, pmd);
17811 +}
17812 #else /* !CONFIG_X86_PAE */
17813 static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
17814 {
17815 paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
17816 set_pud(pud, __pud(_PAGE_TABLE | __pa(pmd)));
17817 }
17818 +
17819 +static inline void pud_populate_kernel(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
17820 +{
17821 + paravirt_alloc_pmd(mm, __pa(pmd) >> PAGE_SHIFT);
17822 + set_pud(pud, __pud(_KERNPG_TABLE | __pa(pmd)));
17823 +}
17824 #endif /* CONFIG_X86_PAE */
17825
17826 #if PAGETABLE_LEVELS > 3
17827 @@ -123,6 +140,12 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
17828 set_pgd(pgd, __pgd(_PAGE_TABLE | __pa(pud)));
17829 }
17830
17831 +static inline void pgd_populate_kernel(struct mm_struct *mm, pgd_t *pgd, pud_t *pud)
17832 +{
17833 + paravirt_alloc_pud(mm, __pa(pud) >> PAGE_SHIFT);
17834 + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(pud)));
17835 +}
17836 +
17837 static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
17838 {
17839 return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
17840 diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
17841 index 0d193e2..bf59aeb 100644
17842 --- a/arch/x86/include/asm/pgtable-2level.h
17843 +++ b/arch/x86/include/asm/pgtable-2level.h
17844 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t *ptep , pte_t pte)
17845
17846 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
17847 {
17848 + pax_open_kernel();
17849 *pmdp = pmd;
17850 + pax_close_kernel();
17851 }
17852
17853 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
17854 diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
17855 index 81bb91b..9392125 100644
17856 --- a/arch/x86/include/asm/pgtable-3level.h
17857 +++ b/arch/x86/include/asm/pgtable-3level.h
17858 @@ -92,12 +92,16 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
17859
17860 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
17861 {
17862 + pax_open_kernel();
17863 set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
17864 + pax_close_kernel();
17865 }
17866
17867 static inline void native_set_pud(pud_t *pudp, pud_t pud)
17868 {
17869 + pax_open_kernel();
17870 set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
17871 + pax_close_kernel();
17872 }
17873
17874 /*
17875 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
17876 index bbc8b12..f228861 100644
17877 --- a/arch/x86/include/asm/pgtable.h
17878 +++ b/arch/x86/include/asm/pgtable.h
17879 @@ -45,6 +45,7 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
17880
17881 #ifndef __PAGETABLE_PUD_FOLDED
17882 #define set_pgd(pgdp, pgd) native_set_pgd(pgdp, pgd)
17883 +#define set_pgd_batched(pgdp, pgd) native_set_pgd_batched(pgdp, pgd)
17884 #define pgd_clear(pgd) native_pgd_clear(pgd)
17885 #endif
17886
17887 @@ -82,12 +83,51 @@ extern struct mm_struct *pgd_page_get_mm(struct page *page);
17888
17889 #define arch_end_context_switch(prev) do {} while(0)
17890
17891 +#define pax_open_kernel() native_pax_open_kernel()
17892 +#define pax_close_kernel() native_pax_close_kernel()
17893 #endif /* CONFIG_PARAVIRT */
17894
17895 +#define __HAVE_ARCH_PAX_OPEN_KERNEL
17896 +#define __HAVE_ARCH_PAX_CLOSE_KERNEL
17897 +
17898 +#ifdef CONFIG_PAX_KERNEXEC
17899 +static inline unsigned long native_pax_open_kernel(void)
17900 +{
17901 + unsigned long cr0;
17902 +
17903 + preempt_disable();
17904 + barrier();
17905 + cr0 = read_cr0() ^ X86_CR0_WP;
17906 + BUG_ON(cr0 & X86_CR0_WP);
17907 + write_cr0(cr0);
17908 + return cr0 ^ X86_CR0_WP;
17909 +}
17910 +
17911 +static inline unsigned long native_pax_close_kernel(void)
17912 +{
17913 + unsigned long cr0;
17914 +
17915 + cr0 = read_cr0() ^ X86_CR0_WP;
17916 + BUG_ON(!(cr0 & X86_CR0_WP));
17917 + write_cr0(cr0);
17918 + barrier();
17919 + preempt_enable_no_resched();
17920 + return cr0 ^ X86_CR0_WP;
17921 +}
17922 +#else
17923 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
17924 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
17925 +#endif
17926 +
17927 /*
17928 * The following only work if pte_present() is true.
17929 * Undefined behaviour if not..
17930 */
17931 +static inline int pte_user(pte_t pte)
17932 +{
17933 + return pte_val(pte) & _PAGE_USER;
17934 +}
17935 +
17936 static inline int pte_dirty(pte_t pte)
17937 {
17938 return pte_flags(pte) & _PAGE_DIRTY;
17939 @@ -148,6 +188,11 @@ static inline unsigned long pud_pfn(pud_t pud)
17940 return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
17941 }
17942
17943 +static inline unsigned long pgd_pfn(pgd_t pgd)
17944 +{
17945 + return (pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT;
17946 +}
17947 +
17948 #define pte_page(pte) pfn_to_page(pte_pfn(pte))
17949
17950 static inline int pmd_large(pmd_t pte)
17951 @@ -201,9 +246,29 @@ static inline pte_t pte_wrprotect(pte_t pte)
17952 return pte_clear_flags(pte, _PAGE_RW);
17953 }
17954
17955 +static inline pte_t pte_mkread(pte_t pte)
17956 +{
17957 + return __pte(pte_val(pte) | _PAGE_USER);
17958 +}
17959 +
17960 static inline pte_t pte_mkexec(pte_t pte)
17961 {
17962 - return pte_clear_flags(pte, _PAGE_NX);
17963 +#ifdef CONFIG_X86_PAE
17964 + if (__supported_pte_mask & _PAGE_NX)
17965 + return pte_clear_flags(pte, _PAGE_NX);
17966 + else
17967 +#endif
17968 + return pte_set_flags(pte, _PAGE_USER);
17969 +}
17970 +
17971 +static inline pte_t pte_exprotect(pte_t pte)
17972 +{
17973 +#ifdef CONFIG_X86_PAE
17974 + if (__supported_pte_mask & _PAGE_NX)
17975 + return pte_set_flags(pte, _PAGE_NX);
17976 + else
17977 +#endif
17978 + return pte_clear_flags(pte, _PAGE_USER);
17979 }
17980
17981 static inline pte_t pte_mkdirty(pte_t pte)
17982 @@ -430,6 +495,16 @@ pte_t *populate_extra_pte(unsigned long vaddr);
17983 #endif
17984
17985 #ifndef __ASSEMBLY__
17986 +
17987 +#ifdef CONFIG_PAX_PER_CPU_PGD
17988 +extern pgd_t cpu_pgd[NR_CPUS][2][PTRS_PER_PGD];
17989 +enum cpu_pgd_type {kernel = 0, user = 1};
17990 +static inline pgd_t *get_cpu_pgd(unsigned int cpu, enum cpu_pgd_type type)
17991 +{
17992 + return cpu_pgd[cpu][type];
17993 +}
17994 +#endif
17995 +
17996 #include <linux/mm_types.h>
17997 #include <linux/mmdebug.h>
17998 #include <linux/log2.h>
17999 @@ -570,7 +645,7 @@ static inline unsigned long pud_page_vaddr(pud_t pud)
18000 * Currently stuck as a macro due to indirect forward reference to
18001 * linux/mmzone.h's __section_mem_map_addr() definition:
18002 */
18003 -#define pud_page(pud) pfn_to_page(pud_val(pud) >> PAGE_SHIFT)
18004 +#define pud_page(pud) pfn_to_page((pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT)
18005
18006 /* Find an entry in the second-level page table.. */
18007 static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
18008 @@ -610,7 +685,7 @@ static inline unsigned long pgd_page_vaddr(pgd_t pgd)
18009 * Currently stuck as a macro due to indirect forward reference to
18010 * linux/mmzone.h's __section_mem_map_addr() definition:
18011 */
18012 -#define pgd_page(pgd) pfn_to_page(pgd_val(pgd) >> PAGE_SHIFT)
18013 +#define pgd_page(pgd) pfn_to_page((pgd_val(pgd) & PTE_PFN_MASK) >> PAGE_SHIFT)
18014
18015 /* to find an entry in a page-table-directory. */
18016 static inline unsigned long pud_index(unsigned long address)
18017 @@ -625,7 +700,7 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
18018
18019 static inline int pgd_bad(pgd_t pgd)
18020 {
18021 - return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
18022 + return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
18023 }
18024
18025 static inline int pgd_none(pgd_t pgd)
18026 @@ -648,7 +723,12 @@ static inline int pgd_none(pgd_t pgd)
18027 * pgd_offset() returns a (pgd_t *)
18028 * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
18029 */
18030 -#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
18031 +#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
18032 +
18033 +#ifdef CONFIG_PAX_PER_CPU_PGD
18034 +#define pgd_offset_cpu(cpu, type, address) (get_cpu_pgd(cpu, type) + pgd_index(address))
18035 +#endif
18036 +
18037 /*
18038 * a shortcut which implies the use of the kernel's pgd, instead
18039 * of a process's
18040 @@ -659,6 +739,23 @@ static inline int pgd_none(pgd_t pgd)
18041 #define KERNEL_PGD_BOUNDARY pgd_index(PAGE_OFFSET)
18042 #define KERNEL_PGD_PTRS (PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
18043
18044 +#ifdef CONFIG_X86_32
18045 +#define USER_PGD_PTRS KERNEL_PGD_BOUNDARY
18046 +#else
18047 +#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
18048 +#define USER_PGD_PTRS (_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
18049 +
18050 +#ifdef CONFIG_PAX_MEMORY_UDEREF
18051 +#ifdef __ASSEMBLY__
18052 +#define pax_user_shadow_base pax_user_shadow_base(%rip)
18053 +#else
18054 +extern unsigned long pax_user_shadow_base;
18055 +extern pgdval_t clone_pgd_mask;
18056 +#endif
18057 +#endif
18058 +
18059 +#endif
18060 +
18061 #ifndef __ASSEMBLY__
18062
18063 extern int direct_gbpages;
18064 @@ -825,11 +922,24 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm,
18065 * dst and src can be on the same page, but the range must not overlap,
18066 * and must not cross a page boundary.
18067 */
18068 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
18069 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
18070 {
18071 - memcpy(dst, src, count * sizeof(pgd_t));
18072 + pax_open_kernel();
18073 + while (count--)
18074 + *dst++ = *src++;
18075 + pax_close_kernel();
18076 }
18077
18078 +#ifdef CONFIG_PAX_PER_CPU_PGD
18079 +extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src);
18080 +#endif
18081 +
18082 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
18083 +extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src);
18084 +#else
18085 +static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src) {}
18086 +#endif
18087 +
18088 #define PTE_SHIFT ilog2(PTRS_PER_PTE)
18089 static inline int page_level_shift(enum pg_level level)
18090 {
18091 diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
18092 index 9ee3221..b979c6b 100644
18093 --- a/arch/x86/include/asm/pgtable_32.h
18094 +++ b/arch/x86/include/asm/pgtable_32.h
18095 @@ -25,9 +25,6 @@
18096 struct mm_struct;
18097 struct vm_area_struct;
18098
18099 -extern pgd_t swapper_pg_dir[1024];
18100 -extern pgd_t initial_page_table[1024];
18101 -
18102 static inline void pgtable_cache_init(void) { }
18103 static inline void check_pgt_cache(void) { }
18104 void paging_init(void);
18105 @@ -48,6 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
18106 # include <asm/pgtable-2level.h>
18107 #endif
18108
18109 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
18110 +extern pgd_t initial_page_table[PTRS_PER_PGD];
18111 +#ifdef CONFIG_X86_PAE
18112 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
18113 +#endif
18114 +
18115 #if defined(CONFIG_HIGHPTE)
18116 #define pte_offset_map(dir, address) \
18117 ((pte_t *)kmap_atomic(pmd_page(*(dir))) + \
18118 @@ -62,12 +65,17 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
18119 /* Clear a kernel PTE and flush it from the TLB */
18120 #define kpte_clear_flush(ptep, vaddr) \
18121 do { \
18122 + pax_open_kernel(); \
18123 pte_clear(&init_mm, (vaddr), (ptep)); \
18124 + pax_close_kernel(); \
18125 __flush_tlb_one((vaddr)); \
18126 } while (0)
18127
18128 #endif /* !__ASSEMBLY__ */
18129
18130 +#define HAVE_ARCH_UNMAPPED_AREA
18131 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
18132 +
18133 /*
18134 * kern_addr_valid() is (1) for FLATMEM and (0) for
18135 * SPARSEMEM and DISCONTIGMEM
18136 diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
18137 index ed5903b..c7fe163 100644
18138 --- a/arch/x86/include/asm/pgtable_32_types.h
18139 +++ b/arch/x86/include/asm/pgtable_32_types.h
18140 @@ -8,7 +8,7 @@
18141 */
18142 #ifdef CONFIG_X86_PAE
18143 # include <asm/pgtable-3level_types.h>
18144 -# define PMD_SIZE (1UL << PMD_SHIFT)
18145 +# define PMD_SIZE (_AC(1, UL) << PMD_SHIFT)
18146 # define PMD_MASK (~(PMD_SIZE - 1))
18147 #else
18148 # include <asm/pgtable-2level_types.h>
18149 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set once high_memory is set */
18150 # define VMALLOC_END (FIXADDR_START - 2 * PAGE_SIZE)
18151 #endif
18152
18153 +#ifdef CONFIG_PAX_KERNEXEC
18154 +#ifndef __ASSEMBLY__
18155 +extern unsigned char MODULES_EXEC_VADDR[];
18156 +extern unsigned char MODULES_EXEC_END[];
18157 +#endif
18158 +#include <asm/boot.h>
18159 +#define ktla_ktva(addr) (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
18160 +#define ktva_ktla(addr) (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
18161 +#else
18162 +#define ktla_ktva(addr) (addr)
18163 +#define ktva_ktla(addr) (addr)
18164 +#endif
18165 +
18166 #define MODULES_VADDR VMALLOC_START
18167 #define MODULES_END VMALLOC_END
18168 #define MODULES_LEN (MODULES_VADDR - MODULES_END)
18169 diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
18170 index e22c1db..23a625a 100644
18171 --- a/arch/x86/include/asm/pgtable_64.h
18172 +++ b/arch/x86/include/asm/pgtable_64.h
18173 @@ -16,10 +16,14 @@
18174
18175 extern pud_t level3_kernel_pgt[512];
18176 extern pud_t level3_ident_pgt[512];
18177 +extern pud_t level3_vmalloc_start_pgt[512];
18178 +extern pud_t level3_vmalloc_end_pgt[512];
18179 +extern pud_t level3_vmemmap_pgt[512];
18180 +extern pud_t level2_vmemmap_pgt[512];
18181 extern pmd_t level2_kernel_pgt[512];
18182 extern pmd_t level2_fixmap_pgt[512];
18183 -extern pmd_t level2_ident_pgt[512];
18184 -extern pgd_t init_level4_pgt[];
18185 +extern pmd_t level2_ident_pgt[512*2];
18186 +extern pgd_t init_level4_pgt[512];
18187
18188 #define swapper_pg_dir init_level4_pgt
18189
18190 @@ -61,7 +65,9 @@ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
18191
18192 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
18193 {
18194 + pax_open_kernel();
18195 *pmdp = pmd;
18196 + pax_close_kernel();
18197 }
18198
18199 static inline void native_pmd_clear(pmd_t *pmd)
18200 @@ -97,7 +103,9 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
18201
18202 static inline void native_set_pud(pud_t *pudp, pud_t pud)
18203 {
18204 + pax_open_kernel();
18205 *pudp = pud;
18206 + pax_close_kernel();
18207 }
18208
18209 static inline void native_pud_clear(pud_t *pud)
18210 @@ -107,6 +115,13 @@ static inline void native_pud_clear(pud_t *pud)
18211
18212 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
18213 {
18214 + pax_open_kernel();
18215 + *pgdp = pgd;
18216 + pax_close_kernel();
18217 +}
18218 +
18219 +static inline void native_set_pgd_batched(pgd_t *pgdp, pgd_t pgd)
18220 +{
18221 *pgdp = pgd;
18222 }
18223
18224 diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
18225 index c883bf7..19970b3 100644
18226 --- a/arch/x86/include/asm/pgtable_64_types.h
18227 +++ b/arch/x86/include/asm/pgtable_64_types.h
18228 @@ -61,6 +61,11 @@ typedef struct { pteval_t pte; } pte_t;
18229 #define MODULES_VADDR (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
18230 #define MODULES_END _AC(0xffffffffff000000, UL)
18231 #define MODULES_LEN (MODULES_END - MODULES_VADDR)
18232 +#define MODULES_EXEC_VADDR MODULES_VADDR
18233 +#define MODULES_EXEC_END MODULES_END
18234 +
18235 +#define ktla_ktva(addr) (addr)
18236 +#define ktva_ktla(addr) (addr)
18237
18238 #define EARLY_DYNAMIC_PAGE_TABLES 64
18239
18240 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
18241 index 94e40f1..ebd03e4 100644
18242 --- a/arch/x86/include/asm/pgtable_types.h
18243 +++ b/arch/x86/include/asm/pgtable_types.h
18244 @@ -16,13 +16,12 @@
18245 #define _PAGE_BIT_PSE 7 /* 4 MB (or 2MB) page */
18246 #define _PAGE_BIT_PAT 7 /* on 4KB pages */
18247 #define _PAGE_BIT_GLOBAL 8 /* Global TLB entry PPro+ */
18248 -#define _PAGE_BIT_UNUSED1 9 /* available for programmer */
18249 +#define _PAGE_BIT_SPECIAL 9 /* special mappings, no associated struct page */
18250 #define _PAGE_BIT_IOMAP 10 /* flag used to indicate IO mapping */
18251 #define _PAGE_BIT_HIDDEN 11 /* hidden by kmemcheck */
18252 #define _PAGE_BIT_PAT_LARGE 12 /* On 2MB or 1GB pages */
18253 -#define _PAGE_BIT_SPECIAL _PAGE_BIT_UNUSED1
18254 -#define _PAGE_BIT_CPA_TEST _PAGE_BIT_UNUSED1
18255 -#define _PAGE_BIT_SPLITTING _PAGE_BIT_UNUSED1 /* only valid on a PSE pmd */
18256 +#define _PAGE_BIT_CPA_TEST _PAGE_BIT_SPECIAL
18257 +#define _PAGE_BIT_SPLITTING _PAGE_BIT_SPECIAL /* only valid on a PSE pmd */
18258 #define _PAGE_BIT_NX 63 /* No execute: only valid after cpuid check */
18259
18260 /* If _PAGE_BIT_PRESENT is clear, we use these: */
18261 @@ -40,7 +39,6 @@
18262 #define _PAGE_DIRTY (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
18263 #define _PAGE_PSE (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
18264 #define _PAGE_GLOBAL (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
18265 -#define _PAGE_UNUSED1 (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
18266 #define _PAGE_IOMAP (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
18267 #define _PAGE_PAT (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
18268 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
18269 @@ -87,8 +85,10 @@
18270
18271 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
18272 #define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_NX)
18273 -#else
18274 +#elif defined(CONFIG_KMEMCHECK) || defined(CONFIG_MEM_SOFT_DIRTY)
18275 #define _PAGE_NX (_AT(pteval_t, 0))
18276 +#else
18277 +#define _PAGE_NX (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
18278 #endif
18279
18280 #define _PAGE_FILE (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
18281 @@ -147,6 +147,9 @@
18282 #define PAGE_READONLY_EXEC __pgprot(_PAGE_PRESENT | _PAGE_USER | \
18283 _PAGE_ACCESSED)
18284
18285 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
18286 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
18287 +
18288 #define __PAGE_KERNEL_EXEC \
18289 (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
18290 #define __PAGE_KERNEL (__PAGE_KERNEL_EXEC | _PAGE_NX)
18291 @@ -157,7 +160,7 @@
18292 #define __PAGE_KERNEL_WC (__PAGE_KERNEL | _PAGE_CACHE_WC)
18293 #define __PAGE_KERNEL_NOCACHE (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
18294 #define __PAGE_KERNEL_UC_MINUS (__PAGE_KERNEL | _PAGE_PCD)
18295 -#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RX | _PAGE_USER)
18296 +#define __PAGE_KERNEL_VSYSCALL (__PAGE_KERNEL_RO | _PAGE_USER)
18297 #define __PAGE_KERNEL_VVAR (__PAGE_KERNEL_RO | _PAGE_USER)
18298 #define __PAGE_KERNEL_VVAR_NOCACHE (__PAGE_KERNEL_VVAR | _PAGE_PCD | _PAGE_PWT)
18299 #define __PAGE_KERNEL_LARGE (__PAGE_KERNEL | _PAGE_PSE)
18300 @@ -219,8 +222,8 @@
18301 * bits are combined, this will alow user to access the high address mapped
18302 * VDSO in the presence of CONFIG_COMPAT_VDSO
18303 */
18304 -#define PTE_IDENT_ATTR 0x003 /* PRESENT+RW */
18305 -#define PDE_IDENT_ATTR 0x067 /* PRESENT+RW+USER+DIRTY+ACCESSED */
18306 +#define PTE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
18307 +#define PDE_IDENT_ATTR 0x063 /* PRESENT+RW+DIRTY+ACCESSED */
18308 #define PGD_IDENT_ATTR 0x001 /* PRESENT (no other attributes) */
18309 #endif
18310
18311 @@ -258,7 +261,17 @@ static inline pgdval_t pgd_flags(pgd_t pgd)
18312 {
18313 return native_pgd_val(pgd) & PTE_FLAGS_MASK;
18314 }
18315 +#endif
18316
18317 +#if PAGETABLE_LEVELS == 3
18318 +#include <asm-generic/pgtable-nopud.h>
18319 +#endif
18320 +
18321 +#if PAGETABLE_LEVELS == 2
18322 +#include <asm-generic/pgtable-nopmd.h>
18323 +#endif
18324 +
18325 +#ifndef __ASSEMBLY__
18326 #if PAGETABLE_LEVELS > 3
18327 typedef struct { pudval_t pud; } pud_t;
18328
18329 @@ -272,8 +285,6 @@ static inline pudval_t native_pud_val(pud_t pud)
18330 return pud.pud;
18331 }
18332 #else
18333 -#include <asm-generic/pgtable-nopud.h>
18334 -
18335 static inline pudval_t native_pud_val(pud_t pud)
18336 {
18337 return native_pgd_val(pud.pgd);
18338 @@ -293,8 +304,6 @@ static inline pmdval_t native_pmd_val(pmd_t pmd)
18339 return pmd.pmd;
18340 }
18341 #else
18342 -#include <asm-generic/pgtable-nopmd.h>
18343 -
18344 static inline pmdval_t native_pmd_val(pmd_t pmd)
18345 {
18346 return native_pgd_val(pmd.pud.pgd);
18347 @@ -334,7 +343,6 @@ typedef struct page *pgtable_t;
18348
18349 extern pteval_t __supported_pte_mask;
18350 extern void set_nx(void);
18351 -extern int nx_enabled;
18352
18353 #define pgprot_writecombine pgprot_writecombine
18354 extern pgprot_t pgprot_writecombine(pgprot_t prot);
18355 diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
18356 index b39e194..9d44fd1 100644
18357 --- a/arch/x86/include/asm/preempt.h
18358 +++ b/arch/x86/include/asm/preempt.h
18359 @@ -99,7 +99,7 @@ static __always_inline void __preempt_count_sub(int val)
18360 */
18361 static __always_inline bool __preempt_count_dec_and_test(void)
18362 {
18363 - GEN_UNARY_RMWcc("decl", __preempt_count, __percpu_arg(0), "e");
18364 + GEN_UNARY_RMWcc("decl", "incl", __preempt_count, __percpu_arg(0), "e");
18365 }
18366
18367 /*
18368 diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
18369 index fdedd38..95c02c2 100644
18370 --- a/arch/x86/include/asm/processor.h
18371 +++ b/arch/x86/include/asm/processor.h
18372 @@ -128,7 +128,7 @@ struct cpuinfo_x86 {
18373 /* Index into per_cpu list: */
18374 u16 cpu_index;
18375 u32 microcode;
18376 -} __attribute__((__aligned__(SMP_CACHE_BYTES)));
18377 +} __attribute__((__aligned__(SMP_CACHE_BYTES))) __randomize_layout;
18378
18379 #define X86_VENDOR_INTEL 0
18380 #define X86_VENDOR_CYRIX 1
18381 @@ -199,9 +199,21 @@ static inline void native_cpuid(unsigned int *eax, unsigned int *ebx,
18382 : "memory");
18383 }
18384
18385 +/* invpcid (%rdx),%rax */
18386 +#define __ASM_INVPCID ".byte 0x66,0x0f,0x38,0x82,0x02"
18387 +
18388 +#define INVPCID_SINGLE_ADDRESS 0UL
18389 +#define INVPCID_SINGLE_CONTEXT 1UL
18390 +#define INVPCID_ALL_GLOBAL 2UL
18391 +#define INVPCID_ALL_MONGLOBAL 3UL
18392 +
18393 +#define PCID_KERNEL 0UL
18394 +#define PCID_USER 1UL
18395 +#define PCID_NOFLUSH (1UL << 63)
18396 +
18397 static inline void load_cr3(pgd_t *pgdir)
18398 {
18399 - write_cr3(__pa(pgdir));
18400 + write_cr3(__pa(pgdir) | PCID_KERNEL);
18401 }
18402
18403 #ifdef CONFIG_X86_32
18404 @@ -283,7 +295,7 @@ struct tss_struct {
18405
18406 } ____cacheline_aligned;
18407
18408 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
18409 +extern struct tss_struct init_tss[NR_CPUS];
18410
18411 /*
18412 * Save the original ist values for checking stack pointers during debugging
18413 @@ -470,6 +482,7 @@ struct thread_struct {
18414 unsigned short ds;
18415 unsigned short fsindex;
18416 unsigned short gsindex;
18417 + unsigned short ss;
18418 #endif
18419 #ifdef CONFIG_X86_32
18420 unsigned long ip;
18421 @@ -579,29 +592,8 @@ static inline void load_sp0(struct tss_struct *tss,
18422 extern unsigned long mmu_cr4_features;
18423 extern u32 *trampoline_cr4_features;
18424
18425 -static inline void set_in_cr4(unsigned long mask)
18426 -{
18427 - unsigned long cr4;
18428 -
18429 - mmu_cr4_features |= mask;
18430 - if (trampoline_cr4_features)
18431 - *trampoline_cr4_features = mmu_cr4_features;
18432 - cr4 = read_cr4();
18433 - cr4 |= mask;
18434 - write_cr4(cr4);
18435 -}
18436 -
18437 -static inline void clear_in_cr4(unsigned long mask)
18438 -{
18439 - unsigned long cr4;
18440 -
18441 - mmu_cr4_features &= ~mask;
18442 - if (trampoline_cr4_features)
18443 - *trampoline_cr4_features = mmu_cr4_features;
18444 - cr4 = read_cr4();
18445 - cr4 &= ~mask;
18446 - write_cr4(cr4);
18447 -}
18448 +extern void set_in_cr4(unsigned long mask);
18449 +extern void clear_in_cr4(unsigned long mask);
18450
18451 typedef struct {
18452 unsigned long seg;
18453 @@ -827,11 +819,18 @@ static inline void spin_lock_prefetch(const void *x)
18454 */
18455 #define TASK_SIZE PAGE_OFFSET
18456 #define TASK_SIZE_MAX TASK_SIZE
18457 +
18458 +#ifdef CONFIG_PAX_SEGMEXEC
18459 +#define SEGMEXEC_TASK_SIZE (TASK_SIZE / 2)
18460 +#define STACK_TOP ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
18461 +#else
18462 #define STACK_TOP TASK_SIZE
18463 -#define STACK_TOP_MAX STACK_TOP
18464 +#endif
18465 +
18466 +#define STACK_TOP_MAX TASK_SIZE
18467
18468 #define INIT_THREAD { \
18469 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
18470 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
18471 .vm86_info = NULL, \
18472 .sysenter_cs = __KERNEL_CS, \
18473 .io_bitmap_ptr = NULL, \
18474 @@ -845,7 +844,7 @@ static inline void spin_lock_prefetch(const void *x)
18475 */
18476 #define INIT_TSS { \
18477 .x86_tss = { \
18478 - .sp0 = sizeof(init_stack) + (long)&init_stack, \
18479 + .sp0 = sizeof(init_stack) + (long)&init_stack - 8, \
18480 .ss0 = __KERNEL_DS, \
18481 .ss1 = __KERNEL_CS, \
18482 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET, \
18483 @@ -856,11 +855,7 @@ static inline void spin_lock_prefetch(const void *x)
18484 extern unsigned long thread_saved_pc(struct task_struct *tsk);
18485
18486 #define THREAD_SIZE_LONGS (THREAD_SIZE/sizeof(unsigned long))
18487 -#define KSTK_TOP(info) \
18488 -({ \
18489 - unsigned long *__ptr = (unsigned long *)(info); \
18490 - (unsigned long)(&__ptr[THREAD_SIZE_LONGS]); \
18491 -})
18492 +#define KSTK_TOP(info) ((container_of(info, struct task_struct, tinfo))->thread.sp0)
18493
18494 /*
18495 * The below -8 is to reserve 8 bytes on top of the ring0 stack.
18496 @@ -875,7 +870,7 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
18497 #define task_pt_regs(task) \
18498 ({ \
18499 struct pt_regs *__regs__; \
18500 - __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
18501 + __regs__ = (struct pt_regs *)((task)->thread.sp0); \
18502 __regs__ - 1; \
18503 })
18504
18505 @@ -885,13 +880,13 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
18506 /*
18507 * User space process size. 47bits minus one guard page.
18508 */
18509 -#define TASK_SIZE_MAX ((1UL << 47) - PAGE_SIZE)
18510 +#define TASK_SIZE_MAX ((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
18511
18512 /* This decides where the kernel will search for a free chunk of vm
18513 * space during mmap's.
18514 */
18515 #define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? \
18516 - 0xc0000000 : 0xFFFFe000)
18517 + 0xc0000000 : 0xFFFFf000)
18518
18519 #define TASK_SIZE (test_thread_flag(TIF_ADDR32) ? \
18520 IA32_PAGE_OFFSET : TASK_SIZE_MAX)
18521 @@ -902,11 +897,11 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
18522 #define STACK_TOP_MAX TASK_SIZE_MAX
18523
18524 #define INIT_THREAD { \
18525 - .sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
18526 + .sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
18527 }
18528
18529 #define INIT_TSS { \
18530 - .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
18531 + .x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
18532 }
18533
18534 /*
18535 @@ -934,6 +929,10 @@ extern void start_thread(struct pt_regs *regs, unsigned long new_ip,
18536 */
18537 #define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 3))
18538
18539 +#ifdef CONFIG_PAX_SEGMEXEC
18540 +#define SEGMEXEC_TASK_UNMAPPED_BASE (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
18541 +#endif
18542 +
18543 #define KSTK_EIP(task) (task_pt_regs(task)->ip)
18544
18545 /* Get/set a process' ability to use the timestamp counter instruction */
18546 @@ -960,7 +959,7 @@ static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves)
18547 return 0;
18548 }
18549
18550 -extern unsigned long arch_align_stack(unsigned long sp);
18551 +#define arch_align_stack(x) ((x) & ~0xfUL)
18552 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
18553
18554 void default_idle(void);
18555 @@ -970,6 +969,6 @@ bool xen_set_default_idle(void);
18556 #define xen_set_default_idle 0
18557 #endif
18558
18559 -void stop_this_cpu(void *dummy);
18560 +void stop_this_cpu(void *dummy) __noreturn;
18561 void df_debug(struct pt_regs *regs, long error_code);
18562 #endif /* _ASM_X86_PROCESSOR_H */
18563 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
18564 index 14fd6fd..6740420 100644
18565 --- a/arch/x86/include/asm/ptrace.h
18566 +++ b/arch/x86/include/asm/ptrace.h
18567 @@ -84,28 +84,29 @@ static inline unsigned long regs_return_value(struct pt_regs *regs)
18568 }
18569
18570 /*
18571 - * user_mode_vm(regs) determines whether a register set came from user mode.
18572 + * user_mode(regs) determines whether a register set came from user mode.
18573 * This is true if V8086 mode was enabled OR if the register set was from
18574 * protected mode with RPL-3 CS value. This tricky test checks that with
18575 * one comparison. Many places in the kernel can bypass this full check
18576 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
18577 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
18578 + * be used.
18579 */
18580 -static inline int user_mode(struct pt_regs *regs)
18581 +static inline int user_mode_novm(struct pt_regs *regs)
18582 {
18583 #ifdef CONFIG_X86_32
18584 return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
18585 #else
18586 - return !!(regs->cs & 3);
18587 + return !!(regs->cs & SEGMENT_RPL_MASK);
18588 #endif
18589 }
18590
18591 -static inline int user_mode_vm(struct pt_regs *regs)
18592 +static inline int user_mode(struct pt_regs *regs)
18593 {
18594 #ifdef CONFIG_X86_32
18595 return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
18596 USER_RPL;
18597 #else
18598 - return user_mode(regs);
18599 + return user_mode_novm(regs);
18600 #endif
18601 }
18602
18603 @@ -121,15 +122,16 @@ static inline int v8086_mode(struct pt_regs *regs)
18604 #ifdef CONFIG_X86_64
18605 static inline bool user_64bit_mode(struct pt_regs *regs)
18606 {
18607 + unsigned long cs = regs->cs & 0xffff;
18608 #ifndef CONFIG_PARAVIRT
18609 /*
18610 * On non-paravirt systems, this is the only long mode CPL 3
18611 * selector. We do not allow long mode selectors in the LDT.
18612 */
18613 - return regs->cs == __USER_CS;
18614 + return cs == __USER_CS;
18615 #else
18616 /* Headers are too twisted for this to go in paravirt.h. */
18617 - return regs->cs == __USER_CS || regs->cs == pv_info.extra_user_64bit_cs;
18618 + return cs == __USER_CS || cs == pv_info.extra_user_64bit_cs;
18619 #endif
18620 }
18621
18622 @@ -180,9 +182,11 @@ static inline unsigned long regs_get_register(struct pt_regs *regs,
18623 * Traps from the kernel do not save sp and ss.
18624 * Use the helper function to retrieve sp.
18625 */
18626 - if (offset == offsetof(struct pt_regs, sp) &&
18627 - regs->cs == __KERNEL_CS)
18628 - return kernel_stack_pointer(regs);
18629 + if (offset == offsetof(struct pt_regs, sp)) {
18630 + unsigned long cs = regs->cs & 0xffff;
18631 + if (cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS)
18632 + return kernel_stack_pointer(regs);
18633 + }
18634 #endif
18635 return *(unsigned long *)((unsigned long)regs + offset);
18636 }
18637 diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
18638 index 9c6b890..5305f53 100644
18639 --- a/arch/x86/include/asm/realmode.h
18640 +++ b/arch/x86/include/asm/realmode.h
18641 @@ -22,16 +22,14 @@ struct real_mode_header {
18642 #endif
18643 /* APM/BIOS reboot */
18644 u32 machine_real_restart_asm;
18645 -#ifdef CONFIG_X86_64
18646 u32 machine_real_restart_seg;
18647 -#endif
18648 };
18649
18650 /* This must match data at trampoline_32/64.S */
18651 struct trampoline_header {
18652 #ifdef CONFIG_X86_32
18653 u32 start;
18654 - u16 gdt_pad;
18655 + u16 boot_cs;
18656 u16 gdt_limit;
18657 u32 gdt_base;
18658 #else
18659 diff --git a/arch/x86/include/asm/reboot.h b/arch/x86/include/asm/reboot.h
18660 index a82c4f1..ac45053 100644
18661 --- a/arch/x86/include/asm/reboot.h
18662 +++ b/arch/x86/include/asm/reboot.h
18663 @@ -6,13 +6,13 @@
18664 struct pt_regs;
18665
18666 struct machine_ops {
18667 - void (*restart)(char *cmd);
18668 - void (*halt)(void);
18669 - void (*power_off)(void);
18670 + void (* __noreturn restart)(char *cmd);
18671 + void (* __noreturn halt)(void);
18672 + void (* __noreturn power_off)(void);
18673 void (*shutdown)(void);
18674 void (*crash_shutdown)(struct pt_regs *);
18675 - void (*emergency_restart)(void);
18676 -};
18677 + void (* __noreturn emergency_restart)(void);
18678 +} __no_const;
18679
18680 extern struct machine_ops machine_ops;
18681
18682 diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h
18683 index 8f7866a..e442f20 100644
18684 --- a/arch/x86/include/asm/rmwcc.h
18685 +++ b/arch/x86/include/asm/rmwcc.h
18686 @@ -3,7 +3,34 @@
18687
18688 #ifdef CC_HAVE_ASM_GOTO
18689
18690 -#define __GEN_RMWcc(fullop, var, cc, ...) \
18691 +#ifdef CONFIG_PAX_REFCOUNT
18692 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18693 +do { \
18694 + asm_volatile_goto (fullop \
18695 + ";jno 0f\n" \
18696 + fullantiop \
18697 + ";int $4\n0:\n" \
18698 + _ASM_EXTABLE(0b, 0b) \
18699 + ";j" cc " %l[cc_label]" \
18700 + : : "m" (var), ## __VA_ARGS__ \
18701 + : "memory" : cc_label); \
18702 + return 0; \
18703 +cc_label: \
18704 + return 1; \
18705 +} while (0)
18706 +#else
18707 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18708 +do { \
18709 + asm_volatile_goto (fullop ";j" cc " %l[cc_label]" \
18710 + : : "m" (var), ## __VA_ARGS__ \
18711 + : "memory" : cc_label); \
18712 + return 0; \
18713 +cc_label: \
18714 + return 1; \
18715 +} while (0)
18716 +#endif
18717 +
18718 +#define __GEN_RMWcc_unchecked(fullop, var, cc, ...) \
18719 do { \
18720 asm_volatile_goto (fullop "; j" cc " %l[cc_label]" \
18721 : : "m" (var), ## __VA_ARGS__ \
18722 @@ -13,15 +40,46 @@ cc_label: \
18723 return 1; \
18724 } while (0)
18725
18726 -#define GEN_UNARY_RMWcc(op, var, arg0, cc) \
18727 - __GEN_RMWcc(op " " arg0, var, cc)
18728 +#define GEN_UNARY_RMWcc(op, antiop, var, arg0, cc) \
18729 + __GEN_RMWcc(op " " arg0, antiop " " arg0, var, cc)
18730
18731 -#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
18732 - __GEN_RMWcc(op " %1, " arg0, var, cc, vcon (val))
18733 +#define GEN_UNARY_RMWcc_unchecked(op, var, arg0, cc) \
18734 + __GEN_RMWcc_unchecked(op " " arg0, var, cc)
18735 +
18736 +#define GEN_BINARY_RMWcc(op, antiop, var, vcon, val, arg0, cc) \
18737 + __GEN_RMWcc(op " %1, " arg0, antiop " %1, " arg0, var, cc, vcon (val))
18738 +
18739 +#define GEN_BINARY_RMWcc_unchecked(op, var, vcon, val, arg0, cc) \
18740 + __GEN_RMWcc_unchecked(op " %1, " arg0, var, cc, vcon (val))
18741
18742 #else /* !CC_HAVE_ASM_GOTO */
18743
18744 -#define __GEN_RMWcc(fullop, var, cc, ...) \
18745 +#ifdef CONFIG_PAX_REFCOUNT
18746 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18747 +do { \
18748 + char c; \
18749 + asm volatile (fullop \
18750 + ";jno 0f\n" \
18751 + fullantiop \
18752 + ";int $4\n0:\n" \
18753 + _ASM_EXTABLE(0b, 0b) \
18754 + "; set" cc " %1" \
18755 + : "+m" (var), "=qm" (c) \
18756 + : __VA_ARGS__ : "memory"); \
18757 + return c != 0; \
18758 +} while (0)
18759 +#else
18760 +#define __GEN_RMWcc(fullop, fullantiop, var, cc, ...) \
18761 +do { \
18762 + char c; \
18763 + asm volatile (fullop "; set" cc " %1" \
18764 + : "+m" (var), "=qm" (c) \
18765 + : __VA_ARGS__ : "memory"); \
18766 + return c != 0; \
18767 +} while (0)
18768 +#endif
18769 +
18770 +#define __GEN_RMWcc_unchecked(fullop, var, cc, ...) \
18771 do { \
18772 char c; \
18773 asm volatile (fullop "; set" cc " %1" \
18774 @@ -30,11 +88,17 @@ do { \
18775 return c != 0; \
18776 } while (0)
18777
18778 -#define GEN_UNARY_RMWcc(op, var, arg0, cc) \
18779 - __GEN_RMWcc(op " " arg0, var, cc)
18780 +#define GEN_UNARY_RMWcc(op, antiop, var, arg0, cc) \
18781 + __GEN_RMWcc(op " " arg0, antiop " " arg0, var, cc)
18782 +
18783 +#define GEN_UNARY_RMWcc_unchecked(op, var, arg0, cc) \
18784 + __GEN_RMWcc_unchecked(op " " arg0, var, cc)
18785 +
18786 +#define GEN_BINARY_RMWcc(op, antiop, var, vcon, val, arg0, cc) \
18787 + __GEN_RMWcc(op " %2, " arg0, antiop " %2, " arg0, var, cc, vcon (val))
18788
18789 -#define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \
18790 - __GEN_RMWcc(op " %2, " arg0, var, cc, vcon (val))
18791 +#define GEN_BINARY_RMWcc_unchecked(op, var, vcon, val, arg0, cc) \
18792 + __GEN_RMWcc_unchecked(op " %2, " arg0, var, cc, vcon (val))
18793
18794 #endif /* CC_HAVE_ASM_GOTO */
18795
18796 diff --git a/arch/x86/include/asm/rwsem.h b/arch/x86/include/asm/rwsem.h
18797 index cad82c9..2e5c5c1 100644
18798 --- a/arch/x86/include/asm/rwsem.h
18799 +++ b/arch/x86/include/asm/rwsem.h
18800 @@ -64,6 +64,14 @@ static inline void __down_read(struct rw_semaphore *sem)
18801 {
18802 asm volatile("# beginning down_read\n\t"
18803 LOCK_PREFIX _ASM_INC "(%1)\n\t"
18804 +
18805 +#ifdef CONFIG_PAX_REFCOUNT
18806 + "jno 0f\n"
18807 + LOCK_PREFIX _ASM_DEC "(%1)\n"
18808 + "int $4\n0:\n"
18809 + _ASM_EXTABLE(0b, 0b)
18810 +#endif
18811 +
18812 /* adds 0x00000001 */
18813 " jns 1f\n"
18814 " call call_rwsem_down_read_failed\n"
18815 @@ -85,6 +93,14 @@ static inline int __down_read_trylock(struct rw_semaphore *sem)
18816 "1:\n\t"
18817 " mov %1,%2\n\t"
18818 " add %3,%2\n\t"
18819 +
18820 +#ifdef CONFIG_PAX_REFCOUNT
18821 + "jno 0f\n"
18822 + "sub %3,%2\n"
18823 + "int $4\n0:\n"
18824 + _ASM_EXTABLE(0b, 0b)
18825 +#endif
18826 +
18827 " jle 2f\n\t"
18828 LOCK_PREFIX " cmpxchg %2,%0\n\t"
18829 " jnz 1b\n\t"
18830 @@ -104,6 +120,14 @@ static inline void __down_write_nested(struct rw_semaphore *sem, int subclass)
18831 long tmp;
18832 asm volatile("# beginning down_write\n\t"
18833 LOCK_PREFIX " xadd %1,(%2)\n\t"
18834 +
18835 +#ifdef CONFIG_PAX_REFCOUNT
18836 + "jno 0f\n"
18837 + "mov %1,(%2)\n"
18838 + "int $4\n0:\n"
18839 + _ASM_EXTABLE(0b, 0b)
18840 +#endif
18841 +
18842 /* adds 0xffff0001, returns the old value */
18843 " test " __ASM_SEL(%w1,%k1) "," __ASM_SEL(%w1,%k1) "\n\t"
18844 /* was the active mask 0 before? */
18845 @@ -155,6 +179,14 @@ static inline void __up_read(struct rw_semaphore *sem)
18846 long tmp;
18847 asm volatile("# beginning __up_read\n\t"
18848 LOCK_PREFIX " xadd %1,(%2)\n\t"
18849 +
18850 +#ifdef CONFIG_PAX_REFCOUNT
18851 + "jno 0f\n"
18852 + "mov %1,(%2)\n"
18853 + "int $4\n0:\n"
18854 + _ASM_EXTABLE(0b, 0b)
18855 +#endif
18856 +
18857 /* subtracts 1, returns the old value */
18858 " jns 1f\n\t"
18859 " call call_rwsem_wake\n" /* expects old value in %edx */
18860 @@ -173,6 +205,14 @@ static inline void __up_write(struct rw_semaphore *sem)
18861 long tmp;
18862 asm volatile("# beginning __up_write\n\t"
18863 LOCK_PREFIX " xadd %1,(%2)\n\t"
18864 +
18865 +#ifdef CONFIG_PAX_REFCOUNT
18866 + "jno 0f\n"
18867 + "mov %1,(%2)\n"
18868 + "int $4\n0:\n"
18869 + _ASM_EXTABLE(0b, 0b)
18870 +#endif
18871 +
18872 /* subtracts 0xffff0001, returns the old value */
18873 " jns 1f\n\t"
18874 " call call_rwsem_wake\n" /* expects old value in %edx */
18875 @@ -190,6 +230,14 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
18876 {
18877 asm volatile("# beginning __downgrade_write\n\t"
18878 LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
18879 +
18880 +#ifdef CONFIG_PAX_REFCOUNT
18881 + "jno 0f\n"
18882 + LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
18883 + "int $4\n0:\n"
18884 + _ASM_EXTABLE(0b, 0b)
18885 +#endif
18886 +
18887 /*
18888 * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
18889 * 0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
18890 @@ -208,7 +256,15 @@ static inline void __downgrade_write(struct rw_semaphore *sem)
18891 */
18892 static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
18893 {
18894 - asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
18895 + asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
18896 +
18897 +#ifdef CONFIG_PAX_REFCOUNT
18898 + "jno 0f\n"
18899 + LOCK_PREFIX _ASM_SUB "%1,%0\n"
18900 + "int $4\n0:\n"
18901 + _ASM_EXTABLE(0b, 0b)
18902 +#endif
18903 +
18904 : "+m" (sem->count)
18905 : "er" (delta));
18906 }
18907 @@ -218,7 +274,7 @@ static inline void rwsem_atomic_add(long delta, struct rw_semaphore *sem)
18908 */
18909 static inline long rwsem_atomic_update(long delta, struct rw_semaphore *sem)
18910 {
18911 - return delta + xadd(&sem->count, delta);
18912 + return delta + xadd_check_overflow(&sem->count, delta);
18913 }
18914
18915 #endif /* __KERNEL__ */
18916 diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
18917 index 6f1c3a8..7744f19 100644
18918 --- a/arch/x86/include/asm/segment.h
18919 +++ b/arch/x86/include/asm/segment.h
18920 @@ -64,10 +64,15 @@
18921 * 26 - ESPFIX small SS
18922 * 27 - per-cpu [ offset to per-cpu data area ]
18923 * 28 - stack_canary-20 [ for stack protector ]
18924 - * 29 - unused
18925 - * 30 - unused
18926 + * 29 - PCI BIOS CS
18927 + * 30 - PCI BIOS DS
18928 * 31 - TSS for double fault handler
18929 */
18930 +#define GDT_ENTRY_KERNEXEC_EFI_CS (1)
18931 +#define GDT_ENTRY_KERNEXEC_EFI_DS (2)
18932 +#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8)
18933 +#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8)
18934 +
18935 #define GDT_ENTRY_TLS_MIN 6
18936 #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1)
18937
18938 @@ -79,6 +84,8 @@
18939
18940 #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE+0)
18941
18942 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS (4)
18943 +
18944 #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE+1)
18945
18946 #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE+4)
18947 @@ -104,6 +111,12 @@
18948 #define __KERNEL_STACK_CANARY 0
18949 #endif
18950
18951 +#define GDT_ENTRY_PCIBIOS_CS (GDT_ENTRY_KERNEL_BASE+17)
18952 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
18953 +
18954 +#define GDT_ENTRY_PCIBIOS_DS (GDT_ENTRY_KERNEL_BASE+18)
18955 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
18956 +
18957 #define GDT_ENTRY_DOUBLEFAULT_TSS 31
18958
18959 /*
18960 @@ -141,7 +154,7 @@
18961 */
18962
18963 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
18964 -#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
18965 +#define SEGMENT_IS_PNP_CODE(x) (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
18966
18967
18968 #else
18969 @@ -165,6 +178,8 @@
18970 #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS*8+3)
18971 #define __USER32_DS __USER_DS
18972
18973 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
18974 +
18975 #define GDT_ENTRY_TSS 8 /* needs two entries */
18976 #define GDT_ENTRY_LDT 10 /* needs two entries */
18977 #define GDT_ENTRY_TLS_MIN 12
18978 @@ -173,6 +188,8 @@
18979 #define GDT_ENTRY_PER_CPU 15 /* Abused to load per CPU data from limit */
18980 #define __PER_CPU_SEG (GDT_ENTRY_PER_CPU * 8 + 3)
18981
18982 +#define GDT_ENTRY_UDEREF_KERNEL_DS 16
18983 +
18984 /* TLS indexes for 64bit - hardcoded in arch_prctl */
18985 #define FS_TLS 0
18986 #define GS_TLS 1
18987 @@ -180,12 +197,14 @@
18988 #define GS_TLS_SEL ((GDT_ENTRY_TLS_MIN+GS_TLS)*8 + 3)
18989 #define FS_TLS_SEL ((GDT_ENTRY_TLS_MIN+FS_TLS)*8 + 3)
18990
18991 -#define GDT_ENTRIES 16
18992 +#define GDT_ENTRIES 17
18993
18994 #endif
18995
18996 #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS*8)
18997 +#define __KERNEXEC_KERNEL_CS (GDT_ENTRY_KERNEXEC_KERNEL_CS*8)
18998 #define __KERNEL_DS (GDT_ENTRY_KERNEL_DS*8)
18999 +#define __UDEREF_KERNEL_DS (GDT_ENTRY_UDEREF_KERNEL_DS*8)
19000 #define __USER_DS (GDT_ENTRY_DEFAULT_USER_DS*8+3)
19001 #define __USER_CS (GDT_ENTRY_DEFAULT_USER_CS*8+3)
19002 #ifndef CONFIG_PARAVIRT
19003 @@ -268,7 +287,7 @@ static inline unsigned long get_limit(unsigned long segment)
19004 {
19005 unsigned long __limit;
19006 asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
19007 - return __limit + 1;
19008 + return __limit;
19009 }
19010
19011 #endif /* !__ASSEMBLY__ */
19012 diff --git a/arch/x86/include/asm/smap.h b/arch/x86/include/asm/smap.h
19013 index 8d3120f..352b440 100644
19014 --- a/arch/x86/include/asm/smap.h
19015 +++ b/arch/x86/include/asm/smap.h
19016 @@ -25,11 +25,40 @@
19017
19018 #include <asm/alternative-asm.h>
19019
19020 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19021 +#define ASM_PAX_OPEN_USERLAND \
19022 + 661: jmp 663f; \
19023 + .pushsection .altinstr_replacement, "a" ; \
19024 + 662: pushq %rax; nop; \
19025 + .popsection ; \
19026 + .pushsection .altinstructions, "a" ; \
19027 + altinstruction_entry 661b, 662b, X86_FEATURE_STRONGUDEREF, 2, 2;\
19028 + .popsection ; \
19029 + call __pax_open_userland; \
19030 + popq %rax; \
19031 + 663:
19032 +
19033 +#define ASM_PAX_CLOSE_USERLAND \
19034 + 661: jmp 663f; \
19035 + .pushsection .altinstr_replacement, "a" ; \
19036 + 662: pushq %rax; nop; \
19037 + .popsection; \
19038 + .pushsection .altinstructions, "a" ; \
19039 + altinstruction_entry 661b, 662b, X86_FEATURE_STRONGUDEREF, 2, 2;\
19040 + .popsection; \
19041 + call __pax_close_userland; \
19042 + popq %rax; \
19043 + 663:
19044 +#else
19045 +#define ASM_PAX_OPEN_USERLAND
19046 +#define ASM_PAX_CLOSE_USERLAND
19047 +#endif
19048 +
19049 #ifdef CONFIG_X86_SMAP
19050
19051 #define ASM_CLAC \
19052 661: ASM_NOP3 ; \
19053 - .pushsection .altinstr_replacement, "ax" ; \
19054 + .pushsection .altinstr_replacement, "a" ; \
19055 662: __ASM_CLAC ; \
19056 .popsection ; \
19057 .pushsection .altinstructions, "a" ; \
19058 @@ -38,7 +67,7 @@
19059
19060 #define ASM_STAC \
19061 661: ASM_NOP3 ; \
19062 - .pushsection .altinstr_replacement, "ax" ; \
19063 + .pushsection .altinstr_replacement, "a" ; \
19064 662: __ASM_STAC ; \
19065 .popsection ; \
19066 .pushsection .altinstructions, "a" ; \
19067 @@ -56,6 +85,37 @@
19068
19069 #include <asm/alternative.h>
19070
19071 +#define __HAVE_ARCH_PAX_OPEN_USERLAND
19072 +#define __HAVE_ARCH_PAX_CLOSE_USERLAND
19073 +
19074 +extern void __pax_open_userland(void);
19075 +static __always_inline unsigned long pax_open_userland(void)
19076 +{
19077 +
19078 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19079 + asm volatile(ALTERNATIVE(ASM_NOP5, "call %P[open]", X86_FEATURE_STRONGUDEREF)
19080 + :
19081 + : [open] "i" (__pax_open_userland)
19082 + : "memory", "rax");
19083 +#endif
19084 +
19085 + return 0;
19086 +}
19087 +
19088 +extern void __pax_close_userland(void);
19089 +static __always_inline unsigned long pax_close_userland(void)
19090 +{
19091 +
19092 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19093 + asm volatile(ALTERNATIVE(ASM_NOP5, "call %P[close]", X86_FEATURE_STRONGUDEREF)
19094 + :
19095 + : [close] "i" (__pax_close_userland)
19096 + : "memory", "rax");
19097 +#endif
19098 +
19099 + return 0;
19100 +}
19101 +
19102 #ifdef CONFIG_X86_SMAP
19103
19104 static __always_inline void clac(void)
19105 diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
19106 index 8cd27e0..7f05ec8 100644
19107 --- a/arch/x86/include/asm/smp.h
19108 +++ b/arch/x86/include/asm/smp.h
19109 @@ -35,7 +35,7 @@ DECLARE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_core_map);
19110 /* cpus sharing the last level cache: */
19111 DECLARE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_llc_shared_map);
19112 DECLARE_PER_CPU_READ_MOSTLY(u16, cpu_llc_id);
19113 -DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number);
19114 +DECLARE_PER_CPU_READ_MOSTLY(unsigned int, cpu_number);
19115
19116 static inline struct cpumask *cpu_sibling_mask(int cpu)
19117 {
19118 @@ -78,7 +78,7 @@ struct smp_ops {
19119
19120 void (*send_call_func_ipi)(const struct cpumask *mask);
19121 void (*send_call_func_single_ipi)(int cpu);
19122 -};
19123 +} __no_const;
19124
19125 /* Globals due to paravirt */
19126 extern void set_cpu_sibling_map(int cpu);
19127 @@ -190,14 +190,8 @@ extern unsigned disabled_cpus;
19128 extern int safe_smp_processor_id(void);
19129
19130 #elif defined(CONFIG_X86_64_SMP)
19131 -#define raw_smp_processor_id() (this_cpu_read(cpu_number))
19132 -
19133 -#define stack_smp_processor_id() \
19134 -({ \
19135 - struct thread_info *ti; \
19136 - __asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK)); \
19137 - ti->cpu; \
19138 -})
19139 +#define raw_smp_processor_id() (this_cpu_read(cpu_number))
19140 +#define stack_smp_processor_id() raw_smp_processor_id()
19141 #define safe_smp_processor_id() smp_processor_id()
19142
19143 #endif
19144 diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
19145 index 0f62f54..cb5d0dd 100644
19146 --- a/arch/x86/include/asm/spinlock.h
19147 +++ b/arch/x86/include/asm/spinlock.h
19148 @@ -222,6 +222,14 @@ static inline int arch_write_can_lock(arch_rwlock_t *lock)
19149 static inline void arch_read_lock(arch_rwlock_t *rw)
19150 {
19151 asm volatile(LOCK_PREFIX READ_LOCK_SIZE(dec) " (%0)\n\t"
19152 +
19153 +#ifdef CONFIG_PAX_REFCOUNT
19154 + "jno 0f\n"
19155 + LOCK_PREFIX READ_LOCK_SIZE(inc) " (%0)\n"
19156 + "int $4\n0:\n"
19157 + _ASM_EXTABLE(0b, 0b)
19158 +#endif
19159 +
19160 "jns 1f\n"
19161 "call __read_lock_failed\n\t"
19162 "1:\n"
19163 @@ -231,6 +239,14 @@ static inline void arch_read_lock(arch_rwlock_t *rw)
19164 static inline void arch_write_lock(arch_rwlock_t *rw)
19165 {
19166 asm volatile(LOCK_PREFIX WRITE_LOCK_SUB(%1) "(%0)\n\t"
19167 +
19168 +#ifdef CONFIG_PAX_REFCOUNT
19169 + "jno 0f\n"
19170 + LOCK_PREFIX WRITE_LOCK_ADD(%1) "(%0)\n"
19171 + "int $4\n0:\n"
19172 + _ASM_EXTABLE(0b, 0b)
19173 +#endif
19174 +
19175 "jz 1f\n"
19176 "call __write_lock_failed\n\t"
19177 "1:\n"
19178 @@ -260,13 +276,29 @@ static inline int arch_write_trylock(arch_rwlock_t *lock)
19179
19180 static inline void arch_read_unlock(arch_rwlock_t *rw)
19181 {
19182 - asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0"
19183 + asm volatile(LOCK_PREFIX READ_LOCK_SIZE(inc) " %0\n"
19184 +
19185 +#ifdef CONFIG_PAX_REFCOUNT
19186 + "jno 0f\n"
19187 + LOCK_PREFIX READ_LOCK_SIZE(dec) " %0\n"
19188 + "int $4\n0:\n"
19189 + _ASM_EXTABLE(0b, 0b)
19190 +#endif
19191 +
19192 :"+m" (rw->lock) : : "memory");
19193 }
19194
19195 static inline void arch_write_unlock(arch_rwlock_t *rw)
19196 {
19197 - asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0"
19198 + asm volatile(LOCK_PREFIX WRITE_LOCK_ADD(%1) "%0\n"
19199 +
19200 +#ifdef CONFIG_PAX_REFCOUNT
19201 + "jno 0f\n"
19202 + LOCK_PREFIX WRITE_LOCK_SUB(%1) "%0\n"
19203 + "int $4\n0:\n"
19204 + _ASM_EXTABLE(0b, 0b)
19205 +#endif
19206 +
19207 : "+m" (rw->write) : "i" (RW_LOCK_BIAS) : "memory");
19208 }
19209
19210 diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
19211 index 6a99859..03cb807 100644
19212 --- a/arch/x86/include/asm/stackprotector.h
19213 +++ b/arch/x86/include/asm/stackprotector.h
19214 @@ -47,7 +47,7 @@
19215 * head_32 for boot CPU and setup_per_cpu_areas() for others.
19216 */
19217 #define GDT_STACK_CANARY_INIT \
19218 - [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
19219 + [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
19220
19221 /*
19222 * Initialize the stackprotector canary value.
19223 @@ -112,7 +112,7 @@ static inline void setup_stack_canary_segment(int cpu)
19224
19225 static inline void load_stack_canary_segment(void)
19226 {
19227 -#ifdef CONFIG_X86_32
19228 +#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
19229 asm volatile ("mov %0, %%gs" : : "r" (0));
19230 #endif
19231 }
19232 diff --git a/arch/x86/include/asm/stacktrace.h b/arch/x86/include/asm/stacktrace.h
19233 index 70bbe39..4ae2bd4 100644
19234 --- a/arch/x86/include/asm/stacktrace.h
19235 +++ b/arch/x86/include/asm/stacktrace.h
19236 @@ -11,28 +11,20 @@
19237
19238 extern int kstack_depth_to_print;
19239
19240 -struct thread_info;
19241 +struct task_struct;
19242 struct stacktrace_ops;
19243
19244 -typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
19245 - unsigned long *stack,
19246 - unsigned long bp,
19247 - const struct stacktrace_ops *ops,
19248 - void *data,
19249 - unsigned long *end,
19250 - int *graph);
19251 +typedef unsigned long walk_stack_t(struct task_struct *task,
19252 + void *stack_start,
19253 + unsigned long *stack,
19254 + unsigned long bp,
19255 + const struct stacktrace_ops *ops,
19256 + void *data,
19257 + unsigned long *end,
19258 + int *graph);
19259
19260 -extern unsigned long
19261 -print_context_stack(struct thread_info *tinfo,
19262 - unsigned long *stack, unsigned long bp,
19263 - const struct stacktrace_ops *ops, void *data,
19264 - unsigned long *end, int *graph);
19265 -
19266 -extern unsigned long
19267 -print_context_stack_bp(struct thread_info *tinfo,
19268 - unsigned long *stack, unsigned long bp,
19269 - const struct stacktrace_ops *ops, void *data,
19270 - unsigned long *end, int *graph);
19271 +extern walk_stack_t print_context_stack;
19272 +extern walk_stack_t print_context_stack_bp;
19273
19274 /* Generic stack tracer with callbacks */
19275
19276 @@ -40,7 +32,7 @@ struct stacktrace_ops {
19277 void (*address)(void *data, unsigned long address, int reliable);
19278 /* On negative return stop dumping */
19279 int (*stack)(void *data, char *name);
19280 - walk_stack_t walk_stack;
19281 + walk_stack_t *walk_stack;
19282 };
19283
19284 void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
19285 diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
19286 index d7f3b3b..3cc39f1 100644
19287 --- a/arch/x86/include/asm/switch_to.h
19288 +++ b/arch/x86/include/asm/switch_to.h
19289 @@ -108,7 +108,7 @@ do { \
19290 "call __switch_to\n\t" \
19291 "movq "__percpu_arg([current_task])",%%rsi\n\t" \
19292 __switch_canary \
19293 - "movq %P[thread_info](%%rsi),%%r8\n\t" \
19294 + "movq "__percpu_arg([thread_info])",%%r8\n\t" \
19295 "movq %%rax,%%rdi\n\t" \
19296 "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \
19297 "jnz ret_from_fork\n\t" \
19298 @@ -119,7 +119,7 @@ do { \
19299 [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
19300 [ti_flags] "i" (offsetof(struct thread_info, flags)), \
19301 [_tif_fork] "i" (_TIF_FORK), \
19302 - [thread_info] "i" (offsetof(struct task_struct, stack)), \
19303 + [thread_info] "m" (current_tinfo), \
19304 [current_task] "m" (current_task) \
19305 __switch_canary_iparam \
19306 : "memory", "cc" __EXTRA_CLOBBER)
19307 diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
19308 index e1940c0..ac50dd8 100644
19309 --- a/arch/x86/include/asm/thread_info.h
19310 +++ b/arch/x86/include/asm/thread_info.h
19311 @@ -10,6 +10,7 @@
19312 #include <linux/compiler.h>
19313 #include <asm/page.h>
19314 #include <asm/types.h>
19315 +#include <asm/percpu.h>
19316
19317 /*
19318 * low level task data that entry.S needs immediate access to
19319 @@ -23,7 +24,6 @@ struct exec_domain;
19320 #include <linux/atomic.h>
19321
19322 struct thread_info {
19323 - struct task_struct *task; /* main task structure */
19324 struct exec_domain *exec_domain; /* execution domain */
19325 __u32 flags; /* low level flags */
19326 __u32 status; /* thread synchronous flags */
19327 @@ -32,19 +32,13 @@ struct thread_info {
19328 mm_segment_t addr_limit;
19329 struct restart_block restart_block;
19330 void __user *sysenter_return;
19331 -#ifdef CONFIG_X86_32
19332 - unsigned long previous_esp; /* ESP of the previous stack in
19333 - case of nested (IRQ) stacks
19334 - */
19335 - __u8 supervisor_stack[0];
19336 -#endif
19337 + unsigned long lowest_stack;
19338 unsigned int sig_on_uaccess_error:1;
19339 unsigned int uaccess_err:1; /* uaccess failed */
19340 };
19341
19342 -#define INIT_THREAD_INFO(tsk) \
19343 +#define INIT_THREAD_INFO \
19344 { \
19345 - .task = &tsk, \
19346 .exec_domain = &default_exec_domain, \
19347 .flags = 0, \
19348 .cpu = 0, \
19349 @@ -55,7 +49,7 @@ struct thread_info {
19350 }, \
19351 }
19352
19353 -#define init_thread_info (init_thread_union.thread_info)
19354 +#define init_thread_info (init_thread_union.stack)
19355 #define init_stack (init_thread_union.stack)
19356
19357 #else /* !__ASSEMBLY__ */
19358 @@ -95,6 +89,7 @@ struct thread_info {
19359 #define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
19360 #define TIF_ADDR32 29 /* 32-bit address space on 64 bits */
19361 #define TIF_X32 30 /* 32-bit native x86-64 binary */
19362 +#define TIF_GRSEC_SETXID 31 /* update credentials on syscall entry/exit */
19363
19364 #define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
19365 #define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
19366 @@ -118,17 +113,18 @@ struct thread_info {
19367 #define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
19368 #define _TIF_ADDR32 (1 << TIF_ADDR32)
19369 #define _TIF_X32 (1 << TIF_X32)
19370 +#define _TIF_GRSEC_SETXID (1 << TIF_GRSEC_SETXID)
19371
19372 /* work to do in syscall_trace_enter() */
19373 #define _TIF_WORK_SYSCALL_ENTRY \
19374 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_EMU | _TIF_SYSCALL_AUDIT | \
19375 _TIF_SECCOMP | _TIF_SINGLESTEP | _TIF_SYSCALL_TRACEPOINT | \
19376 - _TIF_NOHZ)
19377 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
19378
19379 /* work to do in syscall_trace_leave() */
19380 #define _TIF_WORK_SYSCALL_EXIT \
19381 (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SINGLESTEP | \
19382 - _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ)
19383 + _TIF_SYSCALL_TRACEPOINT | _TIF_NOHZ | _TIF_GRSEC_SETXID)
19384
19385 /* work to do on interrupt/exception return */
19386 #define _TIF_WORK_MASK \
19387 @@ -139,7 +135,7 @@ struct thread_info {
19388 /* work to do on any return to user space */
19389 #define _TIF_ALLWORK_MASK \
19390 ((0x0000FFFF & ~_TIF_SECCOMP) | _TIF_SYSCALL_TRACEPOINT | \
19391 - _TIF_NOHZ)
19392 + _TIF_NOHZ | _TIF_GRSEC_SETXID)
19393
19394 /* Only used for 64 bit */
19395 #define _TIF_DO_NOTIFY_MASK \
19396 @@ -153,6 +149,23 @@ struct thread_info {
19397 #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
19398 #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
19399
19400 +#ifdef __ASSEMBLY__
19401 +/* how to get the thread information struct from ASM */
19402 +#define GET_THREAD_INFO(reg) \
19403 + mov PER_CPU_VAR(current_tinfo), reg
19404 +
19405 +/* use this one if reg already contains %esp */
19406 +#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
19407 +#else
19408 +/* how to get the thread information struct from C */
19409 +DECLARE_PER_CPU(struct thread_info *, current_tinfo);
19410 +
19411 +static __always_inline struct thread_info *current_thread_info(void)
19412 +{
19413 + return this_cpu_read_stable(current_tinfo);
19414 +}
19415 +#endif
19416 +
19417 #ifdef CONFIG_X86_32
19418
19419 #define STACK_WARN (THREAD_SIZE/8)
19420 @@ -169,31 +182,10 @@ struct thread_info {
19421 sp; \
19422 })
19423
19424 -/* how to get the thread information struct from C */
19425 -static inline struct thread_info *current_thread_info(void)
19426 -{
19427 - return (struct thread_info *)
19428 - (current_stack_pointer & ~(THREAD_SIZE - 1));
19429 -}
19430 -
19431 -#else /* !__ASSEMBLY__ */
19432 -
19433 -/* how to get the thread information struct from ASM */
19434 -#define GET_THREAD_INFO(reg) \
19435 - movl $-THREAD_SIZE, reg; \
19436 - andl %esp, reg
19437 -
19438 -/* use this one if reg already contains %esp */
19439 -#define GET_THREAD_INFO_WITH_ESP(reg) \
19440 - andl $-THREAD_SIZE, reg
19441 -
19442 #endif
19443
19444 #else /* X86_32 */
19445
19446 -#include <asm/percpu.h>
19447 -#define KERNEL_STACK_OFFSET (5*8)
19448 -
19449 /*
19450 * macros/functions for gaining access to the thread information structure
19451 * preempt_count needs to be 1 initially, until the scheduler is functional.
19452 @@ -201,27 +193,8 @@ static inline struct thread_info *current_thread_info(void)
19453 #ifndef __ASSEMBLY__
19454 DECLARE_PER_CPU(unsigned long, kernel_stack);
19455
19456 -static inline struct thread_info *current_thread_info(void)
19457 -{
19458 - struct thread_info *ti;
19459 - ti = (void *)(this_cpu_read_stable(kernel_stack) +
19460 - KERNEL_STACK_OFFSET - THREAD_SIZE);
19461 - return ti;
19462 -}
19463 -
19464 -#else /* !__ASSEMBLY__ */
19465 -
19466 -/* how to get the thread information struct from ASM */
19467 -#define GET_THREAD_INFO(reg) \
19468 - movq PER_CPU_VAR(kernel_stack),reg ; \
19469 - subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
19470 -
19471 -/*
19472 - * Same if PER_CPU_VAR(kernel_stack) is, perhaps with some offset, already in
19473 - * a certain register (to be used in assembler memory operands).
19474 - */
19475 -#define THREAD_INFO(reg, off) KERNEL_STACK_OFFSET+(off)-THREAD_SIZE(reg)
19476 -
19477 +/* how to get the current stack pointer from C */
19478 +register unsigned long current_stack_pointer asm("rsp") __used;
19479 #endif
19480
19481 #endif /* !X86_32 */
19482 @@ -280,5 +253,12 @@ static inline bool is_ia32_task(void)
19483 extern void arch_task_cache_init(void);
19484 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
19485 extern void arch_release_task_struct(struct task_struct *tsk);
19486 +
19487 +#define __HAVE_THREAD_FUNCTIONS
19488 +#define task_thread_info(task) (&(task)->tinfo)
19489 +#define task_stack_page(task) ((task)->stack)
19490 +#define setup_thread_stack(p, org) do {} while (0)
19491 +#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
19492 +
19493 #endif
19494 #endif /* _ASM_X86_THREAD_INFO_H */
19495 diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
19496 index 04905bf..49203ca 100644
19497 --- a/arch/x86/include/asm/tlbflush.h
19498 +++ b/arch/x86/include/asm/tlbflush.h
19499 @@ -17,18 +17,44 @@
19500
19501 static inline void __native_flush_tlb(void)
19502 {
19503 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19504 + u64 descriptor[2];
19505 +
19506 + descriptor[0] = PCID_KERNEL;
19507 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_MONGLOBAL) : "memory");
19508 + return;
19509 + }
19510 +
19511 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19512 + if (static_cpu_has(X86_FEATURE_PCID)) {
19513 + unsigned int cpu = raw_get_cpu();
19514 +
19515 + native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
19516 + native_write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL);
19517 + raw_put_cpu_no_resched();
19518 + return;
19519 + }
19520 +#endif
19521 +
19522 native_write_cr3(native_read_cr3());
19523 }
19524
19525 static inline void __native_flush_tlb_global_irq_disabled(void)
19526 {
19527 - unsigned long cr4;
19528 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19529 + u64 descriptor[2];
19530
19531 - cr4 = native_read_cr4();
19532 - /* clear PGE */
19533 - native_write_cr4(cr4 & ~X86_CR4_PGE);
19534 - /* write old PGE again and flush TLBs */
19535 - native_write_cr4(cr4);
19536 + descriptor[0] = PCID_KERNEL;
19537 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_ALL_GLOBAL) : "memory");
19538 + } else {
19539 + unsigned long cr4;
19540 +
19541 + cr4 = native_read_cr4();
19542 + /* clear PGE */
19543 + native_write_cr4(cr4 & ~X86_CR4_PGE);
19544 + /* write old PGE again and flush TLBs */
19545 + native_write_cr4(cr4);
19546 + }
19547 }
19548
19549 static inline void __native_flush_tlb_global(void)
19550 @@ -49,6 +75,41 @@ static inline void __native_flush_tlb_global(void)
19551
19552 static inline void __native_flush_tlb_single(unsigned long addr)
19553 {
19554 + if (static_cpu_has(X86_FEATURE_INVPCID)) {
19555 + u64 descriptor[2];
19556 +
19557 + descriptor[0] = PCID_KERNEL;
19558 + descriptor[1] = addr;
19559 +
19560 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19561 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
19562 + if (addr < TASK_SIZE_MAX)
19563 + descriptor[1] += pax_user_shadow_base;
19564 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
19565 + }
19566 +
19567 + descriptor[0] = PCID_USER;
19568 + descriptor[1] = addr;
19569 +#endif
19570 +
19571 + asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
19572 + return;
19573 + }
19574 +
19575 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19576 + if (static_cpu_has(X86_FEATURE_PCID)) {
19577 + unsigned int cpu = raw_get_cpu();
19578 +
19579 + native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
19580 + asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
19581 + native_write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
19582 + raw_put_cpu_no_resched();
19583 +
19584 + if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) && addr < TASK_SIZE_MAX)
19585 + addr += pax_user_shadow_base;
19586 + }
19587 +#endif
19588 +
19589 asm volatile("invlpg (%0)" ::"r" (addr) : "memory");
19590 }
19591
19592 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
19593 index 0d592e0..7437fcc 100644
19594 --- a/arch/x86/include/asm/uaccess.h
19595 +++ b/arch/x86/include/asm/uaccess.h
19596 @@ -7,6 +7,7 @@
19597 #include <linux/compiler.h>
19598 #include <linux/thread_info.h>
19599 #include <linux/string.h>
19600 +#include <linux/spinlock.h>
19601 #include <asm/asm.h>
19602 #include <asm/page.h>
19603 #include <asm/smap.h>
19604 @@ -29,7 +30,12 @@
19605
19606 #define get_ds() (KERNEL_DS)
19607 #define get_fs() (current_thread_info()->addr_limit)
19608 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19609 +void __set_fs(mm_segment_t x);
19610 +void set_fs(mm_segment_t x);
19611 +#else
19612 #define set_fs(x) (current_thread_info()->addr_limit = (x))
19613 +#endif
19614
19615 #define segment_eq(a, b) ((a).seg == (b).seg)
19616
19617 @@ -85,8 +91,36 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un
19618 * checks that the pointer is in the user space range - after calling
19619 * this function, memory access functions may still return -EFAULT.
19620 */
19621 -#define access_ok(type, addr, size) \
19622 - likely(!__range_not_ok(addr, size, user_addr_max()))
19623 +extern int _cond_resched(void);
19624 +#define access_ok_noprefault(type, addr, size) (likely(!__range_not_ok(addr, size, user_addr_max())))
19625 +#define access_ok(type, addr, size) \
19626 +({ \
19627 + unsigned long __size = size; \
19628 + unsigned long __addr = (unsigned long)addr; \
19629 + bool __ret_ao = __range_not_ok(__addr, __size, user_addr_max()) == 0;\
19630 + if (__ret_ao && __size) { \
19631 + unsigned long __addr_ao = __addr & PAGE_MASK; \
19632 + unsigned long __end_ao = __addr + __size - 1; \
19633 + if (unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
19634 + while (__addr_ao <= __end_ao) { \
19635 + char __c_ao; \
19636 + __addr_ao += PAGE_SIZE; \
19637 + if (__size > PAGE_SIZE) \
19638 + _cond_resched(); \
19639 + if (__get_user(__c_ao, (char __user *)__addr)) \
19640 + break; \
19641 + if (type != VERIFY_WRITE) { \
19642 + __addr = __addr_ao; \
19643 + continue; \
19644 + } \
19645 + if (__put_user(__c_ao, (char __user *)__addr)) \
19646 + break; \
19647 + __addr = __addr_ao; \
19648 + } \
19649 + } \
19650 + } \
19651 + __ret_ao; \
19652 +})
19653
19654 /*
19655 * The exception table consists of pairs of addresses relative to the
19656 @@ -176,10 +210,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19657 register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX); \
19658 __chk_user_ptr(ptr); \
19659 might_fault(); \
19660 + pax_open_userland(); \
19661 asm volatile("call __get_user_%P3" \
19662 : "=a" (__ret_gu), "=r" (__val_gu) \
19663 : "0" (ptr), "i" (sizeof(*(ptr)))); \
19664 (x) = (__typeof__(*(ptr))) __val_gu; \
19665 + pax_close_userland(); \
19666 __ret_gu; \
19667 })
19668
19669 @@ -187,13 +223,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19670 asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
19671 : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
19672
19673 -
19674 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
19675 +#define __copyuser_seg "gs;"
19676 +#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
19677 +#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
19678 +#else
19679 +#define __copyuser_seg
19680 +#define __COPYUSER_SET_ES
19681 +#define __COPYUSER_RESTORE_ES
19682 +#endif
19683
19684 #ifdef CONFIG_X86_32
19685 #define __put_user_asm_u64(x, addr, err, errret) \
19686 asm volatile(ASM_STAC "\n" \
19687 - "1: movl %%eax,0(%2)\n" \
19688 - "2: movl %%edx,4(%2)\n" \
19689 + "1: "__copyuser_seg"movl %%eax,0(%2)\n" \
19690 + "2: "__copyuser_seg"movl %%edx,4(%2)\n" \
19691 "3: " ASM_CLAC "\n" \
19692 ".section .fixup,\"ax\"\n" \
19693 "4: movl %3,%0\n" \
19694 @@ -206,8 +250,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
19695
19696 #define __put_user_asm_ex_u64(x, addr) \
19697 asm volatile(ASM_STAC "\n" \
19698 - "1: movl %%eax,0(%1)\n" \
19699 - "2: movl %%edx,4(%1)\n" \
19700 + "1: "__copyuser_seg"movl %%eax,0(%1)\n" \
19701 + "2: "__copyuser_seg"movl %%edx,4(%1)\n" \
19702 "3: " ASM_CLAC "\n" \
19703 _ASM_EXTABLE_EX(1b, 2b) \
19704 _ASM_EXTABLE_EX(2b, 3b) \
19705 @@ -257,7 +301,8 @@ extern void __put_user_8(void);
19706 __typeof__(*(ptr)) __pu_val; \
19707 __chk_user_ptr(ptr); \
19708 might_fault(); \
19709 - __pu_val = x; \
19710 + __pu_val = (x); \
19711 + pax_open_userland(); \
19712 switch (sizeof(*(ptr))) { \
19713 case 1: \
19714 __put_user_x(1, __pu_val, ptr, __ret_pu); \
19715 @@ -275,6 +320,7 @@ extern void __put_user_8(void);
19716 __put_user_x(X, __pu_val, ptr, __ret_pu); \
19717 break; \
19718 } \
19719 + pax_close_userland(); \
19720 __ret_pu; \
19721 })
19722
19723 @@ -355,8 +401,10 @@ do { \
19724 } while (0)
19725
19726 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
19727 +do { \
19728 + pax_open_userland(); \
19729 asm volatile(ASM_STAC "\n" \
19730 - "1: mov"itype" %2,%"rtype"1\n" \
19731 + "1: "__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
19732 "2: " ASM_CLAC "\n" \
19733 ".section .fixup,\"ax\"\n" \
19734 "3: mov %3,%0\n" \
19735 @@ -364,8 +412,10 @@ do { \
19736 " jmp 2b\n" \
19737 ".previous\n" \
19738 _ASM_EXTABLE(1b, 3b) \
19739 - : "=r" (err), ltype(x) \
19740 - : "m" (__m(addr)), "i" (errret), "0" (err))
19741 + : "=r" (err), ltype (x) \
19742 + : "m" (__m(addr)), "i" (errret), "0" (err)); \
19743 + pax_close_userland(); \
19744 +} while (0)
19745
19746 #define __get_user_size_ex(x, ptr, size) \
19747 do { \
19748 @@ -389,7 +439,7 @@ do { \
19749 } while (0)
19750
19751 #define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
19752 - asm volatile("1: mov"itype" %1,%"rtype"0\n" \
19753 + asm volatile("1: "__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
19754 "2:\n" \
19755 _ASM_EXTABLE_EX(1b, 2b) \
19756 : ltype(x) : "m" (__m(addr)))
19757 @@ -406,13 +456,24 @@ do { \
19758 int __gu_err; \
19759 unsigned long __gu_val; \
19760 __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
19761 - (x) = (__force __typeof__(*(ptr)))__gu_val; \
19762 + (x) = (__typeof__(*(ptr)))__gu_val; \
19763 __gu_err; \
19764 })
19765
19766 /* FIXME: this hack is definitely wrong -AK */
19767 struct __large_struct { unsigned long buf[100]; };
19768 -#define __m(x) (*(struct __large_struct __user *)(x))
19769 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19770 +#define ____m(x) \
19771 +({ \
19772 + unsigned long ____x = (unsigned long)(x); \
19773 + if (____x < pax_user_shadow_base) \
19774 + ____x += pax_user_shadow_base; \
19775 + (typeof(x))____x; \
19776 +})
19777 +#else
19778 +#define ____m(x) (x)
19779 +#endif
19780 +#define __m(x) (*(struct __large_struct __user *)____m(x))
19781
19782 /*
19783 * Tell gcc we read from memory instead of writing: this is because
19784 @@ -420,8 +481,10 @@ struct __large_struct { unsigned long buf[100]; };
19785 * aliasing issues.
19786 */
19787 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
19788 +do { \
19789 + pax_open_userland(); \
19790 asm volatile(ASM_STAC "\n" \
19791 - "1: mov"itype" %"rtype"1,%2\n" \
19792 + "1: "__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
19793 "2: " ASM_CLAC "\n" \
19794 ".section .fixup,\"ax\"\n" \
19795 "3: mov %3,%0\n" \
19796 @@ -429,10 +492,12 @@ struct __large_struct { unsigned long buf[100]; };
19797 ".previous\n" \
19798 _ASM_EXTABLE(1b, 3b) \
19799 : "=r"(err) \
19800 - : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
19801 + : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err));\
19802 + pax_close_userland(); \
19803 +} while (0)
19804
19805 #define __put_user_asm_ex(x, addr, itype, rtype, ltype) \
19806 - asm volatile("1: mov"itype" %"rtype"0,%1\n" \
19807 + asm volatile("1: "__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
19808 "2:\n" \
19809 _ASM_EXTABLE_EX(1b, 2b) \
19810 : : ltype(x), "m" (__m(addr)))
19811 @@ -442,11 +507,13 @@ struct __large_struct { unsigned long buf[100]; };
19812 */
19813 #define uaccess_try do { \
19814 current_thread_info()->uaccess_err = 0; \
19815 + pax_open_userland(); \
19816 stac(); \
19817 barrier();
19818
19819 #define uaccess_catch(err) \
19820 clac(); \
19821 + pax_close_userland(); \
19822 (err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \
19823 } while (0)
19824
19825 @@ -471,8 +538,12 @@ struct __large_struct { unsigned long buf[100]; };
19826 * On error, the variable @x is set to zero.
19827 */
19828
19829 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19830 +#define __get_user(x, ptr) get_user((x), (ptr))
19831 +#else
19832 #define __get_user(x, ptr) \
19833 __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
19834 +#endif
19835
19836 /**
19837 * __put_user: - Write a simple value into user space, with less checking.
19838 @@ -494,8 +565,12 @@ struct __large_struct { unsigned long buf[100]; };
19839 * Returns zero on success, or -EFAULT on error.
19840 */
19841
19842 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
19843 +#define __put_user(x, ptr) put_user((x), (ptr))
19844 +#else
19845 #define __put_user(x, ptr) \
19846 __put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
19847 +#endif
19848
19849 #define __get_user_unaligned __get_user
19850 #define __put_user_unaligned __put_user
19851 @@ -513,7 +588,7 @@ struct __large_struct { unsigned long buf[100]; };
19852 #define get_user_ex(x, ptr) do { \
19853 unsigned long __gue_val; \
19854 __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
19855 - (x) = (__force __typeof__(*(ptr)))__gue_val; \
19856 + (x) = (__typeof__(*(ptr)))__gue_val; \
19857 } while (0)
19858
19859 #define put_user_try uaccess_try
19860 @@ -542,18 +617,19 @@ extern void __cmpxchg_wrong_size(void)
19861 __typeof__(ptr) __uval = (uval); \
19862 __typeof__(*(ptr)) __old = (old); \
19863 __typeof__(*(ptr)) __new = (new); \
19864 + pax_open_userland(); \
19865 switch (size) { \
19866 case 1: \
19867 { \
19868 asm volatile("\t" ASM_STAC "\n" \
19869 - "1:\t" LOCK_PREFIX "cmpxchgb %4, %2\n" \
19870 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgb %4, %2\n"\
19871 "2:\t" ASM_CLAC "\n" \
19872 "\t.section .fixup, \"ax\"\n" \
19873 "3:\tmov %3, %0\n" \
19874 "\tjmp 2b\n" \
19875 "\t.previous\n" \
19876 _ASM_EXTABLE(1b, 3b) \
19877 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19878 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19879 : "i" (-EFAULT), "q" (__new), "1" (__old) \
19880 : "memory" \
19881 ); \
19882 @@ -562,14 +638,14 @@ extern void __cmpxchg_wrong_size(void)
19883 case 2: \
19884 { \
19885 asm volatile("\t" ASM_STAC "\n" \
19886 - "1:\t" LOCK_PREFIX "cmpxchgw %4, %2\n" \
19887 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgw %4, %2\n"\
19888 "2:\t" ASM_CLAC "\n" \
19889 "\t.section .fixup, \"ax\"\n" \
19890 "3:\tmov %3, %0\n" \
19891 "\tjmp 2b\n" \
19892 "\t.previous\n" \
19893 _ASM_EXTABLE(1b, 3b) \
19894 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19895 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19896 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19897 : "memory" \
19898 ); \
19899 @@ -578,14 +654,14 @@ extern void __cmpxchg_wrong_size(void)
19900 case 4: \
19901 { \
19902 asm volatile("\t" ASM_STAC "\n" \
19903 - "1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n" \
19904 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %4, %2\n"\
19905 "2:\t" ASM_CLAC "\n" \
19906 "\t.section .fixup, \"ax\"\n" \
19907 "3:\tmov %3, %0\n" \
19908 "\tjmp 2b\n" \
19909 "\t.previous\n" \
19910 _ASM_EXTABLE(1b, 3b) \
19911 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19912 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19913 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19914 : "memory" \
19915 ); \
19916 @@ -597,14 +673,14 @@ extern void __cmpxchg_wrong_size(void)
19917 __cmpxchg_wrong_size(); \
19918 \
19919 asm volatile("\t" ASM_STAC "\n" \
19920 - "1:\t" LOCK_PREFIX "cmpxchgq %4, %2\n" \
19921 + "1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgq %4, %2\n"\
19922 "2:\t" ASM_CLAC "\n" \
19923 "\t.section .fixup, \"ax\"\n" \
19924 "3:\tmov %3, %0\n" \
19925 "\tjmp 2b\n" \
19926 "\t.previous\n" \
19927 _ASM_EXTABLE(1b, 3b) \
19928 - : "+r" (__ret), "=a" (__old), "+m" (*(ptr)) \
19929 + : "+r" (__ret), "=a" (__old), "+m" (*____m(ptr))\
19930 : "i" (-EFAULT), "r" (__new), "1" (__old) \
19931 : "memory" \
19932 ); \
19933 @@ -613,6 +689,7 @@ extern void __cmpxchg_wrong_size(void)
19934 default: \
19935 __cmpxchg_wrong_size(); \
19936 } \
19937 + pax_close_userland(); \
19938 *__uval = __old; \
19939 __ret; \
19940 })
19941 @@ -636,17 +713,6 @@ extern struct movsl_mask {
19942
19943 #define ARCH_HAS_NOCACHE_UACCESS 1
19944
19945 -#ifdef CONFIG_X86_32
19946 -# include <asm/uaccess_32.h>
19947 -#else
19948 -# include <asm/uaccess_64.h>
19949 -#endif
19950 -
19951 -unsigned long __must_check _copy_from_user(void *to, const void __user *from,
19952 - unsigned n);
19953 -unsigned long __must_check _copy_to_user(void __user *to, const void *from,
19954 - unsigned n);
19955 -
19956 #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
19957 # define copy_user_diag __compiletime_error
19958 #else
19959 @@ -656,7 +722,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
19960 extern void copy_user_diag("copy_from_user() buffer size is too small")
19961 copy_from_user_overflow(void);
19962 extern void copy_user_diag("copy_to_user() buffer size is too small")
19963 -copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
19964 +copy_to_user_overflow(void);
19965
19966 #undef copy_user_diag
19967
19968 @@ -669,7 +735,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
19969
19970 extern void
19971 __compiletime_warning("copy_to_user() buffer size is not provably correct")
19972 -__copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
19973 +__copy_to_user_overflow(void) __asm__("copy_to_user_overflow");
19974 #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
19975
19976 #else
19977 @@ -684,10 +750,16 @@ __copy_from_user_overflow(int size, unsigned long count)
19978
19979 #endif
19980
19981 +#ifdef CONFIG_X86_32
19982 +# include <asm/uaccess_32.h>
19983 +#else
19984 +# include <asm/uaccess_64.h>
19985 +#endif
19986 +
19987 static inline unsigned long __must_check
19988 copy_from_user(void *to, const void __user *from, unsigned long n)
19989 {
19990 - int sz = __compiletime_object_size(to);
19991 + size_t sz = __compiletime_object_size(to);
19992
19993 might_fault();
19994
19995 @@ -709,12 +781,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
19996 * case, and do only runtime checking for non-constant sizes.
19997 */
19998
19999 - if (likely(sz < 0 || sz >= n))
20000 - n = _copy_from_user(to, from, n);
20001 - else if(__builtin_constant_p(n))
20002 - copy_from_user_overflow();
20003 - else
20004 - __copy_from_user_overflow(sz, n);
20005 + if (likely(sz != (size_t)-1 && sz < n)) {
20006 + if(__builtin_constant_p(n))
20007 + copy_from_user_overflow();
20008 + else
20009 + __copy_from_user_overflow(sz, n);
20010 + } if (access_ok(VERIFY_READ, from, n))
20011 + n = __copy_from_user(to, from, n);
20012 + else if ((long)n > 0)
20013 + memset(to, 0, n);
20014
20015 return n;
20016 }
20017 @@ -722,17 +797,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
20018 static inline unsigned long __must_check
20019 copy_to_user(void __user *to, const void *from, unsigned long n)
20020 {
20021 - int sz = __compiletime_object_size(from);
20022 + size_t sz = __compiletime_object_size(from);
20023
20024 might_fault();
20025
20026 /* See the comment in copy_from_user() above. */
20027 - if (likely(sz < 0 || sz >= n))
20028 - n = _copy_to_user(to, from, n);
20029 - else if(__builtin_constant_p(n))
20030 - copy_to_user_overflow();
20031 - else
20032 - __copy_to_user_overflow(sz, n);
20033 + if (likely(sz != (size_t)-1 && sz < n)) {
20034 + if(__builtin_constant_p(n))
20035 + copy_to_user_overflow();
20036 + else
20037 + __copy_to_user_overflow(sz, n);
20038 + } else if (access_ok(VERIFY_WRITE, to, n))
20039 + n = __copy_to_user(to, from, n);
20040
20041 return n;
20042 }
20043 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
20044 index 3c03a5d..1071638 100644
20045 --- a/arch/x86/include/asm/uaccess_32.h
20046 +++ b/arch/x86/include/asm/uaccess_32.h
20047 @@ -43,6 +43,11 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
20048 static __always_inline unsigned long __must_check
20049 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
20050 {
20051 + if ((long)n < 0)
20052 + return n;
20053 +
20054 + check_object_size(from, n, true);
20055 +
20056 if (__builtin_constant_p(n)) {
20057 unsigned long ret;
20058
20059 @@ -82,12 +87,16 @@ static __always_inline unsigned long __must_check
20060 __copy_to_user(void __user *to, const void *from, unsigned long n)
20061 {
20062 might_fault();
20063 +
20064 return __copy_to_user_inatomic(to, from, n);
20065 }
20066
20067 static __always_inline unsigned long
20068 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
20069 {
20070 + if ((long)n < 0)
20071 + return n;
20072 +
20073 /* Avoid zeroing the tail if the copy fails..
20074 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
20075 * but as the zeroing behaviour is only significant when n is not
20076 @@ -137,6 +146,12 @@ static __always_inline unsigned long
20077 __copy_from_user(void *to, const void __user *from, unsigned long n)
20078 {
20079 might_fault();
20080 +
20081 + if ((long)n < 0)
20082 + return n;
20083 +
20084 + check_object_size(to, n, false);
20085 +
20086 if (__builtin_constant_p(n)) {
20087 unsigned long ret;
20088
20089 @@ -159,6 +174,10 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
20090 const void __user *from, unsigned long n)
20091 {
20092 might_fault();
20093 +
20094 + if ((long)n < 0)
20095 + return n;
20096 +
20097 if (__builtin_constant_p(n)) {
20098 unsigned long ret;
20099
20100 @@ -181,7 +200,10 @@ static __always_inline unsigned long
20101 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
20102 unsigned long n)
20103 {
20104 - return __copy_from_user_ll_nocache_nozero(to, from, n);
20105 + if ((long)n < 0)
20106 + return n;
20107 +
20108 + return __copy_from_user_ll_nocache_nozero(to, from, n);
20109 }
20110
20111 #endif /* _ASM_X86_UACCESS_32_H */
20112 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
20113 index 12a26b9..206c200 100644
20114 --- a/arch/x86/include/asm/uaccess_64.h
20115 +++ b/arch/x86/include/asm/uaccess_64.h
20116 @@ -10,6 +10,9 @@
20117 #include <asm/alternative.h>
20118 #include <asm/cpufeature.h>
20119 #include <asm/page.h>
20120 +#include <asm/pgtable.h>
20121 +
20122 +#define set_fs(x) (current_thread_info()->addr_limit = (x))
20123
20124 /*
20125 * Copy To/From Userspace
20126 @@ -17,14 +20,14 @@
20127
20128 /* Handles exceptions in both to and from, but doesn't do access_ok */
20129 __must_check unsigned long
20130 -copy_user_enhanced_fast_string(void *to, const void *from, unsigned len);
20131 +copy_user_enhanced_fast_string(void *to, const void *from, unsigned len) __size_overflow(3);
20132 __must_check unsigned long
20133 -copy_user_generic_string(void *to, const void *from, unsigned len);
20134 +copy_user_generic_string(void *to, const void *from, unsigned len) __size_overflow(3);
20135 __must_check unsigned long
20136 -copy_user_generic_unrolled(void *to, const void *from, unsigned len);
20137 +copy_user_generic_unrolled(void *to, const void *from, unsigned len) __size_overflow(3);
20138
20139 static __always_inline __must_check unsigned long
20140 -copy_user_generic(void *to, const void *from, unsigned len)
20141 +copy_user_generic(void *to, const void *from, unsigned long len)
20142 {
20143 unsigned ret;
20144
20145 @@ -46,121 +49,170 @@ copy_user_generic(void *to, const void *from, unsigned len)
20146 }
20147
20148 __must_check unsigned long
20149 -copy_in_user(void __user *to, const void __user *from, unsigned len);
20150 +copy_in_user(void __user *to, const void __user *from, unsigned long len);
20151
20152 static __always_inline __must_check
20153 -int __copy_from_user_nocheck(void *dst, const void __user *src, unsigned size)
20154 +unsigned long __copy_from_user_nocheck(void *dst, const void __user *src, unsigned long size)
20155 {
20156 - int ret = 0;
20157 + size_t sz = __compiletime_object_size(dst);
20158 + unsigned ret = 0;
20159 +
20160 + if (size > INT_MAX)
20161 + return size;
20162 +
20163 + check_object_size(dst, size, false);
20164 +
20165 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20166 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20167 + return size;
20168 +#endif
20169 +
20170 + if (unlikely(sz != (size_t)-1 && sz < size)) {
20171 + if(__builtin_constant_p(size))
20172 + copy_from_user_overflow();
20173 + else
20174 + __copy_from_user_overflow(sz, size);
20175 + return size;
20176 + }
20177
20178 if (!__builtin_constant_p(size))
20179 - return copy_user_generic(dst, (__force void *)src, size);
20180 + return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
20181 switch (size) {
20182 - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
20183 + case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
20184 ret, "b", "b", "=q", 1);
20185 return ret;
20186 - case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
20187 + case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
20188 ret, "w", "w", "=r", 2);
20189 return ret;
20190 - case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
20191 + case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
20192 ret, "l", "k", "=r", 4);
20193 return ret;
20194 - case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
20195 + case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20196 ret, "q", "", "=r", 8);
20197 return ret;
20198 case 10:
20199 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
20200 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20201 ret, "q", "", "=r", 10);
20202 if (unlikely(ret))
20203 return ret;
20204 __get_user_asm(*(u16 *)(8 + (char *)dst),
20205 - (u16 __user *)(8 + (char __user *)src),
20206 + (const u16 __user *)(8 + (const char __user *)src),
20207 ret, "w", "w", "=r", 2);
20208 return ret;
20209 case 16:
20210 - __get_user_asm(*(u64 *)dst, (u64 __user *)src,
20211 + __get_user_asm(*(u64 *)dst, (const u64 __user *)src,
20212 ret, "q", "", "=r", 16);
20213 if (unlikely(ret))
20214 return ret;
20215 __get_user_asm(*(u64 *)(8 + (char *)dst),
20216 - (u64 __user *)(8 + (char __user *)src),
20217 + (const u64 __user *)(8 + (const char __user *)src),
20218 ret, "q", "", "=r", 8);
20219 return ret;
20220 default:
20221 - return copy_user_generic(dst, (__force void *)src, size);
20222 + return copy_user_generic(dst, (__force_kernel const void *)____m(src), size);
20223 }
20224 }
20225
20226 static __always_inline __must_check
20227 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
20228 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned long size)
20229 {
20230 might_fault();
20231 return __copy_from_user_nocheck(dst, src, size);
20232 }
20233
20234 static __always_inline __must_check
20235 -int __copy_to_user_nocheck(void __user *dst, const void *src, unsigned size)
20236 +unsigned long __copy_to_user_nocheck(void __user *dst, const void *src, unsigned long size)
20237 {
20238 - int ret = 0;
20239 + size_t sz = __compiletime_object_size(src);
20240 + unsigned ret = 0;
20241 +
20242 + if (size > INT_MAX)
20243 + return size;
20244 +
20245 + check_object_size(src, size, true);
20246 +
20247 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20248 + if (!access_ok_noprefault(VERIFY_WRITE, dst, size))
20249 + return size;
20250 +#endif
20251 +
20252 + if (unlikely(sz != (size_t)-1 && sz < size)) {
20253 + if(__builtin_constant_p(size))
20254 + copy_to_user_overflow();
20255 + else
20256 + __copy_to_user_overflow(sz, size);
20257 + return size;
20258 + }
20259
20260 if (!__builtin_constant_p(size))
20261 - return copy_user_generic((__force void *)dst, src, size);
20262 + return copy_user_generic((__force_kernel void *)____m(dst), src, size);
20263 switch (size) {
20264 - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
20265 + case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
20266 ret, "b", "b", "iq", 1);
20267 return ret;
20268 - case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
20269 + case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
20270 ret, "w", "w", "ir", 2);
20271 return ret;
20272 - case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
20273 + case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
20274 ret, "l", "k", "ir", 4);
20275 return ret;
20276 - case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
20277 + case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20278 ret, "q", "", "er", 8);
20279 return ret;
20280 case 10:
20281 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
20282 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20283 ret, "q", "", "er", 10);
20284 if (unlikely(ret))
20285 return ret;
20286 asm("":::"memory");
20287 - __put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
20288 + __put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
20289 ret, "w", "w", "ir", 2);
20290 return ret;
20291 case 16:
20292 - __put_user_asm(*(u64 *)src, (u64 __user *)dst,
20293 + __put_user_asm(*(const u64 *)src, (u64 __user *)dst,
20294 ret, "q", "", "er", 16);
20295 if (unlikely(ret))
20296 return ret;
20297 asm("":::"memory");
20298 - __put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
20299 + __put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
20300 ret, "q", "", "er", 8);
20301 return ret;
20302 default:
20303 - return copy_user_generic((__force void *)dst, src, size);
20304 + return copy_user_generic((__force_kernel void *)____m(dst), src, size);
20305 }
20306 }
20307
20308 static __always_inline __must_check
20309 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
20310 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned long size)
20311 {
20312 might_fault();
20313 return __copy_to_user_nocheck(dst, src, size);
20314 }
20315
20316 static __always_inline __must_check
20317 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20318 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20319 {
20320 - int ret = 0;
20321 + unsigned ret = 0;
20322
20323 might_fault();
20324 +
20325 + if (size > INT_MAX)
20326 + return size;
20327 +
20328 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20329 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20330 + return size;
20331 + if (!access_ok_noprefault(VERIFY_WRITE, dst, size))
20332 + return size;
20333 +#endif
20334 +
20335 if (!__builtin_constant_p(size))
20336 - return copy_user_generic((__force void *)dst,
20337 - (__force void *)src, size);
20338 + return copy_user_generic((__force_kernel void *)____m(dst),
20339 + (__force_kernel const void *)____m(src), size);
20340 switch (size) {
20341 case 1: {
20342 u8 tmp;
20343 - __get_user_asm(tmp, (u8 __user *)src,
20344 + __get_user_asm(tmp, (const u8 __user *)src,
20345 ret, "b", "b", "=q", 1);
20346 if (likely(!ret))
20347 __put_user_asm(tmp, (u8 __user *)dst,
20348 @@ -169,7 +221,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20349 }
20350 case 2: {
20351 u16 tmp;
20352 - __get_user_asm(tmp, (u16 __user *)src,
20353 + __get_user_asm(tmp, (const u16 __user *)src,
20354 ret, "w", "w", "=r", 2);
20355 if (likely(!ret))
20356 __put_user_asm(tmp, (u16 __user *)dst,
20357 @@ -179,7 +231,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20358
20359 case 4: {
20360 u32 tmp;
20361 - __get_user_asm(tmp, (u32 __user *)src,
20362 + __get_user_asm(tmp, (const u32 __user *)src,
20363 ret, "l", "k", "=r", 4);
20364 if (likely(!ret))
20365 __put_user_asm(tmp, (u32 __user *)dst,
20366 @@ -188,7 +240,7 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20367 }
20368 case 8: {
20369 u64 tmp;
20370 - __get_user_asm(tmp, (u64 __user *)src,
20371 + __get_user_asm(tmp, (const u64 __user *)src,
20372 ret, "q", "", "=r", 8);
20373 if (likely(!ret))
20374 __put_user_asm(tmp, (u64 __user *)dst,
20375 @@ -196,41 +248,58 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
20376 return ret;
20377 }
20378 default:
20379 - return copy_user_generic((__force void *)dst,
20380 - (__force void *)src, size);
20381 + return copy_user_generic((__force_kernel void *)____m(dst),
20382 + (__force_kernel const void *)____m(src), size);
20383 }
20384 }
20385
20386 -static __must_check __always_inline int
20387 -__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
20388 +static __must_check __always_inline unsigned long
20389 +__copy_from_user_inatomic(void *dst, const void __user *src, unsigned long size)
20390 {
20391 return __copy_from_user_nocheck(dst, src, size);
20392 }
20393
20394 -static __must_check __always_inline int
20395 -__copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
20396 +static __must_check __always_inline unsigned long
20397 +__copy_to_user_inatomic(void __user *dst, const void *src, unsigned long size)
20398 {
20399 return __copy_to_user_nocheck(dst, src, size);
20400 }
20401
20402 -extern long __copy_user_nocache(void *dst, const void __user *src,
20403 - unsigned size, int zerorest);
20404 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
20405 + unsigned long size, int zerorest);
20406
20407 -static inline int
20408 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
20409 +static inline unsigned long
20410 +__copy_from_user_nocache(void *dst, const void __user *src, unsigned long size)
20411 {
20412 might_fault();
20413 +
20414 + if (size > INT_MAX)
20415 + return size;
20416 +
20417 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20418 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20419 + return size;
20420 +#endif
20421 +
20422 return __copy_user_nocache(dst, src, size, 1);
20423 }
20424
20425 -static inline int
20426 +static inline unsigned long
20427 __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
20428 - unsigned size)
20429 + unsigned long size)
20430 {
20431 + if (size > INT_MAX)
20432 + return size;
20433 +
20434 +#ifdef CONFIG_PAX_MEMORY_UDEREF
20435 + if (!access_ok_noprefault(VERIFY_READ, src, size))
20436 + return size;
20437 +#endif
20438 +
20439 return __copy_user_nocache(dst, src, size, 0);
20440 }
20441
20442 unsigned long
20443 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
20444 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest) __size_overflow(3);
20445
20446 #endif /* _ASM_X86_UACCESS_64_H */
20447 diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h
20448 index 5b238981..77fdd78 100644
20449 --- a/arch/x86/include/asm/word-at-a-time.h
20450 +++ b/arch/x86/include/asm/word-at-a-time.h
20451 @@ -11,7 +11,7 @@
20452 * and shift, for example.
20453 */
20454 struct word_at_a_time {
20455 - const unsigned long one_bits, high_bits;
20456 + unsigned long one_bits, high_bits;
20457 };
20458
20459 #define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
20460 diff --git a/arch/x86/include/asm/x86_init.h b/arch/x86/include/asm/x86_init.h
20461 index e45e4da..44e8572 100644
20462 --- a/arch/x86/include/asm/x86_init.h
20463 +++ b/arch/x86/include/asm/x86_init.h
20464 @@ -129,7 +129,7 @@ struct x86_init_ops {
20465 struct x86_init_timers timers;
20466 struct x86_init_iommu iommu;
20467 struct x86_init_pci pci;
20468 -};
20469 +} __no_const;
20470
20471 /**
20472 * struct x86_cpuinit_ops - platform specific cpu hotplug setups
20473 @@ -140,7 +140,7 @@ struct x86_cpuinit_ops {
20474 void (*setup_percpu_clockev)(void);
20475 void (*early_percpu_clock_init)(void);
20476 void (*fixup_cpu_id)(struct cpuinfo_x86 *c, int node);
20477 -};
20478 +} __no_const;
20479
20480 struct timespec;
20481
20482 @@ -168,7 +168,7 @@ struct x86_platform_ops {
20483 void (*save_sched_clock_state)(void);
20484 void (*restore_sched_clock_state)(void);
20485 void (*apic_post_init)(void);
20486 -};
20487 +} __no_const;
20488
20489 struct pci_dev;
20490 struct msi_msg;
20491 @@ -185,7 +185,7 @@ struct x86_msi_ops {
20492 int (*setup_hpet_msi)(unsigned int irq, unsigned int id);
20493 u32 (*msi_mask_irq)(struct msi_desc *desc, u32 mask, u32 flag);
20494 u32 (*msix_mask_irq)(struct msi_desc *desc, u32 flag);
20495 -};
20496 +} __no_const;
20497
20498 struct IO_APIC_route_entry;
20499 struct io_apic_irq_attr;
20500 @@ -206,7 +206,7 @@ struct x86_io_apic_ops {
20501 unsigned int destination, int vector,
20502 struct io_apic_irq_attr *attr);
20503 void (*eoi_ioapic_pin)(int apic, int pin, int vector);
20504 -};
20505 +} __no_const;
20506
20507 extern struct x86_init_ops x86_init;
20508 extern struct x86_cpuinit_ops x86_cpuinit;
20509 diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
20510 index 3e276eb..2eb3c30 100644
20511 --- a/arch/x86/include/asm/xen/page.h
20512 +++ b/arch/x86/include/asm/xen/page.h
20513 @@ -56,7 +56,7 @@ extern int m2p_remove_override(struct page *page,
20514 extern struct page *m2p_find_override(unsigned long mfn);
20515 extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
20516
20517 -static inline unsigned long pfn_to_mfn(unsigned long pfn)
20518 +static inline unsigned long __intentional_overflow(-1) pfn_to_mfn(unsigned long pfn)
20519 {
20520 unsigned long mfn;
20521
20522 diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
20523 index 6c1d741..39e6ecf 100644
20524 --- a/arch/x86/include/asm/xsave.h
20525 +++ b/arch/x86/include/asm/xsave.h
20526 @@ -80,8 +80,11 @@ static inline int xsave_user(struct xsave_struct __user *buf)
20527 if (unlikely(err))
20528 return -EFAULT;
20529
20530 + pax_open_userland();
20531 __asm__ __volatile__(ASM_STAC "\n"
20532 - "1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
20533 + "1:"
20534 + __copyuser_seg
20535 + ".byte " REX_PREFIX "0x0f,0xae,0x27\n"
20536 "2: " ASM_CLAC "\n"
20537 ".section .fixup,\"ax\"\n"
20538 "3: movl $-1,%[err]\n"
20539 @@ -91,18 +94,22 @@ static inline int xsave_user(struct xsave_struct __user *buf)
20540 : [err] "=r" (err)
20541 : "D" (buf), "a" (-1), "d" (-1), "0" (0)
20542 : "memory");
20543 + pax_close_userland();
20544 return err;
20545 }
20546
20547 static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
20548 {
20549 int err;
20550 - struct xsave_struct *xstate = ((__force struct xsave_struct *)buf);
20551 + struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf);
20552 u32 lmask = mask;
20553 u32 hmask = mask >> 32;
20554
20555 + pax_open_userland();
20556 __asm__ __volatile__(ASM_STAC "\n"
20557 - "1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
20558 + "1:"
20559 + __copyuser_seg
20560 + ".byte " REX_PREFIX "0x0f,0xae,0x2f\n"
20561 "2: " ASM_CLAC "\n"
20562 ".section .fixup,\"ax\"\n"
20563 "3: movl $-1,%[err]\n"
20564 @@ -112,6 +119,7 @@ static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask)
20565 : [err] "=r" (err)
20566 : "D" (xstate), "a" (lmask), "d" (hmask), "0" (0)
20567 : "memory"); /* memory required? */
20568 + pax_close_userland();
20569 return err;
20570 }
20571
20572 diff --git a/arch/x86/include/uapi/asm/e820.h b/arch/x86/include/uapi/asm/e820.h
20573 index bbae024..e1528f9 100644
20574 --- a/arch/x86/include/uapi/asm/e820.h
20575 +++ b/arch/x86/include/uapi/asm/e820.h
20576 @@ -63,7 +63,7 @@ struct e820map {
20577 #define ISA_START_ADDRESS 0xa0000
20578 #define ISA_END_ADDRESS 0x100000
20579
20580 -#define BIOS_BEGIN 0x000a0000
20581 +#define BIOS_BEGIN 0x000c0000
20582 #define BIOS_END 0x00100000
20583
20584 #define BIOS_ROM_BASE 0xffe00000
20585 diff --git a/arch/x86/include/uapi/asm/ptrace-abi.h b/arch/x86/include/uapi/asm/ptrace-abi.h
20586 index 7b0a55a..ad115bf 100644
20587 --- a/arch/x86/include/uapi/asm/ptrace-abi.h
20588 +++ b/arch/x86/include/uapi/asm/ptrace-abi.h
20589 @@ -49,7 +49,6 @@
20590 #define EFLAGS 144
20591 #define RSP 152
20592 #define SS 160
20593 -#define ARGOFFSET R11
20594 #endif /* __ASSEMBLY__ */
20595
20596 /* top of stack page */
20597 diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
20598 index cb648c8..91cb07e 100644
20599 --- a/arch/x86/kernel/Makefile
20600 +++ b/arch/x86/kernel/Makefile
20601 @@ -24,7 +24,7 @@ obj-y += time.o ioport.o ldt.o dumpstack.o nmi.o
20602 obj-y += setup.o x86_init.o i8259.o irqinit.o jump_label.o
20603 obj-$(CONFIG_IRQ_WORK) += irq_work.o
20604 obj-y += probe_roms.o
20605 -obj-$(CONFIG_X86_32) += i386_ksyms_32.o
20606 +obj-$(CONFIG_X86_32) += sys_i386_32.o i386_ksyms_32.o
20607 obj-$(CONFIG_X86_64) += sys_x86_64.o x8664_ksyms_64.o
20608 obj-y += syscall_$(BITS).o
20609 obj-$(CONFIG_X86_64) += vsyscall_64.o
20610 diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
20611 index 1dac942..19c8b0c 100644
20612 --- a/arch/x86/kernel/acpi/boot.c
20613 +++ b/arch/x86/kernel/acpi/boot.c
20614 @@ -1312,7 +1312,7 @@ static int __init dmi_ignore_irq0_timer_override(const struct dmi_system_id *d)
20615 * If your system is blacklisted here, but you find that acpi=force
20616 * works for you, please contact linux-acpi@vger.kernel.org
20617 */
20618 -static struct dmi_system_id __initdata acpi_dmi_table[] = {
20619 +static const struct dmi_system_id __initconst acpi_dmi_table[] = {
20620 /*
20621 * Boxes that need ACPI disabled
20622 */
20623 @@ -1387,7 +1387,7 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
20624 };
20625
20626 /* second table for DMI checks that should run after early-quirks */
20627 -static struct dmi_system_id __initdata acpi_dmi_table_late[] = {
20628 +static const struct dmi_system_id __initconst acpi_dmi_table_late[] = {
20629 /*
20630 * HP laptops which use a DSDT reporting as HP/SB400/10000,
20631 * which includes some code which overrides all temperature
20632 diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
20633 index 3a2ae4c..9db31d6 100644
20634 --- a/arch/x86/kernel/acpi/sleep.c
20635 +++ b/arch/x86/kernel/acpi/sleep.c
20636 @@ -99,8 +99,12 @@ int x86_acpi_suspend_lowlevel(void)
20637 #else /* CONFIG_64BIT */
20638 #ifdef CONFIG_SMP
20639 stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
20640 +
20641 + pax_open_kernel();
20642 early_gdt_descr.address =
20643 (unsigned long)get_cpu_gdt_table(smp_processor_id());
20644 + pax_close_kernel();
20645 +
20646 initial_gs = per_cpu_offset(smp_processor_id());
20647 #endif
20648 initial_code = (unsigned long)wakeup_long64;
20649 diff --git a/arch/x86/kernel/acpi/wakeup_32.S b/arch/x86/kernel/acpi/wakeup_32.S
20650 index 665c6b7..eae4d56 100644
20651 --- a/arch/x86/kernel/acpi/wakeup_32.S
20652 +++ b/arch/x86/kernel/acpi/wakeup_32.S
20653 @@ -29,13 +29,11 @@ wakeup_pmode_return:
20654 # and restore the stack ... but you need gdt for this to work
20655 movl saved_context_esp, %esp
20656
20657 - movl %cs:saved_magic, %eax
20658 - cmpl $0x12345678, %eax
20659 + cmpl $0x12345678, saved_magic
20660 jne bogus_magic
20661
20662 # jump to place where we left off
20663 - movl saved_eip, %eax
20664 - jmp *%eax
20665 + jmp *(saved_eip)
20666
20667 bogus_magic:
20668 jmp bogus_magic
20669 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
20670 index df94598..f3b29bf 100644
20671 --- a/arch/x86/kernel/alternative.c
20672 +++ b/arch/x86/kernel/alternative.c
20673 @@ -269,6 +269,13 @@ void __init_or_module apply_alternatives(struct alt_instr *start,
20674 */
20675 for (a = start; a < end; a++) {
20676 instr = (u8 *)&a->instr_offset + a->instr_offset;
20677 +
20678 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20679 + instr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20680 + if (instr < (u8 *)_text || (u8 *)_einittext <= instr)
20681 + instr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20682 +#endif
20683 +
20684 replacement = (u8 *)&a->repl_offset + a->repl_offset;
20685 BUG_ON(a->replacementlen > a->instrlen);
20686 BUG_ON(a->instrlen > sizeof(insnbuf));
20687 @@ -300,10 +307,16 @@ static void alternatives_smp_lock(const s32 *start, const s32 *end,
20688 for (poff = start; poff < end; poff++) {
20689 u8 *ptr = (u8 *)poff + *poff;
20690
20691 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20692 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20693 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
20694 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20695 +#endif
20696 +
20697 if (!*poff || ptr < text || ptr >= text_end)
20698 continue;
20699 /* turn DS segment override prefix into lock prefix */
20700 - if (*ptr == 0x3e)
20701 + if (*ktla_ktva(ptr) == 0x3e)
20702 text_poke(ptr, ((unsigned char []){0xf0}), 1);
20703 }
20704 mutex_unlock(&text_mutex);
20705 @@ -318,10 +331,16 @@ static void alternatives_smp_unlock(const s32 *start, const s32 *end,
20706 for (poff = start; poff < end; poff++) {
20707 u8 *ptr = (u8 *)poff + *poff;
20708
20709 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
20710 + ptr += ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20711 + if (ptr < (u8 *)_text || (u8 *)_einittext <= ptr)
20712 + ptr -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
20713 +#endif
20714 +
20715 if (!*poff || ptr < text || ptr >= text_end)
20716 continue;
20717 /* turn lock prefix into DS segment override prefix */
20718 - if (*ptr == 0xf0)
20719 + if (*ktla_ktva(ptr) == 0xf0)
20720 text_poke(ptr, ((unsigned char []){0x3E}), 1);
20721 }
20722 mutex_unlock(&text_mutex);
20723 @@ -458,7 +477,7 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start,
20724
20725 BUG_ON(p->len > MAX_PATCH_LEN);
20726 /* prep the buffer with the original instructions */
20727 - memcpy(insnbuf, p->instr, p->len);
20728 + memcpy(insnbuf, ktla_ktva(p->instr), p->len);
20729 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
20730 (unsigned long)p->instr, p->len);
20731
20732 @@ -505,7 +524,7 @@ void __init alternative_instructions(void)
20733 if (!uniproc_patched || num_possible_cpus() == 1)
20734 free_init_pages("SMP alternatives",
20735 (unsigned long)__smp_locks,
20736 - (unsigned long)__smp_locks_end);
20737 + PAGE_ALIGN((unsigned long)__smp_locks_end));
20738 #endif
20739
20740 apply_paravirt(__parainstructions, __parainstructions_end);
20741 @@ -525,13 +544,17 @@ void __init alternative_instructions(void)
20742 * instructions. And on the local CPU you need to be protected again NMI or MCE
20743 * handlers seeing an inconsistent instruction while you patch.
20744 */
20745 -void *__init_or_module text_poke_early(void *addr, const void *opcode,
20746 +void *__kprobes text_poke_early(void *addr, const void *opcode,
20747 size_t len)
20748 {
20749 unsigned long flags;
20750 local_irq_save(flags);
20751 - memcpy(addr, opcode, len);
20752 +
20753 + pax_open_kernel();
20754 + memcpy(ktla_ktva(addr), opcode, len);
20755 sync_core();
20756 + pax_close_kernel();
20757 +
20758 local_irq_restore(flags);
20759 /* Could also do a CLFLUSH here to speed up CPU recovery; but
20760 that causes hangs on some VIA CPUs. */
20761 @@ -553,36 +576,22 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode,
20762 */
20763 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
20764 {
20765 - unsigned long flags;
20766 - char *vaddr;
20767 + unsigned char *vaddr = ktla_ktva(addr);
20768 struct page *pages[2];
20769 - int i;
20770 + size_t i;
20771
20772 if (!core_kernel_text((unsigned long)addr)) {
20773 - pages[0] = vmalloc_to_page(addr);
20774 - pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
20775 + pages[0] = vmalloc_to_page(vaddr);
20776 + pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
20777 } else {
20778 - pages[0] = virt_to_page(addr);
20779 + pages[0] = virt_to_page(vaddr);
20780 WARN_ON(!PageReserved(pages[0]));
20781 - pages[1] = virt_to_page(addr + PAGE_SIZE);
20782 + pages[1] = virt_to_page(vaddr + PAGE_SIZE);
20783 }
20784 BUG_ON(!pages[0]);
20785 - local_irq_save(flags);
20786 - set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
20787 - if (pages[1])
20788 - set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
20789 - vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
20790 - memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
20791 - clear_fixmap(FIX_TEXT_POKE0);
20792 - if (pages[1])
20793 - clear_fixmap(FIX_TEXT_POKE1);
20794 - local_flush_tlb();
20795 - sync_core();
20796 - /* Could also do a CLFLUSH here to speed up CPU recovery; but
20797 - that causes hangs on some VIA CPUs. */
20798 + text_poke_early(addr, opcode, len);
20799 for (i = 0; i < len; i++)
20800 - BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
20801 - local_irq_restore(flags);
20802 + BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
20803 return addr;
20804 }
20805
20806 @@ -602,7 +611,7 @@ int poke_int3_handler(struct pt_regs *regs)
20807 if (likely(!bp_patching_in_progress))
20808 return 0;
20809
20810 - if (user_mode_vm(regs) || regs->ip != (unsigned long)bp_int3_addr)
20811 + if (user_mode(regs) || regs->ip != (unsigned long)bp_int3_addr)
20812 return 0;
20813
20814 /* set up the specified breakpoint handler */
20815 @@ -636,7 +645,7 @@ int poke_int3_handler(struct pt_regs *regs)
20816 */
20817 void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler)
20818 {
20819 - unsigned char int3 = 0xcc;
20820 + const unsigned char int3 = 0xcc;
20821
20822 bp_int3_handler = handler;
20823 bp_int3_addr = (u8 *)addr + sizeof(int3);
20824 diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
20825 index 7f26c9a..694544e 100644
20826 --- a/arch/x86/kernel/apic/apic.c
20827 +++ b/arch/x86/kernel/apic/apic.c
20828 @@ -198,7 +198,7 @@ int first_system_vector = 0xfe;
20829 /*
20830 * Debug level, exported for io_apic.c
20831 */
20832 -unsigned int apic_verbosity;
20833 +int apic_verbosity;
20834
20835 int pic_mode;
20836
20837 @@ -1992,7 +1992,7 @@ static inline void __smp_error_interrupt(struct pt_regs *regs)
20838 apic_write(APIC_ESR, 0);
20839 v = apic_read(APIC_ESR);
20840 ack_APIC_irq();
20841 - atomic_inc(&irq_err_count);
20842 + atomic_inc_unchecked(&irq_err_count);
20843
20844 apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x",
20845 smp_processor_id(), v);
20846 diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
20847 index 2c621a6..fa2b1ae 100644
20848 --- a/arch/x86/kernel/apic/apic_flat_64.c
20849 +++ b/arch/x86/kernel/apic/apic_flat_64.c
20850 @@ -154,7 +154,7 @@ static int flat_probe(void)
20851 return 1;
20852 }
20853
20854 -static struct apic apic_flat = {
20855 +static struct apic apic_flat __read_only = {
20856 .name = "flat",
20857 .probe = flat_probe,
20858 .acpi_madt_oem_check = flat_acpi_madt_oem_check,
20859 @@ -268,7 +268,7 @@ static int physflat_probe(void)
20860 return 0;
20861 }
20862
20863 -static struct apic apic_physflat = {
20864 +static struct apic apic_physflat __read_only = {
20865
20866 .name = "physical flat",
20867 .probe = physflat_probe,
20868 diff --git a/arch/x86/kernel/apic/apic_noop.c b/arch/x86/kernel/apic/apic_noop.c
20869 index 191ce75..2db6d63 100644
20870 --- a/arch/x86/kernel/apic/apic_noop.c
20871 +++ b/arch/x86/kernel/apic/apic_noop.c
20872 @@ -118,7 +118,7 @@ static void noop_apic_write(u32 reg, u32 v)
20873 WARN_ON_ONCE(cpu_has_apic && !disable_apic);
20874 }
20875
20876 -struct apic apic_noop = {
20877 +struct apic apic_noop __read_only = {
20878 .name = "noop",
20879 .probe = noop_probe,
20880 .acpi_madt_oem_check = NULL,
20881 diff --git a/arch/x86/kernel/apic/bigsmp_32.c b/arch/x86/kernel/apic/bigsmp_32.c
20882 index d50e364..543bee3 100644
20883 --- a/arch/x86/kernel/apic/bigsmp_32.c
20884 +++ b/arch/x86/kernel/apic/bigsmp_32.c
20885 @@ -152,7 +152,7 @@ static int probe_bigsmp(void)
20886 return dmi_bigsmp;
20887 }
20888
20889 -static struct apic apic_bigsmp = {
20890 +static struct apic apic_bigsmp __read_only = {
20891
20892 .name = "bigsmp",
20893 .probe = probe_bigsmp,
20894 diff --git a/arch/x86/kernel/apic/es7000_32.c b/arch/x86/kernel/apic/es7000_32.c
20895 index c552247..587a316 100644
20896 --- a/arch/x86/kernel/apic/es7000_32.c
20897 +++ b/arch/x86/kernel/apic/es7000_32.c
20898 @@ -608,8 +608,7 @@ static int es7000_mps_oem_check_cluster(struct mpc_table *mpc, char *oem,
20899 return ret && es7000_apic_is_cluster();
20900 }
20901
20902 -/* We've been warned by a false positive warning.Use __refdata to keep calm. */
20903 -static struct apic __refdata apic_es7000_cluster = {
20904 +static struct apic apic_es7000_cluster __read_only = {
20905
20906 .name = "es7000",
20907 .probe = probe_es7000,
20908 @@ -675,7 +674,7 @@ static struct apic __refdata apic_es7000_cluster = {
20909 .x86_32_early_logical_apicid = es7000_early_logical_apicid,
20910 };
20911
20912 -static struct apic __refdata apic_es7000 = {
20913 +static struct apic apic_es7000 __read_only = {
20914
20915 .name = "es7000",
20916 .probe = probe_es7000,
20917 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
20918 index 6ad4658..38a7b5c 100644
20919 --- a/arch/x86/kernel/apic/io_apic.c
20920 +++ b/arch/x86/kernel/apic/io_apic.c
20921 @@ -1057,7 +1057,7 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin,
20922 }
20923 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
20924
20925 -void lock_vector_lock(void)
20926 +void lock_vector_lock(void) __acquires(vector_lock)
20927 {
20928 /* Used to the online set of cpus does not change
20929 * during assign_irq_vector.
20930 @@ -1065,7 +1065,7 @@ void lock_vector_lock(void)
20931 raw_spin_lock(&vector_lock);
20932 }
20933
20934 -void unlock_vector_lock(void)
20935 +void unlock_vector_lock(void) __releases(vector_lock)
20936 {
20937 raw_spin_unlock(&vector_lock);
20938 }
20939 @@ -2364,7 +2364,7 @@ static void ack_apic_edge(struct irq_data *data)
20940 ack_APIC_irq();
20941 }
20942
20943 -atomic_t irq_mis_count;
20944 +atomic_unchecked_t irq_mis_count;
20945
20946 #ifdef CONFIG_GENERIC_PENDING_IRQ
20947 static bool io_apic_level_ack_pending(struct irq_cfg *cfg)
20948 @@ -2505,7 +2505,7 @@ static void ack_apic_level(struct irq_data *data)
20949 * at the cpu.
20950 */
20951 if (!(v & (1 << (i & 0x1f)))) {
20952 - atomic_inc(&irq_mis_count);
20953 + atomic_inc_unchecked(&irq_mis_count);
20954
20955 eoi_ioapic_irq(irq, cfg);
20956 }
20957 diff --git a/arch/x86/kernel/apic/numaq_32.c b/arch/x86/kernel/apic/numaq_32.c
20958 index 1e42e8f..daacf44 100644
20959 --- a/arch/x86/kernel/apic/numaq_32.c
20960 +++ b/arch/x86/kernel/apic/numaq_32.c
20961 @@ -455,8 +455,7 @@ static void numaq_setup_portio_remap(void)
20962 (u_long) xquad_portio, (u_long) num_quads*XQUAD_PORTIO_QUAD);
20963 }
20964
20965 -/* Use __refdata to keep false positive warning calm. */
20966 -static struct apic __refdata apic_numaq = {
20967 +static struct apic apic_numaq __read_only = {
20968
20969 .name = "NUMAQ",
20970 .probe = probe_numaq,
20971 diff --git a/arch/x86/kernel/apic/probe_32.c b/arch/x86/kernel/apic/probe_32.c
20972 index eb35ef9..f184a21 100644
20973 --- a/arch/x86/kernel/apic/probe_32.c
20974 +++ b/arch/x86/kernel/apic/probe_32.c
20975 @@ -72,7 +72,7 @@ static int probe_default(void)
20976 return 1;
20977 }
20978
20979 -static struct apic apic_default = {
20980 +static struct apic apic_default __read_only = {
20981
20982 .name = "default",
20983 .probe = probe_default,
20984 diff --git a/arch/x86/kernel/apic/summit_32.c b/arch/x86/kernel/apic/summit_32.c
20985 index 00146f9..5e299b8 100644
20986 --- a/arch/x86/kernel/apic/summit_32.c
20987 +++ b/arch/x86/kernel/apic/summit_32.c
20988 @@ -485,7 +485,7 @@ void setup_summit(void)
20989 }
20990 #endif
20991
20992 -static struct apic apic_summit = {
20993 +static struct apic apic_summit __read_only = {
20994
20995 .name = "summit",
20996 .probe = probe_summit,
20997 diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
20998 index cac85ee..01fa741 100644
20999 --- a/arch/x86/kernel/apic/x2apic_cluster.c
21000 +++ b/arch/x86/kernel/apic/x2apic_cluster.c
21001 @@ -182,7 +182,7 @@ update_clusterinfo(struct notifier_block *nfb, unsigned long action, void *hcpu)
21002 return notifier_from_errno(err);
21003 }
21004
21005 -static struct notifier_block __refdata x2apic_cpu_notifier = {
21006 +static struct notifier_block x2apic_cpu_notifier = {
21007 .notifier_call = update_clusterinfo,
21008 };
21009
21010 @@ -234,7 +234,7 @@ static void cluster_vector_allocation_domain(int cpu, struct cpumask *retmask,
21011 cpumask_and(retmask, mask, per_cpu(cpus_in_cluster, cpu));
21012 }
21013
21014 -static struct apic apic_x2apic_cluster = {
21015 +static struct apic apic_x2apic_cluster __read_only = {
21016
21017 .name = "cluster x2apic",
21018 .probe = x2apic_cluster_probe,
21019 diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
21020 index de231e3..1d1b2ee 100644
21021 --- a/arch/x86/kernel/apic/x2apic_phys.c
21022 +++ b/arch/x86/kernel/apic/x2apic_phys.c
21023 @@ -88,7 +88,7 @@ static int x2apic_phys_probe(void)
21024 return apic == &apic_x2apic_phys;
21025 }
21026
21027 -static struct apic apic_x2apic_phys = {
21028 +static struct apic apic_x2apic_phys __read_only = {
21029
21030 .name = "physical x2apic",
21031 .probe = x2apic_phys_probe,
21032 diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
21033 index d263b13..963258b 100644
21034 --- a/arch/x86/kernel/apic/x2apic_uv_x.c
21035 +++ b/arch/x86/kernel/apic/x2apic_uv_x.c
21036 @@ -350,7 +350,7 @@ static int uv_probe(void)
21037 return apic == &apic_x2apic_uv_x;
21038 }
21039
21040 -static struct apic __refdata apic_x2apic_uv_x = {
21041 +static struct apic apic_x2apic_uv_x __read_only = {
21042
21043 .name = "UV large system",
21044 .probe = uv_probe,
21045 diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
21046 index 3ab0343..814c4787 100644
21047 --- a/arch/x86/kernel/apm_32.c
21048 +++ b/arch/x86/kernel/apm_32.c
21049 @@ -433,7 +433,7 @@ static DEFINE_MUTEX(apm_mutex);
21050 * This is for buggy BIOS's that refer to (real mode) segment 0x40
21051 * even though they are called in protected mode.
21052 */
21053 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
21054 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
21055 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
21056
21057 static const char driver_version[] = "1.16ac"; /* no spaces */
21058 @@ -611,7 +611,10 @@ static long __apm_bios_call(void *_call)
21059 BUG_ON(cpu != 0);
21060 gdt = get_cpu_gdt_table(cpu);
21061 save_desc_40 = gdt[0x40 / 8];
21062 +
21063 + pax_open_kernel();
21064 gdt[0x40 / 8] = bad_bios_desc;
21065 + pax_close_kernel();
21066
21067 apm_irq_save(flags);
21068 APM_DO_SAVE_SEGS;
21069 @@ -620,7 +623,11 @@ static long __apm_bios_call(void *_call)
21070 &call->esi);
21071 APM_DO_RESTORE_SEGS;
21072 apm_irq_restore(flags);
21073 +
21074 + pax_open_kernel();
21075 gdt[0x40 / 8] = save_desc_40;
21076 + pax_close_kernel();
21077 +
21078 put_cpu();
21079
21080 return call->eax & 0xff;
21081 @@ -687,7 +694,10 @@ static long __apm_bios_call_simple(void *_call)
21082 BUG_ON(cpu != 0);
21083 gdt = get_cpu_gdt_table(cpu);
21084 save_desc_40 = gdt[0x40 / 8];
21085 +
21086 + pax_open_kernel();
21087 gdt[0x40 / 8] = bad_bios_desc;
21088 + pax_close_kernel();
21089
21090 apm_irq_save(flags);
21091 APM_DO_SAVE_SEGS;
21092 @@ -695,7 +705,11 @@ static long __apm_bios_call_simple(void *_call)
21093 &call->eax);
21094 APM_DO_RESTORE_SEGS;
21095 apm_irq_restore(flags);
21096 +
21097 + pax_open_kernel();
21098 gdt[0x40 / 8] = save_desc_40;
21099 + pax_close_kernel();
21100 +
21101 put_cpu();
21102 return error;
21103 }
21104 @@ -2362,12 +2376,15 @@ static int __init apm_init(void)
21105 * code to that CPU.
21106 */
21107 gdt = get_cpu_gdt_table(0);
21108 +
21109 + pax_open_kernel();
21110 set_desc_base(&gdt[APM_CS >> 3],
21111 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
21112 set_desc_base(&gdt[APM_CS_16 >> 3],
21113 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
21114 set_desc_base(&gdt[APM_DS >> 3],
21115 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
21116 + pax_close_kernel();
21117
21118 proc_create("apm", 0, NULL, &apm_file_ops);
21119
21120 diff --git a/arch/x86/kernel/asm-offsets.c b/arch/x86/kernel/asm-offsets.c
21121 index 9f6b934..cf5ffb3 100644
21122 --- a/arch/x86/kernel/asm-offsets.c
21123 +++ b/arch/x86/kernel/asm-offsets.c
21124 @@ -32,6 +32,8 @@ void common(void) {
21125 OFFSET(TI_flags, thread_info, flags);
21126 OFFSET(TI_status, thread_info, status);
21127 OFFSET(TI_addr_limit, thread_info, addr_limit);
21128 + OFFSET(TI_lowest_stack, thread_info, lowest_stack);
21129 + DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
21130
21131 BLANK();
21132 OFFSET(crypto_tfm_ctx_offset, crypto_tfm, __crt_ctx);
21133 @@ -52,8 +54,26 @@ void common(void) {
21134 OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
21135 OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
21136 OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
21137 +
21138 +#ifdef CONFIG_PAX_KERNEXEC
21139 + OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
21140 #endif
21141
21142 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21143 + OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
21144 + OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
21145 +#ifdef CONFIG_X86_64
21146 + OFFSET(PV_MMU_set_pgd_batched, pv_mmu_ops, set_pgd_batched);
21147 +#endif
21148 +#endif
21149 +
21150 +#endif
21151 +
21152 + BLANK();
21153 + DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
21154 + DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
21155 + DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
21156 +
21157 #ifdef CONFIG_XEN
21158 BLANK();
21159 OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
21160 diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
21161 index e7c798b..2b2019b 100644
21162 --- a/arch/x86/kernel/asm-offsets_64.c
21163 +++ b/arch/x86/kernel/asm-offsets_64.c
21164 @@ -77,6 +77,7 @@ int main(void)
21165 BLANK();
21166 #undef ENTRY
21167
21168 + DEFINE(TSS_size, sizeof(struct tss_struct));
21169 OFFSET(TSS_ist, tss_struct, x86_tss.ist);
21170 BLANK();
21171
21172 diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
21173 index 7fd54f0..0691410 100644
21174 --- a/arch/x86/kernel/cpu/Makefile
21175 +++ b/arch/x86/kernel/cpu/Makefile
21176 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
21177 CFLAGS_REMOVE_perf_event.o = -pg
21178 endif
21179
21180 -# Make sure load_percpu_segment has no stackprotector
21181 -nostackp := $(call cc-option, -fno-stack-protector)
21182 -CFLAGS_common.o := $(nostackp)
21183 -
21184 obj-y := intel_cacheinfo.o scattered.o topology.o
21185 obj-y += proc.o capflags.o powerflags.o common.o
21186 obj-y += rdrand.o
21187 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
21188 index c67ffa6..f41fbbf 100644
21189 --- a/arch/x86/kernel/cpu/amd.c
21190 +++ b/arch/x86/kernel/cpu/amd.c
21191 @@ -752,7 +752,7 @@ static void init_amd(struct cpuinfo_x86 *c)
21192 static unsigned int amd_size_cache(struct cpuinfo_x86 *c, unsigned int size)
21193 {
21194 /* AMD errata T13 (order #21922) */
21195 - if ((c->x86 == 6)) {
21196 + if (c->x86 == 6) {
21197 /* Duron Rev A0 */
21198 if (c->x86_model == 3 && c->x86_mask == 0)
21199 size = 64;
21200 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
21201 index 8e28bf2..bf5c0d2 100644
21202 --- a/arch/x86/kernel/cpu/common.c
21203 +++ b/arch/x86/kernel/cpu/common.c
21204 @@ -88,60 +88,6 @@ static const struct cpu_dev default_cpu = {
21205
21206 static const struct cpu_dev *this_cpu = &default_cpu;
21207
21208 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
21209 -#ifdef CONFIG_X86_64
21210 - /*
21211 - * We need valid kernel segments for data and code in long mode too
21212 - * IRET will check the segment types kkeil 2000/10/28
21213 - * Also sysret mandates a special GDT layout
21214 - *
21215 - * TLS descriptors are currently at a different place compared to i386.
21216 - * Hopefully nobody expects them at a fixed place (Wine?)
21217 - */
21218 - [GDT_ENTRY_KERNEL32_CS] = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
21219 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
21220 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
21221 - [GDT_ENTRY_DEFAULT_USER32_CS] = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
21222 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
21223 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
21224 -#else
21225 - [GDT_ENTRY_KERNEL_CS] = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
21226 - [GDT_ENTRY_KERNEL_DS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21227 - [GDT_ENTRY_DEFAULT_USER_CS] = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
21228 - [GDT_ENTRY_DEFAULT_USER_DS] = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
21229 - /*
21230 - * Segments used for calling PnP BIOS have byte granularity.
21231 - * They code segments and data segments have fixed 64k limits,
21232 - * the transfer segment sizes are set at run time.
21233 - */
21234 - /* 32-bit code */
21235 - [GDT_ENTRY_PNPBIOS_CS32] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
21236 - /* 16-bit code */
21237 - [GDT_ENTRY_PNPBIOS_CS16] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
21238 - /* 16-bit data */
21239 - [GDT_ENTRY_PNPBIOS_DS] = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
21240 - /* 16-bit data */
21241 - [GDT_ENTRY_PNPBIOS_TS1] = GDT_ENTRY_INIT(0x0092, 0, 0),
21242 - /* 16-bit data */
21243 - [GDT_ENTRY_PNPBIOS_TS2] = GDT_ENTRY_INIT(0x0092, 0, 0),
21244 - /*
21245 - * The APM segments have byte granularity and their bases
21246 - * are set at run time. All have 64k limits.
21247 - */
21248 - /* 32-bit code */
21249 - [GDT_ENTRY_APMBIOS_BASE] = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
21250 - /* 16-bit code */
21251 - [GDT_ENTRY_APMBIOS_BASE+1] = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
21252 - /* data */
21253 - [GDT_ENTRY_APMBIOS_BASE+2] = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
21254 -
21255 - [GDT_ENTRY_ESPFIX_SS] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21256 - [GDT_ENTRY_PERCPU] = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
21257 - GDT_STACK_CANARY_INIT
21258 -#endif
21259 -} };
21260 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
21261 -
21262 static int __init x86_xsave_setup(char *s)
21263 {
21264 setup_clear_cpu_cap(X86_FEATURE_XSAVE);
21265 @@ -293,6 +239,59 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
21266 }
21267 }
21268
21269 +#ifdef CONFIG_X86_64
21270 +static __init int setup_disable_pcid(char *arg)
21271 +{
21272 + setup_clear_cpu_cap(X86_FEATURE_PCID);
21273 + setup_clear_cpu_cap(X86_FEATURE_INVPCID);
21274 +
21275 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21276 + if (clone_pgd_mask != ~(pgdval_t)0UL)
21277 + pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
21278 +#endif
21279 +
21280 + return 1;
21281 +}
21282 +__setup("nopcid", setup_disable_pcid);
21283 +
21284 +static void setup_pcid(struct cpuinfo_x86 *c)
21285 +{
21286 + if (!cpu_has(c, X86_FEATURE_PCID)) {
21287 + clear_cpu_cap(c, X86_FEATURE_INVPCID);
21288 +
21289 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21290 + if (clone_pgd_mask != ~(pgdval_t)0UL) {
21291 + pax_open_kernel();
21292 + pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
21293 + pax_close_kernel();
21294 + printk("PAX: slow and weak UDEREF enabled\n");
21295 + } else
21296 + printk("PAX: UDEREF disabled\n");
21297 +#endif
21298 +
21299 + return;
21300 + }
21301 +
21302 + printk("PAX: PCID detected\n");
21303 + set_in_cr4(X86_CR4_PCIDE);
21304 +
21305 +#ifdef CONFIG_PAX_MEMORY_UDEREF
21306 + pax_open_kernel();
21307 + clone_pgd_mask = ~(pgdval_t)0UL;
21308 + pax_close_kernel();
21309 + if (pax_user_shadow_base)
21310 + printk("PAX: weak UDEREF enabled\n");
21311 + else {
21312 + set_cpu_cap(c, X86_FEATURE_STRONGUDEREF);
21313 + printk("PAX: strong UDEREF enabled\n");
21314 + }
21315 +#endif
21316 +
21317 + if (cpu_has(c, X86_FEATURE_INVPCID))
21318 + printk("PAX: INVPCID detected\n");
21319 +}
21320 +#endif
21321 +
21322 /*
21323 * Some CPU features depend on higher CPUID levels, which may not always
21324 * be available due to CPUID level capping or broken virtualization
21325 @@ -393,7 +392,7 @@ void switch_to_new_gdt(int cpu)
21326 {
21327 struct desc_ptr gdt_descr;
21328
21329 - gdt_descr.address = (long)get_cpu_gdt_table(cpu);
21330 + gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
21331 gdt_descr.size = GDT_SIZE - 1;
21332 load_gdt(&gdt_descr);
21333 /* Reload the per-cpu base */
21334 @@ -883,6 +882,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
21335 setup_smep(c);
21336 setup_smap(c);
21337
21338 +#ifdef CONFIG_X86_64
21339 + setup_pcid(c);
21340 +#endif
21341 +
21342 /*
21343 * The vendor-specific functions might have changed features.
21344 * Now we do "generic changes."
21345 @@ -891,6 +894,10 @@ static void identify_cpu(struct cpuinfo_x86 *c)
21346 /* Filter out anything that depends on CPUID levels we don't have */
21347 filter_cpuid_features(c, true);
21348
21349 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
21350 + setup_clear_cpu_cap(X86_FEATURE_SEP);
21351 +#endif
21352 +
21353 /* If the model name is still unset, do table lookup. */
21354 if (!c->x86_model_id[0]) {
21355 const char *p;
21356 @@ -1078,10 +1085,12 @@ static __init int setup_disablecpuid(char *arg)
21357 }
21358 __setup("clearcpuid=", setup_disablecpuid);
21359
21360 +DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
21361 +EXPORT_PER_CPU_SYMBOL(current_tinfo);
21362 +
21363 #ifdef CONFIG_X86_64
21364 -struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
21365 -struct desc_ptr debug_idt_descr = { NR_VECTORS * 16 - 1,
21366 - (unsigned long) debug_idt_table };
21367 +struct desc_ptr idt_descr __read_only = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
21368 +const struct desc_ptr debug_idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) debug_idt_table };
21369
21370 DEFINE_PER_CPU_FIRST(union irq_stack_union,
21371 irq_stack_union) __aligned(PAGE_SIZE) __visible;
21372 @@ -1095,7 +1104,7 @@ DEFINE_PER_CPU(struct task_struct *, current_task) ____cacheline_aligned =
21373 EXPORT_PER_CPU_SYMBOL(current_task);
21374
21375 DEFINE_PER_CPU(unsigned long, kernel_stack) =
21376 - (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
21377 + (unsigned long)&init_thread_union - 16 + THREAD_SIZE;
21378 EXPORT_PER_CPU_SYMBOL(kernel_stack);
21379
21380 DEFINE_PER_CPU(char *, irq_stack_ptr) =
21381 @@ -1245,7 +1254,7 @@ void cpu_init(void)
21382 load_ucode_ap();
21383
21384 cpu = stack_smp_processor_id();
21385 - t = &per_cpu(init_tss, cpu);
21386 + t = init_tss + cpu;
21387 oist = &per_cpu(orig_ist, cpu);
21388
21389 #ifdef CONFIG_NUMA
21390 @@ -1280,7 +1289,6 @@ void cpu_init(void)
21391 wrmsrl(MSR_KERNEL_GS_BASE, 0);
21392 barrier();
21393
21394 - x86_configure_nx();
21395 enable_x2apic();
21396
21397 /*
21398 @@ -1332,7 +1340,7 @@ void cpu_init(void)
21399 {
21400 int cpu = smp_processor_id();
21401 struct task_struct *curr = current;
21402 - struct tss_struct *t = &per_cpu(init_tss, cpu);
21403 + struct tss_struct *t = init_tss + cpu;
21404 struct thread_struct *thread = &curr->thread;
21405
21406 show_ucode_info_early();
21407 diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
21408 index 0641113..06f5ba4 100644
21409 --- a/arch/x86/kernel/cpu/intel_cacheinfo.c
21410 +++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
21411 @@ -1014,6 +1014,22 @@ static struct attribute *default_attrs[] = {
21412 };
21413
21414 #ifdef CONFIG_AMD_NB
21415 +static struct attribute *default_attrs_amd_nb[] = {
21416 + &type.attr,
21417 + &level.attr,
21418 + &coherency_line_size.attr,
21419 + &physical_line_partition.attr,
21420 + &ways_of_associativity.attr,
21421 + &number_of_sets.attr,
21422 + &size.attr,
21423 + &shared_cpu_map.attr,
21424 + &shared_cpu_list.attr,
21425 + NULL,
21426 + NULL,
21427 + NULL,
21428 + NULL
21429 +};
21430 +
21431 static struct attribute **amd_l3_attrs(void)
21432 {
21433 static struct attribute **attrs;
21434 @@ -1024,18 +1040,7 @@ static struct attribute **amd_l3_attrs(void)
21435
21436 n = ARRAY_SIZE(default_attrs);
21437
21438 - if (amd_nb_has_feature(AMD_NB_L3_INDEX_DISABLE))
21439 - n += 2;
21440 -
21441 - if (amd_nb_has_feature(AMD_NB_L3_PARTITIONING))
21442 - n += 1;
21443 -
21444 - attrs = kzalloc(n * sizeof (struct attribute *), GFP_KERNEL);
21445 - if (attrs == NULL)
21446 - return attrs = default_attrs;
21447 -
21448 - for (n = 0; default_attrs[n]; n++)
21449 - attrs[n] = default_attrs[n];
21450 + attrs = default_attrs_amd_nb;
21451
21452 if (amd_nb_has_feature(AMD_NB_L3_INDEX_DISABLE)) {
21453 attrs[n++] = &cache_disable_0.attr;
21454 @@ -1086,6 +1091,13 @@ static struct kobj_type ktype_cache = {
21455 .default_attrs = default_attrs,
21456 };
21457
21458 +#ifdef CONFIG_AMD_NB
21459 +static struct kobj_type ktype_cache_amd_nb = {
21460 + .sysfs_ops = &sysfs_ops,
21461 + .default_attrs = default_attrs_amd_nb,
21462 +};
21463 +#endif
21464 +
21465 static struct kobj_type ktype_percpu_entry = {
21466 .sysfs_ops = &sysfs_ops,
21467 };
21468 @@ -1151,20 +1163,26 @@ static int cache_add_dev(struct device *dev)
21469 return retval;
21470 }
21471
21472 +#ifdef CONFIG_AMD_NB
21473 + amd_l3_attrs();
21474 +#endif
21475 +
21476 for (i = 0; i < num_cache_leaves; i++) {
21477 + struct kobj_type *ktype;
21478 +
21479 this_object = INDEX_KOBJECT_PTR(cpu, i);
21480 this_object->cpu = cpu;
21481 this_object->index = i;
21482
21483 this_leaf = CPUID4_INFO_IDX(cpu, i);
21484
21485 - ktype_cache.default_attrs = default_attrs;
21486 + ktype = &ktype_cache;
21487 #ifdef CONFIG_AMD_NB
21488 if (this_leaf->base.nb)
21489 - ktype_cache.default_attrs = amd_l3_attrs();
21490 + ktype = &ktype_cache_amd_nb;
21491 #endif
21492 retval = kobject_init_and_add(&(this_object->kobj),
21493 - &ktype_cache,
21494 + ktype,
21495 per_cpu(ici_cache_kobject, cpu),
21496 "index%1lu", i);
21497 if (unlikely(retval)) {
21498 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
21499 index 4d5419b..95f11bb 100644
21500 --- a/arch/x86/kernel/cpu/mcheck/mce.c
21501 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
21502 @@ -45,6 +45,7 @@
21503 #include <asm/processor.h>
21504 #include <asm/mce.h>
21505 #include <asm/msr.h>
21506 +#include <asm/local.h>
21507
21508 #include "mce-internal.h"
21509
21510 @@ -258,7 +259,7 @@ static void print_mce(struct mce *m)
21511 !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
21512 m->cs, m->ip);
21513
21514 - if (m->cs == __KERNEL_CS)
21515 + if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
21516 print_symbol("{%s}", m->ip);
21517 pr_cont("\n");
21518 }
21519 @@ -291,10 +292,10 @@ static void print_mce(struct mce *m)
21520
21521 #define PANIC_TIMEOUT 5 /* 5 seconds */
21522
21523 -static atomic_t mce_paniced;
21524 +static atomic_unchecked_t mce_paniced;
21525
21526 static int fake_panic;
21527 -static atomic_t mce_fake_paniced;
21528 +static atomic_unchecked_t mce_fake_paniced;
21529
21530 /* Panic in progress. Enable interrupts and wait for final IPI */
21531 static void wait_for_panic(void)
21532 @@ -318,7 +319,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
21533 /*
21534 * Make sure only one CPU runs in machine check panic
21535 */
21536 - if (atomic_inc_return(&mce_paniced) > 1)
21537 + if (atomic_inc_return_unchecked(&mce_paniced) > 1)
21538 wait_for_panic();
21539 barrier();
21540
21541 @@ -326,7 +327,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
21542 console_verbose();
21543 } else {
21544 /* Don't log too much for fake panic */
21545 - if (atomic_inc_return(&mce_fake_paniced) > 1)
21546 + if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
21547 return;
21548 }
21549 /* First print corrected ones that are still unlogged */
21550 @@ -365,7 +366,7 @@ static void mce_panic(char *msg, struct mce *final, char *exp)
21551 if (!fake_panic) {
21552 if (panic_timeout == 0)
21553 panic_timeout = mca_cfg.panic_timeout;
21554 - panic(msg);
21555 + panic("%s", msg);
21556 } else
21557 pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg);
21558 }
21559 @@ -695,7 +696,7 @@ static int mce_timed_out(u64 *t)
21560 * might have been modified by someone else.
21561 */
21562 rmb();
21563 - if (atomic_read(&mce_paniced))
21564 + if (atomic_read_unchecked(&mce_paniced))
21565 wait_for_panic();
21566 if (!mca_cfg.monarch_timeout)
21567 goto out;
21568 @@ -1666,7 +1667,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
21569 }
21570
21571 /* Call the installed machine check handler for this CPU setup. */
21572 -void (*machine_check_vector)(struct pt_regs *, long error_code) =
21573 +void (*machine_check_vector)(struct pt_regs *, long error_code) __read_only =
21574 unexpected_machine_check;
21575
21576 /*
21577 @@ -1689,7 +1690,9 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
21578 return;
21579 }
21580
21581 + pax_open_kernel();
21582 machine_check_vector = do_machine_check;
21583 + pax_close_kernel();
21584
21585 __mcheck_cpu_init_generic();
21586 __mcheck_cpu_init_vendor(c);
21587 @@ -1703,7 +1706,7 @@ void mcheck_cpu_init(struct cpuinfo_x86 *c)
21588 */
21589
21590 static DEFINE_SPINLOCK(mce_chrdev_state_lock);
21591 -static int mce_chrdev_open_count; /* #times opened */
21592 +static local_t mce_chrdev_open_count; /* #times opened */
21593 static int mce_chrdev_open_exclu; /* already open exclusive? */
21594
21595 static int mce_chrdev_open(struct inode *inode, struct file *file)
21596 @@ -1711,7 +1714,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
21597 spin_lock(&mce_chrdev_state_lock);
21598
21599 if (mce_chrdev_open_exclu ||
21600 - (mce_chrdev_open_count && (file->f_flags & O_EXCL))) {
21601 + (local_read(&mce_chrdev_open_count) && (file->f_flags & O_EXCL))) {
21602 spin_unlock(&mce_chrdev_state_lock);
21603
21604 return -EBUSY;
21605 @@ -1719,7 +1722,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
21606
21607 if (file->f_flags & O_EXCL)
21608 mce_chrdev_open_exclu = 1;
21609 - mce_chrdev_open_count++;
21610 + local_inc(&mce_chrdev_open_count);
21611
21612 spin_unlock(&mce_chrdev_state_lock);
21613
21614 @@ -1730,7 +1733,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
21615 {
21616 spin_lock(&mce_chrdev_state_lock);
21617
21618 - mce_chrdev_open_count--;
21619 + local_dec(&mce_chrdev_open_count);
21620 mce_chrdev_open_exclu = 0;
21621
21622 spin_unlock(&mce_chrdev_state_lock);
21623 @@ -2406,7 +2409,7 @@ static __init void mce_init_banks(void)
21624
21625 for (i = 0; i < mca_cfg.banks; i++) {
21626 struct mce_bank *b = &mce_banks[i];
21627 - struct device_attribute *a = &b->attr;
21628 + device_attribute_no_const *a = &b->attr;
21629
21630 sysfs_attr_init(&a->attr);
21631 a->attr.name = b->attrname;
21632 @@ -2474,7 +2477,7 @@ struct dentry *mce_get_debugfs_dir(void)
21633 static void mce_reset(void)
21634 {
21635 cpu_missing = 0;
21636 - atomic_set(&mce_fake_paniced, 0);
21637 + atomic_set_unchecked(&mce_fake_paniced, 0);
21638 atomic_set(&mce_executing, 0);
21639 atomic_set(&mce_callin, 0);
21640 atomic_set(&global_nwo, 0);
21641 diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
21642 index a304298..49b6d06 100644
21643 --- a/arch/x86/kernel/cpu/mcheck/p5.c
21644 +++ b/arch/x86/kernel/cpu/mcheck/p5.c
21645 @@ -10,6 +10,7 @@
21646 #include <asm/processor.h>
21647 #include <asm/mce.h>
21648 #include <asm/msr.h>
21649 +#include <asm/pgtable.h>
21650
21651 /* By default disabled */
21652 int mce_p5_enabled __read_mostly;
21653 @@ -48,7 +49,9 @@ void intel_p5_mcheck_init(struct cpuinfo_x86 *c)
21654 if (!cpu_has(c, X86_FEATURE_MCE))
21655 return;
21656
21657 + pax_open_kernel();
21658 machine_check_vector = pentium_machine_check;
21659 + pax_close_kernel();
21660 /* Make sure the vector pointer is visible before we enable MCEs: */
21661 wmb();
21662
21663 diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
21664 index 7dc5564..1273569 100644
21665 --- a/arch/x86/kernel/cpu/mcheck/winchip.c
21666 +++ b/arch/x86/kernel/cpu/mcheck/winchip.c
21667 @@ -9,6 +9,7 @@
21668 #include <asm/processor.h>
21669 #include <asm/mce.h>
21670 #include <asm/msr.h>
21671 +#include <asm/pgtable.h>
21672
21673 /* Machine check handler for WinChip C6: */
21674 static void winchip_machine_check(struct pt_regs *regs, long error_code)
21675 @@ -22,7 +23,9 @@ void winchip_mcheck_init(struct cpuinfo_x86 *c)
21676 {
21677 u32 lo, hi;
21678
21679 + pax_open_kernel();
21680 machine_check_vector = winchip_machine_check;
21681 + pax_close_kernel();
21682 /* Make sure the vector pointer is visible before we enable MCEs: */
21683 wmb();
21684
21685 diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
21686 index 15c9876..0a43909 100644
21687 --- a/arch/x86/kernel/cpu/microcode/core.c
21688 +++ b/arch/x86/kernel/cpu/microcode/core.c
21689 @@ -513,7 +513,7 @@ mc_cpu_callback(struct notifier_block *nb, unsigned long action, void *hcpu)
21690 return NOTIFY_OK;
21691 }
21692
21693 -static struct notifier_block __refdata mc_cpu_notifier = {
21694 +static struct notifier_block mc_cpu_notifier = {
21695 .notifier_call = mc_cpu_callback,
21696 };
21697
21698 diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
21699 index a276fa7..e66810f 100644
21700 --- a/arch/x86/kernel/cpu/microcode/intel.c
21701 +++ b/arch/x86/kernel/cpu/microcode/intel.c
21702 @@ -293,13 +293,13 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device,
21703
21704 static int get_ucode_user(void *to, const void *from, size_t n)
21705 {
21706 - return copy_from_user(to, from, n);
21707 + return copy_from_user(to, (const void __force_user *)from, n);
21708 }
21709
21710 static enum ucode_state
21711 request_microcode_user(int cpu, const void __user *buf, size_t size)
21712 {
21713 - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
21714 + return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user);
21715 }
21716
21717 static void microcode_fini_cpu(int cpu)
21718 diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
21719 index f961de9..8a9d332 100644
21720 --- a/arch/x86/kernel/cpu/mtrr/main.c
21721 +++ b/arch/x86/kernel/cpu/mtrr/main.c
21722 @@ -66,7 +66,7 @@ static DEFINE_MUTEX(mtrr_mutex);
21723 u64 size_or_mask, size_and_mask;
21724 static bool mtrr_aps_delayed_init;
21725
21726 -static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
21727 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
21728
21729 const struct mtrr_ops *mtrr_if;
21730
21731 diff --git a/arch/x86/kernel/cpu/mtrr/mtrr.h b/arch/x86/kernel/cpu/mtrr/mtrr.h
21732 index df5e41f..816c719 100644
21733 --- a/arch/x86/kernel/cpu/mtrr/mtrr.h
21734 +++ b/arch/x86/kernel/cpu/mtrr/mtrr.h
21735 @@ -25,7 +25,7 @@ struct mtrr_ops {
21736 int (*validate_add_page)(unsigned long base, unsigned long size,
21737 unsigned int type);
21738 int (*have_wrcomb)(void);
21739 -};
21740 +} __do_const;
21741
21742 extern int generic_get_free_region(unsigned long base, unsigned long size,
21743 int replace_reg);
21744 diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
21745 index 79f9f84..38ace52 100644
21746 --- a/arch/x86/kernel/cpu/perf_event.c
21747 +++ b/arch/x86/kernel/cpu/perf_event.c
21748 @@ -1351,7 +1351,7 @@ static void __init pmu_check_apic(void)
21749 pr_info("no hardware sampling interrupt available.\n");
21750 }
21751
21752 -static struct attribute_group x86_pmu_format_group = {
21753 +static attribute_group_no_const x86_pmu_format_group = {
21754 .name = "format",
21755 .attrs = NULL,
21756 };
21757 @@ -1450,7 +1450,7 @@ static struct attribute *events_attr[] = {
21758 NULL,
21759 };
21760
21761 -static struct attribute_group x86_pmu_events_group = {
21762 +static attribute_group_no_const x86_pmu_events_group = {
21763 .name = "events",
21764 .attrs = events_attr,
21765 };
21766 @@ -1971,7 +1971,7 @@ static unsigned long get_segment_base(unsigned int segment)
21767 if (idx > GDT_ENTRIES)
21768 return 0;
21769
21770 - desc = __this_cpu_ptr(&gdt_page.gdt[0]);
21771 + desc = get_cpu_gdt_table(smp_processor_id());
21772 }
21773
21774 return get_desc_base(desc + idx);
21775 @@ -2061,7 +2061,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
21776 break;
21777
21778 perf_callchain_store(entry, frame.return_address);
21779 - fp = frame.next_frame;
21780 + fp = (const void __force_user *)frame.next_frame;
21781 }
21782 }
21783
21784 diff --git a/arch/x86/kernel/cpu/perf_event_amd_iommu.c b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21785 index 639d128..e92d7e5 100644
21786 --- a/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21787 +++ b/arch/x86/kernel/cpu/perf_event_amd_iommu.c
21788 @@ -405,7 +405,7 @@ static void perf_iommu_del(struct perf_event *event, int flags)
21789 static __init int _init_events_attrs(struct perf_amd_iommu *perf_iommu)
21790 {
21791 struct attribute **attrs;
21792 - struct attribute_group *attr_group;
21793 + attribute_group_no_const *attr_group;
21794 int i = 0, j;
21795
21796 while (amd_iommu_v2_event_descs[i].attr.attr.name)
21797 diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
21798 index aa333d9..f9db700 100644
21799 --- a/arch/x86/kernel/cpu/perf_event_intel.c
21800 +++ b/arch/x86/kernel/cpu/perf_event_intel.c
21801 @@ -2309,10 +2309,10 @@ __init int intel_pmu_init(void)
21802 x86_pmu.num_counters_fixed = max((int)edx.split.num_counters_fixed, 3);
21803
21804 if (boot_cpu_has(X86_FEATURE_PDCM)) {
21805 - u64 capabilities;
21806 + u64 capabilities = x86_pmu.intel_cap.capabilities;
21807
21808 - rdmsrl(MSR_IA32_PERF_CAPABILITIES, capabilities);
21809 - x86_pmu.intel_cap.capabilities = capabilities;
21810 + if (rdmsrl_safe(MSR_IA32_PERF_CAPABILITIES, &x86_pmu.intel_cap.capabilities))
21811 + x86_pmu.intel_cap.capabilities = capabilities;
21812 }
21813
21814 intel_ds_init();
21815 diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21816 index 5ad35ad..e0a3960 100644
21817 --- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21818 +++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
21819 @@ -425,7 +425,7 @@ static struct attribute *rapl_events_cln_attr[] = {
21820 NULL,
21821 };
21822
21823 -static struct attribute_group rapl_pmu_events_group = {
21824 +static attribute_group_no_const rapl_pmu_events_group __read_only = {
21825 .name = "events",
21826 .attrs = NULL, /* patched at runtime */
21827 };
21828 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21829 index 047f540..afdeba0 100644
21830 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21831 +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
21832 @@ -3326,7 +3326,7 @@ static void __init uncore_types_exit(struct intel_uncore_type **types)
21833 static int __init uncore_type_init(struct intel_uncore_type *type)
21834 {
21835 struct intel_uncore_pmu *pmus;
21836 - struct attribute_group *attr_group;
21837 + attribute_group_no_const *attr_group;
21838 struct attribute **attrs;
21839 int i, j;
21840
21841 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.h b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21842 index a80ab71..4089da5 100644
21843 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21844 +++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
21845 @@ -498,7 +498,7 @@ struct intel_uncore_box {
21846 struct uncore_event_desc {
21847 struct kobj_attribute attr;
21848 const char *config;
21849 -};
21850 +} __do_const;
21851
21852 #define INTEL_UNCORE_EVENT_DESC(_name, _config) \
21853 { \
21854 diff --git a/arch/x86/kernel/cpuid.c b/arch/x86/kernel/cpuid.c
21855 index 7d9481c..99c7e4b 100644
21856 --- a/arch/x86/kernel/cpuid.c
21857 +++ b/arch/x86/kernel/cpuid.c
21858 @@ -170,7 +170,7 @@ static int cpuid_class_cpu_callback(struct notifier_block *nfb,
21859 return notifier_from_errno(err);
21860 }
21861
21862 -static struct notifier_block __refdata cpuid_class_cpu_notifier =
21863 +static struct notifier_block cpuid_class_cpu_notifier =
21864 {
21865 .notifier_call = cpuid_class_cpu_callback,
21866 };
21867 diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
21868 index a57902e..ebaae2a 100644
21869 --- a/arch/x86/kernel/crash.c
21870 +++ b/arch/x86/kernel/crash.c
21871 @@ -57,10 +57,8 @@ static void kdump_nmi_callback(int cpu, struct pt_regs *regs)
21872 {
21873 #ifdef CONFIG_X86_32
21874 struct pt_regs fixed_regs;
21875 -#endif
21876
21877 -#ifdef CONFIG_X86_32
21878 - if (!user_mode_vm(regs)) {
21879 + if (!user_mode(regs)) {
21880 crash_fixup_ss_esp(&fixed_regs, regs);
21881 regs = &fixed_regs;
21882 }
21883 diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
21884 index afa64ad..dce67dd 100644
21885 --- a/arch/x86/kernel/crash_dump_64.c
21886 +++ b/arch/x86/kernel/crash_dump_64.c
21887 @@ -36,7 +36,7 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
21888 return -ENOMEM;
21889
21890 if (userbuf) {
21891 - if (copy_to_user(buf, vaddr + offset, csize)) {
21892 + if (copy_to_user((char __force_user *)buf, vaddr + offset, csize)) {
21893 iounmap(vaddr);
21894 return -EFAULT;
21895 }
21896 diff --git a/arch/x86/kernel/doublefault.c b/arch/x86/kernel/doublefault.c
21897 index f6dfd93..892ade4 100644
21898 --- a/arch/x86/kernel/doublefault.c
21899 +++ b/arch/x86/kernel/doublefault.c
21900 @@ -12,7 +12,7 @@
21901
21902 #define DOUBLEFAULT_STACKSIZE (1024)
21903 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
21904 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
21905 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
21906
21907 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
21908
21909 @@ -22,7 +22,7 @@ static void doublefault_fn(void)
21910 unsigned long gdt, tss;
21911
21912 native_store_gdt(&gdt_desc);
21913 - gdt = gdt_desc.address;
21914 + gdt = (unsigned long)gdt_desc.address;
21915
21916 printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
21917
21918 @@ -59,10 +59,10 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
21919 /* 0x2 bit is always set */
21920 .flags = X86_EFLAGS_SF | 0x2,
21921 .sp = STACK_START,
21922 - .es = __USER_DS,
21923 + .es = __KERNEL_DS,
21924 .cs = __KERNEL_CS,
21925 .ss = __KERNEL_DS,
21926 - .ds = __USER_DS,
21927 + .ds = __KERNEL_DS,
21928 .fs = __KERNEL_PERCPU,
21929
21930 .__cr3 = __pa_nodebug(swapper_pg_dir),
21931 diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
21932 index d9c12d3..7858b62 100644
21933 --- a/arch/x86/kernel/dumpstack.c
21934 +++ b/arch/x86/kernel/dumpstack.c
21935 @@ -2,6 +2,9 @@
21936 * Copyright (C) 1991, 1992 Linus Torvalds
21937 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
21938 */
21939 +#ifdef CONFIG_GRKERNSEC_HIDESYM
21940 +#define __INCLUDED_BY_HIDESYM 1
21941 +#endif
21942 #include <linux/kallsyms.h>
21943 #include <linux/kprobes.h>
21944 #include <linux/uaccess.h>
21945 @@ -40,16 +43,14 @@ void printk_address(unsigned long address)
21946 static void
21947 print_ftrace_graph_addr(unsigned long addr, void *data,
21948 const struct stacktrace_ops *ops,
21949 - struct thread_info *tinfo, int *graph)
21950 + struct task_struct *task, int *graph)
21951 {
21952 - struct task_struct *task;
21953 unsigned long ret_addr;
21954 int index;
21955
21956 if (addr != (unsigned long)return_to_handler)
21957 return;
21958
21959 - task = tinfo->task;
21960 index = task->curr_ret_stack;
21961
21962 if (!task->ret_stack || index < *graph)
21963 @@ -66,7 +67,7 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
21964 static inline void
21965 print_ftrace_graph_addr(unsigned long addr, void *data,
21966 const struct stacktrace_ops *ops,
21967 - struct thread_info *tinfo, int *graph)
21968 + struct task_struct *task, int *graph)
21969 { }
21970 #endif
21971
21972 @@ -77,10 +78,8 @@ print_ftrace_graph_addr(unsigned long addr, void *data,
21973 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
21974 */
21975
21976 -static inline int valid_stack_ptr(struct thread_info *tinfo,
21977 - void *p, unsigned int size, void *end)
21978 +static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
21979 {
21980 - void *t = tinfo;
21981 if (end) {
21982 if (p < end && p >= (end-THREAD_SIZE))
21983 return 1;
21984 @@ -91,14 +90,14 @@ static inline int valid_stack_ptr(struct thread_info *tinfo,
21985 }
21986
21987 unsigned long
21988 -print_context_stack(struct thread_info *tinfo,
21989 +print_context_stack(struct task_struct *task, void *stack_start,
21990 unsigned long *stack, unsigned long bp,
21991 const struct stacktrace_ops *ops, void *data,
21992 unsigned long *end, int *graph)
21993 {
21994 struct stack_frame *frame = (struct stack_frame *)bp;
21995
21996 - while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
21997 + while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
21998 unsigned long addr;
21999
22000 addr = *stack;
22001 @@ -110,7 +109,7 @@ print_context_stack(struct thread_info *tinfo,
22002 } else {
22003 ops->address(data, addr, 0);
22004 }
22005 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
22006 + print_ftrace_graph_addr(addr, data, ops, task, graph);
22007 }
22008 stack++;
22009 }
22010 @@ -119,7 +118,7 @@ print_context_stack(struct thread_info *tinfo,
22011 EXPORT_SYMBOL_GPL(print_context_stack);
22012
22013 unsigned long
22014 -print_context_stack_bp(struct thread_info *tinfo,
22015 +print_context_stack_bp(struct task_struct *task, void *stack_start,
22016 unsigned long *stack, unsigned long bp,
22017 const struct stacktrace_ops *ops, void *data,
22018 unsigned long *end, int *graph)
22019 @@ -127,7 +126,7 @@ print_context_stack_bp(struct thread_info *tinfo,
22020 struct stack_frame *frame = (struct stack_frame *)bp;
22021 unsigned long *ret_addr = &frame->return_address;
22022
22023 - while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
22024 + while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
22025 unsigned long addr = *ret_addr;
22026
22027 if (!__kernel_text_address(addr))
22028 @@ -136,7 +135,7 @@ print_context_stack_bp(struct thread_info *tinfo,
22029 ops->address(data, addr, 1);
22030 frame = frame->next_frame;
22031 ret_addr = &frame->return_address;
22032 - print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
22033 + print_ftrace_graph_addr(addr, data, ops, task, graph);
22034 }
22035
22036 return (unsigned long)frame;
22037 @@ -155,7 +154,7 @@ static int print_trace_stack(void *data, char *name)
22038 static void print_trace_address(void *data, unsigned long addr, int reliable)
22039 {
22040 touch_nmi_watchdog();
22041 - printk(data);
22042 + printk("%s", (char *)data);
22043 printk_stack_address(addr, reliable);
22044 }
22045
22046 @@ -224,6 +223,8 @@ unsigned __kprobes long oops_begin(void)
22047 }
22048 EXPORT_SYMBOL_GPL(oops_begin);
22049
22050 +extern void gr_handle_kernel_exploit(void);
22051 +
22052 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
22053 {
22054 if (regs && kexec_should_crash(current))
22055 @@ -245,7 +246,10 @@ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
22056 panic("Fatal exception in interrupt");
22057 if (panic_on_oops)
22058 panic("Fatal exception");
22059 - do_exit(signr);
22060 +
22061 + gr_handle_kernel_exploit();
22062 +
22063 + do_group_exit(signr);
22064 }
22065
22066 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
22067 @@ -273,7 +277,7 @@ int __kprobes __die(const char *str, struct pt_regs *regs, long err)
22068 print_modules();
22069 show_regs(regs);
22070 #ifdef CONFIG_X86_32
22071 - if (user_mode_vm(regs)) {
22072 + if (user_mode(regs)) {
22073 sp = regs->sp;
22074 ss = regs->ss & 0xffff;
22075 } else {
22076 @@ -301,7 +305,7 @@ void die(const char *str, struct pt_regs *regs, long err)
22077 unsigned long flags = oops_begin();
22078 int sig = SIGSEGV;
22079
22080 - if (!user_mode_vm(regs))
22081 + if (!user_mode(regs))
22082 report_bug(regs->ip, regs);
22083
22084 if (__die(str, regs, err))
22085 diff --git a/arch/x86/kernel/dumpstack_32.c b/arch/x86/kernel/dumpstack_32.c
22086 index f2a1770..10fa52d 100644
22087 --- a/arch/x86/kernel/dumpstack_32.c
22088 +++ b/arch/x86/kernel/dumpstack_32.c
22089 @@ -38,15 +38,13 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22090 bp = stack_frame(task, regs);
22091
22092 for (;;) {
22093 - struct thread_info *context;
22094 + void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
22095
22096 - context = (struct thread_info *)
22097 - ((unsigned long)stack & (~(THREAD_SIZE - 1)));
22098 - bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
22099 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
22100
22101 - stack = (unsigned long *)context->previous_esp;
22102 - if (!stack)
22103 + if (stack_start == task_stack_page(task))
22104 break;
22105 + stack = *(unsigned long **)stack_start;
22106 if (ops->stack(data, "IRQ") < 0)
22107 break;
22108 touch_nmi_watchdog();
22109 @@ -87,27 +85,28 @@ void show_regs(struct pt_regs *regs)
22110 int i;
22111
22112 show_regs_print_info(KERN_EMERG);
22113 - __show_regs(regs, !user_mode_vm(regs));
22114 + __show_regs(regs, !user_mode(regs));
22115
22116 /*
22117 * When in-kernel, we also print out the stack and code at the
22118 * time of the fault..
22119 */
22120 - if (!user_mode_vm(regs)) {
22121 + if (!user_mode(regs)) {
22122 unsigned int code_prologue = code_bytes * 43 / 64;
22123 unsigned int code_len = code_bytes;
22124 unsigned char c;
22125 u8 *ip;
22126 + unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(0)[(0xffff & regs->cs) >> 3]);
22127
22128 pr_emerg("Stack:\n");
22129 show_stack_log_lvl(NULL, regs, &regs->sp, 0, KERN_EMERG);
22130
22131 pr_emerg("Code:");
22132
22133 - ip = (u8 *)regs->ip - code_prologue;
22134 + ip = (u8 *)regs->ip - code_prologue + cs_base;
22135 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
22136 /* try starting at IP */
22137 - ip = (u8 *)regs->ip;
22138 + ip = (u8 *)regs->ip + cs_base;
22139 code_len = code_len - code_prologue + 1;
22140 }
22141 for (i = 0; i < code_len; i++, ip++) {
22142 @@ -116,7 +115,7 @@ void show_regs(struct pt_regs *regs)
22143 pr_cont(" Bad EIP value.");
22144 break;
22145 }
22146 - if (ip == (u8 *)regs->ip)
22147 + if (ip == (u8 *)regs->ip + cs_base)
22148 pr_cont(" <%02x>", c);
22149 else
22150 pr_cont(" %02x", c);
22151 @@ -129,6 +128,7 @@ int is_valid_bugaddr(unsigned long ip)
22152 {
22153 unsigned short ud2;
22154
22155 + ip = ktla_ktva(ip);
22156 if (ip < PAGE_OFFSET)
22157 return 0;
22158 if (probe_kernel_address((unsigned short *)ip, ud2))
22159 @@ -136,3 +136,15 @@ int is_valid_bugaddr(unsigned long ip)
22160
22161 return ud2 == 0x0b0f;
22162 }
22163 +
22164 +#if defined(CONFIG_PAX_MEMORY_STACKLEAK) || defined(CONFIG_PAX_USERCOPY)
22165 +void pax_check_alloca(unsigned long size)
22166 +{
22167 + unsigned long sp = (unsigned long)&sp, stack_left;
22168 +
22169 + /* all kernel stacks are of the same size */
22170 + stack_left = sp & (THREAD_SIZE - 1);
22171 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22172 +}
22173 +EXPORT_SYMBOL(pax_check_alloca);
22174 +#endif
22175 diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
22176 index addb207..921706b 100644
22177 --- a/arch/x86/kernel/dumpstack_64.c
22178 +++ b/arch/x86/kernel/dumpstack_64.c
22179 @@ -119,9 +119,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22180 unsigned long *irq_stack_end =
22181 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
22182 unsigned used = 0;
22183 - struct thread_info *tinfo;
22184 int graph = 0;
22185 unsigned long dummy;
22186 + void *stack_start;
22187
22188 if (!task)
22189 task = current;
22190 @@ -142,10 +142,10 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22191 * current stack address. If the stacks consist of nested
22192 * exceptions
22193 */
22194 - tinfo = task_thread_info(task);
22195 for (;;) {
22196 char *id;
22197 unsigned long *estack_end;
22198 +
22199 estack_end = in_exception_stack(cpu, (unsigned long)stack,
22200 &used, &id);
22201
22202 @@ -153,7 +153,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22203 if (ops->stack(data, id) < 0)
22204 break;
22205
22206 - bp = ops->walk_stack(tinfo, stack, bp, ops,
22207 + bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
22208 data, estack_end, &graph);
22209 ops->stack(data, "<EOE>");
22210 /*
22211 @@ -161,6 +161,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22212 * second-to-last pointer (index -2 to end) in the
22213 * exception stack:
22214 */
22215 + if ((u16)estack_end[-1] != __KERNEL_DS)
22216 + goto out;
22217 stack = (unsigned long *) estack_end[-2];
22218 continue;
22219 }
22220 @@ -172,7 +174,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22221 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
22222 if (ops->stack(data, "IRQ") < 0)
22223 break;
22224 - bp = ops->walk_stack(tinfo, stack, bp,
22225 + bp = ops->walk_stack(task, irq_stack, stack, bp,
22226 ops, data, irq_stack_end, &graph);
22227 /*
22228 * We link to the next stack (which would be
22229 @@ -191,7 +193,9 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
22230 /*
22231 * This handles the process stack:
22232 */
22233 - bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
22234 + stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
22235 + bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
22236 +out:
22237 put_cpu();
22238 }
22239 EXPORT_SYMBOL(dump_trace);
22240 @@ -300,3 +304,50 @@ int is_valid_bugaddr(unsigned long ip)
22241
22242 return ud2 == 0x0b0f;
22243 }
22244 +
22245 +#if defined(CONFIG_PAX_MEMORY_STACKLEAK) || defined(CONFIG_PAX_USERCOPY)
22246 +void pax_check_alloca(unsigned long size)
22247 +{
22248 + unsigned long sp = (unsigned long)&sp, stack_start, stack_end;
22249 + unsigned cpu, used;
22250 + char *id;
22251 +
22252 + /* check the process stack first */
22253 + stack_start = (unsigned long)task_stack_page(current);
22254 + stack_end = stack_start + THREAD_SIZE;
22255 + if (likely(stack_start <= sp && sp < stack_end)) {
22256 + unsigned long stack_left = sp & (THREAD_SIZE - 1);
22257 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22258 + return;
22259 + }
22260 +
22261 + cpu = get_cpu();
22262 +
22263 + /* check the irq stacks */
22264 + stack_end = (unsigned long)per_cpu(irq_stack_ptr, cpu);
22265 + stack_start = stack_end - IRQ_STACK_SIZE;
22266 + if (stack_start <= sp && sp < stack_end) {
22267 + unsigned long stack_left = sp & (IRQ_STACK_SIZE - 1);
22268 + put_cpu();
22269 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22270 + return;
22271 + }
22272 +
22273 + /* check the exception stacks */
22274 + used = 0;
22275 + stack_end = (unsigned long)in_exception_stack(cpu, sp, &used, &id);
22276 + stack_start = stack_end - EXCEPTION_STKSZ;
22277 + if (stack_end && stack_start <= sp && sp < stack_end) {
22278 + unsigned long stack_left = sp & (EXCEPTION_STKSZ - 1);
22279 + put_cpu();
22280 + BUG_ON(stack_left < 256 || size >= stack_left - 256);
22281 + return;
22282 + }
22283 +
22284 + put_cpu();
22285 +
22286 + /* unknown stack */
22287 + BUG();
22288 +}
22289 +EXPORT_SYMBOL(pax_check_alloca);
22290 +#endif
22291 diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
22292 index 988c00a..4f673b6 100644
22293 --- a/arch/x86/kernel/e820.c
22294 +++ b/arch/x86/kernel/e820.c
22295 @@ -803,8 +803,8 @@ unsigned long __init e820_end_of_low_ram_pfn(void)
22296
22297 static void early_panic(char *msg)
22298 {
22299 - early_printk(msg);
22300 - panic(msg);
22301 + early_printk("%s", msg);
22302 + panic("%s", msg);
22303 }
22304
22305 static int userdef __initdata;
22306 diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
22307 index 01d1c18..8073693 100644
22308 --- a/arch/x86/kernel/early_printk.c
22309 +++ b/arch/x86/kernel/early_printk.c
22310 @@ -7,6 +7,7 @@
22311 #include <linux/pci_regs.h>
22312 #include <linux/pci_ids.h>
22313 #include <linux/errno.h>
22314 +#include <linux/sched.h>
22315 #include <asm/io.h>
22316 #include <asm/processor.h>
22317 #include <asm/fcntl.h>
22318 diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
22319 index a2a4f46..6cab058 100644
22320 --- a/arch/x86/kernel/entry_32.S
22321 +++ b/arch/x86/kernel/entry_32.S
22322 @@ -177,13 +177,153 @@
22323 /*CFI_REL_OFFSET gs, PT_GS*/
22324 .endm
22325 .macro SET_KERNEL_GS reg
22326 +
22327 +#ifdef CONFIG_CC_STACKPROTECTOR
22328 movl $(__KERNEL_STACK_CANARY), \reg
22329 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
22330 + movl $(__USER_DS), \reg
22331 +#else
22332 + xorl \reg, \reg
22333 +#endif
22334 +
22335 movl \reg, %gs
22336 .endm
22337
22338 #endif /* CONFIG_X86_32_LAZY_GS */
22339
22340 -.macro SAVE_ALL
22341 +.macro pax_enter_kernel
22342 +#ifdef CONFIG_PAX_KERNEXEC
22343 + call pax_enter_kernel
22344 +#endif
22345 +.endm
22346 +
22347 +.macro pax_exit_kernel
22348 +#ifdef CONFIG_PAX_KERNEXEC
22349 + call pax_exit_kernel
22350 +#endif
22351 +.endm
22352 +
22353 +#ifdef CONFIG_PAX_KERNEXEC
22354 +ENTRY(pax_enter_kernel)
22355 +#ifdef CONFIG_PARAVIRT
22356 + pushl %eax
22357 + pushl %ecx
22358 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
22359 + mov %eax, %esi
22360 +#else
22361 + mov %cr0, %esi
22362 +#endif
22363 + bts $16, %esi
22364 + jnc 1f
22365 + mov %cs, %esi
22366 + cmp $__KERNEL_CS, %esi
22367 + jz 3f
22368 + ljmp $__KERNEL_CS, $3f
22369 +1: ljmp $__KERNEXEC_KERNEL_CS, $2f
22370 +2:
22371 +#ifdef CONFIG_PARAVIRT
22372 + mov %esi, %eax
22373 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
22374 +#else
22375 + mov %esi, %cr0
22376 +#endif
22377 +3:
22378 +#ifdef CONFIG_PARAVIRT
22379 + popl %ecx
22380 + popl %eax
22381 +#endif
22382 + ret
22383 +ENDPROC(pax_enter_kernel)
22384 +
22385 +ENTRY(pax_exit_kernel)
22386 +#ifdef CONFIG_PARAVIRT
22387 + pushl %eax
22388 + pushl %ecx
22389 +#endif
22390 + mov %cs, %esi
22391 + cmp $__KERNEXEC_KERNEL_CS, %esi
22392 + jnz 2f
22393 +#ifdef CONFIG_PARAVIRT
22394 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
22395 + mov %eax, %esi
22396 +#else
22397 + mov %cr0, %esi
22398 +#endif
22399 + btr $16, %esi
22400 + ljmp $__KERNEL_CS, $1f
22401 +1:
22402 +#ifdef CONFIG_PARAVIRT
22403 + mov %esi, %eax
22404 + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
22405 +#else
22406 + mov %esi, %cr0
22407 +#endif
22408 +2:
22409 +#ifdef CONFIG_PARAVIRT
22410 + popl %ecx
22411 + popl %eax
22412 +#endif
22413 + ret
22414 +ENDPROC(pax_exit_kernel)
22415 +#endif
22416 +
22417 + .macro pax_erase_kstack
22418 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
22419 + call pax_erase_kstack
22420 +#endif
22421 + .endm
22422 +
22423 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
22424 +/*
22425 + * ebp: thread_info
22426 + */
22427 +ENTRY(pax_erase_kstack)
22428 + pushl %edi
22429 + pushl %ecx
22430 + pushl %eax
22431 +
22432 + mov TI_lowest_stack(%ebp), %edi
22433 + mov $-0xBEEF, %eax
22434 + std
22435 +
22436 +1: mov %edi, %ecx
22437 + and $THREAD_SIZE_asm - 1, %ecx
22438 + shr $2, %ecx
22439 + repne scasl
22440 + jecxz 2f
22441 +
22442 + cmp $2*16, %ecx
22443 + jc 2f
22444 +
22445 + mov $2*16, %ecx
22446 + repe scasl
22447 + jecxz 2f
22448 + jne 1b
22449 +
22450 +2: cld
22451 + mov %esp, %ecx
22452 + sub %edi, %ecx
22453 +
22454 + cmp $THREAD_SIZE_asm, %ecx
22455 + jb 3f
22456 + ud2
22457 +3:
22458 +
22459 + shr $2, %ecx
22460 + rep stosl
22461 +
22462 + mov TI_task_thread_sp0(%ebp), %edi
22463 + sub $128, %edi
22464 + mov %edi, TI_lowest_stack(%ebp)
22465 +
22466 + popl %eax
22467 + popl %ecx
22468 + popl %edi
22469 + ret
22470 +ENDPROC(pax_erase_kstack)
22471 +#endif
22472 +
22473 +.macro __SAVE_ALL _DS
22474 cld
22475 PUSH_GS
22476 pushl_cfi %fs
22477 @@ -206,7 +346,7 @@
22478 CFI_REL_OFFSET ecx, 0
22479 pushl_cfi %ebx
22480 CFI_REL_OFFSET ebx, 0
22481 - movl $(__USER_DS), %edx
22482 + movl $\_DS, %edx
22483 movl %edx, %ds
22484 movl %edx, %es
22485 movl $(__KERNEL_PERCPU), %edx
22486 @@ -214,6 +354,15 @@
22487 SET_KERNEL_GS %edx
22488 .endm
22489
22490 +.macro SAVE_ALL
22491 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
22492 + __SAVE_ALL __KERNEL_DS
22493 + pax_enter_kernel
22494 +#else
22495 + __SAVE_ALL __USER_DS
22496 +#endif
22497 +.endm
22498 +
22499 .macro RESTORE_INT_REGS
22500 popl_cfi %ebx
22501 CFI_RESTORE ebx
22502 @@ -297,7 +446,7 @@ ENTRY(ret_from_fork)
22503 popfl_cfi
22504 jmp syscall_exit
22505 CFI_ENDPROC
22506 -END(ret_from_fork)
22507 +ENDPROC(ret_from_fork)
22508
22509 ENTRY(ret_from_kernel_thread)
22510 CFI_STARTPROC
22511 @@ -344,7 +493,15 @@ ret_from_intr:
22512 andl $SEGMENT_RPL_MASK, %eax
22513 #endif
22514 cmpl $USER_RPL, %eax
22515 +
22516 +#ifdef CONFIG_PAX_KERNEXEC
22517 + jae resume_userspace
22518 +
22519 + pax_exit_kernel
22520 + jmp resume_kernel
22521 +#else
22522 jb resume_kernel # not returning to v8086 or userspace
22523 +#endif
22524
22525 ENTRY(resume_userspace)
22526 LOCKDEP_SYS_EXIT
22527 @@ -356,8 +513,8 @@ ENTRY(resume_userspace)
22528 andl $_TIF_WORK_MASK, %ecx # is there any work to be done on
22529 # int/exception return?
22530 jne work_pending
22531 - jmp restore_all
22532 -END(ret_from_exception)
22533 + jmp restore_all_pax
22534 +ENDPROC(ret_from_exception)
22535
22536 #ifdef CONFIG_PREEMPT
22537 ENTRY(resume_kernel)
22538 @@ -369,7 +526,7 @@ need_resched:
22539 jz restore_all
22540 call preempt_schedule_irq
22541 jmp need_resched
22542 -END(resume_kernel)
22543 +ENDPROC(resume_kernel)
22544 #endif
22545 CFI_ENDPROC
22546 /*
22547 @@ -403,30 +560,45 @@ sysenter_past_esp:
22548 /*CFI_REL_OFFSET cs, 0*/
22549 /*
22550 * Push current_thread_info()->sysenter_return to the stack.
22551 - * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
22552 - * pushed above; +8 corresponds to copy_thread's esp0 setting.
22553 */
22554 - pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
22555 + pushl_cfi $0
22556 CFI_REL_OFFSET eip, 0
22557
22558 pushl_cfi %eax
22559 SAVE_ALL
22560 + GET_THREAD_INFO(%ebp)
22561 + movl TI_sysenter_return(%ebp),%ebp
22562 + movl %ebp,PT_EIP(%esp)
22563 ENABLE_INTERRUPTS(CLBR_NONE)
22564
22565 /*
22566 * Load the potential sixth argument from user stack.
22567 * Careful about security.
22568 */
22569 + movl PT_OLDESP(%esp),%ebp
22570 +
22571 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22572 + mov PT_OLDSS(%esp),%ds
22573 +1: movl %ds:(%ebp),%ebp
22574 + push %ss
22575 + pop %ds
22576 +#else
22577 cmpl $__PAGE_OFFSET-3,%ebp
22578 jae syscall_fault
22579 ASM_STAC
22580 1: movl (%ebp),%ebp
22581 ASM_CLAC
22582 +#endif
22583 +
22584 movl %ebp,PT_EBP(%esp)
22585 _ASM_EXTABLE(1b,syscall_fault)
22586
22587 GET_THREAD_INFO(%ebp)
22588
22589 +#ifdef CONFIG_PAX_RANDKSTACK
22590 + pax_erase_kstack
22591 +#endif
22592 +
22593 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
22594 jnz sysenter_audit
22595 sysenter_do_call:
22596 @@ -441,12 +613,24 @@ sysenter_do_call:
22597 testl $_TIF_ALLWORK_MASK, %ecx
22598 jne sysexit_audit
22599 sysenter_exit:
22600 +
22601 +#ifdef CONFIG_PAX_RANDKSTACK
22602 + pushl_cfi %eax
22603 + movl %esp, %eax
22604 + call pax_randomize_kstack
22605 + popl_cfi %eax
22606 +#endif
22607 +
22608 + pax_erase_kstack
22609 +
22610 /* if something modifies registers it must also disable sysexit */
22611 movl PT_EIP(%esp), %edx
22612 movl PT_OLDESP(%esp), %ecx
22613 xorl %ebp,%ebp
22614 TRACE_IRQS_ON
22615 1: mov PT_FS(%esp), %fs
22616 +2: mov PT_DS(%esp), %ds
22617 +3: mov PT_ES(%esp), %es
22618 PTGS_TO_GS
22619 ENABLE_INTERRUPTS_SYSEXIT
22620
22621 @@ -463,6 +647,9 @@ sysenter_audit:
22622 movl %eax,%edx /* 2nd arg: syscall number */
22623 movl $AUDIT_ARCH_I386,%eax /* 1st arg: audit arch */
22624 call __audit_syscall_entry
22625 +
22626 + pax_erase_kstack
22627 +
22628 pushl_cfi %ebx
22629 movl PT_EAX(%esp),%eax /* reload syscall number */
22630 jmp sysenter_do_call
22631 @@ -488,10 +675,16 @@ sysexit_audit:
22632
22633 CFI_ENDPROC
22634 .pushsection .fixup,"ax"
22635 -2: movl $0,PT_FS(%esp)
22636 +4: movl $0,PT_FS(%esp)
22637 + jmp 1b
22638 +5: movl $0,PT_DS(%esp)
22639 + jmp 1b
22640 +6: movl $0,PT_ES(%esp)
22641 jmp 1b
22642 .popsection
22643 - _ASM_EXTABLE(1b,2b)
22644 + _ASM_EXTABLE(1b,4b)
22645 + _ASM_EXTABLE(2b,5b)
22646 + _ASM_EXTABLE(3b,6b)
22647 PTGS_TO_GS_EX
22648 ENDPROC(ia32_sysenter_target)
22649
22650 @@ -506,6 +699,11 @@ ENTRY(system_call)
22651 pushl_cfi %eax # save orig_eax
22652 SAVE_ALL
22653 GET_THREAD_INFO(%ebp)
22654 +
22655 +#ifdef CONFIG_PAX_RANDKSTACK
22656 + pax_erase_kstack
22657 +#endif
22658 +
22659 # system call tracing in operation / emulation
22660 testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%ebp)
22661 jnz syscall_trace_entry
22662 @@ -524,6 +722,15 @@ syscall_exit:
22663 testl $_TIF_ALLWORK_MASK, %ecx # current->work
22664 jne syscall_exit_work
22665
22666 +restore_all_pax:
22667 +
22668 +#ifdef CONFIG_PAX_RANDKSTACK
22669 + movl %esp, %eax
22670 + call pax_randomize_kstack
22671 +#endif
22672 +
22673 + pax_erase_kstack
22674 +
22675 restore_all:
22676 TRACE_IRQS_IRET
22677 restore_all_notrace:
22678 @@ -580,14 +787,34 @@ ldt_ss:
22679 * compensating for the offset by changing to the ESPFIX segment with
22680 * a base address that matches for the difference.
22681 */
22682 -#define GDT_ESPFIX_SS PER_CPU_VAR(gdt_page) + (GDT_ENTRY_ESPFIX_SS * 8)
22683 +#define GDT_ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)(%ebx)
22684 mov %esp, %edx /* load kernel esp */
22685 mov PT_OLDESP(%esp), %eax /* load userspace esp */
22686 mov %dx, %ax /* eax: new kernel esp */
22687 sub %eax, %edx /* offset (low word is 0) */
22688 +#ifdef CONFIG_SMP
22689 + movl PER_CPU_VAR(cpu_number), %ebx
22690 + shll $PAGE_SHIFT_asm, %ebx
22691 + addl $cpu_gdt_table, %ebx
22692 +#else
22693 + movl $cpu_gdt_table, %ebx
22694 +#endif
22695 shr $16, %edx
22696 - mov %dl, GDT_ESPFIX_SS + 4 /* bits 16..23 */
22697 - mov %dh, GDT_ESPFIX_SS + 7 /* bits 24..31 */
22698 +
22699 +#ifdef CONFIG_PAX_KERNEXEC
22700 + mov %cr0, %esi
22701 + btr $16, %esi
22702 + mov %esi, %cr0
22703 +#endif
22704 +
22705 + mov %dl, 4 + GDT_ESPFIX_SS /* bits 16..23 */
22706 + mov %dh, 7 + GDT_ESPFIX_SS /* bits 24..31 */
22707 +
22708 +#ifdef CONFIG_PAX_KERNEXEC
22709 + bts $16, %esi
22710 + mov %esi, %cr0
22711 +#endif
22712 +
22713 pushl_cfi $__ESPFIX_SS
22714 pushl_cfi %eax /* new kernel esp */
22715 /* Disable interrupts, but do not irqtrace this section: we
22716 @@ -616,20 +843,18 @@ work_resched:
22717 movl TI_flags(%ebp), %ecx
22718 andl $_TIF_WORK_MASK, %ecx # is there any work to be done other
22719 # than syscall tracing?
22720 - jz restore_all
22721 + jz restore_all_pax
22722 testb $_TIF_NEED_RESCHED, %cl
22723 jnz work_resched
22724
22725 work_notifysig: # deal with pending signals and
22726 # notify-resume requests
22727 + movl %esp, %eax
22728 #ifdef CONFIG_VM86
22729 testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
22730 - movl %esp, %eax
22731 jne work_notifysig_v86 # returning to kernel-space or
22732 # vm86-space
22733 1:
22734 -#else
22735 - movl %esp, %eax
22736 #endif
22737 TRACE_IRQS_ON
22738 ENABLE_INTERRUPTS(CLBR_NONE)
22739 @@ -650,7 +875,7 @@ work_notifysig_v86:
22740 movl %eax, %esp
22741 jmp 1b
22742 #endif
22743 -END(work_pending)
22744 +ENDPROC(work_pending)
22745
22746 # perform syscall exit tracing
22747 ALIGN
22748 @@ -658,11 +883,14 @@ syscall_trace_entry:
22749 movl $-ENOSYS,PT_EAX(%esp)
22750 movl %esp, %eax
22751 call syscall_trace_enter
22752 +
22753 + pax_erase_kstack
22754 +
22755 /* What it returned is what we'll actually use. */
22756 cmpl $(NR_syscalls), %eax
22757 jnae syscall_call
22758 jmp syscall_exit
22759 -END(syscall_trace_entry)
22760 +ENDPROC(syscall_trace_entry)
22761
22762 # perform syscall exit tracing
22763 ALIGN
22764 @@ -675,21 +903,25 @@ syscall_exit_work:
22765 movl %esp, %eax
22766 call syscall_trace_leave
22767 jmp resume_userspace
22768 -END(syscall_exit_work)
22769 +ENDPROC(syscall_exit_work)
22770 CFI_ENDPROC
22771
22772 RING0_INT_FRAME # can't unwind into user space anyway
22773 syscall_fault:
22774 +#ifdef CONFIG_PAX_MEMORY_UDEREF
22775 + push %ss
22776 + pop %ds
22777 +#endif
22778 ASM_CLAC
22779 GET_THREAD_INFO(%ebp)
22780 movl $-EFAULT,PT_EAX(%esp)
22781 jmp resume_userspace
22782 -END(syscall_fault)
22783 +ENDPROC(syscall_fault)
22784
22785 syscall_badsys:
22786 movl $-ENOSYS,PT_EAX(%esp)
22787 jmp resume_userspace
22788 -END(syscall_badsys)
22789 +ENDPROC(syscall_badsys)
22790 CFI_ENDPROC
22791 /*
22792 * End of kprobes section
22793 @@ -705,8 +937,15 @@ END(syscall_badsys)
22794 * normal stack and adjusts ESP with the matching offset.
22795 */
22796 /* fixup the stack */
22797 - mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
22798 - mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
22799 +#ifdef CONFIG_SMP
22800 + movl PER_CPU_VAR(cpu_number), %ebx
22801 + shll $PAGE_SHIFT_asm, %ebx
22802 + addl $cpu_gdt_table, %ebx
22803 +#else
22804 + movl $cpu_gdt_table, %ebx
22805 +#endif
22806 + mov 4 + GDT_ESPFIX_SS, %al /* bits 16..23 */
22807 + mov 7 + GDT_ESPFIX_SS, %ah /* bits 24..31 */
22808 shl $16, %eax
22809 addl %esp, %eax /* the adjusted stack pointer */
22810 pushl_cfi $__KERNEL_DS
22811 @@ -759,7 +998,7 @@ vector=vector+1
22812 .endr
22813 2: jmp common_interrupt
22814 .endr
22815 -END(irq_entries_start)
22816 +ENDPROC(irq_entries_start)
22817
22818 .previous
22819 END(interrupt)
22820 @@ -820,7 +1059,7 @@ ENTRY(coprocessor_error)
22821 pushl_cfi $do_coprocessor_error
22822 jmp error_code
22823 CFI_ENDPROC
22824 -END(coprocessor_error)
22825 +ENDPROC(coprocessor_error)
22826
22827 ENTRY(simd_coprocessor_error)
22828 RING0_INT_FRAME
22829 @@ -833,7 +1072,7 @@ ENTRY(simd_coprocessor_error)
22830 .section .altinstructions,"a"
22831 altinstruction_entry 661b, 663f, X86_FEATURE_XMM, 662b-661b, 664f-663f
22832 .previous
22833 -.section .altinstr_replacement,"ax"
22834 +.section .altinstr_replacement,"a"
22835 663: pushl $do_simd_coprocessor_error
22836 664:
22837 .previous
22838 @@ -842,7 +1081,7 @@ ENTRY(simd_coprocessor_error)
22839 #endif
22840 jmp error_code
22841 CFI_ENDPROC
22842 -END(simd_coprocessor_error)
22843 +ENDPROC(simd_coprocessor_error)
22844
22845 ENTRY(device_not_available)
22846 RING0_INT_FRAME
22847 @@ -851,18 +1090,18 @@ ENTRY(device_not_available)
22848 pushl_cfi $do_device_not_available
22849 jmp error_code
22850 CFI_ENDPROC
22851 -END(device_not_available)
22852 +ENDPROC(device_not_available)
22853
22854 #ifdef CONFIG_PARAVIRT
22855 ENTRY(native_iret)
22856 iret
22857 _ASM_EXTABLE(native_iret, iret_exc)
22858 -END(native_iret)
22859 +ENDPROC(native_iret)
22860
22861 ENTRY(native_irq_enable_sysexit)
22862 sti
22863 sysexit
22864 -END(native_irq_enable_sysexit)
22865 +ENDPROC(native_irq_enable_sysexit)
22866 #endif
22867
22868 ENTRY(overflow)
22869 @@ -872,7 +1111,7 @@ ENTRY(overflow)
22870 pushl_cfi $do_overflow
22871 jmp error_code
22872 CFI_ENDPROC
22873 -END(overflow)
22874 +ENDPROC(overflow)
22875
22876 ENTRY(bounds)
22877 RING0_INT_FRAME
22878 @@ -881,7 +1120,7 @@ ENTRY(bounds)
22879 pushl_cfi $do_bounds
22880 jmp error_code
22881 CFI_ENDPROC
22882 -END(bounds)
22883 +ENDPROC(bounds)
22884
22885 ENTRY(invalid_op)
22886 RING0_INT_FRAME
22887 @@ -890,7 +1129,7 @@ ENTRY(invalid_op)
22888 pushl_cfi $do_invalid_op
22889 jmp error_code
22890 CFI_ENDPROC
22891 -END(invalid_op)
22892 +ENDPROC(invalid_op)
22893
22894 ENTRY(coprocessor_segment_overrun)
22895 RING0_INT_FRAME
22896 @@ -899,7 +1138,7 @@ ENTRY(coprocessor_segment_overrun)
22897 pushl_cfi $do_coprocessor_segment_overrun
22898 jmp error_code
22899 CFI_ENDPROC
22900 -END(coprocessor_segment_overrun)
22901 +ENDPROC(coprocessor_segment_overrun)
22902
22903 ENTRY(invalid_TSS)
22904 RING0_EC_FRAME
22905 @@ -907,7 +1146,7 @@ ENTRY(invalid_TSS)
22906 pushl_cfi $do_invalid_TSS
22907 jmp error_code
22908 CFI_ENDPROC
22909 -END(invalid_TSS)
22910 +ENDPROC(invalid_TSS)
22911
22912 ENTRY(segment_not_present)
22913 RING0_EC_FRAME
22914 @@ -915,7 +1154,7 @@ ENTRY(segment_not_present)
22915 pushl_cfi $do_segment_not_present
22916 jmp error_code
22917 CFI_ENDPROC
22918 -END(segment_not_present)
22919 +ENDPROC(segment_not_present)
22920
22921 ENTRY(stack_segment)
22922 RING0_EC_FRAME
22923 @@ -923,7 +1162,7 @@ ENTRY(stack_segment)
22924 pushl_cfi $do_stack_segment
22925 jmp error_code
22926 CFI_ENDPROC
22927 -END(stack_segment)
22928 +ENDPROC(stack_segment)
22929
22930 ENTRY(alignment_check)
22931 RING0_EC_FRAME
22932 @@ -931,7 +1170,7 @@ ENTRY(alignment_check)
22933 pushl_cfi $do_alignment_check
22934 jmp error_code
22935 CFI_ENDPROC
22936 -END(alignment_check)
22937 +ENDPROC(alignment_check)
22938
22939 ENTRY(divide_error)
22940 RING0_INT_FRAME
22941 @@ -940,7 +1179,7 @@ ENTRY(divide_error)
22942 pushl_cfi $do_divide_error
22943 jmp error_code
22944 CFI_ENDPROC
22945 -END(divide_error)
22946 +ENDPROC(divide_error)
22947
22948 #ifdef CONFIG_X86_MCE
22949 ENTRY(machine_check)
22950 @@ -950,7 +1189,7 @@ ENTRY(machine_check)
22951 pushl_cfi machine_check_vector
22952 jmp error_code
22953 CFI_ENDPROC
22954 -END(machine_check)
22955 +ENDPROC(machine_check)
22956 #endif
22957
22958 ENTRY(spurious_interrupt_bug)
22959 @@ -960,7 +1199,7 @@ ENTRY(spurious_interrupt_bug)
22960 pushl_cfi $do_spurious_interrupt_bug
22961 jmp error_code
22962 CFI_ENDPROC
22963 -END(spurious_interrupt_bug)
22964 +ENDPROC(spurious_interrupt_bug)
22965 /*
22966 * End of kprobes section
22967 */
22968 @@ -1070,7 +1309,7 @@ BUILD_INTERRUPT3(hyperv_callback_vector, HYPERVISOR_CALLBACK_VECTOR,
22969
22970 ENTRY(mcount)
22971 ret
22972 -END(mcount)
22973 +ENDPROC(mcount)
22974
22975 ENTRY(ftrace_caller)
22976 cmpl $0, function_trace_stop
22977 @@ -1103,7 +1342,7 @@ ftrace_graph_call:
22978 .globl ftrace_stub
22979 ftrace_stub:
22980 ret
22981 -END(ftrace_caller)
22982 +ENDPROC(ftrace_caller)
22983
22984 ENTRY(ftrace_regs_caller)
22985 pushf /* push flags before compare (in cs location) */
22986 @@ -1207,7 +1446,7 @@ trace:
22987 popl %ecx
22988 popl %eax
22989 jmp ftrace_stub
22990 -END(mcount)
22991 +ENDPROC(mcount)
22992 #endif /* CONFIG_DYNAMIC_FTRACE */
22993 #endif /* CONFIG_FUNCTION_TRACER */
22994
22995 @@ -1225,7 +1464,7 @@ ENTRY(ftrace_graph_caller)
22996 popl %ecx
22997 popl %eax
22998 ret
22999 -END(ftrace_graph_caller)
23000 +ENDPROC(ftrace_graph_caller)
23001
23002 .globl return_to_handler
23003 return_to_handler:
23004 @@ -1291,15 +1530,18 @@ error_code:
23005 movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart
23006 REG_TO_PTGS %ecx
23007 SET_KERNEL_GS %ecx
23008 - movl $(__USER_DS), %ecx
23009 + movl $(__KERNEL_DS), %ecx
23010 movl %ecx, %ds
23011 movl %ecx, %es
23012 +
23013 + pax_enter_kernel
23014 +
23015 TRACE_IRQS_OFF
23016 movl %esp,%eax # pt_regs pointer
23017 call *%edi
23018 jmp ret_from_exception
23019 CFI_ENDPROC
23020 -END(page_fault)
23021 +ENDPROC(page_fault)
23022
23023 /*
23024 * Debug traps and NMI can happen at the one SYSENTER instruction
23025 @@ -1342,7 +1584,7 @@ debug_stack_correct:
23026 call do_debug
23027 jmp ret_from_exception
23028 CFI_ENDPROC
23029 -END(debug)
23030 +ENDPROC(debug)
23031
23032 /*
23033 * NMI is doubly nasty. It can happen _while_ we're handling
23034 @@ -1380,6 +1622,9 @@ nmi_stack_correct:
23035 xorl %edx,%edx # zero error code
23036 movl %esp,%eax # pt_regs pointer
23037 call do_nmi
23038 +
23039 + pax_exit_kernel
23040 +
23041 jmp restore_all_notrace
23042 CFI_ENDPROC
23043
23044 @@ -1416,12 +1661,15 @@ nmi_espfix_stack:
23045 FIXUP_ESPFIX_STACK # %eax == %esp
23046 xorl %edx,%edx # zero error code
23047 call do_nmi
23048 +
23049 + pax_exit_kernel
23050 +
23051 RESTORE_REGS
23052 lss 12+4(%esp), %esp # back to espfix stack
23053 CFI_ADJUST_CFA_OFFSET -24
23054 jmp irq_return
23055 CFI_ENDPROC
23056 -END(nmi)
23057 +ENDPROC(nmi)
23058
23059 ENTRY(int3)
23060 RING0_INT_FRAME
23061 @@ -1434,14 +1682,14 @@ ENTRY(int3)
23062 call do_int3
23063 jmp ret_from_exception
23064 CFI_ENDPROC
23065 -END(int3)
23066 +ENDPROC(int3)
23067
23068 ENTRY(general_protection)
23069 RING0_EC_FRAME
23070 pushl_cfi $do_general_protection
23071 jmp error_code
23072 CFI_ENDPROC
23073 -END(general_protection)
23074 +ENDPROC(general_protection)
23075
23076 #ifdef CONFIG_KVM_GUEST
23077 ENTRY(async_page_fault)
23078 @@ -1450,7 +1698,7 @@ ENTRY(async_page_fault)
23079 pushl_cfi $do_async_page_fault
23080 jmp error_code
23081 CFI_ENDPROC
23082 -END(async_page_fault)
23083 +ENDPROC(async_page_fault)
23084 #endif
23085
23086 /*
23087 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
23088 index 1e96c36..3ff710a 100644
23089 --- a/arch/x86/kernel/entry_64.S
23090 +++ b/arch/x86/kernel/entry_64.S
23091 @@ -59,6 +59,8 @@
23092 #include <asm/context_tracking.h>
23093 #include <asm/smap.h>
23094 #include <linux/err.h>
23095 +#include <asm/pgtable.h>
23096 +#include <asm/alternative-asm.h>
23097
23098 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
23099 #include <linux/elf-em.h>
23100 @@ -80,8 +82,9 @@
23101 #ifdef CONFIG_DYNAMIC_FTRACE
23102
23103 ENTRY(function_hook)
23104 + pax_force_retaddr
23105 retq
23106 -END(function_hook)
23107 +ENDPROC(function_hook)
23108
23109 /* skip is set if stack has been adjusted */
23110 .macro ftrace_caller_setup skip=0
23111 @@ -122,8 +125,9 @@ GLOBAL(ftrace_graph_call)
23112 #endif
23113
23114 GLOBAL(ftrace_stub)
23115 + pax_force_retaddr
23116 retq
23117 -END(ftrace_caller)
23118 +ENDPROC(ftrace_caller)
23119
23120 ENTRY(ftrace_regs_caller)
23121 /* Save the current flags before compare (in SS location)*/
23122 @@ -191,7 +195,7 @@ ftrace_restore_flags:
23123 popfq
23124 jmp ftrace_stub
23125
23126 -END(ftrace_regs_caller)
23127 +ENDPROC(ftrace_regs_caller)
23128
23129
23130 #else /* ! CONFIG_DYNAMIC_FTRACE */
23131 @@ -212,6 +216,7 @@ ENTRY(function_hook)
23132 #endif
23133
23134 GLOBAL(ftrace_stub)
23135 + pax_force_retaddr
23136 retq
23137
23138 trace:
23139 @@ -225,12 +230,13 @@ trace:
23140 #endif
23141 subq $MCOUNT_INSN_SIZE, %rdi
23142
23143 + pax_force_fptr ftrace_trace_function
23144 call *ftrace_trace_function
23145
23146 MCOUNT_RESTORE_FRAME
23147
23148 jmp ftrace_stub
23149 -END(function_hook)
23150 +ENDPROC(function_hook)
23151 #endif /* CONFIG_DYNAMIC_FTRACE */
23152 #endif /* CONFIG_FUNCTION_TRACER */
23153
23154 @@ -252,8 +258,9 @@ ENTRY(ftrace_graph_caller)
23155
23156 MCOUNT_RESTORE_FRAME
23157
23158 + pax_force_retaddr
23159 retq
23160 -END(ftrace_graph_caller)
23161 +ENDPROC(ftrace_graph_caller)
23162
23163 GLOBAL(return_to_handler)
23164 subq $24, %rsp
23165 @@ -269,7 +276,9 @@ GLOBAL(return_to_handler)
23166 movq 8(%rsp), %rdx
23167 movq (%rsp), %rax
23168 addq $24, %rsp
23169 + pax_force_fptr %rdi
23170 jmp *%rdi
23171 +ENDPROC(return_to_handler)
23172 #endif
23173
23174
23175 @@ -284,6 +293,430 @@ ENTRY(native_usergs_sysret64)
23176 ENDPROC(native_usergs_sysret64)
23177 #endif /* CONFIG_PARAVIRT */
23178
23179 + .macro ljmpq sel, off
23180 +#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
23181 + .byte 0x48; ljmp *1234f(%rip)
23182 + .pushsection .rodata
23183 + .align 16
23184 + 1234: .quad \off; .word \sel
23185 + .popsection
23186 +#else
23187 + pushq $\sel
23188 + pushq $\off
23189 + lretq
23190 +#endif
23191 + .endm
23192 +
23193 + .macro pax_enter_kernel
23194 + pax_set_fptr_mask
23195 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23196 + call pax_enter_kernel
23197 +#endif
23198 + .endm
23199 +
23200 + .macro pax_exit_kernel
23201 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23202 + call pax_exit_kernel
23203 +#endif
23204 +
23205 + .endm
23206 +
23207 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
23208 +ENTRY(pax_enter_kernel)
23209 + pushq %rdi
23210 +
23211 +#ifdef CONFIG_PARAVIRT
23212 + PV_SAVE_REGS(CLBR_RDI)
23213 +#endif
23214 +
23215 +#ifdef CONFIG_PAX_KERNEXEC
23216 + GET_CR0_INTO_RDI
23217 + bts $16,%rdi
23218 + jnc 3f
23219 + mov %cs,%edi
23220 + cmp $__KERNEL_CS,%edi
23221 + jnz 2f
23222 +1:
23223 +#endif
23224 +
23225 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23226 + 661: jmp 111f
23227 + .pushsection .altinstr_replacement, "a"
23228 + 662: ASM_NOP2
23229 + .popsection
23230 + .pushsection .altinstructions, "a"
23231 + altinstruction_entry 661b, 662b, X86_FEATURE_PCID, 2, 2
23232 + .popsection
23233 + GET_CR3_INTO_RDI
23234 + cmp $0,%dil
23235 + jnz 112f
23236 + mov $__KERNEL_DS,%edi
23237 + mov %edi,%ss
23238 + jmp 111f
23239 +112: cmp $1,%dil
23240 + jz 113f
23241 + ud2
23242 +113: sub $4097,%rdi
23243 + bts $63,%rdi
23244 + SET_RDI_INTO_CR3
23245 + mov $__UDEREF_KERNEL_DS,%edi
23246 + mov %edi,%ss
23247 +111:
23248 +#endif
23249 +
23250 +#ifdef CONFIG_PARAVIRT
23251 + PV_RESTORE_REGS(CLBR_RDI)
23252 +#endif
23253 +
23254 + popq %rdi
23255 + pax_force_retaddr
23256 + retq
23257 +
23258 +#ifdef CONFIG_PAX_KERNEXEC
23259 +2: ljmpq __KERNEL_CS,1b
23260 +3: ljmpq __KERNEXEC_KERNEL_CS,4f
23261 +4: SET_RDI_INTO_CR0
23262 + jmp 1b
23263 +#endif
23264 +ENDPROC(pax_enter_kernel)
23265 +
23266 +ENTRY(pax_exit_kernel)
23267 + pushq %rdi
23268 +
23269 +#ifdef CONFIG_PARAVIRT
23270 + PV_SAVE_REGS(CLBR_RDI)
23271 +#endif
23272 +
23273 +#ifdef CONFIG_PAX_KERNEXEC
23274 + mov %cs,%rdi
23275 + cmp $__KERNEXEC_KERNEL_CS,%edi
23276 + jz 2f
23277 + GET_CR0_INTO_RDI
23278 + bts $16,%rdi
23279 + jnc 4f
23280 +1:
23281 +#endif
23282 +
23283 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23284 + 661: jmp 111f
23285 + .pushsection .altinstr_replacement, "a"
23286 + 662: ASM_NOP2
23287 + .popsection
23288 + .pushsection .altinstructions, "a"
23289 + altinstruction_entry 661b, 662b, X86_FEATURE_PCID, 2, 2
23290 + .popsection
23291 + mov %ss,%edi
23292 + cmp $__UDEREF_KERNEL_DS,%edi
23293 + jnz 111f
23294 + GET_CR3_INTO_RDI
23295 + cmp $0,%dil
23296 + jz 112f
23297 + ud2
23298 +112: add $4097,%rdi
23299 + bts $63,%rdi
23300 + SET_RDI_INTO_CR3
23301 + mov $__KERNEL_DS,%edi
23302 + mov %edi,%ss
23303 +111:
23304 +#endif
23305 +
23306 +#ifdef CONFIG_PARAVIRT
23307 + PV_RESTORE_REGS(CLBR_RDI);
23308 +#endif
23309 +
23310 + popq %rdi
23311 + pax_force_retaddr
23312 + retq
23313 +
23314 +#ifdef CONFIG_PAX_KERNEXEC
23315 +2: GET_CR0_INTO_RDI
23316 + btr $16,%rdi
23317 + jnc 4f
23318 + ljmpq __KERNEL_CS,3f
23319 +3: SET_RDI_INTO_CR0
23320 + jmp 1b
23321 +4: ud2
23322 + jmp 4b
23323 +#endif
23324 +ENDPROC(pax_exit_kernel)
23325 +#endif
23326 +
23327 + .macro pax_enter_kernel_user
23328 + pax_set_fptr_mask
23329 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23330 + call pax_enter_kernel_user
23331 +#endif
23332 + .endm
23333 +
23334 + .macro pax_exit_kernel_user
23335 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23336 + call pax_exit_kernel_user
23337 +#endif
23338 +#ifdef CONFIG_PAX_RANDKSTACK
23339 + pushq %rax
23340 + pushq %r11
23341 + call pax_randomize_kstack
23342 + popq %r11
23343 + popq %rax
23344 +#endif
23345 + .endm
23346 +
23347 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23348 +ENTRY(pax_enter_kernel_user)
23349 + pushq %rdi
23350 + pushq %rbx
23351 +
23352 +#ifdef CONFIG_PARAVIRT
23353 + PV_SAVE_REGS(CLBR_RDI)
23354 +#endif
23355 +
23356 + 661: jmp 111f
23357 + .pushsection .altinstr_replacement, "a"
23358 + 662: ASM_NOP2
23359 + .popsection
23360 + .pushsection .altinstructions, "a"
23361 + altinstruction_entry 661b, 662b, X86_FEATURE_PCID, 2, 2
23362 + .popsection
23363 + GET_CR3_INTO_RDI
23364 + cmp $1,%dil
23365 + jnz 4f
23366 + sub $4097,%rdi
23367 + bts $63,%rdi
23368 + SET_RDI_INTO_CR3
23369 + jmp 3f
23370 +111:
23371 +
23372 + GET_CR3_INTO_RDI
23373 + mov %rdi,%rbx
23374 + add $__START_KERNEL_map,%rbx
23375 + sub phys_base(%rip),%rbx
23376 +
23377 +#ifdef CONFIG_PARAVIRT
23378 + cmpl $0, pv_info+PARAVIRT_enabled
23379 + jz 1f
23380 + pushq %rdi
23381 + i = 0
23382 + .rept USER_PGD_PTRS
23383 + mov i*8(%rbx),%rsi
23384 + mov $0,%sil
23385 + lea i*8(%rbx),%rdi
23386 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
23387 + i = i + 1
23388 + .endr
23389 + popq %rdi
23390 + jmp 2f
23391 +1:
23392 +#endif
23393 +
23394 + i = 0
23395 + .rept USER_PGD_PTRS
23396 + movb $0,i*8(%rbx)
23397 + i = i + 1
23398 + .endr
23399 +
23400 +2: SET_RDI_INTO_CR3
23401 +
23402 +#ifdef CONFIG_PAX_KERNEXEC
23403 + GET_CR0_INTO_RDI
23404 + bts $16,%rdi
23405 + SET_RDI_INTO_CR0
23406 +#endif
23407 +
23408 +3:
23409 +
23410 +#ifdef CONFIG_PARAVIRT
23411 + PV_RESTORE_REGS(CLBR_RDI)
23412 +#endif
23413 +
23414 + popq %rbx
23415 + popq %rdi
23416 + pax_force_retaddr
23417 + retq
23418 +4: ud2
23419 +ENDPROC(pax_enter_kernel_user)
23420 +
23421 +ENTRY(pax_exit_kernel_user)
23422 + pushq %rdi
23423 + pushq %rbx
23424 +
23425 +#ifdef CONFIG_PARAVIRT
23426 + PV_SAVE_REGS(CLBR_RDI)
23427 +#endif
23428 +
23429 + GET_CR3_INTO_RDI
23430 + 661: jmp 1f
23431 + .pushsection .altinstr_replacement, "a"
23432 + 662: ASM_NOP2
23433 + .popsection
23434 + .pushsection .altinstructions, "a"
23435 + altinstruction_entry 661b, 662b, X86_FEATURE_PCID, 2, 2
23436 + .popsection
23437 + cmp $0,%dil
23438 + jnz 3f
23439 + add $4097,%rdi
23440 + bts $63,%rdi
23441 + SET_RDI_INTO_CR3
23442 + jmp 2f
23443 +1:
23444 +
23445 + mov %rdi,%rbx
23446 +
23447 +#ifdef CONFIG_PAX_KERNEXEC
23448 + GET_CR0_INTO_RDI
23449 + btr $16,%rdi
23450 + jnc 3f
23451 + SET_RDI_INTO_CR0
23452 +#endif
23453 +
23454 + add $__START_KERNEL_map,%rbx
23455 + sub phys_base(%rip),%rbx
23456 +
23457 +#ifdef CONFIG_PARAVIRT
23458 + cmpl $0, pv_info+PARAVIRT_enabled
23459 + jz 1f
23460 + i = 0
23461 + .rept USER_PGD_PTRS
23462 + mov i*8(%rbx),%rsi
23463 + mov $0x67,%sil
23464 + lea i*8(%rbx),%rdi
23465 + call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd_batched)
23466 + i = i + 1
23467 + .endr
23468 + jmp 2f
23469 +1:
23470 +#endif
23471 +
23472 + i = 0
23473 + .rept USER_PGD_PTRS
23474 + movb $0x67,i*8(%rbx)
23475 + i = i + 1
23476 + .endr
23477 +2:
23478 +
23479 +#ifdef CONFIG_PARAVIRT
23480 + PV_RESTORE_REGS(CLBR_RDI)
23481 +#endif
23482 +
23483 + popq %rbx
23484 + popq %rdi
23485 + pax_force_retaddr
23486 + retq
23487 +3: ud2
23488 +ENDPROC(pax_exit_kernel_user)
23489 +#endif
23490 +
23491 + .macro pax_enter_kernel_nmi
23492 + pax_set_fptr_mask
23493 +
23494 +#ifdef CONFIG_PAX_KERNEXEC
23495 + GET_CR0_INTO_RDI
23496 + bts $16,%rdi
23497 + jc 110f
23498 + SET_RDI_INTO_CR0
23499 + or $2,%ebx
23500 +110:
23501 +#endif
23502 +
23503 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23504 + 661: jmp 111f
23505 + .pushsection .altinstr_replacement, "a"
23506 + 662: ASM_NOP2
23507 + .popsection
23508 + .pushsection .altinstructions, "a"
23509 + altinstruction_entry 661b, 662b, X86_FEATURE_PCID, 2, 2
23510 + .popsection
23511 + GET_CR3_INTO_RDI
23512 + cmp $0,%dil
23513 + jz 111f
23514 + sub $4097,%rdi
23515 + or $4,%ebx
23516 + bts $63,%rdi
23517 + SET_RDI_INTO_CR3
23518 + mov $__UDEREF_KERNEL_DS,%edi
23519 + mov %edi,%ss
23520 +111:
23521 +#endif
23522 + .endm
23523 +
23524 + .macro pax_exit_kernel_nmi
23525 +#ifdef CONFIG_PAX_KERNEXEC
23526 + btr $1,%ebx
23527 + jnc 110f
23528 + GET_CR0_INTO_RDI
23529 + btr $16,%rdi
23530 + SET_RDI_INTO_CR0
23531 +110:
23532 +#endif
23533 +
23534 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23535 + btr $2,%ebx
23536 + jnc 111f
23537 + GET_CR3_INTO_RDI
23538 + add $4097,%rdi
23539 + bts $63,%rdi
23540 + SET_RDI_INTO_CR3
23541 + mov $__KERNEL_DS,%edi
23542 + mov %edi,%ss
23543 +111:
23544 +#endif
23545 + .endm
23546 +
23547 + .macro pax_erase_kstack
23548 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
23549 + call pax_erase_kstack
23550 +#endif
23551 + .endm
23552 +
23553 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
23554 +ENTRY(pax_erase_kstack)
23555 + pushq %rdi
23556 + pushq %rcx
23557 + pushq %rax
23558 + pushq %r11
23559 +
23560 + GET_THREAD_INFO(%r11)
23561 + mov TI_lowest_stack(%r11), %rdi
23562 + mov $-0xBEEF, %rax
23563 + std
23564 +
23565 +1: mov %edi, %ecx
23566 + and $THREAD_SIZE_asm - 1, %ecx
23567 + shr $3, %ecx
23568 + repne scasq
23569 + jecxz 2f
23570 +
23571 + cmp $2*8, %ecx
23572 + jc 2f
23573 +
23574 + mov $2*8, %ecx
23575 + repe scasq
23576 + jecxz 2f
23577 + jne 1b
23578 +
23579 +2: cld
23580 + mov %esp, %ecx
23581 + sub %edi, %ecx
23582 +
23583 + cmp $THREAD_SIZE_asm, %rcx
23584 + jb 3f
23585 + ud2
23586 +3:
23587 +
23588 + shr $3, %ecx
23589 + rep stosq
23590 +
23591 + mov TI_task_thread_sp0(%r11), %rdi
23592 + sub $256, %rdi
23593 + mov %rdi, TI_lowest_stack(%r11)
23594 +
23595 + popq %r11
23596 + popq %rax
23597 + popq %rcx
23598 + popq %rdi
23599 + pax_force_retaddr
23600 + ret
23601 +ENDPROC(pax_erase_kstack)
23602 +#endif
23603
23604 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
23605 #ifdef CONFIG_TRACE_IRQFLAGS
23606 @@ -320,7 +753,7 @@ ENDPROC(native_usergs_sysret64)
23607 .endm
23608
23609 .macro TRACE_IRQS_IRETQ_DEBUG offset=ARGOFFSET
23610 - bt $9,EFLAGS-\offset(%rsp) /* interrupts off? */
23611 + bt $X86_EFLAGS_IF_BIT,EFLAGS-\offset(%rsp) /* interrupts off? */
23612 jnc 1f
23613 TRACE_IRQS_ON_DEBUG
23614 1:
23615 @@ -358,27 +791,6 @@ ENDPROC(native_usergs_sysret64)
23616 movq \tmp,R11+\offset(%rsp)
23617 .endm
23618
23619 - .macro FAKE_STACK_FRAME child_rip
23620 - /* push in order ss, rsp, eflags, cs, rip */
23621 - xorl %eax, %eax
23622 - pushq_cfi $__KERNEL_DS /* ss */
23623 - /*CFI_REL_OFFSET ss,0*/
23624 - pushq_cfi %rax /* rsp */
23625 - CFI_REL_OFFSET rsp,0
23626 - pushq_cfi $(X86_EFLAGS_IF|X86_EFLAGS_FIXED) /* eflags - interrupts on */
23627 - /*CFI_REL_OFFSET rflags,0*/
23628 - pushq_cfi $__KERNEL_CS /* cs */
23629 - /*CFI_REL_OFFSET cs,0*/
23630 - pushq_cfi \child_rip /* rip */
23631 - CFI_REL_OFFSET rip,0
23632 - pushq_cfi %rax /* orig rax */
23633 - .endm
23634 -
23635 - .macro UNFAKE_STACK_FRAME
23636 - addq $8*6, %rsp
23637 - CFI_ADJUST_CFA_OFFSET -(6*8)
23638 - .endm
23639 -
23640 /*
23641 * initial frame state for interrupts (and exceptions without error code)
23642 */
23643 @@ -445,25 +857,26 @@ ENDPROC(native_usergs_sysret64)
23644 /* save partial stack frame */
23645 .macro SAVE_ARGS_IRQ
23646 cld
23647 - /* start from rbp in pt_regs and jump over */
23648 - movq_cfi rdi, (RDI-RBP)
23649 - movq_cfi rsi, (RSI-RBP)
23650 - movq_cfi rdx, (RDX-RBP)
23651 - movq_cfi rcx, (RCX-RBP)
23652 - movq_cfi rax, (RAX-RBP)
23653 - movq_cfi r8, (R8-RBP)
23654 - movq_cfi r9, (R9-RBP)
23655 - movq_cfi r10, (R10-RBP)
23656 - movq_cfi r11, (R11-RBP)
23657 + /* start from r15 in pt_regs and jump over */
23658 + movq_cfi rdi, RDI
23659 + movq_cfi rsi, RSI
23660 + movq_cfi rdx, RDX
23661 + movq_cfi rcx, RCX
23662 + movq_cfi rax, RAX
23663 + movq_cfi r8, R8
23664 + movq_cfi r9, R9
23665 + movq_cfi r10, R10
23666 + movq_cfi r11, R11
23667 + movq_cfi r12, R12
23668
23669 /* Save rbp so that we can unwind from get_irq_regs() */
23670 - movq_cfi rbp, 0
23671 + movq_cfi rbp, RBP
23672
23673 /* Save previous stack value */
23674 movq %rsp, %rsi
23675
23676 - leaq -RBP(%rsp),%rdi /* arg1 for handler */
23677 - testl $3, CS-RBP(%rsi)
23678 + movq %rsp,%rdi /* arg1 for handler */
23679 + testb $3, CS(%rsi)
23680 je 1f
23681 SWAPGS
23682 /*
23683 @@ -483,6 +896,18 @@ ENDPROC(native_usergs_sysret64)
23684 0x06 /* DW_OP_deref */, \
23685 0x08 /* DW_OP_const1u */, SS+8-RBP, \
23686 0x22 /* DW_OP_plus */
23687 +
23688 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23689 + testb $3, CS(%rdi)
23690 + jnz 1f
23691 + pax_enter_kernel
23692 + jmp 2f
23693 +1: pax_enter_kernel_user
23694 +2:
23695 +#else
23696 + pax_enter_kernel
23697 +#endif
23698 +
23699 /* We entered an interrupt context - irqs are off: */
23700 TRACE_IRQS_OFF
23701 .endm
23702 @@ -514,9 +939,52 @@ ENTRY(save_paranoid)
23703 js 1f /* negative -> in kernel */
23704 SWAPGS
23705 xorl %ebx,%ebx
23706 -1: ret
23707 +1:
23708 +#ifdef CONFIG_PAX_MEMORY_UDEREF
23709 + testb $3, CS+8(%rsp)
23710 + jnz 1f
23711 + pax_enter_kernel
23712 + jmp 2f
23713 +1: pax_enter_kernel_user
23714 +2:
23715 +#else
23716 + pax_enter_kernel
23717 +#endif
23718 + pax_force_retaddr
23719 + ret
23720 CFI_ENDPROC
23721 -END(save_paranoid)
23722 +ENDPROC(save_paranoid)
23723 +
23724 +ENTRY(save_paranoid_nmi)
23725 + XCPT_FRAME 1 RDI+8
23726 + cld
23727 + movq_cfi rdi, RDI+8
23728 + movq_cfi rsi, RSI+8
23729 + movq_cfi rdx, RDX+8
23730 + movq_cfi rcx, RCX+8
23731 + movq_cfi rax, RAX+8
23732 + movq_cfi r8, R8+8
23733 + movq_cfi r9, R9+8
23734 + movq_cfi r10, R10+8
23735 + movq_cfi r11, R11+8
23736 + movq_cfi rbx, RBX+8
23737 + movq_cfi rbp, RBP+8
23738 + movq_cfi r12, R12+8
23739 + movq_cfi r13, R13+8
23740 + movq_cfi r14, R14+8
23741 + movq_cfi r15, R15+8
23742 + movl $1,%ebx
23743 + movl $MSR_GS_BASE,%ecx
23744 + rdmsr
23745 + testl %edx,%edx
23746 + js 1f /* negative -> in kernel */
23747 + SWAPGS
23748 + xorl %ebx,%ebx
23749 +1: pax_enter_kernel_nmi
23750 + pax_force_retaddr
23751 + ret
23752 + CFI_ENDPROC
23753 +ENDPROC(save_paranoid_nmi)
23754 .popsection
23755
23756 /*
23757 @@ -538,7 +1006,7 @@ ENTRY(ret_from_fork)
23758
23759 RESTORE_REST
23760
23761 - testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
23762 + testb $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
23763 jz 1f
23764
23765 testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
23766 @@ -548,15 +1016,13 @@ ENTRY(ret_from_fork)
23767 jmp ret_from_sys_call # go to the SYSRET fastpath
23768
23769 1:
23770 - subq $REST_SKIP, %rsp # leave space for volatiles
23771 - CFI_ADJUST_CFA_OFFSET REST_SKIP
23772 movq %rbp, %rdi
23773 call *%rbx
23774 movl $0, RAX(%rsp)
23775 RESTORE_REST
23776 jmp int_ret_from_sys_call
23777 CFI_ENDPROC
23778 -END(ret_from_fork)
23779 +ENDPROC(ret_from_fork)
23780
23781 /*
23782 * System call entry. Up to 6 arguments in registers are supported.
23783 @@ -593,7 +1059,7 @@ END(ret_from_fork)
23784 ENTRY(system_call)
23785 CFI_STARTPROC simple
23786 CFI_SIGNAL_FRAME
23787 - CFI_DEF_CFA rsp,KERNEL_STACK_OFFSET
23788 + CFI_DEF_CFA rsp,0
23789 CFI_REGISTER rip,rcx
23790 /*CFI_REGISTER rflags,r11*/
23791 SWAPGS_UNSAFE_STACK
23792 @@ -606,16 +1072,23 @@ GLOBAL(system_call_after_swapgs)
23793
23794 movq %rsp,PER_CPU_VAR(old_rsp)
23795 movq PER_CPU_VAR(kernel_stack),%rsp
23796 + SAVE_ARGS 8*6,0
23797 + pax_enter_kernel_user
23798 +
23799 +#ifdef CONFIG_PAX_RANDKSTACK
23800 + pax_erase_kstack
23801 +#endif
23802 +
23803 /*
23804 * No need to follow this irqs off/on section - it's straight
23805 * and short:
23806 */
23807 ENABLE_INTERRUPTS(CLBR_NONE)
23808 - SAVE_ARGS 8,0
23809 movq %rax,ORIG_RAX-ARGOFFSET(%rsp)
23810 movq %rcx,RIP-ARGOFFSET(%rsp)
23811 CFI_REL_OFFSET rip,RIP-ARGOFFSET
23812 - testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
23813 + GET_THREAD_INFO(%rcx)
23814 + testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%rcx)
23815 jnz tracesys
23816 system_call_fastpath:
23817 #if __SYSCALL_MASK == ~0
23818 @@ -639,10 +1112,13 @@ sysret_check:
23819 LOCKDEP_SYS_EXIT
23820 DISABLE_INTERRUPTS(CLBR_NONE)
23821 TRACE_IRQS_OFF
23822 - movl TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET),%edx
23823 + GET_THREAD_INFO(%rcx)
23824 + movl TI_flags(%rcx),%edx
23825 andl %edi,%edx
23826 jnz sysret_careful
23827 CFI_REMEMBER_STATE
23828 + pax_exit_kernel_user
23829 + pax_erase_kstack
23830 /*
23831 * sysretq will re-enable interrupts:
23832 */
23833 @@ -701,6 +1177,9 @@ auditsys:
23834 movq %rax,%rsi /* 2nd arg: syscall number */
23835 movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */
23836 call __audit_syscall_entry
23837 +
23838 + pax_erase_kstack
23839 +
23840 LOAD_ARGS 0 /* reload call-clobbered registers */
23841 jmp system_call_fastpath
23842
23843 @@ -722,7 +1201,7 @@ sysret_audit:
23844 /* Do syscall tracing */
23845 tracesys:
23846 #ifdef CONFIG_AUDITSYSCALL
23847 - testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags+THREAD_INFO(%rsp,RIP-ARGOFFSET)
23848 + testl $(_TIF_WORK_SYSCALL_ENTRY & ~_TIF_SYSCALL_AUDIT),TI_flags(%rcx)
23849 jz auditsys
23850 #endif
23851 SAVE_REST
23852 @@ -730,12 +1209,15 @@ tracesys:
23853 FIXUP_TOP_OF_STACK %rdi
23854 movq %rsp,%rdi
23855 call syscall_trace_enter
23856 +
23857 + pax_erase_kstack
23858 +
23859 /*
23860 * Reload arg registers from stack in case ptrace changed them.
23861 * We don't reload %rax because syscall_trace_enter() returned
23862 * the value it wants us to use in the table lookup.
23863 */
23864 - LOAD_ARGS ARGOFFSET, 1
23865 + LOAD_ARGS 1
23866 RESTORE_REST
23867 #if __SYSCALL_MASK == ~0
23868 cmpq $__NR_syscall_max,%rax
23869 @@ -765,7 +1247,9 @@ GLOBAL(int_with_check)
23870 andl %edi,%edx
23871 jnz int_careful
23872 andl $~TS_COMPAT,TI_status(%rcx)
23873 - jmp retint_swapgs
23874 + pax_exit_kernel_user
23875 + pax_erase_kstack
23876 + jmp retint_swapgs_pax
23877
23878 /* Either reschedule or signal or syscall exit tracking needed. */
23879 /* First do a reschedule test. */
23880 @@ -811,7 +1295,7 @@ int_restore_rest:
23881 TRACE_IRQS_OFF
23882 jmp int_with_check
23883 CFI_ENDPROC
23884 -END(system_call)
23885 +ENDPROC(system_call)
23886
23887 .macro FORK_LIKE func
23888 ENTRY(stub_\func)
23889 @@ -824,9 +1308,10 @@ ENTRY(stub_\func)
23890 DEFAULT_FRAME 0 8 /* offset 8: return address */
23891 call sys_\func
23892 RESTORE_TOP_OF_STACK %r11, 8
23893 - ret $REST_SKIP /* pop extended registers */
23894 + pax_force_retaddr
23895 + ret
23896 CFI_ENDPROC
23897 -END(stub_\func)
23898 +ENDPROC(stub_\func)
23899 .endm
23900
23901 .macro FIXED_FRAME label,func
23902 @@ -836,9 +1321,10 @@ ENTRY(\label)
23903 FIXUP_TOP_OF_STACK %r11, 8-ARGOFFSET
23904 call \func
23905 RESTORE_TOP_OF_STACK %r11, 8-ARGOFFSET
23906 + pax_force_retaddr
23907 ret
23908 CFI_ENDPROC
23909 -END(\label)
23910 +ENDPROC(\label)
23911 .endm
23912
23913 FORK_LIKE clone
23914 @@ -846,19 +1332,6 @@ END(\label)
23915 FORK_LIKE vfork
23916 FIXED_FRAME stub_iopl, sys_iopl
23917
23918 -ENTRY(ptregscall_common)
23919 - DEFAULT_FRAME 1 8 /* offset 8: return address */
23920 - RESTORE_TOP_OF_STACK %r11, 8
23921 - movq_cfi_restore R15+8, r15
23922 - movq_cfi_restore R14+8, r14
23923 - movq_cfi_restore R13+8, r13
23924 - movq_cfi_restore R12+8, r12
23925 - movq_cfi_restore RBP+8, rbp
23926 - movq_cfi_restore RBX+8, rbx
23927 - ret $REST_SKIP /* pop extended registers */
23928 - CFI_ENDPROC
23929 -END(ptregscall_common)
23930 -
23931 ENTRY(stub_execve)
23932 CFI_STARTPROC
23933 addq $8, %rsp
23934 @@ -870,7 +1343,7 @@ ENTRY(stub_execve)
23935 RESTORE_REST
23936 jmp int_ret_from_sys_call
23937 CFI_ENDPROC
23938 -END(stub_execve)
23939 +ENDPROC(stub_execve)
23940
23941 /*
23942 * sigreturn is special because it needs to restore all registers on return.
23943 @@ -887,7 +1360,7 @@ ENTRY(stub_rt_sigreturn)
23944 RESTORE_REST
23945 jmp int_ret_from_sys_call
23946 CFI_ENDPROC
23947 -END(stub_rt_sigreturn)
23948 +ENDPROC(stub_rt_sigreturn)
23949
23950 #ifdef CONFIG_X86_X32_ABI
23951 ENTRY(stub_x32_rt_sigreturn)
23952 @@ -901,7 +1374,7 @@ ENTRY(stub_x32_rt_sigreturn)
23953 RESTORE_REST
23954 jmp int_ret_from_sys_call
23955 CFI_ENDPROC
23956 -END(stub_x32_rt_sigreturn)
23957 +ENDPROC(stub_x32_rt_sigreturn)
23958
23959 ENTRY(stub_x32_execve)
23960 CFI_STARTPROC
23961 @@ -915,7 +1388,7 @@ ENTRY(stub_x32_execve)
23962 RESTORE_REST
23963 jmp int_ret_from_sys_call
23964 CFI_ENDPROC
23965 -END(stub_x32_execve)
23966 +ENDPROC(stub_x32_execve)
23967
23968 #endif
23969
23970 @@ -952,7 +1425,7 @@ vector=vector+1
23971 2: jmp common_interrupt
23972 .endr
23973 CFI_ENDPROC
23974 -END(irq_entries_start)
23975 +ENDPROC(irq_entries_start)
23976
23977 .previous
23978 END(interrupt)
23979 @@ -969,8 +1442,8 @@ END(interrupt)
23980 /* 0(%rsp): ~(interrupt number) */
23981 .macro interrupt func
23982 /* reserve pt_regs for scratch regs and rbp */
23983 - subq $ORIG_RAX-RBP, %rsp
23984 - CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
23985 + subq $ORIG_RAX, %rsp
23986 + CFI_ADJUST_CFA_OFFSET ORIG_RAX
23987 SAVE_ARGS_IRQ
23988 call \func
23989 .endm
23990 @@ -997,14 +1470,14 @@ ret_from_intr:
23991
23992 /* Restore saved previous stack */
23993 popq %rsi
23994 - CFI_DEF_CFA rsi,SS+8-RBP /* reg/off reset after def_cfa_expr */
23995 - leaq ARGOFFSET-RBP(%rsi), %rsp
23996 + CFI_DEF_CFA rsi,SS+8 /* reg/off reset after def_cfa_expr */
23997 + movq %rsi, %rsp
23998 CFI_DEF_CFA_REGISTER rsp
23999 - CFI_ADJUST_CFA_OFFSET RBP-ARGOFFSET
24000 + CFI_ADJUST_CFA_OFFSET -ARGOFFSET
24001
24002 exit_intr:
24003 GET_THREAD_INFO(%rcx)
24004 - testl $3,CS-ARGOFFSET(%rsp)
24005 + testb $3,CS-ARGOFFSET(%rsp)
24006 je retint_kernel
24007
24008 /* Interrupt came from user space */
24009 @@ -1026,12 +1499,16 @@ retint_swapgs: /* return to user-space */
24010 * The iretq could re-enable interrupts:
24011 */
24012 DISABLE_INTERRUPTS(CLBR_ANY)
24013 + pax_exit_kernel_user
24014 +retint_swapgs_pax:
24015 TRACE_IRQS_IRETQ
24016 SWAPGS
24017 jmp restore_args
24018
24019 retint_restore_args: /* return to kernel space */
24020 DISABLE_INTERRUPTS(CLBR_ANY)
24021 + pax_exit_kernel
24022 + pax_force_retaddr (RIP-ARGOFFSET)
24023 /*
24024 * The iretq could re-enable interrupts:
24025 */
24026 @@ -1112,7 +1589,7 @@ ENTRY(retint_kernel)
24027 #endif
24028
24029 CFI_ENDPROC
24030 -END(common_interrupt)
24031 +ENDPROC(common_interrupt)
24032 /*
24033 * End of kprobes section
24034 */
24035 @@ -1130,7 +1607,7 @@ ENTRY(\sym)
24036 interrupt \do_sym
24037 jmp ret_from_intr
24038 CFI_ENDPROC
24039 -END(\sym)
24040 +ENDPROC(\sym)
24041 .endm
24042
24043 #ifdef CONFIG_TRACING
24044 @@ -1218,7 +1695,7 @@ ENTRY(\sym)
24045 call \do_sym
24046 jmp error_exit /* %ebx: no swapgs flag */
24047 CFI_ENDPROC
24048 -END(\sym)
24049 +ENDPROC(\sym)
24050 .endm
24051
24052 .macro paranoidzeroentry sym do_sym
24053 @@ -1236,10 +1713,10 @@ ENTRY(\sym)
24054 call \do_sym
24055 jmp paranoid_exit /* %ebx: no swapgs flag */
24056 CFI_ENDPROC
24057 -END(\sym)
24058 +ENDPROC(\sym)
24059 .endm
24060
24061 -#define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
24062 +#define INIT_TSS_IST(x) (TSS_ist + ((x) - 1) * 8)(%r13)
24063 .macro paranoidzeroentry_ist sym do_sym ist
24064 ENTRY(\sym)
24065 INTR_FRAME
24066 @@ -1252,12 +1729,18 @@ ENTRY(\sym)
24067 TRACE_IRQS_OFF_DEBUG
24068 movq %rsp,%rdi /* pt_regs pointer */
24069 xorl %esi,%esi /* no error code */
24070 +#ifdef CONFIG_SMP
24071 + imul $TSS_size, PER_CPU_VAR(cpu_number), %r13d
24072 + lea init_tss(%r13), %r13
24073 +#else
24074 + lea init_tss(%rip), %r13
24075 +#endif
24076 subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
24077 call \do_sym
24078 addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
24079 jmp paranoid_exit /* %ebx: no swapgs flag */
24080 CFI_ENDPROC
24081 -END(\sym)
24082 +ENDPROC(\sym)
24083 .endm
24084
24085 .macro errorentry sym do_sym
24086 @@ -1275,7 +1758,7 @@ ENTRY(\sym)
24087 call \do_sym
24088 jmp error_exit /* %ebx: no swapgs flag */
24089 CFI_ENDPROC
24090 -END(\sym)
24091 +ENDPROC(\sym)
24092 .endm
24093
24094 #ifdef CONFIG_TRACING
24095 @@ -1306,7 +1789,7 @@ ENTRY(\sym)
24096 call \do_sym
24097 jmp paranoid_exit /* %ebx: no swapgs flag */
24098 CFI_ENDPROC
24099 -END(\sym)
24100 +ENDPROC(\sym)
24101 .endm
24102
24103 zeroentry divide_error do_divide_error
24104 @@ -1336,9 +1819,10 @@ gs_change:
24105 2: mfence /* workaround */
24106 SWAPGS
24107 popfq_cfi
24108 + pax_force_retaddr
24109 ret
24110 CFI_ENDPROC
24111 -END(native_load_gs_index)
24112 +ENDPROC(native_load_gs_index)
24113
24114 _ASM_EXTABLE(gs_change,bad_gs)
24115 .section .fixup,"ax"
24116 @@ -1366,9 +1850,10 @@ ENTRY(do_softirq_own_stack)
24117 CFI_DEF_CFA_REGISTER rsp
24118 CFI_ADJUST_CFA_OFFSET -8
24119 decl PER_CPU_VAR(irq_count)
24120 + pax_force_retaddr
24121 ret
24122 CFI_ENDPROC
24123 -END(do_softirq_own_stack)
24124 +ENDPROC(do_softirq_own_stack)
24125
24126 #ifdef CONFIG_XEN
24127 zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
24128 @@ -1406,7 +1891,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
24129 decl PER_CPU_VAR(irq_count)
24130 jmp error_exit
24131 CFI_ENDPROC
24132 -END(xen_do_hypervisor_callback)
24133 +ENDPROC(xen_do_hypervisor_callback)
24134
24135 /*
24136 * Hypervisor uses this for application faults while it executes.
24137 @@ -1465,7 +1950,7 @@ ENTRY(xen_failsafe_callback)
24138 SAVE_ALL
24139 jmp error_exit
24140 CFI_ENDPROC
24141 -END(xen_failsafe_callback)
24142 +ENDPROC(xen_failsafe_callback)
24143
24144 apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
24145 xen_hvm_callback_vector xen_evtchn_do_upcall
24146 @@ -1517,18 +2002,33 @@ ENTRY(paranoid_exit)
24147 DEFAULT_FRAME
24148 DISABLE_INTERRUPTS(CLBR_NONE)
24149 TRACE_IRQS_OFF_DEBUG
24150 - testl %ebx,%ebx /* swapgs needed? */
24151 + testl $1,%ebx /* swapgs needed? */
24152 jnz paranoid_restore
24153 - testl $3,CS(%rsp)
24154 + testb $3,CS(%rsp)
24155 jnz paranoid_userspace
24156 +#ifdef CONFIG_PAX_MEMORY_UDEREF
24157 + pax_exit_kernel
24158 + TRACE_IRQS_IRETQ 0
24159 + SWAPGS_UNSAFE_STACK
24160 + RESTORE_ALL 8
24161 + pax_force_retaddr_bts
24162 + jmp irq_return
24163 +#endif
24164 paranoid_swapgs:
24165 +#ifdef CONFIG_PAX_MEMORY_UDEREF
24166 + pax_exit_kernel_user
24167 +#else
24168 + pax_exit_kernel
24169 +#endif
24170 TRACE_IRQS_IRETQ 0
24171 SWAPGS_UNSAFE_STACK
24172 RESTORE_ALL 8
24173 jmp irq_return
24174 paranoid_restore:
24175 + pax_exit_kernel
24176 TRACE_IRQS_IRETQ_DEBUG 0
24177 RESTORE_ALL 8
24178 + pax_force_retaddr_bts
24179 jmp irq_return
24180 paranoid_userspace:
24181 GET_THREAD_INFO(%rcx)
24182 @@ -1557,7 +2057,7 @@ paranoid_schedule:
24183 TRACE_IRQS_OFF
24184 jmp paranoid_userspace
24185 CFI_ENDPROC
24186 -END(paranoid_exit)
24187 +ENDPROC(paranoid_exit)
24188
24189 /*
24190 * Exception entry point. This expects an error code/orig_rax on the stack.
24191 @@ -1584,12 +2084,23 @@ ENTRY(error_entry)
24192 movq_cfi r14, R14+8
24193 movq_cfi r15, R15+8
24194 xorl %ebx,%ebx
24195 - testl $3,CS+8(%rsp)
24196 + testb $3,CS+8(%rsp)
24197 je error_kernelspace
24198 error_swapgs:
24199 SWAPGS
24200 error_sti:
24201 +#ifdef CONFIG_PAX_MEMORY_UDEREF
24202 + testb $3, CS+8(%rsp)
24203 + jnz 1f
24204 + pax_enter_kernel
24205 + jmp 2f
24206 +1: pax_enter_kernel_user
24207 +2:
24208 +#else
24209 + pax_enter_kernel
24210 +#endif
24211 TRACE_IRQS_OFF
24212 + pax_force_retaddr
24213 ret
24214
24215 /*
24216 @@ -1616,7 +2127,7 @@ bstep_iret:
24217 movq %rcx,RIP+8(%rsp)
24218 jmp error_swapgs
24219 CFI_ENDPROC
24220 -END(error_entry)
24221 +ENDPROC(error_entry)
24222
24223
24224 /* ebx: no swapgs flag (1: don't need swapgs, 0: need it) */
24225 @@ -1627,7 +2138,7 @@ ENTRY(error_exit)
24226 DISABLE_INTERRUPTS(CLBR_NONE)
24227 TRACE_IRQS_OFF
24228 GET_THREAD_INFO(%rcx)
24229 - testl %eax,%eax
24230 + testl $1,%eax
24231 jne retint_kernel
24232 LOCKDEP_SYS_EXIT_IRQ
24233 movl TI_flags(%rcx),%edx
24234 @@ -1636,7 +2147,7 @@ ENTRY(error_exit)
24235 jnz retint_careful
24236 jmp retint_swapgs
24237 CFI_ENDPROC
24238 -END(error_exit)
24239 +ENDPROC(error_exit)
24240
24241 /*
24242 * Test if a given stack is an NMI stack or not.
24243 @@ -1694,9 +2205,11 @@ ENTRY(nmi)
24244 * If %cs was not the kernel segment, then the NMI triggered in user
24245 * space, which means it is definitely not nested.
24246 */
24247 + cmpl $__KERNEXEC_KERNEL_CS, 16(%rsp)
24248 + je 1f
24249 cmpl $__KERNEL_CS, 16(%rsp)
24250 jne first_nmi
24251 -
24252 +1:
24253 /*
24254 * Check the special variable on the stack to see if NMIs are
24255 * executing.
24256 @@ -1730,8 +2243,7 @@ nested_nmi:
24257
24258 1:
24259 /* Set up the interrupted NMIs stack to jump to repeat_nmi */
24260 - leaq -1*8(%rsp), %rdx
24261 - movq %rdx, %rsp
24262 + subq $8, %rsp
24263 CFI_ADJUST_CFA_OFFSET 1*8
24264 leaq -10*8(%rsp), %rdx
24265 pushq_cfi $__KERNEL_DS
24266 @@ -1749,6 +2261,7 @@ nested_nmi_out:
24267 CFI_RESTORE rdx
24268
24269 /* No need to check faults here */
24270 +# pax_force_retaddr_bts
24271 INTERRUPT_RETURN
24272
24273 CFI_RESTORE_STATE
24274 @@ -1845,13 +2358,13 @@ end_repeat_nmi:
24275 subq $ORIG_RAX-R15, %rsp
24276 CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
24277 /*
24278 - * Use save_paranoid to handle SWAPGS, but no need to use paranoid_exit
24279 + * Use save_paranoid_nmi to handle SWAPGS, but no need to use paranoid_exit
24280 * as we should not be calling schedule in NMI context.
24281 * Even with normal interrupts enabled. An NMI should not be
24282 * setting NEED_RESCHED or anything that normal interrupts and
24283 * exceptions might do.
24284 */
24285 - call save_paranoid
24286 + call save_paranoid_nmi
24287 DEFAULT_FRAME 0
24288
24289 /*
24290 @@ -1861,9 +2374,9 @@ end_repeat_nmi:
24291 * NMI itself takes a page fault, the page fault that was preempted
24292 * will read the information from the NMI page fault and not the
24293 * origin fault. Save it off and restore it if it changes.
24294 - * Use the r12 callee-saved register.
24295 + * Use the r13 callee-saved register.
24296 */
24297 - movq %cr2, %r12
24298 + movq %cr2, %r13
24299
24300 /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
24301 movq %rsp,%rdi
24302 @@ -1872,31 +2385,36 @@ end_repeat_nmi:
24303
24304 /* Did the NMI take a page fault? Restore cr2 if it did */
24305 movq %cr2, %rcx
24306 - cmpq %rcx, %r12
24307 + cmpq %rcx, %r13
24308 je 1f
24309 - movq %r12, %cr2
24310 + movq %r13, %cr2
24311 1:
24312
24313 - testl %ebx,%ebx /* swapgs needed? */
24314 + testl $1,%ebx /* swapgs needed? */
24315 jnz nmi_restore
24316 nmi_swapgs:
24317 SWAPGS_UNSAFE_STACK
24318 nmi_restore:
24319 + pax_exit_kernel_nmi
24320 /* Pop the extra iret frame at once */
24321 RESTORE_ALL 6*8
24322 + testb $3, 8(%rsp)
24323 + jnz 1f
24324 + pax_force_retaddr_bts
24325 +1:
24326
24327 /* Clear the NMI executing stack variable */
24328 movq $0, 5*8(%rsp)
24329 jmp irq_return
24330 CFI_ENDPROC
24331 -END(nmi)
24332 +ENDPROC(nmi)
24333
24334 ENTRY(ignore_sysret)
24335 CFI_STARTPROC
24336 mov $-ENOSYS,%eax
24337 sysret
24338 CFI_ENDPROC
24339 -END(ignore_sysret)
24340 +ENDPROC(ignore_sysret)
24341
24342 /*
24343 * End of kprobes section
24344 diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
24345 index 1ffc32d..e52c745 100644
24346 --- a/arch/x86/kernel/ftrace.c
24347 +++ b/arch/x86/kernel/ftrace.c
24348 @@ -104,6 +104,8 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
24349 {
24350 unsigned char replaced[MCOUNT_INSN_SIZE];
24351
24352 + ip = ktla_ktva(ip);
24353 +
24354 /*
24355 * Note: Due to modules and __init, code can
24356 * disappear and change, we need to protect against faulting
24357 @@ -229,7 +231,7 @@ static int update_ftrace_func(unsigned long ip, void *new)
24358 unsigned char old[MCOUNT_INSN_SIZE];
24359 int ret;
24360
24361 - memcpy(old, (void *)ip, MCOUNT_INSN_SIZE);
24362 + memcpy(old, (void *)ktla_ktva(ip), MCOUNT_INSN_SIZE);
24363
24364 ftrace_update_func = ip;
24365 /* Make sure the breakpoints see the ftrace_update_func update */
24366 @@ -306,7 +308,7 @@ static int ftrace_write(unsigned long ip, const char *val, int size)
24367 * kernel identity mapping to modify code.
24368 */
24369 if (within(ip, (unsigned long)_text, (unsigned long)_etext))
24370 - ip = (unsigned long)__va(__pa_symbol(ip));
24371 + ip = (unsigned long)__va(__pa_symbol(ktla_ktva(ip)));
24372
24373 return probe_kernel_write((void *)ip, val, size);
24374 }
24375 @@ -316,7 +318,7 @@ static int add_break(unsigned long ip, const char *old)
24376 unsigned char replaced[MCOUNT_INSN_SIZE];
24377 unsigned char brk = BREAKPOINT_INSTRUCTION;
24378
24379 - if (probe_kernel_read(replaced, (void *)ip, MCOUNT_INSN_SIZE))
24380 + if (probe_kernel_read(replaced, (void *)ktla_ktva(ip), MCOUNT_INSN_SIZE))
24381 return -EFAULT;
24382
24383 /* Make sure it is what we expect it to be */
24384 @@ -664,7 +666,7 @@ ftrace_modify_code(unsigned long ip, unsigned const char *old_code,
24385 return ret;
24386
24387 fail_update:
24388 - probe_kernel_write((void *)ip, &old_code[0], 1);
24389 + probe_kernel_write((void *)ktla_ktva(ip), &old_code[0], 1);
24390 goto out;
24391 }
24392
24393 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
24394 index 85126cc..1bbce17 100644
24395 --- a/arch/x86/kernel/head64.c
24396 +++ b/arch/x86/kernel/head64.c
24397 @@ -67,12 +67,12 @@ again:
24398 pgd = *pgd_p;
24399
24400 /*
24401 - * The use of __START_KERNEL_map rather than __PAGE_OFFSET here is
24402 - * critical -- __PAGE_OFFSET would point us back into the dynamic
24403 + * The use of __early_va rather than __va here is critical:
24404 + * __va would point us back into the dynamic
24405 * range and we might end up looping forever...
24406 */
24407 if (pgd)
24408 - pud_p = (pudval_t *)((pgd & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
24409 + pud_p = (pudval_t *)(__early_va(pgd & PTE_PFN_MASK));
24410 else {
24411 if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
24412 reset_early_page_tables();
24413 @@ -82,13 +82,13 @@ again:
24414 pud_p = (pudval_t *)early_dynamic_pgts[next_early_pgt++];
24415 for (i = 0; i < PTRS_PER_PUD; i++)
24416 pud_p[i] = 0;
24417 - *pgd_p = (pgdval_t)pud_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
24418 + *pgd_p = (pgdval_t)__pa(pud_p) + _KERNPG_TABLE;
24419 }
24420 pud_p += pud_index(address);
24421 pud = *pud_p;
24422
24423 if (pud)
24424 - pmd_p = (pmdval_t *)((pud & PTE_PFN_MASK) + __START_KERNEL_map - phys_base);
24425 + pmd_p = (pmdval_t *)(__early_va(pud & PTE_PFN_MASK));
24426 else {
24427 if (next_early_pgt >= EARLY_DYNAMIC_PAGE_TABLES) {
24428 reset_early_page_tables();
24429 @@ -98,7 +98,7 @@ again:
24430 pmd_p = (pmdval_t *)early_dynamic_pgts[next_early_pgt++];
24431 for (i = 0; i < PTRS_PER_PMD; i++)
24432 pmd_p[i] = 0;
24433 - *pud_p = (pudval_t)pmd_p - __START_KERNEL_map + phys_base + _KERNPG_TABLE;
24434 + *pud_p = (pudval_t)__pa(pmd_p) + _KERNPG_TABLE;
24435 }
24436 pmd = (physaddr & PMD_MASK) + early_pmd_flags;
24437 pmd_p[pmd_index(address)] = pmd;
24438 @@ -175,7 +175,6 @@ asmlinkage void __init x86_64_start_kernel(char * real_mode_data)
24439 if (console_loglevel == 10)
24440 early_printk("Kernel alive\n");
24441
24442 - clear_page(init_level4_pgt);
24443 /* set init_level4_pgt kernel high mapping*/
24444 init_level4_pgt[511] = early_level4_pgt[511];
24445
24446 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
24447 index f36bd42..56ee1534 100644
24448 --- a/arch/x86/kernel/head_32.S
24449 +++ b/arch/x86/kernel/head_32.S
24450 @@ -26,6 +26,12 @@
24451 /* Physical address */
24452 #define pa(X) ((X) - __PAGE_OFFSET)
24453
24454 +#ifdef CONFIG_PAX_KERNEXEC
24455 +#define ta(X) (X)
24456 +#else
24457 +#define ta(X) ((X) - __PAGE_OFFSET)
24458 +#endif
24459 +
24460 /*
24461 * References to members of the new_cpu_data structure.
24462 */
24463 @@ -55,11 +61,7 @@
24464 * and small than max_low_pfn, otherwise will waste some page table entries
24465 */
24466
24467 -#if PTRS_PER_PMD > 1
24468 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
24469 -#else
24470 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
24471 -#endif
24472 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
24473
24474 /* Number of possible pages in the lowmem region */
24475 LOWMEM_PAGES = (((1<<32) - __PAGE_OFFSET) >> PAGE_SHIFT)
24476 @@ -78,6 +80,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_PAGES) * PAGE_SIZE
24477 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
24478
24479 /*
24480 + * Real beginning of normal "text" segment
24481 + */
24482 +ENTRY(stext)
24483 +ENTRY(_stext)
24484 +
24485 +/*
24486 * 32-bit kernel entrypoint; only used by the boot CPU. On entry,
24487 * %esi points to the real-mode code as a 32-bit pointer.
24488 * CS and DS must be 4 GB flat segments, but we don't depend on
24489 @@ -85,6 +93,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
24490 * can.
24491 */
24492 __HEAD
24493 +
24494 +#ifdef CONFIG_PAX_KERNEXEC
24495 + jmp startup_32
24496 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
24497 +.fill PAGE_SIZE-5,1,0xcc
24498 +#endif
24499 +
24500 ENTRY(startup_32)
24501 movl pa(stack_start),%ecx
24502
24503 @@ -106,6 +121,59 @@ ENTRY(startup_32)
24504 2:
24505 leal -__PAGE_OFFSET(%ecx),%esp
24506
24507 +#ifdef CONFIG_SMP
24508 + movl $pa(cpu_gdt_table),%edi
24509 + movl $__per_cpu_load,%eax
24510 + movw %ax,GDT_ENTRY_PERCPU * 8 + 2(%edi)
24511 + rorl $16,%eax
24512 + movb %al,GDT_ENTRY_PERCPU * 8 + 4(%edi)
24513 + movb %ah,GDT_ENTRY_PERCPU * 8 + 7(%edi)
24514 + movl $__per_cpu_end - 1,%eax
24515 + subl $__per_cpu_start,%eax
24516 + movw %ax,GDT_ENTRY_PERCPU * 8 + 0(%edi)
24517 +#endif
24518 +
24519 +#ifdef CONFIG_PAX_MEMORY_UDEREF
24520 + movl $NR_CPUS,%ecx
24521 + movl $pa(cpu_gdt_table),%edi
24522 +1:
24523 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
24524 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
24525 + movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
24526 + addl $PAGE_SIZE_asm,%edi
24527 + loop 1b
24528 +#endif
24529 +
24530 +#ifdef CONFIG_PAX_KERNEXEC
24531 + movl $pa(boot_gdt),%edi
24532 + movl $__LOAD_PHYSICAL_ADDR,%eax
24533 + movw %ax,GDT_ENTRY_BOOT_CS * 8 + 2(%edi)
24534 + rorl $16,%eax
24535 + movb %al,GDT_ENTRY_BOOT_CS * 8 + 4(%edi)
24536 + movb %ah,GDT_ENTRY_BOOT_CS * 8 + 7(%edi)
24537 + rorl $16,%eax
24538 +
24539 + ljmp $(__BOOT_CS),$1f
24540 +1:
24541 +
24542 + movl $NR_CPUS,%ecx
24543 + movl $pa(cpu_gdt_table),%edi
24544 + addl $__PAGE_OFFSET,%eax
24545 +1:
24546 + movb $0xc0,GDT_ENTRY_KERNEL_CS * 8 + 6(%edi)
24547 + movb $0xc0,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 6(%edi)
24548 + movw %ax,GDT_ENTRY_KERNEL_CS * 8 + 2(%edi)
24549 + movw %ax,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 2(%edi)
24550 + rorl $16,%eax
24551 + movb %al,GDT_ENTRY_KERNEL_CS * 8 + 4(%edi)
24552 + movb %al,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 4(%edi)
24553 + movb %ah,GDT_ENTRY_KERNEL_CS * 8 + 7(%edi)
24554 + movb %ah,GDT_ENTRY_KERNEXEC_KERNEL_CS * 8 + 7(%edi)
24555 + rorl $16,%eax
24556 + addl $PAGE_SIZE_asm,%edi
24557 + loop 1b
24558 +#endif
24559 +
24560 /*
24561 * Clear BSS first so that there are no surprises...
24562 */
24563 @@ -201,8 +269,11 @@ ENTRY(startup_32)
24564 movl %eax, pa(max_pfn_mapped)
24565
24566 /* Do early initialization of the fixmap area */
24567 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
24568 - movl %eax,pa(initial_pg_pmd+0x1000*KPMDS-8)
24569 +#ifdef CONFIG_COMPAT_VDSO
24570 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_pg_pmd+0x1000*KPMDS-8)
24571 +#else
24572 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_pg_pmd+0x1000*KPMDS-8)
24573 +#endif
24574 #else /* Not PAE */
24575
24576 page_pde_offset = (__PAGE_OFFSET >> 20);
24577 @@ -232,8 +303,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
24578 movl %eax, pa(max_pfn_mapped)
24579
24580 /* Do early initialization of the fixmap area */
24581 - movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,%eax
24582 - movl %eax,pa(initial_page_table+0xffc)
24583 +#ifdef CONFIG_COMPAT_VDSO
24584 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(initial_page_table+0xffc)
24585 +#else
24586 + movl $pa(initial_pg_fixmap)+PDE_IDENT_ATTR,pa(initial_page_table+0xffc)
24587 +#endif
24588 #endif
24589
24590 #ifdef CONFIG_PARAVIRT
24591 @@ -247,9 +321,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
24592 cmpl $num_subarch_entries, %eax
24593 jae bad_subarch
24594
24595 - movl pa(subarch_entries)(,%eax,4), %eax
24596 - subl $__PAGE_OFFSET, %eax
24597 - jmp *%eax
24598 + jmp *pa(subarch_entries)(,%eax,4)
24599
24600 bad_subarch:
24601 WEAK(lguest_entry)
24602 @@ -261,10 +333,10 @@ WEAK(xen_entry)
24603 __INITDATA
24604
24605 subarch_entries:
24606 - .long default_entry /* normal x86/PC */
24607 - .long lguest_entry /* lguest hypervisor */
24608 - .long xen_entry /* Xen hypervisor */
24609 - .long default_entry /* Moorestown MID */
24610 + .long ta(default_entry) /* normal x86/PC */
24611 + .long ta(lguest_entry) /* lguest hypervisor */
24612 + .long ta(xen_entry) /* Xen hypervisor */
24613 + .long ta(default_entry) /* Moorestown MID */
24614 num_subarch_entries = (. - subarch_entries) / 4
24615 .previous
24616 #else
24617 @@ -354,6 +426,7 @@ default_entry:
24618 movl pa(mmu_cr4_features),%eax
24619 movl %eax,%cr4
24620
24621 +#ifdef CONFIG_X86_PAE
24622 testb $X86_CR4_PAE, %al # check if PAE is enabled
24623 jz enable_paging
24624
24625 @@ -382,6 +455,9 @@ default_entry:
24626 /* Make changes effective */
24627 wrmsr
24628
24629 + btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
24630 +#endif
24631 +
24632 enable_paging:
24633
24634 /*
24635 @@ -449,14 +525,20 @@ is486:
24636 1: movl $(__KERNEL_DS),%eax # reload all the segment registers
24637 movl %eax,%ss # after changing gdt.
24638
24639 - movl $(__USER_DS),%eax # DS/ES contains default USER segment
24640 +# movl $(__KERNEL_DS),%eax # DS/ES contains default KERNEL segment
24641 movl %eax,%ds
24642 movl %eax,%es
24643
24644 movl $(__KERNEL_PERCPU), %eax
24645 movl %eax,%fs # set this cpu's percpu
24646
24647 +#ifdef CONFIG_CC_STACKPROTECTOR
24648 movl $(__KERNEL_STACK_CANARY),%eax
24649 +#elif defined(CONFIG_PAX_MEMORY_UDEREF)
24650 + movl $(__USER_DS),%eax
24651 +#else
24652 + xorl %eax,%eax
24653 +#endif
24654 movl %eax,%gs
24655
24656 xorl %eax,%eax # Clear LDT
24657 @@ -512,8 +594,11 @@ setup_once:
24658 * relocation. Manually set base address in stack canary
24659 * segment descriptor.
24660 */
24661 - movl $gdt_page,%eax
24662 + movl $cpu_gdt_table,%eax
24663 movl $stack_canary,%ecx
24664 +#ifdef CONFIG_SMP
24665 + addl $__per_cpu_load,%ecx
24666 +#endif
24667 movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
24668 shrl $16, %ecx
24669 movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
24670 @@ -548,7 +633,7 @@ ENTRY(early_idt_handler)
24671 cmpl $2,(%esp) # X86_TRAP_NMI
24672 je is_nmi # Ignore NMI
24673
24674 - cmpl $2,%ss:early_recursion_flag
24675 + cmpl $1,%ss:early_recursion_flag
24676 je hlt_loop
24677 incl %ss:early_recursion_flag
24678
24679 @@ -586,8 +671,8 @@ ENTRY(early_idt_handler)
24680 pushl (20+6*4)(%esp) /* trapno */
24681 pushl $fault_msg
24682 call printk
24683 -#endif
24684 call dump_stack
24685 +#endif
24686 hlt_loop:
24687 hlt
24688 jmp hlt_loop
24689 @@ -607,8 +692,11 @@ ENDPROC(early_idt_handler)
24690 /* This is the default interrupt "handler" :-) */
24691 ALIGN
24692 ignore_int:
24693 - cld
24694 #ifdef CONFIG_PRINTK
24695 + cmpl $2,%ss:early_recursion_flag
24696 + je hlt_loop
24697 + incl %ss:early_recursion_flag
24698 + cld
24699 pushl %eax
24700 pushl %ecx
24701 pushl %edx
24702 @@ -617,9 +705,6 @@ ignore_int:
24703 movl $(__KERNEL_DS),%eax
24704 movl %eax,%ds
24705 movl %eax,%es
24706 - cmpl $2,early_recursion_flag
24707 - je hlt_loop
24708 - incl early_recursion_flag
24709 pushl 16(%esp)
24710 pushl 24(%esp)
24711 pushl 32(%esp)
24712 @@ -653,29 +738,34 @@ ENTRY(setup_once_ref)
24713 /*
24714 * BSS section
24715 */
24716 -__PAGE_ALIGNED_BSS
24717 - .align PAGE_SIZE
24718 #ifdef CONFIG_X86_PAE
24719 +.section .initial_pg_pmd,"a",@progbits
24720 initial_pg_pmd:
24721 .fill 1024*KPMDS,4,0
24722 #else
24723 +.section .initial_page_table,"a",@progbits
24724 ENTRY(initial_page_table)
24725 .fill 1024,4,0
24726 #endif
24727 +.section .initial_pg_fixmap,"a",@progbits
24728 initial_pg_fixmap:
24729 .fill 1024,4,0
24730 +.section .empty_zero_page,"a",@progbits
24731 ENTRY(empty_zero_page)
24732 .fill 4096,1,0
24733 +.section .swapper_pg_dir,"a",@progbits
24734 ENTRY(swapper_pg_dir)
24735 +#ifdef CONFIG_X86_PAE
24736 + .fill 4,8,0
24737 +#else
24738 .fill 1024,4,0
24739 +#endif
24740
24741 /*
24742 * This starts the data section.
24743 */
24744 #ifdef CONFIG_X86_PAE
24745 -__PAGE_ALIGNED_DATA
24746 - /* Page-aligned for the benefit of paravirt? */
24747 - .align PAGE_SIZE
24748 +.section .initial_page_table,"a",@progbits
24749 ENTRY(initial_page_table)
24750 .long pa(initial_pg_pmd+PGD_IDENT_ATTR),0 /* low identity map */
24751 # if KPMDS == 3
24752 @@ -694,12 +784,20 @@ ENTRY(initial_page_table)
24753 # error "Kernel PMDs should be 1, 2 or 3"
24754 # endif
24755 .align PAGE_SIZE /* needs to be page-sized too */
24756 +
24757 +#ifdef CONFIG_PAX_PER_CPU_PGD
24758 +ENTRY(cpu_pgd)
24759 + .rept 2*NR_CPUS
24760 + .fill 4,8,0
24761 + .endr
24762 +#endif
24763 +
24764 #endif
24765
24766 .data
24767 .balign 4
24768 ENTRY(stack_start)
24769 - .long init_thread_union+THREAD_SIZE
24770 + .long init_thread_union+THREAD_SIZE-8
24771
24772 __INITRODATA
24773 int_msg:
24774 @@ -727,7 +825,7 @@ fault_msg:
24775 * segment size, and 32-bit linear address value:
24776 */
24777
24778 - .data
24779 +.section .rodata,"a",@progbits
24780 .globl boot_gdt_descr
24781 .globl idt_descr
24782
24783 @@ -736,7 +834,7 @@ fault_msg:
24784 .word 0 # 32 bit align gdt_desc.address
24785 boot_gdt_descr:
24786 .word __BOOT_DS+7
24787 - .long boot_gdt - __PAGE_OFFSET
24788 + .long pa(boot_gdt)
24789
24790 .word 0 # 32-bit align idt_desc.address
24791 idt_descr:
24792 @@ -747,7 +845,7 @@ idt_descr:
24793 .word 0 # 32 bit align gdt_desc.address
24794 ENTRY(early_gdt_descr)
24795 .word GDT_ENTRIES*8-1
24796 - .long gdt_page /* Overwritten for secondary CPUs */
24797 + .long cpu_gdt_table /* Overwritten for secondary CPUs */
24798
24799 /*
24800 * The boot_gdt must mirror the equivalent in setup.S and is
24801 @@ -756,5 +854,65 @@ ENTRY(early_gdt_descr)
24802 .align L1_CACHE_BYTES
24803 ENTRY(boot_gdt)
24804 .fill GDT_ENTRY_BOOT_CS,8,0
24805 - .quad 0x00cf9a000000ffff /* kernel 4GB code at 0x00000000 */
24806 - .quad 0x00cf92000000ffff /* kernel 4GB data at 0x00000000 */
24807 + .quad 0x00cf9b000000ffff /* kernel 4GB code at 0x00000000 */
24808 + .quad 0x00cf93000000ffff /* kernel 4GB data at 0x00000000 */
24809 +
24810 + .align PAGE_SIZE_asm
24811 +ENTRY(cpu_gdt_table)
24812 + .rept NR_CPUS
24813 + .quad 0x0000000000000000 /* NULL descriptor */
24814 + .quad 0x0000000000000000 /* 0x0b reserved */
24815 + .quad 0x0000000000000000 /* 0x13 reserved */
24816 + .quad 0x0000000000000000 /* 0x1b reserved */
24817 +
24818 +#ifdef CONFIG_PAX_KERNEXEC
24819 + .quad 0x00cf9b000000ffff /* 0x20 alternate kernel 4GB code at 0x00000000 */
24820 +#else
24821 + .quad 0x0000000000000000 /* 0x20 unused */
24822 +#endif
24823 +
24824 + .quad 0x0000000000000000 /* 0x28 unused */
24825 + .quad 0x0000000000000000 /* 0x33 TLS entry 1 */
24826 + .quad 0x0000000000000000 /* 0x3b TLS entry 2 */
24827 + .quad 0x0000000000000000 /* 0x43 TLS entry 3 */
24828 + .quad 0x0000000000000000 /* 0x4b reserved */
24829 + .quad 0x0000000000000000 /* 0x53 reserved */
24830 + .quad 0x0000000000000000 /* 0x5b reserved */
24831 +
24832 + .quad 0x00cf9b000000ffff /* 0x60 kernel 4GB code at 0x00000000 */
24833 + .quad 0x00cf93000000ffff /* 0x68 kernel 4GB data at 0x00000000 */
24834 + .quad 0x00cffb000000ffff /* 0x73 user 4GB code at 0x00000000 */
24835 + .quad 0x00cff3000000ffff /* 0x7b user 4GB data at 0x00000000 */
24836 +
24837 + .quad 0x0000000000000000 /* 0x80 TSS descriptor */
24838 + .quad 0x0000000000000000 /* 0x88 LDT descriptor */
24839 +
24840 + /*
24841 + * Segments used for calling PnP BIOS have byte granularity.
24842 + * The code segments and data segments have fixed 64k limits,
24843 + * the transfer segment sizes are set at run time.
24844 + */
24845 + .quad 0x00409b000000ffff /* 0x90 32-bit code */
24846 + .quad 0x00009b000000ffff /* 0x98 16-bit code */
24847 + .quad 0x000093000000ffff /* 0xa0 16-bit data */
24848 + .quad 0x0000930000000000 /* 0xa8 16-bit data */
24849 + .quad 0x0000930000000000 /* 0xb0 16-bit data */
24850 +
24851 + /*
24852 + * The APM segments have byte granularity and their bases
24853 + * are set at run time. All have 64k limits.
24854 + */
24855 + .quad 0x00409b000000ffff /* 0xb8 APM CS code */
24856 + .quad 0x00009b000000ffff /* 0xc0 APM CS 16 code (16 bit) */
24857 + .quad 0x004093000000ffff /* 0xc8 APM DS data */
24858 +
24859 + .quad 0x00c0930000000000 /* 0xd0 - ESPFIX SS */
24860 + .quad 0x0040930000000000 /* 0xd8 - PERCPU */
24861 + .quad 0x0040910000000017 /* 0xe0 - STACK_CANARY */
24862 + .quad 0x0000000000000000 /* 0xe8 - PCIBIOS_CS */
24863 + .quad 0x0000000000000000 /* 0xf0 - PCIBIOS_DS */
24864 + .quad 0x0000000000000000 /* 0xf8 - GDT entry 31: double-fault TSS */
24865 +
24866 + /* Be sure this is zeroed to avoid false validations in Xen */
24867 + .fill PAGE_SIZE_asm - GDT_SIZE,1,0
24868 + .endr
24869 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
24870 index a468c0a..c7dec74 100644
24871 --- a/arch/x86/kernel/head_64.S
24872 +++ b/arch/x86/kernel/head_64.S
24873 @@ -20,6 +20,8 @@
24874 #include <asm/processor-flags.h>
24875 #include <asm/percpu.h>
24876 #include <asm/nops.h>
24877 +#include <asm/cpufeature.h>
24878 +#include <asm/alternative-asm.h>
24879
24880 #ifdef CONFIG_PARAVIRT
24881 #include <asm/asm-offsets.h>
24882 @@ -41,6 +43,12 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET)
24883 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
24884 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
24885 L3_START_KERNEL = pud_index(__START_KERNEL_map)
24886 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
24887 +L3_VMALLOC_START = pud_index(VMALLOC_START)
24888 +L4_VMALLOC_END = pgd_index(VMALLOC_END)
24889 +L3_VMALLOC_END = pud_index(VMALLOC_END)
24890 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
24891 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
24892
24893 .text
24894 __HEAD
24895 @@ -89,11 +97,24 @@ startup_64:
24896 * Fixup the physical addresses in the page table
24897 */
24898 addq %rbp, early_level4_pgt + (L4_START_KERNEL*8)(%rip)
24899 + addq %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
24900 + addq %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
24901 + addq %rbp, init_level4_pgt + (L4_VMALLOC_END*8)(%rip)
24902 + addq %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
24903 + addq %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
24904
24905 - addq %rbp, level3_kernel_pgt + (510*8)(%rip)
24906 - addq %rbp, level3_kernel_pgt + (511*8)(%rip)
24907 + addq %rbp, level3_ident_pgt + (0*8)(%rip)
24908 +#ifndef CONFIG_XEN
24909 + addq %rbp, level3_ident_pgt + (1*8)(%rip)
24910 +#endif
24911 +
24912 + addq %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
24913 +
24914 + addq %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
24915 + addq %rbp, level3_kernel_pgt + ((L3_START_KERNEL+1)*8)(%rip)
24916
24917 addq %rbp, level2_fixmap_pgt + (506*8)(%rip)
24918 + addq %rbp, level2_fixmap_pgt + (507*8)(%rip)
24919
24920 /*
24921 * Set up the identity mapping for the switchover. These
24922 @@ -177,8 +198,8 @@ ENTRY(secondary_startup_64)
24923 movq $(init_level4_pgt - __START_KERNEL_map), %rax
24924 1:
24925
24926 - /* Enable PAE mode and PGE */
24927 - movl $(X86_CR4_PAE | X86_CR4_PGE), %ecx
24928 + /* Enable PAE mode and PSE/PGE */
24929 + movl $(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %ecx
24930 movq %rcx, %cr4
24931
24932 /* Setup early boot stage 4 level pagetables. */
24933 @@ -199,10 +220,19 @@ ENTRY(secondary_startup_64)
24934 movl $MSR_EFER, %ecx
24935 rdmsr
24936 btsl $_EFER_SCE, %eax /* Enable System Call */
24937 - btl $20,%edi /* No Execute supported? */
24938 + btl $(X86_FEATURE_NX & 31),%edi /* No Execute supported? */
24939 jnc 1f
24940 btsl $_EFER_NX, %eax
24941 btsq $_PAGE_BIT_NX,early_pmd_flags(%rip)
24942 +#ifndef CONFIG_EFI
24943 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_PAGE_OFFSET(%rip)
24944 +#endif
24945 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMALLOC_START(%rip)
24946 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMALLOC_END(%rip)
24947 + btsq $_PAGE_BIT_NX, init_level4_pgt + 8*L4_VMEMMAP_START(%rip)
24948 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*506(%rip)
24949 + btsq $_PAGE_BIT_NX, level2_fixmap_pgt + 8*507(%rip)
24950 + btsq $_PAGE_BIT_NX, __supported_pte_mask(%rip)
24951 1: wrmsr /* Make changes effective */
24952
24953 /* Setup cr0 */
24954 @@ -282,6 +312,7 @@ ENTRY(secondary_startup_64)
24955 * REX.W + FF /5 JMP m16:64 Jump far, absolute indirect,
24956 * address given in m16:64.
24957 */
24958 + pax_set_fptr_mask
24959 movq initial_code(%rip),%rax
24960 pushq $0 # fake return address to stop unwinder
24961 pushq $__KERNEL_CS # set correct cs
24962 @@ -313,7 +344,7 @@ ENDPROC(start_cpu0)
24963 .quad INIT_PER_CPU_VAR(irq_stack_union)
24964
24965 GLOBAL(stack_start)
24966 - .quad init_thread_union+THREAD_SIZE-8
24967 + .quad init_thread_union+THREAD_SIZE-16
24968 .word 0
24969 __FINITDATA
24970
24971 @@ -391,7 +422,7 @@ ENTRY(early_idt_handler)
24972 call dump_stack
24973 #ifdef CONFIG_KALLSYMS
24974 leaq early_idt_ripmsg(%rip),%rdi
24975 - movq 40(%rsp),%rsi # %rip again
24976 + movq 88(%rsp),%rsi # %rip again
24977 call __print_symbol
24978 #endif
24979 #endif /* EARLY_PRINTK */
24980 @@ -420,6 +451,7 @@ ENDPROC(early_idt_handler)
24981 early_recursion_flag:
24982 .long 0
24983
24984 + .section .rodata,"a",@progbits
24985 #ifdef CONFIG_EARLY_PRINTK
24986 early_idt_msg:
24987 .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
24988 @@ -447,29 +479,52 @@ NEXT_PAGE(early_level4_pgt)
24989 NEXT_PAGE(early_dynamic_pgts)
24990 .fill 512*EARLY_DYNAMIC_PAGE_TABLES,8,0
24991
24992 - .data
24993 + .section .rodata,"a",@progbits
24994
24995 -#ifndef CONFIG_XEN
24996 NEXT_PAGE(init_level4_pgt)
24997 - .fill 512,8,0
24998 -#else
24999 -NEXT_PAGE(init_level4_pgt)
25000 - .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25001 .org init_level4_pgt + L4_PAGE_OFFSET*8, 0
25002 .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25003 + .org init_level4_pgt + L4_VMALLOC_START*8, 0
25004 + .quad level3_vmalloc_start_pgt - __START_KERNEL_map + _KERNPG_TABLE
25005 + .org init_level4_pgt + L4_VMALLOC_END*8, 0
25006 + .quad level3_vmalloc_end_pgt - __START_KERNEL_map + _KERNPG_TABLE
25007 + .org init_level4_pgt + L4_VMEMMAP_START*8, 0
25008 + .quad level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
25009 .org init_level4_pgt + L4_START_KERNEL*8, 0
25010 /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
25011 .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
25012
25013 +#ifdef CONFIG_PAX_PER_CPU_PGD
25014 +NEXT_PAGE(cpu_pgd)
25015 + .rept 2*NR_CPUS
25016 + .fill 512,8,0
25017 + .endr
25018 +#endif
25019 +
25020 NEXT_PAGE(level3_ident_pgt)
25021 .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
25022 +#ifdef CONFIG_XEN
25023 .fill 511, 8, 0
25024 +#else
25025 + .quad level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
25026 + .fill 510,8,0
25027 +#endif
25028 +
25029 +NEXT_PAGE(level3_vmalloc_start_pgt)
25030 + .fill 512,8,0
25031 +
25032 +NEXT_PAGE(level3_vmalloc_end_pgt)
25033 + .fill 512,8,0
25034 +
25035 +NEXT_PAGE(level3_vmemmap_pgt)
25036 + .fill L3_VMEMMAP_START,8,0
25037 + .quad level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
25038 +
25039 NEXT_PAGE(level2_ident_pgt)
25040 - /* Since I easily can, map the first 1G.
25041 + /* Since I easily can, map the first 2G.
25042 * Don't set NX because code runs from these pages.
25043 */
25044 - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
25045 -#endif
25046 + PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
25047
25048 NEXT_PAGE(level3_kernel_pgt)
25049 .fill L3_START_KERNEL,8,0
25050 @@ -477,6 +532,9 @@ NEXT_PAGE(level3_kernel_pgt)
25051 .quad level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
25052 .quad level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
25053
25054 +NEXT_PAGE(level2_vmemmap_pgt)
25055 + .fill 512,8,0
25056 +
25057 NEXT_PAGE(level2_kernel_pgt)
25058 /*
25059 * 512 MB kernel mapping. We spend a full page on this pagetable
25060 @@ -494,28 +552,64 @@ NEXT_PAGE(level2_kernel_pgt)
25061 NEXT_PAGE(level2_fixmap_pgt)
25062 .fill 506,8,0
25063 .quad level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
25064 - /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
25065 - .fill 5,8,0
25066 + .quad level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
25067 + /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
25068 + .fill 4,8,0
25069
25070 NEXT_PAGE(level1_fixmap_pgt)
25071 .fill 512,8,0
25072
25073 +NEXT_PAGE(level1_vsyscall_pgt)
25074 + .fill 512,8,0
25075 +
25076 #undef PMDS
25077
25078 - .data
25079 + .align PAGE_SIZE
25080 +ENTRY(cpu_gdt_table)
25081 + .rept NR_CPUS
25082 + .quad 0x0000000000000000 /* NULL descriptor */
25083 + .quad 0x00cf9b000000ffff /* __KERNEL32_CS */
25084 + .quad 0x00af9b000000ffff /* __KERNEL_CS */
25085 + .quad 0x00cf93000000ffff /* __KERNEL_DS */
25086 + .quad 0x00cffb000000ffff /* __USER32_CS */
25087 + .quad 0x00cff3000000ffff /* __USER_DS, __USER32_DS */
25088 + .quad 0x00affb000000ffff /* __USER_CS */
25089 +
25090 +#ifdef CONFIG_PAX_KERNEXEC
25091 + .quad 0x00af9b000000ffff /* __KERNEXEC_KERNEL_CS */
25092 +#else
25093 + .quad 0x0 /* unused */
25094 +#endif
25095 +
25096 + .quad 0,0 /* TSS */
25097 + .quad 0,0 /* LDT */
25098 + .quad 0,0,0 /* three TLS descriptors */
25099 + .quad 0x0000f40000000000 /* node/CPU stored in limit */
25100 + /* asm/segment.h:GDT_ENTRIES must match this */
25101 +
25102 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25103 + .quad 0x00cf93000000ffff /* __UDEREF_KERNEL_DS */
25104 +#else
25105 + .quad 0x0 /* unused */
25106 +#endif
25107 +
25108 + /* zero the remaining page */
25109 + .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
25110 + .endr
25111 +
25112 .align 16
25113 .globl early_gdt_descr
25114 early_gdt_descr:
25115 .word GDT_ENTRIES*8-1
25116 early_gdt_descr_base:
25117 - .quad INIT_PER_CPU_VAR(gdt_page)
25118 + .quad cpu_gdt_table
25119
25120 ENTRY(phys_base)
25121 /* This must match the first entry in level2_kernel_pgt */
25122 .quad 0x0000000000000000
25123
25124 #include "../../x86/xen/xen-head.S"
25125 -
25126 - __PAGE_ALIGNED_BSS
25127 +
25128 + .section .rodata,"a",@progbits
25129 NEXT_PAGE(empty_zero_page)
25130 .skip PAGE_SIZE
25131 diff --git a/arch/x86/kernel/i386_ksyms_32.c b/arch/x86/kernel/i386_ksyms_32.c
25132 index 05fd74f..c3548b1 100644
25133 --- a/arch/x86/kernel/i386_ksyms_32.c
25134 +++ b/arch/x86/kernel/i386_ksyms_32.c
25135 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
25136 EXPORT_SYMBOL(cmpxchg8b_emu);
25137 #endif
25138
25139 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
25140 +
25141 /* Networking helper routines. */
25142 EXPORT_SYMBOL(csum_partial_copy_generic);
25143 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
25144 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
25145
25146 EXPORT_SYMBOL(__get_user_1);
25147 EXPORT_SYMBOL(__get_user_2);
25148 @@ -44,3 +48,11 @@ EXPORT_SYMBOL(___preempt_schedule);
25149 EXPORT_SYMBOL(___preempt_schedule_context);
25150 #endif
25151 #endif
25152 +
25153 +#ifdef CONFIG_PAX_KERNEXEC
25154 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
25155 +#endif
25156 +
25157 +#ifdef CONFIG_PAX_PER_CPU_PGD
25158 +EXPORT_SYMBOL(cpu_pgd);
25159 +#endif
25160 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
25161 index d5dd808..b6432cf 100644
25162 --- a/arch/x86/kernel/i387.c
25163 +++ b/arch/x86/kernel/i387.c
25164 @@ -51,7 +51,7 @@ static inline bool interrupted_kernel_fpu_idle(void)
25165 static inline bool interrupted_user_mode(void)
25166 {
25167 struct pt_regs *regs = get_irq_regs();
25168 - return regs && user_mode_vm(regs);
25169 + return regs && user_mode(regs);
25170 }
25171
25172 /*
25173 diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c
25174 index 2e977b5..5f2c273 100644
25175 --- a/arch/x86/kernel/i8259.c
25176 +++ b/arch/x86/kernel/i8259.c
25177 @@ -110,7 +110,7 @@ static int i8259A_irq_pending(unsigned int irq)
25178 static void make_8259A_irq(unsigned int irq)
25179 {
25180 disable_irq_nosync(irq);
25181 - io_apic_irqs &= ~(1<<irq);
25182 + io_apic_irqs &= ~(1UL<<irq);
25183 irq_set_chip_and_handler_name(irq, &i8259A_chip, handle_level_irq,
25184 i8259A_chip.name);
25185 enable_irq(irq);
25186 @@ -209,7 +209,7 @@ spurious_8259A_irq:
25187 "spurious 8259A interrupt: IRQ%d.\n", irq);
25188 spurious_irq_mask |= irqmask;
25189 }
25190 - atomic_inc(&irq_err_count);
25191 + atomic_inc_unchecked(&irq_err_count);
25192 /*
25193 * Theoretically we do not have to handle this IRQ,
25194 * but in Linux this does not cause problems and is
25195 @@ -332,14 +332,16 @@ static void init_8259A(int auto_eoi)
25196 /* (slave's support for AEOI in flat mode is to be investigated) */
25197 outb_pic(SLAVE_ICW4_DEFAULT, PIC_SLAVE_IMR);
25198
25199 + pax_open_kernel();
25200 if (auto_eoi)
25201 /*
25202 * In AEOI mode we just have to mask the interrupt
25203 * when acking.
25204 */
25205 - i8259A_chip.irq_mask_ack = disable_8259A_irq;
25206 + *(void **)&i8259A_chip.irq_mask_ack = disable_8259A_irq;
25207 else
25208 - i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
25209 + *(void **)&i8259A_chip.irq_mask_ack = mask_and_ack_8259A;
25210 + pax_close_kernel();
25211
25212 udelay(100); /* wait for 8259A to initialize */
25213
25214 diff --git a/arch/x86/kernel/io_delay.c b/arch/x86/kernel/io_delay.c
25215 index a979b5b..1d6db75 100644
25216 --- a/arch/x86/kernel/io_delay.c
25217 +++ b/arch/x86/kernel/io_delay.c
25218 @@ -58,7 +58,7 @@ static int __init dmi_io_delay_0xed_port(const struct dmi_system_id *id)
25219 * Quirk table for systems that misbehave (lock up, etc.) if port
25220 * 0x80 is used:
25221 */
25222 -static struct dmi_system_id __initdata io_delay_0xed_port_dmi_table[] = {
25223 +static const struct dmi_system_id __initconst io_delay_0xed_port_dmi_table[] = {
25224 {
25225 .callback = dmi_io_delay_0xed_port,
25226 .ident = "Compaq Presario V6000",
25227 diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
25228 index 4ddaf66..49d5c18 100644
25229 --- a/arch/x86/kernel/ioport.c
25230 +++ b/arch/x86/kernel/ioport.c
25231 @@ -6,6 +6,7 @@
25232 #include <linux/sched.h>
25233 #include <linux/kernel.h>
25234 #include <linux/capability.h>
25235 +#include <linux/security.h>
25236 #include <linux/errno.h>
25237 #include <linux/types.h>
25238 #include <linux/ioport.h>
25239 @@ -30,6 +31,12 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
25240 return -EINVAL;
25241 if (turn_on && !capable(CAP_SYS_RAWIO))
25242 return -EPERM;
25243 +#ifdef CONFIG_GRKERNSEC_IO
25244 + if (turn_on && grsec_disable_privio) {
25245 + gr_handle_ioperm();
25246 + return -ENODEV;
25247 + }
25248 +#endif
25249
25250 /*
25251 * If it's the first ioperm() call in this thread's lifetime, set the
25252 @@ -54,7 +61,7 @@ asmlinkage long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
25253 * because the ->io_bitmap_max value must match the bitmap
25254 * contents:
25255 */
25256 - tss = &per_cpu(init_tss, get_cpu());
25257 + tss = init_tss + get_cpu();
25258
25259 if (turn_on)
25260 bitmap_clear(t->io_bitmap_ptr, from, num);
25261 @@ -105,6 +112,12 @@ SYSCALL_DEFINE1(iopl, unsigned int, level)
25262 if (level > old) {
25263 if (!capable(CAP_SYS_RAWIO))
25264 return -EPERM;
25265 +#ifdef CONFIG_GRKERNSEC_IO
25266 + if (grsec_disable_privio) {
25267 + gr_handle_iopl();
25268 + return -ENODEV;
25269 + }
25270 +#endif
25271 }
25272 regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
25273 t->iopl = level << 12;
25274 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
25275 index d99f31d..1c0f466 100644
25276 --- a/arch/x86/kernel/irq.c
25277 +++ b/arch/x86/kernel/irq.c
25278 @@ -21,7 +21,7 @@
25279 #define CREATE_TRACE_POINTS
25280 #include <asm/trace/irq_vectors.h>
25281
25282 -atomic_t irq_err_count;
25283 +atomic_unchecked_t irq_err_count;
25284
25285 /* Function pointer for generic interrupt vector handling */
25286 void (*x86_platform_ipi_callback)(void) = NULL;
25287 @@ -125,9 +125,9 @@ int arch_show_interrupts(struct seq_file *p, int prec)
25288 seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
25289 seq_printf(p, " Machine check polls\n");
25290 #endif
25291 - seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
25292 + seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
25293 #if defined(CONFIG_X86_IO_APIC)
25294 - seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
25295 + seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
25296 #endif
25297 return 0;
25298 }
25299 @@ -167,7 +167,7 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
25300
25301 u64 arch_irq_stat(void)
25302 {
25303 - u64 sum = atomic_read(&irq_err_count);
25304 + u64 sum = atomic_read_unchecked(&irq_err_count);
25305 return sum;
25306 }
25307
25308 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
25309 index d7fcbed..96e715a 100644
25310 --- a/arch/x86/kernel/irq_32.c
25311 +++ b/arch/x86/kernel/irq_32.c
25312 @@ -29,6 +29,8 @@ EXPORT_PER_CPU_SYMBOL(irq_regs);
25313
25314 #ifdef CONFIG_DEBUG_STACKOVERFLOW
25315
25316 +extern void gr_handle_kernel_exploit(void);
25317 +
25318 int sysctl_panic_on_stackoverflow __read_mostly;
25319
25320 /* Debugging check for stack overflow: is there less than 1KB free? */
25321 @@ -39,13 +41,14 @@ static int check_stack_overflow(void)
25322 __asm__ __volatile__("andl %%esp,%0" :
25323 "=r" (sp) : "0" (THREAD_SIZE - 1));
25324
25325 - return sp < (sizeof(struct thread_info) + STACK_WARN);
25326 + return sp < STACK_WARN;
25327 }
25328
25329 static void print_stack_overflow(void)
25330 {
25331 printk(KERN_WARNING "low stack detected by irq handler\n");
25332 dump_stack();
25333 + gr_handle_kernel_exploit();
25334 if (sysctl_panic_on_stackoverflow)
25335 panic("low stack detected by irq handler - check messages\n");
25336 }
25337 @@ -59,8 +62,8 @@ static inline void print_stack_overflow(void) { }
25338 * per-CPU IRQ handling contexts (thread information and stack)
25339 */
25340 union irq_ctx {
25341 - struct thread_info tinfo;
25342 - u32 stack[THREAD_SIZE/sizeof(u32)];
25343 + unsigned long previous_esp;
25344 + u32 stack[THREAD_SIZE/sizeof(u32)];
25345 } __attribute__((aligned(THREAD_SIZE)));
25346
25347 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
25348 @@ -80,10 +83,9 @@ static void call_on_stack(void *func, void *stack)
25349 static inline int
25350 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25351 {
25352 - union irq_ctx *curctx, *irqctx;
25353 + union irq_ctx *irqctx;
25354 u32 *isp, arg1, arg2;
25355
25356 - curctx = (union irq_ctx *) current_thread_info();
25357 irqctx = __this_cpu_read(hardirq_ctx);
25358
25359 /*
25360 @@ -92,13 +94,16 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25361 * handler) we can't do that and just have to keep using the
25362 * current stack (which is the irq stack already after all)
25363 */
25364 - if (unlikely(curctx == irqctx))
25365 + if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
25366 return 0;
25367
25368 /* build the stack frame on the IRQ stack */
25369 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
25370 - irqctx->tinfo.task = curctx->tinfo.task;
25371 - irqctx->tinfo.previous_esp = current_stack_pointer;
25372 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
25373 + irqctx->previous_esp = current_stack_pointer;
25374 +
25375 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25376 + __set_fs(MAKE_MM_SEG(0));
25377 +#endif
25378
25379 if (unlikely(overflow))
25380 call_on_stack(print_stack_overflow, isp);
25381 @@ -110,6 +115,11 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25382 : "0" (irq), "1" (desc), "2" (isp),
25383 "D" (desc->handle_irq)
25384 : "memory", "cc", "ecx");
25385 +
25386 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25387 + __set_fs(current_thread_info()->addr_limit);
25388 +#endif
25389 +
25390 return 1;
25391 }
25392
25393 @@ -118,48 +128,34 @@ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
25394 */
25395 void irq_ctx_init(int cpu)
25396 {
25397 - union irq_ctx *irqctx;
25398 -
25399 if (per_cpu(hardirq_ctx, cpu))
25400 return;
25401
25402 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
25403 - THREADINFO_GFP,
25404 - THREAD_SIZE_ORDER));
25405 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
25406 - irqctx->tinfo.cpu = cpu;
25407 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
25408 -
25409 - per_cpu(hardirq_ctx, cpu) = irqctx;
25410 -
25411 - irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
25412 - THREADINFO_GFP,
25413 - THREAD_SIZE_ORDER));
25414 - memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
25415 - irqctx->tinfo.cpu = cpu;
25416 - irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
25417 -
25418 - per_cpu(softirq_ctx, cpu) = irqctx;
25419 -
25420 - printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
25421 - cpu, per_cpu(hardirq_ctx, cpu), per_cpu(softirq_ctx, cpu));
25422 + per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
25423 + per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREADINFO_GFP, THREAD_SIZE_ORDER));
25424 }
25425
25426 void do_softirq_own_stack(void)
25427 {
25428 - struct thread_info *curctx;
25429 union irq_ctx *irqctx;
25430 u32 *isp;
25431
25432 - curctx = current_thread_info();
25433 irqctx = __this_cpu_read(softirq_ctx);
25434 - irqctx->tinfo.task = curctx->task;
25435 - irqctx->tinfo.previous_esp = current_stack_pointer;
25436 + irqctx->previous_esp = current_stack_pointer;
25437
25438 /* build the stack frame on the softirq stack */
25439 - isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
25440 + isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
25441 +
25442 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25443 + __set_fs(MAKE_MM_SEG(0));
25444 +#endif
25445
25446 call_on_stack(__do_softirq, isp);
25447 +
25448 +#ifdef CONFIG_PAX_MEMORY_UDEREF
25449 + __set_fs(current_thread_info()->addr_limit);
25450 +#endif
25451 +
25452 }
25453
25454 bool handle_irq(unsigned irq, struct pt_regs *regs)
25455 @@ -173,7 +169,7 @@ bool handle_irq(unsigned irq, struct pt_regs *regs)
25456 if (unlikely(!desc))
25457 return false;
25458
25459 - if (user_mode_vm(regs) || !execute_on_irq_stack(overflow, desc, irq)) {
25460 + if (user_mode(regs) || !execute_on_irq_stack(overflow, desc, irq)) {
25461 if (unlikely(overflow))
25462 print_stack_overflow();
25463 desc->handle_irq(irq, desc);
25464 diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
25465 index 4d1c746..55a22d6 100644
25466 --- a/arch/x86/kernel/irq_64.c
25467 +++ b/arch/x86/kernel/irq_64.c
25468 @@ -26,6 +26,8 @@ EXPORT_PER_CPU_SYMBOL(irq_stat);
25469 DEFINE_PER_CPU(struct pt_regs *, irq_regs);
25470 EXPORT_PER_CPU_SYMBOL(irq_regs);
25471
25472 +extern void gr_handle_kernel_exploit(void);
25473 +
25474 int sysctl_panic_on_stackoverflow;
25475
25476 /*
25477 @@ -44,7 +46,7 @@ static inline void stack_overflow_check(struct pt_regs *regs)
25478 u64 estack_top, estack_bottom;
25479 u64 curbase = (u64)task_stack_page(current);
25480
25481 - if (user_mode_vm(regs))
25482 + if (user_mode(regs))
25483 return;
25484
25485 if (regs->sp >= curbase + sizeof(struct thread_info) +
25486 @@ -69,6 +71,8 @@ static inline void stack_overflow_check(struct pt_regs *regs)
25487 irq_stack_top, irq_stack_bottom,
25488 estack_top, estack_bottom);
25489
25490 + gr_handle_kernel_exploit();
25491 +
25492 if (sysctl_panic_on_stackoverflow)
25493 panic("low stack detected by irq handler - check messages\n");
25494 #endif
25495 diff --git a/arch/x86/kernel/jump_label.c b/arch/x86/kernel/jump_label.c
25496 index 26d5a55..a01160a 100644
25497 --- a/arch/x86/kernel/jump_label.c
25498 +++ b/arch/x86/kernel/jump_label.c
25499 @@ -51,7 +51,7 @@ static void __jump_label_transform(struct jump_entry *entry,
25500 * Jump label is enabled for the first time.
25501 * So we expect a default_nop...
25502 */
25503 - if (unlikely(memcmp((void *)entry->code, default_nop, 5)
25504 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), default_nop, 5)
25505 != 0))
25506 bug_at((void *)entry->code, __LINE__);
25507 } else {
25508 @@ -59,7 +59,7 @@ static void __jump_label_transform(struct jump_entry *entry,
25509 * ...otherwise expect an ideal_nop. Otherwise
25510 * something went horribly wrong.
25511 */
25512 - if (unlikely(memcmp((void *)entry->code, ideal_nop, 5)
25513 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), ideal_nop, 5)
25514 != 0))
25515 bug_at((void *)entry->code, __LINE__);
25516 }
25517 @@ -75,13 +75,13 @@ static void __jump_label_transform(struct jump_entry *entry,
25518 * are converting the default nop to the ideal nop.
25519 */
25520 if (init) {
25521 - if (unlikely(memcmp((void *)entry->code, default_nop, 5) != 0))
25522 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), default_nop, 5) != 0))
25523 bug_at((void *)entry->code, __LINE__);
25524 } else {
25525 code.jump = 0xe9;
25526 code.offset = entry->target -
25527 (entry->code + JUMP_LABEL_NOP_SIZE);
25528 - if (unlikely(memcmp((void *)entry->code, &code, 5) != 0))
25529 + if (unlikely(memcmp((void *)ktla_ktva(entry->code), &code, 5) != 0))
25530 bug_at((void *)entry->code, __LINE__);
25531 }
25532 memcpy(&code, ideal_nops[NOP_ATOMIC5], JUMP_LABEL_NOP_SIZE);
25533 diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
25534 index 7ec1d5f..5a7d130 100644
25535 --- a/arch/x86/kernel/kgdb.c
25536 +++ b/arch/x86/kernel/kgdb.c
25537 @@ -126,11 +126,11 @@ char *dbg_get_reg(int regno, void *mem, struct pt_regs *regs)
25538 #ifdef CONFIG_X86_32
25539 switch (regno) {
25540 case GDB_SS:
25541 - if (!user_mode_vm(regs))
25542 + if (!user_mode(regs))
25543 *(unsigned long *)mem = __KERNEL_DS;
25544 break;
25545 case GDB_SP:
25546 - if (!user_mode_vm(regs))
25547 + if (!user_mode(regs))
25548 *(unsigned long *)mem = kernel_stack_pointer(regs);
25549 break;
25550 case GDB_GS:
25551 @@ -228,7 +228,10 @@ static void kgdb_correct_hw_break(void)
25552 bp->attr.bp_addr = breakinfo[breakno].addr;
25553 bp->attr.bp_len = breakinfo[breakno].len;
25554 bp->attr.bp_type = breakinfo[breakno].type;
25555 - info->address = breakinfo[breakno].addr;
25556 + if (breakinfo[breakno].type == X86_BREAKPOINT_EXECUTE)
25557 + info->address = ktla_ktva(breakinfo[breakno].addr);
25558 + else
25559 + info->address = breakinfo[breakno].addr;
25560 info->len = breakinfo[breakno].len;
25561 info->type = breakinfo[breakno].type;
25562 val = arch_install_hw_breakpoint(bp);
25563 @@ -475,12 +478,12 @@ int kgdb_arch_handle_exception(int e_vector, int signo, int err_code,
25564 case 'k':
25565 /* clear the trace bit */
25566 linux_regs->flags &= ~X86_EFLAGS_TF;
25567 - atomic_set(&kgdb_cpu_doing_single_step, -1);
25568 + atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
25569
25570 /* set the trace bit if we're stepping */
25571 if (remcomInBuffer[0] == 's') {
25572 linux_regs->flags |= X86_EFLAGS_TF;
25573 - atomic_set(&kgdb_cpu_doing_single_step,
25574 + atomic_set_unchecked(&kgdb_cpu_doing_single_step,
25575 raw_smp_processor_id());
25576 }
25577
25578 @@ -545,7 +548,7 @@ static int __kgdb_notify(struct die_args *args, unsigned long cmd)
25579
25580 switch (cmd) {
25581 case DIE_DEBUG:
25582 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
25583 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
25584 if (user_mode(regs))
25585 return single_step_cont(regs, args);
25586 break;
25587 @@ -750,11 +753,11 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
25588 #endif /* CONFIG_DEBUG_RODATA */
25589
25590 bpt->type = BP_BREAKPOINT;
25591 - err = probe_kernel_read(bpt->saved_instr, (char *)bpt->bpt_addr,
25592 + err = probe_kernel_read(bpt->saved_instr, ktla_ktva((char *)bpt->bpt_addr),
25593 BREAK_INSTR_SIZE);
25594 if (err)
25595 return err;
25596 - err = probe_kernel_write((char *)bpt->bpt_addr,
25597 + err = probe_kernel_write(ktla_ktva((char *)bpt->bpt_addr),
25598 arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE);
25599 #ifdef CONFIG_DEBUG_RODATA
25600 if (!err)
25601 @@ -767,7 +770,7 @@ int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
25602 return -EBUSY;
25603 text_poke((void *)bpt->bpt_addr, arch_kgdb_ops.gdb_bpt_instr,
25604 BREAK_INSTR_SIZE);
25605 - err = probe_kernel_read(opc, (char *)bpt->bpt_addr, BREAK_INSTR_SIZE);
25606 + err = probe_kernel_read(opc, ktla_ktva((char *)bpt->bpt_addr), BREAK_INSTR_SIZE);
25607 if (err)
25608 return err;
25609 if (memcmp(opc, arch_kgdb_ops.gdb_bpt_instr, BREAK_INSTR_SIZE))
25610 @@ -792,13 +795,13 @@ int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
25611 if (mutex_is_locked(&text_mutex))
25612 goto knl_write;
25613 text_poke((void *)bpt->bpt_addr, bpt->saved_instr, BREAK_INSTR_SIZE);
25614 - err = probe_kernel_read(opc, (char *)bpt->bpt_addr, BREAK_INSTR_SIZE);
25615 + err = probe_kernel_read(opc, ktla_ktva((char *)bpt->bpt_addr), BREAK_INSTR_SIZE);
25616 if (err || memcmp(opc, bpt->saved_instr, BREAK_INSTR_SIZE))
25617 goto knl_write;
25618 return err;
25619 knl_write:
25620 #endif /* CONFIG_DEBUG_RODATA */
25621 - return probe_kernel_write((char *)bpt->bpt_addr,
25622 + return probe_kernel_write(ktla_ktva((char *)bpt->bpt_addr),
25623 (char *)bpt->saved_instr, BREAK_INSTR_SIZE);
25624 }
25625
25626 diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
25627 index 79a3f96..6ba030a 100644
25628 --- a/arch/x86/kernel/kprobes/core.c
25629 +++ b/arch/x86/kernel/kprobes/core.c
25630 @@ -119,9 +119,12 @@ static void __kprobes __synthesize_relative_insn(void *from, void *to, u8 op)
25631 s32 raddr;
25632 } __packed *insn;
25633
25634 - insn = (struct __arch_relative_insn *)from;
25635 + insn = (struct __arch_relative_insn *)ktla_ktva(from);
25636 +
25637 + pax_open_kernel();
25638 insn->raddr = (s32)((long)(to) - ((long)(from) + 5));
25639 insn->op = op;
25640 + pax_close_kernel();
25641 }
25642
25643 /* Insert a jump instruction at address 'from', which jumps to address 'to'.*/
25644 @@ -164,7 +167,7 @@ int __kprobes can_boost(kprobe_opcode_t *opcodes)
25645 kprobe_opcode_t opcode;
25646 kprobe_opcode_t *orig_opcodes = opcodes;
25647
25648 - if (search_exception_tables((unsigned long)opcodes))
25649 + if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
25650 return 0; /* Page fault may occur on this address. */
25651
25652 retry:
25653 @@ -238,9 +241,9 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr)
25654 * for the first byte, we can recover the original instruction
25655 * from it and kp->opcode.
25656 */
25657 - memcpy(buf, kp->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
25658 + memcpy(buf, ktla_ktva(kp->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
25659 buf[0] = kp->opcode;
25660 - return (unsigned long)buf;
25661 + return ktva_ktla((unsigned long)buf);
25662 }
25663
25664 /*
25665 @@ -332,7 +335,9 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src)
25666 /* Another subsystem puts a breakpoint, failed to recover */
25667 if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION)
25668 return 0;
25669 + pax_open_kernel();
25670 memcpy(dest, insn.kaddr, insn.length);
25671 + pax_close_kernel();
25672
25673 #ifdef CONFIG_X86_64
25674 if (insn_rip_relative(&insn)) {
25675 @@ -359,7 +364,9 @@ int __kprobes __copy_instruction(u8 *dest, u8 *src)
25676 return 0;
25677 }
25678 disp = (u8 *) dest + insn_offset_displacement(&insn);
25679 + pax_open_kernel();
25680 *(s32 *) disp = (s32) newdisp;
25681 + pax_close_kernel();
25682 }
25683 #endif
25684 return insn.length;
25685 @@ -498,7 +505,7 @@ setup_singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *k
25686 * nor set current_kprobe, because it doesn't use single
25687 * stepping.
25688 */
25689 - regs->ip = (unsigned long)p->ainsn.insn;
25690 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
25691 preempt_enable_no_resched();
25692 return;
25693 }
25694 @@ -515,9 +522,9 @@ setup_singlestep(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *k
25695 regs->flags &= ~X86_EFLAGS_IF;
25696 /* single step inline if the instruction is an int3 */
25697 if (p->opcode == BREAKPOINT_INSTRUCTION)
25698 - regs->ip = (unsigned long)p->addr;
25699 + regs->ip = ktla_ktva((unsigned long)p->addr);
25700 else
25701 - regs->ip = (unsigned long)p->ainsn.insn;
25702 + regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
25703 }
25704
25705 /*
25706 @@ -596,7 +603,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
25707 setup_singlestep(p, regs, kcb, 0);
25708 return 1;
25709 }
25710 - } else if (*addr != BREAKPOINT_INSTRUCTION) {
25711 + } else if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
25712 /*
25713 * The breakpoint instruction was removed right
25714 * after we hit it. Another cpu has removed
25715 @@ -642,6 +649,9 @@ static void __used __kprobes kretprobe_trampoline_holder(void)
25716 " movq %rax, 152(%rsp)\n"
25717 RESTORE_REGS_STRING
25718 " popfq\n"
25719 +#ifdef KERNEXEC_PLUGIN
25720 + " btsq $63,(%rsp)\n"
25721 +#endif
25722 #else
25723 " pushf\n"
25724 SAVE_REGS_STRING
25725 @@ -779,7 +789,7 @@ static void __kprobes
25726 resume_execution(struct kprobe *p, struct pt_regs *regs, struct kprobe_ctlblk *kcb)
25727 {
25728 unsigned long *tos = stack_addr(regs);
25729 - unsigned long copy_ip = (unsigned long)p->ainsn.insn;
25730 + unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
25731 unsigned long orig_ip = (unsigned long)p->addr;
25732 kprobe_opcode_t *insn = p->ainsn.insn;
25733
25734 @@ -961,7 +971,7 @@ kprobe_exceptions_notify(struct notifier_block *self, unsigned long val, void *d
25735 struct die_args *args = data;
25736 int ret = NOTIFY_DONE;
25737
25738 - if (args->regs && user_mode_vm(args->regs))
25739 + if (args->regs && user_mode(args->regs))
25740 return ret;
25741
25742 switch (val) {
25743 diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
25744 index 898160b..758cde8 100644
25745 --- a/arch/x86/kernel/kprobes/opt.c
25746 +++ b/arch/x86/kernel/kprobes/opt.c
25747 @@ -79,6 +79,7 @@ found:
25748 /* Insert a move instruction which sets a pointer to eax/rdi (1st arg). */
25749 static void __kprobes synthesize_set_arg1(kprobe_opcode_t *addr, unsigned long val)
25750 {
25751 + pax_open_kernel();
25752 #ifdef CONFIG_X86_64
25753 *addr++ = 0x48;
25754 *addr++ = 0xbf;
25755 @@ -86,6 +87,7 @@ static void __kprobes synthesize_set_arg1(kprobe_opcode_t *addr, unsigned long v
25756 *addr++ = 0xb8;
25757 #endif
25758 *(unsigned long *)addr = val;
25759 + pax_close_kernel();
25760 }
25761
25762 asm (
25763 @@ -335,7 +337,7 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
25764 * Verify if the address gap is in 2GB range, because this uses
25765 * a relative jump.
25766 */
25767 - rel = (long)op->optinsn.insn - (long)op->kp.addr + RELATIVEJUMP_SIZE;
25768 + rel = (long)op->optinsn.insn - ktla_ktva((long)op->kp.addr) + RELATIVEJUMP_SIZE;
25769 if (abs(rel) > 0x7fffffff)
25770 return -ERANGE;
25771
25772 @@ -350,16 +352,18 @@ int __kprobes arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
25773 op->optinsn.size = ret;
25774
25775 /* Copy arch-dep-instance from template */
25776 - memcpy(buf, &optprobe_template_entry, TMPL_END_IDX);
25777 + pax_open_kernel();
25778 + memcpy(buf, ktla_ktva(&optprobe_template_entry), TMPL_END_IDX);
25779 + pax_close_kernel();
25780
25781 /* Set probe information */
25782 synthesize_set_arg1(buf + TMPL_MOVE_IDX, (unsigned long)op);
25783
25784 /* Set probe function call */
25785 - synthesize_relcall(buf + TMPL_CALL_IDX, optimized_callback);
25786 + synthesize_relcall(ktva_ktla(buf) + TMPL_CALL_IDX, optimized_callback);
25787
25788 /* Set returning jmp instruction at the tail of out-of-line buffer */
25789 - synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
25790 + synthesize_reljump(ktva_ktla(buf) + TMPL_END_IDX + op->optinsn.size,
25791 (u8 *)op->kp.addr + op->optinsn.size);
25792
25793 flush_icache_range((unsigned long) buf,
25794 @@ -384,7 +388,7 @@ void __kprobes arch_optimize_kprobes(struct list_head *oplist)
25795 WARN_ON(kprobe_disabled(&op->kp));
25796
25797 /* Backup instructions which will be replaced by jump address */
25798 - memcpy(op->optinsn.copied_insn, op->kp.addr + INT3_SIZE,
25799 + memcpy(op->optinsn.copied_insn, ktla_ktva(op->kp.addr) + INT3_SIZE,
25800 RELATIVE_ADDR_SIZE);
25801
25802 insn_buf[0] = RELATIVEJUMP_OPCODE;
25803 @@ -433,7 +437,7 @@ setup_detour_execution(struct kprobe *p, struct pt_regs *regs, int reenter)
25804 /* This kprobe is really able to run optimized path. */
25805 op = container_of(p, struct optimized_kprobe, kp);
25806 /* Detour through copied instructions */
25807 - regs->ip = (unsigned long)op->optinsn.insn + TMPL_END_IDX;
25808 + regs->ip = ktva_ktla((unsigned long)op->optinsn.insn) + TMPL_END_IDX;
25809 if (!reenter)
25810 reset_current_kprobe();
25811 preempt_enable_no_resched();
25812 diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
25813 index c2bedae..25e7ab6 100644
25814 --- a/arch/x86/kernel/ksysfs.c
25815 +++ b/arch/x86/kernel/ksysfs.c
25816 @@ -184,7 +184,7 @@ out:
25817
25818 static struct kobj_attribute type_attr = __ATTR_RO(type);
25819
25820 -static struct bin_attribute data_attr = {
25821 +static bin_attribute_no_const data_attr __read_only = {
25822 .attr = {
25823 .name = "data",
25824 .mode = S_IRUGO,
25825 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
25826 index af1d14a..81ae763 100644
25827 --- a/arch/x86/kernel/ldt.c
25828 +++ b/arch/x86/kernel/ldt.c
25829 @@ -20,6 +20,8 @@
25830 #include <asm/mmu_context.h>
25831 #include <asm/syscalls.h>
25832
25833 +int sysctl_ldt16 = 0;
25834 +
25835 #ifdef CONFIG_SMP
25836 static void flush_ldt(void *current_mm)
25837 {
25838 @@ -66,13 +68,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
25839 if (reload) {
25840 #ifdef CONFIG_SMP
25841 preempt_disable();
25842 - load_LDT(pc);
25843 + load_LDT_nolock(pc);
25844 if (!cpumask_equal(mm_cpumask(current->mm),
25845 cpumask_of(smp_processor_id())))
25846 smp_call_function(flush_ldt, current->mm, 1);
25847 preempt_enable();
25848 #else
25849 - load_LDT(pc);
25850 + load_LDT_nolock(pc);
25851 #endif
25852 }
25853 if (oldsize) {
25854 @@ -94,7 +96,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
25855 return err;
25856
25857 for (i = 0; i < old->size; i++)
25858 - write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
25859 + write_ldt_entry(new->ldt, i, old->ldt + i);
25860 return 0;
25861 }
25862
25863 @@ -115,6 +117,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
25864 retval = copy_ldt(&mm->context, &old_mm->context);
25865 mutex_unlock(&old_mm->context.lock);
25866 }
25867 +
25868 + if (tsk == current) {
25869 + mm->context.vdso = 0;
25870 +
25871 +#ifdef CONFIG_X86_32
25872 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
25873 + mm->context.user_cs_base = 0UL;
25874 + mm->context.user_cs_limit = ~0UL;
25875 +
25876 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
25877 + cpus_clear(mm->context.cpu_user_cs_mask);
25878 +#endif
25879 +
25880 +#endif
25881 +#endif
25882 +
25883 + }
25884 +
25885 return retval;
25886 }
25887
25888 @@ -229,12 +249,19 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
25889 }
25890 }
25891
25892 +#ifdef CONFIG_PAX_SEGMEXEC
25893 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
25894 + error = -EINVAL;
25895 + goto out_unlock;
25896 + }
25897 +#endif
25898 +
25899 /*
25900 * On x86-64 we do not support 16-bit segments due to
25901 * IRET leaking the high bits of the kernel stack address.
25902 */
25903 #ifdef CONFIG_X86_64
25904 - if (!ldt_info.seg_32bit) {
25905 + if (!ldt_info.seg_32bit && !sysctl_ldt16) {
25906 error = -EINVAL;
25907 goto out_unlock;
25908 }
25909 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
25910 index 1667b1d..16492c5 100644
25911 --- a/arch/x86/kernel/machine_kexec_32.c
25912 +++ b/arch/x86/kernel/machine_kexec_32.c
25913 @@ -25,7 +25,7 @@
25914 #include <asm/cacheflush.h>
25915 #include <asm/debugreg.h>
25916
25917 -static void set_idt(void *newidt, __u16 limit)
25918 +static void set_idt(struct desc_struct *newidt, __u16 limit)
25919 {
25920 struct desc_ptr curidt;
25921
25922 @@ -37,7 +37,7 @@ static void set_idt(void *newidt, __u16 limit)
25923 }
25924
25925
25926 -static void set_gdt(void *newgdt, __u16 limit)
25927 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
25928 {
25929 struct desc_ptr curgdt;
25930
25931 @@ -215,7 +215,7 @@ void machine_kexec(struct kimage *image)
25932 }
25933
25934 control_page = page_address(image->control_code_page);
25935 - memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
25936 + memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
25937
25938 relocate_kernel_ptr = control_page;
25939 page_list[PA_CONTROL_PAGE] = __pa(control_page);
25940 diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
25941 index 18be189..4a9fe40 100644
25942 --- a/arch/x86/kernel/module.c
25943 +++ b/arch/x86/kernel/module.c
25944 @@ -43,15 +43,60 @@ do { \
25945 } while (0)
25946 #endif
25947
25948 -void *module_alloc(unsigned long size)
25949 +static inline void *__module_alloc(unsigned long size, pgprot_t prot)
25950 {
25951 - if (PAGE_ALIGN(size) > MODULES_LEN)
25952 + if (!size || PAGE_ALIGN(size) > MODULES_LEN)
25953 return NULL;
25954 return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
25955 - GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
25956 + GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot,
25957 NUMA_NO_NODE, __builtin_return_address(0));
25958 }
25959
25960 +void *module_alloc(unsigned long size)
25961 +{
25962 +
25963 +#ifdef CONFIG_PAX_KERNEXEC
25964 + return __module_alloc(size, PAGE_KERNEL);
25965 +#else
25966 + return __module_alloc(size, PAGE_KERNEL_EXEC);
25967 +#endif
25968 +
25969 +}
25970 +
25971 +#ifdef CONFIG_PAX_KERNEXEC
25972 +#ifdef CONFIG_X86_32
25973 +void *module_alloc_exec(unsigned long size)
25974 +{
25975 + struct vm_struct *area;
25976 +
25977 + if (size == 0)
25978 + return NULL;
25979 +
25980 + area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
25981 + return area ? area->addr : NULL;
25982 +}
25983 +EXPORT_SYMBOL(module_alloc_exec);
25984 +
25985 +void module_free_exec(struct module *mod, void *module_region)
25986 +{
25987 + vunmap(module_region);
25988 +}
25989 +EXPORT_SYMBOL(module_free_exec);
25990 +#else
25991 +void module_free_exec(struct module *mod, void *module_region)
25992 +{
25993 + module_free(mod, module_region);
25994 +}
25995 +EXPORT_SYMBOL(module_free_exec);
25996 +
25997 +void *module_alloc_exec(unsigned long size)
25998 +{
25999 + return __module_alloc(size, PAGE_KERNEL_RX);
26000 +}
26001 +EXPORT_SYMBOL(module_alloc_exec);
26002 +#endif
26003 +#endif
26004 +
26005 #ifdef CONFIG_X86_32
26006 int apply_relocate(Elf32_Shdr *sechdrs,
26007 const char *strtab,
26008 @@ -62,14 +107,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
26009 unsigned int i;
26010 Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
26011 Elf32_Sym *sym;
26012 - uint32_t *location;
26013 + uint32_t *plocation, location;
26014
26015 DEBUGP("Applying relocate section %u to %u\n",
26016 relsec, sechdrs[relsec].sh_info);
26017 for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
26018 /* This is where to make the change */
26019 - location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
26020 - + rel[i].r_offset;
26021 + plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
26022 + location = (uint32_t)plocation;
26023 + if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
26024 + plocation = ktla_ktva((void *)plocation);
26025 /* This is the symbol it is referring to. Note that all
26026 undefined symbols have been resolved. */
26027 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
26028 @@ -78,11 +125,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
26029 switch (ELF32_R_TYPE(rel[i].r_info)) {
26030 case R_386_32:
26031 /* We add the value into the location given */
26032 - *location += sym->st_value;
26033 + pax_open_kernel();
26034 + *plocation += sym->st_value;
26035 + pax_close_kernel();
26036 break;
26037 case R_386_PC32:
26038 /* Add the value, subtract its position */
26039 - *location += sym->st_value - (uint32_t)location;
26040 + pax_open_kernel();
26041 + *plocation += sym->st_value - location;
26042 + pax_close_kernel();
26043 break;
26044 default:
26045 pr_err("%s: Unknown relocation: %u\n",
26046 @@ -127,21 +178,30 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
26047 case R_X86_64_NONE:
26048 break;
26049 case R_X86_64_64:
26050 + pax_open_kernel();
26051 *(u64 *)loc = val;
26052 + pax_close_kernel();
26053 break;
26054 case R_X86_64_32:
26055 + pax_open_kernel();
26056 *(u32 *)loc = val;
26057 + pax_close_kernel();
26058 if (val != *(u32 *)loc)
26059 goto overflow;
26060 break;
26061 case R_X86_64_32S:
26062 + pax_open_kernel();
26063 *(s32 *)loc = val;
26064 + pax_close_kernel();
26065 if ((s64)val != *(s32 *)loc)
26066 goto overflow;
26067 break;
26068 case R_X86_64_PC32:
26069 val -= (u64)loc;
26070 + pax_open_kernel();
26071 *(u32 *)loc = val;
26072 + pax_close_kernel();
26073 +
26074 #if 0
26075 if ((s64)val != *(s32 *)loc)
26076 goto overflow;
26077 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
26078 index 05266b5..3432443 100644
26079 --- a/arch/x86/kernel/msr.c
26080 +++ b/arch/x86/kernel/msr.c
26081 @@ -37,6 +37,7 @@
26082 #include <linux/notifier.h>
26083 #include <linux/uaccess.h>
26084 #include <linux/gfp.h>
26085 +#include <linux/grsecurity.h>
26086
26087 #include <asm/processor.h>
26088 #include <asm/msr.h>
26089 @@ -103,6 +104,11 @@ static ssize_t msr_write(struct file *file, const char __user *buf,
26090 int err = 0;
26091 ssize_t bytes = 0;
26092
26093 +#ifdef CONFIG_GRKERNSEC_KMEM
26094 + gr_handle_msr_write();
26095 + return -EPERM;
26096 +#endif
26097 +
26098 if (count % 8)
26099 return -EINVAL; /* Invalid chunk size */
26100
26101 @@ -150,6 +156,10 @@ static long msr_ioctl(struct file *file, unsigned int ioc, unsigned long arg)
26102 err = -EBADF;
26103 break;
26104 }
26105 +#ifdef CONFIG_GRKERNSEC_KMEM
26106 + gr_handle_msr_write();
26107 + return -EPERM;
26108 +#endif
26109 if (copy_from_user(&regs, uregs, sizeof regs)) {
26110 err = -EFAULT;
26111 break;
26112 @@ -233,7 +243,7 @@ static int msr_class_cpu_callback(struct notifier_block *nfb,
26113 return notifier_from_errno(err);
26114 }
26115
26116 -static struct notifier_block __refdata msr_class_cpu_notifier = {
26117 +static struct notifier_block msr_class_cpu_notifier = {
26118 .notifier_call = msr_class_cpu_callback,
26119 };
26120
26121 diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
26122 index 6fcb49c..5b3f4ff 100644
26123 --- a/arch/x86/kernel/nmi.c
26124 +++ b/arch/x86/kernel/nmi.c
26125 @@ -138,7 +138,7 @@ static int __kprobes nmi_handle(unsigned int type, struct pt_regs *regs, bool b2
26126 return handled;
26127 }
26128
26129 -int __register_nmi_handler(unsigned int type, struct nmiaction *action)
26130 +int __register_nmi_handler(unsigned int type, const struct nmiaction *action)
26131 {
26132 struct nmi_desc *desc = nmi_to_desc(type);
26133 unsigned long flags;
26134 @@ -162,9 +162,9 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
26135 * event confuses some handlers (kdump uses this flag)
26136 */
26137 if (action->flags & NMI_FLAG_FIRST)
26138 - list_add_rcu(&action->list, &desc->head);
26139 + pax_list_add_rcu((struct list_head *)&action->list, &desc->head);
26140 else
26141 - list_add_tail_rcu(&action->list, &desc->head);
26142 + pax_list_add_tail_rcu((struct list_head *)&action->list, &desc->head);
26143
26144 spin_unlock_irqrestore(&desc->lock, flags);
26145 return 0;
26146 @@ -187,7 +187,7 @@ void unregister_nmi_handler(unsigned int type, const char *name)
26147 if (!strcmp(n->name, name)) {
26148 WARN(in_nmi(),
26149 "Trying to free NMI (%s) from NMI context!\n", n->name);
26150 - list_del_rcu(&n->list);
26151 + pax_list_del_rcu((struct list_head *)&n->list);
26152 break;
26153 }
26154 }
26155 @@ -512,6 +512,17 @@ static inline void nmi_nesting_postprocess(void)
26156 dotraplinkage notrace __kprobes void
26157 do_nmi(struct pt_regs *regs, long error_code)
26158 {
26159 +
26160 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
26161 + if (!user_mode(regs)) {
26162 + unsigned long cs = regs->cs & 0xFFFF;
26163 + unsigned long ip = ktva_ktla(regs->ip);
26164 +
26165 + if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
26166 + regs->ip = ip;
26167 + }
26168 +#endif
26169 +
26170 nmi_nesting_preprocess(regs);
26171
26172 nmi_enter();
26173 diff --git a/arch/x86/kernel/nmi_selftest.c b/arch/x86/kernel/nmi_selftest.c
26174 index 6d9582e..f746287 100644
26175 --- a/arch/x86/kernel/nmi_selftest.c
26176 +++ b/arch/x86/kernel/nmi_selftest.c
26177 @@ -43,7 +43,7 @@ static void __init init_nmi_testsuite(void)
26178 {
26179 /* trap all the unknown NMIs we may generate */
26180 register_nmi_handler(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk",
26181 - __initdata);
26182 + __initconst);
26183 }
26184
26185 static void __init cleanup_nmi_testsuite(void)
26186 @@ -66,7 +66,7 @@ static void __init test_nmi_ipi(struct cpumask *mask)
26187 unsigned long timeout;
26188
26189 if (register_nmi_handler(NMI_LOCAL, test_nmi_ipi_callback,
26190 - NMI_FLAG_FIRST, "nmi_selftest", __initdata)) {
26191 + NMI_FLAG_FIRST, "nmi_selftest", __initconst)) {
26192 nmi_fail = FAILURE;
26193 return;
26194 }
26195 diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
26196 index bbb6c73..24a58ef 100644
26197 --- a/arch/x86/kernel/paravirt-spinlocks.c
26198 +++ b/arch/x86/kernel/paravirt-spinlocks.c
26199 @@ -8,7 +8,7 @@
26200
26201 #include <asm/paravirt.h>
26202
26203 -struct pv_lock_ops pv_lock_ops = {
26204 +struct pv_lock_ops pv_lock_ops __read_only = {
26205 #ifdef CONFIG_SMP
26206 .lock_spinning = __PV_IS_CALLEE_SAVE(paravirt_nop),
26207 .unlock_kick = paravirt_nop,
26208 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
26209 index 1b10af8..45bfbec 100644
26210 --- a/arch/x86/kernel/paravirt.c
26211 +++ b/arch/x86/kernel/paravirt.c
26212 @@ -55,6 +55,9 @@ u64 _paravirt_ident_64(u64 x)
26213 {
26214 return x;
26215 }
26216 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
26217 +PV_CALLEE_SAVE_REGS_THUNK(_paravirt_ident_64);
26218 +#endif
26219
26220 void __init default_banner(void)
26221 {
26222 @@ -141,16 +144,20 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
26223
26224 if (opfunc == NULL)
26225 /* If there's no function, patch it with a ud2a (BUG) */
26226 - ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
26227 - else if (opfunc == _paravirt_nop)
26228 + ret = paravirt_patch_insns(insnbuf, len, ktva_ktla(ud2a), ud2a+sizeof(ud2a));
26229 + else if (opfunc == (void *)_paravirt_nop)
26230 /* If the operation is a nop, then nop the callsite */
26231 ret = paravirt_patch_nop();
26232
26233 /* identity functions just return their single argument */
26234 - else if (opfunc == _paravirt_ident_32)
26235 + else if (opfunc == (void *)_paravirt_ident_32)
26236 ret = paravirt_patch_ident_32(insnbuf, len);
26237 - else if (opfunc == _paravirt_ident_64)
26238 + else if (opfunc == (void *)_paravirt_ident_64)
26239 ret = paravirt_patch_ident_64(insnbuf, len);
26240 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
26241 + else if (opfunc == (void *)__raw_callee_save__paravirt_ident_64)
26242 + ret = paravirt_patch_ident_64(insnbuf, len);
26243 +#endif
26244
26245 else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
26246 type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
26247 @@ -175,7 +182,7 @@ unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
26248 if (insn_len > len || start == NULL)
26249 insn_len = len;
26250 else
26251 - memcpy(insnbuf, start, insn_len);
26252 + memcpy(insnbuf, ktla_ktva(start), insn_len);
26253
26254 return insn_len;
26255 }
26256 @@ -299,7 +306,7 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
26257 return this_cpu_read(paravirt_lazy_mode);
26258 }
26259
26260 -struct pv_info pv_info = {
26261 +struct pv_info pv_info __read_only = {
26262 .name = "bare hardware",
26263 .paravirt_enabled = 0,
26264 .kernel_rpl = 0,
26265 @@ -310,16 +317,16 @@ struct pv_info pv_info = {
26266 #endif
26267 };
26268
26269 -struct pv_init_ops pv_init_ops = {
26270 +struct pv_init_ops pv_init_ops __read_only = {
26271 .patch = native_patch,
26272 };
26273
26274 -struct pv_time_ops pv_time_ops = {
26275 +struct pv_time_ops pv_time_ops __read_only = {
26276 .sched_clock = native_sched_clock,
26277 .steal_clock = native_steal_clock,
26278 };
26279
26280 -__visible struct pv_irq_ops pv_irq_ops = {
26281 +__visible struct pv_irq_ops pv_irq_ops __read_only = {
26282 .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
26283 .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
26284 .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
26285 @@ -331,7 +338,7 @@ __visible struct pv_irq_ops pv_irq_ops = {
26286 #endif
26287 };
26288
26289 -__visible struct pv_cpu_ops pv_cpu_ops = {
26290 +__visible struct pv_cpu_ops pv_cpu_ops __read_only = {
26291 .cpuid = native_cpuid,
26292 .get_debugreg = native_get_debugreg,
26293 .set_debugreg = native_set_debugreg,
26294 @@ -389,21 +396,26 @@ __visible struct pv_cpu_ops pv_cpu_ops = {
26295 .end_context_switch = paravirt_nop,
26296 };
26297
26298 -struct pv_apic_ops pv_apic_ops = {
26299 +struct pv_apic_ops pv_apic_ops __read_only= {
26300 #ifdef CONFIG_X86_LOCAL_APIC
26301 .startup_ipi_hook = paravirt_nop,
26302 #endif
26303 };
26304
26305 -#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
26306 +#ifdef CONFIG_X86_32
26307 +#ifdef CONFIG_X86_PAE
26308 +/* 64-bit pagetable entries */
26309 +#define PTE_IDENT PV_CALLEE_SAVE(_paravirt_ident_64)
26310 +#else
26311 /* 32-bit pagetable entries */
26312 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
26313 +#endif
26314 #else
26315 /* 64-bit pagetable entries */
26316 #define PTE_IDENT __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
26317 #endif
26318
26319 -struct pv_mmu_ops pv_mmu_ops = {
26320 +struct pv_mmu_ops pv_mmu_ops __read_only = {
26321
26322 .read_cr2 = native_read_cr2,
26323 .write_cr2 = native_write_cr2,
26324 @@ -453,6 +465,7 @@ struct pv_mmu_ops pv_mmu_ops = {
26325 .make_pud = PTE_IDENT,
26326
26327 .set_pgd = native_set_pgd,
26328 + .set_pgd_batched = native_set_pgd_batched,
26329 #endif
26330 #endif /* PAGETABLE_LEVELS >= 3 */
26331
26332 @@ -473,6 +486,12 @@ struct pv_mmu_ops pv_mmu_ops = {
26333 },
26334
26335 .set_fixmap = native_set_fixmap,
26336 +
26337 +#ifdef CONFIG_PAX_KERNEXEC
26338 + .pax_open_kernel = native_pax_open_kernel,
26339 + .pax_close_kernel = native_pax_close_kernel,
26340 +#endif
26341 +
26342 };
26343
26344 EXPORT_SYMBOL_GPL(pv_time_ops);
26345 diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c
26346 index 299d493..2ccb0ee 100644
26347 --- a/arch/x86/kernel/pci-calgary_64.c
26348 +++ b/arch/x86/kernel/pci-calgary_64.c
26349 @@ -1339,7 +1339,7 @@ static void __init get_tce_space_from_tar(void)
26350 tce_space = be64_to_cpu(readq(target));
26351 tce_space = tce_space & TAR_SW_BITS;
26352
26353 - tce_space = tce_space & (~specified_table_size);
26354 + tce_space = tce_space & (~(unsigned long)specified_table_size);
26355 info->tce_space = (u64 *)__va(tce_space);
26356 }
26357 }
26358 diff --git a/arch/x86/kernel/pci-iommu_table.c b/arch/x86/kernel/pci-iommu_table.c
26359 index 35ccf75..7a15747 100644
26360 --- a/arch/x86/kernel/pci-iommu_table.c
26361 +++ b/arch/x86/kernel/pci-iommu_table.c
26362 @@ -2,7 +2,7 @@
26363 #include <asm/iommu_table.h>
26364 #include <linux/string.h>
26365 #include <linux/kallsyms.h>
26366 -
26367 +#include <linux/sched.h>
26368
26369 #define DEBUG 1
26370
26371 diff --git a/arch/x86/kernel/pci-swiotlb.c b/arch/x86/kernel/pci-swiotlb.c
26372 index 6c483ba..d10ce2f 100644
26373 --- a/arch/x86/kernel/pci-swiotlb.c
26374 +++ b/arch/x86/kernel/pci-swiotlb.c
26375 @@ -32,7 +32,7 @@ static void x86_swiotlb_free_coherent(struct device *dev, size_t size,
26376 void *vaddr, dma_addr_t dma_addr,
26377 struct dma_attrs *attrs)
26378 {
26379 - swiotlb_free_coherent(dev, size, vaddr, dma_addr);
26380 + swiotlb_free_coherent(dev, size, vaddr, dma_addr, attrs);
26381 }
26382
26383 static struct dma_map_ops swiotlb_dma_ops = {
26384 diff --git a/arch/x86/kernel/preempt.S b/arch/x86/kernel/preempt.S
26385 index ca7f0d5..8996469 100644
26386 --- a/arch/x86/kernel/preempt.S
26387 +++ b/arch/x86/kernel/preempt.S
26388 @@ -3,12 +3,14 @@
26389 #include <asm/dwarf2.h>
26390 #include <asm/asm.h>
26391 #include <asm/calling.h>
26392 +#include <asm/alternative-asm.h>
26393
26394 ENTRY(___preempt_schedule)
26395 CFI_STARTPROC
26396 SAVE_ALL
26397 call preempt_schedule
26398 RESTORE_ALL
26399 + pax_force_retaddr
26400 ret
26401 CFI_ENDPROC
26402
26403 @@ -19,6 +21,7 @@ ENTRY(___preempt_schedule_context)
26404 SAVE_ALL
26405 call preempt_schedule_context
26406 RESTORE_ALL
26407 + pax_force_retaddr
26408 ret
26409 CFI_ENDPROC
26410
26411 diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
26412 index 3fb8d95..254dc51 100644
26413 --- a/arch/x86/kernel/process.c
26414 +++ b/arch/x86/kernel/process.c
26415 @@ -36,7 +36,8 @@
26416 * section. Since TSS's are completely CPU-local, we want them
26417 * on exact cacheline boundaries, to eliminate cacheline ping-pong.
26418 */
26419 -__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
26420 +struct tss_struct init_tss[NR_CPUS] __visible ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
26421 +EXPORT_SYMBOL(init_tss);
26422
26423 #ifdef CONFIG_X86_64
26424 static DEFINE_PER_CPU(unsigned char, is_idle);
26425 @@ -92,7 +93,7 @@ void arch_task_cache_init(void)
26426 task_xstate_cachep =
26427 kmem_cache_create("task_xstate", xstate_size,
26428 __alignof__(union thread_xstate),
26429 - SLAB_PANIC | SLAB_NOTRACK, NULL);
26430 + SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
26431 }
26432
26433 /*
26434 @@ -105,7 +106,7 @@ void exit_thread(void)
26435 unsigned long *bp = t->io_bitmap_ptr;
26436
26437 if (bp) {
26438 - struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
26439 + struct tss_struct *tss = init_tss + get_cpu();
26440
26441 t->io_bitmap_ptr = NULL;
26442 clear_thread_flag(TIF_IO_BITMAP);
26443 @@ -125,6 +126,9 @@ void flush_thread(void)
26444 {
26445 struct task_struct *tsk = current;
26446
26447 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
26448 + loadsegment(gs, 0);
26449 +#endif
26450 flush_ptrace_hw_breakpoint(tsk);
26451 memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
26452 drop_init_fpu(tsk);
26453 @@ -271,7 +275,7 @@ static void __exit_idle(void)
26454 void exit_idle(void)
26455 {
26456 /* idle loop has pid 0 */
26457 - if (current->pid)
26458 + if (task_pid_nr(current))
26459 return;
26460 __exit_idle();
26461 }
26462 @@ -327,7 +331,7 @@ bool xen_set_default_idle(void)
26463 return ret;
26464 }
26465 #endif
26466 -void stop_this_cpu(void *dummy)
26467 +__noreturn void stop_this_cpu(void *dummy)
26468 {
26469 local_irq_disable();
26470 /*
26471 @@ -456,16 +460,37 @@ static int __init idle_setup(char *str)
26472 }
26473 early_param("idle", idle_setup);
26474
26475 -unsigned long arch_align_stack(unsigned long sp)
26476 +#ifdef CONFIG_PAX_RANDKSTACK
26477 +void pax_randomize_kstack(struct pt_regs *regs)
26478 {
26479 - if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
26480 - sp -= get_random_int() % 8192;
26481 - return sp & ~0xf;
26482 -}
26483 + struct thread_struct *thread = &current->thread;
26484 + unsigned long time;
26485
26486 -unsigned long arch_randomize_brk(struct mm_struct *mm)
26487 -{
26488 - unsigned long range_end = mm->brk + 0x02000000;
26489 - return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
26490 -}
26491 + if (!randomize_va_space)
26492 + return;
26493 +
26494 + if (v8086_mode(regs))
26495 + return;
26496
26497 + rdtscl(time);
26498 +
26499 + /* P4 seems to return a 0 LSB, ignore it */
26500 +#ifdef CONFIG_MPENTIUM4
26501 + time &= 0x3EUL;
26502 + time <<= 2;
26503 +#elif defined(CONFIG_X86_64)
26504 + time &= 0xFUL;
26505 + time <<= 4;
26506 +#else
26507 + time &= 0x1FUL;
26508 + time <<= 3;
26509 +#endif
26510 +
26511 + thread->sp0 ^= time;
26512 + load_sp0(init_tss + smp_processor_id(), thread);
26513 +
26514 +#ifdef CONFIG_X86_64
26515 + this_cpu_write(kernel_stack, thread->sp0);
26516 +#endif
26517 +}
26518 +#endif
26519 diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
26520 index 0de43e9..056b840 100644
26521 --- a/arch/x86/kernel/process_32.c
26522 +++ b/arch/x86/kernel/process_32.c
26523 @@ -64,6 +64,7 @@ asmlinkage void ret_from_kernel_thread(void) __asm__("ret_from_kernel_thread");
26524 unsigned long thread_saved_pc(struct task_struct *tsk)
26525 {
26526 return ((unsigned long *)tsk->thread.sp)[3];
26527 +//XXX return tsk->thread.eip;
26528 }
26529
26530 void __show_regs(struct pt_regs *regs, int all)
26531 @@ -73,19 +74,18 @@ void __show_regs(struct pt_regs *regs, int all)
26532 unsigned long sp;
26533 unsigned short ss, gs;
26534
26535 - if (user_mode_vm(regs)) {
26536 + if (user_mode(regs)) {
26537 sp = regs->sp;
26538 ss = regs->ss & 0xffff;
26539 - gs = get_user_gs(regs);
26540 } else {
26541 sp = kernel_stack_pointer(regs);
26542 savesegment(ss, ss);
26543 - savesegment(gs, gs);
26544 }
26545 + gs = get_user_gs(regs);
26546
26547 printk(KERN_DEFAULT "EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
26548 (u16)regs->cs, regs->ip, regs->flags,
26549 - smp_processor_id());
26550 + raw_smp_processor_id());
26551 print_symbol("EIP is at %s\n", regs->ip);
26552
26553 printk(KERN_DEFAULT "EAX: %08lx EBX: %08lx ECX: %08lx EDX: %08lx\n",
26554 @@ -132,20 +132,21 @@ void release_thread(struct task_struct *dead_task)
26555 int copy_thread(unsigned long clone_flags, unsigned long sp,
26556 unsigned long arg, struct task_struct *p)
26557 {
26558 - struct pt_regs *childregs = task_pt_regs(p);
26559 + struct pt_regs *childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
26560 struct task_struct *tsk;
26561 int err;
26562
26563 p->thread.sp = (unsigned long) childregs;
26564 p->thread.sp0 = (unsigned long) (childregs+1);
26565 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
26566
26567 if (unlikely(p->flags & PF_KTHREAD)) {
26568 /* kernel thread */
26569 memset(childregs, 0, sizeof(struct pt_regs));
26570 p->thread.ip = (unsigned long) ret_from_kernel_thread;
26571 - task_user_gs(p) = __KERNEL_STACK_CANARY;
26572 - childregs->ds = __USER_DS;
26573 - childregs->es = __USER_DS;
26574 + savesegment(gs, childregs->gs);
26575 + childregs->ds = __KERNEL_DS;
26576 + childregs->es = __KERNEL_DS;
26577 childregs->fs = __KERNEL_PERCPU;
26578 childregs->bx = sp; /* function */
26579 childregs->bp = arg;
26580 @@ -252,7 +253,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26581 struct thread_struct *prev = &prev_p->thread,
26582 *next = &next_p->thread;
26583 int cpu = smp_processor_id();
26584 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
26585 + struct tss_struct *tss = init_tss + cpu;
26586 fpu_switch_t fpu;
26587
26588 /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
26589 @@ -276,6 +277,10 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26590 */
26591 lazy_save_gs(prev->gs);
26592
26593 +#ifdef CONFIG_PAX_MEMORY_UDEREF
26594 + __set_fs(task_thread_info(next_p)->addr_limit);
26595 +#endif
26596 +
26597 /*
26598 * Load the per-thread Thread-Local Storage descriptor.
26599 */
26600 @@ -314,6 +319,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26601 */
26602 arch_end_context_switch(next_p);
26603
26604 + this_cpu_write(current_task, next_p);
26605 + this_cpu_write(current_tinfo, &next_p->tinfo);
26606 +
26607 /*
26608 * Restore %gs if needed (which is common)
26609 */
26610 @@ -322,8 +330,6 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26611
26612 switch_fpu_finish(next_p, fpu);
26613
26614 - this_cpu_write(current_task, next_p);
26615 -
26616 return prev_p;
26617 }
26618
26619 @@ -353,4 +359,3 @@ unsigned long get_wchan(struct task_struct *p)
26620 } while (count++ < 16);
26621 return 0;
26622 }
26623 -
26624 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
26625 index 9c0280f..5bbb1c0 100644
26626 --- a/arch/x86/kernel/process_64.c
26627 +++ b/arch/x86/kernel/process_64.c
26628 @@ -158,10 +158,11 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
26629 struct pt_regs *childregs;
26630 struct task_struct *me = current;
26631
26632 - p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE;
26633 + p->thread.sp0 = (unsigned long)task_stack_page(p) + THREAD_SIZE - 16;
26634 childregs = task_pt_regs(p);
26635 p->thread.sp = (unsigned long) childregs;
26636 p->thread.usersp = me->thread.usersp;
26637 + p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
26638 set_tsk_thread_flag(p, TIF_FORK);
26639 p->thread.fpu_counter = 0;
26640 p->thread.io_bitmap_ptr = NULL;
26641 @@ -172,6 +173,8 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
26642 p->thread.fs = p->thread.fsindex ? 0 : me->thread.fs;
26643 savesegment(es, p->thread.es);
26644 savesegment(ds, p->thread.ds);
26645 + savesegment(ss, p->thread.ss);
26646 + BUG_ON(p->thread.ss == __UDEREF_KERNEL_DS);
26647 memset(p->thread.ptrace_bps, 0, sizeof(p->thread.ptrace_bps));
26648
26649 if (unlikely(p->flags & PF_KTHREAD)) {
26650 @@ -280,7 +283,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26651 struct thread_struct *prev = &prev_p->thread;
26652 struct thread_struct *next = &next_p->thread;
26653 int cpu = smp_processor_id();
26654 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
26655 + struct tss_struct *tss = init_tss + cpu;
26656 unsigned fsindex, gsindex;
26657 fpu_switch_t fpu;
26658
26659 @@ -303,6 +306,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26660 if (unlikely(next->ds | prev->ds))
26661 loadsegment(ds, next->ds);
26662
26663 + savesegment(ss, prev->ss);
26664 + if (unlikely(next->ss != prev->ss))
26665 + loadsegment(ss, next->ss);
26666
26667 /* We must save %fs and %gs before load_TLS() because
26668 * %fs and %gs may be cleared by load_TLS().
26669 @@ -362,6 +368,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26670 prev->usersp = this_cpu_read(old_rsp);
26671 this_cpu_write(old_rsp, next->usersp);
26672 this_cpu_write(current_task, next_p);
26673 + this_cpu_write(current_tinfo, &next_p->tinfo);
26674
26675 /*
26676 * If it were not for PREEMPT_ACTIVE we could guarantee that the
26677 @@ -371,9 +378,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
26678 task_thread_info(prev_p)->saved_preempt_count = this_cpu_read(__preempt_count);
26679 this_cpu_write(__preempt_count, task_thread_info(next_p)->saved_preempt_count);
26680
26681 - this_cpu_write(kernel_stack,
26682 - (unsigned long)task_stack_page(next_p) +
26683 - THREAD_SIZE - KERNEL_STACK_OFFSET);
26684 + this_cpu_write(kernel_stack, next->sp0);
26685
26686 /*
26687 * Now maybe reload the debug registers and handle I/O bitmaps
26688 @@ -442,12 +447,11 @@ unsigned long get_wchan(struct task_struct *p)
26689 if (!p || p == current || p->state == TASK_RUNNING)
26690 return 0;
26691 stack = (unsigned long)task_stack_page(p);
26692 - if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
26693 + if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
26694 return 0;
26695 fp = *(u64 *)(p->thread.sp);
26696 do {
26697 - if (fp < (unsigned long)stack ||
26698 - fp >= (unsigned long)stack+THREAD_SIZE)
26699 + if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
26700 return 0;
26701 ip = *(u64 *)(fp+8);
26702 if (!in_sched_functions(ip))
26703 diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
26704 index 7461f50..1334029 100644
26705 --- a/arch/x86/kernel/ptrace.c
26706 +++ b/arch/x86/kernel/ptrace.c
26707 @@ -184,14 +184,13 @@ unsigned long kernel_stack_pointer(struct pt_regs *regs)
26708 {
26709 unsigned long context = (unsigned long)regs & ~(THREAD_SIZE - 1);
26710 unsigned long sp = (unsigned long)&regs->sp;
26711 - struct thread_info *tinfo;
26712
26713 - if (context == (sp & ~(THREAD_SIZE - 1)))
26714 + if (context == ((sp + 8) & ~(THREAD_SIZE - 1)))
26715 return sp;
26716
26717 - tinfo = (struct thread_info *)context;
26718 - if (tinfo->previous_esp)
26719 - return tinfo->previous_esp;
26720 + sp = *(unsigned long *)context;
26721 + if (sp)
26722 + return sp;
26723
26724 return (unsigned long)regs;
26725 }
26726 @@ -588,7 +587,7 @@ static void ptrace_triggered(struct perf_event *bp,
26727 static unsigned long ptrace_get_dr7(struct perf_event *bp[])
26728 {
26729 int i;
26730 - int dr7 = 0;
26731 + unsigned long dr7 = 0;
26732 struct arch_hw_breakpoint *info;
26733
26734 for (i = 0; i < HBP_NUM; i++) {
26735 @@ -822,7 +821,7 @@ long arch_ptrace(struct task_struct *child, long request,
26736 unsigned long addr, unsigned long data)
26737 {
26738 int ret;
26739 - unsigned long __user *datap = (unsigned long __user *)data;
26740 + unsigned long __user *datap = (__force unsigned long __user *)data;
26741
26742 switch (request) {
26743 /* read the word at location addr in the USER area. */
26744 @@ -907,14 +906,14 @@ long arch_ptrace(struct task_struct *child, long request,
26745 if ((int) addr < 0)
26746 return -EIO;
26747 ret = do_get_thread_area(child, addr,
26748 - (struct user_desc __user *)data);
26749 + (__force struct user_desc __user *) data);
26750 break;
26751
26752 case PTRACE_SET_THREAD_AREA:
26753 if ((int) addr < 0)
26754 return -EIO;
26755 ret = do_set_thread_area(child, addr,
26756 - (struct user_desc __user *)data, 0);
26757 + (__force struct user_desc __user *) data, 0);
26758 break;
26759 #endif
26760
26761 @@ -1292,7 +1291,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
26762
26763 #ifdef CONFIG_X86_64
26764
26765 -static struct user_regset x86_64_regsets[] __read_mostly = {
26766 +static user_regset_no_const x86_64_regsets[] __read_only = {
26767 [REGSET_GENERAL] = {
26768 .core_note_type = NT_PRSTATUS,
26769 .n = sizeof(struct user_regs_struct) / sizeof(long),
26770 @@ -1333,7 +1332,7 @@ static const struct user_regset_view user_x86_64_view = {
26771 #endif /* CONFIG_X86_64 */
26772
26773 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
26774 -static struct user_regset x86_32_regsets[] __read_mostly = {
26775 +static user_regset_no_const x86_32_regsets[] __read_only = {
26776 [REGSET_GENERAL] = {
26777 .core_note_type = NT_PRSTATUS,
26778 .n = sizeof(struct user_regs_struct32) / sizeof(u32),
26779 @@ -1386,7 +1385,7 @@ static const struct user_regset_view user_x86_32_view = {
26780 */
26781 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
26782
26783 -void update_regset_xstate_info(unsigned int size, u64 xstate_mask)
26784 +void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
26785 {
26786 #ifdef CONFIG_X86_64
26787 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
26788 @@ -1421,7 +1420,7 @@ static void fill_sigtrap_info(struct task_struct *tsk,
26789 memset(info, 0, sizeof(*info));
26790 info->si_signo = SIGTRAP;
26791 info->si_code = si_code;
26792 - info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
26793 + info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
26794 }
26795
26796 void user_single_step_siginfo(struct task_struct *tsk,
26797 @@ -1450,6 +1449,10 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
26798 # define IS_IA32 0
26799 #endif
26800
26801 +#ifdef CONFIG_GRKERNSEC_SETXID
26802 +extern void gr_delayed_cred_worker(void);
26803 +#endif
26804 +
26805 /*
26806 * We must return the syscall number to actually look up in the table.
26807 * This can be -1L to skip running any syscall at all.
26808 @@ -1460,6 +1463,11 @@ long syscall_trace_enter(struct pt_regs *regs)
26809
26810 user_exit();
26811
26812 +#ifdef CONFIG_GRKERNSEC_SETXID
26813 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
26814 + gr_delayed_cred_worker();
26815 +#endif
26816 +
26817 /*
26818 * If we stepped into a sysenter/syscall insn, it trapped in
26819 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP.
26820 @@ -1515,6 +1523,11 @@ void syscall_trace_leave(struct pt_regs *regs)
26821 */
26822 user_exit();
26823
26824 +#ifdef CONFIG_GRKERNSEC_SETXID
26825 + if (unlikely(test_and_clear_thread_flag(TIF_GRSEC_SETXID)))
26826 + gr_delayed_cred_worker();
26827 +#endif
26828 +
26829 audit_syscall_exit(regs);
26830
26831 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
26832 diff --git a/arch/x86/kernel/pvclock.c b/arch/x86/kernel/pvclock.c
26833 index 2f355d2..e75ed0a 100644
26834 --- a/arch/x86/kernel/pvclock.c
26835 +++ b/arch/x86/kernel/pvclock.c
26836 @@ -51,11 +51,11 @@ void pvclock_touch_watchdogs(void)
26837 reset_hung_task_detector();
26838 }
26839
26840 -static atomic64_t last_value = ATOMIC64_INIT(0);
26841 +static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
26842
26843 void pvclock_resume(void)
26844 {
26845 - atomic64_set(&last_value, 0);
26846 + atomic64_set_unchecked(&last_value, 0);
26847 }
26848
26849 u8 pvclock_read_flags(struct pvclock_vcpu_time_info *src)
26850 @@ -105,11 +105,11 @@ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
26851 * updating at the same time, and one of them could be slightly behind,
26852 * making the assumption that last_value always go forward fail to hold.
26853 */
26854 - last = atomic64_read(&last_value);
26855 + last = atomic64_read_unchecked(&last_value);
26856 do {
26857 if (ret < last)
26858 return last;
26859 - last = atomic64_cmpxchg(&last_value, last, ret);
26860 + last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
26861 } while (unlikely(last != ret));
26862
26863 return ret;
26864 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
26865 index c752cb4..866c432 100644
26866 --- a/arch/x86/kernel/reboot.c
26867 +++ b/arch/x86/kernel/reboot.c
26868 @@ -68,6 +68,11 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
26869
26870 void __noreturn machine_real_restart(unsigned int type)
26871 {
26872 +
26873 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF))
26874 + struct desc_struct *gdt;
26875 +#endif
26876 +
26877 local_irq_disable();
26878
26879 /*
26880 @@ -95,7 +100,29 @@ void __noreturn machine_real_restart(unsigned int type)
26881
26882 /* Jump to the identity-mapped low memory code */
26883 #ifdef CONFIG_X86_32
26884 - asm volatile("jmpl *%0" : :
26885 +
26886 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
26887 + gdt = get_cpu_gdt_table(smp_processor_id());
26888 + pax_open_kernel();
26889 +#ifdef CONFIG_PAX_MEMORY_UDEREF
26890 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
26891 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
26892 + loadsegment(ds, __KERNEL_DS);
26893 + loadsegment(es, __KERNEL_DS);
26894 + loadsegment(ss, __KERNEL_DS);
26895 +#endif
26896 +#ifdef CONFIG_PAX_KERNEXEC
26897 + gdt[GDT_ENTRY_KERNEL_CS].base0 = 0;
26898 + gdt[GDT_ENTRY_KERNEL_CS].base1 = 0;
26899 + gdt[GDT_ENTRY_KERNEL_CS].base2 = 0;
26900 + gdt[GDT_ENTRY_KERNEL_CS].limit0 = 0xffff;
26901 + gdt[GDT_ENTRY_KERNEL_CS].limit = 0xf;
26902 + gdt[GDT_ENTRY_KERNEL_CS].g = 1;
26903 +#endif
26904 + pax_close_kernel();
26905 +#endif
26906 +
26907 + asm volatile("ljmpl *%0" : :
26908 "rm" (real_mode_header->machine_real_restart_asm),
26909 "a" (type));
26910 #else
26911 @@ -470,7 +497,7 @@ void __attribute__((weak)) mach_reboot_fixups(void)
26912 * try to force a triple fault and then cycle between hitting the keyboard
26913 * controller and doing that
26914 */
26915 -static void native_machine_emergency_restart(void)
26916 +static void __noreturn native_machine_emergency_restart(void)
26917 {
26918 int i;
26919 int attempt = 0;
26920 @@ -593,13 +620,13 @@ void native_machine_shutdown(void)
26921 #endif
26922 }
26923
26924 -static void __machine_emergency_restart(int emergency)
26925 +static void __noreturn __machine_emergency_restart(int emergency)
26926 {
26927 reboot_emergency = emergency;
26928 machine_ops.emergency_restart();
26929 }
26930
26931 -static void native_machine_restart(char *__unused)
26932 +static void __noreturn native_machine_restart(char *__unused)
26933 {
26934 pr_notice("machine restart\n");
26935
26936 @@ -608,7 +635,7 @@ static void native_machine_restart(char *__unused)
26937 __machine_emergency_restart(0);
26938 }
26939
26940 -static void native_machine_halt(void)
26941 +static void __noreturn native_machine_halt(void)
26942 {
26943 /* Stop other cpus and apics */
26944 machine_shutdown();
26945 @@ -618,7 +645,7 @@ static void native_machine_halt(void)
26946 stop_this_cpu(NULL);
26947 }
26948
26949 -static void native_machine_power_off(void)
26950 +static void __noreturn native_machine_power_off(void)
26951 {
26952 if (pm_power_off) {
26953 if (!reboot_force)
26954 @@ -627,9 +654,10 @@ static void native_machine_power_off(void)
26955 }
26956 /* A fallback in case there is no PM info available */
26957 tboot_shutdown(TB_SHUTDOWN_HALT);
26958 + unreachable();
26959 }
26960
26961 -struct machine_ops machine_ops = {
26962 +struct machine_ops machine_ops __read_only = {
26963 .power_off = native_machine_power_off,
26964 .shutdown = native_machine_shutdown,
26965 .emergency_restart = native_machine_emergency_restart,
26966 diff --git a/arch/x86/kernel/reboot_fixups_32.c b/arch/x86/kernel/reboot_fixups_32.c
26967 index c8e41e9..64049ef 100644
26968 --- a/arch/x86/kernel/reboot_fixups_32.c
26969 +++ b/arch/x86/kernel/reboot_fixups_32.c
26970 @@ -57,7 +57,7 @@ struct device_fixup {
26971 unsigned int vendor;
26972 unsigned int device;
26973 void (*reboot_fixup)(struct pci_dev *);
26974 -};
26975 +} __do_const;
26976
26977 /*
26978 * PCI ids solely used for fixups_table go here
26979 diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
26980 index 3fd2c69..a444264 100644
26981 --- a/arch/x86/kernel/relocate_kernel_64.S
26982 +++ b/arch/x86/kernel/relocate_kernel_64.S
26983 @@ -96,8 +96,7 @@ relocate_kernel:
26984
26985 /* jump to identity mapped page */
26986 addq $(identity_mapped - relocate_kernel), %r8
26987 - pushq %r8
26988 - ret
26989 + jmp *%r8
26990
26991 identity_mapped:
26992 /* set return address to 0 if not preserving context */
26993 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
26994 index ce72964..be8aea7 100644
26995 --- a/arch/x86/kernel/setup.c
26996 +++ b/arch/x86/kernel/setup.c
26997 @@ -110,6 +110,7 @@
26998 #include <asm/mce.h>
26999 #include <asm/alternative.h>
27000 #include <asm/prom.h>
27001 +#include <asm/boot.h>
27002
27003 /*
27004 * max_low_pfn_mapped: highest direct mapped pfn under 4GB
27005 @@ -205,12 +206,50 @@ EXPORT_SYMBOL(boot_cpu_data);
27006 #endif
27007
27008
27009 -#if !defined(CONFIG_X86_PAE) || defined(CONFIG_X86_64)
27010 -__visible unsigned long mmu_cr4_features;
27011 +#ifdef CONFIG_X86_64
27012 +__visible unsigned long mmu_cr4_features __read_only = X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE;
27013 +#elif defined(CONFIG_X86_PAE)
27014 +__visible unsigned long mmu_cr4_features __read_only = X86_CR4_PAE;
27015 #else
27016 -__visible unsigned long mmu_cr4_features = X86_CR4_PAE;
27017 +__visible unsigned long mmu_cr4_features __read_only;
27018 #endif
27019
27020 +void set_in_cr4(unsigned long mask)
27021 +{
27022 + unsigned long cr4 = read_cr4();
27023 +
27024 + if ((cr4 & mask) == mask && cr4 == mmu_cr4_features)
27025 + return;
27026 +
27027 + pax_open_kernel();
27028 + mmu_cr4_features |= mask;
27029 + pax_close_kernel();
27030 +
27031 + if (trampoline_cr4_features)
27032 + *trampoline_cr4_features = mmu_cr4_features;
27033 + cr4 |= mask;
27034 + write_cr4(cr4);
27035 +}
27036 +EXPORT_SYMBOL(set_in_cr4);
27037 +
27038 +void clear_in_cr4(unsigned long mask)
27039 +{
27040 + unsigned long cr4 = read_cr4();
27041 +
27042 + if (!(cr4 & mask) && cr4 == mmu_cr4_features)
27043 + return;
27044 +
27045 + pax_open_kernel();
27046 + mmu_cr4_features &= ~mask;
27047 + pax_close_kernel();
27048 +
27049 + if (trampoline_cr4_features)
27050 + *trampoline_cr4_features = mmu_cr4_features;
27051 + cr4 &= ~mask;
27052 + write_cr4(cr4);
27053 +}
27054 +EXPORT_SYMBOL(clear_in_cr4);
27055 +
27056 /* Boot loader ID and version as integers, for the benefit of proc_dointvec */
27057 int bootloader_type, bootloader_version;
27058
27059 @@ -772,7 +811,7 @@ static void __init trim_bios_range(void)
27060 * area (640->1Mb) as ram even though it is not.
27061 * take them out.
27062 */
27063 - e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
27064 + e820_remove_range(ISA_START_ADDRESS, ISA_END_ADDRESS - ISA_START_ADDRESS, E820_RAM, 1);
27065
27066 sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
27067 }
27068 @@ -780,7 +819,7 @@ static void __init trim_bios_range(void)
27069 /* called before trim_bios_range() to spare extra sanitize */
27070 static void __init e820_add_kernel_range(void)
27071 {
27072 - u64 start = __pa_symbol(_text);
27073 + u64 start = __pa_symbol(ktla_ktva(_text));
27074 u64 size = __pa_symbol(_end) - start;
27075
27076 /*
27077 @@ -856,8 +895,12 @@ dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
27078
27079 void __init setup_arch(char **cmdline_p)
27080 {
27081 +#ifdef CONFIG_X86_32
27082 + memblock_reserve(LOAD_PHYSICAL_ADDR, __pa_symbol(__bss_stop) - LOAD_PHYSICAL_ADDR);
27083 +#else
27084 memblock_reserve(__pa_symbol(_text),
27085 (unsigned long)__bss_stop - (unsigned long)_text);
27086 +#endif
27087
27088 early_reserve_initrd();
27089
27090 @@ -947,14 +990,14 @@ void __init setup_arch(char **cmdline_p)
27091
27092 if (!boot_params.hdr.root_flags)
27093 root_mountflags &= ~MS_RDONLY;
27094 - init_mm.start_code = (unsigned long) _text;
27095 - init_mm.end_code = (unsigned long) _etext;
27096 + init_mm.start_code = ktla_ktva((unsigned long) _text);
27097 + init_mm.end_code = ktla_ktva((unsigned long) _etext);
27098 init_mm.end_data = (unsigned long) _edata;
27099 init_mm.brk = _brk_end;
27100
27101 - code_resource.start = __pa_symbol(_text);
27102 - code_resource.end = __pa_symbol(_etext)-1;
27103 - data_resource.start = __pa_symbol(_etext);
27104 + code_resource.start = __pa_symbol(ktla_ktva(_text));
27105 + code_resource.end = __pa_symbol(ktla_ktva(_etext))-1;
27106 + data_resource.start = __pa_symbol(_sdata);
27107 data_resource.end = __pa_symbol(_edata)-1;
27108 bss_resource.start = __pa_symbol(__bss_start);
27109 bss_resource.end = __pa_symbol(__bss_stop)-1;
27110 diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
27111 index 5cdff03..80fa283 100644
27112 --- a/arch/x86/kernel/setup_percpu.c
27113 +++ b/arch/x86/kernel/setup_percpu.c
27114 @@ -21,19 +21,17 @@
27115 #include <asm/cpu.h>
27116 #include <asm/stackprotector.h>
27117
27118 -DEFINE_PER_CPU_READ_MOSTLY(int, cpu_number);
27119 +#ifdef CONFIG_SMP
27120 +DEFINE_PER_CPU_READ_MOSTLY(unsigned int, cpu_number);
27121 EXPORT_PER_CPU_SYMBOL(cpu_number);
27122 +#endif
27123
27124 -#ifdef CONFIG_X86_64
27125 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
27126 -#else
27127 -#define BOOT_PERCPU_OFFSET 0
27128 -#endif
27129
27130 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
27131 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
27132
27133 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
27134 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
27135 [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
27136 };
27137 EXPORT_SYMBOL(__per_cpu_offset);
27138 @@ -66,7 +64,7 @@ static bool __init pcpu_need_numa(void)
27139 {
27140 #ifdef CONFIG_NEED_MULTIPLE_NODES
27141 pg_data_t *last = NULL;
27142 - unsigned int cpu;
27143 + int cpu;
27144
27145 for_each_possible_cpu(cpu) {
27146 int node = early_cpu_to_node(cpu);
27147 @@ -155,10 +153,10 @@ static inline void setup_percpu_segment(int cpu)
27148 {
27149 #ifdef CONFIG_X86_32
27150 struct desc_struct gdt;
27151 + unsigned long base = per_cpu_offset(cpu);
27152
27153 - pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
27154 - 0x2 | DESCTYPE_S, 0x8);
27155 - gdt.s = 1;
27156 + pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
27157 + 0x83 | DESCTYPE_S, 0xC);
27158 write_gdt_entry(get_cpu_gdt_table(cpu),
27159 GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
27160 #endif
27161 @@ -219,6 +217,11 @@ void __init setup_per_cpu_areas(void)
27162 /* alrighty, percpu areas up and running */
27163 delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
27164 for_each_possible_cpu(cpu) {
27165 +#ifdef CONFIG_CC_STACKPROTECTOR
27166 +#ifdef CONFIG_X86_32
27167 + unsigned long canary = per_cpu(stack_canary.canary, cpu);
27168 +#endif
27169 +#endif
27170 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
27171 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
27172 per_cpu(cpu_number, cpu) = cpu;
27173 @@ -259,6 +262,12 @@ void __init setup_per_cpu_areas(void)
27174 */
27175 set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
27176 #endif
27177 +#ifdef CONFIG_CC_STACKPROTECTOR
27178 +#ifdef CONFIG_X86_32
27179 + if (!cpu)
27180 + per_cpu(stack_canary.canary, cpu) = canary;
27181 +#endif
27182 +#endif
27183 /*
27184 * Up to this point, the boot CPU has been using .init.data
27185 * area. Reload any changed state for the boot CPU.
27186 diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
27187 index 9e5de68..16c53cb 100644
27188 --- a/arch/x86/kernel/signal.c
27189 +++ b/arch/x86/kernel/signal.c
27190 @@ -190,7 +190,7 @@ static unsigned long align_sigframe(unsigned long sp)
27191 * Align the stack pointer according to the i386 ABI,
27192 * i.e. so that on function entry ((sp + 4) & 15) == 0.
27193 */
27194 - sp = ((sp + 4) & -16ul) - 4;
27195 + sp = ((sp - 12) & -16ul) - 4;
27196 #else /* !CONFIG_X86_32 */
27197 sp = round_down(sp, 16) - 8;
27198 #endif
27199 @@ -298,9 +298,9 @@ __setup_frame(int sig, struct ksignal *ksig, sigset_t *set,
27200 }
27201
27202 if (current->mm->context.vdso)
27203 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
27204 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
27205 else
27206 - restorer = &frame->retcode;
27207 + restorer = (void __user *)&frame->retcode;
27208 if (ksig->ka.sa.sa_flags & SA_RESTORER)
27209 restorer = ksig->ka.sa.sa_restorer;
27210
27211 @@ -314,7 +314,7 @@ __setup_frame(int sig, struct ksignal *ksig, sigset_t *set,
27212 * reasons and because gdb uses it as a signature to notice
27213 * signal handler stack frames.
27214 */
27215 - err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
27216 + err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
27217
27218 if (err)
27219 return -EFAULT;
27220 @@ -361,7 +361,10 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
27221 save_altstack_ex(&frame->uc.uc_stack, regs->sp);
27222
27223 /* Set up to return from userspace. */
27224 - restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
27225 + if (current->mm->context.vdso)
27226 + restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
27227 + else
27228 + restorer = (void __user *)&frame->retcode;
27229 if (ksig->ka.sa.sa_flags & SA_RESTORER)
27230 restorer = ksig->ka.sa.sa_restorer;
27231 put_user_ex(restorer, &frame->pretcode);
27232 @@ -373,7 +376,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ksig,
27233 * reasons and because gdb uses it as a signature to notice
27234 * signal handler stack frames.
27235 */
27236 - put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
27237 + put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
27238 } put_user_catch(err);
27239
27240 err |= copy_siginfo_to_user(&frame->info, &ksig->info);
27241 @@ -609,7 +612,12 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
27242 {
27243 int usig = signr_convert(ksig->sig);
27244 sigset_t *set = sigmask_to_save();
27245 - compat_sigset_t *cset = (compat_sigset_t *) set;
27246 + sigset_t sigcopy;
27247 + compat_sigset_t *cset;
27248 +
27249 + sigcopy = *set;
27250 +
27251 + cset = (compat_sigset_t *) &sigcopy;
27252
27253 /* Set up the stack frame */
27254 if (is_ia32_frame()) {
27255 @@ -620,7 +628,7 @@ setup_rt_frame(struct ksignal *ksig, struct pt_regs *regs)
27256 } else if (is_x32_frame()) {
27257 return x32_setup_rt_frame(ksig, cset, regs);
27258 } else {
27259 - return __setup_rt_frame(ksig->sig, ksig, set, regs);
27260 + return __setup_rt_frame(ksig->sig, ksig, &sigcopy, regs);
27261 }
27262 }
27263
27264 diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
27265 index 7c3a5a6..f0a8961 100644
27266 --- a/arch/x86/kernel/smp.c
27267 +++ b/arch/x86/kernel/smp.c
27268 @@ -341,7 +341,7 @@ static int __init nonmi_ipi_setup(char *str)
27269
27270 __setup("nonmi_ipi", nonmi_ipi_setup);
27271
27272 -struct smp_ops smp_ops = {
27273 +struct smp_ops smp_ops __read_only = {
27274 .smp_prepare_boot_cpu = native_smp_prepare_boot_cpu,
27275 .smp_prepare_cpus = native_smp_prepare_cpus,
27276 .smp_cpus_done = native_smp_cpus_done,
27277 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
27278 index a32da80..30c97f1 100644
27279 --- a/arch/x86/kernel/smpboot.c
27280 +++ b/arch/x86/kernel/smpboot.c
27281 @@ -229,14 +229,18 @@ static void notrace start_secondary(void *unused)
27282
27283 enable_start_cpu0 = 0;
27284
27285 -#ifdef CONFIG_X86_32
27286 - /* switch away from the initial page table */
27287 - load_cr3(swapper_pg_dir);
27288 - __flush_tlb_all();
27289 -#endif
27290 -
27291 /* otherwise gcc will move up smp_processor_id before the cpu_init */
27292 barrier();
27293 +
27294 + /* switch away from the initial page table */
27295 +#ifdef CONFIG_PAX_PER_CPU_PGD
27296 + load_cr3(get_cpu_pgd(smp_processor_id(), kernel));
27297 + __flush_tlb_all();
27298 +#elif defined(CONFIG_X86_32)
27299 + load_cr3(swapper_pg_dir);
27300 + __flush_tlb_all();
27301 +#endif
27302 +
27303 /*
27304 * Check TSC synchronization with the BP:
27305 */
27306 @@ -749,8 +753,9 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
27307 alternatives_enable_smp();
27308
27309 idle->thread.sp = (unsigned long) (((struct pt_regs *)
27310 - (THREAD_SIZE + task_stack_page(idle))) - 1);
27311 + (THREAD_SIZE - 16 + task_stack_page(idle))) - 1);
27312 per_cpu(current_task, cpu) = idle;
27313 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
27314
27315 #ifdef CONFIG_X86_32
27316 /* Stack for startup_32 can be just as for start_secondary onwards */
27317 @@ -758,11 +763,13 @@ static int do_boot_cpu(int apicid, int cpu, struct task_struct *idle)
27318 #else
27319 clear_tsk_thread_flag(idle, TIF_FORK);
27320 initial_gs = per_cpu_offset(cpu);
27321 - per_cpu(kernel_stack, cpu) =
27322 - (unsigned long)task_stack_page(idle) -
27323 - KERNEL_STACK_OFFSET + THREAD_SIZE;
27324 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
27325 #endif
27326 +
27327 + pax_open_kernel();
27328 early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
27329 + pax_close_kernel();
27330 +
27331 initial_code = (unsigned long)start_secondary;
27332 stack_start = idle->thread.sp;
27333
27334 @@ -911,6 +918,15 @@ int native_cpu_up(unsigned int cpu, struct task_struct *tidle)
27335 /* the FPU context is blank, nobody can own it */
27336 __cpu_disable_lazy_restore(cpu);
27337
27338 +#ifdef CONFIG_PAX_PER_CPU_PGD
27339 + clone_pgd_range(get_cpu_pgd(cpu, kernel) + KERNEL_PGD_BOUNDARY,
27340 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
27341 + KERNEL_PGD_PTRS);
27342 + clone_pgd_range(get_cpu_pgd(cpu, user) + KERNEL_PGD_BOUNDARY,
27343 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
27344 + KERNEL_PGD_PTRS);
27345 +#endif
27346 +
27347 err = do_boot_cpu(apicid, cpu, tidle);
27348 if (err) {
27349 pr_debug("do_boot_cpu failed %d\n", err);
27350 diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
27351 index 9b4d51d..5d28b58 100644
27352 --- a/arch/x86/kernel/step.c
27353 +++ b/arch/x86/kernel/step.c
27354 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
27355 struct desc_struct *desc;
27356 unsigned long base;
27357
27358 - seg &= ~7UL;
27359 + seg >>= 3;
27360
27361 mutex_lock(&child->mm->context.lock);
27362 - if (unlikely((seg >> 3) >= child->mm->context.size))
27363 + if (unlikely(seg >= child->mm->context.size))
27364 addr = -1L; /* bogus selector, access would fault */
27365 else {
27366 desc = child->mm->context.ldt + seg;
27367 @@ -42,7 +42,8 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
27368 addr += base;
27369 }
27370 mutex_unlock(&child->mm->context.lock);
27371 - }
27372 + } else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
27373 + addr = ktla_ktva(addr);
27374
27375 return addr;
27376 }
27377 @@ -53,6 +54,9 @@ static int is_setting_trap_flag(struct task_struct *child, struct pt_regs *regs)
27378 unsigned char opcode[15];
27379 unsigned long addr = convert_ip_to_linear(child, regs);
27380
27381 + if (addr == -EINVAL)
27382 + return 0;
27383 +
27384 copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
27385 for (i = 0; i < copied; i++) {
27386 switch (opcode[i]) {
27387 diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
27388 new file mode 100644
27389 index 0000000..5877189
27390 --- /dev/null
27391 +++ b/arch/x86/kernel/sys_i386_32.c
27392 @@ -0,0 +1,189 @@
27393 +/*
27394 + * This file contains various random system calls that
27395 + * have a non-standard calling sequence on the Linux/i386
27396 + * platform.
27397 + */
27398 +
27399 +#include <linux/errno.h>
27400 +#include <linux/sched.h>
27401 +#include <linux/mm.h>
27402 +#include <linux/fs.h>
27403 +#include <linux/smp.h>
27404 +#include <linux/sem.h>
27405 +#include <linux/msg.h>
27406 +#include <linux/shm.h>
27407 +#include <linux/stat.h>
27408 +#include <linux/syscalls.h>
27409 +#include <linux/mman.h>
27410 +#include <linux/file.h>
27411 +#include <linux/utsname.h>
27412 +#include <linux/ipc.h>
27413 +#include <linux/elf.h>
27414 +
27415 +#include <linux/uaccess.h>
27416 +#include <linux/unistd.h>
27417 +
27418 +#include <asm/syscalls.h>
27419 +
27420 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
27421 +{
27422 + unsigned long pax_task_size = TASK_SIZE;
27423 +
27424 +#ifdef CONFIG_PAX_SEGMEXEC
27425 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
27426 + pax_task_size = SEGMEXEC_TASK_SIZE;
27427 +#endif
27428 +
27429 + if (flags & MAP_FIXED)
27430 + if (len > pax_task_size || addr > pax_task_size - len)
27431 + return -EINVAL;
27432 +
27433 + return 0;
27434 +}
27435 +
27436 +/*
27437 + * Align a virtual address to avoid aliasing in the I$ on AMD F15h.
27438 + */
27439 +static unsigned long get_align_mask(void)
27440 +{
27441 + if (va_align.flags < 0 || !(va_align.flags & ALIGN_VA_32))
27442 + return 0;
27443 +
27444 + if (!(current->flags & PF_RANDOMIZE))
27445 + return 0;
27446 +
27447 + return va_align.mask;
27448 +}
27449 +
27450 +unsigned long
27451 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
27452 + unsigned long len, unsigned long pgoff, unsigned long flags)
27453 +{
27454 + struct mm_struct *mm = current->mm;
27455 + struct vm_area_struct *vma;
27456 + unsigned long pax_task_size = TASK_SIZE;
27457 + struct vm_unmapped_area_info info;
27458 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
27459 +
27460 +#ifdef CONFIG_PAX_SEGMEXEC
27461 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
27462 + pax_task_size = SEGMEXEC_TASK_SIZE;
27463 +#endif
27464 +
27465 + pax_task_size -= PAGE_SIZE;
27466 +
27467 + if (len > pax_task_size)
27468 + return -ENOMEM;
27469 +
27470 + if (flags & MAP_FIXED)
27471 + return addr;
27472 +
27473 +#ifdef CONFIG_PAX_RANDMMAP
27474 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27475 +#endif
27476 +
27477 + if (addr) {
27478 + addr = PAGE_ALIGN(addr);
27479 + if (pax_task_size - len >= addr) {
27480 + vma = find_vma(mm, addr);
27481 + if (check_heap_stack_gap(vma, addr, len, offset))
27482 + return addr;
27483 + }
27484 + }
27485 +
27486 + info.flags = 0;
27487 + info.length = len;
27488 + info.align_mask = filp ? get_align_mask() : 0;
27489 + info.align_offset = pgoff << PAGE_SHIFT;
27490 + info.threadstack_offset = offset;
27491 +
27492 +#ifdef CONFIG_PAX_PAGEEXEC
27493 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE)) {
27494 + info.low_limit = 0x00110000UL;
27495 + info.high_limit = mm->start_code;
27496 +
27497 +#ifdef CONFIG_PAX_RANDMMAP
27498 + if (mm->pax_flags & MF_PAX_RANDMMAP)
27499 + info.low_limit += mm->delta_mmap & 0x03FFF000UL;
27500 +#endif
27501 +
27502 + if (info.low_limit < info.high_limit) {
27503 + addr = vm_unmapped_area(&info);
27504 + if (!IS_ERR_VALUE(addr))
27505 + return addr;
27506 + }
27507 + } else
27508 +#endif
27509 +
27510 + info.low_limit = mm->mmap_base;
27511 + info.high_limit = pax_task_size;
27512 +
27513 + return vm_unmapped_area(&info);
27514 +}
27515 +
27516 +unsigned long
27517 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
27518 + const unsigned long len, const unsigned long pgoff,
27519 + const unsigned long flags)
27520 +{
27521 + struct vm_area_struct *vma;
27522 + struct mm_struct *mm = current->mm;
27523 + unsigned long addr = addr0, pax_task_size = TASK_SIZE;
27524 + struct vm_unmapped_area_info info;
27525 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
27526 +
27527 +#ifdef CONFIG_PAX_SEGMEXEC
27528 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
27529 + pax_task_size = SEGMEXEC_TASK_SIZE;
27530 +#endif
27531 +
27532 + pax_task_size -= PAGE_SIZE;
27533 +
27534 + /* requested length too big for entire address space */
27535 + if (len > pax_task_size)
27536 + return -ENOMEM;
27537 +
27538 + if (flags & MAP_FIXED)
27539 + return addr;
27540 +
27541 +#ifdef CONFIG_PAX_PAGEEXEC
27542 + if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
27543 + goto bottomup;
27544 +#endif
27545 +
27546 +#ifdef CONFIG_PAX_RANDMMAP
27547 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27548 +#endif
27549 +
27550 + /* requesting a specific address */
27551 + if (addr) {
27552 + addr = PAGE_ALIGN(addr);
27553 + if (pax_task_size - len >= addr) {
27554 + vma = find_vma(mm, addr);
27555 + if (check_heap_stack_gap(vma, addr, len, offset))
27556 + return addr;
27557 + }
27558 + }
27559 +
27560 + info.flags = VM_UNMAPPED_AREA_TOPDOWN;
27561 + info.length = len;
27562 + info.low_limit = PAGE_SIZE;
27563 + info.high_limit = mm->mmap_base;
27564 + info.align_mask = filp ? get_align_mask() : 0;
27565 + info.align_offset = pgoff << PAGE_SHIFT;
27566 + info.threadstack_offset = offset;
27567 +
27568 + addr = vm_unmapped_area(&info);
27569 + if (!(addr & ~PAGE_MASK))
27570 + return addr;
27571 + VM_BUG_ON(addr != -ENOMEM);
27572 +
27573 +bottomup:
27574 + /*
27575 + * A failed mmap() very likely causes application failure,
27576 + * so fall back to the bottom-up function here. This scenario
27577 + * can happen with large stack limits and large mmap()
27578 + * allocations.
27579 + */
27580 + return arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
27581 +}
27582 diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
27583 index 30277e2..5664a29 100644
27584 --- a/arch/x86/kernel/sys_x86_64.c
27585 +++ b/arch/x86/kernel/sys_x86_64.c
27586 @@ -81,8 +81,8 @@ out:
27587 return error;
27588 }
27589
27590 -static void find_start_end(unsigned long flags, unsigned long *begin,
27591 - unsigned long *end)
27592 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
27593 + unsigned long *begin, unsigned long *end)
27594 {
27595 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) {
27596 unsigned long new_begin;
27597 @@ -101,7 +101,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
27598 *begin = new_begin;
27599 }
27600 } else {
27601 - *begin = current->mm->mmap_legacy_base;
27602 + *begin = mm->mmap_legacy_base;
27603 *end = TASK_SIZE;
27604 }
27605 }
27606 @@ -114,20 +114,24 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
27607 struct vm_area_struct *vma;
27608 struct vm_unmapped_area_info info;
27609 unsigned long begin, end;
27610 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
27611
27612 if (flags & MAP_FIXED)
27613 return addr;
27614
27615 - find_start_end(flags, &begin, &end);
27616 + find_start_end(mm, flags, &begin, &end);
27617
27618 if (len > end)
27619 return -ENOMEM;
27620
27621 +#ifdef CONFIG_PAX_RANDMMAP
27622 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27623 +#endif
27624 +
27625 if (addr) {
27626 addr = PAGE_ALIGN(addr);
27627 vma = find_vma(mm, addr);
27628 - if (end - len >= addr &&
27629 - (!vma || addr + len <= vma->vm_start))
27630 + if (end - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
27631 return addr;
27632 }
27633
27634 @@ -137,6 +141,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
27635 info.high_limit = end;
27636 info.align_mask = filp ? get_align_mask() : 0;
27637 info.align_offset = pgoff << PAGE_SHIFT;
27638 + info.threadstack_offset = offset;
27639 return vm_unmapped_area(&info);
27640 }
27641
27642 @@ -149,6 +154,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
27643 struct mm_struct *mm = current->mm;
27644 unsigned long addr = addr0;
27645 struct vm_unmapped_area_info info;
27646 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
27647
27648 /* requested length too big for entire address space */
27649 if (len > TASK_SIZE)
27650 @@ -161,12 +167,15 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
27651 if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT))
27652 goto bottomup;
27653
27654 +#ifdef CONFIG_PAX_RANDMMAP
27655 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
27656 +#endif
27657 +
27658 /* requesting a specific address */
27659 if (addr) {
27660 addr = PAGE_ALIGN(addr);
27661 vma = find_vma(mm, addr);
27662 - if (TASK_SIZE - len >= addr &&
27663 - (!vma || addr + len <= vma->vm_start))
27664 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
27665 return addr;
27666 }
27667
27668 @@ -176,6 +185,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
27669 info.high_limit = mm->mmap_base;
27670 info.align_mask = filp ? get_align_mask() : 0;
27671 info.align_offset = pgoff << PAGE_SHIFT;
27672 + info.threadstack_offset = offset;
27673 addr = vm_unmapped_area(&info);
27674 if (!(addr & ~PAGE_MASK))
27675 return addr;
27676 diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
27677 index 91a4496..bb87552 100644
27678 --- a/arch/x86/kernel/tboot.c
27679 +++ b/arch/x86/kernel/tboot.c
27680 @@ -221,7 +221,7 @@ static int tboot_setup_sleep(void)
27681
27682 void tboot_shutdown(u32 shutdown_type)
27683 {
27684 - void (*shutdown)(void);
27685 + void (* __noreturn shutdown)(void);
27686
27687 if (!tboot_enabled())
27688 return;
27689 @@ -243,7 +243,7 @@ void tboot_shutdown(u32 shutdown_type)
27690
27691 switch_to_tboot_pt();
27692
27693 - shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
27694 + shutdown = (void *)(unsigned long)tboot->shutdown_entry;
27695 shutdown();
27696
27697 /* should not reach here */
27698 @@ -310,7 +310,7 @@ static int tboot_extended_sleep(u8 sleep_state, u32 val_a, u32 val_b)
27699 return -ENODEV;
27700 }
27701
27702 -static atomic_t ap_wfs_count;
27703 +static atomic_unchecked_t ap_wfs_count;
27704
27705 static int tboot_wait_for_aps(int num_aps)
27706 {
27707 @@ -334,9 +334,9 @@ static int tboot_cpu_callback(struct notifier_block *nfb, unsigned long action,
27708 {
27709 switch (action) {
27710 case CPU_DYING:
27711 - atomic_inc(&ap_wfs_count);
27712 + atomic_inc_unchecked(&ap_wfs_count);
27713 if (num_online_cpus() == 1)
27714 - if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
27715 + if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
27716 return NOTIFY_BAD;
27717 break;
27718 }
27719 @@ -422,7 +422,7 @@ static __init int tboot_late_init(void)
27720
27721 tboot_create_trampoline();
27722
27723 - atomic_set(&ap_wfs_count, 0);
27724 + atomic_set_unchecked(&ap_wfs_count, 0);
27725 register_hotcpu_notifier(&tboot_cpu_notifier);
27726
27727 #ifdef CONFIG_DEBUG_FS
27728 diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c
27729 index 24d3c91..d06b473 100644
27730 --- a/arch/x86/kernel/time.c
27731 +++ b/arch/x86/kernel/time.c
27732 @@ -30,9 +30,9 @@ unsigned long profile_pc(struct pt_regs *regs)
27733 {
27734 unsigned long pc = instruction_pointer(regs);
27735
27736 - if (!user_mode_vm(regs) && in_lock_functions(pc)) {
27737 + if (!user_mode(regs) && in_lock_functions(pc)) {
27738 #ifdef CONFIG_FRAME_POINTER
27739 - return *(unsigned long *)(regs->bp + sizeof(long));
27740 + return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
27741 #else
27742 unsigned long *sp =
27743 (unsigned long *)kernel_stack_pointer(regs);
27744 @@ -41,11 +41,17 @@ unsigned long profile_pc(struct pt_regs *regs)
27745 * or above a saved flags. Eflags has bits 22-31 zero,
27746 * kernel addresses don't.
27747 */
27748 +
27749 +#ifdef CONFIG_PAX_KERNEXEC
27750 + return ktla_ktva(sp[0]);
27751 +#else
27752 if (sp[0] >> 22)
27753 return sp[0];
27754 if (sp[1] >> 22)
27755 return sp[1];
27756 #endif
27757 +
27758 +#endif
27759 }
27760 return pc;
27761 }
27762 diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
27763 index f7fec09..9991981 100644
27764 --- a/arch/x86/kernel/tls.c
27765 +++ b/arch/x86/kernel/tls.c
27766 @@ -84,6 +84,11 @@ int do_set_thread_area(struct task_struct *p, int idx,
27767 if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
27768 return -EINVAL;
27769
27770 +#ifdef CONFIG_PAX_SEGMEXEC
27771 + if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
27772 + return -EINVAL;
27773 +#endif
27774 +
27775 set_tls_desc(p, idx, &info, 1);
27776
27777 return 0;
27778 @@ -200,7 +205,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
27779
27780 if (kbuf)
27781 info = kbuf;
27782 - else if (__copy_from_user(infobuf, ubuf, count))
27783 + else if (count > sizeof infobuf || __copy_from_user(infobuf, ubuf, count))
27784 return -EFAULT;
27785 else
27786 info = infobuf;
27787 diff --git a/arch/x86/kernel/tracepoint.c b/arch/x86/kernel/tracepoint.c
27788 index 1c113db..287b42e 100644
27789 --- a/arch/x86/kernel/tracepoint.c
27790 +++ b/arch/x86/kernel/tracepoint.c
27791 @@ -9,11 +9,11 @@
27792 #include <linux/atomic.h>
27793
27794 atomic_t trace_idt_ctr = ATOMIC_INIT(0);
27795 -struct desc_ptr trace_idt_descr = { NR_VECTORS * 16 - 1,
27796 +const struct desc_ptr trace_idt_descr = { NR_VECTORS * 16 - 1,
27797 (unsigned long) trace_idt_table };
27798
27799 /* No need to be aligned, but done to keep all IDTs defined the same way. */
27800 -gate_desc trace_idt_table[NR_VECTORS] __page_aligned_bss;
27801 +gate_desc trace_idt_table[NR_VECTORS] __page_aligned_rodata;
27802
27803 static int trace_irq_vector_refcount;
27804 static DEFINE_MUTEX(irq_vector_mutex);
27805 diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
27806 index 57409f6..b505597 100644
27807 --- a/arch/x86/kernel/traps.c
27808 +++ b/arch/x86/kernel/traps.c
27809 @@ -66,7 +66,7 @@
27810 #include <asm/proto.h>
27811
27812 /* No need to be aligned, but done to keep all IDTs defined the same way. */
27813 -gate_desc debug_idt_table[NR_VECTORS] __page_aligned_bss;
27814 +gate_desc debug_idt_table[NR_VECTORS] __page_aligned_rodata;
27815 #else
27816 #include <asm/processor-flags.h>
27817 #include <asm/setup.h>
27818 @@ -75,7 +75,7 @@ asmlinkage int system_call(void);
27819 #endif
27820
27821 /* Must be page-aligned because the real IDT is used in a fixmap. */
27822 -gate_desc idt_table[NR_VECTORS] __page_aligned_bss;
27823 +gate_desc idt_table[NR_VECTORS] __page_aligned_rodata;
27824
27825 DECLARE_BITMAP(used_vectors, NR_VECTORS);
27826 EXPORT_SYMBOL_GPL(used_vectors);
27827 @@ -107,11 +107,11 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
27828 }
27829
27830 static int __kprobes
27831 -do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
27832 +do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
27833 struct pt_regs *regs, long error_code)
27834 {
27835 #ifdef CONFIG_X86_32
27836 - if (regs->flags & X86_VM_MASK) {
27837 + if (v8086_mode(regs)) {
27838 /*
27839 * Traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
27840 * On nmi (interrupt 2), do_trap should not be called.
27841 @@ -124,12 +124,24 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
27842 return -1;
27843 }
27844 #endif
27845 - if (!user_mode(regs)) {
27846 + if (!user_mode_novm(regs)) {
27847 if (!fixup_exception(regs)) {
27848 tsk->thread.error_code = error_code;
27849 tsk->thread.trap_nr = trapnr;
27850 +
27851 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
27852 + if (trapnr == X86_TRAP_SS && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
27853 + str = "PAX: suspicious stack segment fault";
27854 +#endif
27855 +
27856 die(str, regs, error_code);
27857 }
27858 +
27859 +#ifdef CONFIG_PAX_REFCOUNT
27860 + if (trapnr == X86_TRAP_OF)
27861 + pax_report_refcount_overflow(regs);
27862 +#endif
27863 +
27864 return 0;
27865 }
27866
27867 @@ -137,7 +149,7 @@ do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
27868 }
27869
27870 static void __kprobes
27871 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
27872 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
27873 long error_code, siginfo_t *info)
27874 {
27875 struct task_struct *tsk = current;
27876 @@ -161,7 +173,7 @@ do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
27877 if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
27878 printk_ratelimit()) {
27879 pr_info("%s[%d] trap %s ip:%lx sp:%lx error:%lx",
27880 - tsk->comm, tsk->pid, str,
27881 + tsk->comm, task_pid_nr(tsk), str,
27882 regs->ip, regs->sp, error_code);
27883 print_vma_addr(" in ", regs->ip);
27884 pr_cont("\n");
27885 @@ -251,6 +263,11 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
27886 tsk->thread.error_code = error_code;
27887 tsk->thread.trap_nr = X86_TRAP_DF;
27888
27889 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
27890 + if ((unsigned long)tsk->stack - regs->sp <= PAGE_SIZE)
27891 + die("grsec: kernel stack overflow detected", regs, error_code);
27892 +#endif
27893 +
27894 #ifdef CONFIG_DOUBLEFAULT
27895 df_debug(regs, error_code);
27896 #endif
27897 @@ -273,7 +290,7 @@ do_general_protection(struct pt_regs *regs, long error_code)
27898 conditional_sti(regs);
27899
27900 #ifdef CONFIG_X86_32
27901 - if (regs->flags & X86_VM_MASK) {
27902 + if (v8086_mode(regs)) {
27903 local_irq_enable();
27904 handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
27905 goto exit;
27906 @@ -281,18 +298,42 @@ do_general_protection(struct pt_regs *regs, long error_code)
27907 #endif
27908
27909 tsk = current;
27910 - if (!user_mode(regs)) {
27911 + if (!user_mode_novm(regs)) {
27912 if (fixup_exception(regs))
27913 goto exit;
27914
27915 tsk->thread.error_code = error_code;
27916 tsk->thread.trap_nr = X86_TRAP_GP;
27917 if (notify_die(DIE_GPF, "general protection fault", regs, error_code,
27918 - X86_TRAP_GP, SIGSEGV) != NOTIFY_STOP)
27919 + X86_TRAP_GP, SIGSEGV) != NOTIFY_STOP) {
27920 +
27921 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
27922 + if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
27923 + die("PAX: suspicious general protection fault", regs, error_code);
27924 + else
27925 +#endif
27926 +
27927 die("general protection fault", regs, error_code);
27928 + }
27929 goto exit;
27930 }
27931
27932 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
27933 + if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
27934 + struct mm_struct *mm = tsk->mm;
27935 + unsigned long limit;
27936 +
27937 + down_write(&mm->mmap_sem);
27938 + limit = mm->context.user_cs_limit;
27939 + if (limit < TASK_SIZE) {
27940 + track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
27941 + up_write(&mm->mmap_sem);
27942 + return;
27943 + }
27944 + up_write(&mm->mmap_sem);
27945 + }
27946 +#endif
27947 +
27948 tsk->thread.error_code = error_code;
27949 tsk->thread.trap_nr = X86_TRAP_GP;
27950
27951 @@ -453,7 +494,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
27952 /* It's safe to allow irq's after DR6 has been saved */
27953 preempt_conditional_sti(regs);
27954
27955 - if (regs->flags & X86_VM_MASK) {
27956 + if (v8086_mode(regs)) {
27957 handle_vm86_trap((struct kernel_vm86_regs *) regs, error_code,
27958 X86_TRAP_DB);
27959 preempt_conditional_cli(regs);
27960 @@ -468,7 +509,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
27961 * We already checked v86 mode above, so we can check for kernel mode
27962 * by just checking the CPL of CS.
27963 */
27964 - if ((dr6 & DR_STEP) && !user_mode(regs)) {
27965 + if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
27966 tsk->thread.debugreg6 &= ~DR_STEP;
27967 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
27968 regs->flags &= ~X86_EFLAGS_TF;
27969 @@ -500,7 +541,7 @@ void math_error(struct pt_regs *regs, int error_code, int trapnr)
27970 return;
27971 conditional_sti(regs);
27972
27973 - if (!user_mode_vm(regs))
27974 + if (!user_mode(regs))
27975 {
27976 if (!fixup_exception(regs)) {
27977 task->thread.error_code = error_code;
27978 diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
27979 index cfbe99f..a6e8fa7 100644
27980 --- a/arch/x86/kernel/tsc.c
27981 +++ b/arch/x86/kernel/tsc.c
27982 @@ -150,7 +150,7 @@ static void cyc2ns_write_end(int cpu, struct cyc2ns_data *data)
27983 */
27984 smp_wmb();
27985
27986 - ACCESS_ONCE(c2n->head) = data;
27987 + ACCESS_ONCE_RW(c2n->head) = data;
27988 }
27989
27990 /*
27991 diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
27992 index 2ed8459..7cf329f 100644
27993 --- a/arch/x86/kernel/uprobes.c
27994 +++ b/arch/x86/kernel/uprobes.c
27995 @@ -629,7 +629,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self, unsigned long val,
27996 int ret = NOTIFY_DONE;
27997
27998 /* We are only interested in userspace traps */
27999 - if (regs && !user_mode_vm(regs))
28000 + if (regs && !user_mode(regs))
28001 return NOTIFY_DONE;
28002
28003 switch (val) {
28004 @@ -719,7 +719,7 @@ arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs
28005
28006 if (ncopied != rasize) {
28007 pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
28008 - "%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
28009 + "%%ip=%#lx\n", task_pid_nr(current), regs->sp, regs->ip);
28010
28011 force_sig_info(SIGSEGV, SEND_SIG_FORCED, current);
28012 }
28013 diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
28014 index b9242ba..50c5edd 100644
28015 --- a/arch/x86/kernel/verify_cpu.S
28016 +++ b/arch/x86/kernel/verify_cpu.S
28017 @@ -20,6 +20,7 @@
28018 * arch/x86/boot/compressed/head_64.S: Boot cpu verification
28019 * arch/x86/kernel/trampoline_64.S: secondary processor verification
28020 * arch/x86/kernel/head_32.S: processor startup
28021 + * arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
28022 *
28023 * verify_cpu, returns the status of longmode and SSE in register %eax.
28024 * 0: Success 1: Failure
28025 diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
28026 index e8edcf5..27f9344 100644
28027 --- a/arch/x86/kernel/vm86_32.c
28028 +++ b/arch/x86/kernel/vm86_32.c
28029 @@ -44,6 +44,7 @@
28030 #include <linux/ptrace.h>
28031 #include <linux/audit.h>
28032 #include <linux/stddef.h>
28033 +#include <linux/grsecurity.h>
28034
28035 #include <asm/uaccess.h>
28036 #include <asm/io.h>
28037 @@ -150,7 +151,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
28038 do_exit(SIGSEGV);
28039 }
28040
28041 - tss = &per_cpu(init_tss, get_cpu());
28042 + tss = init_tss + get_cpu();
28043 current->thread.sp0 = current->thread.saved_sp0;
28044 current->thread.sysenter_cs = __KERNEL_CS;
28045 load_sp0(tss, &current->thread);
28046 @@ -214,6 +215,14 @@ SYSCALL_DEFINE1(vm86old, struct vm86_struct __user *, v86)
28047
28048 if (tsk->thread.saved_sp0)
28049 return -EPERM;
28050 +
28051 +#ifdef CONFIG_GRKERNSEC_VM86
28052 + if (!capable(CAP_SYS_RAWIO)) {
28053 + gr_handle_vm86();
28054 + return -EPERM;
28055 + }
28056 +#endif
28057 +
28058 tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
28059 offsetof(struct kernel_vm86_struct, vm86plus) -
28060 sizeof(info.regs));
28061 @@ -238,6 +247,13 @@ SYSCALL_DEFINE2(vm86, unsigned long, cmd, unsigned long, arg)
28062 int tmp;
28063 struct vm86plus_struct __user *v86;
28064
28065 +#ifdef CONFIG_GRKERNSEC_VM86
28066 + if (!capable(CAP_SYS_RAWIO)) {
28067 + gr_handle_vm86();
28068 + return -EPERM;
28069 + }
28070 +#endif
28071 +
28072 tsk = current;
28073 switch (cmd) {
28074 case VM86_REQUEST_IRQ:
28075 @@ -318,7 +334,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
28076 tsk->thread.saved_fs = info->regs32->fs;
28077 tsk->thread.saved_gs = get_user_gs(info->regs32);
28078
28079 - tss = &per_cpu(init_tss, get_cpu());
28080 + tss = init_tss + get_cpu();
28081 tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
28082 if (cpu_has_sep)
28083 tsk->thread.sysenter_cs = 0;
28084 @@ -525,7 +541,7 @@ static void do_int(struct kernel_vm86_regs *regs, int i,
28085 goto cannot_handle;
28086 if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
28087 goto cannot_handle;
28088 - intr_ptr = (unsigned long __user *) (i << 2);
28089 + intr_ptr = (__force unsigned long __user *) (i << 2);
28090 if (get_user(segoffs, intr_ptr))
28091 goto cannot_handle;
28092 if ((segoffs >> 16) == BIOSSEG)
28093 diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
28094 index da6b35a..977e9cf 100644
28095 --- a/arch/x86/kernel/vmlinux.lds.S
28096 +++ b/arch/x86/kernel/vmlinux.lds.S
28097 @@ -26,6 +26,13 @@
28098 #include <asm/page_types.h>
28099 #include <asm/cache.h>
28100 #include <asm/boot.h>
28101 +#include <asm/segment.h>
28102 +
28103 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28104 +#define __KERNEL_TEXT_OFFSET (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
28105 +#else
28106 +#define __KERNEL_TEXT_OFFSET 0
28107 +#endif
28108
28109 #undef i386 /* in case the preprocessor is a 32bit one */
28110
28111 @@ -69,30 +76,43 @@ jiffies_64 = jiffies;
28112
28113 PHDRS {
28114 text PT_LOAD FLAGS(5); /* R_E */
28115 +#ifdef CONFIG_X86_32
28116 + module PT_LOAD FLAGS(5); /* R_E */
28117 +#endif
28118 +#ifdef CONFIG_XEN
28119 + rodata PT_LOAD FLAGS(5); /* R_E */
28120 +#else
28121 + rodata PT_LOAD FLAGS(4); /* R__ */
28122 +#endif
28123 data PT_LOAD FLAGS(6); /* RW_ */
28124 -#ifdef CONFIG_X86_64
28125 + init.begin PT_LOAD FLAGS(6); /* RW_ */
28126 #ifdef CONFIG_SMP
28127 percpu PT_LOAD FLAGS(6); /* RW_ */
28128 #endif
28129 + text.init PT_LOAD FLAGS(5); /* R_E */
28130 + text.exit PT_LOAD FLAGS(5); /* R_E */
28131 init PT_LOAD FLAGS(7); /* RWE */
28132 -#endif
28133 note PT_NOTE FLAGS(0); /* ___ */
28134 }
28135
28136 SECTIONS
28137 {
28138 #ifdef CONFIG_X86_32
28139 - . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
28140 - phys_startup_32 = startup_32 - LOAD_OFFSET;
28141 + . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
28142 #else
28143 - . = __START_KERNEL;
28144 - phys_startup_64 = startup_64 - LOAD_OFFSET;
28145 + . = __START_KERNEL;
28146 #endif
28147
28148 /* Text and read-only data */
28149 - .text : AT(ADDR(.text) - LOAD_OFFSET) {
28150 - _text = .;
28151 + .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
28152 /* bootstrapping code */
28153 +#ifdef CONFIG_X86_32
28154 + phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28155 +#else
28156 + phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28157 +#endif
28158 + __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
28159 + _text = .;
28160 HEAD_TEXT
28161 . = ALIGN(8);
28162 _stext = .;
28163 @@ -104,13 +124,47 @@ SECTIONS
28164 IRQENTRY_TEXT
28165 *(.fixup)
28166 *(.gnu.warning)
28167 - /* End of text section */
28168 - _etext = .;
28169 } :text = 0x9090
28170
28171 - NOTES :text :note
28172 + . += __KERNEL_TEXT_OFFSET;
28173
28174 - EXCEPTION_TABLE(16) :text = 0x9090
28175 +#ifdef CONFIG_X86_32
28176 + . = ALIGN(PAGE_SIZE);
28177 + .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
28178 +
28179 +#ifdef CONFIG_PAX_KERNEXEC
28180 + MODULES_EXEC_VADDR = .;
28181 + BYTE(0)
28182 + . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
28183 + . = ALIGN(HPAGE_SIZE) - 1;
28184 + MODULES_EXEC_END = .;
28185 +#endif
28186 +
28187 + } :module
28188 +#endif
28189 +
28190 + .text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
28191 + /* End of text section */
28192 + BYTE(0)
28193 + _etext = . - __KERNEL_TEXT_OFFSET;
28194 + }
28195 +
28196 +#ifdef CONFIG_X86_32
28197 + . = ALIGN(PAGE_SIZE);
28198 + .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
28199 + . = ALIGN(PAGE_SIZE);
28200 + *(.empty_zero_page)
28201 + *(.initial_pg_fixmap)
28202 + *(.initial_pg_pmd)
28203 + *(.initial_page_table)
28204 + *(.swapper_pg_dir)
28205 + } :rodata
28206 +#endif
28207 +
28208 + . = ALIGN(PAGE_SIZE);
28209 + NOTES :rodata :note
28210 +
28211 + EXCEPTION_TABLE(16) :rodata
28212
28213 #if defined(CONFIG_DEBUG_RODATA)
28214 /* .text should occupy whole number of pages */
28215 @@ -122,16 +176,20 @@ SECTIONS
28216
28217 /* Data */
28218 .data : AT(ADDR(.data) - LOAD_OFFSET) {
28219 +
28220 +#ifdef CONFIG_PAX_KERNEXEC
28221 + . = ALIGN(HPAGE_SIZE);
28222 +#else
28223 + . = ALIGN(PAGE_SIZE);
28224 +#endif
28225 +
28226 /* Start of data section */
28227 _sdata = .;
28228
28229 /* init_task */
28230 INIT_TASK_DATA(THREAD_SIZE)
28231
28232 -#ifdef CONFIG_X86_32
28233 - /* 32 bit has nosave before _edata */
28234 NOSAVE_DATA
28235 -#endif
28236
28237 PAGE_ALIGNED_DATA(PAGE_SIZE)
28238
28239 @@ -172,12 +230,19 @@ SECTIONS
28240 #endif /* CONFIG_X86_64 */
28241
28242 /* Init code and data - will be freed after init */
28243 - . = ALIGN(PAGE_SIZE);
28244 .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
28245 + BYTE(0)
28246 +
28247 +#ifdef CONFIG_PAX_KERNEXEC
28248 + . = ALIGN(HPAGE_SIZE);
28249 +#else
28250 + . = ALIGN(PAGE_SIZE);
28251 +#endif
28252 +
28253 __init_begin = .; /* paired with __init_end */
28254 - }
28255 + } :init.begin
28256
28257 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
28258 +#ifdef CONFIG_SMP
28259 /*
28260 * percpu offsets are zero-based on SMP. PERCPU_VADDR() changes the
28261 * output PHDR, so the next output section - .init.text - should
28262 @@ -186,12 +251,27 @@ SECTIONS
28263 PERCPU_VADDR(INTERNODE_CACHE_BYTES, 0, :percpu)
28264 #endif
28265
28266 - INIT_TEXT_SECTION(PAGE_SIZE)
28267 -#ifdef CONFIG_X86_64
28268 - :init
28269 -#endif
28270 + . = ALIGN(PAGE_SIZE);
28271 + init_begin = .;
28272 + .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
28273 + VMLINUX_SYMBOL(_sinittext) = .;
28274 + INIT_TEXT
28275 + VMLINUX_SYMBOL(_einittext) = .;
28276 + . = ALIGN(PAGE_SIZE);
28277 + } :text.init
28278
28279 - INIT_DATA_SECTION(16)
28280 + /*
28281 + * .exit.text is discard at runtime, not link time, to deal with
28282 + * references from .altinstructions and .eh_frame
28283 + */
28284 + .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
28285 + EXIT_TEXT
28286 + . = ALIGN(16);
28287 + } :text.exit
28288 + . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
28289 +
28290 + . = ALIGN(PAGE_SIZE);
28291 + INIT_DATA_SECTION(16) :init
28292
28293 .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
28294 __x86_cpu_dev_start = .;
28295 @@ -262,19 +342,12 @@ SECTIONS
28296 }
28297
28298 . = ALIGN(8);
28299 - /*
28300 - * .exit.text is discard at runtime, not link time, to deal with
28301 - * references from .altinstructions and .eh_frame
28302 - */
28303 - .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
28304 - EXIT_TEXT
28305 - }
28306
28307 .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
28308 EXIT_DATA
28309 }
28310
28311 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
28312 +#ifndef CONFIG_SMP
28313 PERCPU_SECTION(INTERNODE_CACHE_BYTES)
28314 #endif
28315
28316 @@ -293,16 +366,10 @@ SECTIONS
28317 .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
28318 __smp_locks = .;
28319 *(.smp_locks)
28320 - . = ALIGN(PAGE_SIZE);
28321 __smp_locks_end = .;
28322 + . = ALIGN(PAGE_SIZE);
28323 }
28324
28325 -#ifdef CONFIG_X86_64
28326 - .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
28327 - NOSAVE_DATA
28328 - }
28329 -#endif
28330 -
28331 /* BSS */
28332 . = ALIGN(PAGE_SIZE);
28333 .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
28334 @@ -318,6 +385,7 @@ SECTIONS
28335 __brk_base = .;
28336 . += 64 * 1024; /* 64k alignment slop space */
28337 *(.brk_reservation) /* areas brk users have reserved */
28338 + . = ALIGN(HPAGE_SIZE);
28339 __brk_limit = .;
28340 }
28341
28342 @@ -344,13 +412,12 @@ SECTIONS
28343 * for the boot processor.
28344 */
28345 #define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
28346 -INIT_PER_CPU(gdt_page);
28347 INIT_PER_CPU(irq_stack_union);
28348
28349 /*
28350 * Build-time check on the image size:
28351 */
28352 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
28353 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
28354 "kernel image bigger than KERNEL_IMAGE_SIZE");
28355
28356 #ifdef CONFIG_SMP
28357 diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
28358 index 1f96f93..6f29be7 100644
28359 --- a/arch/x86/kernel/vsyscall_64.c
28360 +++ b/arch/x86/kernel/vsyscall_64.c
28361 @@ -56,15 +56,13 @@
28362 DEFINE_VVAR(int, vgetcpu_mode);
28363 DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data);
28364
28365 -static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
28366 +static enum { EMULATE, NONE } vsyscall_mode = EMULATE;
28367
28368 static int __init vsyscall_setup(char *str)
28369 {
28370 if (str) {
28371 if (!strcmp("emulate", str))
28372 vsyscall_mode = EMULATE;
28373 - else if (!strcmp("native", str))
28374 - vsyscall_mode = NATIVE;
28375 else if (!strcmp("none", str))
28376 vsyscall_mode = NONE;
28377 else
28378 @@ -101,7 +99,7 @@ void update_vsyscall(struct timekeeper *tk)
28379 vdata->monotonic_time_sec = tk->xtime_sec
28380 + tk->wall_to_monotonic.tv_sec;
28381 vdata->monotonic_time_snsec = tk->xtime_nsec
28382 - + (tk->wall_to_monotonic.tv_nsec
28383 + + ((u64)tk->wall_to_monotonic.tv_nsec
28384 << tk->shift);
28385 while (vdata->monotonic_time_snsec >=
28386 (((u64)NSEC_PER_SEC) << tk->shift)) {
28387 @@ -323,8 +321,7 @@ do_ret:
28388 return true;
28389
28390 sigsegv:
28391 - force_sig(SIGSEGV, current);
28392 - return true;
28393 + do_group_exit(SIGKILL);
28394 }
28395
28396 /*
28397 @@ -377,10 +374,7 @@ void __init map_vsyscall(void)
28398 extern char __vvar_page;
28399 unsigned long physaddr_vvar_page = __pa_symbol(&__vvar_page);
28400
28401 - __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall,
28402 - vsyscall_mode == NATIVE
28403 - ? PAGE_KERNEL_VSYSCALL
28404 - : PAGE_KERNEL_VVAR);
28405 + __set_fixmap(VSYSCALL_FIRST_PAGE, physaddr_vsyscall, PAGE_KERNEL_VVAR);
28406 BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_FIRST_PAGE) !=
28407 (unsigned long)VSYSCALL_START);
28408
28409 diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
28410 index 04068192..4d75aa6 100644
28411 --- a/arch/x86/kernel/x8664_ksyms_64.c
28412 +++ b/arch/x86/kernel/x8664_ksyms_64.c
28413 @@ -34,8 +34,6 @@ EXPORT_SYMBOL(copy_user_generic_string);
28414 EXPORT_SYMBOL(copy_user_generic_unrolled);
28415 EXPORT_SYMBOL(copy_user_enhanced_fast_string);
28416 EXPORT_SYMBOL(__copy_user_nocache);
28417 -EXPORT_SYMBOL(_copy_from_user);
28418 -EXPORT_SYMBOL(_copy_to_user);
28419
28420 EXPORT_SYMBOL(copy_page);
28421 EXPORT_SYMBOL(clear_page);
28422 @@ -73,3 +71,7 @@ EXPORT_SYMBOL(___preempt_schedule);
28423 EXPORT_SYMBOL(___preempt_schedule_context);
28424 #endif
28425 #endif
28426 +
28427 +#ifdef CONFIG_PAX_PER_CPU_PGD
28428 +EXPORT_SYMBOL(cpu_pgd);
28429 +#endif
28430 diff --git a/arch/x86/kernel/x86_init.c b/arch/x86/kernel/x86_init.c
28431 index e48b674..a451dd9 100644
28432 --- a/arch/x86/kernel/x86_init.c
28433 +++ b/arch/x86/kernel/x86_init.c
28434 @@ -93,7 +93,7 @@ struct x86_cpuinit_ops x86_cpuinit = {
28435 static void default_nmi_init(void) { };
28436 static int default_i8042_detect(void) { return 1; };
28437
28438 -struct x86_platform_ops x86_platform = {
28439 +struct x86_platform_ops x86_platform __read_only = {
28440 .calibrate_tsc = native_calibrate_tsc,
28441 .get_wallclock = mach_get_cmos_time,
28442 .set_wallclock = mach_set_rtc_mmss,
28443 @@ -109,7 +109,7 @@ struct x86_platform_ops x86_platform = {
28444 EXPORT_SYMBOL_GPL(x86_platform);
28445
28446 #if defined(CONFIG_PCI_MSI)
28447 -struct x86_msi_ops x86_msi = {
28448 +struct x86_msi_ops x86_msi __read_only = {
28449 .setup_msi_irqs = native_setup_msi_irqs,
28450 .compose_msi_msg = native_compose_msi_msg,
28451 .teardown_msi_irq = native_teardown_msi_irq,
28452 @@ -150,7 +150,7 @@ u32 arch_msix_mask_irq(struct msi_desc *desc, u32 flag)
28453 }
28454 #endif
28455
28456 -struct x86_io_apic_ops x86_io_apic_ops = {
28457 +struct x86_io_apic_ops x86_io_apic_ops __read_only = {
28458 .init = native_io_apic_init_mappings,
28459 .read = native_io_apic_read,
28460 .write = native_io_apic_write,
28461 diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
28462 index a4b451c..8dfe1ad 100644
28463 --- a/arch/x86/kernel/xsave.c
28464 +++ b/arch/x86/kernel/xsave.c
28465 @@ -164,18 +164,18 @@ static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
28466
28467 /* Setup the bytes not touched by the [f]xsave and reserved for SW. */
28468 sw_bytes = ia32_frame ? &fx_sw_reserved_ia32 : &fx_sw_reserved;
28469 - err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
28470 + err = __copy_to_user(x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
28471
28472 if (!use_xsave())
28473 return err;
28474
28475 - err |= __put_user(FP_XSTATE_MAGIC2, (__u32 *)(buf + xstate_size));
28476 + err |= __put_user(FP_XSTATE_MAGIC2, (__u32 __user *)(buf + xstate_size));
28477
28478 /*
28479 * Read the xstate_bv which we copied (directly from the cpu or
28480 * from the state in task struct) to the user buffers.
28481 */
28482 - err |= __get_user(xstate_bv, (__u32 *)&x->xsave_hdr.xstate_bv);
28483 + err |= __get_user(xstate_bv, (__u32 __user *)&x->xsave_hdr.xstate_bv);
28484
28485 /*
28486 * For legacy compatible, we always set FP/SSE bits in the bit
28487 @@ -190,7 +190,7 @@ static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
28488 */
28489 xstate_bv |= XSTATE_FPSSE;
28490
28491 - err |= __put_user(xstate_bv, (__u32 *)&x->xsave_hdr.xstate_bv);
28492 + err |= __put_user(xstate_bv, (__u32 __user *)&x->xsave_hdr.xstate_bv);
28493
28494 return err;
28495 }
28496 @@ -199,6 +199,7 @@ static inline int save_user_xstate(struct xsave_struct __user *buf)
28497 {
28498 int err;
28499
28500 + buf = (struct xsave_struct __user *)____m(buf);
28501 if (use_xsave())
28502 err = xsave_user(buf);
28503 else if (use_fxsr())
28504 @@ -311,6 +312,7 @@ sanitize_restored_xstate(struct task_struct *tsk,
28505 */
28506 static inline int restore_user_xstate(void __user *buf, u64 xbv, int fx_only)
28507 {
28508 + buf = (void __user *)____m(buf);
28509 if (use_xsave()) {
28510 if ((unsigned long)buf % 64 || fx_only) {
28511 u64 init_bv = pcntxt_mask & ~XSTATE_FPSSE;
28512 diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
28513 index c697625..a032162 100644
28514 --- a/arch/x86/kvm/cpuid.c
28515 +++ b/arch/x86/kvm/cpuid.c
28516 @@ -156,15 +156,20 @@ int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
28517 struct kvm_cpuid2 *cpuid,
28518 struct kvm_cpuid_entry2 __user *entries)
28519 {
28520 - int r;
28521 + int r, i;
28522
28523 r = -E2BIG;
28524 if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
28525 goto out;
28526 r = -EFAULT;
28527 - if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
28528 - cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
28529 + if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
28530 goto out;
28531 + for (i = 0; i < cpuid->nent; ++i) {
28532 + struct kvm_cpuid_entry2 cpuid_entry;
28533 + if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
28534 + goto out;
28535 + vcpu->arch.cpuid_entries[i] = cpuid_entry;
28536 + }
28537 vcpu->arch.cpuid_nent = cpuid->nent;
28538 kvm_apic_set_version(vcpu);
28539 kvm_x86_ops->cpuid_update(vcpu);
28540 @@ -179,15 +184,19 @@ int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
28541 struct kvm_cpuid2 *cpuid,
28542 struct kvm_cpuid_entry2 __user *entries)
28543 {
28544 - int r;
28545 + int r, i;
28546
28547 r = -E2BIG;
28548 if (cpuid->nent < vcpu->arch.cpuid_nent)
28549 goto out;
28550 r = -EFAULT;
28551 - if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
28552 - vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
28553 + if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
28554 goto out;
28555 + for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
28556 + struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
28557 + if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
28558 + goto out;
28559 + }
28560 return 0;
28561
28562 out:
28563 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
28564 index 9736529..ab4f54c 100644
28565 --- a/arch/x86/kvm/lapic.c
28566 +++ b/arch/x86/kvm/lapic.c
28567 @@ -55,7 +55,7 @@
28568 #define APIC_BUS_CYCLE_NS 1
28569
28570 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
28571 -#define apic_debug(fmt, arg...)
28572 +#define apic_debug(fmt, arg...) do {} while (0)
28573
28574 #define APIC_LVT_NUM 6
28575 /* 14 is the version for Xeon and Pentium 8.4.8*/
28576 diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
28577 index cba218a..1cc1bed 100644
28578 --- a/arch/x86/kvm/paging_tmpl.h
28579 +++ b/arch/x86/kvm/paging_tmpl.h
28580 @@ -331,7 +331,7 @@ retry_walk:
28581 if (unlikely(kvm_is_error_hva(host_addr)))
28582 goto error;
28583
28584 - ptep_user = (pt_element_t __user *)((void *)host_addr + offset);
28585 + ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset);
28586 if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte))))
28587 goto error;
28588 walker->ptep_user[walker->level - 1] = ptep_user;
28589 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
28590 index 2de1bc0..22251ee 100644
28591 --- a/arch/x86/kvm/svm.c
28592 +++ b/arch/x86/kvm/svm.c
28593 @@ -3508,7 +3508,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
28594 int cpu = raw_smp_processor_id();
28595
28596 struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
28597 +
28598 + pax_open_kernel();
28599 sd->tss_desc->type = 9; /* available 32/64-bit TSS */
28600 + pax_close_kernel();
28601 +
28602 load_TR_desc();
28603 }
28604
28605 @@ -3911,6 +3915,10 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu)
28606 #endif
28607 #endif
28608
28609 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
28610 + __set_fs(current_thread_info()->addr_limit);
28611 +#endif
28612 +
28613 reload_tss(vcpu);
28614
28615 local_irq_disable();
28616 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
28617 index 3927528..fc19971 100644
28618 --- a/arch/x86/kvm/vmx.c
28619 +++ b/arch/x86/kvm/vmx.c
28620 @@ -1320,12 +1320,12 @@ static void vmcs_write64(unsigned long field, u64 value)
28621 #endif
28622 }
28623
28624 -static void vmcs_clear_bits(unsigned long field, u32 mask)
28625 +static void vmcs_clear_bits(unsigned long field, unsigned long mask)
28626 {
28627 vmcs_writel(field, vmcs_readl(field) & ~mask);
28628 }
28629
28630 -static void vmcs_set_bits(unsigned long field, u32 mask)
28631 +static void vmcs_set_bits(unsigned long field, unsigned long mask)
28632 {
28633 vmcs_writel(field, vmcs_readl(field) | mask);
28634 }
28635 @@ -1585,7 +1585,11 @@ static void reload_tss(void)
28636 struct desc_struct *descs;
28637
28638 descs = (void *)gdt->address;
28639 +
28640 + pax_open_kernel();
28641 descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
28642 + pax_close_kernel();
28643 +
28644 load_TR_desc();
28645 }
28646
28647 @@ -1809,6 +1813,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
28648 vmcs_writel(HOST_TR_BASE, kvm_read_tr_base()); /* 22.2.4 */
28649 vmcs_writel(HOST_GDTR_BASE, gdt->address); /* 22.2.4 */
28650
28651 +#ifdef CONFIG_PAX_PER_CPU_PGD
28652 + vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
28653 +#endif
28654 +
28655 rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
28656 vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
28657 vmx->loaded_vmcs->cpu = cpu;
28658 @@ -2098,7 +2106,7 @@ static void setup_msrs(struct vcpu_vmx *vmx)
28659 * reads and returns guest's timestamp counter "register"
28660 * guest_tsc = host_tsc + tsc_offset -- 21.3
28661 */
28662 -static u64 guest_read_tsc(void)
28663 +static u64 __intentional_overflow(-1) guest_read_tsc(void)
28664 {
28665 u64 host_tsc, tsc_offset;
28666
28667 @@ -3024,8 +3032,11 @@ static __init int hardware_setup(void)
28668 if (!cpu_has_vmx_flexpriority())
28669 flexpriority_enabled = 0;
28670
28671 - if (!cpu_has_vmx_tpr_shadow())
28672 - kvm_x86_ops->update_cr8_intercept = NULL;
28673 + if (!cpu_has_vmx_tpr_shadow()) {
28674 + pax_open_kernel();
28675 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
28676 + pax_close_kernel();
28677 + }
28678
28679 if (enable_ept && !cpu_has_vmx_ept_2m_page())
28680 kvm_disable_largepages();
28681 @@ -3036,13 +3047,15 @@ static __init int hardware_setup(void)
28682 if (!cpu_has_vmx_apicv())
28683 enable_apicv = 0;
28684
28685 + pax_open_kernel();
28686 if (enable_apicv)
28687 - kvm_x86_ops->update_cr8_intercept = NULL;
28688 + *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
28689 else {
28690 - kvm_x86_ops->hwapic_irr_update = NULL;
28691 - kvm_x86_ops->deliver_posted_interrupt = NULL;
28692 - kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy;
28693 + *(void **)&kvm_x86_ops->hwapic_irr_update = NULL;
28694 + *(void **)&kvm_x86_ops->deliver_posted_interrupt = NULL;
28695 + *(void **)&kvm_x86_ops->sync_pir_to_irr = vmx_sync_pir_to_irr_dummy;
28696 }
28697 + pax_close_kernel();
28698
28699 if (nested)
28700 nested_vmx_setup_ctls_msrs();
28701 @@ -4165,7 +4178,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
28702
28703 vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */
28704 vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
28705 +
28706 +#ifndef CONFIG_PAX_PER_CPU_PGD
28707 vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
28708 +#endif
28709
28710 vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
28711 #ifdef CONFIG_X86_64
28712 @@ -4187,7 +4203,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
28713 vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
28714 vmx->host_idt_base = dt.address;
28715
28716 - vmcs_writel(HOST_RIP, vmx_return); /* 22.2.5 */
28717 + vmcs_writel(HOST_RIP, ktla_ktva(vmx_return)); /* 22.2.5 */
28718
28719 rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
28720 vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
28721 @@ -7265,6 +7281,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
28722 "jmp 2f \n\t"
28723 "1: " __ex(ASM_VMX_VMRESUME) "\n\t"
28724 "2: "
28725 +
28726 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28727 + "ljmp %[cs],$3f\n\t"
28728 + "3: "
28729 +#endif
28730 +
28731 /* Save guest registers, load host registers, keep flags */
28732 "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t"
28733 "pop %0 \n\t"
28734 @@ -7317,6 +7339,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
28735 #endif
28736 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
28737 [wordsize]"i"(sizeof(ulong))
28738 +
28739 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
28740 + ,[cs]"i"(__KERNEL_CS)
28741 +#endif
28742 +
28743 : "cc", "memory"
28744 #ifdef CONFIG_X86_64
28745 , "rax", "rbx", "rdi", "rsi"
28746 @@ -7330,7 +7357,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
28747 if (debugctlmsr)
28748 update_debugctlmsr(debugctlmsr);
28749
28750 -#ifndef CONFIG_X86_64
28751 +#ifdef CONFIG_X86_32
28752 /*
28753 * The sysexit path does not restore ds/es, so we must set them to
28754 * a reasonable value ourselves.
28755 @@ -7339,8 +7366,18 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
28756 * may be executed in interrupt context, which saves and restore segments
28757 * around it, nullifying its effect.
28758 */
28759 - loadsegment(ds, __USER_DS);
28760 - loadsegment(es, __USER_DS);
28761 + loadsegment(ds, __KERNEL_DS);
28762 + loadsegment(es, __KERNEL_DS);
28763 + loadsegment(ss, __KERNEL_DS);
28764 +
28765 +#ifdef CONFIG_PAX_KERNEXEC
28766 + loadsegment(fs, __KERNEL_PERCPU);
28767 +#endif
28768 +
28769 +#ifdef CONFIG_PAX_MEMORY_UDEREF
28770 + __set_fs(current_thread_info()->addr_limit);
28771 +#endif
28772 +
28773 #endif
28774
28775 vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
28776 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
28777 index ee0c3b5..773bb94 100644
28778 --- a/arch/x86/kvm/x86.c
28779 +++ b/arch/x86/kvm/x86.c
28780 @@ -1776,8 +1776,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
28781 {
28782 struct kvm *kvm = vcpu->kvm;
28783 int lm = is_long_mode(vcpu);
28784 - u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64
28785 - : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
28786 + u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64
28787 + : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32;
28788 u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
28789 : kvm->arch.xen_hvm_config.blob_size_32;
28790 u32 page_num = data & ~PAGE_MASK;
28791 @@ -2688,6 +2688,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
28792 if (n < msr_list.nmsrs)
28793 goto out;
28794 r = -EFAULT;
28795 + if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
28796 + goto out;
28797 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
28798 num_msrs_to_save * sizeof(u32)))
28799 goto out;
28800 @@ -5502,7 +5504,7 @@ static struct notifier_block pvclock_gtod_notifier = {
28801 };
28802 #endif
28803
28804 -int kvm_arch_init(void *opaque)
28805 +int kvm_arch_init(const void *opaque)
28806 {
28807 int r;
28808 struct kvm_x86_ops *ops = opaque;
28809 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
28810 index ad1fb5f..fe30b66 100644
28811 --- a/arch/x86/lguest/boot.c
28812 +++ b/arch/x86/lguest/boot.c
28813 @@ -1206,9 +1206,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
28814 * Rebooting also tells the Host we're finished, but the RESTART flag tells the
28815 * Launcher to reboot us.
28816 */
28817 -static void lguest_restart(char *reason)
28818 +static __noreturn void lguest_restart(char *reason)
28819 {
28820 hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
28821 + BUG();
28822 }
28823
28824 /*G:050
28825 diff --git a/arch/x86/lib/atomic64_386_32.S b/arch/x86/lib/atomic64_386_32.S
28826 index 00933d5..3a64af9 100644
28827 --- a/arch/x86/lib/atomic64_386_32.S
28828 +++ b/arch/x86/lib/atomic64_386_32.S
28829 @@ -48,6 +48,10 @@ BEGIN(read)
28830 movl (v), %eax
28831 movl 4(v), %edx
28832 RET_ENDP
28833 +BEGIN(read_unchecked)
28834 + movl (v), %eax
28835 + movl 4(v), %edx
28836 +RET_ENDP
28837 #undef v
28838
28839 #define v %esi
28840 @@ -55,6 +59,10 @@ BEGIN(set)
28841 movl %ebx, (v)
28842 movl %ecx, 4(v)
28843 RET_ENDP
28844 +BEGIN(set_unchecked)
28845 + movl %ebx, (v)
28846 + movl %ecx, 4(v)
28847 +RET_ENDP
28848 #undef v
28849
28850 #define v %esi
28851 @@ -70,6 +78,20 @@ RET_ENDP
28852 BEGIN(add)
28853 addl %eax, (v)
28854 adcl %edx, 4(v)
28855 +
28856 +#ifdef CONFIG_PAX_REFCOUNT
28857 + jno 0f
28858 + subl %eax, (v)
28859 + sbbl %edx, 4(v)
28860 + int $4
28861 +0:
28862 + _ASM_EXTABLE(0b, 0b)
28863 +#endif
28864 +
28865 +RET_ENDP
28866 +BEGIN(add_unchecked)
28867 + addl %eax, (v)
28868 + adcl %edx, 4(v)
28869 RET_ENDP
28870 #undef v
28871
28872 @@ -77,6 +99,24 @@ RET_ENDP
28873 BEGIN(add_return)
28874 addl (v), %eax
28875 adcl 4(v), %edx
28876 +
28877 +#ifdef CONFIG_PAX_REFCOUNT
28878 + into
28879 +1234:
28880 + _ASM_EXTABLE(1234b, 2f)
28881 +#endif
28882 +
28883 + movl %eax, (v)
28884 + movl %edx, 4(v)
28885 +
28886 +#ifdef CONFIG_PAX_REFCOUNT
28887 +2:
28888 +#endif
28889 +
28890 +RET_ENDP
28891 +BEGIN(add_return_unchecked)
28892 + addl (v), %eax
28893 + adcl 4(v), %edx
28894 movl %eax, (v)
28895 movl %edx, 4(v)
28896 RET_ENDP
28897 @@ -86,6 +126,20 @@ RET_ENDP
28898 BEGIN(sub)
28899 subl %eax, (v)
28900 sbbl %edx, 4(v)
28901 +
28902 +#ifdef CONFIG_PAX_REFCOUNT
28903 + jno 0f
28904 + addl %eax, (v)
28905 + adcl %edx, 4(v)
28906 + int $4
28907 +0:
28908 + _ASM_EXTABLE(0b, 0b)
28909 +#endif
28910 +
28911 +RET_ENDP
28912 +BEGIN(sub_unchecked)
28913 + subl %eax, (v)
28914 + sbbl %edx, 4(v)
28915 RET_ENDP
28916 #undef v
28917
28918 @@ -96,6 +150,27 @@ BEGIN(sub_return)
28919 sbbl $0, %edx
28920 addl (v), %eax
28921 adcl 4(v), %edx
28922 +
28923 +#ifdef CONFIG_PAX_REFCOUNT
28924 + into
28925 +1234:
28926 + _ASM_EXTABLE(1234b, 2f)
28927 +#endif
28928 +
28929 + movl %eax, (v)
28930 + movl %edx, 4(v)
28931 +
28932 +#ifdef CONFIG_PAX_REFCOUNT
28933 +2:
28934 +#endif
28935 +
28936 +RET_ENDP
28937 +BEGIN(sub_return_unchecked)
28938 + negl %edx
28939 + negl %eax
28940 + sbbl $0, %edx
28941 + addl (v), %eax
28942 + adcl 4(v), %edx
28943 movl %eax, (v)
28944 movl %edx, 4(v)
28945 RET_ENDP
28946 @@ -105,6 +180,20 @@ RET_ENDP
28947 BEGIN(inc)
28948 addl $1, (v)
28949 adcl $0, 4(v)
28950 +
28951 +#ifdef CONFIG_PAX_REFCOUNT
28952 + jno 0f
28953 + subl $1, (v)
28954 + sbbl $0, 4(v)
28955 + int $4
28956 +0:
28957 + _ASM_EXTABLE(0b, 0b)
28958 +#endif
28959 +
28960 +RET_ENDP
28961 +BEGIN(inc_unchecked)
28962 + addl $1, (v)
28963 + adcl $0, 4(v)
28964 RET_ENDP
28965 #undef v
28966
28967 @@ -114,6 +203,26 @@ BEGIN(inc_return)
28968 movl 4(v), %edx
28969 addl $1, %eax
28970 adcl $0, %edx
28971 +
28972 +#ifdef CONFIG_PAX_REFCOUNT
28973 + into
28974 +1234:
28975 + _ASM_EXTABLE(1234b, 2f)
28976 +#endif
28977 +
28978 + movl %eax, (v)
28979 + movl %edx, 4(v)
28980 +
28981 +#ifdef CONFIG_PAX_REFCOUNT
28982 +2:
28983 +#endif
28984 +
28985 +RET_ENDP
28986 +BEGIN(inc_return_unchecked)
28987 + movl (v), %eax
28988 + movl 4(v), %edx
28989 + addl $1, %eax
28990 + adcl $0, %edx
28991 movl %eax, (v)
28992 movl %edx, 4(v)
28993 RET_ENDP
28994 @@ -123,6 +232,20 @@ RET_ENDP
28995 BEGIN(dec)
28996 subl $1, (v)
28997 sbbl $0, 4(v)
28998 +
28999 +#ifdef CONFIG_PAX_REFCOUNT
29000 + jno 0f
29001 + addl $1, (v)
29002 + adcl $0, 4(v)
29003 + int $4
29004 +0:
29005 + _ASM_EXTABLE(0b, 0b)
29006 +#endif
29007 +
29008 +RET_ENDP
29009 +BEGIN(dec_unchecked)
29010 + subl $1, (v)
29011 + sbbl $0, 4(v)
29012 RET_ENDP
29013 #undef v
29014
29015 @@ -132,6 +255,26 @@ BEGIN(dec_return)
29016 movl 4(v), %edx
29017 subl $1, %eax
29018 sbbl $0, %edx
29019 +
29020 +#ifdef CONFIG_PAX_REFCOUNT
29021 + into
29022 +1234:
29023 + _ASM_EXTABLE(1234b, 2f)
29024 +#endif
29025 +
29026 + movl %eax, (v)
29027 + movl %edx, 4(v)
29028 +
29029 +#ifdef CONFIG_PAX_REFCOUNT
29030 +2:
29031 +#endif
29032 +
29033 +RET_ENDP
29034 +BEGIN(dec_return_unchecked)
29035 + movl (v), %eax
29036 + movl 4(v), %edx
29037 + subl $1, %eax
29038 + sbbl $0, %edx
29039 movl %eax, (v)
29040 movl %edx, 4(v)
29041 RET_ENDP
29042 @@ -143,6 +286,13 @@ BEGIN(add_unless)
29043 adcl %edx, %edi
29044 addl (v), %eax
29045 adcl 4(v), %edx
29046 +
29047 +#ifdef CONFIG_PAX_REFCOUNT
29048 + into
29049 +1234:
29050 + _ASM_EXTABLE(1234b, 2f)
29051 +#endif
29052 +
29053 cmpl %eax, %ecx
29054 je 3f
29055 1:
29056 @@ -168,6 +318,13 @@ BEGIN(inc_not_zero)
29057 1:
29058 addl $1, %eax
29059 adcl $0, %edx
29060 +
29061 +#ifdef CONFIG_PAX_REFCOUNT
29062 + into
29063 +1234:
29064 + _ASM_EXTABLE(1234b, 2f)
29065 +#endif
29066 +
29067 movl %eax, (v)
29068 movl %edx, 4(v)
29069 movl $1, %eax
29070 @@ -186,6 +343,13 @@ BEGIN(dec_if_positive)
29071 movl 4(v), %edx
29072 subl $1, %eax
29073 sbbl $0, %edx
29074 +
29075 +#ifdef CONFIG_PAX_REFCOUNT
29076 + into
29077 +1234:
29078 + _ASM_EXTABLE(1234b, 1f)
29079 +#endif
29080 +
29081 js 1f
29082 movl %eax, (v)
29083 movl %edx, 4(v)
29084 diff --git a/arch/x86/lib/atomic64_cx8_32.S b/arch/x86/lib/atomic64_cx8_32.S
29085 index f5cc9eb..51fa319 100644
29086 --- a/arch/x86/lib/atomic64_cx8_32.S
29087 +++ b/arch/x86/lib/atomic64_cx8_32.S
29088 @@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8)
29089 CFI_STARTPROC
29090
29091 read64 %ecx
29092 + pax_force_retaddr
29093 ret
29094 CFI_ENDPROC
29095 ENDPROC(atomic64_read_cx8)
29096
29097 +ENTRY(atomic64_read_unchecked_cx8)
29098 + CFI_STARTPROC
29099 +
29100 + read64 %ecx
29101 + pax_force_retaddr
29102 + ret
29103 + CFI_ENDPROC
29104 +ENDPROC(atomic64_read_unchecked_cx8)
29105 +
29106 ENTRY(atomic64_set_cx8)
29107 CFI_STARTPROC
29108
29109 @@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8)
29110 cmpxchg8b (%esi)
29111 jne 1b
29112
29113 + pax_force_retaddr
29114 ret
29115 CFI_ENDPROC
29116 ENDPROC(atomic64_set_cx8)
29117
29118 +ENTRY(atomic64_set_unchecked_cx8)
29119 + CFI_STARTPROC
29120 +
29121 +1:
29122 +/* we don't need LOCK_PREFIX since aligned 64-bit writes
29123 + * are atomic on 586 and newer */
29124 + cmpxchg8b (%esi)
29125 + jne 1b
29126 +
29127 + pax_force_retaddr
29128 + ret
29129 + CFI_ENDPROC
29130 +ENDPROC(atomic64_set_unchecked_cx8)
29131 +
29132 ENTRY(atomic64_xchg_cx8)
29133 CFI_STARTPROC
29134
29135 @@ -60,12 +85,13 @@ ENTRY(atomic64_xchg_cx8)
29136 cmpxchg8b (%esi)
29137 jne 1b
29138
29139 + pax_force_retaddr
29140 ret
29141 CFI_ENDPROC
29142 ENDPROC(atomic64_xchg_cx8)
29143
29144 -.macro addsub_return func ins insc
29145 -ENTRY(atomic64_\func\()_return_cx8)
29146 +.macro addsub_return func ins insc unchecked=""
29147 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
29148 CFI_STARTPROC
29149 SAVE ebp
29150 SAVE ebx
29151 @@ -82,27 +108,44 @@ ENTRY(atomic64_\func\()_return_cx8)
29152 movl %edx, %ecx
29153 \ins\()l %esi, %ebx
29154 \insc\()l %edi, %ecx
29155 +
29156 +.ifb \unchecked
29157 +#ifdef CONFIG_PAX_REFCOUNT
29158 + into
29159 +2:
29160 + _ASM_EXTABLE(2b, 3f)
29161 +#endif
29162 +.endif
29163 +
29164 LOCK_PREFIX
29165 cmpxchg8b (%ebp)
29166 jne 1b
29167 -
29168 -10:
29169 movl %ebx, %eax
29170 movl %ecx, %edx
29171 +
29172 +.ifb \unchecked
29173 +#ifdef CONFIG_PAX_REFCOUNT
29174 +3:
29175 +#endif
29176 +.endif
29177 +
29178 RESTORE edi
29179 RESTORE esi
29180 RESTORE ebx
29181 RESTORE ebp
29182 + pax_force_retaddr
29183 ret
29184 CFI_ENDPROC
29185 -ENDPROC(atomic64_\func\()_return_cx8)
29186 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
29187 .endm
29188
29189 addsub_return add add adc
29190 addsub_return sub sub sbb
29191 +addsub_return add add adc _unchecked
29192 +addsub_return sub sub sbb _unchecked
29193
29194 -.macro incdec_return func ins insc
29195 -ENTRY(atomic64_\func\()_return_cx8)
29196 +.macro incdec_return func ins insc unchecked=""
29197 +ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
29198 CFI_STARTPROC
29199 SAVE ebx
29200
29201 @@ -112,21 +155,39 @@ ENTRY(atomic64_\func\()_return_cx8)
29202 movl %edx, %ecx
29203 \ins\()l $1, %ebx
29204 \insc\()l $0, %ecx
29205 +
29206 +.ifb \unchecked
29207 +#ifdef CONFIG_PAX_REFCOUNT
29208 + into
29209 +2:
29210 + _ASM_EXTABLE(2b, 3f)
29211 +#endif
29212 +.endif
29213 +
29214 LOCK_PREFIX
29215 cmpxchg8b (%esi)
29216 jne 1b
29217
29218 -10:
29219 movl %ebx, %eax
29220 movl %ecx, %edx
29221 +
29222 +.ifb \unchecked
29223 +#ifdef CONFIG_PAX_REFCOUNT
29224 +3:
29225 +#endif
29226 +.endif
29227 +
29228 RESTORE ebx
29229 + pax_force_retaddr
29230 ret
29231 CFI_ENDPROC
29232 -ENDPROC(atomic64_\func\()_return_cx8)
29233 +ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
29234 .endm
29235
29236 incdec_return inc add adc
29237 incdec_return dec sub sbb
29238 +incdec_return inc add adc _unchecked
29239 +incdec_return dec sub sbb _unchecked
29240
29241 ENTRY(atomic64_dec_if_positive_cx8)
29242 CFI_STARTPROC
29243 @@ -138,6 +199,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
29244 movl %edx, %ecx
29245 subl $1, %ebx
29246 sbb $0, %ecx
29247 +
29248 +#ifdef CONFIG_PAX_REFCOUNT
29249 + into
29250 +1234:
29251 + _ASM_EXTABLE(1234b, 2f)
29252 +#endif
29253 +
29254 js 2f
29255 LOCK_PREFIX
29256 cmpxchg8b (%esi)
29257 @@ -147,6 +215,7 @@ ENTRY(atomic64_dec_if_positive_cx8)
29258 movl %ebx, %eax
29259 movl %ecx, %edx
29260 RESTORE ebx
29261 + pax_force_retaddr
29262 ret
29263 CFI_ENDPROC
29264 ENDPROC(atomic64_dec_if_positive_cx8)
29265 @@ -171,6 +240,13 @@ ENTRY(atomic64_add_unless_cx8)
29266 movl %edx, %ecx
29267 addl %ebp, %ebx
29268 adcl %edi, %ecx
29269 +
29270 +#ifdef CONFIG_PAX_REFCOUNT
29271 + into
29272 +1234:
29273 + _ASM_EXTABLE(1234b, 3f)
29274 +#endif
29275 +
29276 LOCK_PREFIX
29277 cmpxchg8b (%esi)
29278 jne 1b
29279 @@ -181,6 +257,7 @@ ENTRY(atomic64_add_unless_cx8)
29280 CFI_ADJUST_CFA_OFFSET -8
29281 RESTORE ebx
29282 RESTORE ebp
29283 + pax_force_retaddr
29284 ret
29285 4:
29286 cmpl %edx, 4(%esp)
29287 @@ -203,6 +280,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
29288 xorl %ecx, %ecx
29289 addl $1, %ebx
29290 adcl %edx, %ecx
29291 +
29292 +#ifdef CONFIG_PAX_REFCOUNT
29293 + into
29294 +1234:
29295 + _ASM_EXTABLE(1234b, 3f)
29296 +#endif
29297 +
29298 LOCK_PREFIX
29299 cmpxchg8b (%esi)
29300 jne 1b
29301 @@ -210,6 +294,7 @@ ENTRY(atomic64_inc_not_zero_cx8)
29302 movl $1, %eax
29303 3:
29304 RESTORE ebx
29305 + pax_force_retaddr
29306 ret
29307 CFI_ENDPROC
29308 ENDPROC(atomic64_inc_not_zero_cx8)
29309 diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S
29310 index e78b8ee..7e173a8 100644
29311 --- a/arch/x86/lib/checksum_32.S
29312 +++ b/arch/x86/lib/checksum_32.S
29313 @@ -29,7 +29,8 @@
29314 #include <asm/dwarf2.h>
29315 #include <asm/errno.h>
29316 #include <asm/asm.h>
29317 -
29318 +#include <asm/segment.h>
29319 +
29320 /*
29321 * computes a partial checksum, e.g. for TCP/UDP fragments
29322 */
29323 @@ -293,9 +294,24 @@ unsigned int csum_partial_copy_generic (const char *src, char *dst,
29324
29325 #define ARGBASE 16
29326 #define FP 12
29327 -
29328 -ENTRY(csum_partial_copy_generic)
29329 +
29330 +ENTRY(csum_partial_copy_generic_to_user)
29331 CFI_STARTPROC
29332 +
29333 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29334 + pushl_cfi %gs
29335 + popl_cfi %es
29336 + jmp csum_partial_copy_generic
29337 +#endif
29338 +
29339 +ENTRY(csum_partial_copy_generic_from_user)
29340 +
29341 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29342 + pushl_cfi %gs
29343 + popl_cfi %ds
29344 +#endif
29345 +
29346 +ENTRY(csum_partial_copy_generic)
29347 subl $4,%esp
29348 CFI_ADJUST_CFA_OFFSET 4
29349 pushl_cfi %edi
29350 @@ -317,7 +333,7 @@ ENTRY(csum_partial_copy_generic)
29351 jmp 4f
29352 SRC(1: movw (%esi), %bx )
29353 addl $2, %esi
29354 -DST( movw %bx, (%edi) )
29355 +DST( movw %bx, %es:(%edi) )
29356 addl $2, %edi
29357 addw %bx, %ax
29358 adcl $0, %eax
29359 @@ -329,30 +345,30 @@ DST( movw %bx, (%edi) )
29360 SRC(1: movl (%esi), %ebx )
29361 SRC( movl 4(%esi), %edx )
29362 adcl %ebx, %eax
29363 -DST( movl %ebx, (%edi) )
29364 +DST( movl %ebx, %es:(%edi) )
29365 adcl %edx, %eax
29366 -DST( movl %edx, 4(%edi) )
29367 +DST( movl %edx, %es:4(%edi) )
29368
29369 SRC( movl 8(%esi), %ebx )
29370 SRC( movl 12(%esi), %edx )
29371 adcl %ebx, %eax
29372 -DST( movl %ebx, 8(%edi) )
29373 +DST( movl %ebx, %es:8(%edi) )
29374 adcl %edx, %eax
29375 -DST( movl %edx, 12(%edi) )
29376 +DST( movl %edx, %es:12(%edi) )
29377
29378 SRC( movl 16(%esi), %ebx )
29379 SRC( movl 20(%esi), %edx )
29380 adcl %ebx, %eax
29381 -DST( movl %ebx, 16(%edi) )
29382 +DST( movl %ebx, %es:16(%edi) )
29383 adcl %edx, %eax
29384 -DST( movl %edx, 20(%edi) )
29385 +DST( movl %edx, %es:20(%edi) )
29386
29387 SRC( movl 24(%esi), %ebx )
29388 SRC( movl 28(%esi), %edx )
29389 adcl %ebx, %eax
29390 -DST( movl %ebx, 24(%edi) )
29391 +DST( movl %ebx, %es:24(%edi) )
29392 adcl %edx, %eax
29393 -DST( movl %edx, 28(%edi) )
29394 +DST( movl %edx, %es:28(%edi) )
29395
29396 lea 32(%esi), %esi
29397 lea 32(%edi), %edi
29398 @@ -366,7 +382,7 @@ DST( movl %edx, 28(%edi) )
29399 shrl $2, %edx # This clears CF
29400 SRC(3: movl (%esi), %ebx )
29401 adcl %ebx, %eax
29402 -DST( movl %ebx, (%edi) )
29403 +DST( movl %ebx, %es:(%edi) )
29404 lea 4(%esi), %esi
29405 lea 4(%edi), %edi
29406 dec %edx
29407 @@ -378,12 +394,12 @@ DST( movl %ebx, (%edi) )
29408 jb 5f
29409 SRC( movw (%esi), %cx )
29410 leal 2(%esi), %esi
29411 -DST( movw %cx, (%edi) )
29412 +DST( movw %cx, %es:(%edi) )
29413 leal 2(%edi), %edi
29414 je 6f
29415 shll $16,%ecx
29416 SRC(5: movb (%esi), %cl )
29417 -DST( movb %cl, (%edi) )
29418 +DST( movb %cl, %es:(%edi) )
29419 6: addl %ecx, %eax
29420 adcl $0, %eax
29421 7:
29422 @@ -394,7 +410,7 @@ DST( movb %cl, (%edi) )
29423
29424 6001:
29425 movl ARGBASE+20(%esp), %ebx # src_err_ptr
29426 - movl $-EFAULT, (%ebx)
29427 + movl $-EFAULT, %ss:(%ebx)
29428
29429 # zero the complete destination - computing the rest
29430 # is too much work
29431 @@ -407,11 +423,15 @@ DST( movb %cl, (%edi) )
29432
29433 6002:
29434 movl ARGBASE+24(%esp), %ebx # dst_err_ptr
29435 - movl $-EFAULT,(%ebx)
29436 + movl $-EFAULT,%ss:(%ebx)
29437 jmp 5000b
29438
29439 .previous
29440
29441 + pushl_cfi %ss
29442 + popl_cfi %ds
29443 + pushl_cfi %ss
29444 + popl_cfi %es
29445 popl_cfi %ebx
29446 CFI_RESTORE ebx
29447 popl_cfi %esi
29448 @@ -421,26 +441,43 @@ DST( movb %cl, (%edi) )
29449 popl_cfi %ecx # equivalent to addl $4,%esp
29450 ret
29451 CFI_ENDPROC
29452 -ENDPROC(csum_partial_copy_generic)
29453 +ENDPROC(csum_partial_copy_generic_to_user)
29454
29455 #else
29456
29457 /* Version for PentiumII/PPro */
29458
29459 #define ROUND1(x) \
29460 + nop; nop; nop; \
29461 SRC(movl x(%esi), %ebx ) ; \
29462 addl %ebx, %eax ; \
29463 - DST(movl %ebx, x(%edi) ) ;
29464 + DST(movl %ebx, %es:x(%edi)) ;
29465
29466 #define ROUND(x) \
29467 + nop; nop; nop; \
29468 SRC(movl x(%esi), %ebx ) ; \
29469 adcl %ebx, %eax ; \
29470 - DST(movl %ebx, x(%edi) ) ;
29471 + DST(movl %ebx, %es:x(%edi)) ;
29472
29473 #define ARGBASE 12
29474 -
29475 -ENTRY(csum_partial_copy_generic)
29476 +
29477 +ENTRY(csum_partial_copy_generic_to_user)
29478 CFI_STARTPROC
29479 +
29480 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29481 + pushl_cfi %gs
29482 + popl_cfi %es
29483 + jmp csum_partial_copy_generic
29484 +#endif
29485 +
29486 +ENTRY(csum_partial_copy_generic_from_user)
29487 +
29488 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29489 + pushl_cfi %gs
29490 + popl_cfi %ds
29491 +#endif
29492 +
29493 +ENTRY(csum_partial_copy_generic)
29494 pushl_cfi %ebx
29495 CFI_REL_OFFSET ebx, 0
29496 pushl_cfi %edi
29497 @@ -461,7 +498,7 @@ ENTRY(csum_partial_copy_generic)
29498 subl %ebx, %edi
29499 lea -1(%esi),%edx
29500 andl $-32,%edx
29501 - lea 3f(%ebx,%ebx), %ebx
29502 + lea 3f(%ebx,%ebx,2), %ebx
29503 testl %esi, %esi
29504 jmp *%ebx
29505 1: addl $64,%esi
29506 @@ -482,19 +519,19 @@ ENTRY(csum_partial_copy_generic)
29507 jb 5f
29508 SRC( movw (%esi), %dx )
29509 leal 2(%esi), %esi
29510 -DST( movw %dx, (%edi) )
29511 +DST( movw %dx, %es:(%edi) )
29512 leal 2(%edi), %edi
29513 je 6f
29514 shll $16,%edx
29515 5:
29516 SRC( movb (%esi), %dl )
29517 -DST( movb %dl, (%edi) )
29518 +DST( movb %dl, %es:(%edi) )
29519 6: addl %edx, %eax
29520 adcl $0, %eax
29521 7:
29522 .section .fixup, "ax"
29523 6001: movl ARGBASE+20(%esp), %ebx # src_err_ptr
29524 - movl $-EFAULT, (%ebx)
29525 + movl $-EFAULT, %ss:(%ebx)
29526 # zero the complete destination (computing the rest is too much work)
29527 movl ARGBASE+8(%esp),%edi # dst
29528 movl ARGBASE+12(%esp),%ecx # len
29529 @@ -502,10 +539,17 @@ DST( movb %dl, (%edi) )
29530 rep; stosb
29531 jmp 7b
29532 6002: movl ARGBASE+24(%esp), %ebx # dst_err_ptr
29533 - movl $-EFAULT, (%ebx)
29534 + movl $-EFAULT, %ss:(%ebx)
29535 jmp 7b
29536 .previous
29537
29538 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29539 + pushl_cfi %ss
29540 + popl_cfi %ds
29541 + pushl_cfi %ss
29542 + popl_cfi %es
29543 +#endif
29544 +
29545 popl_cfi %esi
29546 CFI_RESTORE esi
29547 popl_cfi %edi
29548 @@ -514,7 +558,7 @@ DST( movb %dl, (%edi) )
29549 CFI_RESTORE ebx
29550 ret
29551 CFI_ENDPROC
29552 -ENDPROC(csum_partial_copy_generic)
29553 +ENDPROC(csum_partial_copy_generic_to_user)
29554
29555 #undef ROUND
29556 #undef ROUND1
29557 diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
29558 index f2145cf..cea889d 100644
29559 --- a/arch/x86/lib/clear_page_64.S
29560 +++ b/arch/x86/lib/clear_page_64.S
29561 @@ -11,6 +11,7 @@ ENTRY(clear_page_c)
29562 movl $4096/8,%ecx
29563 xorl %eax,%eax
29564 rep stosq
29565 + pax_force_retaddr
29566 ret
29567 CFI_ENDPROC
29568 ENDPROC(clear_page_c)
29569 @@ -20,6 +21,7 @@ ENTRY(clear_page_c_e)
29570 movl $4096,%ecx
29571 xorl %eax,%eax
29572 rep stosb
29573 + pax_force_retaddr
29574 ret
29575 CFI_ENDPROC
29576 ENDPROC(clear_page_c_e)
29577 @@ -43,6 +45,7 @@ ENTRY(clear_page)
29578 leaq 64(%rdi),%rdi
29579 jnz .Lloop
29580 nop
29581 + pax_force_retaddr
29582 ret
29583 CFI_ENDPROC
29584 .Lclear_page_end:
29585 @@ -58,7 +61,7 @@ ENDPROC(clear_page)
29586
29587 #include <asm/cpufeature.h>
29588
29589 - .section .altinstr_replacement,"ax"
29590 + .section .altinstr_replacement,"a"
29591 1: .byte 0xeb /* jmp <disp8> */
29592 .byte (clear_page_c - clear_page) - (2f - 1b) /* offset */
29593 2: .byte 0xeb /* jmp <disp8> */
29594 diff --git a/arch/x86/lib/cmpxchg16b_emu.S b/arch/x86/lib/cmpxchg16b_emu.S
29595 index 1e572c5..2a162cd 100644
29596 --- a/arch/x86/lib/cmpxchg16b_emu.S
29597 +++ b/arch/x86/lib/cmpxchg16b_emu.S
29598 @@ -53,11 +53,13 @@ this_cpu_cmpxchg16b_emu:
29599
29600 popf
29601 mov $1, %al
29602 + pax_force_retaddr
29603 ret
29604
29605 not_same:
29606 popf
29607 xor %al,%al
29608 + pax_force_retaddr
29609 ret
29610
29611 CFI_ENDPROC
29612 diff --git a/arch/x86/lib/copy_page_64.S b/arch/x86/lib/copy_page_64.S
29613 index 176cca6..e0d658e 100644
29614 --- a/arch/x86/lib/copy_page_64.S
29615 +++ b/arch/x86/lib/copy_page_64.S
29616 @@ -9,6 +9,7 @@ copy_page_rep:
29617 CFI_STARTPROC
29618 movl $4096/8, %ecx
29619 rep movsq
29620 + pax_force_retaddr
29621 ret
29622 CFI_ENDPROC
29623 ENDPROC(copy_page_rep)
29624 @@ -24,8 +25,8 @@ ENTRY(copy_page)
29625 CFI_ADJUST_CFA_OFFSET 2*8
29626 movq %rbx, (%rsp)
29627 CFI_REL_OFFSET rbx, 0
29628 - movq %r12, 1*8(%rsp)
29629 - CFI_REL_OFFSET r12, 1*8
29630 + movq %r13, 1*8(%rsp)
29631 + CFI_REL_OFFSET r13, 1*8
29632
29633 movl $(4096/64)-5, %ecx
29634 .p2align 4
29635 @@ -38,7 +39,7 @@ ENTRY(copy_page)
29636 movq 0x8*4(%rsi), %r9
29637 movq 0x8*5(%rsi), %r10
29638 movq 0x8*6(%rsi), %r11
29639 - movq 0x8*7(%rsi), %r12
29640 + movq 0x8*7(%rsi), %r13
29641
29642 prefetcht0 5*64(%rsi)
29643
29644 @@ -49,7 +50,7 @@ ENTRY(copy_page)
29645 movq %r9, 0x8*4(%rdi)
29646 movq %r10, 0x8*5(%rdi)
29647 movq %r11, 0x8*6(%rdi)
29648 - movq %r12, 0x8*7(%rdi)
29649 + movq %r13, 0x8*7(%rdi)
29650
29651 leaq 64 (%rsi), %rsi
29652 leaq 64 (%rdi), %rdi
29653 @@ -68,7 +69,7 @@ ENTRY(copy_page)
29654 movq 0x8*4(%rsi), %r9
29655 movq 0x8*5(%rsi), %r10
29656 movq 0x8*6(%rsi), %r11
29657 - movq 0x8*7(%rsi), %r12
29658 + movq 0x8*7(%rsi), %r13
29659
29660 movq %rax, 0x8*0(%rdi)
29661 movq %rbx, 0x8*1(%rdi)
29662 @@ -77,7 +78,7 @@ ENTRY(copy_page)
29663 movq %r9, 0x8*4(%rdi)
29664 movq %r10, 0x8*5(%rdi)
29665 movq %r11, 0x8*6(%rdi)
29666 - movq %r12, 0x8*7(%rdi)
29667 + movq %r13, 0x8*7(%rdi)
29668
29669 leaq 64(%rdi), %rdi
29670 leaq 64(%rsi), %rsi
29671 @@ -85,10 +86,11 @@ ENTRY(copy_page)
29672
29673 movq (%rsp), %rbx
29674 CFI_RESTORE rbx
29675 - movq 1*8(%rsp), %r12
29676 - CFI_RESTORE r12
29677 + movq 1*8(%rsp), %r13
29678 + CFI_RESTORE r13
29679 addq $2*8, %rsp
29680 CFI_ADJUST_CFA_OFFSET -2*8
29681 + pax_force_retaddr
29682 ret
29683 .Lcopy_page_end:
29684 CFI_ENDPROC
29685 @@ -99,7 +101,7 @@ ENDPROC(copy_page)
29686
29687 #include <asm/cpufeature.h>
29688
29689 - .section .altinstr_replacement,"ax"
29690 + .section .altinstr_replacement,"a"
29691 1: .byte 0xeb /* jmp <disp8> */
29692 .byte (copy_page_rep - copy_page) - (2f - 1b) /* offset */
29693 2:
29694 diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
29695 index dee945d..a84067b 100644
29696 --- a/arch/x86/lib/copy_user_64.S
29697 +++ b/arch/x86/lib/copy_user_64.S
29698 @@ -18,31 +18,7 @@
29699 #include <asm/alternative-asm.h>
29700 #include <asm/asm.h>
29701 #include <asm/smap.h>
29702 -
29703 -/*
29704 - * By placing feature2 after feature1 in altinstructions section, we logically
29705 - * implement:
29706 - * If CPU has feature2, jmp to alt2 is used
29707 - * else if CPU has feature1, jmp to alt1 is used
29708 - * else jmp to orig is used.
29709 - */
29710 - .macro ALTERNATIVE_JUMP feature1,feature2,orig,alt1,alt2
29711 -0:
29712 - .byte 0xe9 /* 32bit jump */
29713 - .long \orig-1f /* by default jump to orig */
29714 -1:
29715 - .section .altinstr_replacement,"ax"
29716 -2: .byte 0xe9 /* near jump with 32bit immediate */
29717 - .long \alt1-1b /* offset */ /* or alternatively to alt1 */
29718 -3: .byte 0xe9 /* near jump with 32bit immediate */
29719 - .long \alt2-1b /* offset */ /* or alternatively to alt2 */
29720 - .previous
29721 -
29722 - .section .altinstructions,"a"
29723 - altinstruction_entry 0b,2b,\feature1,5,5
29724 - altinstruction_entry 0b,3b,\feature2,5,5
29725 - .previous
29726 - .endm
29727 +#include <asm/pgtable.h>
29728
29729 .macro ALIGN_DESTINATION
29730 #ifdef FIX_ALIGNMENT
29731 @@ -70,52 +46,6 @@
29732 #endif
29733 .endm
29734
29735 -/* Standard copy_to_user with segment limit checking */
29736 -ENTRY(_copy_to_user)
29737 - CFI_STARTPROC
29738 - GET_THREAD_INFO(%rax)
29739 - movq %rdi,%rcx
29740 - addq %rdx,%rcx
29741 - jc bad_to_user
29742 - cmpq TI_addr_limit(%rax),%rcx
29743 - ja bad_to_user
29744 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
29745 - copy_user_generic_unrolled,copy_user_generic_string, \
29746 - copy_user_enhanced_fast_string
29747 - CFI_ENDPROC
29748 -ENDPROC(_copy_to_user)
29749 -
29750 -/* Standard copy_from_user with segment limit checking */
29751 -ENTRY(_copy_from_user)
29752 - CFI_STARTPROC
29753 - GET_THREAD_INFO(%rax)
29754 - movq %rsi,%rcx
29755 - addq %rdx,%rcx
29756 - jc bad_from_user
29757 - cmpq TI_addr_limit(%rax),%rcx
29758 - ja bad_from_user
29759 - ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,X86_FEATURE_ERMS, \
29760 - copy_user_generic_unrolled,copy_user_generic_string, \
29761 - copy_user_enhanced_fast_string
29762 - CFI_ENDPROC
29763 -ENDPROC(_copy_from_user)
29764 -
29765 - .section .fixup,"ax"
29766 - /* must zero dest */
29767 -ENTRY(bad_from_user)
29768 -bad_from_user:
29769 - CFI_STARTPROC
29770 - movl %edx,%ecx
29771 - xorl %eax,%eax
29772 - rep
29773 - stosb
29774 -bad_to_user:
29775 - movl %edx,%eax
29776 - ret
29777 - CFI_ENDPROC
29778 -ENDPROC(bad_from_user)
29779 - .previous
29780 -
29781 /*
29782 * copy_user_generic_unrolled - memory copy with exception handling.
29783 * This version is for CPUs like P4 that don't have efficient micro
29784 @@ -131,6 +61,7 @@ ENDPROC(bad_from_user)
29785 */
29786 ENTRY(copy_user_generic_unrolled)
29787 CFI_STARTPROC
29788 + ASM_PAX_OPEN_USERLAND
29789 ASM_STAC
29790 cmpl $8,%edx
29791 jb 20f /* less then 8 bytes, go to byte copy loop */
29792 @@ -180,6 +111,8 @@ ENTRY(copy_user_generic_unrolled)
29793 jnz 21b
29794 23: xor %eax,%eax
29795 ASM_CLAC
29796 + ASM_PAX_CLOSE_USERLAND
29797 + pax_force_retaddr
29798 ret
29799
29800 .section .fixup,"ax"
29801 @@ -235,6 +168,7 @@ ENDPROC(copy_user_generic_unrolled)
29802 */
29803 ENTRY(copy_user_generic_string)
29804 CFI_STARTPROC
29805 + ASM_PAX_OPEN_USERLAND
29806 ASM_STAC
29807 cmpl $8,%edx
29808 jb 2f /* less than 8 bytes, go to byte copy loop */
29809 @@ -249,6 +183,8 @@ ENTRY(copy_user_generic_string)
29810 movsb
29811 xorl %eax,%eax
29812 ASM_CLAC
29813 + ASM_PAX_CLOSE_USERLAND
29814 + pax_force_retaddr
29815 ret
29816
29817 .section .fixup,"ax"
29818 @@ -276,12 +212,15 @@ ENDPROC(copy_user_generic_string)
29819 */
29820 ENTRY(copy_user_enhanced_fast_string)
29821 CFI_STARTPROC
29822 + ASM_PAX_OPEN_USERLAND
29823 ASM_STAC
29824 movl %edx,%ecx
29825 1: rep
29826 movsb
29827 xorl %eax,%eax
29828 ASM_CLAC
29829 + ASM_PAX_CLOSE_USERLAND
29830 + pax_force_retaddr
29831 ret
29832
29833 .section .fixup,"ax"
29834 diff --git a/arch/x86/lib/copy_user_nocache_64.S b/arch/x86/lib/copy_user_nocache_64.S
29835 index 6a4f43c..c70fb52 100644
29836 --- a/arch/x86/lib/copy_user_nocache_64.S
29837 +++ b/arch/x86/lib/copy_user_nocache_64.S
29838 @@ -8,6 +8,7 @@
29839
29840 #include <linux/linkage.h>
29841 #include <asm/dwarf2.h>
29842 +#include <asm/alternative-asm.h>
29843
29844 #define FIX_ALIGNMENT 1
29845
29846 @@ -16,6 +17,7 @@
29847 #include <asm/thread_info.h>
29848 #include <asm/asm.h>
29849 #include <asm/smap.h>
29850 +#include <asm/pgtable.h>
29851
29852 .macro ALIGN_DESTINATION
29853 #ifdef FIX_ALIGNMENT
29854 @@ -49,6 +51,16 @@
29855 */
29856 ENTRY(__copy_user_nocache)
29857 CFI_STARTPROC
29858 +
29859 +#ifdef CONFIG_PAX_MEMORY_UDEREF
29860 + mov pax_user_shadow_base,%rcx
29861 + cmp %rcx,%rsi
29862 + jae 1f
29863 + add %rcx,%rsi
29864 +1:
29865 +#endif
29866 +
29867 + ASM_PAX_OPEN_USERLAND
29868 ASM_STAC
29869 cmpl $8,%edx
29870 jb 20f /* less then 8 bytes, go to byte copy loop */
29871 @@ -98,7 +110,9 @@ ENTRY(__copy_user_nocache)
29872 jnz 21b
29873 23: xorl %eax,%eax
29874 ASM_CLAC
29875 + ASM_PAX_CLOSE_USERLAND
29876 sfence
29877 + pax_force_retaddr
29878 ret
29879
29880 .section .fixup,"ax"
29881 diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
29882 index 2419d5f..fe52d0e 100644
29883 --- a/arch/x86/lib/csum-copy_64.S
29884 +++ b/arch/x86/lib/csum-copy_64.S
29885 @@ -9,6 +9,7 @@
29886 #include <asm/dwarf2.h>
29887 #include <asm/errno.h>
29888 #include <asm/asm.h>
29889 +#include <asm/alternative-asm.h>
29890
29891 /*
29892 * Checksum copy with exception handling.
29893 @@ -56,8 +57,8 @@ ENTRY(csum_partial_copy_generic)
29894 CFI_ADJUST_CFA_OFFSET 7*8
29895 movq %rbx, 2*8(%rsp)
29896 CFI_REL_OFFSET rbx, 2*8
29897 - movq %r12, 3*8(%rsp)
29898 - CFI_REL_OFFSET r12, 3*8
29899 + movq %r15, 3*8(%rsp)
29900 + CFI_REL_OFFSET r15, 3*8
29901 movq %r14, 4*8(%rsp)
29902 CFI_REL_OFFSET r14, 4*8
29903 movq %r13, 5*8(%rsp)
29904 @@ -72,16 +73,16 @@ ENTRY(csum_partial_copy_generic)
29905 movl %edx, %ecx
29906
29907 xorl %r9d, %r9d
29908 - movq %rcx, %r12
29909 + movq %rcx, %r15
29910
29911 - shrq $6, %r12
29912 + shrq $6, %r15
29913 jz .Lhandle_tail /* < 64 */
29914
29915 clc
29916
29917 /* main loop. clear in 64 byte blocks */
29918 /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */
29919 - /* r11: temp3, rdx: temp4, r12 loopcnt */
29920 + /* r11: temp3, rdx: temp4, r15 loopcnt */
29921 /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */
29922 .p2align 4
29923 .Lloop:
29924 @@ -115,7 +116,7 @@ ENTRY(csum_partial_copy_generic)
29925 adcq %r14, %rax
29926 adcq %r13, %rax
29927
29928 - decl %r12d
29929 + decl %r15d
29930
29931 dest
29932 movq %rbx, (%rsi)
29933 @@ -210,8 +211,8 @@ ENTRY(csum_partial_copy_generic)
29934 .Lende:
29935 movq 2*8(%rsp), %rbx
29936 CFI_RESTORE rbx
29937 - movq 3*8(%rsp), %r12
29938 - CFI_RESTORE r12
29939 + movq 3*8(%rsp), %r15
29940 + CFI_RESTORE r15
29941 movq 4*8(%rsp), %r14
29942 CFI_RESTORE r14
29943 movq 5*8(%rsp), %r13
29944 @@ -220,6 +221,7 @@ ENTRY(csum_partial_copy_generic)
29945 CFI_RESTORE rbp
29946 addq $7*8, %rsp
29947 CFI_ADJUST_CFA_OFFSET -7*8
29948 + pax_force_retaddr
29949 ret
29950 CFI_RESTORE_STATE
29951
29952 diff --git a/arch/x86/lib/csum-wrappers_64.c b/arch/x86/lib/csum-wrappers_64.c
29953 index 7609e0e..b449b98 100644
29954 --- a/arch/x86/lib/csum-wrappers_64.c
29955 +++ b/arch/x86/lib/csum-wrappers_64.c
29956 @@ -53,10 +53,12 @@ csum_partial_copy_from_user(const void __user *src, void *dst,
29957 len -= 2;
29958 }
29959 }
29960 + pax_open_userland();
29961 stac();
29962 - isum = csum_partial_copy_generic((__force const void *)src,
29963 + isum = csum_partial_copy_generic((const void __force_kernel *)____m(src),
29964 dst, len, isum, errp, NULL);
29965 clac();
29966 + pax_close_userland();
29967 if (unlikely(*errp))
29968 goto out_err;
29969
29970 @@ -110,10 +112,12 @@ csum_partial_copy_to_user(const void *src, void __user *dst,
29971 }
29972
29973 *errp = 0;
29974 + pax_open_userland();
29975 stac();
29976 - ret = csum_partial_copy_generic(src, (void __force *)dst,
29977 + ret = csum_partial_copy_generic(src, (void __force_kernel *)____m(dst),
29978 len, isum, NULL, errp);
29979 clac();
29980 + pax_close_userland();
29981 return ret;
29982 }
29983 EXPORT_SYMBOL(csum_partial_copy_to_user);
29984 diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S
29985 index a451235..1daa956 100644
29986 --- a/arch/x86/lib/getuser.S
29987 +++ b/arch/x86/lib/getuser.S
29988 @@ -33,17 +33,40 @@
29989 #include <asm/thread_info.h>
29990 #include <asm/asm.h>
29991 #include <asm/smap.h>
29992 +#include <asm/segment.h>
29993 +#include <asm/pgtable.h>
29994 +#include <asm/alternative-asm.h>
29995 +
29996 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
29997 +#define __copyuser_seg gs;
29998 +#else
29999 +#define __copyuser_seg
30000 +#endif
30001
30002 .text
30003 ENTRY(__get_user_1)
30004 CFI_STARTPROC
30005 +
30006 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30007 GET_THREAD_INFO(%_ASM_DX)
30008 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30009 jae bad_get_user
30010 ASM_STAC
30011 -1: movzbl (%_ASM_AX),%edx
30012 +
30013 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30014 + mov pax_user_shadow_base,%_ASM_DX
30015 + cmp %_ASM_DX,%_ASM_AX
30016 + jae 1234f
30017 + add %_ASM_DX,%_ASM_AX
30018 +1234:
30019 +#endif
30020 +
30021 +#endif
30022 +
30023 +1: __copyuser_seg movzbl (%_ASM_AX),%edx
30024 xor %eax,%eax
30025 ASM_CLAC
30026 + pax_force_retaddr
30027 ret
30028 CFI_ENDPROC
30029 ENDPROC(__get_user_1)
30030 @@ -51,14 +74,28 @@ ENDPROC(__get_user_1)
30031 ENTRY(__get_user_2)
30032 CFI_STARTPROC
30033 add $1,%_ASM_AX
30034 +
30035 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30036 jc bad_get_user
30037 GET_THREAD_INFO(%_ASM_DX)
30038 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30039 jae bad_get_user
30040 ASM_STAC
30041 -2: movzwl -1(%_ASM_AX),%edx
30042 +
30043 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30044 + mov pax_user_shadow_base,%_ASM_DX
30045 + cmp %_ASM_DX,%_ASM_AX
30046 + jae 1234f
30047 + add %_ASM_DX,%_ASM_AX
30048 +1234:
30049 +#endif
30050 +
30051 +#endif
30052 +
30053 +2: __copyuser_seg movzwl -1(%_ASM_AX),%edx
30054 xor %eax,%eax
30055 ASM_CLAC
30056 + pax_force_retaddr
30057 ret
30058 CFI_ENDPROC
30059 ENDPROC(__get_user_2)
30060 @@ -66,14 +103,28 @@ ENDPROC(__get_user_2)
30061 ENTRY(__get_user_4)
30062 CFI_STARTPROC
30063 add $3,%_ASM_AX
30064 +
30065 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30066 jc bad_get_user
30067 GET_THREAD_INFO(%_ASM_DX)
30068 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30069 jae bad_get_user
30070 ASM_STAC
30071 -3: movl -3(%_ASM_AX),%edx
30072 +
30073 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30074 + mov pax_user_shadow_base,%_ASM_DX
30075 + cmp %_ASM_DX,%_ASM_AX
30076 + jae 1234f
30077 + add %_ASM_DX,%_ASM_AX
30078 +1234:
30079 +#endif
30080 +
30081 +#endif
30082 +
30083 +3: __copyuser_seg movl -3(%_ASM_AX),%edx
30084 xor %eax,%eax
30085 ASM_CLAC
30086 + pax_force_retaddr
30087 ret
30088 CFI_ENDPROC
30089 ENDPROC(__get_user_4)
30090 @@ -86,10 +137,20 @@ ENTRY(__get_user_8)
30091 GET_THREAD_INFO(%_ASM_DX)
30092 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30093 jae bad_get_user
30094 +
30095 +#ifdef CONFIG_PAX_MEMORY_UDEREF
30096 + mov pax_user_shadow_base,%_ASM_DX
30097 + cmp %_ASM_DX,%_ASM_AX
30098 + jae 1234f
30099 + add %_ASM_DX,%_ASM_AX
30100 +1234:
30101 +#endif
30102 +
30103 ASM_STAC
30104 4: movq -7(%_ASM_AX),%rdx
30105 xor %eax,%eax
30106 ASM_CLAC
30107 + pax_force_retaddr
30108 ret
30109 #else
30110 add $7,%_ASM_AX
30111 @@ -98,10 +159,11 @@ ENTRY(__get_user_8)
30112 cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
30113 jae bad_get_user_8
30114 ASM_STAC
30115 -4: movl -7(%_ASM_AX),%edx
30116 -5: movl -3(%_ASM_AX),%ecx
30117 +4: __copyuser_seg movl -7(%_ASM_AX),%edx
30118 +5: __copyuser_seg movl -3(%_ASM_AX),%ecx
30119 xor %eax,%eax
30120 ASM_CLAC
30121 + pax_force_retaddr
30122 ret
30123 #endif
30124 CFI_ENDPROC
30125 @@ -113,6 +175,7 @@ bad_get_user:
30126 xor %edx,%edx
30127 mov $(-EFAULT),%_ASM_AX
30128 ASM_CLAC
30129 + pax_force_retaddr
30130 ret
30131 CFI_ENDPROC
30132 END(bad_get_user)
30133 @@ -124,6 +187,7 @@ bad_get_user_8:
30134 xor %ecx,%ecx
30135 mov $(-EFAULT),%_ASM_AX
30136 ASM_CLAC
30137 + pax_force_retaddr
30138 ret
30139 CFI_ENDPROC
30140 END(bad_get_user_8)
30141 diff --git a/arch/x86/lib/insn.c b/arch/x86/lib/insn.c
30142 index 54fcffe..7be149e 100644
30143 --- a/arch/x86/lib/insn.c
30144 +++ b/arch/x86/lib/insn.c
30145 @@ -20,8 +20,10 @@
30146
30147 #ifdef __KERNEL__
30148 #include <linux/string.h>
30149 +#include <asm/pgtable_types.h>
30150 #else
30151 #include <string.h>
30152 +#define ktla_ktva(addr) addr
30153 #endif
30154 #include <asm/inat.h>
30155 #include <asm/insn.h>
30156 @@ -53,8 +55,8 @@
30157 void insn_init(struct insn *insn, const void *kaddr, int x86_64)
30158 {
30159 memset(insn, 0, sizeof(*insn));
30160 - insn->kaddr = kaddr;
30161 - insn->next_byte = kaddr;
30162 + insn->kaddr = ktla_ktva(kaddr);
30163 + insn->next_byte = ktla_ktva(kaddr);
30164 insn->x86_64 = x86_64 ? 1 : 0;
30165 insn->opnd_bytes = 4;
30166 if (x86_64)
30167 diff --git a/arch/x86/lib/iomap_copy_64.S b/arch/x86/lib/iomap_copy_64.S
30168 index 05a95e7..326f2fa 100644
30169 --- a/arch/x86/lib/iomap_copy_64.S
30170 +++ b/arch/x86/lib/iomap_copy_64.S
30171 @@ -17,6 +17,7 @@
30172
30173 #include <linux/linkage.h>
30174 #include <asm/dwarf2.h>
30175 +#include <asm/alternative-asm.h>
30176
30177 /*
30178 * override generic version in lib/iomap_copy.c
30179 @@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy)
30180 CFI_STARTPROC
30181 movl %edx,%ecx
30182 rep movsd
30183 + pax_force_retaddr
30184 ret
30185 CFI_ENDPROC
30186 ENDPROC(__iowrite32_copy)
30187 diff --git a/arch/x86/lib/memcpy_64.S b/arch/x86/lib/memcpy_64.S
30188 index 56313a3..0db417e 100644
30189 --- a/arch/x86/lib/memcpy_64.S
30190 +++ b/arch/x86/lib/memcpy_64.S
30191 @@ -24,7 +24,7 @@
30192 * This gets patched over the unrolled variant (below) via the
30193 * alternative instructions framework:
30194 */
30195 - .section .altinstr_replacement, "ax", @progbits
30196 + .section .altinstr_replacement, "a", @progbits
30197 .Lmemcpy_c:
30198 movq %rdi, %rax
30199 movq %rdx, %rcx
30200 @@ -33,6 +33,7 @@
30201 rep movsq
30202 movl %edx, %ecx
30203 rep movsb
30204 + pax_force_retaddr
30205 ret
30206 .Lmemcpy_e:
30207 .previous
30208 @@ -44,11 +45,12 @@
30209 * This gets patched over the unrolled variant (below) via the
30210 * alternative instructions framework:
30211 */
30212 - .section .altinstr_replacement, "ax", @progbits
30213 + .section .altinstr_replacement, "a", @progbits
30214 .Lmemcpy_c_e:
30215 movq %rdi, %rax
30216 movq %rdx, %rcx
30217 rep movsb
30218 + pax_force_retaddr
30219 ret
30220 .Lmemcpy_e_e:
30221 .previous
30222 @@ -136,6 +138,7 @@ ENTRY(memcpy)
30223 movq %r9, 1*8(%rdi)
30224 movq %r10, -2*8(%rdi, %rdx)
30225 movq %r11, -1*8(%rdi, %rdx)
30226 + pax_force_retaddr
30227 retq
30228 .p2align 4
30229 .Lless_16bytes:
30230 @@ -148,6 +151,7 @@ ENTRY(memcpy)
30231 movq -1*8(%rsi, %rdx), %r9
30232 movq %r8, 0*8(%rdi)
30233 movq %r9, -1*8(%rdi, %rdx)
30234 + pax_force_retaddr
30235 retq
30236 .p2align 4
30237 .Lless_8bytes:
30238 @@ -161,6 +165,7 @@ ENTRY(memcpy)
30239 movl -4(%rsi, %rdx), %r8d
30240 movl %ecx, (%rdi)
30241 movl %r8d, -4(%rdi, %rdx)
30242 + pax_force_retaddr
30243 retq
30244 .p2align 4
30245 .Lless_3bytes:
30246 @@ -179,6 +184,7 @@ ENTRY(memcpy)
30247 movb %cl, (%rdi)
30248
30249 .Lend:
30250 + pax_force_retaddr
30251 retq
30252 CFI_ENDPROC
30253 ENDPROC(memcpy)
30254 diff --git a/arch/x86/lib/memmove_64.S b/arch/x86/lib/memmove_64.S
30255 index 65268a6..dd1de11 100644
30256 --- a/arch/x86/lib/memmove_64.S
30257 +++ b/arch/x86/lib/memmove_64.S
30258 @@ -202,14 +202,16 @@ ENTRY(memmove)
30259 movb (%rsi), %r11b
30260 movb %r11b, (%rdi)
30261 13:
30262 + pax_force_retaddr
30263 retq
30264 CFI_ENDPROC
30265
30266 - .section .altinstr_replacement,"ax"
30267 + .section .altinstr_replacement,"a"
30268 .Lmemmove_begin_forward_efs:
30269 /* Forward moving data. */
30270 movq %rdx, %rcx
30271 rep movsb
30272 + pax_force_retaddr
30273 retq
30274 .Lmemmove_end_forward_efs:
30275 .previous
30276 diff --git a/arch/x86/lib/memset_64.S b/arch/x86/lib/memset_64.S
30277 index 2dcb380..2eb79fe 100644
30278 --- a/arch/x86/lib/memset_64.S
30279 +++ b/arch/x86/lib/memset_64.S
30280 @@ -16,7 +16,7 @@
30281 *
30282 * rax original destination
30283 */
30284 - .section .altinstr_replacement, "ax", @progbits
30285 + .section .altinstr_replacement, "a", @progbits
30286 .Lmemset_c:
30287 movq %rdi,%r9
30288 movq %rdx,%rcx
30289 @@ -30,6 +30,7 @@
30290 movl %edx,%ecx
30291 rep stosb
30292 movq %r9,%rax
30293 + pax_force_retaddr
30294 ret
30295 .Lmemset_e:
30296 .previous
30297 @@ -45,13 +46,14 @@
30298 *
30299 * rax original destination
30300 */
30301 - .section .altinstr_replacement, "ax", @progbits
30302 + .section .altinstr_replacement, "a", @progbits
30303 .Lmemset_c_e:
30304 movq %rdi,%r9
30305 movb %sil,%al
30306 movq %rdx,%rcx
30307 rep stosb
30308 movq %r9,%rax
30309 + pax_force_retaddr
30310 ret
30311 .Lmemset_e_e:
30312 .previous
30313 @@ -118,6 +120,7 @@ ENTRY(__memset)
30314
30315 .Lende:
30316 movq %r10,%rax
30317 + pax_force_retaddr
30318 ret
30319
30320 CFI_RESTORE_STATE
30321 diff --git a/arch/x86/lib/mmx_32.c b/arch/x86/lib/mmx_32.c
30322 index c9f2d9b..e7fd2c0 100644
30323 --- a/arch/x86/lib/mmx_32.c
30324 +++ b/arch/x86/lib/mmx_32.c
30325 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
30326 {
30327 void *p;
30328 int i;
30329 + unsigned long cr0;
30330
30331 if (unlikely(in_interrupt()))
30332 return __memcpy(to, from, len);
30333 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *from, size_t len)
30334 kernel_fpu_begin();
30335
30336 __asm__ __volatile__ (
30337 - "1: prefetch (%0)\n" /* This set is 28 bytes */
30338 - " prefetch 64(%0)\n"
30339 - " prefetch 128(%0)\n"
30340 - " prefetch 192(%0)\n"
30341 - " prefetch 256(%0)\n"
30342 + "1: prefetch (%1)\n" /* This set is 28 bytes */
30343 + " prefetch 64(%1)\n"
30344 + " prefetch 128(%1)\n"
30345 + " prefetch 192(%1)\n"
30346 + " prefetch 256(%1)\n"
30347 "2: \n"
30348 ".section .fixup, \"ax\"\n"
30349 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30350 + "3: \n"
30351 +
30352 +#ifdef CONFIG_PAX_KERNEXEC
30353 + " movl %%cr0, %0\n"
30354 + " movl %0, %%eax\n"
30355 + " andl $0xFFFEFFFF, %%eax\n"
30356 + " movl %%eax, %%cr0\n"
30357 +#endif
30358 +
30359 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30360 +
30361 +#ifdef CONFIG_PAX_KERNEXEC
30362 + " movl %0, %%cr0\n"
30363 +#endif
30364 +
30365 " jmp 2b\n"
30366 ".previous\n"
30367 _ASM_EXTABLE(1b, 3b)
30368 - : : "r" (from));
30369 + : "=&r" (cr0) : "r" (from) : "ax");
30370
30371 for ( ; i > 5; i--) {
30372 __asm__ __volatile__ (
30373 - "1: prefetch 320(%0)\n"
30374 - "2: movq (%0), %%mm0\n"
30375 - " movq 8(%0), %%mm1\n"
30376 - " movq 16(%0), %%mm2\n"
30377 - " movq 24(%0), %%mm3\n"
30378 - " movq %%mm0, (%1)\n"
30379 - " movq %%mm1, 8(%1)\n"
30380 - " movq %%mm2, 16(%1)\n"
30381 - " movq %%mm3, 24(%1)\n"
30382 - " movq 32(%0), %%mm0\n"
30383 - " movq 40(%0), %%mm1\n"
30384 - " movq 48(%0), %%mm2\n"
30385 - " movq 56(%0), %%mm3\n"
30386 - " movq %%mm0, 32(%1)\n"
30387 - " movq %%mm1, 40(%1)\n"
30388 - " movq %%mm2, 48(%1)\n"
30389 - " movq %%mm3, 56(%1)\n"
30390 + "1: prefetch 320(%1)\n"
30391 + "2: movq (%1), %%mm0\n"
30392 + " movq 8(%1), %%mm1\n"
30393 + " movq 16(%1), %%mm2\n"
30394 + " movq 24(%1), %%mm3\n"
30395 + " movq %%mm0, (%2)\n"
30396 + " movq %%mm1, 8(%2)\n"
30397 + " movq %%mm2, 16(%2)\n"
30398 + " movq %%mm3, 24(%2)\n"
30399 + " movq 32(%1), %%mm0\n"
30400 + " movq 40(%1), %%mm1\n"
30401 + " movq 48(%1), %%mm2\n"
30402 + " movq 56(%1), %%mm3\n"
30403 + " movq %%mm0, 32(%2)\n"
30404 + " movq %%mm1, 40(%2)\n"
30405 + " movq %%mm2, 48(%2)\n"
30406 + " movq %%mm3, 56(%2)\n"
30407 ".section .fixup, \"ax\"\n"
30408 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30409 + "3:\n"
30410 +
30411 +#ifdef CONFIG_PAX_KERNEXEC
30412 + " movl %%cr0, %0\n"
30413 + " movl %0, %%eax\n"
30414 + " andl $0xFFFEFFFF, %%eax\n"
30415 + " movl %%eax, %%cr0\n"
30416 +#endif
30417 +
30418 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30419 +
30420 +#ifdef CONFIG_PAX_KERNEXEC
30421 + " movl %0, %%cr0\n"
30422 +#endif
30423 +
30424 " jmp 2b\n"
30425 ".previous\n"
30426 _ASM_EXTABLE(1b, 3b)
30427 - : : "r" (from), "r" (to) : "memory");
30428 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
30429
30430 from += 64;
30431 to += 64;
30432 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
30433 static void fast_copy_page(void *to, void *from)
30434 {
30435 int i;
30436 + unsigned long cr0;
30437
30438 kernel_fpu_begin();
30439
30440 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, void *from)
30441 * but that is for later. -AV
30442 */
30443 __asm__ __volatile__(
30444 - "1: prefetch (%0)\n"
30445 - " prefetch 64(%0)\n"
30446 - " prefetch 128(%0)\n"
30447 - " prefetch 192(%0)\n"
30448 - " prefetch 256(%0)\n"
30449 + "1: prefetch (%1)\n"
30450 + " prefetch 64(%1)\n"
30451 + " prefetch 128(%1)\n"
30452 + " prefetch 192(%1)\n"
30453 + " prefetch 256(%1)\n"
30454 "2: \n"
30455 ".section .fixup, \"ax\"\n"
30456 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30457 + "3: \n"
30458 +
30459 +#ifdef CONFIG_PAX_KERNEXEC
30460 + " movl %%cr0, %0\n"
30461 + " movl %0, %%eax\n"
30462 + " andl $0xFFFEFFFF, %%eax\n"
30463 + " movl %%eax, %%cr0\n"
30464 +#endif
30465 +
30466 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30467 +
30468 +#ifdef CONFIG_PAX_KERNEXEC
30469 + " movl %0, %%cr0\n"
30470 +#endif
30471 +
30472 " jmp 2b\n"
30473 ".previous\n"
30474 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
30475 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
30476
30477 for (i = 0; i < (4096-320)/64; i++) {
30478 __asm__ __volatile__ (
30479 - "1: prefetch 320(%0)\n"
30480 - "2: movq (%0), %%mm0\n"
30481 - " movntq %%mm0, (%1)\n"
30482 - " movq 8(%0), %%mm1\n"
30483 - " movntq %%mm1, 8(%1)\n"
30484 - " movq 16(%0), %%mm2\n"
30485 - " movntq %%mm2, 16(%1)\n"
30486 - " movq 24(%0), %%mm3\n"
30487 - " movntq %%mm3, 24(%1)\n"
30488 - " movq 32(%0), %%mm4\n"
30489 - " movntq %%mm4, 32(%1)\n"
30490 - " movq 40(%0), %%mm5\n"
30491 - " movntq %%mm5, 40(%1)\n"
30492 - " movq 48(%0), %%mm6\n"
30493 - " movntq %%mm6, 48(%1)\n"
30494 - " movq 56(%0), %%mm7\n"
30495 - " movntq %%mm7, 56(%1)\n"
30496 + "1: prefetch 320(%1)\n"
30497 + "2: movq (%1), %%mm0\n"
30498 + " movntq %%mm0, (%2)\n"
30499 + " movq 8(%1), %%mm1\n"
30500 + " movntq %%mm1, 8(%2)\n"
30501 + " movq 16(%1), %%mm2\n"
30502 + " movntq %%mm2, 16(%2)\n"
30503 + " movq 24(%1), %%mm3\n"
30504 + " movntq %%mm3, 24(%2)\n"
30505 + " movq 32(%1), %%mm4\n"
30506 + " movntq %%mm4, 32(%2)\n"
30507 + " movq 40(%1), %%mm5\n"
30508 + " movntq %%mm5, 40(%2)\n"
30509 + " movq 48(%1), %%mm6\n"
30510 + " movntq %%mm6, 48(%2)\n"
30511 + " movq 56(%1), %%mm7\n"
30512 + " movntq %%mm7, 56(%2)\n"
30513 ".section .fixup, \"ax\"\n"
30514 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30515 + "3:\n"
30516 +
30517 +#ifdef CONFIG_PAX_KERNEXEC
30518 + " movl %%cr0, %0\n"
30519 + " movl %0, %%eax\n"
30520 + " andl $0xFFFEFFFF, %%eax\n"
30521 + " movl %%eax, %%cr0\n"
30522 +#endif
30523 +
30524 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30525 +
30526 +#ifdef CONFIG_PAX_KERNEXEC
30527 + " movl %0, %%cr0\n"
30528 +#endif
30529 +
30530 " jmp 2b\n"
30531 ".previous\n"
30532 - _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
30533 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
30534
30535 from += 64;
30536 to += 64;
30537 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
30538 static void fast_copy_page(void *to, void *from)
30539 {
30540 int i;
30541 + unsigned long cr0;
30542
30543 kernel_fpu_begin();
30544
30545 __asm__ __volatile__ (
30546 - "1: prefetch (%0)\n"
30547 - " prefetch 64(%0)\n"
30548 - " prefetch 128(%0)\n"
30549 - " prefetch 192(%0)\n"
30550 - " prefetch 256(%0)\n"
30551 + "1: prefetch (%1)\n"
30552 + " prefetch 64(%1)\n"
30553 + " prefetch 128(%1)\n"
30554 + " prefetch 192(%1)\n"
30555 + " prefetch 256(%1)\n"
30556 "2: \n"
30557 ".section .fixup, \"ax\"\n"
30558 - "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30559 + "3: \n"
30560 +
30561 +#ifdef CONFIG_PAX_KERNEXEC
30562 + " movl %%cr0, %0\n"
30563 + " movl %0, %%eax\n"
30564 + " andl $0xFFFEFFFF, %%eax\n"
30565 + " movl %%eax, %%cr0\n"
30566 +#endif
30567 +
30568 + " movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
30569 +
30570 +#ifdef CONFIG_PAX_KERNEXEC
30571 + " movl %0, %%cr0\n"
30572 +#endif
30573 +
30574 " jmp 2b\n"
30575 ".previous\n"
30576 - _ASM_EXTABLE(1b, 3b) : : "r" (from));
30577 + _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
30578
30579 for (i = 0; i < 4096/64; i++) {
30580 __asm__ __volatile__ (
30581 - "1: prefetch 320(%0)\n"
30582 - "2: movq (%0), %%mm0\n"
30583 - " movq 8(%0), %%mm1\n"
30584 - " movq 16(%0), %%mm2\n"
30585 - " movq 24(%0), %%mm3\n"
30586 - " movq %%mm0, (%1)\n"
30587 - " movq %%mm1, 8(%1)\n"
30588 - " movq %%mm2, 16(%1)\n"
30589 - " movq %%mm3, 24(%1)\n"
30590 - " movq 32(%0), %%mm0\n"
30591 - " movq 40(%0), %%mm1\n"
30592 - " movq 48(%0), %%mm2\n"
30593 - " movq 56(%0), %%mm3\n"
30594 - " movq %%mm0, 32(%1)\n"
30595 - " movq %%mm1, 40(%1)\n"
30596 - " movq %%mm2, 48(%1)\n"
30597 - " movq %%mm3, 56(%1)\n"
30598 + "1: prefetch 320(%1)\n"
30599 + "2: movq (%1), %%mm0\n"
30600 + " movq 8(%1), %%mm1\n"
30601 + " movq 16(%1), %%mm2\n"
30602 + " movq 24(%1), %%mm3\n"
30603 + " movq %%mm0, (%2)\n"
30604 + " movq %%mm1, 8(%2)\n"
30605 + " movq %%mm2, 16(%2)\n"
30606 + " movq %%mm3, 24(%2)\n"
30607 + " movq 32(%1), %%mm0\n"
30608 + " movq 40(%1), %%mm1\n"
30609 + " movq 48(%1), %%mm2\n"
30610 + " movq 56(%1), %%mm3\n"
30611 + " movq %%mm0, 32(%2)\n"
30612 + " movq %%mm1, 40(%2)\n"
30613 + " movq %%mm2, 48(%2)\n"
30614 + " movq %%mm3, 56(%2)\n"
30615 ".section .fixup, \"ax\"\n"
30616 - "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30617 + "3:\n"
30618 +
30619 +#ifdef CONFIG_PAX_KERNEXEC
30620 + " movl %%cr0, %0\n"
30621 + " movl %0, %%eax\n"
30622 + " andl $0xFFFEFFFF, %%eax\n"
30623 + " movl %%eax, %%cr0\n"
30624 +#endif
30625 +
30626 + " movw $0x05EB, 1b\n" /* jmp on 5 bytes */
30627 +
30628 +#ifdef CONFIG_PAX_KERNEXEC
30629 + " movl %0, %%cr0\n"
30630 +#endif
30631 +
30632 " jmp 2b\n"
30633 ".previous\n"
30634 _ASM_EXTABLE(1b, 3b)
30635 - : : "r" (from), "r" (to) : "memory");
30636 + : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
30637
30638 from += 64;
30639 to += 64;
30640 diff --git a/arch/x86/lib/msr-reg.S b/arch/x86/lib/msr-reg.S
30641 index f6d13ee..d789440 100644
30642 --- a/arch/x86/lib/msr-reg.S
30643 +++ b/arch/x86/lib/msr-reg.S
30644 @@ -3,6 +3,7 @@
30645 #include <asm/dwarf2.h>
30646 #include <asm/asm.h>
30647 #include <asm/msr.h>
30648 +#include <asm/alternative-asm.h>
30649
30650 #ifdef CONFIG_X86_64
30651 /*
30652 @@ -37,6 +38,7 @@ ENTRY(\op\()_safe_regs)
30653 movl %edi, 28(%r10)
30654 popq_cfi %rbp
30655 popq_cfi %rbx
30656 + pax_force_retaddr
30657 ret
30658 3:
30659 CFI_RESTORE_STATE
30660 diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
30661 index fc6ba17..d4d989d 100644
30662 --- a/arch/x86/lib/putuser.S
30663 +++ b/arch/x86/lib/putuser.S
30664 @@ -16,7 +16,9 @@
30665 #include <asm/errno.h>
30666 #include <asm/asm.h>
30667 #include <asm/smap.h>
30668 -
30669 +#include <asm/segment.h>
30670 +#include <asm/pgtable.h>
30671 +#include <asm/alternative-asm.h>
30672
30673 /*
30674 * __put_user_X
30675 @@ -30,57 +32,125 @@
30676 * as they get called from within inline assembly.
30677 */
30678
30679 -#define ENTER CFI_STARTPROC ; \
30680 - GET_THREAD_INFO(%_ASM_BX)
30681 -#define EXIT ASM_CLAC ; \
30682 - ret ; \
30683 +#define ENTER CFI_STARTPROC
30684 +#define EXIT ASM_CLAC ; \
30685 + pax_force_retaddr ; \
30686 + ret ; \
30687 CFI_ENDPROC
30688
30689 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30690 +#define _DEST %_ASM_CX,%_ASM_BX
30691 +#else
30692 +#define _DEST %_ASM_CX
30693 +#endif
30694 +
30695 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
30696 +#define __copyuser_seg gs;
30697 +#else
30698 +#define __copyuser_seg
30699 +#endif
30700 +
30701 .text
30702 ENTRY(__put_user_1)
30703 ENTER
30704 +
30705 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30706 + GET_THREAD_INFO(%_ASM_BX)
30707 cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
30708 jae bad_put_user
30709 ASM_STAC
30710 -1: movb %al,(%_ASM_CX)
30711 +
30712 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30713 + mov pax_user_shadow_base,%_ASM_BX
30714 + cmp %_ASM_BX,%_ASM_CX
30715 + jb 1234f
30716 + xor %ebx,%ebx
30717 +1234:
30718 +#endif
30719 +
30720 +#endif
30721 +
30722 +1: __copyuser_seg movb %al,(_DEST)
30723 xor %eax,%eax
30724 EXIT
30725 ENDPROC(__put_user_1)
30726
30727 ENTRY(__put_user_2)
30728 ENTER
30729 +
30730 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30731 + GET_THREAD_INFO(%_ASM_BX)
30732 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
30733 sub $1,%_ASM_BX
30734 cmp %_ASM_BX,%_ASM_CX
30735 jae bad_put_user
30736 ASM_STAC
30737 -2: movw %ax,(%_ASM_CX)
30738 +
30739 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30740 + mov pax_user_shadow_base,%_ASM_BX
30741 + cmp %_ASM_BX,%_ASM_CX
30742 + jb 1234f
30743 + xor %ebx,%ebx
30744 +1234:
30745 +#endif
30746 +
30747 +#endif
30748 +
30749 +2: __copyuser_seg movw %ax,(_DEST)
30750 xor %eax,%eax
30751 EXIT
30752 ENDPROC(__put_user_2)
30753
30754 ENTRY(__put_user_4)
30755 ENTER
30756 +
30757 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30758 + GET_THREAD_INFO(%_ASM_BX)
30759 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
30760 sub $3,%_ASM_BX
30761 cmp %_ASM_BX,%_ASM_CX
30762 jae bad_put_user
30763 ASM_STAC
30764 -3: movl %eax,(%_ASM_CX)
30765 +
30766 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30767 + mov pax_user_shadow_base,%_ASM_BX
30768 + cmp %_ASM_BX,%_ASM_CX
30769 + jb 1234f
30770 + xor %ebx,%ebx
30771 +1234:
30772 +#endif
30773 +
30774 +#endif
30775 +
30776 +3: __copyuser_seg movl %eax,(_DEST)
30777 xor %eax,%eax
30778 EXIT
30779 ENDPROC(__put_user_4)
30780
30781 ENTRY(__put_user_8)
30782 ENTER
30783 +
30784 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
30785 + GET_THREAD_INFO(%_ASM_BX)
30786 mov TI_addr_limit(%_ASM_BX),%_ASM_BX
30787 sub $7,%_ASM_BX
30788 cmp %_ASM_BX,%_ASM_CX
30789 jae bad_put_user
30790 ASM_STAC
30791 -4: mov %_ASM_AX,(%_ASM_CX)
30792 +
30793 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
30794 + mov pax_user_shadow_base,%_ASM_BX
30795 + cmp %_ASM_BX,%_ASM_CX
30796 + jb 1234f
30797 + xor %ebx,%ebx
30798 +1234:
30799 +#endif
30800 +
30801 +#endif
30802 +
30803 +4: __copyuser_seg mov %_ASM_AX,(_DEST)
30804 #ifdef CONFIG_X86_32
30805 -5: movl %edx,4(%_ASM_CX)
30806 +5: __copyuser_seg movl %edx,4(_DEST)
30807 #endif
30808 xor %eax,%eax
30809 EXIT
30810 diff --git a/arch/x86/lib/rwlock.S b/arch/x86/lib/rwlock.S
30811 index 1cad221..de671ee 100644
30812 --- a/arch/x86/lib/rwlock.S
30813 +++ b/arch/x86/lib/rwlock.S
30814 @@ -16,13 +16,34 @@ ENTRY(__write_lock_failed)
30815 FRAME
30816 0: LOCK_PREFIX
30817 WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
30818 +
30819 +#ifdef CONFIG_PAX_REFCOUNT
30820 + jno 1234f
30821 + LOCK_PREFIX
30822 + WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
30823 + int $4
30824 +1234:
30825 + _ASM_EXTABLE(1234b, 1234b)
30826 +#endif
30827 +
30828 1: rep; nop
30829 cmpl $WRITE_LOCK_CMP, (%__lock_ptr)
30830 jne 1b
30831 LOCK_PREFIX
30832 WRITE_LOCK_SUB($RW_LOCK_BIAS) (%__lock_ptr)
30833 +
30834 +#ifdef CONFIG_PAX_REFCOUNT
30835 + jno 1234f
30836 + LOCK_PREFIX
30837 + WRITE_LOCK_ADD($RW_LOCK_BIAS) (%__lock_ptr)
30838 + int $4
30839 +1234:
30840 + _ASM_EXTABLE(1234b, 1234b)
30841 +#endif
30842 +
30843 jnz 0b
30844 ENDFRAME
30845 + pax_force_retaddr
30846 ret
30847 CFI_ENDPROC
30848 END(__write_lock_failed)
30849 @@ -32,13 +53,34 @@ ENTRY(__read_lock_failed)
30850 FRAME
30851 0: LOCK_PREFIX
30852 READ_LOCK_SIZE(inc) (%__lock_ptr)
30853 +
30854 +#ifdef CONFIG_PAX_REFCOUNT
30855 + jno 1234f
30856 + LOCK_PREFIX
30857 + READ_LOCK_SIZE(dec) (%__lock_ptr)
30858 + int $4
30859 +1234:
30860 + _ASM_EXTABLE(1234b, 1234b)
30861 +#endif
30862 +
30863 1: rep; nop
30864 READ_LOCK_SIZE(cmp) $1, (%__lock_ptr)
30865 js 1b
30866 LOCK_PREFIX
30867 READ_LOCK_SIZE(dec) (%__lock_ptr)
30868 +
30869 +#ifdef CONFIG_PAX_REFCOUNT
30870 + jno 1234f
30871 + LOCK_PREFIX
30872 + READ_LOCK_SIZE(inc) (%__lock_ptr)
30873 + int $4
30874 +1234:
30875 + _ASM_EXTABLE(1234b, 1234b)
30876 +#endif
30877 +
30878 js 0b
30879 ENDFRAME
30880 + pax_force_retaddr
30881 ret
30882 CFI_ENDPROC
30883 END(__read_lock_failed)
30884 diff --git a/arch/x86/lib/rwsem.S b/arch/x86/lib/rwsem.S
30885 index 5dff5f0..cadebf4 100644
30886 --- a/arch/x86/lib/rwsem.S
30887 +++ b/arch/x86/lib/rwsem.S
30888 @@ -94,6 +94,7 @@ ENTRY(call_rwsem_down_read_failed)
30889 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
30890 CFI_RESTORE __ASM_REG(dx)
30891 restore_common_regs
30892 + pax_force_retaddr
30893 ret
30894 CFI_ENDPROC
30895 ENDPROC(call_rwsem_down_read_failed)
30896 @@ -104,6 +105,7 @@ ENTRY(call_rwsem_down_write_failed)
30897 movq %rax,%rdi
30898 call rwsem_down_write_failed
30899 restore_common_regs
30900 + pax_force_retaddr
30901 ret
30902 CFI_ENDPROC
30903 ENDPROC(call_rwsem_down_write_failed)
30904 @@ -117,7 +119,8 @@ ENTRY(call_rwsem_wake)
30905 movq %rax,%rdi
30906 call rwsem_wake
30907 restore_common_regs
30908 -1: ret
30909 +1: pax_force_retaddr
30910 + ret
30911 CFI_ENDPROC
30912 ENDPROC(call_rwsem_wake)
30913
30914 @@ -131,6 +134,7 @@ ENTRY(call_rwsem_downgrade_wake)
30915 __ASM_SIZE(pop,_cfi) %__ASM_REG(dx)
30916 CFI_RESTORE __ASM_REG(dx)
30917 restore_common_regs
30918 + pax_force_retaddr
30919 ret
30920 CFI_ENDPROC
30921 ENDPROC(call_rwsem_downgrade_wake)
30922 diff --git a/arch/x86/lib/thunk_64.S b/arch/x86/lib/thunk_64.S
30923 index a63efd6..8149fbe 100644
30924 --- a/arch/x86/lib/thunk_64.S
30925 +++ b/arch/x86/lib/thunk_64.S
30926 @@ -8,6 +8,7 @@
30927 #include <linux/linkage.h>
30928 #include <asm/dwarf2.h>
30929 #include <asm/calling.h>
30930 +#include <asm/alternative-asm.h>
30931
30932 /* rdi: arg1 ... normal C conventions. rax is saved/restored. */
30933 .macro THUNK name, func, put_ret_addr_in_rdi=0
30934 @@ -15,11 +16,11 @@
30935 \name:
30936 CFI_STARTPROC
30937
30938 - /* this one pushes 9 elems, the next one would be %rIP */
30939 - SAVE_ARGS
30940 + /* this one pushes 15+1 elems, the next one would be %rIP */
30941 + SAVE_ARGS 8
30942
30943 .if \put_ret_addr_in_rdi
30944 - movq_cfi_restore 9*8, rdi
30945 + movq_cfi_restore RIP, rdi
30946 .endif
30947
30948 call \func
30949 @@ -38,8 +39,9 @@
30950
30951 /* SAVE_ARGS below is used only for the .cfi directives it contains. */
30952 CFI_STARTPROC
30953 - SAVE_ARGS
30954 + SAVE_ARGS 8
30955 restore:
30956 - RESTORE_ARGS
30957 + RESTORE_ARGS 1,8
30958 + pax_force_retaddr
30959 ret
30960 CFI_ENDPROC
30961 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
30962 index e2f5e21..4b22130 100644
30963 --- a/arch/x86/lib/usercopy_32.c
30964 +++ b/arch/x86/lib/usercopy_32.c
30965 @@ -42,11 +42,13 @@ do { \
30966 int __d0; \
30967 might_fault(); \
30968 __asm__ __volatile__( \
30969 + __COPYUSER_SET_ES \
30970 ASM_STAC "\n" \
30971 "0: rep; stosl\n" \
30972 " movl %2,%0\n" \
30973 "1: rep; stosb\n" \
30974 "2: " ASM_CLAC "\n" \
30975 + __COPYUSER_RESTORE_ES \
30976 ".section .fixup,\"ax\"\n" \
30977 "3: lea 0(%2,%0,4),%0\n" \
30978 " jmp 2b\n" \
30979 @@ -98,7 +100,7 @@ EXPORT_SYMBOL(__clear_user);
30980
30981 #ifdef CONFIG_X86_INTEL_USERCOPY
30982 static unsigned long
30983 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
30984 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
30985 {
30986 int d0, d1;
30987 __asm__ __volatile__(
30988 @@ -110,36 +112,36 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
30989 " .align 2,0x90\n"
30990 "3: movl 0(%4), %%eax\n"
30991 "4: movl 4(%4), %%edx\n"
30992 - "5: movl %%eax, 0(%3)\n"
30993 - "6: movl %%edx, 4(%3)\n"
30994 + "5: "__copyuser_seg" movl %%eax, 0(%3)\n"
30995 + "6: "__copyuser_seg" movl %%edx, 4(%3)\n"
30996 "7: movl 8(%4), %%eax\n"
30997 "8: movl 12(%4),%%edx\n"
30998 - "9: movl %%eax, 8(%3)\n"
30999 - "10: movl %%edx, 12(%3)\n"
31000 + "9: "__copyuser_seg" movl %%eax, 8(%3)\n"
31001 + "10: "__copyuser_seg" movl %%edx, 12(%3)\n"
31002 "11: movl 16(%4), %%eax\n"
31003 "12: movl 20(%4), %%edx\n"
31004 - "13: movl %%eax, 16(%3)\n"
31005 - "14: movl %%edx, 20(%3)\n"
31006 + "13: "__copyuser_seg" movl %%eax, 16(%3)\n"
31007 + "14: "__copyuser_seg" movl %%edx, 20(%3)\n"
31008 "15: movl 24(%4), %%eax\n"
31009 "16: movl 28(%4), %%edx\n"
31010 - "17: movl %%eax, 24(%3)\n"
31011 - "18: movl %%edx, 28(%3)\n"
31012 + "17: "__copyuser_seg" movl %%eax, 24(%3)\n"
31013 + "18: "__copyuser_seg" movl %%edx, 28(%3)\n"
31014 "19: movl 32(%4), %%eax\n"
31015 "20: movl 36(%4), %%edx\n"
31016 - "21: movl %%eax, 32(%3)\n"
31017 - "22: movl %%edx, 36(%3)\n"
31018 + "21: "__copyuser_seg" movl %%eax, 32(%3)\n"
31019 + "22: "__copyuser_seg" movl %%edx, 36(%3)\n"
31020 "23: movl 40(%4), %%eax\n"
31021 "24: movl 44(%4), %%edx\n"
31022 - "25: movl %%eax, 40(%3)\n"
31023 - "26: movl %%edx, 44(%3)\n"
31024 + "25: "__copyuser_seg" movl %%eax, 40(%3)\n"
31025 + "26: "__copyuser_seg" movl %%edx, 44(%3)\n"
31026 "27: movl 48(%4), %%eax\n"
31027 "28: movl 52(%4), %%edx\n"
31028 - "29: movl %%eax, 48(%3)\n"
31029 - "30: movl %%edx, 52(%3)\n"
31030 + "29: "__copyuser_seg" movl %%eax, 48(%3)\n"
31031 + "30: "__copyuser_seg" movl %%edx, 52(%3)\n"
31032 "31: movl 56(%4), %%eax\n"
31033 "32: movl 60(%4), %%edx\n"
31034 - "33: movl %%eax, 56(%3)\n"
31035 - "34: movl %%edx, 60(%3)\n"
31036 + "33: "__copyuser_seg" movl %%eax, 56(%3)\n"
31037 + "34: "__copyuser_seg" movl %%edx, 60(%3)\n"
31038 " addl $-64, %0\n"
31039 " addl $64, %4\n"
31040 " addl $64, %3\n"
31041 @@ -149,10 +151,116 @@ __copy_user_intel(void __user *to, const void *from, unsigned long size)
31042 " shrl $2, %0\n"
31043 " andl $3, %%eax\n"
31044 " cld\n"
31045 + __COPYUSER_SET_ES
31046 "99: rep; movsl\n"
31047 "36: movl %%eax, %0\n"
31048 "37: rep; movsb\n"
31049 "100:\n"
31050 + __COPYUSER_RESTORE_ES
31051 + ".section .fixup,\"ax\"\n"
31052 + "101: lea 0(%%eax,%0,4),%0\n"
31053 + " jmp 100b\n"
31054 + ".previous\n"
31055 + _ASM_EXTABLE(1b,100b)
31056 + _ASM_EXTABLE(2b,100b)
31057 + _ASM_EXTABLE(3b,100b)
31058 + _ASM_EXTABLE(4b,100b)
31059 + _ASM_EXTABLE(5b,100b)
31060 + _ASM_EXTABLE(6b,100b)
31061 + _ASM_EXTABLE(7b,100b)
31062 + _ASM_EXTABLE(8b,100b)
31063 + _ASM_EXTABLE(9b,100b)
31064 + _ASM_EXTABLE(10b,100b)
31065 + _ASM_EXTABLE(11b,100b)
31066 + _ASM_EXTABLE(12b,100b)
31067 + _ASM_EXTABLE(13b,100b)
31068 + _ASM_EXTABLE(14b,100b)
31069 + _ASM_EXTABLE(15b,100b)
31070 + _ASM_EXTABLE(16b,100b)
31071 + _ASM_EXTABLE(17b,100b)
31072 + _ASM_EXTABLE(18b,100b)
31073 + _ASM_EXTABLE(19b,100b)
31074 + _ASM_EXTABLE(20b,100b)
31075 + _ASM_EXTABLE(21b,100b)
31076 + _ASM_EXTABLE(22b,100b)
31077 + _ASM_EXTABLE(23b,100b)
31078 + _ASM_EXTABLE(24b,100b)
31079 + _ASM_EXTABLE(25b,100b)
31080 + _ASM_EXTABLE(26b,100b)
31081 + _ASM_EXTABLE(27b,100b)
31082 + _ASM_EXTABLE(28b,100b)
31083 + _ASM_EXTABLE(29b,100b)
31084 + _ASM_EXTABLE(30b,100b)
31085 + _ASM_EXTABLE(31b,100b)
31086 + _ASM_EXTABLE(32b,100b)
31087 + _ASM_EXTABLE(33b,100b)
31088 + _ASM_EXTABLE(34b,100b)
31089 + _ASM_EXTABLE(35b,100b)
31090 + _ASM_EXTABLE(36b,100b)
31091 + _ASM_EXTABLE(37b,100b)
31092 + _ASM_EXTABLE(99b,101b)
31093 + : "=&c"(size), "=&D" (d0), "=&S" (d1)
31094 + : "1"(to), "2"(from), "0"(size)
31095 + : "eax", "edx", "memory");
31096 + return size;
31097 +}
31098 +
31099 +static unsigned long
31100 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
31101 +{
31102 + int d0, d1;
31103 + __asm__ __volatile__(
31104 + " .align 2,0x90\n"
31105 + "1: "__copyuser_seg" movl 32(%4), %%eax\n"
31106 + " cmpl $67, %0\n"
31107 + " jbe 3f\n"
31108 + "2: "__copyuser_seg" movl 64(%4), %%eax\n"
31109 + " .align 2,0x90\n"
31110 + "3: "__copyuser_seg" movl 0(%4), %%eax\n"
31111 + "4: "__copyuser_seg" movl 4(%4), %%edx\n"
31112 + "5: movl %%eax, 0(%3)\n"
31113 + "6: movl %%edx, 4(%3)\n"
31114 + "7: "__copyuser_seg" movl 8(%4), %%eax\n"
31115 + "8: "__copyuser_seg" movl 12(%4),%%edx\n"
31116 + "9: movl %%eax, 8(%3)\n"
31117 + "10: movl %%edx, 12(%3)\n"
31118 + "11: "__copyuser_seg" movl 16(%4), %%eax\n"
31119 + "12: "__copyuser_seg" movl 20(%4), %%edx\n"
31120 + "13: movl %%eax, 16(%3)\n"
31121 + "14: movl %%edx, 20(%3)\n"
31122 + "15: "__copyuser_seg" movl 24(%4), %%eax\n"
31123 + "16: "__copyuser_seg" movl 28(%4), %%edx\n"
31124 + "17: movl %%eax, 24(%3)\n"
31125 + "18: movl %%edx, 28(%3)\n"
31126 + "19: "__copyuser_seg" movl 32(%4), %%eax\n"
31127 + "20: "__copyuser_seg" movl 36(%4), %%edx\n"
31128 + "21: movl %%eax, 32(%3)\n"
31129 + "22: movl %%edx, 36(%3)\n"
31130 + "23: "__copyuser_seg" movl 40(%4), %%eax\n"
31131 + "24: "__copyuser_seg" movl 44(%4), %%edx\n"
31132 + "25: movl %%eax, 40(%3)\n"
31133 + "26: movl %%edx, 44(%3)\n"
31134 + "27: "__copyuser_seg" movl 48(%4), %%eax\n"
31135 + "28: "__copyuser_seg" movl 52(%4), %%edx\n"
31136 + "29: movl %%eax, 48(%3)\n"
31137 + "30: movl %%edx, 52(%3)\n"
31138 + "31: "__copyuser_seg" movl 56(%4), %%eax\n"
31139 + "32: "__copyuser_seg" movl 60(%4), %%edx\n"
31140 + "33: movl %%eax, 56(%3)\n"
31141 + "34: movl %%edx, 60(%3)\n"
31142 + " addl $-64, %0\n"
31143 + " addl $64, %4\n"
31144 + " addl $64, %3\n"
31145 + " cmpl $63, %0\n"
31146 + " ja 1b\n"
31147 + "35: movl %0, %%eax\n"
31148 + " shrl $2, %0\n"
31149 + " andl $3, %%eax\n"
31150 + " cld\n"
31151 + "99: rep; "__copyuser_seg" movsl\n"
31152 + "36: movl %%eax, %0\n"
31153 + "37: rep; "__copyuser_seg" movsb\n"
31154 + "100:\n"
31155 ".section .fixup,\"ax\"\n"
31156 "101: lea 0(%%eax,%0,4),%0\n"
31157 " jmp 100b\n"
31158 @@ -207,41 +315,41 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
31159 int d0, d1;
31160 __asm__ __volatile__(
31161 " .align 2,0x90\n"
31162 - "0: movl 32(%4), %%eax\n"
31163 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31164 " cmpl $67, %0\n"
31165 " jbe 2f\n"
31166 - "1: movl 64(%4), %%eax\n"
31167 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31168 " .align 2,0x90\n"
31169 - "2: movl 0(%4), %%eax\n"
31170 - "21: movl 4(%4), %%edx\n"
31171 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31172 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31173 " movl %%eax, 0(%3)\n"
31174 " movl %%edx, 4(%3)\n"
31175 - "3: movl 8(%4), %%eax\n"
31176 - "31: movl 12(%4),%%edx\n"
31177 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31178 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31179 " movl %%eax, 8(%3)\n"
31180 " movl %%edx, 12(%3)\n"
31181 - "4: movl 16(%4), %%eax\n"
31182 - "41: movl 20(%4), %%edx\n"
31183 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31184 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31185 " movl %%eax, 16(%3)\n"
31186 " movl %%edx, 20(%3)\n"
31187 - "10: movl 24(%4), %%eax\n"
31188 - "51: movl 28(%4), %%edx\n"
31189 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31190 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31191 " movl %%eax, 24(%3)\n"
31192 " movl %%edx, 28(%3)\n"
31193 - "11: movl 32(%4), %%eax\n"
31194 - "61: movl 36(%4), %%edx\n"
31195 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31196 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31197 " movl %%eax, 32(%3)\n"
31198 " movl %%edx, 36(%3)\n"
31199 - "12: movl 40(%4), %%eax\n"
31200 - "71: movl 44(%4), %%edx\n"
31201 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31202 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31203 " movl %%eax, 40(%3)\n"
31204 " movl %%edx, 44(%3)\n"
31205 - "13: movl 48(%4), %%eax\n"
31206 - "81: movl 52(%4), %%edx\n"
31207 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31208 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31209 " movl %%eax, 48(%3)\n"
31210 " movl %%edx, 52(%3)\n"
31211 - "14: movl 56(%4), %%eax\n"
31212 - "91: movl 60(%4), %%edx\n"
31213 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31214 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31215 " movl %%eax, 56(%3)\n"
31216 " movl %%edx, 60(%3)\n"
31217 " addl $-64, %0\n"
31218 @@ -253,9 +361,9 @@ __copy_user_zeroing_intel(void *to, const void __user *from, unsigned long size)
31219 " shrl $2, %0\n"
31220 " andl $3, %%eax\n"
31221 " cld\n"
31222 - "6: rep; movsl\n"
31223 + "6: rep; "__copyuser_seg" movsl\n"
31224 " movl %%eax,%0\n"
31225 - "7: rep; movsb\n"
31226 + "7: rep; "__copyuser_seg" movsb\n"
31227 "8:\n"
31228 ".section .fixup,\"ax\"\n"
31229 "9: lea 0(%%eax,%0,4),%0\n"
31230 @@ -305,41 +413,41 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
31231
31232 __asm__ __volatile__(
31233 " .align 2,0x90\n"
31234 - "0: movl 32(%4), %%eax\n"
31235 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31236 " cmpl $67, %0\n"
31237 " jbe 2f\n"
31238 - "1: movl 64(%4), %%eax\n"
31239 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31240 " .align 2,0x90\n"
31241 - "2: movl 0(%4), %%eax\n"
31242 - "21: movl 4(%4), %%edx\n"
31243 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31244 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31245 " movnti %%eax, 0(%3)\n"
31246 " movnti %%edx, 4(%3)\n"
31247 - "3: movl 8(%4), %%eax\n"
31248 - "31: movl 12(%4),%%edx\n"
31249 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31250 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31251 " movnti %%eax, 8(%3)\n"
31252 " movnti %%edx, 12(%3)\n"
31253 - "4: movl 16(%4), %%eax\n"
31254 - "41: movl 20(%4), %%edx\n"
31255 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31256 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31257 " movnti %%eax, 16(%3)\n"
31258 " movnti %%edx, 20(%3)\n"
31259 - "10: movl 24(%4), %%eax\n"
31260 - "51: movl 28(%4), %%edx\n"
31261 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31262 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31263 " movnti %%eax, 24(%3)\n"
31264 " movnti %%edx, 28(%3)\n"
31265 - "11: movl 32(%4), %%eax\n"
31266 - "61: movl 36(%4), %%edx\n"
31267 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31268 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31269 " movnti %%eax, 32(%3)\n"
31270 " movnti %%edx, 36(%3)\n"
31271 - "12: movl 40(%4), %%eax\n"
31272 - "71: movl 44(%4), %%edx\n"
31273 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31274 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31275 " movnti %%eax, 40(%3)\n"
31276 " movnti %%edx, 44(%3)\n"
31277 - "13: movl 48(%4), %%eax\n"
31278 - "81: movl 52(%4), %%edx\n"
31279 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31280 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31281 " movnti %%eax, 48(%3)\n"
31282 " movnti %%edx, 52(%3)\n"
31283 - "14: movl 56(%4), %%eax\n"
31284 - "91: movl 60(%4), %%edx\n"
31285 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31286 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31287 " movnti %%eax, 56(%3)\n"
31288 " movnti %%edx, 60(%3)\n"
31289 " addl $-64, %0\n"
31290 @@ -352,9 +460,9 @@ static unsigned long __copy_user_zeroing_intel_nocache(void *to,
31291 " shrl $2, %0\n"
31292 " andl $3, %%eax\n"
31293 " cld\n"
31294 - "6: rep; movsl\n"
31295 + "6: rep; "__copyuser_seg" movsl\n"
31296 " movl %%eax,%0\n"
31297 - "7: rep; movsb\n"
31298 + "7: rep; "__copyuser_seg" movsb\n"
31299 "8:\n"
31300 ".section .fixup,\"ax\"\n"
31301 "9: lea 0(%%eax,%0,4),%0\n"
31302 @@ -399,41 +507,41 @@ static unsigned long __copy_user_intel_nocache(void *to,
31303
31304 __asm__ __volatile__(
31305 " .align 2,0x90\n"
31306 - "0: movl 32(%4), %%eax\n"
31307 + "0: "__copyuser_seg" movl 32(%4), %%eax\n"
31308 " cmpl $67, %0\n"
31309 " jbe 2f\n"
31310 - "1: movl 64(%4), %%eax\n"
31311 + "1: "__copyuser_seg" movl 64(%4), %%eax\n"
31312 " .align 2,0x90\n"
31313 - "2: movl 0(%4), %%eax\n"
31314 - "21: movl 4(%4), %%edx\n"
31315 + "2: "__copyuser_seg" movl 0(%4), %%eax\n"
31316 + "21: "__copyuser_seg" movl 4(%4), %%edx\n"
31317 " movnti %%eax, 0(%3)\n"
31318 " movnti %%edx, 4(%3)\n"
31319 - "3: movl 8(%4), %%eax\n"
31320 - "31: movl 12(%4),%%edx\n"
31321 + "3: "__copyuser_seg" movl 8(%4), %%eax\n"
31322 + "31: "__copyuser_seg" movl 12(%4),%%edx\n"
31323 " movnti %%eax, 8(%3)\n"
31324 " movnti %%edx, 12(%3)\n"
31325 - "4: movl 16(%4), %%eax\n"
31326 - "41: movl 20(%4), %%edx\n"
31327 + "4: "__copyuser_seg" movl 16(%4), %%eax\n"
31328 + "41: "__copyuser_seg" movl 20(%4), %%edx\n"
31329 " movnti %%eax, 16(%3)\n"
31330 " movnti %%edx, 20(%3)\n"
31331 - "10: movl 24(%4), %%eax\n"
31332 - "51: movl 28(%4), %%edx\n"
31333 + "10: "__copyuser_seg" movl 24(%4), %%eax\n"
31334 + "51: "__copyuser_seg" movl 28(%4), %%edx\n"
31335 " movnti %%eax, 24(%3)\n"
31336 " movnti %%edx, 28(%3)\n"
31337 - "11: movl 32(%4), %%eax\n"
31338 - "61: movl 36(%4), %%edx\n"
31339 + "11: "__copyuser_seg" movl 32(%4), %%eax\n"
31340 + "61: "__copyuser_seg" movl 36(%4), %%edx\n"
31341 " movnti %%eax, 32(%3)\n"
31342 " movnti %%edx, 36(%3)\n"
31343 - "12: movl 40(%4), %%eax\n"
31344 - "71: movl 44(%4), %%edx\n"
31345 + "12: "__copyuser_seg" movl 40(%4), %%eax\n"
31346 + "71: "__copyuser_seg" movl 44(%4), %%edx\n"
31347 " movnti %%eax, 40(%3)\n"
31348 " movnti %%edx, 44(%3)\n"
31349 - "13: movl 48(%4), %%eax\n"
31350 - "81: movl 52(%4), %%edx\n"
31351 + "13: "__copyuser_seg" movl 48(%4), %%eax\n"
31352 + "81: "__copyuser_seg" movl 52(%4), %%edx\n"
31353 " movnti %%eax, 48(%3)\n"
31354 " movnti %%edx, 52(%3)\n"
31355 - "14: movl 56(%4), %%eax\n"
31356 - "91: movl 60(%4), %%edx\n"
31357 + "14: "__copyuser_seg" movl 56(%4), %%eax\n"
31358 + "91: "__copyuser_seg" movl 60(%4), %%edx\n"
31359 " movnti %%eax, 56(%3)\n"
31360 " movnti %%edx, 60(%3)\n"
31361 " addl $-64, %0\n"
31362 @@ -446,9 +554,9 @@ static unsigned long __copy_user_intel_nocache(void *to,
31363 " shrl $2, %0\n"
31364 " andl $3, %%eax\n"
31365 " cld\n"
31366 - "6: rep; movsl\n"
31367 + "6: rep; "__copyuser_seg" movsl\n"
31368 " movl %%eax,%0\n"
31369 - "7: rep; movsb\n"
31370 + "7: rep; "__copyuser_seg" movsb\n"
31371 "8:\n"
31372 ".section .fixup,\"ax\"\n"
31373 "9: lea 0(%%eax,%0,4),%0\n"
31374 @@ -488,32 +596,36 @@ static unsigned long __copy_user_intel_nocache(void *to,
31375 */
31376 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
31377 unsigned long size);
31378 -unsigned long __copy_user_intel(void __user *to, const void *from,
31379 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
31380 + unsigned long size);
31381 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
31382 unsigned long size);
31383 unsigned long __copy_user_zeroing_intel_nocache(void *to,
31384 const void __user *from, unsigned long size);
31385 #endif /* CONFIG_X86_INTEL_USERCOPY */
31386
31387 /* Generic arbitrary sized copy. */
31388 -#define __copy_user(to, from, size) \
31389 +#define __copy_user(to, from, size, prefix, set, restore) \
31390 do { \
31391 int __d0, __d1, __d2; \
31392 __asm__ __volatile__( \
31393 + set \
31394 " cmp $7,%0\n" \
31395 " jbe 1f\n" \
31396 " movl %1,%0\n" \
31397 " negl %0\n" \
31398 " andl $7,%0\n" \
31399 " subl %0,%3\n" \
31400 - "4: rep; movsb\n" \
31401 + "4: rep; "prefix"movsb\n" \
31402 " movl %3,%0\n" \
31403 " shrl $2,%0\n" \
31404 " andl $3,%3\n" \
31405 " .align 2,0x90\n" \
31406 - "0: rep; movsl\n" \
31407 + "0: rep; "prefix"movsl\n" \
31408 " movl %3,%0\n" \
31409 - "1: rep; movsb\n" \
31410 + "1: rep; "prefix"movsb\n" \
31411 "2:\n" \
31412 + restore \
31413 ".section .fixup,\"ax\"\n" \
31414 "5: addl %3,%0\n" \
31415 " jmp 2b\n" \
31416 @@ -538,14 +650,14 @@ do { \
31417 " negl %0\n" \
31418 " andl $7,%0\n" \
31419 " subl %0,%3\n" \
31420 - "4: rep; movsb\n" \
31421 + "4: rep; "__copyuser_seg"movsb\n" \
31422 " movl %3,%0\n" \
31423 " shrl $2,%0\n" \
31424 " andl $3,%3\n" \
31425 " .align 2,0x90\n" \
31426 - "0: rep; movsl\n" \
31427 + "0: rep; "__copyuser_seg"movsl\n" \
31428 " movl %3,%0\n" \
31429 - "1: rep; movsb\n" \
31430 + "1: rep; "__copyuser_seg"movsb\n" \
31431 "2:\n" \
31432 ".section .fixup,\"ax\"\n" \
31433 "5: addl %3,%0\n" \
31434 @@ -572,9 +684,9 @@ unsigned long __copy_to_user_ll(void __user *to, const void *from,
31435 {
31436 stac();
31437 if (movsl_is_ok(to, from, n))
31438 - __copy_user(to, from, n);
31439 + __copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
31440 else
31441 - n = __copy_user_intel(to, from, n);
31442 + n = __generic_copy_to_user_intel(to, from, n);
31443 clac();
31444 return n;
31445 }
31446 @@ -598,10 +710,9 @@ unsigned long __copy_from_user_ll_nozero(void *to, const void __user *from,
31447 {
31448 stac();
31449 if (movsl_is_ok(to, from, n))
31450 - __copy_user(to, from, n);
31451 + __copy_user(to, from, n, __copyuser_seg, "", "");
31452 else
31453 - n = __copy_user_intel((void __user *)to,
31454 - (const void *)from, n);
31455 + n = __generic_copy_from_user_intel(to, from, n);
31456 clac();
31457 return n;
31458 }
31459 @@ -632,58 +743,38 @@ unsigned long __copy_from_user_ll_nocache_nozero(void *to, const void __user *fr
31460 if (n > 64 && cpu_has_xmm2)
31461 n = __copy_user_intel_nocache(to, from, n);
31462 else
31463 - __copy_user(to, from, n);
31464 + __copy_user(to, from, n, __copyuser_seg, "", "");
31465 #else
31466 - __copy_user(to, from, n);
31467 + __copy_user(to, from, n, __copyuser_seg, "", "");
31468 #endif
31469 clac();
31470 return n;
31471 }
31472 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
31473
31474 -/**
31475 - * copy_to_user: - Copy a block of data into user space.
31476 - * @to: Destination address, in user space.
31477 - * @from: Source address, in kernel space.
31478 - * @n: Number of bytes to copy.
31479 - *
31480 - * Context: User context only. This function may sleep.
31481 - *
31482 - * Copy data from kernel space to user space.
31483 - *
31484 - * Returns number of bytes that could not be copied.
31485 - * On success, this will be zero.
31486 - */
31487 -unsigned long _copy_to_user(void __user *to, const void *from, unsigned n)
31488 +#ifdef CONFIG_PAX_MEMORY_UDEREF
31489 +void __set_fs(mm_segment_t x)
31490 {
31491 - if (access_ok(VERIFY_WRITE, to, n))
31492 - n = __copy_to_user(to, from, n);
31493 - return n;
31494 + switch (x.seg) {
31495 + case 0:
31496 + loadsegment(gs, 0);
31497 + break;
31498 + case TASK_SIZE_MAX:
31499 + loadsegment(gs, __USER_DS);
31500 + break;
31501 + case -1UL:
31502 + loadsegment(gs, __KERNEL_DS);
31503 + break;
31504 + default:
31505 + BUG();
31506 + }
31507 }
31508 -EXPORT_SYMBOL(_copy_to_user);
31509 +EXPORT_SYMBOL(__set_fs);
31510
31511 -/**
31512 - * copy_from_user: - Copy a block of data from user space.
31513 - * @to: Destination address, in kernel space.
31514 - * @from: Source address, in user space.
31515 - * @n: Number of bytes to copy.
31516 - *
31517 - * Context: User context only. This function may sleep.
31518 - *
31519 - * Copy data from user space to kernel space.
31520 - *
31521 - * Returns number of bytes that could not be copied.
31522 - * On success, this will be zero.
31523 - *
31524 - * If some data could not be copied, this function will pad the copied
31525 - * data to the requested size using zero bytes.
31526 - */
31527 -unsigned long _copy_from_user(void *to, const void __user *from, unsigned n)
31528 +void set_fs(mm_segment_t x)
31529 {
31530 - if (access_ok(VERIFY_READ, from, n))
31531 - n = __copy_from_user(to, from, n);
31532 - else
31533 - memset(to, 0, n);
31534 - return n;
31535 + current_thread_info()->addr_limit = x;
31536 + __set_fs(x);
31537 }
31538 -EXPORT_SYMBOL(_copy_from_user);
31539 +EXPORT_SYMBOL(set_fs);
31540 +#endif
31541 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
31542 index c905e89..01ab928 100644
31543 --- a/arch/x86/lib/usercopy_64.c
31544 +++ b/arch/x86/lib/usercopy_64.c
31545 @@ -18,6 +18,7 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
31546 might_fault();
31547 /* no memory constraint because it doesn't change any memory gcc knows
31548 about */
31549 + pax_open_userland();
31550 stac();
31551 asm volatile(
31552 " testq %[size8],%[size8]\n"
31553 @@ -39,9 +40,10 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
31554 _ASM_EXTABLE(0b,3b)
31555 _ASM_EXTABLE(1b,2b)
31556 : [size8] "=&c"(size), [dst] "=&D" (__d0)
31557 - : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(addr),
31558 + : [size1] "r"(size & 7), "[size8]" (size / 8), "[dst]"(____m(addr)),
31559 [zero] "r" (0UL), [eight] "r" (8UL));
31560 clac();
31561 + pax_close_userland();
31562 return size;
31563 }
31564 EXPORT_SYMBOL(__clear_user);
31565 @@ -54,12 +56,11 @@ unsigned long clear_user(void __user *to, unsigned long n)
31566 }
31567 EXPORT_SYMBOL(clear_user);
31568
31569 -unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
31570 +unsigned long copy_in_user(void __user *to, const void __user *from, unsigned long len)
31571 {
31572 - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
31573 - return copy_user_generic((__force void *)to, (__force void *)from, len);
31574 - }
31575 - return len;
31576 + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len))
31577 + return copy_user_generic((void __force_kernel *)____m(to), (void __force_kernel *)____m(from), len);
31578 + return len;
31579 }
31580 EXPORT_SYMBOL(copy_in_user);
31581
31582 @@ -69,11 +70,13 @@ EXPORT_SYMBOL(copy_in_user);
31583 * it is not necessary to optimize tail handling.
31584 */
31585 __visible unsigned long
31586 -copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
31587 +copy_user_handle_tail(char __user *to, char __user *from, unsigned long len, unsigned zerorest)
31588 {
31589 char c;
31590 unsigned zero_len;
31591
31592 + clac();
31593 + pax_close_userland();
31594 for (; len; --len, to++) {
31595 if (__get_user_nocheck(c, from++, sizeof(char)))
31596 break;
31597 @@ -84,6 +87,5 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
31598 for (c = 0, zero_len = len; zerorest && zero_len; --zero_len)
31599 if (__put_user_nocheck(c, to++, sizeof(char)))
31600 break;
31601 - clac();
31602 return len;
31603 }
31604 diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
31605 index 6a19ad9..1c48f9a 100644
31606 --- a/arch/x86/mm/Makefile
31607 +++ b/arch/x86/mm/Makefile
31608 @@ -30,3 +30,7 @@ obj-$(CONFIG_ACPI_NUMA) += srat.o
31609 obj-$(CONFIG_NUMA_EMU) += numa_emulation.o
31610
31611 obj-$(CONFIG_MEMTEST) += memtest.o
31612 +
31613 +quote:="
31614 +obj-$(CONFIG_X86_64) += uderef_64.o
31615 +CFLAGS_uderef_64.o := $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS))
31616 diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
31617 index 903ec1e..c4166b2 100644
31618 --- a/arch/x86/mm/extable.c
31619 +++ b/arch/x86/mm/extable.c
31620 @@ -6,12 +6,24 @@
31621 static inline unsigned long
31622 ex_insn_addr(const struct exception_table_entry *x)
31623 {
31624 - return (unsigned long)&x->insn + x->insn;
31625 + unsigned long reloc = 0;
31626 +
31627 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31628 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
31629 +#endif
31630 +
31631 + return (unsigned long)&x->insn + x->insn + reloc;
31632 }
31633 static inline unsigned long
31634 ex_fixup_addr(const struct exception_table_entry *x)
31635 {
31636 - return (unsigned long)&x->fixup + x->fixup;
31637 + unsigned long reloc = 0;
31638 +
31639 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31640 + reloc = ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
31641 +#endif
31642 +
31643 + return (unsigned long)&x->fixup + x->fixup + reloc;
31644 }
31645
31646 int fixup_exception(struct pt_regs *regs)
31647 @@ -20,7 +32,7 @@ int fixup_exception(struct pt_regs *regs)
31648 unsigned long new_ip;
31649
31650 #ifdef CONFIG_PNPBIOS
31651 - if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
31652 + if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
31653 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
31654 extern u32 pnp_bios_is_utter_crap;
31655 pnp_bios_is_utter_crap = 1;
31656 @@ -145,6 +157,13 @@ void sort_extable(struct exception_table_entry *start,
31657 i += 4;
31658 p->fixup -= i;
31659 i += 4;
31660 +
31661 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
31662 + BUILD_BUG_ON(!IS_ENABLED(CONFIG_BUILDTIME_EXTABLE_SORT));
31663 + p->insn -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
31664 + p->fixup -= ____LOAD_PHYSICAL_ADDR - LOAD_PHYSICAL_ADDR;
31665 +#endif
31666 +
31667 }
31668 }
31669
31670 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
31671 index a10c8c7..35a5abb 100644
31672 --- a/arch/x86/mm/fault.c
31673 +++ b/arch/x86/mm/fault.c
31674 @@ -14,11 +14,18 @@
31675 #include <linux/hugetlb.h> /* hstate_index_to_shift */
31676 #include <linux/prefetch.h> /* prefetchw */
31677 #include <linux/context_tracking.h> /* exception_enter(), ... */
31678 +#include <linux/unistd.h>
31679 +#include <linux/compiler.h>
31680
31681 #include <asm/traps.h> /* dotraplinkage, ... */
31682 #include <asm/pgalloc.h> /* pgd_*(), ... */
31683 #include <asm/kmemcheck.h> /* kmemcheck_*(), ... */
31684 #include <asm/fixmap.h> /* VSYSCALL_START */
31685 +#include <asm/tlbflush.h>
31686 +
31687 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
31688 +#include <asm/stacktrace.h>
31689 +#endif
31690
31691 #define CREATE_TRACE_POINTS
31692 #include <asm/trace/exceptions.h>
31693 @@ -59,7 +66,7 @@ static inline int __kprobes kprobes_fault(struct pt_regs *regs)
31694 int ret = 0;
31695
31696 /* kprobe_running() needs smp_processor_id() */
31697 - if (kprobes_built_in() && !user_mode_vm(regs)) {
31698 + if (kprobes_built_in() && !user_mode(regs)) {
31699 preempt_disable();
31700 if (kprobe_running() && kprobe_fault_handler(regs, 14))
31701 ret = 1;
31702 @@ -120,7 +127,10 @@ check_prefetch_opcode(struct pt_regs *regs, unsigned char *instr,
31703 return !instr_lo || (instr_lo>>1) == 1;
31704 case 0x00:
31705 /* Prefetch instruction is 0x0F0D or 0x0F18 */
31706 - if (probe_kernel_address(instr, opcode))
31707 + if (user_mode(regs)) {
31708 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
31709 + return 0;
31710 + } else if (probe_kernel_address(instr, opcode))
31711 return 0;
31712
31713 *prefetch = (instr_lo == 0xF) &&
31714 @@ -154,7 +164,10 @@ is_prefetch(struct pt_regs *regs, unsigned long error_code, unsigned long addr)
31715 while (instr < max_instr) {
31716 unsigned char opcode;
31717
31718 - if (probe_kernel_address(instr, opcode))
31719 + if (user_mode(regs)) {
31720 + if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1))
31721 + break;
31722 + } else if (probe_kernel_address(instr, opcode))
31723 break;
31724
31725 instr++;
31726 @@ -185,6 +198,34 @@ force_sig_info_fault(int si_signo, int si_code, unsigned long address,
31727 force_sig_info(si_signo, &info, tsk);
31728 }
31729
31730 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
31731 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address);
31732 +#endif
31733 +
31734 +#ifdef CONFIG_PAX_EMUTRAMP
31735 +static int pax_handle_fetch_fault(struct pt_regs *regs);
31736 +#endif
31737 +
31738 +#ifdef CONFIG_PAX_PAGEEXEC
31739 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
31740 +{
31741 + pgd_t *pgd;
31742 + pud_t *pud;
31743 + pmd_t *pmd;
31744 +
31745 + pgd = pgd_offset(mm, address);
31746 + if (!pgd_present(*pgd))
31747 + return NULL;
31748 + pud = pud_offset(pgd, address);
31749 + if (!pud_present(*pud))
31750 + return NULL;
31751 + pmd = pmd_offset(pud, address);
31752 + if (!pmd_present(*pmd))
31753 + return NULL;
31754 + return pmd;
31755 +}
31756 +#endif
31757 +
31758 DEFINE_SPINLOCK(pgd_lock);
31759 LIST_HEAD(pgd_list);
31760
31761 @@ -235,10 +276,27 @@ void vmalloc_sync_all(void)
31762 for (address = VMALLOC_START & PMD_MASK;
31763 address >= TASK_SIZE && address < FIXADDR_TOP;
31764 address += PMD_SIZE) {
31765 +
31766 +#ifdef CONFIG_PAX_PER_CPU_PGD
31767 + unsigned long cpu;
31768 +#else
31769 struct page *page;
31770 +#endif
31771
31772 spin_lock(&pgd_lock);
31773 +
31774 +#ifdef CONFIG_PAX_PER_CPU_PGD
31775 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
31776 + pgd_t *pgd = get_cpu_pgd(cpu, user);
31777 + pmd_t *ret;
31778 +
31779 + ret = vmalloc_sync_one(pgd, address);
31780 + if (!ret)
31781 + break;
31782 + pgd = get_cpu_pgd(cpu, kernel);
31783 +#else
31784 list_for_each_entry(page, &pgd_list, lru) {
31785 + pgd_t *pgd;
31786 spinlock_t *pgt_lock;
31787 pmd_t *ret;
31788
31789 @@ -246,8 +304,14 @@ void vmalloc_sync_all(void)
31790 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
31791
31792 spin_lock(pgt_lock);
31793 - ret = vmalloc_sync_one(page_address(page), address);
31794 + pgd = page_address(page);
31795 +#endif
31796 +
31797 + ret = vmalloc_sync_one(pgd, address);
31798 +
31799 +#ifndef CONFIG_PAX_PER_CPU_PGD
31800 spin_unlock(pgt_lock);
31801 +#endif
31802
31803 if (!ret)
31804 break;
31805 @@ -281,6 +345,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
31806 * an interrupt in the middle of a task switch..
31807 */
31808 pgd_paddr = read_cr3();
31809 +
31810 +#ifdef CONFIG_PAX_PER_CPU_PGD
31811 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id(), kernel)) != (pgd_paddr & __PHYSICAL_MASK));
31812 + vmalloc_sync_one(__va(pgd_paddr + PAGE_SIZE), address);
31813 +#endif
31814 +
31815 pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
31816 if (!pmd_k)
31817 return -1;
31818 @@ -376,11 +446,25 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
31819 * happen within a race in page table update. In the later
31820 * case just flush:
31821 */
31822 - pgd = pgd_offset(current->active_mm, address);
31823 +
31824 pgd_ref = pgd_offset_k(address);
31825 if (pgd_none(*pgd_ref))
31826 return -1;
31827
31828 +#ifdef CONFIG_PAX_PER_CPU_PGD
31829 + BUG_ON(__pa(get_cpu_pgd(smp_processor_id(), kernel)) != (read_cr3() & __PHYSICAL_MASK));
31830 + pgd = pgd_offset_cpu(smp_processor_id(), user, address);
31831 + if (pgd_none(*pgd)) {
31832 + set_pgd(pgd, *pgd_ref);
31833 + arch_flush_lazy_mmu_mode();
31834 + } else {
31835 + BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
31836 + }
31837 + pgd = pgd_offset_cpu(smp_processor_id(), kernel, address);
31838 +#else
31839 + pgd = pgd_offset(current->active_mm, address);
31840 +#endif
31841 +
31842 if (pgd_none(*pgd)) {
31843 set_pgd(pgd, *pgd_ref);
31844 arch_flush_lazy_mmu_mode();
31845 @@ -546,7 +630,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
31846 static int is_errata100(struct pt_regs *regs, unsigned long address)
31847 {
31848 #ifdef CONFIG_X86_64
31849 - if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
31850 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
31851 return 1;
31852 #endif
31853 return 0;
31854 @@ -573,7 +657,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
31855 }
31856
31857 static const char nx_warning[] = KERN_CRIT
31858 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
31859 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
31860
31861 static void
31862 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
31863 @@ -582,15 +666,27 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
31864 if (!oops_may_print())
31865 return;
31866
31867 - if (error_code & PF_INSTR) {
31868 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
31869 unsigned int level;
31870
31871 pte_t *pte = lookup_address(address, &level);
31872
31873 if (pte && pte_present(*pte) && !pte_exec(*pte))
31874 - printk(nx_warning, from_kuid(&init_user_ns, current_uid()));
31875 + printk(nx_warning, from_kuid_munged(&init_user_ns, current_uid()), current->comm, task_pid_nr(current));
31876 }
31877
31878 +#ifdef CONFIG_PAX_KERNEXEC
31879 + if (init_mm.start_code <= address && address < init_mm.end_code) {
31880 + if (current->signal->curr_ip)
31881 + printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
31882 + &current->signal->curr_ip, current->comm, task_pid_nr(current),
31883 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
31884 + else
31885 + printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n", current->comm, task_pid_nr(current),
31886 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
31887 + }
31888 +#endif
31889 +
31890 printk(KERN_ALERT "BUG: unable to handle kernel ");
31891 if (address < PAGE_SIZE)
31892 printk(KERN_CONT "NULL pointer dereference");
31893 @@ -771,6 +867,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
31894 return;
31895 }
31896 #endif
31897 +
31898 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
31899 + if (pax_is_fetch_fault(regs, error_code, address)) {
31900 +
31901 +#ifdef CONFIG_PAX_EMUTRAMP
31902 + switch (pax_handle_fetch_fault(regs)) {
31903 + case 2:
31904 + return;
31905 + }
31906 +#endif
31907 +
31908 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
31909 + do_group_exit(SIGKILL);
31910 + }
31911 +#endif
31912 +
31913 /* Kernel addresses are always protection faults: */
31914 if (address >= TASK_SIZE)
31915 error_code |= PF_PROT;
31916 @@ -856,7 +968,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
31917 if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
31918 printk(KERN_ERR
31919 "MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
31920 - tsk->comm, tsk->pid, address);
31921 + tsk->comm, task_pid_nr(tsk), address);
31922 code = BUS_MCEERR_AR;
31923 }
31924 #endif
31925 @@ -910,6 +1022,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
31926 return 1;
31927 }
31928
31929 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
31930 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
31931 +{
31932 + pte_t *pte;
31933 + pmd_t *pmd;
31934 + spinlock_t *ptl;
31935 + unsigned char pte_mask;
31936 +
31937 + if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
31938 + !(mm->pax_flags & MF_PAX_PAGEEXEC))
31939 + return 0;
31940 +
31941 + /* PaX: it's our fault, let's handle it if we can */
31942 +
31943 + /* PaX: take a look at read faults before acquiring any locks */
31944 + if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
31945 + /* instruction fetch attempt from a protected page in user mode */
31946 + up_read(&mm->mmap_sem);
31947 +
31948 +#ifdef CONFIG_PAX_EMUTRAMP
31949 + switch (pax_handle_fetch_fault(regs)) {
31950 + case 2:
31951 + return 1;
31952 + }
31953 +#endif
31954 +
31955 + pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
31956 + do_group_exit(SIGKILL);
31957 + }
31958 +
31959 + pmd = pax_get_pmd(mm, address);
31960 + if (unlikely(!pmd))
31961 + return 0;
31962 +
31963 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
31964 + if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
31965 + pte_unmap_unlock(pte, ptl);
31966 + return 0;
31967 + }
31968 +
31969 + if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
31970 + /* write attempt to a protected page in user mode */
31971 + pte_unmap_unlock(pte, ptl);
31972 + return 0;
31973 + }
31974 +
31975 +#ifdef CONFIG_SMP
31976 + if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
31977 +#else
31978 + if (likely(address > get_limit(regs->cs)))
31979 +#endif
31980 + {
31981 + set_pte(pte, pte_mkread(*pte));
31982 + __flush_tlb_one(address);
31983 + pte_unmap_unlock(pte, ptl);
31984 + up_read(&mm->mmap_sem);
31985 + return 1;
31986 + }
31987 +
31988 + pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
31989 +
31990 + /*
31991 + * PaX: fill DTLB with user rights and retry
31992 + */
31993 + __asm__ __volatile__ (
31994 + "orb %2,(%1)\n"
31995 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
31996 +/*
31997 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
31998 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
31999 + * page fault when examined during a TLB load attempt. this is true not only
32000 + * for PTEs holding a non-present entry but also present entries that will
32001 + * raise a page fault (such as those set up by PaX, or the copy-on-write
32002 + * mechanism). in effect it means that we do *not* need to flush the TLBs
32003 + * for our target pages since their PTEs are simply not in the TLBs at all.
32004 +
32005 + * the best thing in omitting it is that we gain around 15-20% speed in the
32006 + * fast path of the page fault handler and can get rid of tracing since we
32007 + * can no longer flush unintended entries.
32008 + */
32009 + "invlpg (%0)\n"
32010 +#endif
32011 + __copyuser_seg"testb $0,(%0)\n"
32012 + "xorb %3,(%1)\n"
32013 + :
32014 + : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
32015 + : "memory", "cc");
32016 + pte_unmap_unlock(pte, ptl);
32017 + up_read(&mm->mmap_sem);
32018 + return 1;
32019 +}
32020 +#endif
32021 +
32022 /*
32023 * Handle a spurious fault caused by a stale TLB entry.
32024 *
32025 @@ -976,6 +1181,9 @@ int show_unhandled_signals = 1;
32026 static inline int
32027 access_error(unsigned long error_code, struct vm_area_struct *vma)
32028 {
32029 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
32030 + return 1;
32031 +
32032 if (error_code & PF_WRITE) {
32033 /* write, present and write, not present: */
32034 if (unlikely(!(vma->vm_flags & VM_WRITE)))
32035 @@ -1010,7 +1218,7 @@ static inline bool smap_violation(int error_code, struct pt_regs *regs)
32036 if (error_code & PF_USER)
32037 return false;
32038
32039 - if (!user_mode_vm(regs) && (regs->flags & X86_EFLAGS_AC))
32040 + if (!user_mode(regs) && (regs->flags & X86_EFLAGS_AC))
32041 return false;
32042
32043 return true;
32044 @@ -1038,6 +1246,22 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
32045 tsk = current;
32046 mm = tsk->mm;
32047
32048 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
32049 + if (!user_mode(regs) && address < 2 * pax_user_shadow_base) {
32050 + if (!search_exception_tables(regs->ip)) {
32051 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
32052 + bad_area_nosemaphore(regs, error_code, address);
32053 + return;
32054 + }
32055 + if (address < pax_user_shadow_base) {
32056 + printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
32057 + printk(KERN_ERR "PAX: faulting IP: %pS\n", (void *)regs->ip);
32058 + show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
32059 + } else
32060 + address -= pax_user_shadow_base;
32061 + }
32062 +#endif
32063 +
32064 /*
32065 * Detect and handle instructions that would cause a page fault for
32066 * both a tracked kernel page and a userspace page.
32067 @@ -1115,7 +1339,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code,
32068 * User-mode registers count as a user access even for any
32069 * potential system fault or CPU buglet:
32070 */
32071 - if (user_mode_vm(regs)) {
32072 + if (user_mode(regs)) {
32073 local_irq_enable();
32074 error_code |= PF_USER;
32075 flags |= FAULT_FLAG_USER;
32076 @@ -1162,6 +1386,11 @@ retry:
32077 might_sleep();
32078 }
32079
32080 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
32081 + if (pax_handle_pageexec_fault(regs, mm, address, error_code))
32082 + return;
32083 +#endif
32084 +
32085 vma = find_vma(mm, address);
32086 if (unlikely(!vma)) {
32087 bad_area(regs, error_code, address);
32088 @@ -1173,18 +1402,24 @@ retry:
32089 bad_area(regs, error_code, address);
32090 return;
32091 }
32092 - if (error_code & PF_USER) {
32093 - /*
32094 - * Accessing the stack below %sp is always a bug.
32095 - * The large cushion allows instructions like enter
32096 - * and pusha to work. ("enter $65535, $31" pushes
32097 - * 32 pointers and then decrements %sp by 65535.)
32098 - */
32099 - if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
32100 - bad_area(regs, error_code, address);
32101 - return;
32102 - }
32103 + /*
32104 + * Accessing the stack below %sp is always a bug.
32105 + * The large cushion allows instructions like enter
32106 + * and pusha to work. ("enter $65535, $31" pushes
32107 + * 32 pointers and then decrements %sp by 65535.)
32108 + */
32109 + if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
32110 + bad_area(regs, error_code, address);
32111 + return;
32112 }
32113 +
32114 +#ifdef CONFIG_PAX_SEGMEXEC
32115 + if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
32116 + bad_area(regs, error_code, address);
32117 + return;
32118 + }
32119 +#endif
32120 +
32121 if (unlikely(expand_stack(vma, address))) {
32122 bad_area(regs, error_code, address);
32123 return;
32124 @@ -1296,3 +1531,292 @@ trace_do_page_fault(struct pt_regs *regs, unsigned long error_code)
32125 exception_exit(prev_state);
32126 }
32127 #endif /* CONFIG_TRACING */
32128 +
32129 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32130 +static bool pax_is_fetch_fault(struct pt_regs *regs, unsigned long error_code, unsigned long address)
32131 +{
32132 + struct mm_struct *mm = current->mm;
32133 + unsigned long ip = regs->ip;
32134 +
32135 + if (v8086_mode(regs))
32136 + ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
32137 +
32138 +#ifdef CONFIG_PAX_PAGEEXEC
32139 + if (mm->pax_flags & MF_PAX_PAGEEXEC) {
32140 + if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR))
32141 + return true;
32142 + if (!(error_code & (PF_PROT | PF_WRITE)) && ip == address)
32143 + return true;
32144 + return false;
32145 + }
32146 +#endif
32147 +
32148 +#ifdef CONFIG_PAX_SEGMEXEC
32149 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
32150 + if (!(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address))
32151 + return true;
32152 + return false;
32153 + }
32154 +#endif
32155 +
32156 + return false;
32157 +}
32158 +#endif
32159 +
32160 +#ifdef CONFIG_PAX_EMUTRAMP
32161 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
32162 +{
32163 + int err;
32164 +
32165 + do { /* PaX: libffi trampoline emulation */
32166 + unsigned char mov, jmp;
32167 + unsigned int addr1, addr2;
32168 +
32169 +#ifdef CONFIG_X86_64
32170 + if ((regs->ip + 9) >> 32)
32171 + break;
32172 +#endif
32173 +
32174 + err = get_user(mov, (unsigned char __user *)regs->ip);
32175 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32176 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
32177 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32178 +
32179 + if (err)
32180 + break;
32181 +
32182 + if (mov == 0xB8 && jmp == 0xE9) {
32183 + regs->ax = addr1;
32184 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
32185 + return 2;
32186 + }
32187 + } while (0);
32188 +
32189 + do { /* PaX: gcc trampoline emulation #1 */
32190 + unsigned char mov1, mov2;
32191 + unsigned short jmp;
32192 + unsigned int addr1, addr2;
32193 +
32194 +#ifdef CONFIG_X86_64
32195 + if ((regs->ip + 11) >> 32)
32196 + break;
32197 +#endif
32198 +
32199 + err = get_user(mov1, (unsigned char __user *)regs->ip);
32200 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32201 + err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
32202 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32203 + err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
32204 +
32205 + if (err)
32206 + break;
32207 +
32208 + if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
32209 + regs->cx = addr1;
32210 + regs->ax = addr2;
32211 + regs->ip = addr2;
32212 + return 2;
32213 + }
32214 + } while (0);
32215 +
32216 + do { /* PaX: gcc trampoline emulation #2 */
32217 + unsigned char mov, jmp;
32218 + unsigned int addr1, addr2;
32219 +
32220 +#ifdef CONFIG_X86_64
32221 + if ((regs->ip + 9) >> 32)
32222 + break;
32223 +#endif
32224 +
32225 + err = get_user(mov, (unsigned char __user *)regs->ip);
32226 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
32227 + err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
32228 + err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
32229 +
32230 + if (err)
32231 + break;
32232 +
32233 + if (mov == 0xB9 && jmp == 0xE9) {
32234 + regs->cx = addr1;
32235 + regs->ip = (unsigned int)(regs->ip + addr2 + 10);
32236 + return 2;
32237 + }
32238 + } while (0);
32239 +
32240 + return 1; /* PaX in action */
32241 +}
32242 +
32243 +#ifdef CONFIG_X86_64
32244 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
32245 +{
32246 + int err;
32247 +
32248 + do { /* PaX: libffi trampoline emulation */
32249 + unsigned short mov1, mov2, jmp1;
32250 + unsigned char stcclc, jmp2;
32251 + unsigned long addr1, addr2;
32252 +
32253 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32254 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
32255 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
32256 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
32257 + err |= get_user(stcclc, (unsigned char __user *)(regs->ip + 20));
32258 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 21));
32259 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 23));
32260 +
32261 + if (err)
32262 + break;
32263 +
32264 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && (stcclc == 0xF8 || stcclc == 0xF9) && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32265 + regs->r11 = addr1;
32266 + regs->r10 = addr2;
32267 + if (stcclc == 0xF8)
32268 + regs->flags &= ~X86_EFLAGS_CF;
32269 + else
32270 + regs->flags |= X86_EFLAGS_CF;
32271 + regs->ip = addr1;
32272 + return 2;
32273 + }
32274 + } while (0);
32275 +
32276 + do { /* PaX: gcc trampoline emulation #1 */
32277 + unsigned short mov1, mov2, jmp1;
32278 + unsigned char jmp2;
32279 + unsigned int addr1;
32280 + unsigned long addr2;
32281 +
32282 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32283 + err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
32284 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
32285 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
32286 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
32287 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
32288 +
32289 + if (err)
32290 + break;
32291 +
32292 + if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32293 + regs->r11 = addr1;
32294 + regs->r10 = addr2;
32295 + regs->ip = addr1;
32296 + return 2;
32297 + }
32298 + } while (0);
32299 +
32300 + do { /* PaX: gcc trampoline emulation #2 */
32301 + unsigned short mov1, mov2, jmp1;
32302 + unsigned char jmp2;
32303 + unsigned long addr1, addr2;
32304 +
32305 + err = get_user(mov1, (unsigned short __user *)regs->ip);
32306 + err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
32307 + err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
32308 + err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
32309 + err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
32310 + err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
32311 +
32312 + if (err)
32313 + break;
32314 +
32315 + if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
32316 + regs->r11 = addr1;
32317 + regs->r10 = addr2;
32318 + regs->ip = addr1;
32319 + return 2;
32320 + }
32321 + } while (0);
32322 +
32323 + return 1; /* PaX in action */
32324 +}
32325 +#endif
32326 +
32327 +/*
32328 + * PaX: decide what to do with offenders (regs->ip = fault address)
32329 + *
32330 + * returns 1 when task should be killed
32331 + * 2 when gcc trampoline was detected
32332 + */
32333 +static int pax_handle_fetch_fault(struct pt_regs *regs)
32334 +{
32335 + if (v8086_mode(regs))
32336 + return 1;
32337 +
32338 + if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
32339 + return 1;
32340 +
32341 +#ifdef CONFIG_X86_32
32342 + return pax_handle_fetch_fault_32(regs);
32343 +#else
32344 + if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
32345 + return pax_handle_fetch_fault_32(regs);
32346 + else
32347 + return pax_handle_fetch_fault_64(regs);
32348 +#endif
32349 +}
32350 +#endif
32351 +
32352 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32353 +void pax_report_insns(struct pt_regs *regs, void *pc, void *sp)
32354 +{
32355 + long i;
32356 +
32357 + printk(KERN_ERR "PAX: bytes at PC: ");
32358 + for (i = 0; i < 20; i++) {
32359 + unsigned char c;
32360 + if (get_user(c, (unsigned char __force_user *)pc+i))
32361 + printk(KERN_CONT "?? ");
32362 + else
32363 + printk(KERN_CONT "%02x ", c);
32364 + }
32365 + printk("\n");
32366 +
32367 + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
32368 + for (i = -1; i < 80 / (long)sizeof(long); i++) {
32369 + unsigned long c;
32370 + if (get_user(c, (unsigned long __force_user *)sp+i)) {
32371 +#ifdef CONFIG_X86_32
32372 + printk(KERN_CONT "???????? ");
32373 +#else
32374 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)))
32375 + printk(KERN_CONT "???????? ???????? ");
32376 + else
32377 + printk(KERN_CONT "???????????????? ");
32378 +#endif
32379 + } else {
32380 +#ifdef CONFIG_X86_64
32381 + if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))) {
32382 + printk(KERN_CONT "%08x ", (unsigned int)c);
32383 + printk(KERN_CONT "%08x ", (unsigned int)(c >> 32));
32384 + } else
32385 +#endif
32386 + printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
32387 + }
32388 + }
32389 + printk("\n");
32390 +}
32391 +#endif
32392 +
32393 +/**
32394 + * probe_kernel_write(): safely attempt to write to a location
32395 + * @dst: address to write to
32396 + * @src: pointer to the data that shall be written
32397 + * @size: size of the data chunk
32398 + *
32399 + * Safely write to address @dst from the buffer at @src. If a kernel fault
32400 + * happens, handle that and return -EFAULT.
32401 + */
32402 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
32403 +{
32404 + long ret;
32405 + mm_segment_t old_fs = get_fs();
32406 +
32407 + set_fs(KERNEL_DS);
32408 + pagefault_disable();
32409 + pax_open_kernel();
32410 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
32411 + pax_close_kernel();
32412 + pagefault_enable();
32413 + set_fs(old_fs);
32414 +
32415 + return ret ? -EFAULT : 0;
32416 +}
32417 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
32418 index 207d9aef..69030980 100644
32419 --- a/arch/x86/mm/gup.c
32420 +++ b/arch/x86/mm/gup.c
32421 @@ -268,7 +268,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
32422 addr = start;
32423 len = (unsigned long) nr_pages << PAGE_SHIFT;
32424 end = start + len;
32425 - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
32426 + if (unlikely(!access_ok_noprefault(write ? VERIFY_WRITE : VERIFY_READ,
32427 (void __user *)start, len)))
32428 return 0;
32429
32430 @@ -344,6 +344,10 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
32431 goto slow_irqon;
32432 #endif
32433
32434 + if (unlikely(!access_ok_noprefault(write ? VERIFY_WRITE : VERIFY_READ,
32435 + (void __user *)start, len)))
32436 + return 0;
32437 +
32438 /*
32439 * XXX: batch / limit 'nr', to avoid large irq off latency
32440 * needs some instrumenting to determine the common sizes used by
32441 diff --git a/arch/x86/mm/highmem_32.c b/arch/x86/mm/highmem_32.c
32442 index 4500142..53a363c 100644
32443 --- a/arch/x86/mm/highmem_32.c
32444 +++ b/arch/x86/mm/highmem_32.c
32445 @@ -45,7 +45,11 @@ void *kmap_atomic_prot(struct page *page, pgprot_t prot)
32446 idx = type + KM_TYPE_NR*smp_processor_id();
32447 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
32448 BUG_ON(!pte_none(*(kmap_pte-idx)));
32449 +
32450 + pax_open_kernel();
32451 set_pte(kmap_pte-idx, mk_pte(page, prot));
32452 + pax_close_kernel();
32453 +
32454 arch_flush_lazy_mmu_mode();
32455
32456 return (void *)vaddr;
32457 diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
32458 index 8c9f647..57cb402 100644
32459 --- a/arch/x86/mm/hugetlbpage.c
32460 +++ b/arch/x86/mm/hugetlbpage.c
32461 @@ -90,23 +90,24 @@ int pmd_huge_support(void)
32462 #ifdef CONFIG_HUGETLB_PAGE
32463 static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
32464 unsigned long addr, unsigned long len,
32465 - unsigned long pgoff, unsigned long flags)
32466 + unsigned long pgoff, unsigned long flags, unsigned long offset)
32467 {
32468 struct hstate *h = hstate_file(file);
32469 struct vm_unmapped_area_info info;
32470 -
32471 +
32472 info.flags = 0;
32473 info.length = len;
32474 info.low_limit = current->mm->mmap_legacy_base;
32475 info.high_limit = TASK_SIZE;
32476 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
32477 info.align_offset = 0;
32478 + info.threadstack_offset = offset;
32479 return vm_unmapped_area(&info);
32480 }
32481
32482 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32483 unsigned long addr0, unsigned long len,
32484 - unsigned long pgoff, unsigned long flags)
32485 + unsigned long pgoff, unsigned long flags, unsigned long offset)
32486 {
32487 struct hstate *h = hstate_file(file);
32488 struct vm_unmapped_area_info info;
32489 @@ -118,6 +119,7 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32490 info.high_limit = current->mm->mmap_base;
32491 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
32492 info.align_offset = 0;
32493 + info.threadstack_offset = offset;
32494 addr = vm_unmapped_area(&info);
32495
32496 /*
32497 @@ -130,6 +132,12 @@ static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
32498 VM_BUG_ON(addr != -ENOMEM);
32499 info.flags = 0;
32500 info.low_limit = TASK_UNMAPPED_BASE;
32501 +
32502 +#ifdef CONFIG_PAX_RANDMMAP
32503 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
32504 + info.low_limit += current->mm->delta_mmap;
32505 +#endif
32506 +
32507 info.high_limit = TASK_SIZE;
32508 addr = vm_unmapped_area(&info);
32509 }
32510 @@ -144,10 +152,20 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
32511 struct hstate *h = hstate_file(file);
32512 struct mm_struct *mm = current->mm;
32513 struct vm_area_struct *vma;
32514 + unsigned long pax_task_size = TASK_SIZE;
32515 + unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
32516
32517 if (len & ~huge_page_mask(h))
32518 return -EINVAL;
32519 - if (len > TASK_SIZE)
32520 +
32521 +#ifdef CONFIG_PAX_SEGMEXEC
32522 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
32523 + pax_task_size = SEGMEXEC_TASK_SIZE;
32524 +#endif
32525 +
32526 + pax_task_size -= PAGE_SIZE;
32527 +
32528 + if (len > pax_task_size)
32529 return -ENOMEM;
32530
32531 if (flags & MAP_FIXED) {
32532 @@ -156,19 +174,22 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
32533 return addr;
32534 }
32535
32536 +#ifdef CONFIG_PAX_RANDMMAP
32537 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
32538 +#endif
32539 +
32540 if (addr) {
32541 addr = ALIGN(addr, huge_page_size(h));
32542 vma = find_vma(mm, addr);
32543 - if (TASK_SIZE - len >= addr &&
32544 - (!vma || addr + len <= vma->vm_start))
32545 + if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
32546 return addr;
32547 }
32548 if (mm->get_unmapped_area == arch_get_unmapped_area)
32549 return hugetlb_get_unmapped_area_bottomup(file, addr, len,
32550 - pgoff, flags);
32551 + pgoff, flags, offset);
32552 else
32553 return hugetlb_get_unmapped_area_topdown(file, addr, len,
32554 - pgoff, flags);
32555 + pgoff, flags, offset);
32556 }
32557 #endif /* CONFIG_HUGETLB_PAGE */
32558
32559 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
32560 index f971306..e83e0f6 100644
32561 --- a/arch/x86/mm/init.c
32562 +++ b/arch/x86/mm/init.c
32563 @@ -4,6 +4,7 @@
32564 #include <linux/swap.h>
32565 #include <linux/memblock.h>
32566 #include <linux/bootmem.h> /* for max_low_pfn */
32567 +#include <linux/tboot.h>
32568
32569 #include <asm/cacheflush.h>
32570 #include <asm/e820.h>
32571 @@ -17,6 +18,8 @@
32572 #include <asm/proto.h>
32573 #include <asm/dma.h> /* for MAX_DMA_PFN */
32574 #include <asm/microcode.h>
32575 +#include <asm/desc.h>
32576 +#include <asm/bios_ebda.h>
32577
32578 #include "mm_internal.h"
32579
32580 @@ -563,7 +566,18 @@ void __init init_mem_mapping(void)
32581 early_ioremap_page_table_range_init();
32582 #endif
32583
32584 +#ifdef CONFIG_PAX_PER_CPU_PGD
32585 + clone_pgd_range(get_cpu_pgd(0, kernel) + KERNEL_PGD_BOUNDARY,
32586 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
32587 + KERNEL_PGD_PTRS);
32588 + clone_pgd_range(get_cpu_pgd(0, user) + KERNEL_PGD_BOUNDARY,
32589 + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
32590 + KERNEL_PGD_PTRS);
32591 + load_cr3(get_cpu_pgd(0, kernel));
32592 +#else
32593 load_cr3(swapper_pg_dir);
32594 +#endif
32595 +
32596 __flush_tlb_all();
32597
32598 early_memtest(0, max_pfn_mapped << PAGE_SHIFT);
32599 @@ -579,10 +593,40 @@ void __init init_mem_mapping(void)
32600 * Access has to be given to non-kernel-ram areas as well, these contain the PCI
32601 * mmio resources as well as potential bios/acpi data regions.
32602 */
32603 +
32604 +#ifdef CONFIG_GRKERNSEC_KMEM
32605 +static unsigned int ebda_start __read_only;
32606 +static unsigned int ebda_end __read_only;
32607 +#endif
32608 +
32609 int devmem_is_allowed(unsigned long pagenr)
32610 {
32611 - if (pagenr < 256)
32612 +#ifdef CONFIG_GRKERNSEC_KMEM
32613 + /* allow BDA */
32614 + if (!pagenr)
32615 return 1;
32616 + /* allow EBDA */
32617 + if (pagenr >= ebda_start && pagenr < ebda_end)
32618 + return 1;
32619 + /* if tboot is in use, allow access to its hardcoded serial log range */
32620 + if (tboot_enabled() && ((0x60000 >> PAGE_SHIFT) <= pagenr) && (pagenr < (0x68000 >> PAGE_SHIFT)))
32621 + return 1;
32622 +#else
32623 + if (!pagenr)
32624 + return 1;
32625 +#ifdef CONFIG_VM86
32626 + if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
32627 + return 1;
32628 +#endif
32629 +#endif
32630 +
32631 + if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
32632 + return 1;
32633 +#ifdef CONFIG_GRKERNSEC_KMEM
32634 + /* throw out everything else below 1MB */
32635 + if (pagenr <= 256)
32636 + return 0;
32637 +#endif
32638 if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
32639 return 0;
32640 if (!page_is_ram(pagenr))
32641 @@ -628,8 +672,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
32642 #endif
32643 }
32644
32645 +#ifdef CONFIG_GRKERNSEC_KMEM
32646 +static inline void gr_init_ebda(void)
32647 +{
32648 + unsigned int ebda_addr;
32649 + unsigned int ebda_size = 0;
32650 +
32651 + ebda_addr = get_bios_ebda();
32652 + if (ebda_addr) {
32653 + ebda_size = *(unsigned char *)phys_to_virt(ebda_addr);
32654 + ebda_size <<= 10;
32655 + }
32656 + if (ebda_addr && ebda_size) {
32657 + ebda_start = ebda_addr >> PAGE_SHIFT;
32658 + ebda_end = min((unsigned int)PAGE_ALIGN(ebda_addr + ebda_size), (unsigned int)0xa0000) >> PAGE_SHIFT;
32659 + } else {
32660 + ebda_start = 0x9f000 >> PAGE_SHIFT;
32661 + ebda_end = 0xa0000 >> PAGE_SHIFT;
32662 + }
32663 +}
32664 +#else
32665 +static inline void gr_init_ebda(void) { }
32666 +#endif
32667 +
32668 void free_initmem(void)
32669 {
32670 +#ifdef CONFIG_PAX_KERNEXEC
32671 +#ifdef CONFIG_X86_32
32672 + /* PaX: limit KERNEL_CS to actual size */
32673 + unsigned long addr, limit;
32674 + struct desc_struct d;
32675 + int cpu;
32676 +#else
32677 + pgd_t *pgd;
32678 + pud_t *pud;
32679 + pmd_t *pmd;
32680 + unsigned long addr, end;
32681 +#endif
32682 +#endif
32683 +
32684 + gr_init_ebda();
32685 +
32686 +#ifdef CONFIG_PAX_KERNEXEC
32687 +#ifdef CONFIG_X86_32
32688 + limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
32689 + limit = (limit - 1UL) >> PAGE_SHIFT;
32690 +
32691 + memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
32692 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
32693 + pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
32694 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
32695 + write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEXEC_KERNEL_CS, &d, DESCTYPE_S);
32696 + }
32697 +
32698 + /* PaX: make KERNEL_CS read-only */
32699 + addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
32700 + if (!paravirt_enabled())
32701 + set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
32702 +/*
32703 + for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
32704 + pgd = pgd_offset_k(addr);
32705 + pud = pud_offset(pgd, addr);
32706 + pmd = pmd_offset(pud, addr);
32707 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
32708 + }
32709 +*/
32710 +#ifdef CONFIG_X86_PAE
32711 + set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
32712 +/*
32713 + for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
32714 + pgd = pgd_offset_k(addr);
32715 + pud = pud_offset(pgd, addr);
32716 + pmd = pmd_offset(pud, addr);
32717 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
32718 + }
32719 +*/
32720 +#endif
32721 +
32722 +#ifdef CONFIG_MODULES
32723 + set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
32724 +#endif
32725 +
32726 +#else
32727 + /* PaX: make kernel code/rodata read-only, rest non-executable */
32728 + for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
32729 + pgd = pgd_offset_k(addr);
32730 + pud = pud_offset(pgd, addr);
32731 + pmd = pmd_offset(pud, addr);
32732 + if (!pmd_present(*pmd))
32733 + continue;
32734 + if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
32735 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
32736 + else
32737 + set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
32738 + }
32739 +
32740 + addr = (unsigned long)__va(__pa(__START_KERNEL_map));
32741 + end = addr + KERNEL_IMAGE_SIZE;
32742 + for (; addr < end; addr += PMD_SIZE) {
32743 + pgd = pgd_offset_k(addr);
32744 + pud = pud_offset(pgd, addr);
32745 + pmd = pmd_offset(pud, addr);
32746 + if (!pmd_present(*pmd))
32747 + continue;
32748 + if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
32749 + set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
32750 + }
32751 +#endif
32752 +
32753 + flush_tlb_all();
32754 +#endif
32755 +
32756 free_init_pages("unused kernel",
32757 (unsigned long)(&__init_begin),
32758 (unsigned long)(&__init_end));
32759 diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
32760 index e395048..cd38278 100644
32761 --- a/arch/x86/mm/init_32.c
32762 +++ b/arch/x86/mm/init_32.c
32763 @@ -62,33 +62,6 @@ static noinline int do_test_wp_bit(void);
32764 bool __read_mostly __vmalloc_start_set = false;
32765
32766 /*
32767 - * Creates a middle page table and puts a pointer to it in the
32768 - * given global directory entry. This only returns the gd entry
32769 - * in non-PAE compilation mode, since the middle layer is folded.
32770 - */
32771 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
32772 -{
32773 - pud_t *pud;
32774 - pmd_t *pmd_table;
32775 -
32776 -#ifdef CONFIG_X86_PAE
32777 - if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
32778 - pmd_table = (pmd_t *)alloc_low_page();
32779 - paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
32780 - set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
32781 - pud = pud_offset(pgd, 0);
32782 - BUG_ON(pmd_table != pmd_offset(pud, 0));
32783 -
32784 - return pmd_table;
32785 - }
32786 -#endif
32787 - pud = pud_offset(pgd, 0);
32788 - pmd_table = pmd_offset(pud, 0);
32789 -
32790 - return pmd_table;
32791 -}
32792 -
32793 -/*
32794 * Create a page table and place a pointer to it in a middle page
32795 * directory entry:
32796 */
32797 @@ -98,13 +71,28 @@ static pte_t * __init one_page_table_init(pmd_t *pmd)
32798 pte_t *page_table = (pte_t *)alloc_low_page();
32799
32800 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
32801 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
32802 + set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
32803 +#else
32804 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
32805 +#endif
32806 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
32807 }
32808
32809 return pte_offset_kernel(pmd, 0);
32810 }
32811
32812 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
32813 +{
32814 + pud_t *pud;
32815 + pmd_t *pmd_table;
32816 +
32817 + pud = pud_offset(pgd, 0);
32818 + pmd_table = pmd_offset(pud, 0);
32819 +
32820 + return pmd_table;
32821 +}
32822 +
32823 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
32824 {
32825 int pgd_idx = pgd_index(vaddr);
32826 @@ -208,6 +196,7 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
32827 int pgd_idx, pmd_idx;
32828 unsigned long vaddr;
32829 pgd_t *pgd;
32830 + pud_t *pud;
32831 pmd_t *pmd;
32832 pte_t *pte = NULL;
32833 unsigned long count = page_table_range_init_count(start, end);
32834 @@ -222,8 +211,13 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
32835 pgd = pgd_base + pgd_idx;
32836
32837 for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
32838 - pmd = one_md_table_init(pgd);
32839 - pmd = pmd + pmd_index(vaddr);
32840 + pud = pud_offset(pgd, vaddr);
32841 + pmd = pmd_offset(pud, vaddr);
32842 +
32843 +#ifdef CONFIG_X86_PAE
32844 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
32845 +#endif
32846 +
32847 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
32848 pmd++, pmd_idx++) {
32849 pte = page_table_kmap_check(one_page_table_init(pmd),
32850 @@ -235,11 +229,20 @@ page_table_range_init(unsigned long start, unsigned long end, pgd_t *pgd_base)
32851 }
32852 }
32853
32854 -static inline int is_kernel_text(unsigned long addr)
32855 +static inline int is_kernel_text(unsigned long start, unsigned long end)
32856 {
32857 - if (addr >= (unsigned long)_text && addr <= (unsigned long)__init_end)
32858 - return 1;
32859 - return 0;
32860 + if ((start >= ktla_ktva((unsigned long)_etext) ||
32861 + end <= ktla_ktva((unsigned long)_stext)) &&
32862 + (start >= ktla_ktva((unsigned long)_einittext) ||
32863 + end <= ktla_ktva((unsigned long)_sinittext)) &&
32864 +
32865 +#ifdef CONFIG_ACPI_SLEEP
32866 + (start >= (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
32867 +#endif
32868 +
32869 + (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
32870 + return 0;
32871 + return 1;
32872 }
32873
32874 /*
32875 @@ -256,9 +259,10 @@ kernel_physical_mapping_init(unsigned long start,
32876 unsigned long last_map_addr = end;
32877 unsigned long start_pfn, end_pfn;
32878 pgd_t *pgd_base = swapper_pg_dir;
32879 - int pgd_idx, pmd_idx, pte_ofs;
32880 + unsigned int pgd_idx, pmd_idx, pte_ofs;
32881 unsigned long pfn;
32882 pgd_t *pgd;
32883 + pud_t *pud;
32884 pmd_t *pmd;
32885 pte_t *pte;
32886 unsigned pages_2m, pages_4k;
32887 @@ -291,8 +295,13 @@ repeat:
32888 pfn = start_pfn;
32889 pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
32890 pgd = pgd_base + pgd_idx;
32891 - for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
32892 - pmd = one_md_table_init(pgd);
32893 + for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
32894 + pud = pud_offset(pgd, 0);
32895 + pmd = pmd_offset(pud, 0);
32896 +
32897 +#ifdef CONFIG_X86_PAE
32898 + paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
32899 +#endif
32900
32901 if (pfn >= end_pfn)
32902 continue;
32903 @@ -304,14 +313,13 @@ repeat:
32904 #endif
32905 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
32906 pmd++, pmd_idx++) {
32907 - unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
32908 + unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
32909
32910 /*
32911 * Map with big pages if possible, otherwise
32912 * create normal page tables:
32913 */
32914 if (use_pse) {
32915 - unsigned int addr2;
32916 pgprot_t prot = PAGE_KERNEL_LARGE;
32917 /*
32918 * first pass will use the same initial
32919 @@ -322,11 +330,7 @@ repeat:
32920 _PAGE_PSE);
32921
32922 pfn &= PMD_MASK >> PAGE_SHIFT;
32923 - addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
32924 - PAGE_OFFSET + PAGE_SIZE-1;
32925 -
32926 - if (is_kernel_text(addr) ||
32927 - is_kernel_text(addr2))
32928 + if (is_kernel_text(address, address + PMD_SIZE))
32929 prot = PAGE_KERNEL_LARGE_EXEC;
32930
32931 pages_2m++;
32932 @@ -343,7 +347,7 @@ repeat:
32933 pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
32934 pte += pte_ofs;
32935 for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
32936 - pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
32937 + pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
32938 pgprot_t prot = PAGE_KERNEL;
32939 /*
32940 * first pass will use the same initial
32941 @@ -351,7 +355,7 @@ repeat:
32942 */
32943 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
32944
32945 - if (is_kernel_text(addr))
32946 + if (is_kernel_text(address, address + PAGE_SIZE))
32947 prot = PAGE_KERNEL_EXEC;
32948
32949 pages_4k++;
32950 @@ -474,7 +478,7 @@ void __init native_pagetable_init(void)
32951
32952 pud = pud_offset(pgd, va);
32953 pmd = pmd_offset(pud, va);
32954 - if (!pmd_present(*pmd))
32955 + if (!pmd_present(*pmd)) // PAX TODO || pmd_large(*pmd))
32956 break;
32957
32958 /* should not be large page here */
32959 @@ -532,12 +536,10 @@ void __init early_ioremap_page_table_range_init(void)
32960
32961 static void __init pagetable_init(void)
32962 {
32963 - pgd_t *pgd_base = swapper_pg_dir;
32964 -
32965 - permanent_kmaps_init(pgd_base);
32966 + permanent_kmaps_init(swapper_pg_dir);
32967 }
32968
32969 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
32970 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
32971 EXPORT_SYMBOL_GPL(__supported_pte_mask);
32972
32973 /* user-defined highmem size */
32974 @@ -787,10 +789,10 @@ void __init mem_init(void)
32975 ((unsigned long)&__init_end -
32976 (unsigned long)&__init_begin) >> 10,
32977
32978 - (unsigned long)&_etext, (unsigned long)&_edata,
32979 - ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
32980 + (unsigned long)&_sdata, (unsigned long)&_edata,
32981 + ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
32982
32983 - (unsigned long)&_text, (unsigned long)&_etext,
32984 + ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
32985 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
32986
32987 /*
32988 @@ -883,6 +885,7 @@ void set_kernel_text_rw(void)
32989 if (!kernel_set_to_readonly)
32990 return;
32991
32992 + start = ktla_ktva(start);
32993 pr_debug("Set kernel text: %lx - %lx for read write\n",
32994 start, start+size);
32995
32996 @@ -897,6 +900,7 @@ void set_kernel_text_ro(void)
32997 if (!kernel_set_to_readonly)
32998 return;
32999
33000 + start = ktla_ktva(start);
33001 pr_debug("Set kernel text: %lx - %lx for read only\n",
33002 start, start+size);
33003
33004 @@ -925,6 +929,7 @@ void mark_rodata_ro(void)
33005 unsigned long start = PFN_ALIGN(_text);
33006 unsigned long size = PFN_ALIGN(_etext) - start;
33007
33008 + start = ktla_ktva(start);
33009 set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
33010 printk(KERN_INFO "Write protecting the kernel text: %luk\n",
33011 size >> 10);
33012 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
33013 index f35c66c..84b95ef 100644
33014 --- a/arch/x86/mm/init_64.c
33015 +++ b/arch/x86/mm/init_64.c
33016 @@ -151,7 +151,7 @@ early_param("gbpages", parse_direct_gbpages_on);
33017 * around without checking the pgd every time.
33018 */
33019
33020 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
33021 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
33022 EXPORT_SYMBOL_GPL(__supported_pte_mask);
33023
33024 int force_personality32;
33025 @@ -184,12 +184,29 @@ void sync_global_pgds(unsigned long start, unsigned long end)
33026
33027 for (address = start; address <= end; address += PGDIR_SIZE) {
33028 const pgd_t *pgd_ref = pgd_offset_k(address);
33029 +
33030 +#ifdef CONFIG_PAX_PER_CPU_PGD
33031 + unsigned long cpu;
33032 +#else
33033 struct page *page;
33034 +#endif
33035
33036 if (pgd_none(*pgd_ref))
33037 continue;
33038
33039 spin_lock(&pgd_lock);
33040 +
33041 +#ifdef CONFIG_PAX_PER_CPU_PGD
33042 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
33043 + pgd_t *pgd = pgd_offset_cpu(cpu, user, address);
33044 +
33045 + if (pgd_none(*pgd))
33046 + set_pgd(pgd, *pgd_ref);
33047 + else
33048 + BUG_ON(pgd_page_vaddr(*pgd)
33049 + != pgd_page_vaddr(*pgd_ref));
33050 + pgd = pgd_offset_cpu(cpu, kernel, address);
33051 +#else
33052 list_for_each_entry(page, &pgd_list, lru) {
33053 pgd_t *pgd;
33054 spinlock_t *pgt_lock;
33055 @@ -198,6 +215,7 @@ void sync_global_pgds(unsigned long start, unsigned long end)
33056 /* the pgt_lock only for Xen */
33057 pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
33058 spin_lock(pgt_lock);
33059 +#endif
33060
33061 if (pgd_none(*pgd))
33062 set_pgd(pgd, *pgd_ref);
33063 @@ -205,7 +223,10 @@ void sync_global_pgds(unsigned long start, unsigned long end)
33064 BUG_ON(pgd_page_vaddr(*pgd)
33065 != pgd_page_vaddr(*pgd_ref));
33066
33067 +#ifndef CONFIG_PAX_PER_CPU_PGD
33068 spin_unlock(pgt_lock);
33069 +#endif
33070 +
33071 }
33072 spin_unlock(&pgd_lock);
33073 }
33074 @@ -238,7 +259,7 @@ static pud_t *fill_pud(pgd_t *pgd, unsigned long vaddr)
33075 {
33076 if (pgd_none(*pgd)) {
33077 pud_t *pud = (pud_t *)spp_getpage();
33078 - pgd_populate(&init_mm, pgd, pud);
33079 + pgd_populate_kernel(&init_mm, pgd, pud);
33080 if (pud != pud_offset(pgd, 0))
33081 printk(KERN_ERR "PAGETABLE BUG #00! %p <-> %p\n",
33082 pud, pud_offset(pgd, 0));
33083 @@ -250,7 +271,7 @@ static pmd_t *fill_pmd(pud_t *pud, unsigned long vaddr)
33084 {
33085 if (pud_none(*pud)) {
33086 pmd_t *pmd = (pmd_t *) spp_getpage();
33087 - pud_populate(&init_mm, pud, pmd);
33088 + pud_populate_kernel(&init_mm, pud, pmd);
33089 if (pmd != pmd_offset(pud, 0))
33090 printk(KERN_ERR "PAGETABLE BUG #01! %p <-> %p\n",
33091 pmd, pmd_offset(pud, 0));
33092 @@ -279,7 +300,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte)
33093 pmd = fill_pmd(pud, vaddr);
33094 pte = fill_pte(pmd, vaddr);
33095
33096 + pax_open_kernel();
33097 set_pte(pte, new_pte);
33098 + pax_close_kernel();
33099
33100 /*
33101 * It's enough to flush this one mapping.
33102 @@ -338,14 +361,12 @@ static void __init __init_extra_mapping(unsigned long phys, unsigned long size,
33103 pgd = pgd_offset_k((unsigned long)__va(phys));
33104 if (pgd_none(*pgd)) {
33105 pud = (pud_t *) spp_getpage();
33106 - set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
33107 - _PAGE_USER));
33108 + set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
33109 }
33110 pud = pud_offset(pgd, (unsigned long)__va(phys));
33111 if (pud_none(*pud)) {
33112 pmd = (pmd_t *) spp_getpage();
33113 - set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
33114 - _PAGE_USER));
33115 + set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
33116 }
33117 pmd = pmd_offset(pud, phys);
33118 BUG_ON(!pmd_none(*pmd));
33119 @@ -586,7 +607,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end,
33120 prot);
33121
33122 spin_lock(&init_mm.page_table_lock);
33123 - pud_populate(&init_mm, pud, pmd);
33124 + pud_populate_kernel(&init_mm, pud, pmd);
33125 spin_unlock(&init_mm.page_table_lock);
33126 }
33127 __flush_tlb_all();
33128 @@ -627,7 +648,7 @@ kernel_physical_mapping_init(unsigned long start,
33129 page_size_mask);
33130
33131 spin_lock(&init_mm.page_table_lock);
33132 - pgd_populate(&init_mm, pgd, pud);
33133 + pgd_populate_kernel(&init_mm, pgd, pud);
33134 spin_unlock(&init_mm.page_table_lock);
33135 pgd_changed = true;
33136 }
33137 @@ -1188,8 +1209,8 @@ int kern_addr_valid(unsigned long addr)
33138 static struct vm_area_struct gate_vma = {
33139 .vm_start = VSYSCALL_START,
33140 .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
33141 - .vm_page_prot = PAGE_READONLY_EXEC,
33142 - .vm_flags = VM_READ | VM_EXEC
33143 + .vm_page_prot = PAGE_READONLY,
33144 + .vm_flags = VM_READ
33145 };
33146
33147 struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
33148 @@ -1223,7 +1244,7 @@ int in_gate_area_no_mm(unsigned long addr)
33149
33150 const char *arch_vma_name(struct vm_area_struct *vma)
33151 {
33152 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
33153 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
33154 return "[vdso]";
33155 if (vma == &gate_vma)
33156 return "[vsyscall]";
33157 diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
33158 index 7b179b4..6bd17777 100644
33159 --- a/arch/x86/mm/iomap_32.c
33160 +++ b/arch/x86/mm/iomap_32.c
33161 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
33162 type = kmap_atomic_idx_push();
33163 idx = type + KM_TYPE_NR * smp_processor_id();
33164 vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
33165 +
33166 + pax_open_kernel();
33167 set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
33168 + pax_close_kernel();
33169 +
33170 arch_flush_lazy_mmu_mode();
33171
33172 return (void *)vaddr;
33173 diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
33174 index 799580c..72f9fe0 100644
33175 --- a/arch/x86/mm/ioremap.c
33176 +++ b/arch/x86/mm/ioremap.c
33177 @@ -97,7 +97,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
33178 for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
33179 int is_ram = page_is_ram(pfn);
33180
33181 - if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
33182 + if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
33183 return NULL;
33184 WARN_ON_ONCE(is_ram);
33185 }
33186 @@ -256,7 +256,7 @@ EXPORT_SYMBOL(ioremap_prot);
33187 *
33188 * Caller must ensure there is only one unmapping for the same pointer.
33189 */
33190 -void iounmap(volatile void __iomem *addr)
33191 +void iounmap(const volatile void __iomem *addr)
33192 {
33193 struct vm_struct *p, *o;
33194
33195 @@ -310,6 +310,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
33196
33197 /* If page is RAM, we can use __va. Otherwise ioremap and unmap. */
33198 if (page_is_ram(start >> PAGE_SHIFT))
33199 +#ifdef CONFIG_HIGHMEM
33200 + if ((start >> PAGE_SHIFT) < max_low_pfn)
33201 +#endif
33202 return __va(phys);
33203
33204 addr = (void __force *)ioremap_cache(start, PAGE_SIZE);
33205 @@ -322,6 +325,9 @@ void *xlate_dev_mem_ptr(unsigned long phys)
33206 void unxlate_dev_mem_ptr(unsigned long phys, void *addr)
33207 {
33208 if (page_is_ram(phys >> PAGE_SHIFT))
33209 +#ifdef CONFIG_HIGHMEM
33210 + if ((phys >> PAGE_SHIFT) < max_low_pfn)
33211 +#endif
33212 return;
33213
33214 iounmap((void __iomem *)((unsigned long)addr & PAGE_MASK));
33215 @@ -339,7 +345,7 @@ static int __init early_ioremap_debug_setup(char *str)
33216 early_param("early_ioremap_debug", early_ioremap_debug_setup);
33217
33218 static __initdata int after_paging_init;
33219 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
33220 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
33221
33222 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
33223 {
33224 @@ -376,8 +382,7 @@ void __init early_ioremap_init(void)
33225 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
33226
33227 pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
33228 - memset(bm_pte, 0, sizeof(bm_pte));
33229 - pmd_populate_kernel(&init_mm, pmd, bm_pte);
33230 + pmd_populate_user(&init_mm, pmd, bm_pte);
33231
33232 /*
33233 * The boot-ioremap range spans multiple pmds, for which
33234 diff --git a/arch/x86/mm/kmemcheck/kmemcheck.c b/arch/x86/mm/kmemcheck/kmemcheck.c
33235 index d87dd6d..bf3fa66 100644
33236 --- a/arch/x86/mm/kmemcheck/kmemcheck.c
33237 +++ b/arch/x86/mm/kmemcheck/kmemcheck.c
33238 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *regs, unsigned long address,
33239 * memory (e.g. tracked pages)? For now, we need this to avoid
33240 * invoking kmemcheck for PnP BIOS calls.
33241 */
33242 - if (regs->flags & X86_VM_MASK)
33243 + if (v8086_mode(regs))
33244 return false;
33245 - if (regs->cs != __KERNEL_CS)
33246 + if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
33247 return false;
33248
33249 pte = kmemcheck_pte_lookup(address);
33250 diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
33251 index 25e7e13..1964579 100644
33252 --- a/arch/x86/mm/mmap.c
33253 +++ b/arch/x86/mm/mmap.c
33254 @@ -52,7 +52,7 @@ static unsigned int stack_maxrandom_size(void)
33255 * Leave an at least ~128 MB hole with possible stack randomization.
33256 */
33257 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
33258 -#define MAX_GAP (TASK_SIZE/6*5)
33259 +#define MAX_GAP (pax_task_size/6*5)
33260
33261 static int mmap_is_legacy(void)
33262 {
33263 @@ -82,27 +82,40 @@ static unsigned long mmap_rnd(void)
33264 return rnd << PAGE_SHIFT;
33265 }
33266
33267 -static unsigned long mmap_base(void)
33268 +static unsigned long mmap_base(struct mm_struct *mm)
33269 {
33270 unsigned long gap = rlimit(RLIMIT_STACK);
33271 + unsigned long pax_task_size = TASK_SIZE;
33272 +
33273 +#ifdef CONFIG_PAX_SEGMEXEC
33274 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
33275 + pax_task_size = SEGMEXEC_TASK_SIZE;
33276 +#endif
33277
33278 if (gap < MIN_GAP)
33279 gap = MIN_GAP;
33280 else if (gap > MAX_GAP)
33281 gap = MAX_GAP;
33282
33283 - return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
33284 + return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
33285 }
33286
33287 /*
33288 * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
33289 * does, but not when emulating X86_32
33290 */
33291 -static unsigned long mmap_legacy_base(void)
33292 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
33293 {
33294 - if (mmap_is_ia32())
33295 + if (mmap_is_ia32()) {
33296 +
33297 +#ifdef CONFIG_PAX_SEGMEXEC
33298 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
33299 + return SEGMEXEC_TASK_UNMAPPED_BASE;
33300 + else
33301 +#endif
33302 +
33303 return TASK_UNMAPPED_BASE;
33304 - else
33305 + } else
33306 return TASK_UNMAPPED_BASE + mmap_rnd();
33307 }
33308
33309 @@ -112,8 +125,15 @@ static unsigned long mmap_legacy_base(void)
33310 */
33311 void arch_pick_mmap_layout(struct mm_struct *mm)
33312 {
33313 - mm->mmap_legacy_base = mmap_legacy_base();
33314 - mm->mmap_base = mmap_base();
33315 + mm->mmap_legacy_base = mmap_legacy_base(mm);
33316 + mm->mmap_base = mmap_base(mm);
33317 +
33318 +#ifdef CONFIG_PAX_RANDMMAP
33319 + if (mm->pax_flags & MF_PAX_RANDMMAP) {
33320 + mm->mmap_legacy_base += mm->delta_mmap;
33321 + mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
33322 + }
33323 +#endif
33324
33325 if (mmap_is_legacy()) {
33326 mm->mmap_base = mm->mmap_legacy_base;
33327 diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
33328 index 0057a7a..95c7edd 100644
33329 --- a/arch/x86/mm/mmio-mod.c
33330 +++ b/arch/x86/mm/mmio-mod.c
33331 @@ -194,7 +194,7 @@ static void pre(struct kmmio_probe *p, struct pt_regs *regs,
33332 break;
33333 default:
33334 {
33335 - unsigned char *ip = (unsigned char *)instptr;
33336 + unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
33337 my_trace->opcode = MMIO_UNKNOWN_OP;
33338 my_trace->width = 0;
33339 my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
33340 @@ -234,7 +234,7 @@ static void post(struct kmmio_probe *p, unsigned long condition,
33341 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
33342 void __iomem *addr)
33343 {
33344 - static atomic_t next_id;
33345 + static atomic_unchecked_t next_id;
33346 struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
33347 /* These are page-unaligned. */
33348 struct mmiotrace_map map = {
33349 @@ -258,7 +258,7 @@ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
33350 .private = trace
33351 },
33352 .phys = offset,
33353 - .id = atomic_inc_return(&next_id)
33354 + .id = atomic_inc_return_unchecked(&next_id)
33355 };
33356 map.map_id = trace->id;
33357
33358 @@ -290,7 +290,7 @@ void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
33359 ioremap_trace_core(offset, size, addr);
33360 }
33361
33362 -static void iounmap_trace_core(volatile void __iomem *addr)
33363 +static void iounmap_trace_core(const volatile void __iomem *addr)
33364 {
33365 struct mmiotrace_map map = {
33366 .phys = 0,
33367 @@ -328,7 +328,7 @@ not_enabled:
33368 }
33369 }
33370
33371 -void mmiotrace_iounmap(volatile void __iomem *addr)
33372 +void mmiotrace_iounmap(const volatile void __iomem *addr)
33373 {
33374 might_sleep();
33375 if (is_enabled()) /* recheck and proper locking in *_core() */
33376 diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
33377 index 27aa0455..0eb1406 100644
33378 --- a/arch/x86/mm/numa.c
33379 +++ b/arch/x86/mm/numa.c
33380 @@ -478,7 +478,7 @@ static bool __init numa_meminfo_cover_memory(const struct numa_meminfo *mi)
33381 return true;
33382 }
33383
33384 -static int __init numa_register_memblks(struct numa_meminfo *mi)
33385 +static int __init __intentional_overflow(-1) numa_register_memblks(struct numa_meminfo *mi)
33386 {
33387 unsigned long uninitialized_var(pfn_align);
33388 int i, nid;
33389 diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
33390 index 461bc82..4e091a3 100644
33391 --- a/arch/x86/mm/pageattr-test.c
33392 +++ b/arch/x86/mm/pageattr-test.c
33393 @@ -35,7 +35,7 @@ enum {
33394
33395 static int pte_testbit(pte_t pte)
33396 {
33397 - return pte_flags(pte) & _PAGE_UNUSED1;
33398 + return pte_flags(pte) & _PAGE_CPA_TEST;
33399 }
33400
33401 struct split_state {
33402 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
33403 index a348868..3c64310 100644
33404 --- a/arch/x86/mm/pageattr.c
33405 +++ b/arch/x86/mm/pageattr.c
33406 @@ -262,7 +262,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33407 */
33408 #ifdef CONFIG_PCI_BIOS
33409 if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
33410 - pgprot_val(forbidden) |= _PAGE_NX;
33411 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33412 #endif
33413
33414 /*
33415 @@ -270,9 +270,10 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33416 * Does not cover __inittext since that is gone later on. On
33417 * 64bit we do not enforce !NX on the low mapping
33418 */
33419 - if (within(address, (unsigned long)_text, (unsigned long)_etext))
33420 - pgprot_val(forbidden) |= _PAGE_NX;
33421 + if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
33422 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33423
33424 +#ifdef CONFIG_DEBUG_RODATA
33425 /*
33426 * The .rodata section needs to be read-only. Using the pfn
33427 * catches all aliases.
33428 @@ -280,6 +281,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33429 if (within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT,
33430 __pa_symbol(__end_rodata) >> PAGE_SHIFT))
33431 pgprot_val(forbidden) |= _PAGE_RW;
33432 +#endif
33433
33434 #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
33435 /*
33436 @@ -318,6 +320,13 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
33437 }
33438 #endif
33439
33440 +#ifdef CONFIG_PAX_KERNEXEC
33441 + if (within(pfn, __pa(ktla_ktva((unsigned long)&_text)), __pa((unsigned long)&_sdata))) {
33442 + pgprot_val(forbidden) |= _PAGE_RW;
33443 + pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
33444 + }
33445 +#endif
33446 +
33447 prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
33448
33449 return prot;
33450 @@ -416,23 +425,37 @@ EXPORT_SYMBOL_GPL(slow_virt_to_phys);
33451 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
33452 {
33453 /* change init_mm */
33454 + pax_open_kernel();
33455 set_pte_atomic(kpte, pte);
33456 +
33457 #ifdef CONFIG_X86_32
33458 if (!SHARED_KERNEL_PMD) {
33459 +
33460 +#ifdef CONFIG_PAX_PER_CPU_PGD
33461 + unsigned long cpu;
33462 +#else
33463 struct page *page;
33464 +#endif
33465
33466 +#ifdef CONFIG_PAX_PER_CPU_PGD
33467 + for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
33468 + pgd_t *pgd = get_cpu_pgd(cpu, kernel);
33469 +#else
33470 list_for_each_entry(page, &pgd_list, lru) {
33471 - pgd_t *pgd;
33472 + pgd_t *pgd = (pgd_t *)page_address(page);
33473 +#endif
33474 +
33475 pud_t *pud;
33476 pmd_t *pmd;
33477
33478 - pgd = (pgd_t *)page_address(page) + pgd_index(address);
33479 + pgd += pgd_index(address);
33480 pud = pud_offset(pgd, address);
33481 pmd = pmd_offset(pud, address);
33482 set_pte_atomic((pte_t *)pmd, pte);
33483 }
33484 }
33485 #endif
33486 + pax_close_kernel();
33487 }
33488
33489 static int
33490 diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
33491 index 6574388..87e9bef 100644
33492 --- a/arch/x86/mm/pat.c
33493 +++ b/arch/x86/mm/pat.c
33494 @@ -376,7 +376,7 @@ int free_memtype(u64 start, u64 end)
33495
33496 if (!entry) {
33497 printk(KERN_INFO "%s:%d freeing invalid memtype [mem %#010Lx-%#010Lx]\n",
33498 - current->comm, current->pid, start, end - 1);
33499 + current->comm, task_pid_nr(current), start, end - 1);
33500 return -EINVAL;
33501 }
33502
33503 @@ -506,8 +506,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
33504
33505 while (cursor < to) {
33506 if (!devmem_is_allowed(pfn)) {
33507 - printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx]\n",
33508 - current->comm, from, to - 1);
33509 + printk(KERN_INFO "Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx] (%#010Lx)\n",
33510 + current->comm, from, to - 1, cursor);
33511 return 0;
33512 }
33513 cursor += PAGE_SIZE;
33514 @@ -577,7 +577,7 @@ int kernel_map_sync_memtype(u64 base, unsigned long size, unsigned long flags)
33515 if (ioremap_change_attr((unsigned long)__va(base), id_sz, flags) < 0) {
33516 printk(KERN_INFO "%s:%d ioremap_change_attr failed %s "
33517 "for [mem %#010Lx-%#010Lx]\n",
33518 - current->comm, current->pid,
33519 + current->comm, task_pid_nr(current),
33520 cattr_name(flags),
33521 base, (unsigned long long)(base + size-1));
33522 return -EINVAL;
33523 @@ -612,7 +612,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
33524 flags = lookup_memtype(paddr);
33525 if (want_flags != flags) {
33526 printk(KERN_WARNING "%s:%d map pfn RAM range req %s for [mem %#010Lx-%#010Lx], got %s\n",
33527 - current->comm, current->pid,
33528 + current->comm, task_pid_nr(current),
33529 cattr_name(want_flags),
33530 (unsigned long long)paddr,
33531 (unsigned long long)(paddr + size - 1),
33532 @@ -634,7 +634,7 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
33533 free_memtype(paddr, paddr + size);
33534 printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
33535 " for [mem %#010Lx-%#010Lx], got %s\n",
33536 - current->comm, current->pid,
33537 + current->comm, task_pid_nr(current),
33538 cattr_name(want_flags),
33539 (unsigned long long)paddr,
33540 (unsigned long long)(paddr + size - 1),
33541 diff --git a/arch/x86/mm/pat_rbtree.c b/arch/x86/mm/pat_rbtree.c
33542 index 415f6c4..d319983 100644
33543 --- a/arch/x86/mm/pat_rbtree.c
33544 +++ b/arch/x86/mm/pat_rbtree.c
33545 @@ -160,7 +160,7 @@ success:
33546
33547 failure:
33548 printk(KERN_INFO "%s:%d conflicting memory types "
33549 - "%Lx-%Lx %s<->%s\n", current->comm, current->pid, start,
33550 + "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), start,
33551 end, cattr_name(found_type), cattr_name(match->type));
33552 return -EBUSY;
33553 }
33554 diff --git a/arch/x86/mm/pf_in.c b/arch/x86/mm/pf_in.c
33555 index 9f0614d..92ae64a 100644
33556 --- a/arch/x86/mm/pf_in.c
33557 +++ b/arch/x86/mm/pf_in.c
33558 @@ -148,7 +148,7 @@ enum reason_type get_ins_type(unsigned long ins_addr)
33559 int i;
33560 enum reason_type rv = OTHERS;
33561
33562 - p = (unsigned char *)ins_addr;
33563 + p = (unsigned char *)ktla_ktva(ins_addr);
33564 p += skip_prefix(p, &prf);
33565 p += get_opcode(p, &opcode);
33566
33567 @@ -168,7 +168,7 @@ static unsigned int get_ins_reg_width(unsigned long ins_addr)
33568 struct prefix_bits prf;
33569 int i;
33570
33571 - p = (unsigned char *)ins_addr;
33572 + p = (unsigned char *)ktla_ktva(ins_addr);
33573 p += skip_prefix(p, &prf);
33574 p += get_opcode(p, &opcode);
33575
33576 @@ -191,7 +191,7 @@ unsigned int get_ins_mem_width(unsigned long ins_addr)
33577 struct prefix_bits prf;
33578 int i;
33579
33580 - p = (unsigned char *)ins_addr;
33581 + p = (unsigned char *)ktla_ktva(ins_addr);
33582 p += skip_prefix(p, &prf);
33583 p += get_opcode(p, &opcode);
33584
33585 @@ -415,7 +415,7 @@ unsigned long get_ins_reg_val(unsigned long ins_addr, struct pt_regs *regs)
33586 struct prefix_bits prf;
33587 int i;
33588
33589 - p = (unsigned char *)ins_addr;
33590 + p = (unsigned char *)ktla_ktva(ins_addr);
33591 p += skip_prefix(p, &prf);
33592 p += get_opcode(p, &opcode);
33593 for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
33594 @@ -470,7 +470,7 @@ unsigned long get_ins_imm_val(unsigned long ins_addr)
33595 struct prefix_bits prf;
33596 int i;
33597
33598 - p = (unsigned char *)ins_addr;
33599 + p = (unsigned char *)ktla_ktva(ins_addr);
33600 p += skip_prefix(p, &prf);
33601 p += get_opcode(p, &opcode);
33602 for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
33603 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
33604 index c96314a..433b127 100644
33605 --- a/arch/x86/mm/pgtable.c
33606 +++ b/arch/x86/mm/pgtable.c
33607 @@ -97,10 +97,71 @@ static inline void pgd_list_del(pgd_t *pgd)
33608 list_del(&page->lru);
33609 }
33610
33611 -#define UNSHARED_PTRS_PER_PGD \
33612 - (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
33613 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
33614 +pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
33615
33616 +void __shadow_user_pgds(pgd_t *dst, const pgd_t *src)
33617 +{
33618 + unsigned int count = USER_PGD_PTRS;
33619
33620 + if (!pax_user_shadow_base)
33621 + return;
33622 +
33623 + while (count--)
33624 + *dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
33625 +}
33626 +#endif
33627 +
33628 +#ifdef CONFIG_PAX_PER_CPU_PGD
33629 +void __clone_user_pgds(pgd_t *dst, const pgd_t *src)
33630 +{
33631 + unsigned int count = USER_PGD_PTRS;
33632 +
33633 + while (count--) {
33634 + pgd_t pgd;
33635 +
33636 +#ifdef CONFIG_X86_64
33637 + pgd = __pgd(pgd_val(*src++) | _PAGE_USER);
33638 +#else
33639 + pgd = *src++;
33640 +#endif
33641 +
33642 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
33643 + pgd = __pgd(pgd_val(pgd) & clone_pgd_mask);
33644 +#endif
33645 +
33646 + *dst++ = pgd;
33647 + }
33648 +
33649 +}
33650 +#endif
33651 +
33652 +#ifdef CONFIG_X86_64
33653 +#define pxd_t pud_t
33654 +#define pyd_t pgd_t
33655 +#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
33656 +#define pgtable_pxd_page_ctor(page) true
33657 +#define pgtable_pxd_page_dtor(page)
33658 +#define pxd_free(mm, pud) pud_free((mm), (pud))
33659 +#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
33660 +#define pyd_offset(mm, address) pgd_offset((mm), (address))
33661 +#define PYD_SIZE PGDIR_SIZE
33662 +#else
33663 +#define pxd_t pmd_t
33664 +#define pyd_t pud_t
33665 +#define paravirt_release_pxd(pfn) paravirt_release_pmd(pfn)
33666 +#define pgtable_pxd_page_ctor(page) pgtable_pmd_page_ctor(page)
33667 +#define pgtable_pxd_page_dtor(page) pgtable_pmd_page_dtor(page)
33668 +#define pxd_free(mm, pud) pmd_free((mm), (pud))
33669 +#define pyd_populate(mm, pgd, pud) pud_populate((mm), (pgd), (pud))
33670 +#define pyd_offset(mm, address) pud_offset((mm), (address))
33671 +#define PYD_SIZE PUD_SIZE
33672 +#endif
33673 +
33674 +#ifdef CONFIG_PAX_PER_CPU_PGD
33675 +static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
33676 +static inline void pgd_dtor(pgd_t *pgd) {}
33677 +#else
33678 static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
33679 {
33680 BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
33681 @@ -141,6 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
33682 pgd_list_del(pgd);
33683 spin_unlock(&pgd_lock);
33684 }
33685 +#endif
33686
33687 /*
33688 * List of all pgd's needed for non-PAE so it can invalidate entries
33689 @@ -153,7 +215,7 @@ static void pgd_dtor(pgd_t *pgd)
33690 * -- nyc
33691 */
33692
33693 -#ifdef CONFIG_X86_PAE
33694 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
33695 /*
33696 * In PAE mode, we need to do a cr3 reload (=tlb flush) when
33697 * updating the top-level pagetable entries to guarantee the
33698 @@ -165,7 +227,7 @@ static void pgd_dtor(pgd_t *pgd)
33699 * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
33700 * and initialize the kernel pmds here.
33701 */
33702 -#define PREALLOCATED_PMDS UNSHARED_PTRS_PER_PGD
33703 +#define PREALLOCATED_PXDS (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
33704
33705 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
33706 {
33707 @@ -183,43 +245,45 @@ void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
33708 */
33709 flush_tlb_mm(mm);
33710 }
33711 +#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
33712 +#define PREALLOCATED_PXDS USER_PGD_PTRS
33713 #else /* !CONFIG_X86_PAE */
33714
33715 /* No need to prepopulate any pagetable entries in non-PAE modes. */
33716 -#define PREALLOCATED_PMDS 0
33717 +#define PREALLOCATED_PXDS 0
33718
33719 #endif /* CONFIG_X86_PAE */
33720
33721 -static void free_pmds(pmd_t *pmds[])
33722 +static void free_pxds(pxd_t *pxds[])
33723 {
33724 int i;
33725
33726 - for(i = 0; i < PREALLOCATED_PMDS; i++)
33727 - if (pmds[i]) {
33728 - pgtable_pmd_page_dtor(virt_to_page(pmds[i]));
33729 - free_page((unsigned long)pmds[i]);
33730 + for(i = 0; i < PREALLOCATED_PXDS; i++)
33731 + if (pxds[i]) {
33732 + pgtable_pxd_page_dtor(virt_to_page(pxds[i]));
33733 + free_page((unsigned long)pxds[i]);
33734 }
33735 }
33736
33737 -static int preallocate_pmds(pmd_t *pmds[])
33738 +static int preallocate_pxds(pxd_t *pxds[])
33739 {
33740 int i;
33741 bool failed = false;
33742
33743 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
33744 - pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
33745 - if (!pmd)
33746 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
33747 + pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
33748 + if (!pxd)
33749 failed = true;
33750 - if (pmd && !pgtable_pmd_page_ctor(virt_to_page(pmd))) {
33751 - free_page((unsigned long)pmd);
33752 - pmd = NULL;
33753 + if (pxd && !pgtable_pxd_page_ctor(virt_to_page(pxd))) {
33754 + free_page((unsigned long)pxd);
33755 + pxd = NULL;
33756 failed = true;
33757 }
33758 - pmds[i] = pmd;
33759 + pxds[i] = pxd;
33760 }
33761
33762 if (failed) {
33763 - free_pmds(pmds);
33764 + free_pxds(pxds);
33765 return -ENOMEM;
33766 }
33767
33768 @@ -232,49 +296,52 @@ static int preallocate_pmds(pmd_t *pmds[])
33769 * preallocate which never got a corresponding vma will need to be
33770 * freed manually.
33771 */
33772 -static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
33773 +static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
33774 {
33775 int i;
33776
33777 - for(i = 0; i < PREALLOCATED_PMDS; i++) {
33778 + for(i = 0; i < PREALLOCATED_PXDS; i++) {
33779 pgd_t pgd = pgdp[i];
33780
33781 if (pgd_val(pgd) != 0) {
33782 - pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
33783 + pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
33784
33785 - pgdp[i] = native_make_pgd(0);
33786 + set_pgd(pgdp + i, native_make_pgd(0));
33787
33788 - paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
33789 - pmd_free(mm, pmd);
33790 + paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
33791 + pxd_free(mm, pxd);
33792 }
33793 }
33794 }
33795
33796 -static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
33797 +static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
33798 {
33799 - pud_t *pud;
33800 + pyd_t *pyd;
33801 int i;
33802
33803 - if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
33804 + if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
33805 return;
33806
33807 - pud = pud_offset(pgd, 0);
33808 -
33809 - for (i = 0; i < PREALLOCATED_PMDS; i++, pud++) {
33810 - pmd_t *pmd = pmds[i];
33811 +#ifdef CONFIG_X86_64
33812 + pyd = pyd_offset(mm, 0L);
33813 +#else
33814 + pyd = pyd_offset(pgd, 0L);
33815 +#endif
33816
33817 + for (i = 0; i < PREALLOCATED_PXDS; i++, pyd++) {
33818 + pxd_t *pxd = pxds[i];
33819 if (i >= KERNEL_PGD_BOUNDARY)
33820 - memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
33821 - sizeof(pmd_t) * PTRS_PER_PMD);
33822 + memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
33823 + sizeof(pxd_t) * PTRS_PER_PMD);
33824
33825 - pud_populate(mm, pud, pmd);
33826 + pyd_populate(mm, pyd, pxd);
33827 }
33828 }
33829
33830 pgd_t *pgd_alloc(struct mm_struct *mm)
33831 {
33832 pgd_t *pgd;
33833 - pmd_t *pmds[PREALLOCATED_PMDS];
33834 + pxd_t *pxds[PREALLOCATED_PXDS];
33835
33836 pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
33837
33838 @@ -283,11 +350,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
33839
33840 mm->pgd = pgd;
33841
33842 - if (preallocate_pmds(pmds) != 0)
33843 + if (preallocate_pxds(pxds) != 0)
33844 goto out_free_pgd;
33845
33846 if (paravirt_pgd_alloc(mm) != 0)
33847 - goto out_free_pmds;
33848 + goto out_free_pxds;
33849
33850 /*
33851 * Make sure that pre-populating the pmds is atomic with
33852 @@ -297,14 +364,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
33853 spin_lock(&pgd_lock);
33854
33855 pgd_ctor(mm, pgd);
33856 - pgd_prepopulate_pmd(mm, pgd, pmds);
33857 + pgd_prepopulate_pxd(mm, pgd, pxds);
33858
33859 spin_unlock(&pgd_lock);
33860
33861 return pgd;
33862
33863 -out_free_pmds:
33864 - free_pmds(pmds);
33865 +out_free_pxds:
33866 + free_pxds(pxds);
33867 out_free_pgd:
33868 free_page((unsigned long)pgd);
33869 out:
33870 @@ -313,7 +380,7 @@ out:
33871
33872 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
33873 {
33874 - pgd_mop_up_pmds(mm, pgd);
33875 + pgd_mop_up_pxds(mm, pgd);
33876 pgd_dtor(pgd);
33877 paravirt_pgd_free(mm, pgd);
33878 free_page((unsigned long)pgd);
33879 diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
33880 index a69bcb8..19068ab 100644
33881 --- a/arch/x86/mm/pgtable_32.c
33882 +++ b/arch/x86/mm/pgtable_32.c
33883 @@ -47,10 +47,13 @@ void set_pte_vaddr(unsigned long vaddr, pte_t pteval)
33884 return;
33885 }
33886 pte = pte_offset_kernel(pmd, vaddr);
33887 +
33888 + pax_open_kernel();
33889 if (pte_val(pteval))
33890 set_pte_at(&init_mm, vaddr, pte, pteval);
33891 else
33892 pte_clear(&init_mm, vaddr, pte);
33893 + pax_close_kernel();
33894
33895 /*
33896 * It's enough to flush this one mapping.
33897 diff --git a/arch/x86/mm/physaddr.c b/arch/x86/mm/physaddr.c
33898 index e666cbb..61788c45 100644
33899 --- a/arch/x86/mm/physaddr.c
33900 +++ b/arch/x86/mm/physaddr.c
33901 @@ -10,7 +10,7 @@
33902 #ifdef CONFIG_X86_64
33903
33904 #ifdef CONFIG_DEBUG_VIRTUAL
33905 -unsigned long __phys_addr(unsigned long x)
33906 +unsigned long __intentional_overflow(-1) __phys_addr(unsigned long x)
33907 {
33908 unsigned long y = x - __START_KERNEL_map;
33909
33910 @@ -67,7 +67,7 @@ EXPORT_SYMBOL(__virt_addr_valid);
33911 #else
33912
33913 #ifdef CONFIG_DEBUG_VIRTUAL
33914 -unsigned long __phys_addr(unsigned long x)
33915 +unsigned long __intentional_overflow(-1) __phys_addr(unsigned long x)
33916 {
33917 unsigned long phys_addr = x - PAGE_OFFSET;
33918 /* VMALLOC_* aren't constants */
33919 diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
33920 index 90555bf..f5f1828 100644
33921 --- a/arch/x86/mm/setup_nx.c
33922 +++ b/arch/x86/mm/setup_nx.c
33923 @@ -5,8 +5,10 @@
33924 #include <asm/pgtable.h>
33925 #include <asm/proto.h>
33926
33927 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
33928 static int disable_nx;
33929
33930 +#ifndef CONFIG_PAX_PAGEEXEC
33931 /*
33932 * noexec = on|off
33933 *
33934 @@ -28,12 +30,17 @@ static int __init noexec_setup(char *str)
33935 return 0;
33936 }
33937 early_param("noexec", noexec_setup);
33938 +#endif
33939 +
33940 +#endif
33941
33942 void x86_configure_nx(void)
33943 {
33944 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
33945 if (cpu_has_nx && !disable_nx)
33946 __supported_pte_mask |= _PAGE_NX;
33947 else
33948 +#endif
33949 __supported_pte_mask &= ~_PAGE_NX;
33950 }
33951
33952 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
33953 index dd8dda1..9e9b0f6 100644
33954 --- a/arch/x86/mm/tlb.c
33955 +++ b/arch/x86/mm/tlb.c
33956 @@ -48,7 +48,11 @@ void leave_mm(int cpu)
33957 BUG();
33958 if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) {
33959 cpumask_clear_cpu(cpu, mm_cpumask(active_mm));
33960 +
33961 +#ifndef CONFIG_PAX_PER_CPU_PGD
33962 load_cr3(swapper_pg_dir);
33963 +#endif
33964 +
33965 }
33966 }
33967 EXPORT_SYMBOL_GPL(leave_mm);
33968 diff --git a/arch/x86/mm/uderef_64.c b/arch/x86/mm/uderef_64.c
33969 new file mode 100644
33970 index 0000000..dace51c
33971 --- /dev/null
33972 +++ b/arch/x86/mm/uderef_64.c
33973 @@ -0,0 +1,37 @@
33974 +#include <linux/mm.h>
33975 +#include <asm/pgtable.h>
33976 +#include <asm/uaccess.h>
33977 +
33978 +#ifdef CONFIG_PAX_MEMORY_UDEREF
33979 +/* PaX: due to the special call convention these functions must
33980 + * - remain leaf functions under all configurations,
33981 + * - never be called directly, only dereferenced from the wrappers.
33982 + */
33983 +void __pax_open_userland(void)
33984 +{
33985 + unsigned int cpu;
33986 +
33987 + if (unlikely(!segment_eq(get_fs(), USER_DS)))
33988 + return;
33989 +
33990 + cpu = raw_get_cpu();
33991 + BUG_ON((read_cr3() & ~PAGE_MASK) != PCID_KERNEL);
33992 + write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
33993 + raw_put_cpu_no_resched();
33994 +}
33995 +EXPORT_SYMBOL(__pax_open_userland);
33996 +
33997 +void __pax_close_userland(void)
33998 +{
33999 + unsigned int cpu;
34000 +
34001 + if (unlikely(!segment_eq(get_fs(), USER_DS)))
34002 + return;
34003 +
34004 + cpu = raw_get_cpu();
34005 + BUG_ON((read_cr3() & ~PAGE_MASK) != PCID_USER);
34006 + write_cr3(__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL | PCID_NOFLUSH);
34007 + raw_put_cpu_no_resched();
34008 +}
34009 +EXPORT_SYMBOL(__pax_close_userland);
34010 +#endif
34011 diff --git a/arch/x86/net/bpf_jit.S b/arch/x86/net/bpf_jit.S
34012 index 0149575..f746de8 100644
34013 --- a/arch/x86/net/bpf_jit.S
34014 +++ b/arch/x86/net/bpf_jit.S
34015 @@ -9,6 +9,7 @@
34016 */
34017 #include <linux/linkage.h>
34018 #include <asm/dwarf2.h>
34019 +#include <asm/alternative-asm.h>
34020
34021 /*
34022 * Calling convention :
34023 @@ -35,6 +36,7 @@ sk_load_word_positive_offset:
34024 jle bpf_slow_path_word
34025 mov (SKBDATA,%rsi),%eax
34026 bswap %eax /* ntohl() */
34027 + pax_force_retaddr
34028 ret
34029
34030 sk_load_half:
34031 @@ -52,6 +54,7 @@ sk_load_half_positive_offset:
34032 jle bpf_slow_path_half
34033 movzwl (SKBDATA,%rsi),%eax
34034 rol $8,%ax # ntohs()
34035 + pax_force_retaddr
34036 ret
34037
34038 sk_load_byte:
34039 @@ -66,6 +69,7 @@ sk_load_byte_positive_offset:
34040 cmp %esi,%r9d /* if (offset >= hlen) goto bpf_slow_path_byte */
34041 jle bpf_slow_path_byte
34042 movzbl (SKBDATA,%rsi),%eax
34043 + pax_force_retaddr
34044 ret
34045
34046 /**
34047 @@ -87,6 +91,7 @@ sk_load_byte_msh_positive_offset:
34048 movzbl (SKBDATA,%rsi),%ebx
34049 and $15,%bl
34050 shl $2,%bl
34051 + pax_force_retaddr
34052 ret
34053
34054 /* rsi contains offset and can be scratched */
34055 @@ -109,6 +114,7 @@ bpf_slow_path_word:
34056 js bpf_error
34057 mov -12(%rbp),%eax
34058 bswap %eax
34059 + pax_force_retaddr
34060 ret
34061
34062 bpf_slow_path_half:
34063 @@ -117,12 +123,14 @@ bpf_slow_path_half:
34064 mov -12(%rbp),%ax
34065 rol $8,%ax
34066 movzwl %ax,%eax
34067 + pax_force_retaddr
34068 ret
34069
34070 bpf_slow_path_byte:
34071 bpf_slow_path_common(1)
34072 js bpf_error
34073 movzbl -12(%rbp),%eax
34074 + pax_force_retaddr
34075 ret
34076
34077 bpf_slow_path_byte_msh:
34078 @@ -133,6 +141,7 @@ bpf_slow_path_byte_msh:
34079 and $15,%al
34080 shl $2,%al
34081 xchg %eax,%ebx
34082 + pax_force_retaddr
34083 ret
34084
34085 #define sk_negative_common(SIZE) \
34086 @@ -157,6 +166,7 @@ sk_load_word_negative_offset:
34087 sk_negative_common(4)
34088 mov (%rax), %eax
34089 bswap %eax
34090 + pax_force_retaddr
34091 ret
34092
34093 bpf_slow_path_half_neg:
34094 @@ -168,6 +178,7 @@ sk_load_half_negative_offset:
34095 mov (%rax),%ax
34096 rol $8,%ax
34097 movzwl %ax,%eax
34098 + pax_force_retaddr
34099 ret
34100
34101 bpf_slow_path_byte_neg:
34102 @@ -177,6 +188,7 @@ sk_load_byte_negative_offset:
34103 .globl sk_load_byte_negative_offset
34104 sk_negative_common(1)
34105 movzbl (%rax), %eax
34106 + pax_force_retaddr
34107 ret
34108
34109 bpf_slow_path_byte_msh_neg:
34110 @@ -190,6 +202,7 @@ sk_load_byte_msh_negative_offset:
34111 and $15,%al
34112 shl $2,%al
34113 xchg %eax,%ebx
34114 + pax_force_retaddr
34115 ret
34116
34117 bpf_error:
34118 @@ -197,4 +210,5 @@ bpf_error:
34119 xor %eax,%eax
34120 mov -8(%rbp),%rbx
34121 leaveq
34122 + pax_force_retaddr
34123 ret
34124 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
34125 index af2d431..3cf24f0b 100644
34126 --- a/arch/x86/net/bpf_jit_comp.c
34127 +++ b/arch/x86/net/bpf_jit_comp.c
34128 @@ -50,13 +50,90 @@ static inline u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len)
34129 return ptr + len;
34130 }
34131
34132 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34133 +#define MAX_INSTR_CODE_SIZE 96
34134 +#else
34135 +#define MAX_INSTR_CODE_SIZE 64
34136 +#endif
34137 +
34138 #define EMIT(bytes, len) do { prog = emit_code(prog, bytes, len); } while (0)
34139
34140 #define EMIT1(b1) EMIT(b1, 1)
34141 #define EMIT2(b1, b2) EMIT((b1) + ((b2) << 8), 2)
34142 #define EMIT3(b1, b2, b3) EMIT((b1) + ((b2) << 8) + ((b3) << 16), 3)
34143 #define EMIT4(b1, b2, b3, b4) EMIT((b1) + ((b2) << 8) + ((b3) << 16) + ((b4) << 24), 4)
34144 +
34145 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34146 +/* original constant will appear in ecx */
34147 +#define DILUTE_CONST_SEQUENCE(_off, _key) \
34148 +do { \
34149 + /* mov ecx, randkey */ \
34150 + EMIT1(0xb9); \
34151 + EMIT(_key, 4); \
34152 + /* xor ecx, randkey ^ off */ \
34153 + EMIT2(0x81, 0xf1); \
34154 + EMIT((_key) ^ (_off), 4); \
34155 +} while (0)
34156 +
34157 +#define EMIT1_off32(b1, _off) \
34158 +do { \
34159 + switch (b1) { \
34160 + case 0x05: /* add eax, imm32 */ \
34161 + case 0x2d: /* sub eax, imm32 */ \
34162 + case 0x25: /* and eax, imm32 */ \
34163 + case 0x0d: /* or eax, imm32 */ \
34164 + case 0xb8: /* mov eax, imm32 */ \
34165 + case 0x35: /* xor eax, imm32 */ \
34166 + case 0x3d: /* cmp eax, imm32 */ \
34167 + case 0xa9: /* test eax, imm32 */ \
34168 + DILUTE_CONST_SEQUENCE(_off, randkey); \
34169 + EMIT2((b1) - 4, 0xc8); /* convert imm instruction to eax, ecx */\
34170 + break; \
34171 + case 0xbb: /* mov ebx, imm32 */ \
34172 + DILUTE_CONST_SEQUENCE(_off, randkey); \
34173 + /* mov ebx, ecx */ \
34174 + EMIT2(0x89, 0xcb); \
34175 + break; \
34176 + case 0xbe: /* mov esi, imm32 */ \
34177 + DILUTE_CONST_SEQUENCE(_off, randkey); \
34178 + /* mov esi, ecx */ \
34179 + EMIT2(0x89, 0xce); \
34180 + break; \
34181 + case 0xe8: /* call rel imm32, always to known funcs */ \
34182 + EMIT1(b1); \
34183 + EMIT(_off, 4); \
34184 + break; \
34185 + case 0xe9: /* jmp rel imm32 */ \
34186 + EMIT1(b1); \
34187 + EMIT(_off, 4); \
34188 + /* prevent fall-through, we're not called if off = 0 */ \
34189 + EMIT(0xcccccccc, 4); \
34190 + EMIT(0xcccccccc, 4); \
34191 + break; \
34192 + default: \
34193 + BUILD_BUG(); \
34194 + } \
34195 +} while (0)
34196 +
34197 +#define EMIT2_off32(b1, b2, _off) \
34198 +do { \
34199 + if ((b1) == 0x8d && (b2) == 0xb3) { /* lea esi, [rbx+imm32] */ \
34200 + EMIT2(0x8d, 0xb3); /* lea esi, [rbx+randkey] */ \
34201 + EMIT(randkey, 4); \
34202 + EMIT2(0x8d, 0xb6); /* lea esi, [esi+off-randkey] */ \
34203 + EMIT((_off) - randkey, 4); \
34204 + } else if ((b1) == 0x69 && (b2) == 0xc0) { /* imul eax, imm32 */\
34205 + DILUTE_CONST_SEQUENCE(_off, randkey); \
34206 + /* imul eax, ecx */ \
34207 + EMIT3(0x0f, 0xaf, 0xc1); \
34208 + } else { \
34209 + BUILD_BUG(); \
34210 + } \
34211 +} while (0)
34212 +#else
34213 #define EMIT1_off32(b1, off) do { EMIT1(b1); EMIT(off, 4);} while (0)
34214 +#define EMIT2_off32(b1, b2, off) do { EMIT2(b1, b2); EMIT(off, 4);} while (0)
34215 +#endif
34216
34217 #define CLEAR_A() EMIT2(0x31, 0xc0) /* xor %eax,%eax */
34218 #define CLEAR_X() EMIT2(0x31, 0xdb) /* xor %ebx,%ebx */
34219 @@ -91,6 +168,24 @@ do { \
34220 #define X86_JBE 0x76
34221 #define X86_JA 0x77
34222
34223 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34224 +#define APPEND_FLOW_VERIFY() \
34225 +do { \
34226 + /* mov ecx, randkey */ \
34227 + EMIT1(0xb9); \
34228 + EMIT(randkey, 4); \
34229 + /* cmp ecx, randkey */ \
34230 + EMIT2(0x81, 0xf9); \
34231 + EMIT(randkey, 4); \
34232 + /* jz after 8 int 3s */ \
34233 + EMIT2(0x74, 0x08); \
34234 + EMIT(0xcccccccc, 4); \
34235 + EMIT(0xcccccccc, 4); \
34236 +} while (0)
34237 +#else
34238 +#define APPEND_FLOW_VERIFY() do { } while (0)
34239 +#endif
34240 +
34241 #define EMIT_COND_JMP(op, offset) \
34242 do { \
34243 if (is_near(offset)) \
34244 @@ -98,6 +193,7 @@ do { \
34245 else { \
34246 EMIT2(0x0f, op + 0x10); \
34247 EMIT(offset, 4); /* jxx .+off32 */ \
34248 + APPEND_FLOW_VERIFY(); \
34249 } \
34250 } while (0)
34251
34252 @@ -145,55 +241,54 @@ static int pkt_type_offset(void)
34253 return -1;
34254 }
34255
34256 -struct bpf_binary_header {
34257 - unsigned int pages;
34258 - /* Note : for security reasons, bpf code will follow a randomly
34259 - * sized amount of int3 instructions
34260 - */
34261 - u8 image[];
34262 -};
34263 -
34264 -static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen,
34265 +/* Note : for security reasons, bpf code will follow a randomly
34266 + * sized amount of int3 instructions
34267 + */
34268 +static u8 *bpf_alloc_binary(unsigned int proglen,
34269 u8 **image_ptr)
34270 {
34271 unsigned int sz, hole;
34272 - struct bpf_binary_header *header;
34273 + u8 *header;
34274
34275 /* Most of BPF filters are really small,
34276 * but if some of them fill a page, allow at least
34277 * 128 extra bytes to insert a random section of int3
34278 */
34279 - sz = round_up(proglen + sizeof(*header) + 128, PAGE_SIZE);
34280 - header = module_alloc(sz);
34281 + sz = round_up(proglen + 128, PAGE_SIZE);
34282 + header = module_alloc_exec(sz);
34283 if (!header)
34284 return NULL;
34285
34286 + pax_open_kernel();
34287 memset(header, 0xcc, sz); /* fill whole space with int3 instructions */
34288 + pax_close_kernel();
34289
34290 - header->pages = sz / PAGE_SIZE;
34291 - hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header));
34292 + hole = PAGE_SIZE - (proglen & ~PAGE_MASK);
34293
34294 /* insert a random number of int3 instructions before BPF code */
34295 - *image_ptr = &header->image[prandom_u32() % hole];
34296 + *image_ptr = &header[prandom_u32() % hole];
34297 return header;
34298 }
34299
34300 void bpf_jit_compile(struct sk_filter *fp)
34301 {
34302 - u8 temp[64];
34303 + u8 temp[MAX_INSTR_CODE_SIZE];
34304 u8 *prog;
34305 unsigned int proglen, oldproglen = 0;
34306 int ilen, i;
34307 int t_offset, f_offset;
34308 u8 t_op, f_op, seen = 0, pass;
34309 u8 *image = NULL;
34310 - struct bpf_binary_header *header = NULL;
34311 + u8 *header = NULL;
34312 u8 *func;
34313 int pc_ret0 = -1; /* bpf index of first RET #0 instruction (if any) */
34314 unsigned int cleanup_addr; /* epilogue code offset */
34315 unsigned int *addrs;
34316 const struct sock_filter *filter = fp->insns;
34317 int flen = fp->len;
34318 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34319 + unsigned int randkey;
34320 +#endif
34321
34322 if (!bpf_jit_enable)
34323 return;
34324 @@ -203,10 +298,10 @@ void bpf_jit_compile(struct sk_filter *fp)
34325 return;
34326
34327 /* Before first pass, make a rough estimation of addrs[]
34328 - * each bpf instruction is translated to less than 64 bytes
34329 + * each bpf instruction is translated to less than MAX_INSTR_CODE_SIZE bytes
34330 */
34331 for (proglen = 0, i = 0; i < flen; i++) {
34332 - proglen += 64;
34333 + proglen += MAX_INSTR_CODE_SIZE;
34334 addrs[i] = proglen;
34335 }
34336 cleanup_addr = proglen; /* epilogue address */
34337 @@ -285,6 +380,10 @@ void bpf_jit_compile(struct sk_filter *fp)
34338 for (i = 0; i < flen; i++) {
34339 unsigned int K = filter[i].k;
34340
34341 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34342 + randkey = prandom_u32();
34343 +#endif
34344 +
34345 switch (filter[i].code) {
34346 case BPF_S_ALU_ADD_X: /* A += X; */
34347 seen |= SEEN_XREG;
34348 @@ -317,10 +416,8 @@ void bpf_jit_compile(struct sk_filter *fp)
34349 case BPF_S_ALU_MUL_K: /* A *= K */
34350 if (is_imm8(K))
34351 EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
34352 - else {
34353 - EMIT2(0x69, 0xc0); /* imul imm32,%eax */
34354 - EMIT(K, 4);
34355 - }
34356 + else
34357 + EMIT2_off32(0x69, 0xc0, K); /* imul imm32,%eax */
34358 break;
34359 case BPF_S_ALU_DIV_X: /* A /= X; */
34360 seen |= SEEN_XREG;
34361 @@ -364,7 +461,11 @@ void bpf_jit_compile(struct sk_filter *fp)
34362 break;
34363 }
34364 EMIT2(0x31, 0xd2); /* xor %edx,%edx */
34365 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34366 + DILUTE_CONST_SEQUENCE(K, randkey);
34367 +#else
34368 EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
34369 +#endif
34370 EMIT2(0xf7, 0xf1); /* div %ecx */
34371 EMIT2(0x89, 0xd0); /* mov %edx,%eax */
34372 break;
34373 @@ -372,7 +473,11 @@ void bpf_jit_compile(struct sk_filter *fp)
34374 if (K == 1)
34375 break;
34376 EMIT2(0x31, 0xd2); /* xor %edx,%edx */
34377 +#ifdef CONFIG_GRKERNSEC_JIT_HARDEN
34378 + DILUTE_CONST_SEQUENCE(K, randkey);
34379 +#else
34380 EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
34381 +#endif
34382 EMIT2(0xf7, 0xf1); /* div %ecx */
34383 break;
34384 case BPF_S_ALU_AND_X:
34385 @@ -643,8 +748,7 @@ common_load_ind: seen |= SEEN_DATAREF | SEEN_XREG;
34386 if (is_imm8(K)) {
34387 EMIT3(0x8d, 0x73, K); /* lea imm8(%rbx), %esi */
34388 } else {
34389 - EMIT2(0x8d, 0xb3); /* lea imm32(%rbx),%esi */
34390 - EMIT(K, 4);
34391 + EMIT2_off32(0x8d, 0xb3, K); /* lea imm32(%rbx),%esi */
34392 }
34393 } else {
34394 EMIT2(0x89,0xde); /* mov %ebx,%esi */
34395 @@ -734,10 +838,12 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
34396 if (unlikely(proglen + ilen > oldproglen)) {
34397 pr_err("bpb_jit_compile fatal error\n");
34398 kfree(addrs);
34399 - module_free(NULL, header);
34400 + module_free_exec(NULL, image);
34401 return;
34402 }
34403 + pax_open_kernel();
34404 memcpy(image + proglen, temp, ilen);
34405 + pax_close_kernel();
34406 }
34407 proglen += ilen;
34408 addrs[i] = proglen;
34409 @@ -770,7 +876,6 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
34410
34411 if (image) {
34412 bpf_flush_icache(header, image + proglen);
34413 - set_memory_ro((unsigned long)header, header->pages);
34414 fp->bpf_func = (void *)image;
34415 }
34416 out:
34417 @@ -782,10 +887,9 @@ static void bpf_jit_free_deferred(struct work_struct *work)
34418 {
34419 struct sk_filter *fp = container_of(work, struct sk_filter, work);
34420 unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
34421 - struct bpf_binary_header *header = (void *)addr;
34422
34423 - set_memory_rw(addr, header->pages);
34424 - module_free(NULL, header);
34425 + set_memory_rw(addr, 1);
34426 + module_free_exec(NULL, (void *)addr);
34427 kfree(fp);
34428 }
34429
34430 diff --git a/arch/x86/oprofile/backtrace.c b/arch/x86/oprofile/backtrace.c
34431 index 5d04be5..2beeaa2 100644
34432 --- a/arch/x86/oprofile/backtrace.c
34433 +++ b/arch/x86/oprofile/backtrace.c
34434 @@ -46,11 +46,11 @@ dump_user_backtrace_32(struct stack_frame_ia32 *head)
34435 struct stack_frame_ia32 *fp;
34436 unsigned long bytes;
34437
34438 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
34439 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
34440 if (bytes != 0)
34441 return NULL;
34442
34443 - fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame);
34444 + fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame);
34445
34446 oprofile_add_trace(bufhead[0].return_address);
34447
34448 @@ -92,7 +92,7 @@ static struct stack_frame *dump_user_backtrace(struct stack_frame *head)
34449 struct stack_frame bufhead[2];
34450 unsigned long bytes;
34451
34452 - bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead));
34453 + bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead));
34454 if (bytes != 0)
34455 return NULL;
34456
34457 @@ -111,7 +111,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
34458 {
34459 struct stack_frame *head = (struct stack_frame *)frame_pointer(regs);
34460
34461 - if (!user_mode_vm(regs)) {
34462 + if (!user_mode(regs)) {
34463 unsigned long stack = kernel_stack_pointer(regs);
34464 if (depth)
34465 dump_trace(NULL, regs, (unsigned long *)stack, 0,
34466 diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
34467 index 6890d84..1dad1f1 100644
34468 --- a/arch/x86/oprofile/nmi_int.c
34469 +++ b/arch/x86/oprofile/nmi_int.c
34470 @@ -23,6 +23,7 @@
34471 #include <asm/nmi.h>
34472 #include <asm/msr.h>
34473 #include <asm/apic.h>
34474 +#include <asm/pgtable.h>
34475
34476 #include "op_counter.h"
34477 #include "op_x86_model.h"
34478 @@ -774,8 +775,11 @@ int __init op_nmi_init(struct oprofile_operations *ops)
34479 if (ret)
34480 return ret;
34481
34482 - if (!model->num_virt_counters)
34483 - model->num_virt_counters = model->num_counters;
34484 + if (!model->num_virt_counters) {
34485 + pax_open_kernel();
34486 + *(unsigned int *)&model->num_virt_counters = model->num_counters;
34487 + pax_close_kernel();
34488 + }
34489
34490 mux_init(ops);
34491
34492 diff --git a/arch/x86/oprofile/op_model_amd.c b/arch/x86/oprofile/op_model_amd.c
34493 index 50d86c0..7985318 100644
34494 --- a/arch/x86/oprofile/op_model_amd.c
34495 +++ b/arch/x86/oprofile/op_model_amd.c
34496 @@ -519,9 +519,11 @@ static int op_amd_init(struct oprofile_operations *ops)
34497 num_counters = AMD64_NUM_COUNTERS;
34498 }
34499
34500 - op_amd_spec.num_counters = num_counters;
34501 - op_amd_spec.num_controls = num_counters;
34502 - op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
34503 + pax_open_kernel();
34504 + *(unsigned int *)&op_amd_spec.num_counters = num_counters;
34505 + *(unsigned int *)&op_amd_spec.num_controls = num_counters;
34506 + *(unsigned int *)&op_amd_spec.num_virt_counters = max(num_counters, NUM_VIRT_COUNTERS);
34507 + pax_close_kernel();
34508
34509 return 0;
34510 }
34511 diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
34512 index d90528e..0127e2b 100644
34513 --- a/arch/x86/oprofile/op_model_ppro.c
34514 +++ b/arch/x86/oprofile/op_model_ppro.c
34515 @@ -19,6 +19,7 @@
34516 #include <asm/msr.h>
34517 #include <asm/apic.h>
34518 #include <asm/nmi.h>
34519 +#include <asm/pgtable.h>
34520
34521 #include "op_x86_model.h"
34522 #include "op_counter.h"
34523 @@ -221,8 +222,10 @@ static void arch_perfmon_setup_counters(void)
34524
34525 num_counters = min((int)eax.split.num_counters, OP_MAX_COUNTER);
34526
34527 - op_arch_perfmon_spec.num_counters = num_counters;
34528 - op_arch_perfmon_spec.num_controls = num_counters;
34529 + pax_open_kernel();
34530 + *(unsigned int *)&op_arch_perfmon_spec.num_counters = num_counters;
34531 + *(unsigned int *)&op_arch_perfmon_spec.num_controls = num_counters;
34532 + pax_close_kernel();
34533 }
34534
34535 static int arch_perfmon_init(struct oprofile_operations *ignore)
34536 diff --git a/arch/x86/oprofile/op_x86_model.h b/arch/x86/oprofile/op_x86_model.h
34537 index 71e8a67..6a313bb 100644
34538 --- a/arch/x86/oprofile/op_x86_model.h
34539 +++ b/arch/x86/oprofile/op_x86_model.h
34540 @@ -52,7 +52,7 @@ struct op_x86_model_spec {
34541 void (*switch_ctrl)(struct op_x86_model_spec const *model,
34542 struct op_msrs const * const msrs);
34543 #endif
34544 -};
34545 +} __do_const;
34546
34547 struct op_counter_config;
34548
34549 diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
34550 index 84b9d67..260e5ff 100644
34551 --- a/arch/x86/pci/intel_mid_pci.c
34552 +++ b/arch/x86/pci/intel_mid_pci.c
34553 @@ -245,7 +245,7 @@ int __init intel_mid_pci_init(void)
34554 pr_info("Intel MID platform detected, using MID PCI ops\n");
34555 pci_mmcfg_late_init();
34556 pcibios_enable_irq = intel_mid_pci_irq_enable;
34557 - pci_root_ops = intel_mid_pci_ops;
34558 + memcpy((void *)&pci_root_ops, &intel_mid_pci_ops, sizeof pci_root_ops);
34559 pci_soc_mode = 1;
34560 /* Continue with standard init */
34561 return 1;
34562 diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
34563 index 372e9b8..e775a6c 100644
34564 --- a/arch/x86/pci/irq.c
34565 +++ b/arch/x86/pci/irq.c
34566 @@ -50,7 +50,7 @@ struct irq_router {
34567 struct irq_router_handler {
34568 u16 vendor;
34569 int (*probe)(struct irq_router *r, struct pci_dev *router, u16 device);
34570 -};
34571 +} __do_const;
34572
34573 int (*pcibios_enable_irq)(struct pci_dev *dev) = pirq_enable_irq;
34574 void (*pcibios_disable_irq)(struct pci_dev *dev) = NULL;
34575 @@ -794,7 +794,7 @@ static __init int pico_router_probe(struct irq_router *r, struct pci_dev *router
34576 return 0;
34577 }
34578
34579 -static __initdata struct irq_router_handler pirq_routers[] = {
34580 +static __initconst const struct irq_router_handler pirq_routers[] = {
34581 { PCI_VENDOR_ID_INTEL, intel_router_probe },
34582 { PCI_VENDOR_ID_AL, ali_router_probe },
34583 { PCI_VENDOR_ID_ITE, ite_router_probe },
34584 @@ -821,7 +821,7 @@ static struct pci_dev *pirq_router_dev;
34585 static void __init pirq_find_router(struct irq_router *r)
34586 {
34587 struct irq_routing_table *rt = pirq_table;
34588 - struct irq_router_handler *h;
34589 + const struct irq_router_handler *h;
34590
34591 #ifdef CONFIG_PCI_BIOS
34592 if (!rt->signature) {
34593 @@ -1094,7 +1094,7 @@ static int __init fix_acer_tm360_irqrouting(const struct dmi_system_id *d)
34594 return 0;
34595 }
34596
34597 -static struct dmi_system_id __initdata pciirq_dmi_table[] = {
34598 +static const struct dmi_system_id __initconst pciirq_dmi_table[] = {
34599 {
34600 .callback = fix_broken_hp_bios_irq9,
34601 .ident = "HP Pavilion N5400 Series Laptop",
34602 diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
34603 index c77b24a..c979855 100644
34604 --- a/arch/x86/pci/pcbios.c
34605 +++ b/arch/x86/pci/pcbios.c
34606 @@ -79,7 +79,7 @@ union bios32 {
34607 static struct {
34608 unsigned long address;
34609 unsigned short segment;
34610 -} bios32_indirect = { 0, __KERNEL_CS };
34611 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
34612
34613 /*
34614 * Returns the entry point for the given service, NULL on error
34615 @@ -92,37 +92,80 @@ static unsigned long bios32_service(unsigned long service)
34616 unsigned long length; /* %ecx */
34617 unsigned long entry; /* %edx */
34618 unsigned long flags;
34619 + struct desc_struct d, *gdt;
34620
34621 local_irq_save(flags);
34622 - __asm__("lcall *(%%edi); cld"
34623 +
34624 + gdt = get_cpu_gdt_table(smp_processor_id());
34625 +
34626 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
34627 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
34628 + pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
34629 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
34630 +
34631 + __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
34632 : "=a" (return_code),
34633 "=b" (address),
34634 "=c" (length),
34635 "=d" (entry)
34636 : "0" (service),
34637 "1" (0),
34638 - "D" (&bios32_indirect));
34639 + "D" (&bios32_indirect),
34640 + "r"(__PCIBIOS_DS)
34641 + : "memory");
34642 +
34643 + pax_open_kernel();
34644 + gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
34645 + gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
34646 + gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
34647 + gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
34648 + pax_close_kernel();
34649 +
34650 local_irq_restore(flags);
34651
34652 switch (return_code) {
34653 - case 0:
34654 - return address + entry;
34655 - case 0x80: /* Not present */
34656 - printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
34657 - return 0;
34658 - default: /* Shouldn't happen */
34659 - printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
34660 - service, return_code);
34661 + case 0: {
34662 + int cpu;
34663 + unsigned char flags;
34664 +
34665 + printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
34666 + if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
34667 + printk(KERN_WARNING "bios32_service: not valid\n");
34668 return 0;
34669 + }
34670 + address = address + PAGE_OFFSET;
34671 + length += 16UL; /* some BIOSs underreport this... */
34672 + flags = 4;
34673 + if (length >= 64*1024*1024) {
34674 + length >>= PAGE_SHIFT;
34675 + flags |= 8;
34676 + }
34677 +
34678 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
34679 + gdt = get_cpu_gdt_table(cpu);
34680 + pack_descriptor(&d, address, length, 0x9b, flags);
34681 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
34682 + pack_descriptor(&d, address, length, 0x93, flags);
34683 + write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
34684 + }
34685 + return entry;
34686 + }
34687 + case 0x80: /* Not present */
34688 + printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
34689 + return 0;
34690 + default: /* Shouldn't happen */
34691 + printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
34692 + service, return_code);
34693 + return 0;
34694 }
34695 }
34696
34697 static struct {
34698 unsigned long address;
34699 unsigned short segment;
34700 -} pci_indirect = { 0, __KERNEL_CS };
34701 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
34702
34703 -static int pci_bios_present;
34704 +static int pci_bios_present __read_only;
34705
34706 static int check_pcibios(void)
34707 {
34708 @@ -131,11 +174,13 @@ static int check_pcibios(void)
34709 unsigned long flags, pcibios_entry;
34710
34711 if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
34712 - pci_indirect.address = pcibios_entry + PAGE_OFFSET;
34713 + pci_indirect.address = pcibios_entry;
34714
34715 local_irq_save(flags);
34716 - __asm__(
34717 - "lcall *(%%edi); cld\n\t"
34718 + __asm__("movw %w6, %%ds\n\t"
34719 + "lcall *%%ss:(%%edi); cld\n\t"
34720 + "push %%ss\n\t"
34721 + "pop %%ds\n\t"
34722 "jc 1f\n\t"
34723 "xor %%ah, %%ah\n"
34724 "1:"
34725 @@ -144,7 +189,8 @@ static int check_pcibios(void)
34726 "=b" (ebx),
34727 "=c" (ecx)
34728 : "1" (PCIBIOS_PCI_BIOS_PRESENT),
34729 - "D" (&pci_indirect)
34730 + "D" (&pci_indirect),
34731 + "r" (__PCIBIOS_DS)
34732 : "memory");
34733 local_irq_restore(flags);
34734
34735 @@ -189,7 +235,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34736
34737 switch (len) {
34738 case 1:
34739 - __asm__("lcall *(%%esi); cld\n\t"
34740 + __asm__("movw %w6, %%ds\n\t"
34741 + "lcall *%%ss:(%%esi); cld\n\t"
34742 + "push %%ss\n\t"
34743 + "pop %%ds\n\t"
34744 "jc 1f\n\t"
34745 "xor %%ah, %%ah\n"
34746 "1:"
34747 @@ -198,7 +247,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34748 : "1" (PCIBIOS_READ_CONFIG_BYTE),
34749 "b" (bx),
34750 "D" ((long)reg),
34751 - "S" (&pci_indirect));
34752 + "S" (&pci_indirect),
34753 + "r" (__PCIBIOS_DS));
34754 /*
34755 * Zero-extend the result beyond 8 bits, do not trust the
34756 * BIOS having done it:
34757 @@ -206,7 +256,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34758 *value &= 0xff;
34759 break;
34760 case 2:
34761 - __asm__("lcall *(%%esi); cld\n\t"
34762 + __asm__("movw %w6, %%ds\n\t"
34763 + "lcall *%%ss:(%%esi); cld\n\t"
34764 + "push %%ss\n\t"
34765 + "pop %%ds\n\t"
34766 "jc 1f\n\t"
34767 "xor %%ah, %%ah\n"
34768 "1:"
34769 @@ -215,7 +268,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34770 : "1" (PCIBIOS_READ_CONFIG_WORD),
34771 "b" (bx),
34772 "D" ((long)reg),
34773 - "S" (&pci_indirect));
34774 + "S" (&pci_indirect),
34775 + "r" (__PCIBIOS_DS));
34776 /*
34777 * Zero-extend the result beyond 16 bits, do not trust the
34778 * BIOS having done it:
34779 @@ -223,7 +277,10 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34780 *value &= 0xffff;
34781 break;
34782 case 4:
34783 - __asm__("lcall *(%%esi); cld\n\t"
34784 + __asm__("movw %w6, %%ds\n\t"
34785 + "lcall *%%ss:(%%esi); cld\n\t"
34786 + "push %%ss\n\t"
34787 + "pop %%ds\n\t"
34788 "jc 1f\n\t"
34789 "xor %%ah, %%ah\n"
34790 "1:"
34791 @@ -232,7 +289,8 @@ static int pci_bios_read(unsigned int seg, unsigned int bus,
34792 : "1" (PCIBIOS_READ_CONFIG_DWORD),
34793 "b" (bx),
34794 "D" ((long)reg),
34795 - "S" (&pci_indirect));
34796 + "S" (&pci_indirect),
34797 + "r" (__PCIBIOS_DS));
34798 break;
34799 }
34800
34801 @@ -256,7 +314,10 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34802
34803 switch (len) {
34804 case 1:
34805 - __asm__("lcall *(%%esi); cld\n\t"
34806 + __asm__("movw %w6, %%ds\n\t"
34807 + "lcall *%%ss:(%%esi); cld\n\t"
34808 + "push %%ss\n\t"
34809 + "pop %%ds\n\t"
34810 "jc 1f\n\t"
34811 "xor %%ah, %%ah\n"
34812 "1:"
34813 @@ -265,10 +326,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34814 "c" (value),
34815 "b" (bx),
34816 "D" ((long)reg),
34817 - "S" (&pci_indirect));
34818 + "S" (&pci_indirect),
34819 + "r" (__PCIBIOS_DS));
34820 break;
34821 case 2:
34822 - __asm__("lcall *(%%esi); cld\n\t"
34823 + __asm__("movw %w6, %%ds\n\t"
34824 + "lcall *%%ss:(%%esi); cld\n\t"
34825 + "push %%ss\n\t"
34826 + "pop %%ds\n\t"
34827 "jc 1f\n\t"
34828 "xor %%ah, %%ah\n"
34829 "1:"
34830 @@ -277,10 +342,14 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34831 "c" (value),
34832 "b" (bx),
34833 "D" ((long)reg),
34834 - "S" (&pci_indirect));
34835 + "S" (&pci_indirect),
34836 + "r" (__PCIBIOS_DS));
34837 break;
34838 case 4:
34839 - __asm__("lcall *(%%esi); cld\n\t"
34840 + __asm__("movw %w6, %%ds\n\t"
34841 + "lcall *%%ss:(%%esi); cld\n\t"
34842 + "push %%ss\n\t"
34843 + "pop %%ds\n\t"
34844 "jc 1f\n\t"
34845 "xor %%ah, %%ah\n"
34846 "1:"
34847 @@ -289,7 +358,8 @@ static int pci_bios_write(unsigned int seg, unsigned int bus,
34848 "c" (value),
34849 "b" (bx),
34850 "D" ((long)reg),
34851 - "S" (&pci_indirect));
34852 + "S" (&pci_indirect),
34853 + "r" (__PCIBIOS_DS));
34854 break;
34855 }
34856
34857 @@ -394,10 +464,13 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
34858
34859 DBG("PCI: Fetching IRQ routing table... ");
34860 __asm__("push %%es\n\t"
34861 + "movw %w8, %%ds\n\t"
34862 "push %%ds\n\t"
34863 "pop %%es\n\t"
34864 - "lcall *(%%esi); cld\n\t"
34865 + "lcall *%%ss:(%%esi); cld\n\t"
34866 "pop %%es\n\t"
34867 + "push %%ss\n\t"
34868 + "pop %%ds\n"
34869 "jc 1f\n\t"
34870 "xor %%ah, %%ah\n"
34871 "1:"
34872 @@ -408,7 +481,8 @@ struct irq_routing_table * pcibios_get_irq_routing_table(void)
34873 "1" (0),
34874 "D" ((long) &opt),
34875 "S" (&pci_indirect),
34876 - "m" (opt)
34877 + "m" (opt),
34878 + "r" (__PCIBIOS_DS)
34879 : "memory");
34880 DBG("OK ret=%d, size=%d, map=%x\n", ret, opt.size, map);
34881 if (ret & 0xff00)
34882 @@ -432,7 +506,10 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
34883 {
34884 int ret;
34885
34886 - __asm__("lcall *(%%esi); cld\n\t"
34887 + __asm__("movw %w5, %%ds\n\t"
34888 + "lcall *%%ss:(%%esi); cld\n\t"
34889 + "push %%ss\n\t"
34890 + "pop %%ds\n"
34891 "jc 1f\n\t"
34892 "xor %%ah, %%ah\n"
34893 "1:"
34894 @@ -440,7 +517,8 @@ int pcibios_set_irq_routing(struct pci_dev *dev, int pin, int irq)
34895 : "0" (PCIBIOS_SET_PCI_HW_INT),
34896 "b" ((dev->bus->number << 8) | dev->devfn),
34897 "c" ((irq << 8) | (pin + 10)),
34898 - "S" (&pci_indirect));
34899 + "S" (&pci_indirect),
34900 + "r" (__PCIBIOS_DS));
34901 return !(ret & 0xff00);
34902 }
34903 EXPORT_SYMBOL(pcibios_set_irq_routing);
34904 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
34905 index 9ee3491..872192f 100644
34906 --- a/arch/x86/platform/efi/efi_32.c
34907 +++ b/arch/x86/platform/efi/efi_32.c
34908 @@ -59,11 +59,22 @@ void efi_call_phys_prelog(void)
34909 {
34910 struct desc_ptr gdt_descr;
34911
34912 +#ifdef CONFIG_PAX_KERNEXEC
34913 + struct desc_struct d;
34914 +#endif
34915 +
34916 local_irq_save(efi_rt_eflags);
34917
34918 load_cr3(initial_page_table);
34919 __flush_tlb_all();
34920
34921 +#ifdef CONFIG_PAX_KERNEXEC
34922 + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC);
34923 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
34924 + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC);
34925 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
34926 +#endif
34927 +
34928 gdt_descr.address = __pa(get_cpu_gdt_table(0));
34929 gdt_descr.size = GDT_SIZE - 1;
34930 load_gdt(&gdt_descr);
34931 @@ -73,11 +84,24 @@ void efi_call_phys_epilog(void)
34932 {
34933 struct desc_ptr gdt_descr;
34934
34935 +#ifdef CONFIG_PAX_KERNEXEC
34936 + struct desc_struct d;
34937 +
34938 + memset(&d, 0, sizeof d);
34939 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S);
34940 + write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S);
34941 +#endif
34942 +
34943 gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
34944 gdt_descr.size = GDT_SIZE - 1;
34945 load_gdt(&gdt_descr);
34946
34947 +#ifdef CONFIG_PAX_PER_CPU_PGD
34948 + load_cr3(get_cpu_pgd(smp_processor_id(), kernel));
34949 +#else
34950 load_cr3(swapper_pg_dir);
34951 +#endif
34952 +
34953 __flush_tlb_all();
34954
34955 local_irq_restore(efi_rt_eflags);
34956 diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
34957 index 666b74a..673d88f 100644
34958 --- a/arch/x86/platform/efi/efi_64.c
34959 +++ b/arch/x86/platform/efi/efi_64.c
34960 @@ -97,6 +97,11 @@ void __init efi_call_phys_prelog(void)
34961 vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
34962 set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
34963 }
34964 +
34965 +#ifdef CONFIG_PAX_PER_CPU_PGD
34966 + load_cr3(swapper_pg_dir);
34967 +#endif
34968 +
34969 __flush_tlb_all();
34970 }
34971
34972 @@ -114,6 +119,11 @@ void __init efi_call_phys_epilog(void)
34973 for (pgd = 0; pgd < n_pgds; pgd++)
34974 set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
34975 kfree(save_pgd);
34976 +
34977 +#ifdef CONFIG_PAX_PER_CPU_PGD
34978 + load_cr3(get_cpu_pgd(smp_processor_id(), kernel));
34979 +#endif
34980 +
34981 __flush_tlb_all();
34982 local_irq_restore(efi_flags);
34983 early_code_mapping_set_exec(0);
34984 diff --git a/arch/x86/platform/efi/efi_stub_32.S b/arch/x86/platform/efi/efi_stub_32.S
34985 index fbe66e6..eae5e38 100644
34986 --- a/arch/x86/platform/efi/efi_stub_32.S
34987 +++ b/arch/x86/platform/efi/efi_stub_32.S
34988 @@ -6,7 +6,9 @@
34989 */
34990
34991 #include <linux/linkage.h>
34992 +#include <linux/init.h>
34993 #include <asm/page_types.h>
34994 +#include <asm/segment.h>
34995
34996 /*
34997 * efi_call_phys(void *, ...) is a function with variable parameters.
34998 @@ -20,7 +22,7 @@
34999 * service functions will comply with gcc calling convention, too.
35000 */
35001
35002 -.text
35003 +__INIT
35004 ENTRY(efi_call_phys)
35005 /*
35006 * 0. The function can only be called in Linux kernel. So CS has been
35007 @@ -36,10 +38,24 @@ ENTRY(efi_call_phys)
35008 * The mapping of lower virtual memory has been created in prelog and
35009 * epilog.
35010 */
35011 - movl $1f, %edx
35012 - subl $__PAGE_OFFSET, %edx
35013 - jmp *%edx
35014 +#ifdef CONFIG_PAX_KERNEXEC
35015 + movl $(__KERNEXEC_EFI_DS), %edx
35016 + mov %edx, %ds
35017 + mov %edx, %es
35018 + mov %edx, %ss
35019 + addl $2f,(1f)
35020 + ljmp *(1f)
35021 +
35022 +__INITDATA
35023 +1: .long __LOAD_PHYSICAL_ADDR, __KERNEXEC_EFI_CS
35024 +.previous
35025 +
35026 +2:
35027 + subl $2b,(1b)
35028 +#else
35029 + jmp 1f-__PAGE_OFFSET
35030 1:
35031 +#endif
35032
35033 /*
35034 * 2. Now on the top of stack is the return
35035 @@ -47,14 +63,8 @@ ENTRY(efi_call_phys)
35036 * parameter 2, ..., param n. To make things easy, we save the return
35037 * address of efi_call_phys in a global variable.
35038 */
35039 - popl %edx
35040 - movl %edx, saved_return_addr
35041 - /* get the function pointer into ECX*/
35042 - popl %ecx
35043 - movl %ecx, efi_rt_function_ptr
35044 - movl $2f, %edx
35045 - subl $__PAGE_OFFSET, %edx
35046 - pushl %edx
35047 + popl (saved_return_addr)
35048 + popl (efi_rt_function_ptr)
35049
35050 /*
35051 * 3. Clear PG bit in %CR0.
35052 @@ -73,9 +83,8 @@ ENTRY(efi_call_phys)
35053 /*
35054 * 5. Call the physical function.
35055 */
35056 - jmp *%ecx
35057 + call *(efi_rt_function_ptr-__PAGE_OFFSET)
35058
35059 -2:
35060 /*
35061 * 6. After EFI runtime service returns, control will return to
35062 * following instruction. We'd better readjust stack pointer first.
35063 @@ -88,35 +97,36 @@ ENTRY(efi_call_phys)
35064 movl %cr0, %edx
35065 orl $0x80000000, %edx
35066 movl %edx, %cr0
35067 - jmp 1f
35068 -1:
35069 +
35070 /*
35071 * 8. Now restore the virtual mode from flat mode by
35072 * adding EIP with PAGE_OFFSET.
35073 */
35074 - movl $1f, %edx
35075 - jmp *%edx
35076 +#ifdef CONFIG_PAX_KERNEXEC
35077 + movl $(__KERNEL_DS), %edx
35078 + mov %edx, %ds
35079 + mov %edx, %es
35080 + mov %edx, %ss
35081 + ljmp $(__KERNEL_CS),$1f
35082 +#else
35083 + jmp 1f+__PAGE_OFFSET
35084 +#endif
35085 1:
35086
35087 /*
35088 * 9. Balance the stack. And because EAX contain the return value,
35089 * we'd better not clobber it.
35090 */
35091 - leal efi_rt_function_ptr, %edx
35092 - movl (%edx), %ecx
35093 - pushl %ecx
35094 + pushl (efi_rt_function_ptr)
35095
35096 /*
35097 - * 10. Push the saved return address onto the stack and return.
35098 + * 10. Return to the saved return address.
35099 */
35100 - leal saved_return_addr, %edx
35101 - movl (%edx), %ecx
35102 - pushl %ecx
35103 - ret
35104 + jmpl *(saved_return_addr)
35105 ENDPROC(efi_call_phys)
35106 .previous
35107
35108 -.data
35109 +__INITDATA
35110 saved_return_addr:
35111 .long 0
35112 efi_rt_function_ptr:
35113 diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
35114 index 88073b1..1cc2f53 100644
35115 --- a/arch/x86/platform/efi/efi_stub_64.S
35116 +++ b/arch/x86/platform/efi/efi_stub_64.S
35117 @@ -7,6 +7,7 @@
35118 */
35119
35120 #include <linux/linkage.h>
35121 +#include <asm/alternative-asm.h>
35122
35123 #define SAVE_XMM \
35124 mov %rsp, %rax; \
35125 @@ -77,6 +78,7 @@ ENTRY(efi_call0)
35126 RESTORE_PGT
35127 addq $32, %rsp
35128 RESTORE_XMM
35129 + pax_force_retaddr 0, 1
35130 ret
35131 ENDPROC(efi_call0)
35132
35133 @@ -89,6 +91,7 @@ ENTRY(efi_call1)
35134 RESTORE_PGT
35135 addq $32, %rsp
35136 RESTORE_XMM
35137 + pax_force_retaddr 0, 1
35138 ret
35139 ENDPROC(efi_call1)
35140
35141 @@ -101,6 +104,7 @@ ENTRY(efi_call2)
35142 RESTORE_PGT
35143 addq $32, %rsp
35144 RESTORE_XMM
35145 + pax_force_retaddr 0, 1
35146 ret
35147 ENDPROC(efi_call2)
35148
35149 @@ -114,6 +118,7 @@ ENTRY(efi_call3)
35150 RESTORE_PGT
35151 addq $32, %rsp
35152 RESTORE_XMM
35153 + pax_force_retaddr 0, 1
35154 ret
35155 ENDPROC(efi_call3)
35156
35157 @@ -128,6 +133,7 @@ ENTRY(efi_call4)
35158 RESTORE_PGT
35159 addq $32, %rsp
35160 RESTORE_XMM
35161 + pax_force_retaddr 0, 1
35162 ret
35163 ENDPROC(efi_call4)
35164
35165 @@ -143,6 +149,7 @@ ENTRY(efi_call5)
35166 RESTORE_PGT
35167 addq $48, %rsp
35168 RESTORE_XMM
35169 + pax_force_retaddr 0, 1
35170 ret
35171 ENDPROC(efi_call5)
35172
35173 @@ -161,6 +168,7 @@ ENTRY(efi_call6)
35174 RESTORE_PGT
35175 addq $48, %rsp
35176 RESTORE_XMM
35177 + pax_force_retaddr 0, 1
35178 ret
35179 ENDPROC(efi_call6)
35180
35181 diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
35182 index 1bbedc4..eb795b5 100644
35183 --- a/arch/x86/platform/intel-mid/intel-mid.c
35184 +++ b/arch/x86/platform/intel-mid/intel-mid.c
35185 @@ -71,9 +71,10 @@ static void intel_mid_power_off(void)
35186 {
35187 };
35188
35189 -static void intel_mid_reboot(void)
35190 +static void __noreturn intel_mid_reboot(void)
35191 {
35192 intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0);
35193 + BUG();
35194 }
35195
35196 static unsigned long __init intel_mid_calibrate_tsc(void)
35197 diff --git a/arch/x86/platform/olpc/olpc_dt.c b/arch/x86/platform/olpc/olpc_dt.c
35198 index d6ee929..3637cb5 100644
35199 --- a/arch/x86/platform/olpc/olpc_dt.c
35200 +++ b/arch/x86/platform/olpc/olpc_dt.c
35201 @@ -156,7 +156,7 @@ void * __init prom_early_alloc(unsigned long size)
35202 return res;
35203 }
35204
35205 -static struct of_pdt_ops prom_olpc_ops __initdata = {
35206 +static struct of_pdt_ops prom_olpc_ops __initconst = {
35207 .nextprop = olpc_dt_nextprop,
35208 .getproplen = olpc_dt_getproplen,
35209 .getproperty = olpc_dt_getproperty,
35210 diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
35211 index 424f4c9..f2a2988 100644
35212 --- a/arch/x86/power/cpu.c
35213 +++ b/arch/x86/power/cpu.c
35214 @@ -137,11 +137,8 @@ static void do_fpu_end(void)
35215 static void fix_processor_context(void)
35216 {
35217 int cpu = smp_processor_id();
35218 - struct tss_struct *t = &per_cpu(init_tss, cpu);
35219 -#ifdef CONFIG_X86_64
35220 - struct desc_struct *desc = get_cpu_gdt_table(cpu);
35221 - tss_desc tss;
35222 -#endif
35223 + struct tss_struct *t = init_tss + cpu;
35224 +
35225 set_tss_desc(cpu, t); /*
35226 * This just modifies memory; should not be
35227 * necessary. But... This is necessary, because
35228 @@ -150,10 +147,6 @@ static void fix_processor_context(void)
35229 */
35230
35231 #ifdef CONFIG_X86_64
35232 - memcpy(&tss, &desc[GDT_ENTRY_TSS], sizeof(tss_desc));
35233 - tss.type = 0x9; /* The available 64-bit TSS (see AMD vol 2, pg 91 */
35234 - write_gdt_entry(desc, GDT_ENTRY_TSS, &tss, DESC_TSS);
35235 -
35236 syscall_init(); /* This sets MSR_*STAR and related */
35237 #endif
35238 load_TR_desc(); /* This does ltr */
35239 diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
35240 index bad628a..a102610 100644
35241 --- a/arch/x86/realmode/init.c
35242 +++ b/arch/x86/realmode/init.c
35243 @@ -68,7 +68,13 @@ void __init setup_real_mode(void)
35244 __va(real_mode_header->trampoline_header);
35245
35246 #ifdef CONFIG_X86_32
35247 - trampoline_header->start = __pa_symbol(startup_32_smp);
35248 + trampoline_header->start = __pa_symbol(ktla_ktva(startup_32_smp));
35249 +
35250 +#ifdef CONFIG_PAX_KERNEXEC
35251 + trampoline_header->start -= LOAD_PHYSICAL_ADDR;
35252 +#endif
35253 +
35254 + trampoline_header->boot_cs = __BOOT_CS;
35255 trampoline_header->gdt_limit = __BOOT_DS + 7;
35256 trampoline_header->gdt_base = __pa_symbol(boot_gdt);
35257 #else
35258 @@ -84,7 +90,7 @@ void __init setup_real_mode(void)
35259 *trampoline_cr4_features = read_cr4();
35260
35261 trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
35262 - trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd;
35263 + trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd & ~_PAGE_NX;
35264 trampoline_pgd[511] = init_level4_pgt[511].pgd;
35265 #endif
35266 }
35267 diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
35268 index 3497f14..cc73b92 100644
35269 --- a/arch/x86/realmode/rm/Makefile
35270 +++ b/arch/x86/realmode/rm/Makefile
35271 @@ -66,5 +66,8 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE
35272
35273 KBUILD_CFLAGS := $(LINUXINCLUDE) $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \
35274 -I$(srctree)/arch/x86/boot
35275 +ifdef CONSTIFY_PLUGIN
35276 +KBUILD_CFLAGS += -fplugin-arg-constify_plugin-no-constify
35277 +endif
35278 KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
35279 GCOV_PROFILE := n
35280 diff --git a/arch/x86/realmode/rm/header.S b/arch/x86/realmode/rm/header.S
35281 index a28221d..93c40f1 100644
35282 --- a/arch/x86/realmode/rm/header.S
35283 +++ b/arch/x86/realmode/rm/header.S
35284 @@ -30,7 +30,9 @@ GLOBAL(real_mode_header)
35285 #endif
35286 /* APM/BIOS reboot */
35287 .long pa_machine_real_restart_asm
35288 -#ifdef CONFIG_X86_64
35289 +#ifdef CONFIG_X86_32
35290 + .long __KERNEL_CS
35291 +#else
35292 .long __KERNEL32_CS
35293 #endif
35294 END(real_mode_header)
35295 diff --git a/arch/x86/realmode/rm/trampoline_32.S b/arch/x86/realmode/rm/trampoline_32.S
35296 index 48ddd76..c26749f 100644
35297 --- a/arch/x86/realmode/rm/trampoline_32.S
35298 +++ b/arch/x86/realmode/rm/trampoline_32.S
35299 @@ -24,6 +24,12 @@
35300 #include <asm/page_types.h>
35301 #include "realmode.h"
35302
35303 +#ifdef CONFIG_PAX_KERNEXEC
35304 +#define ta(X) (X)
35305 +#else
35306 +#define ta(X) (pa_ ## X)
35307 +#endif
35308 +
35309 .text
35310 .code16
35311
35312 @@ -38,8 +44,6 @@ ENTRY(trampoline_start)
35313
35314 cli # We should be safe anyway
35315
35316 - movl tr_start, %eax # where we need to go
35317 -
35318 movl $0xA5A5A5A5, trampoline_status
35319 # write marker for master knows we're running
35320
35321 @@ -55,7 +59,7 @@ ENTRY(trampoline_start)
35322 movw $1, %dx # protected mode (PE) bit
35323 lmsw %dx # into protected mode
35324
35325 - ljmpl $__BOOT_CS, $pa_startup_32
35326 + ljmpl *(trampoline_header)
35327
35328 .section ".text32","ax"
35329 .code32
35330 @@ -66,7 +70,7 @@ ENTRY(startup_32) # note: also used from wakeup_asm.S
35331 .balign 8
35332 GLOBAL(trampoline_header)
35333 tr_start: .space 4
35334 - tr_gdt_pad: .space 2
35335 + tr_boot_cs: .space 2
35336 tr_gdt: .space 6
35337 END(trampoline_header)
35338
35339 diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
35340 index dac7b20..72dbaca 100644
35341 --- a/arch/x86/realmode/rm/trampoline_64.S
35342 +++ b/arch/x86/realmode/rm/trampoline_64.S
35343 @@ -93,6 +93,7 @@ ENTRY(startup_32)
35344 movl %edx, %gs
35345
35346 movl pa_tr_cr4, %eax
35347 + andl $~X86_CR4_PCIDE, %eax
35348 movl %eax, %cr4 # Enable PAE mode
35349
35350 # Setup trampoline 4 level pagetables
35351 @@ -106,7 +107,7 @@ ENTRY(startup_32)
35352 wrmsr
35353
35354 # Enable paging and in turn activate Long Mode
35355 - movl $(X86_CR0_PG | X86_CR0_WP | X86_CR0_PE), %eax
35356 + movl $(X86_CR0_PG | X86_CR0_PE), %eax
35357 movl %eax, %cr0
35358
35359 /*
35360 diff --git a/arch/x86/realmode/rm/wakeup_asm.S b/arch/x86/realmode/rm/wakeup_asm.S
35361 index 9e7e147..25a4158 100644
35362 --- a/arch/x86/realmode/rm/wakeup_asm.S
35363 +++ b/arch/x86/realmode/rm/wakeup_asm.S
35364 @@ -126,11 +126,10 @@ ENTRY(wakeup_start)
35365 lgdtl pmode_gdt
35366
35367 /* This really couldn't... */
35368 - movl pmode_entry, %eax
35369 movl pmode_cr0, %ecx
35370 movl %ecx, %cr0
35371 - ljmpl $__KERNEL_CS, $pa_startup_32
35372 - /* -> jmp *%eax in trampoline_32.S */
35373 +
35374 + ljmpl *pmode_entry
35375 #else
35376 jmp trampoline_start
35377 #endif
35378 diff --git a/arch/x86/tools/Makefile b/arch/x86/tools/Makefile
35379 index e812034..c747134 100644
35380 --- a/arch/x86/tools/Makefile
35381 +++ b/arch/x86/tools/Makefile
35382 @@ -37,7 +37,7 @@ $(obj)/test_get_len.o: $(srctree)/arch/x86/lib/insn.c $(srctree)/arch/x86/lib/in
35383
35384 $(obj)/insn_sanity.o: $(srctree)/arch/x86/lib/insn.c $(srctree)/arch/x86/lib/inat.c $(srctree)/arch/x86/include/asm/inat_types.h $(srctree)/arch/x86/include/asm/inat.h $(srctree)/arch/x86/include/asm/insn.h $(objtree)/arch/x86/lib/inat-tables.c
35385
35386 -HOST_EXTRACFLAGS += -I$(srctree)/tools/include
35387 +HOST_EXTRACFLAGS += -I$(srctree)/tools/include -ggdb
35388 hostprogs-y += relocs
35389 relocs-objs := relocs_32.o relocs_64.o relocs_common.o
35390 relocs: $(obj)/relocs
35391 diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
35392 index cfbdbdb..1aa763c 100644
35393 --- a/arch/x86/tools/relocs.c
35394 +++ b/arch/x86/tools/relocs.c
35395 @@ -1,5 +1,7 @@
35396 /* This is included from relocs_32/64.c */
35397
35398 +#include "../../../include/generated/autoconf.h"
35399 +
35400 #define ElfW(type) _ElfW(ELF_BITS, type)
35401 #define _ElfW(bits, type) __ElfW(bits, type)
35402 #define __ElfW(bits, type) Elf##bits##_##type
35403 @@ -11,6 +13,7 @@
35404 #define Elf_Sym ElfW(Sym)
35405
35406 static Elf_Ehdr ehdr;
35407 +static Elf_Phdr *phdr;
35408
35409 struct relocs {
35410 uint32_t *offset;
35411 @@ -383,9 +386,39 @@ static void read_ehdr(FILE *fp)
35412 }
35413 }
35414
35415 +static void read_phdrs(FILE *fp)
35416 +{
35417 + unsigned int i;
35418 +
35419 + phdr = calloc(ehdr.e_phnum, sizeof(Elf_Phdr));
35420 + if (!phdr) {
35421 + die("Unable to allocate %d program headers\n",
35422 + ehdr.e_phnum);
35423 + }
35424 + if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
35425 + die("Seek to %d failed: %s\n",
35426 + ehdr.e_phoff, strerror(errno));
35427 + }
35428 + if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
35429 + die("Cannot read ELF program headers: %s\n",
35430 + strerror(errno));
35431 + }
35432 + for(i = 0; i < ehdr.e_phnum; i++) {
35433 + phdr[i].p_type = elf_word_to_cpu(phdr[i].p_type);
35434 + phdr[i].p_offset = elf_off_to_cpu(phdr[i].p_offset);
35435 + phdr[i].p_vaddr = elf_addr_to_cpu(phdr[i].p_vaddr);
35436 + phdr[i].p_paddr = elf_addr_to_cpu(phdr[i].p_paddr);
35437 + phdr[i].p_filesz = elf_word_to_cpu(phdr[i].p_filesz);
35438 + phdr[i].p_memsz = elf_word_to_cpu(phdr[i].p_memsz);
35439 + phdr[i].p_flags = elf_word_to_cpu(phdr[i].p_flags);
35440 + phdr[i].p_align = elf_word_to_cpu(phdr[i].p_align);
35441 + }
35442 +
35443 +}
35444 +
35445 static void read_shdrs(FILE *fp)
35446 {
35447 - int i;
35448 + unsigned int i;
35449 Elf_Shdr shdr;
35450
35451 secs = calloc(ehdr.e_shnum, sizeof(struct section));
35452 @@ -420,7 +453,7 @@ static void read_shdrs(FILE *fp)
35453
35454 static void read_strtabs(FILE *fp)
35455 {
35456 - int i;
35457 + unsigned int i;
35458 for (i = 0; i < ehdr.e_shnum; i++) {
35459 struct section *sec = &secs[i];
35460 if (sec->shdr.sh_type != SHT_STRTAB) {
35461 @@ -445,7 +478,7 @@ static void read_strtabs(FILE *fp)
35462
35463 static void read_symtabs(FILE *fp)
35464 {
35465 - int i,j;
35466 + unsigned int i,j;
35467 for (i = 0; i < ehdr.e_shnum; i++) {
35468 struct section *sec = &secs[i];
35469 if (sec->shdr.sh_type != SHT_SYMTAB) {
35470 @@ -476,9 +509,11 @@ static void read_symtabs(FILE *fp)
35471 }
35472
35473
35474 -static void read_relocs(FILE *fp)
35475 +static void read_relocs(FILE *fp, int use_real_mode)
35476 {
35477 - int i,j;
35478 + unsigned int i,j;
35479 + uint32_t base;
35480 +
35481 for (i = 0; i < ehdr.e_shnum; i++) {
35482 struct section *sec = &secs[i];
35483 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35484 @@ -498,9 +533,22 @@ static void read_relocs(FILE *fp)
35485 die("Cannot read symbol table: %s\n",
35486 strerror(errno));
35487 }
35488 + base = 0;
35489 +
35490 +#ifdef CONFIG_X86_32
35491 + for (j = 0; !use_real_mode && j < ehdr.e_phnum; j++) {
35492 + if (phdr[j].p_type != PT_LOAD )
35493 + continue;
35494 + if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
35495 + continue;
35496 + base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
35497 + break;
35498 + }
35499 +#endif
35500 +
35501 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {
35502 Elf_Rel *rel = &sec->reltab[j];
35503 - rel->r_offset = elf_addr_to_cpu(rel->r_offset);
35504 + rel->r_offset = elf_addr_to_cpu(rel->r_offset) + base;
35505 rel->r_info = elf_xword_to_cpu(rel->r_info);
35506 #if (SHT_REL_TYPE == SHT_RELA)
35507 rel->r_addend = elf_xword_to_cpu(rel->r_addend);
35508 @@ -512,7 +560,7 @@ static void read_relocs(FILE *fp)
35509
35510 static void print_absolute_symbols(void)
35511 {
35512 - int i;
35513 + unsigned int i;
35514 const char *format;
35515
35516 if (ELF_BITS == 64)
35517 @@ -525,7 +573,7 @@ static void print_absolute_symbols(void)
35518 for (i = 0; i < ehdr.e_shnum; i++) {
35519 struct section *sec = &secs[i];
35520 char *sym_strtab;
35521 - int j;
35522 + unsigned int j;
35523
35524 if (sec->shdr.sh_type != SHT_SYMTAB) {
35525 continue;
35526 @@ -552,7 +600,7 @@ static void print_absolute_symbols(void)
35527
35528 static void print_absolute_relocs(void)
35529 {
35530 - int i, printed = 0;
35531 + unsigned int i, printed = 0;
35532 const char *format;
35533
35534 if (ELF_BITS == 64)
35535 @@ -565,7 +613,7 @@ static void print_absolute_relocs(void)
35536 struct section *sec_applies, *sec_symtab;
35537 char *sym_strtab;
35538 Elf_Sym *sh_symtab;
35539 - int j;
35540 + unsigned int j;
35541 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35542 continue;
35543 }
35544 @@ -642,13 +690,13 @@ static void add_reloc(struct relocs *r, uint32_t offset)
35545 static void walk_relocs(int (*process)(struct section *sec, Elf_Rel *rel,
35546 Elf_Sym *sym, const char *symname))
35547 {
35548 - int i;
35549 + unsigned int i;
35550 /* Walk through the relocations */
35551 for (i = 0; i < ehdr.e_shnum; i++) {
35552 char *sym_strtab;
35553 Elf_Sym *sh_symtab;
35554 struct section *sec_applies, *sec_symtab;
35555 - int j;
35556 + unsigned int j;
35557 struct section *sec = &secs[i];
35558
35559 if (sec->shdr.sh_type != SHT_REL_TYPE) {
35560 @@ -822,6 +870,23 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
35561 {
35562 unsigned r_type = ELF32_R_TYPE(rel->r_info);
35563 int shn_abs = (sym->st_shndx == SHN_ABS) && !is_reloc(S_REL, symname);
35564 + char *sym_strtab = sec->link->link->strtab;
35565 +
35566 + /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
35567 + if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
35568 + return 0;
35569 +
35570 +#ifdef CONFIG_PAX_KERNEXEC
35571 + /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
35572 + if (!strcmp(sec_name(sym->st_shndx), ".text.end") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
35573 + return 0;
35574 + if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
35575 + return 0;
35576 + if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
35577 + return 0;
35578 + if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
35579 + return 0;
35580 +#endif
35581
35582 switch (r_type) {
35583 case R_386_NONE:
35584 @@ -960,7 +1025,7 @@ static int write32_as_text(uint32_t v, FILE *f)
35585
35586 static void emit_relocs(int as_text, int use_real_mode)
35587 {
35588 - int i;
35589 + unsigned int i;
35590 int (*write_reloc)(uint32_t, FILE *) = write32;
35591 int (*do_reloc)(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
35592 const char *symname);
35593 @@ -1060,10 +1125,11 @@ void process(FILE *fp, int use_real_mode, int as_text,
35594 {
35595 regex_init(use_real_mode);
35596 read_ehdr(fp);
35597 + read_phdrs(fp);
35598 read_shdrs(fp);
35599 read_strtabs(fp);
35600 read_symtabs(fp);
35601 - read_relocs(fp);
35602 + read_relocs(fp, use_real_mode);
35603 if (ELF_BITS == 64)
35604 percpu_init();
35605 if (show_absolute_syms) {
35606 diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
35607 index 80ffa5b..a33bd15 100644
35608 --- a/arch/x86/um/tls_32.c
35609 +++ b/arch/x86/um/tls_32.c
35610 @@ -260,7 +260,7 @@ out:
35611 if (unlikely(task == current &&
35612 !t->arch.tls_array[idx - GDT_ENTRY_TLS_MIN].flushed)) {
35613 printk(KERN_ERR "get_tls_entry: task with pid %d got here "
35614 - "without flushed TLS.", current->pid);
35615 + "without flushed TLS.", task_pid_nr(current));
35616 }
35617
35618 return 0;
35619 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
35620 index fd14be1..e3c79c0 100644
35621 --- a/arch/x86/vdso/Makefile
35622 +++ b/arch/x86/vdso/Makefile
35623 @@ -181,7 +181,7 @@ quiet_cmd_vdso = VDSO $@
35624 -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
35625 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
35626
35627 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
35628 +VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
35629 GCOV_PROFILE := n
35630
35631 #
35632 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
35633 index d6bfb87..a75c5f7 100644
35634 --- a/arch/x86/vdso/vdso32-setup.c
35635 +++ b/arch/x86/vdso/vdso32-setup.c
35636 @@ -25,6 +25,7 @@
35637 #include <asm/tlbflush.h>
35638 #include <asm/vdso.h>
35639 #include <asm/proto.h>
35640 +#include <asm/mman.h>
35641
35642 enum {
35643 VDSO_DISABLED = 0,
35644 @@ -41,6 +42,7 @@ enum {
35645 #ifdef CONFIG_X86_64
35646 #define vdso_enabled sysctl_vsyscall32
35647 #define arch_setup_additional_pages syscall32_setup_pages
35648 +extern int sysctl_ldt16;
35649 #endif
35650
35651 /*
35652 @@ -226,7 +228,7 @@ static inline void map_compat_vdso(int map)
35653 void enable_sep_cpu(void)
35654 {
35655 int cpu = get_cpu();
35656 - struct tss_struct *tss = &per_cpu(init_tss, cpu);
35657 + struct tss_struct *tss = init_tss + cpu;
35658
35659 if (!boot_cpu_has(X86_FEATURE_SEP)) {
35660 put_cpu();
35661 @@ -249,7 +251,7 @@ static int __init gate_vma_init(void)
35662 gate_vma.vm_start = FIXADDR_USER_START;
35663 gate_vma.vm_end = FIXADDR_USER_END;
35664 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
35665 - gate_vma.vm_page_prot = __P101;
35666 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
35667
35668 return 0;
35669 }
35670 @@ -330,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
35671 if (compat)
35672 addr = VDSO_HIGH_BASE;
35673 else {
35674 - addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
35675 + addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
35676 if (IS_ERR_VALUE(addr)) {
35677 ret = addr;
35678 goto up_fail;
35679 }
35680 }
35681
35682 - current->mm->context.vdso = (void *)addr;
35683 + current->mm->context.vdso = addr;
35684
35685 if (compat_uses_vma || !compat) {
35686 /*
35687 @@ -353,11 +355,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
35688 }
35689
35690 current_thread_info()->sysenter_return =
35691 - VDSO32_SYMBOL(addr, SYSENTER_RETURN);
35692 + (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
35693
35694 up_fail:
35695 if (ret)
35696 - current->mm->context.vdso = NULL;
35697 + current->mm->context.vdso = 0;
35698
35699 up_write(&mm->mmap_sem);
35700
35701 @@ -380,6 +382,13 @@ static struct ctl_table abi_table2[] = {
35702 .mode = 0644,
35703 .proc_handler = proc_dointvec
35704 },
35705 + {
35706 + .procname = "ldt16",
35707 + .data = &sysctl_ldt16,
35708 + .maxlen = sizeof(int),
35709 + .mode = 0644,
35710 + .proc_handler = proc_dointvec
35711 + },
35712 {}
35713 };
35714
35715 @@ -404,8 +413,14 @@ __initcall(ia32_binfmt_init);
35716
35717 const char *arch_vma_name(struct vm_area_struct *vma)
35718 {
35719 - if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
35720 + if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
35721 return "[vdso]";
35722 +
35723 +#ifdef CONFIG_PAX_SEGMEXEC
35724 + if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
35725 + return "[vdso]";
35726 +#endif
35727 +
35728 return NULL;
35729 }
35730
35731 @@ -415,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
35732 * Check to see if the corresponding task was created in compat vdso
35733 * mode.
35734 */
35735 - if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
35736 + if (mm && mm->context.vdso == VDSO_HIGH_BASE)
35737 return &gate_vma;
35738 return NULL;
35739 }
35740 diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
35741 index 431e875..cbb23f3 100644
35742 --- a/arch/x86/vdso/vma.c
35743 +++ b/arch/x86/vdso/vma.c
35744 @@ -16,8 +16,6 @@
35745 #include <asm/vdso.h>
35746 #include <asm/page.h>
35747
35748 -unsigned int __read_mostly vdso_enabled = 1;
35749 -
35750 extern char vdso_start[], vdso_end[];
35751 extern unsigned short vdso_sync_cpuid;
35752
35753 @@ -141,7 +139,6 @@ static unsigned long vdso_addr(unsigned long start, unsigned len)
35754 * unaligned here as a result of stack start randomization.
35755 */
35756 addr = PAGE_ALIGN(addr);
35757 - addr = align_vdso_addr(addr);
35758
35759 return addr;
35760 }
35761 @@ -154,30 +151,31 @@ static int setup_additional_pages(struct linux_binprm *bprm,
35762 unsigned size)
35763 {
35764 struct mm_struct *mm = current->mm;
35765 - unsigned long addr;
35766 + unsigned long addr = 0;
35767 int ret;
35768
35769 - if (!vdso_enabled)
35770 - return 0;
35771 -
35772 down_write(&mm->mmap_sem);
35773 +
35774 +#ifdef CONFIG_PAX_RANDMMAP
35775 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
35776 +#endif
35777 +
35778 addr = vdso_addr(mm->start_stack, size);
35779 + addr = align_vdso_addr(addr);
35780 addr = get_unmapped_area(NULL, addr, size, 0, 0);
35781 if (IS_ERR_VALUE(addr)) {
35782 ret = addr;
35783 goto up_fail;
35784 }
35785
35786 - current->mm->context.vdso = (void *)addr;
35787 + mm->context.vdso = addr;
35788
35789 ret = install_special_mapping(mm, addr, size,
35790 VM_READ|VM_EXEC|
35791 VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
35792 pages);
35793 - if (ret) {
35794 - current->mm->context.vdso = NULL;
35795 - goto up_fail;
35796 - }
35797 + if (ret)
35798 + mm->context.vdso = 0;
35799
35800 up_fail:
35801 up_write(&mm->mmap_sem);
35802 @@ -197,10 +195,3 @@ int x32_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
35803 vdsox32_size);
35804 }
35805 #endif
35806 -
35807 -static __init int vdso_setup(char *s)
35808 -{
35809 - vdso_enabled = simple_strtoul(s, NULL, 0);
35810 - return 0;
35811 -}
35812 -__setup("vdso=", vdso_setup);
35813 diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
35814 index 01b9026..1e476df 100644
35815 --- a/arch/x86/xen/Kconfig
35816 +++ b/arch/x86/xen/Kconfig
35817 @@ -9,6 +9,7 @@ config XEN
35818 select XEN_HAVE_PVMMU
35819 depends on X86_64 || (X86_32 && X86_PAE && !X86_VISWS)
35820 depends on X86_TSC
35821 + depends on !GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_VIRT_XEN
35822 help
35823 This is the Linux Xen port. Enabling this will allow the
35824 kernel to boot in a paravirtualized environment under the
35825 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
35826 index 201d09a..e4723e5 100644
35827 --- a/arch/x86/xen/enlighten.c
35828 +++ b/arch/x86/xen/enlighten.c
35829 @@ -123,8 +123,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
35830
35831 struct shared_info xen_dummy_shared_info;
35832
35833 -void *xen_initial_gdt;
35834 -
35835 RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
35836 __read_mostly int xen_have_vector_callback;
35837 EXPORT_SYMBOL_GPL(xen_have_vector_callback);
35838 @@ -542,8 +540,7 @@ static void xen_load_gdt(const struct desc_ptr *dtr)
35839 {
35840 unsigned long va = dtr->address;
35841 unsigned int size = dtr->size + 1;
35842 - unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
35843 - unsigned long frames[pages];
35844 + unsigned long frames[65536 / PAGE_SIZE];
35845 int f;
35846
35847 /*
35848 @@ -591,8 +588,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
35849 {
35850 unsigned long va = dtr->address;
35851 unsigned int size = dtr->size + 1;
35852 - unsigned pages = (size + PAGE_SIZE - 1) / PAGE_SIZE;
35853 - unsigned long frames[pages];
35854 + unsigned long frames[(GDT_SIZE + PAGE_SIZE - 1) / PAGE_SIZE];
35855 int f;
35856
35857 /*
35858 @@ -600,7 +596,7 @@ static void __init xen_load_gdt_boot(const struct desc_ptr *dtr)
35859 * 8-byte entries, or 16 4k pages..
35860 */
35861
35862 - BUG_ON(size > 65536);
35863 + BUG_ON(size > GDT_SIZE);
35864 BUG_ON(va & ~PAGE_MASK);
35865
35866 for (f = 0; va < dtr->address + size; va += PAGE_SIZE, f++) {
35867 @@ -989,7 +985,7 @@ static u32 xen_safe_apic_wait_icr_idle(void)
35868 return 0;
35869 }
35870
35871 -static void set_xen_basic_apic_ops(void)
35872 +static void __init set_xen_basic_apic_ops(void)
35873 {
35874 apic->read = xen_apic_read;
35875 apic->write = xen_apic_write;
35876 @@ -1295,30 +1291,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
35877 #endif
35878 };
35879
35880 -static void xen_reboot(int reason)
35881 +static __noreturn void xen_reboot(int reason)
35882 {
35883 struct sched_shutdown r = { .reason = reason };
35884
35885 - if (HYPERVISOR_sched_op(SCHEDOP_shutdown, &r))
35886 - BUG();
35887 + HYPERVISOR_sched_op(SCHEDOP_shutdown, &r);
35888 + BUG();
35889 }
35890
35891 -static void xen_restart(char *msg)
35892 +static __noreturn void xen_restart(char *msg)
35893 {
35894 xen_reboot(SHUTDOWN_reboot);
35895 }
35896
35897 -static void xen_emergency_restart(void)
35898 +static __noreturn void xen_emergency_restart(void)
35899 {
35900 xen_reboot(SHUTDOWN_reboot);
35901 }
35902
35903 -static void xen_machine_halt(void)
35904 +static __noreturn void xen_machine_halt(void)
35905 {
35906 xen_reboot(SHUTDOWN_poweroff);
35907 }
35908
35909 -static void xen_machine_power_off(void)
35910 +static __noreturn void xen_machine_power_off(void)
35911 {
35912 if (pm_power_off)
35913 pm_power_off();
35914 @@ -1564,7 +1560,17 @@ asmlinkage void __init xen_start_kernel(void)
35915 __userpte_alloc_gfp &= ~__GFP_HIGHMEM;
35916
35917 /* Work out if we support NX */
35918 - x86_configure_nx();
35919 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
35920 + if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
35921 + (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
35922 + unsigned l, h;
35923 +
35924 + __supported_pte_mask |= _PAGE_NX;
35925 + rdmsr(MSR_EFER, l, h);
35926 + l |= EFER_NX;
35927 + wrmsr(MSR_EFER, l, h);
35928 + }
35929 +#endif
35930
35931 /* Get mfn list */
35932 xen_build_dynamic_phys_to_machine();
35933 @@ -1592,13 +1598,6 @@ asmlinkage void __init xen_start_kernel(void)
35934
35935 machine_ops = xen_machine_ops;
35936
35937 - /*
35938 - * The only reliable way to retain the initial address of the
35939 - * percpu gdt_page is to remember it here, so we can go and
35940 - * mark it RW later, when the initial percpu area is freed.
35941 - */
35942 - xen_initial_gdt = &per_cpu(gdt_page, 0);
35943 -
35944 xen_smp_init();
35945
35946 #ifdef CONFIG_ACPI_NUMA
35947 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
35948 index 2423ef0..4f6fb5b 100644
35949 --- a/arch/x86/xen/mmu.c
35950 +++ b/arch/x86/xen/mmu.c
35951 @@ -379,7 +379,7 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
35952 return val;
35953 }
35954
35955 -static pteval_t pte_pfn_to_mfn(pteval_t val)
35956 +static pteval_t __intentional_overflow(-1) pte_pfn_to_mfn(pteval_t val)
35957 {
35958 if (val & _PAGE_PRESENT) {
35959 unsigned long pfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
35960 @@ -1904,6 +1904,9 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
35961 /* L3_k[510] -> level2_kernel_pgt
35962 * L3_i[511] -> level2_fixmap_pgt */
35963 convert_pfn_mfn(level3_kernel_pgt);
35964 + convert_pfn_mfn(level3_vmalloc_start_pgt);
35965 + convert_pfn_mfn(level3_vmalloc_end_pgt);
35966 + convert_pfn_mfn(level3_vmemmap_pgt);
35967 }
35968 /* We get [511][511] and have Xen's version of level2_kernel_pgt */
35969 l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
35970 @@ -1933,8 +1936,12 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
35971 set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
35972 set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
35973 set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
35974 + set_page_prot(level3_vmalloc_start_pgt, PAGE_KERNEL_RO);
35975 + set_page_prot(level3_vmalloc_end_pgt, PAGE_KERNEL_RO);
35976 + set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
35977 set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
35978 set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
35979 + set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
35980 set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
35981 set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
35982
35983 @@ -2123,6 +2130,7 @@ static void __init xen_post_allocator_init(void)
35984 pv_mmu_ops.set_pud = xen_set_pud;
35985 #if PAGETABLE_LEVELS == 4
35986 pv_mmu_ops.set_pgd = xen_set_pgd;
35987 + pv_mmu_ops.set_pgd_batched = xen_set_pgd;
35988 #endif
35989
35990 /* This will work as long as patching hasn't happened yet
35991 @@ -2201,6 +2209,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
35992 .pud_val = PV_CALLEE_SAVE(xen_pud_val),
35993 .make_pud = PV_CALLEE_SAVE(xen_make_pud),
35994 .set_pgd = xen_set_pgd_hyper,
35995 + .set_pgd_batched = xen_set_pgd_hyper,
35996
35997 .alloc_pud = xen_alloc_pmd_init,
35998 .release_pud = xen_release_pmd_init,
35999 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
36000 index a18eadd..2e2f10e 100644
36001 --- a/arch/x86/xen/smp.c
36002 +++ b/arch/x86/xen/smp.c
36003 @@ -283,17 +283,13 @@ static void __init xen_smp_prepare_boot_cpu(void)
36004
36005 if (xen_pv_domain()) {
36006 if (!xen_feature(XENFEAT_writable_page_tables))
36007 - /* We've switched to the "real" per-cpu gdt, so make
36008 - * sure the old memory can be recycled. */
36009 - make_lowmem_page_readwrite(xen_initial_gdt);
36010 -
36011 #ifdef CONFIG_X86_32
36012 /*
36013 * Xen starts us with XEN_FLAT_RING1_DS, but linux code
36014 * expects __USER_DS
36015 */
36016 - loadsegment(ds, __USER_DS);
36017 - loadsegment(es, __USER_DS);
36018 + loadsegment(ds, __KERNEL_DS);
36019 + loadsegment(es, __KERNEL_DS);
36020 #endif
36021
36022 xen_filter_cpu_maps();
36023 @@ -372,7 +368,7 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
36024 #ifdef CONFIG_X86_32
36025 /* Note: PVH is not yet supported on x86_32. */
36026 ctxt->user_regs.fs = __KERNEL_PERCPU;
36027 - ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
36028 + savesegment(gs, ctxt->user_regs.gs);
36029 #endif
36030 ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
36031
36032 @@ -381,8 +377,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
36033 if (!xen_feature(XENFEAT_auto_translated_physmap)) {
36034 ctxt->flags = VGCF_IN_KERNEL;
36035 ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
36036 - ctxt->user_regs.ds = __USER_DS;
36037 - ctxt->user_regs.es = __USER_DS;
36038 + ctxt->user_regs.ds = __KERNEL_DS;
36039 + ctxt->user_regs.es = __KERNEL_DS;
36040 ctxt->user_regs.ss = __KERNEL_DS;
36041
36042 xen_copy_trap_info(ctxt->trap_ctxt);
36043 @@ -437,13 +433,12 @@ static int xen_cpu_up(unsigned int cpu, struct task_struct *idle)
36044 int rc;
36045
36046 per_cpu(current_task, cpu) = idle;
36047 + per_cpu(current_tinfo, cpu) = &idle->tinfo;
36048 #ifdef CONFIG_X86_32
36049 irq_ctx_init(cpu);
36050 #else
36051 clear_tsk_thread_flag(idle, TIF_FORK);
36052 - per_cpu(kernel_stack, cpu) =
36053 - (unsigned long)task_stack_page(idle) -
36054 - KERNEL_STACK_OFFSET + THREAD_SIZE;
36055 + per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
36056 #endif
36057 xen_setup_runstate_info(cpu);
36058 xen_setup_timer(cpu);
36059 @@ -719,7 +714,7 @@ static const struct smp_ops xen_smp_ops __initconst = {
36060
36061 void __init xen_smp_init(void)
36062 {
36063 - smp_ops = xen_smp_ops;
36064 + memcpy((void *)&smp_ops, &xen_smp_ops, sizeof smp_ops);
36065 xen_fill_possible_map();
36066 }
36067
36068 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
36069 index 33ca6e4..0ded929 100644
36070 --- a/arch/x86/xen/xen-asm_32.S
36071 +++ b/arch/x86/xen/xen-asm_32.S
36072 @@ -84,14 +84,14 @@ ENTRY(xen_iret)
36073 ESP_OFFSET=4 # bytes pushed onto stack
36074
36075 /*
36076 - * Store vcpu_info pointer for easy access. Do it this way to
36077 - * avoid having to reload %fs
36078 + * Store vcpu_info pointer for easy access.
36079 */
36080 #ifdef CONFIG_SMP
36081 - GET_THREAD_INFO(%eax)
36082 - movl %ss:TI_cpu(%eax), %eax
36083 - movl %ss:__per_cpu_offset(,%eax,4), %eax
36084 - mov %ss:xen_vcpu(%eax), %eax
36085 + push %fs
36086 + mov $(__KERNEL_PERCPU), %eax
36087 + mov %eax, %fs
36088 + mov PER_CPU_VAR(xen_vcpu), %eax
36089 + pop %fs
36090 #else
36091 movl %ss:xen_vcpu, %eax
36092 #endif
36093 diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
36094 index 485b695..fda3e7c 100644
36095 --- a/arch/x86/xen/xen-head.S
36096 +++ b/arch/x86/xen/xen-head.S
36097 @@ -39,6 +39,17 @@ ENTRY(startup_xen)
36098 #ifdef CONFIG_X86_32
36099 mov %esi,xen_start_info
36100 mov $init_thread_union+THREAD_SIZE,%esp
36101 +#ifdef CONFIG_SMP
36102 + movl $cpu_gdt_table,%edi
36103 + movl $__per_cpu_load,%eax
36104 + movw %ax,__KERNEL_PERCPU + 2(%edi)
36105 + rorl $16,%eax
36106 + movb %al,__KERNEL_PERCPU + 4(%edi)
36107 + movb %ah,__KERNEL_PERCPU + 7(%edi)
36108 + movl $__per_cpu_end - 1,%eax
36109 + subl $__per_cpu_start,%eax
36110 + movw %ax,__KERNEL_PERCPU + 0(%edi)
36111 +#endif
36112 #else
36113 mov %rsi,xen_start_info
36114 mov $init_thread_union+THREAD_SIZE,%rsp
36115 diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
36116 index 1cb6f4c..9981524 100644
36117 --- a/arch/x86/xen/xen-ops.h
36118 +++ b/arch/x86/xen/xen-ops.h
36119 @@ -10,8 +10,6 @@
36120 extern const char xen_hypervisor_callback[];
36121 extern const char xen_failsafe_callback[];
36122
36123 -extern void *xen_initial_gdt;
36124 -
36125 struct trap_info;
36126 void xen_copy_trap_info(struct trap_info *traps);
36127
36128 diff --git a/arch/xtensa/variants/dc232b/include/variant/core.h b/arch/xtensa/variants/dc232b/include/variant/core.h
36129 index 525bd3d..ef888b1 100644
36130 --- a/arch/xtensa/variants/dc232b/include/variant/core.h
36131 +++ b/arch/xtensa/variants/dc232b/include/variant/core.h
36132 @@ -119,9 +119,9 @@
36133 ----------------------------------------------------------------------*/
36134
36135 #define XCHAL_ICACHE_LINESIZE 32 /* I-cache line size in bytes */
36136 -#define XCHAL_DCACHE_LINESIZE 32 /* D-cache line size in bytes */
36137 #define XCHAL_ICACHE_LINEWIDTH 5 /* log2(I line size in bytes) */
36138 #define XCHAL_DCACHE_LINEWIDTH 5 /* log2(D line size in bytes) */
36139 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
36140
36141 #define XCHAL_ICACHE_SIZE 16384 /* I-cache size in bytes or 0 */
36142 #define XCHAL_DCACHE_SIZE 16384 /* D-cache size in bytes or 0 */
36143 diff --git a/arch/xtensa/variants/fsf/include/variant/core.h b/arch/xtensa/variants/fsf/include/variant/core.h
36144 index 2f33760..835e50a 100644
36145 --- a/arch/xtensa/variants/fsf/include/variant/core.h
36146 +++ b/arch/xtensa/variants/fsf/include/variant/core.h
36147 @@ -11,6 +11,7 @@
36148 #ifndef _XTENSA_CORE_H
36149 #define _XTENSA_CORE_H
36150
36151 +#include <linux/const.h>
36152
36153 /****************************************************************************
36154 Parameters Useful for Any Code, USER or PRIVILEGED
36155 @@ -112,9 +113,9 @@
36156 ----------------------------------------------------------------------*/
36157
36158 #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
36159 -#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
36160 #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
36161 #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
36162 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
36163
36164 #define XCHAL_ICACHE_SIZE 8192 /* I-cache size in bytes or 0 */
36165 #define XCHAL_DCACHE_SIZE 8192 /* D-cache size in bytes or 0 */
36166 diff --git a/arch/xtensa/variants/s6000/include/variant/core.h b/arch/xtensa/variants/s6000/include/variant/core.h
36167 index af00795..2bb8105 100644
36168 --- a/arch/xtensa/variants/s6000/include/variant/core.h
36169 +++ b/arch/xtensa/variants/s6000/include/variant/core.h
36170 @@ -11,6 +11,7 @@
36171 #ifndef _XTENSA_CORE_CONFIGURATION_H
36172 #define _XTENSA_CORE_CONFIGURATION_H
36173
36174 +#include <linux/const.h>
36175
36176 /****************************************************************************
36177 Parameters Useful for Any Code, USER or PRIVILEGED
36178 @@ -118,9 +119,9 @@
36179 ----------------------------------------------------------------------*/
36180
36181 #define XCHAL_ICACHE_LINESIZE 16 /* I-cache line size in bytes */
36182 -#define XCHAL_DCACHE_LINESIZE 16 /* D-cache line size in bytes */
36183 #define XCHAL_ICACHE_LINEWIDTH 4 /* log2(I line size in bytes) */
36184 #define XCHAL_DCACHE_LINEWIDTH 4 /* log2(D line size in bytes) */
36185 +#define XCHAL_DCACHE_LINESIZE (_AC(1,UL) << XCHAL_DCACHE_LINEWIDTH) /* D-cache line size in bytes */
36186
36187 #define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
36188 #define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
36189 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
36190 index 4e491d9..c8e18e4 100644
36191 --- a/block/blk-cgroup.c
36192 +++ b/block/blk-cgroup.c
36193 @@ -812,7 +812,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
36194 static struct cgroup_subsys_state *
36195 blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
36196 {
36197 - static atomic64_t id_seq = ATOMIC64_INIT(0);
36198 + static atomic64_unchecked_t id_seq = ATOMIC64_INIT(0);
36199 struct blkcg *blkcg;
36200
36201 if (!parent_css) {
36202 @@ -826,7 +826,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
36203
36204 blkcg->cfq_weight = CFQ_WEIGHT_DEFAULT;
36205 blkcg->cfq_leaf_weight = CFQ_WEIGHT_DEFAULT;
36206 - blkcg->id = atomic64_inc_return(&id_seq); /* root is 0, start from 1 */
36207 + blkcg->id = atomic64_inc_return_unchecked(&id_seq); /* root is 0, start from 1 */
36208 done:
36209 spin_lock_init(&blkcg->lock);
36210 INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_ATOMIC);
36211 diff --git a/block/blk-iopoll.c b/block/blk-iopoll.c
36212 index 1855bf5..af12b06 100644
36213 --- a/block/blk-iopoll.c
36214 +++ b/block/blk-iopoll.c
36215 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopoll *iopoll)
36216 }
36217 EXPORT_SYMBOL(blk_iopoll_complete);
36218
36219 -static void blk_iopoll_softirq(struct softirq_action *h)
36220 +static __latent_entropy void blk_iopoll_softirq(void)
36221 {
36222 struct list_head *list = this_cpu_ptr(&blk_cpu_iopoll);
36223 int rearm = 0, budget = blk_iopoll_budget;
36224 diff --git a/block/blk-map.c b/block/blk-map.c
36225 index ae4ae10..c470b8d 100644
36226 --- a/block/blk-map.c
36227 +++ b/block/blk-map.c
36228 @@ -302,7 +302,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
36229 if (!len || !kbuf)
36230 return -EINVAL;
36231
36232 - do_copy = !blk_rq_aligned(q, addr, len) || object_is_on_stack(kbuf);
36233 + do_copy = !blk_rq_aligned(q, addr, len) || object_starts_on_stack(kbuf);
36234 if (do_copy)
36235 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
36236 else
36237 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
36238 index 57790c1..5e988dd 100644
36239 --- a/block/blk-softirq.c
36240 +++ b/block/blk-softirq.c
36241 @@ -18,7 +18,7 @@ static DEFINE_PER_CPU(struct list_head, blk_cpu_done);
36242 * Softirq action handler - move entries to local list and loop over them
36243 * while passing them to the queue registered handler.
36244 */
36245 -static void blk_done_softirq(struct softirq_action *h)
36246 +static __latent_entropy void blk_done_softirq(void)
36247 {
36248 struct list_head *cpu_list, local_list;
36249
36250 diff --git a/block/bsg.c b/block/bsg.c
36251 index 420a5a9..23834aa 100644
36252 --- a/block/bsg.c
36253 +++ b/block/bsg.c
36254 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct request_queue *q, struct request *rq,
36255 struct sg_io_v4 *hdr, struct bsg_device *bd,
36256 fmode_t has_write_perm)
36257 {
36258 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36259 + unsigned char *cmdptr;
36260 +
36261 if (hdr->request_len > BLK_MAX_CDB) {
36262 rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
36263 if (!rq->cmd)
36264 return -ENOMEM;
36265 - }
36266 + cmdptr = rq->cmd;
36267 + } else
36268 + cmdptr = tmpcmd;
36269
36270 - if (copy_from_user(rq->cmd, (void __user *)(unsigned long)hdr->request,
36271 + if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request,
36272 hdr->request_len))
36273 return -EFAULT;
36274
36275 + if (cmdptr != rq->cmd)
36276 + memcpy(rq->cmd, cmdptr, hdr->request_len);
36277 +
36278 if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
36279 if (blk_verify_command(rq->cmd, has_write_perm))
36280 return -EPERM;
36281 diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c
36282 index fbd5a67..f24fd95 100644
36283 --- a/block/compat_ioctl.c
36284 +++ b/block/compat_ioctl.c
36285 @@ -156,7 +156,7 @@ static int compat_cdrom_generic_command(struct block_device *bdev, fmode_t mode,
36286 cgc = compat_alloc_user_space(sizeof(*cgc));
36287 cgc32 = compat_ptr(arg);
36288
36289 - if (copy_in_user(&cgc->cmd, &cgc32->cmd, sizeof(cgc->cmd)) ||
36290 + if (copy_in_user(cgc->cmd, cgc32->cmd, sizeof(cgc->cmd)) ||
36291 get_user(data, &cgc32->buffer) ||
36292 put_user(compat_ptr(data), &cgc->buffer) ||
36293 copy_in_user(&cgc->buflen, &cgc32->buflen,
36294 @@ -341,7 +341,7 @@ static int compat_fd_ioctl(struct block_device *bdev, fmode_t mode,
36295 err |= __get_user(f->spec1, &uf->spec1);
36296 err |= __get_user(f->fmt_gap, &uf->fmt_gap);
36297 err |= __get_user(name, &uf->name);
36298 - f->name = compat_ptr(name);
36299 + f->name = (void __force_kernel *)compat_ptr(name);
36300 if (err) {
36301 err = -EFAULT;
36302 goto out;
36303 diff --git a/block/genhd.c b/block/genhd.c
36304 index 791f419..89f21c4 100644
36305 --- a/block/genhd.c
36306 +++ b/block/genhd.c
36307 @@ -467,21 +467,24 @@ static char *bdevt_str(dev_t devt, char *buf)
36308
36309 /*
36310 * Register device numbers dev..(dev+range-1)
36311 - * range must be nonzero
36312 + * Noop if @range is zero.
36313 * The hash chain is sorted on range, so that subranges can override.
36314 */
36315 void blk_register_region(dev_t devt, unsigned long range, struct module *module,
36316 struct kobject *(*probe)(dev_t, int *, void *),
36317 int (*lock)(dev_t, void *), void *data)
36318 {
36319 - kobj_map(bdev_map, devt, range, module, probe, lock, data);
36320 + if (range)
36321 + kobj_map(bdev_map, devt, range, module, probe, lock, data);
36322 }
36323
36324 EXPORT_SYMBOL(blk_register_region);
36325
36326 +/* undo blk_register_region(), noop if @range is zero */
36327 void blk_unregister_region(dev_t devt, unsigned long range)
36328 {
36329 - kobj_unmap(bdev_map, devt, range);
36330 + if (range)
36331 + kobj_unmap(bdev_map, devt, range);
36332 }
36333
36334 EXPORT_SYMBOL(blk_unregister_region);
36335 diff --git a/block/partitions/efi.c b/block/partitions/efi.c
36336 index dc51f46..d5446a8 100644
36337 --- a/block/partitions/efi.c
36338 +++ b/block/partitions/efi.c
36339 @@ -293,14 +293,14 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
36340 if (!gpt)
36341 return NULL;
36342
36343 + if (!le32_to_cpu(gpt->num_partition_entries))
36344 + return NULL;
36345 + pte = kcalloc(le32_to_cpu(gpt->num_partition_entries), le32_to_cpu(gpt->sizeof_partition_entry), GFP_KERNEL);
36346 + if (!pte)
36347 + return NULL;
36348 +
36349 count = le32_to_cpu(gpt->num_partition_entries) *
36350 le32_to_cpu(gpt->sizeof_partition_entry);
36351 - if (!count)
36352 - return NULL;
36353 - pte = kmalloc(count, GFP_KERNEL);
36354 - if (!pte)
36355 - return NULL;
36356 -
36357 if (read_lba(state, le64_to_cpu(gpt->partition_entry_lba),
36358 (u8 *) pte, count) < count) {
36359 kfree(pte);
36360 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
36361 index 2648797..92ed21f 100644
36362 --- a/block/scsi_ioctl.c
36363 +++ b/block/scsi_ioctl.c
36364 @@ -67,7 +67,7 @@ static int scsi_get_bus(struct request_queue *q, int __user *p)
36365 return put_user(0, p);
36366 }
36367
36368 -static int sg_get_timeout(struct request_queue *q)
36369 +static int __intentional_overflow(-1) sg_get_timeout(struct request_queue *q)
36370 {
36371 return jiffies_to_clock_t(q->sg_timeout);
36372 }
36373 @@ -224,8 +224,20 @@ EXPORT_SYMBOL(blk_verify_command);
36374 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
36375 struct sg_io_hdr *hdr, fmode_t mode)
36376 {
36377 - if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
36378 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36379 + unsigned char *cmdptr;
36380 +
36381 + if (rq->cmd != rq->__cmd)
36382 + cmdptr = rq->cmd;
36383 + else
36384 + cmdptr = tmpcmd;
36385 +
36386 + if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
36387 return -EFAULT;
36388 +
36389 + if (cmdptr != rq->cmd)
36390 + memcpy(rq->cmd, cmdptr, hdr->cmd_len);
36391 +
36392 if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
36393 return -EPERM;
36394
36395 @@ -417,6 +429,8 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
36396 int err;
36397 unsigned int in_len, out_len, bytes, opcode, cmdlen;
36398 char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
36399 + unsigned char tmpcmd[sizeof(rq->__cmd)];
36400 + unsigned char *cmdptr;
36401
36402 if (!sic)
36403 return -EINVAL;
36404 @@ -450,9 +464,18 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
36405 */
36406 err = -EFAULT;
36407 rq->cmd_len = cmdlen;
36408 - if (copy_from_user(rq->cmd, sic->data, cmdlen))
36409 +
36410 + if (rq->cmd != rq->__cmd)
36411 + cmdptr = rq->cmd;
36412 + else
36413 + cmdptr = tmpcmd;
36414 +
36415 + if (copy_from_user(cmdptr, sic->data, cmdlen))
36416 goto error;
36417
36418 + if (rq->cmd != cmdptr)
36419 + memcpy(rq->cmd, cmdptr, cmdlen);
36420 +
36421 if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
36422 goto error;
36423
36424 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
36425 index 7bdd61b..afec999 100644
36426 --- a/crypto/cryptd.c
36427 +++ b/crypto/cryptd.c
36428 @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx {
36429
36430 struct cryptd_blkcipher_request_ctx {
36431 crypto_completion_t complete;
36432 -};
36433 +} __no_const;
36434
36435 struct cryptd_hash_ctx {
36436 struct crypto_shash *child;
36437 @@ -80,7 +80,7 @@ struct cryptd_aead_ctx {
36438
36439 struct cryptd_aead_request_ctx {
36440 crypto_completion_t complete;
36441 -};
36442 +} __no_const;
36443
36444 static void cryptd_queue_worker(struct work_struct *work);
36445
36446 diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
36447 index 309d345..1632720 100644
36448 --- a/crypto/pcrypt.c
36449 +++ b/crypto/pcrypt.c
36450 @@ -440,7 +440,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
36451 int ret;
36452
36453 pinst->kobj.kset = pcrypt_kset;
36454 - ret = kobject_add(&pinst->kobj, NULL, name);
36455 + ret = kobject_add(&pinst->kobj, NULL, "%s", name);
36456 if (!ret)
36457 kobject_uevent(&pinst->kobj, KOBJ_ADD);
36458
36459 diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
36460 index 15dddc1..b61cf0c 100644
36461 --- a/drivers/acpi/acpica/hwxfsleep.c
36462 +++ b/drivers/acpi/acpica/hwxfsleep.c
36463 @@ -63,11 +63,12 @@ static acpi_status acpi_hw_sleep_dispatch(u8 sleep_state, u32 function_id);
36464 /* Legacy functions are optional, based upon ACPI_REDUCED_HARDWARE */
36465
36466 static struct acpi_sleep_functions acpi_sleep_dispatch[] = {
36467 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_sleep),
36468 - acpi_hw_extended_sleep},
36469 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake_prep),
36470 - acpi_hw_extended_wake_prep},
36471 - {ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake), acpi_hw_extended_wake}
36472 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_sleep),
36473 + .extended_function = acpi_hw_extended_sleep},
36474 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake_prep),
36475 + .extended_function = acpi_hw_extended_wake_prep},
36476 + {.legacy_function = ACPI_HW_OPTIONAL_FUNCTION(acpi_hw_legacy_wake),
36477 + .extended_function = acpi_hw_extended_wake}
36478 };
36479
36480 /*
36481 diff --git a/drivers/acpi/apei/apei-internal.h b/drivers/acpi/apei/apei-internal.h
36482 index e5bcd91..74f050d 100644
36483 --- a/drivers/acpi/apei/apei-internal.h
36484 +++ b/drivers/acpi/apei/apei-internal.h
36485 @@ -19,7 +19,7 @@ typedef int (*apei_exec_ins_func_t)(struct apei_exec_context *ctx,
36486 struct apei_exec_ins_type {
36487 u32 flags;
36488 apei_exec_ins_func_t run;
36489 -};
36490 +} __do_const;
36491
36492 struct apei_exec_context {
36493 u32 ip;
36494 diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
36495 index dab7cb7..f0d2994 100644
36496 --- a/drivers/acpi/apei/ghes.c
36497 +++ b/drivers/acpi/apei/ghes.c
36498 @@ -500,7 +500,7 @@ static void __ghes_print_estatus(const char *pfx,
36499 const struct acpi_hest_generic *generic,
36500 const struct acpi_generic_status *estatus)
36501 {
36502 - static atomic_t seqno;
36503 + static atomic_unchecked_t seqno;
36504 unsigned int curr_seqno;
36505 char pfx_seq[64];
36506
36507 @@ -511,7 +511,7 @@ static void __ghes_print_estatus(const char *pfx,
36508 else
36509 pfx = KERN_ERR;
36510 }
36511 - curr_seqno = atomic_inc_return(&seqno);
36512 + curr_seqno = atomic_inc_return_unchecked(&seqno);
36513 snprintf(pfx_seq, sizeof(pfx_seq), "%s{%u}" HW_ERR, pfx, curr_seqno);
36514 printk("%s""Hardware error from APEI Generic Hardware Error Source: %d\n",
36515 pfx_seq, generic->header.source_id);
36516 diff --git a/drivers/acpi/bgrt.c b/drivers/acpi/bgrt.c
36517 index a83e3c6..c3d617f 100644
36518 --- a/drivers/acpi/bgrt.c
36519 +++ b/drivers/acpi/bgrt.c
36520 @@ -86,8 +86,10 @@ static int __init bgrt_init(void)
36521 if (!bgrt_image)
36522 return -ENODEV;
36523
36524 - bin_attr_image.private = bgrt_image;
36525 - bin_attr_image.size = bgrt_image_size;
36526 + pax_open_kernel();
36527 + *(void **)&bin_attr_image.private = bgrt_image;
36528 + *(size_t *)&bin_attr_image.size = bgrt_image_size;
36529 + pax_close_kernel();
36530
36531 bgrt_kobj = kobject_create_and_add("bgrt", acpi_kobj);
36532 if (!bgrt_kobj)
36533 diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
36534 index afec452..c5d8b96 100644
36535 --- a/drivers/acpi/blacklist.c
36536 +++ b/drivers/acpi/blacklist.c
36537 @@ -51,7 +51,7 @@ struct acpi_blacklist_item {
36538 u32 is_critical_error;
36539 };
36540
36541 -static struct dmi_system_id acpi_osi_dmi_table[] __initdata;
36542 +static const struct dmi_system_id acpi_osi_dmi_table[] __initconst;
36543
36544 /*
36545 * POLICY: If *anything* doesn't work, put it on the blacklist.
36546 @@ -163,7 +163,7 @@ static int __init dmi_disable_osi_win8(const struct dmi_system_id *d)
36547 return 0;
36548 }
36549
36550 -static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
36551 +static const struct dmi_system_id acpi_osi_dmi_table[] __initconst = {
36552 {
36553 .callback = dmi_disable_osi_vista,
36554 .ident = "Fujitsu Siemens",
36555 diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c
36556 index c68e724..e863008 100644
36557 --- a/drivers/acpi/custom_method.c
36558 +++ b/drivers/acpi/custom_method.c
36559 @@ -29,6 +29,10 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
36560 struct acpi_table_header table;
36561 acpi_status status;
36562
36563 +#ifdef CONFIG_GRKERNSEC_KMEM
36564 + return -EPERM;
36565 +#endif
36566 +
36567 if (!(*ppos)) {
36568 /* parse the table header to get the table length */
36569 if (count <= sizeof(struct acpi_table_header))
36570 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
36571 index 3dca36d..abaf070 100644
36572 --- a/drivers/acpi/processor_idle.c
36573 +++ b/drivers/acpi/processor_idle.c
36574 @@ -952,7 +952,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
36575 {
36576 int i, count = CPUIDLE_DRIVER_STATE_START;
36577 struct acpi_processor_cx *cx;
36578 - struct cpuidle_state *state;
36579 + cpuidle_state_no_const *state;
36580 struct cpuidle_driver *drv = &acpi_idle_driver;
36581
36582 if (!pr->flags.power_setup_done)
36583 diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
36584 index 91a32ce..d77fcaf 100644
36585 --- a/drivers/acpi/sysfs.c
36586 +++ b/drivers/acpi/sysfs.c
36587 @@ -425,11 +425,11 @@ static u32 num_counters;
36588 static struct attribute **all_attrs;
36589 static u32 acpi_gpe_count;
36590
36591 -static struct attribute_group interrupt_stats_attr_group = {
36592 +static attribute_group_no_const interrupt_stats_attr_group = {
36593 .name = "interrupts",
36594 };
36595
36596 -static struct kobj_attribute *counter_attrs;
36597 +static kobj_attribute_no_const *counter_attrs;
36598
36599 static void delete_gpe_attr_array(void)
36600 {
36601 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
36602 index 36605ab..6ef6d4b 100644
36603 --- a/drivers/ata/libahci.c
36604 +++ b/drivers/ata/libahci.c
36605 @@ -1239,7 +1239,7 @@ int ahci_kick_engine(struct ata_port *ap)
36606 }
36607 EXPORT_SYMBOL_GPL(ahci_kick_engine);
36608
36609 -static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
36610 +static int __intentional_overflow(-1) ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
36611 struct ata_taskfile *tf, int is_cmd, u16 flags,
36612 unsigned long timeout_msec)
36613 {
36614 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
36615 index 0a79c54..c1b92ed 100644
36616 --- a/drivers/ata/libata-core.c
36617 +++ b/drivers/ata/libata-core.c
36618 @@ -98,7 +98,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
36619 static void ata_dev_xfermask(struct ata_device *dev);
36620 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
36621
36622 -atomic_t ata_print_id = ATOMIC_INIT(0);
36623 +atomic_unchecked_t ata_print_id = ATOMIC_INIT(0);
36624
36625 struct ata_force_param {
36626 const char *name;
36627 @@ -4858,7 +4858,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
36628 struct ata_port *ap;
36629 unsigned int tag;
36630
36631 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36632 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36633 ap = qc->ap;
36634
36635 qc->flags = 0;
36636 @@ -4874,7 +4874,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
36637 struct ata_port *ap;
36638 struct ata_link *link;
36639
36640 - WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36641 + BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
36642 WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
36643 ap = qc->ap;
36644 link = qc->dev->link;
36645 @@ -5993,6 +5993,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
36646 return;
36647
36648 spin_lock(&lock);
36649 + pax_open_kernel();
36650
36651 for (cur = ops->inherits; cur; cur = cur->inherits) {
36652 void **inherit = (void **)cur;
36653 @@ -6006,8 +6007,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
36654 if (IS_ERR(*pp))
36655 *pp = NULL;
36656
36657 - ops->inherits = NULL;
36658 + *(struct ata_port_operations **)&ops->inherits = NULL;
36659
36660 + pax_close_kernel();
36661 spin_unlock(&lock);
36662 }
36663
36664 @@ -6200,7 +6202,7 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
36665
36666 /* give ports names and add SCSI hosts */
36667 for (i = 0; i < host->n_ports; i++) {
36668 - host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
36669 + host->ports[i]->print_id = atomic_inc_return_unchecked(&ata_print_id);
36670 host->ports[i]->local_port_no = i + 1;
36671 }
36672
36673 diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
36674 index ef8567d..8bdbd03 100644
36675 --- a/drivers/ata/libata-scsi.c
36676 +++ b/drivers/ata/libata-scsi.c
36677 @@ -4147,7 +4147,7 @@ int ata_sas_port_init(struct ata_port *ap)
36678
36679 if (rc)
36680 return rc;
36681 - ap->print_id = atomic_inc_return(&ata_print_id);
36682 + ap->print_id = atomic_inc_return_unchecked(&ata_print_id);
36683 return 0;
36684 }
36685 EXPORT_SYMBOL_GPL(ata_sas_port_init);
36686 diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
36687 index 45b5ab3..98446b8 100644
36688 --- a/drivers/ata/libata.h
36689 +++ b/drivers/ata/libata.h
36690 @@ -53,7 +53,7 @@ enum {
36691 ATA_DNXFER_QUIET = (1 << 31),
36692 };
36693
36694 -extern atomic_t ata_print_id;
36695 +extern atomic_unchecked_t ata_print_id;
36696 extern int atapi_passthru16;
36697 extern int libata_fua;
36698 extern int libata_noacpi;
36699 diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
36700 index 73492dd..ca2bff5 100644
36701 --- a/drivers/ata/pata_arasan_cf.c
36702 +++ b/drivers/ata/pata_arasan_cf.c
36703 @@ -865,7 +865,9 @@ static int arasan_cf_probe(struct platform_device *pdev)
36704 /* Handle platform specific quirks */
36705 if (quirk) {
36706 if (quirk & CF_BROKEN_PIO) {
36707 - ap->ops->set_piomode = NULL;
36708 + pax_open_kernel();
36709 + *(void **)&ap->ops->set_piomode = NULL;
36710 + pax_close_kernel();
36711 ap->pio_mask = 0;
36712 }
36713 if (quirk & CF_BROKEN_MWDMA)
36714 diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
36715 index f9b983a..887b9d8 100644
36716 --- a/drivers/atm/adummy.c
36717 +++ b/drivers/atm/adummy.c
36718 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct sk_buff *skb)
36719 vcc->pop(vcc, skb);
36720 else
36721 dev_kfree_skb_any(skb);
36722 - atomic_inc(&vcc->stats->tx);
36723 + atomic_inc_unchecked(&vcc->stats->tx);
36724
36725 return 0;
36726 }
36727 diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
36728 index 62a7607..cc4be104 100644
36729 --- a/drivers/atm/ambassador.c
36730 +++ b/drivers/atm/ambassador.c
36731 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, tx_out * tx) {
36732 PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
36733
36734 // VC layer stats
36735 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
36736 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
36737
36738 // free the descriptor
36739 kfree (tx_descr);
36740 @@ -495,7 +495,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
36741 dump_skb ("<<<", vc, skb);
36742
36743 // VC layer stats
36744 - atomic_inc(&atm_vcc->stats->rx);
36745 + atomic_inc_unchecked(&atm_vcc->stats->rx);
36746 __net_timestamp(skb);
36747 // end of our responsibility
36748 atm_vcc->push (atm_vcc, skb);
36749 @@ -510,7 +510,7 @@ static void rx_complete (amb_dev * dev, rx_out * rx) {
36750 } else {
36751 PRINTK (KERN_INFO, "dropped over-size frame");
36752 // should we count this?
36753 - atomic_inc(&atm_vcc->stats->rx_drop);
36754 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
36755 }
36756
36757 } else {
36758 @@ -1338,7 +1338,7 @@ static int amb_send (struct atm_vcc * atm_vcc, struct sk_buff * skb) {
36759 }
36760
36761 if (check_area (skb->data, skb->len)) {
36762 - atomic_inc(&atm_vcc->stats->tx_err);
36763 + atomic_inc_unchecked(&atm_vcc->stats->tx_err);
36764 return -ENOMEM; // ?
36765 }
36766
36767 diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
36768 index 0e3f8f9..765a7a5 100644
36769 --- a/drivers/atm/atmtcp.c
36770 +++ b/drivers/atm/atmtcp.c
36771 @@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
36772 if (vcc->pop) vcc->pop(vcc,skb);
36773 else dev_kfree_skb(skb);
36774 if (dev_data) return 0;
36775 - atomic_inc(&vcc->stats->tx_err);
36776 + atomic_inc_unchecked(&vcc->stats->tx_err);
36777 return -ENOLINK;
36778 }
36779 size = skb->len+sizeof(struct atmtcp_hdr);
36780 @@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
36781 if (!new_skb) {
36782 if (vcc->pop) vcc->pop(vcc,skb);
36783 else dev_kfree_skb(skb);
36784 - atomic_inc(&vcc->stats->tx_err);
36785 + atomic_inc_unchecked(&vcc->stats->tx_err);
36786 return -ENOBUFS;
36787 }
36788 hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
36789 @@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc *vcc,struct sk_buff *skb)
36790 if (vcc->pop) vcc->pop(vcc,skb);
36791 else dev_kfree_skb(skb);
36792 out_vcc->push(out_vcc,new_skb);
36793 - atomic_inc(&vcc->stats->tx);
36794 - atomic_inc(&out_vcc->stats->rx);
36795 + atomic_inc_unchecked(&vcc->stats->tx);
36796 + atomic_inc_unchecked(&out_vcc->stats->rx);
36797 return 0;
36798 }
36799
36800 @@ -299,7 +299,7 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
36801 out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
36802 read_unlock(&vcc_sklist_lock);
36803 if (!out_vcc) {
36804 - atomic_inc(&vcc->stats->tx_err);
36805 + atomic_inc_unchecked(&vcc->stats->tx_err);
36806 goto done;
36807 }
36808 skb_pull(skb,sizeof(struct atmtcp_hdr));
36809 @@ -311,8 +311,8 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
36810 __net_timestamp(new_skb);
36811 skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
36812 out_vcc->push(out_vcc,new_skb);
36813 - atomic_inc(&vcc->stats->tx);
36814 - atomic_inc(&out_vcc->stats->rx);
36815 + atomic_inc_unchecked(&vcc->stats->tx);
36816 + atomic_inc_unchecked(&out_vcc->stats->rx);
36817 done:
36818 if (vcc->pop) vcc->pop(vcc,skb);
36819 else dev_kfree_skb(skb);
36820 diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
36821 index b1955ba..b179940 100644
36822 --- a/drivers/atm/eni.c
36823 +++ b/drivers/atm/eni.c
36824 @@ -522,7 +522,7 @@ static int rx_aal0(struct atm_vcc *vcc)
36825 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
36826 vcc->dev->number);
36827 length = 0;
36828 - atomic_inc(&vcc->stats->rx_err);
36829 + atomic_inc_unchecked(&vcc->stats->rx_err);
36830 }
36831 else {
36832 length = ATM_CELL_SIZE-1; /* no HEC */
36833 @@ -577,7 +577,7 @@ static int rx_aal5(struct atm_vcc *vcc)
36834 size);
36835 }
36836 eff = length = 0;
36837 - atomic_inc(&vcc->stats->rx_err);
36838 + atomic_inc_unchecked(&vcc->stats->rx_err);
36839 }
36840 else {
36841 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
36842 @@ -594,7 +594,7 @@ static int rx_aal5(struct atm_vcc *vcc)
36843 "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
36844 vcc->dev->number,vcc->vci,length,size << 2,descr);
36845 length = eff = 0;
36846 - atomic_inc(&vcc->stats->rx_err);
36847 + atomic_inc_unchecked(&vcc->stats->rx_err);
36848 }
36849 }
36850 skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
36851 @@ -767,7 +767,7 @@ rx_dequeued++;
36852 vcc->push(vcc,skb);
36853 pushed++;
36854 }
36855 - atomic_inc(&vcc->stats->rx);
36856 + atomic_inc_unchecked(&vcc->stats->rx);
36857 }
36858 wake_up(&eni_dev->rx_wait);
36859 }
36860 @@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *dev)
36861 PCI_DMA_TODEVICE);
36862 if (vcc->pop) vcc->pop(vcc,skb);
36863 else dev_kfree_skb_irq(skb);
36864 - atomic_inc(&vcc->stats->tx);
36865 + atomic_inc_unchecked(&vcc->stats->tx);
36866 wake_up(&eni_dev->tx_wait);
36867 dma_complete++;
36868 }
36869 diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
36870 index b41c948..a002b17 100644
36871 --- a/drivers/atm/firestream.c
36872 +++ b/drivers/atm/firestream.c
36873 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct fs_dev *dev, struct queue *q)
36874 }
36875 }
36876
36877 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
36878 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
36879
36880 fs_dprintk (FS_DEBUG_TXMEM, "i");
36881 fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
36882 @@ -816,7 +816,7 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
36883 #endif
36884 skb_put (skb, qe->p1 & 0xffff);
36885 ATM_SKB(skb)->vcc = atm_vcc;
36886 - atomic_inc(&atm_vcc->stats->rx);
36887 + atomic_inc_unchecked(&atm_vcc->stats->rx);
36888 __net_timestamp(skb);
36889 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
36890 atm_vcc->push (atm_vcc, skb);
36891 @@ -837,12 +837,12 @@ static void process_incoming (struct fs_dev *dev, struct queue *q)
36892 kfree (pe);
36893 }
36894 if (atm_vcc)
36895 - atomic_inc(&atm_vcc->stats->rx_drop);
36896 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
36897 break;
36898 case 0x1f: /* Reassembly abort: no buffers. */
36899 /* Silently increment error counter. */
36900 if (atm_vcc)
36901 - atomic_inc(&atm_vcc->stats->rx_drop);
36902 + atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
36903 break;
36904 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
36905 printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
36906 diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
36907 index 204814e..cede831 100644
36908 --- a/drivers/atm/fore200e.c
36909 +++ b/drivers/atm/fore200e.c
36910 @@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200e)
36911 #endif
36912 /* check error condition */
36913 if (*entry->status & STATUS_ERROR)
36914 - atomic_inc(&vcc->stats->tx_err);
36915 + atomic_inc_unchecked(&vcc->stats->tx_err);
36916 else
36917 - atomic_inc(&vcc->stats->tx);
36918 + atomic_inc_unchecked(&vcc->stats->tx);
36919 }
36920 }
36921
36922 @@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
36923 if (skb == NULL) {
36924 DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
36925
36926 - atomic_inc(&vcc->stats->rx_drop);
36927 + atomic_inc_unchecked(&vcc->stats->rx_drop);
36928 return -ENOMEM;
36929 }
36930
36931 @@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore200e, struct atm_vcc* vcc, struct rpd* rp
36932
36933 dev_kfree_skb_any(skb);
36934
36935 - atomic_inc(&vcc->stats->rx_drop);
36936 + atomic_inc_unchecked(&vcc->stats->rx_drop);
36937 return -ENOMEM;
36938 }
36939
36940 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
36941
36942 vcc->push(vcc, skb);
36943 - atomic_inc(&vcc->stats->rx);
36944 + atomic_inc_unchecked(&vcc->stats->rx);
36945
36946 ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
36947
36948 @@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200e)
36949 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
36950 fore200e->atm_dev->number,
36951 entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
36952 - atomic_inc(&vcc->stats->rx_err);
36953 + atomic_inc_unchecked(&vcc->stats->rx_err);
36954 }
36955 }
36956
36957 @@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
36958 goto retry_here;
36959 }
36960
36961 - atomic_inc(&vcc->stats->tx_err);
36962 + atomic_inc_unchecked(&vcc->stats->tx_err);
36963
36964 fore200e->tx_sat++;
36965 DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
36966 diff --git a/drivers/atm/he.c b/drivers/atm/he.c
36967 index aa6be26..f70a785 100644
36968 --- a/drivers/atm/he.c
36969 +++ b/drivers/atm/he.c
36970 @@ -1690,7 +1690,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
36971
36972 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
36973 hprintk("HBUF_ERR! (cid 0x%x)\n", cid);
36974 - atomic_inc(&vcc->stats->rx_drop);
36975 + atomic_inc_unchecked(&vcc->stats->rx_drop);
36976 goto return_host_buffers;
36977 }
36978
36979 @@ -1717,7 +1717,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
36980 RBRQ_LEN_ERR(he_dev->rbrq_head)
36981 ? "LEN_ERR" : "",
36982 vcc->vpi, vcc->vci);
36983 - atomic_inc(&vcc->stats->rx_err);
36984 + atomic_inc_unchecked(&vcc->stats->rx_err);
36985 goto return_host_buffers;
36986 }
36987
36988 @@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, int group)
36989 vcc->push(vcc, skb);
36990 spin_lock(&he_dev->global_lock);
36991
36992 - atomic_inc(&vcc->stats->rx);
36993 + atomic_inc_unchecked(&vcc->stats->rx);
36994
36995 return_host_buffers:
36996 ++pdus_assembled;
36997 @@ -2095,7 +2095,7 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
36998 tpd->vcc->pop(tpd->vcc, tpd->skb);
36999 else
37000 dev_kfree_skb_any(tpd->skb);
37001 - atomic_inc(&tpd->vcc->stats->tx_err);
37002 + atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
37003 }
37004 pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
37005 return;
37006 @@ -2507,7 +2507,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37007 vcc->pop(vcc, skb);
37008 else
37009 dev_kfree_skb_any(skb);
37010 - atomic_inc(&vcc->stats->tx_err);
37011 + atomic_inc_unchecked(&vcc->stats->tx_err);
37012 return -EINVAL;
37013 }
37014
37015 @@ -2518,7 +2518,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37016 vcc->pop(vcc, skb);
37017 else
37018 dev_kfree_skb_any(skb);
37019 - atomic_inc(&vcc->stats->tx_err);
37020 + atomic_inc_unchecked(&vcc->stats->tx_err);
37021 return -EINVAL;
37022 }
37023 #endif
37024 @@ -2530,7 +2530,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37025 vcc->pop(vcc, skb);
37026 else
37027 dev_kfree_skb_any(skb);
37028 - atomic_inc(&vcc->stats->tx_err);
37029 + atomic_inc_unchecked(&vcc->stats->tx_err);
37030 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37031 return -ENOMEM;
37032 }
37033 @@ -2572,7 +2572,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37034 vcc->pop(vcc, skb);
37035 else
37036 dev_kfree_skb_any(skb);
37037 - atomic_inc(&vcc->stats->tx_err);
37038 + atomic_inc_unchecked(&vcc->stats->tx_err);
37039 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37040 return -ENOMEM;
37041 }
37042 @@ -2603,7 +2603,7 @@ he_send(struct atm_vcc *vcc, struct sk_buff *skb)
37043 __enqueue_tpd(he_dev, tpd, cid);
37044 spin_unlock_irqrestore(&he_dev->global_lock, flags);
37045
37046 - atomic_inc(&vcc->stats->tx);
37047 + atomic_inc_unchecked(&vcc->stats->tx);
37048
37049 return 0;
37050 }
37051 diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
37052 index 1dc0519..1aadaf7 100644
37053 --- a/drivers/atm/horizon.c
37054 +++ b/drivers/atm/horizon.c
37055 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, int irq) {
37056 {
37057 struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
37058 // VC layer stats
37059 - atomic_inc(&vcc->stats->rx);
37060 + atomic_inc_unchecked(&vcc->stats->rx);
37061 __net_timestamp(skb);
37062 // end of our responsibility
37063 vcc->push (vcc, skb);
37064 @@ -1186,7 +1186,7 @@ static void tx_schedule (hrz_dev * const dev, int irq) {
37065 dev->tx_iovec = NULL;
37066
37067 // VC layer stats
37068 - atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
37069 + atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
37070
37071 // free the skb
37072 hrz_kfree_skb (skb);
37073 diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
37074 index 1bdf104..9dc44b1 100644
37075 --- a/drivers/atm/idt77252.c
37076 +++ b/drivers/atm/idt77252.c
37077 @@ -812,7 +812,7 @@ drain_scq(struct idt77252_dev *card, struct vc_map *vc)
37078 else
37079 dev_kfree_skb(skb);
37080
37081 - atomic_inc(&vcc->stats->tx);
37082 + atomic_inc_unchecked(&vcc->stats->tx);
37083 }
37084
37085 atomic_dec(&scq->used);
37086 @@ -1075,13 +1075,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37087 if ((sb = dev_alloc_skb(64)) == NULL) {
37088 printk("%s: Can't allocate buffers for aal0.\n",
37089 card->name);
37090 - atomic_add(i, &vcc->stats->rx_drop);
37091 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
37092 break;
37093 }
37094 if (!atm_charge(vcc, sb->truesize)) {
37095 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
37096 card->name);
37097 - atomic_add(i - 1, &vcc->stats->rx_drop);
37098 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
37099 dev_kfree_skb(sb);
37100 break;
37101 }
37102 @@ -1098,7 +1098,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37103 ATM_SKB(sb)->vcc = vcc;
37104 __net_timestamp(sb);
37105 vcc->push(vcc, sb);
37106 - atomic_inc(&vcc->stats->rx);
37107 + atomic_inc_unchecked(&vcc->stats->rx);
37108
37109 cell += ATM_CELL_PAYLOAD;
37110 }
37111 @@ -1135,13 +1135,13 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37112 "(CDC: %08x)\n",
37113 card->name, len, rpp->len, readl(SAR_REG_CDC));
37114 recycle_rx_pool_skb(card, rpp);
37115 - atomic_inc(&vcc->stats->rx_err);
37116 + atomic_inc_unchecked(&vcc->stats->rx_err);
37117 return;
37118 }
37119 if (stat & SAR_RSQE_CRC) {
37120 RXPRINTK("%s: AAL5 CRC error.\n", card->name);
37121 recycle_rx_pool_skb(card, rpp);
37122 - atomic_inc(&vcc->stats->rx_err);
37123 + atomic_inc_unchecked(&vcc->stats->rx_err);
37124 return;
37125 }
37126 if (skb_queue_len(&rpp->queue) > 1) {
37127 @@ -1152,7 +1152,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37128 RXPRINTK("%s: Can't alloc RX skb.\n",
37129 card->name);
37130 recycle_rx_pool_skb(card, rpp);
37131 - atomic_inc(&vcc->stats->rx_err);
37132 + atomic_inc_unchecked(&vcc->stats->rx_err);
37133 return;
37134 }
37135 if (!atm_charge(vcc, skb->truesize)) {
37136 @@ -1171,7 +1171,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37137 __net_timestamp(skb);
37138
37139 vcc->push(vcc, skb);
37140 - atomic_inc(&vcc->stats->rx);
37141 + atomic_inc_unchecked(&vcc->stats->rx);
37142
37143 return;
37144 }
37145 @@ -1193,7 +1193,7 @@ dequeue_rx(struct idt77252_dev *card, struct rsq_entry *rsqe)
37146 __net_timestamp(skb);
37147
37148 vcc->push(vcc, skb);
37149 - atomic_inc(&vcc->stats->rx);
37150 + atomic_inc_unchecked(&vcc->stats->rx);
37151
37152 if (skb->truesize > SAR_FB_SIZE_3)
37153 add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
37154 @@ -1304,14 +1304,14 @@ idt77252_rx_raw(struct idt77252_dev *card)
37155 if (vcc->qos.aal != ATM_AAL0) {
37156 RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
37157 card->name, vpi, vci);
37158 - atomic_inc(&vcc->stats->rx_drop);
37159 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37160 goto drop;
37161 }
37162
37163 if ((sb = dev_alloc_skb(64)) == NULL) {
37164 printk("%s: Can't allocate buffers for AAL0.\n",
37165 card->name);
37166 - atomic_inc(&vcc->stats->rx_err);
37167 + atomic_inc_unchecked(&vcc->stats->rx_err);
37168 goto drop;
37169 }
37170
37171 @@ -1330,7 +1330,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
37172 ATM_SKB(sb)->vcc = vcc;
37173 __net_timestamp(sb);
37174 vcc->push(vcc, sb);
37175 - atomic_inc(&vcc->stats->rx);
37176 + atomic_inc_unchecked(&vcc->stats->rx);
37177
37178 drop:
37179 skb_pull(queue, 64);
37180 @@ -1955,13 +1955,13 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37181
37182 if (vc == NULL) {
37183 printk("%s: NULL connection in send().\n", card->name);
37184 - atomic_inc(&vcc->stats->tx_err);
37185 + atomic_inc_unchecked(&vcc->stats->tx_err);
37186 dev_kfree_skb(skb);
37187 return -EINVAL;
37188 }
37189 if (!test_bit(VCF_TX, &vc->flags)) {
37190 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
37191 - atomic_inc(&vcc->stats->tx_err);
37192 + atomic_inc_unchecked(&vcc->stats->tx_err);
37193 dev_kfree_skb(skb);
37194 return -EINVAL;
37195 }
37196 @@ -1973,14 +1973,14 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37197 break;
37198 default:
37199 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
37200 - atomic_inc(&vcc->stats->tx_err);
37201 + atomic_inc_unchecked(&vcc->stats->tx_err);
37202 dev_kfree_skb(skb);
37203 return -EINVAL;
37204 }
37205
37206 if (skb_shinfo(skb)->nr_frags != 0) {
37207 printk("%s: No scatter-gather yet.\n", card->name);
37208 - atomic_inc(&vcc->stats->tx_err);
37209 + atomic_inc_unchecked(&vcc->stats->tx_err);
37210 dev_kfree_skb(skb);
37211 return -EINVAL;
37212 }
37213 @@ -1988,7 +1988,7 @@ idt77252_send_skb(struct atm_vcc *vcc, struct sk_buff *skb, int oam)
37214
37215 err = queue_skb(card, vc, skb, oam);
37216 if (err) {
37217 - atomic_inc(&vcc->stats->tx_err);
37218 + atomic_inc_unchecked(&vcc->stats->tx_err);
37219 dev_kfree_skb(skb);
37220 return err;
37221 }
37222 @@ -2011,7 +2011,7 @@ idt77252_send_oam(struct atm_vcc *vcc, void *cell, int flags)
37223 skb = dev_alloc_skb(64);
37224 if (!skb) {
37225 printk("%s: Out of memory in send_oam().\n", card->name);
37226 - atomic_inc(&vcc->stats->tx_err);
37227 + atomic_inc_unchecked(&vcc->stats->tx_err);
37228 return -ENOMEM;
37229 }
37230 atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
37231 diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
37232 index 4217f29..88f547a 100644
37233 --- a/drivers/atm/iphase.c
37234 +++ b/drivers/atm/iphase.c
37235 @@ -1145,7 +1145,7 @@ static int rx_pkt(struct atm_dev *dev)
37236 status = (u_short) (buf_desc_ptr->desc_mode);
37237 if (status & (RX_CER | RX_PTE | RX_OFL))
37238 {
37239 - atomic_inc(&vcc->stats->rx_err);
37240 + atomic_inc_unchecked(&vcc->stats->rx_err);
37241 IF_ERR(printk("IA: bad packet, dropping it");)
37242 if (status & RX_CER) {
37243 IF_ERR(printk(" cause: packet CRC error\n");)
37244 @@ -1168,7 +1168,7 @@ static int rx_pkt(struct atm_dev *dev)
37245 len = dma_addr - buf_addr;
37246 if (len > iadev->rx_buf_sz) {
37247 printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
37248 - atomic_inc(&vcc->stats->rx_err);
37249 + atomic_inc_unchecked(&vcc->stats->rx_err);
37250 goto out_free_desc;
37251 }
37252
37253 @@ -1318,7 +1318,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37254 ia_vcc = INPH_IA_VCC(vcc);
37255 if (ia_vcc == NULL)
37256 {
37257 - atomic_inc(&vcc->stats->rx_err);
37258 + atomic_inc_unchecked(&vcc->stats->rx_err);
37259 atm_return(vcc, skb->truesize);
37260 dev_kfree_skb_any(skb);
37261 goto INCR_DLE;
37262 @@ -1330,7 +1330,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37263 if ((length > iadev->rx_buf_sz) || (length >
37264 (skb->len - sizeof(struct cpcs_trailer))))
37265 {
37266 - atomic_inc(&vcc->stats->rx_err);
37267 + atomic_inc_unchecked(&vcc->stats->rx_err);
37268 IF_ERR(printk("rx_dle_intr: Bad AAL5 trailer %d (skb len %d)",
37269 length, skb->len);)
37270 atm_return(vcc, skb->truesize);
37271 @@ -1346,7 +1346,7 @@ static void rx_dle_intr(struct atm_dev *dev)
37272
37273 IF_RX(printk("rx_dle_intr: skb push");)
37274 vcc->push(vcc,skb);
37275 - atomic_inc(&vcc->stats->rx);
37276 + atomic_inc_unchecked(&vcc->stats->rx);
37277 iadev->rx_pkt_cnt++;
37278 }
37279 INCR_DLE:
37280 @@ -2826,15 +2826,15 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
37281 {
37282 struct k_sonet_stats *stats;
37283 stats = &PRIV(_ia_dev[board])->sonet_stats;
37284 - printk("section_bip: %d\n", atomic_read(&stats->section_bip));
37285 - printk("line_bip : %d\n", atomic_read(&stats->line_bip));
37286 - printk("path_bip : %d\n", atomic_read(&stats->path_bip));
37287 - printk("line_febe : %d\n", atomic_read(&stats->line_febe));
37288 - printk("path_febe : %d\n", atomic_read(&stats->path_febe));
37289 - printk("corr_hcs : %d\n", atomic_read(&stats->corr_hcs));
37290 - printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
37291 - printk("tx_cells : %d\n", atomic_read(&stats->tx_cells));
37292 - printk("rx_cells : %d\n", atomic_read(&stats->rx_cells));
37293 + printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
37294 + printk("line_bip : %d\n", atomic_read_unchecked(&stats->line_bip));
37295 + printk("path_bip : %d\n", atomic_read_unchecked(&stats->path_bip));
37296 + printk("line_febe : %d\n", atomic_read_unchecked(&stats->line_febe));
37297 + printk("path_febe : %d\n", atomic_read_unchecked(&stats->path_febe));
37298 + printk("corr_hcs : %d\n", atomic_read_unchecked(&stats->corr_hcs));
37299 + printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
37300 + printk("tx_cells : %d\n", atomic_read_unchecked(&stats->tx_cells));
37301 + printk("rx_cells : %d\n", atomic_read_unchecked(&stats->rx_cells));
37302 }
37303 ia_cmds.status = 0;
37304 break;
37305 @@ -2939,7 +2939,7 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
37306 if ((desc == 0) || (desc > iadev->num_tx_desc))
37307 {
37308 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
37309 - atomic_inc(&vcc->stats->tx);
37310 + atomic_inc_unchecked(&vcc->stats->tx);
37311 if (vcc->pop)
37312 vcc->pop(vcc, skb);
37313 else
37314 @@ -3044,14 +3044,14 @@ static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
37315 ATM_DESC(skb) = vcc->vci;
37316 skb_queue_tail(&iadev->tx_dma_q, skb);
37317
37318 - atomic_inc(&vcc->stats->tx);
37319 + atomic_inc_unchecked(&vcc->stats->tx);
37320 iadev->tx_pkt_cnt++;
37321 /* Increment transaction counter */
37322 writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
37323
37324 #if 0
37325 /* add flow control logic */
37326 - if (atomic_read(&vcc->stats->tx) % 20 == 0) {
37327 + if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
37328 if (iavcc->vc_desc_cnt > 10) {
37329 vcc->tx_quota = vcc->tx_quota * 3 / 4;
37330 printk("Tx1: vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
37331 diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c
37332 index fa7d701..1e404c7 100644
37333 --- a/drivers/atm/lanai.c
37334 +++ b/drivers/atm/lanai.c
37335 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct lanai_dev *lanai,
37336 vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
37337 lanai_endtx(lanai, lvcc);
37338 lanai_free_skb(lvcc->tx.atmvcc, skb);
37339 - atomic_inc(&lvcc->tx.atmvcc->stats->tx);
37340 + atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
37341 }
37342
37343 /* Try to fill the buffer - don't call unless there is backlog */
37344 @@ -1426,7 +1426,7 @@ static void vcc_rx_aal5(struct lanai_vcc *lvcc, int endptr)
37345 ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
37346 __net_timestamp(skb);
37347 lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
37348 - atomic_inc(&lvcc->rx.atmvcc->stats->rx);
37349 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
37350 out:
37351 lvcc->rx.buf.ptr = end;
37352 cardvcc_write(lvcc, endptr, vcc_rxreadptr);
37353 @@ -1667,7 +1667,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37354 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
37355 "vcc %d\n", lanai->number, (unsigned int) s, vci);
37356 lanai->stats.service_rxnotaal5++;
37357 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37358 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37359 return 0;
37360 }
37361 if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
37362 @@ -1679,7 +1679,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37363 int bytes;
37364 read_unlock(&vcc_sklist_lock);
37365 DPRINTK("got trashed rx pdu on vci %d\n", vci);
37366 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37367 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37368 lvcc->stats.x.aal5.service_trash++;
37369 bytes = (SERVICE_GET_END(s) * 16) -
37370 (((unsigned long) lvcc->rx.buf.ptr) -
37371 @@ -1691,7 +1691,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37372 }
37373 if (s & SERVICE_STREAM) {
37374 read_unlock(&vcc_sklist_lock);
37375 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37376 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37377 lvcc->stats.x.aal5.service_stream++;
37378 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
37379 "PDU on VCI %d!\n", lanai->number, vci);
37380 @@ -1699,7 +1699,7 @@ static int handle_service(struct lanai_dev *lanai, u32 s)
37381 return 0;
37382 }
37383 DPRINTK("got rx crc error on vci %d\n", vci);
37384 - atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
37385 + atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
37386 lvcc->stats.x.aal5.service_rxcrc++;
37387 lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
37388 cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
37389 diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
37390 index 9587e95..b45c5cb 100644
37391 --- a/drivers/atm/nicstar.c
37392 +++ b/drivers/atm/nicstar.c
37393 @@ -1640,7 +1640,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37394 if ((vc = (vc_map *) vcc->dev_data) == NULL) {
37395 printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
37396 card->index);
37397 - atomic_inc(&vcc->stats->tx_err);
37398 + atomic_inc_unchecked(&vcc->stats->tx_err);
37399 dev_kfree_skb_any(skb);
37400 return -EINVAL;
37401 }
37402 @@ -1648,7 +1648,7 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37403 if (!vc->tx) {
37404 printk("nicstar%d: Trying to transmit on a non-tx VC.\n",
37405 card->index);
37406 - atomic_inc(&vcc->stats->tx_err);
37407 + atomic_inc_unchecked(&vcc->stats->tx_err);
37408 dev_kfree_skb_any(skb);
37409 return -EINVAL;
37410 }
37411 @@ -1656,14 +1656,14 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37412 if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0) {
37413 printk("nicstar%d: Only AAL0 and AAL5 are supported.\n",
37414 card->index);
37415 - atomic_inc(&vcc->stats->tx_err);
37416 + atomic_inc_unchecked(&vcc->stats->tx_err);
37417 dev_kfree_skb_any(skb);
37418 return -EINVAL;
37419 }
37420
37421 if (skb_shinfo(skb)->nr_frags != 0) {
37422 printk("nicstar%d: No scatter-gather yet.\n", card->index);
37423 - atomic_inc(&vcc->stats->tx_err);
37424 + atomic_inc_unchecked(&vcc->stats->tx_err);
37425 dev_kfree_skb_any(skb);
37426 return -EINVAL;
37427 }
37428 @@ -1711,11 +1711,11 @@ static int ns_send(struct atm_vcc *vcc, struct sk_buff *skb)
37429 }
37430
37431 if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
37432 - atomic_inc(&vcc->stats->tx_err);
37433 + atomic_inc_unchecked(&vcc->stats->tx_err);
37434 dev_kfree_skb_any(skb);
37435 return -EIO;
37436 }
37437 - atomic_inc(&vcc->stats->tx);
37438 + atomic_inc_unchecked(&vcc->stats->tx);
37439
37440 return 0;
37441 }
37442 @@ -2032,14 +2032,14 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37443 printk
37444 ("nicstar%d: Can't allocate buffers for aal0.\n",
37445 card->index);
37446 - atomic_add(i, &vcc->stats->rx_drop);
37447 + atomic_add_unchecked(i, &vcc->stats->rx_drop);
37448 break;
37449 }
37450 if (!atm_charge(vcc, sb->truesize)) {
37451 RXPRINTK
37452 ("nicstar%d: atm_charge() dropped aal0 packets.\n",
37453 card->index);
37454 - atomic_add(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
37455 + atomic_add_unchecked(i - 1, &vcc->stats->rx_drop); /* already increased by 1 */
37456 dev_kfree_skb_any(sb);
37457 break;
37458 }
37459 @@ -2054,7 +2054,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37460 ATM_SKB(sb)->vcc = vcc;
37461 __net_timestamp(sb);
37462 vcc->push(vcc, sb);
37463 - atomic_inc(&vcc->stats->rx);
37464 + atomic_inc_unchecked(&vcc->stats->rx);
37465 cell += ATM_CELL_PAYLOAD;
37466 }
37467
37468 @@ -2071,7 +2071,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37469 if (iovb == NULL) {
37470 printk("nicstar%d: Out of iovec buffers.\n",
37471 card->index);
37472 - atomic_inc(&vcc->stats->rx_drop);
37473 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37474 recycle_rx_buf(card, skb);
37475 return;
37476 }
37477 @@ -2095,7 +2095,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37478 small or large buffer itself. */
37479 } else if (NS_PRV_IOVCNT(iovb) >= NS_MAX_IOVECS) {
37480 printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
37481 - atomic_inc(&vcc->stats->rx_err);
37482 + atomic_inc_unchecked(&vcc->stats->rx_err);
37483 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37484 NS_MAX_IOVECS);
37485 NS_PRV_IOVCNT(iovb) = 0;
37486 @@ -2115,7 +2115,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37487 ("nicstar%d: Expected a small buffer, and this is not one.\n",
37488 card->index);
37489 which_list(card, skb);
37490 - atomic_inc(&vcc->stats->rx_err);
37491 + atomic_inc_unchecked(&vcc->stats->rx_err);
37492 recycle_rx_buf(card, skb);
37493 vc->rx_iov = NULL;
37494 recycle_iov_buf(card, iovb);
37495 @@ -2128,7 +2128,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37496 ("nicstar%d: Expected a large buffer, and this is not one.\n",
37497 card->index);
37498 which_list(card, skb);
37499 - atomic_inc(&vcc->stats->rx_err);
37500 + atomic_inc_unchecked(&vcc->stats->rx_err);
37501 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37502 NS_PRV_IOVCNT(iovb));
37503 vc->rx_iov = NULL;
37504 @@ -2151,7 +2151,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37505 printk(" - PDU size mismatch.\n");
37506 else
37507 printk(".\n");
37508 - atomic_inc(&vcc->stats->rx_err);
37509 + atomic_inc_unchecked(&vcc->stats->rx_err);
37510 recycle_iovec_rx_bufs(card, (struct iovec *)iovb->data,
37511 NS_PRV_IOVCNT(iovb));
37512 vc->rx_iov = NULL;
37513 @@ -2165,7 +2165,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37514 /* skb points to a small buffer */
37515 if (!atm_charge(vcc, skb->truesize)) {
37516 push_rxbufs(card, skb);
37517 - atomic_inc(&vcc->stats->rx_drop);
37518 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37519 } else {
37520 skb_put(skb, len);
37521 dequeue_sm_buf(card, skb);
37522 @@ -2175,7 +2175,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37523 ATM_SKB(skb)->vcc = vcc;
37524 __net_timestamp(skb);
37525 vcc->push(vcc, skb);
37526 - atomic_inc(&vcc->stats->rx);
37527 + atomic_inc_unchecked(&vcc->stats->rx);
37528 }
37529 } else if (NS_PRV_IOVCNT(iovb) == 2) { /* One small plus one large buffer */
37530 struct sk_buff *sb;
37531 @@ -2186,7 +2186,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37532 if (len <= NS_SMBUFSIZE) {
37533 if (!atm_charge(vcc, sb->truesize)) {
37534 push_rxbufs(card, sb);
37535 - atomic_inc(&vcc->stats->rx_drop);
37536 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37537 } else {
37538 skb_put(sb, len);
37539 dequeue_sm_buf(card, sb);
37540 @@ -2196,7 +2196,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37541 ATM_SKB(sb)->vcc = vcc;
37542 __net_timestamp(sb);
37543 vcc->push(vcc, sb);
37544 - atomic_inc(&vcc->stats->rx);
37545 + atomic_inc_unchecked(&vcc->stats->rx);
37546 }
37547
37548 push_rxbufs(card, skb);
37549 @@ -2205,7 +2205,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37550
37551 if (!atm_charge(vcc, skb->truesize)) {
37552 push_rxbufs(card, skb);
37553 - atomic_inc(&vcc->stats->rx_drop);
37554 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37555 } else {
37556 dequeue_lg_buf(card, skb);
37557 #ifdef NS_USE_DESTRUCTORS
37558 @@ -2218,7 +2218,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37559 ATM_SKB(skb)->vcc = vcc;
37560 __net_timestamp(skb);
37561 vcc->push(vcc, skb);
37562 - atomic_inc(&vcc->stats->rx);
37563 + atomic_inc_unchecked(&vcc->stats->rx);
37564 }
37565
37566 push_rxbufs(card, sb);
37567 @@ -2239,7 +2239,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37568 printk
37569 ("nicstar%d: Out of huge buffers.\n",
37570 card->index);
37571 - atomic_inc(&vcc->stats->rx_drop);
37572 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37573 recycle_iovec_rx_bufs(card,
37574 (struct iovec *)
37575 iovb->data,
37576 @@ -2290,7 +2290,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37577 card->hbpool.count++;
37578 } else
37579 dev_kfree_skb_any(hb);
37580 - atomic_inc(&vcc->stats->rx_drop);
37581 + atomic_inc_unchecked(&vcc->stats->rx_drop);
37582 } else {
37583 /* Copy the small buffer to the huge buffer */
37584 sb = (struct sk_buff *)iov->iov_base;
37585 @@ -2327,7 +2327,7 @@ static void dequeue_rx(ns_dev * card, ns_rsqe * rsqe)
37586 #endif /* NS_USE_DESTRUCTORS */
37587 __net_timestamp(hb);
37588 vcc->push(vcc, hb);
37589 - atomic_inc(&vcc->stats->rx);
37590 + atomic_inc_unchecked(&vcc->stats->rx);
37591 }
37592 }
37593
37594 diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
37595 index e3fb496..d9646bf 100644
37596 --- a/drivers/atm/solos-pci.c
37597 +++ b/drivers/atm/solos-pci.c
37598 @@ -838,7 +838,7 @@ void solos_bh(unsigned long card_arg)
37599 }
37600 atm_charge(vcc, skb->truesize);
37601 vcc->push(vcc, skb);
37602 - atomic_inc(&vcc->stats->rx);
37603 + atomic_inc_unchecked(&vcc->stats->rx);
37604 break;
37605
37606 case PKT_STATUS:
37607 @@ -1116,7 +1116,7 @@ static uint32_t fpga_tx(struct solos_card *card)
37608 vcc = SKB_CB(oldskb)->vcc;
37609
37610 if (vcc) {
37611 - atomic_inc(&vcc->stats->tx);
37612 + atomic_inc_unchecked(&vcc->stats->tx);
37613 solos_pop(vcc, oldskb);
37614 } else {
37615 dev_kfree_skb_irq(oldskb);
37616 diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
37617 index 0215934..ce9f5b1 100644
37618 --- a/drivers/atm/suni.c
37619 +++ b/drivers/atm/suni.c
37620 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
37621
37622
37623 #define ADD_LIMITED(s,v) \
37624 - atomic_add((v),&stats->s); \
37625 - if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
37626 + atomic_add_unchecked((v),&stats->s); \
37627 + if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
37628
37629
37630 static void suni_hz(unsigned long from_timer)
37631 diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
37632 index 5120a96..e2572bd 100644
37633 --- a/drivers/atm/uPD98402.c
37634 +++ b/drivers/atm/uPD98402.c
37635 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *dev,struct sonet_stats __user *arg,int ze
37636 struct sonet_stats tmp;
37637 int error = 0;
37638
37639 - atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
37640 + atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
37641 sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
37642 if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
37643 if (zero && !error) {
37644 @@ -161,9 +161,9 @@ static int uPD98402_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
37645
37646
37647 #define ADD_LIMITED(s,v) \
37648 - { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
37649 - if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
37650 - atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
37651 + { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
37652 + if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
37653 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
37654
37655
37656 static void stat_event(struct atm_dev *dev)
37657 @@ -194,7 +194,7 @@ static void uPD98402_int(struct atm_dev *dev)
37658 if (reason & uPD98402_INT_PFM) stat_event(dev);
37659 if (reason & uPD98402_INT_PCO) {
37660 (void) GET(PCOCR); /* clear interrupt cause */
37661 - atomic_add(GET(HECCT),
37662 + atomic_add_unchecked(GET(HECCT),
37663 &PRIV(dev)->sonet_stats.uncorr_hcs);
37664 }
37665 if ((reason & uPD98402_INT_RFO) &&
37666 @@ -222,9 +222,9 @@ static int uPD98402_start(struct atm_dev *dev)
37667 PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
37668 uPD98402_INT_LOS),PIMR); /* enable them */
37669 (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
37670 - atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
37671 - atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
37672 - atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
37673 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
37674 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
37675 + atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
37676 return 0;
37677 }
37678
37679 diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
37680 index 969c3c2..9b72956 100644
37681 --- a/drivers/atm/zatm.c
37682 +++ b/drivers/atm/zatm.c
37683 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
37684 }
37685 if (!size) {
37686 dev_kfree_skb_irq(skb);
37687 - if (vcc) atomic_inc(&vcc->stats->rx_err);
37688 + if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
37689 continue;
37690 }
37691 if (!atm_charge(vcc,skb->truesize)) {
37692 @@ -469,7 +469,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy[0],dummy[1]);
37693 skb->len = size;
37694 ATM_SKB(skb)->vcc = vcc;
37695 vcc->push(vcc,skb);
37696 - atomic_inc(&vcc->stats->rx);
37697 + atomic_inc_unchecked(&vcc->stats->rx);
37698 }
37699 zout(pos & 0xffff,MTA(mbx));
37700 #if 0 /* probably a stupid idea */
37701 @@ -733,7 +733,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD_V | uPD98401_TXPD_DP |
37702 skb_queue_head(&zatm_vcc->backlog,skb);
37703 break;
37704 }
37705 - atomic_inc(&vcc->stats->tx);
37706 + atomic_inc_unchecked(&vcc->stats->tx);
37707 wake_up(&zatm_vcc->tx_wait);
37708 }
37709
37710 diff --git a/drivers/base/bus.c b/drivers/base/bus.c
37711 index 59dc808..f10c74e 100644
37712 --- a/drivers/base/bus.c
37713 +++ b/drivers/base/bus.c
37714 @@ -1124,7 +1124,7 @@ int subsys_interface_register(struct subsys_interface *sif)
37715 return -EINVAL;
37716
37717 mutex_lock(&subsys->p->mutex);
37718 - list_add_tail(&sif->node, &subsys->p->interfaces);
37719 + pax_list_add_tail((struct list_head *)&sif->node, &subsys->p->interfaces);
37720 if (sif->add_dev) {
37721 subsys_dev_iter_init(&iter, subsys, NULL, NULL);
37722 while ((dev = subsys_dev_iter_next(&iter)))
37723 @@ -1149,7 +1149,7 @@ void subsys_interface_unregister(struct subsys_interface *sif)
37724 subsys = sif->subsys;
37725
37726 mutex_lock(&subsys->p->mutex);
37727 - list_del_init(&sif->node);
37728 + pax_list_del_init((struct list_head *)&sif->node);
37729 if (sif->remove_dev) {
37730 subsys_dev_iter_init(&iter, subsys, NULL, NULL);
37731 while ((dev = subsys_dev_iter_next(&iter)))
37732 diff --git a/drivers/base/devtmpfs.c b/drivers/base/devtmpfs.c
37733 index 25798db..15f130e 100644
37734 --- a/drivers/base/devtmpfs.c
37735 +++ b/drivers/base/devtmpfs.c
37736 @@ -354,7 +354,7 @@ int devtmpfs_mount(const char *mntdir)
37737 if (!thread)
37738 return 0;
37739
37740 - err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL);
37741 + err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL);
37742 if (err)
37743 printk(KERN_INFO "devtmpfs: error mounting %i\n", err);
37744 else
37745 @@ -380,11 +380,11 @@ static int devtmpfsd(void *p)
37746 *err = sys_unshare(CLONE_NEWNS);
37747 if (*err)
37748 goto out;
37749 - *err = sys_mount("devtmpfs", "/", "devtmpfs", MS_SILENT, options);
37750 + *err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)"/", (char __force_user *)"devtmpfs", MS_SILENT, (char __force_user *)options);
37751 if (*err)
37752 goto out;
37753 - sys_chdir("/.."); /* will traverse into overmounted root */
37754 - sys_chroot(".");
37755 + sys_chdir((char __force_user *)"/.."); /* will traverse into overmounted root */
37756 + sys_chroot((char __force_user *)".");
37757 complete(&setup_done);
37758 while (1) {
37759 spin_lock(&req_lock);
37760 diff --git a/drivers/base/node.c b/drivers/base/node.c
37761 index bc9f43b..29703b8 100644
37762 --- a/drivers/base/node.c
37763 +++ b/drivers/base/node.c
37764 @@ -620,7 +620,7 @@ static ssize_t print_nodes_state(enum node_states state, char *buf)
37765 struct node_attr {
37766 struct device_attribute attr;
37767 enum node_states state;
37768 -};
37769 +} __do_const;
37770
37771 static ssize_t show_node_state(struct device *dev,
37772 struct device_attribute *attr, char *buf)
37773 diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
37774 index bfb8955..4ebff34 100644
37775 --- a/drivers/base/power/domain.c
37776 +++ b/drivers/base/power/domain.c
37777 @@ -1809,9 +1809,9 @@ int __pm_genpd_remove_callbacks(struct device *dev, bool clear_td)
37778
37779 if (dev->power.subsys_data->domain_data) {
37780 gpd_data = to_gpd_data(dev->power.subsys_data->domain_data);
37781 - gpd_data->ops = (struct gpd_dev_ops){ NULL };
37782 + memset(&gpd_data->ops, 0, sizeof(gpd_data->ops));
37783 if (clear_td)
37784 - gpd_data->td = (struct gpd_timing_data){ 0 };
37785 + memset(&gpd_data->td, 0, sizeof(gpd_data->td));
37786
37787 if (--gpd_data->refcount == 0) {
37788 dev->power.subsys_data->domain_data = NULL;
37789 @@ -1850,7 +1850,7 @@ int pm_genpd_attach_cpuidle(struct generic_pm_domain *genpd, int state)
37790 {
37791 struct cpuidle_driver *cpuidle_drv;
37792 struct gpd_cpu_data *cpu_data;
37793 - struct cpuidle_state *idle_state;
37794 + cpuidle_state_no_const *idle_state;
37795 int ret = 0;
37796
37797 if (IS_ERR_OR_NULL(genpd) || state < 0)
37798 @@ -1918,7 +1918,7 @@ int pm_genpd_name_attach_cpuidle(const char *name, int state)
37799 int pm_genpd_detach_cpuidle(struct generic_pm_domain *genpd)
37800 {
37801 struct gpd_cpu_data *cpu_data;
37802 - struct cpuidle_state *idle_state;
37803 + cpuidle_state_no_const *idle_state;
37804 int ret = 0;
37805
37806 if (IS_ERR_OR_NULL(genpd))
37807 diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c
37808 index 03e089a..0e9560c 100644
37809 --- a/drivers/base/power/sysfs.c
37810 +++ b/drivers/base/power/sysfs.c
37811 @@ -185,7 +185,7 @@ static ssize_t rtpm_status_show(struct device *dev,
37812 return -EIO;
37813 }
37814 }
37815 - return sprintf(buf, p);
37816 + return sprintf(buf, "%s", p);
37817 }
37818
37819 static DEVICE_ATTR(runtime_status, 0444, rtpm_status_show, NULL);
37820 diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
37821 index 2d56f41..8830f19 100644
37822 --- a/drivers/base/power/wakeup.c
37823 +++ b/drivers/base/power/wakeup.c
37824 @@ -29,14 +29,14 @@ bool events_check_enabled __read_mostly;
37825 * They need to be modified together atomically, so it's better to use one
37826 * atomic variable to hold them both.
37827 */
37828 -static atomic_t combined_event_count = ATOMIC_INIT(0);
37829 +static atomic_unchecked_t combined_event_count = ATOMIC_INIT(0);
37830
37831 #define IN_PROGRESS_BITS (sizeof(int) * 4)
37832 #define MAX_IN_PROGRESS ((1 << IN_PROGRESS_BITS) - 1)
37833
37834 static void split_counters(unsigned int *cnt, unsigned int *inpr)
37835 {
37836 - unsigned int comb = atomic_read(&combined_event_count);
37837 + unsigned int comb = atomic_read_unchecked(&combined_event_count);
37838
37839 *cnt = (comb >> IN_PROGRESS_BITS);
37840 *inpr = comb & MAX_IN_PROGRESS;
37841 @@ -395,7 +395,7 @@ static void wakeup_source_activate(struct wakeup_source *ws)
37842 ws->start_prevent_time = ws->last_time;
37843
37844 /* Increment the counter of events in progress. */
37845 - cec = atomic_inc_return(&combined_event_count);
37846 + cec = atomic_inc_return_unchecked(&combined_event_count);
37847
37848 trace_wakeup_source_activate(ws->name, cec);
37849 }
37850 @@ -521,7 +521,7 @@ static void wakeup_source_deactivate(struct wakeup_source *ws)
37851 * Increment the counter of registered wakeup events and decrement the
37852 * couter of wakeup events in progress simultaneously.
37853 */
37854 - cec = atomic_add_return(MAX_IN_PROGRESS, &combined_event_count);
37855 + cec = atomic_add_return_unchecked(MAX_IN_PROGRESS, &combined_event_count);
37856 trace_wakeup_source_deactivate(ws->name, cec);
37857
37858 split_counters(&cnt, &inpr);
37859 diff --git a/drivers/base/syscore.c b/drivers/base/syscore.c
37860 index e8d11b6..7b1b36f 100644
37861 --- a/drivers/base/syscore.c
37862 +++ b/drivers/base/syscore.c
37863 @@ -21,7 +21,7 @@ static DEFINE_MUTEX(syscore_ops_lock);
37864 void register_syscore_ops(struct syscore_ops *ops)
37865 {
37866 mutex_lock(&syscore_ops_lock);
37867 - list_add_tail(&ops->node, &syscore_ops_list);
37868 + pax_list_add_tail((struct list_head *)&ops->node, &syscore_ops_list);
37869 mutex_unlock(&syscore_ops_lock);
37870 }
37871 EXPORT_SYMBOL_GPL(register_syscore_ops);
37872 @@ -33,7 +33,7 @@ EXPORT_SYMBOL_GPL(register_syscore_ops);
37873 void unregister_syscore_ops(struct syscore_ops *ops)
37874 {
37875 mutex_lock(&syscore_ops_lock);
37876 - list_del(&ops->node);
37877 + pax_list_del((struct list_head *)&ops->node);
37878 mutex_unlock(&syscore_ops_lock);
37879 }
37880 EXPORT_SYMBOL_GPL(unregister_syscore_ops);
37881 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
37882 index 036e8ab..6221dec 100644
37883 --- a/drivers/block/cciss.c
37884 +++ b/drivers/block/cciss.c
37885 @@ -3011,7 +3011,7 @@ static void start_io(ctlr_info_t *h)
37886 while (!list_empty(&h->reqQ)) {
37887 c = list_entry(h->reqQ.next, CommandList_struct, list);
37888 /* can't do anything if fifo is full */
37889 - if ((h->access.fifo_full(h))) {
37890 + if ((h->access->fifo_full(h))) {
37891 dev_warn(&h->pdev->dev, "fifo full\n");
37892 break;
37893 }
37894 @@ -3021,7 +3021,7 @@ static void start_io(ctlr_info_t *h)
37895 h->Qdepth--;
37896
37897 /* Tell the controller execute command */
37898 - h->access.submit_command(h, c);
37899 + h->access->submit_command(h, c);
37900
37901 /* Put job onto the completed Q */
37902 addQ(&h->cmpQ, c);
37903 @@ -3447,17 +3447,17 @@ startio:
37904
37905 static inline unsigned long get_next_completion(ctlr_info_t *h)
37906 {
37907 - return h->access.command_completed(h);
37908 + return h->access->command_completed(h);
37909 }
37910
37911 static inline int interrupt_pending(ctlr_info_t *h)
37912 {
37913 - return h->access.intr_pending(h);
37914 + return h->access->intr_pending(h);
37915 }
37916
37917 static inline long interrupt_not_for_us(ctlr_info_t *h)
37918 {
37919 - return ((h->access.intr_pending(h) == 0) ||
37920 + return ((h->access->intr_pending(h) == 0) ||
37921 (h->interrupts_enabled == 0));
37922 }
37923
37924 @@ -3490,7 +3490,7 @@ static inline u32 next_command(ctlr_info_t *h)
37925 u32 a;
37926
37927 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
37928 - return h->access.command_completed(h);
37929 + return h->access->command_completed(h);
37930
37931 if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
37932 a = *(h->reply_pool_head); /* Next cmd in ring buffer */
37933 @@ -4047,7 +4047,7 @@ static void cciss_put_controller_into_performant_mode(ctlr_info_t *h)
37934 trans_support & CFGTBL_Trans_use_short_tags);
37935
37936 /* Change the access methods to the performant access methods */
37937 - h->access = SA5_performant_access;
37938 + h->access = &SA5_performant_access;
37939 h->transMethod = CFGTBL_Trans_Performant;
37940
37941 return;
37942 @@ -4327,7 +4327,7 @@ static int cciss_pci_init(ctlr_info_t *h)
37943 if (prod_index < 0)
37944 return -ENODEV;
37945 h->product_name = products[prod_index].product_name;
37946 - h->access = *(products[prod_index].access);
37947 + h->access = products[prod_index].access;
37948
37949 if (cciss_board_disabled(h)) {
37950 dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
37951 @@ -5059,7 +5059,7 @@ reinit_after_soft_reset:
37952 }
37953
37954 /* make sure the board interrupts are off */
37955 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
37956 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
37957 rc = cciss_request_irq(h, do_cciss_msix_intr, do_cciss_intx);
37958 if (rc)
37959 goto clean2;
37960 @@ -5109,7 +5109,7 @@ reinit_after_soft_reset:
37961 * fake ones to scoop up any residual completions.
37962 */
37963 spin_lock_irqsave(&h->lock, flags);
37964 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
37965 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
37966 spin_unlock_irqrestore(&h->lock, flags);
37967 free_irq(h->intr[h->intr_mode], h);
37968 rc = cciss_request_irq(h, cciss_msix_discard_completions,
37969 @@ -5129,9 +5129,9 @@ reinit_after_soft_reset:
37970 dev_info(&h->pdev->dev, "Board READY.\n");
37971 dev_info(&h->pdev->dev,
37972 "Waiting for stale completions to drain.\n");
37973 - h->access.set_intr_mask(h, CCISS_INTR_ON);
37974 + h->access->set_intr_mask(h, CCISS_INTR_ON);
37975 msleep(10000);
37976 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
37977 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
37978
37979 rc = controller_reset_failed(h->cfgtable);
37980 if (rc)
37981 @@ -5154,7 +5154,7 @@ reinit_after_soft_reset:
37982 cciss_scsi_setup(h);
37983
37984 /* Turn the interrupts on so we can service requests */
37985 - h->access.set_intr_mask(h, CCISS_INTR_ON);
37986 + h->access->set_intr_mask(h, CCISS_INTR_ON);
37987
37988 /* Get the firmware version */
37989 inq_buff = kzalloc(sizeof(InquiryData_struct), GFP_KERNEL);
37990 @@ -5226,7 +5226,7 @@ static void cciss_shutdown(struct pci_dev *pdev)
37991 kfree(flush_buf);
37992 if (return_code != IO_OK)
37993 dev_warn(&h->pdev->dev, "Error flushing cache\n");
37994 - h->access.set_intr_mask(h, CCISS_INTR_OFF);
37995 + h->access->set_intr_mask(h, CCISS_INTR_OFF);
37996 free_irq(h->intr[h->intr_mode], h);
37997 }
37998
37999 diff --git a/drivers/block/cciss.h b/drivers/block/cciss.h
38000 index 7fda30e..2f27946 100644
38001 --- a/drivers/block/cciss.h
38002 +++ b/drivers/block/cciss.h
38003 @@ -101,7 +101,7 @@ struct ctlr_info
38004 /* information about each logical volume */
38005 drive_info_struct *drv[CISS_MAX_LUN];
38006
38007 - struct access_method access;
38008 + struct access_method *access;
38009
38010 /* queue and queue Info */
38011 struct list_head reqQ;
38012 @@ -402,27 +402,27 @@ static bool SA5_performant_intr_pending(ctlr_info_t *h)
38013 }
38014
38015 static struct access_method SA5_access = {
38016 - SA5_submit_command,
38017 - SA5_intr_mask,
38018 - SA5_fifo_full,
38019 - SA5_intr_pending,
38020 - SA5_completed,
38021 + .submit_command = SA5_submit_command,
38022 + .set_intr_mask = SA5_intr_mask,
38023 + .fifo_full = SA5_fifo_full,
38024 + .intr_pending = SA5_intr_pending,
38025 + .command_completed = SA5_completed,
38026 };
38027
38028 static struct access_method SA5B_access = {
38029 - SA5_submit_command,
38030 - SA5B_intr_mask,
38031 - SA5_fifo_full,
38032 - SA5B_intr_pending,
38033 - SA5_completed,
38034 + .submit_command = SA5_submit_command,
38035 + .set_intr_mask = SA5B_intr_mask,
38036 + .fifo_full = SA5_fifo_full,
38037 + .intr_pending = SA5B_intr_pending,
38038 + .command_completed = SA5_completed,
38039 };
38040
38041 static struct access_method SA5_performant_access = {
38042 - SA5_submit_command,
38043 - SA5_performant_intr_mask,
38044 - SA5_fifo_full,
38045 - SA5_performant_intr_pending,
38046 - SA5_performant_completed,
38047 + .submit_command = SA5_submit_command,
38048 + .set_intr_mask = SA5_performant_intr_mask,
38049 + .fifo_full = SA5_fifo_full,
38050 + .intr_pending = SA5_performant_intr_pending,
38051 + .command_completed = SA5_performant_completed,
38052 };
38053
38054 struct board_type {
38055 diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
38056 index 2b94403..fd6ad1f 100644
38057 --- a/drivers/block/cpqarray.c
38058 +++ b/drivers/block/cpqarray.c
38059 @@ -404,7 +404,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev)
38060 if (register_blkdev(COMPAQ_SMART2_MAJOR+i, hba[i]->devname)) {
38061 goto Enomem4;
38062 }
38063 - hba[i]->access.set_intr_mask(hba[i], 0);
38064 + hba[i]->access->set_intr_mask(hba[i], 0);
38065 if (request_irq(hba[i]->intr, do_ida_intr,
38066 IRQF_DISABLED|IRQF_SHARED, hba[i]->devname, hba[i]))
38067 {
38068 @@ -459,7 +459,7 @@ static int cpqarray_register_ctlr(int i, struct pci_dev *pdev)
38069 add_timer(&hba[i]->timer);
38070
38071 /* Enable IRQ now that spinlock and rate limit timer are set up */
38072 - hba[i]->access.set_intr_mask(hba[i], FIFO_NOT_EMPTY);
38073 + hba[i]->access->set_intr_mask(hba[i], FIFO_NOT_EMPTY);
38074
38075 for(j=0; j<NWD; j++) {
38076 struct gendisk *disk = ida_gendisk[i][j];
38077 @@ -694,7 +694,7 @@ DBGINFO(
38078 for(i=0; i<NR_PRODUCTS; i++) {
38079 if (board_id == products[i].board_id) {
38080 c->product_name = products[i].product_name;
38081 - c->access = *(products[i].access);
38082 + c->access = products[i].access;
38083 break;
38084 }
38085 }
38086 @@ -792,7 +792,7 @@ static int cpqarray_eisa_detect(void)
38087 hba[ctlr]->intr = intr;
38088 sprintf(hba[ctlr]->devname, "ida%d", nr_ctlr);
38089 hba[ctlr]->product_name = products[j].product_name;
38090 - hba[ctlr]->access = *(products[j].access);
38091 + hba[ctlr]->access = products[j].access;
38092 hba[ctlr]->ctlr = ctlr;
38093 hba[ctlr]->board_id = board_id;
38094 hba[ctlr]->pci_dev = NULL; /* not PCI */
38095 @@ -978,7 +978,7 @@ static void start_io(ctlr_info_t *h)
38096
38097 while((c = h->reqQ) != NULL) {
38098 /* Can't do anything if we're busy */
38099 - if (h->access.fifo_full(h) == 0)
38100 + if (h->access->fifo_full(h) == 0)
38101 return;
38102
38103 /* Get the first entry from the request Q */
38104 @@ -986,7 +986,7 @@ static void start_io(ctlr_info_t *h)
38105 h->Qdepth--;
38106
38107 /* Tell the controller to do our bidding */
38108 - h->access.submit_command(h, c);
38109 + h->access->submit_command(h, c);
38110
38111 /* Get onto the completion Q */
38112 addQ(&h->cmpQ, c);
38113 @@ -1048,7 +1048,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
38114 unsigned long flags;
38115 __u32 a,a1;
38116
38117 - istat = h->access.intr_pending(h);
38118 + istat = h->access->intr_pending(h);
38119 /* Is this interrupt for us? */
38120 if (istat == 0)
38121 return IRQ_NONE;
38122 @@ -1059,7 +1059,7 @@ static irqreturn_t do_ida_intr(int irq, void *dev_id)
38123 */
38124 spin_lock_irqsave(IDA_LOCK(h->ctlr), flags);
38125 if (istat & FIFO_NOT_EMPTY) {
38126 - while((a = h->access.command_completed(h))) {
38127 + while((a = h->access->command_completed(h))) {
38128 a1 = a; a &= ~3;
38129 if ((c = h->cmpQ) == NULL)
38130 {
38131 @@ -1448,11 +1448,11 @@ static int sendcmd(
38132 /*
38133 * Disable interrupt
38134 */
38135 - info_p->access.set_intr_mask(info_p, 0);
38136 + info_p->access->set_intr_mask(info_p, 0);
38137 /* Make sure there is room in the command FIFO */
38138 /* Actually it should be completely empty at this time. */
38139 for (i = 200000; i > 0; i--) {
38140 - temp = info_p->access.fifo_full(info_p);
38141 + temp = info_p->access->fifo_full(info_p);
38142 if (temp != 0) {
38143 break;
38144 }
38145 @@ -1465,7 +1465,7 @@ DBG(
38146 /*
38147 * Send the cmd
38148 */
38149 - info_p->access.submit_command(info_p, c);
38150 + info_p->access->submit_command(info_p, c);
38151 complete = pollcomplete(ctlr);
38152
38153 pci_unmap_single(info_p->pci_dev, (dma_addr_t) c->req.sg[0].addr,
38154 @@ -1548,9 +1548,9 @@ static int revalidate_allvol(ctlr_info_t *host)
38155 * we check the new geometry. Then turn interrupts back on when
38156 * we're done.
38157 */
38158 - host->access.set_intr_mask(host, 0);
38159 + host->access->set_intr_mask(host, 0);
38160 getgeometry(ctlr);
38161 - host->access.set_intr_mask(host, FIFO_NOT_EMPTY);
38162 + host->access->set_intr_mask(host, FIFO_NOT_EMPTY);
38163
38164 for(i=0; i<NWD; i++) {
38165 struct gendisk *disk = ida_gendisk[ctlr][i];
38166 @@ -1590,7 +1590,7 @@ static int pollcomplete(int ctlr)
38167 /* Wait (up to 2 seconds) for a command to complete */
38168
38169 for (i = 200000; i > 0; i--) {
38170 - done = hba[ctlr]->access.command_completed(hba[ctlr]);
38171 + done = hba[ctlr]->access->command_completed(hba[ctlr]);
38172 if (done == 0) {
38173 udelay(10); /* a short fixed delay */
38174 } else
38175 diff --git a/drivers/block/cpqarray.h b/drivers/block/cpqarray.h
38176 index be73e9d..7fbf140 100644
38177 --- a/drivers/block/cpqarray.h
38178 +++ b/drivers/block/cpqarray.h
38179 @@ -99,7 +99,7 @@ struct ctlr_info {
38180 drv_info_t drv[NWD];
38181 struct proc_dir_entry *proc;
38182
38183 - struct access_method access;
38184 + struct access_method *access;
38185
38186 cmdlist_t *reqQ;
38187 cmdlist_t *cmpQ;
38188 diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h
38189 index 0e06f0c..c47b81d 100644
38190 --- a/drivers/block/drbd/drbd_int.h
38191 +++ b/drivers/block/drbd/drbd_int.h
38192 @@ -582,7 +582,7 @@ struct drbd_epoch {
38193 struct drbd_tconn *tconn;
38194 struct list_head list;
38195 unsigned int barrier_nr;
38196 - atomic_t epoch_size; /* increased on every request added. */
38197 + atomic_unchecked_t epoch_size; /* increased on every request added. */
38198 atomic_t active; /* increased on every req. added, and dec on every finished. */
38199 unsigned long flags;
38200 };
38201 @@ -1022,7 +1022,7 @@ struct drbd_conf {
38202 unsigned int al_tr_number;
38203 int al_tr_cycle;
38204 wait_queue_head_t seq_wait;
38205 - atomic_t packet_seq;
38206 + atomic_unchecked_t packet_seq;
38207 unsigned int peer_seq;
38208 spinlock_t peer_seq_lock;
38209 unsigned int minor;
38210 @@ -1573,7 +1573,7 @@ static inline int drbd_setsockopt(struct socket *sock, int level, int optname,
38211 char __user *uoptval;
38212 int err;
38213
38214 - uoptval = (char __user __force *)optval;
38215 + uoptval = (char __force_user *)optval;
38216
38217 set_fs(KERNEL_DS);
38218 if (level == SOL_SOCKET)
38219 diff --git a/drivers/block/drbd/drbd_interval.c b/drivers/block/drbd/drbd_interval.c
38220 index 89c497c..9c736ae 100644
38221 --- a/drivers/block/drbd/drbd_interval.c
38222 +++ b/drivers/block/drbd/drbd_interval.c
38223 @@ -67,9 +67,9 @@ static void augment_rotate(struct rb_node *rb_old, struct rb_node *rb_new)
38224 }
38225
38226 static const struct rb_augment_callbacks augment_callbacks = {
38227 - augment_propagate,
38228 - augment_copy,
38229 - augment_rotate,
38230 + .propagate = augment_propagate,
38231 + .copy = augment_copy,
38232 + .rotate = augment_rotate,
38233 };
38234
38235 /**
38236 diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
38237 index 929468e..7d934eb 100644
38238 --- a/drivers/block/drbd/drbd_main.c
38239 +++ b/drivers/block/drbd/drbd_main.c
38240 @@ -1317,7 +1317,7 @@ static int _drbd_send_ack(struct drbd_conf *mdev, enum drbd_packet cmd,
38241 p->sector = sector;
38242 p->block_id = block_id;
38243 p->blksize = blksize;
38244 - p->seq_num = cpu_to_be32(atomic_inc_return(&mdev->packet_seq));
38245 + p->seq_num = cpu_to_be32(atomic_inc_return_unchecked(&mdev->packet_seq));
38246 return drbd_send_command(mdev, sock, cmd, sizeof(*p), NULL, 0);
38247 }
38248
38249 @@ -1622,7 +1622,7 @@ int drbd_send_dblock(struct drbd_conf *mdev, struct drbd_request *req)
38250 return -EIO;
38251 p->sector = cpu_to_be64(req->i.sector);
38252 p->block_id = (unsigned long)req;
38253 - p->seq_num = cpu_to_be32(atomic_inc_return(&mdev->packet_seq));
38254 + p->seq_num = cpu_to_be32(atomic_inc_return_unchecked(&mdev->packet_seq));
38255 dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
38256 if (mdev->state.conn >= C_SYNC_SOURCE &&
38257 mdev->state.conn <= C_PAUSED_SYNC_T)
38258 @@ -2577,8 +2577,8 @@ void conn_destroy(struct kref *kref)
38259 {
38260 struct drbd_tconn *tconn = container_of(kref, struct drbd_tconn, kref);
38261
38262 - if (atomic_read(&tconn->current_epoch->epoch_size) != 0)
38263 - conn_err(tconn, "epoch_size:%d\n", atomic_read(&tconn->current_epoch->epoch_size));
38264 + if (atomic_read_unchecked(&tconn->current_epoch->epoch_size) != 0)
38265 + conn_err(tconn, "epoch_size:%d\n", atomic_read_unchecked(&tconn->current_epoch->epoch_size));
38266 kfree(tconn->current_epoch);
38267
38268 idr_destroy(&tconn->volumes);
38269 diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
38270 index c706d50..5e1b472 100644
38271 --- a/drivers/block/drbd/drbd_nl.c
38272 +++ b/drivers/block/drbd/drbd_nl.c
38273 @@ -3440,7 +3440,7 @@ out:
38274
38275 void drbd_bcast_event(struct drbd_conf *mdev, const struct sib_info *sib)
38276 {
38277 - static atomic_t drbd_genl_seq = ATOMIC_INIT(2); /* two. */
38278 + static atomic_unchecked_t drbd_genl_seq = ATOMIC_INIT(2); /* two. */
38279 struct sk_buff *msg;
38280 struct drbd_genlmsghdr *d_out;
38281 unsigned seq;
38282 @@ -3453,7 +3453,7 @@ void drbd_bcast_event(struct drbd_conf *mdev, const struct sib_info *sib)
38283 return;
38284 }
38285
38286 - seq = atomic_inc_return(&drbd_genl_seq);
38287 + seq = atomic_inc_return_unchecked(&drbd_genl_seq);
38288 msg = genlmsg_new(NLMSG_GOODSIZE, GFP_NOIO);
38289 if (!msg)
38290 goto failed;
38291 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
38292 index d073305..4998fea 100644
38293 --- a/drivers/block/drbd/drbd_receiver.c
38294 +++ b/drivers/block/drbd/drbd_receiver.c
38295 @@ -834,7 +834,7 @@ int drbd_connected(struct drbd_conf *mdev)
38296 {
38297 int err;
38298
38299 - atomic_set(&mdev->packet_seq, 0);
38300 + atomic_set_unchecked(&mdev->packet_seq, 0);
38301 mdev->peer_seq = 0;
38302
38303 mdev->state_mutex = mdev->tconn->agreed_pro_version < 100 ?
38304 @@ -1193,7 +1193,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_tconn *tconn,
38305 do {
38306 next_epoch = NULL;
38307
38308 - epoch_size = atomic_read(&epoch->epoch_size);
38309 + epoch_size = atomic_read_unchecked(&epoch->epoch_size);
38310
38311 switch (ev & ~EV_CLEANUP) {
38312 case EV_PUT:
38313 @@ -1233,7 +1233,7 @@ static enum finish_epoch drbd_may_finish_epoch(struct drbd_tconn *tconn,
38314 rv = FE_DESTROYED;
38315 } else {
38316 epoch->flags = 0;
38317 - atomic_set(&epoch->epoch_size, 0);
38318 + atomic_set_unchecked(&epoch->epoch_size, 0);
38319 /* atomic_set(&epoch->active, 0); is already zero */
38320 if (rv == FE_STILL_LIVE)
38321 rv = FE_RECYCLED;
38322 @@ -1451,7 +1451,7 @@ static int receive_Barrier(struct drbd_tconn *tconn, struct packet_info *pi)
38323 conn_wait_active_ee_empty(tconn);
38324 drbd_flush(tconn);
38325
38326 - if (atomic_read(&tconn->current_epoch->epoch_size)) {
38327 + if (atomic_read_unchecked(&tconn->current_epoch->epoch_size)) {
38328 epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
38329 if (epoch)
38330 break;
38331 @@ -1464,11 +1464,11 @@ static int receive_Barrier(struct drbd_tconn *tconn, struct packet_info *pi)
38332 }
38333
38334 epoch->flags = 0;
38335 - atomic_set(&epoch->epoch_size, 0);
38336 + atomic_set_unchecked(&epoch->epoch_size, 0);
38337 atomic_set(&epoch->active, 0);
38338
38339 spin_lock(&tconn->epoch_lock);
38340 - if (atomic_read(&tconn->current_epoch->epoch_size)) {
38341 + if (atomic_read_unchecked(&tconn->current_epoch->epoch_size)) {
38342 list_add(&epoch->list, &tconn->current_epoch->list);
38343 tconn->current_epoch = epoch;
38344 tconn->epochs++;
38345 @@ -2164,7 +2164,7 @@ static int receive_Data(struct drbd_tconn *tconn, struct packet_info *pi)
38346
38347 err = wait_for_and_update_peer_seq(mdev, peer_seq);
38348 drbd_send_ack_dp(mdev, P_NEG_ACK, p, pi->size);
38349 - atomic_inc(&tconn->current_epoch->epoch_size);
38350 + atomic_inc_unchecked(&tconn->current_epoch->epoch_size);
38351 err2 = drbd_drain_block(mdev, pi->size);
38352 if (!err)
38353 err = err2;
38354 @@ -2198,7 +2198,7 @@ static int receive_Data(struct drbd_tconn *tconn, struct packet_info *pi)
38355
38356 spin_lock(&tconn->epoch_lock);
38357 peer_req->epoch = tconn->current_epoch;
38358 - atomic_inc(&peer_req->epoch->epoch_size);
38359 + atomic_inc_unchecked(&peer_req->epoch->epoch_size);
38360 atomic_inc(&peer_req->epoch->active);
38361 spin_unlock(&tconn->epoch_lock);
38362
38363 @@ -4345,7 +4345,7 @@ struct data_cmd {
38364 int expect_payload;
38365 size_t pkt_size;
38366 int (*fn)(struct drbd_tconn *, struct packet_info *);
38367 -};
38368 +} __do_const;
38369
38370 static struct data_cmd drbd_cmd_handler[] = {
38371 [P_DATA] = { 1, sizeof(struct p_data), receive_Data },
38372 @@ -4465,7 +4465,7 @@ static void conn_disconnect(struct drbd_tconn *tconn)
38373 if (!list_empty(&tconn->current_epoch->list))
38374 conn_err(tconn, "ASSERTION FAILED: tconn->current_epoch->list not empty\n");
38375 /* ok, no more ee's on the fly, it is safe to reset the epoch_size */
38376 - atomic_set(&tconn->current_epoch->epoch_size, 0);
38377 + atomic_set_unchecked(&tconn->current_epoch->epoch_size, 0);
38378 tconn->send.seen_any_write_yet = false;
38379
38380 conn_info(tconn, "Connection closed\n");
38381 @@ -5221,7 +5221,7 @@ static int tconn_finish_peer_reqs(struct drbd_tconn *tconn)
38382 struct asender_cmd {
38383 size_t pkt_size;
38384 int (*fn)(struct drbd_tconn *tconn, struct packet_info *);
38385 -};
38386 +} __do_const;
38387
38388 static struct asender_cmd asender_tbl[] = {
38389 [P_PING] = { 0, got_Ping },
38390 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
38391 index 66e8c3b..9b68dd9 100644
38392 --- a/drivers/block/loop.c
38393 +++ b/drivers/block/loop.c
38394 @@ -232,7 +232,7 @@ static int __do_lo_send_write(struct file *file,
38395
38396 file_start_write(file);
38397 set_fs(get_ds());
38398 - bw = file->f_op->write(file, buf, len, &pos);
38399 + bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos);
38400 set_fs(old_fs);
38401 file_end_write(file);
38402 if (likely(bw == len))
38403 diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
38404 index 091b9ea..f5428f8 100644
38405 --- a/drivers/block/null_blk.c
38406 +++ b/drivers/block/null_blk.c
38407 @@ -382,15 +382,25 @@ static int null_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
38408 return 0;
38409 }
38410
38411 -static struct blk_mq_ops null_mq_ops = {
38412 - .queue_rq = null_queue_rq,
38413 - .map_queue = blk_mq_map_queue,
38414 +static struct blk_mq_ops null_mq_single_ops = {
38415 + .queue_rq = null_queue_rq,
38416 + .map_queue = blk_mq_map_queue,
38417 .init_hctx = null_init_hctx,
38418 .complete = null_softirq_done_fn,
38419 + .alloc_hctx = blk_mq_alloc_single_hw_queue,
38420 + .free_hctx = blk_mq_free_single_hw_queue,
38421 +};
38422 +
38423 +static struct blk_mq_ops null_mq_per_node_ops = {
38424 + .queue_rq = null_queue_rq,
38425 + .map_queue = blk_mq_map_queue,
38426 + .init_hctx = null_init_hctx,
38427 + .alloc_hctx = null_alloc_hctx,
38428 + .free_hctx = null_free_hctx,
38429 };
38430
38431 static struct blk_mq_reg null_mq_reg = {
38432 - .ops = &null_mq_ops,
38433 + .ops = &null_mq_single_ops,
38434 .queue_depth = 64,
38435 .cmd_size = sizeof(struct nullb_cmd),
38436 .flags = BLK_MQ_F_SHOULD_MERGE,
38437 @@ -521,13 +531,8 @@ static int null_add_dev(void)
38438 null_mq_reg.queue_depth = hw_queue_depth;
38439 null_mq_reg.nr_hw_queues = submit_queues;
38440
38441 - if (use_per_node_hctx) {
38442 - null_mq_reg.ops->alloc_hctx = null_alloc_hctx;
38443 - null_mq_reg.ops->free_hctx = null_free_hctx;
38444 - } else {
38445 - null_mq_reg.ops->alloc_hctx = blk_mq_alloc_single_hw_queue;
38446 - null_mq_reg.ops->free_hctx = blk_mq_free_single_hw_queue;
38447 - }
38448 + if (use_per_node_hctx)
38449 + null_mq_reg.ops = &null_mq_per_node_ops;
38450
38451 nullb->q = blk_mq_init_queue(&null_mq_reg, nullb);
38452 } else if (queue_mode == NULL_Q_BIO) {
38453 diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
38454 index a2af73d..c0b8f61 100644
38455 --- a/drivers/block/pktcdvd.c
38456 +++ b/drivers/block/pktcdvd.c
38457 @@ -108,7 +108,7 @@ static int pkt_seq_show(struct seq_file *m, void *p);
38458
38459 static sector_t get_zone(sector_t sector, struct pktcdvd_device *pd)
38460 {
38461 - return (sector + pd->offset) & ~(sector_t)(pd->settings.size - 1);
38462 + return (sector + pd->offset) & ~(sector_t)(pd->settings.size - 1UL);
38463 }
38464
38465 /*
38466 @@ -1888,7 +1888,7 @@ static noinline_for_stack int pkt_probe_settings(struct pktcdvd_device *pd)
38467 return -EROFS;
38468 }
38469 pd->settings.fp = ti.fp;
38470 - pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1);
38471 + pd->offset = (be32_to_cpu(ti.track_start) << 2) & (pd->settings.size - 1UL);
38472
38473 if (ti.nwa_v) {
38474 pd->nwa = be32_to_cpu(ti.next_writable);
38475 diff --git a/drivers/block/smart1,2.h b/drivers/block/smart1,2.h
38476 index e5565fb..71be10b4 100644
38477 --- a/drivers/block/smart1,2.h
38478 +++ b/drivers/block/smart1,2.h
38479 @@ -108,11 +108,11 @@ static unsigned long smart4_intr_pending(ctlr_info_t *h)
38480 }
38481
38482 static struct access_method smart4_access = {
38483 - smart4_submit_command,
38484 - smart4_intr_mask,
38485 - smart4_fifo_full,
38486 - smart4_intr_pending,
38487 - smart4_completed,
38488 + .submit_command = smart4_submit_command,
38489 + .set_intr_mask = smart4_intr_mask,
38490 + .fifo_full = smart4_fifo_full,
38491 + .intr_pending = smart4_intr_pending,
38492 + .command_completed = smart4_completed,
38493 };
38494
38495 /*
38496 @@ -144,11 +144,11 @@ static unsigned long smart2_intr_pending(ctlr_info_t *h)
38497 }
38498
38499 static struct access_method smart2_access = {
38500 - smart2_submit_command,
38501 - smart2_intr_mask,
38502 - smart2_fifo_full,
38503 - smart2_intr_pending,
38504 - smart2_completed,
38505 + .submit_command = smart2_submit_command,
38506 + .set_intr_mask = smart2_intr_mask,
38507 + .fifo_full = smart2_fifo_full,
38508 + .intr_pending = smart2_intr_pending,
38509 + .command_completed = smart2_completed,
38510 };
38511
38512 /*
38513 @@ -180,11 +180,11 @@ static unsigned long smart2e_intr_pending(ctlr_info_t *h)
38514 }
38515
38516 static struct access_method smart2e_access = {
38517 - smart2e_submit_command,
38518 - smart2e_intr_mask,
38519 - smart2e_fifo_full,
38520 - smart2e_intr_pending,
38521 - smart2e_completed,
38522 + .submit_command = smart2e_submit_command,
38523 + .set_intr_mask = smart2e_intr_mask,
38524 + .fifo_full = smart2e_fifo_full,
38525 + .intr_pending = smart2e_intr_pending,
38526 + .command_completed = smart2e_completed,
38527 };
38528
38529 /*
38530 @@ -270,9 +270,9 @@ static unsigned long smart1_intr_pending(ctlr_info_t *h)
38531 }
38532
38533 static struct access_method smart1_access = {
38534 - smart1_submit_command,
38535 - smart1_intr_mask,
38536 - smart1_fifo_full,
38537 - smart1_intr_pending,
38538 - smart1_completed,
38539 + .submit_command = smart1_submit_command,
38540 + .set_intr_mask = smart1_intr_mask,
38541 + .fifo_full = smart1_fifo_full,
38542 + .intr_pending = smart1_intr_pending,
38543 + .command_completed = smart1_completed,
38544 };
38545 diff --git a/drivers/bluetooth/btwilink.c b/drivers/bluetooth/btwilink.c
38546 index f038dba..bb74c08 100644
38547 --- a/drivers/bluetooth/btwilink.c
38548 +++ b/drivers/bluetooth/btwilink.c
38549 @@ -288,7 +288,7 @@ static int ti_st_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
38550
38551 static int bt_ti_probe(struct platform_device *pdev)
38552 {
38553 - static struct ti_st *hst;
38554 + struct ti_st *hst;
38555 struct hci_dev *hdev;
38556 int err;
38557
38558 diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
38559 index 8a3aff7..d7538c2 100644
38560 --- a/drivers/cdrom/cdrom.c
38561 +++ b/drivers/cdrom/cdrom.c
38562 @@ -416,7 +416,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
38563 ENSURE(reset, CDC_RESET);
38564 ENSURE(generic_packet, CDC_GENERIC_PACKET);
38565 cdi->mc_flags = 0;
38566 - cdo->n_minors = 0;
38567 cdi->options = CDO_USE_FFLAGS;
38568
38569 if (autoclose==1 && CDROM_CAN(CDC_CLOSE_TRAY))
38570 @@ -436,8 +435,11 @@ int register_cdrom(struct cdrom_device_info *cdi)
38571 else
38572 cdi->cdda_method = CDDA_OLD;
38573
38574 - if (!cdo->generic_packet)
38575 - cdo->generic_packet = cdrom_dummy_generic_packet;
38576 + if (!cdo->generic_packet) {
38577 + pax_open_kernel();
38578 + *(void **)&cdo->generic_packet = cdrom_dummy_generic_packet;
38579 + pax_close_kernel();
38580 + }
38581
38582 cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" registered\n", cdi->name);
38583 mutex_lock(&cdrom_mutex);
38584 @@ -458,7 +460,6 @@ void unregister_cdrom(struct cdrom_device_info *cdi)
38585 if (cdi->exit)
38586 cdi->exit(cdi);
38587
38588 - cdi->ops->n_minors--;
38589 cdinfo(CD_REG_UNREG, "drive \"/dev/%s\" unregistered\n", cdi->name);
38590 }
38591
38592 @@ -2107,7 +2108,7 @@ static int cdrom_read_cdda_old(struct cdrom_device_info *cdi, __u8 __user *ubuf,
38593 */
38594 nr = nframes;
38595 do {
38596 - cgc.buffer = kmalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
38597 + cgc.buffer = kzalloc(CD_FRAMESIZE_RAW * nr, GFP_KERNEL);
38598 if (cgc.buffer)
38599 break;
38600
38601 @@ -3429,7 +3430,7 @@ static int cdrom_print_info(const char *header, int val, char *info,
38602 struct cdrom_device_info *cdi;
38603 int ret;
38604
38605 - ret = scnprintf(info + *pos, max_size - *pos, header);
38606 + ret = scnprintf(info + *pos, max_size - *pos, "%s", header);
38607 if (!ret)
38608 return 1;
38609
38610 diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c
38611 index 51e75ad..39c4c76 100644
38612 --- a/drivers/cdrom/gdrom.c
38613 +++ b/drivers/cdrom/gdrom.c
38614 @@ -491,7 +491,6 @@ static struct cdrom_device_ops gdrom_ops = {
38615 .audio_ioctl = gdrom_audio_ioctl,
38616 .capability = CDC_MULTI_SESSION | CDC_MEDIA_CHANGED |
38617 CDC_RESET | CDC_DRIVE_STATUS | CDC_CD_R,
38618 - .n_minors = 1,
38619 };
38620
38621 static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode)
38622 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
38623 index 1386749..5430258 100644
38624 --- a/drivers/char/Kconfig
38625 +++ b/drivers/char/Kconfig
38626 @@ -8,7 +8,8 @@ source "drivers/tty/Kconfig"
38627
38628 config DEVKMEM
38629 bool "/dev/kmem virtual device support"
38630 - default y
38631 + default n
38632 + depends on !GRKERNSEC_KMEM
38633 help
38634 Say Y here if you want to support the /dev/kmem device. The
38635 /dev/kmem device is rarely used, but can be used for certain
38636 @@ -577,6 +578,7 @@ config DEVPORT
38637 bool
38638 depends on !M68K
38639 depends on ISA || PCI
38640 + depends on !GRKERNSEC_KMEM
38641 default y
38642
38643 source "drivers/s390/char/Kconfig"
38644 diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
38645 index a48e05b..6bac831 100644
38646 --- a/drivers/char/agp/compat_ioctl.c
38647 +++ b/drivers/char/agp/compat_ioctl.c
38648 @@ -108,7 +108,7 @@ static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user
38649 return -ENOMEM;
38650 }
38651
38652 - if (copy_from_user(usegment, (void __user *) ureserve.seg_list,
38653 + if (copy_from_user(usegment, (void __force_user *) ureserve.seg_list,
38654 sizeof(*usegment) * ureserve.seg_count)) {
38655 kfree(usegment);
38656 kfree(ksegment);
38657 diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
38658 index 1b19239..963967b 100644
38659 --- a/drivers/char/agp/frontend.c
38660 +++ b/drivers/char/agp/frontend.c
38661 @@ -731,6 +731,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
38662
38663 agp_copy_info(agp_bridge, &kerninfo);
38664
38665 + memset(&userinfo, 0, sizeof(userinfo));
38666 userinfo.version.major = kerninfo.version.major;
38667 userinfo.version.minor = kerninfo.version.minor;
38668 userinfo.bridge_id = kerninfo.device->vendor |
38669 @@ -819,7 +820,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
38670 if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
38671 return -EFAULT;
38672
38673 - if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
38674 + if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
38675 return -EFAULT;
38676
38677 client = agp_find_client_by_pid(reserve.pid);
38678 @@ -849,7 +850,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
38679 if (segment == NULL)
38680 return -ENOMEM;
38681
38682 - if (copy_from_user(segment, (void __user *) reserve.seg_list,
38683 + if (copy_from_user(segment, (void __force_user *) reserve.seg_list,
38684 sizeof(struct agp_segment) * reserve.seg_count)) {
38685 kfree(segment);
38686 return -EFAULT;
38687 diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
38688 index 4f94375..413694e 100644
38689 --- a/drivers/char/genrtc.c
38690 +++ b/drivers/char/genrtc.c
38691 @@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *file,
38692 switch (cmd) {
38693
38694 case RTC_PLL_GET:
38695 + memset(&pll, 0, sizeof(pll));
38696 if (get_rtc_pll(&pll))
38697 return -EINVAL;
38698 else
38699 diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
38700 index d5d4cd8..22d561d 100644
38701 --- a/drivers/char/hpet.c
38702 +++ b/drivers/char/hpet.c
38703 @@ -575,7 +575,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
38704 }
38705
38706 static int
38707 -hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg,
38708 +hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg,
38709 struct hpet_info *info)
38710 {
38711 struct hpet_timer __iomem *timer;
38712 diff --git a/drivers/char/hw_random/intel-rng.c b/drivers/char/hw_random/intel-rng.c
38713 index 86fe45c..c0ea948 100644
38714 --- a/drivers/char/hw_random/intel-rng.c
38715 +++ b/drivers/char/hw_random/intel-rng.c
38716 @@ -314,7 +314,7 @@ PFX "RNG, try using the 'no_fwh_detect' option.\n";
38717
38718 if (no_fwh_detect)
38719 return -ENODEV;
38720 - printk(warning);
38721 + printk("%s", warning);
38722 return -EBUSY;
38723 }
38724
38725 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
38726 index ec4e10f..f2a763b 100644
38727 --- a/drivers/char/ipmi/ipmi_msghandler.c
38728 +++ b/drivers/char/ipmi/ipmi_msghandler.c
38729 @@ -420,7 +420,7 @@ struct ipmi_smi {
38730 struct proc_dir_entry *proc_dir;
38731 char proc_dir_name[10];
38732
38733 - atomic_t stats[IPMI_NUM_STATS];
38734 + atomic_unchecked_t stats[IPMI_NUM_STATS];
38735
38736 /*
38737 * run_to_completion duplicate of smb_info, smi_info
38738 @@ -453,9 +453,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
38739
38740
38741 #define ipmi_inc_stat(intf, stat) \
38742 - atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
38743 + atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
38744 #define ipmi_get_stat(intf, stat) \
38745 - ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
38746 + ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
38747
38748 static int is_lan_addr(struct ipmi_addr *addr)
38749 {
38750 @@ -2883,7 +2883,7 @@ int ipmi_register_smi(struct ipmi_smi_handlers *handlers,
38751 INIT_LIST_HEAD(&intf->cmd_rcvrs);
38752 init_waitqueue_head(&intf->waitq);
38753 for (i = 0; i < IPMI_NUM_STATS; i++)
38754 - atomic_set(&intf->stats[i], 0);
38755 + atomic_set_unchecked(&intf->stats[i], 0);
38756
38757 intf->proc_dir = NULL;
38758
38759 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
38760 index 03f4189..e79f5e0 100644
38761 --- a/drivers/char/ipmi/ipmi_si_intf.c
38762 +++ b/drivers/char/ipmi/ipmi_si_intf.c
38763 @@ -280,7 +280,7 @@ struct smi_info {
38764 unsigned char slave_addr;
38765
38766 /* Counters and things for the proc filesystem. */
38767 - atomic_t stats[SI_NUM_STATS];
38768 + atomic_unchecked_t stats[SI_NUM_STATS];
38769
38770 struct task_struct *thread;
38771
38772 @@ -289,9 +289,9 @@ struct smi_info {
38773 };
38774
38775 #define smi_inc_stat(smi, stat) \
38776 - atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
38777 + atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
38778 #define smi_get_stat(smi, stat) \
38779 - ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
38780 + ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
38781
38782 #define SI_MAX_PARMS 4
38783
38784 @@ -3339,7 +3339,7 @@ static int try_smi_init(struct smi_info *new_smi)
38785 atomic_set(&new_smi->req_events, 0);
38786 new_smi->run_to_completion = 0;
38787 for (i = 0; i < SI_NUM_STATS; i++)
38788 - atomic_set(&new_smi->stats[i], 0);
38789 + atomic_set_unchecked(&new_smi->stats[i], 0);
38790
38791 new_smi->interrupt_disabled = 1;
38792 atomic_set(&new_smi->stop_operation, 0);
38793 diff --git a/drivers/char/mem.c b/drivers/char/mem.c
38794 index 92c5937..1be4e4d 100644
38795 --- a/drivers/char/mem.c
38796 +++ b/drivers/char/mem.c
38797 @@ -18,6 +18,7 @@
38798 #include <linux/raw.h>
38799 #include <linux/tty.h>
38800 #include <linux/capability.h>
38801 +#include <linux/security.h>
38802 #include <linux/ptrace.h>
38803 #include <linux/device.h>
38804 #include <linux/highmem.h>
38805 @@ -36,6 +37,10 @@
38806
38807 #define DEVPORT_MINOR 4
38808
38809 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
38810 +extern const struct file_operations grsec_fops;
38811 +#endif
38812 +
38813 static inline unsigned long size_inside_page(unsigned long start,
38814 unsigned long size)
38815 {
38816 @@ -67,9 +72,13 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
38817
38818 while (cursor < to) {
38819 if (!devmem_is_allowed(pfn)) {
38820 +#ifdef CONFIG_GRKERNSEC_KMEM
38821 + gr_handle_mem_readwrite(from, to);
38822 +#else
38823 printk(KERN_INFO
38824 "Program %s tried to access /dev/mem between %Lx->%Lx.\n",
38825 current->comm, from, to);
38826 +#endif
38827 return 0;
38828 }
38829 cursor += PAGE_SIZE;
38830 @@ -77,6 +86,11 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
38831 }
38832 return 1;
38833 }
38834 +#elif defined(CONFIG_GRKERNSEC_KMEM)
38835 +static inline int range_is_allowed(unsigned long pfn, unsigned long size)
38836 +{
38837 + return 0;
38838 +}
38839 #else
38840 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
38841 {
38842 @@ -119,6 +133,7 @@ static ssize_t read_mem(struct file *file, char __user *buf,
38843
38844 while (count > 0) {
38845 unsigned long remaining;
38846 + char *temp;
38847
38848 sz = size_inside_page(p, count);
38849
38850 @@ -134,7 +149,23 @@ static ssize_t read_mem(struct file *file, char __user *buf,
38851 if (!ptr)
38852 return -EFAULT;
38853
38854 - remaining = copy_to_user(buf, ptr, sz);
38855 +#ifdef CONFIG_PAX_USERCOPY
38856 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
38857 + if (!temp) {
38858 + unxlate_dev_mem_ptr(p, ptr);
38859 + return -ENOMEM;
38860 + }
38861 + memcpy(temp, ptr, sz);
38862 +#else
38863 + temp = ptr;
38864 +#endif
38865 +
38866 + remaining = copy_to_user(buf, temp, sz);
38867 +
38868 +#ifdef CONFIG_PAX_USERCOPY
38869 + kfree(temp);
38870 +#endif
38871 +
38872 unxlate_dev_mem_ptr(p, ptr);
38873 if (remaining)
38874 return -EFAULT;
38875 @@ -363,9 +394,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
38876 size_t count, loff_t *ppos)
38877 {
38878 unsigned long p = *ppos;
38879 - ssize_t low_count, read, sz;
38880 + ssize_t low_count, read, sz, err = 0;
38881 char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
38882 - int err = 0;
38883
38884 read = 0;
38885 if (p < (unsigned long) high_memory) {
38886 @@ -387,6 +417,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
38887 }
38888 #endif
38889 while (low_count > 0) {
38890 + char *temp;
38891 +
38892 sz = size_inside_page(p, low_count);
38893
38894 /*
38895 @@ -396,7 +428,22 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
38896 */
38897 kbuf = xlate_dev_kmem_ptr((char *)p);
38898
38899 - if (copy_to_user(buf, kbuf, sz))
38900 +#ifdef CONFIG_PAX_USERCOPY
38901 + temp = kmalloc(sz, GFP_KERNEL|GFP_USERCOPY);
38902 + if (!temp)
38903 + return -ENOMEM;
38904 + memcpy(temp, kbuf, sz);
38905 +#else
38906 + temp = kbuf;
38907 +#endif
38908 +
38909 + err = copy_to_user(buf, temp, sz);
38910 +
38911 +#ifdef CONFIG_PAX_USERCOPY
38912 + kfree(temp);
38913 +#endif
38914 +
38915 + if (err)
38916 return -EFAULT;
38917 buf += sz;
38918 p += sz;
38919 @@ -821,6 +868,9 @@ static const struct memdev {
38920 #ifdef CONFIG_PRINTK
38921 [11] = { "kmsg", 0644, &kmsg_fops, NULL },
38922 #endif
38923 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
38924 + [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
38925 +#endif
38926 };
38927
38928 static int memory_open(struct inode *inode, struct file *filp)
38929 @@ -892,7 +942,7 @@ static int __init chr_dev_init(void)
38930 continue;
38931
38932 device_create(mem_class, NULL, MKDEV(MEM_MAJOR, minor),
38933 - NULL, devlist[minor].name);
38934 + NULL, "%s", devlist[minor].name);
38935 }
38936
38937 return tty_init();
38938 diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
38939 index 9df78e2..01ba9ae 100644
38940 --- a/drivers/char/nvram.c
38941 +++ b/drivers/char/nvram.c
38942 @@ -247,7 +247,7 @@ static ssize_t nvram_read(struct file *file, char __user *buf,
38943
38944 spin_unlock_irq(&rtc_lock);
38945
38946 - if (copy_to_user(buf, contents, tmp - contents))
38947 + if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
38948 return -EFAULT;
38949
38950 *ppos = i;
38951 diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
38952 index 8320abd..ec48108 100644
38953 --- a/drivers/char/pcmcia/synclink_cs.c
38954 +++ b/drivers/char/pcmcia/synclink_cs.c
38955 @@ -2345,9 +2345,9 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
38956
38957 if (debug_level >= DEBUG_LEVEL_INFO)
38958 printk("%s(%d):mgslpc_close(%s) entry, count=%d\n",
38959 - __FILE__, __LINE__, info->device_name, port->count);
38960 + __FILE__, __LINE__, info->device_name, atomic_read(&port->count));
38961
38962 - WARN_ON(!port->count);
38963 + WARN_ON(!atomic_read(&port->count));
38964
38965 if (tty_port_close_start(port, tty, filp) == 0)
38966 goto cleanup;
38967 @@ -2365,7 +2365,7 @@ static void mgslpc_close(struct tty_struct *tty, struct file * filp)
38968 cleanup:
38969 if (debug_level >= DEBUG_LEVEL_INFO)
38970 printk("%s(%d):mgslpc_close(%s) exit, count=%d\n", __FILE__, __LINE__,
38971 - tty->driver->name, port->count);
38972 + tty->driver->name, atomic_read(&port->count));
38973 }
38974
38975 /* Wait until the transmitter is empty.
38976 @@ -2507,7 +2507,7 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
38977
38978 if (debug_level >= DEBUG_LEVEL_INFO)
38979 printk("%s(%d):mgslpc_open(%s), old ref count = %d\n",
38980 - __FILE__, __LINE__, tty->driver->name, port->count);
38981 + __FILE__, __LINE__, tty->driver->name, atomic_read(&port->count));
38982
38983 /* If port is closing, signal caller to try again */
38984 if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING){
38985 @@ -2527,11 +2527,11 @@ static int mgslpc_open(struct tty_struct *tty, struct file * filp)
38986 goto cleanup;
38987 }
38988 spin_lock(&port->lock);
38989 - port->count++;
38990 + atomic_inc(&port->count);
38991 spin_unlock(&port->lock);
38992 spin_unlock_irqrestore(&info->netlock, flags);
38993
38994 - if (port->count == 1) {
38995 + if (atomic_read(&port->count) == 1) {
38996 /* 1st open on this device, init hardware */
38997 retval = startup(info, tty);
38998 if (retval < 0)
38999 @@ -3920,7 +3920,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
39000 unsigned short new_crctype;
39001
39002 /* return error if TTY interface open */
39003 - if (info->port.count)
39004 + if (atomic_read(&info->port.count))
39005 return -EBUSY;
39006
39007 switch (encoding)
39008 @@ -4024,7 +4024,7 @@ static int hdlcdev_open(struct net_device *dev)
39009
39010 /* arbitrate between network and tty opens */
39011 spin_lock_irqsave(&info->netlock, flags);
39012 - if (info->port.count != 0 || info->netcount != 0) {
39013 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
39014 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
39015 spin_unlock_irqrestore(&info->netlock, flags);
39016 return -EBUSY;
39017 @@ -4114,7 +4114,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
39018 printk("%s:hdlcdev_ioctl(%s)\n", __FILE__, dev->name);
39019
39020 /* return error if TTY interface open */
39021 - if (info->port.count)
39022 + if (atomic_read(&info->port.count))
39023 return -EBUSY;
39024
39025 if (cmd != SIOCWANDEV)
39026 diff --git a/drivers/char/random.c b/drivers/char/random.c
39027 index 429b75b..a7f4145 100644
39028 --- a/drivers/char/random.c
39029 +++ b/drivers/char/random.c
39030 @@ -270,10 +270,17 @@
39031 /*
39032 * Configuration information
39033 */
39034 +#ifdef CONFIG_GRKERNSEC_RANDNET
39035 +#define INPUT_POOL_SHIFT 14
39036 +#define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
39037 +#define OUTPUT_POOL_SHIFT 12
39038 +#define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
39039 +#else
39040 #define INPUT_POOL_SHIFT 12
39041 #define INPUT_POOL_WORDS (1 << (INPUT_POOL_SHIFT-5))
39042 #define OUTPUT_POOL_SHIFT 10
39043 #define OUTPUT_POOL_WORDS (1 << (OUTPUT_POOL_SHIFT-5))
39044 +#endif
39045 #define SEC_XFER_SIZE 512
39046 #define EXTRACT_SIZE 10
39047
39048 @@ -284,9 +291,6 @@
39049 /*
39050 * To allow fractional bits to be tracked, the entropy_count field is
39051 * denominated in units of 1/8th bits.
39052 - *
39053 - * 2*(ENTROPY_SHIFT + log2(poolbits)) must <= 31, or the multiply in
39054 - * credit_entropy_bits() needs to be 64 bits wide.
39055 */
39056 #define ENTROPY_SHIFT 3
39057 #define ENTROPY_BITS(r) ((r)->entropy_count >> ENTROPY_SHIFT)
39058 @@ -361,12 +365,19 @@ static struct poolinfo {
39059 #define S(x) ilog2(x)+5, (x), (x)*4, (x)*32, (x) << (ENTROPY_SHIFT+5)
39060 int tap1, tap2, tap3, tap4, tap5;
39061 } poolinfo_table[] = {
39062 +#ifdef CONFIG_GRKERNSEC_RANDNET
39063 + /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
39064 + { S(512), 411, 308, 208, 104, 1 },
39065 + /* x^128 + x^104 + x^76 + x^51 + x^25 + x + 1 -- 105 */
39066 + { S(128), 104, 76, 51, 25, 1 },
39067 +#else
39068 /* was: x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 */
39069 /* x^128 + x^104 + x^76 + x^51 +x^25 + x + 1 */
39070 { S(128), 104, 76, 51, 25, 1 },
39071 /* was: x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 */
39072 /* x^32 + x^26 + x^19 + x^14 + x^7 + x + 1 */
39073 { S(32), 26, 19, 14, 7, 1 },
39074 +#endif
39075 #if 0
39076 /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1 -- 115 */
39077 { S(2048), 1638, 1231, 819, 411, 1 },
39078 @@ -433,9 +444,9 @@ struct entropy_store {
39079 };
39080
39081 static void push_to_pool(struct work_struct *work);
39082 -static __u32 input_pool_data[INPUT_POOL_WORDS];
39083 -static __u32 blocking_pool_data[OUTPUT_POOL_WORDS];
39084 -static __u32 nonblocking_pool_data[OUTPUT_POOL_WORDS];
39085 +static __u32 input_pool_data[INPUT_POOL_WORDS] __latent_entropy;
39086 +static __u32 blocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
39087 +static __u32 nonblocking_pool_data[OUTPUT_POOL_WORDS] __latent_entropy;
39088
39089 static struct entropy_store input_pool = {
39090 .poolinfo = &poolinfo_table[0],
39091 @@ -524,8 +535,8 @@ static void _mix_pool_bytes(struct entropy_store *r, const void *in,
39092 input_rotate = (input_rotate + (i ? 7 : 14)) & 31;
39093 }
39094
39095 - ACCESS_ONCE(r->input_rotate) = input_rotate;
39096 - ACCESS_ONCE(r->add_ptr) = i;
39097 + ACCESS_ONCE_RW(r->input_rotate) = input_rotate;
39098 + ACCESS_ONCE_RW(r->add_ptr) = i;
39099 smp_wmb();
39100
39101 if (out)
39102 @@ -632,7 +643,7 @@ retry:
39103 /* The +2 corresponds to the /4 in the denominator */
39104
39105 do {
39106 - unsigned int anfrac = min(pnfrac, pool_size/2);
39107 + u64 anfrac = min(pnfrac, pool_size/2);
39108 unsigned int add =
39109 ((pool_size - entropy_count)*anfrac*3) >> s;
39110
39111 @@ -1151,7 +1162,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
39112
39113 extract_buf(r, tmp);
39114 i = min_t(int, nbytes, EXTRACT_SIZE);
39115 - if (copy_to_user(buf, tmp, i)) {
39116 + if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
39117 ret = -EFAULT;
39118 break;
39119 }
39120 @@ -1507,7 +1518,7 @@ EXPORT_SYMBOL(generate_random_uuid);
39121 #include <linux/sysctl.h>
39122
39123 static int min_read_thresh = 8, min_write_thresh;
39124 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
39125 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
39126 static int max_write_thresh = INPUT_POOL_WORDS * 32;
39127 static char sysctl_bootid[16];
39128
39129 @@ -1523,7 +1534,7 @@ static char sysctl_bootid[16];
39130 static int proc_do_uuid(struct ctl_table *table, int write,
39131 void __user *buffer, size_t *lenp, loff_t *ppos)
39132 {
39133 - struct ctl_table fake_table;
39134 + ctl_table_no_const fake_table;
39135 unsigned char buf[64], tmp_uuid[16], *uuid;
39136
39137 uuid = table->data;
39138 @@ -1553,7 +1564,7 @@ static int proc_do_uuid(struct ctl_table *table, int write,
39139 static int proc_do_entropy(ctl_table *table, int write,
39140 void __user *buffer, size_t *lenp, loff_t *ppos)
39141 {
39142 - ctl_table fake_table;
39143 + ctl_table_no_const fake_table;
39144 int entropy_count;
39145
39146 entropy_count = *(int *)table->data >> ENTROPY_SHIFT;
39147 diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
39148 index 7cc1fe22..b602d6b 100644
39149 --- a/drivers/char/sonypi.c
39150 +++ b/drivers/char/sonypi.c
39151 @@ -54,6 +54,7 @@
39152
39153 #include <asm/uaccess.h>
39154 #include <asm/io.h>
39155 +#include <asm/local.h>
39156
39157 #include <linux/sonypi.h>
39158
39159 @@ -490,7 +491,7 @@ static struct sonypi_device {
39160 spinlock_t fifo_lock;
39161 wait_queue_head_t fifo_proc_list;
39162 struct fasync_struct *fifo_async;
39163 - int open_count;
39164 + local_t open_count;
39165 int model;
39166 struct input_dev *input_jog_dev;
39167 struct input_dev *input_key_dev;
39168 @@ -892,7 +893,7 @@ static int sonypi_misc_fasync(int fd, struct file *filp, int on)
39169 static int sonypi_misc_release(struct inode *inode, struct file *file)
39170 {
39171 mutex_lock(&sonypi_device.lock);
39172 - sonypi_device.open_count--;
39173 + local_dec(&sonypi_device.open_count);
39174 mutex_unlock(&sonypi_device.lock);
39175 return 0;
39176 }
39177 @@ -901,9 +902,9 @@ static int sonypi_misc_open(struct inode *inode, struct file *file)
39178 {
39179 mutex_lock(&sonypi_device.lock);
39180 /* Flush input queue on first open */
39181 - if (!sonypi_device.open_count)
39182 + if (!local_read(&sonypi_device.open_count))
39183 kfifo_reset(&sonypi_device.fifo);
39184 - sonypi_device.open_count++;
39185 + local_inc(&sonypi_device.open_count);
39186 mutex_unlock(&sonypi_device.lock);
39187
39188 return 0;
39189 diff --git a/drivers/char/tpm/tpm_acpi.c b/drivers/char/tpm/tpm_acpi.c
39190 index b9a57fa..5bb9e38 100644
39191 --- a/drivers/char/tpm/tpm_acpi.c
39192 +++ b/drivers/char/tpm/tpm_acpi.c
39193 @@ -98,11 +98,12 @@ int read_log(struct tpm_bios_log *log)
39194 virt = acpi_os_map_memory(start, len);
39195 if (!virt) {
39196 kfree(log->bios_event_log);
39197 + log->bios_event_log = NULL;
39198 printk("%s: ERROR - Unable to map memory\n", __func__);
39199 return -EIO;
39200 }
39201
39202 - memcpy_fromio(log->bios_event_log, virt, len);
39203 + memcpy_fromio(log->bios_event_log, (const char __force_kernel *)virt, len);
39204
39205 acpi_os_unmap_memory(virt, len);
39206 return 0;
39207 diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c
39208 index 59f7cb2..bac8b6d 100644
39209 --- a/drivers/char/tpm/tpm_eventlog.c
39210 +++ b/drivers/char/tpm/tpm_eventlog.c
39211 @@ -95,7 +95,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
39212 event = addr;
39213
39214 if ((event->event_type == 0 && event->event_size == 0) ||
39215 - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
39216 + (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
39217 return NULL;
39218
39219 return addr;
39220 @@ -120,7 +120,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
39221 return NULL;
39222
39223 if ((event->event_type == 0 && event->event_size == 0) ||
39224 - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
39225 + (event->event_size >= limit - v - sizeof(struct tcpa_event)))
39226 return NULL;
39227
39228 (*pos)++;
39229 @@ -213,7 +213,8 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
39230 int i;
39231
39232 for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
39233 - seq_putc(m, data[i]);
39234 + if (!seq_putc(m, data[i]))
39235 + return -EFAULT;
39236
39237 return 0;
39238 }
39239 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
39240 index 6928d09..ff6abe8 100644
39241 --- a/drivers/char/virtio_console.c
39242 +++ b/drivers/char/virtio_console.c
39243 @@ -684,7 +684,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
39244 if (to_user) {
39245 ssize_t ret;
39246
39247 - ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count);
39248 + ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count);
39249 if (ret)
39250 return -EFAULT;
39251 } else {
39252 @@ -787,7 +787,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
39253 if (!port_has_data(port) && !port->host_connected)
39254 return 0;
39255
39256 - return fill_readbuf(port, ubuf, count, true);
39257 + return fill_readbuf(port, (char __force_kernel *)ubuf, count, true);
39258 }
39259
39260 static int wait_port_writable(struct port *port, bool nonblock)
39261 diff --git a/drivers/clk/clk-composite.c b/drivers/clk/clk-composite.c
39262 index 57a078e..c17cde8 100644
39263 --- a/drivers/clk/clk-composite.c
39264 +++ b/drivers/clk/clk-composite.c
39265 @@ -146,7 +146,7 @@ struct clk *clk_register_composite(struct device *dev, const char *name,
39266 struct clk *clk;
39267 struct clk_init_data init;
39268 struct clk_composite *composite;
39269 - struct clk_ops *clk_composite_ops;
39270 + clk_ops_no_const *clk_composite_ops;
39271
39272 composite = kzalloc(sizeof(*composite), GFP_KERNEL);
39273 if (!composite) {
39274 diff --git a/drivers/clk/socfpga/clk.c b/drivers/clk/socfpga/clk.c
39275 index 5983a26..65d5f46 100644
39276 --- a/drivers/clk/socfpga/clk.c
39277 +++ b/drivers/clk/socfpga/clk.c
39278 @@ -22,6 +22,7 @@
39279 #include <linux/clk-provider.h>
39280 #include <linux/io.h>
39281 #include <linux/of.h>
39282 +#include <asm/pgtable.h>
39283
39284 /* Clock Manager offsets */
39285 #define CLKMGR_CTRL 0x0
39286 @@ -150,8 +151,10 @@ static __init struct clk *socfpga_clk_init(struct device_node *node,
39287 streq(clk_name, "periph_pll") ||
39288 streq(clk_name, "sdram_pll")) {
39289 socfpga_clk->hw.bit_idx = SOCFPGA_PLL_EXT_ENA;
39290 - clk_pll_ops.enable = clk_gate_ops.enable;
39291 - clk_pll_ops.disable = clk_gate_ops.disable;
39292 + pax_open_kernel();
39293 + *(void **)&clk_pll_ops.enable = clk_gate_ops.enable;
39294 + *(void **)&clk_pll_ops.disable = clk_gate_ops.disable;
39295 + pax_close_kernel();
39296 }
39297
39298 clk = clk_register(NULL, &socfpga_clk->hw.hw);
39299 @@ -242,7 +245,7 @@ static unsigned long socfpga_clk_recalc_rate(struct clk_hw *hwclk,
39300 return parent_rate / div;
39301 }
39302
39303 -static struct clk_ops gateclk_ops = {
39304 +static clk_ops_no_const gateclk_ops __read_only = {
39305 .recalc_rate = socfpga_clk_recalc_rate,
39306 .get_parent = socfpga_clk_get_parent,
39307 .set_parent = socfpga_clk_set_parent,
39308 diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
39309 index 18448a7..d5fad43 100644
39310 --- a/drivers/cpufreq/acpi-cpufreq.c
39311 +++ b/drivers/cpufreq/acpi-cpufreq.c
39312 @@ -676,8 +676,11 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
39313 data->acpi_data = per_cpu_ptr(acpi_perf_data, cpu);
39314 per_cpu(acfreq_data, cpu) = data;
39315
39316 - if (cpu_has(c, X86_FEATURE_CONSTANT_TSC))
39317 - acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
39318 + if (cpu_has(c, X86_FEATURE_CONSTANT_TSC)) {
39319 + pax_open_kernel();
39320 + *(u8 *)&acpi_cpufreq_driver.flags |= CPUFREQ_CONST_LOOPS;
39321 + pax_close_kernel();
39322 + }
39323
39324 result = acpi_processor_register_performance(data->acpi_data, cpu);
39325 if (result)
39326 @@ -810,7 +813,9 @@ static int acpi_cpufreq_cpu_init(struct cpufreq_policy *policy)
39327 policy->cur = acpi_cpufreq_guess_freq(data, policy->cpu);
39328 break;
39329 case ACPI_ADR_SPACE_FIXED_HARDWARE:
39330 - acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
39331 + pax_open_kernel();
39332 + *(void **)&acpi_cpufreq_driver.get = get_cur_freq_on_cpu;
39333 + pax_close_kernel();
39334 break;
39335 default:
39336 break;
39337 @@ -905,8 +910,10 @@ static void __init acpi_cpufreq_boost_init(void)
39338 if (!msrs)
39339 return;
39340
39341 - acpi_cpufreq_driver.boost_supported = true;
39342 - acpi_cpufreq_driver.boost_enabled = boost_state(0);
39343 + pax_open_kernel();
39344 + *(bool *)&acpi_cpufreq_driver.boost_supported = true;
39345 + *(bool *)&acpi_cpufreq_driver.boost_enabled = boost_state(0);
39346 + pax_close_kernel();
39347 get_online_cpus();
39348
39349 /* Force all MSRs to the same value */
39350 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
39351 index 199b52b..e3503bb 100644
39352 --- a/drivers/cpufreq/cpufreq.c
39353 +++ b/drivers/cpufreq/cpufreq.c
39354 @@ -1970,7 +1970,7 @@ void cpufreq_unregister_governor(struct cpufreq_governor *governor)
39355 #endif
39356
39357 mutex_lock(&cpufreq_governor_mutex);
39358 - list_del(&governor->governor_list);
39359 + pax_list_del(&governor->governor_list);
39360 mutex_unlock(&cpufreq_governor_mutex);
39361 return;
39362 }
39363 @@ -2200,7 +2200,7 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
39364 return NOTIFY_OK;
39365 }
39366
39367 -static struct notifier_block __refdata cpufreq_cpu_notifier = {
39368 +static struct notifier_block cpufreq_cpu_notifier = {
39369 .notifier_call = cpufreq_cpu_callback,
39370 };
39371
39372 @@ -2240,13 +2240,17 @@ int cpufreq_boost_trigger_state(int state)
39373 return 0;
39374
39375 write_lock_irqsave(&cpufreq_driver_lock, flags);
39376 - cpufreq_driver->boost_enabled = state;
39377 + pax_open_kernel();
39378 + *(bool *)&cpufreq_driver->boost_enabled = state;
39379 + pax_close_kernel();
39380 write_unlock_irqrestore(&cpufreq_driver_lock, flags);
39381
39382 ret = cpufreq_driver->set_boost(state);
39383 if (ret) {
39384 write_lock_irqsave(&cpufreq_driver_lock, flags);
39385 - cpufreq_driver->boost_enabled = !state;
39386 + pax_open_kernel();
39387 + *(bool *)&cpufreq_driver->boost_enabled = !state;
39388 + pax_close_kernel();
39389 write_unlock_irqrestore(&cpufreq_driver_lock, flags);
39390
39391 pr_err("%s: Cannot %s BOOST\n", __func__,
39392 @@ -2300,8 +2304,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
39393
39394 pr_debug("trying to register driver %s\n", driver_data->name);
39395
39396 - if (driver_data->setpolicy)
39397 - driver_data->flags |= CPUFREQ_CONST_LOOPS;
39398 + if (driver_data->setpolicy) {
39399 + pax_open_kernel();
39400 + *(u8 *)&driver_data->flags |= CPUFREQ_CONST_LOOPS;
39401 + pax_close_kernel();
39402 + }
39403
39404 write_lock_irqsave(&cpufreq_driver_lock, flags);
39405 if (cpufreq_driver) {
39406 @@ -2316,8 +2323,11 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
39407 * Check if driver provides function to enable boost -
39408 * if not, use cpufreq_boost_set_sw as default
39409 */
39410 - if (!cpufreq_driver->set_boost)
39411 - cpufreq_driver->set_boost = cpufreq_boost_set_sw;
39412 + if (!cpufreq_driver->set_boost) {
39413 + pax_open_kernel();
39414 + *(void **)&cpufreq_driver->set_boost = cpufreq_boost_set_sw;
39415 + pax_close_kernel();
39416 + }
39417
39418 ret = cpufreq_sysfs_create_file(&boost.attr);
39419 if (ret) {
39420 diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c
39421 index ba43991..23858ffb 100644
39422 --- a/drivers/cpufreq/cpufreq_governor.c
39423 +++ b/drivers/cpufreq/cpufreq_governor.c
39424 @@ -191,7 +191,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39425 struct dbs_data *dbs_data;
39426 struct od_cpu_dbs_info_s *od_dbs_info = NULL;
39427 struct cs_cpu_dbs_info_s *cs_dbs_info = NULL;
39428 - struct od_ops *od_ops = NULL;
39429 + const struct od_ops *od_ops = NULL;
39430 struct od_dbs_tuners *od_tuners = NULL;
39431 struct cs_dbs_tuners *cs_tuners = NULL;
39432 struct cpu_dbs_common_info *cpu_cdbs;
39433 @@ -257,7 +257,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39434
39435 if ((cdata->governor == GOV_CONSERVATIVE) &&
39436 (!policy->governor->initialized)) {
39437 - struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39438 + const struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39439
39440 cpufreq_register_notifier(cs_ops->notifier_block,
39441 CPUFREQ_TRANSITION_NOTIFIER);
39442 @@ -277,7 +277,7 @@ int cpufreq_governor_dbs(struct cpufreq_policy *policy,
39443
39444 if ((dbs_data->cdata->governor == GOV_CONSERVATIVE) &&
39445 (policy->governor->initialized == 1)) {
39446 - struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39447 + const struct cs_ops *cs_ops = dbs_data->cdata->gov_ops;
39448
39449 cpufreq_unregister_notifier(cs_ops->notifier_block,
39450 CPUFREQ_TRANSITION_NOTIFIER);
39451 diff --git a/drivers/cpufreq/cpufreq_governor.h b/drivers/cpufreq/cpufreq_governor.h
39452 index bfb9ae1..e1d3a7e 100644
39453 --- a/drivers/cpufreq/cpufreq_governor.h
39454 +++ b/drivers/cpufreq/cpufreq_governor.h
39455 @@ -205,7 +205,7 @@ struct common_dbs_data {
39456 void (*exit)(struct dbs_data *dbs_data);
39457
39458 /* Governor specific ops, see below */
39459 - void *gov_ops;
39460 + const void *gov_ops;
39461 };
39462
39463 /* Governor Per policy data */
39464 @@ -225,7 +225,7 @@ struct od_ops {
39465 unsigned int (*powersave_bias_target)(struct cpufreq_policy *policy,
39466 unsigned int freq_next, unsigned int relation);
39467 void (*freq_increase)(struct cpufreq_policy *policy, unsigned int freq);
39468 -};
39469 +} __no_const;
39470
39471 struct cs_ops {
39472 struct notifier_block *notifier_block;
39473 diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
39474 index 18d4091..434be15 100644
39475 --- a/drivers/cpufreq/cpufreq_ondemand.c
39476 +++ b/drivers/cpufreq/cpufreq_ondemand.c
39477 @@ -521,7 +521,7 @@ static void od_exit(struct dbs_data *dbs_data)
39478
39479 define_get_cpu_dbs_routines(od_cpu_dbs_info);
39480
39481 -static struct od_ops od_ops = {
39482 +static struct od_ops od_ops __read_only = {
39483 .powersave_bias_init_cpu = ondemand_powersave_bias_init_cpu,
39484 .powersave_bias_target = generic_powersave_bias_target,
39485 .freq_increase = dbs_freq_increase,
39486 @@ -576,14 +576,18 @@ void od_register_powersave_bias_handler(unsigned int (*f)
39487 (struct cpufreq_policy *, unsigned int, unsigned int),
39488 unsigned int powersave_bias)
39489 {
39490 - od_ops.powersave_bias_target = f;
39491 + pax_open_kernel();
39492 + *(void **)&od_ops.powersave_bias_target = f;
39493 + pax_close_kernel();
39494 od_set_powersave_bias(powersave_bias);
39495 }
39496 EXPORT_SYMBOL_GPL(od_register_powersave_bias_handler);
39497
39498 void od_unregister_powersave_bias_handler(void)
39499 {
39500 - od_ops.powersave_bias_target = generic_powersave_bias_target;
39501 + pax_open_kernel();
39502 + *(void **)&od_ops.powersave_bias_target = generic_powersave_bias_target;
39503 + pax_close_kernel();
39504 od_set_powersave_bias(0);
39505 }
39506 EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
39507 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
39508 index 2cd36b9..8f07fae 100644
39509 --- a/drivers/cpufreq/intel_pstate.c
39510 +++ b/drivers/cpufreq/intel_pstate.c
39511 @@ -124,10 +124,10 @@ struct pstate_funcs {
39512 struct cpu_defaults {
39513 struct pstate_adjust_policy pid_policy;
39514 struct pstate_funcs funcs;
39515 -};
39516 +} __do_const;
39517
39518 static struct pstate_adjust_policy pid_params;
39519 -static struct pstate_funcs pstate_funcs;
39520 +static struct pstate_funcs *pstate_funcs;
39521
39522 struct perf_limits {
39523 int no_turbo;
39524 @@ -518,7 +518,7 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
39525
39526 cpu->pstate.current_pstate = pstate;
39527
39528 - pstate_funcs.set(cpu, pstate);
39529 + pstate_funcs->set(cpu, pstate);
39530 }
39531
39532 static inline void intel_pstate_pstate_increase(struct cpudata *cpu, int steps)
39533 @@ -540,12 +540,12 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
39534 {
39535 sprintf(cpu->name, "Intel 2nd generation core");
39536
39537 - cpu->pstate.min_pstate = pstate_funcs.get_min();
39538 - cpu->pstate.max_pstate = pstate_funcs.get_max();
39539 - cpu->pstate.turbo_pstate = pstate_funcs.get_turbo();
39540 + cpu->pstate.min_pstate = pstate_funcs->get_min();
39541 + cpu->pstate.max_pstate = pstate_funcs->get_max();
39542 + cpu->pstate.turbo_pstate = pstate_funcs->get_turbo();
39543
39544 - if (pstate_funcs.get_vid)
39545 - pstate_funcs.get_vid(cpu);
39546 + if (pstate_funcs->get_vid)
39547 + pstate_funcs->get_vid(cpu);
39548
39549 /*
39550 * goto max pstate so we don't slow up boot if we are built-in if we are
39551 @@ -832,9 +832,9 @@ static int intel_pstate_msrs_not_valid(void)
39552 rdmsrl(MSR_IA32_APERF, aperf);
39553 rdmsrl(MSR_IA32_MPERF, mperf);
39554
39555 - if (!pstate_funcs.get_max() ||
39556 - !pstate_funcs.get_min() ||
39557 - !pstate_funcs.get_turbo())
39558 + if (!pstate_funcs->get_max() ||
39559 + !pstate_funcs->get_min() ||
39560 + !pstate_funcs->get_turbo())
39561 return -ENODEV;
39562
39563 rdmsrl(MSR_IA32_APERF, tmp);
39564 @@ -848,7 +848,7 @@ static int intel_pstate_msrs_not_valid(void)
39565 return 0;
39566 }
39567
39568 -static void copy_pid_params(struct pstate_adjust_policy *policy)
39569 +static void copy_pid_params(const struct pstate_adjust_policy *policy)
39570 {
39571 pid_params.sample_rate_ms = policy->sample_rate_ms;
39572 pid_params.p_gain_pct = policy->p_gain_pct;
39573 @@ -860,11 +860,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
39574
39575 static void copy_cpu_funcs(struct pstate_funcs *funcs)
39576 {
39577 - pstate_funcs.get_max = funcs->get_max;
39578 - pstate_funcs.get_min = funcs->get_min;
39579 - pstate_funcs.get_turbo = funcs->get_turbo;
39580 - pstate_funcs.set = funcs->set;
39581 - pstate_funcs.get_vid = funcs->get_vid;
39582 + pstate_funcs = funcs;
39583 }
39584
39585 #if IS_ENABLED(CONFIG_ACPI)
39586 diff --git a/drivers/cpufreq/p4-clockmod.c b/drivers/cpufreq/p4-clockmod.c
39587 index 3d1cba9..0ab21d2 100644
39588 --- a/drivers/cpufreq/p4-clockmod.c
39589 +++ b/drivers/cpufreq/p4-clockmod.c
39590 @@ -134,10 +134,14 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
39591 case 0x0F: /* Core Duo */
39592 case 0x16: /* Celeron Core */
39593 case 0x1C: /* Atom */
39594 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39595 + pax_open_kernel();
39596 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39597 + pax_close_kernel();
39598 return speedstep_get_frequency(SPEEDSTEP_CPU_PCORE);
39599 case 0x0D: /* Pentium M (Dothan) */
39600 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39601 + pax_open_kernel();
39602 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39603 + pax_close_kernel();
39604 /* fall through */
39605 case 0x09: /* Pentium M (Banias) */
39606 return speedstep_get_frequency(SPEEDSTEP_CPU_PM);
39607 @@ -149,7 +153,9 @@ static unsigned int cpufreq_p4_get_frequency(struct cpuinfo_x86 *c)
39608
39609 /* on P-4s, the TSC runs with constant frequency independent whether
39610 * throttling is active or not. */
39611 - p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39612 + pax_open_kernel();
39613 + *(u8 *)&p4clockmod_driver.flags |= CPUFREQ_CONST_LOOPS;
39614 + pax_close_kernel();
39615
39616 if (speedstep_detect_processor() == SPEEDSTEP_CPU_P4M) {
39617 printk(KERN_WARNING PFX "Warning: Pentium 4-M detected. "
39618 diff --git a/drivers/cpufreq/sparc-us3-cpufreq.c b/drivers/cpufreq/sparc-us3-cpufreq.c
39619 index 724ffbd..f06aaaa 100644
39620 --- a/drivers/cpufreq/sparc-us3-cpufreq.c
39621 +++ b/drivers/cpufreq/sparc-us3-cpufreq.c
39622 @@ -18,14 +18,12 @@
39623 #include <asm/head.h>
39624 #include <asm/timer.h>
39625
39626 -static struct cpufreq_driver *cpufreq_us3_driver;
39627 -
39628 struct us3_freq_percpu_info {
39629 struct cpufreq_frequency_table table[4];
39630 };
39631
39632 /* Indexed by cpu number. */
39633 -static struct us3_freq_percpu_info *us3_freq_table;
39634 +static struct us3_freq_percpu_info us3_freq_table[NR_CPUS];
39635
39636 /* UltraSPARC-III has three dividers: 1, 2, and 32. These are controlled
39637 * in the Safari config register.
39638 @@ -156,18 +154,28 @@ static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
39639
39640 static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
39641 {
39642 - if (cpufreq_us3_driver) {
39643 - cpufreq_frequency_table_put_attr(policy->cpu);
39644 - us3_freq_target(policy, 0);
39645 - }
39646 + cpufreq_frequency_table_put_attr(policy->cpu);
39647 + us3_freq_target(policy, 0);
39648
39649 return 0;
39650 }
39651
39652 +static int __init us3_freq_init(void);
39653 +static void __exit us3_freq_exit(void);
39654 +
39655 +static struct cpufreq_driver cpufreq_us3_driver = {
39656 + .init = us3_freq_cpu_init,
39657 + .verify = cpufreq_generic_frequency_table_verify,
39658 + .target_index = us3_freq_target,
39659 + .get = us3_freq_get,
39660 + .exit = us3_freq_cpu_exit,
39661 + .name = "UltraSPARC-III",
39662 +
39663 +};
39664 +
39665 static int __init us3_freq_init(void)
39666 {
39667 unsigned long manuf, impl, ver;
39668 - int ret;
39669
39670 if (tlb_type != cheetah && tlb_type != cheetah_plus)
39671 return -ENODEV;
39672 @@ -180,55 +188,15 @@ static int __init us3_freq_init(void)
39673 (impl == CHEETAH_IMPL ||
39674 impl == CHEETAH_PLUS_IMPL ||
39675 impl == JAGUAR_IMPL ||
39676 - impl == PANTHER_IMPL)) {
39677 - struct cpufreq_driver *driver;
39678 -
39679 - ret = -ENOMEM;
39680 - driver = kzalloc(sizeof(*driver), GFP_KERNEL);
39681 - if (!driver)
39682 - goto err_out;
39683 -
39684 - us3_freq_table = kzalloc((NR_CPUS * sizeof(*us3_freq_table)),
39685 - GFP_KERNEL);
39686 - if (!us3_freq_table)
39687 - goto err_out;
39688 -
39689 - driver->init = us3_freq_cpu_init;
39690 - driver->verify = cpufreq_generic_frequency_table_verify;
39691 - driver->target_index = us3_freq_target;
39692 - driver->get = us3_freq_get;
39693 - driver->exit = us3_freq_cpu_exit;
39694 - strcpy(driver->name, "UltraSPARC-III");
39695 -
39696 - cpufreq_us3_driver = driver;
39697 - ret = cpufreq_register_driver(driver);
39698 - if (ret)
39699 - goto err_out;
39700 -
39701 - return 0;
39702 -
39703 -err_out:
39704 - if (driver) {
39705 - kfree(driver);
39706 - cpufreq_us3_driver = NULL;
39707 - }
39708 - kfree(us3_freq_table);
39709 - us3_freq_table = NULL;
39710 - return ret;
39711 - }
39712 + impl == PANTHER_IMPL))
39713 + return cpufreq_register_driver(&cpufreq_us3_driver);
39714
39715 return -ENODEV;
39716 }
39717
39718 static void __exit us3_freq_exit(void)
39719 {
39720 - if (cpufreq_us3_driver) {
39721 - cpufreq_unregister_driver(cpufreq_us3_driver);
39722 - kfree(cpufreq_us3_driver);
39723 - cpufreq_us3_driver = NULL;
39724 - kfree(us3_freq_table);
39725 - us3_freq_table = NULL;
39726 - }
39727 + cpufreq_unregister_driver(&cpufreq_us3_driver);
39728 }
39729
39730 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
39731 diff --git a/drivers/cpufreq/speedstep-centrino.c b/drivers/cpufreq/speedstep-centrino.c
39732 index 4e1daca..e707b61 100644
39733 --- a/drivers/cpufreq/speedstep-centrino.c
39734 +++ b/drivers/cpufreq/speedstep-centrino.c
39735 @@ -351,8 +351,11 @@ static int centrino_cpu_init(struct cpufreq_policy *policy)
39736 !cpu_has(cpu, X86_FEATURE_EST))
39737 return -ENODEV;
39738
39739 - if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC))
39740 - centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
39741 + if (cpu_has(cpu, X86_FEATURE_CONSTANT_TSC)) {
39742 + pax_open_kernel();
39743 + *(u8 *)&centrino_driver.flags |= CPUFREQ_CONST_LOOPS;
39744 + pax_close_kernel();
39745 + }
39746
39747 if (policy->cpu != 0)
39748 return -ENODEV;
39749 diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
39750 index 06dbe7c..c2c8671 100644
39751 --- a/drivers/cpuidle/driver.c
39752 +++ b/drivers/cpuidle/driver.c
39753 @@ -202,7 +202,7 @@ static int poll_idle(struct cpuidle_device *dev,
39754
39755 static void poll_idle_init(struct cpuidle_driver *drv)
39756 {
39757 - struct cpuidle_state *state = &drv->states[0];
39758 + cpuidle_state_no_const *state = &drv->states[0];
39759
39760 snprintf(state->name, CPUIDLE_NAME_LEN, "POLL");
39761 snprintf(state->desc, CPUIDLE_DESC_LEN, "CPUIDLE CORE POLL IDLE");
39762 diff --git a/drivers/cpuidle/governor.c b/drivers/cpuidle/governor.c
39763 index ca89412..a7b9c49 100644
39764 --- a/drivers/cpuidle/governor.c
39765 +++ b/drivers/cpuidle/governor.c
39766 @@ -87,7 +87,7 @@ int cpuidle_register_governor(struct cpuidle_governor *gov)
39767 mutex_lock(&cpuidle_lock);
39768 if (__cpuidle_find_governor(gov->name) == NULL) {
39769 ret = 0;
39770 - list_add_tail(&gov->governor_list, &cpuidle_governors);
39771 + pax_list_add_tail((struct list_head *)&gov->governor_list, &cpuidle_governors);
39772 if (!cpuidle_curr_governor ||
39773 cpuidle_curr_governor->rating < gov->rating)
39774 cpuidle_switch_governor(gov);
39775 diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
39776 index e918b6d..f87ea80 100644
39777 --- a/drivers/cpuidle/sysfs.c
39778 +++ b/drivers/cpuidle/sysfs.c
39779 @@ -135,7 +135,7 @@ static struct attribute *cpuidle_switch_attrs[] = {
39780 NULL
39781 };
39782
39783 -static struct attribute_group cpuidle_attr_group = {
39784 +static attribute_group_no_const cpuidle_attr_group = {
39785 .attrs = cpuidle_default_attrs,
39786 .name = "cpuidle",
39787 };
39788 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
39789 index 12fea3e..1e28f47 100644
39790 --- a/drivers/crypto/hifn_795x.c
39791 +++ b/drivers/crypto/hifn_795x.c
39792 @@ -51,7 +51,7 @@ module_param_string(hifn_pll_ref, hifn_pll_ref, sizeof(hifn_pll_ref), 0444);
39793 MODULE_PARM_DESC(hifn_pll_ref,
39794 "PLL reference clock (pci[freq] or ext[freq], default ext)");
39795
39796 -static atomic_t hifn_dev_number;
39797 +static atomic_unchecked_t hifn_dev_number;
39798
39799 #define ACRYPTO_OP_DECRYPT 0
39800 #define ACRYPTO_OP_ENCRYPT 1
39801 @@ -2577,7 +2577,7 @@ static int hifn_probe(struct pci_dev *pdev, const struct pci_device_id *id)
39802 goto err_out_disable_pci_device;
39803
39804 snprintf(name, sizeof(name), "hifn%d",
39805 - atomic_inc_return(&hifn_dev_number)-1);
39806 + atomic_inc_return_unchecked(&hifn_dev_number)-1);
39807
39808 err = pci_request_regions(pdev, name);
39809 if (err)
39810 diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
39811 index a0b2f7e..1b6f028 100644
39812 --- a/drivers/devfreq/devfreq.c
39813 +++ b/drivers/devfreq/devfreq.c
39814 @@ -607,7 +607,7 @@ int devfreq_add_governor(struct devfreq_governor *governor)
39815 goto err_out;
39816 }
39817
39818 - list_add(&governor->node, &devfreq_governor_list);
39819 + pax_list_add((struct list_head *)&governor->node, &devfreq_governor_list);
39820
39821 list_for_each_entry(devfreq, &devfreq_list, node) {
39822 int ret = 0;
39823 @@ -695,7 +695,7 @@ int devfreq_remove_governor(struct devfreq_governor *governor)
39824 }
39825 }
39826
39827 - list_del(&governor->node);
39828 + pax_list_del((struct list_head *)&governor->node);
39829 err_out:
39830 mutex_unlock(&devfreq_list_lock);
39831
39832 diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
39833 index 2e7b394..1371a64 100644
39834 --- a/drivers/dma/sh/shdma-base.c
39835 +++ b/drivers/dma/sh/shdma-base.c
39836 @@ -267,8 +267,8 @@ static int shdma_alloc_chan_resources(struct dma_chan *chan)
39837 schan->slave_id = -EINVAL;
39838 }
39839
39840 - schan->desc = kcalloc(NR_DESCS_PER_CHANNEL,
39841 - sdev->desc_size, GFP_KERNEL);
39842 + schan->desc = kcalloc(sdev->desc_size,
39843 + NR_DESCS_PER_CHANNEL, GFP_KERNEL);
39844 if (!schan->desc) {
39845 ret = -ENOMEM;
39846 goto edescalloc;
39847 diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
39848 index 0d765c0..60b7480 100644
39849 --- a/drivers/dma/sh/shdmac.c
39850 +++ b/drivers/dma/sh/shdmac.c
39851 @@ -511,7 +511,7 @@ static int sh_dmae_nmi_handler(struct notifier_block *self,
39852 return ret;
39853 }
39854
39855 -static struct notifier_block sh_dmae_nmi_notifier __read_mostly = {
39856 +static struct notifier_block sh_dmae_nmi_notifier = {
39857 .notifier_call = sh_dmae_nmi_handler,
39858
39859 /* Run before NMI debug handler and KGDB */
39860 diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
39861 index 592af5f..bb1d583 100644
39862 --- a/drivers/edac/edac_device.c
39863 +++ b/drivers/edac/edac_device.c
39864 @@ -477,9 +477,9 @@ void edac_device_reset_delay_period(struct edac_device_ctl_info *edac_dev,
39865 */
39866 int edac_device_alloc_index(void)
39867 {
39868 - static atomic_t device_indexes = ATOMIC_INIT(0);
39869 + static atomic_unchecked_t device_indexes = ATOMIC_INIT(0);
39870
39871 - return atomic_inc_return(&device_indexes) - 1;
39872 + return atomic_inc_return_unchecked(&device_indexes) - 1;
39873 }
39874 EXPORT_SYMBOL_GPL(edac_device_alloc_index);
39875
39876 diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
39877 index b335c6a..db65b44 100644
39878 --- a/drivers/edac/edac_mc_sysfs.c
39879 +++ b/drivers/edac/edac_mc_sysfs.c
39880 @@ -152,7 +152,7 @@ static const char * const edac_caps[] = {
39881 struct dev_ch_attribute {
39882 struct device_attribute attr;
39883 int channel;
39884 -};
39885 +} __do_const;
39886
39887 #define DEVICE_CHANNEL(_name, _mode, _show, _store, _var) \
39888 struct dev_ch_attribute dev_attr_legacy_##_name = \
39889 @@ -1009,14 +1009,16 @@ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci)
39890 }
39891
39892 if (mci->set_sdram_scrub_rate || mci->get_sdram_scrub_rate) {
39893 + pax_open_kernel();
39894 if (mci->get_sdram_scrub_rate) {
39895 - dev_attr_sdram_scrub_rate.attr.mode |= S_IRUGO;
39896 - dev_attr_sdram_scrub_rate.show = &mci_sdram_scrub_rate_show;
39897 + *(umode_t *)&dev_attr_sdram_scrub_rate.attr.mode |= S_IRUGO;
39898 + *(void **)&dev_attr_sdram_scrub_rate.show = &mci_sdram_scrub_rate_show;
39899 }
39900 if (mci->set_sdram_scrub_rate) {
39901 - dev_attr_sdram_scrub_rate.attr.mode |= S_IWUSR;
39902 - dev_attr_sdram_scrub_rate.store = &mci_sdram_scrub_rate_store;
39903 + *(umode_t *)&dev_attr_sdram_scrub_rate.attr.mode |= S_IWUSR;
39904 + *(void **)&dev_attr_sdram_scrub_rate.store = &mci_sdram_scrub_rate_store;
39905 }
39906 + pax_close_kernel();
39907 err = device_create_file(&mci->dev,
39908 &dev_attr_sdram_scrub_rate);
39909 if (err) {
39910 diff --git a/drivers/edac/edac_pci.c b/drivers/edac/edac_pci.c
39911 index 2cf44b4d..6dd2dc7 100644
39912 --- a/drivers/edac/edac_pci.c
39913 +++ b/drivers/edac/edac_pci.c
39914 @@ -29,7 +29,7 @@
39915
39916 static DEFINE_MUTEX(edac_pci_ctls_mutex);
39917 static LIST_HEAD(edac_pci_list);
39918 -static atomic_t pci_indexes = ATOMIC_INIT(0);
39919 +static atomic_unchecked_t pci_indexes = ATOMIC_INIT(0);
39920
39921 /*
39922 * edac_pci_alloc_ctl_info
39923 @@ -315,7 +315,7 @@ EXPORT_SYMBOL_GPL(edac_pci_reset_delay_period);
39924 */
39925 int edac_pci_alloc_index(void)
39926 {
39927 - return atomic_inc_return(&pci_indexes) - 1;
39928 + return atomic_inc_return_unchecked(&pci_indexes) - 1;
39929 }
39930 EXPORT_SYMBOL_GPL(edac_pci_alloc_index);
39931
39932 diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
39933 index e8658e4..22746d6 100644
39934 --- a/drivers/edac/edac_pci_sysfs.c
39935 +++ b/drivers/edac/edac_pci_sysfs.c
39936 @@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1; /* log PCI parity errors */
39937 static int edac_pci_log_npe = 1; /* log PCI non-parity error errors */
39938 static int edac_pci_poll_msec = 1000; /* one second workq period */
39939
39940 -static atomic_t pci_parity_count = ATOMIC_INIT(0);
39941 -static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
39942 +static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
39943 +static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
39944
39945 static struct kobject *edac_pci_top_main_kobj;
39946 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
39947 @@ -235,7 +235,7 @@ struct edac_pci_dev_attribute {
39948 void *value;
39949 ssize_t(*show) (void *, char *);
39950 ssize_t(*store) (void *, const char *, size_t);
39951 -};
39952 +} __do_const;
39953
39954 /* Set of show/store abstract level functions for PCI Parity object */
39955 static ssize_t edac_pci_dev_show(struct kobject *kobj, struct attribute *attr,
39956 @@ -579,7 +579,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
39957 edac_printk(KERN_CRIT, EDAC_PCI,
39958 "Signaled System Error on %s\n",
39959 pci_name(dev));
39960 - atomic_inc(&pci_nonparity_count);
39961 + atomic_inc_unchecked(&pci_nonparity_count);
39962 }
39963
39964 if (status & (PCI_STATUS_PARITY)) {
39965 @@ -587,7 +587,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
39966 "Master Data Parity Error on %s\n",
39967 pci_name(dev));
39968
39969 - atomic_inc(&pci_parity_count);
39970 + atomic_inc_unchecked(&pci_parity_count);
39971 }
39972
39973 if (status & (PCI_STATUS_DETECTED_PARITY)) {
39974 @@ -595,7 +595,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
39975 "Detected Parity Error on %s\n",
39976 pci_name(dev));
39977
39978 - atomic_inc(&pci_parity_count);
39979 + atomic_inc_unchecked(&pci_parity_count);
39980 }
39981 }
39982
39983 @@ -618,7 +618,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
39984 edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
39985 "Signaled System Error on %s\n",
39986 pci_name(dev));
39987 - atomic_inc(&pci_nonparity_count);
39988 + atomic_inc_unchecked(&pci_nonparity_count);
39989 }
39990
39991 if (status & (PCI_STATUS_PARITY)) {
39992 @@ -626,7 +626,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
39993 "Master Data Parity Error on "
39994 "%s\n", pci_name(dev));
39995
39996 - atomic_inc(&pci_parity_count);
39997 + atomic_inc_unchecked(&pci_parity_count);
39998 }
39999
40000 if (status & (PCI_STATUS_DETECTED_PARITY)) {
40001 @@ -634,7 +634,7 @@ static void edac_pci_dev_parity_test(struct pci_dev *dev)
40002 "Detected Parity Error on %s\n",
40003 pci_name(dev));
40004
40005 - atomic_inc(&pci_parity_count);
40006 + atomic_inc_unchecked(&pci_parity_count);
40007 }
40008 }
40009 }
40010 @@ -672,7 +672,7 @@ void edac_pci_do_parity_check(void)
40011 if (!check_pci_errors)
40012 return;
40013
40014 - before_count = atomic_read(&pci_parity_count);
40015 + before_count = atomic_read_unchecked(&pci_parity_count);
40016
40017 /* scan all PCI devices looking for a Parity Error on devices and
40018 * bridges.
40019 @@ -684,7 +684,7 @@ void edac_pci_do_parity_check(void)
40020 /* Only if operator has selected panic on PCI Error */
40021 if (edac_pci_get_panic_on_pe()) {
40022 /* If the count is different 'after' from 'before' */
40023 - if (before_count != atomic_read(&pci_parity_count))
40024 + if (before_count != atomic_read_unchecked(&pci_parity_count))
40025 panic("EDAC: PCI Parity Error");
40026 }
40027 }
40028 diff --git a/drivers/edac/mce_amd.h b/drivers/edac/mce_amd.h
40029 index 51b7e3a..aa8a3e8 100644
40030 --- a/drivers/edac/mce_amd.h
40031 +++ b/drivers/edac/mce_amd.h
40032 @@ -77,7 +77,7 @@ struct amd_decoder_ops {
40033 bool (*mc0_mce)(u16, u8);
40034 bool (*mc1_mce)(u16, u8);
40035 bool (*mc2_mce)(u16, u8);
40036 -};
40037 +} __no_const;
40038
40039 void amd_report_gart_errors(bool);
40040 void amd_register_ecc_decoder(void (*f)(int, struct mce *));
40041 diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
40042 index 57ea7f4..af06b76 100644
40043 --- a/drivers/firewire/core-card.c
40044 +++ b/drivers/firewire/core-card.c
40045 @@ -528,9 +528,9 @@ void fw_card_initialize(struct fw_card *card,
40046 const struct fw_card_driver *driver,
40047 struct device *device)
40048 {
40049 - static atomic_t index = ATOMIC_INIT(-1);
40050 + static atomic_unchecked_t index = ATOMIC_INIT(-1);
40051
40052 - card->index = atomic_inc_return(&index);
40053 + card->index = atomic_inc_return_unchecked(&index);
40054 card->driver = driver;
40055 card->device = device;
40056 card->current_tlabel = 0;
40057 @@ -680,7 +680,7 @@ EXPORT_SYMBOL_GPL(fw_card_release);
40058
40059 void fw_core_remove_card(struct fw_card *card)
40060 {
40061 - struct fw_card_driver dummy_driver = dummy_driver_template;
40062 + fw_card_driver_no_const dummy_driver = dummy_driver_template;
40063
40064 card->driver->update_phy_reg(card, 4,
40065 PHY_LINK_ACTIVE | PHY_CONTENDER, 0);
40066 diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
40067 index 2c6d5e1..a2cca6b 100644
40068 --- a/drivers/firewire/core-device.c
40069 +++ b/drivers/firewire/core-device.c
40070 @@ -253,7 +253,7 @@ EXPORT_SYMBOL(fw_device_enable_phys_dma);
40071 struct config_rom_attribute {
40072 struct device_attribute attr;
40073 u32 key;
40074 -};
40075 +} __do_const;
40076
40077 static ssize_t show_immediate(struct device *dev,
40078 struct device_attribute *dattr, char *buf)
40079 diff --git a/drivers/firewire/core-transaction.c b/drivers/firewire/core-transaction.c
40080 index eb6935c..3cc2bfa 100644
40081 --- a/drivers/firewire/core-transaction.c
40082 +++ b/drivers/firewire/core-transaction.c
40083 @@ -38,6 +38,7 @@
40084 #include <linux/timer.h>
40085 #include <linux/types.h>
40086 #include <linux/workqueue.h>
40087 +#include <linux/sched.h>
40088
40089 #include <asm/byteorder.h>
40090
40091 diff --git a/drivers/firewire/core.h b/drivers/firewire/core.h
40092 index c98764a..551b520 100644
40093 --- a/drivers/firewire/core.h
40094 +++ b/drivers/firewire/core.h
40095 @@ -111,6 +111,7 @@ struct fw_card_driver {
40096
40097 int (*stop_iso)(struct fw_iso_context *ctx);
40098 };
40099 +typedef struct fw_card_driver __no_const fw_card_driver_no_const;
40100
40101 void fw_card_initialize(struct fw_card *card,
40102 const struct fw_card_driver *driver, struct device *device);
40103 diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
40104 index 8db6632..9bbc8ca 100644
40105 --- a/drivers/firewire/ohci.c
40106 +++ b/drivers/firewire/ohci.c
40107 @@ -2049,10 +2049,12 @@ static void bus_reset_work(struct work_struct *work)
40108 be32_to_cpu(ohci->next_header));
40109 }
40110
40111 +#ifndef CONFIG_GRKERNSEC
40112 if (param_remote_dma) {
40113 reg_write(ohci, OHCI1394_PhyReqFilterHiSet, ~0);
40114 reg_write(ohci, OHCI1394_PhyReqFilterLoSet, ~0);
40115 }
40116 +#endif
40117
40118 spin_unlock_irq(&ohci->lock);
40119
40120 @@ -2584,8 +2586,10 @@ static int ohci_enable_phys_dma(struct fw_card *card,
40121 unsigned long flags;
40122 int n, ret = 0;
40123
40124 +#ifndef CONFIG_GRKERNSEC
40125 if (param_remote_dma)
40126 return 0;
40127 +#endif
40128
40129 /*
40130 * FIXME: Make sure this bitmask is cleared when we clear the busReset
40131 diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
40132 index 94a58a0..f5eba42 100644
40133 --- a/drivers/firmware/dmi-id.c
40134 +++ b/drivers/firmware/dmi-id.c
40135 @@ -16,7 +16,7 @@
40136 struct dmi_device_attribute{
40137 struct device_attribute dev_attr;
40138 int field;
40139 -};
40140 +} __do_const;
40141 #define to_dmi_dev_attr(_dev_attr) \
40142 container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
40143
40144 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
40145 index 17afc51..0ef90cd 100644
40146 --- a/drivers/firmware/dmi_scan.c
40147 +++ b/drivers/firmware/dmi_scan.c
40148 @@ -835,7 +835,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
40149 if (buf == NULL)
40150 return -1;
40151
40152 - dmi_table(buf, dmi_len, dmi_num, decode, private_data);
40153 + dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data);
40154
40155 dmi_unmap(buf);
40156 return 0;
40157 diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
40158 index 1491dd4..aa910db 100644
40159 --- a/drivers/firmware/efi/cper.c
40160 +++ b/drivers/firmware/efi/cper.c
40161 @@ -41,12 +41,12 @@
40162 */
40163 u64 cper_next_record_id(void)
40164 {
40165 - static atomic64_t seq;
40166 + static atomic64_unchecked_t seq;
40167
40168 - if (!atomic64_read(&seq))
40169 - atomic64_set(&seq, ((u64)get_seconds()) << 32);
40170 + if (!atomic64_read_unchecked(&seq))
40171 + atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
40172
40173 - return atomic64_inc_return(&seq);
40174 + return atomic64_inc_return_unchecked(&seq);
40175 }
40176 EXPORT_SYMBOL_GPL(cper_next_record_id);
40177
40178 diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
40179 index 4753bac..02861a2 100644
40180 --- a/drivers/firmware/efi/efi.c
40181 +++ b/drivers/firmware/efi/efi.c
40182 @@ -120,14 +120,16 @@ static struct attribute_group efi_subsys_attr_group = {
40183 };
40184
40185 static struct efivars generic_efivars;
40186 -static struct efivar_operations generic_ops;
40187 +static efivar_operations_no_const generic_ops __read_only;
40188
40189 static int generic_ops_register(void)
40190 {
40191 - generic_ops.get_variable = efi.get_variable;
40192 - generic_ops.set_variable = efi.set_variable;
40193 - generic_ops.get_next_variable = efi.get_next_variable;
40194 - generic_ops.query_variable_store = efi_query_variable_store;
40195 + pax_open_kernel();
40196 + *(void **)&generic_ops.get_variable = efi.get_variable;
40197 + *(void **)&generic_ops.set_variable = efi.set_variable;
40198 + *(void **)&generic_ops.get_next_variable = efi.get_next_variable;
40199 + *(void **)&generic_ops.query_variable_store = efi_query_variable_store;
40200 + pax_close_kernel();
40201
40202 return efivars_register(&generic_efivars, &generic_ops, efi_kobj);
40203 }
40204 diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c
40205 index 3dc2482..7bd2f61 100644
40206 --- a/drivers/firmware/efi/efivars.c
40207 +++ b/drivers/firmware/efi/efivars.c
40208 @@ -456,7 +456,7 @@ efivar_create_sysfs_entry(struct efivar_entry *new_var)
40209 static int
40210 create_efivars_bin_attributes(void)
40211 {
40212 - struct bin_attribute *attr;
40213 + bin_attribute_no_const *attr;
40214 int error;
40215
40216 /* new_var */
40217 diff --git a/drivers/firmware/google/memconsole.c b/drivers/firmware/google/memconsole.c
40218 index 2a90ba6..07f3733 100644
40219 --- a/drivers/firmware/google/memconsole.c
40220 +++ b/drivers/firmware/google/memconsole.c
40221 @@ -147,7 +147,9 @@ static int __init memconsole_init(void)
40222 if (!found_memconsole())
40223 return -ENODEV;
40224
40225 - memconsole_bin_attr.size = memconsole_length;
40226 + pax_open_kernel();
40227 + *(size_t *)&memconsole_bin_attr.size = memconsole_length;
40228 + pax_close_kernel();
40229
40230 ret = sysfs_create_bin_file(firmware_kobj, &memconsole_bin_attr);
40231
40232 diff --git a/drivers/gpio/gpio-em.c b/drivers/gpio/gpio-em.c
40233 index 1e98a98..b444372 100644
40234 --- a/drivers/gpio/gpio-em.c
40235 +++ b/drivers/gpio/gpio-em.c
40236 @@ -278,7 +278,7 @@ static int em_gio_probe(struct platform_device *pdev)
40237 struct em_gio_priv *p;
40238 struct resource *io[2], *irq[2];
40239 struct gpio_chip *gpio_chip;
40240 - struct irq_chip *irq_chip;
40241 + irq_chip_no_const *irq_chip;
40242 const char *name = dev_name(&pdev->dev);
40243 int ret;
40244
40245 diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
40246 index f5bf3c3..7baaa59 100644
40247 --- a/drivers/gpio/gpio-ich.c
40248 +++ b/drivers/gpio/gpio-ich.c
40249 @@ -71,7 +71,7 @@ struct ichx_desc {
40250 /* Some chipsets have quirks, let these use their own request/get */
40251 int (*request)(struct gpio_chip *chip, unsigned offset);
40252 int (*get)(struct gpio_chip *chip, unsigned offset);
40253 -};
40254 +} __do_const;
40255
40256 static struct {
40257 spinlock_t lock;
40258 diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
40259 index ca76ce7..68b384b 100644
40260 --- a/drivers/gpio/gpio-rcar.c
40261 +++ b/drivers/gpio/gpio-rcar.c
40262 @@ -355,7 +355,7 @@ static int gpio_rcar_probe(struct platform_device *pdev)
40263 struct gpio_rcar_priv *p;
40264 struct resource *io, *irq;
40265 struct gpio_chip *gpio_chip;
40266 - struct irq_chip *irq_chip;
40267 + irq_chip_no_const *irq_chip;
40268 const char *name = dev_name(&pdev->dev);
40269 int ret;
40270
40271 diff --git a/drivers/gpio/gpio-vr41xx.c b/drivers/gpio/gpio-vr41xx.c
40272 index 9902732..64b62dd 100644
40273 --- a/drivers/gpio/gpio-vr41xx.c
40274 +++ b/drivers/gpio/gpio-vr41xx.c
40275 @@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
40276 printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
40277 maskl, pendl, maskh, pendh);
40278
40279 - atomic_inc(&irq_err_count);
40280 + atomic_inc_unchecked(&irq_err_count);
40281
40282 return -EINVAL;
40283 }
40284 diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
40285 index 3b7d32d..05c2f74 100644
40286 --- a/drivers/gpu/drm/drm_crtc.c
40287 +++ b/drivers/gpu/drm/drm_crtc.c
40288 @@ -3123,7 +3123,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
40289 goto done;
40290 }
40291
40292 - if (copy_to_user(&enum_ptr[copied].name,
40293 + if (copy_to_user(enum_ptr[copied].name,
40294 &prop_enum->name, DRM_PROP_NAME_LEN)) {
40295 ret = -EFAULT;
40296 goto done;
40297 diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
40298 index 345be03..158368d 100644
40299 --- a/drivers/gpu/drm/drm_drv.c
40300 +++ b/drivers/gpu/drm/drm_drv.c
40301 @@ -233,7 +233,7 @@ module_exit(drm_core_exit);
40302 /**
40303 * Copy and IOCTL return string to user space
40304 */
40305 -static int drm_copy_field(char *buf, size_t *buf_len, const char *value)
40306 +static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value)
40307 {
40308 int len;
40309
40310 @@ -303,7 +303,7 @@ long drm_ioctl(struct file *filp,
40311 struct drm_file *file_priv = filp->private_data;
40312 struct drm_device *dev;
40313 const struct drm_ioctl_desc *ioctl = NULL;
40314 - drm_ioctl_t *func;
40315 + drm_ioctl_no_const_t func;
40316 unsigned int nr = DRM_IOCTL_NR(cmd);
40317 int retcode = -EINVAL;
40318 char stack_kdata[128];
40319 diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
40320 index 7f2af9a..1561914 100644
40321 --- a/drivers/gpu/drm/drm_fops.c
40322 +++ b/drivers/gpu/drm/drm_fops.c
40323 @@ -97,7 +97,7 @@ int drm_open(struct inode *inode, struct file *filp)
40324 if (drm_device_is_unplugged(dev))
40325 return -ENODEV;
40326
40327 - if (!dev->open_count++)
40328 + if (local_inc_return(&dev->open_count) == 1)
40329 need_setup = 1;
40330 mutex_lock(&dev->struct_mutex);
40331 old_imapping = inode->i_mapping;
40332 @@ -127,7 +127,7 @@ err_undo:
40333 iput(container_of(dev->dev_mapping, struct inode, i_data));
40334 dev->dev_mapping = old_mapping;
40335 mutex_unlock(&dev->struct_mutex);
40336 - dev->open_count--;
40337 + local_dec(&dev->open_count);
40338 return retcode;
40339 }
40340 EXPORT_SYMBOL(drm_open);
40341 @@ -463,7 +463,7 @@ int drm_release(struct inode *inode, struct file *filp)
40342
40343 mutex_lock(&drm_global_mutex);
40344
40345 - DRM_DEBUG("open_count = %d\n", dev->open_count);
40346 + DRM_DEBUG("open_count = %ld\n", local_read(&dev->open_count));
40347
40348 if (dev->driver->preclose)
40349 dev->driver->preclose(dev, file_priv);
40350 @@ -472,10 +472,10 @@ int drm_release(struct inode *inode, struct file *filp)
40351 * Begin inline drm_release
40352 */
40353
40354 - DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
40355 + DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %ld\n",
40356 task_pid_nr(current),
40357 (long)old_encode_dev(file_priv->minor->device),
40358 - dev->open_count);
40359 + local_read(&dev->open_count));
40360
40361 /* Release any auth tokens that might point to this file_priv,
40362 (do that under the drm_global_mutex) */
40363 @@ -573,7 +573,7 @@ int drm_release(struct inode *inode, struct file *filp)
40364 * End inline drm_release
40365 */
40366
40367 - if (!--dev->open_count) {
40368 + if (local_dec_and_test(&dev->open_count)) {
40369 retcode = drm_lastclose(dev);
40370 if (drm_device_is_unplugged(dev))
40371 drm_put_dev(dev);
40372 diff --git a/drivers/gpu/drm/drm_global.c b/drivers/gpu/drm/drm_global.c
40373 index 3d2e91c..d31c4c9 100644
40374 --- a/drivers/gpu/drm/drm_global.c
40375 +++ b/drivers/gpu/drm/drm_global.c
40376 @@ -36,7 +36,7 @@
40377 struct drm_global_item {
40378 struct mutex mutex;
40379 void *object;
40380 - int refcount;
40381 + atomic_t refcount;
40382 };
40383
40384 static struct drm_global_item glob[DRM_GLOBAL_NUM];
40385 @@ -49,7 +49,7 @@ void drm_global_init(void)
40386 struct drm_global_item *item = &glob[i];
40387 mutex_init(&item->mutex);
40388 item->object = NULL;
40389 - item->refcount = 0;
40390 + atomic_set(&item->refcount, 0);
40391 }
40392 }
40393
40394 @@ -59,7 +59,7 @@ void drm_global_release(void)
40395 for (i = 0; i < DRM_GLOBAL_NUM; ++i) {
40396 struct drm_global_item *item = &glob[i];
40397 BUG_ON(item->object != NULL);
40398 - BUG_ON(item->refcount != 0);
40399 + BUG_ON(atomic_read(&item->refcount) != 0);
40400 }
40401 }
40402
40403 @@ -69,7 +69,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
40404 struct drm_global_item *item = &glob[ref->global_type];
40405
40406 mutex_lock(&item->mutex);
40407 - if (item->refcount == 0) {
40408 + if (atomic_read(&item->refcount) == 0) {
40409 item->object = kzalloc(ref->size, GFP_KERNEL);
40410 if (unlikely(item->object == NULL)) {
40411 ret = -ENOMEM;
40412 @@ -82,7 +82,7 @@ int drm_global_item_ref(struct drm_global_reference *ref)
40413 goto out_err;
40414
40415 }
40416 - ++item->refcount;
40417 + atomic_inc(&item->refcount);
40418 ref->object = item->object;
40419 mutex_unlock(&item->mutex);
40420 return 0;
40421 @@ -98,9 +98,9 @@ void drm_global_item_unref(struct drm_global_reference *ref)
40422 struct drm_global_item *item = &glob[ref->global_type];
40423
40424 mutex_lock(&item->mutex);
40425 - BUG_ON(item->refcount == 0);
40426 + BUG_ON(atomic_read(&item->refcount) == 0);
40427 BUG_ON(ref->object != item->object);
40428 - if (--item->refcount == 0) {
40429 + if (atomic_dec_and_test(&item->refcount)) {
40430 ref->release(ref);
40431 item->object = NULL;
40432 }
40433 diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
40434 index 7473035..a48b9c5 100644
40435 --- a/drivers/gpu/drm/drm_info.c
40436 +++ b/drivers/gpu/drm/drm_info.c
40437 @@ -75,10 +75,13 @@ int drm_vm_info(struct seq_file *m, void *data)
40438 struct drm_local_map *map;
40439 struct drm_map_list *r_list;
40440
40441 - /* Hardcoded from _DRM_FRAME_BUFFER,
40442 - _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
40443 - _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
40444 - const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
40445 + static const char * const types[] = {
40446 + [_DRM_FRAME_BUFFER] = "FB",
40447 + [_DRM_REGISTERS] = "REG",
40448 + [_DRM_SHM] = "SHM",
40449 + [_DRM_AGP] = "AGP",
40450 + [_DRM_SCATTER_GATHER] = "SG",
40451 + [_DRM_CONSISTENT] = "PCI"};
40452 const char *type;
40453 int i;
40454
40455 @@ -89,7 +92,7 @@ int drm_vm_info(struct seq_file *m, void *data)
40456 map = r_list->map;
40457 if (!map)
40458 continue;
40459 - if (map->type < 0 || map->type > 5)
40460 + if (map->type >= ARRAY_SIZE(types))
40461 type = "??";
40462 else
40463 type = types[map->type];
40464 @@ -261,7 +264,11 @@ int drm_vma_info(struct seq_file *m, void *data)
40465 vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
40466 vma->vm_flags & VM_LOCKED ? 'l' : '-',
40467 vma->vm_flags & VM_IO ? 'i' : '-',
40468 +#ifdef CONFIG_GRKERNSEC_HIDESYM
40469 + 0);
40470 +#else
40471 vma->vm_pgoff);
40472 +#endif
40473
40474 #if defined(__i386__)
40475 pgprot = pgprot_val(vma->vm_page_prot);
40476 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
40477 index 2f4c4343..dd12cd2 100644
40478 --- a/drivers/gpu/drm/drm_ioc32.c
40479 +++ b/drivers/gpu/drm/drm_ioc32.c
40480 @@ -457,7 +457,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
40481 request = compat_alloc_user_space(nbytes);
40482 if (!access_ok(VERIFY_WRITE, request, nbytes))
40483 return -EFAULT;
40484 - list = (struct drm_buf_desc *) (request + 1);
40485 + list = (struct drm_buf_desc __user *) (request + 1);
40486
40487 if (__put_user(count, &request->count)
40488 || __put_user(list, &request->list))
40489 @@ -518,7 +518,7 @@ static int compat_drm_mapbufs(struct file *file, unsigned int cmd,
40490 request = compat_alloc_user_space(nbytes);
40491 if (!access_ok(VERIFY_WRITE, request, nbytes))
40492 return -EFAULT;
40493 - list = (struct drm_buf_pub *) (request + 1);
40494 + list = (struct drm_buf_pub __user *) (request + 1);
40495
40496 if (__put_user(count, &request->count)
40497 || __put_user(list, &request->list))
40498 @@ -1016,7 +1016,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
40499 return 0;
40500 }
40501
40502 -drm_ioctl_compat_t *drm_compat_ioctls[] = {
40503 +drm_ioctl_compat_t drm_compat_ioctls[] = {
40504 [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
40505 [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
40506 [DRM_IOCTL_NR(DRM_IOCTL_GET_MAP32)] = compat_drm_getmap,
40507 @@ -1062,7 +1062,6 @@ drm_ioctl_compat_t *drm_compat_ioctls[] = {
40508 long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
40509 {
40510 unsigned int nr = DRM_IOCTL_NR(cmd);
40511 - drm_ioctl_compat_t *fn;
40512 int ret;
40513
40514 /* Assume that ioctls without an explicit compat routine will just
40515 @@ -1072,10 +1071,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
40516 if (nr >= ARRAY_SIZE(drm_compat_ioctls))
40517 return drm_ioctl(filp, cmd, arg);
40518
40519 - fn = drm_compat_ioctls[nr];
40520 -
40521 - if (fn != NULL)
40522 - ret = (*fn) (filp, cmd, arg);
40523 + if (drm_compat_ioctls[nr] != NULL)
40524 + ret = (*drm_compat_ioctls[nr]) (filp, cmd, arg);
40525 else
40526 ret = drm_ioctl(filp, cmd, arg);
40527
40528 diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
40529 index 98a33c580..8fd1c2b 100644
40530 --- a/drivers/gpu/drm/drm_stub.c
40531 +++ b/drivers/gpu/drm/drm_stub.c
40532 @@ -409,7 +409,7 @@ void drm_unplug_dev(struct drm_device *dev)
40533
40534 drm_device_set_unplugged(dev);
40535
40536 - if (dev->open_count == 0) {
40537 + if (local_read(&dev->open_count) == 0) {
40538 drm_put_dev(dev);
40539 }
40540 mutex_unlock(&drm_global_mutex);
40541 diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
40542 index c22c309..ae758c3 100644
40543 --- a/drivers/gpu/drm/drm_sysfs.c
40544 +++ b/drivers/gpu/drm/drm_sysfs.c
40545 @@ -505,7 +505,7 @@ static void drm_sysfs_release(struct device *dev)
40546 */
40547 int drm_sysfs_device_add(struct drm_minor *minor)
40548 {
40549 - char *minor_str;
40550 + const char *minor_str;
40551 int r;
40552
40553 if (minor->type == DRM_MINOR_CONTROL)
40554 diff --git a/drivers/gpu/drm/i810/i810_drv.h b/drivers/gpu/drm/i810/i810_drv.h
40555 index d4d16ed..8fb0b51 100644
40556 --- a/drivers/gpu/drm/i810/i810_drv.h
40557 +++ b/drivers/gpu/drm/i810/i810_drv.h
40558 @@ -108,8 +108,8 @@ typedef struct drm_i810_private {
40559 int page_flipping;
40560
40561 wait_queue_head_t irq_queue;
40562 - atomic_t irq_received;
40563 - atomic_t irq_emitted;
40564 + atomic_unchecked_t irq_received;
40565 + atomic_unchecked_t irq_emitted;
40566
40567 int front_offset;
40568 } drm_i810_private_t;
40569 diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
40570 index b2b46c5..feb9fe7 100644
40571 --- a/drivers/gpu/drm/i915/i915_debugfs.c
40572 +++ b/drivers/gpu/drm/i915/i915_debugfs.c
40573 @@ -713,7 +713,7 @@ static int i915_interrupt_info(struct seq_file *m, void *data)
40574 I915_READ(GTIMR));
40575 }
40576 seq_printf(m, "Interrupts received: %d\n",
40577 - atomic_read(&dev_priv->irq_received));
40578 + atomic_read_unchecked(&dev_priv->irq_received));
40579 for_each_ring(ring, dev_priv, i) {
40580 if (INTEL_INFO(dev)->gen >= 6) {
40581 seq_printf(m,
40582 diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
40583 index 15a74f9..4278889 100644
40584 --- a/drivers/gpu/drm/i915/i915_dma.c
40585 +++ b/drivers/gpu/drm/i915/i915_dma.c
40586 @@ -1273,7 +1273,7 @@ static bool i915_switcheroo_can_switch(struct pci_dev *pdev)
40587 bool can_switch;
40588
40589 spin_lock(&dev->count_lock);
40590 - can_switch = (dev->open_count == 0);
40591 + can_switch = (local_read(&dev->open_count) == 0);
40592 spin_unlock(&dev->count_lock);
40593 return can_switch;
40594 }
40595 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
40596 index 697f215..6f89b7f 100644
40597 --- a/drivers/gpu/drm/i915/i915_drv.h
40598 +++ b/drivers/gpu/drm/i915/i915_drv.h
40599 @@ -1362,7 +1362,7 @@ typedef struct drm_i915_private {
40600 drm_dma_handle_t *status_page_dmah;
40601 struct resource mch_res;
40602
40603 - atomic_t irq_received;
40604 + atomic_unchecked_t irq_received;
40605
40606 /* protects the irq masks */
40607 spinlock_t irq_lock;
40608 diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
40609 index d269ecf..6d857bc 100644
40610 --- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
40611 +++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
40612 @@ -860,9 +860,9 @@ i915_gem_check_execbuffer(struct drm_i915_gem_execbuffer2 *exec)
40613
40614 static int
40615 validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
40616 - int count)
40617 + unsigned int count)
40618 {
40619 - int i;
40620 + unsigned int i;
40621 unsigned relocs_total = 0;
40622 unsigned relocs_max = UINT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
40623
40624 diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
40625 index 3c59584..500f2e9 100644
40626 --- a/drivers/gpu/drm/i915/i915_ioc32.c
40627 +++ b/drivers/gpu/drm/i915/i915_ioc32.c
40628 @@ -181,7 +181,7 @@ static int compat_i915_alloc(struct file *file, unsigned int cmd,
40629 (unsigned long)request);
40630 }
40631
40632 -static drm_ioctl_compat_t *i915_compat_ioctls[] = {
40633 +static drm_ioctl_compat_t i915_compat_ioctls[] = {
40634 [DRM_I915_BATCHBUFFER] = compat_i915_batchbuffer,
40635 [DRM_I915_CMDBUFFER] = compat_i915_cmdbuffer,
40636 [DRM_I915_GETPARAM] = compat_i915_getparam,
40637 @@ -202,18 +202,15 @@ static drm_ioctl_compat_t *i915_compat_ioctls[] = {
40638 long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
40639 {
40640 unsigned int nr = DRM_IOCTL_NR(cmd);
40641 - drm_ioctl_compat_t *fn = NULL;
40642 int ret;
40643
40644 if (nr < DRM_COMMAND_BASE)
40645 return drm_compat_ioctl(filp, cmd, arg);
40646
40647 - if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(i915_compat_ioctls))
40648 - fn = i915_compat_ioctls[nr - DRM_COMMAND_BASE];
40649 -
40650 - if (fn != NULL)
40651 + if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(i915_compat_ioctls)) {
40652 + drm_ioctl_compat_t fn = i915_compat_ioctls[nr - DRM_COMMAND_BASE];
40653 ret = (*fn) (filp, cmd, arg);
40654 - else
40655 + } else
40656 ret = drm_ioctl(filp, cmd, arg);
40657
40658 return ret;
40659 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
40660 index d554169..f4426bb 100644
40661 --- a/drivers/gpu/drm/i915/i915_irq.c
40662 +++ b/drivers/gpu/drm/i915/i915_irq.c
40663 @@ -1438,7 +1438,7 @@ static irqreturn_t valleyview_irq_handler(int irq, void *arg)
40664 int pipe;
40665 u32 pipe_stats[I915_MAX_PIPES];
40666
40667 - atomic_inc(&dev_priv->irq_received);
40668 + atomic_inc_unchecked(&dev_priv->irq_received);
40669
40670 while (true) {
40671 iir = I915_READ(VLV_IIR);
40672 @@ -1751,7 +1751,7 @@ static irqreturn_t ironlake_irq_handler(int irq, void *arg)
40673 u32 de_iir, gt_iir, de_ier, sde_ier = 0;
40674 irqreturn_t ret = IRQ_NONE;
40675
40676 - atomic_inc(&dev_priv->irq_received);
40677 + atomic_inc_unchecked(&dev_priv->irq_received);
40678
40679 /* We get interrupts on unclaimed registers, so check for this before we
40680 * do any I915_{READ,WRITE}. */
40681 @@ -1821,7 +1821,7 @@ static irqreturn_t gen8_irq_handler(int irq, void *arg)
40682 uint32_t tmp = 0;
40683 enum pipe pipe;
40684
40685 - atomic_inc(&dev_priv->irq_received);
40686 + atomic_inc_unchecked(&dev_priv->irq_received);
40687
40688 master_ctl = I915_READ(GEN8_MASTER_IRQ);
40689 master_ctl &= ~GEN8_MASTER_IRQ_CONTROL;
40690 @@ -2645,7 +2645,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
40691 {
40692 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
40693
40694 - atomic_set(&dev_priv->irq_received, 0);
40695 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40696
40697 I915_WRITE(HWSTAM, 0xeffe);
40698
40699 @@ -2663,7 +2663,7 @@ static void valleyview_irq_preinstall(struct drm_device *dev)
40700 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
40701 int pipe;
40702
40703 - atomic_set(&dev_priv->irq_received, 0);
40704 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40705
40706 /* VLV magic */
40707 I915_WRITE(VLV_IMR, 0);
40708 @@ -2694,7 +2694,7 @@ static void gen8_irq_preinstall(struct drm_device *dev)
40709 struct drm_i915_private *dev_priv = dev->dev_private;
40710 int pipe;
40711
40712 - atomic_set(&dev_priv->irq_received, 0);
40713 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40714
40715 I915_WRITE(GEN8_MASTER_IRQ, 0);
40716 POSTING_READ(GEN8_MASTER_IRQ);
40717 @@ -3018,7 +3018,7 @@ static void gen8_irq_uninstall(struct drm_device *dev)
40718 if (!dev_priv)
40719 return;
40720
40721 - atomic_set(&dev_priv->irq_received, 0);
40722 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40723
40724 I915_WRITE(GEN8_MASTER_IRQ, 0);
40725
40726 @@ -3112,7 +3112,7 @@ static void i8xx_irq_preinstall(struct drm_device * dev)
40727 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
40728 int pipe;
40729
40730 - atomic_set(&dev_priv->irq_received, 0);
40731 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40732
40733 for_each_pipe(pipe)
40734 I915_WRITE(PIPESTAT(pipe), 0);
40735 @@ -3198,7 +3198,7 @@ static irqreturn_t i8xx_irq_handler(int irq, void *arg)
40736 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
40737 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
40738
40739 - atomic_inc(&dev_priv->irq_received);
40740 + atomic_inc_unchecked(&dev_priv->irq_received);
40741
40742 iir = I915_READ16(IIR);
40743 if (iir == 0)
40744 @@ -3277,7 +3277,7 @@ static void i915_irq_preinstall(struct drm_device * dev)
40745 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
40746 int pipe;
40747
40748 - atomic_set(&dev_priv->irq_received, 0);
40749 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40750
40751 if (I915_HAS_HOTPLUG(dev)) {
40752 I915_WRITE(PORT_HOTPLUG_EN, 0);
40753 @@ -3384,7 +3384,7 @@ static irqreturn_t i915_irq_handler(int irq, void *arg)
40754 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
40755 int pipe, ret = IRQ_NONE;
40756
40757 - atomic_inc(&dev_priv->irq_received);
40758 + atomic_inc_unchecked(&dev_priv->irq_received);
40759
40760 iir = I915_READ(IIR);
40761 do {
40762 @@ -3511,7 +3511,7 @@ static void i965_irq_preinstall(struct drm_device * dev)
40763 drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
40764 int pipe;
40765
40766 - atomic_set(&dev_priv->irq_received, 0);
40767 + atomic_set_unchecked(&dev_priv->irq_received, 0);
40768
40769 I915_WRITE(PORT_HOTPLUG_EN, 0);
40770 I915_WRITE(PORT_HOTPLUG_STAT, I915_READ(PORT_HOTPLUG_STAT));
40771 @@ -3627,7 +3627,7 @@ static irqreturn_t i965_irq_handler(int irq, void *arg)
40772 I915_DISPLAY_PLANE_A_FLIP_PENDING_INTERRUPT |
40773 I915_DISPLAY_PLANE_B_FLIP_PENDING_INTERRUPT;
40774
40775 - atomic_inc(&dev_priv->irq_received);
40776 + atomic_inc_unchecked(&dev_priv->irq_received);
40777
40778 iir = I915_READ(IIR);
40779
40780 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
40781 index 963639d..ea0c0cb 100644
40782 --- a/drivers/gpu/drm/i915/intel_display.c
40783 +++ b/drivers/gpu/drm/i915/intel_display.c
40784 @@ -10787,13 +10787,13 @@ struct intel_quirk {
40785 int subsystem_vendor;
40786 int subsystem_device;
40787 void (*hook)(struct drm_device *dev);
40788 -};
40789 +} __do_const;
40790
40791 /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
40792 struct intel_dmi_quirk {
40793 void (*hook)(struct drm_device *dev);
40794 const struct dmi_system_id (*dmi_id_list)[];
40795 -};
40796 +} __do_const;
40797
40798 static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
40799 {
40800 @@ -10801,18 +10801,20 @@ static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
40801 return 1;
40802 }
40803
40804 -static const struct intel_dmi_quirk intel_dmi_quirks[] = {
40805 +static const struct dmi_system_id intel_dmi_quirks_table[] = {
40806 {
40807 - .dmi_id_list = &(const struct dmi_system_id[]) {
40808 - {
40809 - .callback = intel_dmi_reverse_brightness,
40810 - .ident = "NCR Corporation",
40811 - .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
40812 - DMI_MATCH(DMI_PRODUCT_NAME, ""),
40813 - },
40814 - },
40815 - { } /* terminating entry */
40816 + .callback = intel_dmi_reverse_brightness,
40817 + .ident = "NCR Corporation",
40818 + .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
40819 + DMI_MATCH(DMI_PRODUCT_NAME, ""),
40820 },
40821 + },
40822 + { } /* terminating entry */
40823 +};
40824 +
40825 +static const struct intel_dmi_quirk intel_dmi_quirks[] = {
40826 + {
40827 + .dmi_id_list = &intel_dmi_quirks_table,
40828 .hook = quirk_invert_brightness,
40829 },
40830 };
40831 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
40832 index fe45321..836fdca 100644
40833 --- a/drivers/gpu/drm/mga/mga_drv.h
40834 +++ b/drivers/gpu/drm/mga/mga_drv.h
40835 @@ -120,9 +120,9 @@ typedef struct drm_mga_private {
40836 u32 clear_cmd;
40837 u32 maccess;
40838
40839 - atomic_t vbl_received; /**< Number of vblanks received. */
40840 + atomic_unchecked_t vbl_received; /**< Number of vblanks received. */
40841 wait_queue_head_t fence_queue;
40842 - atomic_t last_fence_retired;
40843 + atomic_unchecked_t last_fence_retired;
40844 u32 next_fence_to_post;
40845
40846 unsigned int fb_cpp;
40847 diff --git a/drivers/gpu/drm/mga/mga_ioc32.c b/drivers/gpu/drm/mga/mga_ioc32.c
40848 index 86b4bb8..ae237ad 100644
40849 --- a/drivers/gpu/drm/mga/mga_ioc32.c
40850 +++ b/drivers/gpu/drm/mga/mga_ioc32.c
40851 @@ -190,7 +190,7 @@ static int compat_mga_dma_bootstrap(struct file *file, unsigned int cmd,
40852 return 0;
40853 }
40854
40855 -drm_ioctl_compat_t *mga_compat_ioctls[] = {
40856 +drm_ioctl_compat_t mga_compat_ioctls[] = {
40857 [DRM_MGA_INIT] = compat_mga_init,
40858 [DRM_MGA_GETPARAM] = compat_mga_getparam,
40859 [DRM_MGA_DMA_BOOTSTRAP] = compat_mga_dma_bootstrap,
40860 @@ -208,18 +208,15 @@ drm_ioctl_compat_t *mga_compat_ioctls[] = {
40861 long mga_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
40862 {
40863 unsigned int nr = DRM_IOCTL_NR(cmd);
40864 - drm_ioctl_compat_t *fn = NULL;
40865 int ret;
40866
40867 if (nr < DRM_COMMAND_BASE)
40868 return drm_compat_ioctl(filp, cmd, arg);
40869
40870 - if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(mga_compat_ioctls))
40871 - fn = mga_compat_ioctls[nr - DRM_COMMAND_BASE];
40872 -
40873 - if (fn != NULL)
40874 + if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(mga_compat_ioctls)) {
40875 + drm_ioctl_compat_t fn = mga_compat_ioctls[nr - DRM_COMMAND_BASE];
40876 ret = (*fn) (filp, cmd, arg);
40877 - else
40878 + } else
40879 ret = drm_ioctl(filp, cmd, arg);
40880
40881 return ret;
40882 diff --git a/drivers/gpu/drm/mga/mga_irq.c b/drivers/gpu/drm/mga/mga_irq.c
40883 index 1b071b8..de8601a 100644
40884 --- a/drivers/gpu/drm/mga/mga_irq.c
40885 +++ b/drivers/gpu/drm/mga/mga_irq.c
40886 @@ -43,7 +43,7 @@ u32 mga_get_vblank_counter(struct drm_device *dev, int crtc)
40887 if (crtc != 0)
40888 return 0;
40889
40890 - return atomic_read(&dev_priv->vbl_received);
40891 + return atomic_read_unchecked(&dev_priv->vbl_received);
40892 }
40893
40894
40895 @@ -59,7 +59,7 @@ irqreturn_t mga_driver_irq_handler(int irq, void *arg)
40896 /* VBLANK interrupt */
40897 if (status & MGA_VLINEPEN) {
40898 MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
40899 - atomic_inc(&dev_priv->vbl_received);
40900 + atomic_inc_unchecked(&dev_priv->vbl_received);
40901 drm_handle_vblank(dev, 0);
40902 handled = 1;
40903 }
40904 @@ -78,7 +78,7 @@ irqreturn_t mga_driver_irq_handler(int irq, void *arg)
40905 if ((prim_start & ~0x03) != (prim_end & ~0x03))
40906 MGA_WRITE(MGA_PRIMEND, prim_end);
40907
40908 - atomic_inc(&dev_priv->last_fence_retired);
40909 + atomic_inc_unchecked(&dev_priv->last_fence_retired);
40910 wake_up(&dev_priv->fence_queue);
40911 handled = 1;
40912 }
40913 @@ -129,7 +129,7 @@ int mga_driver_fence_wait(struct drm_device *dev, unsigned int *sequence)
40914 * using fences.
40915 */
40916 DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * HZ,
40917 - (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
40918 + (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
40919 - *sequence) <= (1 << 23)));
40920
40921 *sequence = cur_fence;
40922 diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
40923 index 4c3feaa..26391ce 100644
40924 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c
40925 +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
40926 @@ -965,7 +965,7 @@ static int parse_bit_tmds_tbl_entry(struct drm_device *dev, struct nvbios *bios,
40927 struct bit_table {
40928 const char id;
40929 int (* const parse_fn)(struct drm_device *, struct nvbios *, struct bit_entry *);
40930 -};
40931 +} __no_const;
40932
40933 #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
40934
40935 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.h b/drivers/gpu/drm/nouveau/nouveau_drm.h
40936 index 23ca7a5..b6c955d 100644
40937 --- a/drivers/gpu/drm/nouveau/nouveau_drm.h
40938 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.h
40939 @@ -97,7 +97,6 @@ struct nouveau_drm {
40940 struct drm_global_reference mem_global_ref;
40941 struct ttm_bo_global_ref bo_global_ref;
40942 struct ttm_bo_device bdev;
40943 - atomic_t validate_sequence;
40944 int (*move)(struct nouveau_channel *,
40945 struct ttm_buffer_object *,
40946 struct ttm_mem_reg *, struct ttm_mem_reg *);
40947 diff --git a/drivers/gpu/drm/nouveau/nouveau_ioc32.c b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
40948 index c1a7e5a..38b8539 100644
40949 --- a/drivers/gpu/drm/nouveau/nouveau_ioc32.c
40950 +++ b/drivers/gpu/drm/nouveau/nouveau_ioc32.c
40951 @@ -50,7 +50,7 @@ long nouveau_compat_ioctl(struct file *filp, unsigned int cmd,
40952 unsigned long arg)
40953 {
40954 unsigned int nr = DRM_IOCTL_NR(cmd);
40955 - drm_ioctl_compat_t *fn = NULL;
40956 + drm_ioctl_compat_t fn = NULL;
40957 int ret;
40958
40959 if (nr < DRM_COMMAND_BASE)
40960 diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
40961 index d45d50d..72a5dd2 100644
40962 --- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
40963 +++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
40964 @@ -130,11 +130,11 @@ nouveau_vram_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
40965 }
40966
40967 const struct ttm_mem_type_manager_func nouveau_vram_manager = {
40968 - nouveau_vram_manager_init,
40969 - nouveau_vram_manager_fini,
40970 - nouveau_vram_manager_new,
40971 - nouveau_vram_manager_del,
40972 - nouveau_vram_manager_debug
40973 + .init = nouveau_vram_manager_init,
40974 + .takedown = nouveau_vram_manager_fini,
40975 + .get_node = nouveau_vram_manager_new,
40976 + .put_node = nouveau_vram_manager_del,
40977 + .debug = nouveau_vram_manager_debug
40978 };
40979
40980 static int
40981 @@ -199,11 +199,11 @@ nouveau_gart_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
40982 }
40983
40984 const struct ttm_mem_type_manager_func nouveau_gart_manager = {
40985 - nouveau_gart_manager_init,
40986 - nouveau_gart_manager_fini,
40987 - nouveau_gart_manager_new,
40988 - nouveau_gart_manager_del,
40989 - nouveau_gart_manager_debug
40990 + .init = nouveau_gart_manager_init,
40991 + .takedown = nouveau_gart_manager_fini,
40992 + .get_node = nouveau_gart_manager_new,
40993 + .put_node = nouveau_gart_manager_del,
40994 + .debug = nouveau_gart_manager_debug
40995 };
40996
40997 #include <core/subdev/vm/nv04.h>
40998 @@ -271,11 +271,11 @@ nv04_gart_manager_debug(struct ttm_mem_type_manager *man, const char *prefix)
40999 }
41000
41001 const struct ttm_mem_type_manager_func nv04_gart_manager = {
41002 - nv04_gart_manager_init,
41003 - nv04_gart_manager_fini,
41004 - nv04_gart_manager_new,
41005 - nv04_gart_manager_del,
41006 - nv04_gart_manager_debug
41007 + .init = nv04_gart_manager_init,
41008 + .takedown = nv04_gart_manager_fini,
41009 + .get_node = nv04_gart_manager_new,
41010 + .put_node = nv04_gart_manager_del,
41011 + .debug = nv04_gart_manager_debug
41012 };
41013
41014 int
41015 diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
41016 index 471347e..5adc6b9 100644
41017 --- a/drivers/gpu/drm/nouveau/nouveau_vga.c
41018 +++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
41019 @@ -67,7 +67,7 @@ nouveau_switcheroo_can_switch(struct pci_dev *pdev)
41020 bool can_switch;
41021
41022 spin_lock(&dev->count_lock);
41023 - can_switch = (dev->open_count == 0);
41024 + can_switch = (local_read(&dev->open_count) == 0);
41025 spin_unlock(&dev->count_lock);
41026 return can_switch;
41027 }
41028 diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
41029 index eb89653..613cf71 100644
41030 --- a/drivers/gpu/drm/qxl/qxl_cmd.c
41031 +++ b/drivers/gpu/drm/qxl/qxl_cmd.c
41032 @@ -285,27 +285,27 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port,
41033 int ret;
41034
41035 mutex_lock(&qdev->async_io_mutex);
41036 - irq_num = atomic_read(&qdev->irq_received_io_cmd);
41037 + irq_num = atomic_read_unchecked(&qdev->irq_received_io_cmd);
41038 if (qdev->last_sent_io_cmd > irq_num) {
41039 if (intr)
41040 ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
41041 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41042 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41043 else
41044 ret = wait_event_timeout(qdev->io_cmd_event,
41045 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41046 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41047 /* 0 is timeout, just bail the "hw" has gone away */
41048 if (ret <= 0)
41049 goto out;
41050 - irq_num = atomic_read(&qdev->irq_received_io_cmd);
41051 + irq_num = atomic_read_unchecked(&qdev->irq_received_io_cmd);
41052 }
41053 outb(val, addr);
41054 qdev->last_sent_io_cmd = irq_num + 1;
41055 if (intr)
41056 ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
41057 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41058 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41059 else
41060 ret = wait_event_timeout(qdev->io_cmd_event,
41061 - atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41062 + atomic_read_unchecked(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
41063 out:
41064 if (ret > 0)
41065 ret = 0;
41066 diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c
41067 index c3c2bbd..bc3c0fb 100644
41068 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c
41069 +++ b/drivers/gpu/drm/qxl/qxl_debugfs.c
41070 @@ -42,10 +42,10 @@ qxl_debugfs_irq_received(struct seq_file *m, void *data)
41071 struct drm_info_node *node = (struct drm_info_node *) m->private;
41072 struct qxl_device *qdev = node->minor->dev->dev_private;
41073
41074 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received));
41075 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_display));
41076 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_cursor));
41077 - seq_printf(m, "%d\n", atomic_read(&qdev->irq_received_io_cmd));
41078 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received));
41079 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_display));
41080 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_cursor));
41081 + seq_printf(m, "%d\n", atomic_read_unchecked(&qdev->irq_received_io_cmd));
41082 seq_printf(m, "%d\n", qdev->irq_received_error);
41083 return 0;
41084 }
41085 diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
41086 index 36ed40b..0397633 100644
41087 --- a/drivers/gpu/drm/qxl/qxl_drv.h
41088 +++ b/drivers/gpu/drm/qxl/qxl_drv.h
41089 @@ -290,10 +290,10 @@ struct qxl_device {
41090 unsigned int last_sent_io_cmd;
41091
41092 /* interrupt handling */
41093 - atomic_t irq_received;
41094 - atomic_t irq_received_display;
41095 - atomic_t irq_received_cursor;
41096 - atomic_t irq_received_io_cmd;
41097 + atomic_unchecked_t irq_received;
41098 + atomic_unchecked_t irq_received_display;
41099 + atomic_unchecked_t irq_received_cursor;
41100 + atomic_unchecked_t irq_received_io_cmd;
41101 unsigned irq_received_error;
41102 wait_queue_head_t display_event;
41103 wait_queue_head_t cursor_event;
41104 diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
41105 index 0bb86e6..d41416d 100644
41106 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c
41107 +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
41108 @@ -181,7 +181,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
41109
41110 /* TODO copy slow path code from i915 */
41111 fb_cmd = qxl_bo_kmap_atomic_page(qdev, cmd_bo, (release->release_offset & PAGE_SIZE));
41112 - unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void *)(unsigned long)cmd->command, cmd->command_size);
41113 + unwritten = __copy_from_user_inatomic_nocache(fb_cmd + sizeof(union qxl_release_info) + (release->release_offset & ~PAGE_SIZE), (void __force_user *)(unsigned long)cmd->command, cmd->command_size);
41114
41115 {
41116 struct qxl_drawable *draw = fb_cmd;
41117 @@ -201,7 +201,7 @@ static int qxl_process_single_command(struct qxl_device *qdev,
41118 struct drm_qxl_reloc reloc;
41119
41120 if (copy_from_user(&reloc,
41121 - &((struct drm_qxl_reloc *)(uintptr_t)cmd->relocs)[i],
41122 + &((struct drm_qxl_reloc __force_user *)(uintptr_t)cmd->relocs)[i],
41123 sizeof(reloc))) {
41124 ret = -EFAULT;
41125 goto out_free_bos;
41126 @@ -294,10 +294,10 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
41127
41128 for (cmd_num = 0; cmd_num < execbuffer->commands_num; ++cmd_num) {
41129
41130 - struct drm_qxl_command *commands =
41131 - (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
41132 + struct drm_qxl_command __user *commands =
41133 + (struct drm_qxl_command __user *)(uintptr_t)execbuffer->commands;
41134
41135 - if (copy_from_user(&user_cmd, &commands[cmd_num],
41136 + if (copy_from_user(&user_cmd, (struct drm_qxl_command __force_user *)&commands[cmd_num],
41137 sizeof(user_cmd)))
41138 return -EFAULT;
41139
41140 diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c
41141 index 28f84b4..fb3e224 100644
41142 --- a/drivers/gpu/drm/qxl/qxl_irq.c
41143 +++ b/drivers/gpu/drm/qxl/qxl_irq.c
41144 @@ -33,19 +33,19 @@ irqreturn_t qxl_irq_handler(int irq, void *arg)
41145
41146 pending = xchg(&qdev->ram_header->int_pending, 0);
41147
41148 - atomic_inc(&qdev->irq_received);
41149 + atomic_inc_unchecked(&qdev->irq_received);
41150
41151 if (pending & QXL_INTERRUPT_DISPLAY) {
41152 - atomic_inc(&qdev->irq_received_display);
41153 + atomic_inc_unchecked(&qdev->irq_received_display);
41154 wake_up_all(&qdev->display_event);
41155 qxl_queue_garbage_collect(qdev, false);
41156 }
41157 if (pending & QXL_INTERRUPT_CURSOR) {
41158 - atomic_inc(&qdev->irq_received_cursor);
41159 + atomic_inc_unchecked(&qdev->irq_received_cursor);
41160 wake_up_all(&qdev->cursor_event);
41161 }
41162 if (pending & QXL_INTERRUPT_IO_CMD) {
41163 - atomic_inc(&qdev->irq_received_io_cmd);
41164 + atomic_inc_unchecked(&qdev->irq_received_io_cmd);
41165 wake_up_all(&qdev->io_cmd_event);
41166 }
41167 if (pending & QXL_INTERRUPT_ERROR) {
41168 @@ -82,10 +82,10 @@ int qxl_irq_init(struct qxl_device *qdev)
41169 init_waitqueue_head(&qdev->io_cmd_event);
41170 INIT_WORK(&qdev->client_monitors_config_work,
41171 qxl_client_monitors_config_work_func);
41172 - atomic_set(&qdev->irq_received, 0);
41173 - atomic_set(&qdev->irq_received_display, 0);
41174 - atomic_set(&qdev->irq_received_cursor, 0);
41175 - atomic_set(&qdev->irq_received_io_cmd, 0);
41176 + atomic_set_unchecked(&qdev->irq_received, 0);
41177 + atomic_set_unchecked(&qdev->irq_received_display, 0);
41178 + atomic_set_unchecked(&qdev->irq_received_cursor, 0);
41179 + atomic_set_unchecked(&qdev->irq_received_io_cmd, 0);
41180 qdev->irq_received_error = 0;
41181 ret = drm_irq_install(qdev->ddev);
41182 qdev->ram_header->int_mask = QXL_INTERRUPT_MASK;
41183 diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
41184 index c82c1d6a9..6158c02 100644
41185 --- a/drivers/gpu/drm/qxl/qxl_ttm.c
41186 +++ b/drivers/gpu/drm/qxl/qxl_ttm.c
41187 @@ -103,7 +103,7 @@ static void qxl_ttm_global_fini(struct qxl_device *qdev)
41188 }
41189 }
41190
41191 -static struct vm_operations_struct qxl_ttm_vm_ops;
41192 +static vm_operations_struct_no_const qxl_ttm_vm_ops __read_only;
41193 static const struct vm_operations_struct *ttm_vm_ops;
41194
41195 static int qxl_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
41196 @@ -147,8 +147,10 @@ int qxl_mmap(struct file *filp, struct vm_area_struct *vma)
41197 return r;
41198 if (unlikely(ttm_vm_ops == NULL)) {
41199 ttm_vm_ops = vma->vm_ops;
41200 + pax_open_kernel();
41201 qxl_ttm_vm_ops = *ttm_vm_ops;
41202 qxl_ttm_vm_ops.fault = &qxl_ttm_fault;
41203 + pax_close_kernel();
41204 }
41205 vma->vm_ops = &qxl_ttm_vm_ops;
41206 return 0;
41207 @@ -561,25 +563,23 @@ static int qxl_mm_dump_table(struct seq_file *m, void *data)
41208 static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
41209 {
41210 #if defined(CONFIG_DEBUG_FS)
41211 - static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES];
41212 - static char qxl_mem_types_names[QXL_DEBUGFS_MEM_TYPES][32];
41213 - unsigned i;
41214 + static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES] = {
41215 + {
41216 + .name = "qxl_mem_mm",
41217 + .show = &qxl_mm_dump_table,
41218 + },
41219 + {
41220 + .name = "qxl_surf_mm",
41221 + .show = &qxl_mm_dump_table,
41222 + }
41223 + };
41224
41225 - for (i = 0; i < QXL_DEBUGFS_MEM_TYPES; i++) {
41226 - if (i == 0)
41227 - sprintf(qxl_mem_types_names[i], "qxl_mem_mm");
41228 - else
41229 - sprintf(qxl_mem_types_names[i], "qxl_surf_mm");
41230 - qxl_mem_types_list[i].name = qxl_mem_types_names[i];
41231 - qxl_mem_types_list[i].show = &qxl_mm_dump_table;
41232 - qxl_mem_types_list[i].driver_features = 0;
41233 - if (i == 0)
41234 - qxl_mem_types_list[i].data = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
41235 - else
41236 - qxl_mem_types_list[i].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
41237 + pax_open_kernel();
41238 + *(void **)&qxl_mem_types_list[0].data = qdev->mman.bdev.man[TTM_PL_VRAM].priv;
41239 + *(void **)&qxl_mem_types_list[1].data = qdev->mman.bdev.man[TTM_PL_PRIV0].priv;
41240 + pax_close_kernel();
41241
41242 - }
41243 - return qxl_debugfs_add_files(qdev, qxl_mem_types_list, i);
41244 + return qxl_debugfs_add_files(qdev, qxl_mem_types_list, QXL_DEBUGFS_MEM_TYPES);
41245 #else
41246 return 0;
41247 #endif
41248 diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
41249 index 59459fe..be26b31 100644
41250 --- a/drivers/gpu/drm/r128/r128_cce.c
41251 +++ b/drivers/gpu/drm/r128/r128_cce.c
41252 @@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_device *dev, drm_r128_init_t *init)
41253
41254 /* GH: Simple idle check.
41255 */
41256 - atomic_set(&dev_priv->idle_count, 0);
41257 + atomic_set_unchecked(&dev_priv->idle_count, 0);
41258
41259 /* We don't support anything other than bus-mastering ring mode,
41260 * but the ring can be in either AGP or PCI space for the ring
41261 diff --git a/drivers/gpu/drm/r128/r128_drv.h b/drivers/gpu/drm/r128/r128_drv.h
41262 index 5bf3f5f..7000661 100644
41263 --- a/drivers/gpu/drm/r128/r128_drv.h
41264 +++ b/drivers/gpu/drm/r128/r128_drv.h
41265 @@ -90,14 +90,14 @@ typedef struct drm_r128_private {
41266 int is_pci;
41267 unsigned long cce_buffers_offset;
41268
41269 - atomic_t idle_count;
41270 + atomic_unchecked_t idle_count;
41271
41272 int page_flipping;
41273 int current_page;
41274 u32 crtc_offset;
41275 u32 crtc_offset_cntl;
41276
41277 - atomic_t vbl_received;
41278 + atomic_unchecked_t vbl_received;
41279
41280 u32 color_fmt;
41281 unsigned int front_offset;
41282 diff --git a/drivers/gpu/drm/r128/r128_ioc32.c b/drivers/gpu/drm/r128/r128_ioc32.c
41283 index b0d0fd3..a6fbbe4 100644
41284 --- a/drivers/gpu/drm/r128/r128_ioc32.c
41285 +++ b/drivers/gpu/drm/r128/r128_ioc32.c
41286 @@ -178,7 +178,7 @@ static int compat_r128_getparam(struct file *file, unsigned int cmd,
41287 return drm_ioctl(file, DRM_IOCTL_R128_GETPARAM, (unsigned long)getparam);
41288 }
41289
41290 -drm_ioctl_compat_t *r128_compat_ioctls[] = {
41291 +drm_ioctl_compat_t r128_compat_ioctls[] = {
41292 [DRM_R128_INIT] = compat_r128_init,
41293 [DRM_R128_DEPTH] = compat_r128_depth,
41294 [DRM_R128_STIPPLE] = compat_r128_stipple,
41295 @@ -197,18 +197,15 @@ drm_ioctl_compat_t *r128_compat_ioctls[] = {
41296 long r128_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41297 {
41298 unsigned int nr = DRM_IOCTL_NR(cmd);
41299 - drm_ioctl_compat_t *fn = NULL;
41300 int ret;
41301
41302 if (nr < DRM_COMMAND_BASE)
41303 return drm_compat_ioctl(filp, cmd, arg);
41304
41305 - if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(r128_compat_ioctls))
41306 - fn = r128_compat_ioctls[nr - DRM_COMMAND_BASE];
41307 -
41308 - if (fn != NULL)
41309 + if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(r128_compat_ioctls)) {
41310 + drm_ioctl_compat_t fn = r128_compat_ioctls[nr - DRM_COMMAND_BASE];
41311 ret = (*fn) (filp, cmd, arg);
41312 - else
41313 + } else
41314 ret = drm_ioctl(filp, cmd, arg);
41315
41316 return ret;
41317 diff --git a/drivers/gpu/drm/r128/r128_irq.c b/drivers/gpu/drm/r128/r128_irq.c
41318 index c2ae496..30b5993 100644
41319 --- a/drivers/gpu/drm/r128/r128_irq.c
41320 +++ b/drivers/gpu/drm/r128/r128_irq.c
41321 @@ -41,7 +41,7 @@ u32 r128_get_vblank_counter(struct drm_device *dev, int crtc)
41322 if (crtc != 0)
41323 return 0;
41324
41325 - return atomic_read(&dev_priv->vbl_received);
41326 + return atomic_read_unchecked(&dev_priv->vbl_received);
41327 }
41328
41329 irqreturn_t r128_driver_irq_handler(int irq, void *arg)
41330 @@ -55,7 +55,7 @@ irqreturn_t r128_driver_irq_handler(int irq, void *arg)
41331 /* VBLANK interrupt */
41332 if (status & R128_CRTC_VBLANK_INT) {
41333 R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
41334 - atomic_inc(&dev_priv->vbl_received);
41335 + atomic_inc_unchecked(&dev_priv->vbl_received);
41336 drm_handle_vblank(dev, 0);
41337 return IRQ_HANDLED;
41338 }
41339 diff --git a/drivers/gpu/drm/r128/r128_state.c b/drivers/gpu/drm/r128/r128_state.c
41340 index e806dac..f81d32f 100644
41341 --- a/drivers/gpu/drm/r128/r128_state.c
41342 +++ b/drivers/gpu/drm/r128/r128_state.c
41343 @@ -320,10 +320,10 @@ static void r128_clear_box(drm_r128_private_t *dev_priv,
41344
41345 static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
41346 {
41347 - if (atomic_read(&dev_priv->idle_count) == 0)
41348 + if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
41349 r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
41350 else
41351 - atomic_set(&dev_priv->idle_count, 0);
41352 + atomic_set_unchecked(&dev_priv->idle_count, 0);
41353 }
41354
41355 #endif
41356 diff --git a/drivers/gpu/drm/radeon/mkregtable.c b/drivers/gpu/drm/radeon/mkregtable.c
41357 index 4a85bb6..aaea819 100644
41358 --- a/drivers/gpu/drm/radeon/mkregtable.c
41359 +++ b/drivers/gpu/drm/radeon/mkregtable.c
41360 @@ -624,14 +624,14 @@ static int parser_auth(struct table *t, const char *filename)
41361 regex_t mask_rex;
41362 regmatch_t match[4];
41363 char buf[1024];
41364 - size_t end;
41365 + long end;
41366 int len;
41367 int done = 0;
41368 int r;
41369 unsigned o;
41370 struct offset *offset;
41371 char last_reg_s[10];
41372 - int last_reg;
41373 + unsigned long last_reg;
41374
41375 if (regcomp
41376 (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
41377 diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
41378 index 044bc98..50ced9b 100644
41379 --- a/drivers/gpu/drm/radeon/radeon_device.c
41380 +++ b/drivers/gpu/drm/radeon/radeon_device.c
41381 @@ -1125,7 +1125,7 @@ static bool radeon_switcheroo_can_switch(struct pci_dev *pdev)
41382 bool can_switch;
41383
41384 spin_lock(&dev->count_lock);
41385 - can_switch = (dev->open_count == 0);
41386 + can_switch = (local_read(&dev->open_count) == 0);
41387 spin_unlock(&dev->count_lock);
41388 return can_switch;
41389 }
41390 diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
41391 index dafd812..1bf20c7 100644
41392 --- a/drivers/gpu/drm/radeon/radeon_drv.h
41393 +++ b/drivers/gpu/drm/radeon/radeon_drv.h
41394 @@ -262,7 +262,7 @@ typedef struct drm_radeon_private {
41395
41396 /* SW interrupt */
41397 wait_queue_head_t swi_queue;
41398 - atomic_t swi_emitted;
41399 + atomic_unchecked_t swi_emitted;
41400 int vblank_crtc;
41401 uint32_t irq_enable_reg;
41402 uint32_t r500_disp_irq_reg;
41403 diff --git a/drivers/gpu/drm/radeon/radeon_ioc32.c b/drivers/gpu/drm/radeon/radeon_ioc32.c
41404 index bdb0f93..5ff558f 100644
41405 --- a/drivers/gpu/drm/radeon/radeon_ioc32.c
41406 +++ b/drivers/gpu/drm/radeon/radeon_ioc32.c
41407 @@ -358,7 +358,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
41408 request = compat_alloc_user_space(sizeof(*request));
41409 if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
41410 || __put_user(req32.param, &request->param)
41411 - || __put_user((void __user *)(unsigned long)req32.value,
41412 + || __put_user((unsigned long)req32.value,
41413 &request->value))
41414 return -EFAULT;
41415
41416 @@ -368,7 +368,7 @@ static int compat_radeon_cp_setparam(struct file *file, unsigned int cmd,
41417 #define compat_radeon_cp_setparam NULL
41418 #endif /* X86_64 || IA64 */
41419
41420 -static drm_ioctl_compat_t *radeon_compat_ioctls[] = {
41421 +static drm_ioctl_compat_t radeon_compat_ioctls[] = {
41422 [DRM_RADEON_CP_INIT] = compat_radeon_cp_init,
41423 [DRM_RADEON_CLEAR] = compat_radeon_cp_clear,
41424 [DRM_RADEON_STIPPLE] = compat_radeon_cp_stipple,
41425 @@ -393,18 +393,15 @@ static drm_ioctl_compat_t *radeon_compat_ioctls[] = {
41426 long radeon_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
41427 {
41428 unsigned int nr = DRM_IOCTL_NR(cmd);
41429 - drm_ioctl_compat_t *fn = NULL;
41430 int ret;
41431
41432 if (nr < DRM_COMMAND_BASE)
41433 return drm_compat_ioctl(filp, cmd, arg);
41434
41435 - if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(radeon_compat_ioctls))
41436 - fn = radeon_compat_ioctls[nr - DRM_COMMAND_BASE];
41437 -
41438 - if (fn != NULL)
41439 + if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(radeon_compat_ioctls)) {
41440 + drm_ioctl_compat_t fn = radeon_compat_ioctls[nr - DRM_COMMAND_BASE];
41441 ret = (*fn) (filp, cmd, arg);
41442 - else
41443 + } else
41444 ret = drm_ioctl(filp, cmd, arg);
41445
41446 return ret;
41447 diff --git a/drivers/gpu/drm/radeon/radeon_irq.c b/drivers/gpu/drm/radeon/radeon_irq.c
41448 index 244b19b..c19226d 100644
41449 --- a/drivers/gpu/drm/radeon/radeon_irq.c
41450 +++ b/drivers/gpu/drm/radeon/radeon_irq.c
41451 @@ -226,8 +226,8 @@ static int radeon_emit_irq(struct drm_device * dev)
41452 unsigned int ret;
41453 RING_LOCALS;
41454
41455 - atomic_inc(&dev_priv->swi_emitted);
41456 - ret = atomic_read(&dev_priv->swi_emitted);
41457 + atomic_inc_unchecked(&dev_priv->swi_emitted);
41458 + ret = atomic_read_unchecked(&dev_priv->swi_emitted);
41459
41460 BEGIN_RING(4);
41461 OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
41462 @@ -353,7 +353,7 @@ int radeon_driver_irq_postinstall(struct drm_device *dev)
41463 drm_radeon_private_t *dev_priv =
41464 (drm_radeon_private_t *) dev->dev_private;
41465
41466 - atomic_set(&dev_priv->swi_emitted, 0);
41467 + atomic_set_unchecked(&dev_priv->swi_emitted, 0);
41468 init_waitqueue_head(&dev_priv->swi_queue);
41469
41470 dev->max_vblank_count = 0x001fffff;
41471 diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
41472 index 956ab7f..fbd36d8 100644
41473 --- a/drivers/gpu/drm/radeon/radeon_state.c
41474 +++ b/drivers/gpu/drm/radeon/radeon_state.c
41475 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_device *dev, void *data, struct drm_file *
41476 if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
41477 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
41478
41479 - if (copy_from_user(&depth_boxes, clear->depth_boxes,
41480 + if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || copy_from_user(&depth_boxes, clear->depth_boxes,
41481 sarea_priv->nbox * sizeof(depth_boxes[0])))
41482 return -EFAULT;
41483
41484 @@ -3031,7 +3031,7 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
41485 {
41486 drm_radeon_private_t *dev_priv = dev->dev_private;
41487 drm_radeon_getparam_t *param = data;
41488 - int value;
41489 + int value = 0;
41490
41491 DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
41492
41493 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
41494 index 040a2a1..eae4e54 100644
41495 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
41496 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
41497 @@ -790,7 +790,7 @@ void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
41498 man->size = size >> PAGE_SHIFT;
41499 }
41500
41501 -static struct vm_operations_struct radeon_ttm_vm_ops;
41502 +static vm_operations_struct_no_const radeon_ttm_vm_ops __read_only;
41503 static const struct vm_operations_struct *ttm_vm_ops = NULL;
41504
41505 static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
41506 @@ -831,8 +831,10 @@ int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
41507 }
41508 if (unlikely(ttm_vm_ops == NULL)) {
41509 ttm_vm_ops = vma->vm_ops;
41510 + pax_open_kernel();
41511 radeon_ttm_vm_ops = *ttm_vm_ops;
41512 radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
41513 + pax_close_kernel();
41514 }
41515 vma->vm_ops = &radeon_ttm_vm_ops;
41516 return 0;
41517 diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
41518 index 9336006..ce78aa7 100644
41519 --- a/drivers/gpu/drm/tegra/dc.c
41520 +++ b/drivers/gpu/drm/tegra/dc.c
41521 @@ -1057,7 +1057,7 @@ static int tegra_dc_debugfs_init(struct tegra_dc *dc, struct drm_minor *minor)
41522 }
41523
41524 for (i = 0; i < ARRAY_SIZE(debugfs_files); i++)
41525 - dc->debugfs_files[i].data = dc;
41526 + *(void **)&dc->debugfs_files[i].data = dc;
41527
41528 err = drm_debugfs_create_files(dc->debugfs_files,
41529 ARRAY_SIZE(debugfs_files),
41530 diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
41531 index d452faab..f8cbc6a 100644
41532 --- a/drivers/gpu/drm/tegra/dsi.c
41533 +++ b/drivers/gpu/drm/tegra/dsi.c
41534 @@ -53,7 +53,7 @@ struct tegra_dsi {
41535 struct clk *clk_lp;
41536 struct clk *clk;
41537
41538 - struct drm_info_list *debugfs_files;
41539 + drm_info_list_no_const *debugfs_files;
41540 struct drm_minor *minor;
41541 struct dentry *debugfs;
41542
41543 diff --git a/drivers/gpu/drm/tegra/hdmi.c b/drivers/gpu/drm/tegra/hdmi.c
41544 index 6928015..c9853e7 100644
41545 --- a/drivers/gpu/drm/tegra/hdmi.c
41546 +++ b/drivers/gpu/drm/tegra/hdmi.c
41547 @@ -59,7 +59,7 @@ struct tegra_hdmi {
41548 bool stereo;
41549 bool dvi;
41550
41551 - struct drm_info_list *debugfs_files;
41552 + drm_info_list_no_const *debugfs_files;
41553 struct drm_minor *minor;
41554 struct dentry *debugfs;
41555 };
41556 diff --git a/drivers/gpu/drm/ttm/ttm_bo_manager.c b/drivers/gpu/drm/ttm/ttm_bo_manager.c
41557 index c58eba33..83c2728 100644
41558 --- a/drivers/gpu/drm/ttm/ttm_bo_manager.c
41559 +++ b/drivers/gpu/drm/ttm/ttm_bo_manager.c
41560 @@ -141,10 +141,10 @@ static void ttm_bo_man_debug(struct ttm_mem_type_manager *man,
41561 }
41562
41563 const struct ttm_mem_type_manager_func ttm_bo_manager_func = {
41564 - ttm_bo_man_init,
41565 - ttm_bo_man_takedown,
41566 - ttm_bo_man_get_node,
41567 - ttm_bo_man_put_node,
41568 - ttm_bo_man_debug
41569 + .init = ttm_bo_man_init,
41570 + .takedown = ttm_bo_man_takedown,
41571 + .get_node = ttm_bo_man_get_node,
41572 + .put_node = ttm_bo_man_put_node,
41573 + .debug = ttm_bo_man_debug
41574 };
41575 EXPORT_SYMBOL(ttm_bo_manager_func);
41576 diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
41577 index dbc2def..0a9f710 100644
41578 --- a/drivers/gpu/drm/ttm/ttm_memory.c
41579 +++ b/drivers/gpu/drm/ttm/ttm_memory.c
41580 @@ -264,7 +264,7 @@ static int ttm_mem_init_kernel_zone(struct ttm_mem_global *glob,
41581 zone->glob = glob;
41582 glob->zone_kernel = zone;
41583 ret = kobject_init_and_add(
41584 - &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, zone->name);
41585 + &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, "%s", zone->name);
41586 if (unlikely(ret != 0)) {
41587 kobject_put(&zone->kobj);
41588 return ret;
41589 @@ -347,7 +347,7 @@ static int ttm_mem_init_dma32_zone(struct ttm_mem_global *glob,
41590 zone->glob = glob;
41591 glob->zone_dma32 = zone;
41592 ret = kobject_init_and_add(
41593 - &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, zone->name);
41594 + &zone->kobj, &ttm_mem_zone_kobj_type, &glob->kobj, "%s", zone->name);
41595 if (unlikely(ret != 0)) {
41596 kobject_put(&zone->kobj);
41597 return ret;
41598 diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
41599 index 863bef9..cba15cf 100644
41600 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
41601 +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
41602 @@ -391,9 +391,9 @@ out:
41603 static unsigned long
41604 ttm_pool_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
41605 {
41606 - static atomic_t start_pool = ATOMIC_INIT(0);
41607 + static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
41608 unsigned i;
41609 - unsigned pool_offset = atomic_add_return(1, &start_pool);
41610 + unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
41611 struct ttm_page_pool *pool;
41612 int shrink_pages = sc->nr_to_scan;
41613 unsigned long freed = 0;
41614 diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
41615 index dbadd49..1b7457b 100644
41616 --- a/drivers/gpu/drm/udl/udl_fb.c
41617 +++ b/drivers/gpu/drm/udl/udl_fb.c
41618 @@ -367,7 +367,6 @@ static int udl_fb_release(struct fb_info *info, int user)
41619 fb_deferred_io_cleanup(info);
41620 kfree(info->fbdefio);
41621 info->fbdefio = NULL;
41622 - info->fbops->fb_mmap = udl_fb_mmap;
41623 }
41624
41625 pr_warn("released /dev/fb%d user=%d count=%d\n",
41626 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
41627 index ad02732..144f5ed 100644
41628 --- a/drivers/gpu/drm/via/via_drv.h
41629 +++ b/drivers/gpu/drm/via/via_drv.h
41630 @@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
41631 typedef uint32_t maskarray_t[5];
41632
41633 typedef struct drm_via_irq {
41634 - atomic_t irq_received;
41635 + atomic_unchecked_t irq_received;
41636 uint32_t pending_mask;
41637 uint32_t enable_mask;
41638 wait_queue_head_t irq_queue;
41639 @@ -75,7 +75,7 @@ typedef struct drm_via_private {
41640 struct timeval last_vblank;
41641 int last_vblank_valid;
41642 unsigned usec_per_vblank;
41643 - atomic_t vbl_received;
41644 + atomic_unchecked_t vbl_received;
41645 drm_via_state_t hc_state;
41646 char pci_buf[VIA_PCI_BUF_SIZE];
41647 const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
41648 diff --git a/drivers/gpu/drm/via/via_irq.c b/drivers/gpu/drm/via/via_irq.c
41649 index 1319433..a993b0c 100644
41650 --- a/drivers/gpu/drm/via/via_irq.c
41651 +++ b/drivers/gpu/drm/via/via_irq.c
41652 @@ -101,7 +101,7 @@ u32 via_get_vblank_counter(struct drm_device *dev, int crtc)
41653 if (crtc != 0)
41654 return 0;
41655
41656 - return atomic_read(&dev_priv->vbl_received);
41657 + return atomic_read_unchecked(&dev_priv->vbl_received);
41658 }
41659
41660 irqreturn_t via_driver_irq_handler(int irq, void *arg)
41661 @@ -116,8 +116,8 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
41662
41663 status = VIA_READ(VIA_REG_INTERRUPT);
41664 if (status & VIA_IRQ_VBLANK_PENDING) {
41665 - atomic_inc(&dev_priv->vbl_received);
41666 - if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
41667 + atomic_inc_unchecked(&dev_priv->vbl_received);
41668 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
41669 do_gettimeofday(&cur_vblank);
41670 if (dev_priv->last_vblank_valid) {
41671 dev_priv->usec_per_vblank =
41672 @@ -127,7 +127,7 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
41673 dev_priv->last_vblank = cur_vblank;
41674 dev_priv->last_vblank_valid = 1;
41675 }
41676 - if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
41677 + if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
41678 DRM_DEBUG("US per vblank is: %u\n",
41679 dev_priv->usec_per_vblank);
41680 }
41681 @@ -137,7 +137,7 @@ irqreturn_t via_driver_irq_handler(int irq, void *arg)
41682
41683 for (i = 0; i < dev_priv->num_irqs; ++i) {
41684 if (status & cur_irq->pending_mask) {
41685 - atomic_inc(&cur_irq->irq_received);
41686 + atomic_inc_unchecked(&cur_irq->irq_received);
41687 wake_up(&cur_irq->irq_queue);
41688 handled = 1;
41689 if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
41690 @@ -242,11 +242,11 @@ via_driver_irq_wait(struct drm_device *dev, unsigned int irq, int force_sequence
41691 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * HZ,
41692 ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
41693 masks[irq][4]));
41694 - cur_irq_sequence = atomic_read(&cur_irq->irq_received);
41695 + cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
41696 } else {
41697 DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * HZ,
41698 (((cur_irq_sequence =
41699 - atomic_read(&cur_irq->irq_received)) -
41700 + atomic_read_unchecked(&cur_irq->irq_received)) -
41701 *sequence) <= (1 << 23)));
41702 }
41703 *sequence = cur_irq_sequence;
41704 @@ -284,7 +284,7 @@ void via_driver_irq_preinstall(struct drm_device *dev)
41705 }
41706
41707 for (i = 0; i < dev_priv->num_irqs; ++i) {
41708 - atomic_set(&cur_irq->irq_received, 0);
41709 + atomic_set_unchecked(&cur_irq->irq_received, 0);
41710 cur_irq->enable_mask = dev_priv->irq_masks[i][0];
41711 cur_irq->pending_mask = dev_priv->irq_masks[i][1];
41712 init_waitqueue_head(&cur_irq->irq_queue);
41713 @@ -366,7 +366,7 @@ int via_wait_irq(struct drm_device *dev, void *data, struct drm_file *file_priv)
41714 switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
41715 case VIA_IRQ_RELATIVE:
41716 irqwait->request.sequence +=
41717 - atomic_read(&cur_irq->irq_received);
41718 + atomic_read_unchecked(&cur_irq->irq_received);
41719 irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
41720 case VIA_IRQ_ABSOLUTE:
41721 break;
41722 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
41723 index 0783155..b29e18e 100644
41724 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
41725 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
41726 @@ -437,7 +437,7 @@ struct vmw_private {
41727 * Fencing and IRQs.
41728 */
41729
41730 - atomic_t marker_seq;
41731 + atomic_unchecked_t marker_seq;
41732 wait_queue_head_t fence_queue;
41733 wait_queue_head_t fifo_queue;
41734 int fence_queue_waiters; /* Protected by hw_mutex */
41735 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
41736 index 6ccd993..618d592 100644
41737 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
41738 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
41739 @@ -154,7 +154,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
41740 (unsigned int) min,
41741 (unsigned int) fifo->capabilities);
41742
41743 - atomic_set(&dev_priv->marker_seq, dev_priv->last_read_seqno);
41744 + atomic_set_unchecked(&dev_priv->marker_seq, dev_priv->last_read_seqno);
41745 iowrite32(dev_priv->last_read_seqno, fifo_mem + SVGA_FIFO_FENCE);
41746 vmw_marker_queue_init(&fifo->marker_queue);
41747 return vmw_fifo_send_fence(dev_priv, &dummy);
41748 @@ -372,7 +372,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
41749 if (reserveable)
41750 iowrite32(bytes, fifo_mem +
41751 SVGA_FIFO_RESERVED);
41752 - return fifo_mem + (next_cmd >> 2);
41753 + return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2);
41754 } else {
41755 need_bounce = true;
41756 }
41757 @@ -492,7 +492,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
41758
41759 fm = vmw_fifo_reserve(dev_priv, bytes);
41760 if (unlikely(fm == NULL)) {
41761 - *seqno = atomic_read(&dev_priv->marker_seq);
41762 + *seqno = atomic_read_unchecked(&dev_priv->marker_seq);
41763 ret = -ENOMEM;
41764 (void)vmw_fallback_wait(dev_priv, false, true, *seqno,
41765 false, 3*HZ);
41766 @@ -500,7 +500,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
41767 }
41768
41769 do {
41770 - *seqno = atomic_add_return(1, &dev_priv->marker_seq);
41771 + *seqno = atomic_add_return_unchecked(1, &dev_priv->marker_seq);
41772 } while (*seqno == 0);
41773
41774 if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
41775 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
41776 index b1273e8..9c274fd 100644
41777 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
41778 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c
41779 @@ -164,9 +164,9 @@ static void vmw_gmrid_man_debug(struct ttm_mem_type_manager *man,
41780 }
41781
41782 const struct ttm_mem_type_manager_func vmw_gmrid_manager_func = {
41783 - vmw_gmrid_man_init,
41784 - vmw_gmrid_man_takedown,
41785 - vmw_gmrid_man_get_node,
41786 - vmw_gmrid_man_put_node,
41787 - vmw_gmrid_man_debug
41788 + .init = vmw_gmrid_man_init,
41789 + .takedown = vmw_gmrid_man_takedown,
41790 + .get_node = vmw_gmrid_man_get_node,
41791 + .put_node = vmw_gmrid_man_put_node,
41792 + .debug = vmw_gmrid_man_debug
41793 };
41794 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
41795 index 47b7094..698ba09 100644
41796 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
41797 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
41798 @@ -236,7 +236,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
41799 int ret;
41800
41801 num_clips = arg->num_clips;
41802 - clips_ptr = (struct drm_vmw_rect *)(unsigned long)arg->clips_ptr;
41803 + clips_ptr = (struct drm_vmw_rect __user *)(unsigned long)arg->clips_ptr;
41804
41805 if (unlikely(num_clips == 0))
41806 return 0;
41807 @@ -320,7 +320,7 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
41808 int ret;
41809
41810 num_clips = arg->num_clips;
41811 - clips_ptr = (struct drm_vmw_rect *)(unsigned long)arg->clips_ptr;
41812 + clips_ptr = (struct drm_vmw_rect __user *)(unsigned long)arg->clips_ptr;
41813
41814 if (unlikely(num_clips == 0))
41815 return 0;
41816 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
41817 index 0c42376..6febe77 100644
41818 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
41819 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
41820 @@ -107,7 +107,7 @@ bool vmw_seqno_passed(struct vmw_private *dev_priv,
41821 * emitted. Then the fence is stale and signaled.
41822 */
41823
41824 - ret = ((atomic_read(&dev_priv->marker_seq) - seqno)
41825 + ret = ((atomic_read_unchecked(&dev_priv->marker_seq) - seqno)
41826 > VMW_FENCE_WRAP);
41827
41828 return ret;
41829 @@ -138,7 +138,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
41830
41831 if (fifo_idle)
41832 down_read(&fifo_state->rwsem);
41833 - signal_seq = atomic_read(&dev_priv->marker_seq);
41834 + signal_seq = atomic_read_unchecked(&dev_priv->marker_seq);
41835 ret = 0;
41836
41837 for (;;) {
41838 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
41839 index 8a8725c2..afed796 100644
41840 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
41841 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_marker.c
41842 @@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev_priv,
41843 while (!vmw_lag_lt(queue, us)) {
41844 spin_lock(&queue->lock);
41845 if (list_empty(&queue->head))
41846 - seqno = atomic_read(&dev_priv->marker_seq);
41847 + seqno = atomic_read_unchecked(&dev_priv->marker_seq);
41848 else {
41849 marker = list_first_entry(&queue->head,
41850 struct vmw_marker, head);
41851 diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
41852 index ec0ae2d..dc0780b 100644
41853 --- a/drivers/gpu/vga/vga_switcheroo.c
41854 +++ b/drivers/gpu/vga/vga_switcheroo.c
41855 @@ -643,7 +643,7 @@ static int vga_switcheroo_runtime_resume(struct device *dev)
41856
41857 /* this version is for the case where the power switch is separate
41858 to the device being powered down. */
41859 -int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain)
41860 +int vga_switcheroo_init_domain_pm_ops(struct device *dev, dev_pm_domain_no_const *domain)
41861 {
41862 /* copy over all the bus versions */
41863 if (dev->bus && dev->bus->pm) {
41864 @@ -688,7 +688,7 @@ static int vga_switcheroo_runtime_resume_hdmi_audio(struct device *dev)
41865 return ret;
41866 }
41867
41868 -int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain)
41869 +int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, dev_pm_domain_no_const *domain)
41870 {
41871 /* copy over all the bus versions */
41872 if (dev->bus && dev->bus->pm) {
41873 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
41874 index 8a5384c..cf63c18 100644
41875 --- a/drivers/hid/hid-core.c
41876 +++ b/drivers/hid/hid-core.c
41877 @@ -2422,7 +2422,7 @@ EXPORT_SYMBOL_GPL(hid_ignore);
41878
41879 int hid_add_device(struct hid_device *hdev)
41880 {
41881 - static atomic_t id = ATOMIC_INIT(0);
41882 + static atomic_unchecked_t id = ATOMIC_INIT(0);
41883 int ret;
41884
41885 if (WARN_ON(hdev->status & HID_STAT_ADDED))
41886 @@ -2456,7 +2456,7 @@ int hid_add_device(struct hid_device *hdev)
41887 /* XXX hack, any other cleaner solution after the driver core
41888 * is converted to allow more than 20 bytes as the device name? */
41889 dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
41890 - hdev->vendor, hdev->product, atomic_inc_return(&id));
41891 + hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
41892
41893 hid_debug_register(hdev, dev_name(&hdev->dev));
41894 ret = device_add(&hdev->dev);
41895 diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
41896 index c13fb5b..55a3802 100644
41897 --- a/drivers/hid/hid-wiimote-debug.c
41898 +++ b/drivers/hid/hid-wiimote-debug.c
41899 @@ -66,7 +66,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s,
41900 else if (size == 0)
41901 return -EIO;
41902
41903 - if (copy_to_user(u, buf, size))
41904 + if (size > sizeof(buf) || copy_to_user(u, buf, size))
41905 return -EFAULT;
41906
41907 *off += size;
41908 diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
41909 index cedc6da..2c3da2a 100644
41910 --- a/drivers/hid/uhid.c
41911 +++ b/drivers/hid/uhid.c
41912 @@ -47,7 +47,7 @@ struct uhid_device {
41913 struct mutex report_lock;
41914 wait_queue_head_t report_wait;
41915 atomic_t report_done;
41916 - atomic_t report_id;
41917 + atomic_unchecked_t report_id;
41918 struct uhid_event report_buf;
41919 };
41920
41921 @@ -163,7 +163,7 @@ static int uhid_hid_get_raw(struct hid_device *hid, unsigned char rnum,
41922
41923 spin_lock_irqsave(&uhid->qlock, flags);
41924 ev->type = UHID_FEATURE;
41925 - ev->u.feature.id = atomic_inc_return(&uhid->report_id);
41926 + ev->u.feature.id = atomic_inc_return_unchecked(&uhid->report_id);
41927 ev->u.feature.rnum = rnum;
41928 ev->u.feature.rtype = report_type;
41929
41930 @@ -446,7 +446,7 @@ static int uhid_dev_feature_answer(struct uhid_device *uhid,
41931 spin_lock_irqsave(&uhid->qlock, flags);
41932
41933 /* id for old report; drop it silently */
41934 - if (atomic_read(&uhid->report_id) != ev->u.feature_answer.id)
41935 + if (atomic_read_unchecked(&uhid->report_id) != ev->u.feature_answer.id)
41936 goto unlock;
41937 if (atomic_read(&uhid->report_done))
41938 goto unlock;
41939 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
41940 index 69ea36f..8dbf4bb 100644
41941 --- a/drivers/hv/channel.c
41942 +++ b/drivers/hv/channel.c
41943 @@ -364,8 +364,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
41944 int ret = 0;
41945 int t;
41946
41947 - next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
41948 - atomic_inc(&vmbus_connection.next_gpadl_handle);
41949 + next_gpadl_handle = atomic_read_unchecked(&vmbus_connection.next_gpadl_handle);
41950 + atomic_inc_unchecked(&vmbus_connection.next_gpadl_handle);
41951
41952 ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
41953 if (ret)
41954 diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
41955 index bcb4950..61dba6c 100644
41956 --- a/drivers/hv/hv.c
41957 +++ b/drivers/hv/hv.c
41958 @@ -112,7 +112,7 @@ static u64 do_hypercall(u64 control, void *input, void *output)
41959 u64 output_address = (output) ? virt_to_phys(output) : 0;
41960 u32 output_address_hi = output_address >> 32;
41961 u32 output_address_lo = output_address & 0xFFFFFFFF;
41962 - void *hypercall_page = hv_context.hypercall_page;
41963 + void *hypercall_page = ktva_ktla(hv_context.hypercall_page);
41964
41965 __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi),
41966 "=a"(hv_status_lo) : "d" (control_hi),
41967 @@ -154,7 +154,7 @@ int hv_init(void)
41968 /* See if the hypercall page is already set */
41969 rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
41970
41971 - virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC);
41972 + virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX);
41973
41974 if (!virtaddr)
41975 goto cleanup;
41976 diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
41977 index 7e17a54..a50a33d 100644
41978 --- a/drivers/hv/hv_balloon.c
41979 +++ b/drivers/hv/hv_balloon.c
41980 @@ -464,7 +464,7 @@ MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
41981
41982 module_param(pressure_report_delay, uint, (S_IRUGO | S_IWUSR));
41983 MODULE_PARM_DESC(pressure_report_delay, "Delay in secs in reporting pressure");
41984 -static atomic_t trans_id = ATOMIC_INIT(0);
41985 +static atomic_unchecked_t trans_id = ATOMIC_INIT(0);
41986
41987 static int dm_ring_size = (5 * PAGE_SIZE);
41988
41989 @@ -886,7 +886,7 @@ static void hot_add_req(struct work_struct *dummy)
41990 pr_info("Memory hot add failed\n");
41991
41992 dm->state = DM_INITIALIZED;
41993 - resp.hdr.trans_id = atomic_inc_return(&trans_id);
41994 + resp.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
41995 vmbus_sendpacket(dm->dev->channel, &resp,
41996 sizeof(struct dm_hot_add_response),
41997 (unsigned long)NULL,
41998 @@ -960,7 +960,7 @@ static void post_status(struct hv_dynmem_device *dm)
41999 memset(&status, 0, sizeof(struct dm_status));
42000 status.hdr.type = DM_STATUS_REPORT;
42001 status.hdr.size = sizeof(struct dm_status);
42002 - status.hdr.trans_id = atomic_inc_return(&trans_id);
42003 + status.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42004
42005 /*
42006 * The host expects the guest to report free memory.
42007 @@ -980,7 +980,7 @@ static void post_status(struct hv_dynmem_device *dm)
42008 * send the status. This can happen if we were interrupted
42009 * after we picked our transaction ID.
42010 */
42011 - if (status.hdr.trans_id != atomic_read(&trans_id))
42012 + if (status.hdr.trans_id != atomic_read_unchecked(&trans_id))
42013 return;
42014
42015 vmbus_sendpacket(dm->dev->channel, &status,
42016 @@ -1108,7 +1108,7 @@ static void balloon_up(struct work_struct *dummy)
42017 */
42018
42019 do {
42020 - bl_resp->hdr.trans_id = atomic_inc_return(&trans_id);
42021 + bl_resp->hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42022 ret = vmbus_sendpacket(dm_device.dev->channel,
42023 bl_resp,
42024 bl_resp->hdr.size,
42025 @@ -1152,7 +1152,7 @@ static void balloon_down(struct hv_dynmem_device *dm,
42026
42027 memset(&resp, 0, sizeof(struct dm_unballoon_response));
42028 resp.hdr.type = DM_UNBALLOON_RESPONSE;
42029 - resp.hdr.trans_id = atomic_inc_return(&trans_id);
42030 + resp.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42031 resp.hdr.size = sizeof(struct dm_unballoon_response);
42032
42033 vmbus_sendpacket(dm_device.dev->channel, &resp,
42034 @@ -1215,7 +1215,7 @@ static void version_resp(struct hv_dynmem_device *dm,
42035 memset(&version_req, 0, sizeof(struct dm_version_request));
42036 version_req.hdr.type = DM_VERSION_REQUEST;
42037 version_req.hdr.size = sizeof(struct dm_version_request);
42038 - version_req.hdr.trans_id = atomic_inc_return(&trans_id);
42039 + version_req.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42040 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN7;
42041 version_req.is_last_attempt = 1;
42042
42043 @@ -1385,7 +1385,7 @@ static int balloon_probe(struct hv_device *dev,
42044 memset(&version_req, 0, sizeof(struct dm_version_request));
42045 version_req.hdr.type = DM_VERSION_REQUEST;
42046 version_req.hdr.size = sizeof(struct dm_version_request);
42047 - version_req.hdr.trans_id = atomic_inc_return(&trans_id);
42048 + version_req.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42049 version_req.version.version = DYNMEM_PROTOCOL_VERSION_WIN8;
42050 version_req.is_last_attempt = 0;
42051
42052 @@ -1416,7 +1416,7 @@ static int balloon_probe(struct hv_device *dev,
42053 memset(&cap_msg, 0, sizeof(struct dm_capabilities));
42054 cap_msg.hdr.type = DM_CAPABILITIES_REPORT;
42055 cap_msg.hdr.size = sizeof(struct dm_capabilities);
42056 - cap_msg.hdr.trans_id = atomic_inc_return(&trans_id);
42057 + cap_msg.hdr.trans_id = atomic_inc_return_unchecked(&trans_id);
42058
42059 cap_msg.caps.cap_bits.balloon = 1;
42060 cap_msg.caps.cap_bits.hot_add = 1;
42061 diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
42062 index e055176..c22ff1f 100644
42063 --- a/drivers/hv/hyperv_vmbus.h
42064 +++ b/drivers/hv/hyperv_vmbus.h
42065 @@ -602,7 +602,7 @@ enum vmbus_connect_state {
42066 struct vmbus_connection {
42067 enum vmbus_connect_state conn_state;
42068
42069 - atomic_t next_gpadl_handle;
42070 + atomic_unchecked_t next_gpadl_handle;
42071
42072 /*
42073 * Represents channel interrupts. Each bit position represents a
42074 diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
42075 index 077bb1b..d433d74 100644
42076 --- a/drivers/hv/vmbus_drv.c
42077 +++ b/drivers/hv/vmbus_drv.c
42078 @@ -844,10 +844,10 @@ int vmbus_device_register(struct hv_device *child_device_obj)
42079 {
42080 int ret = 0;
42081
42082 - static atomic_t device_num = ATOMIC_INIT(0);
42083 + static atomic_unchecked_t device_num = ATOMIC_INIT(0);
42084
42085 dev_set_name(&child_device_obj->device, "vmbus_0_%d",
42086 - atomic_inc_return(&device_num));
42087 + atomic_inc_return_unchecked(&device_num));
42088
42089 child_device_obj->device.bus = &hv_bus;
42090 child_device_obj->device.parent = &hv_acpi_dev->dev;
42091 diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c
42092 index 579bdf9..75118b5 100644
42093 --- a/drivers/hwmon/acpi_power_meter.c
42094 +++ b/drivers/hwmon/acpi_power_meter.c
42095 @@ -116,7 +116,7 @@ struct sensor_template {
42096 struct device_attribute *devattr,
42097 const char *buf, size_t count);
42098 int index;
42099 -};
42100 +} __do_const;
42101
42102 /* Averaging interval */
42103 static int update_avg_interval(struct acpi_power_meter_resource *resource)
42104 @@ -631,7 +631,7 @@ static int register_attrs(struct acpi_power_meter_resource *resource,
42105 struct sensor_template *attrs)
42106 {
42107 struct device *dev = &resource->acpi_dev->dev;
42108 - struct sensor_device_attribute *sensors =
42109 + sensor_device_attribute_no_const *sensors =
42110 &resource->sensors[resource->num_sensors];
42111 int res = 0;
42112
42113 diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
42114 index 3288f13..71cfb4e 100644
42115 --- a/drivers/hwmon/applesmc.c
42116 +++ b/drivers/hwmon/applesmc.c
42117 @@ -1106,7 +1106,7 @@ static int applesmc_create_nodes(struct applesmc_node_group *groups, int num)
42118 {
42119 struct applesmc_node_group *grp;
42120 struct applesmc_dev_attr *node;
42121 - struct attribute *attr;
42122 + attribute_no_const *attr;
42123 int ret, i;
42124
42125 for (grp = groups; grp->format; grp++) {
42126 diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
42127 index ae208f6..48b6c5b 100644
42128 --- a/drivers/hwmon/asus_atk0110.c
42129 +++ b/drivers/hwmon/asus_atk0110.c
42130 @@ -147,10 +147,10 @@ MODULE_DEVICE_TABLE(acpi, atk_ids);
42131 struct atk_sensor_data {
42132 struct list_head list;
42133 struct atk_data *data;
42134 - struct device_attribute label_attr;
42135 - struct device_attribute input_attr;
42136 - struct device_attribute limit1_attr;
42137 - struct device_attribute limit2_attr;
42138 + device_attribute_no_const label_attr;
42139 + device_attribute_no_const input_attr;
42140 + device_attribute_no_const limit1_attr;
42141 + device_attribute_no_const limit2_attr;
42142 char label_attr_name[ATTR_NAME_SIZE];
42143 char input_attr_name[ATTR_NAME_SIZE];
42144 char limit1_attr_name[ATTR_NAME_SIZE];
42145 @@ -270,7 +270,7 @@ static ssize_t atk_name_show(struct device *dev,
42146 static struct device_attribute atk_name_attr =
42147 __ATTR(name, 0444, atk_name_show, NULL);
42148
42149 -static void atk_init_attribute(struct device_attribute *attr, char *name,
42150 +static void atk_init_attribute(device_attribute_no_const *attr, char *name,
42151 sysfs_show_func show)
42152 {
42153 sysfs_attr_init(&attr->attr);
42154 diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
42155 index bbb0b0d..9fe1332 100644
42156 --- a/drivers/hwmon/coretemp.c
42157 +++ b/drivers/hwmon/coretemp.c
42158 @@ -823,7 +823,7 @@ static int coretemp_cpu_callback(struct notifier_block *nfb,
42159 return NOTIFY_OK;
42160 }
42161
42162 -static struct notifier_block coretemp_cpu_notifier __refdata = {
42163 +static struct notifier_block coretemp_cpu_notifier = {
42164 .notifier_call = coretemp_cpu_callback,
42165 };
42166
42167 diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
42168 index 632f1dc..57e6a58 100644
42169 --- a/drivers/hwmon/ibmaem.c
42170 +++ b/drivers/hwmon/ibmaem.c
42171 @@ -926,7 +926,7 @@ static int aem_register_sensors(struct aem_data *data,
42172 struct aem_rw_sensor_template *rw)
42173 {
42174 struct device *dev = &data->pdev->dev;
42175 - struct sensor_device_attribute *sensors = data->sensors;
42176 + sensor_device_attribute_no_const *sensors = data->sensors;
42177 int err;
42178
42179 /* Set up read-only sensors */
42180 diff --git a/drivers/hwmon/iio_hwmon.c b/drivers/hwmon/iio_hwmon.c
42181 index 708081b..fe2d4ab 100644
42182 --- a/drivers/hwmon/iio_hwmon.c
42183 +++ b/drivers/hwmon/iio_hwmon.c
42184 @@ -73,7 +73,7 @@ static int iio_hwmon_probe(struct platform_device *pdev)
42185 {
42186 struct device *dev = &pdev->dev;
42187 struct iio_hwmon_state *st;
42188 - struct sensor_device_attribute *a;
42189 + sensor_device_attribute_no_const *a;
42190 int ret, i;
42191 int in_i = 1, temp_i = 1, curr_i = 1;
42192 enum iio_chan_type type;
42193 diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
42194 index 38d5a63..cf2c2ea 100644
42195 --- a/drivers/hwmon/nct6775.c
42196 +++ b/drivers/hwmon/nct6775.c
42197 @@ -944,10 +944,10 @@ static struct attribute_group *
42198 nct6775_create_attr_group(struct device *dev, struct sensor_template_group *tg,
42199 int repeat)
42200 {
42201 - struct attribute_group *group;
42202 + attribute_group_no_const *group;
42203 struct sensor_device_attr_u *su;
42204 - struct sensor_device_attribute *a;
42205 - struct sensor_device_attribute_2 *a2;
42206 + sensor_device_attribute_no_const *a;
42207 + sensor_device_attribute_2_no_const *a2;
42208 struct attribute **attrs;
42209 struct sensor_device_template **t;
42210 int i, count;
42211 diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
42212 index 291d11f..3f0dbbd 100644
42213 --- a/drivers/hwmon/pmbus/pmbus_core.c
42214 +++ b/drivers/hwmon/pmbus/pmbus_core.c
42215 @@ -783,7 +783,7 @@ static int pmbus_add_attribute(struct pmbus_data *data, struct attribute *attr)
42216 return 0;
42217 }
42218
42219 -static void pmbus_dev_attr_init(struct device_attribute *dev_attr,
42220 +static void pmbus_dev_attr_init(device_attribute_no_const *dev_attr,
42221 const char *name,
42222 umode_t mode,
42223 ssize_t (*show)(struct device *dev,
42224 @@ -800,7 +800,7 @@ static void pmbus_dev_attr_init(struct device_attribute *dev_attr,
42225 dev_attr->store = store;
42226 }
42227
42228 -static void pmbus_attr_init(struct sensor_device_attribute *a,
42229 +static void pmbus_attr_init(sensor_device_attribute_no_const *a,
42230 const char *name,
42231 umode_t mode,
42232 ssize_t (*show)(struct device *dev,
42233 @@ -822,7 +822,7 @@ static int pmbus_add_boolean(struct pmbus_data *data,
42234 u16 reg, u8 mask)
42235 {
42236 struct pmbus_boolean *boolean;
42237 - struct sensor_device_attribute *a;
42238 + sensor_device_attribute_no_const *a;
42239
42240 boolean = devm_kzalloc(data->dev, sizeof(*boolean), GFP_KERNEL);
42241 if (!boolean)
42242 @@ -847,7 +847,7 @@ static struct pmbus_sensor *pmbus_add_sensor(struct pmbus_data *data,
42243 bool update, bool readonly)
42244 {
42245 struct pmbus_sensor *sensor;
42246 - struct device_attribute *a;
42247 + device_attribute_no_const *a;
42248
42249 sensor = devm_kzalloc(data->dev, sizeof(*sensor), GFP_KERNEL);
42250 if (!sensor)
42251 @@ -878,7 +878,7 @@ static int pmbus_add_label(struct pmbus_data *data,
42252 const char *lstring, int index)
42253 {
42254 struct pmbus_label *label;
42255 - struct device_attribute *a;
42256 + device_attribute_no_const *a;
42257
42258 label = devm_kzalloc(data->dev, sizeof(*label), GFP_KERNEL);
42259 if (!label)
42260 diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
42261 index 97cd45a..ac54d8b 100644
42262 --- a/drivers/hwmon/sht15.c
42263 +++ b/drivers/hwmon/sht15.c
42264 @@ -169,7 +169,7 @@ struct sht15_data {
42265 int supply_uv;
42266 bool supply_uv_valid;
42267 struct work_struct update_supply_work;
42268 - atomic_t interrupt_handled;
42269 + atomic_unchecked_t interrupt_handled;
42270 };
42271
42272 /**
42273 @@ -542,13 +542,13 @@ static int sht15_measurement(struct sht15_data *data,
42274 ret = gpio_direction_input(data->pdata->gpio_data);
42275 if (ret)
42276 return ret;
42277 - atomic_set(&data->interrupt_handled, 0);
42278 + atomic_set_unchecked(&data->interrupt_handled, 0);
42279
42280 enable_irq(gpio_to_irq(data->pdata->gpio_data));
42281 if (gpio_get_value(data->pdata->gpio_data) == 0) {
42282 disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
42283 /* Only relevant if the interrupt hasn't occurred. */
42284 - if (!atomic_read(&data->interrupt_handled))
42285 + if (!atomic_read_unchecked(&data->interrupt_handled))
42286 schedule_work(&data->read_work);
42287 }
42288 ret = wait_event_timeout(data->wait_queue,
42289 @@ -820,7 +820,7 @@ static irqreturn_t sht15_interrupt_fired(int irq, void *d)
42290
42291 /* First disable the interrupt */
42292 disable_irq_nosync(irq);
42293 - atomic_inc(&data->interrupt_handled);
42294 + atomic_inc_unchecked(&data->interrupt_handled);
42295 /* Then schedule a reading work struct */
42296 if (data->state != SHT15_READING_NOTHING)
42297 schedule_work(&data->read_work);
42298 @@ -842,11 +842,11 @@ static void sht15_bh_read_data(struct work_struct *work_s)
42299 * If not, then start the interrupt again - care here as could
42300 * have gone low in meantime so verify it hasn't!
42301 */
42302 - atomic_set(&data->interrupt_handled, 0);
42303 + atomic_set_unchecked(&data->interrupt_handled, 0);
42304 enable_irq(gpio_to_irq(data->pdata->gpio_data));
42305 /* If still not occurred or another handler was scheduled */
42306 if (gpio_get_value(data->pdata->gpio_data)
42307 - || atomic_read(&data->interrupt_handled))
42308 + || atomic_read_unchecked(&data->interrupt_handled))
42309 return;
42310 }
42311
42312 diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
42313 index 38944e9..ae9e5ed 100644
42314 --- a/drivers/hwmon/via-cputemp.c
42315 +++ b/drivers/hwmon/via-cputemp.c
42316 @@ -296,7 +296,7 @@ static int via_cputemp_cpu_callback(struct notifier_block *nfb,
42317 return NOTIFY_OK;
42318 }
42319
42320 -static struct notifier_block via_cputemp_cpu_notifier __refdata = {
42321 +static struct notifier_block via_cputemp_cpu_notifier = {
42322 .notifier_call = via_cputemp_cpu_callback,
42323 };
42324
42325 diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
42326 index 41fc683..a39cfea 100644
42327 --- a/drivers/i2c/busses/i2c-amd756-s4882.c
42328 +++ b/drivers/i2c/busses/i2c-amd756-s4882.c
42329 @@ -43,7 +43,7 @@
42330 extern struct i2c_adapter amd756_smbus;
42331
42332 static struct i2c_adapter *s4882_adapter;
42333 -static struct i2c_algorithm *s4882_algo;
42334 +static i2c_algorithm_no_const *s4882_algo;
42335
42336 /* Wrapper access functions for multiplexed SMBus */
42337 static DEFINE_MUTEX(amd756_lock);
42338 diff --git a/drivers/i2c/busses/i2c-diolan-u2c.c b/drivers/i2c/busses/i2c-diolan-u2c.c
42339 index 721f7eb..0fd2a09 100644
42340 --- a/drivers/i2c/busses/i2c-diolan-u2c.c
42341 +++ b/drivers/i2c/busses/i2c-diolan-u2c.c
42342 @@ -98,7 +98,7 @@ MODULE_PARM_DESC(frequency, "I2C clock frequency in hertz");
42343 /* usb layer */
42344
42345 /* Send command to device, and get response. */
42346 -static int diolan_usb_transfer(struct i2c_diolan_u2c *dev)
42347 +static int __intentional_overflow(-1) diolan_usb_transfer(struct i2c_diolan_u2c *dev)
42348 {
42349 int ret = 0;
42350 int actual;
42351 diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
42352 index b170bdf..3c76427 100644
42353 --- a/drivers/i2c/busses/i2c-nforce2-s4985.c
42354 +++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
42355 @@ -41,7 +41,7 @@
42356 extern struct i2c_adapter *nforce2_smbus;
42357
42358 static struct i2c_adapter *s4985_adapter;
42359 -static struct i2c_algorithm *s4985_algo;
42360 +static i2c_algorithm_no_const *s4985_algo;
42361
42362 /* Wrapper access functions for multiplexed SMBus */
42363 static DEFINE_MUTEX(nforce2_lock);
42364 diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
42365 index 80b47e8..1a6040d9 100644
42366 --- a/drivers/i2c/i2c-dev.c
42367 +++ b/drivers/i2c/i2c-dev.c
42368 @@ -277,7 +277,7 @@ static noinline int i2cdev_ioctl_rdrw(struct i2c_client *client,
42369 break;
42370 }
42371
42372 - data_ptrs[i] = (u8 __user *)rdwr_pa[i].buf;
42373 + data_ptrs[i] = (u8 __force_user *)rdwr_pa[i].buf;
42374 rdwr_pa[i].buf = memdup_user(data_ptrs[i], rdwr_pa[i].len);
42375 if (IS_ERR(rdwr_pa[i].buf)) {
42376 res = PTR_ERR(rdwr_pa[i].buf);
42377 diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
42378 index 0b510ba..4fbb5085 100644
42379 --- a/drivers/ide/ide-cd.c
42380 +++ b/drivers/ide/ide-cd.c
42381 @@ -768,7 +768,7 @@ static void cdrom_do_block_pc(ide_drive_t *drive, struct request *rq)
42382 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
42383 if ((unsigned long)buf & alignment
42384 || blk_rq_bytes(rq) & q->dma_pad_mask
42385 - || object_is_on_stack(buf))
42386 + || object_starts_on_stack(buf))
42387 drive->dma = 0;
42388 }
42389 }
42390 diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
42391 index acc911a..8700c3c 100644
42392 --- a/drivers/iio/industrialio-core.c
42393 +++ b/drivers/iio/industrialio-core.c
42394 @@ -527,7 +527,7 @@ static ssize_t iio_write_channel_info(struct device *dev,
42395 }
42396
42397 static
42398 -int __iio_device_attr_init(struct device_attribute *dev_attr,
42399 +int __iio_device_attr_init(device_attribute_no_const *dev_attr,
42400 const char *postfix,
42401 struct iio_chan_spec const *chan,
42402 ssize_t (*readfunc)(struct device *dev,
42403 diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
42404 index c323917..6ddea8b 100644
42405 --- a/drivers/infiniband/core/cm.c
42406 +++ b/drivers/infiniband/core/cm.c
42407 @@ -115,7 +115,7 @@ static char const counter_group_names[CM_COUNTER_GROUPS]
42408
42409 struct cm_counter_group {
42410 struct kobject obj;
42411 - atomic_long_t counter[CM_ATTR_COUNT];
42412 + atomic_long_unchecked_t counter[CM_ATTR_COUNT];
42413 };
42414
42415 struct cm_counter_attribute {
42416 @@ -1398,7 +1398,7 @@ static void cm_dup_req_handler(struct cm_work *work,
42417 struct ib_mad_send_buf *msg = NULL;
42418 int ret;
42419
42420 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42421 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42422 counter[CM_REQ_COUNTER]);
42423
42424 /* Quick state check to discard duplicate REQs. */
42425 @@ -1785,7 +1785,7 @@ static void cm_dup_rep_handler(struct cm_work *work)
42426 if (!cm_id_priv)
42427 return;
42428
42429 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42430 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42431 counter[CM_REP_COUNTER]);
42432 ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
42433 if (ret)
42434 @@ -1952,7 +1952,7 @@ static int cm_rtu_handler(struct cm_work *work)
42435 if (cm_id_priv->id.state != IB_CM_REP_SENT &&
42436 cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
42437 spin_unlock_irq(&cm_id_priv->lock);
42438 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42439 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42440 counter[CM_RTU_COUNTER]);
42441 goto out;
42442 }
42443 @@ -2135,7 +2135,7 @@ static int cm_dreq_handler(struct cm_work *work)
42444 cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
42445 dreq_msg->local_comm_id);
42446 if (!cm_id_priv) {
42447 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42448 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42449 counter[CM_DREQ_COUNTER]);
42450 cm_issue_drep(work->port, work->mad_recv_wc);
42451 return -EINVAL;
42452 @@ -2160,7 +2160,7 @@ static int cm_dreq_handler(struct cm_work *work)
42453 case IB_CM_MRA_REP_RCVD:
42454 break;
42455 case IB_CM_TIMEWAIT:
42456 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42457 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42458 counter[CM_DREQ_COUNTER]);
42459 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
42460 goto unlock;
42461 @@ -2174,7 +2174,7 @@ static int cm_dreq_handler(struct cm_work *work)
42462 cm_free_msg(msg);
42463 goto deref;
42464 case IB_CM_DREQ_RCVD:
42465 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42466 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42467 counter[CM_DREQ_COUNTER]);
42468 goto unlock;
42469 default:
42470 @@ -2541,7 +2541,7 @@ static int cm_mra_handler(struct cm_work *work)
42471 ib_modify_mad(cm_id_priv->av.port->mad_agent,
42472 cm_id_priv->msg, timeout)) {
42473 if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
42474 - atomic_long_inc(&work->port->
42475 + atomic_long_inc_unchecked(&work->port->
42476 counter_group[CM_RECV_DUPLICATES].
42477 counter[CM_MRA_COUNTER]);
42478 goto out;
42479 @@ -2550,7 +2550,7 @@ static int cm_mra_handler(struct cm_work *work)
42480 break;
42481 case IB_CM_MRA_REQ_RCVD:
42482 case IB_CM_MRA_REP_RCVD:
42483 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42484 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42485 counter[CM_MRA_COUNTER]);
42486 /* fall through */
42487 default:
42488 @@ -2712,7 +2712,7 @@ static int cm_lap_handler(struct cm_work *work)
42489 case IB_CM_LAP_IDLE:
42490 break;
42491 case IB_CM_MRA_LAP_SENT:
42492 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42493 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42494 counter[CM_LAP_COUNTER]);
42495 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
42496 goto unlock;
42497 @@ -2728,7 +2728,7 @@ static int cm_lap_handler(struct cm_work *work)
42498 cm_free_msg(msg);
42499 goto deref;
42500 case IB_CM_LAP_RCVD:
42501 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42502 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42503 counter[CM_LAP_COUNTER]);
42504 goto unlock;
42505 default:
42506 @@ -3012,7 +3012,7 @@ static int cm_sidr_req_handler(struct cm_work *work)
42507 cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
42508 if (cur_cm_id_priv) {
42509 spin_unlock_irq(&cm.lock);
42510 - atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
42511 + atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
42512 counter[CM_SIDR_REQ_COUNTER]);
42513 goto out; /* Duplicate message. */
42514 }
42515 @@ -3224,10 +3224,10 @@ static void cm_send_handler(struct ib_mad_agent *mad_agent,
42516 if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
42517 msg->retries = 1;
42518
42519 - atomic_long_add(1 + msg->retries,
42520 + atomic_long_add_unchecked(1 + msg->retries,
42521 &port->counter_group[CM_XMIT].counter[attr_index]);
42522 if (msg->retries)
42523 - atomic_long_add(msg->retries,
42524 + atomic_long_add_unchecked(msg->retries,
42525 &port->counter_group[CM_XMIT_RETRIES].
42526 counter[attr_index]);
42527
42528 @@ -3437,7 +3437,7 @@ static void cm_recv_handler(struct ib_mad_agent *mad_agent,
42529 }
42530
42531 attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
42532 - atomic_long_inc(&port->counter_group[CM_RECV].
42533 + atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
42534 counter[attr_id - CM_ATTR_ID_OFFSET]);
42535
42536 work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
42537 @@ -3668,7 +3668,7 @@ static ssize_t cm_show_counter(struct kobject *obj, struct attribute *attr,
42538 cm_attr = container_of(attr, struct cm_counter_attribute, attr);
42539
42540 return sprintf(buf, "%ld\n",
42541 - atomic_long_read(&group->counter[cm_attr->index]));
42542 + atomic_long_read_unchecked(&group->counter[cm_attr->index]));
42543 }
42544
42545 static const struct sysfs_ops cm_counter_ops = {
42546 diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
42547 index 9f5ad7c..588cd84 100644
42548 --- a/drivers/infiniband/core/fmr_pool.c
42549 +++ b/drivers/infiniband/core/fmr_pool.c
42550 @@ -98,8 +98,8 @@ struct ib_fmr_pool {
42551
42552 struct task_struct *thread;
42553
42554 - atomic_t req_ser;
42555 - atomic_t flush_ser;
42556 + atomic_unchecked_t req_ser;
42557 + atomic_unchecked_t flush_ser;
42558
42559 wait_queue_head_t force_wait;
42560 };
42561 @@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
42562 struct ib_fmr_pool *pool = pool_ptr;
42563
42564 do {
42565 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
42566 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
42567 ib_fmr_batch_release(pool);
42568
42569 - atomic_inc(&pool->flush_ser);
42570 + atomic_inc_unchecked(&pool->flush_ser);
42571 wake_up_interruptible(&pool->force_wait);
42572
42573 if (pool->flush_function)
42574 @@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *pool_ptr)
42575 }
42576
42577 set_current_state(TASK_INTERRUPTIBLE);
42578 - if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
42579 + if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
42580 !kthread_should_stop())
42581 schedule();
42582 __set_current_state(TASK_RUNNING);
42583 @@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd *pd,
42584 pool->dirty_watermark = params->dirty_watermark;
42585 pool->dirty_len = 0;
42586 spin_lock_init(&pool->pool_lock);
42587 - atomic_set(&pool->req_ser, 0);
42588 - atomic_set(&pool->flush_ser, 0);
42589 + atomic_set_unchecked(&pool->req_ser, 0);
42590 + atomic_set_unchecked(&pool->flush_ser, 0);
42591 init_waitqueue_head(&pool->force_wait);
42592
42593 pool->thread = kthread_run(ib_fmr_cleanup_thread,
42594 @@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool *pool)
42595 }
42596 spin_unlock_irq(&pool->pool_lock);
42597
42598 - serial = atomic_inc_return(&pool->req_ser);
42599 + serial = atomic_inc_return_unchecked(&pool->req_ser);
42600 wake_up_process(pool->thread);
42601
42602 if (wait_event_interruptible(pool->force_wait,
42603 - atomic_read(&pool->flush_ser) - serial >= 0))
42604 + atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
42605 return -EINTR;
42606
42607 return 0;
42608 @@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr *fmr)
42609 } else {
42610 list_add_tail(&fmr->list, &pool->dirty_list);
42611 if (++pool->dirty_len >= pool->dirty_watermark) {
42612 - atomic_inc(&pool->req_ser);
42613 + atomic_inc_unchecked(&pool->req_ser);
42614 wake_up_process(pool->thread);
42615 }
42616 }
42617 diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
42618 index 41b1195..27971a0 100644
42619 --- a/drivers/infiniband/hw/cxgb4/mem.c
42620 +++ b/drivers/infiniband/hw/cxgb4/mem.c
42621 @@ -249,7 +249,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
42622 int err;
42623 struct fw_ri_tpte tpt;
42624 u32 stag_idx;
42625 - static atomic_t key;
42626 + static atomic_unchecked_t key;
42627
42628 if (c4iw_fatal_error(rdev))
42629 return -EIO;
42630 @@ -266,7 +266,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
42631 if (rdev->stats.stag.cur > rdev->stats.stag.max)
42632 rdev->stats.stag.max = rdev->stats.stag.cur;
42633 mutex_unlock(&rdev->stats.lock);
42634 - *stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
42635 + *stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
42636 }
42637 PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
42638 __func__, stag_state, type, pdid, stag_idx);
42639 diff --git a/drivers/infiniband/hw/ipath/ipath_dma.c b/drivers/infiniband/hw/ipath/ipath_dma.c
42640 index 644c2c7..ecf0879 100644
42641 --- a/drivers/infiniband/hw/ipath/ipath_dma.c
42642 +++ b/drivers/infiniband/hw/ipath/ipath_dma.c
42643 @@ -176,17 +176,17 @@ static void ipath_dma_free_coherent(struct ib_device *dev, size_t size,
42644 }
42645
42646 struct ib_dma_mapping_ops ipath_dma_mapping_ops = {
42647 - ipath_mapping_error,
42648 - ipath_dma_map_single,
42649 - ipath_dma_unmap_single,
42650 - ipath_dma_map_page,
42651 - ipath_dma_unmap_page,
42652 - ipath_map_sg,
42653 - ipath_unmap_sg,
42654 - ipath_sg_dma_address,
42655 - ipath_sg_dma_len,
42656 - ipath_sync_single_for_cpu,
42657 - ipath_sync_single_for_device,
42658 - ipath_dma_alloc_coherent,
42659 - ipath_dma_free_coherent
42660 + .mapping_error = ipath_mapping_error,
42661 + .map_single = ipath_dma_map_single,
42662 + .unmap_single = ipath_dma_unmap_single,
42663 + .map_page = ipath_dma_map_page,
42664 + .unmap_page = ipath_dma_unmap_page,
42665 + .map_sg = ipath_map_sg,
42666 + .unmap_sg = ipath_unmap_sg,
42667 + .dma_address = ipath_sg_dma_address,
42668 + .dma_len = ipath_sg_dma_len,
42669 + .sync_single_for_cpu = ipath_sync_single_for_cpu,
42670 + .sync_single_for_device = ipath_sync_single_for_device,
42671 + .alloc_coherent = ipath_dma_alloc_coherent,
42672 + .free_coherent = ipath_dma_free_coherent
42673 };
42674 diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
42675 index 79b3dbc..96e5fcc 100644
42676 --- a/drivers/infiniband/hw/ipath/ipath_rc.c
42677 +++ b/drivers/infiniband/hw/ipath/ipath_rc.c
42678 @@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
42679 struct ib_atomic_eth *ateth;
42680 struct ipath_ack_entry *e;
42681 u64 vaddr;
42682 - atomic64_t *maddr;
42683 + atomic64_unchecked_t *maddr;
42684 u64 sdata;
42685 u32 rkey;
42686 u8 next;
42687 @@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
42688 IB_ACCESS_REMOTE_ATOMIC)))
42689 goto nack_acc_unlck;
42690 /* Perform atomic OP and save result. */
42691 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
42692 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
42693 sdata = be64_to_cpu(ateth->swap_data);
42694 e = &qp->s_ack_queue[qp->r_head_ack_queue];
42695 e->atomic_data = (opcode == OP(FETCH_ADD)) ?
42696 - (u64) atomic64_add_return(sdata, maddr) - sdata :
42697 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
42698 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
42699 be64_to_cpu(ateth->compare_data),
42700 sdata);
42701 diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
42702 index 1f95bba..9530f87 100644
42703 --- a/drivers/infiniband/hw/ipath/ipath_ruc.c
42704 +++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
42705 @@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ipath_qp *sqp)
42706 unsigned long flags;
42707 struct ib_wc wc;
42708 u64 sdata;
42709 - atomic64_t *maddr;
42710 + atomic64_unchecked_t *maddr;
42711 enum ib_wc_status send_status;
42712
42713 /*
42714 @@ -382,11 +382,11 @@ again:
42715 IB_ACCESS_REMOTE_ATOMIC)))
42716 goto acc_err;
42717 /* Perform atomic OP and save result. */
42718 - maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
42719 + maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
42720 sdata = wqe->wr.wr.atomic.compare_add;
42721 *(u64 *) sqp->s_sge.sge.vaddr =
42722 (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
42723 - (u64) atomic64_add_return(sdata, maddr) - sdata :
42724 + (u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
42725 (u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
42726 sdata, wqe->wr.wr.atomic.swap);
42727 goto send_comp;
42728 diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
42729 index f2a3f48..673ec79 100644
42730 --- a/drivers/infiniband/hw/mlx4/mad.c
42731 +++ b/drivers/infiniband/hw/mlx4/mad.c
42732 @@ -98,7 +98,7 @@ __be64 mlx4_ib_gen_node_guid(void)
42733
42734 __be64 mlx4_ib_get_new_demux_tid(struct mlx4_ib_demux_ctx *ctx)
42735 {
42736 - return cpu_to_be64(atomic_inc_return(&ctx->tid)) |
42737 + return cpu_to_be64(atomic_inc_return_unchecked(&ctx->tid)) |
42738 cpu_to_be64(0xff00000000000000LL);
42739 }
42740
42741 diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
42742 index 25b2cdf..099ff97 100644
42743 --- a/drivers/infiniband/hw/mlx4/mcg.c
42744 +++ b/drivers/infiniband/hw/mlx4/mcg.c
42745 @@ -1040,7 +1040,7 @@ int mlx4_ib_mcg_port_init(struct mlx4_ib_demux_ctx *ctx)
42746 {
42747 char name[20];
42748
42749 - atomic_set(&ctx->tid, 0);
42750 + atomic_set_unchecked(&ctx->tid, 0);
42751 sprintf(name, "mlx4_ib_mcg%d", ctx->port);
42752 ctx->mcg_wq = create_singlethread_workqueue(name);
42753 if (!ctx->mcg_wq)
42754 diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
42755 index a230683..3723f2d 100644
42756 --- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
42757 +++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
42758 @@ -408,7 +408,7 @@ struct mlx4_ib_demux_ctx {
42759 struct list_head mcg_mgid0_list;
42760 struct workqueue_struct *mcg_wq;
42761 struct mlx4_ib_demux_pv_ctx **tun;
42762 - atomic_t tid;
42763 + atomic_unchecked_t tid;
42764 int flushing; /* flushing the work queue */
42765 };
42766
42767 diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
42768 index 9d3e5c1..6f166df 100644
42769 --- a/drivers/infiniband/hw/mthca/mthca_cmd.c
42770 +++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
42771 @@ -772,7 +772,7 @@ static void mthca_setup_cmd_doorbells(struct mthca_dev *dev, u64 base)
42772 mthca_dbg(dev, "Mapped doorbell page for posting FW commands\n");
42773 }
42774
42775 -int mthca_QUERY_FW(struct mthca_dev *dev)
42776 +int __intentional_overflow(-1) mthca_QUERY_FW(struct mthca_dev *dev)
42777 {
42778 struct mthca_mailbox *mailbox;
42779 u32 *outbox;
42780 @@ -1612,7 +1612,7 @@ int mthca_HW2SW_MPT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
42781 CMD_TIME_CLASS_B);
42782 }
42783
42784 -int mthca_WRITE_MTT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
42785 +int __intentional_overflow(-1) mthca_WRITE_MTT(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
42786 int num_mtt)
42787 {
42788 return mthca_cmd(dev, mailbox->dma, num_mtt, 0, CMD_WRITE_MTT,
42789 @@ -1634,7 +1634,7 @@ int mthca_MAP_EQ(struct mthca_dev *dev, u64 event_mask, int unmap,
42790 0, CMD_MAP_EQ, CMD_TIME_CLASS_B);
42791 }
42792
42793 -int mthca_SW2HW_EQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
42794 +int __intentional_overflow(-1) mthca_SW2HW_EQ(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
42795 int eq_num)
42796 {
42797 return mthca_cmd(dev, mailbox->dma, eq_num, 0, CMD_SW2HW_EQ,
42798 @@ -1857,7 +1857,7 @@ int mthca_CONF_SPECIAL_QP(struct mthca_dev *dev, int type, u32 qpn)
42799 CMD_TIME_CLASS_B);
42800 }
42801
42802 -int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
42803 +int __intentional_overflow(-1) mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
42804 int port, struct ib_wc *in_wc, struct ib_grh *in_grh,
42805 void *in_mad, void *response_mad)
42806 {
42807 diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
42808 index 87897b9..7e79542 100644
42809 --- a/drivers/infiniband/hw/mthca/mthca_main.c
42810 +++ b/drivers/infiniband/hw/mthca/mthca_main.c
42811 @@ -692,7 +692,7 @@ err_close:
42812 return err;
42813 }
42814
42815 -static int mthca_setup_hca(struct mthca_dev *dev)
42816 +static int __intentional_overflow(-1) mthca_setup_hca(struct mthca_dev *dev)
42817 {
42818 int err;
42819
42820 diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
42821 index ed9a989..6aa5dc2 100644
42822 --- a/drivers/infiniband/hw/mthca/mthca_mr.c
42823 +++ b/drivers/infiniband/hw/mthca/mthca_mr.c
42824 @@ -81,7 +81,7 @@ struct mthca_mpt_entry {
42825 * through the bitmaps)
42826 */
42827
42828 -static u32 mthca_buddy_alloc(struct mthca_buddy *buddy, int order)
42829 +static u32 __intentional_overflow(-1) mthca_buddy_alloc(struct mthca_buddy *buddy, int order)
42830 {
42831 int o;
42832 int m;
42833 @@ -426,7 +426,7 @@ static inline u32 adjust_key(struct mthca_dev *dev, u32 key)
42834 return key;
42835 }
42836
42837 -int mthca_mr_alloc(struct mthca_dev *dev, u32 pd, int buffer_size_shift,
42838 +int __intentional_overflow(-1) mthca_mr_alloc(struct mthca_dev *dev, u32 pd, int buffer_size_shift,
42839 u64 iova, u64 total_size, u32 access, struct mthca_mr *mr)
42840 {
42841 struct mthca_mailbox *mailbox;
42842 @@ -516,7 +516,7 @@ int mthca_mr_alloc_notrans(struct mthca_dev *dev, u32 pd,
42843 return mthca_mr_alloc(dev, pd, 12, 0, ~0ULL, access, mr);
42844 }
42845
42846 -int mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd,
42847 +int __intentional_overflow(-1) mthca_mr_alloc_phys(struct mthca_dev *dev, u32 pd,
42848 u64 *buffer_list, int buffer_size_shift,
42849 int list_len, u64 iova, u64 total_size,
42850 u32 access, struct mthca_mr *mr)
42851 diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
42852 index 42dde06..1257310 100644
42853 --- a/drivers/infiniband/hw/mthca/mthca_provider.c
42854 +++ b/drivers/infiniband/hw/mthca/mthca_provider.c
42855 @@ -764,7 +764,7 @@ unlock:
42856 return 0;
42857 }
42858
42859 -static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
42860 +static int __intentional_overflow(-1) mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata)
42861 {
42862 struct mthca_dev *dev = to_mdev(ibcq->device);
42863 struct mthca_cq *cq = to_mcq(ibcq);
42864 diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
42865 index 353c7b0..c6ce921 100644
42866 --- a/drivers/infiniband/hw/nes/nes.c
42867 +++ b/drivers/infiniband/hw/nes/nes.c
42868 @@ -98,7 +98,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limit max read request size to 256 Bytes");
42869 LIST_HEAD(nes_adapter_list);
42870 static LIST_HEAD(nes_dev_list);
42871
42872 -atomic_t qps_destroyed;
42873 +atomic_unchecked_t qps_destroyed;
42874
42875 static unsigned int ee_flsh_adapter;
42876 static unsigned int sysfs_nonidx_addr;
42877 @@ -269,7 +269,7 @@ static void nes_cqp_rem_ref_callback(struct nes_device *nesdev, struct nes_cqp_r
42878 struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
42879 struct nes_adapter *nesadapter = nesdev->nesadapter;
42880
42881 - atomic_inc(&qps_destroyed);
42882 + atomic_inc_unchecked(&qps_destroyed);
42883
42884 /* Free the control structures */
42885
42886 diff --git a/drivers/infiniband/hw/nes/nes.h b/drivers/infiniband/hw/nes/nes.h
42887 index 33cc589..3bd6538 100644
42888 --- a/drivers/infiniband/hw/nes/nes.h
42889 +++ b/drivers/infiniband/hw/nes/nes.h
42890 @@ -177,17 +177,17 @@ extern unsigned int nes_debug_level;
42891 extern unsigned int wqm_quanta;
42892 extern struct list_head nes_adapter_list;
42893
42894 -extern atomic_t cm_connects;
42895 -extern atomic_t cm_accepts;
42896 -extern atomic_t cm_disconnects;
42897 -extern atomic_t cm_closes;
42898 -extern atomic_t cm_connecteds;
42899 -extern atomic_t cm_connect_reqs;
42900 -extern atomic_t cm_rejects;
42901 -extern atomic_t mod_qp_timouts;
42902 -extern atomic_t qps_created;
42903 -extern atomic_t qps_destroyed;
42904 -extern atomic_t sw_qps_destroyed;
42905 +extern atomic_unchecked_t cm_connects;
42906 +extern atomic_unchecked_t cm_accepts;
42907 +extern atomic_unchecked_t cm_disconnects;
42908 +extern atomic_unchecked_t cm_closes;
42909 +extern atomic_unchecked_t cm_connecteds;
42910 +extern atomic_unchecked_t cm_connect_reqs;
42911 +extern atomic_unchecked_t cm_rejects;
42912 +extern atomic_unchecked_t mod_qp_timouts;
42913 +extern atomic_unchecked_t qps_created;
42914 +extern atomic_unchecked_t qps_destroyed;
42915 +extern atomic_unchecked_t sw_qps_destroyed;
42916 extern u32 mh_detected;
42917 extern u32 mh_pauses_sent;
42918 extern u32 cm_packets_sent;
42919 @@ -196,16 +196,16 @@ extern u32 cm_packets_created;
42920 extern u32 cm_packets_received;
42921 extern u32 cm_packets_dropped;
42922 extern u32 cm_packets_retrans;
42923 -extern atomic_t cm_listens_created;
42924 -extern atomic_t cm_listens_destroyed;
42925 +extern atomic_unchecked_t cm_listens_created;
42926 +extern atomic_unchecked_t cm_listens_destroyed;
42927 extern u32 cm_backlog_drops;
42928 -extern atomic_t cm_loopbacks;
42929 -extern atomic_t cm_nodes_created;
42930 -extern atomic_t cm_nodes_destroyed;
42931 -extern atomic_t cm_accel_dropped_pkts;
42932 -extern atomic_t cm_resets_recvd;
42933 -extern atomic_t pau_qps_created;
42934 -extern atomic_t pau_qps_destroyed;
42935 +extern atomic_unchecked_t cm_loopbacks;
42936 +extern atomic_unchecked_t cm_nodes_created;
42937 +extern atomic_unchecked_t cm_nodes_destroyed;
42938 +extern atomic_unchecked_t cm_accel_dropped_pkts;
42939 +extern atomic_unchecked_t cm_resets_recvd;
42940 +extern atomic_unchecked_t pau_qps_created;
42941 +extern atomic_unchecked_t pau_qps_destroyed;
42942
42943 extern u32 int_mod_timer_init;
42944 extern u32 int_mod_cq_depth_256;
42945 diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
42946 index 9c9f2f5..2559190 100644
42947 --- a/drivers/infiniband/hw/nes/nes_cm.c
42948 +++ b/drivers/infiniband/hw/nes/nes_cm.c
42949 @@ -68,14 +68,14 @@ u32 cm_packets_dropped;
42950 u32 cm_packets_retrans;
42951 u32 cm_packets_created;
42952 u32 cm_packets_received;
42953 -atomic_t cm_listens_created;
42954 -atomic_t cm_listens_destroyed;
42955 +atomic_unchecked_t cm_listens_created;
42956 +atomic_unchecked_t cm_listens_destroyed;
42957 u32 cm_backlog_drops;
42958 -atomic_t cm_loopbacks;
42959 -atomic_t cm_nodes_created;
42960 -atomic_t cm_nodes_destroyed;
42961 -atomic_t cm_accel_dropped_pkts;
42962 -atomic_t cm_resets_recvd;
42963 +atomic_unchecked_t cm_loopbacks;
42964 +atomic_unchecked_t cm_nodes_created;
42965 +atomic_unchecked_t cm_nodes_destroyed;
42966 +atomic_unchecked_t cm_accel_dropped_pkts;
42967 +atomic_unchecked_t cm_resets_recvd;
42968
42969 static inline int mini_cm_accelerated(struct nes_cm_core *, struct nes_cm_node *);
42970 static struct nes_cm_listener *mini_cm_listen(struct nes_cm_core *, struct nes_vnic *, struct nes_cm_info *);
42971 @@ -133,28 +133,28 @@ static void print_core(struct nes_cm_core *core);
42972 /* instance of function pointers for client API */
42973 /* set address of this instance to cm_core->cm_ops at cm_core alloc */
42974 static struct nes_cm_ops nes_cm_api = {
42975 - mini_cm_accelerated,
42976 - mini_cm_listen,
42977 - mini_cm_del_listen,
42978 - mini_cm_connect,
42979 - mini_cm_close,
42980 - mini_cm_accept,
42981 - mini_cm_reject,
42982 - mini_cm_recv_pkt,
42983 - mini_cm_dealloc_core,
42984 - mini_cm_get,
42985 - mini_cm_set
42986 + .accelerated = mini_cm_accelerated,
42987 + .listen = mini_cm_listen,
42988 + .stop_listener = mini_cm_del_listen,
42989 + .connect = mini_cm_connect,
42990 + .close = mini_cm_close,
42991 + .accept = mini_cm_accept,
42992 + .reject = mini_cm_reject,
42993 + .recv_pkt = mini_cm_recv_pkt,
42994 + .destroy_cm_core = mini_cm_dealloc_core,
42995 + .get = mini_cm_get,
42996 + .set = mini_cm_set
42997 };
42998
42999 static struct nes_cm_core *g_cm_core;
43000
43001 -atomic_t cm_connects;
43002 -atomic_t cm_accepts;
43003 -atomic_t cm_disconnects;
43004 -atomic_t cm_closes;
43005 -atomic_t cm_connecteds;
43006 -atomic_t cm_connect_reqs;
43007 -atomic_t cm_rejects;
43008 +atomic_unchecked_t cm_connects;
43009 +atomic_unchecked_t cm_accepts;
43010 +atomic_unchecked_t cm_disconnects;
43011 +atomic_unchecked_t cm_closes;
43012 +atomic_unchecked_t cm_connecteds;
43013 +atomic_unchecked_t cm_connect_reqs;
43014 +atomic_unchecked_t cm_rejects;
43015
43016 int nes_add_ref_cm_node(struct nes_cm_node *cm_node)
43017 {
43018 @@ -1272,7 +1272,7 @@ static int mini_cm_dec_refcnt_listen(struct nes_cm_core *cm_core,
43019 kfree(listener);
43020 listener = NULL;
43021 ret = 0;
43022 - atomic_inc(&cm_listens_destroyed);
43023 + atomic_inc_unchecked(&cm_listens_destroyed);
43024 } else {
43025 spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
43026 }
43027 @@ -1465,7 +1465,7 @@ static struct nes_cm_node *make_cm_node(struct nes_cm_core *cm_core,
43028 cm_node->rem_mac);
43029
43030 add_hte_node(cm_core, cm_node);
43031 - atomic_inc(&cm_nodes_created);
43032 + atomic_inc_unchecked(&cm_nodes_created);
43033
43034 return cm_node;
43035 }
43036 @@ -1523,7 +1523,7 @@ static int rem_ref_cm_node(struct nes_cm_core *cm_core,
43037 }
43038
43039 atomic_dec(&cm_core->node_cnt);
43040 - atomic_inc(&cm_nodes_destroyed);
43041 + atomic_inc_unchecked(&cm_nodes_destroyed);
43042 nesqp = cm_node->nesqp;
43043 if (nesqp) {
43044 nesqp->cm_node = NULL;
43045 @@ -1587,7 +1587,7 @@ static int process_options(struct nes_cm_node *cm_node, u8 *optionsloc,
43046
43047 static void drop_packet(struct sk_buff *skb)
43048 {
43049 - atomic_inc(&cm_accel_dropped_pkts);
43050 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
43051 dev_kfree_skb_any(skb);
43052 }
43053
43054 @@ -1650,7 +1650,7 @@ static void handle_rst_pkt(struct nes_cm_node *cm_node, struct sk_buff *skb,
43055 {
43056
43057 int reset = 0; /* whether to send reset in case of err.. */
43058 - atomic_inc(&cm_resets_recvd);
43059 + atomic_inc_unchecked(&cm_resets_recvd);
43060 nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
43061 " refcnt=%d\n", cm_node, cm_node->state,
43062 atomic_read(&cm_node->ref_count));
43063 @@ -2291,7 +2291,7 @@ static struct nes_cm_node *mini_cm_connect(struct nes_cm_core *cm_core,
43064 rem_ref_cm_node(cm_node->cm_core, cm_node);
43065 return NULL;
43066 }
43067 - atomic_inc(&cm_loopbacks);
43068 + atomic_inc_unchecked(&cm_loopbacks);
43069 loopbackremotenode->loopbackpartner = cm_node;
43070 loopbackremotenode->tcp_cntxt.rcv_wscale =
43071 NES_CM_DEFAULT_RCV_WND_SCALE;
43072 @@ -2566,7 +2566,7 @@ static int mini_cm_recv_pkt(struct nes_cm_core *cm_core,
43073 nes_queue_mgt_skbs(skb, nesvnic, cm_node->nesqp);
43074 else {
43075 rem_ref_cm_node(cm_core, cm_node);
43076 - atomic_inc(&cm_accel_dropped_pkts);
43077 + atomic_inc_unchecked(&cm_accel_dropped_pkts);
43078 dev_kfree_skb_any(skb);
43079 }
43080 break;
43081 @@ -2874,7 +2874,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
43082
43083 if ((cm_id) && (cm_id->event_handler)) {
43084 if (issue_disconn) {
43085 - atomic_inc(&cm_disconnects);
43086 + atomic_inc_unchecked(&cm_disconnects);
43087 cm_event.event = IW_CM_EVENT_DISCONNECT;
43088 cm_event.status = disconn_status;
43089 cm_event.local_addr = cm_id->local_addr;
43090 @@ -2896,7 +2896,7 @@ static int nes_cm_disconn_true(struct nes_qp *nesqp)
43091 }
43092
43093 if (issue_close) {
43094 - atomic_inc(&cm_closes);
43095 + atomic_inc_unchecked(&cm_closes);
43096 nes_disconnect(nesqp, 1);
43097
43098 cm_id->provider_data = nesqp;
43099 @@ -3034,7 +3034,7 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
43100
43101 nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
43102 nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
43103 - atomic_inc(&cm_accepts);
43104 + atomic_inc_unchecked(&cm_accepts);
43105
43106 nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
43107 netdev_refcnt_read(nesvnic->netdev));
43108 @@ -3223,7 +3223,7 @@ int nes_reject(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
43109 struct nes_cm_core *cm_core;
43110 u8 *start_buff;
43111
43112 - atomic_inc(&cm_rejects);
43113 + atomic_inc_unchecked(&cm_rejects);
43114 cm_node = (struct nes_cm_node *)cm_id->provider_data;
43115 loopback = cm_node->loopbackpartner;
43116 cm_core = cm_node->cm_core;
43117 @@ -3285,7 +3285,7 @@ int nes_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
43118 ntohs(raddr->sin_port), ntohl(laddr->sin_addr.s_addr),
43119 ntohs(laddr->sin_port));
43120
43121 - atomic_inc(&cm_connects);
43122 + atomic_inc_unchecked(&cm_connects);
43123 nesqp->active_conn = 1;
43124
43125 /* cache the cm_id in the qp */
43126 @@ -3397,7 +3397,7 @@ int nes_create_listen(struct iw_cm_id *cm_id, int backlog)
43127 g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
43128 return err;
43129 }
43130 - atomic_inc(&cm_listens_created);
43131 + atomic_inc_unchecked(&cm_listens_created);
43132 }
43133
43134 cm_id->add_ref(cm_id);
43135 @@ -3504,7 +3504,7 @@ static void cm_event_connected(struct nes_cm_event *event)
43136
43137 if (nesqp->destroyed)
43138 return;
43139 - atomic_inc(&cm_connecteds);
43140 + atomic_inc_unchecked(&cm_connecteds);
43141 nes_debug(NES_DBG_CM, "QP%u attempting to connect to 0x%08X:0x%04X on"
43142 " local port 0x%04X. jiffies = %lu.\n",
43143 nesqp->hwqp.qp_id, ntohl(raddr->sin_addr.s_addr),
43144 @@ -3685,7 +3685,7 @@ static void cm_event_reset(struct nes_cm_event *event)
43145
43146 cm_id->add_ref(cm_id);
43147 ret = cm_id->event_handler(cm_id, &cm_event);
43148 - atomic_inc(&cm_closes);
43149 + atomic_inc_unchecked(&cm_closes);
43150 cm_event.event = IW_CM_EVENT_CLOSE;
43151 cm_event.status = 0;
43152 cm_event.provider_data = cm_id->provider_data;
43153 @@ -3725,7 +3725,7 @@ static void cm_event_mpa_req(struct nes_cm_event *event)
43154 return;
43155 cm_id = cm_node->cm_id;
43156
43157 - atomic_inc(&cm_connect_reqs);
43158 + atomic_inc_unchecked(&cm_connect_reqs);
43159 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
43160 cm_node, cm_id, jiffies);
43161
43162 @@ -3769,7 +3769,7 @@ static void cm_event_mpa_reject(struct nes_cm_event *event)
43163 return;
43164 cm_id = cm_node->cm_id;
43165
43166 - atomic_inc(&cm_connect_reqs);
43167 + atomic_inc_unchecked(&cm_connect_reqs);
43168 nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
43169 cm_node, cm_id, jiffies);
43170
43171 diff --git a/drivers/infiniband/hw/nes/nes_mgt.c b/drivers/infiniband/hw/nes/nes_mgt.c
43172 index 4166452..fc952c3 100644
43173 --- a/drivers/infiniband/hw/nes/nes_mgt.c
43174 +++ b/drivers/infiniband/hw/nes/nes_mgt.c
43175 @@ -40,8 +40,8 @@
43176 #include "nes.h"
43177 #include "nes_mgt.h"
43178
43179 -atomic_t pau_qps_created;
43180 -atomic_t pau_qps_destroyed;
43181 +atomic_unchecked_t pau_qps_created;
43182 +atomic_unchecked_t pau_qps_destroyed;
43183
43184 static void nes_replenish_mgt_rq(struct nes_vnic_mgt *mgtvnic)
43185 {
43186 @@ -621,7 +621,7 @@ void nes_destroy_pau_qp(struct nes_device *nesdev, struct nes_qp *nesqp)
43187 {
43188 struct sk_buff *skb;
43189 unsigned long flags;
43190 - atomic_inc(&pau_qps_destroyed);
43191 + atomic_inc_unchecked(&pau_qps_destroyed);
43192
43193 /* Free packets that have not yet been forwarded */
43194 /* Lock is acquired by skb_dequeue when removing the skb */
43195 @@ -810,7 +810,7 @@ static void nes_mgt_ce_handler(struct nes_device *nesdev, struct nes_hw_nic_cq *
43196 cq->cq_vbase[head].cqe_words[NES_NIC_CQE_HASH_RCVNXT]);
43197 skb_queue_head_init(&nesqp->pau_list);
43198 spin_lock_init(&nesqp->pau_lock);
43199 - atomic_inc(&pau_qps_created);
43200 + atomic_inc_unchecked(&pau_qps_created);
43201 nes_change_quad_hash(nesdev, mgtvnic->nesvnic, nesqp);
43202 }
43203
43204 diff --git a/drivers/infiniband/hw/nes/nes_nic.c b/drivers/infiniband/hw/nes/nes_nic.c
43205 index 49eb511..a774366 100644
43206 --- a/drivers/infiniband/hw/nes/nes_nic.c
43207 +++ b/drivers/infiniband/hw/nes/nes_nic.c
43208 @@ -1273,39 +1273,39 @@ static void nes_netdev_get_ethtool_stats(struct net_device *netdev,
43209 target_stat_values[++index] = mh_detected;
43210 target_stat_values[++index] = mh_pauses_sent;
43211 target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
43212 - target_stat_values[++index] = atomic_read(&cm_connects);
43213 - target_stat_values[++index] = atomic_read(&cm_accepts);
43214 - target_stat_values[++index] = atomic_read(&cm_disconnects);
43215 - target_stat_values[++index] = atomic_read(&cm_connecteds);
43216 - target_stat_values[++index] = atomic_read(&cm_connect_reqs);
43217 - target_stat_values[++index] = atomic_read(&cm_rejects);
43218 - target_stat_values[++index] = atomic_read(&mod_qp_timouts);
43219 - target_stat_values[++index] = atomic_read(&qps_created);
43220 - target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
43221 - target_stat_values[++index] = atomic_read(&qps_destroyed);
43222 - target_stat_values[++index] = atomic_read(&cm_closes);
43223 + target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
43224 + target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
43225 + target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
43226 + target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
43227 + target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
43228 + target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
43229 + target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
43230 + target_stat_values[++index] = atomic_read_unchecked(&qps_created);
43231 + target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
43232 + target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
43233 + target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
43234 target_stat_values[++index] = cm_packets_sent;
43235 target_stat_values[++index] = cm_packets_bounced;
43236 target_stat_values[++index] = cm_packets_created;
43237 target_stat_values[++index] = cm_packets_received;
43238 target_stat_values[++index] = cm_packets_dropped;
43239 target_stat_values[++index] = cm_packets_retrans;
43240 - target_stat_values[++index] = atomic_read(&cm_listens_created);
43241 - target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
43242 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
43243 + target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
43244 target_stat_values[++index] = cm_backlog_drops;
43245 - target_stat_values[++index] = atomic_read(&cm_loopbacks);
43246 - target_stat_values[++index] = atomic_read(&cm_nodes_created);
43247 - target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
43248 - target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
43249 - target_stat_values[++index] = atomic_read(&cm_resets_recvd);
43250 + target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
43251 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
43252 + target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
43253 + target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
43254 + target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
43255 target_stat_values[++index] = nesadapter->free_4kpbl;
43256 target_stat_values[++index] = nesadapter->free_256pbl;
43257 target_stat_values[++index] = int_mod_timer_init;
43258 target_stat_values[++index] = nesvnic->lro_mgr.stats.aggregated;
43259 target_stat_values[++index] = nesvnic->lro_mgr.stats.flushed;
43260 target_stat_values[++index] = nesvnic->lro_mgr.stats.no_desc;
43261 - target_stat_values[++index] = atomic_read(&pau_qps_created);
43262 - target_stat_values[++index] = atomic_read(&pau_qps_destroyed);
43263 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_created);
43264 + target_stat_values[++index] = atomic_read_unchecked(&pau_qps_destroyed);
43265 }
43266
43267 /**
43268 diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
43269 index eb62461..2b7fc71 100644
43270 --- a/drivers/infiniband/hw/nes/nes_verbs.c
43271 +++ b/drivers/infiniband/hw/nes/nes_verbs.c
43272 @@ -46,9 +46,9 @@
43273
43274 #include <rdma/ib_umem.h>
43275
43276 -atomic_t mod_qp_timouts;
43277 -atomic_t qps_created;
43278 -atomic_t sw_qps_destroyed;
43279 +atomic_unchecked_t mod_qp_timouts;
43280 +atomic_unchecked_t qps_created;
43281 +atomic_unchecked_t sw_qps_destroyed;
43282
43283 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
43284
43285 @@ -1134,7 +1134,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
43286 if (init_attr->create_flags)
43287 return ERR_PTR(-EINVAL);
43288
43289 - atomic_inc(&qps_created);
43290 + atomic_inc_unchecked(&qps_created);
43291 switch (init_attr->qp_type) {
43292 case IB_QPT_RC:
43293 if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
43294 @@ -1466,7 +1466,7 @@ static int nes_destroy_qp(struct ib_qp *ibqp)
43295 struct iw_cm_event cm_event;
43296 int ret = 0;
43297
43298 - atomic_inc(&sw_qps_destroyed);
43299 + atomic_inc_unchecked(&sw_qps_destroyed);
43300 nesqp->destroyed = 1;
43301
43302 /* Blow away the connection if it exists. */
43303 diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
43304 index 1946101..09766d2 100644
43305 --- a/drivers/infiniband/hw/qib/qib.h
43306 +++ b/drivers/infiniband/hw/qib/qib.h
43307 @@ -52,6 +52,7 @@
43308 #include <linux/kref.h>
43309 #include <linux/sched.h>
43310 #include <linux/kthread.h>
43311 +#include <linux/slab.h>
43312
43313 #include "qib_common.h"
43314 #include "qib_verbs.h"
43315 diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
43316 index 24c41ba..102d71f 100644
43317 --- a/drivers/input/gameport/gameport.c
43318 +++ b/drivers/input/gameport/gameport.c
43319 @@ -490,14 +490,14 @@ EXPORT_SYMBOL(gameport_set_phys);
43320 */
43321 static void gameport_init_port(struct gameport *gameport)
43322 {
43323 - static atomic_t gameport_no = ATOMIC_INIT(0);
43324 + static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
43325
43326 __module_get(THIS_MODULE);
43327
43328 mutex_init(&gameport->drv_mutex);
43329 device_initialize(&gameport->dev);
43330 dev_set_name(&gameport->dev, "gameport%lu",
43331 - (unsigned long)atomic_inc_return(&gameport_no) - 1);
43332 + (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
43333 gameport->dev.bus = &gameport_bus;
43334 gameport->dev.release = gameport_release_port;
43335 if (gameport->parent)
43336 diff --git a/drivers/input/input.c b/drivers/input/input.c
43337 index 1c4c0db..6f7abe3 100644
43338 --- a/drivers/input/input.c
43339 +++ b/drivers/input/input.c
43340 @@ -1772,7 +1772,7 @@ EXPORT_SYMBOL_GPL(input_class);
43341 */
43342 struct input_dev *input_allocate_device(void)
43343 {
43344 - static atomic_t input_no = ATOMIC_INIT(0);
43345 + static atomic_unchecked_t input_no = ATOMIC_INIT(0);
43346 struct input_dev *dev;
43347
43348 dev = kzalloc(sizeof(struct input_dev), GFP_KERNEL);
43349 @@ -1787,7 +1787,7 @@ struct input_dev *input_allocate_device(void)
43350 INIT_LIST_HEAD(&dev->node);
43351
43352 dev_set_name(&dev->dev, "input%ld",
43353 - (unsigned long) atomic_inc_return(&input_no) - 1);
43354 + (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
43355
43356 __module_get(THIS_MODULE);
43357 }
43358 diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
43359 index 4a95b22..874c182 100644
43360 --- a/drivers/input/joystick/sidewinder.c
43361 +++ b/drivers/input/joystick/sidewinder.c
43362 @@ -30,6 +30,7 @@
43363 #include <linux/kernel.h>
43364 #include <linux/module.h>
43365 #include <linux/slab.h>
43366 +#include <linux/sched.h>
43367 #include <linux/input.h>
43368 #include <linux/gameport.h>
43369 #include <linux/jiffies.h>
43370 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
43371 index 603fe0d..f63decc 100644
43372 --- a/drivers/input/joystick/xpad.c
43373 +++ b/drivers/input/joystick/xpad.c
43374 @@ -737,7 +737,7 @@ static void xpad_led_set(struct led_classdev *led_cdev,
43375
43376 static int xpad_led_probe(struct usb_xpad *xpad)
43377 {
43378 - static atomic_t led_seq = ATOMIC_INIT(0);
43379 + static atomic_unchecked_t led_seq = ATOMIC_INIT(0);
43380 long led_no;
43381 struct xpad_led *led;
43382 struct led_classdev *led_cdev;
43383 @@ -750,7 +750,7 @@ static int xpad_led_probe(struct usb_xpad *xpad)
43384 if (!led)
43385 return -ENOMEM;
43386
43387 - led_no = (long)atomic_inc_return(&led_seq) - 1;
43388 + led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
43389
43390 snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
43391 led->xpad = xpad;
43392 diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
43393 index e204f26..8459f15 100644
43394 --- a/drivers/input/misc/ims-pcu.c
43395 +++ b/drivers/input/misc/ims-pcu.c
43396 @@ -1621,7 +1621,7 @@ static int ims_pcu_identify_type(struct ims_pcu *pcu, u8 *device_id)
43397
43398 static int ims_pcu_init_application_mode(struct ims_pcu *pcu)
43399 {
43400 - static atomic_t device_no = ATOMIC_INIT(0);
43401 + static atomic_unchecked_t device_no = ATOMIC_INIT(0);
43402
43403 const struct ims_pcu_device_info *info;
43404 u8 device_id;
43405 @@ -1653,7 +1653,7 @@ static int ims_pcu_init_application_mode(struct ims_pcu *pcu)
43406 }
43407
43408 /* Device appears to be operable, complete initialization */
43409 - pcu->device_no = atomic_inc_return(&device_no) - 1;
43410 + pcu->device_no = atomic_inc_return_unchecked(&device_no) - 1;
43411
43412 error = ims_pcu_setup_backlight(pcu);
43413 if (error)
43414 diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
43415 index 2f0b39d..7370f13 100644
43416 --- a/drivers/input/mouse/psmouse.h
43417 +++ b/drivers/input/mouse/psmouse.h
43418 @@ -116,7 +116,7 @@ struct psmouse_attribute {
43419 ssize_t (*set)(struct psmouse *psmouse, void *data,
43420 const char *buf, size_t count);
43421 bool protect;
43422 -};
43423 +} __do_const;
43424 #define to_psmouse_attr(a) container_of((a), struct psmouse_attribute, dattr)
43425
43426 ssize_t psmouse_attr_show_helper(struct device *dev, struct device_attribute *attr,
43427 diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
43428 index b604564..3f14ae4 100644
43429 --- a/drivers/input/mousedev.c
43430 +++ b/drivers/input/mousedev.c
43431 @@ -744,7 +744,7 @@ static ssize_t mousedev_read(struct file *file, char __user *buffer,
43432
43433 spin_unlock_irq(&client->packet_lock);
43434
43435 - if (copy_to_user(buffer, data, count))
43436 + if (count > sizeof(data) || copy_to_user(buffer, data, count))
43437 return -EFAULT;
43438
43439 return count;
43440 diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
43441 index 8f4c4ab..5fc8a45 100644
43442 --- a/drivers/input/serio/serio.c
43443 +++ b/drivers/input/serio/serio.c
43444 @@ -505,7 +505,7 @@ static void serio_release_port(struct device *dev)
43445 */
43446 static void serio_init_port(struct serio *serio)
43447 {
43448 - static atomic_t serio_no = ATOMIC_INIT(0);
43449 + static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
43450
43451 __module_get(THIS_MODULE);
43452
43453 @@ -516,7 +516,7 @@ static void serio_init_port(struct serio *serio)
43454 mutex_init(&serio->drv_mutex);
43455 device_initialize(&serio->dev);
43456 dev_set_name(&serio->dev, "serio%ld",
43457 - (long)atomic_inc_return(&serio_no) - 1);
43458 + (long)atomic_inc_return_unchecked(&serio_no) - 1);
43459 serio->dev.bus = &serio_bus;
43460 serio->dev.release = serio_release_port;
43461 serio->dev.groups = serio_device_attr_groups;
43462 diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c
43463 index c9a02fe..0debc75 100644
43464 --- a/drivers/input/serio/serio_raw.c
43465 +++ b/drivers/input/serio/serio_raw.c
43466 @@ -292,7 +292,7 @@ static irqreturn_t serio_raw_interrupt(struct serio *serio, unsigned char data,
43467
43468 static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
43469 {
43470 - static atomic_t serio_raw_no = ATOMIC_INIT(0);
43471 + static atomic_unchecked_t serio_raw_no = ATOMIC_INIT(0);
43472 struct serio_raw *serio_raw;
43473 int err;
43474
43475 @@ -303,7 +303,7 @@ static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
43476 }
43477
43478 snprintf(serio_raw->name, sizeof(serio_raw->name),
43479 - "serio_raw%ld", (long)atomic_inc_return(&serio_raw_no) - 1);
43480 + "serio_raw%ld", (long)atomic_inc_return_unchecked(&serio_raw_no) - 1);
43481 kref_init(&serio_raw->kref);
43482 INIT_LIST_HEAD(&serio_raw->client_list);
43483 init_waitqueue_head(&serio_raw->wait);
43484 diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
43485 index e5555fc..937986d 100644
43486 --- a/drivers/iommu/iommu.c
43487 +++ b/drivers/iommu/iommu.c
43488 @@ -588,7 +588,7 @@ static struct notifier_block iommu_bus_nb = {
43489 static void iommu_bus_init(struct bus_type *bus, struct iommu_ops *ops)
43490 {
43491 bus_register_notifier(bus, &iommu_bus_nb);
43492 - bus_for_each_dev(bus, NULL, ops, add_iommu_group);
43493 + bus_for_each_dev(bus, NULL, (void *)ops, add_iommu_group);
43494 }
43495
43496 /**
43497 diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
43498 index 228632c9..edfe331 100644
43499 --- a/drivers/iommu/irq_remapping.c
43500 +++ b/drivers/iommu/irq_remapping.c
43501 @@ -356,7 +356,7 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
43502 void panic_if_irq_remap(const char *msg)
43503 {
43504 if (irq_remapping_enabled)
43505 - panic(msg);
43506 + panic("%s", msg);
43507 }
43508
43509 static void ir_ack_apic_edge(struct irq_data *data)
43510 @@ -377,10 +377,12 @@ static void ir_print_prefix(struct irq_data *data, struct seq_file *p)
43511
43512 void irq_remap_modify_chip_defaults(struct irq_chip *chip)
43513 {
43514 - chip->irq_print_chip = ir_print_prefix;
43515 - chip->irq_ack = ir_ack_apic_edge;
43516 - chip->irq_eoi = ir_ack_apic_level;
43517 - chip->irq_set_affinity = x86_io_apic_ops.set_affinity;
43518 + pax_open_kernel();
43519 + *(void **)&chip->irq_print_chip = ir_print_prefix;
43520 + *(void **)&chip->irq_ack = ir_ack_apic_edge;
43521 + *(void **)&chip->irq_eoi = ir_ack_apic_level;
43522 + *(void **)&chip->irq_set_affinity = x86_io_apic_ops.set_affinity;
43523 + pax_close_kernel();
43524 }
43525
43526 bool setup_remapped_irq(int irq, struct irq_cfg *cfg, struct irq_chip *chip)
43527 diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
43528 index 341c601..e5f407e 100644
43529 --- a/drivers/irqchip/irq-gic.c
43530 +++ b/drivers/irqchip/irq-gic.c
43531 @@ -84,7 +84,7 @@ static u8 gic_cpu_map[NR_GIC_CPU_IF] __read_mostly;
43532 * Supported arch specific GIC irq extension.
43533 * Default make them NULL.
43534 */
43535 -struct irq_chip gic_arch_extn = {
43536 +irq_chip_no_const gic_arch_extn = {
43537 .irq_eoi = NULL,
43538 .irq_mask = NULL,
43539 .irq_unmask = NULL,
43540 @@ -332,7 +332,7 @@ static void gic_handle_cascade_irq(unsigned int irq, struct irq_desc *desc)
43541 chained_irq_exit(chip, desc);
43542 }
43543
43544 -static struct irq_chip gic_chip = {
43545 +static irq_chip_no_const gic_chip __read_only = {
43546 .name = "GIC",
43547 .irq_mask = gic_mask_irq,
43548 .irq_unmask = gic_unmask_irq,
43549 diff --git a/drivers/irqchip/irq-renesas-irqc.c b/drivers/irqchip/irq-renesas-irqc.c
43550 index 8777065..a4a9967 100644
43551 --- a/drivers/irqchip/irq-renesas-irqc.c
43552 +++ b/drivers/irqchip/irq-renesas-irqc.c
43553 @@ -151,7 +151,7 @@ static int irqc_probe(struct platform_device *pdev)
43554 struct irqc_priv *p;
43555 struct resource *io;
43556 struct resource *irq;
43557 - struct irq_chip *irq_chip;
43558 + irq_chip_no_const *irq_chip;
43559 const char *name = dev_name(&pdev->dev);
43560 int ret;
43561 int k;
43562 diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
43563 index ac6f72b..81150f2 100644
43564 --- a/drivers/isdn/capi/capi.c
43565 +++ b/drivers/isdn/capi/capi.c
43566 @@ -81,8 +81,8 @@ struct capiminor {
43567
43568 struct capi20_appl *ap;
43569 u32 ncci;
43570 - atomic_t datahandle;
43571 - atomic_t msgid;
43572 + atomic_unchecked_t datahandle;
43573 + atomic_unchecked_t msgid;
43574
43575 struct tty_port port;
43576 int ttyinstop;
43577 @@ -391,7 +391,7 @@ gen_data_b3_resp_for(struct capiminor *mp, struct sk_buff *skb)
43578 capimsg_setu16(s, 2, mp->ap->applid);
43579 capimsg_setu8 (s, 4, CAPI_DATA_B3);
43580 capimsg_setu8 (s, 5, CAPI_RESP);
43581 - capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
43582 + capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
43583 capimsg_setu32(s, 8, mp->ncci);
43584 capimsg_setu16(s, 12, datahandle);
43585 }
43586 @@ -512,14 +512,14 @@ static void handle_minor_send(struct capiminor *mp)
43587 mp->outbytes -= len;
43588 spin_unlock_bh(&mp->outlock);
43589
43590 - datahandle = atomic_inc_return(&mp->datahandle);
43591 + datahandle = atomic_inc_return_unchecked(&mp->datahandle);
43592 skb_push(skb, CAPI_DATA_B3_REQ_LEN);
43593 memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
43594 capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
43595 capimsg_setu16(skb->data, 2, mp->ap->applid);
43596 capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
43597 capimsg_setu8 (skb->data, 5, CAPI_REQ);
43598 - capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
43599 + capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
43600 capimsg_setu32(skb->data, 8, mp->ncci); /* NCCI */
43601 capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
43602 capimsg_setu16(skb->data, 16, len); /* Data length */
43603 diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
43604 index c44950d..10ac276 100644
43605 --- a/drivers/isdn/gigaset/bas-gigaset.c
43606 +++ b/drivers/isdn/gigaset/bas-gigaset.c
43607 @@ -2564,22 +2564,22 @@ static int gigaset_post_reset(struct usb_interface *intf)
43608
43609
43610 static const struct gigaset_ops gigops = {
43611 - gigaset_write_cmd,
43612 - gigaset_write_room,
43613 - gigaset_chars_in_buffer,
43614 - gigaset_brkchars,
43615 - gigaset_init_bchannel,
43616 - gigaset_close_bchannel,
43617 - gigaset_initbcshw,
43618 - gigaset_freebcshw,
43619 - gigaset_reinitbcshw,
43620 - gigaset_initcshw,
43621 - gigaset_freecshw,
43622 - gigaset_set_modem_ctrl,
43623 - gigaset_baud_rate,
43624 - gigaset_set_line_ctrl,
43625 - gigaset_isoc_send_skb,
43626 - gigaset_isoc_input,
43627 + .write_cmd = gigaset_write_cmd,
43628 + .write_room = gigaset_write_room,
43629 + .chars_in_buffer = gigaset_chars_in_buffer,
43630 + .brkchars = gigaset_brkchars,
43631 + .init_bchannel = gigaset_init_bchannel,
43632 + .close_bchannel = gigaset_close_bchannel,
43633 + .initbcshw = gigaset_initbcshw,
43634 + .freebcshw = gigaset_freebcshw,
43635 + .reinitbcshw = gigaset_reinitbcshw,
43636 + .initcshw = gigaset_initcshw,
43637 + .freecshw = gigaset_freecshw,
43638 + .set_modem_ctrl = gigaset_set_modem_ctrl,
43639 + .baud_rate = gigaset_baud_rate,
43640 + .set_line_ctrl = gigaset_set_line_ctrl,
43641 + .send_skb = gigaset_isoc_send_skb,
43642 + .handle_input = gigaset_isoc_input,
43643 };
43644
43645 /* bas_gigaset_init
43646 diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
43647 index 600c79b..3752bab 100644
43648 --- a/drivers/isdn/gigaset/interface.c
43649 +++ b/drivers/isdn/gigaset/interface.c
43650 @@ -130,9 +130,9 @@ static int if_open(struct tty_struct *tty, struct file *filp)
43651 }
43652 tty->driver_data = cs;
43653
43654 - ++cs->port.count;
43655 + atomic_inc(&cs->port.count);
43656
43657 - if (cs->port.count == 1) {
43658 + if (atomic_read(&cs->port.count) == 1) {
43659 tty_port_tty_set(&cs->port, tty);
43660 cs->port.low_latency = 1;
43661 }
43662 @@ -156,9 +156,9 @@ static void if_close(struct tty_struct *tty, struct file *filp)
43663
43664 if (!cs->connected)
43665 gig_dbg(DEBUG_IF, "not connected"); /* nothing to do */
43666 - else if (!cs->port.count)
43667 + else if (!atomic_read(&cs->port.count))
43668 dev_warn(cs->dev, "%s: device not opened\n", __func__);
43669 - else if (!--cs->port.count)
43670 + else if (!atomic_dec_return(&cs->port.count))
43671 tty_port_tty_set(&cs->port, NULL);
43672
43673 mutex_unlock(&cs->mutex);
43674 diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
43675 index 8c91fd5..14f13ce 100644
43676 --- a/drivers/isdn/gigaset/ser-gigaset.c
43677 +++ b/drivers/isdn/gigaset/ser-gigaset.c
43678 @@ -453,22 +453,22 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
43679 }
43680
43681 static const struct gigaset_ops ops = {
43682 - gigaset_write_cmd,
43683 - gigaset_write_room,
43684 - gigaset_chars_in_buffer,
43685 - gigaset_brkchars,
43686 - gigaset_init_bchannel,
43687 - gigaset_close_bchannel,
43688 - gigaset_initbcshw,
43689 - gigaset_freebcshw,
43690 - gigaset_reinitbcshw,
43691 - gigaset_initcshw,
43692 - gigaset_freecshw,
43693 - gigaset_set_modem_ctrl,
43694 - gigaset_baud_rate,
43695 - gigaset_set_line_ctrl,
43696 - gigaset_m10x_send_skb, /* asyncdata.c */
43697 - gigaset_m10x_input, /* asyncdata.c */
43698 + .write_cmd = gigaset_write_cmd,
43699 + .write_room = gigaset_write_room,
43700 + .chars_in_buffer = gigaset_chars_in_buffer,
43701 + .brkchars = gigaset_brkchars,
43702 + .init_bchannel = gigaset_init_bchannel,
43703 + .close_bchannel = gigaset_close_bchannel,
43704 + .initbcshw = gigaset_initbcshw,
43705 + .freebcshw = gigaset_freebcshw,
43706 + .reinitbcshw = gigaset_reinitbcshw,
43707 + .initcshw = gigaset_initcshw,
43708 + .freecshw = gigaset_freecshw,
43709 + .set_modem_ctrl = gigaset_set_modem_ctrl,
43710 + .baud_rate = gigaset_baud_rate,
43711 + .set_line_ctrl = gigaset_set_line_ctrl,
43712 + .send_skb = gigaset_m10x_send_skb, /* asyncdata.c */
43713 + .handle_input = gigaset_m10x_input, /* asyncdata.c */
43714 };
43715
43716
43717 diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
43718 index d0a41cb..b953e50 100644
43719 --- a/drivers/isdn/gigaset/usb-gigaset.c
43720 +++ b/drivers/isdn/gigaset/usb-gigaset.c
43721 @@ -547,7 +547,7 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
43722 gigaset_dbg_buffer(DEBUG_USBREQ, "brkchars", 6, buf);
43723 memcpy(cs->hw.usb->bchars, buf, 6);
43724 return usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x19, 0x41,
43725 - 0, 0, &buf, 6, 2000);
43726 + 0, 0, buf, 6, 2000);
43727 }
43728
43729 static void gigaset_freebcshw(struct bc_state *bcs)
43730 @@ -869,22 +869,22 @@ static int gigaset_pre_reset(struct usb_interface *intf)
43731 }
43732
43733 static const struct gigaset_ops ops = {
43734 - gigaset_write_cmd,
43735 - gigaset_write_room,
43736 - gigaset_chars_in_buffer,
43737 - gigaset_brkchars,
43738 - gigaset_init_bchannel,
43739 - gigaset_close_bchannel,
43740 - gigaset_initbcshw,
43741 - gigaset_freebcshw,
43742 - gigaset_reinitbcshw,
43743 - gigaset_initcshw,
43744 - gigaset_freecshw,
43745 - gigaset_set_modem_ctrl,
43746 - gigaset_baud_rate,
43747 - gigaset_set_line_ctrl,
43748 - gigaset_m10x_send_skb,
43749 - gigaset_m10x_input,
43750 + .write_cmd = gigaset_write_cmd,
43751 + .write_room = gigaset_write_room,
43752 + .chars_in_buffer = gigaset_chars_in_buffer,
43753 + .brkchars = gigaset_brkchars,
43754 + .init_bchannel = gigaset_init_bchannel,
43755 + .close_bchannel = gigaset_close_bchannel,
43756 + .initbcshw = gigaset_initbcshw,
43757 + .freebcshw = gigaset_freebcshw,
43758 + .reinitbcshw = gigaset_reinitbcshw,
43759 + .initcshw = gigaset_initcshw,
43760 + .freecshw = gigaset_freecshw,
43761 + .set_modem_ctrl = gigaset_set_modem_ctrl,
43762 + .baud_rate = gigaset_baud_rate,
43763 + .set_line_ctrl = gigaset_set_line_ctrl,
43764 + .send_skb = gigaset_m10x_send_skb,
43765 + .handle_input = gigaset_m10x_input,
43766 };
43767
43768 /*
43769 diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
43770 index 4d9b195..455075c 100644
43771 --- a/drivers/isdn/hardware/avm/b1.c
43772 +++ b/drivers/isdn/hardware/avm/b1.c
43773 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capiloaddatapart *t4file)
43774 }
43775 if (left) {
43776 if (t4file->user) {
43777 - if (copy_from_user(buf, dp, left))
43778 + if (left > sizeof buf || copy_from_user(buf, dp, left))
43779 return -EFAULT;
43780 } else {
43781 memcpy(buf, dp, left);
43782 @@ -224,7 +224,7 @@ int b1_load_config(avmcard *card, capiloaddatapart *config)
43783 }
43784 if (left) {
43785 if (config->user) {
43786 - if (copy_from_user(buf, dp, left))
43787 + if (left > sizeof buf || copy_from_user(buf, dp, left))
43788 return -EFAULT;
43789 } else {
43790 memcpy(buf, dp, left);
43791 diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
43792 index 9bb12ba..d4262f7 100644
43793 --- a/drivers/isdn/i4l/isdn_common.c
43794 +++ b/drivers/isdn/i4l/isdn_common.c
43795 @@ -1651,6 +1651,8 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg)
43796 } else
43797 return -EINVAL;
43798 case IIOCDBGVAR:
43799 + if (!capable(CAP_SYS_RAWIO))
43800 + return -EPERM;
43801 if (arg) {
43802 if (copy_to_user(argp, &dev, sizeof(ulong)))
43803 return -EFAULT;
43804 diff --git a/drivers/isdn/i4l/isdn_concap.c b/drivers/isdn/i4l/isdn_concap.c
43805 index 91d5730..336523e 100644
43806 --- a/drivers/isdn/i4l/isdn_concap.c
43807 +++ b/drivers/isdn/i4l/isdn_concap.c
43808 @@ -80,9 +80,9 @@ static int isdn_concap_dl_disconn_req(struct concap_proto *concap)
43809 }
43810
43811 struct concap_device_ops isdn_concap_reliable_dl_dops = {
43812 - &isdn_concap_dl_data_req,
43813 - &isdn_concap_dl_connect_req,
43814 - &isdn_concap_dl_disconn_req
43815 + .data_req = &isdn_concap_dl_data_req,
43816 + .connect_req = &isdn_concap_dl_connect_req,
43817 + .disconn_req = &isdn_concap_dl_disconn_req
43818 };
43819
43820 /* The following should better go into a dedicated source file such that
43821 diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
43822 index 3c5f249..5fac4d0 100644
43823 --- a/drivers/isdn/i4l/isdn_tty.c
43824 +++ b/drivers/isdn/i4l/isdn_tty.c
43825 @@ -1508,9 +1508,9 @@ isdn_tty_open(struct tty_struct *tty, struct file *filp)
43826
43827 #ifdef ISDN_DEBUG_MODEM_OPEN
43828 printk(KERN_DEBUG "isdn_tty_open %s, count = %d\n", tty->name,
43829 - port->count);
43830 + atomic_read(&port->count));
43831 #endif
43832 - port->count++;
43833 + atomic_inc(&port->count);
43834 port->tty = tty;
43835 /*
43836 * Start up serial port
43837 @@ -1554,7 +1554,7 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
43838 #endif
43839 return;
43840 }
43841 - if ((tty->count == 1) && (port->count != 1)) {
43842 + if ((tty->count == 1) && (atomic_read(&port->count) != 1)) {
43843 /*
43844 * Uh, oh. tty->count is 1, which means that the tty
43845 * structure will be freed. Info->count should always
43846 @@ -1563,15 +1563,15 @@ isdn_tty_close(struct tty_struct *tty, struct file *filp)
43847 * serial port won't be shutdown.
43848 */
43849 printk(KERN_ERR "isdn_tty_close: bad port count; tty->count is 1, "
43850 - "info->count is %d\n", port->count);
43851 - port->count = 1;
43852 + "info->count is %d\n", atomic_read(&port->count));
43853 + atomic_set(&port->count, 1);
43854 }
43855 - if (--port->count < 0) {
43856 + if (atomic_dec_return(&port->count) < 0) {
43857 printk(KERN_ERR "isdn_tty_close: bad port count for ttyi%d: %d\n",
43858 - info->line, port->count);
43859 - port->count = 0;
43860 + info->line, atomic_read(&port->count));
43861 + atomic_set(&port->count, 0);
43862 }
43863 - if (port->count) {
43864 + if (atomic_read(&port->count)) {
43865 #ifdef ISDN_DEBUG_MODEM_OPEN
43866 printk(KERN_DEBUG "isdn_tty_close after info->count != 0\n");
43867 #endif
43868 @@ -1625,7 +1625,7 @@ isdn_tty_hangup(struct tty_struct *tty)
43869 if (isdn_tty_paranoia_check(info, tty->name, "isdn_tty_hangup"))
43870 return;
43871 isdn_tty_shutdown(info);
43872 - port->count = 0;
43873 + atomic_set(&port->count, 0);
43874 port->flags &= ~ASYNC_NORMAL_ACTIVE;
43875 port->tty = NULL;
43876 wake_up_interruptible(&port->open_wait);
43877 @@ -1970,7 +1970,7 @@ isdn_tty_find_icall(int di, int ch, setup_parm *setup)
43878 for (i = 0; i < ISDN_MAX_CHANNELS; i++) {
43879 modem_info *info = &dev->mdm.info[i];
43880
43881 - if (info->port.count == 0)
43882 + if (atomic_read(&info->port.count) == 0)
43883 continue;
43884 if ((info->emu.mdmreg[REG_SI1] & si2bit[si1]) && /* SI1 is matching */
43885 (info->emu.mdmreg[REG_SI2] == si2)) { /* SI2 is matching */
43886 diff --git a/drivers/isdn/i4l/isdn_x25iface.c b/drivers/isdn/i4l/isdn_x25iface.c
43887 index e2d4e58..40cd045 100644
43888 --- a/drivers/isdn/i4l/isdn_x25iface.c
43889 +++ b/drivers/isdn/i4l/isdn_x25iface.c
43890 @@ -53,14 +53,14 @@ static int isdn_x25iface_disconn_ind(struct concap_proto *);
43891
43892
43893 static struct concap_proto_ops ix25_pops = {
43894 - &isdn_x25iface_proto_new,
43895 - &isdn_x25iface_proto_del,
43896 - &isdn_x25iface_proto_restart,
43897 - &isdn_x25iface_proto_close,
43898 - &isdn_x25iface_xmit,
43899 - &isdn_x25iface_receive,
43900 - &isdn_x25iface_connect_ind,
43901 - &isdn_x25iface_disconn_ind
43902 + .proto_new = &isdn_x25iface_proto_new,
43903 + .proto_del = &isdn_x25iface_proto_del,
43904 + .restart = &isdn_x25iface_proto_restart,
43905 + .close = &isdn_x25iface_proto_close,
43906 + .encap_and_xmit = &isdn_x25iface_xmit,
43907 + .data_ind = &isdn_x25iface_receive,
43908 + .connect_ind = &isdn_x25iface_connect_ind,
43909 + .disconn_ind = &isdn_x25iface_disconn_ind
43910 };
43911
43912 /* error message helper function */
43913 diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
43914 index 53d487f..cae33fe 100644
43915 --- a/drivers/isdn/icn/icn.c
43916 +++ b/drivers/isdn/icn/icn.c
43917 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char *buf, int len, int user, icn_card *card)
43918 if (count > len)
43919 count = len;
43920 if (user) {
43921 - if (copy_from_user(msg, buf, count))
43922 + if (count > sizeof msg || copy_from_user(msg, buf, count))
43923 return -EFAULT;
43924 } else
43925 memcpy(msg, buf, count);
43926 @@ -1155,7 +1155,7 @@ icn_command(isdn_ctrl *c, icn_card *card)
43927 ulong a;
43928 ulong flags;
43929 int i;
43930 - char cbuf[60];
43931 + char cbuf[80];
43932 isdn_ctrl cmd;
43933 icn_cdef cdef;
43934 char __user *arg;
43935 @@ -1309,7 +1309,6 @@ icn_command(isdn_ctrl *c, icn_card *card)
43936 break;
43937 if ((c->arg & 255) < ICN_BCH) {
43938 char *p;
43939 - char dial[50];
43940 char dcode[4];
43941
43942 a = c->arg;
43943 @@ -1321,10 +1320,10 @@ icn_command(isdn_ctrl *c, icn_card *card)
43944 } else
43945 /* Normal Dial */
43946 strcpy(dcode, "CAL");
43947 - strcpy(dial, p);
43948 - sprintf(cbuf, "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1),
43949 - dcode, dial, c->parm.setup.si1,
43950 - c->parm.setup.si2, c->parm.setup.eazmsn);
43951 + snprintf(cbuf, sizeof(cbuf),
43952 + "%02d;D%s_R%s,%02d,%02d,%s\n", (int) (a + 1),
43953 + dcode, p, c->parm.setup.si1,
43954 + c->parm.setup.si2, c->parm.setup.eazmsn);
43955 i = icn_writecmd(cbuf, strlen(cbuf), 0, card);
43956 }
43957 break;
43958 diff --git a/drivers/isdn/mISDN/dsp_cmx.c b/drivers/isdn/mISDN/dsp_cmx.c
43959 index a4f05c5..1433bc5 100644
43960 --- a/drivers/isdn/mISDN/dsp_cmx.c
43961 +++ b/drivers/isdn/mISDN/dsp_cmx.c
43962 @@ -1628,7 +1628,7 @@ unsigned long dsp_spl_jiffies; /* calculate the next time to fire */
43963 static u16 dsp_count; /* last sample count */
43964 static int dsp_count_valid; /* if we have last sample count */
43965
43966 -void
43967 +void __intentional_overflow(-1)
43968 dsp_cmx_send(void *arg)
43969 {
43970 struct dsp_conf *conf;
43971 diff --git a/drivers/leds/leds-clevo-mail.c b/drivers/leds/leds-clevo-mail.c
43972 index d93e245..e7ece6b 100644
43973 --- a/drivers/leds/leds-clevo-mail.c
43974 +++ b/drivers/leds/leds-clevo-mail.c
43975 @@ -40,7 +40,7 @@ static int __init clevo_mail_led_dmi_callback(const struct dmi_system_id *id)
43976 * detected as working, but in reality it is not) as low as
43977 * possible.
43978 */
43979 -static struct dmi_system_id clevo_mail_led_dmi_table[] __initdata = {
43980 +static struct dmi_system_id clevo_mail_led_dmi_table[] __initconst = {
43981 {
43982 .callback = clevo_mail_led_dmi_callback,
43983 .ident = "Clevo D410J",
43984 diff --git a/drivers/leds/leds-ss4200.c b/drivers/leds/leds-ss4200.c
43985 index 5b8f938..b73d657 100644
43986 --- a/drivers/leds/leds-ss4200.c
43987 +++ b/drivers/leds/leds-ss4200.c
43988 @@ -91,7 +91,7 @@ MODULE_PARM_DESC(nodetect, "Skip DMI-based hardware detection");
43989 * detected as working, but in reality it is not) as low as
43990 * possible.
43991 */
43992 -static struct dmi_system_id nas_led_whitelist[] __initdata = {
43993 +static struct dmi_system_id nas_led_whitelist[] __initconst = {
43994 {
43995 .callback = ss4200_led_dmi_callback,
43996 .ident = "Intel SS4200-E",
43997 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
43998 index 0bf1e4e..b4bf44e 100644
43999 --- a/drivers/lguest/core.c
44000 +++ b/drivers/lguest/core.c
44001 @@ -97,9 +97,17 @@ static __init int map_switcher(void)
44002 * The end address needs +1 because __get_vm_area allocates an
44003 * extra guard page, so we need space for that.
44004 */
44005 +
44006 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
44007 + switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
44008 + VM_ALLOC | VM_KERNEXEC, switcher_addr, switcher_addr
44009 + + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
44010 +#else
44011 switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
44012 VM_ALLOC, switcher_addr, switcher_addr
44013 + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
44014 +#endif
44015 +
44016 if (!switcher_vma) {
44017 err = -ENOMEM;
44018 printk("lguest: could not map switcher pages high\n");
44019 @@ -124,7 +132,7 @@ static __init int map_switcher(void)
44020 * Now the Switcher is mapped at the right address, we can't fail!
44021 * Copy in the compiled-in Switcher code (from x86/switcher_32.S).
44022 */
44023 - memcpy(switcher_vma->addr, start_switcher_text,
44024 + memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
44025 end_switcher_text - start_switcher_text);
44026
44027 printk(KERN_INFO "lguest: mapped switcher at %p\n",
44028 diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
44029 index bfb39bb..08a603b 100644
44030 --- a/drivers/lguest/page_tables.c
44031 +++ b/drivers/lguest/page_tables.c
44032 @@ -559,7 +559,7 @@ void pin_page(struct lg_cpu *cpu, unsigned long vaddr)
44033 /*:*/
44034
44035 #ifdef CONFIG_X86_PAE
44036 -static void release_pmd(pmd_t *spmd)
44037 +static void __intentional_overflow(-1) release_pmd(pmd_t *spmd)
44038 {
44039 /* If the entry's not present, there's nothing to release. */
44040 if (pmd_flags(*spmd) & _PAGE_PRESENT) {
44041 diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
44042 index 922a1ac..9dd0c2a 100644
44043 --- a/drivers/lguest/x86/core.c
44044 +++ b/drivers/lguest/x86/core.c
44045 @@ -59,7 +59,7 @@ static struct {
44046 /* Offset from where switcher.S was compiled to where we've copied it */
44047 static unsigned long switcher_offset(void)
44048 {
44049 - return switcher_addr - (unsigned long)start_switcher_text;
44050 + return switcher_addr - (unsigned long)ktla_ktva(start_switcher_text);
44051 }
44052
44053 /* This cpu's struct lguest_pages (after the Switcher text page) */
44054 @@ -99,7 +99,13 @@ static void copy_in_guest_info(struct lg_cpu *cpu, struct lguest_pages *pages)
44055 * These copies are pretty cheap, so we do them unconditionally: */
44056 /* Save the current Host top-level page directory.
44057 */
44058 +
44059 +#ifdef CONFIG_PAX_PER_CPU_PGD
44060 + pages->state.host_cr3 = read_cr3();
44061 +#else
44062 pages->state.host_cr3 = __pa(current->mm->pgd);
44063 +#endif
44064 +
44065 /*
44066 * Set up the Guest's page tables to see this CPU's pages (and no
44067 * other CPU's pages).
44068 @@ -477,7 +483,7 @@ void __init lguest_arch_host_init(void)
44069 * compiled-in switcher code and the high-mapped copy we just made.
44070 */
44071 for (i = 0; i < IDT_ENTRIES; i++)
44072 - default_idt_entries[i] += switcher_offset();
44073 + default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
44074
44075 /*
44076 * Set up the Switcher's per-cpu areas.
44077 @@ -560,7 +566,7 @@ void __init lguest_arch_host_init(void)
44078 * it will be undisturbed when we switch. To change %cs and jump we
44079 * need this structure to feed to Intel's "lcall" instruction.
44080 */
44081 - lguest_entry.offset = (long)switch_to_guest + switcher_offset();
44082 + lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
44083 lguest_entry.segment = LGUEST_CS;
44084
44085 /*
44086 diff --git a/drivers/lguest/x86/switcher_32.S b/drivers/lguest/x86/switcher_32.S
44087 index 40634b0..4f5855e 100644
44088 --- a/drivers/lguest/x86/switcher_32.S
44089 +++ b/drivers/lguest/x86/switcher_32.S
44090 @@ -87,6 +87,7 @@
44091 #include <asm/page.h>
44092 #include <asm/segment.h>
44093 #include <asm/lguest.h>
44094 +#include <asm/processor-flags.h>
44095
44096 // We mark the start of the code to copy
44097 // It's placed in .text tho it's never run here
44098 @@ -149,6 +150,13 @@ ENTRY(switch_to_guest)
44099 // Changes type when we load it: damn Intel!
44100 // For after we switch over our page tables
44101 // That entry will be read-only: we'd crash.
44102 +
44103 +#ifdef CONFIG_PAX_KERNEXEC
44104 + mov %cr0, %edx
44105 + xor $X86_CR0_WP, %edx
44106 + mov %edx, %cr0
44107 +#endif
44108 +
44109 movl $(GDT_ENTRY_TSS*8), %edx
44110 ltr %dx
44111
44112 @@ -157,9 +165,15 @@ ENTRY(switch_to_guest)
44113 // Let's clear it again for our return.
44114 // The GDT descriptor of the Host
44115 // Points to the table after two "size" bytes
44116 - movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
44117 + movl (LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
44118 // Clear "used" from type field (byte 5, bit 2)
44119 - andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
44120 + andb $0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
44121 +
44122 +#ifdef CONFIG_PAX_KERNEXEC
44123 + mov %cr0, %eax
44124 + xor $X86_CR0_WP, %eax
44125 + mov %eax, %cr0
44126 +#endif
44127
44128 // Once our page table's switched, the Guest is live!
44129 // The Host fades as we run this final step.
44130 @@ -295,13 +309,12 @@ deliver_to_host:
44131 // I consulted gcc, and it gave
44132 // These instructions, which I gladly credit:
44133 leal (%edx,%ebx,8), %eax
44134 - movzwl (%eax),%edx
44135 - movl 4(%eax), %eax
44136 - xorw %ax, %ax
44137 - orl %eax, %edx
44138 + movl 4(%eax), %edx
44139 + movw (%eax), %dx
44140 // Now the address of the handler's in %edx
44141 // We call it now: its "iret" drops us home.
44142 - jmp *%edx
44143 + ljmp $__KERNEL_CS, $1f
44144 +1: jmp *%edx
44145
44146 // Every interrupt can come to us here
44147 // But we must truly tell each apart.
44148 diff --git a/drivers/md/bcache/closure.h b/drivers/md/bcache/closure.h
44149 index 7ef7461..5a09dac 100644
44150 --- a/drivers/md/bcache/closure.h
44151 +++ b/drivers/md/bcache/closure.h
44152 @@ -238,7 +238,7 @@ static inline void closure_set_stopped(struct closure *cl)
44153 static inline void set_closure_fn(struct closure *cl, closure_fn *fn,
44154 struct workqueue_struct *wq)
44155 {
44156 - BUG_ON(object_is_on_stack(cl));
44157 + BUG_ON(object_starts_on_stack(cl));
44158 closure_set_ip(cl);
44159 cl->fn = fn;
44160 cl->wq = wq;
44161 diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
44162 index 4195a01..42527ac 100644
44163 --- a/drivers/md/bitmap.c
44164 +++ b/drivers/md/bitmap.c
44165 @@ -1779,7 +1779,7 @@ void bitmap_status(struct seq_file *seq, struct bitmap *bitmap)
44166 chunk_kb ? "KB" : "B");
44167 if (bitmap->storage.file) {
44168 seq_printf(seq, ", file: ");
44169 - seq_path(seq, &bitmap->storage.file->f_path, " \t\n");
44170 + seq_path(seq, &bitmap->storage.file->f_path, " \t\n\\");
44171 }
44172
44173 seq_printf(seq, "\n");
44174 diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
44175 index 5152142..623d141 100644
44176 --- a/drivers/md/dm-ioctl.c
44177 +++ b/drivers/md/dm-ioctl.c
44178 @@ -1769,7 +1769,7 @@ static int validate_params(uint cmd, struct dm_ioctl *param)
44179 cmd == DM_LIST_VERSIONS_CMD)
44180 return 0;
44181
44182 - if ((cmd == DM_DEV_CREATE_CMD)) {
44183 + if (cmd == DM_DEV_CREATE_CMD) {
44184 if (!*param->name) {
44185 DMWARN("name not supplied when creating device");
44186 return -EINVAL;
44187 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
44188 index 7dfdb5c..4caada6 100644
44189 --- a/drivers/md/dm-raid1.c
44190 +++ b/drivers/md/dm-raid1.c
44191 @@ -40,7 +40,7 @@ enum dm_raid1_error {
44192
44193 struct mirror {
44194 struct mirror_set *ms;
44195 - atomic_t error_count;
44196 + atomic_unchecked_t error_count;
44197 unsigned long error_type;
44198 struct dm_dev *dev;
44199 sector_t offset;
44200 @@ -186,7 +186,7 @@ static struct mirror *get_valid_mirror(struct mirror_set *ms)
44201 struct mirror *m;
44202
44203 for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
44204 - if (!atomic_read(&m->error_count))
44205 + if (!atomic_read_unchecked(&m->error_count))
44206 return m;
44207
44208 return NULL;
44209 @@ -218,7 +218,7 @@ static void fail_mirror(struct mirror *m, enum dm_raid1_error error_type)
44210 * simple way to tell if a device has encountered
44211 * errors.
44212 */
44213 - atomic_inc(&m->error_count);
44214 + atomic_inc_unchecked(&m->error_count);
44215
44216 if (test_and_set_bit(error_type, &m->error_type))
44217 return;
44218 @@ -409,7 +409,7 @@ static struct mirror *choose_mirror(struct mirror_set *ms, sector_t sector)
44219 struct mirror *m = get_default_mirror(ms);
44220
44221 do {
44222 - if (likely(!atomic_read(&m->error_count)))
44223 + if (likely(!atomic_read_unchecked(&m->error_count)))
44224 return m;
44225
44226 if (m-- == ms->mirror)
44227 @@ -423,7 +423,7 @@ static int default_ok(struct mirror *m)
44228 {
44229 struct mirror *default_mirror = get_default_mirror(m->ms);
44230
44231 - return !atomic_read(&default_mirror->error_count);
44232 + return !atomic_read_unchecked(&default_mirror->error_count);
44233 }
44234
44235 static int mirror_available(struct mirror_set *ms, struct bio *bio)
44236 @@ -560,7 +560,7 @@ static void do_reads(struct mirror_set *ms, struct bio_list *reads)
44237 */
44238 if (likely(region_in_sync(ms, region, 1)))
44239 m = choose_mirror(ms, bio->bi_iter.bi_sector);
44240 - else if (m && atomic_read(&m->error_count))
44241 + else if (m && atomic_read_unchecked(&m->error_count))
44242 m = NULL;
44243
44244 if (likely(m))
44245 @@ -927,7 +927,7 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
44246 }
44247
44248 ms->mirror[mirror].ms = ms;
44249 - atomic_set(&(ms->mirror[mirror].error_count), 0);
44250 + atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
44251 ms->mirror[mirror].error_type = 0;
44252 ms->mirror[mirror].offset = offset;
44253
44254 @@ -1342,7 +1342,7 @@ static void mirror_resume(struct dm_target *ti)
44255 */
44256 static char device_status_char(struct mirror *m)
44257 {
44258 - if (!atomic_read(&(m->error_count)))
44259 + if (!atomic_read_unchecked(&(m->error_count)))
44260 return 'A';
44261
44262 return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
44263 diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
44264 index 28a9012..9c0f6a5 100644
44265 --- a/drivers/md/dm-stats.c
44266 +++ b/drivers/md/dm-stats.c
44267 @@ -382,7 +382,7 @@ do_sync_free:
44268 synchronize_rcu_expedited();
44269 dm_stat_free(&s->rcu_head);
44270 } else {
44271 - ACCESS_ONCE(dm_stat_need_rcu_barrier) = 1;
44272 + ACCESS_ONCE_RW(dm_stat_need_rcu_barrier) = 1;
44273 call_rcu(&s->rcu_head, dm_stat_free);
44274 }
44275 return 0;
44276 @@ -554,8 +554,8 @@ void dm_stats_account_io(struct dm_stats *stats, unsigned long bi_rw,
44277 ((bi_rw & (REQ_WRITE | REQ_DISCARD)) ==
44278 (ACCESS_ONCE(last->last_rw) & (REQ_WRITE | REQ_DISCARD)))
44279 ));
44280 - ACCESS_ONCE(last->last_sector) = end_sector;
44281 - ACCESS_ONCE(last->last_rw) = bi_rw;
44282 + ACCESS_ONCE_RW(last->last_sector) = end_sector;
44283 + ACCESS_ONCE_RW(last->last_rw) = bi_rw;
44284 }
44285
44286 rcu_read_lock();
44287 diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
44288 index d1600d2..4c3af3a 100644
44289 --- a/drivers/md/dm-stripe.c
44290 +++ b/drivers/md/dm-stripe.c
44291 @@ -21,7 +21,7 @@ struct stripe {
44292 struct dm_dev *dev;
44293 sector_t physical_start;
44294
44295 - atomic_t error_count;
44296 + atomic_unchecked_t error_count;
44297 };
44298
44299 struct stripe_c {
44300 @@ -186,7 +186,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
44301 kfree(sc);
44302 return r;
44303 }
44304 - atomic_set(&(sc->stripe[i].error_count), 0);
44305 + atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
44306 }
44307
44308 ti->private = sc;
44309 @@ -330,7 +330,7 @@ static void stripe_status(struct dm_target *ti, status_type_t type,
44310 DMEMIT("%d ", sc->stripes);
44311 for (i = 0; i < sc->stripes; i++) {
44312 DMEMIT("%s ", sc->stripe[i].dev->name);
44313 - buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
44314 + buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
44315 'D' : 'A';
44316 }
44317 buffer[i] = '\0';
44318 @@ -375,8 +375,8 @@ static int stripe_end_io(struct dm_target *ti, struct bio *bio, int error)
44319 */
44320 for (i = 0; i < sc->stripes; i++)
44321 if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
44322 - atomic_inc(&(sc->stripe[i].error_count));
44323 - if (atomic_read(&(sc->stripe[i].error_count)) <
44324 + atomic_inc_unchecked(&(sc->stripe[i].error_count));
44325 + if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
44326 DM_IO_ERROR_THRESHOLD)
44327 schedule_work(&sc->trigger_event);
44328 }
44329 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
44330 index 6a7f2b8..fea0bde 100644
44331 --- a/drivers/md/dm-table.c
44332 +++ b/drivers/md/dm-table.c
44333 @@ -274,7 +274,7 @@ static struct dm_dev_internal *find_device(struct list_head *l, dev_t dev)
44334 static int open_dev(struct dm_dev_internal *d, dev_t dev,
44335 struct mapped_device *md)
44336 {
44337 - static char *_claim_ptr = "I belong to device-mapper";
44338 + static char _claim_ptr[] = "I belong to device-mapper";
44339 struct block_device *bdev;
44340
44341 int r;
44342 @@ -342,7 +342,7 @@ static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
44343 if (!dev_size)
44344 return 0;
44345
44346 - if ((start >= dev_size) || (start + len > dev_size)) {
44347 + if ((start >= dev_size) || (len > dev_size - start)) {
44348 DMWARN("%s: %s too small for target: "
44349 "start=%llu, len=%llu, dev_size=%llu",
44350 dm_device_name(ti->table->md), bdevname(bdev, b),
44351 diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
44352 index b086a94..74cb67e 100644
44353 --- a/drivers/md/dm-thin-metadata.c
44354 +++ b/drivers/md/dm-thin-metadata.c
44355 @@ -404,7 +404,7 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
44356 {
44357 pmd->info.tm = pmd->tm;
44358 pmd->info.levels = 2;
44359 - pmd->info.value_type.context = pmd->data_sm;
44360 + pmd->info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
44361 pmd->info.value_type.size = sizeof(__le64);
44362 pmd->info.value_type.inc = data_block_inc;
44363 pmd->info.value_type.dec = data_block_dec;
44364 @@ -423,7 +423,7 @@ static void __setup_btree_details(struct dm_pool_metadata *pmd)
44365
44366 pmd->bl_info.tm = pmd->tm;
44367 pmd->bl_info.levels = 1;
44368 - pmd->bl_info.value_type.context = pmd->data_sm;
44369 + pmd->bl_info.value_type.context = (dm_space_map_no_const *)pmd->data_sm;
44370 pmd->bl_info.value_type.size = sizeof(__le64);
44371 pmd->bl_info.value_type.inc = data_block_inc;
44372 pmd->bl_info.value_type.dec = data_block_dec;
44373 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
44374 index 8c53b09..f1fb2b0 100644
44375 --- a/drivers/md/dm.c
44376 +++ b/drivers/md/dm.c
44377 @@ -185,9 +185,9 @@ struct mapped_device {
44378 /*
44379 * Event handling.
44380 */
44381 - atomic_t event_nr;
44382 + atomic_unchecked_t event_nr;
44383 wait_queue_head_t eventq;
44384 - atomic_t uevent_seq;
44385 + atomic_unchecked_t uevent_seq;
44386 struct list_head uevent_list;
44387 spinlock_t uevent_lock; /* Protect access to uevent_list */
44388
44389 @@ -1888,8 +1888,8 @@ static struct mapped_device *alloc_dev(int minor)
44390 spin_lock_init(&md->deferred_lock);
44391 atomic_set(&md->holders, 1);
44392 atomic_set(&md->open_count, 0);
44393 - atomic_set(&md->event_nr, 0);
44394 - atomic_set(&md->uevent_seq, 0);
44395 + atomic_set_unchecked(&md->event_nr, 0);
44396 + atomic_set_unchecked(&md->uevent_seq, 0);
44397 INIT_LIST_HEAD(&md->uevent_list);
44398 spin_lock_init(&md->uevent_lock);
44399
44400 @@ -2043,7 +2043,7 @@ static void event_callback(void *context)
44401
44402 dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
44403
44404 - atomic_inc(&md->event_nr);
44405 + atomic_inc_unchecked(&md->event_nr);
44406 wake_up(&md->eventq);
44407 }
44408
44409 @@ -2736,18 +2736,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
44410
44411 uint32_t dm_next_uevent_seq(struct mapped_device *md)
44412 {
44413 - return atomic_add_return(1, &md->uevent_seq);
44414 + return atomic_add_return_unchecked(1, &md->uevent_seq);
44415 }
44416
44417 uint32_t dm_get_event_nr(struct mapped_device *md)
44418 {
44419 - return atomic_read(&md->event_nr);
44420 + return atomic_read_unchecked(&md->event_nr);
44421 }
44422
44423 int dm_wait_event(struct mapped_device *md, int event_nr)
44424 {
44425 return wait_event_interruptible(md->eventq,
44426 - (event_nr != atomic_read(&md->event_nr)));
44427 + (event_nr != atomic_read_unchecked(&md->event_nr)));
44428 }
44429
44430 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
44431 diff --git a/drivers/md/md.c b/drivers/md/md.c
44432 index 4ad5cc4..0f19664 100644
44433 --- a/drivers/md/md.c
44434 +++ b/drivers/md/md.c
44435 @@ -194,10 +194,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
44436 * start build, activate spare
44437 */
44438 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
44439 -static atomic_t md_event_count;
44440 +static atomic_unchecked_t md_event_count;
44441 void md_new_event(struct mddev *mddev)
44442 {
44443 - atomic_inc(&md_event_count);
44444 + atomic_inc_unchecked(&md_event_count);
44445 wake_up(&md_event_waiters);
44446 }
44447 EXPORT_SYMBOL_GPL(md_new_event);
44448 @@ -207,7 +207,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
44449 */
44450 static void md_new_event_inintr(struct mddev *mddev)
44451 {
44452 - atomic_inc(&md_event_count);
44453 + atomic_inc_unchecked(&md_event_count);
44454 wake_up(&md_event_waiters);
44455 }
44456
44457 @@ -1462,7 +1462,7 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
44458 if ((le32_to_cpu(sb->feature_map) & MD_FEATURE_RESHAPE_ACTIVE) &&
44459 (le32_to_cpu(sb->feature_map) & MD_FEATURE_NEW_OFFSET))
44460 rdev->new_data_offset += (s32)le32_to_cpu(sb->new_offset);
44461 - atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
44462 + atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
44463
44464 rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
44465 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
44466 @@ -1713,7 +1713,7 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev)
44467 else
44468 sb->resync_offset = cpu_to_le64(0);
44469
44470 - sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
44471 + sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
44472
44473 sb->raid_disks = cpu_to_le32(mddev->raid_disks);
44474 sb->size = cpu_to_le64(mddev->dev_sectors);
44475 @@ -2725,7 +2725,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_show, state_store);
44476 static ssize_t
44477 errors_show(struct md_rdev *rdev, char *page)
44478 {
44479 - return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
44480 + return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
44481 }
44482
44483 static ssize_t
44484 @@ -2734,7 +2734,7 @@ errors_store(struct md_rdev *rdev, const char *buf, size_t len)
44485 char *e;
44486 unsigned long n = simple_strtoul(buf, &e, 10);
44487 if (*buf && (*e == 0 || *e == '\n')) {
44488 - atomic_set(&rdev->corrected_errors, n);
44489 + atomic_set_unchecked(&rdev->corrected_errors, n);
44490 return len;
44491 }
44492 return -EINVAL;
44493 @@ -3183,8 +3183,8 @@ int md_rdev_init(struct md_rdev *rdev)
44494 rdev->sb_loaded = 0;
44495 rdev->bb_page = NULL;
44496 atomic_set(&rdev->nr_pending, 0);
44497 - atomic_set(&rdev->read_errors, 0);
44498 - atomic_set(&rdev->corrected_errors, 0);
44499 + atomic_set_unchecked(&rdev->read_errors, 0);
44500 + atomic_set_unchecked(&rdev->corrected_errors, 0);
44501
44502 INIT_LIST_HEAD(&rdev->same_set);
44503 init_waitqueue_head(&rdev->blocked_wait);
44504 @@ -7075,7 +7075,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
44505
44506 spin_unlock(&pers_lock);
44507 seq_printf(seq, "\n");
44508 - seq->poll_event = atomic_read(&md_event_count);
44509 + seq->poll_event = atomic_read_unchecked(&md_event_count);
44510 return 0;
44511 }
44512 if (v == (void*)2) {
44513 @@ -7178,7 +7178,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
44514 return error;
44515
44516 seq = file->private_data;
44517 - seq->poll_event = atomic_read(&md_event_count);
44518 + seq->poll_event = atomic_read_unchecked(&md_event_count);
44519 return error;
44520 }
44521
44522 @@ -7192,7 +7192,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
44523 /* always allow read */
44524 mask = POLLIN | POLLRDNORM;
44525
44526 - if (seq->poll_event != atomic_read(&md_event_count))
44527 + if (seq->poll_event != atomic_read_unchecked(&md_event_count))
44528 mask |= POLLERR | POLLPRI;
44529 return mask;
44530 }
44531 @@ -7236,7 +7236,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
44532 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
44533 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
44534 (int)part_stat_read(&disk->part0, sectors[1]) -
44535 - atomic_read(&disk->sync_io);
44536 + atomic_read_unchecked(&disk->sync_io);
44537 /* sync IO will cause sync_io to increase before the disk_stats
44538 * as sync_io is counted when a request starts, and
44539 * disk_stats is counted when it completes.
44540 diff --git a/drivers/md/md.h b/drivers/md/md.h
44541 index 07bba96..2d6788c 100644
44542 --- a/drivers/md/md.h
44543 +++ b/drivers/md/md.h
44544 @@ -94,13 +94,13 @@ struct md_rdev {
44545 * only maintained for arrays that
44546 * support hot removal
44547 */
44548 - atomic_t read_errors; /* number of consecutive read errors that
44549 + atomic_unchecked_t read_errors; /* number of consecutive read errors that
44550 * we have tried to ignore.
44551 */
44552 struct timespec last_read_error; /* monotonic time since our
44553 * last read error
44554 */
44555 - atomic_t corrected_errors; /* number of corrected read errors,
44556 + atomic_unchecked_t corrected_errors; /* number of corrected read errors,
44557 * for reporting to userspace and storing
44558 * in superblock.
44559 */
44560 @@ -449,7 +449,7 @@ static inline void rdev_dec_pending(struct md_rdev *rdev, struct mddev *mddev)
44561
44562 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
44563 {
44564 - atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
44565 + atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
44566 }
44567
44568 struct md_personality
44569 diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
44570 index 786b689..ea8c956 100644
44571 --- a/drivers/md/persistent-data/dm-space-map-metadata.c
44572 +++ b/drivers/md/persistent-data/dm-space-map-metadata.c
44573 @@ -679,7 +679,7 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
44574 * Flick into a mode where all blocks get allocated in the new area.
44575 */
44576 smm->begin = old_len;
44577 - memcpy(sm, &bootstrap_ops, sizeof(*sm));
44578 + memcpy((void *)sm, &bootstrap_ops, sizeof(*sm));
44579
44580 /*
44581 * Extend.
44582 @@ -710,7 +710,7 @@ out:
44583 /*
44584 * Switch back to normal behaviour.
44585 */
44586 - memcpy(sm, &ops, sizeof(*sm));
44587 + memcpy((void *)sm, &ops, sizeof(*sm));
44588 return r;
44589 }
44590
44591 diff --git a/drivers/md/persistent-data/dm-space-map.h b/drivers/md/persistent-data/dm-space-map.h
44592 index 3e6d115..ffecdeb 100644
44593 --- a/drivers/md/persistent-data/dm-space-map.h
44594 +++ b/drivers/md/persistent-data/dm-space-map.h
44595 @@ -71,6 +71,7 @@ struct dm_space_map {
44596 dm_sm_threshold_fn fn,
44597 void *context);
44598 };
44599 +typedef struct dm_space_map __no_const dm_space_map_no_const;
44600
44601 /*----------------------------------------------------------------*/
44602
44603 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
44604 index 56e24c0..e1c8e1f 100644
44605 --- a/drivers/md/raid1.c
44606 +++ b/drivers/md/raid1.c
44607 @@ -1931,7 +1931,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
44608 if (r1_sync_page_io(rdev, sect, s,
44609 bio->bi_io_vec[idx].bv_page,
44610 READ) != 0)
44611 - atomic_add(s, &rdev->corrected_errors);
44612 + atomic_add_unchecked(s, &rdev->corrected_errors);
44613 }
44614 sectors -= s;
44615 sect += s;
44616 @@ -2165,7 +2165,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
44617 test_bit(In_sync, &rdev->flags)) {
44618 if (r1_sync_page_io(rdev, sect, s,
44619 conf->tmppage, READ)) {
44620 - atomic_add(s, &rdev->corrected_errors);
44621 + atomic_add_unchecked(s, &rdev->corrected_errors);
44622 printk(KERN_INFO
44623 "md/raid1:%s: read error corrected "
44624 "(%d sectors at %llu on %s)\n",
44625 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
44626 index 33fc408..fc61709 100644
44627 --- a/drivers/md/raid10.c
44628 +++ b/drivers/md/raid10.c
44629 @@ -1948,7 +1948,7 @@ static void end_sync_read(struct bio *bio, int error)
44630 /* The write handler will notice the lack of
44631 * R10BIO_Uptodate and record any errors etc
44632 */
44633 - atomic_add(r10_bio->sectors,
44634 + atomic_add_unchecked(r10_bio->sectors,
44635 &conf->mirrors[d].rdev->corrected_errors);
44636
44637 /* for reconstruct, we always reschedule after a read.
44638 @@ -2306,7 +2306,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
44639 {
44640 struct timespec cur_time_mon;
44641 unsigned long hours_since_last;
44642 - unsigned int read_errors = atomic_read(&rdev->read_errors);
44643 + unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
44644
44645 ktime_get_ts(&cur_time_mon);
44646
44647 @@ -2328,9 +2328,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
44648 * overflowing the shift of read_errors by hours_since_last.
44649 */
44650 if (hours_since_last >= 8 * sizeof(read_errors))
44651 - atomic_set(&rdev->read_errors, 0);
44652 + atomic_set_unchecked(&rdev->read_errors, 0);
44653 else
44654 - atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
44655 + atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
44656 }
44657
44658 static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
44659 @@ -2384,8 +2384,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
44660 return;
44661
44662 check_decay_read_errors(mddev, rdev);
44663 - atomic_inc(&rdev->read_errors);
44664 - if (atomic_read(&rdev->read_errors) > max_read_errors) {
44665 + atomic_inc_unchecked(&rdev->read_errors);
44666 + if (atomic_read_unchecked(&rdev->read_errors) > max_read_errors) {
44667 char b[BDEVNAME_SIZE];
44668 bdevname(rdev->bdev, b);
44669
44670 @@ -2393,7 +2393,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
44671 "md/raid10:%s: %s: Raid device exceeded "
44672 "read_error threshold [cur %d:max %d]\n",
44673 mdname(mddev), b,
44674 - atomic_read(&rdev->read_errors), max_read_errors);
44675 + atomic_read_unchecked(&rdev->read_errors), max_read_errors);
44676 printk(KERN_NOTICE
44677 "md/raid10:%s: %s: Failing raid device\n",
44678 mdname(mddev), b);
44679 @@ -2548,7 +2548,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
44680 sect +
44681 choose_data_offset(r10_bio, rdev)),
44682 bdevname(rdev->bdev, b));
44683 - atomic_add(s, &rdev->corrected_errors);
44684 + atomic_add_unchecked(s, &rdev->corrected_errors);
44685 }
44686
44687 rdev_dec_pending(rdev, mddev);
44688 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
44689 index 16f5c21..4df20dc 100644
44690 --- a/drivers/md/raid5.c
44691 +++ b/drivers/md/raid5.c
44692 @@ -1991,21 +1991,21 @@ static void raid5_end_read_request(struct bio * bi, int error)
44693 mdname(conf->mddev), STRIPE_SECTORS,
44694 (unsigned long long)s,
44695 bdevname(rdev->bdev, b));
44696 - atomic_add(STRIPE_SECTORS, &rdev->corrected_errors);
44697 + atomic_add_unchecked(STRIPE_SECTORS, &rdev->corrected_errors);
44698 clear_bit(R5_ReadError, &sh->dev[i].flags);
44699 clear_bit(R5_ReWrite, &sh->dev[i].flags);
44700 } else if (test_bit(R5_ReadNoMerge, &sh->dev[i].flags))
44701 clear_bit(R5_ReadNoMerge, &sh->dev[i].flags);
44702
44703 - if (atomic_read(&rdev->read_errors))
44704 - atomic_set(&rdev->read_errors, 0);
44705 + if (atomic_read_unchecked(&rdev->read_errors))
44706 + atomic_set_unchecked(&rdev->read_errors, 0);
44707 } else {
44708 const char *bdn = bdevname(rdev->bdev, b);
44709 int retry = 0;
44710 int set_bad = 0;
44711
44712 clear_bit(R5_UPTODATE, &sh->dev[i].flags);
44713 - atomic_inc(&rdev->read_errors);
44714 + atomic_inc_unchecked(&rdev->read_errors);
44715 if (test_bit(R5_ReadRepl, &sh->dev[i].flags))
44716 printk_ratelimited(
44717 KERN_WARNING
44718 @@ -2033,7 +2033,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
44719 mdname(conf->mddev),
44720 (unsigned long long)s,
44721 bdn);
44722 - } else if (atomic_read(&rdev->read_errors)
44723 + } else if (atomic_read_unchecked(&rdev->read_errors)
44724 > conf->max_nr_stripes)
44725 printk(KERN_WARNING
44726 "md/raid:%s: Too many read errors, failing device %s.\n",
44727 diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
44728 index 983db75..ef9248c 100644
44729 --- a/drivers/media/dvb-core/dvbdev.c
44730 +++ b/drivers/media/dvb-core/dvbdev.c
44731 @@ -185,7 +185,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
44732 const struct dvb_device *template, void *priv, int type)
44733 {
44734 struct dvb_device *dvbdev;
44735 - struct file_operations *dvbdevfops;
44736 + file_operations_no_const *dvbdevfops;
44737 struct device *clsdev;
44738 int minor;
44739 int id;
44740 diff --git a/drivers/media/dvb-frontends/dib3000.h b/drivers/media/dvb-frontends/dib3000.h
44741 index 9b6c3bb..baeb5c7 100644
44742 --- a/drivers/media/dvb-frontends/dib3000.h
44743 +++ b/drivers/media/dvb-frontends/dib3000.h
44744 @@ -39,7 +39,7 @@ struct dib_fe_xfer_ops
44745 int (*fifo_ctrl)(struct dvb_frontend *fe, int onoff);
44746 int (*pid_ctrl)(struct dvb_frontend *fe, int index, int pid, int onoff);
44747 int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
44748 -};
44749 +} __no_const;
44750
44751 #if IS_ENABLED(CONFIG_DVB_DIB3000MB)
44752 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
44753 diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
44754 index d5a7a13..703560f 100644
44755 --- a/drivers/media/media-device.c
44756 +++ b/drivers/media/media-device.c
44757 @@ -93,6 +93,7 @@ static long media_device_enum_entities(struct media_device *mdev,
44758 struct media_entity *ent;
44759 struct media_entity_desc u_ent;
44760
44761 + memset(&u_ent, 0, sizeof(u_ent));
44762 if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
44763 return -EFAULT;
44764
44765 diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c
44766 index ed8cb90..5ef7f79 100644
44767 --- a/drivers/media/pci/cx88/cx88-video.c
44768 +++ b/drivers/media/pci/cx88/cx88-video.c
44769 @@ -50,9 +50,9 @@ MODULE_VERSION(CX88_VERSION);
44770
44771 /* ------------------------------------------------------------------ */
44772
44773 -static unsigned int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44774 -static unsigned int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44775 -static unsigned int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44776 +static int video_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44777 +static int vbi_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44778 +static int radio_nr[] = {[0 ... (CX88_MAXBOARDS - 1)] = UNSET };
44779
44780 module_param_array(video_nr, int, NULL, 0444);
44781 module_param_array(vbi_nr, int, NULL, 0444);
44782 diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
44783 index 802642d..5534900 100644
44784 --- a/drivers/media/pci/ivtv/ivtv-driver.c
44785 +++ b/drivers/media/pci/ivtv/ivtv-driver.c
44786 @@ -83,7 +83,7 @@ static struct pci_device_id ivtv_pci_tbl[] = {
44787 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
44788
44789 /* ivtv instance counter */
44790 -static atomic_t ivtv_instance = ATOMIC_INIT(0);
44791 +static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
44792
44793 /* Parameter declarations */
44794 static int cardtype[IVTV_MAX_CARDS];
44795 diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
44796 index dfd0a21..6bbb465 100644
44797 --- a/drivers/media/platform/omap/omap_vout.c
44798 +++ b/drivers/media/platform/omap/omap_vout.c
44799 @@ -63,7 +63,6 @@ enum omap_vout_channels {
44800 OMAP_VIDEO2,
44801 };
44802
44803 -static struct videobuf_queue_ops video_vbq_ops;
44804 /* Variables configurable through module params*/
44805 static u32 video1_numbuffers = 3;
44806 static u32 video2_numbuffers = 3;
44807 @@ -1014,6 +1013,12 @@ static int omap_vout_open(struct file *file)
44808 {
44809 struct videobuf_queue *q;
44810 struct omap_vout_device *vout = NULL;
44811 + static struct videobuf_queue_ops video_vbq_ops = {
44812 + .buf_setup = omap_vout_buffer_setup,
44813 + .buf_prepare = omap_vout_buffer_prepare,
44814 + .buf_release = omap_vout_buffer_release,
44815 + .buf_queue = omap_vout_buffer_queue,
44816 + };
44817
44818 vout = video_drvdata(file);
44819 v4l2_dbg(1, debug, &vout->vid_dev->v4l2_dev, "Entering %s\n", __func__);
44820 @@ -1031,10 +1036,6 @@ static int omap_vout_open(struct file *file)
44821 vout->type = V4L2_BUF_TYPE_VIDEO_OUTPUT;
44822
44823 q = &vout->vbq;
44824 - video_vbq_ops.buf_setup = omap_vout_buffer_setup;
44825 - video_vbq_ops.buf_prepare = omap_vout_buffer_prepare;
44826 - video_vbq_ops.buf_release = omap_vout_buffer_release;
44827 - video_vbq_ops.buf_queue = omap_vout_buffer_queue;
44828 spin_lock_init(&vout->vbq_lock);
44829
44830 videobuf_queue_dma_contig_init(q, &video_vbq_ops, q->dev,
44831 diff --git a/drivers/media/platform/s5p-tv/mixer.h b/drivers/media/platform/s5p-tv/mixer.h
44832 index fb2acc5..a2fcbdc4 100644
44833 --- a/drivers/media/platform/s5p-tv/mixer.h
44834 +++ b/drivers/media/platform/s5p-tv/mixer.h
44835 @@ -156,7 +156,7 @@ struct mxr_layer {
44836 /** layer index (unique identifier) */
44837 int idx;
44838 /** callbacks for layer methods */
44839 - struct mxr_layer_ops ops;
44840 + struct mxr_layer_ops *ops;
44841 /** format array */
44842 const struct mxr_format **fmt_array;
44843 /** size of format array */
44844 diff --git a/drivers/media/platform/s5p-tv/mixer_grp_layer.c b/drivers/media/platform/s5p-tv/mixer_grp_layer.c
44845 index 74344c7..a39e70e 100644
44846 --- a/drivers/media/platform/s5p-tv/mixer_grp_layer.c
44847 +++ b/drivers/media/platform/s5p-tv/mixer_grp_layer.c
44848 @@ -235,7 +235,7 @@ struct mxr_layer *mxr_graph_layer_create(struct mxr_device *mdev, int idx)
44849 {
44850 struct mxr_layer *layer;
44851 int ret;
44852 - struct mxr_layer_ops ops = {
44853 + static struct mxr_layer_ops ops = {
44854 .release = mxr_graph_layer_release,
44855 .buffer_set = mxr_graph_buffer_set,
44856 .stream_set = mxr_graph_stream_set,
44857 diff --git a/drivers/media/platform/s5p-tv/mixer_reg.c b/drivers/media/platform/s5p-tv/mixer_reg.c
44858 index b713403..53cb5ad 100644
44859 --- a/drivers/media/platform/s5p-tv/mixer_reg.c
44860 +++ b/drivers/media/platform/s5p-tv/mixer_reg.c
44861 @@ -276,7 +276,7 @@ static void mxr_irq_layer_handle(struct mxr_layer *layer)
44862 layer->update_buf = next;
44863 }
44864
44865 - layer->ops.buffer_set(layer, layer->update_buf);
44866 + layer->ops->buffer_set(layer, layer->update_buf);
44867
44868 if (done && done != layer->shadow_buf)
44869 vb2_buffer_done(&done->vb, VB2_BUF_STATE_DONE);
44870 diff --git a/drivers/media/platform/s5p-tv/mixer_video.c b/drivers/media/platform/s5p-tv/mixer_video.c
44871 index c5059ba..2649f28 100644
44872 --- a/drivers/media/platform/s5p-tv/mixer_video.c
44873 +++ b/drivers/media/platform/s5p-tv/mixer_video.c
44874 @@ -210,7 +210,7 @@ static void mxr_layer_default_geo(struct mxr_layer *layer)
44875 layer->geo.src.height = layer->geo.src.full_height;
44876
44877 mxr_geometry_dump(mdev, &layer->geo);
44878 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
44879 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
44880 mxr_geometry_dump(mdev, &layer->geo);
44881 }
44882
44883 @@ -228,7 +228,7 @@ static void mxr_layer_update_output(struct mxr_layer *layer)
44884 layer->geo.dst.full_width = mbus_fmt.width;
44885 layer->geo.dst.full_height = mbus_fmt.height;
44886 layer->geo.dst.field = mbus_fmt.field;
44887 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
44888 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SINK, 0);
44889
44890 mxr_geometry_dump(mdev, &layer->geo);
44891 }
44892 @@ -334,7 +334,7 @@ static int mxr_s_fmt(struct file *file, void *priv,
44893 /* set source size to highest accepted value */
44894 geo->src.full_width = max(geo->dst.full_width, pix->width);
44895 geo->src.full_height = max(geo->dst.full_height, pix->height);
44896 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
44897 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
44898 mxr_geometry_dump(mdev, &layer->geo);
44899 /* set cropping to total visible screen */
44900 geo->src.width = pix->width;
44901 @@ -342,12 +342,12 @@ static int mxr_s_fmt(struct file *file, void *priv,
44902 geo->src.x_offset = 0;
44903 geo->src.y_offset = 0;
44904 /* assure consistency of geometry */
44905 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET);
44906 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_CROP, MXR_NO_OFFSET);
44907 mxr_geometry_dump(mdev, &layer->geo);
44908 /* set full size to lowest possible value */
44909 geo->src.full_width = 0;
44910 geo->src.full_height = 0;
44911 - layer->ops.fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
44912 + layer->ops->fix_geometry(layer, MXR_GEOMETRY_SOURCE, 0);
44913 mxr_geometry_dump(mdev, &layer->geo);
44914
44915 /* returning results */
44916 @@ -474,7 +474,7 @@ static int mxr_s_selection(struct file *file, void *fh,
44917 target->width = s->r.width;
44918 target->height = s->r.height;
44919
44920 - layer->ops.fix_geometry(layer, stage, s->flags);
44921 + layer->ops->fix_geometry(layer, stage, s->flags);
44922
44923 /* retrieve update selection rectangle */
44924 res.left = target->x_offset;
44925 @@ -955,13 +955,13 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count)
44926 mxr_output_get(mdev);
44927
44928 mxr_layer_update_output(layer);
44929 - layer->ops.format_set(layer);
44930 + layer->ops->format_set(layer);
44931 /* enabling layer in hardware */
44932 spin_lock_irqsave(&layer->enq_slock, flags);
44933 layer->state = MXR_LAYER_STREAMING;
44934 spin_unlock_irqrestore(&layer->enq_slock, flags);
44935
44936 - layer->ops.stream_set(layer, MXR_ENABLE);
44937 + layer->ops->stream_set(layer, MXR_ENABLE);
44938 mxr_streamer_get(mdev);
44939
44940 return 0;
44941 @@ -1031,7 +1031,7 @@ static int stop_streaming(struct vb2_queue *vq)
44942 spin_unlock_irqrestore(&layer->enq_slock, flags);
44943
44944 /* disabling layer in hardware */
44945 - layer->ops.stream_set(layer, MXR_DISABLE);
44946 + layer->ops->stream_set(layer, MXR_DISABLE);
44947 /* remove one streamer */
44948 mxr_streamer_put(mdev);
44949 /* allow changes in output configuration */
44950 @@ -1070,8 +1070,8 @@ void mxr_base_layer_unregister(struct mxr_layer *layer)
44951
44952 void mxr_layer_release(struct mxr_layer *layer)
44953 {
44954 - if (layer->ops.release)
44955 - layer->ops.release(layer);
44956 + if (layer->ops->release)
44957 + layer->ops->release(layer);
44958 }
44959
44960 void mxr_base_layer_release(struct mxr_layer *layer)
44961 @@ -1097,7 +1097,7 @@ struct mxr_layer *mxr_base_layer_create(struct mxr_device *mdev,
44962
44963 layer->mdev = mdev;
44964 layer->idx = idx;
44965 - layer->ops = *ops;
44966 + layer->ops = ops;
44967
44968 spin_lock_init(&layer->enq_slock);
44969 INIT_LIST_HEAD(&layer->enq_list);
44970 diff --git a/drivers/media/platform/s5p-tv/mixer_vp_layer.c b/drivers/media/platform/s5p-tv/mixer_vp_layer.c
44971 index c9388c4..ce71ece 100644
44972 --- a/drivers/media/platform/s5p-tv/mixer_vp_layer.c
44973 +++ b/drivers/media/platform/s5p-tv/mixer_vp_layer.c
44974 @@ -206,7 +206,7 @@ struct mxr_layer *mxr_vp_layer_create(struct mxr_device *mdev, int idx)
44975 {
44976 struct mxr_layer *layer;
44977 int ret;
44978 - struct mxr_layer_ops ops = {
44979 + static struct mxr_layer_ops ops = {
44980 .release = mxr_vp_layer_release,
44981 .buffer_set = mxr_vp_buffer_set,
44982 .stream_set = mxr_vp_stream_set,
44983 diff --git a/drivers/media/platform/vivi.c b/drivers/media/platform/vivi.c
44984 index 2d4e73b..8b4d5b6 100644
44985 --- a/drivers/media/platform/vivi.c
44986 +++ b/drivers/media/platform/vivi.c
44987 @@ -58,8 +58,8 @@ MODULE_AUTHOR("Mauro Carvalho Chehab, Ted Walther and John Sokol");
44988 MODULE_LICENSE("Dual BSD/GPL");
44989 MODULE_VERSION(VIVI_VERSION);
44990
44991 -static unsigned video_nr = -1;
44992 -module_param(video_nr, uint, 0644);
44993 +static int video_nr = -1;
44994 +module_param(video_nr, int, 0644);
44995 MODULE_PARM_DESC(video_nr, "videoX start number, -1 is autodetect");
44996
44997 static unsigned n_devs = 1;
44998 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
44999 index 545c04c..a14bded 100644
45000 --- a/drivers/media/radio/radio-cadet.c
45001 +++ b/drivers/media/radio/radio-cadet.c
45002 @@ -324,6 +324,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
45003 unsigned char readbuf[RDS_BUFFER];
45004 int i = 0;
45005
45006 + if (count > RDS_BUFFER)
45007 + return -EFAULT;
45008 mutex_lock(&dev->lock);
45009 if (dev->rdsstat == 0)
45010 cadet_start_rds(dev);
45011 @@ -339,7 +341,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
45012 while (i < count && dev->rdsin != dev->rdsout)
45013 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
45014
45015 - if (i && copy_to_user(data, readbuf, i))
45016 + if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
45017 i = -EFAULT;
45018 unlock:
45019 mutex_unlock(&dev->lock);
45020 diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
45021 index 5236035..c622c74 100644
45022 --- a/drivers/media/radio/radio-maxiradio.c
45023 +++ b/drivers/media/radio/radio-maxiradio.c
45024 @@ -61,7 +61,7 @@ MODULE_PARM_DESC(radio_nr, "Radio device number");
45025 /* TEA5757 pin mappings */
45026 static const int clk = 1, data = 2, wren = 4, mo_st = 8, power = 16;
45027
45028 -static atomic_t maxiradio_instance = ATOMIC_INIT(0);
45029 +static atomic_unchecked_t maxiradio_instance = ATOMIC_INIT(0);
45030
45031 #define PCI_VENDOR_ID_GUILLEMOT 0x5046
45032 #define PCI_DEVICE_ID_GUILLEMOT_MAXIRADIO 0x1001
45033 diff --git a/drivers/media/radio/radio-shark.c b/drivers/media/radio/radio-shark.c
45034 index 050b3bb..79f62b9 100644
45035 --- a/drivers/media/radio/radio-shark.c
45036 +++ b/drivers/media/radio/radio-shark.c
45037 @@ -79,7 +79,7 @@ struct shark_device {
45038 u32 last_val;
45039 };
45040
45041 -static atomic_t shark_instance = ATOMIC_INIT(0);
45042 +static atomic_unchecked_t shark_instance = ATOMIC_INIT(0);
45043
45044 static void shark_write_val(struct snd_tea575x *tea, u32 val)
45045 {
45046 diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
45047 index 8654e0d..0608a64 100644
45048 --- a/drivers/media/radio/radio-shark2.c
45049 +++ b/drivers/media/radio/radio-shark2.c
45050 @@ -74,7 +74,7 @@ struct shark_device {
45051 u8 *transfer_buffer;
45052 };
45053
45054 -static atomic_t shark_instance = ATOMIC_INIT(0);
45055 +static atomic_unchecked_t shark_instance = ATOMIC_INIT(0);
45056
45057 static int shark_write_reg(struct radio_tea5777 *tea, u64 reg)
45058 {
45059 diff --git a/drivers/media/radio/radio-si476x.c b/drivers/media/radio/radio-si476x.c
45060 index 2fd9009..278cc1e 100644
45061 --- a/drivers/media/radio/radio-si476x.c
45062 +++ b/drivers/media/radio/radio-si476x.c
45063 @@ -1445,7 +1445,7 @@ static int si476x_radio_probe(struct platform_device *pdev)
45064 struct si476x_radio *radio;
45065 struct v4l2_ctrl *ctrl;
45066
45067 - static atomic_t instance = ATOMIC_INIT(0);
45068 + static atomic_unchecked_t instance = ATOMIC_INIT(0);
45069
45070 radio = devm_kzalloc(&pdev->dev, sizeof(*radio), GFP_KERNEL);
45071 if (!radio)
45072 diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c
45073 index a1c641e..3007da9 100644
45074 --- a/drivers/media/usb/dvb-usb/cxusb.c
45075 +++ b/drivers/media/usb/dvb-usb/cxusb.c
45076 @@ -1112,7 +1112,7 @@ static struct dib0070_config dib7070p_dib0070_config = {
45077
45078 struct dib0700_adapter_state {
45079 int (*set_param_save) (struct dvb_frontend *);
45080 -};
45081 +} __no_const;
45082
45083 static int dib7070_set_param_override(struct dvb_frontend *fe)
45084 {
45085 diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
45086 index ae0f56a..ec71784 100644
45087 --- a/drivers/media/usb/dvb-usb/dw2102.c
45088 +++ b/drivers/media/usb/dvb-usb/dw2102.c
45089 @@ -118,7 +118,7 @@ struct su3000_state {
45090
45091 struct s6x0_state {
45092 int (*old_set_voltage)(struct dvb_frontend *f, fe_sec_voltage_t v);
45093 -};
45094 +} __no_const;
45095
45096 /* debug */
45097 static int dvb_usb_dw2102_debug;
45098 diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
45099 index b63a5e5..b16a062 100644
45100 --- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
45101 +++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c
45102 @@ -326,7 +326,7 @@ struct v4l2_buffer32 {
45103 __u32 reserved;
45104 };
45105
45106 -static int get_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
45107 +static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
45108 enum v4l2_memory memory)
45109 {
45110 void __user *up_pln;
45111 @@ -355,7 +355,7 @@ static int get_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
45112 return 0;
45113 }
45114
45115 -static int put_v4l2_plane32(struct v4l2_plane *up, struct v4l2_plane32 *up32,
45116 +static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32,
45117 enum v4l2_memory memory)
45118 {
45119 if (copy_in_user(up32, up, 2 * sizeof(__u32)) ||
45120 @@ -425,7 +425,7 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
45121 * by passing a very big num_planes value */
45122 uplane = compat_alloc_user_space(num_planes *
45123 sizeof(struct v4l2_plane));
45124 - kp->m.planes = uplane;
45125 + kp->m.planes = (struct v4l2_plane __force_kernel *)uplane;
45126
45127 while (--num_planes >= 0) {
45128 ret = get_v4l2_plane32(uplane, uplane32, kp->memory);
45129 @@ -496,7 +496,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
45130 if (num_planes == 0)
45131 return 0;
45132
45133 - uplane = kp->m.planes;
45134 + uplane = (struct v4l2_plane __force_user *)kp->m.planes;
45135 if (get_user(p, &up->m.planes))
45136 return -EFAULT;
45137 uplane32 = compat_ptr(p);
45138 @@ -550,7 +550,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_frame
45139 get_user(kp->capability, &up->capability) ||
45140 get_user(kp->flags, &up->flags))
45141 return -EFAULT;
45142 - kp->base = compat_ptr(tmp);
45143 + kp->base = (void __force_kernel *)compat_ptr(tmp);
45144 get_v4l2_pix_format(&kp->fmt, &up->fmt);
45145 return 0;
45146 }
45147 @@ -656,7 +656,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
45148 n * sizeof(struct v4l2_ext_control32)))
45149 return -EFAULT;
45150 kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control));
45151 - kp->controls = kcontrols;
45152 + kp->controls = (struct v4l2_ext_control __force_kernel *)kcontrols;
45153 while (--n >= 0) {
45154 if (copy_in_user(kcontrols, ucontrols, sizeof(*ucontrols)))
45155 return -EFAULT;
45156 @@ -678,7 +678,7 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext
45157 static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up)
45158 {
45159 struct v4l2_ext_control32 __user *ucontrols;
45160 - struct v4l2_ext_control __user *kcontrols = kp->controls;
45161 + struct v4l2_ext_control __user *kcontrols = (struct v4l2_ext_control __force_user *)kp->controls;
45162 int n = kp->count;
45163 compat_caddr_t p;
45164
45165 @@ -772,7 +772,7 @@ static int put_v4l2_subdev_edid32(struct v4l2_subdev_edid *kp, struct v4l2_subde
45166 put_user(kp->start_block, &up->start_block) ||
45167 put_user(kp->blocks, &up->blocks) ||
45168 put_user(tmp, &up->edid) ||
45169 - copy_to_user(kp->reserved, up->reserved, sizeof(kp->reserved)))
45170 + copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved)))
45171 return -EFAULT;
45172 return 0;
45173 }
45174 diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
45175 index 6ff002b..6b9316b 100644
45176 --- a/drivers/media/v4l2-core/v4l2-ctrls.c
45177 +++ b/drivers/media/v4l2-core/v4l2-ctrls.c
45178 @@ -1401,8 +1401,8 @@ static int validate_new(const struct v4l2_ctrl *ctrl,
45179 return 0;
45180
45181 case V4L2_CTRL_TYPE_STRING:
45182 - len = strlen(c->string);
45183 - if (len < ctrl->minimum)
45184 + len = strlen_user(c->string);
45185 + if (!len || len < ctrl->minimum)
45186 return -ERANGE;
45187 if ((len - ctrl->minimum) % ctrl->step)
45188 return -ERANGE;
45189 diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c
45190 index 02d1b63..5fd6b16 100644
45191 --- a/drivers/media/v4l2-core/v4l2-device.c
45192 +++ b/drivers/media/v4l2-core/v4l2-device.c
45193 @@ -75,9 +75,9 @@ int v4l2_device_put(struct v4l2_device *v4l2_dev)
45194 EXPORT_SYMBOL_GPL(v4l2_device_put);
45195
45196 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
45197 - atomic_t *instance)
45198 + atomic_unchecked_t *instance)
45199 {
45200 - int num = atomic_inc_return(instance) - 1;
45201 + int num = atomic_inc_return_unchecked(instance) - 1;
45202 int len = strlen(basename);
45203
45204 if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
45205 diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
45206 index 707aef7..93b8ac0 100644
45207 --- a/drivers/media/v4l2-core/v4l2-ioctl.c
45208 +++ b/drivers/media/v4l2-core/v4l2-ioctl.c
45209 @@ -1942,7 +1942,8 @@ struct v4l2_ioctl_info {
45210 struct file *file, void *fh, void *p);
45211 } u;
45212 void (*debug)(const void *arg, bool write_only);
45213 -};
45214 +} __do_const;
45215 +typedef struct v4l2_ioctl_info __no_const v4l2_ioctl_info_no_const;
45216
45217 /* This control needs a priority check */
45218 #define INFO_FL_PRIO (1 << 0)
45219 @@ -2123,7 +2124,7 @@ static long __video_do_ioctl(struct file *file,
45220 struct video_device *vfd = video_devdata(file);
45221 const struct v4l2_ioctl_ops *ops = vfd->ioctl_ops;
45222 bool write_only = false;
45223 - struct v4l2_ioctl_info default_info;
45224 + v4l2_ioctl_info_no_const default_info;
45225 const struct v4l2_ioctl_info *info;
45226 void *fh = file->private_data;
45227 struct v4l2_fh *vfh = NULL;
45228 @@ -2197,7 +2198,7 @@ done:
45229 }
45230
45231 static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
45232 - void * __user *user_ptr, void ***kernel_ptr)
45233 + void __user **user_ptr, void ***kernel_ptr)
45234 {
45235 int ret = 0;
45236
45237 @@ -2213,7 +2214,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
45238 ret = -EINVAL;
45239 break;
45240 }
45241 - *user_ptr = (void __user *)buf->m.planes;
45242 + *user_ptr = (void __force_user *)buf->m.planes;
45243 *kernel_ptr = (void *)&buf->m.planes;
45244 *array_size = sizeof(struct v4l2_plane) * buf->length;
45245 ret = 1;
45246 @@ -2248,7 +2249,7 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size,
45247 ret = -EINVAL;
45248 break;
45249 }
45250 - *user_ptr = (void __user *)ctrls->controls;
45251 + *user_ptr = (void __force_user *)ctrls->controls;
45252 *kernel_ptr = (void *)&ctrls->controls;
45253 *array_size = sizeof(struct v4l2_ext_control)
45254 * ctrls->count;
45255 @@ -2349,7 +2350,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
45256 }
45257
45258 if (has_array_args) {
45259 - *kernel_ptr = user_ptr;
45260 + *kernel_ptr = (void __force_kernel *)user_ptr;
45261 if (copy_to_user(user_ptr, mbuf, array_size))
45262 err = -EFAULT;
45263 goto out_array_args;
45264 diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
45265 index 570b18a..f880314 100644
45266 --- a/drivers/message/fusion/mptbase.c
45267 +++ b/drivers/message/fusion/mptbase.c
45268 @@ -6755,8 +6755,13 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
45269 seq_printf(m, " MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
45270 seq_printf(m, " MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
45271
45272 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45273 + seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n", NULL, NULL);
45274 +#else
45275 seq_printf(m, " RequestFrames @ 0x%p (Dma @ 0x%p)\n",
45276 (void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
45277 +#endif
45278 +
45279 /*
45280 * Rounding UP to nearest 4-kB boundary here...
45281 */
45282 @@ -6769,7 +6774,11 @@ static int mpt_iocinfo_proc_show(struct seq_file *m, void *v)
45283 ioc->facts.GlobalCredits);
45284
45285 seq_printf(m, " Frames @ 0x%p (Dma @ 0x%p)\n",
45286 +#ifdef CONFIG_GRKERNSEC_HIDESYM
45287 + NULL, NULL);
45288 +#else
45289 (void *)ioc->alloc, (void *)(ulong)ioc->alloc_dma);
45290 +#endif
45291 sz = (ioc->reply_sz * ioc->reply_depth) + 128;
45292 seq_printf(m, " {CurRepSz=%d} x {CurRepDepth=%d} = %d bytes ^= 0x%x\n",
45293 ioc->reply_sz, ioc->reply_depth, ioc->reply_sz*ioc->reply_depth, sz);
45294 diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
45295 index 00d339c..2ea899d 100644
45296 --- a/drivers/message/fusion/mptsas.c
45297 +++ b/drivers/message/fusion/mptsas.c
45298 @@ -446,6 +446,23 @@ mptsas_is_end_device(struct mptsas_devinfo * attached)
45299 return 0;
45300 }
45301
45302 +static inline void
45303 +mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
45304 +{
45305 + if (phy_info->port_details) {
45306 + phy_info->port_details->rphy = rphy;
45307 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
45308 + ioc->name, rphy));
45309 + }
45310 +
45311 + if (rphy) {
45312 + dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
45313 + &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
45314 + dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
45315 + ioc->name, rphy, rphy->dev.release));
45316 + }
45317 +}
45318 +
45319 /* no mutex */
45320 static void
45321 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
45322 @@ -484,23 +501,6 @@ mptsas_get_rphy(struct mptsas_phyinfo *phy_info)
45323 return NULL;
45324 }
45325
45326 -static inline void
45327 -mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
45328 -{
45329 - if (phy_info->port_details) {
45330 - phy_info->port_details->rphy = rphy;
45331 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
45332 - ioc->name, rphy));
45333 - }
45334 -
45335 - if (rphy) {
45336 - dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
45337 - &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
45338 - dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
45339 - ioc->name, rphy, rphy->dev.release));
45340 - }
45341 -}
45342 -
45343 static inline struct sas_port *
45344 mptsas_get_port(struct mptsas_phyinfo *phy_info)
45345 {
45346 diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
45347 index 727819c..ad74694 100644
45348 --- a/drivers/message/fusion/mptscsih.c
45349 +++ b/drivers/message/fusion/mptscsih.c
45350 @@ -1271,15 +1271,16 @@ mptscsih_info(struct Scsi_Host *SChost)
45351
45352 h = shost_priv(SChost);
45353
45354 - if (h) {
45355 - if (h->info_kbuf == NULL)
45356 - if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
45357 - return h->info_kbuf;
45358 - h->info_kbuf[0] = '\0';
45359 + if (!h)
45360 + return NULL;
45361
45362 - mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
45363 - h->info_kbuf[size-1] = '\0';
45364 - }
45365 + if (h->info_kbuf == NULL)
45366 + if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
45367 + return h->info_kbuf;
45368 + h->info_kbuf[0] = '\0';
45369 +
45370 + mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
45371 + h->info_kbuf[size-1] = '\0';
45372
45373 return h->info_kbuf;
45374 }
45375 diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
45376 index b7d87cd..3fb36da 100644
45377 --- a/drivers/message/i2o/i2o_proc.c
45378 +++ b/drivers/message/i2o/i2o_proc.c
45379 @@ -255,12 +255,6 @@ static char *scsi_devices[] = {
45380 "Array Controller Device"
45381 };
45382
45383 -static char *chtostr(char *tmp, u8 *chars, int n)
45384 -{
45385 - tmp[0] = 0;
45386 - return strncat(tmp, (char *)chars, n);
45387 -}
45388 -
45389 static int i2o_report_query_status(struct seq_file *seq, int block_status,
45390 char *group)
45391 {
45392 @@ -707,9 +701,9 @@ static int i2o_seq_show_status(struct seq_file *seq, void *v)
45393 static int i2o_seq_show_hw(struct seq_file *seq, void *v)
45394 {
45395 struct i2o_controller *c = (struct i2o_controller *)seq->private;
45396 - static u32 work32[5];
45397 - static u8 *work8 = (u8 *) work32;
45398 - static u16 *work16 = (u16 *) work32;
45399 + u32 work32[5];
45400 + u8 *work8 = (u8 *) work32;
45401 + u16 *work16 = (u16 *) work32;
45402 int token;
45403 u32 hwcap;
45404
45405 @@ -790,7 +784,6 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
45406 } *result;
45407
45408 i2o_exec_execute_ddm_table ddm_table;
45409 - char tmp[28 + 1];
45410
45411 result = kmalloc(sizeof(*result), GFP_KERNEL);
45412 if (!result)
45413 @@ -825,8 +818,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
45414
45415 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
45416 seq_printf(seq, "%-#8x", ddm_table.module_id);
45417 - seq_printf(seq, "%-29s",
45418 - chtostr(tmp, ddm_table.module_name_version, 28));
45419 + seq_printf(seq, "%-.28s", ddm_table.module_name_version);
45420 seq_printf(seq, "%9d ", ddm_table.data_size);
45421 seq_printf(seq, "%8d", ddm_table.code_size);
45422
45423 @@ -893,7 +885,6 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
45424
45425 i2o_driver_result_table *result;
45426 i2o_driver_store_table *dst;
45427 - char tmp[28 + 1];
45428
45429 result = kmalloc(sizeof(i2o_driver_result_table), GFP_KERNEL);
45430 if (result == NULL)
45431 @@ -928,9 +919,8 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
45432
45433 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
45434 seq_printf(seq, "%-#8x", dst->module_id);
45435 - seq_printf(seq, "%-29s",
45436 - chtostr(tmp, dst->module_name_version, 28));
45437 - seq_printf(seq, "%-9s", chtostr(tmp, dst->date, 8));
45438 + seq_printf(seq, "%-.28s", dst->module_name_version);
45439 + seq_printf(seq, "%-.8s", dst->date);
45440 seq_printf(seq, "%8d ", dst->module_size);
45441 seq_printf(seq, "%8d ", dst->mpb_size);
45442 seq_printf(seq, "0x%04x", dst->module_flags);
45443 @@ -1246,11 +1236,10 @@ static int i2o_seq_show_authorized_users(struct seq_file *seq, void *v)
45444 static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
45445 {
45446 struct i2o_device *d = (struct i2o_device *)seq->private;
45447 - static u32 work32[128]; // allow for "stuff" + up to 256 byte (max) serial number
45448 + u32 work32[128]; // allow for "stuff" + up to 256 byte (max) serial number
45449 // == (allow) 512d bytes (max)
45450 - static u16 *work16 = (u16 *) work32;
45451 + u16 *work16 = (u16 *) work32;
45452 int token;
45453 - char tmp[16 + 1];
45454
45455 token = i2o_parm_field_get(d, 0xF100, -1, &work32, sizeof(work32));
45456
45457 @@ -1262,14 +1251,10 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
45458 seq_printf(seq, "Device Class : %s\n", i2o_get_class_name(work16[0]));
45459 seq_printf(seq, "Owner TID : %0#5x\n", work16[2]);
45460 seq_printf(seq, "Parent TID : %0#5x\n", work16[3]);
45461 - seq_printf(seq, "Vendor info : %s\n",
45462 - chtostr(tmp, (u8 *) (work32 + 2), 16));
45463 - seq_printf(seq, "Product info : %s\n",
45464 - chtostr(tmp, (u8 *) (work32 + 6), 16));
45465 - seq_printf(seq, "Description : %s\n",
45466 - chtostr(tmp, (u8 *) (work32 + 10), 16));
45467 - seq_printf(seq, "Product rev. : %s\n",
45468 - chtostr(tmp, (u8 *) (work32 + 14), 8));
45469 + seq_printf(seq, "Vendor info : %.16s\n", (u8 *) (work32 + 2));
45470 + seq_printf(seq, "Product info : %.16s\n", (u8 *) (work32 + 6));
45471 + seq_printf(seq, "Description : %.16s\n", (u8 *) (work32 + 10));
45472 + seq_printf(seq, "Product rev. : %.8s\n", (u8 *) (work32 + 14));
45473
45474 seq_printf(seq, "Serial number : ");
45475 print_serial_number(seq, (u8 *) (work32 + 16),
45476 @@ -1306,8 +1291,6 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
45477 u8 pad[256]; // allow up to 256 byte (max) serial number
45478 } result;
45479
45480 - char tmp[24 + 1];
45481 -
45482 token = i2o_parm_field_get(d, 0xF101, -1, &result, sizeof(result));
45483
45484 if (token < 0) {
45485 @@ -1316,10 +1299,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
45486 }
45487
45488 seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
45489 - seq_printf(seq, "Module name : %s\n",
45490 - chtostr(tmp, result.module_name, 24));
45491 - seq_printf(seq, "Module revision : %s\n",
45492 - chtostr(tmp, result.module_rev, 8));
45493 + seq_printf(seq, "Module name : %.24s\n", result.module_name);
45494 + seq_printf(seq, "Module revision : %.8s\n", result.module_rev);
45495
45496 seq_printf(seq, "Serial number : ");
45497 print_serial_number(seq, result.serial_number, sizeof(result) - 36);
45498 @@ -1343,8 +1324,6 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
45499 u8 instance_number[4];
45500 } result;
45501
45502 - char tmp[64 + 1];
45503 -
45504 token = i2o_parm_field_get(d, 0xF102, -1, &result, sizeof(result));
45505
45506 if (token < 0) {
45507 @@ -1352,14 +1331,10 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
45508 return 0;
45509 }
45510
45511 - seq_printf(seq, "Device name : %s\n",
45512 - chtostr(tmp, result.device_name, 64));
45513 - seq_printf(seq, "Service name : %s\n",
45514 - chtostr(tmp, result.service_name, 64));
45515 - seq_printf(seq, "Physical name : %s\n",
45516 - chtostr(tmp, result.physical_location, 64));
45517 - seq_printf(seq, "Instance number : %s\n",
45518 - chtostr(tmp, result.instance_number, 4));
45519 + seq_printf(seq, "Device name : %.64s\n", result.device_name);
45520 + seq_printf(seq, "Service name : %.64s\n", result.service_name);
45521 + seq_printf(seq, "Physical name : %.64s\n", result.physical_location);
45522 + seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
45523
45524 return 0;
45525 }
45526 @@ -1368,9 +1343,9 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
45527 static int i2o_seq_show_sgl_limits(struct seq_file *seq, void *v)
45528 {
45529 struct i2o_device *d = (struct i2o_device *)seq->private;
45530 - static u32 work32[12];
45531 - static u16 *work16 = (u16 *) work32;
45532 - static u8 *work8 = (u8 *) work32;
45533 + u32 work32[12];
45534 + u16 *work16 = (u16 *) work32;
45535 + u8 *work8 = (u8 *) work32;
45536 int token;
45537
45538 token = i2o_parm_field_get(d, 0xF103, -1, &work32, sizeof(work32));
45539 diff --git a/drivers/message/i2o/iop.c b/drivers/message/i2o/iop.c
45540 index a8c08f3..155fe3d 100644
45541 --- a/drivers/message/i2o/iop.c
45542 +++ b/drivers/message/i2o/iop.c
45543 @@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_controller * c, void *ptr)
45544
45545 spin_lock_irqsave(&c->context_list_lock, flags);
45546
45547 - if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
45548 - atomic_inc(&c->context_list_counter);
45549 + if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
45550 + atomic_inc_unchecked(&c->context_list_counter);
45551
45552 - entry->context = atomic_read(&c->context_list_counter);
45553 + entry->context = atomic_read_unchecked(&c->context_list_counter);
45554
45555 list_add(&entry->list, &c->context_list);
45556
45557 @@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(void)
45558
45559 #if BITS_PER_LONG == 64
45560 spin_lock_init(&c->context_list_lock);
45561 - atomic_set(&c->context_list_counter, 0);
45562 + atomic_set_unchecked(&c->context_list_counter, 0);
45563 INIT_LIST_HEAD(&c->context_list);
45564 #endif
45565
45566 diff --git a/drivers/mfd/ab8500-debugfs.c b/drivers/mfd/ab8500-debugfs.c
45567 index d1a22aa..d0f7bf7 100644
45568 --- a/drivers/mfd/ab8500-debugfs.c
45569 +++ b/drivers/mfd/ab8500-debugfs.c
45570 @@ -100,7 +100,7 @@ static int irq_last;
45571 static u32 *irq_count;
45572 static int num_irqs;
45573
45574 -static struct device_attribute **dev_attr;
45575 +static device_attribute_no_const **dev_attr;
45576 static char **event_name;
45577
45578 static u8 avg_sample = SAMPLE_16;
45579 diff --git a/drivers/mfd/janz-cmodio.c b/drivers/mfd/janz-cmodio.c
45580 index 81b7d88..95ae998 100644
45581 --- a/drivers/mfd/janz-cmodio.c
45582 +++ b/drivers/mfd/janz-cmodio.c
45583 @@ -13,6 +13,7 @@
45584
45585 #include <linux/kernel.h>
45586 #include <linux/module.h>
45587 +#include <linux/slab.h>
45588 #include <linux/init.h>
45589 #include <linux/pci.h>
45590 #include <linux/interrupt.h>
45591 diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c
45592 index a83eed5..62a58a9 100644
45593 --- a/drivers/mfd/max8925-i2c.c
45594 +++ b/drivers/mfd/max8925-i2c.c
45595 @@ -152,7 +152,7 @@ static int max8925_probe(struct i2c_client *client,
45596 const struct i2c_device_id *id)
45597 {
45598 struct max8925_platform_data *pdata = dev_get_platdata(&client->dev);
45599 - static struct max8925_chip *chip;
45600 + struct max8925_chip *chip;
45601 struct device_node *node = client->dev.of_node;
45602
45603 if (node && !pdata) {
45604 diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
45605 index d657331..0d9a80f 100644
45606 --- a/drivers/mfd/tps65910.c
45607 +++ b/drivers/mfd/tps65910.c
45608 @@ -230,7 +230,7 @@ static int tps65910_irq_init(struct tps65910 *tps65910, int irq,
45609 struct tps65910_platform_data *pdata)
45610 {
45611 int ret = 0;
45612 - static struct regmap_irq_chip *tps6591x_irqs_chip;
45613 + struct regmap_irq_chip *tps6591x_irqs_chip;
45614
45615 if (!irq) {
45616 dev_warn(tps65910->dev, "No interrupt support, no core IRQ\n");
45617 diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
45618 index 9aa6d1e..1631bfc 100644
45619 --- a/drivers/mfd/twl4030-irq.c
45620 +++ b/drivers/mfd/twl4030-irq.c
45621 @@ -35,6 +35,7 @@
45622 #include <linux/of.h>
45623 #include <linux/irqdomain.h>
45624 #include <linux/i2c/twl.h>
45625 +#include <asm/pgtable.h>
45626
45627 #include "twl-core.h"
45628
45629 @@ -726,10 +727,12 @@ int twl4030_init_irq(struct device *dev, int irq_num)
45630 * Install an irq handler for each of the SIH modules;
45631 * clone dummy irq_chip since PIH can't *do* anything
45632 */
45633 - twl4030_irq_chip = dummy_irq_chip;
45634 - twl4030_irq_chip.name = "twl4030";
45635 + pax_open_kernel();
45636 + memcpy((void *)&twl4030_irq_chip, &dummy_irq_chip, sizeof twl4030_irq_chip);
45637 + *(const char **)&twl4030_irq_chip.name = "twl4030";
45638
45639 - twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
45640 + *(void **)&twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
45641 + pax_close_kernel();
45642
45643 for (i = irq_base; i < irq_end; i++) {
45644 irq_set_chip_and_handler(i, &twl4030_irq_chip,
45645 diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
45646 index 464419b..64bae8d 100644
45647 --- a/drivers/misc/c2port/core.c
45648 +++ b/drivers/misc/c2port/core.c
45649 @@ -922,7 +922,9 @@ struct c2port_device *c2port_device_register(char *name,
45650 goto error_idr_alloc;
45651 c2dev->id = ret;
45652
45653 - bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
45654 + pax_open_kernel();
45655 + *(size_t *)&bin_attr_flash_data.size = ops->blocks_num * ops->block_size;
45656 + pax_close_kernel();
45657
45658 c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
45659 "c2port%d", c2dev->id);
45660 diff --git a/drivers/misc/eeprom/sunxi_sid.c b/drivers/misc/eeprom/sunxi_sid.c
45661 index 9c34e57..b981cda 100644
45662 --- a/drivers/misc/eeprom/sunxi_sid.c
45663 +++ b/drivers/misc/eeprom/sunxi_sid.c
45664 @@ -127,7 +127,9 @@ static int sunxi_sid_probe(struct platform_device *pdev)
45665
45666 platform_set_drvdata(pdev, sid_data);
45667
45668 - sid_bin_attr.size = sid_data->keysize;
45669 + pax_open_kernel();
45670 + *(size_t *)&sid_bin_attr.size = sid_data->keysize;
45671 + pax_close_kernel();
45672 if (device_create_bin_file(&pdev->dev, &sid_bin_attr))
45673 return -ENODEV;
45674
45675 diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
45676 index 36f5d52..32311c3 100644
45677 --- a/drivers/misc/kgdbts.c
45678 +++ b/drivers/misc/kgdbts.c
45679 @@ -834,7 +834,7 @@ static void run_plant_and_detach_test(int is_early)
45680 char before[BREAK_INSTR_SIZE];
45681 char after[BREAK_INSTR_SIZE];
45682
45683 - probe_kernel_read(before, (char *)kgdbts_break_test,
45684 + probe_kernel_read(before, ktla_ktva((char *)kgdbts_break_test),
45685 BREAK_INSTR_SIZE);
45686 init_simple_test();
45687 ts.tst = plant_and_detach_test;
45688 @@ -842,7 +842,7 @@ static void run_plant_and_detach_test(int is_early)
45689 /* Activate test with initial breakpoint */
45690 if (!is_early)
45691 kgdb_breakpoint();
45692 - probe_kernel_read(after, (char *)kgdbts_break_test,
45693 + probe_kernel_read(after, ktla_ktva((char *)kgdbts_break_test),
45694 BREAK_INSTR_SIZE);
45695 if (memcmp(before, after, BREAK_INSTR_SIZE)) {
45696 printk(KERN_CRIT "kgdbts: ERROR kgdb corrupted memory\n");
45697 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
45698 index 036effe..b3a6336 100644
45699 --- a/drivers/misc/lis3lv02d/lis3lv02d.c
45700 +++ b/drivers/misc/lis3lv02d/lis3lv02d.c
45701 @@ -498,7 +498,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *data)
45702 * the lid is closed. This leads to interrupts as soon as a little move
45703 * is done.
45704 */
45705 - atomic_inc(&lis3->count);
45706 + atomic_inc_unchecked(&lis3->count);
45707
45708 wake_up_interruptible(&lis3->misc_wait);
45709 kill_fasync(&lis3->async_queue, SIGIO, POLL_IN);
45710 @@ -584,7 +584,7 @@ static int lis3lv02d_misc_open(struct inode *inode, struct file *file)
45711 if (lis3->pm_dev)
45712 pm_runtime_get_sync(lis3->pm_dev);
45713
45714 - atomic_set(&lis3->count, 0);
45715 + atomic_set_unchecked(&lis3->count, 0);
45716 return 0;
45717 }
45718
45719 @@ -616,7 +616,7 @@ static ssize_t lis3lv02d_misc_read(struct file *file, char __user *buf,
45720 add_wait_queue(&lis3->misc_wait, &wait);
45721 while (true) {
45722 set_current_state(TASK_INTERRUPTIBLE);
45723 - data = atomic_xchg(&lis3->count, 0);
45724 + data = atomic_xchg_unchecked(&lis3->count, 0);
45725 if (data)
45726 break;
45727
45728 @@ -657,7 +657,7 @@ static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
45729 struct lis3lv02d, miscdev);
45730
45731 poll_wait(file, &lis3->misc_wait, wait);
45732 - if (atomic_read(&lis3->count))
45733 + if (atomic_read_unchecked(&lis3->count))
45734 return POLLIN | POLLRDNORM;
45735 return 0;
45736 }
45737 diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h
45738 index c439c82..1f20f57 100644
45739 --- a/drivers/misc/lis3lv02d/lis3lv02d.h
45740 +++ b/drivers/misc/lis3lv02d/lis3lv02d.h
45741 @@ -297,7 +297,7 @@ struct lis3lv02d {
45742 struct input_polled_dev *idev; /* input device */
45743 struct platform_device *pdev; /* platform device */
45744 struct regulator_bulk_data regulators[2];
45745 - atomic_t count; /* interrupt count after last read */
45746 + atomic_unchecked_t count; /* interrupt count after last read */
45747 union axis_conversion ac; /* hw -> logical axis */
45748 int mapped_btns[3];
45749
45750 diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
45751 index 2f30bad..c4c13d0 100644
45752 --- a/drivers/misc/sgi-gru/gruhandles.c
45753 +++ b/drivers/misc/sgi-gru/gruhandles.c
45754 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op op, unsigned long clks)
45755 unsigned long nsec;
45756
45757 nsec = CLKS2NSEC(clks);
45758 - atomic_long_inc(&mcs_op_statistics[op].count);
45759 - atomic_long_add(nsec, &mcs_op_statistics[op].total);
45760 + atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
45761 + atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
45762 if (mcs_op_statistics[op].max < nsec)
45763 mcs_op_statistics[op].max = nsec;
45764 }
45765 diff --git a/drivers/misc/sgi-gru/gruprocfs.c b/drivers/misc/sgi-gru/gruprocfs.c
45766 index 4f76359..cdfcb2e 100644
45767 --- a/drivers/misc/sgi-gru/gruprocfs.c
45768 +++ b/drivers/misc/sgi-gru/gruprocfs.c
45769 @@ -32,9 +32,9 @@
45770
45771 #define printstat(s, f) printstat_val(s, &gru_stats.f, #f)
45772
45773 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
45774 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
45775 {
45776 - unsigned long val = atomic_long_read(v);
45777 + unsigned long val = atomic_long_read_unchecked(v);
45778
45779 seq_printf(s, "%16lu %s\n", val, id);
45780 }
45781 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct seq_file *s, void *p)
45782
45783 seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
45784 for (op = 0; op < mcsop_last; op++) {
45785 - count = atomic_long_read(&mcs_op_statistics[op].count);
45786 - total = atomic_long_read(&mcs_op_statistics[op].total);
45787 + count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
45788 + total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
45789 max = mcs_op_statistics[op].max;
45790 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
45791 count ? total / count : 0, max);
45792 diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
45793 index 5c3ce24..4915ccb 100644
45794 --- a/drivers/misc/sgi-gru/grutables.h
45795 +++ b/drivers/misc/sgi-gru/grutables.h
45796 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
45797 * GRU statistics.
45798 */
45799 struct gru_stats_s {
45800 - atomic_long_t vdata_alloc;
45801 - atomic_long_t vdata_free;
45802 - atomic_long_t gts_alloc;
45803 - atomic_long_t gts_free;
45804 - atomic_long_t gms_alloc;
45805 - atomic_long_t gms_free;
45806 - atomic_long_t gts_double_allocate;
45807 - atomic_long_t assign_context;
45808 - atomic_long_t assign_context_failed;
45809 - atomic_long_t free_context;
45810 - atomic_long_t load_user_context;
45811 - atomic_long_t load_kernel_context;
45812 - atomic_long_t lock_kernel_context;
45813 - atomic_long_t unlock_kernel_context;
45814 - atomic_long_t steal_user_context;
45815 - atomic_long_t steal_kernel_context;
45816 - atomic_long_t steal_context_failed;
45817 - atomic_long_t nopfn;
45818 - atomic_long_t asid_new;
45819 - atomic_long_t asid_next;
45820 - atomic_long_t asid_wrap;
45821 - atomic_long_t asid_reuse;
45822 - atomic_long_t intr;
45823 - atomic_long_t intr_cbr;
45824 - atomic_long_t intr_tfh;
45825 - atomic_long_t intr_spurious;
45826 - atomic_long_t intr_mm_lock_failed;
45827 - atomic_long_t call_os;
45828 - atomic_long_t call_os_wait_queue;
45829 - atomic_long_t user_flush_tlb;
45830 - atomic_long_t user_unload_context;
45831 - atomic_long_t user_exception;
45832 - atomic_long_t set_context_option;
45833 - atomic_long_t check_context_retarget_intr;
45834 - atomic_long_t check_context_unload;
45835 - atomic_long_t tlb_dropin;
45836 - atomic_long_t tlb_preload_page;
45837 - atomic_long_t tlb_dropin_fail_no_asid;
45838 - atomic_long_t tlb_dropin_fail_upm;
45839 - atomic_long_t tlb_dropin_fail_invalid;
45840 - atomic_long_t tlb_dropin_fail_range_active;
45841 - atomic_long_t tlb_dropin_fail_idle;
45842 - atomic_long_t tlb_dropin_fail_fmm;
45843 - atomic_long_t tlb_dropin_fail_no_exception;
45844 - atomic_long_t tfh_stale_on_fault;
45845 - atomic_long_t mmu_invalidate_range;
45846 - atomic_long_t mmu_invalidate_page;
45847 - atomic_long_t flush_tlb;
45848 - atomic_long_t flush_tlb_gru;
45849 - atomic_long_t flush_tlb_gru_tgh;
45850 - atomic_long_t flush_tlb_gru_zero_asid;
45851 + atomic_long_unchecked_t vdata_alloc;
45852 + atomic_long_unchecked_t vdata_free;
45853 + atomic_long_unchecked_t gts_alloc;
45854 + atomic_long_unchecked_t gts_free;
45855 + atomic_long_unchecked_t gms_alloc;
45856 + atomic_long_unchecked_t gms_free;
45857 + atomic_long_unchecked_t gts_double_allocate;
45858 + atomic_long_unchecked_t assign_context;
45859 + atomic_long_unchecked_t assign_context_failed;
45860 + atomic_long_unchecked_t free_context;
45861 + atomic_long_unchecked_t load_user_context;
45862 + atomic_long_unchecked_t load_kernel_context;
45863 + atomic_long_unchecked_t lock_kernel_context;
45864 + atomic_long_unchecked_t unlock_kernel_context;
45865 + atomic_long_unchecked_t steal_user_context;
45866 + atomic_long_unchecked_t steal_kernel_context;
45867 + atomic_long_unchecked_t steal_context_failed;
45868 + atomic_long_unchecked_t nopfn;
45869 + atomic_long_unchecked_t asid_new;
45870 + atomic_long_unchecked_t asid_next;
45871 + atomic_long_unchecked_t asid_wrap;
45872 + atomic_long_unchecked_t asid_reuse;
45873 + atomic_long_unchecked_t intr;
45874 + atomic_long_unchecked_t intr_cbr;
45875 + atomic_long_unchecked_t intr_tfh;
45876 + atomic_long_unchecked_t intr_spurious;
45877 + atomic_long_unchecked_t intr_mm_lock_failed;
45878 + atomic_long_unchecked_t call_os;
45879 + atomic_long_unchecked_t call_os_wait_queue;
45880 + atomic_long_unchecked_t user_flush_tlb;
45881 + atomic_long_unchecked_t user_unload_context;
45882 + atomic_long_unchecked_t user_exception;
45883 + atomic_long_unchecked_t set_context_option;
45884 + atomic_long_unchecked_t check_context_retarget_intr;
45885 + atomic_long_unchecked_t check_context_unload;
45886 + atomic_long_unchecked_t tlb_dropin;
45887 + atomic_long_unchecked_t tlb_preload_page;
45888 + atomic_long_unchecked_t tlb_dropin_fail_no_asid;
45889 + atomic_long_unchecked_t tlb_dropin_fail_upm;
45890 + atomic_long_unchecked_t tlb_dropin_fail_invalid;
45891 + atomic_long_unchecked_t tlb_dropin_fail_range_active;
45892 + atomic_long_unchecked_t tlb_dropin_fail_idle;
45893 + atomic_long_unchecked_t tlb_dropin_fail_fmm;
45894 + atomic_long_unchecked_t tlb_dropin_fail_no_exception;
45895 + atomic_long_unchecked_t tfh_stale_on_fault;
45896 + atomic_long_unchecked_t mmu_invalidate_range;
45897 + atomic_long_unchecked_t mmu_invalidate_page;
45898 + atomic_long_unchecked_t flush_tlb;
45899 + atomic_long_unchecked_t flush_tlb_gru;
45900 + atomic_long_unchecked_t flush_tlb_gru_tgh;
45901 + atomic_long_unchecked_t flush_tlb_gru_zero_asid;
45902
45903 - atomic_long_t copy_gpa;
45904 - atomic_long_t read_gpa;
45905 + atomic_long_unchecked_t copy_gpa;
45906 + atomic_long_unchecked_t read_gpa;
45907
45908 - atomic_long_t mesq_receive;
45909 - atomic_long_t mesq_receive_none;
45910 - atomic_long_t mesq_send;
45911 - atomic_long_t mesq_send_failed;
45912 - atomic_long_t mesq_noop;
45913 - atomic_long_t mesq_send_unexpected_error;
45914 - atomic_long_t mesq_send_lb_overflow;
45915 - atomic_long_t mesq_send_qlimit_reached;
45916 - atomic_long_t mesq_send_amo_nacked;
45917 - atomic_long_t mesq_send_put_nacked;
45918 - atomic_long_t mesq_page_overflow;
45919 - atomic_long_t mesq_qf_locked;
45920 - atomic_long_t mesq_qf_noop_not_full;
45921 - atomic_long_t mesq_qf_switch_head_failed;
45922 - atomic_long_t mesq_qf_unexpected_error;
45923 - atomic_long_t mesq_noop_unexpected_error;
45924 - atomic_long_t mesq_noop_lb_overflow;
45925 - atomic_long_t mesq_noop_qlimit_reached;
45926 - atomic_long_t mesq_noop_amo_nacked;
45927 - atomic_long_t mesq_noop_put_nacked;
45928 - atomic_long_t mesq_noop_page_overflow;
45929 + atomic_long_unchecked_t mesq_receive;
45930 + atomic_long_unchecked_t mesq_receive_none;
45931 + atomic_long_unchecked_t mesq_send;
45932 + atomic_long_unchecked_t mesq_send_failed;
45933 + atomic_long_unchecked_t mesq_noop;
45934 + atomic_long_unchecked_t mesq_send_unexpected_error;
45935 + atomic_long_unchecked_t mesq_send_lb_overflow;
45936 + atomic_long_unchecked_t mesq_send_qlimit_reached;
45937 + atomic_long_unchecked_t mesq_send_amo_nacked;
45938 + atomic_long_unchecked_t mesq_send_put_nacked;
45939 + atomic_long_unchecked_t mesq_page_overflow;
45940 + atomic_long_unchecked_t mesq_qf_locked;
45941 + atomic_long_unchecked_t mesq_qf_noop_not_full;
45942 + atomic_long_unchecked_t mesq_qf_switch_head_failed;
45943 + atomic_long_unchecked_t mesq_qf_unexpected_error;
45944 + atomic_long_unchecked_t mesq_noop_unexpected_error;
45945 + atomic_long_unchecked_t mesq_noop_lb_overflow;
45946 + atomic_long_unchecked_t mesq_noop_qlimit_reached;
45947 + atomic_long_unchecked_t mesq_noop_amo_nacked;
45948 + atomic_long_unchecked_t mesq_noop_put_nacked;
45949 + atomic_long_unchecked_t mesq_noop_page_overflow;
45950
45951 };
45952
45953 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start, cchop_interrupt, cchop_interrupt_sync,
45954 tghop_invalidate, mcsop_last};
45955
45956 struct mcs_op_statistic {
45957 - atomic_long_t count;
45958 - atomic_long_t total;
45959 + atomic_long_unchecked_t count;
45960 + atomic_long_unchecked_t total;
45961 unsigned long max;
45962 };
45963
45964 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_statistics[mcsop_last];
45965
45966 #define STAT(id) do { \
45967 if (gru_options & OPT_STATS) \
45968 - atomic_long_inc(&gru_stats.id); \
45969 + atomic_long_inc_unchecked(&gru_stats.id); \
45970 } while (0)
45971
45972 #ifdef CONFIG_SGI_GRU_DEBUG
45973 diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
45974 index c862cd4..0d176fe 100644
45975 --- a/drivers/misc/sgi-xp/xp.h
45976 +++ b/drivers/misc/sgi-xp/xp.h
45977 @@ -288,7 +288,7 @@ struct xpc_interface {
45978 xpc_notify_func, void *);
45979 void (*received) (short, int, void *);
45980 enum xp_retval (*partid_to_nasids) (short, void *);
45981 -};
45982 +} __no_const;
45983
45984 extern struct xpc_interface xpc_interface;
45985
45986 diff --git a/drivers/misc/sgi-xp/xp_main.c b/drivers/misc/sgi-xp/xp_main.c
45987 index 01be66d..e3a0c7e 100644
45988 --- a/drivers/misc/sgi-xp/xp_main.c
45989 +++ b/drivers/misc/sgi-xp/xp_main.c
45990 @@ -78,13 +78,13 @@ xpc_notloaded(void)
45991 }
45992
45993 struct xpc_interface xpc_interface = {
45994 - (void (*)(int))xpc_notloaded,
45995 - (void (*)(int))xpc_notloaded,
45996 - (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
45997 - (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
45998 + .connect = (void (*)(int))xpc_notloaded,
45999 + .disconnect = (void (*)(int))xpc_notloaded,
46000 + .send = (enum xp_retval(*)(short, int, u32, void *, u16))xpc_notloaded,
46001 + .send_notify = (enum xp_retval(*)(short, int, u32, void *, u16, xpc_notify_func,
46002 void *))xpc_notloaded,
46003 - (void (*)(short, int, void *))xpc_notloaded,
46004 - (enum xp_retval(*)(short, void *))xpc_notloaded
46005 + .received = (void (*)(short, int, void *))xpc_notloaded,
46006 + .partid_to_nasids = (enum xp_retval(*)(short, void *))xpc_notloaded
46007 };
46008 EXPORT_SYMBOL_GPL(xpc_interface);
46009
46010 diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
46011 index b94d5f7..7f494c5 100644
46012 --- a/drivers/misc/sgi-xp/xpc.h
46013 +++ b/drivers/misc/sgi-xp/xpc.h
46014 @@ -835,6 +835,7 @@ struct xpc_arch_operations {
46015 void (*received_payload) (struct xpc_channel *, void *);
46016 void (*notify_senders_of_disconnect) (struct xpc_channel *);
46017 };
46018 +typedef struct xpc_arch_operations __no_const xpc_arch_operations_no_const;
46019
46020 /* struct xpc_partition act_state values (for XPC HB) */
46021
46022 @@ -876,7 +877,7 @@ extern struct xpc_registration xpc_registrations[];
46023 /* found in xpc_main.c */
46024 extern struct device *xpc_part;
46025 extern struct device *xpc_chan;
46026 -extern struct xpc_arch_operations xpc_arch_ops;
46027 +extern xpc_arch_operations_no_const xpc_arch_ops;
46028 extern int xpc_disengage_timelimit;
46029 extern int xpc_disengage_timedout;
46030 extern int xpc_activate_IRQ_rcvd;
46031 diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
46032 index 82dc574..8539ab2 100644
46033 --- a/drivers/misc/sgi-xp/xpc_main.c
46034 +++ b/drivers/misc/sgi-xp/xpc_main.c
46035 @@ -166,7 +166,7 @@ static struct notifier_block xpc_die_notifier = {
46036 .notifier_call = xpc_system_die,
46037 };
46038
46039 -struct xpc_arch_operations xpc_arch_ops;
46040 +xpc_arch_operations_no_const xpc_arch_ops;
46041
46042 /*
46043 * Timer function to enforce the timelimit on the partition disengage.
46044 @@ -1210,7 +1210,7 @@ xpc_system_die(struct notifier_block *nb, unsigned long event, void *_die_args)
46045
46046 if (((die_args->trapnr == X86_TRAP_MF) ||
46047 (die_args->trapnr == X86_TRAP_XF)) &&
46048 - !user_mode_vm(die_args->regs))
46049 + !user_mode(die_args->regs))
46050 xpc_die_deactivate();
46051
46052 break;
46053 diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
46054 index 7b5424f..ed1d6ac 100644
46055 --- a/drivers/mmc/card/block.c
46056 +++ b/drivers/mmc/card/block.c
46057 @@ -575,7 +575,7 @@ static int mmc_blk_ioctl_cmd(struct block_device *bdev,
46058 if (idata->ic.postsleep_min_us)
46059 usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us);
46060
46061 - if (copy_to_user(&(ic_ptr->response), cmd.resp, sizeof(cmd.resp))) {
46062 + if (copy_to_user(ic_ptr->response, cmd.resp, sizeof(cmd.resp))) {
46063 err = -EFAULT;
46064 goto cmd_rel_host;
46065 }
46066 diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
46067 index e5b5eeb..7bf2212 100644
46068 --- a/drivers/mmc/core/mmc_ops.c
46069 +++ b/drivers/mmc/core/mmc_ops.c
46070 @@ -247,7 +247,7 @@ mmc_send_cxd_data(struct mmc_card *card, struct mmc_host *host,
46071 void *data_buf;
46072 int is_on_stack;
46073
46074 - is_on_stack = object_is_on_stack(buf);
46075 + is_on_stack = object_starts_on_stack(buf);
46076 if (is_on_stack) {
46077 /*
46078 * dma onto stack is unsafe/nonportable, but callers to this
46079 diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
46080 index 6bf24ab..13d0293b 100644
46081 --- a/drivers/mmc/host/dw_mmc.h
46082 +++ b/drivers/mmc/host/dw_mmc.h
46083 @@ -258,5 +258,5 @@ struct dw_mci_drv_data {
46084 int (*parse_dt)(struct dw_mci *host);
46085 int (*execute_tuning)(struct dw_mci_slot *slot, u32 opcode,
46086 struct dw_mci_tuning_data *tuning_data);
46087 -};
46088 +} __do_const;
46089 #endif /* _DW_MMC_H_ */
46090 diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
46091 index b931226..df6a085 100644
46092 --- a/drivers/mmc/host/mmci.c
46093 +++ b/drivers/mmc/host/mmci.c
46094 @@ -1504,7 +1504,9 @@ static int mmci_probe(struct amba_device *dev,
46095 }
46096
46097 if (variant->busy_detect) {
46098 - mmci_ops.card_busy = mmci_card_busy;
46099 + pax_open_kernel();
46100 + *(void **)&mmci_ops.card_busy = mmci_card_busy;
46101 + pax_close_kernel();
46102 mmci_write_datactrlreg(host, MCI_ST_DPSM_BUSYMODE);
46103 }
46104
46105 diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
46106 index b841bb7..d82712f5 100644
46107 --- a/drivers/mmc/host/sdhci-esdhc-imx.c
46108 +++ b/drivers/mmc/host/sdhci-esdhc-imx.c
46109 @@ -1031,9 +1031,12 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)
46110 host->mmc->caps |= MMC_CAP_1_8V_DDR;
46111 }
46112
46113 - if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING)
46114 - sdhci_esdhc_ops.platform_execute_tuning =
46115 + if (imx_data->socdata->flags & ESDHC_FLAG_MAN_TUNING) {
46116 + pax_open_kernel();
46117 + *(void **)&sdhci_esdhc_ops.platform_execute_tuning =
46118 esdhc_executing_tuning;
46119 + pax_close_kernel();
46120 + }
46121
46122 if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING)
46123 writel(readl(host->ioaddr + ESDHC_TUNING_CTRL) |
46124 diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
46125 index 6debda9..2ba7427 100644
46126 --- a/drivers/mmc/host/sdhci-s3c.c
46127 +++ b/drivers/mmc/host/sdhci-s3c.c
46128 @@ -668,9 +668,11 @@ static int sdhci_s3c_probe(struct platform_device *pdev)
46129 * we can use overriding functions instead of default.
46130 */
46131 if (host->quirks & SDHCI_QUIRK_NONSTANDARD_CLOCK) {
46132 - sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
46133 - sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
46134 - sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
46135 + pax_open_kernel();
46136 + *(void **)&sdhci_s3c_ops.set_clock = sdhci_cmu_set_clock;
46137 + *(void **)&sdhci_s3c_ops.get_min_clock = sdhci_cmu_get_min_clock;
46138 + *(void **)&sdhci_s3c_ops.get_max_clock = sdhci_cmu_get_max_clock;
46139 + pax_close_kernel();
46140 }
46141
46142 /* It supports additional host capabilities if needed */
46143 diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
46144 index 096993f..f02c23b 100644
46145 --- a/drivers/mtd/chips/cfi_cmdset_0020.c
46146 +++ b/drivers/mtd/chips/cfi_cmdset_0020.c
46147 @@ -669,7 +669,7 @@ cfi_staa_writev(struct mtd_info *mtd, const struct kvec *vecs,
46148 size_t totlen = 0, thislen;
46149 int ret = 0;
46150 size_t buflen = 0;
46151 - static char *buffer;
46152 + char *buffer;
46153
46154 if (!ECCBUF_SIZE) {
46155 /* We should fall back to a general writev implementation.
46156 diff --git a/drivers/mtd/nand/denali.c b/drivers/mtd/nand/denali.c
46157 index c07cd57..61c4fbd 100644
46158 --- a/drivers/mtd/nand/denali.c
46159 +++ b/drivers/mtd/nand/denali.c
46160 @@ -24,6 +24,7 @@
46161 #include <linux/slab.h>
46162 #include <linux/mtd/mtd.h>
46163 #include <linux/module.h>
46164 +#include <linux/slab.h>
46165
46166 #include "denali.h"
46167
46168 diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
46169 index ca6369f..0ce9fed 100644
46170 --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
46171 +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
46172 @@ -369,7 +369,7 @@ void prepare_data_dma(struct gpmi_nand_data *this, enum dma_data_direction dr)
46173
46174 /* first try to map the upper buffer directly */
46175 if (virt_addr_valid(this->upper_buf) &&
46176 - !object_is_on_stack(this->upper_buf)) {
46177 + !object_starts_on_stack(this->upper_buf)) {
46178 sg_init_one(sgl, this->upper_buf, this->upper_len);
46179 ret = dma_map_sg(this->dev, sgl, 1, dr);
46180 if (ret == 0)
46181 diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
46182 index 51b9d6a..52af9a7 100644
46183 --- a/drivers/mtd/nftlmount.c
46184 +++ b/drivers/mtd/nftlmount.c
46185 @@ -24,6 +24,7 @@
46186 #include <asm/errno.h>
46187 #include <linux/delay.h>
46188 #include <linux/slab.h>
46189 +#include <linux/sched.h>
46190 #include <linux/mtd/mtd.h>
46191 #include <linux/mtd/nand.h>
46192 #include <linux/mtd/nftl.h>
46193 diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c
46194 index cf49c22..971b133 100644
46195 --- a/drivers/mtd/sm_ftl.c
46196 +++ b/drivers/mtd/sm_ftl.c
46197 @@ -56,7 +56,7 @@ static ssize_t sm_attr_show(struct device *dev, struct device_attribute *attr,
46198 #define SM_CIS_VENDOR_OFFSET 0x59
46199 static struct attribute_group *sm_create_sysfs_attributes(struct sm_ftl *ftl)
46200 {
46201 - struct attribute_group *attr_group;
46202 + attribute_group_no_const *attr_group;
46203 struct attribute **attributes;
46204 struct sm_sysfs_attribute *vendor_attribute;
46205 char *vendor;
46206 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
46207 index 91ec8cd..562ff5f 100644
46208 --- a/drivers/net/bonding/bond_main.c
46209 +++ b/drivers/net/bonding/bond_main.c
46210 @@ -4552,6 +4552,7 @@ static void __exit bonding_exit(void)
46211
46212 bond_netlink_fini();
46213 unregister_pernet_subsys(&bond_net_ops);
46214 + rtnl_link_unregister(&bond_link_ops);
46215
46216 #ifdef CONFIG_NET_POLL_CONTROLLER
46217 /*
46218 diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
46219 index 70651f8..7eb1bdf 100644
46220 --- a/drivers/net/bonding/bond_netlink.c
46221 +++ b/drivers/net/bonding/bond_netlink.c
46222 @@ -542,7 +542,7 @@ nla_put_failure:
46223 return -EMSGSIZE;
46224 }
46225
46226 -struct rtnl_link_ops bond_link_ops __read_mostly = {
46227 +struct rtnl_link_ops bond_link_ops = {
46228 .kind = "bond",
46229 .priv_size = sizeof(struct bonding),
46230 .setup = bond_setup,
46231 diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig
46232 index 9e7d95d..d447b88 100644
46233 --- a/drivers/net/can/Kconfig
46234 +++ b/drivers/net/can/Kconfig
46235 @@ -104,7 +104,7 @@ config CAN_JANZ_ICAN3
46236
46237 config CAN_FLEXCAN
46238 tristate "Support for Freescale FLEXCAN based chips"
46239 - depends on ARM || PPC
46240 + depends on (ARM && CPU_LITTLE_ENDIAN) || PPC
46241 ---help---
46242 Say Y here if you want to support for Freescale FlexCAN.
46243
46244 diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
46245 index 455d4c3..3353ee7 100644
46246 --- a/drivers/net/ethernet/8390/ax88796.c
46247 +++ b/drivers/net/ethernet/8390/ax88796.c
46248 @@ -889,9 +889,11 @@ static int ax_probe(struct platform_device *pdev)
46249 if (ax->plat->reg_offsets)
46250 ei_local->reg_offset = ax->plat->reg_offsets;
46251 else {
46252 + resource_size_t _mem_size = mem_size;
46253 + do_div(_mem_size, 0x18);
46254 ei_local->reg_offset = ax->reg_offsets;
46255 for (ret = 0; ret < 0x18; ret++)
46256 - ax->reg_offsets[ret] = (mem_size / 0x18) * ret;
46257 + ax->reg_offsets[ret] = _mem_size * ret;
46258 }
46259
46260 if (!request_mem_region(mem->start, mem_size, pdev->name)) {
46261 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
46262 index a89a40f..5a8a2ac 100644
46263 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
46264 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
46265 @@ -1062,7 +1062,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
46266 static inline void bnx2x_init_bp_objs(struct bnx2x *bp)
46267 {
46268 /* RX_MODE controlling object */
46269 - bnx2x_init_rx_mode_obj(bp, &bp->rx_mode_obj);
46270 + bnx2x_init_rx_mode_obj(bp);
46271
46272 /* multicast configuration controlling object */
46273 bnx2x_init_mcast_obj(bp, &bp->mcast_obj, bp->fp->cl_id, bp->fp->cid,
46274 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
46275 index 0fb6ff2..78fd55c 100644
46276 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
46277 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
46278 @@ -2329,15 +2329,14 @@ int bnx2x_config_rx_mode(struct bnx2x *bp,
46279 return rc;
46280 }
46281
46282 -void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
46283 - struct bnx2x_rx_mode_obj *o)
46284 +void bnx2x_init_rx_mode_obj(struct bnx2x *bp)
46285 {
46286 if (CHIP_IS_E1x(bp)) {
46287 - o->wait_comp = bnx2x_empty_rx_mode_wait;
46288 - o->config_rx_mode = bnx2x_set_rx_mode_e1x;
46289 + bp->rx_mode_obj.wait_comp = bnx2x_empty_rx_mode_wait;
46290 + bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e1x;
46291 } else {
46292 - o->wait_comp = bnx2x_wait_rx_mode_comp_e2;
46293 - o->config_rx_mode = bnx2x_set_rx_mode_e2;
46294 + bp->rx_mode_obj.wait_comp = bnx2x_wait_rx_mode_comp_e2;
46295 + bp->rx_mode_obj.config_rx_mode = bnx2x_set_rx_mode_e2;
46296 }
46297 }
46298
46299 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
46300 index 00d7f21..2cddec4 100644
46301 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
46302 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
46303 @@ -1321,8 +1321,7 @@ int bnx2x_vlan_mac_move(struct bnx2x *bp,
46304
46305 /********************* RX MODE ****************/
46306
46307 -void bnx2x_init_rx_mode_obj(struct bnx2x *bp,
46308 - struct bnx2x_rx_mode_obj *o);
46309 +void bnx2x_init_rx_mode_obj(struct bnx2x *bp);
46310
46311 /**
46312 * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
46313 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
46314 index 04321e5..b51cdc4 100644
46315 --- a/drivers/net/ethernet/broadcom/tg3.h
46316 +++ b/drivers/net/ethernet/broadcom/tg3.h
46317 @@ -150,6 +150,7 @@
46318 #define CHIPREV_ID_5750_A0 0x4000
46319 #define CHIPREV_ID_5750_A1 0x4001
46320 #define CHIPREV_ID_5750_A3 0x4003
46321 +#define CHIPREV_ID_5750_C1 0x4201
46322 #define CHIPREV_ID_5750_C2 0x4202
46323 #define CHIPREV_ID_5752_A0_HW 0x5000
46324 #define CHIPREV_ID_5752_A0 0x6000
46325 diff --git a/drivers/net/ethernet/brocade/bna/bna_enet.c b/drivers/net/ethernet/brocade/bna/bna_enet.c
46326 index 13f9636..228040f 100644
46327 --- a/drivers/net/ethernet/brocade/bna/bna_enet.c
46328 +++ b/drivers/net/ethernet/brocade/bna/bna_enet.c
46329 @@ -1690,10 +1690,10 @@ bna_cb_ioceth_reset(void *arg)
46330 }
46331
46332 static struct bfa_ioc_cbfn bna_ioceth_cbfn = {
46333 - bna_cb_ioceth_enable,
46334 - bna_cb_ioceth_disable,
46335 - bna_cb_ioceth_hbfail,
46336 - bna_cb_ioceth_reset
46337 + .enable_cbfn = bna_cb_ioceth_enable,
46338 + .disable_cbfn = bna_cb_ioceth_disable,
46339 + .hbfail_cbfn = bna_cb_ioceth_hbfail,
46340 + .reset_cbfn = bna_cb_ioceth_reset
46341 };
46342
46343 static void bna_attr_init(struct bna_ioceth *ioceth)
46344 diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
46345 index 8cffcdf..aadf043 100644
46346 --- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h
46347 +++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
46348 @@ -87,7 +87,7 @@ typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
46349 */
46350 struct l2t_skb_cb {
46351 arp_failure_handler_func arp_failure_handler;
46352 -};
46353 +} __no_const;
46354
46355 #define L2T_SKB_CB(skb) ((struct l2t_skb_cb *)(skb)->cb)
46356
46357 diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
46358 index 34e2488..07e2079 100644
46359 --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
46360 +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
46361 @@ -2120,7 +2120,7 @@ static void get_regs(struct net_device *dev, struct ethtool_regs *regs,
46362
46363 int i;
46364 struct adapter *ap = netdev2adap(dev);
46365 - static const unsigned int *reg_ranges;
46366 + const unsigned int *reg_ranges;
46367 int arr_size = 0, buf_size = 0;
46368
46369 if (is_t4(ap->params.chip)) {
46370 diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c
46371 index c05b66d..ed69872 100644
46372 --- a/drivers/net/ethernet/dec/tulip/de4x5.c
46373 +++ b/drivers/net/ethernet/dec/tulip/de4x5.c
46374 @@ -5388,7 +5388,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
46375 for (i=0; i<ETH_ALEN; i++) {
46376 tmp.addr[i] = dev->dev_addr[i];
46377 }
46378 - if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
46379 + if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
46380 break;
46381
46382 case DE4X5_SET_HWADDR: /* Set the hardware address */
46383 @@ -5428,7 +5428,7 @@ de4x5_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
46384 spin_lock_irqsave(&lp->lock, flags);
46385 memcpy(&statbuf, &lp->pktStats, ioc->len);
46386 spin_unlock_irqrestore(&lp->lock, flags);
46387 - if (copy_to_user(ioc->data, &statbuf, ioc->len))
46388 + if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
46389 return -EFAULT;
46390 break;
46391 }
46392 diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
46393 index 36c8061..ca5e1e0 100644
46394 --- a/drivers/net/ethernet/emulex/benet/be_main.c
46395 +++ b/drivers/net/ethernet/emulex/benet/be_main.c
46396 @@ -534,7 +534,7 @@ static void accumulate_16bit_val(u32 *acc, u16 val)
46397
46398 if (wrapped)
46399 newacc += 65536;
46400 - ACCESS_ONCE(*acc) = newacc;
46401 + ACCESS_ONCE_RW(*acc) = newacc;
46402 }
46403
46404 static void populate_erx_stats(struct be_adapter *adapter,
46405 diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
46406 index c11ecbc..13bb299 100644
46407 --- a/drivers/net/ethernet/faraday/ftgmac100.c
46408 +++ b/drivers/net/ethernet/faraday/ftgmac100.c
46409 @@ -30,6 +30,8 @@
46410 #include <linux/netdevice.h>
46411 #include <linux/phy.h>
46412 #include <linux/platform_device.h>
46413 +#include <linux/interrupt.h>
46414 +#include <linux/irqreturn.h>
46415 #include <net/ip.h>
46416
46417 #include "ftgmac100.h"
46418 diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
46419 index 8be5b40..081bc1b 100644
46420 --- a/drivers/net/ethernet/faraday/ftmac100.c
46421 +++ b/drivers/net/ethernet/faraday/ftmac100.c
46422 @@ -31,6 +31,8 @@
46423 #include <linux/module.h>
46424 #include <linux/netdevice.h>
46425 #include <linux/platform_device.h>
46426 +#include <linux/interrupt.h>
46427 +#include <linux/irqreturn.h>
46428
46429 #include "ftmac100.h"
46430
46431 diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
46432 index e33ec6c..f54cfe7 100644
46433 --- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c
46434 +++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c
46435 @@ -436,7 +436,7 @@ void i40e_ptp_set_increment(struct i40e_pf *pf)
46436 wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32);
46437
46438 /* Update the base adjustement value. */
46439 - ACCESS_ONCE(pf->ptp_base_adj) = incval;
46440 + ACCESS_ONCE_RW(pf->ptp_base_adj) = incval;
46441 smp_mb(); /* Force the above update. */
46442 }
46443
46444 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
46445 index 5184e2a..acb28c3 100644
46446 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
46447 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
46448 @@ -776,7 +776,7 @@ void ixgbe_ptp_start_cyclecounter(struct ixgbe_adapter *adapter)
46449 }
46450
46451 /* update the base incval used to calculate frequency adjustment */
46452 - ACCESS_ONCE(adapter->base_incval) = incval;
46453 + ACCESS_ONCE_RW(adapter->base_incval) = incval;
46454 smp_mb();
46455
46456 /* need lock to prevent incorrect read while modifying cyclecounter */
46457 diff --git a/drivers/net/ethernet/neterion/vxge/vxge-config.c b/drivers/net/ethernet/neterion/vxge/vxge-config.c
46458 index 089b713..28d87ae 100644
46459 --- a/drivers/net/ethernet/neterion/vxge/vxge-config.c
46460 +++ b/drivers/net/ethernet/neterion/vxge/vxge-config.c
46461 @@ -3461,7 +3461,10 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
46462 struct __vxge_hw_fifo *fifo;
46463 struct vxge_hw_fifo_config *config;
46464 u32 txdl_size, txdl_per_memblock;
46465 - struct vxge_hw_mempool_cbs fifo_mp_callback;
46466 + static struct vxge_hw_mempool_cbs fifo_mp_callback = {
46467 + .item_func_alloc = __vxge_hw_fifo_mempool_item_alloc,
46468 + };
46469 +
46470 struct __vxge_hw_virtualpath *vpath;
46471
46472 if ((vp == NULL) || (attr == NULL)) {
46473 @@ -3544,8 +3547,6 @@ __vxge_hw_fifo_create(struct __vxge_hw_vpath_handle *vp,
46474 goto exit;
46475 }
46476
46477 - fifo_mp_callback.item_func_alloc = __vxge_hw_fifo_mempool_item_alloc;
46478 -
46479 fifo->mempool =
46480 __vxge_hw_mempool_create(vpath->hldev,
46481 fifo->config->memblock_size,
46482 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
46483 index 90a2dda..47e620e 100644
46484 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
46485 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
46486 @@ -2088,7 +2088,9 @@ int qlcnic_83xx_configure_opmode(struct qlcnic_adapter *adapter)
46487 adapter->max_tx_rings = QLCNIC_MAX_VNIC_TX_RINGS;
46488 } else if (ret == QLC_83XX_DEFAULT_OPMODE) {
46489 ahw->nic_mode = QLCNIC_DEFAULT_MODE;
46490 - adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
46491 + pax_open_kernel();
46492 + *(void **)&adapter->nic_ops->init_driver = qlcnic_83xx_init_default_driver;
46493 + pax_close_kernel();
46494 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
46495 adapter->max_sds_rings = QLCNIC_MAX_SDS_RINGS;
46496 adapter->max_tx_rings = QLCNIC_MAX_TX_RINGS;
46497 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
46498 index be7d7a6..a8983f8 100644
46499 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
46500 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
46501 @@ -207,17 +207,23 @@ int qlcnic_83xx_config_vnic_opmode(struct qlcnic_adapter *adapter)
46502 case QLCNIC_NON_PRIV_FUNC:
46503 ahw->op_mode = QLCNIC_NON_PRIV_FUNC;
46504 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
46505 - nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
46506 + pax_open_kernel();
46507 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_non_privileged_vnic;
46508 + pax_close_kernel();
46509 break;
46510 case QLCNIC_PRIV_FUNC:
46511 ahw->op_mode = QLCNIC_PRIV_FUNC;
46512 ahw->idc.state_entry = qlcnic_83xx_idc_vnic_pf_entry;
46513 - nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
46514 + pax_open_kernel();
46515 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_privileged_vnic;
46516 + pax_close_kernel();
46517 break;
46518 case QLCNIC_MGMT_FUNC:
46519 ahw->op_mode = QLCNIC_MGMT_FUNC;
46520 ahw->idc.state_entry = qlcnic_83xx_idc_ready_state_entry;
46521 - nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
46522 + pax_open_kernel();
46523 + *(void **)&nic_ops->init_driver = qlcnic_83xx_init_mgmt_vnic;
46524 + pax_close_kernel();
46525 break;
46526 default:
46527 dev_err(&adapter->pdev->dev, "Invalid Virtual NIC opmode\n");
46528 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
46529 index 7d4f549..3e46c89 100644
46530 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
46531 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c
46532 @@ -1022,6 +1022,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev,
46533 struct qlcnic_dcb_cee *peer;
46534 int i;
46535
46536 + memset(info, 0, sizeof(*info));
46537 *app_count = 0;
46538
46539 if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state))
46540 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
46541 index 7763962..c3499a7 100644
46542 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
46543 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
46544 @@ -1108,7 +1108,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
46545 struct qlcnic_dump_entry *entry;
46546 struct qlcnic_fw_dump *fw_dump = &adapter->ahw->fw_dump;
46547 struct qlcnic_dump_template_hdr *tmpl_hdr = fw_dump->tmpl_hdr;
46548 - static const struct qlcnic_dump_operations *fw_dump_ops;
46549 + const struct qlcnic_dump_operations *fw_dump_ops;
46550 struct device *dev = &adapter->pdev->dev;
46551 struct qlcnic_hardware_context *ahw;
46552 void *temp_buffer;
46553 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
46554 index 3ff7bc3..366091b 100644
46555 --- a/drivers/net/ethernet/realtek/r8169.c
46556 +++ b/drivers/net/ethernet/realtek/r8169.c
46557 @@ -758,22 +758,22 @@ struct rtl8169_private {
46558 struct mdio_ops {
46559 void (*write)(struct rtl8169_private *, int, int);
46560 int (*read)(struct rtl8169_private *, int);
46561 - } mdio_ops;
46562 + } __no_const mdio_ops;
46563
46564 struct pll_power_ops {
46565 void (*down)(struct rtl8169_private *);
46566 void (*up)(struct rtl8169_private *);
46567 - } pll_power_ops;
46568 + } __no_const pll_power_ops;
46569
46570 struct jumbo_ops {
46571 void (*enable)(struct rtl8169_private *);
46572 void (*disable)(struct rtl8169_private *);
46573 - } jumbo_ops;
46574 + } __no_const jumbo_ops;
46575
46576 struct csi_ops {
46577 void (*write)(struct rtl8169_private *, int, int);
46578 u32 (*read)(struct rtl8169_private *, int);
46579 - } csi_ops;
46580 + } __no_const csi_ops;
46581
46582 int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
46583 int (*get_settings)(struct net_device *, struct ethtool_cmd *);
46584 diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
46585 index d7a3682..9ce272a 100644
46586 --- a/drivers/net/ethernet/sfc/ptp.c
46587 +++ b/drivers/net/ethernet/sfc/ptp.c
46588 @@ -825,7 +825,7 @@ static int efx_ptp_synchronize(struct efx_nic *efx, unsigned int num_readings)
46589 ptp->start.dma_addr);
46590
46591 /* Clear flag that signals MC ready */
46592 - ACCESS_ONCE(*start) = 0;
46593 + ACCESS_ONCE_RW(*start) = 0;
46594 rc = efx_mcdi_rpc_start(efx, MC_CMD_PTP, synch_buf,
46595 MC_CMD_PTP_IN_SYNCHRONIZE_LEN);
46596 EFX_BUG_ON_PARANOID(rc);
46597 diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
46598 index 50617c5..b13724c 100644
46599 --- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
46600 +++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
46601 @@ -140,8 +140,8 @@ void dwmac_mmc_ctrl(void __iomem *ioaddr, unsigned int mode)
46602
46603 writel(value, ioaddr + MMC_CNTRL);
46604
46605 - pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
46606 - MMC_CNTRL, value);
46607 +// pr_debug("stmmac: MMC ctrl register (offset 0x%x): 0x%08x\n",
46608 +// MMC_CNTRL, value);
46609 }
46610
46611 /* To mask all all interrupts.*/
46612 diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
46613 index 7b594ce..1f6c5708 100644
46614 --- a/drivers/net/hyperv/hyperv_net.h
46615 +++ b/drivers/net/hyperv/hyperv_net.h
46616 @@ -100,7 +100,7 @@ struct rndis_device {
46617
46618 enum rndis_device_state state;
46619 bool link_state;
46620 - atomic_t new_req_id;
46621 + atomic_unchecked_t new_req_id;
46622
46623 spinlock_t request_lock;
46624 struct list_head req_list;
46625 diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c
46626 index b54fd25..9bd2bae 100644
46627 --- a/drivers/net/hyperv/rndis_filter.c
46628 +++ b/drivers/net/hyperv/rndis_filter.c
46629 @@ -103,7 +103,7 @@ static struct rndis_request *get_rndis_request(struct rndis_device *dev,
46630 * template
46631 */
46632 set = &rndis_msg->msg.set_req;
46633 - set->req_id = atomic_inc_return(&dev->new_req_id);
46634 + set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
46635
46636 /* Add to the request list */
46637 spin_lock_irqsave(&dev->request_lock, flags);
46638 @@ -770,7 +770,7 @@ static void rndis_filter_halt_device(struct rndis_device *dev)
46639
46640 /* Setup the rndis set */
46641 halt = &request->request_msg.msg.halt_req;
46642 - halt->req_id = atomic_inc_return(&dev->new_req_id);
46643 + halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
46644
46645 /* Ignore return since this msg is optional. */
46646 rndis_filter_send_request(dev, request);
46647 diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
46648 index bf0d55e..82bcfbd1 100644
46649 --- a/drivers/net/ieee802154/fakehard.c
46650 +++ b/drivers/net/ieee802154/fakehard.c
46651 @@ -364,7 +364,7 @@ static int ieee802154fake_probe(struct platform_device *pdev)
46652 phy->transmit_power = 0xbf;
46653
46654 dev->netdev_ops = &fake_ops;
46655 - dev->ml_priv = &fake_mlme;
46656 + dev->ml_priv = (void *)&fake_mlme;
46657
46658 priv = netdev_priv(dev);
46659 priv->phy = phy;
46660 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
46661 index 20bb669..9a0e17e 100644
46662 --- a/drivers/net/macvlan.c
46663 +++ b/drivers/net/macvlan.c
46664 @@ -991,13 +991,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
46665 int macvlan_link_register(struct rtnl_link_ops *ops)
46666 {
46667 /* common fields */
46668 - ops->priv_size = sizeof(struct macvlan_dev);
46669 - ops->validate = macvlan_validate;
46670 - ops->maxtype = IFLA_MACVLAN_MAX;
46671 - ops->policy = macvlan_policy;
46672 - ops->changelink = macvlan_changelink;
46673 - ops->get_size = macvlan_get_size;
46674 - ops->fill_info = macvlan_fill_info;
46675 + pax_open_kernel();
46676 + *(size_t *)&ops->priv_size = sizeof(struct macvlan_dev);
46677 + *(void **)&ops->validate = macvlan_validate;
46678 + *(int *)&ops->maxtype = IFLA_MACVLAN_MAX;
46679 + *(const void **)&ops->policy = macvlan_policy;
46680 + *(void **)&ops->changelink = macvlan_changelink;
46681 + *(void **)&ops->get_size = macvlan_get_size;
46682 + *(void **)&ops->fill_info = macvlan_fill_info;
46683 + pax_close_kernel();
46684
46685 return rtnl_link_register(ops);
46686 };
46687 @@ -1052,7 +1054,7 @@ static int macvlan_device_event(struct notifier_block *unused,
46688 return NOTIFY_DONE;
46689 }
46690
46691 -static struct notifier_block macvlan_notifier_block __read_mostly = {
46692 +static struct notifier_block macvlan_notifier_block = {
46693 .notifier_call = macvlan_device_event,
46694 };
46695
46696 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
46697 index 3381c4f..dea5fd5 100644
46698 --- a/drivers/net/macvtap.c
46699 +++ b/drivers/net/macvtap.c
46700 @@ -1020,7 +1020,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
46701 }
46702
46703 ret = 0;
46704 - if (copy_to_user(&ifr->ifr_name, vlan->dev->name, IFNAMSIZ) ||
46705 + if (copy_to_user(ifr->ifr_name, vlan->dev->name, IFNAMSIZ) ||
46706 put_user(q->flags, &ifr->ifr_flags))
46707 ret = -EFAULT;
46708 macvtap_put_vlan(vlan);
46709 @@ -1190,7 +1190,7 @@ static int macvtap_device_event(struct notifier_block *unused,
46710 return NOTIFY_DONE;
46711 }
46712
46713 -static struct notifier_block macvtap_notifier_block __read_mostly = {
46714 +static struct notifier_block macvtap_notifier_block = {
46715 .notifier_call = macvtap_device_event,
46716 };
46717
46718 diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
46719 index daec9b0..6428fcb 100644
46720 --- a/drivers/net/phy/mdio-bitbang.c
46721 +++ b/drivers/net/phy/mdio-bitbang.c
46722 @@ -234,6 +234,7 @@ void free_mdio_bitbang(struct mii_bus *bus)
46723 struct mdiobb_ctrl *ctrl = bus->priv;
46724
46725 module_put(ctrl->ops->owner);
46726 + mdiobus_unregister(bus);
46727 mdiobus_free(bus);
46728 }
46729 EXPORT_SYMBOL(free_mdio_bitbang);
46730 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
46731 index 72ff14b..11d442d 100644
46732 --- a/drivers/net/ppp/ppp_generic.c
46733 +++ b/drivers/net/ppp/ppp_generic.c
46734 @@ -999,7 +999,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
46735 void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
46736 struct ppp_stats stats;
46737 struct ppp_comp_stats cstats;
46738 - char *vers;
46739
46740 switch (cmd) {
46741 case SIOCGPPPSTATS:
46742 @@ -1021,8 +1020,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
46743 break;
46744
46745 case SIOCGPPPVER:
46746 - vers = PPP_VERSION;
46747 - if (copy_to_user(addr, vers, strlen(vers) + 1))
46748 + if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
46749 break;
46750 err = 0;
46751 break;
46752 diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
46753 index 1252d9c..80e660b 100644
46754 --- a/drivers/net/slip/slhc.c
46755 +++ b/drivers/net/slip/slhc.c
46756 @@ -488,7 +488,7 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize)
46757 register struct tcphdr *thp;
46758 register struct iphdr *ip;
46759 register struct cstate *cs;
46760 - int len, hdrlen;
46761 + long len, hdrlen;
46762 unsigned char *cp = icp;
46763
46764 /* We've got a compressed packet; read the change byte */
46765 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
46766 index c8624a8..f0a4f6a 100644
46767 --- a/drivers/net/team/team.c
46768 +++ b/drivers/net/team/team.c
46769 @@ -2869,7 +2869,7 @@ static int team_device_event(struct notifier_block *unused,
46770 return NOTIFY_DONE;
46771 }
46772
46773 -static struct notifier_block team_notifier_block __read_mostly = {
46774 +static struct notifier_block team_notifier_block = {
46775 .notifier_call = team_device_event,
46776 };
46777
46778 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
46779 index 26f8635..c237839 100644
46780 --- a/drivers/net/tun.c
46781 +++ b/drivers/net/tun.c
46782 @@ -1876,7 +1876,7 @@ unlock:
46783 }
46784
46785 static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
46786 - unsigned long arg, int ifreq_len)
46787 + unsigned long arg, size_t ifreq_len)
46788 {
46789 struct tun_file *tfile = file->private_data;
46790 struct tun_struct *tun;
46791 @@ -1889,6 +1889,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
46792 unsigned int ifindex;
46793 int ret;
46794
46795 + if (ifreq_len > sizeof ifr)
46796 + return -EFAULT;
46797 +
46798 if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
46799 if (copy_from_user(&ifr, argp, ifreq_len))
46800 return -EFAULT;
46801 diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
46802 index 660bd5e..ac59452 100644
46803 --- a/drivers/net/usb/hso.c
46804 +++ b/drivers/net/usb/hso.c
46805 @@ -71,7 +71,7 @@
46806 #include <asm/byteorder.h>
46807 #include <linux/serial_core.h>
46808 #include <linux/serial.h>
46809 -
46810 +#include <asm/local.h>
46811
46812 #define MOD_AUTHOR "Option Wireless"
46813 #define MOD_DESCRIPTION "USB High Speed Option driver"
46814 @@ -1179,7 +1179,7 @@ static void put_rxbuf_data_and_resubmit_ctrl_urb(struct hso_serial *serial)
46815 struct urb *urb;
46816
46817 urb = serial->rx_urb[0];
46818 - if (serial->port.count > 0) {
46819 + if (atomic_read(&serial->port.count) > 0) {
46820 count = put_rxbuf_data(urb, serial);
46821 if (count == -1)
46822 return;
46823 @@ -1217,7 +1217,7 @@ static void hso_std_serial_read_bulk_callback(struct urb *urb)
46824 DUMP1(urb->transfer_buffer, urb->actual_length);
46825
46826 /* Anyone listening? */
46827 - if (serial->port.count == 0)
46828 + if (atomic_read(&serial->port.count) == 0)
46829 return;
46830
46831 if (serial->parent->port_spec & HSO_INFO_CRC_BUG)
46832 @@ -1287,8 +1287,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
46833 tty_port_tty_set(&serial->port, tty);
46834
46835 /* check for port already opened, if not set the termios */
46836 - serial->port.count++;
46837 - if (serial->port.count == 1) {
46838 + if (atomic_inc_return(&serial->port.count) == 1) {
46839 serial->rx_state = RX_IDLE;
46840 /* Force default termio settings */
46841 _hso_serial_set_termios(tty, NULL);
46842 @@ -1300,7 +1299,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
46843 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
46844 if (result) {
46845 hso_stop_serial_device(serial->parent);
46846 - serial->port.count--;
46847 + atomic_dec(&serial->port.count);
46848 kref_put(&serial->parent->ref, hso_serial_ref_free);
46849 }
46850 } else {
46851 @@ -1337,10 +1336,10 @@ static void hso_serial_close(struct tty_struct *tty, struct file *filp)
46852
46853 /* reset the rts and dtr */
46854 /* do the actual close */
46855 - serial->port.count--;
46856 + atomic_dec(&serial->port.count);
46857
46858 - if (serial->port.count <= 0) {
46859 - serial->port.count = 0;
46860 + if (atomic_read(&serial->port.count) <= 0) {
46861 + atomic_set(&serial->port.count, 0);
46862 tty_port_tty_set(&serial->port, NULL);
46863 if (!usb_gone)
46864 hso_stop_serial_device(serial->parent);
46865 @@ -1416,7 +1415,7 @@ static void hso_serial_set_termios(struct tty_struct *tty, struct ktermios *old)
46866
46867 /* the actual setup */
46868 spin_lock_irqsave(&serial->serial_lock, flags);
46869 - if (serial->port.count)
46870 + if (atomic_read(&serial->port.count))
46871 _hso_serial_set_termios(tty, old);
46872 else
46873 tty->termios = *old;
46874 @@ -1885,7 +1884,7 @@ static void intr_callback(struct urb *urb)
46875 D1("Pending read interrupt on port %d\n", i);
46876 spin_lock(&serial->serial_lock);
46877 if (serial->rx_state == RX_IDLE &&
46878 - serial->port.count > 0) {
46879 + atomic_read(&serial->port.count) > 0) {
46880 /* Setup and send a ctrl req read on
46881 * port i */
46882 if (!serial->rx_urb_filled[0]) {
46883 @@ -3061,7 +3060,7 @@ static int hso_resume(struct usb_interface *iface)
46884 /* Start all serial ports */
46885 for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
46886 if (serial_table[i] && (serial_table[i]->interface == iface)) {
46887 - if (dev2ser(serial_table[i])->port.count) {
46888 + if (atomic_read(&dev2ser(serial_table[i])->port.count)) {
46889 result =
46890 hso_start_serial_device(serial_table[i], GFP_NOIO);
46891 hso_kick_transmit(dev2ser(serial_table[i]));
46892 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
46893 index adb12f3..48005ab 100644
46894 --- a/drivers/net/usb/r8152.c
46895 +++ b/drivers/net/usb/r8152.c
46896 @@ -513,7 +513,7 @@ struct r8152 {
46897 void (*disable)(struct r8152 *);
46898 void (*down)(struct r8152 *);
46899 void (*unload)(struct r8152 *);
46900 - } rtl_ops;
46901 + } __no_const rtl_ops;
46902
46903 int intr_interval;
46904 u32 msg_enable;
46905 diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
46906 index a2515887..6d13233 100644
46907 --- a/drivers/net/usb/sierra_net.c
46908 +++ b/drivers/net/usb/sierra_net.c
46909 @@ -51,7 +51,7 @@ static const char driver_name[] = "sierra_net";
46910 /* atomic counter partially included in MAC address to make sure 2 devices
46911 * do not end up with the same MAC - concept breaks in case of > 255 ifaces
46912 */
46913 -static atomic_t iface_counter = ATOMIC_INIT(0);
46914 +static atomic_unchecked_t iface_counter = ATOMIC_INIT(0);
46915
46916 /*
46917 * SYNC Timer Delay definition used to set the expiry time
46918 @@ -697,7 +697,7 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
46919 dev->net->netdev_ops = &sierra_net_device_ops;
46920
46921 /* change MAC addr to include, ifacenum, and to be unique */
46922 - dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
46923 + dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return_unchecked(&iface_counter);
46924 dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
46925
46926 /* we will have to manufacture ethernet headers, prepare template */
46927 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
46928 index d091e52..568bb179 100644
46929 --- a/drivers/net/vxlan.c
46930 +++ b/drivers/net/vxlan.c
46931 @@ -2847,7 +2847,7 @@ nla_put_failure:
46932 return -EMSGSIZE;
46933 }
46934
46935 -static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
46936 +static struct rtnl_link_ops vxlan_link_ops = {
46937 .kind = "vxlan",
46938 .maxtype = IFLA_VXLAN_MAX,
46939 .policy = vxlan_policy,
46940 @@ -2894,7 +2894,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
46941 return NOTIFY_DONE;
46942 }
46943
46944 -static struct notifier_block vxlan_notifier_block __read_mostly = {
46945 +static struct notifier_block vxlan_notifier_block = {
46946 .notifier_call = vxlan_lowerdev_event,
46947 };
46948
46949 diff --git a/drivers/net/wan/lmc/lmc_media.c b/drivers/net/wan/lmc/lmc_media.c
46950 index 5920c99..ff2e4a5 100644
46951 --- a/drivers/net/wan/lmc/lmc_media.c
46952 +++ b/drivers/net/wan/lmc/lmc_media.c
46953 @@ -95,62 +95,63 @@ static inline void write_av9110_bit (lmc_softc_t *, int);
46954 static void write_av9110(lmc_softc_t *, u32, u32, u32, u32, u32);
46955
46956 lmc_media_t lmc_ds3_media = {
46957 - lmc_ds3_init, /* special media init stuff */
46958 - lmc_ds3_default, /* reset to default state */
46959 - lmc_ds3_set_status, /* reset status to state provided */
46960 - lmc_dummy_set_1, /* set clock source */
46961 - lmc_dummy_set2_1, /* set line speed */
46962 - lmc_ds3_set_100ft, /* set cable length */
46963 - lmc_ds3_set_scram, /* set scrambler */
46964 - lmc_ds3_get_link_status, /* get link status */
46965 - lmc_dummy_set_1, /* set link status */
46966 - lmc_ds3_set_crc_length, /* set CRC length */
46967 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
46968 - lmc_ds3_watchdog
46969 + .init = lmc_ds3_init, /* special media init stuff */
46970 + .defaults = lmc_ds3_default, /* reset to default state */
46971 + .set_status = lmc_ds3_set_status, /* reset status to state provided */
46972 + .set_clock_source = lmc_dummy_set_1, /* set clock source */
46973 + .set_speed = lmc_dummy_set2_1, /* set line speed */
46974 + .set_cable_length = lmc_ds3_set_100ft, /* set cable length */
46975 + .set_scrambler = lmc_ds3_set_scram, /* set scrambler */
46976 + .get_link_status = lmc_ds3_get_link_status, /* get link status */
46977 + .set_link_status = lmc_dummy_set_1, /* set link status */
46978 + .set_crc_length = lmc_ds3_set_crc_length, /* set CRC length */
46979 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
46980 + .watchdog = lmc_ds3_watchdog
46981 };
46982
46983 lmc_media_t lmc_hssi_media = {
46984 - lmc_hssi_init, /* special media init stuff */
46985 - lmc_hssi_default, /* reset to default state */
46986 - lmc_hssi_set_status, /* reset status to state provided */
46987 - lmc_hssi_set_clock, /* set clock source */
46988 - lmc_dummy_set2_1, /* set line speed */
46989 - lmc_dummy_set_1, /* set cable length */
46990 - lmc_dummy_set_1, /* set scrambler */
46991 - lmc_hssi_get_link_status, /* get link status */
46992 - lmc_hssi_set_link_status, /* set link status */
46993 - lmc_hssi_set_crc_length, /* set CRC length */
46994 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
46995 - lmc_hssi_watchdog
46996 + .init = lmc_hssi_init, /* special media init stuff */
46997 + .defaults = lmc_hssi_default, /* reset to default state */
46998 + .set_status = lmc_hssi_set_status, /* reset status to state provided */
46999 + .set_clock_source = lmc_hssi_set_clock, /* set clock source */
47000 + .set_speed = lmc_dummy_set2_1, /* set line speed */
47001 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
47002 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
47003 + .get_link_status = lmc_hssi_get_link_status, /* get link status */
47004 + .set_link_status = lmc_hssi_set_link_status, /* set link status */
47005 + .set_crc_length = lmc_hssi_set_crc_length, /* set CRC length */
47006 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
47007 + .watchdog = lmc_hssi_watchdog
47008 };
47009
47010 -lmc_media_t lmc_ssi_media = { lmc_ssi_init, /* special media init stuff */
47011 - lmc_ssi_default, /* reset to default state */
47012 - lmc_ssi_set_status, /* reset status to state provided */
47013 - lmc_ssi_set_clock, /* set clock source */
47014 - lmc_ssi_set_speed, /* set line speed */
47015 - lmc_dummy_set_1, /* set cable length */
47016 - lmc_dummy_set_1, /* set scrambler */
47017 - lmc_ssi_get_link_status, /* get link status */
47018 - lmc_ssi_set_link_status, /* set link status */
47019 - lmc_ssi_set_crc_length, /* set CRC length */
47020 - lmc_dummy_set_1, /* set T1 or E1 circuit type */
47021 - lmc_ssi_watchdog
47022 +lmc_media_t lmc_ssi_media = {
47023 + .init = lmc_ssi_init, /* special media init stuff */
47024 + .defaults = lmc_ssi_default, /* reset to default state */
47025 + .set_status = lmc_ssi_set_status, /* reset status to state provided */
47026 + .set_clock_source = lmc_ssi_set_clock, /* set clock source */
47027 + .set_speed = lmc_ssi_set_speed, /* set line speed */
47028 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
47029 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
47030 + .get_link_status = lmc_ssi_get_link_status, /* get link status */
47031 + .set_link_status = lmc_ssi_set_link_status, /* set link status */
47032 + .set_crc_length = lmc_ssi_set_crc_length, /* set CRC length */
47033 + .set_circuit_type = lmc_dummy_set_1, /* set T1 or E1 circuit type */
47034 + .watchdog = lmc_ssi_watchdog
47035 };
47036
47037 lmc_media_t lmc_t1_media = {
47038 - lmc_t1_init, /* special media init stuff */
47039 - lmc_t1_default, /* reset to default state */
47040 - lmc_t1_set_status, /* reset status to state provided */
47041 - lmc_t1_set_clock, /* set clock source */
47042 - lmc_dummy_set2_1, /* set line speed */
47043 - lmc_dummy_set_1, /* set cable length */
47044 - lmc_dummy_set_1, /* set scrambler */
47045 - lmc_t1_get_link_status, /* get link status */
47046 - lmc_dummy_set_1, /* set link status */
47047 - lmc_t1_set_crc_length, /* set CRC length */
47048 - lmc_t1_set_circuit_type, /* set T1 or E1 circuit type */
47049 - lmc_t1_watchdog
47050 + .init = lmc_t1_init, /* special media init stuff */
47051 + .defaults = lmc_t1_default, /* reset to default state */
47052 + .set_status = lmc_t1_set_status, /* reset status to state provided */
47053 + .set_clock_source = lmc_t1_set_clock, /* set clock source */
47054 + .set_speed = lmc_dummy_set2_1, /* set line speed */
47055 + .set_cable_length = lmc_dummy_set_1, /* set cable length */
47056 + .set_scrambler = lmc_dummy_set_1, /* set scrambler */
47057 + .get_link_status = lmc_t1_get_link_status, /* get link status */
47058 + .set_link_status = lmc_dummy_set_1, /* set link status */
47059 + .set_crc_length = lmc_t1_set_crc_length, /* set CRC length */
47060 + .set_circuit_type = lmc_t1_set_circuit_type, /* set T1 or E1 circuit type */
47061 + .watchdog = lmc_t1_watchdog
47062 };
47063
47064 static void
47065 diff --git a/drivers/net/wan/z85230.c b/drivers/net/wan/z85230.c
47066 index feacc3b..5bac0de 100644
47067 --- a/drivers/net/wan/z85230.c
47068 +++ b/drivers/net/wan/z85230.c
47069 @@ -485,9 +485,9 @@ static void z8530_status(struct z8530_channel *chan)
47070
47071 struct z8530_irqhandler z8530_sync =
47072 {
47073 - z8530_rx,
47074 - z8530_tx,
47075 - z8530_status
47076 + .rx = z8530_rx,
47077 + .tx = z8530_tx,
47078 + .status = z8530_status
47079 };
47080
47081 EXPORT_SYMBOL(z8530_sync);
47082 @@ -605,15 +605,15 @@ static void z8530_dma_status(struct z8530_channel *chan)
47083 }
47084
47085 static struct z8530_irqhandler z8530_dma_sync = {
47086 - z8530_dma_rx,
47087 - z8530_dma_tx,
47088 - z8530_dma_status
47089 + .rx = z8530_dma_rx,
47090 + .tx = z8530_dma_tx,
47091 + .status = z8530_dma_status
47092 };
47093
47094 static struct z8530_irqhandler z8530_txdma_sync = {
47095 - z8530_rx,
47096 - z8530_dma_tx,
47097 - z8530_dma_status
47098 + .rx = z8530_rx,
47099 + .tx = z8530_dma_tx,
47100 + .status = z8530_dma_status
47101 };
47102
47103 /**
47104 @@ -680,9 +680,9 @@ static void z8530_status_clear(struct z8530_channel *chan)
47105
47106 struct z8530_irqhandler z8530_nop=
47107 {
47108 - z8530_rx_clear,
47109 - z8530_tx_clear,
47110 - z8530_status_clear
47111 + .rx = z8530_rx_clear,
47112 + .tx = z8530_tx_clear,
47113 + .status = z8530_status_clear
47114 };
47115
47116
47117 diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
47118 index 0b60295..b8bfa5b 100644
47119 --- a/drivers/net/wimax/i2400m/rx.c
47120 +++ b/drivers/net/wimax/i2400m/rx.c
47121 @@ -1359,7 +1359,7 @@ int i2400m_rx_setup(struct i2400m *i2400m)
47122 if (i2400m->rx_roq == NULL)
47123 goto error_roq_alloc;
47124
47125 - rd = kcalloc(I2400M_RO_CIN + 1, sizeof(*i2400m->rx_roq[0].log),
47126 + rd = kcalloc(sizeof(*i2400m->rx_roq[0].log), I2400M_RO_CIN + 1,
47127 GFP_KERNEL);
47128 if (rd == NULL) {
47129 result = -ENOMEM;
47130 diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
47131 index edf4b57..68b51c0 100644
47132 --- a/drivers/net/wireless/airo.c
47133 +++ b/drivers/net/wireless/airo.c
47134 @@ -7843,7 +7843,7 @@ static int writerids(struct net_device *dev, aironet_ioctl *comp) {
47135 struct airo_info *ai = dev->ml_priv;
47136 int ridcode;
47137 int enabled;
47138 - static int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
47139 + int (* writer)(struct airo_info *, u16 rid, const void *, int, int);
47140 unsigned char *iobuf;
47141
47142 /* Only super-user can write RIDs */
47143 diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
47144 index 99b3bfa..9559372 100644
47145 --- a/drivers/net/wireless/at76c50x-usb.c
47146 +++ b/drivers/net/wireless/at76c50x-usb.c
47147 @@ -353,7 +353,7 @@ static int at76_dfu_get_state(struct usb_device *udev, u8 *state)
47148 }
47149
47150 /* Convert timeout from the DFU status to jiffies */
47151 -static inline unsigned long at76_get_timeout(struct dfu_status *s)
47152 +static inline unsigned long __intentional_overflow(-1) at76_get_timeout(struct dfu_status *s)
47153 {
47154 return msecs_to_jiffies((s->poll_timeout[2] << 16)
47155 | (s->poll_timeout[1] << 8)
47156 diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
47157 index edc57ab..ff49e0a 100644
47158 --- a/drivers/net/wireless/ath/ath10k/htc.c
47159 +++ b/drivers/net/wireless/ath/ath10k/htc.c
47160 @@ -831,7 +831,10 @@ void ath10k_htc_stop(struct ath10k_htc *htc)
47161 /* registered target arrival callback from the HIF layer */
47162 int ath10k_htc_init(struct ath10k *ar)
47163 {
47164 - struct ath10k_hif_cb htc_callbacks;
47165 + static struct ath10k_hif_cb htc_callbacks = {
47166 + .rx_completion = ath10k_htc_rx_completion_handler,
47167 + .tx_completion = ath10k_htc_tx_completion_handler,
47168 + };
47169 struct ath10k_htc_ep *ep = NULL;
47170 struct ath10k_htc *htc = &ar->htc;
47171
47172 @@ -841,8 +844,6 @@ int ath10k_htc_init(struct ath10k *ar)
47173 ath10k_htc_reset_endpoint_states(htc);
47174
47175 /* setup HIF layer callbacks */
47176 - htc_callbacks.rx_completion = ath10k_htc_rx_completion_handler;
47177 - htc_callbacks.tx_completion = ath10k_htc_tx_completion_handler;
47178 htc->ar = ar;
47179
47180 /* Get HIF default pipe for HTC message exchange */
47181 diff --git a/drivers/net/wireless/ath/ath10k/htc.h b/drivers/net/wireless/ath/ath10k/htc.h
47182 index 4716d33..a688310 100644
47183 --- a/drivers/net/wireless/ath/ath10k/htc.h
47184 +++ b/drivers/net/wireless/ath/ath10k/htc.h
47185 @@ -271,13 +271,13 @@ enum ath10k_htc_ep_id {
47186
47187 struct ath10k_htc_ops {
47188 void (*target_send_suspend_complete)(struct ath10k *ar);
47189 -};
47190 +} __no_const;
47191
47192 struct ath10k_htc_ep_ops {
47193 void (*ep_tx_complete)(struct ath10k *, struct sk_buff *);
47194 void (*ep_rx_complete)(struct ath10k *, struct sk_buff *);
47195 void (*ep_tx_credits)(struct ath10k *);
47196 -};
47197 +} __no_const;
47198
47199 /* service connection information */
47200 struct ath10k_htc_svc_conn_req {
47201 diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
47202 index 741b38d..b7ae41b 100644
47203 --- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
47204 +++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
47205 @@ -220,8 +220,8 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47206 ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
47207 ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
47208
47209 - ACCESS_ONCE(ads->ds_link) = i->link;
47210 - ACCESS_ONCE(ads->ds_data) = i->buf_addr[0];
47211 + ACCESS_ONCE_RW(ads->ds_link) = i->link;
47212 + ACCESS_ONCE_RW(ads->ds_data) = i->buf_addr[0];
47213
47214 ctl1 = i->buf_len[0] | (i->is_last ? 0 : AR_TxMore);
47215 ctl6 = SM(i->keytype, AR_EncrType);
47216 @@ -235,26 +235,26 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47217
47218 if ((i->is_first || i->is_last) &&
47219 i->aggr != AGGR_BUF_MIDDLE && i->aggr != AGGR_BUF_LAST) {
47220 - ACCESS_ONCE(ads->ds_ctl2) = set11nTries(i->rates, 0)
47221 + ACCESS_ONCE_RW(ads->ds_ctl2) = set11nTries(i->rates, 0)
47222 | set11nTries(i->rates, 1)
47223 | set11nTries(i->rates, 2)
47224 | set11nTries(i->rates, 3)
47225 | (i->dur_update ? AR_DurUpdateEna : 0)
47226 | SM(0, AR_BurstDur);
47227
47228 - ACCESS_ONCE(ads->ds_ctl3) = set11nRate(i->rates, 0)
47229 + ACCESS_ONCE_RW(ads->ds_ctl3) = set11nRate(i->rates, 0)
47230 | set11nRate(i->rates, 1)
47231 | set11nRate(i->rates, 2)
47232 | set11nRate(i->rates, 3);
47233 } else {
47234 - ACCESS_ONCE(ads->ds_ctl2) = 0;
47235 - ACCESS_ONCE(ads->ds_ctl3) = 0;
47236 + ACCESS_ONCE_RW(ads->ds_ctl2) = 0;
47237 + ACCESS_ONCE_RW(ads->ds_ctl3) = 0;
47238 }
47239
47240 if (!i->is_first) {
47241 - ACCESS_ONCE(ads->ds_ctl0) = 0;
47242 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
47243 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
47244 + ACCESS_ONCE_RW(ads->ds_ctl0) = 0;
47245 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
47246 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
47247 return;
47248 }
47249
47250 @@ -279,7 +279,7 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47251 break;
47252 }
47253
47254 - ACCESS_ONCE(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
47255 + ACCESS_ONCE_RW(ads->ds_ctl0) = (i->pkt_len & AR_FrameLen)
47256 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
47257 | SM(i->txpower, AR_XmitPower)
47258 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
47259 @@ -289,19 +289,19 @@ ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47260 | (i->flags & ATH9K_TXDESC_RTSENA ? AR_RTSEnable :
47261 (i->flags & ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0));
47262
47263 - ACCESS_ONCE(ads->ds_ctl1) = ctl1;
47264 - ACCESS_ONCE(ads->ds_ctl6) = ctl6;
47265 + ACCESS_ONCE_RW(ads->ds_ctl1) = ctl1;
47266 + ACCESS_ONCE_RW(ads->ds_ctl6) = ctl6;
47267
47268 if (i->aggr == AGGR_BUF_MIDDLE || i->aggr == AGGR_BUF_LAST)
47269 return;
47270
47271 - ACCESS_ONCE(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
47272 + ACCESS_ONCE_RW(ads->ds_ctl4) = set11nPktDurRTSCTS(i->rates, 0)
47273 | set11nPktDurRTSCTS(i->rates, 1);
47274
47275 - ACCESS_ONCE(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
47276 + ACCESS_ONCE_RW(ads->ds_ctl5) = set11nPktDurRTSCTS(i->rates, 2)
47277 | set11nPktDurRTSCTS(i->rates, 3);
47278
47279 - ACCESS_ONCE(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
47280 + ACCESS_ONCE_RW(ads->ds_ctl7) = set11nRateFlags(i->rates, 0)
47281 | set11nRateFlags(i->rates, 1)
47282 | set11nRateFlags(i->rates, 2)
47283 | set11nRateFlags(i->rates, 3)
47284 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
47285 index 729ffbf..49f50e3 100644
47286 --- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
47287 +++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
47288 @@ -39,47 +39,47 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47289 (i->qcu << AR_TxQcuNum_S) | desc_len;
47290
47291 checksum += val;
47292 - ACCESS_ONCE(ads->info) = val;
47293 + ACCESS_ONCE_RW(ads->info) = val;
47294
47295 checksum += i->link;
47296 - ACCESS_ONCE(ads->link) = i->link;
47297 + ACCESS_ONCE_RW(ads->link) = i->link;
47298
47299 checksum += i->buf_addr[0];
47300 - ACCESS_ONCE(ads->data0) = i->buf_addr[0];
47301 + ACCESS_ONCE_RW(ads->data0) = i->buf_addr[0];
47302 checksum += i->buf_addr[1];
47303 - ACCESS_ONCE(ads->data1) = i->buf_addr[1];
47304 + ACCESS_ONCE_RW(ads->data1) = i->buf_addr[1];
47305 checksum += i->buf_addr[2];
47306 - ACCESS_ONCE(ads->data2) = i->buf_addr[2];
47307 + ACCESS_ONCE_RW(ads->data2) = i->buf_addr[2];
47308 checksum += i->buf_addr[3];
47309 - ACCESS_ONCE(ads->data3) = i->buf_addr[3];
47310 + ACCESS_ONCE_RW(ads->data3) = i->buf_addr[3];
47311
47312 checksum += (val = (i->buf_len[0] << AR_BufLen_S) & AR_BufLen);
47313 - ACCESS_ONCE(ads->ctl3) = val;
47314 + ACCESS_ONCE_RW(ads->ctl3) = val;
47315 checksum += (val = (i->buf_len[1] << AR_BufLen_S) & AR_BufLen);
47316 - ACCESS_ONCE(ads->ctl5) = val;
47317 + ACCESS_ONCE_RW(ads->ctl5) = val;
47318 checksum += (val = (i->buf_len[2] << AR_BufLen_S) & AR_BufLen);
47319 - ACCESS_ONCE(ads->ctl7) = val;
47320 + ACCESS_ONCE_RW(ads->ctl7) = val;
47321 checksum += (val = (i->buf_len[3] << AR_BufLen_S) & AR_BufLen);
47322 - ACCESS_ONCE(ads->ctl9) = val;
47323 + ACCESS_ONCE_RW(ads->ctl9) = val;
47324
47325 checksum = (u16) (((checksum & 0xffff) + (checksum >> 16)) & 0xffff);
47326 - ACCESS_ONCE(ads->ctl10) = checksum;
47327 + ACCESS_ONCE_RW(ads->ctl10) = checksum;
47328
47329 if (i->is_first || i->is_last) {
47330 - ACCESS_ONCE(ads->ctl13) = set11nTries(i->rates, 0)
47331 + ACCESS_ONCE_RW(ads->ctl13) = set11nTries(i->rates, 0)
47332 | set11nTries(i->rates, 1)
47333 | set11nTries(i->rates, 2)
47334 | set11nTries(i->rates, 3)
47335 | (i->dur_update ? AR_DurUpdateEna : 0)
47336 | SM(0, AR_BurstDur);
47337
47338 - ACCESS_ONCE(ads->ctl14) = set11nRate(i->rates, 0)
47339 + ACCESS_ONCE_RW(ads->ctl14) = set11nRate(i->rates, 0)
47340 | set11nRate(i->rates, 1)
47341 | set11nRate(i->rates, 2)
47342 | set11nRate(i->rates, 3);
47343 } else {
47344 - ACCESS_ONCE(ads->ctl13) = 0;
47345 - ACCESS_ONCE(ads->ctl14) = 0;
47346 + ACCESS_ONCE_RW(ads->ctl13) = 0;
47347 + ACCESS_ONCE_RW(ads->ctl14) = 0;
47348 }
47349
47350 ads->ctl20 = 0;
47351 @@ -89,17 +89,17 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47352
47353 ctl17 = SM(i->keytype, AR_EncrType);
47354 if (!i->is_first) {
47355 - ACCESS_ONCE(ads->ctl11) = 0;
47356 - ACCESS_ONCE(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
47357 - ACCESS_ONCE(ads->ctl15) = 0;
47358 - ACCESS_ONCE(ads->ctl16) = 0;
47359 - ACCESS_ONCE(ads->ctl17) = ctl17;
47360 - ACCESS_ONCE(ads->ctl18) = 0;
47361 - ACCESS_ONCE(ads->ctl19) = 0;
47362 + ACCESS_ONCE_RW(ads->ctl11) = 0;
47363 + ACCESS_ONCE_RW(ads->ctl12) = i->is_last ? 0 : AR_TxMore;
47364 + ACCESS_ONCE_RW(ads->ctl15) = 0;
47365 + ACCESS_ONCE_RW(ads->ctl16) = 0;
47366 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
47367 + ACCESS_ONCE_RW(ads->ctl18) = 0;
47368 + ACCESS_ONCE_RW(ads->ctl19) = 0;
47369 return;
47370 }
47371
47372 - ACCESS_ONCE(ads->ctl11) = (i->pkt_len & AR_FrameLen)
47373 + ACCESS_ONCE_RW(ads->ctl11) = (i->pkt_len & AR_FrameLen)
47374 | (i->flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
47375 | SM(i->txpower, AR_XmitPower)
47376 | (i->flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
47377 @@ -135,22 +135,22 @@ ar9003_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)
47378 val = (i->flags & ATH9K_TXDESC_PAPRD) >> ATH9K_TXDESC_PAPRD_S;
47379 ctl12 |= SM(val, AR_PAPRDChainMask);
47380
47381 - ACCESS_ONCE(ads->ctl12) = ctl12;
47382 - ACCESS_ONCE(ads->ctl17) = ctl17;
47383 + ACCESS_ONCE_RW(ads->ctl12) = ctl12;
47384 + ACCESS_ONCE_RW(ads->ctl17) = ctl17;
47385
47386 - ACCESS_ONCE(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
47387 + ACCESS_ONCE_RW(ads->ctl15) = set11nPktDurRTSCTS(i->rates, 0)
47388 | set11nPktDurRTSCTS(i->rates, 1);
47389
47390 - ACCESS_ONCE(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
47391 + ACCESS_ONCE_RW(ads->ctl16) = set11nPktDurRTSCTS(i->rates, 2)
47392 | set11nPktDurRTSCTS(i->rates, 3);
47393
47394 - ACCESS_ONCE(ads->ctl18) = set11nRateFlags(i->rates, 0)
47395 + ACCESS_ONCE_RW(ads->ctl18) = set11nRateFlags(i->rates, 0)
47396 | set11nRateFlags(i->rates, 1)
47397 | set11nRateFlags(i->rates, 2)
47398 | set11nRateFlags(i->rates, 3)
47399 | SM(i->rtscts_rate, AR_RTSCTSRate);
47400
47401 - ACCESS_ONCE(ads->ctl19) = AR_Not_Sounding;
47402 + ACCESS_ONCE_RW(ads->ctl19) = AR_Not_Sounding;
47403 }
47404
47405 static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
47406 diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
47407 index 0acd4b5..0591c91 100644
47408 --- a/drivers/net/wireless/ath/ath9k/hw.h
47409 +++ b/drivers/net/wireless/ath/ath9k/hw.h
47410 @@ -629,7 +629,7 @@ struct ath_hw_private_ops {
47411
47412 /* ANI */
47413 void (*ani_cache_ini_regs)(struct ath_hw *ah);
47414 -};
47415 +} __no_const;
47416
47417 /**
47418 * struct ath_spec_scan - parameters for Atheros spectral scan
47419 @@ -706,7 +706,7 @@ struct ath_hw_ops {
47420 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
47421 void (*set_bt_ant_diversity)(struct ath_hw *hw, bool enable);
47422 #endif
47423 -};
47424 +} __no_const;
47425
47426 struct ath_nf_limits {
47427 s16 max;
47428 diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
47429 index 92190da..f3a4c4c 100644
47430 --- a/drivers/net/wireless/b43/phy_lp.c
47431 +++ b/drivers/net/wireless/b43/phy_lp.c
47432 @@ -2514,7 +2514,7 @@ static int lpphy_b2063_tune(struct b43_wldev *dev,
47433 {
47434 struct ssb_bus *bus = dev->dev->sdev->bus;
47435
47436 - static const struct b206x_channel *chandata = NULL;
47437 + const struct b206x_channel *chandata = NULL;
47438 u32 crystal_freq = bus->chipco.pmu.crystalfreq * 1000;
47439 u32 freqref, vco_freq, val1, val2, val3, timeout, timeoutref, count;
47440 u16 old_comm15, scale;
47441 diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
47442 index 0487461..fd9e84a 100644
47443 --- a/drivers/net/wireless/iwlegacy/3945-mac.c
47444 +++ b/drivers/net/wireless/iwlegacy/3945-mac.c
47445 @@ -3638,7 +3638,9 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
47446 */
47447 if (il3945_mod_params.disable_hw_scan) {
47448 D_INFO("Disabling hw_scan\n");
47449 - il3945_mac_ops.hw_scan = NULL;
47450 + pax_open_kernel();
47451 + *(void **)&il3945_mac_ops.hw_scan = NULL;
47452 + pax_close_kernel();
47453 }
47454
47455 D_INFO("*** LOAD DRIVER ***\n");
47456 diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
47457 index d2fe259..0c4c682 100644
47458 --- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
47459 +++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
47460 @@ -188,7 +188,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
47461 {
47462 struct iwl_priv *priv = file->private_data;
47463 char buf[64];
47464 - int buf_size;
47465 + size_t buf_size;
47466 u32 offset, len;
47467
47468 memset(buf, 0, sizeof(buf));
47469 @@ -458,7 +458,7 @@ static ssize_t iwl_dbgfs_rx_handlers_write(struct file *file,
47470 struct iwl_priv *priv = file->private_data;
47471
47472 char buf[8];
47473 - int buf_size;
47474 + size_t buf_size;
47475 u32 reset_flag;
47476
47477 memset(buf, 0, sizeof(buf));
47478 @@ -539,7 +539,7 @@ static ssize_t iwl_dbgfs_disable_ht40_write(struct file *file,
47479 {
47480 struct iwl_priv *priv = file->private_data;
47481 char buf[8];
47482 - int buf_size;
47483 + size_t buf_size;
47484 int ht40;
47485
47486 memset(buf, 0, sizeof(buf));
47487 @@ -591,7 +591,7 @@ static ssize_t iwl_dbgfs_sleep_level_override_write(struct file *file,
47488 {
47489 struct iwl_priv *priv = file->private_data;
47490 char buf[8];
47491 - int buf_size;
47492 + size_t buf_size;
47493 int value;
47494
47495 memset(buf, 0, sizeof(buf));
47496 @@ -683,10 +683,10 @@ DEBUGFS_READ_FILE_OPS(temperature);
47497 DEBUGFS_READ_WRITE_FILE_OPS(sleep_level_override);
47498 DEBUGFS_READ_FILE_OPS(current_sleep_command);
47499
47500 -static const char *fmt_value = " %-30s %10u\n";
47501 -static const char *fmt_hex = " %-30s 0x%02X\n";
47502 -static const char *fmt_table = " %-30s %10u %10u %10u %10u\n";
47503 -static const char *fmt_header =
47504 +static const char fmt_value[] = " %-30s %10u\n";
47505 +static const char fmt_hex[] = " %-30s 0x%02X\n";
47506 +static const char fmt_table[] = " %-30s %10u %10u %10u %10u\n";
47507 +static const char fmt_header[] =
47508 "%-32s current cumulative delta max\n";
47509
47510 static int iwl_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
47511 @@ -1856,7 +1856,7 @@ static ssize_t iwl_dbgfs_clear_ucode_statistics_write(struct file *file,
47512 {
47513 struct iwl_priv *priv = file->private_data;
47514 char buf[8];
47515 - int buf_size;
47516 + size_t buf_size;
47517 int clear;
47518
47519 memset(buf, 0, sizeof(buf));
47520 @@ -1901,7 +1901,7 @@ static ssize_t iwl_dbgfs_ucode_tracing_write(struct file *file,
47521 {
47522 struct iwl_priv *priv = file->private_data;
47523 char buf[8];
47524 - int buf_size;
47525 + size_t buf_size;
47526 int trace;
47527
47528 memset(buf, 0, sizeof(buf));
47529 @@ -1972,7 +1972,7 @@ static ssize_t iwl_dbgfs_missed_beacon_write(struct file *file,
47530 {
47531 struct iwl_priv *priv = file->private_data;
47532 char buf[8];
47533 - int buf_size;
47534 + size_t buf_size;
47535 int missed;
47536
47537 memset(buf, 0, sizeof(buf));
47538 @@ -2013,7 +2013,7 @@ static ssize_t iwl_dbgfs_plcp_delta_write(struct file *file,
47539
47540 struct iwl_priv *priv = file->private_data;
47541 char buf[8];
47542 - int buf_size;
47543 + size_t buf_size;
47544 int plcp;
47545
47546 memset(buf, 0, sizeof(buf));
47547 @@ -2073,7 +2073,7 @@ static ssize_t iwl_dbgfs_txfifo_flush_write(struct file *file,
47548
47549 struct iwl_priv *priv = file->private_data;
47550 char buf[8];
47551 - int buf_size;
47552 + size_t buf_size;
47553 int flush;
47554
47555 memset(buf, 0, sizeof(buf));
47556 @@ -2163,7 +2163,7 @@ static ssize_t iwl_dbgfs_protection_mode_write(struct file *file,
47557
47558 struct iwl_priv *priv = file->private_data;
47559 char buf[8];
47560 - int buf_size;
47561 + size_t buf_size;
47562 int rts;
47563
47564 if (!priv->cfg->ht_params)
47565 @@ -2205,7 +2205,7 @@ static ssize_t iwl_dbgfs_echo_test_write(struct file *file,
47566 {
47567 struct iwl_priv *priv = file->private_data;
47568 char buf[8];
47569 - int buf_size;
47570 + size_t buf_size;
47571
47572 memset(buf, 0, sizeof(buf));
47573 buf_size = min(count, sizeof(buf) - 1);
47574 @@ -2239,7 +2239,7 @@ static ssize_t iwl_dbgfs_log_event_write(struct file *file,
47575 struct iwl_priv *priv = file->private_data;
47576 u32 event_log_flag;
47577 char buf[8];
47578 - int buf_size;
47579 + size_t buf_size;
47580
47581 /* check that the interface is up */
47582 if (!iwl_is_ready(priv))
47583 @@ -2293,7 +2293,7 @@ static ssize_t iwl_dbgfs_calib_disabled_write(struct file *file,
47584 struct iwl_priv *priv = file->private_data;
47585 char buf[8];
47586 u32 calib_disabled;
47587 - int buf_size;
47588 + size_t buf_size;
47589
47590 memset(buf, 0, sizeof(buf));
47591 buf_size = min(count, sizeof(buf) - 1);
47592 diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
47593 index ea7e70c..bc0c45f 100644
47594 --- a/drivers/net/wireless/iwlwifi/dvm/main.c
47595 +++ b/drivers/net/wireless/iwlwifi/dvm/main.c
47596 @@ -1127,7 +1127,7 @@ static void iwl_option_config(struct iwl_priv *priv)
47597 static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
47598 {
47599 struct iwl_nvm_data *data = priv->nvm_data;
47600 - char *debug_msg;
47601 + static const char debug_msg[] = "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n";
47602
47603 if (data->sku_cap_11n_enable &&
47604 !priv->cfg->ht_params) {
47605 @@ -1141,7 +1141,6 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
47606 return -EINVAL;
47607 }
47608
47609 - debug_msg = "Device SKU: 24GHz %s %s, 52GHz %s %s, 11.n %s %s\n";
47610 IWL_DEBUG_INFO(priv, debug_msg,
47611 data->sku_cap_band_24GHz_enable ? "" : "NOT", "enabled",
47612 data->sku_cap_band_52GHz_enable ? "" : "NOT", "enabled",
47613 diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
47614 index f950780..be9df93 100644
47615 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
47616 +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
47617 @@ -1365,7 +1365,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
47618 struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
47619
47620 char buf[8];
47621 - int buf_size;
47622 + size_t buf_size;
47623 u32 reset_flag;
47624
47625 memset(buf, 0, sizeof(buf));
47626 @@ -1386,7 +1386,7 @@ static ssize_t iwl_dbgfs_csr_write(struct file *file,
47627 {
47628 struct iwl_trans *trans = file->private_data;
47629 char buf[8];
47630 - int buf_size;
47631 + size_t buf_size;
47632 int csr;
47633
47634 memset(buf, 0, sizeof(buf));
47635 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
47636 index 69d4c31..bd0b316 100644
47637 --- a/drivers/net/wireless/mac80211_hwsim.c
47638 +++ b/drivers/net/wireless/mac80211_hwsim.c
47639 @@ -2541,20 +2541,20 @@ static int __init init_mac80211_hwsim(void)
47640 if (channels < 1)
47641 return -EINVAL;
47642
47643 - mac80211_hwsim_mchan_ops = mac80211_hwsim_ops;
47644 - mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
47645 - mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
47646 - mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
47647 - mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
47648 - mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
47649 - mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
47650 - mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
47651 - mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
47652 - mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
47653 - mac80211_hwsim_mchan_ops.assign_vif_chanctx =
47654 - mac80211_hwsim_assign_vif_chanctx;
47655 - mac80211_hwsim_mchan_ops.unassign_vif_chanctx =
47656 - mac80211_hwsim_unassign_vif_chanctx;
47657 + pax_open_kernel();
47658 + memcpy((void *)&mac80211_hwsim_mchan_ops, &mac80211_hwsim_ops, sizeof mac80211_hwsim_mchan_ops);
47659 + *(void **)&mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
47660 + *(void **)&mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
47661 + *(void **)&mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
47662 + *(void **)&mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
47663 + *(void **)&mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
47664 + *(void **)&mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
47665 + *(void **)&mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
47666 + *(void **)&mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
47667 + *(void **)&mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
47668 + *(void **)&mac80211_hwsim_mchan_ops.assign_vif_chanctx = mac80211_hwsim_assign_vif_chanctx;
47669 + *(void **)&mac80211_hwsim_mchan_ops.unassign_vif_chanctx = mac80211_hwsim_unassign_vif_chanctx;
47670 + pax_close_kernel();
47671
47672 spin_lock_init(&hwsim_radio_lock);
47673 INIT_LIST_HEAD(&hwsim_radios);
47674 diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
47675 index 5028557..91cf394 100644
47676 --- a/drivers/net/wireless/rndis_wlan.c
47677 +++ b/drivers/net/wireless/rndis_wlan.c
47678 @@ -1236,7 +1236,7 @@ static int set_rts_threshold(struct usbnet *usbdev, u32 rts_threshold)
47679
47680 netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
47681
47682 - if (rts_threshold < 0 || rts_threshold > 2347)
47683 + if (rts_threshold > 2347)
47684 rts_threshold = 2347;
47685
47686 tmp = cpu_to_le32(rts_threshold);
47687 diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
47688 index e3b885d..7a7de2f 100644
47689 --- a/drivers/net/wireless/rt2x00/rt2x00.h
47690 +++ b/drivers/net/wireless/rt2x00/rt2x00.h
47691 @@ -375,7 +375,7 @@ struct rt2x00_intf {
47692 * for hardware which doesn't support hardware
47693 * sequence counting.
47694 */
47695 - atomic_t seqno;
47696 + atomic_unchecked_t seqno;
47697 };
47698
47699 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
47700 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
47701 index 5642ccc..01f03eb 100644
47702 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
47703 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
47704 @@ -250,9 +250,9 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
47705 * sequence counter given by mac80211.
47706 */
47707 if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
47708 - seqno = atomic_add_return(0x10, &intf->seqno);
47709 + seqno = atomic_add_return_unchecked(0x10, &intf->seqno);
47710 else
47711 - seqno = atomic_read(&intf->seqno);
47712 + seqno = atomic_read_unchecked(&intf->seqno);
47713
47714 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
47715 hdr->seq_ctrl |= cpu_to_le16(seqno);
47716 diff --git a/drivers/net/wireless/ti/wl1251/sdio.c b/drivers/net/wireless/ti/wl1251/sdio.c
47717 index e2b3d9c..67a5184 100644
47718 --- a/drivers/net/wireless/ti/wl1251/sdio.c
47719 +++ b/drivers/net/wireless/ti/wl1251/sdio.c
47720 @@ -271,13 +271,17 @@ static int wl1251_sdio_probe(struct sdio_func *func,
47721
47722 irq_set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
47723
47724 - wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
47725 - wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
47726 + pax_open_kernel();
47727 + *(void **)&wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
47728 + *(void **)&wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
47729 + pax_close_kernel();
47730
47731 wl1251_info("using dedicated interrupt line");
47732 } else {
47733 - wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
47734 - wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
47735 + pax_open_kernel();
47736 + *(void **)&wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
47737 + *(void **)&wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
47738 + pax_close_kernel();
47739
47740 wl1251_info("using SDIO interrupt");
47741 }
47742 diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
47743 index be7129b..4161356 100644
47744 --- a/drivers/net/wireless/ti/wl12xx/main.c
47745 +++ b/drivers/net/wireless/ti/wl12xx/main.c
47746 @@ -656,7 +656,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
47747 sizeof(wl->conf.mem));
47748
47749 /* read data preparation is only needed by wl127x */
47750 - wl->ops->prepare_read = wl127x_prepare_read;
47751 + pax_open_kernel();
47752 + *(void **)&wl->ops->prepare_read = wl127x_prepare_read;
47753 + pax_close_kernel();
47754
47755 wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
47756 WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER,
47757 @@ -681,7 +683,9 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
47758 sizeof(wl->conf.mem));
47759
47760 /* read data preparation is only needed by wl127x */
47761 - wl->ops->prepare_read = wl127x_prepare_read;
47762 + pax_open_kernel();
47763 + *(void **)&wl->ops->prepare_read = wl127x_prepare_read;
47764 + pax_close_kernel();
47765
47766 wlcore_set_min_fw_ver(wl, WL127X_CHIP_VER,
47767 WL127X_IFTYPE_SR_VER, WL127X_MAJOR_SR_VER,
47768 diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
47769 index ec37b16..7e34d66 100644
47770 --- a/drivers/net/wireless/ti/wl18xx/main.c
47771 +++ b/drivers/net/wireless/ti/wl18xx/main.c
47772 @@ -1823,8 +1823,10 @@ static int wl18xx_setup(struct wl1271 *wl)
47773 }
47774
47775 if (!checksum_param) {
47776 - wl18xx_ops.set_rx_csum = NULL;
47777 - wl18xx_ops.init_vif = NULL;
47778 + pax_open_kernel();
47779 + *(void **)&wl18xx_ops.set_rx_csum = NULL;
47780 + *(void **)&wl18xx_ops.init_vif = NULL;
47781 + pax_close_kernel();
47782 }
47783
47784 /* Enable 11a Band only if we have 5G antennas */
47785 diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
47786 index a912dc0..a8225ba 100644
47787 --- a/drivers/net/wireless/zd1211rw/zd_usb.c
47788 +++ b/drivers/net/wireless/zd1211rw/zd_usb.c
47789 @@ -385,7 +385,7 @@ static inline void handle_regs_int(struct urb *urb)
47790 {
47791 struct zd_usb *usb = urb->context;
47792 struct zd_usb_interrupt *intr = &usb->intr;
47793 - int len;
47794 + unsigned int len;
47795 u16 int_num;
47796
47797 ZD_ASSERT(in_interrupt());
47798 diff --git a/drivers/nfc/nfcwilink.c b/drivers/nfc/nfcwilink.c
47799 index 683671a..4519fc2 100644
47800 --- a/drivers/nfc/nfcwilink.c
47801 +++ b/drivers/nfc/nfcwilink.c
47802 @@ -497,7 +497,7 @@ static struct nci_ops nfcwilink_ops = {
47803
47804 static int nfcwilink_probe(struct platform_device *pdev)
47805 {
47806 - static struct nfcwilink *drv;
47807 + struct nfcwilink *drv;
47808 int rc;
47809 __u32 protocols;
47810
47811 diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
47812 index d93b2b6..ae50401 100644
47813 --- a/drivers/oprofile/buffer_sync.c
47814 +++ b/drivers/oprofile/buffer_sync.c
47815 @@ -332,7 +332,7 @@ static void add_data(struct op_entry *entry, struct mm_struct *mm)
47816 if (cookie == NO_COOKIE)
47817 offset = pc;
47818 if (cookie == INVALID_COOKIE) {
47819 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
47820 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
47821 offset = pc;
47822 }
47823 if (cookie != last_cookie) {
47824 @@ -376,14 +376,14 @@ add_sample(struct mm_struct *mm, struct op_sample *s, int in_kernel)
47825 /* add userspace sample */
47826
47827 if (!mm) {
47828 - atomic_inc(&oprofile_stats.sample_lost_no_mm);
47829 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
47830 return 0;
47831 }
47832
47833 cookie = lookup_dcookie(mm, s->eip, &offset);
47834
47835 if (cookie == INVALID_COOKIE) {
47836 - atomic_inc(&oprofile_stats.sample_lost_no_mapping);
47837 + atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
47838 return 0;
47839 }
47840
47841 @@ -552,7 +552,7 @@ void sync_buffer(int cpu)
47842 /* ignore backtraces if failed to add a sample */
47843 if (state == sb_bt_start) {
47844 state = sb_bt_ignore;
47845 - atomic_inc(&oprofile_stats.bt_lost_no_mapping);
47846 + atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
47847 }
47848 }
47849 release_mm(mm);
47850 diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
47851 index c0cc4e7..44d4e54 100644
47852 --- a/drivers/oprofile/event_buffer.c
47853 +++ b/drivers/oprofile/event_buffer.c
47854 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value)
47855 }
47856
47857 if (buffer_pos == buffer_size) {
47858 - atomic_inc(&oprofile_stats.event_lost_overflow);
47859 + atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
47860 return;
47861 }
47862
47863 diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
47864 index ed2c3ec..deda85a 100644
47865 --- a/drivers/oprofile/oprof.c
47866 +++ b/drivers/oprofile/oprof.c
47867 @@ -110,7 +110,7 @@ static void switch_worker(struct work_struct *work)
47868 if (oprofile_ops.switch_events())
47869 return;
47870
47871 - atomic_inc(&oprofile_stats.multiplex_counter);
47872 + atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
47873 start_switch_worker();
47874 }
47875
47876 diff --git a/drivers/oprofile/oprofile_files.c b/drivers/oprofile/oprofile_files.c
47877 index ee2cfce..7f8f699 100644
47878 --- a/drivers/oprofile/oprofile_files.c
47879 +++ b/drivers/oprofile/oprofile_files.c
47880 @@ -27,7 +27,7 @@ unsigned long oprofile_time_slice;
47881
47882 #ifdef CONFIG_OPROFILE_EVENT_MULTIPLEX
47883
47884 -static ssize_t timeout_read(struct file *file, char __user *buf,
47885 +static ssize_t __intentional_overflow(-1) timeout_read(struct file *file, char __user *buf,
47886 size_t count, loff_t *offset)
47887 {
47888 return oprofilefs_ulong_to_user(jiffies_to_msecs(oprofile_time_slice),
47889 diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofile/oprofile_stats.c
47890 index 59659ce..6c860a0 100644
47891 --- a/drivers/oprofile/oprofile_stats.c
47892 +++ b/drivers/oprofile/oprofile_stats.c
47893 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
47894 cpu_buf->sample_invalid_eip = 0;
47895 }
47896
47897 - atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
47898 - atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
47899 - atomic_set(&oprofile_stats.event_lost_overflow, 0);
47900 - atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
47901 - atomic_set(&oprofile_stats.multiplex_counter, 0);
47902 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
47903 + atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
47904 + atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
47905 + atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
47906 + atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
47907 }
47908
47909
47910 diff --git a/drivers/oprofile/oprofile_stats.h b/drivers/oprofile/oprofile_stats.h
47911 index 1fc622b..8c48fc3 100644
47912 --- a/drivers/oprofile/oprofile_stats.h
47913 +++ b/drivers/oprofile/oprofile_stats.h
47914 @@ -13,11 +13,11 @@
47915 #include <linux/atomic.h>
47916
47917 struct oprofile_stat_struct {
47918 - atomic_t sample_lost_no_mm;
47919 - atomic_t sample_lost_no_mapping;
47920 - atomic_t bt_lost_no_mapping;
47921 - atomic_t event_lost_overflow;
47922 - atomic_t multiplex_counter;
47923 + atomic_unchecked_t sample_lost_no_mm;
47924 + atomic_unchecked_t sample_lost_no_mapping;
47925 + atomic_unchecked_t bt_lost_no_mapping;
47926 + atomic_unchecked_t event_lost_overflow;
47927 + atomic_unchecked_t multiplex_counter;
47928 };
47929
47930 extern struct oprofile_stat_struct oprofile_stats;
47931 diff --git a/drivers/oprofile/oprofilefs.c b/drivers/oprofile/oprofilefs.c
47932 index 3f49345..c750d0b 100644
47933 --- a/drivers/oprofile/oprofilefs.c
47934 +++ b/drivers/oprofile/oprofilefs.c
47935 @@ -176,8 +176,8 @@ int oprofilefs_create_ro_ulong(struct dentry *root,
47936
47937 static ssize_t atomic_read_file(struct file *file, char __user *buf, size_t count, loff_t *offset)
47938 {
47939 - atomic_t *val = file->private_data;
47940 - return oprofilefs_ulong_to_user(atomic_read(val), buf, count, offset);
47941 + atomic_unchecked_t *val = file->private_data;
47942 + return oprofilefs_ulong_to_user(atomic_read_unchecked(val), buf, count, offset);
47943 }
47944
47945
47946 @@ -189,7 +189,7 @@ static const struct file_operations atomic_ro_fops = {
47947
47948
47949 int oprofilefs_create_ro_atomic(struct dentry *root,
47950 - char const *name, atomic_t *val)
47951 + char const *name, atomic_unchecked_t *val)
47952 {
47953 return __oprofilefs_create_file(root, name,
47954 &atomic_ro_fops, 0444, val);
47955 diff --git a/drivers/oprofile/timer_int.c b/drivers/oprofile/timer_int.c
47956 index 61be1d9..dec05d7 100644
47957 --- a/drivers/oprofile/timer_int.c
47958 +++ b/drivers/oprofile/timer_int.c
47959 @@ -93,7 +93,7 @@ static int oprofile_cpu_notify(struct notifier_block *self,
47960 return NOTIFY_OK;
47961 }
47962
47963 -static struct notifier_block __refdata oprofile_cpu_notifier = {
47964 +static struct notifier_block oprofile_cpu_notifier = {
47965 .notifier_call = oprofile_cpu_notify,
47966 };
47967
47968 diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
47969 index 92ed045..62d39bd7 100644
47970 --- a/drivers/parport/procfs.c
47971 +++ b/drivers/parport/procfs.c
47972 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *table, int write,
47973
47974 *ppos += len;
47975
47976 - return copy_to_user(result, buffer, len) ? -EFAULT : 0;
47977 + return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
47978 }
47979
47980 #ifdef CONFIG_PARPORT_1284
47981 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table, int write,
47982
47983 *ppos += len;
47984
47985 - return copy_to_user (result, buffer, len) ? -EFAULT : 0;
47986 + return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
47987 }
47988 #endif /* IEEE1284.3 support. */
47989
47990 diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
47991 index 8dcccff..35d701d 100644
47992 --- a/drivers/pci/hotplug/acpiphp_ibm.c
47993 +++ b/drivers/pci/hotplug/acpiphp_ibm.c
47994 @@ -452,7 +452,9 @@ static int __init ibm_acpiphp_init(void)
47995 goto init_cleanup;
47996 }
47997
47998 - ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
47999 + pax_open_kernel();
48000 + *(size_t *)&ibm_apci_table_attr.size = ibm_get_table_from_acpi(NULL);
48001 + pax_close_kernel();
48002 retval = sysfs_create_bin_file(sysdir, &ibm_apci_table_attr);
48003
48004 return retval;
48005 diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
48006 index 7536eef..52dc8fa 100644
48007 --- a/drivers/pci/hotplug/cpcihp_generic.c
48008 +++ b/drivers/pci/hotplug/cpcihp_generic.c
48009 @@ -73,7 +73,6 @@ static u16 port;
48010 static unsigned int enum_bit;
48011 static u8 enum_mask;
48012
48013 -static struct cpci_hp_controller_ops generic_hpc_ops;
48014 static struct cpci_hp_controller generic_hpc;
48015
48016 static int __init validate_parameters(void)
48017 @@ -139,6 +138,10 @@ static int query_enum(void)
48018 return ((value & enum_mask) == enum_mask);
48019 }
48020
48021 +static struct cpci_hp_controller_ops generic_hpc_ops = {
48022 + .query_enum = query_enum,
48023 +};
48024 +
48025 static int __init cpcihp_generic_init(void)
48026 {
48027 int status;
48028 @@ -165,7 +168,6 @@ static int __init cpcihp_generic_init(void)
48029 pci_dev_put(dev);
48030
48031 memset(&generic_hpc, 0, sizeof (struct cpci_hp_controller));
48032 - generic_hpc_ops.query_enum = query_enum;
48033 generic_hpc.ops = &generic_hpc_ops;
48034
48035 status = cpci_hp_register_controller(&generic_hpc);
48036 diff --git a/drivers/pci/hotplug/cpcihp_zt5550.c b/drivers/pci/hotplug/cpcihp_zt5550.c
48037 index e8c4a7c..7046f5c 100644
48038 --- a/drivers/pci/hotplug/cpcihp_zt5550.c
48039 +++ b/drivers/pci/hotplug/cpcihp_zt5550.c
48040 @@ -59,7 +59,6 @@
48041 /* local variables */
48042 static bool debug;
48043 static bool poll;
48044 -static struct cpci_hp_controller_ops zt5550_hpc_ops;
48045 static struct cpci_hp_controller zt5550_hpc;
48046
48047 /* Primary cPCI bus bridge device */
48048 @@ -205,6 +204,10 @@ static int zt5550_hc_disable_irq(void)
48049 return 0;
48050 }
48051
48052 +static struct cpci_hp_controller_ops zt5550_hpc_ops = {
48053 + .query_enum = zt5550_hc_query_enum,
48054 +};
48055 +
48056 static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
48057 {
48058 int status;
48059 @@ -216,16 +219,17 @@ static int zt5550_hc_init_one (struct pci_dev *pdev, const struct pci_device_id
48060 dbg("returned from zt5550_hc_config");
48061
48062 memset(&zt5550_hpc, 0, sizeof (struct cpci_hp_controller));
48063 - zt5550_hpc_ops.query_enum = zt5550_hc_query_enum;
48064 zt5550_hpc.ops = &zt5550_hpc_ops;
48065 if(!poll) {
48066 zt5550_hpc.irq = hc_dev->irq;
48067 zt5550_hpc.irq_flags = IRQF_SHARED;
48068 zt5550_hpc.dev_id = hc_dev;
48069
48070 - zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
48071 - zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
48072 - zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
48073 + pax_open_kernel();
48074 + *(void **)&zt5550_hpc_ops.enable_irq = zt5550_hc_enable_irq;
48075 + *(void **)&zt5550_hpc_ops.disable_irq = zt5550_hc_disable_irq;
48076 + *(void **)&zt5550_hpc_ops.check_irq = zt5550_hc_check_irq;
48077 + pax_open_kernel();
48078 } else {
48079 info("using ENUM# polling mode");
48080 }
48081 diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
48082 index 76ba8a1..20ca857 100644
48083 --- a/drivers/pci/hotplug/cpqphp_nvram.c
48084 +++ b/drivers/pci/hotplug/cpqphp_nvram.c
48085 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_start)
48086
48087 void compaq_nvram_init (void __iomem *rom_start)
48088 {
48089 +
48090 +#ifndef CONFIG_PAX_KERNEXEC
48091 if (rom_start) {
48092 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
48093 }
48094 +#endif
48095 +
48096 dbg("int15 entry = %p\n", compaq_int15_entry_point);
48097
48098 /* initialize our int15 lock */
48099 diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
48100 index cfa92a9..29539c5 100644
48101 --- a/drivers/pci/hotplug/pci_hotplug_core.c
48102 +++ b/drivers/pci/hotplug/pci_hotplug_core.c
48103 @@ -441,8 +441,10 @@ int __pci_hp_register(struct hotplug_slot *slot, struct pci_bus *bus,
48104 return -EINVAL;
48105 }
48106
48107 - slot->ops->owner = owner;
48108 - slot->ops->mod_name = mod_name;
48109 + pax_open_kernel();
48110 + *(struct module **)&slot->ops->owner = owner;
48111 + *(const char **)&slot->ops->mod_name = mod_name;
48112 + pax_close_kernel();
48113
48114 mutex_lock(&pci_hp_mutex);
48115 /*
48116 diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
48117 index 53b58de..4479896 100644
48118 --- a/drivers/pci/hotplug/pciehp_core.c
48119 +++ b/drivers/pci/hotplug/pciehp_core.c
48120 @@ -92,7 +92,7 @@ static int init_slot(struct controller *ctrl)
48121 struct slot *slot = ctrl->slot;
48122 struct hotplug_slot *hotplug = NULL;
48123 struct hotplug_slot_info *info = NULL;
48124 - struct hotplug_slot_ops *ops = NULL;
48125 + hotplug_slot_ops_no_const *ops = NULL;
48126 char name[SLOT_NAME_SIZE];
48127 int retval = -ENOMEM;
48128
48129 diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
48130 index 955ab79..d1df9c7 100644
48131 --- a/drivers/pci/msi.c
48132 +++ b/drivers/pci/msi.c
48133 @@ -524,8 +524,8 @@ static int populate_msi_sysfs(struct pci_dev *pdev)
48134 {
48135 struct attribute **msi_attrs;
48136 struct attribute *msi_attr;
48137 - struct device_attribute *msi_dev_attr;
48138 - struct attribute_group *msi_irq_group;
48139 + device_attribute_no_const *msi_dev_attr;
48140 + attribute_group_no_const *msi_irq_group;
48141 const struct attribute_group **msi_irq_groups;
48142 struct msi_desc *entry;
48143 int ret = -ENOMEM;
48144 @@ -589,7 +589,7 @@ error_attrs:
48145 count = 0;
48146 msi_attr = msi_attrs[count];
48147 while (msi_attr) {
48148 - msi_dev_attr = container_of(msi_attr, struct device_attribute, attr);
48149 + msi_dev_attr = container_of(msi_attr, device_attribute_no_const, attr);
48150 kfree(msi_attr->name);
48151 kfree(msi_dev_attr);
48152 ++count;
48153 diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
48154 index 276ef9c..1d33a36 100644
48155 --- a/drivers/pci/pci-sysfs.c
48156 +++ b/drivers/pci/pci-sysfs.c
48157 @@ -1112,7 +1112,7 @@ static int pci_create_attr(struct pci_dev *pdev, int num, int write_combine)
48158 {
48159 /* allocate attribute structure, piggyback attribute name */
48160 int name_len = write_combine ? 13 : 10;
48161 - struct bin_attribute *res_attr;
48162 + bin_attribute_no_const *res_attr;
48163 int retval;
48164
48165 res_attr = kzalloc(sizeof(*res_attr) + name_len, GFP_ATOMIC);
48166 @@ -1297,7 +1297,7 @@ static struct device_attribute reset_attr = __ATTR(reset, 0200, NULL, reset_stor
48167 static int pci_create_capabilities_sysfs(struct pci_dev *dev)
48168 {
48169 int retval;
48170 - struct bin_attribute *attr;
48171 + bin_attribute_no_const *attr;
48172
48173 /* If the device has VPD, try to expose it in sysfs. */
48174 if (dev->vpd) {
48175 @@ -1344,7 +1344,7 @@ int __must_check pci_create_sysfs_dev_files (struct pci_dev *pdev)
48176 {
48177 int retval;
48178 int rom_size = 0;
48179 - struct bin_attribute *attr;
48180 + bin_attribute_no_const *attr;
48181
48182 if (!sysfs_initialized)
48183 return -EACCES;
48184 diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
48185 index 4df38df..b6bb7fe 100644
48186 --- a/drivers/pci/pci.h
48187 +++ b/drivers/pci/pci.h
48188 @@ -93,7 +93,7 @@ struct pci_vpd_ops {
48189 struct pci_vpd {
48190 unsigned int len;
48191 const struct pci_vpd_ops *ops;
48192 - struct bin_attribute *attr; /* descriptor for sysfs VPD entry */
48193 + bin_attribute_no_const *attr; /* descriptor for sysfs VPD entry */
48194 };
48195
48196 int pci_vpd_pci22_init(struct pci_dev *dev);
48197 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
48198 index e1e7026..d28dd33 100644
48199 --- a/drivers/pci/pcie/aspm.c
48200 +++ b/drivers/pci/pcie/aspm.c
48201 @@ -27,9 +27,9 @@
48202 #define MODULE_PARAM_PREFIX "pcie_aspm."
48203
48204 /* Note: those are not register definitions */
48205 -#define ASPM_STATE_L0S_UP (1) /* Upstream direction L0s state */
48206 -#define ASPM_STATE_L0S_DW (2) /* Downstream direction L0s state */
48207 -#define ASPM_STATE_L1 (4) /* L1 state */
48208 +#define ASPM_STATE_L0S_UP (1U) /* Upstream direction L0s state */
48209 +#define ASPM_STATE_L0S_DW (2U) /* Downstream direction L0s state */
48210 +#define ASPM_STATE_L1 (4U) /* L1 state */
48211 #define ASPM_STATE_L0S (ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
48212 #define ASPM_STATE_ALL (ASPM_STATE_L0S | ASPM_STATE_L1)
48213
48214 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
48215 index 6e34498..9911975 100644
48216 --- a/drivers/pci/probe.c
48217 +++ b/drivers/pci/probe.c
48218 @@ -175,7 +175,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
48219 struct pci_bus_region region, inverted_region;
48220 bool bar_too_big = false, bar_disabled = false;
48221
48222 - mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
48223 + mask = type ? (u32)PCI_ROM_ADDRESS_MASK : ~0;
48224
48225 /* No printks while decoding is disabled! */
48226 if (!dev->mmio_always_on) {
48227 diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c
48228 index 46d1378..30e452b 100644
48229 --- a/drivers/pci/proc.c
48230 +++ b/drivers/pci/proc.c
48231 @@ -434,7 +434,16 @@ static const struct file_operations proc_bus_pci_dev_operations = {
48232 static int __init pci_proc_init(void)
48233 {
48234 struct pci_dev *dev = NULL;
48235 +
48236 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
48237 +#ifdef CONFIG_GRKERNSEC_PROC_USER
48238 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
48239 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
48240 + proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
48241 +#endif
48242 +#else
48243 proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
48244 +#endif
48245 proc_create("devices", 0, proc_bus_pci_dir,
48246 &proc_bus_pci_dev_operations);
48247 proc_initialized = 1;
48248 diff --git a/drivers/platform/chrome/chromeos_laptop.c b/drivers/platform/chrome/chromeos_laptop.c
48249 index 7f3aad0..7d604bb 100644
48250 --- a/drivers/platform/chrome/chromeos_laptop.c
48251 +++ b/drivers/platform/chrome/chromeos_laptop.c
48252 @@ -406,7 +406,7 @@ static struct chromeos_laptop cr48 = {
48253 .callback = chromeos_laptop_dmi_matched, \
48254 .driver_data = (void *)&board_
48255
48256 -static struct dmi_system_id chromeos_laptop_dmi_table[] __initdata = {
48257 +static struct dmi_system_id chromeos_laptop_dmi_table[] __initconst = {
48258 {
48259 .ident = "Samsung Series 5 550",
48260 .matches = {
48261 diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
48262 index c5e082f..d6307a0 100644
48263 --- a/drivers/platform/x86/asus-wmi.c
48264 +++ b/drivers/platform/x86/asus-wmi.c
48265 @@ -1595,6 +1595,10 @@ static int show_dsts(struct seq_file *m, void *data)
48266 int err;
48267 u32 retval = -1;
48268
48269 +#ifdef CONFIG_GRKERNSEC_KMEM
48270 + return -EPERM;
48271 +#endif
48272 +
48273 err = asus_wmi_get_devstate(asus, asus->debug.dev_id, &retval);
48274
48275 if (err < 0)
48276 @@ -1611,6 +1615,10 @@ static int show_devs(struct seq_file *m, void *data)
48277 int err;
48278 u32 retval = -1;
48279
48280 +#ifdef CONFIG_GRKERNSEC_KMEM
48281 + return -EPERM;
48282 +#endif
48283 +
48284 err = asus_wmi_set_devstate(asus->debug.dev_id, asus->debug.ctrl_param,
48285 &retval);
48286
48287 @@ -1635,6 +1643,10 @@ static int show_call(struct seq_file *m, void *data)
48288 union acpi_object *obj;
48289 acpi_status status;
48290
48291 +#ifdef CONFIG_GRKERNSEC_KMEM
48292 + return -EPERM;
48293 +#endif
48294 +
48295 status = wmi_evaluate_method(ASUS_WMI_MGMT_GUID,
48296 1, asus->debug.method_id,
48297 &input, &output);
48298 diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c
48299 index 62f8030..c7f2a45 100644
48300 --- a/drivers/platform/x86/msi-laptop.c
48301 +++ b/drivers/platform/x86/msi-laptop.c
48302 @@ -1000,12 +1000,14 @@ static int __init load_scm_model_init(struct platform_device *sdev)
48303
48304 if (!quirks->ec_read_only) {
48305 /* allow userland write sysfs file */
48306 - dev_attr_bluetooth.store = store_bluetooth;
48307 - dev_attr_wlan.store = store_wlan;
48308 - dev_attr_threeg.store = store_threeg;
48309 - dev_attr_bluetooth.attr.mode |= S_IWUSR;
48310 - dev_attr_wlan.attr.mode |= S_IWUSR;
48311 - dev_attr_threeg.attr.mode |= S_IWUSR;
48312 + pax_open_kernel();
48313 + *(void **)&dev_attr_bluetooth.store = store_bluetooth;
48314 + *(void **)&dev_attr_wlan.store = store_wlan;
48315 + *(void **)&dev_attr_threeg.store = store_threeg;
48316 + *(umode_t *)&dev_attr_bluetooth.attr.mode |= S_IWUSR;
48317 + *(umode_t *)&dev_attr_wlan.attr.mode |= S_IWUSR;
48318 + *(umode_t *)&dev_attr_threeg.attr.mode |= S_IWUSR;
48319 + pax_close_kernel();
48320 }
48321
48322 /* disable hardware control by fn key */
48323 diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
48324 index 70222f2..8c8ce66 100644
48325 --- a/drivers/platform/x86/msi-wmi.c
48326 +++ b/drivers/platform/x86/msi-wmi.c
48327 @@ -183,7 +183,7 @@ static const struct backlight_ops msi_backlight_ops = {
48328 static void msi_wmi_notify(u32 value, void *context)
48329 {
48330 struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
48331 - static struct key_entry *key;
48332 + struct key_entry *key;
48333 union acpi_object *obj;
48334 acpi_status status;
48335
48336 diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
48337 index 8f8551a..3ace3ca 100644
48338 --- a/drivers/platform/x86/sony-laptop.c
48339 +++ b/drivers/platform/x86/sony-laptop.c
48340 @@ -2451,7 +2451,7 @@ static void sony_nc_gfx_switch_cleanup(struct platform_device *pd)
48341 }
48342
48343 /* High speed charging function */
48344 -static struct device_attribute *hsc_handle;
48345 +static device_attribute_no_const *hsc_handle;
48346
48347 static ssize_t sony_nc_highspeed_charging_store(struct device *dev,
48348 struct device_attribute *attr,
48349 diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
48350 index e2a91c8..986cc9f 100644
48351 --- a/drivers/platform/x86/thinkpad_acpi.c
48352 +++ b/drivers/platform/x86/thinkpad_acpi.c
48353 @@ -2094,7 +2094,7 @@ static int hotkey_mask_get(void)
48354 return 0;
48355 }
48356
48357 -void static hotkey_mask_warn_incomplete_mask(void)
48358 +static void hotkey_mask_warn_incomplete_mask(void)
48359 {
48360 /* log only what the user can fix... */
48361 const u32 wantedmask = hotkey_driver_mask &
48362 @@ -2321,11 +2321,6 @@ static void hotkey_read_nvram(struct tp_nvram_state *n, const u32 m)
48363 }
48364 }
48365
48366 -static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48367 - struct tp_nvram_state *newn,
48368 - const u32 event_mask)
48369 -{
48370 -
48371 #define TPACPI_COMPARE_KEY(__scancode, __member) \
48372 do { \
48373 if ((event_mask & (1 << __scancode)) && \
48374 @@ -2339,36 +2334,42 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48375 tpacpi_hotkey_send_key(__scancode); \
48376 } while (0)
48377
48378 - void issue_volchange(const unsigned int oldvol,
48379 - const unsigned int newvol)
48380 - {
48381 - unsigned int i = oldvol;
48382 +static void issue_volchange(const unsigned int oldvol,
48383 + const unsigned int newvol,
48384 + const u32 event_mask)
48385 +{
48386 + unsigned int i = oldvol;
48387
48388 - while (i > newvol) {
48389 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
48390 - i--;
48391 - }
48392 - while (i < newvol) {
48393 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
48394 - i++;
48395 - }
48396 + while (i > newvol) {
48397 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEDOWN);
48398 + i--;
48399 }
48400 + while (i < newvol) {
48401 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
48402 + i++;
48403 + }
48404 +}
48405
48406 - void issue_brightnesschange(const unsigned int oldbrt,
48407 - const unsigned int newbrt)
48408 - {
48409 - unsigned int i = oldbrt;
48410 +static void issue_brightnesschange(const unsigned int oldbrt,
48411 + const unsigned int newbrt,
48412 + const u32 event_mask)
48413 +{
48414 + unsigned int i = oldbrt;
48415
48416 - while (i > newbrt) {
48417 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
48418 - i--;
48419 - }
48420 - while (i < newbrt) {
48421 - TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
48422 - i++;
48423 - }
48424 + while (i > newbrt) {
48425 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNEND);
48426 + i--;
48427 + }
48428 + while (i < newbrt) {
48429 + TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
48430 + i++;
48431 }
48432 +}
48433
48434 +static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48435 + struct tp_nvram_state *newn,
48436 + const u32 event_mask)
48437 +{
48438 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_THINKPAD, thinkpad_toggle);
48439 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNSPACE, zoom_toggle);
48440 TPACPI_COMPARE_KEY(TP_ACPI_HOTKEYSCAN_FNF7, display_toggle);
48441 @@ -2402,7 +2403,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48442 oldn->volume_level != newn->volume_level) {
48443 /* recently muted, or repeated mute keypress, or
48444 * multiple presses ending in mute */
48445 - issue_volchange(oldn->volume_level, newn->volume_level);
48446 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
48447 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_MUTE);
48448 }
48449 } else {
48450 @@ -2412,7 +2413,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48451 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_VOLUMEUP);
48452 }
48453 if (oldn->volume_level != newn->volume_level) {
48454 - issue_volchange(oldn->volume_level, newn->volume_level);
48455 + issue_volchange(oldn->volume_level, newn->volume_level, event_mask);
48456 } else if (oldn->volume_toggle != newn->volume_toggle) {
48457 /* repeated vol up/down keypress at end of scale ? */
48458 if (newn->volume_level == 0)
48459 @@ -2425,7 +2426,8 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48460 /* handle brightness */
48461 if (oldn->brightness_level != newn->brightness_level) {
48462 issue_brightnesschange(oldn->brightness_level,
48463 - newn->brightness_level);
48464 + newn->brightness_level,
48465 + event_mask);
48466 } else if (oldn->brightness_toggle != newn->brightness_toggle) {
48467 /* repeated key presses that didn't change state */
48468 if (newn->brightness_level == 0)
48469 @@ -2434,10 +2436,10 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
48470 && !tp_features.bright_unkfw)
48471 TPACPI_MAY_SEND_KEY(TP_ACPI_HOTKEYSCAN_FNHOME);
48472 }
48473 +}
48474
48475 #undef TPACPI_COMPARE_KEY
48476 #undef TPACPI_MAY_SEND_KEY
48477 -}
48478
48479 /*
48480 * Polling driver
48481 diff --git a/drivers/pnp/pnpbios/bioscalls.c b/drivers/pnp/pnpbios/bioscalls.c
48482 index 769d265..a3a05ca 100644
48483 --- a/drivers/pnp/pnpbios/bioscalls.c
48484 +++ b/drivers/pnp/pnpbios/bioscalls.c
48485 @@ -58,7 +58,7 @@ do { \
48486 set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
48487 } while(0)
48488
48489 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
48490 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
48491 (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
48492
48493 /*
48494 @@ -95,7 +95,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
48495
48496 cpu = get_cpu();
48497 save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
48498 +
48499 + pax_open_kernel();
48500 get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
48501 + pax_close_kernel();
48502
48503 /* On some boxes IRQ's during PnP BIOS calls are deadly. */
48504 spin_lock_irqsave(&pnp_bios_lock, flags);
48505 @@ -133,7 +136,10 @@ static inline u16 call_pnp_bios(u16 func, u16 arg1, u16 arg2, u16 arg3,
48506 :"memory");
48507 spin_unlock_irqrestore(&pnp_bios_lock, flags);
48508
48509 + pax_open_kernel();
48510 get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
48511 + pax_close_kernel();
48512 +
48513 put_cpu();
48514
48515 /* If we get here and this is set then the PnP BIOS faulted on us. */
48516 @@ -467,7 +473,7 @@ int pnp_bios_read_escd(char *data, u32 nvram_base)
48517 return status;
48518 }
48519
48520 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
48521 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
48522 {
48523 int i;
48524
48525 @@ -475,6 +481,8 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
48526 pnp_bios_callpoint.offset = header->fields.pm16offset;
48527 pnp_bios_callpoint.segment = PNP_CS16;
48528
48529 + pax_open_kernel();
48530 +
48531 for_each_possible_cpu(i) {
48532 struct desc_struct *gdt = get_cpu_gdt_table(i);
48533 if (!gdt)
48534 @@ -486,4 +494,6 @@ void pnpbios_calls_init(union pnp_bios_install_struct *header)
48535 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
48536 (unsigned long)__va(header->fields.pm16dseg));
48537 }
48538 +
48539 + pax_close_kernel();
48540 }
48541 diff --git a/drivers/pnp/resource.c b/drivers/pnp/resource.c
48542 index bacddd1..65ea100 100644
48543 --- a/drivers/pnp/resource.c
48544 +++ b/drivers/pnp/resource.c
48545 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, struct resource *res)
48546 return 1;
48547
48548 /* check if the resource is valid */
48549 - if (*irq < 0 || *irq > 15)
48550 + if (*irq > 15)
48551 return 0;
48552
48553 /* check if the resource is reserved */
48554 @@ -424,7 +424,7 @@ int pnp_check_dma(struct pnp_dev *dev, struct resource *res)
48555 return 1;
48556
48557 /* check if the resource is valid */
48558 - if (*dma < 0 || *dma == 4 || *dma > 7)
48559 + if (*dma == 4 || *dma > 7)
48560 return 0;
48561
48562 /* check if the resource is reserved */
48563 diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c
48564 index 0c52e2a..3421ab7 100644
48565 --- a/drivers/power/pda_power.c
48566 +++ b/drivers/power/pda_power.c
48567 @@ -37,7 +37,11 @@ static int polling;
48568
48569 #if IS_ENABLED(CONFIG_USB_PHY)
48570 static struct usb_phy *transceiver;
48571 -static struct notifier_block otg_nb;
48572 +static int otg_handle_notification(struct notifier_block *nb,
48573 + unsigned long event, void *unused);
48574 +static struct notifier_block otg_nb = {
48575 + .notifier_call = otg_handle_notification
48576 +};
48577 #endif
48578
48579 static struct regulator *ac_draw;
48580 @@ -369,7 +373,6 @@ static int pda_power_probe(struct platform_device *pdev)
48581
48582 #if IS_ENABLED(CONFIG_USB_PHY)
48583 if (!IS_ERR_OR_NULL(transceiver) && pdata->use_otg_notifier) {
48584 - otg_nb.notifier_call = otg_handle_notification;
48585 ret = usb_register_notifier(transceiver, &otg_nb);
48586 if (ret) {
48587 dev_err(dev, "failure to register otg notifier\n");
48588 diff --git a/drivers/power/power_supply.h b/drivers/power/power_supply.h
48589 index cc439fd..8fa30df 100644
48590 --- a/drivers/power/power_supply.h
48591 +++ b/drivers/power/power_supply.h
48592 @@ -16,12 +16,12 @@ struct power_supply;
48593
48594 #ifdef CONFIG_SYSFS
48595
48596 -extern void power_supply_init_attrs(struct device_type *dev_type);
48597 +extern void power_supply_init_attrs(void);
48598 extern int power_supply_uevent(struct device *dev, struct kobj_uevent_env *env);
48599
48600 #else
48601
48602 -static inline void power_supply_init_attrs(struct device_type *dev_type) {}
48603 +static inline void power_supply_init_attrs(void) {}
48604 #define power_supply_uevent NULL
48605
48606 #endif /* CONFIG_SYSFS */
48607 diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
48608 index 2660664..75fcb04 100644
48609 --- a/drivers/power/power_supply_core.c
48610 +++ b/drivers/power/power_supply_core.c
48611 @@ -28,7 +28,10 @@ EXPORT_SYMBOL_GPL(power_supply_class);
48612 ATOMIC_NOTIFIER_HEAD(power_supply_notifier);
48613 EXPORT_SYMBOL_GPL(power_supply_notifier);
48614
48615 -static struct device_type power_supply_dev_type;
48616 +extern const struct attribute_group *power_supply_attr_groups[];
48617 +static struct device_type power_supply_dev_type = {
48618 + .groups = power_supply_attr_groups,
48619 +};
48620
48621 static bool __power_supply_is_supplied_by(struct power_supply *supplier,
48622 struct power_supply *supply)
48623 @@ -628,7 +631,7 @@ static int __init power_supply_class_init(void)
48624 return PTR_ERR(power_supply_class);
48625
48626 power_supply_class->dev_uevent = power_supply_uevent;
48627 - power_supply_init_attrs(&power_supply_dev_type);
48628 + power_supply_init_attrs();
48629
48630 return 0;
48631 }
48632 diff --git a/drivers/power/power_supply_sysfs.c b/drivers/power/power_supply_sysfs.c
48633 index 44420d1..967126e 100644
48634 --- a/drivers/power/power_supply_sysfs.c
48635 +++ b/drivers/power/power_supply_sysfs.c
48636 @@ -230,17 +230,15 @@ static struct attribute_group power_supply_attr_group = {
48637 .is_visible = power_supply_attr_is_visible,
48638 };
48639
48640 -static const struct attribute_group *power_supply_attr_groups[] = {
48641 +const struct attribute_group *power_supply_attr_groups[] = {
48642 &power_supply_attr_group,
48643 NULL,
48644 };
48645
48646 -void power_supply_init_attrs(struct device_type *dev_type)
48647 +void power_supply_init_attrs(void)
48648 {
48649 int i;
48650
48651 - dev_type->groups = power_supply_attr_groups;
48652 -
48653 for (i = 0; i < ARRAY_SIZE(power_supply_attrs); i++)
48654 __power_supply_attrs[i] = &power_supply_attrs[i].attr;
48655 }
48656 diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
48657 index 84419af..268ede8 100644
48658 --- a/drivers/powercap/powercap_sys.c
48659 +++ b/drivers/powercap/powercap_sys.c
48660 @@ -154,8 +154,77 @@ struct powercap_constraint_attr {
48661 struct device_attribute name_attr;
48662 };
48663
48664 +static ssize_t show_constraint_name(struct device *dev,
48665 + struct device_attribute *dev_attr,
48666 + char *buf);
48667 +
48668 static struct powercap_constraint_attr
48669 - constraint_attrs[MAX_CONSTRAINTS_PER_ZONE];
48670 + constraint_attrs[MAX_CONSTRAINTS_PER_ZONE] = {
48671 + [0 ... MAX_CONSTRAINTS_PER_ZONE - 1] = {
48672 + .power_limit_attr = {
48673 + .attr = {
48674 + .name = NULL,
48675 + .mode = S_IWUSR | S_IRUGO
48676 + },
48677 + .show = show_constraint_power_limit_uw,
48678 + .store = store_constraint_power_limit_uw
48679 + },
48680 +
48681 + .time_window_attr = {
48682 + .attr = {
48683 + .name = NULL,
48684 + .mode = S_IWUSR | S_IRUGO
48685 + },
48686 + .show = show_constraint_time_window_us,
48687 + .store = store_constraint_time_window_us
48688 + },
48689 +
48690 + .max_power_attr = {
48691 + .attr = {
48692 + .name = NULL,
48693 + .mode = S_IRUGO
48694 + },
48695 + .show = show_constraint_max_power_uw,
48696 + .store = NULL
48697 + },
48698 +
48699 + .min_power_attr = {
48700 + .attr = {
48701 + .name = NULL,
48702 + .mode = S_IRUGO
48703 + },
48704 + .show = show_constraint_min_power_uw,
48705 + .store = NULL
48706 + },
48707 +
48708 + .max_time_window_attr = {
48709 + .attr = {
48710 + .name = NULL,
48711 + .mode = S_IRUGO
48712 + },
48713 + .show = show_constraint_max_time_window_us,
48714 + .store = NULL
48715 + },
48716 +
48717 + .min_time_window_attr = {
48718 + .attr = {
48719 + .name = NULL,
48720 + .mode = S_IRUGO
48721 + },
48722 + .show = show_constraint_min_time_window_us,
48723 + .store = NULL
48724 + },
48725 +
48726 + .name_attr = {
48727 + .attr = {
48728 + .name = NULL,
48729 + .mode = S_IRUGO
48730 + },
48731 + .show = show_constraint_name,
48732 + .store = NULL
48733 + }
48734 + }
48735 +};
48736
48737 /* A list of powercap control_types */
48738 static LIST_HEAD(powercap_cntrl_list);
48739 @@ -193,23 +262,16 @@ static ssize_t show_constraint_name(struct device *dev,
48740 }
48741
48742 static int create_constraint_attribute(int id, const char *name,
48743 - int mode,
48744 - struct device_attribute *dev_attr,
48745 - ssize_t (*show)(struct device *,
48746 - struct device_attribute *, char *),
48747 - ssize_t (*store)(struct device *,
48748 - struct device_attribute *,
48749 - const char *, size_t)
48750 - )
48751 + struct device_attribute *dev_attr)
48752 {
48753 + name = kasprintf(GFP_KERNEL, "constraint_%d_%s", id, name);
48754
48755 - dev_attr->attr.name = kasprintf(GFP_KERNEL, "constraint_%d_%s",
48756 - id, name);
48757 - if (!dev_attr->attr.name)
48758 + if (!name)
48759 return -ENOMEM;
48760 - dev_attr->attr.mode = mode;
48761 - dev_attr->show = show;
48762 - dev_attr->store = store;
48763 +
48764 + pax_open_kernel();
48765 + *(const char **)&dev_attr->attr.name = name;
48766 + pax_close_kernel();
48767
48768 return 0;
48769 }
48770 @@ -236,49 +298,31 @@ static int seed_constraint_attributes(void)
48771
48772 for (i = 0; i < MAX_CONSTRAINTS_PER_ZONE; ++i) {
48773 ret = create_constraint_attribute(i, "power_limit_uw",
48774 - S_IWUSR | S_IRUGO,
48775 - &constraint_attrs[i].power_limit_attr,
48776 - show_constraint_power_limit_uw,
48777 - store_constraint_power_limit_uw);
48778 + &constraint_attrs[i].power_limit_attr);
48779 if (ret)
48780 goto err_alloc;
48781 ret = create_constraint_attribute(i, "time_window_us",
48782 - S_IWUSR | S_IRUGO,
48783 - &constraint_attrs[i].time_window_attr,
48784 - show_constraint_time_window_us,
48785 - store_constraint_time_window_us);
48786 + &constraint_attrs[i].time_window_attr);
48787 if (ret)
48788 goto err_alloc;
48789 - ret = create_constraint_attribute(i, "name", S_IRUGO,
48790 - &constraint_attrs[i].name_attr,
48791 - show_constraint_name,
48792 - NULL);
48793 + ret = create_constraint_attribute(i, "name",
48794 + &constraint_attrs[i].name_attr);
48795 if (ret)
48796 goto err_alloc;
48797 - ret = create_constraint_attribute(i, "max_power_uw", S_IRUGO,
48798 - &constraint_attrs[i].max_power_attr,
48799 - show_constraint_max_power_uw,
48800 - NULL);
48801 + ret = create_constraint_attribute(i, "max_power_uw",
48802 + &constraint_attrs[i].max_power_attr);
48803 if (ret)
48804 goto err_alloc;
48805 - ret = create_constraint_attribute(i, "min_power_uw", S_IRUGO,
48806 - &constraint_attrs[i].min_power_attr,
48807 - show_constraint_min_power_uw,
48808 - NULL);
48809 + ret = create_constraint_attribute(i, "min_power_uw",
48810 + &constraint_attrs[i].min_power_attr);
48811 if (ret)
48812 goto err_alloc;
48813 ret = create_constraint_attribute(i, "max_time_window_us",
48814 - S_IRUGO,
48815 - &constraint_attrs[i].max_time_window_attr,
48816 - show_constraint_max_time_window_us,
48817 - NULL);
48818 + &constraint_attrs[i].max_time_window_attr);
48819 if (ret)
48820 goto err_alloc;
48821 ret = create_constraint_attribute(i, "min_time_window_us",
48822 - S_IRUGO,
48823 - &constraint_attrs[i].min_time_window_attr,
48824 - show_constraint_min_time_window_us,
48825 - NULL);
48826 + &constraint_attrs[i].min_time_window_attr);
48827 if (ret)
48828 goto err_alloc;
48829
48830 @@ -378,10 +422,12 @@ static void create_power_zone_common_attributes(
48831 power_zone->zone_dev_attrs[count++] =
48832 &dev_attr_max_energy_range_uj.attr;
48833 if (power_zone->ops->get_energy_uj) {
48834 + pax_open_kernel();
48835 if (power_zone->ops->reset_energy_uj)
48836 - dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
48837 + *(umode_t *)&dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
48838 else
48839 - dev_attr_energy_uj.attr.mode = S_IRUGO;
48840 + *(umode_t *)&dev_attr_energy_uj.attr.mode = S_IRUGO;
48841 + pax_close_kernel();
48842 power_zone->zone_dev_attrs[count++] =
48843 &dev_attr_energy_uj.attr;
48844 }
48845 diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
48846 index afca1bc..86840b8 100644
48847 --- a/drivers/regulator/core.c
48848 +++ b/drivers/regulator/core.c
48849 @@ -3366,7 +3366,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
48850 {
48851 const struct regulation_constraints *constraints = NULL;
48852 const struct regulator_init_data *init_data;
48853 - static atomic_t regulator_no = ATOMIC_INIT(0);
48854 + static atomic_unchecked_t regulator_no = ATOMIC_INIT(0);
48855 struct regulator_dev *rdev;
48856 struct device *dev;
48857 int ret, i;
48858 @@ -3436,7 +3436,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
48859 rdev->dev.of_node = config->of_node;
48860 rdev->dev.parent = dev;
48861 dev_set_name(&rdev->dev, "regulator.%d",
48862 - atomic_inc_return(&regulator_no) - 1);
48863 + atomic_inc_return_unchecked(&regulator_no) - 1);
48864 ret = device_register(&rdev->dev);
48865 if (ret != 0) {
48866 put_device(&rdev->dev);
48867 diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
48868 index 8d94d3d..653b623 100644
48869 --- a/drivers/regulator/max8660.c
48870 +++ b/drivers/regulator/max8660.c
48871 @@ -420,8 +420,10 @@ static int max8660_probe(struct i2c_client *client,
48872 max8660->shadow_regs[MAX8660_OVER1] = 5;
48873 } else {
48874 /* Otherwise devices can be toggled via software */
48875 - max8660_dcdc_ops.enable = max8660_dcdc_enable;
48876 - max8660_dcdc_ops.disable = max8660_dcdc_disable;
48877 + pax_open_kernel();
48878 + *(void **)&max8660_dcdc_ops.enable = max8660_dcdc_enable;
48879 + *(void **)&max8660_dcdc_ops.disable = max8660_dcdc_disable;
48880 + pax_close_kernel();
48881 }
48882
48883 /*
48884 diff --git a/drivers/regulator/max8973-regulator.c b/drivers/regulator/max8973-regulator.c
48885 index 892aa1e..ebd1b9c 100644
48886 --- a/drivers/regulator/max8973-regulator.c
48887 +++ b/drivers/regulator/max8973-regulator.c
48888 @@ -406,9 +406,11 @@ static int max8973_probe(struct i2c_client *client,
48889 if (!pdata || !pdata->enable_ext_control) {
48890 max->desc.enable_reg = MAX8973_VOUT;
48891 max->desc.enable_mask = MAX8973_VOUT_ENABLE;
48892 - max->ops.enable = regulator_enable_regmap;
48893 - max->ops.disable = regulator_disable_regmap;
48894 - max->ops.is_enabled = regulator_is_enabled_regmap;
48895 + pax_open_kernel();
48896 + *(void **)&max->ops.enable = regulator_enable_regmap;
48897 + *(void **)&max->ops.disable = regulator_disable_regmap;
48898 + *(void **)&max->ops.is_enabled = regulator_is_enabled_regmap;
48899 + pax_close_kernel();
48900 }
48901
48902 if (pdata) {
48903 diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
48904 index f374fa5..26f0683 100644
48905 --- a/drivers/regulator/mc13892-regulator.c
48906 +++ b/drivers/regulator/mc13892-regulator.c
48907 @@ -582,10 +582,12 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
48908 }
48909 mc13xxx_unlock(mc13892);
48910
48911 - mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
48912 + pax_open_kernel();
48913 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->set_mode
48914 = mc13892_vcam_set_mode;
48915 - mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
48916 + *(void **)&mc13892_regulators[MC13892_VCAM].desc.ops->get_mode
48917 = mc13892_vcam_get_mode;
48918 + pax_close_kernel();
48919
48920 mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
48921 ARRAY_SIZE(mc13892_regulators));
48922 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
48923 index cae212f..58a3980 100644
48924 --- a/drivers/rtc/rtc-cmos.c
48925 +++ b/drivers/rtc/rtc-cmos.c
48926 @@ -777,7 +777,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
48927 hpet_rtc_timer_init();
48928
48929 /* export at least the first block of NVRAM */
48930 - nvram.size = address_space - NVRAM_OFFSET;
48931 + pax_open_kernel();
48932 + *(size_t *)&nvram.size = address_space - NVRAM_OFFSET;
48933 + pax_close_kernel();
48934 retval = sysfs_create_bin_file(&dev->kobj, &nvram);
48935 if (retval < 0) {
48936 dev_dbg(dev, "can't create nvram file? %d\n", retval);
48937 diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
48938 index d049393..bb20be0 100644
48939 --- a/drivers/rtc/rtc-dev.c
48940 +++ b/drivers/rtc/rtc-dev.c
48941 @@ -16,6 +16,7 @@
48942 #include <linux/module.h>
48943 #include <linux/rtc.h>
48944 #include <linux/sched.h>
48945 +#include <linux/grsecurity.h>
48946 #include "rtc-core.h"
48947
48948 static dev_t rtc_devt;
48949 @@ -347,6 +348,8 @@ static long rtc_dev_ioctl(struct file *file,
48950 if (copy_from_user(&tm, uarg, sizeof(tm)))
48951 return -EFAULT;
48952
48953 + gr_log_timechange();
48954 +
48955 return rtc_set_time(rtc, &tm);
48956
48957 case RTC_PIE_ON:
48958 diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
48959 index 4e75345..09f8663 100644
48960 --- a/drivers/rtc/rtc-ds1307.c
48961 +++ b/drivers/rtc/rtc-ds1307.c
48962 @@ -107,7 +107,7 @@ struct ds1307 {
48963 u8 offset; /* register's offset */
48964 u8 regs[11];
48965 u16 nvram_offset;
48966 - struct bin_attribute *nvram;
48967 + bin_attribute_no_const *nvram;
48968 enum ds_type type;
48969 unsigned long flags;
48970 #define HAS_NVRAM 0 /* bit 0 == sysfs file active */
48971 diff --git a/drivers/rtc/rtc-m48t59.c b/drivers/rtc/rtc-m48t59.c
48972 index 11880c1..b823aa4 100644
48973 --- a/drivers/rtc/rtc-m48t59.c
48974 +++ b/drivers/rtc/rtc-m48t59.c
48975 @@ -483,7 +483,9 @@ static int m48t59_rtc_probe(struct platform_device *pdev)
48976 if (IS_ERR(m48t59->rtc))
48977 return PTR_ERR(m48t59->rtc);
48978
48979 - m48t59_nvram_attr.size = pdata->offset;
48980 + pax_open_kernel();
48981 + *(size_t *)&m48t59_nvram_attr.size = pdata->offset;
48982 + pax_close_kernel();
48983
48984 ret = sysfs_create_bin_file(&pdev->dev.kobj, &m48t59_nvram_attr);
48985 if (ret)
48986 diff --git a/drivers/scsi/aic7xxx/aic79xx_pci.c b/drivers/scsi/aic7xxx/aic79xx_pci.c
48987 index 14b5f8d..cc9bd26 100644
48988 --- a/drivers/scsi/aic7xxx/aic79xx_pci.c
48989 +++ b/drivers/scsi/aic7xxx/aic79xx_pci.c
48990 @@ -827,7 +827,7 @@ ahd_pci_intr(struct ahd_softc *ahd)
48991 for (bit = 0; bit < 8; bit++) {
48992
48993 if ((pci_status[i] & (0x1 << bit)) != 0) {
48994 - static const char *s;
48995 + const char *s;
48996
48997 s = pci_status_strings[bit];
48998 if (i == 7/*TARG*/ && bit == 3)
48999 @@ -887,23 +887,15 @@ ahd_pci_split_intr(struct ahd_softc *ahd, u_int intstat)
49000
49001 for (bit = 0; bit < 8; bit++) {
49002
49003 - if ((split_status[i] & (0x1 << bit)) != 0) {
49004 - static const char *s;
49005 -
49006 - s = split_status_strings[bit];
49007 - printk(s, ahd_name(ahd),
49008 + if ((split_status[i] & (0x1 << bit)) != 0)
49009 + printk(split_status_strings[bit], ahd_name(ahd),
49010 split_status_source[i]);
49011 - }
49012
49013 if (i > 1)
49014 continue;
49015
49016 - if ((sg_split_status[i] & (0x1 << bit)) != 0) {
49017 - static const char *s;
49018 -
49019 - s = split_status_strings[bit];
49020 - printk(s, ahd_name(ahd), "SG");
49021 - }
49022 + if ((sg_split_status[i] & (0x1 << bit)) != 0)
49023 + printk(split_status_strings[bit], ahd_name(ahd), "SG");
49024 }
49025 }
49026 /*
49027 diff --git a/drivers/scsi/bfa/bfa_fcpim.h b/drivers/scsi/bfa/bfa_fcpim.h
49028 index e693af6..2e525b6 100644
49029 --- a/drivers/scsi/bfa/bfa_fcpim.h
49030 +++ b/drivers/scsi/bfa/bfa_fcpim.h
49031 @@ -36,7 +36,7 @@ struct bfa_iotag_s {
49032
49033 struct bfa_itn_s {
49034 bfa_isr_func_t isr;
49035 -};
49036 +} __no_const;
49037
49038 void bfa_itn_create(struct bfa_s *bfa, struct bfa_rport_s *rport,
49039 void (*isr)(struct bfa_s *bfa, struct bfi_msg_s *m));
49040 diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
49041 index a3ab5cc..8143622 100644
49042 --- a/drivers/scsi/bfa/bfa_fcs.c
49043 +++ b/drivers/scsi/bfa/bfa_fcs.c
49044 @@ -38,10 +38,21 @@ struct bfa_fcs_mod_s {
49045 #define BFA_FCS_MODULE(_mod) { _mod ## _modinit, _mod ## _modexit }
49046
49047 static struct bfa_fcs_mod_s fcs_modules[] = {
49048 - { bfa_fcs_port_attach, NULL, NULL },
49049 - { bfa_fcs_uf_attach, NULL, NULL },
49050 - { bfa_fcs_fabric_attach, bfa_fcs_fabric_modinit,
49051 - bfa_fcs_fabric_modexit },
49052 + {
49053 + .attach = bfa_fcs_port_attach,
49054 + .modinit = NULL,
49055 + .modexit = NULL
49056 + },
49057 + {
49058 + .attach = bfa_fcs_uf_attach,
49059 + .modinit = NULL,
49060 + .modexit = NULL
49061 + },
49062 + {
49063 + .attach = bfa_fcs_fabric_attach,
49064 + .modinit = bfa_fcs_fabric_modinit,
49065 + .modexit = bfa_fcs_fabric_modexit
49066 + },
49067 };
49068
49069 /*
49070 diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
49071 index ff75ef8..2dfe00a 100644
49072 --- a/drivers/scsi/bfa/bfa_fcs_lport.c
49073 +++ b/drivers/scsi/bfa/bfa_fcs_lport.c
49074 @@ -89,15 +89,26 @@ static struct {
49075 void (*offline) (struct bfa_fcs_lport_s *port);
49076 } __port_action[] = {
49077 {
49078 - bfa_fcs_lport_unknown_init, bfa_fcs_lport_unknown_online,
49079 - bfa_fcs_lport_unknown_offline}, {
49080 - bfa_fcs_lport_fab_init, bfa_fcs_lport_fab_online,
49081 - bfa_fcs_lport_fab_offline}, {
49082 - bfa_fcs_lport_n2n_init, bfa_fcs_lport_n2n_online,
49083 - bfa_fcs_lport_n2n_offline}, {
49084 - bfa_fcs_lport_loop_init, bfa_fcs_lport_loop_online,
49085 - bfa_fcs_lport_loop_offline},
49086 - };
49087 + .init = bfa_fcs_lport_unknown_init,
49088 + .online = bfa_fcs_lport_unknown_online,
49089 + .offline = bfa_fcs_lport_unknown_offline
49090 + },
49091 + {
49092 + .init = bfa_fcs_lport_fab_init,
49093 + .online = bfa_fcs_lport_fab_online,
49094 + .offline = bfa_fcs_lport_fab_offline
49095 + },
49096 + {
49097 + .init = bfa_fcs_lport_n2n_init,
49098 + .online = bfa_fcs_lport_n2n_online,
49099 + .offline = bfa_fcs_lport_n2n_offline
49100 + },
49101 + {
49102 + .init = bfa_fcs_lport_loop_init,
49103 + .online = bfa_fcs_lport_loop_online,
49104 + .offline = bfa_fcs_lport_loop_offline
49105 + },
49106 +};
49107
49108 /*
49109 * fcs_port_sm FCS logical port state machine
49110 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
49111 index 2e28392..9d865b6 100644
49112 --- a/drivers/scsi/bfa/bfa_ioc.h
49113 +++ b/drivers/scsi/bfa/bfa_ioc.h
49114 @@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
49115 bfa_ioc_disable_cbfn_t disable_cbfn;
49116 bfa_ioc_hbfail_cbfn_t hbfail_cbfn;
49117 bfa_ioc_reset_cbfn_t reset_cbfn;
49118 -};
49119 +} __no_const;
49120
49121 /*
49122 * IOC event notification mechanism.
49123 @@ -352,7 +352,7 @@ struct bfa_ioc_hwif_s {
49124 void (*ioc_set_alt_fwstate) (struct bfa_ioc_s *ioc,
49125 enum bfi_ioc_state fwstate);
49126 enum bfi_ioc_state (*ioc_get_alt_fwstate) (struct bfa_ioc_s *ioc);
49127 -};
49128 +} __no_const;
49129
49130 /*
49131 * Queue element to wait for room in request queue. FIFO order is
49132 diff --git a/drivers/scsi/bfa/bfa_modules.h b/drivers/scsi/bfa/bfa_modules.h
49133 index a14c784..6de6790 100644
49134 --- a/drivers/scsi/bfa/bfa_modules.h
49135 +++ b/drivers/scsi/bfa/bfa_modules.h
49136 @@ -78,12 +78,12 @@ enum {
49137 \
49138 extern struct bfa_module_s hal_mod_ ## __mod; \
49139 struct bfa_module_s hal_mod_ ## __mod = { \
49140 - bfa_ ## __mod ## _meminfo, \
49141 - bfa_ ## __mod ## _attach, \
49142 - bfa_ ## __mod ## _detach, \
49143 - bfa_ ## __mod ## _start, \
49144 - bfa_ ## __mod ## _stop, \
49145 - bfa_ ## __mod ## _iocdisable, \
49146 + .meminfo = bfa_ ## __mod ## _meminfo, \
49147 + .attach = bfa_ ## __mod ## _attach, \
49148 + .detach = bfa_ ## __mod ## _detach, \
49149 + .start = bfa_ ## __mod ## _start, \
49150 + .stop = bfa_ ## __mod ## _stop, \
49151 + .iocdisable = bfa_ ## __mod ## _iocdisable, \
49152 }
49153
49154 #define BFA_CACHELINE_SZ (256)
49155 diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c
49156 index 045c4e1..13de803 100644
49157 --- a/drivers/scsi/fcoe/fcoe_sysfs.c
49158 +++ b/drivers/scsi/fcoe/fcoe_sysfs.c
49159 @@ -33,8 +33,8 @@
49160 */
49161 #include "libfcoe.h"
49162
49163 -static atomic_t ctlr_num;
49164 -static atomic_t fcf_num;
49165 +static atomic_unchecked_t ctlr_num;
49166 +static atomic_unchecked_t fcf_num;
49167
49168 /*
49169 * fcoe_fcf_dev_loss_tmo: the default number of seconds that fcoe sysfs
49170 @@ -685,7 +685,7 @@ struct fcoe_ctlr_device *fcoe_ctlr_device_add(struct device *parent,
49171 if (!ctlr)
49172 goto out;
49173
49174 - ctlr->id = atomic_inc_return(&ctlr_num) - 1;
49175 + ctlr->id = atomic_inc_return_unchecked(&ctlr_num) - 1;
49176 ctlr->f = f;
49177 ctlr->mode = FIP_CONN_TYPE_FABRIC;
49178 INIT_LIST_HEAD(&ctlr->fcfs);
49179 @@ -902,7 +902,7 @@ struct fcoe_fcf_device *fcoe_fcf_device_add(struct fcoe_ctlr_device *ctlr,
49180 fcf->dev.parent = &ctlr->dev;
49181 fcf->dev.bus = &fcoe_bus_type;
49182 fcf->dev.type = &fcoe_fcf_device_type;
49183 - fcf->id = atomic_inc_return(&fcf_num) - 1;
49184 + fcf->id = atomic_inc_return_unchecked(&fcf_num) - 1;
49185 fcf->state = FCOE_FCF_STATE_UNKNOWN;
49186
49187 fcf->dev_loss_tmo = ctlr->fcf_dev_loss_tmo;
49188 @@ -938,8 +938,8 @@ int __init fcoe_sysfs_setup(void)
49189 {
49190 int error;
49191
49192 - atomic_set(&ctlr_num, 0);
49193 - atomic_set(&fcf_num, 0);
49194 + atomic_set_unchecked(&ctlr_num, 0);
49195 + atomic_set_unchecked(&fcf_num, 0);
49196
49197 error = bus_register(&fcoe_bus_type);
49198 if (error)
49199 diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
49200 index f28ea07..34b16d3 100644
49201 --- a/drivers/scsi/hosts.c
49202 +++ b/drivers/scsi/hosts.c
49203 @@ -42,7 +42,7 @@
49204 #include "scsi_logging.h"
49205
49206
49207 -static atomic_t scsi_host_next_hn = ATOMIC_INIT(0); /* host_no for next new host */
49208 +static atomic_unchecked_t scsi_host_next_hn = ATOMIC_INIT(0); /* host_no for next new host */
49209
49210
49211 static void scsi_host_cls_release(struct device *dev)
49212 @@ -369,7 +369,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
49213 * subtract one because we increment first then return, but we need to
49214 * know what the next host number was before increment
49215 */
49216 - shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
49217 + shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
49218 shost->dma_channel = 0xff;
49219
49220 /* These three are default values which can be overridden */
49221 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
49222 index 868318a..e07ef3b 100644
49223 --- a/drivers/scsi/hpsa.c
49224 +++ b/drivers/scsi/hpsa.c
49225 @@ -571,7 +571,7 @@ static inline u32 next_command(struct ctlr_info *h, u8 q)
49226 unsigned long flags;
49227
49228 if (unlikely(!(h->transMethod & CFGTBL_Trans_Performant)))
49229 - return h->access.command_completed(h, q);
49230 + return h->access->command_completed(h, q);
49231
49232 if ((rq->head[rq->current_entry] & 1) == rq->wraparound) {
49233 a = rq->head[rq->current_entry];
49234 @@ -3474,7 +3474,7 @@ static void start_io(struct ctlr_info *h)
49235 while (!list_empty(&h->reqQ)) {
49236 c = list_entry(h->reqQ.next, struct CommandList, list);
49237 /* can't do anything if fifo is full */
49238 - if ((h->access.fifo_full(h))) {
49239 + if ((h->access->fifo_full(h))) {
49240 h->fifo_recently_full = 1;
49241 dev_warn(&h->pdev->dev, "fifo full\n");
49242 break;
49243 @@ -3498,7 +3498,7 @@ static void start_io(struct ctlr_info *h)
49244
49245 /* Tell the controller execute command */
49246 spin_unlock_irqrestore(&h->lock, flags);
49247 - h->access.submit_command(h, c);
49248 + h->access->submit_command(h, c);
49249 spin_lock_irqsave(&h->lock, flags);
49250 }
49251 spin_unlock_irqrestore(&h->lock, flags);
49252 @@ -3506,17 +3506,17 @@ static void start_io(struct ctlr_info *h)
49253
49254 static inline unsigned long get_next_completion(struct ctlr_info *h, u8 q)
49255 {
49256 - return h->access.command_completed(h, q);
49257 + return h->access->command_completed(h, q);
49258 }
49259
49260 static inline bool interrupt_pending(struct ctlr_info *h)
49261 {
49262 - return h->access.intr_pending(h);
49263 + return h->access->intr_pending(h);
49264 }
49265
49266 static inline long interrupt_not_for_us(struct ctlr_info *h)
49267 {
49268 - return (h->access.intr_pending(h) == 0) ||
49269 + return (h->access->intr_pending(h) == 0) ||
49270 (h->interrupts_enabled == 0);
49271 }
49272
49273 @@ -4442,7 +4442,7 @@ static int hpsa_pci_init(struct ctlr_info *h)
49274 if (prod_index < 0)
49275 return -ENODEV;
49276 h->product_name = products[prod_index].product_name;
49277 - h->access = *(products[prod_index].access);
49278 + h->access = products[prod_index].access;
49279
49280 pci_disable_link_state(h->pdev, PCIE_LINK_STATE_L0S |
49281 PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM);
49282 @@ -4712,7 +4712,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
49283 {
49284 unsigned long flags;
49285
49286 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
49287 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
49288 spin_lock_irqsave(&h->lock, flags);
49289 h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
49290 spin_unlock_irqrestore(&h->lock, flags);
49291 @@ -4843,7 +4843,7 @@ reinit_after_soft_reset:
49292 }
49293
49294 /* make sure the board interrupts are off */
49295 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
49296 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
49297
49298 if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
49299 goto clean2;
49300 @@ -4877,7 +4877,7 @@ reinit_after_soft_reset:
49301 * fake ones to scoop up any residual completions.
49302 */
49303 spin_lock_irqsave(&h->lock, flags);
49304 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
49305 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
49306 spin_unlock_irqrestore(&h->lock, flags);
49307 free_irqs(h);
49308 rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
49309 @@ -4896,9 +4896,9 @@ reinit_after_soft_reset:
49310 dev_info(&h->pdev->dev, "Board READY.\n");
49311 dev_info(&h->pdev->dev,
49312 "Waiting for stale completions to drain.\n");
49313 - h->access.set_intr_mask(h, HPSA_INTR_ON);
49314 + h->access->set_intr_mask(h, HPSA_INTR_ON);
49315 msleep(10000);
49316 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
49317 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
49318
49319 rc = controller_reset_failed(h->cfgtable);
49320 if (rc)
49321 @@ -4919,7 +4919,7 @@ reinit_after_soft_reset:
49322 }
49323
49324 /* Turn the interrupts on so we can service requests */
49325 - h->access.set_intr_mask(h, HPSA_INTR_ON);
49326 + h->access->set_intr_mask(h, HPSA_INTR_ON);
49327
49328 hpsa_hba_inquiry(h);
49329 hpsa_register_scsi(h); /* hook ourselves into SCSI subsystem */
49330 @@ -4988,7 +4988,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
49331 * To write all data in the battery backed cache to disks
49332 */
49333 hpsa_flush_cache(h);
49334 - h->access.set_intr_mask(h, HPSA_INTR_OFF);
49335 + h->access->set_intr_mask(h, HPSA_INTR_OFF);
49336 hpsa_free_irqs_and_disable_msix(h);
49337 }
49338
49339 @@ -5162,7 +5162,7 @@ static void hpsa_enter_performant_mode(struct ctlr_info *h, u32 use_short_tags)
49340 return;
49341 }
49342 /* Change the access methods to the performant access methods */
49343 - h->access = SA5_performant_access;
49344 + h->access = &SA5_performant_access;
49345 h->transMethod = CFGTBL_Trans_Performant;
49346 }
49347
49348 diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h
49349 index 01c3283..4655219 100644
49350 --- a/drivers/scsi/hpsa.h
49351 +++ b/drivers/scsi/hpsa.h
49352 @@ -79,7 +79,7 @@ struct ctlr_info {
49353 unsigned int msix_vector;
49354 unsigned int msi_vector;
49355 int intr_mode; /* either PERF_MODE_INT or SIMPLE_MODE_INT */
49356 - struct access_method access;
49357 + struct access_method *access;
49358
49359 /* queue and queue Info */
49360 struct list_head reqQ;
49361 @@ -388,19 +388,19 @@ static bool SA5_performant_intr_pending(struct ctlr_info *h)
49362 }
49363
49364 static struct access_method SA5_access = {
49365 - SA5_submit_command,
49366 - SA5_intr_mask,
49367 - SA5_fifo_full,
49368 - SA5_intr_pending,
49369 - SA5_completed,
49370 + .submit_command = SA5_submit_command,
49371 + .set_intr_mask = SA5_intr_mask,
49372 + .fifo_full = SA5_fifo_full,
49373 + .intr_pending = SA5_intr_pending,
49374 + .command_completed = SA5_completed,
49375 };
49376
49377 static struct access_method SA5_performant_access = {
49378 - SA5_submit_command,
49379 - SA5_performant_intr_mask,
49380 - SA5_fifo_full,
49381 - SA5_performant_intr_pending,
49382 - SA5_performant_completed,
49383 + .submit_command = SA5_submit_command,
49384 + .set_intr_mask = SA5_performant_intr_mask,
49385 + .fifo_full = SA5_fifo_full,
49386 + .intr_pending = SA5_performant_intr_pending,
49387 + .command_completed = SA5_performant_completed,
49388 };
49389
49390 struct board_type {
49391 diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
49392 index 1b3a094..068e683 100644
49393 --- a/drivers/scsi/libfc/fc_exch.c
49394 +++ b/drivers/scsi/libfc/fc_exch.c
49395 @@ -101,12 +101,12 @@ struct fc_exch_mgr {
49396 u16 pool_max_index;
49397
49398 struct {
49399 - atomic_t no_free_exch;
49400 - atomic_t no_free_exch_xid;
49401 - atomic_t xid_not_found;
49402 - atomic_t xid_busy;
49403 - atomic_t seq_not_found;
49404 - atomic_t non_bls_resp;
49405 + atomic_unchecked_t no_free_exch;
49406 + atomic_unchecked_t no_free_exch_xid;
49407 + atomic_unchecked_t xid_not_found;
49408 + atomic_unchecked_t xid_busy;
49409 + atomic_unchecked_t seq_not_found;
49410 + atomic_unchecked_t non_bls_resp;
49411 } stats;
49412 };
49413
49414 @@ -811,7 +811,7 @@ static struct fc_exch *fc_exch_em_alloc(struct fc_lport *lport,
49415 /* allocate memory for exchange */
49416 ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
49417 if (!ep) {
49418 - atomic_inc(&mp->stats.no_free_exch);
49419 + atomic_inc_unchecked(&mp->stats.no_free_exch);
49420 goto out;
49421 }
49422 memset(ep, 0, sizeof(*ep));
49423 @@ -874,7 +874,7 @@ out:
49424 return ep;
49425 err:
49426 spin_unlock_bh(&pool->lock);
49427 - atomic_inc(&mp->stats.no_free_exch_xid);
49428 + atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
49429 mempool_free(ep, mp->ep_pool);
49430 return NULL;
49431 }
49432 @@ -1023,7 +1023,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
49433 xid = ntohs(fh->fh_ox_id); /* we originated exch */
49434 ep = fc_exch_find(mp, xid);
49435 if (!ep) {
49436 - atomic_inc(&mp->stats.xid_not_found);
49437 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49438 reject = FC_RJT_OX_ID;
49439 goto out;
49440 }
49441 @@ -1053,7 +1053,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
49442 ep = fc_exch_find(mp, xid);
49443 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
49444 if (ep) {
49445 - atomic_inc(&mp->stats.xid_busy);
49446 + atomic_inc_unchecked(&mp->stats.xid_busy);
49447 reject = FC_RJT_RX_ID;
49448 goto rel;
49449 }
49450 @@ -1064,7 +1064,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
49451 }
49452 xid = ep->xid; /* get our XID */
49453 } else if (!ep) {
49454 - atomic_inc(&mp->stats.xid_not_found);
49455 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49456 reject = FC_RJT_RX_ID; /* XID not found */
49457 goto out;
49458 }
49459 @@ -1082,7 +1082,7 @@ static enum fc_pf_rjt_reason fc_seq_lookup_recip(struct fc_lport *lport,
49460 } else {
49461 sp = &ep->seq;
49462 if (sp->id != fh->fh_seq_id) {
49463 - atomic_inc(&mp->stats.seq_not_found);
49464 + atomic_inc_unchecked(&mp->stats.seq_not_found);
49465 if (f_ctl & FC_FC_END_SEQ) {
49466 /*
49467 * Update sequence_id based on incoming last
49468 @@ -1533,22 +1533,22 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
49469
49470 ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
49471 if (!ep) {
49472 - atomic_inc(&mp->stats.xid_not_found);
49473 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49474 goto out;
49475 }
49476 if (ep->esb_stat & ESB_ST_COMPLETE) {
49477 - atomic_inc(&mp->stats.xid_not_found);
49478 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49479 goto rel;
49480 }
49481 if (ep->rxid == FC_XID_UNKNOWN)
49482 ep->rxid = ntohs(fh->fh_rx_id);
49483 if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
49484 - atomic_inc(&mp->stats.xid_not_found);
49485 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49486 goto rel;
49487 }
49488 if (ep->did != ntoh24(fh->fh_s_id) &&
49489 ep->did != FC_FID_FLOGI) {
49490 - atomic_inc(&mp->stats.xid_not_found);
49491 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49492 goto rel;
49493 }
49494 sof = fr_sof(fp);
49495 @@ -1557,7 +1557,7 @@ static void fc_exch_recv_seq_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
49496 sp->ssb_stat |= SSB_ST_RESP;
49497 sp->id = fh->fh_seq_id;
49498 } else if (sp->id != fh->fh_seq_id) {
49499 - atomic_inc(&mp->stats.seq_not_found);
49500 + atomic_inc_unchecked(&mp->stats.seq_not_found);
49501 goto rel;
49502 }
49503
49504 @@ -1619,9 +1619,9 @@ static void fc_exch_recv_resp(struct fc_exch_mgr *mp, struct fc_frame *fp)
49505 sp = fc_seq_lookup_orig(mp, fp); /* doesn't hold sequence */
49506
49507 if (!sp)
49508 - atomic_inc(&mp->stats.xid_not_found);
49509 + atomic_inc_unchecked(&mp->stats.xid_not_found);
49510 else
49511 - atomic_inc(&mp->stats.non_bls_resp);
49512 + atomic_inc_unchecked(&mp->stats.non_bls_resp);
49513
49514 fc_frame_free(fp);
49515 }
49516 @@ -2261,13 +2261,13 @@ void fc_exch_update_stats(struct fc_lport *lport)
49517
49518 list_for_each_entry(ema, &lport->ema_list, ema_list) {
49519 mp = ema->mp;
49520 - st->fc_no_free_exch += atomic_read(&mp->stats.no_free_exch);
49521 + st->fc_no_free_exch += atomic_read_unchecked(&mp->stats.no_free_exch);
49522 st->fc_no_free_exch_xid +=
49523 - atomic_read(&mp->stats.no_free_exch_xid);
49524 - st->fc_xid_not_found += atomic_read(&mp->stats.xid_not_found);
49525 - st->fc_xid_busy += atomic_read(&mp->stats.xid_busy);
49526 - st->fc_seq_not_found += atomic_read(&mp->stats.seq_not_found);
49527 - st->fc_non_bls_resp += atomic_read(&mp->stats.non_bls_resp);
49528 + atomic_read_unchecked(&mp->stats.no_free_exch_xid);
49529 + st->fc_xid_not_found += atomic_read_unchecked(&mp->stats.xid_not_found);
49530 + st->fc_xid_busy += atomic_read_unchecked(&mp->stats.xid_busy);
49531 + st->fc_seq_not_found += atomic_read_unchecked(&mp->stats.seq_not_found);
49532 + st->fc_non_bls_resp += atomic_read_unchecked(&mp->stats.non_bls_resp);
49533 }
49534 }
49535 EXPORT_SYMBOL(fc_exch_update_stats);
49536 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
49537 index d289583..b745eec 100644
49538 --- a/drivers/scsi/libsas/sas_ata.c
49539 +++ b/drivers/scsi/libsas/sas_ata.c
49540 @@ -554,7 +554,7 @@ static struct ata_port_operations sas_sata_ops = {
49541 .postreset = ata_std_postreset,
49542 .error_handler = ata_std_error_handler,
49543 .post_internal_cmd = sas_ata_post_internal,
49544 - .qc_defer = ata_std_qc_defer,
49545 + .qc_defer = ata_std_qc_defer,
49546 .qc_prep = ata_noop_qc_prep,
49547 .qc_issue = sas_ata_qc_issue,
49548 .qc_fill_rtf = sas_ata_qc_fill_rtf,
49549 diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
49550 index 4e1b75c..0bbdfa9 100644
49551 --- a/drivers/scsi/lpfc/lpfc.h
49552 +++ b/drivers/scsi/lpfc/lpfc.h
49553 @@ -432,7 +432,7 @@ struct lpfc_vport {
49554 struct dentry *debug_nodelist;
49555 struct dentry *vport_debugfs_root;
49556 struct lpfc_debugfs_trc *disc_trc;
49557 - atomic_t disc_trc_cnt;
49558 + atomic_unchecked_t disc_trc_cnt;
49559 #endif
49560 uint8_t stat_data_enabled;
49561 uint8_t stat_data_blocked;
49562 @@ -865,8 +865,8 @@ struct lpfc_hba {
49563 struct timer_list fabric_block_timer;
49564 unsigned long bit_flags;
49565 #define FABRIC_COMANDS_BLOCKED 0
49566 - atomic_t num_rsrc_err;
49567 - atomic_t num_cmd_success;
49568 + atomic_unchecked_t num_rsrc_err;
49569 + atomic_unchecked_t num_cmd_success;
49570 unsigned long last_rsrc_error_time;
49571 unsigned long last_ramp_down_time;
49572 unsigned long last_ramp_up_time;
49573 @@ -902,7 +902,7 @@ struct lpfc_hba {
49574
49575 struct dentry *debug_slow_ring_trc;
49576 struct lpfc_debugfs_trc *slow_ring_trc;
49577 - atomic_t slow_ring_trc_cnt;
49578 + atomic_unchecked_t slow_ring_trc_cnt;
49579 /* iDiag debugfs sub-directory */
49580 struct dentry *idiag_root;
49581 struct dentry *idiag_pci_cfg;
49582 diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
49583 index b800cc9..16b6a91 100644
49584 --- a/drivers/scsi/lpfc/lpfc_debugfs.c
49585 +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
49586 @@ -106,7 +106,7 @@ MODULE_PARM_DESC(lpfc_debugfs_mask_disc_trc,
49587
49588 #include <linux/debugfs.h>
49589
49590 -static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
49591 +static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
49592 static unsigned long lpfc_debugfs_start_time = 0L;
49593
49594 /* iDiag */
49595 @@ -147,7 +147,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_vport *vport, char *buf, int size)
49596 lpfc_debugfs_enable = 0;
49597
49598 len = 0;
49599 - index = (atomic_read(&vport->disc_trc_cnt) + 1) &
49600 + index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
49601 (lpfc_debugfs_max_disc_trc - 1);
49602 for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
49603 dtp = vport->disc_trc + i;
49604 @@ -213,7 +213,7 @@ lpfc_debugfs_slow_ring_trc_data(struct lpfc_hba *phba, char *buf, int size)
49605 lpfc_debugfs_enable = 0;
49606
49607 len = 0;
49608 - index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
49609 + index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
49610 (lpfc_debugfs_max_slow_ring_trc - 1);
49611 for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
49612 dtp = phba->slow_ring_trc + i;
49613 @@ -646,14 +646,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport *vport, int mask, char *fmt,
49614 !vport || !vport->disc_trc)
49615 return;
49616
49617 - index = atomic_inc_return(&vport->disc_trc_cnt) &
49618 + index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
49619 (lpfc_debugfs_max_disc_trc - 1);
49620 dtp = vport->disc_trc + index;
49621 dtp->fmt = fmt;
49622 dtp->data1 = data1;
49623 dtp->data2 = data2;
49624 dtp->data3 = data3;
49625 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
49626 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
49627 dtp->jif = jiffies;
49628 #endif
49629 return;
49630 @@ -684,14 +684,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_hba *phba, char *fmt,
49631 !phba || !phba->slow_ring_trc)
49632 return;
49633
49634 - index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
49635 + index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
49636 (lpfc_debugfs_max_slow_ring_trc - 1);
49637 dtp = phba->slow_ring_trc + index;
49638 dtp->fmt = fmt;
49639 dtp->data1 = data1;
49640 dtp->data2 = data2;
49641 dtp->data3 = data3;
49642 - dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
49643 + dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
49644 dtp->jif = jiffies;
49645 #endif
49646 return;
49647 @@ -4168,7 +4168,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
49648 "slow_ring buffer\n");
49649 goto debug_failed;
49650 }
49651 - atomic_set(&phba->slow_ring_trc_cnt, 0);
49652 + atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
49653 memset(phba->slow_ring_trc, 0,
49654 (sizeof(struct lpfc_debugfs_trc) *
49655 lpfc_debugfs_max_slow_ring_trc));
49656 @@ -4214,7 +4214,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport)
49657 "buffer\n");
49658 goto debug_failed;
49659 }
49660 - atomic_set(&vport->disc_trc_cnt, 0);
49661 + atomic_set_unchecked(&vport->disc_trc_cnt, 0);
49662
49663 snprintf(name, sizeof(name), "discovery_trace");
49664 vport->debug_disc_trc =
49665 diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
49666 index 68c94cc..8c27be5 100644
49667 --- a/drivers/scsi/lpfc/lpfc_init.c
49668 +++ b/drivers/scsi/lpfc/lpfc_init.c
49669 @@ -10949,8 +10949,10 @@ lpfc_init(void)
49670 "misc_register returned with status %d", error);
49671
49672 if (lpfc_enable_npiv) {
49673 - lpfc_transport_functions.vport_create = lpfc_vport_create;
49674 - lpfc_transport_functions.vport_delete = lpfc_vport_delete;
49675 + pax_open_kernel();
49676 + *(void **)&lpfc_transport_functions.vport_create = lpfc_vport_create;
49677 + *(void **)&lpfc_transport_functions.vport_delete = lpfc_vport_delete;
49678 + pax_close_kernel();
49679 }
49680 lpfc_transport_template =
49681 fc_attach_transport(&lpfc_transport_functions);
49682 diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
49683 index b2ede05..aaf482ca 100644
49684 --- a/drivers/scsi/lpfc/lpfc_scsi.c
49685 +++ b/drivers/scsi/lpfc/lpfc_scsi.c
49686 @@ -353,7 +353,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hba *phba)
49687 uint32_t evt_posted;
49688
49689 spin_lock_irqsave(&phba->hbalock, flags);
49690 - atomic_inc(&phba->num_rsrc_err);
49691 + atomic_inc_unchecked(&phba->num_rsrc_err);
49692 phba->last_rsrc_error_time = jiffies;
49693
49694 if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
49695 @@ -394,7 +394,7 @@ lpfc_rampup_queue_depth(struct lpfc_vport *vport,
49696 unsigned long flags;
49697 struct lpfc_hba *phba = vport->phba;
49698 uint32_t evt_posted;
49699 - atomic_inc(&phba->num_cmd_success);
49700 + atomic_inc_unchecked(&phba->num_cmd_success);
49701
49702 if (vport->cfg_lun_queue_depth <= queue_depth)
49703 return;
49704 @@ -438,8 +438,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
49705 unsigned long num_rsrc_err, num_cmd_success;
49706 int i;
49707
49708 - num_rsrc_err = atomic_read(&phba->num_rsrc_err);
49709 - num_cmd_success = atomic_read(&phba->num_cmd_success);
49710 + num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
49711 + num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
49712
49713 /*
49714 * The error and success command counters are global per
49715 @@ -467,8 +467,8 @@ lpfc_ramp_down_queue_handler(struct lpfc_hba *phba)
49716 }
49717 }
49718 lpfc_destroy_vport_work_array(phba, vports);
49719 - atomic_set(&phba->num_rsrc_err, 0);
49720 - atomic_set(&phba->num_cmd_success, 0);
49721 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
49722 + atomic_set_unchecked(&phba->num_cmd_success, 0);
49723 }
49724
49725 /**
49726 @@ -502,8 +502,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_hba *phba)
49727 }
49728 }
49729 lpfc_destroy_vport_work_array(phba, vports);
49730 - atomic_set(&phba->num_rsrc_err, 0);
49731 - atomic_set(&phba->num_cmd_success, 0);
49732 + atomic_set_unchecked(&phba->num_rsrc_err, 0);
49733 + atomic_set_unchecked(&phba->num_cmd_success, 0);
49734 }
49735
49736 /**
49737 diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
49738 index 6fd7d40..b444223 100644
49739 --- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
49740 +++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
49741 @@ -1557,7 +1557,7 @@ _scsih_get_resync(struct device *dev)
49742 {
49743 struct scsi_device *sdev = to_scsi_device(dev);
49744 struct MPT2SAS_ADAPTER *ioc = shost_priv(sdev->host);
49745 - static struct _raid_device *raid_device;
49746 + struct _raid_device *raid_device;
49747 unsigned long flags;
49748 Mpi2RaidVolPage0_t vol_pg0;
49749 Mpi2ConfigReply_t mpi_reply;
49750 @@ -1609,7 +1609,7 @@ _scsih_get_state(struct device *dev)
49751 {
49752 struct scsi_device *sdev = to_scsi_device(dev);
49753 struct MPT2SAS_ADAPTER *ioc = shost_priv(sdev->host);
49754 - static struct _raid_device *raid_device;
49755 + struct _raid_device *raid_device;
49756 unsigned long flags;
49757 Mpi2RaidVolPage0_t vol_pg0;
49758 Mpi2ConfigReply_t mpi_reply;
49759 @@ -6637,7 +6637,7 @@ _scsih_sas_ir_operation_status_event(struct MPT2SAS_ADAPTER *ioc,
49760 struct fw_event_work *fw_event)
49761 {
49762 Mpi2EventDataIrOperationStatus_t *event_data = fw_event->event_data;
49763 - static struct _raid_device *raid_device;
49764 + struct _raid_device *raid_device;
49765 unsigned long flags;
49766 u16 handle;
49767
49768 @@ -7108,7 +7108,7 @@ _scsih_scan_for_devices_after_reset(struct MPT2SAS_ADAPTER *ioc)
49769 u64 sas_address;
49770 struct _sas_device *sas_device;
49771 struct _sas_node *expander_device;
49772 - static struct _raid_device *raid_device;
49773 + struct _raid_device *raid_device;
49774 u8 retry_count;
49775 unsigned long flags;
49776
49777 diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
49778 index be8ce54..94ed33a 100644
49779 --- a/drivers/scsi/pmcraid.c
49780 +++ b/drivers/scsi/pmcraid.c
49781 @@ -200,8 +200,8 @@ static int pmcraid_slave_alloc(struct scsi_device *scsi_dev)
49782 res->scsi_dev = scsi_dev;
49783 scsi_dev->hostdata = res;
49784 res->change_detected = 0;
49785 - atomic_set(&res->read_failures, 0);
49786 - atomic_set(&res->write_failures, 0);
49787 + atomic_set_unchecked(&res->read_failures, 0);
49788 + atomic_set_unchecked(&res->write_failures, 0);
49789 rc = 0;
49790 }
49791 spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
49792 @@ -2687,9 +2687,9 @@ static int pmcraid_error_handler(struct pmcraid_cmd *cmd)
49793
49794 /* If this was a SCSI read/write command keep count of errors */
49795 if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
49796 - atomic_inc(&res->read_failures);
49797 + atomic_inc_unchecked(&res->read_failures);
49798 else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
49799 - atomic_inc(&res->write_failures);
49800 + atomic_inc_unchecked(&res->write_failures);
49801
49802 if (!RES_IS_GSCSI(res->cfg_entry) &&
49803 masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
49804 @@ -3545,7 +3545,7 @@ static int pmcraid_queuecommand_lck(
49805 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
49806 * hrrq_id assigned here in queuecommand
49807 */
49808 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
49809 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
49810 pinstance->num_hrrq;
49811 cmd->cmd_done = pmcraid_io_done;
49812
49813 @@ -3857,7 +3857,7 @@ static long pmcraid_ioctl_passthrough(
49814 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
49815 * hrrq_id assigned here in queuecommand
49816 */
49817 - ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
49818 + ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
49819 pinstance->num_hrrq;
49820
49821 if (request_size) {
49822 @@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(struct work_struct *workp)
49823
49824 pinstance = container_of(workp, struct pmcraid_instance, worker_q);
49825 /* add resources only after host is added into system */
49826 - if (!atomic_read(&pinstance->expose_resources))
49827 + if (!atomic_read_unchecked(&pinstance->expose_resources))
49828 return;
49829
49830 fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
49831 @@ -5322,8 +5322,8 @@ static int pmcraid_init_instance(struct pci_dev *pdev, struct Scsi_Host *host,
49832 init_waitqueue_head(&pinstance->reset_wait_q);
49833
49834 atomic_set(&pinstance->outstanding_cmds, 0);
49835 - atomic_set(&pinstance->last_message_id, 0);
49836 - atomic_set(&pinstance->expose_resources, 0);
49837 + atomic_set_unchecked(&pinstance->last_message_id, 0);
49838 + atomic_set_unchecked(&pinstance->expose_resources, 0);
49839
49840 INIT_LIST_HEAD(&pinstance->free_res_q);
49841 INIT_LIST_HEAD(&pinstance->used_res_q);
49842 @@ -6036,7 +6036,7 @@ static int pmcraid_probe(struct pci_dev *pdev,
49843 /* Schedule worker thread to handle CCN and take care of adding and
49844 * removing devices to OS
49845 */
49846 - atomic_set(&pinstance->expose_resources, 1);
49847 + atomic_set_unchecked(&pinstance->expose_resources, 1);
49848 schedule_work(&pinstance->worker_q);
49849 return rc;
49850
49851 diff --git a/drivers/scsi/pmcraid.h b/drivers/scsi/pmcraid.h
49852 index e1d150f..6c6df44 100644
49853 --- a/drivers/scsi/pmcraid.h
49854 +++ b/drivers/scsi/pmcraid.h
49855 @@ -748,7 +748,7 @@ struct pmcraid_instance {
49856 struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
49857
49858 /* Message id as filled in last fired IOARCB, used to identify HRRQ */
49859 - atomic_t last_message_id;
49860 + atomic_unchecked_t last_message_id;
49861
49862 /* configuration table */
49863 struct pmcraid_config_table *cfg_table;
49864 @@ -777,7 +777,7 @@ struct pmcraid_instance {
49865 atomic_t outstanding_cmds;
49866
49867 /* should add/delete resources to mid-layer now ?*/
49868 - atomic_t expose_resources;
49869 + atomic_unchecked_t expose_resources;
49870
49871
49872
49873 @@ -813,8 +813,8 @@ struct pmcraid_resource_entry {
49874 struct pmcraid_config_table_entry_ext cfg_entry_ext;
49875 };
49876 struct scsi_device *scsi_dev; /* Link scsi_device structure */
49877 - atomic_t read_failures; /* count of failed READ commands */
49878 - atomic_t write_failures; /* count of failed WRITE commands */
49879 + atomic_unchecked_t read_failures; /* count of failed READ commands */
49880 + atomic_unchecked_t write_failures; /* count of failed WRITE commands */
49881
49882 /* To indicate add/delete/modify during CCN */
49883 u8 change_detected;
49884 diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
49885 index 4a0d7c9..3d658d7 100644
49886 --- a/drivers/scsi/qla2xxx/qla_attr.c
49887 +++ b/drivers/scsi/qla2xxx/qla_attr.c
49888 @@ -2038,7 +2038,7 @@ qla24xx_vport_disable(struct fc_vport *fc_vport, bool disable)
49889 return 0;
49890 }
49891
49892 -struct fc_function_template qla2xxx_transport_functions = {
49893 +fc_function_template_no_const qla2xxx_transport_functions = {
49894
49895 .show_host_node_name = 1,
49896 .show_host_port_name = 1,
49897 @@ -2086,7 +2086,7 @@ struct fc_function_template qla2xxx_transport_functions = {
49898 .bsg_timeout = qla24xx_bsg_timeout,
49899 };
49900
49901 -struct fc_function_template qla2xxx_transport_vport_functions = {
49902 +fc_function_template_no_const qla2xxx_transport_vport_functions = {
49903
49904 .show_host_node_name = 1,
49905 .show_host_port_name = 1,
49906 diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
49907 index 1f42662..bf9836c 100644
49908 --- a/drivers/scsi/qla2xxx/qla_gbl.h
49909 +++ b/drivers/scsi/qla2xxx/qla_gbl.h
49910 @@ -546,8 +546,8 @@ extern void qla2x00_get_sym_node_name(scsi_qla_host_t *, uint8_t *);
49911 struct device_attribute;
49912 extern struct device_attribute *qla2x00_host_attrs[];
49913 struct fc_function_template;
49914 -extern struct fc_function_template qla2xxx_transport_functions;
49915 -extern struct fc_function_template qla2xxx_transport_vport_functions;
49916 +extern fc_function_template_no_const qla2xxx_transport_functions;
49917 +extern fc_function_template_no_const qla2xxx_transport_vport_functions;
49918 extern void qla2x00_alloc_sysfs_attr(scsi_qla_host_t *);
49919 extern void qla2x00_free_sysfs_attr(scsi_qla_host_t *, bool);
49920 extern void qla2x00_init_host_attr(scsi_qla_host_t *);
49921 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
49922 index 83cb612..9b7b08c 100644
49923 --- a/drivers/scsi/qla2xxx/qla_os.c
49924 +++ b/drivers/scsi/qla2xxx/qla_os.c
49925 @@ -1491,8 +1491,10 @@ qla2x00_config_dma_addressing(struct qla_hw_data *ha)
49926 !pci_set_consistent_dma_mask(ha->pdev, DMA_BIT_MASK(64))) {
49927 /* Ok, a 64bit DMA mask is applicable. */
49928 ha->flags.enable_64bit_addressing = 1;
49929 - ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
49930 - ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
49931 + pax_open_kernel();
49932 + *(void **)&ha->isp_ops->calc_req_entries = qla2x00_calc_iocbs_64;
49933 + *(void **)&ha->isp_ops->build_iocbs = qla2x00_build_scsi_iocbs_64;
49934 + pax_close_kernel();
49935 return;
49936 }
49937 }
49938 diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
49939 index aa67bb9..06d0e2a 100644
49940 --- a/drivers/scsi/qla4xxx/ql4_def.h
49941 +++ b/drivers/scsi/qla4xxx/ql4_def.h
49942 @@ -303,7 +303,7 @@ struct ddb_entry {
49943 * (4000 only) */
49944 atomic_t relogin_timer; /* Max Time to wait for
49945 * relogin to complete */
49946 - atomic_t relogin_retry_count; /* Num of times relogin has been
49947 + atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
49948 * retried */
49949 uint32_t default_time2wait; /* Default Min time between
49950 * relogins (+aens) */
49951 diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
49952 index c21adc3..1b4155f 100644
49953 --- a/drivers/scsi/qla4xxx/ql4_os.c
49954 +++ b/drivers/scsi/qla4xxx/ql4_os.c
49955 @@ -4463,12 +4463,12 @@ static void qla4xxx_check_relogin_flash_ddb(struct iscsi_cls_session *cls_sess)
49956 */
49957 if (!iscsi_is_session_online(cls_sess)) {
49958 /* Reset retry relogin timer */
49959 - atomic_inc(&ddb_entry->relogin_retry_count);
49960 + atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
49961 DEBUG2(ql4_printk(KERN_INFO, ha,
49962 "%s: index[%d] relogin timed out-retrying"
49963 " relogin (%d), retry (%d)\n", __func__,
49964 ddb_entry->fw_ddb_index,
49965 - atomic_read(&ddb_entry->relogin_retry_count),
49966 + atomic_read_unchecked(&ddb_entry->relogin_retry_count),
49967 ddb_entry->default_time2wait + 4));
49968 set_bit(DPC_RELOGIN_DEVICE, &ha->dpc_flags);
49969 atomic_set(&ddb_entry->retry_relogin_timer,
49970 @@ -6552,7 +6552,7 @@ static void qla4xxx_setup_flash_ddb_entry(struct scsi_qla_host *ha,
49971
49972 atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
49973 atomic_set(&ddb_entry->relogin_timer, 0);
49974 - atomic_set(&ddb_entry->relogin_retry_count, 0);
49975 + atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
49976 def_timeout = le16_to_cpu(ddb_entry->fw_ddb_entry.def_timeout);
49977 ddb_entry->default_relogin_timeout =
49978 (def_timeout > LOGIN_TOV) && (def_timeout < LOGIN_TOV * 10) ?
49979 diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
49980 index d8afec8..3ec7152 100644
49981 --- a/drivers/scsi/scsi.c
49982 +++ b/drivers/scsi/scsi.c
49983 @@ -658,7 +658,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
49984 struct Scsi_Host *host = cmd->device->host;
49985 int rtn = 0;
49986
49987 - atomic_inc(&cmd->device->iorequest_cnt);
49988 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
49989
49990 /* check if the device is still usable */
49991 if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
49992 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
49993 index 62ec84b..93159d8 100644
49994 --- a/drivers/scsi/scsi_lib.c
49995 +++ b/drivers/scsi/scsi_lib.c
49996 @@ -1474,7 +1474,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
49997 shost = sdev->host;
49998 scsi_init_cmd_errh(cmd);
49999 cmd->result = DID_NO_CONNECT << 16;
50000 - atomic_inc(&cmd->device->iorequest_cnt);
50001 + atomic_inc_unchecked(&cmd->device->iorequest_cnt);
50002
50003 /*
50004 * SCSI request completion path will do scsi_device_unbusy(),
50005 @@ -1500,9 +1500,9 @@ static void scsi_softirq_done(struct request *rq)
50006
50007 INIT_LIST_HEAD(&cmd->eh_entry);
50008
50009 - atomic_inc(&cmd->device->iodone_cnt);
50010 + atomic_inc_unchecked(&cmd->device->iodone_cnt);
50011 if (cmd->result)
50012 - atomic_inc(&cmd->device->ioerr_cnt);
50013 + atomic_inc_unchecked(&cmd->device->ioerr_cnt);
50014
50015 disposition = scsi_decide_disposition(cmd);
50016 if (disposition != SUCCESS &&
50017 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
50018 index 665acbf..d18fab4 100644
50019 --- a/drivers/scsi/scsi_sysfs.c
50020 +++ b/drivers/scsi/scsi_sysfs.c
50021 @@ -734,7 +734,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
50022 char *buf) \
50023 { \
50024 struct scsi_device *sdev = to_scsi_device(dev); \
50025 - unsigned long long count = atomic_read(&sdev->field); \
50026 + unsigned long long count = atomic_read_unchecked(&sdev->field); \
50027 return snprintf(buf, 20, "0x%llx\n", count); \
50028 } \
50029 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
50030 diff --git a/drivers/scsi/scsi_tgt_lib.c b/drivers/scsi/scsi_tgt_lib.c
50031 index 84a1fdf..693b0d6 100644
50032 --- a/drivers/scsi/scsi_tgt_lib.c
50033 +++ b/drivers/scsi/scsi_tgt_lib.c
50034 @@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct scsi_tgt_cmd *tcmd, struct scsi_cmnd *cmd,
50035 int err;
50036
50037 dprintk("%lx %u\n", uaddr, len);
50038 - err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL);
50039 + err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL);
50040 if (err) {
50041 /*
50042 * TODO: need to fixup sg_tablesize, max_segment_size,
50043 diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
50044 index 4628fd5..a94a1c2 100644
50045 --- a/drivers/scsi/scsi_transport_fc.c
50046 +++ b/drivers/scsi/scsi_transport_fc.c
50047 @@ -497,7 +497,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_class,
50048 * Netlink Infrastructure
50049 */
50050
50051 -static atomic_t fc_event_seq;
50052 +static atomic_unchecked_t fc_event_seq;
50053
50054 /**
50055 * fc_get_event_number - Obtain the next sequential FC event number
50056 @@ -510,7 +510,7 @@ static atomic_t fc_event_seq;
50057 u32
50058 fc_get_event_number(void)
50059 {
50060 - return atomic_add_return(1, &fc_event_seq);
50061 + return atomic_add_return_unchecked(1, &fc_event_seq);
50062 }
50063 EXPORT_SYMBOL(fc_get_event_number);
50064
50065 @@ -654,7 +654,7 @@ static __init int fc_transport_init(void)
50066 {
50067 int error;
50068
50069 - atomic_set(&fc_event_seq, 0);
50070 + atomic_set_unchecked(&fc_event_seq, 0);
50071
50072 error = transport_class_register(&fc_host_class);
50073 if (error)
50074 @@ -844,7 +844,7 @@ static int fc_str_to_dev_loss(const char *buf, unsigned long *val)
50075 char *cp;
50076
50077 *val = simple_strtoul(buf, &cp, 0);
50078 - if ((*cp && (*cp != '\n')) || (*val < 0))
50079 + if (*cp && (*cp != '\n'))
50080 return -EINVAL;
50081 /*
50082 * Check for overflow; dev_loss_tmo is u32
50083 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
50084 index fd8ffe6..fd0bebf 100644
50085 --- a/drivers/scsi/scsi_transport_iscsi.c
50086 +++ b/drivers/scsi/scsi_transport_iscsi.c
50087 @@ -79,7 +79,7 @@ struct iscsi_internal {
50088 struct transport_container session_cont;
50089 };
50090
50091 -static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
50092 +static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
50093 static struct workqueue_struct *iscsi_eh_timer_workq;
50094
50095 static DEFINE_IDA(iscsi_sess_ida);
50096 @@ -2071,7 +2071,7 @@ int iscsi_add_session(struct iscsi_cls_session *session, unsigned int target_id)
50097 int err;
50098
50099 ihost = shost->shost_data;
50100 - session->sid = atomic_add_return(1, &iscsi_session_nr);
50101 + session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
50102
50103 if (target_id == ISCSI_MAX_TARGET) {
50104 id = ida_simple_get(&iscsi_sess_ida, 0, 0, GFP_KERNEL);
50105 @@ -4511,7 +4511,7 @@ static __init int iscsi_transport_init(void)
50106 printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
50107 ISCSI_TRANSPORT_VERSION);
50108
50109 - atomic_set(&iscsi_session_nr, 0);
50110 + atomic_set_unchecked(&iscsi_session_nr, 0);
50111
50112 err = class_register(&iscsi_transport_class);
50113 if (err)
50114 diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
50115 index d47ffc8..30f46a9 100644
50116 --- a/drivers/scsi/scsi_transport_srp.c
50117 +++ b/drivers/scsi/scsi_transport_srp.c
50118 @@ -36,7 +36,7 @@
50119 #include "scsi_transport_srp_internal.h"
50120
50121 struct srp_host_attrs {
50122 - atomic_t next_port_id;
50123 + atomic_unchecked_t next_port_id;
50124 };
50125 #define to_srp_host_attrs(host) ((struct srp_host_attrs *)(host)->shost_data)
50126
50127 @@ -101,7 +101,7 @@ static int srp_host_setup(struct transport_container *tc, struct device *dev,
50128 struct Scsi_Host *shost = dev_to_shost(dev);
50129 struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
50130
50131 - atomic_set(&srp_host->next_port_id, 0);
50132 + atomic_set_unchecked(&srp_host->next_port_id, 0);
50133 return 0;
50134 }
50135
50136 @@ -734,7 +734,7 @@ struct srp_rport *srp_rport_add(struct Scsi_Host *shost,
50137 rport_fast_io_fail_timedout);
50138 INIT_DELAYED_WORK(&rport->dev_loss_work, rport_dev_loss_timedout);
50139
50140 - id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
50141 + id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
50142 dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
50143
50144 transport_setup_device(&rport->dev);
50145 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
50146 index 36d1a23..3f33303 100644
50147 --- a/drivers/scsi/sd.c
50148 +++ b/drivers/scsi/sd.c
50149 @@ -2962,7 +2962,7 @@ static int sd_probe(struct device *dev)
50150 sdkp->disk = gd;
50151 sdkp->index = index;
50152 atomic_set(&sdkp->openers, 0);
50153 - atomic_set(&sdkp->device->ioerr_cnt, 0);
50154 + atomic_set_unchecked(&sdkp->device->ioerr_cnt, 0);
50155
50156 if (!sdp->request_queue->rq_timeout) {
50157 if (sdp->type != TYPE_MOD)
50158 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
50159 index df5e961..df6b97f 100644
50160 --- a/drivers/scsi/sg.c
50161 +++ b/drivers/scsi/sg.c
50162 @@ -1102,7 +1102,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
50163 sdp->disk->disk_name,
50164 MKDEV(SCSI_GENERIC_MAJOR, sdp->index),
50165 NULL,
50166 - (char *)arg);
50167 + (char __user *)arg);
50168 case BLKTRACESTART:
50169 return blk_trace_startstop(sdp->device->request_queue, 1);
50170 case BLKTRACESTOP:
50171 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
50172 index d0b28bb..a263613 100644
50173 --- a/drivers/spi/spi.c
50174 +++ b/drivers/spi/spi.c
50175 @@ -1971,7 +1971,7 @@ int spi_bus_unlock(struct spi_master *master)
50176 EXPORT_SYMBOL_GPL(spi_bus_unlock);
50177
50178 /* portable code must never pass more than 32 bytes */
50179 -#define SPI_BUFSIZ max(32, SMP_CACHE_BYTES)
50180 +#define SPI_BUFSIZ max(32UL, SMP_CACHE_BYTES)
50181
50182 static u8 *buf;
50183
50184 diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
50185 index 2c61783..4d49e4e 100644
50186 --- a/drivers/staging/android/timed_output.c
50187 +++ b/drivers/staging/android/timed_output.c
50188 @@ -25,7 +25,7 @@
50189 #include "timed_output.h"
50190
50191 static struct class *timed_output_class;
50192 -static atomic_t device_count;
50193 +static atomic_unchecked_t device_count;
50194
50195 static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
50196 char *buf)
50197 @@ -63,7 +63,7 @@ static int create_timed_output_class(void)
50198 timed_output_class = class_create(THIS_MODULE, "timed_output");
50199 if (IS_ERR(timed_output_class))
50200 return PTR_ERR(timed_output_class);
50201 - atomic_set(&device_count, 0);
50202 + atomic_set_unchecked(&device_count, 0);
50203 timed_output_class->dev_groups = timed_output_groups;
50204 }
50205
50206 @@ -81,7 +81,7 @@ int timed_output_dev_register(struct timed_output_dev *tdev)
50207 if (ret < 0)
50208 return ret;
50209
50210 - tdev->index = atomic_inc_return(&device_count);
50211 + tdev->index = atomic_inc_return_unchecked(&device_count);
50212 tdev->dev = device_create(timed_output_class, NULL,
50213 MKDEV(0, tdev->index), NULL, "%s", tdev->name);
50214 if (IS_ERR(tdev->dev))
50215 diff --git a/drivers/staging/gdm724x/gdm_tty.c b/drivers/staging/gdm724x/gdm_tty.c
50216 index fe47cd3..19a1bd1 100644
50217 --- a/drivers/staging/gdm724x/gdm_tty.c
50218 +++ b/drivers/staging/gdm724x/gdm_tty.c
50219 @@ -44,7 +44,7 @@
50220 #define gdm_tty_send_control(n, r, v, d, l) (\
50221 n->tty_dev->send_control(n->tty_dev->priv_dev, r, v, d, l))
50222
50223 -#define GDM_TTY_READY(gdm) (gdm && gdm->tty_dev && gdm->port.count)
50224 +#define GDM_TTY_READY(gdm) (gdm && gdm->tty_dev && atomic_read(&gdm->port.count))
50225
50226 static struct tty_driver *gdm_driver[TTY_MAX_COUNT];
50227 static struct gdm *gdm_table[TTY_MAX_COUNT][GDM_TTY_MINOR];
50228 diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
50229 index 236ed66..dd9cd74 100644
50230 --- a/drivers/staging/imx-drm/imx-drm-core.c
50231 +++ b/drivers/staging/imx-drm/imx-drm-core.c
50232 @@ -488,7 +488,7 @@ int imx_drm_add_crtc(struct drm_crtc *crtc,
50233 goto err_busy;
50234 }
50235
50236 - if (imxdrm->drm->open_count) {
50237 + if (local_read(&imxdrm->drm->open_count)) {
50238 ret = -EBUSY;
50239 goto err_busy;
50240 }
50241 @@ -576,7 +576,7 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
50242
50243 mutex_lock(&imxdrm->mutex);
50244
50245 - if (imxdrm->drm->open_count) {
50246 + if (local_read(&imxdrm->drm->open_count)) {
50247 ret = -EBUSY;
50248 goto err_busy;
50249 }
50250 @@ -715,7 +715,7 @@ int imx_drm_add_connector(struct drm_connector *connector,
50251
50252 mutex_lock(&imxdrm->mutex);
50253
50254 - if (imxdrm->drm->open_count) {
50255 + if (local_read(&imxdrm->drm->open_count)) {
50256 ret = -EBUSY;
50257 goto err_busy;
50258 }
50259 diff --git a/drivers/staging/lustre/lnet/selftest/brw_test.c b/drivers/staging/lustre/lnet/selftest/brw_test.c
50260 index 3f8020c..649fded 100644
50261 --- a/drivers/staging/lustre/lnet/selftest/brw_test.c
50262 +++ b/drivers/staging/lustre/lnet/selftest/brw_test.c
50263 @@ -488,13 +488,11 @@ brw_server_handle(struct srpc_server_rpc *rpc)
50264 return 0;
50265 }
50266
50267 -sfw_test_client_ops_t brw_test_client;
50268 -void brw_init_test_client(void)
50269 -{
50270 - brw_test_client.tso_init = brw_client_init;
50271 - brw_test_client.tso_fini = brw_client_fini;
50272 - brw_test_client.tso_prep_rpc = brw_client_prep_rpc;
50273 - brw_test_client.tso_done_rpc = brw_client_done_rpc;
50274 +sfw_test_client_ops_t brw_test_client = {
50275 + .tso_init = brw_client_init,
50276 + .tso_fini = brw_client_fini,
50277 + .tso_prep_rpc = brw_client_prep_rpc,
50278 + .tso_done_rpc = brw_client_done_rpc,
50279 };
50280
50281 srpc_service_t brw_test_service;
50282 diff --git a/drivers/staging/lustre/lnet/selftest/framework.c b/drivers/staging/lustre/lnet/selftest/framework.c
50283 index 050723a..fa6fdf1 100644
50284 --- a/drivers/staging/lustre/lnet/selftest/framework.c
50285 +++ b/drivers/staging/lustre/lnet/selftest/framework.c
50286 @@ -1635,12 +1635,10 @@ static srpc_service_t sfw_services[] =
50287
50288 extern sfw_test_client_ops_t ping_test_client;
50289 extern srpc_service_t ping_test_service;
50290 -extern void ping_init_test_client(void);
50291 extern void ping_init_test_service(void);
50292
50293 extern sfw_test_client_ops_t brw_test_client;
50294 extern srpc_service_t brw_test_service;
50295 -extern void brw_init_test_client(void);
50296 extern void brw_init_test_service(void);
50297
50298
50299 @@ -1684,12 +1682,10 @@ sfw_startup (void)
50300 INIT_LIST_HEAD(&sfw_data.fw_zombie_rpcs);
50301 INIT_LIST_HEAD(&sfw_data.fw_zombie_sessions);
50302
50303 - brw_init_test_client();
50304 brw_init_test_service();
50305 rc = sfw_register_test(&brw_test_service, &brw_test_client);
50306 LASSERT (rc == 0);
50307
50308 - ping_init_test_client();
50309 ping_init_test_service();
50310 rc = sfw_register_test(&ping_test_service, &ping_test_client);
50311 LASSERT (rc == 0);
50312 diff --git a/drivers/staging/lustre/lnet/selftest/ping_test.c b/drivers/staging/lustre/lnet/selftest/ping_test.c
50313 index 750cac4..e4d751f 100644
50314 --- a/drivers/staging/lustre/lnet/selftest/ping_test.c
50315 +++ b/drivers/staging/lustre/lnet/selftest/ping_test.c
50316 @@ -211,14 +211,12 @@ ping_server_handle(struct srpc_server_rpc *rpc)
50317 return 0;
50318 }
50319
50320 -sfw_test_client_ops_t ping_test_client;
50321 -void ping_init_test_client(void)
50322 -{
50323 - ping_test_client.tso_init = ping_client_init;
50324 - ping_test_client.tso_fini = ping_client_fini;
50325 - ping_test_client.tso_prep_rpc = ping_client_prep_rpc;
50326 - ping_test_client.tso_done_rpc = ping_client_done_rpc;
50327 -}
50328 +sfw_test_client_ops_t ping_test_client = {
50329 + .tso_init = ping_client_init,
50330 + .tso_fini = ping_client_fini,
50331 + .tso_prep_rpc = ping_client_prep_rpc,
50332 + .tso_done_rpc = ping_client_done_rpc,
50333 +};
50334
50335 srpc_service_t ping_test_service;
50336 void ping_init_test_service(void)
50337 diff --git a/drivers/staging/lustre/lustre/include/lustre_dlm.h b/drivers/staging/lustre/lustre/include/lustre_dlm.h
50338 index ec4bb5e..740c6dd 100644
50339 --- a/drivers/staging/lustre/lustre/include/lustre_dlm.h
50340 +++ b/drivers/staging/lustre/lustre/include/lustre_dlm.h
50341 @@ -1141,7 +1141,7 @@ struct ldlm_callback_suite {
50342 ldlm_completion_callback lcs_completion;
50343 ldlm_blocking_callback lcs_blocking;
50344 ldlm_glimpse_callback lcs_glimpse;
50345 -};
50346 +} __no_const;
50347
50348 /* ldlm_lockd.c */
50349 int ldlm_del_waiting_lock(struct ldlm_lock *lock);
50350 diff --git a/drivers/staging/lustre/lustre/include/obd.h b/drivers/staging/lustre/lustre/include/obd.h
50351 index c3470ce..2bef527 100644
50352 --- a/drivers/staging/lustre/lustre/include/obd.h
50353 +++ b/drivers/staging/lustre/lustre/include/obd.h
50354 @@ -1426,7 +1426,7 @@ struct md_ops {
50355 * lprocfs_alloc_md_stats() in obdclass/lprocfs_status.c. Also, add a
50356 * wrapper function in include/linux/obd_class.h.
50357 */
50358 -};
50359 +} __no_const;
50360
50361 struct lsm_operations {
50362 void (*lsm_free)(struct lov_stripe_md *);
50363 diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
50364 index c9aae13..60ea292 100644
50365 --- a/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
50366 +++ b/drivers/staging/lustre/lustre/ldlm/ldlm_flock.c
50367 @@ -239,7 +239,7 @@ ldlm_process_flock_lock(struct ldlm_lock *req, __u64 *flags, int first_enq,
50368 int added = (mode == LCK_NL);
50369 int overlaps = 0;
50370 int splitted = 0;
50371 - const struct ldlm_callback_suite null_cbs = { NULL };
50372 + const struct ldlm_callback_suite null_cbs = { };
50373
50374 CDEBUG(D_DLMTRACE, "flags %#llx owner "LPU64" pid %u mode %u start "
50375 LPU64" end "LPU64"\n", *flags,
50376 diff --git a/drivers/staging/lustre/lustre/libcfs/linux/linux-proc.c b/drivers/staging/lustre/lustre/libcfs/linux/linux-proc.c
50377 index e947b91..f408990 100644
50378 --- a/drivers/staging/lustre/lustre/libcfs/linux/linux-proc.c
50379 +++ b/drivers/staging/lustre/lustre/libcfs/linux/linux-proc.c
50380 @@ -217,7 +217,7 @@ DECLARE_PROC_HANDLER(proc_debug_mb)
50381 int LL_PROC_PROTO(proc_console_max_delay_cs)
50382 {
50383 int rc, max_delay_cs;
50384 - ctl_table_t dummy = *table;
50385 + ctl_table_no_const dummy = *table;
50386 cfs_duration_t d;
50387
50388 dummy.data = &max_delay_cs;
50389 @@ -248,7 +248,7 @@ int LL_PROC_PROTO(proc_console_max_delay_cs)
50390 int LL_PROC_PROTO(proc_console_min_delay_cs)
50391 {
50392 int rc, min_delay_cs;
50393 - ctl_table_t dummy = *table;
50394 + ctl_table_no_const dummy = *table;
50395 cfs_duration_t d;
50396
50397 dummy.data = &min_delay_cs;
50398 @@ -279,7 +279,7 @@ int LL_PROC_PROTO(proc_console_min_delay_cs)
50399 int LL_PROC_PROTO(proc_console_backoff)
50400 {
50401 int rc, backoff;
50402 - ctl_table_t dummy = *table;
50403 + ctl_table_no_const dummy = *table;
50404
50405 dummy.data = &backoff;
50406 dummy.proc_handler = &proc_dointvec;
50407 diff --git a/drivers/staging/lustre/lustre/libcfs/module.c b/drivers/staging/lustre/lustre/libcfs/module.c
50408 index 24ae26d..9d09cab 100644
50409 --- a/drivers/staging/lustre/lustre/libcfs/module.c
50410 +++ b/drivers/staging/lustre/lustre/libcfs/module.c
50411 @@ -313,11 +313,11 @@ out:
50412
50413
50414 struct cfs_psdev_ops libcfs_psdev_ops = {
50415 - libcfs_psdev_open,
50416 - libcfs_psdev_release,
50417 - NULL,
50418 - NULL,
50419 - libcfs_ioctl
50420 + .p_open = libcfs_psdev_open,
50421 + .p_close = libcfs_psdev_release,
50422 + .p_read = NULL,
50423 + .p_write = NULL,
50424 + .p_ioctl = libcfs_ioctl
50425 };
50426
50427 extern int insert_proc(void);
50428 diff --git a/drivers/staging/lustre/lustre/llite/dir.c b/drivers/staging/lustre/lustre/llite/dir.c
50429 index 52b7731..d604da0 100644
50430 --- a/drivers/staging/lustre/lustre/llite/dir.c
50431 +++ b/drivers/staging/lustre/lustre/llite/dir.c
50432 @@ -660,7 +660,7 @@ int ll_dir_setdirstripe(struct inode *dir, struct lmv_user_md *lump,
50433 int mode;
50434 int err;
50435
50436 - mode = (0755 & (S_IRWXUGO|S_ISVTX) & ~current->fs->umask) | S_IFDIR;
50437 + mode = (0755 & (S_IRWXUGO|S_ISVTX) & ~current_umask()) | S_IFDIR;
50438 op_data = ll_prep_md_op_data(NULL, dir, NULL, filename,
50439 strlen(filename), mode, LUSTRE_OPC_MKDIR,
50440 lump);
50441 diff --git a/drivers/staging/media/solo6x10/solo6x10-core.c b/drivers/staging/media/solo6x10/solo6x10-core.c
50442 index 480b7c4..6846324 100644
50443 --- a/drivers/staging/media/solo6x10/solo6x10-core.c
50444 +++ b/drivers/staging/media/solo6x10/solo6x10-core.c
50445 @@ -434,7 +434,7 @@ static void solo_device_release(struct device *dev)
50446
50447 static int solo_sysfs_init(struct solo_dev *solo_dev)
50448 {
50449 - struct bin_attribute *sdram_attr = &solo_dev->sdram_attr;
50450 + bin_attribute_no_const *sdram_attr = &solo_dev->sdram_attr;
50451 struct device *dev = &solo_dev->dev;
50452 const char *driver;
50453 int i;
50454 diff --git a/drivers/staging/media/solo6x10/solo6x10-g723.c b/drivers/staging/media/solo6x10/solo6x10-g723.c
50455 index 1db18c7..35e6afc 100644
50456 --- a/drivers/staging/media/solo6x10/solo6x10-g723.c
50457 +++ b/drivers/staging/media/solo6x10/solo6x10-g723.c
50458 @@ -355,7 +355,7 @@ static int solo_snd_pcm_init(struct solo_dev *solo_dev)
50459
50460 int solo_g723_init(struct solo_dev *solo_dev)
50461 {
50462 - static struct snd_device_ops ops = { NULL };
50463 + static struct snd_device_ops ops = { };
50464 struct snd_card *card;
50465 struct snd_kcontrol_new kctl;
50466 char name[32];
50467 diff --git a/drivers/staging/media/solo6x10/solo6x10-p2m.c b/drivers/staging/media/solo6x10/solo6x10-p2m.c
50468 index 7f2f247..d999137 100644
50469 --- a/drivers/staging/media/solo6x10/solo6x10-p2m.c
50470 +++ b/drivers/staging/media/solo6x10/solo6x10-p2m.c
50471 @@ -77,7 +77,7 @@ int solo_p2m_dma_desc(struct solo_dev *solo_dev,
50472
50473 /* Get next ID. According to Softlogic, 6110 has problems on !=0 P2M */
50474 if (solo_dev->type != SOLO_DEV_6110 && multi_p2m) {
50475 - p2m_id = atomic_inc_return(&solo_dev->p2m_count) % SOLO_NR_P2M;
50476 + p2m_id = atomic_inc_return_unchecked(&solo_dev->p2m_count) % SOLO_NR_P2M;
50477 if (p2m_id < 0)
50478 p2m_id = -p2m_id;
50479 }
50480 diff --git a/drivers/staging/media/solo6x10/solo6x10.h b/drivers/staging/media/solo6x10/solo6x10.h
50481 index 8964f8b..36eb087 100644
50482 --- a/drivers/staging/media/solo6x10/solo6x10.h
50483 +++ b/drivers/staging/media/solo6x10/solo6x10.h
50484 @@ -237,7 +237,7 @@ struct solo_dev {
50485
50486 /* P2M DMA Engine */
50487 struct solo_p2m_dev p2m_dev[SOLO_NR_P2M];
50488 - atomic_t p2m_count;
50489 + atomic_unchecked_t p2m_count;
50490 int p2m_jiffies;
50491 unsigned int p2m_timeouts;
50492
50493 diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
50494 index a0f4868..139f1fb 100644
50495 --- a/drivers/staging/octeon/ethernet-rx.c
50496 +++ b/drivers/staging/octeon/ethernet-rx.c
50497 @@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
50498 /* Increment RX stats for virtual ports */
50499 if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
50500 #ifdef CONFIG_64BIT
50501 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
50502 - atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
50503 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
50504 + atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
50505 #else
50506 - atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
50507 - atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
50508 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
50509 + atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
50510 #endif
50511 }
50512 netif_receive_skb(skb);
50513 @@ -432,9 +432,9 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
50514 dev->name);
50515 */
50516 #ifdef CONFIG_64BIT
50517 - atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
50518 + atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
50519 #else
50520 - atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
50521 + atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
50522 #endif
50523 dev_kfree_skb_irq(skb);
50524 }
50525 diff --git a/drivers/staging/octeon/ethernet.c b/drivers/staging/octeon/ethernet.c
50526 index 089dc4b..c9a687e 100644
50527 --- a/drivers/staging/octeon/ethernet.c
50528 +++ b/drivers/staging/octeon/ethernet.c
50529 @@ -253,11 +253,11 @@ static struct net_device_stats *cvm_oct_common_get_stats(struct net_device *dev)
50530 * since the RX tasklet also increments it.
50531 */
50532 #ifdef CONFIG_64BIT
50533 - atomic64_add(rx_status.dropped_packets,
50534 - (atomic64_t *)&priv->stats.rx_dropped);
50535 + atomic64_add_unchecked(rx_status.dropped_packets,
50536 + (atomic64_unchecked_t *)&priv->stats.rx_dropped);
50537 #else
50538 - atomic_add(rx_status.dropped_packets,
50539 - (atomic_t *)&priv->stats.rx_dropped);
50540 + atomic_add_unchecked(rx_status.dropped_packets,
50541 + (atomic_unchecked_t *)&priv->stats.rx_dropped);
50542 #endif
50543 }
50544
50545 diff --git a/drivers/staging/rtl8188eu/include/hal_intf.h b/drivers/staging/rtl8188eu/include/hal_intf.h
50546 index c274b34..f84de76 100644
50547 --- a/drivers/staging/rtl8188eu/include/hal_intf.h
50548 +++ b/drivers/staging/rtl8188eu/include/hal_intf.h
50549 @@ -271,7 +271,7 @@ struct hal_ops {
50550 s32 (*c2h_handler)(struct adapter *padapter,
50551 struct c2h_evt_hdr *c2h_evt);
50552 c2h_id_filter c2h_id_filter_ccx;
50553 -};
50554 +} __no_const;
50555
50556 enum rt_eeprom_type {
50557 EEPROM_93C46,
50558 diff --git a/drivers/staging/rtl8188eu/include/rtw_io.h b/drivers/staging/rtl8188eu/include/rtw_io.h
50559 index 3d1dfcc..ff5620a 100644
50560 --- a/drivers/staging/rtl8188eu/include/rtw_io.h
50561 +++ b/drivers/staging/rtl8188eu/include/rtw_io.h
50562 @@ -126,7 +126,7 @@ struct _io_ops {
50563 u32 (*_write_scsi)(struct intf_hdl *pintfhdl, u32 cnt, u8 *pmem);
50564 void (*_read_port_cancel)(struct intf_hdl *pintfhdl);
50565 void (*_write_port_cancel)(struct intf_hdl *pintfhdl);
50566 -};
50567 +} __no_const;
50568
50569 struct io_req {
50570 struct list_head list;
50571 diff --git a/drivers/staging/rtl8712/rtl871x_io.h b/drivers/staging/rtl8712/rtl871x_io.h
50572 index dc23395..cf7e9b1 100644
50573 --- a/drivers/staging/rtl8712/rtl871x_io.h
50574 +++ b/drivers/staging/rtl8712/rtl871x_io.h
50575 @@ -108,7 +108,7 @@ struct _io_ops {
50576 u8 *pmem);
50577 u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
50578 u8 *pmem);
50579 -};
50580 +} __no_const;
50581
50582 struct io_req {
50583 struct list_head list;
50584 diff --git a/drivers/staging/sbe-2t3e3/netdev.c b/drivers/staging/sbe-2t3e3/netdev.c
50585 index 1f5088b..0e59820 100644
50586 --- a/drivers/staging/sbe-2t3e3/netdev.c
50587 +++ b/drivers/staging/sbe-2t3e3/netdev.c
50588 @@ -51,7 +51,7 @@ static int t3e3_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
50589 t3e3_if_config(sc, cmd_2t3e3, (char *)&param, &resp, &rlen);
50590
50591 if (rlen)
50592 - if (copy_to_user(data, &resp, rlen))
50593 + if (rlen > sizeof resp || copy_to_user(data, &resp, rlen))
50594 return -EFAULT;
50595
50596 return 0;
50597 diff --git a/drivers/staging/usbip/vhci.h b/drivers/staging/usbip/vhci.h
50598 index a863a98..d272795 100644
50599 --- a/drivers/staging/usbip/vhci.h
50600 +++ b/drivers/staging/usbip/vhci.h
50601 @@ -83,7 +83,7 @@ struct vhci_hcd {
50602 unsigned resuming:1;
50603 unsigned long re_timeout;
50604
50605 - atomic_t seqnum;
50606 + atomic_unchecked_t seqnum;
50607
50608 /*
50609 * NOTE:
50610 diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
50611 index 72391ef..7c6717a 100644
50612 --- a/drivers/staging/usbip/vhci_hcd.c
50613 +++ b/drivers/staging/usbip/vhci_hcd.c
50614 @@ -440,7 +440,7 @@ static void vhci_tx_urb(struct urb *urb)
50615
50616 spin_lock(&vdev->priv_lock);
50617
50618 - priv->seqnum = atomic_inc_return(&the_controller->seqnum);
50619 + priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
50620 if (priv->seqnum == 0xffff)
50621 dev_info(&urb->dev->dev, "seqnum max\n");
50622
50623 @@ -686,7 +686,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
50624 return -ENOMEM;
50625 }
50626
50627 - unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
50628 + unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
50629 if (unlink->seqnum == 0xffff)
50630 pr_info("seqnum max\n");
50631
50632 @@ -890,7 +890,7 @@ static int vhci_start(struct usb_hcd *hcd)
50633 vdev->rhport = rhport;
50634 }
50635
50636 - atomic_set(&vhci->seqnum, 0);
50637 + atomic_set_unchecked(&vhci->seqnum, 0);
50638 spin_lock_init(&vhci->lock);
50639
50640 hcd->power_budget = 0; /* no limit */
50641 diff --git a/drivers/staging/usbip/vhci_rx.c b/drivers/staging/usbip/vhci_rx.c
50642 index d07fcb5..358e1e1 100644
50643 --- a/drivers/staging/usbip/vhci_rx.c
50644 +++ b/drivers/staging/usbip/vhci_rx.c
50645 @@ -80,7 +80,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev,
50646 if (!urb) {
50647 pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum);
50648 pr_info("max seqnum %d\n",
50649 - atomic_read(&the_controller->seqnum));
50650 + atomic_read_unchecked(&the_controller->seqnum));
50651 usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
50652 return;
50653 }
50654 diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
50655 index 6eecd53..29317c6 100644
50656 --- a/drivers/staging/vt6655/hostap.c
50657 +++ b/drivers/staging/vt6655/hostap.c
50658 @@ -69,14 +69,13 @@ static int msglevel = MSG_LEVEL_INFO;
50659 *
50660 */
50661
50662 +static net_device_ops_no_const apdev_netdev_ops;
50663 +
50664 static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
50665 {
50666 PSDevice apdev_priv;
50667 struct net_device *dev = pDevice->dev;
50668 int ret;
50669 - const struct net_device_ops apdev_netdev_ops = {
50670 - .ndo_start_xmit = pDevice->tx_80211,
50671 - };
50672
50673 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
50674
50675 @@ -88,6 +87,8 @@ static int hostap_enable_hostapd(PSDevice pDevice, int rtnl_locked)
50676 *apdev_priv = *pDevice;
50677 eth_hw_addr_inherit(pDevice->apdev, dev);
50678
50679 + /* only half broken now */
50680 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
50681 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
50682
50683 pDevice->apdev->type = ARPHRD_IEEE80211;
50684 diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c
50685 index 67ba48b..24e602f 100644
50686 --- a/drivers/staging/vt6656/hostap.c
50687 +++ b/drivers/staging/vt6656/hostap.c
50688 @@ -60,14 +60,13 @@ static int msglevel =MSG_LEVEL_INFO;
50689 *
50690 */
50691
50692 +static net_device_ops_no_const apdev_netdev_ops;
50693 +
50694 static int hostap_enable_hostapd(struct vnt_private *pDevice, int rtnl_locked)
50695 {
50696 struct vnt_private *apdev_priv;
50697 struct net_device *dev = pDevice->dev;
50698 int ret;
50699 - const struct net_device_ops apdev_netdev_ops = {
50700 - .ndo_start_xmit = pDevice->tx_80211,
50701 - };
50702
50703 DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Enabling hostapd mode\n", dev->name);
50704
50705 @@ -79,6 +78,8 @@ static int hostap_enable_hostapd(struct vnt_private *pDevice, int rtnl_locked)
50706 *apdev_priv = *pDevice;
50707 memcpy(pDevice->apdev->dev_addr, dev->dev_addr, ETH_ALEN);
50708
50709 + /* only half broken now */
50710 + apdev_netdev_ops.ndo_start_xmit = pDevice->tx_80211;
50711 pDevice->apdev->netdev_ops = &apdev_netdev_ops;
50712
50713 pDevice->apdev->type = ARPHRD_IEEE80211;
50714 diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
50715 index 24884ca..26c8220 100644
50716 --- a/drivers/target/sbp/sbp_target.c
50717 +++ b/drivers/target/sbp/sbp_target.c
50718 @@ -62,7 +62,7 @@ static const u32 sbp_unit_directory_template[] = {
50719
50720 #define SESSION_MAINTENANCE_INTERVAL HZ
50721
50722 -static atomic_t login_id = ATOMIC_INIT(0);
50723 +static atomic_unchecked_t login_id = ATOMIC_INIT(0);
50724
50725 static void session_maintenance_work(struct work_struct *);
50726 static int sbp_run_transaction(struct fw_card *, int, int, int, int,
50727 @@ -444,7 +444,7 @@ static void sbp_management_request_login(
50728 login->lun = se_lun;
50729 login->status_fifo_addr = sbp2_pointer_to_addr(&req->orb.status_fifo);
50730 login->exclusive = LOGIN_ORB_EXCLUSIVE(be32_to_cpu(req->orb.misc));
50731 - login->login_id = atomic_inc_return(&login_id);
50732 + login->login_id = atomic_inc_return_unchecked(&login_id);
50733
50734 login->tgt_agt = sbp_target_agent_register(login);
50735 if (IS_ERR(login->tgt_agt)) {
50736 diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
50737 index 65001e1..2ebfbb9 100644
50738 --- a/drivers/target/target_core_device.c
50739 +++ b/drivers/target/target_core_device.c
50740 @@ -1520,7 +1520,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
50741 spin_lock_init(&dev->se_tmr_lock);
50742 spin_lock_init(&dev->qf_cmd_lock);
50743 sema_init(&dev->caw_sem, 1);
50744 - atomic_set(&dev->dev_ordered_id, 0);
50745 + atomic_set_unchecked(&dev->dev_ordered_id, 0);
50746 INIT_LIST_HEAD(&dev->t10_wwn.t10_vpd_list);
50747 spin_lock_init(&dev->t10_wwn.t10_vpd_lock);
50748 INIT_LIST_HEAD(&dev->t10_pr.registration_list);
50749 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
50750 index 2956250..b10f722 100644
50751 --- a/drivers/target/target_core_transport.c
50752 +++ b/drivers/target/target_core_transport.c
50753 @@ -1136,7 +1136,7 @@ transport_check_alloc_task_attr(struct se_cmd *cmd)
50754 * Used to determine when ORDERED commands should go from
50755 * Dormant to Active status.
50756 */
50757 - cmd->se_ordered_id = atomic_inc_return(&dev->dev_ordered_id);
50758 + cmd->se_ordered_id = atomic_inc_return_unchecked(&dev->dev_ordered_id);
50759 smp_mb__after_atomic_inc();
50760 pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
50761 cmd->se_ordered_id, cmd->sam_task_attr,
50762 diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
50763 index 04b1be7..5eff86d 100644
50764 --- a/drivers/thermal/of-thermal.c
50765 +++ b/drivers/thermal/of-thermal.c
50766 @@ -30,6 +30,7 @@
50767 #include <linux/err.h>
50768 #include <linux/export.h>
50769 #include <linux/string.h>
50770 +#include <linux/mm.h>
50771
50772 #include "thermal_core.h"
50773
50774 @@ -341,8 +342,10 @@ thermal_zone_of_add_sensor(struct device_node *zone,
50775 tz->get_trend = get_trend;
50776 tz->sensor_data = data;
50777
50778 - tzd->ops->get_temp = of_thermal_get_temp;
50779 - tzd->ops->get_trend = of_thermal_get_trend;
50780 + pax_open_kernel();
50781 + *(void **)&tzd->ops->get_temp = of_thermal_get_temp;
50782 + *(void **)&tzd->ops->get_trend = of_thermal_get_trend;
50783 + pax_close_kernel();
50784 mutex_unlock(&tzd->lock);
50785
50786 return tzd;
50787 @@ -461,8 +464,10 @@ void thermal_zone_of_sensor_unregister(struct device *dev,
50788 return;
50789
50790 mutex_lock(&tzd->lock);
50791 - tzd->ops->get_temp = NULL;
50792 - tzd->ops->get_trend = NULL;
50793 + pax_open_kernel();
50794 + *(void **)&tzd->ops->get_temp = NULL;
50795 + *(void **)&tzd->ops->get_trend = NULL;
50796 + pax_close_kernel();
50797
50798 tz->get_temp = NULL;
50799 tz->get_trend = NULL;
50800 diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c
50801 index a57bb5a..1f727d33 100644
50802 --- a/drivers/tty/cyclades.c
50803 +++ b/drivers/tty/cyclades.c
50804 @@ -1570,10 +1570,10 @@ static int cy_open(struct tty_struct *tty, struct file *filp)
50805 printk(KERN_DEBUG "cyc:cy_open ttyC%d, count = %d\n", info->line,
50806 info->port.count);
50807 #endif
50808 - info->port.count++;
50809 + atomic_inc(&info->port.count);
50810 #ifdef CY_DEBUG_COUNT
50811 printk(KERN_DEBUG "cyc:cy_open (%d): incrementing count to %d\n",
50812 - current->pid, info->port.count);
50813 + current->pid, atomic_read(&info->port.count));
50814 #endif
50815
50816 /*
50817 @@ -3974,7 +3974,7 @@ static int cyclades_proc_show(struct seq_file *m, void *v)
50818 for (j = 0; j < cy_card[i].nports; j++) {
50819 info = &cy_card[i].ports[j];
50820
50821 - if (info->port.count) {
50822 + if (atomic_read(&info->port.count)) {
50823 /* XXX is the ldisc num worth this? */
50824 struct tty_struct *tty;
50825 struct tty_ldisc *ld;
50826 diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
50827 index 0ff7fda..dbc7d52 100644
50828 --- a/drivers/tty/hvc/hvc_console.c
50829 +++ b/drivers/tty/hvc/hvc_console.c
50830 @@ -342,7 +342,7 @@ static int hvc_open(struct tty_struct *tty, struct file * filp)
50831
50832 spin_lock_irqsave(&hp->port.lock, flags);
50833 /* Check and then increment for fast path open. */
50834 - if (hp->port.count++ > 0) {
50835 + if (atomic_inc_return(&hp->port.count) > 1) {
50836 spin_unlock_irqrestore(&hp->port.lock, flags);
50837 hvc_kick();
50838 return 0;
50839 @@ -397,7 +397,7 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
50840
50841 spin_lock_irqsave(&hp->port.lock, flags);
50842
50843 - if (--hp->port.count == 0) {
50844 + if (atomic_dec_return(&hp->port.count) == 0) {
50845 spin_unlock_irqrestore(&hp->port.lock, flags);
50846 /* We are done with the tty pointer now. */
50847 tty_port_tty_set(&hp->port, NULL);
50848 @@ -419,9 +419,9 @@ static void hvc_close(struct tty_struct *tty, struct file * filp)
50849 */
50850 tty_wait_until_sent_from_close(tty, HVC_CLOSE_WAIT);
50851 } else {
50852 - if (hp->port.count < 0)
50853 + if (atomic_read(&hp->port.count) < 0)
50854 printk(KERN_ERR "hvc_close %X: oops, count is %d\n",
50855 - hp->vtermno, hp->port.count);
50856 + hp->vtermno, atomic_read(&hp->port.count));
50857 spin_unlock_irqrestore(&hp->port.lock, flags);
50858 }
50859 }
50860 @@ -451,12 +451,12 @@ static void hvc_hangup(struct tty_struct *tty)
50861 * open->hangup case this can be called after the final close so prevent
50862 * that from happening for now.
50863 */
50864 - if (hp->port.count <= 0) {
50865 + if (atomic_read(&hp->port.count) <= 0) {
50866 spin_unlock_irqrestore(&hp->port.lock, flags);
50867 return;
50868 }
50869
50870 - hp->port.count = 0;
50871 + atomic_set(&hp->port.count, 0);
50872 spin_unlock_irqrestore(&hp->port.lock, flags);
50873 tty_port_tty_set(&hp->port, NULL);
50874
50875 @@ -504,7 +504,7 @@ static int hvc_write(struct tty_struct *tty, const unsigned char *buf, int count
50876 return -EPIPE;
50877
50878 /* FIXME what's this (unprotected) check for? */
50879 - if (hp->port.count <= 0)
50880 + if (atomic_read(&hp->port.count) <= 0)
50881 return -EIO;
50882
50883 spin_lock_irqsave(&hp->lock, flags);
50884 diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
50885 index 81e939e..95ead10 100644
50886 --- a/drivers/tty/hvc/hvcs.c
50887 +++ b/drivers/tty/hvc/hvcs.c
50888 @@ -83,6 +83,7 @@
50889 #include <asm/hvcserver.h>
50890 #include <asm/uaccess.h>
50891 #include <asm/vio.h>
50892 +#include <asm/local.h>
50893
50894 /*
50895 * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
50896 @@ -416,7 +417,7 @@ static ssize_t hvcs_vterm_state_store(struct device *dev, struct device_attribut
50897
50898 spin_lock_irqsave(&hvcsd->lock, flags);
50899
50900 - if (hvcsd->port.count > 0) {
50901 + if (atomic_read(&hvcsd->port.count) > 0) {
50902 spin_unlock_irqrestore(&hvcsd->lock, flags);
50903 printk(KERN_INFO "HVCS: vterm state unchanged. "
50904 "The hvcs device node is still in use.\n");
50905 @@ -1127,7 +1128,7 @@ static int hvcs_install(struct tty_driver *driver, struct tty_struct *tty)
50906 }
50907 }
50908
50909 - hvcsd->port.count = 0;
50910 + atomic_set(&hvcsd->port.count, 0);
50911 hvcsd->port.tty = tty;
50912 tty->driver_data = hvcsd;
50913
50914 @@ -1180,7 +1181,7 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
50915 unsigned long flags;
50916
50917 spin_lock_irqsave(&hvcsd->lock, flags);
50918 - hvcsd->port.count++;
50919 + atomic_inc(&hvcsd->port.count);
50920 hvcsd->todo_mask |= HVCS_SCHED_READ;
50921 spin_unlock_irqrestore(&hvcsd->lock, flags);
50922
50923 @@ -1216,7 +1217,7 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
50924 hvcsd = tty->driver_data;
50925
50926 spin_lock_irqsave(&hvcsd->lock, flags);
50927 - if (--hvcsd->port.count == 0) {
50928 + if (atomic_dec_and_test(&hvcsd->port.count)) {
50929
50930 vio_disable_interrupts(hvcsd->vdev);
50931
50932 @@ -1241,10 +1242,10 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
50933
50934 free_irq(irq, hvcsd);
50935 return;
50936 - } else if (hvcsd->port.count < 0) {
50937 + } else if (atomic_read(&hvcsd->port.count) < 0) {
50938 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
50939 " is missmanaged.\n",
50940 - hvcsd->vdev->unit_address, hvcsd->port.count);
50941 + hvcsd->vdev->unit_address, atomic_read(&hvcsd->port.count));
50942 }
50943
50944 spin_unlock_irqrestore(&hvcsd->lock, flags);
50945 @@ -1266,7 +1267,7 @@ static void hvcs_hangup(struct tty_struct * tty)
50946
50947 spin_lock_irqsave(&hvcsd->lock, flags);
50948 /* Preserve this so that we know how many kref refs to put */
50949 - temp_open_count = hvcsd->port.count;
50950 + temp_open_count = atomic_read(&hvcsd->port.count);
50951
50952 /*
50953 * Don't kref put inside the spinlock because the destruction
50954 @@ -1281,7 +1282,7 @@ static void hvcs_hangup(struct tty_struct * tty)
50955 tty->driver_data = NULL;
50956 hvcsd->port.tty = NULL;
50957
50958 - hvcsd->port.count = 0;
50959 + atomic_set(&hvcsd->port.count, 0);
50960
50961 /* This will drop any buffered data on the floor which is OK in a hangup
50962 * scenario. */
50963 @@ -1352,7 +1353,7 @@ static int hvcs_write(struct tty_struct *tty,
50964 * the middle of a write operation? This is a crummy place to do this
50965 * but we want to keep it all in the spinlock.
50966 */
50967 - if (hvcsd->port.count <= 0) {
50968 + if (atomic_read(&hvcsd->port.count) <= 0) {
50969 spin_unlock_irqrestore(&hvcsd->lock, flags);
50970 return -ENODEV;
50971 }
50972 @@ -1426,7 +1427,7 @@ static int hvcs_write_room(struct tty_struct *tty)
50973 {
50974 struct hvcs_struct *hvcsd = tty->driver_data;
50975
50976 - if (!hvcsd || hvcsd->port.count <= 0)
50977 + if (!hvcsd || atomic_read(&hvcsd->port.count) <= 0)
50978 return 0;
50979
50980 return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
50981 diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c
50982 index 4190199..06d5bfa 100644
50983 --- a/drivers/tty/hvc/hvsi.c
50984 +++ b/drivers/tty/hvc/hvsi.c
50985 @@ -85,7 +85,7 @@ struct hvsi_struct {
50986 int n_outbuf;
50987 uint32_t vtermno;
50988 uint32_t virq;
50989 - atomic_t seqno; /* HVSI packet sequence number */
50990 + atomic_unchecked_t seqno; /* HVSI packet sequence number */
50991 uint16_t mctrl;
50992 uint8_t state; /* HVSI protocol state */
50993 uint8_t flags;
50994 @@ -295,7 +295,7 @@ static int hvsi_version_respond(struct hvsi_struct *hp, uint16_t query_seqno)
50995
50996 packet.hdr.type = VS_QUERY_RESPONSE_PACKET_HEADER;
50997 packet.hdr.len = sizeof(struct hvsi_query_response);
50998 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
50999 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
51000 packet.verb = VSV_SEND_VERSION_NUMBER;
51001 packet.u.version = HVSI_VERSION;
51002 packet.query_seqno = query_seqno+1;
51003 @@ -555,7 +555,7 @@ static int hvsi_query(struct hvsi_struct *hp, uint16_t verb)
51004
51005 packet.hdr.type = VS_QUERY_PACKET_HEADER;
51006 packet.hdr.len = sizeof(struct hvsi_query);
51007 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
51008 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
51009 packet.verb = verb;
51010
51011 pr_debug("%s: sending %i bytes\n", __func__, packet.hdr.len);
51012 @@ -597,7 +597,7 @@ static int hvsi_set_mctrl(struct hvsi_struct *hp, uint16_t mctrl)
51013 int wrote;
51014
51015 packet.hdr.type = VS_CONTROL_PACKET_HEADER,
51016 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
51017 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
51018 packet.hdr.len = sizeof(struct hvsi_control);
51019 packet.verb = VSV_SET_MODEM_CTL;
51020 packet.mask = HVSI_TSDTR;
51021 @@ -680,7 +680,7 @@ static int hvsi_put_chars(struct hvsi_struct *hp, const char *buf, int count)
51022 BUG_ON(count > HVSI_MAX_OUTGOING_DATA);
51023
51024 packet.hdr.type = VS_DATA_PACKET_HEADER;
51025 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
51026 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
51027 packet.hdr.len = count + sizeof(struct hvsi_header);
51028 memcpy(&packet.data, buf, count);
51029
51030 @@ -697,7 +697,7 @@ static void hvsi_close_protocol(struct hvsi_struct *hp)
51031 struct hvsi_control packet __ALIGNED__;
51032
51033 packet.hdr.type = VS_CONTROL_PACKET_HEADER;
51034 - packet.hdr.seqno = atomic_inc_return(&hp->seqno);
51035 + packet.hdr.seqno = atomic_inc_return_unchecked(&hp->seqno);
51036 packet.hdr.len = 6;
51037 packet.verb = VSV_CLOSE_PROTOCOL;
51038
51039 @@ -725,7 +725,7 @@ static int hvsi_open(struct tty_struct *tty, struct file *filp)
51040
51041 tty_port_tty_set(&hp->port, tty);
51042 spin_lock_irqsave(&hp->lock, flags);
51043 - hp->port.count++;
51044 + atomic_inc(&hp->port.count);
51045 atomic_set(&hp->seqno, 0);
51046 h_vio_signal(hp->vtermno, VIO_IRQ_ENABLE);
51047 spin_unlock_irqrestore(&hp->lock, flags);
51048 @@ -782,7 +782,7 @@ static void hvsi_close(struct tty_struct *tty, struct file *filp)
51049
51050 spin_lock_irqsave(&hp->lock, flags);
51051
51052 - if (--hp->port.count == 0) {
51053 + if (atomic_dec_return(&hp->port.count) == 0) {
51054 tty_port_tty_set(&hp->port, NULL);
51055 hp->inbuf_end = hp->inbuf; /* discard remaining partial packets */
51056
51057 @@ -815,9 +815,9 @@ static void hvsi_close(struct tty_struct *tty, struct file *filp)
51058
51059 spin_lock_irqsave(&hp->lock, flags);
51060 }
51061 - } else if (hp->port.count < 0)
51062 + } else if (atomic_read(&hp->port.count) < 0)
51063 printk(KERN_ERR "hvsi_close %lu: oops, count is %d\n",
51064 - hp - hvsi_ports, hp->port.count);
51065 + hp - hvsi_ports, atomic_read(&hp->port.count));
51066
51067 spin_unlock_irqrestore(&hp->lock, flags);
51068 }
51069 @@ -832,7 +832,7 @@ static void hvsi_hangup(struct tty_struct *tty)
51070 tty_port_tty_set(&hp->port, NULL);
51071
51072 spin_lock_irqsave(&hp->lock, flags);
51073 - hp->port.count = 0;
51074 + atomic_set(&hp->port.count, 0);
51075 hp->n_outbuf = 0;
51076 spin_unlock_irqrestore(&hp->lock, flags);
51077 }
51078 diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
51079 index 7ae6c29..05c6dba 100644
51080 --- a/drivers/tty/hvc/hvsi_lib.c
51081 +++ b/drivers/tty/hvc/hvsi_lib.c
51082 @@ -8,7 +8,7 @@
51083
51084 static int hvsi_send_packet(struct hvsi_priv *pv, struct hvsi_header *packet)
51085 {
51086 - packet->seqno = cpu_to_be16(atomic_inc_return(&pv->seqno));
51087 + packet->seqno = cpu_to_be16(atomic_inc_return_unchecked(&pv->seqno));
51088
51089 /* Assumes that always succeeds, works in practice */
51090 return pv->put_chars(pv->termno, (char *)packet, packet->len);
51091 @@ -20,7 +20,7 @@ static void hvsi_start_handshake(struct hvsi_priv *pv)
51092
51093 /* Reset state */
51094 pv->established = 0;
51095 - atomic_set(&pv->seqno, 0);
51096 + atomic_set_unchecked(&pv->seqno, 0);
51097
51098 pr_devel("HVSI@%x: Handshaking started\n", pv->termno);
51099
51100 diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
51101 index 17ee3bf..8d2520d 100644
51102 --- a/drivers/tty/ipwireless/tty.c
51103 +++ b/drivers/tty/ipwireless/tty.c
51104 @@ -28,6 +28,7 @@
51105 #include <linux/tty_driver.h>
51106 #include <linux/tty_flip.h>
51107 #include <linux/uaccess.h>
51108 +#include <asm/local.h>
51109
51110 #include "tty.h"
51111 #include "network.h"
51112 @@ -98,10 +99,10 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
51113 mutex_unlock(&tty->ipw_tty_mutex);
51114 return -ENODEV;
51115 }
51116 - if (tty->port.count == 0)
51117 + if (atomic_read(&tty->port.count) == 0)
51118 tty->tx_bytes_queued = 0;
51119
51120 - tty->port.count++;
51121 + atomic_inc(&tty->port.count);
51122
51123 tty->port.tty = linux_tty;
51124 linux_tty->driver_data = tty;
51125 @@ -117,9 +118,7 @@ static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
51126
51127 static void do_ipw_close(struct ipw_tty *tty)
51128 {
51129 - tty->port.count--;
51130 -
51131 - if (tty->port.count == 0) {
51132 + if (atomic_dec_return(&tty->port.count) == 0) {
51133 struct tty_struct *linux_tty = tty->port.tty;
51134
51135 if (linux_tty != NULL) {
51136 @@ -140,7 +139,7 @@ static void ipw_hangup(struct tty_struct *linux_tty)
51137 return;
51138
51139 mutex_lock(&tty->ipw_tty_mutex);
51140 - if (tty->port.count == 0) {
51141 + if (atomic_read(&tty->port.count) == 0) {
51142 mutex_unlock(&tty->ipw_tty_mutex);
51143 return;
51144 }
51145 @@ -163,7 +162,7 @@ void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
51146
51147 mutex_lock(&tty->ipw_tty_mutex);
51148
51149 - if (!tty->port.count) {
51150 + if (!atomic_read(&tty->port.count)) {
51151 mutex_unlock(&tty->ipw_tty_mutex);
51152 return;
51153 }
51154 @@ -202,7 +201,7 @@ static int ipw_write(struct tty_struct *linux_tty,
51155 return -ENODEV;
51156
51157 mutex_lock(&tty->ipw_tty_mutex);
51158 - if (!tty->port.count) {
51159 + if (!atomic_read(&tty->port.count)) {
51160 mutex_unlock(&tty->ipw_tty_mutex);
51161 return -EINVAL;
51162 }
51163 @@ -242,7 +241,7 @@ static int ipw_write_room(struct tty_struct *linux_tty)
51164 if (!tty)
51165 return -ENODEV;
51166
51167 - if (!tty->port.count)
51168 + if (!atomic_read(&tty->port.count))
51169 return -EINVAL;
51170
51171 room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
51172 @@ -284,7 +283,7 @@ static int ipw_chars_in_buffer(struct tty_struct *linux_tty)
51173 if (!tty)
51174 return 0;
51175
51176 - if (!tty->port.count)
51177 + if (!atomic_read(&tty->port.count))
51178 return 0;
51179
51180 return tty->tx_bytes_queued;
51181 @@ -365,7 +364,7 @@ static int ipw_tiocmget(struct tty_struct *linux_tty)
51182 if (!tty)
51183 return -ENODEV;
51184
51185 - if (!tty->port.count)
51186 + if (!atomic_read(&tty->port.count))
51187 return -EINVAL;
51188
51189 return get_control_lines(tty);
51190 @@ -381,7 +380,7 @@ ipw_tiocmset(struct tty_struct *linux_tty,
51191 if (!tty)
51192 return -ENODEV;
51193
51194 - if (!tty->port.count)
51195 + if (!atomic_read(&tty->port.count))
51196 return -EINVAL;
51197
51198 return set_control_lines(tty, set, clear);
51199 @@ -395,7 +394,7 @@ static int ipw_ioctl(struct tty_struct *linux_tty,
51200 if (!tty)
51201 return -ENODEV;
51202
51203 - if (!tty->port.count)
51204 + if (!atomic_read(&tty->port.count))
51205 return -EINVAL;
51206
51207 /* FIXME: Exactly how is the tty object locked here .. */
51208 @@ -551,7 +550,7 @@ void ipwireless_tty_free(struct ipw_tty *tty)
51209 * are gone */
51210 mutex_lock(&ttyj->ipw_tty_mutex);
51211 }
51212 - while (ttyj->port.count)
51213 + while (atomic_read(&ttyj->port.count))
51214 do_ipw_close(ttyj);
51215 ipwireless_disassociate_network_ttys(network,
51216 ttyj->channel_idx);
51217 diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c
51218 index 1deaca4..c8582d4 100644
51219 --- a/drivers/tty/moxa.c
51220 +++ b/drivers/tty/moxa.c
51221 @@ -1189,7 +1189,7 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
51222 }
51223
51224 ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
51225 - ch->port.count++;
51226 + atomic_inc(&ch->port.count);
51227 tty->driver_data = ch;
51228 tty_port_tty_set(&ch->port, tty);
51229 mutex_lock(&ch->port.mutex);
51230 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
51231 index 2ebe47b..3205833 100644
51232 --- a/drivers/tty/n_gsm.c
51233 +++ b/drivers/tty/n_gsm.c
51234 @@ -1644,7 +1644,7 @@ static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
51235 spin_lock_init(&dlci->lock);
51236 mutex_init(&dlci->mutex);
51237 dlci->fifo = &dlci->_fifo;
51238 - if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL) < 0) {
51239 + if (kfifo_alloc(&dlci->_fifo, 4096, GFP_KERNEL)) {
51240 kfree(dlci);
51241 return NULL;
51242 }
51243 @@ -2954,7 +2954,7 @@ static int gsmtty_open(struct tty_struct *tty, struct file *filp)
51244 struct gsm_dlci *dlci = tty->driver_data;
51245 struct tty_port *port = &dlci->port;
51246
51247 - port->count++;
51248 + atomic_inc(&port->count);
51249 tty_port_tty_set(port, tty);
51250
51251 dlci->modem_rx = 0;
51252 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
51253 index e36d1f5..9938e3e 100644
51254 --- a/drivers/tty/n_tty.c
51255 +++ b/drivers/tty/n_tty.c
51256 @@ -115,7 +115,7 @@ struct n_tty_data {
51257 int minimum_to_wake;
51258
51259 /* consumer-published */
51260 - size_t read_tail;
51261 + size_t read_tail __intentional_overflow(-1);
51262 size_t line_start;
51263
51264 /* protected by output lock */
51265 @@ -2519,6 +2519,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
51266 {
51267 *ops = tty_ldisc_N_TTY;
51268 ops->owner = NULL;
51269 - ops->refcount = ops->flags = 0;
51270 + atomic_set(&ops->refcount, 0);
51271 + ops->flags = 0;
51272 }
51273 EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
51274 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
51275 index 25c9bc7..24077b7 100644
51276 --- a/drivers/tty/pty.c
51277 +++ b/drivers/tty/pty.c
51278 @@ -790,8 +790,10 @@ static void __init unix98_pty_init(void)
51279 panic("Couldn't register Unix98 pts driver");
51280
51281 /* Now create the /dev/ptmx special device */
51282 + pax_open_kernel();
51283 tty_default_fops(&ptmx_fops);
51284 - ptmx_fops.open = ptmx_open;
51285 + *(void **)&ptmx_fops.open = ptmx_open;
51286 + pax_close_kernel();
51287
51288 cdev_init(&ptmx_cdev, &ptmx_fops);
51289 if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
51290 diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
51291 index 383c4c7..d408e21 100644
51292 --- a/drivers/tty/rocket.c
51293 +++ b/drivers/tty/rocket.c
51294 @@ -914,7 +914,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
51295 tty->driver_data = info;
51296 tty_port_tty_set(port, tty);
51297
51298 - if (port->count++ == 0) {
51299 + if (atomic_inc_return(&port->count) == 1) {
51300 atomic_inc(&rp_num_ports_open);
51301
51302 #ifdef ROCKET_DEBUG_OPEN
51303 @@ -923,7 +923,7 @@ static int rp_open(struct tty_struct *tty, struct file *filp)
51304 #endif
51305 }
51306 #ifdef ROCKET_DEBUG_OPEN
51307 - printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, info->port.count);
51308 + printk(KERN_INFO "rp_open ttyR%d, count=%d\n", info->line, atomic-read(&info->port.count));
51309 #endif
51310
51311 /*
51312 @@ -1515,7 +1515,7 @@ static void rp_hangup(struct tty_struct *tty)
51313 spin_unlock_irqrestore(&info->port.lock, flags);
51314 return;
51315 }
51316 - if (info->port.count)
51317 + if (atomic_read(&info->port.count))
51318 atomic_dec(&rp_num_ports_open);
51319 clear_bit((info->aiop * 8) + info->chan, (void *) &xmit_flags[info->board]);
51320 spin_unlock_irqrestore(&info->port.lock, flags);
51321 diff --git a/drivers/tty/serial/ioc4_serial.c b/drivers/tty/serial/ioc4_serial.c
51322 index 1274499..f541382 100644
51323 --- a/drivers/tty/serial/ioc4_serial.c
51324 +++ b/drivers/tty/serial/ioc4_serial.c
51325 @@ -437,7 +437,7 @@ struct ioc4_soft {
51326 } is_intr_info[MAX_IOC4_INTR_ENTS];
51327
51328 /* Number of entries active in the above array */
51329 - atomic_t is_num_intrs;
51330 + atomic_unchecked_t is_num_intrs;
51331 } is_intr_type[IOC4_NUM_INTR_TYPES];
51332
51333 /* is_ir_lock must be held while
51334 @@ -974,7 +974,7 @@ intr_connect(struct ioc4_soft *soft, int type,
51335 BUG_ON(!((type == IOC4_SIO_INTR_TYPE)
51336 || (type == IOC4_OTHER_INTR_TYPE)));
51337
51338 - i = atomic_inc_return(&soft-> is_intr_type[type].is_num_intrs) - 1;
51339 + i = atomic_inc_return_unchecked(&soft-> is_intr_type[type].is_num_intrs) - 1;
51340 BUG_ON(!(i < MAX_IOC4_INTR_ENTS || (printk("i %d\n", i), 0)));
51341
51342 /* Save off the lower level interrupt handler */
51343 @@ -1001,7 +1001,7 @@ static irqreturn_t ioc4_intr(int irq, void *arg)
51344
51345 soft = arg;
51346 for (intr_type = 0; intr_type < IOC4_NUM_INTR_TYPES; intr_type++) {
51347 - num_intrs = (int)atomic_read(
51348 + num_intrs = (int)atomic_read_unchecked(
51349 &soft->is_intr_type[intr_type].is_num_intrs);
51350
51351 this_mir = this_ir = pending_intrs(soft, intr_type);
51352 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
51353 index a260cde..6b2b5ce 100644
51354 --- a/drivers/tty/serial/kgdboc.c
51355 +++ b/drivers/tty/serial/kgdboc.c
51356 @@ -24,8 +24,9 @@
51357 #define MAX_CONFIG_LEN 40
51358
51359 static struct kgdb_io kgdboc_io_ops;
51360 +static struct kgdb_io kgdboc_io_ops_console;
51361
51362 -/* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
51363 +/* -1 = init not run yet, 0 = unconfigured, 1/2 = configured. */
51364 static int configured = -1;
51365
51366 static char config[MAX_CONFIG_LEN];
51367 @@ -151,6 +152,8 @@ static void cleanup_kgdboc(void)
51368 kgdboc_unregister_kbd();
51369 if (configured == 1)
51370 kgdb_unregister_io_module(&kgdboc_io_ops);
51371 + else if (configured == 2)
51372 + kgdb_unregister_io_module(&kgdboc_io_ops_console);
51373 }
51374
51375 static int configure_kgdboc(void)
51376 @@ -160,13 +163,13 @@ static int configure_kgdboc(void)
51377 int err;
51378 char *cptr = config;
51379 struct console *cons;
51380 + int is_console = 0;
51381
51382 err = kgdboc_option_setup(config);
51383 if (err || !strlen(config) || isspace(config[0]))
51384 goto noconfig;
51385
51386 err = -ENODEV;
51387 - kgdboc_io_ops.is_console = 0;
51388 kgdb_tty_driver = NULL;
51389
51390 kgdboc_use_kms = 0;
51391 @@ -187,7 +190,7 @@ static int configure_kgdboc(void)
51392 int idx;
51393 if (cons->device && cons->device(cons, &idx) == p &&
51394 idx == tty_line) {
51395 - kgdboc_io_ops.is_console = 1;
51396 + is_console = 1;
51397 break;
51398 }
51399 cons = cons->next;
51400 @@ -197,7 +200,13 @@ static int configure_kgdboc(void)
51401 kgdb_tty_line = tty_line;
51402
51403 do_register:
51404 - err = kgdb_register_io_module(&kgdboc_io_ops);
51405 + if (is_console) {
51406 + err = kgdb_register_io_module(&kgdboc_io_ops_console);
51407 + configured = 2;
51408 + } else {
51409 + err = kgdb_register_io_module(&kgdboc_io_ops);
51410 + configured = 1;
51411 + }
51412 if (err)
51413 goto noconfig;
51414
51415 @@ -205,8 +214,6 @@ do_register:
51416 if (err)
51417 goto nmi_con_failed;
51418
51419 - configured = 1;
51420 -
51421 return 0;
51422
51423 nmi_con_failed:
51424 @@ -223,7 +230,7 @@ noconfig:
51425 static int __init init_kgdboc(void)
51426 {
51427 /* Already configured? */
51428 - if (configured == 1)
51429 + if (configured >= 1)
51430 return 0;
51431
51432 return configure_kgdboc();
51433 @@ -272,7 +279,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
51434 if (config[len - 1] == '\n')
51435 config[len - 1] = '\0';
51436
51437 - if (configured == 1)
51438 + if (configured >= 1)
51439 cleanup_kgdboc();
51440
51441 /* Go and configure with the new params. */
51442 @@ -312,6 +319,15 @@ static struct kgdb_io kgdboc_io_ops = {
51443 .post_exception = kgdboc_post_exp_handler,
51444 };
51445
51446 +static struct kgdb_io kgdboc_io_ops_console = {
51447 + .name = "kgdboc",
51448 + .read_char = kgdboc_get_char,
51449 + .write_char = kgdboc_put_char,
51450 + .pre_exception = kgdboc_pre_exp_handler,
51451 + .post_exception = kgdboc_post_exp_handler,
51452 + .is_console = 1
51453 +};
51454 +
51455 #ifdef CONFIG_KGDB_SERIAL_CONSOLE
51456 /* This is only available if kgdboc is a built in for early debugging */
51457 static int __init kgdboc_early_init(char *opt)
51458 diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c
51459 index b5d779c..3622cfe 100644
51460 --- a/drivers/tty/serial/msm_serial.c
51461 +++ b/drivers/tty/serial/msm_serial.c
51462 @@ -897,7 +897,7 @@ static struct uart_driver msm_uart_driver = {
51463 .cons = MSM_CONSOLE,
51464 };
51465
51466 -static atomic_t msm_uart_next_id = ATOMIC_INIT(0);
51467 +static atomic_unchecked_t msm_uart_next_id = ATOMIC_INIT(0);
51468
51469 static const struct of_device_id msm_uartdm_table[] = {
51470 { .compatible = "qcom,msm-uartdm" },
51471 @@ -912,7 +912,7 @@ static int __init msm_serial_probe(struct platform_device *pdev)
51472 int irq;
51473
51474 if (pdev->id == -1)
51475 - pdev->id = atomic_inc_return(&msm_uart_next_id) - 1;
51476 + pdev->id = atomic_inc_return_unchecked(&msm_uart_next_id) - 1;
51477
51478 if (unlikely(pdev->id < 0 || pdev->id >= UART_NR))
51479 return -ENXIO;
51480 diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
51481 index 9cd706d..6ff2de7 100644
51482 --- a/drivers/tty/serial/samsung.c
51483 +++ b/drivers/tty/serial/samsung.c
51484 @@ -463,11 +463,16 @@ static void s3c24xx_serial_shutdown(struct uart_port *port)
51485 }
51486 }
51487
51488 +static int s3c64xx_serial_startup(struct uart_port *port);
51489 static int s3c24xx_serial_startup(struct uart_port *port)
51490 {
51491 struct s3c24xx_uart_port *ourport = to_ourport(port);
51492 int ret;
51493
51494 + /* Startup sequence is different for s3c64xx and higher SoC's */
51495 + if (s3c24xx_serial_has_interrupt_mask(port))
51496 + return s3c64xx_serial_startup(port);
51497 +
51498 dbg("s3c24xx_serial_startup: port=%p (%08lx,%p)\n",
51499 port->mapbase, port->membase);
51500
51501 @@ -1141,10 +1146,6 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport,
51502 /* setup info for port */
51503 port->dev = &platdev->dev;
51504
51505 - /* Startup sequence is different for s3c64xx and higher SoC's */
51506 - if (s3c24xx_serial_has_interrupt_mask(port))
51507 - s3c24xx_serial_ops.startup = s3c64xx_serial_startup;
51508 -
51509 port->uartclk = 1;
51510
51511 if (cfg->uart_flags & UPF_CONS_FLOW) {
51512 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
51513 index ece2049..fba2524 100644
51514 --- a/drivers/tty/serial/serial_core.c
51515 +++ b/drivers/tty/serial/serial_core.c
51516 @@ -1448,7 +1448,7 @@ static void uart_hangup(struct tty_struct *tty)
51517 uart_flush_buffer(tty);
51518 uart_shutdown(tty, state);
51519 spin_lock_irqsave(&port->lock, flags);
51520 - port->count = 0;
51521 + atomic_set(&port->count, 0);
51522 clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
51523 spin_unlock_irqrestore(&port->lock, flags);
51524 tty_port_tty_set(port, NULL);
51525 @@ -1544,7 +1544,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
51526 goto end;
51527 }
51528
51529 - port->count++;
51530 + atomic_inc(&port->count);
51531 if (!state->uart_port || state->uart_port->flags & UPF_DEAD) {
51532 retval = -ENXIO;
51533 goto err_dec_count;
51534 @@ -1572,7 +1572,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
51535 /*
51536 * Make sure the device is in D0 state.
51537 */
51538 - if (port->count == 1)
51539 + if (atomic_read(&port->count) == 1)
51540 uart_change_pm(state, UART_PM_STATE_ON);
51541
51542 /*
51543 @@ -1590,7 +1590,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
51544 end:
51545 return retval;
51546 err_dec_count:
51547 - port->count--;
51548 + atomic_inc(&port->count);
51549 mutex_unlock(&port->mutex);
51550 goto end;
51551 }
51552 diff --git a/drivers/tty/synclink.c b/drivers/tty/synclink.c
51553 index 5ae14b4..2c1288f 100644
51554 --- a/drivers/tty/synclink.c
51555 +++ b/drivers/tty/synclink.c
51556 @@ -3090,7 +3090,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
51557
51558 if (debug_level >= DEBUG_LEVEL_INFO)
51559 printk("%s(%d):mgsl_close(%s) entry, count=%d\n",
51560 - __FILE__,__LINE__, info->device_name, info->port.count);
51561 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
51562
51563 if (tty_port_close_start(&info->port, tty, filp) == 0)
51564 goto cleanup;
51565 @@ -3108,7 +3108,7 @@ static void mgsl_close(struct tty_struct *tty, struct file * filp)
51566 cleanup:
51567 if (debug_level >= DEBUG_LEVEL_INFO)
51568 printk("%s(%d):mgsl_close(%s) exit, count=%d\n", __FILE__,__LINE__,
51569 - tty->driver->name, info->port.count);
51570 + tty->driver->name, atomic_read(&info->port.count));
51571
51572 } /* end of mgsl_close() */
51573
51574 @@ -3207,8 +3207,8 @@ static void mgsl_hangup(struct tty_struct *tty)
51575
51576 mgsl_flush_buffer(tty);
51577 shutdown(info);
51578 -
51579 - info->port.count = 0;
51580 +
51581 + atomic_set(&info->port.count, 0);
51582 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
51583 info->port.tty = NULL;
51584
51585 @@ -3297,12 +3297,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
51586
51587 if (debug_level >= DEBUG_LEVEL_INFO)
51588 printk("%s(%d):block_til_ready before block on %s count=%d\n",
51589 - __FILE__,__LINE__, tty->driver->name, port->count );
51590 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51591
51592 spin_lock_irqsave(&info->irq_spinlock, flags);
51593 if (!tty_hung_up_p(filp)) {
51594 extra_count = true;
51595 - port->count--;
51596 + atomic_dec(&port->count);
51597 }
51598 spin_unlock_irqrestore(&info->irq_spinlock, flags);
51599 port->blocked_open++;
51600 @@ -3331,7 +3331,7 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
51601
51602 if (debug_level >= DEBUG_LEVEL_INFO)
51603 printk("%s(%d):block_til_ready blocking on %s count=%d\n",
51604 - __FILE__,__LINE__, tty->driver->name, port->count );
51605 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51606
51607 tty_unlock(tty);
51608 schedule();
51609 @@ -3343,12 +3343,12 @@ static int block_til_ready(struct tty_struct *tty, struct file * filp,
51610
51611 /* FIXME: Racy on hangup during close wait */
51612 if (extra_count)
51613 - port->count++;
51614 + atomic_inc(&port->count);
51615 port->blocked_open--;
51616
51617 if (debug_level >= DEBUG_LEVEL_INFO)
51618 printk("%s(%d):block_til_ready after blocking on %s count=%d\n",
51619 - __FILE__,__LINE__, tty->driver->name, port->count );
51620 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51621
51622 if (!retval)
51623 port->flags |= ASYNC_NORMAL_ACTIVE;
51624 @@ -3400,7 +3400,7 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
51625
51626 if (debug_level >= DEBUG_LEVEL_INFO)
51627 printk("%s(%d):mgsl_open(%s), old ref count = %d\n",
51628 - __FILE__,__LINE__,tty->driver->name, info->port.count);
51629 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
51630
51631 /* If port is closing, signal caller to try again */
51632 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
51633 @@ -3419,10 +3419,10 @@ static int mgsl_open(struct tty_struct *tty, struct file * filp)
51634 spin_unlock_irqrestore(&info->netlock, flags);
51635 goto cleanup;
51636 }
51637 - info->port.count++;
51638 + atomic_inc(&info->port.count);
51639 spin_unlock_irqrestore(&info->netlock, flags);
51640
51641 - if (info->port.count == 1) {
51642 + if (atomic_read(&info->port.count) == 1) {
51643 /* 1st open on this device, init hardware */
51644 retval = startup(info);
51645 if (retval < 0)
51646 @@ -3446,8 +3446,8 @@ cleanup:
51647 if (retval) {
51648 if (tty->count == 1)
51649 info->port.tty = NULL; /* tty layer will release tty struct */
51650 - if(info->port.count)
51651 - info->port.count--;
51652 + if (atomic_read(&info->port.count))
51653 + atomic_dec(&info->port.count);
51654 }
51655
51656 return retval;
51657 @@ -7665,7 +7665,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
51658 unsigned short new_crctype;
51659
51660 /* return error if TTY interface open */
51661 - if (info->port.count)
51662 + if (atomic_read(&info->port.count))
51663 return -EBUSY;
51664
51665 switch (encoding)
51666 @@ -7760,7 +7760,7 @@ static int hdlcdev_open(struct net_device *dev)
51667
51668 /* arbitrate between network and tty opens */
51669 spin_lock_irqsave(&info->netlock, flags);
51670 - if (info->port.count != 0 || info->netcount != 0) {
51671 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
51672 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
51673 spin_unlock_irqrestore(&info->netlock, flags);
51674 return -EBUSY;
51675 @@ -7846,7 +7846,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
51676 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
51677
51678 /* return error if TTY interface open */
51679 - if (info->port.count)
51680 + if (atomic_read(&info->port.count))
51681 return -EBUSY;
51682
51683 if (cmd != SIOCWANDEV)
51684 diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
51685 index c359a91..959fc26 100644
51686 --- a/drivers/tty/synclink_gt.c
51687 +++ b/drivers/tty/synclink_gt.c
51688 @@ -670,7 +670,7 @@ static int open(struct tty_struct *tty, struct file *filp)
51689 tty->driver_data = info;
51690 info->port.tty = tty;
51691
51692 - DBGINFO(("%s open, old ref count = %d\n", info->device_name, info->port.count));
51693 + DBGINFO(("%s open, old ref count = %d\n", info->device_name, atomic_read(&info->port.count)));
51694
51695 /* If port is closing, signal caller to try again */
51696 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
51697 @@ -691,10 +691,10 @@ static int open(struct tty_struct *tty, struct file *filp)
51698 mutex_unlock(&info->port.mutex);
51699 goto cleanup;
51700 }
51701 - info->port.count++;
51702 + atomic_inc(&info->port.count);
51703 spin_unlock_irqrestore(&info->netlock, flags);
51704
51705 - if (info->port.count == 1) {
51706 + if (atomic_read(&info->port.count) == 1) {
51707 /* 1st open on this device, init hardware */
51708 retval = startup(info);
51709 if (retval < 0) {
51710 @@ -715,8 +715,8 @@ cleanup:
51711 if (retval) {
51712 if (tty->count == 1)
51713 info->port.tty = NULL; /* tty layer will release tty struct */
51714 - if(info->port.count)
51715 - info->port.count--;
51716 + if(atomic_read(&info->port.count))
51717 + atomic_dec(&info->port.count);
51718 }
51719
51720 DBGINFO(("%s open rc=%d\n", info->device_name, retval));
51721 @@ -729,7 +729,7 @@ static void close(struct tty_struct *tty, struct file *filp)
51722
51723 if (sanity_check(info, tty->name, "close"))
51724 return;
51725 - DBGINFO(("%s close entry, count=%d\n", info->device_name, info->port.count));
51726 + DBGINFO(("%s close entry, count=%d\n", info->device_name, atomic_read(&info->port.count)));
51727
51728 if (tty_port_close_start(&info->port, tty, filp) == 0)
51729 goto cleanup;
51730 @@ -746,7 +746,7 @@ static void close(struct tty_struct *tty, struct file *filp)
51731 tty_port_close_end(&info->port, tty);
51732 info->port.tty = NULL;
51733 cleanup:
51734 - DBGINFO(("%s close exit, count=%d\n", tty->driver->name, info->port.count));
51735 + DBGINFO(("%s close exit, count=%d\n", tty->driver->name, atomic_read(&info->port.count)));
51736 }
51737
51738 static void hangup(struct tty_struct *tty)
51739 @@ -764,7 +764,7 @@ static void hangup(struct tty_struct *tty)
51740 shutdown(info);
51741
51742 spin_lock_irqsave(&info->port.lock, flags);
51743 - info->port.count = 0;
51744 + atomic_set(&info->port.count, 0);
51745 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
51746 info->port.tty = NULL;
51747 spin_unlock_irqrestore(&info->port.lock, flags);
51748 @@ -1449,7 +1449,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
51749 unsigned short new_crctype;
51750
51751 /* return error if TTY interface open */
51752 - if (info->port.count)
51753 + if (atomic_read(&info->port.count))
51754 return -EBUSY;
51755
51756 DBGINFO(("%s hdlcdev_attach\n", info->device_name));
51757 @@ -1544,7 +1544,7 @@ static int hdlcdev_open(struct net_device *dev)
51758
51759 /* arbitrate between network and tty opens */
51760 spin_lock_irqsave(&info->netlock, flags);
51761 - if (info->port.count != 0 || info->netcount != 0) {
51762 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
51763 DBGINFO(("%s hdlc_open busy\n", dev->name));
51764 spin_unlock_irqrestore(&info->netlock, flags);
51765 return -EBUSY;
51766 @@ -1629,7 +1629,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
51767 DBGINFO(("%s hdlcdev_ioctl\n", dev->name));
51768
51769 /* return error if TTY interface open */
51770 - if (info->port.count)
51771 + if (atomic_read(&info->port.count))
51772 return -EBUSY;
51773
51774 if (cmd != SIOCWANDEV)
51775 @@ -2413,7 +2413,7 @@ static irqreturn_t slgt_interrupt(int dummy, void *dev_id)
51776 if (port == NULL)
51777 continue;
51778 spin_lock(&port->lock);
51779 - if ((port->port.count || port->netcount) &&
51780 + if ((atomic_read(&port->port.count) || port->netcount) &&
51781 port->pending_bh && !port->bh_running &&
51782 !port->bh_requested) {
51783 DBGISR(("%s bh queued\n", port->device_name));
51784 @@ -3302,7 +3302,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
51785 spin_lock_irqsave(&info->lock, flags);
51786 if (!tty_hung_up_p(filp)) {
51787 extra_count = true;
51788 - port->count--;
51789 + atomic_dec(&port->count);
51790 }
51791 spin_unlock_irqrestore(&info->lock, flags);
51792 port->blocked_open++;
51793 @@ -3339,7 +3339,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
51794 remove_wait_queue(&port->open_wait, &wait);
51795
51796 if (extra_count)
51797 - port->count++;
51798 + atomic_inc(&port->count);
51799 port->blocked_open--;
51800
51801 if (!retval)
51802 diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
51803 index 144202e..4ccb07d 100644
51804 --- a/drivers/tty/synclinkmp.c
51805 +++ b/drivers/tty/synclinkmp.c
51806 @@ -750,7 +750,7 @@ static int open(struct tty_struct *tty, struct file *filp)
51807
51808 if (debug_level >= DEBUG_LEVEL_INFO)
51809 printk("%s(%d):%s open(), old ref count = %d\n",
51810 - __FILE__,__LINE__,tty->driver->name, info->port.count);
51811 + __FILE__,__LINE__,tty->driver->name, atomic_read(&info->port.count));
51812
51813 /* If port is closing, signal caller to try again */
51814 if (tty_hung_up_p(filp) || info->port.flags & ASYNC_CLOSING){
51815 @@ -769,10 +769,10 @@ static int open(struct tty_struct *tty, struct file *filp)
51816 spin_unlock_irqrestore(&info->netlock, flags);
51817 goto cleanup;
51818 }
51819 - info->port.count++;
51820 + atomic_inc(&info->port.count);
51821 spin_unlock_irqrestore(&info->netlock, flags);
51822
51823 - if (info->port.count == 1) {
51824 + if (atomic_read(&info->port.count) == 1) {
51825 /* 1st open on this device, init hardware */
51826 retval = startup(info);
51827 if (retval < 0)
51828 @@ -796,8 +796,8 @@ cleanup:
51829 if (retval) {
51830 if (tty->count == 1)
51831 info->port.tty = NULL; /* tty layer will release tty struct */
51832 - if(info->port.count)
51833 - info->port.count--;
51834 + if(atomic_read(&info->port.count))
51835 + atomic_dec(&info->port.count);
51836 }
51837
51838 return retval;
51839 @@ -815,7 +815,7 @@ static void close(struct tty_struct *tty, struct file *filp)
51840
51841 if (debug_level >= DEBUG_LEVEL_INFO)
51842 printk("%s(%d):%s close() entry, count=%d\n",
51843 - __FILE__,__LINE__, info->device_name, info->port.count);
51844 + __FILE__,__LINE__, info->device_name, atomic_read(&info->port.count));
51845
51846 if (tty_port_close_start(&info->port, tty, filp) == 0)
51847 goto cleanup;
51848 @@ -834,7 +834,7 @@ static void close(struct tty_struct *tty, struct file *filp)
51849 cleanup:
51850 if (debug_level >= DEBUG_LEVEL_INFO)
51851 printk("%s(%d):%s close() exit, count=%d\n", __FILE__,__LINE__,
51852 - tty->driver->name, info->port.count);
51853 + tty->driver->name, atomic_read(&info->port.count));
51854 }
51855
51856 /* Called by tty_hangup() when a hangup is signaled.
51857 @@ -857,7 +857,7 @@ static void hangup(struct tty_struct *tty)
51858 shutdown(info);
51859
51860 spin_lock_irqsave(&info->port.lock, flags);
51861 - info->port.count = 0;
51862 + atomic_set(&info->port.count, 0);
51863 info->port.flags &= ~ASYNC_NORMAL_ACTIVE;
51864 info->port.tty = NULL;
51865 spin_unlock_irqrestore(&info->port.lock, flags);
51866 @@ -1565,7 +1565,7 @@ static int hdlcdev_attach(struct net_device *dev, unsigned short encoding,
51867 unsigned short new_crctype;
51868
51869 /* return error if TTY interface open */
51870 - if (info->port.count)
51871 + if (atomic_read(&info->port.count))
51872 return -EBUSY;
51873
51874 switch (encoding)
51875 @@ -1660,7 +1660,7 @@ static int hdlcdev_open(struct net_device *dev)
51876
51877 /* arbitrate between network and tty opens */
51878 spin_lock_irqsave(&info->netlock, flags);
51879 - if (info->port.count != 0 || info->netcount != 0) {
51880 + if (atomic_read(&info->port.count) != 0 || info->netcount != 0) {
51881 printk(KERN_WARNING "%s: hdlc_open returning busy\n", dev->name);
51882 spin_unlock_irqrestore(&info->netlock, flags);
51883 return -EBUSY;
51884 @@ -1746,7 +1746,7 @@ static int hdlcdev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
51885 printk("%s:hdlcdev_ioctl(%s)\n",__FILE__,dev->name);
51886
51887 /* return error if TTY interface open */
51888 - if (info->port.count)
51889 + if (atomic_read(&info->port.count))
51890 return -EBUSY;
51891
51892 if (cmd != SIOCWANDEV)
51893 @@ -2620,7 +2620,7 @@ static irqreturn_t synclinkmp_interrupt(int dummy, void *dev_id)
51894 * do not request bottom half processing if the
51895 * device is not open in a normal mode.
51896 */
51897 - if ( port && (port->port.count || port->netcount) &&
51898 + if ( port && (atomic_read(&port->port.count) || port->netcount) &&
51899 port->pending_bh && !port->bh_running &&
51900 !port->bh_requested ) {
51901 if ( debug_level >= DEBUG_LEVEL_ISR )
51902 @@ -3318,12 +3318,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
51903
51904 if (debug_level >= DEBUG_LEVEL_INFO)
51905 printk("%s(%d):%s block_til_ready() before block, count=%d\n",
51906 - __FILE__,__LINE__, tty->driver->name, port->count );
51907 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51908
51909 spin_lock_irqsave(&info->lock, flags);
51910 if (!tty_hung_up_p(filp)) {
51911 extra_count = true;
51912 - port->count--;
51913 + atomic_dec(&port->count);
51914 }
51915 spin_unlock_irqrestore(&info->lock, flags);
51916 port->blocked_open++;
51917 @@ -3352,7 +3352,7 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
51918
51919 if (debug_level >= DEBUG_LEVEL_INFO)
51920 printk("%s(%d):%s block_til_ready() count=%d\n",
51921 - __FILE__,__LINE__, tty->driver->name, port->count );
51922 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51923
51924 tty_unlock(tty);
51925 schedule();
51926 @@ -3363,12 +3363,12 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
51927 remove_wait_queue(&port->open_wait, &wait);
51928
51929 if (extra_count)
51930 - port->count++;
51931 + atomic_inc(&port->count);
51932 port->blocked_open--;
51933
51934 if (debug_level >= DEBUG_LEVEL_INFO)
51935 printk("%s(%d):%s block_til_ready() after, count=%d\n",
51936 - __FILE__,__LINE__, tty->driver->name, port->count );
51937 + __FILE__,__LINE__, tty->driver->name, atomic_read(&port->count));
51938
51939 if (!retval)
51940 port->flags |= ASYNC_NORMAL_ACTIVE;
51941 diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
51942 index ce396ec..04a37be 100644
51943 --- a/drivers/tty/sysrq.c
51944 +++ b/drivers/tty/sysrq.c
51945 @@ -1075,7 +1075,7 @@ EXPORT_SYMBOL(unregister_sysrq_key);
51946 static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf,
51947 size_t count, loff_t *ppos)
51948 {
51949 - if (count) {
51950 + if (count && capable(CAP_SYS_ADMIN)) {
51951 char c;
51952
51953 if (get_user(c, buf))
51954 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
51955 index d3448a9..28e8db0 100644
51956 --- a/drivers/tty/tty_io.c
51957 +++ b/drivers/tty/tty_io.c
51958 @@ -3475,7 +3475,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
51959
51960 void tty_default_fops(struct file_operations *fops)
51961 {
51962 - *fops = tty_fops;
51963 + memcpy((void *)fops, &tty_fops, sizeof(tty_fops));
51964 }
51965
51966 /*
51967 diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
51968 index 2d822aa..a566234 100644
51969 --- a/drivers/tty/tty_ldisc.c
51970 +++ b/drivers/tty/tty_ldisc.c
51971 @@ -71,7 +71,7 @@ int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc)
51972 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
51973 tty_ldiscs[disc] = new_ldisc;
51974 new_ldisc->num = disc;
51975 - new_ldisc->refcount = 0;
51976 + atomic_set(&new_ldisc->refcount, 0);
51977 raw_spin_unlock_irqrestore(&tty_ldiscs_lock, flags);
51978
51979 return ret;
51980 @@ -99,7 +99,7 @@ int tty_unregister_ldisc(int disc)
51981 return -EINVAL;
51982
51983 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
51984 - if (tty_ldiscs[disc]->refcount)
51985 + if (atomic_read(&tty_ldiscs[disc]->refcount))
51986 ret = -EBUSY;
51987 else
51988 tty_ldiscs[disc] = NULL;
51989 @@ -120,7 +120,7 @@ static struct tty_ldisc_ops *get_ldops(int disc)
51990 if (ldops) {
51991 ret = ERR_PTR(-EAGAIN);
51992 if (try_module_get(ldops->owner)) {
51993 - ldops->refcount++;
51994 + atomic_inc(&ldops->refcount);
51995 ret = ldops;
51996 }
51997 }
51998 @@ -133,7 +133,7 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
51999 unsigned long flags;
52000
52001 raw_spin_lock_irqsave(&tty_ldiscs_lock, flags);
52002 - ldops->refcount--;
52003 + atomic_dec(&ldops->refcount);
52004 module_put(ldops->owner);
52005 raw_spin_unlock_irqrestore(&tty_ldiscs_lock, flags);
52006 }
52007 diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
52008 index 3f746c8..2f2fcaa 100644
52009 --- a/drivers/tty/tty_port.c
52010 +++ b/drivers/tty/tty_port.c
52011 @@ -235,7 +235,7 @@ void tty_port_hangup(struct tty_port *port)
52012 unsigned long flags;
52013
52014 spin_lock_irqsave(&port->lock, flags);
52015 - port->count = 0;
52016 + atomic_set(&port->count, 0);
52017 port->flags &= ~ASYNC_NORMAL_ACTIVE;
52018 tty = port->tty;
52019 if (tty)
52020 @@ -393,7 +393,7 @@ int tty_port_block_til_ready(struct tty_port *port,
52021 /* The port lock protects the port counts */
52022 spin_lock_irqsave(&port->lock, flags);
52023 if (!tty_hung_up_p(filp))
52024 - port->count--;
52025 + atomic_dec(&port->count);
52026 port->blocked_open++;
52027 spin_unlock_irqrestore(&port->lock, flags);
52028
52029 @@ -435,7 +435,7 @@ int tty_port_block_til_ready(struct tty_port *port,
52030 we must not mess that up further */
52031 spin_lock_irqsave(&port->lock, flags);
52032 if (!tty_hung_up_p(filp))
52033 - port->count++;
52034 + atomic_inc(&port->count);
52035 port->blocked_open--;
52036 if (retval == 0)
52037 port->flags |= ASYNC_NORMAL_ACTIVE;
52038 @@ -469,19 +469,19 @@ int tty_port_close_start(struct tty_port *port,
52039 return 0;
52040 }
52041
52042 - if (tty->count == 1 && port->count != 1) {
52043 + if (tty->count == 1 && atomic_read(&port->count) != 1) {
52044 printk(KERN_WARNING
52045 "tty_port_close_start: tty->count = 1 port count = %d.\n",
52046 - port->count);
52047 - port->count = 1;
52048 + atomic_read(&port->count));
52049 + atomic_set(&port->count, 1);
52050 }
52051 - if (--port->count < 0) {
52052 + if (atomic_dec_return(&port->count) < 0) {
52053 printk(KERN_WARNING "tty_port_close_start: count = %d\n",
52054 - port->count);
52055 - port->count = 0;
52056 + atomic_read(&port->count));
52057 + atomic_set(&port->count, 0);
52058 }
52059
52060 - if (port->count) {
52061 + if (atomic_read(&port->count)) {
52062 spin_unlock_irqrestore(&port->lock, flags);
52063 return 0;
52064 }
52065 @@ -563,7 +563,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
52066 {
52067 spin_lock_irq(&port->lock);
52068 if (!tty_hung_up_p(filp))
52069 - ++port->count;
52070 + atomic_inc(&port->count);
52071 spin_unlock_irq(&port->lock);
52072 tty_port_tty_set(port, tty);
52073
52074 diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
52075 index d0e3a44..5f8b754 100644
52076 --- a/drivers/tty/vt/keyboard.c
52077 +++ b/drivers/tty/vt/keyboard.c
52078 @@ -641,6 +641,16 @@ static void k_spec(struct vc_data *vc, unsigned char value, char up_flag)
52079 kbd->kbdmode == VC_OFF) &&
52080 value != KVAL(K_SAK))
52081 return; /* SAK is allowed even in raw mode */
52082 +
52083 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
52084 + {
52085 + void *func = fn_handler[value];
52086 + if (func == fn_show_state || func == fn_show_ptregs ||
52087 + func == fn_show_mem)
52088 + return;
52089 + }
52090 +#endif
52091 +
52092 fn_handler[value](vc);
52093 }
52094
52095 @@ -1776,9 +1786,6 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
52096 if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
52097 return -EFAULT;
52098
52099 - if (!capable(CAP_SYS_TTY_CONFIG))
52100 - perm = 0;
52101 -
52102 switch (cmd) {
52103 case KDGKBENT:
52104 /* Ensure another thread doesn't free it under us */
52105 @@ -1793,6 +1800,9 @@ int vt_do_kdsk_ioctl(int cmd, struct kbentry __user *user_kbe, int perm,
52106 spin_unlock_irqrestore(&kbd_event_lock, flags);
52107 return put_user(val, &user_kbe->kb_value);
52108 case KDSKBENT:
52109 + if (!capable(CAP_SYS_TTY_CONFIG))
52110 + perm = 0;
52111 +
52112 if (!perm)
52113 return -EPERM;
52114 if (!i && v == K_NOSUCHMAP) {
52115 @@ -1883,9 +1893,6 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
52116 int i, j, k;
52117 int ret;
52118
52119 - if (!capable(CAP_SYS_TTY_CONFIG))
52120 - perm = 0;
52121 -
52122 kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
52123 if (!kbs) {
52124 ret = -ENOMEM;
52125 @@ -1919,6 +1926,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
52126 kfree(kbs);
52127 return ((p && *p) ? -EOVERFLOW : 0);
52128 case KDSKBSENT:
52129 + if (!capable(CAP_SYS_TTY_CONFIG))
52130 + perm = 0;
52131 +
52132 if (!perm) {
52133 ret = -EPERM;
52134 goto reterr;
52135 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
52136 index a673e5b..36e5d32 100644
52137 --- a/drivers/uio/uio.c
52138 +++ b/drivers/uio/uio.c
52139 @@ -25,6 +25,7 @@
52140 #include <linux/kobject.h>
52141 #include <linux/cdev.h>
52142 #include <linux/uio_driver.h>
52143 +#include <asm/local.h>
52144
52145 #define UIO_MAX_DEVICES (1U << MINORBITS)
52146
52147 @@ -32,7 +33,7 @@ struct uio_device {
52148 struct module *owner;
52149 struct device *dev;
52150 int minor;
52151 - atomic_t event;
52152 + atomic_unchecked_t event;
52153 struct fasync_struct *async_queue;
52154 wait_queue_head_t wait;
52155 struct uio_info *info;
52156 @@ -243,7 +244,7 @@ static ssize_t event_show(struct device *dev,
52157 struct device_attribute *attr, char *buf)
52158 {
52159 struct uio_device *idev = dev_get_drvdata(dev);
52160 - return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
52161 + return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
52162 }
52163 static DEVICE_ATTR_RO(event);
52164
52165 @@ -405,7 +406,7 @@ void uio_event_notify(struct uio_info *info)
52166 {
52167 struct uio_device *idev = info->uio_dev;
52168
52169 - atomic_inc(&idev->event);
52170 + atomic_inc_unchecked(&idev->event);
52171 wake_up_interruptible(&idev->wait);
52172 kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
52173 }
52174 @@ -458,7 +459,7 @@ static int uio_open(struct inode *inode, struct file *filep)
52175 }
52176
52177 listener->dev = idev;
52178 - listener->event_count = atomic_read(&idev->event);
52179 + listener->event_count = atomic_read_unchecked(&idev->event);
52180 filep->private_data = listener;
52181
52182 if (idev->info->open) {
52183 @@ -509,7 +510,7 @@ static unsigned int uio_poll(struct file *filep, poll_table *wait)
52184 return -EIO;
52185
52186 poll_wait(filep, &idev->wait, wait);
52187 - if (listener->event_count != atomic_read(&idev->event))
52188 + if (listener->event_count != atomic_read_unchecked(&idev->event))
52189 return POLLIN | POLLRDNORM;
52190 return 0;
52191 }
52192 @@ -534,7 +535,7 @@ static ssize_t uio_read(struct file *filep, char __user *buf,
52193 do {
52194 set_current_state(TASK_INTERRUPTIBLE);
52195
52196 - event_count = atomic_read(&idev->event);
52197 + event_count = atomic_read_unchecked(&idev->event);
52198 if (event_count != listener->event_count) {
52199 if (copy_to_user(buf, &event_count, count))
52200 retval = -EFAULT;
52201 @@ -591,9 +592,13 @@ static ssize_t uio_write(struct file *filep, const char __user *buf,
52202 static int uio_find_mem_index(struct vm_area_struct *vma)
52203 {
52204 struct uio_device *idev = vma->vm_private_data;
52205 + unsigned long size;
52206
52207 if (vma->vm_pgoff < MAX_UIO_MAPS) {
52208 - if (idev->info->mem[vma->vm_pgoff].size == 0)
52209 + size = idev->info->mem[vma->vm_pgoff].size;
52210 + if (size == 0)
52211 + return -1;
52212 + if (vma->vm_end - vma->vm_start > size)
52213 return -1;
52214 return (int)vma->vm_pgoff;
52215 }
52216 @@ -825,7 +830,7 @@ int __uio_register_device(struct module *owner,
52217 idev->owner = owner;
52218 idev->info = info;
52219 init_waitqueue_head(&idev->wait);
52220 - atomic_set(&idev->event, 0);
52221 + atomic_set_unchecked(&idev->event, 0);
52222
52223 ret = uio_get_minor(idev);
52224 if (ret)
52225 diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
52226 index 813d4d3..a71934f 100644
52227 --- a/drivers/usb/atm/cxacru.c
52228 +++ b/drivers/usb/atm/cxacru.c
52229 @@ -472,7 +472,7 @@ static ssize_t cxacru_sysfs_store_adsl_config(struct device *dev,
52230 ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
52231 if (ret < 2)
52232 return -EINVAL;
52233 - if (index < 0 || index > 0x7f)
52234 + if (index > 0x7f)
52235 return -EINVAL;
52236 pos += tmp;
52237
52238 diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
52239 index dada014..1d0d517 100644
52240 --- a/drivers/usb/atm/usbatm.c
52241 +++ b/drivers/usb/atm/usbatm.c
52242 @@ -331,7 +331,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
52243 if (printk_ratelimit())
52244 atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
52245 __func__, vpi, vci);
52246 - atomic_inc(&vcc->stats->rx_err);
52247 + atomic_inc_unchecked(&vcc->stats->rx_err);
52248 return;
52249 }
52250
52251 @@ -358,7 +358,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
52252 if (length > ATM_MAX_AAL5_PDU) {
52253 atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
52254 __func__, length, vcc);
52255 - atomic_inc(&vcc->stats->rx_err);
52256 + atomic_inc_unchecked(&vcc->stats->rx_err);
52257 goto out;
52258 }
52259
52260 @@ -367,14 +367,14 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
52261 if (sarb->len < pdu_length) {
52262 atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
52263 __func__, pdu_length, sarb->len, vcc);
52264 - atomic_inc(&vcc->stats->rx_err);
52265 + atomic_inc_unchecked(&vcc->stats->rx_err);
52266 goto out;
52267 }
52268
52269 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
52270 atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
52271 __func__, vcc);
52272 - atomic_inc(&vcc->stats->rx_err);
52273 + atomic_inc_unchecked(&vcc->stats->rx_err);
52274 goto out;
52275 }
52276
52277 @@ -386,7 +386,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
52278 if (printk_ratelimit())
52279 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
52280 __func__, length);
52281 - atomic_inc(&vcc->stats->rx_drop);
52282 + atomic_inc_unchecked(&vcc->stats->rx_drop);
52283 goto out;
52284 }
52285
52286 @@ -414,7 +414,7 @@ static void usbatm_extract_one_cell(struct usbatm_data *instance, unsigned char
52287
52288 vcc->push(vcc, skb);
52289
52290 - atomic_inc(&vcc->stats->rx);
52291 + atomic_inc_unchecked(&vcc->stats->rx);
52292 out:
52293 skb_trim(sarb, 0);
52294 }
52295 @@ -612,7 +612,7 @@ static void usbatm_tx_process(unsigned long data)
52296 struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
52297
52298 usbatm_pop(vcc, skb);
52299 - atomic_inc(&vcc->stats->tx);
52300 + atomic_inc_unchecked(&vcc->stats->tx);
52301
52302 skb = skb_dequeue(&instance->sndqueue);
52303 }
52304 @@ -756,11 +756,11 @@ static int usbatm_atm_proc_read(struct atm_dev *atm_dev, loff_t *pos, char *page
52305 if (!left--)
52306 return sprintf(page,
52307 "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
52308 - atomic_read(&atm_dev->stats.aal5.tx),
52309 - atomic_read(&atm_dev->stats.aal5.tx_err),
52310 - atomic_read(&atm_dev->stats.aal5.rx),
52311 - atomic_read(&atm_dev->stats.aal5.rx_err),
52312 - atomic_read(&atm_dev->stats.aal5.rx_drop));
52313 + atomic_read_unchecked(&atm_dev->stats.aal5.tx),
52314 + atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
52315 + atomic_read_unchecked(&atm_dev->stats.aal5.rx),
52316 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
52317 + atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
52318
52319 if (!left--) {
52320 if (instance->disconnected)
52321 diff --git a/drivers/usb/core/devices.c b/drivers/usb/core/devices.c
52322 index 2a3bbdf..91d72cf 100644
52323 --- a/drivers/usb/core/devices.c
52324 +++ b/drivers/usb/core/devices.c
52325 @@ -126,7 +126,7 @@ static const char format_endpt[] =
52326 * time it gets called.
52327 */
52328 static struct device_connect_event {
52329 - atomic_t count;
52330 + atomic_unchecked_t count;
52331 wait_queue_head_t wait;
52332 } device_event = {
52333 .count = ATOMIC_INIT(1),
52334 @@ -164,7 +164,7 @@ static const struct class_info clas_info[] = {
52335
52336 void usbfs_conn_disc_event(void)
52337 {
52338 - atomic_add(2, &device_event.count);
52339 + atomic_add_unchecked(2, &device_event.count);
52340 wake_up(&device_event.wait);
52341 }
52342
52343 @@ -652,7 +652,7 @@ static unsigned int usb_device_poll(struct file *file,
52344
52345 poll_wait(file, &device_event.wait, wait);
52346
52347 - event_count = atomic_read(&device_event.count);
52348 + event_count = atomic_read_unchecked(&device_event.count);
52349 if (file->f_version != event_count) {
52350 file->f_version = event_count;
52351 return POLLIN | POLLRDNORM;
52352 diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
52353 index 90e18f6..5eeda46 100644
52354 --- a/drivers/usb/core/devio.c
52355 +++ b/drivers/usb/core/devio.c
52356 @@ -187,7 +187,7 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
52357 struct dev_state *ps = file->private_data;
52358 struct usb_device *dev = ps->dev;
52359 ssize_t ret = 0;
52360 - unsigned len;
52361 + size_t len;
52362 loff_t pos;
52363 int i;
52364
52365 @@ -229,22 +229,22 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes,
52366 for (i = 0; nbytes && i < dev->descriptor.bNumConfigurations; i++) {
52367 struct usb_config_descriptor *config =
52368 (struct usb_config_descriptor *)dev->rawdescriptors[i];
52369 - unsigned int length = le16_to_cpu(config->wTotalLength);
52370 + size_t length = le16_to_cpu(config->wTotalLength);
52371
52372 if (*ppos < pos + length) {
52373
52374 /* The descriptor may claim to be longer than it
52375 * really is. Here is the actual allocated length. */
52376 - unsigned alloclen =
52377 + size_t alloclen =
52378 le16_to_cpu(dev->config[i].desc.wTotalLength);
52379
52380 - len = length - (*ppos - pos);
52381 + len = length + pos - *ppos;
52382 if (len > nbytes)
52383 len = nbytes;
52384
52385 /* Simply don't write (skip over) unallocated parts */
52386 if (alloclen > (*ppos - pos)) {
52387 - alloclen -= (*ppos - pos);
52388 + alloclen = alloclen + pos - *ppos;
52389 if (copy_to_user(buf,
52390 dev->rawdescriptors[i] + (*ppos - pos),
52391 min(len, alloclen))) {
52392 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
52393 index 2518c32..1c201bb 100644
52394 --- a/drivers/usb/core/hcd.c
52395 +++ b/drivers/usb/core/hcd.c
52396 @@ -1550,7 +1550,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
52397 */
52398 usb_get_urb(urb);
52399 atomic_inc(&urb->use_count);
52400 - atomic_inc(&urb->dev->urbnum);
52401 + atomic_inc_unchecked(&urb->dev->urbnum);
52402 usbmon_urb_submit(&hcd->self, urb);
52403
52404 /* NOTE requirements on root-hub callers (usbfs and the hub
52405 @@ -1577,7 +1577,7 @@ int usb_hcd_submit_urb (struct urb *urb, gfp_t mem_flags)
52406 urb->hcpriv = NULL;
52407 INIT_LIST_HEAD(&urb->urb_list);
52408 atomic_dec(&urb->use_count);
52409 - atomic_dec(&urb->dev->urbnum);
52410 + atomic_dec_unchecked(&urb->dev->urbnum);
52411 if (atomic_read(&urb->reject))
52412 wake_up(&usb_kill_urb_queue);
52413 usb_put_urb(urb);
52414 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
52415 index d498d03..e26f959 100644
52416 --- a/drivers/usb/core/hub.c
52417 +++ b/drivers/usb/core/hub.c
52418 @@ -27,6 +27,7 @@
52419 #include <linux/freezer.h>
52420 #include <linux/random.h>
52421 #include <linux/pm_qos.h>
52422 +#include <linux/grsecurity.h>
52423
52424 #include <asm/uaccess.h>
52425 #include <asm/byteorder.h>
52426 @@ -4472,6 +4473,10 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
52427 goto done;
52428 return;
52429 }
52430 +
52431 + if (gr_handle_new_usb())
52432 + goto done;
52433 +
52434 if (hub_is_superspeed(hub->hdev))
52435 unit_load = 150;
52436 else
52437 diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
52438 index f829a1a..e6c334a 100644
52439 --- a/drivers/usb/core/message.c
52440 +++ b/drivers/usb/core/message.c
52441 @@ -128,7 +128,7 @@ static int usb_internal_control_msg(struct usb_device *usb_dev,
52442 * Return: If successful, the number of bytes transferred. Otherwise, a negative
52443 * error number.
52444 */
52445 -int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
52446 +int __intentional_overflow(-1) usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request,
52447 __u8 requesttype, __u16 value, __u16 index, void *data,
52448 __u16 size, int timeout)
52449 {
52450 @@ -180,7 +180,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg);
52451 * If successful, 0. Otherwise a negative error number. The number of actual
52452 * bytes transferred will be stored in the @actual_length paramater.
52453 */
52454 -int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
52455 +int __intentional_overflow(-1) usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
52456 void *data, int len, int *actual_length, int timeout)
52457 {
52458 return usb_bulk_msg(usb_dev, pipe, data, len, actual_length, timeout);
52459 @@ -220,7 +220,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg);
52460 * bytes transferred will be stored in the @actual_length parameter.
52461 *
52462 */
52463 -int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
52464 +int __intentional_overflow(-1) usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
52465 void *data, int len, int *actual_length, int timeout)
52466 {
52467 struct urb *urb;
52468 diff --git a/drivers/usb/core/sysfs.c b/drivers/usb/core/sysfs.c
52469 index 1236c60..d47a51c 100644
52470 --- a/drivers/usb/core/sysfs.c
52471 +++ b/drivers/usb/core/sysfs.c
52472 @@ -244,7 +244,7 @@ static ssize_t urbnum_show(struct device *dev, struct device_attribute *attr,
52473 struct usb_device *udev;
52474
52475 udev = to_usb_device(dev);
52476 - return sprintf(buf, "%d\n", atomic_read(&udev->urbnum));
52477 + return sprintf(buf, "%d\n", atomic_read_unchecked(&udev->urbnum));
52478 }
52479 static DEVICE_ATTR_RO(urbnum);
52480
52481 diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
52482 index 4d11449..f4ccabf 100644
52483 --- a/drivers/usb/core/usb.c
52484 +++ b/drivers/usb/core/usb.c
52485 @@ -433,7 +433,7 @@ struct usb_device *usb_alloc_dev(struct usb_device *parent,
52486 set_dev_node(&dev->dev, dev_to_node(bus->controller));
52487 dev->state = USB_STATE_ATTACHED;
52488 dev->lpm_disable_count = 1;
52489 - atomic_set(&dev->urbnum, 0);
52490 + atomic_set_unchecked(&dev->urbnum, 0);
52491
52492 INIT_LIST_HEAD(&dev->ep0.urb_list);
52493 dev->ep0.desc.bLength = USB_DT_ENDPOINT_SIZE;
52494 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
52495 index 2da0a5a..4870e09 100644
52496 --- a/drivers/usb/dwc3/gadget.c
52497 +++ b/drivers/usb/dwc3/gadget.c
52498 @@ -532,8 +532,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
52499 if (!usb_endpoint_xfer_isoc(desc))
52500 return 0;
52501
52502 - memset(&trb_link, 0, sizeof(trb_link));
52503 -
52504 /* Link TRB for ISOC. The HWO bit is never reset */
52505 trb_st_hw = &dep->trb_pool[0];
52506
52507 diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
52508 index 8cfc319..4868255 100644
52509 --- a/drivers/usb/early/ehci-dbgp.c
52510 +++ b/drivers/usb/early/ehci-dbgp.c
52511 @@ -98,7 +98,8 @@ static inline u32 dbgp_len_update(u32 x, u32 len)
52512
52513 #ifdef CONFIG_KGDB
52514 static struct kgdb_io kgdbdbgp_io_ops;
52515 -#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops)
52516 +static struct kgdb_io kgdbdbgp_io_ops_console;
52517 +#define dbgp_kgdb_mode (dbg_io_ops == &kgdbdbgp_io_ops || dbg_io_ops == &kgdbdbgp_io_ops_console)
52518 #else
52519 #define dbgp_kgdb_mode (0)
52520 #endif
52521 @@ -1043,6 +1044,13 @@ static struct kgdb_io kgdbdbgp_io_ops = {
52522 .write_char = kgdbdbgp_write_char,
52523 };
52524
52525 +static struct kgdb_io kgdbdbgp_io_ops_console = {
52526 + .name = "kgdbdbgp",
52527 + .read_char = kgdbdbgp_read_char,
52528 + .write_char = kgdbdbgp_write_char,
52529 + .is_console = 1
52530 +};
52531 +
52532 static int kgdbdbgp_wait_time;
52533
52534 static int __init kgdbdbgp_parse_config(char *str)
52535 @@ -1058,8 +1066,10 @@ static int __init kgdbdbgp_parse_config(char *str)
52536 ptr++;
52537 kgdbdbgp_wait_time = simple_strtoul(ptr, &ptr, 10);
52538 }
52539 - kgdb_register_io_module(&kgdbdbgp_io_ops);
52540 - kgdbdbgp_io_ops.is_console = early_dbgp_console.index != -1;
52541 + if (early_dbgp_console.index != -1)
52542 + kgdb_register_io_module(&kgdbdbgp_io_ops_console);
52543 + else
52544 + kgdb_register_io_module(&kgdbdbgp_io_ops);
52545
52546 return 0;
52547 }
52548 diff --git a/drivers/usb/gadget/f_uac1.c b/drivers/usb/gadget/f_uac1.c
52549 index 2b4c82d..06a8ee6 100644
52550 --- a/drivers/usb/gadget/f_uac1.c
52551 +++ b/drivers/usb/gadget/f_uac1.c
52552 @@ -13,6 +13,7 @@
52553 #include <linux/kernel.h>
52554 #include <linux/device.h>
52555 #include <linux/atomic.h>
52556 +#include <linux/module.h>
52557
52558 #include "u_uac1.h"
52559
52560 diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
52561 index ad0aca8..8ff84865 100644
52562 --- a/drivers/usb/gadget/u_serial.c
52563 +++ b/drivers/usb/gadget/u_serial.c
52564 @@ -733,9 +733,9 @@ static int gs_open(struct tty_struct *tty, struct file *file)
52565 spin_lock_irq(&port->port_lock);
52566
52567 /* already open? Great. */
52568 - if (port->port.count) {
52569 + if (atomic_read(&port->port.count)) {
52570 status = 0;
52571 - port->port.count++;
52572 + atomic_inc(&port->port.count);
52573
52574 /* currently opening/closing? wait ... */
52575 } else if (port->openclose) {
52576 @@ -794,7 +794,7 @@ static int gs_open(struct tty_struct *tty, struct file *file)
52577 tty->driver_data = port;
52578 port->port.tty = tty;
52579
52580 - port->port.count = 1;
52581 + atomic_set(&port->port.count, 1);
52582 port->openclose = false;
52583
52584 /* if connected, start the I/O stream */
52585 @@ -836,11 +836,11 @@ static void gs_close(struct tty_struct *tty, struct file *file)
52586
52587 spin_lock_irq(&port->port_lock);
52588
52589 - if (port->port.count != 1) {
52590 - if (port->port.count == 0)
52591 + if (atomic_read(&port->port.count) != 1) {
52592 + if (atomic_read(&port->port.count) == 0)
52593 WARN_ON(1);
52594 else
52595 - --port->port.count;
52596 + atomic_dec(&port->port.count);
52597 goto exit;
52598 }
52599
52600 @@ -850,7 +850,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
52601 * and sleep if necessary
52602 */
52603 port->openclose = true;
52604 - port->port.count = 0;
52605 + atomic_set(&port->port.count, 0);
52606
52607 gser = port->port_usb;
52608 if (gser && gser->disconnect)
52609 @@ -1066,7 +1066,7 @@ static int gs_closed(struct gs_port *port)
52610 int cond;
52611
52612 spin_lock_irq(&port->port_lock);
52613 - cond = (port->port.count == 0) && !port->openclose;
52614 + cond = (atomic_read(&port->port.count) == 0) && !port->openclose;
52615 spin_unlock_irq(&port->port_lock);
52616 return cond;
52617 }
52618 @@ -1209,7 +1209,7 @@ int gserial_connect(struct gserial *gser, u8 port_num)
52619 /* if it's already open, start I/O ... and notify the serial
52620 * protocol about open/close status (connect/disconnect).
52621 */
52622 - if (port->port.count) {
52623 + if (atomic_read(&port->port.count)) {
52624 pr_debug("gserial_connect: start ttyGS%d\n", port->port_num);
52625 gs_start_io(port);
52626 if (gser->connect)
52627 @@ -1256,7 +1256,7 @@ void gserial_disconnect(struct gserial *gser)
52628
52629 port->port_usb = NULL;
52630 gser->ioport = NULL;
52631 - if (port->port.count > 0 || port->openclose) {
52632 + if (atomic_read(&port->port.count) > 0 || port->openclose) {
52633 wake_up_interruptible(&port->drain_wait);
52634 if (port->port.tty)
52635 tty_hangup(port->port.tty);
52636 @@ -1272,7 +1272,7 @@ void gserial_disconnect(struct gserial *gser)
52637
52638 /* finally, free any unused/unusable I/O buffers */
52639 spin_lock_irqsave(&port->port_lock, flags);
52640 - if (port->port.count == 0 && !port->openclose)
52641 + if (atomic_read(&port->port.count) == 0 && !port->openclose)
52642 gs_buf_free(&port->port_write_buf);
52643 gs_free_requests(gser->out, &port->read_pool, NULL);
52644 gs_free_requests(gser->out, &port->read_queue, NULL);
52645 diff --git a/drivers/usb/gadget/u_uac1.c b/drivers/usb/gadget/u_uac1.c
52646 index 7a55fea..cc0ed4f 100644
52647 --- a/drivers/usb/gadget/u_uac1.c
52648 +++ b/drivers/usb/gadget/u_uac1.c
52649 @@ -16,6 +16,7 @@
52650 #include <linux/ctype.h>
52651 #include <linux/random.h>
52652 #include <linux/syscalls.h>
52653 +#include <linux/module.h>
52654
52655 #include "u_uac1.h"
52656
52657 diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
52658 index 7ae0c4d..35521b7 100644
52659 --- a/drivers/usb/host/ehci-hub.c
52660 +++ b/drivers/usb/host/ehci-hub.c
52661 @@ -780,7 +780,7 @@ static struct urb *request_single_step_set_feature_urb(
52662 urb->transfer_flags = URB_DIR_IN;
52663 usb_get_urb(urb);
52664 atomic_inc(&urb->use_count);
52665 - atomic_inc(&urb->dev->urbnum);
52666 + atomic_inc_unchecked(&urb->dev->urbnum);
52667 urb->setup_dma = dma_map_single(
52668 hcd->self.controller,
52669 urb->setup_packet,
52670 @@ -847,7 +847,7 @@ static int ehset_single_step_set_feature(struct usb_hcd *hcd, int port)
52671 urb->status = -EINPROGRESS;
52672 usb_get_urb(urb);
52673 atomic_inc(&urb->use_count);
52674 - atomic_inc(&urb->dev->urbnum);
52675 + atomic_inc_unchecked(&urb->dev->urbnum);
52676 retval = submit_single_step_set_feature(hcd, urb, 0);
52677 if (!retval && !wait_for_completion_timeout(&done,
52678 msecs_to_jiffies(2000))) {
52679 diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
52680 index ba6a5d6..f88f7f3 100644
52681 --- a/drivers/usb/misc/appledisplay.c
52682 +++ b/drivers/usb/misc/appledisplay.c
52683 @@ -83,7 +83,7 @@ struct appledisplay {
52684 spinlock_t lock;
52685 };
52686
52687 -static atomic_t count_displays = ATOMIC_INIT(0);
52688 +static atomic_unchecked_t count_displays = ATOMIC_INIT(0);
52689 static struct workqueue_struct *wq;
52690
52691 static void appledisplay_complete(struct urb *urb)
52692 @@ -281,7 +281,7 @@ static int appledisplay_probe(struct usb_interface *iface,
52693
52694 /* Register backlight device */
52695 snprintf(bl_name, sizeof(bl_name), "appledisplay%d",
52696 - atomic_inc_return(&count_displays) - 1);
52697 + atomic_inc_return_unchecked(&count_displays) - 1);
52698 memset(&props, 0, sizeof(struct backlight_properties));
52699 props.type = BACKLIGHT_RAW;
52700 props.max_brightness = 0xff;
52701 diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
52702 index 8d7fc48..01c4986 100644
52703 --- a/drivers/usb/serial/console.c
52704 +++ b/drivers/usb/serial/console.c
52705 @@ -123,7 +123,7 @@ static int usb_console_setup(struct console *co, char *options)
52706
52707 info->port = port;
52708
52709 - ++port->port.count;
52710 + atomic_inc(&port->port.count);
52711 if (!test_bit(ASYNCB_INITIALIZED, &port->port.flags)) {
52712 if (serial->type->set_termios) {
52713 /*
52714 @@ -167,7 +167,7 @@ static int usb_console_setup(struct console *co, char *options)
52715 }
52716 /* Now that any required fake tty operations are completed restore
52717 * the tty port count */
52718 - --port->port.count;
52719 + atomic_dec(&port->port.count);
52720 /* The console is special in terms of closing the device so
52721 * indicate this port is now acting as a system console. */
52722 port->port.console = 1;
52723 @@ -180,7 +180,7 @@ static int usb_console_setup(struct console *co, char *options)
52724 free_tty:
52725 kfree(tty);
52726 reset_open_count:
52727 - port->port.count = 0;
52728 + atomic_set(&port->port.count, 0);
52729 usb_autopm_put_interface(serial->interface);
52730 error_get_interface:
52731 usb_serial_put(serial);
52732 @@ -191,7 +191,7 @@ static int usb_console_setup(struct console *co, char *options)
52733 static void usb_console_write(struct console *co,
52734 const char *buf, unsigned count)
52735 {
52736 - static struct usbcons_info *info = &usbcons_info;
52737 + struct usbcons_info *info = &usbcons_info;
52738 struct usb_serial_port *port = info->port;
52739 struct usb_serial *serial;
52740 int retval = -ENODEV;
52741 diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
52742 index 75f70f0..d467e1a 100644
52743 --- a/drivers/usb/storage/usb.h
52744 +++ b/drivers/usb/storage/usb.h
52745 @@ -63,7 +63,7 @@ struct us_unusual_dev {
52746 __u8 useProtocol;
52747 __u8 useTransport;
52748 int (*initFunction)(struct us_data *);
52749 -};
52750 +} __do_const;
52751
52752
52753 /* Dynamic bitflag definitions (us->dflags): used in set_bit() etc. */
52754 diff --git a/drivers/usb/wusbcore/wa-hc.h b/drivers/usb/wusbcore/wa-hc.h
52755 index a2ef84b..aa7c2b8 100644
52756 --- a/drivers/usb/wusbcore/wa-hc.h
52757 +++ b/drivers/usb/wusbcore/wa-hc.h
52758 @@ -225,7 +225,7 @@ struct wahc {
52759 spinlock_t xfer_list_lock;
52760 struct work_struct xfer_enqueue_work;
52761 struct work_struct xfer_error_work;
52762 - atomic_t xfer_id_count;
52763 + atomic_unchecked_t xfer_id_count;
52764
52765 kernel_ulong_t quirks;
52766 };
52767 @@ -287,7 +287,7 @@ static inline void wa_init(struct wahc *wa)
52768 INIT_WORK(&wa->xfer_enqueue_work, wa_urb_enqueue_run);
52769 INIT_WORK(&wa->xfer_error_work, wa_process_errored_transfers_run);
52770 wa->dto_in_use = 0;
52771 - atomic_set(&wa->xfer_id_count, 1);
52772 + atomic_set_unchecked(&wa->xfer_id_count, 1);
52773 }
52774
52775 /**
52776 diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
52777 index 3cd96e9..bd7c58d 100644
52778 --- a/drivers/usb/wusbcore/wa-xfer.c
52779 +++ b/drivers/usb/wusbcore/wa-xfer.c
52780 @@ -312,7 +312,7 @@ static void wa_xfer_completion(struct wa_xfer *xfer)
52781 */
52782 static void wa_xfer_id_init(struct wa_xfer *xfer)
52783 {
52784 - xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
52785 + xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
52786 }
52787
52788 /* Return the xfer's ID. */
52789 diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
52790 index 21271d8..45b55a0 100644
52791 --- a/drivers/vfio/vfio.c
52792 +++ b/drivers/vfio/vfio.c
52793 @@ -487,7 +487,7 @@ static int vfio_group_nb_add_dev(struct vfio_group *group, struct device *dev)
52794 return 0;
52795
52796 /* TODO Prevent device auto probing */
52797 - WARN("Device %s added to live group %d!\n", dev_name(dev),
52798 + WARN(1, "Device %s added to live group %d!\n", dev_name(dev),
52799 iommu_group_id(group->iommu_group));
52800
52801 return 0;
52802 diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c
52803 index 5174eba..451e6bc 100644
52804 --- a/drivers/vhost/vringh.c
52805 +++ b/drivers/vhost/vringh.c
52806 @@ -530,17 +530,17 @@ static inline void __vringh_notify_disable(struct vringh *vrh,
52807 /* Userspace access helpers: in this case, addresses are really userspace. */
52808 static inline int getu16_user(u16 *val, const u16 *p)
52809 {
52810 - return get_user(*val, (__force u16 __user *)p);
52811 + return get_user(*val, (u16 __force_user *)p);
52812 }
52813
52814 static inline int putu16_user(u16 *p, u16 val)
52815 {
52816 - return put_user(val, (__force u16 __user *)p);
52817 + return put_user(val, (u16 __force_user *)p);
52818 }
52819
52820 static inline int copydesc_user(void *dst, const void *src, size_t len)
52821 {
52822 - return copy_from_user(dst, (__force void __user *)src, len) ?
52823 + return copy_from_user(dst, (void __force_user *)src, len) ?
52824 -EFAULT : 0;
52825 }
52826
52827 @@ -548,19 +548,19 @@ static inline int putused_user(struct vring_used_elem *dst,
52828 const struct vring_used_elem *src,
52829 unsigned int num)
52830 {
52831 - return copy_to_user((__force void __user *)dst, src,
52832 + return copy_to_user((void __force_user *)dst, src,
52833 sizeof(*dst) * num) ? -EFAULT : 0;
52834 }
52835
52836 static inline int xfer_from_user(void *src, void *dst, size_t len)
52837 {
52838 - return copy_from_user(dst, (__force void __user *)src, len) ?
52839 + return copy_from_user(dst, (void __force_user *)src, len) ?
52840 -EFAULT : 0;
52841 }
52842
52843 static inline int xfer_to_user(void *dst, void *src, size_t len)
52844 {
52845 - return copy_to_user((__force void __user *)dst, src, len) ?
52846 + return copy_to_user((void __force_user *)dst, src, len) ?
52847 -EFAULT : 0;
52848 }
52849
52850 @@ -596,9 +596,9 @@ int vringh_init_user(struct vringh *vrh, u32 features,
52851 vrh->last_used_idx = 0;
52852 vrh->vring.num = num;
52853 /* vring expects kernel addresses, but only used via accessors. */
52854 - vrh->vring.desc = (__force struct vring_desc *)desc;
52855 - vrh->vring.avail = (__force struct vring_avail *)avail;
52856 - vrh->vring.used = (__force struct vring_used *)used;
52857 + vrh->vring.desc = (__force_kernel struct vring_desc *)desc;
52858 + vrh->vring.avail = (__force_kernel struct vring_avail *)avail;
52859 + vrh->vring.used = (__force_kernel struct vring_used *)used;
52860 return 0;
52861 }
52862 EXPORT_SYMBOL(vringh_init_user);
52863 @@ -800,7 +800,7 @@ static inline int getu16_kern(u16 *val, const u16 *p)
52864
52865 static inline int putu16_kern(u16 *p, u16 val)
52866 {
52867 - ACCESS_ONCE(*p) = val;
52868 + ACCESS_ONCE_RW(*p) = val;
52869 return 0;
52870 }
52871
52872 diff --git a/drivers/video/arcfb.c b/drivers/video/arcfb.c
52873 index 1b0b233..6f34c2c 100644
52874 --- a/drivers/video/arcfb.c
52875 +++ b/drivers/video/arcfb.c
52876 @@ -458,7 +458,7 @@ static ssize_t arcfb_write(struct fb_info *info, const char __user *buf,
52877 return -ENOSPC;
52878
52879 err = 0;
52880 - if ((count + p) > fbmemlength) {
52881 + if (count > (fbmemlength - p)) {
52882 count = fbmemlength - p;
52883 err = -ENOSPC;
52884 }
52885 diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
52886 index 52108be..c7c110d 100644
52887 --- a/drivers/video/aty/aty128fb.c
52888 +++ b/drivers/video/aty/aty128fb.c
52889 @@ -149,7 +149,7 @@ enum {
52890 };
52891
52892 /* Must match above enum */
52893 -static char * const r128_family[] = {
52894 +static const char * const r128_family[] = {
52895 "AGP",
52896 "PCI",
52897 "PRO AGP",
52898 diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
52899 index 28fafbf..ae91651 100644
52900 --- a/drivers/video/aty/atyfb_base.c
52901 +++ b/drivers/video/aty/atyfb_base.c
52902 @@ -1326,10 +1326,14 @@ static int atyfb_set_par(struct fb_info *info)
52903 par->accel_flags = var->accel_flags; /* hack */
52904
52905 if (var->accel_flags) {
52906 - info->fbops->fb_sync = atyfb_sync;
52907 + pax_open_kernel();
52908 + *(void **)&info->fbops->fb_sync = atyfb_sync;
52909 + pax_close_kernel();
52910 info->flags &= ~FBINFO_HWACCEL_DISABLED;
52911 } else {
52912 - info->fbops->fb_sync = NULL;
52913 + pax_open_kernel();
52914 + *(void **)&info->fbops->fb_sync = NULL;
52915 + pax_close_kernel();
52916 info->flags |= FBINFO_HWACCEL_DISABLED;
52917 }
52918
52919 diff --git a/drivers/video/aty/mach64_cursor.c b/drivers/video/aty/mach64_cursor.c
52920 index 0fe02e2..ab01b26 100644
52921 --- a/drivers/video/aty/mach64_cursor.c
52922 +++ b/drivers/video/aty/mach64_cursor.c
52923 @@ -8,6 +8,7 @@
52924 #include "../fb_draw.h"
52925
52926 #include <asm/io.h>
52927 +#include <asm/pgtable.h>
52928
52929 #ifdef __sparc__
52930 #include <asm/fbio.h>
52931 @@ -218,7 +219,9 @@ int aty_init_cursor(struct fb_info *info)
52932 info->sprite.buf_align = 16; /* and 64 lines tall. */
52933 info->sprite.flags = FB_PIXMAP_IO;
52934
52935 - info->fbops->fb_cursor = atyfb_cursor;
52936 + pax_open_kernel();
52937 + *(void **)&info->fbops->fb_cursor = atyfb_cursor;
52938 + pax_close_kernel();
52939
52940 return 0;
52941 }
52942 diff --git a/drivers/video/backlight/kb3886_bl.c b/drivers/video/backlight/kb3886_bl.c
52943 index 84a110a..96312c3 100644
52944 --- a/drivers/video/backlight/kb3886_bl.c
52945 +++ b/drivers/video/backlight/kb3886_bl.c
52946 @@ -78,7 +78,7 @@ static struct kb3886bl_machinfo *bl_machinfo;
52947 static unsigned long kb3886bl_flags;
52948 #define KB3886BL_SUSPENDED 0x01
52949
52950 -static struct dmi_system_id kb3886bl_device_table[] __initdata = {
52951 +static const struct dmi_system_id kb3886bl_device_table[] __initconst = {
52952 {
52953 .ident = "Sahara Touch-iT",
52954 .matches = {
52955 diff --git a/drivers/video/fb_defio.c b/drivers/video/fb_defio.c
52956 index 900aa4e..6d49418 100644
52957 --- a/drivers/video/fb_defio.c
52958 +++ b/drivers/video/fb_defio.c
52959 @@ -206,7 +206,9 @@ void fb_deferred_io_init(struct fb_info *info)
52960
52961 BUG_ON(!fbdefio);
52962 mutex_init(&fbdefio->lock);
52963 - info->fbops->fb_mmap = fb_deferred_io_mmap;
52964 + pax_open_kernel();
52965 + *(void **)&info->fbops->fb_mmap = fb_deferred_io_mmap;
52966 + pax_close_kernel();
52967 INIT_DELAYED_WORK(&info->deferred_work, fb_deferred_io_work);
52968 INIT_LIST_HEAD(&fbdefio->pagelist);
52969 if (fbdefio->delay == 0) /* set a default of 1 s */
52970 @@ -237,7 +239,7 @@ void fb_deferred_io_cleanup(struct fb_info *info)
52971 page->mapping = NULL;
52972 }
52973
52974 - info->fbops->fb_mmap = NULL;
52975 + *(void **)&info->fbops->fb_mmap = NULL;
52976 mutex_destroy(&fbdefio->lock);
52977 }
52978 EXPORT_SYMBOL_GPL(fb_deferred_io_cleanup);
52979 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
52980 index 7309ac7..be3c49c 100644
52981 --- a/drivers/video/fbmem.c
52982 +++ b/drivers/video/fbmem.c
52983 @@ -433,7 +433,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
52984 image->dx += image->width + 8;
52985 }
52986 } else if (rotate == FB_ROTATE_UD) {
52987 - for (x = 0; x < num && image->dx >= 0; x++) {
52988 + for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
52989 info->fbops->fb_imageblit(info, image);
52990 image->dx -= image->width + 8;
52991 }
52992 @@ -445,7 +445,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
52993 image->dy += image->height + 8;
52994 }
52995 } else if (rotate == FB_ROTATE_CCW) {
52996 - for (x = 0; x < num && image->dy >= 0; x++) {
52997 + for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
52998 info->fbops->fb_imageblit(info, image);
52999 image->dy -= image->height + 8;
53000 }
53001 @@ -1179,7 +1179,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
53002 return -EFAULT;
53003 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
53004 return -EINVAL;
53005 - if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
53006 + if (con2fb.framebuffer >= FB_MAX)
53007 return -EINVAL;
53008 if (!registered_fb[con2fb.framebuffer])
53009 request_module("fb%d", con2fb.framebuffer);
53010 @@ -1300,7 +1300,7 @@ static int do_fscreeninfo_to_user(struct fb_fix_screeninfo *fix,
53011 __u32 data;
53012 int err;
53013
53014 - err = copy_to_user(&fix32->id, &fix->id, sizeof(fix32->id));
53015 + err = copy_to_user(fix32->id, &fix->id, sizeof(fix32->id));
53016
53017 data = (__u32) (unsigned long) fix->smem_start;
53018 err |= put_user(data, &fix32->smem_start);
53019 diff --git a/drivers/video/hyperv_fb.c b/drivers/video/hyperv_fb.c
53020 index 130708f..cdac1a9 100644
53021 --- a/drivers/video/hyperv_fb.c
53022 +++ b/drivers/video/hyperv_fb.c
53023 @@ -233,7 +233,7 @@ static uint screen_fb_size;
53024 static inline int synthvid_send(struct hv_device *hdev,
53025 struct synthvid_msg *msg)
53026 {
53027 - static atomic64_t request_id = ATOMIC64_INIT(0);
53028 + static atomic64_unchecked_t request_id = ATOMIC64_INIT(0);
53029 int ret;
53030
53031 msg->pipe_hdr.type = PIPE_MSG_DATA;
53032 @@ -241,7 +241,7 @@ static inline int synthvid_send(struct hv_device *hdev,
53033
53034 ret = vmbus_sendpacket(hdev->channel, msg,
53035 msg->vid_hdr.size + sizeof(struct pipe_msg_hdr),
53036 - atomic64_inc_return(&request_id),
53037 + atomic64_inc_return_unchecked(&request_id),
53038 VM_PKT_DATA_INBAND, 0);
53039
53040 if (ret)
53041 diff --git a/drivers/video/i810/i810_accel.c b/drivers/video/i810/i810_accel.c
53042 index 7672d2e..b56437f 100644
53043 --- a/drivers/video/i810/i810_accel.c
53044 +++ b/drivers/video/i810/i810_accel.c
53045 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct fb_info *info, u32 space)
53046 }
53047 }
53048 printk("ringbuffer lockup!!!\n");
53049 + printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
53050 i810_report_error(mmio);
53051 par->dev_flags |= LOCKUP;
53052 info->pixmap.scan_align = 1;
53053 diff --git a/drivers/video/logo/logo_linux_clut224.ppm b/drivers/video/logo/logo_linux_clut224.ppm
53054 index 3c14e43..2630570 100644
53055 --- a/drivers/video/logo/logo_linux_clut224.ppm
53056 +++ b/drivers/video/logo/logo_linux_clut224.ppm
53057 @@ -2,1603 +2,1123 @@ P3
53058 # Standard 224-color Linux logo
53059 80 80
53060 255
53061 - 0 0 0 0 0 0 0 0 0 0 0 0
53062 - 0 0 0 0 0 0 0 0 0 0 0 0
53063 - 0 0 0 0 0 0 0 0 0 0 0 0
53064 - 0 0 0 0 0 0 0 0 0 0 0 0
53065 - 0 0 0 0 0 0 0 0 0 0 0 0
53066 - 0 0 0 0 0 0 0 0 0 0 0 0
53067 - 0 0 0 0 0 0 0 0 0 0 0 0
53068 - 0 0 0 0 0 0 0 0 0 0 0 0
53069 - 0 0 0 0 0 0 0 0 0 0 0 0
53070 - 6 6 6 6 6 6 10 10 10 10 10 10
53071 - 10 10 10 6 6 6 6 6 6 6 6 6
53072 - 0 0 0 0 0 0 0 0 0 0 0 0
53073 - 0 0 0 0 0 0 0 0 0 0 0 0
53074 - 0 0 0 0 0 0 0 0 0 0 0 0
53075 - 0 0 0 0 0 0 0 0 0 0 0 0
53076 - 0 0 0 0 0 0 0 0 0 0 0 0
53077 - 0 0 0 0 0 0 0 0 0 0 0 0
53078 - 0 0 0 0 0 0 0 0 0 0 0 0
53079 - 0 0 0 0 0 0 0 0 0 0 0 0
53080 - 0 0 0 0 0 0 0 0 0 0 0 0
53081 - 0 0 0 0 0 0 0 0 0 0 0 0
53082 - 0 0 0 0 0 0 0 0 0 0 0 0
53083 - 0 0 0 0 0 0 0 0 0 0 0 0
53084 - 0 0 0 0 0 0 0 0 0 0 0 0
53085 - 0 0 0 0 0 0 0 0 0 0 0 0
53086 - 0 0 0 0 0 0 0 0 0 0 0 0
53087 - 0 0 0 0 0 0 0 0 0 0 0 0
53088 - 0 0 0 0 0 0 0 0 0 0 0 0
53089 - 0 0 0 6 6 6 10 10 10 14 14 14
53090 - 22 22 22 26 26 26 30 30 30 34 34 34
53091 - 30 30 30 30 30 30 26 26 26 18 18 18
53092 - 14 14 14 10 10 10 6 6 6 0 0 0
53093 - 0 0 0 0 0 0 0 0 0 0 0 0
53094 - 0 0 0 0 0 0 0 0 0 0 0 0
53095 - 0 0 0 0 0 0 0 0 0 0 0 0
53096 - 0 0 0 0 0 0 0 0 0 0 0 0
53097 - 0 0 0 0 0 0 0 0 0 0 0 0
53098 - 0 0 0 0 0 0 0 0 0 0 0 0
53099 - 0 0 0 0 0 0 0 0 0 0 0 0
53100 - 0 0 0 0 0 0 0 0 0 0 0 0
53101 - 0 0 0 0 0 0 0 0 0 0 0 0
53102 - 0 0 0 0 0 1 0 0 1 0 0 0
53103 - 0 0 0 0 0 0 0 0 0 0 0 0
53104 - 0 0 0 0 0 0 0 0 0 0 0 0
53105 - 0 0 0 0 0 0 0 0 0 0 0 0
53106 - 0 0 0 0 0 0 0 0 0 0 0 0
53107 - 0 0 0 0 0 0 0 0 0 0 0 0
53108 - 0 0 0 0 0 0 0 0 0 0 0 0
53109 - 6 6 6 14 14 14 26 26 26 42 42 42
53110 - 54 54 54 66 66 66 78 78 78 78 78 78
53111 - 78 78 78 74 74 74 66 66 66 54 54 54
53112 - 42 42 42 26 26 26 18 18 18 10 10 10
53113 - 6 6 6 0 0 0 0 0 0 0 0 0
53114 - 0 0 0 0 0 0 0 0 0 0 0 0
53115 - 0 0 0 0 0 0 0 0 0 0 0 0
53116 - 0 0 0 0 0 0 0 0 0 0 0 0
53117 - 0 0 0 0 0 0 0 0 0 0 0 0
53118 - 0 0 0 0 0 0 0 0 0 0 0 0
53119 - 0 0 0 0 0 0 0 0 0 0 0 0
53120 - 0 0 0 0 0 0 0 0 0 0 0 0
53121 - 0 0 0 0 0 0 0 0 0 0 0 0
53122 - 0 0 1 0 0 0 0 0 0 0 0 0
53123 - 0 0 0 0 0 0 0 0 0 0 0 0
53124 - 0 0 0 0 0 0 0 0 0 0 0 0
53125 - 0 0 0 0 0 0 0 0 0 0 0 0
53126 - 0 0 0 0 0 0 0 0 0 0 0 0
53127 - 0 0 0 0 0 0 0 0 0 0 0 0
53128 - 0 0 0 0 0 0 0 0 0 10 10 10
53129 - 22 22 22 42 42 42 66 66 66 86 86 86
53130 - 66 66 66 38 38 38 38 38 38 22 22 22
53131 - 26 26 26 34 34 34 54 54 54 66 66 66
53132 - 86 86 86 70 70 70 46 46 46 26 26 26
53133 - 14 14 14 6 6 6 0 0 0 0 0 0
53134 - 0 0 0 0 0 0 0 0 0 0 0 0
53135 - 0 0 0 0 0 0 0 0 0 0 0 0
53136 - 0 0 0 0 0 0 0 0 0 0 0 0
53137 - 0 0 0 0 0 0 0 0 0 0 0 0
53138 - 0 0 0 0 0 0 0 0 0 0 0 0
53139 - 0 0 0 0 0 0 0 0 0 0 0 0
53140 - 0 0 0 0 0 0 0 0 0 0 0 0
53141 - 0 0 0 0 0 0 0 0 0 0 0 0
53142 - 0 0 1 0 0 1 0 0 1 0 0 0
53143 - 0 0 0 0 0 0 0 0 0 0 0 0
53144 - 0 0 0 0 0 0 0 0 0 0 0 0
53145 - 0 0 0 0 0 0 0 0 0 0 0 0
53146 - 0 0 0 0 0 0 0 0 0 0 0 0
53147 - 0 0 0 0 0 0 0 0 0 0 0 0
53148 - 0 0 0 0 0 0 10 10 10 26 26 26
53149 - 50 50 50 82 82 82 58 58 58 6 6 6
53150 - 2 2 6 2 2 6 2 2 6 2 2 6
53151 - 2 2 6 2 2 6 2 2 6 2 2 6
53152 - 6 6 6 54 54 54 86 86 86 66 66 66
53153 - 38 38 38 18 18 18 6 6 6 0 0 0
53154 - 0 0 0 0 0 0 0 0 0 0 0 0
53155 - 0 0 0 0 0 0 0 0 0 0 0 0
53156 - 0 0 0 0 0 0 0 0 0 0 0 0
53157 - 0 0 0 0 0 0 0 0 0 0 0 0
53158 - 0 0 0 0 0 0 0 0 0 0 0 0
53159 - 0 0 0 0 0 0 0 0 0 0 0 0
53160 - 0 0 0 0 0 0 0 0 0 0 0 0
53161 - 0 0 0 0 0 0 0 0 0 0 0 0
53162 - 0 0 0 0 0 0 0 0 0 0 0 0
53163 - 0 0 0 0 0 0 0 0 0 0 0 0
53164 - 0 0 0 0 0 0 0 0 0 0 0 0
53165 - 0 0 0 0 0 0 0 0 0 0 0 0
53166 - 0 0 0 0 0 0 0 0 0 0 0 0
53167 - 0 0 0 0 0 0 0 0 0 0 0 0
53168 - 0 0 0 6 6 6 22 22 22 50 50 50
53169 - 78 78 78 34 34 34 2 2 6 2 2 6
53170 - 2 2 6 2 2 6 2 2 6 2 2 6
53171 - 2 2 6 2 2 6 2 2 6 2 2 6
53172 - 2 2 6 2 2 6 6 6 6 70 70 70
53173 - 78 78 78 46 46 46 22 22 22 6 6 6
53174 - 0 0 0 0 0 0 0 0 0 0 0 0
53175 - 0 0 0 0 0 0 0 0 0 0 0 0
53176 - 0 0 0 0 0 0 0 0 0 0 0 0
53177 - 0 0 0 0 0 0 0 0 0 0 0 0
53178 - 0 0 0 0 0 0 0 0 0 0 0 0
53179 - 0 0 0 0 0 0 0 0 0 0 0 0
53180 - 0 0 0 0 0 0 0 0 0 0 0 0
53181 - 0 0 0 0 0 0 0 0 0 0 0 0
53182 - 0 0 1 0 0 1 0 0 1 0 0 0
53183 - 0 0 0 0 0 0 0 0 0 0 0 0
53184 - 0 0 0 0 0 0 0 0 0 0 0 0
53185 - 0 0 0 0 0 0 0 0 0 0 0 0
53186 - 0 0 0 0 0 0 0 0 0 0 0 0
53187 - 0 0 0 0 0 0 0 0 0 0 0 0
53188 - 6 6 6 18 18 18 42 42 42 82 82 82
53189 - 26 26 26 2 2 6 2 2 6 2 2 6
53190 - 2 2 6 2 2 6 2 2 6 2 2 6
53191 - 2 2 6 2 2 6 2 2 6 14 14 14
53192 - 46 46 46 34 34 34 6 6 6 2 2 6
53193 - 42 42 42 78 78 78 42 42 42 18 18 18
53194 - 6 6 6 0 0 0 0 0 0 0 0 0
53195 - 0 0 0 0 0 0 0 0 0 0 0 0
53196 - 0 0 0 0 0 0 0 0 0 0 0 0
53197 - 0 0 0 0 0 0 0 0 0 0 0 0
53198 - 0 0 0 0 0 0 0 0 0 0 0 0
53199 - 0 0 0 0 0 0 0 0 0 0 0 0
53200 - 0 0 0 0 0 0 0 0 0 0 0 0
53201 - 0 0 0 0 0 0 0 0 0 0 0 0
53202 - 0 0 1 0 0 0 0 0 1 0 0 0
53203 - 0 0 0 0 0 0 0 0 0 0 0 0
53204 - 0 0 0 0 0 0 0 0 0 0 0 0
53205 - 0 0 0 0 0 0 0 0 0 0 0 0
53206 - 0 0 0 0 0 0 0 0 0 0 0 0
53207 - 0 0 0 0 0 0 0 0 0 0 0 0
53208 - 10 10 10 30 30 30 66 66 66 58 58 58
53209 - 2 2 6 2 2 6 2 2 6 2 2 6
53210 - 2 2 6 2 2 6 2 2 6 2 2 6
53211 - 2 2 6 2 2 6 2 2 6 26 26 26
53212 - 86 86 86 101 101 101 46 46 46 10 10 10
53213 - 2 2 6 58 58 58 70 70 70 34 34 34
53214 - 10 10 10 0 0 0 0 0 0 0 0 0
53215 - 0 0 0 0 0 0 0 0 0 0 0 0
53216 - 0 0 0 0 0 0 0 0 0 0 0 0
53217 - 0 0 0 0 0 0 0 0 0 0 0 0
53218 - 0 0 0 0 0 0 0 0 0 0 0 0
53219 - 0 0 0 0 0 0 0 0 0 0 0 0
53220 - 0 0 0 0 0 0 0 0 0 0 0 0
53221 - 0 0 0 0 0 0 0 0 0 0 0 0
53222 - 0 0 1 0 0 1 0 0 1 0 0 0
53223 - 0 0 0 0 0 0 0 0 0 0 0 0
53224 - 0 0 0 0 0 0 0 0 0 0 0 0
53225 - 0 0 0 0 0 0 0 0 0 0 0 0
53226 - 0 0 0 0 0 0 0 0 0 0 0 0
53227 - 0 0 0 0 0 0 0 0 0 0 0 0
53228 - 14 14 14 42 42 42 86 86 86 10 10 10
53229 - 2 2 6 2 2 6 2 2 6 2 2 6
53230 - 2 2 6 2 2 6 2 2 6 2 2 6
53231 - 2 2 6 2 2 6 2 2 6 30 30 30
53232 - 94 94 94 94 94 94 58 58 58 26 26 26
53233 - 2 2 6 6 6 6 78 78 78 54 54 54
53234 - 22 22 22 6 6 6 0 0 0 0 0 0
53235 - 0 0 0 0 0 0 0 0 0 0 0 0
53236 - 0 0 0 0 0 0 0 0 0 0 0 0
53237 - 0 0 0 0 0 0 0 0 0 0 0 0
53238 - 0 0 0 0 0 0 0 0 0 0 0 0
53239 - 0 0 0 0 0 0 0 0 0 0 0 0
53240 - 0 0 0 0 0 0 0 0 0 0 0 0
53241 - 0 0 0 0 0 0 0 0 0 0 0 0
53242 - 0 0 0 0 0 0 0 0 0 0 0 0
53243 - 0 0 0 0 0 0 0 0 0 0 0 0
53244 - 0 0 0 0 0 0 0 0 0 0 0 0
53245 - 0 0 0 0 0 0 0 0 0 0 0 0
53246 - 0 0 0 0 0 0 0 0 0 0 0 0
53247 - 0 0 0 0 0 0 0 0 0 6 6 6
53248 - 22 22 22 62 62 62 62 62 62 2 2 6
53249 - 2 2 6 2 2 6 2 2 6 2 2 6
53250 - 2 2 6 2 2 6 2 2 6 2 2 6
53251 - 2 2 6 2 2 6 2 2 6 26 26 26
53252 - 54 54 54 38 38 38 18 18 18 10 10 10
53253 - 2 2 6 2 2 6 34 34 34 82 82 82
53254 - 38 38 38 14 14 14 0 0 0 0 0 0
53255 - 0 0 0 0 0 0 0 0 0 0 0 0
53256 - 0 0 0 0 0 0 0 0 0 0 0 0
53257 - 0 0 0 0 0 0 0 0 0 0 0 0
53258 - 0 0 0 0 0 0 0 0 0 0 0 0
53259 - 0 0 0 0 0 0 0 0 0 0 0 0
53260 - 0 0 0 0 0 0 0 0 0 0 0 0
53261 - 0 0 0 0 0 0 0 0 0 0 0 0
53262 - 0 0 0 0 0 1 0 0 1 0 0 0
53263 - 0 0 0 0 0 0 0 0 0 0 0 0
53264 - 0 0 0 0 0 0 0 0 0 0 0 0
53265 - 0 0 0 0 0 0 0 0 0 0 0 0
53266 - 0 0 0 0 0 0 0 0 0 0 0 0
53267 - 0 0 0 0 0 0 0 0 0 6 6 6
53268 - 30 30 30 78 78 78 30 30 30 2 2 6
53269 - 2 2 6 2 2 6 2 2 6 2 2 6
53270 - 2 2 6 2 2 6 2 2 6 2 2 6
53271 - 2 2 6 2 2 6 2 2 6 10 10 10
53272 - 10 10 10 2 2 6 2 2 6 2 2 6
53273 - 2 2 6 2 2 6 2 2 6 78 78 78
53274 - 50 50 50 18 18 18 6 6 6 0 0 0
53275 - 0 0 0 0 0 0 0 0 0 0 0 0
53276 - 0 0 0 0 0 0 0 0 0 0 0 0
53277 - 0 0 0 0 0 0 0 0 0 0 0 0
53278 - 0 0 0 0 0 0 0 0 0 0 0 0
53279 - 0 0 0 0 0 0 0 0 0 0 0 0
53280 - 0 0 0 0 0 0 0 0 0 0 0 0
53281 - 0 0 0 0 0 0 0 0 0 0 0 0
53282 - 0 0 1 0 0 0 0 0 0 0 0 0
53283 - 0 0 0 0 0 0 0 0 0 0 0 0
53284 - 0 0 0 0 0 0 0 0 0 0 0 0
53285 - 0 0 0 0 0 0 0 0 0 0 0 0
53286 - 0 0 0 0 0 0 0 0 0 0 0 0
53287 - 0 0 0 0 0 0 0 0 0 10 10 10
53288 - 38 38 38 86 86 86 14 14 14 2 2 6
53289 - 2 2 6 2 2 6 2 2 6 2 2 6
53290 - 2 2 6 2 2 6 2 2 6 2 2 6
53291 - 2 2 6 2 2 6 2 2 6 2 2 6
53292 - 2 2 6 2 2 6 2 2 6 2 2 6
53293 - 2 2 6 2 2 6 2 2 6 54 54 54
53294 - 66 66 66 26 26 26 6 6 6 0 0 0
53295 - 0 0 0 0 0 0 0 0 0 0 0 0
53296 - 0 0 0 0 0 0 0 0 0 0 0 0
53297 - 0 0 0 0 0 0 0 0 0 0 0 0
53298 - 0 0 0 0 0 0 0 0 0 0 0 0
53299 - 0 0 0 0 0 0 0 0 0 0 0 0
53300 - 0 0 0 0 0 0 0 0 0 0 0 0
53301 - 0 0 0 0 0 0 0 0 0 0 0 0
53302 - 0 0 0 0 0 1 0 0 1 0 0 0
53303 - 0 0 0 0 0 0 0 0 0 0 0 0
53304 - 0 0 0 0 0 0 0 0 0 0 0 0
53305 - 0 0 0 0 0 0 0 0 0 0 0 0
53306 - 0 0 0 0 0 0 0 0 0 0 0 0
53307 - 0 0 0 0 0 0 0 0 0 14 14 14
53308 - 42 42 42 82 82 82 2 2 6 2 2 6
53309 - 2 2 6 6 6 6 10 10 10 2 2 6
53310 - 2 2 6 2 2 6 2 2 6 2 2 6
53311 - 2 2 6 2 2 6 2 2 6 6 6 6
53312 - 14 14 14 10 10 10 2 2 6 2 2 6
53313 - 2 2 6 2 2 6 2 2 6 18 18 18
53314 - 82 82 82 34 34 34 10 10 10 0 0 0
53315 - 0 0 0 0 0 0 0 0 0 0 0 0
53316 - 0 0 0 0 0 0 0 0 0 0 0 0
53317 - 0 0 0 0 0 0 0 0 0 0 0 0
53318 - 0 0 0 0 0 0 0 0 0 0 0 0
53319 - 0 0 0 0 0 0 0 0 0 0 0 0
53320 - 0 0 0 0 0 0 0 0 0 0 0 0
53321 - 0 0 0 0 0 0 0 0 0 0 0 0
53322 - 0 0 1 0 0 0 0 0 0 0 0 0
53323 - 0 0 0 0 0 0 0 0 0 0 0 0
53324 - 0 0 0 0 0 0 0 0 0 0 0 0
53325 - 0 0 0 0 0 0 0 0 0 0 0 0
53326 - 0 0 0 0 0 0 0 0 0 0 0 0
53327 - 0 0 0 0 0 0 0 0 0 14 14 14
53328 - 46 46 46 86 86 86 2 2 6 2 2 6
53329 - 6 6 6 6 6 6 22 22 22 34 34 34
53330 - 6 6 6 2 2 6 2 2 6 2 2 6
53331 - 2 2 6 2 2 6 18 18 18 34 34 34
53332 - 10 10 10 50 50 50 22 22 22 2 2 6
53333 - 2 2 6 2 2 6 2 2 6 10 10 10
53334 - 86 86 86 42 42 42 14 14 14 0 0 0
53335 - 0 0 0 0 0 0 0 0 0 0 0 0
53336 - 0 0 0 0 0 0 0 0 0 0 0 0
53337 - 0 0 0 0 0 0 0 0 0 0 0 0
53338 - 0 0 0 0 0 0 0 0 0 0 0 0
53339 - 0 0 0 0 0 0 0 0 0 0 0 0
53340 - 0 0 0 0 0 0 0 0 0 0 0 0
53341 - 0 0 0 0 0 0 0 0 0 0 0 0
53342 - 0 0 1 0 0 1 0 0 1 0 0 0
53343 - 0 0 0 0 0 0 0 0 0 0 0 0
53344 - 0 0 0 0 0 0 0 0 0 0 0 0
53345 - 0 0 0 0 0 0 0 0 0 0 0 0
53346 - 0 0 0 0 0 0 0 0 0 0 0 0
53347 - 0 0 0 0 0 0 0 0 0 14 14 14
53348 - 46 46 46 86 86 86 2 2 6 2 2 6
53349 - 38 38 38 116 116 116 94 94 94 22 22 22
53350 - 22 22 22 2 2 6 2 2 6 2 2 6
53351 - 14 14 14 86 86 86 138 138 138 162 162 162
53352 -154 154 154 38 38 38 26 26 26 6 6 6
53353 - 2 2 6 2 2 6 2 2 6 2 2 6
53354 - 86 86 86 46 46 46 14 14 14 0 0 0
53355 - 0 0 0 0 0 0 0 0 0 0 0 0
53356 - 0 0 0 0 0 0 0 0 0 0 0 0
53357 - 0 0 0 0 0 0 0 0 0 0 0 0
53358 - 0 0 0 0 0 0 0 0 0 0 0 0
53359 - 0 0 0 0 0 0 0 0 0 0 0 0
53360 - 0 0 0 0 0 0 0 0 0 0 0 0
53361 - 0 0 0 0 0 0 0 0 0 0 0 0
53362 - 0 0 0 0 0 0 0 0 0 0 0 0
53363 - 0 0 0 0 0 0 0 0 0 0 0 0
53364 - 0 0 0 0 0 0 0 0 0 0 0 0
53365 - 0 0 0 0 0 0 0 0 0 0 0 0
53366 - 0 0 0 0 0 0 0 0 0 0 0 0
53367 - 0 0 0 0 0 0 0 0 0 14 14 14
53368 - 46 46 46 86 86 86 2 2 6 14 14 14
53369 -134 134 134 198 198 198 195 195 195 116 116 116
53370 - 10 10 10 2 2 6 2 2 6 6 6 6
53371 -101 98 89 187 187 187 210 210 210 218 218 218
53372 -214 214 214 134 134 134 14 14 14 6 6 6
53373 - 2 2 6 2 2 6 2 2 6 2 2 6
53374 - 86 86 86 50 50 50 18 18 18 6 6 6
53375 - 0 0 0 0 0 0 0 0 0 0 0 0
53376 - 0 0 0 0 0 0 0 0 0 0 0 0
53377 - 0 0 0 0 0 0 0 0 0 0 0 0
53378 - 0 0 0 0 0 0 0 0 0 0 0 0
53379 - 0 0 0 0 0 0 0 0 0 0 0 0
53380 - 0 0 0 0 0 0 0 0 0 0 0 0
53381 - 0 0 0 0 0 0 0 0 1 0 0 0
53382 - 0 0 1 0 0 1 0 0 1 0 0 0
53383 - 0 0 0 0 0 0 0 0 0 0 0 0
53384 - 0 0 0 0 0 0 0 0 0 0 0 0
53385 - 0 0 0 0 0 0 0 0 0 0 0 0
53386 - 0 0 0 0 0 0 0 0 0 0 0 0
53387 - 0 0 0 0 0 0 0 0 0 14 14 14
53388 - 46 46 46 86 86 86 2 2 6 54 54 54
53389 -218 218 218 195 195 195 226 226 226 246 246 246
53390 - 58 58 58 2 2 6 2 2 6 30 30 30
53391 -210 210 210 253 253 253 174 174 174 123 123 123
53392 -221 221 221 234 234 234 74 74 74 2 2 6
53393 - 2 2 6 2 2 6 2 2 6 2 2 6
53394 - 70 70 70 58 58 58 22 22 22 6 6 6
53395 - 0 0 0 0 0 0 0 0 0 0 0 0
53396 - 0 0 0 0 0 0 0 0 0 0 0 0
53397 - 0 0 0 0 0 0 0 0 0 0 0 0
53398 - 0 0 0 0 0 0 0 0 0 0 0 0
53399 - 0 0 0 0 0 0 0 0 0 0 0 0
53400 - 0 0 0 0 0 0 0 0 0 0 0 0
53401 - 0 0 0 0 0 0 0 0 0 0 0 0
53402 - 0 0 0 0 0 0 0 0 0 0 0 0
53403 - 0 0 0 0 0 0 0 0 0 0 0 0
53404 - 0 0 0 0 0 0 0 0 0 0 0 0
53405 - 0 0 0 0 0 0 0 0 0 0 0 0
53406 - 0 0 0 0 0 0 0 0 0 0 0 0
53407 - 0 0 0 0 0 0 0 0 0 14 14 14
53408 - 46 46 46 82 82 82 2 2 6 106 106 106
53409 -170 170 170 26 26 26 86 86 86 226 226 226
53410 -123 123 123 10 10 10 14 14 14 46 46 46
53411 -231 231 231 190 190 190 6 6 6 70 70 70
53412 - 90 90 90 238 238 238 158 158 158 2 2 6
53413 - 2 2 6 2 2 6 2 2 6 2 2 6
53414 - 70 70 70 58 58 58 22 22 22 6 6 6
53415 - 0 0 0 0 0 0 0 0 0 0 0 0
53416 - 0 0 0 0 0 0 0 0 0 0 0 0
53417 - 0 0 0 0 0 0 0 0 0 0 0 0
53418 - 0 0 0 0 0 0 0 0 0 0 0 0
53419 - 0 0 0 0 0 0 0 0 0 0 0 0
53420 - 0 0 0 0 0 0 0 0 0 0 0 0
53421 - 0 0 0 0 0 0 0 0 1 0 0 0
53422 - 0 0 1 0 0 1 0 0 1 0 0 0
53423 - 0 0 0 0 0 0 0 0 0 0 0 0
53424 - 0 0 0 0 0 0 0 0 0 0 0 0
53425 - 0 0 0 0 0 0 0 0 0 0 0 0
53426 - 0 0 0 0 0 0 0 0 0 0 0 0
53427 - 0 0 0 0 0 0 0 0 0 14 14 14
53428 - 42 42 42 86 86 86 6 6 6 116 116 116
53429 -106 106 106 6 6 6 70 70 70 149 149 149
53430 -128 128 128 18 18 18 38 38 38 54 54 54
53431 -221 221 221 106 106 106 2 2 6 14 14 14
53432 - 46 46 46 190 190 190 198 198 198 2 2 6
53433 - 2 2 6 2 2 6 2 2 6 2 2 6
53434 - 74 74 74 62 62 62 22 22 22 6 6 6
53435 - 0 0 0 0 0 0 0 0 0 0 0 0
53436 - 0 0 0 0 0 0 0 0 0 0 0 0
53437 - 0 0 0 0 0 0 0 0 0 0 0 0
53438 - 0 0 0 0 0 0 0 0 0 0 0 0
53439 - 0 0 0 0 0 0 0 0 0 0 0 0
53440 - 0 0 0 0 0 0 0 0 0 0 0 0
53441 - 0 0 0 0 0 0 0 0 1 0 0 0
53442 - 0 0 1 0 0 0 0 0 1 0 0 0
53443 - 0 0 0 0 0 0 0 0 0 0 0 0
53444 - 0 0 0 0 0 0 0 0 0 0 0 0
53445 - 0 0 0 0 0 0 0 0 0 0 0 0
53446 - 0 0 0 0 0 0 0 0 0 0 0 0
53447 - 0 0 0 0 0 0 0 0 0 14 14 14
53448 - 42 42 42 94 94 94 14 14 14 101 101 101
53449 -128 128 128 2 2 6 18 18 18 116 116 116
53450 -118 98 46 121 92 8 121 92 8 98 78 10
53451 -162 162 162 106 106 106 2 2 6 2 2 6
53452 - 2 2 6 195 195 195 195 195 195 6 6 6
53453 - 2 2 6 2 2 6 2 2 6 2 2 6
53454 - 74 74 74 62 62 62 22 22 22 6 6 6
53455 - 0 0 0 0 0 0 0 0 0 0 0 0
53456 - 0 0 0 0 0 0 0 0 0 0 0 0
53457 - 0 0 0 0 0 0 0 0 0 0 0 0
53458 - 0 0 0 0 0 0 0 0 0 0 0 0
53459 - 0 0 0 0 0 0 0 0 0 0 0 0
53460 - 0 0 0 0 0 0 0 0 0 0 0 0
53461 - 0 0 0 0 0 0 0 0 1 0 0 1
53462 - 0 0 1 0 0 0 0 0 1 0 0 0
53463 - 0 0 0 0 0 0 0 0 0 0 0 0
53464 - 0 0 0 0 0 0 0 0 0 0 0 0
53465 - 0 0 0 0 0 0 0 0 0 0 0 0
53466 - 0 0 0 0 0 0 0 0 0 0 0 0
53467 - 0 0 0 0 0 0 0 0 0 10 10 10
53468 - 38 38 38 90 90 90 14 14 14 58 58 58
53469 -210 210 210 26 26 26 54 38 6 154 114 10
53470 -226 170 11 236 186 11 225 175 15 184 144 12
53471 -215 174 15 175 146 61 37 26 9 2 2 6
53472 - 70 70 70 246 246 246 138 138 138 2 2 6
53473 - 2 2 6 2 2 6 2 2 6 2 2 6
53474 - 70 70 70 66 66 66 26 26 26 6 6 6
53475 - 0 0 0 0 0 0 0 0 0 0 0 0
53476 - 0 0 0 0 0 0 0 0 0 0 0 0
53477 - 0 0 0 0 0 0 0 0 0 0 0 0
53478 - 0 0 0 0 0 0 0 0 0 0 0 0
53479 - 0 0 0 0 0 0 0 0 0 0 0 0
53480 - 0 0 0 0 0 0 0 0 0 0 0 0
53481 - 0 0 0 0 0 0 0 0 0 0 0 0
53482 - 0 0 0 0 0 0 0 0 0 0 0 0
53483 - 0 0 0 0 0 0 0 0 0 0 0 0
53484 - 0 0 0 0 0 0 0 0 0 0 0 0
53485 - 0 0 0 0 0 0 0 0 0 0 0 0
53486 - 0 0 0 0 0 0 0 0 0 0 0 0
53487 - 0 0 0 0 0 0 0 0 0 10 10 10
53488 - 38 38 38 86 86 86 14 14 14 10 10 10
53489 -195 195 195 188 164 115 192 133 9 225 175 15
53490 -239 182 13 234 190 10 232 195 16 232 200 30
53491 -245 207 45 241 208 19 232 195 16 184 144 12
53492 -218 194 134 211 206 186 42 42 42 2 2 6
53493 - 2 2 6 2 2 6 2 2 6 2 2 6
53494 - 50 50 50 74 74 74 30 30 30 6 6 6
53495 - 0 0 0 0 0 0 0 0 0 0 0 0
53496 - 0 0 0 0 0 0 0 0 0 0 0 0
53497 - 0 0 0 0 0 0 0 0 0 0 0 0
53498 - 0 0 0 0 0 0 0 0 0 0 0 0
53499 - 0 0 0 0 0 0 0 0 0 0 0 0
53500 - 0 0 0 0 0 0 0 0 0 0 0 0
53501 - 0 0 0 0 0 0 0 0 0 0 0 0
53502 - 0 0 0 0 0 0 0 0 0 0 0 0
53503 - 0 0 0 0 0 0 0 0 0 0 0 0
53504 - 0 0 0 0 0 0 0 0 0 0 0 0
53505 - 0 0 0 0 0 0 0 0 0 0 0 0
53506 - 0 0 0 0 0 0 0 0 0 0 0 0
53507 - 0 0 0 0 0 0 0 0 0 10 10 10
53508 - 34 34 34 86 86 86 14 14 14 2 2 6
53509 -121 87 25 192 133 9 219 162 10 239 182 13
53510 -236 186 11 232 195 16 241 208 19 244 214 54
53511 -246 218 60 246 218 38 246 215 20 241 208 19
53512 -241 208 19 226 184 13 121 87 25 2 2 6
53513 - 2 2 6 2 2 6 2 2 6 2 2 6
53514 - 50 50 50 82 82 82 34 34 34 10 10 10
53515 - 0 0 0 0 0 0 0 0 0 0 0 0
53516 - 0 0 0 0 0 0 0 0 0 0 0 0
53517 - 0 0 0 0 0 0 0 0 0 0 0 0
53518 - 0 0 0 0 0 0 0 0 0 0 0 0
53519 - 0 0 0 0 0 0 0 0 0 0 0 0
53520 - 0 0 0 0 0 0 0 0 0 0 0 0
53521 - 0 0 0 0 0 0 0 0 0 0 0 0
53522 - 0 0 0 0 0 0 0 0 0 0 0 0
53523 - 0 0 0 0 0 0 0 0 0 0 0 0
53524 - 0 0 0 0 0 0 0 0 0 0 0 0
53525 - 0 0 0 0 0 0 0 0 0 0 0 0
53526 - 0 0 0 0 0 0 0 0 0 0 0 0
53527 - 0 0 0 0 0 0 0 0 0 10 10 10
53528 - 34 34 34 82 82 82 30 30 30 61 42 6
53529 -180 123 7 206 145 10 230 174 11 239 182 13
53530 -234 190 10 238 202 15 241 208 19 246 218 74
53531 -246 218 38 246 215 20 246 215 20 246 215 20
53532 -226 184 13 215 174 15 184 144 12 6 6 6
53533 - 2 2 6 2 2 6 2 2 6 2 2 6
53534 - 26 26 26 94 94 94 42 42 42 14 14 14
53535 - 0 0 0 0 0 0 0 0 0 0 0 0
53536 - 0 0 0 0 0 0 0 0 0 0 0 0
53537 - 0 0 0 0 0 0 0 0 0 0 0 0
53538 - 0 0 0 0 0 0 0 0 0 0 0 0
53539 - 0 0 0 0 0 0 0 0 0 0 0 0
53540 - 0 0 0 0 0 0 0 0 0 0 0 0
53541 - 0 0 0 0 0 0 0 0 0 0 0 0
53542 - 0 0 0 0 0 0 0 0 0 0 0 0
53543 - 0 0 0 0 0 0 0 0 0 0 0 0
53544 - 0 0 0 0 0 0 0 0 0 0 0 0
53545 - 0 0 0 0 0 0 0 0 0 0 0 0
53546 - 0 0 0 0 0 0 0 0 0 0 0 0
53547 - 0 0 0 0 0 0 0 0 0 10 10 10
53548 - 30 30 30 78 78 78 50 50 50 104 69 6
53549 -192 133 9 216 158 10 236 178 12 236 186 11
53550 -232 195 16 241 208 19 244 214 54 245 215 43
53551 -246 215 20 246 215 20 241 208 19 198 155 10
53552 -200 144 11 216 158 10 156 118 10 2 2 6
53553 - 2 2 6 2 2 6 2 2 6 2 2 6
53554 - 6 6 6 90 90 90 54 54 54 18 18 18
53555 - 6 6 6 0 0 0 0 0 0 0 0 0
53556 - 0 0 0 0 0 0 0 0 0 0 0 0
53557 - 0 0 0 0 0 0 0 0 0 0 0 0
53558 - 0 0 0 0 0 0 0 0 0 0 0 0
53559 - 0 0 0 0 0 0 0 0 0 0 0 0
53560 - 0 0 0 0 0 0 0 0 0 0 0 0
53561 - 0 0 0 0 0 0 0 0 0 0 0 0
53562 - 0 0 0 0 0 0 0 0 0 0 0 0
53563 - 0 0 0 0 0 0 0 0 0 0 0 0
53564 - 0 0 0 0 0 0 0 0 0 0 0 0
53565 - 0 0 0 0 0 0 0 0 0 0 0 0
53566 - 0 0 0 0 0 0 0 0 0 0 0 0
53567 - 0 0 0 0 0 0 0 0 0 10 10 10
53568 - 30 30 30 78 78 78 46 46 46 22 22 22
53569 -137 92 6 210 162 10 239 182 13 238 190 10
53570 -238 202 15 241 208 19 246 215 20 246 215 20
53571 -241 208 19 203 166 17 185 133 11 210 150 10
53572 -216 158 10 210 150 10 102 78 10 2 2 6
53573 - 6 6 6 54 54 54 14 14 14 2 2 6
53574 - 2 2 6 62 62 62 74 74 74 30 30 30
53575 - 10 10 10 0 0 0 0 0 0 0 0 0
53576 - 0 0 0 0 0 0 0 0 0 0 0 0
53577 - 0 0 0 0 0 0 0 0 0 0 0 0
53578 - 0 0 0 0 0 0 0 0 0 0 0 0
53579 - 0 0 0 0 0 0 0 0 0 0 0 0
53580 - 0 0 0 0 0 0 0 0 0 0 0 0
53581 - 0 0 0 0 0 0 0 0 0 0 0 0
53582 - 0 0 0 0 0 0 0 0 0 0 0 0
53583 - 0 0 0 0 0 0 0 0 0 0 0 0
53584 - 0 0 0 0 0 0 0 0 0 0 0 0
53585 - 0 0 0 0 0 0 0 0 0 0 0 0
53586 - 0 0 0 0 0 0 0 0 0 0 0 0
53587 - 0 0 0 0 0 0 0 0 0 10 10 10
53588 - 34 34 34 78 78 78 50 50 50 6 6 6
53589 - 94 70 30 139 102 15 190 146 13 226 184 13
53590 -232 200 30 232 195 16 215 174 15 190 146 13
53591 -168 122 10 192 133 9 210 150 10 213 154 11
53592 -202 150 34 182 157 106 101 98 89 2 2 6
53593 - 2 2 6 78 78 78 116 116 116 58 58 58
53594 - 2 2 6 22 22 22 90 90 90 46 46 46
53595 - 18 18 18 6 6 6 0 0 0 0 0 0
53596 - 0 0 0 0 0 0 0 0 0 0 0 0
53597 - 0 0 0 0 0 0 0 0 0 0 0 0
53598 - 0 0 0 0 0 0 0 0 0 0 0 0
53599 - 0 0 0 0 0 0 0 0 0 0 0 0
53600 - 0 0 0 0 0 0 0 0 0 0 0 0
53601 - 0 0 0 0 0 0 0 0 0 0 0 0
53602 - 0 0 0 0 0 0 0 0 0 0 0 0
53603 - 0 0 0 0 0 0 0 0 0 0 0 0
53604 - 0 0 0 0 0 0 0 0 0 0 0 0
53605 - 0 0 0 0 0 0 0 0 0 0 0 0
53606 - 0 0 0 0 0 0 0 0 0 0 0 0
53607 - 0 0 0 0 0 0 0 0 0 10 10 10
53608 - 38 38 38 86 86 86 50 50 50 6 6 6
53609 -128 128 128 174 154 114 156 107 11 168 122 10
53610 -198 155 10 184 144 12 197 138 11 200 144 11
53611 -206 145 10 206 145 10 197 138 11 188 164 115
53612 -195 195 195 198 198 198 174 174 174 14 14 14
53613 - 2 2 6 22 22 22 116 116 116 116 116 116
53614 - 22 22 22 2 2 6 74 74 74 70 70 70
53615 - 30 30 30 10 10 10 0 0 0 0 0 0
53616 - 0 0 0 0 0 0 0 0 0 0 0 0
53617 - 0 0 0 0 0 0 0 0 0 0 0 0
53618 - 0 0 0 0 0 0 0 0 0 0 0 0
53619 - 0 0 0 0 0 0 0 0 0 0 0 0
53620 - 0 0 0 0 0 0 0 0 0 0 0 0
53621 - 0 0 0 0 0 0 0 0 0 0 0 0
53622 - 0 0 0 0 0 0 0 0 0 0 0 0
53623 - 0 0 0 0 0 0 0 0 0 0 0 0
53624 - 0 0 0 0 0 0 0 0 0 0 0 0
53625 - 0 0 0 0 0 0 0 0 0 0 0 0
53626 - 0 0 0 0 0 0 0 0 0 0 0 0
53627 - 0 0 0 0 0 0 6 6 6 18 18 18
53628 - 50 50 50 101 101 101 26 26 26 10 10 10
53629 -138 138 138 190 190 190 174 154 114 156 107 11
53630 -197 138 11 200 144 11 197 138 11 192 133 9
53631 -180 123 7 190 142 34 190 178 144 187 187 187
53632 -202 202 202 221 221 221 214 214 214 66 66 66
53633 - 2 2 6 2 2 6 50 50 50 62 62 62
53634 - 6 6 6 2 2 6 10 10 10 90 90 90
53635 - 50 50 50 18 18 18 6 6 6 0 0 0
53636 - 0 0 0 0 0 0 0 0 0 0 0 0
53637 - 0 0 0 0 0 0 0 0 0 0 0 0
53638 - 0 0 0 0 0 0 0 0 0 0 0 0
53639 - 0 0 0 0 0 0 0 0 0 0 0 0
53640 - 0 0 0 0 0 0 0 0 0 0 0 0
53641 - 0 0 0 0 0 0 0 0 0 0 0 0
53642 - 0 0 0 0 0 0 0 0 0 0 0 0
53643 - 0 0 0 0 0 0 0 0 0 0 0 0
53644 - 0 0 0 0 0 0 0 0 0 0 0 0
53645 - 0 0 0 0 0 0 0 0 0 0 0 0
53646 - 0 0 0 0 0 0 0 0 0 0 0 0
53647 - 0 0 0 0 0 0 10 10 10 34 34 34
53648 - 74 74 74 74 74 74 2 2 6 6 6 6
53649 -144 144 144 198 198 198 190 190 190 178 166 146
53650 -154 121 60 156 107 11 156 107 11 168 124 44
53651 -174 154 114 187 187 187 190 190 190 210 210 210
53652 -246 246 246 253 253 253 253 253 253 182 182 182
53653 - 6 6 6 2 2 6 2 2 6 2 2 6
53654 - 2 2 6 2 2 6 2 2 6 62 62 62
53655 - 74 74 74 34 34 34 14 14 14 0 0 0
53656 - 0 0 0 0 0 0 0 0 0 0 0 0
53657 - 0 0 0 0 0 0 0 0 0 0 0 0
53658 - 0 0 0 0 0 0 0 0 0 0 0 0
53659 - 0 0 0 0 0 0 0 0 0 0 0 0
53660 - 0 0 0 0 0 0 0 0 0 0 0 0
53661 - 0 0 0 0 0 0 0 0 0 0 0 0
53662 - 0 0 0 0 0 0 0 0 0 0 0 0
53663 - 0 0 0 0 0 0 0 0 0 0 0 0
53664 - 0 0 0 0 0 0 0 0 0 0 0 0
53665 - 0 0 0 0 0 0 0 0 0 0 0 0
53666 - 0 0 0 0 0 0 0 0 0 0 0 0
53667 - 0 0 0 10 10 10 22 22 22 54 54 54
53668 - 94 94 94 18 18 18 2 2 6 46 46 46
53669 -234 234 234 221 221 221 190 190 190 190 190 190
53670 -190 190 190 187 187 187 187 187 187 190 190 190
53671 -190 190 190 195 195 195 214 214 214 242 242 242
53672 -253 253 253 253 253 253 253 253 253 253 253 253
53673 - 82 82 82 2 2 6 2 2 6 2 2 6
53674 - 2 2 6 2 2 6 2 2 6 14 14 14
53675 - 86 86 86 54 54 54 22 22 22 6 6 6
53676 - 0 0 0 0 0 0 0 0 0 0 0 0
53677 - 0 0 0 0 0 0 0 0 0 0 0 0
53678 - 0 0 0 0 0 0 0 0 0 0 0 0
53679 - 0 0 0 0 0 0 0 0 0 0 0 0
53680 - 0 0 0 0 0 0 0 0 0 0 0 0
53681 - 0 0 0 0 0 0 0 0 0 0 0 0
53682 - 0 0 0 0 0 0 0 0 0 0 0 0
53683 - 0 0 0 0 0 0 0 0 0 0 0 0
53684 - 0 0 0 0 0 0 0 0 0 0 0 0
53685 - 0 0 0 0 0 0 0 0 0 0 0 0
53686 - 0 0 0 0 0 0 0 0 0 0 0 0
53687 - 6 6 6 18 18 18 46 46 46 90 90 90
53688 - 46 46 46 18 18 18 6 6 6 182 182 182
53689 -253 253 253 246 246 246 206 206 206 190 190 190
53690 -190 190 190 190 190 190 190 190 190 190 190 190
53691 -206 206 206 231 231 231 250 250 250 253 253 253
53692 -253 253 253 253 253 253 253 253 253 253 253 253
53693 -202 202 202 14 14 14 2 2 6 2 2 6
53694 - 2 2 6 2 2 6 2 2 6 2 2 6
53695 - 42 42 42 86 86 86 42 42 42 18 18 18
53696 - 6 6 6 0 0 0 0 0 0 0 0 0
53697 - 0 0 0 0 0 0 0 0 0 0 0 0
53698 - 0 0 0 0 0 0 0 0 0 0 0 0
53699 - 0 0 0 0 0 0 0 0 0 0 0 0
53700 - 0 0 0 0 0 0 0 0 0 0 0 0
53701 - 0 0 0 0 0 0 0 0 0 0 0 0
53702 - 0 0 0 0 0 0 0 0 0 0 0 0
53703 - 0 0 0 0 0 0 0 0 0 0 0 0
53704 - 0 0 0 0 0 0 0 0 0 0 0 0
53705 - 0 0 0 0 0 0 0 0 0 0 0 0
53706 - 0 0 0 0 0 0 0 0 0 6 6 6
53707 - 14 14 14 38 38 38 74 74 74 66 66 66
53708 - 2 2 6 6 6 6 90 90 90 250 250 250
53709 -253 253 253 253 253 253 238 238 238 198 198 198
53710 -190 190 190 190 190 190 195 195 195 221 221 221
53711 -246 246 246 253 253 253 253 253 253 253 253 253
53712 -253 253 253 253 253 253 253 253 253 253 253 253
53713 -253 253 253 82 82 82 2 2 6 2 2 6
53714 - 2 2 6 2 2 6 2 2 6 2 2 6
53715 - 2 2 6 78 78 78 70 70 70 34 34 34
53716 - 14 14 14 6 6 6 0 0 0 0 0 0
53717 - 0 0 0 0 0 0 0 0 0 0 0 0
53718 - 0 0 0 0 0 0 0 0 0 0 0 0
53719 - 0 0 0 0 0 0 0 0 0 0 0 0
53720 - 0 0 0 0 0 0 0 0 0 0 0 0
53721 - 0 0 0 0 0 0 0 0 0 0 0 0
53722 - 0 0 0 0 0 0 0 0 0 0 0 0
53723 - 0 0 0 0 0 0 0 0 0 0 0 0
53724 - 0 0 0 0 0 0 0 0 0 0 0 0
53725 - 0 0 0 0 0 0 0 0 0 0 0 0
53726 - 0 0 0 0 0 0 0 0 0 14 14 14
53727 - 34 34 34 66 66 66 78 78 78 6 6 6
53728 - 2 2 6 18 18 18 218 218 218 253 253 253
53729 -253 253 253 253 253 253 253 253 253 246 246 246
53730 -226 226 226 231 231 231 246 246 246 253 253 253
53731 -253 253 253 253 253 253 253 253 253 253 253 253
53732 -253 253 253 253 253 253 253 253 253 253 253 253
53733 -253 253 253 178 178 178 2 2 6 2 2 6
53734 - 2 2 6 2 2 6 2 2 6 2 2 6
53735 - 2 2 6 18 18 18 90 90 90 62 62 62
53736 - 30 30 30 10 10 10 0 0 0 0 0 0
53737 - 0 0 0 0 0 0 0 0 0 0 0 0
53738 - 0 0 0 0 0 0 0 0 0 0 0 0
53739 - 0 0 0 0 0 0 0 0 0 0 0 0
53740 - 0 0 0 0 0 0 0 0 0 0 0 0
53741 - 0 0 0 0 0 0 0 0 0 0 0 0
53742 - 0 0 0 0 0 0 0 0 0 0 0 0
53743 - 0 0 0 0 0 0 0 0 0 0 0 0
53744 - 0 0 0 0 0 0 0 0 0 0 0 0
53745 - 0 0 0 0 0 0 0 0 0 0 0 0
53746 - 0 0 0 0 0 0 10 10 10 26 26 26
53747 - 58 58 58 90 90 90 18 18 18 2 2 6
53748 - 2 2 6 110 110 110 253 253 253 253 253 253
53749 -253 253 253 253 253 253 253 253 253 253 253 253
53750 -250 250 250 253 253 253 253 253 253 253 253 253
53751 -253 253 253 253 253 253 253 253 253 253 253 253
53752 -253 253 253 253 253 253 253 253 253 253 253 253
53753 -253 253 253 231 231 231 18 18 18 2 2 6
53754 - 2 2 6 2 2 6 2 2 6 2 2 6
53755 - 2 2 6 2 2 6 18 18 18 94 94 94
53756 - 54 54 54 26 26 26 10 10 10 0 0 0
53757 - 0 0 0 0 0 0 0 0 0 0 0 0
53758 - 0 0 0 0 0 0 0 0 0 0 0 0
53759 - 0 0 0 0 0 0 0 0 0 0 0 0
53760 - 0 0 0 0 0 0 0 0 0 0 0 0
53761 - 0 0 0 0 0 0 0 0 0 0 0 0
53762 - 0 0 0 0 0 0 0 0 0 0 0 0
53763 - 0 0 0 0 0 0 0 0 0 0 0 0
53764 - 0 0 0 0 0 0 0 0 0 0 0 0
53765 - 0 0 0 0 0 0 0 0 0 0 0 0
53766 - 0 0 0 6 6 6 22 22 22 50 50 50
53767 - 90 90 90 26 26 26 2 2 6 2 2 6
53768 - 14 14 14 195 195 195 250 250 250 253 253 253
53769 -253 253 253 253 253 253 253 253 253 253 253 253
53770 -253 253 253 253 253 253 253 253 253 253 253 253
53771 -253 253 253 253 253 253 253 253 253 253 253 253
53772 -253 253 253 253 253 253 253 253 253 253 253 253
53773 -250 250 250 242 242 242 54 54 54 2 2 6
53774 - 2 2 6 2 2 6 2 2 6 2 2 6
53775 - 2 2 6 2 2 6 2 2 6 38 38 38
53776 - 86 86 86 50 50 50 22 22 22 6 6 6
53777 - 0 0 0 0 0 0 0 0 0 0 0 0
53778 - 0 0 0 0 0 0 0 0 0 0 0 0
53779 - 0 0 0 0 0 0 0 0 0 0 0 0
53780 - 0 0 0 0 0 0 0 0 0 0 0 0
53781 - 0 0 0 0 0 0 0 0 0 0 0 0
53782 - 0 0 0 0 0 0 0 0 0 0 0 0
53783 - 0 0 0 0 0 0 0 0 0 0 0 0
53784 - 0 0 0 0 0 0 0 0 0 0 0 0
53785 - 0 0 0 0 0 0 0 0 0 0 0 0
53786 - 6 6 6 14 14 14 38 38 38 82 82 82
53787 - 34 34 34 2 2 6 2 2 6 2 2 6
53788 - 42 42 42 195 195 195 246 246 246 253 253 253
53789 -253 253 253 253 253 253 253 253 253 250 250 250
53790 -242 242 242 242 242 242 250 250 250 253 253 253
53791 -253 253 253 253 253 253 253 253 253 253 253 253
53792 -253 253 253 250 250 250 246 246 246 238 238 238
53793 -226 226 226 231 231 231 101 101 101 6 6 6
53794 - 2 2 6 2 2 6 2 2 6 2 2 6
53795 - 2 2 6 2 2 6 2 2 6 2 2 6
53796 - 38 38 38 82 82 82 42 42 42 14 14 14
53797 - 6 6 6 0 0 0 0 0 0 0 0 0
53798 - 0 0 0 0 0 0 0 0 0 0 0 0
53799 - 0 0 0 0 0 0 0 0 0 0 0 0
53800 - 0 0 0 0 0 0 0 0 0 0 0 0
53801 - 0 0 0 0 0 0 0 0 0 0 0 0
53802 - 0 0 0 0 0 0 0 0 0 0 0 0
53803 - 0 0 0 0 0 0 0 0 0 0 0 0
53804 - 0 0 0 0 0 0 0 0 0 0 0 0
53805 - 0 0 0 0 0 0 0 0 0 0 0 0
53806 - 10 10 10 26 26 26 62 62 62 66 66 66
53807 - 2 2 6 2 2 6 2 2 6 6 6 6
53808 - 70 70 70 170 170 170 206 206 206 234 234 234
53809 -246 246 246 250 250 250 250 250 250 238 238 238
53810 -226 226 226 231 231 231 238 238 238 250 250 250
53811 -250 250 250 250 250 250 246 246 246 231 231 231
53812 -214 214 214 206 206 206 202 202 202 202 202 202
53813 -198 198 198 202 202 202 182 182 182 18 18 18
53814 - 2 2 6 2 2 6 2 2 6 2 2 6
53815 - 2 2 6 2 2 6 2 2 6 2 2 6
53816 - 2 2 6 62 62 62 66 66 66 30 30 30
53817 - 10 10 10 0 0 0 0 0 0 0 0 0
53818 - 0 0 0 0 0 0 0 0 0 0 0 0
53819 - 0 0 0 0 0 0 0 0 0 0 0 0
53820 - 0 0 0 0 0 0 0 0 0 0 0 0
53821 - 0 0 0 0 0 0 0 0 0 0 0 0
53822 - 0 0 0 0 0 0 0 0 0 0 0 0
53823 - 0 0 0 0 0 0 0 0 0 0 0 0
53824 - 0 0 0 0 0 0 0 0 0 0 0 0
53825 - 0 0 0 0 0 0 0 0 0 0 0 0
53826 - 14 14 14 42 42 42 82 82 82 18 18 18
53827 - 2 2 6 2 2 6 2 2 6 10 10 10
53828 - 94 94 94 182 182 182 218 218 218 242 242 242
53829 -250 250 250 253 253 253 253 253 253 250 250 250
53830 -234 234 234 253 253 253 253 253 253 253 253 253
53831 -253 253 253 253 253 253 253 253 253 246 246 246
53832 -238 238 238 226 226 226 210 210 210 202 202 202
53833 -195 195 195 195 195 195 210 210 210 158 158 158
53834 - 6 6 6 14 14 14 50 50 50 14 14 14
53835 - 2 2 6 2 2 6 2 2 6 2 2 6
53836 - 2 2 6 6 6 6 86 86 86 46 46 46
53837 - 18 18 18 6 6 6 0 0 0 0 0 0
53838 - 0 0 0 0 0 0 0 0 0 0 0 0
53839 - 0 0 0 0 0 0 0 0 0 0 0 0
53840 - 0 0 0 0 0 0 0 0 0 0 0 0
53841 - 0 0 0 0 0 0 0 0 0 0 0 0
53842 - 0 0 0 0 0 0 0 0 0 0 0 0
53843 - 0 0 0 0 0 0 0 0 0 0 0 0
53844 - 0 0 0 0 0 0 0 0 0 0 0 0
53845 - 0 0 0 0 0 0 0 0 0 6 6 6
53846 - 22 22 22 54 54 54 70 70 70 2 2 6
53847 - 2 2 6 10 10 10 2 2 6 22 22 22
53848 -166 166 166 231 231 231 250 250 250 253 253 253
53849 -253 253 253 253 253 253 253 253 253 250 250 250
53850 -242 242 242 253 253 253 253 253 253 253 253 253
53851 -253 253 253 253 253 253 253 253 253 253 253 253
53852 -253 253 253 253 253 253 253 253 253 246 246 246
53853 -231 231 231 206 206 206 198 198 198 226 226 226
53854 - 94 94 94 2 2 6 6 6 6 38 38 38
53855 - 30 30 30 2 2 6 2 2 6 2 2 6
53856 - 2 2 6 2 2 6 62 62 62 66 66 66
53857 - 26 26 26 10 10 10 0 0 0 0 0 0
53858 - 0 0 0 0 0 0 0 0 0 0 0 0
53859 - 0 0 0 0 0 0 0 0 0 0 0 0
53860 - 0 0 0 0 0 0 0 0 0 0 0 0
53861 - 0 0 0 0 0 0 0 0 0 0 0 0
53862 - 0 0 0 0 0 0 0 0 0 0 0 0
53863 - 0 0 0 0 0 0 0 0 0 0 0 0
53864 - 0 0 0 0 0 0 0 0 0 0 0 0
53865 - 0 0 0 0 0 0 0 0 0 10 10 10
53866 - 30 30 30 74 74 74 50 50 50 2 2 6
53867 - 26 26 26 26 26 26 2 2 6 106 106 106
53868 -238 238 238 253 253 253 253 253 253 253 253 253
53869 -253 253 253 253 253 253 253 253 253 253 253 253
53870 -253 253 253 253 253 253 253 253 253 253 253 253
53871 -253 253 253 253 253 253 253 253 253 253 253 253
53872 -253 253 253 253 253 253 253 253 253 253 253 253
53873 -253 253 253 246 246 246 218 218 218 202 202 202
53874 -210 210 210 14 14 14 2 2 6 2 2 6
53875 - 30 30 30 22 22 22 2 2 6 2 2 6
53876 - 2 2 6 2 2 6 18 18 18 86 86 86
53877 - 42 42 42 14 14 14 0 0 0 0 0 0
53878 - 0 0 0 0 0 0 0 0 0 0 0 0
53879 - 0 0 0 0 0 0 0 0 0 0 0 0
53880 - 0 0 0 0 0 0 0 0 0 0 0 0
53881 - 0 0 0 0 0 0 0 0 0 0 0 0
53882 - 0 0 0 0 0 0 0 0 0 0 0 0
53883 - 0 0 0 0 0 0 0 0 0 0 0 0
53884 - 0 0 0 0 0 0 0 0 0 0 0 0
53885 - 0 0 0 0 0 0 0 0 0 14 14 14
53886 - 42 42 42 90 90 90 22 22 22 2 2 6
53887 - 42 42 42 2 2 6 18 18 18 218 218 218
53888 -253 253 253 253 253 253 253 253 253 253 253 253
53889 -253 253 253 253 253 253 253 253 253 253 253 253
53890 -253 253 253 253 253 253 253 253 253 253 253 253
53891 -253 253 253 253 253 253 253 253 253 253 253 253
53892 -253 253 253 253 253 253 253 253 253 253 253 253
53893 -253 253 253 253 253 253 250 250 250 221 221 221
53894 -218 218 218 101 101 101 2 2 6 14 14 14
53895 - 18 18 18 38 38 38 10 10 10 2 2 6
53896 - 2 2 6 2 2 6 2 2 6 78 78 78
53897 - 58 58 58 22 22 22 6 6 6 0 0 0
53898 - 0 0 0 0 0 0 0 0 0 0 0 0
53899 - 0 0 0 0 0 0 0 0 0 0 0 0
53900 - 0 0 0 0 0 0 0 0 0 0 0 0
53901 - 0 0 0 0 0 0 0 0 0 0 0 0
53902 - 0 0 0 0 0 0 0 0 0 0 0 0
53903 - 0 0 0 0 0 0 0 0 0 0 0 0
53904 - 0 0 0 0 0 0 0 0 0 0 0 0
53905 - 0 0 0 0 0 0 6 6 6 18 18 18
53906 - 54 54 54 82 82 82 2 2 6 26 26 26
53907 - 22 22 22 2 2 6 123 123 123 253 253 253
53908 -253 253 253 253 253 253 253 253 253 253 253 253
53909 -253 253 253 253 253 253 253 253 253 253 253 253
53910 -253 253 253 253 253 253 253 253 253 253 253 253
53911 -253 253 253 253 253 253 253 253 253 253 253 253
53912 -253 253 253 253 253 253 253 253 253 253 253 253
53913 -253 253 253 253 253 253 253 253 253 250 250 250
53914 -238 238 238 198 198 198 6 6 6 38 38 38
53915 - 58 58 58 26 26 26 38 38 38 2 2 6
53916 - 2 2 6 2 2 6 2 2 6 46 46 46
53917 - 78 78 78 30 30 30 10 10 10 0 0 0
53918 - 0 0 0 0 0 0 0 0 0 0 0 0
53919 - 0 0 0 0 0 0 0 0 0 0 0 0
53920 - 0 0 0 0 0 0 0 0 0 0 0 0
53921 - 0 0 0 0 0 0 0 0 0 0 0 0
53922 - 0 0 0 0 0 0 0 0 0 0 0 0
53923 - 0 0 0 0 0 0 0 0 0 0 0 0
53924 - 0 0 0 0 0 0 0 0 0 0 0 0
53925 - 0 0 0 0 0 0 10 10 10 30 30 30
53926 - 74 74 74 58 58 58 2 2 6 42 42 42
53927 - 2 2 6 22 22 22 231 231 231 253 253 253
53928 -253 253 253 253 253 253 253 253 253 253 253 253
53929 -253 253 253 253 253 253 253 253 253 250 250 250
53930 -253 253 253 253 253 253 253 253 253 253 253 253
53931 -253 253 253 253 253 253 253 253 253 253 253 253
53932 -253 253 253 253 253 253 253 253 253 253 253 253
53933 -253 253 253 253 253 253 253 253 253 253 253 253
53934 -253 253 253 246 246 246 46 46 46 38 38 38
53935 - 42 42 42 14 14 14 38 38 38 14 14 14
53936 - 2 2 6 2 2 6 2 2 6 6 6 6
53937 - 86 86 86 46 46 46 14 14 14 0 0 0
53938 - 0 0 0 0 0 0 0 0 0 0 0 0
53939 - 0 0 0 0 0 0 0 0 0 0 0 0
53940 - 0 0 0 0 0 0 0 0 0 0 0 0
53941 - 0 0 0 0 0 0 0 0 0 0 0 0
53942 - 0 0 0 0 0 0 0 0 0 0 0 0
53943 - 0 0 0 0 0 0 0 0 0 0 0 0
53944 - 0 0 0 0 0 0 0 0 0 0 0 0
53945 - 0 0 0 6 6 6 14 14 14 42 42 42
53946 - 90 90 90 18 18 18 18 18 18 26 26 26
53947 - 2 2 6 116 116 116 253 253 253 253 253 253
53948 -253 253 253 253 253 253 253 253 253 253 253 253
53949 -253 253 253 253 253 253 250 250 250 238 238 238
53950 -253 253 253 253 253 253 253 253 253 253 253 253
53951 -253 253 253 253 253 253 253 253 253 253 253 253
53952 -253 253 253 253 253 253 253 253 253 253 253 253
53953 -253 253 253 253 253 253 253 253 253 253 253 253
53954 -253 253 253 253 253 253 94 94 94 6 6 6
53955 - 2 2 6 2 2 6 10 10 10 34 34 34
53956 - 2 2 6 2 2 6 2 2 6 2 2 6
53957 - 74 74 74 58 58 58 22 22 22 6 6 6
53958 - 0 0 0 0 0 0 0 0 0 0 0 0
53959 - 0 0 0 0 0 0 0 0 0 0 0 0
53960 - 0 0 0 0 0 0 0 0 0 0 0 0
53961 - 0 0 0 0 0 0 0 0 0 0 0 0
53962 - 0 0 0 0 0 0 0 0 0 0 0 0
53963 - 0 0 0 0 0 0 0 0 0 0 0 0
53964 - 0 0 0 0 0 0 0 0 0 0 0 0
53965 - 0 0 0 10 10 10 26 26 26 66 66 66
53966 - 82 82 82 2 2 6 38 38 38 6 6 6
53967 - 14 14 14 210 210 210 253 253 253 253 253 253
53968 -253 253 253 253 253 253 253 253 253 253 253 253
53969 -253 253 253 253 253 253 246 246 246 242 242 242
53970 -253 253 253 253 253 253 253 253 253 253 253 253
53971 -253 253 253 253 253 253 253 253 253 253 253 253
53972 -253 253 253 253 253 253 253 253 253 253 253 253
53973 -253 253 253 253 253 253 253 253 253 253 253 253
53974 -253 253 253 253 253 253 144 144 144 2 2 6
53975 - 2 2 6 2 2 6 2 2 6 46 46 46
53976 - 2 2 6 2 2 6 2 2 6 2 2 6
53977 - 42 42 42 74 74 74 30 30 30 10 10 10
53978 - 0 0 0 0 0 0 0 0 0 0 0 0
53979 - 0 0 0 0 0 0 0 0 0 0 0 0
53980 - 0 0 0 0 0 0 0 0 0 0 0 0
53981 - 0 0 0 0 0 0 0 0 0 0 0 0
53982 - 0 0 0 0 0 0 0 0 0 0 0 0
53983 - 0 0 0 0 0 0 0 0 0 0 0 0
53984 - 0 0 0 0 0 0 0 0 0 0 0 0
53985 - 6 6 6 14 14 14 42 42 42 90 90 90
53986 - 26 26 26 6 6 6 42 42 42 2 2 6
53987 - 74 74 74 250 250 250 253 253 253 253 253 253
53988 -253 253 253 253 253 253 253 253 253 253 253 253
53989 -253 253 253 253 253 253 242 242 242 242 242 242
53990 -253 253 253 253 253 253 253 253 253 253 253 253
53991 -253 253 253 253 253 253 253 253 253 253 253 253
53992 -253 253 253 253 253 253 253 253 253 253 253 253
53993 -253 253 253 253 253 253 253 253 253 253 253 253
53994 -253 253 253 253 253 253 182 182 182 2 2 6
53995 - 2 2 6 2 2 6 2 2 6 46 46 46
53996 - 2 2 6 2 2 6 2 2 6 2 2 6
53997 - 10 10 10 86 86 86 38 38 38 10 10 10
53998 - 0 0 0 0 0 0 0 0 0 0 0 0
53999 - 0 0 0 0 0 0 0 0 0 0 0 0
54000 - 0 0 0 0 0 0 0 0 0 0 0 0
54001 - 0 0 0 0 0 0 0 0 0 0 0 0
54002 - 0 0 0 0 0 0 0 0 0 0 0 0
54003 - 0 0 0 0 0 0 0 0 0 0 0 0
54004 - 0 0 0 0 0 0 0 0 0 0 0 0
54005 - 10 10 10 26 26 26 66 66 66 82 82 82
54006 - 2 2 6 22 22 22 18 18 18 2 2 6
54007 -149 149 149 253 253 253 253 253 253 253 253 253
54008 -253 253 253 253 253 253 253 253 253 253 253 253
54009 -253 253 253 253 253 253 234 234 234 242 242 242
54010 -253 253 253 253 253 253 253 253 253 253 253 253
54011 -253 253 253 253 253 253 253 253 253 253 253 253
54012 -253 253 253 253 253 253 253 253 253 253 253 253
54013 -253 253 253 253 253 253 253 253 253 253 253 253
54014 -253 253 253 253 253 253 206 206 206 2 2 6
54015 - 2 2 6 2 2 6 2 2 6 38 38 38
54016 - 2 2 6 2 2 6 2 2 6 2 2 6
54017 - 6 6 6 86 86 86 46 46 46 14 14 14
54018 - 0 0 0 0 0 0 0 0 0 0 0 0
54019 - 0 0 0 0 0 0 0 0 0 0 0 0
54020 - 0 0 0 0 0 0 0 0 0 0 0 0
54021 - 0 0 0 0 0 0 0 0 0 0 0 0
54022 - 0 0 0 0 0 0 0 0 0 0 0 0
54023 - 0 0 0 0 0 0 0 0 0 0 0 0
54024 - 0 0 0 0 0 0 0 0 0 6 6 6
54025 - 18 18 18 46 46 46 86 86 86 18 18 18
54026 - 2 2 6 34 34 34 10 10 10 6 6 6
54027 -210 210 210 253 253 253 253 253 253 253 253 253
54028 -253 253 253 253 253 253 253 253 253 253 253 253
54029 -253 253 253 253 253 253 234 234 234 242 242 242
54030 -253 253 253 253 253 253 253 253 253 253 253 253
54031 -253 253 253 253 253 253 253 253 253 253 253 253
54032 -253 253 253 253 253 253 253 253 253 253 253 253
54033 -253 253 253 253 253 253 253 253 253 253 253 253
54034 -253 253 253 253 253 253 221 221 221 6 6 6
54035 - 2 2 6 2 2 6 6 6 6 30 30 30
54036 - 2 2 6 2 2 6 2 2 6 2 2 6
54037 - 2 2 6 82 82 82 54 54 54 18 18 18
54038 - 6 6 6 0 0 0 0 0 0 0 0 0
54039 - 0 0 0 0 0 0 0 0 0 0 0 0
54040 - 0 0 0 0 0 0 0 0 0 0 0 0
54041 - 0 0 0 0 0 0 0 0 0 0 0 0
54042 - 0 0 0 0 0 0 0 0 0 0 0 0
54043 - 0 0 0 0 0 0 0 0 0 0 0 0
54044 - 0 0 0 0 0 0 0 0 0 10 10 10
54045 - 26 26 26 66 66 66 62 62 62 2 2 6
54046 - 2 2 6 38 38 38 10 10 10 26 26 26
54047 -238 238 238 253 253 253 253 253 253 253 253 253
54048 -253 253 253 253 253 253 253 253 253 253 253 253
54049 -253 253 253 253 253 253 231 231 231 238 238 238
54050 -253 253 253 253 253 253 253 253 253 253 253 253
54051 -253 253 253 253 253 253 253 253 253 253 253 253
54052 -253 253 253 253 253 253 253 253 253 253 253 253
54053 -253 253 253 253 253 253 253 253 253 253 253 253
54054 -253 253 253 253 253 253 231 231 231 6 6 6
54055 - 2 2 6 2 2 6 10 10 10 30 30 30
54056 - 2 2 6 2 2 6 2 2 6 2 2 6
54057 - 2 2 6 66 66 66 58 58 58 22 22 22
54058 - 6 6 6 0 0 0 0 0 0 0 0 0
54059 - 0 0 0 0 0 0 0 0 0 0 0 0
54060 - 0 0 0 0 0 0 0 0 0 0 0 0
54061 - 0 0 0 0 0 0 0 0 0 0 0 0
54062 - 0 0 0 0 0 0 0 0 0 0 0 0
54063 - 0 0 0 0 0 0 0 0 0 0 0 0
54064 - 0 0 0 0 0 0 0 0 0 10 10 10
54065 - 38 38 38 78 78 78 6 6 6 2 2 6
54066 - 2 2 6 46 46 46 14 14 14 42 42 42
54067 -246 246 246 253 253 253 253 253 253 253 253 253
54068 -253 253 253 253 253 253 253 253 253 253 253 253
54069 -253 253 253 253 253 253 231 231 231 242 242 242
54070 -253 253 253 253 253 253 253 253 253 253 253 253
54071 -253 253 253 253 253 253 253 253 253 253 253 253
54072 -253 253 253 253 253 253 253 253 253 253 253 253
54073 -253 253 253 253 253 253 253 253 253 253 253 253
54074 -253 253 253 253 253 253 234 234 234 10 10 10
54075 - 2 2 6 2 2 6 22 22 22 14 14 14
54076 - 2 2 6 2 2 6 2 2 6 2 2 6
54077 - 2 2 6 66 66 66 62 62 62 22 22 22
54078 - 6 6 6 0 0 0 0 0 0 0 0 0
54079 - 0 0 0 0 0 0 0 0 0 0 0 0
54080 - 0 0 0 0 0 0 0 0 0 0 0 0
54081 - 0 0 0 0 0 0 0 0 0 0 0 0
54082 - 0 0 0 0 0 0 0 0 0 0 0 0
54083 - 0 0 0 0 0 0 0 0 0 0 0 0
54084 - 0 0 0 0 0 0 6 6 6 18 18 18
54085 - 50 50 50 74 74 74 2 2 6 2 2 6
54086 - 14 14 14 70 70 70 34 34 34 62 62 62
54087 -250 250 250 253 253 253 253 253 253 253 253 253
54088 -253 253 253 253 253 253 253 253 253 253 253 253
54089 -253 253 253 253 253 253 231 231 231 246 246 246
54090 -253 253 253 253 253 253 253 253 253 253 253 253
54091 -253 253 253 253 253 253 253 253 253 253 253 253
54092 -253 253 253 253 253 253 253 253 253 253 253 253
54093 -253 253 253 253 253 253 253 253 253 253 253 253
54094 -253 253 253 253 253 253 234 234 234 14 14 14
54095 - 2 2 6 2 2 6 30 30 30 2 2 6
54096 - 2 2 6 2 2 6 2 2 6 2 2 6
54097 - 2 2 6 66 66 66 62 62 62 22 22 22
54098 - 6 6 6 0 0 0 0 0 0 0 0 0
54099 - 0 0 0 0 0 0 0 0 0 0 0 0
54100 - 0 0 0 0 0 0 0 0 0 0 0 0
54101 - 0 0 0 0 0 0 0 0 0 0 0 0
54102 - 0 0 0 0 0 0 0 0 0 0 0 0
54103 - 0 0 0 0 0 0 0 0 0 0 0 0
54104 - 0 0 0 0 0 0 6 6 6 18 18 18
54105 - 54 54 54 62 62 62 2 2 6 2 2 6
54106 - 2 2 6 30 30 30 46 46 46 70 70 70
54107 -250 250 250 253 253 253 253 253 253 253 253 253
54108 -253 253 253 253 253 253 253 253 253 253 253 253
54109 -253 253 253 253 253 253 231 231 231 246 246 246
54110 -253 253 253 253 253 253 253 253 253 253 253 253
54111 -253 253 253 253 253 253 253 253 253 253 253 253
54112 -253 253 253 253 253 253 253 253 253 253 253 253
54113 -253 253 253 253 253 253 253 253 253 253 253 253
54114 -253 253 253 253 253 253 226 226 226 10 10 10
54115 - 2 2 6 6 6 6 30 30 30 2 2 6
54116 - 2 2 6 2 2 6 2 2 6 2 2 6
54117 - 2 2 6 66 66 66 58 58 58 22 22 22
54118 - 6 6 6 0 0 0 0 0 0 0 0 0
54119 - 0 0 0 0 0 0 0 0 0 0 0 0
54120 - 0 0 0 0 0 0 0 0 0 0 0 0
54121 - 0 0 0 0 0 0 0 0 0 0 0 0
54122 - 0 0 0 0 0 0 0 0 0 0 0 0
54123 - 0 0 0 0 0 0 0 0 0 0 0 0
54124 - 0 0 0 0 0 0 6 6 6 22 22 22
54125 - 58 58 58 62 62 62 2 2 6 2 2 6
54126 - 2 2 6 2 2 6 30 30 30 78 78 78
54127 -250 250 250 253 253 253 253 253 253 253 253 253
54128 -253 253 253 253 253 253 253 253 253 253 253 253
54129 -253 253 253 253 253 253 231 231 231 246 246 246
54130 -253 253 253 253 253 253 253 253 253 253 253 253
54131 -253 253 253 253 253 253 253 253 253 253 253 253
54132 -253 253 253 253 253 253 253 253 253 253 253 253
54133 -253 253 253 253 253 253 253 253 253 253 253 253
54134 -253 253 253 253 253 253 206 206 206 2 2 6
54135 - 22 22 22 34 34 34 18 14 6 22 22 22
54136 - 26 26 26 18 18 18 6 6 6 2 2 6
54137 - 2 2 6 82 82 82 54 54 54 18 18 18
54138 - 6 6 6 0 0 0 0 0 0 0 0 0
54139 - 0 0 0 0 0 0 0 0 0 0 0 0
54140 - 0 0 0 0 0 0 0 0 0 0 0 0
54141 - 0 0 0 0 0 0 0 0 0 0 0 0
54142 - 0 0 0 0 0 0 0 0 0 0 0 0
54143 - 0 0 0 0 0 0 0 0 0 0 0 0
54144 - 0 0 0 0 0 0 6 6 6 26 26 26
54145 - 62 62 62 106 106 106 74 54 14 185 133 11
54146 -210 162 10 121 92 8 6 6 6 62 62 62
54147 -238 238 238 253 253 253 253 253 253 253 253 253
54148 -253 253 253 253 253 253 253 253 253 253 253 253
54149 -253 253 253 253 253 253 231 231 231 246 246 246
54150 -253 253 253 253 253 253 253 253 253 253 253 253
54151 -253 253 253 253 253 253 253 253 253 253 253 253
54152 -253 253 253 253 253 253 253 253 253 253 253 253
54153 -253 253 253 253 253 253 253 253 253 253 253 253
54154 -253 253 253 253 253 253 158 158 158 18 18 18
54155 - 14 14 14 2 2 6 2 2 6 2 2 6
54156 - 6 6 6 18 18 18 66 66 66 38 38 38
54157 - 6 6 6 94 94 94 50 50 50 18 18 18
54158 - 6 6 6 0 0 0 0 0 0 0 0 0
54159 - 0 0 0 0 0 0 0 0 0 0 0 0
54160 - 0 0 0 0 0 0 0 0 0 0 0 0
54161 - 0 0 0 0 0 0 0 0 0 0 0 0
54162 - 0 0 0 0 0 0 0 0 0 0 0 0
54163 - 0 0 0 0 0 0 0 0 0 6 6 6
54164 - 10 10 10 10 10 10 18 18 18 38 38 38
54165 - 78 78 78 142 134 106 216 158 10 242 186 14
54166 -246 190 14 246 190 14 156 118 10 10 10 10
54167 - 90 90 90 238 238 238 253 253 253 253 253 253
54168 -253 253 253 253 253 253 253 253 253 253 253 253
54169 -253 253 253 253 253 253 231 231 231 250 250 250
54170 -253 253 253 253 253 253 253 253 253 253 253 253
54171 -253 253 253 253 253 253 253 253 253 253 253 253
54172 -253 253 253 253 253 253 253 253 253 253 253 253
54173 -253 253 253 253 253 253 253 253 253 246 230 190
54174 -238 204 91 238 204 91 181 142 44 37 26 9
54175 - 2 2 6 2 2 6 2 2 6 2 2 6
54176 - 2 2 6 2 2 6 38 38 38 46 46 46
54177 - 26 26 26 106 106 106 54 54 54 18 18 18
54178 - 6 6 6 0 0 0 0 0 0 0 0 0
54179 - 0 0 0 0 0 0 0 0 0 0 0 0
54180 - 0 0 0 0 0 0 0 0 0 0 0 0
54181 - 0 0 0 0 0 0 0 0 0 0 0 0
54182 - 0 0 0 0 0 0 0 0 0 0 0 0
54183 - 0 0 0 6 6 6 14 14 14 22 22 22
54184 - 30 30 30 38 38 38 50 50 50 70 70 70
54185 -106 106 106 190 142 34 226 170 11 242 186 14
54186 -246 190 14 246 190 14 246 190 14 154 114 10
54187 - 6 6 6 74 74 74 226 226 226 253 253 253
54188 -253 253 253 253 253 253 253 253 253 253 253 253
54189 -253 253 253 253 253 253 231 231 231 250 250 250
54190 -253 253 253 253 253 253 253 253 253 253 253 253
54191 -253 253 253 253 253 253 253 253 253 253 253 253
54192 -253 253 253 253 253 253 253 253 253 253 253 253
54193 -253 253 253 253 253 253 253 253 253 228 184 62
54194 -241 196 14 241 208 19 232 195 16 38 30 10
54195 - 2 2 6 2 2 6 2 2 6 2 2 6
54196 - 2 2 6 6 6 6 30 30 30 26 26 26
54197 -203 166 17 154 142 90 66 66 66 26 26 26
54198 - 6 6 6 0 0 0 0 0 0 0 0 0
54199 - 0 0 0 0 0 0 0 0 0 0 0 0
54200 - 0 0 0 0 0 0 0 0 0 0 0 0
54201 - 0 0 0 0 0 0 0 0 0 0 0 0
54202 - 0 0 0 0 0 0 0 0 0 0 0 0
54203 - 6 6 6 18 18 18 38 38 38 58 58 58
54204 - 78 78 78 86 86 86 101 101 101 123 123 123
54205 -175 146 61 210 150 10 234 174 13 246 186 14
54206 -246 190 14 246 190 14 246 190 14 238 190 10
54207 -102 78 10 2 2 6 46 46 46 198 198 198
54208 -253 253 253 253 253 253 253 253 253 253 253 253
54209 -253 253 253 253 253 253 234 234 234 242 242 242
54210 -253 253 253 253 253 253 253 253 253 253 253 253
54211 -253 253 253 253 253 253 253 253 253 253 253 253
54212 -253 253 253 253 253 253 253 253 253 253 253 253
54213 -253 253 253 253 253 253 253 253 253 224 178 62
54214 -242 186 14 241 196 14 210 166 10 22 18 6
54215 - 2 2 6 2 2 6 2 2 6 2 2 6
54216 - 2 2 6 2 2 6 6 6 6 121 92 8
54217 -238 202 15 232 195 16 82 82 82 34 34 34
54218 - 10 10 10 0 0 0 0 0 0 0 0 0
54219 - 0 0 0 0 0 0 0 0 0 0 0 0
54220 - 0 0 0 0 0 0 0 0 0 0 0 0
54221 - 0 0 0 0 0 0 0 0 0 0 0 0
54222 - 0 0 0 0 0 0 0 0 0 0 0 0
54223 - 14 14 14 38 38 38 70 70 70 154 122 46
54224 -190 142 34 200 144 11 197 138 11 197 138 11
54225 -213 154 11 226 170 11 242 186 14 246 190 14
54226 -246 190 14 246 190 14 246 190 14 246 190 14
54227 -225 175 15 46 32 6 2 2 6 22 22 22
54228 -158 158 158 250 250 250 253 253 253 253 253 253
54229 -253 253 253 253 253 253 253 253 253 253 253 253
54230 -253 253 253 253 253 253 253 253 253 253 253 253
54231 -253 253 253 253 253 253 253 253 253 253 253 253
54232 -253 253 253 253 253 253 253 253 253 253 253 253
54233 -253 253 253 250 250 250 242 242 242 224 178 62
54234 -239 182 13 236 186 11 213 154 11 46 32 6
54235 - 2 2 6 2 2 6 2 2 6 2 2 6
54236 - 2 2 6 2 2 6 61 42 6 225 175 15
54237 -238 190 10 236 186 11 112 100 78 42 42 42
54238 - 14 14 14 0 0 0 0 0 0 0 0 0
54239 - 0 0 0 0 0 0 0 0 0 0 0 0
54240 - 0 0 0 0 0 0 0 0 0 0 0 0
54241 - 0 0 0 0 0 0 0 0 0 0 0 0
54242 - 0 0 0 0 0 0 0 0 0 6 6 6
54243 - 22 22 22 54 54 54 154 122 46 213 154 11
54244 -226 170 11 230 174 11 226 170 11 226 170 11
54245 -236 178 12 242 186 14 246 190 14 246 190 14
54246 -246 190 14 246 190 14 246 190 14 246 190 14
54247 -241 196 14 184 144 12 10 10 10 2 2 6
54248 - 6 6 6 116 116 116 242 242 242 253 253 253
54249 -253 253 253 253 253 253 253 253 253 253 253 253
54250 -253 253 253 253 253 253 253 253 253 253 253 253
54251 -253 253 253 253 253 253 253 253 253 253 253 253
54252 -253 253 253 253 253 253 253 253 253 253 253 253
54253 -253 253 253 231 231 231 198 198 198 214 170 54
54254 -236 178 12 236 178 12 210 150 10 137 92 6
54255 - 18 14 6 2 2 6 2 2 6 2 2 6
54256 - 6 6 6 70 47 6 200 144 11 236 178 12
54257 -239 182 13 239 182 13 124 112 88 58 58 58
54258 - 22 22 22 6 6 6 0 0 0 0 0 0
54259 - 0 0 0 0 0 0 0 0 0 0 0 0
54260 - 0 0 0 0 0 0 0 0 0 0 0 0
54261 - 0 0 0 0 0 0 0 0 0 0 0 0
54262 - 0 0 0 0 0 0 0 0 0 10 10 10
54263 - 30 30 30 70 70 70 180 133 36 226 170 11
54264 -239 182 13 242 186 14 242 186 14 246 186 14
54265 -246 190 14 246 190 14 246 190 14 246 190 14
54266 -246 190 14 246 190 14 246 190 14 246 190 14
54267 -246 190 14 232 195 16 98 70 6 2 2 6
54268 - 2 2 6 2 2 6 66 66 66 221 221 221
54269 -253 253 253 253 253 253 253 253 253 253 253 253
54270 -253 253 253 253 253 253 253 253 253 253 253 253
54271 -253 253 253 253 253 253 253 253 253 253 253 253
54272 -253 253 253 253 253 253 253 253 253 253 253 253
54273 -253 253 253 206 206 206 198 198 198 214 166 58
54274 -230 174 11 230 174 11 216 158 10 192 133 9
54275 -163 110 8 116 81 8 102 78 10 116 81 8
54276 -167 114 7 197 138 11 226 170 11 239 182 13
54277 -242 186 14 242 186 14 162 146 94 78 78 78
54278 - 34 34 34 14 14 14 6 6 6 0 0 0
54279 - 0 0 0 0 0 0 0 0 0 0 0 0
54280 - 0 0 0 0 0 0 0 0 0 0 0 0
54281 - 0 0 0 0 0 0 0 0 0 0 0 0
54282 - 0 0 0 0 0 0 0 0 0 6 6 6
54283 - 30 30 30 78 78 78 190 142 34 226 170 11
54284 -239 182 13 246 190 14 246 190 14 246 190 14
54285 -246 190 14 246 190 14 246 190 14 246 190 14
54286 -246 190 14 246 190 14 246 190 14 246 190 14
54287 -246 190 14 241 196 14 203 166 17 22 18 6
54288 - 2 2 6 2 2 6 2 2 6 38 38 38
54289 -218 218 218 253 253 253 253 253 253 253 253 253
54290 -253 253 253 253 253 253 253 253 253 253 253 253
54291 -253 253 253 253 253 253 253 253 253 253 253 253
54292 -253 253 253 253 253 253 253 253 253 253 253 253
54293 -250 250 250 206 206 206 198 198 198 202 162 69
54294 -226 170 11 236 178 12 224 166 10 210 150 10
54295 -200 144 11 197 138 11 192 133 9 197 138 11
54296 -210 150 10 226 170 11 242 186 14 246 190 14
54297 -246 190 14 246 186 14 225 175 15 124 112 88
54298 - 62 62 62 30 30 30 14 14 14 6 6 6
54299 - 0 0 0 0 0 0 0 0 0 0 0 0
54300 - 0 0 0 0 0 0 0 0 0 0 0 0
54301 - 0 0 0 0 0 0 0 0 0 0 0 0
54302 - 0 0 0 0 0 0 0 0 0 10 10 10
54303 - 30 30 30 78 78 78 174 135 50 224 166 10
54304 -239 182 13 246 190 14 246 190 14 246 190 14
54305 -246 190 14 246 190 14 246 190 14 246 190 14
54306 -246 190 14 246 190 14 246 190 14 246 190 14
54307 -246 190 14 246 190 14 241 196 14 139 102 15
54308 - 2 2 6 2 2 6 2 2 6 2 2 6
54309 - 78 78 78 250 250 250 253 253 253 253 253 253
54310 -253 253 253 253 253 253 253 253 253 253 253 253
54311 -253 253 253 253 253 253 253 253 253 253 253 253
54312 -253 253 253 253 253 253 253 253 253 253 253 253
54313 -250 250 250 214 214 214 198 198 198 190 150 46
54314 -219 162 10 236 178 12 234 174 13 224 166 10
54315 -216 158 10 213 154 11 213 154 11 216 158 10
54316 -226 170 11 239 182 13 246 190 14 246 190 14
54317 -246 190 14 246 190 14 242 186 14 206 162 42
54318 -101 101 101 58 58 58 30 30 30 14 14 14
54319 - 6 6 6 0 0 0 0 0 0 0 0 0
54320 - 0 0 0 0 0 0 0 0 0 0 0 0
54321 - 0 0 0 0 0 0 0 0 0 0 0 0
54322 - 0 0 0 0 0 0 0 0 0 10 10 10
54323 - 30 30 30 74 74 74 174 135 50 216 158 10
54324 -236 178 12 246 190 14 246 190 14 246 190 14
54325 -246 190 14 246 190 14 246 190 14 246 190 14
54326 -246 190 14 246 190 14 246 190 14 246 190 14
54327 -246 190 14 246 190 14 241 196 14 226 184 13
54328 - 61 42 6 2 2 6 2 2 6 2 2 6
54329 - 22 22 22 238 238 238 253 253 253 253 253 253
54330 -253 253 253 253 253 253 253 253 253 253 253 253
54331 -253 253 253 253 253 253 253 253 253 253 253 253
54332 -253 253 253 253 253 253 253 253 253 253 253 253
54333 -253 253 253 226 226 226 187 187 187 180 133 36
54334 -216 158 10 236 178 12 239 182 13 236 178 12
54335 -230 174 11 226 170 11 226 170 11 230 174 11
54336 -236 178 12 242 186 14 246 190 14 246 190 14
54337 -246 190 14 246 190 14 246 186 14 239 182 13
54338 -206 162 42 106 106 106 66 66 66 34 34 34
54339 - 14 14 14 6 6 6 0 0 0 0 0 0
54340 - 0 0 0 0 0 0 0 0 0 0 0 0
54341 - 0 0 0 0 0 0 0 0 0 0 0 0
54342 - 0 0 0 0 0 0 0 0 0 6 6 6
54343 - 26 26 26 70 70 70 163 133 67 213 154 11
54344 -236 178 12 246 190 14 246 190 14 246 190 14
54345 -246 190 14 246 190 14 246 190 14 246 190 14
54346 -246 190 14 246 190 14 246 190 14 246 190 14
54347 -246 190 14 246 190 14 246 190 14 241 196 14
54348 -190 146 13 18 14 6 2 2 6 2 2 6
54349 - 46 46 46 246 246 246 253 253 253 253 253 253
54350 -253 253 253 253 253 253 253 253 253 253 253 253
54351 -253 253 253 253 253 253 253 253 253 253 253 253
54352 -253 253 253 253 253 253 253 253 253 253 253 253
54353 -253 253 253 221 221 221 86 86 86 156 107 11
54354 -216 158 10 236 178 12 242 186 14 246 186 14
54355 -242 186 14 239 182 13 239 182 13 242 186 14
54356 -242 186 14 246 186 14 246 190 14 246 190 14
54357 -246 190 14 246 190 14 246 190 14 246 190 14
54358 -242 186 14 225 175 15 142 122 72 66 66 66
54359 - 30 30 30 10 10 10 0 0 0 0 0 0
54360 - 0 0 0 0 0 0 0 0 0 0 0 0
54361 - 0 0 0 0 0 0 0 0 0 0 0 0
54362 - 0 0 0 0 0 0 0 0 0 6 6 6
54363 - 26 26 26 70 70 70 163 133 67 210 150 10
54364 -236 178 12 246 190 14 246 190 14 246 190 14
54365 -246 190 14 246 190 14 246 190 14 246 190 14
54366 -246 190 14 246 190 14 246 190 14 246 190 14
54367 -246 190 14 246 190 14 246 190 14 246 190 14
54368 -232 195 16 121 92 8 34 34 34 106 106 106
54369 -221 221 221 253 253 253 253 253 253 253 253 253
54370 -253 253 253 253 253 253 253 253 253 253 253 253
54371 -253 253 253 253 253 253 253 253 253 253 253 253
54372 -253 253 253 253 253 253 253 253 253 253 253 253
54373 -242 242 242 82 82 82 18 14 6 163 110 8
54374 -216 158 10 236 178 12 242 186 14 246 190 14
54375 -246 190 14 246 190 14 246 190 14 246 190 14
54376 -246 190 14 246 190 14 246 190 14 246 190 14
54377 -246 190 14 246 190 14 246 190 14 246 190 14
54378 -246 190 14 246 190 14 242 186 14 163 133 67
54379 - 46 46 46 18 18 18 6 6 6 0 0 0
54380 - 0 0 0 0 0 0 0 0 0 0 0 0
54381 - 0 0 0 0 0 0 0 0 0 0 0 0
54382 - 0 0 0 0 0 0 0 0 0 10 10 10
54383 - 30 30 30 78 78 78 163 133 67 210 150 10
54384 -236 178 12 246 186 14 246 190 14 246 190 14
54385 -246 190 14 246 190 14 246 190 14 246 190 14
54386 -246 190 14 246 190 14 246 190 14 246 190 14
54387 -246 190 14 246 190 14 246 190 14 246 190 14
54388 -241 196 14 215 174 15 190 178 144 253 253 253
54389 -253 253 253 253 253 253 253 253 253 253 253 253
54390 -253 253 253 253 253 253 253 253 253 253 253 253
54391 -253 253 253 253 253 253 253 253 253 253 253 253
54392 -253 253 253 253 253 253 253 253 253 218 218 218
54393 - 58 58 58 2 2 6 22 18 6 167 114 7
54394 -216 158 10 236 178 12 246 186 14 246 190 14
54395 -246 190 14 246 190 14 246 190 14 246 190 14
54396 -246 190 14 246 190 14 246 190 14 246 190 14
54397 -246 190 14 246 190 14 246 190 14 246 190 14
54398 -246 190 14 246 186 14 242 186 14 190 150 46
54399 - 54 54 54 22 22 22 6 6 6 0 0 0
54400 - 0 0 0 0 0 0 0 0 0 0 0 0
54401 - 0 0 0 0 0 0 0 0 0 0 0 0
54402 - 0 0 0 0 0 0 0 0 0 14 14 14
54403 - 38 38 38 86 86 86 180 133 36 213 154 11
54404 -236 178 12 246 186 14 246 190 14 246 190 14
54405 -246 190 14 246 190 14 246 190 14 246 190 14
54406 -246 190 14 246 190 14 246 190 14 246 190 14
54407 -246 190 14 246 190 14 246 190 14 246 190 14
54408 -246 190 14 232 195 16 190 146 13 214 214 214
54409 -253 253 253 253 253 253 253 253 253 253 253 253
54410 -253 253 253 253 253 253 253 253 253 253 253 253
54411 -253 253 253 253 253 253 253 253 253 253 253 253
54412 -253 253 253 250 250 250 170 170 170 26 26 26
54413 - 2 2 6 2 2 6 37 26 9 163 110 8
54414 -219 162 10 239 182 13 246 186 14 246 190 14
54415 -246 190 14 246 190 14 246 190 14 246 190 14
54416 -246 190 14 246 190 14 246 190 14 246 190 14
54417 -246 190 14 246 190 14 246 190 14 246 190 14
54418 -246 186 14 236 178 12 224 166 10 142 122 72
54419 - 46 46 46 18 18 18 6 6 6 0 0 0
54420 - 0 0 0 0 0 0 0 0 0 0 0 0
54421 - 0 0 0 0 0 0 0 0 0 0 0 0
54422 - 0 0 0 0 0 0 6 6 6 18 18 18
54423 - 50 50 50 109 106 95 192 133 9 224 166 10
54424 -242 186 14 246 190 14 246 190 14 246 190 14
54425 -246 190 14 246 190 14 246 190 14 246 190 14
54426 -246 190 14 246 190 14 246 190 14 246 190 14
54427 -246 190 14 246 190 14 246 190 14 246 190 14
54428 -242 186 14 226 184 13 210 162 10 142 110 46
54429 -226 226 226 253 253 253 253 253 253 253 253 253
54430 -253 253 253 253 253 253 253 253 253 253 253 253
54431 -253 253 253 253 253 253 253 253 253 253 253 253
54432 -198 198 198 66 66 66 2 2 6 2 2 6
54433 - 2 2 6 2 2 6 50 34 6 156 107 11
54434 -219 162 10 239 182 13 246 186 14 246 190 14
54435 -246 190 14 246 190 14 246 190 14 246 190 14
54436 -246 190 14 246 190 14 246 190 14 246 190 14
54437 -246 190 14 246 190 14 246 190 14 242 186 14
54438 -234 174 13 213 154 11 154 122 46 66 66 66
54439 - 30 30 30 10 10 10 0 0 0 0 0 0
54440 - 0 0 0 0 0 0 0 0 0 0 0 0
54441 - 0 0 0 0 0 0 0 0 0 0 0 0
54442 - 0 0 0 0 0 0 6 6 6 22 22 22
54443 - 58 58 58 154 121 60 206 145 10 234 174 13
54444 -242 186 14 246 186 14 246 190 14 246 190 14
54445 -246 190 14 246 190 14 246 190 14 246 190 14
54446 -246 190 14 246 190 14 246 190 14 246 190 14
54447 -246 190 14 246 190 14 246 190 14 246 190 14
54448 -246 186 14 236 178 12 210 162 10 163 110 8
54449 - 61 42 6 138 138 138 218 218 218 250 250 250
54450 -253 253 253 253 253 253 253 253 253 250 250 250
54451 -242 242 242 210 210 210 144 144 144 66 66 66
54452 - 6 6 6 2 2 6 2 2 6 2 2 6
54453 - 2 2 6 2 2 6 61 42 6 163 110 8
54454 -216 158 10 236 178 12 246 190 14 246 190 14
54455 -246 190 14 246 190 14 246 190 14 246 190 14
54456 -246 190 14 246 190 14 246 190 14 246 190 14
54457 -246 190 14 239 182 13 230 174 11 216 158 10
54458 -190 142 34 124 112 88 70 70 70 38 38 38
54459 - 18 18 18 6 6 6 0 0 0 0 0 0
54460 - 0 0 0 0 0 0 0 0 0 0 0 0
54461 - 0 0 0 0 0 0 0 0 0 0 0 0
54462 - 0 0 0 0 0 0 6 6 6 22 22 22
54463 - 62 62 62 168 124 44 206 145 10 224 166 10
54464 -236 178 12 239 182 13 242 186 14 242 186 14
54465 -246 186 14 246 190 14 246 190 14 246 190 14
54466 -246 190 14 246 190 14 246 190 14 246 190 14
54467 -246 190 14 246 190 14 246 190 14 246 190 14
54468 -246 190 14 236 178 12 216 158 10 175 118 6
54469 - 80 54 7 2 2 6 6 6 6 30 30 30
54470 - 54 54 54 62 62 62 50 50 50 38 38 38
54471 - 14 14 14 2 2 6 2 2 6 2 2 6
54472 - 2 2 6 2 2 6 2 2 6 2 2 6
54473 - 2 2 6 6 6 6 80 54 7 167 114 7
54474 -213 154 11 236 178 12 246 190 14 246 190 14
54475 -246 190 14 246 190 14 246 190 14 246 190 14
54476 -246 190 14 242 186 14 239 182 13 239 182 13
54477 -230 174 11 210 150 10 174 135 50 124 112 88
54478 - 82 82 82 54 54 54 34 34 34 18 18 18
54479 - 6 6 6 0 0 0 0 0 0 0 0 0
54480 - 0 0 0 0 0 0 0 0 0 0 0 0
54481 - 0 0 0 0 0 0 0 0 0 0 0 0
54482 - 0 0 0 0 0 0 6 6 6 18 18 18
54483 - 50 50 50 158 118 36 192 133 9 200 144 11
54484 -216 158 10 219 162 10 224 166 10 226 170 11
54485 -230 174 11 236 178 12 239 182 13 239 182 13
54486 -242 186 14 246 186 14 246 190 14 246 190 14
54487 -246 190 14 246 190 14 246 190 14 246 190 14
54488 -246 186 14 230 174 11 210 150 10 163 110 8
54489 -104 69 6 10 10 10 2 2 6 2 2 6
54490 - 2 2 6 2 2 6 2 2 6 2 2 6
54491 - 2 2 6 2 2 6 2 2 6 2 2 6
54492 - 2 2 6 2 2 6 2 2 6 2 2 6
54493 - 2 2 6 6 6 6 91 60 6 167 114 7
54494 -206 145 10 230 174 11 242 186 14 246 190 14
54495 -246 190 14 246 190 14 246 186 14 242 186 14
54496 -239 182 13 230 174 11 224 166 10 213 154 11
54497 -180 133 36 124 112 88 86 86 86 58 58 58
54498 - 38 38 38 22 22 22 10 10 10 6 6 6
54499 - 0 0 0 0 0 0 0 0 0 0 0 0
54500 - 0 0 0 0 0 0 0 0 0 0 0 0
54501 - 0 0 0 0 0 0 0 0 0 0 0 0
54502 - 0 0 0 0 0 0 0 0 0 14 14 14
54503 - 34 34 34 70 70 70 138 110 50 158 118 36
54504 -167 114 7 180 123 7 192 133 9 197 138 11
54505 -200 144 11 206 145 10 213 154 11 219 162 10
54506 -224 166 10 230 174 11 239 182 13 242 186 14
54507 -246 186 14 246 186 14 246 186 14 246 186 14
54508 -239 182 13 216 158 10 185 133 11 152 99 6
54509 -104 69 6 18 14 6 2 2 6 2 2 6
54510 - 2 2 6 2 2 6 2 2 6 2 2 6
54511 - 2 2 6 2 2 6 2 2 6 2 2 6
54512 - 2 2 6 2 2 6 2 2 6 2 2 6
54513 - 2 2 6 6 6 6 80 54 7 152 99 6
54514 -192 133 9 219 162 10 236 178 12 239 182 13
54515 -246 186 14 242 186 14 239 182 13 236 178 12
54516 -224 166 10 206 145 10 192 133 9 154 121 60
54517 - 94 94 94 62 62 62 42 42 42 22 22 22
54518 - 14 14 14 6 6 6 0 0 0 0 0 0
54519 - 0 0 0 0 0 0 0 0 0 0 0 0
54520 - 0 0 0 0 0 0 0 0 0 0 0 0
54521 - 0 0 0 0 0 0 0 0 0 0 0 0
54522 - 0 0 0 0 0 0 0 0 0 6 6 6
54523 - 18 18 18 34 34 34 58 58 58 78 78 78
54524 -101 98 89 124 112 88 142 110 46 156 107 11
54525 -163 110 8 167 114 7 175 118 6 180 123 7
54526 -185 133 11 197 138 11 210 150 10 219 162 10
54527 -226 170 11 236 178 12 236 178 12 234 174 13
54528 -219 162 10 197 138 11 163 110 8 130 83 6
54529 - 91 60 6 10 10 10 2 2 6 2 2 6
54530 - 18 18 18 38 38 38 38 38 38 38 38 38
54531 - 38 38 38 38 38 38 38 38 38 38 38 38
54532 - 38 38 38 38 38 38 26 26 26 2 2 6
54533 - 2 2 6 6 6 6 70 47 6 137 92 6
54534 -175 118 6 200 144 11 219 162 10 230 174 11
54535 -234 174 13 230 174 11 219 162 10 210 150 10
54536 -192 133 9 163 110 8 124 112 88 82 82 82
54537 - 50 50 50 30 30 30 14 14 14 6 6 6
54538 - 0 0 0 0 0 0 0 0 0 0 0 0
54539 - 0 0 0 0 0 0 0 0 0 0 0 0
54540 - 0 0 0 0 0 0 0 0 0 0 0 0
54541 - 0 0 0 0 0 0 0 0 0 0 0 0
54542 - 0 0 0 0 0 0 0 0 0 0 0 0
54543 - 6 6 6 14 14 14 22 22 22 34 34 34
54544 - 42 42 42 58 58 58 74 74 74 86 86 86
54545 -101 98 89 122 102 70 130 98 46 121 87 25
54546 -137 92 6 152 99 6 163 110 8 180 123 7
54547 -185 133 11 197 138 11 206 145 10 200 144 11
54548 -180 123 7 156 107 11 130 83 6 104 69 6
54549 - 50 34 6 54 54 54 110 110 110 101 98 89
54550 - 86 86 86 82 82 82 78 78 78 78 78 78
54551 - 78 78 78 78 78 78 78 78 78 78 78 78
54552 - 78 78 78 82 82 82 86 86 86 94 94 94
54553 -106 106 106 101 101 101 86 66 34 124 80 6
54554 -156 107 11 180 123 7 192 133 9 200 144 11
54555 -206 145 10 200 144 11 192 133 9 175 118 6
54556 -139 102 15 109 106 95 70 70 70 42 42 42
54557 - 22 22 22 10 10 10 0 0 0 0 0 0
54558 - 0 0 0 0 0 0 0 0 0 0 0 0
54559 - 0 0 0 0 0 0 0 0 0 0 0 0
54560 - 0 0 0 0 0 0 0 0 0 0 0 0
54561 - 0 0 0 0 0 0 0 0 0 0 0 0
54562 - 0 0 0 0 0 0 0 0 0 0 0 0
54563 - 0 0 0 0 0 0 6 6 6 10 10 10
54564 - 14 14 14 22 22 22 30 30 30 38 38 38
54565 - 50 50 50 62 62 62 74 74 74 90 90 90
54566 -101 98 89 112 100 78 121 87 25 124 80 6
54567 -137 92 6 152 99 6 152 99 6 152 99 6
54568 -138 86 6 124 80 6 98 70 6 86 66 30
54569 -101 98 89 82 82 82 58 58 58 46 46 46
54570 - 38 38 38 34 34 34 34 34 34 34 34 34
54571 - 34 34 34 34 34 34 34 34 34 34 34 34
54572 - 34 34 34 34 34 34 38 38 38 42 42 42
54573 - 54 54 54 82 82 82 94 86 76 91 60 6
54574 -134 86 6 156 107 11 167 114 7 175 118 6
54575 -175 118 6 167 114 7 152 99 6 121 87 25
54576 -101 98 89 62 62 62 34 34 34 18 18 18
54577 - 6 6 6 0 0 0 0 0 0 0 0 0
54578 - 0 0 0 0 0 0 0 0 0 0 0 0
54579 - 0 0 0 0 0 0 0 0 0 0 0 0
54580 - 0 0 0 0 0 0 0 0 0 0 0 0
54581 - 0 0 0 0 0 0 0 0 0 0 0 0
54582 - 0 0 0 0 0 0 0 0 0 0 0 0
54583 - 0 0 0 0 0 0 0 0 0 0 0 0
54584 - 0 0 0 6 6 6 6 6 6 10 10 10
54585 - 18 18 18 22 22 22 30 30 30 42 42 42
54586 - 50 50 50 66 66 66 86 86 86 101 98 89
54587 -106 86 58 98 70 6 104 69 6 104 69 6
54588 -104 69 6 91 60 6 82 62 34 90 90 90
54589 - 62 62 62 38 38 38 22 22 22 14 14 14
54590 - 10 10 10 10 10 10 10 10 10 10 10 10
54591 - 10 10 10 10 10 10 6 6 6 10 10 10
54592 - 10 10 10 10 10 10 10 10 10 14 14 14
54593 - 22 22 22 42 42 42 70 70 70 89 81 66
54594 - 80 54 7 104 69 6 124 80 6 137 92 6
54595 -134 86 6 116 81 8 100 82 52 86 86 86
54596 - 58 58 58 30 30 30 14 14 14 6 6 6
54597 - 0 0 0 0 0 0 0 0 0 0 0 0
54598 - 0 0 0 0 0 0 0 0 0 0 0 0
54599 - 0 0 0 0 0 0 0 0 0 0 0 0
54600 - 0 0 0 0 0 0 0 0 0 0 0 0
54601 - 0 0 0 0 0 0 0 0 0 0 0 0
54602 - 0 0 0 0 0 0 0 0 0 0 0 0
54603 - 0 0 0 0 0 0 0 0 0 0 0 0
54604 - 0 0 0 0 0 0 0 0 0 0 0 0
54605 - 0 0 0 6 6 6 10 10 10 14 14 14
54606 - 18 18 18 26 26 26 38 38 38 54 54 54
54607 - 70 70 70 86 86 86 94 86 76 89 81 66
54608 - 89 81 66 86 86 86 74 74 74 50 50 50
54609 - 30 30 30 14 14 14 6 6 6 0 0 0
54610 - 0 0 0 0 0 0 0 0 0 0 0 0
54611 - 0 0 0 0 0 0 0 0 0 0 0 0
54612 - 0 0 0 0 0 0 0 0 0 0 0 0
54613 - 6 6 6 18 18 18 34 34 34 58 58 58
54614 - 82 82 82 89 81 66 89 81 66 89 81 66
54615 - 94 86 66 94 86 76 74 74 74 50 50 50
54616 - 26 26 26 14 14 14 6 6 6 0 0 0
54617 - 0 0 0 0 0 0 0 0 0 0 0 0
54618 - 0 0 0 0 0 0 0 0 0 0 0 0
54619 - 0 0 0 0 0 0 0 0 0 0 0 0
54620 - 0 0 0 0 0 0 0 0 0 0 0 0
54621 - 0 0 0 0 0 0 0 0 0 0 0 0
54622 - 0 0 0 0 0 0 0 0 0 0 0 0
54623 - 0 0 0 0 0 0 0 0 0 0 0 0
54624 - 0 0 0 0 0 0 0 0 0 0 0 0
54625 - 0 0 0 0 0 0 0 0 0 0 0 0
54626 - 6 6 6 6 6 6 14 14 14 18 18 18
54627 - 30 30 30 38 38 38 46 46 46 54 54 54
54628 - 50 50 50 42 42 42 30 30 30 18 18 18
54629 - 10 10 10 0 0 0 0 0 0 0 0 0
54630 - 0 0 0 0 0 0 0 0 0 0 0 0
54631 - 0 0 0 0 0 0 0 0 0 0 0 0
54632 - 0 0 0 0 0 0 0 0 0 0 0 0
54633 - 0 0 0 6 6 6 14 14 14 26 26 26
54634 - 38 38 38 50 50 50 58 58 58 58 58 58
54635 - 54 54 54 42 42 42 30 30 30 18 18 18
54636 - 10 10 10 0 0 0 0 0 0 0 0 0
54637 - 0 0 0 0 0 0 0 0 0 0 0 0
54638 - 0 0 0 0 0 0 0 0 0 0 0 0
54639 - 0 0 0 0 0 0 0 0 0 0 0 0
54640 - 0 0 0 0 0 0 0 0 0 0 0 0
54641 - 0 0 0 0 0 0 0 0 0 0 0 0
54642 - 0 0 0 0 0 0 0 0 0 0 0 0
54643 - 0 0 0 0 0 0 0 0 0 0 0 0
54644 - 0 0 0 0 0 0 0 0 0 0 0 0
54645 - 0 0 0 0 0 0 0 0 0 0 0 0
54646 - 0 0 0 0 0 0 0 0 0 6 6 6
54647 - 6 6 6 10 10 10 14 14 14 18 18 18
54648 - 18 18 18 14 14 14 10 10 10 6 6 6
54649 - 0 0 0 0 0 0 0 0 0 0 0 0
54650 - 0 0 0 0 0 0 0 0 0 0 0 0
54651 - 0 0 0 0 0 0 0 0 0 0 0 0
54652 - 0 0 0 0 0 0 0 0 0 0 0 0
54653 - 0 0 0 0 0 0 0 0 0 6 6 6
54654 - 14 14 14 18 18 18 22 22 22 22 22 22
54655 - 18 18 18 14 14 14 10 10 10 6 6 6
54656 - 0 0 0 0 0 0 0 0 0 0 0 0
54657 - 0 0 0 0 0 0 0 0 0 0 0 0
54658 - 0 0 0 0 0 0 0 0 0 0 0 0
54659 - 0 0 0 0 0 0 0 0 0 0 0 0
54660 - 0 0 0 0 0 0 0 0 0 0 0 0
54661 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54663 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54664 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54665 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54666 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54667 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54668 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54669 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54670 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54671 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54672 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54673 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54674 +4 4 4 4 4 4
54675 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54677 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54678 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54679 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54680 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54681 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54682 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54683 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54684 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54685 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54686 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54687 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54688 +4 4 4 4 4 4
54689 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54691 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54692 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54693 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54694 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54695 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54696 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54697 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54698 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54699 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54700 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54701 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54702 +4 4 4 4 4 4
54703 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54704 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54705 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54706 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54707 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54708 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54709 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54710 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54711 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54712 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54713 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54714 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54715 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54716 +4 4 4 4 4 4
54717 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54718 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54719 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54720 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54721 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54722 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54723 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54724 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54725 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54727 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54728 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54729 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54730 +4 4 4 4 4 4
54731 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54732 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54733 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54734 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54735 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54736 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54737 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54738 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54739 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54740 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54741 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54742 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54743 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54744 +4 4 4 4 4 4
54745 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54746 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54747 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54748 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54749 +4 4 4 4 4 4 4 4 4 3 3 3 0 0 0 0 0 0
54750 +0 0 0 0 0 0 0 0 0 0 0 0 3 3 3 4 4 4
54751 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54752 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54753 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54754 +4 4 4 4 4 4 4 4 4 4 4 4 1 1 1 0 0 0
54755 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
54756 +4 4 4 4 4 4 4 4 4 2 1 0 2 1 0 3 2 2
54757 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54758 +4 4 4 4 4 4
54759 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54760 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54761 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54762 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54763 +4 4 4 4 4 4 2 2 2 0 0 0 3 4 3 26 28 28
54764 +37 38 37 37 38 37 14 17 19 2 2 2 0 0 0 2 2 2
54765 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54766 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54767 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54768 +4 4 4 4 4 4 3 3 3 0 0 0 1 1 1 6 6 6
54769 +2 2 2 0 0 0 3 3 3 4 4 4 4 4 4 4 4 4
54770 +4 4 5 3 3 3 1 0 0 0 0 0 1 0 0 0 0 0
54771 +1 1 1 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54772 +4 4 4 4 4 4
54773 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54774 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54775 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54776 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54777 +2 2 2 0 0 0 0 0 0 14 17 19 60 74 84 137 136 137
54778 +153 152 153 137 136 137 125 124 125 60 73 81 6 6 6 3 1 0
54779 +0 0 0 3 3 3 4 4 4 4 4 4 4 4 4 4 4 4
54780 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54781 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54782 +4 4 4 4 4 4 0 0 0 4 4 4 41 54 63 125 124 125
54783 +60 73 81 6 6 6 4 0 0 3 3 3 4 4 4 4 4 4
54784 +4 4 4 0 0 0 6 9 11 41 54 63 41 65 82 22 30 35
54785 +2 2 2 2 1 0 4 4 4 4 4 4 4 4 4 4 4 4
54786 +4 4 4 4 4 4
54787 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54788 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54789 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54790 +4 4 4 4 4 4 5 5 5 5 5 5 2 2 2 0 0 0
54791 +4 0 0 6 6 6 41 54 63 137 136 137 174 174 174 167 166 167
54792 +165 164 165 165 164 165 163 162 163 163 162 163 125 124 125 41 54 63
54793 +1 1 1 0 0 0 0 0 0 3 3 3 5 5 5 4 4 4
54794 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54795 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
54796 +3 3 3 2 0 0 4 0 0 60 73 81 156 155 156 167 166 167
54797 +163 162 163 85 115 134 5 7 8 0 0 0 4 4 4 5 5 5
54798 +0 0 0 2 5 5 55 98 126 90 154 193 90 154 193 72 125 159
54799 +37 51 59 2 0 0 1 1 1 4 5 5 4 4 4 4 4 4
54800 +4 4 4 4 4 4
54801 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54802 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54803 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54804 +4 4 4 5 5 5 4 4 4 1 1 1 0 0 0 3 3 3
54805 +37 38 37 125 124 125 163 162 163 174 174 174 158 157 158 158 157 158
54806 +156 155 156 156 155 156 158 157 158 165 164 165 174 174 174 166 165 166
54807 +125 124 125 16 19 21 1 0 0 0 0 0 0 0 0 4 4 4
54808 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
54809 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 1 1 1
54810 +0 0 0 0 0 0 37 38 37 153 152 153 174 174 174 158 157 158
54811 +174 174 174 163 162 163 37 38 37 4 3 3 4 0 0 1 1 1
54812 +0 0 0 22 40 52 101 161 196 101 161 196 90 154 193 101 161 196
54813 +64 123 161 14 17 19 0 0 0 4 4 4 4 4 4 4 4 4
54814 +4 4 4 4 4 4
54815 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54816 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54817 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
54818 +5 5 5 2 2 2 0 0 0 4 0 0 24 26 27 85 115 134
54819 +156 155 156 174 174 174 167 166 167 156 155 156 154 153 154 157 156 157
54820 +156 155 156 156 155 156 155 154 155 153 152 153 158 157 158 167 166 167
54821 +174 174 174 156 155 156 60 74 84 16 19 21 0 0 0 0 0 0
54822 +1 1 1 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
54823 +4 4 4 5 5 5 6 6 6 3 3 3 0 0 0 4 0 0
54824 +13 16 17 60 73 81 137 136 137 165 164 165 156 155 156 153 152 153
54825 +174 174 174 177 184 187 60 73 81 3 1 0 0 0 0 1 1 2
54826 +22 30 35 64 123 161 136 185 209 90 154 193 90 154 193 90 154 193
54827 +90 154 193 21 29 34 0 0 0 3 2 2 4 4 5 4 4 4
54828 +4 4 4 4 4 4
54829 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54830 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54831 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 3 3 3
54832 +0 0 0 0 0 0 10 13 16 60 74 84 157 156 157 174 174 174
54833 +174 174 174 158 157 158 153 152 153 154 153 154 156 155 156 155 154 155
54834 +156 155 156 155 154 155 154 153 154 157 156 157 154 153 154 153 152 153
54835 +163 162 163 174 174 174 177 184 187 137 136 137 60 73 81 13 16 17
54836 +4 0 0 0 0 0 3 3 3 5 5 5 4 4 4 4 4 4
54837 +5 5 5 4 4 4 1 1 1 0 0 0 3 3 3 41 54 63
54838 +131 129 131 174 174 174 174 174 174 174 174 174 167 166 167 174 174 174
54839 +190 197 201 137 136 137 24 26 27 4 0 0 16 21 25 50 82 103
54840 +90 154 193 136 185 209 90 154 193 101 161 196 101 161 196 101 161 196
54841 +31 91 132 3 6 7 0 0 0 4 4 4 4 4 4 4 4 4
54842 +4 4 4 4 4 4
54843 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54844 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54845 +4 4 4 4 4 4 4 4 4 2 2 2 0 0 0 4 0 0
54846 +4 0 0 43 57 68 137 136 137 177 184 187 174 174 174 163 162 163
54847 +155 154 155 155 154 155 156 155 156 155 154 155 158 157 158 165 164 165
54848 +167 166 167 166 165 166 163 162 163 157 156 157 155 154 155 155 154 155
54849 +153 152 153 156 155 156 167 166 167 174 174 174 174 174 174 131 129 131
54850 +41 54 63 5 5 5 0 0 0 0 0 0 3 3 3 4 4 4
54851 +1 1 1 0 0 0 1 0 0 26 28 28 125 124 125 174 174 174
54852 +177 184 187 174 174 174 174 174 174 156 155 156 131 129 131 137 136 137
54853 +125 124 125 24 26 27 4 0 0 41 65 82 90 154 193 136 185 209
54854 +136 185 209 101 161 196 53 118 160 37 112 160 90 154 193 34 86 122
54855 +7 12 15 0 0 0 4 4 4 4 4 4 4 4 4 4 4 4
54856 +4 4 4 4 4 4
54857 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54858 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54859 +4 4 4 3 3 3 0 0 0 0 0 0 5 5 5 37 38 37
54860 +125 124 125 167 166 167 174 174 174 167 166 167 158 157 158 155 154 155
54861 +156 155 156 156 155 156 156 155 156 163 162 163 167 166 167 155 154 155
54862 +137 136 137 153 152 153 156 155 156 165 164 165 163 162 163 156 155 156
54863 +156 155 156 156 155 156 155 154 155 158 157 158 166 165 166 174 174 174
54864 +167 166 167 125 124 125 37 38 37 1 0 0 0 0 0 0 0 0
54865 +0 0 0 24 26 27 60 74 84 158 157 158 174 174 174 174 174 174
54866 +166 165 166 158 157 158 125 124 125 41 54 63 13 16 17 6 6 6
54867 +6 6 6 37 38 37 80 127 157 136 185 209 101 161 196 101 161 196
54868 +90 154 193 28 67 93 6 10 14 13 20 25 13 20 25 6 10 14
54869 +1 1 2 4 3 3 4 4 4 4 4 4 4 4 4 4 4 4
54870 +4 4 4 4 4 4
54871 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54872 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54873 +1 1 1 1 0 0 4 3 3 37 38 37 60 74 84 153 152 153
54874 +167 166 167 167 166 167 158 157 158 154 153 154 155 154 155 156 155 156
54875 +157 156 157 158 157 158 167 166 167 167 166 167 131 129 131 43 57 68
54876 +26 28 28 37 38 37 60 73 81 131 129 131 165 164 165 166 165 166
54877 +158 157 158 155 154 155 156 155 156 156 155 156 156 155 156 158 157 158
54878 +165 164 165 174 174 174 163 162 163 60 74 84 16 19 21 13 16 17
54879 +60 73 81 131 129 131 174 174 174 174 174 174 167 166 167 165 164 165
54880 +137 136 137 60 73 81 24 26 27 4 0 0 4 0 0 16 19 21
54881 +52 104 138 101 161 196 136 185 209 136 185 209 90 154 193 27 99 146
54882 +13 20 25 4 5 7 2 5 5 4 5 7 1 1 2 0 0 0
54883 +4 4 4 4 4 4 3 3 3 2 2 2 2 2 2 4 4 4
54884 +4 4 4 4 4 4
54885 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54886 +4 4 4 4 4 4 4 4 4 4 4 4 3 3 3 0 0 0
54887 +0 0 0 13 16 17 60 73 81 137 136 137 174 174 174 166 165 166
54888 +158 157 158 156 155 156 157 156 157 156 155 156 155 154 155 158 157 158
54889 +167 166 167 174 174 174 153 152 153 60 73 81 16 19 21 4 0 0
54890 +4 0 0 4 0 0 6 6 6 26 28 28 60 74 84 158 157 158
54891 +174 174 174 166 165 166 157 156 157 155 154 155 156 155 156 156 155 156
54892 +155 154 155 158 157 158 167 166 167 167 166 167 131 129 131 125 124 125
54893 +137 136 137 167 166 167 167 166 167 174 174 174 158 157 158 125 124 125
54894 +16 19 21 4 0 0 4 0 0 10 13 16 49 76 92 107 159 188
54895 +136 185 209 136 185 209 90 154 193 26 108 161 22 40 52 6 10 14
54896 +2 3 3 1 1 2 1 1 2 4 4 5 4 4 5 4 4 5
54897 +4 4 5 2 2 1 0 0 0 0 0 0 0 0 0 2 2 2
54898 +4 4 4 4 4 4
54899 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
54900 +4 4 4 5 5 5 3 3 3 0 0 0 1 0 0 4 0 0
54901 +37 51 59 131 129 131 167 166 167 167 166 167 163 162 163 157 156 157
54902 +157 156 157 155 154 155 153 152 153 157 156 157 167 166 167 174 174 174
54903 +153 152 153 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
54904 +4 3 3 4 3 3 4 0 0 6 6 6 4 0 0 37 38 37
54905 +125 124 125 174 174 174 174 174 174 165 164 165 156 155 156 154 153 154
54906 +156 155 156 156 155 156 155 154 155 163 162 163 158 157 158 163 162 163
54907 +174 174 174 174 174 174 174 174 174 125 124 125 37 38 37 0 0 0
54908 +4 0 0 6 9 11 41 54 63 90 154 193 136 185 209 146 190 211
54909 +136 185 209 37 112 160 22 40 52 6 10 14 3 6 7 1 1 2
54910 +1 1 2 3 3 3 1 1 2 3 3 3 4 4 4 4 4 4
54911 +2 2 2 2 0 0 16 19 21 37 38 37 24 26 27 0 0 0
54912 +0 0 0 4 4 4
54913 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 5 5 5
54914 +4 4 4 0 0 0 0 0 0 0 0 0 26 28 28 120 125 127
54915 +158 157 158 174 174 174 165 164 165 157 156 157 155 154 155 156 155 156
54916 +153 152 153 153 152 153 167 166 167 174 174 174 174 174 174 125 124 125
54917 +37 38 37 4 0 0 0 0 0 4 0 0 4 3 3 4 4 4
54918 +4 4 4 4 4 4 5 5 5 4 0 0 4 0 0 4 0 0
54919 +4 3 3 43 57 68 137 136 137 174 174 174 174 174 174 165 164 165
54920 +154 153 154 153 152 153 153 152 153 153 152 153 163 162 163 174 174 174
54921 +174 174 174 153 152 153 60 73 81 6 6 6 4 0 0 4 3 3
54922 +32 43 50 80 127 157 136 185 209 146 190 211 146 190 211 90 154 193
54923 +28 67 93 28 67 93 40 71 93 3 6 7 1 1 2 2 5 5
54924 +50 82 103 79 117 143 26 37 45 0 0 0 3 3 3 1 1 1
54925 +0 0 0 41 54 63 137 136 137 174 174 174 153 152 153 60 73 81
54926 +2 0 0 0 0 0
54927 +4 4 4 4 4 4 4 4 4 4 4 4 6 6 6 2 2 2
54928 +0 0 0 2 0 0 24 26 27 60 74 84 153 152 153 174 174 174
54929 +174 174 174 157 156 157 154 153 154 156 155 156 154 153 154 153 152 153
54930 +165 164 165 174 174 174 177 184 187 137 136 137 43 57 68 6 6 6
54931 +4 0 0 2 0 0 3 3 3 5 5 5 5 5 5 4 4 4
54932 +4 4 4 4 4 4 4 4 4 5 5 5 6 6 6 4 3 3
54933 +4 0 0 4 0 0 24 26 27 60 73 81 153 152 153 174 174 174
54934 +174 174 174 158 157 158 158 157 158 174 174 174 174 174 174 158 157 158
54935 +60 74 84 24 26 27 4 0 0 4 0 0 17 23 27 59 113 148
54936 +136 185 209 191 222 234 146 190 211 136 185 209 31 91 132 7 11 13
54937 +22 40 52 101 161 196 90 154 193 6 9 11 3 4 4 43 95 132
54938 +136 185 209 172 205 220 55 98 126 0 0 0 0 0 0 2 0 0
54939 +26 28 28 153 152 153 177 184 187 167 166 167 177 184 187 165 164 165
54940 +37 38 37 0 0 0
54941 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
54942 +13 16 17 60 73 81 137 136 137 174 174 174 174 174 174 165 164 165
54943 +153 152 153 153 152 153 155 154 155 154 153 154 158 157 158 174 174 174
54944 +177 184 187 163 162 163 60 73 81 16 19 21 4 0 0 4 0 0
54945 +4 3 3 4 4 4 5 5 5 5 5 5 4 4 4 5 5 5
54946 +5 5 5 5 5 5 5 5 5 4 4 4 4 4 4 5 5 5
54947 +6 6 6 4 0 0 4 0 0 4 0 0 24 26 27 60 74 84
54948 +166 165 166 174 174 174 177 184 187 165 164 165 125 124 125 24 26 27
54949 +4 0 0 4 0 0 5 5 5 50 82 103 136 185 209 172 205 220
54950 +146 190 211 136 185 209 26 108 161 22 40 52 7 12 15 44 81 103
54951 +71 116 144 28 67 93 37 51 59 41 65 82 100 139 164 101 161 196
54952 +90 154 193 90 154 193 28 67 93 0 0 0 0 0 0 26 28 28
54953 +125 124 125 167 166 167 163 162 163 153 152 153 163 162 163 174 174 174
54954 +85 115 134 4 0 0
54955 +4 4 4 5 5 5 4 4 4 1 0 0 4 0 0 34 47 55
54956 +125 124 125 174 174 174 174 174 174 167 166 167 157 156 157 153 152 153
54957 +155 154 155 155 154 155 158 157 158 166 165 166 167 166 167 154 153 154
54958 +125 124 125 26 28 28 4 0 0 4 0 0 4 0 0 5 5 5
54959 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 1 1 1
54960 +0 0 0 0 0 0 1 1 1 4 4 4 4 4 4 4 4 4
54961 +5 5 5 5 5 5 4 3 3 4 0 0 4 0 0 6 6 6
54962 +37 38 37 131 129 131 137 136 137 37 38 37 0 0 0 4 0 0
54963 +4 5 5 43 61 72 90 154 193 172 205 220 146 190 211 136 185 209
54964 +90 154 193 28 67 93 13 20 25 43 61 72 71 116 144 44 81 103
54965 +2 5 5 7 11 13 59 113 148 101 161 196 90 154 193 28 67 93
54966 +13 20 25 6 10 14 0 0 0 13 16 17 60 73 81 137 136 137
54967 +166 165 166 158 157 158 156 155 156 154 153 154 167 166 167 174 174 174
54968 +60 73 81 4 0 0
54969 +4 4 4 4 4 4 0 0 0 3 3 3 60 74 84 174 174 174
54970 +174 174 174 167 166 167 163 162 163 155 154 155 157 156 157 155 154 155
54971 +156 155 156 163 162 163 167 166 167 158 157 158 125 124 125 37 38 37
54972 +4 3 3 4 0 0 4 0 0 6 6 6 6 6 6 5 5 5
54973 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 2 3 3
54974 +10 13 16 7 11 13 1 0 0 0 0 0 2 2 1 4 4 4
54975 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 4 0 0
54976 +4 0 0 7 11 13 13 16 17 4 0 0 3 3 3 34 47 55
54977 +80 127 157 146 190 211 172 205 220 136 185 209 136 185 209 136 185 209
54978 +28 67 93 22 40 52 55 98 126 55 98 126 21 29 34 7 11 13
54979 +50 82 103 101 161 196 101 161 196 35 83 115 13 20 25 2 2 1
54980 +1 1 2 1 1 2 37 51 59 131 129 131 174 174 174 174 174 174
54981 +167 166 167 163 162 163 163 162 163 167 166 167 174 174 174 125 124 125
54982 +16 19 21 4 0 0
54983 +4 4 4 4 0 0 4 0 0 60 74 84 174 174 174 174 174 174
54984 +158 157 158 155 154 155 155 154 155 156 155 156 155 154 155 158 157 158
54985 +167 166 167 165 164 165 131 129 131 60 73 81 13 16 17 4 0 0
54986 +4 0 0 4 3 3 6 6 6 4 3 3 5 5 5 4 4 4
54987 +4 4 4 3 2 2 0 0 0 0 0 0 7 11 13 45 69 86
54988 +80 127 157 71 116 144 43 61 72 7 11 13 0 0 0 1 1 1
54989 +4 3 3 4 4 4 4 4 4 4 4 4 6 6 6 5 5 5
54990 +3 2 2 4 0 0 1 0 0 21 29 34 59 113 148 136 185 209
54991 +146 190 211 136 185 209 136 185 209 136 185 209 136 185 209 136 185 209
54992 +68 124 159 44 81 103 22 40 52 13 16 17 43 61 72 90 154 193
54993 +136 185 209 59 113 148 21 29 34 3 4 3 1 1 1 0 0 0
54994 +24 26 27 125 124 125 163 162 163 174 174 174 166 165 166 165 164 165
54995 +163 162 163 125 124 125 125 124 125 125 124 125 125 124 125 26 28 28
54996 +4 0 0 4 3 3
54997 +3 3 3 0 0 0 24 26 27 153 152 153 177 184 187 158 157 158
54998 +156 155 156 156 155 156 155 154 155 155 154 155 165 164 165 174 174 174
54999 +155 154 155 60 74 84 26 28 28 4 0 0 4 0 0 3 1 0
55000 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 3 3
55001 +2 0 0 0 0 0 0 0 0 32 43 50 72 125 159 101 161 196
55002 +136 185 209 101 161 196 101 161 196 79 117 143 32 43 50 0 0 0
55003 +0 0 0 2 2 2 4 4 4 4 4 4 3 3 3 1 0 0
55004 +0 0 0 4 5 5 49 76 92 101 161 196 146 190 211 146 190 211
55005 +136 185 209 136 185 209 136 185 209 136 185 209 136 185 209 90 154 193
55006 +28 67 93 13 16 17 37 51 59 80 127 157 136 185 209 90 154 193
55007 +22 40 52 6 9 11 3 4 3 2 2 1 16 19 21 60 73 81
55008 +137 136 137 163 162 163 158 157 158 166 165 166 167 166 167 153 152 153
55009 +60 74 84 37 38 37 6 6 6 13 16 17 4 0 0 1 0 0
55010 +3 2 2 4 4 4
55011 +3 2 2 4 0 0 37 38 37 137 136 137 167 166 167 158 157 158
55012 +157 156 157 154 153 154 157 156 157 167 166 167 174 174 174 125 124 125
55013 +37 38 37 4 0 0 4 0 0 4 0 0 4 3 3 4 4 4
55014 +4 4 4 4 4 4 5 5 5 5 5 5 1 1 1 0 0 0
55015 +0 0 0 16 21 25 55 98 126 90 154 193 136 185 209 101 161 196
55016 +101 161 196 101 161 196 136 185 209 136 185 209 101 161 196 55 98 126
55017 +14 17 19 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
55018 +22 40 52 90 154 193 146 190 211 146 190 211 136 185 209 136 185 209
55019 +136 185 209 136 185 209 136 185 209 101 161 196 35 83 115 7 11 13
55020 +17 23 27 59 113 148 136 185 209 101 161 196 34 86 122 7 12 15
55021 +2 5 5 3 4 3 6 6 6 60 73 81 131 129 131 163 162 163
55022 +166 165 166 174 174 174 174 174 174 163 162 163 125 124 125 41 54 63
55023 +13 16 17 4 0 0 4 0 0 4 0 0 1 0 0 2 2 2
55024 +4 4 4 4 4 4
55025 +1 1 1 2 1 0 43 57 68 137 136 137 153 152 153 153 152 153
55026 +163 162 163 156 155 156 165 164 165 167 166 167 60 74 84 6 6 6
55027 +4 0 0 4 0 0 5 5 5 4 4 4 4 4 4 4 4 4
55028 +4 5 5 6 6 6 4 3 3 0 0 0 0 0 0 11 15 18
55029 +40 71 93 100 139 164 101 161 196 101 161 196 101 161 196 101 161 196
55030 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 136 185 209
55031 +101 161 196 45 69 86 6 6 6 0 0 0 17 23 27 55 98 126
55032 +136 185 209 146 190 211 136 185 209 136 185 209 136 185 209 136 185 209
55033 +136 185 209 136 185 209 90 154 193 22 40 52 7 11 13 50 82 103
55034 +136 185 209 136 185 209 53 118 160 22 40 52 7 11 13 2 5 5
55035 +3 4 3 37 38 37 125 124 125 157 156 157 166 165 166 167 166 167
55036 +174 174 174 174 174 174 137 136 137 60 73 81 4 0 0 4 0 0
55037 +4 0 0 4 0 0 5 5 5 3 3 3 3 3 3 4 4 4
55038 +4 4 4 4 4 4
55039 +4 0 0 4 0 0 41 54 63 137 136 137 125 124 125 131 129 131
55040 +155 154 155 167 166 167 174 174 174 60 74 84 6 6 6 4 0 0
55041 +4 3 3 6 6 6 4 4 4 4 4 4 4 4 4 5 5 5
55042 +4 4 4 1 1 1 0 0 0 3 6 7 41 65 82 72 125 159
55043 +101 161 196 101 161 196 101 161 196 90 154 193 90 154 193 101 161 196
55044 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
55045 +136 185 209 136 185 209 80 127 157 55 98 126 101 161 196 146 190 211
55046 +136 185 209 136 185 209 136 185 209 101 161 196 136 185 209 101 161 196
55047 +136 185 209 101 161 196 35 83 115 22 30 35 101 161 196 172 205 220
55048 +90 154 193 28 67 93 7 11 13 2 5 5 3 4 3 13 16 17
55049 +85 115 134 167 166 167 174 174 174 174 174 174 174 174 174 174 174 174
55050 +167 166 167 60 74 84 13 16 17 4 0 0 4 0 0 4 3 3
55051 +6 6 6 5 5 5 4 4 4 5 5 5 4 4 4 5 5 5
55052 +5 5 5 5 5 5
55053 +1 1 1 4 0 0 41 54 63 137 136 137 137 136 137 125 124 125
55054 +131 129 131 167 166 167 157 156 157 37 38 37 6 6 6 4 0 0
55055 +6 6 6 5 5 5 4 4 4 4 4 4 4 5 5 2 2 1
55056 +0 0 0 0 0 0 26 37 45 58 111 146 101 161 196 101 161 196
55057 +101 161 196 90 154 193 90 154 193 90 154 193 101 161 196 101 161 196
55058 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
55059 +101 161 196 136 185 209 136 185 209 136 185 209 146 190 211 136 185 209
55060 +136 185 209 101 161 196 136 185 209 136 185 209 101 161 196 136 185 209
55061 +101 161 196 136 185 209 136 185 209 136 185 209 136 185 209 16 89 141
55062 +7 11 13 2 5 5 2 5 5 13 16 17 60 73 81 154 154 154
55063 +174 174 174 174 174 174 174 174 174 174 174 174 163 162 163 125 124 125
55064 +24 26 27 4 0 0 4 0 0 4 0 0 5 5 5 5 5 5
55065 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
55066 +5 5 5 4 4 4
55067 +4 0 0 6 6 6 37 38 37 137 136 137 137 136 137 131 129 131
55068 +131 129 131 153 152 153 131 129 131 26 28 28 4 0 0 4 3 3
55069 +6 6 6 4 4 4 4 4 4 4 4 4 0 0 0 0 0 0
55070 +13 20 25 51 88 114 90 154 193 101 161 196 101 161 196 90 154 193
55071 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
55072 +101 161 196 101 161 196 101 161 196 101 161 196 136 185 209 101 161 196
55073 +101 161 196 136 185 209 101 161 196 136 185 209 136 185 209 101 161 196
55074 +136 185 209 101 161 196 136 185 209 101 161 196 101 161 196 101 161 196
55075 +136 185 209 136 185 209 136 185 209 37 112 160 21 29 34 5 7 8
55076 +2 5 5 13 16 17 43 57 68 131 129 131 174 174 174 174 174 174
55077 +174 174 174 167 166 167 157 156 157 125 124 125 37 38 37 4 0 0
55078 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
55079 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55080 +4 4 4 4 4 4
55081 +1 1 1 4 0 0 41 54 63 153 152 153 137 136 137 137 136 137
55082 +137 136 137 153 152 153 125 124 125 24 26 27 4 0 0 3 2 2
55083 +4 4 4 4 4 4 4 3 3 4 0 0 3 6 7 43 61 72
55084 +64 123 161 101 161 196 90 154 193 90 154 193 90 154 193 90 154 193
55085 +90 154 193 90 154 193 90 154 193 90 154 193 101 161 196 90 154 193
55086 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
55087 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
55088 +136 185 209 101 161 196 101 161 196 136 185 209 136 185 209 101 161 196
55089 +101 161 196 90 154 193 28 67 93 13 16 17 7 11 13 3 6 7
55090 +37 51 59 125 124 125 163 162 163 174 174 174 167 166 167 166 165 166
55091 +167 166 167 131 129 131 60 73 81 4 0 0 4 0 0 4 0 0
55092 +3 3 3 5 5 5 6 6 6 4 4 4 4 4 4 4 4 4
55093 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55094 +4 4 4 4 4 4
55095 +4 0 0 4 0 0 41 54 63 137 136 137 153 152 153 137 136 137
55096 +153 152 153 157 156 157 125 124 125 24 26 27 0 0 0 2 2 2
55097 +4 4 4 4 4 4 2 0 0 0 0 0 28 67 93 90 154 193
55098 +90 154 193 90 154 193 90 154 193 90 154 193 64 123 161 90 154 193
55099 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
55100 +90 154 193 101 161 196 101 161 196 101 161 196 90 154 193 136 185 209
55101 +101 161 196 101 161 196 136 185 209 101 161 196 136 185 209 101 161 196
55102 +101 161 196 101 161 196 136 185 209 101 161 196 101 161 196 90 154 193
55103 +35 83 115 13 16 17 3 6 7 2 5 5 13 16 17 60 74 84
55104 +154 154 154 166 165 166 165 164 165 158 157 158 163 162 163 157 156 157
55105 +60 74 84 13 16 17 4 0 0 4 0 0 3 2 2 4 4 4
55106 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55107 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55108 +4 4 4 4 4 4
55109 +1 1 1 4 0 0 41 54 63 157 156 157 155 154 155 137 136 137
55110 +153 152 153 158 157 158 137 136 137 26 28 28 2 0 0 2 2 2
55111 +4 4 4 4 4 4 1 0 0 6 10 14 34 86 122 90 154 193
55112 +64 123 161 90 154 193 64 123 161 90 154 193 90 154 193 90 154 193
55113 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
55114 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
55115 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 101 161 196
55116 +136 185 209 101 161 196 136 185 209 90 154 193 26 108 161 22 40 52
55117 +13 16 17 5 7 8 2 5 5 2 5 5 37 38 37 165 164 165
55118 +174 174 174 163 162 163 154 154 154 165 164 165 167 166 167 60 73 81
55119 +6 6 6 4 0 0 4 0 0 4 4 4 4 4 4 4 4 4
55120 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55121 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55122 +4 4 4 4 4 4
55123 +4 0 0 6 6 6 41 54 63 156 155 156 158 157 158 153 152 153
55124 +156 155 156 165 164 165 137 136 137 26 28 28 0 0 0 2 2 2
55125 +4 4 5 4 4 4 2 0 0 7 12 15 31 96 139 64 123 161
55126 +90 154 193 64 123 161 90 154 193 90 154 193 64 123 161 90 154 193
55127 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
55128 +90 154 193 90 154 193 90 154 193 101 161 196 101 161 196 101 161 196
55129 +101 161 196 101 161 196 101 161 196 101 161 196 101 161 196 136 185 209
55130 +101 161 196 136 185 209 26 108 161 22 40 52 7 11 13 5 7 8
55131 +2 5 5 2 5 5 2 5 5 2 2 1 37 38 37 158 157 158
55132 +174 174 174 154 154 154 156 155 156 167 166 167 165 164 165 37 38 37
55133 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55134 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55135 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55136 +4 4 4 4 4 4
55137 +3 1 0 4 0 0 60 73 81 157 156 157 163 162 163 153 152 153
55138 +158 157 158 167 166 167 137 136 137 26 28 28 2 0 0 2 2 2
55139 +4 5 5 4 4 4 4 0 0 7 12 15 24 86 132 26 108 161
55140 +37 112 160 64 123 161 90 154 193 64 123 161 90 154 193 90 154 193
55141 +90 154 193 90 154 193 90 154 193 90 154 193 90 154 193 90 154 193
55142 +90 154 193 101 161 196 90 154 193 101 161 196 101 161 196 101 161 196
55143 +101 161 196 101 161 196 101 161 196 136 185 209 101 161 196 136 185 209
55144 +90 154 193 35 83 115 13 16 17 13 16 17 7 11 13 3 6 7
55145 +5 7 8 6 6 6 3 4 3 2 2 1 30 32 34 154 154 154
55146 +167 166 167 154 154 154 154 154 154 174 174 174 165 164 165 37 38 37
55147 +6 6 6 4 0 0 6 6 6 4 4 4 4 4 4 4 4 4
55148 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55149 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55150 +4 4 4 4 4 4
55151 +4 0 0 4 0 0 41 54 63 163 162 163 166 165 166 154 154 154
55152 +163 162 163 174 174 174 137 136 137 26 28 28 0 0 0 2 2 2
55153 +4 5 5 4 4 5 1 1 2 6 10 14 28 67 93 18 97 151
55154 +18 97 151 18 97 151 26 108 161 37 112 160 37 112 160 90 154 193
55155 +64 123 161 90 154 193 90 154 193 90 154 193 90 154 193 101 161 196
55156 +90 154 193 101 161 196 101 161 196 90 154 193 101 161 196 101 161 196
55157 +101 161 196 101 161 196 101 161 196 136 185 209 90 154 193 16 89 141
55158 +13 20 25 7 11 13 5 7 8 5 7 8 2 5 5 4 5 5
55159 +3 4 3 4 5 5 3 4 3 0 0 0 37 38 37 158 157 158
55160 +174 174 174 158 157 158 158 157 158 167 166 167 174 174 174 41 54 63
55161 +4 0 0 3 2 2 5 5 5 4 4 4 4 4 4 4 4 4
55162 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55163 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55164 +4 4 4 4 4 4
55165 +1 1 1 4 0 0 60 73 81 165 164 165 174 174 174 158 157 158
55166 +167 166 167 174 174 174 153 152 153 26 28 28 2 0 0 2 2 2
55167 +4 5 5 4 4 4 4 0 0 7 12 15 10 87 144 10 87 144
55168 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
55169 +26 108 161 37 112 160 53 118 160 90 154 193 90 154 193 90 154 193
55170 +90 154 193 90 154 193 101 161 196 101 161 196 101 161 196 101 161 196
55171 +101 161 196 136 185 209 90 154 193 26 108 161 22 40 52 13 16 17
55172 +7 11 13 3 6 7 5 7 8 5 7 8 2 5 5 4 5 5
55173 +4 5 5 6 6 6 3 4 3 0 0 0 30 32 34 158 157 158
55174 +174 174 174 156 155 156 155 154 155 165 164 165 154 153 154 37 38 37
55175 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55176 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55177 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55178 +4 4 4 4 4 4
55179 +4 0 0 4 0 0 60 73 81 167 166 167 174 174 174 163 162 163
55180 +174 174 174 174 174 174 153 152 153 26 28 28 0 0 0 3 3 3
55181 +5 5 5 4 4 4 1 1 2 7 12 15 28 67 93 18 97 151
55182 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
55183 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55184 +90 154 193 26 108 161 90 154 193 90 154 193 90 154 193 101 161 196
55185 +101 161 196 26 108 161 22 40 52 13 16 17 7 11 13 2 5 5
55186 +2 5 5 6 6 6 2 5 5 4 5 5 4 5 5 4 5 5
55187 +3 4 3 5 5 5 3 4 3 2 0 0 30 32 34 137 136 137
55188 +153 152 153 137 136 137 131 129 131 137 136 137 131 129 131 37 38 37
55189 +4 0 0 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55190 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55191 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55192 +4 4 4 4 4 4
55193 +1 1 1 4 0 0 60 73 81 167 166 167 174 174 174 166 165 166
55194 +174 174 174 177 184 187 153 152 153 30 32 34 1 0 0 3 3 3
55195 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
55196 +18 97 151 18 97 151 18 97 151 26 108 161 26 108 161 26 108 161
55197 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55198 +26 108 161 26 108 161 26 108 161 90 154 193 90 154 193 26 108 161
55199 +35 83 115 13 16 17 7 11 13 5 7 8 3 6 7 5 7 8
55200 +2 5 5 6 6 6 4 5 5 4 5 5 3 4 3 4 5 5
55201 +3 4 3 6 6 6 3 4 3 0 0 0 26 28 28 125 124 125
55202 +131 129 131 125 124 125 125 124 125 131 129 131 131 129 131 37 38 37
55203 +4 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55204 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55205 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55206 +4 4 4 4 4 4
55207 +3 1 0 4 0 0 60 73 81 174 174 174 177 184 187 167 166 167
55208 +174 174 174 177 184 187 153 152 153 30 32 34 0 0 0 3 3 3
55209 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
55210 +18 97 151 18 97 151 18 97 151 18 97 151 18 97 151 26 108 161
55211 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55212 +26 108 161 90 154 193 26 108 161 26 108 161 24 86 132 13 20 25
55213 +7 11 13 13 20 25 22 40 52 5 7 8 3 4 3 3 4 3
55214 +4 5 5 3 4 3 4 5 5 3 4 3 4 5 5 3 4 3
55215 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
55216 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55217 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55218 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55219 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55220 +4 4 4 4 4 4
55221 +1 1 1 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
55222 +174 174 174 190 197 201 157 156 157 30 32 34 1 0 0 3 3 3
55223 +5 5 5 4 3 3 4 0 0 7 12 15 10 87 144 10 87 144
55224 +18 97 151 19 95 150 19 95 150 18 97 151 18 97 151 26 108 161
55225 +18 97 151 26 108 161 26 108 161 26 108 161 26 108 161 90 154 193
55226 +26 108 161 26 108 161 26 108 161 22 40 52 2 5 5 3 4 3
55227 +28 67 93 37 112 160 34 86 122 2 5 5 3 4 3 3 4 3
55228 +3 4 3 3 4 3 3 4 3 2 2 1 3 4 3 4 4 4
55229 +4 5 5 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
55230 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55231 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55232 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55233 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55234 +4 4 4 4 4 4
55235 +4 0 0 4 0 0 60 73 81 174 174 174 177 184 187 174 174 174
55236 +174 174 174 190 197 201 158 157 158 30 32 34 0 0 0 2 2 2
55237 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 18 97 151
55238 +10 87 144 19 95 150 19 95 150 18 97 151 18 97 151 18 97 151
55239 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55240 +18 97 151 22 40 52 2 5 5 2 2 1 22 40 52 26 108 161
55241 +90 154 193 37 112 160 22 40 52 3 4 3 13 20 25 22 30 35
55242 +3 6 7 1 1 1 2 2 2 6 9 11 5 5 5 4 3 3
55243 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
55244 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55245 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55246 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55247 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55248 +4 4 4 4 4 4
55249 +1 1 1 4 0 0 60 73 81 177 184 187 193 200 203 174 174 174
55250 +177 184 187 193 200 203 163 162 163 30 32 34 4 0 0 2 2 2
55251 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
55252 +10 87 144 10 87 144 19 95 150 19 95 150 19 95 150 18 97 151
55253 +26 108 161 26 108 161 26 108 161 90 154 193 26 108 161 28 67 93
55254 +6 10 14 2 5 5 13 20 25 24 86 132 37 112 160 90 154 193
55255 +10 87 144 7 12 15 2 5 5 28 67 93 37 112 160 28 67 93
55256 +2 2 1 7 12 15 35 83 115 28 67 93 3 6 7 1 0 0
55257 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
55258 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55259 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55260 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55261 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55262 +4 4 4 4 4 4
55263 +4 0 0 4 0 0 60 73 81 174 174 174 190 197 201 174 174 174
55264 +177 184 187 193 200 203 163 162 163 30 32 34 0 0 0 2 2 2
55265 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
55266 +10 87 144 16 89 141 19 95 150 10 87 144 26 108 161 26 108 161
55267 +26 108 161 26 108 161 26 108 161 28 67 93 6 10 14 1 1 2
55268 +7 12 15 28 67 93 26 108 161 16 89 141 24 86 132 21 29 34
55269 +3 4 3 21 29 34 37 112 160 37 112 160 27 99 146 21 29 34
55270 +21 29 34 26 108 161 90 154 193 35 83 115 1 1 2 2 0 0
55271 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 125 124 125
55272 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55273 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55274 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55275 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55276 +4 4 4 4 4 4
55277 +3 1 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
55278 +190 197 201 193 200 203 165 164 165 37 38 37 4 0 0 2 2 2
55279 +5 5 5 4 3 3 4 0 0 6 10 14 24 86 132 10 87 144
55280 +10 87 144 10 87 144 16 89 141 18 97 151 18 97 151 10 87 144
55281 +24 86 132 24 86 132 13 20 25 4 5 7 4 5 7 22 40 52
55282 +18 97 151 37 112 160 26 108 161 7 12 15 1 1 1 0 0 0
55283 +28 67 93 37 112 160 26 108 161 28 67 93 22 40 52 28 67 93
55284 +26 108 161 90 154 193 26 108 161 10 87 144 0 0 0 2 0 0
55285 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
55286 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55287 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55288 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55289 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55290 +4 4 4 4 4 4
55291 +4 0 0 6 6 6 60 73 81 174 174 174 193 200 203 174 174 174
55292 +190 197 201 193 200 203 165 164 165 30 32 34 0 0 0 2 2 2
55293 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
55294 +10 87 144 10 87 144 10 87 144 18 97 151 28 67 93 6 10 14
55295 +0 0 0 1 1 2 4 5 7 13 20 25 16 89 141 26 108 161
55296 +26 108 161 26 108 161 24 86 132 6 9 11 2 3 3 22 40 52
55297 +37 112 160 16 89 141 22 40 52 28 67 93 26 108 161 26 108 161
55298 +90 154 193 26 108 161 26 108 161 28 67 93 1 1 1 4 0 0
55299 +4 4 4 5 5 5 3 3 3 4 0 0 26 28 28 124 126 130
55300 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55301 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55302 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55303 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55304 +4 4 4 4 4 4
55305 +4 0 0 4 0 0 60 73 81 193 200 203 193 200 203 174 174 174
55306 +193 200 203 193 200 203 167 166 167 37 38 37 4 0 0 2 2 2
55307 +5 5 5 4 4 4 4 0 0 6 10 14 28 67 93 10 87 144
55308 +10 87 144 10 87 144 18 97 151 10 87 144 13 20 25 4 5 7
55309 +1 1 2 1 1 1 22 40 52 26 108 161 26 108 161 26 108 161
55310 +26 108 161 26 108 161 26 108 161 24 86 132 22 40 52 22 40 52
55311 +22 40 52 22 40 52 10 87 144 26 108 161 26 108 161 26 108 161
55312 +26 108 161 26 108 161 90 154 193 10 87 144 0 0 0 4 0 0
55313 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
55314 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55315 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55316 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55317 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55318 +4 4 4 4 4 4
55319 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
55320 +190 197 201 205 212 215 167 166 167 30 32 34 0 0 0 2 2 2
55321 +5 5 5 4 4 4 1 1 2 6 10 14 28 67 93 10 87 144
55322 +10 87 144 10 87 144 10 87 144 10 87 144 22 40 52 1 1 2
55323 +2 0 0 1 1 2 24 86 132 26 108 161 26 108 161 26 108 161
55324 +26 108 161 19 95 150 16 89 141 10 87 144 22 40 52 22 40 52
55325 +10 87 144 26 108 161 37 112 160 26 108 161 26 108 161 26 108 161
55326 +26 108 161 26 108 161 26 108 161 28 67 93 2 0 0 3 1 0
55327 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
55328 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55329 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55330 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55331 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55332 +4 4 4 4 4 4
55333 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
55334 +193 200 203 193 200 203 174 174 174 37 38 37 4 0 0 2 2 2
55335 +5 5 5 4 4 4 3 2 2 1 1 2 13 20 25 10 87 144
55336 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 13 20 25
55337 +13 20 25 22 40 52 10 87 144 18 97 151 18 97 151 26 108 161
55338 +10 87 144 13 20 25 6 10 14 21 29 34 24 86 132 18 97 151
55339 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55340 +26 108 161 90 154 193 18 97 151 13 20 25 0 0 0 4 3 3
55341 +4 4 4 5 5 5 3 3 3 0 0 0 26 28 28 131 129 131
55342 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55343 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55344 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55345 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55346 +4 4 4 4 4 4
55347 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
55348 +190 197 201 220 221 221 167 166 167 30 32 34 1 0 0 2 2 2
55349 +5 5 5 4 4 4 4 4 5 2 5 5 4 5 7 13 20 25
55350 +28 67 93 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
55351 +10 87 144 10 87 144 18 97 151 10 87 144 18 97 151 18 97 151
55352 +28 67 93 2 3 3 0 0 0 28 67 93 26 108 161 26 108 161
55353 +26 108 161 26 108 161 26 108 161 26 108 161 26 108 161 26 108 161
55354 +26 108 161 10 87 144 13 20 25 1 1 2 3 2 2 4 4 4
55355 +4 4 4 5 5 5 3 3 3 2 0 0 26 28 28 131 129 131
55356 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55357 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55358 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55359 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55360 +4 4 4 4 4 4
55361 +4 0 0 4 0 0 60 73 81 220 221 221 190 197 201 174 174 174
55362 +193 200 203 193 200 203 174 174 174 26 28 28 4 0 0 4 3 3
55363 +5 5 5 4 4 4 4 4 4 4 4 5 1 1 2 2 5 5
55364 +4 5 7 22 40 52 10 87 144 10 87 144 18 97 151 10 87 144
55365 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 18 97 151
55366 +10 87 144 28 67 93 22 40 52 10 87 144 26 108 161 18 97 151
55367 +18 97 151 18 97 151 26 108 161 26 108 161 26 108 161 26 108 161
55368 +22 40 52 1 1 2 0 0 0 2 3 3 4 4 4 4 4 4
55369 +4 4 4 5 5 5 4 4 4 0 0 0 26 28 28 131 129 131
55370 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55371 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55372 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55373 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55374 +4 4 4 4 4 4
55375 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
55376 +190 197 201 220 221 221 190 197 201 41 54 63 4 0 0 2 2 2
55377 +6 6 6 4 4 4 4 4 4 4 4 5 4 4 5 3 3 3
55378 +1 1 2 1 1 2 6 10 14 22 40 52 10 87 144 18 97 151
55379 +18 97 151 10 87 144 10 87 144 10 87 144 18 97 151 10 87 144
55380 +10 87 144 18 97 151 26 108 161 18 97 151 18 97 151 10 87 144
55381 +26 108 161 26 108 161 26 108 161 10 87 144 28 67 93 6 10 14
55382 +1 1 2 1 1 2 4 3 3 4 4 5 4 4 4 4 4 4
55383 +5 5 5 5 5 5 1 1 1 4 0 0 37 51 59 137 136 137
55384 +137 136 137 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55385 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55386 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55387 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55388 +4 4 4 4 4 4
55389 +4 0 0 4 0 0 60 73 81 220 221 221 193 200 203 174 174 174
55390 +193 200 203 193 200 203 220 221 221 137 136 137 13 16 17 4 0 0
55391 +2 2 2 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5
55392 +4 4 5 4 3 3 1 1 2 4 5 7 13 20 25 28 67 93
55393 +10 87 144 10 87 144 10 87 144 10 87 144 10 87 144 10 87 144
55394 +10 87 144 18 97 151 18 97 151 10 87 144 18 97 151 26 108 161
55395 +26 108 161 18 97 151 28 67 93 6 10 14 0 0 0 0 0 0
55396 +2 3 3 4 5 5 4 4 5 4 4 4 4 4 4 5 5 5
55397 +3 3 3 1 1 1 0 0 0 16 19 21 125 124 125 137 136 137
55398 +131 129 131 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55399 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55400 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55401 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55402 +4 4 4 4 4 4
55403 +4 0 0 6 6 6 60 73 81 174 174 174 220 221 221 174 174 174
55404 +193 200 203 190 197 201 220 221 221 220 221 221 153 152 153 30 32 34
55405 +0 0 0 0 0 0 2 2 2 4 4 4 4 4 4 4 4 4
55406 +4 4 4 4 5 5 4 5 7 1 1 2 1 1 2 4 5 7
55407 +13 20 25 28 67 93 10 87 144 18 97 151 10 87 144 10 87 144
55408 +10 87 144 10 87 144 10 87 144 18 97 151 26 108 161 18 97 151
55409 +28 67 93 7 12 15 0 0 0 0 0 0 2 2 1 4 4 4
55410 +4 5 5 4 5 5 4 4 4 4 4 4 3 3 3 0 0 0
55411 +0 0 0 0 0 0 37 38 37 125 124 125 158 157 158 131 129 131
55412 +125 124 125 125 124 125 125 124 125 137 136 137 131 129 131 37 38 37
55413 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55414 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55415 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55416 +4 4 4 4 4 4
55417 +4 3 3 4 0 0 41 54 63 193 200 203 220 221 221 174 174 174
55418 +193 200 203 193 200 203 193 200 203 220 221 221 244 246 246 193 200 203
55419 +120 125 127 5 5 5 1 0 0 0 0 0 1 1 1 4 4 4
55420 +4 4 4 4 4 4 4 5 5 4 5 5 4 4 5 1 1 2
55421 +4 5 7 4 5 7 22 40 52 10 87 144 10 87 144 10 87 144
55422 +10 87 144 10 87 144 18 97 151 10 87 144 10 87 144 13 20 25
55423 +4 5 7 2 3 3 1 1 2 4 4 4 4 5 5 4 4 4
55424 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 1 2
55425 +24 26 27 60 74 84 153 152 153 163 162 163 137 136 137 125 124 125
55426 +125 124 125 125 124 125 125 124 125 137 136 137 125 124 125 26 28 28
55427 +0 0 0 3 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55428 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55429 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55430 +4 4 4 4 4 4
55431 +4 0 0 6 6 6 26 28 28 156 155 156 220 221 221 220 221 221
55432 +174 174 174 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
55433 +220 221 221 167 166 167 60 73 81 7 11 13 0 0 0 0 0 0
55434 +3 3 3 4 4 4 4 4 4 4 4 4 4 4 5 4 4 5
55435 +4 4 5 1 1 2 1 1 2 4 5 7 22 40 52 10 87 144
55436 +10 87 144 10 87 144 10 87 144 22 40 52 4 5 7 1 1 2
55437 +1 1 2 4 4 5 4 4 4 4 4 4 4 4 4 4 4 4
55438 +5 5 5 2 2 2 0 0 0 4 0 0 16 19 21 60 73 81
55439 +137 136 137 167 166 167 158 157 158 137 136 137 131 129 131 131 129 131
55440 +125 124 125 125 124 125 131 129 131 155 154 155 60 74 84 5 7 8
55441 +0 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55442 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55443 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55444 +4 4 4 4 4 4
55445 +5 5 5 4 0 0 4 0 0 60 73 81 193 200 203 220 221 221
55446 +193 200 203 193 200 203 193 200 203 193 200 203 205 212 215 220 221 221
55447 +220 221 221 220 221 221 220 221 221 137 136 137 43 57 68 6 6 6
55448 +4 0 0 1 1 1 4 4 4 4 4 4 4 4 4 4 4 4
55449 +4 4 5 4 4 5 3 2 2 1 1 2 2 5 5 13 20 25
55450 +22 40 52 22 40 52 13 20 25 2 3 3 1 1 2 3 3 3
55451 +4 5 7 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55452 +1 1 1 0 0 0 2 3 3 41 54 63 131 129 131 166 165 166
55453 +166 165 166 155 154 155 153 152 153 137 136 137 137 136 137 125 124 125
55454 +125 124 125 137 136 137 137 136 137 125 124 125 37 38 37 4 3 3
55455 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
55456 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55457 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55458 +4 4 4 4 4 4
55459 +4 3 3 6 6 6 6 6 6 13 16 17 60 73 81 167 166 167
55460 +220 221 221 220 221 221 220 221 221 193 200 203 193 200 203 193 200 203
55461 +205 212 215 220 221 221 220 221 221 244 246 246 205 212 215 125 124 125
55462 +24 26 27 0 0 0 0 0 0 2 2 2 5 5 5 5 5 5
55463 +4 4 4 4 4 4 4 4 4 4 4 5 1 1 2 4 5 7
55464 +4 5 7 4 5 7 1 1 2 3 2 2 4 4 5 4 4 4
55465 +4 4 4 4 4 4 5 5 5 4 4 4 0 0 0 0 0 0
55466 +2 0 0 26 28 28 125 124 125 174 174 174 174 174 174 166 165 166
55467 +156 155 156 153 152 153 137 136 137 137 136 137 131 129 131 137 136 137
55468 +137 136 137 137 136 137 60 74 84 30 32 34 4 0 0 4 0 0
55469 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55470 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55471 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55472 +4 4 4 4 4 4
55473 +5 5 5 6 6 6 4 0 0 4 0 0 6 6 6 26 28 28
55474 +125 124 125 174 174 174 220 221 221 220 221 221 220 221 221 193 200 203
55475 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
55476 +193 200 203 60 74 84 13 16 17 4 0 0 0 0 0 3 3 3
55477 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 5 3 3 3
55478 +1 1 2 3 3 3 4 4 5 4 4 5 4 4 4 4 4 4
55479 +5 5 5 5 5 5 2 2 2 0 0 0 0 0 0 13 16 17
55480 +60 74 84 174 174 174 193 200 203 174 174 174 167 166 167 163 162 163
55481 +153 152 153 153 152 153 137 136 137 137 136 137 153 152 153 137 136 137
55482 +125 124 125 41 54 63 24 26 27 4 0 0 4 0 0 5 5 5
55483 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55484 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55485 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55486 +4 4 4 4 4 4
55487 +4 3 3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
55488 +6 6 6 37 38 37 131 129 131 220 221 221 220 221 221 220 221 221
55489 +193 200 203 193 200 203 220 221 221 205 212 215 220 221 221 244 246 246
55490 +244 246 246 244 246 246 174 174 174 41 54 63 0 0 0 0 0 0
55491 +0 0 0 4 4 4 5 5 5 5 5 5 4 4 4 4 4 5
55492 +4 4 5 4 4 5 4 4 4 4 4 4 6 6 6 6 6 6
55493 +3 3 3 0 0 0 2 0 0 13 16 17 60 73 81 156 155 156
55494 +220 221 221 193 200 203 174 174 174 165 164 165 163 162 163 154 153 154
55495 +153 152 153 153 152 153 158 157 158 163 162 163 137 136 137 60 73 81
55496 +13 16 17 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
55497 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55498 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55499 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55500 +4 4 4 4 4 4
55501 +5 5 5 4 3 3 4 3 3 6 6 6 6 6 6 6 6 6
55502 +6 6 6 6 6 6 6 6 6 37 38 37 167 166 167 244 246 246
55503 +244 246 246 220 221 221 205 212 215 205 212 215 220 221 221 193 200 203
55504 +220 221 221 244 246 246 244 246 246 244 246 246 137 136 137 37 38 37
55505 +3 2 2 0 0 0 1 1 1 5 5 5 5 5 5 4 4 4
55506 +4 4 4 4 4 4 4 4 4 5 5 5 4 4 4 1 1 1
55507 +0 0 0 5 5 5 43 57 68 153 152 153 193 200 203 220 221 221
55508 +177 184 187 174 174 174 167 166 167 166 165 166 158 157 158 157 156 157
55509 +158 157 158 166 165 166 156 155 156 85 115 134 13 16 17 4 0 0
55510 +4 0 0 4 0 0 5 5 5 5 5 5 4 4 4 4 4 4
55511 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55512 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55513 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55514 +4 4 4 4 4 4
55515 +5 5 5 4 3 3 6 6 6 6 6 6 4 0 0 6 6 6
55516 +6 6 6 6 6 6 6 6 6 6 6 6 13 16 17 60 73 81
55517 +177 184 187 220 221 221 220 221 221 220 221 221 205 212 215 220 221 221
55518 +220 221 221 205 212 215 220 221 221 244 246 246 244 246 246 205 212 215
55519 +125 124 125 30 32 34 0 0 0 0 0 0 2 2 2 5 5 5
55520 +4 4 4 4 4 4 4 4 4 1 1 1 0 0 0 1 0 0
55521 +37 38 37 131 129 131 205 212 215 220 221 221 193 200 203 174 174 174
55522 +174 174 174 174 174 174 167 166 167 165 164 165 166 165 166 167 166 167
55523 +158 157 158 125 124 125 37 38 37 4 0 0 4 0 0 4 0 0
55524 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
55525 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55526 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55527 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55528 +4 4 4 4 4 4
55529 +4 4 4 5 5 5 4 3 3 4 3 3 6 6 6 6 6 6
55530 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
55531 +26 28 28 125 124 125 205 212 215 220 221 221 220 221 221 220 221 221
55532 +205 212 215 220 221 221 205 212 215 220 221 221 220 221 221 244 246 246
55533 +244 246 246 190 197 201 60 74 84 16 19 21 4 0 0 0 0 0
55534 +0 0 0 0 0 0 0 0 0 0 0 0 16 19 21 120 125 127
55535 +177 184 187 220 221 221 205 212 215 177 184 187 174 174 174 177 184 187
55536 +174 174 174 174 174 174 167 166 167 174 174 174 166 165 166 137 136 137
55537 +60 73 81 13 16 17 4 0 0 4 0 0 4 3 3 6 6 6
55538 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55539 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55540 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55541 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55542 +4 4 4 4 4 4
55543 +5 5 5 4 3 3 5 5 5 4 3 3 6 6 6 4 0 0
55544 +6 6 6 6 6 6 4 0 0 6 6 6 4 0 0 6 6 6
55545 +6 6 6 6 6 6 37 38 37 137 136 137 193 200 203 220 221 221
55546 +220 221 221 205 212 215 220 221 221 205 212 215 205 212 215 220 221 221
55547 +220 221 221 220 221 221 244 246 246 166 165 166 43 57 68 2 2 2
55548 +0 0 0 4 0 0 16 19 21 60 73 81 157 156 157 202 210 214
55549 +220 221 221 193 200 203 177 184 187 177 184 187 177 184 187 174 174 174
55550 +174 174 174 174 174 174 174 174 174 157 156 157 60 74 84 24 26 27
55551 +4 0 0 4 0 0 4 0 0 6 6 6 4 4 4 4 4 4
55552 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55553 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55554 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55555 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55556 +4 4 4 4 4 4
55557 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
55558 +6 6 6 4 0 0 6 6 6 6 6 6 6 6 6 4 0 0
55559 +4 0 0 4 0 0 6 6 6 24 26 27 60 73 81 167 166 167
55560 +220 221 221 220 221 221 220 221 221 205 212 215 205 212 215 205 212 215
55561 +205 212 215 220 221 221 220 221 221 220 221 221 205 212 215 137 136 137
55562 +60 74 84 125 124 125 137 136 137 190 197 201 220 221 221 193 200 203
55563 +177 184 187 177 184 187 177 184 187 174 174 174 174 174 174 177 184 187
55564 +190 197 201 174 174 174 125 124 125 37 38 37 6 6 6 4 0 0
55565 +4 0 0 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55566 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55567 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55568 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55569 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55570 +4 4 4 4 4 4
55571 +4 4 4 4 4 4 5 5 5 5 5 5 4 3 3 6 6 6
55572 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 6 6 6
55573 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
55574 +125 124 125 193 200 203 244 246 246 220 221 221 205 212 215 205 212 215
55575 +205 212 215 193 200 203 205 212 215 205 212 215 220 221 221 220 221 221
55576 +193 200 203 193 200 203 205 212 215 193 200 203 193 200 203 177 184 187
55577 +190 197 201 190 197 201 174 174 174 190 197 201 193 200 203 190 197 201
55578 +153 152 153 60 73 81 4 0 0 4 0 0 4 0 0 3 2 2
55579 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55580 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55581 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55582 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55583 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55584 +4 4 4 4 4 4
55585 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
55586 +6 6 6 4 3 3 4 3 3 4 3 3 6 6 6 6 6 6
55587 +4 0 0 6 6 6 6 6 6 6 6 6 4 0 0 4 0 0
55588 +4 0 0 26 28 28 131 129 131 220 221 221 244 246 246 220 221 221
55589 +205 212 215 193 200 203 205 212 215 193 200 203 193 200 203 205 212 215
55590 +220 221 221 193 200 203 193 200 203 193 200 203 190 197 201 174 174 174
55591 +174 174 174 190 197 201 193 200 203 193 200 203 167 166 167 125 124 125
55592 +6 6 6 4 0 0 4 0 0 4 3 3 4 4 4 4 4 4
55593 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55594 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55595 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55596 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55597 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55598 +4 4 4 4 4 4
55599 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
55600 +5 5 5 4 3 3 5 5 5 6 6 6 4 3 3 5 5 5
55601 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
55602 +4 0 0 4 0 0 6 6 6 41 54 63 158 157 158 220 221 221
55603 +220 221 221 220 221 221 193 200 203 193 200 203 193 200 203 190 197 201
55604 +190 197 201 190 197 201 190 197 201 190 197 201 174 174 174 193 200 203
55605 +193 200 203 220 221 221 174 174 174 125 124 125 37 38 37 4 0 0
55606 +4 0 0 4 3 3 6 6 6 4 4 4 4 4 4 4 4 4
55607 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55608 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55609 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55610 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55611 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55612 +4 4 4 4 4 4
55613 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55614 +4 4 4 5 5 5 4 3 3 4 3 3 4 3 3 5 5 5
55615 +4 3 3 6 6 6 5 5 5 4 3 3 6 6 6 6 6 6
55616 +6 6 6 6 6 6 4 0 0 4 0 0 13 16 17 60 73 81
55617 +174 174 174 220 221 221 220 221 221 205 212 215 190 197 201 174 174 174
55618 +193 200 203 174 174 174 190 197 201 174 174 174 193 200 203 220 221 221
55619 +193 200 203 131 129 131 37 38 37 6 6 6 4 0 0 4 0 0
55620 +6 6 6 6 6 6 4 3 3 5 5 5 4 4 4 4 4 4
55621 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55622 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55623 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55624 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55625 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55626 +4 4 4 4 4 4
55627 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55628 +4 4 4 4 4 4 4 4 4 5 5 5 5 5 5 5 5 5
55629 +5 5 5 4 3 3 4 3 3 5 5 5 4 3 3 4 3 3
55630 +5 5 5 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
55631 +6 6 6 125 124 125 174 174 174 220 221 221 220 221 221 193 200 203
55632 +193 200 203 193 200 203 193 200 203 193 200 203 220 221 221 158 157 158
55633 +60 73 81 6 6 6 4 0 0 4 0 0 5 5 5 6 6 6
55634 +5 5 5 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
55635 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55636 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55637 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55638 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55639 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55640 +4 4 4 4 4 4
55641 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55642 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55643 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
55644 +5 5 5 5 5 5 6 6 6 6 6 6 4 0 0 4 0 0
55645 +4 0 0 4 0 0 26 28 28 125 124 125 174 174 174 193 200 203
55646 +193 200 203 174 174 174 193 200 203 167 166 167 125 124 125 6 6 6
55647 +6 6 6 6 6 6 4 0 0 6 6 6 6 6 6 5 5 5
55648 +4 3 3 5 5 5 4 4 4 4 4 4 4 4 4 4 4 4
55649 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55650 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55651 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55652 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55653 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55654 +4 4 4 4 4 4
55655 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55656 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55657 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
55658 +4 3 3 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
55659 +6 6 6 4 0 0 4 0 0 6 6 6 37 38 37 125 124 125
55660 +153 152 153 131 129 131 125 124 125 37 38 37 6 6 6 6 6 6
55661 +6 6 6 4 0 0 6 6 6 6 6 6 4 3 3 5 5 5
55662 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55663 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55664 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55665 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55666 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55667 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55668 +4 4 4 4 4 4
55669 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55670 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55671 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55672 +4 4 4 5 5 5 5 5 5 4 3 3 5 5 5 4 3 3
55673 +6 6 6 6 6 6 4 0 0 4 0 0 6 6 6 6 6 6
55674 +24 26 27 24 26 27 6 6 6 6 6 6 6 6 6 4 0 0
55675 +6 6 6 6 6 6 4 0 0 6 6 6 5 5 5 4 3 3
55676 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55677 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55678 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55679 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55680 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55681 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55682 +4 4 4 4 4 4
55683 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55684 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55685 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55686 +4 4 4 4 4 4 5 5 5 4 3 3 5 5 5 6 6 6
55687 +4 0 0 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6
55688 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 6 6 6
55689 +4 0 0 6 6 6 6 6 6 4 3 3 5 5 5 4 4 4
55690 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55691 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55692 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55693 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55694 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55695 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55696 +4 4 4 4 4 4
55697 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55698 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55699 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55700 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 5 5 5
55701 +5 5 5 5 5 5 4 0 0 6 6 6 4 0 0 6 6 6
55702 +6 6 6 6 6 6 6 6 6 4 0 0 6 6 6 4 0 0
55703 +6 6 6 4 3 3 5 5 5 4 3 3 5 5 5 4 4 4
55704 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55705 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55706 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55707 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55708 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55709 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55710 +4 4 4 4 4 4
55711 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55712 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55713 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55714 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 5 5 5
55715 +4 3 3 6 6 6 4 3 3 6 6 6 6 6 6 6 6 6
55716 +4 0 0 6 6 6 4 0 0 6 6 6 6 6 6 6 6 6
55717 +6 6 6 4 3 3 5 5 5 4 4 4 4 4 4 4 4 4
55718 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55719 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55720 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55721 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55722 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55723 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55724 +4 4 4 4 4 4
55725 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55726 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55727 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55728 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55729 +4 4 4 5 5 5 4 3 3 5 5 5 4 0 0 6 6 6
55730 +6 6 6 4 0 0 6 6 6 6 6 6 4 0 0 6 6 6
55731 +4 3 3 5 5 5 5 5 5 4 4 4 4 4 4 4 4 4
55732 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55733 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55734 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55735 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55736 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55737 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55738 +4 4 4 4 4 4
55739 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55740 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55741 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55742 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55743 +4 4 4 5 5 5 4 3 3 5 5 5 6 6 6 4 3 3
55744 +4 3 3 6 6 6 6 6 6 4 3 3 6 6 6 4 3 3
55745 +5 5 5 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55746 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55747 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55748 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55749 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55750 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55751 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55752 +4 4 4 4 4 4
55753 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55754 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55755 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55756 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55757 +4 4 4 4 4 4 4 4 4 5 5 5 4 3 3 6 6 6
55758 +5 5 5 4 3 3 4 3 3 4 3 3 5 5 5 5 5 5
55759 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55760 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55761 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55762 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55763 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55764 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55765 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55766 +4 4 4 4 4 4
55767 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55768 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55769 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55770 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55771 +4 4 4 4 4 4 4 4 4 4 4 4 5 5 5 4 3 3
55772 +5 5 5 4 3 3 5 5 5 5 5 5 4 4 4 4 4 4
55773 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55774 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55775 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55776 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55777 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55778 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55779 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4
55780 +4 4 4 4 4 4
55781 diff --git a/drivers/video/matrox/matroxfb_DAC1064.c b/drivers/video/matrox/matroxfb_DAC1064.c
55782 index a01147f..5d896f8 100644
55783 --- a/drivers/video/matrox/matroxfb_DAC1064.c
55784 +++ b/drivers/video/matrox/matroxfb_DAC1064.c
55785 @@ -1088,14 +1088,20 @@ static void MGAG100_restore(struct matrox_fb_info *minfo)
55786
55787 #ifdef CONFIG_FB_MATROX_MYSTIQUE
55788 struct matrox_switch matrox_mystique = {
55789 - MGA1064_preinit, MGA1064_reset, MGA1064_init, MGA1064_restore,
55790 + .preinit = MGA1064_preinit,
55791 + .reset = MGA1064_reset,
55792 + .init = MGA1064_init,
55793 + .restore = MGA1064_restore,
55794 };
55795 EXPORT_SYMBOL(matrox_mystique);
55796 #endif
55797
55798 #ifdef CONFIG_FB_MATROX_G
55799 struct matrox_switch matrox_G100 = {
55800 - MGAG100_preinit, MGAG100_reset, MGAG100_init, MGAG100_restore,
55801 + .preinit = MGAG100_preinit,
55802 + .reset = MGAG100_reset,
55803 + .init = MGAG100_init,
55804 + .restore = MGAG100_restore,
55805 };
55806 EXPORT_SYMBOL(matrox_G100);
55807 #endif
55808 diff --git a/drivers/video/matrox/matroxfb_Ti3026.c b/drivers/video/matrox/matroxfb_Ti3026.c
55809 index 195ad7c..09743fc 100644
55810 --- a/drivers/video/matrox/matroxfb_Ti3026.c
55811 +++ b/drivers/video/matrox/matroxfb_Ti3026.c
55812 @@ -738,7 +738,10 @@ static int Ti3026_preinit(struct matrox_fb_info *minfo)
55813 }
55814
55815 struct matrox_switch matrox_millennium = {
55816 - Ti3026_preinit, Ti3026_reset, Ti3026_init, Ti3026_restore
55817 + .preinit = Ti3026_preinit,
55818 + .reset = Ti3026_reset,
55819 + .init = Ti3026_init,
55820 + .restore = Ti3026_restore
55821 };
55822 EXPORT_SYMBOL(matrox_millennium);
55823 #endif
55824 diff --git a/drivers/video/mb862xx/mb862xxfb_accel.c b/drivers/video/mb862xx/mb862xxfb_accel.c
55825 index fe92eed..106e085 100644
55826 --- a/drivers/video/mb862xx/mb862xxfb_accel.c
55827 +++ b/drivers/video/mb862xx/mb862xxfb_accel.c
55828 @@ -312,14 +312,18 @@ void mb862xxfb_init_accel(struct fb_info *info, int xres)
55829 struct mb862xxfb_par *par = info->par;
55830
55831 if (info->var.bits_per_pixel == 32) {
55832 - info->fbops->fb_fillrect = cfb_fillrect;
55833 - info->fbops->fb_copyarea = cfb_copyarea;
55834 - info->fbops->fb_imageblit = cfb_imageblit;
55835 + pax_open_kernel();
55836 + *(void **)&info->fbops->fb_fillrect = cfb_fillrect;
55837 + *(void **)&info->fbops->fb_copyarea = cfb_copyarea;
55838 + *(void **)&info->fbops->fb_imageblit = cfb_imageblit;
55839 + pax_close_kernel();
55840 } else {
55841 outreg(disp, GC_L0EM, 3);
55842 - info->fbops->fb_fillrect = mb86290fb_fillrect;
55843 - info->fbops->fb_copyarea = mb86290fb_copyarea;
55844 - info->fbops->fb_imageblit = mb86290fb_imageblit;
55845 + pax_open_kernel();
55846 + *(void **)&info->fbops->fb_fillrect = mb86290fb_fillrect;
55847 + *(void **)&info->fbops->fb_copyarea = mb86290fb_copyarea;
55848 + *(void **)&info->fbops->fb_imageblit = mb86290fb_imageblit;
55849 + pax_close_kernel();
55850 }
55851 outreg(draw, GDC_REG_DRAW_BASE, 0);
55852 outreg(draw, GDC_REG_MODE_MISC, 0x8000);
55853 diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
55854 index def0412..fed6529 100644
55855 --- a/drivers/video/nvidia/nvidia.c
55856 +++ b/drivers/video/nvidia/nvidia.c
55857 @@ -669,19 +669,23 @@ static int nvidiafb_set_par(struct fb_info *info)
55858 info->fix.line_length = (info->var.xres_virtual *
55859 info->var.bits_per_pixel) >> 3;
55860 if (info->var.accel_flags) {
55861 - info->fbops->fb_imageblit = nvidiafb_imageblit;
55862 - info->fbops->fb_fillrect = nvidiafb_fillrect;
55863 - info->fbops->fb_copyarea = nvidiafb_copyarea;
55864 - info->fbops->fb_sync = nvidiafb_sync;
55865 + pax_open_kernel();
55866 + *(void **)&info->fbops->fb_imageblit = nvidiafb_imageblit;
55867 + *(void **)&info->fbops->fb_fillrect = nvidiafb_fillrect;
55868 + *(void **)&info->fbops->fb_copyarea = nvidiafb_copyarea;
55869 + *(void **)&info->fbops->fb_sync = nvidiafb_sync;
55870 + pax_close_kernel();
55871 info->pixmap.scan_align = 4;
55872 info->flags &= ~FBINFO_HWACCEL_DISABLED;
55873 info->flags |= FBINFO_READS_FAST;
55874 NVResetGraphics(info);
55875 } else {
55876 - info->fbops->fb_imageblit = cfb_imageblit;
55877 - info->fbops->fb_fillrect = cfb_fillrect;
55878 - info->fbops->fb_copyarea = cfb_copyarea;
55879 - info->fbops->fb_sync = NULL;
55880 + pax_open_kernel();
55881 + *(void **)&info->fbops->fb_imageblit = cfb_imageblit;
55882 + *(void **)&info->fbops->fb_fillrect = cfb_fillrect;
55883 + *(void **)&info->fbops->fb_copyarea = cfb_copyarea;
55884 + *(void **)&info->fbops->fb_sync = NULL;
55885 + pax_close_kernel();
55886 info->pixmap.scan_align = 1;
55887 info->flags |= FBINFO_HWACCEL_DISABLED;
55888 info->flags &= ~FBINFO_READS_FAST;
55889 @@ -1173,8 +1177,11 @@ static int nvidia_set_fbinfo(struct fb_info *info)
55890 info->pixmap.size = 8 * 1024;
55891 info->pixmap.flags = FB_PIXMAP_SYSTEM;
55892
55893 - if (!hwcur)
55894 - info->fbops->fb_cursor = NULL;
55895 + if (!hwcur) {
55896 + pax_open_kernel();
55897 + *(void **)&info->fbops->fb_cursor = NULL;
55898 + pax_close_kernel();
55899 + }
55900
55901 info->var.accel_flags = (!noaccel);
55902
55903 diff --git a/drivers/video/omap2/dss/display.c b/drivers/video/omap2/dss/display.c
55904 index 669a81f..e216d76 100644
55905 --- a/drivers/video/omap2/dss/display.c
55906 +++ b/drivers/video/omap2/dss/display.c
55907 @@ -137,12 +137,14 @@ int omapdss_register_display(struct omap_dss_device *dssdev)
55908 snprintf(dssdev->alias, sizeof(dssdev->alias),
55909 "display%d", disp_num_counter++);
55910
55911 + pax_open_kernel();
55912 if (drv && drv->get_resolution == NULL)
55913 - drv->get_resolution = omapdss_default_get_resolution;
55914 + *(void **)&drv->get_resolution = omapdss_default_get_resolution;
55915 if (drv && drv->get_recommended_bpp == NULL)
55916 - drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
55917 + *(void **)&drv->get_recommended_bpp = omapdss_default_get_recommended_bpp;
55918 if (drv && drv->get_timings == NULL)
55919 - drv->get_timings = omapdss_default_get_timings;
55920 + *(void **)&drv->get_timings = omapdss_default_get_timings;
55921 + pax_close_kernel();
55922
55923 mutex_lock(&panel_list_mutex);
55924 list_add_tail(&dssdev->panel_list, &panel_list);
55925 diff --git a/drivers/video/s1d13xxxfb.c b/drivers/video/s1d13xxxfb.c
55926 index 83433cb..71e9b98 100644
55927 --- a/drivers/video/s1d13xxxfb.c
55928 +++ b/drivers/video/s1d13xxxfb.c
55929 @@ -881,8 +881,10 @@ static int s1d13xxxfb_probe(struct platform_device *pdev)
55930
55931 switch(prod_id) {
55932 case S1D13506_PROD_ID: /* activate acceleration */
55933 - s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
55934 - s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
55935 + pax_open_kernel();
55936 + *(void **)&s1d13xxxfb_fbops.fb_fillrect = s1d13xxxfb_bitblt_solidfill;
55937 + *(void **)&s1d13xxxfb_fbops.fb_copyarea = s1d13xxxfb_bitblt_copyarea;
55938 + pax_close_kernel();
55939 info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_YPAN |
55940 FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_COPYAREA;
55941 break;
55942 diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
55943 index 2bcc84a..29dd1ea 100644
55944 --- a/drivers/video/sh_mobile_lcdcfb.c
55945 +++ b/drivers/video/sh_mobile_lcdcfb.c
55946 @@ -439,9 +439,9 @@ static unsigned long lcdc_sys_read_data(void *handle)
55947 }
55948
55949 static struct sh_mobile_lcdc_sys_bus_ops sh_mobile_lcdc_sys_bus_ops = {
55950 - lcdc_sys_write_index,
55951 - lcdc_sys_write_data,
55952 - lcdc_sys_read_data,
55953 + .write_index = lcdc_sys_write_index,
55954 + .write_data = lcdc_sys_write_data,
55955 + .read_data = lcdc_sys_read_data,
55956 };
55957
55958 static int sh_mobile_lcdc_sginit(struct fb_info *info,
55959 diff --git a/drivers/video/smscufx.c b/drivers/video/smscufx.c
55960 index d513ed6..90b0de9 100644
55961 --- a/drivers/video/smscufx.c
55962 +++ b/drivers/video/smscufx.c
55963 @@ -1175,7 +1175,9 @@ static int ufx_ops_release(struct fb_info *info, int user)
55964 fb_deferred_io_cleanup(info);
55965 kfree(info->fbdefio);
55966 info->fbdefio = NULL;
55967 - info->fbops->fb_mmap = ufx_ops_mmap;
55968 + pax_open_kernel();
55969 + *(void **)&info->fbops->fb_mmap = ufx_ops_mmap;
55970 + pax_close_kernel();
55971 }
55972
55973 pr_debug("released /dev/fb%d user=%d count=%d",
55974 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
55975 index 77b890e..458e666 100644
55976 --- a/drivers/video/udlfb.c
55977 +++ b/drivers/video/udlfb.c
55978 @@ -623,11 +623,11 @@ static int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
55979 dlfb_urb_completion(urb);
55980
55981 error:
55982 - atomic_add(bytes_sent, &dev->bytes_sent);
55983 - atomic_add(bytes_identical, &dev->bytes_identical);
55984 - atomic_add(width*height*2, &dev->bytes_rendered);
55985 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
55986 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
55987 + atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
55988 end_cycles = get_cycles();
55989 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
55990 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
55991 >> 10)), /* Kcycles */
55992 &dev->cpu_kcycles_used);
55993
55994 @@ -748,11 +748,11 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
55995 dlfb_urb_completion(urb);
55996
55997 error:
55998 - atomic_add(bytes_sent, &dev->bytes_sent);
55999 - atomic_add(bytes_identical, &dev->bytes_identical);
56000 - atomic_add(bytes_rendered, &dev->bytes_rendered);
56001 + atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
56002 + atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
56003 + atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
56004 end_cycles = get_cycles();
56005 - atomic_add(((unsigned int) ((end_cycles - start_cycles)
56006 + atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
56007 >> 10)), /* Kcycles */
56008 &dev->cpu_kcycles_used);
56009 }
56010 @@ -993,7 +993,9 @@ static int dlfb_ops_release(struct fb_info *info, int user)
56011 fb_deferred_io_cleanup(info);
56012 kfree(info->fbdefio);
56013 info->fbdefio = NULL;
56014 - info->fbops->fb_mmap = dlfb_ops_mmap;
56015 + pax_open_kernel();
56016 + *(void **)&info->fbops->fb_mmap = dlfb_ops_mmap;
56017 + pax_close_kernel();
56018 }
56019
56020 pr_warn("released /dev/fb%d user=%d count=%d\n",
56021 @@ -1376,7 +1378,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
56022 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56023 struct dlfb_data *dev = fb_info->par;
56024 return snprintf(buf, PAGE_SIZE, "%u\n",
56025 - atomic_read(&dev->bytes_rendered));
56026 + atomic_read_unchecked(&dev->bytes_rendered));
56027 }
56028
56029 static ssize_t metrics_bytes_identical_show(struct device *fbdev,
56030 @@ -1384,7 +1386,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
56031 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56032 struct dlfb_data *dev = fb_info->par;
56033 return snprintf(buf, PAGE_SIZE, "%u\n",
56034 - atomic_read(&dev->bytes_identical));
56035 + atomic_read_unchecked(&dev->bytes_identical));
56036 }
56037
56038 static ssize_t metrics_bytes_sent_show(struct device *fbdev,
56039 @@ -1392,7 +1394,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
56040 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56041 struct dlfb_data *dev = fb_info->par;
56042 return snprintf(buf, PAGE_SIZE, "%u\n",
56043 - atomic_read(&dev->bytes_sent));
56044 + atomic_read_unchecked(&dev->bytes_sent));
56045 }
56046
56047 static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
56048 @@ -1400,7 +1402,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
56049 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56050 struct dlfb_data *dev = fb_info->par;
56051 return snprintf(buf, PAGE_SIZE, "%u\n",
56052 - atomic_read(&dev->cpu_kcycles_used));
56053 + atomic_read_unchecked(&dev->cpu_kcycles_used));
56054 }
56055
56056 static ssize_t edid_show(
56057 @@ -1460,10 +1462,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
56058 struct fb_info *fb_info = dev_get_drvdata(fbdev);
56059 struct dlfb_data *dev = fb_info->par;
56060
56061 - atomic_set(&dev->bytes_rendered, 0);
56062 - atomic_set(&dev->bytes_identical, 0);
56063 - atomic_set(&dev->bytes_sent, 0);
56064 - atomic_set(&dev->cpu_kcycles_used, 0);
56065 + atomic_set_unchecked(&dev->bytes_rendered, 0);
56066 + atomic_set_unchecked(&dev->bytes_identical, 0);
56067 + atomic_set_unchecked(&dev->bytes_sent, 0);
56068 + atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
56069
56070 return count;
56071 }
56072 diff --git a/drivers/video/uvesafb.c b/drivers/video/uvesafb.c
56073 index 256fba7..6e75516 100644
56074 --- a/drivers/video/uvesafb.c
56075 +++ b/drivers/video/uvesafb.c
56076 @@ -19,6 +19,7 @@
56077 #include <linux/io.h>
56078 #include <linux/mutex.h>
56079 #include <linux/slab.h>
56080 +#include <linux/moduleloader.h>
56081 #include <video/edid.h>
56082 #include <video/uvesafb.h>
56083 #ifdef CONFIG_X86
56084 @@ -565,10 +566,32 @@ static int uvesafb_vbe_getpmi(struct uvesafb_ktask *task,
56085 if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
56086 par->pmi_setpal = par->ypan = 0;
56087 } else {
56088 +
56089 +#ifdef CONFIG_PAX_KERNEXEC
56090 +#ifdef CONFIG_MODULES
56091 + par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
56092 +#endif
56093 + if (!par->pmi_code) {
56094 + par->pmi_setpal = par->ypan = 0;
56095 + return 0;
56096 + }
56097 +#endif
56098 +
56099 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
56100 + task->t.regs.edi);
56101 +
56102 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56103 + pax_open_kernel();
56104 + memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
56105 + pax_close_kernel();
56106 +
56107 + par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
56108 + par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
56109 +#else
56110 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
56111 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
56112 +#endif
56113 +
56114 printk(KERN_INFO "uvesafb: protected mode interface info at "
56115 "%04x:%04x\n",
56116 (u16)task->t.regs.es, (u16)task->t.regs.edi);
56117 @@ -813,13 +836,14 @@ static int uvesafb_vbe_init(struct fb_info *info)
56118 par->ypan = ypan;
56119
56120 if (par->pmi_setpal || par->ypan) {
56121 +#if !defined(CONFIG_MODULES) || !defined(CONFIG_PAX_KERNEXEC)
56122 if (__supported_pte_mask & _PAGE_NX) {
56123 par->pmi_setpal = par->ypan = 0;
56124 printk(KERN_WARNING "uvesafb: NX protection is active, "
56125 "better not use the PMI.\n");
56126 - } else {
56127 + } else
56128 +#endif
56129 uvesafb_vbe_getpmi(task, par);
56130 - }
56131 }
56132 #else
56133 /* The protected mode interface is not available on non-x86. */
56134 @@ -1453,8 +1477,11 @@ static void uvesafb_init_info(struct fb_info *info, struct vbe_mode_ib *mode)
56135 info->fix.ywrapstep = (par->ypan > 1) ? 1 : 0;
56136
56137 /* Disable blanking if the user requested so. */
56138 - if (!blank)
56139 - info->fbops->fb_blank = NULL;
56140 + if (!blank) {
56141 + pax_open_kernel();
56142 + *(void **)&info->fbops->fb_blank = NULL;
56143 + pax_close_kernel();
56144 + }
56145
56146 /*
56147 * Find out how much IO memory is required for the mode with
56148 @@ -1530,8 +1557,11 @@ static void uvesafb_init_info(struct fb_info *info, struct vbe_mode_ib *mode)
56149 info->flags = FBINFO_FLAG_DEFAULT |
56150 (par->ypan ? FBINFO_HWACCEL_YPAN : 0);
56151
56152 - if (!par->ypan)
56153 - info->fbops->fb_pan_display = NULL;
56154 + if (!par->ypan) {
56155 + pax_open_kernel();
56156 + *(void **)&info->fbops->fb_pan_display = NULL;
56157 + pax_close_kernel();
56158 + }
56159 }
56160
56161 static void uvesafb_init_mtrr(struct fb_info *info)
56162 @@ -1792,6 +1822,11 @@ out_mode:
56163 out:
56164 kfree(par->vbe_modes);
56165
56166 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56167 + if (par->pmi_code)
56168 + module_free_exec(NULL, par->pmi_code);
56169 +#endif
56170 +
56171 framebuffer_release(info);
56172 return err;
56173 }
56174 @@ -1816,6 +1851,12 @@ static int uvesafb_remove(struct platform_device *dev)
56175 kfree(par->vbe_modes);
56176 kfree(par->vbe_state_orig);
56177 kfree(par->vbe_state_saved);
56178 +
56179 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56180 + if (par->pmi_code)
56181 + module_free_exec(NULL, par->pmi_code);
56182 +#endif
56183 +
56184 }
56185
56186 framebuffer_release(info);
56187 diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
56188 index 1c7da3b..56ea0bd 100644
56189 --- a/drivers/video/vesafb.c
56190 +++ b/drivers/video/vesafb.c
56191 @@ -9,6 +9,7 @@
56192 */
56193
56194 #include <linux/module.h>
56195 +#include <linux/moduleloader.h>
56196 #include <linux/kernel.h>
56197 #include <linux/errno.h>
56198 #include <linux/string.h>
56199 @@ -52,8 +53,8 @@ static int vram_remap; /* Set amount of memory to be used */
56200 static int vram_total; /* Set total amount of memory */
56201 static int pmi_setpal __read_mostly = 1; /* pmi for palette changes ??? */
56202 static int ypan __read_mostly; /* 0..nothing, 1..ypan, 2..ywrap */
56203 -static void (*pmi_start)(void) __read_mostly;
56204 -static void (*pmi_pal) (void) __read_mostly;
56205 +static void (*pmi_start)(void) __read_only;
56206 +static void (*pmi_pal) (void) __read_only;
56207 static int depth __read_mostly;
56208 static int vga_compat __read_mostly;
56209 /* --------------------------------------------------------------------- */
56210 @@ -234,6 +235,7 @@ static int vesafb_probe(struct platform_device *dev)
56211 unsigned int size_remap;
56212 unsigned int size_total;
56213 char *option = NULL;
56214 + void *pmi_code = NULL;
56215
56216 /* ignore error return of fb_get_options */
56217 fb_get_options("vesafb", &option);
56218 @@ -280,10 +282,6 @@ static int vesafb_probe(struct platform_device *dev)
56219 size_remap = size_total;
56220 vesafb_fix.smem_len = size_remap;
56221
56222 -#ifndef __i386__
56223 - screen_info.vesapm_seg = 0;
56224 -#endif
56225 -
56226 if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
56227 printk(KERN_WARNING
56228 "vesafb: cannot reserve video memory at 0x%lx\n",
56229 @@ -312,9 +310,21 @@ static int vesafb_probe(struct platform_device *dev)
56230 printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
56231 vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
56232
56233 +#ifdef __i386__
56234 +
56235 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56236 + pmi_code = module_alloc_exec(screen_info.vesapm_size);
56237 + if (!pmi_code)
56238 +#elif !defined(CONFIG_PAX_KERNEXEC)
56239 + if (0)
56240 +#endif
56241 +
56242 +#endif
56243 + screen_info.vesapm_seg = 0;
56244 +
56245 if (screen_info.vesapm_seg) {
56246 - printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
56247 - screen_info.vesapm_seg,screen_info.vesapm_off);
56248 + printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
56249 + screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
56250 }
56251
56252 if (screen_info.vesapm_seg < 0xc000)
56253 @@ -322,9 +332,25 @@ static int vesafb_probe(struct platform_device *dev)
56254
56255 if (ypan || pmi_setpal) {
56256 unsigned short *pmi_base;
56257 +
56258 pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
56259 - pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
56260 - pmi_pal = (void*)((char*)pmi_base + pmi_base[2]);
56261 +
56262 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56263 + pax_open_kernel();
56264 + memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
56265 +#else
56266 + pmi_code = pmi_base;
56267 +#endif
56268 +
56269 + pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
56270 + pmi_pal = (void*)((char*)pmi_code + pmi_base[2]);
56271 +
56272 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56273 + pmi_start = ktva_ktla(pmi_start);
56274 + pmi_pal = ktva_ktla(pmi_pal);
56275 + pax_close_kernel();
56276 +#endif
56277 +
56278 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
56279 if (pmi_base[3]) {
56280 printk(KERN_INFO "vesafb: pmi: ports = ");
56281 @@ -477,8 +503,11 @@ static int vesafb_probe(struct platform_device *dev)
56282 info->flags = FBINFO_FLAG_DEFAULT | FBINFO_MISC_FIRMWARE |
56283 (ypan ? FBINFO_HWACCEL_YPAN : 0);
56284
56285 - if (!ypan)
56286 - info->fbops->fb_pan_display = NULL;
56287 + if (!ypan) {
56288 + pax_open_kernel();
56289 + *(void **)&info->fbops->fb_pan_display = NULL;
56290 + pax_close_kernel();
56291 + }
56292
56293 if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
56294 err = -ENOMEM;
56295 @@ -492,6 +521,11 @@ static int vesafb_probe(struct platform_device *dev)
56296 fb_info(info, "%s frame buffer device\n", info->fix.id);
56297 return 0;
56298 err:
56299 +
56300 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
56301 + module_free_exec(NULL, pmi_code);
56302 +#endif
56303 +
56304 if (info->screen_base)
56305 iounmap(info->screen_base);
56306 framebuffer_release(info);
56307 diff --git a/drivers/video/via/via_clock.h b/drivers/video/via/via_clock.h
56308 index 88714ae..16c2e11 100644
56309 --- a/drivers/video/via/via_clock.h
56310 +++ b/drivers/video/via/via_clock.h
56311 @@ -56,7 +56,7 @@ struct via_clock {
56312
56313 void (*set_engine_pll_state)(u8 state);
56314 void (*set_engine_pll)(struct via_pll_config config);
56315 -};
56316 +} __no_const;
56317
56318
56319 static inline u32 get_pll_internal_frequency(u32 ref_freq,
56320 diff --git a/drivers/xen/xenfs/xenstored.c b/drivers/xen/xenfs/xenstored.c
56321 index fef20db..d28b1ab 100644
56322 --- a/drivers/xen/xenfs/xenstored.c
56323 +++ b/drivers/xen/xenfs/xenstored.c
56324 @@ -24,7 +24,12 @@ static int xsd_release(struct inode *inode, struct file *file)
56325 static int xsd_kva_open(struct inode *inode, struct file *file)
56326 {
56327 file->private_data = (void *)kasprintf(GFP_KERNEL, "0x%p",
56328 +#ifdef CONFIG_GRKERNSEC_HIDESYM
56329 + NULL);
56330 +#else
56331 xen_store_interface);
56332 +#endif
56333 +
56334 if (!file->private_data)
56335 return -ENOMEM;
56336 return 0;
56337 diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
56338 index c71e886..61d3d44b 100644
56339 --- a/fs/9p/vfs_addr.c
56340 +++ b/fs/9p/vfs_addr.c
56341 @@ -187,7 +187,7 @@ static int v9fs_vfs_writepage_locked(struct page *page)
56342
56343 retval = v9fs_file_write_internal(inode,
56344 v9inode->writeback_fid,
56345 - (__force const char __user *)buffer,
56346 + (const char __force_user *)buffer,
56347 len, &offset, 0);
56348 if (retval > 0)
56349 retval = 0;
56350 diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
56351 index bb7991c..481e21a 100644
56352 --- a/fs/9p/vfs_inode.c
56353 +++ b/fs/9p/vfs_inode.c
56354 @@ -1312,7 +1312,7 @@ static void *v9fs_vfs_follow_link(struct dentry *dentry, struct nameidata *nd)
56355 void
56356 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
56357 {
56358 - char *s = nd_get_link(nd);
56359 + const char *s = nd_get_link(nd);
56360
56361 p9_debug(P9_DEBUG_VFS, " %s %s\n",
56362 dentry->d_name.name, IS_ERR(s) ? "<error>" : s);
56363 diff --git a/fs/Kconfig.binfmt b/fs/Kconfig.binfmt
56364 index 370b24c..ff0be7b 100644
56365 --- a/fs/Kconfig.binfmt
56366 +++ b/fs/Kconfig.binfmt
56367 @@ -103,7 +103,7 @@ config HAVE_AOUT
56368
56369 config BINFMT_AOUT
56370 tristate "Kernel support for a.out and ECOFF binaries"
56371 - depends on HAVE_AOUT
56372 + depends on HAVE_AOUT && BROKEN
56373 ---help---
56374 A.out (Assembler.OUTput) is a set of formats for libraries and
56375 executables used in the earliest versions of UNIX. Linux used
56376 diff --git a/fs/affs/super.c b/fs/affs/super.c
56377 index d098731..9a5b19d 100644
56378 --- a/fs/affs/super.c
56379 +++ b/fs/affs/super.c
56380 @@ -336,8 +336,6 @@ static int affs_fill_super(struct super_block *sb, void *data, int silent)
56381 &blocksize,&sbi->s_prefix,
56382 sbi->s_volume, &mount_flags)) {
56383 printk(KERN_ERR "AFFS: Error parsing options\n");
56384 - kfree(sbi->s_prefix);
56385 - kfree(sbi);
56386 return -EINVAL;
56387 }
56388 /* N.B. after this point s_prefix must be released */
56389 diff --git a/fs/afs/inode.c b/fs/afs/inode.c
56390 index ce25d75..dc09eeb 100644
56391 --- a/fs/afs/inode.c
56392 +++ b/fs/afs/inode.c
56393 @@ -141,7 +141,7 @@ struct inode *afs_iget_autocell(struct inode *dir, const char *dev_name,
56394 struct afs_vnode *vnode;
56395 struct super_block *sb;
56396 struct inode *inode;
56397 - static atomic_t afs_autocell_ino;
56398 + static atomic_unchecked_t afs_autocell_ino;
56399
56400 _enter("{%x:%u},%*.*s,",
56401 AFS_FS_I(dir)->fid.vid, AFS_FS_I(dir)->fid.vnode,
56402 @@ -154,7 +154,7 @@ struct inode *afs_iget_autocell(struct inode *dir, const char *dev_name,
56403 data.fid.unique = 0;
56404 data.fid.vnode = 0;
56405
56406 - inode = iget5_locked(sb, atomic_inc_return(&afs_autocell_ino),
56407 + inode = iget5_locked(sb, atomic_inc_return_unchecked(&afs_autocell_ino),
56408 afs_iget5_autocell_test, afs_iget5_set,
56409 &data);
56410 if (!inode) {
56411 diff --git a/fs/aio.c b/fs/aio.c
56412 index 12a3de0e..25949c1 100644
56413 --- a/fs/aio.c
56414 +++ b/fs/aio.c
56415 @@ -375,7 +375,7 @@ static int aio_setup_ring(struct kioctx *ctx)
56416 size += sizeof(struct io_event) * nr_events;
56417
56418 nr_pages = PFN_UP(size);
56419 - if (nr_pages < 0)
56420 + if (nr_pages <= 0)
56421 return -EINVAL;
56422
56423 file = aio_private_file(ctx, nr_pages);
56424 @@ -1299,10 +1299,8 @@ rw_common:
56425 &iovec, compat)
56426 : aio_setup_single_vector(req, rw, buf, &nr_segs,
56427 iovec);
56428 - if (ret)
56429 - return ret;
56430 -
56431 - ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
56432 + if (!ret)
56433 + ret = rw_verify_area(rw, file, &req->ki_pos, req->ki_nbytes);
56434 if (ret < 0) {
56435 if (iovec != &inline_vec)
56436 kfree(iovec);
56437 diff --git a/fs/attr.c b/fs/attr.c
56438 index 5d4e59d..fd02418 100644
56439 --- a/fs/attr.c
56440 +++ b/fs/attr.c
56441 @@ -102,6 +102,7 @@ int inode_newsize_ok(const struct inode *inode, loff_t offset)
56442 unsigned long limit;
56443
56444 limit = rlimit(RLIMIT_FSIZE);
56445 + gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
56446 if (limit != RLIM_INFINITY && offset > limit)
56447 goto out_sig;
56448 if (offset > inode->i_sb->s_maxbytes)
56449 diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
56450 index 116fd38..c04182da 100644
56451 --- a/fs/autofs4/waitq.c
56452 +++ b/fs/autofs4/waitq.c
56453 @@ -59,7 +59,7 @@ static int autofs4_write(struct autofs_sb_info *sbi,
56454 {
56455 unsigned long sigpipe, flags;
56456 mm_segment_t fs;
56457 - const char *data = (const char *)addr;
56458 + const char __user *data = (const char __force_user *)addr;
56459 ssize_t wr = 0;
56460
56461 sigpipe = sigismember(&current->pending.signal, SIGPIPE);
56462 @@ -340,6 +340,10 @@ static int validate_request(struct autofs_wait_queue **wait,
56463 return 1;
56464 }
56465
56466 +#ifdef CONFIG_GRKERNSEC_HIDESYM
56467 +static atomic_unchecked_t autofs_dummy_name_id = ATOMIC_INIT(0);
56468 +#endif
56469 +
56470 int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
56471 enum autofs_notify notify)
56472 {
56473 @@ -385,7 +389,12 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
56474
56475 /* If this is a direct mount request create a dummy name */
56476 if (IS_ROOT(dentry) && autofs_type_trigger(sbi->type))
56477 +#ifdef CONFIG_GRKERNSEC_HIDESYM
56478 + /* this name does get written to userland via autofs4_write() */
56479 + qstr.len = sprintf(name, "%08x", atomic_inc_return_unchecked(&autofs_dummy_name_id));
56480 +#else
56481 qstr.len = sprintf(name, "%p", dentry);
56482 +#endif
56483 else {
56484 qstr.len = autofs4_getpath(sbi, dentry, &name);
56485 if (!qstr.len) {
56486 diff --git a/fs/befs/endian.h b/fs/befs/endian.h
56487 index 2722387..56059b5 100644
56488 --- a/fs/befs/endian.h
56489 +++ b/fs/befs/endian.h
56490 @@ -11,7 +11,7 @@
56491
56492 #include <asm/byteorder.h>
56493
56494 -static inline u64
56495 +static inline u64 __intentional_overflow(-1)
56496 fs64_to_cpu(const struct super_block *sb, fs64 n)
56497 {
56498 if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
56499 @@ -29,7 +29,7 @@ cpu_to_fs64(const struct super_block *sb, u64 n)
56500 return (__force fs64)cpu_to_be64(n);
56501 }
56502
56503 -static inline u32
56504 +static inline u32 __intentional_overflow(-1)
56505 fs32_to_cpu(const struct super_block *sb, fs32 n)
56506 {
56507 if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
56508 @@ -47,7 +47,7 @@ cpu_to_fs32(const struct super_block *sb, u32 n)
56509 return (__force fs32)cpu_to_be32(n);
56510 }
56511
56512 -static inline u16
56513 +static inline u16 __intentional_overflow(-1)
56514 fs16_to_cpu(const struct super_block *sb, fs16 n)
56515 {
56516 if (BEFS_SB(sb)->byte_order == BEFS_BYTESEX_LE)
56517 diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
56518 index ca0ba15..0fa3257 100644
56519 --- a/fs/binfmt_aout.c
56520 +++ b/fs/binfmt_aout.c
56521 @@ -16,6 +16,7 @@
56522 #include <linux/string.h>
56523 #include <linux/fs.h>
56524 #include <linux/file.h>
56525 +#include <linux/security.h>
56526 #include <linux/stat.h>
56527 #include <linux/fcntl.h>
56528 #include <linux/ptrace.h>
56529 @@ -58,6 +59,8 @@ static int aout_core_dump(struct coredump_params *cprm)
56530 #endif
56531 # define START_STACK(u) ((void __user *)u.start_stack)
56532
56533 + memset(&dump, 0, sizeof(dump));
56534 +
56535 fs = get_fs();
56536 set_fs(KERNEL_DS);
56537 has_dumped = 1;
56538 @@ -68,10 +71,12 @@ static int aout_core_dump(struct coredump_params *cprm)
56539
56540 /* If the size of the dump file exceeds the rlimit, then see what would happen
56541 if we wrote the stack, but not the data area. */
56542 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
56543 if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
56544 dump.u_dsize = 0;
56545
56546 /* Make sure we have enough room to write the stack and data areas. */
56547 + gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
56548 if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
56549 dump.u_ssize = 0;
56550
56551 @@ -232,6 +237,8 @@ static int load_aout_binary(struct linux_binprm * bprm)
56552 rlim = rlimit(RLIMIT_DATA);
56553 if (rlim >= RLIM_INFINITY)
56554 rlim = ~0;
56555 +
56556 + gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
56557 if (ex.a_data + ex.a_bss > rlim)
56558 return -ENOMEM;
56559
56560 @@ -264,6 +271,27 @@ static int load_aout_binary(struct linux_binprm * bprm)
56561
56562 install_exec_creds(bprm);
56563
56564 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
56565 + current->mm->pax_flags = 0UL;
56566 +#endif
56567 +
56568 +#ifdef CONFIG_PAX_PAGEEXEC
56569 + if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
56570 + current->mm->pax_flags |= MF_PAX_PAGEEXEC;
56571 +
56572 +#ifdef CONFIG_PAX_EMUTRAMP
56573 + if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
56574 + current->mm->pax_flags |= MF_PAX_EMUTRAMP;
56575 +#endif
56576 +
56577 +#ifdef CONFIG_PAX_MPROTECT
56578 + if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
56579 + current->mm->pax_flags |= MF_PAX_MPROTECT;
56580 +#endif
56581 +
56582 + }
56583 +#endif
56584 +
56585 if (N_MAGIC(ex) == OMAGIC) {
56586 unsigned long text_addr, map_size;
56587 loff_t pos;
56588 @@ -321,7 +349,7 @@ static int load_aout_binary(struct linux_binprm * bprm)
56589 }
56590
56591 error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
56592 - PROT_READ | PROT_WRITE | PROT_EXEC,
56593 + PROT_READ | PROT_WRITE,
56594 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
56595 fd_offset + ex.a_text);
56596 if (error != N_DATADDR(ex)) {
56597 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
56598 index 67be295..83e2f86 100644
56599 --- a/fs/binfmt_elf.c
56600 +++ b/fs/binfmt_elf.c
56601 @@ -34,6 +34,7 @@
56602 #include <linux/utsname.h>
56603 #include <linux/coredump.h>
56604 #include <linux/sched.h>
56605 +#include <linux/xattr.h>
56606 #include <asm/uaccess.h>
56607 #include <asm/param.h>
56608 #include <asm/page.h>
56609 @@ -48,7 +49,7 @@
56610 static int load_elf_binary(struct linux_binprm *bprm);
56611 static int load_elf_library(struct file *);
56612 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
56613 - int, int, unsigned long);
56614 + int, int, unsigned long) __intentional_overflow(-1);
56615
56616 /*
56617 * If we don't support core dumping, then supply a NULL so we
56618 @@ -60,6 +61,14 @@ static int elf_core_dump(struct coredump_params *cprm);
56619 #define elf_core_dump NULL
56620 #endif
56621
56622 +#ifdef CONFIG_PAX_MPROTECT
56623 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
56624 +#endif
56625 +
56626 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
56627 +static void elf_handle_mmap(struct file *file);
56628 +#endif
56629 +
56630 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
56631 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
56632 #else
56633 @@ -79,6 +88,15 @@ static struct linux_binfmt elf_format = {
56634 .load_binary = load_elf_binary,
56635 .load_shlib = load_elf_library,
56636 .core_dump = elf_core_dump,
56637 +
56638 +#ifdef CONFIG_PAX_MPROTECT
56639 + .handle_mprotect= elf_handle_mprotect,
56640 +#endif
56641 +
56642 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
56643 + .handle_mmap = elf_handle_mmap,
56644 +#endif
56645 +
56646 .min_coredump = ELF_EXEC_PAGESIZE,
56647 };
56648
56649 @@ -86,6 +104,8 @@ static struct linux_binfmt elf_format = {
56650
56651 static int set_brk(unsigned long start, unsigned long end)
56652 {
56653 + unsigned long e = end;
56654 +
56655 start = ELF_PAGEALIGN(start);
56656 end = ELF_PAGEALIGN(end);
56657 if (end > start) {
56658 @@ -94,7 +114,7 @@ static int set_brk(unsigned long start, unsigned long end)
56659 if (BAD_ADDR(addr))
56660 return addr;
56661 }
56662 - current->mm->start_brk = current->mm->brk = end;
56663 + current->mm->start_brk = current->mm->brk = e;
56664 return 0;
56665 }
56666
56667 @@ -155,12 +175,13 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
56668 elf_addr_t __user *u_rand_bytes;
56669 const char *k_platform = ELF_PLATFORM;
56670 const char *k_base_platform = ELF_BASE_PLATFORM;
56671 - unsigned char k_rand_bytes[16];
56672 + u32 k_rand_bytes[4];
56673 int items;
56674 elf_addr_t *elf_info;
56675 int ei_index = 0;
56676 const struct cred *cred = current_cred();
56677 struct vm_area_struct *vma;
56678 + unsigned long saved_auxv[AT_VECTOR_SIZE];
56679
56680 /*
56681 * In some cases (e.g. Hyper-Threading), we want to avoid L1
56682 @@ -202,8 +223,12 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
56683 * Generate 16 random bytes for userspace PRNG seeding.
56684 */
56685 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
56686 - u_rand_bytes = (elf_addr_t __user *)
56687 - STACK_ALLOC(p, sizeof(k_rand_bytes));
56688 + prandom_seed(k_rand_bytes[0] ^ prandom_u32());
56689 + prandom_seed(k_rand_bytes[1] ^ prandom_u32());
56690 + prandom_seed(k_rand_bytes[2] ^ prandom_u32());
56691 + prandom_seed(k_rand_bytes[3] ^ prandom_u32());
56692 + p = STACK_ROUND(p, sizeof(k_rand_bytes));
56693 + u_rand_bytes = (elf_addr_t __user *) p;
56694 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
56695 return -EFAULT;
56696
56697 @@ -318,9 +343,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
56698 return -EFAULT;
56699 current->mm->env_end = p;
56700
56701 + memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
56702 +
56703 /* Put the elf_info on the stack in the right place. */
56704 sp = (elf_addr_t __user *)envp + 1;
56705 - if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
56706 + if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
56707 return -EFAULT;
56708 return 0;
56709 }
56710 @@ -388,15 +415,14 @@ static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
56711 an ELF header */
56712
56713 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
56714 - struct file *interpreter, unsigned long *interp_map_addr,
56715 - unsigned long no_base)
56716 + struct file *interpreter, unsigned long no_base)
56717 {
56718 struct elf_phdr *elf_phdata;
56719 struct elf_phdr *eppnt;
56720 - unsigned long load_addr = 0;
56721 + unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
56722 int load_addr_set = 0;
56723 unsigned long last_bss = 0, elf_bss = 0;
56724 - unsigned long error = ~0UL;
56725 + unsigned long error = -EINVAL;
56726 unsigned long total_size;
56727 int retval, i, size;
56728
56729 @@ -442,6 +468,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
56730 goto out_close;
56731 }
56732
56733 +#ifdef CONFIG_PAX_SEGMEXEC
56734 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
56735 + pax_task_size = SEGMEXEC_TASK_SIZE;
56736 +#endif
56737 +
56738 eppnt = elf_phdata;
56739 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
56740 if (eppnt->p_type == PT_LOAD) {
56741 @@ -465,8 +496,6 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
56742 map_addr = elf_map(interpreter, load_addr + vaddr,
56743 eppnt, elf_prot, elf_type, total_size);
56744 total_size = 0;
56745 - if (!*interp_map_addr)
56746 - *interp_map_addr = map_addr;
56747 error = map_addr;
56748 if (BAD_ADDR(map_addr))
56749 goto out_close;
56750 @@ -485,8 +514,8 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
56751 k = load_addr + eppnt->p_vaddr;
56752 if (BAD_ADDR(k) ||
56753 eppnt->p_filesz > eppnt->p_memsz ||
56754 - eppnt->p_memsz > TASK_SIZE ||
56755 - TASK_SIZE - eppnt->p_memsz < k) {
56756 + eppnt->p_memsz > pax_task_size ||
56757 + pax_task_size - eppnt->p_memsz < k) {
56758 error = -ENOMEM;
56759 goto out_close;
56760 }
56761 @@ -525,9 +554,11 @@ static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
56762 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
56763
56764 /* Map the last of the bss segment */
56765 - error = vm_brk(elf_bss, last_bss - elf_bss);
56766 - if (BAD_ADDR(error))
56767 - goto out_close;
56768 + if (last_bss > elf_bss) {
56769 + error = vm_brk(elf_bss, last_bss - elf_bss);
56770 + if (BAD_ADDR(error))
56771 + goto out_close;
56772 + }
56773 }
56774
56775 error = load_addr;
56776 @@ -538,6 +569,336 @@ out:
56777 return error;
56778 }
56779
56780 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
56781 +#ifdef CONFIG_PAX_SOFTMODE
56782 +static unsigned long pax_parse_pt_pax_softmode(const struct elf_phdr * const elf_phdata)
56783 +{
56784 + unsigned long pax_flags = 0UL;
56785 +
56786 +#ifdef CONFIG_PAX_PAGEEXEC
56787 + if (elf_phdata->p_flags & PF_PAGEEXEC)
56788 + pax_flags |= MF_PAX_PAGEEXEC;
56789 +#endif
56790 +
56791 +#ifdef CONFIG_PAX_SEGMEXEC
56792 + if (elf_phdata->p_flags & PF_SEGMEXEC)
56793 + pax_flags |= MF_PAX_SEGMEXEC;
56794 +#endif
56795 +
56796 +#ifdef CONFIG_PAX_EMUTRAMP
56797 + if ((elf_phdata->p_flags & PF_EMUTRAMP) && (pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)))
56798 + pax_flags |= MF_PAX_EMUTRAMP;
56799 +#endif
56800 +
56801 +#ifdef CONFIG_PAX_MPROTECT
56802 + if (elf_phdata->p_flags & PF_MPROTECT)
56803 + pax_flags |= MF_PAX_MPROTECT;
56804 +#endif
56805 +
56806 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
56807 + if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
56808 + pax_flags |= MF_PAX_RANDMMAP;
56809 +#endif
56810 +
56811 + return pax_flags;
56812 +}
56813 +#endif
56814 +
56815 +static unsigned long pax_parse_pt_pax_hardmode(const struct elf_phdr * const elf_phdata)
56816 +{
56817 + unsigned long pax_flags = 0UL;
56818 +
56819 +#ifdef CONFIG_PAX_PAGEEXEC
56820 + if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
56821 + pax_flags |= MF_PAX_PAGEEXEC;
56822 +#endif
56823 +
56824 +#ifdef CONFIG_PAX_SEGMEXEC
56825 + if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
56826 + pax_flags |= MF_PAX_SEGMEXEC;
56827 +#endif
56828 +
56829 +#ifdef CONFIG_PAX_EMUTRAMP
56830 + if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
56831 + pax_flags |= MF_PAX_EMUTRAMP;
56832 +#endif
56833 +
56834 +#ifdef CONFIG_PAX_MPROTECT
56835 + if (!(elf_phdata->p_flags & PF_NOMPROTECT))
56836 + pax_flags |= MF_PAX_MPROTECT;
56837 +#endif
56838 +
56839 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
56840 + if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
56841 + pax_flags |= MF_PAX_RANDMMAP;
56842 +#endif
56843 +
56844 + return pax_flags;
56845 +}
56846 +#endif
56847 +
56848 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
56849 +#ifdef CONFIG_PAX_SOFTMODE
56850 +static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
56851 +{
56852 + unsigned long pax_flags = 0UL;
56853 +
56854 +#ifdef CONFIG_PAX_PAGEEXEC
56855 + if (pax_flags_softmode & MF_PAX_PAGEEXEC)
56856 + pax_flags |= MF_PAX_PAGEEXEC;
56857 +#endif
56858 +
56859 +#ifdef CONFIG_PAX_SEGMEXEC
56860 + if (pax_flags_softmode & MF_PAX_SEGMEXEC)
56861 + pax_flags |= MF_PAX_SEGMEXEC;
56862 +#endif
56863 +
56864 +#ifdef CONFIG_PAX_EMUTRAMP
56865 + if ((pax_flags_softmode & MF_PAX_EMUTRAMP) && (pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)))
56866 + pax_flags |= MF_PAX_EMUTRAMP;
56867 +#endif
56868 +
56869 +#ifdef CONFIG_PAX_MPROTECT
56870 + if (pax_flags_softmode & MF_PAX_MPROTECT)
56871 + pax_flags |= MF_PAX_MPROTECT;
56872 +#endif
56873 +
56874 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
56875 + if (randomize_va_space && (pax_flags_softmode & MF_PAX_RANDMMAP))
56876 + pax_flags |= MF_PAX_RANDMMAP;
56877 +#endif
56878 +
56879 + return pax_flags;
56880 +}
56881 +#endif
56882 +
56883 +static unsigned long pax_parse_xattr_pax_hardmode(unsigned long pax_flags_hardmode)
56884 +{
56885 + unsigned long pax_flags = 0UL;
56886 +
56887 +#ifdef CONFIG_PAX_PAGEEXEC
56888 + if (!(pax_flags_hardmode & MF_PAX_PAGEEXEC))
56889 + pax_flags |= MF_PAX_PAGEEXEC;
56890 +#endif
56891 +
56892 +#ifdef CONFIG_PAX_SEGMEXEC
56893 + if (!(pax_flags_hardmode & MF_PAX_SEGMEXEC))
56894 + pax_flags |= MF_PAX_SEGMEXEC;
56895 +#endif
56896 +
56897 +#ifdef CONFIG_PAX_EMUTRAMP
56898 + if (!(pax_flags_hardmode & MF_PAX_EMUTRAMP))
56899 + pax_flags |= MF_PAX_EMUTRAMP;
56900 +#endif
56901 +
56902 +#ifdef CONFIG_PAX_MPROTECT
56903 + if (!(pax_flags_hardmode & MF_PAX_MPROTECT))
56904 + pax_flags |= MF_PAX_MPROTECT;
56905 +#endif
56906 +
56907 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
56908 + if (randomize_va_space && !(pax_flags_hardmode & MF_PAX_RANDMMAP))
56909 + pax_flags |= MF_PAX_RANDMMAP;
56910 +#endif
56911 +
56912 + return pax_flags;
56913 +}
56914 +#endif
56915 +
56916 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
56917 +static unsigned long pax_parse_defaults(void)
56918 +{
56919 + unsigned long pax_flags = 0UL;
56920 +
56921 +#ifdef CONFIG_PAX_SOFTMODE
56922 + if (pax_softmode)
56923 + return pax_flags;
56924 +#endif
56925 +
56926 +#ifdef CONFIG_PAX_PAGEEXEC
56927 + pax_flags |= MF_PAX_PAGEEXEC;
56928 +#endif
56929 +
56930 +#ifdef CONFIG_PAX_SEGMEXEC
56931 + pax_flags |= MF_PAX_SEGMEXEC;
56932 +#endif
56933 +
56934 +#ifdef CONFIG_PAX_MPROTECT
56935 + pax_flags |= MF_PAX_MPROTECT;
56936 +#endif
56937 +
56938 +#ifdef CONFIG_PAX_RANDMMAP
56939 + if (randomize_va_space)
56940 + pax_flags |= MF_PAX_RANDMMAP;
56941 +#endif
56942 +
56943 + return pax_flags;
56944 +}
56945 +
56946 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
56947 +{
56948 + unsigned long pax_flags = PAX_PARSE_FLAGS_FALLBACK;
56949 +
56950 +#ifdef CONFIG_PAX_EI_PAX
56951 +
56952 +#ifdef CONFIG_PAX_SOFTMODE
56953 + if (pax_softmode)
56954 + return pax_flags;
56955 +#endif
56956 +
56957 + pax_flags = 0UL;
56958 +
56959 +#ifdef CONFIG_PAX_PAGEEXEC
56960 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
56961 + pax_flags |= MF_PAX_PAGEEXEC;
56962 +#endif
56963 +
56964 +#ifdef CONFIG_PAX_SEGMEXEC
56965 + if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
56966 + pax_flags |= MF_PAX_SEGMEXEC;
56967 +#endif
56968 +
56969 +#ifdef CONFIG_PAX_EMUTRAMP
56970 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
56971 + pax_flags |= MF_PAX_EMUTRAMP;
56972 +#endif
56973 +
56974 +#ifdef CONFIG_PAX_MPROTECT
56975 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
56976 + pax_flags |= MF_PAX_MPROTECT;
56977 +#endif
56978 +
56979 +#ifdef CONFIG_PAX_ASLR
56980 + if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
56981 + pax_flags |= MF_PAX_RANDMMAP;
56982 +#endif
56983 +
56984 +#endif
56985 +
56986 + return pax_flags;
56987 +
56988 +}
56989 +
56990 +static unsigned long pax_parse_pt_pax(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
56991 +{
56992 +
56993 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
56994 + unsigned long i;
56995 +
56996 + for (i = 0UL; i < elf_ex->e_phnum; i++)
56997 + if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
56998 + if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
56999 + ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
57000 + ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
57001 + ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
57002 + ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
57003 + return PAX_PARSE_FLAGS_FALLBACK;
57004 +
57005 +#ifdef CONFIG_PAX_SOFTMODE
57006 + if (pax_softmode)
57007 + return pax_parse_pt_pax_softmode(&elf_phdata[i]);
57008 + else
57009 +#endif
57010 +
57011 + return pax_parse_pt_pax_hardmode(&elf_phdata[i]);
57012 + break;
57013 + }
57014 +#endif
57015 +
57016 + return PAX_PARSE_FLAGS_FALLBACK;
57017 +}
57018 +
57019 +static unsigned long pax_parse_xattr_pax(struct file * const file)
57020 +{
57021 +
57022 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
57023 + ssize_t xattr_size, i;
57024 + unsigned char xattr_value[sizeof("pemrs") - 1];
57025 + unsigned long pax_flags_hardmode = 0UL, pax_flags_softmode = 0UL;
57026 +
57027 + xattr_size = pax_getxattr(file->f_path.dentry, xattr_value, sizeof xattr_value);
57028 + if (xattr_size < 0 || xattr_size > sizeof xattr_value)
57029 + return PAX_PARSE_FLAGS_FALLBACK;
57030 +
57031 + for (i = 0; i < xattr_size; i++)
57032 + switch (xattr_value[i]) {
57033 + default:
57034 + return PAX_PARSE_FLAGS_FALLBACK;
57035 +
57036 +#define parse_flag(option1, option2, flag) \
57037 + case option1: \
57038 + if (pax_flags_hardmode & MF_PAX_##flag) \
57039 + return PAX_PARSE_FLAGS_FALLBACK;\
57040 + pax_flags_hardmode |= MF_PAX_##flag; \
57041 + break; \
57042 + case option2: \
57043 + if (pax_flags_softmode & MF_PAX_##flag) \
57044 + return PAX_PARSE_FLAGS_FALLBACK;\
57045 + pax_flags_softmode |= MF_PAX_##flag; \
57046 + break;
57047 +
57048 + parse_flag('p', 'P', PAGEEXEC);
57049 + parse_flag('e', 'E', EMUTRAMP);
57050 + parse_flag('m', 'M', MPROTECT);
57051 + parse_flag('r', 'R', RANDMMAP);
57052 + parse_flag('s', 'S', SEGMEXEC);
57053 +
57054 +#undef parse_flag
57055 + }
57056 +
57057 + if (pax_flags_hardmode & pax_flags_softmode)
57058 + return PAX_PARSE_FLAGS_FALLBACK;
57059 +
57060 +#ifdef CONFIG_PAX_SOFTMODE
57061 + if (pax_softmode)
57062 + return pax_parse_xattr_pax_softmode(pax_flags_softmode);
57063 + else
57064 +#endif
57065 +
57066 + return pax_parse_xattr_pax_hardmode(pax_flags_hardmode);
57067 +#else
57068 + return PAX_PARSE_FLAGS_FALLBACK;
57069 +#endif
57070 +
57071 +}
57072 +
57073 +static long pax_parse_pax_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata, struct file * const file)
57074 +{
57075 + unsigned long pax_flags, ei_pax_flags, pt_pax_flags, xattr_pax_flags;
57076 +
57077 + pax_flags = pax_parse_defaults();
57078 + ei_pax_flags = pax_parse_ei_pax(elf_ex);
57079 + pt_pax_flags = pax_parse_pt_pax(elf_ex, elf_phdata);
57080 + xattr_pax_flags = pax_parse_xattr_pax(file);
57081 +
57082 + if (pt_pax_flags != PAX_PARSE_FLAGS_FALLBACK &&
57083 + xattr_pax_flags != PAX_PARSE_FLAGS_FALLBACK &&
57084 + pt_pax_flags != xattr_pax_flags)
57085 + return -EINVAL;
57086 + if (xattr_pax_flags != PAX_PARSE_FLAGS_FALLBACK)
57087 + pax_flags = xattr_pax_flags;
57088 + else if (pt_pax_flags != PAX_PARSE_FLAGS_FALLBACK)
57089 + pax_flags = pt_pax_flags;
57090 + else if (ei_pax_flags != PAX_PARSE_FLAGS_FALLBACK)
57091 + pax_flags = ei_pax_flags;
57092 +
57093 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
57094 + if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
57095 + if ((__supported_pte_mask & _PAGE_NX))
57096 + pax_flags &= ~MF_PAX_SEGMEXEC;
57097 + else
57098 + pax_flags &= ~MF_PAX_PAGEEXEC;
57099 + }
57100 +#endif
57101 +
57102 + if (0 > pax_check_flags(&pax_flags))
57103 + return -EINVAL;
57104 +
57105 + current->mm->pax_flags = pax_flags;
57106 + return 0;
57107 +}
57108 +#endif
57109 +
57110 /*
57111 * These are the functions used to load ELF style executables and shared
57112 * libraries. There is no binary dependent code anywhere else.
57113 @@ -551,6 +912,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
57114 {
57115 unsigned int random_variable = 0;
57116
57117 +#ifdef CONFIG_PAX_RANDUSTACK
57118 + if (current->mm->pax_flags & MF_PAX_RANDMMAP)
57119 + return stack_top - current->mm->delta_stack;
57120 +#endif
57121 +
57122 if ((current->flags & PF_RANDOMIZE) &&
57123 !(current->personality & ADDR_NO_RANDOMIZE)) {
57124 random_variable = get_random_int() & STACK_RND_MASK;
57125 @@ -569,7 +935,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
57126 unsigned long load_addr = 0, load_bias = 0;
57127 int load_addr_set = 0;
57128 char * elf_interpreter = NULL;
57129 - unsigned long error;
57130 + unsigned long error = 0;
57131 struct elf_phdr *elf_ppnt, *elf_phdata;
57132 unsigned long elf_bss, elf_brk;
57133 int retval, i;
57134 @@ -579,12 +945,12 @@ static int load_elf_binary(struct linux_binprm *bprm)
57135 unsigned long start_code, end_code, start_data, end_data;
57136 unsigned long reloc_func_desc __maybe_unused = 0;
57137 int executable_stack = EXSTACK_DEFAULT;
57138 - unsigned long def_flags = 0;
57139 struct pt_regs *regs = current_pt_regs();
57140 struct {
57141 struct elfhdr elf_ex;
57142 struct elfhdr interp_elf_ex;
57143 } *loc;
57144 + unsigned long pax_task_size;
57145
57146 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
57147 if (!loc) {
57148 @@ -720,11 +1086,82 @@ static int load_elf_binary(struct linux_binprm *bprm)
57149 goto out_free_dentry;
57150
57151 /* OK, This is the point of no return */
57152 - current->mm->def_flags = def_flags;
57153 + current->mm->def_flags = 0;
57154
57155 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
57156 may depend on the personality. */
57157 SET_PERSONALITY(loc->elf_ex);
57158 +
57159 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
57160 + current->mm->pax_flags = 0UL;
57161 +#endif
57162 +
57163 +#ifdef CONFIG_PAX_DLRESOLVE
57164 + current->mm->call_dl_resolve = 0UL;
57165 +#endif
57166 +
57167 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
57168 + current->mm->call_syscall = 0UL;
57169 +#endif
57170 +
57171 +#ifdef CONFIG_PAX_ASLR
57172 + current->mm->delta_mmap = 0UL;
57173 + current->mm->delta_stack = 0UL;
57174 +#endif
57175 +
57176 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
57177 + if (0 > pax_parse_pax_flags(&loc->elf_ex, elf_phdata, bprm->file)) {
57178 + send_sig(SIGKILL, current, 0);
57179 + goto out_free_dentry;
57180 + }
57181 +#endif
57182 +
57183 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
57184 + pax_set_initial_flags(bprm);
57185 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
57186 + if (pax_set_initial_flags_func)
57187 + (pax_set_initial_flags_func)(bprm);
57188 +#endif
57189 +
57190 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
57191 + if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
57192 + current->mm->context.user_cs_limit = PAGE_SIZE;
57193 + current->mm->def_flags |= VM_PAGEEXEC | VM_NOHUGEPAGE;
57194 + }
57195 +#endif
57196 +
57197 +#ifdef CONFIG_PAX_SEGMEXEC
57198 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
57199 + current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
57200 + current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
57201 + pax_task_size = SEGMEXEC_TASK_SIZE;
57202 + current->mm->def_flags |= VM_NOHUGEPAGE;
57203 + } else
57204 +#endif
57205 +
57206 + pax_task_size = TASK_SIZE;
57207 +
57208 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
57209 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
57210 + set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
57211 + put_cpu();
57212 + }
57213 +#endif
57214 +
57215 +#ifdef CONFIG_PAX_ASLR
57216 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
57217 + current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
57218 + current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
57219 + }
57220 +#endif
57221 +
57222 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
57223 + if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
57224 + executable_stack = EXSTACK_DISABLE_X;
57225 + current->personality &= ~READ_IMPLIES_EXEC;
57226 + } else
57227 +#endif
57228 +
57229 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
57230 current->personality |= READ_IMPLIES_EXEC;
57231
57232 @@ -814,6 +1251,20 @@ static int load_elf_binary(struct linux_binprm *bprm)
57233 #else
57234 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
57235 #endif
57236 +
57237 +#ifdef CONFIG_PAX_RANDMMAP
57238 + /* PaX: randomize base address at the default exe base if requested */
57239 + if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
57240 +#ifdef CONFIG_SPARC64
57241 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
57242 +#else
57243 + load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
57244 +#endif
57245 + load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
57246 + elf_flags |= MAP_FIXED;
57247 + }
57248 +#endif
57249 +
57250 }
57251
57252 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
57253 @@ -846,9 +1297,9 @@ static int load_elf_binary(struct linux_binprm *bprm)
57254 * allowed task size. Note that p_filesz must always be
57255 * <= p_memsz so it is only necessary to check p_memsz.
57256 */
57257 - if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
57258 - elf_ppnt->p_memsz > TASK_SIZE ||
57259 - TASK_SIZE - elf_ppnt->p_memsz < k) {
57260 + if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
57261 + elf_ppnt->p_memsz > pax_task_size ||
57262 + pax_task_size - elf_ppnt->p_memsz < k) {
57263 /* set_brk can never work. Avoid overflows. */
57264 send_sig(SIGKILL, current, 0);
57265 retval = -EINVAL;
57266 @@ -887,17 +1338,45 @@ static int load_elf_binary(struct linux_binprm *bprm)
57267 goto out_free_dentry;
57268 }
57269 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
57270 - send_sig(SIGSEGV, current, 0);
57271 - retval = -EFAULT; /* Nobody gets to see this, but.. */
57272 - goto out_free_dentry;
57273 + /*
57274 + * This bss-zeroing can fail if the ELF
57275 + * file specifies odd protections. So
57276 + * we don't check the return value
57277 + */
57278 }
57279
57280 +#ifdef CONFIG_PAX_RANDMMAP
57281 + if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
57282 + unsigned long start, size, flags;
57283 + vm_flags_t vm_flags;
57284 +
57285 + start = ELF_PAGEALIGN(elf_brk);
57286 + size = PAGE_SIZE + ((pax_get_random_long() & ((1UL << 22) - 1UL)) << 4);
57287 + flags = MAP_FIXED | MAP_PRIVATE;
57288 + vm_flags = VM_DONTEXPAND | VM_DONTDUMP;
57289 +
57290 + down_write(&current->mm->mmap_sem);
57291 + start = get_unmapped_area(NULL, start, PAGE_ALIGN(size), 0, flags);
57292 + retval = -ENOMEM;
57293 + if (!IS_ERR_VALUE(start) && !find_vma_intersection(current->mm, start, start + size + PAGE_SIZE)) {
57294 +// if (current->personality & ADDR_NO_RANDOMIZE)
57295 +// vm_flags |= VM_READ | VM_MAYREAD;
57296 + start = mmap_region(NULL, start, PAGE_ALIGN(size), vm_flags, 0);
57297 + retval = IS_ERR_VALUE(start) ? start : 0;
57298 + }
57299 + up_write(&current->mm->mmap_sem);
57300 + if (retval == 0)
57301 + retval = set_brk(start + size, start + size + PAGE_SIZE);
57302 + if (retval < 0) {
57303 + send_sig(SIGKILL, current, 0);
57304 + goto out_free_dentry;
57305 + }
57306 + }
57307 +#endif
57308 +
57309 if (elf_interpreter) {
57310 - unsigned long interp_map_addr = 0;
57311 -
57312 elf_entry = load_elf_interp(&loc->interp_elf_ex,
57313 interpreter,
57314 - &interp_map_addr,
57315 load_bias);
57316 if (!IS_ERR((void *)elf_entry)) {
57317 /*
57318 @@ -1119,7 +1598,7 @@ static bool always_dump_vma(struct vm_area_struct *vma)
57319 * Decide what to dump of a segment, part, all or none.
57320 */
57321 static unsigned long vma_dump_size(struct vm_area_struct *vma,
57322 - unsigned long mm_flags)
57323 + unsigned long mm_flags, long signr)
57324 {
57325 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
57326
57327 @@ -1157,7 +1636,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
57328 if (vma->vm_file == NULL)
57329 return 0;
57330
57331 - if (FILTER(MAPPED_PRIVATE))
57332 + if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
57333 goto whole;
57334
57335 /*
57336 @@ -1364,9 +1843,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
57337 {
57338 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
57339 int i = 0;
57340 - do
57341 + do {
57342 i += 2;
57343 - while (auxv[i - 2] != AT_NULL);
57344 + } while (auxv[i - 2] != AT_NULL);
57345 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
57346 }
57347
57348 @@ -1375,7 +1854,7 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
57349 {
57350 mm_segment_t old_fs = get_fs();
57351 set_fs(KERNEL_DS);
57352 - copy_siginfo_to_user((user_siginfo_t __user *) csigdata, siginfo);
57353 + copy_siginfo_to_user((user_siginfo_t __force_user *) csigdata, siginfo);
57354 set_fs(old_fs);
57355 fill_note(note, "CORE", NT_SIGINFO, sizeof(*csigdata), csigdata);
57356 }
57357 @@ -1999,14 +2478,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
57358 }
57359
57360 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
57361 - unsigned long mm_flags)
57362 + struct coredump_params *cprm)
57363 {
57364 struct vm_area_struct *vma;
57365 size_t size = 0;
57366
57367 for (vma = first_vma(current, gate_vma); vma != NULL;
57368 vma = next_vma(vma, gate_vma))
57369 - size += vma_dump_size(vma, mm_flags);
57370 + size += vma_dump_size(vma, cprm->mm_flags, cprm->siginfo->si_signo);
57371 return size;
57372 }
57373
57374 @@ -2097,7 +2576,7 @@ static int elf_core_dump(struct coredump_params *cprm)
57375
57376 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
57377
57378 - offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
57379 + offset += elf_core_vma_data_size(gate_vma, cprm);
57380 offset += elf_core_extra_data_size();
57381 e_shoff = offset;
57382
57383 @@ -2125,7 +2604,7 @@ static int elf_core_dump(struct coredump_params *cprm)
57384 phdr.p_offset = offset;
57385 phdr.p_vaddr = vma->vm_start;
57386 phdr.p_paddr = 0;
57387 - phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
57388 + phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags, cprm->siginfo->si_signo);
57389 phdr.p_memsz = vma->vm_end - vma->vm_start;
57390 offset += phdr.p_filesz;
57391 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
57392 @@ -2158,7 +2637,7 @@ static int elf_core_dump(struct coredump_params *cprm)
57393 unsigned long addr;
57394 unsigned long end;
57395
57396 - end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
57397 + end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags, cprm->siginfo->si_signo);
57398
57399 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
57400 struct page *page;
57401 @@ -2199,6 +2678,167 @@ out:
57402
57403 #endif /* CONFIG_ELF_CORE */
57404
57405 +#ifdef CONFIG_PAX_MPROTECT
57406 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
57407 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
57408 + * we'll remove VM_MAYWRITE for good on RELRO segments.
57409 + *
57410 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
57411 + * basis because we want to allow the common case and not the special ones.
57412 + */
57413 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
57414 +{
57415 + struct elfhdr elf_h;
57416 + struct elf_phdr elf_p;
57417 + unsigned long i;
57418 + unsigned long oldflags;
57419 + bool is_textrel_rw, is_textrel_rx, is_relro;
57420 +
57421 + if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT) || !vma->vm_file)
57422 + return;
57423 +
57424 + oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
57425 + newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
57426 +
57427 +#ifdef CONFIG_PAX_ELFRELOCS
57428 + /* possible TEXTREL */
57429 + is_textrel_rw = !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
57430 + is_textrel_rx = vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
57431 +#else
57432 + is_textrel_rw = false;
57433 + is_textrel_rx = false;
57434 +#endif
57435 +
57436 + /* possible RELRO */
57437 + is_relro = vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
57438 +
57439 + if (!is_textrel_rw && !is_textrel_rx && !is_relro)
57440 + return;
57441 +
57442 + if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
57443 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
57444 +
57445 +#ifdef CONFIG_PAX_ETEXECRELOCS
57446 + ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
57447 +#else
57448 + ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
57449 +#endif
57450 +
57451 + (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
57452 + !elf_check_arch(&elf_h) ||
57453 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
57454 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
57455 + return;
57456 +
57457 + for (i = 0UL; i < elf_h.e_phnum; i++) {
57458 + if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
57459 + return;
57460 + switch (elf_p.p_type) {
57461 + case PT_DYNAMIC:
57462 + if (!is_textrel_rw && !is_textrel_rx)
57463 + continue;
57464 + i = 0UL;
57465 + while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
57466 + elf_dyn dyn;
57467 +
57468 + if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
57469 + break;
57470 + if (dyn.d_tag == DT_NULL)
57471 + break;
57472 + if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
57473 + gr_log_textrel(vma);
57474 + if (is_textrel_rw)
57475 + vma->vm_flags |= VM_MAYWRITE;
57476 + else
57477 + /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
57478 + vma->vm_flags &= ~VM_MAYWRITE;
57479 + break;
57480 + }
57481 + i++;
57482 + }
57483 + is_textrel_rw = false;
57484 + is_textrel_rx = false;
57485 + continue;
57486 +
57487 + case PT_GNU_RELRO:
57488 + if (!is_relro)
57489 + continue;
57490 + if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
57491 + vma->vm_flags &= ~VM_MAYWRITE;
57492 + is_relro = false;
57493 + continue;
57494 +
57495 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
57496 + case PT_PAX_FLAGS: {
57497 + const char *msg_mprotect = "", *msg_emutramp = "";
57498 + char *buffer_lib, *buffer_exe;
57499 +
57500 + if (elf_p.p_flags & PF_NOMPROTECT)
57501 + msg_mprotect = "MPROTECT disabled";
57502 +
57503 +#ifdef CONFIG_PAX_EMUTRAMP
57504 + if (!(vma->vm_mm->pax_flags & MF_PAX_EMUTRAMP) && !(elf_p.p_flags & PF_NOEMUTRAMP))
57505 + msg_emutramp = "EMUTRAMP enabled";
57506 +#endif
57507 +
57508 + if (!msg_mprotect[0] && !msg_emutramp[0])
57509 + continue;
57510 +
57511 + if (!printk_ratelimit())
57512 + continue;
57513 +
57514 + buffer_lib = (char *)__get_free_page(GFP_KERNEL);
57515 + buffer_exe = (char *)__get_free_page(GFP_KERNEL);
57516 + if (buffer_lib && buffer_exe) {
57517 + char *path_lib, *path_exe;
57518 +
57519 + path_lib = pax_get_path(&vma->vm_file->f_path, buffer_lib, PAGE_SIZE);
57520 + path_exe = pax_get_path(&vma->vm_mm->exe_file->f_path, buffer_exe, PAGE_SIZE);
57521 +
57522 + pr_info("PAX: %s wants %s%s%s on %s\n", path_lib, msg_mprotect,
57523 + (msg_mprotect[0] && msg_emutramp[0] ? " and " : ""), msg_emutramp, path_exe);
57524 +
57525 + }
57526 + free_page((unsigned long)buffer_exe);
57527 + free_page((unsigned long)buffer_lib);
57528 + continue;
57529 + }
57530 +#endif
57531 +
57532 + }
57533 + }
57534 +}
57535 +#endif
57536 +
57537 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
57538 +
57539 +extern int grsec_enable_log_rwxmaps;
57540 +
57541 +static void elf_handle_mmap(struct file *file)
57542 +{
57543 + struct elfhdr elf_h;
57544 + struct elf_phdr elf_p;
57545 + unsigned long i;
57546 +
57547 + if (!grsec_enable_log_rwxmaps)
57548 + return;
57549 +
57550 + if (sizeof(elf_h) != kernel_read(file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
57551 + memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
57552 + (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC) || !elf_check_arch(&elf_h) ||
57553 + elf_h.e_phentsize != sizeof(struct elf_phdr) ||
57554 + elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
57555 + return;
57556 +
57557 + for (i = 0UL; i < elf_h.e_phnum; i++) {
57558 + if (sizeof(elf_p) != kernel_read(file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
57559 + return;
57560 + if (elf_p.p_type == PT_GNU_STACK && (elf_p.p_flags & PF_X))
57561 + gr_log_ptgnustack(file);
57562 + }
57563 +}
57564 +#endif
57565 +
57566 static int __init init_elf_binfmt(void)
57567 {
57568 register_binfmt(&elf_format);
57569 diff --git a/fs/bio.c b/fs/bio.c
57570 index 8754e7b..0669094 100644
57571 --- a/fs/bio.c
57572 +++ b/fs/bio.c
57573 @@ -1145,7 +1145,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
57574 /*
57575 * Overflow, abort
57576 */
57577 - if (end < start)
57578 + if (end < start || end - start > INT_MAX - nr_pages)
57579 return ERR_PTR(-EINVAL);
57580
57581 nr_pages += end - start;
57582 @@ -1279,7 +1279,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
57583 /*
57584 * Overflow, abort
57585 */
57586 - if (end < start)
57587 + if (end < start || end - start > INT_MAX - nr_pages)
57588 return ERR_PTR(-EINVAL);
57589
57590 nr_pages += end - start;
57591 @@ -1541,7 +1541,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
57592 const int read = bio_data_dir(bio) == READ;
57593 struct bio_map_data *bmd = bio->bi_private;
57594 int i;
57595 - char *p = bmd->sgvecs[0].iov_base;
57596 + char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
57597
57598 bio_for_each_segment_all(bvec, bio, i) {
57599 char *addr = page_address(bvec->bv_page);
57600 diff --git a/fs/block_dev.c b/fs/block_dev.c
57601 index 1e86823..8e34695 100644
57602 --- a/fs/block_dev.c
57603 +++ b/fs/block_dev.c
57604 @@ -637,7 +637,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
57605 else if (bdev->bd_contains == bdev)
57606 return true; /* is a whole device which isn't held */
57607
57608 - else if (whole->bd_holder == bd_may_claim)
57609 + else if (whole->bd_holder == (void *)bd_may_claim)
57610 return true; /* is a partition of a device that is being partitioned */
57611 else if (whole->bd_holder != NULL)
57612 return false; /* is a partition of a held device */
57613 diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
57614 index cbd3a7d6f..c6a2881 100644
57615 --- a/fs/btrfs/ctree.c
57616 +++ b/fs/btrfs/ctree.c
57617 @@ -1216,9 +1216,12 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
57618 free_extent_buffer(buf);
57619 add_root_to_dirty_list(root);
57620 } else {
57621 - if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
57622 - parent_start = parent->start;
57623 - else
57624 + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
57625 + if (parent)
57626 + parent_start = parent->start;
57627 + else
57628 + parent_start = 0;
57629 + } else
57630 parent_start = 0;
57631
57632 WARN_ON(trans->transid != btrfs_header_generation(parent));
57633 diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
57634 index 451b00c..a2cccee 100644
57635 --- a/fs/btrfs/delayed-inode.c
57636 +++ b/fs/btrfs/delayed-inode.c
57637 @@ -459,7 +459,7 @@ static int __btrfs_add_delayed_deletion_item(struct btrfs_delayed_node *node,
57638
57639 static void finish_one_item(struct btrfs_delayed_root *delayed_root)
57640 {
57641 - int seq = atomic_inc_return(&delayed_root->items_seq);
57642 + int seq = atomic_inc_return_unchecked(&delayed_root->items_seq);
57643 if ((atomic_dec_return(&delayed_root->items) <
57644 BTRFS_DELAYED_BACKGROUND || seq % BTRFS_DELAYED_BATCH == 0) &&
57645 waitqueue_active(&delayed_root->wait))
57646 @@ -1409,7 +1409,7 @@ void btrfs_assert_delayed_root_empty(struct btrfs_root *root)
57647
57648 static int could_end_wait(struct btrfs_delayed_root *delayed_root, int seq)
57649 {
57650 - int val = atomic_read(&delayed_root->items_seq);
57651 + int val = atomic_read_unchecked(&delayed_root->items_seq);
57652
57653 if (val < seq || val >= seq + BTRFS_DELAYED_BATCH)
57654 return 1;
57655 @@ -1433,7 +1433,7 @@ void btrfs_balance_delayed_items(struct btrfs_root *root)
57656 int seq;
57657 int ret;
57658
57659 - seq = atomic_read(&delayed_root->items_seq);
57660 + seq = atomic_read_unchecked(&delayed_root->items_seq);
57661
57662 ret = btrfs_wq_run_delayed_node(delayed_root, root, 0);
57663 if (ret)
57664 diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
57665 index f70119f..ab5894d 100644
57666 --- a/fs/btrfs/delayed-inode.h
57667 +++ b/fs/btrfs/delayed-inode.h
57668 @@ -43,7 +43,7 @@ struct btrfs_delayed_root {
57669 */
57670 struct list_head prepare_list;
57671 atomic_t items; /* for delayed items */
57672 - atomic_t items_seq; /* for delayed items */
57673 + atomic_unchecked_t items_seq; /* for delayed items */
57674 int nodes; /* for delayed nodes */
57675 wait_queue_head_t wait;
57676 };
57677 @@ -90,7 +90,7 @@ static inline void btrfs_init_delayed_root(
57678 struct btrfs_delayed_root *delayed_root)
57679 {
57680 atomic_set(&delayed_root->items, 0);
57681 - atomic_set(&delayed_root->items_seq, 0);
57682 + atomic_set_unchecked(&delayed_root->items_seq, 0);
57683 delayed_root->nodes = 0;
57684 spin_lock_init(&delayed_root->lock);
57685 init_waitqueue_head(&delayed_root->wait);
57686 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
57687 index a6d8efa..2f062cf 100644
57688 --- a/fs/btrfs/ioctl.c
57689 +++ b/fs/btrfs/ioctl.c
57690 @@ -3491,9 +3491,12 @@ static long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
57691 for (i = 0; i < num_types; i++) {
57692 struct btrfs_space_info *tmp;
57693
57694 + /* Don't copy in more than we allocated */
57695 if (!slot_count)
57696 break;
57697
57698 + slot_count--;
57699 +
57700 info = NULL;
57701 rcu_read_lock();
57702 list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
57703 @@ -3515,10 +3518,7 @@ static long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
57704 memcpy(dest, &space, sizeof(space));
57705 dest++;
57706 space_args.total_spaces++;
57707 - slot_count--;
57708 }
57709 - if (!slot_count)
57710 - break;
57711 }
57712 up_read(&info->groups_sem);
57713 }
57714 diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
57715 index d04db81..96e54f1 100644
57716 --- a/fs/btrfs/super.c
57717 +++ b/fs/btrfs/super.c
57718 @@ -268,7 +268,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
57719 function, line, errstr);
57720 return;
57721 }
57722 - ACCESS_ONCE(trans->transaction->aborted) = errno;
57723 + ACCESS_ONCE_RW(trans->transaction->aborted) = errno;
57724 /* Wake up anybody who may be waiting on this transaction */
57725 wake_up(&root->fs_info->transaction_wait);
57726 wake_up(&root->fs_info->transaction_blocked_wait);
57727 diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
57728 index 865f4cf..f321e86 100644
57729 --- a/fs/btrfs/sysfs.c
57730 +++ b/fs/btrfs/sysfs.c
57731 @@ -436,7 +436,7 @@ static int addrm_unknown_feature_attrs(struct btrfs_fs_info *fs_info, bool add)
57732 for (set = 0; set < FEAT_MAX; set++) {
57733 int i;
57734 struct attribute *attrs[2];
57735 - struct attribute_group agroup = {
57736 + attribute_group_no_const agroup = {
57737 .name = "features",
57738 .attrs = attrs,
57739 };
57740 diff --git a/fs/buffer.c b/fs/buffer.c
57741 index 27265a8..289f488 100644
57742 --- a/fs/buffer.c
57743 +++ b/fs/buffer.c
57744 @@ -3428,7 +3428,7 @@ void __init buffer_init(void)
57745 bh_cachep = kmem_cache_create("buffer_head",
57746 sizeof(struct buffer_head), 0,
57747 (SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
57748 - SLAB_MEM_SPREAD),
57749 + SLAB_MEM_SPREAD|SLAB_NO_SANITIZE),
57750 NULL);
57751
57752 /*
57753 diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
57754 index 622f469..e8d2d55 100644
57755 --- a/fs/cachefiles/bind.c
57756 +++ b/fs/cachefiles/bind.c
57757 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
57758 args);
57759
57760 /* start by checking things over */
57761 - ASSERT(cache->fstop_percent >= 0 &&
57762 - cache->fstop_percent < cache->fcull_percent &&
57763 + ASSERT(cache->fstop_percent < cache->fcull_percent &&
57764 cache->fcull_percent < cache->frun_percent &&
57765 cache->frun_percent < 100);
57766
57767 - ASSERT(cache->bstop_percent >= 0 &&
57768 - cache->bstop_percent < cache->bcull_percent &&
57769 + ASSERT(cache->bstop_percent < cache->bcull_percent &&
57770 cache->bcull_percent < cache->brun_percent &&
57771 cache->brun_percent < 100);
57772
57773 diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
57774 index 0a1467b..6a53245 100644
57775 --- a/fs/cachefiles/daemon.c
57776 +++ b/fs/cachefiles/daemon.c
57777 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(struct file *file, char __user *_buffer,
57778 if (n > buflen)
57779 return -EMSGSIZE;
57780
57781 - if (copy_to_user(_buffer, buffer, n) != 0)
57782 + if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
57783 return -EFAULT;
57784
57785 return n;
57786 @@ -222,7 +222,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
57787 if (test_bit(CACHEFILES_DEAD, &cache->flags))
57788 return -EIO;
57789
57790 - if (datalen < 0 || datalen > PAGE_SIZE - 1)
57791 + if (datalen > PAGE_SIZE - 1)
57792 return -EOPNOTSUPP;
57793
57794 /* drag the command string into the kernel so we can parse it */
57795 @@ -386,7 +386,7 @@ static int cachefiles_daemon_fstop(struct cachefiles_cache *cache, char *args)
57796 if (args[0] != '%' || args[1] != '\0')
57797 return -EINVAL;
57798
57799 - if (fstop < 0 || fstop >= cache->fcull_percent)
57800 + if (fstop >= cache->fcull_percent)
57801 return cachefiles_daemon_range_error(cache, args);
57802
57803 cache->fstop_percent = fstop;
57804 @@ -458,7 +458,7 @@ static int cachefiles_daemon_bstop(struct cachefiles_cache *cache, char *args)
57805 if (args[0] != '%' || args[1] != '\0')
57806 return -EINVAL;
57807
57808 - if (bstop < 0 || bstop >= cache->bcull_percent)
57809 + if (bstop >= cache->bcull_percent)
57810 return cachefiles_daemon_range_error(cache, args);
57811
57812 cache->bstop_percent = bstop;
57813 diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
57814 index 5349473..d6c0b93 100644
57815 --- a/fs/cachefiles/internal.h
57816 +++ b/fs/cachefiles/internal.h
57817 @@ -59,7 +59,7 @@ struct cachefiles_cache {
57818 wait_queue_head_t daemon_pollwq; /* poll waitqueue for daemon */
57819 struct rb_root active_nodes; /* active nodes (can't be culled) */
57820 rwlock_t active_lock; /* lock for active_nodes */
57821 - atomic_t gravecounter; /* graveyard uniquifier */
57822 + atomic_unchecked_t gravecounter; /* graveyard uniquifier */
57823 unsigned frun_percent; /* when to stop culling (% files) */
57824 unsigned fcull_percent; /* when to start culling (% files) */
57825 unsigned fstop_percent; /* when to stop allocating (% files) */
57826 @@ -171,19 +171,19 @@ extern int cachefiles_check_in_use(struct cachefiles_cache *cache,
57827 * proc.c
57828 */
57829 #ifdef CONFIG_CACHEFILES_HISTOGRAM
57830 -extern atomic_t cachefiles_lookup_histogram[HZ];
57831 -extern atomic_t cachefiles_mkdir_histogram[HZ];
57832 -extern atomic_t cachefiles_create_histogram[HZ];
57833 +extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
57834 +extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
57835 +extern atomic_unchecked_t cachefiles_create_histogram[HZ];
57836
57837 extern int __init cachefiles_proc_init(void);
57838 extern void cachefiles_proc_cleanup(void);
57839 static inline
57840 -void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
57841 +void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
57842 {
57843 unsigned long jif = jiffies - start_jif;
57844 if (jif >= HZ)
57845 jif = HZ - 1;
57846 - atomic_inc(&histogram[jif]);
57847 + atomic_inc_unchecked(&histogram[jif]);
57848 }
57849
57850 #else
57851 diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
57852 index ca65f39..48921e3 100644
57853 --- a/fs/cachefiles/namei.c
57854 +++ b/fs/cachefiles/namei.c
57855 @@ -317,7 +317,7 @@ try_again:
57856 /* first step is to make up a grave dentry in the graveyard */
57857 sprintf(nbuffer, "%08x%08x",
57858 (uint32_t) get_seconds(),
57859 - (uint32_t) atomic_inc_return(&cache->gravecounter));
57860 + (uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
57861
57862 /* do the multiway lock magic */
57863 trap = lock_rename(cache->graveyard, dir);
57864 diff --git a/fs/cachefiles/proc.c b/fs/cachefiles/proc.c
57865 index eccd339..4c1d995 100644
57866 --- a/fs/cachefiles/proc.c
57867 +++ b/fs/cachefiles/proc.c
57868 @@ -14,9 +14,9 @@
57869 #include <linux/seq_file.h>
57870 #include "internal.h"
57871
57872 -atomic_t cachefiles_lookup_histogram[HZ];
57873 -atomic_t cachefiles_mkdir_histogram[HZ];
57874 -atomic_t cachefiles_create_histogram[HZ];
57875 +atomic_unchecked_t cachefiles_lookup_histogram[HZ];
57876 +atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
57877 +atomic_unchecked_t cachefiles_create_histogram[HZ];
57878
57879 /*
57880 * display the latency histogram
57881 @@ -35,9 +35,9 @@ static int cachefiles_histogram_show(struct seq_file *m, void *v)
57882 return 0;
57883 default:
57884 index = (unsigned long) v - 3;
57885 - x = atomic_read(&cachefiles_lookup_histogram[index]);
57886 - y = atomic_read(&cachefiles_mkdir_histogram[index]);
57887 - z = atomic_read(&cachefiles_create_histogram[index]);
57888 + x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
57889 + y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
57890 + z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
57891 if (x == 0 && y == 0 && z == 0)
57892 return 0;
57893
57894 diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
57895 index ebaff36..7e3ea26 100644
57896 --- a/fs/cachefiles/rdwr.c
57897 +++ b/fs/cachefiles/rdwr.c
57898 @@ -950,7 +950,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
57899 old_fs = get_fs();
57900 set_fs(KERNEL_DS);
57901 ret = file->f_op->write(
57902 - file, (const void __user *) data, len, &pos);
57903 + file, (const void __force_user *) data, len, &pos);
57904 set_fs(old_fs);
57905 kunmap(page);
57906 file_end_write(file);
57907 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
57908 index 45eda6d..9126f7f 100644
57909 --- a/fs/ceph/dir.c
57910 +++ b/fs/ceph/dir.c
57911 @@ -248,7 +248,7 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
57912 struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
57913 struct ceph_mds_client *mdsc = fsc->mdsc;
57914 unsigned frag = fpos_frag(ctx->pos);
57915 - int off = fpos_off(ctx->pos);
57916 + unsigned int off = fpos_off(ctx->pos);
57917 int err;
57918 u32 ftype;
57919 struct ceph_mds_reply_info_parsed *rinfo;
57920 diff --git a/fs/ceph/super.c b/fs/ceph/super.c
57921 index 10a4ccb..92dbc5e 100644
57922 --- a/fs/ceph/super.c
57923 +++ b/fs/ceph/super.c
57924 @@ -895,7 +895,7 @@ static int ceph_compare_super(struct super_block *sb, void *data)
57925 /*
57926 * construct our own bdi so we can control readahead, etc.
57927 */
57928 -static atomic_long_t bdi_seq = ATOMIC_LONG_INIT(0);
57929 +static atomic_long_unchecked_t bdi_seq = ATOMIC_LONG_INIT(0);
57930
57931 static int ceph_register_bdi(struct super_block *sb,
57932 struct ceph_fs_client *fsc)
57933 @@ -912,7 +912,7 @@ static int ceph_register_bdi(struct super_block *sb,
57934 default_backing_dev_info.ra_pages;
57935
57936 err = bdi_register(&fsc->backing_dev_info, NULL, "ceph-%ld",
57937 - atomic_long_inc_return(&bdi_seq));
57938 + atomic_long_inc_return_unchecked(&bdi_seq));
57939 if (!err)
57940 sb->s_bdi = &fsc->backing_dev_info;
57941 return err;
57942 diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
57943 index f3ac415..3d2420c 100644
57944 --- a/fs/cifs/cifs_debug.c
57945 +++ b/fs/cifs/cifs_debug.c
57946 @@ -286,8 +286,8 @@ static ssize_t cifs_stats_proc_write(struct file *file,
57947
57948 if (c == '1' || c == 'y' || c == 'Y' || c == '0') {
57949 #ifdef CONFIG_CIFS_STATS2
57950 - atomic_set(&totBufAllocCount, 0);
57951 - atomic_set(&totSmBufAllocCount, 0);
57952 + atomic_set_unchecked(&totBufAllocCount, 0);
57953 + atomic_set_unchecked(&totSmBufAllocCount, 0);
57954 #endif /* CONFIG_CIFS_STATS2 */
57955 spin_lock(&cifs_tcp_ses_lock);
57956 list_for_each(tmp1, &cifs_tcp_ses_list) {
57957 @@ -300,7 +300,7 @@ static ssize_t cifs_stats_proc_write(struct file *file,
57958 tcon = list_entry(tmp3,
57959 struct cifs_tcon,
57960 tcon_list);
57961 - atomic_set(&tcon->num_smbs_sent, 0);
57962 + atomic_set_unchecked(&tcon->num_smbs_sent, 0);
57963 if (server->ops->clear_stats)
57964 server->ops->clear_stats(tcon);
57965 }
57966 @@ -332,8 +332,8 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
57967 smBufAllocCount.counter, cifs_min_small);
57968 #ifdef CONFIG_CIFS_STATS2
57969 seq_printf(m, "Total Large %d Small %d Allocations\n",
57970 - atomic_read(&totBufAllocCount),
57971 - atomic_read(&totSmBufAllocCount));
57972 + atomic_read_unchecked(&totBufAllocCount),
57973 + atomic_read_unchecked(&totSmBufAllocCount));
57974 #endif /* CONFIG_CIFS_STATS2 */
57975
57976 seq_printf(m, "Operations (MIDs): %d\n", atomic_read(&midCount));
57977 @@ -362,7 +362,7 @@ static int cifs_stats_proc_show(struct seq_file *m, void *v)
57978 if (tcon->need_reconnect)
57979 seq_puts(m, "\tDISCONNECTED ");
57980 seq_printf(m, "\nSMBs: %d",
57981 - atomic_read(&tcon->num_smbs_sent));
57982 + atomic_read_unchecked(&tcon->num_smbs_sent));
57983 if (server->ops->print_stats)
57984 server->ops->print_stats(m, tcon);
57985 }
57986 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
57987 index 7c6b73c..a8f0db2 100644
57988 --- a/fs/cifs/cifsfs.c
57989 +++ b/fs/cifs/cifsfs.c
57990 @@ -1068,7 +1068,7 @@ cifs_init_request_bufs(void)
57991 */
57992 cifs_req_cachep = kmem_cache_create("cifs_request",
57993 CIFSMaxBufSize + max_hdr_size, 0,
57994 - SLAB_HWCACHE_ALIGN, NULL);
57995 + SLAB_HWCACHE_ALIGN | SLAB_USERCOPY, NULL);
57996 if (cifs_req_cachep == NULL)
57997 return -ENOMEM;
57998
57999 @@ -1095,7 +1095,7 @@ cifs_init_request_bufs(void)
58000 efficient to alloc 1 per page off the slab compared to 17K (5page)
58001 alloc of large cifs buffers even when page debugging is on */
58002 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq",
58003 - MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
58004 + MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN | SLAB_USERCOPY,
58005 NULL);
58006 if (cifs_sm_req_cachep == NULL) {
58007 mempool_destroy(cifs_req_poolp);
58008 @@ -1180,8 +1180,8 @@ init_cifs(void)
58009 atomic_set(&bufAllocCount, 0);
58010 atomic_set(&smBufAllocCount, 0);
58011 #ifdef CONFIG_CIFS_STATS2
58012 - atomic_set(&totBufAllocCount, 0);
58013 - atomic_set(&totSmBufAllocCount, 0);
58014 + atomic_set_unchecked(&totBufAllocCount, 0);
58015 + atomic_set_unchecked(&totSmBufAllocCount, 0);
58016 #endif /* CONFIG_CIFS_STATS2 */
58017
58018 atomic_set(&midCount, 0);
58019 diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
58020 index 30f6e92..e915ba5 100644
58021 --- a/fs/cifs/cifsglob.h
58022 +++ b/fs/cifs/cifsglob.h
58023 @@ -806,35 +806,35 @@ struct cifs_tcon {
58024 __u16 Flags; /* optional support bits */
58025 enum statusEnum tidStatus;
58026 #ifdef CONFIG_CIFS_STATS
58027 - atomic_t num_smbs_sent;
58028 + atomic_unchecked_t num_smbs_sent;
58029 union {
58030 struct {
58031 - atomic_t num_writes;
58032 - atomic_t num_reads;
58033 - atomic_t num_flushes;
58034 - atomic_t num_oplock_brks;
58035 - atomic_t num_opens;
58036 - atomic_t num_closes;
58037 - atomic_t num_deletes;
58038 - atomic_t num_mkdirs;
58039 - atomic_t num_posixopens;
58040 - atomic_t num_posixmkdirs;
58041 - atomic_t num_rmdirs;
58042 - atomic_t num_renames;
58043 - atomic_t num_t2renames;
58044 - atomic_t num_ffirst;
58045 - atomic_t num_fnext;
58046 - atomic_t num_fclose;
58047 - atomic_t num_hardlinks;
58048 - atomic_t num_symlinks;
58049 - atomic_t num_locks;
58050 - atomic_t num_acl_get;
58051 - atomic_t num_acl_set;
58052 + atomic_unchecked_t num_writes;
58053 + atomic_unchecked_t num_reads;
58054 + atomic_unchecked_t num_flushes;
58055 + atomic_unchecked_t num_oplock_brks;
58056 + atomic_unchecked_t num_opens;
58057 + atomic_unchecked_t num_closes;
58058 + atomic_unchecked_t num_deletes;
58059 + atomic_unchecked_t num_mkdirs;
58060 + atomic_unchecked_t num_posixopens;
58061 + atomic_unchecked_t num_posixmkdirs;
58062 + atomic_unchecked_t num_rmdirs;
58063 + atomic_unchecked_t num_renames;
58064 + atomic_unchecked_t num_t2renames;
58065 + atomic_unchecked_t num_ffirst;
58066 + atomic_unchecked_t num_fnext;
58067 + atomic_unchecked_t num_fclose;
58068 + atomic_unchecked_t num_hardlinks;
58069 + atomic_unchecked_t num_symlinks;
58070 + atomic_unchecked_t num_locks;
58071 + atomic_unchecked_t num_acl_get;
58072 + atomic_unchecked_t num_acl_set;
58073 } cifs_stats;
58074 #ifdef CONFIG_CIFS_SMB2
58075 struct {
58076 - atomic_t smb2_com_sent[NUMBER_OF_SMB2_COMMANDS];
58077 - atomic_t smb2_com_failed[NUMBER_OF_SMB2_COMMANDS];
58078 + atomic_unchecked_t smb2_com_sent[NUMBER_OF_SMB2_COMMANDS];
58079 + atomic_unchecked_t smb2_com_failed[NUMBER_OF_SMB2_COMMANDS];
58080 } smb2_stats;
58081 #endif /* CONFIG_CIFS_SMB2 */
58082 } stats;
58083 @@ -1170,7 +1170,7 @@ convert_delimiter(char *path, char delim)
58084 }
58085
58086 #ifdef CONFIG_CIFS_STATS
58087 -#define cifs_stats_inc atomic_inc
58088 +#define cifs_stats_inc atomic_inc_unchecked
58089
58090 static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
58091 unsigned int bytes)
58092 @@ -1536,8 +1536,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
58093 /* Various Debug counters */
58094 GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
58095 #ifdef CONFIG_CIFS_STATS2
58096 -GLOBAL_EXTERN atomic_t totBufAllocCount; /* total allocated over all time */
58097 -GLOBAL_EXTERN atomic_t totSmBufAllocCount;
58098 +GLOBAL_EXTERN atomic_unchecked_t totBufAllocCount; /* total allocated over all time */
58099 +GLOBAL_EXTERN atomic_unchecked_t totSmBufAllocCount;
58100 #endif
58101 GLOBAL_EXTERN atomic_t smBufAllocCount;
58102 GLOBAL_EXTERN atomic_t midCount;
58103 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
58104 index 87c4dd0..a90f115 100644
58105 --- a/fs/cifs/file.c
58106 +++ b/fs/cifs/file.c
58107 @@ -1900,10 +1900,14 @@ static int cifs_writepages(struct address_space *mapping,
58108 index = mapping->writeback_index; /* Start from prev offset */
58109 end = -1;
58110 } else {
58111 - index = wbc->range_start >> PAGE_CACHE_SHIFT;
58112 - end = wbc->range_end >> PAGE_CACHE_SHIFT;
58113 - if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX)
58114 + if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) {
58115 range_whole = true;
58116 + index = 0;
58117 + end = ULONG_MAX;
58118 + } else {
58119 + index = wbc->range_start >> PAGE_CACHE_SHIFT;
58120 + end = wbc->range_end >> PAGE_CACHE_SHIFT;
58121 + }
58122 scanned = true;
58123 }
58124 retry:
58125 diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
58126 index 3b0c62e..f7d090c 100644
58127 --- a/fs/cifs/misc.c
58128 +++ b/fs/cifs/misc.c
58129 @@ -170,7 +170,7 @@ cifs_buf_get(void)
58130 memset(ret_buf, 0, buf_size + 3);
58131 atomic_inc(&bufAllocCount);
58132 #ifdef CONFIG_CIFS_STATS2
58133 - atomic_inc(&totBufAllocCount);
58134 + atomic_inc_unchecked(&totBufAllocCount);
58135 #endif /* CONFIG_CIFS_STATS2 */
58136 }
58137
58138 @@ -205,7 +205,7 @@ cifs_small_buf_get(void)
58139 /* memset(ret_buf, 0, sizeof(struct smb_hdr) + 27);*/
58140 atomic_inc(&smBufAllocCount);
58141 #ifdef CONFIG_CIFS_STATS2
58142 - atomic_inc(&totSmBufAllocCount);
58143 + atomic_inc_unchecked(&totSmBufAllocCount);
58144 #endif /* CONFIG_CIFS_STATS2 */
58145
58146 }
58147 diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
58148 index d1fdfa8..94558f8 100644
58149 --- a/fs/cifs/smb1ops.c
58150 +++ b/fs/cifs/smb1ops.c
58151 @@ -626,27 +626,27 @@ static void
58152 cifs_clear_stats(struct cifs_tcon *tcon)
58153 {
58154 #ifdef CONFIG_CIFS_STATS
58155 - atomic_set(&tcon->stats.cifs_stats.num_writes, 0);
58156 - atomic_set(&tcon->stats.cifs_stats.num_reads, 0);
58157 - atomic_set(&tcon->stats.cifs_stats.num_flushes, 0);
58158 - atomic_set(&tcon->stats.cifs_stats.num_oplock_brks, 0);
58159 - atomic_set(&tcon->stats.cifs_stats.num_opens, 0);
58160 - atomic_set(&tcon->stats.cifs_stats.num_posixopens, 0);
58161 - atomic_set(&tcon->stats.cifs_stats.num_posixmkdirs, 0);
58162 - atomic_set(&tcon->stats.cifs_stats.num_closes, 0);
58163 - atomic_set(&tcon->stats.cifs_stats.num_deletes, 0);
58164 - atomic_set(&tcon->stats.cifs_stats.num_mkdirs, 0);
58165 - atomic_set(&tcon->stats.cifs_stats.num_rmdirs, 0);
58166 - atomic_set(&tcon->stats.cifs_stats.num_renames, 0);
58167 - atomic_set(&tcon->stats.cifs_stats.num_t2renames, 0);
58168 - atomic_set(&tcon->stats.cifs_stats.num_ffirst, 0);
58169 - atomic_set(&tcon->stats.cifs_stats.num_fnext, 0);
58170 - atomic_set(&tcon->stats.cifs_stats.num_fclose, 0);
58171 - atomic_set(&tcon->stats.cifs_stats.num_hardlinks, 0);
58172 - atomic_set(&tcon->stats.cifs_stats.num_symlinks, 0);
58173 - atomic_set(&tcon->stats.cifs_stats.num_locks, 0);
58174 - atomic_set(&tcon->stats.cifs_stats.num_acl_get, 0);
58175 - atomic_set(&tcon->stats.cifs_stats.num_acl_set, 0);
58176 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_writes, 0);
58177 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_reads, 0);
58178 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_flushes, 0);
58179 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_oplock_brks, 0);
58180 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_opens, 0);
58181 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_posixopens, 0);
58182 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_posixmkdirs, 0);
58183 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_closes, 0);
58184 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_deletes, 0);
58185 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_mkdirs, 0);
58186 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_rmdirs, 0);
58187 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_renames, 0);
58188 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_t2renames, 0);
58189 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_ffirst, 0);
58190 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_fnext, 0);
58191 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_fclose, 0);
58192 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_hardlinks, 0);
58193 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_symlinks, 0);
58194 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_locks, 0);
58195 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_acl_get, 0);
58196 + atomic_set_unchecked(&tcon->stats.cifs_stats.num_acl_set, 0);
58197 #endif
58198 }
58199
58200 @@ -655,36 +655,36 @@ cifs_print_stats(struct seq_file *m, struct cifs_tcon *tcon)
58201 {
58202 #ifdef CONFIG_CIFS_STATS
58203 seq_printf(m, " Oplocks breaks: %d",
58204 - atomic_read(&tcon->stats.cifs_stats.num_oplock_brks));
58205 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_oplock_brks));
58206 seq_printf(m, "\nReads: %d Bytes: %llu",
58207 - atomic_read(&tcon->stats.cifs_stats.num_reads),
58208 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_reads),
58209 (long long)(tcon->bytes_read));
58210 seq_printf(m, "\nWrites: %d Bytes: %llu",
58211 - atomic_read(&tcon->stats.cifs_stats.num_writes),
58212 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_writes),
58213 (long long)(tcon->bytes_written));
58214 seq_printf(m, "\nFlushes: %d",
58215 - atomic_read(&tcon->stats.cifs_stats.num_flushes));
58216 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_flushes));
58217 seq_printf(m, "\nLocks: %d HardLinks: %d Symlinks: %d",
58218 - atomic_read(&tcon->stats.cifs_stats.num_locks),
58219 - atomic_read(&tcon->stats.cifs_stats.num_hardlinks),
58220 - atomic_read(&tcon->stats.cifs_stats.num_symlinks));
58221 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_locks),
58222 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_hardlinks),
58223 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_symlinks));
58224 seq_printf(m, "\nOpens: %d Closes: %d Deletes: %d",
58225 - atomic_read(&tcon->stats.cifs_stats.num_opens),
58226 - atomic_read(&tcon->stats.cifs_stats.num_closes),
58227 - atomic_read(&tcon->stats.cifs_stats.num_deletes));
58228 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_opens),
58229 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_closes),
58230 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_deletes));
58231 seq_printf(m, "\nPosix Opens: %d Posix Mkdirs: %d",
58232 - atomic_read(&tcon->stats.cifs_stats.num_posixopens),
58233 - atomic_read(&tcon->stats.cifs_stats.num_posixmkdirs));
58234 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_posixopens),
58235 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_posixmkdirs));
58236 seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
58237 - atomic_read(&tcon->stats.cifs_stats.num_mkdirs),
58238 - atomic_read(&tcon->stats.cifs_stats.num_rmdirs));
58239 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_mkdirs),
58240 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_rmdirs));
58241 seq_printf(m, "\nRenames: %d T2 Renames %d",
58242 - atomic_read(&tcon->stats.cifs_stats.num_renames),
58243 - atomic_read(&tcon->stats.cifs_stats.num_t2renames));
58244 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_renames),
58245 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_t2renames));
58246 seq_printf(m, "\nFindFirst: %d FNext %d FClose %d",
58247 - atomic_read(&tcon->stats.cifs_stats.num_ffirst),
58248 - atomic_read(&tcon->stats.cifs_stats.num_fnext),
58249 - atomic_read(&tcon->stats.cifs_stats.num_fclose));
58250 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_ffirst),
58251 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_fnext),
58252 + atomic_read_unchecked(&tcon->stats.cifs_stats.num_fclose));
58253 #endif
58254 }
58255
58256 diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
58257 index 35ddc3e..563e809 100644
58258 --- a/fs/cifs/smb2ops.c
58259 +++ b/fs/cifs/smb2ops.c
58260 @@ -364,8 +364,8 @@ smb2_clear_stats(struct cifs_tcon *tcon)
58261 #ifdef CONFIG_CIFS_STATS
58262 int i;
58263 for (i = 0; i < NUMBER_OF_SMB2_COMMANDS; i++) {
58264 - atomic_set(&tcon->stats.smb2_stats.smb2_com_sent[i], 0);
58265 - atomic_set(&tcon->stats.smb2_stats.smb2_com_failed[i], 0);
58266 + atomic_set_unchecked(&tcon->stats.smb2_stats.smb2_com_sent[i], 0);
58267 + atomic_set_unchecked(&tcon->stats.smb2_stats.smb2_com_failed[i], 0);
58268 }
58269 #endif
58270 }
58271 @@ -405,65 +405,65 @@ static void
58272 smb2_print_stats(struct seq_file *m, struct cifs_tcon *tcon)
58273 {
58274 #ifdef CONFIG_CIFS_STATS
58275 - atomic_t *sent = tcon->stats.smb2_stats.smb2_com_sent;
58276 - atomic_t *failed = tcon->stats.smb2_stats.smb2_com_failed;
58277 + atomic_unchecked_t *sent = tcon->stats.smb2_stats.smb2_com_sent;
58278 + atomic_unchecked_t *failed = tcon->stats.smb2_stats.smb2_com_failed;
58279 seq_printf(m, "\nNegotiates: %d sent %d failed",
58280 - atomic_read(&sent[SMB2_NEGOTIATE_HE]),
58281 - atomic_read(&failed[SMB2_NEGOTIATE_HE]));
58282 + atomic_read_unchecked(&sent[SMB2_NEGOTIATE_HE]),
58283 + atomic_read_unchecked(&failed[SMB2_NEGOTIATE_HE]));
58284 seq_printf(m, "\nSessionSetups: %d sent %d failed",
58285 - atomic_read(&sent[SMB2_SESSION_SETUP_HE]),
58286 - atomic_read(&failed[SMB2_SESSION_SETUP_HE]));
58287 + atomic_read_unchecked(&sent[SMB2_SESSION_SETUP_HE]),
58288 + atomic_read_unchecked(&failed[SMB2_SESSION_SETUP_HE]));
58289 seq_printf(m, "\nLogoffs: %d sent %d failed",
58290 - atomic_read(&sent[SMB2_LOGOFF_HE]),
58291 - atomic_read(&failed[SMB2_LOGOFF_HE]));
58292 + atomic_read_unchecked(&sent[SMB2_LOGOFF_HE]),
58293 + atomic_read_unchecked(&failed[SMB2_LOGOFF_HE]));
58294 seq_printf(m, "\nTreeConnects: %d sent %d failed",
58295 - atomic_read(&sent[SMB2_TREE_CONNECT_HE]),
58296 - atomic_read(&failed[SMB2_TREE_CONNECT_HE]));
58297 + atomic_read_unchecked(&sent[SMB2_TREE_CONNECT_HE]),
58298 + atomic_read_unchecked(&failed[SMB2_TREE_CONNECT_HE]));
58299 seq_printf(m, "\nTreeDisconnects: %d sent %d failed",
58300 - atomic_read(&sent[SMB2_TREE_DISCONNECT_HE]),
58301 - atomic_read(&failed[SMB2_TREE_DISCONNECT_HE]));
58302 + atomic_read_unchecked(&sent[SMB2_TREE_DISCONNECT_HE]),
58303 + atomic_read_unchecked(&failed[SMB2_TREE_DISCONNECT_HE]));
58304 seq_printf(m, "\nCreates: %d sent %d failed",
58305 - atomic_read(&sent[SMB2_CREATE_HE]),
58306 - atomic_read(&failed[SMB2_CREATE_HE]));
58307 + atomic_read_unchecked(&sent[SMB2_CREATE_HE]),
58308 + atomic_read_unchecked(&failed[SMB2_CREATE_HE]));
58309 seq_printf(m, "\nCloses: %d sent %d failed",
58310 - atomic_read(&sent[SMB2_CLOSE_HE]),
58311 - atomic_read(&failed[SMB2_CLOSE_HE]));
58312 + atomic_read_unchecked(&sent[SMB2_CLOSE_HE]),
58313 + atomic_read_unchecked(&failed[SMB2_CLOSE_HE]));
58314 seq_printf(m, "\nFlushes: %d sent %d failed",
58315 - atomic_read(&sent[SMB2_FLUSH_HE]),
58316 - atomic_read(&failed[SMB2_FLUSH_HE]));
58317 + atomic_read_unchecked(&sent[SMB2_FLUSH_HE]),
58318 + atomic_read_unchecked(&failed[SMB2_FLUSH_HE]));
58319 seq_printf(m, "\nReads: %d sent %d failed",
58320 - atomic_read(&sent[SMB2_READ_HE]),
58321 - atomic_read(&failed[SMB2_READ_HE]));
58322 + atomic_read_unchecked(&sent[SMB2_READ_HE]),
58323 + atomic_read_unchecked(&failed[SMB2_READ_HE]));
58324 seq_printf(m, "\nWrites: %d sent %d failed",
58325 - atomic_read(&sent[SMB2_WRITE_HE]),
58326 - atomic_read(&failed[SMB2_WRITE_HE]));
58327 + atomic_read_unchecked(&sent[SMB2_WRITE_HE]),
58328 + atomic_read_unchecked(&failed[SMB2_WRITE_HE]));
58329 seq_printf(m, "\nLocks: %d sent %d failed",
58330 - atomic_read(&sent[SMB2_LOCK_HE]),
58331 - atomic_read(&failed[SMB2_LOCK_HE]));
58332 + atomic_read_unchecked(&sent[SMB2_LOCK_HE]),
58333 + atomic_read_unchecked(&failed[SMB2_LOCK_HE]));
58334 seq_printf(m, "\nIOCTLs: %d sent %d failed",
58335 - atomic_read(&sent[SMB2_IOCTL_HE]),
58336 - atomic_read(&failed[SMB2_IOCTL_HE]));
58337 + atomic_read_unchecked(&sent[SMB2_IOCTL_HE]),
58338 + atomic_read_unchecked(&failed[SMB2_IOCTL_HE]));
58339 seq_printf(m, "\nCancels: %d sent %d failed",
58340 - atomic_read(&sent[SMB2_CANCEL_HE]),
58341 - atomic_read(&failed[SMB2_CANCEL_HE]));
58342 + atomic_read_unchecked(&sent[SMB2_CANCEL_HE]),
58343 + atomic_read_unchecked(&failed[SMB2_CANCEL_HE]));
58344 seq_printf(m, "\nEchos: %d sent %d failed",
58345 - atomic_read(&sent[SMB2_ECHO_HE]),
58346 - atomic_read(&failed[SMB2_ECHO_HE]));
58347 + atomic_read_unchecked(&sent[SMB2_ECHO_HE]),
58348 + atomic_read_unchecked(&failed[SMB2_ECHO_HE]));
58349 seq_printf(m, "\nQueryDirectories: %d sent %d failed",
58350 - atomic_read(&sent[SMB2_QUERY_DIRECTORY_HE]),
58351 - atomic_read(&failed[SMB2_QUERY_DIRECTORY_HE]));
58352 + atomic_read_unchecked(&sent[SMB2_QUERY_DIRECTORY_HE]),
58353 + atomic_read_unchecked(&failed[SMB2_QUERY_DIRECTORY_HE]));
58354 seq_printf(m, "\nChangeNotifies: %d sent %d failed",
58355 - atomic_read(&sent[SMB2_CHANGE_NOTIFY_HE]),
58356 - atomic_read(&failed[SMB2_CHANGE_NOTIFY_HE]));
58357 + atomic_read_unchecked(&sent[SMB2_CHANGE_NOTIFY_HE]),
58358 + atomic_read_unchecked(&failed[SMB2_CHANGE_NOTIFY_HE]));
58359 seq_printf(m, "\nQueryInfos: %d sent %d failed",
58360 - atomic_read(&sent[SMB2_QUERY_INFO_HE]),
58361 - atomic_read(&failed[SMB2_QUERY_INFO_HE]));
58362 + atomic_read_unchecked(&sent[SMB2_QUERY_INFO_HE]),
58363 + atomic_read_unchecked(&failed[SMB2_QUERY_INFO_HE]));
58364 seq_printf(m, "\nSetInfos: %d sent %d failed",
58365 - atomic_read(&sent[SMB2_SET_INFO_HE]),
58366 - atomic_read(&failed[SMB2_SET_INFO_HE]));
58367 + atomic_read_unchecked(&sent[SMB2_SET_INFO_HE]),
58368 + atomic_read_unchecked(&failed[SMB2_SET_INFO_HE]));
58369 seq_printf(m, "\nOplockBreaks: %d sent %d failed",
58370 - atomic_read(&sent[SMB2_OPLOCK_BREAK_HE]),
58371 - atomic_read(&failed[SMB2_OPLOCK_BREAK_HE]));
58372 + atomic_read_unchecked(&sent[SMB2_OPLOCK_BREAK_HE]),
58373 + atomic_read_unchecked(&failed[SMB2_OPLOCK_BREAK_HE]));
58374 #endif
58375 }
58376
58377 diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
58378 index 8603447..f9caeee 100644
58379 --- a/fs/cifs/smb2pdu.c
58380 +++ b/fs/cifs/smb2pdu.c
58381 @@ -2094,8 +2094,7 @@ SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon,
58382 default:
58383 cifs_dbg(VFS, "info level %u isn't supported\n",
58384 srch_inf->info_level);
58385 - rc = -EINVAL;
58386 - goto qdir_exit;
58387 + return -EINVAL;
58388 }
58389
58390 req->FileIndex = cpu_to_le32(index);
58391 diff --git a/fs/coda/cache.c b/fs/coda/cache.c
58392 index 1da168c..8bc7ff6 100644
58393 --- a/fs/coda/cache.c
58394 +++ b/fs/coda/cache.c
58395 @@ -24,7 +24,7 @@
58396 #include "coda_linux.h"
58397 #include "coda_cache.h"
58398
58399 -static atomic_t permission_epoch = ATOMIC_INIT(0);
58400 +static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
58401
58402 /* replace or extend an acl cache hit */
58403 void coda_cache_enter(struct inode *inode, int mask)
58404 @@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inode, int mask)
58405 struct coda_inode_info *cii = ITOC(inode);
58406
58407 spin_lock(&cii->c_lock);
58408 - cii->c_cached_epoch = atomic_read(&permission_epoch);
58409 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
58410 if (!uid_eq(cii->c_uid, current_fsuid())) {
58411 cii->c_uid = current_fsuid();
58412 cii->c_cached_perm = mask;
58413 @@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode *inode)
58414 {
58415 struct coda_inode_info *cii = ITOC(inode);
58416 spin_lock(&cii->c_lock);
58417 - cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
58418 + cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
58419 spin_unlock(&cii->c_lock);
58420 }
58421
58422 /* remove all acl caches */
58423 void coda_cache_clear_all(struct super_block *sb)
58424 {
58425 - atomic_inc(&permission_epoch);
58426 + atomic_inc_unchecked(&permission_epoch);
58427 }
58428
58429
58430 @@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode, int mask)
58431 spin_lock(&cii->c_lock);
58432 hit = (mask & cii->c_cached_perm) == mask &&
58433 uid_eq(cii->c_uid, current_fsuid()) &&
58434 - cii->c_cached_epoch == atomic_read(&permission_epoch);
58435 + cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
58436 spin_unlock(&cii->c_lock);
58437
58438 return hit;
58439 diff --git a/fs/compat.c b/fs/compat.c
58440 index 6af20de..fec3fbb 100644
58441 --- a/fs/compat.c
58442 +++ b/fs/compat.c
58443 @@ -54,7 +54,7 @@
58444 #include <asm/ioctls.h>
58445 #include "internal.h"
58446
58447 -int compat_log = 1;
58448 +int compat_log = 0;
58449
58450 int compat_printk(const char *fmt, ...)
58451 {
58452 @@ -488,7 +488,7 @@ compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p)
58453
58454 set_fs(KERNEL_DS);
58455 /* The __user pointer cast is valid because of the set_fs() */
58456 - ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
58457 + ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64);
58458 set_fs(oldfs);
58459 /* truncating is ok because it's a user address */
58460 if (!ret)
58461 @@ -546,7 +546,7 @@ ssize_t compat_rw_copy_check_uvector(int type,
58462 goto out;
58463
58464 ret = -EINVAL;
58465 - if (nr_segs > UIO_MAXIOV || nr_segs < 0)
58466 + if (nr_segs > UIO_MAXIOV)
58467 goto out;
58468 if (nr_segs > fast_segs) {
58469 ret = -ENOMEM;
58470 @@ -834,6 +834,7 @@ struct compat_old_linux_dirent {
58471 struct compat_readdir_callback {
58472 struct dir_context ctx;
58473 struct compat_old_linux_dirent __user *dirent;
58474 + struct file * file;
58475 int result;
58476 };
58477
58478 @@ -851,6 +852,10 @@ static int compat_fillonedir(void *__buf, const char *name, int namlen,
58479 buf->result = -EOVERFLOW;
58480 return -EOVERFLOW;
58481 }
58482 +
58483 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
58484 + return 0;
58485 +
58486 buf->result++;
58487 dirent = buf->dirent;
58488 if (!access_ok(VERIFY_WRITE, dirent,
58489 @@ -882,6 +887,7 @@ asmlinkage long compat_sys_old_readdir(unsigned int fd,
58490 if (!f.file)
58491 return -EBADF;
58492
58493 + buf.file = f.file;
58494 error = iterate_dir(f.file, &buf.ctx);
58495 if (buf.result)
58496 error = buf.result;
58497 @@ -901,6 +907,7 @@ struct compat_getdents_callback {
58498 struct dir_context ctx;
58499 struct compat_linux_dirent __user *current_dir;
58500 struct compat_linux_dirent __user *previous;
58501 + struct file * file;
58502 int count;
58503 int error;
58504 };
58505 @@ -922,6 +929,10 @@ static int compat_filldir(void *__buf, const char *name, int namlen,
58506 buf->error = -EOVERFLOW;
58507 return -EOVERFLOW;
58508 }
58509 +
58510 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
58511 + return 0;
58512 +
58513 dirent = buf->previous;
58514 if (dirent) {
58515 if (__put_user(offset, &dirent->d_off))
58516 @@ -967,6 +978,7 @@ asmlinkage long compat_sys_getdents(unsigned int fd,
58517 if (!f.file)
58518 return -EBADF;
58519
58520 + buf.file = f.file;
58521 error = iterate_dir(f.file, &buf.ctx);
58522 if (error >= 0)
58523 error = buf.error;
58524 @@ -987,6 +999,7 @@ struct compat_getdents_callback64 {
58525 struct dir_context ctx;
58526 struct linux_dirent64 __user *current_dir;
58527 struct linux_dirent64 __user *previous;
58528 + struct file * file;
58529 int count;
58530 int error;
58531 };
58532 @@ -1003,6 +1016,10 @@ static int compat_filldir64(void * __buf, const char * name, int namlen, loff_t
58533 buf->error = -EINVAL; /* only used if we fail.. */
58534 if (reclen > buf->count)
58535 return -EINVAL;
58536 +
58537 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
58538 + return 0;
58539 +
58540 dirent = buf->previous;
58541
58542 if (dirent) {
58543 @@ -1052,6 +1069,7 @@ asmlinkage long compat_sys_getdents64(unsigned int fd,
58544 if (!f.file)
58545 return -EBADF;
58546
58547 + buf.file = f.file;
58548 error = iterate_dir(f.file, &buf.ctx);
58549 if (error >= 0)
58550 error = buf.error;
58551 diff --git a/fs/compat_binfmt_elf.c b/fs/compat_binfmt_elf.c
58552 index a81147e..20bf2b5 100644
58553 --- a/fs/compat_binfmt_elf.c
58554 +++ b/fs/compat_binfmt_elf.c
58555 @@ -30,11 +30,13 @@
58556 #undef elf_phdr
58557 #undef elf_shdr
58558 #undef elf_note
58559 +#undef elf_dyn
58560 #undef elf_addr_t
58561 #define elfhdr elf32_hdr
58562 #define elf_phdr elf32_phdr
58563 #define elf_shdr elf32_shdr
58564 #define elf_note elf32_note
58565 +#define elf_dyn Elf32_Dyn
58566 #define elf_addr_t Elf32_Addr
58567
58568 /*
58569 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
58570 index 3881610..ab3df0b 100644
58571 --- a/fs/compat_ioctl.c
58572 +++ b/fs/compat_ioctl.c
58573 @@ -621,7 +621,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd,
58574 return -EFAULT;
58575 if (__get_user(udata, &ss32->iomem_base))
58576 return -EFAULT;
58577 - ss.iomem_base = compat_ptr(udata);
58578 + ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata);
58579 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) ||
58580 __get_user(ss.port_high, &ss32->port_high))
58581 return -EFAULT;
58582 @@ -703,8 +703,8 @@ static int do_i2c_rdwr_ioctl(unsigned int fd, unsigned int cmd,
58583 for (i = 0; i < nmsgs; i++) {
58584 if (copy_in_user(&tmsgs[i].addr, &umsgs[i].addr, 3*sizeof(u16)))
58585 return -EFAULT;
58586 - if (get_user(datap, &umsgs[i].buf) ||
58587 - put_user(compat_ptr(datap), &tmsgs[i].buf))
58588 + if (get_user(datap, (u8 __user * __user *)&umsgs[i].buf) ||
58589 + put_user(compat_ptr(datap), (u8 __user * __user *)&tmsgs[i].buf))
58590 return -EFAULT;
58591 }
58592 return sys_ioctl(fd, cmd, (unsigned long)tdata);
58593 @@ -797,7 +797,7 @@ static int compat_ioctl_preallocate(struct file *file,
58594 copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) ||
58595 copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) ||
58596 copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) ||
58597 - copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32)))
58598 + copy_in_user(p->l_pad, p32->l_pad, 4*sizeof(u32)))
58599 return -EFAULT;
58600
58601 return ioctl_preallocate(file, p);
58602 @@ -1617,8 +1617,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd,
58603 static int __init init_sys32_ioctl_cmp(const void *p, const void *q)
58604 {
58605 unsigned int a, b;
58606 - a = *(unsigned int *)p;
58607 - b = *(unsigned int *)q;
58608 + a = *(const unsigned int *)p;
58609 + b = *(const unsigned int *)q;
58610 if (a > b)
58611 return 1;
58612 if (a < b)
58613 diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
58614 index e081acb..911df21 100644
58615 --- a/fs/configfs/dir.c
58616 +++ b/fs/configfs/dir.c
58617 @@ -1548,7 +1548,8 @@ static int configfs_readdir(struct file *file, struct dir_context *ctx)
58618 }
58619 for (p = q->next; p != &parent_sd->s_children; p = p->next) {
58620 struct configfs_dirent *next;
58621 - const char *name;
58622 + const unsigned char * name;
58623 + char d_name[sizeof(next->s_dentry->d_iname)];
58624 int len;
58625 struct inode *inode = NULL;
58626
58627 @@ -1557,7 +1558,12 @@ static int configfs_readdir(struct file *file, struct dir_context *ctx)
58628 continue;
58629
58630 name = configfs_get_name(next);
58631 - len = strlen(name);
58632 + if (next->s_dentry && name == next->s_dentry->d_iname) {
58633 + len = next->s_dentry->d_name.len;
58634 + memcpy(d_name, name, len);
58635 + name = d_name;
58636 + } else
58637 + len = strlen(name);
58638
58639 /*
58640 * We'll have a dentry and an inode for
58641 diff --git a/fs/coredump.c b/fs/coredump.c
58642 index e3ad709..836c55f 100644
58643 --- a/fs/coredump.c
58644 +++ b/fs/coredump.c
58645 @@ -73,10 +73,15 @@ static int expand_corename(struct core_name *cn, int size)
58646 static int cn_vprintf(struct core_name *cn, const char *fmt, va_list arg)
58647 {
58648 int free, need;
58649 + va_list arg_copy;
58650
58651 again:
58652 free = cn->size - cn->used;
58653 - need = vsnprintf(cn->corename + cn->used, free, fmt, arg);
58654 +
58655 + va_copy(arg_copy, arg);
58656 + need = vsnprintf(cn->corename + cn->used, free, fmt, arg_copy);
58657 + va_end(arg_copy);
58658 +
58659 if (need < free) {
58660 cn->used += need;
58661 return 0;
58662 @@ -437,8 +442,8 @@ static void wait_for_dump_helpers(struct file *file)
58663 struct pipe_inode_info *pipe = file->private_data;
58664
58665 pipe_lock(pipe);
58666 - pipe->readers++;
58667 - pipe->writers--;
58668 + atomic_inc(&pipe->readers);
58669 + atomic_dec(&pipe->writers);
58670 wake_up_interruptible_sync(&pipe->wait);
58671 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
58672 pipe_unlock(pipe);
58673 @@ -447,11 +452,11 @@ static void wait_for_dump_helpers(struct file *file)
58674 * We actually want wait_event_freezable() but then we need
58675 * to clear TIF_SIGPENDING and improve dump_interrupted().
58676 */
58677 - wait_event_interruptible(pipe->wait, pipe->readers == 1);
58678 + wait_event_interruptible(pipe->wait, atomic_read(&pipe->readers) == 1);
58679
58680 pipe_lock(pipe);
58681 - pipe->readers--;
58682 - pipe->writers++;
58683 + atomic_dec(&pipe->readers);
58684 + atomic_inc(&pipe->writers);
58685 pipe_unlock(pipe);
58686 }
58687
58688 @@ -498,7 +503,9 @@ void do_coredump(const siginfo_t *siginfo)
58689 struct files_struct *displaced;
58690 bool need_nonrelative = false;
58691 bool core_dumped = false;
58692 - static atomic_t core_dump_count = ATOMIC_INIT(0);
58693 + static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
58694 + long signr = siginfo->si_signo;
58695 + int dumpable;
58696 struct coredump_params cprm = {
58697 .siginfo = siginfo,
58698 .regs = signal_pt_regs(),
58699 @@ -511,12 +518,17 @@ void do_coredump(const siginfo_t *siginfo)
58700 .mm_flags = mm->flags,
58701 };
58702
58703 - audit_core_dumps(siginfo->si_signo);
58704 + audit_core_dumps(signr);
58705 +
58706 + dumpable = __get_dumpable(cprm.mm_flags);
58707 +
58708 + if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
58709 + gr_handle_brute_attach(dumpable);
58710
58711 binfmt = mm->binfmt;
58712 if (!binfmt || !binfmt->core_dump)
58713 goto fail;
58714 - if (!__get_dumpable(cprm.mm_flags))
58715 + if (!dumpable)
58716 goto fail;
58717
58718 cred = prepare_creds();
58719 @@ -535,7 +547,7 @@ void do_coredump(const siginfo_t *siginfo)
58720 need_nonrelative = true;
58721 }
58722
58723 - retval = coredump_wait(siginfo->si_signo, &core_state);
58724 + retval = coredump_wait(signr, &core_state);
58725 if (retval < 0)
58726 goto fail_creds;
58727
58728 @@ -578,7 +590,7 @@ void do_coredump(const siginfo_t *siginfo)
58729 }
58730 cprm.limit = RLIM_INFINITY;
58731
58732 - dump_count = atomic_inc_return(&core_dump_count);
58733 + dump_count = atomic_inc_return_unchecked(&core_dump_count);
58734 if (core_pipe_limit && (core_pipe_limit < dump_count)) {
58735 printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
58736 task_tgid_vnr(current), current->comm);
58737 @@ -610,6 +622,8 @@ void do_coredump(const siginfo_t *siginfo)
58738 } else {
58739 struct inode *inode;
58740
58741 + gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
58742 +
58743 if (cprm.limit < binfmt->min_coredump)
58744 goto fail_unlock;
58745
58746 @@ -668,7 +682,7 @@ close_fail:
58747 filp_close(cprm.file, NULL);
58748 fail_dropcount:
58749 if (ispipe)
58750 - atomic_dec(&core_dump_count);
58751 + atomic_dec_unchecked(&core_dump_count);
58752 fail_unlock:
58753 kfree(cn.corename);
58754 coredump_finish(mm, core_dumped);
58755 @@ -689,6 +703,8 @@ int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
58756 struct file *file = cprm->file;
58757 loff_t pos = file->f_pos;
58758 ssize_t n;
58759 +
58760 + gr_learn_resource(current, RLIMIT_CORE, cprm->written + nr, 1);
58761 if (cprm->written + nr > cprm->limit)
58762 return 0;
58763 while (nr) {
58764 diff --git a/fs/dcache.c b/fs/dcache.c
58765 index ca02c13..7e2b581 100644
58766 --- a/fs/dcache.c
58767 +++ b/fs/dcache.c
58768 @@ -1495,7 +1495,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
58769 */
58770 dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
58771 if (name->len > DNAME_INLINE_LEN-1) {
58772 - dname = kmalloc(name->len + 1, GFP_KERNEL);
58773 + dname = kmalloc(round_up(name->len + 1, sizeof(unsigned long)), GFP_KERNEL);
58774 if (!dname) {
58775 kmem_cache_free(dentry_cache, dentry);
58776 return NULL;
58777 @@ -3431,7 +3431,8 @@ void __init vfs_caches_init(unsigned long mempages)
58778 mempages -= reserve;
58779
58780 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
58781 - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
58782 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY|
58783 + SLAB_NO_SANITIZE, NULL);
58784
58785 dcache_init();
58786 inode_init();
58787 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
58788 index 9c0444c..628490c 100644
58789 --- a/fs/debugfs/inode.c
58790 +++ b/fs/debugfs/inode.c
58791 @@ -415,7 +415,11 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
58792 */
58793 struct dentry *debugfs_create_dir(const char *name, struct dentry *parent)
58794 {
58795 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
58796 + return __create_file(name, S_IFDIR | S_IRWXU,
58797 +#else
58798 return __create_file(name, S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
58799 +#endif
58800 parent, NULL, NULL);
58801 }
58802 EXPORT_SYMBOL_GPL(debugfs_create_dir);
58803 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
58804 index b167ca4..a224e19 100644
58805 --- a/fs/ecryptfs/inode.c
58806 +++ b/fs/ecryptfs/inode.c
58807 @@ -673,7 +673,7 @@ static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
58808 old_fs = get_fs();
58809 set_fs(get_ds());
58810 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
58811 - (char __user *)lower_buf,
58812 + (char __force_user *)lower_buf,
58813 PATH_MAX);
58814 set_fs(old_fs);
58815 if (rc < 0)
58816 diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
58817 index e4141f2..d8263e8 100644
58818 --- a/fs/ecryptfs/miscdev.c
58819 +++ b/fs/ecryptfs/miscdev.c
58820 @@ -304,7 +304,7 @@ check_list:
58821 goto out_unlock_msg_ctx;
58822 i = PKT_TYPE_SIZE + PKT_CTR_SIZE;
58823 if (msg_ctx->msg) {
58824 - if (copy_to_user(&buf[i], packet_length, packet_length_size))
58825 + if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
58826 goto out_unlock_msg_ctx;
58827 i += packet_length_size;
58828 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
58829 diff --git a/fs/exec.c b/fs/exec.c
58830 index 3d78fcc..6b2fd70 100644
58831 --- a/fs/exec.c
58832 +++ b/fs/exec.c
58833 @@ -55,8 +55,20 @@
58834 #include <linux/pipe_fs_i.h>
58835 #include <linux/oom.h>
58836 #include <linux/compat.h>
58837 +#include <linux/random.h>
58838 +#include <linux/seq_file.h>
58839 +#include <linux/coredump.h>
58840 +#include <linux/mman.h>
58841 +
58842 +#ifdef CONFIG_PAX_REFCOUNT
58843 +#include <linux/kallsyms.h>
58844 +#include <linux/kdebug.h>
58845 +#endif
58846 +
58847 +#include <trace/events/fs.h>
58848
58849 #include <asm/uaccess.h>
58850 +#include <asm/sections.h>
58851 #include <asm/mmu_context.h>
58852 #include <asm/tlb.h>
58853
58854 @@ -65,19 +77,34 @@
58855
58856 #include <trace/events/sched.h>
58857
58858 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
58859 +void __weak pax_set_initial_flags(struct linux_binprm *bprm)
58860 +{
58861 + pr_warn_once("PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n");
58862 +}
58863 +#endif
58864 +
58865 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
58866 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
58867 +EXPORT_SYMBOL(pax_set_initial_flags_func);
58868 +#endif
58869 +
58870 int suid_dumpable = 0;
58871
58872 static LIST_HEAD(formats);
58873 static DEFINE_RWLOCK(binfmt_lock);
58874
58875 +extern int gr_process_kernel_exec_ban(void);
58876 +extern int gr_process_suid_exec_ban(const struct linux_binprm *bprm);
58877 +
58878 void __register_binfmt(struct linux_binfmt * fmt, int insert)
58879 {
58880 BUG_ON(!fmt);
58881 if (WARN_ON(!fmt->load_binary))
58882 return;
58883 write_lock(&binfmt_lock);
58884 - insert ? list_add(&fmt->lh, &formats) :
58885 - list_add_tail(&fmt->lh, &formats);
58886 + insert ? pax_list_add((struct list_head *)&fmt->lh, &formats) :
58887 + pax_list_add_tail((struct list_head *)&fmt->lh, &formats);
58888 write_unlock(&binfmt_lock);
58889 }
58890
58891 @@ -86,7 +113,7 @@ EXPORT_SYMBOL(__register_binfmt);
58892 void unregister_binfmt(struct linux_binfmt * fmt)
58893 {
58894 write_lock(&binfmt_lock);
58895 - list_del(&fmt->lh);
58896 + pax_list_del((struct list_head *)&fmt->lh);
58897 write_unlock(&binfmt_lock);
58898 }
58899
58900 @@ -180,18 +207,10 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
58901 int write)
58902 {
58903 struct page *page;
58904 - int ret;
58905
58906 -#ifdef CONFIG_STACK_GROWSUP
58907 - if (write) {
58908 - ret = expand_downwards(bprm->vma, pos);
58909 - if (ret < 0)
58910 - return NULL;
58911 - }
58912 -#endif
58913 - ret = get_user_pages(current, bprm->mm, pos,
58914 - 1, write, 1, &page, NULL);
58915 - if (ret <= 0)
58916 + if (0 > expand_downwards(bprm->vma, pos))
58917 + return NULL;
58918 + if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
58919 return NULL;
58920
58921 if (write) {
58922 @@ -207,6 +226,17 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
58923 if (size <= ARG_MAX)
58924 return page;
58925
58926 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
58927 + // only allow 512KB for argv+env on suid/sgid binaries
58928 + // to prevent easy ASLR exhaustion
58929 + if (((!uid_eq(bprm->cred->euid, current_euid())) ||
58930 + (!gid_eq(bprm->cred->egid, current_egid()))) &&
58931 + (size > (512 * 1024))) {
58932 + put_page(page);
58933 + return NULL;
58934 + }
58935 +#endif
58936 +
58937 /*
58938 * Limit to 1/4-th the stack size for the argv+env strings.
58939 * This ensures that:
58940 @@ -266,6 +296,11 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
58941 vma->vm_end = STACK_TOP_MAX;
58942 vma->vm_start = vma->vm_end - PAGE_SIZE;
58943 vma->vm_flags = VM_SOFTDIRTY | VM_STACK_FLAGS | VM_STACK_INCOMPLETE_SETUP;
58944 +
58945 +#ifdef CONFIG_PAX_SEGMEXEC
58946 + vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
58947 +#endif
58948 +
58949 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
58950 INIT_LIST_HEAD(&vma->anon_vma_chain);
58951
58952 @@ -276,6 +311,12 @@ static int __bprm_mm_init(struct linux_binprm *bprm)
58953 mm->stack_vm = mm->total_vm = 1;
58954 up_write(&mm->mmap_sem);
58955 bprm->p = vma->vm_end - sizeof(void *);
58956 +
58957 +#ifdef CONFIG_PAX_RANDUSTACK
58958 + if (randomize_va_space)
58959 + bprm->p ^= prandom_u32() & ~PAGE_MASK;
58960 +#endif
58961 +
58962 return 0;
58963 err:
58964 up_write(&mm->mmap_sem);
58965 @@ -396,7 +437,7 @@ struct user_arg_ptr {
58966 } ptr;
58967 };
58968
58969 -static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
58970 +const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
58971 {
58972 const char __user *native;
58973
58974 @@ -405,14 +446,14 @@ static const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr)
58975 compat_uptr_t compat;
58976
58977 if (get_user(compat, argv.ptr.compat + nr))
58978 - return ERR_PTR(-EFAULT);
58979 + return (const char __force_user *)ERR_PTR(-EFAULT);
58980
58981 return compat_ptr(compat);
58982 }
58983 #endif
58984
58985 if (get_user(native, argv.ptr.native + nr))
58986 - return ERR_PTR(-EFAULT);
58987 + return (const char __force_user *)ERR_PTR(-EFAULT);
58988
58989 return native;
58990 }
58991 @@ -431,7 +472,7 @@ static int count(struct user_arg_ptr argv, int max)
58992 if (!p)
58993 break;
58994
58995 - if (IS_ERR(p))
58996 + if (IS_ERR((const char __force_kernel *)p))
58997 return -EFAULT;
58998
58999 if (i >= max)
59000 @@ -466,7 +507,7 @@ static int copy_strings(int argc, struct user_arg_ptr argv,
59001
59002 ret = -EFAULT;
59003 str = get_user_arg_ptr(argv, argc);
59004 - if (IS_ERR(str))
59005 + if (IS_ERR((const char __force_kernel *)str))
59006 goto out;
59007
59008 len = strnlen_user(str, MAX_ARG_STRLEN);
59009 @@ -548,7 +589,7 @@ int copy_strings_kernel(int argc, const char *const *__argv,
59010 int r;
59011 mm_segment_t oldfs = get_fs();
59012 struct user_arg_ptr argv = {
59013 - .ptr.native = (const char __user *const __user *)__argv,
59014 + .ptr.native = (const char __user * const __force_user *)__argv,
59015 };
59016
59017 set_fs(KERNEL_DS);
59018 @@ -583,7 +624,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
59019 unsigned long new_end = old_end - shift;
59020 struct mmu_gather tlb;
59021
59022 - BUG_ON(new_start > new_end);
59023 + if (new_start >= new_end || new_start < mmap_min_addr)
59024 + return -ENOMEM;
59025
59026 /*
59027 * ensure there are no vmas between where we want to go
59028 @@ -592,6 +634,10 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
59029 if (vma != find_vma(mm, new_start))
59030 return -EFAULT;
59031
59032 +#ifdef CONFIG_PAX_SEGMEXEC
59033 + BUG_ON(pax_find_mirror_vma(vma));
59034 +#endif
59035 +
59036 /*
59037 * cover the whole range: [new_start, old_end)
59038 */
59039 @@ -672,10 +718,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
59040 stack_top = arch_align_stack(stack_top);
59041 stack_top = PAGE_ALIGN(stack_top);
59042
59043 - if (unlikely(stack_top < mmap_min_addr) ||
59044 - unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
59045 - return -ENOMEM;
59046 -
59047 stack_shift = vma->vm_end - stack_top;
59048
59049 bprm->p -= stack_shift;
59050 @@ -687,8 +729,28 @@ int setup_arg_pages(struct linux_binprm *bprm,
59051 bprm->exec -= stack_shift;
59052
59053 down_write(&mm->mmap_sem);
59054 +
59055 + /* Move stack pages down in memory. */
59056 + if (stack_shift) {
59057 + ret = shift_arg_pages(vma, stack_shift);
59058 + if (ret)
59059 + goto out_unlock;
59060 + }
59061 +
59062 vm_flags = VM_STACK_FLAGS;
59063
59064 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
59065 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
59066 + vm_flags &= ~VM_EXEC;
59067 +
59068 +#ifdef CONFIG_PAX_MPROTECT
59069 + if (mm->pax_flags & MF_PAX_MPROTECT)
59070 + vm_flags &= ~VM_MAYEXEC;
59071 +#endif
59072 +
59073 + }
59074 +#endif
59075 +
59076 /*
59077 * Adjust stack execute permissions; explicitly enable for
59078 * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
59079 @@ -707,13 +769,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
59080 goto out_unlock;
59081 BUG_ON(prev != vma);
59082
59083 - /* Move stack pages down in memory. */
59084 - if (stack_shift) {
59085 - ret = shift_arg_pages(vma, stack_shift);
59086 - if (ret)
59087 - goto out_unlock;
59088 - }
59089 -
59090 /* mprotect_fixup is overkill to remove the temporary stack flags */
59091 vma->vm_flags &= ~VM_STACK_INCOMPLETE_SETUP;
59092
59093 @@ -737,6 +792,27 @@ int setup_arg_pages(struct linux_binprm *bprm,
59094 #endif
59095 current->mm->start_stack = bprm->p;
59096 ret = expand_stack(vma, stack_base);
59097 +
59098 +#if !defined(CONFIG_STACK_GROWSUP) && defined(CONFIG_PAX_RANDMMAP)
59099 + if (!ret && (mm->pax_flags & MF_PAX_RANDMMAP) && STACK_TOP <= 0xFFFFFFFFU && STACK_TOP > vma->vm_end) {
59100 + unsigned long size;
59101 + vm_flags_t vm_flags;
59102 +
59103 + size = STACK_TOP - vma->vm_end;
59104 + vm_flags = VM_NONE | VM_DONTEXPAND | VM_DONTDUMP;
59105 +
59106 + ret = vma->vm_end != mmap_region(NULL, vma->vm_end, size, vm_flags, 0);
59107 +
59108 +#ifdef CONFIG_X86
59109 + if (!ret) {
59110 + size = PAGE_SIZE + mmap_min_addr + ((mm->delta_mmap ^ mm->delta_stack) & (0xFFUL << PAGE_SHIFT));
59111 + ret = 0 != mmap_region(NULL, 0, PAGE_ALIGN(size), vm_flags, 0);
59112 + }
59113 +#endif
59114 +
59115 + }
59116 +#endif
59117 +
59118 if (ret)
59119 ret = -EFAULT;
59120
59121 @@ -772,6 +848,8 @@ static struct file *do_open_exec(struct filename *name)
59122
59123 fsnotify_open(file);
59124
59125 + trace_open_exec(name->name);
59126 +
59127 err = deny_write_access(file);
59128 if (err)
59129 goto exit;
59130 @@ -801,7 +879,7 @@ int kernel_read(struct file *file, loff_t offset,
59131 old_fs = get_fs();
59132 set_fs(get_ds());
59133 /* The cast to a user pointer is valid due to the set_fs() */
59134 - result = vfs_read(file, (void __user *)addr, count, &pos);
59135 + result = vfs_read(file, (void __force_user *)addr, count, &pos);
59136 set_fs(old_fs);
59137 return result;
59138 }
59139 @@ -846,6 +924,7 @@ static int exec_mmap(struct mm_struct *mm)
59140 tsk->mm = mm;
59141 tsk->active_mm = mm;
59142 activate_mm(active_mm, mm);
59143 + populate_stack();
59144 task_unlock(tsk);
59145 if (old_mm) {
59146 up_read(&old_mm->mmap_sem);
59147 @@ -1258,7 +1337,7 @@ static void check_unsafe_exec(struct linux_binprm *bprm)
59148 }
59149 rcu_read_unlock();
59150
59151 - if (p->fs->users > n_fs)
59152 + if (atomic_read(&p->fs->users) > n_fs)
59153 bprm->unsafe |= LSM_UNSAFE_SHARE;
59154 else
59155 p->fs->in_exec = 1;
59156 @@ -1434,6 +1513,31 @@ static int exec_binprm(struct linux_binprm *bprm)
59157 return ret;
59158 }
59159
59160 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
59161 +static DEFINE_PER_CPU(u64, exec_counter);
59162 +static int __init init_exec_counters(void)
59163 +{
59164 + unsigned int cpu;
59165 +
59166 + for_each_possible_cpu(cpu) {
59167 + per_cpu(exec_counter, cpu) = (u64)cpu;
59168 + }
59169 +
59170 + return 0;
59171 +}
59172 +early_initcall(init_exec_counters);
59173 +static inline void increment_exec_counter(void)
59174 +{
59175 + BUILD_BUG_ON(NR_CPUS > (1 << 16));
59176 + current->exec_id = this_cpu_add_return(exec_counter, 1 << 16);
59177 +}
59178 +#else
59179 +static inline void increment_exec_counter(void) {}
59180 +#endif
59181 +
59182 +extern void gr_handle_exec_args(struct linux_binprm *bprm,
59183 + struct user_arg_ptr argv);
59184 +
59185 /*
59186 * sys_execve() executes a new program.
59187 */
59188 @@ -1441,6 +1545,11 @@ static int do_execve_common(struct filename *filename,
59189 struct user_arg_ptr argv,
59190 struct user_arg_ptr envp)
59191 {
59192 +#ifdef CONFIG_GRKERNSEC
59193 + struct file *old_exec_file;
59194 + struct acl_subject_label *old_acl;
59195 + struct rlimit old_rlim[RLIM_NLIMITS];
59196 +#endif
59197 struct linux_binprm *bprm;
59198 struct file *file;
59199 struct files_struct *displaced;
59200 @@ -1449,6 +1558,8 @@ static int do_execve_common(struct filename *filename,
59201 if (IS_ERR(filename))
59202 return PTR_ERR(filename);
59203
59204 + gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current_user()->processes), 1);
59205 +
59206 /*
59207 * We move the actual failure in case of RLIMIT_NPROC excess from
59208 * set*uid() to execve() because too many poorly written programs
59209 @@ -1486,11 +1597,21 @@ static int do_execve_common(struct filename *filename,
59210 if (IS_ERR(file))
59211 goto out_unmark;
59212
59213 + if (gr_ptrace_readexec(file, bprm->unsafe)) {
59214 + retval = -EPERM;
59215 + goto out_unmark;
59216 + }
59217 +
59218 sched_exec();
59219
59220 bprm->file = file;
59221 bprm->filename = bprm->interp = filename->name;
59222
59223 + if (!gr_acl_handle_execve(file->f_path.dentry, file->f_path.mnt)) {
59224 + retval = -EACCES;
59225 + goto out_unmark;
59226 + }
59227 +
59228 retval = bprm_mm_init(bprm);
59229 if (retval)
59230 goto out_unmark;
59231 @@ -1507,24 +1628,70 @@ static int do_execve_common(struct filename *filename,
59232 if (retval < 0)
59233 goto out;
59234
59235 +#ifdef CONFIG_GRKERNSEC
59236 + old_acl = current->acl;
59237 + memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
59238 + old_exec_file = current->exec_file;
59239 + get_file(file);
59240 + current->exec_file = file;
59241 +#endif
59242 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
59243 + /* limit suid stack to 8MB
59244 + * we saved the old limits above and will restore them if this exec fails
59245 + */
59246 + if (((!uid_eq(bprm->cred->euid, current_euid())) || (!gid_eq(bprm->cred->egid, current_egid()))) &&
59247 + (old_rlim[RLIMIT_STACK].rlim_cur > (8 * 1024 * 1024)))
59248 + current->signal->rlim[RLIMIT_STACK].rlim_cur = 8 * 1024 * 1024;
59249 +#endif
59250 +
59251 + if (gr_process_kernel_exec_ban() || gr_process_suid_exec_ban(bprm)) {
59252 + retval = -EPERM;
59253 + goto out_fail;
59254 + }
59255 +
59256 + if (!gr_tpe_allow(file)) {
59257 + retval = -EACCES;
59258 + goto out_fail;
59259 + }
59260 +
59261 + if (gr_check_crash_exec(file)) {
59262 + retval = -EACCES;
59263 + goto out_fail;
59264 + }
59265 +
59266 + retval = gr_set_proc_label(file->f_path.dentry, file->f_path.mnt,
59267 + bprm->unsafe);
59268 + if (retval < 0)
59269 + goto out_fail;
59270 +
59271 retval = copy_strings_kernel(1, &bprm->filename, bprm);
59272 if (retval < 0)
59273 - goto out;
59274 + goto out_fail;
59275
59276 bprm->exec = bprm->p;
59277 retval = copy_strings(bprm->envc, envp, bprm);
59278 if (retval < 0)
59279 - goto out;
59280 + goto out_fail;
59281
59282 retval = copy_strings(bprm->argc, argv, bprm);
59283 if (retval < 0)
59284 - goto out;
59285 + goto out_fail;
59286 +
59287 + gr_log_chroot_exec(file->f_path.dentry, file->f_path.mnt);
59288 +
59289 + gr_handle_exec_args(bprm, argv);
59290
59291 retval = exec_binprm(bprm);
59292 if (retval < 0)
59293 - goto out;
59294 + goto out_fail;
59295 +#ifdef CONFIG_GRKERNSEC
59296 + if (old_exec_file)
59297 + fput(old_exec_file);
59298 +#endif
59299
59300 /* execve succeeded */
59301 +
59302 + increment_exec_counter();
59303 current->fs->in_exec = 0;
59304 current->in_execve = 0;
59305 acct_update_integrals(current);
59306 @@ -1535,6 +1702,14 @@ static int do_execve_common(struct filename *filename,
59307 put_files_struct(displaced);
59308 return retval;
59309
59310 +out_fail:
59311 +#ifdef CONFIG_GRKERNSEC
59312 + current->acl = old_acl;
59313 + memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
59314 + fput(current->exec_file);
59315 + current->exec_file = old_exec_file;
59316 +#endif
59317 +
59318 out:
59319 if (bprm->mm) {
59320 acct_arg_size(bprm, 0);
59321 @@ -1626,3 +1801,311 @@ asmlinkage long compat_sys_execve(const char __user * filename,
59322 return compat_do_execve(getname(filename), argv, envp);
59323 }
59324 #endif
59325 +
59326 +int pax_check_flags(unsigned long *flags)
59327 +{
59328 + int retval = 0;
59329 +
59330 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
59331 + if (*flags & MF_PAX_SEGMEXEC)
59332 + {
59333 + *flags &= ~MF_PAX_SEGMEXEC;
59334 + retval = -EINVAL;
59335 + }
59336 +#endif
59337 +
59338 + if ((*flags & MF_PAX_PAGEEXEC)
59339 +
59340 +#ifdef CONFIG_PAX_PAGEEXEC
59341 + && (*flags & MF_PAX_SEGMEXEC)
59342 +#endif
59343 +
59344 + )
59345 + {
59346 + *flags &= ~MF_PAX_PAGEEXEC;
59347 + retval = -EINVAL;
59348 + }
59349 +
59350 + if ((*flags & MF_PAX_MPROTECT)
59351 +
59352 +#ifdef CONFIG_PAX_MPROTECT
59353 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
59354 +#endif
59355 +
59356 + )
59357 + {
59358 + *flags &= ~MF_PAX_MPROTECT;
59359 + retval = -EINVAL;
59360 + }
59361 +
59362 + if ((*flags & MF_PAX_EMUTRAMP)
59363 +
59364 +#ifdef CONFIG_PAX_EMUTRAMP
59365 + && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
59366 +#endif
59367 +
59368 + )
59369 + {
59370 + *flags &= ~MF_PAX_EMUTRAMP;
59371 + retval = -EINVAL;
59372 + }
59373 +
59374 + return retval;
59375 +}
59376 +
59377 +EXPORT_SYMBOL(pax_check_flags);
59378 +
59379 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
59380 +char *pax_get_path(const struct path *path, char *buf, int buflen)
59381 +{
59382 + char *pathname = d_path(path, buf, buflen);
59383 +
59384 + if (IS_ERR(pathname))
59385 + goto toolong;
59386 +
59387 + pathname = mangle_path(buf, pathname, "\t\n\\");
59388 + if (!pathname)
59389 + goto toolong;
59390 +
59391 + *pathname = 0;
59392 + return buf;
59393 +
59394 +toolong:
59395 + return "<path too long>";
59396 +}
59397 +EXPORT_SYMBOL(pax_get_path);
59398 +
59399 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
59400 +{
59401 + struct task_struct *tsk = current;
59402 + struct mm_struct *mm = current->mm;
59403 + char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
59404 + char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
59405 + char *path_exec = NULL;
59406 + char *path_fault = NULL;
59407 + unsigned long start = 0UL, end = 0UL, offset = 0UL;
59408 + siginfo_t info = { };
59409 +
59410 + if (buffer_exec && buffer_fault) {
59411 + struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
59412 +
59413 + down_read(&mm->mmap_sem);
59414 + vma = mm->mmap;
59415 + while (vma && (!vma_exec || !vma_fault)) {
59416 + if (vma->vm_file && mm->exe_file == vma->vm_file && (vma->vm_flags & VM_EXEC))
59417 + vma_exec = vma;
59418 + if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
59419 + vma_fault = vma;
59420 + vma = vma->vm_next;
59421 + }
59422 + if (vma_exec)
59423 + path_exec = pax_get_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
59424 + if (vma_fault) {
59425 + start = vma_fault->vm_start;
59426 + end = vma_fault->vm_end;
59427 + offset = vma_fault->vm_pgoff << PAGE_SHIFT;
59428 + if (vma_fault->vm_file)
59429 + path_fault = pax_get_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
59430 + else if ((unsigned long)pc >= mm->start_brk && (unsigned long)pc < mm->brk)
59431 + path_fault = "<heap>";
59432 + else if (vma_fault->vm_flags & (VM_GROWSDOWN | VM_GROWSUP))
59433 + path_fault = "<stack>";
59434 + else
59435 + path_fault = "<anonymous mapping>";
59436 + }
59437 + up_read(&mm->mmap_sem);
59438 + }
59439 + if (tsk->signal->curr_ip)
59440 + printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
59441 + else
59442 + printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
59443 + printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
59444 + from_kuid_munged(&init_user_ns, task_uid(tsk)), from_kuid_munged(&init_user_ns, task_euid(tsk)), pc, sp);
59445 + free_page((unsigned long)buffer_exec);
59446 + free_page((unsigned long)buffer_fault);
59447 + pax_report_insns(regs, pc, sp);
59448 + info.si_signo = SIGKILL;
59449 + info.si_errno = 0;
59450 + info.si_code = SI_KERNEL;
59451 + info.si_pid = 0;
59452 + info.si_uid = 0;
59453 + do_coredump(&info);
59454 +}
59455 +#endif
59456 +
59457 +#ifdef CONFIG_PAX_REFCOUNT
59458 +void pax_report_refcount_overflow(struct pt_regs *regs)
59459 +{
59460 + if (current->signal->curr_ip)
59461 + printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
59462 + &current->signal->curr_ip, current->comm, task_pid_nr(current),
59463 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
59464 + else
59465 + printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n", current->comm, task_pid_nr(current),
59466 + from_kuid_munged(&init_user_ns, current_uid()), from_kuid_munged(&init_user_ns, current_euid()));
59467 + print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
59468 + preempt_disable();
59469 + show_regs(regs);
59470 + preempt_enable();
59471 + force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
59472 +}
59473 +#endif
59474 +
59475 +#ifdef CONFIG_PAX_USERCOPY
59476 +/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
59477 +static noinline int check_stack_object(const void *obj, unsigned long len)
59478 +{
59479 + const void * const stack = task_stack_page(current);
59480 + const void * const stackend = stack + THREAD_SIZE;
59481 +
59482 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
59483 + const void *frame = NULL;
59484 + const void *oldframe;
59485 +#endif
59486 +
59487 + if (obj + len < obj)
59488 + return -1;
59489 +
59490 + if (obj + len <= stack || stackend <= obj)
59491 + return 0;
59492 +
59493 + if (obj < stack || stackend < obj + len)
59494 + return -1;
59495 +
59496 +#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
59497 + oldframe = __builtin_frame_address(1);
59498 + if (oldframe)
59499 + frame = __builtin_frame_address(2);
59500 + /*
59501 + low ----------------------------------------------> high
59502 + [saved bp][saved ip][args][local vars][saved bp][saved ip]
59503 + ^----------------^
59504 + allow copies only within here
59505 + */
59506 + while (stack <= frame && frame < stackend) {
59507 + /* if obj + len extends past the last frame, this
59508 + check won't pass and the next frame will be 0,
59509 + causing us to bail out and correctly report
59510 + the copy as invalid
59511 + */
59512 + if (obj + len <= frame)
59513 + return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
59514 + oldframe = frame;
59515 + frame = *(const void * const *)frame;
59516 + }
59517 + return -1;
59518 +#else
59519 + return 1;
59520 +#endif
59521 +}
59522 +
59523 +static __noreturn void pax_report_usercopy(const void *ptr, unsigned long len, bool to_user, const char *type)
59524 +{
59525 + if (current->signal->curr_ip)
59526 + printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
59527 + &current->signal->curr_ip, to_user ? "leak" : "overwrite", to_user ? "from" : "to", ptr, type ? : "unknown", len);
59528 + else
59529 + printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
59530 + to_user ? "leak" : "overwrite", to_user ? "from" : "to", ptr, type ? : "unknown", len);
59531 + dump_stack();
59532 + gr_handle_kernel_exploit();
59533 + do_group_exit(SIGKILL);
59534 +}
59535 +#endif
59536 +
59537 +#ifdef CONFIG_PAX_USERCOPY
59538 +
59539 +static inline bool check_kernel_text_object(unsigned long low, unsigned long high)
59540 +{
59541 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
59542 + unsigned long textlow = ktla_ktva((unsigned long)_stext);
59543 +#ifdef CONFIG_MODULES
59544 + unsigned long texthigh = (unsigned long)MODULES_EXEC_VADDR;
59545 +#else
59546 + unsigned long texthigh = ktla_ktva((unsigned long)_etext);
59547 +#endif
59548 +
59549 +#else
59550 + unsigned long textlow = (unsigned long)_stext;
59551 + unsigned long texthigh = (unsigned long)_etext;
59552 +
59553 +#ifdef CONFIG_X86_64
59554 + /* check against linear mapping as well */
59555 + if (high > (unsigned long)__va(__pa(textlow)) &&
59556 + low < (unsigned long)__va(__pa(texthigh)))
59557 + return true;
59558 +#endif
59559 +
59560 +#endif
59561 +
59562 + if (high <= textlow || low >= texthigh)
59563 + return false;
59564 + else
59565 + return true;
59566 +}
59567 +#endif
59568 +
59569 +void __check_object_size(const void *ptr, unsigned long n, bool to_user, bool const_size)
59570 +{
59571 +#ifdef CONFIG_PAX_USERCOPY
59572 + const char *type;
59573 +#endif
59574 +
59575 +#ifndef CONFIG_STACK_GROWSUP
59576 + unsigned long stackstart = (unsigned long)task_stack_page(current);
59577 + if (unlikely(current_stack_pointer < stackstart + 512 ||
59578 + current_stack_pointer >= stackstart + THREAD_SIZE))
59579 + BUG();
59580 +#endif
59581 +
59582 +#ifndef CONFIG_PAX_USERCOPY_DEBUG
59583 + if (const_size)
59584 + return;
59585 +#endif
59586 +
59587 +#ifdef CONFIG_PAX_USERCOPY
59588 + if (!n)
59589 + return;
59590 +
59591 + type = check_heap_object(ptr, n);
59592 + if (!type) {
59593 + int ret = check_stack_object(ptr, n);
59594 + if (ret == 1 || ret == 2)
59595 + return;
59596 + if (ret == 0) {
59597 + if (check_kernel_text_object((unsigned long)ptr, (unsigned long)ptr + n))
59598 + type = "<kernel text>";
59599 + else
59600 + return;
59601 + } else
59602 + type = "<process stack>";
59603 + }
59604 +
59605 + pax_report_usercopy(ptr, n, to_user, type);
59606 +#endif
59607 +
59608 +}
59609 +EXPORT_SYMBOL(__check_object_size);
59610 +
59611 +#ifdef CONFIG_PAX_MEMORY_STACKLEAK
59612 +void pax_track_stack(void)
59613 +{
59614 + unsigned long sp = (unsigned long)&sp;
59615 + if (sp < current_thread_info()->lowest_stack &&
59616 + sp > (unsigned long)task_stack_page(current))
59617 + current_thread_info()->lowest_stack = sp;
59618 + if (unlikely((sp & ~(THREAD_SIZE - 1)) < (THREAD_SIZE/16)))
59619 + BUG();
59620 +}
59621 +EXPORT_SYMBOL(pax_track_stack);
59622 +#endif
59623 +
59624 +#ifdef CONFIG_PAX_SIZE_OVERFLOW
59625 +void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
59626 +{
59627 + printk(KERN_ERR "PAX: size overflow detected in function %s %s:%u %s", func, file, line, ssa_name);
59628 + dump_stack();
59629 + do_group_exit(SIGKILL);
59630 +}
59631 +EXPORT_SYMBOL(report_size_overflow);
59632 +#endif
59633 diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
59634 index 9f9992b..8b59411 100644
59635 --- a/fs/ext2/balloc.c
59636 +++ b/fs/ext2/balloc.c
59637 @@ -1184,10 +1184,10 @@ static int ext2_has_free_blocks(struct ext2_sb_info *sbi)
59638
59639 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
59640 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
59641 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
59642 + if (free_blocks < root_blocks + 1 &&
59643 !uid_eq(sbi->s_resuid, current_fsuid()) &&
59644 (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) ||
59645 - !in_group_p (sbi->s_resgid))) {
59646 + !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) {
59647 return 0;
59648 }
59649 return 1;
59650 diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c
59651 index 9142614..97484fa 100644
59652 --- a/fs/ext2/xattr.c
59653 +++ b/fs/ext2/xattr.c
59654 @@ -247,7 +247,7 @@ ext2_xattr_list(struct dentry *dentry, char *buffer, size_t buffer_size)
59655 struct buffer_head *bh = NULL;
59656 struct ext2_xattr_entry *entry;
59657 char *end;
59658 - size_t rest = buffer_size;
59659 + size_t rest = buffer_size, total_size = 0;
59660 int error;
59661
59662 ea_idebug(inode, "buffer=%p, buffer_size=%ld",
59663 @@ -305,9 +305,10 @@ bad_block: ext2_error(inode->i_sb, "ext2_xattr_list",
59664 buffer += size;
59665 }
59666 rest -= size;
59667 + total_size += size;
59668 }
59669 }
59670 - error = buffer_size - rest; /* total size */
59671 + error = total_size;
59672
59673 cleanup:
59674 brelse(bh);
59675 diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
59676 index 22548f5..41521d8 100644
59677 --- a/fs/ext3/balloc.c
59678 +++ b/fs/ext3/balloc.c
59679 @@ -1438,10 +1438,10 @@ static int ext3_has_free_blocks(struct ext3_sb_info *sbi, int use_reservation)
59680
59681 free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
59682 root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
59683 - if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
59684 + if (free_blocks < root_blocks + 1 &&
59685 !use_reservation && !uid_eq(sbi->s_resuid, current_fsuid()) &&
59686 (gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) ||
59687 - !in_group_p (sbi->s_resgid))) {
59688 + !in_group_p (sbi->s_resgid)) && !capable_nolog(CAP_SYS_RESOURCE)) {
59689 return 0;
59690 }
59691 return 1;
59692 diff --git a/fs/ext3/xattr.c b/fs/ext3/xattr.c
59693 index c6874be..f8a6ae8 100644
59694 --- a/fs/ext3/xattr.c
59695 +++ b/fs/ext3/xattr.c
59696 @@ -330,7 +330,7 @@ static int
59697 ext3_xattr_list_entries(struct dentry *dentry, struct ext3_xattr_entry *entry,
59698 char *buffer, size_t buffer_size)
59699 {
59700 - size_t rest = buffer_size;
59701 + size_t rest = buffer_size, total_size = 0;
59702
59703 for (; !IS_LAST_ENTRY(entry); entry = EXT3_XATTR_NEXT(entry)) {
59704 const struct xattr_handler *handler =
59705 @@ -347,9 +347,10 @@ ext3_xattr_list_entries(struct dentry *dentry, struct ext3_xattr_entry *entry,
59706 buffer += size;
59707 }
59708 rest -= size;
59709 + total_size += size;
59710 }
59711 }
59712 - return buffer_size - rest;
59713 + return total_size;
59714 }
59715
59716 static int
59717 diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
59718 index 6ea7b14..8fa16d9 100644
59719 --- a/fs/ext4/balloc.c
59720 +++ b/fs/ext4/balloc.c
59721 @@ -534,8 +534,8 @@ static int ext4_has_free_clusters(struct ext4_sb_info *sbi,
59722 /* Hm, nope. Are (enough) root reserved clusters available? */
59723 if (uid_eq(sbi->s_resuid, current_fsuid()) ||
59724 (!gid_eq(sbi->s_resgid, GLOBAL_ROOT_GID) && in_group_p(sbi->s_resgid)) ||
59725 - capable(CAP_SYS_RESOURCE) ||
59726 - (flags & EXT4_MB_USE_ROOT_BLOCKS)) {
59727 + (flags & EXT4_MB_USE_ROOT_BLOCKS) ||
59728 + capable_nolog(CAP_SYS_RESOURCE)) {
59729
59730 if (free_clusters >= (nclusters + dirty_clusters +
59731 resv_clusters))
59732 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
59733 index 3a603a8..9b868ba 100644
59734 --- a/fs/ext4/ext4.h
59735 +++ b/fs/ext4/ext4.h
59736 @@ -1269,19 +1269,19 @@ struct ext4_sb_info {
59737 unsigned long s_mb_last_start;
59738
59739 /* stats for buddy allocator */
59740 - atomic_t s_bal_reqs; /* number of reqs with len > 1 */
59741 - atomic_t s_bal_success; /* we found long enough chunks */
59742 - atomic_t s_bal_allocated; /* in blocks */
59743 - atomic_t s_bal_ex_scanned; /* total extents scanned */
59744 - atomic_t s_bal_goals; /* goal hits */
59745 - atomic_t s_bal_breaks; /* too long searches */
59746 - atomic_t s_bal_2orders; /* 2^order hits */
59747 + atomic_unchecked_t s_bal_reqs; /* number of reqs with len > 1 */
59748 + atomic_unchecked_t s_bal_success; /* we found long enough chunks */
59749 + atomic_unchecked_t s_bal_allocated; /* in blocks */
59750 + atomic_unchecked_t s_bal_ex_scanned; /* total extents scanned */
59751 + atomic_unchecked_t s_bal_goals; /* goal hits */
59752 + atomic_unchecked_t s_bal_breaks; /* too long searches */
59753 + atomic_unchecked_t s_bal_2orders; /* 2^order hits */
59754 spinlock_t s_bal_lock;
59755 unsigned long s_mb_buddies_generated;
59756 unsigned long long s_mb_generation_time;
59757 - atomic_t s_mb_lost_chunks;
59758 - atomic_t s_mb_preallocated;
59759 - atomic_t s_mb_discarded;
59760 + atomic_unchecked_t s_mb_lost_chunks;
59761 + atomic_unchecked_t s_mb_preallocated;
59762 + atomic_unchecked_t s_mb_discarded;
59763 atomic_t s_lock_busy;
59764
59765 /* locality groups */
59766 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
59767 index 04a5c75..09894fa 100644
59768 --- a/fs/ext4/mballoc.c
59769 +++ b/fs/ext4/mballoc.c
59770 @@ -1880,7 +1880,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
59771 BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
59772
59773 if (EXT4_SB(sb)->s_mb_stats)
59774 - atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
59775 + atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
59776
59777 break;
59778 }
59779 @@ -2189,7 +2189,7 @@ repeat:
59780 ac->ac_status = AC_STATUS_CONTINUE;
59781 ac->ac_flags |= EXT4_MB_HINT_FIRST;
59782 cr = 3;
59783 - atomic_inc(&sbi->s_mb_lost_chunks);
59784 + atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
59785 goto repeat;
59786 }
59787 }
59788 @@ -2697,25 +2697,25 @@ int ext4_mb_release(struct super_block *sb)
59789 if (sbi->s_mb_stats) {
59790 ext4_msg(sb, KERN_INFO,
59791 "mballoc: %u blocks %u reqs (%u success)",
59792 - atomic_read(&sbi->s_bal_allocated),
59793 - atomic_read(&sbi->s_bal_reqs),
59794 - atomic_read(&sbi->s_bal_success));
59795 + atomic_read_unchecked(&sbi->s_bal_allocated),
59796 + atomic_read_unchecked(&sbi->s_bal_reqs),
59797 + atomic_read_unchecked(&sbi->s_bal_success));
59798 ext4_msg(sb, KERN_INFO,
59799 "mballoc: %u extents scanned, %u goal hits, "
59800 "%u 2^N hits, %u breaks, %u lost",
59801 - atomic_read(&sbi->s_bal_ex_scanned),
59802 - atomic_read(&sbi->s_bal_goals),
59803 - atomic_read(&sbi->s_bal_2orders),
59804 - atomic_read(&sbi->s_bal_breaks),
59805 - atomic_read(&sbi->s_mb_lost_chunks));
59806 + atomic_read_unchecked(&sbi->s_bal_ex_scanned),
59807 + atomic_read_unchecked(&sbi->s_bal_goals),
59808 + atomic_read_unchecked(&sbi->s_bal_2orders),
59809 + atomic_read_unchecked(&sbi->s_bal_breaks),
59810 + atomic_read_unchecked(&sbi->s_mb_lost_chunks));
59811 ext4_msg(sb, KERN_INFO,
59812 "mballoc: %lu generated and it took %Lu",
59813 sbi->s_mb_buddies_generated,
59814 sbi->s_mb_generation_time);
59815 ext4_msg(sb, KERN_INFO,
59816 "mballoc: %u preallocated, %u discarded",
59817 - atomic_read(&sbi->s_mb_preallocated),
59818 - atomic_read(&sbi->s_mb_discarded));
59819 + atomic_read_unchecked(&sbi->s_mb_preallocated),
59820 + atomic_read_unchecked(&sbi->s_mb_discarded));
59821 }
59822
59823 free_percpu(sbi->s_locality_groups);
59824 @@ -3169,16 +3169,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
59825 struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
59826
59827 if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
59828 - atomic_inc(&sbi->s_bal_reqs);
59829 - atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
59830 + atomic_inc_unchecked(&sbi->s_bal_reqs);
59831 + atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
59832 if (ac->ac_b_ex.fe_len >= ac->ac_o_ex.fe_len)
59833 - atomic_inc(&sbi->s_bal_success);
59834 - atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
59835 + atomic_inc_unchecked(&sbi->s_bal_success);
59836 + atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
59837 if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
59838 ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
59839 - atomic_inc(&sbi->s_bal_goals);
59840 + atomic_inc_unchecked(&sbi->s_bal_goals);
59841 if (ac->ac_found > sbi->s_mb_max_to_scan)
59842 - atomic_inc(&sbi->s_bal_breaks);
59843 + atomic_inc_unchecked(&sbi->s_bal_breaks);
59844 }
59845
59846 if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
59847 @@ -3583,7 +3583,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
59848 trace_ext4_mb_new_inode_pa(ac, pa);
59849
59850 ext4_mb_use_inode_pa(ac, pa);
59851 - atomic_add(pa->pa_free, &sbi->s_mb_preallocated);
59852 + atomic_add_unchecked(pa->pa_free, &sbi->s_mb_preallocated);
59853
59854 ei = EXT4_I(ac->ac_inode);
59855 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
59856 @@ -3643,7 +3643,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
59857 trace_ext4_mb_new_group_pa(ac, pa);
59858
59859 ext4_mb_use_group_pa(ac, pa);
59860 - atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
59861 + atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
59862
59863 grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
59864 lg = ac->ac_lg;
59865 @@ -3732,7 +3732,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
59866 * from the bitmap and continue.
59867 */
59868 }
59869 - atomic_add(free, &sbi->s_mb_discarded);
59870 + atomic_add_unchecked(free, &sbi->s_mb_discarded);
59871
59872 return err;
59873 }
59874 @@ -3750,7 +3750,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
59875 ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
59876 BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
59877 mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
59878 - atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
59879 + atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
59880 trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
59881
59882 return 0;
59883 diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
59884 index 04434ad..6404663 100644
59885 --- a/fs/ext4/mmp.c
59886 +++ b/fs/ext4/mmp.c
59887 @@ -113,7 +113,7 @@ static int read_mmp_block(struct super_block *sb, struct buffer_head **bh,
59888 void __dump_mmp_msg(struct super_block *sb, struct mmp_struct *mmp,
59889 const char *function, unsigned int line, const char *msg)
59890 {
59891 - __ext4_warning(sb, function, line, msg);
59892 + __ext4_warning(sb, function, line, "%s", msg);
59893 __ext4_warning(sb, function, line,
59894 "MMP failure info: last update time: %llu, last update "
59895 "node: %s, last update device: %s\n",
59896 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
59897 index 710fed2..a82e4e8 100644
59898 --- a/fs/ext4/super.c
59899 +++ b/fs/ext4/super.c
59900 @@ -1270,7 +1270,7 @@ static ext4_fsblk_t get_sb_block(void **data)
59901 }
59902
59903 #define DEFAULT_JOURNAL_IOPRIO (IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, 3))
59904 -static char deprecated_msg[] = "Mount option \"%s\" will be removed by %s\n"
59905 +static const char deprecated_msg[] = "Mount option \"%s\" will be removed by %s\n"
59906 "Contact linux-ext4@vger.kernel.org if you think we should keep it.\n";
59907
59908 #ifdef CONFIG_QUOTA
59909 @@ -2450,7 +2450,7 @@ struct ext4_attr {
59910 int offset;
59911 int deprecated_val;
59912 } u;
59913 -};
59914 +} __do_const;
59915
59916 static int parse_strtoull(const char *buf,
59917 unsigned long long max, unsigned long long *value)
59918 diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
59919 index 55e611c..cfad16d 100644
59920 --- a/fs/ext4/xattr.c
59921 +++ b/fs/ext4/xattr.c
59922 @@ -381,7 +381,7 @@ static int
59923 ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
59924 char *buffer, size_t buffer_size)
59925 {
59926 - size_t rest = buffer_size;
59927 + size_t rest = buffer_size, total_size = 0;
59928
59929 for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
59930 const struct xattr_handler *handler =
59931 @@ -398,9 +398,10 @@ ext4_xattr_list_entries(struct dentry *dentry, struct ext4_xattr_entry *entry,
59932 buffer += size;
59933 }
59934 rest -= size;
59935 + total_size += size;
59936 }
59937 }
59938 - return buffer_size - rest;
59939 + return total_size;
59940 }
59941
59942 static int
59943 diff --git a/fs/fcntl.c b/fs/fcntl.c
59944 index ef68665..5deacdc 100644
59945 --- a/fs/fcntl.c
59946 +++ b/fs/fcntl.c
59947 @@ -106,6 +106,11 @@ int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
59948 if (err)
59949 return err;
59950
59951 + if (gr_handle_chroot_fowner(pid, type))
59952 + return -ENOENT;
59953 + if (gr_check_protected_task_fowner(pid, type))
59954 + return -EACCES;
59955 +
59956 f_modown(filp, pid, type, force);
59957 return 0;
59958 }
59959 diff --git a/fs/fhandle.c b/fs/fhandle.c
59960 index 999ff5c..41f4109 100644
59961 --- a/fs/fhandle.c
59962 +++ b/fs/fhandle.c
59963 @@ -67,8 +67,7 @@ static long do_sys_name_to_handle(struct path *path,
59964 } else
59965 retval = 0;
59966 /* copy the mount id */
59967 - if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id,
59968 - sizeof(*mnt_id)) ||
59969 + if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
59970 copy_to_user(ufh, handle,
59971 sizeof(struct file_handle) + handle_bytes))
59972 retval = -EFAULT;
59973 diff --git a/fs/file.c b/fs/file.c
59974 index eb56a13..ccee850 100644
59975 --- a/fs/file.c
59976 +++ b/fs/file.c
59977 @@ -16,6 +16,7 @@
59978 #include <linux/slab.h>
59979 #include <linux/vmalloc.h>
59980 #include <linux/file.h>
59981 +#include <linux/security.h>
59982 #include <linux/fdtable.h>
59983 #include <linux/bitops.h>
59984 #include <linux/interrupt.h>
59985 @@ -141,7 +142,7 @@ out:
59986 * Return <0 error code on error; 1 on successful completion.
59987 * The files->file_lock should be held on entry, and will be held on exit.
59988 */
59989 -static int expand_fdtable(struct files_struct *files, int nr)
59990 +static int expand_fdtable(struct files_struct *files, unsigned int nr)
59991 __releases(files->file_lock)
59992 __acquires(files->file_lock)
59993 {
59994 @@ -186,7 +187,7 @@ static int expand_fdtable(struct files_struct *files, int nr)
59995 * expanded and execution may have blocked.
59996 * The files->file_lock should be held on entry, and will be held on exit.
59997 */
59998 -static int expand_files(struct files_struct *files, int nr)
59999 +static int expand_files(struct files_struct *files, unsigned int nr)
60000 {
60001 struct fdtable *fdt;
60002
60003 @@ -807,6 +808,7 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags)
60004 if (!file)
60005 return __close_fd(files, fd);
60006
60007 + gr_learn_resource(current, RLIMIT_NOFILE, fd, 0);
60008 if (fd >= rlimit(RLIMIT_NOFILE))
60009 return -EBADF;
60010
60011 @@ -833,6 +835,7 @@ SYSCALL_DEFINE3(dup3, unsigned int, oldfd, unsigned int, newfd, int, flags)
60012 if (unlikely(oldfd == newfd))
60013 return -EINVAL;
60014
60015 + gr_learn_resource(current, RLIMIT_NOFILE, newfd, 0);
60016 if (newfd >= rlimit(RLIMIT_NOFILE))
60017 return -EBADF;
60018
60019 @@ -888,6 +891,7 @@ SYSCALL_DEFINE1(dup, unsigned int, fildes)
60020 int f_dupfd(unsigned int from, struct file *file, unsigned flags)
60021 {
60022 int err;
60023 + gr_learn_resource(current, RLIMIT_NOFILE, from, 0);
60024 if (from >= rlimit(RLIMIT_NOFILE))
60025 return -EINVAL;
60026 err = alloc_fd(from, flags);
60027 diff --git a/fs/filesystems.c b/fs/filesystems.c
60028 index 92567d9..fcd8cbf 100644
60029 --- a/fs/filesystems.c
60030 +++ b/fs/filesystems.c
60031 @@ -273,7 +273,11 @@ struct file_system_type *get_fs_type(const char *name)
60032 int len = dot ? dot - name : strlen(name);
60033
60034 fs = __get_fs_type(name, len);
60035 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
60036 + if (!fs && (___request_module(true, "grsec_modharden_fs", "fs-%.*s", len, name) == 0))
60037 +#else
60038 if (!fs && (request_module("fs-%.*s", len, name) == 0))
60039 +#endif
60040 fs = __get_fs_type(name, len);
60041
60042 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
60043 diff --git a/fs/fs_struct.c b/fs/fs_struct.c
60044 index 7dca743..543d620 100644
60045 --- a/fs/fs_struct.c
60046 +++ b/fs/fs_struct.c
60047 @@ -4,6 +4,7 @@
60048 #include <linux/path.h>
60049 #include <linux/slab.h>
60050 #include <linux/fs_struct.h>
60051 +#include <linux/grsecurity.h>
60052 #include "internal.h"
60053
60054 /*
60055 @@ -19,6 +20,7 @@ void set_fs_root(struct fs_struct *fs, const struct path *path)
60056 write_seqcount_begin(&fs->seq);
60057 old_root = fs->root;
60058 fs->root = *path;
60059 + gr_set_chroot_entries(current, path);
60060 write_seqcount_end(&fs->seq);
60061 spin_unlock(&fs->lock);
60062 if (old_root.dentry)
60063 @@ -67,6 +69,10 @@ void chroot_fs_refs(const struct path *old_root, const struct path *new_root)
60064 int hits = 0;
60065 spin_lock(&fs->lock);
60066 write_seqcount_begin(&fs->seq);
60067 + /* this root replacement is only done by pivot_root,
60068 + leave grsec's chroot tagging alone for this task
60069 + so that a pivoted root isn't treated as a chroot
60070 + */
60071 hits += replace_path(&fs->root, old_root, new_root);
60072 hits += replace_path(&fs->pwd, old_root, new_root);
60073 write_seqcount_end(&fs->seq);
60074 @@ -99,7 +105,8 @@ void exit_fs(struct task_struct *tsk)
60075 task_lock(tsk);
60076 spin_lock(&fs->lock);
60077 tsk->fs = NULL;
60078 - kill = !--fs->users;
60079 + gr_clear_chroot_entries(tsk);
60080 + kill = !atomic_dec_return(&fs->users);
60081 spin_unlock(&fs->lock);
60082 task_unlock(tsk);
60083 if (kill)
60084 @@ -112,7 +119,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
60085 struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
60086 /* We don't need to lock fs - think why ;-) */
60087 if (fs) {
60088 - fs->users = 1;
60089 + atomic_set(&fs->users, 1);
60090 fs->in_exec = 0;
60091 spin_lock_init(&fs->lock);
60092 seqcount_init(&fs->seq);
60093 @@ -121,6 +128,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old)
60094 spin_lock(&old->lock);
60095 fs->root = old->root;
60096 path_get(&fs->root);
60097 + /* instead of calling gr_set_chroot_entries here,
60098 + we call it from every caller of this function
60099 + */
60100 fs->pwd = old->pwd;
60101 path_get(&fs->pwd);
60102 spin_unlock(&old->lock);
60103 @@ -139,8 +149,9 @@ int unshare_fs_struct(void)
60104
60105 task_lock(current);
60106 spin_lock(&fs->lock);
60107 - kill = !--fs->users;
60108 + kill = !atomic_dec_return(&fs->users);
60109 current->fs = new_fs;
60110 + gr_set_chroot_entries(current, &new_fs->root);
60111 spin_unlock(&fs->lock);
60112 task_unlock(current);
60113
60114 @@ -153,13 +164,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct);
60115
60116 int current_umask(void)
60117 {
60118 - return current->fs->umask;
60119 + return current->fs->umask | gr_acl_umask();
60120 }
60121 EXPORT_SYMBOL(current_umask);
60122
60123 /* to be mentioned only in INIT_TASK */
60124 struct fs_struct init_fs = {
60125 - .users = 1,
60126 + .users = ATOMIC_INIT(1),
60127 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock),
60128 .seq = SEQCNT_ZERO(init_fs.seq),
60129 .umask = 0022,
60130 diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c
60131 index 29d7feb..303644d 100644
60132 --- a/fs/fscache/cookie.c
60133 +++ b/fs/fscache/cookie.c
60134 @@ -19,7 +19,7 @@
60135
60136 struct kmem_cache *fscache_cookie_jar;
60137
60138 -static atomic_t fscache_object_debug_id = ATOMIC_INIT(0);
60139 +static atomic_unchecked_t fscache_object_debug_id = ATOMIC_INIT(0);
60140
60141 static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie);
60142 static int fscache_alloc_object(struct fscache_cache *cache,
60143 @@ -69,11 +69,11 @@ struct fscache_cookie *__fscache_acquire_cookie(
60144 parent ? (char *) parent->def->name : "<no-parent>",
60145 def->name, netfs_data, enable);
60146
60147 - fscache_stat(&fscache_n_acquires);
60148 + fscache_stat_unchecked(&fscache_n_acquires);
60149
60150 /* if there's no parent cookie, then we don't create one here either */
60151 if (!parent) {
60152 - fscache_stat(&fscache_n_acquires_null);
60153 + fscache_stat_unchecked(&fscache_n_acquires_null);
60154 _leave(" [no parent]");
60155 return NULL;
60156 }
60157 @@ -88,7 +88,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
60158 /* allocate and initialise a cookie */
60159 cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
60160 if (!cookie) {
60161 - fscache_stat(&fscache_n_acquires_oom);
60162 + fscache_stat_unchecked(&fscache_n_acquires_oom);
60163 _leave(" [ENOMEM]");
60164 return NULL;
60165 }
60166 @@ -115,13 +115,13 @@ struct fscache_cookie *__fscache_acquire_cookie(
60167
60168 switch (cookie->def->type) {
60169 case FSCACHE_COOKIE_TYPE_INDEX:
60170 - fscache_stat(&fscache_n_cookie_index);
60171 + fscache_stat_unchecked(&fscache_n_cookie_index);
60172 break;
60173 case FSCACHE_COOKIE_TYPE_DATAFILE:
60174 - fscache_stat(&fscache_n_cookie_data);
60175 + fscache_stat_unchecked(&fscache_n_cookie_data);
60176 break;
60177 default:
60178 - fscache_stat(&fscache_n_cookie_special);
60179 + fscache_stat_unchecked(&fscache_n_cookie_special);
60180 break;
60181 }
60182
60183 @@ -135,7 +135,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
60184 } else {
60185 atomic_dec(&parent->n_children);
60186 __fscache_cookie_put(cookie);
60187 - fscache_stat(&fscache_n_acquires_nobufs);
60188 + fscache_stat_unchecked(&fscache_n_acquires_nobufs);
60189 _leave(" = NULL");
60190 return NULL;
60191 }
60192 @@ -144,7 +144,7 @@ struct fscache_cookie *__fscache_acquire_cookie(
60193 }
60194 }
60195
60196 - fscache_stat(&fscache_n_acquires_ok);
60197 + fscache_stat_unchecked(&fscache_n_acquires_ok);
60198 _leave(" = %p", cookie);
60199 return cookie;
60200 }
60201 @@ -213,7 +213,7 @@ static int fscache_acquire_non_index_cookie(struct fscache_cookie *cookie)
60202 cache = fscache_select_cache_for_object(cookie->parent);
60203 if (!cache) {
60204 up_read(&fscache_addremove_sem);
60205 - fscache_stat(&fscache_n_acquires_no_cache);
60206 + fscache_stat_unchecked(&fscache_n_acquires_no_cache);
60207 _leave(" = -ENOMEDIUM [no cache]");
60208 return -ENOMEDIUM;
60209 }
60210 @@ -297,14 +297,14 @@ static int fscache_alloc_object(struct fscache_cache *cache,
60211 object = cache->ops->alloc_object(cache, cookie);
60212 fscache_stat_d(&fscache_n_cop_alloc_object);
60213 if (IS_ERR(object)) {
60214 - fscache_stat(&fscache_n_object_no_alloc);
60215 + fscache_stat_unchecked(&fscache_n_object_no_alloc);
60216 ret = PTR_ERR(object);
60217 goto error;
60218 }
60219
60220 - fscache_stat(&fscache_n_object_alloc);
60221 + fscache_stat_unchecked(&fscache_n_object_alloc);
60222
60223 - object->debug_id = atomic_inc_return(&fscache_object_debug_id);
60224 + object->debug_id = atomic_inc_return_unchecked(&fscache_object_debug_id);
60225
60226 _debug("ALLOC OBJ%x: %s {%lx}",
60227 object->debug_id, cookie->def->name, object->events);
60228 @@ -418,7 +418,7 @@ void __fscache_invalidate(struct fscache_cookie *cookie)
60229
60230 _enter("{%s}", cookie->def->name);
60231
60232 - fscache_stat(&fscache_n_invalidates);
60233 + fscache_stat_unchecked(&fscache_n_invalidates);
60234
60235 /* Only permit invalidation of data files. Invalidating an index will
60236 * require the caller to release all its attachments to the tree rooted
60237 @@ -477,10 +477,10 @@ void __fscache_update_cookie(struct fscache_cookie *cookie)
60238 {
60239 struct fscache_object *object;
60240
60241 - fscache_stat(&fscache_n_updates);
60242 + fscache_stat_unchecked(&fscache_n_updates);
60243
60244 if (!cookie) {
60245 - fscache_stat(&fscache_n_updates_null);
60246 + fscache_stat_unchecked(&fscache_n_updates_null);
60247 _leave(" [no cookie]");
60248 return;
60249 }
60250 @@ -581,12 +581,12 @@ EXPORT_SYMBOL(__fscache_disable_cookie);
60251 */
60252 void __fscache_relinquish_cookie(struct fscache_cookie *cookie, bool retire)
60253 {
60254 - fscache_stat(&fscache_n_relinquishes);
60255 + fscache_stat_unchecked(&fscache_n_relinquishes);
60256 if (retire)
60257 - fscache_stat(&fscache_n_relinquishes_retire);
60258 + fscache_stat_unchecked(&fscache_n_relinquishes_retire);
60259
60260 if (!cookie) {
60261 - fscache_stat(&fscache_n_relinquishes_null);
60262 + fscache_stat_unchecked(&fscache_n_relinquishes_null);
60263 _leave(" [no cookie]");
60264 return;
60265 }
60266 @@ -687,7 +687,7 @@ int __fscache_check_consistency(struct fscache_cookie *cookie)
60267 if (test_bit(FSCACHE_IOERROR, &object->cache->flags))
60268 goto inconsistent;
60269
60270 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
60271 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
60272
60273 __fscache_use_cookie(cookie);
60274 if (fscache_submit_op(object, op) < 0)
60275 diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h
60276 index 4226f66..0fb3f45 100644
60277 --- a/fs/fscache/internal.h
60278 +++ b/fs/fscache/internal.h
60279 @@ -133,8 +133,8 @@ extern void fscache_operation_gc(struct work_struct *);
60280 extern int fscache_wait_for_deferred_lookup(struct fscache_cookie *);
60281 extern int fscache_wait_for_operation_activation(struct fscache_object *,
60282 struct fscache_operation *,
60283 - atomic_t *,
60284 - atomic_t *,
60285 + atomic_unchecked_t *,
60286 + atomic_unchecked_t *,
60287 void (*)(struct fscache_operation *));
60288 extern void fscache_invalidate_writes(struct fscache_cookie *);
60289
60290 @@ -153,101 +153,101 @@ extern void fscache_proc_cleanup(void);
60291 * stats.c
60292 */
60293 #ifdef CONFIG_FSCACHE_STATS
60294 -extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
60295 -extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
60296 +extern atomic_unchecked_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
60297 +extern atomic_unchecked_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
60298
60299 -extern atomic_t fscache_n_op_pend;
60300 -extern atomic_t fscache_n_op_run;
60301 -extern atomic_t fscache_n_op_enqueue;
60302 -extern atomic_t fscache_n_op_deferred_release;
60303 -extern atomic_t fscache_n_op_release;
60304 -extern atomic_t fscache_n_op_gc;
60305 -extern atomic_t fscache_n_op_cancelled;
60306 -extern atomic_t fscache_n_op_rejected;
60307 +extern atomic_unchecked_t fscache_n_op_pend;
60308 +extern atomic_unchecked_t fscache_n_op_run;
60309 +extern atomic_unchecked_t fscache_n_op_enqueue;
60310 +extern atomic_unchecked_t fscache_n_op_deferred_release;
60311 +extern atomic_unchecked_t fscache_n_op_release;
60312 +extern atomic_unchecked_t fscache_n_op_gc;
60313 +extern atomic_unchecked_t fscache_n_op_cancelled;
60314 +extern atomic_unchecked_t fscache_n_op_rejected;
60315
60316 -extern atomic_t fscache_n_attr_changed;
60317 -extern atomic_t fscache_n_attr_changed_ok;
60318 -extern atomic_t fscache_n_attr_changed_nobufs;
60319 -extern atomic_t fscache_n_attr_changed_nomem;
60320 -extern atomic_t fscache_n_attr_changed_calls;
60321 +extern atomic_unchecked_t fscache_n_attr_changed;
60322 +extern atomic_unchecked_t fscache_n_attr_changed_ok;
60323 +extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
60324 +extern atomic_unchecked_t fscache_n_attr_changed_nomem;
60325 +extern atomic_unchecked_t fscache_n_attr_changed_calls;
60326
60327 -extern atomic_t fscache_n_allocs;
60328 -extern atomic_t fscache_n_allocs_ok;
60329 -extern atomic_t fscache_n_allocs_wait;
60330 -extern atomic_t fscache_n_allocs_nobufs;
60331 -extern atomic_t fscache_n_allocs_intr;
60332 -extern atomic_t fscache_n_allocs_object_dead;
60333 -extern atomic_t fscache_n_alloc_ops;
60334 -extern atomic_t fscache_n_alloc_op_waits;
60335 +extern atomic_unchecked_t fscache_n_allocs;
60336 +extern atomic_unchecked_t fscache_n_allocs_ok;
60337 +extern atomic_unchecked_t fscache_n_allocs_wait;
60338 +extern atomic_unchecked_t fscache_n_allocs_nobufs;
60339 +extern atomic_unchecked_t fscache_n_allocs_intr;
60340 +extern atomic_unchecked_t fscache_n_allocs_object_dead;
60341 +extern atomic_unchecked_t fscache_n_alloc_ops;
60342 +extern atomic_unchecked_t fscache_n_alloc_op_waits;
60343
60344 -extern atomic_t fscache_n_retrievals;
60345 -extern atomic_t fscache_n_retrievals_ok;
60346 -extern atomic_t fscache_n_retrievals_wait;
60347 -extern atomic_t fscache_n_retrievals_nodata;
60348 -extern atomic_t fscache_n_retrievals_nobufs;
60349 -extern atomic_t fscache_n_retrievals_intr;
60350 -extern atomic_t fscache_n_retrievals_nomem;
60351 -extern atomic_t fscache_n_retrievals_object_dead;
60352 -extern atomic_t fscache_n_retrieval_ops;
60353 -extern atomic_t fscache_n_retrieval_op_waits;
60354 +extern atomic_unchecked_t fscache_n_retrievals;
60355 +extern atomic_unchecked_t fscache_n_retrievals_ok;
60356 +extern atomic_unchecked_t fscache_n_retrievals_wait;
60357 +extern atomic_unchecked_t fscache_n_retrievals_nodata;
60358 +extern atomic_unchecked_t fscache_n_retrievals_nobufs;
60359 +extern atomic_unchecked_t fscache_n_retrievals_intr;
60360 +extern atomic_unchecked_t fscache_n_retrievals_nomem;
60361 +extern atomic_unchecked_t fscache_n_retrievals_object_dead;
60362 +extern atomic_unchecked_t fscache_n_retrieval_ops;
60363 +extern atomic_unchecked_t fscache_n_retrieval_op_waits;
60364
60365 -extern atomic_t fscache_n_stores;
60366 -extern atomic_t fscache_n_stores_ok;
60367 -extern atomic_t fscache_n_stores_again;
60368 -extern atomic_t fscache_n_stores_nobufs;
60369 -extern atomic_t fscache_n_stores_oom;
60370 -extern atomic_t fscache_n_store_ops;
60371 -extern atomic_t fscache_n_store_calls;
60372 -extern atomic_t fscache_n_store_pages;
60373 -extern atomic_t fscache_n_store_radix_deletes;
60374 -extern atomic_t fscache_n_store_pages_over_limit;
60375 +extern atomic_unchecked_t fscache_n_stores;
60376 +extern atomic_unchecked_t fscache_n_stores_ok;
60377 +extern atomic_unchecked_t fscache_n_stores_again;
60378 +extern atomic_unchecked_t fscache_n_stores_nobufs;
60379 +extern atomic_unchecked_t fscache_n_stores_oom;
60380 +extern atomic_unchecked_t fscache_n_store_ops;
60381 +extern atomic_unchecked_t fscache_n_store_calls;
60382 +extern atomic_unchecked_t fscache_n_store_pages;
60383 +extern atomic_unchecked_t fscache_n_store_radix_deletes;
60384 +extern atomic_unchecked_t fscache_n_store_pages_over_limit;
60385
60386 -extern atomic_t fscache_n_store_vmscan_not_storing;
60387 -extern atomic_t fscache_n_store_vmscan_gone;
60388 -extern atomic_t fscache_n_store_vmscan_busy;
60389 -extern atomic_t fscache_n_store_vmscan_cancelled;
60390 -extern atomic_t fscache_n_store_vmscan_wait;
60391 +extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
60392 +extern atomic_unchecked_t fscache_n_store_vmscan_gone;
60393 +extern atomic_unchecked_t fscache_n_store_vmscan_busy;
60394 +extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
60395 +extern atomic_unchecked_t fscache_n_store_vmscan_wait;
60396
60397 -extern atomic_t fscache_n_marks;
60398 -extern atomic_t fscache_n_uncaches;
60399 +extern atomic_unchecked_t fscache_n_marks;
60400 +extern atomic_unchecked_t fscache_n_uncaches;
60401
60402 -extern atomic_t fscache_n_acquires;
60403 -extern atomic_t fscache_n_acquires_null;
60404 -extern atomic_t fscache_n_acquires_no_cache;
60405 -extern atomic_t fscache_n_acquires_ok;
60406 -extern atomic_t fscache_n_acquires_nobufs;
60407 -extern atomic_t fscache_n_acquires_oom;
60408 +extern atomic_unchecked_t fscache_n_acquires;
60409 +extern atomic_unchecked_t fscache_n_acquires_null;
60410 +extern atomic_unchecked_t fscache_n_acquires_no_cache;
60411 +extern atomic_unchecked_t fscache_n_acquires_ok;
60412 +extern atomic_unchecked_t fscache_n_acquires_nobufs;
60413 +extern atomic_unchecked_t fscache_n_acquires_oom;
60414
60415 -extern atomic_t fscache_n_invalidates;
60416 -extern atomic_t fscache_n_invalidates_run;
60417 +extern atomic_unchecked_t fscache_n_invalidates;
60418 +extern atomic_unchecked_t fscache_n_invalidates_run;
60419
60420 -extern atomic_t fscache_n_updates;
60421 -extern atomic_t fscache_n_updates_null;
60422 -extern atomic_t fscache_n_updates_run;
60423 +extern atomic_unchecked_t fscache_n_updates;
60424 +extern atomic_unchecked_t fscache_n_updates_null;
60425 +extern atomic_unchecked_t fscache_n_updates_run;
60426
60427 -extern atomic_t fscache_n_relinquishes;
60428 -extern atomic_t fscache_n_relinquishes_null;
60429 -extern atomic_t fscache_n_relinquishes_waitcrt;
60430 -extern atomic_t fscache_n_relinquishes_retire;
60431 +extern atomic_unchecked_t fscache_n_relinquishes;
60432 +extern atomic_unchecked_t fscache_n_relinquishes_null;
60433 +extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
60434 +extern atomic_unchecked_t fscache_n_relinquishes_retire;
60435
60436 -extern atomic_t fscache_n_cookie_index;
60437 -extern atomic_t fscache_n_cookie_data;
60438 -extern atomic_t fscache_n_cookie_special;
60439 +extern atomic_unchecked_t fscache_n_cookie_index;
60440 +extern atomic_unchecked_t fscache_n_cookie_data;
60441 +extern atomic_unchecked_t fscache_n_cookie_special;
60442
60443 -extern atomic_t fscache_n_object_alloc;
60444 -extern atomic_t fscache_n_object_no_alloc;
60445 -extern atomic_t fscache_n_object_lookups;
60446 -extern atomic_t fscache_n_object_lookups_negative;
60447 -extern atomic_t fscache_n_object_lookups_positive;
60448 -extern atomic_t fscache_n_object_lookups_timed_out;
60449 -extern atomic_t fscache_n_object_created;
60450 -extern atomic_t fscache_n_object_avail;
60451 -extern atomic_t fscache_n_object_dead;
60452 +extern atomic_unchecked_t fscache_n_object_alloc;
60453 +extern atomic_unchecked_t fscache_n_object_no_alloc;
60454 +extern atomic_unchecked_t fscache_n_object_lookups;
60455 +extern atomic_unchecked_t fscache_n_object_lookups_negative;
60456 +extern atomic_unchecked_t fscache_n_object_lookups_positive;
60457 +extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
60458 +extern atomic_unchecked_t fscache_n_object_created;
60459 +extern atomic_unchecked_t fscache_n_object_avail;
60460 +extern atomic_unchecked_t fscache_n_object_dead;
60461
60462 -extern atomic_t fscache_n_checkaux_none;
60463 -extern atomic_t fscache_n_checkaux_okay;
60464 -extern atomic_t fscache_n_checkaux_update;
60465 -extern atomic_t fscache_n_checkaux_obsolete;
60466 +extern atomic_unchecked_t fscache_n_checkaux_none;
60467 +extern atomic_unchecked_t fscache_n_checkaux_okay;
60468 +extern atomic_unchecked_t fscache_n_checkaux_update;
60469 +extern atomic_unchecked_t fscache_n_checkaux_obsolete;
60470
60471 extern atomic_t fscache_n_cop_alloc_object;
60472 extern atomic_t fscache_n_cop_lookup_object;
60473 @@ -272,6 +272,11 @@ static inline void fscache_stat(atomic_t *stat)
60474 atomic_inc(stat);
60475 }
60476
60477 +static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
60478 +{
60479 + atomic_inc_unchecked(stat);
60480 +}
60481 +
60482 static inline void fscache_stat_d(atomic_t *stat)
60483 {
60484 atomic_dec(stat);
60485 @@ -284,6 +289,7 @@ extern const struct file_operations fscache_stats_fops;
60486
60487 #define __fscache_stat(stat) (NULL)
60488 #define fscache_stat(stat) do {} while (0)
60489 +#define fscache_stat_unchecked(stat) do {} while (0)
60490 #define fscache_stat_d(stat) do {} while (0)
60491 #endif
60492
60493 diff --git a/fs/fscache/object.c b/fs/fscache/object.c
60494 index d3b4539..ed0c659 100644
60495 --- a/fs/fscache/object.c
60496 +++ b/fs/fscache/object.c
60497 @@ -454,7 +454,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object
60498 _debug("LOOKUP \"%s\" in \"%s\"",
60499 cookie->def->name, object->cache->tag->name);
60500
60501 - fscache_stat(&fscache_n_object_lookups);
60502 + fscache_stat_unchecked(&fscache_n_object_lookups);
60503 fscache_stat(&fscache_n_cop_lookup_object);
60504 ret = object->cache->ops->lookup_object(object);
60505 fscache_stat_d(&fscache_n_cop_lookup_object);
60506 @@ -464,7 +464,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object
60507 if (ret == -ETIMEDOUT) {
60508 /* probably stuck behind another object, so move this one to
60509 * the back of the queue */
60510 - fscache_stat(&fscache_n_object_lookups_timed_out);
60511 + fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
60512 _leave(" [timeout]");
60513 return NO_TRANSIT;
60514 }
60515 @@ -492,7 +492,7 @@ void fscache_object_lookup_negative(struct fscache_object *object)
60516 _enter("{OBJ%x,%s}", object->debug_id, object->state->name);
60517
60518 if (!test_and_set_bit(FSCACHE_OBJECT_IS_LOOKED_UP, &object->flags)) {
60519 - fscache_stat(&fscache_n_object_lookups_negative);
60520 + fscache_stat_unchecked(&fscache_n_object_lookups_negative);
60521
60522 /* Allow write requests to begin stacking up and read requests to begin
60523 * returning ENODATA.
60524 @@ -527,7 +527,7 @@ void fscache_obtained_object(struct fscache_object *object)
60525 /* if we were still looking up, then we must have a positive lookup
60526 * result, in which case there may be data available */
60527 if (!test_and_set_bit(FSCACHE_OBJECT_IS_LOOKED_UP, &object->flags)) {
60528 - fscache_stat(&fscache_n_object_lookups_positive);
60529 + fscache_stat_unchecked(&fscache_n_object_lookups_positive);
60530
60531 /* We do (presumably) have data */
60532 clear_bit_unlock(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
60533 @@ -539,7 +539,7 @@ void fscache_obtained_object(struct fscache_object *object)
60534 clear_bit_unlock(FSCACHE_COOKIE_LOOKING_UP, &cookie->flags);
60535 wake_up_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP);
60536 } else {
60537 - fscache_stat(&fscache_n_object_created);
60538 + fscache_stat_unchecked(&fscache_n_object_created);
60539 }
60540
60541 set_bit(FSCACHE_OBJECT_IS_AVAILABLE, &object->flags);
60542 @@ -575,7 +575,7 @@ static const struct fscache_state *fscache_object_available(struct fscache_objec
60543 fscache_stat_d(&fscache_n_cop_lookup_complete);
60544
60545 fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
60546 - fscache_stat(&fscache_n_object_avail);
60547 + fscache_stat_unchecked(&fscache_n_object_avail);
60548
60549 _leave("");
60550 return transit_to(JUMPSTART_DEPS);
60551 @@ -722,7 +722,7 @@ static const struct fscache_state *fscache_drop_object(struct fscache_object *ob
60552
60553 /* this just shifts the object release to the work processor */
60554 fscache_put_object(object);
60555 - fscache_stat(&fscache_n_object_dead);
60556 + fscache_stat_unchecked(&fscache_n_object_dead);
60557
60558 _leave("");
60559 return transit_to(OBJECT_DEAD);
60560 @@ -887,7 +887,7 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
60561 enum fscache_checkaux result;
60562
60563 if (!object->cookie->def->check_aux) {
60564 - fscache_stat(&fscache_n_checkaux_none);
60565 + fscache_stat_unchecked(&fscache_n_checkaux_none);
60566 return FSCACHE_CHECKAUX_OKAY;
60567 }
60568
60569 @@ -896,17 +896,17 @@ enum fscache_checkaux fscache_check_aux(struct fscache_object *object,
60570 switch (result) {
60571 /* entry okay as is */
60572 case FSCACHE_CHECKAUX_OKAY:
60573 - fscache_stat(&fscache_n_checkaux_okay);
60574 + fscache_stat_unchecked(&fscache_n_checkaux_okay);
60575 break;
60576
60577 /* entry requires update */
60578 case FSCACHE_CHECKAUX_NEEDS_UPDATE:
60579 - fscache_stat(&fscache_n_checkaux_update);
60580 + fscache_stat_unchecked(&fscache_n_checkaux_update);
60581 break;
60582
60583 /* entry requires deletion */
60584 case FSCACHE_CHECKAUX_OBSOLETE:
60585 - fscache_stat(&fscache_n_checkaux_obsolete);
60586 + fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
60587 break;
60588
60589 default:
60590 @@ -992,7 +992,7 @@ static const struct fscache_state *fscache_invalidate_object(struct fscache_obje
60591 {
60592 const struct fscache_state *s;
60593
60594 - fscache_stat(&fscache_n_invalidates_run);
60595 + fscache_stat_unchecked(&fscache_n_invalidates_run);
60596 fscache_stat(&fscache_n_cop_invalidate_object);
60597 s = _fscache_invalidate_object(object, event);
60598 fscache_stat_d(&fscache_n_cop_invalidate_object);
60599 @@ -1007,7 +1007,7 @@ static const struct fscache_state *fscache_update_object(struct fscache_object *
60600 {
60601 _enter("{OBJ%x},%d", object->debug_id, event);
60602
60603 - fscache_stat(&fscache_n_updates_run);
60604 + fscache_stat_unchecked(&fscache_n_updates_run);
60605 fscache_stat(&fscache_n_cop_update_object);
60606 object->cache->ops->update_object(object);
60607 fscache_stat_d(&fscache_n_cop_update_object);
60608 diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
60609 index 318071a..379938b 100644
60610 --- a/fs/fscache/operation.c
60611 +++ b/fs/fscache/operation.c
60612 @@ -17,7 +17,7 @@
60613 #include <linux/slab.h>
60614 #include "internal.h"
60615
60616 -atomic_t fscache_op_debug_id;
60617 +atomic_unchecked_t fscache_op_debug_id;
60618 EXPORT_SYMBOL(fscache_op_debug_id);
60619
60620 /**
60621 @@ -39,7 +39,7 @@ void fscache_enqueue_operation(struct fscache_operation *op)
60622 ASSERTCMP(atomic_read(&op->usage), >, 0);
60623 ASSERTCMP(op->state, ==, FSCACHE_OP_ST_IN_PROGRESS);
60624
60625 - fscache_stat(&fscache_n_op_enqueue);
60626 + fscache_stat_unchecked(&fscache_n_op_enqueue);
60627 switch (op->flags & FSCACHE_OP_TYPE) {
60628 case FSCACHE_OP_ASYNC:
60629 _debug("queue async");
60630 @@ -73,7 +73,7 @@ static void fscache_run_op(struct fscache_object *object,
60631 wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
60632 if (op->processor)
60633 fscache_enqueue_operation(op);
60634 - fscache_stat(&fscache_n_op_run);
60635 + fscache_stat_unchecked(&fscache_n_op_run);
60636 }
60637
60638 /*
60639 @@ -105,11 +105,11 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
60640 if (object->n_in_progress > 0) {
60641 atomic_inc(&op->usage);
60642 list_add_tail(&op->pend_link, &object->pending_ops);
60643 - fscache_stat(&fscache_n_op_pend);
60644 + fscache_stat_unchecked(&fscache_n_op_pend);
60645 } else if (!list_empty(&object->pending_ops)) {
60646 atomic_inc(&op->usage);
60647 list_add_tail(&op->pend_link, &object->pending_ops);
60648 - fscache_stat(&fscache_n_op_pend);
60649 + fscache_stat_unchecked(&fscache_n_op_pend);
60650 fscache_start_operations(object);
60651 } else {
60652 ASSERTCMP(object->n_in_progress, ==, 0);
60653 @@ -125,7 +125,7 @@ int fscache_submit_exclusive_op(struct fscache_object *object,
60654 object->n_exclusive++; /* reads and writes must wait */
60655 atomic_inc(&op->usage);
60656 list_add_tail(&op->pend_link, &object->pending_ops);
60657 - fscache_stat(&fscache_n_op_pend);
60658 + fscache_stat_unchecked(&fscache_n_op_pend);
60659 ret = 0;
60660 } else {
60661 /* If we're in any other state, there must have been an I/O
60662 @@ -212,11 +212,11 @@ int fscache_submit_op(struct fscache_object *object,
60663 if (object->n_exclusive > 0) {
60664 atomic_inc(&op->usage);
60665 list_add_tail(&op->pend_link, &object->pending_ops);
60666 - fscache_stat(&fscache_n_op_pend);
60667 + fscache_stat_unchecked(&fscache_n_op_pend);
60668 } else if (!list_empty(&object->pending_ops)) {
60669 atomic_inc(&op->usage);
60670 list_add_tail(&op->pend_link, &object->pending_ops);
60671 - fscache_stat(&fscache_n_op_pend);
60672 + fscache_stat_unchecked(&fscache_n_op_pend);
60673 fscache_start_operations(object);
60674 } else {
60675 ASSERTCMP(object->n_exclusive, ==, 0);
60676 @@ -228,10 +228,10 @@ int fscache_submit_op(struct fscache_object *object,
60677 object->n_ops++;
60678 atomic_inc(&op->usage);
60679 list_add_tail(&op->pend_link, &object->pending_ops);
60680 - fscache_stat(&fscache_n_op_pend);
60681 + fscache_stat_unchecked(&fscache_n_op_pend);
60682 ret = 0;
60683 } else if (fscache_object_is_dying(object)) {
60684 - fscache_stat(&fscache_n_op_rejected);
60685 + fscache_stat_unchecked(&fscache_n_op_rejected);
60686 op->state = FSCACHE_OP_ST_CANCELLED;
60687 ret = -ENOBUFS;
60688 } else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
60689 @@ -310,7 +310,7 @@ int fscache_cancel_op(struct fscache_operation *op,
60690 ret = -EBUSY;
60691 if (op->state == FSCACHE_OP_ST_PENDING) {
60692 ASSERT(!list_empty(&op->pend_link));
60693 - fscache_stat(&fscache_n_op_cancelled);
60694 + fscache_stat_unchecked(&fscache_n_op_cancelled);
60695 list_del_init(&op->pend_link);
60696 if (do_cancel)
60697 do_cancel(op);
60698 @@ -342,7 +342,7 @@ void fscache_cancel_all_ops(struct fscache_object *object)
60699 while (!list_empty(&object->pending_ops)) {
60700 op = list_entry(object->pending_ops.next,
60701 struct fscache_operation, pend_link);
60702 - fscache_stat(&fscache_n_op_cancelled);
60703 + fscache_stat_unchecked(&fscache_n_op_cancelled);
60704 list_del_init(&op->pend_link);
60705
60706 ASSERTCMP(op->state, ==, FSCACHE_OP_ST_PENDING);
60707 @@ -414,7 +414,7 @@ void fscache_put_operation(struct fscache_operation *op)
60708 op->state, ==, FSCACHE_OP_ST_CANCELLED);
60709 op->state = FSCACHE_OP_ST_DEAD;
60710
60711 - fscache_stat(&fscache_n_op_release);
60712 + fscache_stat_unchecked(&fscache_n_op_release);
60713
60714 if (op->release) {
60715 op->release(op);
60716 @@ -433,7 +433,7 @@ void fscache_put_operation(struct fscache_operation *op)
60717 * lock, and defer it otherwise */
60718 if (!spin_trylock(&object->lock)) {
60719 _debug("defer put");
60720 - fscache_stat(&fscache_n_op_deferred_release);
60721 + fscache_stat_unchecked(&fscache_n_op_deferred_release);
60722
60723 cache = object->cache;
60724 spin_lock(&cache->op_gc_list_lock);
60725 @@ -486,7 +486,7 @@ void fscache_operation_gc(struct work_struct *work)
60726
60727 _debug("GC DEFERRED REL OBJ%x OP%x",
60728 object->debug_id, op->debug_id);
60729 - fscache_stat(&fscache_n_op_gc);
60730 + fscache_stat_unchecked(&fscache_n_op_gc);
60731
60732 ASSERTCMP(atomic_read(&op->usage), ==, 0);
60733 ASSERTCMP(op->state, ==, FSCACHE_OP_ST_DEAD);
60734 diff --git a/fs/fscache/page.c b/fs/fscache/page.c
60735 index 7f5c658..6c1e164 100644
60736 --- a/fs/fscache/page.c
60737 +++ b/fs/fscache/page.c
60738 @@ -61,7 +61,7 @@ try_again:
60739 val = radix_tree_lookup(&cookie->stores, page->index);
60740 if (!val) {
60741 rcu_read_unlock();
60742 - fscache_stat(&fscache_n_store_vmscan_not_storing);
60743 + fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
60744 __fscache_uncache_page(cookie, page);
60745 return true;
60746 }
60747 @@ -91,11 +91,11 @@ try_again:
60748 spin_unlock(&cookie->stores_lock);
60749
60750 if (xpage) {
60751 - fscache_stat(&fscache_n_store_vmscan_cancelled);
60752 - fscache_stat(&fscache_n_store_radix_deletes);
60753 + fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
60754 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
60755 ASSERTCMP(xpage, ==, page);
60756 } else {
60757 - fscache_stat(&fscache_n_store_vmscan_gone);
60758 + fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
60759 }
60760
60761 wake_up_bit(&cookie->flags, 0);
60762 @@ -110,11 +110,11 @@ page_busy:
60763 * sleeping on memory allocation, so we may need to impose a timeout
60764 * too. */
60765 if (!(gfp & __GFP_WAIT) || !(gfp & __GFP_FS)) {
60766 - fscache_stat(&fscache_n_store_vmscan_busy);
60767 + fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
60768 return false;
60769 }
60770
60771 - fscache_stat(&fscache_n_store_vmscan_wait);
60772 + fscache_stat_unchecked(&fscache_n_store_vmscan_wait);
60773 __fscache_wait_on_page_write(cookie, page);
60774 gfp &= ~__GFP_WAIT;
60775 goto try_again;
60776 @@ -140,7 +140,7 @@ static void fscache_end_page_write(struct fscache_object *object,
60777 FSCACHE_COOKIE_STORING_TAG);
60778 if (!radix_tree_tag_get(&cookie->stores, page->index,
60779 FSCACHE_COOKIE_PENDING_TAG)) {
60780 - fscache_stat(&fscache_n_store_radix_deletes);
60781 + fscache_stat_unchecked(&fscache_n_store_radix_deletes);
60782 xpage = radix_tree_delete(&cookie->stores, page->index);
60783 }
60784 spin_unlock(&cookie->stores_lock);
60785 @@ -161,7 +161,7 @@ static void fscache_attr_changed_op(struct fscache_operation *op)
60786
60787 _enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
60788
60789 - fscache_stat(&fscache_n_attr_changed_calls);
60790 + fscache_stat_unchecked(&fscache_n_attr_changed_calls);
60791
60792 if (fscache_object_is_active(object)) {
60793 fscache_stat(&fscache_n_cop_attr_changed);
60794 @@ -188,11 +188,11 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
60795
60796 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
60797
60798 - fscache_stat(&fscache_n_attr_changed);
60799 + fscache_stat_unchecked(&fscache_n_attr_changed);
60800
60801 op = kzalloc(sizeof(*op), GFP_KERNEL);
60802 if (!op) {
60803 - fscache_stat(&fscache_n_attr_changed_nomem);
60804 + fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
60805 _leave(" = -ENOMEM");
60806 return -ENOMEM;
60807 }
60808 @@ -214,7 +214,7 @@ int __fscache_attr_changed(struct fscache_cookie *cookie)
60809 if (fscache_submit_exclusive_op(object, op) < 0)
60810 goto nobufs;
60811 spin_unlock(&cookie->lock);
60812 - fscache_stat(&fscache_n_attr_changed_ok);
60813 + fscache_stat_unchecked(&fscache_n_attr_changed_ok);
60814 fscache_put_operation(op);
60815 _leave(" = 0");
60816 return 0;
60817 @@ -225,7 +225,7 @@ nobufs:
60818 kfree(op);
60819 if (wake_cookie)
60820 __fscache_wake_unused_cookie(cookie);
60821 - fscache_stat(&fscache_n_attr_changed_nobufs);
60822 + fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
60823 _leave(" = %d", -ENOBUFS);
60824 return -ENOBUFS;
60825 }
60826 @@ -264,7 +264,7 @@ static struct fscache_retrieval *fscache_alloc_retrieval(
60827 /* allocate a retrieval operation and attempt to submit it */
60828 op = kzalloc(sizeof(*op), GFP_NOIO);
60829 if (!op) {
60830 - fscache_stat(&fscache_n_retrievals_nomem);
60831 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
60832 return NULL;
60833 }
60834
60835 @@ -294,13 +294,13 @@ int fscache_wait_for_deferred_lookup(struct fscache_cookie *cookie)
60836 return 0;
60837 }
60838
60839 - fscache_stat(&fscache_n_retrievals_wait);
60840 + fscache_stat_unchecked(&fscache_n_retrievals_wait);
60841
60842 jif = jiffies;
60843 if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
60844 fscache_wait_bit_interruptible,
60845 TASK_INTERRUPTIBLE) != 0) {
60846 - fscache_stat(&fscache_n_retrievals_intr);
60847 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
60848 _leave(" = -ERESTARTSYS");
60849 return -ERESTARTSYS;
60850 }
60851 @@ -329,8 +329,8 @@ static void fscache_do_cancel_retrieval(struct fscache_operation *_op)
60852 */
60853 int fscache_wait_for_operation_activation(struct fscache_object *object,
60854 struct fscache_operation *op,
60855 - atomic_t *stat_op_waits,
60856 - atomic_t *stat_object_dead,
60857 + atomic_unchecked_t *stat_op_waits,
60858 + atomic_unchecked_t *stat_object_dead,
60859 void (*do_cancel)(struct fscache_operation *))
60860 {
60861 int ret;
60862 @@ -340,7 +340,7 @@ int fscache_wait_for_operation_activation(struct fscache_object *object,
60863
60864 _debug(">>> WT");
60865 if (stat_op_waits)
60866 - fscache_stat(stat_op_waits);
60867 + fscache_stat_unchecked(stat_op_waits);
60868 if (wait_on_bit(&op->flags, FSCACHE_OP_WAITING,
60869 fscache_wait_bit_interruptible,
60870 TASK_INTERRUPTIBLE) != 0) {
60871 @@ -358,7 +358,7 @@ int fscache_wait_for_operation_activation(struct fscache_object *object,
60872 check_if_dead:
60873 if (op->state == FSCACHE_OP_ST_CANCELLED) {
60874 if (stat_object_dead)
60875 - fscache_stat(stat_object_dead);
60876 + fscache_stat_unchecked(stat_object_dead);
60877 _leave(" = -ENOBUFS [cancelled]");
60878 return -ENOBUFS;
60879 }
60880 @@ -366,7 +366,7 @@ check_if_dead:
60881 pr_err("%s() = -ENOBUFS [obj dead %d]\n", __func__, op->state);
60882 fscache_cancel_op(op, do_cancel);
60883 if (stat_object_dead)
60884 - fscache_stat(stat_object_dead);
60885 + fscache_stat_unchecked(stat_object_dead);
60886 return -ENOBUFS;
60887 }
60888 return 0;
60889 @@ -394,7 +394,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
60890
60891 _enter("%p,%p,,,", cookie, page);
60892
60893 - fscache_stat(&fscache_n_retrievals);
60894 + fscache_stat_unchecked(&fscache_n_retrievals);
60895
60896 if (hlist_empty(&cookie->backing_objects))
60897 goto nobufs;
60898 @@ -436,7 +436,7 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
60899 goto nobufs_unlock_dec;
60900 spin_unlock(&cookie->lock);
60901
60902 - fscache_stat(&fscache_n_retrieval_ops);
60903 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
60904
60905 /* pin the netfs read context in case we need to do the actual netfs
60906 * read because we've encountered a cache read failure */
60907 @@ -467,15 +467,15 @@ int __fscache_read_or_alloc_page(struct fscache_cookie *cookie,
60908
60909 error:
60910 if (ret == -ENOMEM)
60911 - fscache_stat(&fscache_n_retrievals_nomem);
60912 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
60913 else if (ret == -ERESTARTSYS)
60914 - fscache_stat(&fscache_n_retrievals_intr);
60915 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
60916 else if (ret == -ENODATA)
60917 - fscache_stat(&fscache_n_retrievals_nodata);
60918 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
60919 else if (ret < 0)
60920 - fscache_stat(&fscache_n_retrievals_nobufs);
60921 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
60922 else
60923 - fscache_stat(&fscache_n_retrievals_ok);
60924 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
60925
60926 fscache_put_retrieval(op);
60927 _leave(" = %d", ret);
60928 @@ -490,7 +490,7 @@ nobufs_unlock:
60929 __fscache_wake_unused_cookie(cookie);
60930 kfree(op);
60931 nobufs:
60932 - fscache_stat(&fscache_n_retrievals_nobufs);
60933 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
60934 _leave(" = -ENOBUFS");
60935 return -ENOBUFS;
60936 }
60937 @@ -529,7 +529,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
60938
60939 _enter("%p,,%d,,,", cookie, *nr_pages);
60940
60941 - fscache_stat(&fscache_n_retrievals);
60942 + fscache_stat_unchecked(&fscache_n_retrievals);
60943
60944 if (hlist_empty(&cookie->backing_objects))
60945 goto nobufs;
60946 @@ -567,7 +567,7 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
60947 goto nobufs_unlock_dec;
60948 spin_unlock(&cookie->lock);
60949
60950 - fscache_stat(&fscache_n_retrieval_ops);
60951 + fscache_stat_unchecked(&fscache_n_retrieval_ops);
60952
60953 /* pin the netfs read context in case we need to do the actual netfs
60954 * read because we've encountered a cache read failure */
60955 @@ -598,15 +598,15 @@ int __fscache_read_or_alloc_pages(struct fscache_cookie *cookie,
60956
60957 error:
60958 if (ret == -ENOMEM)
60959 - fscache_stat(&fscache_n_retrievals_nomem);
60960 + fscache_stat_unchecked(&fscache_n_retrievals_nomem);
60961 else if (ret == -ERESTARTSYS)
60962 - fscache_stat(&fscache_n_retrievals_intr);
60963 + fscache_stat_unchecked(&fscache_n_retrievals_intr);
60964 else if (ret == -ENODATA)
60965 - fscache_stat(&fscache_n_retrievals_nodata);
60966 + fscache_stat_unchecked(&fscache_n_retrievals_nodata);
60967 else if (ret < 0)
60968 - fscache_stat(&fscache_n_retrievals_nobufs);
60969 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
60970 else
60971 - fscache_stat(&fscache_n_retrievals_ok);
60972 + fscache_stat_unchecked(&fscache_n_retrievals_ok);
60973
60974 fscache_put_retrieval(op);
60975 _leave(" = %d", ret);
60976 @@ -621,7 +621,7 @@ nobufs_unlock:
60977 if (wake_cookie)
60978 __fscache_wake_unused_cookie(cookie);
60979 nobufs:
60980 - fscache_stat(&fscache_n_retrievals_nobufs);
60981 + fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
60982 _leave(" = -ENOBUFS");
60983 return -ENOBUFS;
60984 }
60985 @@ -646,7 +646,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
60986
60987 _enter("%p,%p,,,", cookie, page);
60988
60989 - fscache_stat(&fscache_n_allocs);
60990 + fscache_stat_unchecked(&fscache_n_allocs);
60991
60992 if (hlist_empty(&cookie->backing_objects))
60993 goto nobufs;
60994 @@ -680,7 +680,7 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
60995 goto nobufs_unlock_dec;
60996 spin_unlock(&cookie->lock);
60997
60998 - fscache_stat(&fscache_n_alloc_ops);
60999 + fscache_stat_unchecked(&fscache_n_alloc_ops);
61000
61001 ret = fscache_wait_for_operation_activation(
61002 object, &op->op,
61003 @@ -697,11 +697,11 @@ int __fscache_alloc_page(struct fscache_cookie *cookie,
61004
61005 error:
61006 if (ret == -ERESTARTSYS)
61007 - fscache_stat(&fscache_n_allocs_intr);
61008 + fscache_stat_unchecked(&fscache_n_allocs_intr);
61009 else if (ret < 0)
61010 - fscache_stat(&fscache_n_allocs_nobufs);
61011 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
61012 else
61013 - fscache_stat(&fscache_n_allocs_ok);
61014 + fscache_stat_unchecked(&fscache_n_allocs_ok);
61015
61016 fscache_put_retrieval(op);
61017 _leave(" = %d", ret);
61018 @@ -715,7 +715,7 @@ nobufs_unlock:
61019 if (wake_cookie)
61020 __fscache_wake_unused_cookie(cookie);
61021 nobufs:
61022 - fscache_stat(&fscache_n_allocs_nobufs);
61023 + fscache_stat_unchecked(&fscache_n_allocs_nobufs);
61024 _leave(" = -ENOBUFS");
61025 return -ENOBUFS;
61026 }
61027 @@ -791,7 +791,7 @@ static void fscache_write_op(struct fscache_operation *_op)
61028
61029 spin_lock(&cookie->stores_lock);
61030
61031 - fscache_stat(&fscache_n_store_calls);
61032 + fscache_stat_unchecked(&fscache_n_store_calls);
61033
61034 /* find a page to store */
61035 page = NULL;
61036 @@ -802,7 +802,7 @@ static void fscache_write_op(struct fscache_operation *_op)
61037 page = results[0];
61038 _debug("gang %d [%lx]", n, page->index);
61039 if (page->index > op->store_limit) {
61040 - fscache_stat(&fscache_n_store_pages_over_limit);
61041 + fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
61042 goto superseded;
61043 }
61044
61045 @@ -814,7 +814,7 @@ static void fscache_write_op(struct fscache_operation *_op)
61046 spin_unlock(&cookie->stores_lock);
61047 spin_unlock(&object->lock);
61048
61049 - fscache_stat(&fscache_n_store_pages);
61050 + fscache_stat_unchecked(&fscache_n_store_pages);
61051 fscache_stat(&fscache_n_cop_write_page);
61052 ret = object->cache->ops->write_page(op, page);
61053 fscache_stat_d(&fscache_n_cop_write_page);
61054 @@ -918,7 +918,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
61055 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
61056 ASSERT(PageFsCache(page));
61057
61058 - fscache_stat(&fscache_n_stores);
61059 + fscache_stat_unchecked(&fscache_n_stores);
61060
61061 if (test_bit(FSCACHE_COOKIE_INVALIDATING, &cookie->flags)) {
61062 _leave(" = -ENOBUFS [invalidating]");
61063 @@ -977,7 +977,7 @@ int __fscache_write_page(struct fscache_cookie *cookie,
61064 spin_unlock(&cookie->stores_lock);
61065 spin_unlock(&object->lock);
61066
61067 - op->op.debug_id = atomic_inc_return(&fscache_op_debug_id);
61068 + op->op.debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
61069 op->store_limit = object->store_limit;
61070
61071 __fscache_use_cookie(cookie);
61072 @@ -986,8 +986,8 @@ int __fscache_write_page(struct fscache_cookie *cookie,
61073
61074 spin_unlock(&cookie->lock);
61075 radix_tree_preload_end();
61076 - fscache_stat(&fscache_n_store_ops);
61077 - fscache_stat(&fscache_n_stores_ok);
61078 + fscache_stat_unchecked(&fscache_n_store_ops);
61079 + fscache_stat_unchecked(&fscache_n_stores_ok);
61080
61081 /* the work queue now carries its own ref on the object */
61082 fscache_put_operation(&op->op);
61083 @@ -995,14 +995,14 @@ int __fscache_write_page(struct fscache_cookie *cookie,
61084 return 0;
61085
61086 already_queued:
61087 - fscache_stat(&fscache_n_stores_again);
61088 + fscache_stat_unchecked(&fscache_n_stores_again);
61089 already_pending:
61090 spin_unlock(&cookie->stores_lock);
61091 spin_unlock(&object->lock);
61092 spin_unlock(&cookie->lock);
61093 radix_tree_preload_end();
61094 kfree(op);
61095 - fscache_stat(&fscache_n_stores_ok);
61096 + fscache_stat_unchecked(&fscache_n_stores_ok);
61097 _leave(" = 0");
61098 return 0;
61099
61100 @@ -1024,14 +1024,14 @@ nobufs:
61101 kfree(op);
61102 if (wake_cookie)
61103 __fscache_wake_unused_cookie(cookie);
61104 - fscache_stat(&fscache_n_stores_nobufs);
61105 + fscache_stat_unchecked(&fscache_n_stores_nobufs);
61106 _leave(" = -ENOBUFS");
61107 return -ENOBUFS;
61108
61109 nomem_free:
61110 kfree(op);
61111 nomem:
61112 - fscache_stat(&fscache_n_stores_oom);
61113 + fscache_stat_unchecked(&fscache_n_stores_oom);
61114 _leave(" = -ENOMEM");
61115 return -ENOMEM;
61116 }
61117 @@ -1049,7 +1049,7 @@ void __fscache_uncache_page(struct fscache_cookie *cookie, struct page *page)
61118 ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
61119 ASSERTCMP(page, !=, NULL);
61120
61121 - fscache_stat(&fscache_n_uncaches);
61122 + fscache_stat_unchecked(&fscache_n_uncaches);
61123
61124 /* cache withdrawal may beat us to it */
61125 if (!PageFsCache(page))
61126 @@ -1100,7 +1100,7 @@ void fscache_mark_page_cached(struct fscache_retrieval *op, struct page *page)
61127 struct fscache_cookie *cookie = op->op.object->cookie;
61128
61129 #ifdef CONFIG_FSCACHE_STATS
61130 - atomic_inc(&fscache_n_marks);
61131 + atomic_inc_unchecked(&fscache_n_marks);
61132 #endif
61133
61134 _debug("- mark %p{%lx}", page, page->index);
61135 diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
61136 index 40d13c7..ddf52b9 100644
61137 --- a/fs/fscache/stats.c
61138 +++ b/fs/fscache/stats.c
61139 @@ -18,99 +18,99 @@
61140 /*
61141 * operation counters
61142 */
61143 -atomic_t fscache_n_op_pend;
61144 -atomic_t fscache_n_op_run;
61145 -atomic_t fscache_n_op_enqueue;
61146 -atomic_t fscache_n_op_requeue;
61147 -atomic_t fscache_n_op_deferred_release;
61148 -atomic_t fscache_n_op_release;
61149 -atomic_t fscache_n_op_gc;
61150 -atomic_t fscache_n_op_cancelled;
61151 -atomic_t fscache_n_op_rejected;
61152 +atomic_unchecked_t fscache_n_op_pend;
61153 +atomic_unchecked_t fscache_n_op_run;
61154 +atomic_unchecked_t fscache_n_op_enqueue;
61155 +atomic_unchecked_t fscache_n_op_requeue;
61156 +atomic_unchecked_t fscache_n_op_deferred_release;
61157 +atomic_unchecked_t fscache_n_op_release;
61158 +atomic_unchecked_t fscache_n_op_gc;
61159 +atomic_unchecked_t fscache_n_op_cancelled;
61160 +atomic_unchecked_t fscache_n_op_rejected;
61161
61162 -atomic_t fscache_n_attr_changed;
61163 -atomic_t fscache_n_attr_changed_ok;
61164 -atomic_t fscache_n_attr_changed_nobufs;
61165 -atomic_t fscache_n_attr_changed_nomem;
61166 -atomic_t fscache_n_attr_changed_calls;
61167 +atomic_unchecked_t fscache_n_attr_changed;
61168 +atomic_unchecked_t fscache_n_attr_changed_ok;
61169 +atomic_unchecked_t fscache_n_attr_changed_nobufs;
61170 +atomic_unchecked_t fscache_n_attr_changed_nomem;
61171 +atomic_unchecked_t fscache_n_attr_changed_calls;
61172
61173 -atomic_t fscache_n_allocs;
61174 -atomic_t fscache_n_allocs_ok;
61175 -atomic_t fscache_n_allocs_wait;
61176 -atomic_t fscache_n_allocs_nobufs;
61177 -atomic_t fscache_n_allocs_intr;
61178 -atomic_t fscache_n_allocs_object_dead;
61179 -atomic_t fscache_n_alloc_ops;
61180 -atomic_t fscache_n_alloc_op_waits;
61181 +atomic_unchecked_t fscache_n_allocs;
61182 +atomic_unchecked_t fscache_n_allocs_ok;
61183 +atomic_unchecked_t fscache_n_allocs_wait;
61184 +atomic_unchecked_t fscache_n_allocs_nobufs;
61185 +atomic_unchecked_t fscache_n_allocs_intr;
61186 +atomic_unchecked_t fscache_n_allocs_object_dead;
61187 +atomic_unchecked_t fscache_n_alloc_ops;
61188 +atomic_unchecked_t fscache_n_alloc_op_waits;
61189
61190 -atomic_t fscache_n_retrievals;
61191 -atomic_t fscache_n_retrievals_ok;
61192 -atomic_t fscache_n_retrievals_wait;
61193 -atomic_t fscache_n_retrievals_nodata;
61194 -atomic_t fscache_n_retrievals_nobufs;
61195 -atomic_t fscache_n_retrievals_intr;
61196 -atomic_t fscache_n_retrievals_nomem;
61197 -atomic_t fscache_n_retrievals_object_dead;
61198 -atomic_t fscache_n_retrieval_ops;
61199 -atomic_t fscache_n_retrieval_op_waits;
61200 +atomic_unchecked_t fscache_n_retrievals;
61201 +atomic_unchecked_t fscache_n_retrievals_ok;
61202 +atomic_unchecked_t fscache_n_retrievals_wait;
61203 +atomic_unchecked_t fscache_n_retrievals_nodata;
61204 +atomic_unchecked_t fscache_n_retrievals_nobufs;
61205 +atomic_unchecked_t fscache_n_retrievals_intr;
61206 +atomic_unchecked_t fscache_n_retrievals_nomem;
61207 +atomic_unchecked_t fscache_n_retrievals_object_dead;
61208 +atomic_unchecked_t fscache_n_retrieval_ops;
61209 +atomic_unchecked_t fscache_n_retrieval_op_waits;
61210
61211 -atomic_t fscache_n_stores;
61212 -atomic_t fscache_n_stores_ok;
61213 -atomic_t fscache_n_stores_again;
61214 -atomic_t fscache_n_stores_nobufs;
61215 -atomic_t fscache_n_stores_oom;
61216 -atomic_t fscache_n_store_ops;
61217 -atomic_t fscache_n_store_calls;
61218 -atomic_t fscache_n_store_pages;
61219 -atomic_t fscache_n_store_radix_deletes;
61220 -atomic_t fscache_n_store_pages_over_limit;
61221 +atomic_unchecked_t fscache_n_stores;
61222 +atomic_unchecked_t fscache_n_stores_ok;
61223 +atomic_unchecked_t fscache_n_stores_again;
61224 +atomic_unchecked_t fscache_n_stores_nobufs;
61225 +atomic_unchecked_t fscache_n_stores_oom;
61226 +atomic_unchecked_t fscache_n_store_ops;
61227 +atomic_unchecked_t fscache_n_store_calls;
61228 +atomic_unchecked_t fscache_n_store_pages;
61229 +atomic_unchecked_t fscache_n_store_radix_deletes;
61230 +atomic_unchecked_t fscache_n_store_pages_over_limit;
61231
61232 -atomic_t fscache_n_store_vmscan_not_storing;
61233 -atomic_t fscache_n_store_vmscan_gone;
61234 -atomic_t fscache_n_store_vmscan_busy;
61235 -atomic_t fscache_n_store_vmscan_cancelled;
61236 -atomic_t fscache_n_store_vmscan_wait;
61237 +atomic_unchecked_t fscache_n_store_vmscan_not_storing;
61238 +atomic_unchecked_t fscache_n_store_vmscan_gone;
61239 +atomic_unchecked_t fscache_n_store_vmscan_busy;
61240 +atomic_unchecked_t fscache_n_store_vmscan_cancelled;
61241 +atomic_unchecked_t fscache_n_store_vmscan_wait;
61242
61243 -atomic_t fscache_n_marks;
61244 -atomic_t fscache_n_uncaches;
61245 +atomic_unchecked_t fscache_n_marks;
61246 +atomic_unchecked_t fscache_n_uncaches;
61247
61248 -atomic_t fscache_n_acquires;
61249 -atomic_t fscache_n_acquires_null;
61250 -atomic_t fscache_n_acquires_no_cache;
61251 -atomic_t fscache_n_acquires_ok;
61252 -atomic_t fscache_n_acquires_nobufs;
61253 -atomic_t fscache_n_acquires_oom;
61254 +atomic_unchecked_t fscache_n_acquires;
61255 +atomic_unchecked_t fscache_n_acquires_null;
61256 +atomic_unchecked_t fscache_n_acquires_no_cache;
61257 +atomic_unchecked_t fscache_n_acquires_ok;
61258 +atomic_unchecked_t fscache_n_acquires_nobufs;
61259 +atomic_unchecked_t fscache_n_acquires_oom;
61260
61261 -atomic_t fscache_n_invalidates;
61262 -atomic_t fscache_n_invalidates_run;
61263 +atomic_unchecked_t fscache_n_invalidates;
61264 +atomic_unchecked_t fscache_n_invalidates_run;
61265
61266 -atomic_t fscache_n_updates;
61267 -atomic_t fscache_n_updates_null;
61268 -atomic_t fscache_n_updates_run;
61269 +atomic_unchecked_t fscache_n_updates;
61270 +atomic_unchecked_t fscache_n_updates_null;
61271 +atomic_unchecked_t fscache_n_updates_run;
61272
61273 -atomic_t fscache_n_relinquishes;
61274 -atomic_t fscache_n_relinquishes_null;
61275 -atomic_t fscache_n_relinquishes_waitcrt;
61276 -atomic_t fscache_n_relinquishes_retire;
61277 +atomic_unchecked_t fscache_n_relinquishes;
61278 +atomic_unchecked_t fscache_n_relinquishes_null;
61279 +atomic_unchecked_t fscache_n_relinquishes_waitcrt;
61280 +atomic_unchecked_t fscache_n_relinquishes_retire;
61281
61282 -atomic_t fscache_n_cookie_index;
61283 -atomic_t fscache_n_cookie_data;
61284 -atomic_t fscache_n_cookie_special;
61285 +atomic_unchecked_t fscache_n_cookie_index;
61286 +atomic_unchecked_t fscache_n_cookie_data;
61287 +atomic_unchecked_t fscache_n_cookie_special;
61288
61289 -atomic_t fscache_n_object_alloc;
61290 -atomic_t fscache_n_object_no_alloc;
61291 -atomic_t fscache_n_object_lookups;
61292 -atomic_t fscache_n_object_lookups_negative;
61293 -atomic_t fscache_n_object_lookups_positive;
61294 -atomic_t fscache_n_object_lookups_timed_out;
61295 -atomic_t fscache_n_object_created;
61296 -atomic_t fscache_n_object_avail;
61297 -atomic_t fscache_n_object_dead;
61298 +atomic_unchecked_t fscache_n_object_alloc;
61299 +atomic_unchecked_t fscache_n_object_no_alloc;
61300 +atomic_unchecked_t fscache_n_object_lookups;
61301 +atomic_unchecked_t fscache_n_object_lookups_negative;
61302 +atomic_unchecked_t fscache_n_object_lookups_positive;
61303 +atomic_unchecked_t fscache_n_object_lookups_timed_out;
61304 +atomic_unchecked_t fscache_n_object_created;
61305 +atomic_unchecked_t fscache_n_object_avail;
61306 +atomic_unchecked_t fscache_n_object_dead;
61307
61308 -atomic_t fscache_n_checkaux_none;
61309 -atomic_t fscache_n_checkaux_okay;
61310 -atomic_t fscache_n_checkaux_update;
61311 -atomic_t fscache_n_checkaux_obsolete;
61312 +atomic_unchecked_t fscache_n_checkaux_none;
61313 +atomic_unchecked_t fscache_n_checkaux_okay;
61314 +atomic_unchecked_t fscache_n_checkaux_update;
61315 +atomic_unchecked_t fscache_n_checkaux_obsolete;
61316
61317 atomic_t fscache_n_cop_alloc_object;
61318 atomic_t fscache_n_cop_lookup_object;
61319 @@ -138,118 +138,118 @@ static int fscache_stats_show(struct seq_file *m, void *v)
61320 seq_puts(m, "FS-Cache statistics\n");
61321
61322 seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
61323 - atomic_read(&fscache_n_cookie_index),
61324 - atomic_read(&fscache_n_cookie_data),
61325 - atomic_read(&fscache_n_cookie_special));
61326 + atomic_read_unchecked(&fscache_n_cookie_index),
61327 + atomic_read_unchecked(&fscache_n_cookie_data),
61328 + atomic_read_unchecked(&fscache_n_cookie_special));
61329
61330 seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
61331 - atomic_read(&fscache_n_object_alloc),
61332 - atomic_read(&fscache_n_object_no_alloc),
61333 - atomic_read(&fscache_n_object_avail),
61334 - atomic_read(&fscache_n_object_dead));
61335 + atomic_read_unchecked(&fscache_n_object_alloc),
61336 + atomic_read_unchecked(&fscache_n_object_no_alloc),
61337 + atomic_read_unchecked(&fscache_n_object_avail),
61338 + atomic_read_unchecked(&fscache_n_object_dead));
61339 seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
61340 - atomic_read(&fscache_n_checkaux_none),
61341 - atomic_read(&fscache_n_checkaux_okay),
61342 - atomic_read(&fscache_n_checkaux_update),
61343 - atomic_read(&fscache_n_checkaux_obsolete));
61344 + atomic_read_unchecked(&fscache_n_checkaux_none),
61345 + atomic_read_unchecked(&fscache_n_checkaux_okay),
61346 + atomic_read_unchecked(&fscache_n_checkaux_update),
61347 + atomic_read_unchecked(&fscache_n_checkaux_obsolete));
61348
61349 seq_printf(m, "Pages : mrk=%u unc=%u\n",
61350 - atomic_read(&fscache_n_marks),
61351 - atomic_read(&fscache_n_uncaches));
61352 + atomic_read_unchecked(&fscache_n_marks),
61353 + atomic_read_unchecked(&fscache_n_uncaches));
61354
61355 seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
61356 " oom=%u\n",
61357 - atomic_read(&fscache_n_acquires),
61358 - atomic_read(&fscache_n_acquires_null),
61359 - atomic_read(&fscache_n_acquires_no_cache),
61360 - atomic_read(&fscache_n_acquires_ok),
61361 - atomic_read(&fscache_n_acquires_nobufs),
61362 - atomic_read(&fscache_n_acquires_oom));
61363 + atomic_read_unchecked(&fscache_n_acquires),
61364 + atomic_read_unchecked(&fscache_n_acquires_null),
61365 + atomic_read_unchecked(&fscache_n_acquires_no_cache),
61366 + atomic_read_unchecked(&fscache_n_acquires_ok),
61367 + atomic_read_unchecked(&fscache_n_acquires_nobufs),
61368 + atomic_read_unchecked(&fscache_n_acquires_oom));
61369
61370 seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
61371 - atomic_read(&fscache_n_object_lookups),
61372 - atomic_read(&fscache_n_object_lookups_negative),
61373 - atomic_read(&fscache_n_object_lookups_positive),
61374 - atomic_read(&fscache_n_object_created),
61375 - atomic_read(&fscache_n_object_lookups_timed_out));
61376 + atomic_read_unchecked(&fscache_n_object_lookups),
61377 + atomic_read_unchecked(&fscache_n_object_lookups_negative),
61378 + atomic_read_unchecked(&fscache_n_object_lookups_positive),
61379 + atomic_read_unchecked(&fscache_n_object_created),
61380 + atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
61381
61382 seq_printf(m, "Invals : n=%u run=%u\n",
61383 - atomic_read(&fscache_n_invalidates),
61384 - atomic_read(&fscache_n_invalidates_run));
61385 + atomic_read_unchecked(&fscache_n_invalidates),
61386 + atomic_read_unchecked(&fscache_n_invalidates_run));
61387
61388 seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
61389 - atomic_read(&fscache_n_updates),
61390 - atomic_read(&fscache_n_updates_null),
61391 - atomic_read(&fscache_n_updates_run));
61392 + atomic_read_unchecked(&fscache_n_updates),
61393 + atomic_read_unchecked(&fscache_n_updates_null),
61394 + atomic_read_unchecked(&fscache_n_updates_run));
61395
61396 seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
61397 - atomic_read(&fscache_n_relinquishes),
61398 - atomic_read(&fscache_n_relinquishes_null),
61399 - atomic_read(&fscache_n_relinquishes_waitcrt),
61400 - atomic_read(&fscache_n_relinquishes_retire));
61401 + atomic_read_unchecked(&fscache_n_relinquishes),
61402 + atomic_read_unchecked(&fscache_n_relinquishes_null),
61403 + atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
61404 + atomic_read_unchecked(&fscache_n_relinquishes_retire));
61405
61406 seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
61407 - atomic_read(&fscache_n_attr_changed),
61408 - atomic_read(&fscache_n_attr_changed_ok),
61409 - atomic_read(&fscache_n_attr_changed_nobufs),
61410 - atomic_read(&fscache_n_attr_changed_nomem),
61411 - atomic_read(&fscache_n_attr_changed_calls));
61412 + atomic_read_unchecked(&fscache_n_attr_changed),
61413 + atomic_read_unchecked(&fscache_n_attr_changed_ok),
61414 + atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
61415 + atomic_read_unchecked(&fscache_n_attr_changed_nomem),
61416 + atomic_read_unchecked(&fscache_n_attr_changed_calls));
61417
61418 seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
61419 - atomic_read(&fscache_n_allocs),
61420 - atomic_read(&fscache_n_allocs_ok),
61421 - atomic_read(&fscache_n_allocs_wait),
61422 - atomic_read(&fscache_n_allocs_nobufs),
61423 - atomic_read(&fscache_n_allocs_intr));
61424 + atomic_read_unchecked(&fscache_n_allocs),
61425 + atomic_read_unchecked(&fscache_n_allocs_ok),
61426 + atomic_read_unchecked(&fscache_n_allocs_wait),
61427 + atomic_read_unchecked(&fscache_n_allocs_nobufs),
61428 + atomic_read_unchecked(&fscache_n_allocs_intr));
61429 seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
61430 - atomic_read(&fscache_n_alloc_ops),
61431 - atomic_read(&fscache_n_alloc_op_waits),
61432 - atomic_read(&fscache_n_allocs_object_dead));
61433 + atomic_read_unchecked(&fscache_n_alloc_ops),
61434 + atomic_read_unchecked(&fscache_n_alloc_op_waits),
61435 + atomic_read_unchecked(&fscache_n_allocs_object_dead));
61436
61437 seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
61438 " int=%u oom=%u\n",
61439 - atomic_read(&fscache_n_retrievals),
61440 - atomic_read(&fscache_n_retrievals_ok),
61441 - atomic_read(&fscache_n_retrievals_wait),
61442 - atomic_read(&fscache_n_retrievals_nodata),
61443 - atomic_read(&fscache_n_retrievals_nobufs),
61444 - atomic_read(&fscache_n_retrievals_intr),
61445 - atomic_read(&fscache_n_retrievals_nomem));
61446 + atomic_read_unchecked(&fscache_n_retrievals),
61447 + atomic_read_unchecked(&fscache_n_retrievals_ok),
61448 + atomic_read_unchecked(&fscache_n_retrievals_wait),
61449 + atomic_read_unchecked(&fscache_n_retrievals_nodata),
61450 + atomic_read_unchecked(&fscache_n_retrievals_nobufs),
61451 + atomic_read_unchecked(&fscache_n_retrievals_intr),
61452 + atomic_read_unchecked(&fscache_n_retrievals_nomem));
61453 seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
61454 - atomic_read(&fscache_n_retrieval_ops),
61455 - atomic_read(&fscache_n_retrieval_op_waits),
61456 - atomic_read(&fscache_n_retrievals_object_dead));
61457 + atomic_read_unchecked(&fscache_n_retrieval_ops),
61458 + atomic_read_unchecked(&fscache_n_retrieval_op_waits),
61459 + atomic_read_unchecked(&fscache_n_retrievals_object_dead));
61460
61461 seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
61462 - atomic_read(&fscache_n_stores),
61463 - atomic_read(&fscache_n_stores_ok),
61464 - atomic_read(&fscache_n_stores_again),
61465 - atomic_read(&fscache_n_stores_nobufs),
61466 - atomic_read(&fscache_n_stores_oom));
61467 + atomic_read_unchecked(&fscache_n_stores),
61468 + atomic_read_unchecked(&fscache_n_stores_ok),
61469 + atomic_read_unchecked(&fscache_n_stores_again),
61470 + atomic_read_unchecked(&fscache_n_stores_nobufs),
61471 + atomic_read_unchecked(&fscache_n_stores_oom));
61472 seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
61473 - atomic_read(&fscache_n_store_ops),
61474 - atomic_read(&fscache_n_store_calls),
61475 - atomic_read(&fscache_n_store_pages),
61476 - atomic_read(&fscache_n_store_radix_deletes),
61477 - atomic_read(&fscache_n_store_pages_over_limit));
61478 + atomic_read_unchecked(&fscache_n_store_ops),
61479 + atomic_read_unchecked(&fscache_n_store_calls),
61480 + atomic_read_unchecked(&fscache_n_store_pages),
61481 + atomic_read_unchecked(&fscache_n_store_radix_deletes),
61482 + atomic_read_unchecked(&fscache_n_store_pages_over_limit));
61483
61484 seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u wt=%u\n",
61485 - atomic_read(&fscache_n_store_vmscan_not_storing),
61486 - atomic_read(&fscache_n_store_vmscan_gone),
61487 - atomic_read(&fscache_n_store_vmscan_busy),
61488 - atomic_read(&fscache_n_store_vmscan_cancelled),
61489 - atomic_read(&fscache_n_store_vmscan_wait));
61490 + atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
61491 + atomic_read_unchecked(&fscache_n_store_vmscan_gone),
61492 + atomic_read_unchecked(&fscache_n_store_vmscan_busy),
61493 + atomic_read_unchecked(&fscache_n_store_vmscan_cancelled),
61494 + atomic_read_unchecked(&fscache_n_store_vmscan_wait));
61495
61496 seq_printf(m, "Ops : pend=%u run=%u enq=%u can=%u rej=%u\n",
61497 - atomic_read(&fscache_n_op_pend),
61498 - atomic_read(&fscache_n_op_run),
61499 - atomic_read(&fscache_n_op_enqueue),
61500 - atomic_read(&fscache_n_op_cancelled),
61501 - atomic_read(&fscache_n_op_rejected));
61502 + atomic_read_unchecked(&fscache_n_op_pend),
61503 + atomic_read_unchecked(&fscache_n_op_run),
61504 + atomic_read_unchecked(&fscache_n_op_enqueue),
61505 + atomic_read_unchecked(&fscache_n_op_cancelled),
61506 + atomic_read_unchecked(&fscache_n_op_rejected));
61507 seq_printf(m, "Ops : dfr=%u rel=%u gc=%u\n",
61508 - atomic_read(&fscache_n_op_deferred_release),
61509 - atomic_read(&fscache_n_op_release),
61510 - atomic_read(&fscache_n_op_gc));
61511 + atomic_read_unchecked(&fscache_n_op_deferred_release),
61512 + atomic_read_unchecked(&fscache_n_op_release),
61513 + atomic_read_unchecked(&fscache_n_op_gc));
61514
61515 seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
61516 atomic_read(&fscache_n_cop_alloc_object),
61517 diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
61518 index b96a49b..9bfdc47 100644
61519 --- a/fs/fuse/cuse.c
61520 +++ b/fs/fuse/cuse.c
61521 @@ -606,10 +606,12 @@ static int __init cuse_init(void)
61522 INIT_LIST_HEAD(&cuse_conntbl[i]);
61523
61524 /* inherit and extend fuse_dev_operations */
61525 - cuse_channel_fops = fuse_dev_operations;
61526 - cuse_channel_fops.owner = THIS_MODULE;
61527 - cuse_channel_fops.open = cuse_channel_open;
61528 - cuse_channel_fops.release = cuse_channel_release;
61529 + pax_open_kernel();
61530 + memcpy((void *)&cuse_channel_fops, &fuse_dev_operations, sizeof(fuse_dev_operations));
61531 + *(void **)&cuse_channel_fops.owner = THIS_MODULE;
61532 + *(void **)&cuse_channel_fops.open = cuse_channel_open;
61533 + *(void **)&cuse_channel_fops.release = cuse_channel_release;
61534 + pax_close_kernel();
61535
61536 cuse_class = class_create(THIS_MODULE, "cuse");
61537 if (IS_ERR(cuse_class))
61538 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
61539 index 0a648bb..8d463f1 100644
61540 --- a/fs/fuse/dev.c
61541 +++ b/fs/fuse/dev.c
61542 @@ -1323,7 +1323,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
61543 ret = 0;
61544 pipe_lock(pipe);
61545
61546 - if (!pipe->readers) {
61547 + if (!atomic_read(&pipe->readers)) {
61548 send_sig(SIGPIPE, current, 0);
61549 if (!ret)
61550 ret = -EPIPE;
61551 @@ -1352,7 +1352,7 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
61552 page_nr++;
61553 ret += buf->len;
61554
61555 - if (pipe->files)
61556 + if (atomic_read(&pipe->files))
61557 do_wakeup = 1;
61558 }
61559
61560 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
61561 index 1d1292c..bba17ea 100644
61562 --- a/fs/fuse/dir.c
61563 +++ b/fs/fuse/dir.c
61564 @@ -1418,7 +1418,7 @@ static char *read_link(struct dentry *dentry)
61565 return link;
61566 }
61567
61568 -static void free_link(char *link)
61569 +static void free_link(const char *link)
61570 {
61571 if (!IS_ERR(link))
61572 free_page((unsigned long) link);
61573 diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
61574 index fe649d3..c679164 100644
61575 --- a/fs/hostfs/hostfs_kern.c
61576 +++ b/fs/hostfs/hostfs_kern.c
61577 @@ -898,7 +898,7 @@ static void *hostfs_follow_link(struct dentry *dentry, struct nameidata *nd)
61578
61579 static void hostfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
61580 {
61581 - char *s = nd_get_link(nd);
61582 + const char *s = nd_get_link(nd);
61583 if (!IS_ERR(s))
61584 __putname(s);
61585 }
61586 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
61587 index d19b30a..ef89c36 100644
61588 --- a/fs/hugetlbfs/inode.c
61589 +++ b/fs/hugetlbfs/inode.c
61590 @@ -152,6 +152,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
61591 struct mm_struct *mm = current->mm;
61592 struct vm_area_struct *vma;
61593 struct hstate *h = hstate_file(file);
61594 + unsigned long offset = gr_rand_threadstack_offset(mm, file, flags);
61595 struct vm_unmapped_area_info info;
61596
61597 if (len & ~huge_page_mask(h))
61598 @@ -165,17 +166,26 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
61599 return addr;
61600 }
61601
61602 +#ifdef CONFIG_PAX_RANDMMAP
61603 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
61604 +#endif
61605 +
61606 if (addr) {
61607 addr = ALIGN(addr, huge_page_size(h));
61608 vma = find_vma(mm, addr);
61609 - if (TASK_SIZE - len >= addr &&
61610 - (!vma || addr + len <= vma->vm_start))
61611 + if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len, offset))
61612 return addr;
61613 }
61614
61615 info.flags = 0;
61616 info.length = len;
61617 info.low_limit = TASK_UNMAPPED_BASE;
61618 +
61619 +#ifdef CONFIG_PAX_RANDMMAP
61620 + if (mm->pax_flags & MF_PAX_RANDMMAP)
61621 + info.low_limit += mm->delta_mmap;
61622 +#endif
61623 +
61624 info.high_limit = TASK_SIZE;
61625 info.align_mask = PAGE_MASK & ~huge_page_mask(h);
61626 info.align_offset = 0;
61627 @@ -908,7 +918,7 @@ static struct file_system_type hugetlbfs_fs_type = {
61628 };
61629 MODULE_ALIAS_FS("hugetlbfs");
61630
61631 -static struct vfsmount *hugetlbfs_vfsmount[HUGE_MAX_HSTATE];
61632 +struct vfsmount *hugetlbfs_vfsmount[HUGE_MAX_HSTATE];
61633
61634 static int can_do_hugetlb_shm(void)
61635 {
61636 diff --git a/fs/inode.c b/fs/inode.c
61637 index 4bcdad3..1883822 100644
61638 --- a/fs/inode.c
61639 +++ b/fs/inode.c
61640 @@ -841,8 +841,8 @@ unsigned int get_next_ino(void)
61641
61642 #ifdef CONFIG_SMP
61643 if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
61644 - static atomic_t shared_last_ino;
61645 - int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
61646 + static atomic_unchecked_t shared_last_ino;
61647 + int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
61648
61649 res = next - LAST_INO_BATCH;
61650 }
61651 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
61652 index 4a6cf28..d3a29d3 100644
61653 --- a/fs/jffs2/erase.c
61654 +++ b/fs/jffs2/erase.c
61655 @@ -452,7 +452,8 @@ static void jffs2_mark_erased_block(struct jffs2_sb_info *c, struct jffs2_eraseb
61656 struct jffs2_unknown_node marker = {
61657 .magic = cpu_to_je16(JFFS2_MAGIC_BITMASK),
61658 .nodetype = cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
61659 - .totlen = cpu_to_je32(c->cleanmarker_size)
61660 + .totlen = cpu_to_je32(c->cleanmarker_size),
61661 + .hdr_crc = cpu_to_je32(0)
61662 };
61663
61664 jffs2_prealloc_raw_node_refs(c, jeb, 1);
61665 diff --git a/fs/jffs2/wbuf.c b/fs/jffs2/wbuf.c
61666 index a6597d6..41b30ec 100644
61667 --- a/fs/jffs2/wbuf.c
61668 +++ b/fs/jffs2/wbuf.c
61669 @@ -1023,7 +1023,8 @@ static const struct jffs2_unknown_node oob_cleanmarker =
61670 {
61671 .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
61672 .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
61673 - .totlen = constant_cpu_to_je32(8)
61674 + .totlen = constant_cpu_to_je32(8),
61675 + .hdr_crc = constant_cpu_to_je32(0)
61676 };
61677
61678 /*
61679 diff --git a/fs/jfs/super.c b/fs/jfs/super.c
61680 index e2b7483..855bca3 100644
61681 --- a/fs/jfs/super.c
61682 +++ b/fs/jfs/super.c
61683 @@ -884,7 +884,7 @@ static int __init init_jfs_fs(void)
61684
61685 jfs_inode_cachep =
61686 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
61687 - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
61688 + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
61689 init_once);
61690 if (jfs_inode_cachep == NULL)
61691 return -ENOMEM;
61692 diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
61693 index 39c0143..d54fad4 100644
61694 --- a/fs/kernfs/dir.c
61695 +++ b/fs/kernfs/dir.c
61696 @@ -28,7 +28,7 @@ DEFINE_MUTEX(kernfs_mutex);
61697 *
61698 * Returns 31 bit hash of ns + name (so it fits in an off_t )
61699 */
61700 -static unsigned int kernfs_name_hash(const char *name, const void *ns)
61701 +static unsigned int kernfs_name_hash(const unsigned char *name, const void *ns)
61702 {
61703 unsigned long hash = init_name_hash();
61704 unsigned int len = strlen(name);
61705 diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
61706 index dbf397b..d624b48 100644
61707 --- a/fs/kernfs/file.c
61708 +++ b/fs/kernfs/file.c
61709 @@ -33,7 +33,7 @@ static DEFINE_MUTEX(kernfs_open_file_mutex);
61710
61711 struct kernfs_open_node {
61712 atomic_t refcnt;
61713 - atomic_t event;
61714 + atomic_unchecked_t event;
61715 wait_queue_head_t poll;
61716 struct list_head files; /* goes through kernfs_open_file.list */
61717 };
61718 @@ -149,7 +149,7 @@ static int kernfs_seq_show(struct seq_file *sf, void *v)
61719 {
61720 struct kernfs_open_file *of = sf->private;
61721
61722 - of->event = atomic_read(&of->kn->attr.open->event);
61723 + of->event = atomic_read_unchecked(&of->kn->attr.open->event);
61724
61725 return of->kn->attr.ops->seq_show(sf, v);
61726 }
61727 @@ -353,12 +353,12 @@ static int kernfs_vma_page_mkwrite(struct vm_area_struct *vma,
61728 return ret;
61729 }
61730
61731 -static int kernfs_vma_access(struct vm_area_struct *vma, unsigned long addr,
61732 - void *buf, int len, int write)
61733 +static ssize_t kernfs_vma_access(struct vm_area_struct *vma, unsigned long addr,
61734 + void *buf, size_t len, int write)
61735 {
61736 struct file *file = vma->vm_file;
61737 struct kernfs_open_file *of = kernfs_of(file);
61738 - int ret;
61739 + ssize_t ret;
61740
61741 if (!of->vm_ops)
61742 return -EINVAL;
61743 @@ -557,7 +557,7 @@ static int kernfs_get_open_node(struct kernfs_node *kn,
61744 return -ENOMEM;
61745
61746 atomic_set(&new_on->refcnt, 0);
61747 - atomic_set(&new_on->event, 1);
61748 + atomic_set_unchecked(&new_on->event, 1);
61749 init_waitqueue_head(&new_on->poll);
61750 INIT_LIST_HEAD(&new_on->files);
61751 goto retry;
61752 @@ -754,7 +754,7 @@ static unsigned int kernfs_fop_poll(struct file *filp, poll_table *wait)
61753
61754 kernfs_put_active(kn);
61755
61756 - if (of->event != atomic_read(&on->event))
61757 + if (of->event != atomic_read_unchecked(&on->event))
61758 goto trigger;
61759
61760 return DEFAULT_POLLMASK;
61761 @@ -779,7 +779,7 @@ void kernfs_notify(struct kernfs_node *kn)
61762 if (!WARN_ON(kernfs_type(kn) != KERNFS_FILE)) {
61763 on = kn->attr.open;
61764 if (on) {
61765 - atomic_inc(&on->event);
61766 + atomic_inc_unchecked(&on->event);
61767 wake_up_interruptible(&on->poll);
61768 }
61769 }
61770 diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
61771 index 4d45705..b35e0bd 100644
61772 --- a/fs/kernfs/symlink.c
61773 +++ b/fs/kernfs/symlink.c
61774 @@ -132,7 +132,7 @@ static void *kernfs_iop_follow_link(struct dentry *dentry, struct nameidata *nd)
61775 static void kernfs_iop_put_link(struct dentry *dentry, struct nameidata *nd,
61776 void *cookie)
61777 {
61778 - char *page = nd_get_link(nd);
61779 + const char *page = nd_get_link(nd);
61780 if (!IS_ERR(page))
61781 free_page((unsigned long)page);
61782 }
61783 diff --git a/fs/libfs.c b/fs/libfs.c
61784 index a184424..944ddce 100644
61785 --- a/fs/libfs.c
61786 +++ b/fs/libfs.c
61787 @@ -159,6 +159,9 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
61788
61789 for (p = q->next; p != &dentry->d_subdirs; p = p->next) {
61790 struct dentry *next = list_entry(p, struct dentry, d_u.d_child);
61791 + char d_name[sizeof(next->d_iname)];
61792 + const unsigned char *name;
61793 +
61794 spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
61795 if (!simple_positive(next)) {
61796 spin_unlock(&next->d_lock);
61797 @@ -167,7 +170,12 @@ int dcache_readdir(struct file *file, struct dir_context *ctx)
61798
61799 spin_unlock(&next->d_lock);
61800 spin_unlock(&dentry->d_lock);
61801 - if (!dir_emit(ctx, next->d_name.name, next->d_name.len,
61802 + name = next->d_name.name;
61803 + if (name == next->d_iname) {
61804 + memcpy(d_name, name, next->d_name.len);
61805 + name = d_name;
61806 + }
61807 + if (!dir_emit(ctx, name, next->d_name.len,
61808 next->d_inode->i_ino, dt_type(next->d_inode)))
61809 return 0;
61810 spin_lock(&dentry->d_lock);
61811 @@ -999,7 +1007,7 @@ EXPORT_SYMBOL(noop_fsync);
61812 void kfree_put_link(struct dentry *dentry, struct nameidata *nd,
61813 void *cookie)
61814 {
61815 - char *s = nd_get_link(nd);
61816 + const char *s = nd_get_link(nd);
61817 if (!IS_ERR(s))
61818 kfree(s);
61819 }
61820 diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
61821 index acd3947..1f896e2 100644
61822 --- a/fs/lockd/clntproc.c
61823 +++ b/fs/lockd/clntproc.c
61824 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
61825 /*
61826 * Cookie counter for NLM requests
61827 */
61828 -static atomic_t nlm_cookie = ATOMIC_INIT(0x1234);
61829 +static atomic_unchecked_t nlm_cookie = ATOMIC_INIT(0x1234);
61830
61831 void nlmclnt_next_cookie(struct nlm_cookie *c)
61832 {
61833 - u32 cookie = atomic_inc_return(&nlm_cookie);
61834 + u32 cookie = atomic_inc_return_unchecked(&nlm_cookie);
61835
61836 memcpy(c->data, &cookie, 4);
61837 c->len=4;
61838 diff --git a/fs/locks.c b/fs/locks.c
61839 index 4dd39b9..12d6aaf 100644
61840 --- a/fs/locks.c
61841 +++ b/fs/locks.c
61842 @@ -2218,16 +2218,16 @@ void locks_remove_flock(struct file *filp)
61843 return;
61844
61845 if (filp->f_op->flock) {
61846 - struct file_lock fl = {
61847 + struct file_lock flock = {
61848 .fl_pid = current->tgid,
61849 .fl_file = filp,
61850 .fl_flags = FL_FLOCK,
61851 .fl_type = F_UNLCK,
61852 .fl_end = OFFSET_MAX,
61853 };
61854 - filp->f_op->flock(filp, F_SETLKW, &fl);
61855 - if (fl.fl_ops && fl.fl_ops->fl_release_private)
61856 - fl.fl_ops->fl_release_private(&fl);
61857 + filp->f_op->flock(filp, F_SETLKW, &flock);
61858 + if (flock.fl_ops && flock.fl_ops->fl_release_private)
61859 + flock.fl_ops->fl_release_private(&flock);
61860 }
61861
61862 spin_lock(&inode->i_lock);
61863 diff --git a/fs/mount.h b/fs/mount.h
61864 index b29e42f..5ea7fdf 100644
61865 --- a/fs/mount.h
61866 +++ b/fs/mount.h
61867 @@ -11,7 +11,7 @@ struct mnt_namespace {
61868 u64 seq; /* Sequence number to prevent loops */
61869 wait_queue_head_t poll;
61870 int event;
61871 -};
61872 +} __randomize_layout;
61873
61874 struct mnt_pcp {
61875 int mnt_count;
61876 @@ -57,7 +57,7 @@ struct mount {
61877 int mnt_expiry_mark; /* true if marked for expiry */
61878 int mnt_pinned;
61879 struct path mnt_ex_mountpoint;
61880 -};
61881 +} __randomize_layout;
61882
61883 #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
61884
61885 diff --git a/fs/namei.c b/fs/namei.c
61886 index 4b491b4..a0166f9 100644
61887 --- a/fs/namei.c
61888 +++ b/fs/namei.c
61889 @@ -330,16 +330,32 @@ int generic_permission(struct inode *inode, int mask)
61890 if (ret != -EACCES)
61891 return ret;
61892
61893 +#ifdef CONFIG_GRKERNSEC
61894 + /* we'll block if we have to log due to a denied capability use */
61895 + if (mask & MAY_NOT_BLOCK)
61896 + return -ECHILD;
61897 +#endif
61898 +
61899 if (S_ISDIR(inode->i_mode)) {
61900 /* DACs are overridable for directories */
61901 - if (inode_capable(inode, CAP_DAC_OVERRIDE))
61902 - return 0;
61903 if (!(mask & MAY_WRITE))
61904 - if (inode_capable(inode, CAP_DAC_READ_SEARCH))
61905 + if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) ||
61906 + inode_capable(inode, CAP_DAC_READ_SEARCH))
61907 return 0;
61908 + if (inode_capable(inode, CAP_DAC_OVERRIDE))
61909 + return 0;
61910 return -EACCES;
61911 }
61912 /*
61913 + * Searching includes executable on directories, else just read.
61914 + */
61915 + mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
61916 + if (mask == MAY_READ)
61917 + if (inode_capable_nolog(inode, CAP_DAC_OVERRIDE) ||
61918 + inode_capable(inode, CAP_DAC_READ_SEARCH))
61919 + return 0;
61920 +
61921 + /*
61922 * Read/write DACs are always overridable.
61923 * Executable DACs are overridable when there is
61924 * at least one exec bit set.
61925 @@ -348,14 +364,6 @@ int generic_permission(struct inode *inode, int mask)
61926 if (inode_capable(inode, CAP_DAC_OVERRIDE))
61927 return 0;
61928
61929 - /*
61930 - * Searching includes executable on directories, else just read.
61931 - */
61932 - mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
61933 - if (mask == MAY_READ)
61934 - if (inode_capable(inode, CAP_DAC_READ_SEARCH))
61935 - return 0;
61936 -
61937 return -EACCES;
61938 }
61939
61940 @@ -821,7 +829,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
61941 {
61942 struct dentry *dentry = link->dentry;
61943 int error;
61944 - char *s;
61945 + const char *s;
61946
61947 BUG_ON(nd->flags & LOOKUP_RCU);
61948
61949 @@ -842,6 +850,12 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
61950 if (error)
61951 goto out_put_nd_path;
61952
61953 + if (gr_handle_follow_link(dentry->d_parent->d_inode,
61954 + dentry->d_inode, dentry, nd->path.mnt)) {
61955 + error = -EACCES;
61956 + goto out_put_nd_path;
61957 + }
61958 +
61959 nd->last_type = LAST_BIND;
61960 *p = dentry->d_inode->i_op->follow_link(dentry, nd);
61961 error = PTR_ERR(*p);
61962 @@ -1590,6 +1604,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
61963 if (res)
61964 break;
61965 res = walk_component(nd, path, LOOKUP_FOLLOW);
61966 + if (res >= 0 && gr_handle_symlink_owner(&link, nd->inode))
61967 + res = -EACCES;
61968 put_link(nd, &link, cookie);
61969 } while (res > 0);
61970
61971 @@ -1663,7 +1679,7 @@ EXPORT_SYMBOL(full_name_hash);
61972 static inline unsigned long hash_name(const char *name, unsigned int *hashp)
61973 {
61974 unsigned long a, b, adata, bdata, mask, hash, len;
61975 - const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
61976 + static const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
61977
61978 hash = a = 0;
61979 len = -sizeof(unsigned long);
61980 @@ -1947,6 +1963,8 @@ static int path_lookupat(int dfd, const char *name,
61981 if (err)
61982 break;
61983 err = lookup_last(nd, &path);
61984 + if (!err && gr_handle_symlink_owner(&link, nd->inode))
61985 + err = -EACCES;
61986 put_link(nd, &link, cookie);
61987 }
61988 }
61989 @@ -1954,6 +1972,13 @@ static int path_lookupat(int dfd, const char *name,
61990 if (!err)
61991 err = complete_walk(nd);
61992
61993 + if (!err && !(nd->flags & LOOKUP_PARENT)) {
61994 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
61995 + path_put(&nd->path);
61996 + err = -ENOENT;
61997 + }
61998 + }
61999 +
62000 if (!err && nd->flags & LOOKUP_DIRECTORY) {
62001 if (!d_is_directory(nd->path.dentry)) {
62002 path_put(&nd->path);
62003 @@ -1981,8 +2006,15 @@ static int filename_lookup(int dfd, struct filename *name,
62004 retval = path_lookupat(dfd, name->name,
62005 flags | LOOKUP_REVAL, nd);
62006
62007 - if (likely(!retval))
62008 + if (likely(!retval)) {
62009 audit_inode(name, nd->path.dentry, flags & LOOKUP_PARENT);
62010 + if (name->name[0] != '/' && nd->path.dentry && nd->inode) {
62011 + if (!gr_chroot_fchdir(nd->path.dentry, nd->path.mnt)) {
62012 + path_put(&nd->path);
62013 + return -ENOENT;
62014 + }
62015 + }
62016 + }
62017 return retval;
62018 }
62019
62020 @@ -2556,6 +2588,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
62021 if (flag & O_NOATIME && !inode_owner_or_capable(inode))
62022 return -EPERM;
62023
62024 + if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode))
62025 + return -EPERM;
62026 + if (gr_handle_rawio(inode))
62027 + return -EPERM;
62028 + if (!gr_acl_handle_open(dentry, path->mnt, acc_mode))
62029 + return -EACCES;
62030 +
62031 return 0;
62032 }
62033
62034 @@ -2787,7 +2826,7 @@ looked_up:
62035 * cleared otherwise prior to returning.
62036 */
62037 static int lookup_open(struct nameidata *nd, struct path *path,
62038 - struct file *file,
62039 + struct path *link, struct file *file,
62040 const struct open_flags *op,
62041 bool got_write, int *opened)
62042 {
62043 @@ -2822,6 +2861,17 @@ static int lookup_open(struct nameidata *nd, struct path *path,
62044 /* Negative dentry, just create the file */
62045 if (!dentry->d_inode && (op->open_flag & O_CREAT)) {
62046 umode_t mode = op->mode;
62047 +
62048 + if (link && gr_handle_symlink_owner(link, dir->d_inode)) {
62049 + error = -EACCES;
62050 + goto out_dput;
62051 + }
62052 +
62053 + if (!gr_acl_handle_creat(dentry, dir, nd->path.mnt, op->open_flag, op->acc_mode, mode)) {
62054 + error = -EACCES;
62055 + goto out_dput;
62056 + }
62057 +
62058 if (!IS_POSIXACL(dir->d_inode))
62059 mode &= ~current_umask();
62060 /*
62061 @@ -2843,6 +2893,8 @@ static int lookup_open(struct nameidata *nd, struct path *path,
62062 nd->flags & LOOKUP_EXCL);
62063 if (error)
62064 goto out_dput;
62065 + else
62066 + gr_handle_create(dentry, nd->path.mnt);
62067 }
62068 out_no_open:
62069 path->dentry = dentry;
62070 @@ -2857,7 +2909,7 @@ out_dput:
62071 /*
62072 * Handle the last step of open()
62073 */
62074 -static int do_last(struct nameidata *nd, struct path *path,
62075 +static int do_last(struct nameidata *nd, struct path *path, struct path *link,
62076 struct file *file, const struct open_flags *op,
62077 int *opened, struct filename *name)
62078 {
62079 @@ -2907,6 +2959,15 @@ static int do_last(struct nameidata *nd, struct path *path,
62080 if (error)
62081 return error;
62082
62083 + if (!gr_acl_handle_hidden_file(dir, nd->path.mnt)) {
62084 + error = -ENOENT;
62085 + goto out;
62086 + }
62087 + if (link && gr_handle_symlink_owner(link, nd->inode)) {
62088 + error = -EACCES;
62089 + goto out;
62090 + }
62091 +
62092 audit_inode(name, dir, LOOKUP_PARENT);
62093 error = -EISDIR;
62094 /* trailing slashes? */
62095 @@ -2926,7 +2987,7 @@ retry_lookup:
62096 */
62097 }
62098 mutex_lock(&dir->d_inode->i_mutex);
62099 - error = lookup_open(nd, path, file, op, got_write, opened);
62100 + error = lookup_open(nd, path, link, file, op, got_write, opened);
62101 mutex_unlock(&dir->d_inode->i_mutex);
62102
62103 if (error <= 0) {
62104 @@ -2950,11 +3011,28 @@ retry_lookup:
62105 goto finish_open_created;
62106 }
62107
62108 + if (!gr_acl_handle_hidden_file(path->dentry, nd->path.mnt)) {
62109 + error = -ENOENT;
62110 + goto exit_dput;
62111 + }
62112 + if (link && gr_handle_symlink_owner(link, path->dentry->d_inode)) {
62113 + error = -EACCES;
62114 + goto exit_dput;
62115 + }
62116 +
62117 /*
62118 * create/update audit record if it already exists.
62119 */
62120 - if (d_is_positive(path->dentry))
62121 + if (d_is_positive(path->dentry)) {
62122 + /* only check if O_CREAT is specified, all other checks need to go
62123 + into may_open */
62124 + if (gr_handle_fifo(path->dentry, path->mnt, dir, open_flag, acc_mode)) {
62125 + error = -EACCES;
62126 + goto exit_dput;
62127 + }
62128 +
62129 audit_inode(name, path->dentry, 0);
62130 + }
62131
62132 /*
62133 * If atomic_open() acquired write access it is dropped now due to
62134 @@ -2995,6 +3073,11 @@ finish_lookup:
62135 }
62136 }
62137 BUG_ON(inode != path->dentry->d_inode);
62138 + /* if we're resolving a symlink to another symlink */
62139 + if (link && gr_handle_symlink_owner(link, inode)) {
62140 + error = -EACCES;
62141 + goto out;
62142 + }
62143 return 1;
62144 }
62145
62146 @@ -3004,7 +3087,6 @@ finish_lookup:
62147 save_parent.dentry = nd->path.dentry;
62148 save_parent.mnt = mntget(path->mnt);
62149 nd->path.dentry = path->dentry;
62150 -
62151 }
62152 nd->inode = inode;
62153 /* Why this, you ask? _Now_ we might have grown LOOKUP_JUMPED... */
62154 @@ -3014,7 +3096,18 @@ finish_open:
62155 path_put(&save_parent);
62156 return error;
62157 }
62158 +
62159 + if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
62160 + error = -ENOENT;
62161 + goto out;
62162 + }
62163 + if (link && gr_handle_symlink_owner(link, nd->inode)) {
62164 + error = -EACCES;
62165 + goto out;
62166 + }
62167 +
62168 audit_inode(name, nd->path.dentry, 0);
62169 +
62170 error = -EISDIR;
62171 if ((open_flag & O_CREAT) &&
62172 (d_is_directory(nd->path.dentry) || d_is_autodir(nd->path.dentry)))
62173 @@ -3178,7 +3271,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
62174 if (unlikely(error))
62175 goto out;
62176
62177 - error = do_last(nd, &path, file, op, &opened, pathname);
62178 + error = do_last(nd, &path, NULL, file, op, &opened, pathname);
62179 while (unlikely(error > 0)) { /* trailing symlink */
62180 struct path link = path;
62181 void *cookie;
62182 @@ -3196,7 +3289,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
62183 error = follow_link(&link, nd, &cookie);
62184 if (unlikely(error))
62185 break;
62186 - error = do_last(nd, &path, file, op, &opened, pathname);
62187 + error = do_last(nd, &path, &link, file, op, &opened, pathname);
62188 put_link(nd, &link, cookie);
62189 }
62190 out:
62191 @@ -3296,9 +3389,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname,
62192 goto unlock;
62193
62194 error = -EEXIST;
62195 - if (d_is_positive(dentry))
62196 + if (d_is_positive(dentry)) {
62197 + if (!gr_acl_handle_hidden_file(dentry, nd.path.mnt))
62198 + error = -ENOENT;
62199 goto fail;
62200 -
62201 + }
62202 /*
62203 * Special case - lookup gave negative, but... we had foo/bar/
62204 * From the vfs_mknod() POV we just have a negative dentry -
62205 @@ -3350,6 +3445,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname,
62206 }
62207 EXPORT_SYMBOL(user_path_create);
62208
62209 +static struct dentry *user_path_create_with_name(int dfd, const char __user *pathname, struct path *path, struct filename **to, unsigned int lookup_flags)
62210 +{
62211 + struct filename *tmp = getname(pathname);
62212 + struct dentry *res;
62213 + if (IS_ERR(tmp))
62214 + return ERR_CAST(tmp);
62215 + res = kern_path_create(dfd, tmp->name, path, lookup_flags);
62216 + if (IS_ERR(res))
62217 + putname(tmp);
62218 + else
62219 + *to = tmp;
62220 + return res;
62221 +}
62222 +
62223 int vfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
62224 {
62225 int error = may_create(dir, dentry);
62226 @@ -3412,6 +3521,17 @@ retry:
62227
62228 if (!IS_POSIXACL(path.dentry->d_inode))
62229 mode &= ~current_umask();
62230 +
62231 + if (gr_handle_chroot_mknod(dentry, path.mnt, mode)) {
62232 + error = -EPERM;
62233 + goto out;
62234 + }
62235 +
62236 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
62237 + error = -EACCES;
62238 + goto out;
62239 + }
62240 +
62241 error = security_path_mknod(&path, dentry, mode, dev);
62242 if (error)
62243 goto out;
62244 @@ -3428,6 +3548,8 @@ retry:
62245 break;
62246 }
62247 out:
62248 + if (!error)
62249 + gr_handle_create(dentry, path.mnt);
62250 done_path_create(&path, dentry);
62251 if (retry_estale(error, lookup_flags)) {
62252 lookup_flags |= LOOKUP_REVAL;
62253 @@ -3480,9 +3602,16 @@ retry:
62254
62255 if (!IS_POSIXACL(path.dentry->d_inode))
62256 mode &= ~current_umask();
62257 + if (!gr_acl_handle_mkdir(dentry, path.dentry, path.mnt)) {
62258 + error = -EACCES;
62259 + goto out;
62260 + }
62261 error = security_path_mkdir(&path, dentry, mode);
62262 if (!error)
62263 error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
62264 + if (!error)
62265 + gr_handle_create(dentry, path.mnt);
62266 +out:
62267 done_path_create(&path, dentry);
62268 if (retry_estale(error, lookup_flags)) {
62269 lookup_flags |= LOOKUP_REVAL;
62270 @@ -3563,6 +3692,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
62271 struct filename *name;
62272 struct dentry *dentry;
62273 struct nameidata nd;
62274 + ino_t saved_ino = 0;
62275 + dev_t saved_dev = 0;
62276 unsigned int lookup_flags = 0;
62277 retry:
62278 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
62279 @@ -3595,10 +3726,21 @@ retry:
62280 error = -ENOENT;
62281 goto exit3;
62282 }
62283 +
62284 + saved_ino = dentry->d_inode->i_ino;
62285 + saved_dev = gr_get_dev_from_dentry(dentry);
62286 +
62287 + if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
62288 + error = -EACCES;
62289 + goto exit3;
62290 + }
62291 +
62292 error = security_path_rmdir(&nd.path, dentry);
62293 if (error)
62294 goto exit3;
62295 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
62296 + if (!error && (saved_dev || saved_ino))
62297 + gr_handle_delete(saved_ino, saved_dev);
62298 exit3:
62299 dput(dentry);
62300 exit2:
62301 @@ -3688,6 +3830,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
62302 struct nameidata nd;
62303 struct inode *inode = NULL;
62304 struct inode *delegated_inode = NULL;
62305 + ino_t saved_ino = 0;
62306 + dev_t saved_dev = 0;
62307 unsigned int lookup_flags = 0;
62308 retry:
62309 name = user_path_parent(dfd, pathname, &nd, lookup_flags);
62310 @@ -3714,10 +3858,22 @@ retry_deleg:
62311 if (d_is_negative(dentry))
62312 goto slashes;
62313 ihold(inode);
62314 +
62315 + if (inode->i_nlink <= 1) {
62316 + saved_ino = inode->i_ino;
62317 + saved_dev = gr_get_dev_from_dentry(dentry);
62318 + }
62319 + if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
62320 + error = -EACCES;
62321 + goto exit2;
62322 + }
62323 +
62324 error = security_path_unlink(&nd.path, dentry);
62325 if (error)
62326 goto exit2;
62327 error = vfs_unlink(nd.path.dentry->d_inode, dentry, &delegated_inode);
62328 + if (!error && (saved_ino || saved_dev))
62329 + gr_handle_delete(saved_ino, saved_dev);
62330 exit2:
62331 dput(dentry);
62332 }
62333 @@ -3805,9 +3961,17 @@ retry:
62334 if (IS_ERR(dentry))
62335 goto out_putname;
62336
62337 + if (!gr_acl_handle_symlink(dentry, path.dentry, path.mnt, from)) {
62338 + error = -EACCES;
62339 + goto out;
62340 + }
62341 +
62342 error = security_path_symlink(&path, dentry, from->name);
62343 if (!error)
62344 error = vfs_symlink(path.dentry->d_inode, dentry, from->name);
62345 + if (!error)
62346 + gr_handle_create(dentry, path.mnt);
62347 +out:
62348 done_path_create(&path, dentry);
62349 if (retry_estale(error, lookup_flags)) {
62350 lookup_flags |= LOOKUP_REVAL;
62351 @@ -3910,6 +4074,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
62352 struct dentry *new_dentry;
62353 struct path old_path, new_path;
62354 struct inode *delegated_inode = NULL;
62355 + struct filename *to = NULL;
62356 int how = 0;
62357 int error;
62358
62359 @@ -3933,7 +4098,7 @@ retry:
62360 if (error)
62361 return error;
62362
62363 - new_dentry = user_path_create(newdfd, newname, &new_path,
62364 + new_dentry = user_path_create_with_name(newdfd, newname, &new_path, &to,
62365 (how & LOOKUP_REVAL));
62366 error = PTR_ERR(new_dentry);
62367 if (IS_ERR(new_dentry))
62368 @@ -3945,11 +4110,28 @@ retry:
62369 error = may_linkat(&old_path);
62370 if (unlikely(error))
62371 goto out_dput;
62372 +
62373 + if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
62374 + old_path.dentry->d_inode,
62375 + old_path.dentry->d_inode->i_mode, to)) {
62376 + error = -EACCES;
62377 + goto out_dput;
62378 + }
62379 +
62380 + if (!gr_acl_handle_link(new_dentry, new_path.dentry, new_path.mnt,
62381 + old_path.dentry, old_path.mnt, to)) {
62382 + error = -EACCES;
62383 + goto out_dput;
62384 + }
62385 +
62386 error = security_path_link(old_path.dentry, &new_path, new_dentry);
62387 if (error)
62388 goto out_dput;
62389 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry, &delegated_inode);
62390 + if (!error)
62391 + gr_handle_create(new_dentry, new_path.mnt);
62392 out_dput:
62393 + putname(to);
62394 done_path_create(&new_path, new_dentry);
62395 if (delegated_inode) {
62396 error = break_deleg_wait(&delegated_inode);
62397 @@ -4236,6 +4418,12 @@ retry_deleg:
62398 if (new_dentry == trap)
62399 goto exit5;
62400
62401 + error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
62402 + old_dentry, old_dir->d_inode, oldnd.path.mnt,
62403 + to);
62404 + if (error)
62405 + goto exit5;
62406 +
62407 error = security_path_rename(&oldnd.path, old_dentry,
62408 &newnd.path, new_dentry);
62409 if (error)
62410 @@ -4243,6 +4431,9 @@ retry_deleg:
62411 error = vfs_rename(old_dir->d_inode, old_dentry,
62412 new_dir->d_inode, new_dentry,
62413 &delegated_inode);
62414 + if (!error)
62415 + gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
62416 + new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
62417 exit5:
62418 dput(new_dentry);
62419 exit4:
62420 @@ -4279,6 +4470,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
62421
62422 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
62423 {
62424 + char tmpbuf[64];
62425 + const char *newlink;
62426 int len;
62427
62428 len = PTR_ERR(link);
62429 @@ -4288,7 +4481,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
62430 len = strlen(link);
62431 if (len > (unsigned) buflen)
62432 len = buflen;
62433 - if (copy_to_user(buffer, link, len))
62434 +
62435 + if (len < sizeof(tmpbuf)) {
62436 + memcpy(tmpbuf, link, len);
62437 + newlink = tmpbuf;
62438 + } else
62439 + newlink = link;
62440 +
62441 + if (copy_to_user(buffer, newlink, len))
62442 len = -EFAULT;
62443 out:
62444 return len;
62445 diff --git a/fs/namespace.c b/fs/namespace.c
62446 index 65233a5..82ac953 100644
62447 --- a/fs/namespace.c
62448 +++ b/fs/namespace.c
62449 @@ -1339,6 +1339,9 @@ static int do_umount(struct mount *mnt, int flags)
62450 if (!(sb->s_flags & MS_RDONLY))
62451 retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
62452 up_write(&sb->s_umount);
62453 +
62454 + gr_log_remount(mnt->mnt_devname, retval);
62455 +
62456 return retval;
62457 }
62458
62459 @@ -1361,6 +1364,9 @@ static int do_umount(struct mount *mnt, int flags)
62460 }
62461 unlock_mount_hash();
62462 namespace_unlock();
62463 +
62464 + gr_log_unmount(mnt->mnt_devname, retval);
62465 +
62466 return retval;
62467 }
62468
62469 @@ -1380,7 +1386,7 @@ static inline bool may_mount(void)
62470 * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
62471 */
62472
62473 -SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
62474 +SYSCALL_DEFINE2(umount, const char __user *, name, int, flags)
62475 {
62476 struct path path;
62477 struct mount *mnt;
62478 @@ -1422,7 +1428,7 @@ out:
62479 /*
62480 * The 2.0 compatible umount. No flags.
62481 */
62482 -SYSCALL_DEFINE1(oldumount, char __user *, name)
62483 +SYSCALL_DEFINE1(oldumount, const char __user *, name)
62484 {
62485 return sys_umount(name, 0);
62486 }
62487 @@ -2431,6 +2437,16 @@ long do_mount(const char *dev_name, const char *dir_name,
62488 MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
62489 MS_STRICTATIME);
62490
62491 + if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
62492 + retval = -EPERM;
62493 + goto dput_out;
62494 + }
62495 +
62496 + if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
62497 + retval = -EPERM;
62498 + goto dput_out;
62499 + }
62500 +
62501 if (flags & MS_REMOUNT)
62502 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
62503 data_page);
62504 @@ -2445,6 +2461,9 @@ long do_mount(const char *dev_name, const char *dir_name,
62505 dev_name, data_page);
62506 dput_out:
62507 path_put(&path);
62508 +
62509 + gr_log_mount(dev_name, dir_name, retval);
62510 +
62511 return retval;
62512 }
62513
62514 @@ -2462,7 +2481,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
62515 * number incrementing at 10Ghz will take 12,427 years to wrap which
62516 * is effectively never, so we can ignore the possibility.
62517 */
62518 -static atomic64_t mnt_ns_seq = ATOMIC64_INIT(1);
62519 +static atomic64_unchecked_t mnt_ns_seq = ATOMIC64_INIT(1);
62520
62521 static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
62522 {
62523 @@ -2477,7 +2496,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
62524 kfree(new_ns);
62525 return ERR_PTR(ret);
62526 }
62527 - new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
62528 + new_ns->seq = atomic64_inc_return_unchecked(&mnt_ns_seq);
62529 atomic_set(&new_ns->count, 1);
62530 new_ns->root = NULL;
62531 INIT_LIST_HEAD(&new_ns->list);
62532 @@ -2487,7 +2506,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
62533 return new_ns;
62534 }
62535
62536 -struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
62537 +__latent_entropy struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
62538 struct user_namespace *user_ns, struct fs_struct *new_fs)
62539 {
62540 struct mnt_namespace *new_ns;
62541 @@ -2608,8 +2627,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
62542 }
62543 EXPORT_SYMBOL(mount_subtree);
62544
62545 -SYSCALL_DEFINE5(mount, char __user *, dev_name, char __user *, dir_name,
62546 - char __user *, type, unsigned long, flags, void __user *, data)
62547 +SYSCALL_DEFINE5(mount, const char __user *, dev_name, const char __user *, dir_name,
62548 + const char __user *, type, unsigned long, flags, void __user *, data)
62549 {
62550 int ret;
62551 char *kernel_type;
62552 @@ -2722,6 +2741,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
62553 if (error)
62554 goto out2;
62555
62556 + if (gr_handle_chroot_pivot()) {
62557 + error = -EPERM;
62558 + goto out2;
62559 + }
62560 +
62561 get_fs_root(current->fs, &root);
62562 old_mp = lock_mount(&old);
62563 error = PTR_ERR(old_mp);
62564 @@ -2990,7 +3014,7 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns)
62565 !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
62566 return -EPERM;
62567
62568 - if (fs->users != 1)
62569 + if (atomic_read(&fs->users) != 1)
62570 return -EINVAL;
62571
62572 get_mnt_ns(mnt_ns);
62573 diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
62574 index f4ccfe6..a5cf064 100644
62575 --- a/fs/nfs/callback_xdr.c
62576 +++ b/fs/nfs/callback_xdr.c
62577 @@ -51,7 +51,7 @@ struct callback_op {
62578 callback_decode_arg_t decode_args;
62579 callback_encode_res_t encode_res;
62580 long res_maxsize;
62581 -};
62582 +} __do_const;
62583
62584 static struct callback_op callback_ops[];
62585
62586 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
62587 index 360114a..ac6e265 100644
62588 --- a/fs/nfs/inode.c
62589 +++ b/fs/nfs/inode.c
62590 @@ -1189,16 +1189,16 @@ static int nfs_size_need_update(const struct inode *inode, const struct nfs_fatt
62591 return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
62592 }
62593
62594 -static atomic_long_t nfs_attr_generation_counter;
62595 +static atomic_long_unchecked_t nfs_attr_generation_counter;
62596
62597 static unsigned long nfs_read_attr_generation_counter(void)
62598 {
62599 - return atomic_long_read(&nfs_attr_generation_counter);
62600 + return atomic_long_read_unchecked(&nfs_attr_generation_counter);
62601 }
62602
62603 unsigned long nfs_inc_attr_generation_counter(void)
62604 {
62605 - return atomic_long_inc_return(&nfs_attr_generation_counter);
62606 + return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
62607 }
62608
62609 void nfs_fattr_init(struct nfs_fattr *fattr)
62610 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
62611 index 9a914e8..e89c0ea 100644
62612 --- a/fs/nfsd/nfs4proc.c
62613 +++ b/fs/nfsd/nfs4proc.c
62614 @@ -1178,7 +1178,7 @@ struct nfsd4_operation {
62615 nfsd4op_rsize op_rsize_bop;
62616 stateid_getter op_get_currentstateid;
62617 stateid_setter op_set_currentstateid;
62618 -};
62619 +} __do_const;
62620
62621 static struct nfsd4_operation nfsd4_ops[];
62622
62623 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
62624 index 16e8fa7..b0803f6 100644
62625 --- a/fs/nfsd/nfs4xdr.c
62626 +++ b/fs/nfsd/nfs4xdr.c
62627 @@ -1531,7 +1531,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
62628
62629 typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *);
62630
62631 -static nfsd4_dec nfsd4_dec_ops[] = {
62632 +static const nfsd4_dec nfsd4_dec_ops[] = {
62633 [OP_ACCESS] = (nfsd4_dec)nfsd4_decode_access,
62634 [OP_CLOSE] = (nfsd4_dec)nfsd4_decode_close,
62635 [OP_COMMIT] = (nfsd4_dec)nfsd4_decode_commit,
62636 diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
62637 index f8f060f..c4ba09a 100644
62638 --- a/fs/nfsd/nfscache.c
62639 +++ b/fs/nfsd/nfscache.c
62640 @@ -519,14 +519,17 @@ nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, __be32 *statp)
62641 {
62642 struct svc_cacherep *rp = rqstp->rq_cacherep;
62643 struct kvec *resv = &rqstp->rq_res.head[0], *cachv;
62644 - int len;
62645 + long len;
62646 size_t bufsize = 0;
62647
62648 if (!rp)
62649 return;
62650
62651 - len = resv->iov_len - ((char*)statp - (char*)resv->iov_base);
62652 - len >>= 2;
62653 + if (statp) {
62654 + len = (char*)statp - (char*)resv->iov_base;
62655 + len = resv->iov_len - len;
62656 + len >>= 2;
62657 + }
62658
62659 /* Don't cache excessive amounts of data and XDR failures */
62660 if (!statp || len > (256 >> 2)) {
62661 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
62662 index eea5ad1..5a84ac7 100644
62663 --- a/fs/nfsd/vfs.c
62664 +++ b/fs/nfsd/vfs.c
62665 @@ -843,7 +843,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
62666 } else {
62667 oldfs = get_fs();
62668 set_fs(KERNEL_DS);
62669 - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
62670 + host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset);
62671 set_fs(oldfs);
62672 }
62673
62674 @@ -934,7 +934,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
62675
62676 /* Write the data. */
62677 oldfs = get_fs(); set_fs(KERNEL_DS);
62678 - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
62679 + host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &pos);
62680 set_fs(oldfs);
62681 if (host_err < 0)
62682 goto out_nfserr;
62683 @@ -1479,7 +1479,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
62684 */
62685
62686 oldfs = get_fs(); set_fs(KERNEL_DS);
62687 - host_err = inode->i_op->readlink(path.dentry, (char __user *)buf, *lenp);
62688 + host_err = inode->i_op->readlink(path.dentry, (char __force_user *)buf, *lenp);
62689 set_fs(oldfs);
62690
62691 if (host_err < 0)
62692 diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
62693 index 52ccd34..43a53b1 100644
62694 --- a/fs/nls/nls_base.c
62695 +++ b/fs/nls/nls_base.c
62696 @@ -234,21 +234,25 @@ EXPORT_SYMBOL(utf16s_to_utf8s);
62697
62698 int __register_nls(struct nls_table *nls, struct module *owner)
62699 {
62700 - struct nls_table ** tmp = &tables;
62701 + struct nls_table *tmp = tables;
62702
62703 if (nls->next)
62704 return -EBUSY;
62705
62706 - nls->owner = owner;
62707 + pax_open_kernel();
62708 + *(void **)&nls->owner = owner;
62709 + pax_close_kernel();
62710 spin_lock(&nls_lock);
62711 - while (*tmp) {
62712 - if (nls == *tmp) {
62713 + while (tmp) {
62714 + if (nls == tmp) {
62715 spin_unlock(&nls_lock);
62716 return -EBUSY;
62717 }
62718 - tmp = &(*tmp)->next;
62719 + tmp = tmp->next;
62720 }
62721 - nls->next = tables;
62722 + pax_open_kernel();
62723 + *(struct nls_table **)&nls->next = tables;
62724 + pax_close_kernel();
62725 tables = nls;
62726 spin_unlock(&nls_lock);
62727 return 0;
62728 @@ -257,12 +261,14 @@ EXPORT_SYMBOL(__register_nls);
62729
62730 int unregister_nls(struct nls_table * nls)
62731 {
62732 - struct nls_table ** tmp = &tables;
62733 + struct nls_table * const * tmp = &tables;
62734
62735 spin_lock(&nls_lock);
62736 while (*tmp) {
62737 if (nls == *tmp) {
62738 - *tmp = nls->next;
62739 + pax_open_kernel();
62740 + *(struct nls_table **)tmp = nls->next;
62741 + pax_close_kernel();
62742 spin_unlock(&nls_lock);
62743 return 0;
62744 }
62745 diff --git a/fs/nls/nls_euc-jp.c b/fs/nls/nls_euc-jp.c
62746 index 162b3f1..6076a7c 100644
62747 --- a/fs/nls/nls_euc-jp.c
62748 +++ b/fs/nls/nls_euc-jp.c
62749 @@ -560,8 +560,10 @@ static int __init init_nls_euc_jp(void)
62750 p_nls = load_nls("cp932");
62751
62752 if (p_nls) {
62753 - table.charset2upper = p_nls->charset2upper;
62754 - table.charset2lower = p_nls->charset2lower;
62755 + pax_open_kernel();
62756 + *(const unsigned char **)&table.charset2upper = p_nls->charset2upper;
62757 + *(const unsigned char **)&table.charset2lower = p_nls->charset2lower;
62758 + pax_close_kernel();
62759 return register_nls(&table);
62760 }
62761
62762 diff --git a/fs/nls/nls_koi8-ru.c b/fs/nls/nls_koi8-ru.c
62763 index a80a741..7b96e1b 100644
62764 --- a/fs/nls/nls_koi8-ru.c
62765 +++ b/fs/nls/nls_koi8-ru.c
62766 @@ -62,8 +62,10 @@ static int __init init_nls_koi8_ru(void)
62767 p_nls = load_nls("koi8-u");
62768
62769 if (p_nls) {
62770 - table.charset2upper = p_nls->charset2upper;
62771 - table.charset2lower = p_nls->charset2lower;
62772 + pax_open_kernel();
62773 + *(const unsigned char **)&table.charset2upper = p_nls->charset2upper;
62774 + *(const unsigned char **)&table.charset2lower = p_nls->charset2lower;
62775 + pax_close_kernel();
62776 return register_nls(&table);
62777 }
62778
62779 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
62780 index 287a22c..4e56e4e 100644
62781 --- a/fs/notify/fanotify/fanotify_user.c
62782 +++ b/fs/notify/fanotify/fanotify_user.c
62783 @@ -251,8 +251,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
62784
62785 fd = fanotify_event_metadata.fd;
62786 ret = -EFAULT;
62787 - if (copy_to_user(buf, &fanotify_event_metadata,
62788 - fanotify_event_metadata.event_len))
62789 + if (fanotify_event_metadata.event_len > sizeof fanotify_event_metadata ||
62790 + copy_to_user(buf, &fanotify_event_metadata, fanotify_event_metadata.event_len))
62791 goto out_close_fd;
62792
62793 ret = prepare_for_access_response(group, event, fd);
62794 @@ -742,6 +742,8 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
62795 oevent->path.mnt = NULL;
62796 oevent->path.dentry = NULL;
62797
62798 + if (force_o_largefile())
62799 + event_f_flags |= O_LARGEFILE;
62800 group->fanotify_data.f_flags = event_f_flags;
62801 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
62802 oevent->response = 0;
62803 diff --git a/fs/notify/notification.c b/fs/notify/notification.c
62804 index 1e58402..bb2d6f4 100644
62805 --- a/fs/notify/notification.c
62806 +++ b/fs/notify/notification.c
62807 @@ -48,7 +48,7 @@
62808 #include <linux/fsnotify_backend.h>
62809 #include "fsnotify.h"
62810
62811 -static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
62812 +static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
62813
62814 /**
62815 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
62816 @@ -56,7 +56,7 @@ static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
62817 */
62818 u32 fsnotify_get_cookie(void)
62819 {
62820 - return atomic_inc_return(&fsnotify_sync_cookie);
62821 + return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
62822 }
62823 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
62824
62825 diff --git a/fs/ntfs/dir.c b/fs/ntfs/dir.c
62826 index 9e38daf..5727cae 100644
62827 --- a/fs/ntfs/dir.c
62828 +++ b/fs/ntfs/dir.c
62829 @@ -1310,7 +1310,7 @@ find_next_index_buffer:
62830 ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
62831 ~(s64)(ndir->itype.index.block_size - 1)));
62832 /* Bounds checks. */
62833 - if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
62834 + if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
62835 ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
62836 "inode 0x%lx or driver bug.", vdir->i_ino);
62837 goto err_out;
62838 diff --git a/fs/ntfs/file.c b/fs/ntfs/file.c
62839 index db9bd8a..8338fb6 100644
62840 --- a/fs/ntfs/file.c
62841 +++ b/fs/ntfs/file.c
62842 @@ -1282,7 +1282,7 @@ static inline size_t ntfs_copy_from_user(struct page **pages,
62843 char *addr;
62844 size_t total = 0;
62845 unsigned len;
62846 - int left;
62847 + unsigned left;
62848
62849 do {
62850 len = PAGE_CACHE_SIZE - ofs;
62851 diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
62852 index 82650d5..db37dcf 100644
62853 --- a/fs/ntfs/super.c
62854 +++ b/fs/ntfs/super.c
62855 @@ -685,7 +685,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
62856 if (!silent)
62857 ntfs_error(sb, "Primary boot sector is invalid.");
62858 } else if (!silent)
62859 - ntfs_error(sb, read_err_str, "primary");
62860 + ntfs_error(sb, read_err_str, "%s", "primary");
62861 if (!(NTFS_SB(sb)->on_errors & ON_ERRORS_RECOVER)) {
62862 if (bh_primary)
62863 brelse(bh_primary);
62864 @@ -701,7 +701,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
62865 goto hotfix_primary_boot_sector;
62866 brelse(bh_backup);
62867 } else if (!silent)
62868 - ntfs_error(sb, read_err_str, "backup");
62869 + ntfs_error(sb, read_err_str, "%s", "backup");
62870 /* Try to read NT3.51- backup boot sector. */
62871 if ((bh_backup = sb_bread(sb, nr_blocks >> 1))) {
62872 if (is_boot_sector_ntfs(sb, (NTFS_BOOT_SECTOR*)
62873 @@ -712,7 +712,7 @@ static struct buffer_head *read_ntfs_boot_sector(struct super_block *sb,
62874 "sector.");
62875 brelse(bh_backup);
62876 } else if (!silent)
62877 - ntfs_error(sb, read_err_str, "backup");
62878 + ntfs_error(sb, read_err_str, "%s", "backup");
62879 /* We failed. Cleanup and return. */
62880 if (bh_primary)
62881 brelse(bh_primary);
62882 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
62883 index 0440134..d52c93a 100644
62884 --- a/fs/ocfs2/localalloc.c
62885 +++ b/fs/ocfs2/localalloc.c
62886 @@ -1320,7 +1320,7 @@ static int ocfs2_local_alloc_slide_window(struct ocfs2_super *osb,
62887 goto bail;
62888 }
62889
62890 - atomic_inc(&osb->alloc_stats.moves);
62891 + atomic_inc_unchecked(&osb->alloc_stats.moves);
62892
62893 bail:
62894 if (handle)
62895 diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
62896 index 553f53c..aaf5133 100644
62897 --- a/fs/ocfs2/ocfs2.h
62898 +++ b/fs/ocfs2/ocfs2.h
62899 @@ -235,11 +235,11 @@ enum ocfs2_vol_state
62900
62901 struct ocfs2_alloc_stats
62902 {
62903 - atomic_t moves;
62904 - atomic_t local_data;
62905 - atomic_t bitmap_data;
62906 - atomic_t bg_allocs;
62907 - atomic_t bg_extends;
62908 + atomic_unchecked_t moves;
62909 + atomic_unchecked_t local_data;
62910 + atomic_unchecked_t bitmap_data;
62911 + atomic_unchecked_t bg_allocs;
62912 + atomic_unchecked_t bg_extends;
62913 };
62914
62915 enum ocfs2_local_alloc_state
62916 diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
62917 index 47ae266..6e8b793 100644
62918 --- a/fs/ocfs2/suballoc.c
62919 +++ b/fs/ocfs2/suballoc.c
62920 @@ -866,7 +866,7 @@ static int ocfs2_reserve_suballoc_bits(struct ocfs2_super *osb,
62921 mlog_errno(status);
62922 goto bail;
62923 }
62924 - atomic_inc(&osb->alloc_stats.bg_extends);
62925 + atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
62926
62927 /* You should never ask for this much metadata */
62928 BUG_ON(bits_wanted >
62929 @@ -1992,7 +1992,7 @@ int ocfs2_claim_metadata(handle_t *handle,
62930 mlog_errno(status);
62931 goto bail;
62932 }
62933 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62934 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62935
62936 *suballoc_loc = res.sr_bg_blkno;
62937 *suballoc_bit_start = res.sr_bit_offset;
62938 @@ -2156,7 +2156,7 @@ int ocfs2_claim_new_inode_at_loc(handle_t *handle,
62939 trace_ocfs2_claim_new_inode_at_loc((unsigned long long)di_blkno,
62940 res->sr_bits);
62941
62942 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62943 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62944
62945 BUG_ON(res->sr_bits != 1);
62946
62947 @@ -2198,7 +2198,7 @@ int ocfs2_claim_new_inode(handle_t *handle,
62948 mlog_errno(status);
62949 goto bail;
62950 }
62951 - atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62952 + atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
62953
62954 BUG_ON(res.sr_bits != 1);
62955
62956 @@ -2302,7 +2302,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
62957 cluster_start,
62958 num_clusters);
62959 if (!status)
62960 - atomic_inc(&osb->alloc_stats.local_data);
62961 + atomic_inc_unchecked(&osb->alloc_stats.local_data);
62962 } else {
62963 if (min_clusters > (osb->bitmap_cpg - 1)) {
62964 /* The only paths asking for contiguousness
62965 @@ -2328,7 +2328,7 @@ int __ocfs2_claim_clusters(handle_t *handle,
62966 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
62967 res.sr_bg_blkno,
62968 res.sr_bit_offset);
62969 - atomic_inc(&osb->alloc_stats.bitmap_data);
62970 + atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
62971 *num_clusters = res.sr_bits;
62972 }
62973 }
62974 diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
62975 index 49d84f8..4807e0b 100644
62976 --- a/fs/ocfs2/super.c
62977 +++ b/fs/ocfs2/super.c
62978 @@ -300,11 +300,11 @@ static int ocfs2_osb_dump(struct ocfs2_super *osb, char *buf, int len)
62979 "%10s => GlobalAllocs: %d LocalAllocs: %d "
62980 "SubAllocs: %d LAWinMoves: %d SAExtends: %d\n",
62981 "Stats",
62982 - atomic_read(&osb->alloc_stats.bitmap_data),
62983 - atomic_read(&osb->alloc_stats.local_data),
62984 - atomic_read(&osb->alloc_stats.bg_allocs),
62985 - atomic_read(&osb->alloc_stats.moves),
62986 - atomic_read(&osb->alloc_stats.bg_extends));
62987 + atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
62988 + atomic_read_unchecked(&osb->alloc_stats.local_data),
62989 + atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
62990 + atomic_read_unchecked(&osb->alloc_stats.moves),
62991 + atomic_read_unchecked(&osb->alloc_stats.bg_extends));
62992
62993 out += snprintf(buf + out, len - out,
62994 "%10s => State: %u Descriptor: %llu Size: %u bits "
62995 @@ -2123,11 +2123,11 @@ static int ocfs2_initialize_super(struct super_block *sb,
62996 spin_lock_init(&osb->osb_xattr_lock);
62997 ocfs2_init_steal_slots(osb);
62998
62999 - atomic_set(&osb->alloc_stats.moves, 0);
63000 - atomic_set(&osb->alloc_stats.local_data, 0);
63001 - atomic_set(&osb->alloc_stats.bitmap_data, 0);
63002 - atomic_set(&osb->alloc_stats.bg_allocs, 0);
63003 - atomic_set(&osb->alloc_stats.bg_extends, 0);
63004 + atomic_set_unchecked(&osb->alloc_stats.moves, 0);
63005 + atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
63006 + atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
63007 + atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
63008 + atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
63009
63010 /* Copy the blockcheck stats from the superblock probe */
63011 osb->osb_ecc_stats = *stats;
63012 diff --git a/fs/open.c b/fs/open.c
63013 index 2ed7325..4e77ac3 100644
63014 --- a/fs/open.c
63015 +++ b/fs/open.c
63016 @@ -32,6 +32,8 @@
63017 #include <linux/dnotify.h>
63018 #include <linux/compat.h>
63019
63020 +#define CREATE_TRACE_POINTS
63021 +#include <trace/events/fs.h>
63022 #include "internal.h"
63023
63024 int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
63025 @@ -103,6 +105,8 @@ long vfs_truncate(struct path *path, loff_t length)
63026 error = locks_verify_truncate(inode, NULL, length);
63027 if (!error)
63028 error = security_path_truncate(path);
63029 + if (!error && !gr_acl_handle_truncate(path->dentry, path->mnt))
63030 + error = -EACCES;
63031 if (!error)
63032 error = do_truncate(path->dentry, length, 0, NULL);
63033
63034 @@ -187,6 +191,8 @@ static long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
63035 error = locks_verify_truncate(inode, f.file, length);
63036 if (!error)
63037 error = security_path_truncate(&f.file->f_path);
63038 + if (!error && !gr_acl_handle_truncate(f.file->f_path.dentry, f.file->f_path.mnt))
63039 + error = -EACCES;
63040 if (!error)
63041 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, f.file);
63042 sb_end_write(inode->i_sb);
63043 @@ -361,6 +367,9 @@ retry:
63044 if (__mnt_is_readonly(path.mnt))
63045 res = -EROFS;
63046
63047 + if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
63048 + res = -EACCES;
63049 +
63050 out_path_release:
63051 path_put(&path);
63052 if (retry_estale(res, lookup_flags)) {
63053 @@ -392,6 +401,8 @@ retry:
63054 if (error)
63055 goto dput_and_out;
63056
63057 + gr_log_chdir(path.dentry, path.mnt);
63058 +
63059 set_fs_pwd(current->fs, &path);
63060
63061 dput_and_out:
63062 @@ -421,6 +432,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
63063 goto out_putf;
63064
63065 error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
63066 +
63067 + if (!error && !gr_chroot_fchdir(f.file->f_path.dentry, f.file->f_path.mnt))
63068 + error = -EPERM;
63069 +
63070 + if (!error)
63071 + gr_log_chdir(f.file->f_path.dentry, f.file->f_path.mnt);
63072 +
63073 if (!error)
63074 set_fs_pwd(current->fs, &f.file->f_path);
63075 out_putf:
63076 @@ -450,7 +468,13 @@ retry:
63077 if (error)
63078 goto dput_and_out;
63079
63080 + if (gr_handle_chroot_chroot(path.dentry, path.mnt))
63081 + goto dput_and_out;
63082 +
63083 set_fs_root(current->fs, &path);
63084 +
63085 + gr_handle_chroot_chdir(&path);
63086 +
63087 error = 0;
63088 dput_and_out:
63089 path_put(&path);
63090 @@ -474,6 +498,16 @@ static int chmod_common(struct path *path, umode_t mode)
63091 return error;
63092 retry_deleg:
63093 mutex_lock(&inode->i_mutex);
63094 +
63095 + if (!gr_acl_handle_chmod(path->dentry, path->mnt, &mode)) {
63096 + error = -EACCES;
63097 + goto out_unlock;
63098 + }
63099 + if (gr_handle_chroot_chmod(path->dentry, path->mnt, mode)) {
63100 + error = -EACCES;
63101 + goto out_unlock;
63102 + }
63103 +
63104 error = security_path_chmod(path, mode);
63105 if (error)
63106 goto out_unlock;
63107 @@ -539,6 +573,9 @@ static int chown_common(struct path *path, uid_t user, gid_t group)
63108 uid = make_kuid(current_user_ns(), user);
63109 gid = make_kgid(current_user_ns(), group);
63110
63111 + if (!gr_acl_handle_chown(path->dentry, path->mnt))
63112 + return -EACCES;
63113 +
63114 newattrs.ia_valid = ATTR_CTIME;
63115 if (user != (uid_t) -1) {
63116 if (!uid_valid(uid))
63117 @@ -982,6 +1019,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
63118 } else {
63119 fsnotify_open(f);
63120 fd_install(fd, f);
63121 + trace_do_sys_open(tmp->name, flags, mode);
63122 }
63123 }
63124 putname(tmp);
63125 diff --git a/fs/pipe.c b/fs/pipe.c
63126 index 78fd0d0..f71fc09 100644
63127 --- a/fs/pipe.c
63128 +++ b/fs/pipe.c
63129 @@ -56,7 +56,7 @@ unsigned int pipe_min_size = PAGE_SIZE;
63130
63131 static void pipe_lock_nested(struct pipe_inode_info *pipe, int subclass)
63132 {
63133 - if (pipe->files)
63134 + if (atomic_read(&pipe->files))
63135 mutex_lock_nested(&pipe->mutex, subclass);
63136 }
63137
63138 @@ -71,7 +71,7 @@ EXPORT_SYMBOL(pipe_lock);
63139
63140 void pipe_unlock(struct pipe_inode_info *pipe)
63141 {
63142 - if (pipe->files)
63143 + if (atomic_read(&pipe->files))
63144 mutex_unlock(&pipe->mutex);
63145 }
63146 EXPORT_SYMBOL(pipe_unlock);
63147 @@ -449,9 +449,9 @@ redo:
63148 }
63149 if (bufs) /* More to do? */
63150 continue;
63151 - if (!pipe->writers)
63152 + if (!atomic_read(&pipe->writers))
63153 break;
63154 - if (!pipe->waiting_writers) {
63155 + if (!atomic_read(&pipe->waiting_writers)) {
63156 /* syscall merging: Usually we must not sleep
63157 * if O_NONBLOCK is set, or if we got some data.
63158 * But if a writer sleeps in kernel space, then
63159 @@ -513,7 +513,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
63160 ret = 0;
63161 __pipe_lock(pipe);
63162
63163 - if (!pipe->readers) {
63164 + if (!atomic_read(&pipe->readers)) {
63165 send_sig(SIGPIPE, current, 0);
63166 ret = -EPIPE;
63167 goto out;
63168 @@ -562,7 +562,7 @@ redo1:
63169 for (;;) {
63170 int bufs;
63171
63172 - if (!pipe->readers) {
63173 + if (!atomic_read(&pipe->readers)) {
63174 send_sig(SIGPIPE, current, 0);
63175 if (!ret)
63176 ret = -EPIPE;
63177 @@ -653,9 +653,9 @@ redo2:
63178 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
63179 do_wakeup = 0;
63180 }
63181 - pipe->waiting_writers++;
63182 + atomic_inc(&pipe->waiting_writers);
63183 pipe_wait(pipe);
63184 - pipe->waiting_writers--;
63185 + atomic_dec(&pipe->waiting_writers);
63186 }
63187 out:
63188 __pipe_unlock(pipe);
63189 @@ -710,7 +710,7 @@ pipe_poll(struct file *filp, poll_table *wait)
63190 mask = 0;
63191 if (filp->f_mode & FMODE_READ) {
63192 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
63193 - if (!pipe->writers && filp->f_version != pipe->w_counter)
63194 + if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
63195 mask |= POLLHUP;
63196 }
63197
63198 @@ -720,7 +720,7 @@ pipe_poll(struct file *filp, poll_table *wait)
63199 * Most Unices do not set POLLERR for FIFOs but on Linux they
63200 * behave exactly like pipes for poll().
63201 */
63202 - if (!pipe->readers)
63203 + if (!atomic_read(&pipe->readers))
63204 mask |= POLLERR;
63205 }
63206
63207 @@ -732,7 +732,7 @@ static void put_pipe_info(struct inode *inode, struct pipe_inode_info *pipe)
63208 int kill = 0;
63209
63210 spin_lock(&inode->i_lock);
63211 - if (!--pipe->files) {
63212 + if (atomic_dec_and_test(&pipe->files)) {
63213 inode->i_pipe = NULL;
63214 kill = 1;
63215 }
63216 @@ -749,11 +749,11 @@ pipe_release(struct inode *inode, struct file *file)
63217
63218 __pipe_lock(pipe);
63219 if (file->f_mode & FMODE_READ)
63220 - pipe->readers--;
63221 + atomic_dec(&pipe->readers);
63222 if (file->f_mode & FMODE_WRITE)
63223 - pipe->writers--;
63224 + atomic_dec(&pipe->writers);
63225
63226 - if (pipe->readers || pipe->writers) {
63227 + if (atomic_read(&pipe->readers) || atomic_read(&pipe->writers)) {
63228 wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
63229 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
63230 kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
63231 @@ -818,7 +818,7 @@ void free_pipe_info(struct pipe_inode_info *pipe)
63232 kfree(pipe);
63233 }
63234
63235 -static struct vfsmount *pipe_mnt __read_mostly;
63236 +struct vfsmount *pipe_mnt __read_mostly;
63237
63238 /*
63239 * pipefs_dname() is called from d_path().
63240 @@ -848,8 +848,9 @@ static struct inode * get_pipe_inode(void)
63241 goto fail_iput;
63242
63243 inode->i_pipe = pipe;
63244 - pipe->files = 2;
63245 - pipe->readers = pipe->writers = 1;
63246 + atomic_set(&pipe->files, 2);
63247 + atomic_set(&pipe->readers, 1);
63248 + atomic_set(&pipe->writers, 1);
63249 inode->i_fop = &pipefifo_fops;
63250
63251 /*
63252 @@ -1028,17 +1029,17 @@ static int fifo_open(struct inode *inode, struct file *filp)
63253 spin_lock(&inode->i_lock);
63254 if (inode->i_pipe) {
63255 pipe = inode->i_pipe;
63256 - pipe->files++;
63257 + atomic_inc(&pipe->files);
63258 spin_unlock(&inode->i_lock);
63259 } else {
63260 spin_unlock(&inode->i_lock);
63261 pipe = alloc_pipe_info();
63262 if (!pipe)
63263 return -ENOMEM;
63264 - pipe->files = 1;
63265 + atomic_set(&pipe->files, 1);
63266 spin_lock(&inode->i_lock);
63267 if (unlikely(inode->i_pipe)) {
63268 - inode->i_pipe->files++;
63269 + atomic_inc(&inode->i_pipe->files);
63270 spin_unlock(&inode->i_lock);
63271 free_pipe_info(pipe);
63272 pipe = inode->i_pipe;
63273 @@ -1063,10 +1064,10 @@ static int fifo_open(struct inode *inode, struct file *filp)
63274 * opened, even when there is no process writing the FIFO.
63275 */
63276 pipe->r_counter++;
63277 - if (pipe->readers++ == 0)
63278 + if (atomic_inc_return(&pipe->readers) == 1)
63279 wake_up_partner(pipe);
63280
63281 - if (!is_pipe && !pipe->writers) {
63282 + if (!is_pipe && !atomic_read(&pipe->writers)) {
63283 if ((filp->f_flags & O_NONBLOCK)) {
63284 /* suppress POLLHUP until we have
63285 * seen a writer */
63286 @@ -1085,14 +1086,14 @@ static int fifo_open(struct inode *inode, struct file *filp)
63287 * errno=ENXIO when there is no process reading the FIFO.
63288 */
63289 ret = -ENXIO;
63290 - if (!is_pipe && (filp->f_flags & O_NONBLOCK) && !pipe->readers)
63291 + if (!is_pipe && (filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
63292 goto err;
63293
63294 pipe->w_counter++;
63295 - if (!pipe->writers++)
63296 + if (atomic_inc_return(&pipe->writers) == 1)
63297 wake_up_partner(pipe);
63298
63299 - if (!is_pipe && !pipe->readers) {
63300 + if (!is_pipe && !atomic_read(&pipe->readers)) {
63301 if (wait_for_partner(pipe, &pipe->r_counter))
63302 goto err_wr;
63303 }
63304 @@ -1106,11 +1107,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
63305 * the process can at least talk to itself.
63306 */
63307
63308 - pipe->readers++;
63309 - pipe->writers++;
63310 + atomic_inc(&pipe->readers);
63311 + atomic_inc(&pipe->writers);
63312 pipe->r_counter++;
63313 pipe->w_counter++;
63314 - if (pipe->readers == 1 || pipe->writers == 1)
63315 + if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
63316 wake_up_partner(pipe);
63317 break;
63318
63319 @@ -1124,13 +1125,13 @@ static int fifo_open(struct inode *inode, struct file *filp)
63320 return 0;
63321
63322 err_rd:
63323 - if (!--pipe->readers)
63324 + if (atomic_dec_and_test(&pipe->readers))
63325 wake_up_interruptible(&pipe->wait);
63326 ret = -ERESTARTSYS;
63327 goto err;
63328
63329 err_wr:
63330 - if (!--pipe->writers)
63331 + if (atomic_dec_and_test(&pipe->writers))
63332 wake_up_interruptible(&pipe->wait);
63333 ret = -ERESTARTSYS;
63334 goto err;
63335 diff --git a/fs/posix_acl.c b/fs/posix_acl.c
63336 index 9e363e4..d936d15 100644
63337 --- a/fs/posix_acl.c
63338 +++ b/fs/posix_acl.c
63339 @@ -20,6 +20,7 @@
63340 #include <linux/xattr.h>
63341 #include <linux/export.h>
63342 #include <linux/user_namespace.h>
63343 +#include <linux/grsecurity.h>
63344
63345 struct posix_acl **acl_by_type(struct inode *inode, int type)
63346 {
63347 @@ -271,7 +272,7 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
63348 }
63349 }
63350 if (mode_p)
63351 - *mode_p = (*mode_p & ~S_IRWXUGO) | mode;
63352 + *mode_p = ((*mode_p & ~S_IRWXUGO) | mode) & ~gr_acl_umask();
63353 return not_equiv;
63354 }
63355 EXPORT_SYMBOL(posix_acl_equiv_mode);
63356 @@ -421,7 +422,7 @@ static int posix_acl_create_masq(struct posix_acl *acl, umode_t *mode_p)
63357 mode &= (group_obj->e_perm << 3) | ~S_IRWXG;
63358 }
63359
63360 - *mode_p = (*mode_p & ~S_IRWXUGO) | mode;
63361 + *mode_p = ((*mode_p & ~S_IRWXUGO) | mode) & ~gr_acl_umask();
63362 return not_equiv;
63363 }
63364
63365 @@ -479,6 +480,8 @@ __posix_acl_create(struct posix_acl **acl, gfp_t gfp, umode_t *mode_p)
63366 struct posix_acl *clone = posix_acl_clone(*acl, gfp);
63367 int err = -ENOMEM;
63368 if (clone) {
63369 + *mode_p &= ~gr_acl_umask();
63370 +
63371 err = posix_acl_create_masq(clone, mode_p);
63372 if (err < 0) {
63373 posix_acl_release(clone);
63374 @@ -653,11 +656,12 @@ struct posix_acl *
63375 posix_acl_from_xattr(struct user_namespace *user_ns,
63376 const void *value, size_t size)
63377 {
63378 - posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
63379 - posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
63380 + const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
63381 + const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
63382 int count;
63383 struct posix_acl *acl;
63384 struct posix_acl_entry *acl_e;
63385 + umode_t umask = gr_acl_umask();
63386
63387 if (!value)
63388 return NULL;
63389 @@ -683,12 +687,18 @@ posix_acl_from_xattr(struct user_namespace *user_ns,
63390
63391 switch(acl_e->e_tag) {
63392 case ACL_USER_OBJ:
63393 + acl_e->e_perm &= ~((umask & S_IRWXU) >> 6);
63394 + break;
63395 case ACL_GROUP_OBJ:
63396 case ACL_MASK:
63397 + acl_e->e_perm &= ~((umask & S_IRWXG) >> 3);
63398 + break;
63399 case ACL_OTHER:
63400 + acl_e->e_perm &= ~(umask & S_IRWXO);
63401 break;
63402
63403 case ACL_USER:
63404 + acl_e->e_perm &= ~((umask & S_IRWXU) >> 6);
63405 acl_e->e_uid =
63406 make_kuid(user_ns,
63407 le32_to_cpu(entry->e_id));
63408 @@ -696,6 +706,7 @@ posix_acl_from_xattr(struct user_namespace *user_ns,
63409 goto fail;
63410 break;
63411 case ACL_GROUP:
63412 + acl_e->e_perm &= ~((umask & S_IRWXG) >> 3);
63413 acl_e->e_gid =
63414 make_kgid(user_ns,
63415 le32_to_cpu(entry->e_id));
63416 diff --git a/fs/proc/Kconfig b/fs/proc/Kconfig
63417 index 2183fcf..3c32a98 100644
63418 --- a/fs/proc/Kconfig
63419 +++ b/fs/proc/Kconfig
63420 @@ -30,7 +30,7 @@ config PROC_FS
63421
63422 config PROC_KCORE
63423 bool "/proc/kcore support" if !ARM
63424 - depends on PROC_FS && MMU
63425 + depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
63426 help
63427 Provides a virtual ELF core file of the live kernel. This can
63428 be read with gdb and other ELF tools. No modifications can be
63429 @@ -38,8 +38,8 @@ config PROC_KCORE
63430
63431 config PROC_VMCORE
63432 bool "/proc/vmcore support"
63433 - depends on PROC_FS && CRASH_DUMP
63434 - default y
63435 + depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
63436 + default n
63437 help
63438 Exports the dump image of crashed kernel in ELF format.
63439
63440 @@ -63,8 +63,8 @@ config PROC_SYSCTL
63441 limited in memory.
63442
63443 config PROC_PAGE_MONITOR
63444 - default y
63445 - depends on PROC_FS && MMU
63446 + default n
63447 + depends on PROC_FS && MMU && !GRKERNSEC
63448 bool "Enable /proc page monitoring" if EXPERT
63449 help
63450 Various /proc files exist to monitor process memory utilization:
63451 diff --git a/fs/proc/array.c b/fs/proc/array.c
63452 index 656e401..b5b86b9 100644
63453 --- a/fs/proc/array.c
63454 +++ b/fs/proc/array.c
63455 @@ -60,6 +60,7 @@
63456 #include <linux/tty.h>
63457 #include <linux/string.h>
63458 #include <linux/mman.h>
63459 +#include <linux/grsecurity.h>
63460 #include <linux/proc_fs.h>
63461 #include <linux/ioport.h>
63462 #include <linux/uaccess.h>
63463 @@ -356,6 +357,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
63464 seq_putc(m, '\n');
63465 }
63466
63467 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63468 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
63469 +{
63470 + if (p->mm)
63471 + seq_printf(m, "PaX:\t%c%c%c%c%c\n",
63472 + p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
63473 + p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
63474 + p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
63475 + p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
63476 + p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
63477 + else
63478 + seq_printf(m, "PaX:\t-----\n");
63479 +}
63480 +#endif
63481 +
63482 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
63483 struct pid *pid, struct task_struct *task)
63484 {
63485 @@ -374,9 +390,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
63486 task_cpus_allowed(m, task);
63487 cpuset_task_status_allowed(m, task);
63488 task_context_switch_counts(m, task);
63489 +
63490 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
63491 + task_pax(m, task);
63492 +#endif
63493 +
63494 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
63495 + task_grsec_rbac(m, task);
63496 +#endif
63497 +
63498 return 0;
63499 }
63500
63501 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63502 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
63503 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
63504 + _mm->pax_flags & MF_PAX_SEGMEXEC))
63505 +#endif
63506 +
63507 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
63508 struct pid *pid, struct task_struct *task, int whole)
63509 {
63510 @@ -398,6 +429,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
63511 char tcomm[sizeof(task->comm)];
63512 unsigned long flags;
63513
63514 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63515 + if (current->exec_id != m->exec_id) {
63516 + gr_log_badprocpid("stat");
63517 + return 0;
63518 + }
63519 +#endif
63520 +
63521 state = *get_task_state(task);
63522 vsize = eip = esp = 0;
63523 permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
63524 @@ -468,6 +506,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
63525 gtime = task_gtime(task);
63526 }
63527
63528 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63529 + if (PAX_RAND_FLAGS(mm)) {
63530 + eip = 0;
63531 + esp = 0;
63532 + wchan = 0;
63533 + }
63534 +#endif
63535 +#ifdef CONFIG_GRKERNSEC_HIDESYM
63536 + wchan = 0;
63537 + eip =0;
63538 + esp =0;
63539 +#endif
63540 +
63541 /* scale priority and nice values from timeslices to -20..20 */
63542 /* to make it look like a "normal" Unix priority/nice value */
63543 priority = task_prio(task);
63544 @@ -504,9 +555,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
63545 seq_put_decimal_ull(m, ' ', vsize);
63546 seq_put_decimal_ull(m, ' ', mm ? get_mm_rss(mm) : 0);
63547 seq_put_decimal_ull(m, ' ', rsslim);
63548 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63549 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0));
63550 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0));
63551 + seq_put_decimal_ull(m, ' ', PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0));
63552 +#else
63553 seq_put_decimal_ull(m, ' ', mm ? (permitted ? mm->start_code : 1) : 0);
63554 seq_put_decimal_ull(m, ' ', mm ? (permitted ? mm->end_code : 1) : 0);
63555 seq_put_decimal_ull(m, ' ', (permitted && mm) ? mm->start_stack : 0);
63556 +#endif
63557 seq_put_decimal_ull(m, ' ', esp);
63558 seq_put_decimal_ull(m, ' ', eip);
63559 /* The signal information here is obsolete.
63560 @@ -528,7 +585,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
63561 seq_put_decimal_ull(m, ' ', cputime_to_clock_t(gtime));
63562 seq_put_decimal_ll(m, ' ', cputime_to_clock_t(cgtime));
63563
63564 - if (mm && permitted) {
63565 + if (mm && permitted
63566 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63567 + && !PAX_RAND_FLAGS(mm)
63568 +#endif
63569 + ) {
63570 seq_put_decimal_ull(m, ' ', mm->start_data);
63571 seq_put_decimal_ull(m, ' ', mm->end_data);
63572 seq_put_decimal_ull(m, ' ', mm->start_brk);
63573 @@ -566,8 +627,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
63574 struct pid *pid, struct task_struct *task)
63575 {
63576 unsigned long size = 0, resident = 0, shared = 0, text = 0, data = 0;
63577 - struct mm_struct *mm = get_task_mm(task);
63578 + struct mm_struct *mm;
63579
63580 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63581 + if (current->exec_id != m->exec_id) {
63582 + gr_log_badprocpid("statm");
63583 + return 0;
63584 + }
63585 +#endif
63586 + mm = get_task_mm(task);
63587 if (mm) {
63588 size = task_statm(mm, &shared, &text, &data, &resident);
63589 mmput(mm);
63590 @@ -590,6 +658,13 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
63591 return 0;
63592 }
63593
63594 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
63595 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
63596 +{
63597 + return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
63598 +}
63599 +#endif
63600 +
63601 #ifdef CONFIG_CHECKPOINT_RESTORE
63602 static struct pid *
63603 get_children_pid(struct inode *inode, struct pid *pid_prev, loff_t pos)
63604 diff --git a/fs/proc/base.c b/fs/proc/base.c
63605 index b976062..584d0bc 100644
63606 --- a/fs/proc/base.c
63607 +++ b/fs/proc/base.c
63608 @@ -113,6 +113,14 @@ struct pid_entry {
63609 union proc_op op;
63610 };
63611
63612 +struct getdents_callback {
63613 + struct linux_dirent __user * current_dir;
63614 + struct linux_dirent __user * previous;
63615 + struct file * file;
63616 + int count;
63617 + int error;
63618 +};
63619 +
63620 #define NOD(NAME, MODE, IOP, FOP, OP) { \
63621 .name = (NAME), \
63622 .len = sizeof(NAME) - 1, \
63623 @@ -210,6 +218,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
63624 if (!mm->arg_end)
63625 goto out_mm; /* Shh! No looking before we're done */
63626
63627 + if (gr_acl_handle_procpidmem(task))
63628 + goto out_mm;
63629 +
63630 len = mm->arg_end - mm->arg_start;
63631
63632 if (len > PAGE_SIZE)
63633 @@ -237,12 +248,28 @@ out:
63634 return res;
63635 }
63636
63637 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63638 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
63639 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
63640 + _mm->pax_flags & MF_PAX_SEGMEXEC))
63641 +#endif
63642 +
63643 static int proc_pid_auxv(struct task_struct *task, char *buffer)
63644 {
63645 struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
63646 int res = PTR_ERR(mm);
63647 if (mm && !IS_ERR(mm)) {
63648 unsigned int nwords = 0;
63649 +
63650 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63651 + /* allow if we're currently ptracing this task */
63652 + if (PAX_RAND_FLAGS(mm) &&
63653 + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
63654 + mmput(mm);
63655 + return 0;
63656 + }
63657 +#endif
63658 +
63659 do {
63660 nwords += 2;
63661 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
63662 @@ -256,7 +283,7 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
63663 }
63664
63665
63666 -#ifdef CONFIG_KALLSYMS
63667 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63668 /*
63669 * Provides a wchan file via kallsyms in a proper one-value-per-file format.
63670 * Returns the resolved symbol. If that fails, simply return the address.
63671 @@ -295,7 +322,7 @@ static void unlock_trace(struct task_struct *task)
63672 mutex_unlock(&task->signal->cred_guard_mutex);
63673 }
63674
63675 -#ifdef CONFIG_STACKTRACE
63676 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63677
63678 #define MAX_STACK_TRACE_DEPTH 64
63679
63680 @@ -518,7 +545,7 @@ static int proc_pid_limits(struct task_struct *task, char *buffer)
63681 return count;
63682 }
63683
63684 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
63685 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
63686 static int proc_pid_syscall(struct task_struct *task, char *buffer)
63687 {
63688 long nr;
63689 @@ -547,7 +574,7 @@ static int proc_pid_syscall(struct task_struct *task, char *buffer)
63690 /************************************************************************/
63691
63692 /* permission checks */
63693 -static int proc_fd_access_allowed(struct inode *inode)
63694 +static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
63695 {
63696 struct task_struct *task;
63697 int allowed = 0;
63698 @@ -557,7 +584,10 @@ static int proc_fd_access_allowed(struct inode *inode)
63699 */
63700 task = get_proc_task(inode);
63701 if (task) {
63702 - allowed = ptrace_may_access(task, PTRACE_MODE_READ);
63703 + if (log)
63704 + allowed = ptrace_may_access(task, PTRACE_MODE_READ);
63705 + else
63706 + allowed = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
63707 put_task_struct(task);
63708 }
63709 return allowed;
63710 @@ -588,10 +618,35 @@ static bool has_pid_permissions(struct pid_namespace *pid,
63711 struct task_struct *task,
63712 int hide_pid_min)
63713 {
63714 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
63715 + return false;
63716 +
63717 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63718 + rcu_read_lock();
63719 + {
63720 + const struct cred *tmpcred = current_cred();
63721 + const struct cred *cred = __task_cred(task);
63722 +
63723 + if (uid_eq(tmpcred->uid, GLOBAL_ROOT_UID) || uid_eq(tmpcred->uid, cred->uid)
63724 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
63725 + || in_group_p(grsec_proc_gid)
63726 +#endif
63727 + ) {
63728 + rcu_read_unlock();
63729 + return true;
63730 + }
63731 + }
63732 + rcu_read_unlock();
63733 +
63734 + if (!pid->hide_pid)
63735 + return false;
63736 +#endif
63737 +
63738 if (pid->hide_pid < hide_pid_min)
63739 return true;
63740 if (in_group_p(pid->pid_gid))
63741 return true;
63742 +
63743 return ptrace_may_access(task, PTRACE_MODE_READ);
63744 }
63745
63746 @@ -609,7 +664,11 @@ static int proc_pid_permission(struct inode *inode, int mask)
63747 put_task_struct(task);
63748
63749 if (!has_perms) {
63750 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63751 + {
63752 +#else
63753 if (pid->hide_pid == 2) {
63754 +#endif
63755 /*
63756 * Let's make getdents(), stat(), and open()
63757 * consistent with each other. If a process
63758 @@ -707,6 +766,11 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
63759 if (!task)
63760 return -ESRCH;
63761
63762 + if (gr_acl_handle_procpidmem(task)) {
63763 + put_task_struct(task);
63764 + return -EPERM;
63765 + }
63766 +
63767 mm = mm_access(task, mode);
63768 put_task_struct(task);
63769
63770 @@ -722,6 +786,10 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
63771
63772 file->private_data = mm;
63773
63774 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63775 + file->f_version = current->exec_id;
63776 +#endif
63777 +
63778 return 0;
63779 }
63780
63781 @@ -743,6 +811,17 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
63782 ssize_t copied;
63783 char *page;
63784
63785 +#ifdef CONFIG_GRKERNSEC
63786 + if (write)
63787 + return -EPERM;
63788 +#endif
63789 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63790 + if (file->f_version != current->exec_id) {
63791 + gr_log_badprocpid("mem");
63792 + return 0;
63793 + }
63794 +#endif
63795 +
63796 if (!mm)
63797 return 0;
63798
63799 @@ -755,7 +834,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
63800 goto free;
63801
63802 while (count > 0) {
63803 - int this_len = min_t(int, count, PAGE_SIZE);
63804 + ssize_t this_len = min_t(ssize_t, count, PAGE_SIZE);
63805
63806 if (write && copy_from_user(page, buf, this_len)) {
63807 copied = -EFAULT;
63808 @@ -847,6 +926,13 @@ static ssize_t environ_read(struct file *file, char __user *buf,
63809 if (!mm)
63810 return 0;
63811
63812 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
63813 + if (file->f_version != current->exec_id) {
63814 + gr_log_badprocpid("environ");
63815 + return 0;
63816 + }
63817 +#endif
63818 +
63819 page = (char *)__get_free_page(GFP_TEMPORARY);
63820 if (!page)
63821 return -ENOMEM;
63822 @@ -856,7 +942,7 @@ static ssize_t environ_read(struct file *file, char __user *buf,
63823 goto free;
63824 while (count > 0) {
63825 size_t this_len, max_len;
63826 - int retval;
63827 + ssize_t retval;
63828
63829 if (src >= (mm->env_end - mm->env_start))
63830 break;
63831 @@ -1467,7 +1553,7 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
63832 int error = -EACCES;
63833
63834 /* Are we allowed to snoop on the tasks file descriptors? */
63835 - if (!proc_fd_access_allowed(inode))
63836 + if (!proc_fd_access_allowed(inode, 0))
63837 goto out;
63838
63839 error = PROC_I(inode)->op.proc_get_link(dentry, &path);
63840 @@ -1511,8 +1597,18 @@ static int proc_pid_readlink(struct dentry * dentry, char __user * buffer, int b
63841 struct path path;
63842
63843 /* Are we allowed to snoop on the tasks file descriptors? */
63844 - if (!proc_fd_access_allowed(inode))
63845 - goto out;
63846 + /* logging this is needed for learning on chromium to work properly,
63847 + but we don't want to flood the logs from 'ps' which does a readlink
63848 + on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
63849 + CAP_SYS_PTRACE as it's not necessary for its basic functionality
63850 + */
63851 + if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
63852 + if (!proc_fd_access_allowed(inode,0))
63853 + goto out;
63854 + } else {
63855 + if (!proc_fd_access_allowed(inode,1))
63856 + goto out;
63857 + }
63858
63859 error = PROC_I(inode)->op.proc_get_link(dentry, &path);
63860 if (error)
63861 @@ -1562,7 +1658,11 @@ struct inode *proc_pid_make_inode(struct super_block * sb, struct task_struct *t
63862 rcu_read_lock();
63863 cred = __task_cred(task);
63864 inode->i_uid = cred->euid;
63865 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
63866 + inode->i_gid = grsec_proc_gid;
63867 +#else
63868 inode->i_gid = cred->egid;
63869 +#endif
63870 rcu_read_unlock();
63871 }
63872 security_task_to_inode(task, inode);
63873 @@ -1598,10 +1698,19 @@ int pid_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
63874 return -ENOENT;
63875 }
63876 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
63877 +#ifdef CONFIG_GRKERNSEC_PROC_USER
63878 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
63879 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63880 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
63881 +#endif
63882 task_dumpable(task)) {
63883 cred = __task_cred(task);
63884 stat->uid = cred->euid;
63885 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
63886 + stat->gid = grsec_proc_gid;
63887 +#else
63888 stat->gid = cred->egid;
63889 +#endif
63890 }
63891 }
63892 rcu_read_unlock();
63893 @@ -1639,11 +1748,20 @@ int pid_revalidate(struct dentry *dentry, unsigned int flags)
63894
63895 if (task) {
63896 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
63897 +#ifdef CONFIG_GRKERNSEC_PROC_USER
63898 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
63899 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63900 + (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
63901 +#endif
63902 task_dumpable(task)) {
63903 rcu_read_lock();
63904 cred = __task_cred(task);
63905 inode->i_uid = cred->euid;
63906 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
63907 + inode->i_gid = grsec_proc_gid;
63908 +#else
63909 inode->i_gid = cred->egid;
63910 +#endif
63911 rcu_read_unlock();
63912 } else {
63913 inode->i_uid = GLOBAL_ROOT_UID;
63914 @@ -2178,6 +2296,9 @@ static struct dentry *proc_pident_lookup(struct inode *dir,
63915 if (!task)
63916 goto out_no_task;
63917
63918 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
63919 + goto out;
63920 +
63921 /*
63922 * Yes, it does not scale. And it should not. Don't add
63923 * new entries into /proc/<tgid>/ without very good reasons.
63924 @@ -2208,6 +2329,9 @@ static int proc_pident_readdir(struct file *file, struct dir_context *ctx,
63925 if (!task)
63926 return -ENOENT;
63927
63928 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
63929 + goto out;
63930 +
63931 if (!dir_emit_dots(file, ctx))
63932 goto out;
63933
63934 @@ -2597,7 +2721,7 @@ static const struct pid_entry tgid_base_stuff[] = {
63935 REG("autogroup", S_IRUGO|S_IWUSR, proc_pid_sched_autogroup_operations),
63936 #endif
63937 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
63938 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
63939 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
63940 INF("syscall", S_IRUGO, proc_pid_syscall),
63941 #endif
63942 INF("cmdline", S_IRUGO, proc_pid_cmdline),
63943 @@ -2622,10 +2746,10 @@ static const struct pid_entry tgid_base_stuff[] = {
63944 #ifdef CONFIG_SECURITY
63945 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
63946 #endif
63947 -#ifdef CONFIG_KALLSYMS
63948 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63949 INF("wchan", S_IRUGO, proc_pid_wchan),
63950 #endif
63951 -#ifdef CONFIG_STACKTRACE
63952 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
63953 ONE("stack", S_IRUGO, proc_pid_stack),
63954 #endif
63955 #ifdef CONFIG_SCHEDSTATS
63956 @@ -2659,6 +2783,9 @@ static const struct pid_entry tgid_base_stuff[] = {
63957 #ifdef CONFIG_HARDWALL
63958 INF("hardwall", S_IRUGO, proc_pid_hardwall),
63959 #endif
63960 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
63961 + INF("ipaddr", S_IRUSR, proc_pid_ipaddr),
63962 +#endif
63963 #ifdef CONFIG_USER_NS
63964 REG("uid_map", S_IRUGO|S_IWUSR, proc_uid_map_operations),
63965 REG("gid_map", S_IRUGO|S_IWUSR, proc_gid_map_operations),
63966 @@ -2789,7 +2916,14 @@ static int proc_pid_instantiate(struct inode *dir,
63967 if (!inode)
63968 goto out;
63969
63970 +#ifdef CONFIG_GRKERNSEC_PROC_USER
63971 + inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
63972 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
63973 + inode->i_gid = grsec_proc_gid;
63974 + inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
63975 +#else
63976 inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
63977 +#endif
63978 inode->i_op = &proc_tgid_base_inode_operations;
63979 inode->i_fop = &proc_tgid_base_operations;
63980 inode->i_flags|=S_IMMUTABLE;
63981 @@ -2827,7 +2961,11 @@ struct dentry *proc_pid_lookup(struct inode *dir, struct dentry * dentry, unsign
63982 if (!task)
63983 goto out;
63984
63985 + if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
63986 + goto out_put_task;
63987 +
63988 result = proc_pid_instantiate(dir, dentry, task, NULL);
63989 +out_put_task:
63990 put_task_struct(task);
63991 out:
63992 return ERR_PTR(result);
63993 @@ -2933,7 +3071,7 @@ static const struct pid_entry tid_base_stuff[] = {
63994 REG("sched", S_IRUGO|S_IWUSR, proc_pid_sched_operations),
63995 #endif
63996 REG("comm", S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
63997 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
63998 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
63999 INF("syscall", S_IRUGO, proc_pid_syscall),
64000 #endif
64001 INF("cmdline", S_IRUGO, proc_pid_cmdline),
64002 @@ -2960,10 +3098,10 @@ static const struct pid_entry tid_base_stuff[] = {
64003 #ifdef CONFIG_SECURITY
64004 DIR("attr", S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
64005 #endif
64006 -#ifdef CONFIG_KALLSYMS
64007 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
64008 INF("wchan", S_IRUGO, proc_pid_wchan),
64009 #endif
64010 -#ifdef CONFIG_STACKTRACE
64011 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
64012 ONE("stack", S_IRUGO, proc_pid_stack),
64013 #endif
64014 #ifdef CONFIG_SCHEDSTATS
64015 diff --git a/fs/proc/cmdline.c b/fs/proc/cmdline.c
64016 index cbd82df..c0407d2 100644
64017 --- a/fs/proc/cmdline.c
64018 +++ b/fs/proc/cmdline.c
64019 @@ -23,7 +23,11 @@ static const struct file_operations cmdline_proc_fops = {
64020
64021 static int __init proc_cmdline_init(void)
64022 {
64023 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
64024 + proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
64025 +#else
64026 proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
64027 +#endif
64028 return 0;
64029 }
64030 fs_initcall(proc_cmdline_init);
64031 diff --git a/fs/proc/devices.c b/fs/proc/devices.c
64032 index 50493ed..248166b 100644
64033 --- a/fs/proc/devices.c
64034 +++ b/fs/proc/devices.c
64035 @@ -64,7 +64,11 @@ static const struct file_operations proc_devinfo_operations = {
64036
64037 static int __init proc_devices_init(void)
64038 {
64039 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
64040 + proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
64041 +#else
64042 proc_create("devices", 0, NULL, &proc_devinfo_operations);
64043 +#endif
64044 return 0;
64045 }
64046 fs_initcall(proc_devices_init);
64047 diff --git a/fs/proc/fd.c b/fs/proc/fd.c
64048 index 985ea88..d118a0a 100644
64049 --- a/fs/proc/fd.c
64050 +++ b/fs/proc/fd.c
64051 @@ -25,7 +25,8 @@ static int seq_show(struct seq_file *m, void *v)
64052 if (!task)
64053 return -ENOENT;
64054
64055 - files = get_files_struct(task);
64056 + if (!gr_acl_handle_procpidmem(task))
64057 + files = get_files_struct(task);
64058 put_task_struct(task);
64059
64060 if (files) {
64061 @@ -283,11 +284,21 @@ static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry,
64062 */
64063 int proc_fd_permission(struct inode *inode, int mask)
64064 {
64065 + struct task_struct *task;
64066 int rv = generic_permission(inode, mask);
64067 - if (rv == 0)
64068 - return 0;
64069 +
64070 if (task_tgid(current) == proc_pid(inode))
64071 rv = 0;
64072 +
64073 + task = get_proc_task(inode);
64074 + if (task == NULL)
64075 + return rv;
64076 +
64077 + if (gr_acl_handle_procpidmem(task))
64078 + rv = -EACCES;
64079 +
64080 + put_task_struct(task);
64081 +
64082 return rv;
64083 }
64084
64085 diff --git a/fs/proc/generic.c b/fs/proc/generic.c
64086 index b7f268e..3bea6b7 100644
64087 --- a/fs/proc/generic.c
64088 +++ b/fs/proc/generic.c
64089 @@ -23,6 +23,7 @@
64090 #include <linux/bitops.h>
64091 #include <linux/spinlock.h>
64092 #include <linux/completion.h>
64093 +#include <linux/grsecurity.h>
64094 #include <asm/uaccess.h>
64095
64096 #include "internal.h"
64097 @@ -207,6 +208,15 @@ struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry,
64098 return proc_lookup_de(PDE(dir), dir, dentry);
64099 }
64100
64101 +struct dentry *proc_lookup_restrict(struct inode *dir, struct dentry *dentry,
64102 + unsigned int flags)
64103 +{
64104 + if (gr_proc_is_restricted())
64105 + return ERR_PTR(-EACCES);
64106 +
64107 + return proc_lookup_de(PDE(dir), dir, dentry);
64108 +}
64109 +
64110 /*
64111 * This returns non-zero if at EOF, so that the /proc
64112 * root directory can use this and check if it should
64113 @@ -264,6 +274,16 @@ int proc_readdir(struct file *file, struct dir_context *ctx)
64114 return proc_readdir_de(PDE(inode), file, ctx);
64115 }
64116
64117 +int proc_readdir_restrict(struct file *file, struct dir_context *ctx)
64118 +{
64119 + struct inode *inode = file_inode(file);
64120 +
64121 + if (gr_proc_is_restricted())
64122 + return -EACCES;
64123 +
64124 + return proc_readdir_de(PDE(inode), file, ctx);
64125 +}
64126 +
64127 /*
64128 * These are the generic /proc directory operations. They
64129 * use the in-memory "struct proc_dir_entry" tree to parse
64130 @@ -275,6 +295,12 @@ static const struct file_operations proc_dir_operations = {
64131 .iterate = proc_readdir,
64132 };
64133
64134 +static const struct file_operations proc_dir_restricted_operations = {
64135 + .llseek = generic_file_llseek,
64136 + .read = generic_read_dir,
64137 + .iterate = proc_readdir_restrict,
64138 +};
64139 +
64140 /*
64141 * proc directories can do almost nothing..
64142 */
64143 @@ -284,6 +310,12 @@ static const struct inode_operations proc_dir_inode_operations = {
64144 .setattr = proc_notify_change,
64145 };
64146
64147 +static const struct inode_operations proc_dir_restricted_inode_operations = {
64148 + .lookup = proc_lookup_restrict,
64149 + .getattr = proc_getattr,
64150 + .setattr = proc_notify_change,
64151 +};
64152 +
64153 static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp)
64154 {
64155 struct proc_dir_entry *tmp;
64156 @@ -294,8 +326,13 @@ static int proc_register(struct proc_dir_entry * dir, struct proc_dir_entry * dp
64157 return ret;
64158
64159 if (S_ISDIR(dp->mode)) {
64160 - dp->proc_fops = &proc_dir_operations;
64161 - dp->proc_iops = &proc_dir_inode_operations;
64162 + if (dp->restricted) {
64163 + dp->proc_fops = &proc_dir_restricted_operations;
64164 + dp->proc_iops = &proc_dir_restricted_inode_operations;
64165 + } else {
64166 + dp->proc_fops = &proc_dir_operations;
64167 + dp->proc_iops = &proc_dir_inode_operations;
64168 + }
64169 dir->nlink++;
64170 } else if (S_ISLNK(dp->mode)) {
64171 dp->proc_iops = &proc_link_inode_operations;
64172 @@ -407,6 +444,27 @@ struct proc_dir_entry *proc_mkdir_data(const char *name, umode_t mode,
64173 }
64174 EXPORT_SYMBOL_GPL(proc_mkdir_data);
64175
64176 +struct proc_dir_entry *proc_mkdir_data_restrict(const char *name, umode_t mode,
64177 + struct proc_dir_entry *parent, void *data)
64178 +{
64179 + struct proc_dir_entry *ent;
64180 +
64181 + if (mode == 0)
64182 + mode = S_IRUGO | S_IXUGO;
64183 +
64184 + ent = __proc_create(&parent, name, S_IFDIR | mode, 2);
64185 + if (ent) {
64186 + ent->data = data;
64187 + ent->restricted = 1;
64188 + if (proc_register(parent, ent) < 0) {
64189 + kfree(ent);
64190 + ent = NULL;
64191 + }
64192 + }
64193 + return ent;
64194 +}
64195 +EXPORT_SYMBOL_GPL(proc_mkdir_data_restrict);
64196 +
64197 struct proc_dir_entry *proc_mkdir_mode(const char *name, umode_t mode,
64198 struct proc_dir_entry *parent)
64199 {
64200 @@ -421,6 +479,13 @@ struct proc_dir_entry *proc_mkdir(const char *name,
64201 }
64202 EXPORT_SYMBOL(proc_mkdir);
64203
64204 +struct proc_dir_entry *proc_mkdir_restrict(const char *name,
64205 + struct proc_dir_entry *parent)
64206 +{
64207 + return proc_mkdir_data_restrict(name, 0, parent, NULL);
64208 +}
64209 +EXPORT_SYMBOL(proc_mkdir_restrict);
64210 +
64211 struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
64212 struct proc_dir_entry *parent,
64213 const struct file_operations *proc_fops,
64214 diff --git a/fs/proc/inode.c b/fs/proc/inode.c
64215 index 124fc43..8afbb02 100644
64216 --- a/fs/proc/inode.c
64217 +++ b/fs/proc/inode.c
64218 @@ -23,11 +23,17 @@
64219 #include <linux/slab.h>
64220 #include <linux/mount.h>
64221 #include <linux/magic.h>
64222 +#include <linux/grsecurity.h>
64223
64224 #include <asm/uaccess.h>
64225
64226 #include "internal.h"
64227
64228 +#ifdef CONFIG_PROC_SYSCTL
64229 +extern const struct inode_operations proc_sys_inode_operations;
64230 +extern const struct inode_operations proc_sys_dir_operations;
64231 +#endif
64232 +
64233 static void proc_evict_inode(struct inode *inode)
64234 {
64235 struct proc_dir_entry *de;
64236 @@ -55,6 +61,13 @@ static void proc_evict_inode(struct inode *inode)
64237 ns = PROC_I(inode)->ns.ns;
64238 if (ns_ops && ns)
64239 ns_ops->put(ns);
64240 +
64241 +#ifdef CONFIG_PROC_SYSCTL
64242 + if (inode->i_op == &proc_sys_inode_operations ||
64243 + inode->i_op == &proc_sys_dir_operations)
64244 + gr_handle_delete(inode->i_ino, inode->i_sb->s_dev);
64245 +#endif
64246 +
64247 }
64248
64249 static struct kmem_cache * proc_inode_cachep;
64250 @@ -413,7 +426,11 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
64251 if (de->mode) {
64252 inode->i_mode = de->mode;
64253 inode->i_uid = de->uid;
64254 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
64255 + inode->i_gid = grsec_proc_gid;
64256 +#else
64257 inode->i_gid = de->gid;
64258 +#endif
64259 }
64260 if (de->size)
64261 inode->i_size = de->size;
64262 diff --git a/fs/proc/internal.h b/fs/proc/internal.h
64263 index 651d09a..6a4b495 100644
64264 --- a/fs/proc/internal.h
64265 +++ b/fs/proc/internal.h
64266 @@ -46,9 +46,10 @@ struct proc_dir_entry {
64267 struct completion *pde_unload_completion;
64268 struct list_head pde_openers; /* who did ->open, but not ->release */
64269 spinlock_t pde_unload_lock; /* proc_fops checks and pde_users bumps */
64270 + u8 restricted; /* a directory in /proc/net that should be restricted via GRKERNSEC_PROC */
64271 u8 namelen;
64272 char name[];
64273 -};
64274 +} __randomize_layout;
64275
64276 union proc_op {
64277 int (*proc_get_link)(struct dentry *, struct path *);
64278 @@ -67,7 +68,7 @@ struct proc_inode {
64279 struct ctl_table *sysctl_entry;
64280 struct proc_ns ns;
64281 struct inode vfs_inode;
64282 -};
64283 +} __randomize_layout;
64284
64285 /*
64286 * General functions
64287 @@ -155,6 +156,9 @@ extern int proc_pid_status(struct seq_file *, struct pid_namespace *,
64288 struct pid *, struct task_struct *);
64289 extern int proc_pid_statm(struct seq_file *, struct pid_namespace *,
64290 struct pid *, struct task_struct *);
64291 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
64292 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
64293 +#endif
64294
64295 /*
64296 * base.c
64297 @@ -181,9 +185,11 @@ extern bool proc_fill_cache(struct file *, struct dir_context *, const char *, i
64298 extern spinlock_t proc_subdir_lock;
64299
64300 extern struct dentry *proc_lookup(struct inode *, struct dentry *, unsigned int);
64301 +extern struct dentry *proc_lookup_restrict(struct inode *, struct dentry *, unsigned int);
64302 extern struct dentry *proc_lookup_de(struct proc_dir_entry *, struct inode *,
64303 struct dentry *);
64304 extern int proc_readdir(struct file *, struct dir_context *);
64305 +extern int proc_readdir_restrict(struct file *, struct dir_context *);
64306 extern int proc_readdir_de(struct proc_dir_entry *, struct file *, struct dir_context *);
64307
64308 static inline struct proc_dir_entry *pde_get(struct proc_dir_entry *pde)
64309 diff --git a/fs/proc/interrupts.c b/fs/proc/interrupts.c
64310 index a352d57..cb94a5c 100644
64311 --- a/fs/proc/interrupts.c
64312 +++ b/fs/proc/interrupts.c
64313 @@ -47,7 +47,11 @@ static const struct file_operations proc_interrupts_operations = {
64314
64315 static int __init proc_interrupts_init(void)
64316 {
64317 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
64318 + proc_create_grsec("interrupts", 0, NULL, &proc_interrupts_operations);
64319 +#else
64320 proc_create("interrupts", 0, NULL, &proc_interrupts_operations);
64321 +#endif
64322 return 0;
64323 }
64324 fs_initcall(proc_interrupts_init);
64325 diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
64326 index 39e6ef3..2f9cb5e 100644
64327 --- a/fs/proc/kcore.c
64328 +++ b/fs/proc/kcore.c
64329 @@ -483,9 +483,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
64330 * the addresses in the elf_phdr on our list.
64331 */
64332 start = kc_offset_to_vaddr(*fpos - elf_buflen);
64333 - if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
64334 + tsz = PAGE_SIZE - (start & ~PAGE_MASK);
64335 + if (tsz > buflen)
64336 tsz = buflen;
64337 -
64338 +
64339 while (buflen) {
64340 struct kcore_list *m;
64341
64342 @@ -514,20 +515,23 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
64343 kfree(elf_buf);
64344 } else {
64345 if (kern_addr_valid(start)) {
64346 - unsigned long n;
64347 + char *elf_buf;
64348 + mm_segment_t oldfs;
64349
64350 - n = copy_to_user(buffer, (char *)start, tsz);
64351 - /*
64352 - * We cannot distinguish between fault on source
64353 - * and fault on destination. When this happens
64354 - * we clear too and hope it will trigger the
64355 - * EFAULT again.
64356 - */
64357 - if (n) {
64358 - if (clear_user(buffer + tsz - n,
64359 - n))
64360 + elf_buf = kmalloc(tsz, GFP_KERNEL);
64361 + if (!elf_buf)
64362 + return -ENOMEM;
64363 + oldfs = get_fs();
64364 + set_fs(KERNEL_DS);
64365 + if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
64366 + set_fs(oldfs);
64367 + if (copy_to_user(buffer, elf_buf, tsz)) {
64368 + kfree(elf_buf);
64369 return -EFAULT;
64370 + }
64371 }
64372 + set_fs(oldfs);
64373 + kfree(elf_buf);
64374 } else {
64375 if (clear_user(buffer, tsz))
64376 return -EFAULT;
64377 @@ -547,6 +551,9 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
64378
64379 static int open_kcore(struct inode *inode, struct file *filp)
64380 {
64381 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
64382 + return -EPERM;
64383 +#endif
64384 if (!capable(CAP_SYS_RAWIO))
64385 return -EPERM;
64386 if (kcore_need_update)
64387 diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
64388 index 136e548..1f88922 100644
64389 --- a/fs/proc/meminfo.c
64390 +++ b/fs/proc/meminfo.c
64391 @@ -187,7 +187,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
64392 vmi.used >> 10,
64393 vmi.largest_chunk >> 10
64394 #ifdef CONFIG_MEMORY_FAILURE
64395 - ,atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10)
64396 + ,atomic_long_read_unchecked(&num_poisoned_pages) << (PAGE_SHIFT - 10)
64397 #endif
64398 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
64399 ,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
64400 diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
64401 index d4a3574..b421ce9 100644
64402 --- a/fs/proc/nommu.c
64403 +++ b/fs/proc/nommu.c
64404 @@ -64,7 +64,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
64405
64406 if (file) {
64407 seq_pad(m, ' ');
64408 - seq_path(m, &file->f_path, "");
64409 + seq_path(m, &file->f_path, "\n\\");
64410 }
64411
64412 seq_putc(m, '\n');
64413 diff --git a/fs/proc/proc_net.c b/fs/proc/proc_net.c
64414 index 4677bb7..94067cd 100644
64415 --- a/fs/proc/proc_net.c
64416 +++ b/fs/proc/proc_net.c
64417 @@ -23,6 +23,7 @@
64418 #include <linux/nsproxy.h>
64419 #include <net/net_namespace.h>
64420 #include <linux/seq_file.h>
64421 +#include <linux/grsecurity.h>
64422
64423 #include "internal.h"
64424
64425 @@ -36,6 +37,8 @@ static struct net *get_proc_net(const struct inode *inode)
64426 return maybe_get_net(PDE_NET(PDE(inode)));
64427 }
64428
64429 +extern const struct seq_operations dev_seq_ops;
64430 +
64431 int seq_open_net(struct inode *ino, struct file *f,
64432 const struct seq_operations *ops, int size)
64433 {
64434 @@ -44,6 +47,10 @@ int seq_open_net(struct inode *ino, struct file *f,
64435
64436 BUG_ON(size < sizeof(*p));
64437
64438 + /* only permit access to /proc/net/dev */
64439 + if (ops != &dev_seq_ops && gr_proc_is_restricted())
64440 + return -EACCES;
64441 +
64442 net = get_proc_net(ino);
64443 if (net == NULL)
64444 return -ENXIO;
64445 @@ -66,6 +73,9 @@ int single_open_net(struct inode *inode, struct file *file,
64446 int err;
64447 struct net *net;
64448
64449 + if (gr_proc_is_restricted())
64450 + return -EACCES;
64451 +
64452 err = -ENXIO;
64453 net = get_proc_net(inode);
64454 if (net == NULL)
64455 diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
64456 index 7129046..6914844 100644
64457 --- a/fs/proc/proc_sysctl.c
64458 +++ b/fs/proc/proc_sysctl.c
64459 @@ -11,13 +11,21 @@
64460 #include <linux/namei.h>
64461 #include <linux/mm.h>
64462 #include <linux/module.h>
64463 +#include <linux/nsproxy.h>
64464 +#ifdef CONFIG_GRKERNSEC
64465 +#include <net/net_namespace.h>
64466 +#endif
64467 #include "internal.h"
64468
64469 +extern int gr_handle_chroot_sysctl(const int op);
64470 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
64471 + const int op);
64472 +
64473 static const struct dentry_operations proc_sys_dentry_operations;
64474 static const struct file_operations proc_sys_file_operations;
64475 -static const struct inode_operations proc_sys_inode_operations;
64476 +const struct inode_operations proc_sys_inode_operations;
64477 static const struct file_operations proc_sys_dir_file_operations;
64478 -static const struct inode_operations proc_sys_dir_operations;
64479 +const struct inode_operations proc_sys_dir_operations;
64480
64481 void proc_sys_poll_notify(struct ctl_table_poll *poll)
64482 {
64483 @@ -467,6 +475,9 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
64484
64485 err = NULL;
64486 d_set_d_op(dentry, &proc_sys_dentry_operations);
64487 +
64488 + gr_handle_proc_create(dentry, inode);
64489 +
64490 d_add(dentry, inode);
64491
64492 out:
64493 @@ -482,6 +493,7 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
64494 struct inode *inode = file_inode(filp);
64495 struct ctl_table_header *head = grab_header(inode);
64496 struct ctl_table *table = PROC_I(inode)->sysctl_entry;
64497 + int op = write ? MAY_WRITE : MAY_READ;
64498 ssize_t error;
64499 size_t res;
64500
64501 @@ -493,7 +505,7 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
64502 * and won't be until we finish.
64503 */
64504 error = -EPERM;
64505 - if (sysctl_perm(head, table, write ? MAY_WRITE : MAY_READ))
64506 + if (sysctl_perm(head, table, op))
64507 goto out;
64508
64509 /* if that can happen at all, it should be -EINVAL, not -EISDIR */
64510 @@ -501,6 +513,27 @@ static ssize_t proc_sys_call_handler(struct file *filp, void __user *buf,
64511 if (!table->proc_handler)
64512 goto out;
64513
64514 +#ifdef CONFIG_GRKERNSEC
64515 + error = -EPERM;
64516 + if (gr_handle_chroot_sysctl(op))
64517 + goto out;
64518 + dget(filp->f_path.dentry);
64519 + if (gr_handle_sysctl_mod(filp->f_path.dentry->d_parent->d_name.name, table->procname, op)) {
64520 + dput(filp->f_path.dentry);
64521 + goto out;
64522 + }
64523 + dput(filp->f_path.dentry);
64524 + if (!gr_acl_handle_open(filp->f_path.dentry, filp->f_path.mnt, op))
64525 + goto out;
64526 + if (write) {
64527 + if (current->nsproxy->net_ns != table->extra2) {
64528 + if (!capable(CAP_SYS_ADMIN))
64529 + goto out;
64530 + } else if (!ns_capable(current->nsproxy->net_ns->user_ns, CAP_NET_ADMIN))
64531 + goto out;
64532 + }
64533 +#endif
64534 +
64535 /* careful: calling conventions are nasty here */
64536 res = count;
64537 error = table->proc_handler(table, write, buf, &res, ppos);
64538 @@ -598,6 +631,9 @@ static bool proc_sys_fill_cache(struct file *file,
64539 return false;
64540 } else {
64541 d_set_d_op(child, &proc_sys_dentry_operations);
64542 +
64543 + gr_handle_proc_create(child, inode);
64544 +
64545 d_add(child, inode);
64546 }
64547 } else {
64548 @@ -641,6 +677,9 @@ static int scan(struct ctl_table_header *head, ctl_table *table,
64549 if ((*pos)++ < ctx->pos)
64550 return true;
64551
64552 + if (!gr_acl_handle_hidden_file(file->f_path.dentry, file->f_path.mnt))
64553 + return 0;
64554 +
64555 if (unlikely(S_ISLNK(table->mode)))
64556 res = proc_sys_link_fill_cache(file, ctx, head, table);
64557 else
64558 @@ -734,6 +773,9 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
64559 if (IS_ERR(head))
64560 return PTR_ERR(head);
64561
64562 + if (table && !gr_acl_handle_hidden_file(dentry, mnt))
64563 + return -ENOENT;
64564 +
64565 generic_fillattr(inode, stat);
64566 if (table)
64567 stat->mode = (stat->mode & S_IFMT) | table->mode;
64568 @@ -756,13 +798,13 @@ static const struct file_operations proc_sys_dir_file_operations = {
64569 .llseek = generic_file_llseek,
64570 };
64571
64572 -static const struct inode_operations proc_sys_inode_operations = {
64573 +const struct inode_operations proc_sys_inode_operations = {
64574 .permission = proc_sys_permission,
64575 .setattr = proc_sys_setattr,
64576 .getattr = proc_sys_getattr,
64577 };
64578
64579 -static const struct inode_operations proc_sys_dir_operations = {
64580 +const struct inode_operations proc_sys_dir_operations = {
64581 .lookup = proc_sys_lookup,
64582 .permission = proc_sys_permission,
64583 .setattr = proc_sys_setattr,
64584 @@ -839,7 +881,7 @@ static struct ctl_dir *find_subdir(struct ctl_dir *dir,
64585 static struct ctl_dir *new_dir(struct ctl_table_set *set,
64586 const char *name, int namelen)
64587 {
64588 - struct ctl_table *table;
64589 + ctl_table_no_const *table;
64590 struct ctl_dir *new;
64591 struct ctl_node *node;
64592 char *new_name;
64593 @@ -851,7 +893,7 @@ static struct ctl_dir *new_dir(struct ctl_table_set *set,
64594 return NULL;
64595
64596 node = (struct ctl_node *)(new + 1);
64597 - table = (struct ctl_table *)(node + 1);
64598 + table = (ctl_table_no_const *)(node + 1);
64599 new_name = (char *)(table + 2);
64600 memcpy(new_name, name, namelen);
64601 new_name[namelen] = '\0';
64602 @@ -1020,7 +1062,8 @@ static int sysctl_check_table(const char *path, struct ctl_table *table)
64603 static struct ctl_table_header *new_links(struct ctl_dir *dir, struct ctl_table *table,
64604 struct ctl_table_root *link_root)
64605 {
64606 - struct ctl_table *link_table, *entry, *link;
64607 + ctl_table_no_const *link_table, *link;
64608 + struct ctl_table *entry;
64609 struct ctl_table_header *links;
64610 struct ctl_node *node;
64611 char *link_name;
64612 @@ -1043,7 +1086,7 @@ static struct ctl_table_header *new_links(struct ctl_dir *dir, struct ctl_table
64613 return NULL;
64614
64615 node = (struct ctl_node *)(links + 1);
64616 - link_table = (struct ctl_table *)(node + nr_entries);
64617 + link_table = (ctl_table_no_const *)(node + nr_entries);
64618 link_name = (char *)&link_table[nr_entries + 1];
64619
64620 for (link = link_table, entry = table; entry->procname; link++, entry++) {
64621 @@ -1291,8 +1334,8 @@ static int register_leaf_sysctl_tables(const char *path, char *pos,
64622 struct ctl_table_header ***subheader, struct ctl_table_set *set,
64623 struct ctl_table *table)
64624 {
64625 - struct ctl_table *ctl_table_arg = NULL;
64626 - struct ctl_table *entry, *files;
64627 + ctl_table_no_const *ctl_table_arg = NULL, *files = NULL;
64628 + struct ctl_table *entry;
64629 int nr_files = 0;
64630 int nr_dirs = 0;
64631 int err = -ENOMEM;
64632 @@ -1304,10 +1347,9 @@ static int register_leaf_sysctl_tables(const char *path, char *pos,
64633 nr_files++;
64634 }
64635
64636 - files = table;
64637 /* If there are mixed files and directories we need a new table */
64638 if (nr_dirs && nr_files) {
64639 - struct ctl_table *new;
64640 + ctl_table_no_const *new;
64641 files = kzalloc(sizeof(struct ctl_table) * (nr_files + 1),
64642 GFP_KERNEL);
64643 if (!files)
64644 @@ -1325,7 +1367,7 @@ static int register_leaf_sysctl_tables(const char *path, char *pos,
64645 /* Register everything except a directory full of subdirectories */
64646 if (nr_files || !nr_dirs) {
64647 struct ctl_table_header *header;
64648 - header = __register_sysctl_table(set, path, files);
64649 + header = __register_sysctl_table(set, path, files ? files : table);
64650 if (!header) {
64651 kfree(ctl_table_arg);
64652 goto out;
64653 diff --git a/fs/proc/root.c b/fs/proc/root.c
64654 index 87dbcbe..55e1b4d 100644
64655 --- a/fs/proc/root.c
64656 +++ b/fs/proc/root.c
64657 @@ -186,7 +186,15 @@ void __init proc_root_init(void)
64658 #ifdef CONFIG_PROC_DEVICETREE
64659 proc_device_tree_init();
64660 #endif
64661 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
64662 +#ifdef CONFIG_GRKERNSEC_PROC_USER
64663 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
64664 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64665 + proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
64666 +#endif
64667 +#else
64668 proc_mkdir("bus", NULL);
64669 +#endif
64670 proc_sys_init();
64671 }
64672
64673 diff --git a/fs/proc/stat.c b/fs/proc/stat.c
64674 index 6f599c6..bd00271 100644
64675 --- a/fs/proc/stat.c
64676 +++ b/fs/proc/stat.c
64677 @@ -11,6 +11,7 @@
64678 #include <linux/irqnr.h>
64679 #include <asm/cputime.h>
64680 #include <linux/tick.h>
64681 +#include <linux/grsecurity.h>
64682
64683 #ifndef arch_irq_stat_cpu
64684 #define arch_irq_stat_cpu(cpu) 0
64685 @@ -87,6 +88,18 @@ static int show_stat(struct seq_file *p, void *v)
64686 u64 sum_softirq = 0;
64687 unsigned int per_softirq_sums[NR_SOFTIRQS] = {0};
64688 struct timespec boottime;
64689 + int unrestricted = 1;
64690 +
64691 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
64692 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
64693 + if (!uid_eq(current_uid(), GLOBAL_ROOT_UID)
64694 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
64695 + && !in_group_p(grsec_proc_gid)
64696 +#endif
64697 + )
64698 + unrestricted = 0;
64699 +#endif
64700 +#endif
64701
64702 user = nice = system = idle = iowait =
64703 irq = softirq = steal = 0;
64704 @@ -99,23 +112,25 @@ static int show_stat(struct seq_file *p, void *v)
64705 nice += kcpustat_cpu(i).cpustat[CPUTIME_NICE];
64706 system += kcpustat_cpu(i).cpustat[CPUTIME_SYSTEM];
64707 idle += get_idle_time(i);
64708 - iowait += get_iowait_time(i);
64709 - irq += kcpustat_cpu(i).cpustat[CPUTIME_IRQ];
64710 - softirq += kcpustat_cpu(i).cpustat[CPUTIME_SOFTIRQ];
64711 - steal += kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
64712 - guest += kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
64713 - guest_nice += kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
64714 - sum += kstat_cpu_irqs_sum(i);
64715 - sum += arch_irq_stat_cpu(i);
64716 + if (unrestricted) {
64717 + iowait += get_iowait_time(i);
64718 + irq += kcpustat_cpu(i).cpustat[CPUTIME_IRQ];
64719 + softirq += kcpustat_cpu(i).cpustat[CPUTIME_SOFTIRQ];
64720 + steal += kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
64721 + guest += kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
64722 + guest_nice += kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
64723 + sum += kstat_cpu_irqs_sum(i);
64724 + sum += arch_irq_stat_cpu(i);
64725 + for (j = 0; j < NR_SOFTIRQS; j++) {
64726 + unsigned int softirq_stat = kstat_softirqs_cpu(j, i);
64727
64728 - for (j = 0; j < NR_SOFTIRQS; j++) {
64729 - unsigned int softirq_stat = kstat_softirqs_cpu(j, i);
64730 -
64731 - per_softirq_sums[j] += softirq_stat;
64732 - sum_softirq += softirq_stat;
64733 + per_softirq_sums[j] += softirq_stat;
64734 + sum_softirq += softirq_stat;
64735 + }
64736 }
64737 }
64738 - sum += arch_irq_stat();
64739 + if (unrestricted)
64740 + sum += arch_irq_stat();
64741
64742 seq_puts(p, "cpu ");
64743 seq_put_decimal_ull(p, ' ', cputime64_to_clock_t(user));
64744 @@ -136,12 +151,14 @@ static int show_stat(struct seq_file *p, void *v)
64745 nice = kcpustat_cpu(i).cpustat[CPUTIME_NICE];
64746 system = kcpustat_cpu(i).cpustat[CPUTIME_SYSTEM];
64747 idle = get_idle_time(i);
64748 - iowait = get_iowait_time(i);
64749 - irq = kcpustat_cpu(i).cpustat[CPUTIME_IRQ];
64750 - softirq = kcpustat_cpu(i).cpustat[CPUTIME_SOFTIRQ];
64751 - steal = kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
64752 - guest = kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
64753 - guest_nice = kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
64754 + if (unrestricted) {
64755 + iowait = get_iowait_time(i);
64756 + irq = kcpustat_cpu(i).cpustat[CPUTIME_IRQ];
64757 + softirq = kcpustat_cpu(i).cpustat[CPUTIME_SOFTIRQ];
64758 + steal = kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
64759 + guest = kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
64760 + guest_nice = kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
64761 + }
64762 seq_printf(p, "cpu%d", i);
64763 seq_put_decimal_ull(p, ' ', cputime64_to_clock_t(user));
64764 seq_put_decimal_ull(p, ' ', cputime64_to_clock_t(nice));
64765 @@ -159,7 +176,7 @@ static int show_stat(struct seq_file *p, void *v)
64766
64767 /* sum again ? it could be updated? */
64768 for_each_irq_nr(j)
64769 - seq_put_decimal_ull(p, ' ', kstat_irqs(j));
64770 + seq_put_decimal_ull(p, ' ', unrestricted ? kstat_irqs(j) : 0ULL);
64771
64772 seq_printf(p,
64773 "\nctxt %llu\n"
64774 @@ -167,11 +184,11 @@ static int show_stat(struct seq_file *p, void *v)
64775 "processes %lu\n"
64776 "procs_running %lu\n"
64777 "procs_blocked %lu\n",
64778 - nr_context_switches(),
64779 + unrestricted ? nr_context_switches() : 0ULL,
64780 (unsigned long)jif,
64781 - total_forks,
64782 - nr_running(),
64783 - nr_iowait());
64784 + unrestricted ? total_forks : 0UL,
64785 + unrestricted ? nr_running() : 0UL,
64786 + unrestricted ? nr_iowait() : 0UL);
64787
64788 seq_printf(p, "softirq %llu", (unsigned long long)sum_softirq);
64789
64790 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
64791 index fb52b54..5fc7c14 100644
64792 --- a/fs/proc/task_mmu.c
64793 +++ b/fs/proc/task_mmu.c
64794 @@ -12,12 +12,19 @@
64795 #include <linux/swap.h>
64796 #include <linux/swapops.h>
64797 #include <linux/mmu_notifier.h>
64798 +#include <linux/grsecurity.h>
64799
64800 #include <asm/elf.h>
64801 #include <asm/uaccess.h>
64802 #include <asm/tlbflush.h>
64803 #include "internal.h"
64804
64805 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64806 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
64807 + (_mm->pax_flags & MF_PAX_RANDMMAP || \
64808 + _mm->pax_flags & MF_PAX_SEGMEXEC))
64809 +#endif
64810 +
64811 void task_mem(struct seq_file *m, struct mm_struct *mm)
64812 {
64813 unsigned long data, text, lib, swap;
64814 @@ -53,8 +60,13 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
64815 "VmExe:\t%8lu kB\n"
64816 "VmLib:\t%8lu kB\n"
64817 "VmPTE:\t%8lu kB\n"
64818 - "VmSwap:\t%8lu kB\n",
64819 - hiwater_vm << (PAGE_SHIFT-10),
64820 + "VmSwap:\t%8lu kB\n"
64821 +
64822 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
64823 + "CsBase:\t%8lx\nCsLim:\t%8lx\n"
64824 +#endif
64825 +
64826 + ,hiwater_vm << (PAGE_SHIFT-10),
64827 total_vm << (PAGE_SHIFT-10),
64828 mm->locked_vm << (PAGE_SHIFT-10),
64829 mm->pinned_vm << (PAGE_SHIFT-10),
64830 @@ -64,7 +76,19 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
64831 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
64832 (PTRS_PER_PTE * sizeof(pte_t) *
64833 atomic_long_read(&mm->nr_ptes)) >> 10,
64834 - swap << (PAGE_SHIFT-10));
64835 + swap << (PAGE_SHIFT-10)
64836 +
64837 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
64838 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64839 + , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_base
64840 + , PAX_RAND_FLAGS(mm) ? 0 : mm->context.user_cs_limit
64841 +#else
64842 + , mm->context.user_cs_base
64843 + , mm->context.user_cs_limit
64844 +#endif
64845 +#endif
64846 +
64847 + );
64848 }
64849
64850 unsigned long task_vsize(struct mm_struct *mm)
64851 @@ -270,13 +294,13 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
64852 pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
64853 }
64854
64855 - /* We don't show the stack guard page in /proc/maps */
64856 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64857 + start = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start;
64858 + end = PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end;
64859 +#else
64860 start = vma->vm_start;
64861 - if (stack_guard_page_start(vma, start))
64862 - start += PAGE_SIZE;
64863 end = vma->vm_end;
64864 - if (stack_guard_page_end(vma, end))
64865 - end -= PAGE_SIZE;
64866 +#endif
64867
64868 seq_setwidth(m, 25 + sizeof(void *) * 6 - 1);
64869 seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ",
64870 @@ -286,7 +310,11 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
64871 flags & VM_WRITE ? 'w' : '-',
64872 flags & VM_EXEC ? 'x' : '-',
64873 flags & VM_MAYSHARE ? 's' : 'p',
64874 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64875 + PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
64876 +#else
64877 pgoff,
64878 +#endif
64879 MAJOR(dev), MINOR(dev), ino);
64880
64881 /*
64882 @@ -295,7 +323,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
64883 */
64884 if (file) {
64885 seq_pad(m, ' ');
64886 - seq_path(m, &file->f_path, "\n");
64887 + seq_path(m, &file->f_path, "\n\\");
64888 goto done;
64889 }
64890
64891 @@ -321,8 +349,9 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
64892 * Thread stack in /proc/PID/task/TID/maps or
64893 * the main process stack.
64894 */
64895 - if (!is_pid || (vma->vm_start <= mm->start_stack &&
64896 - vma->vm_end >= mm->start_stack)) {
64897 + if (!is_pid || (vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
64898 + (vma->vm_start <= mm->start_stack &&
64899 + vma->vm_end >= mm->start_stack)) {
64900 name = "[stack]";
64901 } else {
64902 /* Thread stack in /proc/PID/maps */
64903 @@ -346,6 +375,13 @@ static int show_map(struct seq_file *m, void *v, int is_pid)
64904 struct proc_maps_private *priv = m->private;
64905 struct task_struct *task = priv->task;
64906
64907 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64908 + if (current->exec_id != m->exec_id) {
64909 + gr_log_badprocpid("maps");
64910 + return 0;
64911 + }
64912 +#endif
64913 +
64914 show_map_vma(m, vma, is_pid);
64915
64916 if (m->count < m->size) /* vma is copied successfully */
64917 @@ -586,12 +622,23 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
64918 .private = &mss,
64919 };
64920
64921 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64922 + if (current->exec_id != m->exec_id) {
64923 + gr_log_badprocpid("smaps");
64924 + return 0;
64925 + }
64926 +#endif
64927 memset(&mss, 0, sizeof mss);
64928 - mss.vma = vma;
64929 - /* mmap_sem is held in m_start */
64930 - if (vma->vm_mm && !is_vm_hugetlb_page(vma))
64931 - walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
64932 -
64933 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64934 + if (!PAX_RAND_FLAGS(vma->vm_mm)) {
64935 +#endif
64936 + mss.vma = vma;
64937 + /* mmap_sem is held in m_start */
64938 + if (vma->vm_mm && !is_vm_hugetlb_page(vma))
64939 + walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
64940 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64941 + }
64942 +#endif
64943 show_map_vma(m, vma, is_pid);
64944
64945 seq_printf(m,
64946 @@ -609,7 +656,11 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
64947 "KernelPageSize: %8lu kB\n"
64948 "MMUPageSize: %8lu kB\n"
64949 "Locked: %8lu kB\n",
64950 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64951 + PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
64952 +#else
64953 (vma->vm_end - vma->vm_start) >> 10,
64954 +#endif
64955 mss.resident >> 10,
64956 (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
64957 mss.shared_clean >> 10,
64958 @@ -1387,6 +1438,13 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
64959 char buffer[64];
64960 int nid;
64961
64962 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64963 + if (current->exec_id != m->exec_id) {
64964 + gr_log_badprocpid("numa_maps");
64965 + return 0;
64966 + }
64967 +#endif
64968 +
64969 if (!mm)
64970 return 0;
64971
64972 @@ -1404,11 +1462,15 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
64973 mpol_to_str(buffer, sizeof(buffer), pol);
64974 mpol_cond_put(pol);
64975
64976 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
64977 + seq_printf(m, "%08lx %s", PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : vma->vm_start, buffer);
64978 +#else
64979 seq_printf(m, "%08lx %s", vma->vm_start, buffer);
64980 +#endif
64981
64982 if (file) {
64983 seq_printf(m, " file=");
64984 - seq_path(m, &file->f_path, "\n\t= ");
64985 + seq_path(m, &file->f_path, "\n\t\\= ");
64986 } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
64987 seq_printf(m, " heap");
64988 } else {
64989 diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
64990 index 678455d..ebd3245 100644
64991 --- a/fs/proc/task_nommu.c
64992 +++ b/fs/proc/task_nommu.c
64993 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct mm_struct *mm)
64994 else
64995 bytes += kobjsize(mm);
64996
64997 - if (current->fs && current->fs->users > 1)
64998 + if (current->fs && atomic_read(&current->fs->users) > 1)
64999 sbytes += kobjsize(current->fs);
65000 else
65001 bytes += kobjsize(current->fs);
65002 @@ -161,7 +161,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
65003
65004 if (file) {
65005 seq_pad(m, ' ');
65006 - seq_path(m, &file->f_path, "");
65007 + seq_path(m, &file->f_path, "\n\\");
65008 } else if (mm) {
65009 pid_t tid = vm_is_stack(priv->task, vma, is_pid);
65010
65011 diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
65012 index 88d4585..c10bfeb 100644
65013 --- a/fs/proc/vmcore.c
65014 +++ b/fs/proc/vmcore.c
65015 @@ -105,9 +105,13 @@ static ssize_t read_from_oldmem(char *buf, size_t count,
65016 nr_bytes = count;
65017
65018 /* If pfn is not ram, return zeros for sparse dump files */
65019 - if (pfn_is_ram(pfn) == 0)
65020 - memset(buf, 0, nr_bytes);
65021 - else {
65022 + if (pfn_is_ram(pfn) == 0) {
65023 + if (userbuf) {
65024 + if (clear_user((char __force_user *)buf, nr_bytes))
65025 + return -EFAULT;
65026 + } else
65027 + memset(buf, 0, nr_bytes);
65028 + } else {
65029 tmp = copy_oldmem_page(pfn, buf, nr_bytes,
65030 offset, userbuf);
65031 if (tmp < 0)
65032 @@ -170,7 +174,7 @@ int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma,
65033 static int copy_to(void *target, void *src, size_t size, int userbuf)
65034 {
65035 if (userbuf) {
65036 - if (copy_to_user((char __user *) target, src, size))
65037 + if (copy_to_user((char __force_user *) target, src, size))
65038 return -EFAULT;
65039 } else {
65040 memcpy(target, src, size);
65041 @@ -233,7 +237,7 @@ static ssize_t __read_vmcore(char *buffer, size_t buflen, loff_t *fpos,
65042 if (*fpos < m->offset + m->size) {
65043 tsz = min_t(size_t, m->offset + m->size - *fpos, buflen);
65044 start = m->paddr + *fpos - m->offset;
65045 - tmp = read_from_oldmem(buffer, tsz, &start, userbuf);
65046 + tmp = read_from_oldmem((char __force_kernel *)buffer, tsz, &start, userbuf);
65047 if (tmp < 0)
65048 return tmp;
65049 buflen -= tsz;
65050 @@ -253,7 +257,7 @@ static ssize_t __read_vmcore(char *buffer, size_t buflen, loff_t *fpos,
65051 static ssize_t read_vmcore(struct file *file, char __user *buffer,
65052 size_t buflen, loff_t *fpos)
65053 {
65054 - return __read_vmcore((__force char *) buffer, buflen, fpos, 1);
65055 + return __read_vmcore((__force_kernel char *) buffer, buflen, fpos, 1);
65056 }
65057
65058 /*
65059 diff --git a/fs/qnx6/qnx6.h b/fs/qnx6/qnx6.h
65060 index b00fcc9..e0c6381 100644
65061 --- a/fs/qnx6/qnx6.h
65062 +++ b/fs/qnx6/qnx6.h
65063 @@ -74,7 +74,7 @@ enum {
65064 BYTESEX_BE,
65065 };
65066
65067 -static inline __u64 fs64_to_cpu(struct qnx6_sb_info *sbi, __fs64 n)
65068 +static inline __u64 __intentional_overflow(-1) fs64_to_cpu(struct qnx6_sb_info *sbi, __fs64 n)
65069 {
65070 if (sbi->s_bytesex == BYTESEX_LE)
65071 return le64_to_cpu((__force __le64)n);
65072 @@ -90,7 +90,7 @@ static inline __fs64 cpu_to_fs64(struct qnx6_sb_info *sbi, __u64 n)
65073 return (__force __fs64)cpu_to_be64(n);
65074 }
65075
65076 -static inline __u32 fs32_to_cpu(struct qnx6_sb_info *sbi, __fs32 n)
65077 +static inline __u32 __intentional_overflow(-1) fs32_to_cpu(struct qnx6_sb_info *sbi, __fs32 n)
65078 {
65079 if (sbi->s_bytesex == BYTESEX_LE)
65080 return le32_to_cpu((__force __le32)n);
65081 diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c
65082 index 72d2917..c917c12 100644
65083 --- a/fs/quota/netlink.c
65084 +++ b/fs/quota/netlink.c
65085 @@ -45,7 +45,7 @@ static struct genl_family quota_genl_family = {
65086 void quota_send_warning(struct kqid qid, dev_t dev,
65087 const char warntype)
65088 {
65089 - static atomic_t seq;
65090 + static atomic_unchecked_t seq;
65091 struct sk_buff *skb;
65092 void *msg_head;
65093 int ret;
65094 @@ -61,7 +61,7 @@ void quota_send_warning(struct kqid qid, dev_t dev,
65095 "VFS: Not enough memory to send quota warning.\n");
65096 return;
65097 }
65098 - msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
65099 + msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
65100 &quota_genl_family, 0, QUOTA_NL_C_WARNING);
65101 if (!msg_head) {
65102 printk(KERN_ERR
65103 diff --git a/fs/read_write.c b/fs/read_write.c
65104 index 28cc9c8..208e4fb 100644
65105 --- a/fs/read_write.c
65106 +++ b/fs/read_write.c
65107 @@ -450,7 +450,7 @@ ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t
65108
65109 old_fs = get_fs();
65110 set_fs(get_ds());
65111 - p = (__force const char __user *)buf;
65112 + p = (const char __force_user *)buf;
65113 if (count > MAX_RW_COUNT)
65114 count = MAX_RW_COUNT;
65115 if (file->f_op->write)
65116 diff --git a/fs/readdir.c b/fs/readdir.c
65117 index 5b53d99..a6c3049 100644
65118 --- a/fs/readdir.c
65119 +++ b/fs/readdir.c
65120 @@ -17,6 +17,7 @@
65121 #include <linux/security.h>
65122 #include <linux/syscalls.h>
65123 #include <linux/unistd.h>
65124 +#include <linux/namei.h>
65125
65126 #include <asm/uaccess.h>
65127
65128 @@ -69,6 +70,7 @@ struct old_linux_dirent {
65129 struct readdir_callback {
65130 struct dir_context ctx;
65131 struct old_linux_dirent __user * dirent;
65132 + struct file * file;
65133 int result;
65134 };
65135
65136 @@ -86,6 +88,10 @@ static int fillonedir(void * __buf, const char * name, int namlen, loff_t offset
65137 buf->result = -EOVERFLOW;
65138 return -EOVERFLOW;
65139 }
65140 +
65141 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
65142 + return 0;
65143 +
65144 buf->result++;
65145 dirent = buf->dirent;
65146 if (!access_ok(VERIFY_WRITE, dirent,
65147 @@ -117,6 +123,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned int, fd,
65148 if (!f.file)
65149 return -EBADF;
65150
65151 + buf.file = f.file;
65152 error = iterate_dir(f.file, &buf.ctx);
65153 if (buf.result)
65154 error = buf.result;
65155 @@ -142,6 +149,7 @@ struct getdents_callback {
65156 struct dir_context ctx;
65157 struct linux_dirent __user * current_dir;
65158 struct linux_dirent __user * previous;
65159 + struct file * file;
65160 int count;
65161 int error;
65162 };
65163 @@ -163,6 +171,10 @@ static int filldir(void * __buf, const char * name, int namlen, loff_t offset,
65164 buf->error = -EOVERFLOW;
65165 return -EOVERFLOW;
65166 }
65167 +
65168 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
65169 + return 0;
65170 +
65171 dirent = buf->previous;
65172 if (dirent) {
65173 if (__put_user(offset, &dirent->d_off))
65174 @@ -208,6 +220,7 @@ SYSCALL_DEFINE3(getdents, unsigned int, fd,
65175 if (!f.file)
65176 return -EBADF;
65177
65178 + buf.file = f.file;
65179 error = iterate_dir(f.file, &buf.ctx);
65180 if (error >= 0)
65181 error = buf.error;
65182 @@ -226,6 +239,7 @@ struct getdents_callback64 {
65183 struct dir_context ctx;
65184 struct linux_dirent64 __user * current_dir;
65185 struct linux_dirent64 __user * previous;
65186 + struct file *file;
65187 int count;
65188 int error;
65189 };
65190 @@ -241,6 +255,10 @@ static int filldir64(void * __buf, const char * name, int namlen, loff_t offset,
65191 buf->error = -EINVAL; /* only used if we fail.. */
65192 if (reclen > buf->count)
65193 return -EINVAL;
65194 +
65195 + if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
65196 + return 0;
65197 +
65198 dirent = buf->previous;
65199 if (dirent) {
65200 if (__put_user(offset, &dirent->d_off))
65201 @@ -288,6 +306,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int, fd,
65202 if (!f.file)
65203 return -EBADF;
65204
65205 + buf.file = f.file;
65206 error = iterate_dir(f.file, &buf.ctx);
65207 if (error >= 0)
65208 error = buf.error;
65209 diff --git a/fs/reiserfs/do_balan.c b/fs/reiserfs/do_balan.c
65210 index 9a3c68c..767933e 100644
65211 --- a/fs/reiserfs/do_balan.c
65212 +++ b/fs/reiserfs/do_balan.c
65213 @@ -1546,7 +1546,7 @@ void do_balance(struct tree_balance *tb, /* tree_balance structure */
65214 return;
65215 }
65216
65217 - atomic_inc(&(fs_generation(tb->tb_sb)));
65218 + atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
65219 do_balance_starts(tb);
65220
65221 /* balance leaf returns 0 except if combining L R and S into
65222 diff --git a/fs/reiserfs/item_ops.c b/fs/reiserfs/item_ops.c
65223 index ee382ef..f4eb6eb5 100644
65224 --- a/fs/reiserfs/item_ops.c
65225 +++ b/fs/reiserfs/item_ops.c
65226 @@ -725,18 +725,18 @@ static void errcatch_print_vi(struct virtual_item *vi)
65227 }
65228
65229 static struct item_operations errcatch_ops = {
65230 - errcatch_bytes_number,
65231 - errcatch_decrement_key,
65232 - errcatch_is_left_mergeable,
65233 - errcatch_print_item,
65234 - errcatch_check_item,
65235 + .bytes_number = errcatch_bytes_number,
65236 + .decrement_key = errcatch_decrement_key,
65237 + .is_left_mergeable = errcatch_is_left_mergeable,
65238 + .print_item = errcatch_print_item,
65239 + .check_item = errcatch_check_item,
65240
65241 - errcatch_create_vi,
65242 - errcatch_check_left,
65243 - errcatch_check_right,
65244 - errcatch_part_size,
65245 - errcatch_unit_num,
65246 - errcatch_print_vi
65247 + .create_vi = errcatch_create_vi,
65248 + .check_left = errcatch_check_left,
65249 + .check_right = errcatch_check_right,
65250 + .part_size = errcatch_part_size,
65251 + .unit_num = errcatch_unit_num,
65252 + .print_vi = errcatch_print_vi
65253 };
65254
65255 //////////////////////////////////////////////////////////////////////////////
65256 diff --git a/fs/reiserfs/procfs.c b/fs/reiserfs/procfs.c
65257 index 02b0b7d..c85018b 100644
65258 --- a/fs/reiserfs/procfs.c
65259 +++ b/fs/reiserfs/procfs.c
65260 @@ -114,7 +114,7 @@ static int show_super(struct seq_file *m, void *unused)
65261 "SMALL_TAILS " : "NO_TAILS ",
65262 replay_only(sb) ? "REPLAY_ONLY " : "",
65263 convert_reiserfs(sb) ? "CONV " : "",
65264 - atomic_read(&r->s_generation_counter),
65265 + atomic_read_unchecked(&r->s_generation_counter),
65266 SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
65267 SF(s_do_balance), SF(s_unneeded_left_neighbor),
65268 SF(s_good_search_by_key_reada), SF(s_bmaps),
65269 diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
65270 index 8d06adf..7e1c9f8 100644
65271 --- a/fs/reiserfs/reiserfs.h
65272 +++ b/fs/reiserfs/reiserfs.h
65273 @@ -453,7 +453,7 @@ struct reiserfs_sb_info {
65274 /* Comment? -Hans */
65275 wait_queue_head_t s_wait;
65276 /* To be obsoleted soon by per buffer seals.. -Hans */
65277 - atomic_t s_generation_counter; // increased by one every time the
65278 + atomic_unchecked_t s_generation_counter; // increased by one every time the
65279 // tree gets re-balanced
65280 unsigned long s_properties; /* File system properties. Currently holds
65281 on-disk FS format */
65282 @@ -1972,7 +1972,7 @@ static inline loff_t max_reiserfs_offset(struct inode *inode)
65283 #define REISERFS_USER_MEM 1 /* reiserfs user memory mode */
65284
65285 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
65286 -#define get_generation(s) atomic_read (&fs_generation(s))
65287 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
65288 #define FILESYSTEM_CHANGED_TB(tb) (get_generation((tb)->tb_sb) != (tb)->fs_gen)
65289 #define __fs_changed(gen,s) (gen != get_generation (s))
65290 #define fs_changed(gen,s) \
65291 diff --git a/fs/select.c b/fs/select.c
65292 index 467bb1c..cf9d65a 100644
65293 --- a/fs/select.c
65294 +++ b/fs/select.c
65295 @@ -20,6 +20,7 @@
65296 #include <linux/export.h>
65297 #include <linux/slab.h>
65298 #include <linux/poll.h>
65299 +#include <linux/security.h>
65300 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
65301 #include <linux/file.h>
65302 #include <linux/fdtable.h>
65303 @@ -880,6 +881,7 @@ int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
65304 struct poll_list *walk = head;
65305 unsigned long todo = nfds;
65306
65307 + gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
65308 if (nfds > rlimit(RLIMIT_NOFILE))
65309 return -EINVAL;
65310
65311 diff --git a/fs/seq_file.c b/fs/seq_file.c
65312 index 1d641bb..c2f4743 100644
65313 --- a/fs/seq_file.c
65314 +++ b/fs/seq_file.c
65315 @@ -10,6 +10,8 @@
65316 #include <linux/seq_file.h>
65317 #include <linux/slab.h>
65318 #include <linux/cred.h>
65319 +#include <linux/sched.h>
65320 +#include <linux/grsecurity.h>
65321
65322 #include <asm/uaccess.h>
65323 #include <asm/page.h>
65324 @@ -60,6 +62,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
65325 #ifdef CONFIG_USER_NS
65326 p->user_ns = file->f_cred->user_ns;
65327 #endif
65328 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
65329 + p->exec_id = current->exec_id;
65330 +#endif
65331
65332 /*
65333 * Wrappers around seq_open(e.g. swaps_open) need to be
65334 @@ -82,6 +87,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
65335 }
65336 EXPORT_SYMBOL(seq_open);
65337
65338 +
65339 +int seq_open_restrict(struct file *file, const struct seq_operations *op)
65340 +{
65341 + if (gr_proc_is_restricted())
65342 + return -EACCES;
65343 +
65344 + return seq_open(file, op);
65345 +}
65346 +EXPORT_SYMBOL(seq_open_restrict);
65347 +
65348 static int traverse(struct seq_file *m, loff_t offset)
65349 {
65350 loff_t pos = 0, index;
65351 @@ -96,7 +111,7 @@ static int traverse(struct seq_file *m, loff_t offset)
65352 return 0;
65353 }
65354 if (!m->buf) {
65355 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
65356 + m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
65357 if (!m->buf)
65358 return -ENOMEM;
65359 }
65360 @@ -137,7 +152,7 @@ Eoverflow:
65361 m->op->stop(m, p);
65362 kfree(m->buf);
65363 m->count = 0;
65364 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
65365 + m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
65366 return !m->buf ? -ENOMEM : -EAGAIN;
65367 }
65368
65369 @@ -153,7 +168,7 @@ Eoverflow:
65370 ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
65371 {
65372 struct seq_file *m = file->private_data;
65373 - size_t copied = 0;
65374 + ssize_t copied = 0;
65375 loff_t pos;
65376 size_t n;
65377 void *p;
65378 @@ -192,7 +207,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
65379
65380 /* grab buffer if we didn't have one */
65381 if (!m->buf) {
65382 - m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
65383 + m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL | GFP_USERCOPY);
65384 if (!m->buf)
65385 goto Enomem;
65386 }
65387 @@ -234,7 +249,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
65388 m->op->stop(m, p);
65389 kfree(m->buf);
65390 m->count = 0;
65391 - m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
65392 + m->buf = kmalloc(m->size <<= 1, GFP_KERNEL | GFP_USERCOPY);
65393 if (!m->buf)
65394 goto Enomem;
65395 m->version = 0;
65396 @@ -584,7 +599,7 @@ static void single_stop(struct seq_file *p, void *v)
65397 int single_open(struct file *file, int (*show)(struct seq_file *, void *),
65398 void *data)
65399 {
65400 - struct seq_operations *op = kmalloc(sizeof(*op), GFP_KERNEL);
65401 + seq_operations_no_const *op = kzalloc(sizeof(*op), GFP_KERNEL);
65402 int res = -ENOMEM;
65403
65404 if (op) {
65405 @@ -620,6 +635,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
65406 }
65407 EXPORT_SYMBOL(single_open_size);
65408
65409 +int single_open_restrict(struct file *file, int (*show)(struct seq_file *, void *),
65410 + void *data)
65411 +{
65412 + if (gr_proc_is_restricted())
65413 + return -EACCES;
65414 +
65415 + return single_open(file, show, data);
65416 +}
65417 +EXPORT_SYMBOL(single_open_restrict);
65418 +
65419 +
65420 int single_release(struct inode *inode, struct file *file)
65421 {
65422 const struct seq_operations *op = ((struct seq_file *)file->private_data)->op;
65423 diff --git a/fs/splice.c b/fs/splice.c
65424 index 12028fa..a6f2619 100644
65425 --- a/fs/splice.c
65426 +++ b/fs/splice.c
65427 @@ -196,7 +196,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
65428 pipe_lock(pipe);
65429
65430 for (;;) {
65431 - if (!pipe->readers) {
65432 + if (!atomic_read(&pipe->readers)) {
65433 send_sig(SIGPIPE, current, 0);
65434 if (!ret)
65435 ret = -EPIPE;
65436 @@ -219,7 +219,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
65437 page_nr++;
65438 ret += buf->len;
65439
65440 - if (pipe->files)
65441 + if (atomic_read(&pipe->files))
65442 do_wakeup = 1;
65443
65444 if (!--spd->nr_pages)
65445 @@ -250,9 +250,9 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe,
65446 do_wakeup = 0;
65447 }
65448
65449 - pipe->waiting_writers++;
65450 + atomic_inc(&pipe->waiting_writers);
65451 pipe_wait(pipe);
65452 - pipe->waiting_writers--;
65453 + atomic_dec(&pipe->waiting_writers);
65454 }
65455
65456 pipe_unlock(pipe);
65457 @@ -583,7 +583,7 @@ static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
65458 old_fs = get_fs();
65459 set_fs(get_ds());
65460 /* The cast to a user pointer is valid due to the set_fs() */
65461 - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
65462 + res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos);
65463 set_fs(old_fs);
65464
65465 return res;
65466 @@ -598,7 +598,7 @@ ssize_t kernel_write(struct file *file, const char *buf, size_t count,
65467 old_fs = get_fs();
65468 set_fs(get_ds());
65469 /* The cast to a user pointer is valid due to the set_fs() */
65470 - res = vfs_write(file, (__force const char __user *)buf, count, &pos);
65471 + res = vfs_write(file, (const char __force_user *)buf, count, &pos);
65472 set_fs(old_fs);
65473
65474 return res;
65475 @@ -651,7 +651,7 @@ ssize_t default_file_splice_read(struct file *in, loff_t *ppos,
65476 goto err;
65477
65478 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
65479 - vec[i].iov_base = (void __user *) page_address(page);
65480 + vec[i].iov_base = (void __force_user *) page_address(page);
65481 vec[i].iov_len = this_len;
65482 spd.pages[i] = page;
65483 spd.nr_pages++;
65484 @@ -847,7 +847,7 @@ int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_desc *sd,
65485 ops->release(pipe, buf);
65486 pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
65487 pipe->nrbufs--;
65488 - if (pipe->files)
65489 + if (atomic_read(&pipe->files))
65490 sd->need_wakeup = true;
65491 }
65492
65493 @@ -872,10 +872,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
65494 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
65495 {
65496 while (!pipe->nrbufs) {
65497 - if (!pipe->writers)
65498 + if (!atomic_read(&pipe->writers))
65499 return 0;
65500
65501 - if (!pipe->waiting_writers && sd->num_spliced)
65502 + if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
65503 return 0;
65504
65505 if (sd->flags & SPLICE_F_NONBLOCK)
65506 @@ -1197,7 +1197,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
65507 * out of the pipe right after the splice_to_pipe(). So set
65508 * PIPE_READERS appropriately.
65509 */
65510 - pipe->readers = 1;
65511 + atomic_set(&pipe->readers, 1);
65512
65513 current->splice_pipe = pipe;
65514 }
65515 @@ -1493,6 +1493,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
65516
65517 partial[buffers].offset = off;
65518 partial[buffers].len = plen;
65519 + partial[buffers].private = 0;
65520
65521 off = 0;
65522 len -= plen;
65523 @@ -1795,9 +1796,9 @@ static int ipipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
65524 ret = -ERESTARTSYS;
65525 break;
65526 }
65527 - if (!pipe->writers)
65528 + if (!atomic_read(&pipe->writers))
65529 break;
65530 - if (!pipe->waiting_writers) {
65531 + if (!atomic_read(&pipe->waiting_writers)) {
65532 if (flags & SPLICE_F_NONBLOCK) {
65533 ret = -EAGAIN;
65534 break;
65535 @@ -1829,7 +1830,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
65536 pipe_lock(pipe);
65537
65538 while (pipe->nrbufs >= pipe->buffers) {
65539 - if (!pipe->readers) {
65540 + if (!atomic_read(&pipe->readers)) {
65541 send_sig(SIGPIPE, current, 0);
65542 ret = -EPIPE;
65543 break;
65544 @@ -1842,9 +1843,9 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags)
65545 ret = -ERESTARTSYS;
65546 break;
65547 }
65548 - pipe->waiting_writers++;
65549 + atomic_inc(&pipe->waiting_writers);
65550 pipe_wait(pipe);
65551 - pipe->waiting_writers--;
65552 + atomic_dec(&pipe->waiting_writers);
65553 }
65554
65555 pipe_unlock(pipe);
65556 @@ -1880,14 +1881,14 @@ retry:
65557 pipe_double_lock(ipipe, opipe);
65558
65559 do {
65560 - if (!opipe->readers) {
65561 + if (!atomic_read(&opipe->readers)) {
65562 send_sig(SIGPIPE, current, 0);
65563 if (!ret)
65564 ret = -EPIPE;
65565 break;
65566 }
65567
65568 - if (!ipipe->nrbufs && !ipipe->writers)
65569 + if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
65570 break;
65571
65572 /*
65573 @@ -1984,7 +1985,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
65574 pipe_double_lock(ipipe, opipe);
65575
65576 do {
65577 - if (!opipe->readers) {
65578 + if (!atomic_read(&opipe->readers)) {
65579 send_sig(SIGPIPE, current, 0);
65580 if (!ret)
65581 ret = -EPIPE;
65582 @@ -2029,7 +2030,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
65583 * return EAGAIN if we have the potential of some data in the
65584 * future, otherwise just return 0
65585 */
65586 - if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
65587 + if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
65588 ret = -EAGAIN;
65589
65590 pipe_unlock(ipipe);
65591 diff --git a/fs/stat.c b/fs/stat.c
65592 index ae0c3ce..9ee641c 100644
65593 --- a/fs/stat.c
65594 +++ b/fs/stat.c
65595 @@ -28,8 +28,13 @@ void generic_fillattr(struct inode *inode, struct kstat *stat)
65596 stat->gid = inode->i_gid;
65597 stat->rdev = inode->i_rdev;
65598 stat->size = i_size_read(inode);
65599 - stat->atime = inode->i_atime;
65600 - stat->mtime = inode->i_mtime;
65601 + if (is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
65602 + stat->atime = inode->i_ctime;
65603 + stat->mtime = inode->i_ctime;
65604 + } else {
65605 + stat->atime = inode->i_atime;
65606 + stat->mtime = inode->i_mtime;
65607 + }
65608 stat->ctime = inode->i_ctime;
65609 stat->blksize = (1 << inode->i_blkbits);
65610 stat->blocks = inode->i_blocks;
65611 @@ -52,9 +57,16 @@ EXPORT_SYMBOL(generic_fillattr);
65612 int vfs_getattr_nosec(struct path *path, struct kstat *stat)
65613 {
65614 struct inode *inode = path->dentry->d_inode;
65615 + int retval;
65616
65617 - if (inode->i_op->getattr)
65618 - return inode->i_op->getattr(path->mnt, path->dentry, stat);
65619 + if (inode->i_op->getattr) {
65620 + retval = inode->i_op->getattr(path->mnt, path->dentry, stat);
65621 + if (!retval && is_sidechannel_device(inode) && !capable_nolog(CAP_MKNOD)) {
65622 + stat->atime = stat->ctime;
65623 + stat->mtime = stat->ctime;
65624 + }
65625 + return retval;
65626 + }
65627
65628 generic_fillattr(inode, stat);
65629 return 0;
65630 diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
65631 index ee0d761..b346c58 100644
65632 --- a/fs/sysfs/dir.c
65633 +++ b/fs/sysfs/dir.c
65634 @@ -62,9 +62,16 @@ void sysfs_warn_dup(struct kernfs_node *parent, const char *name)
65635 int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)
65636 {
65637 struct kernfs_node *parent, *kn;
65638 + const char *name;
65639 + umode_t mode = S_IRWXU | S_IRUGO | S_IXUGO;
65640 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
65641 + const char *parent_name;
65642 +#endif
65643
65644 BUG_ON(!kobj);
65645
65646 + name = kobject_name(kobj);
65647 +
65648 if (kobj->parent)
65649 parent = kobj->parent->sd;
65650 else
65651 @@ -73,11 +80,22 @@ int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)
65652 if (!parent)
65653 return -ENOENT;
65654
65655 - kn = kernfs_create_dir_ns(parent, kobject_name(kobj),
65656 - S_IRWXU | S_IRUGO | S_IXUGO, kobj, ns);
65657 +#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
65658 + parent_name = parent->name;
65659 + mode = S_IRWXU;
65660 +
65661 + if ((!strcmp(parent_name, "") && (!strcmp(name, "devices") || !strcmp(name, "fs"))) ||
65662 + (!strcmp(parent_name, "devices") && !strcmp(name, "system")) ||
65663 + (!strcmp(parent_name, "fs") && (!strcmp(name, "selinux") || !strcmp(name, "fuse") || !strcmp(name, "ecryptfs"))) ||
65664 + (!strcmp(parent_name, "system") && !strcmp(name, "cpu")))
65665 + mode = S_IRWXU | S_IRUGO | S_IXUGO;
65666 +#endif
65667 +
65668 + kn = kernfs_create_dir_ns(parent, name,
65669 + mode, kobj, ns);
65670 if (IS_ERR(kn)) {
65671 if (PTR_ERR(kn) == -EEXIST)
65672 - sysfs_warn_dup(parent, kobject_name(kobj));
65673 + sysfs_warn_dup(parent, name);
65674 return PTR_ERR(kn);
65675 }
65676
65677 diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
65678 index 810cf6e..5fd2bf1 100644
65679 --- a/fs/sysfs/file.c
65680 +++ b/fs/sysfs/file.c
65681 @@ -47,12 +47,13 @@ static int sysfs_kf_seq_show(struct seq_file *sf, void *v)
65682 ssize_t count;
65683 char *buf;
65684
65685 - /* acquire buffer and ensure that it's >= PAGE_SIZE */
65686 + /* acquire buffer and ensure that it's >= PAGE_SIZE and clear */
65687 count = seq_get_buf(sf, &buf);
65688 if (count < PAGE_SIZE) {
65689 seq_commit(sf, -1);
65690 return 0;
65691 }
65692 + memset(buf, 0, PAGE_SIZE);
65693
65694 /*
65695 * Invoke show(). Control may reach here via seq file lseek even
65696 diff --git a/fs/sysv/sysv.h b/fs/sysv/sysv.h
65697 index 69d4889..a810bd4 100644
65698 --- a/fs/sysv/sysv.h
65699 +++ b/fs/sysv/sysv.h
65700 @@ -188,7 +188,7 @@ static inline u32 PDP_swab(u32 x)
65701 #endif
65702 }
65703
65704 -static inline __u32 fs32_to_cpu(struct sysv_sb_info *sbi, __fs32 n)
65705 +static inline __u32 __intentional_overflow(-1) fs32_to_cpu(struct sysv_sb_info *sbi, __fs32 n)
65706 {
65707 if (sbi->s_bytesex == BYTESEX_PDP)
65708 return PDP_swab((__force __u32)n);
65709 diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
65710 index e18b988..f1d4ad0f 100644
65711 --- a/fs/ubifs/io.c
65712 +++ b/fs/ubifs/io.c
65713 @@ -155,7 +155,7 @@ int ubifs_leb_change(struct ubifs_info *c, int lnum, const void *buf, int len)
65714 return err;
65715 }
65716
65717 -int ubifs_leb_unmap(struct ubifs_info *c, int lnum)
65718 +int __intentional_overflow(-1) ubifs_leb_unmap(struct ubifs_info *c, int lnum)
65719 {
65720 int err;
65721
65722 diff --git a/fs/udf/misc.c b/fs/udf/misc.c
65723 index c175b4d..8f36a16 100644
65724 --- a/fs/udf/misc.c
65725 +++ b/fs/udf/misc.c
65726 @@ -289,7 +289,7 @@ void udf_new_tag(char *data, uint16_t ident, uint16_t version, uint16_t snum,
65727
65728 u8 udf_tag_checksum(const struct tag *t)
65729 {
65730 - u8 *data = (u8 *)t;
65731 + const u8 *data = (const u8 *)t;
65732 u8 checksum = 0;
65733 int i;
65734 for (i = 0; i < sizeof(struct tag); ++i)
65735 diff --git a/fs/ufs/swab.h b/fs/ufs/swab.h
65736 index 8d974c4..b82f6ec 100644
65737 --- a/fs/ufs/swab.h
65738 +++ b/fs/ufs/swab.h
65739 @@ -22,7 +22,7 @@ enum {
65740 BYTESEX_BE
65741 };
65742
65743 -static inline u64
65744 +static inline u64 __intentional_overflow(-1)
65745 fs64_to_cpu(struct super_block *sbp, __fs64 n)
65746 {
65747 if (UFS_SB(sbp)->s_bytesex == BYTESEX_LE)
65748 @@ -40,7 +40,7 @@ cpu_to_fs64(struct super_block *sbp, u64 n)
65749 return (__force __fs64)cpu_to_be64(n);
65750 }
65751
65752 -static inline u32
65753 +static inline u32 __intentional_overflow(-1)
65754 fs32_to_cpu(struct super_block *sbp, __fs32 n)
65755 {
65756 if (UFS_SB(sbp)->s_bytesex == BYTESEX_LE)
65757 diff --git a/fs/utimes.c b/fs/utimes.c
65758 index aa138d6..5f3a811 100644
65759 --- a/fs/utimes.c
65760 +++ b/fs/utimes.c
65761 @@ -1,6 +1,7 @@
65762 #include <linux/compiler.h>
65763 #include <linux/file.h>
65764 #include <linux/fs.h>
65765 +#include <linux/security.h>
65766 #include <linux/linkage.h>
65767 #include <linux/mount.h>
65768 #include <linux/namei.h>
65769 @@ -103,6 +104,12 @@ static int utimes_common(struct path *path, struct timespec *times)
65770 }
65771 }
65772 retry_deleg:
65773 +
65774 + if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
65775 + error = -EACCES;
65776 + goto mnt_drop_write_and_out;
65777 + }
65778 +
65779 mutex_lock(&inode->i_mutex);
65780 error = notify_change(path->dentry, &newattrs, &delegated_inode);
65781 mutex_unlock(&inode->i_mutex);
65782 diff --git a/fs/xattr.c b/fs/xattr.c
65783 index 3377dff..f394815 100644
65784 --- a/fs/xattr.c
65785 +++ b/fs/xattr.c
65786 @@ -227,6 +227,27 @@ int vfs_xattr_cmp(struct dentry *dentry, const char *xattr_name,
65787 return rc;
65788 }
65789
65790 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
65791 +ssize_t
65792 +pax_getxattr(struct dentry *dentry, void *value, size_t size)
65793 +{
65794 + struct inode *inode = dentry->d_inode;
65795 + ssize_t error;
65796 +
65797 + error = inode_permission(inode, MAY_EXEC);
65798 + if (error)
65799 + return error;
65800 +
65801 + if (inode->i_op->getxattr)
65802 + error = inode->i_op->getxattr(dentry, XATTR_NAME_PAX_FLAGS, value, size);
65803 + else
65804 + error = -EOPNOTSUPP;
65805 +
65806 + return error;
65807 +}
65808 +EXPORT_SYMBOL(pax_getxattr);
65809 +#endif
65810 +
65811 ssize_t
65812 vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
65813 {
65814 @@ -319,7 +340,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
65815 * Extended attribute SET operations
65816 */
65817 static long
65818 -setxattr(struct dentry *d, const char __user *name, const void __user *value,
65819 +setxattr(struct path *path, const char __user *name, const void __user *value,
65820 size_t size, int flags)
65821 {
65822 int error;
65823 @@ -355,7 +376,12 @@ setxattr(struct dentry *d, const char __user *name, const void __user *value,
65824 posix_acl_fix_xattr_from_user(kvalue, size);
65825 }
65826
65827 - error = vfs_setxattr(d, kname, kvalue, size, flags);
65828 + if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
65829 + error = -EACCES;
65830 + goto out;
65831 + }
65832 +
65833 + error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
65834 out:
65835 if (vvalue)
65836 vfree(vvalue);
65837 @@ -377,7 +403,7 @@ retry:
65838 return error;
65839 error = mnt_want_write(path.mnt);
65840 if (!error) {
65841 - error = setxattr(path.dentry, name, value, size, flags);
65842 + error = setxattr(&path, name, value, size, flags);
65843 mnt_drop_write(path.mnt);
65844 }
65845 path_put(&path);
65846 @@ -401,7 +427,7 @@ retry:
65847 return error;
65848 error = mnt_want_write(path.mnt);
65849 if (!error) {
65850 - error = setxattr(path.dentry, name, value, size, flags);
65851 + error = setxattr(&path, name, value, size, flags);
65852 mnt_drop_write(path.mnt);
65853 }
65854 path_put(&path);
65855 @@ -416,16 +442,14 @@ SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
65856 const void __user *,value, size_t, size, int, flags)
65857 {
65858 struct fd f = fdget(fd);
65859 - struct dentry *dentry;
65860 int error = -EBADF;
65861
65862 if (!f.file)
65863 return error;
65864 - dentry = f.file->f_path.dentry;
65865 - audit_inode(NULL, dentry, 0);
65866 + audit_inode(NULL, f.file->f_path.dentry, 0);
65867 error = mnt_want_write_file(f.file);
65868 if (!error) {
65869 - error = setxattr(dentry, name, value, size, flags);
65870 + error = setxattr(&f.file->f_path, name, value, size, flags);
65871 mnt_drop_write_file(f.file);
65872 }
65873 fdput(f);
65874 @@ -626,7 +650,7 @@ SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
65875 * Extended attribute REMOVE operations
65876 */
65877 static long
65878 -removexattr(struct dentry *d, const char __user *name)
65879 +removexattr(struct path *path, const char __user *name)
65880 {
65881 int error;
65882 char kname[XATTR_NAME_MAX + 1];
65883 @@ -637,7 +661,10 @@ removexattr(struct dentry *d, const char __user *name)
65884 if (error < 0)
65885 return error;
65886
65887 - return vfs_removexattr(d, kname);
65888 + if (!gr_acl_handle_removexattr(path->dentry, path->mnt))
65889 + return -EACCES;
65890 +
65891 + return vfs_removexattr(path->dentry, kname);
65892 }
65893
65894 SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
65895 @@ -652,7 +679,7 @@ retry:
65896 return error;
65897 error = mnt_want_write(path.mnt);
65898 if (!error) {
65899 - error = removexattr(path.dentry, name);
65900 + error = removexattr(&path, name);
65901 mnt_drop_write(path.mnt);
65902 }
65903 path_put(&path);
65904 @@ -675,7 +702,7 @@ retry:
65905 return error;
65906 error = mnt_want_write(path.mnt);
65907 if (!error) {
65908 - error = removexattr(path.dentry, name);
65909 + error = removexattr(&path, name);
65910 mnt_drop_write(path.mnt);
65911 }
65912 path_put(&path);
65913 @@ -689,16 +716,16 @@ retry:
65914 SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
65915 {
65916 struct fd f = fdget(fd);
65917 - struct dentry *dentry;
65918 + struct path *path;
65919 int error = -EBADF;
65920
65921 if (!f.file)
65922 return error;
65923 - dentry = f.file->f_path.dentry;
65924 - audit_inode(NULL, dentry, 0);
65925 + path = &f.file->f_path;
65926 + audit_inode(NULL, path->dentry, 0);
65927 error = mnt_want_write_file(f.file);
65928 if (!error) {
65929 - error = removexattr(dentry, name);
65930 + error = removexattr(path, name);
65931 mnt_drop_write_file(f.file);
65932 }
65933 fdput(f);
65934 diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
65935 index 152543c..d80c361 100644
65936 --- a/fs/xfs/xfs_bmap.c
65937 +++ b/fs/xfs/xfs_bmap.c
65938 @@ -584,7 +584,7 @@ xfs_bmap_validate_ret(
65939
65940 #else
65941 #define xfs_bmap_check_leaf_extents(cur, ip, whichfork) do { } while (0)
65942 -#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
65943 +#define xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do { } while (0)
65944 #endif /* DEBUG */
65945
65946 /*
65947 diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c
65948 index aead369..0dfecfd 100644
65949 --- a/fs/xfs/xfs_dir2_readdir.c
65950 +++ b/fs/xfs/xfs_dir2_readdir.c
65951 @@ -160,7 +160,12 @@ xfs_dir2_sf_getdents(
65952 ino = dp->d_ops->sf_get_ino(sfp, sfep);
65953 filetype = dp->d_ops->sf_get_ftype(sfep);
65954 ctx->pos = off & 0x7fffffff;
65955 - if (!dir_emit(ctx, (char *)sfep->name, sfep->namelen, ino,
65956 + if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
65957 + char name[sfep->namelen];
65958 + memcpy(name, sfep->name, sfep->namelen);
65959 + if (!dir_emit(ctx, name, sfep->namelen, ino, xfs_dir3_get_dtype(mp, filetype)))
65960 + return 0;
65961 + } else if (!dir_emit(ctx, (char *)sfep->name, sfep->namelen, ino,
65962 xfs_dir3_get_dtype(mp, filetype)))
65963 return 0;
65964 sfep = dp->d_ops->sf_nextentry(sfp, sfep);
65965 diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
65966 index bcfe612..aa399c0 100644
65967 --- a/fs/xfs/xfs_ioctl.c
65968 +++ b/fs/xfs/xfs_ioctl.c
65969 @@ -122,7 +122,7 @@ xfs_find_handle(
65970 }
65971
65972 error = -EFAULT;
65973 - if (copy_to_user(hreq->ohandle, &handle, hsize) ||
65974 + if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
65975 copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
65976 goto out_put;
65977
65978 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
65979 new file mode 100644
65980 index 0000000..a14eb52
65981 --- /dev/null
65982 +++ b/grsecurity/Kconfig
65983 @@ -0,0 +1,1174 @@
65984 +#
65985 +# grecurity configuration
65986 +#
65987 +menu "Memory Protections"
65988 +depends on GRKERNSEC
65989 +
65990 +config GRKERNSEC_KMEM
65991 + bool "Deny reading/writing to /dev/kmem, /dev/mem, and /dev/port"
65992 + default y if GRKERNSEC_CONFIG_AUTO
65993 + select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
65994 + help
65995 + If you say Y here, /dev/kmem and /dev/mem won't be allowed to
65996 + be written to or read from to modify or leak the contents of the running
65997 + kernel. /dev/port will also not be allowed to be opened, writing to
65998 + /dev/cpu/*/msr will be prevented, and support for kexec will be removed.
65999 + If you have module support disabled, enabling this will close up several
66000 + ways that are currently used to insert malicious code into the running
66001 + kernel.
66002 +
66003 + Even with this feature enabled, we still highly recommend that
66004 + you use the RBAC system, as it is still possible for an attacker to
66005 + modify the running kernel through other more obscure methods.
66006 +
66007 + It is highly recommended that you say Y here if you meet all the
66008 + conditions above.
66009 +
66010 +config GRKERNSEC_VM86
66011 + bool "Restrict VM86 mode"
66012 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
66013 + depends on X86_32
66014 +
66015 + help
66016 + If you say Y here, only processes with CAP_SYS_RAWIO will be able to
66017 + make use of a special execution mode on 32bit x86 processors called
66018 + Virtual 8086 (VM86) mode. XFree86 may need vm86 mode for certain
66019 + video cards and will still work with this option enabled. The purpose
66020 + of the option is to prevent exploitation of emulation errors in
66021 + virtualization of vm86 mode like the one discovered in VMWare in 2009.
66022 + Nearly all users should be able to enable this option.
66023 +
66024 +config GRKERNSEC_IO
66025 + bool "Disable privileged I/O"
66026 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
66027 + depends on X86
66028 + select RTC_CLASS
66029 + select RTC_INTF_DEV
66030 + select RTC_DRV_CMOS
66031 +
66032 + help
66033 + If you say Y here, all ioperm and iopl calls will return an error.
66034 + Ioperm and iopl can be used to modify the running kernel.
66035 + Unfortunately, some programs need this access to operate properly,
66036 + the most notable of which are XFree86 and hwclock. hwclock can be
66037 + remedied by having RTC support in the kernel, so real-time
66038 + clock support is enabled if this option is enabled, to ensure
66039 + that hwclock operates correctly. If hwclock still does not work,
66040 + either update udev or symlink /dev/rtc to /dev/rtc0.
66041 +
66042 + If you're using XFree86 or a version of Xorg from 2012 or earlier,
66043 + you may not be able to boot into a graphical environment with this
66044 + option enabled. In this case, you should use the RBAC system instead.
66045 +
66046 +config GRKERNSEC_JIT_HARDEN
66047 + bool "Harden BPF JIT against spray attacks"
66048 + default y if GRKERNSEC_CONFIG_AUTO
66049 + depends on BPF_JIT && X86
66050 + help
66051 + If you say Y here, the native code generated by the kernel's Berkeley
66052 + Packet Filter (BPF) JIT engine will be hardened against JIT-spraying
66053 + attacks that attempt to fit attacker-beneficial instructions in
66054 + 32bit immediate fields of JIT-generated native instructions. The
66055 + attacker will generally aim to cause an unintended instruction sequence
66056 + of JIT-generated native code to execute by jumping into the middle of
66057 + a generated instruction. This feature effectively randomizes the 32bit
66058 + immediate constants present in the generated code to thwart such attacks.
66059 +
66060 + If you're using KERNEXEC, it's recommended that you enable this option
66061 + to supplement the hardening of the kernel.
66062 +
66063 +config GRKERNSEC_PERF_HARDEN
66064 + bool "Disable unprivileged PERF_EVENTS usage by default"
66065 + default y if GRKERNSEC_CONFIG_AUTO
66066 + depends on PERF_EVENTS
66067 + help
66068 + If you say Y here, the range of acceptable values for the
66069 + /proc/sys/kernel/perf_event_paranoid sysctl will be expanded to allow and
66070 + default to a new value: 3. When the sysctl is set to this value, no
66071 + unprivileged use of the PERF_EVENTS syscall interface will be permitted.
66072 +
66073 + Though PERF_EVENTS can be used legitimately for performance monitoring
66074 + and low-level application profiling, it is forced on regardless of
66075 + configuration, has been at fault for several vulnerabilities, and
66076 + creates new opportunities for side channels and other information leaks.
66077 +
66078 + This feature puts PERF_EVENTS into a secure default state and permits
66079 + the administrator to change out of it temporarily if unprivileged
66080 + application profiling is needed.
66081 +
66082 +config GRKERNSEC_RAND_THREADSTACK
66083 + bool "Insert random gaps between thread stacks"
66084 + default y if GRKERNSEC_CONFIG_AUTO
66085 + depends on PAX_RANDMMAP && !PPC
66086 + help
66087 + If you say Y here, a random-sized gap will be enforced between allocated
66088 + thread stacks. Glibc's NPTL and other threading libraries that
66089 + pass MAP_STACK to the kernel for thread stack allocation are supported.
66090 + The implementation currently provides 8 bits of entropy for the gap.
66091 +
66092 + Many distributions do not compile threaded remote services with the
66093 + -fstack-check argument to GCC, causing the variable-sized stack-based
66094 + allocator, alloca(), to not probe the stack on allocation. This
66095 + permits an unbounded alloca() to skip over any guard page and potentially
66096 + modify another thread's stack reliably. An enforced random gap
66097 + reduces the reliability of such an attack and increases the chance
66098 + that such a read/write to another thread's stack instead lands in
66099 + an unmapped area, causing a crash and triggering grsecurity's
66100 + anti-bruteforcing logic.
66101 +
66102 +config GRKERNSEC_PROC_MEMMAP
66103 + bool "Harden ASLR against information leaks and entropy reduction"
66104 + default y if (GRKERNSEC_CONFIG_AUTO || PAX_NOEXEC || PAX_ASLR)
66105 + depends on PAX_NOEXEC || PAX_ASLR
66106 + help
66107 + If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
66108 + give no information about the addresses of its mappings if
66109 + PaX features that rely on random addresses are enabled on the task.
66110 + In addition to sanitizing this information and disabling other
66111 + dangerous sources of information, this option causes reads of sensitive
66112 + /proc/<pid> entries where the file descriptor was opened in a different
66113 + task than the one performing the read. Such attempts are logged.
66114 + This option also limits argv/env strings for suid/sgid binaries
66115 + to 512KB to prevent a complete exhaustion of the stack entropy provided
66116 + by ASLR. Finally, it places an 8MB stack resource limit on suid/sgid
66117 + binaries to prevent alternative mmap layouts from being abused.
66118 +
66119 + If you use PaX it is essential that you say Y here as it closes up
66120 + several holes that make full ASLR useless locally.
66121 +
66122 +
66123 +config GRKERNSEC_KSTACKOVERFLOW
66124 + bool "Prevent kernel stack overflows"
66125 + default y if GRKERNSEC_CONFIG_AUTO
66126 + depends on !IA64 && 64BIT
66127 + help
66128 + If you say Y here, the kernel's process stacks will be allocated
66129 + with vmalloc instead of the kernel's default allocator. This
66130 + introduces guard pages that in combination with the alloca checking
66131 + of the STACKLEAK feature prevents all forms of kernel process stack
66132 + overflow abuse. Note that this is different from kernel stack
66133 + buffer overflows.
66134 +
66135 +config GRKERNSEC_BRUTE
66136 + bool "Deter exploit bruteforcing"
66137 + default y if GRKERNSEC_CONFIG_AUTO
66138 + help
66139 + If you say Y here, attempts to bruteforce exploits against forking
66140 + daemons such as apache or sshd, as well as against suid/sgid binaries
66141 + will be deterred. When a child of a forking daemon is killed by PaX
66142 + or crashes due to an illegal instruction or other suspicious signal,
66143 + the parent process will be delayed 30 seconds upon every subsequent
66144 + fork until the administrator is able to assess the situation and
66145 + restart the daemon.
66146 + In the suid/sgid case, the attempt is logged, the user has all their
66147 + existing instances of the suid/sgid binary terminated and will
66148 + be unable to execute any suid/sgid binaries for 15 minutes.
66149 +
66150 + It is recommended that you also enable signal logging in the auditing
66151 + section so that logs are generated when a process triggers a suspicious
66152 + signal.
66153 + If the sysctl option is enabled, a sysctl option with name
66154 + "deter_bruteforce" is created.
66155 +
66156 +config GRKERNSEC_MODHARDEN
66157 + bool "Harden module auto-loading"
66158 + default y if GRKERNSEC_CONFIG_AUTO
66159 + depends on MODULES
66160 + help
66161 + If you say Y here, module auto-loading in response to use of some
66162 + feature implemented by an unloaded module will be restricted to
66163 + root users. Enabling this option helps defend against attacks
66164 + by unprivileged users who abuse the auto-loading behavior to
66165 + cause a vulnerable module to load that is then exploited.
66166 +
66167 + If this option prevents a legitimate use of auto-loading for a
66168 + non-root user, the administrator can execute modprobe manually
66169 + with the exact name of the module mentioned in the alert log.
66170 + Alternatively, the administrator can add the module to the list
66171 + of modules loaded at boot by modifying init scripts.
66172 +
66173 + Modification of init scripts will most likely be needed on
66174 + Ubuntu servers with encrypted home directory support enabled,
66175 + as the first non-root user logging in will cause the ecb(aes),
66176 + ecb(aes)-all, cbc(aes), and cbc(aes)-all modules to be loaded.
66177 +
66178 +config GRKERNSEC_HIDESYM
66179 + bool "Hide kernel symbols"
66180 + default y if GRKERNSEC_CONFIG_AUTO
66181 + select PAX_USERCOPY_SLABS
66182 + help
66183 + If you say Y here, getting information on loaded modules, and
66184 + displaying all kernel symbols through a syscall will be restricted
66185 + to users with CAP_SYS_MODULE. For software compatibility reasons,
66186 + /proc/kallsyms will be restricted to the root user. The RBAC
66187 + system can hide that entry even from root.
66188 +
66189 + This option also prevents leaking of kernel addresses through
66190 + several /proc entries.
66191 +
66192 + Note that this option is only effective provided the following
66193 + conditions are met:
66194 + 1) The kernel using grsecurity is not precompiled by some distribution
66195 + 2) You have also enabled GRKERNSEC_DMESG
66196 + 3) You are using the RBAC system and hiding other files such as your
66197 + kernel image and System.map. Alternatively, enabling this option
66198 + causes the permissions on /boot, /lib/modules, and the kernel
66199 + source directory to change at compile time to prevent
66200 + reading by non-root users.
66201 + If the above conditions are met, this option will aid in providing a
66202 + useful protection against local kernel exploitation of overflows
66203 + and arbitrary read/write vulnerabilities.
66204 +
66205 + It is highly recommended that you enable GRKERNSEC_PERF_HARDEN
66206 + in addition to this feature.
66207 +
66208 +config GRKERNSEC_RANDSTRUCT
66209 + bool "Randomize layout of sensitive kernel structures"
66210 + default y if GRKERNSEC_CONFIG_AUTO
66211 + select GRKERNSEC_HIDESYM
66212 + select MODVERSIONS if MODULES
66213 + help
66214 + If you say Y here, the layouts of a number of sensitive kernel
66215 + structures (task, fs, cred, etc) and all structures composed entirely
66216 + of function pointers (aka "ops" structs) will be randomized at compile-time.
66217 + This can introduce the requirement of an additional infoleak
66218 + vulnerability for exploits targeting these structure types.
66219 +
66220 + Enabling this feature will introduce some performance impact, slightly
66221 + increase memory usage, and prevent the use of forensic tools like
66222 + Volatility against the system (unless the kernel source tree isn't
66223 + cleaned after kernel installation).
66224 +
66225 + The seed used for compilation is located at tools/gcc/randomize_layout_seed.h.
66226 + It remains after a make clean to allow for external modules to be compiled
66227 + with the existing seed and will be removed by a make mrproper or
66228 + make distclean.
66229 +
66230 + Note that the implementation requires gcc 4.6.4. or newer. You may need
66231 + to install the supporting headers explicitly in addition to the normal
66232 + gcc package.
66233 +
66234 +config GRKERNSEC_RANDSTRUCT_PERFORMANCE
66235 + bool "Use cacheline-aware structure randomization"
66236 + depends on GRKERNSEC_RANDSTRUCT
66237 + default y if GRKERNSEC_CONFIG_PRIORITY_PERF
66238 + help
66239 + If you say Y here, the RANDSTRUCT randomization will make a best effort
66240 + at restricting randomization to cacheline-sized groups of elements. It
66241 + will further not randomize bitfields in structures. This reduces the
66242 + performance hit of RANDSTRUCT at the cost of weakened randomization.
66243 +
66244 +config GRKERNSEC_KERN_LOCKOUT
66245 + bool "Active kernel exploit response"
66246 + default y if GRKERNSEC_CONFIG_AUTO
66247 + depends on X86 || ARM || PPC || SPARC
66248 + help
66249 + If you say Y here, when a PaX alert is triggered due to suspicious
66250 + activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
66251 + or an OOPS occurs due to bad memory accesses, instead of just
66252 + terminating the offending process (and potentially allowing
66253 + a subsequent exploit from the same user), we will take one of two
66254 + actions:
66255 + If the user was root, we will panic the system
66256 + If the user was non-root, we will log the attempt, terminate
66257 + all processes owned by the user, then prevent them from creating
66258 + any new processes until the system is restarted
66259 + This deters repeated kernel exploitation/bruteforcing attempts
66260 + and is useful for later forensics.
66261 +
66262 +config GRKERNSEC_OLD_ARM_USERLAND
66263 + bool "Old ARM userland compatibility"
66264 + depends on ARM && (CPU_V6 || CPU_V6K || CPU_V7)
66265 + help
66266 + If you say Y here, stubs of executable code to perform such operations
66267 + as "compare-exchange" will be placed at fixed locations in the ARM vector
66268 + table. This is unfortunately needed for old ARM userland meant to run
66269 + across a wide range of processors. Without this option enabled,
66270 + the get_tls and data memory barrier stubs will be emulated by the kernel,
66271 + which is enough for Linaro userlands or other userlands designed for v6
66272 + and newer ARM CPUs. It's recommended that you try without this option enabled
66273 + first, and only enable it if your userland does not boot (it will likely fail
66274 + at init time).
66275 +
66276 +endmenu
66277 +menu "Role Based Access Control Options"
66278 +depends on GRKERNSEC
66279 +
66280 +config GRKERNSEC_RBAC_DEBUG
66281 + bool
66282 +
66283 +config GRKERNSEC_NO_RBAC
66284 + bool "Disable RBAC system"
66285 + help
66286 + If you say Y here, the /dev/grsec device will be removed from the kernel,
66287 + preventing the RBAC system from being enabled. You should only say Y
66288 + here if you have no intention of using the RBAC system, so as to prevent
66289 + an attacker with root access from misusing the RBAC system to hide files
66290 + and processes when loadable module support and /dev/[k]mem have been
66291 + locked down.
66292 +
66293 +config GRKERNSEC_ACL_HIDEKERN
66294 + bool "Hide kernel processes"
66295 + help
66296 + If you say Y here, all kernel threads will be hidden to all
66297 + processes but those whose subject has the "view hidden processes"
66298 + flag.
66299 +
66300 +config GRKERNSEC_ACL_MAXTRIES
66301 + int "Maximum tries before password lockout"
66302 + default 3
66303 + help
66304 + This option enforces the maximum number of times a user can attempt
66305 + to authorize themselves with the grsecurity RBAC system before being
66306 + denied the ability to attempt authorization again for a specified time.
66307 + The lower the number, the harder it will be to brute-force a password.
66308 +
66309 +config GRKERNSEC_ACL_TIMEOUT
66310 + int "Time to wait after max password tries, in seconds"
66311 + default 30
66312 + help
66313 + This option specifies the time the user must wait after attempting to
66314 + authorize to the RBAC system with the maximum number of invalid
66315 + passwords. The higher the number, the harder it will be to brute-force
66316 + a password.
66317 +
66318 +endmenu
66319 +menu "Filesystem Protections"
66320 +depends on GRKERNSEC
66321 +
66322 +config GRKERNSEC_PROC
66323 + bool "Proc restrictions"
66324 + default y if GRKERNSEC_CONFIG_AUTO
66325 + help
66326 + If you say Y here, the permissions of the /proc filesystem
66327 + will be altered to enhance system security and privacy. You MUST
66328 + choose either a user only restriction or a user and group restriction.
66329 + Depending upon the option you choose, you can either restrict users to
66330 + see only the processes they themselves run, or choose a group that can
66331 + view all processes and files normally restricted to root if you choose
66332 + the "restrict to user only" option. NOTE: If you're running identd or
66333 + ntpd as a non-root user, you will have to run it as the group you
66334 + specify here.
66335 +
66336 +config GRKERNSEC_PROC_USER
66337 + bool "Restrict /proc to user only"
66338 + depends on GRKERNSEC_PROC
66339 + help
66340 + If you say Y here, non-root users will only be able to view their own
66341 + processes, and restricts them from viewing network-related information,
66342 + and viewing kernel symbol and module information.
66343 +
66344 +config GRKERNSEC_PROC_USERGROUP
66345 + bool "Allow special group"
66346 + default y if GRKERNSEC_CONFIG_AUTO
66347 + depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
66348 + help
66349 + If you say Y here, you will be able to select a group that will be
66350 + able to view all processes and network-related information. If you've
66351 + enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
66352 + remain hidden. This option is useful if you want to run identd as
66353 + a non-root user. The group you select may also be chosen at boot time
66354 + via "grsec_proc_gid=" on the kernel commandline.
66355 +
66356 +config GRKERNSEC_PROC_GID
66357 + int "GID for special group"
66358 + depends on GRKERNSEC_PROC_USERGROUP
66359 + default 1001
66360 +
66361 +config GRKERNSEC_PROC_ADD
66362 + bool "Additional restrictions"
66363 + default y if GRKERNSEC_CONFIG_AUTO
66364 + depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
66365 + help
66366 + If you say Y here, additional restrictions will be placed on
66367 + /proc that keep normal users from viewing device information and
66368 + slabinfo information that could be useful for exploits.
66369 +
66370 +config GRKERNSEC_LINK
66371 + bool "Linking restrictions"
66372 + default y if GRKERNSEC_CONFIG_AUTO
66373 + help
66374 + If you say Y here, /tmp race exploits will be prevented, since users
66375 + will no longer be able to follow symlinks owned by other users in
66376 + world-writable +t directories (e.g. /tmp), unless the owner of the
66377 + symlink is the owner of the directory. users will also not be
66378 + able to hardlink to files they do not own. If the sysctl option is
66379 + enabled, a sysctl option with name "linking_restrictions" is created.
66380 +
66381 +config GRKERNSEC_SYMLINKOWN
66382 + bool "Kernel-enforced SymlinksIfOwnerMatch"
66383 + default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
66384 + help
66385 + Apache's SymlinksIfOwnerMatch option has an inherent race condition
66386 + that prevents it from being used as a security feature. As Apache
66387 + verifies the symlink by performing a stat() against the target of
66388 + the symlink before it is followed, an attacker can setup a symlink
66389 + to point to a same-owned file, then replace the symlink with one
66390 + that targets another user's file just after Apache "validates" the
66391 + symlink -- a classic TOCTOU race. If you say Y here, a complete,
66392 + race-free replacement for Apache's "SymlinksIfOwnerMatch" option
66393 + will be in place for the group you specify. If the sysctl option
66394 + is enabled, a sysctl option with name "enforce_symlinksifowner" is
66395 + created.
66396 +
66397 +config GRKERNSEC_SYMLINKOWN_GID
66398 + int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
66399 + depends on GRKERNSEC_SYMLINKOWN
66400 + default 1006
66401 + help
66402 + Setting this GID determines what group kernel-enforced
66403 + SymlinksIfOwnerMatch will be enabled for. If the sysctl option
66404 + is enabled, a sysctl option with name "symlinkown_gid" is created.
66405 +
66406 +config GRKERNSEC_FIFO
66407 + bool "FIFO restrictions"
66408 + default y if GRKERNSEC_CONFIG_AUTO
66409 + help
66410 + If you say Y here, users will not be able to write to FIFOs they don't
66411 + own in world-writable +t directories (e.g. /tmp), unless the owner of
66412 + the FIFO is the same owner of the directory it's held in. If the sysctl
66413 + option is enabled, a sysctl option with name "fifo_restrictions" is
66414 + created.
66415 +
66416 +config GRKERNSEC_SYSFS_RESTRICT
66417 + bool "Sysfs/debugfs restriction"
66418 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER)
66419 + depends on SYSFS
66420 + help
66421 + If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
66422 + any filesystem normally mounted under it (e.g. debugfs) will be
66423 + mostly accessible only by root. These filesystems generally provide access
66424 + to hardware and debug information that isn't appropriate for unprivileged
66425 + users of the system. Sysfs and debugfs have also become a large source
66426 + of new vulnerabilities, ranging from infoleaks to local compromise.
66427 + There has been very little oversight with an eye toward security involved
66428 + in adding new exporters of information to these filesystems, so their
66429 + use is discouraged.
66430 + For reasons of compatibility, a few directories have been whitelisted
66431 + for access by non-root users:
66432 + /sys/fs/selinux
66433 + /sys/fs/fuse
66434 + /sys/devices/system/cpu
66435 +
66436 +config GRKERNSEC_ROFS
66437 + bool "Runtime read-only mount protection"
66438 + depends on SYSCTL
66439 + help
66440 + If you say Y here, a sysctl option with name "romount_protect" will
66441 + be created. By setting this option to 1 at runtime, filesystems
66442 + will be protected in the following ways:
66443 + * No new writable mounts will be allowed
66444 + * Existing read-only mounts won't be able to be remounted read/write
66445 + * Write operations will be denied on all block devices
66446 + This option acts independently of grsec_lock: once it is set to 1,
66447 + it cannot be turned off. Therefore, please be mindful of the resulting
66448 + behavior if this option is enabled in an init script on a read-only
66449 + filesystem.
66450 + Also be aware that as with other root-focused features, GRKERNSEC_KMEM
66451 + and GRKERNSEC_IO should be enabled and module loading disabled via
66452 + config or at runtime.
66453 + This feature is mainly intended for secure embedded systems.
66454 +
66455 +
66456 +config GRKERNSEC_DEVICE_SIDECHANNEL
66457 + bool "Eliminate stat/notify-based device sidechannels"
66458 + default y if GRKERNSEC_CONFIG_AUTO
66459 + help
66460 + If you say Y here, timing analyses on block or character
66461 + devices like /dev/ptmx using stat or inotify/dnotify/fanotify
66462 + will be thwarted for unprivileged users. If a process without
66463 + CAP_MKNOD stats such a device, the last access and last modify times
66464 + will match the device's create time. No access or modify events
66465 + will be triggered through inotify/dnotify/fanotify for such devices.
66466 + This feature will prevent attacks that may at a minimum
66467 + allow an attacker to determine the administrator's password length.
66468 +
66469 +config GRKERNSEC_CHROOT
66470 + bool "Chroot jail restrictions"
66471 + default y if GRKERNSEC_CONFIG_AUTO
66472 + help
66473 + If you say Y here, you will be able to choose several options that will
66474 + make breaking out of a chrooted jail much more difficult. If you
66475 + encounter no software incompatibilities with the following options, it
66476 + is recommended that you enable each one.
66477 +
66478 + Note that the chroot restrictions are not intended to apply to "chroots"
66479 + to directories that are simple bind mounts of the global root filesystem.
66480 + For several other reasons, a user shouldn't expect any significant
66481 + security by performing such a chroot.
66482 +
66483 +config GRKERNSEC_CHROOT_MOUNT
66484 + bool "Deny mounts"
66485 + default y if GRKERNSEC_CONFIG_AUTO
66486 + depends on GRKERNSEC_CHROOT
66487 + help
66488 + If you say Y here, processes inside a chroot will not be able to
66489 + mount or remount filesystems. If the sysctl option is enabled, a
66490 + sysctl option with name "chroot_deny_mount" is created.
66491 +
66492 +config GRKERNSEC_CHROOT_DOUBLE
66493 + bool "Deny double-chroots"
66494 + default y if GRKERNSEC_CONFIG_AUTO
66495 + depends on GRKERNSEC_CHROOT
66496 + help
66497 + If you say Y here, processes inside a chroot will not be able to chroot
66498 + again outside the chroot. This is a widely used method of breaking
66499 + out of a chroot jail and should not be allowed. If the sysctl
66500 + option is enabled, a sysctl option with name
66501 + "chroot_deny_chroot" is created.
66502 +
66503 +config GRKERNSEC_CHROOT_PIVOT
66504 + bool "Deny pivot_root in chroot"
66505 + default y if GRKERNSEC_CONFIG_AUTO
66506 + depends on GRKERNSEC_CHROOT
66507 + help
66508 + If you say Y here, processes inside a chroot will not be able to use
66509 + a function called pivot_root() that was introduced in Linux 2.3.41. It
66510 + works similar to chroot in that it changes the root filesystem. This
66511 + function could be misused in a chrooted process to attempt to break out
66512 + of the chroot, and therefore should not be allowed. If the sysctl
66513 + option is enabled, a sysctl option with name "chroot_deny_pivot" is
66514 + created.
66515 +
66516 +config GRKERNSEC_CHROOT_CHDIR
66517 + bool "Enforce chdir(\"/\") on all chroots"
66518 + default y if GRKERNSEC_CONFIG_AUTO
66519 + depends on GRKERNSEC_CHROOT
66520 + help
66521 + If you say Y here, the current working directory of all newly-chrooted
66522 + applications will be set to the the root directory of the chroot.
66523 + The man page on chroot(2) states:
66524 + Note that this call does not change the current working
66525 + directory, so that `.' can be outside the tree rooted at
66526 + `/'. In particular, the super-user can escape from a
66527 + `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
66528 +
66529 + It is recommended that you say Y here, since it's not known to break
66530 + any software. If the sysctl option is enabled, a sysctl option with
66531 + name "chroot_enforce_chdir" is created.
66532 +
66533 +config GRKERNSEC_CHROOT_CHMOD
66534 + bool "Deny (f)chmod +s"
66535 + default y if GRKERNSEC_CONFIG_AUTO
66536 + depends on GRKERNSEC_CHROOT
66537 + help
66538 + If you say Y here, processes inside a chroot will not be able to chmod
66539 + or fchmod files to make them have suid or sgid bits. This protects
66540 + against another published method of breaking a chroot. If the sysctl
66541 + option is enabled, a sysctl option with name "chroot_deny_chmod" is
66542 + created.
66543 +
66544 +config GRKERNSEC_CHROOT_FCHDIR
66545 + bool "Deny fchdir out of chroot"
66546 + default y if GRKERNSEC_CONFIG_AUTO
66547 + depends on GRKERNSEC_CHROOT
66548 + help
66549 + If you say Y here, a well-known method of breaking chroots by fchdir'ing
66550 + to a file descriptor of the chrooting process that points to a directory
66551 + outside the filesystem will be stopped. If the sysctl option
66552 + is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
66553 +
66554 +config GRKERNSEC_CHROOT_MKNOD
66555 + bool "Deny mknod"
66556 + default y if GRKERNSEC_CONFIG_AUTO
66557 + depends on GRKERNSEC_CHROOT
66558 + help
66559 + If you say Y here, processes inside a chroot will not be allowed to
66560 + mknod. The problem with using mknod inside a chroot is that it
66561 + would allow an attacker to create a device entry that is the same
66562 + as one on the physical root of your system, which could range from
66563 + anything from the console device to a device for your harddrive (which
66564 + they could then use to wipe the drive or steal data). It is recommended
66565 + that you say Y here, unless you run into software incompatibilities.
66566 + If the sysctl option is enabled, a sysctl option with name
66567 + "chroot_deny_mknod" is created.
66568 +
66569 +config GRKERNSEC_CHROOT_SHMAT
66570 + bool "Deny shmat() out of chroot"
66571 + default y if GRKERNSEC_CONFIG_AUTO
66572 + depends on GRKERNSEC_CHROOT
66573 + help
66574 + If you say Y here, processes inside a chroot will not be able to attach
66575 + to shared memory segments that were created outside of the chroot jail.
66576 + It is recommended that you say Y here. If the sysctl option is enabled,
66577 + a sysctl option with name "chroot_deny_shmat" is created.
66578 +
66579 +config GRKERNSEC_CHROOT_UNIX
66580 + bool "Deny access to abstract AF_UNIX sockets out of chroot"
66581 + default y if GRKERNSEC_CONFIG_AUTO
66582 + depends on GRKERNSEC_CHROOT
66583 + help
66584 + If you say Y here, processes inside a chroot will not be able to
66585 + connect to abstract (meaning not belonging to a filesystem) Unix
66586 + domain sockets that were bound outside of a chroot. It is recommended
66587 + that you say Y here. If the sysctl option is enabled, a sysctl option
66588 + with name "chroot_deny_unix" is created.
66589 +
66590 +config GRKERNSEC_CHROOT_FINDTASK
66591 + bool "Protect outside processes"
66592 + default y if GRKERNSEC_CONFIG_AUTO
66593 + depends on GRKERNSEC_CHROOT
66594 + help
66595 + If you say Y here, processes inside a chroot will not be able to
66596 + kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
66597 + getsid, or view any process outside of the chroot. If the sysctl
66598 + option is enabled, a sysctl option with name "chroot_findtask" is
66599 + created.
66600 +
66601 +config GRKERNSEC_CHROOT_NICE
66602 + bool "Restrict priority changes"
66603 + default y if GRKERNSEC_CONFIG_AUTO
66604 + depends on GRKERNSEC_CHROOT
66605 + help
66606 + If you say Y here, processes inside a chroot will not be able to raise
66607 + the priority of processes in the chroot, or alter the priority of
66608 + processes outside the chroot. This provides more security than simply
66609 + removing CAP_SYS_NICE from the process' capability set. If the
66610 + sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
66611 + is created.
66612 +
66613 +config GRKERNSEC_CHROOT_SYSCTL
66614 + bool "Deny sysctl writes"
66615 + default y if GRKERNSEC_CONFIG_AUTO
66616 + depends on GRKERNSEC_CHROOT
66617 + help
66618 + If you say Y here, an attacker in a chroot will not be able to
66619 + write to sysctl entries, either by sysctl(2) or through a /proc
66620 + interface. It is strongly recommended that you say Y here. If the
66621 + sysctl option is enabled, a sysctl option with name
66622 + "chroot_deny_sysctl" is created.
66623 +
66624 +config GRKERNSEC_CHROOT_CAPS
66625 + bool "Capability restrictions"
66626 + default y if GRKERNSEC_CONFIG_AUTO
66627 + depends on GRKERNSEC_CHROOT
66628 + help
66629 + If you say Y here, the capabilities on all processes within a
66630 + chroot jail will be lowered to stop module insertion, raw i/o,
66631 + system and net admin tasks, rebooting the system, modifying immutable
66632 + files, modifying IPC owned by another, and changing the system time.
66633 + This is left an option because it can break some apps. Disable this
66634 + if your chrooted apps are having problems performing those kinds of
66635 + tasks. If the sysctl option is enabled, a sysctl option with
66636 + name "chroot_caps" is created.
66637 +
66638 +config GRKERNSEC_CHROOT_INITRD
66639 + bool "Exempt initrd tasks from restrictions"
66640 + default y if GRKERNSEC_CONFIG_AUTO
66641 + depends on GRKERNSEC_CHROOT && BLK_DEV_INITRD
66642 + help
66643 + If you say Y here, tasks started prior to init will be exempted from
66644 + grsecurity's chroot restrictions. This option is mainly meant to
66645 + resolve Plymouth's performing privileged operations unnecessarily
66646 + in a chroot.
66647 +
66648 +endmenu
66649 +menu "Kernel Auditing"
66650 +depends on GRKERNSEC
66651 +
66652 +config GRKERNSEC_AUDIT_GROUP
66653 + bool "Single group for auditing"
66654 + help
66655 + If you say Y here, the exec and chdir logging features will only operate
66656 + on a group you specify. This option is recommended if you only want to
66657 + watch certain users instead of having a large amount of logs from the
66658 + entire system. If the sysctl option is enabled, a sysctl option with
66659 + name "audit_group" is created.
66660 +
66661 +config GRKERNSEC_AUDIT_GID
66662 + int "GID for auditing"
66663 + depends on GRKERNSEC_AUDIT_GROUP
66664 + default 1007
66665 +
66666 +config GRKERNSEC_EXECLOG
66667 + bool "Exec logging"
66668 + help
66669 + If you say Y here, all execve() calls will be logged (since the
66670 + other exec*() calls are frontends to execve(), all execution
66671 + will be logged). Useful for shell-servers that like to keep track
66672 + of their users. If the sysctl option is enabled, a sysctl option with
66673 + name "exec_logging" is created.
66674 + WARNING: This option when enabled will produce a LOT of logs, especially
66675 + on an active system.
66676 +
66677 +config GRKERNSEC_RESLOG
66678 + bool "Resource logging"
66679 + default y if GRKERNSEC_CONFIG_AUTO
66680 + help
66681 + If you say Y here, all attempts to overstep resource limits will
66682 + be logged with the resource name, the requested size, and the current
66683 + limit. It is highly recommended that you say Y here. If the sysctl
66684 + option is enabled, a sysctl option with name "resource_logging" is
66685 + created. If the RBAC system is enabled, the sysctl value is ignored.
66686 +
66687 +config GRKERNSEC_CHROOT_EXECLOG
66688 + bool "Log execs within chroot"
66689 + help
66690 + If you say Y here, all executions inside a chroot jail will be logged
66691 + to syslog. This can cause a large amount of logs if certain
66692 + applications (eg. djb's daemontools) are installed on the system, and
66693 + is therefore left as an option. If the sysctl option is enabled, a
66694 + sysctl option with name "chroot_execlog" is created.
66695 +
66696 +config GRKERNSEC_AUDIT_PTRACE
66697 + bool "Ptrace logging"
66698 + help
66699 + If you say Y here, all attempts to attach to a process via ptrace
66700 + will be logged. If the sysctl option is enabled, a sysctl option
66701 + with name "audit_ptrace" is created.
66702 +
66703 +config GRKERNSEC_AUDIT_CHDIR
66704 + bool "Chdir logging"
66705 + help
66706 + If you say Y here, all chdir() calls will be logged. If the sysctl
66707 + option is enabled, a sysctl option with name "audit_chdir" is created.
66708 +
66709 +config GRKERNSEC_AUDIT_MOUNT
66710 + bool "(Un)Mount logging"
66711 + help
66712 + If you say Y here, all mounts and unmounts will be logged. If the
66713 + sysctl option is enabled, a sysctl option with name "audit_mount" is
66714 + created.
66715 +
66716 +config GRKERNSEC_SIGNAL
66717 + bool "Signal logging"
66718 + default y if GRKERNSEC_CONFIG_AUTO
66719 + help
66720 + If you say Y here, certain important signals will be logged, such as
66721 + SIGSEGV, which will as a result inform you of when a error in a program
66722 + occurred, which in some cases could mean a possible exploit attempt.
66723 + If the sysctl option is enabled, a sysctl option with name
66724 + "signal_logging" is created.
66725 +
66726 +config GRKERNSEC_FORKFAIL
66727 + bool "Fork failure logging"
66728 + help
66729 + If you say Y here, all failed fork() attempts will be logged.
66730 + This could suggest a fork bomb, or someone attempting to overstep
66731 + their process limit. If the sysctl option is enabled, a sysctl option
66732 + with name "forkfail_logging" is created.
66733 +
66734 +config GRKERNSEC_TIME
66735 + bool "Time change logging"
66736 + default y if GRKERNSEC_CONFIG_AUTO
66737 + help
66738 + If you say Y here, any changes of the system clock will be logged.
66739 + If the sysctl option is enabled, a sysctl option with name
66740 + "timechange_logging" is created.
66741 +
66742 +config GRKERNSEC_PROC_IPADDR
66743 + bool "/proc/<pid>/ipaddr support"
66744 + default y if GRKERNSEC_CONFIG_AUTO
66745 + help
66746 + If you say Y here, a new entry will be added to each /proc/<pid>
66747 + directory that contains the IP address of the person using the task.
66748 + The IP is carried across local TCP and AF_UNIX stream sockets.
66749 + This information can be useful for IDS/IPSes to perform remote response
66750 + to a local attack. The entry is readable by only the owner of the
66751 + process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
66752 + the RBAC system), and thus does not create privacy concerns.
66753 +
66754 +config GRKERNSEC_RWXMAP_LOG
66755 + bool 'Denied RWX mmap/mprotect logging'
66756 + default y if GRKERNSEC_CONFIG_AUTO
66757 + depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
66758 + help
66759 + If you say Y here, calls to mmap() and mprotect() with explicit
66760 + usage of PROT_WRITE and PROT_EXEC together will be logged when
66761 + denied by the PAX_MPROTECT feature. This feature will also
66762 + log other problematic scenarios that can occur when PAX_MPROTECT
66763 + is enabled on a binary, like textrels and PT_GNU_STACK. If the
66764 + sysctl option is enabled, a sysctl option with name "rwxmap_logging"
66765 + is created.
66766 +
66767 +endmenu
66768 +
66769 +menu "Executable Protections"
66770 +depends on GRKERNSEC
66771 +
66772 +config GRKERNSEC_DMESG
66773 + bool "Dmesg(8) restriction"
66774 + default y if GRKERNSEC_CONFIG_AUTO
66775 + help
66776 + If you say Y here, non-root users will not be able to use dmesg(8)
66777 + to view the contents of the kernel's circular log buffer.
66778 + The kernel's log buffer often contains kernel addresses and other
66779 + identifying information useful to an attacker in fingerprinting a
66780 + system for a targeted exploit.
66781 + If the sysctl option is enabled, a sysctl option with name "dmesg" is
66782 + created.
66783 +
66784 +config GRKERNSEC_HARDEN_PTRACE
66785 + bool "Deter ptrace-based process snooping"
66786 + default y if GRKERNSEC_CONFIG_AUTO
66787 + help
66788 + If you say Y here, TTY sniffers and other malicious monitoring
66789 + programs implemented through ptrace will be defeated. If you
66790 + have been using the RBAC system, this option has already been
66791 + enabled for several years for all users, with the ability to make
66792 + fine-grained exceptions.
66793 +
66794 + This option only affects the ability of non-root users to ptrace
66795 + processes that are not a descendent of the ptracing process.
66796 + This means that strace ./binary and gdb ./binary will still work,
66797 + but attaching to arbitrary processes will not. If the sysctl
66798 + option is enabled, a sysctl option with name "harden_ptrace" is
66799 + created.
66800 +
66801 +config GRKERNSEC_PTRACE_READEXEC
66802 + bool "Require read access to ptrace sensitive binaries"
66803 + default y if GRKERNSEC_CONFIG_AUTO
66804 + help
66805 + If you say Y here, unprivileged users will not be able to ptrace unreadable
66806 + binaries. This option is useful in environments that
66807 + remove the read bits (e.g. file mode 4711) from suid binaries to
66808 + prevent infoleaking of their contents. This option adds
66809 + consistency to the use of that file mode, as the binary could normally
66810 + be read out when run without privileges while ptracing.
66811 +
66812 + If the sysctl option is enabled, a sysctl option with name "ptrace_readexec"
66813 + is created.
66814 +
66815 +config GRKERNSEC_SETXID
66816 + bool "Enforce consistent multithreaded privileges"
66817 + default y if GRKERNSEC_CONFIG_AUTO
66818 + depends on (X86 || SPARC64 || PPC || ARM || MIPS)
66819 + help
66820 + If you say Y here, a change from a root uid to a non-root uid
66821 + in a multithreaded application will cause the resulting uids,
66822 + gids, supplementary groups, and capabilities in that thread
66823 + to be propagated to the other threads of the process. In most
66824 + cases this is unnecessary, as glibc will emulate this behavior
66825 + on behalf of the application. Other libcs do not act in the
66826 + same way, allowing the other threads of the process to continue
66827 + running with root privileges. If the sysctl option is enabled,
66828 + a sysctl option with name "consistent_setxid" is created.
66829 +
66830 +config GRKERNSEC_HARDEN_IPC
66831 + bool "Disallow access to overly-permissive IPC objects"
66832 + default y if GRKERNSEC_CONFIG_AUTO
66833 + depends on SYSVIPC
66834 + help
66835 + If you say Y here, access to overly-permissive IPC objects (shared
66836 + memory, message queues, and semaphores) will be denied for processes
66837 + given the following criteria beyond normal permission checks:
66838 + 1) If the IPC object is world-accessible and the euid doesn't match
66839 + that of the creator or current uid for the IPC object
66840 + 2) If the IPC object is group-accessible and the egid doesn't
66841 + match that of the creator or current gid for the IPC object
66842 + It's a common error to grant too much permission to these objects,
66843 + with impact ranging from denial of service and information leaking to
66844 + privilege escalation. This feature was developed in response to
66845 + research by Tim Brown:
66846 + http://labs.portcullis.co.uk/whitepapers/memory-squatting-attacks-on-system-v-shared-memory/
66847 + who found hundreds of such insecure usages. Processes with
66848 + CAP_IPC_OWNER are still permitted to access these IPC objects.
66849 + If the sysctl option is enabled, a sysctl option with name
66850 + "harden_ipc" is created.
66851 +
66852 +config GRKERNSEC_TPE
66853 + bool "Trusted Path Execution (TPE)"
66854 + default y if GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_SERVER
66855 + help
66856 + If you say Y here, you will be able to choose a gid to add to the
66857 + supplementary groups of users you want to mark as "untrusted."
66858 + These users will not be able to execute any files that are not in
66859 + root-owned directories writable only by root. If the sysctl option
66860 + is enabled, a sysctl option with name "tpe" is created.
66861 +
66862 +config GRKERNSEC_TPE_ALL
66863 + bool "Partially restrict all non-root users"
66864 + depends on GRKERNSEC_TPE
66865 + help
66866 + If you say Y here, all non-root users will be covered under
66867 + a weaker TPE restriction. This is separate from, and in addition to,
66868 + the main TPE options that you have selected elsewhere. Thus, if a
66869 + "trusted" GID is chosen, this restriction applies to even that GID.
66870 + Under this restriction, all non-root users will only be allowed to
66871 + execute files in directories they own that are not group or
66872 + world-writable, or in directories owned by root and writable only by
66873 + root. If the sysctl option is enabled, a sysctl option with name
66874 + "tpe_restrict_all" is created.
66875 +
66876 +config GRKERNSEC_TPE_INVERT
66877 + bool "Invert GID option"
66878 + depends on GRKERNSEC_TPE
66879 + help
66880 + If you say Y here, the group you specify in the TPE configuration will
66881 + decide what group TPE restrictions will be *disabled* for. This
66882 + option is useful if you want TPE restrictions to be applied to most
66883 + users on the system. If the sysctl option is enabled, a sysctl option
66884 + with name "tpe_invert" is created. Unlike other sysctl options, this
66885 + entry will default to on for backward-compatibility.
66886 +
66887 +config GRKERNSEC_TPE_GID
66888 + int
66889 + default GRKERNSEC_TPE_UNTRUSTED_GID if (GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT)
66890 + default GRKERNSEC_TPE_TRUSTED_GID if (GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT)
66891 +
66892 +config GRKERNSEC_TPE_UNTRUSTED_GID
66893 + int "GID for TPE-untrusted users"
66894 + depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
66895 + default 1005
66896 + help
66897 + Setting this GID determines what group TPE restrictions will be
66898 + *enabled* for. If the sysctl option is enabled, a sysctl option
66899 + with name "tpe_gid" is created.
66900 +
66901 +config GRKERNSEC_TPE_TRUSTED_GID
66902 + int "GID for TPE-trusted users"
66903 + depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
66904 + default 1005
66905 + help
66906 + Setting this GID determines what group TPE restrictions will be
66907 + *disabled* for. If the sysctl option is enabled, a sysctl option
66908 + with name "tpe_gid" is created.
66909 +
66910 +endmenu
66911 +menu "Network Protections"
66912 +depends on GRKERNSEC
66913 +
66914 +config GRKERNSEC_RANDNET
66915 + bool "Larger entropy pools"
66916 + default y if GRKERNSEC_CONFIG_AUTO
66917 + help
66918 + If you say Y here, the entropy pools used for many features of Linux
66919 + and grsecurity will be doubled in size. Since several grsecurity
66920 + features use additional randomness, it is recommended that you say Y
66921 + here. Saying Y here has a similar effect as modifying
66922 + /proc/sys/kernel/random/poolsize.
66923 +
66924 +config GRKERNSEC_BLACKHOLE
66925 + bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
66926 + default y if GRKERNSEC_CONFIG_AUTO
66927 + depends on NET
66928 + help
66929 + If you say Y here, neither TCP resets nor ICMP
66930 + destination-unreachable packets will be sent in response to packets
66931 + sent to ports for which no associated listening process exists.
66932 + This feature supports both IPV4 and IPV6 and exempts the
66933 + loopback interface from blackholing. Enabling this feature
66934 + makes a host more resilient to DoS attacks and reduces network
66935 + visibility against scanners.
66936 +
66937 + The blackhole feature as-implemented is equivalent to the FreeBSD
66938 + blackhole feature, as it prevents RST responses to all packets, not
66939 + just SYNs. Under most application behavior this causes no
66940 + problems, but applications (like haproxy) may not close certain
66941 + connections in a way that cleanly terminates them on the remote
66942 + end, leaving the remote host in LAST_ACK state. Because of this
66943 + side-effect and to prevent intentional LAST_ACK DoSes, this
66944 + feature also adds automatic mitigation against such attacks.
66945 + The mitigation drastically reduces the amount of time a socket
66946 + can spend in LAST_ACK state. If you're using haproxy and not
66947 + all servers it connects to have this option enabled, consider
66948 + disabling this feature on the haproxy host.
66949 +
66950 + If the sysctl option is enabled, two sysctl options with names
66951 + "ip_blackhole" and "lastack_retries" will be created.
66952 + While "ip_blackhole" takes the standard zero/non-zero on/off
66953 + toggle, "lastack_retries" uses the same kinds of values as
66954 + "tcp_retries1" and "tcp_retries2". The default value of 4
66955 + prevents a socket from lasting more than 45 seconds in LAST_ACK
66956 + state.
66957 +
66958 +config GRKERNSEC_NO_SIMULT_CONNECT
66959 + bool "Disable TCP Simultaneous Connect"
66960 + default y if GRKERNSEC_CONFIG_AUTO
66961 + depends on NET
66962 + help
66963 + If you say Y here, a feature by Willy Tarreau will be enabled that
66964 + removes a weakness in Linux's strict implementation of TCP that
66965 + allows two clients to connect to each other without either entering
66966 + a listening state. The weakness allows an attacker to easily prevent
66967 + a client from connecting to a known server provided the source port
66968 + for the connection is guessed correctly.
66969 +
66970 + As the weakness could be used to prevent an antivirus or IPS from
66971 + fetching updates, or prevent an SSL gateway from fetching a CRL,
66972 + it should be eliminated by enabling this option. Though Linux is
66973 + one of few operating systems supporting simultaneous connect, it
66974 + has no legitimate use in practice and is rarely supported by firewalls.
66975 +
66976 +config GRKERNSEC_SOCKET
66977 + bool "Socket restrictions"
66978 + depends on NET
66979 + help
66980 + If you say Y here, you will be able to choose from several options.
66981 + If you assign a GID on your system and add it to the supplementary
66982 + groups of users you want to restrict socket access to, this patch
66983 + will perform up to three things, based on the option(s) you choose.
66984 +
66985 +config GRKERNSEC_SOCKET_ALL
66986 + bool "Deny any sockets to group"
66987 + depends on GRKERNSEC_SOCKET
66988 + help
66989 + If you say Y here, you will be able to choose a GID of whose users will
66990 + be unable to connect to other hosts from your machine or run server
66991 + applications from your machine. If the sysctl option is enabled, a
66992 + sysctl option with name "socket_all" is created.
66993 +
66994 +config GRKERNSEC_SOCKET_ALL_GID
66995 + int "GID to deny all sockets for"
66996 + depends on GRKERNSEC_SOCKET_ALL
66997 + default 1004
66998 + help
66999 + Here you can choose the GID to disable socket access for. Remember to
67000 + add the users you want socket access disabled for to the GID
67001 + specified here. If the sysctl option is enabled, a sysctl option
67002 + with name "socket_all_gid" is created.
67003 +
67004 +config GRKERNSEC_SOCKET_CLIENT
67005 + bool "Deny client sockets to group"
67006 + depends on GRKERNSEC_SOCKET
67007 + help
67008 + If you say Y here, you will be able to choose a GID of whose users will
67009 + be unable to connect to other hosts from your machine, but will be
67010 + able to run servers. If this option is enabled, all users in the group
67011 + you specify will have to use passive mode when initiating ftp transfers
67012 + from the shell on your machine. If the sysctl option is enabled, a
67013 + sysctl option with name "socket_client" is created.
67014 +
67015 +config GRKERNSEC_SOCKET_CLIENT_GID
67016 + int "GID to deny client sockets for"
67017 + depends on GRKERNSEC_SOCKET_CLIENT
67018 + default 1003
67019 + help
67020 + Here you can choose the GID to disable client socket access for.
67021 + Remember to add the users you want client socket access disabled for to
67022 + the GID specified here. If the sysctl option is enabled, a sysctl
67023 + option with name "socket_client_gid" is created.
67024 +
67025 +config GRKERNSEC_SOCKET_SERVER
67026 + bool "Deny server sockets to group"
67027 + depends on GRKERNSEC_SOCKET
67028 + help
67029 + If you say Y here, you will be able to choose a GID of whose users will
67030 + be unable to run server applications from your machine. If the sysctl
67031 + option is enabled, a sysctl option with name "socket_server" is created.
67032 +
67033 +config GRKERNSEC_SOCKET_SERVER_GID
67034 + int "GID to deny server sockets for"
67035 + depends on GRKERNSEC_SOCKET_SERVER
67036 + default 1002
67037 + help
67038 + Here you can choose the GID to disable server socket access for.
67039 + Remember to add the users you want server socket access disabled for to
67040 + the GID specified here. If the sysctl option is enabled, a sysctl
67041 + option with name "socket_server_gid" is created.
67042 +
67043 +endmenu
67044 +
67045 +menu "Physical Protections"
67046 +depends on GRKERNSEC
67047 +
67048 +config GRKERNSEC_DENYUSB
67049 + bool "Deny new USB connections after toggle"
67050 + default y if GRKERNSEC_CONFIG_AUTO
67051 + depends on SYSCTL && USB_SUPPORT
67052 + help
67053 + If you say Y here, a new sysctl option with name "deny_new_usb"
67054 + will be created. Setting its value to 1 will prevent any new
67055 + USB devices from being recognized by the OS. Any attempted USB
67056 + device insertion will be logged. This option is intended to be
67057 + used against custom USB devices designed to exploit vulnerabilities
67058 + in various USB device drivers.
67059 +
67060 + For greatest effectiveness, this sysctl should be set after any
67061 + relevant init scripts. This option is safe to enable in distros
67062 + as each user can choose whether or not to toggle the sysctl.
67063 +
67064 +config GRKERNSEC_DENYUSB_FORCE
67065 + bool "Reject all USB devices not connected at boot"
67066 + select USB
67067 + depends on GRKERNSEC_DENYUSB
67068 + help
67069 + If you say Y here, a variant of GRKERNSEC_DENYUSB will be enabled
67070 + that doesn't involve a sysctl entry. This option should only be
67071 + enabled if you're sure you want to deny all new USB connections
67072 + at runtime and don't want to modify init scripts. This should not
67073 + be enabled by distros. It forces the core USB code to be built
67074 + into the kernel image so that all devices connected at boot time
67075 + can be recognized and new USB device connections can be prevented
67076 + prior to init running.
67077 +
67078 +endmenu
67079 +
67080 +menu "Sysctl Support"
67081 +depends on GRKERNSEC && SYSCTL
67082 +
67083 +config GRKERNSEC_SYSCTL
67084 + bool "Sysctl support"
67085 + default y if GRKERNSEC_CONFIG_AUTO
67086 + help
67087 + If you say Y here, you will be able to change the options that
67088 + grsecurity runs with at bootup, without having to recompile your
67089 + kernel. You can echo values to files in /proc/sys/kernel/grsecurity
67090 + to enable (1) or disable (0) various features. All the sysctl entries
67091 + are mutable until the "grsec_lock" entry is set to a non-zero value.
67092 + All features enabled in the kernel configuration are disabled at boot
67093 + if you do not say Y to the "Turn on features by default" option.
67094 + All options should be set at startup, and the grsec_lock entry should
67095 + be set to a non-zero value after all the options are set.
67096 + *THIS IS EXTREMELY IMPORTANT*
67097 +
67098 +config GRKERNSEC_SYSCTL_DISTRO
67099 + bool "Extra sysctl support for distro makers (READ HELP)"
67100 + depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
67101 + help
67102 + If you say Y here, additional sysctl options will be created
67103 + for features that affect processes running as root. Therefore,
67104 + it is critical when using this option that the grsec_lock entry be
67105 + enabled after boot. Only distros with prebuilt kernel packages
67106 + with this option enabled that can ensure grsec_lock is enabled
67107 + after boot should use this option.
67108 + *Failure to set grsec_lock after boot makes all grsec features
67109 + this option covers useless*
67110 +
67111 + Currently this option creates the following sysctl entries:
67112 + "Disable Privileged I/O": "disable_priv_io"
67113 +
67114 +config GRKERNSEC_SYSCTL_ON
67115 + bool "Turn on features by default"
67116 + default y if GRKERNSEC_CONFIG_AUTO
67117 + depends on GRKERNSEC_SYSCTL
67118 + help
67119 + If you say Y here, instead of having all features enabled in the
67120 + kernel configuration disabled at boot time, the features will be
67121 + enabled at boot time. It is recommended you say Y here unless
67122 + there is some reason you would want all sysctl-tunable features to
67123 + be disabled by default. As mentioned elsewhere, it is important
67124 + to enable the grsec_lock entry once you have finished modifying
67125 + the sysctl entries.
67126 +
67127 +endmenu
67128 +menu "Logging Options"
67129 +depends on GRKERNSEC
67130 +
67131 +config GRKERNSEC_FLOODTIME
67132 + int "Seconds in between log messages (minimum)"
67133 + default 10
67134 + help
67135 + This option allows you to enforce the number of seconds between
67136 + grsecurity log messages. The default should be suitable for most
67137 + people, however, if you choose to change it, choose a value small enough
67138 + to allow informative logs to be produced, but large enough to
67139 + prevent flooding.
67140 +
67141 + Setting both this value and GRKERNSEC_FLOODBURST to 0 will disable
67142 + any rate limiting on grsecurity log messages.
67143 +
67144 +config GRKERNSEC_FLOODBURST
67145 + int "Number of messages in a burst (maximum)"
67146 + default 6
67147 + help
67148 + This option allows you to choose the maximum number of messages allowed
67149 + within the flood time interval you chose in a separate option. The
67150 + default should be suitable for most people, however if you find that
67151 + many of your logs are being interpreted as flooding, you may want to
67152 + raise this value.
67153 +
67154 + Setting both this value and GRKERNSEC_FLOODTIME to 0 will disable
67155 + any rate limiting on grsecurity log messages.
67156 +
67157 +endmenu
67158 diff --git a/grsecurity/Makefile b/grsecurity/Makefile
67159 new file mode 100644
67160 index 0000000..30ababb
67161 --- /dev/null
67162 +++ b/grsecurity/Makefile
67163 @@ -0,0 +1,54 @@
67164 +# grsecurity – access control and security hardening for Linux
67165 +# All code in this directory and various hooks located throughout the Linux kernel are
67166 +# Copyright (C) 2001-2014 Bradley Spengler, Open Source Security, Inc.
67167 +# http://www.grsecurity.net spender@grsecurity.net
67168 +#
67169 +# This program is free software; you can redistribute it and/or
67170 +# modify it under the terms of the GNU General Public License version 2
67171 +# as published by the Free Software Foundation.
67172 +#
67173 +# This program is distributed in the hope that it will be useful,
67174 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
67175 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
67176 +# GNU General Public License for more details.
67177 +#
67178 +# You should have received a copy of the GNU General Public License
67179 +# along with this program; if not, write to the Free Software
67180 +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
67181 +
67182 +KBUILD_CFLAGS += -Werror
67183 +
67184 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
67185 + grsec_mount.o grsec_sig.o grsec_sysctl.o \
67186 + grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o \
67187 + grsec_usb.o grsec_ipc.o grsec_proc.o
67188 +
67189 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
67190 + gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
67191 + gracl_learn.o grsec_log.o gracl_policy.o
67192 +ifdef CONFIG_COMPAT
67193 +obj-$(CONFIG_GRKERNSEC) += gracl_compat.o
67194 +endif
67195 +
67196 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
67197 +
67198 +ifdef CONFIG_NET
67199 +obj-y += grsec_sock.o
67200 +obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
67201 +endif
67202 +
67203 +ifndef CONFIG_GRKERNSEC
67204 +obj-y += grsec_disabled.o
67205 +endif
67206 +
67207 +ifdef CONFIG_GRKERNSEC_HIDESYM
67208 +extra-y := grsec_hidesym.o
67209 +$(obj)/grsec_hidesym.o:
67210 + @-chmod -f 500 /boot
67211 + @-chmod -f 500 /lib/modules
67212 + @-chmod -f 500 /lib64/modules
67213 + @-chmod -f 500 /lib32/modules
67214 + @-chmod -f 700 .
67215 + @-chmod -f 700 $(objtree)
67216 + @echo ' grsec: protected kernel image paths'
67217 +endif
67218 diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
67219 new file mode 100644
67220 index 0000000..e56396f
67221 --- /dev/null
67222 +++ b/grsecurity/gracl.c
67223 @@ -0,0 +1,2679 @@
67224 +#include <linux/kernel.h>
67225 +#include <linux/module.h>
67226 +#include <linux/sched.h>
67227 +#include <linux/mm.h>
67228 +#include <linux/file.h>
67229 +#include <linux/fs.h>
67230 +#include <linux/namei.h>
67231 +#include <linux/mount.h>
67232 +#include <linux/tty.h>
67233 +#include <linux/proc_fs.h>
67234 +#include <linux/lglock.h>
67235 +#include <linux/slab.h>
67236 +#include <linux/vmalloc.h>
67237 +#include <linux/types.h>
67238 +#include <linux/sysctl.h>
67239 +#include <linux/netdevice.h>
67240 +#include <linux/ptrace.h>
67241 +#include <linux/gracl.h>
67242 +#include <linux/gralloc.h>
67243 +#include <linux/security.h>
67244 +#include <linux/grinternal.h>
67245 +#include <linux/pid_namespace.h>
67246 +#include <linux/stop_machine.h>
67247 +#include <linux/fdtable.h>
67248 +#include <linux/percpu.h>
67249 +#include <linux/lglock.h>
67250 +#include <linux/hugetlb.h>
67251 +#include <linux/posix-timers.h>
67252 +#include <linux/prefetch.h>
67253 +#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
67254 +#include <linux/magic.h>
67255 +#include <linux/pagemap.h>
67256 +#include "../fs/btrfs/async-thread.h"
67257 +#include "../fs/btrfs/ctree.h"
67258 +#include "../fs/btrfs/btrfs_inode.h"
67259 +#endif
67260 +#include "../fs/mount.h"
67261 +
67262 +#include <asm/uaccess.h>
67263 +#include <asm/errno.h>
67264 +#include <asm/mman.h>
67265 +
67266 +#define FOR_EACH_ROLE_START(role) \
67267 + role = running_polstate.role_list; \
67268 + while (role) {
67269 +
67270 +#define FOR_EACH_ROLE_END(role) \
67271 + role = role->prev; \
67272 + }
67273 +
67274 +extern struct path gr_real_root;
67275 +
67276 +static struct gr_policy_state running_polstate;
67277 +struct gr_policy_state *polstate = &running_polstate;
67278 +extern struct gr_alloc_state *current_alloc_state;
67279 +
67280 +extern char *gr_shared_page[4];
67281 +DEFINE_RWLOCK(gr_inode_lock);
67282 +
67283 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
67284 +
67285 +#ifdef CONFIG_NET
67286 +extern struct vfsmount *sock_mnt;
67287 +#endif
67288 +
67289 +extern struct vfsmount *pipe_mnt;
67290 +extern struct vfsmount *shm_mnt;
67291 +
67292 +#ifdef CONFIG_HUGETLBFS
67293 +extern struct vfsmount *hugetlbfs_vfsmount[HUGE_MAX_HSTATE];
67294 +#endif
67295 +
67296 +extern u16 acl_sp_role_value;
67297 +extern struct acl_object_label *fakefs_obj_rw;
67298 +extern struct acl_object_label *fakefs_obj_rwx;
67299 +
67300 +int gr_acl_is_enabled(void)
67301 +{
67302 + return (gr_status & GR_READY);
67303 +}
67304 +
67305 +void gr_enable_rbac_system(void)
67306 +{
67307 + pax_open_kernel();
67308 + gr_status |= GR_READY;
67309 + pax_close_kernel();
67310 +}
67311 +
67312 +int gr_rbac_disable(void *unused)
67313 +{
67314 + pax_open_kernel();
67315 + gr_status &= ~GR_READY;
67316 + pax_close_kernel();
67317 +
67318 + return 0;
67319 +}
67320 +
67321 +static inline dev_t __get_dev(const struct dentry *dentry)
67322 +{
67323 +#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
67324 + if (dentry->d_sb->s_magic == BTRFS_SUPER_MAGIC)
67325 + return BTRFS_I(dentry->d_inode)->root->anon_dev;
67326 + else
67327 +#endif
67328 + return dentry->d_sb->s_dev;
67329 +}
67330 +
67331 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
67332 +{
67333 + return __get_dev(dentry);
67334 +}
67335 +
67336 +static char gr_task_roletype_to_char(struct task_struct *task)
67337 +{
67338 + switch (task->role->roletype &
67339 + (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
67340 + GR_ROLE_SPECIAL)) {
67341 + case GR_ROLE_DEFAULT:
67342 + return 'D';
67343 + case GR_ROLE_USER:
67344 + return 'U';
67345 + case GR_ROLE_GROUP:
67346 + return 'G';
67347 + case GR_ROLE_SPECIAL:
67348 + return 'S';
67349 + }
67350 +
67351 + return 'X';
67352 +}
67353 +
67354 +char gr_roletype_to_char(void)
67355 +{
67356 + return gr_task_roletype_to_char(current);
67357 +}
67358 +
67359 +__inline__ int
67360 +gr_acl_tpe_check(void)
67361 +{
67362 + if (unlikely(!(gr_status & GR_READY)))
67363 + return 0;
67364 + if (current->role->roletype & GR_ROLE_TPE)
67365 + return 1;
67366 + else
67367 + return 0;
67368 +}
67369 +
67370 +int
67371 +gr_handle_rawio(const struct inode *inode)
67372 +{
67373 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
67374 + if (inode && (S_ISBLK(inode->i_mode) || (S_ISCHR(inode->i_mode) && imajor(inode) == RAW_MAJOR)) &&
67375 + grsec_enable_chroot_caps && proc_is_chrooted(current) &&
67376 + !capable(CAP_SYS_RAWIO))
67377 + return 1;
67378 +#endif
67379 + return 0;
67380 +}
67381 +
67382 +int
67383 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
67384 +{
67385 + if (likely(lena != lenb))
67386 + return 0;
67387 +
67388 + return !memcmp(a, b, lena);
67389 +}
67390 +
67391 +static int prepend(char **buffer, int *buflen, const char *str, int namelen)
67392 +{
67393 + *buflen -= namelen;
67394 + if (*buflen < 0)
67395 + return -ENAMETOOLONG;
67396 + *buffer -= namelen;
67397 + memcpy(*buffer, str, namelen);
67398 + return 0;
67399 +}
67400 +
67401 +static int prepend_name(char **buffer, int *buflen, struct qstr *name)
67402 +{
67403 + return prepend(buffer, buflen, name->name, name->len);
67404 +}
67405 +
67406 +static int prepend_path(const struct path *path, struct path *root,
67407 + char **buffer, int *buflen)
67408 +{
67409 + struct dentry *dentry = path->dentry;
67410 + struct vfsmount *vfsmnt = path->mnt;
67411 + struct mount *mnt = real_mount(vfsmnt);
67412 + bool slash = false;
67413 + int error = 0;
67414 +
67415 + while (dentry != root->dentry || vfsmnt != root->mnt) {
67416 + struct dentry * parent;
67417 +
67418 + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
67419 + /* Global root? */
67420 + if (!mnt_has_parent(mnt)) {
67421 + goto out;
67422 + }
67423 + dentry = mnt->mnt_mountpoint;
67424 + mnt = mnt->mnt_parent;
67425 + vfsmnt = &mnt->mnt;
67426 + continue;
67427 + }
67428 + parent = dentry->d_parent;
67429 + prefetch(parent);
67430 + spin_lock(&dentry->d_lock);
67431 + error = prepend_name(buffer, buflen, &dentry->d_name);
67432 + spin_unlock(&dentry->d_lock);
67433 + if (!error)
67434 + error = prepend(buffer, buflen, "/", 1);
67435 + if (error)
67436 + break;
67437 +
67438 + slash = true;
67439 + dentry = parent;
67440 + }
67441 +
67442 +out:
67443 + if (!error && !slash)
67444 + error = prepend(buffer, buflen, "/", 1);
67445 +
67446 + return error;
67447 +}
67448 +
67449 +/* this must be called with mount_lock and rename_lock held */
67450 +
67451 +static char *__our_d_path(const struct path *path, struct path *root,
67452 + char *buf, int buflen)
67453 +{
67454 + char *res = buf + buflen;
67455 + int error;
67456 +
67457 + prepend(&res, &buflen, "\0", 1);
67458 + error = prepend_path(path, root, &res, &buflen);
67459 + if (error)
67460 + return ERR_PTR(error);
67461 +
67462 + return res;
67463 +}
67464 +
67465 +static char *
67466 +gen_full_path(struct path *path, struct path *root, char *buf, int buflen)
67467 +{
67468 + char *retval;
67469 +
67470 + retval = __our_d_path(path, root, buf, buflen);
67471 + if (unlikely(IS_ERR(retval)))
67472 + retval = strcpy(buf, "<path too long>");
67473 + else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
67474 + retval[1] = '\0';
67475 +
67476 + return retval;
67477 +}
67478 +
67479 +static char *
67480 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
67481 + char *buf, int buflen)
67482 +{
67483 + struct path path;
67484 + char *res;
67485 +
67486 + path.dentry = (struct dentry *)dentry;
67487 + path.mnt = (struct vfsmount *)vfsmnt;
67488 +
67489 + /* we can use gr_real_root.dentry, gr_real_root.mnt, because this is only called
67490 + by the RBAC system */
67491 + res = gen_full_path(&path, &gr_real_root, buf, buflen);
67492 +
67493 + return res;
67494 +}
67495 +
67496 +static char *
67497 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
67498 + char *buf, int buflen)
67499 +{
67500 + char *res;
67501 + struct path path;
67502 + struct path root;
67503 + struct task_struct *reaper = init_pid_ns.child_reaper;
67504 +
67505 + path.dentry = (struct dentry *)dentry;
67506 + path.mnt = (struct vfsmount *)vfsmnt;
67507 +
67508 + /* we can't use gr_real_root.dentry, gr_real_root.mnt, because they belong only to the RBAC system */
67509 + get_fs_root(reaper->fs, &root);
67510 +
67511 + read_seqlock_excl(&mount_lock);
67512 + write_seqlock(&rename_lock);
67513 + res = gen_full_path(&path, &root, buf, buflen);
67514 + write_sequnlock(&rename_lock);
67515 + read_sequnlock_excl(&mount_lock);
67516 +
67517 + path_put(&root);
67518 + return res;
67519 +}
67520 +
67521 +char *
67522 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
67523 +{
67524 + char *ret;
67525 + read_seqlock_excl(&mount_lock);
67526 + write_seqlock(&rename_lock);
67527 + ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
67528 + PAGE_SIZE);
67529 + write_sequnlock(&rename_lock);
67530 + read_sequnlock_excl(&mount_lock);
67531 + return ret;
67532 +}
67533 +
67534 +static char *
67535 +gr_to_proc_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
67536 +{
67537 + char *ret;
67538 + char *buf;
67539 + int buflen;
67540 +
67541 + read_seqlock_excl(&mount_lock);
67542 + write_seqlock(&rename_lock);
67543 + buf = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
67544 + ret = __d_real_path(dentry, mnt, buf, PAGE_SIZE - 6);
67545 + buflen = (int)(ret - buf);
67546 + if (buflen >= 5)
67547 + prepend(&ret, &buflen, "/proc", 5);
67548 + else
67549 + ret = strcpy(buf, "<path too long>");
67550 + write_sequnlock(&rename_lock);
67551 + read_sequnlock_excl(&mount_lock);
67552 + return ret;
67553 +}
67554 +
67555 +char *
67556 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
67557 +{
67558 + return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
67559 + PAGE_SIZE);
67560 +}
67561 +
67562 +char *
67563 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
67564 +{
67565 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
67566 + PAGE_SIZE);
67567 +}
67568 +
67569 +char *
67570 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
67571 +{
67572 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
67573 + PAGE_SIZE);
67574 +}
67575 +
67576 +char *
67577 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
67578 +{
67579 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
67580 + PAGE_SIZE);
67581 +}
67582 +
67583 +char *
67584 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
67585 +{
67586 + return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
67587 + PAGE_SIZE);
67588 +}
67589 +
67590 +__inline__ __u32
67591 +to_gr_audit(const __u32 reqmode)
67592 +{
67593 + /* masks off auditable permission flags, then shifts them to create
67594 + auditing flags, and adds the special case of append auditing if
67595 + we're requesting write */
67596 + return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
67597 +}
67598 +
67599 +struct acl_role_label *
67600 +__lookup_acl_role_label(const struct gr_policy_state *state, const struct task_struct *task, const uid_t uid,
67601 + const gid_t gid)
67602 +{
67603 + unsigned int index = gr_rhash(uid, GR_ROLE_USER, state->acl_role_set.r_size);
67604 + struct acl_role_label *match;
67605 + struct role_allowed_ip *ipp;
67606 + unsigned int x;
67607 + u32 curr_ip = task->signal->saved_ip;
67608 +
67609 + match = state->acl_role_set.r_hash[index];
67610 +
67611 + while (match) {
67612 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
67613 + for (x = 0; x < match->domain_child_num; x++) {
67614 + if (match->domain_children[x] == uid)
67615 + goto found;
67616 + }
67617 + } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
67618 + break;
67619 + match = match->next;
67620 + }
67621 +found:
67622 + if (match == NULL) {
67623 + try_group:
67624 + index = gr_rhash(gid, GR_ROLE_GROUP, state->acl_role_set.r_size);
67625 + match = state->acl_role_set.r_hash[index];
67626 +
67627 + while (match) {
67628 + if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
67629 + for (x = 0; x < match->domain_child_num; x++) {
67630 + if (match->domain_children[x] == gid)
67631 + goto found2;
67632 + }
67633 + } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
67634 + break;
67635 + match = match->next;
67636 + }
67637 +found2:
67638 + if (match == NULL)
67639 + match = state->default_role;
67640 + if (match->allowed_ips == NULL)
67641 + return match;
67642 + else {
67643 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
67644 + if (likely
67645 + ((ntohl(curr_ip) & ipp->netmask) ==
67646 + (ntohl(ipp->addr) & ipp->netmask)))
67647 + return match;
67648 + }
67649 + match = state->default_role;
67650 + }
67651 + } else if (match->allowed_ips == NULL) {
67652 + return match;
67653 + } else {
67654 + for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
67655 + if (likely
67656 + ((ntohl(curr_ip) & ipp->netmask) ==
67657 + (ntohl(ipp->addr) & ipp->netmask)))
67658 + return match;
67659 + }
67660 + goto try_group;
67661 + }
67662 +
67663 + return match;
67664 +}
67665 +
67666 +static struct acl_role_label *
67667 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
67668 + const gid_t gid)
67669 +{
67670 + return __lookup_acl_role_label(&running_polstate, task, uid, gid);
67671 +}
67672 +
67673 +struct acl_subject_label *
67674 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
67675 + const struct acl_role_label *role)
67676 +{
67677 + unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
67678 + struct acl_subject_label *match;
67679 +
67680 + match = role->subj_hash[index];
67681 +
67682 + while (match && (match->inode != ino || match->device != dev ||
67683 + (match->mode & GR_DELETED))) {
67684 + match = match->next;
67685 + }
67686 +
67687 + if (match && !(match->mode & GR_DELETED))
67688 + return match;
67689 + else
67690 + return NULL;
67691 +}
67692 +
67693 +struct acl_subject_label *
67694 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
67695 + const struct acl_role_label *role)
67696 +{
67697 + unsigned int index = gr_fhash(ino, dev, role->subj_hash_size);
67698 + struct acl_subject_label *match;
67699 +
67700 + match = role->subj_hash[index];
67701 +
67702 + while (match && (match->inode != ino || match->device != dev ||
67703 + !(match->mode & GR_DELETED))) {
67704 + match = match->next;
67705 + }
67706 +
67707 + if (match && (match->mode & GR_DELETED))
67708 + return match;
67709 + else
67710 + return NULL;
67711 +}
67712 +
67713 +static struct acl_object_label *
67714 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
67715 + const struct acl_subject_label *subj)
67716 +{
67717 + unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
67718 + struct acl_object_label *match;
67719 +
67720 + match = subj->obj_hash[index];
67721 +
67722 + while (match && (match->inode != ino || match->device != dev ||
67723 + (match->mode & GR_DELETED))) {
67724 + match = match->next;
67725 + }
67726 +
67727 + if (match && !(match->mode & GR_DELETED))
67728 + return match;
67729 + else
67730 + return NULL;
67731 +}
67732 +
67733 +static struct acl_object_label *
67734 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
67735 + const struct acl_subject_label *subj)
67736 +{
67737 + unsigned int index = gr_fhash(ino, dev, subj->obj_hash_size);
67738 + struct acl_object_label *match;
67739 +
67740 + match = subj->obj_hash[index];
67741 +
67742 + while (match && (match->inode != ino || match->device != dev ||
67743 + !(match->mode & GR_DELETED))) {
67744 + match = match->next;
67745 + }
67746 +
67747 + if (match && (match->mode & GR_DELETED))
67748 + return match;
67749 +
67750 + match = subj->obj_hash[index];
67751 +
67752 + while (match && (match->inode != ino || match->device != dev ||
67753 + (match->mode & GR_DELETED))) {
67754 + match = match->next;
67755 + }
67756 +
67757 + if (match && !(match->mode & GR_DELETED))
67758 + return match;
67759 + else
67760 + return NULL;
67761 +}
67762 +
67763 +struct name_entry *
67764 +__lookup_name_entry(const struct gr_policy_state *state, const char *name)
67765 +{
67766 + unsigned int len = strlen(name);
67767 + unsigned int key = full_name_hash(name, len);
67768 + unsigned int index = key % state->name_set.n_size;
67769 + struct name_entry *match;
67770 +
67771 + match = state->name_set.n_hash[index];
67772 +
67773 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
67774 + match = match->next;
67775 +
67776 + return match;
67777 +}
67778 +
67779 +static struct name_entry *
67780 +lookup_name_entry(const char *name)
67781 +{
67782 + return __lookup_name_entry(&running_polstate, name);
67783 +}
67784 +
67785 +static struct name_entry *
67786 +lookup_name_entry_create(const char *name)
67787 +{
67788 + unsigned int len = strlen(name);
67789 + unsigned int key = full_name_hash(name, len);
67790 + unsigned int index = key % running_polstate.name_set.n_size;
67791 + struct name_entry *match;
67792 +
67793 + match = running_polstate.name_set.n_hash[index];
67794 +
67795 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
67796 + !match->deleted))
67797 + match = match->next;
67798 +
67799 + if (match && match->deleted)
67800 + return match;
67801 +
67802 + match = running_polstate.name_set.n_hash[index];
67803 +
67804 + while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
67805 + match->deleted))
67806 + match = match->next;
67807 +
67808 + if (match && !match->deleted)
67809 + return match;
67810 + else
67811 + return NULL;
67812 +}
67813 +
67814 +static struct inodev_entry *
67815 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
67816 +{
67817 + unsigned int index = gr_fhash(ino, dev, running_polstate.inodev_set.i_size);
67818 + struct inodev_entry *match;
67819 +
67820 + match = running_polstate.inodev_set.i_hash[index];
67821 +
67822 + while (match && (match->nentry->inode != ino || match->nentry->device != dev))
67823 + match = match->next;
67824 +
67825 + return match;
67826 +}
67827 +
67828 +void
67829 +__insert_inodev_entry(const struct gr_policy_state *state, struct inodev_entry *entry)
67830 +{
67831 + unsigned int index = gr_fhash(entry->nentry->inode, entry->nentry->device,
67832 + state->inodev_set.i_size);
67833 + struct inodev_entry **curr;
67834 +
67835 + entry->prev = NULL;
67836 +
67837 + curr = &state->inodev_set.i_hash[index];
67838 + if (*curr != NULL)
67839 + (*curr)->prev = entry;
67840 +
67841 + entry->next = *curr;
67842 + *curr = entry;
67843 +
67844 + return;
67845 +}
67846 +
67847 +static void
67848 +insert_inodev_entry(struct inodev_entry *entry)
67849 +{
67850 + __insert_inodev_entry(&running_polstate, entry);
67851 +}
67852 +
67853 +void
67854 +insert_acl_obj_label(struct acl_object_label *obj,
67855 + struct acl_subject_label *subj)
67856 +{
67857 + unsigned int index =
67858 + gr_fhash(obj->inode, obj->device, subj->obj_hash_size);
67859 + struct acl_object_label **curr;
67860 +
67861 + obj->prev = NULL;
67862 +
67863 + curr = &subj->obj_hash[index];
67864 + if (*curr != NULL)
67865 + (*curr)->prev = obj;
67866 +
67867 + obj->next = *curr;
67868 + *curr = obj;
67869 +
67870 + return;
67871 +}
67872 +
67873 +void
67874 +insert_acl_subj_label(struct acl_subject_label *obj,
67875 + struct acl_role_label *role)
67876 +{
67877 + unsigned int index = gr_fhash(obj->inode, obj->device, role->subj_hash_size);
67878 + struct acl_subject_label **curr;
67879 +
67880 + obj->prev = NULL;
67881 +
67882 + curr = &role->subj_hash[index];
67883 + if (*curr != NULL)
67884 + (*curr)->prev = obj;
67885 +
67886 + obj->next = *curr;
67887 + *curr = obj;
67888 +
67889 + return;
67890 +}
67891 +
67892 +/* derived from glibc fnmatch() 0: match, 1: no match*/
67893 +
67894 +static int
67895 +glob_match(const char *p, const char *n)
67896 +{
67897 + char c;
67898 +
67899 + while ((c = *p++) != '\0') {
67900 + switch (c) {
67901 + case '?':
67902 + if (*n == '\0')
67903 + return 1;
67904 + else if (*n == '/')
67905 + return 1;
67906 + break;
67907 + case '\\':
67908 + if (*n != c)
67909 + return 1;
67910 + break;
67911 + case '*':
67912 + for (c = *p++; c == '?' || c == '*'; c = *p++) {
67913 + if (*n == '/')
67914 + return 1;
67915 + else if (c == '?') {
67916 + if (*n == '\0')
67917 + return 1;
67918 + else
67919 + ++n;
67920 + }
67921 + }
67922 + if (c == '\0') {
67923 + return 0;
67924 + } else {
67925 + const char *endp;
67926 +
67927 + if ((endp = strchr(n, '/')) == NULL)
67928 + endp = n + strlen(n);
67929 +
67930 + if (c == '[') {
67931 + for (--p; n < endp; ++n)
67932 + if (!glob_match(p, n))
67933 + return 0;
67934 + } else if (c == '/') {
67935 + while (*n != '\0' && *n != '/')
67936 + ++n;
67937 + if (*n == '/' && !glob_match(p, n + 1))
67938 + return 0;
67939 + } else {
67940 + for (--p; n < endp; ++n)
67941 + if (*n == c && !glob_match(p, n))
67942 + return 0;
67943 + }
67944 +
67945 + return 1;
67946 + }
67947 + case '[':
67948 + {
67949 + int not;
67950 + char cold;
67951 +
67952 + if (*n == '\0' || *n == '/')
67953 + return 1;
67954 +
67955 + not = (*p == '!' || *p == '^');
67956 + if (not)
67957 + ++p;
67958 +
67959 + c = *p++;
67960 + for (;;) {
67961 + unsigned char fn = (unsigned char)*n;
67962 +
67963 + if (c == '\0')
67964 + return 1;
67965 + else {
67966 + if (c == fn)
67967 + goto matched;
67968 + cold = c;
67969 + c = *p++;
67970 +
67971 + if (c == '-' && *p != ']') {
67972 + unsigned char cend = *p++;
67973 +
67974 + if (cend == '\0')
67975 + return 1;
67976 +
67977 + if (cold <= fn && fn <= cend)
67978 + goto matched;
67979 +
67980 + c = *p++;
67981 + }
67982 + }
67983 +
67984 + if (c == ']')
67985 + break;
67986 + }
67987 + if (!not)
67988 + return 1;
67989 + break;
67990 + matched:
67991 + while (c != ']') {
67992 + if (c == '\0')
67993 + return 1;
67994 +
67995 + c = *p++;
67996 + }
67997 + if (not)
67998 + return 1;
67999 + }
68000 + break;
68001 + default:
68002 + if (c != *n)
68003 + return 1;
68004 + }
68005 +
68006 + ++n;
68007 + }
68008 +
68009 + if (*n == '\0')
68010 + return 0;
68011 +
68012 + if (*n == '/')
68013 + return 0;
68014 +
68015 + return 1;
68016 +}
68017 +
68018 +static struct acl_object_label *
68019 +chk_glob_label(struct acl_object_label *globbed,
68020 + const struct dentry *dentry, const struct vfsmount *mnt, char **path)
68021 +{
68022 + struct acl_object_label *tmp;
68023 +
68024 + if (*path == NULL)
68025 + *path = gr_to_filename_nolock(dentry, mnt);
68026 +
68027 + tmp = globbed;
68028 +
68029 + while (tmp) {
68030 + if (!glob_match(tmp->filename, *path))
68031 + return tmp;
68032 + tmp = tmp->next;
68033 + }
68034 +
68035 + return NULL;
68036 +}
68037 +
68038 +static struct acl_object_label *
68039 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
68040 + const ino_t curr_ino, const dev_t curr_dev,
68041 + const struct acl_subject_label *subj, char **path, const int checkglob)
68042 +{
68043 + struct acl_subject_label *tmpsubj;
68044 + struct acl_object_label *retval;
68045 + struct acl_object_label *retval2;
68046 +
68047 + tmpsubj = (struct acl_subject_label *) subj;
68048 + read_lock(&gr_inode_lock);
68049 + do {
68050 + retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
68051 + if (retval) {
68052 + if (checkglob && retval->globbed) {
68053 + retval2 = chk_glob_label(retval->globbed, orig_dentry, orig_mnt, path);
68054 + if (retval2)
68055 + retval = retval2;
68056 + }
68057 + break;
68058 + }
68059 + } while ((tmpsubj = tmpsubj->parent_subject));
68060 + read_unlock(&gr_inode_lock);
68061 +
68062 + return retval;
68063 +}
68064 +
68065 +static __inline__ struct acl_object_label *
68066 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
68067 + struct dentry *curr_dentry,
68068 + const struct acl_subject_label *subj, char **path, const int checkglob)
68069 +{
68070 + int newglob = checkglob;
68071 + ino_t inode;
68072 + dev_t device;
68073 +
68074 + /* if we aren't checking a subdirectory of the original path yet, don't do glob checking
68075 + as we don't want a / * rule to match instead of the / object
68076 + don't do this for create lookups that call this function though, since they're looking up
68077 + on the parent and thus need globbing checks on all paths
68078 + */
68079 + if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
68080 + newglob = GR_NO_GLOB;
68081 +
68082 + spin_lock(&curr_dentry->d_lock);
68083 + inode = curr_dentry->d_inode->i_ino;
68084 + device = __get_dev(curr_dentry);
68085 + spin_unlock(&curr_dentry->d_lock);
68086 +
68087 + return __full_lookup(orig_dentry, orig_mnt, inode, device, subj, path, newglob);
68088 +}
68089 +
68090 +#ifdef CONFIG_HUGETLBFS
68091 +static inline bool
68092 +is_hugetlbfs_mnt(const struct vfsmount *mnt)
68093 +{
68094 + int i;
68095 + for (i = 0; i < HUGE_MAX_HSTATE; i++) {
68096 + if (unlikely(hugetlbfs_vfsmount[i] == mnt))
68097 + return true;
68098 + }
68099 +
68100 + return false;
68101 +}
68102 +#endif
68103 +
68104 +static struct acl_object_label *
68105 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
68106 + const struct acl_subject_label *subj, char *path, const int checkglob)
68107 +{
68108 + struct dentry *dentry = (struct dentry *) l_dentry;
68109 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
68110 + struct mount *real_mnt = real_mount(mnt);
68111 + struct acl_object_label *retval;
68112 + struct dentry *parent;
68113 +
68114 + read_seqlock_excl(&mount_lock);
68115 + write_seqlock(&rename_lock);
68116 +
68117 + if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt ||
68118 +#ifdef CONFIG_NET
68119 + mnt == sock_mnt ||
68120 +#endif
68121 +#ifdef CONFIG_HUGETLBFS
68122 + (is_hugetlbfs_mnt(mnt) && dentry->d_inode->i_nlink == 0) ||
68123 +#endif
68124 + /* ignore Eric Biederman */
68125 + IS_PRIVATE(l_dentry->d_inode))) {
68126 + retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
68127 + goto out;
68128 + }
68129 +
68130 + for (;;) {
68131 + if (dentry == gr_real_root.dentry && mnt == gr_real_root.mnt)
68132 + break;
68133 +
68134 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
68135 + if (!mnt_has_parent(real_mnt))
68136 + break;
68137 +
68138 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
68139 + if (retval != NULL)
68140 + goto out;
68141 +
68142 + dentry = real_mnt->mnt_mountpoint;
68143 + real_mnt = real_mnt->mnt_parent;
68144 + mnt = &real_mnt->mnt;
68145 + continue;
68146 + }
68147 +
68148 + parent = dentry->d_parent;
68149 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
68150 + if (retval != NULL)
68151 + goto out;
68152 +
68153 + dentry = parent;
68154 + }
68155 +
68156 + retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
68157 +
68158 + /* gr_real_root is pinned so we don't have to hold a reference */
68159 + if (retval == NULL)
68160 + retval = full_lookup(l_dentry, l_mnt, gr_real_root.dentry, subj, &path, checkglob);
68161 +out:
68162 + write_sequnlock(&rename_lock);
68163 + read_sequnlock_excl(&mount_lock);
68164 +
68165 + BUG_ON(retval == NULL);
68166 +
68167 + return retval;
68168 +}
68169 +
68170 +static __inline__ struct acl_object_label *
68171 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
68172 + const struct acl_subject_label *subj)
68173 +{
68174 + char *path = NULL;
68175 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
68176 +}
68177 +
68178 +static __inline__ struct acl_object_label *
68179 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
68180 + const struct acl_subject_label *subj)
68181 +{
68182 + char *path = NULL;
68183 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
68184 +}
68185 +
68186 +static __inline__ struct acl_object_label *
68187 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
68188 + const struct acl_subject_label *subj, char *path)
68189 +{
68190 + return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
68191 +}
68192 +
68193 +struct acl_subject_label *
68194 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
68195 + const struct acl_role_label *role)
68196 +{
68197 + struct dentry *dentry = (struct dentry *) l_dentry;
68198 + struct vfsmount *mnt = (struct vfsmount *) l_mnt;
68199 + struct mount *real_mnt = real_mount(mnt);
68200 + struct acl_subject_label *retval;
68201 + struct dentry *parent;
68202 +
68203 + read_seqlock_excl(&mount_lock);
68204 + write_seqlock(&rename_lock);
68205 +
68206 + for (;;) {
68207 + if (dentry == gr_real_root.dentry && mnt == gr_real_root.mnt)
68208 + break;
68209 + if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
68210 + if (!mnt_has_parent(real_mnt))
68211 + break;
68212 +
68213 + spin_lock(&dentry->d_lock);
68214 + read_lock(&gr_inode_lock);
68215 + retval =
68216 + lookup_acl_subj_label(dentry->d_inode->i_ino,
68217 + __get_dev(dentry), role);
68218 + read_unlock(&gr_inode_lock);
68219 + spin_unlock(&dentry->d_lock);
68220 + if (retval != NULL)
68221 + goto out;
68222 +
68223 + dentry = real_mnt->mnt_mountpoint;
68224 + real_mnt = real_mnt->mnt_parent;
68225 + mnt = &real_mnt->mnt;
68226 + continue;
68227 + }
68228 +
68229 + spin_lock(&dentry->d_lock);
68230 + read_lock(&gr_inode_lock);
68231 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
68232 + __get_dev(dentry), role);
68233 + read_unlock(&gr_inode_lock);
68234 + parent = dentry->d_parent;
68235 + spin_unlock(&dentry->d_lock);
68236 +
68237 + if (retval != NULL)
68238 + goto out;
68239 +
68240 + dentry = parent;
68241 + }
68242 +
68243 + spin_lock(&dentry->d_lock);
68244 + read_lock(&gr_inode_lock);
68245 + retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
68246 + __get_dev(dentry), role);
68247 + read_unlock(&gr_inode_lock);
68248 + spin_unlock(&dentry->d_lock);
68249 +
68250 + if (unlikely(retval == NULL)) {
68251 + /* gr_real_root is pinned, we don't need to hold a reference */
68252 + read_lock(&gr_inode_lock);
68253 + retval = lookup_acl_subj_label(gr_real_root.dentry->d_inode->i_ino,
68254 + __get_dev(gr_real_root.dentry), role);
68255 + read_unlock(&gr_inode_lock);
68256 + }
68257 +out:
68258 + write_sequnlock(&rename_lock);
68259 + read_sequnlock_excl(&mount_lock);
68260 +
68261 + BUG_ON(retval == NULL);
68262 +
68263 + return retval;
68264 +}
68265 +
68266 +void
68267 +assign_special_role(const char *rolename)
68268 +{
68269 + struct acl_object_label *obj;
68270 + struct acl_role_label *r;
68271 + struct acl_role_label *assigned = NULL;
68272 + struct task_struct *tsk;
68273 + struct file *filp;
68274 +
68275 + FOR_EACH_ROLE_START(r)
68276 + if (!strcmp(rolename, r->rolename) &&
68277 + (r->roletype & GR_ROLE_SPECIAL)) {
68278 + assigned = r;
68279 + break;
68280 + }
68281 + FOR_EACH_ROLE_END(r)
68282 +
68283 + if (!assigned)
68284 + return;
68285 +
68286 + read_lock(&tasklist_lock);
68287 + read_lock(&grsec_exec_file_lock);
68288 +
68289 + tsk = current->real_parent;
68290 + if (tsk == NULL)
68291 + goto out_unlock;
68292 +
68293 + filp = tsk->exec_file;
68294 + if (filp == NULL)
68295 + goto out_unlock;
68296 +
68297 + tsk->is_writable = 0;
68298 + tsk->inherited = 0;
68299 +
68300 + tsk->acl_sp_role = 1;
68301 + tsk->acl_role_id = ++acl_sp_role_value;
68302 + tsk->role = assigned;
68303 + tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
68304 +
68305 + /* ignore additional mmap checks for processes that are writable
68306 + by the default ACL */
68307 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, running_polstate.default_role->root_label);
68308 + if (unlikely(obj->mode & GR_WRITE))
68309 + tsk->is_writable = 1;
68310 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
68311 + if (unlikely(obj->mode & GR_WRITE))
68312 + tsk->is_writable = 1;
68313 +
68314 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
68315 + printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename,
68316 + tsk->acl->filename, tsk->comm, task_pid_nr(tsk));
68317 +#endif
68318 +
68319 +out_unlock:
68320 + read_unlock(&grsec_exec_file_lock);
68321 + read_unlock(&tasklist_lock);
68322 + return;
68323 +}
68324 +
68325 +
68326 +static void
68327 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
68328 +{
68329 + struct task_struct *task = current;
68330 + const struct cred *cred = current_cred();
68331 +
68332 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
68333 + GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid), task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
68334 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
68335 + 1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
68336 +
68337 + return;
68338 +}
68339 +
68340 +static void
68341 +gr_log_learn_uid_change(const kuid_t real, const kuid_t effective, const kuid_t fs)
68342 +{
68343 + struct task_struct *task = current;
68344 + const struct cred *cred = current_cred();
68345 +
68346 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
68347 + GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid), task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
68348 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
68349 + 'u', GR_GLOBAL_UID(real), GR_GLOBAL_UID(effective), GR_GLOBAL_UID(fs), &task->signal->saved_ip);
68350 +
68351 + return;
68352 +}
68353 +
68354 +static void
68355 +gr_log_learn_gid_change(const kgid_t real, const kgid_t effective, const kgid_t fs)
68356 +{
68357 + struct task_struct *task = current;
68358 + const struct cred *cred = current_cred();
68359 +
68360 + security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
68361 + GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid), task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
68362 + task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
68363 + 'g', GR_GLOBAL_GID(real), GR_GLOBAL_GID(effective), GR_GLOBAL_GID(fs), &task->signal->saved_ip);
68364 +
68365 + return;
68366 +}
68367 +
68368 +static void
68369 +gr_set_proc_res(struct task_struct *task)
68370 +{
68371 + struct acl_subject_label *proc;
68372 + unsigned short i;
68373 +
68374 + proc = task->acl;
68375 +
68376 + if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
68377 + return;
68378 +
68379 + for (i = 0; i < RLIM_NLIMITS; i++) {
68380 + if (!(proc->resmask & (1U << i)))
68381 + continue;
68382 +
68383 + task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
68384 + task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
68385 +
68386 + if (i == RLIMIT_CPU)
68387 + update_rlimit_cpu(task, proc->res[i].rlim_cur);
68388 + }
68389 +
68390 + return;
68391 +}
68392 +
68393 +/* both of the below must be called with
68394 + rcu_read_lock();
68395 + read_lock(&tasklist_lock);
68396 + read_lock(&grsec_exec_file_lock);
68397 +*/
68398 +
68399 +struct acl_subject_label *__gr_get_subject_for_task(const struct gr_policy_state *state, struct task_struct *task, const char *filename)
68400 +{
68401 + char *tmpname;
68402 + struct acl_subject_label *tmpsubj;
68403 + struct file *filp;
68404 + struct name_entry *nmatch;
68405 +
68406 + filp = task->exec_file;
68407 + if (filp == NULL)
68408 + return NULL;
68409 +
68410 + /* the following is to apply the correct subject
68411 + on binaries running when the RBAC system
68412 + is enabled, when the binaries have been
68413 + replaced or deleted since their execution
68414 + -----
68415 + when the RBAC system starts, the inode/dev
68416 + from exec_file will be one the RBAC system
68417 + is unaware of. It only knows the inode/dev
68418 + of the present file on disk, or the absence
68419 + of it.
68420 + */
68421 +
68422 + if (filename)
68423 + nmatch = __lookup_name_entry(state, filename);
68424 + else {
68425 + preempt_disable();
68426 + tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
68427 +
68428 + nmatch = __lookup_name_entry(state, tmpname);
68429 + preempt_enable();
68430 + }
68431 + tmpsubj = NULL;
68432 + if (nmatch) {
68433 + if (nmatch->deleted)
68434 + tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
68435 + else
68436 + tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
68437 + }
68438 + /* this also works for the reload case -- if we don't match a potentially inherited subject
68439 + then we fall back to a normal lookup based on the binary's ino/dev
68440 + */
68441 + if (tmpsubj == NULL)
68442 + tmpsubj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, task->role);
68443 +
68444 + return tmpsubj;
68445 +}
68446 +
68447 +static struct acl_subject_label *gr_get_subject_for_task(struct task_struct *task, const char *filename)
68448 +{
68449 + return __gr_get_subject_for_task(&running_polstate, task, filename);
68450 +}
68451 +
68452 +void __gr_apply_subject_to_task(const struct gr_policy_state *state, struct task_struct *task, struct acl_subject_label *subj)
68453 +{
68454 + struct acl_object_label *obj;
68455 + struct file *filp;
68456 +
68457 + filp = task->exec_file;
68458 +
68459 + task->acl = subj;
68460 + task->is_writable = 0;
68461 + /* ignore additional mmap checks for processes that are writable
68462 + by the default ACL */
68463 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, state->default_role->root_label);
68464 + if (unlikely(obj->mode & GR_WRITE))
68465 + task->is_writable = 1;
68466 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
68467 + if (unlikely(obj->mode & GR_WRITE))
68468 + task->is_writable = 1;
68469 +
68470 + gr_set_proc_res(task);
68471 +
68472 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
68473 + printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task_pid_nr(task), task->role->rolename, task->acl->filename);
68474 +#endif
68475 +}
68476 +
68477 +static void gr_apply_subject_to_task(struct task_struct *task, struct acl_subject_label *subj)
68478 +{
68479 + __gr_apply_subject_to_task(&running_polstate, task, subj);
68480 +}
68481 +
68482 +__u32
68483 +gr_search_file(const struct dentry * dentry, const __u32 mode,
68484 + const struct vfsmount * mnt)
68485 +{
68486 + __u32 retval = mode;
68487 + struct acl_subject_label *curracl;
68488 + struct acl_object_label *currobj;
68489 +
68490 + if (unlikely(!(gr_status & GR_READY)))
68491 + return (mode & ~GR_AUDITS);
68492 +
68493 + curracl = current->acl;
68494 +
68495 + currobj = chk_obj_label(dentry, mnt, curracl);
68496 + retval = currobj->mode & mode;
68497 +
68498 + /* if we're opening a specified transfer file for writing
68499 + (e.g. /dev/initctl), then transfer our role to init
68500 + */
68501 + if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
68502 + current->role->roletype & GR_ROLE_PERSIST)) {
68503 + struct task_struct *task = init_pid_ns.child_reaper;
68504 +
68505 + if (task->role != current->role) {
68506 + struct acl_subject_label *subj;
68507 +
68508 + task->acl_sp_role = 0;
68509 + task->acl_role_id = current->acl_role_id;
68510 + task->role = current->role;
68511 + rcu_read_lock();
68512 + read_lock(&grsec_exec_file_lock);
68513 + subj = gr_get_subject_for_task(task, NULL);
68514 + gr_apply_subject_to_task(task, subj);
68515 + read_unlock(&grsec_exec_file_lock);
68516 + rcu_read_unlock();
68517 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
68518 + }
68519 + }
68520 +
68521 + if (unlikely
68522 + ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
68523 + && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
68524 + __u32 new_mode = mode;
68525 +
68526 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
68527 +
68528 + retval = new_mode;
68529 +
68530 + if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
68531 + new_mode |= GR_INHERIT;
68532 +
68533 + if (!(mode & GR_NOLEARN))
68534 + gr_log_learn(dentry, mnt, new_mode);
68535 + }
68536 +
68537 + return retval;
68538 +}
68539 +
68540 +struct acl_object_label *gr_get_create_object(const struct dentry *new_dentry,
68541 + const struct dentry *parent,
68542 + const struct vfsmount *mnt)
68543 +{
68544 + struct name_entry *match;
68545 + struct acl_object_label *matchpo;
68546 + struct acl_subject_label *curracl;
68547 + char *path;
68548 +
68549 + if (unlikely(!(gr_status & GR_READY)))
68550 + return NULL;
68551 +
68552 + preempt_disable();
68553 + path = gr_to_filename_rbac(new_dentry, mnt);
68554 + match = lookup_name_entry_create(path);
68555 +
68556 + curracl = current->acl;
68557 +
68558 + if (match) {
68559 + read_lock(&gr_inode_lock);
68560 + matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
68561 + read_unlock(&gr_inode_lock);
68562 +
68563 + if (matchpo) {
68564 + preempt_enable();
68565 + return matchpo;
68566 + }
68567 + }
68568 +
68569 + // lookup parent
68570 +
68571 + matchpo = chk_obj_create_label(parent, mnt, curracl, path);
68572 +
68573 + preempt_enable();
68574 + return matchpo;
68575 +}
68576 +
68577 +__u32
68578 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
68579 + const struct vfsmount * mnt, const __u32 mode)
68580 +{
68581 + struct acl_object_label *matchpo;
68582 + __u32 retval;
68583 +
68584 + if (unlikely(!(gr_status & GR_READY)))
68585 + return (mode & ~GR_AUDITS);
68586 +
68587 + matchpo = gr_get_create_object(new_dentry, parent, mnt);
68588 +
68589 + retval = matchpo->mode & mode;
68590 +
68591 + if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
68592 + && (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
68593 + __u32 new_mode = mode;
68594 +
68595 + new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
68596 +
68597 + gr_log_learn(new_dentry, mnt, new_mode);
68598 + return new_mode;
68599 + }
68600 +
68601 + return retval;
68602 +}
68603 +
68604 +__u32
68605 +gr_check_link(const struct dentry * new_dentry,
68606 + const struct dentry * parent_dentry,
68607 + const struct vfsmount * parent_mnt,
68608 + const struct dentry * old_dentry, const struct vfsmount * old_mnt)
68609 +{
68610 + struct acl_object_label *obj;
68611 + __u32 oldmode, newmode;
68612 + __u32 needmode;
68613 + __u32 checkmodes = GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC | GR_SETID | GR_READ |
68614 + GR_DELETE | GR_INHERIT;
68615 +
68616 + if (unlikely(!(gr_status & GR_READY)))
68617 + return (GR_CREATE | GR_LINK);
68618 +
68619 + obj = chk_obj_label(old_dentry, old_mnt, current->acl);
68620 + oldmode = obj->mode;
68621 +
68622 + obj = gr_get_create_object(new_dentry, parent_dentry, parent_mnt);
68623 + newmode = obj->mode;
68624 +
68625 + needmode = newmode & checkmodes;
68626 +
68627 + // old name for hardlink must have at least the permissions of the new name
68628 + if ((oldmode & needmode) != needmode)
68629 + goto bad;
68630 +
68631 + // if old name had restrictions/auditing, make sure the new name does as well
68632 + needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
68633 +
68634 + // don't allow hardlinking of suid/sgid/fcapped files without permission
68635 + if (is_privileged_binary(old_dentry))
68636 + needmode |= GR_SETID;
68637 +
68638 + if ((newmode & needmode) != needmode)
68639 + goto bad;
68640 +
68641 + // enforce minimum permissions
68642 + if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
68643 + return newmode;
68644 +bad:
68645 + needmode = oldmode;
68646 + if (is_privileged_binary(old_dentry))
68647 + needmode |= GR_SETID;
68648 +
68649 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
68650 + gr_log_learn(old_dentry, old_mnt, needmode | GR_CREATE | GR_LINK);
68651 + return (GR_CREATE | GR_LINK);
68652 + } else if (newmode & GR_SUPPRESS)
68653 + return GR_SUPPRESS;
68654 + else
68655 + return 0;
68656 +}
68657 +
68658 +int
68659 +gr_check_hidden_task(const struct task_struct *task)
68660 +{
68661 + if (unlikely(!(gr_status & GR_READY)))
68662 + return 0;
68663 +
68664 + if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
68665 + return 1;
68666 +
68667 + return 0;
68668 +}
68669 +
68670 +int
68671 +gr_check_protected_task(const struct task_struct *task)
68672 +{
68673 + if (unlikely(!(gr_status & GR_READY) || !task))
68674 + return 0;
68675 +
68676 + if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
68677 + task->acl != current->acl)
68678 + return 1;
68679 +
68680 + return 0;
68681 +}
68682 +
68683 +int
68684 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
68685 +{
68686 + struct task_struct *p;
68687 + int ret = 0;
68688 +
68689 + if (unlikely(!(gr_status & GR_READY) || !pid))
68690 + return ret;
68691 +
68692 + read_lock(&tasklist_lock);
68693 + do_each_pid_task(pid, type, p) {
68694 + if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
68695 + p->acl != current->acl) {
68696 + ret = 1;
68697 + goto out;
68698 + }
68699 + } while_each_pid_task(pid, type, p);
68700 +out:
68701 + read_unlock(&tasklist_lock);
68702 +
68703 + return ret;
68704 +}
68705 +
68706 +void
68707 +gr_copy_label(struct task_struct *tsk)
68708 +{
68709 + struct task_struct *p = current;
68710 +
68711 + tsk->inherited = p->inherited;
68712 + tsk->acl_sp_role = 0;
68713 + tsk->acl_role_id = p->acl_role_id;
68714 + tsk->acl = p->acl;
68715 + tsk->role = p->role;
68716 + tsk->signal->used_accept = 0;
68717 + tsk->signal->curr_ip = p->signal->curr_ip;
68718 + tsk->signal->saved_ip = p->signal->saved_ip;
68719 + if (p->exec_file)
68720 + get_file(p->exec_file);
68721 + tsk->exec_file = p->exec_file;
68722 + tsk->is_writable = p->is_writable;
68723 + if (unlikely(p->signal->used_accept)) {
68724 + p->signal->curr_ip = 0;
68725 + p->signal->saved_ip = 0;
68726 + }
68727 +
68728 + return;
68729 +}
68730 +
68731 +extern int gr_process_kernel_setuid_ban(struct user_struct *user);
68732 +
68733 +int
68734 +gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs)
68735 +{
68736 + unsigned int i;
68737 + __u16 num;
68738 + uid_t *uidlist;
68739 + uid_t curuid;
68740 + int realok = 0;
68741 + int effectiveok = 0;
68742 + int fsok = 0;
68743 + uid_t globalreal, globaleffective, globalfs;
68744 +
68745 +#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT)
68746 + struct user_struct *user;
68747 +
68748 + if (!uid_valid(real))
68749 + goto skipit;
68750 +
68751 + /* find user based on global namespace */
68752 +
68753 + globalreal = GR_GLOBAL_UID(real);
68754 +
68755 + user = find_user(make_kuid(&init_user_ns, globalreal));
68756 + if (user == NULL)
68757 + goto skipit;
68758 +
68759 + if (gr_process_kernel_setuid_ban(user)) {
68760 + /* for find_user */
68761 + free_uid(user);
68762 + return 1;
68763 + }
68764 +
68765 + /* for find_user */
68766 + free_uid(user);
68767 +
68768 +skipit:
68769 +#endif
68770 +
68771 + if (unlikely(!(gr_status & GR_READY)))
68772 + return 0;
68773 +
68774 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
68775 + gr_log_learn_uid_change(real, effective, fs);
68776 +
68777 + num = current->acl->user_trans_num;
68778 + uidlist = current->acl->user_transitions;
68779 +
68780 + if (uidlist == NULL)
68781 + return 0;
68782 +
68783 + if (!uid_valid(real)) {
68784 + realok = 1;
68785 + globalreal = (uid_t)-1;
68786 + } else {
68787 + globalreal = GR_GLOBAL_UID(real);
68788 + }
68789 + if (!uid_valid(effective)) {
68790 + effectiveok = 1;
68791 + globaleffective = (uid_t)-1;
68792 + } else {
68793 + globaleffective = GR_GLOBAL_UID(effective);
68794 + }
68795 + if (!uid_valid(fs)) {
68796 + fsok = 1;
68797 + globalfs = (uid_t)-1;
68798 + } else {
68799 + globalfs = GR_GLOBAL_UID(fs);
68800 + }
68801 +
68802 + if (current->acl->user_trans_type & GR_ID_ALLOW) {
68803 + for (i = 0; i < num; i++) {
68804 + curuid = uidlist[i];
68805 + if (globalreal == curuid)
68806 + realok = 1;
68807 + if (globaleffective == curuid)
68808 + effectiveok = 1;
68809 + if (globalfs == curuid)
68810 + fsok = 1;
68811 + }
68812 + } else if (current->acl->user_trans_type & GR_ID_DENY) {
68813 + for (i = 0; i < num; i++) {
68814 + curuid = uidlist[i];
68815 + if (globalreal == curuid)
68816 + break;
68817 + if (globaleffective == curuid)
68818 + break;
68819 + if (globalfs == curuid)
68820 + break;
68821 + }
68822 + /* not in deny list */
68823 + if (i == num) {
68824 + realok = 1;
68825 + effectiveok = 1;
68826 + fsok = 1;
68827 + }
68828 + }
68829 +
68830 + if (realok && effectiveok && fsok)
68831 + return 0;
68832 + else {
68833 + gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : globalfs) : globaleffective) : globalreal);
68834 + return 1;
68835 + }
68836 +}
68837 +
68838 +int
68839 +gr_check_group_change(kgid_t real, kgid_t effective, kgid_t fs)
68840 +{
68841 + unsigned int i;
68842 + __u16 num;
68843 + gid_t *gidlist;
68844 + gid_t curgid;
68845 + int realok = 0;
68846 + int effectiveok = 0;
68847 + int fsok = 0;
68848 + gid_t globalreal, globaleffective, globalfs;
68849 +
68850 + if (unlikely(!(gr_status & GR_READY)))
68851 + return 0;
68852 +
68853 + if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
68854 + gr_log_learn_gid_change(real, effective, fs);
68855 +
68856 + num = current->acl->group_trans_num;
68857 + gidlist = current->acl->group_transitions;
68858 +
68859 + if (gidlist == NULL)
68860 + return 0;
68861 +
68862 + if (!gid_valid(real)) {
68863 + realok = 1;
68864 + globalreal = (gid_t)-1;
68865 + } else {
68866 + globalreal = GR_GLOBAL_GID(real);
68867 + }
68868 + if (!gid_valid(effective)) {
68869 + effectiveok = 1;
68870 + globaleffective = (gid_t)-1;
68871 + } else {
68872 + globaleffective = GR_GLOBAL_GID(effective);
68873 + }
68874 + if (!gid_valid(fs)) {
68875 + fsok = 1;
68876 + globalfs = (gid_t)-1;
68877 + } else {
68878 + globalfs = GR_GLOBAL_GID(fs);
68879 + }
68880 +
68881 + if (current->acl->group_trans_type & GR_ID_ALLOW) {
68882 + for (i = 0; i < num; i++) {
68883 + curgid = gidlist[i];
68884 + if (globalreal == curgid)
68885 + realok = 1;
68886 + if (globaleffective == curgid)
68887 + effectiveok = 1;
68888 + if (globalfs == curgid)
68889 + fsok = 1;
68890 + }
68891 + } else if (current->acl->group_trans_type & GR_ID_DENY) {
68892 + for (i = 0; i < num; i++) {
68893 + curgid = gidlist[i];
68894 + if (globalreal == curgid)
68895 + break;
68896 + if (globaleffective == curgid)
68897 + break;
68898 + if (globalfs == curgid)
68899 + break;
68900 + }
68901 + /* not in deny list */
68902 + if (i == num) {
68903 + realok = 1;
68904 + effectiveok = 1;
68905 + fsok = 1;
68906 + }
68907 + }
68908 +
68909 + if (realok && effectiveok && fsok)
68910 + return 0;
68911 + else {
68912 + gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : globalfs) : globaleffective) : globalreal);
68913 + return 1;
68914 + }
68915 +}
68916 +
68917 +extern int gr_acl_is_capable(const int cap);
68918 +
68919 +void
68920 +gr_set_role_label(struct task_struct *task, const kuid_t kuid, const kgid_t kgid)
68921 +{
68922 + struct acl_role_label *role = task->role;
68923 + struct acl_subject_label *subj = NULL;
68924 + struct acl_object_label *obj;
68925 + struct file *filp;
68926 + uid_t uid;
68927 + gid_t gid;
68928 +
68929 + if (unlikely(!(gr_status & GR_READY)))
68930 + return;
68931 +
68932 + uid = GR_GLOBAL_UID(kuid);
68933 + gid = GR_GLOBAL_GID(kgid);
68934 +
68935 + filp = task->exec_file;
68936 +
68937 + /* kernel process, we'll give them the kernel role */
68938 + if (unlikely(!filp)) {
68939 + task->role = running_polstate.kernel_role;
68940 + task->acl = running_polstate.kernel_role->root_label;
68941 + return;
68942 + } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL)) {
68943 + /* save the current ip at time of role lookup so that the proper
68944 + IP will be learned for role_allowed_ip */
68945 + task->signal->saved_ip = task->signal->curr_ip;
68946 + role = lookup_acl_role_label(task, uid, gid);
68947 + }
68948 +
68949 + /* don't change the role if we're not a privileged process */
68950 + if (role && task->role != role &&
68951 + (((role->roletype & GR_ROLE_USER) && !gr_acl_is_capable(CAP_SETUID)) ||
68952 + ((role->roletype & GR_ROLE_GROUP) && !gr_acl_is_capable(CAP_SETGID))))
68953 + return;
68954 +
68955 + /* perform subject lookup in possibly new role
68956 + we can use this result below in the case where role == task->role
68957 + */
68958 + subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
68959 +
68960 + /* if we changed uid/gid, but result in the same role
68961 + and are using inheritance, don't lose the inherited subject
68962 + if current subject is other than what normal lookup
68963 + would result in, we arrived via inheritance, don't
68964 + lose subject
68965 + */
68966 + if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
68967 + (subj == task->acl)))
68968 + task->acl = subj;
68969 +
68970 + /* leave task->inherited unaffected */
68971 +
68972 + task->role = role;
68973 +
68974 + task->is_writable = 0;
68975 +
68976 + /* ignore additional mmap checks for processes that are writable
68977 + by the default ACL */
68978 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, running_polstate.default_role->root_label);
68979 + if (unlikely(obj->mode & GR_WRITE))
68980 + task->is_writable = 1;
68981 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
68982 + if (unlikely(obj->mode & GR_WRITE))
68983 + task->is_writable = 1;
68984 +
68985 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
68986 + printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task_pid_nr(task), task->role->rolename, task->acl->filename);
68987 +#endif
68988 +
68989 + gr_set_proc_res(task);
68990 +
68991 + return;
68992 +}
68993 +
68994 +int
68995 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
68996 + const int unsafe_flags)
68997 +{
68998 + struct task_struct *task = current;
68999 + struct acl_subject_label *newacl;
69000 + struct acl_object_label *obj;
69001 + __u32 retmode;
69002 +
69003 + if (unlikely(!(gr_status & GR_READY)))
69004 + return 0;
69005 +
69006 + newacl = chk_subj_label(dentry, mnt, task->role);
69007 +
69008 + /* special handling for if we did an strace -f -p <pid> from an admin role, where pid then
69009 + did an exec
69010 + */
69011 + rcu_read_lock();
69012 + read_lock(&tasklist_lock);
69013 + if (task->ptrace && task->parent && ((task->parent->role->roletype & GR_ROLE_GOD) ||
69014 + (task->parent->acl->mode & GR_POVERRIDE))) {
69015 + read_unlock(&tasklist_lock);
69016 + rcu_read_unlock();
69017 + goto skip_check;
69018 + }
69019 + read_unlock(&tasklist_lock);
69020 + rcu_read_unlock();
69021 +
69022 + if (unsafe_flags && !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
69023 + !(task->role->roletype & GR_ROLE_GOD) &&
69024 + !gr_search_file(dentry, GR_PTRACERD, mnt) &&
69025 + !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN))) {
69026 + if (unsafe_flags & LSM_UNSAFE_SHARE)
69027 + gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
69028 + else
69029 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
69030 + return -EACCES;
69031 + }
69032 +
69033 +skip_check:
69034 +
69035 + obj = chk_obj_label(dentry, mnt, task->acl);
69036 + retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
69037 +
69038 + if (!(task->acl->mode & GR_INHERITLEARN) &&
69039 + ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
69040 + if (obj->nested)
69041 + task->acl = obj->nested;
69042 + else
69043 + task->acl = newacl;
69044 + task->inherited = 0;
69045 + } else {
69046 + task->inherited = 1;
69047 + if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
69048 + gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
69049 + }
69050 +
69051 + task->is_writable = 0;
69052 +
69053 + /* ignore additional mmap checks for processes that are writable
69054 + by the default ACL */
69055 + obj = chk_obj_label(dentry, mnt, running_polstate.default_role->root_label);
69056 + if (unlikely(obj->mode & GR_WRITE))
69057 + task->is_writable = 1;
69058 + obj = chk_obj_label(dentry, mnt, task->role->root_label);
69059 + if (unlikely(obj->mode & GR_WRITE))
69060 + task->is_writable = 1;
69061 +
69062 + gr_set_proc_res(task);
69063 +
69064 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
69065 + printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task_pid_nr(task), task->role->rolename, task->acl->filename);
69066 +#endif
69067 + return 0;
69068 +}
69069 +
69070 +/* always called with valid inodev ptr */
69071 +static void
69072 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
69073 +{
69074 + struct acl_object_label *matchpo;
69075 + struct acl_subject_label *matchps;
69076 + struct acl_subject_label *subj;
69077 + struct acl_role_label *role;
69078 + unsigned int x;
69079 +
69080 + FOR_EACH_ROLE_START(role)
69081 + FOR_EACH_SUBJECT_START(role, subj, x)
69082 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
69083 + matchpo->mode |= GR_DELETED;
69084 + FOR_EACH_SUBJECT_END(subj,x)
69085 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
69086 + /* nested subjects aren't in the role's subj_hash table */
69087 + if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
69088 + matchpo->mode |= GR_DELETED;
69089 + FOR_EACH_NESTED_SUBJECT_END(subj)
69090 + if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
69091 + matchps->mode |= GR_DELETED;
69092 + FOR_EACH_ROLE_END(role)
69093 +
69094 + inodev->nentry->deleted = 1;
69095 +
69096 + return;
69097 +}
69098 +
69099 +void
69100 +gr_handle_delete(const ino_t ino, const dev_t dev)
69101 +{
69102 + struct inodev_entry *inodev;
69103 +
69104 + if (unlikely(!(gr_status & GR_READY)))
69105 + return;
69106 +
69107 + write_lock(&gr_inode_lock);
69108 + inodev = lookup_inodev_entry(ino, dev);
69109 + if (inodev != NULL)
69110 + do_handle_delete(inodev, ino, dev);
69111 + write_unlock(&gr_inode_lock);
69112 +
69113 + return;
69114 +}
69115 +
69116 +static void
69117 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
69118 + const ino_t newinode, const dev_t newdevice,
69119 + struct acl_subject_label *subj)
69120 +{
69121 + unsigned int index = gr_fhash(oldinode, olddevice, subj->obj_hash_size);
69122 + struct acl_object_label *match;
69123 +
69124 + match = subj->obj_hash[index];
69125 +
69126 + while (match && (match->inode != oldinode ||
69127 + match->device != olddevice ||
69128 + !(match->mode & GR_DELETED)))
69129 + match = match->next;
69130 +
69131 + if (match && (match->inode == oldinode)
69132 + && (match->device == olddevice)
69133 + && (match->mode & GR_DELETED)) {
69134 + if (match->prev == NULL) {
69135 + subj->obj_hash[index] = match->next;
69136 + if (match->next != NULL)
69137 + match->next->prev = NULL;
69138 + } else {
69139 + match->prev->next = match->next;
69140 + if (match->next != NULL)
69141 + match->next->prev = match->prev;
69142 + }
69143 + match->prev = NULL;
69144 + match->next = NULL;
69145 + match->inode = newinode;
69146 + match->device = newdevice;
69147 + match->mode &= ~GR_DELETED;
69148 +
69149 + insert_acl_obj_label(match, subj);
69150 + }
69151 +
69152 + return;
69153 +}
69154 +
69155 +static void
69156 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
69157 + const ino_t newinode, const dev_t newdevice,
69158 + struct acl_role_label *role)
69159 +{
69160 + unsigned int index = gr_fhash(oldinode, olddevice, role->subj_hash_size);
69161 + struct acl_subject_label *match;
69162 +
69163 + match = role->subj_hash[index];
69164 +
69165 + while (match && (match->inode != oldinode ||
69166 + match->device != olddevice ||
69167 + !(match->mode & GR_DELETED)))
69168 + match = match->next;
69169 +
69170 + if (match && (match->inode == oldinode)
69171 + && (match->device == olddevice)
69172 + && (match->mode & GR_DELETED)) {
69173 + if (match->prev == NULL) {
69174 + role->subj_hash[index] = match->next;
69175 + if (match->next != NULL)
69176 + match->next->prev = NULL;
69177 + } else {
69178 + match->prev->next = match->next;
69179 + if (match->next != NULL)
69180 + match->next->prev = match->prev;
69181 + }
69182 + match->prev = NULL;
69183 + match->next = NULL;
69184 + match->inode = newinode;
69185 + match->device = newdevice;
69186 + match->mode &= ~GR_DELETED;
69187 +
69188 + insert_acl_subj_label(match, role);
69189 + }
69190 +
69191 + return;
69192 +}
69193 +
69194 +static void
69195 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
69196 + const ino_t newinode, const dev_t newdevice)
69197 +{
69198 + unsigned int index = gr_fhash(oldinode, olddevice, running_polstate.inodev_set.i_size);
69199 + struct inodev_entry *match;
69200 +
69201 + match = running_polstate.inodev_set.i_hash[index];
69202 +
69203 + while (match && (match->nentry->inode != oldinode ||
69204 + match->nentry->device != olddevice || !match->nentry->deleted))
69205 + match = match->next;
69206 +
69207 + if (match && (match->nentry->inode == oldinode)
69208 + && (match->nentry->device == olddevice) &&
69209 + match->nentry->deleted) {
69210 + if (match->prev == NULL) {
69211 + running_polstate.inodev_set.i_hash[index] = match->next;
69212 + if (match->next != NULL)
69213 + match->next->prev = NULL;
69214 + } else {
69215 + match->prev->next = match->next;
69216 + if (match->next != NULL)
69217 + match->next->prev = match->prev;
69218 + }
69219 + match->prev = NULL;
69220 + match->next = NULL;
69221 + match->nentry->inode = newinode;
69222 + match->nentry->device = newdevice;
69223 + match->nentry->deleted = 0;
69224 +
69225 + insert_inodev_entry(match);
69226 + }
69227 +
69228 + return;
69229 +}
69230 +
69231 +static void
69232 +__do_handle_create(const struct name_entry *matchn, ino_t ino, dev_t dev)
69233 +{
69234 + struct acl_subject_label *subj;
69235 + struct acl_role_label *role;
69236 + unsigned int x;
69237 +
69238 + FOR_EACH_ROLE_START(role)
69239 + update_acl_subj_label(matchn->inode, matchn->device, ino, dev, role);
69240 +
69241 + FOR_EACH_NESTED_SUBJECT_START(role, subj)
69242 + if ((subj->inode == ino) && (subj->device == dev)) {
69243 + subj->inode = ino;
69244 + subj->device = dev;
69245 + }
69246 + /* nested subjects aren't in the role's subj_hash table */
69247 + update_acl_obj_label(matchn->inode, matchn->device,
69248 + ino, dev, subj);
69249 + FOR_EACH_NESTED_SUBJECT_END(subj)
69250 + FOR_EACH_SUBJECT_START(role, subj, x)
69251 + update_acl_obj_label(matchn->inode, matchn->device,
69252 + ino, dev, subj);
69253 + FOR_EACH_SUBJECT_END(subj,x)
69254 + FOR_EACH_ROLE_END(role)
69255 +
69256 + update_inodev_entry(matchn->inode, matchn->device, ino, dev);
69257 +
69258 + return;
69259 +}
69260 +
69261 +static void
69262 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
69263 + const struct vfsmount *mnt)
69264 +{
69265 + ino_t ino = dentry->d_inode->i_ino;
69266 + dev_t dev = __get_dev(dentry);
69267 +
69268 + __do_handle_create(matchn, ino, dev);
69269 +
69270 + return;
69271 +}
69272 +
69273 +void
69274 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
69275 +{
69276 + struct name_entry *matchn;
69277 +
69278 + if (unlikely(!(gr_status & GR_READY)))
69279 + return;
69280 +
69281 + preempt_disable();
69282 + matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
69283 +
69284 + if (unlikely((unsigned long)matchn)) {
69285 + write_lock(&gr_inode_lock);
69286 + do_handle_create(matchn, dentry, mnt);
69287 + write_unlock(&gr_inode_lock);
69288 + }
69289 + preempt_enable();
69290 +
69291 + return;
69292 +}
69293 +
69294 +void
69295 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
69296 +{
69297 + struct name_entry *matchn;
69298 +
69299 + if (unlikely(!(gr_status & GR_READY)))
69300 + return;
69301 +
69302 + preempt_disable();
69303 + matchn = lookup_name_entry(gr_to_proc_filename_rbac(dentry, init_pid_ns.proc_mnt));
69304 +
69305 + if (unlikely((unsigned long)matchn)) {
69306 + write_lock(&gr_inode_lock);
69307 + __do_handle_create(matchn, inode->i_ino, inode->i_sb->s_dev);
69308 + write_unlock(&gr_inode_lock);
69309 + }
69310 + preempt_enable();
69311 +
69312 + return;
69313 +}
69314 +
69315 +void
69316 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
69317 + struct dentry *old_dentry,
69318 + struct dentry *new_dentry,
69319 + struct vfsmount *mnt, const __u8 replace)
69320 +{
69321 + struct name_entry *matchn;
69322 + struct inodev_entry *inodev;
69323 + struct inode *inode = new_dentry->d_inode;
69324 + ino_t old_ino = old_dentry->d_inode->i_ino;
69325 + dev_t old_dev = __get_dev(old_dentry);
69326 +
69327 + /* vfs_rename swaps the name and parent link for old_dentry and
69328 + new_dentry
69329 + at this point, old_dentry has the new name, parent link, and inode
69330 + for the renamed file
69331 + if a file is being replaced by a rename, new_dentry has the inode
69332 + and name for the replaced file
69333 + */
69334 +
69335 + if (unlikely(!(gr_status & GR_READY)))
69336 + return;
69337 +
69338 + preempt_disable();
69339 + matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
69340 +
69341 + /* we wouldn't have to check d_inode if it weren't for
69342 + NFS silly-renaming
69343 + */
69344 +
69345 + write_lock(&gr_inode_lock);
69346 + if (unlikely(replace && inode)) {
69347 + ino_t new_ino = inode->i_ino;
69348 + dev_t new_dev = __get_dev(new_dentry);
69349 +
69350 + inodev = lookup_inodev_entry(new_ino, new_dev);
69351 + if (inodev != NULL && ((inode->i_nlink <= 1) || S_ISDIR(inode->i_mode)))
69352 + do_handle_delete(inodev, new_ino, new_dev);
69353 + }
69354 +
69355 + inodev = lookup_inodev_entry(old_ino, old_dev);
69356 + if (inodev != NULL && ((old_dentry->d_inode->i_nlink <= 1) || S_ISDIR(old_dentry->d_inode->i_mode)))
69357 + do_handle_delete(inodev, old_ino, old_dev);
69358 +
69359 + if (unlikely((unsigned long)matchn))
69360 + do_handle_create(matchn, old_dentry, mnt);
69361 +
69362 + write_unlock(&gr_inode_lock);
69363 + preempt_enable();
69364 +
69365 + return;
69366 +}
69367 +
69368 +#if defined(CONFIG_GRKERNSEC_RESLOG) || !defined(CONFIG_GRKERNSEC_NO_RBAC)
69369 +static const unsigned long res_learn_bumps[GR_NLIMITS] = {
69370 + [RLIMIT_CPU] = GR_RLIM_CPU_BUMP,
69371 + [RLIMIT_FSIZE] = GR_RLIM_FSIZE_BUMP,
69372 + [RLIMIT_DATA] = GR_RLIM_DATA_BUMP,
69373 + [RLIMIT_STACK] = GR_RLIM_STACK_BUMP,
69374 + [RLIMIT_CORE] = GR_RLIM_CORE_BUMP,
69375 + [RLIMIT_RSS] = GR_RLIM_RSS_BUMP,
69376 + [RLIMIT_NPROC] = GR_RLIM_NPROC_BUMP,
69377 + [RLIMIT_NOFILE] = GR_RLIM_NOFILE_BUMP,
69378 + [RLIMIT_MEMLOCK] = GR_RLIM_MEMLOCK_BUMP,
69379 + [RLIMIT_AS] = GR_RLIM_AS_BUMP,
69380 + [RLIMIT_LOCKS] = GR_RLIM_LOCKS_BUMP,
69381 + [RLIMIT_SIGPENDING] = GR_RLIM_SIGPENDING_BUMP,
69382 + [RLIMIT_MSGQUEUE] = GR_RLIM_MSGQUEUE_BUMP,
69383 + [RLIMIT_NICE] = GR_RLIM_NICE_BUMP,
69384 + [RLIMIT_RTPRIO] = GR_RLIM_RTPRIO_BUMP,
69385 + [RLIMIT_RTTIME] = GR_RLIM_RTTIME_BUMP
69386 +};
69387 +
69388 +void
69389 +gr_learn_resource(const struct task_struct *task,
69390 + const int res, const unsigned long wanted, const int gt)
69391 +{
69392 + struct acl_subject_label *acl;
69393 + const struct cred *cred;
69394 +
69395 + if (unlikely((gr_status & GR_READY) &&
69396 + task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
69397 + goto skip_reslog;
69398 +
69399 + gr_log_resource(task, res, wanted, gt);
69400 +skip_reslog:
69401 +
69402 + if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
69403 + return;
69404 +
69405 + acl = task->acl;
69406 +
69407 + if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
69408 + !(acl->resmask & (1U << (unsigned short) res))))
69409 + return;
69410 +
69411 + if (wanted >= acl->res[res].rlim_cur) {
69412 + unsigned long res_add;
69413 +
69414 + res_add = wanted + res_learn_bumps[res];
69415 +
69416 + acl->res[res].rlim_cur = res_add;
69417 +
69418 + if (wanted > acl->res[res].rlim_max)
69419 + acl->res[res].rlim_max = res_add;
69420 +
69421 + /* only log the subject filename, since resource logging is supported for
69422 + single-subject learning only */
69423 + rcu_read_lock();
69424 + cred = __task_cred(task);
69425 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
69426 + task->role->roletype, GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid), acl->filename,
69427 + acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
69428 + "", (unsigned long) res, &task->signal->saved_ip);
69429 + rcu_read_unlock();
69430 + }
69431 +
69432 + return;
69433 +}
69434 +EXPORT_SYMBOL_GPL(gr_learn_resource);
69435 +#endif
69436 +
69437 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
69438 +void
69439 +pax_set_initial_flags(struct linux_binprm *bprm)
69440 +{
69441 + struct task_struct *task = current;
69442 + struct acl_subject_label *proc;
69443 + unsigned long flags;
69444 +
69445 + if (unlikely(!(gr_status & GR_READY)))
69446 + return;
69447 +
69448 + flags = pax_get_flags(task);
69449 +
69450 + proc = task->acl;
69451 +
69452 + if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
69453 + flags &= ~MF_PAX_PAGEEXEC;
69454 + if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
69455 + flags &= ~MF_PAX_SEGMEXEC;
69456 + if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
69457 + flags &= ~MF_PAX_RANDMMAP;
69458 + if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
69459 + flags &= ~MF_PAX_EMUTRAMP;
69460 + if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
69461 + flags &= ~MF_PAX_MPROTECT;
69462 +
69463 + if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
69464 + flags |= MF_PAX_PAGEEXEC;
69465 + if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
69466 + flags |= MF_PAX_SEGMEXEC;
69467 + if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
69468 + flags |= MF_PAX_RANDMMAP;
69469 + if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
69470 + flags |= MF_PAX_EMUTRAMP;
69471 + if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
69472 + flags |= MF_PAX_MPROTECT;
69473 +
69474 + pax_set_flags(task, flags);
69475 +
69476 + return;
69477 +}
69478 +#endif
69479 +
69480 +int
69481 +gr_handle_proc_ptrace(struct task_struct *task)
69482 +{
69483 + struct file *filp;
69484 + struct task_struct *tmp = task;
69485 + struct task_struct *curtemp = current;
69486 + __u32 retmode;
69487 +
69488 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
69489 + if (unlikely(!(gr_status & GR_READY)))
69490 + return 0;
69491 +#endif
69492 +
69493 + read_lock(&tasklist_lock);
69494 + read_lock(&grsec_exec_file_lock);
69495 + filp = task->exec_file;
69496 +
69497 + while (task_pid_nr(tmp) > 0) {
69498 + if (tmp == curtemp)
69499 + break;
69500 + tmp = tmp->real_parent;
69501 + }
69502 +
69503 + if (!filp || (task_pid_nr(tmp) == 0 && ((grsec_enable_harden_ptrace && gr_is_global_nonroot(current_uid()) && !(gr_status & GR_READY)) ||
69504 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
69505 + read_unlock(&grsec_exec_file_lock);
69506 + read_unlock(&tasklist_lock);
69507 + return 1;
69508 + }
69509 +
69510 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
69511 + if (!(gr_status & GR_READY)) {
69512 + read_unlock(&grsec_exec_file_lock);
69513 + read_unlock(&tasklist_lock);
69514 + return 0;
69515 + }
69516 +#endif
69517 +
69518 + retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
69519 + read_unlock(&grsec_exec_file_lock);
69520 + read_unlock(&tasklist_lock);
69521 +
69522 + if (retmode & GR_NOPTRACE)
69523 + return 1;
69524 +
69525 + if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
69526 + && (current->acl != task->acl || (current->acl != current->role->root_label
69527 + && task_pid_nr(current) != task_pid_nr(task))))
69528 + return 1;
69529 +
69530 + return 0;
69531 +}
69532 +
69533 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
69534 +{
69535 + if (unlikely(!(gr_status & GR_READY)))
69536 + return;
69537 +
69538 + if (!(current->role->roletype & GR_ROLE_GOD))
69539 + return;
69540 +
69541 + seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
69542 + p->role->rolename, gr_task_roletype_to_char(p),
69543 + p->acl->filename);
69544 +}
69545 +
69546 +int
69547 +gr_handle_ptrace(struct task_struct *task, const long request)
69548 +{
69549 + struct task_struct *tmp = task;
69550 + struct task_struct *curtemp = current;
69551 + __u32 retmode;
69552 +
69553 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
69554 + if (unlikely(!(gr_status & GR_READY)))
69555 + return 0;
69556 +#endif
69557 + if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
69558 + read_lock(&tasklist_lock);
69559 + while (task_pid_nr(tmp) > 0) {
69560 + if (tmp == curtemp)
69561 + break;
69562 + tmp = tmp->real_parent;
69563 + }
69564 +
69565 + if (task_pid_nr(tmp) == 0 && ((grsec_enable_harden_ptrace && gr_is_global_nonroot(current_uid()) && !(gr_status & GR_READY)) ||
69566 + ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
69567 + read_unlock(&tasklist_lock);
69568 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
69569 + return 1;
69570 + }
69571 + read_unlock(&tasklist_lock);
69572 + }
69573 +
69574 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
69575 + if (!(gr_status & GR_READY))
69576 + return 0;
69577 +#endif
69578 +
69579 + read_lock(&grsec_exec_file_lock);
69580 + if (unlikely(!task->exec_file)) {
69581 + read_unlock(&grsec_exec_file_lock);
69582 + return 0;
69583 + }
69584 +
69585 + retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
69586 + read_unlock(&grsec_exec_file_lock);
69587 +
69588 + if (retmode & GR_NOPTRACE) {
69589 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
69590 + return 1;
69591 + }
69592 +
69593 + if (retmode & GR_PTRACERD) {
69594 + switch (request) {
69595 + case PTRACE_SEIZE:
69596 + case PTRACE_POKETEXT:
69597 + case PTRACE_POKEDATA:
69598 + case PTRACE_POKEUSR:
69599 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
69600 + case PTRACE_SETREGS:
69601 + case PTRACE_SETFPREGS:
69602 +#endif
69603 +#ifdef CONFIG_X86
69604 + case PTRACE_SETFPXREGS:
69605 +#endif
69606 +#ifdef CONFIG_ALTIVEC
69607 + case PTRACE_SETVRREGS:
69608 +#endif
69609 + return 1;
69610 + default:
69611 + return 0;
69612 + }
69613 + } else if (!(current->acl->mode & GR_POVERRIDE) &&
69614 + !(current->role->roletype & GR_ROLE_GOD) &&
69615 + (current->acl != task->acl)) {
69616 + gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
69617 + return 1;
69618 + }
69619 +
69620 + return 0;
69621 +}
69622 +
69623 +static int is_writable_mmap(const struct file *filp)
69624 +{
69625 + struct task_struct *task = current;
69626 + struct acl_object_label *obj, *obj2;
69627 +
69628 + if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
69629 + !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
69630 + obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, running_polstate.default_role->root_label);
69631 + obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
69632 + task->role->root_label);
69633 + if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
69634 + gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
69635 + return 1;
69636 + }
69637 + }
69638 + return 0;
69639 +}
69640 +
69641 +int
69642 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
69643 +{
69644 + __u32 mode;
69645 +
69646 + if (unlikely(!file || !(prot & PROT_EXEC)))
69647 + return 1;
69648 +
69649 + if (is_writable_mmap(file))
69650 + return 0;
69651 +
69652 + mode =
69653 + gr_search_file(file->f_path.dentry,
69654 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
69655 + file->f_path.mnt);
69656 +
69657 + if (!gr_tpe_allow(file))
69658 + return 0;
69659 +
69660 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
69661 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
69662 + return 0;
69663 + } else if (unlikely(!(mode & GR_EXEC))) {
69664 + return 0;
69665 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
69666 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
69667 + return 1;
69668 + }
69669 +
69670 + return 1;
69671 +}
69672 +
69673 +int
69674 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
69675 +{
69676 + __u32 mode;
69677 +
69678 + if (unlikely(!file || !(prot & PROT_EXEC)))
69679 + return 1;
69680 +
69681 + if (is_writable_mmap(file))
69682 + return 0;
69683 +
69684 + mode =
69685 + gr_search_file(file->f_path.dentry,
69686 + GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
69687 + file->f_path.mnt);
69688 +
69689 + if (!gr_tpe_allow(file))
69690 + return 0;
69691 +
69692 + if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
69693 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
69694 + return 0;
69695 + } else if (unlikely(!(mode & GR_EXEC))) {
69696 + return 0;
69697 + } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
69698 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
69699 + return 1;
69700 + }
69701 +
69702 + return 1;
69703 +}
69704 +
69705 +void
69706 +gr_acl_handle_psacct(struct task_struct *task, const long code)
69707 +{
69708 + unsigned long runtime, cputime;
69709 + cputime_t utime, stime;
69710 + unsigned int wday, cday;
69711 + __u8 whr, chr;
69712 + __u8 wmin, cmin;
69713 + __u8 wsec, csec;
69714 + struct timespec timeval;
69715 +
69716 + if (unlikely(!(gr_status & GR_READY) || !task->acl ||
69717 + !(task->acl->mode & GR_PROCACCT)))
69718 + return;
69719 +
69720 + do_posix_clock_monotonic_gettime(&timeval);
69721 + runtime = timeval.tv_sec - task->start_time.tv_sec;
69722 + wday = runtime / (60 * 60 * 24);
69723 + runtime -= wday * (60 * 60 * 24);
69724 + whr = runtime / (60 * 60);
69725 + runtime -= whr * (60 * 60);
69726 + wmin = runtime / 60;
69727 + runtime -= wmin * 60;
69728 + wsec = runtime;
69729 +
69730 + task_cputime(task, &utime, &stime);
69731 + cputime = cputime_to_secs(utime + stime);
69732 + cday = cputime / (60 * 60 * 24);
69733 + cputime -= cday * (60 * 60 * 24);
69734 + chr = cputime / (60 * 60);
69735 + cputime -= chr * (60 * 60);
69736 + cmin = cputime / 60;
69737 + cputime -= cmin * 60;
69738 + csec = cputime;
69739 +
69740 + gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
69741 +
69742 + return;
69743 +}
69744 +
69745 +#ifdef CONFIG_TASKSTATS
69746 +int gr_is_taskstats_denied(int pid)
69747 +{
69748 + struct task_struct *task;
69749 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69750 + const struct cred *cred;
69751 +#endif
69752 + int ret = 0;
69753 +
69754 + /* restrict taskstats viewing to un-chrooted root users
69755 + who have the 'view' subject flag if the RBAC system is enabled
69756 + */
69757 +
69758 + rcu_read_lock();
69759 + read_lock(&tasklist_lock);
69760 + task = find_task_by_vpid(pid);
69761 + if (task) {
69762 +#ifdef CONFIG_GRKERNSEC_CHROOT
69763 + if (proc_is_chrooted(task))
69764 + ret = -EACCES;
69765 +#endif
69766 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69767 + cred = __task_cred(task);
69768 +#ifdef CONFIG_GRKERNSEC_PROC_USER
69769 + if (gr_is_global_nonroot(cred->uid))
69770 + ret = -EACCES;
69771 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
69772 + if (gr_is_global_nonroot(cred->uid) && !groups_search(cred->group_info, grsec_proc_gid))
69773 + ret = -EACCES;
69774 +#endif
69775 +#endif
69776 + if (gr_status & GR_READY) {
69777 + if (!(task->acl->mode & GR_VIEW))
69778 + ret = -EACCES;
69779 + }
69780 + } else
69781 + ret = -ENOENT;
69782 +
69783 + read_unlock(&tasklist_lock);
69784 + rcu_read_unlock();
69785 +
69786 + return ret;
69787 +}
69788 +#endif
69789 +
69790 +/* AUXV entries are filled via a descendant of search_binary_handler
69791 + after we've already applied the subject for the target
69792 +*/
69793 +int gr_acl_enable_at_secure(void)
69794 +{
69795 + if (unlikely(!(gr_status & GR_READY)))
69796 + return 0;
69797 +
69798 + if (current->acl->mode & GR_ATSECURE)
69799 + return 1;
69800 +
69801 + return 0;
69802 +}
69803 +
69804 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
69805 +{
69806 + struct task_struct *task = current;
69807 + struct dentry *dentry = file->f_path.dentry;
69808 + struct vfsmount *mnt = file->f_path.mnt;
69809 + struct acl_object_label *obj, *tmp;
69810 + struct acl_subject_label *subj;
69811 + unsigned int bufsize;
69812 + int is_not_root;
69813 + char *path;
69814 + dev_t dev = __get_dev(dentry);
69815 +
69816 + if (unlikely(!(gr_status & GR_READY)))
69817 + return 1;
69818 +
69819 + if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
69820 + return 1;
69821 +
69822 + /* ignore Eric Biederman */
69823 + if (IS_PRIVATE(dentry->d_inode))
69824 + return 1;
69825 +
69826 + subj = task->acl;
69827 + read_lock(&gr_inode_lock);
69828 + do {
69829 + obj = lookup_acl_obj_label(ino, dev, subj);
69830 + if (obj != NULL) {
69831 + read_unlock(&gr_inode_lock);
69832 + return (obj->mode & GR_FIND) ? 1 : 0;
69833 + }
69834 + } while ((subj = subj->parent_subject));
69835 + read_unlock(&gr_inode_lock);
69836 +
69837 + /* this is purely an optimization since we're looking for an object
69838 + for the directory we're doing a readdir on
69839 + if it's possible for any globbed object to match the entry we're
69840 + filling into the directory, then the object we find here will be
69841 + an anchor point with attached globbed objects
69842 + */
69843 + obj = chk_obj_label_noglob(dentry, mnt, task->acl);
69844 + if (obj->globbed == NULL)
69845 + return (obj->mode & GR_FIND) ? 1 : 0;
69846 +
69847 + is_not_root = ((obj->filename[0] == '/') &&
69848 + (obj->filename[1] == '\0')) ? 0 : 1;
69849 + bufsize = PAGE_SIZE - namelen - is_not_root;
69850 +
69851 + /* check bufsize > PAGE_SIZE || bufsize == 0 */
69852 + if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
69853 + return 1;
69854 +
69855 + preempt_disable();
69856 + path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
69857 + bufsize);
69858 +
69859 + bufsize = strlen(path);
69860 +
69861 + /* if base is "/", don't append an additional slash */
69862 + if (is_not_root)
69863 + *(path + bufsize) = '/';
69864 + memcpy(path + bufsize + is_not_root, name, namelen);
69865 + *(path + bufsize + namelen + is_not_root) = '\0';
69866 +
69867 + tmp = obj->globbed;
69868 + while (tmp) {
69869 + if (!glob_match(tmp->filename, path)) {
69870 + preempt_enable();
69871 + return (tmp->mode & GR_FIND) ? 1 : 0;
69872 + }
69873 + tmp = tmp->next;
69874 + }
69875 + preempt_enable();
69876 + return (obj->mode & GR_FIND) ? 1 : 0;
69877 +}
69878 +
69879 +void gr_put_exec_file(struct task_struct *task)
69880 +{
69881 + struct file *filp;
69882 +
69883 + write_lock(&grsec_exec_file_lock);
69884 + filp = task->exec_file;
69885 + task->exec_file = NULL;
69886 + write_unlock(&grsec_exec_file_lock);
69887 +
69888 + if (filp)
69889 + fput(filp);
69890 +
69891 + return;
69892 +}
69893 +
69894 +
69895 +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
69896 +EXPORT_SYMBOL_GPL(gr_acl_is_enabled);
69897 +#endif
69898 +#ifdef CONFIG_SECURITY
69899 +EXPORT_SYMBOL_GPL(gr_check_user_change);
69900 +EXPORT_SYMBOL_GPL(gr_check_group_change);
69901 +#endif
69902 +
69903 diff --git a/grsecurity/gracl_alloc.c b/grsecurity/gracl_alloc.c
69904 new file mode 100644
69905 index 0000000..18ffbbd
69906 --- /dev/null
69907 +++ b/grsecurity/gracl_alloc.c
69908 @@ -0,0 +1,105 @@
69909 +#include <linux/kernel.h>
69910 +#include <linux/mm.h>
69911 +#include <linux/slab.h>
69912 +#include <linux/vmalloc.h>
69913 +#include <linux/gracl.h>
69914 +#include <linux/grsecurity.h>
69915 +
69916 +static struct gr_alloc_state __current_alloc_state = { 1, 1, NULL };
69917 +struct gr_alloc_state *current_alloc_state = &__current_alloc_state;
69918 +
69919 +static __inline__ int
69920 +alloc_pop(void)
69921 +{
69922 + if (current_alloc_state->alloc_stack_next == 1)
69923 + return 0;
69924 +
69925 + kfree(current_alloc_state->alloc_stack[current_alloc_state->alloc_stack_next - 2]);
69926 +
69927 + current_alloc_state->alloc_stack_next--;
69928 +
69929 + return 1;
69930 +}
69931 +
69932 +static __inline__ int
69933 +alloc_push(void *buf)
69934 +{
69935 + if (current_alloc_state->alloc_stack_next >= current_alloc_state->alloc_stack_size)
69936 + return 1;
69937 +
69938 + current_alloc_state->alloc_stack[current_alloc_state->alloc_stack_next - 1] = buf;
69939 +
69940 + current_alloc_state->alloc_stack_next++;
69941 +
69942 + return 0;
69943 +}
69944 +
69945 +void *
69946 +acl_alloc(unsigned long len)
69947 +{
69948 + void *ret = NULL;
69949 +
69950 + if (!len || len > PAGE_SIZE)
69951 + goto out;
69952 +
69953 + ret = kmalloc(len, GFP_KERNEL);
69954 +
69955 + if (ret) {
69956 + if (alloc_push(ret)) {
69957 + kfree(ret);
69958 + ret = NULL;
69959 + }
69960 + }
69961 +
69962 +out:
69963 + return ret;
69964 +}
69965 +
69966 +void *
69967 +acl_alloc_num(unsigned long num, unsigned long len)
69968 +{
69969 + if (!len || (num > (PAGE_SIZE / len)))
69970 + return NULL;
69971 +
69972 + return acl_alloc(num * len);
69973 +}
69974 +
69975 +void
69976 +acl_free_all(void)
69977 +{
69978 + if (!current_alloc_state->alloc_stack)
69979 + return;
69980 +
69981 + while (alloc_pop()) ;
69982 +
69983 + if (current_alloc_state->alloc_stack) {
69984 + if ((current_alloc_state->alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
69985 + kfree(current_alloc_state->alloc_stack);
69986 + else
69987 + vfree(current_alloc_state->alloc_stack);
69988 + }
69989 +
69990 + current_alloc_state->alloc_stack = NULL;
69991 + current_alloc_state->alloc_stack_size = 1;
69992 + current_alloc_state->alloc_stack_next = 1;
69993 +
69994 + return;
69995 +}
69996 +
69997 +int
69998 +acl_alloc_stack_init(unsigned long size)
69999 +{
70000 + if ((size * sizeof (void *)) <= PAGE_SIZE)
70001 + current_alloc_state->alloc_stack =
70002 + (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
70003 + else
70004 + current_alloc_state->alloc_stack = (void **) vmalloc(size * sizeof (void *));
70005 +
70006 + current_alloc_state->alloc_stack_size = size;
70007 + current_alloc_state->alloc_stack_next = 1;
70008 +
70009 + if (!current_alloc_state->alloc_stack)
70010 + return 0;
70011 + else
70012 + return 1;
70013 +}
70014 diff --git a/grsecurity/gracl_cap.c b/grsecurity/gracl_cap.c
70015 new file mode 100644
70016 index 0000000..bdd51ea
70017 --- /dev/null
70018 +++ b/grsecurity/gracl_cap.c
70019 @@ -0,0 +1,110 @@
70020 +#include <linux/kernel.h>
70021 +#include <linux/module.h>
70022 +#include <linux/sched.h>
70023 +#include <linux/gracl.h>
70024 +#include <linux/grsecurity.h>
70025 +#include <linux/grinternal.h>
70026 +
70027 +extern const char *captab_log[];
70028 +extern int captab_log_entries;
70029 +
70030 +int gr_task_acl_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
70031 +{
70032 + struct acl_subject_label *curracl;
70033 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
70034 + kernel_cap_t cap_audit = __cap_empty_set;
70035 +
70036 + if (!gr_acl_is_enabled())
70037 + return 1;
70038 +
70039 + curracl = task->acl;
70040 +
70041 + cap_drop = curracl->cap_lower;
70042 + cap_mask = curracl->cap_mask;
70043 + cap_audit = curracl->cap_invert_audit;
70044 +
70045 + while ((curracl = curracl->parent_subject)) {
70046 + /* if the cap isn't specified in the current computed mask but is specified in the
70047 + current level subject, and is lowered in the current level subject, then add
70048 + it to the set of dropped capabilities
70049 + otherwise, add the current level subject's mask to the current computed mask
70050 + */
70051 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
70052 + cap_raise(cap_mask, cap);
70053 + if (cap_raised(curracl->cap_lower, cap))
70054 + cap_raise(cap_drop, cap);
70055 + if (cap_raised(curracl->cap_invert_audit, cap))
70056 + cap_raise(cap_audit, cap);
70057 + }
70058 + }
70059 +
70060 + if (!cap_raised(cap_drop, cap)) {
70061 + if (cap_raised(cap_audit, cap))
70062 + gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
70063 + return 1;
70064 + }
70065 +
70066 + curracl = task->acl;
70067 +
70068 + if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
70069 + && cap_raised(cred->cap_effective, cap)) {
70070 + security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
70071 + task->role->roletype, GR_GLOBAL_UID(cred->uid),
70072 + GR_GLOBAL_GID(cred->gid), task->exec_file ?
70073 + gr_to_filename(task->exec_file->f_path.dentry,
70074 + task->exec_file->f_path.mnt) : curracl->filename,
70075 + curracl->filename, 0UL,
70076 + 0UL, "", (unsigned long) cap, &task->signal->saved_ip);
70077 + return 1;
70078 + }
70079 +
70080 + if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
70081 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
70082 +
70083 + return 0;
70084 +}
70085 +
70086 +int
70087 +gr_acl_is_capable(const int cap)
70088 +{
70089 + return gr_task_acl_is_capable(current, current_cred(), cap);
70090 +}
70091 +
70092 +int gr_task_acl_is_capable_nolog(const struct task_struct *task, const int cap)
70093 +{
70094 + struct acl_subject_label *curracl;
70095 + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
70096 +
70097 + if (!gr_acl_is_enabled())
70098 + return 1;
70099 +
70100 + curracl = task->acl;
70101 +
70102 + cap_drop = curracl->cap_lower;
70103 + cap_mask = curracl->cap_mask;
70104 +
70105 + while ((curracl = curracl->parent_subject)) {
70106 + /* if the cap isn't specified in the current computed mask but is specified in the
70107 + current level subject, and is lowered in the current level subject, then add
70108 + it to the set of dropped capabilities
70109 + otherwise, add the current level subject's mask to the current computed mask
70110 + */
70111 + if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
70112 + cap_raise(cap_mask, cap);
70113 + if (cap_raised(curracl->cap_lower, cap))
70114 + cap_raise(cap_drop, cap);
70115 + }
70116 + }
70117 +
70118 + if (!cap_raised(cap_drop, cap))
70119 + return 1;
70120 +
70121 + return 0;
70122 +}
70123 +
70124 +int
70125 +gr_acl_is_capable_nolog(const int cap)
70126 +{
70127 + return gr_task_acl_is_capable_nolog(current, cap);
70128 +}
70129 +
70130 diff --git a/grsecurity/gracl_compat.c b/grsecurity/gracl_compat.c
70131 new file mode 100644
70132 index 0000000..ca25605
70133 --- /dev/null
70134 +++ b/grsecurity/gracl_compat.c
70135 @@ -0,0 +1,270 @@
70136 +#include <linux/kernel.h>
70137 +#include <linux/gracl.h>
70138 +#include <linux/compat.h>
70139 +#include <linux/gracl_compat.h>
70140 +
70141 +#include <asm/uaccess.h>
70142 +
70143 +int copy_gr_arg_wrapper_compat(const char *buf, struct gr_arg_wrapper *uwrap)
70144 +{
70145 + struct gr_arg_wrapper_compat uwrapcompat;
70146 +
70147 + if (copy_from_user(&uwrapcompat, buf, sizeof(uwrapcompat)))
70148 + return -EFAULT;
70149 +
70150 + if (((uwrapcompat.version != GRSECURITY_VERSION) &&
70151 + (uwrapcompat.version != 0x2901)) ||
70152 + (uwrapcompat.size != sizeof(struct gr_arg_compat)))
70153 + return -EINVAL;
70154 +
70155 + uwrap->arg = compat_ptr(uwrapcompat.arg);
70156 + uwrap->version = uwrapcompat.version;
70157 + uwrap->size = sizeof(struct gr_arg);
70158 +
70159 + return 0;
70160 +}
70161 +
70162 +int copy_gr_arg_compat(const struct gr_arg __user *buf, struct gr_arg *arg)
70163 +{
70164 + struct gr_arg_compat argcompat;
70165 +
70166 + if (copy_from_user(&argcompat, buf, sizeof(argcompat)))
70167 + return -EFAULT;
70168 +
70169 + arg->role_db.r_table = compat_ptr(argcompat.role_db.r_table);
70170 + arg->role_db.num_pointers = argcompat.role_db.num_pointers;
70171 + arg->role_db.num_roles = argcompat.role_db.num_roles;
70172 + arg->role_db.num_domain_children = argcompat.role_db.num_domain_children;
70173 + arg->role_db.num_subjects = argcompat.role_db.num_subjects;
70174 + arg->role_db.num_objects = argcompat.role_db.num_objects;
70175 +
70176 + memcpy(&arg->pw, &argcompat.pw, sizeof(arg->pw));
70177 + memcpy(&arg->salt, &argcompat.salt, sizeof(arg->salt));
70178 + memcpy(&arg->sum, &argcompat.sum, sizeof(arg->sum));
70179 + memcpy(&arg->sp_role, &argcompat.sp_role, sizeof(arg->sp_role));
70180 + arg->sprole_pws = compat_ptr(argcompat.sprole_pws);
70181 + arg->segv_device = argcompat.segv_device;
70182 + arg->segv_inode = argcompat.segv_inode;
70183 + arg->segv_uid = argcompat.segv_uid;
70184 + arg->num_sprole_pws = argcompat.num_sprole_pws;
70185 + arg->mode = argcompat.mode;
70186 +
70187 + return 0;
70188 +}
70189 +
70190 +int copy_acl_object_label_compat(struct acl_object_label *obj, const struct acl_object_label *userp)
70191 +{
70192 + struct acl_object_label_compat objcompat;
70193 +
70194 + if (copy_from_user(&objcompat, userp, sizeof(objcompat)))
70195 + return -EFAULT;
70196 +
70197 + obj->filename = compat_ptr(objcompat.filename);
70198 + obj->inode = objcompat.inode;
70199 + obj->device = objcompat.device;
70200 + obj->mode = objcompat.mode;
70201 +
70202 + obj->nested = compat_ptr(objcompat.nested);
70203 + obj->globbed = compat_ptr(objcompat.globbed);
70204 +
70205 + obj->prev = compat_ptr(objcompat.prev);
70206 + obj->next = compat_ptr(objcompat.next);
70207 +
70208 + return 0;
70209 +}
70210 +
70211 +int copy_acl_subject_label_compat(struct acl_subject_label *subj, const struct acl_subject_label *userp)
70212 +{
70213 + unsigned int i;
70214 + struct acl_subject_label_compat subjcompat;
70215 +
70216 + if (copy_from_user(&subjcompat, userp, sizeof(subjcompat)))
70217 + return -EFAULT;
70218 +
70219 + subj->filename = compat_ptr(subjcompat.filename);
70220 + subj->inode = subjcompat.inode;
70221 + subj->device = subjcompat.device;
70222 + subj->mode = subjcompat.mode;
70223 + subj->cap_mask = subjcompat.cap_mask;
70224 + subj->cap_lower = subjcompat.cap_lower;
70225 + subj->cap_invert_audit = subjcompat.cap_invert_audit;
70226 +
70227 + for (i = 0; i < GR_NLIMITS; i++) {
70228 + if (subjcompat.res[i].rlim_cur == COMPAT_RLIM_INFINITY)
70229 + subj->res[i].rlim_cur = RLIM_INFINITY;
70230 + else
70231 + subj->res[i].rlim_cur = subjcompat.res[i].rlim_cur;
70232 + if (subjcompat.res[i].rlim_max == COMPAT_RLIM_INFINITY)
70233 + subj->res[i].rlim_max = RLIM_INFINITY;
70234 + else
70235 + subj->res[i].rlim_max = subjcompat.res[i].rlim_max;
70236 + }
70237 + subj->resmask = subjcompat.resmask;
70238 +
70239 + subj->user_trans_type = subjcompat.user_trans_type;
70240 + subj->group_trans_type = subjcompat.group_trans_type;
70241 + subj->user_transitions = compat_ptr(subjcompat.user_transitions);
70242 + subj->group_transitions = compat_ptr(subjcompat.group_transitions);
70243 + subj->user_trans_num = subjcompat.user_trans_num;
70244 + subj->group_trans_num = subjcompat.group_trans_num;
70245 +
70246 + memcpy(&subj->sock_families, &subjcompat.sock_families, sizeof(subj->sock_families));
70247 + memcpy(&subj->ip_proto, &subjcompat.ip_proto, sizeof(subj->ip_proto));
70248 + subj->ip_type = subjcompat.ip_type;
70249 + subj->ips = compat_ptr(subjcompat.ips);
70250 + subj->ip_num = subjcompat.ip_num;
70251 + subj->inaddr_any_override = subjcompat.inaddr_any_override;
70252 +
70253 + subj->crashes = subjcompat.crashes;
70254 + subj->expires = subjcompat.expires;
70255 +
70256 + subj->parent_subject = compat_ptr(subjcompat.parent_subject);
70257 + subj->hash = compat_ptr(subjcompat.hash);
70258 + subj->prev = compat_ptr(subjcompat.prev);
70259 + subj->next = compat_ptr(subjcompat.next);
70260 +
70261 + subj->obj_hash = compat_ptr(subjcompat.obj_hash);
70262 + subj->obj_hash_size = subjcompat.obj_hash_size;
70263 + subj->pax_flags = subjcompat.pax_flags;
70264 +
70265 + return 0;
70266 +}
70267 +
70268 +int copy_acl_role_label_compat(struct acl_role_label *role, const struct acl_role_label *userp)
70269 +{
70270 + struct acl_role_label_compat rolecompat;
70271 +
70272 + if (copy_from_user(&rolecompat, userp, sizeof(rolecompat)))
70273 + return -EFAULT;
70274 +
70275 + role->rolename = compat_ptr(rolecompat.rolename);
70276 + role->uidgid = rolecompat.uidgid;
70277 + role->roletype = rolecompat.roletype;
70278 +
70279 + role->auth_attempts = rolecompat.auth_attempts;
70280 + role->expires = rolecompat.expires;
70281 +
70282 + role->root_label = compat_ptr(rolecompat.root_label);
70283 + role->hash = compat_ptr(rolecompat.hash);
70284 +
70285 + role->prev = compat_ptr(rolecompat.prev);
70286 + role->next = compat_ptr(rolecompat.next);
70287 +
70288 + role->transitions = compat_ptr(rolecompat.transitions);
70289 + role->allowed_ips = compat_ptr(rolecompat.allowed_ips);
70290 + role->domain_children = compat_ptr(rolecompat.domain_children);
70291 + role->domain_child_num = rolecompat.domain_child_num;
70292 +
70293 + role->umask = rolecompat.umask;
70294 +
70295 + role->subj_hash = compat_ptr(rolecompat.subj_hash);
70296 + role->subj_hash_size = rolecompat.subj_hash_size;
70297 +
70298 + return 0;
70299 +}
70300 +
70301 +int copy_role_allowed_ip_compat(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp)
70302 +{
70303 + struct role_allowed_ip_compat roleip_compat;
70304 +
70305 + if (copy_from_user(&roleip_compat, userp, sizeof(roleip_compat)))
70306 + return -EFAULT;
70307 +
70308 + roleip->addr = roleip_compat.addr;
70309 + roleip->netmask = roleip_compat.netmask;
70310 +
70311 + roleip->prev = compat_ptr(roleip_compat.prev);
70312 + roleip->next = compat_ptr(roleip_compat.next);
70313 +
70314 + return 0;
70315 +}
70316 +
70317 +int copy_role_transition_compat(struct role_transition *trans, const struct role_transition *userp)
70318 +{
70319 + struct role_transition_compat trans_compat;
70320 +
70321 + if (copy_from_user(&trans_compat, userp, sizeof(trans_compat)))
70322 + return -EFAULT;
70323 +
70324 + trans->rolename = compat_ptr(trans_compat.rolename);
70325 +
70326 + trans->prev = compat_ptr(trans_compat.prev);
70327 + trans->next = compat_ptr(trans_compat.next);
70328 +
70329 + return 0;
70330 +
70331 +}
70332 +
70333 +int copy_gr_hash_struct_compat(struct gr_hash_struct *hash, const struct gr_hash_struct *userp)
70334 +{
70335 + struct gr_hash_struct_compat hash_compat;
70336 +
70337 + if (copy_from_user(&hash_compat, userp, sizeof(hash_compat)))
70338 + return -EFAULT;
70339 +
70340 + hash->table = compat_ptr(hash_compat.table);
70341 + hash->nametable = compat_ptr(hash_compat.nametable);
70342 + hash->first = compat_ptr(hash_compat.first);
70343 +
70344 + hash->table_size = hash_compat.table_size;
70345 + hash->used_size = hash_compat.used_size;
70346 +
70347 + hash->type = hash_compat.type;
70348 +
70349 + return 0;
70350 +}
70351 +
70352 +int copy_pointer_from_array_compat(void *ptr, unsigned long idx, const void *userp)
70353 +{
70354 + compat_uptr_t ptrcompat;
70355 +
70356 + if (copy_from_user(&ptrcompat, userp + (idx * sizeof(ptrcompat)), sizeof(ptrcompat)))
70357 + return -EFAULT;
70358 +
70359 + *(void **)ptr = compat_ptr(ptrcompat);
70360 +
70361 + return 0;
70362 +}
70363 +
70364 +int copy_acl_ip_label_compat(struct acl_ip_label *ip, const struct acl_ip_label *userp)
70365 +{
70366 + struct acl_ip_label_compat ip_compat;
70367 +
70368 + if (copy_from_user(&ip_compat, userp, sizeof(ip_compat)))
70369 + return -EFAULT;
70370 +
70371 + ip->iface = compat_ptr(ip_compat.iface);
70372 + ip->addr = ip_compat.addr;
70373 + ip->netmask = ip_compat.netmask;
70374 + ip->low = ip_compat.low;
70375 + ip->high = ip_compat.high;
70376 + ip->mode = ip_compat.mode;
70377 + ip->type = ip_compat.type;
70378 +
70379 + memcpy(&ip->proto, &ip_compat.proto, sizeof(ip->proto));
70380 +
70381 + ip->prev = compat_ptr(ip_compat.prev);
70382 + ip->next = compat_ptr(ip_compat.next);
70383 +
70384 + return 0;
70385 +}
70386 +
70387 +int copy_sprole_pw_compat(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp)
70388 +{
70389 + struct sprole_pw_compat pw_compat;
70390 +
70391 + if (copy_from_user(&pw_compat, (const void *)userp + (sizeof(pw_compat) * idx), sizeof(pw_compat)))
70392 + return -EFAULT;
70393 +
70394 + pw->rolename = compat_ptr(pw_compat.rolename);
70395 + memcpy(&pw->salt, pw_compat.salt, sizeof(pw->salt));
70396 + memcpy(&pw->sum, pw_compat.sum, sizeof(pw->sum));
70397 +
70398 + return 0;
70399 +}
70400 +
70401 +size_t get_gr_arg_wrapper_size_compat(void)
70402 +{
70403 + return sizeof(struct gr_arg_wrapper_compat);
70404 +}
70405 +
70406 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
70407 new file mode 100644
70408 index 0000000..a89b1f4
70409 --- /dev/null
70410 +++ b/grsecurity/gracl_fs.c
70411 @@ -0,0 +1,437 @@
70412 +#include <linux/kernel.h>
70413 +#include <linux/sched.h>
70414 +#include <linux/types.h>
70415 +#include <linux/fs.h>
70416 +#include <linux/file.h>
70417 +#include <linux/stat.h>
70418 +#include <linux/grsecurity.h>
70419 +#include <linux/grinternal.h>
70420 +#include <linux/gracl.h>
70421 +
70422 +umode_t
70423 +gr_acl_umask(void)
70424 +{
70425 + if (unlikely(!gr_acl_is_enabled()))
70426 + return 0;
70427 +
70428 + return current->role->umask;
70429 +}
70430 +
70431 +__u32
70432 +gr_acl_handle_hidden_file(const struct dentry * dentry,
70433 + const struct vfsmount * mnt)
70434 +{
70435 + __u32 mode;
70436 +
70437 + if (unlikely(d_is_negative(dentry)))
70438 + return GR_FIND;
70439 +
70440 + mode =
70441 + gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
70442 +
70443 + if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
70444 + gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
70445 + return mode;
70446 + } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
70447 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
70448 + return 0;
70449 + } else if (unlikely(!(mode & GR_FIND)))
70450 + return 0;
70451 +
70452 + return GR_FIND;
70453 +}
70454 +
70455 +__u32
70456 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
70457 + int acc_mode)
70458 +{
70459 + __u32 reqmode = GR_FIND;
70460 + __u32 mode;
70461 +
70462 + if (unlikely(d_is_negative(dentry)))
70463 + return reqmode;
70464 +
70465 + if (acc_mode & MAY_APPEND)
70466 + reqmode |= GR_APPEND;
70467 + else if (acc_mode & MAY_WRITE)
70468 + reqmode |= GR_WRITE;
70469 + if ((acc_mode & MAY_READ) && !S_ISDIR(dentry->d_inode->i_mode))
70470 + reqmode |= GR_READ;
70471 +
70472 + mode =
70473 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
70474 + mnt);
70475 +
70476 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
70477 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
70478 + reqmode & GR_READ ? " reading" : "",
70479 + reqmode & GR_WRITE ? " writing" : reqmode &
70480 + GR_APPEND ? " appending" : "");
70481 + return reqmode;
70482 + } else
70483 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
70484 + {
70485 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
70486 + reqmode & GR_READ ? " reading" : "",
70487 + reqmode & GR_WRITE ? " writing" : reqmode &
70488 + GR_APPEND ? " appending" : "");
70489 + return 0;
70490 + } else if (unlikely((mode & reqmode) != reqmode))
70491 + return 0;
70492 +
70493 + return reqmode;
70494 +}
70495 +
70496 +__u32
70497 +gr_acl_handle_creat(const struct dentry * dentry,
70498 + const struct dentry * p_dentry,
70499 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
70500 + const int imode)
70501 +{
70502 + __u32 reqmode = GR_WRITE | GR_CREATE;
70503 + __u32 mode;
70504 +
70505 + if (acc_mode & MAY_APPEND)
70506 + reqmode |= GR_APPEND;
70507 + // if a directory was required or the directory already exists, then
70508 + // don't count this open as a read
70509 + if ((acc_mode & MAY_READ) &&
70510 + !((open_flags & O_DIRECTORY) || (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))))
70511 + reqmode |= GR_READ;
70512 + if ((open_flags & O_CREAT) &&
70513 + ((imode & S_ISUID) || ((imode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
70514 + reqmode |= GR_SETID;
70515 +
70516 + mode =
70517 + gr_check_create(dentry, p_dentry, p_mnt,
70518 + reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
70519 +
70520 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
70521 + gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
70522 + reqmode & GR_READ ? " reading" : "",
70523 + reqmode & GR_WRITE ? " writing" : reqmode &
70524 + GR_APPEND ? " appending" : "");
70525 + return reqmode;
70526 + } else
70527 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
70528 + {
70529 + gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
70530 + reqmode & GR_READ ? " reading" : "",
70531 + reqmode & GR_WRITE ? " writing" : reqmode &
70532 + GR_APPEND ? " appending" : "");
70533 + return 0;
70534 + } else if (unlikely((mode & reqmode) != reqmode))
70535 + return 0;
70536 +
70537 + return reqmode;
70538 +}
70539 +
70540 +__u32
70541 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
70542 + const int fmode)
70543 +{
70544 + __u32 mode, reqmode = GR_FIND;
70545 +
70546 + if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
70547 + reqmode |= GR_EXEC;
70548 + if (fmode & S_IWOTH)
70549 + reqmode |= GR_WRITE;
70550 + if (fmode & S_IROTH)
70551 + reqmode |= GR_READ;
70552 +
70553 + mode =
70554 + gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
70555 + mnt);
70556 +
70557 + if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
70558 + gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
70559 + reqmode & GR_READ ? " reading" : "",
70560 + reqmode & GR_WRITE ? " writing" : "",
70561 + reqmode & GR_EXEC ? " executing" : "");
70562 + return reqmode;
70563 + } else
70564 + if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
70565 + {
70566 + gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
70567 + reqmode & GR_READ ? " reading" : "",
70568 + reqmode & GR_WRITE ? " writing" : "",
70569 + reqmode & GR_EXEC ? " executing" : "");
70570 + return 0;
70571 + } else if (unlikely((mode & reqmode) != reqmode))
70572 + return 0;
70573 +
70574 + return reqmode;
70575 +}
70576 +
70577 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
70578 +{
70579 + __u32 mode;
70580 +
70581 + mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
70582 +
70583 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
70584 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
70585 + return mode;
70586 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
70587 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
70588 + return 0;
70589 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
70590 + return 0;
70591 +
70592 + return (reqmode);
70593 +}
70594 +
70595 +__u32
70596 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
70597 +{
70598 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
70599 +}
70600 +
70601 +__u32
70602 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
70603 +{
70604 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
70605 +}
70606 +
70607 +__u32
70608 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
70609 +{
70610 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
70611 +}
70612 +
70613 +__u32
70614 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
70615 +{
70616 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
70617 +}
70618 +
70619 +__u32
70620 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
70621 + umode_t *modeptr)
70622 +{
70623 + umode_t mode;
70624 +
70625 + *modeptr &= ~gr_acl_umask();
70626 + mode = *modeptr;
70627 +
70628 + if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
70629 + return 1;
70630 +
70631 + if (unlikely(dentry->d_inode && !S_ISDIR(dentry->d_inode->i_mode) &&
70632 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))) {
70633 + return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
70634 + GR_CHMOD_ACL_MSG);
70635 + } else {
70636 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
70637 + }
70638 +}
70639 +
70640 +__u32
70641 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
70642 +{
70643 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
70644 +}
70645 +
70646 +__u32
70647 +gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
70648 +{
70649 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
70650 +}
70651 +
70652 +__u32
70653 +gr_acl_handle_removexattr(const struct dentry *dentry, const struct vfsmount *mnt)
70654 +{
70655 + return generic_fs_handler(dentry, mnt, GR_WRITE, GR_REMOVEXATTR_ACL_MSG);
70656 +}
70657 +
70658 +__u32
70659 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
70660 +{
70661 + return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
70662 +}
70663 +
70664 +__u32
70665 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
70666 +{
70667 + return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
70668 + GR_UNIXCONNECT_ACL_MSG);
70669 +}
70670 +
70671 +/* hardlinks require at minimum create and link permission,
70672 + any additional privilege required is based on the
70673 + privilege of the file being linked to
70674 +*/
70675 +__u32
70676 +gr_acl_handle_link(const struct dentry * new_dentry,
70677 + const struct dentry * parent_dentry,
70678 + const struct vfsmount * parent_mnt,
70679 + const struct dentry * old_dentry,
70680 + const struct vfsmount * old_mnt, const struct filename *to)
70681 +{
70682 + __u32 mode;
70683 + __u32 needmode = GR_CREATE | GR_LINK;
70684 + __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
70685 +
70686 + mode =
70687 + gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
70688 + old_mnt);
70689 +
70690 + if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
70691 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to->name);
70692 + return mode;
70693 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
70694 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to->name);
70695 + return 0;
70696 + } else if (unlikely((mode & needmode) != needmode))
70697 + return 0;
70698 +
70699 + return 1;
70700 +}
70701 +
70702 +__u32
70703 +gr_acl_handle_symlink(const struct dentry * new_dentry,
70704 + const struct dentry * parent_dentry,
70705 + const struct vfsmount * parent_mnt, const struct filename *from)
70706 +{
70707 + __u32 needmode = GR_WRITE | GR_CREATE;
70708 + __u32 mode;
70709 +
70710 + mode =
70711 + gr_check_create(new_dentry, parent_dentry, parent_mnt,
70712 + GR_CREATE | GR_AUDIT_CREATE |
70713 + GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
70714 +
70715 + if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
70716 + gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from->name, new_dentry, parent_mnt);
70717 + return mode;
70718 + } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
70719 + gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from->name, new_dentry, parent_mnt);
70720 + return 0;
70721 + } else if (unlikely((mode & needmode) != needmode))
70722 + return 0;
70723 +
70724 + return (GR_WRITE | GR_CREATE);
70725 +}
70726 +
70727 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
70728 +{
70729 + __u32 mode;
70730 +
70731 + mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
70732 +
70733 + if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
70734 + gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
70735 + return mode;
70736 + } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
70737 + gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
70738 + return 0;
70739 + } else if (unlikely((mode & (reqmode)) != (reqmode)))
70740 + return 0;
70741 +
70742 + return (reqmode);
70743 +}
70744 +
70745 +__u32
70746 +gr_acl_handle_mknod(const struct dentry * new_dentry,
70747 + const struct dentry * parent_dentry,
70748 + const struct vfsmount * parent_mnt,
70749 + const int mode)
70750 +{
70751 + __u32 reqmode = GR_WRITE | GR_CREATE;
70752 + if (unlikely((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))))
70753 + reqmode |= GR_SETID;
70754 +
70755 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
70756 + reqmode, GR_MKNOD_ACL_MSG);
70757 +}
70758 +
70759 +__u32
70760 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
70761 + const struct dentry *parent_dentry,
70762 + const struct vfsmount *parent_mnt)
70763 +{
70764 + return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
70765 + GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
70766 +}
70767 +
70768 +#define RENAME_CHECK_SUCCESS(old, new) \
70769 + (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
70770 + ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
70771 +
70772 +int
70773 +gr_acl_handle_rename(struct dentry *new_dentry,
70774 + struct dentry *parent_dentry,
70775 + const struct vfsmount *parent_mnt,
70776 + struct dentry *old_dentry,
70777 + struct inode *old_parent_inode,
70778 + struct vfsmount *old_mnt, const struct filename *newname)
70779 +{
70780 + __u32 comp1, comp2;
70781 + int error = 0;
70782 +
70783 + if (unlikely(!gr_acl_is_enabled()))
70784 + return 0;
70785 +
70786 + if (d_is_negative(new_dentry)) {
70787 + comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
70788 + GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
70789 + GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
70790 + comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
70791 + GR_DELETE | GR_AUDIT_DELETE |
70792 + GR_AUDIT_READ | GR_AUDIT_WRITE |
70793 + GR_SUPPRESS, old_mnt);
70794 + } else {
70795 + comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
70796 + GR_CREATE | GR_DELETE |
70797 + GR_AUDIT_CREATE | GR_AUDIT_DELETE |
70798 + GR_AUDIT_READ | GR_AUDIT_WRITE |
70799 + GR_SUPPRESS, parent_mnt);
70800 + comp2 =
70801 + gr_search_file(old_dentry,
70802 + GR_READ | GR_WRITE | GR_AUDIT_READ |
70803 + GR_DELETE | GR_AUDIT_DELETE |
70804 + GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
70805 + }
70806 +
70807 + if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
70808 + ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
70809 + gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname->name);
70810 + else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
70811 + && !(comp2 & GR_SUPPRESS)) {
70812 + gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname->name);
70813 + error = -EACCES;
70814 + } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
70815 + error = -EACCES;
70816 +
70817 + return error;
70818 +}
70819 +
70820 +void
70821 +gr_acl_handle_exit(void)
70822 +{
70823 + u16 id;
70824 + char *rolename;
70825 +
70826 + if (unlikely(current->acl_sp_role && gr_acl_is_enabled() &&
70827 + !(current->role->roletype & GR_ROLE_PERSIST))) {
70828 + id = current->acl_role_id;
70829 + rolename = current->role->rolename;
70830 + gr_set_acls(1);
70831 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
70832 + }
70833 +
70834 + gr_put_exec_file(current);
70835 + return;
70836 +}
70837 +
70838 +int
70839 +gr_acl_handle_procpidmem(const struct task_struct *task)
70840 +{
70841 + if (unlikely(!gr_acl_is_enabled()))
70842 + return 0;
70843 +
70844 + if (task != current && task->acl->mode & GR_PROTPROCFD)
70845 + return -EACCES;
70846 +
70847 + return 0;
70848 +}
70849 diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
70850 new file mode 100644
70851 index 0000000..f056b81
70852 --- /dev/null
70853 +++ b/grsecurity/gracl_ip.c
70854 @@ -0,0 +1,386 @@
70855 +#include <linux/kernel.h>
70856 +#include <asm/uaccess.h>
70857 +#include <asm/errno.h>
70858 +#include <net/sock.h>
70859 +#include <linux/file.h>
70860 +#include <linux/fs.h>
70861 +#include <linux/net.h>
70862 +#include <linux/in.h>
70863 +#include <linux/skbuff.h>
70864 +#include <linux/ip.h>
70865 +#include <linux/udp.h>
70866 +#include <linux/types.h>
70867 +#include <linux/sched.h>
70868 +#include <linux/netdevice.h>
70869 +#include <linux/inetdevice.h>
70870 +#include <linux/gracl.h>
70871 +#include <linux/grsecurity.h>
70872 +#include <linux/grinternal.h>
70873 +
70874 +#define GR_BIND 0x01
70875 +#define GR_CONNECT 0x02
70876 +#define GR_INVERT 0x04
70877 +#define GR_BINDOVERRIDE 0x08
70878 +#define GR_CONNECTOVERRIDE 0x10
70879 +#define GR_SOCK_FAMILY 0x20
70880 +
70881 +static const char * gr_protocols[IPPROTO_MAX] = {
70882 + "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
70883 + "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
70884 + "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
70885 + "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
70886 + "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
70887 + "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
70888 + "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
70889 + "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
70890 + "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
70891 + "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
70892 + "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
70893 + "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
70894 + "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
70895 + "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
70896 + "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
70897 + "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
70898 + "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
70899 + "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
70900 + "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
70901 + "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
70902 + "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
70903 + "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
70904 + "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
70905 + "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
70906 + "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
70907 + "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
70908 + "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
70909 + "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
70910 + "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
70911 + "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
70912 + "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
70913 + "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
70914 + };
70915 +
70916 +static const char * gr_socktypes[SOCK_MAX] = {
70917 + "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
70918 + "unknown:7", "unknown:8", "unknown:9", "packet"
70919 + };
70920 +
70921 +static const char * gr_sockfamilies[AF_MAX+1] = {
70922 + "unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
70923 + "inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
70924 + "econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
70925 + "tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154", "ciaf"
70926 + };
70927 +
70928 +const char *
70929 +gr_proto_to_name(unsigned char proto)
70930 +{
70931 + return gr_protocols[proto];
70932 +}
70933 +
70934 +const char *
70935 +gr_socktype_to_name(unsigned char type)
70936 +{
70937 + return gr_socktypes[type];
70938 +}
70939 +
70940 +const char *
70941 +gr_sockfamily_to_name(unsigned char family)
70942 +{
70943 + return gr_sockfamilies[family];
70944 +}
70945 +
70946 +extern const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
70947 +
70948 +int
70949 +gr_search_socket(const int domain, const int type, const int protocol)
70950 +{
70951 + struct acl_subject_label *curr;
70952 + const struct cred *cred = current_cred();
70953 +
70954 + if (unlikely(!gr_acl_is_enabled()))
70955 + goto exit;
70956 +
70957 + if ((domain < 0) || (type < 0) || (protocol < 0) ||
70958 + (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
70959 + goto exit; // let the kernel handle it
70960 +
70961 + curr = current->acl;
70962 +
70963 + if (curr->sock_families[domain / 32] & (1U << (domain % 32))) {
70964 + /* the family is allowed, if this is PF_INET allow it only if
70965 + the extra sock type/protocol checks pass */
70966 + if (domain == PF_INET)
70967 + goto inet_check;
70968 + goto exit;
70969 + } else {
70970 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
70971 + __u32 fakeip = 0;
70972 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
70973 + current->role->roletype, GR_GLOBAL_UID(cred->uid),
70974 + GR_GLOBAL_GID(cred->gid), current->exec_file ?
70975 + gr_to_filename(current->exec_file->f_path.dentry,
70976 + current->exec_file->f_path.mnt) :
70977 + curr->filename, curr->filename,
70978 + &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
70979 + &current->signal->saved_ip);
70980 + goto exit;
70981 + }
70982 + goto exit_fail;
70983 + }
70984 +
70985 +inet_check:
70986 + /* the rest of this checking is for IPv4 only */
70987 + if (!curr->ips)
70988 + goto exit;
70989 +
70990 + if ((curr->ip_type & (1U << type)) &&
70991 + (curr->ip_proto[protocol / 32] & (1U << (protocol % 32))))
70992 + goto exit;
70993 +
70994 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
70995 + /* we don't place acls on raw sockets , and sometimes
70996 + dgram/ip sockets are opened for ioctl and not
70997 + bind/connect, so we'll fake a bind learn log */
70998 + if (type == SOCK_RAW || type == SOCK_PACKET) {
70999 + __u32 fakeip = 0;
71000 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
71001 + current->role->roletype, GR_GLOBAL_UID(cred->uid),
71002 + GR_GLOBAL_GID(cred->gid), current->exec_file ?
71003 + gr_to_filename(current->exec_file->f_path.dentry,
71004 + current->exec_file->f_path.mnt) :
71005 + curr->filename, curr->filename,
71006 + &fakeip, 0, type,
71007 + protocol, GR_CONNECT, &current->signal->saved_ip);
71008 + } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
71009 + __u32 fakeip = 0;
71010 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
71011 + current->role->roletype, GR_GLOBAL_UID(cred->uid),
71012 + GR_GLOBAL_GID(cred->gid), current->exec_file ?
71013 + gr_to_filename(current->exec_file->f_path.dentry,
71014 + current->exec_file->f_path.mnt) :
71015 + curr->filename, curr->filename,
71016 + &fakeip, 0, type,
71017 + protocol, GR_BIND, &current->signal->saved_ip);
71018 + }
71019 + /* we'll log when they use connect or bind */
71020 + goto exit;
71021 + }
71022 +
71023 +exit_fail:
71024 + if (domain == PF_INET)
71025 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
71026 + gr_socktype_to_name(type), gr_proto_to_name(protocol));
71027 + else if (rcu_access_pointer(net_families[domain]) != NULL)
71028 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
71029 + gr_socktype_to_name(type), protocol);
71030 +
71031 + return 0;
71032 +exit:
71033 + return 1;
71034 +}
71035 +
71036 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
71037 +{
71038 + if ((ip->mode & mode) &&
71039 + (ip_port >= ip->low) &&
71040 + (ip_port <= ip->high) &&
71041 + ((ntohl(ip_addr) & our_netmask) ==
71042 + (ntohl(our_addr) & our_netmask))
71043 + && (ip->proto[protocol / 32] & (1U << (protocol % 32)))
71044 + && (ip->type & (1U << type))) {
71045 + if (ip->mode & GR_INVERT)
71046 + return 2; // specifically denied
71047 + else
71048 + return 1; // allowed
71049 + }
71050 +
71051 + return 0; // not specifically allowed, may continue parsing
71052 +}
71053 +
71054 +static int
71055 +gr_search_connectbind(const int full_mode, struct sock *sk,
71056 + struct sockaddr_in *addr, const int type)
71057 +{
71058 + char iface[IFNAMSIZ] = {0};
71059 + struct acl_subject_label *curr;
71060 + struct acl_ip_label *ip;
71061 + struct inet_sock *isk;
71062 + struct net_device *dev;
71063 + struct in_device *idev;
71064 + unsigned long i;
71065 + int ret;
71066 + int mode = full_mode & (GR_BIND | GR_CONNECT);
71067 + __u32 ip_addr = 0;
71068 + __u32 our_addr;
71069 + __u32 our_netmask;
71070 + char *p;
71071 + __u16 ip_port = 0;
71072 + const struct cred *cred = current_cred();
71073 +
71074 + if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
71075 + return 0;
71076 +
71077 + curr = current->acl;
71078 + isk = inet_sk(sk);
71079 +
71080 + /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
71081 + if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
71082 + addr->sin_addr.s_addr = curr->inaddr_any_override;
71083 + if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
71084 + struct sockaddr_in saddr;
71085 + int err;
71086 +
71087 + saddr.sin_family = AF_INET;
71088 + saddr.sin_addr.s_addr = curr->inaddr_any_override;
71089 + saddr.sin_port = isk->inet_sport;
71090 +
71091 + err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
71092 + if (err)
71093 + return err;
71094 +
71095 + err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
71096 + if (err)
71097 + return err;
71098 + }
71099 +
71100 + if (!curr->ips)
71101 + return 0;
71102 +
71103 + ip_addr = addr->sin_addr.s_addr;
71104 + ip_port = ntohs(addr->sin_port);
71105 +
71106 + if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
71107 + security_learn(GR_IP_LEARN_MSG, current->role->rolename,
71108 + current->role->roletype, GR_GLOBAL_UID(cred->uid),
71109 + GR_GLOBAL_GID(cred->gid), current->exec_file ?
71110 + gr_to_filename(current->exec_file->f_path.dentry,
71111 + current->exec_file->f_path.mnt) :
71112 + curr->filename, curr->filename,
71113 + &ip_addr, ip_port, type,
71114 + sk->sk_protocol, mode, &current->signal->saved_ip);
71115 + return 0;
71116 + }
71117 +
71118 + for (i = 0; i < curr->ip_num; i++) {
71119 + ip = *(curr->ips + i);
71120 + if (ip->iface != NULL) {
71121 + strncpy(iface, ip->iface, IFNAMSIZ - 1);
71122 + p = strchr(iface, ':');
71123 + if (p != NULL)
71124 + *p = '\0';
71125 + dev = dev_get_by_name(sock_net(sk), iface);
71126 + if (dev == NULL)
71127 + continue;
71128 + idev = in_dev_get(dev);
71129 + if (idev == NULL) {
71130 + dev_put(dev);
71131 + continue;
71132 + }
71133 + rcu_read_lock();
71134 + for_ifa(idev) {
71135 + if (!strcmp(ip->iface, ifa->ifa_label)) {
71136 + our_addr = ifa->ifa_address;
71137 + our_netmask = 0xffffffff;
71138 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
71139 + if (ret == 1) {
71140 + rcu_read_unlock();
71141 + in_dev_put(idev);
71142 + dev_put(dev);
71143 + return 0;
71144 + } else if (ret == 2) {
71145 + rcu_read_unlock();
71146 + in_dev_put(idev);
71147 + dev_put(dev);
71148 + goto denied;
71149 + }
71150 + }
71151 + } endfor_ifa(idev);
71152 + rcu_read_unlock();
71153 + in_dev_put(idev);
71154 + dev_put(dev);
71155 + } else {
71156 + our_addr = ip->addr;
71157 + our_netmask = ip->netmask;
71158 + ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
71159 + if (ret == 1)
71160 + return 0;
71161 + else if (ret == 2)
71162 + goto denied;
71163 + }
71164 + }
71165 +
71166 +denied:
71167 + if (mode == GR_BIND)
71168 + gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
71169 + else if (mode == GR_CONNECT)
71170 + gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
71171 +
71172 + return -EACCES;
71173 +}
71174 +
71175 +int
71176 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
71177 +{
71178 + /* always allow disconnection of dgram sockets with connect */
71179 + if (addr->sin_family == AF_UNSPEC)
71180 + return 0;
71181 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
71182 +}
71183 +
71184 +int
71185 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
71186 +{
71187 + return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
71188 +}
71189 +
71190 +int gr_search_listen(struct socket *sock)
71191 +{
71192 + struct sock *sk = sock->sk;
71193 + struct sockaddr_in addr;
71194 +
71195 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
71196 + addr.sin_port = inet_sk(sk)->inet_sport;
71197 +
71198 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
71199 +}
71200 +
71201 +int gr_search_accept(struct socket *sock)
71202 +{
71203 + struct sock *sk = sock->sk;
71204 + struct sockaddr_in addr;
71205 +
71206 + addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
71207 + addr.sin_port = inet_sk(sk)->inet_sport;
71208 +
71209 + return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
71210 +}
71211 +
71212 +int
71213 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
71214 +{
71215 + if (addr)
71216 + return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
71217 + else {
71218 + struct sockaddr_in sin;
71219 + const struct inet_sock *inet = inet_sk(sk);
71220 +
71221 + sin.sin_addr.s_addr = inet->inet_daddr;
71222 + sin.sin_port = inet->inet_dport;
71223 +
71224 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
71225 + }
71226 +}
71227 +
71228 +int
71229 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
71230 +{
71231 + struct sockaddr_in sin;
71232 +
71233 + if (unlikely(skb->len < sizeof (struct udphdr)))
71234 + return 0; // skip this packet
71235 +
71236 + sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
71237 + sin.sin_port = udp_hdr(skb)->source;
71238 +
71239 + return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
71240 +}
71241 diff --git a/grsecurity/gracl_learn.c b/grsecurity/gracl_learn.c
71242 new file mode 100644
71243 index 0000000..25f54ef
71244 --- /dev/null
71245 +++ b/grsecurity/gracl_learn.c
71246 @@ -0,0 +1,207 @@
71247 +#include <linux/kernel.h>
71248 +#include <linux/mm.h>
71249 +#include <linux/sched.h>
71250 +#include <linux/poll.h>
71251 +#include <linux/string.h>
71252 +#include <linux/file.h>
71253 +#include <linux/types.h>
71254 +#include <linux/vmalloc.h>
71255 +#include <linux/grinternal.h>
71256 +
71257 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
71258 + size_t count, loff_t *ppos);
71259 +extern int gr_acl_is_enabled(void);
71260 +
71261 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
71262 +static int gr_learn_attached;
71263 +
71264 +/* use a 512k buffer */
71265 +#define LEARN_BUFFER_SIZE (512 * 1024)
71266 +
71267 +static DEFINE_SPINLOCK(gr_learn_lock);
71268 +static DEFINE_MUTEX(gr_learn_user_mutex);
71269 +
71270 +/* we need to maintain two buffers, so that the kernel context of grlearn
71271 + uses a semaphore around the userspace copying, and the other kernel contexts
71272 + use a spinlock when copying into the buffer, since they cannot sleep
71273 +*/
71274 +static char *learn_buffer;
71275 +static char *learn_buffer_user;
71276 +static int learn_buffer_len;
71277 +static int learn_buffer_user_len;
71278 +
71279 +static ssize_t
71280 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
71281 +{
71282 + DECLARE_WAITQUEUE(wait, current);
71283 + ssize_t retval = 0;
71284 +
71285 + add_wait_queue(&learn_wait, &wait);
71286 + set_current_state(TASK_INTERRUPTIBLE);
71287 + do {
71288 + mutex_lock(&gr_learn_user_mutex);
71289 + spin_lock(&gr_learn_lock);
71290 + if (learn_buffer_len)
71291 + break;
71292 + spin_unlock(&gr_learn_lock);
71293 + mutex_unlock(&gr_learn_user_mutex);
71294 + if (file->f_flags & O_NONBLOCK) {
71295 + retval = -EAGAIN;
71296 + goto out;
71297 + }
71298 + if (signal_pending(current)) {
71299 + retval = -ERESTARTSYS;
71300 + goto out;
71301 + }
71302 +
71303 + schedule();
71304 + } while (1);
71305 +
71306 + memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
71307 + learn_buffer_user_len = learn_buffer_len;
71308 + retval = learn_buffer_len;
71309 + learn_buffer_len = 0;
71310 +
71311 + spin_unlock(&gr_learn_lock);
71312 +
71313 + if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
71314 + retval = -EFAULT;
71315 +
71316 + mutex_unlock(&gr_learn_user_mutex);
71317 +out:
71318 + set_current_state(TASK_RUNNING);
71319 + remove_wait_queue(&learn_wait, &wait);
71320 + return retval;
71321 +}
71322 +
71323 +static unsigned int
71324 +poll_learn(struct file * file, poll_table * wait)
71325 +{
71326 + poll_wait(file, &learn_wait, wait);
71327 +
71328 + if (learn_buffer_len)
71329 + return (POLLIN | POLLRDNORM);
71330 +
71331 + return 0;
71332 +}
71333 +
71334 +void
71335 +gr_clear_learn_entries(void)
71336 +{
71337 + char *tmp;
71338 +
71339 + mutex_lock(&gr_learn_user_mutex);
71340 + spin_lock(&gr_learn_lock);
71341 + tmp = learn_buffer;
71342 + learn_buffer = NULL;
71343 + spin_unlock(&gr_learn_lock);
71344 + if (tmp)
71345 + vfree(tmp);
71346 + if (learn_buffer_user != NULL) {
71347 + vfree(learn_buffer_user);
71348 + learn_buffer_user = NULL;
71349 + }
71350 + learn_buffer_len = 0;
71351 + mutex_unlock(&gr_learn_user_mutex);
71352 +
71353 + return;
71354 +}
71355 +
71356 +void
71357 +gr_add_learn_entry(const char *fmt, ...)
71358 +{
71359 + va_list args;
71360 + unsigned int len;
71361 +
71362 + if (!gr_learn_attached)
71363 + return;
71364 +
71365 + spin_lock(&gr_learn_lock);
71366 +
71367 + /* leave a gap at the end so we know when it's "full" but don't have to
71368 + compute the exact length of the string we're trying to append
71369 + */
71370 + if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
71371 + spin_unlock(&gr_learn_lock);
71372 + wake_up_interruptible(&learn_wait);
71373 + return;
71374 + }
71375 + if (learn_buffer == NULL) {
71376 + spin_unlock(&gr_learn_lock);
71377 + return;
71378 + }
71379 +
71380 + va_start(args, fmt);
71381 + len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
71382 + va_end(args);
71383 +
71384 + learn_buffer_len += len + 1;
71385 +
71386 + spin_unlock(&gr_learn_lock);
71387 + wake_up_interruptible(&learn_wait);
71388 +
71389 + return;
71390 +}
71391 +
71392 +static int
71393 +open_learn(struct inode *inode, struct file *file)
71394 +{
71395 + if (file->f_mode & FMODE_READ && gr_learn_attached)
71396 + return -EBUSY;
71397 + if (file->f_mode & FMODE_READ) {
71398 + int retval = 0;
71399 + mutex_lock(&gr_learn_user_mutex);
71400 + if (learn_buffer == NULL)
71401 + learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
71402 + if (learn_buffer_user == NULL)
71403 + learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
71404 + if (learn_buffer == NULL) {
71405 + retval = -ENOMEM;
71406 + goto out_error;
71407 + }
71408 + if (learn_buffer_user == NULL) {
71409 + retval = -ENOMEM;
71410 + goto out_error;
71411 + }
71412 + learn_buffer_len = 0;
71413 + learn_buffer_user_len = 0;
71414 + gr_learn_attached = 1;
71415 +out_error:
71416 + mutex_unlock(&gr_learn_user_mutex);
71417 + return retval;
71418 + }
71419 + return 0;
71420 +}
71421 +
71422 +static int
71423 +close_learn(struct inode *inode, struct file *file)
71424 +{
71425 + if (file->f_mode & FMODE_READ) {
71426 + char *tmp = NULL;
71427 + mutex_lock(&gr_learn_user_mutex);
71428 + spin_lock(&gr_learn_lock);
71429 + tmp = learn_buffer;
71430 + learn_buffer = NULL;
71431 + spin_unlock(&gr_learn_lock);
71432 + if (tmp)
71433 + vfree(tmp);
71434 + if (learn_buffer_user != NULL) {
71435 + vfree(learn_buffer_user);
71436 + learn_buffer_user = NULL;
71437 + }
71438 + learn_buffer_len = 0;
71439 + learn_buffer_user_len = 0;
71440 + gr_learn_attached = 0;
71441 + mutex_unlock(&gr_learn_user_mutex);
71442 + }
71443 +
71444 + return 0;
71445 +}
71446 +
71447 +const struct file_operations grsec_fops = {
71448 + .read = read_learn,
71449 + .write = write_grsec_handler,
71450 + .open = open_learn,
71451 + .release = close_learn,
71452 + .poll = poll_learn,
71453 +};
71454 diff --git a/grsecurity/gracl_policy.c b/grsecurity/gracl_policy.c
71455 new file mode 100644
71456 index 0000000..361a099
71457 --- /dev/null
71458 +++ b/grsecurity/gracl_policy.c
71459 @@ -0,0 +1,1782 @@
71460 +#include <linux/kernel.h>
71461 +#include <linux/module.h>
71462 +#include <linux/sched.h>
71463 +#include <linux/mm.h>
71464 +#include <linux/file.h>
71465 +#include <linux/fs.h>
71466 +#include <linux/namei.h>
71467 +#include <linux/mount.h>
71468 +#include <linux/tty.h>
71469 +#include <linux/proc_fs.h>
71470 +#include <linux/lglock.h>
71471 +#include <linux/slab.h>
71472 +#include <linux/vmalloc.h>
71473 +#include <linux/types.h>
71474 +#include <linux/sysctl.h>
71475 +#include <linux/netdevice.h>
71476 +#include <linux/ptrace.h>
71477 +#include <linux/gracl.h>
71478 +#include <linux/gralloc.h>
71479 +#include <linux/security.h>
71480 +#include <linux/grinternal.h>
71481 +#include <linux/pid_namespace.h>
71482 +#include <linux/stop_machine.h>
71483 +#include <linux/fdtable.h>
71484 +#include <linux/percpu.h>
71485 +#include <linux/lglock.h>
71486 +#include <linux/hugetlb.h>
71487 +#include <linux/posix-timers.h>
71488 +#include "../fs/mount.h"
71489 +
71490 +#include <asm/uaccess.h>
71491 +#include <asm/errno.h>
71492 +#include <asm/mman.h>
71493 +
71494 +extern struct gr_policy_state *polstate;
71495 +
71496 +#define FOR_EACH_ROLE_START(role) \
71497 + role = polstate->role_list; \
71498 + while (role) {
71499 +
71500 +#define FOR_EACH_ROLE_END(role) \
71501 + role = role->prev; \
71502 + }
71503 +
71504 +struct path gr_real_root;
71505 +
71506 +extern struct gr_alloc_state *current_alloc_state;
71507 +
71508 +u16 acl_sp_role_value;
71509 +
71510 +static DEFINE_MUTEX(gr_dev_mutex);
71511 +
71512 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
71513 +extern void gr_clear_learn_entries(void);
71514 +
71515 +static struct gr_arg gr_usermode;
71516 +static unsigned char gr_system_salt[GR_SALT_LEN];
71517 +static unsigned char gr_system_sum[GR_SHA_LEN];
71518 +
71519 +static unsigned int gr_auth_attempts = 0;
71520 +static unsigned long gr_auth_expires = 0UL;
71521 +
71522 +struct acl_object_label *fakefs_obj_rw;
71523 +struct acl_object_label *fakefs_obj_rwx;
71524 +
71525 +extern int gr_init_uidset(void);
71526 +extern void gr_free_uidset(void);
71527 +extern void gr_remove_uid(uid_t uid);
71528 +extern int gr_find_uid(uid_t uid);
71529 +
71530 +extern struct acl_subject_label *__gr_get_subject_for_task(const struct gr_policy_state *state, struct task_struct *task, const char *filename);
71531 +extern void __gr_apply_subject_to_task(struct gr_policy_state *state, struct task_struct *task, struct acl_subject_label *subj);
71532 +extern int gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb);
71533 +extern void __insert_inodev_entry(const struct gr_policy_state *state, struct inodev_entry *entry);
71534 +extern struct acl_role_label *__lookup_acl_role_label(const struct gr_policy_state *state, const struct task_struct *task, const uid_t uid, const gid_t gid);
71535 +extern void insert_acl_obj_label(struct acl_object_label *obj, struct acl_subject_label *subj);
71536 +extern void insert_acl_subj_label(struct acl_subject_label *obj, struct acl_role_label *role);
71537 +extern struct name_entry * __lookup_name_entry(const struct gr_policy_state *state, const char *name);
71538 +extern char *gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt);
71539 +extern struct acl_subject_label *lookup_acl_subj_label(const ino_t ino, const dev_t dev, const struct acl_role_label *role);
71540 +extern struct acl_subject_label *lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev, const struct acl_role_label *role);
71541 +extern void assign_special_role(const char *rolename);
71542 +extern struct acl_subject_label *chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt, const struct acl_role_label *role);
71543 +extern int gr_rbac_disable(void *unused);
71544 +extern void gr_enable_rbac_system(void);
71545 +
71546 +static int copy_acl_object_label_normal(struct acl_object_label *obj, const struct acl_object_label *userp)
71547 +{
71548 + if (copy_from_user(obj, userp, sizeof(struct acl_object_label)))
71549 + return -EFAULT;
71550 +
71551 + return 0;
71552 +}
71553 +
71554 +static int copy_acl_ip_label_normal(struct acl_ip_label *ip, const struct acl_ip_label *userp)
71555 +{
71556 + if (copy_from_user(ip, userp, sizeof(struct acl_ip_label)))
71557 + return -EFAULT;
71558 +
71559 + return 0;
71560 +}
71561 +
71562 +static int copy_acl_subject_label_normal(struct acl_subject_label *subj, const struct acl_subject_label *userp)
71563 +{
71564 + if (copy_from_user(subj, userp, sizeof(struct acl_subject_label)))
71565 + return -EFAULT;
71566 +
71567 + return 0;
71568 +}
71569 +
71570 +static int copy_acl_role_label_normal(struct acl_role_label *role, const struct acl_role_label *userp)
71571 +{
71572 + if (copy_from_user(role, userp, sizeof(struct acl_role_label)))
71573 + return -EFAULT;
71574 +
71575 + return 0;
71576 +}
71577 +
71578 +static int copy_role_allowed_ip_normal(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp)
71579 +{
71580 + if (copy_from_user(roleip, userp, sizeof(struct role_allowed_ip)))
71581 + return -EFAULT;
71582 +
71583 + return 0;
71584 +}
71585 +
71586 +static int copy_sprole_pw_normal(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp)
71587 +{
71588 + if (copy_from_user(pw, userp + idx, sizeof(struct sprole_pw)))
71589 + return -EFAULT;
71590 +
71591 + return 0;
71592 +}
71593 +
71594 +static int copy_gr_hash_struct_normal(struct gr_hash_struct *hash, const struct gr_hash_struct *userp)
71595 +{
71596 + if (copy_from_user(hash, userp, sizeof(struct gr_hash_struct)))
71597 + return -EFAULT;
71598 +
71599 + return 0;
71600 +}
71601 +
71602 +static int copy_role_transition_normal(struct role_transition *trans, const struct role_transition *userp)
71603 +{
71604 + if (copy_from_user(trans, userp, sizeof(struct role_transition)))
71605 + return -EFAULT;
71606 +
71607 + return 0;
71608 +}
71609 +
71610 +int copy_pointer_from_array_normal(void *ptr, unsigned long idx, const void *userp)
71611 +{
71612 + if (copy_from_user(ptr, userp + (idx * sizeof(void *)), sizeof(void *)))
71613 + return -EFAULT;
71614 +
71615 + return 0;
71616 +}
71617 +
71618 +static int copy_gr_arg_wrapper_normal(const char __user *buf, struct gr_arg_wrapper *uwrap)
71619 +{
71620 + if (copy_from_user(uwrap, buf, sizeof (struct gr_arg_wrapper)))
71621 + return -EFAULT;
71622 +
71623 + if (((uwrap->version != GRSECURITY_VERSION) &&
71624 + (uwrap->version != 0x2901)) ||
71625 + (uwrap->size != sizeof(struct gr_arg)))
71626 + return -EINVAL;
71627 +
71628 + return 0;
71629 +}
71630 +
71631 +static int copy_gr_arg_normal(const struct gr_arg __user *buf, struct gr_arg *arg)
71632 +{
71633 + if (copy_from_user(arg, buf, sizeof (struct gr_arg)))
71634 + return -EFAULT;
71635 +
71636 + return 0;
71637 +}
71638 +
71639 +static size_t get_gr_arg_wrapper_size_normal(void)
71640 +{
71641 + return sizeof(struct gr_arg_wrapper);
71642 +}
71643 +
71644 +#ifdef CONFIG_COMPAT
71645 +extern int copy_gr_arg_wrapper_compat(const char *buf, struct gr_arg_wrapper *uwrap);
71646 +extern int copy_gr_arg_compat(const struct gr_arg __user *buf, struct gr_arg *arg);
71647 +extern int copy_acl_object_label_compat(struct acl_object_label *obj, const struct acl_object_label *userp);
71648 +extern int copy_acl_subject_label_compat(struct acl_subject_label *subj, const struct acl_subject_label *userp);
71649 +extern int copy_acl_role_label_compat(struct acl_role_label *role, const struct acl_role_label *userp);
71650 +extern int copy_role_allowed_ip_compat(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp);
71651 +extern int copy_role_transition_compat(struct role_transition *trans, const struct role_transition *userp);
71652 +extern int copy_gr_hash_struct_compat(struct gr_hash_struct *hash, const struct gr_hash_struct *userp);
71653 +extern int copy_pointer_from_array_compat(void *ptr, unsigned long idx, const void *userp);
71654 +extern int copy_acl_ip_label_compat(struct acl_ip_label *ip, const struct acl_ip_label *userp);
71655 +extern int copy_sprole_pw_compat(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp);
71656 +extern size_t get_gr_arg_wrapper_size_compat(void);
71657 +
71658 +int (* copy_gr_arg_wrapper)(const char *buf, struct gr_arg_wrapper *uwrap) __read_only;
71659 +int (* copy_gr_arg)(const struct gr_arg *buf, struct gr_arg *arg) __read_only;
71660 +int (* copy_acl_object_label)(struct acl_object_label *obj, const struct acl_object_label *userp) __read_only;
71661 +int (* copy_acl_subject_label)(struct acl_subject_label *subj, const struct acl_subject_label *userp) __read_only;
71662 +int (* copy_acl_role_label)(struct acl_role_label *role, const struct acl_role_label *userp) __read_only;
71663 +int (* copy_acl_ip_label)(struct acl_ip_label *ip, const struct acl_ip_label *userp) __read_only;
71664 +int (* copy_pointer_from_array)(void *ptr, unsigned long idx, const void *userp) __read_only;
71665 +int (* copy_sprole_pw)(struct sprole_pw *pw, unsigned long idx, const struct sprole_pw *userp) __read_only;
71666 +int (* copy_gr_hash_struct)(struct gr_hash_struct *hash, const struct gr_hash_struct *userp) __read_only;
71667 +int (* copy_role_transition)(struct role_transition *trans, const struct role_transition *userp) __read_only;
71668 +int (* copy_role_allowed_ip)(struct role_allowed_ip *roleip, const struct role_allowed_ip *userp) __read_only;
71669 +size_t (* get_gr_arg_wrapper_size)(void) __read_only;
71670 +
71671 +#else
71672 +#define copy_gr_arg_wrapper copy_gr_arg_wrapper_normal
71673 +#define copy_gr_arg copy_gr_arg_normal
71674 +#define copy_gr_hash_struct copy_gr_hash_struct_normal
71675 +#define copy_acl_object_label copy_acl_object_label_normal
71676 +#define copy_acl_subject_label copy_acl_subject_label_normal
71677 +#define copy_acl_role_label copy_acl_role_label_normal
71678 +#define copy_acl_ip_label copy_acl_ip_label_normal
71679 +#define copy_pointer_from_array copy_pointer_from_array_normal
71680 +#define copy_sprole_pw copy_sprole_pw_normal
71681 +#define copy_role_transition copy_role_transition_normal
71682 +#define copy_role_allowed_ip copy_role_allowed_ip_normal
71683 +#define get_gr_arg_wrapper_size get_gr_arg_wrapper_size_normal
71684 +#endif
71685 +
71686 +static struct acl_subject_label *
71687 +lookup_subject_map(const struct acl_subject_label *userp)
71688 +{
71689 + unsigned int index = gr_shash(userp, polstate->subj_map_set.s_size);
71690 + struct subject_map *match;
71691 +
71692 + match = polstate->subj_map_set.s_hash[index];
71693 +
71694 + while (match && match->user != userp)
71695 + match = match->next;
71696 +
71697 + if (match != NULL)
71698 + return match->kernel;
71699 + else
71700 + return NULL;
71701 +}
71702 +
71703 +static void
71704 +insert_subj_map_entry(struct subject_map *subjmap)
71705 +{
71706 + unsigned int index = gr_shash(subjmap->user, polstate->subj_map_set.s_size);
71707 + struct subject_map **curr;
71708 +
71709 + subjmap->prev = NULL;
71710 +
71711 + curr = &polstate->subj_map_set.s_hash[index];
71712 + if (*curr != NULL)
71713 + (*curr)->prev = subjmap;
71714 +
71715 + subjmap->next = *curr;
71716 + *curr = subjmap;
71717 +
71718 + return;
71719 +}
71720 +
71721 +static void
71722 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
71723 +{
71724 + unsigned int index =
71725 + gr_rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), polstate->acl_role_set.r_size);
71726 + struct acl_role_label **curr;
71727 + struct acl_role_label *tmp, *tmp2;
71728 +
71729 + curr = &polstate->acl_role_set.r_hash[index];
71730 +
71731 + /* simple case, slot is empty, just set it to our role */
71732 + if (*curr == NULL) {
71733 + *curr = role;
71734 + } else {
71735 + /* example:
71736 + 1 -> 2 -> 3 (adding 2 -> 3 to here)
71737 + 2 -> 3
71738 + */
71739 + /* first check to see if we can already be reached via this slot */
71740 + tmp = *curr;
71741 + while (tmp && tmp != role)
71742 + tmp = tmp->next;
71743 + if (tmp == role) {
71744 + /* we don't need to add ourselves to this slot's chain */
71745 + return;
71746 + }
71747 + /* we need to add ourselves to this chain, two cases */
71748 + if (role->next == NULL) {
71749 + /* simple case, append the current chain to our role */
71750 + role->next = *curr;
71751 + *curr = role;
71752 + } else {
71753 + /* 1 -> 2 -> 3 -> 4
71754 + 2 -> 3 -> 4
71755 + 3 -> 4 (adding 1 -> 2 -> 3 -> 4 to here)
71756 + */
71757 + /* trickier case: walk our role's chain until we find
71758 + the role for the start of the current slot's chain */
71759 + tmp = role;
71760 + tmp2 = *curr;
71761 + while (tmp->next && tmp->next != tmp2)
71762 + tmp = tmp->next;
71763 + if (tmp->next == tmp2) {
71764 + /* from example above, we found 3, so just
71765 + replace this slot's chain with ours */
71766 + *curr = role;
71767 + } else {
71768 + /* we didn't find a subset of our role's chain
71769 + in the current slot's chain, so append their
71770 + chain to ours, and set us as the first role in
71771 + the slot's chain
71772 +
71773 + we could fold this case with the case above,
71774 + but making it explicit for clarity
71775 + */
71776 + tmp->next = tmp2;
71777 + *curr = role;
71778 + }
71779 + }
71780 + }
71781 +
71782 + return;
71783 +}
71784 +
71785 +static void
71786 +insert_acl_role_label(struct acl_role_label *role)
71787 +{
71788 + int i;
71789 +
71790 + if (polstate->role_list == NULL) {
71791 + polstate->role_list = role;
71792 + role->prev = NULL;
71793 + } else {
71794 + role->prev = polstate->role_list;
71795 + polstate->role_list = role;
71796 + }
71797 +
71798 + /* used for hash chains */
71799 + role->next = NULL;
71800 +
71801 + if (role->roletype & GR_ROLE_DOMAIN) {
71802 + for (i = 0; i < role->domain_child_num; i++)
71803 + __insert_acl_role_label(role, role->domain_children[i]);
71804 + } else
71805 + __insert_acl_role_label(role, role->uidgid);
71806 +}
71807 +
71808 +static int
71809 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
71810 +{
71811 + struct name_entry **curr, *nentry;
71812 + struct inodev_entry *ientry;
71813 + unsigned int len = strlen(name);
71814 + unsigned int key = full_name_hash(name, len);
71815 + unsigned int index = key % polstate->name_set.n_size;
71816 +
71817 + curr = &polstate->name_set.n_hash[index];
71818 +
71819 + while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
71820 + curr = &((*curr)->next);
71821 +
71822 + if (*curr != NULL)
71823 + return 1;
71824 +
71825 + nentry = acl_alloc(sizeof (struct name_entry));
71826 + if (nentry == NULL)
71827 + return 0;
71828 + ientry = acl_alloc(sizeof (struct inodev_entry));
71829 + if (ientry == NULL)
71830 + return 0;
71831 + ientry->nentry = nentry;
71832 +
71833 + nentry->key = key;
71834 + nentry->name = name;
71835 + nentry->inode = inode;
71836 + nentry->device = device;
71837 + nentry->len = len;
71838 + nentry->deleted = deleted;
71839 +
71840 + nentry->prev = NULL;
71841 + curr = &polstate->name_set.n_hash[index];
71842 + if (*curr != NULL)
71843 + (*curr)->prev = nentry;
71844 + nentry->next = *curr;
71845 + *curr = nentry;
71846 +
71847 + /* insert us into the table searchable by inode/dev */
71848 + __insert_inodev_entry(polstate, ientry);
71849 +
71850 + return 1;
71851 +}
71852 +
71853 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
71854 +
71855 +static void *
71856 +create_table(__u32 * len, int elementsize)
71857 +{
71858 + unsigned int table_sizes[] = {
71859 + 7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
71860 + 32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
71861 + 4194301, 8388593, 16777213, 33554393, 67108859
71862 + };
71863 + void *newtable = NULL;
71864 + unsigned int pwr = 0;
71865 +
71866 + while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
71867 + table_sizes[pwr] <= *len)
71868 + pwr++;
71869 +
71870 + if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
71871 + return newtable;
71872 +
71873 + if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
71874 + newtable =
71875 + kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
71876 + else
71877 + newtable = vmalloc(table_sizes[pwr] * elementsize);
71878 +
71879 + *len = table_sizes[pwr];
71880 +
71881 + return newtable;
71882 +}
71883 +
71884 +static int
71885 +init_variables(const struct gr_arg *arg, bool reload)
71886 +{
71887 + struct task_struct *reaper = init_pid_ns.child_reaper;
71888 + unsigned int stacksize;
71889 +
71890 + polstate->subj_map_set.s_size = arg->role_db.num_subjects;
71891 + polstate->acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
71892 + polstate->name_set.n_size = arg->role_db.num_objects;
71893 + polstate->inodev_set.i_size = arg->role_db.num_objects;
71894 +
71895 + if (!polstate->subj_map_set.s_size || !polstate->acl_role_set.r_size ||
71896 + !polstate->name_set.n_size || !polstate->inodev_set.i_size)
71897 + return 1;
71898 +
71899 + if (!reload) {
71900 + if (!gr_init_uidset())
71901 + return 1;
71902 + }
71903 +
71904 + /* set up the stack that holds allocation info */
71905 +
71906 + stacksize = arg->role_db.num_pointers + 5;
71907 +
71908 + if (!acl_alloc_stack_init(stacksize))
71909 + return 1;
71910 +
71911 + if (!reload) {
71912 + /* grab reference for the real root dentry and vfsmount */
71913 + get_fs_root(reaper->fs, &gr_real_root);
71914 +
71915 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
71916 + printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(gr_real_root.dentry), gr_real_root.dentry->d_inode->i_ino);
71917 +#endif
71918 +
71919 + fakefs_obj_rw = kzalloc(sizeof(struct acl_object_label), GFP_KERNEL);
71920 + if (fakefs_obj_rw == NULL)
71921 + return 1;
71922 + fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
71923 +
71924 + fakefs_obj_rwx = kzalloc(sizeof(struct acl_object_label), GFP_KERNEL);
71925 + if (fakefs_obj_rwx == NULL)
71926 + return 1;
71927 + fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
71928 + }
71929 +
71930 + polstate->subj_map_set.s_hash =
71931 + (struct subject_map **) create_table(&polstate->subj_map_set.s_size, sizeof(void *));
71932 + polstate->acl_role_set.r_hash =
71933 + (struct acl_role_label **) create_table(&polstate->acl_role_set.r_size, sizeof(void *));
71934 + polstate->name_set.n_hash = (struct name_entry **) create_table(&polstate->name_set.n_size, sizeof(void *));
71935 + polstate->inodev_set.i_hash =
71936 + (struct inodev_entry **) create_table(&polstate->inodev_set.i_size, sizeof(void *));
71937 +
71938 + if (!polstate->subj_map_set.s_hash || !polstate->acl_role_set.r_hash ||
71939 + !polstate->name_set.n_hash || !polstate->inodev_set.i_hash)
71940 + return 1;
71941 +
71942 + memset(polstate->subj_map_set.s_hash, 0,
71943 + sizeof(struct subject_map *) * polstate->subj_map_set.s_size);
71944 + memset(polstate->acl_role_set.r_hash, 0,
71945 + sizeof (struct acl_role_label *) * polstate->acl_role_set.r_size);
71946 + memset(polstate->name_set.n_hash, 0,
71947 + sizeof (struct name_entry *) * polstate->name_set.n_size);
71948 + memset(polstate->inodev_set.i_hash, 0,
71949 + sizeof (struct inodev_entry *) * polstate->inodev_set.i_size);
71950 +
71951 + return 0;
71952 +}
71953 +
71954 +/* free information not needed after startup
71955 + currently contains user->kernel pointer mappings for subjects
71956 +*/
71957 +
71958 +static void
71959 +free_init_variables(void)
71960 +{
71961 + __u32 i;
71962 +
71963 + if (polstate->subj_map_set.s_hash) {
71964 + for (i = 0; i < polstate->subj_map_set.s_size; i++) {
71965 + if (polstate->subj_map_set.s_hash[i]) {
71966 + kfree(polstate->subj_map_set.s_hash[i]);
71967 + polstate->subj_map_set.s_hash[i] = NULL;
71968 + }
71969 + }
71970 +
71971 + if ((polstate->subj_map_set.s_size * sizeof (struct subject_map *)) <=
71972 + PAGE_SIZE)
71973 + kfree(polstate->subj_map_set.s_hash);
71974 + else
71975 + vfree(polstate->subj_map_set.s_hash);
71976 + }
71977 +
71978 + return;
71979 +}
71980 +
71981 +static void
71982 +free_variables(bool reload)
71983 +{
71984 + struct acl_subject_label *s;
71985 + struct acl_role_label *r;
71986 + struct task_struct *task, *task2;
71987 + unsigned int x;
71988 +
71989 + if (!reload) {
71990 + gr_clear_learn_entries();
71991 +
71992 + read_lock(&tasklist_lock);
71993 + do_each_thread(task2, task) {
71994 + task->acl_sp_role = 0;
71995 + task->acl_role_id = 0;
71996 + task->inherited = 0;
71997 + task->acl = NULL;
71998 + task->role = NULL;
71999 + } while_each_thread(task2, task);
72000 + read_unlock(&tasklist_lock);
72001 +
72002 + kfree(fakefs_obj_rw);
72003 + fakefs_obj_rw = NULL;
72004 + kfree(fakefs_obj_rwx);
72005 + fakefs_obj_rwx = NULL;
72006 +
72007 + /* release the reference to the real root dentry and vfsmount */
72008 + path_put(&gr_real_root);
72009 + memset(&gr_real_root, 0, sizeof(gr_real_root));
72010 + }
72011 +
72012 + /* free all object hash tables */
72013 +
72014 + FOR_EACH_ROLE_START(r)
72015 + if (r->subj_hash == NULL)
72016 + goto next_role;
72017 + FOR_EACH_SUBJECT_START(r, s, x)
72018 + if (s->obj_hash == NULL)
72019 + break;
72020 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
72021 + kfree(s->obj_hash);
72022 + else
72023 + vfree(s->obj_hash);
72024 + FOR_EACH_SUBJECT_END(s, x)
72025 + FOR_EACH_NESTED_SUBJECT_START(r, s)
72026 + if (s->obj_hash == NULL)
72027 + break;
72028 + if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
72029 + kfree(s->obj_hash);
72030 + else
72031 + vfree(s->obj_hash);
72032 + FOR_EACH_NESTED_SUBJECT_END(s)
72033 + if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
72034 + kfree(r->subj_hash);
72035 + else
72036 + vfree(r->subj_hash);
72037 + r->subj_hash = NULL;
72038 +next_role:
72039 + FOR_EACH_ROLE_END(r)
72040 +
72041 + acl_free_all();
72042 +
72043 + if (polstate->acl_role_set.r_hash) {
72044 + if ((polstate->acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
72045 + PAGE_SIZE)
72046 + kfree(polstate->acl_role_set.r_hash);
72047 + else
72048 + vfree(polstate->acl_role_set.r_hash);
72049 + }
72050 + if (polstate->name_set.n_hash) {
72051 + if ((polstate->name_set.n_size * sizeof (struct name_entry *)) <=
72052 + PAGE_SIZE)
72053 + kfree(polstate->name_set.n_hash);
72054 + else
72055 + vfree(polstate->name_set.n_hash);
72056 + }
72057 +
72058 + if (polstate->inodev_set.i_hash) {
72059 + if ((polstate->inodev_set.i_size * sizeof (struct inodev_entry *)) <=
72060 + PAGE_SIZE)
72061 + kfree(polstate->inodev_set.i_hash);
72062 + else
72063 + vfree(polstate->inodev_set.i_hash);
72064 + }
72065 +
72066 + if (!reload)
72067 + gr_free_uidset();
72068 +
72069 + memset(&polstate->name_set, 0, sizeof (struct name_db));
72070 + memset(&polstate->inodev_set, 0, sizeof (struct inodev_db));
72071 + memset(&polstate->acl_role_set, 0, sizeof (struct acl_role_db));
72072 + memset(&polstate->subj_map_set, 0, sizeof (struct acl_subj_map_db));
72073 +
72074 + polstate->default_role = NULL;
72075 + polstate->kernel_role = NULL;
72076 + polstate->role_list = NULL;
72077 +
72078 + return;
72079 +}
72080 +
72081 +static struct acl_subject_label *
72082 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied);
72083 +
72084 +static int alloc_and_copy_string(char **name, unsigned int maxlen)
72085 +{
72086 + unsigned int len = strnlen_user(*name, maxlen);
72087 + char *tmp;
72088 +
72089 + if (!len || len >= maxlen)
72090 + return -EINVAL;
72091 +
72092 + if ((tmp = (char *) acl_alloc(len)) == NULL)
72093 + return -ENOMEM;
72094 +
72095 + if (copy_from_user(tmp, *name, len))
72096 + return -EFAULT;
72097 +
72098 + tmp[len-1] = '\0';
72099 + *name = tmp;
72100 +
72101 + return 0;
72102 +}
72103 +
72104 +static int
72105 +copy_user_glob(struct acl_object_label *obj)
72106 +{
72107 + struct acl_object_label *g_tmp, **guser;
72108 + int error;
72109 +
72110 + if (obj->globbed == NULL)
72111 + return 0;
72112 +
72113 + guser = &obj->globbed;
72114 + while (*guser) {
72115 + g_tmp = (struct acl_object_label *)
72116 + acl_alloc(sizeof (struct acl_object_label));
72117 + if (g_tmp == NULL)
72118 + return -ENOMEM;
72119 +
72120 + if (copy_acl_object_label(g_tmp, *guser))
72121 + return -EFAULT;
72122 +
72123 + error = alloc_and_copy_string(&g_tmp->filename, PATH_MAX);
72124 + if (error)
72125 + return error;
72126 +
72127 + *guser = g_tmp;
72128 + guser = &(g_tmp->next);
72129 + }
72130 +
72131 + return 0;
72132 +}
72133 +
72134 +static int
72135 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
72136 + struct acl_role_label *role)
72137 +{
72138 + struct acl_object_label *o_tmp;
72139 + int ret;
72140 +
72141 + while (userp) {
72142 + if ((o_tmp = (struct acl_object_label *)
72143 + acl_alloc(sizeof (struct acl_object_label))) == NULL)
72144 + return -ENOMEM;
72145 +
72146 + if (copy_acl_object_label(o_tmp, userp))
72147 + return -EFAULT;
72148 +
72149 + userp = o_tmp->prev;
72150 +
72151 + ret = alloc_and_copy_string(&o_tmp->filename, PATH_MAX);
72152 + if (ret)
72153 + return ret;
72154 +
72155 + insert_acl_obj_label(o_tmp, subj);
72156 + if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
72157 + o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
72158 + return -ENOMEM;
72159 +
72160 + ret = copy_user_glob(o_tmp);
72161 + if (ret)
72162 + return ret;
72163 +
72164 + if (o_tmp->nested) {
72165 + int already_copied;
72166 +
72167 + o_tmp->nested = do_copy_user_subj(o_tmp->nested, role, &already_copied);
72168 + if (IS_ERR(o_tmp->nested))
72169 + return PTR_ERR(o_tmp->nested);
72170 +
72171 + /* insert into nested subject list if we haven't copied this one yet
72172 + to prevent duplicate entries */
72173 + if (!already_copied) {
72174 + o_tmp->nested->next = role->hash->first;
72175 + role->hash->first = o_tmp->nested;
72176 + }
72177 + }
72178 + }
72179 +
72180 + return 0;
72181 +}
72182 +
72183 +static __u32
72184 +count_user_subjs(struct acl_subject_label *userp)
72185 +{
72186 + struct acl_subject_label s_tmp;
72187 + __u32 num = 0;
72188 +
72189 + while (userp) {
72190 + if (copy_acl_subject_label(&s_tmp, userp))
72191 + break;
72192 +
72193 + userp = s_tmp.prev;
72194 + }
72195 +
72196 + return num;
72197 +}
72198 +
72199 +static int
72200 +copy_user_allowedips(struct acl_role_label *rolep)
72201 +{
72202 + struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
72203 +
72204 + ruserip = rolep->allowed_ips;
72205 +
72206 + while (ruserip) {
72207 + rlast = rtmp;
72208 +
72209 + if ((rtmp = (struct role_allowed_ip *)
72210 + acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
72211 + return -ENOMEM;
72212 +
72213 + if (copy_role_allowed_ip(rtmp, ruserip))
72214 + return -EFAULT;
72215 +
72216 + ruserip = rtmp->prev;
72217 +
72218 + if (!rlast) {
72219 + rtmp->prev = NULL;
72220 + rolep->allowed_ips = rtmp;
72221 + } else {
72222 + rlast->next = rtmp;
72223 + rtmp->prev = rlast;
72224 + }
72225 +
72226 + if (!ruserip)
72227 + rtmp->next = NULL;
72228 + }
72229 +
72230 + return 0;
72231 +}
72232 +
72233 +static int
72234 +copy_user_transitions(struct acl_role_label *rolep)
72235 +{
72236 + struct role_transition *rusertp, *rtmp = NULL, *rlast;
72237 + int error;
72238 +
72239 + rusertp = rolep->transitions;
72240 +
72241 + while (rusertp) {
72242 + rlast = rtmp;
72243 +
72244 + if ((rtmp = (struct role_transition *)
72245 + acl_alloc(sizeof (struct role_transition))) == NULL)
72246 + return -ENOMEM;
72247 +
72248 + if (copy_role_transition(rtmp, rusertp))
72249 + return -EFAULT;
72250 +
72251 + rusertp = rtmp->prev;
72252 +
72253 + error = alloc_and_copy_string(&rtmp->rolename, GR_SPROLE_LEN);
72254 + if (error)
72255 + return error;
72256 +
72257 + if (!rlast) {
72258 + rtmp->prev = NULL;
72259 + rolep->transitions = rtmp;
72260 + } else {
72261 + rlast->next = rtmp;
72262 + rtmp->prev = rlast;
72263 + }
72264 +
72265 + if (!rusertp)
72266 + rtmp->next = NULL;
72267 + }
72268 +
72269 + return 0;
72270 +}
72271 +
72272 +static __u32 count_user_objs(const struct acl_object_label __user *userp)
72273 +{
72274 + struct acl_object_label o_tmp;
72275 + __u32 num = 0;
72276 +
72277 + while (userp) {
72278 + if (copy_acl_object_label(&o_tmp, userp))
72279 + break;
72280 +
72281 + userp = o_tmp.prev;
72282 + num++;
72283 + }
72284 +
72285 + return num;
72286 +}
72287 +
72288 +static struct acl_subject_label *
72289 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role, int *already_copied)
72290 +{
72291 + struct acl_subject_label *s_tmp = NULL, *s_tmp2;
72292 + __u32 num_objs;
72293 + struct acl_ip_label **i_tmp, *i_utmp2;
72294 + struct gr_hash_struct ghash;
72295 + struct subject_map *subjmap;
72296 + unsigned int i_num;
72297 + int err;
72298 +
72299 + if (already_copied != NULL)
72300 + *already_copied = 0;
72301 +
72302 + s_tmp = lookup_subject_map(userp);
72303 +
72304 + /* we've already copied this subject into the kernel, just return
72305 + the reference to it, and don't copy it over again
72306 + */
72307 + if (s_tmp) {
72308 + if (already_copied != NULL)
72309 + *already_copied = 1;
72310 + return(s_tmp);
72311 + }
72312 +
72313 + if ((s_tmp = (struct acl_subject_label *)
72314 + acl_alloc(sizeof (struct acl_subject_label))) == NULL)
72315 + return ERR_PTR(-ENOMEM);
72316 +
72317 + subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
72318 + if (subjmap == NULL)
72319 + return ERR_PTR(-ENOMEM);
72320 +
72321 + subjmap->user = userp;
72322 + subjmap->kernel = s_tmp;
72323 + insert_subj_map_entry(subjmap);
72324 +
72325 + if (copy_acl_subject_label(s_tmp, userp))
72326 + return ERR_PTR(-EFAULT);
72327 +
72328 + err = alloc_and_copy_string(&s_tmp->filename, PATH_MAX);
72329 + if (err)
72330 + return ERR_PTR(err);
72331 +
72332 + if (!strcmp(s_tmp->filename, "/"))
72333 + role->root_label = s_tmp;
72334 +
72335 + if (copy_gr_hash_struct(&ghash, s_tmp->hash))
72336 + return ERR_PTR(-EFAULT);
72337 +
72338 + /* copy user and group transition tables */
72339 +
72340 + if (s_tmp->user_trans_num) {
72341 + uid_t *uidlist;
72342 +
72343 + uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
72344 + if (uidlist == NULL)
72345 + return ERR_PTR(-ENOMEM);
72346 + if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
72347 + return ERR_PTR(-EFAULT);
72348 +
72349 + s_tmp->user_transitions = uidlist;
72350 + }
72351 +
72352 + if (s_tmp->group_trans_num) {
72353 + gid_t *gidlist;
72354 +
72355 + gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
72356 + if (gidlist == NULL)
72357 + return ERR_PTR(-ENOMEM);
72358 + if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
72359 + return ERR_PTR(-EFAULT);
72360 +
72361 + s_tmp->group_transitions = gidlist;
72362 + }
72363 +
72364 + /* set up object hash table */
72365 + num_objs = count_user_objs(ghash.first);
72366 +
72367 + s_tmp->obj_hash_size = num_objs;
72368 + s_tmp->obj_hash =
72369 + (struct acl_object_label **)
72370 + create_table(&(s_tmp->obj_hash_size), sizeof(void *));
72371 +
72372 + if (!s_tmp->obj_hash)
72373 + return ERR_PTR(-ENOMEM);
72374 +
72375 + memset(s_tmp->obj_hash, 0,
72376 + s_tmp->obj_hash_size *
72377 + sizeof (struct acl_object_label *));
72378 +
72379 + /* add in objects */
72380 + err = copy_user_objs(ghash.first, s_tmp, role);
72381 +
72382 + if (err)
72383 + return ERR_PTR(err);
72384 +
72385 + /* set pointer for parent subject */
72386 + if (s_tmp->parent_subject) {
72387 + s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role, NULL);
72388 +
72389 + if (IS_ERR(s_tmp2))
72390 + return s_tmp2;
72391 +
72392 + s_tmp->parent_subject = s_tmp2;
72393 + }
72394 +
72395 + /* add in ip acls */
72396 +
72397 + if (!s_tmp->ip_num) {
72398 + s_tmp->ips = NULL;
72399 + goto insert;
72400 + }
72401 +
72402 + i_tmp =
72403 + (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
72404 + sizeof (struct acl_ip_label *));
72405 +
72406 + if (!i_tmp)
72407 + return ERR_PTR(-ENOMEM);
72408 +
72409 + for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
72410 + *(i_tmp + i_num) =
72411 + (struct acl_ip_label *)
72412 + acl_alloc(sizeof (struct acl_ip_label));
72413 + if (!*(i_tmp + i_num))
72414 + return ERR_PTR(-ENOMEM);
72415 +
72416 + if (copy_pointer_from_array(&i_utmp2, i_num, s_tmp->ips))
72417 + return ERR_PTR(-EFAULT);
72418 +
72419 + if (copy_acl_ip_label(*(i_tmp + i_num), i_utmp2))
72420 + return ERR_PTR(-EFAULT);
72421 +
72422 + if ((*(i_tmp + i_num))->iface == NULL)
72423 + continue;
72424 +
72425 + err = alloc_and_copy_string(&(*(i_tmp + i_num))->iface, IFNAMSIZ);
72426 + if (err)
72427 + return ERR_PTR(err);
72428 + }
72429 +
72430 + s_tmp->ips = i_tmp;
72431 +
72432 +insert:
72433 + if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
72434 + s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
72435 + return ERR_PTR(-ENOMEM);
72436 +
72437 + return s_tmp;
72438 +}
72439 +
72440 +static int
72441 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
72442 +{
72443 + struct acl_subject_label s_pre;
72444 + struct acl_subject_label * ret;
72445 + int err;
72446 +
72447 + while (userp) {
72448 + if (copy_acl_subject_label(&s_pre, userp))
72449 + return -EFAULT;
72450 +
72451 + ret = do_copy_user_subj(userp, role, NULL);
72452 +
72453 + err = PTR_ERR(ret);
72454 + if (IS_ERR(ret))
72455 + return err;
72456 +
72457 + insert_acl_subj_label(ret, role);
72458 +
72459 + userp = s_pre.prev;
72460 + }
72461 +
72462 + return 0;
72463 +}
72464 +
72465 +static int
72466 +copy_user_acl(struct gr_arg *arg)
72467 +{
72468 + struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
72469 + struct acl_subject_label *subj_list;
72470 + struct sprole_pw *sptmp;
72471 + struct gr_hash_struct *ghash;
72472 + uid_t *domainlist;
72473 + unsigned int r_num;
72474 + int err = 0;
72475 + __u16 i;
72476 + __u32 num_subjs;
72477 +
72478 + /* we need a default and kernel role */
72479 + if (arg->role_db.num_roles < 2)
72480 + return -EINVAL;
72481 +
72482 + /* copy special role authentication info from userspace */
72483 +
72484 + polstate->num_sprole_pws = arg->num_sprole_pws;
72485 + polstate->acl_special_roles = (struct sprole_pw **) acl_alloc_num(polstate->num_sprole_pws, sizeof(struct sprole_pw *));
72486 +
72487 + if (!polstate->acl_special_roles && polstate->num_sprole_pws)
72488 + return -ENOMEM;
72489 +
72490 + for (i = 0; i < polstate->num_sprole_pws; i++) {
72491 + sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
72492 + if (!sptmp)
72493 + return -ENOMEM;
72494 + if (copy_sprole_pw(sptmp, i, arg->sprole_pws))
72495 + return -EFAULT;
72496 +
72497 + err = alloc_and_copy_string((char **)&sptmp->rolename, GR_SPROLE_LEN);
72498 + if (err)
72499 + return err;
72500 +
72501 +#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
72502 + printk(KERN_ALERT "Copying special role %s\n", sptmp->rolename);
72503 +#endif
72504 +
72505 + polstate->acl_special_roles[i] = sptmp;
72506 + }
72507 +
72508 + r_utmp = (struct acl_role_label **) arg->role_db.r_table;
72509 +
72510 + for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
72511 + r_tmp = acl_alloc(sizeof (struct acl_role_label));
72512 +
72513 + if (!r_tmp)
72514 + return -ENOMEM;
72515 +
72516 + if (copy_pointer_from_array(&r_utmp2, r_num, r_utmp))
72517 + return -EFAULT;
72518 +
72519 + if (copy_acl_role_label(r_tmp, r_utmp2))
72520 + return -EFAULT;
72521 +
72522 + err = alloc_and_copy_string(&r_tmp->rolename, GR_SPROLE_LEN);
72523 + if (err)
72524 + return err;
72525 +
72526 + if (!strcmp(r_tmp->rolename, "default")
72527 + && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
72528 + polstate->default_role = r_tmp;
72529 + } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
72530 + polstate->kernel_role = r_tmp;
72531 + }
72532 +
72533 + if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL)
72534 + return -ENOMEM;
72535 +
72536 + if (copy_gr_hash_struct(ghash, r_tmp->hash))
72537 + return -EFAULT;
72538 +
72539 + r_tmp->hash = ghash;
72540 +
72541 + num_subjs = count_user_subjs(r_tmp->hash->first);
72542 +
72543 + r_tmp->subj_hash_size = num_subjs;
72544 + r_tmp->subj_hash =
72545 + (struct acl_subject_label **)
72546 + create_table(&(r_tmp->subj_hash_size), sizeof(void *));
72547 +
72548 + if (!r_tmp->subj_hash)
72549 + return -ENOMEM;
72550 +
72551 + err = copy_user_allowedips(r_tmp);
72552 + if (err)
72553 + return err;
72554 +
72555 + /* copy domain info */
72556 + if (r_tmp->domain_children != NULL) {
72557 + domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
72558 + if (domainlist == NULL)
72559 + return -ENOMEM;
72560 +
72561 + if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t)))
72562 + return -EFAULT;
72563 +
72564 + r_tmp->domain_children = domainlist;
72565 + }
72566 +
72567 + err = copy_user_transitions(r_tmp);
72568 + if (err)
72569 + return err;
72570 +
72571 + memset(r_tmp->subj_hash, 0,
72572 + r_tmp->subj_hash_size *
72573 + sizeof (struct acl_subject_label *));
72574 +
72575 + /* acquire the list of subjects, then NULL out
72576 + the list prior to parsing the subjects for this role,
72577 + as during this parsing the list is replaced with a list
72578 + of *nested* subjects for the role
72579 + */
72580 + subj_list = r_tmp->hash->first;
72581 +
72582 + /* set nested subject list to null */
72583 + r_tmp->hash->first = NULL;
72584 +
72585 + err = copy_user_subjs(subj_list, r_tmp);
72586 +
72587 + if (err)
72588 + return err;
72589 +
72590 + insert_acl_role_label(r_tmp);
72591 + }
72592 +
72593 + if (polstate->default_role == NULL || polstate->kernel_role == NULL)
72594 + return -EINVAL;
72595 +
72596 + return err;
72597 +}
72598 +
72599 +static int gracl_reload_apply_policies(void *reload)
72600 +{
72601 + struct gr_reload_state *reload_state = (struct gr_reload_state *)reload;
72602 + struct task_struct *task, *task2;
72603 + struct acl_role_label *role, *rtmp;
72604 + struct acl_subject_label *subj;
72605 + const struct cred *cred;
72606 + int role_applied;
72607 + int ret = 0;
72608 +
72609 + memcpy(&reload_state->oldpolicy, reload_state->oldpolicy_ptr, sizeof(struct gr_policy_state));
72610 + memcpy(&reload_state->oldalloc, reload_state->oldalloc_ptr, sizeof(struct gr_alloc_state));
72611 +
72612 + /* first make sure we'll be able to apply the new policy cleanly */
72613 + do_each_thread(task2, task) {
72614 + if (task->exec_file == NULL)
72615 + continue;
72616 + role_applied = 0;
72617 + if (!reload_state->oldmode && task->role->roletype & GR_ROLE_SPECIAL) {
72618 + /* preserve special roles */
72619 + FOR_EACH_ROLE_START(role)
72620 + if ((role->roletype & GR_ROLE_SPECIAL) && !strcmp(task->role->rolename, role->rolename)) {
72621 + rtmp = task->role;
72622 + task->role = role;
72623 + role_applied = 1;
72624 + break;
72625 + }
72626 + FOR_EACH_ROLE_END(role)
72627 + }
72628 + if (!role_applied) {
72629 + cred = __task_cred(task);
72630 + rtmp = task->role;
72631 + task->role = __lookup_acl_role_label(polstate, task, GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid));
72632 + }
72633 + /* this handles non-nested inherited subjects, nested subjects will still
72634 + be dropped currently */
72635 + subj = __gr_get_subject_for_task(polstate, task, task->acl->filename);
72636 + task->tmpacl = __gr_get_subject_for_task(polstate, task, NULL);
72637 + /* change the role back so that we've made no modifications to the policy */
72638 + task->role = rtmp;
72639 +
72640 + if (subj == NULL || task->tmpacl == NULL) {
72641 + ret = -EINVAL;
72642 + goto out;
72643 + }
72644 + } while_each_thread(task2, task);
72645 +
72646 + /* now actually apply the policy */
72647 +
72648 + do_each_thread(task2, task) {
72649 + if (task->exec_file) {
72650 + role_applied = 0;
72651 + if (!reload_state->oldmode && task->role->roletype & GR_ROLE_SPECIAL) {
72652 + /* preserve special roles */
72653 + FOR_EACH_ROLE_START(role)
72654 + if ((role->roletype & GR_ROLE_SPECIAL) && !strcmp(task->role->rolename, role->rolename)) {
72655 + task->role = role;
72656 + role_applied = 1;
72657 + break;
72658 + }
72659 + FOR_EACH_ROLE_END(role)
72660 + }
72661 + if (!role_applied) {
72662 + cred = __task_cred(task);
72663 + task->role = __lookup_acl_role_label(polstate, task, GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid));
72664 + }
72665 + /* this handles non-nested inherited subjects, nested subjects will still
72666 + be dropped currently */
72667 + if (!reload_state->oldmode && task->inherited)
72668 + subj = __gr_get_subject_for_task(polstate, task, task->acl->filename);
72669 + else {
72670 + /* looked up and tagged to the task previously */
72671 + subj = task->tmpacl;
72672 + }
72673 + /* subj will be non-null */
72674 + __gr_apply_subject_to_task(polstate, task, subj);
72675 + if (reload_state->oldmode) {
72676 + task->acl_role_id = 0;
72677 + task->acl_sp_role = 0;
72678 + task->inherited = 0;
72679 + }
72680 + } else {
72681 + // it's a kernel process
72682 + task->role = polstate->kernel_role;
72683 + task->acl = polstate->kernel_role->root_label;
72684 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
72685 + task->acl->mode &= ~GR_PROCFIND;
72686 +#endif
72687 + }
72688 + } while_each_thread(task2, task);
72689 +
72690 + memcpy(reload_state->oldpolicy_ptr, &reload_state->newpolicy, sizeof(struct gr_policy_state));
72691 + memcpy(reload_state->oldalloc_ptr, &reload_state->newalloc, sizeof(struct gr_alloc_state));
72692 +
72693 +out:
72694 +
72695 + return ret;
72696 +}
72697 +
72698 +static int gracl_reload(struct gr_arg *args, unsigned char oldmode)
72699 +{
72700 + struct gr_reload_state new_reload_state = { };
72701 + int err;
72702 +
72703 + new_reload_state.oldpolicy_ptr = polstate;
72704 + new_reload_state.oldalloc_ptr = current_alloc_state;
72705 + new_reload_state.oldmode = oldmode;
72706 +
72707 + current_alloc_state = &new_reload_state.newalloc;
72708 + polstate = &new_reload_state.newpolicy;
72709 +
72710 + /* everything relevant is now saved off, copy in the new policy */
72711 + if (init_variables(args, true)) {
72712 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
72713 + err = -ENOMEM;
72714 + goto error;
72715 + }
72716 +
72717 + err = copy_user_acl(args);
72718 + free_init_variables();
72719 + if (err)
72720 + goto error;
72721 + /* the new policy is copied in, with the old policy available via saved_state
72722 + first go through applying roles, making sure to preserve special roles
72723 + then apply new subjects, making sure to preserve inherited and nested subjects,
72724 + though currently only inherited subjects will be preserved
72725 + */
72726 + err = stop_machine(gracl_reload_apply_policies, &new_reload_state, NULL);
72727 + if (err)
72728 + goto error;
72729 +
72730 + /* we've now applied the new policy, so restore the old policy state to free it */
72731 + polstate = &new_reload_state.oldpolicy;
72732 + current_alloc_state = &new_reload_state.oldalloc;
72733 + free_variables(true);
72734 +
72735 + /* oldpolicy/oldalloc_ptr point to the new policy/alloc states as they were copied
72736 + to running_polstate/current_alloc_state inside stop_machine
72737 + */
72738 + err = 0;
72739 + goto out;
72740 +error:
72741 + /* on error of loading the new policy, we'll just keep the previous
72742 + policy set around
72743 + */
72744 + free_variables(true);
72745 +
72746 + /* doesn't affect runtime, but maintains consistent state */
72747 +out:
72748 + polstate = new_reload_state.oldpolicy_ptr;
72749 + current_alloc_state = new_reload_state.oldalloc_ptr;
72750 +
72751 + return err;
72752 +}
72753 +
72754 +static int
72755 +gracl_init(struct gr_arg *args)
72756 +{
72757 + int error = 0;
72758 +
72759 + memcpy(&gr_system_salt, args->salt, sizeof(gr_system_salt));
72760 + memcpy(&gr_system_sum, args->sum, sizeof(gr_system_sum));
72761 +
72762 + if (init_variables(args, false)) {
72763 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
72764 + error = -ENOMEM;
72765 + goto out;
72766 + }
72767 +
72768 + error = copy_user_acl(args);
72769 + free_init_variables();
72770 + if (error)
72771 + goto out;
72772 +
72773 + error = gr_set_acls(0);
72774 + if (error)
72775 + goto out;
72776 +
72777 + gr_enable_rbac_system();
72778 +
72779 + return 0;
72780 +
72781 +out:
72782 + free_variables(false);
72783 + return error;
72784 +}
72785 +
72786 +static int
72787 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
72788 + unsigned char **sum)
72789 +{
72790 + struct acl_role_label *r;
72791 + struct role_allowed_ip *ipp;
72792 + struct role_transition *trans;
72793 + unsigned int i;
72794 + int found = 0;
72795 + u32 curr_ip = current->signal->curr_ip;
72796 +
72797 + current->signal->saved_ip = curr_ip;
72798 +
72799 + /* check transition table */
72800 +
72801 + for (trans = current->role->transitions; trans; trans = trans->next) {
72802 + if (!strcmp(rolename, trans->rolename)) {
72803 + found = 1;
72804 + break;
72805 + }
72806 + }
72807 +
72808 + if (!found)
72809 + return 0;
72810 +
72811 + /* handle special roles that do not require authentication
72812 + and check ip */
72813 +
72814 + FOR_EACH_ROLE_START(r)
72815 + if (!strcmp(rolename, r->rolename) &&
72816 + (r->roletype & GR_ROLE_SPECIAL)) {
72817 + found = 0;
72818 + if (r->allowed_ips != NULL) {
72819 + for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
72820 + if ((ntohl(curr_ip) & ipp->netmask) ==
72821 + (ntohl(ipp->addr) & ipp->netmask))
72822 + found = 1;
72823 + }
72824 + } else
72825 + found = 2;
72826 + if (!found)
72827 + return 0;
72828 +
72829 + if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
72830 + ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
72831 + *salt = NULL;
72832 + *sum = NULL;
72833 + return 1;
72834 + }
72835 + }
72836 + FOR_EACH_ROLE_END(r)
72837 +
72838 + for (i = 0; i < polstate->num_sprole_pws; i++) {
72839 + if (!strcmp(rolename, polstate->acl_special_roles[i]->rolename)) {
72840 + *salt = polstate->acl_special_roles[i]->salt;
72841 + *sum = polstate->acl_special_roles[i]->sum;
72842 + return 1;
72843 + }
72844 + }
72845 +
72846 + return 0;
72847 +}
72848 +
72849 +int gr_check_secure_terminal(struct task_struct *task)
72850 +{
72851 + struct task_struct *p, *p2, *p3;
72852 + struct files_struct *files;
72853 + struct fdtable *fdt;
72854 + struct file *our_file = NULL, *file;
72855 + int i;
72856 +
72857 + if (task->signal->tty == NULL)
72858 + return 1;
72859 +
72860 + files = get_files_struct(task);
72861 + if (files != NULL) {
72862 + rcu_read_lock();
72863 + fdt = files_fdtable(files);
72864 + for (i=0; i < fdt->max_fds; i++) {
72865 + file = fcheck_files(files, i);
72866 + if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
72867 + get_file(file);
72868 + our_file = file;
72869 + }
72870 + }
72871 + rcu_read_unlock();
72872 + put_files_struct(files);
72873 + }
72874 +
72875 + if (our_file == NULL)
72876 + return 1;
72877 +
72878 + read_lock(&tasklist_lock);
72879 + do_each_thread(p2, p) {
72880 + files = get_files_struct(p);
72881 + if (files == NULL ||
72882 + (p->signal && p->signal->tty == task->signal->tty)) {
72883 + if (files != NULL)
72884 + put_files_struct(files);
72885 + continue;
72886 + }
72887 + rcu_read_lock();
72888 + fdt = files_fdtable(files);
72889 + for (i=0; i < fdt->max_fds; i++) {
72890 + file = fcheck_files(files, i);
72891 + if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
72892 + file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
72893 + p3 = task;
72894 + while (task_pid_nr(p3) > 0) {
72895 + if (p3 == p)
72896 + break;
72897 + p3 = p3->real_parent;
72898 + }
72899 + if (p3 == p)
72900 + break;
72901 + gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
72902 + gr_handle_alertkill(p);
72903 + rcu_read_unlock();
72904 + put_files_struct(files);
72905 + read_unlock(&tasklist_lock);
72906 + fput(our_file);
72907 + return 0;
72908 + }
72909 + }
72910 + rcu_read_unlock();
72911 + put_files_struct(files);
72912 + } while_each_thread(p2, p);
72913 + read_unlock(&tasklist_lock);
72914 +
72915 + fput(our_file);
72916 + return 1;
72917 +}
72918 +
72919 +ssize_t
72920 +write_grsec_handler(struct file *file, const char __user * buf, size_t count, loff_t *ppos)
72921 +{
72922 + struct gr_arg_wrapper uwrap;
72923 + unsigned char *sprole_salt = NULL;
72924 + unsigned char *sprole_sum = NULL;
72925 + int error = 0;
72926 + int error2 = 0;
72927 + size_t req_count = 0;
72928 + unsigned char oldmode = 0;
72929 +
72930 + mutex_lock(&gr_dev_mutex);
72931 +
72932 + if (gr_acl_is_enabled() && !(current->acl->mode & GR_KERNELAUTH)) {
72933 + error = -EPERM;
72934 + goto out;
72935 + }
72936 +
72937 +#ifdef CONFIG_COMPAT
72938 + pax_open_kernel();
72939 + if (is_compat_task()) {
72940 + copy_gr_arg_wrapper = &copy_gr_arg_wrapper_compat;
72941 + copy_gr_arg = &copy_gr_arg_compat;
72942 + copy_acl_object_label = &copy_acl_object_label_compat;
72943 + copy_acl_subject_label = &copy_acl_subject_label_compat;
72944 + copy_acl_role_label = &copy_acl_role_label_compat;
72945 + copy_acl_ip_label = &copy_acl_ip_label_compat;
72946 + copy_role_allowed_ip = &copy_role_allowed_ip_compat;
72947 + copy_role_transition = &copy_role_transition_compat;
72948 + copy_sprole_pw = &copy_sprole_pw_compat;
72949 + copy_gr_hash_struct = &copy_gr_hash_struct_compat;
72950 + copy_pointer_from_array = &copy_pointer_from_array_compat;
72951 + get_gr_arg_wrapper_size = &get_gr_arg_wrapper_size_compat;
72952 + } else {
72953 + copy_gr_arg_wrapper = &copy_gr_arg_wrapper_normal;
72954 + copy_gr_arg = &copy_gr_arg_normal;
72955 + copy_acl_object_label = &copy_acl_object_label_normal;
72956 + copy_acl_subject_label = &copy_acl_subject_label_normal;
72957 + copy_acl_role_label = &copy_acl_role_label_normal;
72958 + copy_acl_ip_label = &copy_acl_ip_label_normal;
72959 + copy_role_allowed_ip = &copy_role_allowed_ip_normal;
72960 + copy_role_transition = &copy_role_transition_normal;
72961 + copy_sprole_pw = &copy_sprole_pw_normal;
72962 + copy_gr_hash_struct = &copy_gr_hash_struct_normal;
72963 + copy_pointer_from_array = &copy_pointer_from_array_normal;
72964 + get_gr_arg_wrapper_size = &get_gr_arg_wrapper_size_normal;
72965 + }
72966 + pax_close_kernel();
72967 +#endif
72968 +
72969 + req_count = get_gr_arg_wrapper_size();
72970 +
72971 + if (count != req_count) {
72972 + gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)req_count);
72973 + error = -EINVAL;
72974 + goto out;
72975 + }
72976 +
72977 +
72978 + if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
72979 + gr_auth_expires = 0;
72980 + gr_auth_attempts = 0;
72981 + }
72982 +
72983 + error = copy_gr_arg_wrapper(buf, &uwrap);
72984 + if (error)
72985 + goto out;
72986 +
72987 + error = copy_gr_arg(uwrap.arg, &gr_usermode);
72988 + if (error)
72989 + goto out;
72990 +
72991 + if (gr_usermode.mode != GR_SPROLE && gr_usermode.mode != GR_SPROLEPAM &&
72992 + gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
72993 + time_after(gr_auth_expires, get_seconds())) {
72994 + error = -EBUSY;
72995 + goto out;
72996 + }
72997 +
72998 + /* if non-root trying to do anything other than use a special role,
72999 + do not attempt authentication, do not count towards authentication
73000 + locking
73001 + */
73002 +
73003 + if (gr_usermode.mode != GR_SPROLE && gr_usermode.mode != GR_STATUS &&
73004 + gr_usermode.mode != GR_UNSPROLE && gr_usermode.mode != GR_SPROLEPAM &&
73005 + gr_is_global_nonroot(current_uid())) {
73006 + error = -EPERM;
73007 + goto out;
73008 + }
73009 +
73010 + /* ensure pw and special role name are null terminated */
73011 +
73012 + gr_usermode.pw[GR_PW_LEN - 1] = '\0';
73013 + gr_usermode.sp_role[GR_SPROLE_LEN - 1] = '\0';
73014 +
73015 + /* Okay.
73016 + * We have our enough of the argument structure..(we have yet
73017 + * to copy_from_user the tables themselves) . Copy the tables
73018 + * only if we need them, i.e. for loading operations. */
73019 +
73020 + switch (gr_usermode.mode) {
73021 + case GR_STATUS:
73022 + if (gr_acl_is_enabled()) {
73023 + error = 1;
73024 + if (!gr_check_secure_terminal(current))
73025 + error = 3;
73026 + } else
73027 + error = 2;
73028 + goto out;
73029 + case GR_SHUTDOWN:
73030 + if (gr_acl_is_enabled() && !(chkpw(&gr_usermode, (unsigned char *)&gr_system_salt, (unsigned char *)&gr_system_sum))) {
73031 + stop_machine(gr_rbac_disable, NULL, NULL);
73032 + free_variables(false);
73033 + memset(&gr_usermode, 0, sizeof(gr_usermode));
73034 + memset(&gr_system_salt, 0, sizeof(gr_system_salt));
73035 + memset(&gr_system_sum, 0, sizeof(gr_system_sum));
73036 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
73037 + } else if (gr_acl_is_enabled()) {
73038 + gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
73039 + error = -EPERM;
73040 + } else {
73041 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
73042 + error = -EAGAIN;
73043 + }
73044 + break;
73045 + case GR_ENABLE:
73046 + if (!gr_acl_is_enabled() && !(error2 = gracl_init(&gr_usermode)))
73047 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
73048 + else {
73049 + if (gr_acl_is_enabled())
73050 + error = -EAGAIN;
73051 + else
73052 + error = error2;
73053 + gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
73054 + }
73055 + break;
73056 + case GR_OLDRELOAD:
73057 + oldmode = 1;
73058 + case GR_RELOAD:
73059 + if (!gr_acl_is_enabled()) {
73060 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
73061 + error = -EAGAIN;
73062 + } else if (!(chkpw(&gr_usermode, (unsigned char *)&gr_system_salt, (unsigned char *)&gr_system_sum))) {
73063 + error2 = gracl_reload(&gr_usermode, oldmode);
73064 + if (!error2)
73065 + gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
73066 + else {
73067 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
73068 + error = error2;
73069 + }
73070 + } else {
73071 + gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
73072 + error = -EPERM;
73073 + }
73074 + break;
73075 + case GR_SEGVMOD:
73076 + if (unlikely(!gr_acl_is_enabled())) {
73077 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
73078 + error = -EAGAIN;
73079 + break;
73080 + }
73081 +
73082 + if (!(chkpw(&gr_usermode, (unsigned char *)&gr_system_salt, (unsigned char *)&gr_system_sum))) {
73083 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
73084 + if (gr_usermode.segv_device && gr_usermode.segv_inode) {
73085 + struct acl_subject_label *segvacl;
73086 + segvacl =
73087 + lookup_acl_subj_label(gr_usermode.segv_inode,
73088 + gr_usermode.segv_device,
73089 + current->role);
73090 + if (segvacl) {
73091 + segvacl->crashes = 0;
73092 + segvacl->expires = 0;
73093 + }
73094 + } else if (gr_find_uid(gr_usermode.segv_uid) >= 0) {
73095 + gr_remove_uid(gr_usermode.segv_uid);
73096 + }
73097 + } else {
73098 + gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
73099 + error = -EPERM;
73100 + }
73101 + break;
73102 + case GR_SPROLE:
73103 + case GR_SPROLEPAM:
73104 + if (unlikely(!gr_acl_is_enabled())) {
73105 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
73106 + error = -EAGAIN;
73107 + break;
73108 + }
73109 +
73110 + if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
73111 + current->role->expires = 0;
73112 + current->role->auth_attempts = 0;
73113 + }
73114 +
73115 + if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
73116 + time_after(current->role->expires, get_seconds())) {
73117 + error = -EBUSY;
73118 + goto out;
73119 + }
73120 +
73121 + if (lookup_special_role_auth
73122 + (gr_usermode.mode, gr_usermode.sp_role, &sprole_salt, &sprole_sum)
73123 + && ((!sprole_salt && !sprole_sum)
73124 + || !(chkpw(&gr_usermode, sprole_salt, sprole_sum)))) {
73125 + char *p = "";
73126 + assign_special_role(gr_usermode.sp_role);
73127 + read_lock(&tasklist_lock);
73128 + if (current->real_parent)
73129 + p = current->real_parent->role->rolename;
73130 + read_unlock(&tasklist_lock);
73131 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
73132 + p, acl_sp_role_value);
73133 + } else {
73134 + gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode.sp_role);
73135 + error = -EPERM;
73136 + if(!(current->role->auth_attempts++))
73137 + current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
73138 +
73139 + goto out;
73140 + }
73141 + break;
73142 + case GR_UNSPROLE:
73143 + if (unlikely(!gr_acl_is_enabled())) {
73144 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
73145 + error = -EAGAIN;
73146 + break;
73147 + }
73148 +
73149 + if (current->role->roletype & GR_ROLE_SPECIAL) {
73150 + char *p = "";
73151 + int i = 0;
73152 +
73153 + read_lock(&tasklist_lock);
73154 + if (current->real_parent) {
73155 + p = current->real_parent->role->rolename;
73156 + i = current->real_parent->acl_role_id;
73157 + }
73158 + read_unlock(&tasklist_lock);
73159 +
73160 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
73161 + gr_set_acls(1);
73162 + } else {
73163 + error = -EPERM;
73164 + goto out;
73165 + }
73166 + break;
73167 + default:
73168 + gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode.mode);
73169 + error = -EINVAL;
73170 + break;
73171 + }
73172 +
73173 + if (error != -EPERM)
73174 + goto out;
73175 +
73176 + if(!(gr_auth_attempts++))
73177 + gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
73178 +
73179 + out:
73180 + mutex_unlock(&gr_dev_mutex);
73181 +
73182 + if (!error)
73183 + error = req_count;
73184 +
73185 + return error;
73186 +}
73187 +
73188 +int
73189 +gr_set_acls(const int type)
73190 +{
73191 + struct task_struct *task, *task2;
73192 + struct acl_role_label *role = current->role;
73193 + struct acl_subject_label *subj;
73194 + __u16 acl_role_id = current->acl_role_id;
73195 + const struct cred *cred;
73196 + int ret;
73197 +
73198 + rcu_read_lock();
73199 + read_lock(&tasklist_lock);
73200 + read_lock(&grsec_exec_file_lock);
73201 + do_each_thread(task2, task) {
73202 + /* check to see if we're called from the exit handler,
73203 + if so, only replace ACLs that have inherited the admin
73204 + ACL */
73205 +
73206 + if (type && (task->role != role ||
73207 + task->acl_role_id != acl_role_id))
73208 + continue;
73209 +
73210 + task->acl_role_id = 0;
73211 + task->acl_sp_role = 0;
73212 + task->inherited = 0;
73213 +
73214 + if (task->exec_file) {
73215 + cred = __task_cred(task);
73216 + task->role = __lookup_acl_role_label(polstate, task, GR_GLOBAL_UID(cred->uid), GR_GLOBAL_GID(cred->gid));
73217 + subj = __gr_get_subject_for_task(polstate, task, NULL);
73218 + if (subj == NULL) {
73219 + ret = -EINVAL;
73220 + read_unlock(&grsec_exec_file_lock);
73221 + read_unlock(&tasklist_lock);
73222 + rcu_read_unlock();
73223 + gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task_pid_nr(task));
73224 + return ret;
73225 + }
73226 + __gr_apply_subject_to_task(polstate, task, subj);
73227 + } else {
73228 + // it's a kernel process
73229 + task->role = polstate->kernel_role;
73230 + task->acl = polstate->kernel_role->root_label;
73231 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
73232 + task->acl->mode &= ~GR_PROCFIND;
73233 +#endif
73234 + }
73235 + } while_each_thread(task2, task);
73236 + read_unlock(&grsec_exec_file_lock);
73237 + read_unlock(&tasklist_lock);
73238 + rcu_read_unlock();
73239 +
73240 + return 0;
73241 +}
73242 diff --git a/grsecurity/gracl_res.c b/grsecurity/gracl_res.c
73243 new file mode 100644
73244 index 0000000..39645c9
73245 --- /dev/null
73246 +++ b/grsecurity/gracl_res.c
73247 @@ -0,0 +1,68 @@
73248 +#include <linux/kernel.h>
73249 +#include <linux/sched.h>
73250 +#include <linux/gracl.h>
73251 +#include <linux/grinternal.h>
73252 +
73253 +static const char *restab_log[] = {
73254 + [RLIMIT_CPU] = "RLIMIT_CPU",
73255 + [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
73256 + [RLIMIT_DATA] = "RLIMIT_DATA",
73257 + [RLIMIT_STACK] = "RLIMIT_STACK",
73258 + [RLIMIT_CORE] = "RLIMIT_CORE",
73259 + [RLIMIT_RSS] = "RLIMIT_RSS",
73260 + [RLIMIT_NPROC] = "RLIMIT_NPROC",
73261 + [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
73262 + [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
73263 + [RLIMIT_AS] = "RLIMIT_AS",
73264 + [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
73265 + [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
73266 + [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
73267 + [RLIMIT_NICE] = "RLIMIT_NICE",
73268 + [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
73269 + [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
73270 + [GR_CRASH_RES] = "RLIMIT_CRASH"
73271 +};
73272 +
73273 +void
73274 +gr_log_resource(const struct task_struct *task,
73275 + const int res, const unsigned long wanted, const int gt)
73276 +{
73277 + const struct cred *cred;
73278 + unsigned long rlim;
73279 +
73280 + if (!gr_acl_is_enabled() && !grsec_resource_logging)
73281 + return;
73282 +
73283 + // not yet supported resource
73284 + if (unlikely(!restab_log[res]))
73285 + return;
73286 +
73287 + if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
73288 + rlim = task_rlimit_max(task, res);
73289 + else
73290 + rlim = task_rlimit(task, res);
73291 +
73292 + if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
73293 + return;
73294 +
73295 + rcu_read_lock();
73296 + cred = __task_cred(task);
73297 +
73298 + if (res == RLIMIT_NPROC &&
73299 + (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
73300 + cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
73301 + goto out_rcu_unlock;
73302 + else if (res == RLIMIT_MEMLOCK &&
73303 + cap_raised(cred->cap_effective, CAP_IPC_LOCK))
73304 + goto out_rcu_unlock;
73305 + else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
73306 + goto out_rcu_unlock;
73307 + rcu_read_unlock();
73308 +
73309 + gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
73310 +
73311 + return;
73312 +out_rcu_unlock:
73313 + rcu_read_unlock();
73314 + return;
73315 +}
73316 diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
73317 new file mode 100644
73318 index 0000000..2040e61
73319 --- /dev/null
73320 +++ b/grsecurity/gracl_segv.c
73321 @@ -0,0 +1,313 @@
73322 +#include <linux/kernel.h>
73323 +#include <linux/mm.h>
73324 +#include <asm/uaccess.h>
73325 +#include <asm/errno.h>
73326 +#include <asm/mman.h>
73327 +#include <net/sock.h>
73328 +#include <linux/file.h>
73329 +#include <linux/fs.h>
73330 +#include <linux/net.h>
73331 +#include <linux/in.h>
73332 +#include <linux/slab.h>
73333 +#include <linux/types.h>
73334 +#include <linux/sched.h>
73335 +#include <linux/timer.h>
73336 +#include <linux/gracl.h>
73337 +#include <linux/grsecurity.h>
73338 +#include <linux/grinternal.h>
73339 +#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
73340 +#include <linux/magic.h>
73341 +#include <linux/pagemap.h>
73342 +#include "../fs/btrfs/async-thread.h"
73343 +#include "../fs/btrfs/ctree.h"
73344 +#include "../fs/btrfs/btrfs_inode.h"
73345 +#endif
73346 +
73347 +static struct crash_uid *uid_set;
73348 +static unsigned short uid_used;
73349 +static DEFINE_SPINLOCK(gr_uid_lock);
73350 +extern rwlock_t gr_inode_lock;
73351 +extern struct acl_subject_label *
73352 + lookup_acl_subj_label(const ino_t inode, const dev_t dev,
73353 + struct acl_role_label *role);
73354 +
73355 +static inline dev_t __get_dev(const struct dentry *dentry)
73356 +{
73357 +#if defined(CONFIG_BTRFS_FS) || defined(CONFIG_BTRFS_FS_MODULE)
73358 + if (dentry->d_sb->s_magic == BTRFS_SUPER_MAGIC)
73359 + return BTRFS_I(dentry->d_inode)->root->anon_dev;
73360 + else
73361 +#endif
73362 + return dentry->d_sb->s_dev;
73363 +}
73364 +
73365 +int
73366 +gr_init_uidset(void)
73367 +{
73368 + uid_set =
73369 + kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
73370 + uid_used = 0;
73371 +
73372 + return uid_set ? 1 : 0;
73373 +}
73374 +
73375 +void
73376 +gr_free_uidset(void)
73377 +{
73378 + if (uid_set) {
73379 + struct crash_uid *tmpset;
73380 + spin_lock(&gr_uid_lock);
73381 + tmpset = uid_set;
73382 + uid_set = NULL;
73383 + uid_used = 0;
73384 + spin_unlock(&gr_uid_lock);
73385 + if (tmpset)
73386 + kfree(tmpset);
73387 + }
73388 +
73389 + return;
73390 +}
73391 +
73392 +int
73393 +gr_find_uid(const uid_t uid)
73394 +{
73395 + struct crash_uid *tmp = uid_set;
73396 + uid_t buid;
73397 + int low = 0, high = uid_used - 1, mid;
73398 +
73399 + while (high >= low) {
73400 + mid = (low + high) >> 1;
73401 + buid = tmp[mid].uid;
73402 + if (buid == uid)
73403 + return mid;
73404 + if (buid > uid)
73405 + high = mid - 1;
73406 + if (buid < uid)
73407 + low = mid + 1;
73408 + }
73409 +
73410 + return -1;
73411 +}
73412 +
73413 +static __inline__ void
73414 +gr_insertsort(void)
73415 +{
73416 + unsigned short i, j;
73417 + struct crash_uid index;
73418 +
73419 + for (i = 1; i < uid_used; i++) {
73420 + index = uid_set[i];
73421 + j = i;
73422 + while ((j > 0) && uid_set[j - 1].uid > index.uid) {
73423 + uid_set[j] = uid_set[j - 1];
73424 + j--;
73425 + }
73426 + uid_set[j] = index;
73427 + }
73428 +
73429 + return;
73430 +}
73431 +
73432 +static __inline__ void
73433 +gr_insert_uid(const kuid_t kuid, const unsigned long expires)
73434 +{
73435 + int loc;
73436 + uid_t uid = GR_GLOBAL_UID(kuid);
73437 +
73438 + if (uid_used == GR_UIDTABLE_MAX)
73439 + return;
73440 +
73441 + loc = gr_find_uid(uid);
73442 +
73443 + if (loc >= 0) {
73444 + uid_set[loc].expires = expires;
73445 + return;
73446 + }
73447 +
73448 + uid_set[uid_used].uid = uid;
73449 + uid_set[uid_used].expires = expires;
73450 + uid_used++;
73451 +
73452 + gr_insertsort();
73453 +
73454 + return;
73455 +}
73456 +
73457 +void
73458 +gr_remove_uid(const unsigned short loc)
73459 +{
73460 + unsigned short i;
73461 +
73462 + for (i = loc + 1; i < uid_used; i++)
73463 + uid_set[i - 1] = uid_set[i];
73464 +
73465 + uid_used--;
73466 +
73467 + return;
73468 +}
73469 +
73470 +int
73471 +gr_check_crash_uid(const kuid_t kuid)
73472 +{
73473 + int loc;
73474 + int ret = 0;
73475 + uid_t uid;
73476 +
73477 + if (unlikely(!gr_acl_is_enabled()))
73478 + return 0;
73479 +
73480 + uid = GR_GLOBAL_UID(kuid);
73481 +
73482 + spin_lock(&gr_uid_lock);
73483 + loc = gr_find_uid(uid);
73484 +
73485 + if (loc < 0)
73486 + goto out_unlock;
73487 +
73488 + if (time_before_eq(uid_set[loc].expires, get_seconds()))
73489 + gr_remove_uid(loc);
73490 + else
73491 + ret = 1;
73492 +
73493 +out_unlock:
73494 + spin_unlock(&gr_uid_lock);
73495 + return ret;
73496 +}
73497 +
73498 +static __inline__ int
73499 +proc_is_setxid(const struct cred *cred)
73500 +{
73501 + if (!uid_eq(cred->uid, cred->euid) || !uid_eq(cred->uid, cred->suid) ||
73502 + !uid_eq(cred->uid, cred->fsuid))
73503 + return 1;
73504 + if (!gid_eq(cred->gid, cred->egid) || !gid_eq(cred->gid, cred->sgid) ||
73505 + !gid_eq(cred->gid, cred->fsgid))
73506 + return 1;
73507 +
73508 + return 0;
73509 +}
73510 +
73511 +extern int gr_fake_force_sig(int sig, struct task_struct *t);
73512 +
73513 +void
73514 +gr_handle_crash(struct task_struct *task, const int sig)
73515 +{
73516 + struct acl_subject_label *curr;
73517 + struct task_struct *tsk, *tsk2;
73518 + const struct cred *cred;
73519 + const struct cred *cred2;
73520 +
73521 + if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
73522 + return;
73523 +
73524 + if (unlikely(!gr_acl_is_enabled()))
73525 + return;
73526 +
73527 + curr = task->acl;
73528 +
73529 + if (!(curr->resmask & (1U << GR_CRASH_RES)))
73530 + return;
73531 +
73532 + if (time_before_eq(curr->expires, get_seconds())) {
73533 + curr->expires = 0;
73534 + curr->crashes = 0;
73535 + }
73536 +
73537 + curr->crashes++;
73538 +
73539 + if (!curr->expires)
73540 + curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
73541 +
73542 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
73543 + time_after(curr->expires, get_seconds())) {
73544 + rcu_read_lock();
73545 + cred = __task_cred(task);
73546 + if (gr_is_global_nonroot(cred->uid) && proc_is_setxid(cred)) {
73547 + gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
73548 + spin_lock(&gr_uid_lock);
73549 + gr_insert_uid(cred->uid, curr->expires);
73550 + spin_unlock(&gr_uid_lock);
73551 + curr->expires = 0;
73552 + curr->crashes = 0;
73553 + read_lock(&tasklist_lock);
73554 + do_each_thread(tsk2, tsk) {
73555 + cred2 = __task_cred(tsk);
73556 + if (tsk != task && uid_eq(cred2->uid, cred->uid))
73557 + gr_fake_force_sig(SIGKILL, tsk);
73558 + } while_each_thread(tsk2, tsk);
73559 + read_unlock(&tasklist_lock);
73560 + } else {
73561 + gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
73562 + read_lock(&tasklist_lock);
73563 + read_lock(&grsec_exec_file_lock);
73564 + do_each_thread(tsk2, tsk) {
73565 + if (likely(tsk != task)) {
73566 + // if this thread has the same subject as the one that triggered
73567 + // RES_CRASH and it's the same binary, kill it
73568 + if (tsk->acl == task->acl && gr_is_same_file(tsk->exec_file, task->exec_file))
73569 + gr_fake_force_sig(SIGKILL, tsk);
73570 + }
73571 + } while_each_thread(tsk2, tsk);
73572 + read_unlock(&grsec_exec_file_lock);
73573 + read_unlock(&tasklist_lock);
73574 + }
73575 + rcu_read_unlock();
73576 + }
73577 +
73578 + return;
73579 +}
73580 +
73581 +int
73582 +gr_check_crash_exec(const struct file *filp)
73583 +{
73584 + struct acl_subject_label *curr;
73585 +
73586 + if (unlikely(!gr_acl_is_enabled()))
73587 + return 0;
73588 +
73589 + read_lock(&gr_inode_lock);
73590 + curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
73591 + __get_dev(filp->f_path.dentry),
73592 + current->role);
73593 + read_unlock(&gr_inode_lock);
73594 +
73595 + if (!curr || !(curr->resmask & (1U << GR_CRASH_RES)) ||
73596 + (!curr->crashes && !curr->expires))
73597 + return 0;
73598 +
73599 + if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
73600 + time_after(curr->expires, get_seconds()))
73601 + return 1;
73602 + else if (time_before_eq(curr->expires, get_seconds())) {
73603 + curr->crashes = 0;
73604 + curr->expires = 0;
73605 + }
73606 +
73607 + return 0;
73608 +}
73609 +
73610 +void
73611 +gr_handle_alertkill(struct task_struct *task)
73612 +{
73613 + struct acl_subject_label *curracl;
73614 + __u32 curr_ip;
73615 + struct task_struct *p, *p2;
73616 +
73617 + if (unlikely(!gr_acl_is_enabled()))
73618 + return;
73619 +
73620 + curracl = task->acl;
73621 + curr_ip = task->signal->curr_ip;
73622 +
73623 + if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
73624 + read_lock(&tasklist_lock);
73625 + do_each_thread(p2, p) {
73626 + if (p->signal->curr_ip == curr_ip)
73627 + gr_fake_force_sig(SIGKILL, p);
73628 + } while_each_thread(p2, p);
73629 + read_unlock(&tasklist_lock);
73630 + } else if (curracl->mode & GR_KILLPROC)
73631 + gr_fake_force_sig(SIGKILL, task);
73632 +
73633 + return;
73634 +}
73635 diff --git a/grsecurity/gracl_shm.c b/grsecurity/gracl_shm.c
73636 new file mode 100644
73637 index 0000000..98011b0
73638 --- /dev/null
73639 +++ b/grsecurity/gracl_shm.c
73640 @@ -0,0 +1,40 @@
73641 +#include <linux/kernel.h>
73642 +#include <linux/mm.h>
73643 +#include <linux/sched.h>
73644 +#include <linux/file.h>
73645 +#include <linux/ipc.h>
73646 +#include <linux/gracl.h>
73647 +#include <linux/grsecurity.h>
73648 +#include <linux/grinternal.h>
73649 +
73650 +int
73651 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
73652 + const time_t shm_createtime, const kuid_t cuid, const int shmid)
73653 +{
73654 + struct task_struct *task;
73655 +
73656 + if (!gr_acl_is_enabled())
73657 + return 1;
73658 +
73659 + rcu_read_lock();
73660 + read_lock(&tasklist_lock);
73661 +
73662 + task = find_task_by_vpid(shm_cprid);
73663 +
73664 + if (unlikely(!task))
73665 + task = find_task_by_vpid(shm_lapid);
73666 +
73667 + if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
73668 + (task_pid_nr(task) == shm_lapid)) &&
73669 + (task->acl->mode & GR_PROTSHM) &&
73670 + (task->acl != current->acl))) {
73671 + read_unlock(&tasklist_lock);
73672 + rcu_read_unlock();
73673 + gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, GR_GLOBAL_UID(cuid), shm_cprid, shmid);
73674 + return 0;
73675 + }
73676 + read_unlock(&tasklist_lock);
73677 + rcu_read_unlock();
73678 +
73679 + return 1;
73680 +}
73681 diff --git a/grsecurity/grsec_chdir.c b/grsecurity/grsec_chdir.c
73682 new file mode 100644
73683 index 0000000..bc0be01
73684 --- /dev/null
73685 +++ b/grsecurity/grsec_chdir.c
73686 @@ -0,0 +1,19 @@
73687 +#include <linux/kernel.h>
73688 +#include <linux/sched.h>
73689 +#include <linux/fs.h>
73690 +#include <linux/file.h>
73691 +#include <linux/grsecurity.h>
73692 +#include <linux/grinternal.h>
73693 +
73694 +void
73695 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
73696 +{
73697 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
73698 + if ((grsec_enable_chdir && grsec_enable_group &&
73699 + in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
73700 + !grsec_enable_group)) {
73701 + gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
73702 + }
73703 +#endif
73704 + return;
73705 +}
73706 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
73707 new file mode 100644
73708 index 0000000..651d6c2
73709 --- /dev/null
73710 +++ b/grsecurity/grsec_chroot.c
73711 @@ -0,0 +1,370 @@
73712 +#include <linux/kernel.h>
73713 +#include <linux/module.h>
73714 +#include <linux/sched.h>
73715 +#include <linux/file.h>
73716 +#include <linux/fs.h>
73717 +#include <linux/mount.h>
73718 +#include <linux/types.h>
73719 +#include "../fs/mount.h"
73720 +#include <linux/grsecurity.h>
73721 +#include <linux/grinternal.h>
73722 +
73723 +#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
73724 +int gr_init_ran;
73725 +#endif
73726 +
73727 +void gr_set_chroot_entries(struct task_struct *task, const struct path *path)
73728 +{
73729 +#ifdef CONFIG_GRKERNSEC
73730 + if (task_pid_nr(task) > 1 && path->dentry != init_task.fs->root.dentry &&
73731 + path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root
73732 +#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
73733 + && gr_init_ran
73734 +#endif
73735 + )
73736 + task->gr_is_chrooted = 1;
73737 + else {
73738 +#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
73739 + if (task_pid_nr(task) == 1 && !gr_init_ran)
73740 + gr_init_ran = 1;
73741 +#endif
73742 + task->gr_is_chrooted = 0;
73743 + }
73744 +
73745 + task->gr_chroot_dentry = path->dentry;
73746 +#endif
73747 + return;
73748 +}
73749 +
73750 +void gr_clear_chroot_entries(struct task_struct *task)
73751 +{
73752 +#ifdef CONFIG_GRKERNSEC
73753 + task->gr_is_chrooted = 0;
73754 + task->gr_chroot_dentry = NULL;
73755 +#endif
73756 + return;
73757 +}
73758 +
73759 +int
73760 +gr_handle_chroot_unix(const pid_t pid)
73761 +{
73762 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
73763 + struct task_struct *p;
73764 +
73765 + if (unlikely(!grsec_enable_chroot_unix))
73766 + return 1;
73767 +
73768 + if (likely(!proc_is_chrooted(current)))
73769 + return 1;
73770 +
73771 + rcu_read_lock();
73772 + read_lock(&tasklist_lock);
73773 + p = find_task_by_vpid_unrestricted(pid);
73774 + if (unlikely(p && !have_same_root(current, p))) {
73775 + read_unlock(&tasklist_lock);
73776 + rcu_read_unlock();
73777 + gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
73778 + return 0;
73779 + }
73780 + read_unlock(&tasklist_lock);
73781 + rcu_read_unlock();
73782 +#endif
73783 + return 1;
73784 +}
73785 +
73786 +int
73787 +gr_handle_chroot_nice(void)
73788 +{
73789 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
73790 + if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
73791 + gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
73792 + return -EPERM;
73793 + }
73794 +#endif
73795 + return 0;
73796 +}
73797 +
73798 +int
73799 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
73800 +{
73801 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
73802 + if (grsec_enable_chroot_nice && (niceval < task_nice(p))
73803 + && proc_is_chrooted(current)) {
73804 + gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, task_pid_nr(p));
73805 + return -EACCES;
73806 + }
73807 +#endif
73808 + return 0;
73809 +}
73810 +
73811 +int
73812 +gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
73813 +{
73814 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
73815 + struct task_struct *p;
73816 + int ret = 0;
73817 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
73818 + return ret;
73819 +
73820 + read_lock(&tasklist_lock);
73821 + do_each_pid_task(pid, type, p) {
73822 + if (!have_same_root(current, p)) {
73823 + ret = 1;
73824 + goto out;
73825 + }
73826 + } while_each_pid_task(pid, type, p);
73827 +out:
73828 + read_unlock(&tasklist_lock);
73829 + return ret;
73830 +#endif
73831 + return 0;
73832 +}
73833 +
73834 +int
73835 +gr_pid_is_chrooted(struct task_struct *p)
73836 +{
73837 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
73838 + if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
73839 + return 0;
73840 +
73841 + if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
73842 + !have_same_root(current, p)) {
73843 + return 1;
73844 + }
73845 +#endif
73846 + return 0;
73847 +}
73848 +
73849 +EXPORT_SYMBOL_GPL(gr_pid_is_chrooted);
73850 +
73851 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
73852 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
73853 +{
73854 + struct path path, currentroot;
73855 + int ret = 0;
73856 +
73857 + path.dentry = (struct dentry *)u_dentry;
73858 + path.mnt = (struct vfsmount *)u_mnt;
73859 + get_fs_root(current->fs, &currentroot);
73860 + if (path_is_under(&path, &currentroot))
73861 + ret = 1;
73862 + path_put(&currentroot);
73863 +
73864 + return ret;
73865 +}
73866 +#endif
73867 +
73868 +int
73869 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
73870 +{
73871 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
73872 + if (!grsec_enable_chroot_fchdir)
73873 + return 1;
73874 +
73875 + if (!proc_is_chrooted(current))
73876 + return 1;
73877 + else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
73878 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
73879 + return 0;
73880 + }
73881 +#endif
73882 + return 1;
73883 +}
73884 +
73885 +int
73886 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
73887 + const time_t shm_createtime)
73888 +{
73889 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
73890 + struct task_struct *p;
73891 + time_t starttime;
73892 +
73893 + if (unlikely(!grsec_enable_chroot_shmat))
73894 + return 1;
73895 +
73896 + if (likely(!proc_is_chrooted(current)))
73897 + return 1;
73898 +
73899 + rcu_read_lock();
73900 + read_lock(&tasklist_lock);
73901 +
73902 + if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
73903 + starttime = p->start_time.tv_sec;
73904 + if (time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime)) {
73905 + if (have_same_root(current, p)) {
73906 + goto allow;
73907 + } else {
73908 + read_unlock(&tasklist_lock);
73909 + rcu_read_unlock();
73910 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
73911 + return 0;
73912 + }
73913 + }
73914 + /* creator exited, pid reuse, fall through to next check */
73915 + }
73916 + if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
73917 + if (unlikely(!have_same_root(current, p))) {
73918 + read_unlock(&tasklist_lock);
73919 + rcu_read_unlock();
73920 + gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
73921 + return 0;
73922 + }
73923 + }
73924 +
73925 +allow:
73926 + read_unlock(&tasklist_lock);
73927 + rcu_read_unlock();
73928 +#endif
73929 + return 1;
73930 +}
73931 +
73932 +void
73933 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
73934 +{
73935 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
73936 + if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
73937 + gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
73938 +#endif
73939 + return;
73940 +}
73941 +
73942 +int
73943 +gr_handle_chroot_mknod(const struct dentry *dentry,
73944 + const struct vfsmount *mnt, const int mode)
73945 +{
73946 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
73947 + if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
73948 + proc_is_chrooted(current)) {
73949 + gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
73950 + return -EPERM;
73951 + }
73952 +#endif
73953 + return 0;
73954 +}
73955 +
73956 +int
73957 +gr_handle_chroot_mount(const struct dentry *dentry,
73958 + const struct vfsmount *mnt, const char *dev_name)
73959 +{
73960 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
73961 + if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
73962 + gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none", dentry, mnt);
73963 + return -EPERM;
73964 + }
73965 +#endif
73966 + return 0;
73967 +}
73968 +
73969 +int
73970 +gr_handle_chroot_pivot(void)
73971 +{
73972 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
73973 + if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
73974 + gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
73975 + return -EPERM;
73976 + }
73977 +#endif
73978 + return 0;
73979 +}
73980 +
73981 +int
73982 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
73983 +{
73984 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
73985 + if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
73986 + !gr_is_outside_chroot(dentry, mnt)) {
73987 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
73988 + return -EPERM;
73989 + }
73990 +#endif
73991 + return 0;
73992 +}
73993 +
73994 +extern const char *captab_log[];
73995 +extern int captab_log_entries;
73996 +
73997 +int
73998 +gr_task_chroot_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
73999 +{
74000 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
74001 + if (grsec_enable_chroot_caps && proc_is_chrooted(task)) {
74002 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
74003 + if (cap_raised(chroot_caps, cap)) {
74004 + if (cap_raised(cred->cap_effective, cap) && cap < captab_log_entries) {
74005 + gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, task, captab_log[cap]);
74006 + }
74007 + return 0;
74008 + }
74009 + }
74010 +#endif
74011 + return 1;
74012 +}
74013 +
74014 +int
74015 +gr_chroot_is_capable(const int cap)
74016 +{
74017 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
74018 + return gr_task_chroot_is_capable(current, current_cred(), cap);
74019 +#endif
74020 + return 1;
74021 +}
74022 +
74023 +int
74024 +gr_task_chroot_is_capable_nolog(const struct task_struct *task, const int cap)
74025 +{
74026 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
74027 + if (grsec_enable_chroot_caps && proc_is_chrooted(task)) {
74028 + kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
74029 + if (cap_raised(chroot_caps, cap)) {
74030 + return 0;
74031 + }
74032 + }
74033 +#endif
74034 + return 1;
74035 +}
74036 +
74037 +int
74038 +gr_chroot_is_capable_nolog(const int cap)
74039 +{
74040 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
74041 + return gr_task_chroot_is_capable_nolog(current, cap);
74042 +#endif
74043 + return 1;
74044 +}
74045 +
74046 +int
74047 +gr_handle_chroot_sysctl(const int op)
74048 +{
74049 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
74050 + if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
74051 + proc_is_chrooted(current))
74052 + return -EACCES;
74053 +#endif
74054 + return 0;
74055 +}
74056 +
74057 +void
74058 +gr_handle_chroot_chdir(const struct path *path)
74059 +{
74060 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
74061 + if (grsec_enable_chroot_chdir)
74062 + set_fs_pwd(current->fs, path);
74063 +#endif
74064 + return;
74065 +}
74066 +
74067 +int
74068 +gr_handle_chroot_chmod(const struct dentry *dentry,
74069 + const struct vfsmount *mnt, const int mode)
74070 +{
74071 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
74072 + /* allow chmod +s on directories, but not files */
74073 + if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
74074 + ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
74075 + proc_is_chrooted(current)) {
74076 + gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
74077 + return -EPERM;
74078 + }
74079 +#endif
74080 + return 0;
74081 +}
74082 diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c
74083 new file mode 100644
74084 index 0000000..4d6fce8
74085 --- /dev/null
74086 +++ b/grsecurity/grsec_disabled.c
74087 @@ -0,0 +1,433 @@
74088 +#include <linux/kernel.h>
74089 +#include <linux/module.h>
74090 +#include <linux/sched.h>
74091 +#include <linux/file.h>
74092 +#include <linux/fs.h>
74093 +#include <linux/kdev_t.h>
74094 +#include <linux/net.h>
74095 +#include <linux/in.h>
74096 +#include <linux/ip.h>
74097 +#include <linux/skbuff.h>
74098 +#include <linux/sysctl.h>
74099 +
74100 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
74101 +void
74102 +pax_set_initial_flags(struct linux_binprm *bprm)
74103 +{
74104 + return;
74105 +}
74106 +#endif
74107 +
74108 +#ifdef CONFIG_SYSCTL
74109 +__u32
74110 +gr_handle_sysctl(const struct ctl_table * table, const int op)
74111 +{
74112 + return 0;
74113 +}
74114 +#endif
74115 +
74116 +#ifdef CONFIG_TASKSTATS
74117 +int gr_is_taskstats_denied(int pid)
74118 +{
74119 + return 0;
74120 +}
74121 +#endif
74122 +
74123 +int
74124 +gr_acl_is_enabled(void)
74125 +{
74126 + return 0;
74127 +}
74128 +
74129 +void
74130 +gr_handle_proc_create(const struct dentry *dentry, const struct inode *inode)
74131 +{
74132 + return;
74133 +}
74134 +
74135 +int
74136 +gr_handle_rawio(const struct inode *inode)
74137 +{
74138 + return 0;
74139 +}
74140 +
74141 +void
74142 +gr_acl_handle_psacct(struct task_struct *task, const long code)
74143 +{
74144 + return;
74145 +}
74146 +
74147 +int
74148 +gr_handle_ptrace(struct task_struct *task, const long request)
74149 +{
74150 + return 0;
74151 +}
74152 +
74153 +int
74154 +gr_handle_proc_ptrace(struct task_struct *task)
74155 +{
74156 + return 0;
74157 +}
74158 +
74159 +int
74160 +gr_set_acls(const int type)
74161 +{
74162 + return 0;
74163 +}
74164 +
74165 +int
74166 +gr_check_hidden_task(const struct task_struct *tsk)
74167 +{
74168 + return 0;
74169 +}
74170 +
74171 +int
74172 +gr_check_protected_task(const struct task_struct *task)
74173 +{
74174 + return 0;
74175 +}
74176 +
74177 +int
74178 +gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
74179 +{
74180 + return 0;
74181 +}
74182 +
74183 +void
74184 +gr_copy_label(struct task_struct *tsk)
74185 +{
74186 + return;
74187 +}
74188 +
74189 +void
74190 +gr_set_pax_flags(struct task_struct *task)
74191 +{
74192 + return;
74193 +}
74194 +
74195 +int
74196 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
74197 + const int unsafe_share)
74198 +{
74199 + return 0;
74200 +}
74201 +
74202 +void
74203 +gr_handle_delete(const ino_t ino, const dev_t dev)
74204 +{
74205 + return;
74206 +}
74207 +
74208 +void
74209 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
74210 +{
74211 + return;
74212 +}
74213 +
74214 +void
74215 +gr_handle_crash(struct task_struct *task, const int sig)
74216 +{
74217 + return;
74218 +}
74219 +
74220 +int
74221 +gr_check_crash_exec(const struct file *filp)
74222 +{
74223 + return 0;
74224 +}
74225 +
74226 +int
74227 +gr_check_crash_uid(const kuid_t uid)
74228 +{
74229 + return 0;
74230 +}
74231 +
74232 +void
74233 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
74234 + struct dentry *old_dentry,
74235 + struct dentry *new_dentry,
74236 + struct vfsmount *mnt, const __u8 replace)
74237 +{
74238 + return;
74239 +}
74240 +
74241 +int
74242 +gr_search_socket(const int family, const int type, const int protocol)
74243 +{
74244 + return 1;
74245 +}
74246 +
74247 +int
74248 +gr_search_connectbind(const int mode, const struct socket *sock,
74249 + const struct sockaddr_in *addr)
74250 +{
74251 + return 0;
74252 +}
74253 +
74254 +void
74255 +gr_handle_alertkill(struct task_struct *task)
74256 +{
74257 + return;
74258 +}
74259 +
74260 +__u32
74261 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
74262 +{
74263 + return 1;
74264 +}
74265 +
74266 +__u32
74267 +gr_acl_handle_hidden_file(const struct dentry * dentry,
74268 + const struct vfsmount * mnt)
74269 +{
74270 + return 1;
74271 +}
74272 +
74273 +__u32
74274 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
74275 + int acc_mode)
74276 +{
74277 + return 1;
74278 +}
74279 +
74280 +__u32
74281 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
74282 +{
74283 + return 1;
74284 +}
74285 +
74286 +__u32
74287 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
74288 +{
74289 + return 1;
74290 +}
74291 +
74292 +int
74293 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
74294 + unsigned int *vm_flags)
74295 +{
74296 + return 1;
74297 +}
74298 +
74299 +__u32
74300 +gr_acl_handle_truncate(const struct dentry * dentry,
74301 + const struct vfsmount * mnt)
74302 +{
74303 + return 1;
74304 +}
74305 +
74306 +__u32
74307 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
74308 +{
74309 + return 1;
74310 +}
74311 +
74312 +__u32
74313 +gr_acl_handle_access(const struct dentry * dentry,
74314 + const struct vfsmount * mnt, const int fmode)
74315 +{
74316 + return 1;
74317 +}
74318 +
74319 +__u32
74320 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
74321 + umode_t *mode)
74322 +{
74323 + return 1;
74324 +}
74325 +
74326 +__u32
74327 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
74328 +{
74329 + return 1;
74330 +}
74331 +
74332 +__u32
74333 +gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
74334 +{
74335 + return 1;
74336 +}
74337 +
74338 +__u32
74339 +gr_acl_handle_removexattr(const struct dentry * dentry, const struct vfsmount * mnt)
74340 +{
74341 + return 1;
74342 +}
74343 +
74344 +void
74345 +grsecurity_init(void)
74346 +{
74347 + return;
74348 +}
74349 +
74350 +umode_t gr_acl_umask(void)
74351 +{
74352 + return 0;
74353 +}
74354 +
74355 +__u32
74356 +gr_acl_handle_mknod(const struct dentry * new_dentry,
74357 + const struct dentry * parent_dentry,
74358 + const struct vfsmount * parent_mnt,
74359 + const int mode)
74360 +{
74361 + return 1;
74362 +}
74363 +
74364 +__u32
74365 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
74366 + const struct dentry * parent_dentry,
74367 + const struct vfsmount * parent_mnt)
74368 +{
74369 + return 1;
74370 +}
74371 +
74372 +__u32
74373 +gr_acl_handle_symlink(const struct dentry * new_dentry,
74374 + const struct dentry * parent_dentry,
74375 + const struct vfsmount * parent_mnt, const struct filename *from)
74376 +{
74377 + return 1;
74378 +}
74379 +
74380 +__u32
74381 +gr_acl_handle_link(const struct dentry * new_dentry,
74382 + const struct dentry * parent_dentry,
74383 + const struct vfsmount * parent_mnt,
74384 + const struct dentry * old_dentry,
74385 + const struct vfsmount * old_mnt, const struct filename *to)
74386 +{
74387 + return 1;
74388 +}
74389 +
74390 +int
74391 +gr_acl_handle_rename(const struct dentry *new_dentry,
74392 + const struct dentry *parent_dentry,
74393 + const struct vfsmount *parent_mnt,
74394 + const struct dentry *old_dentry,
74395 + const struct inode *old_parent_inode,
74396 + const struct vfsmount *old_mnt, const struct filename *newname)
74397 +{
74398 + return 0;
74399 +}
74400 +
74401 +int
74402 +gr_acl_handle_filldir(const struct file *file, const char *name,
74403 + const int namelen, const ino_t ino)
74404 +{
74405 + return 1;
74406 +}
74407 +
74408 +int
74409 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
74410 + const time_t shm_createtime, const kuid_t cuid, const int shmid)
74411 +{
74412 + return 1;
74413 +}
74414 +
74415 +int
74416 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
74417 +{
74418 + return 0;
74419 +}
74420 +
74421 +int
74422 +gr_search_accept(const struct socket *sock)
74423 +{
74424 + return 0;
74425 +}
74426 +
74427 +int
74428 +gr_search_listen(const struct socket *sock)
74429 +{
74430 + return 0;
74431 +}
74432 +
74433 +int
74434 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
74435 +{
74436 + return 0;
74437 +}
74438 +
74439 +__u32
74440 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
74441 +{
74442 + return 1;
74443 +}
74444 +
74445 +__u32
74446 +gr_acl_handle_creat(const struct dentry * dentry,
74447 + const struct dentry * p_dentry,
74448 + const struct vfsmount * p_mnt, int open_flags, int acc_mode,
74449 + const int imode)
74450 +{
74451 + return 1;
74452 +}
74453 +
74454 +void
74455 +gr_acl_handle_exit(void)
74456 +{
74457 + return;
74458 +}
74459 +
74460 +int
74461 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
74462 +{
74463 + return 1;
74464 +}
74465 +
74466 +void
74467 +gr_set_role_label(const kuid_t uid, const kgid_t gid)
74468 +{
74469 + return;
74470 +}
74471 +
74472 +int
74473 +gr_acl_handle_procpidmem(const struct task_struct *task)
74474 +{
74475 + return 0;
74476 +}
74477 +
74478 +int
74479 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
74480 +{
74481 + return 0;
74482 +}
74483 +
74484 +int
74485 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
74486 +{
74487 + return 0;
74488 +}
74489 +
74490 +int
74491 +gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs)
74492 +{
74493 + return 0;
74494 +}
74495 +
74496 +int
74497 +gr_check_group_change(kgid_t real, kgid_t effective, kgid_t fs)
74498 +{
74499 + return 0;
74500 +}
74501 +
74502 +int gr_acl_enable_at_secure(void)
74503 +{
74504 + return 0;
74505 +}
74506 +
74507 +dev_t gr_get_dev_from_dentry(struct dentry *dentry)
74508 +{
74509 + return dentry->d_sb->s_dev;
74510 +}
74511 +
74512 +void gr_put_exec_file(struct task_struct *task)
74513 +{
74514 + return;
74515 +}
74516 +
74517 +#ifdef CONFIG_SECURITY
74518 +EXPORT_SYMBOL_GPL(gr_check_user_change);
74519 +EXPORT_SYMBOL_GPL(gr_check_group_change);
74520 +#endif
74521 diff --git a/grsecurity/grsec_exec.c b/grsecurity/grsec_exec.c
74522 new file mode 100644
74523 index 0000000..f35f454
74524 --- /dev/null
74525 +++ b/grsecurity/grsec_exec.c
74526 @@ -0,0 +1,187 @@
74527 +#include <linux/kernel.h>
74528 +#include <linux/sched.h>
74529 +#include <linux/file.h>
74530 +#include <linux/binfmts.h>
74531 +#include <linux/fs.h>
74532 +#include <linux/types.h>
74533 +#include <linux/grdefs.h>
74534 +#include <linux/grsecurity.h>
74535 +#include <linux/grinternal.h>
74536 +#include <linux/capability.h>
74537 +#include <linux/module.h>
74538 +#include <linux/compat.h>
74539 +
74540 +#include <asm/uaccess.h>
74541 +
74542 +#ifdef CONFIG_GRKERNSEC_EXECLOG
74543 +static char gr_exec_arg_buf[132];
74544 +static DEFINE_MUTEX(gr_exec_arg_mutex);
74545 +#endif
74546 +
74547 +struct user_arg_ptr {
74548 +#ifdef CONFIG_COMPAT
74549 + bool is_compat;
74550 +#endif
74551 + union {
74552 + const char __user *const __user *native;
74553 +#ifdef CONFIG_COMPAT
74554 + const compat_uptr_t __user *compat;
74555 +#endif
74556 + } ptr;
74557 +};
74558 +
74559 +extern const char __user *get_user_arg_ptr(struct user_arg_ptr argv, int nr);
74560 +
74561 +void
74562 +gr_handle_exec_args(struct linux_binprm *bprm, struct user_arg_ptr argv)
74563 +{
74564 +#ifdef CONFIG_GRKERNSEC_EXECLOG
74565 + char *grarg = gr_exec_arg_buf;
74566 + unsigned int i, x, execlen = 0;
74567 + char c;
74568 +
74569 + if (!((grsec_enable_execlog && grsec_enable_group &&
74570 + in_group_p(grsec_audit_gid))
74571 + || (grsec_enable_execlog && !grsec_enable_group)))
74572 + return;
74573 +
74574 + mutex_lock(&gr_exec_arg_mutex);
74575 + memset(grarg, 0, sizeof(gr_exec_arg_buf));
74576 +
74577 + for (i = 0; i < bprm->argc && execlen < 128; i++) {
74578 + const char __user *p;
74579 + unsigned int len;
74580 +
74581 + p = get_user_arg_ptr(argv, i);
74582 + if (IS_ERR(p))
74583 + goto log;
74584 +
74585 + len = strnlen_user(p, 128 - execlen);
74586 + if (len > 128 - execlen)
74587 + len = 128 - execlen;
74588 + else if (len > 0)
74589 + len--;
74590 + if (copy_from_user(grarg + execlen, p, len))
74591 + goto log;
74592 +
74593 + /* rewrite unprintable characters */
74594 + for (x = 0; x < len; x++) {
74595 + c = *(grarg + execlen + x);
74596 + if (c < 32 || c > 126)
74597 + *(grarg + execlen + x) = ' ';
74598 + }
74599 +
74600 + execlen += len;
74601 + *(grarg + execlen) = ' ';
74602 + *(grarg + execlen + 1) = '\0';
74603 + execlen++;
74604 + }
74605 +
74606 + log:
74607 + gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
74608 + bprm->file->f_path.mnt, grarg);
74609 + mutex_unlock(&gr_exec_arg_mutex);
74610 +#endif
74611 + return;
74612 +}
74613 +
74614 +#ifdef CONFIG_GRKERNSEC
74615 +extern int gr_acl_is_capable(const int cap);
74616 +extern int gr_acl_is_capable_nolog(const int cap);
74617 +extern int gr_task_acl_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
74618 +extern int gr_task_acl_is_capable_nolog(const struct task_struct *task, const int cap);
74619 +extern int gr_chroot_is_capable(const int cap);
74620 +extern int gr_chroot_is_capable_nolog(const int cap);
74621 +extern int gr_task_chroot_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
74622 +extern int gr_task_chroot_is_capable_nolog(const struct task_struct *task, const int cap);
74623 +#endif
74624 +
74625 +const char *captab_log[] = {
74626 + "CAP_CHOWN",
74627 + "CAP_DAC_OVERRIDE",
74628 + "CAP_DAC_READ_SEARCH",
74629 + "CAP_FOWNER",
74630 + "CAP_FSETID",
74631 + "CAP_KILL",
74632 + "CAP_SETGID",
74633 + "CAP_SETUID",
74634 + "CAP_SETPCAP",
74635 + "CAP_LINUX_IMMUTABLE",
74636 + "CAP_NET_BIND_SERVICE",
74637 + "CAP_NET_BROADCAST",
74638 + "CAP_NET_ADMIN",
74639 + "CAP_NET_RAW",
74640 + "CAP_IPC_LOCK",
74641 + "CAP_IPC_OWNER",
74642 + "CAP_SYS_MODULE",
74643 + "CAP_SYS_RAWIO",
74644 + "CAP_SYS_CHROOT",
74645 + "CAP_SYS_PTRACE",
74646 + "CAP_SYS_PACCT",
74647 + "CAP_SYS_ADMIN",
74648 + "CAP_SYS_BOOT",
74649 + "CAP_SYS_NICE",
74650 + "CAP_SYS_RESOURCE",
74651 + "CAP_SYS_TIME",
74652 + "CAP_SYS_TTY_CONFIG",
74653 + "CAP_MKNOD",
74654 + "CAP_LEASE",
74655 + "CAP_AUDIT_WRITE",
74656 + "CAP_AUDIT_CONTROL",
74657 + "CAP_SETFCAP",
74658 + "CAP_MAC_OVERRIDE",
74659 + "CAP_MAC_ADMIN",
74660 + "CAP_SYSLOG",
74661 + "CAP_WAKE_ALARM"
74662 +};
74663 +
74664 +int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]);
74665 +
74666 +int gr_is_capable(const int cap)
74667 +{
74668 +#ifdef CONFIG_GRKERNSEC
74669 + if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap))
74670 + return 1;
74671 + return 0;
74672 +#else
74673 + return 1;
74674 +#endif
74675 +}
74676 +
74677 +int gr_task_is_capable(const struct task_struct *task, const struct cred *cred, const int cap)
74678 +{
74679 +#ifdef CONFIG_GRKERNSEC
74680 + if (gr_task_acl_is_capable(task, cred, cap) && gr_task_chroot_is_capable(task, cred, cap))
74681 + return 1;
74682 + return 0;
74683 +#else
74684 + return 1;
74685 +#endif
74686 +}
74687 +
74688 +int gr_is_capable_nolog(const int cap)
74689 +{
74690 +#ifdef CONFIG_GRKERNSEC
74691 + if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap))
74692 + return 1;
74693 + return 0;
74694 +#else
74695 + return 1;
74696 +#endif
74697 +}
74698 +
74699 +int gr_task_is_capable_nolog(const struct task_struct *task, const int cap)
74700 +{
74701 +#ifdef CONFIG_GRKERNSEC
74702 + if (gr_task_acl_is_capable_nolog(task, cap) && gr_task_chroot_is_capable_nolog(task, cap))
74703 + return 1;
74704 + return 0;
74705 +#else
74706 + return 1;
74707 +#endif
74708 +}
74709 +
74710 +EXPORT_SYMBOL_GPL(gr_is_capable);
74711 +EXPORT_SYMBOL_GPL(gr_is_capable_nolog);
74712 +EXPORT_SYMBOL_GPL(gr_task_is_capable);
74713 +EXPORT_SYMBOL_GPL(gr_task_is_capable_nolog);
74714 diff --git a/grsecurity/grsec_fifo.c b/grsecurity/grsec_fifo.c
74715 new file mode 100644
74716 index 0000000..06cc6ea
74717 --- /dev/null
74718 +++ b/grsecurity/grsec_fifo.c
74719 @@ -0,0 +1,24 @@
74720 +#include <linux/kernel.h>
74721 +#include <linux/sched.h>
74722 +#include <linux/fs.h>
74723 +#include <linux/file.h>
74724 +#include <linux/grinternal.h>
74725 +
74726 +int
74727 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
74728 + const struct dentry *dir, const int flag, const int acc_mode)
74729 +{
74730 +#ifdef CONFIG_GRKERNSEC_FIFO
74731 + const struct cred *cred = current_cred();
74732 +
74733 + if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
74734 + !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
74735 + !uid_eq(dentry->d_inode->i_uid, dir->d_inode->i_uid) &&
74736 + !uid_eq(cred->fsuid, dentry->d_inode->i_uid)) {
74737 + if (!inode_permission(dentry->d_inode, acc_mode))
74738 + gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, GR_GLOBAL_UID(dentry->d_inode->i_uid), GR_GLOBAL_GID(dentry->d_inode->i_gid));
74739 + return -EACCES;
74740 + }
74741 +#endif
74742 + return 0;
74743 +}
74744 diff --git a/grsecurity/grsec_fork.c b/grsecurity/grsec_fork.c
74745 new file mode 100644
74746 index 0000000..8ca18bf
74747 --- /dev/null
74748 +++ b/grsecurity/grsec_fork.c
74749 @@ -0,0 +1,23 @@
74750 +#include <linux/kernel.h>
74751 +#include <linux/sched.h>
74752 +#include <linux/grsecurity.h>
74753 +#include <linux/grinternal.h>
74754 +#include <linux/errno.h>
74755 +
74756 +void
74757 +gr_log_forkfail(const int retval)
74758 +{
74759 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
74760 + if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
74761 + switch (retval) {
74762 + case -EAGAIN:
74763 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
74764 + break;
74765 + case -ENOMEM:
74766 + gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
74767 + break;
74768 + }
74769 + }
74770 +#endif
74771 + return;
74772 +}
74773 diff --git a/grsecurity/grsec_init.c b/grsecurity/grsec_init.c
74774 new file mode 100644
74775 index 0000000..ae6c028
74776 --- /dev/null
74777 +++ b/grsecurity/grsec_init.c
74778 @@ -0,0 +1,272 @@
74779 +#include <linux/kernel.h>
74780 +#include <linux/sched.h>
74781 +#include <linux/mm.h>
74782 +#include <linux/gracl.h>
74783 +#include <linux/slab.h>
74784 +#include <linux/vmalloc.h>
74785 +#include <linux/percpu.h>
74786 +#include <linux/module.h>
74787 +
74788 +int grsec_enable_ptrace_readexec;
74789 +int grsec_enable_setxid;
74790 +int grsec_enable_symlinkown;
74791 +kgid_t grsec_symlinkown_gid;
74792 +int grsec_enable_brute;
74793 +int grsec_enable_link;
74794 +int grsec_enable_dmesg;
74795 +int grsec_enable_harden_ptrace;
74796 +int grsec_enable_harden_ipc;
74797 +int grsec_enable_fifo;
74798 +int grsec_enable_execlog;
74799 +int grsec_enable_signal;
74800 +int grsec_enable_forkfail;
74801 +int grsec_enable_audit_ptrace;
74802 +int grsec_enable_time;
74803 +int grsec_enable_group;
74804 +kgid_t grsec_audit_gid;
74805 +int grsec_enable_chdir;
74806 +int grsec_enable_mount;
74807 +int grsec_enable_rofs;
74808 +int grsec_deny_new_usb;
74809 +int grsec_enable_chroot_findtask;
74810 +int grsec_enable_chroot_mount;
74811 +int grsec_enable_chroot_shmat;
74812 +int grsec_enable_chroot_fchdir;
74813 +int grsec_enable_chroot_double;
74814 +int grsec_enable_chroot_pivot;
74815 +int grsec_enable_chroot_chdir;
74816 +int grsec_enable_chroot_chmod;
74817 +int grsec_enable_chroot_mknod;
74818 +int grsec_enable_chroot_nice;
74819 +int grsec_enable_chroot_execlog;
74820 +int grsec_enable_chroot_caps;
74821 +int grsec_enable_chroot_sysctl;
74822 +int grsec_enable_chroot_unix;
74823 +int grsec_enable_tpe;
74824 +kgid_t grsec_tpe_gid;
74825 +int grsec_enable_blackhole;
74826 +#ifdef CONFIG_IPV6_MODULE
74827 +EXPORT_SYMBOL_GPL(grsec_enable_blackhole);
74828 +#endif
74829 +int grsec_lastack_retries;
74830 +int grsec_enable_tpe_all;
74831 +int grsec_enable_tpe_invert;
74832 +int grsec_enable_socket_all;
74833 +kgid_t grsec_socket_all_gid;
74834 +int grsec_enable_socket_client;
74835 +kgid_t grsec_socket_client_gid;
74836 +int grsec_enable_socket_server;
74837 +kgid_t grsec_socket_server_gid;
74838 +int grsec_resource_logging;
74839 +int grsec_disable_privio;
74840 +int grsec_enable_log_rwxmaps;
74841 +int grsec_lock;
74842 +
74843 +DEFINE_SPINLOCK(grsec_alert_lock);
74844 +unsigned long grsec_alert_wtime = 0;
74845 +unsigned long grsec_alert_fyet = 0;
74846 +
74847 +DEFINE_SPINLOCK(grsec_audit_lock);
74848 +
74849 +DEFINE_RWLOCK(grsec_exec_file_lock);
74850 +
74851 +char *gr_shared_page[4];
74852 +
74853 +char *gr_alert_log_fmt;
74854 +char *gr_audit_log_fmt;
74855 +char *gr_alert_log_buf;
74856 +char *gr_audit_log_buf;
74857 +
74858 +void __init
74859 +grsecurity_init(void)
74860 +{
74861 + int j;
74862 + /* create the per-cpu shared pages */
74863 +
74864 +#ifdef CONFIG_X86
74865 + memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
74866 +#endif
74867 +
74868 + for (j = 0; j < 4; j++) {
74869 + gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
74870 + if (gr_shared_page[j] == NULL) {
74871 + panic("Unable to allocate grsecurity shared page");
74872 + return;
74873 + }
74874 + }
74875 +
74876 + /* allocate log buffers */
74877 + gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
74878 + if (!gr_alert_log_fmt) {
74879 + panic("Unable to allocate grsecurity alert log format buffer");
74880 + return;
74881 + }
74882 + gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
74883 + if (!gr_audit_log_fmt) {
74884 + panic("Unable to allocate grsecurity audit log format buffer");
74885 + return;
74886 + }
74887 + gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
74888 + if (!gr_alert_log_buf) {
74889 + panic("Unable to allocate grsecurity alert log buffer");
74890 + return;
74891 + }
74892 + gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
74893 + if (!gr_audit_log_buf) {
74894 + panic("Unable to allocate grsecurity audit log buffer");
74895 + return;
74896 + }
74897 +
74898 +#ifdef CONFIG_GRKERNSEC_IO
74899 +#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
74900 + grsec_disable_privio = 1;
74901 +#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
74902 + grsec_disable_privio = 1;
74903 +#else
74904 + grsec_disable_privio = 0;
74905 +#endif
74906 +#endif
74907 +
74908 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
74909 + /* for backward compatibility, tpe_invert always defaults to on if
74910 + enabled in the kernel
74911 + */
74912 + grsec_enable_tpe_invert = 1;
74913 +#endif
74914 +
74915 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
74916 +#ifndef CONFIG_GRKERNSEC_SYSCTL
74917 + grsec_lock = 1;
74918 +#endif
74919 +
74920 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
74921 + grsec_enable_log_rwxmaps = 1;
74922 +#endif
74923 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
74924 + grsec_enable_group = 1;
74925 + grsec_audit_gid = KGIDT_INIT(CONFIG_GRKERNSEC_AUDIT_GID);
74926 +#endif
74927 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
74928 + grsec_enable_ptrace_readexec = 1;
74929 +#endif
74930 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
74931 + grsec_enable_chdir = 1;
74932 +#endif
74933 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
74934 + grsec_enable_harden_ptrace = 1;
74935 +#endif
74936 +#ifdef CONFIG_GRKERNSEC_HARDEN_IPC
74937 + grsec_enable_harden_ipc = 1;
74938 +#endif
74939 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
74940 + grsec_enable_mount = 1;
74941 +#endif
74942 +#ifdef CONFIG_GRKERNSEC_LINK
74943 + grsec_enable_link = 1;
74944 +#endif
74945 +#ifdef CONFIG_GRKERNSEC_BRUTE
74946 + grsec_enable_brute = 1;
74947 +#endif
74948 +#ifdef CONFIG_GRKERNSEC_DMESG
74949 + grsec_enable_dmesg = 1;
74950 +#endif
74951 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
74952 + grsec_enable_blackhole = 1;
74953 + grsec_lastack_retries = 4;
74954 +#endif
74955 +#ifdef CONFIG_GRKERNSEC_FIFO
74956 + grsec_enable_fifo = 1;
74957 +#endif
74958 +#ifdef CONFIG_GRKERNSEC_EXECLOG
74959 + grsec_enable_execlog = 1;
74960 +#endif
74961 +#ifdef CONFIG_GRKERNSEC_SETXID
74962 + grsec_enable_setxid = 1;
74963 +#endif
74964 +#ifdef CONFIG_GRKERNSEC_SIGNAL
74965 + grsec_enable_signal = 1;
74966 +#endif
74967 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
74968 + grsec_enable_forkfail = 1;
74969 +#endif
74970 +#ifdef CONFIG_GRKERNSEC_TIME
74971 + grsec_enable_time = 1;
74972 +#endif
74973 +#ifdef CONFIG_GRKERNSEC_RESLOG
74974 + grsec_resource_logging = 1;
74975 +#endif
74976 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
74977 + grsec_enable_chroot_findtask = 1;
74978 +#endif
74979 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
74980 + grsec_enable_chroot_unix = 1;
74981 +#endif
74982 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
74983 + grsec_enable_chroot_mount = 1;
74984 +#endif
74985 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
74986 + grsec_enable_chroot_fchdir = 1;
74987 +#endif
74988 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
74989 + grsec_enable_chroot_shmat = 1;
74990 +#endif
74991 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
74992 + grsec_enable_audit_ptrace = 1;
74993 +#endif
74994 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
74995 + grsec_enable_chroot_double = 1;
74996 +#endif
74997 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
74998 + grsec_enable_chroot_pivot = 1;
74999 +#endif
75000 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
75001 + grsec_enable_chroot_chdir = 1;
75002 +#endif
75003 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
75004 + grsec_enable_chroot_chmod = 1;
75005 +#endif
75006 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
75007 + grsec_enable_chroot_mknod = 1;
75008 +#endif
75009 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
75010 + grsec_enable_chroot_nice = 1;
75011 +#endif
75012 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
75013 + grsec_enable_chroot_execlog = 1;
75014 +#endif
75015 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
75016 + grsec_enable_chroot_caps = 1;
75017 +#endif
75018 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
75019 + grsec_enable_chroot_sysctl = 1;
75020 +#endif
75021 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
75022 + grsec_enable_symlinkown = 1;
75023 + grsec_symlinkown_gid = KGIDT_INIT(CONFIG_GRKERNSEC_SYMLINKOWN_GID);
75024 +#endif
75025 +#ifdef CONFIG_GRKERNSEC_TPE
75026 + grsec_enable_tpe = 1;
75027 + grsec_tpe_gid = KGIDT_INIT(CONFIG_GRKERNSEC_TPE_GID);
75028 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
75029 + grsec_enable_tpe_all = 1;
75030 +#endif
75031 +#endif
75032 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
75033 + grsec_enable_socket_all = 1;
75034 + grsec_socket_all_gid = KGIDT_INIT(CONFIG_GRKERNSEC_SOCKET_ALL_GID);
75035 +#endif
75036 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
75037 + grsec_enable_socket_client = 1;
75038 + grsec_socket_client_gid = KGIDT_INIT(CONFIG_GRKERNSEC_SOCKET_CLIENT_GID);
75039 +#endif
75040 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
75041 + grsec_enable_socket_server = 1;
75042 + grsec_socket_server_gid = KGIDT_INIT(CONFIG_GRKERNSEC_SOCKET_SERVER_GID);
75043 +#endif
75044 +#endif
75045 +#ifdef CONFIG_GRKERNSEC_DENYUSB_FORCE
75046 + grsec_deny_new_usb = 1;
75047 +#endif
75048 +
75049 + return;
75050 +}
75051 diff --git a/grsecurity/grsec_ipc.c b/grsecurity/grsec_ipc.c
75052 new file mode 100644
75053 index 0000000..1773300
75054 --- /dev/null
75055 +++ b/grsecurity/grsec_ipc.c
75056 @@ -0,0 +1,48 @@
75057 +#include <linux/kernel.h>
75058 +#include <linux/mm.h>
75059 +#include <linux/sched.h>
75060 +#include <linux/file.h>
75061 +#include <linux/ipc.h>
75062 +#include <linux/ipc_namespace.h>
75063 +#include <linux/grsecurity.h>
75064 +#include <linux/grinternal.h>
75065 +
75066 +int
75067 +gr_ipc_permitted(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, int requested_mode, int granted_mode)
75068 +{
75069 +#ifdef CONFIG_GRKERNSEC_HARDEN_IPC
75070 + int write;
75071 + int orig_granted_mode;
75072 + kuid_t euid;
75073 + kgid_t egid;
75074 +
75075 + if (!grsec_enable_harden_ipc)
75076 + return 1;
75077 +
75078 + euid = current_euid();
75079 + egid = current_egid();
75080 +
75081 + write = requested_mode & 00002;
75082 + orig_granted_mode = ipcp->mode;
75083 +
75084 + if (uid_eq(euid, ipcp->cuid) || uid_eq(euid, ipcp->uid))
75085 + orig_granted_mode >>= 6;
75086 + else {
75087 + /* if likely wrong permissions, lock to user */
75088 + if (orig_granted_mode & 0007)
75089 + orig_granted_mode = 0;
75090 + /* otherwise do a egid-only check */
75091 + else if (gid_eq(egid, ipcp->cgid) || gid_eq(egid, ipcp->gid))
75092 + orig_granted_mode >>= 3;
75093 + /* otherwise, no access */
75094 + else
75095 + orig_granted_mode = 0;
75096 + }
75097 + if (!(requested_mode & ~granted_mode & 0007) && (requested_mode & ~orig_granted_mode & 0007) &&
75098 + !ns_capable_nolog(ns->user_ns, CAP_IPC_OWNER)) {
75099 + gr_log_str_int(GR_DONT_AUDIT, GR_IPC_DENIED_MSG, write ? "write" : "read", GR_GLOBAL_UID(ipcp->cuid));
75100 + return 0;
75101 + }
75102 +#endif
75103 + return 1;
75104 +}
75105 diff --git a/grsecurity/grsec_link.c b/grsecurity/grsec_link.c
75106 new file mode 100644
75107 index 0000000..5e05e20
75108 --- /dev/null
75109 +++ b/grsecurity/grsec_link.c
75110 @@ -0,0 +1,58 @@
75111 +#include <linux/kernel.h>
75112 +#include <linux/sched.h>
75113 +#include <linux/fs.h>
75114 +#include <linux/file.h>
75115 +#include <linux/grinternal.h>
75116 +
75117 +int gr_handle_symlink_owner(const struct path *link, const struct inode *target)
75118 +{
75119 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
75120 + const struct inode *link_inode = link->dentry->d_inode;
75121 +
75122 + if (grsec_enable_symlinkown && in_group_p(grsec_symlinkown_gid) &&
75123 + /* ignore root-owned links, e.g. /proc/self */
75124 + gr_is_global_nonroot(link_inode->i_uid) && target &&
75125 + !uid_eq(link_inode->i_uid, target->i_uid)) {
75126 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINKOWNER_MSG, link->dentry, link->mnt, link_inode->i_uid, target->i_uid);
75127 + return 1;
75128 + }
75129 +#endif
75130 + return 0;
75131 +}
75132 +
75133 +int
75134 +gr_handle_follow_link(const struct inode *parent,
75135 + const struct inode *inode,
75136 + const struct dentry *dentry, const struct vfsmount *mnt)
75137 +{
75138 +#ifdef CONFIG_GRKERNSEC_LINK
75139 + const struct cred *cred = current_cred();
75140 +
75141 + if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
75142 + (parent->i_mode & S_ISVTX) && !uid_eq(parent->i_uid, inode->i_uid) &&
75143 + (parent->i_mode & S_IWOTH) && !uid_eq(cred->fsuid, inode->i_uid)) {
75144 + gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
75145 + return -EACCES;
75146 + }
75147 +#endif
75148 + return 0;
75149 +}
75150 +
75151 +int
75152 +gr_handle_hardlink(const struct dentry *dentry,
75153 + const struct vfsmount *mnt,
75154 + struct inode *inode, const int mode, const struct filename *to)
75155 +{
75156 +#ifdef CONFIG_GRKERNSEC_LINK
75157 + const struct cred *cred = current_cred();
75158 +
75159 + if (grsec_enable_link && !uid_eq(cred->fsuid, inode->i_uid) &&
75160 + (!S_ISREG(mode) || is_privileged_binary(dentry) ||
75161 + (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
75162 + !capable(CAP_FOWNER) && gr_is_global_nonroot(cred->uid)) {
75163 + gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to->name);
75164 + return -EPERM;
75165 + }
75166 +#endif
75167 + return 0;
75168 +}
75169 diff --git a/grsecurity/grsec_log.c b/grsecurity/grsec_log.c
75170 new file mode 100644
75171 index 0000000..dbe0a6b
75172 --- /dev/null
75173 +++ b/grsecurity/grsec_log.c
75174 @@ -0,0 +1,341 @@
75175 +#include <linux/kernel.h>
75176 +#include <linux/sched.h>
75177 +#include <linux/file.h>
75178 +#include <linux/tty.h>
75179 +#include <linux/fs.h>
75180 +#include <linux/mm.h>
75181 +#include <linux/grinternal.h>
75182 +
75183 +#ifdef CONFIG_TREE_PREEMPT_RCU
75184 +#define DISABLE_PREEMPT() preempt_disable()
75185 +#define ENABLE_PREEMPT() preempt_enable()
75186 +#else
75187 +#define DISABLE_PREEMPT()
75188 +#define ENABLE_PREEMPT()
75189 +#endif
75190 +
75191 +#define BEGIN_LOCKS(x) \
75192 + DISABLE_PREEMPT(); \
75193 + rcu_read_lock(); \
75194 + read_lock(&tasklist_lock); \
75195 + read_lock(&grsec_exec_file_lock); \
75196 + if (x != GR_DO_AUDIT) \
75197 + spin_lock(&grsec_alert_lock); \
75198 + else \
75199 + spin_lock(&grsec_audit_lock)
75200 +
75201 +#define END_LOCKS(x) \
75202 + if (x != GR_DO_AUDIT) \
75203 + spin_unlock(&grsec_alert_lock); \
75204 + else \
75205 + spin_unlock(&grsec_audit_lock); \
75206 + read_unlock(&grsec_exec_file_lock); \
75207 + read_unlock(&tasklist_lock); \
75208 + rcu_read_unlock(); \
75209 + ENABLE_PREEMPT(); \
75210 + if (x == GR_DONT_AUDIT) \
75211 + gr_handle_alertkill(current)
75212 +
75213 +enum {
75214 + FLOODING,
75215 + NO_FLOODING
75216 +};
75217 +
75218 +extern char *gr_alert_log_fmt;
75219 +extern char *gr_audit_log_fmt;
75220 +extern char *gr_alert_log_buf;
75221 +extern char *gr_audit_log_buf;
75222 +
75223 +static int gr_log_start(int audit)
75224 +{
75225 + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
75226 + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
75227 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
75228 +#if (CONFIG_GRKERNSEC_FLOODTIME > 0 && CONFIG_GRKERNSEC_FLOODBURST > 0)
75229 + unsigned long curr_secs = get_seconds();
75230 +
75231 + if (audit == GR_DO_AUDIT)
75232 + goto set_fmt;
75233 +
75234 + if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) {
75235 + grsec_alert_wtime = curr_secs;
75236 + grsec_alert_fyet = 0;
75237 + } else if (time_before_eq(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)
75238 + && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
75239 + grsec_alert_fyet++;
75240 + } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
75241 + grsec_alert_wtime = curr_secs;
75242 + grsec_alert_fyet++;
75243 + printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
75244 + return FLOODING;
75245 + }
75246 + else return FLOODING;
75247 +
75248 +set_fmt:
75249 +#endif
75250 + memset(buf, 0, PAGE_SIZE);
75251 + if (current->signal->curr_ip && gr_acl_is_enabled()) {
75252 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
75253 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
75254 + } else if (current->signal->curr_ip) {
75255 + sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
75256 + snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
75257 + } else if (gr_acl_is_enabled()) {
75258 + sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
75259 + snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
75260 + } else {
75261 + sprintf(fmt, "%s%s", loglevel, "grsec: ");
75262 + strcpy(buf, fmt);
75263 + }
75264 +
75265 + return NO_FLOODING;
75266 +}
75267 +
75268 +static void gr_log_middle(int audit, const char *msg, va_list ap)
75269 + __attribute__ ((format (printf, 2, 0)));
75270 +
75271 +static void gr_log_middle(int audit, const char *msg, va_list ap)
75272 +{
75273 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
75274 + unsigned int len = strlen(buf);
75275 +
75276 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
75277 +
75278 + return;
75279 +}
75280 +
75281 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
75282 + __attribute__ ((format (printf, 2, 3)));
75283 +
75284 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
75285 +{
75286 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
75287 + unsigned int len = strlen(buf);
75288 + va_list ap;
75289 +
75290 + va_start(ap, msg);
75291 + vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
75292 + va_end(ap);
75293 +
75294 + return;
75295 +}
75296 +
75297 +static void gr_log_end(int audit, int append_default)
75298 +{
75299 + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
75300 + if (append_default) {
75301 + struct task_struct *task = current;
75302 + struct task_struct *parent = task->real_parent;
75303 + const struct cred *cred = __task_cred(task);
75304 + const struct cred *pcred = __task_cred(parent);
75305 + unsigned int len = strlen(buf);
75306 +
75307 + snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, gr_task_fullpath(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath(task), parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid));
75308 + }
75309 +
75310 + printk("%s\n", buf);
75311 +
75312 + return;
75313 +}
75314 +
75315 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
75316 +{
75317 + int logtype;
75318 + char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
75319 + char *str1 = NULL, *str2 = NULL, *str3 = NULL;
75320 + void *voidptr = NULL;
75321 + int num1 = 0, num2 = 0;
75322 + unsigned long ulong1 = 0, ulong2 = 0;
75323 + struct dentry *dentry = NULL;
75324 + struct vfsmount *mnt = NULL;
75325 + struct file *file = NULL;
75326 + struct task_struct *task = NULL;
75327 + struct vm_area_struct *vma = NULL;
75328 + const struct cred *cred, *pcred;
75329 + va_list ap;
75330 +
75331 + BEGIN_LOCKS(audit);
75332 + logtype = gr_log_start(audit);
75333 + if (logtype == FLOODING) {
75334 + END_LOCKS(audit);
75335 + return;
75336 + }
75337 + va_start(ap, argtypes);
75338 + switch (argtypes) {
75339 + case GR_TTYSNIFF:
75340 + task = va_arg(ap, struct task_struct *);
75341 + gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task_pid_nr(task), gr_parent_task_fullpath0(task), task->real_parent->comm, task_pid_nr(task->real_parent));
75342 + break;
75343 + case GR_SYSCTL_HIDDEN:
75344 + str1 = va_arg(ap, char *);
75345 + gr_log_middle_varargs(audit, msg, result, str1);
75346 + break;
75347 + case GR_RBAC:
75348 + dentry = va_arg(ap, struct dentry *);
75349 + mnt = va_arg(ap, struct vfsmount *);
75350 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
75351 + break;
75352 + case GR_RBAC_STR:
75353 + dentry = va_arg(ap, struct dentry *);
75354 + mnt = va_arg(ap, struct vfsmount *);
75355 + str1 = va_arg(ap, char *);
75356 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
75357 + break;
75358 + case GR_STR_RBAC:
75359 + str1 = va_arg(ap, char *);
75360 + dentry = va_arg(ap, struct dentry *);
75361 + mnt = va_arg(ap, struct vfsmount *);
75362 + gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
75363 + break;
75364 + case GR_RBAC_MODE2:
75365 + dentry = va_arg(ap, struct dentry *);
75366 + mnt = va_arg(ap, struct vfsmount *);
75367 + str1 = va_arg(ap, char *);
75368 + str2 = va_arg(ap, char *);
75369 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
75370 + break;
75371 + case GR_RBAC_MODE3:
75372 + dentry = va_arg(ap, struct dentry *);
75373 + mnt = va_arg(ap, struct vfsmount *);
75374 + str1 = va_arg(ap, char *);
75375 + str2 = va_arg(ap, char *);
75376 + str3 = va_arg(ap, char *);
75377 + gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
75378 + break;
75379 + case GR_FILENAME:
75380 + dentry = va_arg(ap, struct dentry *);
75381 + mnt = va_arg(ap, struct vfsmount *);
75382 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
75383 + break;
75384 + case GR_STR_FILENAME:
75385 + str1 = va_arg(ap, char *);
75386 + dentry = va_arg(ap, struct dentry *);
75387 + mnt = va_arg(ap, struct vfsmount *);
75388 + gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
75389 + break;
75390 + case GR_FILENAME_STR:
75391 + dentry = va_arg(ap, struct dentry *);
75392 + mnt = va_arg(ap, struct vfsmount *);
75393 + str1 = va_arg(ap, char *);
75394 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
75395 + break;
75396 + case GR_FILENAME_TWO_INT:
75397 + dentry = va_arg(ap, struct dentry *);
75398 + mnt = va_arg(ap, struct vfsmount *);
75399 + num1 = va_arg(ap, int);
75400 + num2 = va_arg(ap, int);
75401 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
75402 + break;
75403 + case GR_FILENAME_TWO_INT_STR:
75404 + dentry = va_arg(ap, struct dentry *);
75405 + mnt = va_arg(ap, struct vfsmount *);
75406 + num1 = va_arg(ap, int);
75407 + num2 = va_arg(ap, int);
75408 + str1 = va_arg(ap, char *);
75409 + gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
75410 + break;
75411 + case GR_TEXTREL:
75412 + file = va_arg(ap, struct file *);
75413 + ulong1 = va_arg(ap, unsigned long);
75414 + ulong2 = va_arg(ap, unsigned long);
75415 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
75416 + break;
75417 + case GR_PTRACE:
75418 + task = va_arg(ap, struct task_struct *);
75419 + gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task_pid_nr(task));
75420 + break;
75421 + case GR_RESOURCE:
75422 + task = va_arg(ap, struct task_struct *);
75423 + cred = __task_cred(task);
75424 + pcred = __task_cred(task->real_parent);
75425 + ulong1 = va_arg(ap, unsigned long);
75426 + str1 = va_arg(ap, char *);
75427 + ulong2 = va_arg(ap, unsigned long);
75428 + gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath(task), task->real_parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid));
75429 + break;
75430 + case GR_CAP:
75431 + task = va_arg(ap, struct task_struct *);
75432 + cred = __task_cred(task);
75433 + pcred = __task_cred(task->real_parent);
75434 + str1 = va_arg(ap, char *);
75435 + gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath(task), task->real_parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid));
75436 + break;
75437 + case GR_SIG:
75438 + str1 = va_arg(ap, char *);
75439 + voidptr = va_arg(ap, void *);
75440 + gr_log_middle_varargs(audit, msg, str1, voidptr);
75441 + break;
75442 + case GR_SIG2:
75443 + task = va_arg(ap, struct task_struct *);
75444 + cred = __task_cred(task);
75445 + pcred = __task_cred(task->real_parent);
75446 + num1 = va_arg(ap, int);
75447 + gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath0(task), task->real_parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid));
75448 + break;
75449 + case GR_CRASH1:
75450 + task = va_arg(ap, struct task_struct *);
75451 + cred = __task_cred(task);
75452 + pcred = __task_cred(task->real_parent);
75453 + ulong1 = va_arg(ap, unsigned long);
75454 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath(task), task->real_parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid), GR_GLOBAL_UID(cred->uid), ulong1);
75455 + break;
75456 + case GR_CRASH2:
75457 + task = va_arg(ap, struct task_struct *);
75458 + cred = __task_cred(task);
75459 + pcred = __task_cred(task->real_parent);
75460 + ulong1 = va_arg(ap, unsigned long);
75461 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task_pid_nr(task), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), gr_parent_task_fullpath(task), task->real_parent->comm, task_pid_nr(task->real_parent), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid), ulong1);
75462 + break;
75463 + case GR_RWXMAP:
75464 + file = va_arg(ap, struct file *);
75465 + gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
75466 + break;
75467 + case GR_RWXMAPVMA:
75468 + vma = va_arg(ap, struct vm_area_struct *);
75469 + if (vma->vm_file)
75470 + str1 = gr_to_filename(vma->vm_file->f_path.dentry, vma->vm_file->f_path.mnt);
75471 + else if (vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP))
75472 + str1 = "<stack>";
75473 + else if (vma->vm_start <= current->mm->brk &&
75474 + vma->vm_end >= current->mm->start_brk)
75475 + str1 = "<heap>";
75476 + else
75477 + str1 = "<anonymous mapping>";
75478 + gr_log_middle_varargs(audit, msg, str1);
75479 + break;
75480 + case GR_PSACCT:
75481 + {
75482 + unsigned int wday, cday;
75483 + __u8 whr, chr;
75484 + __u8 wmin, cmin;
75485 + __u8 wsec, csec;
75486 + char cur_tty[64] = { 0 };
75487 + char parent_tty[64] = { 0 };
75488 +
75489 + task = va_arg(ap, struct task_struct *);
75490 + wday = va_arg(ap, unsigned int);
75491 + cday = va_arg(ap, unsigned int);
75492 + whr = va_arg(ap, int);
75493 + chr = va_arg(ap, int);
75494 + wmin = va_arg(ap, int);
75495 + cmin = va_arg(ap, int);
75496 + wsec = va_arg(ap, int);
75497 + csec = va_arg(ap, int);
75498 + ulong1 = va_arg(ap, unsigned long);
75499 + cred = __task_cred(task);
75500 + pcred = __task_cred(task->real_parent);
75501 +
75502 + gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task_pid_nr(task), &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), GR_GLOBAL_UID(cred->uid), GR_GLOBAL_UID(cred->euid), GR_GLOBAL_GID(cred->gid), GR_GLOBAL_GID(cred->egid), wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task_pid_nr(task->real_parent), &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), GR_GLOBAL_UID(pcred->uid), GR_GLOBAL_UID(pcred->euid), GR_GLOBAL_GID(pcred->gid), GR_GLOBAL_GID(pcred->egid));
75503 + }
75504 + break;
75505 + default:
75506 + gr_log_middle(audit, msg, ap);
75507 + }
75508 + va_end(ap);
75509 + // these don't need DEFAULTSECARGS printed on the end
75510 + if (argtypes == GR_CRASH1 || argtypes == GR_CRASH2)
75511 + gr_log_end(audit, 0);
75512 + else
75513 + gr_log_end(audit, 1);
75514 + END_LOCKS(audit);
75515 +}
75516 diff --git a/grsecurity/grsec_mem.c b/grsecurity/grsec_mem.c
75517 new file mode 100644
75518 index 0000000..0e39d8c
75519 --- /dev/null
75520 +++ b/grsecurity/grsec_mem.c
75521 @@ -0,0 +1,48 @@
75522 +#include <linux/kernel.h>
75523 +#include <linux/sched.h>
75524 +#include <linux/mm.h>
75525 +#include <linux/mman.h>
75526 +#include <linux/module.h>
75527 +#include <linux/grinternal.h>
75528 +
75529 +void gr_handle_msr_write(void)
75530 +{
75531 + gr_log_noargs(GR_DONT_AUDIT, GR_MSRWRITE_MSG);
75532 + return;
75533 +}
75534 +EXPORT_SYMBOL_GPL(gr_handle_msr_write);
75535 +
75536 +void
75537 +gr_handle_ioperm(void)
75538 +{
75539 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
75540 + return;
75541 +}
75542 +
75543 +void
75544 +gr_handle_iopl(void)
75545 +{
75546 + gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
75547 + return;
75548 +}
75549 +
75550 +void
75551 +gr_handle_mem_readwrite(u64 from, u64 to)
75552 +{
75553 + gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
75554 + return;
75555 +}
75556 +
75557 +void
75558 +gr_handle_vm86(void)
75559 +{
75560 + gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
75561 + return;
75562 +}
75563 +
75564 +void
75565 +gr_log_badprocpid(const char *entry)
75566 +{
75567 + gr_log_str(GR_DONT_AUDIT, GR_BADPROCPID_MSG, entry);
75568 + return;
75569 +}
75570 diff --git a/grsecurity/grsec_mount.c b/grsecurity/grsec_mount.c
75571 new file mode 100644
75572 index 0000000..cd9e124
75573 --- /dev/null
75574 +++ b/grsecurity/grsec_mount.c
75575 @@ -0,0 +1,65 @@
75576 +#include <linux/kernel.h>
75577 +#include <linux/sched.h>
75578 +#include <linux/mount.h>
75579 +#include <linux/major.h>
75580 +#include <linux/grsecurity.h>
75581 +#include <linux/grinternal.h>
75582 +
75583 +void
75584 +gr_log_remount(const char *devname, const int retval)
75585 +{
75586 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
75587 + if (grsec_enable_mount && (retval >= 0))
75588 + gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
75589 +#endif
75590 + return;
75591 +}
75592 +
75593 +void
75594 +gr_log_unmount(const char *devname, const int retval)
75595 +{
75596 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
75597 + if (grsec_enable_mount && (retval >= 0))
75598 + gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
75599 +#endif
75600 + return;
75601 +}
75602 +
75603 +void
75604 +gr_log_mount(const char *from, const char *to, const int retval)
75605 +{
75606 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
75607 + if (grsec_enable_mount && (retval >= 0))
75608 + gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
75609 +#endif
75610 + return;
75611 +}
75612 +
75613 +int
75614 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
75615 +{
75616 +#ifdef CONFIG_GRKERNSEC_ROFS
75617 + if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
75618 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
75619 + return -EPERM;
75620 + } else
75621 + return 0;
75622 +#endif
75623 + return 0;
75624 +}
75625 +
75626 +int
75627 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
75628 +{
75629 +#ifdef CONFIG_GRKERNSEC_ROFS
75630 + struct inode *inode = dentry->d_inode;
75631 +
75632 + if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
75633 + inode && (S_ISBLK(inode->i_mode) || (S_ISCHR(inode->i_mode) && imajor(inode) == RAW_MAJOR))) {
75634 + gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
75635 + return -EPERM;
75636 + } else
75637 + return 0;
75638 +#endif
75639 + return 0;
75640 +}
75641 diff --git a/grsecurity/grsec_pax.c b/grsecurity/grsec_pax.c
75642 new file mode 100644
75643 index 0000000..6ee9d50
75644 --- /dev/null
75645 +++ b/grsecurity/grsec_pax.c
75646 @@ -0,0 +1,45 @@
75647 +#include <linux/kernel.h>
75648 +#include <linux/sched.h>
75649 +#include <linux/mm.h>
75650 +#include <linux/file.h>
75651 +#include <linux/grinternal.h>
75652 +#include <linux/grsecurity.h>
75653 +
75654 +void
75655 +gr_log_textrel(struct vm_area_struct * vma)
75656 +{
75657 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
75658 + if (grsec_enable_log_rwxmaps)
75659 + gr_log_textrel_ulong_ulong(GR_DONT_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
75660 +#endif
75661 + return;
75662 +}
75663 +
75664 +void gr_log_ptgnustack(struct file *file)
75665 +{
75666 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
75667 + if (grsec_enable_log_rwxmaps)
75668 + gr_log_rwxmap(GR_DONT_AUDIT, GR_PTGNUSTACK_MSG, file);
75669 +#endif
75670 + return;
75671 +}
75672 +
75673 +void
75674 +gr_log_rwxmmap(struct file *file)
75675 +{
75676 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
75677 + if (grsec_enable_log_rwxmaps)
75678 + gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
75679 +#endif
75680 + return;
75681 +}
75682 +
75683 +void
75684 +gr_log_rwxmprotect(struct vm_area_struct *vma)
75685 +{
75686 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
75687 + if (grsec_enable_log_rwxmaps)
75688 + gr_log_rwxmap_vma(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, vma);
75689 +#endif
75690 + return;
75691 +}
75692 diff --git a/grsecurity/grsec_proc.c b/grsecurity/grsec_proc.c
75693 new file mode 100644
75694 index 0000000..2005a3a
75695 --- /dev/null
75696 +++ b/grsecurity/grsec_proc.c
75697 @@ -0,0 +1,20 @@
75698 +#include <linux/kernel.h>
75699 +#include <linux/sched.h>
75700 +#include <linux/grsecurity.h>
75701 +#include <linux/grinternal.h>
75702 +
75703 +int gr_proc_is_restricted(void)
75704 +{
75705 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
75706 + const struct cred *cred = current_cred();
75707 +#endif
75708 +
75709 +#ifdef CONFIG_GRKERNSEC_PROC_USER
75710 + if (!uid_eq(cred->fsuid, GLOBAL_ROOT_UID))
75711 + return -EACCES;
75712 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
75713 + if (!uid_eq(cred->fsuid, GLOBAL_ROOT_UID) && !in_group_p(grsec_proc_gid))
75714 + return -EACCES;
75715 +#endif
75716 + return 0;
75717 +}
75718 diff --git a/grsecurity/grsec_ptrace.c b/grsecurity/grsec_ptrace.c
75719 new file mode 100644
75720 index 0000000..f7f29aa
75721 --- /dev/null
75722 +++ b/grsecurity/grsec_ptrace.c
75723 @@ -0,0 +1,30 @@
75724 +#include <linux/kernel.h>
75725 +#include <linux/sched.h>
75726 +#include <linux/grinternal.h>
75727 +#include <linux/security.h>
75728 +
75729 +void
75730 +gr_audit_ptrace(struct task_struct *task)
75731 +{
75732 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
75733 + if (grsec_enable_audit_ptrace)
75734 + gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
75735 +#endif
75736 + return;
75737 +}
75738 +
75739 +int
75740 +gr_ptrace_readexec(struct file *file, int unsafe_flags)
75741 +{
75742 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
75743 + const struct dentry *dentry = file->f_path.dentry;
75744 + const struct vfsmount *mnt = file->f_path.mnt;
75745 +
75746 + if (grsec_enable_ptrace_readexec && (unsafe_flags & LSM_UNSAFE_PTRACE) &&
75747 + (inode_permission(dentry->d_inode, MAY_READ) || !gr_acl_handle_open(dentry, mnt, MAY_READ))) {
75748 + gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_READEXEC_MSG, dentry, mnt);
75749 + return -EACCES;
75750 + }
75751 +#endif
75752 + return 0;
75753 +}
75754 diff --git a/grsecurity/grsec_sig.c b/grsecurity/grsec_sig.c
75755 new file mode 100644
75756 index 0000000..3860c7e
75757 --- /dev/null
75758 +++ b/grsecurity/grsec_sig.c
75759 @@ -0,0 +1,236 @@
75760 +#include <linux/kernel.h>
75761 +#include <linux/sched.h>
75762 +#include <linux/fs.h>
75763 +#include <linux/delay.h>
75764 +#include <linux/grsecurity.h>
75765 +#include <linux/grinternal.h>
75766 +#include <linux/hardirq.h>
75767 +
75768 +char *signames[] = {
75769 + [SIGSEGV] = "Segmentation fault",
75770 + [SIGILL] = "Illegal instruction",
75771 + [SIGABRT] = "Abort",
75772 + [SIGBUS] = "Invalid alignment/Bus error"
75773 +};
75774 +
75775 +void
75776 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
75777 +{
75778 +#ifdef CONFIG_GRKERNSEC_SIGNAL
75779 + if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
75780 + (sig == SIGABRT) || (sig == SIGBUS))) {
75781 + if (task_pid_nr(t) == task_pid_nr(current)) {
75782 + gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
75783 + } else {
75784 + gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
75785 + }
75786 + }
75787 +#endif
75788 + return;
75789 +}
75790 +
75791 +int
75792 +gr_handle_signal(const struct task_struct *p, const int sig)
75793 +{
75794 +#ifdef CONFIG_GRKERNSEC
75795 + /* ignore the 0 signal for protected task checks */
75796 + if (task_pid_nr(current) > 1 && sig && gr_check_protected_task(p)) {
75797 + gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
75798 + return -EPERM;
75799 + } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
75800 + return -EPERM;
75801 + }
75802 +#endif
75803 + return 0;
75804 +}
75805 +
75806 +#ifdef CONFIG_GRKERNSEC
75807 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
75808 +
75809 +int gr_fake_force_sig(int sig, struct task_struct *t)
75810 +{
75811 + unsigned long int flags;
75812 + int ret, blocked, ignored;
75813 + struct k_sigaction *action;
75814 +
75815 + spin_lock_irqsave(&t->sighand->siglock, flags);
75816 + action = &t->sighand->action[sig-1];
75817 + ignored = action->sa.sa_handler == SIG_IGN;
75818 + blocked = sigismember(&t->blocked, sig);
75819 + if (blocked || ignored) {
75820 + action->sa.sa_handler = SIG_DFL;
75821 + if (blocked) {
75822 + sigdelset(&t->blocked, sig);
75823 + recalc_sigpending_and_wake(t);
75824 + }
75825 + }
75826 + if (action->sa.sa_handler == SIG_DFL)
75827 + t->signal->flags &= ~SIGNAL_UNKILLABLE;
75828 + ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
75829 +
75830 + spin_unlock_irqrestore(&t->sighand->siglock, flags);
75831 +
75832 + return ret;
75833 +}
75834 +#endif
75835 +
75836 +#define GR_USER_BAN_TIME (15 * 60)
75837 +#define GR_DAEMON_BRUTE_TIME (30 * 60)
75838 +
75839 +void gr_handle_brute_attach(int dumpable)
75840 +{
75841 +#ifdef CONFIG_GRKERNSEC_BRUTE
75842 + struct task_struct *p = current;
75843 + kuid_t uid = GLOBAL_ROOT_UID;
75844 + int daemon = 0;
75845 +
75846 + if (!grsec_enable_brute)
75847 + return;
75848 +
75849 + rcu_read_lock();
75850 + read_lock(&tasklist_lock);
75851 + read_lock(&grsec_exec_file_lock);
75852 + if (p->real_parent && gr_is_same_file(p->real_parent->exec_file, p->exec_file)) {
75853 + p->real_parent->brute_expires = get_seconds() + GR_DAEMON_BRUTE_TIME;
75854 + p->real_parent->brute = 1;
75855 + daemon = 1;
75856 + } else {
75857 + const struct cred *cred = __task_cred(p), *cred2;
75858 + struct task_struct *tsk, *tsk2;
75859 +
75860 + if (dumpable != SUID_DUMP_USER && gr_is_global_nonroot(cred->uid)) {
75861 + struct user_struct *user;
75862 +
75863 + uid = cred->uid;
75864 +
75865 + /* this is put upon execution past expiration */
75866 + user = find_user(uid);
75867 + if (user == NULL)
75868 + goto unlock;
75869 + user->suid_banned = 1;
75870 + user->suid_ban_expires = get_seconds() + GR_USER_BAN_TIME;
75871 + if (user->suid_ban_expires == ~0UL)
75872 + user->suid_ban_expires--;
75873 +
75874 + /* only kill other threads of the same binary, from the same user */
75875 + do_each_thread(tsk2, tsk) {
75876 + cred2 = __task_cred(tsk);
75877 + if (tsk != p && uid_eq(cred2->uid, uid) && gr_is_same_file(tsk->exec_file, p->exec_file))
75878 + gr_fake_force_sig(SIGKILL, tsk);
75879 + } while_each_thread(tsk2, tsk);
75880 + }
75881 + }
75882 +unlock:
75883 + read_unlock(&grsec_exec_file_lock);
75884 + read_unlock(&tasklist_lock);
75885 + rcu_read_unlock();
75886 +
75887 + if (gr_is_global_nonroot(uid))
75888 + gr_log_fs_int2(GR_DONT_AUDIT, GR_BRUTE_SUID_MSG, p->exec_file->f_path.dentry, p->exec_file->f_path.mnt, GR_GLOBAL_UID(uid), GR_USER_BAN_TIME / 60);
75889 + else if (daemon)
75890 + gr_log_noargs(GR_DONT_AUDIT, GR_BRUTE_DAEMON_MSG);
75891 +
75892 +#endif
75893 + return;
75894 +}
75895 +
75896 +void gr_handle_brute_check(void)
75897 +{
75898 +#ifdef CONFIG_GRKERNSEC_BRUTE
75899 + struct task_struct *p = current;
75900 +
75901 + if (unlikely(p->brute)) {
75902 + if (!grsec_enable_brute)
75903 + p->brute = 0;
75904 + else if (time_before(get_seconds(), p->brute_expires))
75905 + msleep(30 * 1000);
75906 + }
75907 +#endif
75908 + return;
75909 +}
75910 +
75911 +void gr_handle_kernel_exploit(void)
75912 +{
75913 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
75914 + const struct cred *cred;
75915 + struct task_struct *tsk, *tsk2;
75916 + struct user_struct *user;
75917 + kuid_t uid;
75918 +
75919 + if (in_irq() || in_serving_softirq() || in_nmi())
75920 + panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
75921 +
75922 + uid = current_uid();
75923 +
75924 + if (gr_is_global_root(uid))
75925 + panic("grsec: halting the system due to suspicious kernel crash caused by root");
75926 + else {
75927 + /* kill all the processes of this user, hold a reference
75928 + to their creds struct, and prevent them from creating
75929 + another process until system reset
75930 + */
75931 + printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n",
75932 + GR_GLOBAL_UID(uid));
75933 + /* we intentionally leak this ref */
75934 + user = get_uid(current->cred->user);
75935 + if (user)
75936 + user->kernel_banned = 1;
75937 +
75938 + /* kill all processes of this user */
75939 + read_lock(&tasklist_lock);
75940 + do_each_thread(tsk2, tsk) {
75941 + cred = __task_cred(tsk);
75942 + if (uid_eq(cred->uid, uid))
75943 + gr_fake_force_sig(SIGKILL, tsk);
75944 + } while_each_thread(tsk2, tsk);
75945 + read_unlock(&tasklist_lock);
75946 + }
75947 +#endif
75948 +}
75949 +
75950 +#ifdef CONFIG_GRKERNSEC_BRUTE
75951 +static bool suid_ban_expired(struct user_struct *user)
75952 +{
75953 + if (user->suid_ban_expires != ~0UL && time_after_eq(get_seconds(), user->suid_ban_expires)) {
75954 + user->suid_banned = 0;
75955 + user->suid_ban_expires = 0;
75956 + free_uid(user);
75957 + return true;
75958 + }
75959 +
75960 + return false;
75961 +}
75962 +#endif
75963 +
75964 +int gr_process_kernel_exec_ban(void)
75965 +{
75966 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
75967 + if (unlikely(current->cred->user->kernel_banned))
75968 + return -EPERM;
75969 +#endif
75970 + return 0;
75971 +}
75972 +
75973 +int gr_process_kernel_setuid_ban(struct user_struct *user)
75974 +{
75975 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
75976 + if (unlikely(user->kernel_banned))
75977 + gr_fake_force_sig(SIGKILL, current);
75978 +#endif
75979 + return 0;
75980 +}
75981 +
75982 +int gr_process_suid_exec_ban(const struct linux_binprm *bprm)
75983 +{
75984 +#ifdef CONFIG_GRKERNSEC_BRUTE
75985 + struct user_struct *user = current->cred->user;
75986 + if (unlikely(user->suid_banned)) {
75987 + if (suid_ban_expired(user))
75988 + return 0;
75989 + /* disallow execution of suid binaries only */
75990 + else if (!uid_eq(bprm->cred->euid, current->cred->uid))
75991 + return -EPERM;
75992 + }
75993 +#endif
75994 + return 0;
75995 +}
75996 diff --git a/grsecurity/grsec_sock.c b/grsecurity/grsec_sock.c
75997 new file mode 100644
75998 index 0000000..c0aef3a
75999 --- /dev/null
76000 +++ b/grsecurity/grsec_sock.c
76001 @@ -0,0 +1,244 @@
76002 +#include <linux/kernel.h>
76003 +#include <linux/module.h>
76004 +#include <linux/sched.h>
76005 +#include <linux/file.h>
76006 +#include <linux/net.h>
76007 +#include <linux/in.h>
76008 +#include <linux/ip.h>
76009 +#include <net/sock.h>
76010 +#include <net/inet_sock.h>
76011 +#include <linux/grsecurity.h>
76012 +#include <linux/grinternal.h>
76013 +#include <linux/gracl.h>
76014 +
76015 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
76016 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
76017 +
76018 +EXPORT_SYMBOL_GPL(gr_search_udp_recvmsg);
76019 +EXPORT_SYMBOL_GPL(gr_search_udp_sendmsg);
76020 +
76021 +#ifdef CONFIG_UNIX_MODULE
76022 +EXPORT_SYMBOL_GPL(gr_acl_handle_unix);
76023 +EXPORT_SYMBOL_GPL(gr_acl_handle_mknod);
76024 +EXPORT_SYMBOL_GPL(gr_handle_chroot_unix);
76025 +EXPORT_SYMBOL_GPL(gr_handle_create);
76026 +#endif
76027 +
76028 +#ifdef CONFIG_GRKERNSEC
76029 +#define gr_conn_table_size 32749
76030 +struct conn_table_entry {
76031 + struct conn_table_entry *next;
76032 + struct signal_struct *sig;
76033 +};
76034 +
76035 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
76036 +DEFINE_SPINLOCK(gr_conn_table_lock);
76037 +
76038 +extern const char * gr_socktype_to_name(unsigned char type);
76039 +extern const char * gr_proto_to_name(unsigned char proto);
76040 +extern const char * gr_sockfamily_to_name(unsigned char family);
76041 +
76042 +static __inline__ int
76043 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
76044 +{
76045 + return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
76046 +}
76047 +
76048 +static __inline__ int
76049 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
76050 + __u16 sport, __u16 dport)
76051 +{
76052 + if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
76053 + sig->gr_sport == sport && sig->gr_dport == dport))
76054 + return 1;
76055 + else
76056 + return 0;
76057 +}
76058 +
76059 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
76060 +{
76061 + struct conn_table_entry **match;
76062 + unsigned int index;
76063 +
76064 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
76065 + sig->gr_sport, sig->gr_dport,
76066 + gr_conn_table_size);
76067 +
76068 + newent->sig = sig;
76069 +
76070 + match = &gr_conn_table[index];
76071 + newent->next = *match;
76072 + *match = newent;
76073 +
76074 + return;
76075 +}
76076 +
76077 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
76078 +{
76079 + struct conn_table_entry *match, *last = NULL;
76080 + unsigned int index;
76081 +
76082 + index = conn_hash(sig->gr_saddr, sig->gr_daddr,
76083 + sig->gr_sport, sig->gr_dport,
76084 + gr_conn_table_size);
76085 +
76086 + match = gr_conn_table[index];
76087 + while (match && !conn_match(match->sig,
76088 + sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
76089 + sig->gr_dport)) {
76090 + last = match;
76091 + match = match->next;
76092 + }
76093 +
76094 + if (match) {
76095 + if (last)
76096 + last->next = match->next;
76097 + else
76098 + gr_conn_table[index] = NULL;
76099 + kfree(match);
76100 + }
76101 +
76102 + return;
76103 +}
76104 +
76105 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
76106 + __u16 sport, __u16 dport)
76107 +{
76108 + struct conn_table_entry *match;
76109 + unsigned int index;
76110 +
76111 + index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
76112 +
76113 + match = gr_conn_table[index];
76114 + while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
76115 + match = match->next;
76116 +
76117 + if (match)
76118 + return match->sig;
76119 + else
76120 + return NULL;
76121 +}
76122 +
76123 +#endif
76124 +
76125 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
76126 +{
76127 +#ifdef CONFIG_GRKERNSEC
76128 + struct signal_struct *sig = task->signal;
76129 + struct conn_table_entry *newent;
76130 +
76131 + newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
76132 + if (newent == NULL)
76133 + return;
76134 + /* no bh lock needed since we are called with bh disabled */
76135 + spin_lock(&gr_conn_table_lock);
76136 + gr_del_task_from_ip_table_nolock(sig);
76137 + sig->gr_saddr = inet->inet_rcv_saddr;
76138 + sig->gr_daddr = inet->inet_daddr;
76139 + sig->gr_sport = inet->inet_sport;
76140 + sig->gr_dport = inet->inet_dport;
76141 + gr_add_to_task_ip_table_nolock(sig, newent);
76142 + spin_unlock(&gr_conn_table_lock);
76143 +#endif
76144 + return;
76145 +}
76146 +
76147 +void gr_del_task_from_ip_table(struct task_struct *task)
76148 +{
76149 +#ifdef CONFIG_GRKERNSEC
76150 + spin_lock_bh(&gr_conn_table_lock);
76151 + gr_del_task_from_ip_table_nolock(task->signal);
76152 + spin_unlock_bh(&gr_conn_table_lock);
76153 +#endif
76154 + return;
76155 +}
76156 +
76157 +void
76158 +gr_attach_curr_ip(const struct sock *sk)
76159 +{
76160 +#ifdef CONFIG_GRKERNSEC
76161 + struct signal_struct *p, *set;
76162 + const struct inet_sock *inet = inet_sk(sk);
76163 +
76164 + if (unlikely(sk->sk_protocol != IPPROTO_TCP))
76165 + return;
76166 +
76167 + set = current->signal;
76168 +
76169 + spin_lock_bh(&gr_conn_table_lock);
76170 + p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
76171 + inet->inet_dport, inet->inet_sport);
76172 + if (unlikely(p != NULL)) {
76173 + set->curr_ip = p->curr_ip;
76174 + set->used_accept = 1;
76175 + gr_del_task_from_ip_table_nolock(p);
76176 + spin_unlock_bh(&gr_conn_table_lock);
76177 + return;
76178 + }
76179 + spin_unlock_bh(&gr_conn_table_lock);
76180 +
76181 + set->curr_ip = inet->inet_daddr;
76182 + set->used_accept = 1;
76183 +#endif
76184 + return;
76185 +}
76186 +
76187 +int
76188 +gr_handle_sock_all(const int family, const int type, const int protocol)
76189 +{
76190 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
76191 + if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
76192 + (family != AF_UNIX)) {
76193 + if (family == AF_INET)
76194 + gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
76195 + else
76196 + gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
76197 + return -EACCES;
76198 + }
76199 +#endif
76200 + return 0;
76201 +}
76202 +
76203 +int
76204 +gr_handle_sock_server(const struct sockaddr *sck)
76205 +{
76206 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
76207 + if (grsec_enable_socket_server &&
76208 + in_group_p(grsec_socket_server_gid) &&
76209 + sck && (sck->sa_family != AF_UNIX) &&
76210 + (sck->sa_family != AF_LOCAL)) {
76211 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
76212 + return -EACCES;
76213 + }
76214 +#endif
76215 + return 0;
76216 +}
76217 +
76218 +int
76219 +gr_handle_sock_server_other(const struct sock *sck)
76220 +{
76221 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
76222 + if (grsec_enable_socket_server &&
76223 + in_group_p(grsec_socket_server_gid) &&
76224 + sck && (sck->sk_family != AF_UNIX) &&
76225 + (sck->sk_family != AF_LOCAL)) {
76226 + gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
76227 + return -EACCES;
76228 + }
76229 +#endif
76230 + return 0;
76231 +}
76232 +
76233 +int
76234 +gr_handle_sock_client(const struct sockaddr *sck)
76235 +{
76236 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
76237 + if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
76238 + sck && (sck->sa_family != AF_UNIX) &&
76239 + (sck->sa_family != AF_LOCAL)) {
76240 + gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
76241 + return -EACCES;
76242 + }
76243 +#endif
76244 + return 0;
76245 +}
76246 diff --git a/grsecurity/grsec_sysctl.c b/grsecurity/grsec_sysctl.c
76247 new file mode 100644
76248 index 0000000..8159888
76249 --- /dev/null
76250 +++ b/grsecurity/grsec_sysctl.c
76251 @@ -0,0 +1,479 @@
76252 +#include <linux/kernel.h>
76253 +#include <linux/sched.h>
76254 +#include <linux/sysctl.h>
76255 +#include <linux/grsecurity.h>
76256 +#include <linux/grinternal.h>
76257 +
76258 +int
76259 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
76260 +{
76261 +#ifdef CONFIG_GRKERNSEC_SYSCTL
76262 + if (dirname == NULL || name == NULL)
76263 + return 0;
76264 + if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
76265 + gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
76266 + return -EACCES;
76267 + }
76268 +#endif
76269 + return 0;
76270 +}
76271 +
76272 +#if defined(CONFIG_GRKERNSEC_ROFS) || defined(CONFIG_GRKERNSEC_DENYUSB)
76273 +static int __maybe_unused __read_only one = 1;
76274 +#endif
76275 +
76276 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS) || \
76277 + defined(CONFIG_GRKERNSEC_DENYUSB)
76278 +struct ctl_table grsecurity_table[] = {
76279 +#ifdef CONFIG_GRKERNSEC_SYSCTL
76280 +#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
76281 +#ifdef CONFIG_GRKERNSEC_IO
76282 + {
76283 + .procname = "disable_priv_io",
76284 + .data = &grsec_disable_privio,
76285 + .maxlen = sizeof(int),
76286 + .mode = 0600,
76287 + .proc_handler = &proc_dointvec,
76288 + },
76289 +#endif
76290 +#endif
76291 +#ifdef CONFIG_GRKERNSEC_LINK
76292 + {
76293 + .procname = "linking_restrictions",
76294 + .data = &grsec_enable_link,
76295 + .maxlen = sizeof(int),
76296 + .mode = 0600,
76297 + .proc_handler = &proc_dointvec,
76298 + },
76299 +#endif
76300 +#ifdef CONFIG_GRKERNSEC_SYMLINKOWN
76301 + {
76302 + .procname = "enforce_symlinksifowner",
76303 + .data = &grsec_enable_symlinkown,
76304 + .maxlen = sizeof(int),
76305 + .mode = 0600,
76306 + .proc_handler = &proc_dointvec,
76307 + },
76308 + {
76309 + .procname = "symlinkown_gid",
76310 + .data = &grsec_symlinkown_gid,
76311 + .maxlen = sizeof(int),
76312 + .mode = 0600,
76313 + .proc_handler = &proc_dointvec,
76314 + },
76315 +#endif
76316 +#ifdef CONFIG_GRKERNSEC_BRUTE
76317 + {
76318 + .procname = "deter_bruteforce",
76319 + .data = &grsec_enable_brute,
76320 + .maxlen = sizeof(int),
76321 + .mode = 0600,
76322 + .proc_handler = &proc_dointvec,
76323 + },
76324 +#endif
76325 +#ifdef CONFIG_GRKERNSEC_FIFO
76326 + {
76327 + .procname = "fifo_restrictions",
76328 + .data = &grsec_enable_fifo,
76329 + .maxlen = sizeof(int),
76330 + .mode = 0600,
76331 + .proc_handler = &proc_dointvec,
76332 + },
76333 +#endif
76334 +#ifdef CONFIG_GRKERNSEC_PTRACE_READEXEC
76335 + {
76336 + .procname = "ptrace_readexec",
76337 + .data = &grsec_enable_ptrace_readexec,
76338 + .maxlen = sizeof(int),
76339 + .mode = 0600,
76340 + .proc_handler = &proc_dointvec,
76341 + },
76342 +#endif
76343 +#ifdef CONFIG_GRKERNSEC_SETXID
76344 + {
76345 + .procname = "consistent_setxid",
76346 + .data = &grsec_enable_setxid,
76347 + .maxlen = sizeof(int),
76348 + .mode = 0600,
76349 + .proc_handler = &proc_dointvec,
76350 + },
76351 +#endif
76352 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
76353 + {
76354 + .procname = "ip_blackhole",
76355 + .data = &grsec_enable_blackhole,
76356 + .maxlen = sizeof(int),
76357 + .mode = 0600,
76358 + .proc_handler = &proc_dointvec,
76359 + },
76360 + {
76361 + .procname = "lastack_retries",
76362 + .data = &grsec_lastack_retries,
76363 + .maxlen = sizeof(int),
76364 + .mode = 0600,
76365 + .proc_handler = &proc_dointvec,
76366 + },
76367 +#endif
76368 +#ifdef CONFIG_GRKERNSEC_EXECLOG
76369 + {
76370 + .procname = "exec_logging",
76371 + .data = &grsec_enable_execlog,
76372 + .maxlen = sizeof(int),
76373 + .mode = 0600,
76374 + .proc_handler = &proc_dointvec,
76375 + },
76376 +#endif
76377 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
76378 + {
76379 + .procname = "rwxmap_logging",
76380 + .data = &grsec_enable_log_rwxmaps,
76381 + .maxlen = sizeof(int),
76382 + .mode = 0600,
76383 + .proc_handler = &proc_dointvec,
76384 + },
76385 +#endif
76386 +#ifdef CONFIG_GRKERNSEC_SIGNAL
76387 + {
76388 + .procname = "signal_logging",
76389 + .data = &grsec_enable_signal,
76390 + .maxlen = sizeof(int),
76391 + .mode = 0600,
76392 + .proc_handler = &proc_dointvec,
76393 + },
76394 +#endif
76395 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
76396 + {
76397 + .procname = "forkfail_logging",
76398 + .data = &grsec_enable_forkfail,
76399 + .maxlen = sizeof(int),
76400 + .mode = 0600,
76401 + .proc_handler = &proc_dointvec,
76402 + },
76403 +#endif
76404 +#ifdef CONFIG_GRKERNSEC_TIME
76405 + {
76406 + .procname = "timechange_logging",
76407 + .data = &grsec_enable_time,
76408 + .maxlen = sizeof(int),
76409 + .mode = 0600,
76410 + .proc_handler = &proc_dointvec,
76411 + },
76412 +#endif
76413 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
76414 + {
76415 + .procname = "chroot_deny_shmat",
76416 + .data = &grsec_enable_chroot_shmat,
76417 + .maxlen = sizeof(int),
76418 + .mode = 0600,
76419 + .proc_handler = &proc_dointvec,
76420 + },
76421 +#endif
76422 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
76423 + {
76424 + .procname = "chroot_deny_unix",
76425 + .data = &grsec_enable_chroot_unix,
76426 + .maxlen = sizeof(int),
76427 + .mode = 0600,
76428 + .proc_handler = &proc_dointvec,
76429 + },
76430 +#endif
76431 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
76432 + {
76433 + .procname = "chroot_deny_mount",
76434 + .data = &grsec_enable_chroot_mount,
76435 + .maxlen = sizeof(int),
76436 + .mode = 0600,
76437 + .proc_handler = &proc_dointvec,
76438 + },
76439 +#endif
76440 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
76441 + {
76442 + .procname = "chroot_deny_fchdir",
76443 + .data = &grsec_enable_chroot_fchdir,
76444 + .maxlen = sizeof(int),
76445 + .mode = 0600,
76446 + .proc_handler = &proc_dointvec,
76447 + },
76448 +#endif
76449 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
76450 + {
76451 + .procname = "chroot_deny_chroot",
76452 + .data = &grsec_enable_chroot_double,
76453 + .maxlen = sizeof(int),
76454 + .mode = 0600,
76455 + .proc_handler = &proc_dointvec,
76456 + },
76457 +#endif
76458 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
76459 + {
76460 + .procname = "chroot_deny_pivot",
76461 + .data = &grsec_enable_chroot_pivot,
76462 + .maxlen = sizeof(int),
76463 + .mode = 0600,
76464 + .proc_handler = &proc_dointvec,
76465 + },
76466 +#endif
76467 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
76468 + {
76469 + .procname = "chroot_enforce_chdir",
76470 + .data = &grsec_enable_chroot_chdir,
76471 + .maxlen = sizeof(int),
76472 + .mode = 0600,
76473 + .proc_handler = &proc_dointvec,
76474 + },
76475 +#endif
76476 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
76477 + {
76478 + .procname = "chroot_deny_chmod",
76479 + .data = &grsec_enable_chroot_chmod,
76480 + .maxlen = sizeof(int),
76481 + .mode = 0600,
76482 + .proc_handler = &proc_dointvec,
76483 + },
76484 +#endif
76485 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
76486 + {
76487 + .procname = "chroot_deny_mknod",
76488 + .data = &grsec_enable_chroot_mknod,
76489 + .maxlen = sizeof(int),
76490 + .mode = 0600,
76491 + .proc_handler = &proc_dointvec,
76492 + },
76493 +#endif
76494 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
76495 + {
76496 + .procname = "chroot_restrict_nice",
76497 + .data = &grsec_enable_chroot_nice,
76498 + .maxlen = sizeof(int),
76499 + .mode = 0600,
76500 + .proc_handler = &proc_dointvec,
76501 + },
76502 +#endif
76503 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
76504 + {
76505 + .procname = "chroot_execlog",
76506 + .data = &grsec_enable_chroot_execlog,
76507 + .maxlen = sizeof(int),
76508 + .mode = 0600,
76509 + .proc_handler = &proc_dointvec,
76510 + },
76511 +#endif
76512 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
76513 + {
76514 + .procname = "chroot_caps",
76515 + .data = &grsec_enable_chroot_caps,
76516 + .maxlen = sizeof(int),
76517 + .mode = 0600,
76518 + .proc_handler = &proc_dointvec,
76519 + },
76520 +#endif
76521 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
76522 + {
76523 + .procname = "chroot_deny_sysctl",
76524 + .data = &grsec_enable_chroot_sysctl,
76525 + .maxlen = sizeof(int),
76526 + .mode = 0600,
76527 + .proc_handler = &proc_dointvec,
76528 + },
76529 +#endif
76530 +#ifdef CONFIG_GRKERNSEC_TPE
76531 + {
76532 + .procname = "tpe",
76533 + .data = &grsec_enable_tpe,
76534 + .maxlen = sizeof(int),
76535 + .mode = 0600,
76536 + .proc_handler = &proc_dointvec,
76537 + },
76538 + {
76539 + .procname = "tpe_gid",
76540 + .data = &grsec_tpe_gid,
76541 + .maxlen = sizeof(int),
76542 + .mode = 0600,
76543 + .proc_handler = &proc_dointvec,
76544 + },
76545 +#endif
76546 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
76547 + {
76548 + .procname = "tpe_invert",
76549 + .data = &grsec_enable_tpe_invert,
76550 + .maxlen = sizeof(int),
76551 + .mode = 0600,
76552 + .proc_handler = &proc_dointvec,
76553 + },
76554 +#endif
76555 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
76556 + {
76557 + .procname = "tpe_restrict_all",
76558 + .data = &grsec_enable_tpe_all,
76559 + .maxlen = sizeof(int),
76560 + .mode = 0600,
76561 + .proc_handler = &proc_dointvec,
76562 + },
76563 +#endif
76564 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
76565 + {
76566 + .procname = "socket_all",
76567 + .data = &grsec_enable_socket_all,
76568 + .maxlen = sizeof(int),
76569 + .mode = 0600,
76570 + .proc_handler = &proc_dointvec,
76571 + },
76572 + {
76573 + .procname = "socket_all_gid",
76574 + .data = &grsec_socket_all_gid,
76575 + .maxlen = sizeof(int),
76576 + .mode = 0600,
76577 + .proc_handler = &proc_dointvec,
76578 + },
76579 +#endif
76580 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
76581 + {
76582 + .procname = "socket_client",
76583 + .data = &grsec_enable_socket_client,
76584 + .maxlen = sizeof(int),
76585 + .mode = 0600,
76586 + .proc_handler = &proc_dointvec,
76587 + },
76588 + {
76589 + .procname = "socket_client_gid",
76590 + .data = &grsec_socket_client_gid,
76591 + .maxlen = sizeof(int),
76592 + .mode = 0600,
76593 + .proc_handler = &proc_dointvec,
76594 + },
76595 +#endif
76596 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
76597 + {
76598 + .procname = "socket_server",
76599 + .data = &grsec_enable_socket_server,
76600 + .maxlen = sizeof(int),
76601 + .mode = 0600,
76602 + .proc_handler = &proc_dointvec,
76603 + },
76604 + {
76605 + .procname = "socket_server_gid",
76606 + .data = &grsec_socket_server_gid,
76607 + .maxlen = sizeof(int),
76608 + .mode = 0600,
76609 + .proc_handler = &proc_dointvec,
76610 + },
76611 +#endif
76612 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
76613 + {
76614 + .procname = "audit_group",
76615 + .data = &grsec_enable_group,
76616 + .maxlen = sizeof(int),
76617 + .mode = 0600,
76618 + .proc_handler = &proc_dointvec,
76619 + },
76620 + {
76621 + .procname = "audit_gid",
76622 + .data = &grsec_audit_gid,
76623 + .maxlen = sizeof(int),
76624 + .mode = 0600,
76625 + .proc_handler = &proc_dointvec,
76626 + },
76627 +#endif
76628 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
76629 + {
76630 + .procname = "audit_chdir",
76631 + .data = &grsec_enable_chdir,
76632 + .maxlen = sizeof(int),
76633 + .mode = 0600,
76634 + .proc_handler = &proc_dointvec,
76635 + },
76636 +#endif
76637 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
76638 + {
76639 + .procname = "audit_mount",
76640 + .data = &grsec_enable_mount,
76641 + .maxlen = sizeof(int),
76642 + .mode = 0600,
76643 + .proc_handler = &proc_dointvec,
76644 + },
76645 +#endif
76646 +#ifdef CONFIG_GRKERNSEC_DMESG
76647 + {
76648 + .procname = "dmesg",
76649 + .data = &grsec_enable_dmesg,
76650 + .maxlen = sizeof(int),
76651 + .mode = 0600,
76652 + .proc_handler = &proc_dointvec,
76653 + },
76654 +#endif
76655 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
76656 + {
76657 + .procname = "chroot_findtask",
76658 + .data = &grsec_enable_chroot_findtask,
76659 + .maxlen = sizeof(int),
76660 + .mode = 0600,
76661 + .proc_handler = &proc_dointvec,
76662 + },
76663 +#endif
76664 +#ifdef CONFIG_GRKERNSEC_RESLOG
76665 + {
76666 + .procname = "resource_logging",
76667 + .data = &grsec_resource_logging,
76668 + .maxlen = sizeof(int),
76669 + .mode = 0600,
76670 + .proc_handler = &proc_dointvec,
76671 + },
76672 +#endif
76673 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
76674 + {
76675 + .procname = "audit_ptrace",
76676 + .data = &grsec_enable_audit_ptrace,
76677 + .maxlen = sizeof(int),
76678 + .mode = 0600,
76679 + .proc_handler = &proc_dointvec,
76680 + },
76681 +#endif
76682 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
76683 + {
76684 + .procname = "harden_ptrace",
76685 + .data = &grsec_enable_harden_ptrace,
76686 + .maxlen = sizeof(int),
76687 + .mode = 0600,
76688 + .proc_handler = &proc_dointvec,
76689 + },
76690 +#endif
76691 +#ifdef CONFIG_GRKERNSEC_HARDEN_IPC
76692 + {
76693 + .procname = "harden_ipc",
76694 + .data = &grsec_enable_harden_ipc,
76695 + .maxlen = sizeof(int),
76696 + .mode = 0600,
76697 + .proc_handler = &proc_dointvec,
76698 + },
76699 +#endif
76700 + {
76701 + .procname = "grsec_lock",
76702 + .data = &grsec_lock,
76703 + .maxlen = sizeof(int),
76704 + .mode = 0600,
76705 + .proc_handler = &proc_dointvec,
76706 + },
76707 +#endif
76708 +#ifdef CONFIG_GRKERNSEC_ROFS
76709 + {
76710 + .procname = "romount_protect",
76711 + .data = &grsec_enable_rofs,
76712 + .maxlen = sizeof(int),
76713 + .mode = 0600,
76714 + .proc_handler = &proc_dointvec_minmax,
76715 + .extra1 = &one,
76716 + .extra2 = &one,
76717 + },
76718 +#endif
76719 +#if defined(CONFIG_GRKERNSEC_DENYUSB) && !defined(CONFIG_GRKERNSEC_DENYUSB_FORCE)
76720 + {
76721 + .procname = "deny_new_usb",
76722 + .data = &grsec_deny_new_usb,
76723 + .maxlen = sizeof(int),
76724 + .mode = 0600,
76725 + .proc_handler = &proc_dointvec,
76726 + },
76727 +#endif
76728 + { }
76729 +};
76730 +#endif
76731 diff --git a/grsecurity/grsec_time.c b/grsecurity/grsec_time.c
76732 new file mode 100644
76733 index 0000000..61b514e
76734 --- /dev/null
76735 +++ b/grsecurity/grsec_time.c
76736 @@ -0,0 +1,16 @@
76737 +#include <linux/kernel.h>
76738 +#include <linux/sched.h>
76739 +#include <linux/grinternal.h>
76740 +#include <linux/module.h>
76741 +
76742 +void
76743 +gr_log_timechange(void)
76744 +{
76745 +#ifdef CONFIG_GRKERNSEC_TIME
76746 + if (grsec_enable_time)
76747 + gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
76748 +#endif
76749 + return;
76750 +}
76751 +
76752 +EXPORT_SYMBOL_GPL(gr_log_timechange);
76753 diff --git a/grsecurity/grsec_tpe.c b/grsecurity/grsec_tpe.c
76754 new file mode 100644
76755 index 0000000..ee57dcf
76756 --- /dev/null
76757 +++ b/grsecurity/grsec_tpe.c
76758 @@ -0,0 +1,73 @@
76759 +#include <linux/kernel.h>
76760 +#include <linux/sched.h>
76761 +#include <linux/file.h>
76762 +#include <linux/fs.h>
76763 +#include <linux/grinternal.h>
76764 +
76765 +extern int gr_acl_tpe_check(void);
76766 +
76767 +int
76768 +gr_tpe_allow(const struct file *file)
76769 +{
76770 +#ifdef CONFIG_GRKERNSEC
76771 + struct inode *inode = file->f_path.dentry->d_parent->d_inode;
76772 + const struct cred *cred = current_cred();
76773 + char *msg = NULL;
76774 + char *msg2 = NULL;
76775 +
76776 + // never restrict root
76777 + if (gr_is_global_root(cred->uid))
76778 + return 1;
76779 +
76780 + if (grsec_enable_tpe) {
76781 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
76782 + if (grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid))
76783 + msg = "not being in trusted group";
76784 + else if (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid))
76785 + msg = "being in untrusted group";
76786 +#else
76787 + if (in_group_p(grsec_tpe_gid))
76788 + msg = "being in untrusted group";
76789 +#endif
76790 + }
76791 + if (!msg && gr_acl_tpe_check())
76792 + msg = "being in untrusted role";
76793 +
76794 + // not in any affected group/role
76795 + if (!msg)
76796 + goto next_check;
76797 +
76798 + if (gr_is_global_nonroot(inode->i_uid))
76799 + msg2 = "file in non-root-owned directory";
76800 + else if (inode->i_mode & S_IWOTH)
76801 + msg2 = "file in world-writable directory";
76802 + else if (inode->i_mode & S_IWGRP)
76803 + msg2 = "file in group-writable directory";
76804 +
76805 + if (msg && msg2) {
76806 + char fullmsg[70] = {0};
76807 + snprintf(fullmsg, sizeof(fullmsg)-1, "%s and %s", msg, msg2);
76808 + gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, fullmsg, file->f_path.dentry, file->f_path.mnt);
76809 + return 0;
76810 + }
76811 + msg = NULL;
76812 +next_check:
76813 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
76814 + if (!grsec_enable_tpe || !grsec_enable_tpe_all)
76815 + return 1;
76816 +
76817 + if (gr_is_global_nonroot(inode->i_uid) && !uid_eq(inode->i_uid, cred->uid))
76818 + msg = "directory not owned by user";
76819 + else if (inode->i_mode & S_IWOTH)
76820 + msg = "file in world-writable directory";
76821 + else if (inode->i_mode & S_IWGRP)
76822 + msg = "file in group-writable directory";
76823 +
76824 + if (msg) {
76825 + gr_log_str_fs(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, msg, file->f_path.dentry, file->f_path.mnt);
76826 + return 0;
76827 + }
76828 +#endif
76829 +#endif
76830 + return 1;
76831 +}
76832 diff --git a/grsecurity/grsec_usb.c b/grsecurity/grsec_usb.c
76833 new file mode 100644
76834 index 0000000..ae02d8e
76835 --- /dev/null
76836 +++ b/grsecurity/grsec_usb.c
76837 @@ -0,0 +1,15 @@
76838 +#include <linux/kernel.h>
76839 +#include <linux/grinternal.h>
76840 +#include <linux/module.h>
76841 +
76842 +int gr_handle_new_usb(void)
76843 +{
76844 +#ifdef CONFIG_GRKERNSEC_DENYUSB
76845 + if (grsec_deny_new_usb) {
76846 + printk(KERN_ALERT "grsec: denied insert of new USB device\n");
76847 + return 1;
76848 + }
76849 +#endif
76850 + return 0;
76851 +}
76852 +EXPORT_SYMBOL_GPL(gr_handle_new_usb);
76853 diff --git a/grsecurity/grsum.c b/grsecurity/grsum.c
76854 new file mode 100644
76855 index 0000000..9f7b1ac
76856 --- /dev/null
76857 +++ b/grsecurity/grsum.c
76858 @@ -0,0 +1,61 @@
76859 +#include <linux/err.h>
76860 +#include <linux/kernel.h>
76861 +#include <linux/sched.h>
76862 +#include <linux/mm.h>
76863 +#include <linux/scatterlist.h>
76864 +#include <linux/crypto.h>
76865 +#include <linux/gracl.h>
76866 +
76867 +
76868 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
76869 +#error "crypto and sha256 must be built into the kernel"
76870 +#endif
76871 +
76872 +int
76873 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
76874 +{
76875 + char *p;
76876 + struct crypto_hash *tfm;
76877 + struct hash_desc desc;
76878 + struct scatterlist sg;
76879 + unsigned char temp_sum[GR_SHA_LEN];
76880 + volatile int retval = 0;
76881 + volatile int dummy = 0;
76882 + unsigned int i;
76883 +
76884 + sg_init_table(&sg, 1);
76885 +
76886 + tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
76887 + if (IS_ERR(tfm)) {
76888 + /* should never happen, since sha256 should be built in */
76889 + return 1;
76890 + }
76891 +
76892 + desc.tfm = tfm;
76893 + desc.flags = 0;
76894 +
76895 + crypto_hash_init(&desc);
76896 +
76897 + p = salt;
76898 + sg_set_buf(&sg, p, GR_SALT_LEN);
76899 + crypto_hash_update(&desc, &sg, sg.length);
76900 +
76901 + p = entry->pw;
76902 + sg_set_buf(&sg, p, strlen(p));
76903 +
76904 + crypto_hash_update(&desc, &sg, sg.length);
76905 +
76906 + crypto_hash_final(&desc, temp_sum);
76907 +
76908 + memset(entry->pw, 0, GR_PW_LEN);
76909 +
76910 + for (i = 0; i < GR_SHA_LEN; i++)
76911 + if (sum[i] != temp_sum[i])
76912 + retval = 1;
76913 + else
76914 + dummy = 1; // waste a cycle
76915 +
76916 + crypto_free_hash(tfm);
76917 +
76918 + return retval;
76919 +}
76920 diff --git a/include/asm-generic/4level-fixup.h b/include/asm-generic/4level-fixup.h
76921 index 77ff547..181834f 100644
76922 --- a/include/asm-generic/4level-fixup.h
76923 +++ b/include/asm-generic/4level-fixup.h
76924 @@ -13,8 +13,10 @@
76925 #define pmd_alloc(mm, pud, address) \
76926 ((unlikely(pgd_none(*(pud))) && __pmd_alloc(mm, pud, address))? \
76927 NULL: pmd_offset(pud, address))
76928 +#define pmd_alloc_kernel(mm, pud, address) pmd_alloc((mm), (pud), (address))
76929
76930 #define pud_alloc(mm, pgd, address) (pgd)
76931 +#define pud_alloc_kernel(mm, pgd, address) pud_alloc((mm), (pgd), (address))
76932 #define pud_offset(pgd, start) (pgd)
76933 #define pud_none(pud) 0
76934 #define pud_bad(pud) 0
76935 diff --git a/include/asm-generic/atomic-long.h b/include/asm-generic/atomic-long.h
76936 index b7babf0..97f4c4f 100644
76937 --- a/include/asm-generic/atomic-long.h
76938 +++ b/include/asm-generic/atomic-long.h
76939 @@ -22,6 +22,12 @@
76940
76941 typedef atomic64_t atomic_long_t;
76942
76943 +#ifdef CONFIG_PAX_REFCOUNT
76944 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
76945 +#else
76946 +typedef atomic64_t atomic_long_unchecked_t;
76947 +#endif
76948 +
76949 #define ATOMIC_LONG_INIT(i) ATOMIC64_INIT(i)
76950
76951 static inline long atomic_long_read(atomic_long_t *l)
76952 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atomic_long_t *l)
76953 return (long)atomic64_read(v);
76954 }
76955
76956 +#ifdef CONFIG_PAX_REFCOUNT
76957 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
76958 +{
76959 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
76960 +
76961 + return (long)atomic64_read_unchecked(v);
76962 +}
76963 +#endif
76964 +
76965 static inline void atomic_long_set(atomic_long_t *l, long i)
76966 {
76967 atomic64_t *v = (atomic64_t *)l;
76968 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
76969 atomic64_set(v, i);
76970 }
76971
76972 +#ifdef CONFIG_PAX_REFCOUNT
76973 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
76974 +{
76975 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
76976 +
76977 + atomic64_set_unchecked(v, i);
76978 +}
76979 +#endif
76980 +
76981 static inline void atomic_long_inc(atomic_long_t *l)
76982 {
76983 atomic64_t *v = (atomic64_t *)l;
76984 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
76985 atomic64_inc(v);
76986 }
76987
76988 +#ifdef CONFIG_PAX_REFCOUNT
76989 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
76990 +{
76991 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
76992 +
76993 + atomic64_inc_unchecked(v);
76994 +}
76995 +#endif
76996 +
76997 static inline void atomic_long_dec(atomic_long_t *l)
76998 {
76999 atomic64_t *v = (atomic64_t *)l;
77000 @@ -52,6 +85,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
77001 atomic64_dec(v);
77002 }
77003
77004 +#ifdef CONFIG_PAX_REFCOUNT
77005 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
77006 +{
77007 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
77008 +
77009 + atomic64_dec_unchecked(v);
77010 +}
77011 +#endif
77012 +
77013 static inline void atomic_long_add(long i, atomic_long_t *l)
77014 {
77015 atomic64_t *v = (atomic64_t *)l;
77016 @@ -59,6 +101,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
77017 atomic64_add(i, v);
77018 }
77019
77020 +#ifdef CONFIG_PAX_REFCOUNT
77021 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
77022 +{
77023 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
77024 +
77025 + atomic64_add_unchecked(i, v);
77026 +}
77027 +#endif
77028 +
77029 static inline void atomic_long_sub(long i, atomic_long_t *l)
77030 {
77031 atomic64_t *v = (atomic64_t *)l;
77032 @@ -66,6 +117,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
77033 atomic64_sub(i, v);
77034 }
77035
77036 +#ifdef CONFIG_PAX_REFCOUNT
77037 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
77038 +{
77039 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
77040 +
77041 + atomic64_sub_unchecked(i, v);
77042 +}
77043 +#endif
77044 +
77045 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
77046 {
77047 atomic64_t *v = (atomic64_t *)l;
77048 @@ -94,13 +154,22 @@ static inline int atomic_long_add_negative(long i, atomic_long_t *l)
77049 return atomic64_add_negative(i, v);
77050 }
77051
77052 -static inline long atomic_long_add_return(long i, atomic_long_t *l)
77053 +static inline long __intentional_overflow(-1) atomic_long_add_return(long i, atomic_long_t *l)
77054 {
77055 atomic64_t *v = (atomic64_t *)l;
77056
77057 return (long)atomic64_add_return(i, v);
77058 }
77059
77060 +#ifdef CONFIG_PAX_REFCOUNT
77061 +static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
77062 +{
77063 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
77064 +
77065 + return (long)atomic64_add_return_unchecked(i, v);
77066 +}
77067 +#endif
77068 +
77069 static inline long atomic_long_sub_return(long i, atomic_long_t *l)
77070 {
77071 atomic64_t *v = (atomic64_t *)l;
77072 @@ -115,6 +184,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
77073 return (long)atomic64_inc_return(v);
77074 }
77075
77076 +#ifdef CONFIG_PAX_REFCOUNT
77077 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
77078 +{
77079 + atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
77080 +
77081 + return (long)atomic64_inc_return_unchecked(v);
77082 +}
77083 +#endif
77084 +
77085 static inline long atomic_long_dec_return(atomic_long_t *l)
77086 {
77087 atomic64_t *v = (atomic64_t *)l;
77088 @@ -140,6 +218,12 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
77089
77090 typedef atomic_t atomic_long_t;
77091
77092 +#ifdef CONFIG_PAX_REFCOUNT
77093 +typedef atomic_unchecked_t atomic_long_unchecked_t;
77094 +#else
77095 +typedef atomic_t atomic_long_unchecked_t;
77096 +#endif
77097 +
77098 #define ATOMIC_LONG_INIT(i) ATOMIC_INIT(i)
77099 static inline long atomic_long_read(atomic_long_t *l)
77100 {
77101 @@ -148,6 +232,15 @@ static inline long atomic_long_read(atomic_long_t *l)
77102 return (long)atomic_read(v);
77103 }
77104
77105 +#ifdef CONFIG_PAX_REFCOUNT
77106 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
77107 +{
77108 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77109 +
77110 + return (long)atomic_read_unchecked(v);
77111 +}
77112 +#endif
77113 +
77114 static inline void atomic_long_set(atomic_long_t *l, long i)
77115 {
77116 atomic_t *v = (atomic_t *)l;
77117 @@ -155,6 +248,15 @@ static inline void atomic_long_set(atomic_long_t *l, long i)
77118 atomic_set(v, i);
77119 }
77120
77121 +#ifdef CONFIG_PAX_REFCOUNT
77122 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
77123 +{
77124 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77125 +
77126 + atomic_set_unchecked(v, i);
77127 +}
77128 +#endif
77129 +
77130 static inline void atomic_long_inc(atomic_long_t *l)
77131 {
77132 atomic_t *v = (atomic_t *)l;
77133 @@ -162,6 +264,15 @@ static inline void atomic_long_inc(atomic_long_t *l)
77134 atomic_inc(v);
77135 }
77136
77137 +#ifdef CONFIG_PAX_REFCOUNT
77138 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
77139 +{
77140 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77141 +
77142 + atomic_inc_unchecked(v);
77143 +}
77144 +#endif
77145 +
77146 static inline void atomic_long_dec(atomic_long_t *l)
77147 {
77148 atomic_t *v = (atomic_t *)l;
77149 @@ -169,6 +280,15 @@ static inline void atomic_long_dec(atomic_long_t *l)
77150 atomic_dec(v);
77151 }
77152
77153 +#ifdef CONFIG_PAX_REFCOUNT
77154 +static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
77155 +{
77156 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77157 +
77158 + atomic_dec_unchecked(v);
77159 +}
77160 +#endif
77161 +
77162 static inline void atomic_long_add(long i, atomic_long_t *l)
77163 {
77164 atomic_t *v = (atomic_t *)l;
77165 @@ -176,6 +296,15 @@ static inline void atomic_long_add(long i, atomic_long_t *l)
77166 atomic_add(i, v);
77167 }
77168
77169 +#ifdef CONFIG_PAX_REFCOUNT
77170 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
77171 +{
77172 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77173 +
77174 + atomic_add_unchecked(i, v);
77175 +}
77176 +#endif
77177 +
77178 static inline void atomic_long_sub(long i, atomic_long_t *l)
77179 {
77180 atomic_t *v = (atomic_t *)l;
77181 @@ -183,6 +312,15 @@ static inline void atomic_long_sub(long i, atomic_long_t *l)
77182 atomic_sub(i, v);
77183 }
77184
77185 +#ifdef CONFIG_PAX_REFCOUNT
77186 +static inline void atomic_long_sub_unchecked(long i, atomic_long_unchecked_t *l)
77187 +{
77188 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77189 +
77190 + atomic_sub_unchecked(i, v);
77191 +}
77192 +#endif
77193 +
77194 static inline int atomic_long_sub_and_test(long i, atomic_long_t *l)
77195 {
77196 atomic_t *v = (atomic_t *)l;
77197 @@ -218,6 +356,16 @@ static inline long atomic_long_add_return(long i, atomic_long_t *l)
77198 return (long)atomic_add_return(i, v);
77199 }
77200
77201 +#ifdef CONFIG_PAX_REFCOUNT
77202 +static inline long atomic_long_add_return_unchecked(long i, atomic_long_unchecked_t *l)
77203 +{
77204 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77205 +
77206 + return (long)atomic_add_return_unchecked(i, v);
77207 +}
77208 +
77209 +#endif
77210 +
77211 static inline long atomic_long_sub_return(long i, atomic_long_t *l)
77212 {
77213 atomic_t *v = (atomic_t *)l;
77214 @@ -232,6 +380,15 @@ static inline long atomic_long_inc_return(atomic_long_t *l)
77215 return (long)atomic_inc_return(v);
77216 }
77217
77218 +#ifdef CONFIG_PAX_REFCOUNT
77219 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
77220 +{
77221 + atomic_unchecked_t *v = (atomic_unchecked_t *)l;
77222 +
77223 + return (long)atomic_inc_return_unchecked(v);
77224 +}
77225 +#endif
77226 +
77227 static inline long atomic_long_dec_return(atomic_long_t *l)
77228 {
77229 atomic_t *v = (atomic_t *)l;
77230 @@ -255,4 +412,57 @@ static inline long atomic_long_add_unless(atomic_long_t *l, long a, long u)
77231
77232 #endif /* BITS_PER_LONG == 64 */
77233
77234 +#ifdef CONFIG_PAX_REFCOUNT
77235 +static inline void pax_refcount_needs_these_functions(void)
77236 +{
77237 + atomic_read_unchecked((atomic_unchecked_t *)NULL);
77238 + atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
77239 + atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
77240 + atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
77241 + atomic_inc_unchecked((atomic_unchecked_t *)NULL);
77242 + (void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
77243 + atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
77244 + atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
77245 + atomic_dec_unchecked((atomic_unchecked_t *)NULL);
77246 + atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
77247 + (void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
77248 +#ifdef CONFIG_X86
77249 + atomic_clear_mask_unchecked(0, NULL);
77250 + atomic_set_mask_unchecked(0, NULL);
77251 +#endif
77252 +
77253 + atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
77254 + atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
77255 + atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
77256 + atomic_long_sub_unchecked(0, (atomic_long_unchecked_t *)NULL);
77257 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
77258 + atomic_long_add_return_unchecked(0, (atomic_long_unchecked_t *)NULL);
77259 + atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
77260 + atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
77261 +}
77262 +#else
77263 +#define atomic_read_unchecked(v) atomic_read(v)
77264 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
77265 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
77266 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
77267 +#define atomic_inc_unchecked(v) atomic_inc(v)
77268 +#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
77269 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
77270 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
77271 +#define atomic_dec_unchecked(v) atomic_dec(v)
77272 +#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
77273 +#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
77274 +#define atomic_clear_mask_unchecked(mask, v) atomic_clear_mask((mask), (v))
77275 +#define atomic_set_mask_unchecked(mask, v) atomic_set_mask((mask), (v))
77276 +
77277 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
77278 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
77279 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
77280 +#define atomic_long_sub_unchecked(i, v) atomic_long_sub((i), (v))
77281 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
77282 +#define atomic_long_add_return_unchecked(i, v) atomic_long_add_return((i), (v))
77283 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
77284 +#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
77285 +#endif
77286 +
77287 #endif /* _ASM_GENERIC_ATOMIC_LONG_H */
77288 diff --git a/include/asm-generic/atomic.h b/include/asm-generic/atomic.h
77289 index 33bd2de..f31bff97 100644
77290 --- a/include/asm-generic/atomic.h
77291 +++ b/include/asm-generic/atomic.h
77292 @@ -153,7 +153,7 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
77293 * Atomically clears the bits set in @mask from @v
77294 */
77295 #ifndef atomic_clear_mask
77296 -static inline void atomic_clear_mask(unsigned long mask, atomic_t *v)
77297 +static inline void atomic_clear_mask(unsigned int mask, atomic_t *v)
77298 {
77299 unsigned long flags;
77300
77301 diff --git a/include/asm-generic/atomic64.h b/include/asm-generic/atomic64.h
77302 index b18ce4f..2ee2843 100644
77303 --- a/include/asm-generic/atomic64.h
77304 +++ b/include/asm-generic/atomic64.h
77305 @@ -16,6 +16,8 @@ typedef struct {
77306 long long counter;
77307 } atomic64_t;
77308
77309 +typedef atomic64_t atomic64_unchecked_t;
77310 +
77311 #define ATOMIC64_INIT(i) { (i) }
77312
77313 extern long long atomic64_read(const atomic64_t *v);
77314 @@ -39,4 +41,14 @@ extern int atomic64_add_unless(atomic64_t *v, long long a, long long u);
77315 #define atomic64_dec_and_test(v) (atomic64_dec_return((v)) == 0)
77316 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1LL, 0LL)
77317
77318 +#define atomic64_read_unchecked(v) atomic64_read(v)
77319 +#define atomic64_set_unchecked(v, i) atomic64_set((v), (i))
77320 +#define atomic64_add_unchecked(a, v) atomic64_add((a), (v))
77321 +#define atomic64_add_return_unchecked(a, v) atomic64_add_return((a), (v))
77322 +#define atomic64_sub_unchecked(a, v) atomic64_sub((a), (v))
77323 +#define atomic64_inc_unchecked(v) atomic64_inc(v)
77324 +#define atomic64_inc_return_unchecked(v) atomic64_inc_return(v)
77325 +#define atomic64_dec_unchecked(v) atomic64_dec(v)
77326 +#define atomic64_cmpxchg_unchecked(v, o, n) atomic64_cmpxchg((v), (o), (n))
77327 +
77328 #endif /* _ASM_GENERIC_ATOMIC64_H */
77329 diff --git a/include/asm-generic/bitops/__fls.h b/include/asm-generic/bitops/__fls.h
77330 index a60a7cc..0fe12f2 100644
77331 --- a/include/asm-generic/bitops/__fls.h
77332 +++ b/include/asm-generic/bitops/__fls.h
77333 @@ -9,7 +9,7 @@
77334 *
77335 * Undefined if no set bit exists, so code should check against 0 first.
77336 */
77337 -static __always_inline unsigned long __fls(unsigned long word)
77338 +static __always_inline unsigned long __intentional_overflow(-1) __fls(unsigned long word)
77339 {
77340 int num = BITS_PER_LONG - 1;
77341
77342 diff --git a/include/asm-generic/bitops/fls.h b/include/asm-generic/bitops/fls.h
77343 index 0576d1f..dad6c71 100644
77344 --- a/include/asm-generic/bitops/fls.h
77345 +++ b/include/asm-generic/bitops/fls.h
77346 @@ -9,7 +9,7 @@
77347 * Note fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
77348 */
77349
77350 -static __always_inline int fls(int x)
77351 +static __always_inline int __intentional_overflow(-1) fls(int x)
77352 {
77353 int r = 32;
77354
77355 diff --git a/include/asm-generic/bitops/fls64.h b/include/asm-generic/bitops/fls64.h
77356 index b097cf8..3d40e14 100644
77357 --- a/include/asm-generic/bitops/fls64.h
77358 +++ b/include/asm-generic/bitops/fls64.h
77359 @@ -15,7 +15,7 @@
77360 * at position 64.
77361 */
77362 #if BITS_PER_LONG == 32
77363 -static __always_inline int fls64(__u64 x)
77364 +static __always_inline int __intentional_overflow(-1) fls64(__u64 x)
77365 {
77366 __u32 h = x >> 32;
77367 if (h)
77368 @@ -23,7 +23,7 @@ static __always_inline int fls64(__u64 x)
77369 return fls(x);
77370 }
77371 #elif BITS_PER_LONG == 64
77372 -static __always_inline int fls64(__u64 x)
77373 +static __always_inline int __intentional_overflow(-1) fls64(__u64 x)
77374 {
77375 if (x == 0)
77376 return 0;
77377 diff --git a/include/asm-generic/cache.h b/include/asm-generic/cache.h
77378 index 1bfcfe5..e04c5c9 100644
77379 --- a/include/asm-generic/cache.h
77380 +++ b/include/asm-generic/cache.h
77381 @@ -6,7 +6,7 @@
77382 * cache lines need to provide their own cache.h.
77383 */
77384
77385 -#define L1_CACHE_SHIFT 5
77386 -#define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
77387 +#define L1_CACHE_SHIFT 5UL
77388 +#define L1_CACHE_BYTES (1UL << L1_CACHE_SHIFT)
77389
77390 #endif /* __ASM_GENERIC_CACHE_H */
77391 diff --git a/include/asm-generic/emergency-restart.h b/include/asm-generic/emergency-restart.h
77392 index 0d68a1e..b74a761 100644
77393 --- a/include/asm-generic/emergency-restart.h
77394 +++ b/include/asm-generic/emergency-restart.h
77395 @@ -1,7 +1,7 @@
77396 #ifndef _ASM_GENERIC_EMERGENCY_RESTART_H
77397 #define _ASM_GENERIC_EMERGENCY_RESTART_H
77398
77399 -static inline void machine_emergency_restart(void)
77400 +static inline __noreturn void machine_emergency_restart(void)
77401 {
77402 machine_restart(NULL);
77403 }
77404 diff --git a/include/asm-generic/kmap_types.h b/include/asm-generic/kmap_types.h
77405 index 90f99c7..00ce236 100644
77406 --- a/include/asm-generic/kmap_types.h
77407 +++ b/include/asm-generic/kmap_types.h
77408 @@ -2,9 +2,9 @@
77409 #define _ASM_GENERIC_KMAP_TYPES_H
77410
77411 #ifdef __WITH_KM_FENCE
77412 -# define KM_TYPE_NR 41
77413 +# define KM_TYPE_NR 42
77414 #else
77415 -# define KM_TYPE_NR 20
77416 +# define KM_TYPE_NR 21
77417 #endif
77418
77419 #endif
77420 diff --git a/include/asm-generic/local.h b/include/asm-generic/local.h
77421 index 9ceb03b..62b0b8f 100644
77422 --- a/include/asm-generic/local.h
77423 +++ b/include/asm-generic/local.h
77424 @@ -23,24 +23,37 @@ typedef struct
77425 atomic_long_t a;
77426 } local_t;
77427
77428 +typedef struct {
77429 + atomic_long_unchecked_t a;
77430 +} local_unchecked_t;
77431 +
77432 #define LOCAL_INIT(i) { ATOMIC_LONG_INIT(i) }
77433
77434 #define local_read(l) atomic_long_read(&(l)->a)
77435 +#define local_read_unchecked(l) atomic_long_read_unchecked(&(l)->a)
77436 #define local_set(l,i) atomic_long_set((&(l)->a),(i))
77437 +#define local_set_unchecked(l,i) atomic_long_set_unchecked((&(l)->a),(i))
77438 #define local_inc(l) atomic_long_inc(&(l)->a)
77439 +#define local_inc_unchecked(l) atomic_long_inc_unchecked(&(l)->a)
77440 #define local_dec(l) atomic_long_dec(&(l)->a)
77441 +#define local_dec_unchecked(l) atomic_long_dec_unchecked(&(l)->a)
77442 #define local_add(i,l) atomic_long_add((i),(&(l)->a))
77443 +#define local_add_unchecked(i,l) atomic_long_add_unchecked((i),(&(l)->a))
77444 #define local_sub(i,l) atomic_long_sub((i),(&(l)->a))
77445 +#define local_sub_unchecked(i,l) atomic_long_sub_unchecked((i),(&(l)->a))
77446
77447 #define local_sub_and_test(i, l) atomic_long_sub_and_test((i), (&(l)->a))
77448 #define local_dec_and_test(l) atomic_long_dec_and_test(&(l)->a)
77449 #define local_inc_and_test(l) atomic_long_inc_and_test(&(l)->a)
77450 #define local_add_negative(i, l) atomic_long_add_negative((i), (&(l)->a))
77451 #define local_add_return(i, l) atomic_long_add_return((i), (&(l)->a))
77452 +#define local_add_return_unchecked(i, l) atomic_long_add_return_unchecked((i), (&(l)->a))
77453 #define local_sub_return(i, l) atomic_long_sub_return((i), (&(l)->a))
77454 #define local_inc_return(l) atomic_long_inc_return(&(l)->a)
77455 +#define local_dec_return(l) atomic_long_dec_return(&(l)->a)
77456
77457 #define local_cmpxchg(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
77458 +#define local_cmpxchg_unchecked(l, o, n) atomic_long_cmpxchg((&(l)->a), (o), (n))
77459 #define local_xchg(l, n) atomic_long_xchg((&(l)->a), (n))
77460 #define local_add_unless(l, _a, u) atomic_long_add_unless((&(l)->a), (_a), (u))
77461 #define local_inc_not_zero(l) atomic_long_inc_not_zero(&(l)->a)
77462 diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h
77463 index 725612b..9cc513a 100644
77464 --- a/include/asm-generic/pgtable-nopmd.h
77465 +++ b/include/asm-generic/pgtable-nopmd.h
77466 @@ -1,14 +1,19 @@
77467 #ifndef _PGTABLE_NOPMD_H
77468 #define _PGTABLE_NOPMD_H
77469
77470 -#ifndef __ASSEMBLY__
77471 -
77472 #include <asm-generic/pgtable-nopud.h>
77473
77474 -struct mm_struct;
77475 -
77476 #define __PAGETABLE_PMD_FOLDED
77477
77478 +#define PMD_SHIFT PUD_SHIFT
77479 +#define PTRS_PER_PMD 1
77480 +#define PMD_SIZE (_AC(1,UL) << PMD_SHIFT)
77481 +#define PMD_MASK (~(PMD_SIZE-1))
77482 +
77483 +#ifndef __ASSEMBLY__
77484 +
77485 +struct mm_struct;
77486 +
77487 /*
77488 * Having the pmd type consist of a pud gets the size right, and allows
77489 * us to conceptually access the pud entry that this pmd is folded into
77490 @@ -16,11 +21,6 @@ struct mm_struct;
77491 */
77492 typedef struct { pud_t pud; } pmd_t;
77493
77494 -#define PMD_SHIFT PUD_SHIFT
77495 -#define PTRS_PER_PMD 1
77496 -#define PMD_SIZE (1UL << PMD_SHIFT)
77497 -#define PMD_MASK (~(PMD_SIZE-1))
77498 -
77499 /*
77500 * The "pud_xxx()" functions here are trivial for a folded two-level
77501 * setup: the pmd is never bad, and a pmd always exists (as it's folded
77502 diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h
77503 index 810431d..0ec4804f 100644
77504 --- a/include/asm-generic/pgtable-nopud.h
77505 +++ b/include/asm-generic/pgtable-nopud.h
77506 @@ -1,10 +1,15 @@
77507 #ifndef _PGTABLE_NOPUD_H
77508 #define _PGTABLE_NOPUD_H
77509
77510 -#ifndef __ASSEMBLY__
77511 -
77512 #define __PAGETABLE_PUD_FOLDED
77513
77514 +#define PUD_SHIFT PGDIR_SHIFT
77515 +#define PTRS_PER_PUD 1
77516 +#define PUD_SIZE (_AC(1,UL) << PUD_SHIFT)
77517 +#define PUD_MASK (~(PUD_SIZE-1))
77518 +
77519 +#ifndef __ASSEMBLY__
77520 +
77521 /*
77522 * Having the pud type consist of a pgd gets the size right, and allows
77523 * us to conceptually access the pgd entry that this pud is folded into
77524 @@ -12,11 +17,6 @@
77525 */
77526 typedef struct { pgd_t pgd; } pud_t;
77527
77528 -#define PUD_SHIFT PGDIR_SHIFT
77529 -#define PTRS_PER_PUD 1
77530 -#define PUD_SIZE (1UL << PUD_SHIFT)
77531 -#define PUD_MASK (~(PUD_SIZE-1))
77532 -
77533 /*
77534 * The "pgd_xxx()" functions here are trivial for a folded two-level
77535 * setup: the pud is never bad, and a pud always exists (as it's folded
77536 @@ -29,6 +29,7 @@ static inline void pgd_clear(pgd_t *pgd) { }
77537 #define pud_ERROR(pud) (pgd_ERROR((pud).pgd))
77538
77539 #define pgd_populate(mm, pgd, pud) do { } while (0)
77540 +#define pgd_populate_kernel(mm, pgd, pud) do { } while (0)
77541 /*
77542 * (puds are folded into pgds so this doesn't get actually called,
77543 * but the define is needed for a generic inline function.)
77544 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
77545 index 38a7437..47f62a4 100644
77546 --- a/include/asm-generic/pgtable.h
77547 +++ b/include/asm-generic/pgtable.h
77548 @@ -802,6 +802,22 @@ static inline void pmdp_set_numa(struct mm_struct *mm, unsigned long addr,
77549 }
77550 #endif /* CONFIG_NUMA_BALANCING */
77551
77552 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
77553 +#ifdef CONFIG_PAX_KERNEXEC
77554 +#error KERNEXEC requires pax_open_kernel
77555 +#else
77556 +static inline unsigned long pax_open_kernel(void) { return 0; }
77557 +#endif
77558 +#endif
77559 +
77560 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
77561 +#ifdef CONFIG_PAX_KERNEXEC
77562 +#error KERNEXEC requires pax_close_kernel
77563 +#else
77564 +static inline unsigned long pax_close_kernel(void) { return 0; }
77565 +#endif
77566 +#endif
77567 +
77568 #endif /* CONFIG_MMU */
77569
77570 #endif /* !__ASSEMBLY__ */
77571 diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
77572 index 72d8803..cb9749c 100644
77573 --- a/include/asm-generic/uaccess.h
77574 +++ b/include/asm-generic/uaccess.h
77575 @@ -343,4 +343,20 @@ clear_user(void __user *to, unsigned long n)
77576 return __clear_user(to, n);
77577 }
77578
77579 +#ifndef __HAVE_ARCH_PAX_OPEN_USERLAND
77580 +#ifdef CONFIG_PAX_MEMORY_UDEREF
77581 +#error UDEREF requires pax_open_userland
77582 +#else
77583 +static inline unsigned long pax_open_userland(void) { return 0; }
77584 +#endif
77585 +#endif
77586 +
77587 +#ifndef __HAVE_ARCH_PAX_CLOSE_USERLAND
77588 +#ifdef CONFIG_PAX_MEMORY_UDEREF
77589 +#error UDEREF requires pax_close_userland
77590 +#else
77591 +static inline unsigned long pax_close_userland(void) { return 0; }
77592 +#endif
77593 +#endif
77594 +
77595 #endif /* __ASM_GENERIC_UACCESS_H */
77596 diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
77597 index bc2121f..2f41f9a 100644
77598 --- a/include/asm-generic/vmlinux.lds.h
77599 +++ b/include/asm-generic/vmlinux.lds.h
77600 @@ -232,6 +232,7 @@
77601 .rodata : AT(ADDR(.rodata) - LOAD_OFFSET) { \
77602 VMLINUX_SYMBOL(__start_rodata) = .; \
77603 *(.rodata) *(.rodata.*) \
77604 + *(.data..read_only) \
77605 *(__vermagic) /* Kernel version magic */ \
77606 . = ALIGN(8); \
77607 VMLINUX_SYMBOL(__start___tracepoints_ptrs) = .; \
77608 @@ -716,17 +717,18 @@
77609 * section in the linker script will go there too. @phdr should have
77610 * a leading colon.
77611 *
77612 - * Note that this macros defines __per_cpu_load as an absolute symbol.
77613 + * Note that this macros defines per_cpu_load as an absolute symbol.
77614 * If there is no need to put the percpu section at a predetermined
77615 * address, use PERCPU_SECTION.
77616 */
77617 #define PERCPU_VADDR(cacheline, vaddr, phdr) \
77618 - VMLINUX_SYMBOL(__per_cpu_load) = .; \
77619 - .data..percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load) \
77620 + per_cpu_load = .; \
77621 + .data..percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load) \
77622 - LOAD_OFFSET) { \
77623 + VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load; \
77624 PERCPU_INPUT(cacheline) \
77625 } phdr \
77626 - . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data..percpu);
77627 + . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data..percpu);
77628
77629 /**
77630 * PERCPU_SECTION - define output section for percpu area, simple version
77631 diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
77632 index e73c19e..5b89e00 100644
77633 --- a/include/crypto/algapi.h
77634 +++ b/include/crypto/algapi.h
77635 @@ -34,7 +34,7 @@ struct crypto_type {
77636 unsigned int maskclear;
77637 unsigned int maskset;
77638 unsigned int tfmsize;
77639 -};
77640 +} __do_const;
77641
77642 struct crypto_instance {
77643 struct crypto_alg alg;
77644 diff --git a/include/drm/drmP.h b/include/drm/drmP.h
77645 index 04a7f31..668d424 100644
77646 --- a/include/drm/drmP.h
77647 +++ b/include/drm/drmP.h
77648 @@ -67,6 +67,7 @@
77649 #include <linux/workqueue.h>
77650 #include <linux/poll.h>
77651 #include <asm/pgalloc.h>
77652 +#include <asm/local.h>
77653 #include <drm/drm.h>
77654 #include <drm/drm_sarea.h>
77655 #include <drm/drm_vma_manager.h>
77656 @@ -297,10 +298,12 @@ do { \
77657 * \param cmd command.
77658 * \param arg argument.
77659 */
77660 -typedef int drm_ioctl_t(struct drm_device *dev, void *data,
77661 +typedef int (* const drm_ioctl_t)(struct drm_device *dev, void *data,
77662 + struct drm_file *file_priv);
77663 +typedef int (* drm_ioctl_no_const_t)(struct drm_device *dev, void *data,
77664 struct drm_file *file_priv);
77665
77666 -typedef int drm_ioctl_compat_t(struct file *filp, unsigned int cmd,
77667 +typedef int (* const drm_ioctl_compat_t)(struct file *filp, unsigned int cmd,
77668 unsigned long arg);
77669
77670 #define DRM_IOCTL_NR(n) _IOC_NR(n)
77671 @@ -316,10 +319,10 @@ typedef int drm_ioctl_compat_t(struct file *filp, unsigned int cmd,
77672 struct drm_ioctl_desc {
77673 unsigned int cmd;
77674 int flags;
77675 - drm_ioctl_t *func;
77676 + drm_ioctl_t func;
77677 unsigned int cmd_drv;
77678 const char *name;
77679 -};
77680 +} __do_const;
77681
77682 /**
77683 * Creates a driver or general drm_ioctl_desc array entry for the given
77684 @@ -1022,7 +1025,8 @@ struct drm_info_list {
77685 int (*show)(struct seq_file*, void*); /** show callback */
77686 u32 driver_features; /**< Required driver features for this entry */
77687 void *data;
77688 -};
77689 +} __do_const;
77690 +typedef struct drm_info_list __no_const drm_info_list_no_const;
77691
77692 /**
77693 * debugfs node structure. This structure represents a debugfs file.
77694 @@ -1106,7 +1110,7 @@ struct drm_device {
77695
77696 /** \name Usage Counters */
77697 /*@{ */
77698 - int open_count; /**< Outstanding files open */
77699 + local_t open_count; /**< Outstanding files open */
77700 int buf_use; /**< Buffers in use -- cannot alloc */
77701 atomic_t buf_alloc; /**< Buffer allocation in progress */
77702 /*@} */
77703 diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
77704 index b1388b5..e1d1163 100644
77705 --- a/include/drm/drm_crtc_helper.h
77706 +++ b/include/drm/drm_crtc_helper.h
77707 @@ -109,7 +109,7 @@ struct drm_encoder_helper_funcs {
77708 struct drm_connector *connector);
77709 /* disable encoder when not in use - more explicit than dpms off */
77710 void (*disable)(struct drm_encoder *encoder);
77711 -};
77712 +} __no_const;
77713
77714 /**
77715 * drm_connector_helper_funcs - helper operations for connectors
77716 diff --git a/include/drm/i915_pciids.h b/include/drm/i915_pciids.h
77717 index 940ece4..8cb727f 100644
77718 --- a/include/drm/i915_pciids.h
77719 +++ b/include/drm/i915_pciids.h
77720 @@ -37,7 +37,7 @@
77721 */
77722 #define INTEL_VGA_DEVICE(id, info) { \
77723 0x8086, id, \
77724 - ~0, ~0, \
77725 + PCI_ANY_ID, PCI_ANY_ID, \
77726 0x030000, 0xff0000, \
77727 (unsigned long) info }
77728
77729 diff --git a/include/drm/ttm/ttm_memory.h b/include/drm/ttm/ttm_memory.h
77730 index 72dcbe8..8db58d7 100644
77731 --- a/include/drm/ttm/ttm_memory.h
77732 +++ b/include/drm/ttm/ttm_memory.h
77733 @@ -48,7 +48,7 @@
77734
77735 struct ttm_mem_shrink {
77736 int (*do_shrink) (struct ttm_mem_shrink *);
77737 -};
77738 +} __no_const;
77739
77740 /**
77741 * struct ttm_mem_global - Global memory accounting structure.
77742 diff --git a/include/drm/ttm/ttm_page_alloc.h b/include/drm/ttm/ttm_page_alloc.h
77743 index 49a8284..9643967 100644
77744 --- a/include/drm/ttm/ttm_page_alloc.h
77745 +++ b/include/drm/ttm/ttm_page_alloc.h
77746 @@ -80,6 +80,7 @@ void ttm_dma_page_alloc_fini(void);
77747 */
77748 extern int ttm_dma_page_alloc_debugfs(struct seq_file *m, void *data);
77749
77750 +struct device;
77751 extern int ttm_dma_populate(struct ttm_dma_tt *ttm_dma, struct device *dev);
77752 extern void ttm_dma_unpopulate(struct ttm_dma_tt *ttm_dma, struct device *dev);
77753
77754 diff --git a/include/keys/asymmetric-subtype.h b/include/keys/asymmetric-subtype.h
77755 index 4b840e8..155d235 100644
77756 --- a/include/keys/asymmetric-subtype.h
77757 +++ b/include/keys/asymmetric-subtype.h
77758 @@ -37,7 +37,7 @@ struct asymmetric_key_subtype {
77759 /* Verify the signature on a key of this subtype (optional) */
77760 int (*verify_signature)(const struct key *key,
77761 const struct public_key_signature *sig);
77762 -};
77763 +} __do_const;
77764
77765 /**
77766 * asymmetric_key_subtype - Get the subtype from an asymmetric key
77767 diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h
77768 index c1da539..1dcec55 100644
77769 --- a/include/linux/atmdev.h
77770 +++ b/include/linux/atmdev.h
77771 @@ -28,7 +28,7 @@ struct compat_atm_iobuf {
77772 #endif
77773
77774 struct k_atm_aal_stats {
77775 -#define __HANDLE_ITEM(i) atomic_t i
77776 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
77777 __AAL_STAT_ITEMS
77778 #undef __HANDLE_ITEM
77779 };
77780 @@ -200,7 +200,7 @@ struct atmdev_ops { /* only send is required */
77781 int (*change_qos)(struct atm_vcc *vcc,struct atm_qos *qos,int flags);
77782 int (*proc_read)(struct atm_dev *dev,loff_t *pos,char *page);
77783 struct module *owner;
77784 -};
77785 +} __do_const ;
77786
77787 struct atmphy_ops {
77788 int (*start)(struct atm_dev *dev);
77789 diff --git a/include/linux/audit.h b/include/linux/audit.h
77790 index ec1464d..833274b 100644
77791 --- a/include/linux/audit.h
77792 +++ b/include/linux/audit.h
77793 @@ -196,7 +196,7 @@ static inline void audit_ptrace(struct task_struct *t)
77794 extern unsigned int audit_serial(void);
77795 extern int auditsc_get_stamp(struct audit_context *ctx,
77796 struct timespec *t, unsigned int *serial);
77797 -extern int audit_set_loginuid(kuid_t loginuid);
77798 +extern int __intentional_overflow(-1) audit_set_loginuid(kuid_t loginuid);
77799
77800 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
77801 {
77802 diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
77803 index b4a745d..e3c0942 100644
77804 --- a/include/linux/binfmts.h
77805 +++ b/include/linux/binfmts.h
77806 @@ -45,7 +45,7 @@ struct linux_binprm {
77807 unsigned interp_data;
77808 unsigned long loader, exec;
77809 char tcomm[TASK_COMM_LEN];
77810 -};
77811 +} __randomize_layout;
77812
77813 #define BINPRM_FLAGS_ENFORCE_NONDUMP_BIT 0
77814 #define BINPRM_FLAGS_ENFORCE_NONDUMP (1 << BINPRM_FLAGS_ENFORCE_NONDUMP_BIT)
77815 @@ -74,8 +74,10 @@ struct linux_binfmt {
77816 int (*load_binary)(struct linux_binprm *);
77817 int (*load_shlib)(struct file *);
77818 int (*core_dump)(struct coredump_params *cprm);
77819 + void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
77820 + void (*handle_mmap)(struct file *);
77821 unsigned long min_coredump; /* minimal dump size */
77822 -};
77823 +} __do_const __randomize_layout;
77824
77825 extern void __register_binfmt(struct linux_binfmt *fmt, int insert);
77826
77827 diff --git a/include/linux/bitops.h b/include/linux/bitops.h
77828 index be5fd38..d71192a 100644
77829 --- a/include/linux/bitops.h
77830 +++ b/include/linux/bitops.h
77831 @@ -102,7 +102,7 @@ static inline __u64 ror64(__u64 word, unsigned int shift)
77832 * @word: value to rotate
77833 * @shift: bits to roll
77834 */
77835 -static inline __u32 rol32(__u32 word, unsigned int shift)
77836 +static inline __u32 __intentional_overflow(-1) rol32(__u32 word, unsigned int shift)
77837 {
77838 return (word << shift) | (word >> (32 - shift));
77839 }
77840 @@ -112,7 +112,7 @@ static inline __u32 rol32(__u32 word, unsigned int shift)
77841 * @word: value to rotate
77842 * @shift: bits to roll
77843 */
77844 -static inline __u32 ror32(__u32 word, unsigned int shift)
77845 +static inline __u32 __intentional_overflow(-1) ror32(__u32 word, unsigned int shift)
77846 {
77847 return (word >> shift) | (word << (32 - shift));
77848 }
77849 @@ -168,7 +168,7 @@ static inline __s32 sign_extend32(__u32 value, int index)
77850 return (__s32)(value << shift) >> shift;
77851 }
77852
77853 -static inline unsigned fls_long(unsigned long l)
77854 +static inline unsigned __intentional_overflow(-1) fls_long(unsigned long l)
77855 {
77856 if (sizeof(l) == 4)
77857 return fls(l);
77858 diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
77859 index 4afa4f8..1ed7824 100644
77860 --- a/include/linux/blkdev.h
77861 +++ b/include/linux/blkdev.h
77862 @@ -1572,7 +1572,7 @@ struct block_device_operations {
77863 /* this callback is with swap_lock and sometimes page table lock held */
77864 void (*swap_slot_free_notify) (struct block_device *, unsigned long);
77865 struct module *owner;
77866 -};
77867 +} __do_const;
77868
77869 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
77870 unsigned long);
77871 diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
77872 index afc1343..9735539 100644
77873 --- a/include/linux/blktrace_api.h
77874 +++ b/include/linux/blktrace_api.h
77875 @@ -25,7 +25,7 @@ struct blk_trace {
77876 struct dentry *dropped_file;
77877 struct dentry *msg_file;
77878 struct list_head running_list;
77879 - atomic_t dropped;
77880 + atomic_unchecked_t dropped;
77881 };
77882
77883 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
77884 diff --git a/include/linux/cache.h b/include/linux/cache.h
77885 index 17e7e82..1d7da26 100644
77886 --- a/include/linux/cache.h
77887 +++ b/include/linux/cache.h
77888 @@ -16,6 +16,14 @@
77889 #define __read_mostly
77890 #endif
77891
77892 +#ifndef __read_only
77893 +#ifdef CONFIG_PAX_KERNEXEC
77894 +#error KERNEXEC requires __read_only
77895 +#else
77896 +#define __read_only __read_mostly
77897 +#endif
77898 +#endif
77899 +
77900 #ifndef ____cacheline_aligned
77901 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
77902 #endif
77903 diff --git a/include/linux/capability.h b/include/linux/capability.h
77904 index a6ee1f9..e1ca49d 100644
77905 --- a/include/linux/capability.h
77906 +++ b/include/linux/capability.h
77907 @@ -212,8 +212,13 @@ extern bool capable(int cap);
77908 extern bool ns_capable(struct user_namespace *ns, int cap);
77909 extern bool inode_capable(const struct inode *inode, int cap);
77910 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
77911 +extern bool capable_nolog(int cap);
77912 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
77913 +extern bool inode_capable_nolog(const struct inode *inode, int cap);
77914
77915 /* audit system wants to get cap info from files as well */
77916 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
77917
77918 +extern int is_privileged_binary(const struct dentry *dentry);
77919 +
77920 #endif /* !_LINUX_CAPABILITY_H */
77921 diff --git a/include/linux/cdrom.h b/include/linux/cdrom.h
77922 index 8609d57..86e4d79 100644
77923 --- a/include/linux/cdrom.h
77924 +++ b/include/linux/cdrom.h
77925 @@ -87,7 +87,6 @@ struct cdrom_device_ops {
77926
77927 /* driver specifications */
77928 const int capability; /* capability flags */
77929 - int n_minors; /* number of active minor devices */
77930 /* handle uniform packets for scsi type devices (scsi,atapi) */
77931 int (*generic_packet) (struct cdrom_device_info *,
77932 struct packet_command *);
77933 diff --git a/include/linux/cleancache.h b/include/linux/cleancache.h
77934 index 4ce9056..86caac6 100644
77935 --- a/include/linux/cleancache.h
77936 +++ b/include/linux/cleancache.h
77937 @@ -31,7 +31,7 @@ struct cleancache_ops {
77938 void (*invalidate_page)(int, struct cleancache_filekey, pgoff_t);
77939 void (*invalidate_inode)(int, struct cleancache_filekey);
77940 void (*invalidate_fs)(int);
77941 -};
77942 +} __no_const;
77943
77944 extern struct cleancache_ops *
77945 cleancache_register_ops(struct cleancache_ops *ops);
77946 diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
77947 index 939533d..cf0a57c 100644
77948 --- a/include/linux/clk-provider.h
77949 +++ b/include/linux/clk-provider.h
77950 @@ -166,6 +166,7 @@ struct clk_ops {
77951 unsigned long parent_accuracy);
77952 void (*init)(struct clk_hw *hw);
77953 };
77954 +typedef struct clk_ops __no_const clk_ops_no_const;
77955
77956 /**
77957 * struct clk_init_data - holds init data that's common to all clocks and is
77958 diff --git a/include/linux/compat.h b/include/linux/compat.h
77959 index 3f448c6..df3ce1d 100644
77960 --- a/include/linux/compat.h
77961 +++ b/include/linux/compat.h
77962 @@ -313,7 +313,7 @@ compat_sys_get_robust_list(int pid, compat_uptr_t __user *head_ptr,
77963 compat_size_t __user *len_ptr);
77964
77965 asmlinkage long compat_sys_ipc(u32, int, int, u32, compat_uptr_t, u32);
77966 -asmlinkage long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg);
77967 +asmlinkage long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg) __intentional_overflow(0);
77968 asmlinkage long compat_sys_semctl(int semid, int semnum, int cmd, int arg);
77969 asmlinkage long compat_sys_msgsnd(int msqid, compat_uptr_t msgp,
77970 compat_ssize_t msgsz, int msgflg);
77971 @@ -420,7 +420,7 @@ extern int compat_ptrace_request(struct task_struct *child,
77972 extern long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
77973 compat_ulong_t addr, compat_ulong_t data);
77974 asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
77975 - compat_long_t addr, compat_long_t data);
77976 + compat_ulong_t addr, compat_ulong_t data);
77977
77978 asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
77979 /*
77980 diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
77981 index 2507fd2..55203f8 100644
77982 --- a/include/linux/compiler-gcc4.h
77983 +++ b/include/linux/compiler-gcc4.h
77984 @@ -39,9 +39,34 @@
77985 # define __compiletime_warning(message) __attribute__((warning(message)))
77986 # define __compiletime_error(message) __attribute__((error(message)))
77987 #endif /* __CHECKER__ */
77988 +
77989 +#define __alloc_size(...) __attribute((alloc_size(__VA_ARGS__)))
77990 +#define __bos(ptr, arg) __builtin_object_size((ptr), (arg))
77991 +#define __bos0(ptr) __bos((ptr), 0)
77992 +#define __bos1(ptr) __bos((ptr), 1)
77993 #endif /* GCC_VERSION >= 40300 */
77994
77995 #if GCC_VERSION >= 40500
77996 +
77997 +#ifdef RANDSTRUCT_PLUGIN
77998 +#define __randomize_layout __attribute__((randomize_layout))
77999 +#define __no_randomize_layout __attribute__((no_randomize_layout))
78000 +#endif
78001 +
78002 +#ifdef CONSTIFY_PLUGIN
78003 +#define __no_const __attribute__((no_const))
78004 +#define __do_const __attribute__((do_const))
78005 +#endif
78006 +
78007 +#ifdef SIZE_OVERFLOW_PLUGIN
78008 +#define __size_overflow(...) __attribute__((size_overflow(__VA_ARGS__)))
78009 +#define __intentional_overflow(...) __attribute__((intentional_overflow(__VA_ARGS__)))
78010 +#endif
78011 +
78012 +#ifdef LATENT_ENTROPY_PLUGIN
78013 +#define __latent_entropy __attribute__((latent_entropy))
78014 +#endif
78015 +
78016 /*
78017 * Mark a position in code as unreachable. This can be used to
78018 * suppress control flow warnings after asm blocks that transfer
78019 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
78020 index 2472740..4857634 100644
78021 --- a/include/linux/compiler.h
78022 +++ b/include/linux/compiler.h
78023 @@ -5,11 +5,14 @@
78024
78025 #ifdef __CHECKER__
78026 # define __user __attribute__((noderef, address_space(1)))
78027 +# define __force_user __force __user
78028 # define __kernel __attribute__((address_space(0)))
78029 +# define __force_kernel __force __kernel
78030 # define __safe __attribute__((safe))
78031 # define __force __attribute__((force))
78032 # define __nocast __attribute__((nocast))
78033 # define __iomem __attribute__((noderef, address_space(2)))
78034 +# define __force_iomem __force __iomem
78035 # define __must_hold(x) __attribute__((context(x,1,1)))
78036 # define __acquires(x) __attribute__((context(x,0,1)))
78037 # define __releases(x) __attribute__((context(x,1,0)))
78038 @@ -17,20 +20,37 @@
78039 # define __release(x) __context__(x,-1)
78040 # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0)
78041 # define __percpu __attribute__((noderef, address_space(3)))
78042 +# define __force_percpu __force __percpu
78043 #ifdef CONFIG_SPARSE_RCU_POINTER
78044 # define __rcu __attribute__((noderef, address_space(4)))
78045 +# define __force_rcu __force __rcu
78046 #else
78047 # define __rcu
78048 +# define __force_rcu
78049 #endif
78050 extern void __chk_user_ptr(const volatile void __user *);
78051 extern void __chk_io_ptr(const volatile void __iomem *);
78052 #else
78053 -# define __user
78054 -# define __kernel
78055 +# ifdef CHECKER_PLUGIN
78056 +//# define __user
78057 +//# define __force_user
78058 +//# define __kernel
78059 +//# define __force_kernel
78060 +# else
78061 +# ifdef STRUCTLEAK_PLUGIN
78062 +# define __user __attribute__((user))
78063 +# else
78064 +# define __user
78065 +# endif
78066 +# define __force_user
78067 +# define __kernel
78068 +# define __force_kernel
78069 +# endif
78070 # define __safe
78071 # define __force
78072 # define __nocast
78073 # define __iomem
78074 +# define __force_iomem
78075 # define __chk_user_ptr(x) (void)0
78076 # define __chk_io_ptr(x) (void)0
78077 # define __builtin_warning(x, y...) (1)
78078 @@ -41,7 +61,9 @@ extern void __chk_io_ptr(const volatile void __iomem *);
78079 # define __release(x) (void)0
78080 # define __cond_lock(x,c) (c)
78081 # define __percpu
78082 +# define __force_percpu
78083 # define __rcu
78084 +# define __force_rcu
78085 #endif
78086
78087 /* Indirect macros required for expanded argument pasting, eg. __LINE__. */
78088 @@ -279,6 +301,34 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
78089 # define __attribute_const__ /* unimplemented */
78090 #endif
78091
78092 +#ifndef __randomize_layout
78093 +# define __randomize_layout
78094 +#endif
78095 +
78096 +#ifndef __no_randomize_layout
78097 +# define __no_randomize_layout
78098 +#endif
78099 +
78100 +#ifndef __no_const
78101 +# define __no_const
78102 +#endif
78103 +
78104 +#ifndef __do_const
78105 +# define __do_const
78106 +#endif
78107 +
78108 +#ifndef __size_overflow
78109 +# define __size_overflow(...)
78110 +#endif
78111 +
78112 +#ifndef __intentional_overflow
78113 +# define __intentional_overflow(...)
78114 +#endif
78115 +
78116 +#ifndef __latent_entropy
78117 +# define __latent_entropy
78118 +#endif
78119 +
78120 /*
78121 * Tell gcc if a function is cold. The compiler will assume any path
78122 * directly leading to the call is unlikely.
78123 @@ -288,6 +338,22 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
78124 #define __cold
78125 #endif
78126
78127 +#ifndef __alloc_size
78128 +#define __alloc_size(...)
78129 +#endif
78130 +
78131 +#ifndef __bos
78132 +#define __bos(ptr, arg)
78133 +#endif
78134 +
78135 +#ifndef __bos0
78136 +#define __bos0(ptr)
78137 +#endif
78138 +
78139 +#ifndef __bos1
78140 +#define __bos1(ptr)
78141 +#endif
78142 +
78143 /* Simple shorthand for a section definition */
78144 #ifndef __section
78145 # define __section(S) __attribute__ ((__section__(#S)))
78146 @@ -362,7 +428,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
78147 * use is to mediate communication between process-level code and irq/NMI
78148 * handlers, all running on the same CPU.
78149 */
78150 -#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
78151 +#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
78152 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
78153
78154 /* Ignore/forbid kprobes attach on very low level functions marked by this attribute: */
78155 #ifdef CONFIG_KPROBES
78156 diff --git a/include/linux/completion.h b/include/linux/completion.h
78157 index 5d5aaae..0ea9b84 100644
78158 --- a/include/linux/completion.h
78159 +++ b/include/linux/completion.h
78160 @@ -90,16 +90,16 @@ static inline void reinit_completion(struct completion *x)
78161
78162 extern void wait_for_completion(struct completion *);
78163 extern void wait_for_completion_io(struct completion *);
78164 -extern int wait_for_completion_interruptible(struct completion *x);
78165 -extern int wait_for_completion_killable(struct completion *x);
78166 +extern int wait_for_completion_interruptible(struct completion *x) __intentional_overflow(-1);
78167 +extern int wait_for_completion_killable(struct completion *x) __intentional_overflow(-1);
78168 extern unsigned long wait_for_completion_timeout(struct completion *x,
78169 - unsigned long timeout);
78170 + unsigned long timeout) __intentional_overflow(-1);
78171 extern unsigned long wait_for_completion_io_timeout(struct completion *x,
78172 - unsigned long timeout);
78173 + unsigned long timeout) __intentional_overflow(-1);
78174 extern long wait_for_completion_interruptible_timeout(
78175 - struct completion *x, unsigned long timeout);
78176 + struct completion *x, unsigned long timeout) __intentional_overflow(-1);
78177 extern long wait_for_completion_killable_timeout(
78178 - struct completion *x, unsigned long timeout);
78179 + struct completion *x, unsigned long timeout) __intentional_overflow(-1);
78180 extern bool try_wait_for_completion(struct completion *x);
78181 extern bool completion_done(struct completion *x);
78182
78183 diff --git a/include/linux/configfs.h b/include/linux/configfs.h
78184 index 34025df..d94bbbc 100644
78185 --- a/include/linux/configfs.h
78186 +++ b/include/linux/configfs.h
78187 @@ -125,7 +125,7 @@ struct configfs_attribute {
78188 const char *ca_name;
78189 struct module *ca_owner;
78190 umode_t ca_mode;
78191 -};
78192 +} __do_const;
78193
78194 /*
78195 * Users often need to create attribute structures for their configurable
78196 diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
78197 index 4d89e0e..5281847 100644
78198 --- a/include/linux/cpufreq.h
78199 +++ b/include/linux/cpufreq.h
78200 @@ -191,6 +191,7 @@ struct global_attr {
78201 ssize_t (*store)(struct kobject *a, struct attribute *b,
78202 const char *c, size_t count);
78203 };
78204 +typedef struct global_attr __no_const global_attr_no_const;
78205
78206 #define define_one_global_ro(_name) \
78207 static struct global_attr _name = \
78208 @@ -232,7 +233,7 @@ struct cpufreq_driver {
78209 bool boost_supported;
78210 bool boost_enabled;
78211 int (*set_boost) (int state);
78212 -};
78213 +} __do_const;
78214
78215 /* flags */
78216 #define CPUFREQ_STICKY (1 << 0) /* driver isn't removed even if
78217 diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
78218 index 50fcbb0..9d2dbd9 100644
78219 --- a/include/linux/cpuidle.h
78220 +++ b/include/linux/cpuidle.h
78221 @@ -50,7 +50,8 @@ struct cpuidle_state {
78222 int index);
78223
78224 int (*enter_dead) (struct cpuidle_device *dev, int index);
78225 -};
78226 +} __do_const;
78227 +typedef struct cpuidle_state __no_const cpuidle_state_no_const;
78228
78229 /* Idle State Flags */
78230 #define CPUIDLE_FLAG_TIME_VALID (0x01) /* is residency time measurable? */
78231 @@ -192,7 +193,7 @@ struct cpuidle_governor {
78232 void (*reflect) (struct cpuidle_device *dev, int index);
78233
78234 struct module *owner;
78235 -};
78236 +} __do_const;
78237
78238 #ifdef CONFIG_CPU_IDLE
78239 extern int cpuidle_register_governor(struct cpuidle_governor *gov);
78240 diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
78241 index d08e4d2..95fad61 100644
78242 --- a/include/linux/cpumask.h
78243 +++ b/include/linux/cpumask.h
78244 @@ -118,17 +118,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
78245 }
78246
78247 /* Valid inputs for n are -1 and 0. */
78248 -static inline unsigned int cpumask_next(int n, const struct cpumask *srcp)
78249 +static inline unsigned int __intentional_overflow(-1) cpumask_next(int n, const struct cpumask *srcp)
78250 {
78251 return n+1;
78252 }
78253
78254 -static inline unsigned int cpumask_next_zero(int n, const struct cpumask *srcp)
78255 +static inline unsigned int __intentional_overflow(-1) cpumask_next_zero(int n, const struct cpumask *srcp)
78256 {
78257 return n+1;
78258 }
78259
78260 -static inline unsigned int cpumask_next_and(int n,
78261 +static inline unsigned int __intentional_overflow(-1) cpumask_next_and(int n,
78262 const struct cpumask *srcp,
78263 const struct cpumask *andp)
78264 {
78265 @@ -167,7 +167,7 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
78266 *
78267 * Returns >= nr_cpu_ids if no further cpus set.
78268 */
78269 -static inline unsigned int cpumask_next(int n, const struct cpumask *srcp)
78270 +static inline unsigned int __intentional_overflow(-1) cpumask_next(int n, const struct cpumask *srcp)
78271 {
78272 /* -1 is a legal arg here. */
78273 if (n != -1)
78274 @@ -182,7 +182,7 @@ static inline unsigned int cpumask_next(int n, const struct cpumask *srcp)
78275 *
78276 * Returns >= nr_cpu_ids if no further cpus unset.
78277 */
78278 -static inline unsigned int cpumask_next_zero(int n, const struct cpumask *srcp)
78279 +static inline unsigned int __intentional_overflow(-1) cpumask_next_zero(int n, const struct cpumask *srcp)
78280 {
78281 /* -1 is a legal arg here. */
78282 if (n != -1)
78283 @@ -190,7 +190,7 @@ static inline unsigned int cpumask_next_zero(int n, const struct cpumask *srcp)
78284 return find_next_zero_bit(cpumask_bits(srcp), nr_cpumask_bits, n+1);
78285 }
78286
78287 -int cpumask_next_and(int n, const struct cpumask *, const struct cpumask *);
78288 +int cpumask_next_and(int n, const struct cpumask *, const struct cpumask *) __intentional_overflow(-1);
78289 int cpumask_any_but(const struct cpumask *mask, unsigned int cpu);
78290
78291 /**
78292 diff --git a/include/linux/cred.h b/include/linux/cred.h
78293 index 04421e8..a85afd4 100644
78294 --- a/include/linux/cred.h
78295 +++ b/include/linux/cred.h
78296 @@ -35,7 +35,7 @@ struct group_info {
78297 int nblocks;
78298 kgid_t small_block[NGROUPS_SMALL];
78299 kgid_t *blocks[0];
78300 -};
78301 +} __randomize_layout;
78302
78303 /**
78304 * get_group_info - Get a reference to a group info structure
78305 @@ -136,7 +136,7 @@ struct cred {
78306 struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
78307 struct group_info *group_info; /* supplementary groups for euid/fsgid */
78308 struct rcu_head rcu; /* RCU deletion hook */
78309 -};
78310 +} __randomize_layout;
78311
78312 extern void __put_cred(struct cred *);
78313 extern void exit_creds(struct task_struct *);
78314 @@ -194,6 +194,9 @@ static inline void validate_creds_for_do_exit(struct task_struct *tsk)
78315 static inline void validate_process_creds(void)
78316 {
78317 }
78318 +static inline void validate_task_creds(struct task_struct *task)
78319 +{
78320 +}
78321 #endif
78322
78323 /**
78324 @@ -322,6 +325,7 @@ static inline void put_cred(const struct cred *_cred)
78325
78326 #define task_uid(task) (task_cred_xxx((task), uid))
78327 #define task_euid(task) (task_cred_xxx((task), euid))
78328 +#define task_securebits(task) (task_cred_xxx((task), securebits))
78329
78330 #define current_cred_xxx(xxx) \
78331 ({ \
78332 diff --git a/include/linux/crypto.h b/include/linux/crypto.h
78333 index b92eadf..b4ecdc1 100644
78334 --- a/include/linux/crypto.h
78335 +++ b/include/linux/crypto.h
78336 @@ -373,7 +373,7 @@ struct cipher_tfm {
78337 const u8 *key, unsigned int keylen);
78338 void (*cit_encrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
78339 void (*cit_decrypt_one)(struct crypto_tfm *tfm, u8 *dst, const u8 *src);
78340 -};
78341 +} __no_const;
78342
78343 struct hash_tfm {
78344 int (*init)(struct hash_desc *desc);
78345 @@ -394,13 +394,13 @@ struct compress_tfm {
78346 int (*cot_decompress)(struct crypto_tfm *tfm,
78347 const u8 *src, unsigned int slen,
78348 u8 *dst, unsigned int *dlen);
78349 -};
78350 +} __no_const;
78351
78352 struct rng_tfm {
78353 int (*rng_gen_random)(struct crypto_rng *tfm, u8 *rdata,
78354 unsigned int dlen);
78355 int (*rng_reset)(struct crypto_rng *tfm, u8 *seed, unsigned int slen);
78356 -};
78357 +} __no_const;
78358
78359 #define crt_ablkcipher crt_u.ablkcipher
78360 #define crt_aead crt_u.aead
78361 diff --git a/include/linux/ctype.h b/include/linux/ctype.h
78362 index 653589e..4ef254a 100644
78363 --- a/include/linux/ctype.h
78364 +++ b/include/linux/ctype.h
78365 @@ -56,7 +56,7 @@ static inline unsigned char __toupper(unsigned char c)
78366 * Fast implementation of tolower() for internal usage. Do not use in your
78367 * code.
78368 */
78369 -static inline char _tolower(const char c)
78370 +static inline unsigned char _tolower(const unsigned char c)
78371 {
78372 return c | 0x20;
78373 }
78374 diff --git a/include/linux/dcache.h b/include/linux/dcache.h
78375 index bf72e9a..4ca7927 100644
78376 --- a/include/linux/dcache.h
78377 +++ b/include/linux/dcache.h
78378 @@ -133,7 +133,7 @@ struct dentry {
78379 } d_u;
78380 struct list_head d_subdirs; /* our children */
78381 struct hlist_node d_alias; /* inode alias list */
78382 -};
78383 +} __randomize_layout;
78384
78385 /*
78386 * dentry->d_lock spinlock nesting subclasses:
78387 diff --git a/include/linux/decompress/mm.h b/include/linux/decompress/mm.h
78388 index 7925bf0..d5143d2 100644
78389 --- a/include/linux/decompress/mm.h
78390 +++ b/include/linux/decompress/mm.h
78391 @@ -77,7 +77,7 @@ static void free(void *where)
78392 * warnings when not needed (indeed large_malloc / large_free are not
78393 * needed by inflate */
78394
78395 -#define malloc(a) kmalloc(a, GFP_KERNEL)
78396 +#define malloc(a) kmalloc((a), GFP_KERNEL)
78397 #define free(a) kfree(a)
78398
78399 #define large_malloc(a) vmalloc(a)
78400 diff --git a/include/linux/devfreq.h b/include/linux/devfreq.h
78401 index d48dc00..211ee54 100644
78402 --- a/include/linux/devfreq.h
78403 +++ b/include/linux/devfreq.h
78404 @@ -114,7 +114,7 @@ struct devfreq_governor {
78405 int (*get_target_freq)(struct devfreq *this, unsigned long *freq);
78406 int (*event_handler)(struct devfreq *devfreq,
78407 unsigned int event, void *data);
78408 -};
78409 +} __do_const;
78410
78411 /**
78412 * struct devfreq - Device devfreq structure
78413 diff --git a/include/linux/device.h b/include/linux/device.h
78414 index 952b010..d5b7691 100644
78415 --- a/include/linux/device.h
78416 +++ b/include/linux/device.h
78417 @@ -310,7 +310,7 @@ struct subsys_interface {
78418 struct list_head node;
78419 int (*add_dev)(struct device *dev, struct subsys_interface *sif);
78420 int (*remove_dev)(struct device *dev, struct subsys_interface *sif);
78421 -};
78422 +} __do_const;
78423
78424 int subsys_interface_register(struct subsys_interface *sif);
78425 void subsys_interface_unregister(struct subsys_interface *sif);
78426 @@ -506,7 +506,7 @@ struct device_type {
78427 void (*release)(struct device *dev);
78428
78429 const struct dev_pm_ops *pm;
78430 -};
78431 +} __do_const;
78432
78433 /* interface for exporting device attributes */
78434 struct device_attribute {
78435 @@ -516,11 +516,12 @@ struct device_attribute {
78436 ssize_t (*store)(struct device *dev, struct device_attribute *attr,
78437 const char *buf, size_t count);
78438 };
78439 +typedef struct device_attribute __no_const device_attribute_no_const;
78440
78441 struct dev_ext_attribute {
78442 struct device_attribute attr;
78443 void *var;
78444 -};
78445 +} __do_const;
78446
78447 ssize_t device_show_ulong(struct device *dev, struct device_attribute *attr,
78448 char *buf);
78449 diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
78450 index fd4aee2..1f28db9 100644
78451 --- a/include/linux/dma-mapping.h
78452 +++ b/include/linux/dma-mapping.h
78453 @@ -54,7 +54,7 @@ struct dma_map_ops {
78454 u64 (*get_required_mask)(struct device *dev);
78455 #endif
78456 int is_phys;
78457 -};
78458 +} __do_const;
78459
78460 #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
78461
78462 diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
78463 index c5c92d5..6a5c2b2 100644
78464 --- a/include/linux/dmaengine.h
78465 +++ b/include/linux/dmaengine.h
78466 @@ -1150,9 +1150,9 @@ struct dma_pinned_list {
78467 struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len);
78468 void dma_unpin_iovec_pages(struct dma_pinned_list* pinned_list);
78469
78470 -dma_cookie_t dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
78471 +dma_cookie_t __intentional_overflow(0) dma_memcpy_to_iovec(struct dma_chan *chan, struct iovec *iov,
78472 struct dma_pinned_list *pinned_list, unsigned char *kdata, size_t len);
78473 -dma_cookie_t dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
78474 +dma_cookie_t __intentional_overflow(0) dma_memcpy_pg_to_iovec(struct dma_chan *chan, struct iovec *iov,
78475 struct dma_pinned_list *pinned_list, struct page *page,
78476 unsigned int offset, size_t len);
78477
78478 diff --git a/include/linux/efi.h b/include/linux/efi.h
78479 index 0a819e7..8ed47f1 100644
78480 --- a/include/linux/efi.h
78481 +++ b/include/linux/efi.h
78482 @@ -768,6 +768,7 @@ struct efivar_operations {
78483 efi_set_variable_t *set_variable;
78484 efi_query_variable_store_t *query_variable_store;
78485 };
78486 +typedef struct efivar_operations __no_const efivar_operations_no_const;
78487
78488 struct efivars {
78489 /*
78490 diff --git a/include/linux/elf.h b/include/linux/elf.h
78491 index 67a5fa7..b817372 100644
78492 --- a/include/linux/elf.h
78493 +++ b/include/linux/elf.h
78494 @@ -24,6 +24,7 @@ extern Elf32_Dyn _DYNAMIC [];
78495 #define elf_note elf32_note
78496 #define elf_addr_t Elf32_Off
78497 #define Elf_Half Elf32_Half
78498 +#define elf_dyn Elf32_Dyn
78499
78500 #else
78501
78502 @@ -34,6 +35,7 @@ extern Elf64_Dyn _DYNAMIC [];
78503 #define elf_note elf64_note
78504 #define elf_addr_t Elf64_Off
78505 #define Elf_Half Elf64_Half
78506 +#define elf_dyn Elf64_Dyn
78507
78508 #endif
78509
78510 diff --git a/include/linux/err.h b/include/linux/err.h
78511 index 15f92e0..e825a8e 100644
78512 --- a/include/linux/err.h
78513 +++ b/include/linux/err.h
78514 @@ -19,12 +19,12 @@
78515
78516 #define IS_ERR_VALUE(x) unlikely((x) >= (unsigned long)-MAX_ERRNO)
78517
78518 -static inline void * __must_check ERR_PTR(long error)
78519 +static inline void * __must_check __intentional_overflow(-1) ERR_PTR(long error)
78520 {
78521 return (void *) error;
78522 }
78523
78524 -static inline long __must_check PTR_ERR(__force const void *ptr)
78525 +static inline long __must_check __intentional_overflow(-1) PTR_ERR(__force const void *ptr)
78526 {
78527 return (long) ptr;
78528 }
78529 diff --git a/include/linux/extcon.h b/include/linux/extcon.h
78530 index 21c59af..6057a03 100644
78531 --- a/include/linux/extcon.h
78532 +++ b/include/linux/extcon.h
78533 @@ -135,7 +135,7 @@ struct extcon_dev {
78534 /* /sys/class/extcon/.../mutually_exclusive/... */
78535 struct attribute_group attr_g_muex;
78536 struct attribute **attrs_muex;
78537 - struct device_attribute *d_attrs_muex;
78538 + device_attribute_no_const *d_attrs_muex;
78539 };
78540
78541 /**
78542 diff --git a/include/linux/fb.h b/include/linux/fb.h
78543 index fe6ac95..898d41d 100644
78544 --- a/include/linux/fb.h
78545 +++ b/include/linux/fb.h
78546 @@ -304,7 +304,7 @@ struct fb_ops {
78547 /* called at KDB enter and leave time to prepare the console */
78548 int (*fb_debug_enter)(struct fb_info *info);
78549 int (*fb_debug_leave)(struct fb_info *info);
78550 -};
78551 +} __do_const;
78552
78553 #ifdef CONFIG_FB_TILEBLITTING
78554 #define FB_TILE_CURSOR_NONE 0
78555 diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
78556 index 70e8e21..1939916 100644
78557 --- a/include/linux/fdtable.h
78558 +++ b/include/linux/fdtable.h
78559 @@ -102,7 +102,7 @@ struct files_struct *get_files_struct(struct task_struct *);
78560 void put_files_struct(struct files_struct *fs);
78561 void reset_files_struct(struct files_struct *);
78562 int unshare_files(struct files_struct **);
78563 -struct files_struct *dup_fd(struct files_struct *, int *);
78564 +struct files_struct *dup_fd(struct files_struct *, int *) __latent_entropy;
78565 void do_close_on_exec(struct files_struct *);
78566 int iterate_fd(struct files_struct *, unsigned,
78567 int (*)(const void *, struct file *, unsigned),
78568 diff --git a/include/linux/frontswap.h b/include/linux/frontswap.h
78569 index 8293262..2b3b8bd 100644
78570 --- a/include/linux/frontswap.h
78571 +++ b/include/linux/frontswap.h
78572 @@ -11,7 +11,7 @@ struct frontswap_ops {
78573 int (*load)(unsigned, pgoff_t, struct page *);
78574 void (*invalidate_page)(unsigned, pgoff_t);
78575 void (*invalidate_area)(unsigned);
78576 -};
78577 +} __no_const;
78578
78579 extern bool frontswap_enabled;
78580 extern struct frontswap_ops *
78581 diff --git a/include/linux/fs.h b/include/linux/fs.h
78582 index 23b2a35..8764ab7 100644
78583 --- a/include/linux/fs.h
78584 +++ b/include/linux/fs.h
78585 @@ -426,7 +426,7 @@ struct address_space {
78586 spinlock_t private_lock; /* for use by the address_space */
78587 struct list_head private_list; /* ditto */
78588 void *private_data; /* ditto */
78589 -} __attribute__((aligned(sizeof(long))));
78590 +} __attribute__((aligned(sizeof(long)))) __randomize_layout;
78591 /*
78592 * On most architectures that alignment is already the case; but
78593 * must be enforced here for CRIS, to let the least significant bit
78594 @@ -469,7 +469,7 @@ struct block_device {
78595 int bd_fsfreeze_count;
78596 /* Mutex for freeze */
78597 struct mutex bd_fsfreeze_mutex;
78598 -};
78599 +} __randomize_layout;
78600
78601 /*
78602 * Radix-tree tags, for tagging dirty and writeback pages within the pagecache
78603 @@ -613,7 +613,7 @@ struct inode {
78604 atomic_t i_readcount; /* struct files open RO */
78605 #endif
78606 void *i_private; /* fs or device private pointer */
78607 -};
78608 +} __randomize_layout;
78609
78610 static inline int inode_unhashed(struct inode *inode)
78611 {
78612 @@ -812,7 +812,7 @@ struct file {
78613 #ifdef CONFIG_DEBUG_WRITECOUNT
78614 unsigned long f_mnt_write_state;
78615 #endif
78616 -} __attribute__((aligned(4))); /* lest something weird decides that 2 is OK */
78617 +} __attribute__((aligned(4))) __randomize_layout; /* lest something weird decides that 2 is OK */
78618
78619 struct file_handle {
78620 __u32 handle_bytes;
78621 @@ -982,7 +982,7 @@ struct file_lock {
78622 int state; /* state of grant or error if -ve */
78623 } afs;
78624 } fl_u;
78625 -};
78626 +} __randomize_layout;
78627
78628 /* The following constant reflects the upper bound of the file/locking space */
78629 #ifndef OFFSET_MAX
78630 @@ -1329,7 +1329,7 @@ struct super_block {
78631 struct list_lru s_dentry_lru ____cacheline_aligned_in_smp;
78632 struct list_lru s_inode_lru ____cacheline_aligned_in_smp;
78633 struct rcu_head rcu;
78634 -};
78635 +} __randomize_layout;
78636
78637 extern struct timespec current_fs_time(struct super_block *sb);
78638
78639 @@ -1551,7 +1551,8 @@ struct file_operations {
78640 long (*fallocate)(struct file *file, int mode, loff_t offset,
78641 loff_t len);
78642 int (*show_fdinfo)(struct seq_file *m, struct file *f);
78643 -};
78644 +} __do_const __randomize_layout;
78645 +typedef struct file_operations __no_const file_operations_no_const;
78646
78647 struct inode_operations {
78648 struct dentry * (*lookup) (struct inode *,struct dentry *, unsigned int);
78649 @@ -2820,4 +2821,14 @@ static inline bool dir_relax(struct inode *inode)
78650 return !IS_DEADDIR(inode);
78651 }
78652
78653 +static inline bool is_sidechannel_device(const struct inode *inode)
78654 +{
78655 +#ifdef CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL
78656 + umode_t mode = inode->i_mode;
78657 + return ((S_ISCHR(mode) || S_ISBLK(mode)) && (mode & (S_IROTH | S_IWOTH)));
78658 +#else
78659 + return false;
78660 +#endif
78661 +}
78662 +
78663 #endif /* _LINUX_FS_H */
78664 diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
78665 index 0efc3e6..fd23610 100644
78666 --- a/include/linux/fs_struct.h
78667 +++ b/include/linux/fs_struct.h
78668 @@ -6,13 +6,13 @@
78669 #include <linux/seqlock.h>
78670
78671 struct fs_struct {
78672 - int users;
78673 + atomic_t users;
78674 spinlock_t lock;
78675 seqcount_t seq;
78676 int umask;
78677 int in_exec;
78678 struct path root, pwd;
78679 -};
78680 +} __randomize_layout;
78681
78682 extern struct kmem_cache *fs_cachep;
78683
78684 diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
78685 index 7714849..a4a5c7a 100644
78686 --- a/include/linux/fscache-cache.h
78687 +++ b/include/linux/fscache-cache.h
78688 @@ -113,7 +113,7 @@ struct fscache_operation {
78689 fscache_operation_release_t release;
78690 };
78691
78692 -extern atomic_t fscache_op_debug_id;
78693 +extern atomic_unchecked_t fscache_op_debug_id;
78694 extern void fscache_op_work_func(struct work_struct *work);
78695
78696 extern void fscache_enqueue_operation(struct fscache_operation *);
78697 @@ -135,7 +135,7 @@ static inline void fscache_operation_init(struct fscache_operation *op,
78698 INIT_WORK(&op->work, fscache_op_work_func);
78699 atomic_set(&op->usage, 1);
78700 op->state = FSCACHE_OP_ST_INITIALISED;
78701 - op->debug_id = atomic_inc_return(&fscache_op_debug_id);
78702 + op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
78703 op->processor = processor;
78704 op->release = release;
78705 INIT_LIST_HEAD(&op->pend_link);
78706 diff --git a/include/linux/fscache.h b/include/linux/fscache.h
78707 index 115bb81..e7b812b 100644
78708 --- a/include/linux/fscache.h
78709 +++ b/include/linux/fscache.h
78710 @@ -152,7 +152,7 @@ struct fscache_cookie_def {
78711 * - this is mandatory for any object that may have data
78712 */
78713 void (*now_uncached)(void *cookie_netfs_data);
78714 -};
78715 +} __do_const;
78716
78717 /*
78718 * fscache cached network filesystem type
78719 diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
78720 index 1c804b0..1432c2b 100644
78721 --- a/include/linux/fsnotify.h
78722 +++ b/include/linux/fsnotify.h
78723 @@ -195,6 +195,9 @@ static inline void fsnotify_access(struct file *file)
78724 struct inode *inode = file_inode(file);
78725 __u32 mask = FS_ACCESS;
78726
78727 + if (is_sidechannel_device(inode))
78728 + return;
78729 +
78730 if (S_ISDIR(inode->i_mode))
78731 mask |= FS_ISDIR;
78732
78733 @@ -213,6 +216,9 @@ static inline void fsnotify_modify(struct file *file)
78734 struct inode *inode = file_inode(file);
78735 __u32 mask = FS_MODIFY;
78736
78737 + if (is_sidechannel_device(inode))
78738 + return;
78739 +
78740 if (S_ISDIR(inode->i_mode))
78741 mask |= FS_ISDIR;
78742
78743 @@ -315,7 +321,7 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid)
78744 */
78745 static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
78746 {
78747 - return kstrdup(name, GFP_KERNEL);
78748 + return (const unsigned char *)kstrdup((const char *)name, GFP_KERNEL);
78749 }
78750
78751 /*
78752 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
78753 index 9f3c275..8bdff5d 100644
78754 --- a/include/linux/genhd.h
78755 +++ b/include/linux/genhd.h
78756 @@ -194,7 +194,7 @@ struct gendisk {
78757 struct kobject *slave_dir;
78758
78759 struct timer_rand_state *random;
78760 - atomic_t sync_io; /* RAID */
78761 + atomic_unchecked_t sync_io; /* RAID */
78762 struct disk_events *ev;
78763 #ifdef CONFIG_BLK_DEV_INTEGRITY
78764 struct blk_integrity *integrity;
78765 @@ -435,7 +435,7 @@ extern void disk_flush_events(struct gendisk *disk, unsigned int mask);
78766 extern unsigned int disk_clear_events(struct gendisk *disk, unsigned int mask);
78767
78768 /* drivers/char/random.c */
78769 -extern void add_disk_randomness(struct gendisk *disk);
78770 +extern void add_disk_randomness(struct gendisk *disk) __latent_entropy;
78771 extern void rand_initialize_disk(struct gendisk *disk);
78772
78773 static inline sector_t get_start_sect(struct block_device *bdev)
78774 diff --git a/include/linux/genl_magic_func.h b/include/linux/genl_magic_func.h
78775 index c0894dd..2fbf10c 100644
78776 --- a/include/linux/genl_magic_func.h
78777 +++ b/include/linux/genl_magic_func.h
78778 @@ -246,7 +246,7 @@ const char *CONCAT_(GENL_MAGIC_FAMILY, _genl_cmd_to_str)(__u8 cmd)
78779 },
78780
78781 #define ZZZ_genl_ops CONCAT_(GENL_MAGIC_FAMILY, _genl_ops)
78782 -static struct genl_ops ZZZ_genl_ops[] __read_mostly = {
78783 +static struct genl_ops ZZZ_genl_ops[] = {
78784 #include GENL_MAGIC_INCLUDE_FILE
78785 };
78786
78787 diff --git a/include/linux/gfp.h b/include/linux/gfp.h
78788 index 39b81dc..819dc51 100644
78789 --- a/include/linux/gfp.h
78790 +++ b/include/linux/gfp.h
78791 @@ -36,6 +36,13 @@ struct vm_area_struct;
78792 #define ___GFP_NO_KSWAPD 0x400000u
78793 #define ___GFP_OTHER_NODE 0x800000u
78794 #define ___GFP_WRITE 0x1000000u
78795 +
78796 +#ifdef CONFIG_PAX_USERCOPY_SLABS
78797 +#define ___GFP_USERCOPY 0x2000000u
78798 +#else
78799 +#define ___GFP_USERCOPY 0
78800 +#endif
78801 +
78802 /* If the above are modified, __GFP_BITS_SHIFT may need updating */
78803
78804 /*
78805 @@ -93,6 +100,7 @@ struct vm_area_struct;
78806 #define __GFP_OTHER_NODE ((__force gfp_t)___GFP_OTHER_NODE) /* On behalf of other node */
78807 #define __GFP_KMEMCG ((__force gfp_t)___GFP_KMEMCG) /* Allocation comes from a memcg-accounted resource */
78808 #define __GFP_WRITE ((__force gfp_t)___GFP_WRITE) /* Allocator intends to dirty page */
78809 +#define __GFP_USERCOPY ((__force gfp_t)___GFP_USERCOPY)/* Allocator intends to copy page to/from userland */
78810
78811 /*
78812 * This may seem redundant, but it's a way of annotating false positives vs.
78813 @@ -100,7 +108,7 @@ struct vm_area_struct;
78814 */
78815 #define __GFP_NOTRACK_FALSE_POSITIVE (__GFP_NOTRACK)
78816
78817 -#define __GFP_BITS_SHIFT 25 /* Room for N __GFP_FOO bits */
78818 +#define __GFP_BITS_SHIFT 26 /* Room for N __GFP_FOO bits */
78819 #define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))
78820
78821 /* This equals 0, but use constants in case they ever change */
78822 @@ -158,6 +166,8 @@ struct vm_area_struct;
78823 /* 4GB DMA on some platforms */
78824 #define GFP_DMA32 __GFP_DMA32
78825
78826 +#define GFP_USERCOPY __GFP_USERCOPY
78827 +
78828 /* Convert GFP flags to their corresponding migrate type */
78829 static inline int allocflags_to_migratetype(gfp_t gfp_flags)
78830 {
78831 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
78832 new file mode 100644
78833 index 0000000..edb2cb6
78834 --- /dev/null
78835 +++ b/include/linux/gracl.h
78836 @@ -0,0 +1,340 @@
78837 +#ifndef GR_ACL_H
78838 +#define GR_ACL_H
78839 +
78840 +#include <linux/grdefs.h>
78841 +#include <linux/resource.h>
78842 +#include <linux/capability.h>
78843 +#include <linux/dcache.h>
78844 +#include <asm/resource.h>
78845 +
78846 +/* Major status information */
78847 +
78848 +#define GR_VERSION "grsecurity 3.0"
78849 +#define GRSECURITY_VERSION 0x3000
78850 +
78851 +enum {
78852 + GR_SHUTDOWN = 0,
78853 + GR_ENABLE = 1,
78854 + GR_SPROLE = 2,
78855 + GR_OLDRELOAD = 3,
78856 + GR_SEGVMOD = 4,
78857 + GR_STATUS = 5,
78858 + GR_UNSPROLE = 6,
78859 + GR_PASSSET = 7,
78860 + GR_SPROLEPAM = 8,
78861 + GR_RELOAD = 9,
78862 +};
78863 +
78864 +/* Password setup definitions
78865 + * kernel/grhash.c */
78866 +enum {
78867 + GR_PW_LEN = 128,
78868 + GR_SALT_LEN = 16,
78869 + GR_SHA_LEN = 32,
78870 +};
78871 +
78872 +enum {
78873 + GR_SPROLE_LEN = 64,
78874 +};
78875 +
78876 +enum {
78877 + GR_NO_GLOB = 0,
78878 + GR_REG_GLOB,
78879 + GR_CREATE_GLOB
78880 +};
78881 +
78882 +#define GR_NLIMITS 32
78883 +
78884 +/* Begin Data Structures */
78885 +
78886 +struct sprole_pw {
78887 + unsigned char *rolename;
78888 + unsigned char salt[GR_SALT_LEN];
78889 + unsigned char sum[GR_SHA_LEN]; /* 256-bit SHA hash of the password */
78890 +};
78891 +
78892 +struct name_entry {
78893 + __u32 key;
78894 + ino_t inode;
78895 + dev_t device;
78896 + char *name;
78897 + __u16 len;
78898 + __u8 deleted;
78899 + struct name_entry *prev;
78900 + struct name_entry *next;
78901 +};
78902 +
78903 +struct inodev_entry {
78904 + struct name_entry *nentry;
78905 + struct inodev_entry *prev;
78906 + struct inodev_entry *next;
78907 +};
78908 +
78909 +struct acl_role_db {
78910 + struct acl_role_label **r_hash;
78911 + __u32 r_size;
78912 +};
78913 +
78914 +struct inodev_db {
78915 + struct inodev_entry **i_hash;
78916 + __u32 i_size;
78917 +};
78918 +
78919 +struct name_db {
78920 + struct name_entry **n_hash;
78921 + __u32 n_size;
78922 +};
78923 +
78924 +struct crash_uid {
78925 + uid_t uid;
78926 + unsigned long expires;
78927 +};
78928 +
78929 +struct gr_hash_struct {
78930 + void **table;
78931 + void **nametable;
78932 + void *first;
78933 + __u32 table_size;
78934 + __u32 used_size;
78935 + int type;
78936 +};
78937 +
78938 +/* Userspace Grsecurity ACL data structures */
78939 +
78940 +struct acl_subject_label {
78941 + char *filename;
78942 + ino_t inode;
78943 + dev_t device;
78944 + __u32 mode;
78945 + kernel_cap_t cap_mask;
78946 + kernel_cap_t cap_lower;
78947 + kernel_cap_t cap_invert_audit;
78948 +
78949 + struct rlimit res[GR_NLIMITS];
78950 + __u32 resmask;
78951 +
78952 + __u8 user_trans_type;
78953 + __u8 group_trans_type;
78954 + uid_t *user_transitions;
78955 + gid_t *group_transitions;
78956 + __u16 user_trans_num;
78957 + __u16 group_trans_num;
78958 +
78959 + __u32 sock_families[2];
78960 + __u32 ip_proto[8];
78961 + __u32 ip_type;
78962 + struct acl_ip_label **ips;
78963 + __u32 ip_num;
78964 + __u32 inaddr_any_override;
78965 +
78966 + __u32 crashes;
78967 + unsigned long expires;
78968 +
78969 + struct acl_subject_label *parent_subject;
78970 + struct gr_hash_struct *hash;
78971 + struct acl_subject_label *prev;
78972 + struct acl_subject_label *next;
78973 +
78974 + struct acl_object_label **obj_hash;
78975 + __u32 obj_hash_size;
78976 + __u16 pax_flags;
78977 +};
78978 +
78979 +struct role_allowed_ip {
78980 + __u32 addr;
78981 + __u32 netmask;
78982 +
78983 + struct role_allowed_ip *prev;
78984 + struct role_allowed_ip *next;
78985 +};
78986 +
78987 +struct role_transition {
78988 + char *rolename;
78989 +
78990 + struct role_transition *prev;
78991 + struct role_transition *next;
78992 +};
78993 +
78994 +struct acl_role_label {
78995 + char *rolename;
78996 + uid_t uidgid;
78997 + __u16 roletype;
78998 +
78999 + __u16 auth_attempts;
79000 + unsigned long expires;
79001 +
79002 + struct acl_subject_label *root_label;
79003 + struct gr_hash_struct *hash;
79004 +
79005 + struct acl_role_label *prev;
79006 + struct acl_role_label *next;
79007 +
79008 + struct role_transition *transitions;
79009 + struct role_allowed_ip *allowed_ips;
79010 + uid_t *domain_children;
79011 + __u16 domain_child_num;
79012 +
79013 + umode_t umask;
79014 +
79015 + struct acl_subject_label **subj_hash;
79016 + __u32 subj_hash_size;
79017 +};
79018 +
79019 +struct user_acl_role_db {
79020 + struct acl_role_label **r_table;
79021 + __u32 num_pointers; /* Number of allocations to track */
79022 + __u32 num_roles; /* Number of roles */
79023 + __u32 num_domain_children; /* Number of domain children */
79024 + __u32 num_subjects; /* Number of subjects */
79025 + __u32 num_objects; /* Number of objects */
79026 +};
79027 +
79028 +struct acl_object_label {
79029 + char *filename;
79030 + ino_t inode;
79031 + dev_t device;
79032 + __u32 mode;
79033 +
79034 + struct acl_subject_label *nested;
79035 + struct acl_object_label *globbed;
79036 +
79037 + /* next two structures not used */
79038 +
79039 + struct acl_object_label *prev;
79040 + struct acl_object_label *next;
79041 +};
79042 +
79043 +struct acl_ip_label {
79044 + char *iface;
79045 + __u32 addr;
79046 + __u32 netmask;
79047 + __u16 low, high;
79048 + __u8 mode;
79049 + __u32 type;
79050 + __u32 proto[8];
79051 +
79052 + /* next two structures not used */
79053 +
79054 + struct acl_ip_label *prev;
79055 + struct acl_ip_label *next;
79056 +};
79057 +
79058 +struct gr_arg {
79059 + struct user_acl_role_db role_db;
79060 + unsigned char pw[GR_PW_LEN];
79061 + unsigned char salt[GR_SALT_LEN];
79062 + unsigned char sum[GR_SHA_LEN];
79063 + unsigned char sp_role[GR_SPROLE_LEN];
79064 + struct sprole_pw *sprole_pws;
79065 + dev_t segv_device;
79066 + ino_t segv_inode;
79067 + uid_t segv_uid;
79068 + __u16 num_sprole_pws;
79069 + __u16 mode;
79070 +};
79071 +
79072 +struct gr_arg_wrapper {
79073 + struct gr_arg *arg;
79074 + __u32 version;
79075 + __u32 size;
79076 +};
79077 +
79078 +struct subject_map {
79079 + struct acl_subject_label *user;
79080 + struct acl_subject_label *kernel;
79081 + struct subject_map *prev;
79082 + struct subject_map *next;
79083 +};
79084 +
79085 +struct acl_subj_map_db {
79086 + struct subject_map **s_hash;
79087 + __u32 s_size;
79088 +};
79089 +
79090 +struct gr_policy_state {
79091 + struct sprole_pw **acl_special_roles;
79092 + __u16 num_sprole_pws;
79093 + struct acl_role_label *kernel_role;
79094 + struct acl_role_label *role_list;
79095 + struct acl_role_label *default_role;
79096 + struct acl_role_db acl_role_set;
79097 + struct acl_subj_map_db subj_map_set;
79098 + struct name_db name_set;
79099 + struct inodev_db inodev_set;
79100 +};
79101 +
79102 +struct gr_alloc_state {
79103 + unsigned long alloc_stack_next;
79104 + unsigned long alloc_stack_size;
79105 + void **alloc_stack;
79106 +};
79107 +
79108 +struct gr_reload_state {
79109 + struct gr_policy_state oldpolicy;
79110 + struct gr_alloc_state oldalloc;
79111 + struct gr_policy_state newpolicy;
79112 + struct gr_alloc_state newalloc;
79113 + struct gr_policy_state *oldpolicy_ptr;
79114 + struct gr_alloc_state *oldalloc_ptr;
79115 + unsigned char oldmode;
79116 +};
79117 +
79118 +/* End Data Structures Section */
79119 +
79120 +/* Hash functions generated by empirical testing by Brad Spengler
79121 + Makes good use of the low bits of the inode. Generally 0-1 times
79122 + in loop for successful match. 0-3 for unsuccessful match.
79123 + Shift/add algorithm with modulus of table size and an XOR*/
79124 +
79125 +static __inline__ unsigned int
79126 +gr_rhash(const uid_t uid, const __u16 type, const unsigned int sz)
79127 +{
79128 + return ((((uid + type) << (16 + type)) ^ uid) % sz);
79129 +}
79130 +
79131 + static __inline__ unsigned int
79132 +gr_shash(const struct acl_subject_label *userp, const unsigned int sz)
79133 +{
79134 + return ((const unsigned long)userp % sz);
79135 +}
79136 +
79137 +static __inline__ unsigned int
79138 +gr_fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
79139 +{
79140 + return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
79141 +}
79142 +
79143 +static __inline__ unsigned int
79144 +gr_nhash(const char *name, const __u16 len, const unsigned int sz)
79145 +{
79146 + return full_name_hash((const unsigned char *)name, len) % sz;
79147 +}
79148 +
79149 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
79150 + subj = NULL; \
79151 + iter = 0; \
79152 + while (iter < role->subj_hash_size) { \
79153 + if (subj == NULL) \
79154 + subj = role->subj_hash[iter]; \
79155 + if (subj == NULL) { \
79156 + iter++; \
79157 + continue; \
79158 + }
79159 +
79160 +#define FOR_EACH_SUBJECT_END(subj,iter) \
79161 + subj = subj->next; \
79162 + if (subj == NULL) \
79163 + iter++; \
79164 + }
79165 +
79166 +
79167 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
79168 + subj = role->hash->first; \
79169 + while (subj != NULL) {
79170 +
79171 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
79172 + subj = subj->next; \
79173 + }
79174 +
79175 +#endif
79176 +
79177 diff --git a/include/linux/gracl_compat.h b/include/linux/gracl_compat.h
79178 new file mode 100644
79179 index 0000000..33ebd1f
79180 --- /dev/null
79181 +++ b/include/linux/gracl_compat.h
79182 @@ -0,0 +1,156 @@
79183 +#ifndef GR_ACL_COMPAT_H
79184 +#define GR_ACL_COMPAT_H
79185 +
79186 +#include <linux/resource.h>
79187 +#include <asm/resource.h>
79188 +
79189 +struct sprole_pw_compat {
79190 + compat_uptr_t rolename;
79191 + unsigned char salt[GR_SALT_LEN];
79192 + unsigned char sum[GR_SHA_LEN];
79193 +};
79194 +
79195 +struct gr_hash_struct_compat {
79196 + compat_uptr_t table;
79197 + compat_uptr_t nametable;
79198 + compat_uptr_t first;
79199 + __u32 table_size;
79200 + __u32 used_size;
79201 + int type;
79202 +};
79203 +
79204 +struct acl_subject_label_compat {
79205 + compat_uptr_t filename;
79206 + compat_ino_t inode;
79207 + __u32 device;
79208 + __u32 mode;
79209 + kernel_cap_t cap_mask;
79210 + kernel_cap_t cap_lower;
79211 + kernel_cap_t cap_invert_audit;
79212 +
79213 + struct compat_rlimit res[GR_NLIMITS];
79214 + __u32 resmask;
79215 +
79216 + __u8 user_trans_type;
79217 + __u8 group_trans_type;
79218 + compat_uptr_t user_transitions;
79219 + compat_uptr_t group_transitions;
79220 + __u16 user_trans_num;
79221 + __u16 group_trans_num;
79222 +
79223 + __u32 sock_families[2];
79224 + __u32 ip_proto[8];
79225 + __u32 ip_type;
79226 + compat_uptr_t ips;
79227 + __u32 ip_num;
79228 + __u32 inaddr_any_override;
79229 +
79230 + __u32 crashes;
79231 + compat_ulong_t expires;
79232 +
79233 + compat_uptr_t parent_subject;
79234 + compat_uptr_t hash;
79235 + compat_uptr_t prev;
79236 + compat_uptr_t next;
79237 +
79238 + compat_uptr_t obj_hash;
79239 + __u32 obj_hash_size;
79240 + __u16 pax_flags;
79241 +};
79242 +
79243 +struct role_allowed_ip_compat {
79244 + __u32 addr;
79245 + __u32 netmask;
79246 +
79247 + compat_uptr_t prev;
79248 + compat_uptr_t next;
79249 +};
79250 +
79251 +struct role_transition_compat {
79252 + compat_uptr_t rolename;
79253 +
79254 + compat_uptr_t prev;
79255 + compat_uptr_t next;
79256 +};
79257 +
79258 +struct acl_role_label_compat {
79259 + compat_uptr_t rolename;
79260 + uid_t uidgid;
79261 + __u16 roletype;
79262 +
79263 + __u16 auth_attempts;
79264 + compat_ulong_t expires;
79265 +
79266 + compat_uptr_t root_label;
79267 + compat_uptr_t hash;
79268 +
79269 + compat_uptr_t prev;
79270 + compat_uptr_t next;
79271 +
79272 + compat_uptr_t transitions;
79273 + compat_uptr_t allowed_ips;
79274 + compat_uptr_t domain_children;
79275 + __u16 domain_child_num;
79276 +
79277 + umode_t umask;
79278 +
79279 + compat_uptr_t subj_hash;
79280 + __u32 subj_hash_size;
79281 +};
79282 +
79283 +struct user_acl_role_db_compat {
79284 + compat_uptr_t r_table;
79285 + __u32 num_pointers;
79286 + __u32 num_roles;
79287 + __u32 num_domain_children;
79288 + __u32 num_subjects;
79289 + __u32 num_objects;
79290 +};
79291 +
79292 +struct acl_object_label_compat {
79293 + compat_uptr_t filename;
79294 + compat_ino_t inode;
79295 + __u32 device;
79296 + __u32 mode;
79297 +
79298 + compat_uptr_t nested;
79299 + compat_uptr_t globbed;
79300 +
79301 + compat_uptr_t prev;
79302 + compat_uptr_t next;
79303 +};
79304 +
79305 +struct acl_ip_label_compat {
79306 + compat_uptr_t iface;
79307 + __u32 addr;
79308 + __u32 netmask;
79309 + __u16 low, high;
79310 + __u8 mode;
79311 + __u32 type;
79312 + __u32 proto[8];
79313 +
79314 + compat_uptr_t prev;
79315 + compat_uptr_t next;
79316 +};
79317 +
79318 +struct gr_arg_compat {
79319 + struct user_acl_role_db_compat role_db;
79320 + unsigned char pw[GR_PW_LEN];
79321 + unsigned char salt[GR_SALT_LEN];
79322 + unsigned char sum[GR_SHA_LEN];
79323 + unsigned char sp_role[GR_SPROLE_LEN];
79324 + compat_uptr_t sprole_pws;
79325 + __u32 segv_device;
79326 + compat_ino_t segv_inode;
79327 + uid_t segv_uid;
79328 + __u16 num_sprole_pws;
79329 + __u16 mode;
79330 +};
79331 +
79332 +struct gr_arg_wrapper_compat {
79333 + compat_uptr_t arg;
79334 + __u32 version;
79335 + __u32 size;
79336 +};
79337 +
79338 +#endif
79339 diff --git a/include/linux/gralloc.h b/include/linux/gralloc.h
79340 new file mode 100644
79341 index 0000000..323ecf2
79342 --- /dev/null
79343 +++ b/include/linux/gralloc.h
79344 @@ -0,0 +1,9 @@
79345 +#ifndef __GRALLOC_H
79346 +#define __GRALLOC_H
79347 +
79348 +void acl_free_all(void);
79349 +int acl_alloc_stack_init(unsigned long size);
79350 +void *acl_alloc(unsigned long len);
79351 +void *acl_alloc_num(unsigned long num, unsigned long len);
79352 +
79353 +#endif
79354 diff --git a/include/linux/grdefs.h b/include/linux/grdefs.h
79355 new file mode 100644
79356 index 0000000..be66033
79357 --- /dev/null
79358 +++ b/include/linux/grdefs.h
79359 @@ -0,0 +1,140 @@
79360 +#ifndef GRDEFS_H
79361 +#define GRDEFS_H
79362 +
79363 +/* Begin grsecurity status declarations */
79364 +
79365 +enum {
79366 + GR_READY = 0x01,
79367 + GR_STATUS_INIT = 0x00 // disabled state
79368 +};
79369 +
79370 +/* Begin ACL declarations */
79371 +
79372 +/* Role flags */
79373 +
79374 +enum {
79375 + GR_ROLE_USER = 0x0001,
79376 + GR_ROLE_GROUP = 0x0002,
79377 + GR_ROLE_DEFAULT = 0x0004,
79378 + GR_ROLE_SPECIAL = 0x0008,
79379 + GR_ROLE_AUTH = 0x0010,
79380 + GR_ROLE_NOPW = 0x0020,
79381 + GR_ROLE_GOD = 0x0040,
79382 + GR_ROLE_LEARN = 0x0080,
79383 + GR_ROLE_TPE = 0x0100,
79384 + GR_ROLE_DOMAIN = 0x0200,
79385 + GR_ROLE_PAM = 0x0400,
79386 + GR_ROLE_PERSIST = 0x0800
79387 +};
79388 +
79389 +/* ACL Subject and Object mode flags */
79390 +enum {
79391 + GR_DELETED = 0x80000000
79392 +};
79393 +
79394 +/* ACL Object-only mode flags */
79395 +enum {
79396 + GR_READ = 0x00000001,
79397 + GR_APPEND = 0x00000002,
79398 + GR_WRITE = 0x00000004,
79399 + GR_EXEC = 0x00000008,
79400 + GR_FIND = 0x00000010,
79401 + GR_INHERIT = 0x00000020,
79402 + GR_SETID = 0x00000040,
79403 + GR_CREATE = 0x00000080,
79404 + GR_DELETE = 0x00000100,
79405 + GR_LINK = 0x00000200,
79406 + GR_AUDIT_READ = 0x00000400,
79407 + GR_AUDIT_APPEND = 0x00000800,
79408 + GR_AUDIT_WRITE = 0x00001000,
79409 + GR_AUDIT_EXEC = 0x00002000,
79410 + GR_AUDIT_FIND = 0x00004000,
79411 + GR_AUDIT_INHERIT= 0x00008000,
79412 + GR_AUDIT_SETID = 0x00010000,
79413 + GR_AUDIT_CREATE = 0x00020000,
79414 + GR_AUDIT_DELETE = 0x00040000,
79415 + GR_AUDIT_LINK = 0x00080000,
79416 + GR_PTRACERD = 0x00100000,
79417 + GR_NOPTRACE = 0x00200000,
79418 + GR_SUPPRESS = 0x00400000,
79419 + GR_NOLEARN = 0x00800000,
79420 + GR_INIT_TRANSFER= 0x01000000
79421 +};
79422 +
79423 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
79424 + GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
79425 + GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
79426 +
79427 +/* ACL subject-only mode flags */
79428 +enum {
79429 + GR_KILL = 0x00000001,
79430 + GR_VIEW = 0x00000002,
79431 + GR_PROTECTED = 0x00000004,
79432 + GR_LEARN = 0x00000008,
79433 + GR_OVERRIDE = 0x00000010,
79434 + /* just a placeholder, this mode is only used in userspace */
79435 + GR_DUMMY = 0x00000020,
79436 + GR_PROTSHM = 0x00000040,
79437 + GR_KILLPROC = 0x00000080,
79438 + GR_KILLIPPROC = 0x00000100,
79439 + /* just a placeholder, this mode is only used in userspace */
79440 + GR_NOTROJAN = 0x00000200,
79441 + GR_PROTPROCFD = 0x00000400,
79442 + GR_PROCACCT = 0x00000800,
79443 + GR_RELAXPTRACE = 0x00001000,
79444 + //GR_NESTED = 0x00002000,
79445 + GR_INHERITLEARN = 0x00004000,
79446 + GR_PROCFIND = 0x00008000,
79447 + GR_POVERRIDE = 0x00010000,
79448 + GR_KERNELAUTH = 0x00020000,
79449 + GR_ATSECURE = 0x00040000,
79450 + GR_SHMEXEC = 0x00080000
79451 +};
79452 +
79453 +enum {
79454 + GR_PAX_ENABLE_SEGMEXEC = 0x0001,
79455 + GR_PAX_ENABLE_PAGEEXEC = 0x0002,
79456 + GR_PAX_ENABLE_MPROTECT = 0x0004,
79457 + GR_PAX_ENABLE_RANDMMAP = 0x0008,
79458 + GR_PAX_ENABLE_EMUTRAMP = 0x0010,
79459 + GR_PAX_DISABLE_SEGMEXEC = 0x0100,
79460 + GR_PAX_DISABLE_PAGEEXEC = 0x0200,
79461 + GR_PAX_DISABLE_MPROTECT = 0x0400,
79462 + GR_PAX_DISABLE_RANDMMAP = 0x0800,
79463 + GR_PAX_DISABLE_EMUTRAMP = 0x1000,
79464 +};
79465 +
79466 +enum {
79467 + GR_ID_USER = 0x01,
79468 + GR_ID_GROUP = 0x02,
79469 +};
79470 +
79471 +enum {
79472 + GR_ID_ALLOW = 0x01,
79473 + GR_ID_DENY = 0x02,
79474 +};
79475 +
79476 +#define GR_CRASH_RES 31
79477 +#define GR_UIDTABLE_MAX 500
79478 +
79479 +/* begin resource learning section */
79480 +enum {
79481 + GR_RLIM_CPU_BUMP = 60,
79482 + GR_RLIM_FSIZE_BUMP = 50000,
79483 + GR_RLIM_DATA_BUMP = 10000,
79484 + GR_RLIM_STACK_BUMP = 1000,
79485 + GR_RLIM_CORE_BUMP = 10000,
79486 + GR_RLIM_RSS_BUMP = 500000,
79487 + GR_RLIM_NPROC_BUMP = 1,
79488 + GR_RLIM_NOFILE_BUMP = 5,
79489 + GR_RLIM_MEMLOCK_BUMP = 50000,
79490 + GR_RLIM_AS_BUMP = 500000,
79491 + GR_RLIM_LOCKS_BUMP = 2,
79492 + GR_RLIM_SIGPENDING_BUMP = 5,
79493 + GR_RLIM_MSGQUEUE_BUMP = 10000,
79494 + GR_RLIM_NICE_BUMP = 1,
79495 + GR_RLIM_RTPRIO_BUMP = 1,
79496 + GR_RLIM_RTTIME_BUMP = 1000000
79497 +};
79498 +
79499 +#endif
79500 diff --git a/include/linux/grinternal.h b/include/linux/grinternal.h
79501 new file mode 100644
79502 index 0000000..d25522e
79503 --- /dev/null
79504 +++ b/include/linux/grinternal.h
79505 @@ -0,0 +1,229 @@
79506 +#ifndef __GRINTERNAL_H
79507 +#define __GRINTERNAL_H
79508 +
79509 +#ifdef CONFIG_GRKERNSEC
79510 +
79511 +#include <linux/fs.h>
79512 +#include <linux/mnt_namespace.h>
79513 +#include <linux/nsproxy.h>
79514 +#include <linux/gracl.h>
79515 +#include <linux/grdefs.h>
79516 +#include <linux/grmsg.h>
79517 +
79518 +void gr_add_learn_entry(const char *fmt, ...)
79519 + __attribute__ ((format (printf, 1, 2)));
79520 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
79521 + const struct vfsmount *mnt);
79522 +__u32 gr_check_create(const struct dentry *new_dentry,
79523 + const struct dentry *parent,
79524 + const struct vfsmount *mnt, const __u32 mode);
79525 +int gr_check_protected_task(const struct task_struct *task);
79526 +__u32 to_gr_audit(const __u32 reqmode);
79527 +int gr_set_acls(const int type);
79528 +int gr_acl_is_enabled(void);
79529 +char gr_roletype_to_char(void);
79530 +
79531 +void gr_handle_alertkill(struct task_struct *task);
79532 +char *gr_to_filename(const struct dentry *dentry,
79533 + const struct vfsmount *mnt);
79534 +char *gr_to_filename1(const struct dentry *dentry,
79535 + const struct vfsmount *mnt);
79536 +char *gr_to_filename2(const struct dentry *dentry,
79537 + const struct vfsmount *mnt);
79538 +char *gr_to_filename3(const struct dentry *dentry,
79539 + const struct vfsmount *mnt);
79540 +
79541 +extern int grsec_enable_ptrace_readexec;
79542 +extern int grsec_enable_harden_ptrace;
79543 +extern int grsec_enable_link;
79544 +extern int grsec_enable_fifo;
79545 +extern int grsec_enable_execve;
79546 +extern int grsec_enable_shm;
79547 +extern int grsec_enable_execlog;
79548 +extern int grsec_enable_signal;
79549 +extern int grsec_enable_audit_ptrace;
79550 +extern int grsec_enable_forkfail;
79551 +extern int grsec_enable_time;
79552 +extern int grsec_enable_rofs;
79553 +extern int grsec_deny_new_usb;
79554 +extern int grsec_enable_chroot_shmat;
79555 +extern int grsec_enable_chroot_mount;
79556 +extern int grsec_enable_chroot_double;
79557 +extern int grsec_enable_chroot_pivot;
79558 +extern int grsec_enable_chroot_chdir;
79559 +extern int grsec_enable_chroot_chmod;
79560 +extern int grsec_enable_chroot_mknod;
79561 +extern int grsec_enable_chroot_fchdir;
79562 +extern int grsec_enable_chroot_nice;
79563 +extern int grsec_enable_chroot_execlog;
79564 +extern int grsec_enable_chroot_caps;
79565 +extern int grsec_enable_chroot_sysctl;
79566 +extern int grsec_enable_chroot_unix;
79567 +extern int grsec_enable_symlinkown;
79568 +extern kgid_t grsec_symlinkown_gid;
79569 +extern int grsec_enable_tpe;
79570 +extern kgid_t grsec_tpe_gid;
79571 +extern int grsec_enable_tpe_all;
79572 +extern int grsec_enable_tpe_invert;
79573 +extern int grsec_enable_socket_all;
79574 +extern kgid_t grsec_socket_all_gid;
79575 +extern int grsec_enable_socket_client;
79576 +extern kgid_t grsec_socket_client_gid;
79577 +extern int grsec_enable_socket_server;
79578 +extern kgid_t grsec_socket_server_gid;
79579 +extern kgid_t grsec_audit_gid;
79580 +extern int grsec_enable_group;
79581 +extern int grsec_enable_log_rwxmaps;
79582 +extern int grsec_enable_mount;
79583 +extern int grsec_enable_chdir;
79584 +extern int grsec_resource_logging;
79585 +extern int grsec_enable_blackhole;
79586 +extern int grsec_lastack_retries;
79587 +extern int grsec_enable_brute;
79588 +extern int grsec_enable_harden_ipc;
79589 +extern int grsec_lock;
79590 +
79591 +extern spinlock_t grsec_alert_lock;
79592 +extern unsigned long grsec_alert_wtime;
79593 +extern unsigned long grsec_alert_fyet;
79594 +
79595 +extern spinlock_t grsec_audit_lock;
79596 +
79597 +extern rwlock_t grsec_exec_file_lock;
79598 +
79599 +#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
79600 + gr_to_filename2((tsk)->exec_file->f_path.dentry, \
79601 + (tsk)->exec_file->f_path.mnt) : "/")
79602 +
79603 +#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
79604 + gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
79605 + (tsk)->real_parent->exec_file->f_path.mnt) : "/")
79606 +
79607 +#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
79608 + gr_to_filename((tsk)->exec_file->f_path.dentry, \
79609 + (tsk)->exec_file->f_path.mnt) : "/")
79610 +
79611 +#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
79612 + gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
79613 + (tsk)->real_parent->exec_file->f_path.mnt) : "/")
79614 +
79615 +#define proc_is_chrooted(tsk_a) ((tsk_a)->gr_is_chrooted)
79616 +
79617 +#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
79618 +
79619 +static inline bool gr_is_same_file(const struct file *file1, const struct file *file2)
79620 +{
79621 + if (file1 && file2) {
79622 + const struct inode *inode1 = file1->f_path.dentry->d_inode;
79623 + const struct inode *inode2 = file2->f_path.dentry->d_inode;
79624 + if (inode1->i_ino == inode2->i_ino && inode1->i_sb->s_dev == inode2->i_sb->s_dev)
79625 + return true;
79626 + }
79627 +
79628 + return false;
79629 +}
79630 +
79631 +#define GR_CHROOT_CAPS {{ \
79632 + CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
79633 + CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
79634 + CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
79635 + CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
79636 + CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
79637 + CAP_TO_MASK(CAP_IPC_OWNER) | CAP_TO_MASK(CAP_SETFCAP), \
79638 + CAP_TO_MASK(CAP_SYSLOG) | CAP_TO_MASK(CAP_MAC_ADMIN) }}
79639 +
79640 +#define security_learn(normal_msg,args...) \
79641 +({ \
79642 + read_lock(&grsec_exec_file_lock); \
79643 + gr_add_learn_entry(normal_msg "\n", ## args); \
79644 + read_unlock(&grsec_exec_file_lock); \
79645 +})
79646 +
79647 +enum {
79648 + GR_DO_AUDIT,
79649 + GR_DONT_AUDIT,
79650 + /* used for non-audit messages that we shouldn't kill the task on */
79651 + GR_DONT_AUDIT_GOOD
79652 +};
79653 +
79654 +enum {
79655 + GR_TTYSNIFF,
79656 + GR_RBAC,
79657 + GR_RBAC_STR,
79658 + GR_STR_RBAC,
79659 + GR_RBAC_MODE2,
79660 + GR_RBAC_MODE3,
79661 + GR_FILENAME,
79662 + GR_SYSCTL_HIDDEN,
79663 + GR_NOARGS,
79664 + GR_ONE_INT,
79665 + GR_ONE_INT_TWO_STR,
79666 + GR_ONE_STR,
79667 + GR_STR_INT,
79668 + GR_TWO_STR_INT,
79669 + GR_TWO_INT,
79670 + GR_TWO_U64,
79671 + GR_THREE_INT,
79672 + GR_FIVE_INT_TWO_STR,
79673 + GR_TWO_STR,
79674 + GR_THREE_STR,
79675 + GR_FOUR_STR,
79676 + GR_STR_FILENAME,
79677 + GR_FILENAME_STR,
79678 + GR_FILENAME_TWO_INT,
79679 + GR_FILENAME_TWO_INT_STR,
79680 + GR_TEXTREL,
79681 + GR_PTRACE,
79682 + GR_RESOURCE,
79683 + GR_CAP,
79684 + GR_SIG,
79685 + GR_SIG2,
79686 + GR_CRASH1,
79687 + GR_CRASH2,
79688 + GR_PSACCT,
79689 + GR_RWXMAP,
79690 + GR_RWXMAPVMA
79691 +};
79692 +
79693 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
79694 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
79695 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
79696 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
79697 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
79698 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
79699 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
79700 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
79701 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
79702 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
79703 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
79704 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
79705 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
79706 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
79707 +#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
79708 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
79709 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
79710 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
79711 +#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
79712 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
79713 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
79714 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
79715 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
79716 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
79717 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
79718 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
79719 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
79720 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
79721 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
79722 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
79723 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
79724 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
79725 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
79726 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
79727 +#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
79728 +#define gr_log_rwxmap_vma(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAPVMA, str)
79729 +
79730 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
79731 +
79732 +#endif
79733 +
79734 +#endif
79735 diff --git a/include/linux/grmsg.h b/include/linux/grmsg.h
79736 new file mode 100644
79737 index 0000000..ba93581
79738 --- /dev/null
79739 +++ b/include/linux/grmsg.h
79740 @@ -0,0 +1,116 @@
79741 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
79742 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
79743 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
79744 +#define GR_STOPMOD_MSG "denied modification of module state by "
79745 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
79746 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
79747 +#define GR_IOPERM_MSG "denied use of ioperm() by "
79748 +#define GR_IOPL_MSG "denied use of iopl() by "
79749 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
79750 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
79751 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
79752 +#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
79753 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
79754 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
79755 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
79756 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
79757 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
79758 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
79759 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
79760 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
79761 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
79762 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
79763 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
79764 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
79765 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
79766 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
79767 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
79768 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
79769 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
79770 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
79771 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
79772 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
79773 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
79774 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
79775 +#define GR_EXEC_TPE_MSG "denied untrusted exec (due to %.70s) of %.950s by "
79776 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
79777 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
79778 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
79779 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
79780 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
79781 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
79782 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
79783 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
79784 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
79785 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
79786 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
79787 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
79788 +#define GR_SETXATTR_ACL_MSG "%s setting extended attribute of %.950s by "
79789 +#define GR_REMOVEXATTR_ACL_MSG "%s removing extended attribute of %.950s by "
79790 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
79791 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
79792 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
79793 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbage by "
79794 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
79795 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
79796 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
79797 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
79798 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
79799 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
79800 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
79801 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
79802 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
79803 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
79804 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
79805 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
79806 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
79807 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
79808 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
79809 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
79810 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
79811 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
79812 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
79813 +#define GR_FAILFORK_MSG "failed fork with errno %s by "
79814 +#define GR_NICE_CHROOT_MSG "denied priority change by "
79815 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
79816 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
79817 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
79818 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
79819 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
79820 +#define GR_TIME_MSG "time set by "
79821 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
79822 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
79823 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
79824 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
79825 +#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
79826 +#define GR_BIND_MSG "denied bind() by "
79827 +#define GR_CONNECT_MSG "denied connect() by "
79828 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
79829 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
79830 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
79831 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
79832 +#define GR_CAP_ACL_MSG "use of %s denied for "
79833 +#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for "
79834 +#define GR_CAP_ACL_MSG2 "use of %s permitted for "
79835 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
79836 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
79837 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
79838 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
79839 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
79840 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
79841 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
79842 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
79843 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
79844 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
79845 +#define GR_TEXTREL_AUDIT_MSG "denied text relocation in %.950s, VMA:0x%08lx 0x%08lx by "
79846 +#define GR_PTGNUSTACK_MSG "denied marking stack executable as requested by PT_GNU_STACK marking in %.950s by "
79847 +#define GR_VM86_MSG "denied use of vm86 by "
79848 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
79849 +#define GR_PTRACE_READEXEC_MSG "denied ptrace of unreadable binary %.950s by "
79850 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
79851 +#define GR_BADPROCPID_MSG "denied read of sensitive /proc/pid/%s entry via fd passed across exec by "
79852 +#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by "
79853 +#define GR_BRUTE_DAEMON_MSG "bruteforce prevention initiated for the next 30 minutes or until service restarted, stalling each fork 30 seconds. Please investigate the crash report for "
79854 +#define GR_BRUTE_SUID_MSG "bruteforce prevention initiated due to crash of %.950s against uid %u, banning suid/sgid execs for %u minutes. Please investigate the crash report for "
79855 +#define GR_IPC_DENIED_MSG "denied %s of overly-permissive IPC object with creator uid %u by "
79856 +#define GR_MSRWRITE_MSG "denied write to CPU MSR by "
79857 diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h
79858 new file mode 100644
79859 index 0000000..f2d8c6c
79860 --- /dev/null
79861 +++ b/include/linux/grsecurity.h
79862 @@ -0,0 +1,248 @@
79863 +#ifndef GR_SECURITY_H
79864 +#define GR_SECURITY_H
79865 +#include <linux/fs.h>
79866 +#include <linux/fs_struct.h>
79867 +#include <linux/binfmts.h>
79868 +#include <linux/gracl.h>
79869 +
79870 +/* notify of brain-dead configs */
79871 +#if defined(CONFIG_GRKERNSEC_PROC_USER) && defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
79872 +#error "CONFIG_GRKERNSEC_PROC_USER and CONFIG_GRKERNSEC_PROC_USERGROUP cannot both be enabled."
79873 +#endif
79874 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
79875 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
79876 +#endif
79877 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
79878 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
79879 +#endif
79880 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
79881 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
79882 +#endif
79883 +
79884 +int gr_handle_new_usb(void);
79885 +
79886 +void gr_handle_brute_attach(int dumpable);
79887 +void gr_handle_brute_check(void);
79888 +void gr_handle_kernel_exploit(void);
79889 +
79890 +char gr_roletype_to_char(void);
79891 +
79892 +int gr_proc_is_restricted(void);
79893 +
79894 +int gr_acl_enable_at_secure(void);
79895 +
79896 +int gr_check_user_change(kuid_t real, kuid_t effective, kuid_t fs);
79897 +int gr_check_group_change(kgid_t real, kgid_t effective, kgid_t fs);
79898 +
79899 +void gr_del_task_from_ip_table(struct task_struct *p);
79900 +
79901 +int gr_pid_is_chrooted(struct task_struct *p);
79902 +int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
79903 +int gr_handle_chroot_nice(void);
79904 +int gr_handle_chroot_sysctl(const int op);
79905 +int gr_handle_chroot_setpriority(struct task_struct *p,
79906 + const int niceval);
79907 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
79908 +int gr_handle_chroot_chroot(const struct dentry *dentry,
79909 + const struct vfsmount *mnt);
79910 +void gr_handle_chroot_chdir(const struct path *path);
79911 +int gr_handle_chroot_chmod(const struct dentry *dentry,
79912 + const struct vfsmount *mnt, const int mode);
79913 +int gr_handle_chroot_mknod(const struct dentry *dentry,
79914 + const struct vfsmount *mnt, const int mode);
79915 +int gr_handle_chroot_mount(const struct dentry *dentry,
79916 + const struct vfsmount *mnt,
79917 + const char *dev_name);
79918 +int gr_handle_chroot_pivot(void);
79919 +int gr_handle_chroot_unix(const pid_t pid);
79920 +
79921 +int gr_handle_rawio(const struct inode *inode);
79922 +
79923 +void gr_handle_ioperm(void);
79924 +void gr_handle_iopl(void);
79925 +void gr_handle_msr_write(void);
79926 +
79927 +umode_t gr_acl_umask(void);
79928 +
79929 +int gr_tpe_allow(const struct file *file);
79930 +
79931 +void gr_set_chroot_entries(struct task_struct *task, const struct path *path);
79932 +void gr_clear_chroot_entries(struct task_struct *task);
79933 +
79934 +void gr_log_forkfail(const int retval);
79935 +void gr_log_timechange(void);
79936 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
79937 +void gr_log_chdir(const struct dentry *dentry,
79938 + const struct vfsmount *mnt);
79939 +void gr_log_chroot_exec(const struct dentry *dentry,
79940 + const struct vfsmount *mnt);
79941 +void gr_log_remount(const char *devname, const int retval);
79942 +void gr_log_unmount(const char *devname, const int retval);
79943 +void gr_log_mount(const char *from, const char *to, const int retval);
79944 +void gr_log_textrel(struct vm_area_struct *vma);
79945 +void gr_log_ptgnustack(struct file *file);
79946 +void gr_log_rwxmmap(struct file *file);
79947 +void gr_log_rwxmprotect(struct vm_area_struct *vma);
79948 +
79949 +int gr_handle_follow_link(const struct inode *parent,
79950 + const struct inode *inode,
79951 + const struct dentry *dentry,
79952 + const struct vfsmount *mnt);
79953 +int gr_handle_fifo(const struct dentry *dentry,
79954 + const struct vfsmount *mnt,
79955 + const struct dentry *dir, const int flag,
79956 + const int acc_mode);
79957 +int gr_handle_hardlink(const struct dentry *dentry,
79958 + const struct vfsmount *mnt,
79959 + struct inode *inode,
79960 + const int mode, const struct filename *to);
79961 +
79962 +int gr_is_capable(const int cap);
79963 +int gr_is_capable_nolog(const int cap);
79964 +int gr_task_is_capable(const struct task_struct *task, const struct cred *cred, const int cap);
79965 +int gr_task_is_capable_nolog(const struct task_struct *task, const int cap);
79966 +
79967 +void gr_copy_label(struct task_struct *tsk);
79968 +void gr_handle_crash(struct task_struct *task, const int sig);
79969 +int gr_handle_signal(const struct task_struct *p, const int sig);
79970 +int gr_check_crash_uid(const kuid_t uid);
79971 +int gr_check_protected_task(const struct task_struct *task);
79972 +int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
79973 +int gr_acl_handle_mmap(const struct file *file,
79974 + const unsigned long prot);
79975 +int gr_acl_handle_mprotect(const struct file *file,
79976 + const unsigned long prot);
79977 +int gr_check_hidden_task(const struct task_struct *tsk);
79978 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
79979 + const struct vfsmount *mnt);
79980 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
79981 + const struct vfsmount *mnt);
79982 +__u32 gr_acl_handle_access(const struct dentry *dentry,
79983 + const struct vfsmount *mnt, const int fmode);
79984 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
79985 + const struct vfsmount *mnt, umode_t *mode);
79986 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
79987 + const struct vfsmount *mnt);
79988 +__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
79989 + const struct vfsmount *mnt);
79990 +__u32 gr_acl_handle_removexattr(const struct dentry *dentry,
79991 + const struct vfsmount *mnt);
79992 +int gr_handle_ptrace(struct task_struct *task, const long request);
79993 +int gr_handle_proc_ptrace(struct task_struct *task);
79994 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
79995 + const struct vfsmount *mnt);
79996 +int gr_check_crash_exec(const struct file *filp);
79997 +int gr_acl_is_enabled(void);
79998 +void gr_set_role_label(struct task_struct *task, const kuid_t uid,
79999 + const kgid_t gid);
80000 +int gr_set_proc_label(const struct dentry *dentry,
80001 + const struct vfsmount *mnt,
80002 + const int unsafe_flags);
80003 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
80004 + const struct vfsmount *mnt);
80005 +__u32 gr_acl_handle_open(const struct dentry *dentry,
80006 + const struct vfsmount *mnt, int acc_mode);
80007 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
80008 + const struct dentry *p_dentry,
80009 + const struct vfsmount *p_mnt,
80010 + int open_flags, int acc_mode, const int imode);
80011 +void gr_handle_create(const struct dentry *dentry,
80012 + const struct vfsmount *mnt);
80013 +void gr_handle_proc_create(const struct dentry *dentry,
80014 + const struct inode *inode);
80015 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
80016 + const struct dentry *parent_dentry,
80017 + const struct vfsmount *parent_mnt,
80018 + const int mode);
80019 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
80020 + const struct dentry *parent_dentry,
80021 + const struct vfsmount *parent_mnt);
80022 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
80023 + const struct vfsmount *mnt);
80024 +void gr_handle_delete(const ino_t ino, const dev_t dev);
80025 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
80026 + const struct vfsmount *mnt);
80027 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
80028 + const struct dentry *parent_dentry,
80029 + const struct vfsmount *parent_mnt,
80030 + const struct filename *from);
80031 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
80032 + const struct dentry *parent_dentry,
80033 + const struct vfsmount *parent_mnt,
80034 + const struct dentry *old_dentry,
80035 + const struct vfsmount *old_mnt, const struct filename *to);
80036 +int gr_handle_symlink_owner(const struct path *link, const struct inode *target);
80037 +int gr_acl_handle_rename(struct dentry *new_dentry,
80038 + struct dentry *parent_dentry,
80039 + const struct vfsmount *parent_mnt,
80040 + struct dentry *old_dentry,
80041 + struct inode *old_parent_inode,
80042 + struct vfsmount *old_mnt, const struct filename *newname);
80043 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
80044 + struct dentry *old_dentry,
80045 + struct dentry *new_dentry,
80046 + struct vfsmount *mnt, const __u8 replace);
80047 +__u32 gr_check_link(const struct dentry *new_dentry,
80048 + const struct dentry *parent_dentry,
80049 + const struct vfsmount *parent_mnt,
80050 + const struct dentry *old_dentry,
80051 + const struct vfsmount *old_mnt);
80052 +int gr_acl_handle_filldir(const struct file *file, const char *name,
80053 + const unsigned int namelen, const ino_t ino);
80054 +
80055 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
80056 + const struct vfsmount *mnt);
80057 +void gr_acl_handle_exit(void);
80058 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
80059 +int gr_acl_handle_procpidmem(const struct task_struct *task);
80060 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
80061 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
80062 +void gr_audit_ptrace(struct task_struct *task);
80063 +dev_t gr_get_dev_from_dentry(struct dentry *dentry);
80064 +void gr_put_exec_file(struct task_struct *task);
80065 +
80066 +int gr_ptrace_readexec(struct file *file, int unsafe_flags);
80067 +
80068 +#if defined(CONFIG_GRKERNSEC) && (defined(CONFIG_GRKERNSEC_RESLOG) || !defined(CONFIG_GRKERNSEC_NO_RBAC))
80069 +extern void gr_learn_resource(const struct task_struct *task, const int res,
80070 + const unsigned long wanted, const int gt);
80071 +#else
80072 +static inline void gr_learn_resource(const struct task_struct *task, const int res,
80073 + const unsigned long wanted, const int gt)
80074 +{
80075 +}
80076 +#endif
80077 +
80078 +#ifdef CONFIG_GRKERNSEC_RESLOG
80079 +extern void gr_log_resource(const struct task_struct *task, const int res,
80080 + const unsigned long wanted, const int gt);
80081 +#else
80082 +static inline void gr_log_resource(const struct task_struct *task, const int res,
80083 + const unsigned long wanted, const int gt)
80084 +{
80085 +}
80086 +#endif
80087 +
80088 +#ifdef CONFIG_GRKERNSEC
80089 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
80090 +void gr_handle_vm86(void);
80091 +void gr_handle_mem_readwrite(u64 from, u64 to);
80092 +
80093 +void gr_log_badprocpid(const char *entry);
80094 +
80095 +extern int grsec_enable_dmesg;
80096 +extern int grsec_disable_privio;
80097 +
80098 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
80099 +extern kgid_t grsec_proc_gid;
80100 +#endif
80101 +
80102 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
80103 +extern int grsec_enable_chroot_findtask;
80104 +#endif
80105 +#ifdef CONFIG_GRKERNSEC_SETXID
80106 +extern int grsec_enable_setxid;
80107 +#endif
80108 +#endif
80109 +
80110 +#endif
80111 diff --git a/include/linux/grsock.h b/include/linux/grsock.h
80112 new file mode 100644
80113 index 0000000..e7ffaaf
80114 --- /dev/null
80115 +++ b/include/linux/grsock.h
80116 @@ -0,0 +1,19 @@
80117 +#ifndef __GRSOCK_H
80118 +#define __GRSOCK_H
80119 +
80120 +extern void gr_attach_curr_ip(const struct sock *sk);
80121 +extern int gr_handle_sock_all(const int family, const int type,
80122 + const int protocol);
80123 +extern int gr_handle_sock_server(const struct sockaddr *sck);
80124 +extern int gr_handle_sock_server_other(const struct sock *sck);
80125 +extern int gr_handle_sock_client(const struct sockaddr *sck);
80126 +extern int gr_search_connect(struct socket * sock,
80127 + struct sockaddr_in * addr);
80128 +extern int gr_search_bind(struct socket * sock,
80129 + struct sockaddr_in * addr);
80130 +extern int gr_search_listen(struct socket * sock);
80131 +extern int gr_search_accept(struct socket * sock);
80132 +extern int gr_search_socket(const int domain, const int type,
80133 + const int protocol);
80134 +
80135 +#endif
80136 diff --git a/include/linux/hash.h b/include/linux/hash.h
80137 index bd1754c..8240892 100644
80138 --- a/include/linux/hash.h
80139 +++ b/include/linux/hash.h
80140 @@ -83,7 +83,7 @@ static inline u32 hash32_ptr(const void *ptr)
80141 struct fast_hash_ops {
80142 u32 (*hash)(const void *data, u32 len, u32 seed);
80143 u32 (*hash2)(const u32 *data, u32 len, u32 seed);
80144 -};
80145 +} __no_const;
80146
80147 /**
80148 * arch_fast_hash - Caclulates a hash over a given buffer that can have
80149 diff --git a/include/linux/highmem.h b/include/linux/highmem.h
80150 index 7fb31da..08b5114 100644
80151 --- a/include/linux/highmem.h
80152 +++ b/include/linux/highmem.h
80153 @@ -189,6 +189,18 @@ static inline void clear_highpage(struct page *page)
80154 kunmap_atomic(kaddr);
80155 }
80156
80157 +static inline void sanitize_highpage(struct page *page)
80158 +{
80159 + void *kaddr;
80160 + unsigned long flags;
80161 +
80162 + local_irq_save(flags);
80163 + kaddr = kmap_atomic(page);
80164 + clear_page(kaddr);
80165 + kunmap_atomic(kaddr);
80166 + local_irq_restore(flags);
80167 +}
80168 +
80169 static inline void zero_user_segments(struct page *page,
80170 unsigned start1, unsigned end1,
80171 unsigned start2, unsigned end2)
80172 diff --git a/include/linux/hwmon-sysfs.h b/include/linux/hwmon-sysfs.h
80173 index 1c7b89a..7dda400 100644
80174 --- a/include/linux/hwmon-sysfs.h
80175 +++ b/include/linux/hwmon-sysfs.h
80176 @@ -25,7 +25,8 @@
80177 struct sensor_device_attribute{
80178 struct device_attribute dev_attr;
80179 int index;
80180 -};
80181 +} __do_const;
80182 +typedef struct sensor_device_attribute __no_const sensor_device_attribute_no_const;
80183 #define to_sensor_dev_attr(_dev_attr) \
80184 container_of(_dev_attr, struct sensor_device_attribute, dev_attr)
80185
80186 @@ -41,7 +42,8 @@ struct sensor_device_attribute_2 {
80187 struct device_attribute dev_attr;
80188 u8 index;
80189 u8 nr;
80190 -};
80191 +} __do_const;
80192 +typedef struct sensor_device_attribute_2 __no_const sensor_device_attribute_2_no_const;
80193 #define to_sensor_dev_attr_2(_dev_attr) \
80194 container_of(_dev_attr, struct sensor_device_attribute_2, dev_attr)
80195
80196 diff --git a/include/linux/i2c.h b/include/linux/i2c.h
80197 index deddeb8..bcaf62d 100644
80198 --- a/include/linux/i2c.h
80199 +++ b/include/linux/i2c.h
80200 @@ -378,6 +378,7 @@ struct i2c_algorithm {
80201 /* To determine what the adapter supports */
80202 u32 (*functionality) (struct i2c_adapter *);
80203 };
80204 +typedef struct i2c_algorithm __no_const i2c_algorithm_no_const;
80205
80206 /**
80207 * struct i2c_bus_recovery_info - I2C bus recovery information
80208 diff --git a/include/linux/i2o.h b/include/linux/i2o.h
80209 index d23c3c2..eb63c81 100644
80210 --- a/include/linux/i2o.h
80211 +++ b/include/linux/i2o.h
80212 @@ -565,7 +565,7 @@ struct i2o_controller {
80213 struct i2o_device *exec; /* Executive */
80214 #if BITS_PER_LONG == 64
80215 spinlock_t context_list_lock; /* lock for context_list */
80216 - atomic_t context_list_counter; /* needed for unique contexts */
80217 + atomic_unchecked_t context_list_counter; /* needed for unique contexts */
80218 struct list_head context_list; /* list of context id's
80219 and pointers */
80220 #endif
80221 diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
80222 index aff7ad8..3942bbd 100644
80223 --- a/include/linux/if_pppox.h
80224 +++ b/include/linux/if_pppox.h
80225 @@ -76,7 +76,7 @@ struct pppox_proto {
80226 int (*ioctl)(struct socket *sock, unsigned int cmd,
80227 unsigned long arg);
80228 struct module *owner;
80229 -};
80230 +} __do_const;
80231
80232 extern int register_pppox_proto(int proto_num, const struct pppox_proto *pp);
80233 extern void unregister_pppox_proto(int proto_num);
80234 diff --git a/include/linux/init.h b/include/linux/init.h
80235 index e168880..d9b489d 100644
80236 --- a/include/linux/init.h
80237 +++ b/include/linux/init.h
80238 @@ -37,9 +37,17 @@
80239 * section.
80240 */
80241
80242 +#define add_init_latent_entropy __latent_entropy
80243 +
80244 +#ifdef CONFIG_MEMORY_HOTPLUG
80245 +#define add_meminit_latent_entropy
80246 +#else
80247 +#define add_meminit_latent_entropy __latent_entropy
80248 +#endif
80249 +
80250 /* These are for everybody (although not all archs will actually
80251 discard it in modules) */
80252 -#define __init __section(.init.text) __cold notrace
80253 +#define __init __section(.init.text) __cold notrace add_init_latent_entropy
80254 #define __initdata __section(.init.data)
80255 #define __initconst __constsection(.init.rodata)
80256 #define __exitdata __section(.exit.data)
80257 @@ -100,7 +108,7 @@
80258 #define __cpuexitconst
80259
80260 /* Used for MEMORY_HOTPLUG */
80261 -#define __meminit __section(.meminit.text) __cold notrace
80262 +#define __meminit __section(.meminit.text) __cold notrace add_meminit_latent_entropy
80263 #define __meminitdata __section(.meminit.data)
80264 #define __meminitconst __constsection(.meminit.rodata)
80265 #define __memexit __section(.memexit.text) __exitused __cold notrace
80266 diff --git a/include/linux/init_task.h b/include/linux/init_task.h
80267 index 6df7f9f..d0bf699 100644
80268 --- a/include/linux/init_task.h
80269 +++ b/include/linux/init_task.h
80270 @@ -156,6 +156,12 @@ extern struct task_group root_task_group;
80271
80272 #define INIT_TASK_COMM "swapper"
80273
80274 +#ifdef CONFIG_X86
80275 +#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
80276 +#else
80277 +#define INIT_TASK_THREAD_INFO
80278 +#endif
80279 +
80280 #ifdef CONFIG_RT_MUTEXES
80281 # define INIT_RT_MUTEXES(tsk) \
80282 .pi_waiters = RB_ROOT, \
80283 @@ -203,6 +209,7 @@ extern struct task_group root_task_group;
80284 RCU_POINTER_INITIALIZER(cred, &init_cred), \
80285 .comm = INIT_TASK_COMM, \
80286 .thread = INIT_THREAD, \
80287 + INIT_TASK_THREAD_INFO \
80288 .fs = &init_fs, \
80289 .files = &init_files, \
80290 .signal = &init_signals, \
80291 diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
80292 index a2678d3..e411b1b 100644
80293 --- a/include/linux/interrupt.h
80294 +++ b/include/linux/interrupt.h
80295 @@ -373,8 +373,8 @@ extern const char * const softirq_to_name[NR_SOFTIRQS];
80296
80297 struct softirq_action
80298 {
80299 - void (*action)(struct softirq_action *);
80300 -};
80301 + void (*action)(void);
80302 +} __no_const;
80303
80304 asmlinkage void do_softirq(void);
80305 asmlinkage void __do_softirq(void);
80306 @@ -388,7 +388,7 @@ static inline void do_softirq_own_stack(void)
80307 }
80308 #endif
80309
80310 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
80311 +extern void open_softirq(int nr, void (*action)(void));
80312 extern void softirq_init(void);
80313 extern void __raise_softirq_irqoff(unsigned int nr);
80314
80315 diff --git a/include/linux/iommu.h b/include/linux/iommu.h
80316 index b96a5b2..2732d1c 100644
80317 --- a/include/linux/iommu.h
80318 +++ b/include/linux/iommu.h
80319 @@ -131,7 +131,7 @@ struct iommu_ops {
80320 u32 (*domain_get_windows)(struct iommu_domain *domain);
80321
80322 unsigned long pgsize_bitmap;
80323 -};
80324 +} __do_const;
80325
80326 #define IOMMU_GROUP_NOTIFY_ADD_DEVICE 1 /* Device added */
80327 #define IOMMU_GROUP_NOTIFY_DEL_DEVICE 2 /* Pre Device removed */
80328 diff --git a/include/linux/ioport.h b/include/linux/ioport.h
80329 index 89b7c24..382af74 100644
80330 --- a/include/linux/ioport.h
80331 +++ b/include/linux/ioport.h
80332 @@ -161,7 +161,7 @@ struct resource *lookup_resource(struct resource *root, resource_size_t start);
80333 int adjust_resource(struct resource *res, resource_size_t start,
80334 resource_size_t size);
80335 resource_size_t resource_alignment(struct resource *res);
80336 -static inline resource_size_t resource_size(const struct resource *res)
80337 +static inline resource_size_t __intentional_overflow(-1) resource_size(const struct resource *res)
80338 {
80339 return res->end - res->start + 1;
80340 }
80341 diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
80342 index 35e7eca..6afb7ad 100644
80343 --- a/include/linux/ipc_namespace.h
80344 +++ b/include/linux/ipc_namespace.h
80345 @@ -69,7 +69,7 @@ struct ipc_namespace {
80346 struct user_namespace *user_ns;
80347
80348 unsigned int proc_inum;
80349 -};
80350 +} __randomize_layout;
80351
80352 extern struct ipc_namespace init_ipc_ns;
80353 extern atomic_t nr_ipc_ns;
80354 diff --git a/include/linux/irq.h b/include/linux/irq.h
80355 index 7dc1003..407327b 100644
80356 --- a/include/linux/irq.h
80357 +++ b/include/linux/irq.h
80358 @@ -338,7 +338,8 @@ struct irq_chip {
80359 void (*irq_print_chip)(struct irq_data *data, struct seq_file *p);
80360
80361 unsigned long flags;
80362 -};
80363 +} __do_const;
80364 +typedef struct irq_chip __no_const irq_chip_no_const;
80365
80366 /*
80367 * irq_chip specific flags
80368 diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h
80369 index 0ceb389..eed3fb8 100644
80370 --- a/include/linux/irqchip/arm-gic.h
80371 +++ b/include/linux/irqchip/arm-gic.h
80372 @@ -73,9 +73,11 @@
80373
80374 #ifndef __ASSEMBLY__
80375
80376 +#include <linux/irq.h>
80377 +
80378 struct device_node;
80379
80380 -extern struct irq_chip gic_arch_extn;
80381 +extern irq_chip_no_const gic_arch_extn;
80382
80383 void gic_init_bases(unsigned int, int, void __iomem *, void __iomem *,
80384 u32 offset, struct device_node *);
80385 diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
80386 index 1f44466..b481806 100644
80387 --- a/include/linux/jiffies.h
80388 +++ b/include/linux/jiffies.h
80389 @@ -292,20 +292,20 @@ extern unsigned long preset_lpj;
80390 /*
80391 * Convert various time units to each other:
80392 */
80393 -extern unsigned int jiffies_to_msecs(const unsigned long j);
80394 -extern unsigned int jiffies_to_usecs(const unsigned long j);
80395 +extern unsigned int jiffies_to_msecs(const unsigned long j) __intentional_overflow(-1);
80396 +extern unsigned int jiffies_to_usecs(const unsigned long j) __intentional_overflow(-1);
80397
80398 -static inline u64 jiffies_to_nsecs(const unsigned long j)
80399 +static inline u64 __intentional_overflow(-1) jiffies_to_nsecs(const unsigned long j)
80400 {
80401 return (u64)jiffies_to_usecs(j) * NSEC_PER_USEC;
80402 }
80403
80404 -extern unsigned long msecs_to_jiffies(const unsigned int m);
80405 -extern unsigned long usecs_to_jiffies(const unsigned int u);
80406 +extern unsigned long msecs_to_jiffies(const unsigned int m) __intentional_overflow(-1);
80407 +extern unsigned long usecs_to_jiffies(const unsigned int u) __intentional_overflow(-1);
80408 extern unsigned long timespec_to_jiffies(const struct timespec *value);
80409 extern void jiffies_to_timespec(const unsigned long jiffies,
80410 - struct timespec *value);
80411 -extern unsigned long timeval_to_jiffies(const struct timeval *value);
80412 + struct timespec *value) __intentional_overflow(-1);
80413 +extern unsigned long timeval_to_jiffies(const struct timeval *value) __intentional_overflow(-1);
80414 extern void jiffies_to_timeval(const unsigned long jiffies,
80415 struct timeval *value);
80416
80417 diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
80418 index 6883e19..e854fcb 100644
80419 --- a/include/linux/kallsyms.h
80420 +++ b/include/linux/kallsyms.h
80421 @@ -15,7 +15,8 @@
80422
80423 struct module;
80424
80425 -#ifdef CONFIG_KALLSYMS
80426 +#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
80427 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
80428 /* Lookup the address for a symbol. Returns 0 if not found. */
80429 unsigned long kallsyms_lookup_name(const char *name);
80430
80431 @@ -106,6 +107,21 @@ static inline int lookup_symbol_attrs(unsigned long addr, unsigned long *size, u
80432 /* Stupid that this does nothing, but I didn't create this mess. */
80433 #define __print_symbol(fmt, addr)
80434 #endif /*CONFIG_KALLSYMS*/
80435 +#else /* when included by kallsyms.c, vsnprintf.c, kprobes.c, or
80436 + arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
80437 +extern unsigned long kallsyms_lookup_name(const char *name);
80438 +extern void __print_symbol(const char *fmt, unsigned long address);
80439 +extern int sprint_backtrace(char *buffer, unsigned long address);
80440 +extern int sprint_symbol(char *buffer, unsigned long address);
80441 +extern int sprint_symbol_no_offset(char *buffer, unsigned long address);
80442 +const char *kallsyms_lookup(unsigned long addr,
80443 + unsigned long *symbolsize,
80444 + unsigned long *offset,
80445 + char **modname, char *namebuf);
80446 +extern int kallsyms_lookup_size_offset(unsigned long addr,
80447 + unsigned long *symbolsize,
80448 + unsigned long *offset);
80449 +#endif
80450
80451 /* This macro allows us to keep printk typechecking */
80452 static __printf(1, 2)
80453 diff --git a/include/linux/key-type.h b/include/linux/key-type.h
80454 index a74c3a8..28d3f21 100644
80455 --- a/include/linux/key-type.h
80456 +++ b/include/linux/key-type.h
80457 @@ -131,7 +131,7 @@ struct key_type {
80458 /* internal fields */
80459 struct list_head link; /* link in types list */
80460 struct lock_class_key lock_class; /* key->sem lock class */
80461 -};
80462 +} __do_const;
80463
80464 extern struct key_type key_type_keyring;
80465
80466 diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h
80467 index 6b06d37..c134867 100644
80468 --- a/include/linux/kgdb.h
80469 +++ b/include/linux/kgdb.h
80470 @@ -52,7 +52,7 @@ extern int kgdb_connected;
80471 extern int kgdb_io_module_registered;
80472
80473 extern atomic_t kgdb_setting_breakpoint;
80474 -extern atomic_t kgdb_cpu_doing_single_step;
80475 +extern atomic_unchecked_t kgdb_cpu_doing_single_step;
80476
80477 extern struct task_struct *kgdb_usethread;
80478 extern struct task_struct *kgdb_contthread;
80479 @@ -254,7 +254,7 @@ struct kgdb_arch {
80480 void (*correct_hw_break)(void);
80481
80482 void (*enable_nmi)(bool on);
80483 -};
80484 +} __do_const;
80485
80486 /**
80487 * struct kgdb_io - Describe the interface for an I/O driver to talk with KGDB.
80488 @@ -279,7 +279,7 @@ struct kgdb_io {
80489 void (*pre_exception) (void);
80490 void (*post_exception) (void);
80491 int is_console;
80492 -};
80493 +} __do_const;
80494
80495 extern struct kgdb_arch arch_kgdb_ops;
80496
80497 diff --git a/include/linux/kmod.h b/include/linux/kmod.h
80498 index 0555cc6..40116ce 100644
80499 --- a/include/linux/kmod.h
80500 +++ b/include/linux/kmod.h
80501 @@ -34,6 +34,8 @@ extern char modprobe_path[]; /* for sysctl */
80502 * usually useless though. */
80503 extern __printf(2, 3)
80504 int __request_module(bool wait, const char *name, ...);
80505 +extern __printf(3, 4)
80506 +int ___request_module(bool wait, char *param_name, const char *name, ...);
80507 #define request_module(mod...) __request_module(true, mod)
80508 #define request_module_nowait(mod...) __request_module(false, mod)
80509 #define try_then_request_module(x, mod...) \
80510 @@ -57,6 +59,9 @@ struct subprocess_info {
80511 struct work_struct work;
80512 struct completion *complete;
80513 char *path;
80514 +#ifdef CONFIG_GRKERNSEC
80515 + char *origpath;
80516 +#endif
80517 char **argv;
80518 char **envp;
80519 int wait;
80520 diff --git a/include/linux/kobject.h b/include/linux/kobject.h
80521 index 926afb6..58dd6e5 100644
80522 --- a/include/linux/kobject.h
80523 +++ b/include/linux/kobject.h
80524 @@ -116,7 +116,7 @@ struct kobj_type {
80525 struct attribute **default_attrs;
80526 const struct kobj_ns_type_operations *(*child_ns_type)(struct kobject *kobj);
80527 const void *(*namespace)(struct kobject *kobj);
80528 -};
80529 +} __do_const;
80530
80531 struct kobj_uevent_env {
80532 char *envp[UEVENT_NUM_ENVP];
80533 @@ -139,6 +139,7 @@ struct kobj_attribute {
80534 ssize_t (*store)(struct kobject *kobj, struct kobj_attribute *attr,
80535 const char *buf, size_t count);
80536 };
80537 +typedef struct kobj_attribute __no_const kobj_attribute_no_const;
80538
80539 extern const struct sysfs_ops kobj_sysfs_ops;
80540
80541 @@ -166,7 +167,7 @@ struct kset {
80542 spinlock_t list_lock;
80543 struct kobject kobj;
80544 const struct kset_uevent_ops *uevent_ops;
80545 -};
80546 +} __randomize_layout;
80547
80548 extern void kset_init(struct kset *kset);
80549 extern int __must_check kset_register(struct kset *kset);
80550 diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h
80551 index df32d25..fb52e27 100644
80552 --- a/include/linux/kobject_ns.h
80553 +++ b/include/linux/kobject_ns.h
80554 @@ -44,7 +44,7 @@ struct kobj_ns_type_operations {
80555 const void *(*netlink_ns)(struct sock *sk);
80556 const void *(*initial_ns)(void);
80557 void (*drop_ns)(void *);
80558 -};
80559 +} __do_const;
80560
80561 int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
80562 int kobj_ns_type_registered(enum kobj_ns_type type);
80563 diff --git a/include/linux/kref.h b/include/linux/kref.h
80564 index 484604d..0f6c5b6 100644
80565 --- a/include/linux/kref.h
80566 +++ b/include/linux/kref.h
80567 @@ -68,7 +68,7 @@ static inline void kref_get(struct kref *kref)
80568 static inline int kref_sub(struct kref *kref, unsigned int count,
80569 void (*release)(struct kref *kref))
80570 {
80571 - WARN_ON(release == NULL);
80572 + BUG_ON(release == NULL);
80573
80574 if (atomic_sub_and_test((int) count, &kref->refcount)) {
80575 release(kref);
80576 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
80577 index b8e9a43..632678d 100644
80578 --- a/include/linux/kvm_host.h
80579 +++ b/include/linux/kvm_host.h
80580 @@ -455,7 +455,7 @@ static inline void kvm_irqfd_exit(void)
80581 {
80582 }
80583 #endif
80584 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
80585 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
80586 struct module *module);
80587 void kvm_exit(void);
80588
80589 @@ -621,7 +621,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(struct kvm_vcpu *vcpu,
80590 struct kvm_guest_debug *dbg);
80591 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
80592
80593 -int kvm_arch_init(void *opaque);
80594 +int kvm_arch_init(const void *opaque);
80595 void kvm_arch_exit(void);
80596
80597 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
80598 diff --git a/include/linux/libata.h b/include/linux/libata.h
80599 index 3fee55e..42565b7 100644
80600 --- a/include/linux/libata.h
80601 +++ b/include/linux/libata.h
80602 @@ -976,7 +976,7 @@ struct ata_port_operations {
80603 * fields must be pointers.
80604 */
80605 const struct ata_port_operations *inherits;
80606 -};
80607 +} __do_const;
80608
80609 struct ata_port_info {
80610 unsigned long flags;
80611 diff --git a/include/linux/linkage.h b/include/linux/linkage.h
80612 index a6a42dd..6c5ebce 100644
80613 --- a/include/linux/linkage.h
80614 +++ b/include/linux/linkage.h
80615 @@ -36,6 +36,7 @@
80616 #endif
80617
80618 #define __page_aligned_data __section(.data..page_aligned) __aligned(PAGE_SIZE)
80619 +#define __page_aligned_rodata __read_only __aligned(PAGE_SIZE)
80620 #define __page_aligned_bss __section(.bss..page_aligned) __aligned(PAGE_SIZE)
80621
80622 /*
80623 diff --git a/include/linux/list.h b/include/linux/list.h
80624 index ef95941..82db65a 100644
80625 --- a/include/linux/list.h
80626 +++ b/include/linux/list.h
80627 @@ -112,6 +112,19 @@ extern void __list_del_entry(struct list_head *entry);
80628 extern void list_del(struct list_head *entry);
80629 #endif
80630
80631 +extern void __pax_list_add(struct list_head *new,
80632 + struct list_head *prev,
80633 + struct list_head *next);
80634 +static inline void pax_list_add(struct list_head *new, struct list_head *head)
80635 +{
80636 + __pax_list_add(new, head, head->next);
80637 +}
80638 +static inline void pax_list_add_tail(struct list_head *new, struct list_head *head)
80639 +{
80640 + __pax_list_add(new, head->prev, head);
80641 +}
80642 +extern void pax_list_del(struct list_head *entry);
80643 +
80644 /**
80645 * list_replace - replace old entry by new one
80646 * @old : the element to be replaced
80647 @@ -145,6 +158,8 @@ static inline void list_del_init(struct list_head *entry)
80648 INIT_LIST_HEAD(entry);
80649 }
80650
80651 +extern void pax_list_del_init(struct list_head *entry);
80652 +
80653 /**
80654 * list_move - delete from one list and add as another's head
80655 * @list: the entry to move
80656 diff --git a/include/linux/math64.h b/include/linux/math64.h
80657 index c45c089..298841c 100644
80658 --- a/include/linux/math64.h
80659 +++ b/include/linux/math64.h
80660 @@ -15,7 +15,7 @@
80661 * This is commonly provided by 32bit archs to provide an optimized 64bit
80662 * divide.
80663 */
80664 -static inline u64 div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
80665 +static inline u64 __intentional_overflow(-1) div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
80666 {
80667 *remainder = dividend % divisor;
80668 return dividend / divisor;
80669 @@ -42,7 +42,7 @@ static inline u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder)
80670 /**
80671 * div64_u64 - unsigned 64bit divide with 64bit divisor
80672 */
80673 -static inline u64 div64_u64(u64 dividend, u64 divisor)
80674 +static inline u64 __intentional_overflow(-1) div64_u64(u64 dividend, u64 divisor)
80675 {
80676 return dividend / divisor;
80677 }
80678 @@ -61,7 +61,7 @@ static inline s64 div64_s64(s64 dividend, s64 divisor)
80679 #define div64_ul(x, y) div_u64((x), (y))
80680
80681 #ifndef div_u64_rem
80682 -static inline u64 div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
80683 +static inline u64 __intentional_overflow(-1) div_u64_rem(u64 dividend, u32 divisor, u32 *remainder)
80684 {
80685 *remainder = do_div(dividend, divisor);
80686 return dividend;
80687 @@ -77,7 +77,7 @@ extern u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder);
80688 #endif
80689
80690 #ifndef div64_u64
80691 -extern u64 div64_u64(u64 dividend, u64 divisor);
80692 +extern u64 __intentional_overflow(-1) div64_u64(u64 dividend, u64 divisor);
80693 #endif
80694
80695 #ifndef div64_s64
80696 @@ -94,7 +94,7 @@ extern s64 div64_s64(s64 dividend, s64 divisor);
80697 * divide.
80698 */
80699 #ifndef div_u64
80700 -static inline u64 div_u64(u64 dividend, u32 divisor)
80701 +static inline u64 __intentional_overflow(-1) div_u64(u64 dividend, u32 divisor)
80702 {
80703 u32 remainder;
80704 return div_u64_rem(dividend, divisor, &remainder);
80705 diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
80706 index 5f1ea75..5125ac5 100644
80707 --- a/include/linux/mempolicy.h
80708 +++ b/include/linux/mempolicy.h
80709 @@ -91,6 +91,10 @@ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
80710 }
80711
80712 #define vma_policy(vma) ((vma)->vm_policy)
80713 +static inline void set_vma_policy(struct vm_area_struct *vma, struct mempolicy *pol)
80714 +{
80715 + vma->vm_policy = pol;
80716 +}
80717
80718 static inline void mpol_get(struct mempolicy *pol)
80719 {
80720 @@ -223,6 +227,9 @@ static inline void mpol_free_shared_policy(struct shared_policy *p)
80721 }
80722
80723 #define vma_policy(vma) NULL
80724 +static inline void set_vma_policy(struct vm_area_struct *vma, struct mempolicy *pol)
80725 +{
80726 +}
80727
80728 static inline int
80729 vma_dup_policy(struct vm_area_struct *src, struct vm_area_struct *dst)
80730 diff --git a/include/linux/mm.h b/include/linux/mm.h
80731 index c1b7414..5ea2ad8 100644
80732 --- a/include/linux/mm.h
80733 +++ b/include/linux/mm.h
80734 @@ -127,6 +127,11 @@ extern unsigned int kobjsize(const void *objp);
80735 #define VM_HUGETLB 0x00400000 /* Huge TLB Page VM */
80736 #define VM_NONLINEAR 0x00800000 /* Is non-linear (remap_file_pages) */
80737 #define VM_ARCH_1 0x01000000 /* Architecture-specific flag */
80738 +
80739 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
80740 +#define VM_PAGEEXEC 0x02000000 /* vma->vm_page_prot needs special handling */
80741 +#endif
80742 +
80743 #define VM_DONTDUMP 0x04000000 /* Do not include in the core dump */
80744
80745 #ifdef CONFIG_MEM_SOFT_DIRTY
80746 @@ -229,8 +234,8 @@ struct vm_operations_struct {
80747 /* called by access_process_vm when get_user_pages() fails, typically
80748 * for use by special VMAs that can switch between memory and hardware
80749 */
80750 - int (*access)(struct vm_area_struct *vma, unsigned long addr,
80751 - void *buf, int len, int write);
80752 + ssize_t (*access)(struct vm_area_struct *vma, unsigned long addr,
80753 + void *buf, size_t len, int write);
80754 #ifdef CONFIG_NUMA
80755 /*
80756 * set_policy() op must add a reference to any non-NULL @new mempolicy
80757 @@ -260,6 +265,7 @@ struct vm_operations_struct {
80758 int (*remap_pages)(struct vm_area_struct *vma, unsigned long addr,
80759 unsigned long size, pgoff_t pgoff);
80760 };
80761 +typedef struct vm_operations_struct __no_const vm_operations_struct_no_const;
80762
80763 struct mmu_gather;
80764 struct inode;
80765 @@ -1112,8 +1118,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
80766 unsigned long *pfn);
80767 int follow_phys(struct vm_area_struct *vma, unsigned long address,
80768 unsigned int flags, unsigned long *prot, resource_size_t *phys);
80769 -int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
80770 - void *buf, int len, int write);
80771 +ssize_t generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
80772 + void *buf, size_t len, int write);
80773
80774 static inline void unmap_shared_mapping_range(struct address_space *mapping,
80775 loff_t const holebegin, loff_t const holelen)
80776 @@ -1152,9 +1158,9 @@ static inline int fixup_user_fault(struct task_struct *tsk,
80777 }
80778 #endif
80779
80780 -extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
80781 -extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
80782 - void *buf, int len, int write);
80783 +extern ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, size_t len, int write);
80784 +extern ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
80785 + void *buf, size_t len, int write);
80786
80787 long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
80788 unsigned long start, unsigned long nr_pages,
80789 @@ -1186,34 +1192,6 @@ int set_page_dirty(struct page *page);
80790 int set_page_dirty_lock(struct page *page);
80791 int clear_page_dirty_for_io(struct page *page);
80792
80793 -/* Is the vma a continuation of the stack vma above it? */
80794 -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
80795 -{
80796 - return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
80797 -}
80798 -
80799 -static inline int stack_guard_page_start(struct vm_area_struct *vma,
80800 - unsigned long addr)
80801 -{
80802 - return (vma->vm_flags & VM_GROWSDOWN) &&
80803 - (vma->vm_start == addr) &&
80804 - !vma_growsdown(vma->vm_prev, addr);
80805 -}
80806 -
80807 -/* Is the vma a continuation of the stack vma below it? */
80808 -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
80809 -{
80810 - return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
80811 -}
80812 -
80813 -static inline int stack_guard_page_end(struct vm_area_struct *vma,
80814 - unsigned long addr)
80815 -{
80816 - return (vma->vm_flags & VM_GROWSUP) &&
80817 - (vma->vm_end == addr) &&
80818 - !vma_growsup(vma->vm_next, addr);
80819 -}
80820 -
80821 extern pid_t
80822 vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_group);
80823
80824 @@ -1313,6 +1291,15 @@ static inline void sync_mm_rss(struct mm_struct *mm)
80825 }
80826 #endif
80827
80828 +#ifdef CONFIG_MMU
80829 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags);
80830 +#else
80831 +static inline pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
80832 +{
80833 + return __pgprot(0);
80834 +}
80835 +#endif
80836 +
80837 int vma_wants_writenotify(struct vm_area_struct *vma);
80838
80839 extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
80840 @@ -1331,8 +1318,15 @@ static inline int __pud_alloc(struct mm_struct *mm, pgd_t *pgd,
80841 {
80842 return 0;
80843 }
80844 +
80845 +static inline int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd,
80846 + unsigned long address)
80847 +{
80848 + return 0;
80849 +}
80850 #else
80851 int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
80852 +int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address);
80853 #endif
80854
80855 #ifdef __PAGETABLE_PMD_FOLDED
80856 @@ -1341,8 +1335,15 @@ static inline int __pmd_alloc(struct mm_struct *mm, pud_t *pud,
80857 {
80858 return 0;
80859 }
80860 +
80861 +static inline int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud,
80862 + unsigned long address)
80863 +{
80864 + return 0;
80865 +}
80866 #else
80867 int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address);
80868 +int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address);
80869 #endif
80870
80871 int __pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
80872 @@ -1360,11 +1361,23 @@ static inline pud_t *pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long a
80873 NULL: pud_offset(pgd, address);
80874 }
80875
80876 +static inline pud_t *pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
80877 +{
80878 + return (unlikely(pgd_none(*pgd)) && __pud_alloc_kernel(mm, pgd, address))?
80879 + NULL: pud_offset(pgd, address);
80880 +}
80881 +
80882 static inline pmd_t *pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
80883 {
80884 return (unlikely(pud_none(*pud)) && __pmd_alloc(mm, pud, address))?
80885 NULL: pmd_offset(pud, address);
80886 }
80887 +
80888 +static inline pmd_t *pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
80889 +{
80890 + return (unlikely(pud_none(*pud)) && __pmd_alloc_kernel(mm, pud, address))?
80891 + NULL: pmd_offset(pud, address);
80892 +}
80893 #endif /* CONFIG_MMU && !__ARCH_HAS_4LEVEL_HACK */
80894
80895 #if USE_SPLIT_PTE_PTLOCKS
80896 @@ -1754,7 +1767,7 @@ extern int install_special_mapping(struct mm_struct *mm,
80897 unsigned long addr, unsigned long len,
80898 unsigned long flags, struct page **pages);
80899
80900 -extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
80901 +extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long) __intentional_overflow(-1);
80902
80903 extern unsigned long mmap_region(struct file *file, unsigned long addr,
80904 unsigned long len, vm_flags_t vm_flags, unsigned long pgoff);
80905 @@ -1762,6 +1775,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
80906 unsigned long len, unsigned long prot, unsigned long flags,
80907 unsigned long pgoff, unsigned long *populate);
80908 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
80909 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
80910
80911 #ifdef CONFIG_MMU
80912 extern int __mm_populate(unsigned long addr, unsigned long len,
80913 @@ -1790,10 +1804,11 @@ struct vm_unmapped_area_info {
80914 unsigned long high_limit;
80915 unsigned long align_mask;
80916 unsigned long align_offset;
80917 + unsigned long threadstack_offset;
80918 };
80919
80920 -extern unsigned long unmapped_area(struct vm_unmapped_area_info *info);
80921 -extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
80922 +extern unsigned long unmapped_area(const struct vm_unmapped_area_info *info);
80923 +extern unsigned long unmapped_area_topdown(const struct vm_unmapped_area_info *info);
80924
80925 /*
80926 * Search for an unmapped address range.
80927 @@ -1805,7 +1820,7 @@ extern unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info);
80928 * - satisfies (begin_addr & align_mask) == (align_offset & align_mask)
80929 */
80930 static inline unsigned long
80931 -vm_unmapped_area(struct vm_unmapped_area_info *info)
80932 +vm_unmapped_area(const struct vm_unmapped_area_info *info)
80933 {
80934 if (!(info->flags & VM_UNMAPPED_AREA_TOPDOWN))
80935 return unmapped_area(info);
80936 @@ -1868,6 +1883,10 @@ extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long add
80937 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
80938 struct vm_area_struct **pprev);
80939
80940 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
80941 +extern __must_check long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
80942 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
80943 +
80944 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
80945 NULL if none. Assume start_addr < end_addr. */
80946 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
80947 @@ -1896,15 +1915,6 @@ static inline struct vm_area_struct *find_exact_vma(struct mm_struct *mm,
80948 return vma;
80949 }
80950
80951 -#ifdef CONFIG_MMU
80952 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
80953 -#else
80954 -static inline pgprot_t vm_get_page_prot(unsigned long vm_flags)
80955 -{
80956 - return __pgprot(0);
80957 -}
80958 -#endif
80959 -
80960 #ifdef CONFIG_NUMA_BALANCING
80961 unsigned long change_prot_numa(struct vm_area_struct *vma,
80962 unsigned long start, unsigned long end);
80963 @@ -1956,6 +1966,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
80964 static inline void vm_stat_account(struct mm_struct *mm,
80965 unsigned long flags, struct file *file, long pages)
80966 {
80967 +
80968 +#ifdef CONFIG_PAX_RANDMMAP
80969 + if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
80970 +#endif
80971 +
80972 mm->total_vm += pages;
80973 }
80974 #endif /* CONFIG_PROC_FS */
80975 @@ -2037,7 +2052,7 @@ extern int unpoison_memory(unsigned long pfn);
80976 extern int sysctl_memory_failure_early_kill;
80977 extern int sysctl_memory_failure_recovery;
80978 extern void shake_page(struct page *p, int access);
80979 -extern atomic_long_t num_poisoned_pages;
80980 +extern atomic_long_unchecked_t num_poisoned_pages;
80981 extern int soft_offline_page(struct page *page, int flags);
80982
80983 #if defined(CONFIG_TRANSPARENT_HUGEPAGE) || defined(CONFIG_HUGETLBFS)
80984 @@ -2072,5 +2087,11 @@ void __init setup_nr_node_ids(void);
80985 static inline void setup_nr_node_ids(void) {}
80986 #endif
80987
80988 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
80989 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
80990 +#else
80991 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
80992 +#endif
80993 +
80994 #endif /* __KERNEL__ */
80995 #endif /* _LINUX_MM_H */
80996 diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
80997 index 290901a..e99b01c 100644
80998 --- a/include/linux/mm_types.h
80999 +++ b/include/linux/mm_types.h
81000 @@ -307,7 +307,9 @@ struct vm_area_struct {
81001 #ifdef CONFIG_NUMA
81002 struct mempolicy *vm_policy; /* NUMA policy for the VMA */
81003 #endif
81004 -};
81005 +
81006 + struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
81007 +} __randomize_layout;
81008
81009 struct core_thread {
81010 struct task_struct *task;
81011 @@ -453,7 +455,25 @@ struct mm_struct {
81012 bool tlb_flush_pending;
81013 #endif
81014 struct uprobes_state uprobes_state;
81015 -};
81016 +
81017 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
81018 + unsigned long pax_flags;
81019 +#endif
81020 +
81021 +#ifdef CONFIG_PAX_DLRESOLVE
81022 + unsigned long call_dl_resolve;
81023 +#endif
81024 +
81025 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
81026 + unsigned long call_syscall;
81027 +#endif
81028 +
81029 +#ifdef CONFIG_PAX_ASLR
81030 + unsigned long delta_mmap; /* randomized offset */
81031 + unsigned long delta_stack; /* randomized offset */
81032 +#endif
81033 +
81034 +} __randomize_layout;
81035
81036 static inline void mm_init_cpumask(struct mm_struct *mm)
81037 {
81038 diff --git a/include/linux/mmiotrace.h b/include/linux/mmiotrace.h
81039 index c5d5278..f0b68c8 100644
81040 --- a/include/linux/mmiotrace.h
81041 +++ b/include/linux/mmiotrace.h
81042 @@ -46,7 +46,7 @@ extern int kmmio_handler(struct pt_regs *regs, unsigned long addr);
81043 /* Called from ioremap.c */
81044 extern void mmiotrace_ioremap(resource_size_t offset, unsigned long size,
81045 void __iomem *addr);
81046 -extern void mmiotrace_iounmap(volatile void __iomem *addr);
81047 +extern void mmiotrace_iounmap(const volatile void __iomem *addr);
81048
81049 /* For anyone to insert markers. Remember trailing newline. */
81050 extern __printf(1, 2) int mmiotrace_printk(const char *fmt, ...);
81051 @@ -66,7 +66,7 @@ static inline void mmiotrace_ioremap(resource_size_t offset,
81052 {
81053 }
81054
81055 -static inline void mmiotrace_iounmap(volatile void __iomem *addr)
81056 +static inline void mmiotrace_iounmap(const volatile void __iomem *addr)
81057 {
81058 }
81059
81060 diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
81061 index 9b61b9b..52147d6b 100644
81062 --- a/include/linux/mmzone.h
81063 +++ b/include/linux/mmzone.h
81064 @@ -396,7 +396,7 @@ struct zone {
81065 unsigned long flags; /* zone flags, see below */
81066
81067 /* Zone statistics */
81068 - atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
81069 + atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
81070
81071 /*
81072 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
81073 diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
81074 index 45e9214..a7227d6 100644
81075 --- a/include/linux/mod_devicetable.h
81076 +++ b/include/linux/mod_devicetable.h
81077 @@ -13,7 +13,7 @@
81078 typedef unsigned long kernel_ulong_t;
81079 #endif
81080
81081 -#define PCI_ANY_ID (~0)
81082 +#define PCI_ANY_ID ((__u16)~0)
81083
81084 struct pci_device_id {
81085 __u32 vendor, device; /* Vendor and device ID or PCI_ANY_ID*/
81086 @@ -139,7 +139,7 @@ struct usb_device_id {
81087 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL 0x0200
81088 #define USB_DEVICE_ID_MATCH_INT_NUMBER 0x0400
81089
81090 -#define HID_ANY_ID (~0)
81091 +#define HID_ANY_ID (~0U)
81092 #define HID_BUS_ANY 0xffff
81093 #define HID_GROUP_ANY 0x0000
81094
81095 @@ -467,7 +467,7 @@ struct dmi_system_id {
81096 const char *ident;
81097 struct dmi_strmatch matches[4];
81098 void *driver_data;
81099 -};
81100 +} __do_const;
81101 /*
81102 * struct dmi_device_id appears during expansion of
81103 * "MODULE_DEVICE_TABLE(dmi, x)". Compiler doesn't look inside it
81104 diff --git a/include/linux/module.h b/include/linux/module.h
81105 index eaf60ff..641979a 100644
81106 --- a/include/linux/module.h
81107 +++ b/include/linux/module.h
81108 @@ -17,9 +17,11 @@
81109 #include <linux/moduleparam.h>
81110 #include <linux/tracepoint.h>
81111 #include <linux/export.h>
81112 +#include <linux/fs.h>
81113
81114 #include <linux/percpu.h>
81115 #include <asm/module.h>
81116 +#include <asm/pgtable.h>
81117
81118 /* In stripped ARM and x86-64 modules, ~ is surprisingly rare. */
81119 #define MODULE_SIG_STRING "~Module signature appended~\n"
81120 @@ -42,7 +44,7 @@ struct module_kobject {
81121 struct kobject *drivers_dir;
81122 struct module_param_attrs *mp;
81123 struct completion *kobj_completion;
81124 -};
81125 +} __randomize_layout;
81126
81127 struct module_attribute {
81128 struct attribute attr;
81129 @@ -54,12 +56,13 @@ struct module_attribute {
81130 int (*test)(struct module *);
81131 void (*free)(struct module *);
81132 };
81133 +typedef struct module_attribute __no_const module_attribute_no_const;
81134
81135 struct module_version_attribute {
81136 struct module_attribute mattr;
81137 const char *module_name;
81138 const char *version;
81139 -} __attribute__ ((__aligned__(sizeof(void *))));
81140 +} __do_const __attribute__ ((__aligned__(sizeof(void *))));
81141
81142 extern ssize_t __modver_version_show(struct module_attribute *,
81143 struct module_kobject *, char *);
81144 @@ -238,7 +241,7 @@ struct module {
81145
81146 /* Sysfs stuff. */
81147 struct module_kobject mkobj;
81148 - struct module_attribute *modinfo_attrs;
81149 + module_attribute_no_const *modinfo_attrs;
81150 const char *version;
81151 const char *srcversion;
81152 struct kobject *holders_dir;
81153 @@ -287,19 +290,16 @@ struct module {
81154 int (*init)(void);
81155
81156 /* If this is non-NULL, vfree after init() returns */
81157 - void *module_init;
81158 + void *module_init_rx, *module_init_rw;
81159
81160 /* Here is the actual code + data, vfree'd on unload. */
81161 - void *module_core;
81162 + void *module_core_rx, *module_core_rw;
81163
81164 /* Here are the sizes of the init and core sections */
81165 - unsigned int init_size, core_size;
81166 + unsigned int init_size_rw, core_size_rw;
81167
81168 /* The size of the executable code in each section. */
81169 - unsigned int init_text_size, core_text_size;
81170 -
81171 - /* Size of RO sections of the module (text+rodata) */
81172 - unsigned int init_ro_size, core_ro_size;
81173 + unsigned int init_size_rx, core_size_rx;
81174
81175 /* Arch-specific module values */
81176 struct mod_arch_specific arch;
81177 @@ -355,6 +355,10 @@ struct module {
81178 #ifdef CONFIG_EVENT_TRACING
81179 struct ftrace_event_call **trace_events;
81180 unsigned int num_trace_events;
81181 + struct file_operations trace_id;
81182 + struct file_operations trace_enable;
81183 + struct file_operations trace_format;
81184 + struct file_operations trace_filter;
81185 #endif
81186 #ifdef CONFIG_FTRACE_MCOUNT_RECORD
81187 unsigned int num_ftrace_callsites;
81188 @@ -378,7 +382,7 @@ struct module {
81189 ctor_fn_t *ctors;
81190 unsigned int num_ctors;
81191 #endif
81192 -};
81193 +} __randomize_layout;
81194 #ifndef MODULE_ARCH_INIT
81195 #define MODULE_ARCH_INIT {}
81196 #endif
81197 @@ -399,16 +403,46 @@ bool is_module_address(unsigned long addr);
81198 bool is_module_percpu_address(unsigned long addr);
81199 bool is_module_text_address(unsigned long addr);
81200
81201 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
81202 +{
81203 +
81204 +#ifdef CONFIG_PAX_KERNEXEC
81205 + if (ktla_ktva(addr) >= (unsigned long)start &&
81206 + ktla_ktva(addr) < (unsigned long)start + size)
81207 + return 1;
81208 +#endif
81209 +
81210 + return ((void *)addr >= start && (void *)addr < start + size);
81211 +}
81212 +
81213 +static inline int within_module_core_rx(unsigned long addr, const struct module *mod)
81214 +{
81215 + return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
81216 +}
81217 +
81218 +static inline int within_module_core_rw(unsigned long addr, const struct module *mod)
81219 +{
81220 + return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
81221 +}
81222 +
81223 +static inline int within_module_init_rx(unsigned long addr, const struct module *mod)
81224 +{
81225 + return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
81226 +}
81227 +
81228 +static inline int within_module_init_rw(unsigned long addr, const struct module *mod)
81229 +{
81230 + return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
81231 +}
81232 +
81233 static inline int within_module_core(unsigned long addr, const struct module *mod)
81234 {
81235 - return (unsigned long)mod->module_core <= addr &&
81236 - addr < (unsigned long)mod->module_core + mod->core_size;
81237 + return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
81238 }
81239
81240 static inline int within_module_init(unsigned long addr, const struct module *mod)
81241 {
81242 - return (unsigned long)mod->module_init <= addr &&
81243 - addr < (unsigned long)mod->module_init + mod->init_size;
81244 + return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
81245 }
81246
81247 /* Search for module by name: must hold module_mutex. */
81248 diff --git a/include/linux/moduleloader.h b/include/linux/moduleloader.h
81249 index 560ca53..ef621ef 100644
81250 --- a/include/linux/moduleloader.h
81251 +++ b/include/linux/moduleloader.h
81252 @@ -25,9 +25,21 @@ unsigned int arch_mod_section_prepend(struct module *mod, unsigned int section);
81253 sections. Returns NULL on failure. */
81254 void *module_alloc(unsigned long size);
81255
81256 +#ifdef CONFIG_PAX_KERNEXEC
81257 +void *module_alloc_exec(unsigned long size);
81258 +#else
81259 +#define module_alloc_exec(x) module_alloc(x)
81260 +#endif
81261 +
81262 /* Free memory returned from module_alloc. */
81263 void module_free(struct module *mod, void *module_region);
81264
81265 +#ifdef CONFIG_PAX_KERNEXEC
81266 +void module_free_exec(struct module *mod, void *module_region);
81267 +#else
81268 +#define module_free_exec(x, y) module_free((x), (y))
81269 +#endif
81270 +
81271 /*
81272 * Apply the given relocation to the (simplified) ELF. Return -error
81273 * or 0.
81274 @@ -45,7 +57,9 @@ static inline int apply_relocate(Elf_Shdr *sechdrs,
81275 unsigned int relsec,
81276 struct module *me)
81277 {
81278 +#ifdef CONFIG_MODULES
81279 printk(KERN_ERR "module %s: REL relocation unsupported\n", me->name);
81280 +#endif
81281 return -ENOEXEC;
81282 }
81283 #endif
81284 @@ -67,7 +81,9 @@ static inline int apply_relocate_add(Elf_Shdr *sechdrs,
81285 unsigned int relsec,
81286 struct module *me)
81287 {
81288 +#ifdef CONFIG_MODULES
81289 printk(KERN_ERR "module %s: REL relocation unsupported\n", me->name);
81290 +#endif
81291 return -ENOEXEC;
81292 }
81293 #endif
81294 diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
81295 index c3eb102..073c4a6 100644
81296 --- a/include/linux/moduleparam.h
81297 +++ b/include/linux/moduleparam.h
81298 @@ -295,7 +295,7 @@ static inline void __kernel_param_unlock(void)
81299 * @len is usually just sizeof(string).
81300 */
81301 #define module_param_string(name, string, len, perm) \
81302 - static const struct kparam_string __param_string_##name \
81303 + static const struct kparam_string __param_string_##name __used \
81304 = { len, string }; \
81305 __module_param_call(MODULE_PARAM_PREFIX, name, \
81306 &param_ops_string, \
81307 @@ -434,7 +434,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp);
81308 */
81309 #define module_param_array_named(name, array, type, nump, perm) \
81310 param_check_##type(name, &(array)[0]); \
81311 - static const struct kparam_array __param_arr_##name \
81312 + static const struct kparam_array __param_arr_##name __used \
81313 = { .max = ARRAY_SIZE(array), .num = nump, \
81314 .ops = &param_ops_##type, \
81315 .elemsize = sizeof(array[0]), .elem = array }; \
81316 diff --git a/include/linux/mount.h b/include/linux/mount.h
81317 index 839bac2..a96b37c 100644
81318 --- a/include/linux/mount.h
81319 +++ b/include/linux/mount.h
81320 @@ -59,7 +59,7 @@ struct vfsmount {
81321 struct dentry *mnt_root; /* root of the mounted tree */
81322 struct super_block *mnt_sb; /* pointer to superblock */
81323 int mnt_flags;
81324 -};
81325 +} __randomize_layout;
81326
81327 struct file; /* forward dec */
81328
81329 diff --git a/include/linux/namei.h b/include/linux/namei.h
81330 index 492de72..1bddcd4 100644
81331 --- a/include/linux/namei.h
81332 +++ b/include/linux/namei.h
81333 @@ -19,7 +19,7 @@ struct nameidata {
81334 unsigned seq, m_seq;
81335 int last_type;
81336 unsigned depth;
81337 - char *saved_names[MAX_NESTED_LINKS + 1];
81338 + const char *saved_names[MAX_NESTED_LINKS + 1];
81339 };
81340
81341 /*
81342 @@ -83,12 +83,12 @@ extern void unlock_rename(struct dentry *, struct dentry *);
81343
81344 extern void nd_jump_link(struct nameidata *nd, struct path *path);
81345
81346 -static inline void nd_set_link(struct nameidata *nd, char *path)
81347 +static inline void nd_set_link(struct nameidata *nd, const char *path)
81348 {
81349 nd->saved_names[nd->depth] = path;
81350 }
81351
81352 -static inline char *nd_get_link(struct nameidata *nd)
81353 +static inline const char *nd_get_link(const struct nameidata *nd)
81354 {
81355 return nd->saved_names[nd->depth];
81356 }
81357 diff --git a/include/linux/net.h b/include/linux/net.h
81358 index 17d8339..81656c0 100644
81359 --- a/include/linux/net.h
81360 +++ b/include/linux/net.h
81361 @@ -192,7 +192,7 @@ struct net_proto_family {
81362 int (*create)(struct net *net, struct socket *sock,
81363 int protocol, int kern);
81364 struct module *owner;
81365 -};
81366 +} __do_const;
81367
81368 struct iovec;
81369 struct kvec;
81370 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
81371 index 911718f..f673407 100644
81372 --- a/include/linux/netdevice.h
81373 +++ b/include/linux/netdevice.h
81374 @@ -1147,6 +1147,7 @@ struct net_device_ops {
81375 void *priv);
81376 int (*ndo_get_lock_subclass)(struct net_device *dev);
81377 };
81378 +typedef struct net_device_ops __no_const net_device_ops_no_const;
81379
81380 /*
81381 * The DEVICE structure.
81382 @@ -1229,7 +1230,7 @@ struct net_device {
81383 int iflink;
81384
81385 struct net_device_stats stats;
81386 - atomic_long_t rx_dropped; /* dropped packets by core network
81387 + atomic_long_unchecked_t rx_dropped; /* dropped packets by core network
81388 * Do not use this in drivers.
81389 */
81390
81391 diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
81392 index 2077489..a15e561 100644
81393 --- a/include/linux/netfilter.h
81394 +++ b/include/linux/netfilter.h
81395 @@ -84,7 +84,7 @@ struct nf_sockopt_ops {
81396 #endif
81397 /* Use the module struct to lock set/get code in place */
81398 struct module *owner;
81399 -};
81400 +} __do_const;
81401
81402 /* Function to register/unregister hook points. */
81403 int nf_register_hook(struct nf_hook_ops *reg);
81404 diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
81405 index 28c7436..2d6156a 100644
81406 --- a/include/linux/netfilter/nfnetlink.h
81407 +++ b/include/linux/netfilter/nfnetlink.h
81408 @@ -19,7 +19,7 @@ struct nfnl_callback {
81409 const struct nlattr * const cda[]);
81410 const struct nla_policy *policy; /* netlink attribute policy */
81411 const u_int16_t attr_count; /* number of nlattr's */
81412 -};
81413 +} __do_const;
81414
81415 struct nfnetlink_subsystem {
81416 const char *name;
81417 diff --git a/include/linux/netfilter/xt_gradm.h b/include/linux/netfilter/xt_gradm.h
81418 new file mode 100644
81419 index 0000000..33f4af8
81420 --- /dev/null
81421 +++ b/include/linux/netfilter/xt_gradm.h
81422 @@ -0,0 +1,9 @@
81423 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
81424 +#define _LINUX_NETFILTER_XT_GRADM_H 1
81425 +
81426 +struct xt_gradm_mtinfo {
81427 + __u16 flags;
81428 + __u16 invflags;
81429 +};
81430 +
81431 +#endif
81432 diff --git a/include/linux/netlink.h b/include/linux/netlink.h
81433 index aad8eea..034cda7 100644
81434 --- a/include/linux/netlink.h
81435 +++ b/include/linux/netlink.h
81436 @@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb)
81437 }
81438
81439 enum netlink_skb_flags {
81440 - NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */
81441 - NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */
81442 - NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */
81443 + NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */
81444 + NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */
81445 + NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */
81446 + NETLINK_SKB_DST = 0x8, /* Dst set in sendto or sendmsg */
81447 };
81448
81449 struct netlink_skb_parms {
81450 @@ -169,4 +170,11 @@ struct netlink_tap {
81451 extern int netlink_add_tap(struct netlink_tap *nt);
81452 extern int netlink_remove_tap(struct netlink_tap *nt);
81453
81454 +bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
81455 + struct user_namespace *ns, int cap);
81456 +bool netlink_ns_capable(const struct sk_buff *skb,
81457 + struct user_namespace *ns, int cap);
81458 +bool netlink_capable(const struct sk_buff *skb, int cap);
81459 +bool netlink_net_capable(const struct sk_buff *skb, int cap);
81460 +
81461 #endif /* __LINUX_NETLINK_H */
81462 diff --git a/include/linux/nls.h b/include/linux/nls.h
81463 index 520681b..1d67ed2 100644
81464 --- a/include/linux/nls.h
81465 +++ b/include/linux/nls.h
81466 @@ -31,7 +31,7 @@ struct nls_table {
81467 const unsigned char *charset2upper;
81468 struct module *owner;
81469 struct nls_table *next;
81470 -};
81471 +} __do_const;
81472
81473 /* this value hold the maximum octet of charset */
81474 #define NLS_MAX_CHARSET_SIZE 6 /* for UTF-8 */
81475 diff --git a/include/linux/notifier.h b/include/linux/notifier.h
81476 index d14a4c3..a078786 100644
81477 --- a/include/linux/notifier.h
81478 +++ b/include/linux/notifier.h
81479 @@ -54,7 +54,8 @@ struct notifier_block {
81480 notifier_fn_t notifier_call;
81481 struct notifier_block __rcu *next;
81482 int priority;
81483 -};
81484 +} __do_const;
81485 +typedef struct notifier_block __no_const notifier_block_no_const;
81486
81487 struct atomic_notifier_head {
81488 spinlock_t lock;
81489 diff --git a/include/linux/oprofile.h b/include/linux/oprofile.h
81490 index b2a0f15..4d7da32 100644
81491 --- a/include/linux/oprofile.h
81492 +++ b/include/linux/oprofile.h
81493 @@ -138,9 +138,9 @@ int oprofilefs_create_ulong(struct dentry * root,
81494 int oprofilefs_create_ro_ulong(struct dentry * root,
81495 char const * name, ulong * val);
81496
81497 -/** Create a file for read-only access to an atomic_t. */
81498 +/** Create a file for read-only access to an atomic_unchecked_t. */
81499 int oprofilefs_create_ro_atomic(struct dentry * root,
81500 - char const * name, atomic_t * val);
81501 + char const * name, atomic_unchecked_t * val);
81502
81503 /** create a directory */
81504 struct dentry *oprofilefs_mkdir(struct dentry *parent, char const *name);
81505 diff --git a/include/linux/padata.h b/include/linux/padata.h
81506 index 4386946..f50c615 100644
81507 --- a/include/linux/padata.h
81508 +++ b/include/linux/padata.h
81509 @@ -129,7 +129,7 @@ struct parallel_data {
81510 struct padata_serial_queue __percpu *squeue;
81511 atomic_t reorder_objects;
81512 atomic_t refcnt;
81513 - atomic_t seq_nr;
81514 + atomic_unchecked_t seq_nr;
81515 struct padata_cpumask cpumask;
81516 spinlock_t lock ____cacheline_aligned;
81517 unsigned int processed;
81518 diff --git a/include/linux/path.h b/include/linux/path.h
81519 index d137218..be0c176 100644
81520 --- a/include/linux/path.h
81521 +++ b/include/linux/path.h
81522 @@ -1,13 +1,15 @@
81523 #ifndef _LINUX_PATH_H
81524 #define _LINUX_PATH_H
81525
81526 +#include <linux/compiler.h>
81527 +
81528 struct dentry;
81529 struct vfsmount;
81530
81531 struct path {
81532 struct vfsmount *mnt;
81533 struct dentry *dentry;
81534 -};
81535 +} __randomize_layout;
81536
81537 extern void path_get(const struct path *);
81538 extern void path_put(const struct path *);
81539 diff --git a/include/linux/pci_hotplug.h b/include/linux/pci_hotplug.h
81540 index 5f2e559..7d59314 100644
81541 --- a/include/linux/pci_hotplug.h
81542 +++ b/include/linux/pci_hotplug.h
81543 @@ -71,7 +71,8 @@ struct hotplug_slot_ops {
81544 int (*get_latch_status) (struct hotplug_slot *slot, u8 *value);
81545 int (*get_adapter_status) (struct hotplug_slot *slot, u8 *value);
81546 int (*reset_slot) (struct hotplug_slot *slot, int probe);
81547 -};
81548 +} __do_const;
81549 +typedef struct hotplug_slot_ops __no_const hotplug_slot_ops_no_const;
81550
81551 /**
81552 * struct hotplug_slot_info - used to notify the hotplug pci core of the state of the slot
81553 diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h
81554 index 95961f0..0afb48f 100644
81555 --- a/include/linux/percpu-refcount.h
81556 +++ b/include/linux/percpu-refcount.h
81557 @@ -110,7 +110,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref)
81558 pcpu_count = ACCESS_ONCE(ref->pcpu_count);
81559
81560 if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
81561 - __this_cpu_inc(*pcpu_count);
81562 + this_cpu_inc(*pcpu_count);
81563 else
81564 atomic_inc(&ref->count);
81565
81566 @@ -139,7 +139,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref)
81567 pcpu_count = ACCESS_ONCE(ref->pcpu_count);
81568
81569 if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR)) {
81570 - __this_cpu_inc(*pcpu_count);
81571 + this_cpu_inc(*pcpu_count);
81572 ret = true;
81573 }
81574
81575 @@ -164,7 +164,7 @@ static inline void percpu_ref_put(struct percpu_ref *ref)
81576 pcpu_count = ACCESS_ONCE(ref->pcpu_count);
81577
81578 if (likely(REF_STATUS(pcpu_count) == PCPU_REF_PTR))
81579 - __this_cpu_dec(*pcpu_count);
81580 + this_cpu_dec(*pcpu_count);
81581 else if (unlikely(atomic_dec_and_test(&ref->count)))
81582 ref->release(ref);
81583
81584 diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
81585 index e56b07f..aef789b 100644
81586 --- a/include/linux/perf_event.h
81587 +++ b/include/linux/perf_event.h
81588 @@ -328,8 +328,8 @@ struct perf_event {
81589
81590 enum perf_event_active_state state;
81591 unsigned int attach_state;
81592 - local64_t count;
81593 - atomic64_t child_count;
81594 + local64_t count; /* PaX: fix it one day */
81595 + atomic64_unchecked_t child_count;
81596
81597 /*
81598 * These are the total time in nanoseconds that the event
81599 @@ -380,8 +380,8 @@ struct perf_event {
81600 * These accumulate total time (in nanoseconds) that children
81601 * events have been enabled and running, respectively.
81602 */
81603 - atomic64_t child_total_time_enabled;
81604 - atomic64_t child_total_time_running;
81605 + atomic64_unchecked_t child_total_time_enabled;
81606 + atomic64_unchecked_t child_total_time_running;
81607
81608 /*
81609 * Protect attach/detach and child_list:
81610 @@ -708,7 +708,7 @@ static inline void perf_callchain_store(struct perf_callchain_entry *entry, u64
81611 entry->ip[entry->nr++] = ip;
81612 }
81613
81614 -extern int sysctl_perf_event_paranoid;
81615 +extern int sysctl_perf_event_legitimately_concerned;
81616 extern int sysctl_perf_event_mlock;
81617 extern int sysctl_perf_event_sample_rate;
81618 extern int sysctl_perf_cpu_time_max_percent;
81619 @@ -723,19 +723,24 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write,
81620 loff_t *ppos);
81621
81622
81623 +static inline bool perf_paranoid_any(void)
81624 +{
81625 + return sysctl_perf_event_legitimately_concerned > 2;
81626 +}
81627 +
81628 static inline bool perf_paranoid_tracepoint_raw(void)
81629 {
81630 - return sysctl_perf_event_paranoid > -1;
81631 + return sysctl_perf_event_legitimately_concerned > -1;
81632 }
81633
81634 static inline bool perf_paranoid_cpu(void)
81635 {
81636 - return sysctl_perf_event_paranoid > 0;
81637 + return sysctl_perf_event_legitimately_concerned > 0;
81638 }
81639
81640 static inline bool perf_paranoid_kernel(void)
81641 {
81642 - return sysctl_perf_event_paranoid > 1;
81643 + return sysctl_perf_event_legitimately_concerned > 1;
81644 }
81645
81646 extern void perf_event_init(void);
81647 @@ -851,7 +856,7 @@ struct perf_pmu_events_attr {
81648 struct device_attribute attr;
81649 u64 id;
81650 const char *event_str;
81651 -};
81652 +} __do_const;
81653
81654 #define PMU_EVENT_ATTR(_name, _var, _id, _show) \
81655 static struct perf_pmu_events_attr _var = { \
81656 diff --git a/include/linux/pid_namespace.h b/include/linux/pid_namespace.h
81657 index 7246ef3..1539ea4 100644
81658 --- a/include/linux/pid_namespace.h
81659 +++ b/include/linux/pid_namespace.h
81660 @@ -43,7 +43,7 @@ struct pid_namespace {
81661 int hide_pid;
81662 int reboot; /* group exit code if this pidns was rebooted */
81663 unsigned int proc_inum;
81664 -};
81665 +} __randomize_layout;
81666
81667 extern struct pid_namespace init_pid_ns;
81668
81669 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
81670 index ab57526..94598804 100644
81671 --- a/include/linux/pipe_fs_i.h
81672 +++ b/include/linux/pipe_fs_i.h
81673 @@ -47,10 +47,10 @@ struct pipe_inode_info {
81674 struct mutex mutex;
81675 wait_queue_head_t wait;
81676 unsigned int nrbufs, curbuf, buffers;
81677 - unsigned int readers;
81678 - unsigned int writers;
81679 - unsigned int files;
81680 - unsigned int waiting_writers;
81681 + atomic_t readers;
81682 + atomic_t writers;
81683 + atomic_t files;
81684 + atomic_t waiting_writers;
81685 unsigned int r_counter;
81686 unsigned int w_counter;
81687 struct page *tmp_page;
81688 diff --git a/include/linux/pm.h b/include/linux/pm.h
81689 index 8c6583a..febb84c 100644
81690 --- a/include/linux/pm.h
81691 +++ b/include/linux/pm.h
81692 @@ -597,6 +597,7 @@ extern int dev_pm_put_subsys_data(struct device *dev);
81693 struct dev_pm_domain {
81694 struct dev_pm_ops ops;
81695 };
81696 +typedef struct dev_pm_domain __no_const dev_pm_domain_no_const;
81697
81698 /*
81699 * The PM_EVENT_ messages are also used by drivers implementing the legacy
81700 diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
81701 index 7c1d252..0e7061d 100644
81702 --- a/include/linux/pm_domain.h
81703 +++ b/include/linux/pm_domain.h
81704 @@ -44,11 +44,11 @@ struct gpd_dev_ops {
81705 int (*thaw_early)(struct device *dev);
81706 int (*thaw)(struct device *dev);
81707 bool (*active_wakeup)(struct device *dev);
81708 -};
81709 +} __no_const;
81710
81711 struct gpd_cpu_data {
81712 unsigned int saved_exit_latency;
81713 - struct cpuidle_state *idle_state;
81714 + cpuidle_state_no_const *idle_state;
81715 };
81716
81717 struct generic_pm_domain {
81718 diff --git a/include/linux/pm_runtime.h b/include/linux/pm_runtime.h
81719 index 16c9a62..f9f0838 100644
81720 --- a/include/linux/pm_runtime.h
81721 +++ b/include/linux/pm_runtime.h
81722 @@ -109,7 +109,7 @@ static inline bool pm_runtime_callbacks_present(struct device *dev)
81723
81724 static inline void pm_runtime_mark_last_busy(struct device *dev)
81725 {
81726 - ACCESS_ONCE(dev->power.last_busy) = jiffies;
81727 + ACCESS_ONCE_RW(dev->power.last_busy) = jiffies;
81728 }
81729
81730 #else /* !CONFIG_PM_RUNTIME */
81731 diff --git a/include/linux/pnp.h b/include/linux/pnp.h
81732 index 195aafc..49a7bc2 100644
81733 --- a/include/linux/pnp.h
81734 +++ b/include/linux/pnp.h
81735 @@ -297,7 +297,7 @@ static inline void pnp_set_drvdata(struct pnp_dev *pdev, void *data)
81736 struct pnp_fixup {
81737 char id[7];
81738 void (*quirk_function) (struct pnp_dev * dev); /* fixup function */
81739 -};
81740 +} __do_const;
81741
81742 /* config parameters */
81743 #define PNP_CONFIG_NORMAL 0x0001
81744 diff --git a/include/linux/poison.h b/include/linux/poison.h
81745 index 2110a81..13a11bb 100644
81746 --- a/include/linux/poison.h
81747 +++ b/include/linux/poison.h
81748 @@ -19,8 +19,8 @@
81749 * under normal circumstances, used to verify that nobody uses
81750 * non-initialized list entries.
81751 */
81752 -#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
81753 -#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)
81754 +#define LIST_POISON1 ((void *) (long)0xFFFFFF01)
81755 +#define LIST_POISON2 ((void *) (long)0xFFFFFF02)
81756
81757 /********** include/linux/timer.h **********/
81758 /*
81759 diff --git a/include/linux/power/smartreflex.h b/include/linux/power/smartreflex.h
81760 index d8b187c3..9a9257a 100644
81761 --- a/include/linux/power/smartreflex.h
81762 +++ b/include/linux/power/smartreflex.h
81763 @@ -238,7 +238,7 @@ struct omap_sr_class_data {
81764 int (*notify)(struct omap_sr *sr, u32 status);
81765 u8 notify_flags;
81766 u8 class_type;
81767 -};
81768 +} __do_const;
81769
81770 /**
81771 * struct omap_sr_nvalue_table - Smartreflex n-target value info
81772 diff --git a/include/linux/ppp-comp.h b/include/linux/ppp-comp.h
81773 index 4ea1d37..80f4b33 100644
81774 --- a/include/linux/ppp-comp.h
81775 +++ b/include/linux/ppp-comp.h
81776 @@ -84,7 +84,7 @@ struct compressor {
81777 struct module *owner;
81778 /* Extra skb space needed by the compressor algorithm */
81779 unsigned int comp_extra;
81780 -};
81781 +} __do_const;
81782
81783 /*
81784 * The return value from decompress routine is the length of the
81785 diff --git a/include/linux/preempt.h b/include/linux/preempt.h
81786 index 1841b58..fbeebf8 100644
81787 --- a/include/linux/preempt.h
81788 +++ b/include/linux/preempt.h
81789 @@ -29,11 +29,16 @@ extern void preempt_count_sub(int val);
81790 #define preempt_count_dec_and_test() __preempt_count_dec_and_test()
81791 #endif
81792
81793 +#define raw_preempt_count_add(val) __preempt_count_add(val)
81794 +#define raw_preempt_count_sub(val) __preempt_count_sub(val)
81795 +
81796 #define __preempt_count_inc() __preempt_count_add(1)
81797 #define __preempt_count_dec() __preempt_count_sub(1)
81798
81799 #define preempt_count_inc() preempt_count_add(1)
81800 +#define raw_preempt_count_inc() raw_preempt_count_add(1)
81801 #define preempt_count_dec() preempt_count_sub(1)
81802 +#define raw_preempt_count_dec() raw_preempt_count_sub(1)
81803
81804 #ifdef CONFIG_PREEMPT_COUNT
81805
81806 @@ -43,6 +48,12 @@ do { \
81807 barrier(); \
81808 } while (0)
81809
81810 +#define raw_preempt_disable() \
81811 +do { \
81812 + raw_preempt_count_inc(); \
81813 + barrier(); \
81814 +} while (0)
81815 +
81816 #define sched_preempt_enable_no_resched() \
81817 do { \
81818 barrier(); \
81819 @@ -51,6 +62,12 @@ do { \
81820
81821 #define preempt_enable_no_resched() sched_preempt_enable_no_resched()
81822
81823 +#define raw_preempt_enable_no_resched() \
81824 +do { \
81825 + barrier(); \
81826 + raw_preempt_count_dec(); \
81827 +} while (0)
81828 +
81829 #ifdef CONFIG_PREEMPT
81830 #define preempt_enable() \
81831 do { \
81832 @@ -115,8 +132,10 @@ do { \
81833 * region.
81834 */
81835 #define preempt_disable() barrier()
81836 +#define raw_preempt_disable() barrier()
81837 #define sched_preempt_enable_no_resched() barrier()
81838 #define preempt_enable_no_resched() barrier()
81839 +#define raw_preempt_enable_no_resched() barrier()
81840 #define preempt_enable() barrier()
81841 #define preempt_check_resched() do { } while (0)
81842
81843 @@ -130,11 +149,13 @@ do { \
81844 /*
81845 * Modules have no business playing preemption tricks.
81846 */
81847 +#ifndef CONFIG_PAX_KERNEXEC
81848 #undef sched_preempt_enable_no_resched
81849 #undef preempt_enable_no_resched
81850 #undef preempt_enable_no_resched_notrace
81851 #undef preempt_check_resched
81852 #endif
81853 +#endif
81854
81855 #define preempt_set_need_resched() \
81856 do { \
81857 diff --git a/include/linux/printk.h b/include/linux/printk.h
81858 index fa47e27..c08e034 100644
81859 --- a/include/linux/printk.h
81860 +++ b/include/linux/printk.h
81861 @@ -114,6 +114,8 @@ static inline __printf(1, 2) __cold
81862 void early_printk(const char *s, ...) { }
81863 #endif
81864
81865 +extern int kptr_restrict;
81866 +
81867 #ifdef CONFIG_PRINTK
81868 asmlinkage __printf(5, 0)
81869 int vprintk_emit(int facility, int level,
81870 @@ -148,7 +150,6 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
81871
81872 extern int printk_delay_msec;
81873 extern int dmesg_restrict;
81874 -extern int kptr_restrict;
81875
81876 extern void wake_up_klogd(void);
81877
81878 diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
81879 index 608e60a..bbcb1a0 100644
81880 --- a/include/linux/proc_fs.h
81881 +++ b/include/linux/proc_fs.h
81882 @@ -17,8 +17,11 @@ extern void proc_flush_task(struct task_struct *);
81883 extern struct proc_dir_entry *proc_symlink(const char *,
81884 struct proc_dir_entry *, const char *);
81885 extern struct proc_dir_entry *proc_mkdir(const char *, struct proc_dir_entry *);
81886 +extern struct proc_dir_entry *proc_mkdir_restrict(const char *, struct proc_dir_entry *);
81887 extern struct proc_dir_entry *proc_mkdir_data(const char *, umode_t,
81888 struct proc_dir_entry *, void *);
81889 +extern struct proc_dir_entry *proc_mkdir_data_restrict(const char *, umode_t,
81890 + struct proc_dir_entry *, void *);
81891 extern struct proc_dir_entry *proc_mkdir_mode(const char *, umode_t,
81892 struct proc_dir_entry *);
81893
81894 @@ -34,6 +37,19 @@ static inline struct proc_dir_entry *proc_create(
81895 return proc_create_data(name, mode, parent, proc_fops, NULL);
81896 }
81897
81898 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, umode_t mode,
81899 + struct proc_dir_entry *parent, const struct file_operations *proc_fops)
81900 +{
81901 +#ifdef CONFIG_GRKERNSEC_PROC_USER
81902 + return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
81903 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
81904 + return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
81905 +#else
81906 + return proc_create_data(name, mode, parent, proc_fops, NULL);
81907 +#endif
81908 +}
81909 +
81910 +
81911 extern void proc_set_size(struct proc_dir_entry *, loff_t);
81912 extern void proc_set_user(struct proc_dir_entry *, kuid_t, kgid_t);
81913 extern void *PDE_DATA(const struct inode *);
81914 @@ -73,7 +89,7 @@ static inline int remove_proc_subtree(const char *name, struct proc_dir_entry *p
81915 static inline struct proc_dir_entry *proc_net_mkdir(
81916 struct net *net, const char *name, struct proc_dir_entry *parent)
81917 {
81918 - return proc_mkdir_data(name, 0, parent, net);
81919 + return proc_mkdir_data_restrict(name, 0, parent, net);
81920 }
81921
81922 #endif /* _LINUX_PROC_FS_H */
81923 diff --git a/include/linux/proc_ns.h b/include/linux/proc_ns.h
81924 index 34a1e10..70f6bde 100644
81925 --- a/include/linux/proc_ns.h
81926 +++ b/include/linux/proc_ns.h
81927 @@ -14,7 +14,7 @@ struct proc_ns_operations {
81928 void (*put)(void *ns);
81929 int (*install)(struct nsproxy *nsproxy, void *ns);
81930 unsigned int (*inum)(void *ns);
81931 -};
81932 +} __do_const __randomize_layout;
81933
81934 struct proc_ns {
81935 void *ns;
81936 diff --git a/include/linux/quota.h b/include/linux/quota.h
81937 index cc7494a..1e27036 100644
81938 --- a/include/linux/quota.h
81939 +++ b/include/linux/quota.h
81940 @@ -70,7 +70,7 @@ struct kqid { /* Type in which we store the quota identifier */
81941
81942 extern bool qid_eq(struct kqid left, struct kqid right);
81943 extern bool qid_lt(struct kqid left, struct kqid right);
81944 -extern qid_t from_kqid(struct user_namespace *to, struct kqid qid);
81945 +extern qid_t from_kqid(struct user_namespace *to, struct kqid qid) __intentional_overflow(-1);
81946 extern qid_t from_kqid_munged(struct user_namespace *to, struct kqid qid);
81947 extern bool qid_valid(struct kqid qid);
81948
81949 diff --git a/include/linux/random.h b/include/linux/random.h
81950 index 1cfce0e..b0b9235 100644
81951 --- a/include/linux/random.h
81952 +++ b/include/linux/random.h
81953 @@ -9,9 +9,19 @@
81954 #include <uapi/linux/random.h>
81955
81956 extern void add_device_randomness(const void *, unsigned int);
81957 +
81958 +static inline void add_latent_entropy(void)
81959 +{
81960 +
81961 +#ifdef LATENT_ENTROPY_PLUGIN
81962 + add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
81963 +#endif
81964 +
81965 +}
81966 +
81967 extern void add_input_randomness(unsigned int type, unsigned int code,
81968 - unsigned int value);
81969 -extern void add_interrupt_randomness(int irq, int irq_flags);
81970 + unsigned int value) __latent_entropy;
81971 +extern void add_interrupt_randomness(int irq, int irq_flags) __latent_entropy;
81972
81973 extern void get_random_bytes(void *buf, int nbytes);
81974 extern void get_random_bytes_arch(void *buf, int nbytes);
81975 @@ -22,10 +32,10 @@ extern int random_int_secret_init(void);
81976 extern const struct file_operations random_fops, urandom_fops;
81977 #endif
81978
81979 -unsigned int get_random_int(void);
81980 +unsigned int __intentional_overflow(-1) get_random_int(void);
81981 unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len);
81982
81983 -u32 prandom_u32(void);
81984 +u32 prandom_u32(void) __intentional_overflow(-1);
81985 void prandom_bytes(void *buf, int nbytes);
81986 void prandom_seed(u32 seed);
81987 void prandom_reseed_late(void);
81988 @@ -37,6 +47,11 @@ struct rnd_state {
81989 u32 prandom_u32_state(struct rnd_state *state);
81990 void prandom_bytes_state(struct rnd_state *state, void *buf, int nbytes);
81991
81992 +static inline unsigned long __intentional_overflow(-1) pax_get_random_long(void)
81993 +{
81994 + return prandom_u32() + (sizeof(long) > 4 ? (unsigned long)prandom_u32() << 32 : 0);
81995 +}
81996 +
81997 /**
81998 * prandom_u32_max - returns a pseudo-random number in interval [0, ep_ro)
81999 * @ep_ro: right open interval endpoint
82000 diff --git a/include/linux/rbtree_augmented.h b/include/linux/rbtree_augmented.h
82001 index fea49b5..2ac22bb 100644
82002 --- a/include/linux/rbtree_augmented.h
82003 +++ b/include/linux/rbtree_augmented.h
82004 @@ -80,7 +80,9 @@ rbname ## _rotate(struct rb_node *rb_old, struct rb_node *rb_new) \
82005 old->rbaugmented = rbcompute(old); \
82006 } \
82007 rbstatic const struct rb_augment_callbacks rbname = { \
82008 - rbname ## _propagate, rbname ## _copy, rbname ## _rotate \
82009 + .propagate = rbname ## _propagate, \
82010 + .copy = rbname ## _copy, \
82011 + .rotate = rbname ## _rotate \
82012 };
82013
82014
82015 diff --git a/include/linux/rculist.h b/include/linux/rculist.h
82016 index dbaf990..52e07b8 100644
82017 --- a/include/linux/rculist.h
82018 +++ b/include/linux/rculist.h
82019 @@ -29,8 +29,8 @@
82020 */
82021 static inline void INIT_LIST_HEAD_RCU(struct list_head *list)
82022 {
82023 - ACCESS_ONCE(list->next) = list;
82024 - ACCESS_ONCE(list->prev) = list;
82025 + ACCESS_ONCE_RW(list->next) = list;
82026 + ACCESS_ONCE_RW(list->prev) = list;
82027 }
82028
82029 /*
82030 @@ -59,6 +59,9 @@ void __list_add_rcu(struct list_head *new,
82031 struct list_head *prev, struct list_head *next);
82032 #endif
82033
82034 +void __pax_list_add_rcu(struct list_head *new,
82035 + struct list_head *prev, struct list_head *next);
82036 +
82037 /**
82038 * list_add_rcu - add a new entry to rcu-protected list
82039 * @new: new entry to be added
82040 @@ -80,6 +83,11 @@ static inline void list_add_rcu(struct list_head *new, struct list_head *head)
82041 __list_add_rcu(new, head, head->next);
82042 }
82043
82044 +static inline void pax_list_add_rcu(struct list_head *new, struct list_head *head)
82045 +{
82046 + __pax_list_add_rcu(new, head, head->next);
82047 +}
82048 +
82049 /**
82050 * list_add_tail_rcu - add a new entry to rcu-protected list
82051 * @new: new entry to be added
82052 @@ -102,6 +110,12 @@ static inline void list_add_tail_rcu(struct list_head *new,
82053 __list_add_rcu(new, head->prev, head);
82054 }
82055
82056 +static inline void pax_list_add_tail_rcu(struct list_head *new,
82057 + struct list_head *head)
82058 +{
82059 + __pax_list_add_rcu(new, head->prev, head);
82060 +}
82061 +
82062 /**
82063 * list_del_rcu - deletes entry from list without re-initialization
82064 * @entry: the element to delete from the list.
82065 @@ -132,6 +146,8 @@ static inline void list_del_rcu(struct list_head *entry)
82066 entry->prev = LIST_POISON2;
82067 }
82068
82069 +extern void pax_list_del_rcu(struct list_head *entry);
82070 +
82071 /**
82072 * hlist_del_init_rcu - deletes entry from hash list with re-initialization
82073 * @n: the element to delete from the hash list.
82074 diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
82075 index 72bf3a0..853347f 100644
82076 --- a/include/linux/rcupdate.h
82077 +++ b/include/linux/rcupdate.h
82078 @@ -588,7 +588,7 @@ static inline void rcu_preempt_sleep_check(void)
82079 #define rcu_assign_pointer(p, v) \
82080 do { \
82081 smp_wmb(); \
82082 - ACCESS_ONCE(p) = RCU_INITIALIZER(v); \
82083 + ACCESS_ONCE_RW(p) = RCU_INITIALIZER(v); \
82084 } while (0)
82085
82086
82087 diff --git a/include/linux/reboot.h b/include/linux/reboot.h
82088 index 9e7db9e..7d4fd72 100644
82089 --- a/include/linux/reboot.h
82090 +++ b/include/linux/reboot.h
82091 @@ -44,9 +44,9 @@ extern int unregister_reboot_notifier(struct notifier_block *);
82092 */
82093
82094 extern void migrate_to_reboot_cpu(void);
82095 -extern void machine_restart(char *cmd);
82096 -extern void machine_halt(void);
82097 -extern void machine_power_off(void);
82098 +extern void machine_restart(char *cmd) __noreturn;
82099 +extern void machine_halt(void) __noreturn;
82100 +extern void machine_power_off(void) __noreturn;
82101
82102 extern void machine_shutdown(void);
82103 struct pt_regs;
82104 @@ -57,9 +57,9 @@ extern void machine_crash_shutdown(struct pt_regs *);
82105 */
82106
82107 extern void kernel_restart_prepare(char *cmd);
82108 -extern void kernel_restart(char *cmd);
82109 -extern void kernel_halt(void);
82110 -extern void kernel_power_off(void);
82111 +extern void kernel_restart(char *cmd) __noreturn;
82112 +extern void kernel_halt(void) __noreturn;
82113 +extern void kernel_power_off(void) __noreturn;
82114
82115 extern int C_A_D; /* for sysctl */
82116 void ctrl_alt_del(void);
82117 @@ -73,7 +73,7 @@ extern int orderly_poweroff(bool force);
82118 * Emergency restart, callable from an interrupt handler.
82119 */
82120
82121 -extern void emergency_restart(void);
82122 +extern void emergency_restart(void) __noreturn;
82123 #include <asm/emergency-restart.h>
82124
82125 #endif /* _LINUX_REBOOT_H */
82126 diff --git a/include/linux/regset.h b/include/linux/regset.h
82127 index 8e0c9fe..ac4d221 100644
82128 --- a/include/linux/regset.h
82129 +++ b/include/linux/regset.h
82130 @@ -161,7 +161,8 @@ struct user_regset {
82131 unsigned int align;
82132 unsigned int bias;
82133 unsigned int core_note_type;
82134 -};
82135 +} __do_const;
82136 +typedef struct user_regset __no_const user_regset_no_const;
82137
82138 /**
82139 * struct user_regset_view - available regsets
82140 diff --git a/include/linux/relay.h b/include/linux/relay.h
82141 index d7c8359..818daf5 100644
82142 --- a/include/linux/relay.h
82143 +++ b/include/linux/relay.h
82144 @@ -157,7 +157,7 @@ struct rchan_callbacks
82145 * The callback should return 0 if successful, negative if not.
82146 */
82147 int (*remove_buf_file)(struct dentry *dentry);
82148 -};
82149 +} __no_const;
82150
82151 /*
82152 * CONFIG_RELAY kernel API, kernel/relay.c
82153 diff --git a/include/linux/rio.h b/include/linux/rio.h
82154 index b71d573..2f940bd 100644
82155 --- a/include/linux/rio.h
82156 +++ b/include/linux/rio.h
82157 @@ -355,7 +355,7 @@ struct rio_ops {
82158 int (*map_inb)(struct rio_mport *mport, dma_addr_t lstart,
82159 u64 rstart, u32 size, u32 flags);
82160 void (*unmap_inb)(struct rio_mport *mport, dma_addr_t lstart);
82161 -};
82162 +} __no_const;
82163
82164 #define RIO_RESOURCE_MEM 0x00000100
82165 #define RIO_RESOURCE_DOORBELL 0x00000200
82166 diff --git a/include/linux/rmap.h b/include/linux/rmap.h
82167 index b66c211..13d2915 100644
82168 --- a/include/linux/rmap.h
82169 +++ b/include/linux/rmap.h
82170 @@ -145,8 +145,8 @@ static inline void anon_vma_unlock_read(struct anon_vma *anon_vma)
82171 void anon_vma_init(void); /* create anon_vma_cachep */
82172 int anon_vma_prepare(struct vm_area_struct *);
82173 void unlink_anon_vmas(struct vm_area_struct *);
82174 -int anon_vma_clone(struct vm_area_struct *, struct vm_area_struct *);
82175 -int anon_vma_fork(struct vm_area_struct *, struct vm_area_struct *);
82176 +int anon_vma_clone(struct vm_area_struct *, const struct vm_area_struct *);
82177 +int anon_vma_fork(struct vm_area_struct *, const struct vm_area_struct *);
82178
82179 static inline void anon_vma_merge(struct vm_area_struct *vma,
82180 struct vm_area_struct *next)
82181 diff --git a/include/linux/sched.h b/include/linux/sched.h
82182 index ccd0c6f..39c28a4 100644
82183 --- a/include/linux/sched.h
82184 +++ b/include/linux/sched.h
82185 @@ -129,6 +129,7 @@ struct fs_struct;
82186 struct perf_event_context;
82187 struct blk_plug;
82188 struct filename;
82189 +struct linux_binprm;
82190
82191 /*
82192 * List of flags we want to share for kernel threads,
82193 @@ -369,7 +370,7 @@ extern char __sched_text_start[], __sched_text_end[];
82194 extern int in_sched_functions(unsigned long addr);
82195
82196 #define MAX_SCHEDULE_TIMEOUT LONG_MAX
82197 -extern signed long schedule_timeout(signed long timeout);
82198 +extern signed long schedule_timeout(signed long timeout) __intentional_overflow(-1);
82199 extern signed long schedule_timeout_interruptible(signed long timeout);
82200 extern signed long schedule_timeout_killable(signed long timeout);
82201 extern signed long schedule_timeout_uninterruptible(signed long timeout);
82202 @@ -380,6 +381,19 @@ struct nsproxy;
82203 struct user_namespace;
82204
82205 #ifdef CONFIG_MMU
82206 +
82207 +#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
82208 +extern unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags);
82209 +#else
82210 +static inline unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
82211 +{
82212 + return 0;
82213 +}
82214 +#endif
82215 +
82216 +extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len, unsigned long offset);
82217 +extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset);
82218 +
82219 extern void arch_pick_mmap_layout(struct mm_struct *mm);
82220 extern unsigned long
82221 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
82222 @@ -677,6 +691,17 @@ struct signal_struct {
82223 #ifdef CONFIG_TASKSTATS
82224 struct taskstats *stats;
82225 #endif
82226 +
82227 +#ifdef CONFIG_GRKERNSEC
82228 + u32 curr_ip;
82229 + u32 saved_ip;
82230 + u32 gr_saddr;
82231 + u32 gr_daddr;
82232 + u16 gr_sport;
82233 + u16 gr_dport;
82234 + u8 used_accept:1;
82235 +#endif
82236 +
82237 #ifdef CONFIG_AUDIT
82238 unsigned audit_tty;
82239 unsigned audit_tty_log_passwd;
82240 @@ -703,7 +728,7 @@ struct signal_struct {
82241 struct mutex cred_guard_mutex; /* guard against foreign influences on
82242 * credential calculations
82243 * (notably. ptrace) */
82244 -};
82245 +} __randomize_layout;
82246
82247 /*
82248 * Bits in flags field of signal_struct.
82249 @@ -757,6 +782,14 @@ struct user_struct {
82250 struct key *session_keyring; /* UID's default session keyring */
82251 #endif
82252
82253 +#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
82254 + unsigned char kernel_banned;
82255 +#endif
82256 +#ifdef CONFIG_GRKERNSEC_BRUTE
82257 + unsigned char suid_banned;
82258 + unsigned long suid_ban_expires;
82259 +#endif
82260 +
82261 /* Hash table maintenance information */
82262 struct hlist_node uidhash_node;
82263 kuid_t uid;
82264 @@ -764,7 +797,7 @@ struct user_struct {
82265 #ifdef CONFIG_PERF_EVENTS
82266 atomic_long_t locked_vm;
82267 #endif
82268 -};
82269 +} __randomize_layout;
82270
82271 extern int uids_sysfs_init(void);
82272
82273 @@ -1286,8 +1319,8 @@ struct task_struct {
82274 struct list_head thread_node;
82275
82276 struct completion *vfork_done; /* for vfork() */
82277 - int __user *set_child_tid; /* CLONE_CHILD_SETTID */
82278 - int __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
82279 + pid_t __user *set_child_tid; /* CLONE_CHILD_SETTID */
82280 + pid_t __user *clear_child_tid; /* CLONE_CHILD_CLEARTID */
82281
82282 cputime_t utime, stime, utimescaled, stimescaled;
82283 cputime_t gtime;
82284 @@ -1312,11 +1345,6 @@ struct task_struct {
82285 struct task_cputime cputime_expires;
82286 struct list_head cpu_timers[3];
82287
82288 -/* process credentials */
82289 - const struct cred __rcu *real_cred; /* objective and real subjective task
82290 - * credentials (COW) */
82291 - const struct cred __rcu *cred; /* effective (overridable) subjective task
82292 - * credentials (COW) */
82293 char comm[TASK_COMM_LEN]; /* executable name excluding path
82294 - access with [gs]et_task_comm (which lock
82295 it with task_lock())
82296 @@ -1333,6 +1361,10 @@ struct task_struct {
82297 #endif
82298 /* CPU-specific state of this task */
82299 struct thread_struct thread;
82300 +/* thread_info moved to task_struct */
82301 +#ifdef CONFIG_X86
82302 + struct thread_info tinfo;
82303 +#endif
82304 /* filesystem information */
82305 struct fs_struct *fs;
82306 /* open file information */
82307 @@ -1409,6 +1441,10 @@ struct task_struct {
82308 gfp_t lockdep_reclaim_gfp;
82309 #endif
82310
82311 +/* process credentials */
82312 + const struct cred __rcu *real_cred; /* objective and real subjective task
82313 + * credentials (COW) */
82314 +
82315 /* journalling filesystem info */
82316 void *journal_info;
82317
82318 @@ -1447,6 +1483,10 @@ struct task_struct {
82319 /* cg_list protected by css_set_lock and tsk->alloc_lock */
82320 struct list_head cg_list;
82321 #endif
82322 +
82323 + const struct cred __rcu *cred; /* effective (overridable) subjective task
82324 + * credentials (COW) */
82325 +
82326 #ifdef CONFIG_FUTEX
82327 struct robust_list_head __user *robust_list;
82328 #ifdef CONFIG_COMPAT
82329 @@ -1581,7 +1621,78 @@ struct task_struct {
82330 unsigned int sequential_io;
82331 unsigned int sequential_io_avg;
82332 #endif
82333 -};
82334 +
82335 +#ifdef CONFIG_GRKERNSEC
82336 + /* grsecurity */
82337 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
82338 + u64 exec_id;
82339 +#endif
82340 +#ifdef CONFIG_GRKERNSEC_SETXID
82341 + const struct cred *delayed_cred;
82342 +#endif
82343 + struct dentry *gr_chroot_dentry;
82344 + struct acl_subject_label *acl;
82345 + struct acl_subject_label *tmpacl;
82346 + struct acl_role_label *role;
82347 + struct file *exec_file;
82348 + unsigned long brute_expires;
82349 + u16 acl_role_id;
82350 + u8 inherited;
82351 + /* is this the task that authenticated to the special role */
82352 + u8 acl_sp_role;
82353 + u8 is_writable;
82354 + u8 brute;
82355 + u8 gr_is_chrooted;
82356 +#endif
82357 +
82358 +} __randomize_layout;
82359 +
82360 +#define MF_PAX_PAGEEXEC 0x01000000 /* Paging based non-executable pages */
82361 +#define MF_PAX_EMUTRAMP 0x02000000 /* Emulate trampolines */
82362 +#define MF_PAX_MPROTECT 0x04000000 /* Restrict mprotect() */
82363 +#define MF_PAX_RANDMMAP 0x08000000 /* Randomize mmap() base */
82364 +/*#define MF_PAX_RANDEXEC 0x10000000*/ /* Randomize ET_EXEC base */
82365 +#define MF_PAX_SEGMEXEC 0x20000000 /* Segmentation based non-executable pages */
82366 +
82367 +#ifdef CONFIG_PAX_SOFTMODE
82368 +extern int pax_softmode;
82369 +#endif
82370 +
82371 +extern int pax_check_flags(unsigned long *);
82372 +#define PAX_PARSE_FLAGS_FALLBACK (~0UL)
82373 +
82374 +/* if tsk != current then task_lock must be held on it */
82375 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
82376 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
82377 +{
82378 + if (likely(tsk->mm))
82379 + return tsk->mm->pax_flags;
82380 + else
82381 + return 0UL;
82382 +}
82383 +
82384 +/* if tsk != current then task_lock must be held on it */
82385 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
82386 +{
82387 + if (likely(tsk->mm)) {
82388 + tsk->mm->pax_flags = flags;
82389 + return 0;
82390 + }
82391 + return -EINVAL;
82392 +}
82393 +#endif
82394 +
82395 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
82396 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
82397 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
82398 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
82399 +#endif
82400 +
82401 +struct path;
82402 +extern char *pax_get_path(const struct path *path, char *buf, int buflen);
82403 +extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
82404 +extern void pax_report_insns(struct pt_regs *regs, void *pc, void *sp);
82405 +extern void pax_report_refcount_overflow(struct pt_regs *regs);
82406
82407 /* Future-safe accessor for struct task_struct's cpus_allowed. */
82408 #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
82409 @@ -1658,7 +1769,7 @@ struct pid_namespace;
82410 pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
82411 struct pid_namespace *ns);
82412
82413 -static inline pid_t task_pid_nr(struct task_struct *tsk)
82414 +static inline pid_t task_pid_nr(const struct task_struct *tsk)
82415 {
82416 return tsk->pid;
82417 }
82418 @@ -2006,6 +2117,25 @@ extern u64 sched_clock_cpu(int cpu);
82419
82420 extern void sched_clock_init(void);
82421
82422 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
82423 +static inline void populate_stack(void)
82424 +{
82425 + struct task_struct *curtask = current;
82426 + int c;
82427 + int *ptr = curtask->stack;
82428 + int *end = curtask->stack + THREAD_SIZE;
82429 +
82430 + while (ptr < end) {
82431 + c = *(volatile int *)ptr;
82432 + ptr += PAGE_SIZE/sizeof(int);
82433 + }
82434 +}
82435 +#else
82436 +static inline void populate_stack(void)
82437 +{
82438 +}
82439 +#endif
82440 +
82441 #ifndef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
82442 static inline void sched_clock_tick(void)
82443 {
82444 @@ -2130,7 +2260,9 @@ void yield(void);
82445 extern struct exec_domain default_exec_domain;
82446
82447 union thread_union {
82448 +#ifndef CONFIG_X86
82449 struct thread_info thread_info;
82450 +#endif
82451 unsigned long stack[THREAD_SIZE/sizeof(long)];
82452 };
82453
82454 @@ -2163,6 +2295,7 @@ extern struct pid_namespace init_pid_ns;
82455 */
82456
82457 extern struct task_struct *find_task_by_vpid(pid_t nr);
82458 +extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
82459 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
82460 struct pid_namespace *ns);
82461
82462 @@ -2325,7 +2458,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
82463 extern void exit_itimers(struct signal_struct *);
82464 extern void flush_itimer_signals(void);
82465
82466 -extern void do_group_exit(int);
82467 +extern __noreturn void do_group_exit(int);
82468
82469 extern int allow_signal(int);
82470 extern int disallow_signal(int);
82471 @@ -2526,9 +2659,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
82472
82473 #endif
82474
82475 -static inline int object_is_on_stack(void *obj)
82476 +static inline int object_starts_on_stack(void *obj)
82477 {
82478 - void *stack = task_stack_page(current);
82479 + const void *stack = task_stack_page(current);
82480
82481 return (obj >= stack) && (obj < (stack + THREAD_SIZE));
82482 }
82483 diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
82484 index 8045a55..c959cd5 100644
82485 --- a/include/linux/sched/sysctl.h
82486 +++ b/include/linux/sched/sysctl.h
82487 @@ -30,6 +30,7 @@ enum { sysctl_hung_task_timeout_secs = 0 };
82488 #define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
82489
82490 extern int sysctl_max_map_count;
82491 +extern unsigned long sysctl_heap_stack_gap;
82492
82493 extern unsigned int sysctl_sched_latency;
82494 extern unsigned int sysctl_sched_min_granularity;
82495 diff --git a/include/linux/security.h b/include/linux/security.h
82496 index 2fc42d1..4d802f2 100644
82497 --- a/include/linux/security.h
82498 +++ b/include/linux/security.h
82499 @@ -27,6 +27,7 @@
82500 #include <linux/slab.h>
82501 #include <linux/err.h>
82502 #include <linux/string.h>
82503 +#include <linux/grsecurity.h>
82504
82505 struct linux_binprm;
82506 struct cred;
82507 @@ -116,8 +117,6 @@ struct seq_file;
82508
82509 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
82510
82511 -void reset_security_ops(void);
82512 -
82513 #ifdef CONFIG_MMU
82514 extern unsigned long mmap_min_addr;
82515 extern unsigned long dac_mmap_min_addr;
82516 @@ -1719,7 +1718,7 @@ struct security_operations {
82517 struct audit_context *actx);
82518 void (*audit_rule_free) (void *lsmrule);
82519 #endif /* CONFIG_AUDIT */
82520 -};
82521 +} __randomize_layout;
82522
82523 /* prototypes */
82524 extern int security_init(void);
82525 diff --git a/include/linux/semaphore.h b/include/linux/semaphore.h
82526 index dc368b8..e895209 100644
82527 --- a/include/linux/semaphore.h
82528 +++ b/include/linux/semaphore.h
82529 @@ -37,7 +37,7 @@ static inline void sema_init(struct semaphore *sem, int val)
82530 }
82531
82532 extern void down(struct semaphore *sem);
82533 -extern int __must_check down_interruptible(struct semaphore *sem);
82534 +extern int __must_check down_interruptible(struct semaphore *sem) __intentional_overflow(-1);
82535 extern int __must_check down_killable(struct semaphore *sem);
82536 extern int __must_check down_trylock(struct semaphore *sem);
82537 extern int __must_check down_timeout(struct semaphore *sem, long jiffies);
82538 diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
82539 index 52e0097..383f21d 100644
82540 --- a/include/linux/seq_file.h
82541 +++ b/include/linux/seq_file.h
82542 @@ -27,6 +27,9 @@ struct seq_file {
82543 struct mutex lock;
82544 const struct seq_operations *op;
82545 int poll_event;
82546 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
82547 + u64 exec_id;
82548 +#endif
82549 #ifdef CONFIG_USER_NS
82550 struct user_namespace *user_ns;
82551 #endif
82552 @@ -39,6 +42,7 @@ struct seq_operations {
82553 void * (*next) (struct seq_file *m, void *v, loff_t *pos);
82554 int (*show) (struct seq_file *m, void *v);
82555 };
82556 +typedef struct seq_operations __no_const seq_operations_no_const;
82557
82558 #define SEQ_SKIP 1
82559
82560 @@ -96,6 +100,7 @@ void seq_pad(struct seq_file *m, char c);
82561
82562 char *mangle_path(char *s, const char *p, const char *esc);
82563 int seq_open(struct file *, const struct seq_operations *);
82564 +int seq_open_restrict(struct file *, const struct seq_operations *);
82565 ssize_t seq_read(struct file *, char __user *, size_t, loff_t *);
82566 loff_t seq_lseek(struct file *, loff_t, int);
82567 int seq_release(struct inode *, struct file *);
82568 @@ -138,6 +143,7 @@ static inline int seq_nodemask_list(struct seq_file *m, nodemask_t *mask)
82569 }
82570
82571 int single_open(struct file *, int (*)(struct seq_file *, void *), void *);
82572 +int single_open_restrict(struct file *, int (*)(struct seq_file *, void *), void *);
82573 int single_open_size(struct file *, int (*)(struct seq_file *, void *), void *, size_t);
82574 int single_release(struct inode *, struct file *);
82575 void *__seq_open_private(struct file *, const struct seq_operations *, int);
82576 diff --git a/include/linux/shm.h b/include/linux/shm.h
82577 index 1e2cd2e..0288750 100644
82578 --- a/include/linux/shm.h
82579 +++ b/include/linux/shm.h
82580 @@ -21,6 +21,10 @@ struct shmid_kernel /* private to the kernel */
82581
82582 /* The task created the shm object. NULL if the task is dead. */
82583 struct task_struct *shm_creator;
82584 +#ifdef CONFIG_GRKERNSEC
82585 + time_t shm_createtime;
82586 + pid_t shm_lapid;
82587 +#endif
82588 };
82589
82590 /* shm_mode upper byte flags */
82591 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
82592 index 15ede6a..80161c3 100644
82593 --- a/include/linux/skbuff.h
82594 +++ b/include/linux/skbuff.h
82595 @@ -662,7 +662,7 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
82596 struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags,
82597 int node);
82598 struct sk_buff *build_skb(void *data, unsigned int frag_size);
82599 -static inline struct sk_buff *alloc_skb(unsigned int size,
82600 +static inline struct sk_buff * __intentional_overflow(0) alloc_skb(unsigned int size,
82601 gfp_t priority)
82602 {
82603 return __alloc_skb(size, priority, 0, NUMA_NO_NODE);
82604 @@ -1768,7 +1768,7 @@ static inline u32 skb_inner_network_header_len(const struct sk_buff *skb)
82605 return skb->inner_transport_header - skb->inner_network_header;
82606 }
82607
82608 -static inline int skb_network_offset(const struct sk_buff *skb)
82609 +static inline int __intentional_overflow(0) skb_network_offset(const struct sk_buff *skb)
82610 {
82611 return skb_network_header(skb) - skb->data;
82612 }
82613 @@ -1828,7 +1828,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
82614 * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
82615 */
82616 #ifndef NET_SKB_PAD
82617 -#define NET_SKB_PAD max(32, L1_CACHE_BYTES)
82618 +#define NET_SKB_PAD max(_AC(32,UL), L1_CACHE_BYTES)
82619 #endif
82620
82621 int ___pskb_trim(struct sk_buff *skb, unsigned int len);
82622 @@ -2427,7 +2427,7 @@ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
82623 int *err);
82624 unsigned int datagram_poll(struct file *file, struct socket *sock,
82625 struct poll_table_struct *wait);
82626 -int skb_copy_datagram_iovec(const struct sk_buff *from, int offset,
82627 +int __intentional_overflow(0) skb_copy_datagram_iovec(const struct sk_buff *from, int offset,
82628 struct iovec *to, int size);
82629 int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb, int hlen,
82630 struct iovec *iov);
82631 @@ -2721,6 +2721,9 @@ static inline void nf_reset(struct sk_buff *skb)
82632 nf_bridge_put(skb->nf_bridge);
82633 skb->nf_bridge = NULL;
82634 #endif
82635 +#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
82636 + skb->nf_trace = 0;
82637 +#endif
82638 }
82639
82640 static inline void nf_reset_trace(struct sk_buff *skb)
82641 diff --git a/include/linux/slab.h b/include/linux/slab.h
82642 index b5b2df6..69f5734 100644
82643 --- a/include/linux/slab.h
82644 +++ b/include/linux/slab.h
82645 @@ -14,15 +14,29 @@
82646 #include <linux/gfp.h>
82647 #include <linux/types.h>
82648 #include <linux/workqueue.h>
82649 -
82650 +#include <linux/err.h>
82651
82652 /*
82653 * Flags to pass to kmem_cache_create().
82654 * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
82655 */
82656 #define SLAB_DEBUG_FREE 0x00000100UL /* DEBUG: Perform (expensive) checks on free */
82657 +
82658 +#ifdef CONFIG_PAX_USERCOPY_SLABS
82659 +#define SLAB_USERCOPY 0x00000200UL /* PaX: Allow copying objs to/from userland */
82660 +#else
82661 +#define SLAB_USERCOPY 0x00000000UL
82662 +#endif
82663 +
82664 #define SLAB_RED_ZONE 0x00000400UL /* DEBUG: Red zone objs in a cache */
82665 #define SLAB_POISON 0x00000800UL /* DEBUG: Poison objects */
82666 +
82667 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
82668 +#define SLAB_NO_SANITIZE 0x00001000UL /* PaX: Do not sanitize objs on free */
82669 +#else
82670 +#define SLAB_NO_SANITIZE 0x00000000UL
82671 +#endif
82672 +
82673 #define SLAB_HWCACHE_ALIGN 0x00002000UL /* Align objs on cache lines */
82674 #define SLAB_CACHE_DMA 0x00004000UL /* Use GFP_DMA memory */
82675 #define SLAB_STORE_USER 0x00010000UL /* DEBUG: Store the last owner for bug hunting */
82676 @@ -98,10 +112,13 @@
82677 * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
82678 * Both make kfree a no-op.
82679 */
82680 -#define ZERO_SIZE_PTR ((void *)16)
82681 +#define ZERO_SIZE_PTR \
82682 +({ \
82683 + BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
82684 + (void *)(-MAX_ERRNO-1L); \
82685 +})
82686
82687 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
82688 - (unsigned long)ZERO_SIZE_PTR)
82689 +#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
82690
82691 #include <linux/kmemleak.h>
82692
82693 @@ -142,6 +159,8 @@ void * __must_check krealloc(const void *, size_t, gfp_t);
82694 void kfree(const void *);
82695 void kzfree(const void *);
82696 size_t ksize(const void *);
82697 +const char *check_heap_object(const void *ptr, unsigned long n);
82698 +bool is_usercopy_object(const void *ptr);
82699
82700 /*
82701 * Some archs want to perform DMA into kmalloc caches and need a guaranteed
82702 @@ -174,7 +193,7 @@ struct kmem_cache {
82703 unsigned int align; /* Alignment as calculated */
82704 unsigned long flags; /* Active flags on the slab */
82705 const char *name; /* Slab name for sysfs */
82706 - int refcount; /* Use counter */
82707 + atomic_t refcount; /* Use counter */
82708 void (*ctor)(void *); /* Called on object slot creation */
82709 struct list_head list; /* List of all slab caches on the system */
82710 };
82711 @@ -248,6 +267,10 @@ extern struct kmem_cache *kmalloc_caches[KMALLOC_SHIFT_HIGH + 1];
82712 extern struct kmem_cache *kmalloc_dma_caches[KMALLOC_SHIFT_HIGH + 1];
82713 #endif
82714
82715 +#ifdef CONFIG_PAX_USERCOPY_SLABS
82716 +extern struct kmem_cache *kmalloc_usercopy_caches[KMALLOC_SHIFT_HIGH + 1];
82717 +#endif
82718 +
82719 /*
82720 * Figure out which kmalloc slab an allocation of a certain size
82721 * belongs to.
82722 @@ -256,7 +279,7 @@ extern struct kmem_cache *kmalloc_dma_caches[KMALLOC_SHIFT_HIGH + 1];
82723 * 2 = 120 .. 192 bytes
82724 * n = 2^(n-1) .. 2^n -1
82725 */
82726 -static __always_inline int kmalloc_index(size_t size)
82727 +static __always_inline __size_overflow(1) int kmalloc_index(size_t size)
82728 {
82729 if (!size)
82730 return 0;
82731 @@ -299,11 +322,11 @@ static __always_inline int kmalloc_index(size_t size)
82732 }
82733 #endif /* !CONFIG_SLOB */
82734
82735 -void *__kmalloc(size_t size, gfp_t flags);
82736 +void *__kmalloc(size_t size, gfp_t flags) __alloc_size(1);
82737 void *kmem_cache_alloc(struct kmem_cache *, gfp_t flags);
82738
82739 #ifdef CONFIG_NUMA
82740 -void *__kmalloc_node(size_t size, gfp_t flags, int node);
82741 +void *__kmalloc_node(size_t size, gfp_t flags, int node) __alloc_size(1);
82742 void *kmem_cache_alloc_node(struct kmem_cache *, gfp_t flags, int node);
82743 #else
82744 static __always_inline void *__kmalloc_node(size_t size, gfp_t flags, int node)
82745 diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
82746 index 8235dfb..47ce586 100644
82747 --- a/include/linux/slab_def.h
82748 +++ b/include/linux/slab_def.h
82749 @@ -38,7 +38,7 @@ struct kmem_cache {
82750 /* 4) cache creation/removal */
82751 const char *name;
82752 struct list_head list;
82753 - int refcount;
82754 + atomic_t refcount;
82755 int object_size;
82756 int align;
82757
82758 @@ -54,10 +54,14 @@ struct kmem_cache {
82759 unsigned long node_allocs;
82760 unsigned long node_frees;
82761 unsigned long node_overflow;
82762 - atomic_t allochit;
82763 - atomic_t allocmiss;
82764 - atomic_t freehit;
82765 - atomic_t freemiss;
82766 + atomic_unchecked_t allochit;
82767 + atomic_unchecked_t allocmiss;
82768 + atomic_unchecked_t freehit;
82769 + atomic_unchecked_t freemiss;
82770 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
82771 + atomic_unchecked_t sanitized;
82772 + atomic_unchecked_t not_sanitized;
82773 +#endif
82774
82775 /*
82776 * If debugging is enabled, then the allocator can add additional
82777 diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
82778 index f56bfa9..8378a26 100644
82779 --- a/include/linux/slub_def.h
82780 +++ b/include/linux/slub_def.h
82781 @@ -74,7 +74,7 @@ struct kmem_cache {
82782 struct kmem_cache_order_objects max;
82783 struct kmem_cache_order_objects min;
82784 gfp_t allocflags; /* gfp flags to use on each alloc */
82785 - int refcount; /* Refcount for slab cache destroy */
82786 + atomic_t refcount; /* Refcount for slab cache destroy */
82787 void (*ctor)(void *);
82788 int inuse; /* Offset to metadata */
82789 int align; /* Alignment */
82790 diff --git a/include/linux/smp.h b/include/linux/smp.h
82791 index 6ae004e..2743532 100644
82792 --- a/include/linux/smp.h
82793 +++ b/include/linux/smp.h
82794 @@ -180,7 +180,9 @@ static inline void kick_all_cpus_sync(void) { }
82795 #endif
82796
82797 #define get_cpu() ({ preempt_disable(); smp_processor_id(); })
82798 +#define raw_get_cpu() ({ raw_preempt_disable(); raw_smp_processor_id(); })
82799 #define put_cpu() preempt_enable()
82800 +#define raw_put_cpu_no_resched() raw_preempt_enable_no_resched()
82801
82802 /*
82803 * Callback to arch code if there's nosmp or maxcpus=0 on the
82804 diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
82805 index 302ab80..3233276 100644
82806 --- a/include/linux/sock_diag.h
82807 +++ b/include/linux/sock_diag.h
82808 @@ -11,7 +11,7 @@ struct sock;
82809 struct sock_diag_handler {
82810 __u8 family;
82811 int (*dump)(struct sk_buff *skb, struct nlmsghdr *nlh);
82812 -};
82813 +} __do_const;
82814
82815 int sock_diag_register(const struct sock_diag_handler *h);
82816 void sock_diag_unregister(const struct sock_diag_handler *h);
82817 diff --git a/include/linux/sonet.h b/include/linux/sonet.h
82818 index 680f9a3..f13aeb0 100644
82819 --- a/include/linux/sonet.h
82820 +++ b/include/linux/sonet.h
82821 @@ -7,7 +7,7 @@
82822 #include <uapi/linux/sonet.h>
82823
82824 struct k_sonet_stats {
82825 -#define __HANDLE_ITEM(i) atomic_t i
82826 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
82827 __SONET_ITEMS
82828 #undef __HANDLE_ITEM
82829 };
82830 diff --git a/include/linux/sunrpc/addr.h b/include/linux/sunrpc/addr.h
82831 index 07d8e53..dc934c9 100644
82832 --- a/include/linux/sunrpc/addr.h
82833 +++ b/include/linux/sunrpc/addr.h
82834 @@ -23,9 +23,9 @@ static inline unsigned short rpc_get_port(const struct sockaddr *sap)
82835 {
82836 switch (sap->sa_family) {
82837 case AF_INET:
82838 - return ntohs(((struct sockaddr_in *)sap)->sin_port);
82839 + return ntohs(((const struct sockaddr_in *)sap)->sin_port);
82840 case AF_INET6:
82841 - return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
82842 + return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
82843 }
82844 return 0;
82845 }
82846 @@ -58,7 +58,7 @@ static inline bool __rpc_cmp_addr4(const struct sockaddr *sap1,
82847 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
82848 const struct sockaddr *src)
82849 {
82850 - const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
82851 + const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
82852 struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
82853
82854 dsin->sin_family = ssin->sin_family;
82855 @@ -164,7 +164,7 @@ static inline u32 rpc_get_scope_id(const struct sockaddr *sa)
82856 if (sa->sa_family != AF_INET6)
82857 return 0;
82858
82859 - return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
82860 + return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
82861 }
82862
82863 #endif /* _LINUX_SUNRPC_ADDR_H */
82864 diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
82865 index 8af2804..c7414ef 100644
82866 --- a/include/linux/sunrpc/clnt.h
82867 +++ b/include/linux/sunrpc/clnt.h
82868 @@ -97,7 +97,7 @@ struct rpc_procinfo {
82869 unsigned int p_timer; /* Which RTT timer to use */
82870 u32 p_statidx; /* Which procedure to account */
82871 const char * p_name; /* name of procedure */
82872 -};
82873 +} __do_const;
82874
82875 #ifdef __KERNEL__
82876
82877 diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
82878 index 04e7632..2e2a8a3 100644
82879 --- a/include/linux/sunrpc/svc.h
82880 +++ b/include/linux/sunrpc/svc.h
82881 @@ -412,7 +412,7 @@ struct svc_procedure {
82882 unsigned int pc_count; /* call count */
82883 unsigned int pc_cachetype; /* cache info (NFS) */
82884 unsigned int pc_xdrressize; /* maximum size of XDR reply */
82885 -};
82886 +} __do_const;
82887
82888 /*
82889 * Function prototypes.
82890 diff --git a/include/linux/sunrpc/svc_rdma.h b/include/linux/sunrpc/svc_rdma.h
82891 index 0b8e3e6..33e0a01 100644
82892 --- a/include/linux/sunrpc/svc_rdma.h
82893 +++ b/include/linux/sunrpc/svc_rdma.h
82894 @@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
82895 extern unsigned int svcrdma_max_requests;
82896 extern unsigned int svcrdma_max_req_size;
82897
82898 -extern atomic_t rdma_stat_recv;
82899 -extern atomic_t rdma_stat_read;
82900 -extern atomic_t rdma_stat_write;
82901 -extern atomic_t rdma_stat_sq_starve;
82902 -extern atomic_t rdma_stat_rq_starve;
82903 -extern atomic_t rdma_stat_rq_poll;
82904 -extern atomic_t rdma_stat_rq_prod;
82905 -extern atomic_t rdma_stat_sq_poll;
82906 -extern atomic_t rdma_stat_sq_prod;
82907 +extern atomic_unchecked_t rdma_stat_recv;
82908 +extern atomic_unchecked_t rdma_stat_read;
82909 +extern atomic_unchecked_t rdma_stat_write;
82910 +extern atomic_unchecked_t rdma_stat_sq_starve;
82911 +extern atomic_unchecked_t rdma_stat_rq_starve;
82912 +extern atomic_unchecked_t rdma_stat_rq_poll;
82913 +extern atomic_unchecked_t rdma_stat_rq_prod;
82914 +extern atomic_unchecked_t rdma_stat_sq_poll;
82915 +extern atomic_unchecked_t rdma_stat_sq_prod;
82916
82917 #define RPCRDMA_VERSION 1
82918
82919 diff --git a/include/linux/sunrpc/svcauth.h b/include/linux/sunrpc/svcauth.h
82920 index 8d71d65..f79586e 100644
82921 --- a/include/linux/sunrpc/svcauth.h
82922 +++ b/include/linux/sunrpc/svcauth.h
82923 @@ -120,7 +120,7 @@ struct auth_ops {
82924 int (*release)(struct svc_rqst *rq);
82925 void (*domain_release)(struct auth_domain *);
82926 int (*set_client)(struct svc_rqst *rq);
82927 -};
82928 +} __do_const;
82929
82930 #define SVC_GARBAGE 1
82931 #define SVC_SYSERR 2
82932 diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
82933 index a5ffd32..0935dea 100644
82934 --- a/include/linux/swiotlb.h
82935 +++ b/include/linux/swiotlb.h
82936 @@ -60,7 +60,8 @@ extern void
82937
82938 extern void
82939 swiotlb_free_coherent(struct device *hwdev, size_t size,
82940 - void *vaddr, dma_addr_t dma_handle);
82941 + void *vaddr, dma_addr_t dma_handle,
82942 + struct dma_attrs *attrs);
82943
82944 extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
82945 unsigned long offset, size_t size,
82946 diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
82947 index a747a77..9e14df7 100644
82948 --- a/include/linux/syscalls.h
82949 +++ b/include/linux/syscalls.h
82950 @@ -98,8 +98,14 @@ struct sigaltstack;
82951 #define __MAP(n,...) __MAP##n(__VA_ARGS__)
82952
82953 #define __SC_DECL(t, a) t a
82954 +#define __TYPE_IS_U(t) (__same_type((t)0, 0UL) || __same_type((t)0, 0U) || __same_type((t)0, (unsigned short)0) || __same_type((t)0, (unsigned char)0))
82955 #define __TYPE_IS_LL(t) (__same_type((t)0, 0LL) || __same_type((t)0, 0ULL))
82956 -#define __SC_LONG(t, a) __typeof(__builtin_choose_expr(__TYPE_IS_LL(t), 0LL, 0L)) a
82957 +#define __SC_LONG(t, a) __typeof( \
82958 + __builtin_choose_expr( \
82959 + sizeof(t) > sizeof(int), \
82960 + (t) 0, \
82961 + __builtin_choose_expr(__TYPE_IS_U(t), 0UL, 0L) \
82962 + )) a
82963 #define __SC_CAST(t, a) (t) a
82964 #define __SC_ARGS(t, a) a
82965 #define __SC_TEST(t, a) (void)BUILD_BUG_ON_ZERO(!__TYPE_IS_LL(t) && sizeof(t) > sizeof(long))
82966 @@ -371,11 +377,11 @@ asmlinkage long sys_sync(void);
82967 asmlinkage long sys_fsync(unsigned int fd);
82968 asmlinkage long sys_fdatasync(unsigned int fd);
82969 asmlinkage long sys_bdflush(int func, long data);
82970 -asmlinkage long sys_mount(char __user *dev_name, char __user *dir_name,
82971 - char __user *type, unsigned long flags,
82972 +asmlinkage long sys_mount(const char __user *dev_name, const char __user *dir_name,
82973 + const char __user *type, unsigned long flags,
82974 void __user *data);
82975 -asmlinkage long sys_umount(char __user *name, int flags);
82976 -asmlinkage long sys_oldumount(char __user *name);
82977 +asmlinkage long sys_umount(const char __user *name, int flags);
82978 +asmlinkage long sys_oldumount(const char __user *name);
82979 asmlinkage long sys_truncate(const char __user *path, long length);
82980 asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length);
82981 asmlinkage long sys_stat(const char __user *filename,
82982 @@ -587,7 +593,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
82983 asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
82984 asmlinkage long sys_send(int, void __user *, size_t, unsigned);
82985 asmlinkage long sys_sendto(int, void __user *, size_t, unsigned,
82986 - struct sockaddr __user *, int);
82987 + struct sockaddr __user *, int) __intentional_overflow(0);
82988 asmlinkage long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags);
82989 asmlinkage long sys_sendmmsg(int fd, struct mmsghdr __user *msg,
82990 unsigned int vlen, unsigned flags);
82991 diff --git a/include/linux/syscore_ops.h b/include/linux/syscore_ops.h
82992 index 27b3b0b..e093dd9 100644
82993 --- a/include/linux/syscore_ops.h
82994 +++ b/include/linux/syscore_ops.h
82995 @@ -16,7 +16,7 @@ struct syscore_ops {
82996 int (*suspend)(void);
82997 void (*resume)(void);
82998 void (*shutdown)(void);
82999 -};
83000 +} __do_const;
83001
83002 extern void register_syscore_ops(struct syscore_ops *ops);
83003 extern void unregister_syscore_ops(struct syscore_ops *ops);
83004 diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
83005 index 14a8ff2..fa95f3a 100644
83006 --- a/include/linux/sysctl.h
83007 +++ b/include/linux/sysctl.h
83008 @@ -34,13 +34,13 @@ struct ctl_table_root;
83009 struct ctl_table_header;
83010 struct ctl_dir;
83011
83012 -typedef struct ctl_table ctl_table;
83013 -
83014 typedef int proc_handler (struct ctl_table *ctl, int write,
83015 void __user *buffer, size_t *lenp, loff_t *ppos);
83016
83017 extern int proc_dostring(struct ctl_table *, int,
83018 void __user *, size_t *, loff_t *);
83019 +extern int proc_dostring_modpriv(struct ctl_table *, int,
83020 + void __user *, size_t *, loff_t *);
83021 extern int proc_dointvec(struct ctl_table *, int,
83022 void __user *, size_t *, loff_t *);
83023 extern int proc_dointvec_minmax(struct ctl_table *, int,
83024 @@ -115,7 +115,9 @@ struct ctl_table
83025 struct ctl_table_poll *poll;
83026 void *extra1;
83027 void *extra2;
83028 -};
83029 +} __do_const __randomize_layout;
83030 +typedef struct ctl_table __no_const ctl_table_no_const;
83031 +typedef struct ctl_table ctl_table;
83032
83033 struct ctl_node {
83034 struct rb_node node;
83035 diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
83036 index 30b2ebe..37412ef 100644
83037 --- a/include/linux/sysfs.h
83038 +++ b/include/linux/sysfs.h
83039 @@ -34,7 +34,8 @@ struct attribute {
83040 struct lock_class_key *key;
83041 struct lock_class_key skey;
83042 #endif
83043 -};
83044 +} __do_const;
83045 +typedef struct attribute __no_const attribute_no_const;
83046
83047 /**
83048 * sysfs_attr_init - initialize a dynamically allocated sysfs attribute
83049 @@ -63,7 +64,8 @@ struct attribute_group {
83050 struct attribute *, int);
83051 struct attribute **attrs;
83052 struct bin_attribute **bin_attrs;
83053 -};
83054 +} __do_const;
83055 +typedef struct attribute_group __no_const attribute_group_no_const;
83056
83057 /**
83058 * Use these macros to make defining attributes easier. See include/linux/device.h
83059 @@ -127,7 +129,8 @@ struct bin_attribute {
83060 char *, loff_t, size_t);
83061 int (*mmap)(struct file *, struct kobject *, struct bin_attribute *attr,
83062 struct vm_area_struct *vma);
83063 -};
83064 +} __do_const;
83065 +typedef struct bin_attribute __no_const bin_attribute_no_const;
83066
83067 /**
83068 * sysfs_bin_attr_init - initialize a dynamically allocated bin_attribute
83069 diff --git a/include/linux/sysrq.h b/include/linux/sysrq.h
83070 index 387fa7d..3fcde6b 100644
83071 --- a/include/linux/sysrq.h
83072 +++ b/include/linux/sysrq.h
83073 @@ -16,6 +16,7 @@
83074
83075 #include <linux/errno.h>
83076 #include <linux/types.h>
83077 +#include <linux/compiler.h>
83078
83079 /* Possible values of bitmask for enabling sysrq functions */
83080 /* 0x0001 is reserved for enable everything */
83081 @@ -33,7 +34,7 @@ struct sysrq_key_op {
83082 char *help_msg;
83083 char *action_msg;
83084 int enable_mask;
83085 -};
83086 +} __do_const;
83087
83088 #ifdef CONFIG_MAGIC_SYSRQ
83089
83090 diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
83091 index a629e4b..3fea3d9 100644
83092 --- a/include/linux/thread_info.h
83093 +++ b/include/linux/thread_info.h
83094 @@ -159,6 +159,13 @@ static inline bool test_and_clear_restore_sigmask(void)
83095 #error "no set_restore_sigmask() provided and default one won't work"
83096 #endif
83097
83098 +extern void __check_object_size(const void *ptr, unsigned long n, bool to_user, bool const_size);
83099 +
83100 +static inline void check_object_size(const void *ptr, unsigned long n, bool to_user)
83101 +{
83102 + __check_object_size(ptr, n, to_user, __builtin_constant_p(n));
83103 +}
83104 +
83105 #endif /* __KERNEL__ */
83106
83107 #endif /* _LINUX_THREAD_INFO_H */
83108 diff --git a/include/linux/tty.h b/include/linux/tty.h
83109 index b90b5c2..e23a512 100644
83110 --- a/include/linux/tty.h
83111 +++ b/include/linux/tty.h
83112 @@ -202,7 +202,7 @@ struct tty_port {
83113 const struct tty_port_operations *ops; /* Port operations */
83114 spinlock_t lock; /* Lock protecting tty field */
83115 int blocked_open; /* Waiting to open */
83116 - int count; /* Usage count */
83117 + atomic_t count; /* Usage count */
83118 wait_queue_head_t open_wait; /* Open waiters */
83119 wait_queue_head_t close_wait; /* Close waiters */
83120 wait_queue_head_t delta_msr_wait; /* Modem status change */
83121 @@ -284,7 +284,7 @@ struct tty_struct {
83122 /* If the tty has a pending do_SAK, queue it here - akpm */
83123 struct work_struct SAK_work;
83124 struct tty_port *port;
83125 -};
83126 +} __randomize_layout;
83127
83128 /* Each of a tty's open files has private_data pointing to tty_file_private */
83129 struct tty_file_private {
83130 @@ -550,7 +550,7 @@ extern int tty_port_open(struct tty_port *port,
83131 struct tty_struct *tty, struct file *filp);
83132 static inline int tty_port_users(struct tty_port *port)
83133 {
83134 - return port->count + port->blocked_open;
83135 + return atomic_read(&port->count) + port->blocked_open;
83136 }
83137
83138 extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc);
83139 diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h
83140 index 756a609..89db85e 100644
83141 --- a/include/linux/tty_driver.h
83142 +++ b/include/linux/tty_driver.h
83143 @@ -285,7 +285,7 @@ struct tty_operations {
83144 void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
83145 #endif
83146 const struct file_operations *proc_fops;
83147 -};
83148 +} __do_const __randomize_layout;
83149
83150 struct tty_driver {
83151 int magic; /* magic number for this structure */
83152 @@ -319,7 +319,7 @@ struct tty_driver {
83153
83154 const struct tty_operations *ops;
83155 struct list_head tty_drivers;
83156 -};
83157 +} __randomize_layout;
83158
83159 extern struct list_head tty_drivers;
83160
83161 diff --git a/include/linux/tty_ldisc.h b/include/linux/tty_ldisc.h
83162 index b8347c2..85d8b0f 100644
83163 --- a/include/linux/tty_ldisc.h
83164 +++ b/include/linux/tty_ldisc.h
83165 @@ -213,7 +213,7 @@ struct tty_ldisc_ops {
83166
83167 struct module *owner;
83168
83169 - int refcount;
83170 + atomic_t refcount;
83171 };
83172
83173 struct tty_ldisc {
83174 diff --git a/include/linux/types.h b/include/linux/types.h
83175 index 4d118ba..c3ee9bf 100644
83176 --- a/include/linux/types.h
83177 +++ b/include/linux/types.h
83178 @@ -176,10 +176,26 @@ typedef struct {
83179 int counter;
83180 } atomic_t;
83181
83182 +#ifdef CONFIG_PAX_REFCOUNT
83183 +typedef struct {
83184 + int counter;
83185 +} atomic_unchecked_t;
83186 +#else
83187 +typedef atomic_t atomic_unchecked_t;
83188 +#endif
83189 +
83190 #ifdef CONFIG_64BIT
83191 typedef struct {
83192 long counter;
83193 } atomic64_t;
83194 +
83195 +#ifdef CONFIG_PAX_REFCOUNT
83196 +typedef struct {
83197 + long counter;
83198 +} atomic64_unchecked_t;
83199 +#else
83200 +typedef atomic64_t atomic64_unchecked_t;
83201 +#endif
83202 #endif
83203
83204 struct list_head {
83205 diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
83206 index ecd3319..8a36ded 100644
83207 --- a/include/linux/uaccess.h
83208 +++ b/include/linux/uaccess.h
83209 @@ -75,11 +75,11 @@ static inline unsigned long __copy_from_user_nocache(void *to,
83210 long ret; \
83211 mm_segment_t old_fs = get_fs(); \
83212 \
83213 - set_fs(KERNEL_DS); \
83214 pagefault_disable(); \
83215 - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \
83216 - pagefault_enable(); \
83217 + set_fs(KERNEL_DS); \
83218 + ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \
83219 set_fs(old_fs); \
83220 + pagefault_enable(); \
83221 ret; \
83222 })
83223
83224 diff --git a/include/linux/uidgid.h b/include/linux/uidgid.h
83225 index 2d1f9b6..d7a9fce 100644
83226 --- a/include/linux/uidgid.h
83227 +++ b/include/linux/uidgid.h
83228 @@ -175,4 +175,9 @@ static inline bool kgid_has_mapping(struct user_namespace *ns, kgid_t gid)
83229
83230 #endif /* CONFIG_USER_NS */
83231
83232 +#define GR_GLOBAL_UID(x) from_kuid_munged(&init_user_ns, (x))
83233 +#define GR_GLOBAL_GID(x) from_kgid_munged(&init_user_ns, (x))
83234 +#define gr_is_global_root(x) uid_eq((x), GLOBAL_ROOT_UID)
83235 +#define gr_is_global_nonroot(x) (!uid_eq((x), GLOBAL_ROOT_UID))
83236 +
83237 #endif /* _LINUX_UIDGID_H */
83238 diff --git a/include/linux/unaligned/access_ok.h b/include/linux/unaligned/access_ok.h
83239 index 99c1b4d..562e6f3 100644
83240 --- a/include/linux/unaligned/access_ok.h
83241 +++ b/include/linux/unaligned/access_ok.h
83242 @@ -4,34 +4,34 @@
83243 #include <linux/kernel.h>
83244 #include <asm/byteorder.h>
83245
83246 -static inline u16 get_unaligned_le16(const void *p)
83247 +static inline u16 __intentional_overflow(-1) get_unaligned_le16(const void *p)
83248 {
83249 - return le16_to_cpup((__le16 *)p);
83250 + return le16_to_cpup((const __le16 *)p);
83251 }
83252
83253 -static inline u32 get_unaligned_le32(const void *p)
83254 +static inline u32 __intentional_overflow(-1) get_unaligned_le32(const void *p)
83255 {
83256 - return le32_to_cpup((__le32 *)p);
83257 + return le32_to_cpup((const __le32 *)p);
83258 }
83259
83260 -static inline u64 get_unaligned_le64(const void *p)
83261 +static inline u64 __intentional_overflow(-1) get_unaligned_le64(const void *p)
83262 {
83263 - return le64_to_cpup((__le64 *)p);
83264 + return le64_to_cpup((const __le64 *)p);
83265 }
83266
83267 -static inline u16 get_unaligned_be16(const void *p)
83268 +static inline u16 __intentional_overflow(-1) get_unaligned_be16(const void *p)
83269 {
83270 - return be16_to_cpup((__be16 *)p);
83271 + return be16_to_cpup((const __be16 *)p);
83272 }
83273
83274 -static inline u32 get_unaligned_be32(const void *p)
83275 +static inline u32 __intentional_overflow(-1) get_unaligned_be32(const void *p)
83276 {
83277 - return be32_to_cpup((__be32 *)p);
83278 + return be32_to_cpup((const __be32 *)p);
83279 }
83280
83281 -static inline u64 get_unaligned_be64(const void *p)
83282 +static inline u64 __intentional_overflow(-1) get_unaligned_be64(const void *p)
83283 {
83284 - return be64_to_cpup((__be64 *)p);
83285 + return be64_to_cpup((const __be64 *)p);
83286 }
83287
83288 static inline void put_unaligned_le16(u16 val, void *p)
83289 diff --git a/include/linux/usb.h b/include/linux/usb.h
83290 index 7f6eb85..656e806 100644
83291 --- a/include/linux/usb.h
83292 +++ b/include/linux/usb.h
83293 @@ -563,7 +563,7 @@ struct usb_device {
83294 int maxchild;
83295
83296 u32 quirks;
83297 - atomic_t urbnum;
83298 + atomic_unchecked_t urbnum;
83299
83300 unsigned long active_duration;
83301
83302 @@ -1642,7 +1642,7 @@ void usb_buffer_unmap_sg(const struct usb_device *dev, int is_in,
83303
83304 extern int usb_control_msg(struct usb_device *dev, unsigned int pipe,
83305 __u8 request, __u8 requesttype, __u16 value, __u16 index,
83306 - void *data, __u16 size, int timeout);
83307 + void *data, __u16 size, int timeout) __intentional_overflow(-1);
83308 extern int usb_interrupt_msg(struct usb_device *usb_dev, unsigned int pipe,
83309 void *data, int len, int *actual_length, int timeout);
83310 extern int usb_bulk_msg(struct usb_device *usb_dev, unsigned int pipe,
83311 diff --git a/include/linux/usb/renesas_usbhs.h b/include/linux/usb/renesas_usbhs.h
83312 index e452ba6..78f8e80 100644
83313 --- a/include/linux/usb/renesas_usbhs.h
83314 +++ b/include/linux/usb/renesas_usbhs.h
83315 @@ -39,7 +39,7 @@ enum {
83316 */
83317 struct renesas_usbhs_driver_callback {
83318 int (*notify_hotplug)(struct platform_device *pdev);
83319 -};
83320 +} __no_const;
83321
83322 /*
83323 * callback functions for platform
83324 diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
83325 index 4836ba3..603f6ee 100644
83326 --- a/include/linux/user_namespace.h
83327 +++ b/include/linux/user_namespace.h
83328 @@ -33,7 +33,7 @@ struct user_namespace {
83329 struct key *persistent_keyring_register;
83330 struct rw_semaphore persistent_keyring_register_sem;
83331 #endif
83332 -};
83333 +} __randomize_layout;
83334
83335 extern struct user_namespace init_user_ns;
83336
83337 diff --git a/include/linux/utsname.h b/include/linux/utsname.h
83338 index 239e277..22a5cf5 100644
83339 --- a/include/linux/utsname.h
83340 +++ b/include/linux/utsname.h
83341 @@ -24,7 +24,7 @@ struct uts_namespace {
83342 struct new_utsname name;
83343 struct user_namespace *user_ns;
83344 unsigned int proc_inum;
83345 -};
83346 +} __randomize_layout;
83347 extern struct uts_namespace init_uts_ns;
83348
83349 #ifdef CONFIG_UTS_NS
83350 diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
83351 index 6f8fbcf..4efc177 100644
83352 --- a/include/linux/vermagic.h
83353 +++ b/include/linux/vermagic.h
83354 @@ -25,9 +25,42 @@
83355 #define MODULE_ARCH_VERMAGIC ""
83356 #endif
83357
83358 +#ifdef CONFIG_PAX_REFCOUNT
83359 +#define MODULE_PAX_REFCOUNT "REFCOUNT "
83360 +#else
83361 +#define MODULE_PAX_REFCOUNT ""
83362 +#endif
83363 +
83364 +#ifdef CONSTIFY_PLUGIN
83365 +#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN "
83366 +#else
83367 +#define MODULE_CONSTIFY_PLUGIN ""
83368 +#endif
83369 +
83370 +#ifdef STACKLEAK_PLUGIN
83371 +#define MODULE_STACKLEAK_PLUGIN "STACKLEAK_PLUGIN "
83372 +#else
83373 +#define MODULE_STACKLEAK_PLUGIN ""
83374 +#endif
83375 +
83376 +#ifdef RANDSTRUCT_PLUGIN
83377 +#include <generated/randomize_layout_hash.h>
83378 +#define MODULE_RANDSTRUCT_PLUGIN "RANDSTRUCT_PLUGIN_" RANDSTRUCT_HASHED_SEED
83379 +#else
83380 +#define MODULE_RANDSTRUCT_PLUGIN
83381 +#endif
83382 +
83383 +#ifdef CONFIG_GRKERNSEC
83384 +#define MODULE_GRSEC "GRSEC "
83385 +#else
83386 +#define MODULE_GRSEC ""
83387 +#endif
83388 +
83389 #define VERMAGIC_STRING \
83390 UTS_RELEASE " " \
83391 MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \
83392 MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \
83393 - MODULE_ARCH_VERMAGIC
83394 + MODULE_ARCH_VERMAGIC \
83395 + MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN MODULE_STACKLEAK_PLUGIN \
83396 + MODULE_GRSEC MODULE_RANDSTRUCT_PLUGIN
83397
83398 diff --git a/include/linux/vga_switcheroo.h b/include/linux/vga_switcheroo.h
83399 index 502073a..a7de024 100644
83400 --- a/include/linux/vga_switcheroo.h
83401 +++ b/include/linux/vga_switcheroo.h
83402 @@ -63,8 +63,8 @@ int vga_switcheroo_get_client_state(struct pci_dev *dev);
83403
83404 void vga_switcheroo_set_dynamic_switch(struct pci_dev *pdev, enum vga_switcheroo_state dynamic);
83405
83406 -int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain);
83407 -int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain);
83408 +int vga_switcheroo_init_domain_pm_ops(struct device *dev, dev_pm_domain_no_const *domain);
83409 +int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, dev_pm_domain_no_const *domain);
83410 #else
83411
83412 static inline void vga_switcheroo_unregister_client(struct pci_dev *dev) {}
83413 @@ -81,8 +81,8 @@ static inline int vga_switcheroo_get_client_state(struct pci_dev *dev) { return
83414
83415 static inline void vga_switcheroo_set_dynamic_switch(struct pci_dev *pdev, enum vga_switcheroo_state dynamic) {}
83416
83417 -static inline int vga_switcheroo_init_domain_pm_ops(struct device *dev, struct dev_pm_domain *domain) { return -EINVAL; }
83418 -static inline int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, struct dev_pm_domain *domain) { return -EINVAL; }
83419 +static inline int vga_switcheroo_init_domain_pm_ops(struct device *dev, dev_pm_domain_no_const *domain) { return -EINVAL; }
83420 +static inline int vga_switcheroo_init_domain_pm_optimus_hdmi_audio(struct device *dev, dev_pm_domain_no_const *domain) { return -EINVAL; }
83421
83422 #endif
83423 #endif /* _LINUX_VGA_SWITCHEROO_H_ */
83424 diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
83425 index 4b8a891..05f2361 100644
83426 --- a/include/linux/vmalloc.h
83427 +++ b/include/linux/vmalloc.h
83428 @@ -16,6 +16,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
83429 #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */
83430 #define VM_VPAGES 0x00000010 /* buffer for pages was vmalloc'ed */
83431 #define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */
83432 +
83433 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
83434 +#define VM_KERNEXEC 0x00000040 /* allocate from executable kernel memory range */
83435 +#endif
83436 +
83437 /* bits [20..32] reserved for arch specific ioremap internals */
83438
83439 /*
83440 @@ -72,6 +77,7 @@ extern void *vzalloc_node(unsigned long size, int node);
83441 extern void *vmalloc_exec(unsigned long size);
83442 extern void *vmalloc_32(unsigned long size);
83443 extern void *vmalloc_32_user(unsigned long size);
83444 +extern void *vmalloc_stack(int node);
83445 extern void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot);
83446 extern void *__vmalloc_node_range(unsigned long size, unsigned long align,
83447 unsigned long start, unsigned long end, gfp_t gfp_mask,
83448 @@ -142,7 +148,7 @@ extern void free_vm_area(struct vm_struct *area);
83449
83450 /* for /dev/kmem */
83451 extern long vread(char *buf, char *addr, unsigned long count);
83452 -extern long vwrite(char *buf, char *addr, unsigned long count);
83453 +extern long vwrite(char *buf, char *addr, unsigned long count) __size_overflow(3);
83454
83455 /*
83456 * Internals. Dont't use..
83457 diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
83458 index 67ce70c..d540954 100644
83459 --- a/include/linux/vmstat.h
83460 +++ b/include/linux/vmstat.h
83461 @@ -98,18 +98,18 @@ static inline void vm_events_fold_cpu(int cpu)
83462 /*
83463 * Zone based page accounting with per cpu differentials.
83464 */
83465 -extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
83466 +extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
83467
83468 static inline void zone_page_state_add(long x, struct zone *zone,
83469 enum zone_stat_item item)
83470 {
83471 - atomic_long_add(x, &zone->vm_stat[item]);
83472 - atomic_long_add(x, &vm_stat[item]);
83473 + atomic_long_add_unchecked(x, &zone->vm_stat[item]);
83474 + atomic_long_add_unchecked(x, &vm_stat[item]);
83475 }
83476
83477 -static inline unsigned long global_page_state(enum zone_stat_item item)
83478 +static inline unsigned long __intentional_overflow(-1) global_page_state(enum zone_stat_item item)
83479 {
83480 - long x = atomic_long_read(&vm_stat[item]);
83481 + long x = atomic_long_read_unchecked(&vm_stat[item]);
83482 #ifdef CONFIG_SMP
83483 if (x < 0)
83484 x = 0;
83485 @@ -117,10 +117,10 @@ static inline unsigned long global_page_state(enum zone_stat_item item)
83486 return x;
83487 }
83488
83489 -static inline unsigned long zone_page_state(struct zone *zone,
83490 +static inline unsigned long __intentional_overflow(-1) zone_page_state(struct zone *zone,
83491 enum zone_stat_item item)
83492 {
83493 - long x = atomic_long_read(&zone->vm_stat[item]);
83494 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
83495 #ifdef CONFIG_SMP
83496 if (x < 0)
83497 x = 0;
83498 @@ -137,7 +137,7 @@ static inline unsigned long zone_page_state(struct zone *zone,
83499 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
83500 enum zone_stat_item item)
83501 {
83502 - long x = atomic_long_read(&zone->vm_stat[item]);
83503 + long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
83504
83505 #ifdef CONFIG_SMP
83506 int cpu;
83507 @@ -226,8 +226,8 @@ static inline void __mod_zone_page_state(struct zone *zone,
83508
83509 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
83510 {
83511 - atomic_long_inc(&zone->vm_stat[item]);
83512 - atomic_long_inc(&vm_stat[item]);
83513 + atomic_long_inc_unchecked(&zone->vm_stat[item]);
83514 + atomic_long_inc_unchecked(&vm_stat[item]);
83515 }
83516
83517 static inline void __inc_zone_page_state(struct page *page,
83518 @@ -238,8 +238,8 @@ static inline void __inc_zone_page_state(struct page *page,
83519
83520 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
83521 {
83522 - atomic_long_dec(&zone->vm_stat[item]);
83523 - atomic_long_dec(&vm_stat[item]);
83524 + atomic_long_dec_unchecked(&zone->vm_stat[item]);
83525 + atomic_long_dec_unchecked(&vm_stat[item]);
83526 }
83527
83528 static inline void __dec_zone_page_state(struct page *page,
83529 diff --git a/include/linux/xattr.h b/include/linux/xattr.h
83530 index 91b0a68..0e9adf6 100644
83531 --- a/include/linux/xattr.h
83532 +++ b/include/linux/xattr.h
83533 @@ -28,7 +28,7 @@ struct xattr_handler {
83534 size_t size, int handler_flags);
83535 int (*set)(struct dentry *dentry, const char *name, const void *buffer,
83536 size_t size, int flags, int handler_flags);
83537 -};
83538 +} __do_const;
83539
83540 struct xattr {
83541 const char *name;
83542 @@ -37,6 +37,9 @@ struct xattr {
83543 };
83544
83545 ssize_t xattr_getsecurity(struct inode *, const char *, void *, size_t);
83546 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
83547 +ssize_t pax_getxattr(struct dentry *, void *, size_t);
83548 +#endif
83549 ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t);
83550 ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size);
83551 int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int);
83552 diff --git a/include/linux/zlib.h b/include/linux/zlib.h
83553 index 9c5a6b4..09c9438 100644
83554 --- a/include/linux/zlib.h
83555 +++ b/include/linux/zlib.h
83556 @@ -31,6 +31,7 @@
83557 #define _ZLIB_H
83558
83559 #include <linux/zconf.h>
83560 +#include <linux/compiler.h>
83561
83562 /* zlib deflate based on ZLIB_VERSION "1.1.3" */
83563 /* zlib inflate based on ZLIB_VERSION "1.2.3" */
83564 @@ -179,7 +180,7 @@ typedef z_stream *z_streamp;
83565
83566 /* basic functions */
83567
83568 -extern int zlib_deflate_workspacesize (int windowBits, int memLevel);
83569 +extern int zlib_deflate_workspacesize (int windowBits, int memLevel) __intentional_overflow(0);
83570 /*
83571 Returns the number of bytes that needs to be allocated for a per-
83572 stream workspace with the specified parameters. A pointer to this
83573 diff --git a/include/media/v4l2-dev.h b/include/media/v4l2-dev.h
83574 index c768c9f..bdcaa5a 100644
83575 --- a/include/media/v4l2-dev.h
83576 +++ b/include/media/v4l2-dev.h
83577 @@ -76,7 +76,7 @@ struct v4l2_file_operations {
83578 int (*mmap) (struct file *, struct vm_area_struct *);
83579 int (*open) (struct file *);
83580 int (*release) (struct file *);
83581 -};
83582 +} __do_const;
83583
83584 /*
83585 * Newer version of video_device, handled by videodev2.c
83586 diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
83587 index c9b1593..a572459 100644
83588 --- a/include/media/v4l2-device.h
83589 +++ b/include/media/v4l2-device.h
83590 @@ -95,7 +95,7 @@ int __must_check v4l2_device_register(struct device *dev, struct v4l2_device *v4
83591 this function returns 0. If the name ends with a digit (e.g. cx18),
83592 then the name will be set to cx18-0 since cx180 looks really odd. */
83593 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
83594 - atomic_t *instance);
83595 + atomic_unchecked_t *instance);
83596
83597 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
83598 Since the parent disappears this ensures that v4l2_dev doesn't have an
83599 diff --git a/include/net/9p/transport.h b/include/net/9p/transport.h
83600 index 9a36d92..0aafe2a 100644
83601 --- a/include/net/9p/transport.h
83602 +++ b/include/net/9p/transport.h
83603 @@ -60,7 +60,7 @@ struct p9_trans_module {
83604 int (*cancel) (struct p9_client *, struct p9_req_t *req);
83605 int (*zc_request)(struct p9_client *, struct p9_req_t *,
83606 char *, char *, int , int, int, int);
83607 -};
83608 +} __do_const;
83609
83610 void v9fs_register_trans(struct p9_trans_module *m);
83611 void v9fs_unregister_trans(struct p9_trans_module *m);
83612 diff --git a/include/net/af_unix.h b/include/net/af_unix.h
83613 index a175ba4..196eb82 100644
83614 --- a/include/net/af_unix.h
83615 +++ b/include/net/af_unix.h
83616 @@ -36,7 +36,7 @@ struct unix_skb_parms {
83617 u32 secid; /* Security ID */
83618 #endif
83619 u32 consumed;
83620 -};
83621 +} __randomize_layout;
83622
83623 #define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb))
83624 #define UNIXSID(skb) (&UNIXCB((skb)).secid)
83625 diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
83626 index dbc4a89..4a59b5d 100644
83627 --- a/include/net/bluetooth/l2cap.h
83628 +++ b/include/net/bluetooth/l2cap.h
83629 @@ -600,7 +600,7 @@ struct l2cap_ops {
83630 long (*get_sndtimeo) (struct l2cap_chan *chan);
83631 struct sk_buff *(*alloc_skb) (struct l2cap_chan *chan,
83632 unsigned long len, int nb);
83633 -};
83634 +} __do_const;
83635
83636 struct l2cap_conn {
83637 struct hci_conn *hcon;
83638 diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
83639 index f2ae33d..c457cf0 100644
83640 --- a/include/net/caif/cfctrl.h
83641 +++ b/include/net/caif/cfctrl.h
83642 @@ -52,7 +52,7 @@ struct cfctrl_rsp {
83643 void (*radioset_rsp)(void);
83644 void (*reject_rsp)(struct cflayer *layer, u8 linkid,
83645 struct cflayer *client_layer);
83646 -};
83647 +} __no_const;
83648
83649 /* Link Setup Parameters for CAIF-Links. */
83650 struct cfctrl_link_param {
83651 @@ -101,8 +101,8 @@ struct cfctrl_request_info {
83652 struct cfctrl {
83653 struct cfsrvl serv;
83654 struct cfctrl_rsp res;
83655 - atomic_t req_seq_no;
83656 - atomic_t rsp_seq_no;
83657 + atomic_unchecked_t req_seq_no;
83658 + atomic_unchecked_t rsp_seq_no;
83659 struct list_head list;
83660 /* Protects from simultaneous access to first_req list */
83661 spinlock_t info_list_lock;
83662 diff --git a/include/net/flow.h b/include/net/flow.h
83663 index d23e7fa..e188307 100644
83664 --- a/include/net/flow.h
83665 +++ b/include/net/flow.h
83666 @@ -221,6 +221,6 @@ struct flow_cache_object *flow_cache_lookup(struct net *net,
83667
83668 void flow_cache_flush(void);
83669 void flow_cache_flush_deferred(void);
83670 -extern atomic_t flow_cache_genid;
83671 +extern atomic_unchecked_t flow_cache_genid;
83672
83673 #endif
83674 diff --git a/include/net/genetlink.h b/include/net/genetlink.h
83675 index 93695f0..766d71c 100644
83676 --- a/include/net/genetlink.h
83677 +++ b/include/net/genetlink.h
83678 @@ -120,7 +120,7 @@ struct genl_ops {
83679 u8 cmd;
83680 u8 internal_flags;
83681 u8 flags;
83682 -};
83683 +} __do_const;
83684
83685 int __genl_register_family(struct genl_family *family);
83686
83687 diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
83688 index 734d9b5..48a9a4b 100644
83689 --- a/include/net/gro_cells.h
83690 +++ b/include/net/gro_cells.h
83691 @@ -29,7 +29,7 @@ static inline void gro_cells_receive(struct gro_cells *gcells, struct sk_buff *s
83692 cell += skb_get_rx_queue(skb) & gcells->gro_cells_mask;
83693
83694 if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
83695 - atomic_long_inc(&dev->rx_dropped);
83696 + atomic_long_inc_unchecked(&dev->rx_dropped);
83697 kfree_skb(skb);
83698 return;
83699 }
83700 diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
83701 index c55aeed..b3393f4 100644
83702 --- a/include/net/inet_connection_sock.h
83703 +++ b/include/net/inet_connection_sock.h
83704 @@ -62,7 +62,7 @@ struct inet_connection_sock_af_ops {
83705 void (*addr2sockaddr)(struct sock *sk, struct sockaddr *);
83706 int (*bind_conflict)(const struct sock *sk,
83707 const struct inet_bind_bucket *tb, bool relax);
83708 -};
83709 +} __do_const;
83710
83711 /** inet_connection_sock - INET connection oriented sock
83712 *
83713 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
83714 index 6efe73c..fa94270 100644
83715 --- a/include/net/inetpeer.h
83716 +++ b/include/net/inetpeer.h
83717 @@ -47,8 +47,8 @@ struct inet_peer {
83718 */
83719 union {
83720 struct {
83721 - atomic_t rid; /* Frag reception counter */
83722 - atomic_t ip_id_count; /* IP ID for the next packet */
83723 + atomic_unchecked_t rid; /* Frag reception counter */
83724 + atomic_unchecked_t ip_id_count; /* IP ID for the next packet */
83725 };
83726 struct rcu_head rcu;
83727 struct inet_peer *gc_next;
83728 @@ -177,16 +177,13 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
83729 /* can be called with or without local BH being disabled */
83730 static inline int inet_getid(struct inet_peer *p, int more)
83731 {
83732 - int old, new;
83733 + int id;
83734 more++;
83735 inet_peer_refcheck(p);
83736 - do {
83737 - old = atomic_read(&p->ip_id_count);
83738 - new = old + more;
83739 - if (!new)
83740 - new = 1;
83741 - } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
83742 - return new;
83743 + id = atomic_add_return_unchecked(more, &p->ip_id_count);
83744 + if (!id)
83745 + id = atomic_inc_return_unchecked(&p->ip_id_count);
83746 + return id;
83747 }
83748
83749 #endif /* _NET_INETPEER_H */
83750 diff --git a/include/net/ip.h b/include/net/ip.h
83751 index 23be0fd..0cb3e2c 100644
83752 --- a/include/net/ip.h
83753 +++ b/include/net/ip.h
83754 @@ -214,7 +214,7 @@ static inline void snmp_mib_free(void __percpu *ptr[SNMP_ARRAY_SZ])
83755
83756 void inet_get_local_port_range(struct net *net, int *low, int *high);
83757
83758 -extern unsigned long *sysctl_local_reserved_ports;
83759 +extern unsigned long sysctl_local_reserved_ports[65536 / 8 / sizeof(unsigned long)];
83760 static inline int inet_is_reserved_local_port(int port)
83761 {
83762 return test_bit(port, sysctl_local_reserved_ports);
83763 diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
83764 index 9922093..a1755d6 100644
83765 --- a/include/net/ip_fib.h
83766 +++ b/include/net/ip_fib.h
83767 @@ -169,7 +169,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
83768
83769 #define FIB_RES_SADDR(net, res) \
83770 ((FIB_RES_NH(res).nh_saddr_genid == \
83771 - atomic_read(&(net)->ipv4.dev_addr_genid)) ? \
83772 + atomic_read_unchecked(&(net)->ipv4.dev_addr_genid)) ? \
83773 FIB_RES_NH(res).nh_saddr : \
83774 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
83775 #define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
83776 diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
83777 index 5679d92..2e7a690 100644
83778 --- a/include/net/ip_vs.h
83779 +++ b/include/net/ip_vs.h
83780 @@ -558,7 +558,7 @@ struct ip_vs_conn {
83781 struct ip_vs_conn *control; /* Master control connection */
83782 atomic_t n_control; /* Number of controlled ones */
83783 struct ip_vs_dest *dest; /* real server */
83784 - atomic_t in_pkts; /* incoming packet counter */
83785 + atomic_unchecked_t in_pkts; /* incoming packet counter */
83786
83787 /* packet transmitter for different forwarding methods. If it
83788 mangles the packet, it must return NF_DROP or better NF_STOLEN,
83789 @@ -705,7 +705,7 @@ struct ip_vs_dest {
83790 __be16 port; /* port number of the server */
83791 union nf_inet_addr addr; /* IP address of the server */
83792 volatile unsigned int flags; /* dest status flags */
83793 - atomic_t conn_flags; /* flags to copy to conn */
83794 + atomic_unchecked_t conn_flags; /* flags to copy to conn */
83795 atomic_t weight; /* server weight */
83796
83797 atomic_t refcnt; /* reference counter */
83798 @@ -960,11 +960,11 @@ struct netns_ipvs {
83799 /* ip_vs_lblc */
83800 int sysctl_lblc_expiration;
83801 struct ctl_table_header *lblc_ctl_header;
83802 - struct ctl_table *lblc_ctl_table;
83803 + ctl_table_no_const *lblc_ctl_table;
83804 /* ip_vs_lblcr */
83805 int sysctl_lblcr_expiration;
83806 struct ctl_table_header *lblcr_ctl_header;
83807 - struct ctl_table *lblcr_ctl_table;
83808 + ctl_table_no_const *lblcr_ctl_table;
83809 /* ip_vs_est */
83810 struct list_head est_list; /* estimator list */
83811 spinlock_t est_lock;
83812 diff --git a/include/net/irda/ircomm_tty.h b/include/net/irda/ircomm_tty.h
83813 index 8d4f588..2e37ad2 100644
83814 --- a/include/net/irda/ircomm_tty.h
83815 +++ b/include/net/irda/ircomm_tty.h
83816 @@ -33,6 +33,7 @@
83817 #include <linux/termios.h>
83818 #include <linux/timer.h>
83819 #include <linux/tty.h> /* struct tty_struct */
83820 +#include <asm/local.h>
83821
83822 #include <net/irda/irias_object.h>
83823 #include <net/irda/ircomm_core.h>
83824 diff --git a/include/net/iucv/af_iucv.h b/include/net/iucv/af_iucv.h
83825 index 714cc9a..ea05f3e 100644
83826 --- a/include/net/iucv/af_iucv.h
83827 +++ b/include/net/iucv/af_iucv.h
83828 @@ -149,7 +149,7 @@ struct iucv_skb_cb {
83829 struct iucv_sock_list {
83830 struct hlist_head head;
83831 rwlock_t lock;
83832 - atomic_t autobind_name;
83833 + atomic_unchecked_t autobind_name;
83834 };
83835
83836 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
83837 diff --git a/include/net/llc_c_ac.h b/include/net/llc_c_ac.h
83838 index f3be818..bf46196 100644
83839 --- a/include/net/llc_c_ac.h
83840 +++ b/include/net/llc_c_ac.h
83841 @@ -87,7 +87,7 @@
83842 #define LLC_CONN_AC_STOP_SENDACK_TMR 70
83843 #define LLC_CONN_AC_START_SENDACK_TMR_IF_NOT_RUNNING 71
83844
83845 -typedef int (*llc_conn_action_t)(struct sock *sk, struct sk_buff *skb);
83846 +typedef int (* const llc_conn_action_t)(struct sock *sk, struct sk_buff *skb);
83847
83848 int llc_conn_ac_clear_remote_busy(struct sock *sk, struct sk_buff *skb);
83849 int llc_conn_ac_conn_ind(struct sock *sk, struct sk_buff *skb);
83850 diff --git a/include/net/llc_c_ev.h b/include/net/llc_c_ev.h
83851 index 3948cf1..83b28c4 100644
83852 --- a/include/net/llc_c_ev.h
83853 +++ b/include/net/llc_c_ev.h
83854 @@ -125,8 +125,8 @@ static __inline__ struct llc_conn_state_ev *llc_conn_ev(struct sk_buff *skb)
83855 return (struct llc_conn_state_ev *)skb->cb;
83856 }
83857
83858 -typedef int (*llc_conn_ev_t)(struct sock *sk, struct sk_buff *skb);
83859 -typedef int (*llc_conn_ev_qfyr_t)(struct sock *sk, struct sk_buff *skb);
83860 +typedef int (* const llc_conn_ev_t)(struct sock *sk, struct sk_buff *skb);
83861 +typedef int (* const llc_conn_ev_qfyr_t)(struct sock *sk, struct sk_buff *skb);
83862
83863 int llc_conn_ev_conn_req(struct sock *sk, struct sk_buff *skb);
83864 int llc_conn_ev_data_req(struct sock *sk, struct sk_buff *skb);
83865 diff --git a/include/net/llc_c_st.h b/include/net/llc_c_st.h
83866 index 0e79cfb..f46db31 100644
83867 --- a/include/net/llc_c_st.h
83868 +++ b/include/net/llc_c_st.h
83869 @@ -37,7 +37,7 @@ struct llc_conn_state_trans {
83870 u8 next_state;
83871 llc_conn_ev_qfyr_t *ev_qualifiers;
83872 llc_conn_action_t *ev_actions;
83873 -};
83874 +} __do_const;
83875
83876 struct llc_conn_state {
83877 u8 current_state;
83878 diff --git a/include/net/llc_s_ac.h b/include/net/llc_s_ac.h
83879 index a61b98c..aade1eb 100644
83880 --- a/include/net/llc_s_ac.h
83881 +++ b/include/net/llc_s_ac.h
83882 @@ -23,7 +23,7 @@
83883 #define SAP_ACT_TEST_IND 9
83884
83885 /* All action functions must look like this */
83886 -typedef int (*llc_sap_action_t)(struct llc_sap *sap, struct sk_buff *skb);
83887 +typedef int (* const llc_sap_action_t)(struct llc_sap *sap, struct sk_buff *skb);
83888
83889 int llc_sap_action_unitdata_ind(struct llc_sap *sap, struct sk_buff *skb);
83890 int llc_sap_action_send_ui(struct llc_sap *sap, struct sk_buff *skb);
83891 diff --git a/include/net/llc_s_st.h b/include/net/llc_s_st.h
83892 index 567c681..cd73ac02 100644
83893 --- a/include/net/llc_s_st.h
83894 +++ b/include/net/llc_s_st.h
83895 @@ -20,7 +20,7 @@ struct llc_sap_state_trans {
83896 llc_sap_ev_t ev;
83897 u8 next_state;
83898 llc_sap_action_t *ev_actions;
83899 -};
83900 +} __do_const;
83901
83902 struct llc_sap_state {
83903 u8 curr_state;
83904 diff --git a/include/net/mac80211.h b/include/net/mac80211.h
83905 index f4ab2fb..71a85ba 100644
83906 --- a/include/net/mac80211.h
83907 +++ b/include/net/mac80211.h
83908 @@ -4476,7 +4476,7 @@ struct rate_control_ops {
83909 void (*add_sta_debugfs)(void *priv, void *priv_sta,
83910 struct dentry *dir);
83911 void (*remove_sta_debugfs)(void *priv, void *priv_sta);
83912 -};
83913 +} __do_const;
83914
83915 static inline int rate_supported(struct ieee80211_sta *sta,
83916 enum ieee80211_band band,
83917 diff --git a/include/net/neighbour.h b/include/net/neighbour.h
83918 index 7277caf..fd095bc 100644
83919 --- a/include/net/neighbour.h
83920 +++ b/include/net/neighbour.h
83921 @@ -163,7 +163,7 @@ struct neigh_ops {
83922 void (*error_report)(struct neighbour *, struct sk_buff *);
83923 int (*output)(struct neighbour *, struct sk_buff *);
83924 int (*connected_output)(struct neighbour *, struct sk_buff *);
83925 -};
83926 +} __do_const;
83927
83928 struct pneigh_entry {
83929 struct pneigh_entry *next;
83930 @@ -203,7 +203,6 @@ struct neigh_table {
83931 void (*proxy_redo)(struct sk_buff *skb);
83932 char *id;
83933 struct neigh_parms parms;
83934 - /* HACK. gc_* should follow parms without a gap! */
83935 int gc_interval;
83936 int gc_thresh1;
83937 int gc_thresh2;
83938 @@ -218,7 +217,7 @@ struct neigh_table {
83939 struct neigh_statistics __percpu *stats;
83940 struct neigh_hash_table __rcu *nht;
83941 struct pneigh_entry **phash_buckets;
83942 -};
83943 +} __randomize_layout;
83944
83945 static inline int neigh_parms_family(struct neigh_parms *p)
83946 {
83947 diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
83948 index 991dcd9..ab58d00 100644
83949 --- a/include/net/net_namespace.h
83950 +++ b/include/net/net_namespace.h
83951 @@ -124,8 +124,8 @@ struct net {
83952 struct netns_ipvs *ipvs;
83953 #endif
83954 struct sock *diag_nlsk;
83955 - atomic_t fnhe_genid;
83956 -};
83957 + atomic_unchecked_t fnhe_genid;
83958 +} __randomize_layout;
83959
83960 /*
83961 * ifindex generation is per-net namespace, and loopback is
83962 @@ -289,7 +289,11 @@ static inline struct net *read_pnet(struct net * const *pnet)
83963 #define __net_init __init
83964 #define __net_exit __exit_refok
83965 #define __net_initdata __initdata
83966 +#ifdef CONSTIFY_PLUGIN
83967 #define __net_initconst __initconst
83968 +#else
83969 +#define __net_initconst __initdata
83970 +#endif
83971 #endif
83972
83973 struct pernet_operations {
83974 @@ -299,7 +303,7 @@ struct pernet_operations {
83975 void (*exit_batch)(struct list_head *net_exit_list);
83976 int *id;
83977 size_t size;
83978 -};
83979 +} __do_const;
83980
83981 /*
83982 * Use these carefully. If you implement a network device and it
83983 @@ -347,23 +351,23 @@ static inline void unregister_net_sysctl_table(struct ctl_table_header *header)
83984
83985 static inline int rt_genid_ipv4(struct net *net)
83986 {
83987 - return atomic_read(&net->ipv4.rt_genid);
83988 + return atomic_read_unchecked(&net->ipv4.rt_genid);
83989 }
83990
83991 static inline void rt_genid_bump_ipv4(struct net *net)
83992 {
83993 - atomic_inc(&net->ipv4.rt_genid);
83994 + atomic_inc_unchecked(&net->ipv4.rt_genid);
83995 }
83996
83997 #if IS_ENABLED(CONFIG_IPV6)
83998 static inline int rt_genid_ipv6(struct net *net)
83999 {
84000 - return atomic_read(&net->ipv6.rt_genid);
84001 + return atomic_read_unchecked(&net->ipv6.rt_genid);
84002 }
84003
84004 static inline void rt_genid_bump_ipv6(struct net *net)
84005 {
84006 - atomic_inc(&net->ipv6.rt_genid);
84007 + atomic_inc_unchecked(&net->ipv6.rt_genid);
84008 }
84009 #else
84010 static inline int rt_genid_ipv6(struct net *net)
84011 @@ -385,12 +389,12 @@ static inline void rt_genid_bump_all(struct net *net)
84012
84013 static inline int fnhe_genid(struct net *net)
84014 {
84015 - return atomic_read(&net->fnhe_genid);
84016 + return atomic_read_unchecked(&net->fnhe_genid);
84017 }
84018
84019 static inline void fnhe_genid_bump(struct net *net)
84020 {
84021 - atomic_inc(&net->fnhe_genid);
84022 + atomic_inc_unchecked(&net->fnhe_genid);
84023 }
84024
84025 #endif /* __NET_NET_NAMESPACE_H */
84026 diff --git a/include/net/netdma.h b/include/net/netdma.h
84027 index 8ba8ce2..99b7fff 100644
84028 --- a/include/net/netdma.h
84029 +++ b/include/net/netdma.h
84030 @@ -24,7 +24,7 @@
84031 #include <linux/dmaengine.h>
84032 #include <linux/skbuff.h>
84033
84034 -int dma_skb_copy_datagram_iovec(struct dma_chan* chan,
84035 +int __intentional_overflow(3,5) dma_skb_copy_datagram_iovec(struct dma_chan* chan,
84036 struct sk_buff *skb, int offset, struct iovec *to,
84037 size_t len, struct dma_pinned_list *pinned_list);
84038
84039 diff --git a/include/net/netlink.h b/include/net/netlink.h
84040 index 2b47eaa..6d5bcc2 100644
84041 --- a/include/net/netlink.h
84042 +++ b/include/net/netlink.h
84043 @@ -521,7 +521,7 @@ static inline void *nlmsg_get_pos(struct sk_buff *skb)
84044 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
84045 {
84046 if (mark)
84047 - skb_trim(skb, (unsigned char *) mark - skb->data);
84048 + skb_trim(skb, (const unsigned char *) mark - skb->data);
84049 }
84050
84051 /**
84052 diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
84053 index fbcc7fa..03c7e51 100644
84054 --- a/include/net/netns/conntrack.h
84055 +++ b/include/net/netns/conntrack.h
84056 @@ -12,10 +12,10 @@ struct nf_conntrack_ecache;
84057 struct nf_proto_net {
84058 #ifdef CONFIG_SYSCTL
84059 struct ctl_table_header *ctl_table_header;
84060 - struct ctl_table *ctl_table;
84061 + ctl_table_no_const *ctl_table;
84062 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
84063 struct ctl_table_header *ctl_compat_header;
84064 - struct ctl_table *ctl_compat_table;
84065 + ctl_table_no_const *ctl_compat_table;
84066 #endif
84067 #endif
84068 unsigned int users;
84069 @@ -58,7 +58,7 @@ struct nf_ip_net {
84070 struct nf_icmp_net icmpv6;
84071 #if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
84072 struct ctl_table_header *ctl_table_header;
84073 - struct ctl_table *ctl_table;
84074 + ctl_table_no_const *ctl_table;
84075 #endif
84076 };
84077
84078 diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
84079 index 80f500a..f0c23c2 100644
84080 --- a/include/net/netns/ipv4.h
84081 +++ b/include/net/netns/ipv4.h
84082 @@ -74,7 +74,7 @@ struct netns_ipv4 {
84083
84084 kgid_t sysctl_ping_group_range[2];
84085
84086 - atomic_t dev_addr_genid;
84087 + atomic_unchecked_t dev_addr_genid;
84088
84089 #ifdef CONFIG_IP_MROUTE
84090 #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
84091 @@ -84,6 +84,6 @@ struct netns_ipv4 {
84092 struct fib_rules_ops *mr_rules_ops;
84093 #endif
84094 #endif
84095 - atomic_t rt_genid;
84096 + atomic_unchecked_t rt_genid;
84097 };
84098 #endif
84099 diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
84100 index 21edaf1..4c5faae 100644
84101 --- a/include/net/netns/ipv6.h
84102 +++ b/include/net/netns/ipv6.h
84103 @@ -73,8 +73,8 @@ struct netns_ipv6 {
84104 struct fib_rules_ops *mr6_rules_ops;
84105 #endif
84106 #endif
84107 - atomic_t dev_addr_genid;
84108 - atomic_t rt_genid;
84109 + atomic_unchecked_t dev_addr_genid;
84110 + atomic_unchecked_t rt_genid;
84111 };
84112
84113 #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
84114 diff --git a/include/net/ping.h b/include/net/ping.h
84115 index 026479b..d9b2829 100644
84116 --- a/include/net/ping.h
84117 +++ b/include/net/ping.h
84118 @@ -54,7 +54,7 @@ struct ping_iter_state {
84119
84120 extern struct proto ping_prot;
84121 #if IS_ENABLED(CONFIG_IPV6)
84122 -extern struct pingv6_ops pingv6_ops;
84123 +extern struct pingv6_ops *pingv6_ops;
84124 #endif
84125
84126 struct pingfakehdr {
84127 diff --git a/include/net/protocol.h b/include/net/protocol.h
84128 index a7e986b..dc67bce 100644
84129 --- a/include/net/protocol.h
84130 +++ b/include/net/protocol.h
84131 @@ -49,7 +49,7 @@ struct net_protocol {
84132 * socket lookup?
84133 */
84134 icmp_strict_tag_validation:1;
84135 -};
84136 +} __do_const;
84137
84138 #if IS_ENABLED(CONFIG_IPV6)
84139 struct inet6_protocol {
84140 @@ -62,7 +62,7 @@ struct inet6_protocol {
84141 u8 type, u8 code, int offset,
84142 __be32 info);
84143 unsigned int flags; /* INET6_PROTO_xxx */
84144 -};
84145 +} __do_const;
84146
84147 #define INET6_PROTO_NOPOLICY 0x1
84148 #define INET6_PROTO_FINAL 0x2
84149 diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
84150 index 661e45d..54c39df 100644
84151 --- a/include/net/rtnetlink.h
84152 +++ b/include/net/rtnetlink.h
84153 @@ -93,7 +93,7 @@ struct rtnl_link_ops {
84154 int (*fill_slave_info)(struct sk_buff *skb,
84155 const struct net_device *dev,
84156 const struct net_device *slave_dev);
84157 -};
84158 +} __do_const;
84159
84160 int __rtnl_link_register(struct rtnl_link_ops *ops);
84161 void __rtnl_link_unregister(struct rtnl_link_ops *ops);
84162 diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
84163 index 4a5b9a3..ca27d73 100644
84164 --- a/include/net/sctp/checksum.h
84165 +++ b/include/net/sctp/checksum.h
84166 @@ -61,8 +61,8 @@ static inline __le32 sctp_compute_cksum(const struct sk_buff *skb,
84167 unsigned int offset)
84168 {
84169 struct sctphdr *sh = sctp_hdr(skb);
84170 - __le32 ret, old = sh->checksum;
84171 - const struct skb_checksum_ops ops = {
84172 + __le32 ret, old = sh->checksum;
84173 + static const struct skb_checksum_ops ops = {
84174 .update = sctp_csum_update,
84175 .combine = sctp_csum_combine,
84176 };
84177 diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
84178 index 7f4eeb3..37e8fe1 100644
84179 --- a/include/net/sctp/sm.h
84180 +++ b/include/net/sctp/sm.h
84181 @@ -80,7 +80,7 @@ typedef void (sctp_timer_event_t) (unsigned long);
84182 typedef struct {
84183 sctp_state_fn_t *fn;
84184 const char *name;
84185 -} sctp_sm_table_entry_t;
84186 +} __do_const sctp_sm_table_entry_t;
84187
84188 /* A naming convention of "sctp_sf_xxx" applies to all the state functions
84189 * currently in use.
84190 @@ -292,7 +292,7 @@ __u32 sctp_generate_tag(const struct sctp_endpoint *);
84191 __u32 sctp_generate_tsn(const struct sctp_endpoint *);
84192
84193 /* Extern declarations for major data structures. */
84194 -extern sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES];
84195 +extern sctp_timer_event_t * const sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES];
84196
84197
84198 /* Get the size of a DATA chunk payload. */
84199 diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
84200 index 0dfcc92..7967849 100644
84201 --- a/include/net/sctp/structs.h
84202 +++ b/include/net/sctp/structs.h
84203 @@ -507,7 +507,7 @@ struct sctp_pf {
84204 struct sctp_association *asoc);
84205 void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
84206 struct sctp_af *af;
84207 -};
84208 +} __do_const;
84209
84210
84211 /* Structure to track chunk fragments that have been acked, but peer
84212 diff --git a/include/net/sock.h b/include/net/sock.h
84213 index b9586a1..b2948c0 100644
84214 --- a/include/net/sock.h
84215 +++ b/include/net/sock.h
84216 @@ -348,7 +348,7 @@ struct sock {
84217 unsigned int sk_napi_id;
84218 unsigned int sk_ll_usec;
84219 #endif
84220 - atomic_t sk_drops;
84221 + atomic_unchecked_t sk_drops;
84222 int sk_rcvbuf;
84223
84224 struct sk_filter __rcu *sk_filter;
84225 @@ -1036,7 +1036,7 @@ struct proto {
84226 void (*destroy_cgroup)(struct mem_cgroup *memcg);
84227 struct cg_proto *(*proto_cgroup)(struct mem_cgroup *memcg);
84228 #endif
84229 -};
84230 +} __randomize_layout;
84231
84232 /*
84233 * Bits in struct cg_proto.flags
84234 @@ -1223,7 +1223,7 @@ static inline u64 memcg_memory_allocated_read(struct cg_proto *prot)
84235 return ret >> PAGE_SHIFT;
84236 }
84237
84238 -static inline long
84239 +static inline long __intentional_overflow(-1)
84240 sk_memory_allocated(const struct sock *sk)
84241 {
84242 struct proto *prot = sk->sk_prot;
84243 @@ -1368,7 +1368,7 @@ struct sock_iocb {
84244 struct scm_cookie *scm;
84245 struct msghdr *msg, async_msg;
84246 struct kiocb *kiocb;
84247 -};
84248 +} __randomize_layout;
84249
84250 static inline struct sock_iocb *kiocb_to_siocb(struct kiocb *iocb)
84251 {
84252 @@ -1830,7 +1830,7 @@ static inline void sk_nocaps_add(struct sock *sk, netdev_features_t flags)
84253 }
84254
84255 static inline int skb_do_copy_data_nocache(struct sock *sk, struct sk_buff *skb,
84256 - char __user *from, char *to,
84257 + char __user *from, unsigned char *to,
84258 int copy, int offset)
84259 {
84260 if (skb->ip_summed == CHECKSUM_NONE) {
84261 @@ -2092,7 +2092,7 @@ static inline void sk_stream_moderate_sndbuf(struct sock *sk)
84262 }
84263 }
84264
84265 -struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
84266 +struct sk_buff * __intentional_overflow(0) sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp);
84267
84268 /**
84269 * sk_page_frag - return an appropriate page_frag
84270 diff --git a/include/net/tcp.h b/include/net/tcp.h
84271 index 743acce..44a58b0 100644
84272 --- a/include/net/tcp.h
84273 +++ b/include/net/tcp.h
84274 @@ -541,7 +541,7 @@ void tcp_retransmit_timer(struct sock *sk);
84275 void tcp_xmit_retransmit_queue(struct sock *);
84276 void tcp_simple_retransmit(struct sock *);
84277 int tcp_trim_head(struct sock *, struct sk_buff *, u32);
84278 -int tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
84279 +int __intentional_overflow(3) tcp_fragment(struct sock *, struct sk_buff *, u32, unsigned int);
84280
84281 void tcp_send_probe0(struct sock *);
84282 void tcp_send_partial(struct sock *);
84283 @@ -710,8 +710,8 @@ struct tcp_skb_cb {
84284 struct inet6_skb_parm h6;
84285 #endif
84286 } header; /* For incoming frames */
84287 - __u32 seq; /* Starting sequence number */
84288 - __u32 end_seq; /* SEQ + FIN + SYN + datalen */
84289 + __u32 seq __intentional_overflow(0); /* Starting sequence number */
84290 + __u32 end_seq __intentional_overflow(0); /* SEQ + FIN + SYN + datalen */
84291 __u32 when; /* used to compute rtt's */
84292 __u8 tcp_flags; /* TCP header flags. (tcp[13]) */
84293
84294 @@ -725,7 +725,7 @@ struct tcp_skb_cb {
84295
84296 __u8 ip_dsfield; /* IPv4 tos or IPv6 dsfield */
84297 /* 1 byte hole */
84298 - __u32 ack_seq; /* Sequence number ACK'd */
84299 + __u32 ack_seq __intentional_overflow(0); /* Sequence number ACK'd */
84300 };
84301
84302 #define TCP_SKB_CB(__skb) ((struct tcp_skb_cb *)&((__skb)->cb[0]))
84303 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
84304 index fb5654a..4457522 100644
84305 --- a/include/net/xfrm.h
84306 +++ b/include/net/xfrm.h
84307 @@ -286,7 +286,6 @@ struct xfrm_dst;
84308 struct xfrm_policy_afinfo {
84309 unsigned short family;
84310 struct dst_ops *dst_ops;
84311 - void (*garbage_collect)(struct net *net);
84312 struct dst_entry *(*dst_lookup)(struct net *net, int tos,
84313 const xfrm_address_t *saddr,
84314 const xfrm_address_t *daddr);
84315 @@ -304,7 +303,7 @@ struct xfrm_policy_afinfo {
84316 struct net_device *dev,
84317 const struct flowi *fl);
84318 struct dst_entry *(*blackhole_route)(struct net *net, struct dst_entry *orig);
84319 -};
84320 +} __do_const;
84321
84322 int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo);
84323 int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo);
84324 @@ -343,7 +342,7 @@ struct xfrm_state_afinfo {
84325 int (*transport_finish)(struct sk_buff *skb,
84326 int async);
84327 void (*local_error)(struct sk_buff *skb, u32 mtu);
84328 -};
84329 +} __do_const;
84330
84331 int xfrm_state_register_afinfo(struct xfrm_state_afinfo *afinfo);
84332 int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
84333 @@ -428,7 +427,7 @@ struct xfrm_mode {
84334 struct module *owner;
84335 unsigned int encap;
84336 int flags;
84337 -};
84338 +} __do_const;
84339
84340 /* Flags for xfrm_mode. */
84341 enum {
84342 @@ -525,7 +524,7 @@ struct xfrm_policy {
84343 struct timer_list timer;
84344
84345 struct flow_cache_object flo;
84346 - atomic_t genid;
84347 + atomic_unchecked_t genid;
84348 u32 priority;
84349 u32 index;
84350 struct xfrm_mark mark;
84351 @@ -1165,6 +1164,7 @@ static inline void xfrm_sk_free_policy(struct sock *sk)
84352 }
84353
84354 void xfrm_garbage_collect(struct net *net);
84355 +void xfrm_garbage_collect_deferred(struct net *net);
84356
84357 #else
84358
84359 @@ -1203,6 +1203,9 @@ static inline int xfrm6_policy_check_reverse(struct sock *sk, int dir,
84360 static inline void xfrm_garbage_collect(struct net *net)
84361 {
84362 }
84363 +static inline void xfrm_garbage_collect_deferred(struct net *net)
84364 +{
84365 +}
84366 #endif
84367
84368 static __inline__
84369 diff --git a/include/rdma/iw_cm.h b/include/rdma/iw_cm.h
84370 index 1017e0b..227aa4d 100644
84371 --- a/include/rdma/iw_cm.h
84372 +++ b/include/rdma/iw_cm.h
84373 @@ -122,7 +122,7 @@ struct iw_cm_verbs {
84374 int backlog);
84375
84376 int (*destroy_listen)(struct iw_cm_id *cm_id);
84377 -};
84378 +} __no_const;
84379
84380 /**
84381 * iw_create_cm_id - Create an IW CM identifier.
84382 diff --git a/include/scsi/libfc.h b/include/scsi/libfc.h
84383 index 52beadf..598734c 100644
84384 --- a/include/scsi/libfc.h
84385 +++ b/include/scsi/libfc.h
84386 @@ -771,6 +771,7 @@ struct libfc_function_template {
84387 */
84388 void (*disc_stop_final) (struct fc_lport *);
84389 };
84390 +typedef struct libfc_function_template __no_const libfc_function_template_no_const;
84391
84392 /**
84393 * struct fc_disc - Discovery context
84394 @@ -875,7 +876,7 @@ struct fc_lport {
84395 struct fc_vport *vport;
84396
84397 /* Operational Information */
84398 - struct libfc_function_template tt;
84399 + libfc_function_template_no_const tt;
84400 u8 link_up;
84401 u8 qfull;
84402 enum fc_lport_state state;
84403 diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
84404 index b4f1eff..7fdbd46 100644
84405 --- a/include/scsi/scsi_device.h
84406 +++ b/include/scsi/scsi_device.h
84407 @@ -180,9 +180,9 @@ struct scsi_device {
84408 unsigned int max_device_blocked; /* what device_blocked counts down from */
84409 #define SCSI_DEFAULT_DEVICE_BLOCKED 3
84410
84411 - atomic_t iorequest_cnt;
84412 - atomic_t iodone_cnt;
84413 - atomic_t ioerr_cnt;
84414 + atomic_unchecked_t iorequest_cnt;
84415 + atomic_unchecked_t iodone_cnt;
84416 + atomic_unchecked_t ioerr_cnt;
84417
84418 struct device sdev_gendev,
84419 sdev_dev;
84420 diff --git a/include/scsi/scsi_transport_fc.h b/include/scsi/scsi_transport_fc.h
84421 index b797e8f..8e2c3aa 100644
84422 --- a/include/scsi/scsi_transport_fc.h
84423 +++ b/include/scsi/scsi_transport_fc.h
84424 @@ -751,7 +751,8 @@ struct fc_function_template {
84425 unsigned long show_host_system_hostname:1;
84426
84427 unsigned long disable_target_scan:1;
84428 -};
84429 +} __do_const;
84430 +typedef struct fc_function_template __no_const fc_function_template_no_const;
84431
84432
84433 /**
84434 diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h
84435 index ae6c3b8..fd748ac 100644
84436 --- a/include/sound/compress_driver.h
84437 +++ b/include/sound/compress_driver.h
84438 @@ -128,7 +128,7 @@ struct snd_compr_ops {
84439 struct snd_compr_caps *caps);
84440 int (*get_codec_caps) (struct snd_compr_stream *stream,
84441 struct snd_compr_codec_caps *codec);
84442 -};
84443 +} __no_const;
84444
84445 /**
84446 * struct snd_compr: Compressed device
84447 diff --git a/include/sound/soc.h b/include/sound/soc.h
84448 index 9a00147..d814573 100644
84449 --- a/include/sound/soc.h
84450 +++ b/include/sound/soc.h
84451 @@ -770,7 +770,7 @@ struct snd_soc_codec_driver {
84452 /* probe ordering - for components with runtime dependencies */
84453 int probe_order;
84454 int remove_order;
84455 -};
84456 +} __do_const;
84457
84458 /* SoC platform interface */
84459 struct snd_soc_platform_driver {
84460 @@ -816,7 +816,7 @@ struct snd_soc_platform_driver {
84461 unsigned int (*read)(struct snd_soc_platform *, unsigned int);
84462 int (*write)(struct snd_soc_platform *, unsigned int, unsigned int);
84463 int (*bespoke_trigger)(struct snd_pcm_substream *, int);
84464 -};
84465 +} __do_const;
84466
84467 struct snd_soc_platform {
84468 const char *name;
84469 diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
84470 index 1772fad..282e3e2 100644
84471 --- a/include/target/target_core_base.h
84472 +++ b/include/target/target_core_base.h
84473 @@ -754,7 +754,7 @@ struct se_device {
84474 atomic_long_t write_bytes;
84475 /* Active commands on this virtual SE device */
84476 atomic_t simple_cmds;
84477 - atomic_t dev_ordered_id;
84478 + atomic_unchecked_t dev_ordered_id;
84479 atomic_t dev_ordered_sync;
84480 atomic_t dev_qf_count;
84481 int export_count;
84482 diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
84483 new file mode 100644
84484 index 0000000..fb634b7
84485 --- /dev/null
84486 +++ b/include/trace/events/fs.h
84487 @@ -0,0 +1,53 @@
84488 +#undef TRACE_SYSTEM
84489 +#define TRACE_SYSTEM fs
84490 +
84491 +#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
84492 +#define _TRACE_FS_H
84493 +
84494 +#include <linux/fs.h>
84495 +#include <linux/tracepoint.h>
84496 +
84497 +TRACE_EVENT(do_sys_open,
84498 +
84499 + TP_PROTO(const char *filename, int flags, int mode),
84500 +
84501 + TP_ARGS(filename, flags, mode),
84502 +
84503 + TP_STRUCT__entry(
84504 + __string( filename, filename )
84505 + __field( int, flags )
84506 + __field( int, mode )
84507 + ),
84508 +
84509 + TP_fast_assign(
84510 + __assign_str(filename, filename);
84511 + __entry->flags = flags;
84512 + __entry->mode = mode;
84513 + ),
84514 +
84515 + TP_printk("\"%s\" %x %o",
84516 + __get_str(filename), __entry->flags, __entry->mode)
84517 +);
84518 +
84519 +TRACE_EVENT(open_exec,
84520 +
84521 + TP_PROTO(const char *filename),
84522 +
84523 + TP_ARGS(filename),
84524 +
84525 + TP_STRUCT__entry(
84526 + __string( filename, filename )
84527 + ),
84528 +
84529 + TP_fast_assign(
84530 + __assign_str(filename, filename);
84531 + ),
84532 +
84533 + TP_printk("\"%s\"",
84534 + __get_str(filename))
84535 +);
84536 +
84537 +#endif /* _TRACE_FS_H */
84538 +
84539 +/* This part must be outside protection */
84540 +#include <trace/define_trace.h>
84541 diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
84542 index 1c09820..7f5ec79 100644
84543 --- a/include/trace/events/irq.h
84544 +++ b/include/trace/events/irq.h
84545 @@ -36,7 +36,7 @@ struct softirq_action;
84546 */
84547 TRACE_EVENT(irq_handler_entry,
84548
84549 - TP_PROTO(int irq, struct irqaction *action),
84550 + TP_PROTO(int irq, const struct irqaction *action),
84551
84552 TP_ARGS(irq, action),
84553
84554 @@ -66,7 +66,7 @@ TRACE_EVENT(irq_handler_entry,
84555 */
84556 TRACE_EVENT(irq_handler_exit,
84557
84558 - TP_PROTO(int irq, struct irqaction *action, int ret),
84559 + TP_PROTO(int irq, const struct irqaction *action, int ret),
84560
84561 TP_ARGS(irq, action, ret),
84562
84563 diff --git a/include/uapi/linux/a.out.h b/include/uapi/linux/a.out.h
84564 index 7caf44c..23c6f27 100644
84565 --- a/include/uapi/linux/a.out.h
84566 +++ b/include/uapi/linux/a.out.h
84567 @@ -39,6 +39,14 @@ enum machine_type {
84568 M_MIPS2 = 152 /* MIPS R6000/R4000 binary */
84569 };
84570
84571 +/* Constants for the N_FLAGS field */
84572 +#define F_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
84573 +#define F_PAX_EMUTRAMP 2 /* Emulate trampolines */
84574 +#define F_PAX_MPROTECT 4 /* Restrict mprotect() */
84575 +#define F_PAX_RANDMMAP 8 /* Randomize mmap() base */
84576 +/*#define F_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
84577 +#define F_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
84578 +
84579 #if !defined (N_MAGIC)
84580 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
84581 #endif
84582 diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h
84583 index 22b6ad3..aeba37e 100644
84584 --- a/include/uapi/linux/bcache.h
84585 +++ b/include/uapi/linux/bcache.h
84586 @@ -5,6 +5,7 @@
84587 * Bcache on disk data structures
84588 */
84589
84590 +#include <linux/compiler.h>
84591 #include <asm/types.h>
84592
84593 #define BITMASK(name, type, field, offset, size) \
84594 @@ -20,8 +21,8 @@ static inline void SET_##name(type *k, __u64 v) \
84595 /* Btree keys - all units are in sectors */
84596
84597 struct bkey {
84598 - __u64 high;
84599 - __u64 low;
84600 + __u64 high __intentional_overflow(-1);
84601 + __u64 low __intentional_overflow(-1);
84602 __u64 ptr[];
84603 };
84604
84605 diff --git a/include/uapi/linux/byteorder/little_endian.h b/include/uapi/linux/byteorder/little_endian.h
84606 index d876736..ccce5c0 100644
84607 --- a/include/uapi/linux/byteorder/little_endian.h
84608 +++ b/include/uapi/linux/byteorder/little_endian.h
84609 @@ -42,51 +42,51 @@
84610
84611 static inline __le64 __cpu_to_le64p(const __u64 *p)
84612 {
84613 - return (__force __le64)*p;
84614 + return (__force const __le64)*p;
84615 }
84616 -static inline __u64 __le64_to_cpup(const __le64 *p)
84617 +static inline __u64 __intentional_overflow(-1) __le64_to_cpup(const __le64 *p)
84618 {
84619 - return (__force __u64)*p;
84620 + return (__force const __u64)*p;
84621 }
84622 static inline __le32 __cpu_to_le32p(const __u32 *p)
84623 {
84624 - return (__force __le32)*p;
84625 + return (__force const __le32)*p;
84626 }
84627 static inline __u32 __le32_to_cpup(const __le32 *p)
84628 {
84629 - return (__force __u32)*p;
84630 + return (__force const __u32)*p;
84631 }
84632 static inline __le16 __cpu_to_le16p(const __u16 *p)
84633 {
84634 - return (__force __le16)*p;
84635 + return (__force const __le16)*p;
84636 }
84637 static inline __u16 __le16_to_cpup(const __le16 *p)
84638 {
84639 - return (__force __u16)*p;
84640 + return (__force const __u16)*p;
84641 }
84642 static inline __be64 __cpu_to_be64p(const __u64 *p)
84643 {
84644 - return (__force __be64)__swab64p(p);
84645 + return (__force const __be64)__swab64p(p);
84646 }
84647 static inline __u64 __be64_to_cpup(const __be64 *p)
84648 {
84649 - return __swab64p((__u64 *)p);
84650 + return __swab64p((const __u64 *)p);
84651 }
84652 static inline __be32 __cpu_to_be32p(const __u32 *p)
84653 {
84654 - return (__force __be32)__swab32p(p);
84655 + return (__force const __be32)__swab32p(p);
84656 }
84657 -static inline __u32 __be32_to_cpup(const __be32 *p)
84658 +static inline __u32 __intentional_overflow(-1) __be32_to_cpup(const __be32 *p)
84659 {
84660 - return __swab32p((__u32 *)p);
84661 + return __swab32p((const __u32 *)p);
84662 }
84663 static inline __be16 __cpu_to_be16p(const __u16 *p)
84664 {
84665 - return (__force __be16)__swab16p(p);
84666 + return (__force const __be16)__swab16p(p);
84667 }
84668 static inline __u16 __be16_to_cpup(const __be16 *p)
84669 {
84670 - return __swab16p((__u16 *)p);
84671 + return __swab16p((const __u16 *)p);
84672 }
84673 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
84674 #define __le64_to_cpus(x) do { (void)(x); } while (0)
84675 diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
84676 index ef6103b..d4e65dd 100644
84677 --- a/include/uapi/linux/elf.h
84678 +++ b/include/uapi/linux/elf.h
84679 @@ -37,6 +37,17 @@ typedef __s64 Elf64_Sxword;
84680 #define PT_GNU_EH_FRAME 0x6474e550
84681
84682 #define PT_GNU_STACK (PT_LOOS + 0x474e551)
84683 +#define PT_GNU_RELRO (PT_LOOS + 0x474e552)
84684 +
84685 +#define PT_PAX_FLAGS (PT_LOOS + 0x5041580)
84686 +
84687 +/* Constants for the e_flags field */
84688 +#define EF_PAX_PAGEEXEC 1 /* Paging based non-executable pages */
84689 +#define EF_PAX_EMUTRAMP 2 /* Emulate trampolines */
84690 +#define EF_PAX_MPROTECT 4 /* Restrict mprotect() */
84691 +#define EF_PAX_RANDMMAP 8 /* Randomize mmap() base */
84692 +/*#define EF_PAX_RANDEXEC 16*/ /* Randomize ET_EXEC base */
84693 +#define EF_PAX_SEGMEXEC 32 /* Segmentation based non-executable pages */
84694
84695 /*
84696 * Extended Numbering
84697 @@ -94,6 +105,8 @@ typedef __s64 Elf64_Sxword;
84698 #define DT_DEBUG 21
84699 #define DT_TEXTREL 22
84700 #define DT_JMPREL 23
84701 +#define DT_FLAGS 30
84702 + #define DF_TEXTREL 0x00000004
84703 #define DT_ENCODING 32
84704 #define OLD_DT_LOOS 0x60000000
84705 #define DT_LOOS 0x6000000d
84706 @@ -240,6 +253,19 @@ typedef struct elf64_hdr {
84707 #define PF_W 0x2
84708 #define PF_X 0x1
84709
84710 +#define PF_PAGEEXEC (1U << 4) /* Enable PAGEEXEC */
84711 +#define PF_NOPAGEEXEC (1U << 5) /* Disable PAGEEXEC */
84712 +#define PF_SEGMEXEC (1U << 6) /* Enable SEGMEXEC */
84713 +#define PF_NOSEGMEXEC (1U << 7) /* Disable SEGMEXEC */
84714 +#define PF_MPROTECT (1U << 8) /* Enable MPROTECT */
84715 +#define PF_NOMPROTECT (1U << 9) /* Disable MPROTECT */
84716 +/*#define PF_RANDEXEC (1U << 10)*/ /* Enable RANDEXEC */
84717 +/*#define PF_NORANDEXEC (1U << 11)*/ /* Disable RANDEXEC */
84718 +#define PF_EMUTRAMP (1U << 12) /* Enable EMUTRAMP */
84719 +#define PF_NOEMUTRAMP (1U << 13) /* Disable EMUTRAMP */
84720 +#define PF_RANDMMAP (1U << 14) /* Enable RANDMMAP */
84721 +#define PF_NORANDMMAP (1U << 15) /* Disable RANDMMAP */
84722 +
84723 typedef struct elf32_phdr{
84724 Elf32_Word p_type;
84725 Elf32_Off p_offset;
84726 @@ -332,6 +358,8 @@ typedef struct elf64_shdr {
84727 #define EI_OSABI 7
84728 #define EI_PAD 8
84729
84730 +#define EI_PAX 14
84731 +
84732 #define ELFMAG0 0x7f /* EI_MAG */
84733 #define ELFMAG1 'E'
84734 #define ELFMAG2 'L'
84735 diff --git a/include/uapi/linux/personality.h b/include/uapi/linux/personality.h
84736 index aa169c4..6a2771d 100644
84737 --- a/include/uapi/linux/personality.h
84738 +++ b/include/uapi/linux/personality.h
84739 @@ -30,6 +30,7 @@ enum {
84740 #define PER_CLEAR_ON_SETID (READ_IMPLIES_EXEC | \
84741 ADDR_NO_RANDOMIZE | \
84742 ADDR_COMPAT_LAYOUT | \
84743 + ADDR_LIMIT_3GB | \
84744 MMAP_PAGE_ZERO)
84745
84746 /*
84747 diff --git a/include/uapi/linux/screen_info.h b/include/uapi/linux/screen_info.h
84748 index 7530e74..e714828 100644
84749 --- a/include/uapi/linux/screen_info.h
84750 +++ b/include/uapi/linux/screen_info.h
84751 @@ -43,7 +43,8 @@ struct screen_info {
84752 __u16 pages; /* 0x32 */
84753 __u16 vesa_attributes; /* 0x34 */
84754 __u32 capabilities; /* 0x36 */
84755 - __u8 _reserved[6]; /* 0x3a */
84756 + __u16 vesapm_size; /* 0x3a */
84757 + __u8 _reserved[4]; /* 0x3c */
84758 } __attribute__((packed));
84759
84760 #define VIDEO_TYPE_MDA 0x10 /* Monochrome Text Display */
84761 diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h
84762 index 0e011eb..82681b1 100644
84763 --- a/include/uapi/linux/swab.h
84764 +++ b/include/uapi/linux/swab.h
84765 @@ -43,7 +43,7 @@
84766 * ___swab16, ___swab32, ___swab64, ___swahw32, ___swahb32
84767 */
84768
84769 -static inline __attribute_const__ __u16 __fswab16(__u16 val)
84770 +static inline __intentional_overflow(-1) __attribute_const__ __u16 __fswab16(__u16 val)
84771 {
84772 #ifdef __HAVE_BUILTIN_BSWAP16__
84773 return __builtin_bswap16(val);
84774 @@ -54,7 +54,7 @@ static inline __attribute_const__ __u16 __fswab16(__u16 val)
84775 #endif
84776 }
84777
84778 -static inline __attribute_const__ __u32 __fswab32(__u32 val)
84779 +static inline __intentional_overflow(-1) __attribute_const__ __u32 __fswab32(__u32 val)
84780 {
84781 #ifdef __HAVE_BUILTIN_BSWAP32__
84782 return __builtin_bswap32(val);
84783 @@ -65,7 +65,7 @@ static inline __attribute_const__ __u32 __fswab32(__u32 val)
84784 #endif
84785 }
84786
84787 -static inline __attribute_const__ __u64 __fswab64(__u64 val)
84788 +static inline __intentional_overflow(-1) __attribute_const__ __u64 __fswab64(__u64 val)
84789 {
84790 #ifdef __HAVE_BUILTIN_BSWAP64__
84791 return __builtin_bswap64(val);
84792 diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
84793 index 6d67213..552fdd9 100644
84794 --- a/include/uapi/linux/sysctl.h
84795 +++ b/include/uapi/linux/sysctl.h
84796 @@ -155,8 +155,6 @@ enum
84797 KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
84798 };
84799
84800 -
84801 -
84802 /* CTL_VM names: */
84803 enum
84804 {
84805 diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
84806 index fe94bb9..c9e51c2 100644
84807 --- a/include/uapi/linux/videodev2.h
84808 +++ b/include/uapi/linux/videodev2.h
84809 @@ -1227,7 +1227,7 @@ struct v4l2_ext_control {
84810 union {
84811 __s32 value;
84812 __s64 value64;
84813 - char *string;
84814 + char __user *string;
84815 };
84816 } __attribute__ ((packed));
84817
84818 diff --git a/include/uapi/linux/xattr.h b/include/uapi/linux/xattr.h
84819 index c38355c..17a57bc 100644
84820 --- a/include/uapi/linux/xattr.h
84821 +++ b/include/uapi/linux/xattr.h
84822 @@ -73,5 +73,9 @@
84823 #define XATTR_POSIX_ACL_DEFAULT "posix_acl_default"
84824 #define XATTR_NAME_POSIX_ACL_DEFAULT XATTR_SYSTEM_PREFIX XATTR_POSIX_ACL_DEFAULT
84825
84826 +/* User namespace */
84827 +#define XATTR_PAX_PREFIX XATTR_USER_PREFIX "pax."
84828 +#define XATTR_PAX_FLAGS_SUFFIX "flags"
84829 +#define XATTR_NAME_PAX_FLAGS XATTR_PAX_PREFIX XATTR_PAX_FLAGS_SUFFIX
84830
84831 #endif /* _UAPI_LINUX_XATTR_H */
84832 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
84833 index f9466fa..f4e2b81 100644
84834 --- a/include/video/udlfb.h
84835 +++ b/include/video/udlfb.h
84836 @@ -53,10 +53,10 @@ struct dlfb_data {
84837 u32 pseudo_palette[256];
84838 int blank_mode; /*one of FB_BLANK_ */
84839 /* blit-only rendering path metrics, exposed through sysfs */
84840 - atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
84841 - atomic_t bytes_identical; /* saved effort with backbuffer comparison */
84842 - atomic_t bytes_sent; /* to usb, after compression including overhead */
84843 - atomic_t cpu_kcycles_used; /* transpired during pixel processing */
84844 + atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
84845 + atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
84846 + atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
84847 + atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
84848 };
84849
84850 #define NR_USB_REQUEST_I2C_SUB_IO 0x02
84851 diff --git a/include/video/uvesafb.h b/include/video/uvesafb.h
84852 index 30f5362..8ed8ac9 100644
84853 --- a/include/video/uvesafb.h
84854 +++ b/include/video/uvesafb.h
84855 @@ -122,6 +122,7 @@ struct uvesafb_par {
84856 u8 ypan; /* 0 - nothing, 1 - ypan, 2 - ywrap */
84857 u8 pmi_setpal; /* PMI for palette changes */
84858 u16 *pmi_base; /* protected mode interface location */
84859 + u8 *pmi_code; /* protected mode code location */
84860 void *pmi_start;
84861 void *pmi_pal;
84862 u8 *vbe_state_orig; /*
84863 diff --git a/init/Kconfig b/init/Kconfig
84864 index 93c5ef0..ac92caa 100644
84865 --- a/init/Kconfig
84866 +++ b/init/Kconfig
84867 @@ -1079,6 +1079,7 @@ endif # CGROUPS
84868
84869 config CHECKPOINT_RESTORE
84870 bool "Checkpoint/restore support" if EXPERT
84871 + depends on !GRKERNSEC
84872 default n
84873 help
84874 Enables additional kernel features in a sake of checkpoint/restore.
84875 @@ -1545,7 +1546,7 @@ config SLUB_DEBUG
84876
84877 config COMPAT_BRK
84878 bool "Disable heap randomization"
84879 - default y
84880 + default n
84881 help
84882 Randomizing heap placement makes heap exploits harder, but it
84883 also breaks ancient binaries (including anything libc5 based).
84884 @@ -1833,7 +1834,7 @@ config INIT_ALL_POSSIBLE
84885 config STOP_MACHINE
84886 bool
84887 default y
84888 - depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU
84889 + depends on (SMP && MODULE_UNLOAD) || HOTPLUG_CPU || GRKERNSEC
84890 help
84891 Need stop_machine() primitive.
84892
84893 diff --git a/init/Makefile b/init/Makefile
84894 index 7bc47ee..6da2dc7 100644
84895 --- a/init/Makefile
84896 +++ b/init/Makefile
84897 @@ -2,6 +2,9 @@
84898 # Makefile for the linux kernel.
84899 #
84900
84901 +ccflags-y := $(GCC_PLUGINS_CFLAGS)
84902 +asflags-y := $(GCC_PLUGINS_AFLAGS)
84903 +
84904 obj-y := main.o version.o mounts.o
84905 ifneq ($(CONFIG_BLK_DEV_INITRD),y)
84906 obj-y += noinitramfs.o
84907 diff --git a/init/do_mounts.c b/init/do_mounts.c
84908 index 8e5addc..c96ea61 100644
84909 --- a/init/do_mounts.c
84910 +++ b/init/do_mounts.c
84911 @@ -359,11 +359,11 @@ static void __init get_fs_names(char *page)
84912 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
84913 {
84914 struct super_block *s;
84915 - int err = sys_mount(name, "/root", fs, flags, data);
84916 + int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data);
84917 if (err)
84918 return err;
84919
84920 - sys_chdir("/root");
84921 + sys_chdir((const char __force_user *)"/root");
84922 s = current->fs->pwd.dentry->d_sb;
84923 ROOT_DEV = s->s_dev;
84924 printk(KERN_INFO
84925 @@ -484,18 +484,18 @@ void __init change_floppy(char *fmt, ...)
84926 va_start(args, fmt);
84927 vsprintf(buf, fmt, args);
84928 va_end(args);
84929 - fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
84930 + fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
84931 if (fd >= 0) {
84932 sys_ioctl(fd, FDEJECT, 0);
84933 sys_close(fd);
84934 }
84935 printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
84936 - fd = sys_open("/dev/console", O_RDWR, 0);
84937 + fd = sys_open((__force const char __user *)"/dev/console", O_RDWR, 0);
84938 if (fd >= 0) {
84939 sys_ioctl(fd, TCGETS, (long)&termios);
84940 termios.c_lflag &= ~ICANON;
84941 sys_ioctl(fd, TCSETSF, (long)&termios);
84942 - sys_read(fd, &c, 1);
84943 + sys_read(fd, (char __user *)&c, 1);
84944 termios.c_lflag |= ICANON;
84945 sys_ioctl(fd, TCSETSF, (long)&termios);
84946 sys_close(fd);
84947 @@ -589,8 +589,8 @@ void __init prepare_namespace(void)
84948 mount_root();
84949 out:
84950 devtmpfs_mount("dev");
84951 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
84952 - sys_chroot(".");
84953 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
84954 + sys_chroot((const char __force_user *)".");
84955 }
84956
84957 static bool is_tmpfs;
84958 diff --git a/init/do_mounts.h b/init/do_mounts.h
84959 index f5b978a..69dbfe8 100644
84960 --- a/init/do_mounts.h
84961 +++ b/init/do_mounts.h
84962 @@ -15,15 +15,15 @@ extern int root_mountflags;
84963
84964 static inline int create_dev(char *name, dev_t dev)
84965 {
84966 - sys_unlink(name);
84967 - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
84968 + sys_unlink((char __force_user *)name);
84969 + return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev));
84970 }
84971
84972 #if BITS_PER_LONG == 32
84973 static inline u32 bstat(char *name)
84974 {
84975 struct stat64 stat;
84976 - if (sys_stat64(name, &stat) != 0)
84977 + if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0)
84978 return 0;
84979 if (!S_ISBLK(stat.st_mode))
84980 return 0;
84981 @@ -35,7 +35,7 @@ static inline u32 bstat(char *name)
84982 static inline u32 bstat(char *name)
84983 {
84984 struct stat stat;
84985 - if (sys_newstat(name, &stat) != 0)
84986 + if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0)
84987 return 0;
84988 if (!S_ISBLK(stat.st_mode))
84989 return 0;
84990 diff --git a/init/do_mounts_initrd.c b/init/do_mounts_initrd.c
84991 index 3e0878e..8a9d7a0 100644
84992 --- a/init/do_mounts_initrd.c
84993 +++ b/init/do_mounts_initrd.c
84994 @@ -37,13 +37,13 @@ static int init_linuxrc(struct subprocess_info *info, struct cred *new)
84995 {
84996 sys_unshare(CLONE_FS | CLONE_FILES);
84997 /* stdin/stdout/stderr for /linuxrc */
84998 - sys_open("/dev/console", O_RDWR, 0);
84999 + sys_open((const char __force_user *)"/dev/console", O_RDWR, 0);
85000 sys_dup(0);
85001 sys_dup(0);
85002 /* move initrd over / and chdir/chroot in initrd root */
85003 - sys_chdir("/root");
85004 - sys_mount(".", "/", NULL, MS_MOVE, NULL);
85005 - sys_chroot(".");
85006 + sys_chdir((const char __force_user *)"/root");
85007 + sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL);
85008 + sys_chroot((const char __force_user *)".");
85009 sys_setsid();
85010 return 0;
85011 }
85012 @@ -59,8 +59,8 @@ static void __init handle_initrd(void)
85013 create_dev("/dev/root.old", Root_RAM0);
85014 /* mount initrd on rootfs' /root */
85015 mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
85016 - sys_mkdir("/old", 0700);
85017 - sys_chdir("/old");
85018 + sys_mkdir((const char __force_user *)"/old", 0700);
85019 + sys_chdir((const char __force_user *)"/old");
85020
85021 /* try loading default modules from initrd */
85022 load_default_modules();
85023 @@ -80,31 +80,31 @@ static void __init handle_initrd(void)
85024 current->flags &= ~PF_FREEZER_SKIP;
85025
85026 /* move initrd to rootfs' /old */
85027 - sys_mount("..", ".", NULL, MS_MOVE, NULL);
85028 + sys_mount((char __force_user *)"..", (char __force_user *)".", NULL, MS_MOVE, NULL);
85029 /* switch root and cwd back to / of rootfs */
85030 - sys_chroot("..");
85031 + sys_chroot((const char __force_user *)"..");
85032
85033 if (new_decode_dev(real_root_dev) == Root_RAM0) {
85034 - sys_chdir("/old");
85035 + sys_chdir((const char __force_user *)"/old");
85036 return;
85037 }
85038
85039 - sys_chdir("/");
85040 + sys_chdir((const char __force_user *)"/");
85041 ROOT_DEV = new_decode_dev(real_root_dev);
85042 mount_root();
85043
85044 printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
85045 - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
85046 + error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL);
85047 if (!error)
85048 printk("okay\n");
85049 else {
85050 - int fd = sys_open("/dev/root.old", O_RDWR, 0);
85051 + int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0);
85052 if (error == -ENOENT)
85053 printk("/initrd does not exist. Ignored.\n");
85054 else
85055 printk("failed\n");
85056 printk(KERN_NOTICE "Unmounting old root\n");
85057 - sys_umount("/old", MNT_DETACH);
85058 + sys_umount((char __force_user *)"/old", MNT_DETACH);
85059 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
85060 if (fd < 0) {
85061 error = fd;
85062 @@ -127,11 +127,11 @@ int __init initrd_load(void)
85063 * mounted in the normal path.
85064 */
85065 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
85066 - sys_unlink("/initrd.image");
85067 + sys_unlink((const char __force_user *)"/initrd.image");
85068 handle_initrd();
85069 return 1;
85070 }
85071 }
85072 - sys_unlink("/initrd.image");
85073 + sys_unlink((const char __force_user *)"/initrd.image");
85074 return 0;
85075 }
85076 diff --git a/init/do_mounts_md.c b/init/do_mounts_md.c
85077 index 8cb6db5..d729f50 100644
85078 --- a/init/do_mounts_md.c
85079 +++ b/init/do_mounts_md.c
85080 @@ -180,7 +180,7 @@ static void __init md_setup_drive(void)
85081 partitioned ? "_d" : "", minor,
85082 md_setup_args[ent].device_names);
85083
85084 - fd = sys_open(name, 0, 0);
85085 + fd = sys_open((char __force_user *)name, 0, 0);
85086 if (fd < 0) {
85087 printk(KERN_ERR "md: open failed - cannot start "
85088 "array %s\n", name);
85089 @@ -243,7 +243,7 @@ static void __init md_setup_drive(void)
85090 * array without it
85091 */
85092 sys_close(fd);
85093 - fd = sys_open(name, 0, 0);
85094 + fd = sys_open((char __force_user *)name, 0, 0);
85095 sys_ioctl(fd, BLKRRPART, 0);
85096 }
85097 sys_close(fd);
85098 @@ -293,7 +293,7 @@ static void __init autodetect_raid(void)
85099
85100 wait_for_device_probe();
85101
85102 - fd = sys_open("/dev/md0", 0, 0);
85103 + fd = sys_open((const char __force_user *) "/dev/md0", 0, 0);
85104 if (fd >= 0) {
85105 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
85106 sys_close(fd);
85107 diff --git a/init/init_task.c b/init/init_task.c
85108 index ba0a7f36..2bcf1d5 100644
85109 --- a/init/init_task.c
85110 +++ b/init/init_task.c
85111 @@ -22,5 +22,9 @@ EXPORT_SYMBOL(init_task);
85112 * Initial thread structure. Alignment of this is handled by a special
85113 * linker map entry.
85114 */
85115 +#ifdef CONFIG_X86
85116 +union thread_union init_thread_union __init_task_data;
85117 +#else
85118 union thread_union init_thread_union __init_task_data =
85119 { INIT_THREAD_INFO(init_task) };
85120 +#endif
85121 diff --git a/init/initramfs.c b/init/initramfs.c
85122 index 93b6139..8d628b7 100644
85123 --- a/init/initramfs.c
85124 +++ b/init/initramfs.c
85125 @@ -84,7 +84,7 @@ static void __init free_hash(void)
85126 }
85127 }
85128
85129 -static long __init do_utime(char *filename, time_t mtime)
85130 +static long __init do_utime(char __force_user *filename, time_t mtime)
85131 {
85132 struct timespec t[2];
85133
85134 @@ -119,7 +119,7 @@ static void __init dir_utime(void)
85135 struct dir_entry *de, *tmp;
85136 list_for_each_entry_safe(de, tmp, &dir_list, list) {
85137 list_del(&de->list);
85138 - do_utime(de->name, de->mtime);
85139 + do_utime((char __force_user *)de->name, de->mtime);
85140 kfree(de->name);
85141 kfree(de);
85142 }
85143 @@ -281,7 +281,7 @@ static int __init maybe_link(void)
85144 if (nlink >= 2) {
85145 char *old = find_link(major, minor, ino, mode, collected);
85146 if (old)
85147 - return (sys_link(old, collected) < 0) ? -1 : 1;
85148 + return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1;
85149 }
85150 return 0;
85151 }
85152 @@ -290,11 +290,11 @@ static void __init clean_path(char *path, umode_t mode)
85153 {
85154 struct stat st;
85155
85156 - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
85157 + if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) {
85158 if (S_ISDIR(st.st_mode))
85159 - sys_rmdir(path);
85160 + sys_rmdir((char __force_user *)path);
85161 else
85162 - sys_unlink(path);
85163 + sys_unlink((char __force_user *)path);
85164 }
85165 }
85166
85167 @@ -315,7 +315,7 @@ static int __init do_name(void)
85168 int openflags = O_WRONLY|O_CREAT;
85169 if (ml != 1)
85170 openflags |= O_TRUNC;
85171 - wfd = sys_open(collected, openflags, mode);
85172 + wfd = sys_open((char __force_user *)collected, openflags, mode);
85173
85174 if (wfd >= 0) {
85175 sys_fchown(wfd, uid, gid);
85176 @@ -327,17 +327,17 @@ static int __init do_name(void)
85177 }
85178 }
85179 } else if (S_ISDIR(mode)) {
85180 - sys_mkdir(collected, mode);
85181 - sys_chown(collected, uid, gid);
85182 - sys_chmod(collected, mode);
85183 + sys_mkdir((char __force_user *)collected, mode);
85184 + sys_chown((char __force_user *)collected, uid, gid);
85185 + sys_chmod((char __force_user *)collected, mode);
85186 dir_add(collected, mtime);
85187 } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
85188 S_ISFIFO(mode) || S_ISSOCK(mode)) {
85189 if (maybe_link() == 0) {
85190 - sys_mknod(collected, mode, rdev);
85191 - sys_chown(collected, uid, gid);
85192 - sys_chmod(collected, mode);
85193 - do_utime(collected, mtime);
85194 + sys_mknod((char __force_user *)collected, mode, rdev);
85195 + sys_chown((char __force_user *)collected, uid, gid);
85196 + sys_chmod((char __force_user *)collected, mode);
85197 + do_utime((char __force_user *)collected, mtime);
85198 }
85199 }
85200 return 0;
85201 @@ -346,15 +346,15 @@ static int __init do_name(void)
85202 static int __init do_copy(void)
85203 {
85204 if (count >= body_len) {
85205 - sys_write(wfd, victim, body_len);
85206 + sys_write(wfd, (char __force_user *)victim, body_len);
85207 sys_close(wfd);
85208 - do_utime(vcollected, mtime);
85209 + do_utime((char __force_user *)vcollected, mtime);
85210 kfree(vcollected);
85211 eat(body_len);
85212 state = SkipIt;
85213 return 0;
85214 } else {
85215 - sys_write(wfd, victim, count);
85216 + sys_write(wfd, (char __force_user *)victim, count);
85217 body_len -= count;
85218 eat(count);
85219 return 1;
85220 @@ -365,9 +365,9 @@ static int __init do_symlink(void)
85221 {
85222 collected[N_ALIGN(name_len) + body_len] = '\0';
85223 clean_path(collected, 0);
85224 - sys_symlink(collected + N_ALIGN(name_len), collected);
85225 - sys_lchown(collected, uid, gid);
85226 - do_utime(collected, mtime);
85227 + sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected);
85228 + sys_lchown((char __force_user *)collected, uid, gid);
85229 + do_utime((char __force_user *)collected, mtime);
85230 state = SkipIt;
85231 next_state = Reset;
85232 return 0;
85233 diff --git a/init/main.c b/init/main.c
85234 index 9c7fd4c..650b4f1 100644
85235 --- a/init/main.c
85236 +++ b/init/main.c
85237 @@ -97,6 +97,8 @@ extern void radix_tree_init(void);
85238 static inline void mark_rodata_ro(void) { }
85239 #endif
85240
85241 +extern void grsecurity_init(void);
85242 +
85243 /*
85244 * Debug helper: via this flag we know that we are in 'early bootup code'
85245 * where only the boot processor is running with IRQ disabled. This means
85246 @@ -158,6 +160,75 @@ static int __init set_reset_devices(char *str)
85247
85248 __setup("reset_devices", set_reset_devices);
85249
85250 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
85251 +kgid_t grsec_proc_gid = KGIDT_INIT(CONFIG_GRKERNSEC_PROC_GID);
85252 +static int __init setup_grsec_proc_gid(char *str)
85253 +{
85254 + grsec_proc_gid = KGIDT_INIT(simple_strtol(str, NULL, 0));
85255 + return 1;
85256 +}
85257 +__setup("grsec_proc_gid=", setup_grsec_proc_gid);
85258 +#endif
85259 +
85260 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
85261 +unsigned long pax_user_shadow_base __read_only;
85262 +EXPORT_SYMBOL(pax_user_shadow_base);
85263 +extern char pax_enter_kernel_user[];
85264 +extern char pax_exit_kernel_user[];
85265 +#endif
85266 +
85267 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
85268 +static int __init setup_pax_nouderef(char *str)
85269 +{
85270 +#ifdef CONFIG_X86_32
85271 + unsigned int cpu;
85272 + struct desc_struct *gdt;
85273 +
85274 + for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
85275 + gdt = get_cpu_gdt_table(cpu);
85276 + gdt[GDT_ENTRY_KERNEL_DS].type = 3;
85277 + gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
85278 + gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
85279 + gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
85280 + }
85281 + loadsegment(ds, __KERNEL_DS);
85282 + loadsegment(es, __KERNEL_DS);
85283 + loadsegment(ss, __KERNEL_DS);
85284 +#else
85285 + memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
85286 + memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
85287 + clone_pgd_mask = ~(pgdval_t)0UL;
85288 + pax_user_shadow_base = 0UL;
85289 + setup_clear_cpu_cap(X86_FEATURE_PCID);
85290 + setup_clear_cpu_cap(X86_FEATURE_INVPCID);
85291 +#endif
85292 +
85293 + return 0;
85294 +}
85295 +early_param("pax_nouderef", setup_pax_nouderef);
85296 +
85297 +#ifdef CONFIG_X86_64
85298 +static int __init setup_pax_weakuderef(char *str)
85299 +{
85300 + if (clone_pgd_mask != ~(pgdval_t)0UL)
85301 + pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
85302 + return 1;
85303 +}
85304 +__setup("pax_weakuderef", setup_pax_weakuderef);
85305 +#endif
85306 +#endif
85307 +
85308 +#ifdef CONFIG_PAX_SOFTMODE
85309 +int pax_softmode;
85310 +
85311 +static int __init setup_pax_softmode(char *str)
85312 +{
85313 + get_option(&str, &pax_softmode);
85314 + return 1;
85315 +}
85316 +__setup("pax_softmode=", setup_pax_softmode);
85317 +#endif
85318 +
85319 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
85320 const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
85321 static const char *panic_later, *panic_param;
85322 @@ -688,25 +759,24 @@ int __init_or_module do_one_initcall(initcall_t fn)
85323 {
85324 int count = preempt_count();
85325 int ret;
85326 - char msgbuf[64];
85327 + const char *msg1 = "", *msg2 = "";
85328
85329 if (initcall_debug)
85330 ret = do_one_initcall_debug(fn);
85331 else
85332 ret = fn();
85333
85334 - msgbuf[0] = 0;
85335 -
85336 if (preempt_count() != count) {
85337 - sprintf(msgbuf, "preemption imbalance ");
85338 + msg1 = " preemption imbalance";
85339 preempt_count_set(count);
85340 }
85341 if (irqs_disabled()) {
85342 - strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
85343 + msg2 = " disabled interrupts";
85344 local_irq_enable();
85345 }
85346 - WARN(msgbuf[0], "initcall %pF returned with %s\n", fn, msgbuf);
85347 + WARN(*msg1 || *msg2, "initcall %pF returned with%s%s\n", fn, msg1, msg2);
85348
85349 + add_latent_entropy();
85350 return ret;
85351 }
85352
85353 @@ -813,8 +883,8 @@ static int run_init_process(const char *init_filename)
85354 {
85355 argv_init[0] = init_filename;
85356 return do_execve(getname_kernel(init_filename),
85357 - (const char __user *const __user *)argv_init,
85358 - (const char __user *const __user *)envp_init);
85359 + (const char __user *const __force_user *)argv_init,
85360 + (const char __user *const __force_user *)envp_init);
85361 }
85362
85363 static int try_to_run_init_process(const char *init_filename)
85364 @@ -831,6 +901,10 @@ static int try_to_run_init_process(const char *init_filename)
85365 return ret;
85366 }
85367
85368 +#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
85369 +extern int gr_init_ran;
85370 +#endif
85371 +
85372 static noinline void __init kernel_init_freeable(void);
85373
85374 static int __ref kernel_init(void *unused)
85375 @@ -855,6 +929,11 @@ static int __ref kernel_init(void *unused)
85376 ramdisk_execute_command, ret);
85377 }
85378
85379 +#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
85380 + /* if no initrd was used, be extra sure we enforce chroot restrictions */
85381 + gr_init_ran = 1;
85382 +#endif
85383 +
85384 /*
85385 * We try each of these until one succeeds.
85386 *
85387 @@ -910,7 +989,7 @@ static noinline void __init kernel_init_freeable(void)
85388 do_basic_setup();
85389
85390 /* Open the /dev/console on the rootfs, this should never fail */
85391 - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0)
85392 + if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0)
85393 pr_err("Warning: unable to open an initial console.\n");
85394
85395 (void) sys_dup(0);
85396 @@ -923,11 +1002,13 @@ static noinline void __init kernel_init_freeable(void)
85397 if (!ramdisk_execute_command)
85398 ramdisk_execute_command = "/init";
85399
85400 - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
85401 + if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) {
85402 ramdisk_execute_command = NULL;
85403 prepare_namespace();
85404 }
85405
85406 + grsecurity_init();
85407 +
85408 /*
85409 * Ok, we have completed the initial bootup, and
85410 * we're essentially up and running. Get rid of the
85411 diff --git a/ipc/compat.c b/ipc/compat.c
85412 index f486b00..442867f 100644
85413 --- a/ipc/compat.c
85414 +++ b/ipc/compat.c
85415 @@ -399,7 +399,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second,
85416 COMPAT_SHMLBA);
85417 if (err < 0)
85418 return err;
85419 - return put_user(raddr, (compat_ulong_t *)compat_ptr(third));
85420 + return put_user(raddr, (compat_ulong_t __user *)compat_ptr(third));
85421 }
85422 case SHMDT:
85423 return sys_shmdt(compat_ptr(ptr));
85424 diff --git a/ipc/ipc_sysctl.c b/ipc/ipc_sysctl.c
85425 index 1702864..797fa84 100644
85426 --- a/ipc/ipc_sysctl.c
85427 +++ b/ipc/ipc_sysctl.c
85428 @@ -30,7 +30,7 @@ static void *get_ipc(ctl_table *table)
85429 static int proc_ipc_dointvec(ctl_table *table, int write,
85430 void __user *buffer, size_t *lenp, loff_t *ppos)
85431 {
85432 - struct ctl_table ipc_table;
85433 + ctl_table_no_const ipc_table;
85434
85435 memcpy(&ipc_table, table, sizeof(ipc_table));
85436 ipc_table.data = get_ipc(table);
85437 @@ -41,7 +41,7 @@ static int proc_ipc_dointvec(ctl_table *table, int write,
85438 static int proc_ipc_dointvec_minmax(ctl_table *table, int write,
85439 void __user *buffer, size_t *lenp, loff_t *ppos)
85440 {
85441 - struct ctl_table ipc_table;
85442 + ctl_table_no_const ipc_table;
85443
85444 memcpy(&ipc_table, table, sizeof(ipc_table));
85445 ipc_table.data = get_ipc(table);
85446 @@ -65,7 +65,7 @@ static int proc_ipc_dointvec_minmax_orphans(ctl_table *table, int write,
85447 static int proc_ipc_callback_dointvec_minmax(ctl_table *table, int write,
85448 void __user *buffer, size_t *lenp, loff_t *ppos)
85449 {
85450 - struct ctl_table ipc_table;
85451 + ctl_table_no_const ipc_table;
85452 size_t lenp_bef = *lenp;
85453 int rc;
85454
85455 @@ -88,7 +88,7 @@ static int proc_ipc_callback_dointvec_minmax(ctl_table *table, int write,
85456 static int proc_ipc_doulongvec_minmax(ctl_table *table, int write,
85457 void __user *buffer, size_t *lenp, loff_t *ppos)
85458 {
85459 - struct ctl_table ipc_table;
85460 + ctl_table_no_const ipc_table;
85461 memcpy(&ipc_table, table, sizeof(ipc_table));
85462 ipc_table.data = get_ipc(table);
85463
85464 @@ -122,7 +122,7 @@ static void ipc_auto_callback(int val)
85465 static int proc_ipcauto_dointvec_minmax(ctl_table *table, int write,
85466 void __user *buffer, size_t *lenp, loff_t *ppos)
85467 {
85468 - struct ctl_table ipc_table;
85469 + ctl_table_no_const ipc_table;
85470 size_t lenp_bef = *lenp;
85471 int oldval;
85472 int rc;
85473 diff --git a/ipc/mq_sysctl.c b/ipc/mq_sysctl.c
85474 index 5bb8bfe..a38ec05 100644
85475 --- a/ipc/mq_sysctl.c
85476 +++ b/ipc/mq_sysctl.c
85477 @@ -25,7 +25,7 @@ static void *get_mq(ctl_table *table)
85478 static int proc_mq_dointvec(ctl_table *table, int write,
85479 void __user *buffer, size_t *lenp, loff_t *ppos)
85480 {
85481 - struct ctl_table mq_table;
85482 + ctl_table_no_const mq_table;
85483 memcpy(&mq_table, table, sizeof(mq_table));
85484 mq_table.data = get_mq(table);
85485
85486 @@ -35,7 +35,7 @@ static int proc_mq_dointvec(ctl_table *table, int write,
85487 static int proc_mq_dointvec_minmax(ctl_table *table, int write,
85488 void __user *buffer, size_t *lenp, loff_t *ppos)
85489 {
85490 - struct ctl_table mq_table;
85491 + ctl_table_no_const mq_table;
85492 memcpy(&mq_table, table, sizeof(mq_table));
85493 mq_table.data = get_mq(table);
85494
85495 diff --git a/ipc/mqueue.c b/ipc/mqueue.c
85496 index c3b3117..1efa933 100644
85497 --- a/ipc/mqueue.c
85498 +++ b/ipc/mqueue.c
85499 @@ -278,6 +278,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
85500 mq_bytes = mq_treesize + (info->attr.mq_maxmsg *
85501 info->attr.mq_msgsize);
85502
85503 + gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
85504 spin_lock(&mq_lock);
85505 if (u->mq_bytes + mq_bytes < u->mq_bytes ||
85506 u->mq_bytes + mq_bytes > rlimit(RLIMIT_MSGQUEUE)) {
85507 diff --git a/ipc/msg.c b/ipc/msg.c
85508 index 6498531..b0ff3c8 100644
85509 --- a/ipc/msg.c
85510 +++ b/ipc/msg.c
85511 @@ -303,18 +303,19 @@ static inline int msg_security(struct kern_ipc_perm *ipcp, int msgflg)
85512 return security_msg_queue_associate(msq, msgflg);
85513 }
85514
85515 +static struct ipc_ops msg_ops = {
85516 + .getnew = newque,
85517 + .associate = msg_security,
85518 + .more_checks = NULL
85519 +};
85520 +
85521 SYSCALL_DEFINE2(msgget, key_t, key, int, msgflg)
85522 {
85523 struct ipc_namespace *ns;
85524 - struct ipc_ops msg_ops;
85525 struct ipc_params msg_params;
85526
85527 ns = current->nsproxy->ipc_ns;
85528
85529 - msg_ops.getnew = newque;
85530 - msg_ops.associate = msg_security;
85531 - msg_ops.more_checks = NULL;
85532 -
85533 msg_params.key = key;
85534 msg_params.flg = msgflg;
85535
85536 diff --git a/ipc/sem.c b/ipc/sem.c
85537 index bee5554..e9af81dd 100644
85538 --- a/ipc/sem.c
85539 +++ b/ipc/sem.c
85540 @@ -561,10 +561,15 @@ static inline int sem_more_checks(struct kern_ipc_perm *ipcp,
85541 return 0;
85542 }
85543
85544 +static struct ipc_ops sem_ops = {
85545 + .getnew = newary,
85546 + .associate = sem_security,
85547 + .more_checks = sem_more_checks
85548 +};
85549 +
85550 SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
85551 {
85552 struct ipc_namespace *ns;
85553 - struct ipc_ops sem_ops;
85554 struct ipc_params sem_params;
85555
85556 ns = current->nsproxy->ipc_ns;
85557 @@ -572,10 +577,6 @@ SYSCALL_DEFINE3(semget, key_t, key, int, nsems, int, semflg)
85558 if (nsems < 0 || nsems > ns->sc_semmsl)
85559 return -EINVAL;
85560
85561 - sem_ops.getnew = newary;
85562 - sem_ops.associate = sem_security;
85563 - sem_ops.more_checks = sem_more_checks;
85564 -
85565 sem_params.key = key;
85566 sem_params.flg = semflg;
85567 sem_params.u.nsems = nsems;
85568 diff --git a/ipc/shm.c b/ipc/shm.c
85569 index 7645961..afc7f02 100644
85570 --- a/ipc/shm.c
85571 +++ b/ipc/shm.c
85572 @@ -72,6 +72,14 @@ static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp);
85573 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
85574 #endif
85575
85576 +#ifdef CONFIG_GRKERNSEC
85577 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
85578 + const time_t shm_createtime, const kuid_t cuid,
85579 + const int shmid);
85580 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
85581 + const time_t shm_createtime);
85582 +#endif
85583 +
85584 void shm_init_ns(struct ipc_namespace *ns)
85585 {
85586 ns->shm_ctlmax = SHMMAX;
85587 @@ -553,6 +561,14 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
85588 shp->shm_lprid = 0;
85589 shp->shm_atim = shp->shm_dtim = 0;
85590 shp->shm_ctim = get_seconds();
85591 +#ifdef CONFIG_GRKERNSEC
85592 + {
85593 + struct timespec timeval;
85594 + do_posix_clock_monotonic_gettime(&timeval);
85595 +
85596 + shp->shm_createtime = timeval.tv_sec;
85597 + }
85598 +#endif
85599 shp->shm_segsz = size;
85600 shp->shm_nattch = 0;
85601 shp->shm_file = file;
85602 @@ -606,18 +622,19 @@ static inline int shm_more_checks(struct kern_ipc_perm *ipcp,
85603 return 0;
85604 }
85605
85606 +static struct ipc_ops shm_ops = {
85607 + .getnew = newseg,
85608 + .associate = shm_security,
85609 + .more_checks = shm_more_checks
85610 +};
85611 +
85612 SYSCALL_DEFINE3(shmget, key_t, key, size_t, size, int, shmflg)
85613 {
85614 struct ipc_namespace *ns;
85615 - struct ipc_ops shm_ops;
85616 struct ipc_params shm_params;
85617
85618 ns = current->nsproxy->ipc_ns;
85619
85620 - shm_ops.getnew = newseg;
85621 - shm_ops.associate = shm_security;
85622 - shm_ops.more_checks = shm_more_checks;
85623 -
85624 shm_params.key = key;
85625 shm_params.flg = shmflg;
85626 shm_params.u.size = size;
85627 @@ -1088,6 +1105,12 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
85628 f_mode = FMODE_READ | FMODE_WRITE;
85629 }
85630 if (shmflg & SHM_EXEC) {
85631 +
85632 +#ifdef CONFIG_PAX_MPROTECT
85633 + if (current->mm->pax_flags & MF_PAX_MPROTECT)
85634 + goto out;
85635 +#endif
85636 +
85637 prot |= PROT_EXEC;
85638 acc_mode |= S_IXUGO;
85639 }
85640 @@ -1112,6 +1135,15 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
85641 if (err)
85642 goto out_unlock;
85643
85644 +#ifdef CONFIG_GRKERNSEC
85645 + if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
85646 + shp->shm_perm.cuid, shmid) ||
85647 + !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
85648 + err = -EACCES;
85649 + goto out_unlock;
85650 + }
85651 +#endif
85652 +
85653 ipc_lock_object(&shp->shm_perm);
85654
85655 /* check if shm_destroy() is tearing down shp */
85656 @@ -1124,6 +1156,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
85657 path = shp->shm_file->f_path;
85658 path_get(&path);
85659 shp->shm_nattch++;
85660 +#ifdef CONFIG_GRKERNSEC
85661 + shp->shm_lapid = current->pid;
85662 +#endif
85663 size = i_size_read(path.dentry->d_inode);
85664 ipc_unlock_object(&shp->shm_perm);
85665 rcu_read_unlock();
85666 diff --git a/ipc/util.c b/ipc/util.c
85667 index e1b4c6d..8174204 100644
85668 --- a/ipc/util.c
85669 +++ b/ipc/util.c
85670 @@ -71,6 +71,8 @@ struct ipc_proc_iface {
85671 int (*show)(struct seq_file *, void *);
85672 };
85673
85674 +extern int gr_ipc_permitted(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, int requested_mode, int granted_mode);
85675 +
85676 static void ipc_memory_notifier(struct work_struct *work)
85677 {
85678 ipcns_notify(IPCNS_MEMCHANGED);
85679 @@ -537,6 +539,10 @@ int ipcperms(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp, short flag)
85680 granted_mode >>= 6;
85681 else if (in_group_p(ipcp->cgid) || in_group_p(ipcp->gid))
85682 granted_mode >>= 3;
85683 +
85684 + if (!gr_ipc_permitted(ns, ipcp, requested_mode, granted_mode))
85685 + return -1;
85686 +
85687 /* is there some bit set in requested_mode but not in granted_mode? */
85688 if ((requested_mode & ~granted_mode & 0007) &&
85689 !ns_capable(ns->user_ns, CAP_IPC_OWNER))
85690 diff --git a/kernel/acct.c b/kernel/acct.c
85691 index 8d6e145..33e0b1e 100644
85692 --- a/kernel/acct.c
85693 +++ b/kernel/acct.c
85694 @@ -556,7 +556,7 @@ static void do_acct_process(struct bsd_acct_struct *acct,
85695 */
85696 flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
85697 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
85698 - file->f_op->write(file, (char *)&ac,
85699 + file->f_op->write(file, (char __force_user *)&ac,
85700 sizeof(acct_t), &file->f_pos);
85701 current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
85702 set_fs(fs);
85703 diff --git a/kernel/audit.c b/kernel/audit.c
85704 index d5f31c1..06646e1 100644
85705 --- a/kernel/audit.c
85706 +++ b/kernel/audit.c
85707 @@ -122,7 +122,7 @@ u32 audit_sig_sid = 0;
85708 3) suppressed due to audit_rate_limit
85709 4) suppressed due to audit_backlog_limit
85710 */
85711 -static atomic_t audit_lost = ATOMIC_INIT(0);
85712 +static atomic_unchecked_t audit_lost = ATOMIC_INIT(0);
85713
85714 /* The netlink socket. */
85715 static struct sock *audit_sock;
85716 @@ -256,7 +256,7 @@ void audit_log_lost(const char *message)
85717 unsigned long now;
85718 int print;
85719
85720 - atomic_inc(&audit_lost);
85721 + atomic_inc_unchecked(&audit_lost);
85722
85723 print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
85724
85725 @@ -273,7 +273,7 @@ void audit_log_lost(const char *message)
85726 if (print) {
85727 if (printk_ratelimit())
85728 pr_warn("audit_lost=%u audit_rate_limit=%u audit_backlog_limit=%u\n",
85729 - atomic_read(&audit_lost),
85730 + atomic_read_unchecked(&audit_lost),
85731 audit_rate_limit,
85732 audit_backlog_limit);
85733 audit_panic(message);
85734 @@ -803,7 +803,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
85735 s.pid = audit_pid;
85736 s.rate_limit = audit_rate_limit;
85737 s.backlog_limit = audit_backlog_limit;
85738 - s.lost = atomic_read(&audit_lost);
85739 + s.lost = atomic_read_unchecked(&audit_lost);
85740 s.backlog = skb_queue_len(&audit_skb_queue);
85741 s.version = AUDIT_VERSION_LATEST;
85742 s.backlog_wait_time = audit_backlog_wait_time;
85743 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
85744 index 3b29605..f6c85d0 100644
85745 --- a/kernel/auditsc.c
85746 +++ b/kernel/auditsc.c
85747 @@ -1945,7 +1945,7 @@ int auditsc_get_stamp(struct audit_context *ctx,
85748 }
85749
85750 /* global counter which is incremented every time something logs in */
85751 -static atomic_t session_id = ATOMIC_INIT(0);
85752 +static atomic_unchecked_t session_id = ATOMIC_INIT(0);
85753
85754 static int audit_set_loginuid_perm(kuid_t loginuid)
85755 {
85756 @@ -2014,7 +2014,7 @@ int audit_set_loginuid(kuid_t loginuid)
85757
85758 /* are we setting or clearing? */
85759 if (uid_valid(loginuid))
85760 - sessionid = (unsigned int)atomic_inc_return(&session_id);
85761 + sessionid = (unsigned int)atomic_inc_return_unchecked(&session_id);
85762
85763 task->sessionid = sessionid;
85764 task->loginuid = loginuid;
85765 diff --git a/kernel/capability.c b/kernel/capability.c
85766 index 34019c5..363f279 100644
85767 --- a/kernel/capability.c
85768 +++ b/kernel/capability.c
85769 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
85770 * before modification is attempted and the application
85771 * fails.
85772 */
85773 + if (tocopy > ARRAY_SIZE(kdata))
85774 + return -EFAULT;
85775 +
85776 if (copy_to_user(dataptr, kdata, tocopy
85777 * sizeof(struct __user_cap_data_struct))) {
85778 return -EFAULT;
85779 @@ -303,10 +306,11 @@ bool has_ns_capability(struct task_struct *t,
85780 int ret;
85781
85782 rcu_read_lock();
85783 - ret = security_capable(__task_cred(t), ns, cap);
85784 + ret = security_capable(__task_cred(t), ns, cap) == 0 &&
85785 + gr_task_is_capable(t, __task_cred(t), cap);
85786 rcu_read_unlock();
85787
85788 - return (ret == 0);
85789 + return ret;
85790 }
85791
85792 /**
85793 @@ -343,10 +347,10 @@ bool has_ns_capability_noaudit(struct task_struct *t,
85794 int ret;
85795
85796 rcu_read_lock();
85797 - ret = security_capable_noaudit(__task_cred(t), ns, cap);
85798 + ret = security_capable_noaudit(__task_cred(t), ns, cap) == 0 && gr_task_is_capable_nolog(t, cap);
85799 rcu_read_unlock();
85800
85801 - return (ret == 0);
85802 + return ret;
85803 }
85804
85805 /**
85806 @@ -384,7 +388,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
85807 BUG();
85808 }
85809
85810 - if (security_capable(current_cred(), ns, cap) == 0) {
85811 + if (security_capable(current_cred(), ns, cap) == 0 && gr_is_capable(cap)) {
85812 current->flags |= PF_SUPERPRIV;
85813 return true;
85814 }
85815 @@ -392,6 +396,21 @@ bool ns_capable(struct user_namespace *ns, int cap)
85816 }
85817 EXPORT_SYMBOL(ns_capable);
85818
85819 +bool ns_capable_nolog(struct user_namespace *ns, int cap)
85820 +{
85821 + if (unlikely(!cap_valid(cap))) {
85822 + printk(KERN_CRIT "capable_nolog() called with invalid cap=%u\n", cap);
85823 + BUG();
85824 + }
85825 +
85826 + if (security_capable_noaudit(current_cred(), ns, cap) == 0 && gr_is_capable_nolog(cap)) {
85827 + current->flags |= PF_SUPERPRIV;
85828 + return true;
85829 + }
85830 + return false;
85831 +}
85832 +EXPORT_SYMBOL(ns_capable_nolog);
85833 +
85834 /**
85835 * file_ns_capable - Determine if the file's opener had a capability in effect
85836 * @file: The file we want to check
85837 @@ -432,6 +451,12 @@ bool capable(int cap)
85838 }
85839 EXPORT_SYMBOL(capable);
85840
85841 +bool capable_nolog(int cap)
85842 +{
85843 + return ns_capable_nolog(&init_user_ns, cap);
85844 +}
85845 +EXPORT_SYMBOL(capable_nolog);
85846 +
85847 /**
85848 * inode_capable - Check superior capability over inode
85849 * @inode: The inode in question
85850 @@ -453,3 +478,11 @@ bool inode_capable(const struct inode *inode, int cap)
85851 return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
85852 }
85853 EXPORT_SYMBOL(inode_capable);
85854 +
85855 +bool inode_capable_nolog(const struct inode *inode, int cap)
85856 +{
85857 + struct user_namespace *ns = current_user_ns();
85858 +
85859 + return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
85860 +}
85861 +EXPORT_SYMBOL(inode_capable_nolog);
85862 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
85863 index 0c753dd..dd7d3d6 100644
85864 --- a/kernel/cgroup.c
85865 +++ b/kernel/cgroup.c
85866 @@ -5372,7 +5372,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v)
85867 struct css_set *cset = link->cset;
85868 struct task_struct *task;
85869 int count = 0;
85870 - seq_printf(seq, "css_set %p\n", cset);
85871 + seq_printf(seq, "css_set %pK\n", cset);
85872 list_for_each_entry(task, &cset->tasks, cg_list) {
85873 if (count++ > MAX_TASKS_SHOWN_PER_CSS) {
85874 seq_puts(seq, " ...\n");
85875 diff --git a/kernel/compat.c b/kernel/compat.c
85876 index 0a09e48..b46b3d78 100644
85877 --- a/kernel/compat.c
85878 +++ b/kernel/compat.c
85879 @@ -13,6 +13,7 @@
85880
85881 #include <linux/linkage.h>
85882 #include <linux/compat.h>
85883 +#include <linux/module.h>
85884 #include <linux/errno.h>
85885 #include <linux/time.h>
85886 #include <linux/signal.h>
85887 @@ -220,7 +221,7 @@ static long compat_nanosleep_restart(struct restart_block *restart)
85888 mm_segment_t oldfs;
85889 long ret;
85890
85891 - restart->nanosleep.rmtp = (struct timespec __user *) &rmt;
85892 + restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt;
85893 oldfs = get_fs();
85894 set_fs(KERNEL_DS);
85895 ret = hrtimer_nanosleep_restart(restart);
85896 @@ -252,7 +253,7 @@ asmlinkage long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
85897 oldfs = get_fs();
85898 set_fs(KERNEL_DS);
85899 ret = hrtimer_nanosleep(&tu,
85900 - rmtp ? (struct timespec __user *)&rmt : NULL,
85901 + rmtp ? (struct timespec __force_user *)&rmt : NULL,
85902 HRTIMER_MODE_REL, CLOCK_MONOTONIC);
85903 set_fs(oldfs);
85904
85905 @@ -361,7 +362,7 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
85906 mm_segment_t old_fs = get_fs();
85907
85908 set_fs(KERNEL_DS);
85909 - ret = sys_sigpending((old_sigset_t __user *) &s);
85910 + ret = sys_sigpending((old_sigset_t __force_user *) &s);
85911 set_fs(old_fs);
85912 if (ret == 0)
85913 ret = put_user(s, set);
85914 @@ -451,7 +452,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
85915 mm_segment_t old_fs = get_fs();
85916
85917 set_fs(KERNEL_DS);
85918 - ret = sys_old_getrlimit(resource, &r);
85919 + ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r);
85920 set_fs(old_fs);
85921
85922 if (!ret) {
85923 @@ -533,8 +534,8 @@ COMPAT_SYSCALL_DEFINE4(wait4,
85924 set_fs (KERNEL_DS);
85925 ret = sys_wait4(pid,
85926 (stat_addr ?
85927 - (unsigned int __user *) &status : NULL),
85928 - options, (struct rusage __user *) &r);
85929 + (unsigned int __force_user *) &status : NULL),
85930 + options, (struct rusage __force_user *) &r);
85931 set_fs (old_fs);
85932
85933 if (ret > 0) {
85934 @@ -560,8 +561,8 @@ COMPAT_SYSCALL_DEFINE5(waitid,
85935 memset(&info, 0, sizeof(info));
85936
85937 set_fs(KERNEL_DS);
85938 - ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options,
85939 - uru ? (struct rusage __user *)&ru : NULL);
85940 + ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options,
85941 + uru ? (struct rusage __force_user *)&ru : NULL);
85942 set_fs(old_fs);
85943
85944 if ((ret < 0) || (info.si_signo == 0))
85945 @@ -695,8 +696,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
85946 oldfs = get_fs();
85947 set_fs(KERNEL_DS);
85948 err = sys_timer_settime(timer_id, flags,
85949 - (struct itimerspec __user *) &newts,
85950 - (struct itimerspec __user *) &oldts);
85951 + (struct itimerspec __force_user *) &newts,
85952 + (struct itimerspec __force_user *) &oldts);
85953 set_fs(oldfs);
85954 if (!err && old && put_compat_itimerspec(old, &oldts))
85955 return -EFAULT;
85956 @@ -713,7 +714,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
85957 oldfs = get_fs();
85958 set_fs(KERNEL_DS);
85959 err = sys_timer_gettime(timer_id,
85960 - (struct itimerspec __user *) &ts);
85961 + (struct itimerspec __force_user *) &ts);
85962 set_fs(oldfs);
85963 if (!err && put_compat_itimerspec(setting, &ts))
85964 return -EFAULT;
85965 @@ -732,7 +733,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
85966 oldfs = get_fs();
85967 set_fs(KERNEL_DS);
85968 err = sys_clock_settime(which_clock,
85969 - (struct timespec __user *) &ts);
85970 + (struct timespec __force_user *) &ts);
85971 set_fs(oldfs);
85972 return err;
85973 }
85974 @@ -747,7 +748,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
85975 oldfs = get_fs();
85976 set_fs(KERNEL_DS);
85977 err = sys_clock_gettime(which_clock,
85978 - (struct timespec __user *) &ts);
85979 + (struct timespec __force_user *) &ts);
85980 set_fs(oldfs);
85981 if (!err && put_compat_timespec(&ts, tp))
85982 return -EFAULT;
85983 @@ -767,7 +768,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
85984
85985 oldfs = get_fs();
85986 set_fs(KERNEL_DS);
85987 - ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc);
85988 + ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc);
85989 set_fs(oldfs);
85990
85991 err = compat_put_timex(utp, &txc);
85992 @@ -787,7 +788,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
85993 oldfs = get_fs();
85994 set_fs(KERNEL_DS);
85995 err = sys_clock_getres(which_clock,
85996 - (struct timespec __user *) &ts);
85997 + (struct timespec __force_user *) &ts);
85998 set_fs(oldfs);
85999 if (!err && tp && put_compat_timespec(&ts, tp))
86000 return -EFAULT;
86001 @@ -799,9 +800,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
86002 long err;
86003 mm_segment_t oldfs;
86004 struct timespec tu;
86005 - struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp;
86006 + struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp;
86007
86008 - restart->nanosleep.rmtp = (struct timespec __user *) &tu;
86009 + restart->nanosleep.rmtp = (struct timespec __force_user *) &tu;
86010 oldfs = get_fs();
86011 set_fs(KERNEL_DS);
86012 err = clock_nanosleep_restart(restart);
86013 @@ -833,8 +834,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
86014 oldfs = get_fs();
86015 set_fs(KERNEL_DS);
86016 err = sys_clock_nanosleep(which_clock, flags,
86017 - (struct timespec __user *) &in,
86018 - (struct timespec __user *) &out);
86019 + (struct timespec __force_user *) &in,
86020 + (struct timespec __force_user *) &out);
86021 set_fs(oldfs);
86022
86023 if ((err == -ERESTART_RESTARTBLOCK) && rmtp &&
86024 @@ -1128,7 +1129,7 @@ COMPAT_SYSCALL_DEFINE2(sched_rr_get_interval,
86025 mm_segment_t old_fs = get_fs();
86026
86027 set_fs(KERNEL_DS);
86028 - ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t);
86029 + ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t);
86030 set_fs(old_fs);
86031 if (put_compat_timespec(&t, interval))
86032 return -EFAULT;
86033 diff --git a/kernel/configs.c b/kernel/configs.c
86034 index c18b1f1..b9a0132 100644
86035 --- a/kernel/configs.c
86036 +++ b/kernel/configs.c
86037 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
86038 struct proc_dir_entry *entry;
86039
86040 /* create the current config file */
86041 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
86042 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
86043 + entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
86044 + &ikconfig_file_ops);
86045 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
86046 + entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
86047 + &ikconfig_file_ops);
86048 +#endif
86049 +#else
86050 entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
86051 &ikconfig_file_ops);
86052 +#endif
86053 +
86054 if (!entry)
86055 return -ENOMEM;
86056
86057 diff --git a/kernel/cred.c b/kernel/cred.c
86058 index e0573a4..20fb164 100644
86059 --- a/kernel/cred.c
86060 +++ b/kernel/cred.c
86061 @@ -164,6 +164,16 @@ void exit_creds(struct task_struct *tsk)
86062 validate_creds(cred);
86063 alter_cred_subscribers(cred, -1);
86064 put_cred(cred);
86065 +
86066 +#ifdef CONFIG_GRKERNSEC_SETXID
86067 + cred = (struct cred *) tsk->delayed_cred;
86068 + if (cred != NULL) {
86069 + tsk->delayed_cred = NULL;
86070 + validate_creds(cred);
86071 + alter_cred_subscribers(cred, -1);
86072 + put_cred(cred);
86073 + }
86074 +#endif
86075 }
86076
86077 /**
86078 @@ -411,7 +421,7 @@ static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
86079 * Always returns 0 thus allowing this function to be tail-called at the end
86080 * of, say, sys_setgid().
86081 */
86082 -int commit_creds(struct cred *new)
86083 +static int __commit_creds(struct cred *new)
86084 {
86085 struct task_struct *task = current;
86086 const struct cred *old = task->real_cred;
86087 @@ -430,6 +440,8 @@ int commit_creds(struct cred *new)
86088
86089 get_cred(new); /* we will require a ref for the subj creds too */
86090
86091 + gr_set_role_label(task, new->uid, new->gid);
86092 +
86093 /* dumpability changes */
86094 if (!uid_eq(old->euid, new->euid) ||
86095 !gid_eq(old->egid, new->egid) ||
86096 @@ -479,6 +491,108 @@ int commit_creds(struct cred *new)
86097 put_cred(old);
86098 return 0;
86099 }
86100 +#ifdef CONFIG_GRKERNSEC_SETXID
86101 +extern int set_user(struct cred *new);
86102 +
86103 +void gr_delayed_cred_worker(void)
86104 +{
86105 + const struct cred *new = current->delayed_cred;
86106 + struct cred *ncred;
86107 +
86108 + current->delayed_cred = NULL;
86109 +
86110 + if (!uid_eq(current_uid(), GLOBAL_ROOT_UID) && new != NULL) {
86111 + // from doing get_cred on it when queueing this
86112 + put_cred(new);
86113 + return;
86114 + } else if (new == NULL)
86115 + return;
86116 +
86117 + ncred = prepare_creds();
86118 + if (!ncred)
86119 + goto die;
86120 + // uids
86121 + ncred->uid = new->uid;
86122 + ncred->euid = new->euid;
86123 + ncred->suid = new->suid;
86124 + ncred->fsuid = new->fsuid;
86125 + // gids
86126 + ncred->gid = new->gid;
86127 + ncred->egid = new->egid;
86128 + ncred->sgid = new->sgid;
86129 + ncred->fsgid = new->fsgid;
86130 + // groups
86131 + if (set_groups(ncred, new->group_info) < 0) {
86132 + abort_creds(ncred);
86133 + goto die;
86134 + }
86135 + // caps
86136 + ncred->securebits = new->securebits;
86137 + ncred->cap_inheritable = new->cap_inheritable;
86138 + ncred->cap_permitted = new->cap_permitted;
86139 + ncred->cap_effective = new->cap_effective;
86140 + ncred->cap_bset = new->cap_bset;
86141 +
86142 + if (set_user(ncred)) {
86143 + abort_creds(ncred);
86144 + goto die;
86145 + }
86146 +
86147 + // from doing get_cred on it when queueing this
86148 + put_cred(new);
86149 +
86150 + __commit_creds(ncred);
86151 + return;
86152 +die:
86153 + // from doing get_cred on it when queueing this
86154 + put_cred(new);
86155 + do_group_exit(SIGKILL);
86156 +}
86157 +#endif
86158 +
86159 +int commit_creds(struct cred *new)
86160 +{
86161 +#ifdef CONFIG_GRKERNSEC_SETXID
86162 + int ret;
86163 + int schedule_it = 0;
86164 + struct task_struct *t;
86165 + unsigned oldsecurebits = current_cred()->securebits;
86166 +
86167 + /* we won't get called with tasklist_lock held for writing
86168 + and interrupts disabled as the cred struct in that case is
86169 + init_cred
86170 + */
86171 + if (grsec_enable_setxid && !current_is_single_threaded() &&
86172 + uid_eq(current_uid(), GLOBAL_ROOT_UID) &&
86173 + !uid_eq(new->uid, GLOBAL_ROOT_UID)) {
86174 + schedule_it = 1;
86175 + }
86176 + ret = __commit_creds(new);
86177 + if (schedule_it) {
86178 + rcu_read_lock();
86179 + read_lock(&tasklist_lock);
86180 + for (t = next_thread(current); t != current;
86181 + t = next_thread(t)) {
86182 + /* we'll check if the thread has uid 0 in
86183 + * the delayed worker routine
86184 + */
86185 + if (task_securebits(t) == oldsecurebits &&
86186 + t->delayed_cred == NULL) {
86187 + t->delayed_cred = get_cred(new);
86188 + set_tsk_thread_flag(t, TIF_GRSEC_SETXID);
86189 + set_tsk_need_resched(t);
86190 + }
86191 + }
86192 + read_unlock(&tasklist_lock);
86193 + rcu_read_unlock();
86194 + }
86195 +
86196 + return ret;
86197 +#else
86198 + return __commit_creds(new);
86199 +#endif
86200 +}
86201 +
86202 EXPORT_SYMBOL(commit_creds);
86203
86204 /**
86205 diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c
86206 index 334b398..9145fb1 100644
86207 --- a/kernel/debug/debug_core.c
86208 +++ b/kernel/debug/debug_core.c
86209 @@ -123,7 +123,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_lock);
86210 */
86211 static atomic_t masters_in_kgdb;
86212 static atomic_t slaves_in_kgdb;
86213 -static atomic_t kgdb_break_tasklet_var;
86214 +static atomic_unchecked_t kgdb_break_tasklet_var;
86215 atomic_t kgdb_setting_breakpoint;
86216
86217 struct task_struct *kgdb_usethread;
86218 @@ -133,7 +133,7 @@ int kgdb_single_step;
86219 static pid_t kgdb_sstep_pid;
86220
86221 /* to keep track of the CPU which is doing the single stepping*/
86222 -atomic_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
86223 +atomic_unchecked_t kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
86224
86225 /*
86226 * If you are debugging a problem where roundup (the collection of
86227 @@ -541,7 +541,7 @@ return_normal:
86228 * kernel will only try for the value of sstep_tries before
86229 * giving up and continuing on.
86230 */
86231 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
86232 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
86233 (kgdb_info[cpu].task &&
86234 kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
86235 atomic_set(&kgdb_active, -1);
86236 @@ -639,8 +639,8 @@ cpu_master_loop:
86237 }
86238
86239 kgdb_restore:
86240 - if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
86241 - int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
86242 + if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
86243 + int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
86244 if (kgdb_info[sstep_cpu].task)
86245 kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
86246 else
86247 @@ -917,18 +917,18 @@ static void kgdb_unregister_callbacks(void)
86248 static void kgdb_tasklet_bpt(unsigned long ing)
86249 {
86250 kgdb_breakpoint();
86251 - atomic_set(&kgdb_break_tasklet_var, 0);
86252 + atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
86253 }
86254
86255 static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
86256
86257 void kgdb_schedule_breakpoint(void)
86258 {
86259 - if (atomic_read(&kgdb_break_tasklet_var) ||
86260 + if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
86261 atomic_read(&kgdb_active) != -1 ||
86262 atomic_read(&kgdb_setting_breakpoint))
86263 return;
86264 - atomic_inc(&kgdb_break_tasklet_var);
86265 + atomic_inc_unchecked(&kgdb_break_tasklet_var);
86266 tasklet_schedule(&kgdb_tasklet_breakpoint);
86267 }
86268 EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
86269 diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
86270 index 0b097c8..11dd5c5 100644
86271 --- a/kernel/debug/kdb/kdb_main.c
86272 +++ b/kernel/debug/kdb/kdb_main.c
86273 @@ -1977,7 +1977,7 @@ static int kdb_lsmod(int argc, const char **argv)
86274 continue;
86275
86276 kdb_printf("%-20s%8u 0x%p ", mod->name,
86277 - mod->core_size, (void *)mod);
86278 + mod->core_size_rx + mod->core_size_rw, (void *)mod);
86279 #ifdef CONFIG_MODULE_UNLOAD
86280 kdb_printf("%4ld ", module_refcount(mod));
86281 #endif
86282 @@ -1987,7 +1987,7 @@ static int kdb_lsmod(int argc, const char **argv)
86283 kdb_printf(" (Loading)");
86284 else
86285 kdb_printf(" (Live)");
86286 - kdb_printf(" 0x%p", mod->module_core);
86287 + kdb_printf(" 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
86288
86289 #ifdef CONFIG_MODULE_UNLOAD
86290 {
86291 diff --git a/kernel/events/core.c b/kernel/events/core.c
86292 index fa0b2d4..67a1c7a 100644
86293 --- a/kernel/events/core.c
86294 +++ b/kernel/events/core.c
86295 @@ -158,8 +158,15 @@ static struct srcu_struct pmus_srcu;
86296 * 0 - disallow raw tracepoint access for unpriv
86297 * 1 - disallow cpu events for unpriv
86298 * 2 - disallow kernel profiling for unpriv
86299 + * 3 - disallow all unpriv perf event use
86300 */
86301 -int sysctl_perf_event_paranoid __read_mostly = 1;
86302 +#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
86303 +int sysctl_perf_event_legitimately_concerned __read_mostly = 3;
86304 +#elif defined(CONFIG_GRKERNSEC_HIDESYM)
86305 +int sysctl_perf_event_legitimately_concerned __read_mostly = 2;
86306 +#else
86307 +int sysctl_perf_event_legitimately_concerned __read_mostly = 1;
86308 +#endif
86309
86310 /* Minimum for 512 kiB + 1 user control page */
86311 int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
86312 @@ -185,7 +192,7 @@ void update_perf_cpu_limits(void)
86313
86314 tmp *= sysctl_perf_cpu_time_max_percent;
86315 do_div(tmp, 100);
86316 - ACCESS_ONCE(perf_sample_allowed_ns) = tmp;
86317 + ACCESS_ONCE_RW(perf_sample_allowed_ns) = tmp;
86318 }
86319
86320 static int perf_rotate_context(struct perf_cpu_context *cpuctx);
86321 @@ -272,7 +279,7 @@ void perf_sample_event_took(u64 sample_len_ns)
86322 update_perf_cpu_limits();
86323 }
86324
86325 -static atomic64_t perf_event_id;
86326 +static atomic64_unchecked_t perf_event_id;
86327
86328 static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
86329 enum event_type_t event_type);
86330 @@ -2986,7 +2993,7 @@ static void __perf_event_read(void *info)
86331
86332 static inline u64 perf_event_count(struct perf_event *event)
86333 {
86334 - return local64_read(&event->count) + atomic64_read(&event->child_count);
86335 + return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
86336 }
86337
86338 static u64 perf_event_read(struct perf_event *event)
86339 @@ -3354,9 +3361,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
86340 mutex_lock(&event->child_mutex);
86341 total += perf_event_read(event);
86342 *enabled += event->total_time_enabled +
86343 - atomic64_read(&event->child_total_time_enabled);
86344 + atomic64_read_unchecked(&event->child_total_time_enabled);
86345 *running += event->total_time_running +
86346 - atomic64_read(&event->child_total_time_running);
86347 + atomic64_read_unchecked(&event->child_total_time_running);
86348
86349 list_for_each_entry(child, &event->child_list, child_list) {
86350 total += perf_event_read(child);
86351 @@ -3785,10 +3792,10 @@ void perf_event_update_userpage(struct perf_event *event)
86352 userpg->offset -= local64_read(&event->hw.prev_count);
86353
86354 userpg->time_enabled = enabled +
86355 - atomic64_read(&event->child_total_time_enabled);
86356 + atomic64_read_unchecked(&event->child_total_time_enabled);
86357
86358 userpg->time_running = running +
86359 - atomic64_read(&event->child_total_time_running);
86360 + atomic64_read_unchecked(&event->child_total_time_running);
86361
86362 arch_perf_update_userpage(userpg, now);
86363
86364 @@ -4339,7 +4346,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
86365
86366 /* Data. */
86367 sp = perf_user_stack_pointer(regs);
86368 - rem = __output_copy_user(handle, (void *) sp, dump_size);
86369 + rem = __output_copy_user(handle, (void __user *) sp, dump_size);
86370 dyn_size = dump_size - rem;
86371
86372 perf_output_skip(handle, rem);
86373 @@ -4430,11 +4437,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
86374 values[n++] = perf_event_count(event);
86375 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
86376 values[n++] = enabled +
86377 - atomic64_read(&event->child_total_time_enabled);
86378 + atomic64_read_unchecked(&event->child_total_time_enabled);
86379 }
86380 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
86381 values[n++] = running +
86382 - atomic64_read(&event->child_total_time_running);
86383 + atomic64_read_unchecked(&event->child_total_time_running);
86384 }
86385 if (read_format & PERF_FORMAT_ID)
86386 values[n++] = primary_event_id(event);
86387 @@ -6704,7 +6711,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
86388 event->parent = parent_event;
86389
86390 event->ns = get_pid_ns(task_active_pid_ns(current));
86391 - event->id = atomic64_inc_return(&perf_event_id);
86392 + event->id = atomic64_inc_return_unchecked(&perf_event_id);
86393
86394 event->state = PERF_EVENT_STATE_INACTIVE;
86395
86396 @@ -7004,6 +7011,11 @@ SYSCALL_DEFINE5(perf_event_open,
86397 if (flags & ~PERF_FLAG_ALL)
86398 return -EINVAL;
86399
86400 +#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
86401 + if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
86402 + return -EACCES;
86403 +#endif
86404 +
86405 err = perf_copy_attr(attr_uptr, &attr);
86406 if (err)
86407 return err;
86408 @@ -7339,10 +7351,10 @@ static void sync_child_event(struct perf_event *child_event,
86409 /*
86410 * Add back the child's count to the parent's count:
86411 */
86412 - atomic64_add(child_val, &parent_event->child_count);
86413 - atomic64_add(child_event->total_time_enabled,
86414 + atomic64_add_unchecked(child_val, &parent_event->child_count);
86415 + atomic64_add_unchecked(child_event->total_time_enabled,
86416 &parent_event->child_total_time_enabled);
86417 - atomic64_add(child_event->total_time_running,
86418 + atomic64_add_unchecked(child_event->total_time_running,
86419 &parent_event->child_total_time_running);
86420
86421 /*
86422 diff --git a/kernel/events/internal.h b/kernel/events/internal.h
86423 index 569b2187..19940d9 100644
86424 --- a/kernel/events/internal.h
86425 +++ b/kernel/events/internal.h
86426 @@ -81,10 +81,10 @@ static inline unsigned long perf_data_size(struct ring_buffer *rb)
86427 return rb->nr_pages << (PAGE_SHIFT + page_order(rb));
86428 }
86429
86430 -#define DEFINE_OUTPUT_COPY(func_name, memcpy_func) \
86431 +#define DEFINE_OUTPUT_COPY(func_name, memcpy_func, user) \
86432 static inline unsigned long \
86433 func_name(struct perf_output_handle *handle, \
86434 - const void *buf, unsigned long len) \
86435 + const void user *buf, unsigned long len) \
86436 { \
86437 unsigned long size, written; \
86438 \
86439 @@ -117,7 +117,7 @@ memcpy_common(void *dst, const void *src, unsigned long n)
86440 return 0;
86441 }
86442
86443 -DEFINE_OUTPUT_COPY(__output_copy, memcpy_common)
86444 +DEFINE_OUTPUT_COPY(__output_copy, memcpy_common, )
86445
86446 static inline unsigned long
86447 memcpy_skip(void *dst, const void *src, unsigned long n)
86448 @@ -125,7 +125,7 @@ memcpy_skip(void *dst, const void *src, unsigned long n)
86449 return 0;
86450 }
86451
86452 -DEFINE_OUTPUT_COPY(__output_skip, memcpy_skip)
86453 +DEFINE_OUTPUT_COPY(__output_skip, memcpy_skip, )
86454
86455 #ifndef arch_perf_out_copy_user
86456 #define arch_perf_out_copy_user arch_perf_out_copy_user
86457 @@ -143,7 +143,7 @@ arch_perf_out_copy_user(void *dst, const void *src, unsigned long n)
86458 }
86459 #endif
86460
86461 -DEFINE_OUTPUT_COPY(__output_copy_user, arch_perf_out_copy_user)
86462 +DEFINE_OUTPUT_COPY(__output_copy_user, arch_perf_out_copy_user, __user)
86463
86464 /* Callchain handling */
86465 extern struct perf_callchain_entry *
86466 diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
86467 index 307d87c..6466cbe 100644
86468 --- a/kernel/events/uprobes.c
86469 +++ b/kernel/events/uprobes.c
86470 @@ -1666,7 +1666,7 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr)
86471 {
86472 struct page *page;
86473 uprobe_opcode_t opcode;
86474 - int result;
86475 + long result;
86476
86477 pagefault_disable();
86478 result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
86479 diff --git a/kernel/exit.c b/kernel/exit.c
86480 index 81b3d67..ef189a4 100644
86481 --- a/kernel/exit.c
86482 +++ b/kernel/exit.c
86483 @@ -173,6 +173,10 @@ void release_task(struct task_struct * p)
86484 struct task_struct *leader;
86485 int zap_leader;
86486 repeat:
86487 +#ifdef CONFIG_NET
86488 + gr_del_task_from_ip_table(p);
86489 +#endif
86490 +
86491 /* don't need to get the RCU readlock here - the process is dead and
86492 * can't be modifying its own credentials. But shut RCU-lockdep up */
86493 rcu_read_lock();
86494 @@ -330,7 +334,7 @@ int allow_signal(int sig)
86495 * know it'll be handled, so that they don't get converted to
86496 * SIGKILL or just silently dropped.
86497 */
86498 - current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
86499 + current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
86500 recalc_sigpending();
86501 spin_unlock_irq(&current->sighand->siglock);
86502 return 0;
86503 @@ -706,6 +710,8 @@ void do_exit(long code)
86504 struct task_struct *tsk = current;
86505 int group_dead;
86506
86507 + set_fs(USER_DS);
86508 +
86509 profile_task_exit(tsk);
86510
86511 WARN_ON(blk_needs_flush_plug(tsk));
86512 @@ -722,7 +728,6 @@ void do_exit(long code)
86513 * mm_release()->clear_child_tid() from writing to a user-controlled
86514 * kernel address.
86515 */
86516 - set_fs(USER_DS);
86517
86518 ptrace_event(PTRACE_EVENT_EXIT, code);
86519
86520 @@ -781,6 +786,9 @@ void do_exit(long code)
86521 tsk->exit_code = code;
86522 taskstats_exit(tsk, group_dead);
86523
86524 + gr_acl_handle_psacct(tsk, code);
86525 + gr_acl_handle_exit();
86526 +
86527 exit_mm(tsk);
86528
86529 if (group_dead)
86530 @@ -900,7 +908,7 @@ SYSCALL_DEFINE1(exit, int, error_code)
86531 * Take down every thread in the group. This is called by fatal signals
86532 * as well as by sys_exit_group (below).
86533 */
86534 -void
86535 +__noreturn void
86536 do_group_exit(int exit_code)
86537 {
86538 struct signal_struct *sig = current->signal;
86539 diff --git a/kernel/fork.c b/kernel/fork.c
86540 index a17621c..d9e4b37 100644
86541 --- a/kernel/fork.c
86542 +++ b/kernel/fork.c
86543 @@ -137,6 +137,18 @@ void __weak arch_release_thread_info(struct thread_info *ti)
86544 {
86545 }
86546
86547 +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
86548 +static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
86549 + int node)
86550 +{
86551 + return vmalloc_stack(node);
86552 +}
86553 +
86554 +static inline void free_thread_info(struct thread_info *ti)
86555 +{
86556 + vfree(ti);
86557 +}
86558 +#else
86559 #ifndef CONFIG_ARCH_THREAD_INFO_ALLOCATOR
86560
86561 /*
86562 @@ -179,6 +191,7 @@ void thread_info_cache_init(void)
86563 }
86564 # endif
86565 #endif
86566 +#endif
86567
86568 /* SLAB cache for signal_struct structures (tsk->signal) */
86569 static struct kmem_cache *signal_cachep;
86570 @@ -200,9 +213,11 @@ static struct kmem_cache *mm_cachep;
86571
86572 static void account_kernel_stack(struct thread_info *ti, int account)
86573 {
86574 +#ifndef CONFIG_GRKERNSEC_KSTACKOVERFLOW
86575 struct zone *zone = page_zone(virt_to_page(ti));
86576
86577 mod_zone_page_state(zone, NR_KERNEL_STACK, account);
86578 +#endif
86579 }
86580
86581 void free_task(struct task_struct *tsk)
86582 @@ -319,7 +334,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
86583 *stackend = STACK_END_MAGIC; /* for overflow detection */
86584
86585 #ifdef CONFIG_CC_STACKPROTECTOR
86586 - tsk->stack_canary = get_random_int();
86587 + tsk->stack_canary = pax_get_random_long();
86588 #endif
86589
86590 /*
86591 @@ -345,12 +360,80 @@ free_tsk:
86592 }
86593
86594 #ifdef CONFIG_MMU
86595 -static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
86596 +static struct vm_area_struct *dup_vma(struct mm_struct *mm, struct mm_struct *oldmm, struct vm_area_struct *mpnt)
86597 +{
86598 + struct vm_area_struct *tmp;
86599 + unsigned long charge;
86600 + struct file *file;
86601 + int retval;
86602 +
86603 + charge = 0;
86604 + if (mpnt->vm_flags & VM_ACCOUNT) {
86605 + unsigned long len = vma_pages(mpnt);
86606 +
86607 + if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
86608 + goto fail_nomem;
86609 + charge = len;
86610 + }
86611 + tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
86612 + if (!tmp)
86613 + goto fail_nomem;
86614 + *tmp = *mpnt;
86615 + tmp->vm_mm = mm;
86616 + INIT_LIST_HEAD(&tmp->anon_vma_chain);
86617 + retval = vma_dup_policy(mpnt, tmp);
86618 + if (retval)
86619 + goto fail_nomem_policy;
86620 + if (anon_vma_fork(tmp, mpnt))
86621 + goto fail_nomem_anon_vma_fork;
86622 + tmp->vm_flags &= ~VM_LOCKED;
86623 + tmp->vm_next = tmp->vm_prev = NULL;
86624 + tmp->vm_mirror = NULL;
86625 + file = tmp->vm_file;
86626 + if (file) {
86627 + struct inode *inode = file_inode(file);
86628 + struct address_space *mapping = file->f_mapping;
86629 +
86630 + get_file(file);
86631 + if (tmp->vm_flags & VM_DENYWRITE)
86632 + atomic_dec(&inode->i_writecount);
86633 + mutex_lock(&mapping->i_mmap_mutex);
86634 + if (tmp->vm_flags & VM_SHARED)
86635 + mapping->i_mmap_writable++;
86636 + flush_dcache_mmap_lock(mapping);
86637 + /* insert tmp into the share list, just after mpnt */
86638 + if (unlikely(tmp->vm_flags & VM_NONLINEAR))
86639 + vma_nonlinear_insert(tmp, &mapping->i_mmap_nonlinear);
86640 + else
86641 + vma_interval_tree_insert_after(tmp, mpnt, &mapping->i_mmap);
86642 + flush_dcache_mmap_unlock(mapping);
86643 + mutex_unlock(&mapping->i_mmap_mutex);
86644 + }
86645 +
86646 + /*
86647 + * Clear hugetlb-related page reserves for children. This only
86648 + * affects MAP_PRIVATE mappings. Faults generated by the child
86649 + * are not guaranteed to succeed, even if read-only
86650 + */
86651 + if (is_vm_hugetlb_page(tmp))
86652 + reset_vma_resv_huge_pages(tmp);
86653 +
86654 + return tmp;
86655 +
86656 +fail_nomem_anon_vma_fork:
86657 + mpol_put(vma_policy(tmp));
86658 +fail_nomem_policy:
86659 + kmem_cache_free(vm_area_cachep, tmp);
86660 +fail_nomem:
86661 + vm_unacct_memory(charge);
86662 + return NULL;
86663 +}
86664 +
86665 +static __latent_entropy int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
86666 {
86667 struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
86668 struct rb_node **rb_link, *rb_parent;
86669 int retval;
86670 - unsigned long charge;
86671
86672 uprobe_start_dup_mmap();
86673 down_write(&oldmm->mmap_sem);
86674 @@ -379,55 +462,15 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
86675
86676 prev = NULL;
86677 for (mpnt = oldmm->mmap; mpnt; mpnt = mpnt->vm_next) {
86678 - struct file *file;
86679 -
86680 if (mpnt->vm_flags & VM_DONTCOPY) {
86681 vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file,
86682 -vma_pages(mpnt));
86683 continue;
86684 }
86685 - charge = 0;
86686 - if (mpnt->vm_flags & VM_ACCOUNT) {
86687 - unsigned long len = vma_pages(mpnt);
86688 -
86689 - if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
86690 - goto fail_nomem;
86691 - charge = len;
86692 - }
86693 - tmp = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
86694 - if (!tmp)
86695 - goto fail_nomem;
86696 - *tmp = *mpnt;
86697 - INIT_LIST_HEAD(&tmp->anon_vma_chain);
86698 - retval = vma_dup_policy(mpnt, tmp);
86699 - if (retval)
86700 - goto fail_nomem_policy;
86701 - tmp->vm_mm = mm;
86702 - if (anon_vma_fork(tmp, mpnt))
86703 - goto fail_nomem_anon_vma_fork;
86704 - tmp->vm_flags &= ~VM_LOCKED;
86705 - tmp->vm_next = tmp->vm_prev = NULL;
86706 - file = tmp->vm_file;
86707 - if (file) {
86708 - struct inode *inode = file_inode(file);
86709 - struct address_space *mapping = file->f_mapping;
86710 -
86711 - get_file(file);
86712 - if (tmp->vm_flags & VM_DENYWRITE)
86713 - atomic_dec(&inode->i_writecount);
86714 - mutex_lock(&mapping->i_mmap_mutex);
86715 - if (tmp->vm_flags & VM_SHARED)
86716 - mapping->i_mmap_writable++;
86717 - flush_dcache_mmap_lock(mapping);
86718 - /* insert tmp into the share list, just after mpnt */
86719 - if (unlikely(tmp->vm_flags & VM_NONLINEAR))
86720 - vma_nonlinear_insert(tmp,
86721 - &mapping->i_mmap_nonlinear);
86722 - else
86723 - vma_interval_tree_insert_after(tmp, mpnt,
86724 - &mapping->i_mmap);
86725 - flush_dcache_mmap_unlock(mapping);
86726 - mutex_unlock(&mapping->i_mmap_mutex);
86727 + tmp = dup_vma(mm, oldmm, mpnt);
86728 + if (!tmp) {
86729 + retval = -ENOMEM;
86730 + goto out;
86731 }
86732
86733 /*
86734 @@ -459,6 +502,31 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
86735 if (retval)
86736 goto out;
86737 }
86738 +
86739 +#ifdef CONFIG_PAX_SEGMEXEC
86740 + if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
86741 + struct vm_area_struct *mpnt_m;
86742 +
86743 + for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
86744 + BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
86745 +
86746 + if (!mpnt->vm_mirror)
86747 + continue;
86748 +
86749 + if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
86750 + BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
86751 + mpnt->vm_mirror = mpnt_m;
86752 + } else {
86753 + BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
86754 + mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
86755 + mpnt_m->vm_mirror->vm_mirror = mpnt_m;
86756 + mpnt->vm_mirror->vm_mirror = mpnt;
86757 + }
86758 + }
86759 + BUG_ON(mpnt_m);
86760 + }
86761 +#endif
86762 +
86763 /* a new mm has just been created */
86764 arch_dup_mmap(oldmm, mm);
86765 retval = 0;
86766 @@ -468,14 +536,6 @@ out:
86767 up_write(&oldmm->mmap_sem);
86768 uprobe_end_dup_mmap();
86769 return retval;
86770 -fail_nomem_anon_vma_fork:
86771 - mpol_put(vma_policy(tmp));
86772 -fail_nomem_policy:
86773 - kmem_cache_free(vm_area_cachep, tmp);
86774 -fail_nomem:
86775 - retval = -ENOMEM;
86776 - vm_unacct_memory(charge);
86777 - goto out;
86778 }
86779
86780 static inline int mm_alloc_pgd(struct mm_struct *mm)
86781 @@ -689,8 +749,8 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
86782 return ERR_PTR(err);
86783
86784 mm = get_task_mm(task);
86785 - if (mm && mm != current->mm &&
86786 - !ptrace_may_access(task, mode)) {
86787 + if (mm && ((mm != current->mm && !ptrace_may_access(task, mode)) ||
86788 + (mode == PTRACE_MODE_ATTACH && (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))))) {
86789 mmput(mm);
86790 mm = ERR_PTR(-EACCES);
86791 }
86792 @@ -906,13 +966,20 @@ static int copy_fs(unsigned long clone_flags, struct task_struct *tsk)
86793 spin_unlock(&fs->lock);
86794 return -EAGAIN;
86795 }
86796 - fs->users++;
86797 + atomic_inc(&fs->users);
86798 spin_unlock(&fs->lock);
86799 return 0;
86800 }
86801 tsk->fs = copy_fs_struct(fs);
86802 if (!tsk->fs)
86803 return -ENOMEM;
86804 + /* Carry through gr_chroot_dentry and is_chrooted instead
86805 + of recomputing it here. Already copied when the task struct
86806 + is duplicated. This allows pivot_root to not be treated as
86807 + a chroot
86808 + */
86809 + //gr_set_chroot_entries(tsk, &tsk->fs->root);
86810 +
86811 return 0;
86812 }
86813
86814 @@ -1130,7 +1197,7 @@ init_task_pid(struct task_struct *task, enum pid_type type, struct pid *pid)
86815 * parts of the process environment (as per the clone
86816 * flags). The actual kick-off is left to the caller.
86817 */
86818 -static struct task_struct *copy_process(unsigned long clone_flags,
86819 +static __latent_entropy struct task_struct *copy_process(unsigned long clone_flags,
86820 unsigned long stack_start,
86821 unsigned long stack_size,
86822 int __user *child_tidptr,
86823 @@ -1202,6 +1269,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
86824 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
86825 #endif
86826 retval = -EAGAIN;
86827 +
86828 + gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
86829 +
86830 if (atomic_read(&p->real_cred->user->processes) >=
86831 task_rlimit(p, RLIMIT_NPROC)) {
86832 if (p->real_cred->user != INIT_USER &&
86833 @@ -1449,6 +1519,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
86834 goto bad_fork_free_pid;
86835 }
86836
86837 + /* synchronizes with gr_set_acls()
86838 + we need to call this past the point of no return for fork()
86839 + */
86840 + gr_copy_label(p);
86841 +
86842 if (likely(p->pid)) {
86843 ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
86844
86845 @@ -1537,6 +1612,8 @@ bad_fork_cleanup_count:
86846 bad_fork_free:
86847 free_task(p);
86848 fork_out:
86849 + gr_log_forkfail(retval);
86850 +
86851 return ERR_PTR(retval);
86852 }
86853
86854 @@ -1598,6 +1675,7 @@ long do_fork(unsigned long clone_flags,
86855
86856 p = copy_process(clone_flags, stack_start, stack_size,
86857 child_tidptr, NULL, trace);
86858 + add_latent_entropy();
86859 /*
86860 * Do this prior waking up the new thread - the thread pointer
86861 * might get invalid after that point, if the thread exits quickly.
86862 @@ -1612,6 +1690,8 @@ long do_fork(unsigned long clone_flags,
86863 if (clone_flags & CLONE_PARENT_SETTID)
86864 put_user(nr, parent_tidptr);
86865
86866 + gr_handle_brute_check();
86867 +
86868 if (clone_flags & CLONE_VFORK) {
86869 p->vfork_done = &vfork;
86870 init_completion(&vfork);
86871 @@ -1728,7 +1808,7 @@ void __init proc_caches_init(void)
86872 mm_cachep = kmem_cache_create("mm_struct",
86873 sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
86874 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
86875 - vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC);
86876 + vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC | SLAB_NO_SANITIZE);
86877 mmap_init();
86878 nsproxy_cache_init();
86879 }
86880 @@ -1768,7 +1848,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
86881 return 0;
86882
86883 /* don't need lock here; in the worst case we'll do useless copy */
86884 - if (fs->users == 1)
86885 + if (atomic_read(&fs->users) == 1)
86886 return 0;
86887
86888 *new_fsp = copy_fs_struct(fs);
86889 @@ -1875,7 +1955,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
86890 fs = current->fs;
86891 spin_lock(&fs->lock);
86892 current->fs = new_fs;
86893 - if (--fs->users)
86894 + gr_set_chroot_entries(current, &current->fs->root);
86895 + if (atomic_dec_return(&fs->users))
86896 new_fs = NULL;
86897 else
86898 new_fs = fs;
86899 diff --git a/kernel/futex.c b/kernel/futex.c
86900 index 6801b37..c0f67cf 100644
86901 --- a/kernel/futex.c
86902 +++ b/kernel/futex.c
86903 @@ -54,6 +54,7 @@
86904 #include <linux/mount.h>
86905 #include <linux/pagemap.h>
86906 #include <linux/syscalls.h>
86907 +#include <linux/ptrace.h>
86908 #include <linux/signal.h>
86909 #include <linux/export.h>
86910 #include <linux/magic.h>
86911 @@ -188,7 +189,7 @@ struct futex_pi_state {
86912 atomic_t refcount;
86913
86914 union futex_key key;
86915 -};
86916 +} __randomize_layout;
86917
86918 /**
86919 * struct futex_q - The hashed futex queue entry, one per waiting task
86920 @@ -222,7 +223,7 @@ struct futex_q {
86921 struct rt_mutex_waiter *rt_waiter;
86922 union futex_key *requeue_pi_key;
86923 u32 bitset;
86924 -};
86925 +} __randomize_layout;
86926
86927 static const struct futex_q futex_q_init = {
86928 /* list gets initialized in queue_me()*/
86929 @@ -380,6 +381,11 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
86930 struct page *page, *page_head;
86931 int err, ro = 0;
86932
86933 +#ifdef CONFIG_PAX_SEGMEXEC
86934 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
86935 + return -EFAULT;
86936 +#endif
86937 +
86938 /*
86939 * The futex address must be "naturally" aligned.
86940 */
86941 @@ -579,7 +585,7 @@ static int cmpxchg_futex_value_locked(u32 *curval, u32 __user *uaddr,
86942
86943 static int get_futex_value_locked(u32 *dest, u32 __user *from)
86944 {
86945 - int ret;
86946 + unsigned long ret;
86947
86948 pagefault_disable();
86949 ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
86950 @@ -729,6 +735,55 @@ void exit_pi_state_list(struct task_struct *curr)
86951 raw_spin_unlock_irq(&curr->pi_lock);
86952 }
86953
86954 +/*
86955 + * We need to check the following states:
86956 + *
86957 + * Waiter | pi_state | pi->owner | uTID | uODIED | ?
86958 + *
86959 + * [1] NULL | --- | --- | 0 | 0/1 | Valid
86960 + * [2] NULL | --- | --- | >0 | 0/1 | Valid
86961 + *
86962 + * [3] Found | NULL | -- | Any | 0/1 | Invalid
86963 + *
86964 + * [4] Found | Found | NULL | 0 | 1 | Valid
86965 + * [5] Found | Found | NULL | >0 | 1 | Invalid
86966 + *
86967 + * [6] Found | Found | task | 0 | 1 | Valid
86968 + *
86969 + * [7] Found | Found | NULL | Any | 0 | Invalid
86970 + *
86971 + * [8] Found | Found | task | ==taskTID | 0/1 | Valid
86972 + * [9] Found | Found | task | 0 | 0 | Invalid
86973 + * [10] Found | Found | task | !=taskTID | 0/1 | Invalid
86974 + *
86975 + * [1] Indicates that the kernel can acquire the futex atomically. We
86976 + * came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
86977 + *
86978 + * [2] Valid, if TID does not belong to a kernel thread. If no matching
86979 + * thread is found then it indicates that the owner TID has died.
86980 + *
86981 + * [3] Invalid. The waiter is queued on a non PI futex
86982 + *
86983 + * [4] Valid state after exit_robust_list(), which sets the user space
86984 + * value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
86985 + *
86986 + * [5] The user space value got manipulated between exit_robust_list()
86987 + * and exit_pi_state_list()
86988 + *
86989 + * [6] Valid state after exit_pi_state_list() which sets the new owner in
86990 + * the pi_state but cannot access the user space value.
86991 + *
86992 + * [7] pi_state->owner can only be NULL when the OWNER_DIED bit is set.
86993 + *
86994 + * [8] Owner and user space value match
86995 + *
86996 + * [9] There is no transient state which sets the user space TID to 0
86997 + * except exit_robust_list(), but this is indicated by the
86998 + * FUTEX_OWNER_DIED bit. See [4]
86999 + *
87000 + * [10] There is no transient state which leaves owner and user space
87001 + * TID out of sync.
87002 + */
87003 static int
87004 lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
87005 union futex_key *key, struct futex_pi_state **ps)
87006 @@ -741,12 +796,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
87007 plist_for_each_entry_safe(this, next, &hb->chain, list) {
87008 if (match_futex(&this->key, key)) {
87009 /*
87010 - * Another waiter already exists - bump up
87011 - * the refcount and return its pi_state:
87012 + * Sanity check the waiter before increasing
87013 + * the refcount and attaching to it.
87014 */
87015 pi_state = this->pi_state;
87016 /*
87017 - * Userspace might have messed up non-PI and PI futexes
87018 + * Userspace might have messed up non-PI and
87019 + * PI futexes [3]
87020 */
87021 if (unlikely(!pi_state))
87022 return -EINVAL;
87023 @@ -754,34 +810,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
87024 WARN_ON(!atomic_read(&pi_state->refcount));
87025
87026 /*
87027 - * When pi_state->owner is NULL then the owner died
87028 - * and another waiter is on the fly. pi_state->owner
87029 - * is fixed up by the task which acquires
87030 - * pi_state->rt_mutex.
87031 - *
87032 - * We do not check for pid == 0 which can happen when
87033 - * the owner died and robust_list_exit() cleared the
87034 - * TID.
87035 + * Handle the owner died case:
87036 */
87037 - if (pid && pi_state->owner) {
87038 + if (uval & FUTEX_OWNER_DIED) {
87039 /*
87040 - * Bail out if user space manipulated the
87041 - * futex value.
87042 + * exit_pi_state_list sets owner to NULL and
87043 + * wakes the topmost waiter. The task which
87044 + * acquires the pi_state->rt_mutex will fixup
87045 + * owner.
87046 */
87047 - if (pid != task_pid_vnr(pi_state->owner))
87048 + if (!pi_state->owner) {
87049 + /*
87050 + * No pi state owner, but the user
87051 + * space TID is not 0. Inconsistent
87052 + * state. [5]
87053 + */
87054 + if (pid)
87055 + return -EINVAL;
87056 + /*
87057 + * Take a ref on the state and
87058 + * return. [4]
87059 + */
87060 + goto out_state;
87061 + }
87062 +
87063 + /*
87064 + * If TID is 0, then either the dying owner
87065 + * has not yet executed exit_pi_state_list()
87066 + * or some waiter acquired the rtmutex in the
87067 + * pi state, but did not yet fixup the TID in
87068 + * user space.
87069 + *
87070 + * Take a ref on the state and return. [6]
87071 + */
87072 + if (!pid)
87073 + goto out_state;
87074 + } else {
87075 + /*
87076 + * If the owner died bit is not set,
87077 + * then the pi_state must have an
87078 + * owner. [7]
87079 + */
87080 + if (!pi_state->owner)
87081 return -EINVAL;
87082 }
87083
87084 + /*
87085 + * Bail out if user space manipulated the
87086 + * futex value. If pi state exists then the
87087 + * owner TID must be the same as the user
87088 + * space TID. [9/10]
87089 + */
87090 + if (pid != task_pid_vnr(pi_state->owner))
87091 + return -EINVAL;
87092 +
87093 + out_state:
87094 atomic_inc(&pi_state->refcount);
87095 *ps = pi_state;
87096 -
87097 return 0;
87098 }
87099 }
87100
87101 /*
87102 * We are the first waiter - try to look up the real owner and attach
87103 - * the new pi_state to it, but bail out when TID = 0
87104 + * the new pi_state to it, but bail out when TID = 0 [1]
87105 */
87106 if (!pid)
87107 return -ESRCH;
87108 @@ -789,6 +881,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
87109 if (!p)
87110 return -ESRCH;
87111
87112 + if (!p->mm) {
87113 + put_task_struct(p);
87114 + return -EPERM;
87115 + }
87116 +
87117 /*
87118 * We need to look at the task state flags to figure out,
87119 * whether the task is exiting. To protect against the do_exit
87120 @@ -809,6 +906,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
87121 return ret;
87122 }
87123
87124 + /*
87125 + * No existing pi state. First waiter. [2]
87126 + */
87127 pi_state = alloc_pi_state();
87128
87129 /*
87130 @@ -880,10 +980,18 @@ retry:
87131 return -EDEADLK;
87132
87133 /*
87134 - * Surprise - we got the lock. Just return to userspace:
87135 + * Surprise - we got the lock, but we do not trust user space at all.
87136 */
87137 - if (unlikely(!curval))
87138 - return 1;
87139 + if (unlikely(!curval)) {
87140 + /*
87141 + * We verify whether there is kernel state for this
87142 + * futex. If not, we can safely assume, that the 0 ->
87143 + * TID transition is correct. If state exists, we do
87144 + * not bother to fixup the user space state as it was
87145 + * corrupted already.
87146 + */
87147 + return futex_top_waiter(hb, key) ? -EINVAL : 1;
87148 + }
87149
87150 uval = curval;
87151
87152 @@ -1014,6 +1122,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
87153 struct task_struct *new_owner;
87154 struct futex_pi_state *pi_state = this->pi_state;
87155 u32 uninitialized_var(curval), newval;
87156 + int ret = 0;
87157
87158 if (!pi_state)
87159 return -EINVAL;
87160 @@ -1037,23 +1146,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
87161 new_owner = this->task;
87162
87163 /*
87164 - * We pass it to the next owner. (The WAITERS bit is always
87165 - * kept enabled while there is PI state around. We must also
87166 - * preserve the owner died bit.)
87167 + * We pass it to the next owner. The WAITERS bit is always
87168 + * kept enabled while there is PI state around. We cleanup the
87169 + * owner died bit, because we are the owner.
87170 */
87171 - if (!(uval & FUTEX_OWNER_DIED)) {
87172 - int ret = 0;
87173 + newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
87174
87175 - newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
87176 -
87177 - if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
87178 - ret = -EFAULT;
87179 - else if (curval != uval)
87180 - ret = -EINVAL;
87181 - if (ret) {
87182 - raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
87183 - return ret;
87184 - }
87185 + if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
87186 + ret = -EFAULT;
87187 + else if (curval != uval)
87188 + ret = -EINVAL;
87189 + if (ret) {
87190 + raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
87191 + return ret;
87192 }
87193
87194 raw_spin_lock_irq(&pi_state->owner->pi_lock);
87195 @@ -1411,6 +1516,13 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
87196
87197 if (requeue_pi) {
87198 /*
87199 + * Requeue PI only works on two distinct uaddrs. This
87200 + * check is only valid for private futexes. See below.
87201 + */
87202 + if (uaddr1 == uaddr2)
87203 + return -EINVAL;
87204 +
87205 + /*
87206 * requeue_pi requires a pi_state, try to allocate it now
87207 * without any locks in case it fails.
87208 */
87209 @@ -1448,6 +1560,15 @@ retry:
87210 if (unlikely(ret != 0))
87211 goto out_put_key1;
87212
87213 + /*
87214 + * The check above which compares uaddrs is not sufficient for
87215 + * shared futexes. We need to compare the keys:
87216 + */
87217 + if (requeue_pi && match_futex(&key1, &key2)) {
87218 + ret = -EINVAL;
87219 + goto out_put_keys;
87220 + }
87221 +
87222 hb1 = hash_futex(&key1);
87223 hb2 = hash_futex(&key2);
87224
87225 @@ -2287,9 +2408,10 @@ retry:
87226 /*
87227 * To avoid races, try to do the TID -> 0 atomic transition
87228 * again. If it succeeds then we can return without waking
87229 - * anyone else up:
87230 + * anyone else up. We only try this if neither the waiters nor
87231 + * the owner died bit are set.
87232 */
87233 - if (!(uval & FUTEX_OWNER_DIED) &&
87234 + if (!(uval & ~FUTEX_TID_MASK) &&
87235 cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
87236 goto pi_faulted;
87237 /*
87238 @@ -2319,11 +2441,9 @@ retry:
87239 /*
87240 * No waiters - kernel unlocks the futex:
87241 */
87242 - if (!(uval & FUTEX_OWNER_DIED)) {
87243 - ret = unlock_futex_pi(uaddr, uval);
87244 - if (ret == -EFAULT)
87245 - goto pi_faulted;
87246 - }
87247 + ret = unlock_futex_pi(uaddr, uval);
87248 + if (ret == -EFAULT)
87249 + goto pi_faulted;
87250
87251 out_unlock:
87252 spin_unlock(&hb->lock);
87253 @@ -2485,6 +2605,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
87254 if (ret)
87255 goto out_key2;
87256
87257 + /*
87258 + * The check above which compares uaddrs is not sufficient for
87259 + * shared futexes. We need to compare the keys:
87260 + */
87261 + if (match_futex(&q.key, &key2)) {
87262 + ret = -EINVAL;
87263 + goto out_put_keys;
87264 + }
87265 +
87266 /* Queue the futex_q, drop the hb lock, wait for wakeup. */
87267 futex_wait_queue_me(hb, &q, to);
87268
87269 @@ -2886,6 +3015,7 @@ static void __init futex_detect_cmpxchg(void)
87270 {
87271 #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
87272 u32 curval;
87273 + mm_segment_t oldfs;
87274
87275 /*
87276 * This will fail and we want it. Some arch implementations do
87277 @@ -2897,8 +3027,11 @@ static void __init futex_detect_cmpxchg(void)
87278 * implementation, the non-functional ones will return
87279 * -ENOSYS.
87280 */
87281 + oldfs = get_fs();
87282 + set_fs(USER_DS);
87283 if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
87284 futex_cmpxchg_enabled = 1;
87285 + set_fs(oldfs);
87286 #endif
87287 }
87288
87289 diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
87290 index f9f44fd..29885e4 100644
87291 --- a/kernel/futex_compat.c
87292 +++ b/kernel/futex_compat.c
87293 @@ -32,7 +32,7 @@ fetch_robust_entry(compat_uptr_t *uentry, struct robust_list __user **entry,
87294 return 0;
87295 }
87296
87297 -static void __user *futex_uaddr(struct robust_list __user *entry,
87298 +static void __user __intentional_overflow(-1) *futex_uaddr(struct robust_list __user *entry,
87299 compat_long_t futex_offset)
87300 {
87301 compat_uptr_t base = ptr_to_compat(entry);
87302 diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c
87303 index f45b75b..bfac6d5 100644
87304 --- a/kernel/gcov/base.c
87305 +++ b/kernel/gcov/base.c
87306 @@ -108,11 +108,6 @@ void gcov_enable_events(void)
87307 }
87308
87309 #ifdef CONFIG_MODULES
87310 -static inline int within(void *addr, void *start, unsigned long size)
87311 -{
87312 - return ((addr >= start) && (addr < start + size));
87313 -}
87314 -
87315 /* Update list and generate events when modules are unloaded. */
87316 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
87317 void *data)
87318 @@ -127,7 +122,7 @@ static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
87319
87320 /* Remove entries located in module from linked list. */
87321 while ((info = gcov_info_next(info))) {
87322 - if (within(info, mod->module_core, mod->core_size)) {
87323 + if (within_module_core_rw((unsigned long)info, mod)) {
87324 gcov_info_unlink(prev, info);
87325 if (gcov_events_enabled)
87326 gcov_event(GCOV_REMOVE, info);
87327 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
87328 index 0909436..6037d22 100644
87329 --- a/kernel/hrtimer.c
87330 +++ b/kernel/hrtimer.c
87331 @@ -1439,7 +1439,7 @@ void hrtimer_peek_ahead_timers(void)
87332 local_irq_restore(flags);
87333 }
87334
87335 -static void run_hrtimer_softirq(struct softirq_action *h)
87336 +static __latent_entropy void run_hrtimer_softirq(void)
87337 {
87338 hrtimer_peek_ahead_timers();
87339 }
87340 diff --git a/kernel/irq_work.c b/kernel/irq_work.c
87341 index 55fcce6..0e4cf34 100644
87342 --- a/kernel/irq_work.c
87343 +++ b/kernel/irq_work.c
87344 @@ -189,12 +189,13 @@ static int irq_work_cpu_notify(struct notifier_block *self,
87345 return NOTIFY_OK;
87346 }
87347
87348 -static struct notifier_block cpu_notify;
87349 +static struct notifier_block cpu_notify = {
87350 + .notifier_call = irq_work_cpu_notify,
87351 + .priority = 0,
87352 +};
87353
87354 static __init int irq_work_init_cpu_notifier(void)
87355 {
87356 - cpu_notify.notifier_call = irq_work_cpu_notify;
87357 - cpu_notify.priority = 0;
87358 register_cpu_notifier(&cpu_notify);
87359 return 0;
87360 }
87361 diff --git a/kernel/jump_label.c b/kernel/jump_label.c
87362 index 9019f15..9a3c42e 100644
87363 --- a/kernel/jump_label.c
87364 +++ b/kernel/jump_label.c
87365 @@ -14,6 +14,7 @@
87366 #include <linux/err.h>
87367 #include <linux/static_key.h>
87368 #include <linux/jump_label_ratelimit.h>
87369 +#include <linux/mm.h>
87370
87371 #ifdef HAVE_JUMP_LABEL
87372
87373 @@ -51,7 +52,9 @@ jump_label_sort_entries(struct jump_entry *start, struct jump_entry *stop)
87374
87375 size = (((unsigned long)stop - (unsigned long)start)
87376 / sizeof(struct jump_entry));
87377 + pax_open_kernel();
87378 sort(start, size, sizeof(struct jump_entry), jump_label_cmp, NULL);
87379 + pax_close_kernel();
87380 }
87381
87382 static void jump_label_update(struct static_key *key, int enable);
87383 @@ -363,10 +366,12 @@ static void jump_label_invalidate_module_init(struct module *mod)
87384 struct jump_entry *iter_stop = iter_start + mod->num_jump_entries;
87385 struct jump_entry *iter;
87386
87387 + pax_open_kernel();
87388 for (iter = iter_start; iter < iter_stop; iter++) {
87389 if (within_module_init(iter->code, mod))
87390 iter->code = 0;
87391 }
87392 + pax_close_kernel();
87393 }
87394
87395 static int
87396 diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
87397 index 3127ad5..159d880 100644
87398 --- a/kernel/kallsyms.c
87399 +++ b/kernel/kallsyms.c
87400 @@ -11,6 +11,9 @@
87401 * Changed the compression method from stem compression to "table lookup"
87402 * compression (see scripts/kallsyms.c for a more complete description)
87403 */
87404 +#ifdef CONFIG_GRKERNSEC_HIDESYM
87405 +#define __INCLUDED_BY_HIDESYM 1
87406 +#endif
87407 #include <linux/kallsyms.h>
87408 #include <linux/module.h>
87409 #include <linux/init.h>
87410 @@ -53,12 +56,33 @@ extern const unsigned long kallsyms_markers[] __attribute__((weak));
87411
87412 static inline int is_kernel_inittext(unsigned long addr)
87413 {
87414 + if (system_state != SYSTEM_BOOTING)
87415 + return 0;
87416 +
87417 if (addr >= (unsigned long)_sinittext
87418 && addr <= (unsigned long)_einittext)
87419 return 1;
87420 return 0;
87421 }
87422
87423 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
87424 +#ifdef CONFIG_MODULES
87425 +static inline int is_module_text(unsigned long addr)
87426 +{
87427 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
87428 + return 1;
87429 +
87430 + addr = ktla_ktva(addr);
87431 + return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
87432 +}
87433 +#else
87434 +static inline int is_module_text(unsigned long addr)
87435 +{
87436 + return 0;
87437 +}
87438 +#endif
87439 +#endif
87440 +
87441 static inline int is_kernel_text(unsigned long addr)
87442 {
87443 if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
87444 @@ -69,13 +93,28 @@ static inline int is_kernel_text(unsigned long addr)
87445
87446 static inline int is_kernel(unsigned long addr)
87447 {
87448 +
87449 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
87450 + if (is_kernel_text(addr) || is_kernel_inittext(addr))
87451 + return 1;
87452 +
87453 + if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
87454 +#else
87455 if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
87456 +#endif
87457 +
87458 return 1;
87459 return in_gate_area_no_mm(addr);
87460 }
87461
87462 static int is_ksym_addr(unsigned long addr)
87463 {
87464 +
87465 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
87466 + if (is_module_text(addr))
87467 + return 0;
87468 +#endif
87469 +
87470 if (all_var)
87471 return is_kernel(addr);
87472
87473 @@ -480,7 +519,6 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
87474
87475 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
87476 {
87477 - iter->name[0] = '\0';
87478 iter->nameoff = get_symbol_offset(new_pos);
87479 iter->pos = new_pos;
87480 }
87481 @@ -528,6 +566,11 @@ static int s_show(struct seq_file *m, void *p)
87482 {
87483 struct kallsym_iter *iter = m->private;
87484
87485 +#ifdef CONFIG_GRKERNSEC_HIDESYM
87486 + if (!uid_eq(current_uid(), GLOBAL_ROOT_UID))
87487 + return 0;
87488 +#endif
87489 +
87490 /* Some debugging symbols have no name. Ignore them. */
87491 if (!iter->name[0])
87492 return 0;
87493 @@ -541,6 +584,7 @@ static int s_show(struct seq_file *m, void *p)
87494 */
87495 type = iter->exported ? toupper(iter->type) :
87496 tolower(iter->type);
87497 +
87498 seq_printf(m, "%pK %c %s\t[%s]\n", (void *)iter->value,
87499 type, iter->name, iter->module_name);
87500 } else
87501 @@ -566,7 +610,7 @@ static int kallsyms_open(struct inode *inode, struct file *file)
87502 struct kallsym_iter *iter;
87503 int ret;
87504
87505 - iter = kmalloc(sizeof(*iter), GFP_KERNEL);
87506 + iter = kzalloc(sizeof(*iter), GFP_KERNEL);
87507 if (!iter)
87508 return -ENOMEM;
87509 reset_iter(iter, 0);
87510 diff --git a/kernel/kcmp.c b/kernel/kcmp.c
87511 index e30ac0f..3528cac 100644
87512 --- a/kernel/kcmp.c
87513 +++ b/kernel/kcmp.c
87514 @@ -99,6 +99,10 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
87515 struct task_struct *task1, *task2;
87516 int ret;
87517
87518 +#ifdef CONFIG_GRKERNSEC
87519 + return -ENOSYS;
87520 +#endif
87521 +
87522 rcu_read_lock();
87523
87524 /*
87525 diff --git a/kernel/kexec.c b/kernel/kexec.c
87526 index 60bafbe..a120f4f 100644
87527 --- a/kernel/kexec.c
87528 +++ b/kernel/kexec.c
87529 @@ -1045,7 +1045,8 @@ asmlinkage long compat_sys_kexec_load(unsigned long entry,
87530 unsigned long flags)
87531 {
87532 struct compat_kexec_segment in;
87533 - struct kexec_segment out, __user *ksegments;
87534 + struct kexec_segment out;
87535 + struct kexec_segment __user *ksegments;
87536 unsigned long i, result;
87537
87538 /* Don't allow clients that don't understand the native
87539 diff --git a/kernel/kmod.c b/kernel/kmod.c
87540 index 6b375af..eaff670 100644
87541 --- a/kernel/kmod.c
87542 +++ b/kernel/kmod.c
87543 @@ -75,7 +75,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
87544 kfree(info->argv);
87545 }
87546
87547 -static int call_modprobe(char *module_name, int wait)
87548 +static int call_modprobe(char *module_name, char *module_param, int wait)
87549 {
87550 struct subprocess_info *info;
87551 static char *envp[] = {
87552 @@ -85,7 +85,7 @@ static int call_modprobe(char *module_name, int wait)
87553 NULL
87554 };
87555
87556 - char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
87557 + char **argv = kmalloc(sizeof(char *[6]), GFP_KERNEL);
87558 if (!argv)
87559 goto out;
87560
87561 @@ -97,7 +97,8 @@ static int call_modprobe(char *module_name, int wait)
87562 argv[1] = "-q";
87563 argv[2] = "--";
87564 argv[3] = module_name; /* check free_modprobe_argv() */
87565 - argv[4] = NULL;
87566 + argv[4] = module_param;
87567 + argv[5] = NULL;
87568
87569 info = call_usermodehelper_setup(modprobe_path, argv, envp, GFP_KERNEL,
87570 NULL, free_modprobe_argv, NULL);
87571 @@ -129,9 +130,8 @@ out:
87572 * If module auto-loading support is disabled then this function
87573 * becomes a no-operation.
87574 */
87575 -int __request_module(bool wait, const char *fmt, ...)
87576 +static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
87577 {
87578 - va_list args;
87579 char module_name[MODULE_NAME_LEN];
87580 unsigned int max_modprobes;
87581 int ret;
87582 @@ -150,9 +150,7 @@ int __request_module(bool wait, const char *fmt, ...)
87583 if (!modprobe_path[0])
87584 return 0;
87585
87586 - va_start(args, fmt);
87587 - ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
87588 - va_end(args);
87589 + ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
87590 if (ret >= MODULE_NAME_LEN)
87591 return -ENAMETOOLONG;
87592
87593 @@ -160,6 +158,20 @@ int __request_module(bool wait, const char *fmt, ...)
87594 if (ret)
87595 return ret;
87596
87597 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
87598 + if (uid_eq(current_uid(), GLOBAL_ROOT_UID)) {
87599 + /* hack to workaround consolekit/udisks stupidity */
87600 + read_lock(&tasklist_lock);
87601 + if (!strcmp(current->comm, "mount") &&
87602 + current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
87603 + read_unlock(&tasklist_lock);
87604 + printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
87605 + return -EPERM;
87606 + }
87607 + read_unlock(&tasklist_lock);
87608 + }
87609 +#endif
87610 +
87611 /* If modprobe needs a service that is in a module, we get a recursive
87612 * loop. Limit the number of running kmod threads to max_threads/2 or
87613 * MAX_KMOD_CONCURRENT, whichever is the smaller. A cleaner method
87614 @@ -188,11 +200,52 @@ int __request_module(bool wait, const char *fmt, ...)
87615
87616 trace_module_request(module_name, wait, _RET_IP_);
87617
87618 - ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
87619 + ret = call_modprobe(module_name, module_param, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
87620
87621 atomic_dec(&kmod_concurrent);
87622 return ret;
87623 }
87624 +
87625 +int ___request_module(bool wait, char *module_param, const char *fmt, ...)
87626 +{
87627 + va_list args;
87628 + int ret;
87629 +
87630 + va_start(args, fmt);
87631 + ret = ____request_module(wait, module_param, fmt, args);
87632 + va_end(args);
87633 +
87634 + return ret;
87635 +}
87636 +
87637 +int __request_module(bool wait, const char *fmt, ...)
87638 +{
87639 + va_list args;
87640 + int ret;
87641 +
87642 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
87643 + if (!uid_eq(current_uid(), GLOBAL_ROOT_UID)) {
87644 + char module_param[MODULE_NAME_LEN];
87645 +
87646 + memset(module_param, 0, sizeof(module_param));
87647 +
87648 + snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", GR_GLOBAL_UID(current_uid()));
87649 +
87650 + va_start(args, fmt);
87651 + ret = ____request_module(wait, module_param, fmt, args);
87652 + va_end(args);
87653 +
87654 + return ret;
87655 + }
87656 +#endif
87657 +
87658 + va_start(args, fmt);
87659 + ret = ____request_module(wait, NULL, fmt, args);
87660 + va_end(args);
87661 +
87662 + return ret;
87663 +}
87664 +
87665 EXPORT_SYMBOL(__request_module);
87666 #endif /* CONFIG_MODULES */
87667
87668 @@ -218,6 +271,20 @@ static int ____call_usermodehelper(void *data)
87669 */
87670 set_user_nice(current, 0);
87671
87672 +#ifdef CONFIG_GRKERNSEC
87673 + /* this is race-free as far as userland is concerned as we copied
87674 + out the path to be used prior to this point and are now operating
87675 + on that copy
87676 + */
87677 + if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
87678 + strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
87679 + strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
87680 + printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
87681 + retval = -EPERM;
87682 + goto fail;
87683 + }
87684 +#endif
87685 +
87686 retval = -ENOMEM;
87687 new = prepare_kernel_cred(current);
87688 if (!new)
87689 @@ -240,8 +307,8 @@ static int ____call_usermodehelper(void *data)
87690 commit_creds(new);
87691
87692 retval = do_execve(getname_kernel(sub_info->path),
87693 - (const char __user *const __user *)sub_info->argv,
87694 - (const char __user *const __user *)sub_info->envp);
87695 + (const char __user *const __force_user *)sub_info->argv,
87696 + (const char __user *const __force_user *)sub_info->envp);
87697 if (!retval)
87698 return 0;
87699
87700 @@ -260,6 +327,10 @@ static int call_helper(void *data)
87701
87702 static void call_usermodehelper_freeinfo(struct subprocess_info *info)
87703 {
87704 +#ifdef CONFIG_GRKERNSEC
87705 + kfree(info->path);
87706 + info->path = info->origpath;
87707 +#endif
87708 if (info->cleanup)
87709 (*info->cleanup)(info);
87710 kfree(info);
87711 @@ -303,7 +374,7 @@ static int wait_for_helper(void *data)
87712 *
87713 * Thus the __user pointer cast is valid here.
87714 */
87715 - sys_wait4(pid, (int __user *)&ret, 0, NULL);
87716 + sys_wait4(pid, (int __force_user *)&ret, 0, NULL);
87717
87718 /*
87719 * If ret is 0, either ____call_usermodehelper failed and the
87720 @@ -542,7 +613,12 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
87721 goto out;
87722
87723 INIT_WORK(&sub_info->work, __call_usermodehelper);
87724 +#ifdef CONFIG_GRKERNSEC
87725 + sub_info->origpath = path;
87726 + sub_info->path = kstrdup(path, gfp_mask);
87727 +#else
87728 sub_info->path = path;
87729 +#endif
87730 sub_info->argv = argv;
87731 sub_info->envp = envp;
87732
87733 @@ -650,7 +726,7 @@ EXPORT_SYMBOL(call_usermodehelper);
87734 static int proc_cap_handler(struct ctl_table *table, int write,
87735 void __user *buffer, size_t *lenp, loff_t *ppos)
87736 {
87737 - struct ctl_table t;
87738 + ctl_table_no_const t;
87739 unsigned long cap_array[_KERNEL_CAPABILITY_U32S];
87740 kernel_cap_t new_cap;
87741 int err, i;
87742 diff --git a/kernel/kprobes.c b/kernel/kprobes.c
87743 index ceeadfc..11c18b6 100644
87744 --- a/kernel/kprobes.c
87745 +++ b/kernel/kprobes.c
87746 @@ -31,6 +31,9 @@
87747 * <jkenisto@us.ibm.com> and Prasanna S Panchamukhi
87748 * <prasanna@in.ibm.com> added function-return probes.
87749 */
87750 +#ifdef CONFIG_GRKERNSEC_HIDESYM
87751 +#define __INCLUDED_BY_HIDESYM 1
87752 +#endif
87753 #include <linux/kprobes.h>
87754 #include <linux/hash.h>
87755 #include <linux/init.h>
87756 @@ -135,12 +138,12 @@ enum kprobe_slot_state {
87757
87758 static void *alloc_insn_page(void)
87759 {
87760 - return module_alloc(PAGE_SIZE);
87761 + return module_alloc_exec(PAGE_SIZE);
87762 }
87763
87764 static void free_insn_page(void *page)
87765 {
87766 - module_free(NULL, page);
87767 + module_free_exec(NULL, page);
87768 }
87769
87770 struct kprobe_insn_cache kprobe_insn_slots = {
87771 @@ -2151,11 +2154,11 @@ static void __kprobes report_probe(struct seq_file *pi, struct kprobe *p,
87772 kprobe_type = "k";
87773
87774 if (sym)
87775 - seq_printf(pi, "%p %s %s+0x%x %s ",
87776 + seq_printf(pi, "%pK %s %s+0x%x %s ",
87777 p->addr, kprobe_type, sym, offset,
87778 (modname ? modname : " "));
87779 else
87780 - seq_printf(pi, "%p %s %p ",
87781 + seq_printf(pi, "%pK %s %pK ",
87782 p->addr, kprobe_type, p->addr);
87783
87784 if (!pp)
87785 diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c
87786 index d945a94..0b7f45f 100644
87787 --- a/kernel/ksysfs.c
87788 +++ b/kernel/ksysfs.c
87789 @@ -46,6 +46,8 @@ static ssize_t uevent_helper_store(struct kobject *kobj,
87790 {
87791 if (count+1 > UEVENT_HELPER_PATH_LEN)
87792 return -ENOENT;
87793 + if (!capable(CAP_SYS_ADMIN))
87794 + return -EPERM;
87795 memcpy(uevent_helper, buf, count);
87796 uevent_helper[count] = '\0';
87797 if (count && uevent_helper[count-1] == '\n')
87798 @@ -172,7 +174,7 @@ static ssize_t notes_read(struct file *filp, struct kobject *kobj,
87799 return count;
87800 }
87801
87802 -static struct bin_attribute notes_attr = {
87803 +static bin_attribute_no_const notes_attr __read_only = {
87804 .attr = {
87805 .name = "notes",
87806 .mode = S_IRUGO,
87807 diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
87808 index eb8a547..321d8e1 100644
87809 --- a/kernel/locking/lockdep.c
87810 +++ b/kernel/locking/lockdep.c
87811 @@ -597,6 +597,10 @@ static int static_obj(void *obj)
87812 end = (unsigned long) &_end,
87813 addr = (unsigned long) obj;
87814
87815 +#ifdef CONFIG_PAX_KERNEXEC
87816 + start = ktla_ktva(start);
87817 +#endif
87818 +
87819 /*
87820 * static variable?
87821 */
87822 @@ -738,6 +742,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
87823 if (!static_obj(lock->key)) {
87824 debug_locks_off();
87825 printk("INFO: trying to register non-static key.\n");
87826 + printk("lock:%pS key:%pS.\n", lock, lock->key);
87827 printk("the code is fine but needs lockdep annotation.\n");
87828 printk("turning off the locking correctness validator.\n");
87829 dump_stack();
87830 @@ -3082,7 +3087,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
87831 if (!class)
87832 return 0;
87833 }
87834 - atomic_inc((atomic_t *)&class->ops);
87835 + atomic_long_inc_unchecked((atomic_long_unchecked_t *)&class->ops);
87836 if (very_verbose(class)) {
87837 printk("\nacquire class [%p] %s", class->key, class->name);
87838 if (class->name_version > 1)
87839 diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
87840 index ef43ac4..2720dfa 100644
87841 --- a/kernel/locking/lockdep_proc.c
87842 +++ b/kernel/locking/lockdep_proc.c
87843 @@ -65,7 +65,7 @@ static int l_show(struct seq_file *m, void *v)
87844 return 0;
87845 }
87846
87847 - seq_printf(m, "%p", class->key);
87848 + seq_printf(m, "%pK", class->key);
87849 #ifdef CONFIG_DEBUG_LOCKDEP
87850 seq_printf(m, " OPS:%8ld", class->ops);
87851 #endif
87852 @@ -83,7 +83,7 @@ static int l_show(struct seq_file *m, void *v)
87853
87854 list_for_each_entry(entry, &class->locks_after, entry) {
87855 if (entry->distance == 1) {
87856 - seq_printf(m, " -> [%p] ", entry->class->key);
87857 + seq_printf(m, " -> [%pK] ", entry->class->key);
87858 print_name(m, entry->class);
87859 seq_puts(m, "\n");
87860 }
87861 @@ -152,7 +152,7 @@ static int lc_show(struct seq_file *m, void *v)
87862 if (!class->key)
87863 continue;
87864
87865 - seq_printf(m, "[%p] ", class->key);
87866 + seq_printf(m, "[%pK] ", class->key);
87867 print_name(m, class);
87868 seq_puts(m, "\n");
87869 }
87870 @@ -496,7 +496,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
87871 if (!i)
87872 seq_line(m, '-', 40-namelen, namelen);
87873
87874 - snprintf(ip, sizeof(ip), "[<%p>]",
87875 + snprintf(ip, sizeof(ip), "[<%pK>]",
87876 (void *)class->contention_point[i]);
87877 seq_printf(m, "%40s %14lu %29s %pS\n",
87878 name, stats->contention_point[i],
87879 @@ -511,7 +511,7 @@ static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
87880 if (!i)
87881 seq_line(m, '-', 40-namelen, namelen);
87882
87883 - snprintf(ip, sizeof(ip), "[<%p>]",
87884 + snprintf(ip, sizeof(ip), "[<%pK>]",
87885 (void *)class->contending_point[i]);
87886 seq_printf(m, "%40s %14lu %29s %pS\n",
87887 name, stats->contending_point[i],
87888 diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
87889 index faf6f5b..dc9070a 100644
87890 --- a/kernel/locking/mutex-debug.c
87891 +++ b/kernel/locking/mutex-debug.c
87892 @@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mutex_waiter *waiter)
87893 }
87894
87895 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
87896 - struct thread_info *ti)
87897 + struct task_struct *task)
87898 {
87899 SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
87900
87901 /* Mark the current thread as blocked on the lock: */
87902 - ti->task->blocked_on = waiter;
87903 + task->blocked_on = waiter;
87904 }
87905
87906 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
87907 - struct thread_info *ti)
87908 + struct task_struct *task)
87909 {
87910 DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
87911 - DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
87912 - DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
87913 - ti->task->blocked_on = NULL;
87914 + DEBUG_LOCKS_WARN_ON(waiter->task != task);
87915 + DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
87916 + task->blocked_on = NULL;
87917
87918 list_del_init(&waiter->list);
87919 waiter->task = NULL;
87920 diff --git a/kernel/locking/mutex-debug.h b/kernel/locking/mutex-debug.h
87921 index 0799fd3..d06ae3b 100644
87922 --- a/kernel/locking/mutex-debug.h
87923 +++ b/kernel/locking/mutex-debug.h
87924 @@ -20,9 +20,9 @@ extern void debug_mutex_wake_waiter(struct mutex *lock,
87925 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
87926 extern void debug_mutex_add_waiter(struct mutex *lock,
87927 struct mutex_waiter *waiter,
87928 - struct thread_info *ti);
87929 + struct task_struct *task);
87930 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
87931 - struct thread_info *ti);
87932 + struct task_struct *task);
87933 extern void debug_mutex_unlock(struct mutex *lock);
87934 extern void debug_mutex_init(struct mutex *lock, const char *name,
87935 struct lock_class_key *key);
87936 diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
87937 index 4dd6e4c..df52693 100644
87938 --- a/kernel/locking/mutex.c
87939 +++ b/kernel/locking/mutex.c
87940 @@ -135,7 +135,7 @@ void mspin_lock(struct mspin_node **lock, struct mspin_node *node)
87941 node->locked = 1;
87942 return;
87943 }
87944 - ACCESS_ONCE(prev->next) = node;
87945 + ACCESS_ONCE_RW(prev->next) = node;
87946 smp_wmb();
87947 /* Wait until the lock holder passes the lock down */
87948 while (!ACCESS_ONCE(node->locked))
87949 @@ -156,7 +156,7 @@ static void mspin_unlock(struct mspin_node **lock, struct mspin_node *node)
87950 while (!(next = ACCESS_ONCE(node->next)))
87951 arch_mutex_cpu_relax();
87952 }
87953 - ACCESS_ONCE(next->locked) = 1;
87954 + ACCESS_ONCE_RW(next->locked) = 1;
87955 smp_wmb();
87956 }
87957
87958 @@ -520,7 +520,7 @@ slowpath:
87959 goto skip_wait;
87960
87961 debug_mutex_lock_common(lock, &waiter);
87962 - debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
87963 + debug_mutex_add_waiter(lock, &waiter, task);
87964
87965 /* add waiting tasks to the end of the waitqueue (FIFO): */
87966 list_add_tail(&waiter.list, &lock->wait_list);
87967 @@ -564,7 +564,7 @@ slowpath:
87968 schedule_preempt_disabled();
87969 spin_lock_mutex(&lock->wait_lock, flags);
87970 }
87971 - mutex_remove_waiter(lock, &waiter, current_thread_info());
87972 + mutex_remove_waiter(lock, &waiter, task);
87973 /* set it to 0 if there are no waiters left: */
87974 if (likely(list_empty(&lock->wait_list)))
87975 atomic_set(&lock->count, 0);
87976 @@ -601,7 +601,7 @@ skip_wait:
87977 return 0;
87978
87979 err:
87980 - mutex_remove_waiter(lock, &waiter, task_thread_info(task));
87981 + mutex_remove_waiter(lock, &waiter, task);
87982 spin_unlock_mutex(&lock->wait_lock, flags);
87983 debug_mutex_free_waiter(&waiter);
87984 mutex_release(&lock->dep_map, 1, ip);
87985 diff --git a/kernel/locking/rtmutex-tester.c b/kernel/locking/rtmutex-tester.c
87986 index 1d96dd0..994ff19 100644
87987 --- a/kernel/locking/rtmutex-tester.c
87988 +++ b/kernel/locking/rtmutex-tester.c
87989 @@ -22,7 +22,7 @@
87990 #define MAX_RT_TEST_MUTEXES 8
87991
87992 static spinlock_t rttest_lock;
87993 -static atomic_t rttest_event;
87994 +static atomic_unchecked_t rttest_event;
87995
87996 struct test_thread_data {
87997 int opcode;
87998 @@ -63,7 +63,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
87999
88000 case RTTEST_LOCKCONT:
88001 td->mutexes[td->opdata] = 1;
88002 - td->event = atomic_add_return(1, &rttest_event);
88003 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88004 return 0;
88005
88006 case RTTEST_RESET:
88007 @@ -76,7 +76,7 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
88008 return 0;
88009
88010 case RTTEST_RESETEVENT:
88011 - atomic_set(&rttest_event, 0);
88012 + atomic_set_unchecked(&rttest_event, 0);
88013 return 0;
88014
88015 default:
88016 @@ -93,9 +93,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
88017 return ret;
88018
88019 td->mutexes[id] = 1;
88020 - td->event = atomic_add_return(1, &rttest_event);
88021 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88022 rt_mutex_lock(&mutexes[id]);
88023 - td->event = atomic_add_return(1, &rttest_event);
88024 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88025 td->mutexes[id] = 4;
88026 return 0;
88027
88028 @@ -106,9 +106,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
88029 return ret;
88030
88031 td->mutexes[id] = 1;
88032 - td->event = atomic_add_return(1, &rttest_event);
88033 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88034 ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
88035 - td->event = atomic_add_return(1, &rttest_event);
88036 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88037 td->mutexes[id] = ret ? 0 : 4;
88038 return ret ? -EINTR : 0;
88039
88040 @@ -117,9 +117,9 @@ static int handle_op(struct test_thread_data *td, int lockwakeup)
88041 if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
88042 return ret;
88043
88044 - td->event = atomic_add_return(1, &rttest_event);
88045 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88046 rt_mutex_unlock(&mutexes[id]);
88047 - td->event = atomic_add_return(1, &rttest_event);
88048 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88049 td->mutexes[id] = 0;
88050 return 0;
88051
88052 @@ -166,7 +166,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
88053 break;
88054
88055 td->mutexes[dat] = 2;
88056 - td->event = atomic_add_return(1, &rttest_event);
88057 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88058 break;
88059
88060 default:
88061 @@ -186,7 +186,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
88062 return;
88063
88064 td->mutexes[dat] = 3;
88065 - td->event = atomic_add_return(1, &rttest_event);
88066 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88067 break;
88068
88069 case RTTEST_LOCKNOWAIT:
88070 @@ -198,7 +198,7 @@ void schedule_rt_mutex_test(struct rt_mutex *mutex)
88071 return;
88072
88073 td->mutexes[dat] = 1;
88074 - td->event = atomic_add_return(1, &rttest_event);
88075 + td->event = atomic_add_return_unchecked(1, &rttest_event);
88076 return;
88077
88078 default:
88079 diff --git a/kernel/module.c b/kernel/module.c
88080 index d24fcf2..2af3fd9 100644
88081 --- a/kernel/module.c
88082 +++ b/kernel/module.c
88083 @@ -61,6 +61,7 @@
88084 #include <linux/pfn.h>
88085 #include <linux/bsearch.h>
88086 #include <linux/fips.h>
88087 +#include <linux/grsecurity.h>
88088 #include <uapi/linux/module.h>
88089 #include "module-internal.h"
88090
88091 @@ -157,7 +158,8 @@ static BLOCKING_NOTIFIER_HEAD(module_notify_list);
88092
88093 /* Bounds of module allocation, for speeding __module_address.
88094 * Protected by module_mutex. */
88095 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
88096 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
88097 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
88098
88099 int register_module_notifier(struct notifier_block * nb)
88100 {
88101 @@ -324,7 +326,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
88102 return true;
88103
88104 list_for_each_entry_rcu(mod, &modules, list) {
88105 - struct symsearch arr[] = {
88106 + struct symsearch modarr[] = {
88107 { mod->syms, mod->syms + mod->num_syms, mod->crcs,
88108 NOT_GPL_ONLY, false },
88109 { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
88110 @@ -349,7 +351,7 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
88111 if (mod->state == MODULE_STATE_UNFORMED)
88112 continue;
88113
88114 - if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
88115 + if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
88116 return true;
88117 }
88118 return false;
88119 @@ -489,7 +491,7 @@ static int percpu_modalloc(struct module *mod, struct load_info *info)
88120 if (!pcpusec->sh_size)
88121 return 0;
88122
88123 - if (align > PAGE_SIZE) {
88124 + if (align-1 >= PAGE_SIZE) {
88125 pr_warn("%s: per-cpu alignment %li > %li\n",
88126 mod->name, align, PAGE_SIZE);
88127 align = PAGE_SIZE;
88128 @@ -1062,7 +1064,7 @@ struct module_attribute module_uevent =
88129 static ssize_t show_coresize(struct module_attribute *mattr,
88130 struct module_kobject *mk, char *buffer)
88131 {
88132 - return sprintf(buffer, "%u\n", mk->mod->core_size);
88133 + return sprintf(buffer, "%u\n", mk->mod->core_size_rx + mk->mod->core_size_rw);
88134 }
88135
88136 static struct module_attribute modinfo_coresize =
88137 @@ -1071,7 +1073,7 @@ static struct module_attribute modinfo_coresize =
88138 static ssize_t show_initsize(struct module_attribute *mattr,
88139 struct module_kobject *mk, char *buffer)
88140 {
88141 - return sprintf(buffer, "%u\n", mk->mod->init_size);
88142 + return sprintf(buffer, "%u\n", mk->mod->init_size_rx + mk->mod->init_size_rw);
88143 }
88144
88145 static struct module_attribute modinfo_initsize =
88146 @@ -1163,12 +1165,29 @@ static int check_version(Elf_Shdr *sechdrs,
88147 goto bad_version;
88148 }
88149
88150 +#ifdef CONFIG_GRKERNSEC_RANDSTRUCT
88151 + /*
88152 + * avoid potentially printing jibberish on attempted load
88153 + * of a module randomized with a different seed
88154 + */
88155 + pr_warn("no symbol version for %s\n", symname);
88156 +#else
88157 pr_warn("%s: no symbol version for %s\n", mod->name, symname);
88158 +#endif
88159 return 0;
88160
88161 bad_version:
88162 +#ifdef CONFIG_GRKERNSEC_RANDSTRUCT
88163 + /*
88164 + * avoid potentially printing jibberish on attempted load
88165 + * of a module randomized with a different seed
88166 + */
88167 + printk("attempted module disagrees about version of symbol %s\n",
88168 + symname);
88169 +#else
88170 printk("%s: disagrees about version of symbol %s\n",
88171 mod->name, symname);
88172 +#endif
88173 return 0;
88174 }
88175
88176 @@ -1284,7 +1303,7 @@ resolve_symbol_wait(struct module *mod,
88177 */
88178 #ifdef CONFIG_SYSFS
88179
88180 -#ifdef CONFIG_KALLSYMS
88181 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
88182 static inline bool sect_empty(const Elf_Shdr *sect)
88183 {
88184 return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
88185 @@ -1424,7 +1443,7 @@ static void add_notes_attrs(struct module *mod, const struct load_info *info)
88186 {
88187 unsigned int notes, loaded, i;
88188 struct module_notes_attrs *notes_attrs;
88189 - struct bin_attribute *nattr;
88190 + bin_attribute_no_const *nattr;
88191
88192 /* failed to create section attributes, so can't create notes */
88193 if (!mod->sect_attrs)
88194 @@ -1536,7 +1555,7 @@ static void del_usage_links(struct module *mod)
88195 static int module_add_modinfo_attrs(struct module *mod)
88196 {
88197 struct module_attribute *attr;
88198 - struct module_attribute *temp_attr;
88199 + module_attribute_no_const *temp_attr;
88200 int error = 0;
88201 int i;
88202
88203 @@ -1757,21 +1776,21 @@ static void set_section_ro_nx(void *base,
88204
88205 static void unset_module_core_ro_nx(struct module *mod)
88206 {
88207 - set_page_attributes(mod->module_core + mod->core_text_size,
88208 - mod->module_core + mod->core_size,
88209 + set_page_attributes(mod->module_core_rw,
88210 + mod->module_core_rw + mod->core_size_rw,
88211 set_memory_x);
88212 - set_page_attributes(mod->module_core,
88213 - mod->module_core + mod->core_ro_size,
88214 + set_page_attributes(mod->module_core_rx,
88215 + mod->module_core_rx + mod->core_size_rx,
88216 set_memory_rw);
88217 }
88218
88219 static void unset_module_init_ro_nx(struct module *mod)
88220 {
88221 - set_page_attributes(mod->module_init + mod->init_text_size,
88222 - mod->module_init + mod->init_size,
88223 + set_page_attributes(mod->module_init_rw,
88224 + mod->module_init_rw + mod->init_size_rw,
88225 set_memory_x);
88226 - set_page_attributes(mod->module_init,
88227 - mod->module_init + mod->init_ro_size,
88228 + set_page_attributes(mod->module_init_rx,
88229 + mod->module_init_rx + mod->init_size_rx,
88230 set_memory_rw);
88231 }
88232
88233 @@ -1784,14 +1803,14 @@ void set_all_modules_text_rw(void)
88234 list_for_each_entry_rcu(mod, &modules, list) {
88235 if (mod->state == MODULE_STATE_UNFORMED)
88236 continue;
88237 - if ((mod->module_core) && (mod->core_text_size)) {
88238 - set_page_attributes(mod->module_core,
88239 - mod->module_core + mod->core_text_size,
88240 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
88241 + set_page_attributes(mod->module_core_rx,
88242 + mod->module_core_rx + mod->core_size_rx,
88243 set_memory_rw);
88244 }
88245 - if ((mod->module_init) && (mod->init_text_size)) {
88246 - set_page_attributes(mod->module_init,
88247 - mod->module_init + mod->init_text_size,
88248 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
88249 + set_page_attributes(mod->module_init_rx,
88250 + mod->module_init_rx + mod->init_size_rx,
88251 set_memory_rw);
88252 }
88253 }
88254 @@ -1807,14 +1826,14 @@ void set_all_modules_text_ro(void)
88255 list_for_each_entry_rcu(mod, &modules, list) {
88256 if (mod->state == MODULE_STATE_UNFORMED)
88257 continue;
88258 - if ((mod->module_core) && (mod->core_text_size)) {
88259 - set_page_attributes(mod->module_core,
88260 - mod->module_core + mod->core_text_size,
88261 + if ((mod->module_core_rx) && (mod->core_size_rx)) {
88262 + set_page_attributes(mod->module_core_rx,
88263 + mod->module_core_rx + mod->core_size_rx,
88264 set_memory_ro);
88265 }
88266 - if ((mod->module_init) && (mod->init_text_size)) {
88267 - set_page_attributes(mod->module_init,
88268 - mod->module_init + mod->init_text_size,
88269 + if ((mod->module_init_rx) && (mod->init_size_rx)) {
88270 + set_page_attributes(mod->module_init_rx,
88271 + mod->module_init_rx + mod->init_size_rx,
88272 set_memory_ro);
88273 }
88274 }
88275 @@ -1865,16 +1884,19 @@ static void free_module(struct module *mod)
88276
88277 /* This may be NULL, but that's OK */
88278 unset_module_init_ro_nx(mod);
88279 - module_free(mod, mod->module_init);
88280 + module_free(mod, mod->module_init_rw);
88281 + module_free_exec(mod, mod->module_init_rx);
88282 kfree(mod->args);
88283 percpu_modfree(mod);
88284
88285 /* Free lock-classes: */
88286 - lockdep_free_key_range(mod->module_core, mod->core_size);
88287 + lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
88288 + lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
88289
88290 /* Finally, free the core (containing the module structure) */
88291 unset_module_core_ro_nx(mod);
88292 - module_free(mod, mod->module_core);
88293 + module_free_exec(mod, mod->module_core_rx);
88294 + module_free(mod, mod->module_core_rw);
88295
88296 #ifdef CONFIG_MPU
88297 update_protections(current->mm);
88298 @@ -1943,9 +1965,31 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
88299 int ret = 0;
88300 const struct kernel_symbol *ksym;
88301
88302 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
88303 + int is_fs_load = 0;
88304 + int register_filesystem_found = 0;
88305 + char *p;
88306 +
88307 + p = strstr(mod->args, "grsec_modharden_fs");
88308 + if (p) {
88309 + char *endptr = p + sizeof("grsec_modharden_fs") - 1;
88310 + /* copy \0 as well */
88311 + memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
88312 + is_fs_load = 1;
88313 + }
88314 +#endif
88315 +
88316 for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
88317 const char *name = info->strtab + sym[i].st_name;
88318
88319 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
88320 + /* it's a real shame this will never get ripped and copied
88321 + upstream! ;(
88322 + */
88323 + if (is_fs_load && !strcmp(name, "register_filesystem"))
88324 + register_filesystem_found = 1;
88325 +#endif
88326 +
88327 switch (sym[i].st_shndx) {
88328 case SHN_COMMON:
88329 /* We compiled with -fno-common. These are not
88330 @@ -1966,7 +2010,9 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
88331 ksym = resolve_symbol_wait(mod, info, name);
88332 /* Ok if resolved. */
88333 if (ksym && !IS_ERR(ksym)) {
88334 + pax_open_kernel();
88335 sym[i].st_value = ksym->value;
88336 + pax_close_kernel();
88337 break;
88338 }
88339
88340 @@ -1985,11 +2031,20 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
88341 secbase = (unsigned long)mod_percpu(mod);
88342 else
88343 secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
88344 + pax_open_kernel();
88345 sym[i].st_value += secbase;
88346 + pax_close_kernel();
88347 break;
88348 }
88349 }
88350
88351 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
88352 + if (is_fs_load && !register_filesystem_found) {
88353 + printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
88354 + ret = -EPERM;
88355 + }
88356 +#endif
88357 +
88358 return ret;
88359 }
88360
88361 @@ -2073,22 +2128,12 @@ static void layout_sections(struct module *mod, struct load_info *info)
88362 || s->sh_entsize != ~0UL
88363 || strstarts(sname, ".init"))
88364 continue;
88365 - s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
88366 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
88367 + s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
88368 + else
88369 + s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
88370 pr_debug("\t%s\n", sname);
88371 }
88372 - switch (m) {
88373 - case 0: /* executable */
88374 - mod->core_size = debug_align(mod->core_size);
88375 - mod->core_text_size = mod->core_size;
88376 - break;
88377 - case 1: /* RO: text and ro-data */
88378 - mod->core_size = debug_align(mod->core_size);
88379 - mod->core_ro_size = mod->core_size;
88380 - break;
88381 - case 3: /* whole core */
88382 - mod->core_size = debug_align(mod->core_size);
88383 - break;
88384 - }
88385 }
88386
88387 pr_debug("Init section allocation order:\n");
88388 @@ -2102,23 +2147,13 @@ static void layout_sections(struct module *mod, struct load_info *info)
88389 || s->sh_entsize != ~0UL
88390 || !strstarts(sname, ".init"))
88391 continue;
88392 - s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
88393 - | INIT_OFFSET_MASK);
88394 + if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
88395 + s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
88396 + else
88397 + s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
88398 + s->sh_entsize |= INIT_OFFSET_MASK;
88399 pr_debug("\t%s\n", sname);
88400 }
88401 - switch (m) {
88402 - case 0: /* executable */
88403 - mod->init_size = debug_align(mod->init_size);
88404 - mod->init_text_size = mod->init_size;
88405 - break;
88406 - case 1: /* RO: text and ro-data */
88407 - mod->init_size = debug_align(mod->init_size);
88408 - mod->init_ro_size = mod->init_size;
88409 - break;
88410 - case 3: /* whole init */
88411 - mod->init_size = debug_align(mod->init_size);
88412 - break;
88413 - }
88414 }
88415 }
88416
88417 @@ -2291,7 +2326,7 @@ static void layout_symtab(struct module *mod, struct load_info *info)
88418
88419 /* Put symbol section at end of init part of module. */
88420 symsect->sh_flags |= SHF_ALLOC;
88421 - symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
88422 + symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
88423 info->index.sym) | INIT_OFFSET_MASK;
88424 pr_debug("\t%s\n", info->secstrings + symsect->sh_name);
88425
88426 @@ -2308,13 +2343,13 @@ static void layout_symtab(struct module *mod, struct load_info *info)
88427 }
88428
88429 /* Append room for core symbols at end of core part. */
88430 - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
88431 - info->stroffs = mod->core_size = info->symoffs + ndst * sizeof(Elf_Sym);
88432 - mod->core_size += strtab_size;
88433 + info->symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
88434 + info->stroffs = mod->core_size_rx = info->symoffs + ndst * sizeof(Elf_Sym);
88435 + mod->core_size_rx += strtab_size;
88436
88437 /* Put string table section at end of init part of module. */
88438 strsect->sh_flags |= SHF_ALLOC;
88439 - strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
88440 + strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
88441 info->index.str) | INIT_OFFSET_MASK;
88442 pr_debug("\t%s\n", info->secstrings + strsect->sh_name);
88443 }
88444 @@ -2332,12 +2367,14 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
88445 /* Make sure we get permanent strtab: don't use info->strtab. */
88446 mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
88447
88448 + pax_open_kernel();
88449 +
88450 /* Set types up while we still have access to sections. */
88451 for (i = 0; i < mod->num_symtab; i++)
88452 mod->symtab[i].st_info = elf_type(&mod->symtab[i], info);
88453
88454 - mod->core_symtab = dst = mod->module_core + info->symoffs;
88455 - mod->core_strtab = s = mod->module_core + info->stroffs;
88456 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs;
88457 + mod->core_strtab = s = mod->module_core_rx + info->stroffs;
88458 src = mod->symtab;
88459 for (ndst = i = 0; i < mod->num_symtab; i++) {
88460 if (i == 0 ||
88461 @@ -2349,6 +2386,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info)
88462 }
88463 }
88464 mod->core_num_syms = ndst;
88465 +
88466 + pax_close_kernel();
88467 }
88468 #else
88469 static inline void layout_symtab(struct module *mod, struct load_info *info)
88470 @@ -2382,17 +2421,33 @@ void * __weak module_alloc(unsigned long size)
88471 return vmalloc_exec(size);
88472 }
88473
88474 -static void *module_alloc_update_bounds(unsigned long size)
88475 +static void *module_alloc_update_bounds_rw(unsigned long size)
88476 {
88477 void *ret = module_alloc(size);
88478
88479 if (ret) {
88480 mutex_lock(&module_mutex);
88481 /* Update module bounds. */
88482 - if ((unsigned long)ret < module_addr_min)
88483 - module_addr_min = (unsigned long)ret;
88484 - if ((unsigned long)ret + size > module_addr_max)
88485 - module_addr_max = (unsigned long)ret + size;
88486 + if ((unsigned long)ret < module_addr_min_rw)
88487 + module_addr_min_rw = (unsigned long)ret;
88488 + if ((unsigned long)ret + size > module_addr_max_rw)
88489 + module_addr_max_rw = (unsigned long)ret + size;
88490 + mutex_unlock(&module_mutex);
88491 + }
88492 + return ret;
88493 +}
88494 +
88495 +static void *module_alloc_update_bounds_rx(unsigned long size)
88496 +{
88497 + void *ret = module_alloc_exec(size);
88498 +
88499 + if (ret) {
88500 + mutex_lock(&module_mutex);
88501 + /* Update module bounds. */
88502 + if ((unsigned long)ret < module_addr_min_rx)
88503 + module_addr_min_rx = (unsigned long)ret;
88504 + if ((unsigned long)ret + size > module_addr_max_rx)
88505 + module_addr_max_rx = (unsigned long)ret + size;
88506 mutex_unlock(&module_mutex);
88507 }
88508 return ret;
88509 @@ -2649,7 +2704,15 @@ static struct module *setup_load_info(struct load_info *info, int flags)
88510 mod = (void *)info->sechdrs[info->index.mod].sh_addr;
88511
88512 if (info->index.sym == 0) {
88513 +#ifdef CONFIG_GRKERNSEC_RANDSTRUCT
88514 + /*
88515 + * avoid potentially printing jibberish on attempted load
88516 + * of a module randomized with a different seed
88517 + */
88518 + pr_warn("module has no symbols (stripped?)\n");
88519 +#else
88520 pr_warn("%s: module has no symbols (stripped?)\n", mod->name);
88521 +#endif
88522 return ERR_PTR(-ENOEXEC);
88523 }
88524
88525 @@ -2665,8 +2728,14 @@ static struct module *setup_load_info(struct load_info *info, int flags)
88526 static int check_modinfo(struct module *mod, struct load_info *info, int flags)
88527 {
88528 const char *modmagic = get_modinfo(info, "vermagic");
88529 + const char *license = get_modinfo(info, "license");
88530 int err;
88531
88532 +#ifdef CONFIG_PAX_KERNEXEC_PLUGIN_METHOD_OR
88533 + if (!license || !license_is_gpl_compatible(license))
88534 + return -ENOEXEC;
88535 +#endif
88536 +
88537 if (flags & MODULE_INIT_IGNORE_VERMAGIC)
88538 modmagic = NULL;
88539
88540 @@ -2691,7 +2760,7 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
88541 }
88542
88543 /* Set up license info based on the info section */
88544 - set_license(mod, get_modinfo(info, "license"));
88545 + set_license(mod, license);
88546
88547 return 0;
88548 }
88549 @@ -2785,7 +2854,7 @@ static int move_module(struct module *mod, struct load_info *info)
88550 void *ptr;
88551
88552 /* Do the allocs. */
88553 - ptr = module_alloc_update_bounds(mod->core_size);
88554 + ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
88555 /*
88556 * The pointer to this block is stored in the module structure
88557 * which is inside the block. Just mark it as not being a
88558 @@ -2795,11 +2864,11 @@ static int move_module(struct module *mod, struct load_info *info)
88559 if (!ptr)
88560 return -ENOMEM;
88561
88562 - memset(ptr, 0, mod->core_size);
88563 - mod->module_core = ptr;
88564 + memset(ptr, 0, mod->core_size_rw);
88565 + mod->module_core_rw = ptr;
88566
88567 - if (mod->init_size) {
88568 - ptr = module_alloc_update_bounds(mod->init_size);
88569 + if (mod->init_size_rw) {
88570 + ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
88571 /*
88572 * The pointer to this block is stored in the module structure
88573 * which is inside the block. This block doesn't need to be
88574 @@ -2808,13 +2877,45 @@ static int move_module(struct module *mod, struct load_info *info)
88575 */
88576 kmemleak_ignore(ptr);
88577 if (!ptr) {
88578 - module_free(mod, mod->module_core);
88579 + module_free(mod, mod->module_core_rw);
88580 return -ENOMEM;
88581 }
88582 - memset(ptr, 0, mod->init_size);
88583 - mod->module_init = ptr;
88584 + memset(ptr, 0, mod->init_size_rw);
88585 + mod->module_init_rw = ptr;
88586 } else
88587 - mod->module_init = NULL;
88588 + mod->module_init_rw = NULL;
88589 +
88590 + ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
88591 + kmemleak_not_leak(ptr);
88592 + if (!ptr) {
88593 + if (mod->module_init_rw)
88594 + module_free(mod, mod->module_init_rw);
88595 + module_free(mod, mod->module_core_rw);
88596 + return -ENOMEM;
88597 + }
88598 +
88599 + pax_open_kernel();
88600 + memset(ptr, 0, mod->core_size_rx);
88601 + pax_close_kernel();
88602 + mod->module_core_rx = ptr;
88603 +
88604 + if (mod->init_size_rx) {
88605 + ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
88606 + kmemleak_ignore(ptr);
88607 + if (!ptr && mod->init_size_rx) {
88608 + module_free_exec(mod, mod->module_core_rx);
88609 + if (mod->module_init_rw)
88610 + module_free(mod, mod->module_init_rw);
88611 + module_free(mod, mod->module_core_rw);
88612 + return -ENOMEM;
88613 + }
88614 +
88615 + pax_open_kernel();
88616 + memset(ptr, 0, mod->init_size_rx);
88617 + pax_close_kernel();
88618 + mod->module_init_rx = ptr;
88619 + } else
88620 + mod->module_init_rx = NULL;
88621
88622 /* Transfer each section which specifies SHF_ALLOC */
88623 pr_debug("final section addresses:\n");
88624 @@ -2825,16 +2926,45 @@ static int move_module(struct module *mod, struct load_info *info)
88625 if (!(shdr->sh_flags & SHF_ALLOC))
88626 continue;
88627
88628 - if (shdr->sh_entsize & INIT_OFFSET_MASK)
88629 - dest = mod->module_init
88630 - + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
88631 - else
88632 - dest = mod->module_core + shdr->sh_entsize;
88633 + if (shdr->sh_entsize & INIT_OFFSET_MASK) {
88634 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
88635 + dest = mod->module_init_rw
88636 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
88637 + else
88638 + dest = mod->module_init_rx
88639 + + (shdr->sh_entsize & ~INIT_OFFSET_MASK);
88640 + } else {
88641 + if ((shdr->sh_flags & SHF_WRITE) || !(shdr->sh_flags & SHF_ALLOC))
88642 + dest = mod->module_core_rw + shdr->sh_entsize;
88643 + else
88644 + dest = mod->module_core_rx + shdr->sh_entsize;
88645 + }
88646 +
88647 + if (shdr->sh_type != SHT_NOBITS) {
88648 +
88649 +#ifdef CONFIG_PAX_KERNEXEC
88650 +#ifdef CONFIG_X86_64
88651 + if ((shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_EXECINSTR))
88652 + set_memory_x((unsigned long)dest, (shdr->sh_size + PAGE_SIZE) >> PAGE_SHIFT);
88653 +#endif
88654 + if (!(shdr->sh_flags & SHF_WRITE) && (shdr->sh_flags & SHF_ALLOC)) {
88655 + pax_open_kernel();
88656 + memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
88657 + pax_close_kernel();
88658 + } else
88659 +#endif
88660
88661 - if (shdr->sh_type != SHT_NOBITS)
88662 memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
88663 + }
88664 /* Update sh_addr to point to copy in image. */
88665 - shdr->sh_addr = (unsigned long)dest;
88666 +
88667 +#ifdef CONFIG_PAX_KERNEXEC
88668 + if (shdr->sh_flags & SHF_EXECINSTR)
88669 + shdr->sh_addr = ktva_ktla((unsigned long)dest);
88670 + else
88671 +#endif
88672 +
88673 + shdr->sh_addr = (unsigned long)dest;
88674 pr_debug("\t0x%lx %s\n",
88675 (long)shdr->sh_addr, info->secstrings + shdr->sh_name);
88676 }
88677 @@ -2891,12 +3021,12 @@ static void flush_module_icache(const struct module *mod)
88678 * Do it before processing of module parameters, so the module
88679 * can provide parameter accessor functions of its own.
88680 */
88681 - if (mod->module_init)
88682 - flush_icache_range((unsigned long)mod->module_init,
88683 - (unsigned long)mod->module_init
88684 - + mod->init_size);
88685 - flush_icache_range((unsigned long)mod->module_core,
88686 - (unsigned long)mod->module_core + mod->core_size);
88687 + if (mod->module_init_rx)
88688 + flush_icache_range((unsigned long)mod->module_init_rx,
88689 + (unsigned long)mod->module_init_rx
88690 + + mod->init_size_rx);
88691 + flush_icache_range((unsigned long)mod->module_core_rx,
88692 + (unsigned long)mod->module_core_rx + mod->core_size_rx);
88693
88694 set_fs(old_fs);
88695 }
88696 @@ -2953,8 +3083,10 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
88697 static void module_deallocate(struct module *mod, struct load_info *info)
88698 {
88699 percpu_modfree(mod);
88700 - module_free(mod, mod->module_init);
88701 - module_free(mod, mod->module_core);
88702 + module_free_exec(mod, mod->module_init_rx);
88703 + module_free_exec(mod, mod->module_core_rx);
88704 + module_free(mod, mod->module_init_rw);
88705 + module_free(mod, mod->module_core_rw);
88706 }
88707
88708 int __weak module_finalize(const Elf_Ehdr *hdr,
88709 @@ -2967,7 +3099,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr,
88710 static int post_relocation(struct module *mod, const struct load_info *info)
88711 {
88712 /* Sort exception table now relocations are done. */
88713 + pax_open_kernel();
88714 sort_extable(mod->extable, mod->extable + mod->num_exentries);
88715 + pax_close_kernel();
88716
88717 /* Copy relocated percpu area over. */
88718 percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr,
88719 @@ -3021,16 +3155,16 @@ static int do_init_module(struct module *mod)
88720 MODULE_STATE_COMING, mod);
88721
88722 /* Set RO and NX regions for core */
88723 - set_section_ro_nx(mod->module_core,
88724 - mod->core_text_size,
88725 - mod->core_ro_size,
88726 - mod->core_size);
88727 + set_section_ro_nx(mod->module_core_rx,
88728 + mod->core_size_rx,
88729 + mod->core_size_rx,
88730 + mod->core_size_rx);
88731
88732 /* Set RO and NX regions for init */
88733 - set_section_ro_nx(mod->module_init,
88734 - mod->init_text_size,
88735 - mod->init_ro_size,
88736 - mod->init_size);
88737 + set_section_ro_nx(mod->module_init_rx,
88738 + mod->init_size_rx,
88739 + mod->init_size_rx,
88740 + mod->init_size_rx);
88741
88742 do_mod_ctors(mod);
88743 /* Start the module */
88744 @@ -3091,11 +3225,12 @@ static int do_init_module(struct module *mod)
88745 mod->strtab = mod->core_strtab;
88746 #endif
88747 unset_module_init_ro_nx(mod);
88748 - module_free(mod, mod->module_init);
88749 - mod->module_init = NULL;
88750 - mod->init_size = 0;
88751 - mod->init_ro_size = 0;
88752 - mod->init_text_size = 0;
88753 + module_free(mod, mod->module_init_rw);
88754 + module_free_exec(mod, mod->module_init_rx);
88755 + mod->module_init_rw = NULL;
88756 + mod->module_init_rx = NULL;
88757 + mod->init_size_rw = 0;
88758 + mod->init_size_rx = 0;
88759 mutex_unlock(&module_mutex);
88760 wake_up_all(&module_wq);
88761
88762 @@ -3238,9 +3373,38 @@ static int load_module(struct load_info *info, const char __user *uargs,
88763 if (err)
88764 goto free_unload;
88765
88766 + /* Now copy in args */
88767 + mod->args = strndup_user(uargs, ~0UL >> 1);
88768 + if (IS_ERR(mod->args)) {
88769 + err = PTR_ERR(mod->args);
88770 + goto free_unload;
88771 + }
88772 +
88773 /* Set up MODINFO_ATTR fields */
88774 setup_modinfo(mod, info);
88775
88776 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
88777 + {
88778 + char *p, *p2;
88779 +
88780 + if (strstr(mod->args, "grsec_modharden_netdev")) {
88781 + printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
88782 + err = -EPERM;
88783 + goto free_modinfo;
88784 + } else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
88785 + p += sizeof("grsec_modharden_normal") - 1;
88786 + p2 = strstr(p, "_");
88787 + if (p2) {
88788 + *p2 = '\0';
88789 + printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
88790 + *p2 = '_';
88791 + }
88792 + err = -EPERM;
88793 + goto free_modinfo;
88794 + }
88795 + }
88796 +#endif
88797 +
88798 /* Fix up syms, so that st_value is a pointer to location. */
88799 err = simplify_symbols(mod, info);
88800 if (err < 0)
88801 @@ -3256,13 +3420,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
88802
88803 flush_module_icache(mod);
88804
88805 - /* Now copy in args */
88806 - mod->args = strndup_user(uargs, ~0UL >> 1);
88807 - if (IS_ERR(mod->args)) {
88808 - err = PTR_ERR(mod->args);
88809 - goto free_arch_cleanup;
88810 - }
88811 -
88812 dynamic_debug_setup(info->debug, info->num_debug);
88813
88814 /* Finally it's fully formed, ready to start executing. */
88815 @@ -3297,11 +3454,10 @@ static int load_module(struct load_info *info, const char __user *uargs,
88816 ddebug_cleanup:
88817 dynamic_debug_remove(info->debug);
88818 synchronize_sched();
88819 - kfree(mod->args);
88820 - free_arch_cleanup:
88821 module_arch_cleanup(mod);
88822 free_modinfo:
88823 free_modinfo(mod);
88824 + kfree(mod->args);
88825 free_unload:
88826 module_unload_free(mod);
88827 unlink_mod:
88828 @@ -3384,10 +3540,16 @@ static const char *get_ksymbol(struct module *mod,
88829 unsigned long nextval;
88830
88831 /* At worse, next value is at end of module */
88832 - if (within_module_init(addr, mod))
88833 - nextval = (unsigned long)mod->module_init+mod->init_text_size;
88834 + if (within_module_init_rx(addr, mod))
88835 + nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
88836 + else if (within_module_init_rw(addr, mod))
88837 + nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
88838 + else if (within_module_core_rx(addr, mod))
88839 + nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
88840 + else if (within_module_core_rw(addr, mod))
88841 + nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
88842 else
88843 - nextval = (unsigned long)mod->module_core+mod->core_text_size;
88844 + return NULL;
88845
88846 /* Scan for closest preceding symbol, and next symbol. (ELF
88847 starts real symbols at 1). */
88848 @@ -3638,7 +3800,7 @@ static int m_show(struct seq_file *m, void *p)
88849 return 0;
88850
88851 seq_printf(m, "%s %u",
88852 - mod->name, mod->init_size + mod->core_size);
88853 + mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
88854 print_unload_info(m, mod);
88855
88856 /* Informative for users. */
88857 @@ -3647,7 +3809,7 @@ static int m_show(struct seq_file *m, void *p)
88858 mod->state == MODULE_STATE_COMING ? "Loading":
88859 "Live");
88860 /* Used by oprofile and other similar tools. */
88861 - seq_printf(m, " 0x%pK", mod->module_core);
88862 + seq_printf(m, " 0x%pK 0x%pK", mod->module_core_rx, mod->module_core_rw);
88863
88864 /* Taints info */
88865 if (mod->taints)
88866 @@ -3683,7 +3845,17 @@ static const struct file_operations proc_modules_operations = {
88867
88868 static int __init proc_modules_init(void)
88869 {
88870 +#ifndef CONFIG_GRKERNSEC_HIDESYM
88871 +#ifdef CONFIG_GRKERNSEC_PROC_USER
88872 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
88873 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
88874 + proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
88875 +#else
88876 proc_create("modules", 0, NULL, &proc_modules_operations);
88877 +#endif
88878 +#else
88879 + proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
88880 +#endif
88881 return 0;
88882 }
88883 module_init(proc_modules_init);
88884 @@ -3744,14 +3916,14 @@ struct module *__module_address(unsigned long addr)
88885 {
88886 struct module *mod;
88887
88888 - if (addr < module_addr_min || addr > module_addr_max)
88889 + if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
88890 + (addr < module_addr_min_rw || addr > module_addr_max_rw))
88891 return NULL;
88892
88893 list_for_each_entry_rcu(mod, &modules, list) {
88894 if (mod->state == MODULE_STATE_UNFORMED)
88895 continue;
88896 - if (within_module_core(addr, mod)
88897 - || within_module_init(addr, mod))
88898 + if (within_module_init(addr, mod) || within_module_core(addr, mod))
88899 return mod;
88900 }
88901 return NULL;
88902 @@ -3786,11 +3958,20 @@ bool is_module_text_address(unsigned long addr)
88903 */
88904 struct module *__module_text_address(unsigned long addr)
88905 {
88906 - struct module *mod = __module_address(addr);
88907 + struct module *mod;
88908 +
88909 +#ifdef CONFIG_X86_32
88910 + addr = ktla_ktva(addr);
88911 +#endif
88912 +
88913 + if (addr < module_addr_min_rx || addr > module_addr_max_rx)
88914 + return NULL;
88915 +
88916 + mod = __module_address(addr);
88917 +
88918 if (mod) {
88919 /* Make sure it's within the text section. */
88920 - if (!within(addr, mod->module_init, mod->init_text_size)
88921 - && !within(addr, mod->module_core, mod->core_text_size))
88922 + if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
88923 mod = NULL;
88924 }
88925 return mod;
88926 diff --git a/kernel/notifier.c b/kernel/notifier.c
88927 index 2d5cc4c..d9ea600 100644
88928 --- a/kernel/notifier.c
88929 +++ b/kernel/notifier.c
88930 @@ -5,6 +5,7 @@
88931 #include <linux/rcupdate.h>
88932 #include <linux/vmalloc.h>
88933 #include <linux/reboot.h>
88934 +#include <linux/mm.h>
88935
88936 /*
88937 * Notifier list for kernel code which wants to be called
88938 @@ -24,10 +25,12 @@ static int notifier_chain_register(struct notifier_block **nl,
88939 while ((*nl) != NULL) {
88940 if (n->priority > (*nl)->priority)
88941 break;
88942 - nl = &((*nl)->next);
88943 + nl = (struct notifier_block **)&((*nl)->next);
88944 }
88945 - n->next = *nl;
88946 + pax_open_kernel();
88947 + *(const void **)&n->next = *nl;
88948 rcu_assign_pointer(*nl, n);
88949 + pax_close_kernel();
88950 return 0;
88951 }
88952
88953 @@ -39,10 +42,12 @@ static int notifier_chain_cond_register(struct notifier_block **nl,
88954 return 0;
88955 if (n->priority > (*nl)->priority)
88956 break;
88957 - nl = &((*nl)->next);
88958 + nl = (struct notifier_block **)&((*nl)->next);
88959 }
88960 - n->next = *nl;
88961 + pax_open_kernel();
88962 + *(const void **)&n->next = *nl;
88963 rcu_assign_pointer(*nl, n);
88964 + pax_close_kernel();
88965 return 0;
88966 }
88967
88968 @@ -51,10 +56,12 @@ static int notifier_chain_unregister(struct notifier_block **nl,
88969 {
88970 while ((*nl) != NULL) {
88971 if ((*nl) == n) {
88972 + pax_open_kernel();
88973 rcu_assign_pointer(*nl, n->next);
88974 + pax_close_kernel();
88975 return 0;
88976 }
88977 - nl = &((*nl)->next);
88978 + nl = (struct notifier_block **)&((*nl)->next);
88979 }
88980 return -ENOENT;
88981 }
88982 diff --git a/kernel/padata.c b/kernel/padata.c
88983 index 161402f..598814c 100644
88984 --- a/kernel/padata.c
88985 +++ b/kernel/padata.c
88986 @@ -54,7 +54,7 @@ static int padata_cpu_hash(struct parallel_data *pd)
88987 * seq_nr mod. number of cpus in use.
88988 */
88989
88990 - seq_nr = atomic_inc_return(&pd->seq_nr);
88991 + seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
88992 cpu_index = seq_nr % cpumask_weight(pd->cpumask.pcpu);
88993
88994 return padata_index_to_cpu(pd, cpu_index);
88995 @@ -428,7 +428,7 @@ static struct parallel_data *padata_alloc_pd(struct padata_instance *pinst,
88996 padata_init_pqueues(pd);
88997 padata_init_squeues(pd);
88998 setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
88999 - atomic_set(&pd->seq_nr, -1);
89000 + atomic_set_unchecked(&pd->seq_nr, -1);
89001 atomic_set(&pd->reorder_objects, 0);
89002 atomic_set(&pd->refcnt, 0);
89003 pd->pinst = pinst;
89004 diff --git a/kernel/panic.c b/kernel/panic.c
89005 index 6d63003..486a109 100644
89006 --- a/kernel/panic.c
89007 +++ b/kernel/panic.c
89008 @@ -52,7 +52,7 @@ EXPORT_SYMBOL(panic_blink);
89009 /*
89010 * Stop ourself in panic -- architecture code may override this
89011 */
89012 -void __weak panic_smp_self_stop(void)
89013 +void __weak __noreturn panic_smp_self_stop(void)
89014 {
89015 while (1)
89016 cpu_relax();
89017 @@ -407,7 +407,7 @@ static void warn_slowpath_common(const char *file, int line, void *caller,
89018 disable_trace_on_warning();
89019
89020 pr_warn("------------[ cut here ]------------\n");
89021 - pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS()\n",
89022 + pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pA()\n",
89023 raw_smp_processor_id(), current->pid, file, line, caller);
89024
89025 if (args)
89026 @@ -461,7 +461,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
89027 */
89028 void __stack_chk_fail(void)
89029 {
89030 - panic("stack-protector: Kernel stack is corrupted in: %p\n",
89031 + dump_stack();
89032 + panic("stack-protector: Kernel stack is corrupted in: %pA\n",
89033 __builtin_return_address(0));
89034 }
89035 EXPORT_SYMBOL(__stack_chk_fail);
89036 diff --git a/kernel/pid.c b/kernel/pid.c
89037 index 9b9a266..c20ef80 100644
89038 --- a/kernel/pid.c
89039 +++ b/kernel/pid.c
89040 @@ -33,6 +33,7 @@
89041 #include <linux/rculist.h>
89042 #include <linux/bootmem.h>
89043 #include <linux/hash.h>
89044 +#include <linux/security.h>
89045 #include <linux/pid_namespace.h>
89046 #include <linux/init_task.h>
89047 #include <linux/syscalls.h>
89048 @@ -47,7 +48,7 @@ struct pid init_struct_pid = INIT_STRUCT_PID;
89049
89050 int pid_max = PID_MAX_DEFAULT;
89051
89052 -#define RESERVED_PIDS 300
89053 +#define RESERVED_PIDS 500
89054
89055 int pid_max_min = RESERVED_PIDS + 1;
89056 int pid_max_max = PID_MAX_LIMIT;
89057 @@ -445,10 +446,18 @@ EXPORT_SYMBOL(pid_task);
89058 */
89059 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
89060 {
89061 + struct task_struct *task;
89062 +
89063 rcu_lockdep_assert(rcu_read_lock_held(),
89064 "find_task_by_pid_ns() needs rcu_read_lock()"
89065 " protection");
89066 - return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
89067 +
89068 + task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
89069 +
89070 + if (gr_pid_is_chrooted(task))
89071 + return NULL;
89072 +
89073 + return task;
89074 }
89075
89076 struct task_struct *find_task_by_vpid(pid_t vnr)
89077 @@ -456,6 +465,14 @@ struct task_struct *find_task_by_vpid(pid_t vnr)
89078 return find_task_by_pid_ns(vnr, task_active_pid_ns(current));
89079 }
89080
89081 +struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
89082 +{
89083 + rcu_lockdep_assert(rcu_read_lock_held(),
89084 + "find_task_by_pid_ns() needs rcu_read_lock()"
89085 + " protection");
89086 + return pid_task(find_pid_ns(vnr, task_active_pid_ns(current)), PIDTYPE_PID);
89087 +}
89088 +
89089 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
89090 {
89091 struct pid *pid;
89092 diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
89093 index db95d8e..a0ca23f 100644
89094 --- a/kernel/pid_namespace.c
89095 +++ b/kernel/pid_namespace.c
89096 @@ -253,7 +253,7 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write,
89097 void __user *buffer, size_t *lenp, loff_t *ppos)
89098 {
89099 struct pid_namespace *pid_ns = task_active_pid_ns(current);
89100 - struct ctl_table tmp = *table;
89101 + ctl_table_no_const tmp = *table;
89102
89103 if (write && !ns_capable(pid_ns->user_ns, CAP_SYS_ADMIN))
89104 return -EPERM;
89105 diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
89106 index 3b89464..5e38379 100644
89107 --- a/kernel/posix-cpu-timers.c
89108 +++ b/kernel/posix-cpu-timers.c
89109 @@ -1464,14 +1464,14 @@ struct k_clock clock_posix_cpu = {
89110
89111 static __init int init_posix_cpu_timers(void)
89112 {
89113 - struct k_clock process = {
89114 + static struct k_clock process = {
89115 .clock_getres = process_cpu_clock_getres,
89116 .clock_get = process_cpu_clock_get,
89117 .timer_create = process_cpu_timer_create,
89118 .nsleep = process_cpu_nsleep,
89119 .nsleep_restart = process_cpu_nsleep_restart,
89120 };
89121 - struct k_clock thread = {
89122 + static struct k_clock thread = {
89123 .clock_getres = thread_cpu_clock_getres,
89124 .clock_get = thread_cpu_clock_get,
89125 .timer_create = thread_cpu_timer_create,
89126 diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
89127 index 424c2d4..679242f 100644
89128 --- a/kernel/posix-timers.c
89129 +++ b/kernel/posix-timers.c
89130 @@ -43,6 +43,7 @@
89131 #include <linux/hash.h>
89132 #include <linux/posix-clock.h>
89133 #include <linux/posix-timers.h>
89134 +#include <linux/grsecurity.h>
89135 #include <linux/syscalls.h>
89136 #include <linux/wait.h>
89137 #include <linux/workqueue.h>
89138 @@ -122,7 +123,7 @@ static DEFINE_SPINLOCK(hash_lock);
89139 * which we beg off on and pass to do_sys_settimeofday().
89140 */
89141
89142 -static struct k_clock posix_clocks[MAX_CLOCKS];
89143 +static struct k_clock *posix_clocks[MAX_CLOCKS];
89144
89145 /*
89146 * These ones are defined below.
89147 @@ -275,7 +276,7 @@ static int posix_get_tai(clockid_t which_clock, struct timespec *tp)
89148 */
89149 static __init int init_posix_timers(void)
89150 {
89151 - struct k_clock clock_realtime = {
89152 + static struct k_clock clock_realtime = {
89153 .clock_getres = hrtimer_get_res,
89154 .clock_get = posix_clock_realtime_get,
89155 .clock_set = posix_clock_realtime_set,
89156 @@ -287,7 +288,7 @@ static __init int init_posix_timers(void)
89157 .timer_get = common_timer_get,
89158 .timer_del = common_timer_del,
89159 };
89160 - struct k_clock clock_monotonic = {
89161 + static struct k_clock clock_monotonic = {
89162 .clock_getres = hrtimer_get_res,
89163 .clock_get = posix_ktime_get_ts,
89164 .nsleep = common_nsleep,
89165 @@ -297,19 +298,19 @@ static __init int init_posix_timers(void)
89166 .timer_get = common_timer_get,
89167 .timer_del = common_timer_del,
89168 };
89169 - struct k_clock clock_monotonic_raw = {
89170 + static struct k_clock clock_monotonic_raw = {
89171 .clock_getres = hrtimer_get_res,
89172 .clock_get = posix_get_monotonic_raw,
89173 };
89174 - struct k_clock clock_realtime_coarse = {
89175 + static struct k_clock clock_realtime_coarse = {
89176 .clock_getres = posix_get_coarse_res,
89177 .clock_get = posix_get_realtime_coarse,
89178 };
89179 - struct k_clock clock_monotonic_coarse = {
89180 + static struct k_clock clock_monotonic_coarse = {
89181 .clock_getres = posix_get_coarse_res,
89182 .clock_get = posix_get_monotonic_coarse,
89183 };
89184 - struct k_clock clock_tai = {
89185 + static struct k_clock clock_tai = {
89186 .clock_getres = hrtimer_get_res,
89187 .clock_get = posix_get_tai,
89188 .nsleep = common_nsleep,
89189 @@ -319,7 +320,7 @@ static __init int init_posix_timers(void)
89190 .timer_get = common_timer_get,
89191 .timer_del = common_timer_del,
89192 };
89193 - struct k_clock clock_boottime = {
89194 + static struct k_clock clock_boottime = {
89195 .clock_getres = hrtimer_get_res,
89196 .clock_get = posix_get_boottime,
89197 .nsleep = common_nsleep,
89198 @@ -531,7 +532,7 @@ void posix_timers_register_clock(const clockid_t clock_id,
89199 return;
89200 }
89201
89202 - posix_clocks[clock_id] = *new_clock;
89203 + posix_clocks[clock_id] = new_clock;
89204 }
89205 EXPORT_SYMBOL_GPL(posix_timers_register_clock);
89206
89207 @@ -577,9 +578,9 @@ static struct k_clock *clockid_to_kclock(const clockid_t id)
89208 return (id & CLOCKFD_MASK) == CLOCKFD ?
89209 &clock_posix_dynamic : &clock_posix_cpu;
89210
89211 - if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
89212 + if (id >= MAX_CLOCKS || !posix_clocks[id] || !posix_clocks[id]->clock_getres)
89213 return NULL;
89214 - return &posix_clocks[id];
89215 + return posix_clocks[id];
89216 }
89217
89218 static int common_timer_create(struct k_itimer *new_timer)
89219 @@ -597,7 +598,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
89220 struct k_clock *kc = clockid_to_kclock(which_clock);
89221 struct k_itimer *new_timer;
89222 int error, new_timer_id;
89223 - sigevent_t event;
89224 + sigevent_t event = { };
89225 int it_id_set = IT_ID_NOT_SET;
89226
89227 if (!kc)
89228 @@ -1011,6 +1012,13 @@ SYSCALL_DEFINE2(clock_settime, const clockid_t, which_clock,
89229 if (copy_from_user(&new_tp, tp, sizeof (*tp)))
89230 return -EFAULT;
89231
89232 + /* only the CLOCK_REALTIME clock can be set, all other clocks
89233 + have their clock_set fptr set to a nosettime dummy function
89234 + CLOCK_REALTIME has a NULL clock_set fptr which causes it to
89235 + call common_clock_set, which calls do_sys_settimeofday, which
89236 + we hook
89237 + */
89238 +
89239 return kc->clock_set(which_clock, &new_tp);
89240 }
89241
89242 diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
89243 index 2fac9cc..56fef29 100644
89244 --- a/kernel/power/Kconfig
89245 +++ b/kernel/power/Kconfig
89246 @@ -24,6 +24,8 @@ config HIBERNATE_CALLBACKS
89247 config HIBERNATION
89248 bool "Hibernation (aka 'suspend to disk')"
89249 depends on SWAP && ARCH_HIBERNATION_POSSIBLE
89250 + depends on !GRKERNSEC_KMEM
89251 + depends on !PAX_MEMORY_SANITIZE
89252 select HIBERNATE_CALLBACKS
89253 select LZO_COMPRESS
89254 select LZO_DECOMPRESS
89255 diff --git a/kernel/power/process.c b/kernel/power/process.c
89256 index 06ec886..9dba35e 100644
89257 --- a/kernel/power/process.c
89258 +++ b/kernel/power/process.c
89259 @@ -34,6 +34,7 @@ static int try_to_freeze_tasks(bool user_only)
89260 unsigned int elapsed_msecs;
89261 bool wakeup = false;
89262 int sleep_usecs = USEC_PER_MSEC;
89263 + bool timedout = false;
89264
89265 do_gettimeofday(&start);
89266
89267 @@ -44,13 +45,20 @@ static int try_to_freeze_tasks(bool user_only)
89268
89269 while (true) {
89270 todo = 0;
89271 + if (time_after(jiffies, end_time))
89272 + timedout = true;
89273 read_lock(&tasklist_lock);
89274 do_each_thread(g, p) {
89275 if (p == current || !freeze_task(p))
89276 continue;
89277
89278 - if (!freezer_should_skip(p))
89279 + if (!freezer_should_skip(p)) {
89280 todo++;
89281 + if (timedout) {
89282 + printk(KERN_ERR "Task refusing to freeze:\n");
89283 + sched_show_task(p);
89284 + }
89285 + }
89286 } while_each_thread(g, p);
89287 read_unlock(&tasklist_lock);
89288
89289 @@ -59,7 +67,7 @@ static int try_to_freeze_tasks(bool user_only)
89290 todo += wq_busy;
89291 }
89292
89293 - if (!todo || time_after(jiffies, end_time))
89294 + if (!todo || timedout)
89295 break;
89296
89297 if (pm_wakeup_pending()) {
89298 diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
89299 index 4dae9cb..039ffbb 100644
89300 --- a/kernel/printk/printk.c
89301 +++ b/kernel/printk/printk.c
89302 @@ -385,6 +385,11 @@ static int check_syslog_permissions(int type, bool from_file)
89303 if (from_file && type != SYSLOG_ACTION_OPEN)
89304 return 0;
89305
89306 +#ifdef CONFIG_GRKERNSEC_DMESG
89307 + if (grsec_enable_dmesg && !capable(CAP_SYSLOG) && !capable_nolog(CAP_SYS_ADMIN))
89308 + return -EPERM;
89309 +#endif
89310 +
89311 if (syslog_action_restricted(type)) {
89312 if (capable(CAP_SYSLOG))
89313 return 0;
89314 diff --git a/kernel/profile.c b/kernel/profile.c
89315 index ebdd9c1..612ee05 100644
89316 --- a/kernel/profile.c
89317 +++ b/kernel/profile.c
89318 @@ -37,7 +37,7 @@ struct profile_hit {
89319 #define NR_PROFILE_HIT (PAGE_SIZE/sizeof(struct profile_hit))
89320 #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ)
89321
89322 -static atomic_t *prof_buffer;
89323 +static atomic_unchecked_t *prof_buffer;
89324 static unsigned long prof_len, prof_shift;
89325
89326 int prof_on __read_mostly;
89327 @@ -260,7 +260,7 @@ static void profile_flip_buffers(void)
89328 hits[i].pc = 0;
89329 continue;
89330 }
89331 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
89332 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
89333 hits[i].hits = hits[i].pc = 0;
89334 }
89335 }
89336 @@ -321,9 +321,9 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
89337 * Add the current hit(s) and flush the write-queue out
89338 * to the global buffer:
89339 */
89340 - atomic_add(nr_hits, &prof_buffer[pc]);
89341 + atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
89342 for (i = 0; i < NR_PROFILE_HIT; ++i) {
89343 - atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
89344 + atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
89345 hits[i].pc = hits[i].hits = 0;
89346 }
89347 out:
89348 @@ -398,7 +398,7 @@ static void do_profile_hits(int type, void *__pc, unsigned int nr_hits)
89349 {
89350 unsigned long pc;
89351 pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
89352 - atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
89353 + atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
89354 }
89355 #endif /* !CONFIG_SMP */
89356
89357 @@ -494,7 +494,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos)
89358 return -EFAULT;
89359 buf++; p++; count--; read++;
89360 }
89361 - pnt = (char *)prof_buffer + p - sizeof(atomic_t);
89362 + pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
89363 if (copy_to_user(buf, (void *)pnt, count))
89364 return -EFAULT;
89365 read += count;
89366 @@ -525,7 +525,7 @@ static ssize_t write_profile(struct file *file, const char __user *buf,
89367 }
89368 #endif
89369 profile_discard_flip_buffers();
89370 - memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
89371 + memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
89372 return count;
89373 }
89374
89375 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
89376 index 1f4bcb3..99cf7ab 100644
89377 --- a/kernel/ptrace.c
89378 +++ b/kernel/ptrace.c
89379 @@ -327,7 +327,7 @@ static int ptrace_attach(struct task_struct *task, long request,
89380 if (seize)
89381 flags |= PT_SEIZED;
89382 rcu_read_lock();
89383 - if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
89384 + if (ns_capable_nolog(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
89385 flags |= PT_PTRACE_CAP;
89386 rcu_read_unlock();
89387 task->ptrace = flags;
89388 @@ -538,7 +538,7 @@ int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __user *dst
89389 break;
89390 return -EIO;
89391 }
89392 - if (copy_to_user(dst, buf, retval))
89393 + if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
89394 return -EFAULT;
89395 copied += retval;
89396 src += retval;
89397 @@ -806,7 +806,7 @@ int ptrace_request(struct task_struct *child, long request,
89398 bool seized = child->ptrace & PT_SEIZED;
89399 int ret = -EIO;
89400 siginfo_t siginfo, *si;
89401 - void __user *datavp = (void __user *) data;
89402 + void __user *datavp = (__force void __user *) data;
89403 unsigned long __user *datalp = datavp;
89404 unsigned long flags;
89405
89406 @@ -1052,14 +1052,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
89407 goto out;
89408 }
89409
89410 + if (gr_handle_ptrace(child, request)) {
89411 + ret = -EPERM;
89412 + goto out_put_task_struct;
89413 + }
89414 +
89415 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
89416 ret = ptrace_attach(child, request, addr, data);
89417 /*
89418 * Some architectures need to do book-keeping after
89419 * a ptrace attach.
89420 */
89421 - if (!ret)
89422 + if (!ret) {
89423 arch_ptrace_attach(child);
89424 + gr_audit_ptrace(child);
89425 + }
89426 goto out_put_task_struct;
89427 }
89428
89429 @@ -1087,7 +1094,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
89430 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
89431 if (copied != sizeof(tmp))
89432 return -EIO;
89433 - return put_user(tmp, (unsigned long __user *)data);
89434 + return put_user(tmp, (__force unsigned long __user *)data);
89435 }
89436
89437 int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
89438 @@ -1181,7 +1188,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
89439 }
89440
89441 asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
89442 - compat_long_t addr, compat_long_t data)
89443 + compat_ulong_t addr, compat_ulong_t data)
89444 {
89445 struct task_struct *child;
89446 long ret;
89447 @@ -1197,14 +1204,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
89448 goto out;
89449 }
89450
89451 + if (gr_handle_ptrace(child, request)) {
89452 + ret = -EPERM;
89453 + goto out_put_task_struct;
89454 + }
89455 +
89456 if (request == PTRACE_ATTACH || request == PTRACE_SEIZE) {
89457 ret = ptrace_attach(child, request, addr, data);
89458 /*
89459 * Some architectures need to do book-keeping after
89460 * a ptrace attach.
89461 */
89462 - if (!ret)
89463 + if (!ret) {
89464 arch_ptrace_attach(child);
89465 + gr_audit_ptrace(child);
89466 + }
89467 goto out_put_task_struct;
89468 }
89469
89470 diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
89471 index 3318d82..1a5b2d1 100644
89472 --- a/kernel/rcu/srcu.c
89473 +++ b/kernel/rcu/srcu.c
89474 @@ -300,9 +300,9 @@ int __srcu_read_lock(struct srcu_struct *sp)
89475
89476 idx = ACCESS_ONCE(sp->completed) & 0x1;
89477 preempt_disable();
89478 - ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
89479 + ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
89480 smp_mb(); /* B */ /* Avoid leaking the critical section. */
89481 - ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
89482 + ACCESS_ONCE_RW(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
89483 preempt_enable();
89484 return idx;
89485 }
89486 diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
89487 index 1254f31..16258dc 100644
89488 --- a/kernel/rcu/tiny.c
89489 +++ b/kernel/rcu/tiny.c
89490 @@ -46,7 +46,7 @@
89491 /* Forward declarations for tiny_plugin.h. */
89492 struct rcu_ctrlblk;
89493 static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp);
89494 -static void rcu_process_callbacks(struct softirq_action *unused);
89495 +static void rcu_process_callbacks(void);
89496 static void __call_rcu(struct rcu_head *head,
89497 void (*func)(struct rcu_head *rcu),
89498 struct rcu_ctrlblk *rcp);
89499 @@ -312,7 +312,7 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
89500 false));
89501 }
89502
89503 -static void rcu_process_callbacks(struct softirq_action *unused)
89504 +static __latent_entropy void rcu_process_callbacks(void)
89505 {
89506 __rcu_process_callbacks(&rcu_sched_ctrlblk);
89507 __rcu_process_callbacks(&rcu_bh_ctrlblk);
89508 diff --git a/kernel/rcu/torture.c b/kernel/rcu/torture.c
89509 index 732f8ae..42c1919 100644
89510 --- a/kernel/rcu/torture.c
89511 +++ b/kernel/rcu/torture.c
89512 @@ -174,12 +174,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_count) =
89513 { 0 };
89514 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
89515 { 0 };
89516 -static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
89517 -static atomic_t n_rcu_torture_alloc;
89518 -static atomic_t n_rcu_torture_alloc_fail;
89519 -static atomic_t n_rcu_torture_free;
89520 -static atomic_t n_rcu_torture_mberror;
89521 -static atomic_t n_rcu_torture_error;
89522 +static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
89523 +static atomic_unchecked_t n_rcu_torture_alloc;
89524 +static atomic_unchecked_t n_rcu_torture_alloc_fail;
89525 +static atomic_unchecked_t n_rcu_torture_free;
89526 +static atomic_unchecked_t n_rcu_torture_mberror;
89527 +static atomic_unchecked_t n_rcu_torture_error;
89528 static long n_rcu_torture_barrier_error;
89529 static long n_rcu_torture_boost_ktrerror;
89530 static long n_rcu_torture_boost_rterror;
89531 @@ -297,11 +297,11 @@ rcu_torture_alloc(void)
89532
89533 spin_lock_bh(&rcu_torture_lock);
89534 if (list_empty(&rcu_torture_freelist)) {
89535 - atomic_inc(&n_rcu_torture_alloc_fail);
89536 + atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
89537 spin_unlock_bh(&rcu_torture_lock);
89538 return NULL;
89539 }
89540 - atomic_inc(&n_rcu_torture_alloc);
89541 + atomic_inc_unchecked(&n_rcu_torture_alloc);
89542 p = rcu_torture_freelist.next;
89543 list_del_init(p);
89544 spin_unlock_bh(&rcu_torture_lock);
89545 @@ -314,7 +314,7 @@ rcu_torture_alloc(void)
89546 static void
89547 rcu_torture_free(struct rcu_torture *p)
89548 {
89549 - atomic_inc(&n_rcu_torture_free);
89550 + atomic_inc_unchecked(&n_rcu_torture_free);
89551 spin_lock_bh(&rcu_torture_lock);
89552 list_add_tail(&p->rtort_free, &rcu_torture_freelist);
89553 spin_unlock_bh(&rcu_torture_lock);
89554 @@ -435,7 +435,7 @@ rcu_torture_cb(struct rcu_head *p)
89555 i = rp->rtort_pipe_count;
89556 if (i > RCU_TORTURE_PIPE_LEN)
89557 i = RCU_TORTURE_PIPE_LEN;
89558 - atomic_inc(&rcu_torture_wcount[i]);
89559 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
89560 if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
89561 rp->rtort_mbtest = 0;
89562 rcu_torture_free(rp);
89563 @@ -823,7 +823,7 @@ rcu_torture_writer(void *arg)
89564 i = old_rp->rtort_pipe_count;
89565 if (i > RCU_TORTURE_PIPE_LEN)
89566 i = RCU_TORTURE_PIPE_LEN;
89567 - atomic_inc(&rcu_torture_wcount[i]);
89568 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
89569 old_rp->rtort_pipe_count++;
89570 if (gp_normal == gp_exp)
89571 exp = !!(rcu_random(&rand) & 0x80);
89572 @@ -841,7 +841,7 @@ rcu_torture_writer(void *arg)
89573 i = rp->rtort_pipe_count;
89574 if (i > RCU_TORTURE_PIPE_LEN)
89575 i = RCU_TORTURE_PIPE_LEN;
89576 - atomic_inc(&rcu_torture_wcount[i]);
89577 + atomic_inc_unchecked(&rcu_torture_wcount[i]);
89578 if (++rp->rtort_pipe_count >=
89579 RCU_TORTURE_PIPE_LEN) {
89580 rp->rtort_mbtest = 0;
89581 @@ -940,7 +940,7 @@ static void rcu_torture_timer(unsigned long unused)
89582 return;
89583 }
89584 if (p->rtort_mbtest == 0)
89585 - atomic_inc(&n_rcu_torture_mberror);
89586 + atomic_inc_unchecked(&n_rcu_torture_mberror);
89587 spin_lock(&rand_lock);
89588 cur_ops->read_delay(&rand);
89589 n_rcu_torture_timers++;
89590 @@ -1010,7 +1010,7 @@ rcu_torture_reader(void *arg)
89591 continue;
89592 }
89593 if (p->rtort_mbtest == 0)
89594 - atomic_inc(&n_rcu_torture_mberror);
89595 + atomic_inc_unchecked(&n_rcu_torture_mberror);
89596 cur_ops->read_delay(&rand);
89597 preempt_disable();
89598 pipe_count = p->rtort_pipe_count;
89599 @@ -1068,15 +1068,15 @@ rcu_torture_printk(char *page)
89600 }
89601 page += sprintf(page, "%s%s ", torture_type, TORTURE_FLAG);
89602 page += sprintf(page,
89603 - "rtc: %p ver: %lu tfle: %d rta: %d rtaf: %d rtf: %d ",
89604 + "rtc: %pP ver: %lu tfle: %d rta: %d rtaf: %d rtf: %d ",
89605 rcu_torture_current,
89606 rcu_torture_current_version,
89607 list_empty(&rcu_torture_freelist),
89608 - atomic_read(&n_rcu_torture_alloc),
89609 - atomic_read(&n_rcu_torture_alloc_fail),
89610 - atomic_read(&n_rcu_torture_free));
89611 + atomic_read_unchecked(&n_rcu_torture_alloc),
89612 + atomic_read_unchecked(&n_rcu_torture_alloc_fail),
89613 + atomic_read_unchecked(&n_rcu_torture_free));
89614 page += sprintf(page, "rtmbe: %d rtbke: %ld rtbre: %ld ",
89615 - atomic_read(&n_rcu_torture_mberror),
89616 + atomic_read_unchecked(&n_rcu_torture_mberror),
89617 n_rcu_torture_boost_ktrerror,
89618 n_rcu_torture_boost_rterror);
89619 page += sprintf(page, "rtbf: %ld rtb: %ld nt: %ld ",
89620 @@ -1095,14 +1095,14 @@ rcu_torture_printk(char *page)
89621 n_barrier_attempts,
89622 n_rcu_torture_barrier_error);
89623 page += sprintf(page, "\n%s%s ", torture_type, TORTURE_FLAG);
89624 - if (atomic_read(&n_rcu_torture_mberror) != 0 ||
89625 + if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
89626 n_rcu_torture_barrier_error != 0 ||
89627 n_rcu_torture_boost_ktrerror != 0 ||
89628 n_rcu_torture_boost_rterror != 0 ||
89629 n_rcu_torture_boost_failure != 0 ||
89630 i > 1) {
89631 page += sprintf(page, "!!! ");
89632 - atomic_inc(&n_rcu_torture_error);
89633 + atomic_inc_unchecked(&n_rcu_torture_error);
89634 WARN_ON_ONCE(1);
89635 }
89636 page += sprintf(page, "Reader Pipe: ");
89637 @@ -1116,7 +1116,7 @@ rcu_torture_printk(char *page)
89638 page += sprintf(page, "Free-Block Circulation: ");
89639 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
89640 page += sprintf(page, " %d",
89641 - atomic_read(&rcu_torture_wcount[i]));
89642 + atomic_read_unchecked(&rcu_torture_wcount[i]));
89643 }
89644 page += sprintf(page, "\n");
89645 if (cur_ops->stats)
89646 @@ -1839,7 +1839,7 @@ rcu_torture_cleanup(void)
89647
89648 rcu_torture_stats_print(); /* -After- the stats thread is stopped! */
89649
89650 - if (atomic_read(&n_rcu_torture_error) || n_rcu_torture_barrier_error)
89651 + if (atomic_read_unchecked(&n_rcu_torture_error) || n_rcu_torture_barrier_error)
89652 rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
89653 else if (n_online_successes != n_online_attempts ||
89654 n_offline_successes != n_offline_attempts)
89655 @@ -1961,18 +1961,18 @@ rcu_torture_init(void)
89656
89657 rcu_torture_current = NULL;
89658 rcu_torture_current_version = 0;
89659 - atomic_set(&n_rcu_torture_alloc, 0);
89660 - atomic_set(&n_rcu_torture_alloc_fail, 0);
89661 - atomic_set(&n_rcu_torture_free, 0);
89662 - atomic_set(&n_rcu_torture_mberror, 0);
89663 - atomic_set(&n_rcu_torture_error, 0);
89664 + atomic_set_unchecked(&n_rcu_torture_alloc, 0);
89665 + atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
89666 + atomic_set_unchecked(&n_rcu_torture_free, 0);
89667 + atomic_set_unchecked(&n_rcu_torture_mberror, 0);
89668 + atomic_set_unchecked(&n_rcu_torture_error, 0);
89669 n_rcu_torture_barrier_error = 0;
89670 n_rcu_torture_boost_ktrerror = 0;
89671 n_rcu_torture_boost_rterror = 0;
89672 n_rcu_torture_boost_failure = 0;
89673 n_rcu_torture_boosts = 0;
89674 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
89675 - atomic_set(&rcu_torture_wcount[i], 0);
89676 + atomic_set_unchecked(&rcu_torture_wcount[i], 0);
89677 for_each_possible_cpu(cpu) {
89678 for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
89679 per_cpu(rcu_torture_count, cpu)[i] = 0;
89680 diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
89681 index b3d116c..ebf6598 100644
89682 --- a/kernel/rcu/tree.c
89683 +++ b/kernel/rcu/tree.c
89684 @@ -390,9 +390,9 @@ static void rcu_eqs_enter_common(struct rcu_dynticks *rdtp, long long oldval,
89685 rcu_prepare_for_idle(smp_processor_id());
89686 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
89687 smp_mb__before_atomic_inc(); /* See above. */
89688 - atomic_inc(&rdtp->dynticks);
89689 + atomic_inc_unchecked(&rdtp->dynticks);
89690 smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */
89691 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
89692 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
89693
89694 /*
89695 * It is illegal to enter an extended quiescent state while
89696 @@ -510,10 +510,10 @@ static void rcu_eqs_exit_common(struct rcu_dynticks *rdtp, long long oldval,
89697 int user)
89698 {
89699 smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */
89700 - atomic_inc(&rdtp->dynticks);
89701 + atomic_inc_unchecked(&rdtp->dynticks);
89702 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
89703 smp_mb__after_atomic_inc(); /* See above. */
89704 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
89705 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
89706 rcu_cleanup_after_idle(smp_processor_id());
89707 trace_rcu_dyntick(TPS("End"), oldval, rdtp->dynticks_nesting);
89708 if (!user && !is_idle_task(current)) {
89709 @@ -634,14 +634,14 @@ void rcu_nmi_enter(void)
89710 struct rcu_dynticks *rdtp = this_cpu_ptr(&rcu_dynticks);
89711
89712 if (rdtp->dynticks_nmi_nesting == 0 &&
89713 - (atomic_read(&rdtp->dynticks) & 0x1))
89714 + (atomic_read_unchecked(&rdtp->dynticks) & 0x1))
89715 return;
89716 rdtp->dynticks_nmi_nesting++;
89717 smp_mb__before_atomic_inc(); /* Force delay from prior write. */
89718 - atomic_inc(&rdtp->dynticks);
89719 + atomic_inc_unchecked(&rdtp->dynticks);
89720 /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */
89721 smp_mb__after_atomic_inc(); /* See above. */
89722 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1));
89723 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1));
89724 }
89725
89726 /**
89727 @@ -660,9 +660,9 @@ void rcu_nmi_exit(void)
89728 return;
89729 /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
89730 smp_mb__before_atomic_inc(); /* See above. */
89731 - atomic_inc(&rdtp->dynticks);
89732 + atomic_inc_unchecked(&rdtp->dynticks);
89733 smp_mb__after_atomic_inc(); /* Force delay to next write. */
89734 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1);
89735 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1);
89736 }
89737
89738 /**
89739 @@ -675,7 +675,7 @@ void rcu_nmi_exit(void)
89740 */
89741 bool notrace __rcu_is_watching(void)
89742 {
89743 - return atomic_read(this_cpu_ptr(&rcu_dynticks.dynticks)) & 0x1;
89744 + return atomic_read_unchecked(this_cpu_ptr(&rcu_dynticks.dynticks)) & 0x1;
89745 }
89746
89747 /**
89748 @@ -758,7 +758,7 @@ static int rcu_is_cpu_rrupt_from_idle(void)
89749 static int dyntick_save_progress_counter(struct rcu_data *rdp,
89750 bool *isidle, unsigned long *maxj)
89751 {
89752 - rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks);
89753 + rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
89754 rcu_sysidle_check_cpu(rdp, isidle, maxj);
89755 return (rdp->dynticks_snap & 0x1) == 0;
89756 }
89757 @@ -781,7 +781,7 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp,
89758 unsigned int curr;
89759 unsigned int snap;
89760
89761 - curr = (unsigned int)atomic_add_return(0, &rdp->dynticks->dynticks);
89762 + curr = (unsigned int)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks);
89763 snap = (unsigned int)rdp->dynticks_snap;
89764
89765 /*
89766 @@ -1450,9 +1450,9 @@ static int rcu_gp_init(struct rcu_state *rsp)
89767 rdp = this_cpu_ptr(rsp->rda);
89768 rcu_preempt_check_blocked_tasks(rnp);
89769 rnp->qsmask = rnp->qsmaskinit;
89770 - ACCESS_ONCE(rnp->gpnum) = rsp->gpnum;
89771 + ACCESS_ONCE_RW(rnp->gpnum) = rsp->gpnum;
89772 WARN_ON_ONCE(rnp->completed != rsp->completed);
89773 - ACCESS_ONCE(rnp->completed) = rsp->completed;
89774 + ACCESS_ONCE_RW(rnp->completed) = rsp->completed;
89775 if (rnp == rdp->mynode)
89776 __note_gp_changes(rsp, rnp, rdp);
89777 rcu_preempt_boost_start_gp(rnp);
89778 @@ -1546,7 +1546,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
89779 rcu_for_each_node_breadth_first(rsp, rnp) {
89780 raw_spin_lock_irq(&rnp->lock);
89781 smp_mb__after_unlock_lock();
89782 - ACCESS_ONCE(rnp->completed) = rsp->gpnum;
89783 + ACCESS_ONCE_RW(rnp->completed) = rsp->gpnum;
89784 rdp = this_cpu_ptr(rsp->rda);
89785 if (rnp == rdp->mynode)
89786 __note_gp_changes(rsp, rnp, rdp);
89787 @@ -1912,7 +1912,7 @@ rcu_send_cbs_to_orphanage(int cpu, struct rcu_state *rsp,
89788 rsp->qlen += rdp->qlen;
89789 rdp->n_cbs_orphaned += rdp->qlen;
89790 rdp->qlen_lazy = 0;
89791 - ACCESS_ONCE(rdp->qlen) = 0;
89792 + ACCESS_ONCE_RW(rdp->qlen) = 0;
89793 }
89794
89795 /*
89796 @@ -2159,7 +2159,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
89797 }
89798 smp_mb(); /* List handling before counting for rcu_barrier(). */
89799 rdp->qlen_lazy -= count_lazy;
89800 - ACCESS_ONCE(rdp->qlen) -= count;
89801 + ACCESS_ONCE_RW(rdp->qlen) -= count;
89802 rdp->n_cbs_invoked += count;
89803
89804 /* Reinstate batch limit if we have worked down the excess. */
89805 @@ -2362,7 +2362,7 @@ __rcu_process_callbacks(struct rcu_state *rsp)
89806 /*
89807 * Do RCU core processing for the current CPU.
89808 */
89809 -static void rcu_process_callbacks(struct softirq_action *unused)
89810 +static void rcu_process_callbacks(void)
89811 {
89812 struct rcu_state *rsp;
89813
89814 @@ -2470,7 +2470,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
89815 WARN_ON_ONCE((unsigned long)head & 0x3); /* Misaligned rcu_head! */
89816 if (debug_rcu_head_queue(head)) {
89817 /* Probable double call_rcu(), so leak the callback. */
89818 - ACCESS_ONCE(head->func) = rcu_leak_callback;
89819 + ACCESS_ONCE_RW(head->func) = rcu_leak_callback;
89820 WARN_ONCE(1, "__call_rcu(): Leaked duplicate callback\n");
89821 return;
89822 }
89823 @@ -2498,7 +2498,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
89824 local_irq_restore(flags);
89825 return;
89826 }
89827 - ACCESS_ONCE(rdp->qlen)++;
89828 + ACCESS_ONCE_RW(rdp->qlen)++;
89829 if (lazy)
89830 rdp->qlen_lazy++;
89831 else
89832 @@ -2707,11 +2707,11 @@ void synchronize_sched_expedited(void)
89833 * counter wrap on a 32-bit system. Quite a few more CPUs would of
89834 * course be required on a 64-bit system.
89835 */
89836 - if (ULONG_CMP_GE((ulong)atomic_long_read(&rsp->expedited_start),
89837 + if (ULONG_CMP_GE((ulong)atomic_long_read_unchecked(&rsp->expedited_start),
89838 (ulong)atomic_long_read(&rsp->expedited_done) +
89839 ULONG_MAX / 8)) {
89840 synchronize_sched();
89841 - atomic_long_inc(&rsp->expedited_wrap);
89842 + atomic_long_inc_unchecked(&rsp->expedited_wrap);
89843 return;
89844 }
89845
89846 @@ -2719,7 +2719,7 @@ void synchronize_sched_expedited(void)
89847 * Take a ticket. Note that atomic_inc_return() implies a
89848 * full memory barrier.
89849 */
89850 - snap = atomic_long_inc_return(&rsp->expedited_start);
89851 + snap = atomic_long_inc_return_unchecked(&rsp->expedited_start);
89852 firstsnap = snap;
89853 get_online_cpus();
89854 WARN_ON_ONCE(cpu_is_offline(raw_smp_processor_id()));
89855 @@ -2732,14 +2732,14 @@ void synchronize_sched_expedited(void)
89856 synchronize_sched_expedited_cpu_stop,
89857 NULL) == -EAGAIN) {
89858 put_online_cpus();
89859 - atomic_long_inc(&rsp->expedited_tryfail);
89860 + atomic_long_inc_unchecked(&rsp->expedited_tryfail);
89861
89862 /* Check to see if someone else did our work for us. */
89863 s = atomic_long_read(&rsp->expedited_done);
89864 if (ULONG_CMP_GE((ulong)s, (ulong)firstsnap)) {
89865 /* ensure test happens before caller kfree */
89866 smp_mb__before_atomic_inc(); /* ^^^ */
89867 - atomic_long_inc(&rsp->expedited_workdone1);
89868 + atomic_long_inc_unchecked(&rsp->expedited_workdone1);
89869 return;
89870 }
89871
89872 @@ -2748,7 +2748,7 @@ void synchronize_sched_expedited(void)
89873 udelay(trycount * num_online_cpus());
89874 } else {
89875 wait_rcu_gp(call_rcu_sched);
89876 - atomic_long_inc(&rsp->expedited_normal);
89877 + atomic_long_inc_unchecked(&rsp->expedited_normal);
89878 return;
89879 }
89880
89881 @@ -2757,7 +2757,7 @@ void synchronize_sched_expedited(void)
89882 if (ULONG_CMP_GE((ulong)s, (ulong)firstsnap)) {
89883 /* ensure test happens before caller kfree */
89884 smp_mb__before_atomic_inc(); /* ^^^ */
89885 - atomic_long_inc(&rsp->expedited_workdone2);
89886 + atomic_long_inc_unchecked(&rsp->expedited_workdone2);
89887 return;
89888 }
89889
89890 @@ -2769,10 +2769,10 @@ void synchronize_sched_expedited(void)
89891 * period works for us.
89892 */
89893 get_online_cpus();
89894 - snap = atomic_long_read(&rsp->expedited_start);
89895 + snap = atomic_long_read_unchecked(&rsp->expedited_start);
89896 smp_mb(); /* ensure read is before try_stop_cpus(). */
89897 }
89898 - atomic_long_inc(&rsp->expedited_stoppedcpus);
89899 + atomic_long_inc_unchecked(&rsp->expedited_stoppedcpus);
89900
89901 /*
89902 * Everyone up to our most recent fetch is covered by our grace
89903 @@ -2781,16 +2781,16 @@ void synchronize_sched_expedited(void)
89904 * than we did already did their update.
89905 */
89906 do {
89907 - atomic_long_inc(&rsp->expedited_done_tries);
89908 + atomic_long_inc_unchecked(&rsp->expedited_done_tries);
89909 s = atomic_long_read(&rsp->expedited_done);
89910 if (ULONG_CMP_GE((ulong)s, (ulong)snap)) {
89911 /* ensure test happens before caller kfree */
89912 smp_mb__before_atomic_inc(); /* ^^^ */
89913 - atomic_long_inc(&rsp->expedited_done_lost);
89914 + atomic_long_inc_unchecked(&rsp->expedited_done_lost);
89915 break;
89916 }
89917 } while (atomic_long_cmpxchg(&rsp->expedited_done, s, snap) != s);
89918 - atomic_long_inc(&rsp->expedited_done_exit);
89919 + atomic_long_inc_unchecked(&rsp->expedited_done_exit);
89920
89921 put_online_cpus();
89922 }
89923 @@ -2996,7 +2996,7 @@ static void _rcu_barrier(struct rcu_state *rsp)
89924 * ACCESS_ONCE() to prevent the compiler from speculating
89925 * the increment to precede the early-exit check.
89926 */
89927 - ACCESS_ONCE(rsp->n_barrier_done)++;
89928 + ACCESS_ONCE_RW(rsp->n_barrier_done)++;
89929 WARN_ON_ONCE((rsp->n_barrier_done & 0x1) != 1);
89930 _rcu_barrier_trace(rsp, "Inc1", -1, rsp->n_barrier_done);
89931 smp_mb(); /* Order ->n_barrier_done increment with below mechanism. */
89932 @@ -3046,7 +3046,7 @@ static void _rcu_barrier(struct rcu_state *rsp)
89933
89934 /* Increment ->n_barrier_done to prevent duplicate work. */
89935 smp_mb(); /* Keep increment after above mechanism. */
89936 - ACCESS_ONCE(rsp->n_barrier_done)++;
89937 + ACCESS_ONCE_RW(rsp->n_barrier_done)++;
89938 WARN_ON_ONCE((rsp->n_barrier_done & 0x1) != 0);
89939 _rcu_barrier_trace(rsp, "Inc2", -1, rsp->n_barrier_done);
89940 smp_mb(); /* Keep increment before caller's subsequent code. */
89941 @@ -3091,10 +3091,10 @@ rcu_boot_init_percpu_data(int cpu, struct rcu_state *rsp)
89942 rdp->grpmask = 1UL << (cpu - rdp->mynode->grplo);
89943 init_callback_list(rdp);
89944 rdp->qlen_lazy = 0;
89945 - ACCESS_ONCE(rdp->qlen) = 0;
89946 + ACCESS_ONCE_RW(rdp->qlen) = 0;
89947 rdp->dynticks = &per_cpu(rcu_dynticks, cpu);
89948 WARN_ON_ONCE(rdp->dynticks->dynticks_nesting != DYNTICK_TASK_EXIT_IDLE);
89949 - WARN_ON_ONCE(atomic_read(&rdp->dynticks->dynticks) != 1);
89950 + WARN_ON_ONCE(atomic_read_unchecked(&rdp->dynticks->dynticks) != 1);
89951 rdp->cpu = cpu;
89952 rdp->rsp = rsp;
89953 rcu_boot_init_nocb_percpu_data(rdp);
89954 @@ -3128,8 +3128,8 @@ rcu_init_percpu_data(int cpu, struct rcu_state *rsp, int preemptible)
89955 init_callback_list(rdp); /* Re-enable callbacks on this CPU. */
89956 rdp->dynticks->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
89957 rcu_sysidle_init_percpu_data(rdp->dynticks);
89958 - atomic_set(&rdp->dynticks->dynticks,
89959 - (atomic_read(&rdp->dynticks->dynticks) & ~0x1) + 1);
89960 + atomic_set_unchecked(&rdp->dynticks->dynticks,
89961 + (atomic_read_unchecked(&rdp->dynticks->dynticks) & ~0x1) + 1);
89962 raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
89963
89964 /* Add CPU to rcu_node bitmasks. */
89965 diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
89966 index 8c19873..bf83c57 100644
89967 --- a/kernel/rcu/tree.h
89968 +++ b/kernel/rcu/tree.h
89969 @@ -87,11 +87,11 @@ struct rcu_dynticks {
89970 long long dynticks_nesting; /* Track irq/process nesting level. */
89971 /* Process level is worth LLONG_MAX/2. */
89972 int dynticks_nmi_nesting; /* Track NMI nesting level. */
89973 - atomic_t dynticks; /* Even value for idle, else odd. */
89974 + atomic_unchecked_t dynticks;/* Even value for idle, else odd. */
89975 #ifdef CONFIG_NO_HZ_FULL_SYSIDLE
89976 long long dynticks_idle_nesting;
89977 /* irq/process nesting level from idle. */
89978 - atomic_t dynticks_idle; /* Even value for idle, else odd. */
89979 + atomic_unchecked_t dynticks_idle;/* Even value for idle, else odd. */
89980 /* "Idle" excludes userspace execution. */
89981 unsigned long dynticks_idle_jiffies;
89982 /* End of last non-NMI non-idle period. */
89983 @@ -431,17 +431,17 @@ struct rcu_state {
89984 /* _rcu_barrier(). */
89985 /* End of fields guarded by barrier_mutex. */
89986
89987 - atomic_long_t expedited_start; /* Starting ticket. */
89988 - atomic_long_t expedited_done; /* Done ticket. */
89989 - atomic_long_t expedited_wrap; /* # near-wrap incidents. */
89990 - atomic_long_t expedited_tryfail; /* # acquisition failures. */
89991 - atomic_long_t expedited_workdone1; /* # done by others #1. */
89992 - atomic_long_t expedited_workdone2; /* # done by others #2. */
89993 - atomic_long_t expedited_normal; /* # fallbacks to normal. */
89994 - atomic_long_t expedited_stoppedcpus; /* # successful stop_cpus. */
89995 - atomic_long_t expedited_done_tries; /* # tries to update _done. */
89996 - atomic_long_t expedited_done_lost; /* # times beaten to _done. */
89997 - atomic_long_t expedited_done_exit; /* # times exited _done loop. */
89998 + atomic_long_unchecked_t expedited_start; /* Starting ticket. */
89999 + atomic_long_t expedited_done; /* Done ticket. */
90000 + atomic_long_unchecked_t expedited_wrap; /* # near-wrap incidents. */
90001 + atomic_long_unchecked_t expedited_tryfail; /* # acquisition failures. */
90002 + atomic_long_unchecked_t expedited_workdone1; /* # done by others #1. */
90003 + atomic_long_unchecked_t expedited_workdone2; /* # done by others #2. */
90004 + atomic_long_unchecked_t expedited_normal; /* # fallbacks to normal. */
90005 + atomic_long_unchecked_t expedited_stoppedcpus; /* # successful stop_cpus. */
90006 + atomic_long_unchecked_t expedited_done_tries; /* # tries to update _done. */
90007 + atomic_long_unchecked_t expedited_done_lost; /* # times beaten to _done. */
90008 + atomic_long_unchecked_t expedited_done_exit; /* # times exited _done loop. */
90009
90010 unsigned long jiffies_force_qs; /* Time at which to invoke */
90011 /* force_quiescent_state(). */
90012 diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
90013 index 6e2ef4b..c15df94 100644
90014 --- a/kernel/rcu/tree_plugin.h
90015 +++ b/kernel/rcu/tree_plugin.h
90016 @@ -758,7 +758,7 @@ static int rcu_preempted_readers_exp(struct rcu_node *rnp)
90017 static int sync_rcu_preempt_exp_done(struct rcu_node *rnp)
90018 {
90019 return !rcu_preempted_readers_exp(rnp) &&
90020 - ACCESS_ONCE(rnp->expmask) == 0;
90021 + ACCESS_ONCE_RW(rnp->expmask) == 0;
90022 }
90023
90024 /*
90025 @@ -920,7 +920,7 @@ void synchronize_rcu_expedited(void)
90026
90027 /* Clean up and exit. */
90028 smp_mb(); /* ensure expedited GP seen before counter increment. */
90029 - ACCESS_ONCE(sync_rcu_preempt_exp_count)++;
90030 + ACCESS_ONCE_RW(sync_rcu_preempt_exp_count)++;
90031 unlock_mb_ret:
90032 mutex_unlock(&sync_rcu_preempt_exp_mutex);
90033 mb_ret:
90034 @@ -1496,7 +1496,7 @@ static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
90035 free_cpumask_var(cm);
90036 }
90037
90038 -static struct smp_hotplug_thread rcu_cpu_thread_spec = {
90039 +static struct smp_hotplug_thread rcu_cpu_thread_spec __read_only = {
90040 .store = &rcu_cpu_kthread_task,
90041 .thread_should_run = rcu_cpu_kthread_should_run,
90042 .thread_fn = rcu_cpu_kthread,
90043 @@ -1965,7 +1965,7 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu)
90044 print_cpu_stall_fast_no_hz(fast_no_hz, cpu);
90045 pr_err("\t%d: (%lu %s) idle=%03x/%llx/%d softirq=%u/%u %s\n",
90046 cpu, ticks_value, ticks_title,
90047 - atomic_read(&rdtp->dynticks) & 0xfff,
90048 + atomic_read_unchecked(&rdtp->dynticks) & 0xfff,
90049 rdtp->dynticks_nesting, rdtp->dynticks_nmi_nesting,
90050 rdp->softirq_snap, kstat_softirqs_cpu(RCU_SOFTIRQ, cpu),
90051 fast_no_hz);
90052 @@ -2129,7 +2129,7 @@ static void __call_rcu_nocb_enqueue(struct rcu_data *rdp,
90053
90054 /* Enqueue the callback on the nocb list and update counts. */
90055 old_rhpp = xchg(&rdp->nocb_tail, rhtp);
90056 - ACCESS_ONCE(*old_rhpp) = rhp;
90057 + ACCESS_ONCE_RW(*old_rhpp) = rhp;
90058 atomic_long_add(rhcount, &rdp->nocb_q_count);
90059 atomic_long_add(rhcount_lazy, &rdp->nocb_q_count_lazy);
90060
90061 @@ -2302,12 +2302,12 @@ static int rcu_nocb_kthread(void *arg)
90062 * Extract queued callbacks, update counts, and wait
90063 * for a grace period to elapse.
90064 */
90065 - ACCESS_ONCE(rdp->nocb_head) = NULL;
90066 + ACCESS_ONCE_RW(rdp->nocb_head) = NULL;
90067 tail = xchg(&rdp->nocb_tail, &rdp->nocb_head);
90068 c = atomic_long_xchg(&rdp->nocb_q_count, 0);
90069 cl = atomic_long_xchg(&rdp->nocb_q_count_lazy, 0);
90070 - ACCESS_ONCE(rdp->nocb_p_count) += c;
90071 - ACCESS_ONCE(rdp->nocb_p_count_lazy) += cl;
90072 + ACCESS_ONCE_RW(rdp->nocb_p_count) += c;
90073 + ACCESS_ONCE_RW(rdp->nocb_p_count_lazy) += cl;
90074 rcu_nocb_wait_gp(rdp);
90075
90076 /* Each pass through the following loop invokes a callback. */
90077 @@ -2333,8 +2333,8 @@ static int rcu_nocb_kthread(void *arg)
90078 list = next;
90079 }
90080 trace_rcu_batch_end(rdp->rsp->name, c, !!list, 0, 0, 1);
90081 - ACCESS_ONCE(rdp->nocb_p_count) -= c;
90082 - ACCESS_ONCE(rdp->nocb_p_count_lazy) -= cl;
90083 + ACCESS_ONCE_RW(rdp->nocb_p_count) -= c;
90084 + ACCESS_ONCE_RW(rdp->nocb_p_count_lazy) -= cl;
90085 rdp->n_nocbs_invoked += c;
90086 }
90087 return 0;
90088 @@ -2351,7 +2351,7 @@ static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
90089 {
90090 if (!rcu_nocb_need_deferred_wakeup(rdp))
90091 return;
90092 - ACCESS_ONCE(rdp->nocb_defer_wakeup) = false;
90093 + ACCESS_ONCE_RW(rdp->nocb_defer_wakeup) = false;
90094 wake_up(&rdp->nocb_wq);
90095 trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu, TPS("DeferredWakeEmpty"));
90096 }
90097 @@ -2377,7 +2377,7 @@ static void __init rcu_spawn_nocb_kthreads(struct rcu_state *rsp)
90098 t = kthread_run(rcu_nocb_kthread, rdp,
90099 "rcuo%c/%d", rsp->abbr, cpu);
90100 BUG_ON(IS_ERR(t));
90101 - ACCESS_ONCE(rdp->nocb_kthread) = t;
90102 + ACCESS_ONCE_RW(rdp->nocb_kthread) = t;
90103 }
90104 }
90105
90106 @@ -2513,11 +2513,11 @@ static void rcu_sysidle_enter(struct rcu_dynticks *rdtp, int irq)
90107
90108 /* Record start of fully idle period. */
90109 j = jiffies;
90110 - ACCESS_ONCE(rdtp->dynticks_idle_jiffies) = j;
90111 + ACCESS_ONCE_RW(rdtp->dynticks_idle_jiffies) = j;
90112 smp_mb__before_atomic_inc();
90113 - atomic_inc(&rdtp->dynticks_idle);
90114 + atomic_inc_unchecked(&rdtp->dynticks_idle);
90115 smp_mb__after_atomic_inc();
90116 - WARN_ON_ONCE(atomic_read(&rdtp->dynticks_idle) & 0x1);
90117 + WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks_idle) & 0x1);
90118 }
90119
90120 /*
90121 @@ -2582,9 +2582,9 @@ static void rcu_sysidle_exit(struct rcu_dynticks *rdtp, int irq)
90122
90123 /* Record end of idle period. */
90124 smp_mb__before_atomic_inc();
90125 - atomic_inc(&rdtp->dynticks_idle);
90126 + atomic_inc_unchecked(&rdtp->dynticks_idle);
90127 smp_mb__after_atomic_inc();
90128 - WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks_idle) & 0x1));
90129 + WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks_idle) & 0x1));
90130
90131 /*
90132 * If we are the timekeeping CPU, we are permitted to be non-idle
90133 @@ -2625,7 +2625,7 @@ static void rcu_sysidle_check_cpu(struct rcu_data *rdp, bool *isidle,
90134 WARN_ON_ONCE(smp_processor_id() != tick_do_timer_cpu);
90135
90136 /* Pick up current idle and NMI-nesting counter and check. */
90137 - cur = atomic_read(&rdtp->dynticks_idle);
90138 + cur = atomic_read_unchecked(&rdtp->dynticks_idle);
90139 if (cur & 0x1) {
90140 *isidle = false; /* We are not idle! */
90141 return;
90142 @@ -2688,7 +2688,7 @@ static void rcu_sysidle(unsigned long j)
90143 case RCU_SYSIDLE_NOT:
90144
90145 /* First time all are idle, so note a short idle period. */
90146 - ACCESS_ONCE(full_sysidle_state) = RCU_SYSIDLE_SHORT;
90147 + ACCESS_ONCE_RW(full_sysidle_state) = RCU_SYSIDLE_SHORT;
90148 break;
90149
90150 case RCU_SYSIDLE_SHORT:
90151 @@ -2725,7 +2725,7 @@ static void rcu_sysidle(unsigned long j)
90152 static void rcu_sysidle_cancel(void)
90153 {
90154 smp_mb();
90155 - ACCESS_ONCE(full_sysidle_state) = RCU_SYSIDLE_NOT;
90156 + ACCESS_ONCE_RW(full_sysidle_state) = RCU_SYSIDLE_NOT;
90157 }
90158
90159 /*
90160 @@ -2773,7 +2773,7 @@ static void rcu_sysidle_cb(struct rcu_head *rhp)
90161 smp_mb(); /* grace period precedes setting inuse. */
90162
90163 rshp = container_of(rhp, struct rcu_sysidle_head, rh);
90164 - ACCESS_ONCE(rshp->inuse) = 0;
90165 + ACCESS_ONCE_RW(rshp->inuse) = 0;
90166 }
90167
90168 /*
90169 diff --git a/kernel/rcu/tree_trace.c b/kernel/rcu/tree_trace.c
90170 index 4def475..8ffddde 100644
90171 --- a/kernel/rcu/tree_trace.c
90172 +++ b/kernel/rcu/tree_trace.c
90173 @@ -121,7 +121,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
90174 ulong2long(rdp->completed), ulong2long(rdp->gpnum),
90175 rdp->passed_quiesce, rdp->qs_pending);
90176 seq_printf(m, " dt=%d/%llx/%d df=%lu",
90177 - atomic_read(&rdp->dynticks->dynticks),
90178 + atomic_read_unchecked(&rdp->dynticks->dynticks),
90179 rdp->dynticks->dynticks_nesting,
90180 rdp->dynticks->dynticks_nmi_nesting,
90181 rdp->dynticks_fqs);
90182 @@ -182,17 +182,17 @@ static int show_rcuexp(struct seq_file *m, void *v)
90183 struct rcu_state *rsp = (struct rcu_state *)m->private;
90184
90185 seq_printf(m, "s=%lu d=%lu w=%lu tf=%lu wd1=%lu wd2=%lu n=%lu sc=%lu dt=%lu dl=%lu dx=%lu\n",
90186 - atomic_long_read(&rsp->expedited_start),
90187 + atomic_long_read_unchecked(&rsp->expedited_start),
90188 atomic_long_read(&rsp->expedited_done),
90189 - atomic_long_read(&rsp->expedited_wrap),
90190 - atomic_long_read(&rsp->expedited_tryfail),
90191 - atomic_long_read(&rsp->expedited_workdone1),
90192 - atomic_long_read(&rsp->expedited_workdone2),
90193 - atomic_long_read(&rsp->expedited_normal),
90194 - atomic_long_read(&rsp->expedited_stoppedcpus),
90195 - atomic_long_read(&rsp->expedited_done_tries),
90196 - atomic_long_read(&rsp->expedited_done_lost),
90197 - atomic_long_read(&rsp->expedited_done_exit));
90198 + atomic_long_read_unchecked(&rsp->expedited_wrap),
90199 + atomic_long_read_unchecked(&rsp->expedited_tryfail),
90200 + atomic_long_read_unchecked(&rsp->expedited_workdone1),
90201 + atomic_long_read_unchecked(&rsp->expedited_workdone2),
90202 + atomic_long_read_unchecked(&rsp->expedited_normal),
90203 + atomic_long_read_unchecked(&rsp->expedited_stoppedcpus),
90204 + atomic_long_read_unchecked(&rsp->expedited_done_tries),
90205 + atomic_long_read_unchecked(&rsp->expedited_done_lost),
90206 + atomic_long_read_unchecked(&rsp->expedited_done_exit));
90207 return 0;
90208 }
90209
90210 diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
90211 index c54609f..2e8829c 100644
90212 --- a/kernel/rcu/update.c
90213 +++ b/kernel/rcu/update.c
90214 @@ -312,10 +312,10 @@ int rcu_jiffies_till_stall_check(void)
90215 * for CONFIG_RCU_CPU_STALL_TIMEOUT.
90216 */
90217 if (till_stall_check < 3) {
90218 - ACCESS_ONCE(rcu_cpu_stall_timeout) = 3;
90219 + ACCESS_ONCE_RW(rcu_cpu_stall_timeout) = 3;
90220 till_stall_check = 3;
90221 } else if (till_stall_check > 300) {
90222 - ACCESS_ONCE(rcu_cpu_stall_timeout) = 300;
90223 + ACCESS_ONCE_RW(rcu_cpu_stall_timeout) = 300;
90224 till_stall_check = 300;
90225 }
90226 return till_stall_check * HZ + RCU_STALL_DELAY_DELTA;
90227 diff --git a/kernel/resource.c b/kernel/resource.c
90228 index 3f285dc..5755f62 100644
90229 --- a/kernel/resource.c
90230 +++ b/kernel/resource.c
90231 @@ -152,8 +152,18 @@ static const struct file_operations proc_iomem_operations = {
90232
90233 static int __init ioresources_init(void)
90234 {
90235 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
90236 +#ifdef CONFIG_GRKERNSEC_PROC_USER
90237 + proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
90238 + proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
90239 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
90240 + proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
90241 + proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
90242 +#endif
90243 +#else
90244 proc_create("ioports", 0, NULL, &proc_ioports_operations);
90245 proc_create("iomem", 0, NULL, &proc_iomem_operations);
90246 +#endif
90247 return 0;
90248 }
90249 __initcall(ioresources_init);
90250 diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
90251 index 4a07353..66b5291 100644
90252 --- a/kernel/sched/auto_group.c
90253 +++ b/kernel/sched/auto_group.c
90254 @@ -11,7 +11,7 @@
90255
90256 unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
90257 static struct autogroup autogroup_default;
90258 -static atomic_t autogroup_seq_nr;
90259 +static atomic_unchecked_t autogroup_seq_nr;
90260
90261 void __init autogroup_init(struct task_struct *init_task)
90262 {
90263 @@ -79,7 +79,7 @@ static inline struct autogroup *autogroup_create(void)
90264
90265 kref_init(&ag->kref);
90266 init_rwsem(&ag->lock);
90267 - ag->id = atomic_inc_return(&autogroup_seq_nr);
90268 + ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
90269 ag->tg = tg;
90270 #ifdef CONFIG_RT_GROUP_SCHED
90271 /*
90272 diff --git a/kernel/sched/completion.c b/kernel/sched/completion.c
90273 index a63f4dc..349bbb0 100644
90274 --- a/kernel/sched/completion.c
90275 +++ b/kernel/sched/completion.c
90276 @@ -204,7 +204,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
90277 * Return: -ERESTARTSYS if interrupted, 0 if timed out, positive (at least 1,
90278 * or number of jiffies left till timeout) if completed.
90279 */
90280 -long __sched
90281 +long __sched __intentional_overflow(-1)
90282 wait_for_completion_interruptible_timeout(struct completion *x,
90283 unsigned long timeout)
90284 {
90285 @@ -221,7 +221,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
90286 *
90287 * Return: -ERESTARTSYS if interrupted, 0 if completed.
90288 */
90289 -int __sched wait_for_completion_killable(struct completion *x)
90290 +int __sched __intentional_overflow(-1) wait_for_completion_killable(struct completion *x)
90291 {
90292 long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
90293 if (t == -ERESTARTSYS)
90294 @@ -242,7 +242,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
90295 * Return: -ERESTARTSYS if interrupted, 0 if timed out, positive (at least 1,
90296 * or number of jiffies left till timeout) if completed.
90297 */
90298 -long __sched
90299 +long __sched __intentional_overflow(-1)
90300 wait_for_completion_killable_timeout(struct completion *x,
90301 unsigned long timeout)
90302 {
90303 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
90304 index f5c6635..7133356 100644
90305 --- a/kernel/sched/core.c
90306 +++ b/kernel/sched/core.c
90307 @@ -1775,7 +1775,7 @@ void set_numabalancing_state(bool enabled)
90308 int sysctl_numa_balancing(struct ctl_table *table, int write,
90309 void __user *buffer, size_t *lenp, loff_t *ppos)
90310 {
90311 - struct ctl_table t;
90312 + ctl_table_no_const t;
90313 int err;
90314 int state = numabalancing_enabled;
90315
90316 @@ -2251,8 +2251,10 @@ context_switch(struct rq *rq, struct task_struct *prev,
90317 next->active_mm = oldmm;
90318 atomic_inc(&oldmm->mm_count);
90319 enter_lazy_tlb(oldmm, next);
90320 - } else
90321 + } else {
90322 switch_mm(oldmm, mm, next);
90323 + populate_stack();
90324 + }
90325
90326 if (!prev->mm) {
90327 prev->active_mm = NULL;
90328 @@ -3049,6 +3051,8 @@ int can_nice(const struct task_struct *p, const int nice)
90329 /* convert nice value [19,-20] to rlimit style value [1,40] */
90330 int nice_rlim = 20 - nice;
90331
90332 + gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
90333 +
90334 return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
90335 capable(CAP_SYS_NICE));
90336 }
90337 @@ -3082,7 +3086,8 @@ SYSCALL_DEFINE1(nice, int, increment)
90338 if (nice > 19)
90339 nice = 19;
90340
90341 - if (increment < 0 && !can_nice(current, nice))
90342 + if (increment < 0 && (!can_nice(current, nice) ||
90343 + gr_handle_chroot_nice()))
90344 return -EPERM;
90345
90346 retval = security_task_setnice(current, nice);
90347 @@ -3332,6 +3337,7 @@ recheck:
90348 if (policy != p->policy && !rlim_rtprio)
90349 return -EPERM;
90350
90351 + gr_learn_resource(p, RLIMIT_RTPRIO, attr->sched_priority, 1);
90352 /* can't increase priority */
90353 if (attr->sched_priority > p->rt_priority &&
90354 attr->sched_priority > rlim_rtprio)
90355 @@ -4702,8 +4708,10 @@ void idle_task_exit(void)
90356
90357 BUG_ON(cpu_online(smp_processor_id()));
90358
90359 - if (mm != &init_mm)
90360 + if (mm != &init_mm) {
90361 switch_mm(mm, &init_mm, current);
90362 + populate_stack();
90363 + }
90364 mmdrop(mm);
90365 }
90366
90367 @@ -4781,7 +4789,7 @@ static void migrate_tasks(unsigned int dead_cpu)
90368
90369 #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
90370
90371 -static struct ctl_table sd_ctl_dir[] = {
90372 +static ctl_table_no_const sd_ctl_dir[] __read_only = {
90373 {
90374 .procname = "sched_domain",
90375 .mode = 0555,
90376 @@ -4798,17 +4806,17 @@ static struct ctl_table sd_ctl_root[] = {
90377 {}
90378 };
90379
90380 -static struct ctl_table *sd_alloc_ctl_entry(int n)
90381 +static ctl_table_no_const *sd_alloc_ctl_entry(int n)
90382 {
90383 - struct ctl_table *entry =
90384 + ctl_table_no_const *entry =
90385 kcalloc(n, sizeof(struct ctl_table), GFP_KERNEL);
90386
90387 return entry;
90388 }
90389
90390 -static void sd_free_ctl_entry(struct ctl_table **tablep)
90391 +static void sd_free_ctl_entry(ctl_table_no_const *tablep)
90392 {
90393 - struct ctl_table *entry;
90394 + ctl_table_no_const *entry;
90395
90396 /*
90397 * In the intermediate directories, both the child directory and
90398 @@ -4816,22 +4824,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
90399 * will always be set. In the lowest directory the names are
90400 * static strings and all have proc handlers.
90401 */
90402 - for (entry = *tablep; entry->mode; entry++) {
90403 - if (entry->child)
90404 - sd_free_ctl_entry(&entry->child);
90405 + for (entry = tablep; entry->mode; entry++) {
90406 + if (entry->child) {
90407 + sd_free_ctl_entry(entry->child);
90408 + pax_open_kernel();
90409 + entry->child = NULL;
90410 + pax_close_kernel();
90411 + }
90412 if (entry->proc_handler == NULL)
90413 kfree(entry->procname);
90414 }
90415
90416 - kfree(*tablep);
90417 - *tablep = NULL;
90418 + kfree(tablep);
90419 }
90420
90421 static int min_load_idx = 0;
90422 static int max_load_idx = CPU_LOAD_IDX_MAX-1;
90423
90424 static void
90425 -set_table_entry(struct ctl_table *entry,
90426 +set_table_entry(ctl_table_no_const *entry,
90427 const char *procname, void *data, int maxlen,
90428 umode_t mode, proc_handler *proc_handler,
90429 bool load_idx)
90430 @@ -4851,7 +4862,7 @@ set_table_entry(struct ctl_table *entry,
90431 static struct ctl_table *
90432 sd_alloc_ctl_domain_table(struct sched_domain *sd)
90433 {
90434 - struct ctl_table *table = sd_alloc_ctl_entry(13);
90435 + ctl_table_no_const *table = sd_alloc_ctl_entry(13);
90436
90437 if (table == NULL)
90438 return NULL;
90439 @@ -4886,9 +4897,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
90440 return table;
90441 }
90442
90443 -static struct ctl_table *sd_alloc_ctl_cpu_table(int cpu)
90444 +static ctl_table_no_const *sd_alloc_ctl_cpu_table(int cpu)
90445 {
90446 - struct ctl_table *entry, *table;
90447 + ctl_table_no_const *entry, *table;
90448 struct sched_domain *sd;
90449 int domain_num = 0, i;
90450 char buf[32];
90451 @@ -4915,11 +4926,13 @@ static struct ctl_table_header *sd_sysctl_header;
90452 static void register_sched_domain_sysctl(void)
90453 {
90454 int i, cpu_num = num_possible_cpus();
90455 - struct ctl_table *entry = sd_alloc_ctl_entry(cpu_num + 1);
90456 + ctl_table_no_const *entry = sd_alloc_ctl_entry(cpu_num + 1);
90457 char buf[32];
90458
90459 WARN_ON(sd_ctl_dir[0].child);
90460 + pax_open_kernel();
90461 sd_ctl_dir[0].child = entry;
90462 + pax_close_kernel();
90463
90464 if (entry == NULL)
90465 return;
90466 @@ -4942,8 +4955,12 @@ static void unregister_sched_domain_sysctl(void)
90467 if (sd_sysctl_header)
90468 unregister_sysctl_table(sd_sysctl_header);
90469 sd_sysctl_header = NULL;
90470 - if (sd_ctl_dir[0].child)
90471 - sd_free_ctl_entry(&sd_ctl_dir[0].child);
90472 + if (sd_ctl_dir[0].child) {
90473 + sd_free_ctl_entry(sd_ctl_dir[0].child);
90474 + pax_open_kernel();
90475 + sd_ctl_dir[0].child = NULL;
90476 + pax_close_kernel();
90477 + }
90478 }
90479 #else
90480 static void register_sched_domain_sysctl(void)
90481 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
90482 index 9b4c4f3..665489b 100644
90483 --- a/kernel/sched/fair.c
90484 +++ b/kernel/sched/fair.c
90485 @@ -1647,7 +1647,7 @@ void task_numa_fault(int last_cpupid, int node, int pages, int flags)
90486
90487 static void reset_ptenuma_scan(struct task_struct *p)
90488 {
90489 - ACCESS_ONCE(p->mm->numa_scan_seq)++;
90490 + ACCESS_ONCE_RW(p->mm->numa_scan_seq)++;
90491 p->mm->numa_scan_offset = 0;
90492 }
90493
90494 @@ -6851,7 +6851,7 @@ static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle) { }
90495 * run_rebalance_domains is triggered when needed from the scheduler tick.
90496 * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
90497 */
90498 -static void run_rebalance_domains(struct softirq_action *h)
90499 +static __latent_entropy void run_rebalance_domains(void)
90500 {
90501 struct rq *this_rq = this_rq();
90502 enum cpu_idle_type idle = this_rq->idle_balance ?
90503 diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
90504 index f964add..dcd823d 100644
90505 --- a/kernel/sched/sched.h
90506 +++ b/kernel/sched/sched.h
90507 @@ -1157,7 +1157,7 @@ struct sched_class {
90508 #ifdef CONFIG_FAIR_GROUP_SCHED
90509 void (*task_move_group) (struct task_struct *p, int on_rq);
90510 #endif
90511 -};
90512 +} __do_const;
90513
90514 #define sched_class_highest (&stop_sched_class)
90515 #define for_each_class(class) \
90516 diff --git a/kernel/signal.c b/kernel/signal.c
90517 index 52f881d..1e9f941 100644
90518 --- a/kernel/signal.c
90519 +++ b/kernel/signal.c
90520 @@ -51,12 +51,12 @@ static struct kmem_cache *sigqueue_cachep;
90521
90522 int print_fatal_signals __read_mostly;
90523
90524 -static void __user *sig_handler(struct task_struct *t, int sig)
90525 +static __sighandler_t sig_handler(struct task_struct *t, int sig)
90526 {
90527 return t->sighand->action[sig - 1].sa.sa_handler;
90528 }
90529
90530 -static int sig_handler_ignored(void __user *handler, int sig)
90531 +static int sig_handler_ignored(__sighandler_t handler, int sig)
90532 {
90533 /* Is it explicitly or implicitly ignored? */
90534 return handler == SIG_IGN ||
90535 @@ -65,7 +65,7 @@ static int sig_handler_ignored(void __user *handler, int sig)
90536
90537 static int sig_task_ignored(struct task_struct *t, int sig, bool force)
90538 {
90539 - void __user *handler;
90540 + __sighandler_t handler;
90541
90542 handler = sig_handler(t, sig);
90543
90544 @@ -369,6 +369,9 @@ __sigqueue_alloc(int sig, struct task_struct *t, gfp_t flags, int override_rlimi
90545 atomic_inc(&user->sigpending);
90546 rcu_read_unlock();
90547
90548 + if (!override_rlimit)
90549 + gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
90550 +
90551 if (override_rlimit ||
90552 atomic_read(&user->sigpending) <=
90553 task_rlimit(t, RLIMIT_SIGPENDING)) {
90554 @@ -496,7 +499,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
90555
90556 int unhandled_signal(struct task_struct *tsk, int sig)
90557 {
90558 - void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
90559 + __sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
90560 if (is_global_init(tsk))
90561 return 1;
90562 if (handler != SIG_IGN && handler != SIG_DFL)
90563 @@ -816,6 +819,13 @@ static int check_kill_permission(int sig, struct siginfo *info,
90564 }
90565 }
90566
90567 + /* allow glibc communication via tgkill to other threads in our
90568 + thread group */
90569 + if ((info == SEND_SIG_NOINFO || info->si_code != SI_TKILL ||
90570 + sig != (SIGRTMIN+1) || task_tgid_vnr(t) != info->si_pid)
90571 + && gr_handle_signal(t, sig))
90572 + return -EPERM;
90573 +
90574 return security_task_kill(t, info, sig, 0);
90575 }
90576
90577 @@ -1199,7 +1209,7 @@ __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
90578 return send_signal(sig, info, p, 1);
90579 }
90580
90581 -static int
90582 +int
90583 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
90584 {
90585 return send_signal(sig, info, t, 0);
90586 @@ -1236,6 +1246,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
90587 unsigned long int flags;
90588 int ret, blocked, ignored;
90589 struct k_sigaction *action;
90590 + int is_unhandled = 0;
90591
90592 spin_lock_irqsave(&t->sighand->siglock, flags);
90593 action = &t->sighand->action[sig-1];
90594 @@ -1250,9 +1261,18 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
90595 }
90596 if (action->sa.sa_handler == SIG_DFL)
90597 t->signal->flags &= ~SIGNAL_UNKILLABLE;
90598 + if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
90599 + is_unhandled = 1;
90600 ret = specific_send_sig_info(sig, info, t);
90601 spin_unlock_irqrestore(&t->sighand->siglock, flags);
90602
90603 + /* only deal with unhandled signals, java etc trigger SIGSEGV during
90604 + normal operation */
90605 + if (is_unhandled) {
90606 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
90607 + gr_handle_crash(t, sig);
90608 + }
90609 +
90610 return ret;
90611 }
90612
90613 @@ -1319,8 +1339,11 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
90614 ret = check_kill_permission(sig, info, p);
90615 rcu_read_unlock();
90616
90617 - if (!ret && sig)
90618 + if (!ret && sig) {
90619 ret = do_send_sig_info(sig, info, p, true);
90620 + if (!ret)
90621 + gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
90622 + }
90623
90624 return ret;
90625 }
90626 @@ -2926,7 +2949,15 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
90627 int error = -ESRCH;
90628
90629 rcu_read_lock();
90630 - p = find_task_by_vpid(pid);
90631 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
90632 + /* allow glibc communication via tgkill to other threads in our
90633 + thread group */
90634 + if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
90635 + sig == (SIGRTMIN+1) && tgid == info->si_pid)
90636 + p = find_task_by_vpid_unrestricted(pid);
90637 + else
90638 +#endif
90639 + p = find_task_by_vpid(pid);
90640 if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
90641 error = check_kill_permission(sig, info, p);
90642 /*
90643 @@ -3239,8 +3270,8 @@ COMPAT_SYSCALL_DEFINE2(sigaltstack,
90644 }
90645 seg = get_fs();
90646 set_fs(KERNEL_DS);
90647 - ret = do_sigaltstack((stack_t __force __user *) (uss_ptr ? &uss : NULL),
90648 - (stack_t __force __user *) &uoss,
90649 + ret = do_sigaltstack((stack_t __force_user *) (uss_ptr ? &uss : NULL),
90650 + (stack_t __force_user *) &uoss,
90651 compat_user_stack_pointer());
90652 set_fs(seg);
90653 if (ret >= 0 && uoss_ptr) {
90654 diff --git a/kernel/smpboot.c b/kernel/smpboot.c
90655 index eb89e18..a4e6792 100644
90656 --- a/kernel/smpboot.c
90657 +++ b/kernel/smpboot.c
90658 @@ -288,7 +288,7 @@ int smpboot_register_percpu_thread(struct smp_hotplug_thread *plug_thread)
90659 }
90660 smpboot_unpark_thread(plug_thread, cpu);
90661 }
90662 - list_add(&plug_thread->list, &hotplug_threads);
90663 + pax_list_add(&plug_thread->list, &hotplug_threads);
90664 out:
90665 mutex_unlock(&smpboot_threads_lock);
90666 return ret;
90667 @@ -305,7 +305,7 @@ void smpboot_unregister_percpu_thread(struct smp_hotplug_thread *plug_thread)
90668 {
90669 get_online_cpus();
90670 mutex_lock(&smpboot_threads_lock);
90671 - list_del(&plug_thread->list);
90672 + pax_list_del(&plug_thread->list);
90673 smpboot_destroy_threads(plug_thread);
90674 mutex_unlock(&smpboot_threads_lock);
90675 put_online_cpus();
90676 diff --git a/kernel/softirq.c b/kernel/softirq.c
90677 index 490fcbb..1e502c6 100644
90678 --- a/kernel/softirq.c
90679 +++ b/kernel/softirq.c
90680 @@ -52,7 +52,7 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
90681 EXPORT_SYMBOL(irq_stat);
90682 #endif
90683
90684 -static struct softirq_action softirq_vec[NR_SOFTIRQS] __cacheline_aligned_in_smp;
90685 +static struct softirq_action softirq_vec[NR_SOFTIRQS] __read_only __aligned(PAGE_SIZE);
90686
90687 DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
90688
90689 @@ -267,7 +267,7 @@ restart:
90690 kstat_incr_softirqs_this_cpu(vec_nr);
90691
90692 trace_softirq_entry(vec_nr);
90693 - h->action(h);
90694 + h->action();
90695 trace_softirq_exit(vec_nr);
90696 if (unlikely(prev_count != preempt_count())) {
90697 pr_err("huh, entered softirq %u %s %p with preempt_count %08x, exited with %08x?\n",
90698 @@ -427,7 +427,7 @@ void __raise_softirq_irqoff(unsigned int nr)
90699 or_softirq_pending(1UL << nr);
90700 }
90701
90702 -void open_softirq(int nr, void (*action)(struct softirq_action *))
90703 +void __init open_softirq(int nr, void (*action)(void))
90704 {
90705 softirq_vec[nr].action = action;
90706 }
90707 @@ -479,7 +479,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
90708 }
90709 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
90710
90711 -static void tasklet_action(struct softirq_action *a)
90712 +static void tasklet_action(void)
90713 {
90714 struct tasklet_struct *list;
90715
90716 @@ -515,7 +515,7 @@ static void tasklet_action(struct softirq_action *a)
90717 }
90718 }
90719
90720 -static void tasklet_hi_action(struct softirq_action *a)
90721 +static __latent_entropy void tasklet_hi_action(void)
90722 {
90723 struct tasklet_struct *list;
90724
90725 @@ -742,7 +742,7 @@ static struct notifier_block cpu_nfb = {
90726 .notifier_call = cpu_callback
90727 };
90728
90729 -static struct smp_hotplug_thread softirq_threads = {
90730 +static struct smp_hotplug_thread softirq_threads __read_only = {
90731 .store = &ksoftirqd,
90732 .thread_should_run = ksoftirqd_should_run,
90733 .thread_fn = run_ksoftirqd,
90734 diff --git a/kernel/sys.c b/kernel/sys.c
90735 index c0a58be..784c618 100644
90736 --- a/kernel/sys.c
90737 +++ b/kernel/sys.c
90738 @@ -148,6 +148,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
90739 error = -EACCES;
90740 goto out;
90741 }
90742 +
90743 + if (gr_handle_chroot_setpriority(p, niceval)) {
90744 + error = -EACCES;
90745 + goto out;
90746 + }
90747 +
90748 no_nice = security_task_setnice(p, niceval);
90749 if (no_nice) {
90750 error = no_nice;
90751 @@ -351,6 +357,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
90752 goto error;
90753 }
90754
90755 + if (gr_check_group_change(new->gid, new->egid, INVALID_GID))
90756 + goto error;
90757 +
90758 if (rgid != (gid_t) -1 ||
90759 (egid != (gid_t) -1 && !gid_eq(kegid, old->gid)))
90760 new->sgid = new->egid;
90761 @@ -386,6 +395,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
90762 old = current_cred();
90763
90764 retval = -EPERM;
90765 +
90766 + if (gr_check_group_change(kgid, kgid, kgid))
90767 + goto error;
90768 +
90769 if (ns_capable(old->user_ns, CAP_SETGID))
90770 new->gid = new->egid = new->sgid = new->fsgid = kgid;
90771 else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid))
90772 @@ -403,7 +416,7 @@ error:
90773 /*
90774 * change the user struct in a credentials set to match the new UID
90775 */
90776 -static int set_user(struct cred *new)
90777 +int set_user(struct cred *new)
90778 {
90779 struct user_struct *new_user;
90780
90781 @@ -483,6 +496,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
90782 goto error;
90783 }
90784
90785 + if (gr_check_user_change(new->uid, new->euid, INVALID_UID))
90786 + goto error;
90787 +
90788 if (!uid_eq(new->uid, old->uid)) {
90789 retval = set_user(new);
90790 if (retval < 0)
90791 @@ -533,6 +549,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
90792 old = current_cred();
90793
90794 retval = -EPERM;
90795 +
90796 + if (gr_check_crash_uid(kuid))
90797 + goto error;
90798 + if (gr_check_user_change(kuid, kuid, kuid))
90799 + goto error;
90800 +
90801 if (ns_capable(old->user_ns, CAP_SETUID)) {
90802 new->suid = new->uid = kuid;
90803 if (!uid_eq(kuid, old->uid)) {
90804 @@ -602,6 +624,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
90805 goto error;
90806 }
90807
90808 + if (gr_check_user_change(kruid, keuid, INVALID_UID))
90809 + goto error;
90810 +
90811 if (ruid != (uid_t) -1) {
90812 new->uid = kruid;
90813 if (!uid_eq(kruid, old->uid)) {
90814 @@ -684,6 +709,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
90815 goto error;
90816 }
90817
90818 + if (gr_check_group_change(krgid, kegid, INVALID_GID))
90819 + goto error;
90820 +
90821 if (rgid != (gid_t) -1)
90822 new->gid = krgid;
90823 if (egid != (gid_t) -1)
90824 @@ -745,12 +773,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
90825 uid_eq(kuid, old->suid) || uid_eq(kuid, old->fsuid) ||
90826 ns_capable(old->user_ns, CAP_SETUID)) {
90827 if (!uid_eq(kuid, old->fsuid)) {
90828 + if (gr_check_user_change(INVALID_UID, INVALID_UID, kuid))
90829 + goto error;
90830 +
90831 new->fsuid = kuid;
90832 if (security_task_fix_setuid(new, old, LSM_SETID_FS) == 0)
90833 goto change_okay;
90834 }
90835 }
90836
90837 +error:
90838 abort_creds(new);
90839 return old_fsuid;
90840
90841 @@ -783,12 +815,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
90842 if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->egid) ||
90843 gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) ||
90844 ns_capable(old->user_ns, CAP_SETGID)) {
90845 + if (gr_check_group_change(INVALID_GID, INVALID_GID, kgid))
90846 + goto error;
90847 +
90848 if (!gid_eq(kgid, old->fsgid)) {
90849 new->fsgid = kgid;
90850 goto change_okay;
90851 }
90852 }
90853
90854 +error:
90855 abort_creds(new);
90856 return old_fsgid;
90857
90858 @@ -1167,19 +1203,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
90859 return -EFAULT;
90860
90861 down_read(&uts_sem);
90862 - error = __copy_to_user(&name->sysname, &utsname()->sysname,
90863 + error = __copy_to_user(name->sysname, &utsname()->sysname,
90864 __OLD_UTS_LEN);
90865 error |= __put_user(0, name->sysname + __OLD_UTS_LEN);
90866 - error |= __copy_to_user(&name->nodename, &utsname()->nodename,
90867 + error |= __copy_to_user(name->nodename, &utsname()->nodename,
90868 __OLD_UTS_LEN);
90869 error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
90870 - error |= __copy_to_user(&name->release, &utsname()->release,
90871 + error |= __copy_to_user(name->release, &utsname()->release,
90872 __OLD_UTS_LEN);
90873 error |= __put_user(0, name->release + __OLD_UTS_LEN);
90874 - error |= __copy_to_user(&name->version, &utsname()->version,
90875 + error |= __copy_to_user(name->version, &utsname()->version,
90876 __OLD_UTS_LEN);
90877 error |= __put_user(0, name->version + __OLD_UTS_LEN);
90878 - error |= __copy_to_user(&name->machine, &utsname()->machine,
90879 + error |= __copy_to_user(name->machine, &utsname()->machine,
90880 __OLD_UTS_LEN);
90881 error |= __put_user(0, name->machine + __OLD_UTS_LEN);
90882 up_read(&uts_sem);
90883 @@ -1381,6 +1417,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
90884 */
90885 new_rlim->rlim_cur = 1;
90886 }
90887 + /* Handle the case where a fork and setuid occur and then RLIMIT_NPROC
90888 + is changed to a lower value. Since tasks can be created by the same
90889 + user in between this limit change and an execve by this task, force
90890 + a recheck only for this task by setting PF_NPROC_EXCEEDED
90891 + */
90892 + if (resource == RLIMIT_NPROC && tsk->real_cred->user != INIT_USER)
90893 + tsk->flags |= PF_NPROC_EXCEEDED;
90894 }
90895 if (!retval) {
90896 if (old_rlim)
90897 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
90898 index aae21e8..58d8c9a 100644
90899 --- a/kernel/sysctl.c
90900 +++ b/kernel/sysctl.c
90901 @@ -94,7 +94,6 @@
90902
90903
90904 #if defined(CONFIG_SYSCTL)
90905 -
90906 /* External variables not in a header file. */
90907 extern int max_threads;
90908 extern int suid_dumpable;
90909 @@ -118,19 +117,18 @@ extern int blk_iopoll_enabled;
90910
90911 /* Constants used for minimum and maximum */
90912 #ifdef CONFIG_LOCKUP_DETECTOR
90913 -static int sixty = 60;
90914 +static int sixty __read_only = 60;
90915 #endif
90916
90917 -static int __maybe_unused neg_one = -1;
90918 -
90919 -static int zero;
90920 -static int __maybe_unused one = 1;
90921 -static int __maybe_unused two = 2;
90922 -static int __maybe_unused three = 3;
90923 -static unsigned long one_ul = 1;
90924 -static int one_hundred = 100;
90925 +static int __maybe_unused neg_one __read_only = -1;
90926 +static int zero __read_only = 0;
90927 +static int __maybe_unused one __read_only = 1;
90928 +static int __maybe_unused two __read_only = 2;
90929 +static int __maybe_unused three __read_only = 3;
90930 +static unsigned long one_ul __read_only = 1;
90931 +static int one_hundred __read_only = 100;
90932 #ifdef CONFIG_PRINTK
90933 -static int ten_thousand = 10000;
90934 +static int ten_thousand __read_only = 10000;
90935 #endif
90936
90937 /* this is needed for the proc_doulongvec_minmax of vm_dirty_bytes */
90938 @@ -182,10 +180,8 @@ static int proc_taint(struct ctl_table *table, int write,
90939 void __user *buffer, size_t *lenp, loff_t *ppos);
90940 #endif
90941
90942 -#ifdef CONFIG_PRINTK
90943 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
90944 void __user *buffer, size_t *lenp, loff_t *ppos);
90945 -#endif
90946
90947 static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
90948 void __user *buffer, size_t *lenp, loff_t *ppos);
90949 @@ -216,6 +212,8 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
90950
90951 #endif
90952
90953 +extern struct ctl_table grsecurity_table[];
90954 +
90955 static struct ctl_table kern_table[];
90956 static struct ctl_table vm_table[];
90957 static struct ctl_table fs_table[];
90958 @@ -230,6 +228,20 @@ extern struct ctl_table epoll_table[];
90959 int sysctl_legacy_va_layout;
90960 #endif
90961
90962 +#ifdef CONFIG_PAX_SOFTMODE
90963 +static ctl_table pax_table[] = {
90964 + {
90965 + .procname = "softmode",
90966 + .data = &pax_softmode,
90967 + .maxlen = sizeof(unsigned int),
90968 + .mode = 0600,
90969 + .proc_handler = &proc_dointvec,
90970 + },
90971 +
90972 + { }
90973 +};
90974 +#endif
90975 +
90976 /* The default sysctl tables: */
90977
90978 static struct ctl_table sysctl_base_table[] = {
90979 @@ -278,6 +290,22 @@ static int max_extfrag_threshold = 1000;
90980 #endif
90981
90982 static struct ctl_table kern_table[] = {
90983 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
90984 + {
90985 + .procname = "grsecurity",
90986 + .mode = 0500,
90987 + .child = grsecurity_table,
90988 + },
90989 +#endif
90990 +
90991 +#ifdef CONFIG_PAX_SOFTMODE
90992 + {
90993 + .procname = "pax",
90994 + .mode = 0500,
90995 + .child = pax_table,
90996 + },
90997 +#endif
90998 +
90999 {
91000 .procname = "sched_child_runs_first",
91001 .data = &sysctl_sched_child_runs_first,
91002 @@ -640,7 +668,7 @@ static struct ctl_table kern_table[] = {
91003 .data = &modprobe_path,
91004 .maxlen = KMOD_PATH_LEN,
91005 .mode = 0644,
91006 - .proc_handler = proc_dostring,
91007 + .proc_handler = proc_dostring_modpriv,
91008 },
91009 {
91010 .procname = "modules_disabled",
91011 @@ -807,16 +835,20 @@ static struct ctl_table kern_table[] = {
91012 .extra1 = &zero,
91013 .extra2 = &one,
91014 },
91015 +#endif
91016 {
91017 .procname = "kptr_restrict",
91018 .data = &kptr_restrict,
91019 .maxlen = sizeof(int),
91020 .mode = 0644,
91021 .proc_handler = proc_dointvec_minmax_sysadmin,
91022 +#ifdef CONFIG_GRKERNSEC_HIDESYM
91023 + .extra1 = &two,
91024 +#else
91025 .extra1 = &zero,
91026 +#endif
91027 .extra2 = &two,
91028 },
91029 -#endif
91030 {
91031 .procname = "ngroups_max",
91032 .data = &ngroups_max,
91033 @@ -1061,10 +1093,17 @@ static struct ctl_table kern_table[] = {
91034 */
91035 {
91036 .procname = "perf_event_paranoid",
91037 - .data = &sysctl_perf_event_paranoid,
91038 - .maxlen = sizeof(sysctl_perf_event_paranoid),
91039 + .data = &sysctl_perf_event_legitimately_concerned,
91040 + .maxlen = sizeof(sysctl_perf_event_legitimately_concerned),
91041 .mode = 0644,
91042 - .proc_handler = proc_dointvec,
91043 + /* go ahead, be a hero */
91044 + .proc_handler = proc_dointvec_minmax_sysadmin,
91045 + .extra1 = &neg_one,
91046 +#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
91047 + .extra2 = &three,
91048 +#else
91049 + .extra2 = &two,
91050 +#endif
91051 },
91052 {
91053 .procname = "perf_event_mlock_kb",
91054 @@ -1335,6 +1374,13 @@ static struct ctl_table vm_table[] = {
91055 .proc_handler = proc_dointvec_minmax,
91056 .extra1 = &zero,
91057 },
91058 + {
91059 + .procname = "heap_stack_gap",
91060 + .data = &sysctl_heap_stack_gap,
91061 + .maxlen = sizeof(sysctl_heap_stack_gap),
91062 + .mode = 0644,
91063 + .proc_handler = proc_doulongvec_minmax,
91064 + },
91065 #else
91066 {
91067 .procname = "nr_trim_pages",
91068 @@ -1799,6 +1845,16 @@ int proc_dostring(struct ctl_table *table, int write,
91069 buffer, lenp, ppos);
91070 }
91071
91072 +int proc_dostring_modpriv(struct ctl_table *table, int write,
91073 + void __user *buffer, size_t *lenp, loff_t *ppos)
91074 +{
91075 + if (write && !capable(CAP_SYS_MODULE))
91076 + return -EPERM;
91077 +
91078 + return _proc_do_string(table->data, table->maxlen, write,
91079 + buffer, lenp, ppos);
91080 +}
91081 +
91082 static size_t proc_skip_spaces(char **buf)
91083 {
91084 size_t ret;
91085 @@ -1904,6 +1960,8 @@ static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
91086 len = strlen(tmp);
91087 if (len > *size)
91088 len = *size;
91089 + if (len > sizeof(tmp))
91090 + len = sizeof(tmp);
91091 if (copy_to_user(*buf, tmp, len))
91092 return -EFAULT;
91093 *size -= len;
91094 @@ -2068,7 +2126,7 @@ int proc_dointvec(struct ctl_table *table, int write,
91095 static int proc_taint(struct ctl_table *table, int write,
91096 void __user *buffer, size_t *lenp, loff_t *ppos)
91097 {
91098 - struct ctl_table t;
91099 + ctl_table_no_const t;
91100 unsigned long tmptaint = get_taint();
91101 int err;
91102
91103 @@ -2096,7 +2154,6 @@ static int proc_taint(struct ctl_table *table, int write,
91104 return err;
91105 }
91106
91107 -#ifdef CONFIG_PRINTK
91108 static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
91109 void __user *buffer, size_t *lenp, loff_t *ppos)
91110 {
91111 @@ -2105,7 +2162,6 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
91112
91113 return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
91114 }
91115 -#endif
91116
91117 struct do_proc_dointvec_minmax_conv_param {
91118 int *min;
91119 @@ -2652,6 +2708,12 @@ int proc_dostring(struct ctl_table *table, int write,
91120 return -ENOSYS;
91121 }
91122
91123 +int proc_dostring_modpriv(struct ctl_table *table, int write,
91124 + void __user *buffer, size_t *lenp, loff_t *ppos)
91125 +{
91126 + return -ENOSYS;
91127 +}
91128 +
91129 int proc_dointvec(struct ctl_table *table, int write,
91130 void __user *buffer, size_t *lenp, loff_t *ppos)
91131 {
91132 @@ -2708,5 +2770,6 @@ EXPORT_SYMBOL(proc_dointvec_minmax);
91133 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
91134 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
91135 EXPORT_SYMBOL(proc_dostring);
91136 +EXPORT_SYMBOL(proc_dostring_modpriv);
91137 EXPORT_SYMBOL(proc_doulongvec_minmax);
91138 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
91139 diff --git a/kernel/taskstats.c b/kernel/taskstats.c
91140 index 13d2f7c..c93d0b0 100644
91141 --- a/kernel/taskstats.c
91142 +++ b/kernel/taskstats.c
91143 @@ -28,9 +28,12 @@
91144 #include <linux/fs.h>
91145 #include <linux/file.h>
91146 #include <linux/pid_namespace.h>
91147 +#include <linux/grsecurity.h>
91148 #include <net/genetlink.h>
91149 #include <linux/atomic.h>
91150
91151 +extern int gr_is_taskstats_denied(int pid);
91152 +
91153 /*
91154 * Maximum length of a cpumask that can be specified in
91155 * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
91156 @@ -576,6 +579,9 @@ err:
91157
91158 static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
91159 {
91160 + if (gr_is_taskstats_denied(current->pid))
91161 + return -EACCES;
91162 +
91163 if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
91164 return cmd_attr_register_cpumask(info);
91165 else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
91166 diff --git a/kernel/time.c b/kernel/time.c
91167 index 7c7964c..2a0d412 100644
91168 --- a/kernel/time.c
91169 +++ b/kernel/time.c
91170 @@ -172,6 +172,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
91171 return error;
91172
91173 if (tz) {
91174 + /* we log in do_settimeofday called below, so don't log twice
91175 + */
91176 + if (!tv)
91177 + gr_log_timechange();
91178 +
91179 sys_tz = *tz;
91180 update_vsyscall_tz();
91181 if (firsttime) {
91182 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
91183 index 88c9c65..7497ebc 100644
91184 --- a/kernel/time/alarmtimer.c
91185 +++ b/kernel/time/alarmtimer.c
91186 @@ -795,7 +795,7 @@ static int __init alarmtimer_init(void)
91187 struct platform_device *pdev;
91188 int error = 0;
91189 int i;
91190 - struct k_clock alarm_clock = {
91191 + static struct k_clock alarm_clock = {
91192 .clock_getres = alarm_clock_getres,
91193 .clock_get = alarm_clock_get,
91194 .timer_create = alarm_timer_create,
91195 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
91196 index 5b40279..81e58db 100644
91197 --- a/kernel/time/timekeeping.c
91198 +++ b/kernel/time/timekeeping.c
91199 @@ -15,6 +15,7 @@
91200 #include <linux/init.h>
91201 #include <linux/mm.h>
91202 #include <linux/sched.h>
91203 +#include <linux/grsecurity.h>
91204 #include <linux/syscore_ops.h>
91205 #include <linux/clocksource.h>
91206 #include <linux/jiffies.h>
91207 @@ -501,6 +502,8 @@ int do_settimeofday(const struct timespec *tv)
91208 if (!timespec_valid_strict(tv))
91209 return -EINVAL;
91210
91211 + gr_log_timechange();
91212 +
91213 raw_spin_lock_irqsave(&timekeeper_lock, flags);
91214 write_seqcount_begin(&timekeeper_seq);
91215
91216 diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
91217 index 61ed862..3b52c65 100644
91218 --- a/kernel/time/timer_list.c
91219 +++ b/kernel/time/timer_list.c
91220 @@ -45,12 +45,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
91221
91222 static void print_name_offset(struct seq_file *m, void *sym)
91223 {
91224 +#ifdef CONFIG_GRKERNSEC_HIDESYM
91225 + SEQ_printf(m, "<%p>", NULL);
91226 +#else
91227 char symname[KSYM_NAME_LEN];
91228
91229 if (lookup_symbol_name((unsigned long)sym, symname) < 0)
91230 SEQ_printf(m, "<%pK>", sym);
91231 else
91232 SEQ_printf(m, "%s", symname);
91233 +#endif
91234 }
91235
91236 static void
91237 @@ -119,7 +123,11 @@ next_one:
91238 static void
91239 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
91240 {
91241 +#ifdef CONFIG_GRKERNSEC_HIDESYM
91242 + SEQ_printf(m, " .base: %p\n", NULL);
91243 +#else
91244 SEQ_printf(m, " .base: %pK\n", base);
91245 +#endif
91246 SEQ_printf(m, " .index: %d\n",
91247 base->index);
91248 SEQ_printf(m, " .resolution: %Lu nsecs\n",
91249 @@ -362,7 +370,11 @@ static int __init init_timer_list_procfs(void)
91250 {
91251 struct proc_dir_entry *pe;
91252
91253 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
91254 + pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
91255 +#else
91256 pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
91257 +#endif
91258 if (!pe)
91259 return -ENOMEM;
91260 return 0;
91261 diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
91262 index 1fb08f2..ca4bb1e 100644
91263 --- a/kernel/time/timer_stats.c
91264 +++ b/kernel/time/timer_stats.c
91265 @@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
91266 static unsigned long nr_entries;
91267 static struct entry entries[MAX_ENTRIES];
91268
91269 -static atomic_t overflow_count;
91270 +static atomic_unchecked_t overflow_count;
91271
91272 /*
91273 * The entries are in a hash-table, for fast lookup:
91274 @@ -140,7 +140,7 @@ static void reset_entries(void)
91275 nr_entries = 0;
91276 memset(entries, 0, sizeof(entries));
91277 memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
91278 - atomic_set(&overflow_count, 0);
91279 + atomic_set_unchecked(&overflow_count, 0);
91280 }
91281
91282 static struct entry *alloc_entry(void)
91283 @@ -261,7 +261,7 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
91284 if (likely(entry))
91285 entry->count++;
91286 else
91287 - atomic_inc(&overflow_count);
91288 + atomic_inc_unchecked(&overflow_count);
91289
91290 out_unlock:
91291 raw_spin_unlock_irqrestore(lock, flags);
91292 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
91293
91294 static void print_name_offset(struct seq_file *m, unsigned long addr)
91295 {
91296 +#ifdef CONFIG_GRKERNSEC_HIDESYM
91297 + seq_printf(m, "<%p>", NULL);
91298 +#else
91299 char symname[KSYM_NAME_LEN];
91300
91301 if (lookup_symbol_name(addr, symname) < 0)
91302 - seq_printf(m, "<%p>", (void *)addr);
91303 + seq_printf(m, "<%pK>", (void *)addr);
91304 else
91305 seq_printf(m, "%s", symname);
91306 +#endif
91307 }
91308
91309 static int tstats_show(struct seq_file *m, void *v)
91310 @@ -300,8 +304,8 @@ static int tstats_show(struct seq_file *m, void *v)
91311
91312 seq_puts(m, "Timer Stats Version: v0.3\n");
91313 seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
91314 - if (atomic_read(&overflow_count))
91315 - seq_printf(m, "Overflow: %d entries\n", atomic_read(&overflow_count));
91316 + if (atomic_read_unchecked(&overflow_count))
91317 + seq_printf(m, "Overflow: %d entries\n", atomic_read_unchecked(&overflow_count));
91318 seq_printf(m, "Collection: %s\n", timer_stats_active ? "active" : "inactive");
91319
91320 for (i = 0; i < nr_entries; i++) {
91321 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(void)
91322 {
91323 struct proc_dir_entry *pe;
91324
91325 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
91326 + pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
91327 +#else
91328 pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
91329 +#endif
91330 if (!pe)
91331 return -ENOMEM;
91332 return 0;
91333 diff --git a/kernel/timer.c b/kernel/timer.c
91334 index accfd24..e00f0c0 100644
91335 --- a/kernel/timer.c
91336 +++ b/kernel/timer.c
91337 @@ -1366,7 +1366,7 @@ void update_process_times(int user_tick)
91338 /*
91339 * This function runs timers and the timer-tq in bottom half context.
91340 */
91341 -static void run_timer_softirq(struct softirq_action *h)
91342 +static __latent_entropy void run_timer_softirq(void)
91343 {
91344 struct tvec_base *base = __this_cpu_read(tvec_bases);
91345
91346 @@ -1429,7 +1429,7 @@ static void process_timeout(unsigned long __data)
91347 *
91348 * In all cases the return value is guaranteed to be non-negative.
91349 */
91350 -signed long __sched schedule_timeout(signed long timeout)
91351 +signed long __sched __intentional_overflow(-1) schedule_timeout(signed long timeout)
91352 {
91353 struct timer_list timer;
91354 unsigned long expire;
91355 diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
91356 index 4f3a3c03..04b7886 100644
91357 --- a/kernel/trace/blktrace.c
91358 +++ b/kernel/trace/blktrace.c
91359 @@ -328,7 +328,7 @@ static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
91360 struct blk_trace *bt = filp->private_data;
91361 char buf[16];
91362
91363 - snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
91364 + snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
91365
91366 return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
91367 }
91368 @@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
91369 return 1;
91370
91371 bt = buf->chan->private_data;
91372 - atomic_inc(&bt->dropped);
91373 + atomic_inc_unchecked(&bt->dropped);
91374 return 0;
91375 }
91376
91377 @@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
91378
91379 bt->dir = dir;
91380 bt->dev = dev;
91381 - atomic_set(&bt->dropped, 0);
91382 + atomic_set_unchecked(&bt->dropped, 0);
91383 INIT_LIST_HEAD(&bt->running_list);
91384
91385 ret = -EIO;
91386 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
91387 index cd7f76d..553c805 100644
91388 --- a/kernel/trace/ftrace.c
91389 +++ b/kernel/trace/ftrace.c
91390 @@ -1965,12 +1965,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
91391 if (unlikely(ftrace_disabled))
91392 return 0;
91393
91394 + ret = ftrace_arch_code_modify_prepare();
91395 + FTRACE_WARN_ON(ret);
91396 + if (ret)
91397 + return 0;
91398 +
91399 ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
91400 + FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
91401 if (ret) {
91402 ftrace_bug(ret, ip);
91403 - return 0;
91404 }
91405 - return 1;
91406 + return ret ? 0 : 1;
91407 }
91408
91409 /*
91410 @@ -4177,8 +4182,10 @@ static int ftrace_process_locs(struct module *mod,
91411 if (!count)
91412 return 0;
91413
91414 + pax_open_kernel();
91415 sort(start, count, sizeof(*start),
91416 ftrace_cmp_ips, ftrace_swap_ips);
91417 + pax_close_kernel();
91418
91419 start_pg = ftrace_allocate_pages(count);
91420 if (!start_pg)
91421 @@ -4909,8 +4916,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
91422 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
91423
91424 static int ftrace_graph_active;
91425 -static struct notifier_block ftrace_suspend_notifier;
91426 -
91427 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
91428 {
91429 return 0;
91430 @@ -5086,6 +5091,10 @@ static void update_function_graph_func(void)
91431 ftrace_graph_entry = ftrace_graph_entry_test;
91432 }
91433
91434 +static struct notifier_block ftrace_suspend_notifier = {
91435 + .notifier_call = ftrace_suspend_notifier_call
91436 +};
91437 +
91438 int register_ftrace_graph(trace_func_graph_ret_t retfunc,
91439 trace_func_graph_ent_t entryfunc)
91440 {
91441 @@ -5099,7 +5108,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
91442 goto out;
91443 }
91444
91445 - ftrace_suspend_notifier.notifier_call = ftrace_suspend_notifier_call;
91446 register_pm_notifier(&ftrace_suspend_notifier);
91447
91448 ftrace_graph_active++;
91449 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
91450 index fc4da2d..f3e800b 100644
91451 --- a/kernel/trace/ring_buffer.c
91452 +++ b/kernel/trace/ring_buffer.c
91453 @@ -352,9 +352,9 @@ struct buffer_data_page {
91454 */
91455 struct buffer_page {
91456 struct list_head list; /* list of buffer pages */
91457 - local_t write; /* index for next write */
91458 + local_unchecked_t write; /* index for next write */
91459 unsigned read; /* index for next read */
91460 - local_t entries; /* entries on this page */
91461 + local_unchecked_t entries; /* entries on this page */
91462 unsigned long real_end; /* real end of data */
91463 struct buffer_data_page *page; /* Actual data page */
91464 };
91465 @@ -473,8 +473,8 @@ struct ring_buffer_per_cpu {
91466 unsigned long last_overrun;
91467 local_t entries_bytes;
91468 local_t entries;
91469 - local_t overrun;
91470 - local_t commit_overrun;
91471 + local_unchecked_t overrun;
91472 + local_unchecked_t commit_overrun;
91473 local_t dropped_events;
91474 local_t committing;
91475 local_t commits;
91476 @@ -992,8 +992,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
91477 *
91478 * We add a counter to the write field to denote this.
91479 */
91480 - old_write = local_add_return(RB_WRITE_INTCNT, &next_page->write);
91481 - old_entries = local_add_return(RB_WRITE_INTCNT, &next_page->entries);
91482 + old_write = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->write);
91483 + old_entries = local_add_return_unchecked(RB_WRITE_INTCNT, &next_page->entries);
91484
91485 /*
91486 * Just make sure we have seen our old_write and synchronize
91487 @@ -1021,8 +1021,8 @@ static int rb_tail_page_update(struct ring_buffer_per_cpu *cpu_buffer,
91488 * cmpxchg to only update if an interrupt did not already
91489 * do it for us. If the cmpxchg fails, we don't care.
91490 */
91491 - (void)local_cmpxchg(&next_page->write, old_write, val);
91492 - (void)local_cmpxchg(&next_page->entries, old_entries, eval);
91493 + (void)local_cmpxchg_unchecked(&next_page->write, old_write, val);
91494 + (void)local_cmpxchg_unchecked(&next_page->entries, old_entries, eval);
91495
91496 /*
91497 * No need to worry about races with clearing out the commit.
91498 @@ -1386,12 +1386,12 @@ static void rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer);
91499
91500 static inline unsigned long rb_page_entries(struct buffer_page *bpage)
91501 {
91502 - return local_read(&bpage->entries) & RB_WRITE_MASK;
91503 + return local_read_unchecked(&bpage->entries) & RB_WRITE_MASK;
91504 }
91505
91506 static inline unsigned long rb_page_write(struct buffer_page *bpage)
91507 {
91508 - return local_read(&bpage->write) & RB_WRITE_MASK;
91509 + return local_read_unchecked(&bpage->write) & RB_WRITE_MASK;
91510 }
91511
91512 static int
91513 @@ -1486,7 +1486,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages)
91514 * bytes consumed in ring buffer from here.
91515 * Increment overrun to account for the lost events.
91516 */
91517 - local_add(page_entries, &cpu_buffer->overrun);
91518 + local_add_unchecked(page_entries, &cpu_buffer->overrun);
91519 local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes);
91520 }
91521
91522 @@ -2064,7 +2064,7 @@ rb_handle_head_page(struct ring_buffer_per_cpu *cpu_buffer,
91523 * it is our responsibility to update
91524 * the counters.
91525 */
91526 - local_add(entries, &cpu_buffer->overrun);
91527 + local_add_unchecked(entries, &cpu_buffer->overrun);
91528 local_sub(BUF_PAGE_SIZE, &cpu_buffer->entries_bytes);
91529
91530 /*
91531 @@ -2214,7 +2214,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
91532 if (tail == BUF_PAGE_SIZE)
91533 tail_page->real_end = 0;
91534
91535 - local_sub(length, &tail_page->write);
91536 + local_sub_unchecked(length, &tail_page->write);
91537 return;
91538 }
91539
91540 @@ -2249,7 +2249,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
91541 rb_event_set_padding(event);
91542
91543 /* Set the write back to the previous setting */
91544 - local_sub(length, &tail_page->write);
91545 + local_sub_unchecked(length, &tail_page->write);
91546 return;
91547 }
91548
91549 @@ -2261,7 +2261,7 @@ rb_reset_tail(struct ring_buffer_per_cpu *cpu_buffer,
91550
91551 /* Set write to end of buffer */
91552 length = (tail + length) - BUF_PAGE_SIZE;
91553 - local_sub(length, &tail_page->write);
91554 + local_sub_unchecked(length, &tail_page->write);
91555 }
91556
91557 /*
91558 @@ -2287,7 +2287,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
91559 * about it.
91560 */
91561 if (unlikely(next_page == commit_page)) {
91562 - local_inc(&cpu_buffer->commit_overrun);
91563 + local_inc_unchecked(&cpu_buffer->commit_overrun);
91564 goto out_reset;
91565 }
91566
91567 @@ -2343,7 +2343,7 @@ rb_move_tail(struct ring_buffer_per_cpu *cpu_buffer,
91568 cpu_buffer->tail_page) &&
91569 (cpu_buffer->commit_page ==
91570 cpu_buffer->reader_page))) {
91571 - local_inc(&cpu_buffer->commit_overrun);
91572 + local_inc_unchecked(&cpu_buffer->commit_overrun);
91573 goto out_reset;
91574 }
91575 }
91576 @@ -2391,7 +2391,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
91577 length += RB_LEN_TIME_EXTEND;
91578
91579 tail_page = cpu_buffer->tail_page;
91580 - write = local_add_return(length, &tail_page->write);
91581 + write = local_add_return_unchecked(length, &tail_page->write);
91582
91583 /* set write to only the index of the write */
91584 write &= RB_WRITE_MASK;
91585 @@ -2415,7 +2415,7 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
91586 kmemcheck_annotate_bitfield(event, bitfield);
91587 rb_update_event(cpu_buffer, event, length, add_timestamp, delta);
91588
91589 - local_inc(&tail_page->entries);
91590 + local_inc_unchecked(&tail_page->entries);
91591
91592 /*
91593 * If this is the first commit on the page, then update
91594 @@ -2448,7 +2448,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
91595
91596 if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
91597 unsigned long write_mask =
91598 - local_read(&bpage->write) & ~RB_WRITE_MASK;
91599 + local_read_unchecked(&bpage->write) & ~RB_WRITE_MASK;
91600 unsigned long event_length = rb_event_length(event);
91601 /*
91602 * This is on the tail page. It is possible that
91603 @@ -2458,7 +2458,7 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
91604 */
91605 old_index += write_mask;
91606 new_index += write_mask;
91607 - index = local_cmpxchg(&bpage->write, old_index, new_index);
91608 + index = local_cmpxchg_unchecked(&bpage->write, old_index, new_index);
91609 if (index == old_index) {
91610 /* update counters */
91611 local_sub(event_length, &cpu_buffer->entries_bytes);
91612 @@ -2850,7 +2850,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
91613
91614 /* Do the likely case first */
91615 if (likely(bpage->page == (void *)addr)) {
91616 - local_dec(&bpage->entries);
91617 + local_dec_unchecked(&bpage->entries);
91618 return;
91619 }
91620
91621 @@ -2862,7 +2862,7 @@ rb_decrement_entry(struct ring_buffer_per_cpu *cpu_buffer,
91622 start = bpage;
91623 do {
91624 if (bpage->page == (void *)addr) {
91625 - local_dec(&bpage->entries);
91626 + local_dec_unchecked(&bpage->entries);
91627 return;
91628 }
91629 rb_inc_page(cpu_buffer, &bpage);
91630 @@ -3146,7 +3146,7 @@ static inline unsigned long
91631 rb_num_of_entries(struct ring_buffer_per_cpu *cpu_buffer)
91632 {
91633 return local_read(&cpu_buffer->entries) -
91634 - (local_read(&cpu_buffer->overrun) + cpu_buffer->read);
91635 + (local_read_unchecked(&cpu_buffer->overrun) + cpu_buffer->read);
91636 }
91637
91638 /**
91639 @@ -3235,7 +3235,7 @@ unsigned long ring_buffer_overrun_cpu(struct ring_buffer *buffer, int cpu)
91640 return 0;
91641
91642 cpu_buffer = buffer->buffers[cpu];
91643 - ret = local_read(&cpu_buffer->overrun);
91644 + ret = local_read_unchecked(&cpu_buffer->overrun);
91645
91646 return ret;
91647 }
91648 @@ -3258,7 +3258,7 @@ ring_buffer_commit_overrun_cpu(struct ring_buffer *buffer, int cpu)
91649 return 0;
91650
91651 cpu_buffer = buffer->buffers[cpu];
91652 - ret = local_read(&cpu_buffer->commit_overrun);
91653 + ret = local_read_unchecked(&cpu_buffer->commit_overrun);
91654
91655 return ret;
91656 }
91657 @@ -3343,7 +3343,7 @@ unsigned long ring_buffer_overruns(struct ring_buffer *buffer)
91658 /* if you care about this being correct, lock the buffer */
91659 for_each_buffer_cpu(buffer, cpu) {
91660 cpu_buffer = buffer->buffers[cpu];
91661 - overruns += local_read(&cpu_buffer->overrun);
91662 + overruns += local_read_unchecked(&cpu_buffer->overrun);
91663 }
91664
91665 return overruns;
91666 @@ -3519,8 +3519,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
91667 /*
91668 * Reset the reader page to size zero.
91669 */
91670 - local_set(&cpu_buffer->reader_page->write, 0);
91671 - local_set(&cpu_buffer->reader_page->entries, 0);
91672 + local_set_unchecked(&cpu_buffer->reader_page->write, 0);
91673 + local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
91674 local_set(&cpu_buffer->reader_page->page->commit, 0);
91675 cpu_buffer->reader_page->real_end = 0;
91676
91677 @@ -3554,7 +3554,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
91678 * want to compare with the last_overrun.
91679 */
91680 smp_mb();
91681 - overwrite = local_read(&(cpu_buffer->overrun));
91682 + overwrite = local_read_unchecked(&(cpu_buffer->overrun));
91683
91684 /*
91685 * Here's the tricky part.
91686 @@ -4124,8 +4124,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
91687
91688 cpu_buffer->head_page
91689 = list_entry(cpu_buffer->pages, struct buffer_page, list);
91690 - local_set(&cpu_buffer->head_page->write, 0);
91691 - local_set(&cpu_buffer->head_page->entries, 0);
91692 + local_set_unchecked(&cpu_buffer->head_page->write, 0);
91693 + local_set_unchecked(&cpu_buffer->head_page->entries, 0);
91694 local_set(&cpu_buffer->head_page->page->commit, 0);
91695
91696 cpu_buffer->head_page->read = 0;
91697 @@ -4135,14 +4135,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
91698
91699 INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
91700 INIT_LIST_HEAD(&cpu_buffer->new_pages);
91701 - local_set(&cpu_buffer->reader_page->write, 0);
91702 - local_set(&cpu_buffer->reader_page->entries, 0);
91703 + local_set_unchecked(&cpu_buffer->reader_page->write, 0);
91704 + local_set_unchecked(&cpu_buffer->reader_page->entries, 0);
91705 local_set(&cpu_buffer->reader_page->page->commit, 0);
91706 cpu_buffer->reader_page->read = 0;
91707
91708 local_set(&cpu_buffer->entries_bytes, 0);
91709 - local_set(&cpu_buffer->overrun, 0);
91710 - local_set(&cpu_buffer->commit_overrun, 0);
91711 + local_set_unchecked(&cpu_buffer->overrun, 0);
91712 + local_set_unchecked(&cpu_buffer->commit_overrun, 0);
91713 local_set(&cpu_buffer->dropped_events, 0);
91714 local_set(&cpu_buffer->entries, 0);
91715 local_set(&cpu_buffer->committing, 0);
91716 @@ -4547,8 +4547,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
91717 rb_init_page(bpage);
91718 bpage = reader->page;
91719 reader->page = *data_page;
91720 - local_set(&reader->write, 0);
91721 - local_set(&reader->entries, 0);
91722 + local_set_unchecked(&reader->write, 0);
91723 + local_set_unchecked(&reader->entries, 0);
91724 reader->read = 0;
91725 *data_page = bpage;
91726
91727 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
91728 index 24c1f23..781fd73f 100644
91729 --- a/kernel/trace/trace.c
91730 +++ b/kernel/trace/trace.c
91731 @@ -3399,7 +3399,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
91732 return 0;
91733 }
91734
91735 -int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled)
91736 +int set_tracer_flag(struct trace_array *tr, unsigned long mask, int enabled)
91737 {
91738 /* do nothing if flag is already set */
91739 if (!!(trace_flags & mask) == !!enabled)
91740 diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
91741 index 02b592f..f971546 100644
91742 --- a/kernel/trace/trace.h
91743 +++ b/kernel/trace/trace.h
91744 @@ -1233,7 +1233,7 @@ extern const char *__stop___tracepoint_str[];
91745 void trace_printk_init_buffers(void);
91746 void trace_printk_start_comm(void);
91747 int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set);
91748 -int set_tracer_flag(struct trace_array *tr, unsigned int mask, int enabled);
91749 +int set_tracer_flag(struct trace_array *tr, unsigned long mask, int enabled);
91750
91751 /*
91752 * Normal trace_printk() and friends allocates special buffers
91753 diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c
91754 index 26dc348..8708ca7 100644
91755 --- a/kernel/trace/trace_clock.c
91756 +++ b/kernel/trace/trace_clock.c
91757 @@ -123,7 +123,7 @@ u64 notrace trace_clock_global(void)
91758 return now;
91759 }
91760
91761 -static atomic64_t trace_counter;
91762 +static atomic64_unchecked_t trace_counter;
91763
91764 /*
91765 * trace_clock_counter(): simply an atomic counter.
91766 @@ -132,5 +132,5 @@ static atomic64_t trace_counter;
91767 */
91768 u64 notrace trace_clock_counter(void)
91769 {
91770 - return atomic64_add_return(1, &trace_counter);
91771 + return atomic64_inc_return_unchecked(&trace_counter);
91772 }
91773 diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
91774 index 7b16d40..1b2875d 100644
91775 --- a/kernel/trace/trace_events.c
91776 +++ b/kernel/trace/trace_events.c
91777 @@ -1681,7 +1681,6 @@ __trace_early_add_new_event(struct ftrace_event_call *call,
91778 return 0;
91779 }
91780
91781 -struct ftrace_module_file_ops;
91782 static void __add_event_to_tracers(struct ftrace_event_call *call);
91783
91784 /* Add an additional event_call dynamically */
91785 diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
91786 index 0abd9b8..6a663a2 100644
91787 --- a/kernel/trace/trace_mmiotrace.c
91788 +++ b/kernel/trace/trace_mmiotrace.c
91789 @@ -24,7 +24,7 @@ struct header_iter {
91790 static struct trace_array *mmio_trace_array;
91791 static bool overrun_detected;
91792 static unsigned long prev_overruns;
91793 -static atomic_t dropped_count;
91794 +static atomic_unchecked_t dropped_count;
91795
91796 static void mmio_reset_data(struct trace_array *tr)
91797 {
91798 @@ -127,7 +127,7 @@ static void mmio_close(struct trace_iterator *iter)
91799
91800 static unsigned long count_overruns(struct trace_iterator *iter)
91801 {
91802 - unsigned long cnt = atomic_xchg(&dropped_count, 0);
91803 + unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
91804 unsigned long over = ring_buffer_overruns(iter->trace_buffer->buffer);
91805
91806 if (over > prev_overruns)
91807 @@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
91808 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
91809 sizeof(*entry), 0, pc);
91810 if (!event) {
91811 - atomic_inc(&dropped_count);
91812 + atomic_inc_unchecked(&dropped_count);
91813 return;
91814 }
91815 entry = ring_buffer_event_data(event);
91816 @@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
91817 event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
91818 sizeof(*entry), 0, pc);
91819 if (!event) {
91820 - atomic_inc(&dropped_count);
91821 + atomic_inc_unchecked(&dropped_count);
91822 return;
91823 }
91824 entry = ring_buffer_event_data(event);
91825 diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
91826 index ed32284..884d6c3 100644
91827 --- a/kernel/trace/trace_output.c
91828 +++ b/kernel/trace/trace_output.c
91829 @@ -294,7 +294,7 @@ int trace_seq_path(struct trace_seq *s, const struct path *path)
91830
91831 p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
91832 if (!IS_ERR(p)) {
91833 - p = mangle_path(s->buffer + s->len, p, "\n");
91834 + p = mangle_path(s->buffer + s->len, p, "\n\\");
91835 if (p) {
91836 s->len = p - s->buffer;
91837 return 1;
91838 @@ -908,14 +908,16 @@ int register_ftrace_event(struct trace_event *event)
91839 goto out;
91840 }
91841
91842 + pax_open_kernel();
91843 if (event->funcs->trace == NULL)
91844 - event->funcs->trace = trace_nop_print;
91845 + *(void **)&event->funcs->trace = trace_nop_print;
91846 if (event->funcs->raw == NULL)
91847 - event->funcs->raw = trace_nop_print;
91848 + *(void **)&event->funcs->raw = trace_nop_print;
91849 if (event->funcs->hex == NULL)
91850 - event->funcs->hex = trace_nop_print;
91851 + *(void **)&event->funcs->hex = trace_nop_print;
91852 if (event->funcs->binary == NULL)
91853 - event->funcs->binary = trace_nop_print;
91854 + *(void **)&event->funcs->binary = trace_nop_print;
91855 + pax_close_kernel();
91856
91857 key = event->type & (EVENT_HASHSIZE - 1);
91858
91859 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
91860 index e6be585..d73ae5e 100644
91861 --- a/kernel/trace/trace_stack.c
91862 +++ b/kernel/trace/trace_stack.c
91863 @@ -68,7 +68,7 @@ check_stack(unsigned long ip, unsigned long *stack)
91864 return;
91865
91866 /* we do not handle interrupt stacks yet */
91867 - if (!object_is_on_stack(stack))
91868 + if (!object_starts_on_stack(stack))
91869 return;
91870
91871 local_irq_save(flags);
91872 diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
91873 index 80a57af..7f5a7ff 100644
91874 --- a/kernel/user_namespace.c
91875 +++ b/kernel/user_namespace.c
91876 @@ -82,6 +82,21 @@ int create_user_ns(struct cred *new)
91877 !kgid_has_mapping(parent_ns, group))
91878 return -EPERM;
91879
91880 +#ifdef CONFIG_GRKERNSEC
91881 + /*
91882 + * This doesn't really inspire confidence:
91883 + * http://marc.info/?l=linux-kernel&m=135543612731939&w=2
91884 + * http://marc.info/?l=linux-kernel&m=135545831607095&w=2
91885 + * Increases kernel attack surface in areas developers
91886 + * previously cared little about ("low importance due
91887 + * to requiring "root" capability")
91888 + * To be removed when this code receives *proper* review
91889 + */
91890 + if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SETUID) ||
91891 + !capable(CAP_SETGID))
91892 + return -EPERM;
91893 +#endif
91894 +
91895 ns = kmem_cache_zalloc(user_ns_cachep, GFP_KERNEL);
91896 if (!ns)
91897 return -ENOMEM;
91898 @@ -865,7 +880,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
91899 if (atomic_read(&current->mm->mm_users) > 1)
91900 return -EINVAL;
91901
91902 - if (current->fs->users != 1)
91903 + if (atomic_read(&current->fs->users) != 1)
91904 return -EINVAL;
91905
91906 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
91907 diff --git a/kernel/utsname_sysctl.c b/kernel/utsname_sysctl.c
91908 index 4f69f9a..7c6f8f8 100644
91909 --- a/kernel/utsname_sysctl.c
91910 +++ b/kernel/utsname_sysctl.c
91911 @@ -47,7 +47,7 @@ static void put_uts(ctl_table *table, int write, void *which)
91912 static int proc_do_uts_string(ctl_table *table, int write,
91913 void __user *buffer, size_t *lenp, loff_t *ppos)
91914 {
91915 - struct ctl_table uts_table;
91916 + ctl_table_no_const uts_table;
91917 int r;
91918 memcpy(&uts_table, table, sizeof(uts_table));
91919 uts_table.data = get_uts(table, write);
91920 diff --git a/kernel/watchdog.c b/kernel/watchdog.c
91921 index 4431610..4265616 100644
91922 --- a/kernel/watchdog.c
91923 +++ b/kernel/watchdog.c
91924 @@ -475,7 +475,7 @@ static int watchdog_nmi_enable(unsigned int cpu) { return 0; }
91925 static void watchdog_nmi_disable(unsigned int cpu) { return; }
91926 #endif /* CONFIG_HARDLOCKUP_DETECTOR */
91927
91928 -static struct smp_hotplug_thread watchdog_threads = {
91929 +static struct smp_hotplug_thread watchdog_threads __read_only = {
91930 .store = &softlockup_watchdog,
91931 .thread_should_run = watchdog_should_run,
91932 .thread_fn = watchdog,
91933 diff --git a/kernel/workqueue.c b/kernel/workqueue.c
91934 index 193e977..26dd63f 100644
91935 --- a/kernel/workqueue.c
91936 +++ b/kernel/workqueue.c
91937 @@ -4678,7 +4678,7 @@ static void rebind_workers(struct worker_pool *pool)
91938 WARN_ON_ONCE(!(worker_flags & WORKER_UNBOUND));
91939 worker_flags |= WORKER_REBOUND;
91940 worker_flags &= ~WORKER_UNBOUND;
91941 - ACCESS_ONCE(worker->flags) = worker_flags;
91942 + ACCESS_ONCE_RW(worker->flags) = worker_flags;
91943 }
91944
91945 spin_unlock_irq(&pool->lock);
91946 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
91947 index a48abea..e108def 100644
91948 --- a/lib/Kconfig.debug
91949 +++ b/lib/Kconfig.debug
91950 @@ -854,7 +854,7 @@ config DEBUG_MUTEXES
91951
91952 config DEBUG_WW_MUTEX_SLOWPATH
91953 bool "Wait/wound mutex debugging: Slowpath testing"
91954 - depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
91955 + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT && !PAX_CONSTIFY_PLUGIN
91956 select DEBUG_LOCK_ALLOC
91957 select DEBUG_SPINLOCK
91958 select DEBUG_MUTEXES
91959 @@ -867,7 +867,7 @@ config DEBUG_WW_MUTEX_SLOWPATH
91960
91961 config DEBUG_LOCK_ALLOC
91962 bool "Lock debugging: detect incorrect freeing of live locks"
91963 - depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
91964 + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT && !PAX_CONSTIFY_PLUGIN
91965 select DEBUG_SPINLOCK
91966 select DEBUG_MUTEXES
91967 select LOCKDEP
91968 @@ -881,7 +881,7 @@ config DEBUG_LOCK_ALLOC
91969
91970 config PROVE_LOCKING
91971 bool "Lock debugging: prove locking correctness"
91972 - depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
91973 + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT && !PAX_CONSTIFY_PLUGIN
91974 select LOCKDEP
91975 select DEBUG_SPINLOCK
91976 select DEBUG_MUTEXES
91977 @@ -932,7 +932,7 @@ config LOCKDEP
91978
91979 config LOCK_STAT
91980 bool "Lock usage statistics"
91981 - depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
91982 + depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT && !PAX_CONSTIFY_PLUGIN
91983 select LOCKDEP
91984 select DEBUG_SPINLOCK
91985 select DEBUG_MUTEXES
91986 @@ -1394,6 +1394,7 @@ config LATENCYTOP
91987 depends on DEBUG_KERNEL
91988 depends on STACKTRACE_SUPPORT
91989 depends on PROC_FS
91990 + depends on !GRKERNSEC_HIDESYM
91991 select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE && !ARM_UNWIND && !ARC
91992 select KALLSYMS
91993 select KALLSYMS_ALL
91994 @@ -1410,7 +1411,7 @@ config ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
91995 config DEBUG_STRICT_USER_COPY_CHECKS
91996 bool "Strict user copy size checks"
91997 depends on ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
91998 - depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
91999 + depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING && !PAX_SIZE_OVERFLOW
92000 help
92001 Enabling this option turns a certain set of sanity checks for user
92002 copy operations into compile time failures.
92003 @@ -1529,7 +1530,7 @@ endmenu # runtime tests
92004
92005 config PROVIDE_OHCI1394_DMA_INIT
92006 bool "Remote debugging over FireWire early on boot"
92007 - depends on PCI && X86
92008 + depends on PCI && X86 && !GRKERNSEC
92009 help
92010 If you want to debug problems which hang or crash the kernel early
92011 on boot and the crashing machine has a FireWire port, you can use
92012 diff --git a/lib/Makefile b/lib/Makefile
92013 index 48140e3..de854e5 100644
92014 --- a/lib/Makefile
92015 +++ b/lib/Makefile
92016 @@ -52,7 +52,7 @@ obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o
92017 obj-$(CONFIG_BTREE) += btree.o
92018 obj-$(CONFIG_ASSOCIATIVE_ARRAY) += assoc_array.o
92019 obj-$(CONFIG_DEBUG_PREEMPT) += smp_processor_id.o
92020 -obj-$(CONFIG_DEBUG_LIST) += list_debug.o
92021 +obj-y += list_debug.o
92022 obj-$(CONFIG_DEBUG_OBJECTS) += debugobjects.o
92023
92024 ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
92025 diff --git a/lib/average.c b/lib/average.c
92026 index 114d1be..ab0350c 100644
92027 --- a/lib/average.c
92028 +++ b/lib/average.c
92029 @@ -55,7 +55,7 @@ struct ewma *ewma_add(struct ewma *avg, unsigned long val)
92030 {
92031 unsigned long internal = ACCESS_ONCE(avg->internal);
92032
92033 - ACCESS_ONCE(avg->internal) = internal ?
92034 + ACCESS_ONCE_RW(avg->internal) = internal ?
92035 (((internal << avg->weight) - internal) +
92036 (val << avg->factor)) >> avg->weight :
92037 (val << avg->factor);
92038 diff --git a/lib/bitmap.c b/lib/bitmap.c
92039 index 06f7e4f..f3cf2b0 100644
92040 --- a/lib/bitmap.c
92041 +++ b/lib/bitmap.c
92042 @@ -422,7 +422,7 @@ int __bitmap_parse(const char *buf, unsigned int buflen,
92043 {
92044 int c, old_c, totaldigits, ndigits, nchunks, nbits;
92045 u32 chunk;
92046 - const char __user __force *ubuf = (const char __user __force *)buf;
92047 + const char __user *ubuf = (const char __force_user *)buf;
92048
92049 bitmap_zero(maskp, nmaskbits);
92050
92051 @@ -507,7 +507,7 @@ int bitmap_parse_user(const char __user *ubuf,
92052 {
92053 if (!access_ok(VERIFY_READ, ubuf, ulen))
92054 return -EFAULT;
92055 - return __bitmap_parse((const char __force *)ubuf,
92056 + return __bitmap_parse((const char __force_kernel *)ubuf,
92057 ulen, 1, maskp, nmaskbits);
92058
92059 }
92060 @@ -598,7 +598,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
92061 {
92062 unsigned a, b;
92063 int c, old_c, totaldigits;
92064 - const char __user __force *ubuf = (const char __user __force *)buf;
92065 + const char __user *ubuf = (const char __force_user *)buf;
92066 int exp_digit, in_range;
92067
92068 totaldigits = c = 0;
92069 @@ -698,7 +698,7 @@ int bitmap_parselist_user(const char __user *ubuf,
92070 {
92071 if (!access_ok(VERIFY_READ, ubuf, ulen))
92072 return -EFAULT;
92073 - return __bitmap_parselist((const char __force *)ubuf,
92074 + return __bitmap_parselist((const char __force_kernel *)ubuf,
92075 ulen, 1, maskp, nmaskbits);
92076 }
92077 EXPORT_SYMBOL(bitmap_parselist_user);
92078 diff --git a/lib/bug.c b/lib/bug.c
92079 index 1686034..a9c00c8 100644
92080 --- a/lib/bug.c
92081 +++ b/lib/bug.c
92082 @@ -134,6 +134,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
92083 return BUG_TRAP_TYPE_NONE;
92084
92085 bug = find_bug(bugaddr);
92086 + if (!bug)
92087 + return BUG_TRAP_TYPE_NONE;
92088
92089 file = NULL;
92090 line = 0;
92091 diff --git a/lib/debugobjects.c b/lib/debugobjects.c
92092 index e0731c3..ad66444 100644
92093 --- a/lib/debugobjects.c
92094 +++ b/lib/debugobjects.c
92095 @@ -286,7 +286,7 @@ static void debug_object_is_on_stack(void *addr, int onstack)
92096 if (limit > 4)
92097 return;
92098
92099 - is_on_stack = object_is_on_stack(addr);
92100 + is_on_stack = object_starts_on_stack(addr);
92101 if (is_on_stack == onstack)
92102 return;
92103
92104 diff --git a/lib/devres.c b/lib/devres.c
92105 index 8235331..5881053 100644
92106 --- a/lib/devres.c
92107 +++ b/lib/devres.c
92108 @@ -81,7 +81,7 @@ EXPORT_SYMBOL(devm_ioremap_nocache);
92109 void devm_iounmap(struct device *dev, void __iomem *addr)
92110 {
92111 WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match,
92112 - (void *)addr));
92113 + (void __force *)addr));
92114 iounmap(addr);
92115 }
92116 EXPORT_SYMBOL(devm_iounmap);
92117 @@ -224,7 +224,7 @@ void devm_ioport_unmap(struct device *dev, void __iomem *addr)
92118 {
92119 ioport_unmap(addr);
92120 WARN_ON(devres_destroy(dev, devm_ioport_map_release,
92121 - devm_ioport_map_match, (void *)addr));
92122 + devm_ioport_map_match, (void __force *)addr));
92123 }
92124 EXPORT_SYMBOL(devm_ioport_unmap);
92125 #endif /* CONFIG_HAS_IOPORT */
92126 diff --git a/lib/div64.c b/lib/div64.c
92127 index 4382ad7..08aa558 100644
92128 --- a/lib/div64.c
92129 +++ b/lib/div64.c
92130 @@ -59,7 +59,7 @@ uint32_t __attribute__((weak)) __div64_32(uint64_t *n, uint32_t base)
92131 EXPORT_SYMBOL(__div64_32);
92132
92133 #ifndef div_s64_rem
92134 -s64 div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
92135 +s64 __intentional_overflow(-1) div_s64_rem(s64 dividend, s32 divisor, s32 *remainder)
92136 {
92137 u64 quotient;
92138
92139 @@ -130,7 +130,7 @@ EXPORT_SYMBOL(div64_u64_rem);
92140 * 'http://www.hackersdelight.org/HDcode/newCode/divDouble.c.txt'
92141 */
92142 #ifndef div64_u64
92143 -u64 div64_u64(u64 dividend, u64 divisor)
92144 +u64 __intentional_overflow(-1) div64_u64(u64 dividend, u64 divisor)
92145 {
92146 u32 high = divisor >> 32;
92147 u64 quot;
92148 diff --git a/lib/dma-debug.c b/lib/dma-debug.c
92149 index 98f2d7e..899da5c 100644
92150 --- a/lib/dma-debug.c
92151 +++ b/lib/dma-debug.c
92152 @@ -971,7 +971,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
92153
92154 void dma_debug_add_bus(struct bus_type *bus)
92155 {
92156 - struct notifier_block *nb;
92157 + notifier_block_no_const *nb;
92158
92159 if (global_disable)
92160 return;
92161 @@ -1148,7 +1148,7 @@ static void check_unmap(struct dma_debug_entry *ref)
92162
92163 static void check_for_stack(struct device *dev, void *addr)
92164 {
92165 - if (object_is_on_stack(addr))
92166 + if (object_starts_on_stack(addr))
92167 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
92168 "stack [addr=%p]\n", addr);
92169 }
92170 diff --git a/lib/hash.c b/lib/hash.c
92171 index fea973f..386626f 100644
92172 --- a/lib/hash.c
92173 +++ b/lib/hash.c
92174 @@ -14,7 +14,7 @@
92175 #include <linux/hash.h>
92176 #include <linux/cache.h>
92177
92178 -static struct fast_hash_ops arch_hash_ops __read_mostly = {
92179 +static struct fast_hash_ops arch_hash_ops __read_only = {
92180 .hash = jhash,
92181 .hash2 = jhash2,
92182 };
92183 diff --git a/lib/inflate.c b/lib/inflate.c
92184 index 013a761..c28f3fc 100644
92185 --- a/lib/inflate.c
92186 +++ b/lib/inflate.c
92187 @@ -269,7 +269,7 @@ static void free(void *where)
92188 malloc_ptr = free_mem_ptr;
92189 }
92190 #else
92191 -#define malloc(a) kmalloc(a, GFP_KERNEL)
92192 +#define malloc(a) kmalloc((a), GFP_KERNEL)
92193 #define free(a) kfree(a)
92194 #endif
92195
92196 diff --git a/lib/ioremap.c b/lib/ioremap.c
92197 index 0c9216c..863bd89 100644
92198 --- a/lib/ioremap.c
92199 +++ b/lib/ioremap.c
92200 @@ -38,7 +38,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr,
92201 unsigned long next;
92202
92203 phys_addr -= addr;
92204 - pmd = pmd_alloc(&init_mm, pud, addr);
92205 + pmd = pmd_alloc_kernel(&init_mm, pud, addr);
92206 if (!pmd)
92207 return -ENOMEM;
92208 do {
92209 @@ -56,7 +56,7 @@ static inline int ioremap_pud_range(pgd_t *pgd, unsigned long addr,
92210 unsigned long next;
92211
92212 phys_addr -= addr;
92213 - pud = pud_alloc(&init_mm, pgd, addr);
92214 + pud = pud_alloc_kernel(&init_mm, pgd, addr);
92215 if (!pud)
92216 return -ENOMEM;
92217 do {
92218 diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
92219 index bd2bea9..6b3c95e 100644
92220 --- a/lib/is_single_threaded.c
92221 +++ b/lib/is_single_threaded.c
92222 @@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
92223 struct task_struct *p, *t;
92224 bool ret;
92225
92226 + if (!mm)
92227 + return true;
92228 +
92229 if (atomic_read(&task->signal->live) != 1)
92230 return false;
92231
92232 diff --git a/lib/kobject.c b/lib/kobject.c
92233 index cb14aea..8c53cdb 100644
92234 --- a/lib/kobject.c
92235 +++ b/lib/kobject.c
92236 @@ -931,9 +931,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
92237
92238
92239 static DEFINE_SPINLOCK(kobj_ns_type_lock);
92240 -static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES];
92241 +static const struct kobj_ns_type_operations *kobj_ns_ops_tbl[KOBJ_NS_TYPES] __read_only;
92242
92243 -int kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
92244 +int __init kobj_ns_type_register(const struct kobj_ns_type_operations *ops)
92245 {
92246 enum kobj_ns_type type = ops->type;
92247 int error;
92248 diff --git a/lib/list_debug.c b/lib/list_debug.c
92249 index c24c2f7..f0296f4 100644
92250 --- a/lib/list_debug.c
92251 +++ b/lib/list_debug.c
92252 @@ -11,7 +11,9 @@
92253 #include <linux/bug.h>
92254 #include <linux/kernel.h>
92255 #include <linux/rculist.h>
92256 +#include <linux/mm.h>
92257
92258 +#ifdef CONFIG_DEBUG_LIST
92259 /*
92260 * Insert a new entry between two known consecutive entries.
92261 *
92262 @@ -19,21 +21,40 @@
92263 * the prev/next entries already!
92264 */
92265
92266 +static bool __list_add_debug(struct list_head *new,
92267 + struct list_head *prev,
92268 + struct list_head *next)
92269 +{
92270 + if (unlikely(next->prev != prev)) {
92271 + printk(KERN_ERR "list_add corruption. next->prev should be "
92272 + "prev (%p), but was %p. (next=%p).\n",
92273 + prev, next->prev, next);
92274 + BUG();
92275 + return false;
92276 + }
92277 + if (unlikely(prev->next != next)) {
92278 + printk(KERN_ERR "list_add corruption. prev->next should be "
92279 + "next (%p), but was %p. (prev=%p).\n",
92280 + next, prev->next, prev);
92281 + BUG();
92282 + return false;
92283 + }
92284 + if (unlikely(new == prev || new == next)) {
92285 + printk(KERN_ERR "list_add double add: new=%p, prev=%p, next=%p.\n",
92286 + new, prev, next);
92287 + BUG();
92288 + return false;
92289 + }
92290 + return true;
92291 +}
92292 +
92293 void __list_add(struct list_head *new,
92294 - struct list_head *prev,
92295 - struct list_head *next)
92296 + struct list_head *prev,
92297 + struct list_head *next)
92298 {
92299 - WARN(next->prev != prev,
92300 - "list_add corruption. next->prev should be "
92301 - "prev (%p), but was %p. (next=%p).\n",
92302 - prev, next->prev, next);
92303 - WARN(prev->next != next,
92304 - "list_add corruption. prev->next should be "
92305 - "next (%p), but was %p. (prev=%p).\n",
92306 - next, prev->next, prev);
92307 - WARN(new == prev || new == next,
92308 - "list_add double add: new=%p, prev=%p, next=%p.\n",
92309 - new, prev, next);
92310 + if (!__list_add_debug(new, prev, next))
92311 + return;
92312 +
92313 next->prev = new;
92314 new->next = next;
92315 new->prev = prev;
92316 @@ -41,28 +62,46 @@ void __list_add(struct list_head *new,
92317 }
92318 EXPORT_SYMBOL(__list_add);
92319
92320 -void __list_del_entry(struct list_head *entry)
92321 +static bool __list_del_entry_debug(struct list_head *entry)
92322 {
92323 struct list_head *prev, *next;
92324
92325 prev = entry->prev;
92326 next = entry->next;
92327
92328 - if (WARN(next == LIST_POISON1,
92329 - "list_del corruption, %p->next is LIST_POISON1 (%p)\n",
92330 - entry, LIST_POISON1) ||
92331 - WARN(prev == LIST_POISON2,
92332 - "list_del corruption, %p->prev is LIST_POISON2 (%p)\n",
92333 - entry, LIST_POISON2) ||
92334 - WARN(prev->next != entry,
92335 - "list_del corruption. prev->next should be %p, "
92336 - "but was %p\n", entry, prev->next) ||
92337 - WARN(next->prev != entry,
92338 - "list_del corruption. next->prev should be %p, "
92339 - "but was %p\n", entry, next->prev))
92340 + if (unlikely(next == LIST_POISON1)) {
92341 + printk(KERN_ERR "list_del corruption, %p->next is LIST_POISON1 (%p)\n",
92342 + entry, LIST_POISON1);
92343 + BUG();
92344 + return false;
92345 + }
92346 + if (unlikely(prev == LIST_POISON2)) {
92347 + printk(KERN_ERR "list_del corruption, %p->prev is LIST_POISON2 (%p)\n",
92348 + entry, LIST_POISON2);
92349 + BUG();
92350 + return false;
92351 + }
92352 + if (unlikely(entry->prev->next != entry)) {
92353 + printk(KERN_ERR "list_del corruption. prev->next should be %p, "
92354 + "but was %p\n", entry, prev->next);
92355 + BUG();
92356 + return false;
92357 + }
92358 + if (unlikely(entry->next->prev != entry)) {
92359 + printk(KERN_ERR "list_del corruption. next->prev should be %p, "
92360 + "but was %p\n", entry, next->prev);
92361 + BUG();
92362 + return false;
92363 + }
92364 + return true;
92365 +}
92366 +
92367 +void __list_del_entry(struct list_head *entry)
92368 +{
92369 + if (!__list_del_entry_debug(entry))
92370 return;
92371
92372 - __list_del(prev, next);
92373 + __list_del(entry->prev, entry->next);
92374 }
92375 EXPORT_SYMBOL(__list_del_entry);
92376
92377 @@ -86,15 +125,85 @@ EXPORT_SYMBOL(list_del);
92378 void __list_add_rcu(struct list_head *new,
92379 struct list_head *prev, struct list_head *next)
92380 {
92381 - WARN(next->prev != prev,
92382 - "list_add_rcu corruption. next->prev should be prev (%p), but was %p. (next=%p).\n",
92383 - prev, next->prev, next);
92384 - WARN(prev->next != next,
92385 - "list_add_rcu corruption. prev->next should be next (%p), but was %p. (prev=%p).\n",
92386 - next, prev->next, prev);
92387 + if (!__list_add_debug(new, prev, next))
92388 + return;
92389 +
92390 new->next = next;
92391 new->prev = prev;
92392 rcu_assign_pointer(list_next_rcu(prev), new);
92393 next->prev = new;
92394 }
92395 EXPORT_SYMBOL(__list_add_rcu);
92396 +#endif
92397 +
92398 +void __pax_list_add(struct list_head *new, struct list_head *prev, struct list_head *next)
92399 +{
92400 +#ifdef CONFIG_DEBUG_LIST
92401 + if (!__list_add_debug(new, prev, next))
92402 + return;
92403 +#endif
92404 +
92405 + pax_open_kernel();
92406 + next->prev = new;
92407 + new->next = next;
92408 + new->prev = prev;
92409 + prev->next = new;
92410 + pax_close_kernel();
92411 +}
92412 +EXPORT_SYMBOL(__pax_list_add);
92413 +
92414 +void pax_list_del(struct list_head *entry)
92415 +{
92416 +#ifdef CONFIG_DEBUG_LIST
92417 + if (!__list_del_entry_debug(entry))
92418 + return;
92419 +#endif
92420 +
92421 + pax_open_kernel();
92422 + __list_del(entry->prev, entry->next);
92423 + entry->next = LIST_POISON1;
92424 + entry->prev = LIST_POISON2;
92425 + pax_close_kernel();
92426 +}
92427 +EXPORT_SYMBOL(pax_list_del);
92428 +
92429 +void pax_list_del_init(struct list_head *entry)
92430 +{
92431 + pax_open_kernel();
92432 + __list_del(entry->prev, entry->next);
92433 + INIT_LIST_HEAD(entry);
92434 + pax_close_kernel();
92435 +}
92436 +EXPORT_SYMBOL(pax_list_del_init);
92437 +
92438 +void __pax_list_add_rcu(struct list_head *new,
92439 + struct list_head *prev, struct list_head *next)
92440 +{
92441 +#ifdef CONFIG_DEBUG_LIST
92442 + if (!__list_add_debug(new, prev, next))
92443 + return;
92444 +#endif
92445 +
92446 + pax_open_kernel();
92447 + new->next = next;
92448 + new->prev = prev;
92449 + rcu_assign_pointer(list_next_rcu(prev), new);
92450 + next->prev = new;
92451 + pax_close_kernel();
92452 +}
92453 +EXPORT_SYMBOL(__pax_list_add_rcu);
92454 +
92455 +void pax_list_del_rcu(struct list_head *entry)
92456 +{
92457 +#ifdef CONFIG_DEBUG_LIST
92458 + if (!__list_del_entry_debug(entry))
92459 + return;
92460 +#endif
92461 +
92462 + pax_open_kernel();
92463 + __list_del(entry->prev, entry->next);
92464 + entry->next = LIST_POISON1;
92465 + entry->prev = LIST_POISON2;
92466 + pax_close_kernel();
92467 +}
92468 +EXPORT_SYMBOL(pax_list_del_rcu);
92469 diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
92470 index 963b703..438bc51 100644
92471 --- a/lib/percpu-refcount.c
92472 +++ b/lib/percpu-refcount.c
92473 @@ -29,7 +29,7 @@
92474 * can't hit 0 before we've added up all the percpu refs.
92475 */
92476
92477 -#define PCPU_COUNT_BIAS (1U << 31)
92478 +#define PCPU_COUNT_BIAS (1U << 30)
92479
92480 /**
92481 * percpu_ref_init - initialize a percpu refcount
92482 diff --git a/lib/radix-tree.c b/lib/radix-tree.c
92483 index bd4a8df..9e4804f 100644
92484 --- a/lib/radix-tree.c
92485 +++ b/lib/radix-tree.c
92486 @@ -93,7 +93,7 @@ struct radix_tree_preload {
92487 int nr;
92488 struct radix_tree_node *nodes[RADIX_TREE_PRELOAD_SIZE];
92489 };
92490 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
92491 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
92492
92493 static inline void *ptr_to_indirect(void *ptr)
92494 {
92495 diff --git a/lib/random32.c b/lib/random32.c
92496 index 6148967..009bfe8 100644
92497 --- a/lib/random32.c
92498 +++ b/lib/random32.c
92499 @@ -44,7 +44,7 @@
92500 static void __init prandom_state_selftest(void);
92501 #endif
92502
92503 -static DEFINE_PER_CPU(struct rnd_state, net_rand_state);
92504 +static DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy;
92505
92506 /**
92507 * prandom_u32_state - seeded pseudo-random number generator.
92508 diff --git a/lib/rbtree.c b/lib/rbtree.c
92509 index 65f4eff..2cfa167 100644
92510 --- a/lib/rbtree.c
92511 +++ b/lib/rbtree.c
92512 @@ -380,7 +380,9 @@ static inline void dummy_copy(struct rb_node *old, struct rb_node *new) {}
92513 static inline void dummy_rotate(struct rb_node *old, struct rb_node *new) {}
92514
92515 static const struct rb_augment_callbacks dummy_callbacks = {
92516 - dummy_propagate, dummy_copy, dummy_rotate
92517 + .propagate = dummy_propagate,
92518 + .copy = dummy_copy,
92519 + .rotate = dummy_rotate
92520 };
92521
92522 void rb_insert_color(struct rb_node *node, struct rb_root *root)
92523 diff --git a/lib/show_mem.c b/lib/show_mem.c
92524 index 0922579..9d7adb9 100644
92525 --- a/lib/show_mem.c
92526 +++ b/lib/show_mem.c
92527 @@ -44,6 +44,6 @@ void show_mem(unsigned int filter)
92528 quicklist_total_size());
92529 #endif
92530 #ifdef CONFIG_MEMORY_FAILURE
92531 - printk("%lu pages hwpoisoned\n", atomic_long_read(&num_poisoned_pages));
92532 + printk("%lu pages hwpoisoned\n", atomic_long_read_unchecked(&num_poisoned_pages));
92533 #endif
92534 }
92535 diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
92536 index bb2b201..46abaf9 100644
92537 --- a/lib/strncpy_from_user.c
92538 +++ b/lib/strncpy_from_user.c
92539 @@ -21,7 +21,7 @@
92540 */
92541 static inline long do_strncpy_from_user(char *dst, const char __user *src, long count, unsigned long max)
92542 {
92543 - const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
92544 + static const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
92545 long res = 0;
92546
92547 /*
92548 diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
92549 index a28df52..3d55877 100644
92550 --- a/lib/strnlen_user.c
92551 +++ b/lib/strnlen_user.c
92552 @@ -26,7 +26,7 @@
92553 */
92554 static inline long do_strnlen_user(const char __user *src, unsigned long count, unsigned long max)
92555 {
92556 - const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
92557 + static const struct word_at_a_time constants = WORD_AT_A_TIME_CONSTANTS;
92558 long align, res = 0;
92559 unsigned long c;
92560
92561 diff --git a/lib/swiotlb.c b/lib/swiotlb.c
92562 index b604b83..c0547f6 100644
92563 --- a/lib/swiotlb.c
92564 +++ b/lib/swiotlb.c
92565 @@ -674,7 +674,7 @@ EXPORT_SYMBOL(swiotlb_alloc_coherent);
92566
92567 void
92568 swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
92569 - dma_addr_t dev_addr)
92570 + dma_addr_t dev_addr, struct dma_attrs *attrs)
92571 {
92572 phys_addr_t paddr = dma_to_phys(hwdev, dev_addr);
92573
92574 diff --git a/lib/usercopy.c b/lib/usercopy.c
92575 index 4f5b1dd..7cab418 100644
92576 --- a/lib/usercopy.c
92577 +++ b/lib/usercopy.c
92578 @@ -7,3 +7,9 @@ void copy_from_user_overflow(void)
92579 WARN(1, "Buffer overflow detected!\n");
92580 }
92581 EXPORT_SYMBOL(copy_from_user_overflow);
92582 +
92583 +void copy_to_user_overflow(void)
92584 +{
92585 + WARN(1, "Buffer overflow detected!\n");
92586 +}
92587 +EXPORT_SYMBOL(copy_to_user_overflow);
92588 diff --git a/lib/vsprintf.c b/lib/vsprintf.c
92589 index 185b6d3..823c48c 100644
92590 --- a/lib/vsprintf.c
92591 +++ b/lib/vsprintf.c
92592 @@ -16,6 +16,9 @@
92593 * - scnprintf and vscnprintf
92594 */
92595
92596 +#ifdef CONFIG_GRKERNSEC_HIDESYM
92597 +#define __INCLUDED_BY_HIDESYM 1
92598 +#endif
92599 #include <stdarg.h>
92600 #include <linux/module.h> /* for KSYM_SYMBOL_LEN */
92601 #include <linux/types.h>
92602 @@ -1179,7 +1182,11 @@ char *address_val(char *buf, char *end, const void *addr,
92603 return number(buf, end, num, spec);
92604 }
92605
92606 +#ifdef CONFIG_GRKERNSEC_HIDESYM
92607 +int kptr_restrict __read_mostly = 2;
92608 +#else
92609 int kptr_restrict __read_mostly;
92610 +#endif
92611
92612 /*
92613 * Show a '%p' thing. A kernel extension is that the '%p' is followed
92614 @@ -1192,6 +1199,7 @@ int kptr_restrict __read_mostly;
92615 * - 'f' For simple symbolic function names without offset
92616 * - 'S' For symbolic direct pointers with offset
92617 * - 's' For symbolic direct pointers without offset
92618 + * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
92619 * - '[FfSs]R' as above with __builtin_extract_return_addr() translation
92620 * - 'B' For backtraced symbolic direct pointers with offset
92621 * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
92622 @@ -1259,12 +1267,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
92623
92624 if (!ptr && *fmt != 'K') {
92625 /*
92626 - * Print (null) with the same width as a pointer so it makes
92627 + * Print (nil) with the same width as a pointer so it makes
92628 * tabular output look nice.
92629 */
92630 if (spec.field_width == -1)
92631 spec.field_width = default_width;
92632 - return string(buf, end, "(null)", spec);
92633 + return string(buf, end, "(nil)", spec);
92634 }
92635
92636 switch (*fmt) {
92637 @@ -1274,6 +1282,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
92638 /* Fallthrough */
92639 case 'S':
92640 case 's':
92641 +#ifdef CONFIG_GRKERNSEC_HIDESYM
92642 + break;
92643 +#else
92644 + return symbol_string(buf, end, ptr, spec, fmt);
92645 +#endif
92646 + case 'A':
92647 case 'B':
92648 return symbol_string(buf, end, ptr, spec, fmt);
92649 case 'R':
92650 @@ -1329,6 +1343,8 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
92651 va_end(va);
92652 return buf;
92653 }
92654 + case 'P':
92655 + break;
92656 case 'K':
92657 /*
92658 * %pK cannot be used in IRQ context because its test
92659 @@ -1386,6 +1402,21 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
92660 ((const struct file *)ptr)->f_path.dentry,
92661 spec, fmt);
92662 }
92663 +
92664 +#ifdef CONFIG_GRKERNSEC_HIDESYM
92665 + /* 'P' = approved pointers to copy to userland,
92666 + as in the /proc/kallsyms case, as we make it display nothing
92667 + for non-root users, and the real contents for root users
92668 + Also ignore 'K' pointers, since we force their NULLing for non-root users
92669 + above
92670 + */
92671 + if ((unsigned long)ptr > TASK_SIZE && *fmt != 'P' && *fmt != 'K' && is_usercopy_object(buf)) {
92672 + printk(KERN_ALERT "grsec: kernel infoleak detected! Please report this log to spender@grsecurity.net.\n");
92673 + dump_stack();
92674 + ptr = NULL;
92675 + }
92676 +#endif
92677 +
92678 spec.flags |= SMALL;
92679 if (spec.field_width == -1) {
92680 spec.field_width = default_width;
92681 @@ -2107,11 +2138,11 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
92682 typeof(type) value; \
92683 if (sizeof(type) == 8) { \
92684 args = PTR_ALIGN(args, sizeof(u32)); \
92685 - *(u32 *)&value = *(u32 *)args; \
92686 - *((u32 *)&value + 1) = *(u32 *)(args + 4); \
92687 + *(u32 *)&value = *(const u32 *)args; \
92688 + *((u32 *)&value + 1) = *(const u32 *)(args + 4); \
92689 } else { \
92690 args = PTR_ALIGN(args, sizeof(type)); \
92691 - value = *(typeof(type) *)args; \
92692 + value = *(const typeof(type) *)args; \
92693 } \
92694 args += sizeof(type); \
92695 value; \
92696 @@ -2174,7 +2205,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
92697 case FORMAT_TYPE_STR: {
92698 const char *str_arg = args;
92699 args += strlen(str_arg) + 1;
92700 - str = string(str, end, (char *)str_arg, spec);
92701 + str = string(str, end, str_arg, spec);
92702 break;
92703 }
92704
92705 diff --git a/localversion-grsec b/localversion-grsec
92706 new file mode 100644
92707 index 0000000..7cd6065
92708 --- /dev/null
92709 +++ b/localversion-grsec
92710 @@ -0,0 +1 @@
92711 +-grsec
92712 diff --git a/mm/Kconfig b/mm/Kconfig
92713 index 2888024..c15a810 100644
92714 --- a/mm/Kconfig
92715 +++ b/mm/Kconfig
92716 @@ -326,10 +326,11 @@ config KSM
92717 root has set /sys/kernel/mm/ksm/run to 1 (if CONFIG_SYSFS is set).
92718
92719 config DEFAULT_MMAP_MIN_ADDR
92720 - int "Low address space to protect from user allocation"
92721 + int "Low address space to protect from user allocation"
92722 depends on MMU
92723 - default 4096
92724 - help
92725 + default 32768 if ALPHA || ARM || PARISC || SPARC32
92726 + default 65536
92727 + help
92728 This is the portion of low virtual memory which should be protected
92729 from userspace allocation. Keeping a user from writing to low pages
92730 can help reduce the impact of kernel NULL pointer bugs.
92731 @@ -360,7 +361,7 @@ config MEMORY_FAILURE
92732
92733 config HWPOISON_INJECT
92734 tristate "HWPoison pages injector"
92735 - depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS
92736 + depends on MEMORY_FAILURE && DEBUG_KERNEL && PROC_FS && !GRKERNSEC
92737 select PROC_PAGE_MONITOR
92738
92739 config NOMMU_INITIAL_TRIM_EXCESS
92740 diff --git a/mm/backing-dev.c b/mm/backing-dev.c
92741 index 09d9591..165bb75 100644
92742 --- a/mm/backing-dev.c
92743 +++ b/mm/backing-dev.c
92744 @@ -12,7 +12,7 @@
92745 #include <linux/device.h>
92746 #include <trace/events/writeback.h>
92747
92748 -static atomic_long_t bdi_seq = ATOMIC_LONG_INIT(0);
92749 +static atomic_long_unchecked_t bdi_seq = ATOMIC_LONG_INIT(0);
92750
92751 struct backing_dev_info default_backing_dev_info = {
92752 .name = "default",
92753 @@ -533,7 +533,7 @@ int bdi_setup_and_register(struct backing_dev_info *bdi, char *name,
92754 return err;
92755
92756 err = bdi_register(bdi, NULL, "%.28s-%ld", name,
92757 - atomic_long_inc_return(&bdi_seq));
92758 + atomic_long_inc_return_unchecked(&bdi_seq));
92759 if (err) {
92760 bdi_destroy(bdi);
92761 return err;
92762 diff --git a/mm/filemap.c b/mm/filemap.c
92763 index 7a13f6a..e31738b 100644
92764 --- a/mm/filemap.c
92765 +++ b/mm/filemap.c
92766 @@ -192,9 +192,11 @@ static int filemap_check_errors(struct address_space *mapping)
92767 {
92768 int ret = 0;
92769 /* Check for outstanding write errors */
92770 - if (test_and_clear_bit(AS_ENOSPC, &mapping->flags))
92771 + if (test_bit(AS_ENOSPC, &mapping->flags) &&
92772 + test_and_clear_bit(AS_ENOSPC, &mapping->flags))
92773 ret = -ENOSPC;
92774 - if (test_and_clear_bit(AS_EIO, &mapping->flags))
92775 + if (test_bit(AS_EIO, &mapping->flags) &&
92776 + test_and_clear_bit(AS_EIO, &mapping->flags))
92777 ret = -EIO;
92778 return ret;
92779 }
92780 @@ -1766,7 +1768,7 @@ int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
92781 struct address_space *mapping = file->f_mapping;
92782
92783 if (!mapping->a_ops->readpage)
92784 - return -ENOEXEC;
92785 + return -ENODEV;
92786 file_accessed(file);
92787 vma->vm_ops = &generic_file_vm_ops;
92788 return 0;
92789 @@ -1948,7 +1950,7 @@ static size_t __iovec_copy_from_user_inatomic(char *vaddr,
92790
92791 while (bytes) {
92792 char __user *buf = iov->iov_base + base;
92793 - int copy = min(bytes, iov->iov_len - base);
92794 + size_t copy = min(bytes, iov->iov_len - base);
92795
92796 base = 0;
92797 left = __copy_from_user_inatomic(vaddr, buf, copy);
92798 @@ -1977,7 +1979,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
92799 BUG_ON(!in_atomic());
92800 kaddr = kmap_atomic(page);
92801 if (likely(i->nr_segs == 1)) {
92802 - int left;
92803 + size_t left;
92804 char __user *buf = i->iov->iov_base + i->iov_offset;
92805 left = __copy_from_user_inatomic(kaddr + offset, buf, bytes);
92806 copied = bytes - left;
92807 @@ -2005,7 +2007,7 @@ size_t iov_iter_copy_from_user(struct page *page,
92808
92809 kaddr = kmap(page);
92810 if (likely(i->nr_segs == 1)) {
92811 - int left;
92812 + size_t left;
92813 char __user *buf = i->iov->iov_base + i->iov_offset;
92814 left = __copy_from_user(kaddr + offset, buf, bytes);
92815 copied = bytes - left;
92816 @@ -2035,7 +2037,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
92817 * zero-length segments (without overruning the iovec).
92818 */
92819 while (bytes || unlikely(i->count && !iov->iov_len)) {
92820 - int copy;
92821 + size_t copy;
92822
92823 copy = min(bytes, iov->iov_len - base);
92824 BUG_ON(!i->count || i->count < copy);
92825 @@ -2106,6 +2108,7 @@ inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, i
92826 *pos = i_size_read(inode);
92827
92828 if (limit != RLIM_INFINITY) {
92829 + gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
92830 if (*pos >= limit) {
92831 send_sig(SIGXFSZ, current, 0);
92832 return -EFBIG;
92833 diff --git a/mm/fremap.c b/mm/fremap.c
92834 index 34feba6..315fe78 100644
92835 --- a/mm/fremap.c
92836 +++ b/mm/fremap.c
92837 @@ -179,6 +179,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
92838 retry:
92839 vma = find_vma(mm, start);
92840
92841 +#ifdef CONFIG_PAX_SEGMEXEC
92842 + if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
92843 + goto out;
92844 +#endif
92845 +
92846 /*
92847 * Make sure the vma is shared, that it supports prefaulting,
92848 * and that the remapped range is valid and fully within
92849 diff --git a/mm/highmem.c b/mm/highmem.c
92850 index b32b70c..e512eb0 100644
92851 --- a/mm/highmem.c
92852 +++ b/mm/highmem.c
92853 @@ -138,8 +138,9 @@ static void flush_all_zero_pkmaps(void)
92854 * So no dangers, even with speculative execution.
92855 */
92856 page = pte_page(pkmap_page_table[i]);
92857 + pax_open_kernel();
92858 pte_clear(&init_mm, PKMAP_ADDR(i), &pkmap_page_table[i]);
92859 -
92860 + pax_close_kernel();
92861 set_page_address(page, NULL);
92862 need_flush = 1;
92863 }
92864 @@ -198,9 +199,11 @@ start:
92865 }
92866 }
92867 vaddr = PKMAP_ADDR(last_pkmap_nr);
92868 +
92869 + pax_open_kernel();
92870 set_pte_at(&init_mm, vaddr,
92871 &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
92872 -
92873 + pax_close_kernel();
92874 pkmap_count[last_pkmap_nr] = 1;
92875 set_page_address(page, (void *)vaddr);
92876
92877 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
92878 index 06a9bc0..cfbba83 100644
92879 --- a/mm/hugetlb.c
92880 +++ b/mm/hugetlb.c
92881 @@ -2070,15 +2070,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
92882 struct hstate *h = &default_hstate;
92883 unsigned long tmp;
92884 int ret;
92885 + ctl_table_no_const hugetlb_table;
92886
92887 tmp = h->max_huge_pages;
92888
92889 if (write && h->order >= MAX_ORDER)
92890 return -EINVAL;
92891
92892 - table->data = &tmp;
92893 - table->maxlen = sizeof(unsigned long);
92894 - ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
92895 + hugetlb_table = *table;
92896 + hugetlb_table.data = &tmp;
92897 + hugetlb_table.maxlen = sizeof(unsigned long);
92898 + ret = proc_doulongvec_minmax(&hugetlb_table, write, buffer, length, ppos);
92899 if (ret)
92900 goto out;
92901
92902 @@ -2123,15 +2125,17 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
92903 struct hstate *h = &default_hstate;
92904 unsigned long tmp;
92905 int ret;
92906 + ctl_table_no_const hugetlb_table;
92907
92908 tmp = h->nr_overcommit_huge_pages;
92909
92910 if (write && h->order >= MAX_ORDER)
92911 return -EINVAL;
92912
92913 - table->data = &tmp;
92914 - table->maxlen = sizeof(unsigned long);
92915 - ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
92916 + hugetlb_table = *table;
92917 + hugetlb_table.data = &tmp;
92918 + hugetlb_table.maxlen = sizeof(unsigned long);
92919 + ret = proc_doulongvec_minmax(&hugetlb_table, write, buffer, length, ppos);
92920 if (ret)
92921 goto out;
92922
92923 @@ -2600,6 +2604,27 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
92924 return 1;
92925 }
92926
92927 +#ifdef CONFIG_PAX_SEGMEXEC
92928 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
92929 +{
92930 + struct mm_struct *mm = vma->vm_mm;
92931 + struct vm_area_struct *vma_m;
92932 + unsigned long address_m;
92933 + pte_t *ptep_m;
92934 +
92935 + vma_m = pax_find_mirror_vma(vma);
92936 + if (!vma_m)
92937 + return;
92938 +
92939 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
92940 + address_m = address + SEGMEXEC_TASK_SIZE;
92941 + ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
92942 + get_page(page_m);
92943 + hugepage_add_anon_rmap(page_m, vma_m, address_m);
92944 + set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
92945 +}
92946 +#endif
92947 +
92948 /*
92949 * Hugetlb_cow() should be called with page lock of the original hugepage held.
92950 * Called with hugetlb_instantiation_mutex held and pte_page locked so we
92951 @@ -2716,6 +2741,11 @@ retry_avoidcopy:
92952 make_huge_pte(vma, new_page, 1));
92953 page_remove_rmap(old_page);
92954 hugepage_add_new_anon_rmap(new_page, vma, address);
92955 +
92956 +#ifdef CONFIG_PAX_SEGMEXEC
92957 + pax_mirror_huge_pte(vma, address, new_page);
92958 +#endif
92959 +
92960 /* Make the old page be freed below */
92961 new_page = old_page;
92962 }
92963 @@ -2880,6 +2910,10 @@ retry:
92964 && (vma->vm_flags & VM_SHARED)));
92965 set_huge_pte_at(mm, address, ptep, new_pte);
92966
92967 +#ifdef CONFIG_PAX_SEGMEXEC
92968 + pax_mirror_huge_pte(vma, address, page);
92969 +#endif
92970 +
92971 if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
92972 /* Optimization, do the COW without a second fault */
92973 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page, ptl);
92974 @@ -2910,6 +2944,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
92975 static DEFINE_MUTEX(hugetlb_instantiation_mutex);
92976 struct hstate *h = hstate_vma(vma);
92977
92978 +#ifdef CONFIG_PAX_SEGMEXEC
92979 + struct vm_area_struct *vma_m;
92980 +#endif
92981 +
92982 address &= huge_page_mask(h);
92983
92984 ptep = huge_pte_offset(mm, address);
92985 @@ -2923,6 +2961,26 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
92986 VM_FAULT_SET_HINDEX(hstate_index(h));
92987 }
92988
92989 +#ifdef CONFIG_PAX_SEGMEXEC
92990 + vma_m = pax_find_mirror_vma(vma);
92991 + if (vma_m) {
92992 + unsigned long address_m;
92993 +
92994 + if (vma->vm_start > vma_m->vm_start) {
92995 + address_m = address;
92996 + address -= SEGMEXEC_TASK_SIZE;
92997 + vma = vma_m;
92998 + h = hstate_vma(vma);
92999 + } else
93000 + address_m = address + SEGMEXEC_TASK_SIZE;
93001 +
93002 + if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
93003 + return VM_FAULT_OOM;
93004 + address_m &= HPAGE_MASK;
93005 + unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
93006 + }
93007 +#endif
93008 +
93009 ptep = huge_pte_alloc(mm, address, huge_page_size(h));
93010 if (!ptep)
93011 return VM_FAULT_OOM;
93012 diff --git a/mm/internal.h b/mm/internal.h
93013 index 3e91000..4741a60 100644
93014 --- a/mm/internal.h
93015 +++ b/mm/internal.h
93016 @@ -94,6 +94,7 @@ extern pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address);
93017 * in mm/page_alloc.c
93018 */
93019 extern void __free_pages_bootmem(struct page *page, unsigned int order);
93020 +extern void free_compound_page(struct page *page);
93021 extern void prep_compound_page(struct page *page, unsigned long order);
93022 #ifdef CONFIG_MEMORY_FAILURE
93023 extern bool is_free_buddy_page(struct page *page);
93024 @@ -352,7 +353,7 @@ extern u32 hwpoison_filter_enable;
93025
93026 extern unsigned long vm_mmap_pgoff(struct file *, unsigned long,
93027 unsigned long, unsigned long,
93028 - unsigned long, unsigned long);
93029 + unsigned long, unsigned long) __intentional_overflow(-1);
93030
93031 extern void set_pageblock_order(void);
93032 unsigned long reclaim_clean_pages_from_list(struct zone *zone,
93033 diff --git a/mm/kmemleak.c b/mm/kmemleak.c
93034 index 31f01c5..7015178 100644
93035 --- a/mm/kmemleak.c
93036 +++ b/mm/kmemleak.c
93037 @@ -363,7 +363,7 @@ static void print_unreferenced(struct seq_file *seq,
93038
93039 for (i = 0; i < object->trace_len; i++) {
93040 void *ptr = (void *)object->trace[i];
93041 - seq_printf(seq, " [<%p>] %pS\n", ptr, ptr);
93042 + seq_printf(seq, " [<%pP>] %pA\n", ptr, ptr);
93043 }
93044 }
93045
93046 @@ -1853,7 +1853,7 @@ static int __init kmemleak_late_init(void)
93047 return -ENOMEM;
93048 }
93049
93050 - dentry = debugfs_create_file("kmemleak", S_IRUGO, NULL, NULL,
93051 + dentry = debugfs_create_file("kmemleak", S_IRUSR, NULL, NULL,
93052 &kmemleak_fops);
93053 if (!dentry)
93054 pr_warning("Failed to create the debugfs kmemleak file\n");
93055 diff --git a/mm/maccess.c b/mm/maccess.c
93056 index d53adf9..03a24bf 100644
93057 --- a/mm/maccess.c
93058 +++ b/mm/maccess.c
93059 @@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, const void *src, size_t size)
93060 set_fs(KERNEL_DS);
93061 pagefault_disable();
93062 ret = __copy_from_user_inatomic(dst,
93063 - (__force const void __user *)src, size);
93064 + (const void __force_user *)src, size);
93065 pagefault_enable();
93066 set_fs(old_fs);
93067
93068 @@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, const void *src, size_t size)
93069
93070 set_fs(KERNEL_DS);
93071 pagefault_disable();
93072 - ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
93073 + ret = __copy_to_user_inatomic((void __force_user *)dst, src, size);
93074 pagefault_enable();
93075 set_fs(old_fs);
93076
93077 diff --git a/mm/madvise.c b/mm/madvise.c
93078 index 539eeb9..e24a987 100644
93079 --- a/mm/madvise.c
93080 +++ b/mm/madvise.c
93081 @@ -51,6 +51,10 @@ static long madvise_behavior(struct vm_area_struct *vma,
93082 pgoff_t pgoff;
93083 unsigned long new_flags = vma->vm_flags;
93084
93085 +#ifdef CONFIG_PAX_SEGMEXEC
93086 + struct vm_area_struct *vma_m;
93087 +#endif
93088 +
93089 switch (behavior) {
93090 case MADV_NORMAL:
93091 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
93092 @@ -126,6 +130,13 @@ success:
93093 /*
93094 * vm_flags is protected by the mmap_sem held in write mode.
93095 */
93096 +
93097 +#ifdef CONFIG_PAX_SEGMEXEC
93098 + vma_m = pax_find_mirror_vma(vma);
93099 + if (vma_m)
93100 + vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
93101 +#endif
93102 +
93103 vma->vm_flags = new_flags;
93104
93105 out:
93106 @@ -274,6 +285,11 @@ static long madvise_dontneed(struct vm_area_struct *vma,
93107 struct vm_area_struct **prev,
93108 unsigned long start, unsigned long end)
93109 {
93110 +
93111 +#ifdef CONFIG_PAX_SEGMEXEC
93112 + struct vm_area_struct *vma_m;
93113 +#endif
93114 +
93115 *prev = vma;
93116 if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
93117 return -EINVAL;
93118 @@ -286,6 +302,21 @@ static long madvise_dontneed(struct vm_area_struct *vma,
93119 zap_page_range(vma, start, end - start, &details);
93120 } else
93121 zap_page_range(vma, start, end - start, NULL);
93122 +
93123 +#ifdef CONFIG_PAX_SEGMEXEC
93124 + vma_m = pax_find_mirror_vma(vma);
93125 + if (vma_m) {
93126 + if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
93127 + struct zap_details details = {
93128 + .nonlinear_vma = vma_m,
93129 + .last_index = ULONG_MAX,
93130 + };
93131 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
93132 + } else
93133 + zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
93134 + }
93135 +#endif
93136 +
93137 return 0;
93138 }
93139
93140 @@ -491,6 +522,16 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
93141 if (end < start)
93142 return error;
93143
93144 +#ifdef CONFIG_PAX_SEGMEXEC
93145 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
93146 + if (end > SEGMEXEC_TASK_SIZE)
93147 + return error;
93148 + } else
93149 +#endif
93150 +
93151 + if (end > TASK_SIZE)
93152 + return error;
93153 +
93154 error = 0;
93155 if (end == start)
93156 return error;
93157 diff --git a/mm/memory-failure.c b/mm/memory-failure.c
93158 index 90002ea..db1452d 100644
93159 --- a/mm/memory-failure.c
93160 +++ b/mm/memory-failure.c
93161 @@ -61,7 +61,7 @@ int sysctl_memory_failure_early_kill __read_mostly = 0;
93162
93163 int sysctl_memory_failure_recovery __read_mostly = 1;
93164
93165 -atomic_long_t num_poisoned_pages __read_mostly = ATOMIC_LONG_INIT(0);
93166 +atomic_long_unchecked_t num_poisoned_pages __read_mostly = ATOMIC_LONG_INIT(0);
93167
93168 #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
93169
93170 @@ -202,7 +202,7 @@ static int kill_proc(struct task_struct *t, unsigned long addr, int trapno,
93171 pfn, t->comm, t->pid);
93172 si.si_signo = SIGBUS;
93173 si.si_errno = 0;
93174 - si.si_addr = (void *)addr;
93175 + si.si_addr = (void __user *)addr;
93176 #ifdef __ARCH_SI_TRAPNO
93177 si.si_trapno = trapno;
93178 #endif
93179 @@ -762,7 +762,7 @@ static struct page_state {
93180 unsigned long res;
93181 char *msg;
93182 int (*action)(struct page *p, unsigned long pfn);
93183 -} error_states[] = {
93184 +} __do_const error_states[] = {
93185 { reserved, reserved, "reserved kernel", me_kernel },
93186 /*
93187 * free pages are specially detected outside this table:
93188 @@ -1062,7 +1062,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
93189 nr_pages = 1 << compound_order(hpage);
93190 else /* normal page or thp */
93191 nr_pages = 1;
93192 - atomic_long_add(nr_pages, &num_poisoned_pages);
93193 + atomic_long_add_unchecked(nr_pages, &num_poisoned_pages);
93194
93195 /*
93196 * We need/can do nothing about count=0 pages.
93197 @@ -1092,7 +1092,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
93198 if (!PageHWPoison(hpage)
93199 || (hwpoison_filter(p) && TestClearPageHWPoison(p))
93200 || (p != hpage && TestSetPageHWPoison(hpage))) {
93201 - atomic_long_sub(nr_pages, &num_poisoned_pages);
93202 + atomic_long_sub_unchecked(nr_pages, &num_poisoned_pages);
93203 return 0;
93204 }
93205 set_page_hwpoison_huge_page(hpage);
93206 @@ -1161,7 +1161,7 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
93207 }
93208 if (hwpoison_filter(p)) {
93209 if (TestClearPageHWPoison(p))
93210 - atomic_long_sub(nr_pages, &num_poisoned_pages);
93211 + atomic_long_sub_unchecked(nr_pages, &num_poisoned_pages);
93212 unlock_page(hpage);
93213 put_page(hpage);
93214 return 0;
93215 @@ -1383,7 +1383,7 @@ int unpoison_memory(unsigned long pfn)
93216 return 0;
93217 }
93218 if (TestClearPageHWPoison(p))
93219 - atomic_long_dec(&num_poisoned_pages);
93220 + atomic_long_dec_unchecked(&num_poisoned_pages);
93221 pr_info("MCE: Software-unpoisoned free page %#lx\n", pfn);
93222 return 0;
93223 }
93224 @@ -1397,7 +1397,7 @@ int unpoison_memory(unsigned long pfn)
93225 */
93226 if (TestClearPageHWPoison(page)) {
93227 pr_info("MCE: Software-unpoisoned page %#lx\n", pfn);
93228 - atomic_long_sub(nr_pages, &num_poisoned_pages);
93229 + atomic_long_sub_unchecked(nr_pages, &num_poisoned_pages);
93230 freeit = 1;
93231 if (PageHuge(page))
93232 clear_page_hwpoison_huge_page(page);
93233 @@ -1522,11 +1522,11 @@ static int soft_offline_huge_page(struct page *page, int flags)
93234 if (PageHuge(page)) {
93235 set_page_hwpoison_huge_page(hpage);
93236 dequeue_hwpoisoned_huge_page(hpage);
93237 - atomic_long_add(1 << compound_order(hpage),
93238 + atomic_long_add_unchecked(1 << compound_order(hpage),
93239 &num_poisoned_pages);
93240 } else {
93241 SetPageHWPoison(page);
93242 - atomic_long_inc(&num_poisoned_pages);
93243 + atomic_long_inc_unchecked(&num_poisoned_pages);
93244 }
93245 }
93246 return ret;
93247 @@ -1565,7 +1565,7 @@ static int __soft_offline_page(struct page *page, int flags)
93248 put_page(page);
93249 pr_info("soft_offline: %#lx: invalidated\n", pfn);
93250 SetPageHWPoison(page);
93251 - atomic_long_inc(&num_poisoned_pages);
93252 + atomic_long_inc_unchecked(&num_poisoned_pages);
93253 return 0;
93254 }
93255
93256 @@ -1616,7 +1616,7 @@ static int __soft_offline_page(struct page *page, int flags)
93257 if (!is_free_buddy_page(page))
93258 pr_info("soft offline: %#lx: page leaked\n",
93259 pfn);
93260 - atomic_long_inc(&num_poisoned_pages);
93261 + atomic_long_inc_unchecked(&num_poisoned_pages);
93262 }
93263 } else {
93264 pr_info("soft offline: %#lx: isolation failed: %d, page count %d, type %lx\n",
93265 @@ -1690,11 +1690,11 @@ int soft_offline_page(struct page *page, int flags)
93266 if (PageHuge(page)) {
93267 set_page_hwpoison_huge_page(hpage);
93268 dequeue_hwpoisoned_huge_page(hpage);
93269 - atomic_long_add(1 << compound_order(hpage),
93270 + atomic_long_add_unchecked(1 << compound_order(hpage),
93271 &num_poisoned_pages);
93272 } else {
93273 SetPageHWPoison(page);
93274 - atomic_long_inc(&num_poisoned_pages);
93275 + atomic_long_inc_unchecked(&num_poisoned_pages);
93276 }
93277 }
93278 unset_migratetype_isolate(page, MIGRATE_MOVABLE);
93279 diff --git a/mm/memory.c b/mm/memory.c
93280 index 22dfa61..90d7ec5 100644
93281 --- a/mm/memory.c
93282 +++ b/mm/memory.c
93283 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
93284 free_pte_range(tlb, pmd, addr);
93285 } while (pmd++, addr = next, addr != end);
93286
93287 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
93288 start &= PUD_MASK;
93289 if (start < floor)
93290 return;
93291 @@ -417,6 +418,8 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
93292 pmd = pmd_offset(pud, start);
93293 pud_clear(pud);
93294 pmd_free_tlb(tlb, pmd, start);
93295 +#endif
93296 +
93297 }
93298
93299 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
93300 @@ -436,6 +439,7 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
93301 free_pmd_range(tlb, pud, addr, next, floor, ceiling);
93302 } while (pud++, addr = next, addr != end);
93303
93304 +#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
93305 start &= PGDIR_MASK;
93306 if (start < floor)
93307 return;
93308 @@ -450,6 +454,8 @@ static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
93309 pud = pud_offset(pgd, start);
93310 pgd_clear(pgd);
93311 pud_free_tlb(tlb, pud, start);
93312 +#endif
93313 +
93314 }
93315
93316 /*
93317 @@ -1636,12 +1642,6 @@ no_page_table:
93318 return page;
93319 }
93320
93321 -static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
93322 -{
93323 - return stack_guard_page_start(vma, addr) ||
93324 - stack_guard_page_end(vma, addr+PAGE_SIZE);
93325 -}
93326 -
93327 /**
93328 * __get_user_pages() - pin user pages in memory
93329 * @tsk: task_struct of target task
93330 @@ -1728,10 +1728,10 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
93331
93332 i = 0;
93333
93334 - do {
93335 + while (nr_pages) {
93336 struct vm_area_struct *vma;
93337
93338 - vma = find_extend_vma(mm, start);
93339 + vma = find_vma(mm, start);
93340 if (!vma && in_gate_area(mm, start)) {
93341 unsigned long pg = start & PAGE_MASK;
93342 pgd_t *pgd;
93343 @@ -1780,7 +1780,7 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
93344 goto next_page;
93345 }
93346
93347 - if (!vma ||
93348 + if (!vma || start < vma->vm_start ||
93349 (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
93350 !(vm_flags & vma->vm_flags))
93351 return i ? : -EFAULT;
93352 @@ -1809,11 +1809,6 @@ long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
93353 int ret;
93354 unsigned int fault_flags = 0;
93355
93356 - /* For mlock, just skip the stack guard page. */
93357 - if (foll_flags & FOLL_MLOCK) {
93358 - if (stack_guard_page(vma, start))
93359 - goto next_page;
93360 - }
93361 if (foll_flags & FOLL_WRITE)
93362 fault_flags |= FAULT_FLAG_WRITE;
93363 if (nonblocking)
93364 @@ -1893,7 +1888,7 @@ next_page:
93365 start += page_increm * PAGE_SIZE;
93366 nr_pages -= page_increm;
93367 } while (nr_pages && start < vma->vm_end);
93368 - } while (nr_pages);
93369 + }
93370 return i;
93371 }
93372 EXPORT_SYMBOL(__get_user_pages);
93373 @@ -1929,12 +1924,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
93374 unsigned long address, unsigned int fault_flags)
93375 {
93376 struct vm_area_struct *vma;
93377 + vm_flags_t vm_flags;
93378 int ret;
93379
93380 vma = find_extend_vma(mm, address);
93381 if (!vma || address < vma->vm_start)
93382 return -EFAULT;
93383
93384 + vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
93385 + if (!(vm_flags & vma->vm_flags))
93386 + return -EFAULT;
93387 +
93388 ret = handle_mm_fault(mm, vma, address, fault_flags);
93389 if (ret & VM_FAULT_ERROR) {
93390 if (ret & VM_FAULT_OOM)
93391 @@ -2100,6 +2100,10 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
93392 page_add_file_rmap(page);
93393 set_pte_at(mm, addr, pte, mk_pte(page, prot));
93394
93395 +#ifdef CONFIG_PAX_SEGMEXEC
93396 + pax_mirror_file_pte(vma, addr, page, ptl);
93397 +#endif
93398 +
93399 retval = 0;
93400 pte_unmap_unlock(pte, ptl);
93401 return retval;
93402 @@ -2144,9 +2148,21 @@ int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
93403 if (!page_count(page))
93404 return -EINVAL;
93405 if (!(vma->vm_flags & VM_MIXEDMAP)) {
93406 +
93407 +#ifdef CONFIG_PAX_SEGMEXEC
93408 + struct vm_area_struct *vma_m;
93409 +#endif
93410 +
93411 BUG_ON(down_read_trylock(&vma->vm_mm->mmap_sem));
93412 BUG_ON(vma->vm_flags & VM_PFNMAP);
93413 vma->vm_flags |= VM_MIXEDMAP;
93414 +
93415 +#ifdef CONFIG_PAX_SEGMEXEC
93416 + vma_m = pax_find_mirror_vma(vma);
93417 + if (vma_m)
93418 + vma_m->vm_flags |= VM_MIXEDMAP;
93419 +#endif
93420 +
93421 }
93422 return insert_page(vma, addr, page, vma->vm_page_prot);
93423 }
93424 @@ -2229,6 +2245,7 @@ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
93425 unsigned long pfn)
93426 {
93427 BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
93428 + BUG_ON(vma->vm_mirror);
93429
93430 if (addr < vma->vm_start || addr >= vma->vm_end)
93431 return -EFAULT;
93432 @@ -2476,7 +2493,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
93433
93434 BUG_ON(pud_huge(*pud));
93435
93436 - pmd = pmd_alloc(mm, pud, addr);
93437 + pmd = (mm == &init_mm) ?
93438 + pmd_alloc_kernel(mm, pud, addr) :
93439 + pmd_alloc(mm, pud, addr);
93440 if (!pmd)
93441 return -ENOMEM;
93442 do {
93443 @@ -2496,7 +2515,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
93444 unsigned long next;
93445 int err;
93446
93447 - pud = pud_alloc(mm, pgd, addr);
93448 + pud = (mm == &init_mm) ?
93449 + pud_alloc_kernel(mm, pgd, addr) :
93450 + pud_alloc(mm, pgd, addr);
93451 if (!pud)
93452 return -ENOMEM;
93453 do {
93454 @@ -2586,6 +2607,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
93455 copy_user_highpage(dst, src, va, vma);
93456 }
93457
93458 +#ifdef CONFIG_PAX_SEGMEXEC
93459 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
93460 +{
93461 + struct mm_struct *mm = vma->vm_mm;
93462 + spinlock_t *ptl;
93463 + pte_t *pte, entry;
93464 +
93465 + pte = pte_offset_map_lock(mm, pmd, address, &ptl);
93466 + entry = *pte;
93467 + if (!pte_present(entry)) {
93468 + if (!pte_none(entry)) {
93469 + BUG_ON(pte_file(entry));
93470 + free_swap_and_cache(pte_to_swp_entry(entry));
93471 + pte_clear_not_present_full(mm, address, pte, 0);
93472 + }
93473 + } else {
93474 + struct page *page;
93475 +
93476 + flush_cache_page(vma, address, pte_pfn(entry));
93477 + entry = ptep_clear_flush(vma, address, pte);
93478 + BUG_ON(pte_dirty(entry));
93479 + page = vm_normal_page(vma, address, entry);
93480 + if (page) {
93481 + update_hiwater_rss(mm);
93482 + if (PageAnon(page))
93483 + dec_mm_counter_fast(mm, MM_ANONPAGES);
93484 + else
93485 + dec_mm_counter_fast(mm, MM_FILEPAGES);
93486 + page_remove_rmap(page);
93487 + page_cache_release(page);
93488 + }
93489 + }
93490 + pte_unmap_unlock(pte, ptl);
93491 +}
93492 +
93493 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
93494 + *
93495 + * the ptl of the lower mapped page is held on entry and is not released on exit
93496 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
93497 + */
93498 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
93499 +{
93500 + struct mm_struct *mm = vma->vm_mm;
93501 + unsigned long address_m;
93502 + spinlock_t *ptl_m;
93503 + struct vm_area_struct *vma_m;
93504 + pmd_t *pmd_m;
93505 + pte_t *pte_m, entry_m;
93506 +
93507 + BUG_ON(!page_m || !PageAnon(page_m));
93508 +
93509 + vma_m = pax_find_mirror_vma(vma);
93510 + if (!vma_m)
93511 + return;
93512 +
93513 + BUG_ON(!PageLocked(page_m));
93514 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
93515 + address_m = address + SEGMEXEC_TASK_SIZE;
93516 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
93517 + pte_m = pte_offset_map(pmd_m, address_m);
93518 + ptl_m = pte_lockptr(mm, pmd_m);
93519 + if (ptl != ptl_m) {
93520 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
93521 + if (!pte_none(*pte_m))
93522 + goto out;
93523 + }
93524 +
93525 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
93526 + page_cache_get(page_m);
93527 + page_add_anon_rmap(page_m, vma_m, address_m);
93528 + inc_mm_counter_fast(mm, MM_ANONPAGES);
93529 + set_pte_at(mm, address_m, pte_m, entry_m);
93530 + update_mmu_cache(vma_m, address_m, pte_m);
93531 +out:
93532 + if (ptl != ptl_m)
93533 + spin_unlock(ptl_m);
93534 + pte_unmap(pte_m);
93535 + unlock_page(page_m);
93536 +}
93537 +
93538 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
93539 +{
93540 + struct mm_struct *mm = vma->vm_mm;
93541 + unsigned long address_m;
93542 + spinlock_t *ptl_m;
93543 + struct vm_area_struct *vma_m;
93544 + pmd_t *pmd_m;
93545 + pte_t *pte_m, entry_m;
93546 +
93547 + BUG_ON(!page_m || PageAnon(page_m));
93548 +
93549 + vma_m = pax_find_mirror_vma(vma);
93550 + if (!vma_m)
93551 + return;
93552 +
93553 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
93554 + address_m = address + SEGMEXEC_TASK_SIZE;
93555 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
93556 + pte_m = pte_offset_map(pmd_m, address_m);
93557 + ptl_m = pte_lockptr(mm, pmd_m);
93558 + if (ptl != ptl_m) {
93559 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
93560 + if (!pte_none(*pte_m))
93561 + goto out;
93562 + }
93563 +
93564 + entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
93565 + page_cache_get(page_m);
93566 + page_add_file_rmap(page_m);
93567 + inc_mm_counter_fast(mm, MM_FILEPAGES);
93568 + set_pte_at(mm, address_m, pte_m, entry_m);
93569 + update_mmu_cache(vma_m, address_m, pte_m);
93570 +out:
93571 + if (ptl != ptl_m)
93572 + spin_unlock(ptl_m);
93573 + pte_unmap(pte_m);
93574 +}
93575 +
93576 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
93577 +{
93578 + struct mm_struct *mm = vma->vm_mm;
93579 + unsigned long address_m;
93580 + spinlock_t *ptl_m;
93581 + struct vm_area_struct *vma_m;
93582 + pmd_t *pmd_m;
93583 + pte_t *pte_m, entry_m;
93584 +
93585 + vma_m = pax_find_mirror_vma(vma);
93586 + if (!vma_m)
93587 + return;
93588 +
93589 + BUG_ON(address >= SEGMEXEC_TASK_SIZE);
93590 + address_m = address + SEGMEXEC_TASK_SIZE;
93591 + pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
93592 + pte_m = pte_offset_map(pmd_m, address_m);
93593 + ptl_m = pte_lockptr(mm, pmd_m);
93594 + if (ptl != ptl_m) {
93595 + spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
93596 + if (!pte_none(*pte_m))
93597 + goto out;
93598 + }
93599 +
93600 + entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
93601 + set_pte_at(mm, address_m, pte_m, entry_m);
93602 +out:
93603 + if (ptl != ptl_m)
93604 + spin_unlock(ptl_m);
93605 + pte_unmap(pte_m);
93606 +}
93607 +
93608 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
93609 +{
93610 + struct page *page_m;
93611 + pte_t entry;
93612 +
93613 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
93614 + goto out;
93615 +
93616 + entry = *pte;
93617 + page_m = vm_normal_page(vma, address, entry);
93618 + if (!page_m)
93619 + pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
93620 + else if (PageAnon(page_m)) {
93621 + if (pax_find_mirror_vma(vma)) {
93622 + pte_unmap_unlock(pte, ptl);
93623 + lock_page(page_m);
93624 + pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
93625 + if (pte_same(entry, *pte))
93626 + pax_mirror_anon_pte(vma, address, page_m, ptl);
93627 + else
93628 + unlock_page(page_m);
93629 + }
93630 + } else
93631 + pax_mirror_file_pte(vma, address, page_m, ptl);
93632 +
93633 +out:
93634 + pte_unmap_unlock(pte, ptl);
93635 +}
93636 +#endif
93637 +
93638 /*
93639 * This routine handles present pages, when users try to write
93640 * to a shared page. It is done by copying the page to a new address
93641 @@ -2810,6 +3011,12 @@ gotten:
93642 */
93643 page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
93644 if (likely(pte_same(*page_table, orig_pte))) {
93645 +
93646 +#ifdef CONFIG_PAX_SEGMEXEC
93647 + if (pax_find_mirror_vma(vma))
93648 + BUG_ON(!trylock_page(new_page));
93649 +#endif
93650 +
93651 if (old_page) {
93652 if (!PageAnon(old_page)) {
93653 dec_mm_counter_fast(mm, MM_FILEPAGES);
93654 @@ -2861,6 +3068,10 @@ gotten:
93655 page_remove_rmap(old_page);
93656 }
93657
93658 +#ifdef CONFIG_PAX_SEGMEXEC
93659 + pax_mirror_anon_pte(vma, address, new_page, ptl);
93660 +#endif
93661 +
93662 /* Free the old page.. */
93663 new_page = old_page;
93664 ret |= VM_FAULT_WRITE;
93665 @@ -3138,6 +3349,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
93666 swap_free(entry);
93667 if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
93668 try_to_free_swap(page);
93669 +
93670 +#ifdef CONFIG_PAX_SEGMEXEC
93671 + if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
93672 +#endif
93673 +
93674 unlock_page(page);
93675 if (page != swapcache) {
93676 /*
93677 @@ -3161,6 +3377,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
93678
93679 /* No need to invalidate - it was non-present before */
93680 update_mmu_cache(vma, address, page_table);
93681 +
93682 +#ifdef CONFIG_PAX_SEGMEXEC
93683 + pax_mirror_anon_pte(vma, address, page, ptl);
93684 +#endif
93685 +
93686 unlock:
93687 pte_unmap_unlock(page_table, ptl);
93688 out:
93689 @@ -3180,40 +3401,6 @@ out_release:
93690 }
93691
93692 /*
93693 - * This is like a special single-page "expand_{down|up}wards()",
93694 - * except we must first make sure that 'address{-|+}PAGE_SIZE'
93695 - * doesn't hit another vma.
93696 - */
93697 -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
93698 -{
93699 - address &= PAGE_MASK;
93700 - if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
93701 - struct vm_area_struct *prev = vma->vm_prev;
93702 -
93703 - /*
93704 - * Is there a mapping abutting this one below?
93705 - *
93706 - * That's only ok if it's the same stack mapping
93707 - * that has gotten split..
93708 - */
93709 - if (prev && prev->vm_end == address)
93710 - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
93711 -
93712 - expand_downwards(vma, address - PAGE_SIZE);
93713 - }
93714 - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
93715 - struct vm_area_struct *next = vma->vm_next;
93716 -
93717 - /* As VM_GROWSDOWN but s/below/above/ */
93718 - if (next && next->vm_start == address + PAGE_SIZE)
93719 - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
93720 -
93721 - expand_upwards(vma, address + PAGE_SIZE);
93722 - }
93723 - return 0;
93724 -}
93725 -
93726 -/*
93727 * We enter with non-exclusive mmap_sem (to exclude vma changes,
93728 * but allow concurrent faults), and pte mapped but not yet locked.
93729 * We return with mmap_sem still held, but pte unmapped and unlocked.
93730 @@ -3222,27 +3409,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
93731 unsigned long address, pte_t *page_table, pmd_t *pmd,
93732 unsigned int flags)
93733 {
93734 - struct page *page;
93735 + struct page *page = NULL;
93736 spinlock_t *ptl;
93737 pte_t entry;
93738
93739 - pte_unmap(page_table);
93740 -
93741 - /* Check if we need to add a guard page to the stack */
93742 - if (check_stack_guard_page(vma, address) < 0)
93743 - return VM_FAULT_SIGBUS;
93744 -
93745 - /* Use the zero-page for reads */
93746 if (!(flags & FAULT_FLAG_WRITE)) {
93747 entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
93748 vma->vm_page_prot));
93749 - page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
93750 + ptl = pte_lockptr(mm, pmd);
93751 + spin_lock(ptl);
93752 if (!pte_none(*page_table))
93753 goto unlock;
93754 goto setpte;
93755 }
93756
93757 /* Allocate our own private page. */
93758 + pte_unmap(page_table);
93759 +
93760 if (unlikely(anon_vma_prepare(vma)))
93761 goto oom;
93762 page = alloc_zeroed_user_highpage_movable(vma, address);
93763 @@ -3266,6 +3449,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
93764 if (!pte_none(*page_table))
93765 goto release;
93766
93767 +#ifdef CONFIG_PAX_SEGMEXEC
93768 + if (pax_find_mirror_vma(vma))
93769 + BUG_ON(!trylock_page(page));
93770 +#endif
93771 +
93772 inc_mm_counter_fast(mm, MM_ANONPAGES);
93773 page_add_new_anon_rmap(page, vma, address);
93774 setpte:
93775 @@ -3273,6 +3461,12 @@ setpte:
93776
93777 /* No need to invalidate - it was non-present before */
93778 update_mmu_cache(vma, address, page_table);
93779 +
93780 +#ifdef CONFIG_PAX_SEGMEXEC
93781 + if (page)
93782 + pax_mirror_anon_pte(vma, address, page, ptl);
93783 +#endif
93784 +
93785 unlock:
93786 pte_unmap_unlock(page_table, ptl);
93787 return 0;
93788 @@ -3417,6 +3611,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
93789 */
93790 /* Only go through if we didn't race with anybody else... */
93791 if (likely(pte_same(*page_table, orig_pte))) {
93792 +
93793 +#ifdef CONFIG_PAX_SEGMEXEC
93794 + if (anon && pax_find_mirror_vma(vma))
93795 + BUG_ON(!trylock_page(page));
93796 +#endif
93797 +
93798 flush_icache_page(vma, page);
93799 entry = mk_pte(page, vma->vm_page_prot);
93800 if (flags & FAULT_FLAG_WRITE)
93801 @@ -3438,6 +3638,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
93802
93803 /* no need to invalidate: a not-present page won't be cached */
93804 update_mmu_cache(vma, address, page_table);
93805 +
93806 +#ifdef CONFIG_PAX_SEGMEXEC
93807 + if (anon)
93808 + pax_mirror_anon_pte(vma, address, page, ptl);
93809 + else
93810 + pax_mirror_file_pte(vma, address, page, ptl);
93811 +#endif
93812 +
93813 } else {
93814 if (cow_page)
93815 mem_cgroup_uncharge_page(cow_page);
93816 @@ -3685,6 +3893,12 @@ static int handle_pte_fault(struct mm_struct *mm,
93817 if (flags & FAULT_FLAG_WRITE)
93818 flush_tlb_fix_spurious_fault(vma, address);
93819 }
93820 +
93821 +#ifdef CONFIG_PAX_SEGMEXEC
93822 + pax_mirror_pte(vma, address, pte, pmd, ptl);
93823 + return 0;
93824 +#endif
93825 +
93826 unlock:
93827 pte_unmap_unlock(pte, ptl);
93828 return 0;
93829 @@ -3701,9 +3915,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
93830 pmd_t *pmd;
93831 pte_t *pte;
93832
93833 +#ifdef CONFIG_PAX_SEGMEXEC
93834 + struct vm_area_struct *vma_m;
93835 +#endif
93836 +
93837 if (unlikely(is_vm_hugetlb_page(vma)))
93838 return hugetlb_fault(mm, vma, address, flags);
93839
93840 +#ifdef CONFIG_PAX_SEGMEXEC
93841 + vma_m = pax_find_mirror_vma(vma);
93842 + if (vma_m) {
93843 + unsigned long address_m;
93844 + pgd_t *pgd_m;
93845 + pud_t *pud_m;
93846 + pmd_t *pmd_m;
93847 +
93848 + if (vma->vm_start > vma_m->vm_start) {
93849 + address_m = address;
93850 + address -= SEGMEXEC_TASK_SIZE;
93851 + vma = vma_m;
93852 + } else
93853 + address_m = address + SEGMEXEC_TASK_SIZE;
93854 +
93855 + pgd_m = pgd_offset(mm, address_m);
93856 + pud_m = pud_alloc(mm, pgd_m, address_m);
93857 + if (!pud_m)
93858 + return VM_FAULT_OOM;
93859 + pmd_m = pmd_alloc(mm, pud_m, address_m);
93860 + if (!pmd_m)
93861 + return VM_FAULT_OOM;
93862 + if (!pmd_present(*pmd_m) && __pte_alloc(mm, vma_m, pmd_m, address_m))
93863 + return VM_FAULT_OOM;
93864 + pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
93865 + }
93866 +#endif
93867 +
93868 pgd = pgd_offset(mm, address);
93869 pud = pud_alloc(mm, pgd, address);
93870 if (!pud)
93871 @@ -3834,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
93872 spin_unlock(&mm->page_table_lock);
93873 return 0;
93874 }
93875 +
93876 +int __pud_alloc_kernel(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
93877 +{
93878 + pud_t *new = pud_alloc_one(mm, address);
93879 + if (!new)
93880 + return -ENOMEM;
93881 +
93882 + smp_wmb(); /* See comment in __pte_alloc */
93883 +
93884 + spin_lock(&mm->page_table_lock);
93885 + if (pgd_present(*pgd)) /* Another has populated it */
93886 + pud_free(mm, new);
93887 + else
93888 + pgd_populate_kernel(mm, pgd, new);
93889 + spin_unlock(&mm->page_table_lock);
93890 + return 0;
93891 +}
93892 #endif /* __PAGETABLE_PUD_FOLDED */
93893
93894 #ifndef __PAGETABLE_PMD_FOLDED
93895 @@ -3864,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
93896 spin_unlock(&mm->page_table_lock);
93897 return 0;
93898 }
93899 +
93900 +int __pmd_alloc_kernel(struct mm_struct *mm, pud_t *pud, unsigned long address)
93901 +{
93902 + pmd_t *new = pmd_alloc_one(mm, address);
93903 + if (!new)
93904 + return -ENOMEM;
93905 +
93906 + smp_wmb(); /* See comment in __pte_alloc */
93907 +
93908 + spin_lock(&mm->page_table_lock);
93909 +#ifndef __ARCH_HAS_4LEVEL_HACK
93910 + if (pud_present(*pud)) /* Another has populated it */
93911 + pmd_free(mm, new);
93912 + else
93913 + pud_populate_kernel(mm, pud, new);
93914 +#else
93915 + if (pgd_present(*pud)) /* Another has populated it */
93916 + pmd_free(mm, new);
93917 + else
93918 + pgd_populate_kernel(mm, pud, new);
93919 +#endif /* __ARCH_HAS_4LEVEL_HACK */
93920 + spin_unlock(&mm->page_table_lock);
93921 + return 0;
93922 +}
93923 #endif /* __PAGETABLE_PMD_FOLDED */
93924
93925 #if !defined(__HAVE_ARCH_GATE_AREA)
93926 @@ -3877,7 +4164,7 @@ static int __init gate_vma_init(void)
93927 gate_vma.vm_start = FIXADDR_USER_START;
93928 gate_vma.vm_end = FIXADDR_USER_END;
93929 gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
93930 - gate_vma.vm_page_prot = __P101;
93931 + gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
93932
93933 return 0;
93934 }
93935 @@ -4011,8 +4298,8 @@ out:
93936 return ret;
93937 }
93938
93939 -int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
93940 - void *buf, int len, int write)
93941 +ssize_t generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
93942 + void *buf, size_t len, int write)
93943 {
93944 resource_size_t phys_addr;
93945 unsigned long prot = 0;
93946 @@ -4038,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
93947 * Access another process' address space as given in mm. If non-NULL, use the
93948 * given task for page fault accounting.
93949 */
93950 -static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
93951 - unsigned long addr, void *buf, int len, int write)
93952 +static ssize_t __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
93953 + unsigned long addr, void *buf, size_t len, int write)
93954 {
93955 struct vm_area_struct *vma;
93956 void *old_buf = buf;
93957 @@ -4047,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
93958 down_read(&mm->mmap_sem);
93959 /* ignore errors, just check how much was successfully transferred */
93960 while (len) {
93961 - int bytes, ret, offset;
93962 + ssize_t bytes, ret, offset;
93963 void *maddr;
93964 struct page *page = NULL;
93965
93966 @@ -4106,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
93967 *
93968 * The caller must hold a reference on @mm.
93969 */
93970 -int access_remote_vm(struct mm_struct *mm, unsigned long addr,
93971 - void *buf, int len, int write)
93972 +ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
93973 + void *buf, size_t len, int write)
93974 {
93975 return __access_remote_vm(NULL, mm, addr, buf, len, write);
93976 }
93977 @@ -4117,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
93978 * Source/target buffer must be kernel space,
93979 * Do not walk the page table directly, use get_user_pages
93980 */
93981 -int access_process_vm(struct task_struct *tsk, unsigned long addr,
93982 - void *buf, int len, int write)
93983 +ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr,
93984 + void *buf, size_t len, int write)
93985 {
93986 struct mm_struct *mm;
93987 - int ret;
93988 + ssize_t ret;
93989
93990 mm = get_task_mm(tsk);
93991 if (!mm)
93992 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
93993 index ae3c8f3..fa4ee8e 100644
93994 --- a/mm/mempolicy.c
93995 +++ b/mm/mempolicy.c
93996 @@ -746,6 +746,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
93997 unsigned long vmstart;
93998 unsigned long vmend;
93999
94000 +#ifdef CONFIG_PAX_SEGMEXEC
94001 + struct vm_area_struct *vma_m;
94002 +#endif
94003 +
94004 vma = find_vma(mm, start);
94005 if (!vma || vma->vm_start > start)
94006 return -EFAULT;
94007 @@ -789,6 +793,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
94008 err = vma_replace_policy(vma, new_pol);
94009 if (err)
94010 goto out;
94011 +
94012 +#ifdef CONFIG_PAX_SEGMEXEC
94013 + vma_m = pax_find_mirror_vma(vma);
94014 + if (vma_m) {
94015 + err = vma_replace_policy(vma_m, new_pol);
94016 + if (err)
94017 + goto out;
94018 + }
94019 +#endif
94020 +
94021 }
94022
94023 out:
94024 @@ -1252,6 +1266,17 @@ static long do_mbind(unsigned long start, unsigned long len,
94025
94026 if (end < start)
94027 return -EINVAL;
94028 +
94029 +#ifdef CONFIG_PAX_SEGMEXEC
94030 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
94031 + if (end > SEGMEXEC_TASK_SIZE)
94032 + return -EINVAL;
94033 + } else
94034 +#endif
94035 +
94036 + if (end > TASK_SIZE)
94037 + return -EINVAL;
94038 +
94039 if (end == start)
94040 return 0;
94041
94042 @@ -1480,8 +1505,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
94043 */
94044 tcred = __task_cred(task);
94045 if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
94046 - !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) &&
94047 - !capable(CAP_SYS_NICE)) {
94048 + !uid_eq(cred->uid, tcred->suid) && !capable(CAP_SYS_NICE)) {
94049 rcu_read_unlock();
94050 err = -EPERM;
94051 goto out_put;
94052 @@ -1512,6 +1536,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
94053 goto out;
94054 }
94055
94056 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
94057 + if (mm != current->mm &&
94058 + (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
94059 + mmput(mm);
94060 + err = -EPERM;
94061 + goto out;
94062 + }
94063 +#endif
94064 +
94065 err = do_migrate_pages(mm, old, new,
94066 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
94067
94068 diff --git a/mm/migrate.c b/mm/migrate.c
94069 index bed4880..a493f67 100644
94070 --- a/mm/migrate.c
94071 +++ b/mm/migrate.c
94072 @@ -1485,8 +1485,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
94073 */
94074 tcred = __task_cred(task);
94075 if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
94076 - !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) &&
94077 - !capable(CAP_SYS_NICE)) {
94078 + !uid_eq(cred->uid, tcred->suid) && !capable(CAP_SYS_NICE)) {
94079 rcu_read_unlock();
94080 err = -EPERM;
94081 goto out;
94082 diff --git a/mm/mlock.c b/mm/mlock.c
94083 index b1eb536..091d154 100644
94084 --- a/mm/mlock.c
94085 +++ b/mm/mlock.c
94086 @@ -14,6 +14,7 @@
94087 #include <linux/pagevec.h>
94088 #include <linux/mempolicy.h>
94089 #include <linux/syscalls.h>
94090 +#include <linux/security.h>
94091 #include <linux/sched.h>
94092 #include <linux/export.h>
94093 #include <linux/rmap.h>
94094 @@ -606,7 +607,7 @@ static int do_mlock(unsigned long start, size_t len, int on)
94095 {
94096 unsigned long nstart, end, tmp;
94097 struct vm_area_struct * vma, * prev;
94098 - int error;
94099 + int error = 0;
94100
94101 VM_BUG_ON(start & ~PAGE_MASK);
94102 VM_BUG_ON(len != PAGE_ALIGN(len));
94103 @@ -615,6 +616,9 @@ static int do_mlock(unsigned long start, size_t len, int on)
94104 return -EINVAL;
94105 if (end == start)
94106 return 0;
94107 + if (end > TASK_SIZE)
94108 + return -EINVAL;
94109 +
94110 vma = find_vma(current->mm, start);
94111 if (!vma || vma->vm_start > start)
94112 return -ENOMEM;
94113 @@ -626,6 +630,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
94114 for (nstart = start ; ; ) {
94115 vm_flags_t newflags;
94116
94117 +#ifdef CONFIG_PAX_SEGMEXEC
94118 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
94119 + break;
94120 +#endif
94121 +
94122 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
94123
94124 newflags = vma->vm_flags & ~VM_LOCKED;
94125 @@ -739,6 +748,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
94126 locked += current->mm->locked_vm;
94127
94128 /* check against resource limits */
94129 + gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
94130 if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
94131 error = do_mlock(start, len, 1);
94132
94133 @@ -776,6 +786,11 @@ static int do_mlockall(int flags)
94134 for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
94135 vm_flags_t newflags;
94136
94137 +#ifdef CONFIG_PAX_SEGMEXEC
94138 + if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
94139 + break;
94140 +#endif
94141 +
94142 newflags = vma->vm_flags & ~VM_LOCKED;
94143 if (flags & MCL_CURRENT)
94144 newflags |= VM_LOCKED;
94145 @@ -807,8 +822,10 @@ SYSCALL_DEFINE1(mlockall, int, flags)
94146 lock_limit >>= PAGE_SHIFT;
94147
94148 ret = -ENOMEM;
94149 +
94150 + gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
94151 +
94152 down_write(&current->mm->mmap_sem);
94153 -
94154 if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
94155 capable(CAP_IPC_LOCK))
94156 ret = do_mlockall(flags);
94157 diff --git a/mm/mmap.c b/mm/mmap.c
94158 index 20ff0c3..a9eda98 100644
94159 --- a/mm/mmap.c
94160 +++ b/mm/mmap.c
94161 @@ -36,6 +36,7 @@
94162 #include <linux/sched/sysctl.h>
94163 #include <linux/notifier.h>
94164 #include <linux/memory.h>
94165 +#include <linux/random.h>
94166
94167 #include <asm/uaccess.h>
94168 #include <asm/cacheflush.h>
94169 @@ -52,6 +53,16 @@
94170 #define arch_rebalance_pgtables(addr, len) (addr)
94171 #endif
94172
94173 +static inline void verify_mm_writelocked(struct mm_struct *mm)
94174 +{
94175 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
94176 + if (unlikely(down_read_trylock(&mm->mmap_sem))) {
94177 + up_read(&mm->mmap_sem);
94178 + BUG();
94179 + }
94180 +#endif
94181 +}
94182 +
94183 static void unmap_region(struct mm_struct *mm,
94184 struct vm_area_struct *vma, struct vm_area_struct *prev,
94185 unsigned long start, unsigned long end);
94186 @@ -71,16 +82,25 @@ static void unmap_region(struct mm_struct *mm,
94187 * x: (no) no x: (no) yes x: (no) yes x: (yes) yes
94188 *
94189 */
94190 -pgprot_t protection_map[16] = {
94191 +pgprot_t protection_map[16] __read_only = {
94192 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
94193 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
94194 };
94195
94196 -pgprot_t vm_get_page_prot(unsigned long vm_flags)
94197 +pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
94198 {
94199 - return __pgprot(pgprot_val(protection_map[vm_flags &
94200 + pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
94201 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
94202 pgprot_val(arch_vm_get_page_prot(vm_flags)));
94203 +
94204 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
94205 + if (!(__supported_pte_mask & _PAGE_NX) &&
94206 + (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
94207 + (vm_flags & (VM_READ | VM_WRITE)))
94208 + prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
94209 +#endif
94210 +
94211 + return prot;
94212 }
94213 EXPORT_SYMBOL(vm_get_page_prot);
94214
94215 @@ -90,6 +110,7 @@ unsigned long sysctl_overcommit_kbytes __read_mostly;
94216 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
94217 unsigned long sysctl_user_reserve_kbytes __read_mostly = 1UL << 17; /* 128MB */
94218 unsigned long sysctl_admin_reserve_kbytes __read_mostly = 1UL << 13; /* 8MB */
94219 +unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
94220 /*
94221 * Make sure vm_committed_as in one cacheline and not cacheline shared with
94222 * other variables. It can be updated by several CPUs frequently.
94223 @@ -246,6 +267,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
94224 struct vm_area_struct *next = vma->vm_next;
94225
94226 might_sleep();
94227 + BUG_ON(vma->vm_mirror);
94228 if (vma->vm_ops && vma->vm_ops->close)
94229 vma->vm_ops->close(vma);
94230 if (vma->vm_file)
94231 @@ -290,6 +312,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
94232 * not page aligned -Ram Gupta
94233 */
94234 rlim = rlimit(RLIMIT_DATA);
94235 + gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
94236 if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
94237 (mm->end_data - mm->start_data) > rlim)
94238 goto out;
94239 @@ -940,6 +963,12 @@ static int
94240 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
94241 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
94242 {
94243 +
94244 +#ifdef CONFIG_PAX_SEGMEXEC
94245 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
94246 + return 0;
94247 +#endif
94248 +
94249 if (is_mergeable_vma(vma, file, vm_flags) &&
94250 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
94251 if (vma->vm_pgoff == vm_pgoff)
94252 @@ -959,6 +988,12 @@ static int
94253 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
94254 struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
94255 {
94256 +
94257 +#ifdef CONFIG_PAX_SEGMEXEC
94258 + if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
94259 + return 0;
94260 +#endif
94261 +
94262 if (is_mergeable_vma(vma, file, vm_flags) &&
94263 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
94264 pgoff_t vm_pglen;
94265 @@ -1001,13 +1036,20 @@ can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
94266 struct vm_area_struct *vma_merge(struct mm_struct *mm,
94267 struct vm_area_struct *prev, unsigned long addr,
94268 unsigned long end, unsigned long vm_flags,
94269 - struct anon_vma *anon_vma, struct file *file,
94270 + struct anon_vma *anon_vma, struct file *file,
94271 pgoff_t pgoff, struct mempolicy *policy)
94272 {
94273 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
94274 struct vm_area_struct *area, *next;
94275 int err;
94276
94277 +#ifdef CONFIG_PAX_SEGMEXEC
94278 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
94279 + struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
94280 +
94281 + BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
94282 +#endif
94283 +
94284 /*
94285 * We later require that vma->vm_flags == vm_flags,
94286 * so this tests vma->vm_flags & VM_SPECIAL, too.
94287 @@ -1023,6 +1065,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
94288 if (next && next->vm_end == end) /* cases 6, 7, 8 */
94289 next = next->vm_next;
94290
94291 +#ifdef CONFIG_PAX_SEGMEXEC
94292 + if (prev)
94293 + prev_m = pax_find_mirror_vma(prev);
94294 + if (area)
94295 + area_m = pax_find_mirror_vma(area);
94296 + if (next)
94297 + next_m = pax_find_mirror_vma(next);
94298 +#endif
94299 +
94300 /*
94301 * Can it merge with the predecessor?
94302 */
94303 @@ -1042,9 +1093,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
94304 /* cases 1, 6 */
94305 err = vma_adjust(prev, prev->vm_start,
94306 next->vm_end, prev->vm_pgoff, NULL);
94307 - } else /* cases 2, 5, 7 */
94308 +
94309 +#ifdef CONFIG_PAX_SEGMEXEC
94310 + if (!err && prev_m)
94311 + err = vma_adjust(prev_m, prev_m->vm_start,
94312 + next_m->vm_end, prev_m->vm_pgoff, NULL);
94313 +#endif
94314 +
94315 + } else { /* cases 2, 5, 7 */
94316 err = vma_adjust(prev, prev->vm_start,
94317 end, prev->vm_pgoff, NULL);
94318 +
94319 +#ifdef CONFIG_PAX_SEGMEXEC
94320 + if (!err && prev_m)
94321 + err = vma_adjust(prev_m, prev_m->vm_start,
94322 + end_m, prev_m->vm_pgoff, NULL);
94323 +#endif
94324 +
94325 + }
94326 if (err)
94327 return NULL;
94328 khugepaged_enter_vma_merge(prev);
94329 @@ -1058,12 +1124,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
94330 mpol_equal(policy, vma_policy(next)) &&
94331 can_vma_merge_before(next, vm_flags,
94332 anon_vma, file, pgoff+pglen)) {
94333 - if (prev && addr < prev->vm_end) /* case 4 */
94334 + if (prev && addr < prev->vm_end) { /* case 4 */
94335 err = vma_adjust(prev, prev->vm_start,
94336 addr, prev->vm_pgoff, NULL);
94337 - else /* cases 3, 8 */
94338 +
94339 +#ifdef CONFIG_PAX_SEGMEXEC
94340 + if (!err && prev_m)
94341 + err = vma_adjust(prev_m, prev_m->vm_start,
94342 + addr_m, prev_m->vm_pgoff, NULL);
94343 +#endif
94344 +
94345 + } else { /* cases 3, 8 */
94346 err = vma_adjust(area, addr, next->vm_end,
94347 next->vm_pgoff - pglen, NULL);
94348 +
94349 +#ifdef CONFIG_PAX_SEGMEXEC
94350 + if (!err && area_m)
94351 + err = vma_adjust(area_m, addr_m, next_m->vm_end,
94352 + next_m->vm_pgoff - pglen, NULL);
94353 +#endif
94354 +
94355 + }
94356 if (err)
94357 return NULL;
94358 khugepaged_enter_vma_merge(area);
94359 @@ -1172,8 +1253,10 @@ none:
94360 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
94361 struct file *file, long pages)
94362 {
94363 - const unsigned long stack_flags
94364 - = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
94365 +
94366 +#ifdef CONFIG_PAX_RANDMMAP
94367 + if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
94368 +#endif
94369
94370 mm->total_vm += pages;
94371
94372 @@ -1181,7 +1264,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
94373 mm->shared_vm += pages;
94374 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
94375 mm->exec_vm += pages;
94376 - } else if (flags & stack_flags)
94377 + } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
94378 mm->stack_vm += pages;
94379 }
94380 #endif /* CONFIG_PROC_FS */
94381 @@ -1211,6 +1294,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
94382 locked += mm->locked_vm;
94383 lock_limit = rlimit(RLIMIT_MEMLOCK);
94384 lock_limit >>= PAGE_SHIFT;
94385 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
94386 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
94387 return -EAGAIN;
94388 }
94389 @@ -1237,7 +1321,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
94390 * (the exception is when the underlying filesystem is noexec
94391 * mounted, in which case we dont add PROT_EXEC.)
94392 */
94393 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
94394 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
94395 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
94396 prot |= PROT_EXEC;
94397
94398 @@ -1263,7 +1347,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
94399 /* Obtain the address to map to. we verify (or select) it and ensure
94400 * that it represents a valid section of the address space.
94401 */
94402 - addr = get_unmapped_area(file, addr, len, pgoff, flags);
94403 + addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
94404 if (addr & ~PAGE_MASK)
94405 return addr;
94406
94407 @@ -1274,6 +1358,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
94408 vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
94409 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
94410
94411 +#ifdef CONFIG_PAX_MPROTECT
94412 + if (mm->pax_flags & MF_PAX_MPROTECT) {
94413 +
94414 +#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
94415 + if (file && !pgoff && (vm_flags & VM_EXEC) && mm->binfmt &&
94416 + mm->binfmt->handle_mmap)
94417 + mm->binfmt->handle_mmap(file);
94418 +#endif
94419 +
94420 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
94421 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
94422 + gr_log_rwxmmap(file);
94423 +
94424 +#ifdef CONFIG_PAX_EMUPLT
94425 + vm_flags &= ~VM_EXEC;
94426 +#else
94427 + return -EPERM;
94428 +#endif
94429 +
94430 + }
94431 +
94432 + if (!(vm_flags & VM_EXEC))
94433 + vm_flags &= ~VM_MAYEXEC;
94434 +#else
94435 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
94436 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
94437 +#endif
94438 + else
94439 + vm_flags &= ~VM_MAYWRITE;
94440 + }
94441 +#endif
94442 +
94443 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
94444 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
94445 + vm_flags &= ~VM_PAGEEXEC;
94446 +#endif
94447 +
94448 if (flags & MAP_LOCKED)
94449 if (!can_do_mlock())
94450 return -EPERM;
94451 @@ -1361,6 +1482,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
94452 vm_flags |= VM_NORESERVE;
94453 }
94454
94455 + if (!gr_acl_handle_mmap(file, prot))
94456 + return -EACCES;
94457 +
94458 addr = mmap_region(file, addr, len, vm_flags, pgoff);
94459 if (!IS_ERR_VALUE(addr) &&
94460 ((vm_flags & VM_LOCKED) ||
94461 @@ -1454,7 +1578,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
94462 vm_flags_t vm_flags = vma->vm_flags;
94463
94464 /* If it was private or non-writable, the write bit is already clear */
94465 - if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
94466 + if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
94467 return 0;
94468
94469 /* The backer wishes to know when pages are first written to? */
94470 @@ -1500,7 +1624,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
94471 struct rb_node **rb_link, *rb_parent;
94472 unsigned long charged = 0;
94473
94474 +#ifdef CONFIG_PAX_SEGMEXEC
94475 + struct vm_area_struct *vma_m = NULL;
94476 +#endif
94477 +
94478 + /*
94479 + * mm->mmap_sem is required to protect against another thread
94480 + * changing the mappings in case we sleep.
94481 + */
94482 + verify_mm_writelocked(mm);
94483 +
94484 /* Check against address space limit. */
94485 +
94486 +#ifdef CONFIG_PAX_RANDMMAP
94487 + if (!(mm->pax_flags & MF_PAX_RANDMMAP) || (vm_flags & (VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)))
94488 +#endif
94489 +
94490 if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
94491 unsigned long nr_pages;
94492
94493 @@ -1519,11 +1658,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
94494
94495 /* Clear old maps */
94496 error = -ENOMEM;
94497 -munmap_back:
94498 if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) {
94499 if (do_munmap(mm, addr, len))
94500 return -ENOMEM;
94501 - goto munmap_back;
94502 + BUG_ON(find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent));
94503 }
94504
94505 /*
94506 @@ -1554,6 +1692,16 @@ munmap_back:
94507 goto unacct_error;
94508 }
94509
94510 +#ifdef CONFIG_PAX_SEGMEXEC
94511 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
94512 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
94513 + if (!vma_m) {
94514 + error = -ENOMEM;
94515 + goto free_vma;
94516 + }
94517 + }
94518 +#endif
94519 +
94520 vma->vm_mm = mm;
94521 vma->vm_start = addr;
94522 vma->vm_end = addr + len;
94523 @@ -1573,6 +1721,13 @@ munmap_back:
94524 if (error)
94525 goto unmap_and_free_vma;
94526
94527 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
94528 + if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
94529 + vma->vm_flags |= VM_PAGEEXEC;
94530 + vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
94531 + }
94532 +#endif
94533 +
94534 /* Can addr have changed??
94535 *
94536 * Answer: Yes, several device drivers can do it in their
94537 @@ -1606,6 +1761,12 @@ munmap_back:
94538 }
94539
94540 vma_link(mm, vma, prev, rb_link, rb_parent);
94541 +
94542 +#ifdef CONFIG_PAX_SEGMEXEC
94543 + if (vma_m)
94544 + BUG_ON(pax_mirror_vma(vma_m, vma));
94545 +#endif
94546 +
94547 /* Once vma denies write, undo our temporary denial count */
94548 if (vm_flags & VM_DENYWRITE)
94549 allow_write_access(file);
94550 @@ -1614,6 +1775,7 @@ out:
94551 perf_event_mmap(vma);
94552
94553 vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
94554 + track_exec_limit(mm, addr, addr + len, vm_flags);
94555 if (vm_flags & VM_LOCKED) {
94556 if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
94557 vma == get_gate_vma(current->mm)))
94558 @@ -1646,6 +1808,12 @@ unmap_and_free_vma:
94559 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
94560 charged = 0;
94561 free_vma:
94562 +
94563 +#ifdef CONFIG_PAX_SEGMEXEC
94564 + if (vma_m)
94565 + kmem_cache_free(vm_area_cachep, vma_m);
94566 +#endif
94567 +
94568 kmem_cache_free(vm_area_cachep, vma);
94569 unacct_error:
94570 if (charged)
94571 @@ -1653,7 +1821,63 @@ unacct_error:
94572 return error;
94573 }
94574
94575 -unsigned long unmapped_area(struct vm_unmapped_area_info *info)
94576 +#ifdef CONFIG_GRKERNSEC_RAND_THREADSTACK
94577 +unsigned long gr_rand_threadstack_offset(const struct mm_struct *mm, const struct file *filp, unsigned long flags)
94578 +{
94579 + if ((mm->pax_flags & MF_PAX_RANDMMAP) && !filp && (flags & MAP_STACK))
94580 + return ((prandom_u32() & 0xFF) + 1) << PAGE_SHIFT;
94581 +
94582 + return 0;
94583 +}
94584 +#endif
94585 +
94586 +bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len, unsigned long offset)
94587 +{
94588 + if (!vma) {
94589 +#ifdef CONFIG_STACK_GROWSUP
94590 + if (addr > sysctl_heap_stack_gap)
94591 + vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
94592 + else
94593 + vma = find_vma(current->mm, 0);
94594 + if (vma && (vma->vm_flags & VM_GROWSUP))
94595 + return false;
94596 +#endif
94597 + return true;
94598 + }
94599 +
94600 + if (addr + len > vma->vm_start)
94601 + return false;
94602 +
94603 + if (vma->vm_flags & VM_GROWSDOWN)
94604 + return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
94605 +#ifdef CONFIG_STACK_GROWSUP
94606 + else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
94607 + return addr - vma->vm_prev->vm_end >= sysctl_heap_stack_gap;
94608 +#endif
94609 + else if (offset)
94610 + return offset <= vma->vm_start - addr - len;
94611 +
94612 + return true;
94613 +}
94614 +
94615 +unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len, unsigned long offset)
94616 +{
94617 + if (vma->vm_start < len)
94618 + return -ENOMEM;
94619 +
94620 + if (!(vma->vm_flags & VM_GROWSDOWN)) {
94621 + if (offset <= vma->vm_start - len)
94622 + return vma->vm_start - len - offset;
94623 + else
94624 + return -ENOMEM;
94625 + }
94626 +
94627 + if (sysctl_heap_stack_gap <= vma->vm_start - len)
94628 + return vma->vm_start - len - sysctl_heap_stack_gap;
94629 + return -ENOMEM;
94630 +}
94631 +
94632 +unsigned long unmapped_area(const struct vm_unmapped_area_info *info)
94633 {
94634 /*
94635 * We implement the search by looking for an rbtree node that
94636 @@ -1701,11 +1925,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
94637 }
94638 }
94639
94640 - gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0;
94641 + gap_start = vma->vm_prev ? vma->vm_prev->vm_end: 0;
94642 check_current:
94643 /* Check if current node has a suitable gap */
94644 if (gap_start > high_limit)
94645 return -ENOMEM;
94646 +
94647 + if (gap_end - gap_start > info->threadstack_offset)
94648 + gap_start += info->threadstack_offset;
94649 + else
94650 + gap_start = gap_end;
94651 +
94652 + if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) {
94653 + if (gap_end - gap_start > sysctl_heap_stack_gap)
94654 + gap_start += sysctl_heap_stack_gap;
94655 + else
94656 + gap_start = gap_end;
94657 + }
94658 + if (vma->vm_flags & VM_GROWSDOWN) {
94659 + if (gap_end - gap_start > sysctl_heap_stack_gap)
94660 + gap_end -= sysctl_heap_stack_gap;
94661 + else
94662 + gap_end = gap_start;
94663 + }
94664 if (gap_end >= low_limit && gap_end - gap_start >= length)
94665 goto found;
94666
94667 @@ -1755,7 +1997,7 @@ found:
94668 return gap_start;
94669 }
94670
94671 -unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
94672 +unsigned long unmapped_area_topdown(const struct vm_unmapped_area_info *info)
94673 {
94674 struct mm_struct *mm = current->mm;
94675 struct vm_area_struct *vma;
94676 @@ -1809,6 +2051,24 @@ check_current:
94677 gap_end = vma->vm_start;
94678 if (gap_end < low_limit)
94679 return -ENOMEM;
94680 +
94681 + if (gap_end - gap_start > info->threadstack_offset)
94682 + gap_end -= info->threadstack_offset;
94683 + else
94684 + gap_end = gap_start;
94685 +
94686 + if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP)) {
94687 + if (gap_end - gap_start > sysctl_heap_stack_gap)
94688 + gap_start += sysctl_heap_stack_gap;
94689 + else
94690 + gap_start = gap_end;
94691 + }
94692 + if (vma->vm_flags & VM_GROWSDOWN) {
94693 + if (gap_end - gap_start > sysctl_heap_stack_gap)
94694 + gap_end -= sysctl_heap_stack_gap;
94695 + else
94696 + gap_end = gap_start;
94697 + }
94698 if (gap_start <= high_limit && gap_end - gap_start >= length)
94699 goto found;
94700
94701 @@ -1872,6 +2132,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
94702 struct mm_struct *mm = current->mm;
94703 struct vm_area_struct *vma;
94704 struct vm_unmapped_area_info info;
94705 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
94706
94707 if (len > TASK_SIZE - mmap_min_addr)
94708 return -ENOMEM;
94709 @@ -1879,11 +2140,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
94710 if (flags & MAP_FIXED)
94711 return addr;
94712
94713 +#ifdef CONFIG_PAX_RANDMMAP
94714 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
94715 +#endif
94716 +
94717 if (addr) {
94718 addr = PAGE_ALIGN(addr);
94719 vma = find_vma(mm, addr);
94720 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
94721 - (!vma || addr + len <= vma->vm_start))
94722 + check_heap_stack_gap(vma, addr, len, offset))
94723 return addr;
94724 }
94725
94726 @@ -1892,6 +2157,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
94727 info.low_limit = mm->mmap_base;
94728 info.high_limit = TASK_SIZE;
94729 info.align_mask = 0;
94730 + info.threadstack_offset = offset;
94731 return vm_unmapped_area(&info);
94732 }
94733 #endif
94734 @@ -1910,6 +2176,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
94735 struct mm_struct *mm = current->mm;
94736 unsigned long addr = addr0;
94737 struct vm_unmapped_area_info info;
94738 + unsigned long offset = gr_rand_threadstack_offset(mm, filp, flags);
94739
94740 /* requested length too big for entire address space */
94741 if (len > TASK_SIZE - mmap_min_addr)
94742 @@ -1918,12 +2185,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
94743 if (flags & MAP_FIXED)
94744 return addr;
94745
94746 +#ifdef CONFIG_PAX_RANDMMAP
94747 + if (!(mm->pax_flags & MF_PAX_RANDMMAP))
94748 +#endif
94749 +
94750 /* requesting a specific address */
94751 if (addr) {
94752 addr = PAGE_ALIGN(addr);
94753 vma = find_vma(mm, addr);
94754 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
94755 - (!vma || addr + len <= vma->vm_start))
94756 + check_heap_stack_gap(vma, addr, len, offset))
94757 return addr;
94758 }
94759
94760 @@ -1932,6 +2203,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
94761 info.low_limit = max(PAGE_SIZE, mmap_min_addr);
94762 info.high_limit = mm->mmap_base;
94763 info.align_mask = 0;
94764 + info.threadstack_offset = offset;
94765 addr = vm_unmapped_area(&info);
94766
94767 /*
94768 @@ -1944,6 +2216,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
94769 VM_BUG_ON(addr != -ENOMEM);
94770 info.flags = 0;
94771 info.low_limit = TASK_UNMAPPED_BASE;
94772 +
94773 +#ifdef CONFIG_PAX_RANDMMAP
94774 + if (mm->pax_flags & MF_PAX_RANDMMAP)
94775 + info.low_limit += mm->delta_mmap;
94776 +#endif
94777 +
94778 info.high_limit = TASK_SIZE;
94779 addr = vm_unmapped_area(&info);
94780 }
94781 @@ -2045,6 +2323,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
94782 return vma;
94783 }
94784
94785 +#ifdef CONFIG_PAX_SEGMEXEC
94786 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
94787 +{
94788 + struct vm_area_struct *vma_m;
94789 +
94790 + BUG_ON(!vma || vma->vm_start >= vma->vm_end);
94791 + if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
94792 + BUG_ON(vma->vm_mirror);
94793 + return NULL;
94794 + }
94795 + BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
94796 + vma_m = vma->vm_mirror;
94797 + BUG_ON(!vma_m || vma_m->vm_mirror != vma);
94798 + BUG_ON(vma->vm_file != vma_m->vm_file);
94799 + BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
94800 + BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff);
94801 + BUG_ON(vma->anon_vma != vma_m->anon_vma && vma->anon_vma->root != vma_m->anon_vma->root);
94802 + BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
94803 + return vma_m;
94804 +}
94805 +#endif
94806 +
94807 /*
94808 * Verify that the stack growth is acceptable and
94809 * update accounting. This is shared with both the
94810 @@ -2061,6 +2361,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
94811 return -ENOMEM;
94812
94813 /* Stack limit test */
94814 + gr_learn_resource(current, RLIMIT_STACK, size, 1);
94815 if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
94816 return -ENOMEM;
94817
94818 @@ -2071,6 +2372,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
94819 locked = mm->locked_vm + grow;
94820 limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
94821 limit >>= PAGE_SHIFT;
94822 + gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
94823 if (locked > limit && !capable(CAP_IPC_LOCK))
94824 return -ENOMEM;
94825 }
94826 @@ -2100,37 +2402,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
94827 * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
94828 * vma is the last one with address > vma->vm_end. Have to extend vma.
94829 */
94830 +#ifndef CONFIG_IA64
94831 +static
94832 +#endif
94833 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
94834 {
94835 int error;
94836 + bool locknext;
94837
94838 if (!(vma->vm_flags & VM_GROWSUP))
94839 return -EFAULT;
94840
94841 + /* Also guard against wrapping around to address 0. */
94842 + if (address < PAGE_ALIGN(address+1))
94843 + address = PAGE_ALIGN(address+1);
94844 + else
94845 + return -ENOMEM;
94846 +
94847 /*
94848 * We must make sure the anon_vma is allocated
94849 * so that the anon_vma locking is not a noop.
94850 */
94851 if (unlikely(anon_vma_prepare(vma)))
94852 return -ENOMEM;
94853 + locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
94854 + if (locknext && anon_vma_prepare(vma->vm_next))
94855 + return -ENOMEM;
94856 vma_lock_anon_vma(vma);
94857 + if (locknext)
94858 + vma_lock_anon_vma(vma->vm_next);
94859
94860 /*
94861 * vma->vm_start/vm_end cannot change under us because the caller
94862 * is required to hold the mmap_sem in read mode. We need the
94863 - * anon_vma lock to serialize against concurrent expand_stacks.
94864 - * Also guard against wrapping around to address 0.
94865 + * anon_vma locks to serialize against concurrent expand_stacks
94866 + * and expand_upwards.
94867 */
94868 - if (address < PAGE_ALIGN(address+4))
94869 - address = PAGE_ALIGN(address+4);
94870 - else {
94871 - vma_unlock_anon_vma(vma);
94872 - return -ENOMEM;
94873 - }
94874 error = 0;
94875
94876 /* Somebody else might have raced and expanded it already */
94877 - if (address > vma->vm_end) {
94878 + if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
94879 + error = -ENOMEM;
94880 + else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
94881 unsigned long size, grow;
94882
94883 size = address - vma->vm_start;
94884 @@ -2165,6 +2478,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
94885 }
94886 }
94887 }
94888 + if (locknext)
94889 + vma_unlock_anon_vma(vma->vm_next);
94890 vma_unlock_anon_vma(vma);
94891 khugepaged_enter_vma_merge(vma);
94892 validate_mm(vma->vm_mm);
94893 @@ -2179,6 +2494,8 @@ int expand_downwards(struct vm_area_struct *vma,
94894 unsigned long address)
94895 {
94896 int error;
94897 + bool lockprev = false;
94898 + struct vm_area_struct *prev;
94899
94900 /*
94901 * We must make sure the anon_vma is allocated
94902 @@ -2192,6 +2509,15 @@ int expand_downwards(struct vm_area_struct *vma,
94903 if (error)
94904 return error;
94905
94906 + prev = vma->vm_prev;
94907 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
94908 + lockprev = prev && (prev->vm_flags & VM_GROWSUP);
94909 +#endif
94910 + if (lockprev && anon_vma_prepare(prev))
94911 + return -ENOMEM;
94912 + if (lockprev)
94913 + vma_lock_anon_vma(prev);
94914 +
94915 vma_lock_anon_vma(vma);
94916
94917 /*
94918 @@ -2201,9 +2527,17 @@ int expand_downwards(struct vm_area_struct *vma,
94919 */
94920
94921 /* Somebody else might have raced and expanded it already */
94922 - if (address < vma->vm_start) {
94923 + if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
94924 + error = -ENOMEM;
94925 + else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
94926 unsigned long size, grow;
94927
94928 +#ifdef CONFIG_PAX_SEGMEXEC
94929 + struct vm_area_struct *vma_m;
94930 +
94931 + vma_m = pax_find_mirror_vma(vma);
94932 +#endif
94933 +
94934 size = vma->vm_end - address;
94935 grow = (vma->vm_start - address) >> PAGE_SHIFT;
94936
94937 @@ -2228,13 +2562,27 @@ int expand_downwards(struct vm_area_struct *vma,
94938 vma->vm_pgoff -= grow;
94939 anon_vma_interval_tree_post_update_vma(vma);
94940 vma_gap_update(vma);
94941 +
94942 +#ifdef CONFIG_PAX_SEGMEXEC
94943 + if (vma_m) {
94944 + anon_vma_interval_tree_pre_update_vma(vma_m);
94945 + vma_m->vm_start -= grow << PAGE_SHIFT;
94946 + vma_m->vm_pgoff -= grow;
94947 + anon_vma_interval_tree_post_update_vma(vma_m);
94948 + vma_gap_update(vma_m);
94949 + }
94950 +#endif
94951 +
94952 spin_unlock(&vma->vm_mm->page_table_lock);
94953
94954 + track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
94955 perf_event_mmap(vma);
94956 }
94957 }
94958 }
94959 vma_unlock_anon_vma(vma);
94960 + if (lockprev)
94961 + vma_unlock_anon_vma(prev);
94962 khugepaged_enter_vma_merge(vma);
94963 validate_mm(vma->vm_mm);
94964 return error;
94965 @@ -2332,6 +2680,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
94966 do {
94967 long nrpages = vma_pages(vma);
94968
94969 +#ifdef CONFIG_PAX_SEGMEXEC
94970 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
94971 + vma = remove_vma(vma);
94972 + continue;
94973 + }
94974 +#endif
94975 +
94976 if (vma->vm_flags & VM_ACCOUNT)
94977 nr_accounted += nrpages;
94978 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
94979 @@ -2376,6 +2731,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
94980 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
94981 vma->vm_prev = NULL;
94982 do {
94983 +
94984 +#ifdef CONFIG_PAX_SEGMEXEC
94985 + if (vma->vm_mirror) {
94986 + BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
94987 + vma->vm_mirror->vm_mirror = NULL;
94988 + vma->vm_mirror->vm_flags &= ~VM_EXEC;
94989 + vma->vm_mirror = NULL;
94990 + }
94991 +#endif
94992 +
94993 vma_rb_erase(vma, &mm->mm_rb);
94994 mm->map_count--;
94995 tail_vma = vma;
94996 @@ -2401,14 +2766,33 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
94997 struct vm_area_struct *new;
94998 int err = -ENOMEM;
94999
95000 +#ifdef CONFIG_PAX_SEGMEXEC
95001 + struct vm_area_struct *vma_m, *new_m = NULL;
95002 + unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
95003 +#endif
95004 +
95005 if (is_vm_hugetlb_page(vma) && (addr &
95006 ~(huge_page_mask(hstate_vma(vma)))))
95007 return -EINVAL;
95008
95009 +#ifdef CONFIG_PAX_SEGMEXEC
95010 + vma_m = pax_find_mirror_vma(vma);
95011 +#endif
95012 +
95013 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
95014 if (!new)
95015 goto out_err;
95016
95017 +#ifdef CONFIG_PAX_SEGMEXEC
95018 + if (vma_m) {
95019 + new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
95020 + if (!new_m) {
95021 + kmem_cache_free(vm_area_cachep, new);
95022 + goto out_err;
95023 + }
95024 + }
95025 +#endif
95026 +
95027 /* most fields are the same, copy all, and then fixup */
95028 *new = *vma;
95029
95030 @@ -2421,6 +2805,22 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
95031 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
95032 }
95033
95034 +#ifdef CONFIG_PAX_SEGMEXEC
95035 + if (vma_m) {
95036 + *new_m = *vma_m;
95037 + INIT_LIST_HEAD(&new_m->anon_vma_chain);
95038 + new_m->vm_mirror = new;
95039 + new->vm_mirror = new_m;
95040 +
95041 + if (new_below)
95042 + new_m->vm_end = addr_m;
95043 + else {
95044 + new_m->vm_start = addr_m;
95045 + new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
95046 + }
95047 + }
95048 +#endif
95049 +
95050 err = vma_dup_policy(vma, new);
95051 if (err)
95052 goto out_free_vma;
95053 @@ -2440,6 +2840,38 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
95054 else
95055 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
95056
95057 +#ifdef CONFIG_PAX_SEGMEXEC
95058 + if (!err && vma_m) {
95059 + struct mempolicy *pol = vma_policy(new);
95060 +
95061 + if (anon_vma_clone(new_m, vma_m))
95062 + goto out_free_mpol;
95063 +
95064 + mpol_get(pol);
95065 + set_vma_policy(new_m, pol);
95066 +
95067 + if (new_m->vm_file)
95068 + get_file(new_m->vm_file);
95069 +
95070 + if (new_m->vm_ops && new_m->vm_ops->open)
95071 + new_m->vm_ops->open(new_m);
95072 +
95073 + if (new_below)
95074 + err = vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
95075 + ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
95076 + else
95077 + err = vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
95078 +
95079 + if (err) {
95080 + if (new_m->vm_ops && new_m->vm_ops->close)
95081 + new_m->vm_ops->close(new_m);
95082 + if (new_m->vm_file)
95083 + fput(new_m->vm_file);
95084 + mpol_put(pol);
95085 + }
95086 + }
95087 +#endif
95088 +
95089 /* Success. */
95090 if (!err)
95091 return 0;
95092 @@ -2449,10 +2881,18 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
95093 new->vm_ops->close(new);
95094 if (new->vm_file)
95095 fput(new->vm_file);
95096 - unlink_anon_vmas(new);
95097 out_free_mpol:
95098 mpol_put(vma_policy(new));
95099 out_free_vma:
95100 +
95101 +#ifdef CONFIG_PAX_SEGMEXEC
95102 + if (new_m) {
95103 + unlink_anon_vmas(new_m);
95104 + kmem_cache_free(vm_area_cachep, new_m);
95105 + }
95106 +#endif
95107 +
95108 + unlink_anon_vmas(new);
95109 kmem_cache_free(vm_area_cachep, new);
95110 out_err:
95111 return err;
95112 @@ -2465,6 +2905,15 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
95113 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
95114 unsigned long addr, int new_below)
95115 {
95116 +
95117 +#ifdef CONFIG_PAX_SEGMEXEC
95118 + if (mm->pax_flags & MF_PAX_SEGMEXEC) {
95119 + BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
95120 + if (mm->map_count >= sysctl_max_map_count-1)
95121 + return -ENOMEM;
95122 + } else
95123 +#endif
95124 +
95125 if (mm->map_count >= sysctl_max_map_count)
95126 return -ENOMEM;
95127
95128 @@ -2476,11 +2925,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
95129 * work. This now handles partial unmappings.
95130 * Jeremy Fitzhardinge <jeremy@goop.org>
95131 */
95132 +#ifdef CONFIG_PAX_SEGMEXEC
95133 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
95134 {
95135 + int ret = __do_munmap(mm, start, len);
95136 + if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
95137 + return ret;
95138 +
95139 + return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
95140 +}
95141 +
95142 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
95143 +#else
95144 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
95145 +#endif
95146 +{
95147 unsigned long end;
95148 struct vm_area_struct *vma, *prev, *last;
95149
95150 + /*
95151 + * mm->mmap_sem is required to protect against another thread
95152 + * changing the mappings in case we sleep.
95153 + */
95154 + verify_mm_writelocked(mm);
95155 +
95156 if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
95157 return -EINVAL;
95158
95159 @@ -2555,6 +3023,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
95160 /* Fix up all other VM information */
95161 remove_vma_list(mm, vma);
95162
95163 + track_exec_limit(mm, start, end, 0UL);
95164 +
95165 return 0;
95166 }
95167
95168 @@ -2563,6 +3033,13 @@ int vm_munmap(unsigned long start, size_t len)
95169 int ret;
95170 struct mm_struct *mm = current->mm;
95171
95172 +
95173 +#ifdef CONFIG_PAX_SEGMEXEC
95174 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
95175 + (len > SEGMEXEC_TASK_SIZE || start > SEGMEXEC_TASK_SIZE-len))
95176 + return -EINVAL;
95177 +#endif
95178 +
95179 down_write(&mm->mmap_sem);
95180 ret = do_munmap(mm, start, len);
95181 up_write(&mm->mmap_sem);
95182 @@ -2576,16 +3053,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
95183 return vm_munmap(addr, len);
95184 }
95185
95186 -static inline void verify_mm_writelocked(struct mm_struct *mm)
95187 -{
95188 -#ifdef CONFIG_DEBUG_VM
95189 - if (unlikely(down_read_trylock(&mm->mmap_sem))) {
95190 - WARN_ON(1);
95191 - up_read(&mm->mmap_sem);
95192 - }
95193 -#endif
95194 -}
95195 -
95196 /*
95197 * this is really a simplified "do_mmap". it only handles
95198 * anonymous maps. eventually we may be able to do some
95199 @@ -2599,6 +3066,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
95200 struct rb_node ** rb_link, * rb_parent;
95201 pgoff_t pgoff = addr >> PAGE_SHIFT;
95202 int error;
95203 + unsigned long charged;
95204
95205 len = PAGE_ALIGN(len);
95206 if (!len)
95207 @@ -2606,10 +3074,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
95208
95209 flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
95210
95211 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
95212 + if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
95213 + flags &= ~VM_EXEC;
95214 +
95215 +#ifdef CONFIG_PAX_MPROTECT
95216 + if (mm->pax_flags & MF_PAX_MPROTECT)
95217 + flags &= ~VM_MAYEXEC;
95218 +#endif
95219 +
95220 + }
95221 +#endif
95222 +
95223 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
95224 if (error & ~PAGE_MASK)
95225 return error;
95226
95227 + charged = len >> PAGE_SHIFT;
95228 +
95229 error = mlock_future_check(mm, mm->def_flags, len);
95230 if (error)
95231 return error;
95232 @@ -2623,21 +3105,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
95233 /*
95234 * Clear old maps. this also does some error checking for us
95235 */
95236 - munmap_back:
95237 if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent)) {
95238 if (do_munmap(mm, addr, len))
95239 return -ENOMEM;
95240 - goto munmap_back;
95241 + BUG_ON(find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent));
95242 }
95243
95244 /* Check against address space limits *after* clearing old maps... */
95245 - if (!may_expand_vm(mm, len >> PAGE_SHIFT))
95246 + if (!may_expand_vm(mm, charged))
95247 return -ENOMEM;
95248
95249 if (mm->map_count > sysctl_max_map_count)
95250 return -ENOMEM;
95251
95252 - if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
95253 + if (security_vm_enough_memory_mm(mm, charged))
95254 return -ENOMEM;
95255
95256 /* Can we just expand an old private anonymous mapping? */
95257 @@ -2651,7 +3132,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
95258 */
95259 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
95260 if (!vma) {
95261 - vm_unacct_memory(len >> PAGE_SHIFT);
95262 + vm_unacct_memory(charged);
95263 return -ENOMEM;
95264 }
95265
95266 @@ -2665,10 +3146,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
95267 vma_link(mm, vma, prev, rb_link, rb_parent);
95268 out:
95269 perf_event_mmap(vma);
95270 - mm->total_vm += len >> PAGE_SHIFT;
95271 + mm->total_vm += charged;
95272 if (flags & VM_LOCKED)
95273 - mm->locked_vm += (len >> PAGE_SHIFT);
95274 + mm->locked_vm += charged;
95275 vma->vm_flags |= VM_SOFTDIRTY;
95276 + track_exec_limit(mm, addr, addr + len, flags);
95277 return addr;
95278 }
95279
95280 @@ -2730,6 +3212,7 @@ void exit_mmap(struct mm_struct *mm)
95281 while (vma) {
95282 if (vma->vm_flags & VM_ACCOUNT)
95283 nr_accounted += vma_pages(vma);
95284 + vma->vm_mirror = NULL;
95285 vma = remove_vma(vma);
95286 }
95287 vm_unacct_memory(nr_accounted);
95288 @@ -2747,6 +3230,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
95289 struct vm_area_struct *prev;
95290 struct rb_node **rb_link, *rb_parent;
95291
95292 +#ifdef CONFIG_PAX_SEGMEXEC
95293 + struct vm_area_struct *vma_m = NULL;
95294 +#endif
95295 +
95296 + if (security_mmap_addr(vma->vm_start))
95297 + return -EPERM;
95298 +
95299 /*
95300 * The vm_pgoff of a purely anonymous vma should be irrelevant
95301 * until its first write fault, when page's anon_vma and index
95302 @@ -2770,7 +3260,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
95303 security_vm_enough_memory_mm(mm, vma_pages(vma)))
95304 return -ENOMEM;
95305
95306 +#ifdef CONFIG_PAX_SEGMEXEC
95307 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
95308 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
95309 + if (!vma_m)
95310 + return -ENOMEM;
95311 + }
95312 +#endif
95313 +
95314 vma_link(mm, vma, prev, rb_link, rb_parent);
95315 +
95316 +#ifdef CONFIG_PAX_SEGMEXEC
95317 + if (vma_m)
95318 + BUG_ON(pax_mirror_vma(vma_m, vma));
95319 +#endif
95320 +
95321 return 0;
95322 }
95323
95324 @@ -2789,6 +3293,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
95325 struct rb_node **rb_link, *rb_parent;
95326 bool faulted_in_anon_vma = true;
95327
95328 + BUG_ON(vma->vm_mirror);
95329 +
95330 /*
95331 * If anonymous vma has not yet been faulted, update new pgoff
95332 * to match new location, to increase its chance of merging.
95333 @@ -2853,6 +3359,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
95334 return NULL;
95335 }
95336
95337 +#ifdef CONFIG_PAX_SEGMEXEC
95338 +long pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
95339 +{
95340 + struct vm_area_struct *prev_m;
95341 + struct rb_node **rb_link_m, *rb_parent_m;
95342 + struct mempolicy *pol_m;
95343 +
95344 + BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
95345 + BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
95346 + BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
95347 + *vma_m = *vma;
95348 + INIT_LIST_HEAD(&vma_m->anon_vma_chain);
95349 + if (anon_vma_clone(vma_m, vma))
95350 + return -ENOMEM;
95351 + pol_m = vma_policy(vma_m);
95352 + mpol_get(pol_m);
95353 + set_vma_policy(vma_m, pol_m);
95354 + vma_m->vm_start += SEGMEXEC_TASK_SIZE;
95355 + vma_m->vm_end += SEGMEXEC_TASK_SIZE;
95356 + vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
95357 + vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
95358 + if (vma_m->vm_file)
95359 + get_file(vma_m->vm_file);
95360 + if (vma_m->vm_ops && vma_m->vm_ops->open)
95361 + vma_m->vm_ops->open(vma_m);
95362 + BUG_ON(find_vma_links(vma->vm_mm, vma_m->vm_start, vma_m->vm_end, &prev_m, &rb_link_m, &rb_parent_m));
95363 + vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
95364 + vma_m->vm_mirror = vma;
95365 + vma->vm_mirror = vma_m;
95366 + return 0;
95367 +}
95368 +#endif
95369 +
95370 /*
95371 * Return true if the calling process may expand its vm space by the passed
95372 * number of pages
95373 @@ -2864,6 +3403,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
95374
95375 lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
95376
95377 + gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
95378 if (cur + npages > lim)
95379 return 0;
95380 return 1;
95381 @@ -2934,6 +3474,22 @@ int install_special_mapping(struct mm_struct *mm,
95382 vma->vm_start = addr;
95383 vma->vm_end = addr + len;
95384
95385 +#ifdef CONFIG_PAX_MPROTECT
95386 + if (mm->pax_flags & MF_PAX_MPROTECT) {
95387 +#ifndef CONFIG_PAX_MPROTECT_COMPAT
95388 + if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
95389 + return -EPERM;
95390 + if (!(vm_flags & VM_EXEC))
95391 + vm_flags &= ~VM_MAYEXEC;
95392 +#else
95393 + if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
95394 + vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
95395 +#endif
95396 + else
95397 + vm_flags &= ~VM_MAYWRITE;
95398 + }
95399 +#endif
95400 +
95401 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND | VM_SOFTDIRTY;
95402 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
95403
95404 diff --git a/mm/mprotect.c b/mm/mprotect.c
95405 index 769a67a..414d24f 100644
95406 --- a/mm/mprotect.c
95407 +++ b/mm/mprotect.c
95408 @@ -24,10 +24,18 @@
95409 #include <linux/migrate.h>
95410 #include <linux/perf_event.h>
95411 #include <linux/ksm.h>
95412 +#include <linux/sched/sysctl.h>
95413 +
95414 +#ifdef CONFIG_PAX_MPROTECT
95415 +#include <linux/elf.h>
95416 +#include <linux/binfmts.h>
95417 +#endif
95418 +
95419 #include <asm/uaccess.h>
95420 #include <asm/pgtable.h>
95421 #include <asm/cacheflush.h>
95422 #include <asm/tlbflush.h>
95423 +#include <asm/mmu_context.h>
95424
95425 #ifndef pgprot_modify
95426 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
95427 @@ -214,6 +222,48 @@ unsigned long change_protection(struct vm_area_struct *vma, unsigned long start,
95428 return pages;
95429 }
95430
95431 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
95432 +/* called while holding the mmap semaphor for writing except stack expansion */
95433 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
95434 +{
95435 + unsigned long oldlimit, newlimit = 0UL;
95436 +
95437 + if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
95438 + return;
95439 +
95440 + spin_lock(&mm->page_table_lock);
95441 + oldlimit = mm->context.user_cs_limit;
95442 + if ((prot & VM_EXEC) && oldlimit < end)
95443 + /* USER_CS limit moved up */
95444 + newlimit = end;
95445 + else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
95446 + /* USER_CS limit moved down */
95447 + newlimit = start;
95448 +
95449 + if (newlimit) {
95450 + mm->context.user_cs_limit = newlimit;
95451 +
95452 +#ifdef CONFIG_SMP
95453 + wmb();
95454 + cpus_clear(mm->context.cpu_user_cs_mask);
95455 + cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
95456 +#endif
95457 +
95458 + set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
95459 + }
95460 + spin_unlock(&mm->page_table_lock);
95461 + if (newlimit == end) {
95462 + struct vm_area_struct *vma = find_vma(mm, oldlimit);
95463 +
95464 + for (; vma && vma->vm_start < end; vma = vma->vm_next)
95465 + if (is_vm_hugetlb_page(vma))
95466 + hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
95467 + else
95468 + change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma), 0);
95469 + }
95470 +}
95471 +#endif
95472 +
95473 int
95474 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
95475 unsigned long start, unsigned long end, unsigned long newflags)
95476 @@ -226,11 +276,29 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
95477 int error;
95478 int dirty_accountable = 0;
95479
95480 +#ifdef CONFIG_PAX_SEGMEXEC
95481 + struct vm_area_struct *vma_m = NULL;
95482 + unsigned long start_m, end_m;
95483 +
95484 + start_m = start + SEGMEXEC_TASK_SIZE;
95485 + end_m = end + SEGMEXEC_TASK_SIZE;
95486 +#endif
95487 +
95488 if (newflags == oldflags) {
95489 *pprev = vma;
95490 return 0;
95491 }
95492
95493 + if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
95494 + struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
95495 +
95496 + if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
95497 + return -ENOMEM;
95498 +
95499 + if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
95500 + return -ENOMEM;
95501 + }
95502 +
95503 /*
95504 * If we make a private mapping writable we increase our commit;
95505 * but (without finer accounting) cannot reduce our commit if we
95506 @@ -247,6 +315,42 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
95507 }
95508 }
95509
95510 +#ifdef CONFIG_PAX_SEGMEXEC
95511 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
95512 + if (start != vma->vm_start) {
95513 + error = split_vma(mm, vma, start, 1);
95514 + if (error)
95515 + goto fail;
95516 + BUG_ON(!*pprev || (*pprev)->vm_next == vma);
95517 + *pprev = (*pprev)->vm_next;
95518 + }
95519 +
95520 + if (end != vma->vm_end) {
95521 + error = split_vma(mm, vma, end, 0);
95522 + if (error)
95523 + goto fail;
95524 + }
95525 +
95526 + if (pax_find_mirror_vma(vma)) {
95527 + error = __do_munmap(mm, start_m, end_m - start_m);
95528 + if (error)
95529 + goto fail;
95530 + } else {
95531 + vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
95532 + if (!vma_m) {
95533 + error = -ENOMEM;
95534 + goto fail;
95535 + }
95536 + vma->vm_flags = newflags;
95537 + error = pax_mirror_vma(vma_m, vma);
95538 + if (error) {
95539 + vma->vm_flags = oldflags;
95540 + goto fail;
95541 + }
95542 + }
95543 + }
95544 +#endif
95545 +
95546 /*
95547 * First try to merge with previous and/or next vma.
95548 */
95549 @@ -277,9 +381,21 @@ success:
95550 * vm_flags and vm_page_prot are protected by the mmap_sem
95551 * held in write mode.
95552 */
95553 +
95554 +#ifdef CONFIG_PAX_SEGMEXEC
95555 + if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
95556 + pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
95557 +#endif
95558 +
95559 vma->vm_flags = newflags;
95560 +
95561 +#ifdef CONFIG_PAX_MPROTECT
95562 + if (mm->binfmt && mm->binfmt->handle_mprotect)
95563 + mm->binfmt->handle_mprotect(vma, newflags);
95564 +#endif
95565 +
95566 vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
95567 - vm_get_page_prot(newflags));
95568 + vm_get_page_prot(vma->vm_flags));
95569
95570 if (vma_wants_writenotify(vma)) {
95571 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
95572 @@ -318,6 +434,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
95573 end = start + len;
95574 if (end <= start)
95575 return -ENOMEM;
95576 +
95577 +#ifdef CONFIG_PAX_SEGMEXEC
95578 + if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
95579 + if (end > SEGMEXEC_TASK_SIZE)
95580 + return -EINVAL;
95581 + } else
95582 +#endif
95583 +
95584 + if (end > TASK_SIZE)
95585 + return -EINVAL;
95586 +
95587 if (!arch_validate_prot(prot))
95588 return -EINVAL;
95589
95590 @@ -325,7 +452,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
95591 /*
95592 * Does the application expect PROT_READ to imply PROT_EXEC:
95593 */
95594 - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
95595 + if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
95596 prot |= PROT_EXEC;
95597
95598 vm_flags = calc_vm_prot_bits(prot);
95599 @@ -357,6 +484,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
95600 if (start > vma->vm_start)
95601 prev = vma;
95602
95603 +#ifdef CONFIG_PAX_MPROTECT
95604 + if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
95605 + current->mm->binfmt->handle_mprotect(vma, vm_flags);
95606 +#endif
95607 +
95608 for (nstart = start ; ; ) {
95609 unsigned long newflags;
95610
95611 @@ -367,6 +499,14 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
95612
95613 /* newflags >> 4 shift VM_MAY% in place of VM_% */
95614 if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
95615 + if (prot & (PROT_WRITE | PROT_EXEC))
95616 + gr_log_rwxmprotect(vma);
95617 +
95618 + error = -EACCES;
95619 + goto out;
95620 + }
95621 +
95622 + if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
95623 error = -EACCES;
95624 goto out;
95625 }
95626 @@ -381,6 +521,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
95627 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
95628 if (error)
95629 goto out;
95630 +
95631 + track_exec_limit(current->mm, nstart, tmp, vm_flags);
95632 +
95633 nstart = tmp;
95634
95635 if (nstart < prev->vm_end)
95636 diff --git a/mm/mremap.c b/mm/mremap.c
95637 index 0843feb..c3cde48 100644
95638 --- a/mm/mremap.c
95639 +++ b/mm/mremap.c
95640 @@ -144,6 +144,12 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
95641 continue;
95642 pte = ptep_get_and_clear(mm, old_addr, old_pte);
95643 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
95644 +
95645 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
95646 + if (!(__supported_pte_mask & _PAGE_NX) && pte_present(pte) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
95647 + pte = pte_exprotect(pte);
95648 +#endif
95649 +
95650 pte = move_soft_dirty_pte(pte);
95651 set_pte_at(mm, new_addr, new_pte, pte);
95652 }
95653 @@ -194,10 +200,17 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
95654 break;
95655 if (pmd_trans_huge(*old_pmd)) {
95656 int err = 0;
95657 - if (extent == HPAGE_PMD_SIZE)
95658 + if (extent == HPAGE_PMD_SIZE) {
95659 + VM_BUG_ON(vma->vm_file || !vma->anon_vma);
95660 + /* See comment in move_ptes() */
95661 + if (need_rmap_locks)
95662 + anon_vma_lock_write(vma->anon_vma);
95663 err = move_huge_pmd(vma, new_vma, old_addr,
95664 new_addr, old_end,
95665 old_pmd, new_pmd);
95666 + if (need_rmap_locks)
95667 + anon_vma_unlock_write(vma->anon_vma);
95668 + }
95669 if (err > 0) {
95670 need_flush = true;
95671 continue;
95672 @@ -337,6 +350,11 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
95673 if (is_vm_hugetlb_page(vma))
95674 goto Einval;
95675
95676 +#ifdef CONFIG_PAX_SEGMEXEC
95677 + if (pax_find_mirror_vma(vma))
95678 + goto Einval;
95679 +#endif
95680 +
95681 /* We can't remap across vm area boundaries */
95682 if (old_len > vma->vm_end - addr)
95683 goto Efault;
95684 @@ -392,20 +410,25 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
95685 unsigned long ret = -EINVAL;
95686 unsigned long charged = 0;
95687 unsigned long map_flags;
95688 + unsigned long pax_task_size = TASK_SIZE;
95689
95690 if (new_addr & ~PAGE_MASK)
95691 goto out;
95692
95693 - if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
95694 +#ifdef CONFIG_PAX_SEGMEXEC
95695 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
95696 + pax_task_size = SEGMEXEC_TASK_SIZE;
95697 +#endif
95698 +
95699 + pax_task_size -= PAGE_SIZE;
95700 +
95701 + if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
95702 goto out;
95703
95704 /* Check if the location we're moving into overlaps the
95705 * old location at all, and fail if it does.
95706 */
95707 - if ((new_addr <= addr) && (new_addr+new_len) > addr)
95708 - goto out;
95709 -
95710 - if ((addr <= new_addr) && (addr+old_len) > new_addr)
95711 + if (addr + old_len > new_addr && new_addr + new_len > addr)
95712 goto out;
95713
95714 ret = do_munmap(mm, new_addr, new_len);
95715 @@ -474,6 +497,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
95716 unsigned long ret = -EINVAL;
95717 unsigned long charged = 0;
95718 bool locked = false;
95719 + unsigned long pax_task_size = TASK_SIZE;
95720
95721 if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
95722 return ret;
95723 @@ -495,6 +519,17 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
95724 if (!new_len)
95725 return ret;
95726
95727 +#ifdef CONFIG_PAX_SEGMEXEC
95728 + if (mm->pax_flags & MF_PAX_SEGMEXEC)
95729 + pax_task_size = SEGMEXEC_TASK_SIZE;
95730 +#endif
95731 +
95732 + pax_task_size -= PAGE_SIZE;
95733 +
95734 + if (new_len > pax_task_size || addr > pax_task_size-new_len ||
95735 + old_len > pax_task_size || addr > pax_task_size-old_len)
95736 + return ret;
95737 +
95738 down_write(&current->mm->mmap_sem);
95739
95740 if (flags & MREMAP_FIXED) {
95741 @@ -545,6 +580,7 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
95742 new_addr = addr;
95743 }
95744 ret = addr;
95745 + track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
95746 goto out;
95747 }
95748 }
95749 @@ -568,7 +604,12 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
95750 goto out;
95751 }
95752
95753 + map_flags = vma->vm_flags;
95754 ret = move_vma(vma, addr, old_len, new_len, new_addr, &locked);
95755 + if (!(ret & ~PAGE_MASK)) {
95756 + track_exec_limit(current->mm, addr, addr + old_len, 0UL);
95757 + track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
95758 + }
95759 }
95760 out:
95761 if (ret & ~PAGE_MASK)
95762 diff --git a/mm/nommu.c b/mm/nommu.c
95763 index 8740213..f87e25b 100644
95764 --- a/mm/nommu.c
95765 +++ b/mm/nommu.c
95766 @@ -65,7 +65,6 @@ int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
95767 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
95768 unsigned long sysctl_user_reserve_kbytes __read_mostly = 1UL << 17; /* 128MB */
95769 unsigned long sysctl_admin_reserve_kbytes __read_mostly = 1UL << 13; /* 8MB */
95770 -int heap_stack_gap = 0;
95771
95772 atomic_long_t mmap_pages_allocated;
95773
95774 @@ -845,15 +844,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
95775 EXPORT_SYMBOL(find_vma);
95776
95777 /*
95778 - * find a VMA
95779 - * - we don't extend stack VMAs under NOMMU conditions
95780 - */
95781 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
95782 -{
95783 - return find_vma(mm, addr);
95784 -}
95785 -
95786 -/*
95787 * expand a stack to a given address
95788 * - not supported under NOMMU conditions
95789 */
95790 @@ -1564,6 +1554,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
95791
95792 /* most fields are the same, copy all, and then fixup */
95793 *new = *vma;
95794 + INIT_LIST_HEAD(&new->anon_vma_chain);
95795 *region = *vma->vm_region;
95796 new->vm_region = region;
95797
95798 @@ -1993,8 +1984,8 @@ int generic_file_remap_pages(struct vm_area_struct *vma, unsigned long addr,
95799 }
95800 EXPORT_SYMBOL(generic_file_remap_pages);
95801
95802 -static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
95803 - unsigned long addr, void *buf, int len, int write)
95804 +static ssize_t __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
95805 + unsigned long addr, void *buf, size_t len, int write)
95806 {
95807 struct vm_area_struct *vma;
95808
95809 @@ -2035,8 +2026,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
95810 *
95811 * The caller must hold a reference on @mm.
95812 */
95813 -int access_remote_vm(struct mm_struct *mm, unsigned long addr,
95814 - void *buf, int len, int write)
95815 +ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
95816 + void *buf, size_t len, int write)
95817 {
95818 return __access_remote_vm(NULL, mm, addr, buf, len, write);
95819 }
95820 @@ -2045,7 +2036,7 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
95821 * Access another process' address space.
95822 * - source/target buffer must be kernel space
95823 */
95824 -int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)
95825 +ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, size_t len, int write)
95826 {
95827 struct mm_struct *mm;
95828
95829 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
95830 index 7106cb1..0805f48 100644
95831 --- a/mm/page-writeback.c
95832 +++ b/mm/page-writeback.c
95833 @@ -685,7 +685,7 @@ static inline long long pos_ratio_polynom(unsigned long setpoint,
95834 * card's bdi_dirty may rush to many times higher than bdi_setpoint.
95835 * - the bdi dirty thresh drops quickly due to change of JBOD workload
95836 */
95837 -static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
95838 +static unsigned long __intentional_overflow(-1) bdi_position_ratio(struct backing_dev_info *bdi,
95839 unsigned long thresh,
95840 unsigned long bg_thresh,
95841 unsigned long dirty,
95842 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
95843 index 7387a67..67105e4 100644
95844 --- a/mm/page_alloc.c
95845 +++ b/mm/page_alloc.c
95846 @@ -61,6 +61,7 @@
95847 #include <linux/page-debug-flags.h>
95848 #include <linux/hugetlb.h>
95849 #include <linux/sched/rt.h>
95850 +#include <linux/random.h>
95851
95852 #include <asm/sections.h>
95853 #include <asm/tlbflush.h>
95854 @@ -354,7 +355,7 @@ out:
95855 * This usage means that zero-order pages may not be compound.
95856 */
95857
95858 -static void free_compound_page(struct page *page)
95859 +void free_compound_page(struct page *page)
95860 {
95861 __free_pages_ok(page, compound_order(page));
95862 }
95863 @@ -728,6 +729,10 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
95864 int i;
95865 int bad = 0;
95866
95867 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
95868 + unsigned long index = 1UL << order;
95869 +#endif
95870 +
95871 trace_mm_page_free(page, order);
95872 kmemcheck_free_shadow(page, order);
95873
95874 @@ -744,6 +749,12 @@ static bool free_pages_prepare(struct page *page, unsigned int order)
95875 debug_check_no_obj_freed(page_address(page),
95876 PAGE_SIZE << order);
95877 }
95878 +
95879 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
95880 + for (; index; --index)
95881 + sanitize_highpage(page + index - 1);
95882 +#endif
95883 +
95884 arch_free_page(page, order);
95885 kernel_map_pages(page, 1 << order, 0);
95886
95887 @@ -766,6 +777,20 @@ static void __free_pages_ok(struct page *page, unsigned int order)
95888 local_irq_restore(flags);
95889 }
95890
95891 +#ifdef CONFIG_PAX_LATENT_ENTROPY
95892 +bool __meminitdata extra_latent_entropy;
95893 +
95894 +static int __init setup_pax_extra_latent_entropy(char *str)
95895 +{
95896 + extra_latent_entropy = true;
95897 + return 0;
95898 +}
95899 +early_param("pax_extra_latent_entropy", setup_pax_extra_latent_entropy);
95900 +
95901 +volatile u64 latent_entropy __latent_entropy;
95902 +EXPORT_SYMBOL(latent_entropy);
95903 +#endif
95904 +
95905 void __init __free_pages_bootmem(struct page *page, unsigned int order)
95906 {
95907 unsigned int nr_pages = 1 << order;
95908 @@ -781,6 +806,19 @@ void __init __free_pages_bootmem(struct page *page, unsigned int order)
95909 __ClearPageReserved(p);
95910 set_page_count(p, 0);
95911
95912 +#ifdef CONFIG_PAX_LATENT_ENTROPY
95913 + if (extra_latent_entropy && !PageHighMem(page) && page_to_pfn(page) < 0x100000) {
95914 + u64 hash = 0;
95915 + size_t index, end = PAGE_SIZE * nr_pages / sizeof hash;
95916 + const u64 *data = lowmem_page_address(page);
95917 +
95918 + for (index = 0; index < end; index++)
95919 + hash ^= hash + data[index];
95920 + latent_entropy ^= hash;
95921 + add_device_randomness((const void *)&latent_entropy, sizeof(latent_entropy));
95922 + }
95923 +#endif
95924 +
95925 page_zone(page)->managed_pages += nr_pages;
95926 set_page_refcounted(page);
95927 __free_pages(page, order);
95928 @@ -897,8 +935,10 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
95929 arch_alloc_page(page, order);
95930 kernel_map_pages(page, 1 << order, 1);
95931
95932 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
95933 if (gfp_flags & __GFP_ZERO)
95934 prep_zero_page(page, order, gfp_flags);
95935 +#endif
95936
95937 if (order && (gfp_flags & __GFP_COMP))
95938 prep_compound_page(page, order);
95939 @@ -2401,7 +2441,7 @@ static void reset_alloc_batches(struct zonelist *zonelist,
95940 continue;
95941 mod_zone_page_state(zone, NR_ALLOC_BATCH,
95942 high_wmark_pages(zone) - low_wmark_pages(zone) -
95943 - atomic_long_read(&zone->vm_stat[NR_ALLOC_BATCH]));
95944 + atomic_long_read_unchecked(&zone->vm_stat[NR_ALLOC_BATCH]));
95945 }
95946 }
95947
95948 @@ -6565,4 +6605,4 @@ void dump_page(struct page *page, char *reason)
95949 {
95950 dump_page_badflags(page, reason, 0);
95951 }
95952 -EXPORT_SYMBOL_GPL(dump_page);
95953 +EXPORT_SYMBOL(dump_page);
95954 diff --git a/mm/page_io.c b/mm/page_io.c
95955 index 7c59ef6..1358905 100644
95956 --- a/mm/page_io.c
95957 +++ b/mm/page_io.c
95958 @@ -260,7 +260,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
95959 struct file *swap_file = sis->swap_file;
95960 struct address_space *mapping = swap_file->f_mapping;
95961 struct iovec iov = {
95962 - .iov_base = kmap(page),
95963 + .iov_base = (void __force_user *)kmap(page),
95964 .iov_len = PAGE_SIZE,
95965 };
95966
95967 diff --git a/mm/percpu.c b/mm/percpu.c
95968 index 036cfe0..980d0fa 100644
95969 --- a/mm/percpu.c
95970 +++ b/mm/percpu.c
95971 @@ -122,7 +122,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
95972 static unsigned int pcpu_high_unit_cpu __read_mostly;
95973
95974 /* the address of the first chunk which starts with the kernel static area */
95975 -void *pcpu_base_addr __read_mostly;
95976 +void *pcpu_base_addr __read_only;
95977 EXPORT_SYMBOL_GPL(pcpu_base_addr);
95978
95979 static const int *pcpu_unit_map __read_mostly; /* cpu -> unit */
95980 diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c
95981 index fd26d04..0cea1b0 100644
95982 --- a/mm/process_vm_access.c
95983 +++ b/mm/process_vm_access.c
95984 @@ -13,6 +13,7 @@
95985 #include <linux/uio.h>
95986 #include <linux/sched.h>
95987 #include <linux/highmem.h>
95988 +#include <linux/security.h>
95989 #include <linux/ptrace.h>
95990 #include <linux/slab.h>
95991 #include <linux/syscalls.h>
95992 @@ -258,19 +259,19 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
95993 size_t iov_l_curr_offset = 0;
95994 ssize_t iov_len;
95995
95996 + return -ENOSYS; // PaX: until properly audited
95997 +
95998 /*
95999 * Work out how many pages of struct pages we're going to need
96000 * when eventually calling get_user_pages
96001 */
96002 for (i = 0; i < riovcnt; i++) {
96003 iov_len = rvec[i].iov_len;
96004 - if (iov_len > 0) {
96005 - nr_pages_iov = ((unsigned long)rvec[i].iov_base
96006 - + iov_len)
96007 - / PAGE_SIZE - (unsigned long)rvec[i].iov_base
96008 - / PAGE_SIZE + 1;
96009 - nr_pages = max(nr_pages, nr_pages_iov);
96010 - }
96011 + if (iov_len <= 0)
96012 + continue;
96013 + nr_pages_iov = ((unsigned long)rvec[i].iov_base + iov_len) / PAGE_SIZE -
96014 + (unsigned long)rvec[i].iov_base / PAGE_SIZE + 1;
96015 + nr_pages = max(nr_pages, nr_pages_iov);
96016 }
96017
96018 if (nr_pages == 0)
96019 @@ -298,6 +299,11 @@ static ssize_t process_vm_rw_core(pid_t pid, const struct iovec *lvec,
96020 goto free_proc_pages;
96021 }
96022
96023 + if (gr_handle_ptrace(task, vm_write ? PTRACE_POKETEXT : PTRACE_ATTACH)) {
96024 + rc = -EPERM;
96025 + goto put_task_struct;
96026 + }
96027 +
96028 mm = mm_access(task, PTRACE_MODE_ATTACH);
96029 if (!mm || IS_ERR(mm)) {
96030 rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
96031 diff --git a/mm/rmap.c b/mm/rmap.c
96032 index d3cbac5..0788da4 100644
96033 --- a/mm/rmap.c
96034 +++ b/mm/rmap.c
96035 @@ -163,6 +163,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
96036 struct anon_vma *anon_vma = vma->anon_vma;
96037 struct anon_vma_chain *avc;
96038
96039 +#ifdef CONFIG_PAX_SEGMEXEC
96040 + struct anon_vma_chain *avc_m = NULL;
96041 +#endif
96042 +
96043 might_sleep();
96044 if (unlikely(!anon_vma)) {
96045 struct mm_struct *mm = vma->vm_mm;
96046 @@ -172,6 +176,12 @@ int anon_vma_prepare(struct vm_area_struct *vma)
96047 if (!avc)
96048 goto out_enomem;
96049
96050 +#ifdef CONFIG_PAX_SEGMEXEC
96051 + avc_m = anon_vma_chain_alloc(GFP_KERNEL);
96052 + if (!avc_m)
96053 + goto out_enomem_free_avc;
96054 +#endif
96055 +
96056 anon_vma = find_mergeable_anon_vma(vma);
96057 allocated = NULL;
96058 if (!anon_vma) {
96059 @@ -185,6 +195,18 @@ int anon_vma_prepare(struct vm_area_struct *vma)
96060 /* page_table_lock to protect against threads */
96061 spin_lock(&mm->page_table_lock);
96062 if (likely(!vma->anon_vma)) {
96063 +
96064 +#ifdef CONFIG_PAX_SEGMEXEC
96065 + struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
96066 +
96067 + if (vma_m) {
96068 + BUG_ON(vma_m->anon_vma);
96069 + vma_m->anon_vma = anon_vma;
96070 + anon_vma_chain_link(vma_m, avc_m, anon_vma);
96071 + avc_m = NULL;
96072 + }
96073 +#endif
96074 +
96075 vma->anon_vma = anon_vma;
96076 anon_vma_chain_link(vma, avc, anon_vma);
96077 allocated = NULL;
96078 @@ -195,12 +217,24 @@ int anon_vma_prepare(struct vm_area_struct *vma)
96079
96080 if (unlikely(allocated))
96081 put_anon_vma(allocated);
96082 +
96083 +#ifdef CONFIG_PAX_SEGMEXEC
96084 + if (unlikely(avc_m))
96085 + anon_vma_chain_free(avc_m);
96086 +#endif
96087 +
96088 if (unlikely(avc))
96089 anon_vma_chain_free(avc);
96090 }
96091 return 0;
96092
96093 out_enomem_free_avc:
96094 +
96095 +#ifdef CONFIG_PAX_SEGMEXEC
96096 + if (avc_m)
96097 + anon_vma_chain_free(avc_m);
96098 +#endif
96099 +
96100 anon_vma_chain_free(avc);
96101 out_enomem:
96102 return -ENOMEM;
96103 @@ -236,7 +270,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
96104 * Attach the anon_vmas from src to dst.
96105 * Returns 0 on success, -ENOMEM on failure.
96106 */
96107 -int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
96108 +int anon_vma_clone(struct vm_area_struct *dst, const struct vm_area_struct *src)
96109 {
96110 struct anon_vma_chain *avc, *pavc;
96111 struct anon_vma *root = NULL;
96112 @@ -269,7 +303,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
96113 * the corresponding VMA in the parent process is attached to.
96114 * Returns 0 on success, non-zero on failure.
96115 */
96116 -int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
96117 +int anon_vma_fork(struct vm_area_struct *vma, const struct vm_area_struct *pvma)
96118 {
96119 struct anon_vma_chain *avc;
96120 struct anon_vma *anon_vma;
96121 @@ -373,8 +407,10 @@ static void anon_vma_ctor(void *data)
96122 void __init anon_vma_init(void)
96123 {
96124 anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
96125 - 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC, anon_vma_ctor);
96126 - anon_vma_chain_cachep = KMEM_CACHE(anon_vma_chain, SLAB_PANIC);
96127 + 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC|SLAB_NO_SANITIZE,
96128 + anon_vma_ctor);
96129 + anon_vma_chain_cachep = KMEM_CACHE(anon_vma_chain,
96130 + SLAB_PANIC|SLAB_NO_SANITIZE);
96131 }
96132
96133 /*
96134 diff --git a/mm/shmem.c b/mm/shmem.c
96135 index 1f18c9d..3e03d33 100644
96136 --- a/mm/shmem.c
96137 +++ b/mm/shmem.c
96138 @@ -33,7 +33,7 @@
96139 #include <linux/swap.h>
96140 #include <linux/aio.h>
96141
96142 -static struct vfsmount *shm_mnt;
96143 +struct vfsmount *shm_mnt;
96144
96145 #ifdef CONFIG_SHMEM
96146 /*
96147 @@ -77,7 +77,7 @@ static struct vfsmount *shm_mnt;
96148 #define BOGO_DIRENT_SIZE 20
96149
96150 /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
96151 -#define SHORT_SYMLINK_LEN 128
96152 +#define SHORT_SYMLINK_LEN 64
96153
96154 /*
96155 * shmem_fallocate and shmem_writepage communicate via inode->i_private
96156 @@ -2218,6 +2218,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
96157 static int shmem_xattr_validate(const char *name)
96158 {
96159 struct { const char *prefix; size_t len; } arr[] = {
96160 +
96161 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
96162 + { XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN},
96163 +#endif
96164 +
96165 { XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
96166 { XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
96167 };
96168 @@ -2273,6 +2278,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
96169 if (err)
96170 return err;
96171
96172 +#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
96173 + if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
96174 + if (strcmp(name, XATTR_NAME_PAX_FLAGS))
96175 + return -EOPNOTSUPP;
96176 + if (size > 8)
96177 + return -EINVAL;
96178 + }
96179 +#endif
96180 +
96181 return simple_xattr_set(&info->xattrs, name, value, size, flags);
96182 }
96183
96184 @@ -2585,8 +2599,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
96185 int err = -ENOMEM;
96186
96187 /* Round up to L1_CACHE_BYTES to resist false sharing */
96188 - sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
96189 - L1_CACHE_BYTES), GFP_KERNEL);
96190 + sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
96191 if (!sbinfo)
96192 return -ENOMEM;
96193
96194 diff --git a/mm/slab.c b/mm/slab.c
96195 index b264214..83872cd 100644
96196 --- a/mm/slab.c
96197 +++ b/mm/slab.c
96198 @@ -300,10 +300,12 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
96199 if ((x)->max_freeable < i) \
96200 (x)->max_freeable = i; \
96201 } while (0)
96202 -#define STATS_INC_ALLOCHIT(x) atomic_inc(&(x)->allochit)
96203 -#define STATS_INC_ALLOCMISS(x) atomic_inc(&(x)->allocmiss)
96204 -#define STATS_INC_FREEHIT(x) atomic_inc(&(x)->freehit)
96205 -#define STATS_INC_FREEMISS(x) atomic_inc(&(x)->freemiss)
96206 +#define STATS_INC_ALLOCHIT(x) atomic_inc_unchecked(&(x)->allochit)
96207 +#define STATS_INC_ALLOCMISS(x) atomic_inc_unchecked(&(x)->allocmiss)
96208 +#define STATS_INC_FREEHIT(x) atomic_inc_unchecked(&(x)->freehit)
96209 +#define STATS_INC_FREEMISS(x) atomic_inc_unchecked(&(x)->freemiss)
96210 +#define STATS_INC_SANITIZED(x) atomic_inc_unchecked(&(x)->sanitized)
96211 +#define STATS_INC_NOT_SANITIZED(x) atomic_inc_unchecked(&(x)->not_sanitized)
96212 #else
96213 #define STATS_INC_ACTIVE(x) do { } while (0)
96214 #define STATS_DEC_ACTIVE(x) do { } while (0)
96215 @@ -320,6 +322,8 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
96216 #define STATS_INC_ALLOCMISS(x) do { } while (0)
96217 #define STATS_INC_FREEHIT(x) do { } while (0)
96218 #define STATS_INC_FREEMISS(x) do { } while (0)
96219 +#define STATS_INC_SANITIZED(x) do { } while (0)
96220 +#define STATS_INC_NOT_SANITIZED(x) do { } while (0)
96221 #endif
96222
96223 #if DEBUG
96224 @@ -403,7 +407,7 @@ static inline void *index_to_obj(struct kmem_cache *cache, struct page *page,
96225 * reciprocal_divide(offset, cache->reciprocal_buffer_size)
96226 */
96227 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
96228 - const struct page *page, void *obj)
96229 + const struct page *page, const void *obj)
96230 {
96231 u32 offset = (obj - page->s_mem);
96232 return reciprocal_divide(offset, cache->reciprocal_buffer_size);
96233 @@ -1489,12 +1493,12 @@ void __init kmem_cache_init(void)
96234 */
96235
96236 kmalloc_caches[INDEX_AC] = create_kmalloc_cache("kmalloc-ac",
96237 - kmalloc_size(INDEX_AC), ARCH_KMALLOC_FLAGS);
96238 + kmalloc_size(INDEX_AC), SLAB_USERCOPY | ARCH_KMALLOC_FLAGS);
96239
96240 if (INDEX_AC != INDEX_NODE)
96241 kmalloc_caches[INDEX_NODE] =
96242 create_kmalloc_cache("kmalloc-node",
96243 - kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS);
96244 + kmalloc_size(INDEX_NODE), SLAB_USERCOPY | ARCH_KMALLOC_FLAGS);
96245
96246 slab_early_init = 0;
96247
96248 @@ -3428,6 +3432,21 @@ static inline void __cache_free(struct kmem_cache *cachep, void *objp,
96249 struct array_cache *ac = cpu_cache_get(cachep);
96250
96251 check_irq_off();
96252 +
96253 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96254 + if (pax_sanitize_slab) {
96255 + if (!(cachep->flags & (SLAB_POISON | SLAB_NO_SANITIZE))) {
96256 + memset(objp, PAX_MEMORY_SANITIZE_VALUE, cachep->object_size);
96257 +
96258 + if (cachep->ctor)
96259 + cachep->ctor(objp);
96260 +
96261 + STATS_INC_SANITIZED(cachep);
96262 + } else
96263 + STATS_INC_NOT_SANITIZED(cachep);
96264 + }
96265 +#endif
96266 +
96267 kmemleak_free_recursive(objp, cachep->flags);
96268 objp = cache_free_debugcheck(cachep, objp, caller);
96269
96270 @@ -3656,6 +3675,7 @@ void kfree(const void *objp)
96271
96272 if (unlikely(ZERO_OR_NULL_PTR(objp)))
96273 return;
96274 + VM_BUG_ON(!virt_addr_valid(objp));
96275 local_irq_save(flags);
96276 kfree_debugcheck(objp);
96277 c = virt_to_cache(objp);
96278 @@ -4097,14 +4117,22 @@ void slabinfo_show_stats(struct seq_file *m, struct kmem_cache *cachep)
96279 }
96280 /* cpu stats */
96281 {
96282 - unsigned long allochit = atomic_read(&cachep->allochit);
96283 - unsigned long allocmiss = atomic_read(&cachep->allocmiss);
96284 - unsigned long freehit = atomic_read(&cachep->freehit);
96285 - unsigned long freemiss = atomic_read(&cachep->freemiss);
96286 + unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
96287 + unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
96288 + unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
96289 + unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
96290
96291 seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
96292 allochit, allocmiss, freehit, freemiss);
96293 }
96294 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96295 + {
96296 + unsigned long sanitized = atomic_read_unchecked(&cachep->sanitized);
96297 + unsigned long not_sanitized = atomic_read_unchecked(&cachep->not_sanitized);
96298 +
96299 + seq_printf(m, " : pax %6lu %6lu", sanitized, not_sanitized);
96300 + }
96301 +#endif
96302 #endif
96303 }
96304
96305 @@ -4334,13 +4362,69 @@ static const struct file_operations proc_slabstats_operations = {
96306 static int __init slab_proc_init(void)
96307 {
96308 #ifdef CONFIG_DEBUG_SLAB_LEAK
96309 - proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
96310 + proc_create("slab_allocators", S_IRUSR, NULL, &proc_slabstats_operations);
96311 #endif
96312 return 0;
96313 }
96314 module_init(slab_proc_init);
96315 #endif
96316
96317 +bool is_usercopy_object(const void *ptr)
96318 +{
96319 + struct page *page;
96320 + struct kmem_cache *cachep;
96321 +
96322 + if (ZERO_OR_NULL_PTR(ptr))
96323 + return false;
96324 +
96325 + if (!slab_is_available())
96326 + return false;
96327 +
96328 + if (!virt_addr_valid(ptr))
96329 + return false;
96330 +
96331 + page = virt_to_head_page(ptr);
96332 +
96333 + if (!PageSlab(page))
96334 + return false;
96335 +
96336 + cachep = page->slab_cache;
96337 + return cachep->flags & SLAB_USERCOPY;
96338 +}
96339 +
96340 +#ifdef CONFIG_PAX_USERCOPY
96341 +const char *check_heap_object(const void *ptr, unsigned long n)
96342 +{
96343 + struct page *page;
96344 + struct kmem_cache *cachep;
96345 + unsigned int objnr;
96346 + unsigned long offset;
96347 +
96348 + if (ZERO_OR_NULL_PTR(ptr))
96349 + return "<null>";
96350 +
96351 + if (!virt_addr_valid(ptr))
96352 + return NULL;
96353 +
96354 + page = virt_to_head_page(ptr);
96355 +
96356 + if (!PageSlab(page))
96357 + return NULL;
96358 +
96359 + cachep = page->slab_cache;
96360 + if (!(cachep->flags & SLAB_USERCOPY))
96361 + return cachep->name;
96362 +
96363 + objnr = obj_to_index(cachep, page, ptr);
96364 + BUG_ON(objnr >= cachep->num);
96365 + offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
96366 + if (offset <= cachep->object_size && n <= cachep->object_size - offset)
96367 + return NULL;
96368 +
96369 + return cachep->name;
96370 +}
96371 +#endif
96372 +
96373 /**
96374 * ksize - get the actual amount of memory allocated for a given object
96375 * @objp: Pointer to the object
96376 diff --git a/mm/slab.h b/mm/slab.h
96377 index 8184a7c..ab27737 100644
96378 --- a/mm/slab.h
96379 +++ b/mm/slab.h
96380 @@ -32,6 +32,15 @@ extern struct list_head slab_caches;
96381 /* The slab cache that manages slab cache information */
96382 extern struct kmem_cache *kmem_cache;
96383
96384 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96385 +#ifdef CONFIG_X86_64
96386 +#define PAX_MEMORY_SANITIZE_VALUE '\xfe'
96387 +#else
96388 +#define PAX_MEMORY_SANITIZE_VALUE '\xff'
96389 +#endif
96390 +extern bool pax_sanitize_slab;
96391 +#endif
96392 +
96393 unsigned long calculate_alignment(unsigned long flags,
96394 unsigned long align, unsigned long size);
96395
96396 @@ -67,7 +76,8 @@ __kmem_cache_alias(struct mem_cgroup *memcg, const char *name, size_t size,
96397
96398 /* Legal flag mask for kmem_cache_create(), for various configurations */
96399 #define SLAB_CORE_FLAGS (SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA | SLAB_PANIC | \
96400 - SLAB_DESTROY_BY_RCU | SLAB_DEBUG_OBJECTS )
96401 + SLAB_DESTROY_BY_RCU | SLAB_DEBUG_OBJECTS | \
96402 + SLAB_USERCOPY | SLAB_NO_SANITIZE)
96403
96404 #if defined(CONFIG_DEBUG_SLAB)
96405 #define SLAB_DEBUG_FLAGS (SLAB_RED_ZONE | SLAB_POISON | SLAB_STORE_USER)
96406 @@ -257,6 +267,9 @@ static inline struct kmem_cache *cache_from_obj(struct kmem_cache *s, void *x)
96407 return s;
96408
96409 page = virt_to_head_page(x);
96410 +
96411 + BUG_ON(!PageSlab(page));
96412 +
96413 cachep = page->slab_cache;
96414 if (slab_equal_or_root(cachep, s))
96415 return cachep;
96416 diff --git a/mm/slab_common.c b/mm/slab_common.c
96417 index 1ec3c61..2067c11 100644
96418 --- a/mm/slab_common.c
96419 +++ b/mm/slab_common.c
96420 @@ -23,11 +23,22 @@
96421
96422 #include "slab.h"
96423
96424 -enum slab_state slab_state;
96425 +enum slab_state slab_state __read_only;
96426 LIST_HEAD(slab_caches);
96427 DEFINE_MUTEX(slab_mutex);
96428 struct kmem_cache *kmem_cache;
96429
96430 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96431 +bool pax_sanitize_slab __read_only = true;
96432 +static int __init pax_sanitize_slab_setup(char *str)
96433 +{
96434 + pax_sanitize_slab = !!simple_strtol(str, NULL, 0);
96435 + printk("%sabled PaX slab sanitization\n", pax_sanitize_slab ? "En" : "Dis");
96436 + return 1;
96437 +}
96438 +__setup("pax_sanitize_slab=", pax_sanitize_slab_setup);
96439 +#endif
96440 +
96441 #ifdef CONFIG_DEBUG_VM
96442 static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name,
96443 size_t size)
96444 @@ -225,7 +236,7 @@ kmem_cache_create_memcg(struct mem_cgroup *memcg, const char *name, size_t size,
96445 if (err)
96446 goto out_free_cache;
96447
96448 - s->refcount = 1;
96449 + atomic_set(&s->refcount, 1);
96450 list_add(&s->list, &slab_caches);
96451 memcg_register_cache(s);
96452
96453 @@ -278,8 +289,7 @@ void kmem_cache_destroy(struct kmem_cache *s)
96454
96455 get_online_cpus();
96456 mutex_lock(&slab_mutex);
96457 - s->refcount--;
96458 - if (!s->refcount) {
96459 + if (atomic_dec_and_test(&s->refcount)) {
96460 list_del(&s->list);
96461
96462 if (!__kmem_cache_shutdown(s)) {
96463 @@ -326,7 +336,7 @@ void __init create_boot_cache(struct kmem_cache *s, const char *name, size_t siz
96464 panic("Creation of kmalloc slab %s size=%zu failed. Reason %d\n",
96465 name, size, err);
96466
96467 - s->refcount = -1; /* Exempt from merging for now */
96468 + atomic_set(&s->refcount, -1); /* Exempt from merging for now */
96469 }
96470
96471 struct kmem_cache *__init create_kmalloc_cache(const char *name, size_t size,
96472 @@ -339,7 +349,7 @@ struct kmem_cache *__init create_kmalloc_cache(const char *name, size_t size,
96473
96474 create_boot_cache(s, name, size, flags);
96475 list_add(&s->list, &slab_caches);
96476 - s->refcount = 1;
96477 + atomic_set(&s->refcount, 1);
96478 return s;
96479 }
96480
96481 @@ -351,6 +361,11 @@ struct kmem_cache *kmalloc_dma_caches[KMALLOC_SHIFT_HIGH + 1];
96482 EXPORT_SYMBOL(kmalloc_dma_caches);
96483 #endif
96484
96485 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96486 +struct kmem_cache *kmalloc_usercopy_caches[KMALLOC_SHIFT_HIGH + 1];
96487 +EXPORT_SYMBOL(kmalloc_usercopy_caches);
96488 +#endif
96489 +
96490 /*
96491 * Conversion table for small slabs sizes / 8 to the index in the
96492 * kmalloc array. This is necessary for slabs < 192 since we have non power
96493 @@ -415,6 +430,13 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)
96494 return kmalloc_dma_caches[index];
96495
96496 #endif
96497 +
96498 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96499 + if (unlikely((flags & GFP_USERCOPY)))
96500 + return kmalloc_usercopy_caches[index];
96501 +
96502 +#endif
96503 +
96504 return kmalloc_caches[index];
96505 }
96506
96507 @@ -471,7 +493,7 @@ void __init create_kmalloc_caches(unsigned long flags)
96508 for (i = KMALLOC_SHIFT_LOW; i <= KMALLOC_SHIFT_HIGH; i++) {
96509 if (!kmalloc_caches[i]) {
96510 kmalloc_caches[i] = create_kmalloc_cache(NULL,
96511 - 1 << i, flags);
96512 + 1 << i, SLAB_USERCOPY | flags);
96513 }
96514
96515 /*
96516 @@ -480,10 +502,10 @@ void __init create_kmalloc_caches(unsigned long flags)
96517 * earlier power of two caches
96518 */
96519 if (KMALLOC_MIN_SIZE <= 32 && !kmalloc_caches[1] && i == 6)
96520 - kmalloc_caches[1] = create_kmalloc_cache(NULL, 96, flags);
96521 + kmalloc_caches[1] = create_kmalloc_cache(NULL, 96, SLAB_USERCOPY | flags);
96522
96523 if (KMALLOC_MIN_SIZE <= 64 && !kmalloc_caches[2] && i == 7)
96524 - kmalloc_caches[2] = create_kmalloc_cache(NULL, 192, flags);
96525 + kmalloc_caches[2] = create_kmalloc_cache(NULL, 192, SLAB_USERCOPY | flags);
96526 }
96527
96528 /* Kmalloc array is now usable */
96529 @@ -516,6 +538,23 @@ void __init create_kmalloc_caches(unsigned long flags)
96530 }
96531 }
96532 #endif
96533 +
96534 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96535 + for (i = 0; i <= KMALLOC_SHIFT_HIGH; i++) {
96536 + struct kmem_cache *s = kmalloc_caches[i];
96537 +
96538 + if (s) {
96539 + int size = kmalloc_size(i);
96540 + char *n = kasprintf(GFP_NOWAIT,
96541 + "usercopy-kmalloc-%d", size);
96542 +
96543 + BUG_ON(!n);
96544 + kmalloc_usercopy_caches[i] = create_kmalloc_cache(n,
96545 + size, SLAB_USERCOPY | flags);
96546 + }
96547 + }
96548 +#endif
96549 +
96550 }
96551 #endif /* !CONFIG_SLOB */
96552
96553 @@ -556,6 +595,9 @@ void print_slabinfo_header(struct seq_file *m)
96554 seq_puts(m, " : globalstat <listallocs> <maxobjs> <grown> <reaped> "
96555 "<error> <maxfreeable> <nodeallocs> <remotefrees> <alienoverflow>");
96556 seq_puts(m, " : cpustat <allochit> <allocmiss> <freehit> <freemiss>");
96557 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96558 + seq_puts(m, " : pax <sanitized> <not_sanitized>");
96559 +#endif
96560 #endif
96561 seq_putc(m, '\n');
96562 }
96563 diff --git a/mm/slob.c b/mm/slob.c
96564 index 4bf8809..98a6914 100644
96565 --- a/mm/slob.c
96566 +++ b/mm/slob.c
96567 @@ -157,7 +157,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
96568 /*
96569 * Return the size of a slob block.
96570 */
96571 -static slobidx_t slob_units(slob_t *s)
96572 +static slobidx_t slob_units(const slob_t *s)
96573 {
96574 if (s->units > 0)
96575 return s->units;
96576 @@ -167,7 +167,7 @@ static slobidx_t slob_units(slob_t *s)
96577 /*
96578 * Return the next free slob block pointer after this one.
96579 */
96580 -static slob_t *slob_next(slob_t *s)
96581 +static slob_t *slob_next(const slob_t *s)
96582 {
96583 slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
96584 slobidx_t next;
96585 @@ -182,14 +182,14 @@ static slob_t *slob_next(slob_t *s)
96586 /*
96587 * Returns true if s is the last free block in its page.
96588 */
96589 -static int slob_last(slob_t *s)
96590 +static int slob_last(const slob_t *s)
96591 {
96592 return !((unsigned long)slob_next(s) & ~PAGE_MASK);
96593 }
96594
96595 -static void *slob_new_pages(gfp_t gfp, int order, int node)
96596 +static struct page *slob_new_pages(gfp_t gfp, unsigned int order, int node)
96597 {
96598 - void *page;
96599 + struct page *page;
96600
96601 #ifdef CONFIG_NUMA
96602 if (node != NUMA_NO_NODE)
96603 @@ -201,14 +201,18 @@ static void *slob_new_pages(gfp_t gfp, int order, int node)
96604 if (!page)
96605 return NULL;
96606
96607 - return page_address(page);
96608 + __SetPageSlab(page);
96609 + return page;
96610 }
96611
96612 -static void slob_free_pages(void *b, int order)
96613 +static void slob_free_pages(struct page *sp, int order)
96614 {
96615 if (current->reclaim_state)
96616 current->reclaim_state->reclaimed_slab += 1 << order;
96617 - free_pages((unsigned long)b, order);
96618 + __ClearPageSlab(sp);
96619 + page_mapcount_reset(sp);
96620 + sp->private = 0;
96621 + __free_pages(sp, order);
96622 }
96623
96624 /*
96625 @@ -313,15 +317,15 @@ static void *slob_alloc(size_t size, gfp_t gfp, int align, int node)
96626
96627 /* Not enough space: must allocate a new page */
96628 if (!b) {
96629 - b = slob_new_pages(gfp & ~__GFP_ZERO, 0, node);
96630 - if (!b)
96631 + sp = slob_new_pages(gfp & ~__GFP_ZERO, 0, node);
96632 + if (!sp)
96633 return NULL;
96634 - sp = virt_to_page(b);
96635 - __SetPageSlab(sp);
96636 + b = page_address(sp);
96637
96638 spin_lock_irqsave(&slob_lock, flags);
96639 sp->units = SLOB_UNITS(PAGE_SIZE);
96640 sp->freelist = b;
96641 + sp->private = 0;
96642 INIT_LIST_HEAD(&sp->list);
96643 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
96644 set_slob_page_free(sp, slob_list);
96645 @@ -359,12 +363,15 @@ static void slob_free(void *block, int size)
96646 if (slob_page_free(sp))
96647 clear_slob_page_free(sp);
96648 spin_unlock_irqrestore(&slob_lock, flags);
96649 - __ClearPageSlab(sp);
96650 - page_mapcount_reset(sp);
96651 - slob_free_pages(b, 0);
96652 + slob_free_pages(sp, 0);
96653 return;
96654 }
96655
96656 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96657 + if (pax_sanitize_slab)
96658 + memset(block, PAX_MEMORY_SANITIZE_VALUE, size);
96659 +#endif
96660 +
96661 if (!slob_page_free(sp)) {
96662 /* This slob page is about to become partially free. Easy! */
96663 sp->units = units;
96664 @@ -424,11 +431,10 @@ out:
96665 */
96666
96667 static __always_inline void *
96668 -__do_kmalloc_node(size_t size, gfp_t gfp, int node, unsigned long caller)
96669 +__do_kmalloc_node_align(size_t size, gfp_t gfp, int node, unsigned long caller, int align)
96670 {
96671 - unsigned int *m;
96672 - int align = max_t(size_t, ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
96673 - void *ret;
96674 + slob_t *m;
96675 + void *ret = NULL;
96676
96677 gfp &= gfp_allowed_mask;
96678
96679 @@ -442,23 +448,41 @@ __do_kmalloc_node(size_t size, gfp_t gfp, int node, unsigned long caller)
96680
96681 if (!m)
96682 return NULL;
96683 - *m = size;
96684 + BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
96685 + BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
96686 + m[0].units = size;
96687 + m[1].units = align;
96688 ret = (void *)m + align;
96689
96690 trace_kmalloc_node(caller, ret,
96691 size, size + align, gfp, node);
96692 } else {
96693 unsigned int order = get_order(size);
96694 + struct page *page;
96695
96696 if (likely(order))
96697 gfp |= __GFP_COMP;
96698 - ret = slob_new_pages(gfp, order, node);
96699 + page = slob_new_pages(gfp, order, node);
96700 + if (page) {
96701 + ret = page_address(page);
96702 + page->private = size;
96703 + }
96704
96705 trace_kmalloc_node(caller, ret,
96706 size, PAGE_SIZE << order, gfp, node);
96707 }
96708
96709 - kmemleak_alloc(ret, size, 1, gfp);
96710 + return ret;
96711 +}
96712 +
96713 +static __always_inline void *
96714 +__do_kmalloc_node(size_t size, gfp_t gfp, int node, unsigned long caller)
96715 +{
96716 + int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
96717 + void *ret = __do_kmalloc_node_align(size, gfp, node, caller, align);
96718 +
96719 + if (!ZERO_OR_NULL_PTR(ret))
96720 + kmemleak_alloc(ret, size, 1, gfp);
96721 return ret;
96722 }
96723
96724 @@ -493,34 +517,112 @@ void kfree(const void *block)
96725 return;
96726 kmemleak_free(block);
96727
96728 + VM_BUG_ON(!virt_addr_valid(block));
96729 sp = virt_to_page(block);
96730 - if (PageSlab(sp)) {
96731 + VM_BUG_ON(!PageSlab(sp));
96732 + if (!sp->private) {
96733 int align = max_t(size_t, ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
96734 - unsigned int *m = (unsigned int *)(block - align);
96735 - slob_free(m, *m + align);
96736 - } else
96737 + slob_t *m = (slob_t *)(block - align);
96738 + slob_free(m, m[0].units + align);
96739 + } else {
96740 + __ClearPageSlab(sp);
96741 + page_mapcount_reset(sp);
96742 + sp->private = 0;
96743 __free_pages(sp, compound_order(sp));
96744 + }
96745 }
96746 EXPORT_SYMBOL(kfree);
96747
96748 +bool is_usercopy_object(const void *ptr)
96749 +{
96750 + if (!slab_is_available())
96751 + return false;
96752 +
96753 + // PAX: TODO
96754 +
96755 + return false;
96756 +}
96757 +
96758 +#ifdef CONFIG_PAX_USERCOPY
96759 +const char *check_heap_object(const void *ptr, unsigned long n)
96760 +{
96761 + struct page *page;
96762 + const slob_t *free;
96763 + const void *base;
96764 + unsigned long flags;
96765 +
96766 + if (ZERO_OR_NULL_PTR(ptr))
96767 + return "<null>";
96768 +
96769 + if (!virt_addr_valid(ptr))
96770 + return NULL;
96771 +
96772 + page = virt_to_head_page(ptr);
96773 + if (!PageSlab(page))
96774 + return NULL;
96775 +
96776 + if (page->private) {
96777 + base = page;
96778 + if (base <= ptr && n <= page->private - (ptr - base))
96779 + return NULL;
96780 + return "<slob>";
96781 + }
96782 +
96783 + /* some tricky double walking to find the chunk */
96784 + spin_lock_irqsave(&slob_lock, flags);
96785 + base = (void *)((unsigned long)ptr & PAGE_MASK);
96786 + free = page->freelist;
96787 +
96788 + while (!slob_last(free) && (void *)free <= ptr) {
96789 + base = free + slob_units(free);
96790 + free = slob_next(free);
96791 + }
96792 +
96793 + while (base < (void *)free) {
96794 + slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
96795 + int size = SLOB_UNIT * SLOB_UNITS(m + align);
96796 + int offset;
96797 +
96798 + if (ptr < base + align)
96799 + break;
96800 +
96801 + offset = ptr - base - align;
96802 + if (offset >= m) {
96803 + base += size;
96804 + continue;
96805 + }
96806 +
96807 + if (n > m - offset)
96808 + break;
96809 +
96810 + spin_unlock_irqrestore(&slob_lock, flags);
96811 + return NULL;
96812 + }
96813 +
96814 + spin_unlock_irqrestore(&slob_lock, flags);
96815 + return "<slob>";
96816 +}
96817 +#endif
96818 +
96819 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
96820 size_t ksize(const void *block)
96821 {
96822 struct page *sp;
96823 int align;
96824 - unsigned int *m;
96825 + slob_t *m;
96826
96827 BUG_ON(!block);
96828 if (unlikely(block == ZERO_SIZE_PTR))
96829 return 0;
96830
96831 sp = virt_to_page(block);
96832 - if (unlikely(!PageSlab(sp)))
96833 - return PAGE_SIZE << compound_order(sp);
96834 + VM_BUG_ON(!PageSlab(sp));
96835 + if (sp->private)
96836 + return sp->private;
96837
96838 align = max_t(size_t, ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
96839 - m = (unsigned int *)(block - align);
96840 - return SLOB_UNITS(*m) * SLOB_UNIT;
96841 + m = (slob_t *)(block - align);
96842 + return SLOB_UNITS(m[0].units) * SLOB_UNIT;
96843 }
96844 EXPORT_SYMBOL(ksize);
96845
96846 @@ -536,23 +638,33 @@ int __kmem_cache_create(struct kmem_cache *c, unsigned long flags)
96847
96848 void *slob_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
96849 {
96850 - void *b;
96851 + void *b = NULL;
96852
96853 flags &= gfp_allowed_mask;
96854
96855 lockdep_trace_alloc(flags);
96856
96857 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96858 + b = __do_kmalloc_node_align(c->size, flags, node, _RET_IP_, c->align);
96859 +#else
96860 if (c->size < PAGE_SIZE) {
96861 b = slob_alloc(c->size, flags, c->align, node);
96862 trace_kmem_cache_alloc_node(_RET_IP_, b, c->object_size,
96863 SLOB_UNITS(c->size) * SLOB_UNIT,
96864 flags, node);
96865 } else {
96866 - b = slob_new_pages(flags, get_order(c->size), node);
96867 + struct page *sp;
96868 +
96869 + sp = slob_new_pages(flags, get_order(c->size), node);
96870 + if (sp) {
96871 + b = page_address(sp);
96872 + sp->private = c->size;
96873 + }
96874 trace_kmem_cache_alloc_node(_RET_IP_, b, c->object_size,
96875 PAGE_SIZE << get_order(c->size),
96876 flags, node);
96877 }
96878 +#endif
96879
96880 if (b && c->ctor)
96881 c->ctor(b);
96882 @@ -584,10 +696,14 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
96883
96884 static void __kmem_cache_free(void *b, int size)
96885 {
96886 - if (size < PAGE_SIZE)
96887 + struct page *sp;
96888 +
96889 + sp = virt_to_page(b);
96890 + BUG_ON(!PageSlab(sp));
96891 + if (!sp->private)
96892 slob_free(b, size);
96893 else
96894 - slob_free_pages(b, get_order(size));
96895 + slob_free_pages(sp, get_order(size));
96896 }
96897
96898 static void kmem_rcu_free(struct rcu_head *head)
96899 @@ -600,17 +716,31 @@ static void kmem_rcu_free(struct rcu_head *head)
96900
96901 void kmem_cache_free(struct kmem_cache *c, void *b)
96902 {
96903 + int size = c->size;
96904 +
96905 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96906 + if (size + c->align < PAGE_SIZE) {
96907 + size += c->align;
96908 + b -= c->align;
96909 + }
96910 +#endif
96911 +
96912 kmemleak_free_recursive(b, c->flags);
96913 if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
96914 struct slob_rcu *slob_rcu;
96915 - slob_rcu = b + (c->size - sizeof(struct slob_rcu));
96916 - slob_rcu->size = c->size;
96917 + slob_rcu = b + (size - sizeof(struct slob_rcu));
96918 + slob_rcu->size = size;
96919 call_rcu(&slob_rcu->head, kmem_rcu_free);
96920 } else {
96921 - __kmem_cache_free(b, c->size);
96922 + __kmem_cache_free(b, size);
96923 }
96924
96925 +#ifdef CONFIG_PAX_USERCOPY_SLABS
96926 + trace_kfree(_RET_IP_, b);
96927 +#else
96928 trace_kmem_cache_free(_RET_IP_, b);
96929 +#endif
96930 +
96931 }
96932 EXPORT_SYMBOL(kmem_cache_free);
96933
96934 diff --git a/mm/slub.c b/mm/slub.c
96935 index 25f14ad..c904f6f 100644
96936 --- a/mm/slub.c
96937 +++ b/mm/slub.c
96938 @@ -207,7 +207,7 @@ struct track {
96939
96940 enum track_item { TRACK_ALLOC, TRACK_FREE };
96941
96942 -#ifdef CONFIG_SYSFS
96943 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
96944 static int sysfs_slab_add(struct kmem_cache *);
96945 static int sysfs_slab_alias(struct kmem_cache *, const char *);
96946 static void sysfs_slab_remove(struct kmem_cache *);
96947 @@ -545,7 +545,7 @@ static void print_track(const char *s, struct track *t)
96948 if (!t->addr)
96949 return;
96950
96951 - printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
96952 + printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
96953 s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
96954 #ifdef CONFIG_STACKTRACE
96955 {
96956 @@ -2666,6 +2666,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
96957
96958 slab_free_hook(s, x);
96959
96960 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96961 + if (pax_sanitize_slab && !(s->flags & SLAB_NO_SANITIZE)) {
96962 + memset(x, PAX_MEMORY_SANITIZE_VALUE, s->object_size);
96963 + if (s->ctor)
96964 + s->ctor(x);
96965 + }
96966 +#endif
96967 +
96968 redo:
96969 /*
96970 * Determine the currently cpus per cpu slab.
96971 @@ -2733,7 +2741,7 @@ static int slub_min_objects;
96972 * Merge control. If this is set then no merging of slab caches will occur.
96973 * (Could be removed. This was introduced to pacify the merge skeptics.)
96974 */
96975 -static int slub_nomerge;
96976 +static int slub_nomerge = 1;
96977
96978 /*
96979 * Calculate the order of allocation given an slab object size.
96980 @@ -3014,6 +3022,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
96981 s->inuse = size;
96982
96983 if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
96984 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
96985 + (pax_sanitize_slab && !(flags & SLAB_NO_SANITIZE)) ||
96986 +#endif
96987 s->ctor)) {
96988 /*
96989 * Relocate free pointer after the object if it is not
96990 @@ -3359,6 +3370,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
96991 EXPORT_SYMBOL(__kmalloc_node);
96992 #endif
96993
96994 +bool is_usercopy_object(const void *ptr)
96995 +{
96996 + struct page *page;
96997 + struct kmem_cache *s;
96998 +
96999 + if (ZERO_OR_NULL_PTR(ptr))
97000 + return false;
97001 +
97002 + if (!slab_is_available())
97003 + return false;
97004 +
97005 + if (!virt_addr_valid(ptr))
97006 + return false;
97007 +
97008 + page = virt_to_head_page(ptr);
97009 +
97010 + if (!PageSlab(page))
97011 + return false;
97012 +
97013 + s = page->slab_cache;
97014 + return s->flags & SLAB_USERCOPY;
97015 +}
97016 +
97017 +#ifdef CONFIG_PAX_USERCOPY
97018 +const char *check_heap_object(const void *ptr, unsigned long n)
97019 +{
97020 + struct page *page;
97021 + struct kmem_cache *s;
97022 + unsigned long offset;
97023 +
97024 + if (ZERO_OR_NULL_PTR(ptr))
97025 + return "<null>";
97026 +
97027 + if (!virt_addr_valid(ptr))
97028 + return NULL;
97029 +
97030 + page = virt_to_head_page(ptr);
97031 +
97032 + if (!PageSlab(page))
97033 + return NULL;
97034 +
97035 + s = page->slab_cache;
97036 + if (!(s->flags & SLAB_USERCOPY))
97037 + return s->name;
97038 +
97039 + offset = (ptr - page_address(page)) % s->size;
97040 + if (offset <= s->object_size && n <= s->object_size - offset)
97041 + return NULL;
97042 +
97043 + return s->name;
97044 +}
97045 +#endif
97046 +
97047 size_t ksize(const void *object)
97048 {
97049 struct page *page;
97050 @@ -3387,6 +3451,7 @@ void kfree(const void *x)
97051 if (unlikely(ZERO_OR_NULL_PTR(x)))
97052 return;
97053
97054 + VM_BUG_ON(!virt_addr_valid(x));
97055 page = virt_to_head_page(x);
97056 if (unlikely(!PageSlab(page))) {
97057 BUG_ON(!PageCompound(page));
97058 @@ -3692,7 +3757,7 @@ static int slab_unmergeable(struct kmem_cache *s)
97059 /*
97060 * We may have set a slab to be unmergeable during bootstrap.
97061 */
97062 - if (s->refcount < 0)
97063 + if (atomic_read(&s->refcount) < 0)
97064 return 1;
97065
97066 return 0;
97067 @@ -3750,7 +3815,7 @@ __kmem_cache_alias(struct mem_cgroup *memcg, const char *name, size_t size,
97068
97069 s = find_mergeable(memcg, size, align, flags, name, ctor);
97070 if (s) {
97071 - s->refcount++;
97072 + atomic_inc(&s->refcount);
97073 /*
97074 * Adjust the object sizes so that we clear
97075 * the complete object on kzalloc.
97076 @@ -3759,7 +3824,7 @@ __kmem_cache_alias(struct mem_cgroup *memcg, const char *name, size_t size,
97077 s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
97078
97079 if (sysfs_slab_alias(s, name)) {
97080 - s->refcount--;
97081 + atomic_dec(&s->refcount);
97082 s = NULL;
97083 }
97084 }
97085 @@ -3879,7 +3944,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
97086 }
97087 #endif
97088
97089 -#ifdef CONFIG_SYSFS
97090 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
97091 static int count_inuse(struct page *page)
97092 {
97093 return page->inuse;
97094 @@ -4163,7 +4228,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
97095 len += sprintf(buf + len, "%7ld ", l->count);
97096
97097 if (l->addr)
97098 +#ifdef CONFIG_GRKERNSEC_HIDESYM
97099 + len += sprintf(buf + len, "%pS", NULL);
97100 +#else
97101 len += sprintf(buf + len, "%pS", (void *)l->addr);
97102 +#endif
97103 else
97104 len += sprintf(buf + len, "<not-available>");
97105
97106 @@ -4268,12 +4337,12 @@ static void resiliency_test(void)
97107 validate_slab_cache(kmalloc_caches[9]);
97108 }
97109 #else
97110 -#ifdef CONFIG_SYSFS
97111 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
97112 static void resiliency_test(void) {};
97113 #endif
97114 #endif
97115
97116 -#ifdef CONFIG_SYSFS
97117 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
97118 enum slab_stat_type {
97119 SL_ALL, /* All slabs */
97120 SL_PARTIAL, /* Only partially allocated slabs */
97121 @@ -4513,13 +4582,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
97122 {
97123 if (!s->ctor)
97124 return 0;
97125 +#ifdef CONFIG_GRKERNSEC_HIDESYM
97126 + return sprintf(buf, "%pS\n", NULL);
97127 +#else
97128 return sprintf(buf, "%pS\n", s->ctor);
97129 +#endif
97130 }
97131 SLAB_ATTR_RO(ctor);
97132
97133 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
97134 {
97135 - return sprintf(buf, "%d\n", s->refcount - 1);
97136 + return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
97137 }
97138 SLAB_ATTR_RO(aliases);
97139
97140 @@ -4607,6 +4680,14 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
97141 SLAB_ATTR_RO(cache_dma);
97142 #endif
97143
97144 +#ifdef CONFIG_PAX_USERCOPY_SLABS
97145 +static ssize_t usercopy_show(struct kmem_cache *s, char *buf)
97146 +{
97147 + return sprintf(buf, "%d\n", !!(s->flags & SLAB_USERCOPY));
97148 +}
97149 +SLAB_ATTR_RO(usercopy);
97150 +#endif
97151 +
97152 static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
97153 {
97154 return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
97155 @@ -4941,6 +5022,9 @@ static struct attribute *slab_attrs[] = {
97156 #ifdef CONFIG_ZONE_DMA
97157 &cache_dma_attr.attr,
97158 #endif
97159 +#ifdef CONFIG_PAX_USERCOPY_SLABS
97160 + &usercopy_attr.attr,
97161 +#endif
97162 #ifdef CONFIG_NUMA
97163 &remote_node_defrag_ratio_attr.attr,
97164 #endif
97165 @@ -5173,6 +5257,7 @@ static char *create_unique_id(struct kmem_cache *s)
97166 return name;
97167 }
97168
97169 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
97170 static int sysfs_slab_add(struct kmem_cache *s)
97171 {
97172 int err;
97173 @@ -5230,6 +5315,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
97174 kobject_del(&s->kobj);
97175 kobject_put(&s->kobj);
97176 }
97177 +#endif
97178
97179 /*
97180 * Need to buffer aliases during bootup until sysfs becomes
97181 @@ -5243,6 +5329,7 @@ struct saved_alias {
97182
97183 static struct saved_alias *alias_list;
97184
97185 +#if defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
97186 static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
97187 {
97188 struct saved_alias *al;
97189 @@ -5265,6 +5352,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
97190 alias_list = al;
97191 return 0;
97192 }
97193 +#endif
97194
97195 static int __init slab_sysfs_init(void)
97196 {
97197 diff --git a/mm/sparse-vmemmap.c b/mm/sparse-vmemmap.c
97198 index 4cba9c2..b4f9fcc 100644
97199 --- a/mm/sparse-vmemmap.c
97200 +++ b/mm/sparse-vmemmap.c
97201 @@ -131,7 +131,7 @@ pud_t * __meminit vmemmap_pud_populate(pgd_t *pgd, unsigned long addr, int node)
97202 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
97203 if (!p)
97204 return NULL;
97205 - pud_populate(&init_mm, pud, p);
97206 + pud_populate_kernel(&init_mm, pud, p);
97207 }
97208 return pud;
97209 }
97210 @@ -143,7 +143,7 @@ pgd_t * __meminit vmemmap_pgd_populate(unsigned long addr, int node)
97211 void *p = vmemmap_alloc_block(PAGE_SIZE, node);
97212 if (!p)
97213 return NULL;
97214 - pgd_populate(&init_mm, pgd, p);
97215 + pgd_populate_kernel(&init_mm, pgd, p);
97216 }
97217 return pgd;
97218 }
97219 diff --git a/mm/sparse.c b/mm/sparse.c
97220 index 63c3ea5..95c0858 100644
97221 --- a/mm/sparse.c
97222 +++ b/mm/sparse.c
97223 @@ -748,7 +748,7 @@ static void clear_hwpoisoned_pages(struct page *memmap, int nr_pages)
97224
97225 for (i = 0; i < PAGES_PER_SECTION; i++) {
97226 if (PageHWPoison(&memmap[i])) {
97227 - atomic_long_sub(1, &num_poisoned_pages);
97228 + atomic_long_sub_unchecked(1, &num_poisoned_pages);
97229 ClearPageHWPoison(&memmap[i]);
97230 }
97231 }
97232 diff --git a/mm/swap.c b/mm/swap.c
97233 index 0092097..33361ff 100644
97234 --- a/mm/swap.c
97235 +++ b/mm/swap.c
97236 @@ -31,6 +31,7 @@
97237 #include <linux/memcontrol.h>
97238 #include <linux/gfp.h>
97239 #include <linux/uio.h>
97240 +#include <linux/hugetlb.h>
97241
97242 #include "internal.h"
97243
97244 @@ -76,6 +77,8 @@ static void __put_compound_page(struct page *page)
97245
97246 __page_cache_release(page);
97247 dtor = get_compound_page_dtor(page);
97248 + if (!PageHuge(page))
97249 + BUG_ON(dtor != free_compound_page);
97250 (*dtor)(page);
97251 }
97252
97253 diff --git a/mm/swapfile.c b/mm/swapfile.c
97254 index 4a7f7e6..22cddf5 100644
97255 --- a/mm/swapfile.c
97256 +++ b/mm/swapfile.c
97257 @@ -66,7 +66,7 @@ static DEFINE_MUTEX(swapon_mutex);
97258
97259 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
97260 /* Activity counter to indicate that a swapon or swapoff has occurred */
97261 -static atomic_t proc_poll_event = ATOMIC_INIT(0);
97262 +static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
97263
97264 static inline unsigned char swap_count(unsigned char ent)
97265 {
97266 @@ -1959,7 +1959,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
97267 spin_unlock(&swap_lock);
97268
97269 err = 0;
97270 - atomic_inc(&proc_poll_event);
97271 + atomic_inc_unchecked(&proc_poll_event);
97272 wake_up_interruptible(&proc_poll_wait);
97273
97274 out_dput:
97275 @@ -1976,8 +1976,8 @@ static unsigned swaps_poll(struct file *file, poll_table *wait)
97276
97277 poll_wait(file, &proc_poll_wait, wait);
97278
97279 - if (seq->poll_event != atomic_read(&proc_poll_event)) {
97280 - seq->poll_event = atomic_read(&proc_poll_event);
97281 + if (seq->poll_event != atomic_read_unchecked(&proc_poll_event)) {
97282 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
97283 return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
97284 }
97285
97286 @@ -2075,7 +2075,7 @@ static int swaps_open(struct inode *inode, struct file *file)
97287 return ret;
97288
97289 seq = file->private_data;
97290 - seq->poll_event = atomic_read(&proc_poll_event);
97291 + seq->poll_event = atomic_read_unchecked(&proc_poll_event);
97292 return 0;
97293 }
97294
97295 @@ -2534,7 +2534,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
97296 (frontswap_map) ? "FS" : "");
97297
97298 mutex_unlock(&swapon_mutex);
97299 - atomic_inc(&proc_poll_event);
97300 + atomic_inc_unchecked(&proc_poll_event);
97301 wake_up_interruptible(&proc_poll_wait);
97302
97303 if (S_ISREG(inode->i_mode))
97304 diff --git a/mm/util.c b/mm/util.c
97305 index a24aa22..a0d41ae 100644
97306 --- a/mm/util.c
97307 +++ b/mm/util.c
97308 @@ -297,6 +297,12 @@ done:
97309 void arch_pick_mmap_layout(struct mm_struct *mm)
97310 {
97311 mm->mmap_base = TASK_UNMAPPED_BASE;
97312 +
97313 +#ifdef CONFIG_PAX_RANDMMAP
97314 + if (mm->pax_flags & MF_PAX_RANDMMAP)
97315 + mm->mmap_base += mm->delta_mmap;
97316 +#endif
97317 +
97318 mm->get_unmapped_area = arch_get_unmapped_area;
97319 }
97320 #endif
97321 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
97322 index 0fdf968..2183ba3 100644
97323 --- a/mm/vmalloc.c
97324 +++ b/mm/vmalloc.c
97325 @@ -59,8 +59,19 @@ static void vunmap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end)
97326
97327 pte = pte_offset_kernel(pmd, addr);
97328 do {
97329 - pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
97330 - WARN_ON(!pte_none(ptent) && !pte_present(ptent));
97331 +
97332 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
97333 + if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
97334 + BUG_ON(!pte_exec(*pte));
97335 + set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
97336 + continue;
97337 + }
97338 +#endif
97339 +
97340 + {
97341 + pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
97342 + WARN_ON(!pte_none(ptent) && !pte_present(ptent));
97343 + }
97344 } while (pte++, addr += PAGE_SIZE, addr != end);
97345 }
97346
97347 @@ -120,16 +131,29 @@ static int vmap_pte_range(pmd_t *pmd, unsigned long addr,
97348 pte = pte_alloc_kernel(pmd, addr);
97349 if (!pte)
97350 return -ENOMEM;
97351 +
97352 + pax_open_kernel();
97353 do {
97354 struct page *page = pages[*nr];
97355
97356 - if (WARN_ON(!pte_none(*pte)))
97357 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
97358 + if (pgprot_val(prot) & _PAGE_NX)
97359 +#endif
97360 +
97361 + if (!pte_none(*pte)) {
97362 + pax_close_kernel();
97363 + WARN_ON(1);
97364 return -EBUSY;
97365 - if (WARN_ON(!page))
97366 + }
97367 + if (!page) {
97368 + pax_close_kernel();
97369 + WARN_ON(1);
97370 return -ENOMEM;
97371 + }
97372 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
97373 (*nr)++;
97374 } while (pte++, addr += PAGE_SIZE, addr != end);
97375 + pax_close_kernel();
97376 return 0;
97377 }
97378
97379 @@ -139,7 +163,7 @@ static int vmap_pmd_range(pud_t *pud, unsigned long addr,
97380 pmd_t *pmd;
97381 unsigned long next;
97382
97383 - pmd = pmd_alloc(&init_mm, pud, addr);
97384 + pmd = pmd_alloc_kernel(&init_mm, pud, addr);
97385 if (!pmd)
97386 return -ENOMEM;
97387 do {
97388 @@ -156,7 +180,7 @@ static int vmap_pud_range(pgd_t *pgd, unsigned long addr,
97389 pud_t *pud;
97390 unsigned long next;
97391
97392 - pud = pud_alloc(&init_mm, pgd, addr);
97393 + pud = pud_alloc_kernel(&init_mm, pgd, addr);
97394 if (!pud)
97395 return -ENOMEM;
97396 do {
97397 @@ -216,6 +240,12 @@ int is_vmalloc_or_module_addr(const void *x)
97398 if (addr >= MODULES_VADDR && addr < MODULES_END)
97399 return 1;
97400 #endif
97401 +
97402 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
97403 + if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
97404 + return 1;
97405 +#endif
97406 +
97407 return is_vmalloc_addr(x);
97408 }
97409
97410 @@ -236,8 +266,14 @@ struct page *vmalloc_to_page(const void *vmalloc_addr)
97411
97412 if (!pgd_none(*pgd)) {
97413 pud_t *pud = pud_offset(pgd, addr);
97414 +#ifdef CONFIG_X86
97415 + if (!pud_large(*pud))
97416 +#endif
97417 if (!pud_none(*pud)) {
97418 pmd_t *pmd = pmd_offset(pud, addr);
97419 +#ifdef CONFIG_X86
97420 + if (!pmd_large(*pmd))
97421 +#endif
97422 if (!pmd_none(*pmd)) {
97423 pte_t *ptep, pte;
97424
97425 @@ -1309,6 +1345,16 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
97426 struct vm_struct *area;
97427
97428 BUG_ON(in_interrupt());
97429 +
97430 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
97431 + if (flags & VM_KERNEXEC) {
97432 + if (start != VMALLOC_START || end != VMALLOC_END)
97433 + return NULL;
97434 + start = (unsigned long)MODULES_EXEC_VADDR;
97435 + end = (unsigned long)MODULES_EXEC_END;
97436 + }
97437 +#endif
97438 +
97439 if (flags & VM_IOREMAP)
97440 align = 1ul << clamp(fls(size), PAGE_SHIFT, IOREMAP_MAX_ORDER);
97441
97442 @@ -1534,6 +1580,11 @@ void *vmap(struct page **pages, unsigned int count,
97443 if (count > totalram_pages)
97444 return NULL;
97445
97446 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
97447 + if (!(pgprot_val(prot) & _PAGE_NX))
97448 + flags |= VM_KERNEXEC;
97449 +#endif
97450 +
97451 area = get_vm_area_caller((count << PAGE_SHIFT), flags,
97452 __builtin_return_address(0));
97453 if (!area)
97454 @@ -1634,6 +1685,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
97455 if (!size || (size >> PAGE_SHIFT) > totalram_pages)
97456 goto fail;
97457
97458 +#if defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
97459 + if (!(pgprot_val(prot) & _PAGE_NX))
97460 + area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNINITIALIZED | VM_KERNEXEC,
97461 + VMALLOC_START, VMALLOC_END, node, gfp_mask, caller);
97462 + else
97463 +#endif
97464 +
97465 area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNINITIALIZED,
97466 start, end, node, gfp_mask, caller);
97467 if (!area)
97468 @@ -1701,6 +1759,12 @@ static inline void *__vmalloc_node_flags(unsigned long size,
97469 node, __builtin_return_address(0));
97470 }
97471
97472 +void *vmalloc_stack(int node)
97473 +{
97474 + return __vmalloc_node(THREAD_SIZE, THREAD_SIZE, THREADINFO_GFP, PAGE_KERNEL,
97475 + node, __builtin_return_address(0));
97476 +}
97477 +
97478 /**
97479 * vmalloc - allocate virtually contiguous memory
97480 * @size: allocation size
97481 @@ -1810,10 +1874,9 @@ EXPORT_SYMBOL(vzalloc_node);
97482 * For tight control over page level allocator and protection flags
97483 * use __vmalloc() instead.
97484 */
97485 -
97486 void *vmalloc_exec(unsigned long size)
97487 {
97488 - return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
97489 + return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
97490 NUMA_NO_NODE, __builtin_return_address(0));
97491 }
97492
97493 @@ -2120,6 +2183,8 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
97494 {
97495 struct vm_struct *area;
97496
97497 + BUG_ON(vma->vm_mirror);
97498 +
97499 size = PAGE_ALIGN(size);
97500
97501 if (!PAGE_ALIGNED(uaddr) || !PAGE_ALIGNED(kaddr))
97502 @@ -2602,7 +2667,11 @@ static int s_show(struct seq_file *m, void *p)
97503 v->addr, v->addr + v->size, v->size);
97504
97505 if (v->caller)
97506 +#ifdef CONFIG_GRKERNSEC_HIDESYM
97507 + seq_printf(m, " %pK", v->caller);
97508 +#else
97509 seq_printf(m, " %pS", v->caller);
97510 +#endif
97511
97512 if (v->nr_pages)
97513 seq_printf(m, " pages=%d", v->nr_pages);
97514 diff --git a/mm/vmstat.c b/mm/vmstat.c
97515 index def5dd2..4ce55cec 100644
97516 --- a/mm/vmstat.c
97517 +++ b/mm/vmstat.c
97518 @@ -20,6 +20,7 @@
97519 #include <linux/writeback.h>
97520 #include <linux/compaction.h>
97521 #include <linux/mm_inline.h>
97522 +#include <linux/grsecurity.h>
97523
97524 #include "internal.h"
97525
97526 @@ -79,7 +80,7 @@ void vm_events_fold_cpu(int cpu)
97527 *
97528 * vm_stat contains the global counters
97529 */
97530 -atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS] __cacheline_aligned_in_smp;
97531 +atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS] __cacheline_aligned_in_smp;
97532 EXPORT_SYMBOL(vm_stat);
97533
97534 #ifdef CONFIG_SMP
97535 @@ -423,7 +424,7 @@ static inline void fold_diff(int *diff)
97536
97537 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
97538 if (diff[i])
97539 - atomic_long_add(diff[i], &vm_stat[i]);
97540 + atomic_long_add_unchecked(diff[i], &vm_stat[i]);
97541 }
97542
97543 /*
97544 @@ -455,7 +456,7 @@ static void refresh_cpu_vm_stats(void)
97545 v = this_cpu_xchg(p->vm_stat_diff[i], 0);
97546 if (v) {
97547
97548 - atomic_long_add(v, &zone->vm_stat[i]);
97549 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
97550 global_diff[i] += v;
97551 #ifdef CONFIG_NUMA
97552 /* 3 seconds idle till flush */
97553 @@ -517,7 +518,7 @@ void cpu_vm_stats_fold(int cpu)
97554
97555 v = p->vm_stat_diff[i];
97556 p->vm_stat_diff[i] = 0;
97557 - atomic_long_add(v, &zone->vm_stat[i]);
97558 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
97559 global_diff[i] += v;
97560 }
97561 }
97562 @@ -537,8 +538,8 @@ void drain_zonestat(struct zone *zone, struct per_cpu_pageset *pset)
97563 if (pset->vm_stat_diff[i]) {
97564 int v = pset->vm_stat_diff[i];
97565 pset->vm_stat_diff[i] = 0;
97566 - atomic_long_add(v, &zone->vm_stat[i]);
97567 - atomic_long_add(v, &vm_stat[i]);
97568 + atomic_long_add_unchecked(v, &zone->vm_stat[i]);
97569 + atomic_long_add_unchecked(v, &vm_stat[i]);
97570 }
97571 }
97572 #endif
97573 @@ -1150,10 +1151,22 @@ static void *vmstat_start(struct seq_file *m, loff_t *pos)
97574 stat_items_size += sizeof(struct vm_event_state);
97575 #endif
97576
97577 - v = kmalloc(stat_items_size, GFP_KERNEL);
97578 + v = kzalloc(stat_items_size, GFP_KERNEL);
97579 m->private = v;
97580 if (!v)
97581 return ERR_PTR(-ENOMEM);
97582 +
97583 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
97584 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
97585 + if (!uid_eq(current_uid(), GLOBAL_ROOT_UID)
97586 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
97587 + && !in_group_p(grsec_proc_gid)
97588 +#endif
97589 + )
97590 + return (unsigned long *)m->private + *pos;
97591 +#endif
97592 +#endif
97593 +
97594 for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
97595 v[i] = global_page_state(i);
97596 v += NR_VM_ZONE_STAT_ITEMS;
97597 @@ -1302,10 +1315,16 @@ static int __init setup_vmstat(void)
97598 put_online_cpus();
97599 #endif
97600 #ifdef CONFIG_PROC_FS
97601 - proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
97602 - proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
97603 - proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
97604 - proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
97605 + {
97606 + mode_t gr_mode = S_IRUGO;
97607 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
97608 + gr_mode = S_IRUSR;
97609 +#endif
97610 + proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
97611 + proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
97612 + proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
97613 + proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
97614 + }
97615 #endif
97616 return 0;
97617 }
97618 diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
97619 index 44ebd5c..1f732bae 100644
97620 --- a/net/8021q/vlan.c
97621 +++ b/net/8021q/vlan.c
97622 @@ -475,7 +475,7 @@ out:
97623 return NOTIFY_DONE;
97624 }
97625
97626 -static struct notifier_block vlan_notifier_block __read_mostly = {
97627 +static struct notifier_block vlan_notifier_block = {
97628 .notifier_call = vlan_device_event,
97629 };
97630
97631 @@ -550,8 +550,7 @@ static int vlan_ioctl_handler(struct net *net, void __user *arg)
97632 err = -EPERM;
97633 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
97634 break;
97635 - if ((args.u.name_type >= 0) &&
97636 - (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
97637 + if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
97638 struct vlan_net *vn;
97639
97640 vn = net_generic(net, vlan_net_id);
97641 diff --git a/net/9p/client.c b/net/9p/client.c
97642 index 9186550..e604a2f 100644
97643 --- a/net/9p/client.c
97644 +++ b/net/9p/client.c
97645 @@ -588,7 +588,7 @@ static int p9_check_zc_errors(struct p9_client *c, struct p9_req_t *req,
97646 len - inline_len);
97647 } else {
97648 err = copy_from_user(ename + inline_len,
97649 - uidata, len - inline_len);
97650 + (char __force_user *)uidata, len - inline_len);
97651 if (err) {
97652 err = -EFAULT;
97653 goto out_err;
97654 @@ -1560,7 +1560,7 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
97655 kernel_buf = 1;
97656 indata = data;
97657 } else
97658 - indata = (__force char *)udata;
97659 + indata = (__force_kernel char *)udata;
97660 /*
97661 * response header len is 11
97662 * PDU Header(7) + IO Size (4)
97663 @@ -1635,7 +1635,7 @@ p9_client_write(struct p9_fid *fid, char *data, const char __user *udata,
97664 kernel_buf = 1;
97665 odata = data;
97666 } else
97667 - odata = (char *)udata;
97668 + odata = (char __force_kernel *)udata;
97669 req = p9_client_zc_rpc(clnt, P9_TWRITE, NULL, odata, 0, rsize,
97670 P9_ZC_HDR_SZ, kernel_buf, "dqd",
97671 fid->fid, offset, rsize);
97672 diff --git a/net/9p/mod.c b/net/9p/mod.c
97673 index 6ab36ae..6f1841b 100644
97674 --- a/net/9p/mod.c
97675 +++ b/net/9p/mod.c
97676 @@ -84,7 +84,7 @@ static LIST_HEAD(v9fs_trans_list);
97677 void v9fs_register_trans(struct p9_trans_module *m)
97678 {
97679 spin_lock(&v9fs_trans_lock);
97680 - list_add_tail(&m->list, &v9fs_trans_list);
97681 + pax_list_add_tail((struct list_head *)&m->list, &v9fs_trans_list);
97682 spin_unlock(&v9fs_trans_lock);
97683 }
97684 EXPORT_SYMBOL(v9fs_register_trans);
97685 @@ -97,7 +97,7 @@ EXPORT_SYMBOL(v9fs_register_trans);
97686 void v9fs_unregister_trans(struct p9_trans_module *m)
97687 {
97688 spin_lock(&v9fs_trans_lock);
97689 - list_del_init(&m->list);
97690 + pax_list_del_init((struct list_head *)&m->list);
97691 spin_unlock(&v9fs_trans_lock);
97692 }
97693 EXPORT_SYMBOL(v9fs_unregister_trans);
97694 diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
97695 index b7bd7f2..2498bf7 100644
97696 --- a/net/9p/trans_fd.c
97697 +++ b/net/9p/trans_fd.c
97698 @@ -432,7 +432,7 @@ static int p9_fd_write(struct p9_client *client, void *v, int len)
97699 oldfs = get_fs();
97700 set_fs(get_ds());
97701 /* The cast to a user pointer is valid due to the set_fs() */
97702 - ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos);
97703 + ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos);
97704 set_fs(oldfs);
97705
97706 if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN)
97707 diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
97708 index af46bc4..f9adfcd 100644
97709 --- a/net/appletalk/atalk_proc.c
97710 +++ b/net/appletalk/atalk_proc.c
97711 @@ -256,7 +256,7 @@ int __init atalk_proc_init(void)
97712 struct proc_dir_entry *p;
97713 int rc = -ENOMEM;
97714
97715 - atalk_proc_dir = proc_mkdir("atalk", init_net.proc_net);
97716 + atalk_proc_dir = proc_mkdir_restrict("atalk", init_net.proc_net);
97717 if (!atalk_proc_dir)
97718 goto out;
97719
97720 diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
97721 index 876fbe8..8bbea9f 100644
97722 --- a/net/atm/atm_misc.c
97723 +++ b/net/atm/atm_misc.c
97724 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int truesize)
97725 if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
97726 return 1;
97727 atm_return(vcc, truesize);
97728 - atomic_inc(&vcc->stats->rx_drop);
97729 + atomic_inc_unchecked(&vcc->stats->rx_drop);
97730 return 0;
97731 }
97732 EXPORT_SYMBOL(atm_charge);
97733 @@ -39,7 +39,7 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
97734 }
97735 }
97736 atm_return(vcc, guess);
97737 - atomic_inc(&vcc->stats->rx_drop);
97738 + atomic_inc_unchecked(&vcc->stats->rx_drop);
97739 return NULL;
97740 }
97741 EXPORT_SYMBOL(atm_alloc_charge);
97742 @@ -86,7 +86,7 @@ EXPORT_SYMBOL(atm_pcr_goal);
97743
97744 void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
97745 {
97746 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
97747 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
97748 __SONET_ITEMS
97749 #undef __HANDLE_ITEM
97750 }
97751 @@ -94,7 +94,7 @@ EXPORT_SYMBOL(sonet_copy_stats);
97752
97753 void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
97754 {
97755 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
97756 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
97757 __SONET_ITEMS
97758 #undef __HANDLE_ITEM
97759 }
97760 diff --git a/net/atm/lec.c b/net/atm/lec.c
97761 index 5a2f602..9396143 100644
97762 --- a/net/atm/lec.c
97763 +++ b/net/atm/lec.c
97764 @@ -111,9 +111,9 @@ static inline void lec_arp_put(struct lec_arp_table *entry)
97765 }
97766
97767 static struct lane2_ops lane2_ops = {
97768 - lane2_resolve, /* resolve, spec 3.1.3 */
97769 - lane2_associate_req, /* associate_req, spec 3.1.4 */
97770 - NULL /* associate indicator, spec 3.1.5 */
97771 + .resolve = lane2_resolve,
97772 + .associate_req = lane2_associate_req,
97773 + .associate_indicator = NULL
97774 };
97775
97776 static unsigned char bus_mac[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
97777 diff --git a/net/atm/lec.h b/net/atm/lec.h
97778 index 4149db1..f2ab682 100644
97779 --- a/net/atm/lec.h
97780 +++ b/net/atm/lec.h
97781 @@ -48,7 +48,7 @@ struct lane2_ops {
97782 const u8 *tlvs, u32 sizeoftlvs);
97783 void (*associate_indicator) (struct net_device *dev, const u8 *mac_addr,
97784 const u8 *tlvs, u32 sizeoftlvs);
97785 -};
97786 +} __no_const;
97787
97788 /*
97789 * ATM LAN Emulation supports both LLC & Dix Ethernet EtherType
97790 diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
97791 index d1b2d9a..d549f7f 100644
97792 --- a/net/atm/mpoa_caches.c
97793 +++ b/net/atm/mpoa_caches.c
97794 @@ -535,30 +535,30 @@ static void eg_destroy_cache(struct mpoa_client *mpc)
97795
97796
97797 static struct in_cache_ops ingress_ops = {
97798 - in_cache_add_entry, /* add_entry */
97799 - in_cache_get, /* get */
97800 - in_cache_get_with_mask, /* get_with_mask */
97801 - in_cache_get_by_vcc, /* get_by_vcc */
97802 - in_cache_put, /* put */
97803 - in_cache_remove_entry, /* remove_entry */
97804 - cache_hit, /* cache_hit */
97805 - clear_count_and_expired, /* clear_count */
97806 - check_resolving_entries, /* check_resolving */
97807 - refresh_entries, /* refresh */
97808 - in_destroy_cache /* destroy_cache */
97809 + .add_entry = in_cache_add_entry,
97810 + .get = in_cache_get,
97811 + .get_with_mask = in_cache_get_with_mask,
97812 + .get_by_vcc = in_cache_get_by_vcc,
97813 + .put = in_cache_put,
97814 + .remove_entry = in_cache_remove_entry,
97815 + .cache_hit = cache_hit,
97816 + .clear_count = clear_count_and_expired,
97817 + .check_resolving = check_resolving_entries,
97818 + .refresh = refresh_entries,
97819 + .destroy_cache = in_destroy_cache
97820 };
97821
97822 static struct eg_cache_ops egress_ops = {
97823 - eg_cache_add_entry, /* add_entry */
97824 - eg_cache_get_by_cache_id, /* get_by_cache_id */
97825 - eg_cache_get_by_tag, /* get_by_tag */
97826 - eg_cache_get_by_vcc, /* get_by_vcc */
97827 - eg_cache_get_by_src_ip, /* get_by_src_ip */
97828 - eg_cache_put, /* put */
97829 - eg_cache_remove_entry, /* remove_entry */
97830 - update_eg_cache_entry, /* update */
97831 - clear_expired, /* clear_expired */
97832 - eg_destroy_cache /* destroy_cache */
97833 + .add_entry = eg_cache_add_entry,
97834 + .get_by_cache_id = eg_cache_get_by_cache_id,
97835 + .get_by_tag = eg_cache_get_by_tag,
97836 + .get_by_vcc = eg_cache_get_by_vcc,
97837 + .get_by_src_ip = eg_cache_get_by_src_ip,
97838 + .put = eg_cache_put,
97839 + .remove_entry = eg_cache_remove_entry,
97840 + .update = update_eg_cache_entry,
97841 + .clear_expired = clear_expired,
97842 + .destroy_cache = eg_destroy_cache
97843 };
97844
97845
97846 diff --git a/net/atm/proc.c b/net/atm/proc.c
97847 index bbb6461..cf04016 100644
97848 --- a/net/atm/proc.c
97849 +++ b/net/atm/proc.c
97850 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
97851 const struct k_atm_aal_stats *stats)
97852 {
97853 seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
97854 - atomic_read(&stats->tx), atomic_read(&stats->tx_err),
97855 - atomic_read(&stats->rx), atomic_read(&stats->rx_err),
97856 - atomic_read(&stats->rx_drop));
97857 + atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
97858 + atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
97859 + atomic_read_unchecked(&stats->rx_drop));
97860 }
97861
97862 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
97863 diff --git a/net/atm/resources.c b/net/atm/resources.c
97864 index 0447d5d..3cf4728 100644
97865 --- a/net/atm/resources.c
97866 +++ b/net/atm/resources.c
97867 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
97868 static void copy_aal_stats(struct k_atm_aal_stats *from,
97869 struct atm_aal_stats *to)
97870 {
97871 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
97872 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
97873 __AAL_STAT_ITEMS
97874 #undef __HANDLE_ITEM
97875 }
97876 @@ -168,7 +168,7 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
97877 static void subtract_aal_stats(struct k_atm_aal_stats *from,
97878 struct atm_aal_stats *to)
97879 {
97880 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
97881 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
97882 __AAL_STAT_ITEMS
97883 #undef __HANDLE_ITEM
97884 }
97885 diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
97886 index 919a5ce..cc6b444 100644
97887 --- a/net/ax25/sysctl_net_ax25.c
97888 +++ b/net/ax25/sysctl_net_ax25.c
97889 @@ -152,7 +152,7 @@ int ax25_register_dev_sysctl(ax25_dev *ax25_dev)
97890 {
97891 char path[sizeof("net/ax25/") + IFNAMSIZ];
97892 int k;
97893 - struct ctl_table *table;
97894 + ctl_table_no_const *table;
97895
97896 table = kmemdup(ax25_param_table, sizeof(ax25_param_table), GFP_KERNEL);
97897 if (!table)
97898 diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
97899 index d074d06..ad3cfcf 100644
97900 --- a/net/batman-adv/bat_iv_ogm.c
97901 +++ b/net/batman-adv/bat_iv_ogm.c
97902 @@ -312,7 +312,7 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
97903
97904 /* randomize initial seqno to avoid collision */
97905 get_random_bytes(&random_seqno, sizeof(random_seqno));
97906 - atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
97907 + atomic_set_unchecked(&hard_iface->bat_iv.ogm_seqno, random_seqno);
97908
97909 hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
97910 ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
97911 @@ -917,9 +917,9 @@ static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
97912 batadv_ogm_packet->tvlv_len = htons(tvlv_len);
97913
97914 /* change sequence number to network order */
97915 - seqno = (uint32_t)atomic_read(&hard_iface->bat_iv.ogm_seqno);
97916 + seqno = (uint32_t)atomic_read_unchecked(&hard_iface->bat_iv.ogm_seqno);
97917 batadv_ogm_packet->seqno = htonl(seqno);
97918 - atomic_inc(&hard_iface->bat_iv.ogm_seqno);
97919 + atomic_inc_unchecked(&hard_iface->bat_iv.ogm_seqno);
97920
97921 batadv_iv_ogm_slide_own_bcast_window(hard_iface);
97922
97923 @@ -1596,7 +1596,7 @@ static void batadv_iv_ogm_process(const struct sk_buff *skb, int ogm_offset,
97924 return;
97925
97926 /* could be changed by schedule_own_packet() */
97927 - if_incoming_seqno = atomic_read(&if_incoming->bat_iv.ogm_seqno);
97928 + if_incoming_seqno = atomic_read_unchecked(&if_incoming->bat_iv.ogm_seqno);
97929
97930 if (ogm_packet->flags & BATADV_DIRECTLINK)
97931 has_directlink_flag = true;
97932 diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
97933 index cc1cfd6..7a68e022 100644
97934 --- a/net/batman-adv/fragmentation.c
97935 +++ b/net/batman-adv/fragmentation.c
97936 @@ -446,7 +446,7 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
97937 frag_header.packet_type = BATADV_UNICAST_FRAG;
97938 frag_header.version = BATADV_COMPAT_VERSION;
97939 frag_header.ttl = BATADV_TTL;
97940 - frag_header.seqno = htons(atomic_inc_return(&bat_priv->frag_seqno));
97941 + frag_header.seqno = htons(atomic_inc_return_unchecked(&bat_priv->frag_seqno));
97942 frag_header.reserved = 0;
97943 frag_header.no = 0;
97944 frag_header.total_size = htons(skb->len);
97945 diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
97946 index f82c267..0e56d32 100644
97947 --- a/net/batman-adv/soft-interface.c
97948 +++ b/net/batman-adv/soft-interface.c
97949 @@ -283,7 +283,7 @@ send:
97950 primary_if->net_dev->dev_addr, ETH_ALEN);
97951
97952 /* set broadcast sequence number */
97953 - seqno = atomic_inc_return(&bat_priv->bcast_seqno);
97954 + seqno = atomic_inc_return_unchecked(&bat_priv->bcast_seqno);
97955 bcast_packet->seqno = htonl(seqno);
97956
97957 batadv_add_bcast_packet_to_list(bat_priv, skb, brd_delay);
97958 @@ -707,7 +707,7 @@ static int batadv_softif_init_late(struct net_device *dev)
97959 atomic_set(&bat_priv->batman_queue_left, BATADV_BATMAN_QUEUE_LEN);
97960
97961 atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
97962 - atomic_set(&bat_priv->bcast_seqno, 1);
97963 + atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
97964 atomic_set(&bat_priv->tt.vn, 0);
97965 atomic_set(&bat_priv->tt.local_changes, 0);
97966 atomic_set(&bat_priv->tt.ogm_append_cnt, 0);
97967 @@ -721,7 +721,7 @@ static int batadv_softif_init_late(struct net_device *dev)
97968
97969 /* randomize initial seqno to avoid collision */
97970 get_random_bytes(&random_seqno, sizeof(random_seqno));
97971 - atomic_set(&bat_priv->frag_seqno, random_seqno);
97972 + atomic_set_unchecked(&bat_priv->frag_seqno, random_seqno);
97973
97974 bat_priv->primary_if = NULL;
97975 bat_priv->num_ifaces = 0;
97976 diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
97977 index 78370ab..1cb3614 100644
97978 --- a/net/batman-adv/types.h
97979 +++ b/net/batman-adv/types.h
97980 @@ -66,7 +66,7 @@ enum batadv_dhcp_recipient {
97981 struct batadv_hard_iface_bat_iv {
97982 unsigned char *ogm_buff;
97983 int ogm_buff_len;
97984 - atomic_t ogm_seqno;
97985 + atomic_unchecked_t ogm_seqno;
97986 };
97987
97988 /**
97989 @@ -714,7 +714,7 @@ struct batadv_priv {
97990 atomic_t bonding;
97991 atomic_t fragmentation;
97992 atomic_t packet_size_max;
97993 - atomic_t frag_seqno;
97994 + atomic_unchecked_t frag_seqno;
97995 #ifdef CONFIG_BATMAN_ADV_BLA
97996 atomic_t bridge_loop_avoidance;
97997 #endif
97998 @@ -730,7 +730,7 @@ struct batadv_priv {
97999 #endif
98000 uint32_t isolation_mark;
98001 uint32_t isolation_mark_mask;
98002 - atomic_t bcast_seqno;
98003 + atomic_unchecked_t bcast_seqno;
98004 atomic_t bcast_queue_left;
98005 atomic_t batman_queue_left;
98006 char num_ifaces;
98007 diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
98008 index 7552f9e..074ce29 100644
98009 --- a/net/bluetooth/hci_sock.c
98010 +++ b/net/bluetooth/hci_sock.c
98011 @@ -1052,7 +1052,7 @@ static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
98012 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
98013 }
98014
98015 - len = min_t(unsigned int, len, sizeof(uf));
98016 + len = min((size_t)len, sizeof(uf));
98017 if (copy_from_user(&uf, optval, len)) {
98018 err = -EFAULT;
98019 break;
98020 diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
98021 index b0ad2c7..96f6a5e 100644
98022 --- a/net/bluetooth/l2cap_core.c
98023 +++ b/net/bluetooth/l2cap_core.c
98024 @@ -3740,8 +3740,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
98025 break;
98026
98027 case L2CAP_CONF_RFC:
98028 - if (olen == sizeof(rfc))
98029 - memcpy(&rfc, (void *)val, olen);
98030 + if (olen != sizeof(rfc))
98031 + break;
98032 +
98033 + memcpy(&rfc, (void *)val, olen);
98034
98035 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
98036 rfc.mode != chan->mode)
98037 diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
98038 index d58f76b..b69600a 100644
98039 --- a/net/bluetooth/l2cap_sock.c
98040 +++ b/net/bluetooth/l2cap_sock.c
98041 @@ -625,7 +625,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
98042 struct sock *sk = sock->sk;
98043 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
98044 struct l2cap_options opts;
98045 - int len, err = 0;
98046 + int err = 0;
98047 + size_t len = optlen;
98048 u32 opt;
98049
98050 BT_DBG("sk %p", sk);
98051 @@ -652,7 +653,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
98052 opts.max_tx = chan->max_tx;
98053 opts.txwin_size = chan->tx_win;
98054
98055 - len = min_t(unsigned int, sizeof(opts), optlen);
98056 + len = min(sizeof(opts), len);
98057 if (copy_from_user((char *) &opts, optval, len)) {
98058 err = -EFAULT;
98059 break;
98060 @@ -734,7 +735,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
98061 struct bt_security sec;
98062 struct bt_power pwr;
98063 struct l2cap_conn *conn;
98064 - int len, err = 0;
98065 + int err = 0;
98066 + size_t len = optlen;
98067 u32 opt;
98068
98069 BT_DBG("sk %p", sk);
98070 @@ -757,7 +759,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
98071
98072 sec.level = BT_SECURITY_LOW;
98073
98074 - len = min_t(unsigned int, sizeof(sec), optlen);
98075 + len = min(sizeof(sec), len);
98076 if (copy_from_user((char *) &sec, optval, len)) {
98077 err = -EFAULT;
98078 break;
98079 @@ -857,7 +859,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
98080
98081 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
98082
98083 - len = min_t(unsigned int, sizeof(pwr), optlen);
98084 + len = min(sizeof(pwr), len);
98085 if (copy_from_user((char *) &pwr, optval, len)) {
98086 err = -EFAULT;
98087 break;
98088 diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
98089 index 3c2d3e4..884855a 100644
98090 --- a/net/bluetooth/rfcomm/sock.c
98091 +++ b/net/bluetooth/rfcomm/sock.c
98092 @@ -672,7 +672,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
98093 struct sock *sk = sock->sk;
98094 struct bt_security sec;
98095 int err = 0;
98096 - size_t len;
98097 + size_t len = optlen;
98098 u32 opt;
98099
98100 BT_DBG("sk %p", sk);
98101 @@ -694,7 +694,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
98102
98103 sec.level = BT_SECURITY_LOW;
98104
98105 - len = min_t(unsigned int, sizeof(sec), optlen);
98106 + len = min(sizeof(sec), len);
98107 if (copy_from_user((char *) &sec, optval, len)) {
98108 err = -EFAULT;
98109 break;
98110 diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
98111 index f9c0980a..fcbbfeb 100644
98112 --- a/net/bluetooth/rfcomm/tty.c
98113 +++ b/net/bluetooth/rfcomm/tty.c
98114 @@ -717,7 +717,7 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
98115 BT_DBG("tty %p id %d", tty, tty->index);
98116
98117 BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
98118 - dev->channel, dev->port.count);
98119 + dev->channel, atomic_read(&dev->port.count));
98120
98121 err = tty_port_open(&dev->port, tty, filp);
98122 if (err)
98123 @@ -740,7 +740,7 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
98124 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
98125
98126 BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
98127 - dev->port.count);
98128 + atomic_read(&dev->port.count));
98129
98130 tty_port_close(&dev->port, tty, filp);
98131 }
98132 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
98133 index 1059ed3..d70846a 100644
98134 --- a/net/bridge/netfilter/ebtables.c
98135 +++ b/net/bridge/netfilter/ebtables.c
98136 @@ -1524,7 +1524,7 @@ static int do_ebt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
98137 tmp.valid_hooks = t->table->valid_hooks;
98138 }
98139 mutex_unlock(&ebt_mutex);
98140 - if (copy_to_user(user, &tmp, *len) != 0) {
98141 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0) {
98142 BUGPRINT("c2u Didn't work\n");
98143 ret = -EFAULT;
98144 break;
98145 @@ -2330,7 +2330,7 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
98146 goto out;
98147 tmp.valid_hooks = t->valid_hooks;
98148
98149 - if (copy_to_user(user, &tmp, *len) != 0) {
98150 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0) {
98151 ret = -EFAULT;
98152 break;
98153 }
98154 @@ -2341,7 +2341,7 @@ static int compat_do_ebt_get_ctl(struct sock *sk, int cmd,
98155 tmp.entries_size = t->table->entries_size;
98156 tmp.valid_hooks = t->table->valid_hooks;
98157
98158 - if (copy_to_user(user, &tmp, *len) != 0) {
98159 + if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0) {
98160 ret = -EFAULT;
98161 break;
98162 }
98163 diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
98164 index 0f45522..dab651f 100644
98165 --- a/net/caif/cfctrl.c
98166 +++ b/net/caif/cfctrl.c
98167 @@ -10,6 +10,7 @@
98168 #include <linux/spinlock.h>
98169 #include <linux/slab.h>
98170 #include <linux/pkt_sched.h>
98171 +#include <linux/sched.h>
98172 #include <net/caif/caif_layer.h>
98173 #include <net/caif/cfpkt.h>
98174 #include <net/caif/cfctrl.h>
98175 @@ -43,8 +44,8 @@ struct cflayer *cfctrl_create(void)
98176 memset(&dev_info, 0, sizeof(dev_info));
98177 dev_info.id = 0xff;
98178 cfsrvl_init(&this->serv, 0, &dev_info, false);
98179 - atomic_set(&this->req_seq_no, 1);
98180 - atomic_set(&this->rsp_seq_no, 1);
98181 + atomic_set_unchecked(&this->req_seq_no, 1);
98182 + atomic_set_unchecked(&this->rsp_seq_no, 1);
98183 this->serv.layer.receive = cfctrl_recv;
98184 sprintf(this->serv.layer.name, "ctrl");
98185 this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
98186 @@ -130,8 +131,8 @@ static void cfctrl_insert_req(struct cfctrl *ctrl,
98187 struct cfctrl_request_info *req)
98188 {
98189 spin_lock_bh(&ctrl->info_list_lock);
98190 - atomic_inc(&ctrl->req_seq_no);
98191 - req->sequence_no = atomic_read(&ctrl->req_seq_no);
98192 + atomic_inc_unchecked(&ctrl->req_seq_no);
98193 + req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
98194 list_add_tail(&req->list, &ctrl->list);
98195 spin_unlock_bh(&ctrl->info_list_lock);
98196 }
98197 @@ -149,7 +150,7 @@ static struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
98198 if (p != first)
98199 pr_warn("Requests are not received in order\n");
98200
98201 - atomic_set(&ctrl->rsp_seq_no,
98202 + atomic_set_unchecked(&ctrl->rsp_seq_no,
98203 p->sequence_no);
98204 list_del(&p->list);
98205 goto out;
98206 diff --git a/net/can/af_can.c b/net/can/af_can.c
98207 index a27f8aa..67174a3 100644
98208 --- a/net/can/af_can.c
98209 +++ b/net/can/af_can.c
98210 @@ -863,7 +863,7 @@ static const struct net_proto_family can_family_ops = {
98211 };
98212
98213 /* notifier block for netdevice event */
98214 -static struct notifier_block can_netdev_notifier __read_mostly = {
98215 +static struct notifier_block can_netdev_notifier = {
98216 .notifier_call = can_notifier,
98217 };
98218
98219 diff --git a/net/can/bcm.c b/net/can/bcm.c
98220 index dcb75c0..24b1b43 100644
98221 --- a/net/can/bcm.c
98222 +++ b/net/can/bcm.c
98223 @@ -1624,7 +1624,7 @@ static int __init bcm_module_init(void)
98224 }
98225
98226 /* create /proc/net/can-bcm directory */
98227 - proc_dir = proc_mkdir("can-bcm", init_net.proc_net);
98228 + proc_dir = proc_mkdir_restrict("can-bcm", init_net.proc_net);
98229 return 0;
98230 }
98231
98232 diff --git a/net/can/gw.c b/net/can/gw.c
98233 index ac31891..4799c17 100644
98234 --- a/net/can/gw.c
98235 +++ b/net/can/gw.c
98236 @@ -80,7 +80,6 @@ MODULE_PARM_DESC(max_hops,
98237 "default: " __stringify(CGW_DEFAULT_HOPS) ")");
98238
98239 static HLIST_HEAD(cgw_list);
98240 -static struct notifier_block notifier;
98241
98242 static struct kmem_cache *cgw_cache __read_mostly;
98243
98244 @@ -947,6 +946,10 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh)
98245 return err;
98246 }
98247
98248 +static struct notifier_block notifier = {
98249 + .notifier_call = cgw_notifier
98250 +};
98251 +
98252 static __init int cgw_module_init(void)
98253 {
98254 /* sanitize given module parameter */
98255 @@ -962,7 +965,6 @@ static __init int cgw_module_init(void)
98256 return -ENOMEM;
98257
98258 /* set notifier */
98259 - notifier.notifier_call = cgw_notifier;
98260 register_netdevice_notifier(&notifier);
98261
98262 if (__rtnl_register(PF_CAN, RTM_GETROUTE, NULL, cgw_dump_jobs, NULL)) {
98263 diff --git a/net/can/proc.c b/net/can/proc.c
98264 index b543470..d2ddae2 100644
98265 --- a/net/can/proc.c
98266 +++ b/net/can/proc.c
98267 @@ -468,7 +468,7 @@ static void can_remove_proc_readentry(const char *name)
98268 void can_init_proc(void)
98269 {
98270 /* create /proc/net/can directory */
98271 - can_dir = proc_mkdir("can", init_net.proc_net);
98272 + can_dir = proc_mkdir_restrict("can", init_net.proc_net);
98273
98274 if (!can_dir) {
98275 printk(KERN_INFO "can: failed to create /proc/net/can . "
98276 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
98277 index 30efc5c..cfa1bbc 100644
98278 --- a/net/ceph/messenger.c
98279 +++ b/net/ceph/messenger.c
98280 @@ -187,7 +187,7 @@ static void con_fault(struct ceph_connection *con);
98281 #define MAX_ADDR_STR_LEN 64 /* 54 is enough */
98282
98283 static char addr_str[ADDR_STR_COUNT][MAX_ADDR_STR_LEN];
98284 -static atomic_t addr_str_seq = ATOMIC_INIT(0);
98285 +static atomic_unchecked_t addr_str_seq = ATOMIC_INIT(0);
98286
98287 static struct page *zero_page; /* used in certain error cases */
98288
98289 @@ -198,7 +198,7 @@ const char *ceph_pr_addr(const struct sockaddr_storage *ss)
98290 struct sockaddr_in *in4 = (struct sockaddr_in *) ss;
98291 struct sockaddr_in6 *in6 = (struct sockaddr_in6 *) ss;
98292
98293 - i = atomic_inc_return(&addr_str_seq) & ADDR_STR_COUNT_MASK;
98294 + i = atomic_inc_return_unchecked(&addr_str_seq) & ADDR_STR_COUNT_MASK;
98295 s = addr_str[i];
98296
98297 switch (ss->ss_family) {
98298 diff --git a/net/compat.c b/net/compat.c
98299 index f50161f..94fa415 100644
98300 --- a/net/compat.c
98301 +++ b/net/compat.c
98302 @@ -73,9 +73,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
98303 return -EFAULT;
98304 if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
98305 kmsg->msg_namelen = sizeof(struct sockaddr_storage);
98306 - kmsg->msg_name = compat_ptr(tmp1);
98307 - kmsg->msg_iov = compat_ptr(tmp2);
98308 - kmsg->msg_control = compat_ptr(tmp3);
98309 + kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1);
98310 + kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2);
98311 + kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3);
98312 return 0;
98313 }
98314
98315 @@ -87,7 +87,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
98316
98317 if (kern_msg->msg_namelen) {
98318 if (mode == VERIFY_READ) {
98319 - int err = move_addr_to_kernel(kern_msg->msg_name,
98320 + int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
98321 kern_msg->msg_namelen,
98322 kern_address);
98323 if (err < 0)
98324 @@ -99,7 +99,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
98325 kern_msg->msg_name = NULL;
98326
98327 tot_len = iov_from_user_compat_to_kern(kern_iov,
98328 - (struct compat_iovec __user *)kern_msg->msg_iov,
98329 + (struct compat_iovec __force_user *)kern_msg->msg_iov,
98330 kern_msg->msg_iovlen);
98331 if (tot_len >= 0)
98332 kern_msg->msg_iov = kern_iov;
98333 @@ -119,20 +119,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
98334
98335 #define CMSG_COMPAT_FIRSTHDR(msg) \
98336 (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \
98337 - (struct compat_cmsghdr __user *)((msg)->msg_control) : \
98338 + (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \
98339 (struct compat_cmsghdr __user *)NULL)
98340
98341 #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \
98342 ((ucmlen) >= sizeof(struct compat_cmsghdr) && \
98343 (ucmlen) <= (unsigned long) \
98344 ((mhdr)->msg_controllen - \
98345 - ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
98346 + ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control)))
98347
98348 static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg,
98349 struct compat_cmsghdr __user *cmsg, int cmsg_len)
98350 {
98351 char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len);
98352 - if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) >
98353 + if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) >
98354 msg->msg_controllen)
98355 return NULL;
98356 return (struct compat_cmsghdr __user *)ptr;
98357 @@ -222,7 +222,7 @@ Efault:
98358
98359 int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *data)
98360 {
98361 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
98362 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
98363 struct compat_cmsghdr cmhdr;
98364 struct compat_timeval ctv;
98365 struct compat_timespec cts[3];
98366 @@ -278,7 +278,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
98367
98368 void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
98369 {
98370 - struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control;
98371 + struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control;
98372 int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
98373 int fdnum = scm->fp->count;
98374 struct file **fp = scm->fp->fp;
98375 @@ -366,7 +366,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
98376 return -EFAULT;
98377 old_fs = get_fs();
98378 set_fs(KERNEL_DS);
98379 - err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime));
98380 + err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime));
98381 set_fs(old_fs);
98382
98383 return err;
98384 @@ -427,7 +427,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
98385 len = sizeof(ktime);
98386 old_fs = get_fs();
98387 set_fs(KERNEL_DS);
98388 - err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len);
98389 + err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len);
98390 set_fs(old_fs);
98391
98392 if (!err) {
98393 @@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
98394 case MCAST_JOIN_GROUP:
98395 case MCAST_LEAVE_GROUP:
98396 {
98397 - struct compat_group_req __user *gr32 = (void *)optval;
98398 + struct compat_group_req __user *gr32 = (void __user *)optval;
98399 struct group_req __user *kgr =
98400 compat_alloc_user_space(sizeof(struct group_req));
98401 u32 interface;
98402 @@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
98403 case MCAST_BLOCK_SOURCE:
98404 case MCAST_UNBLOCK_SOURCE:
98405 {
98406 - struct compat_group_source_req __user *gsr32 = (void *)optval;
98407 + struct compat_group_source_req __user *gsr32 = (void __user *)optval;
98408 struct group_source_req __user *kgsr = compat_alloc_user_space(
98409 sizeof(struct group_source_req));
98410 u32 interface;
98411 @@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
98412 }
98413 case MCAST_MSFILTER:
98414 {
98415 - struct compat_group_filter __user *gf32 = (void *)optval;
98416 + struct compat_group_filter __user *gf32 = (void __user *)optval;
98417 struct group_filter __user *kgf;
98418 u32 interface, fmode, numsrc;
98419
98420 @@ -650,7 +650,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
98421 char __user *optval, int __user *optlen,
98422 int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
98423 {
98424 - struct compat_group_filter __user *gf32 = (void *)optval;
98425 + struct compat_group_filter __user *gf32 = (void __user *)optval;
98426 struct group_filter __user *kgf;
98427 int __user *koptlen;
98428 u32 interface, fmode, numsrc;
98429 @@ -803,7 +803,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
98430
98431 if (call < SYS_SOCKET || call > SYS_SENDMMSG)
98432 return -EINVAL;
98433 - if (copy_from_user(a, args, nas[call]))
98434 + if (nas[call] > sizeof a || copy_from_user(a, args, nas[call]))
98435 return -EFAULT;
98436 a0 = a[0];
98437 a1 = a[1];
98438 diff --git a/net/core/datagram.c b/net/core/datagram.c
98439 index a16ed7b..eb44d17 100644
98440 --- a/net/core/datagram.c
98441 +++ b/net/core/datagram.c
98442 @@ -301,7 +301,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
98443 }
98444
98445 kfree_skb(skb);
98446 - atomic_inc(&sk->sk_drops);
98447 + atomic_inc_unchecked(&sk->sk_drops);
98448 sk_mem_reclaim_partial(sk);
98449
98450 return err;
98451 diff --git a/net/core/dev.c b/net/core/dev.c
98452 index fccc195..c8486ab 100644
98453 --- a/net/core/dev.c
98454 +++ b/net/core/dev.c
98455 @@ -1688,14 +1688,14 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
98456 {
98457 if (skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY) {
98458 if (skb_copy_ubufs(skb, GFP_ATOMIC)) {
98459 - atomic_long_inc(&dev->rx_dropped);
98460 + atomic_long_inc_unchecked(&dev->rx_dropped);
98461 kfree_skb(skb);
98462 return NET_RX_DROP;
98463 }
98464 }
98465
98466 if (unlikely(!is_skb_forwardable(dev, skb))) {
98467 - atomic_long_inc(&dev->rx_dropped);
98468 + atomic_long_inc_unchecked(&dev->rx_dropped);
98469 kfree_skb(skb);
98470 return NET_RX_DROP;
98471 }
98472 @@ -2453,7 +2453,7 @@ static int illegal_highdma(const struct net_device *dev, struct sk_buff *skb)
98473
98474 struct dev_gso_cb {
98475 void (*destructor)(struct sk_buff *skb);
98476 -};
98477 +} __no_const;
98478
98479 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb)
98480
98481 @@ -3227,7 +3227,7 @@ enqueue:
98482
98483 local_irq_restore(flags);
98484
98485 - atomic_long_inc(&skb->dev->rx_dropped);
98486 + atomic_long_inc_unchecked(&skb->dev->rx_dropped);
98487 kfree_skb(skb);
98488 return NET_RX_DROP;
98489 }
98490 @@ -3308,7 +3308,7 @@ int netif_rx_ni(struct sk_buff *skb)
98491 }
98492 EXPORT_SYMBOL(netif_rx_ni);
98493
98494 -static void net_tx_action(struct softirq_action *h)
98495 +static __latent_entropy void net_tx_action(void)
98496 {
98497 struct softnet_data *sd = &__get_cpu_var(softnet_data);
98498
98499 @@ -3645,7 +3645,7 @@ ncls:
98500 ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
98501 } else {
98502 drop:
98503 - atomic_long_inc(&skb->dev->rx_dropped);
98504 + atomic_long_inc_unchecked(&skb->dev->rx_dropped);
98505 kfree_skb(skb);
98506 /* Jamal, now you will not able to escape explaining
98507 * me how you were going to use this. :-)
98508 @@ -4333,7 +4333,7 @@ void netif_napi_del(struct napi_struct *napi)
98509 }
98510 EXPORT_SYMBOL(netif_napi_del);
98511
98512 -static void net_rx_action(struct softirq_action *h)
98513 +static __latent_entropy void net_rx_action(void)
98514 {
98515 struct softnet_data *sd = &__get_cpu_var(softnet_data);
98516 unsigned long time_limit = jiffies + 2;
98517 @@ -6302,7 +6302,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
98518 } else {
98519 netdev_stats_to_stats64(storage, &dev->stats);
98520 }
98521 - storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
98522 + storage->rx_dropped += atomic_long_read_unchecked(&dev->rx_dropped);
98523 return storage;
98524 }
98525 EXPORT_SYMBOL(dev_get_stats);
98526 diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
98527 index cf999e0..c59a975 100644
98528 --- a/net/core/dev_ioctl.c
98529 +++ b/net/core/dev_ioctl.c
98530 @@ -366,9 +366,13 @@ void dev_load(struct net *net, const char *name)
98531 if (no_module && capable(CAP_NET_ADMIN))
98532 no_module = request_module("netdev-%s", name);
98533 if (no_module && capable(CAP_SYS_MODULE)) {
98534 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
98535 + ___request_module(true, "grsec_modharden_netdev", "%s", name);
98536 +#else
98537 if (!request_module("%s", name))
98538 pr_warn("Loading kernel module for a network device with CAP_SYS_MODULE (deprecated). Use CAP_NET_ADMIN and alias netdev-%s instead.\n",
98539 name);
98540 +#endif
98541 }
98542 }
98543 EXPORT_SYMBOL(dev_load);
98544 diff --git a/net/core/filter.c b/net/core/filter.c
98545 index ebce437..9fed9d0 100644
98546 --- a/net/core/filter.c
98547 +++ b/net/core/filter.c
98548 @@ -126,7 +126,7 @@ unsigned int sk_run_filter(const struct sk_buff *skb,
98549 void *ptr;
98550 u32 A = 0; /* Accumulator */
98551 u32 X = 0; /* Index Register */
98552 - u32 mem[BPF_MEMWORDS]; /* Scratch Memory Store */
98553 + u32 mem[BPF_MEMWORDS] = {}; /* Scratch Memory Store */
98554 u32 tmp;
98555 int k;
98556
98557 @@ -292,10 +292,10 @@ load_b:
98558 X = K;
98559 continue;
98560 case BPF_S_LD_MEM:
98561 - A = mem[K];
98562 + A = mem[K&15];
98563 continue;
98564 case BPF_S_LDX_MEM:
98565 - X = mem[K];
98566 + X = mem[K&15];
98567 continue;
98568 case BPF_S_MISC_TAX:
98569 X = A;
98570 @@ -308,10 +308,10 @@ load_b:
98571 case BPF_S_RET_A:
98572 return A;
98573 case BPF_S_ST:
98574 - mem[K] = A;
98575 + mem[K&15] = A;
98576 continue;
98577 case BPF_S_STX:
98578 - mem[K] = X;
98579 + mem[K&15] = X;
98580 continue;
98581 case BPF_S_ANC_PROTOCOL:
98582 A = ntohs(skb->protocol);
98583 @@ -395,9 +395,10 @@ load_b:
98584 continue;
98585 #endif
98586 default:
98587 - WARN_RATELIMIT(1, "Unknown code:%u jt:%u tf:%u k:%u\n",
98588 + WARN(1, KERN_ALERT "Unknown sock filter code:%u jt:%u tf:%u k:%u\n",
98589 fentry->code, fentry->jt,
98590 fentry->jf, fentry->k);
98591 + BUG();
98592 return 0;
98593 }
98594 }
98595 @@ -420,7 +421,7 @@ static int check_load_and_stores(struct sock_filter *filter, int flen)
98596 u16 *masks, memvalid = 0; /* one bit per cell, 16 cells */
98597 int pc, ret = 0;
98598
98599 - BUILD_BUG_ON(BPF_MEMWORDS > 16);
98600 + BUILD_BUG_ON(BPF_MEMWORDS != 16);
98601 masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL);
98602 if (!masks)
98603 return -ENOMEM;
98604 @@ -683,7 +684,7 @@ int sk_unattached_filter_create(struct sk_filter **pfp,
98605 fp = kmalloc(sk_filter_size(fprog->len), GFP_KERNEL);
98606 if (!fp)
98607 return -ENOMEM;
98608 - memcpy(fp->insns, fprog->filter, fsize);
98609 + memcpy(fp->insns, (void __force_kernel *)fprog->filter, fsize);
98610
98611 atomic_set(&fp->refcnt, 1);
98612 fp->len = fprog->len;
98613 diff --git a/net/core/flow.c b/net/core/flow.c
98614 index dfa602c..3103d88 100644
98615 --- a/net/core/flow.c
98616 +++ b/net/core/flow.c
98617 @@ -61,7 +61,7 @@ struct flow_cache {
98618 struct timer_list rnd_timer;
98619 };
98620
98621 -atomic_t flow_cache_genid = ATOMIC_INIT(0);
98622 +atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
98623 EXPORT_SYMBOL(flow_cache_genid);
98624 static struct flow_cache flow_cache_global;
98625 static struct kmem_cache *flow_cachep __read_mostly;
98626 @@ -86,7 +86,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
98627
98628 static int flow_entry_valid(struct flow_cache_entry *fle)
98629 {
98630 - if (atomic_read(&flow_cache_genid) != fle->genid)
98631 + if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
98632 return 0;
98633 if (fle->object && !fle->object->ops->check(fle->object))
98634 return 0;
98635 @@ -258,7 +258,7 @@ flow_cache_lookup(struct net *net, const struct flowi *key, u16 family, u8 dir,
98636 hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
98637 fcp->hash_count++;
98638 }
98639 - } else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
98640 + } else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
98641 flo = fle->object;
98642 if (!flo)
98643 goto ret_object;
98644 @@ -279,7 +279,7 @@ nocache:
98645 }
98646 flo = resolver(net, key, family, dir, flo, ctx);
98647 if (fle) {
98648 - fle->genid = atomic_read(&flow_cache_genid);
98649 + fle->genid = atomic_read_unchecked(&flow_cache_genid);
98650 if (!IS_ERR(flo))
98651 fle->object = flo;
98652 else
98653 diff --git a/net/core/iovec.c b/net/core/iovec.c
98654 index b618694..192bbba 100644
98655 --- a/net/core/iovec.c
98656 +++ b/net/core/iovec.c
98657 @@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
98658 if (m->msg_namelen) {
98659 if (mode == VERIFY_READ) {
98660 void __user *namep;
98661 - namep = (void __user __force *) m->msg_name;
98662 + namep = (void __force_user *) m->msg_name;
98663 err = move_addr_to_kernel(namep, m->msg_namelen,
98664 address);
98665 if (err < 0)
98666 @@ -55,7 +55,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
98667 }
98668
98669 size = m->msg_iovlen * sizeof(struct iovec);
98670 - if (copy_from_user(iov, (void __user __force *) m->msg_iov, size))
98671 + if (copy_from_user(iov, (void __force_user *) m->msg_iov, size))
98672 return -EFAULT;
98673
98674 m->msg_iov = iov;
98675 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
98676 index 7d95f69..a6065de 100644
98677 --- a/net/core/neighbour.c
98678 +++ b/net/core/neighbour.c
98679 @@ -2824,7 +2824,7 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,
98680 void __user *buffer, size_t *lenp, loff_t *ppos)
98681 {
98682 int size, ret;
98683 - struct ctl_table tmp = *ctl;
98684 + ctl_table_no_const tmp = *ctl;
98685
98686 tmp.extra1 = &zero;
98687 tmp.extra2 = &unres_qlen_max;
98688 @@ -2886,7 +2886,7 @@ static int neigh_proc_dointvec_zero_intmax(struct ctl_table *ctl, int write,
98689 void __user *buffer,
98690 size_t *lenp, loff_t *ppos)
98691 {
98692 - struct ctl_table tmp = *ctl;
98693 + ctl_table_no_const tmp = *ctl;
98694 int ret;
98695
98696 tmp.extra1 = &zero;
98697 @@ -3058,11 +3058,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
98698 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
98699 sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
98700 } else {
98701 + struct neigh_table *ntable = container_of(p, struct neigh_table, parms);
98702 dev_name_source = "default";
98703 - t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = (int *)(p + 1);
98704 - t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = (int *)(p + 1) + 1;
98705 - t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = (int *)(p + 1) + 2;
98706 - t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = (int *)(p + 1) + 3;
98707 + t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &ntable->gc_interval;
98708 + t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &ntable->gc_thresh1;
98709 + t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &ntable->gc_thresh2;
98710 + t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &ntable->gc_thresh3;
98711 }
98712
98713 if (handler) {
98714 diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c
98715 index 2bf8329..2eb1423 100644
98716 --- a/net/core/net-procfs.c
98717 +++ b/net/core/net-procfs.c
98718 @@ -79,7 +79,13 @@ static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
98719 struct rtnl_link_stats64 temp;
98720 const struct rtnl_link_stats64 *stats = dev_get_stats(dev, &temp);
98721
98722 - seq_printf(seq, "%6s: %7llu %7llu %4llu %4llu %4llu %5llu %10llu %9llu "
98723 + if (gr_proc_is_restricted())
98724 + seq_printf(seq, "%6s: %7llu %7llu %4llu %4llu %4llu %5llu %10llu %9llu "
98725 + "%8llu %7llu %4llu %4llu %4llu %5llu %7llu %10llu\n",
98726 + dev->name, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL,
98727 + 0ULL, 0ULL, 0ULL, 0ULL, 0ULL, 0ULL);
98728 + else
98729 + seq_printf(seq, "%6s: %7llu %7llu %4llu %4llu %4llu %5llu %10llu %9llu "
98730 "%8llu %7llu %4llu %4llu %4llu %5llu %7llu %10llu\n",
98731 dev->name, stats->rx_bytes, stats->rx_packets,
98732 stats->rx_errors,
98733 @@ -166,7 +172,7 @@ static int softnet_seq_show(struct seq_file *seq, void *v)
98734 return 0;
98735 }
98736
98737 -static const struct seq_operations dev_seq_ops = {
98738 +const struct seq_operations dev_seq_ops = {
98739 .start = dev_seq_start,
98740 .next = dev_seq_next,
98741 .stop = dev_seq_stop,
98742 @@ -196,7 +202,7 @@ static const struct seq_operations softnet_seq_ops = {
98743
98744 static int softnet_seq_open(struct inode *inode, struct file *file)
98745 {
98746 - return seq_open(file, &softnet_seq_ops);
98747 + return seq_open_restrict(file, &softnet_seq_ops);
98748 }
98749
98750 static const struct file_operations softnet_seq_fops = {
98751 @@ -283,8 +289,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
98752 else
98753 seq_printf(seq, "%04x", ntohs(pt->type));
98754
98755 +#ifdef CONFIG_GRKERNSEC_HIDESYM
98756 + seq_printf(seq, " %-8s %pf\n",
98757 + pt->dev ? pt->dev->name : "", NULL);
98758 +#else
98759 seq_printf(seq, " %-8s %pf\n",
98760 pt->dev ? pt->dev->name : "", pt->func);
98761 +#endif
98762 }
98763
98764 return 0;
98765 diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
98766 index 7c8ffd9..0cb3687 100644
98767 --- a/net/core/net_namespace.c
98768 +++ b/net/core/net_namespace.c
98769 @@ -443,7 +443,7 @@ static int __register_pernet_operations(struct list_head *list,
98770 int error;
98771 LIST_HEAD(net_exit_list);
98772
98773 - list_add_tail(&ops->list, list);
98774 + pax_list_add_tail((struct list_head *)&ops->list, list);
98775 if (ops->init || (ops->id && ops->size)) {
98776 for_each_net(net) {
98777 error = ops_init(ops, net);
98778 @@ -456,7 +456,7 @@ static int __register_pernet_operations(struct list_head *list,
98779
98780 out_undo:
98781 /* If I have an error cleanup all namespaces I initialized */
98782 - list_del(&ops->list);
98783 + pax_list_del((struct list_head *)&ops->list);
98784 ops_exit_list(ops, &net_exit_list);
98785 ops_free_list(ops, &net_exit_list);
98786 return error;
98787 @@ -467,7 +467,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
98788 struct net *net;
98789 LIST_HEAD(net_exit_list);
98790
98791 - list_del(&ops->list);
98792 + pax_list_del((struct list_head *)&ops->list);
98793 for_each_net(net)
98794 list_add_tail(&net->exit_list, &net_exit_list);
98795 ops_exit_list(ops, &net_exit_list);
98796 @@ -601,7 +601,7 @@ int register_pernet_device(struct pernet_operations *ops)
98797 mutex_lock(&net_mutex);
98798 error = register_pernet_operations(&pernet_list, ops);
98799 if (!error && (first_device == &pernet_list))
98800 - first_device = &ops->list;
98801 + first_device = (struct list_head *)&ops->list;
98802 mutex_unlock(&net_mutex);
98803 return error;
98804 }
98805 diff --git a/net/core/netpoll.c b/net/core/netpoll.c
98806 index df9e6b1..6e68e4e 100644
98807 --- a/net/core/netpoll.c
98808 +++ b/net/core/netpoll.c
98809 @@ -435,7 +435,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
98810 struct udphdr *udph;
98811 struct iphdr *iph;
98812 struct ethhdr *eth;
98813 - static atomic_t ip_ident;
98814 + static atomic_unchecked_t ip_ident;
98815 struct ipv6hdr *ip6h;
98816
98817 udp_len = len + sizeof(*udph);
98818 @@ -506,7 +506,7 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
98819 put_unaligned(0x45, (unsigned char *)iph);
98820 iph->tos = 0;
98821 put_unaligned(htons(ip_len), &(iph->tot_len));
98822 - iph->id = htons(atomic_inc_return(&ip_ident));
98823 + iph->id = htons(atomic_inc_return_unchecked(&ip_ident));
98824 iph->frag_off = 0;
98825 iph->ttl = 64;
98826 iph->protocol = IPPROTO_UDP;
98827 diff --git a/net/core/pktgen.c b/net/core/pktgen.c
98828 index fdac61c..e5e5b46 100644
98829 --- a/net/core/pktgen.c
98830 +++ b/net/core/pktgen.c
98831 @@ -3719,7 +3719,7 @@ static int __net_init pg_net_init(struct net *net)
98832 pn->net = net;
98833 INIT_LIST_HEAD(&pn->pktgen_threads);
98834 pn->pktgen_exiting = false;
98835 - pn->proc_dir = proc_mkdir(PG_PROC_DIR, pn->net->proc_net);
98836 + pn->proc_dir = proc_mkdir_restrict(PG_PROC_DIR, pn->net->proc_net);
98837 if (!pn->proc_dir) {
98838 pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
98839 return -ENODEV;
98840 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
98841 index 83b9d6a..cff1ce7 100644
98842 --- a/net/core/rtnetlink.c
98843 +++ b/net/core/rtnetlink.c
98844 @@ -58,7 +58,7 @@ struct rtnl_link {
98845 rtnl_doit_func doit;
98846 rtnl_dumpit_func dumpit;
98847 rtnl_calcit_func calcit;
98848 -};
98849 +} __no_const;
98850
98851 static DEFINE_MUTEX(rtnl_mutex);
98852
98853 @@ -299,10 +299,13 @@ int __rtnl_link_register(struct rtnl_link_ops *ops)
98854 if (rtnl_link_ops_get(ops->kind))
98855 return -EEXIST;
98856
98857 - if (!ops->dellink)
98858 - ops->dellink = unregister_netdevice_queue;
98859 + if (!ops->dellink) {
98860 + pax_open_kernel();
98861 + *(void **)&ops->dellink = unregister_netdevice_queue;
98862 + pax_close_kernel();
98863 + }
98864
98865 - list_add_tail(&ops->list, &link_ops);
98866 + pax_list_add_tail((struct list_head *)&ops->list, &link_ops);
98867 return 0;
98868 }
98869 EXPORT_SYMBOL_GPL(__rtnl_link_register);
98870 @@ -349,7 +352,7 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops)
98871 for_each_net(net) {
98872 __rtnl_kill_links(net, ops);
98873 }
98874 - list_del(&ops->list);
98875 + pax_list_del((struct list_head *)&ops->list);
98876 }
98877 EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
98878
98879 diff --git a/net/core/scm.c b/net/core/scm.c
98880 index b442e7e..6f5b5a2 100644
98881 --- a/net/core/scm.c
98882 +++ b/net/core/scm.c
98883 @@ -210,7 +210,7 @@ EXPORT_SYMBOL(__scm_send);
98884 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
98885 {
98886 struct cmsghdr __user *cm
98887 - = (__force struct cmsghdr __user *)msg->msg_control;
98888 + = (struct cmsghdr __force_user *)msg->msg_control;
98889 struct cmsghdr cmhdr;
98890 int cmlen = CMSG_LEN(len);
98891 int err;
98892 @@ -233,7 +233,7 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
98893 err = -EFAULT;
98894 if (copy_to_user(cm, &cmhdr, sizeof cmhdr))
98895 goto out;
98896 - if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
98897 + if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr)))
98898 goto out;
98899 cmlen = CMSG_SPACE(len);
98900 if (msg->msg_controllen < cmlen)
98901 @@ -249,7 +249,7 @@ EXPORT_SYMBOL(put_cmsg);
98902 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
98903 {
98904 struct cmsghdr __user *cm
98905 - = (__force struct cmsghdr __user*)msg->msg_control;
98906 + = (struct cmsghdr __force_user *)msg->msg_control;
98907
98908 int fdmax = 0;
98909 int fdnum = scm->fp->count;
98910 @@ -269,7 +269,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
98911 if (fdnum < fdmax)
98912 fdmax = fdnum;
98913
98914 - for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax;
98915 + for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax;
98916 i++, cmfptr++)
98917 {
98918 struct socket *sock;
98919 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
98920 index e5ae776e..15c90cb 100644
98921 --- a/net/core/skbuff.c
98922 +++ b/net/core/skbuff.c
98923 @@ -2003,7 +2003,7 @@ EXPORT_SYMBOL(__skb_checksum);
98924 __wsum skb_checksum(const struct sk_buff *skb, int offset,
98925 int len, __wsum csum)
98926 {
98927 - const struct skb_checksum_ops ops = {
98928 + static const struct skb_checksum_ops ops = {
98929 .update = csum_partial_ext,
98930 .combine = csum_block_add_ext,
98931 };
98932 @@ -3220,13 +3220,15 @@ void __init skb_init(void)
98933 skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
98934 sizeof(struct sk_buff),
98935 0,
98936 - SLAB_HWCACHE_ALIGN|SLAB_PANIC,
98937 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|
98938 + SLAB_NO_SANITIZE,
98939 NULL);
98940 skbuff_fclone_cache = kmem_cache_create("skbuff_fclone_cache",
98941 (2*sizeof(struct sk_buff)) +
98942 sizeof(atomic_t),
98943 0,
98944 - SLAB_HWCACHE_ALIGN|SLAB_PANIC,
98945 + SLAB_HWCACHE_ALIGN|SLAB_PANIC|
98946 + SLAB_NO_SANITIZE,
98947 NULL);
98948 }
98949
98950 diff --git a/net/core/sock.c b/net/core/sock.c
98951 index c0fc6bd..51d8326 100644
98952 --- a/net/core/sock.c
98953 +++ b/net/core/sock.c
98954 @@ -393,7 +393,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
98955 struct sk_buff_head *list = &sk->sk_receive_queue;
98956
98957 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
98958 - atomic_inc(&sk->sk_drops);
98959 + atomic_inc_unchecked(&sk->sk_drops);
98960 trace_sock_rcvqueue_full(sk, skb);
98961 return -ENOMEM;
98962 }
98963 @@ -403,7 +403,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
98964 return err;
98965
98966 if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
98967 - atomic_inc(&sk->sk_drops);
98968 + atomic_inc_unchecked(&sk->sk_drops);
98969 return -ENOBUFS;
98970 }
98971
98972 @@ -423,7 +423,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
98973 skb_dst_force(skb);
98974
98975 spin_lock_irqsave(&list->lock, flags);
98976 - skb->dropcount = atomic_read(&sk->sk_drops);
98977 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
98978 __skb_queue_tail(list, skb);
98979 spin_unlock_irqrestore(&list->lock, flags);
98980
98981 @@ -443,7 +443,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
98982 skb->dev = NULL;
98983
98984 if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf)) {
98985 - atomic_inc(&sk->sk_drops);
98986 + atomic_inc_unchecked(&sk->sk_drops);
98987 goto discard_and_relse;
98988 }
98989 if (nested)
98990 @@ -461,7 +461,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
98991 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
98992 } else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
98993 bh_unlock_sock(sk);
98994 - atomic_inc(&sk->sk_drops);
98995 + atomic_inc_unchecked(&sk->sk_drops);
98996 goto discard_and_relse;
98997 }
98998
98999 @@ -949,12 +949,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
99000 struct timeval tm;
99001 } v;
99002
99003 - int lv = sizeof(int);
99004 - int len;
99005 + unsigned int lv = sizeof(int);
99006 + unsigned int len;
99007
99008 if (get_user(len, optlen))
99009 return -EFAULT;
99010 - if (len < 0)
99011 + if (len > INT_MAX)
99012 return -EINVAL;
99013
99014 memset(&v, 0, sizeof(v));
99015 @@ -1106,11 +1106,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
99016
99017 case SO_PEERNAME:
99018 {
99019 - char address[128];
99020 + char address[_K_SS_MAXSIZE];
99021
99022 if (sock->ops->getname(sock, (struct sockaddr *)address, &lv, 2))
99023 return -ENOTCONN;
99024 - if (lv < len)
99025 + if (lv < len || sizeof address < len)
99026 return -EINVAL;
99027 if (copy_to_user(optval, address, len))
99028 return -EFAULT;
99029 @@ -1191,7 +1191,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
99030
99031 if (len > lv)
99032 len = lv;
99033 - if (copy_to_user(optval, &v, len))
99034 + if (len > sizeof(v) || copy_to_user(optval, &v, len))
99035 return -EFAULT;
99036 lenout:
99037 if (put_user(len, optlen))
99038 @@ -2326,7 +2326,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
99039 */
99040 smp_wmb();
99041 atomic_set(&sk->sk_refcnt, 1);
99042 - atomic_set(&sk->sk_drops, 0);
99043 + atomic_set_unchecked(&sk->sk_drops, 0);
99044 }
99045 EXPORT_SYMBOL(sock_init_data);
99046
99047 @@ -2454,6 +2454,7 @@ void sock_enable_timestamp(struct sock *sk, int flag)
99048 int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
99049 int level, int type)
99050 {
99051 + struct sock_extended_err ee;
99052 struct sock_exterr_skb *serr;
99053 struct sk_buff *skb, *skb2;
99054 int copied, err;
99055 @@ -2475,7 +2476,8 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len,
99056 sock_recv_timestamp(msg, sk, skb);
99057
99058 serr = SKB_EXT_ERR(skb);
99059 - put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee);
99060 + ee = serr->ee;
99061 + put_cmsg(msg, level, type, sizeof ee, &ee);
99062
99063 msg->msg_flags |= MSG_ERRQUEUE;
99064 err = copied;
99065 diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
99066 index 6a7fae2..d7c22e6 100644
99067 --- a/net/core/sock_diag.c
99068 +++ b/net/core/sock_diag.c
99069 @@ -9,26 +9,33 @@
99070 #include <linux/inet_diag.h>
99071 #include <linux/sock_diag.h>
99072
99073 -static const struct sock_diag_handler *sock_diag_handlers[AF_MAX];
99074 +static const struct sock_diag_handler *sock_diag_handlers[AF_MAX] __read_only;
99075 static int (*inet_rcv_compat)(struct sk_buff *skb, struct nlmsghdr *nlh);
99076 static DEFINE_MUTEX(sock_diag_table_mutex);
99077
99078 int sock_diag_check_cookie(void *sk, __u32 *cookie)
99079 {
99080 +#ifndef CONFIG_GRKERNSEC_HIDESYM
99081 if ((cookie[0] != INET_DIAG_NOCOOKIE ||
99082 cookie[1] != INET_DIAG_NOCOOKIE) &&
99083 ((u32)(unsigned long)sk != cookie[0] ||
99084 (u32)((((unsigned long)sk) >> 31) >> 1) != cookie[1]))
99085 return -ESTALE;
99086 else
99087 +#endif
99088 return 0;
99089 }
99090 EXPORT_SYMBOL_GPL(sock_diag_check_cookie);
99091
99092 void sock_diag_save_cookie(void *sk, __u32 *cookie)
99093 {
99094 +#ifdef CONFIG_GRKERNSEC_HIDESYM
99095 + cookie[0] = 0;
99096 + cookie[1] = 0;
99097 +#else
99098 cookie[0] = (u32)(unsigned long)sk;
99099 cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
99100 +#endif
99101 }
99102 EXPORT_SYMBOL_GPL(sock_diag_save_cookie);
99103
99104 @@ -113,8 +120,11 @@ int sock_diag_register(const struct sock_diag_handler *hndl)
99105 mutex_lock(&sock_diag_table_mutex);
99106 if (sock_diag_handlers[hndl->family])
99107 err = -EBUSY;
99108 - else
99109 + else {
99110 + pax_open_kernel();
99111 sock_diag_handlers[hndl->family] = hndl;
99112 + pax_close_kernel();
99113 + }
99114 mutex_unlock(&sock_diag_table_mutex);
99115
99116 return err;
99117 @@ -130,7 +140,9 @@ void sock_diag_unregister(const struct sock_diag_handler *hnld)
99118
99119 mutex_lock(&sock_diag_table_mutex);
99120 BUG_ON(sock_diag_handlers[family] != hnld);
99121 + pax_open_kernel();
99122 sock_diag_handlers[family] = NULL;
99123 + pax_close_kernel();
99124 mutex_unlock(&sock_diag_table_mutex);
99125 }
99126 EXPORT_SYMBOL_GPL(sock_diag_unregister);
99127 diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
99128 index cf9cd13..8b56af3 100644
99129 --- a/net/core/sysctl_net_core.c
99130 +++ b/net/core/sysctl_net_core.c
99131 @@ -32,7 +32,7 @@ static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
99132 {
99133 unsigned int orig_size, size;
99134 int ret, i;
99135 - struct ctl_table tmp = {
99136 + ctl_table_no_const tmp = {
99137 .data = &size,
99138 .maxlen = sizeof(size),
99139 .mode = table->mode
99140 @@ -200,7 +200,7 @@ static int set_default_qdisc(struct ctl_table *table, int write,
99141 void __user *buffer, size_t *lenp, loff_t *ppos)
99142 {
99143 char id[IFNAMSIZ];
99144 - struct ctl_table tbl = {
99145 + ctl_table_no_const tbl = {
99146 .data = id,
99147 .maxlen = IFNAMSIZ,
99148 };
99149 @@ -379,13 +379,12 @@ static struct ctl_table netns_core_table[] = {
99150
99151 static __net_init int sysctl_core_net_init(struct net *net)
99152 {
99153 - struct ctl_table *tbl;
99154 + ctl_table_no_const *tbl = NULL;
99155
99156 net->core.sysctl_somaxconn = SOMAXCONN;
99157
99158 - tbl = netns_core_table;
99159 if (!net_eq(net, &init_net)) {
99160 - tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
99161 + tbl = kmemdup(netns_core_table, sizeof(netns_core_table), GFP_KERNEL);
99162 if (tbl == NULL)
99163 goto err_dup;
99164
99165 @@ -395,17 +394,16 @@ static __net_init int sysctl_core_net_init(struct net *net)
99166 if (net->user_ns != &init_user_ns) {
99167 tbl[0].procname = NULL;
99168 }
99169 - }
99170 -
99171 - net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl);
99172 + net->core.sysctl_hdr = register_net_sysctl(net, "net/core", tbl);
99173 + } else
99174 + net->core.sysctl_hdr = register_net_sysctl(net, "net/core", netns_core_table);
99175 if (net->core.sysctl_hdr == NULL)
99176 goto err_reg;
99177
99178 return 0;
99179
99180 err_reg:
99181 - if (tbl != netns_core_table)
99182 - kfree(tbl);
99183 + kfree(tbl);
99184 err_dup:
99185 return -ENOMEM;
99186 }
99187 @@ -420,7 +418,7 @@ static __net_exit void sysctl_core_net_exit(struct net *net)
99188 kfree(tbl);
99189 }
99190
99191 -static __net_initdata struct pernet_operations sysctl_core_ops = {
99192 +static __net_initconst struct pernet_operations sysctl_core_ops = {
99193 .init = sysctl_core_net_init,
99194 .exit = sysctl_core_net_exit,
99195 };
99196 diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
99197 index 4c04848..f575934 100644
99198 --- a/net/decnet/af_decnet.c
99199 +++ b/net/decnet/af_decnet.c
99200 @@ -465,6 +465,7 @@ static struct proto dn_proto = {
99201 .sysctl_rmem = sysctl_decnet_rmem,
99202 .max_header = DN_MAX_NSP_DATA_HEADER + 64,
99203 .obj_size = sizeof(struct dn_sock),
99204 + .slab_flags = SLAB_USERCOPY,
99205 };
99206
99207 static struct sock *dn_alloc_sock(struct net *net, struct socket *sock, gfp_t gfp)
99208 diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
99209 index a603823..a36ee0b 100644
99210 --- a/net/decnet/dn_dev.c
99211 +++ b/net/decnet/dn_dev.c
99212 @@ -200,7 +200,7 @@ static struct dn_dev_sysctl_table {
99213 .extra1 = &min_t3,
99214 .extra2 = &max_t3
99215 },
99216 - {0}
99217 + { }
99218 },
99219 };
99220
99221 diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
99222 index 5325b54..a0d4d69 100644
99223 --- a/net/decnet/sysctl_net_decnet.c
99224 +++ b/net/decnet/sysctl_net_decnet.c
99225 @@ -174,7 +174,7 @@ static int dn_node_address_handler(struct ctl_table *table, int write,
99226
99227 if (len > *lenp) len = *lenp;
99228
99229 - if (copy_to_user(buffer, addr, len))
99230 + if (len > sizeof addr || copy_to_user(buffer, addr, len))
99231 return -EFAULT;
99232
99233 *lenp = len;
99234 @@ -237,7 +237,7 @@ static int dn_def_dev_handler(struct ctl_table *table, int write,
99235
99236 if (len > *lenp) len = *lenp;
99237
99238 - if (copy_to_user(buffer, devname, len))
99239 + if (len > sizeof devname || copy_to_user(buffer, devname, len))
99240 return -EFAULT;
99241
99242 *lenp = len;
99243 diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
99244 index 1846c1f..96d4a9f 100644
99245 --- a/net/ieee802154/dgram.c
99246 +++ b/net/ieee802154/dgram.c
99247 @@ -313,8 +313,9 @@ static int dgram_recvmsg(struct kiocb *iocb, struct sock *sk,
99248 if (saddr) {
99249 saddr->family = AF_IEEE802154;
99250 saddr->addr = mac_cb(skb)->sa;
99251 + }
99252 + if (addr_len)
99253 *addr_len = sizeof(*saddr);
99254 - }
99255
99256 if (flags & MSG_TRUNC)
99257 copied = skb->len;
99258 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
99259 index 19ab78a..bf575c9 100644
99260 --- a/net/ipv4/af_inet.c
99261 +++ b/net/ipv4/af_inet.c
99262 @@ -1703,13 +1703,9 @@ static int __init inet_init(void)
99263
99264 BUILD_BUG_ON(sizeof(struct inet_skb_parm) > FIELD_SIZEOF(struct sk_buff, cb));
99265
99266 - sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
99267 - if (!sysctl_local_reserved_ports)
99268 - goto out;
99269 -
99270 rc = proto_register(&tcp_prot, 1);
99271 if (rc)
99272 - goto out_free_reserved_ports;
99273 + goto out;
99274
99275 rc = proto_register(&udp_prot, 1);
99276 if (rc)
99277 @@ -1816,8 +1812,6 @@ out_unregister_udp_proto:
99278 proto_unregister(&udp_prot);
99279 out_unregister_tcp_proto:
99280 proto_unregister(&tcp_prot);
99281 -out_free_reserved_ports:
99282 - kfree(sysctl_local_reserved_ports);
99283 goto out;
99284 }
99285
99286 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
99287 index bdbf68b..deb4759 100644
99288 --- a/net/ipv4/devinet.c
99289 +++ b/net/ipv4/devinet.c
99290 @@ -1543,7 +1543,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
99291 idx = 0;
99292 head = &net->dev_index_head[h];
99293 rcu_read_lock();
99294 - cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^
99295 + cb->seq = atomic_read_unchecked(&net->ipv4.dev_addr_genid) ^
99296 net->dev_base_seq;
99297 hlist_for_each_entry_rcu(dev, head, index_hlist) {
99298 if (idx < s_idx)
99299 @@ -1861,7 +1861,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb,
99300 idx = 0;
99301 head = &net->dev_index_head[h];
99302 rcu_read_lock();
99303 - cb->seq = atomic_read(&net->ipv4.dev_addr_genid) ^
99304 + cb->seq = atomic_read_unchecked(&net->ipv4.dev_addr_genid) ^
99305 net->dev_base_seq;
99306 hlist_for_each_entry_rcu(dev, head, index_hlist) {
99307 if (idx < s_idx)
99308 @@ -2096,7 +2096,7 @@ static int ipv4_doint_and_flush(struct ctl_table *ctl, int write,
99309 #define DEVINET_SYSCTL_FLUSHING_ENTRY(attr, name) \
99310 DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush)
99311
99312 -static struct devinet_sysctl_table {
99313 +static const struct devinet_sysctl_table {
99314 struct ctl_table_header *sysctl_header;
99315 struct ctl_table devinet_vars[__IPV4_DEVCONF_MAX];
99316 } devinet_sysctl = {
99317 @@ -2218,7 +2218,7 @@ static __net_init int devinet_init_net(struct net *net)
99318 int err;
99319 struct ipv4_devconf *all, *dflt;
99320 #ifdef CONFIG_SYSCTL
99321 - struct ctl_table *tbl = ctl_forward_entry;
99322 + ctl_table_no_const *tbl = NULL;
99323 struct ctl_table_header *forw_hdr;
99324 #endif
99325
99326 @@ -2236,7 +2236,7 @@ static __net_init int devinet_init_net(struct net *net)
99327 goto err_alloc_dflt;
99328
99329 #ifdef CONFIG_SYSCTL
99330 - tbl = kmemdup(tbl, sizeof(ctl_forward_entry), GFP_KERNEL);
99331 + tbl = kmemdup(ctl_forward_entry, sizeof(ctl_forward_entry), GFP_KERNEL);
99332 if (tbl == NULL)
99333 goto err_alloc_ctl;
99334
99335 @@ -2256,7 +2256,10 @@ static __net_init int devinet_init_net(struct net *net)
99336 goto err_reg_dflt;
99337
99338 err = -ENOMEM;
99339 - forw_hdr = register_net_sysctl(net, "net/ipv4", tbl);
99340 + if (!net_eq(net, &init_net))
99341 + forw_hdr = register_net_sysctl(net, "net/ipv4", tbl);
99342 + else
99343 + forw_hdr = register_net_sysctl(net, "net/ipv4", ctl_forward_entry);
99344 if (forw_hdr == NULL)
99345 goto err_reg_ctl;
99346 net->ipv4.forw_hdr = forw_hdr;
99347 @@ -2272,8 +2275,7 @@ err_reg_ctl:
99348 err_reg_dflt:
99349 __devinet_sysctl_unregister(all);
99350 err_reg_all:
99351 - if (tbl != ctl_forward_entry)
99352 - kfree(tbl);
99353 + kfree(tbl);
99354 err_alloc_ctl:
99355 #endif
99356 if (dflt != &ipv4_devconf_dflt)
99357 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
99358 index c7539e2..b455e51 100644
99359 --- a/net/ipv4/fib_frontend.c
99360 +++ b/net/ipv4/fib_frontend.c
99361 @@ -1015,12 +1015,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
99362 #ifdef CONFIG_IP_ROUTE_MULTIPATH
99363 fib_sync_up(dev);
99364 #endif
99365 - atomic_inc(&net->ipv4.dev_addr_genid);
99366 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
99367 rt_cache_flush(dev_net(dev));
99368 break;
99369 case NETDEV_DOWN:
99370 fib_del_ifaddr(ifa, NULL);
99371 - atomic_inc(&net->ipv4.dev_addr_genid);
99372 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
99373 if (ifa->ifa_dev->ifa_list == NULL) {
99374 /* Last address was deleted from this interface.
99375 * Disable IP.
99376 @@ -1058,7 +1058,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
99377 #ifdef CONFIG_IP_ROUTE_MULTIPATH
99378 fib_sync_up(dev);
99379 #endif
99380 - atomic_inc(&net->ipv4.dev_addr_genid);
99381 + atomic_inc_unchecked(&net->ipv4.dev_addr_genid);
99382 rt_cache_flush(net);
99383 break;
99384 case NETDEV_DOWN:
99385 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
99386 index 9d43468..ffa28cc 100644
99387 --- a/net/ipv4/fib_semantics.c
99388 +++ b/net/ipv4/fib_semantics.c
99389 @@ -767,7 +767,7 @@ __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh)
99390 nh->nh_saddr = inet_select_addr(nh->nh_dev,
99391 nh->nh_gw,
99392 nh->nh_parent->fib_scope);
99393 - nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
99394 + nh->nh_saddr_genid = atomic_read_unchecked(&net->ipv4.dev_addr_genid);
99395
99396 return nh->nh_saddr;
99397 }
99398 diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
99399 index 0d1e2cb..4501a2c 100644
99400 --- a/net/ipv4/inet_connection_sock.c
99401 +++ b/net/ipv4/inet_connection_sock.c
99402 @@ -29,7 +29,7 @@ const char inet_csk_timer_bug_msg[] = "inet_csk BUG: unknown timer value\n";
99403 EXPORT_SYMBOL(inet_csk_timer_bug_msg);
99404 #endif
99405
99406 -unsigned long *sysctl_local_reserved_ports;
99407 +unsigned long sysctl_local_reserved_ports[65536 / 8 / sizeof(unsigned long)];
99408 EXPORT_SYMBOL(sysctl_local_reserved_ports);
99409
99410 void inet_get_local_port_range(struct net *net, int *low, int *high)
99411 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
99412 index 8b9cf27..0d8d592 100644
99413 --- a/net/ipv4/inet_hashtables.c
99414 +++ b/net/ipv4/inet_hashtables.c
99415 @@ -18,6 +18,7 @@
99416 #include <linux/sched.h>
99417 #include <linux/slab.h>
99418 #include <linux/wait.h>
99419 +#include <linux/security.h>
99420
99421 #include <net/inet_connection_sock.h>
99422 #include <net/inet_hashtables.h>
99423 @@ -49,6 +50,8 @@ static unsigned int inet_sk_ehashfn(const struct sock *sk)
99424 return inet_ehashfn(net, laddr, lport, faddr, fport);
99425 }
99426
99427 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
99428 +
99429 /*
99430 * Allocate and initialize a new local port bind bucket.
99431 * The bindhash mutex for snum's hash chain must be held here.
99432 @@ -554,6 +557,8 @@ ok:
99433 twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
99434 spin_unlock(&head->lock);
99435
99436 + gr_update_task_in_ip_table(current, inet_sk(sk));
99437 +
99438 if (tw) {
99439 inet_twsk_deschedule(tw, death_row);
99440 while (twrefcnt) {
99441 diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
99442 index 48f4244..f56d83a 100644
99443 --- a/net/ipv4/inetpeer.c
99444 +++ b/net/ipv4/inetpeer.c
99445 @@ -496,8 +496,8 @@ relookup:
99446 if (p) {
99447 p->daddr = *daddr;
99448 atomic_set(&p->refcnt, 1);
99449 - atomic_set(&p->rid, 0);
99450 - atomic_set(&p->ip_id_count,
99451 + atomic_set_unchecked(&p->rid, 0);
99452 + atomic_set_unchecked(&p->ip_id_count,
99453 (daddr->family == AF_INET) ?
99454 secure_ip_id(daddr->addr.a4) :
99455 secure_ipv6_id(daddr->addr.a6));
99456 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
99457 index c10a3ce..dd71f84 100644
99458 --- a/net/ipv4/ip_fragment.c
99459 +++ b/net/ipv4/ip_fragment.c
99460 @@ -283,7 +283,7 @@ static inline int ip_frag_too_far(struct ipq *qp)
99461 return 0;
99462
99463 start = qp->rid;
99464 - end = atomic_inc_return(&peer->rid);
99465 + end = atomic_inc_return_unchecked(&peer->rid);
99466 qp->rid = end;
99467
99468 rc = qp->q.fragments && (end - start) > max;
99469 @@ -760,12 +760,11 @@ static struct ctl_table ip4_frags_ctl_table[] = {
99470
99471 static int __net_init ip4_frags_ns_ctl_register(struct net *net)
99472 {
99473 - struct ctl_table *table;
99474 + ctl_table_no_const *table = NULL;
99475 struct ctl_table_header *hdr;
99476
99477 - table = ip4_frags_ns_ctl_table;
99478 if (!net_eq(net, &init_net)) {
99479 - table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
99480 + table = kmemdup(ip4_frags_ns_ctl_table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
99481 if (table == NULL)
99482 goto err_alloc;
99483
99484 @@ -776,9 +775,10 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net)
99485 /* Don't export sysctls to unprivileged users */
99486 if (net->user_ns != &init_user_ns)
99487 table[0].procname = NULL;
99488 - }
99489 + hdr = register_net_sysctl(net, "net/ipv4", table);
99490 + } else
99491 + hdr = register_net_sysctl(net, "net/ipv4", ip4_frags_ns_ctl_table);
99492
99493 - hdr = register_net_sysctl(net, "net/ipv4", table);
99494 if (hdr == NULL)
99495 goto err_reg;
99496
99497 @@ -786,8 +786,7 @@ static int __net_init ip4_frags_ns_ctl_register(struct net *net)
99498 return 0;
99499
99500 err_reg:
99501 - if (!net_eq(net, &init_net))
99502 - kfree(table);
99503 + kfree(table);
99504 err_alloc:
99505 return -ENOMEM;
99506 }
99507 diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
99508 index 94213c8..8bdb342 100644
99509 --- a/net/ipv4/ip_gre.c
99510 +++ b/net/ipv4/ip_gre.c
99511 @@ -115,7 +115,7 @@ static bool log_ecn_error = true;
99512 module_param(log_ecn_error, bool, 0644);
99513 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
99514
99515 -static struct rtnl_link_ops ipgre_link_ops __read_mostly;
99516 +static struct rtnl_link_ops ipgre_link_ops;
99517 static int ipgre_tunnel_init(struct net_device *dev);
99518
99519 static int ipgre_net_id __read_mostly;
99520 @@ -732,7 +732,7 @@ static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
99521 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 },
99522 };
99523
99524 -static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
99525 +static struct rtnl_link_ops ipgre_link_ops = {
99526 .kind = "gre",
99527 .maxtype = IFLA_GRE_MAX,
99528 .policy = ipgre_policy,
99529 @@ -746,7 +746,7 @@ static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
99530 .fill_info = ipgre_fill_info,
99531 };
99532
99533 -static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
99534 +static struct rtnl_link_ops ipgre_tap_ops = {
99535 .kind = "gretap",
99536 .maxtype = IFLA_GRE_MAX,
99537 .policy = ipgre_policy,
99538 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
99539 index 580dd96..9fcef7e 100644
99540 --- a/net/ipv4/ip_sockglue.c
99541 +++ b/net/ipv4/ip_sockglue.c
99542 @@ -1171,7 +1171,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
99543 len = min_t(unsigned int, len, opt->optlen);
99544 if (put_user(len, optlen))
99545 return -EFAULT;
99546 - if (copy_to_user(optval, opt->__data, len))
99547 + if ((len > (sizeof(optbuf) - sizeof(struct ip_options))) ||
99548 + copy_to_user(optval, opt->__data, len))
99549 return -EFAULT;
99550 return 0;
99551 }
99552 @@ -1302,7 +1303,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
99553 if (sk->sk_type != SOCK_STREAM)
99554 return -ENOPROTOOPT;
99555
99556 - msg.msg_control = optval;
99557 + msg.msg_control = (void __force_kernel *)optval;
99558 msg.msg_controllen = len;
99559 msg.msg_flags = flags;
99560
99561 diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
99562 index e4a8f76..dd8ad72 100644
99563 --- a/net/ipv4/ip_vti.c
99564 +++ b/net/ipv4/ip_vti.c
99565 @@ -44,7 +44,7 @@
99566 #include <net/net_namespace.h>
99567 #include <net/netns/generic.h>
99568
99569 -static struct rtnl_link_ops vti_link_ops __read_mostly;
99570 +static struct rtnl_link_ops vti_link_ops;
99571
99572 static int vti_net_id __read_mostly;
99573 static int vti_tunnel_init(struct net_device *dev);
99574 @@ -360,7 +360,7 @@ static const struct nla_policy vti_policy[IFLA_VTI_MAX + 1] = {
99575 [IFLA_VTI_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
99576 };
99577
99578 -static struct rtnl_link_ops vti_link_ops __read_mostly = {
99579 +static struct rtnl_link_ops vti_link_ops = {
99580 .kind = "vti",
99581 .maxtype = IFLA_VTI_MAX,
99582 .policy = vti_policy,
99583 diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
99584 index b3e86ea..18ce98c 100644
99585 --- a/net/ipv4/ipconfig.c
99586 +++ b/net/ipv4/ipconfig.c
99587 @@ -334,7 +334,7 @@ static int __init ic_devinet_ioctl(unsigned int cmd, struct ifreq *arg)
99588
99589 mm_segment_t oldfs = get_fs();
99590 set_fs(get_ds());
99591 - res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
99592 + res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
99593 set_fs(oldfs);
99594 return res;
99595 }
99596 @@ -345,7 +345,7 @@ static int __init ic_dev_ioctl(unsigned int cmd, struct ifreq *arg)
99597
99598 mm_segment_t oldfs = get_fs();
99599 set_fs(get_ds());
99600 - res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg);
99601 + res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg);
99602 set_fs(oldfs);
99603 return res;
99604 }
99605 @@ -356,7 +356,7 @@ static int __init ic_route_ioctl(unsigned int cmd, struct rtentry *arg)
99606
99607 mm_segment_t oldfs = get_fs();
99608 set_fs(get_ds());
99609 - res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg);
99610 + res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg);
99611 set_fs(oldfs);
99612 return res;
99613 }
99614 diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
99615 index 812b183..56cbe9c 100644
99616 --- a/net/ipv4/ipip.c
99617 +++ b/net/ipv4/ipip.c
99618 @@ -124,7 +124,7 @@ MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
99619 static int ipip_net_id __read_mostly;
99620
99621 static int ipip_tunnel_init(struct net_device *dev);
99622 -static struct rtnl_link_ops ipip_link_ops __read_mostly;
99623 +static struct rtnl_link_ops ipip_link_ops;
99624
99625 static int ipip_err(struct sk_buff *skb, u32 info)
99626 {
99627 @@ -409,7 +409,7 @@ static const struct nla_policy ipip_policy[IFLA_IPTUN_MAX + 1] = {
99628 [IFLA_IPTUN_PMTUDISC] = { .type = NLA_U8 },
99629 };
99630
99631 -static struct rtnl_link_ops ipip_link_ops __read_mostly = {
99632 +static struct rtnl_link_ops ipip_link_ops = {
99633 .kind = "ipip",
99634 .maxtype = IFLA_IPTUN_MAX,
99635 .policy = ipip_policy,
99636 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
99637 index f95b6f9..2ee2097 100644
99638 --- a/net/ipv4/netfilter/arp_tables.c
99639 +++ b/net/ipv4/netfilter/arp_tables.c
99640 @@ -885,14 +885,14 @@ static int compat_table_info(const struct xt_table_info *info,
99641 #endif
99642
99643 static int get_info(struct net *net, void __user *user,
99644 - const int *len, int compat)
99645 + int len, int compat)
99646 {
99647 char name[XT_TABLE_MAXNAMELEN];
99648 struct xt_table *t;
99649 int ret;
99650
99651 - if (*len != sizeof(struct arpt_getinfo)) {
99652 - duprintf("length %u != %Zu\n", *len,
99653 + if (len != sizeof(struct arpt_getinfo)) {
99654 + duprintf("length %u != %Zu\n", len,
99655 sizeof(struct arpt_getinfo));
99656 return -EINVAL;
99657 }
99658 @@ -929,7 +929,7 @@ static int get_info(struct net *net, void __user *user,
99659 info.size = private->size;
99660 strcpy(info.name, name);
99661
99662 - if (copy_to_user(user, &info, *len) != 0)
99663 + if (copy_to_user(user, &info, len) != 0)
99664 ret = -EFAULT;
99665 else
99666 ret = 0;
99667 @@ -1690,7 +1690,7 @@ static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,
99668
99669 switch (cmd) {
99670 case ARPT_SO_GET_INFO:
99671 - ret = get_info(sock_net(sk), user, len, 1);
99672 + ret = get_info(sock_net(sk), user, *len, 1);
99673 break;
99674 case ARPT_SO_GET_ENTRIES:
99675 ret = compat_get_entries(sock_net(sk), user, len);
99676 @@ -1735,7 +1735,7 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
99677
99678 switch (cmd) {
99679 case ARPT_SO_GET_INFO:
99680 - ret = get_info(sock_net(sk), user, len, 0);
99681 + ret = get_info(sock_net(sk), user, *len, 0);
99682 break;
99683
99684 case ARPT_SO_GET_ENTRIES:
99685 diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
99686 index 99e810f..3711b81 100644
99687 --- a/net/ipv4/netfilter/ip_tables.c
99688 +++ b/net/ipv4/netfilter/ip_tables.c
99689 @@ -1073,14 +1073,14 @@ static int compat_table_info(const struct xt_table_info *info,
99690 #endif
99691
99692 static int get_info(struct net *net, void __user *user,
99693 - const int *len, int compat)
99694 + int len, int compat)
99695 {
99696 char name[XT_TABLE_MAXNAMELEN];
99697 struct xt_table *t;
99698 int ret;
99699
99700 - if (*len != sizeof(struct ipt_getinfo)) {
99701 - duprintf("length %u != %zu\n", *len,
99702 + if (len != sizeof(struct ipt_getinfo)) {
99703 + duprintf("length %u != %zu\n", len,
99704 sizeof(struct ipt_getinfo));
99705 return -EINVAL;
99706 }
99707 @@ -1117,7 +1117,7 @@ static int get_info(struct net *net, void __user *user,
99708 info.size = private->size;
99709 strcpy(info.name, name);
99710
99711 - if (copy_to_user(user, &info, *len) != 0)
99712 + if (copy_to_user(user, &info, len) != 0)
99713 ret = -EFAULT;
99714 else
99715 ret = 0;
99716 @@ -1973,7 +1973,7 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
99717
99718 switch (cmd) {
99719 case IPT_SO_GET_INFO:
99720 - ret = get_info(sock_net(sk), user, len, 1);
99721 + ret = get_info(sock_net(sk), user, *len, 1);
99722 break;
99723 case IPT_SO_GET_ENTRIES:
99724 ret = compat_get_entries(sock_net(sk), user, len);
99725 @@ -2020,7 +2020,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
99726
99727 switch (cmd) {
99728 case IPT_SO_GET_INFO:
99729 - ret = get_info(sock_net(sk), user, len, 0);
99730 + ret = get_info(sock_net(sk), user, *len, 0);
99731 break;
99732
99733 case IPT_SO_GET_ENTRIES:
99734 diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
99735 index 2510c02..cfb34fa 100644
99736 --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
99737 +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
99738 @@ -720,7 +720,7 @@ static int clusterip_net_init(struct net *net)
99739 spin_lock_init(&cn->lock);
99740
99741 #ifdef CONFIG_PROC_FS
99742 - cn->procdir = proc_mkdir("ipt_CLUSTERIP", net->proc_net);
99743 + cn->procdir = proc_mkdir_restrict("ipt_CLUSTERIP", net->proc_net);
99744 if (!cn->procdir) {
99745 pr_err("Unable to proc dir entry\n");
99746 return -ENOMEM;
99747 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
99748 index e21934b..16f52a6 100644
99749 --- a/net/ipv4/ping.c
99750 +++ b/net/ipv4/ping.c
99751 @@ -59,7 +59,7 @@ struct ping_table {
99752 };
99753
99754 static struct ping_table ping_table;
99755 -struct pingv6_ops pingv6_ops;
99756 +struct pingv6_ops *pingv6_ops;
99757 EXPORT_SYMBOL_GPL(pingv6_ops);
99758
99759 static u16 ping_port_rover;
99760 @@ -259,7 +259,7 @@ int ping_init_sock(struct sock *sk)
99761
99762 inet_get_ping_group_range_net(net, &low, &high);
99763 if (gid_lte(low, group) && gid_lte(group, high))
99764 - return 0;
99765 + goto out_release_group;
99766
99767 group_info = get_current_groups();
99768 count = group_info->ngroups;
99769 @@ -348,7 +348,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
99770 return -ENODEV;
99771 }
99772 }
99773 - has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev,
99774 + has_addr = pingv6_ops->ipv6_chk_addr(net, &addr->sin6_addr, dev,
99775 scoped);
99776 rcu_read_unlock();
99777
99778 @@ -556,7 +556,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
99779 }
99780 #if IS_ENABLED(CONFIG_IPV6)
99781 } else if (skb->protocol == htons(ETH_P_IPV6)) {
99782 - harderr = pingv6_ops.icmpv6_err_convert(type, code, &err);
99783 + harderr = pingv6_ops->icmpv6_err_convert(type, code, &err);
99784 #endif
99785 }
99786
99787 @@ -574,7 +574,7 @@ void ping_err(struct sk_buff *skb, int offset, u32 info)
99788 info, (u8 *)icmph);
99789 #if IS_ENABLED(CONFIG_IPV6)
99790 } else if (family == AF_INET6) {
99791 - pingv6_ops.ipv6_icmp_error(sk, skb, err, 0,
99792 + pingv6_ops->ipv6_icmp_error(sk, skb, err, 0,
99793 info, (u8 *)icmph);
99794 #endif
99795 }
99796 @@ -844,6 +844,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99797 {
99798 struct inet_sock *isk = inet_sk(sk);
99799 int family = sk->sk_family;
99800 + struct sockaddr_in *sin;
99801 + struct sockaddr_in6 *sin6;
99802 struct sk_buff *skb;
99803 int copied, err;
99804
99805 @@ -853,12 +855,19 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99806 if (flags & MSG_OOB)
99807 goto out;
99808
99809 + if (addr_len) {
99810 + if (family == AF_INET)
99811 + *addr_len = sizeof(*sin);
99812 + else if (family == AF_INET6 && addr_len)
99813 + *addr_len = sizeof(*sin6);
99814 + }
99815 +
99816 if (flags & MSG_ERRQUEUE) {
99817 if (family == AF_INET) {
99818 return ip_recv_error(sk, msg, len, addr_len);
99819 #if IS_ENABLED(CONFIG_IPV6)
99820 } else if (family == AF_INET6) {
99821 - return pingv6_ops.ipv6_recv_error(sk, msg, len,
99822 + return pingv6_ops->ipv6_recv_error(sk, msg, len,
99823 addr_len);
99824 #endif
99825 }
99826 @@ -890,7 +899,6 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99827 sin->sin_port = 0 /* skb->h.uh->source */;
99828 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
99829 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
99830 - *addr_len = sizeof(*sin);
99831 }
99832
99833 if (isk->cmsg_flags)
99834 @@ -912,14 +920,13 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99835 sin6->sin6_scope_id =
99836 ipv6_iface_scope_id(&sin6->sin6_addr,
99837 IP6CB(skb)->iif);
99838 - *addr_len = sizeof(*sin6);
99839 }
99840
99841 if (inet6_sk(sk)->rxopt.all)
99842 - pingv6_ops.ip6_datagram_recv_common_ctl(sk, msg, skb);
99843 + pingv6_ops->ip6_datagram_recv_common_ctl(sk, msg, skb);
99844 if (skb->protocol == htons(ETH_P_IPV6) &&
99845 inet6_sk(sk)->rxopt.all)
99846 - pingv6_ops.ip6_datagram_recv_specific_ctl(sk, msg, skb);
99847 + pingv6_ops->ip6_datagram_recv_specific_ctl(sk, msg, skb);
99848 else if (skb->protocol == htons(ETH_P_IP) && isk->cmsg_flags)
99849 ip_cmsg_recv(msg, skb);
99850 #endif
99851 @@ -1111,7 +1118,7 @@ static void ping_v4_format_sock(struct sock *sp, struct seq_file *f,
99852 from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
99853 0, sock_i_ino(sp),
99854 atomic_read(&sp->sk_refcnt), sp,
99855 - atomic_read(&sp->sk_drops));
99856 + atomic_read_unchecked(&sp->sk_drops));
99857 }
99858
99859 static int ping_v4_seq_show(struct seq_file *seq, void *v)
99860 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
99861 index c04518f..824ebe5 100644
99862 --- a/net/ipv4/raw.c
99863 +++ b/net/ipv4/raw.c
99864 @@ -311,7 +311,7 @@ static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
99865 int raw_rcv(struct sock *sk, struct sk_buff *skb)
99866 {
99867 if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
99868 - atomic_inc(&sk->sk_drops);
99869 + atomic_inc_unchecked(&sk->sk_drops);
99870 kfree_skb(skb);
99871 return NET_RX_DROP;
99872 }
99873 @@ -696,6 +696,9 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99874 if (flags & MSG_OOB)
99875 goto out;
99876
99877 + if (addr_len)
99878 + *addr_len = sizeof(*sin);
99879 +
99880 if (flags & MSG_ERRQUEUE) {
99881 err = ip_recv_error(sk, msg, len, addr_len);
99882 goto out;
99883 @@ -723,7 +726,6 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
99884 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
99885 sin->sin_port = 0;
99886 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
99887 - *addr_len = sizeof(*sin);
99888 }
99889 if (inet->cmsg_flags)
99890 ip_cmsg_recv(msg, skb);
99891 @@ -748,16 +750,20 @@ static int raw_init(struct sock *sk)
99892
99893 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
99894 {
99895 + struct icmp_filter filter;
99896 +
99897 if (optlen > sizeof(struct icmp_filter))
99898 optlen = sizeof(struct icmp_filter);
99899 - if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
99900 + if (copy_from_user(&filter, optval, optlen))
99901 return -EFAULT;
99902 + raw_sk(sk)->filter = filter;
99903 return 0;
99904 }
99905
99906 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
99907 {
99908 int len, ret = -EFAULT;
99909 + struct icmp_filter filter;
99910
99911 if (get_user(len, optlen))
99912 goto out;
99913 @@ -767,8 +773,8 @@ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *o
99914 if (len > sizeof(struct icmp_filter))
99915 len = sizeof(struct icmp_filter);
99916 ret = -EFAULT;
99917 - if (put_user(len, optlen) ||
99918 - copy_to_user(optval, &raw_sk(sk)->filter, len))
99919 + filter = raw_sk(sk)->filter;
99920 + if (put_user(len, optlen) || len > sizeof filter || copy_to_user(optval, &filter, len))
99921 goto out;
99922 ret = 0;
99923 out: return ret;
99924 @@ -997,7 +1003,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
99925 0, 0L, 0,
99926 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
99927 0, sock_i_ino(sp),
99928 - atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
99929 + atomic_read(&sp->sk_refcnt), sp, atomic_read_unchecked(&sp->sk_drops));
99930 }
99931
99932 static int raw_seq_show(struct seq_file *seq, void *v)
99933 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
99934 index 1344373..02f339e 100644
99935 --- a/net/ipv4/route.c
99936 +++ b/net/ipv4/route.c
99937 @@ -233,7 +233,7 @@ static const struct seq_operations rt_cache_seq_ops = {
99938
99939 static int rt_cache_seq_open(struct inode *inode, struct file *file)
99940 {
99941 - return seq_open(file, &rt_cache_seq_ops);
99942 + return seq_open_restrict(file, &rt_cache_seq_ops);
99943 }
99944
99945 static const struct file_operations rt_cache_seq_fops = {
99946 @@ -324,7 +324,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
99947
99948 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
99949 {
99950 - return seq_open(file, &rt_cpu_seq_ops);
99951 + return seq_open_restrict(file, &rt_cpu_seq_ops);
99952 }
99953
99954 static const struct file_operations rt_cpu_seq_fops = {
99955 @@ -362,7 +362,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
99956
99957 static int rt_acct_proc_open(struct inode *inode, struct file *file)
99958 {
99959 - return single_open(file, rt_acct_proc_show, NULL);
99960 + return single_open_restrict(file, rt_acct_proc_show, NULL);
99961 }
99962
99963 static const struct file_operations rt_acct_proc_fops = {
99964 @@ -2623,34 +2623,34 @@ static struct ctl_table ipv4_route_flush_table[] = {
99965 .maxlen = sizeof(int),
99966 .mode = 0200,
99967 .proc_handler = ipv4_sysctl_rtcache_flush,
99968 + .extra1 = &init_net,
99969 },
99970 { },
99971 };
99972
99973 static __net_init int sysctl_route_net_init(struct net *net)
99974 {
99975 - struct ctl_table *tbl;
99976 + ctl_table_no_const *tbl = NULL;
99977
99978 - tbl = ipv4_route_flush_table;
99979 if (!net_eq(net, &init_net)) {
99980 - tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
99981 + tbl = kmemdup(ipv4_route_flush_table, sizeof(ipv4_route_flush_table), GFP_KERNEL);
99982 if (tbl == NULL)
99983 goto err_dup;
99984
99985 /* Don't export sysctls to unprivileged users */
99986 if (net->user_ns != &init_user_ns)
99987 tbl[0].procname = NULL;
99988 - }
99989 - tbl[0].extra1 = net;
99990 + tbl[0].extra1 = net;
99991 + net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
99992 + } else
99993 + net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", ipv4_route_flush_table);
99994
99995 - net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
99996 if (net->ipv4.route_hdr == NULL)
99997 goto err_reg;
99998 return 0;
99999
100000 err_reg:
100001 - if (tbl != ipv4_route_flush_table)
100002 - kfree(tbl);
100003 + kfree(tbl);
100004 err_dup:
100005 return -ENOMEM;
100006 }
100007 @@ -2673,8 +2673,8 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
100008
100009 static __net_init int rt_genid_init(struct net *net)
100010 {
100011 - atomic_set(&net->ipv4.rt_genid, 0);
100012 - atomic_set(&net->fnhe_genid, 0);
100013 + atomic_set_unchecked(&net->ipv4.rt_genid, 0);
100014 + atomic_set_unchecked(&net->fnhe_genid, 0);
100015 get_random_bytes(&net->ipv4.dev_addr_genid,
100016 sizeof(net->ipv4.dev_addr_genid));
100017 return 0;
100018 diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
100019 index 44eba05..b36864b 100644
100020 --- a/net/ipv4/sysctl_net_ipv4.c
100021 +++ b/net/ipv4/sysctl_net_ipv4.c
100022 @@ -60,7 +60,7 @@ static int ipv4_local_port_range(struct ctl_table *table, int write,
100023 container_of(table->data, struct net, ipv4.sysctl_local_ports.range);
100024 int ret;
100025 int range[2];
100026 - struct ctl_table tmp = {
100027 + ctl_table_no_const tmp = {
100028 .data = &range,
100029 .maxlen = sizeof(range),
100030 .mode = table->mode,
100031 @@ -118,7 +118,7 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,
100032 int ret;
100033 gid_t urange[2];
100034 kgid_t low, high;
100035 - struct ctl_table tmp = {
100036 + ctl_table_no_const tmp = {
100037 .data = &urange,
100038 .maxlen = sizeof(urange),
100039 .mode = table->mode,
100040 @@ -149,7 +149,7 @@ static int proc_tcp_congestion_control(struct ctl_table *ctl, int write,
100041 void __user *buffer, size_t *lenp, loff_t *ppos)
100042 {
100043 char val[TCP_CA_NAME_MAX];
100044 - struct ctl_table tbl = {
100045 + ctl_table_no_const tbl = {
100046 .data = val,
100047 .maxlen = TCP_CA_NAME_MAX,
100048 };
100049 @@ -168,7 +168,7 @@ static int proc_tcp_available_congestion_control(struct ctl_table *ctl,
100050 void __user *buffer, size_t *lenp,
100051 loff_t *ppos)
100052 {
100053 - struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX, };
100054 + ctl_table_no_const tbl = { .maxlen = TCP_CA_BUF_MAX, };
100055 int ret;
100056
100057 tbl.data = kmalloc(tbl.maxlen, GFP_USER);
100058 @@ -185,7 +185,7 @@ static int proc_allowed_congestion_control(struct ctl_table *ctl,
100059 void __user *buffer, size_t *lenp,
100060 loff_t *ppos)
100061 {
100062 - struct ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
100063 + ctl_table_no_const tbl = { .maxlen = TCP_CA_BUF_MAX };
100064 int ret;
100065
100066 tbl.data = kmalloc(tbl.maxlen, GFP_USER);
100067 @@ -204,7 +204,7 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write,
100068 void __user *buffer, size_t *lenp,
100069 loff_t *ppos)
100070 {
100071 - struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
100072 + ctl_table_no_const tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) };
100073 struct tcp_fastopen_context *ctxt;
100074 int ret;
100075 u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */
100076 @@ -438,7 +438,7 @@ static struct ctl_table ipv4_table[] = {
100077 },
100078 {
100079 .procname = "ip_local_reserved_ports",
100080 - .data = NULL, /* initialized in sysctl_ipv4_init */
100081 + .data = sysctl_local_reserved_ports,
100082 .maxlen = 65536,
100083 .mode = 0644,
100084 .proc_handler = proc_do_large_bitmap,
100085 @@ -843,13 +843,12 @@ static struct ctl_table ipv4_net_table[] = {
100086
100087 static __net_init int ipv4_sysctl_init_net(struct net *net)
100088 {
100089 - struct ctl_table *table;
100090 + ctl_table_no_const *table = NULL;
100091
100092 - table = ipv4_net_table;
100093 if (!net_eq(net, &init_net)) {
100094 int i;
100095
100096 - table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
100097 + table = kmemdup(ipv4_net_table, sizeof(ipv4_net_table), GFP_KERNEL);
100098 if (table == NULL)
100099 goto err_alloc;
100100
100101 @@ -872,15 +871,17 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
100102 net->ipv4.sysctl_local_ports.range[0] = 32768;
100103 net->ipv4.sysctl_local_ports.range[1] = 61000;
100104
100105 - net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
100106 + if (!net_eq(net, &init_net))
100107 + net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", table);
100108 + else
100109 + net->ipv4.ipv4_hdr = register_net_sysctl(net, "net/ipv4", ipv4_net_table);
100110 if (net->ipv4.ipv4_hdr == NULL)
100111 goto err_reg;
100112
100113 return 0;
100114
100115 err_reg:
100116 - if (!net_eq(net, &init_net))
100117 - kfree(table);
100118 + kfree(table);
100119 err_alloc:
100120 return -ENOMEM;
100121 }
100122 @@ -902,16 +903,6 @@ static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
100123 static __init int sysctl_ipv4_init(void)
100124 {
100125 struct ctl_table_header *hdr;
100126 - struct ctl_table *i;
100127 -
100128 - for (i = ipv4_table; i->procname; i++) {
100129 - if (strcmp(i->procname, "ip_local_reserved_ports") == 0) {
100130 - i->data = sysctl_local_reserved_ports;
100131 - break;
100132 - }
100133 - }
100134 - if (!i->procname)
100135 - return -EINVAL;
100136
100137 hdr = register_net_sysctl(&init_net, "net/ipv4", ipv4_table);
100138 if (hdr == NULL)
100139 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
100140 index eeaac39..dc29942 100644
100141 --- a/net/ipv4/tcp_input.c
100142 +++ b/net/ipv4/tcp_input.c
100143 @@ -761,7 +761,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
100144 * without any lock. We want to make sure compiler wont store
100145 * intermediate values in this location.
100146 */
100147 - ACCESS_ONCE(sk->sk_pacing_rate) = min_t(u64, rate,
100148 + ACCESS_ONCE_RW(sk->sk_pacing_rate) = min_t(u64, rate,
100149 sk->sk_max_pacing_rate);
100150 }
100151
100152 @@ -4485,7 +4485,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
100153 * simplifies code)
100154 */
100155 static void
100156 -tcp_collapse(struct sock *sk, struct sk_buff_head *list,
100157 +__intentional_overflow(5,6) tcp_collapse(struct sock *sk, struct sk_buff_head *list,
100158 struct sk_buff *head, struct sk_buff *tail,
100159 u32 start, u32 end)
100160 {
100161 @@ -5562,6 +5562,7 @@ discard:
100162 tcp_paws_reject(&tp->rx_opt, 0))
100163 goto discard_and_undo;
100164
100165 +#ifndef CONFIG_GRKERNSEC_NO_SIMULT_CONNECT
100166 if (th->syn) {
100167 /* We see SYN without ACK. It is attempt of
100168 * simultaneous connect with crossed SYNs.
100169 @@ -5612,6 +5613,7 @@ discard:
100170 goto discard;
100171 #endif
100172 }
100173 +#endif
100174 /* "fifth, if neither of the SYN or RST bits is set then
100175 * drop the segment and return."
100176 */
100177 @@ -5658,7 +5660,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
100178 goto discard;
100179
100180 if (th->syn) {
100181 - if (th->fin)
100182 + if (th->fin || th->urg || th->psh)
100183 goto discard;
100184 if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
100185 return 1;
100186 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
100187 index 1e4eac7..a66fa4a 100644
100188 --- a/net/ipv4/tcp_ipv4.c
100189 +++ b/net/ipv4/tcp_ipv4.c
100190 @@ -91,6 +91,10 @@ int sysctl_tcp_low_latency __read_mostly;
100191 EXPORT_SYMBOL(sysctl_tcp_low_latency);
100192
100193
100194 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100195 +extern int grsec_enable_blackhole;
100196 +#endif
100197 +
100198 #ifdef CONFIG_TCP_MD5SIG
100199 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
100200 __be32 daddr, __be32 saddr, const struct tcphdr *th);
100201 @@ -1829,6 +1833,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
100202 return 0;
100203
100204 reset:
100205 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100206 + if (!grsec_enable_blackhole)
100207 +#endif
100208 tcp_v4_send_reset(rsk, skb);
100209 discard:
100210 kfree_skb(skb);
100211 @@ -1974,12 +1981,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
100212 TCP_SKB_CB(skb)->sacked = 0;
100213
100214 sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
100215 - if (!sk)
100216 + if (!sk) {
100217 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100218 + ret = 1;
100219 +#endif
100220 goto no_tcp_socket;
100221 -
100222 + }
100223 process:
100224 - if (sk->sk_state == TCP_TIME_WAIT)
100225 + if (sk->sk_state == TCP_TIME_WAIT) {
100226 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100227 + ret = 2;
100228 +#endif
100229 goto do_time_wait;
100230 + }
100231
100232 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
100233 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
100234 @@ -2033,6 +2047,10 @@ csum_error:
100235 bad_packet:
100236 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
100237 } else {
100238 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100239 + if (!grsec_enable_blackhole || (ret == 1 &&
100240 + (skb->dev->flags & IFF_LOOPBACK)))
100241 +#endif
100242 tcp_v4_send_reset(NULL, skb);
100243 }
100244
100245 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
100246 index 7a436c5..1b05c59 100644
100247 --- a/net/ipv4/tcp_minisocks.c
100248 +++ b/net/ipv4/tcp_minisocks.c
100249 @@ -27,6 +27,10 @@
100250 #include <net/inet_common.h>
100251 #include <net/xfrm.h>
100252
100253 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100254 +extern int grsec_enable_blackhole;
100255 +#endif
100256 +
100257 int sysctl_tcp_syncookies __read_mostly = 1;
100258 EXPORT_SYMBOL(sysctl_tcp_syncookies);
100259
100260 @@ -709,7 +713,10 @@ embryonic_reset:
100261 * avoid becoming vulnerable to outside attack aiming at
100262 * resetting legit local connections.
100263 */
100264 - req->rsk_ops->send_reset(sk, skb);
100265 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100266 + if (!grsec_enable_blackhole)
100267 +#endif
100268 + req->rsk_ops->send_reset(sk, skb);
100269 } else if (fastopen) { /* received a valid RST pkt */
100270 reqsk_fastopen_remove(sk, req, true);
100271 tcp_reset(sk);
100272 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
100273 index 1f2d376..01d18c4 100644
100274 --- a/net/ipv4/tcp_probe.c
100275 +++ b/net/ipv4/tcp_probe.c
100276 @@ -238,7 +238,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
100277 if (cnt + width >= len)
100278 break;
100279
100280 - if (copy_to_user(buf + cnt, tbuf, width))
100281 + if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
100282 return -EFAULT;
100283 cnt += width;
100284 }
100285 diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
100286 index 64f0354..a81b39d 100644
100287 --- a/net/ipv4/tcp_timer.c
100288 +++ b/net/ipv4/tcp_timer.c
100289 @@ -22,6 +22,10 @@
100290 #include <linux/gfp.h>
100291 #include <net/tcp.h>
100292
100293 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100294 +extern int grsec_lastack_retries;
100295 +#endif
100296 +
100297 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
100298 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
100299 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
100300 @@ -189,6 +193,13 @@ static int tcp_write_timeout(struct sock *sk)
100301 }
100302 }
100303
100304 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100305 + if ((sk->sk_state == TCP_LAST_ACK) &&
100306 + (grsec_lastack_retries > 0) &&
100307 + (grsec_lastack_retries < retry_until))
100308 + retry_until = grsec_lastack_retries;
100309 +#endif
100310 +
100311 if (retransmits_timed_out(sk, retry_until,
100312 syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
100313 /* Has it gone just too far? */
100314 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
100315 index 77bd16f..5f7174a 100644
100316 --- a/net/ipv4/udp.c
100317 +++ b/net/ipv4/udp.c
100318 @@ -87,6 +87,7 @@
100319 #include <linux/types.h>
100320 #include <linux/fcntl.h>
100321 #include <linux/module.h>
100322 +#include <linux/security.h>
100323 #include <linux/socket.h>
100324 #include <linux/sockios.h>
100325 #include <linux/igmp.h>
100326 @@ -113,6 +114,10 @@
100327 #include <net/busy_poll.h>
100328 #include "udp_impl.h"
100329
100330 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100331 +extern int grsec_enable_blackhole;
100332 +#endif
100333 +
100334 struct udp_table udp_table __read_mostly;
100335 EXPORT_SYMBOL(udp_table);
100336
100337 @@ -615,6 +620,9 @@ found:
100338 return s;
100339 }
100340
100341 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
100342 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
100343 +
100344 /*
100345 * This routine is called by the ICMP module when it gets some
100346 * sort of error condition. If err < 0 then the socket should
100347 @@ -914,9 +922,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
100348 dport = usin->sin_port;
100349 if (dport == 0)
100350 return -EINVAL;
100351 +
100352 + err = gr_search_udp_sendmsg(sk, usin);
100353 + if (err)
100354 + return err;
100355 } else {
100356 if (sk->sk_state != TCP_ESTABLISHED)
100357 return -EDESTADDRREQ;
100358 +
100359 + err = gr_search_udp_sendmsg(sk, NULL);
100360 + if (err)
100361 + return err;
100362 +
100363 daddr = inet->inet_daddr;
100364 dport = inet->inet_dport;
100365 /* Open fast path for connected socket.
100366 @@ -1163,7 +1180,7 @@ static unsigned int first_packet_length(struct sock *sk)
100367 IS_UDPLITE(sk));
100368 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
100369 IS_UDPLITE(sk));
100370 - atomic_inc(&sk->sk_drops);
100371 + atomic_inc_unchecked(&sk->sk_drops);
100372 __skb_unlink(skb, rcvq);
100373 __skb_queue_tail(&list_kill, skb);
100374 }
100375 @@ -1234,6 +1251,12 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
100376 int is_udplite = IS_UDPLITE(sk);
100377 bool slow;
100378
100379 + /*
100380 + * Check any passed addresses
100381 + */
100382 + if (addr_len)
100383 + *addr_len = sizeof(*sin);
100384 +
100385 if (flags & MSG_ERRQUEUE)
100386 return ip_recv_error(sk, msg, len, addr_len);
100387
100388 @@ -1243,6 +1266,10 @@ try_again:
100389 if (!skb)
100390 goto out;
100391
100392 + err = gr_search_udp_recvmsg(sk, skb);
100393 + if (err)
100394 + goto out_free;
100395 +
100396 ulen = skb->len - sizeof(struct udphdr);
100397 copied = len;
100398 if (copied > ulen)
100399 @@ -1276,7 +1303,7 @@ try_again:
100400 if (unlikely(err)) {
100401 trace_kfree_skb(skb, udp_recvmsg);
100402 if (!peeked) {
100403 - atomic_inc(&sk->sk_drops);
100404 + atomic_inc_unchecked(&sk->sk_drops);
100405 UDP_INC_STATS_USER(sock_net(sk),
100406 UDP_MIB_INERRORS, is_udplite);
100407 }
100408 @@ -1295,7 +1322,6 @@ try_again:
100409 sin->sin_port = udp_hdr(skb)->source;
100410 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
100411 memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
100412 - *addr_len = sizeof(*sin);
100413 }
100414 if (inet->cmsg_flags)
100415 ip_cmsg_recv(msg, skb);
100416 @@ -1566,7 +1592,7 @@ csum_error:
100417 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
100418 drop:
100419 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
100420 - atomic_inc(&sk->sk_drops);
100421 + atomic_inc_unchecked(&sk->sk_drops);
100422 kfree_skb(skb);
100423 return -1;
100424 }
100425 @@ -1585,7 +1611,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
100426 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
100427
100428 if (!skb1) {
100429 - atomic_inc(&sk->sk_drops);
100430 + atomic_inc_unchecked(&sk->sk_drops);
100431 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
100432 IS_UDPLITE(sk));
100433 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
100434 @@ -1786,6 +1812,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
100435 goto csum_error;
100436
100437 UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
100438 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
100439 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
100440 +#endif
100441 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
100442
100443 /*
100444 @@ -2350,7 +2379,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
100445 from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
100446 0, sock_i_ino(sp),
100447 atomic_read(&sp->sk_refcnt), sp,
100448 - atomic_read(&sp->sk_drops));
100449 + atomic_read_unchecked(&sp->sk_drops));
100450 }
100451
100452 int udp4_seq_show(struct seq_file *seq, void *v)
100453 diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
100454 index e1a6393..f634ce5 100644
100455 --- a/net/ipv4/xfrm4_policy.c
100456 +++ b/net/ipv4/xfrm4_policy.c
100457 @@ -186,11 +186,11 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
100458 fl4->flowi4_tos = iph->tos;
100459 }
100460
100461 -static inline int xfrm4_garbage_collect(struct dst_ops *ops)
100462 +static int xfrm4_garbage_collect(struct dst_ops *ops)
100463 {
100464 struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
100465
100466 - xfrm4_policy_afinfo.garbage_collect(net);
100467 + xfrm_garbage_collect_deferred(net);
100468 return (dst_entries_get_slow(ops) > ops->gc_thresh * 2);
100469 }
100470
100471 @@ -269,19 +269,18 @@ static struct ctl_table xfrm4_policy_table[] = {
100472
100473 static int __net_init xfrm4_net_init(struct net *net)
100474 {
100475 - struct ctl_table *table;
100476 + ctl_table_no_const *table = NULL;
100477 struct ctl_table_header *hdr;
100478
100479 - table = xfrm4_policy_table;
100480 if (!net_eq(net, &init_net)) {
100481 - table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL);
100482 + table = kmemdup(xfrm4_policy_table, sizeof(xfrm4_policy_table), GFP_KERNEL);
100483 if (!table)
100484 goto err_alloc;
100485
100486 table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh;
100487 - }
100488 -
100489 - hdr = register_net_sysctl(net, "net/ipv4", table);
100490 + hdr = register_net_sysctl(net, "net/ipv4", table);
100491 + } else
100492 + hdr = register_net_sysctl(net, "net/ipv4", xfrm4_policy_table);
100493 if (!hdr)
100494 goto err_reg;
100495
100496 @@ -289,8 +288,7 @@ static int __net_init xfrm4_net_init(struct net *net)
100497 return 0;
100498
100499 err_reg:
100500 - if (!net_eq(net, &init_net))
100501 - kfree(table);
100502 + kfree(table);
100503 err_alloc:
100504 return -ENOMEM;
100505 }
100506 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
100507 index 6c7fa08..285086c 100644
100508 --- a/net/ipv6/addrconf.c
100509 +++ b/net/ipv6/addrconf.c
100510 @@ -598,7 +598,7 @@ static int inet6_netconf_dump_devconf(struct sk_buff *skb,
100511 idx = 0;
100512 head = &net->dev_index_head[h];
100513 rcu_read_lock();
100514 - cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
100515 + cb->seq = atomic_read_unchecked(&net->ipv6.dev_addr_genid) ^
100516 net->dev_base_seq;
100517 hlist_for_each_entry_rcu(dev, head, index_hlist) {
100518 if (idx < s_idx)
100519 @@ -2395,7 +2395,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
100520 p.iph.ihl = 5;
100521 p.iph.protocol = IPPROTO_IPV6;
100522 p.iph.ttl = 64;
100523 - ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
100524 + ifr.ifr_ifru.ifru_data = (void __force_user *)&p;
100525
100526 if (ops->ndo_do_ioctl) {
100527 mm_segment_t oldfs = get_fs();
100528 @@ -4146,7 +4146,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
100529 s_ip_idx = ip_idx = cb->args[2];
100530
100531 rcu_read_lock();
100532 - cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
100533 + cb->seq = atomic_read_unchecked(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
100534 for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
100535 idx = 0;
100536 head = &net->dev_index_head[h];
100537 @@ -4758,7 +4758,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
100538 dst_free(&ifp->rt->dst);
100539 break;
100540 }
100541 - atomic_inc(&net->ipv6.dev_addr_genid);
100542 + atomic_inc_unchecked(&net->ipv6.dev_addr_genid);
100543 rt_genid_bump_ipv6(net);
100544 }
100545
100546 @@ -4779,7 +4779,7 @@ int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
100547 int *valp = ctl->data;
100548 int val = *valp;
100549 loff_t pos = *ppos;
100550 - struct ctl_table lctl;
100551 + ctl_table_no_const lctl;
100552 int ret;
100553
100554 /*
100555 @@ -4864,7 +4864,7 @@ int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
100556 int *valp = ctl->data;
100557 int val = *valp;
100558 loff_t pos = *ppos;
100559 - struct ctl_table lctl;
100560 + ctl_table_no_const lctl;
100561 int ret;
100562
100563 /*
100564 diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
100565 index d935889..2f64330 100644
100566 --- a/net/ipv6/af_inet6.c
100567 +++ b/net/ipv6/af_inet6.c
100568 @@ -776,7 +776,7 @@ static int __net_init inet6_net_init(struct net *net)
100569 net->ipv6.sysctl.bindv6only = 0;
100570 net->ipv6.sysctl.icmpv6_time = 1*HZ;
100571 net->ipv6.sysctl.flowlabel_consistency = 1;
100572 - atomic_set(&net->ipv6.rt_genid, 0);
100573 + atomic_set_unchecked(&net->ipv6.rt_genid, 0);
100574
100575 err = ipv6_init_mibs(net);
100576 if (err)
100577 diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
100578 index c3bf2d2..1f00573 100644
100579 --- a/net/ipv6/datagram.c
100580 +++ b/net/ipv6/datagram.c
100581 @@ -938,5 +938,5 @@ void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
100582 0,
100583 sock_i_ino(sp),
100584 atomic_read(&sp->sk_refcnt), sp,
100585 - atomic_read(&sp->sk_drops));
100586 + atomic_read_unchecked(&sp->sk_drops));
100587 }
100588 diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
100589 index 7b32652..0bc348b 100644
100590 --- a/net/ipv6/icmp.c
100591 +++ b/net/ipv6/icmp.c
100592 @@ -1005,7 +1005,7 @@ static struct ctl_table ipv6_icmp_table_template[] = {
100593
100594 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
100595 {
100596 - struct ctl_table *table;
100597 + ctl_table_no_const *table;
100598
100599 table = kmemdup(ipv6_icmp_table_template,
100600 sizeof(ipv6_icmp_table_template),
100601 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
100602 index 2465d18..bc5bf7f 100644
100603 --- a/net/ipv6/ip6_gre.c
100604 +++ b/net/ipv6/ip6_gre.c
100605 @@ -71,7 +71,7 @@ struct ip6gre_net {
100606 struct net_device *fb_tunnel_dev;
100607 };
100608
100609 -static struct rtnl_link_ops ip6gre_link_ops __read_mostly;
100610 +static struct rtnl_link_ops ip6gre_link_ops;
100611 static int ip6gre_tunnel_init(struct net_device *dev);
100612 static void ip6gre_tunnel_setup(struct net_device *dev);
100613 static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t);
100614 @@ -1291,7 +1291,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
100615 }
100616
100617
100618 -static struct inet6_protocol ip6gre_protocol __read_mostly = {
100619 +static struct inet6_protocol ip6gre_protocol = {
100620 .handler = ip6gre_rcv,
100621 .err_handler = ip6gre_err,
100622 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
100623 @@ -1643,7 +1643,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = {
100624 [IFLA_GRE_FLAGS] = { .type = NLA_U32 },
100625 };
100626
100627 -static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
100628 +static struct rtnl_link_ops ip6gre_link_ops = {
100629 .kind = "ip6gre",
100630 .maxtype = IFLA_GRE_MAX,
100631 .policy = ip6gre_policy,
100632 @@ -1657,7 +1657,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
100633 .fill_info = ip6gre_fill_info,
100634 };
100635
100636 -static struct rtnl_link_ops ip6gre_tap_ops __read_mostly = {
100637 +static struct rtnl_link_ops ip6gre_tap_ops = {
100638 .kind = "ip6gretap",
100639 .maxtype = IFLA_GRE_MAX,
100640 .policy = ip6gre_policy,
100641 diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
100642 index 0e51f68..1f501e1 100644
100643 --- a/net/ipv6/ip6_tunnel.c
100644 +++ b/net/ipv6/ip6_tunnel.c
100645 @@ -85,7 +85,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
100646
100647 static int ip6_tnl_dev_init(struct net_device *dev);
100648 static void ip6_tnl_dev_setup(struct net_device *dev);
100649 -static struct rtnl_link_ops ip6_link_ops __read_mostly;
100650 +static struct rtnl_link_ops ip6_link_ops;
100651
100652 static int ip6_tnl_net_id __read_mostly;
100653 struct ip6_tnl_net {
100654 @@ -1714,7 +1714,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
100655 [IFLA_IPTUN_PROTO] = { .type = NLA_U8 },
100656 };
100657
100658 -static struct rtnl_link_ops ip6_link_ops __read_mostly = {
100659 +static struct rtnl_link_ops ip6_link_ops = {
100660 .kind = "ip6tnl",
100661 .maxtype = IFLA_IPTUN_MAX,
100662 .policy = ip6_tnl_policy,
100663 diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
100664 index 2d19272..3a46322 100644
100665 --- a/net/ipv6/ip6_vti.c
100666 +++ b/net/ipv6/ip6_vti.c
100667 @@ -62,7 +62,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
100668
100669 static int vti6_dev_init(struct net_device *dev);
100670 static void vti6_dev_setup(struct net_device *dev);
100671 -static struct rtnl_link_ops vti6_link_ops __read_mostly;
100672 +static struct rtnl_link_ops vti6_link_ops;
100673
100674 static int vti6_net_id __read_mostly;
100675 struct vti6_net {
100676 @@ -901,7 +901,7 @@ static const struct nla_policy vti6_policy[IFLA_VTI_MAX + 1] = {
100677 [IFLA_VTI_OKEY] = { .type = NLA_U32 },
100678 };
100679
100680 -static struct rtnl_link_ops vti6_link_ops __read_mostly = {
100681 +static struct rtnl_link_ops vti6_link_ops = {
100682 .kind = "vti6",
100683 .maxtype = IFLA_VTI_MAX,
100684 .policy = vti6_policy,
100685 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
100686 index 0a00f44..bec42b2 100644
100687 --- a/net/ipv6/ipv6_sockglue.c
100688 +++ b/net/ipv6/ipv6_sockglue.c
100689 @@ -991,7 +991,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
100690 if (sk->sk_type != SOCK_STREAM)
100691 return -ENOPROTOOPT;
100692
100693 - msg.msg_control = optval;
100694 + msg.msg_control = (void __force_kernel *)optval;
100695 msg.msg_controllen = len;
100696 msg.msg_flags = flags;
100697
100698 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
100699 index e080fbb..412b3cf 100644
100700 --- a/net/ipv6/netfilter/ip6_tables.c
100701 +++ b/net/ipv6/netfilter/ip6_tables.c
100702 @@ -1083,14 +1083,14 @@ static int compat_table_info(const struct xt_table_info *info,
100703 #endif
100704
100705 static int get_info(struct net *net, void __user *user,
100706 - const int *len, int compat)
100707 + int len, int compat)
100708 {
100709 char name[XT_TABLE_MAXNAMELEN];
100710 struct xt_table *t;
100711 int ret;
100712
100713 - if (*len != sizeof(struct ip6t_getinfo)) {
100714 - duprintf("length %u != %zu\n", *len,
100715 + if (len != sizeof(struct ip6t_getinfo)) {
100716 + duprintf("length %u != %zu\n", len,
100717 sizeof(struct ip6t_getinfo));
100718 return -EINVAL;
100719 }
100720 @@ -1127,7 +1127,7 @@ static int get_info(struct net *net, void __user *user,
100721 info.size = private->size;
100722 strcpy(info.name, name);
100723
100724 - if (copy_to_user(user, &info, *len) != 0)
100725 + if (copy_to_user(user, &info, len) != 0)
100726 ret = -EFAULT;
100727 else
100728 ret = 0;
100729 @@ -1983,7 +1983,7 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
100730
100731 switch (cmd) {
100732 case IP6T_SO_GET_INFO:
100733 - ret = get_info(sock_net(sk), user, len, 1);
100734 + ret = get_info(sock_net(sk), user, *len, 1);
100735 break;
100736 case IP6T_SO_GET_ENTRIES:
100737 ret = compat_get_entries(sock_net(sk), user, len);
100738 @@ -2030,7 +2030,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
100739
100740 switch (cmd) {
100741 case IP6T_SO_GET_INFO:
100742 - ret = get_info(sock_net(sk), user, len, 0);
100743 + ret = get_info(sock_net(sk), user, *len, 0);
100744 break;
100745
100746 case IP6T_SO_GET_ENTRIES:
100747 diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
100748 index 767ab8d..c5ec70a 100644
100749 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c
100750 +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
100751 @@ -90,12 +90,11 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
100752
100753 static int nf_ct_frag6_sysctl_register(struct net *net)
100754 {
100755 - struct ctl_table *table;
100756 + ctl_table_no_const *table = NULL;
100757 struct ctl_table_header *hdr;
100758
100759 - table = nf_ct_frag6_sysctl_table;
100760 if (!net_eq(net, &init_net)) {
100761 - table = kmemdup(table, sizeof(nf_ct_frag6_sysctl_table),
100762 + table = kmemdup(nf_ct_frag6_sysctl_table, sizeof(nf_ct_frag6_sysctl_table),
100763 GFP_KERNEL);
100764 if (table == NULL)
100765 goto err_alloc;
100766 @@ -103,9 +102,9 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
100767 table[0].data = &net->nf_frag.frags.timeout;
100768 table[1].data = &net->nf_frag.frags.low_thresh;
100769 table[2].data = &net->nf_frag.frags.high_thresh;
100770 - }
100771 -
100772 - hdr = register_net_sysctl(net, "net/netfilter", table);
100773 + hdr = register_net_sysctl(net, "net/netfilter", table);
100774 + } else
100775 + hdr = register_net_sysctl(net, "net/netfilter", nf_ct_frag6_sysctl_table);
100776 if (hdr == NULL)
100777 goto err_reg;
100778
100779 @@ -113,8 +112,7 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
100780 return 0;
100781
100782 err_reg:
100783 - if (!net_eq(net, &init_net))
100784 - kfree(table);
100785 + kfree(table);
100786 err_alloc:
100787 return -ENOMEM;
100788 }
100789 diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
100790 index 827f795..7e28e82 100644
100791 --- a/net/ipv6/output_core.c
100792 +++ b/net/ipv6/output_core.c
100793 @@ -9,8 +9,8 @@
100794
100795 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
100796 {
100797 - static atomic_t ipv6_fragmentation_id;
100798 - int old, new;
100799 + static atomic_unchecked_t ipv6_fragmentation_id;
100800 + int id;
100801
100802 #if IS_ENABLED(CONFIG_IPV6)
100803 if (rt && !(rt->dst.flags & DST_NOPEER)) {
100804 @@ -26,13 +26,10 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
100805 }
100806 }
100807 #endif
100808 - do {
100809 - old = atomic_read(&ipv6_fragmentation_id);
100810 - new = old + 1;
100811 - if (!new)
100812 - new = 1;
100813 - } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
100814 - fhdr->identification = htonl(new);
100815 + id = atomic_inc_return_unchecked(&ipv6_fragmentation_id);
100816 + if (!id)
100817 + id = atomic_inc_return_unchecked(&ipv6_fragmentation_id);
100818 + fhdr->identification = htonl(id);
100819 }
100820 EXPORT_SYMBOL(ipv6_select_ident);
100821
100822 diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
100823 index bda7429..469b26b 100644
100824 --- a/net/ipv6/ping.c
100825 +++ b/net/ipv6/ping.c
100826 @@ -246,6 +246,24 @@ static struct pernet_operations ping_v6_net_ops = {
100827 };
100828 #endif
100829
100830 +static struct pingv6_ops real_pingv6_ops = {
100831 + .ipv6_recv_error = ipv6_recv_error,
100832 + .ip6_datagram_recv_common_ctl = ip6_datagram_recv_common_ctl,
100833 + .ip6_datagram_recv_specific_ctl = ip6_datagram_recv_specific_ctl,
100834 + .icmpv6_err_convert = icmpv6_err_convert,
100835 + .ipv6_icmp_error = ipv6_icmp_error,
100836 + .ipv6_chk_addr = ipv6_chk_addr,
100837 +};
100838 +
100839 +static struct pingv6_ops dummy_pingv6_ops = {
100840 + .ipv6_recv_error = dummy_ipv6_recv_error,
100841 + .ip6_datagram_recv_common_ctl = dummy_ip6_datagram_recv_ctl,
100842 + .ip6_datagram_recv_specific_ctl = dummy_ip6_datagram_recv_ctl,
100843 + .icmpv6_err_convert = dummy_icmpv6_err_convert,
100844 + .ipv6_icmp_error = dummy_ipv6_icmp_error,
100845 + .ipv6_chk_addr = dummy_ipv6_chk_addr,
100846 +};
100847 +
100848 int __init pingv6_init(void)
100849 {
100850 #ifdef CONFIG_PROC_FS
100851 @@ -253,13 +271,7 @@ int __init pingv6_init(void)
100852 if (ret)
100853 return ret;
100854 #endif
100855 - pingv6_ops.ipv6_recv_error = ipv6_recv_error;
100856 - pingv6_ops.ip6_datagram_recv_common_ctl = ip6_datagram_recv_common_ctl;
100857 - pingv6_ops.ip6_datagram_recv_specific_ctl =
100858 - ip6_datagram_recv_specific_ctl;
100859 - pingv6_ops.icmpv6_err_convert = icmpv6_err_convert;
100860 - pingv6_ops.ipv6_icmp_error = ipv6_icmp_error;
100861 - pingv6_ops.ipv6_chk_addr = ipv6_chk_addr;
100862 + pingv6_ops = &real_pingv6_ops;
100863 return inet6_register_protosw(&pingv6_protosw);
100864 }
100865
100866 @@ -268,14 +280,9 @@ int __init pingv6_init(void)
100867 */
100868 void pingv6_exit(void)
100869 {
100870 - pingv6_ops.ipv6_recv_error = dummy_ipv6_recv_error;
100871 - pingv6_ops.ip6_datagram_recv_common_ctl = dummy_ip6_datagram_recv_ctl;
100872 - pingv6_ops.ip6_datagram_recv_specific_ctl = dummy_ip6_datagram_recv_ctl;
100873 - pingv6_ops.icmpv6_err_convert = dummy_icmpv6_err_convert;
100874 - pingv6_ops.ipv6_icmp_error = dummy_ipv6_icmp_error;
100875 - pingv6_ops.ipv6_chk_addr = dummy_ipv6_chk_addr;
100876 #ifdef CONFIG_PROC_FS
100877 unregister_pernet_subsys(&ping_v6_net_ops);
100878 #endif
100879 + pingv6_ops = &dummy_pingv6_ops;
100880 inet6_unregister_protosw(&pingv6_protosw);
100881 }
100882 diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
100883 index 091d066..139d410 100644
100884 --- a/net/ipv6/proc.c
100885 +++ b/net/ipv6/proc.c
100886 @@ -309,7 +309,7 @@ static int __net_init ipv6_proc_init_net(struct net *net)
100887 if (!proc_create("snmp6", S_IRUGO, net->proc_net, &snmp6_seq_fops))
100888 goto proc_snmp6_fail;
100889
100890 - net->mib.proc_net_devsnmp6 = proc_mkdir("dev_snmp6", net->proc_net);
100891 + net->mib.proc_net_devsnmp6 = proc_mkdir_restrict("dev_snmp6", net->proc_net);
100892 if (!net->mib.proc_net_devsnmp6)
100893 goto proc_dev_snmp6_fail;
100894 return 0;
100895 diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
100896 index 1f29996..46fe0c7 100644
100897 --- a/net/ipv6/raw.c
100898 +++ b/net/ipv6/raw.c
100899 @@ -388,7 +388,7 @@ static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
100900 {
100901 if ((raw6_sk(sk)->checksum || rcu_access_pointer(sk->sk_filter)) &&
100902 skb_checksum_complete(skb)) {
100903 - atomic_inc(&sk->sk_drops);
100904 + atomic_inc_unchecked(&sk->sk_drops);
100905 kfree_skb(skb);
100906 return NET_RX_DROP;
100907 }
100908 @@ -416,7 +416,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
100909 struct raw6_sock *rp = raw6_sk(sk);
100910
100911 if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
100912 - atomic_inc(&sk->sk_drops);
100913 + atomic_inc_unchecked(&sk->sk_drops);
100914 kfree_skb(skb);
100915 return NET_RX_DROP;
100916 }
100917 @@ -440,7 +440,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
100918
100919 if (inet->hdrincl) {
100920 if (skb_checksum_complete(skb)) {
100921 - atomic_inc(&sk->sk_drops);
100922 + atomic_inc_unchecked(&sk->sk_drops);
100923 kfree_skb(skb);
100924 return NET_RX_DROP;
100925 }
100926 @@ -469,6 +469,9 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
100927 if (flags & MSG_OOB)
100928 return -EOPNOTSUPP;
100929
100930 + if (addr_len)
100931 + *addr_len=sizeof(*sin6);
100932 +
100933 if (flags & MSG_ERRQUEUE)
100934 return ipv6_recv_error(sk, msg, len, addr_len);
100935
100936 @@ -507,7 +510,6 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
100937 sin6->sin6_flowinfo = 0;
100938 sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
100939 IP6CB(skb)->iif);
100940 - *addr_len = sizeof(*sin6);
100941 }
100942
100943 sock_recv_ts_and_drops(msg, sk, skb);
100944 @@ -610,7 +612,7 @@ out:
100945 return err;
100946 }
100947
100948 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
100949 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
100950 struct flowi6 *fl6, struct dst_entry **dstp,
100951 unsigned int flags)
100952 {
100953 @@ -922,12 +924,15 @@ do_confirm:
100954 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
100955 char __user *optval, int optlen)
100956 {
100957 + struct icmp6_filter filter;
100958 +
100959 switch (optname) {
100960 case ICMPV6_FILTER:
100961 if (optlen > sizeof(struct icmp6_filter))
100962 optlen = sizeof(struct icmp6_filter);
100963 - if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
100964 + if (copy_from_user(&filter, optval, optlen))
100965 return -EFAULT;
100966 + raw6_sk(sk)->filter = filter;
100967 return 0;
100968 default:
100969 return -ENOPROTOOPT;
100970 @@ -940,6 +945,7 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
100971 char __user *optval, int __user *optlen)
100972 {
100973 int len;
100974 + struct icmp6_filter filter;
100975
100976 switch (optname) {
100977 case ICMPV6_FILTER:
100978 @@ -951,7 +957,8 @@ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
100979 len = sizeof(struct icmp6_filter);
100980 if (put_user(len, optlen))
100981 return -EFAULT;
100982 - if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
100983 + filter = raw6_sk(sk)->filter;
100984 + if (len > sizeof filter || copy_to_user(optval, &filter, len))
100985 return -EFAULT;
100986 return 0;
100987 default:
100988 diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
100989 index cc85a9b..526a133 100644
100990 --- a/net/ipv6/reassembly.c
100991 +++ b/net/ipv6/reassembly.c
100992 @@ -626,12 +626,11 @@ static struct ctl_table ip6_frags_ctl_table[] = {
100993
100994 static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
100995 {
100996 - struct ctl_table *table;
100997 + ctl_table_no_const *table = NULL;
100998 struct ctl_table_header *hdr;
100999
101000 - table = ip6_frags_ns_ctl_table;
101001 if (!net_eq(net, &init_net)) {
101002 - table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
101003 + table = kmemdup(ip6_frags_ns_ctl_table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
101004 if (table == NULL)
101005 goto err_alloc;
101006
101007 @@ -642,9 +641,10 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
101008 /* Don't export sysctls to unprivileged users */
101009 if (net->user_ns != &init_user_ns)
101010 table[0].procname = NULL;
101011 - }
101012 + hdr = register_net_sysctl(net, "net/ipv6", table);
101013 + } else
101014 + hdr = register_net_sysctl(net, "net/ipv6", ip6_frags_ns_ctl_table);
101015
101016 - hdr = register_net_sysctl(net, "net/ipv6", table);
101017 if (hdr == NULL)
101018 goto err_reg;
101019
101020 @@ -652,8 +652,7 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
101021 return 0;
101022
101023 err_reg:
101024 - if (!net_eq(net, &init_net))
101025 - kfree(table);
101026 + kfree(table);
101027 err_alloc:
101028 return -ENOMEM;
101029 }
101030 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
101031 index 7cc1102..7785931 100644
101032 --- a/net/ipv6/route.c
101033 +++ b/net/ipv6/route.c
101034 @@ -2973,7 +2973,7 @@ struct ctl_table ipv6_route_table_template[] = {
101035
101036 struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
101037 {
101038 - struct ctl_table *table;
101039 + ctl_table_no_const *table;
101040
101041 table = kmemdup(ipv6_route_table_template,
101042 sizeof(ipv6_route_table_template),
101043 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
101044 index b4d74c8..b4f3fbe 100644
101045 --- a/net/ipv6/sit.c
101046 +++ b/net/ipv6/sit.c
101047 @@ -74,7 +74,7 @@ static void ipip6_tunnel_setup(struct net_device *dev);
101048 static void ipip6_dev_free(struct net_device *dev);
101049 static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
101050 __be32 *v4dst);
101051 -static struct rtnl_link_ops sit_link_ops __read_mostly;
101052 +static struct rtnl_link_ops sit_link_ops;
101053
101054 static int sit_net_id __read_mostly;
101055 struct sit_net {
101056 @@ -1683,7 +1683,7 @@ static void ipip6_dellink(struct net_device *dev, struct list_head *head)
101057 unregister_netdevice_queue(dev, head);
101058 }
101059
101060 -static struct rtnl_link_ops sit_link_ops __read_mostly = {
101061 +static struct rtnl_link_ops sit_link_ops = {
101062 .kind = "sit",
101063 .maxtype = IFLA_IPTUN_MAX,
101064 .policy = ipip6_policy,
101065 diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
101066 index 7f405a1..eabef92 100644
101067 --- a/net/ipv6/sysctl_net_ipv6.c
101068 +++ b/net/ipv6/sysctl_net_ipv6.c
101069 @@ -54,7 +54,7 @@ static struct ctl_table ipv6_rotable[] = {
101070
101071 static int __net_init ipv6_sysctl_net_init(struct net *net)
101072 {
101073 - struct ctl_table *ipv6_table;
101074 + ctl_table_no_const *ipv6_table;
101075 struct ctl_table *ipv6_route_table;
101076 struct ctl_table *ipv6_icmp_table;
101077 int err;
101078 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
101079 index 889079b..a04512c 100644
101080 --- a/net/ipv6/tcp_ipv6.c
101081 +++ b/net/ipv6/tcp_ipv6.c
101082 @@ -104,6 +104,10 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
101083 inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
101084 }
101085
101086 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101087 +extern int grsec_enable_blackhole;
101088 +#endif
101089 +
101090 static void tcp_v6_hash(struct sock *sk)
101091 {
101092 if (sk->sk_state != TCP_CLOSE) {
101093 @@ -1412,6 +1416,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
101094 return 0;
101095
101096 reset:
101097 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101098 + if (!grsec_enable_blackhole)
101099 +#endif
101100 tcp_v6_send_reset(sk, skb);
101101 discard:
101102 if (opt_skb)
101103 @@ -1496,12 +1503,20 @@ static int tcp_v6_rcv(struct sk_buff *skb)
101104 TCP_SKB_CB(skb)->sacked = 0;
101105
101106 sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
101107 - if (!sk)
101108 + if (!sk) {
101109 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101110 + ret = 1;
101111 +#endif
101112 goto no_tcp_socket;
101113 + }
101114
101115 process:
101116 - if (sk->sk_state == TCP_TIME_WAIT)
101117 + if (sk->sk_state == TCP_TIME_WAIT) {
101118 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101119 + ret = 2;
101120 +#endif
101121 goto do_time_wait;
101122 + }
101123
101124 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
101125 NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
101126 @@ -1553,6 +1568,10 @@ csum_error:
101127 bad_packet:
101128 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
101129 } else {
101130 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101131 + if (!grsec_enable_blackhole || (ret == 1 &&
101132 + (skb->dev->flags & IFF_LOOPBACK)))
101133 +#endif
101134 tcp_v6_send_reset(NULL, skb);
101135 }
101136
101137 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
101138 index 1e586d9..384a9c9 100644
101139 --- a/net/ipv6/udp.c
101140 +++ b/net/ipv6/udp.c
101141 @@ -76,6 +76,10 @@ static unsigned int udp6_ehashfn(struct net *net,
101142 udp_ipv6_hash_secret + net_hash_mix(net));
101143 }
101144
101145 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101146 +extern int grsec_enable_blackhole;
101147 +#endif
101148 +
101149 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
101150 {
101151 const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
101152 @@ -392,6 +396,9 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
101153 int is_udp4;
101154 bool slow;
101155
101156 + if (addr_len)
101157 + *addr_len = sizeof(struct sockaddr_in6);
101158 +
101159 if (flags & MSG_ERRQUEUE)
101160 return ipv6_recv_error(sk, msg, len, addr_len);
101161
101162 @@ -435,7 +442,7 @@ try_again:
101163 if (unlikely(err)) {
101164 trace_kfree_skb(skb, udpv6_recvmsg);
101165 if (!peeked) {
101166 - atomic_inc(&sk->sk_drops);
101167 + atomic_inc_unchecked(&sk->sk_drops);
101168 if (is_udp4)
101169 UDP_INC_STATS_USER(sock_net(sk),
101170 UDP_MIB_INERRORS,
101171 @@ -475,7 +482,7 @@ try_again:
101172 ipv6_iface_scope_id(&sin6->sin6_addr,
101173 IP6CB(skb)->iif);
101174 }
101175 - *addr_len = sizeof(*sin6);
101176 +
101177 }
101178
101179 if (np->rxopt.all)
101180 @@ -690,7 +697,7 @@ csum_error:
101181 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
101182 drop:
101183 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
101184 - atomic_inc(&sk->sk_drops);
101185 + atomic_inc_unchecked(&sk->sk_drops);
101186 kfree_skb(skb);
101187 return -1;
101188 }
101189 @@ -747,7 +754,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
101190 if (likely(skb1 == NULL))
101191 skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
101192 if (!skb1) {
101193 - atomic_inc(&sk->sk_drops);
101194 + atomic_inc_unchecked(&sk->sk_drops);
101195 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
101196 IS_UDPLITE(sk));
101197 UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
101198 @@ -886,6 +893,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
101199 goto csum_error;
101200
101201 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
101202 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
101203 + if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
101204 +#endif
101205 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
101206
101207 kfree_skb(skb);
101208 diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
101209 index 5f8e128..865d38e 100644
101210 --- a/net/ipv6/xfrm6_policy.c
101211 +++ b/net/ipv6/xfrm6_policy.c
101212 @@ -212,11 +212,11 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
101213 }
101214 }
101215
101216 -static inline int xfrm6_garbage_collect(struct dst_ops *ops)
101217 +static int xfrm6_garbage_collect(struct dst_ops *ops)
101218 {
101219 struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
101220
101221 - xfrm6_policy_afinfo.garbage_collect(net);
101222 + xfrm_garbage_collect_deferred(net);
101223 return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
101224 }
101225
101226 @@ -329,19 +329,19 @@ static struct ctl_table xfrm6_policy_table[] = {
101227
101228 static int __net_init xfrm6_net_init(struct net *net)
101229 {
101230 - struct ctl_table *table;
101231 + ctl_table_no_const *table = NULL;
101232 struct ctl_table_header *hdr;
101233
101234 - table = xfrm6_policy_table;
101235 if (!net_eq(net, &init_net)) {
101236 - table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
101237 + table = kmemdup(xfrm6_policy_table, sizeof(xfrm6_policy_table), GFP_KERNEL);
101238 if (!table)
101239 goto err_alloc;
101240
101241 table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
101242 - }
101243 + hdr = register_net_sysctl(net, "net/ipv6", table);
101244 + } else
101245 + hdr = register_net_sysctl(net, "net/ipv6", xfrm6_policy_table);
101246
101247 - hdr = register_net_sysctl(net, "net/ipv6", table);
101248 if (!hdr)
101249 goto err_reg;
101250
101251 @@ -349,8 +349,7 @@ static int __net_init xfrm6_net_init(struct net *net)
101252 return 0;
101253
101254 err_reg:
101255 - if (!net_eq(net, &init_net))
101256 - kfree(table);
101257 + kfree(table);
101258 err_alloc:
101259 return -ENOMEM;
101260 }
101261 diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
101262 index e15c16a..7cf07aa 100644
101263 --- a/net/ipx/ipx_proc.c
101264 +++ b/net/ipx/ipx_proc.c
101265 @@ -289,7 +289,7 @@ int __init ipx_proc_init(void)
101266 struct proc_dir_entry *p;
101267 int rc = -ENOMEM;
101268
101269 - ipx_proc_dir = proc_mkdir("ipx", init_net.proc_net);
101270 + ipx_proc_dir = proc_mkdir_restrict("ipx", init_net.proc_net);
101271
101272 if (!ipx_proc_dir)
101273 goto out;
101274 diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
101275 index 2ba8b97..6d33010 100644
101276 --- a/net/irda/ircomm/ircomm_tty.c
101277 +++ b/net/irda/ircomm/ircomm_tty.c
101278 @@ -317,11 +317,11 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
101279 add_wait_queue(&port->open_wait, &wait);
101280
101281 IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
101282 - __FILE__, __LINE__, tty->driver->name, port->count);
101283 + __FILE__, __LINE__, tty->driver->name, atomic_read(&port->count));
101284
101285 spin_lock_irqsave(&port->lock, flags);
101286 if (!tty_hung_up_p(filp))
101287 - port->count--;
101288 + atomic_dec(&port->count);
101289 port->blocked_open++;
101290 spin_unlock_irqrestore(&port->lock, flags);
101291
101292 @@ -356,7 +356,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
101293 }
101294
101295 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
101296 - __FILE__, __LINE__, tty->driver->name, port->count);
101297 + __FILE__, __LINE__, tty->driver->name, atomic_read(&port->count));
101298
101299 schedule();
101300 }
101301 @@ -366,12 +366,12 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
101302
101303 spin_lock_irqsave(&port->lock, flags);
101304 if (!tty_hung_up_p(filp))
101305 - port->count++;
101306 + atomic_inc(&port->count);
101307 port->blocked_open--;
101308 spin_unlock_irqrestore(&port->lock, flags);
101309
101310 IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
101311 - __FILE__, __LINE__, tty->driver->name, port->count);
101312 + __FILE__, __LINE__, tty->driver->name, atomic_read(&port->count));
101313
101314 if (!retval)
101315 port->flags |= ASYNC_NORMAL_ACTIVE;
101316 @@ -445,12 +445,12 @@ static int ircomm_tty_open(struct tty_struct *tty, struct file *filp)
101317
101318 /* ++ is not atomic, so this should be protected - Jean II */
101319 spin_lock_irqsave(&self->port.lock, flags);
101320 - self->port.count++;
101321 + atomic_inc(&self->port.count);
101322 spin_unlock_irqrestore(&self->port.lock, flags);
101323 tty_port_tty_set(&self->port, tty);
101324
101325 IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
101326 - self->line, self->port.count);
101327 + self->line, atomic_read(&self->port.count));
101328
101329 /* Not really used by us, but lets do it anyway */
101330 self->port.low_latency = (self->port.flags & ASYNC_LOW_LATENCY) ? 1 : 0;
101331 @@ -987,7 +987,7 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
101332 tty_kref_put(port->tty);
101333 }
101334 port->tty = NULL;
101335 - port->count = 0;
101336 + atomic_set(&port->count, 0);
101337 spin_unlock_irqrestore(&port->lock, flags);
101338
101339 wake_up_interruptible(&port->open_wait);
101340 @@ -1344,7 +1344,7 @@ static void ircomm_tty_line_info(struct ircomm_tty_cb *self, struct seq_file *m)
101341 seq_putc(m, '\n');
101342
101343 seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
101344 - seq_printf(m, "Open count: %d\n", self->port.count);
101345 + seq_printf(m, "Open count: %d\n", atomic_read(&self->port.count));
101346 seq_printf(m, "Max data size: %d\n", self->max_data_size);
101347 seq_printf(m, "Max header size: %d\n", self->max_header_size);
101348
101349 diff --git a/net/irda/irproc.c b/net/irda/irproc.c
101350 index b9ac598..f88cc56 100644
101351 --- a/net/irda/irproc.c
101352 +++ b/net/irda/irproc.c
101353 @@ -66,7 +66,7 @@ void __init irda_proc_register(void)
101354 {
101355 int i;
101356
101357 - proc_irda = proc_mkdir("irda", init_net.proc_net);
101358 + proc_irda = proc_mkdir_restrict("irda", init_net.proc_net);
101359 if (proc_irda == NULL)
101360 return;
101361
101362 diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
101363 index c4b7218..c7e9f14 100644
101364 --- a/net/iucv/af_iucv.c
101365 +++ b/net/iucv/af_iucv.c
101366 @@ -773,10 +773,10 @@ static int iucv_sock_autobind(struct sock *sk)
101367
101368 write_lock_bh(&iucv_sk_list.lock);
101369
101370 - sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
101371 + sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
101372 while (__iucv_get_sock_by_name(name)) {
101373 sprintf(name, "%08x",
101374 - atomic_inc_return(&iucv_sk_list.autobind_name));
101375 + atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
101376 }
101377
101378 write_unlock_bh(&iucv_sk_list.lock);
101379 @@ -1829,7 +1829,7 @@ static void iucv_callback_txdone(struct iucv_path *path,
101380 spin_lock_irqsave(&list->lock, flags);
101381
101382 while (list_skb != (struct sk_buff *)list) {
101383 - if (msg->tag != IUCV_SKB_CB(list_skb)->tag) {
101384 + if (msg->tag == IUCV_SKB_CB(list_skb)->tag) {
101385 this = list_skb;
101386 break;
101387 }
101388 diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
101389 index cd5b8ec..f205e6b 100644
101390 --- a/net/iucv/iucv.c
101391 +++ b/net/iucv/iucv.c
101392 @@ -690,7 +690,7 @@ static int iucv_cpu_notify(struct notifier_block *self,
101393 return NOTIFY_OK;
101394 }
101395
101396 -static struct notifier_block __refdata iucv_cpu_notifier = {
101397 +static struct notifier_block iucv_cpu_notifier = {
101398 .notifier_call = iucv_cpu_notify,
101399 };
101400
101401 diff --git a/net/key/af_key.c b/net/key/af_key.c
101402 index 7932697..a13d158 100644
101403 --- a/net/key/af_key.c
101404 +++ b/net/key/af_key.c
101405 @@ -3052,10 +3052,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
101406 static u32 get_acqseq(void)
101407 {
101408 u32 res;
101409 - static atomic_t acqseq;
101410 + static atomic_unchecked_t acqseq;
101411
101412 do {
101413 - res = atomic_inc_return(&acqseq);
101414 + res = atomic_inc_return_unchecked(&acqseq);
101415 } while (!res);
101416 return res;
101417 }
101418 diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
101419 index 0b44d85..1a7f88b 100644
101420 --- a/net/l2tp/l2tp_ip.c
101421 +++ b/net/l2tp/l2tp_ip.c
101422 @@ -518,6 +518,9 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
101423 if (flags & MSG_OOB)
101424 goto out;
101425
101426 + if (addr_len)
101427 + *addr_len = sizeof(*sin);
101428 +
101429 skb = skb_recv_datagram(sk, flags, noblock, &err);
101430 if (!skb)
101431 goto out;
101432 @@ -540,7 +543,6 @@ static int l2tp_ip_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
101433 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
101434 sin->sin_port = 0;
101435 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
101436 - *addr_len = sizeof(*sin);
101437 }
101438 if (inet->cmsg_flags)
101439 ip_cmsg_recv(msg, skb);
101440 diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
101441 index 1a3c7e0..80f8b0c 100644
101442 --- a/net/llc/llc_proc.c
101443 +++ b/net/llc/llc_proc.c
101444 @@ -247,7 +247,7 @@ int __init llc_proc_init(void)
101445 int rc = -ENOMEM;
101446 struct proc_dir_entry *p;
101447
101448 - llc_proc_dir = proc_mkdir("llc", init_net.proc_net);
101449 + llc_proc_dir = proc_mkdir_restrict("llc", init_net.proc_net);
101450 if (!llc_proc_dir)
101451 goto out;
101452
101453 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
101454 index 453e974..b3a43a5 100644
101455 --- a/net/mac80211/cfg.c
101456 +++ b/net/mac80211/cfg.c
101457 @@ -839,7 +839,7 @@ static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
101458 ret = ieee80211_vif_use_channel(sdata, chandef,
101459 IEEE80211_CHANCTX_EXCLUSIVE);
101460 }
101461 - } else if (local->open_count == local->monitors) {
101462 + } else if (local_read(&local->open_count) == local->monitors) {
101463 local->_oper_chandef = *chandef;
101464 ieee80211_hw_config(local, 0);
101465 }
101466 @@ -3356,7 +3356,7 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
101467 else
101468 local->probe_req_reg--;
101469
101470 - if (!local->open_count)
101471 + if (!local_read(&local->open_count))
101472 break;
101473
101474 ieee80211_queue_work(&local->hw, &local->reconfig_filter);
101475 @@ -3819,8 +3819,8 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
101476 if (chanctx_conf) {
101477 *chandef = chanctx_conf->def;
101478 ret = 0;
101479 - } else if (local->open_count > 0 &&
101480 - local->open_count == local->monitors &&
101481 + } else if (local_read(&local->open_count) > 0 &&
101482 + local_read(&local->open_count) == local->monitors &&
101483 sdata->vif.type == NL80211_IFTYPE_MONITOR) {
101484 if (local->use_chanctx)
101485 *chandef = local->monitor_chandef;
101486 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
101487 index 6bd4984..d8805c5 100644
101488 --- a/net/mac80211/ieee80211_i.h
101489 +++ b/net/mac80211/ieee80211_i.h
101490 @@ -28,6 +28,7 @@
101491 #include <net/ieee80211_radiotap.h>
101492 #include <net/cfg80211.h>
101493 #include <net/mac80211.h>
101494 +#include <asm/local.h>
101495 #include "key.h"
101496 #include "sta_info.h"
101497 #include "debug.h"
101498 @@ -994,7 +995,7 @@ struct ieee80211_local {
101499 /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
101500 spinlock_t queue_stop_reason_lock;
101501
101502 - int open_count;
101503 + local_t open_count;
101504 int monitors, cooked_mntrs;
101505 /* number of interfaces with corresponding FIF_ flags */
101506 int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
101507 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
101508 index ce1c443..6cd39e1 100644
101509 --- a/net/mac80211/iface.c
101510 +++ b/net/mac80211/iface.c
101511 @@ -529,7 +529,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
101512 break;
101513 }
101514
101515 - if (local->open_count == 0) {
101516 + if (local_read(&local->open_count) == 0) {
101517 res = drv_start(local);
101518 if (res)
101519 goto err_del_bss;
101520 @@ -576,7 +576,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
101521 res = drv_add_interface(local, sdata);
101522 if (res)
101523 goto err_stop;
101524 - } else if (local->monitors == 0 && local->open_count == 0) {
101525 + } else if (local->monitors == 0 && local_read(&local->open_count) == 0) {
101526 res = ieee80211_add_virtual_monitor(local);
101527 if (res)
101528 goto err_stop;
101529 @@ -685,7 +685,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
101530 atomic_inc(&local->iff_promiscs);
101531
101532 if (coming_up)
101533 - local->open_count++;
101534 + local_inc(&local->open_count);
101535
101536 if (hw_reconf_flags)
101537 ieee80211_hw_config(local, hw_reconf_flags);
101538 @@ -723,7 +723,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
101539 err_del_interface:
101540 drv_remove_interface(local, sdata);
101541 err_stop:
101542 - if (!local->open_count)
101543 + if (!local_read(&local->open_count))
101544 drv_stop(local);
101545 err_del_bss:
101546 sdata->bss = NULL;
101547 @@ -874,7 +874,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
101548 }
101549
101550 if (going_down)
101551 - local->open_count--;
101552 + local_dec(&local->open_count);
101553
101554 switch (sdata->vif.type) {
101555 case NL80211_IFTYPE_AP_VLAN:
101556 @@ -933,7 +933,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
101557 }
101558 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
101559
101560 - if (local->open_count == 0)
101561 + if (local_read(&local->open_count) == 0)
101562 ieee80211_clear_tx_pending(local);
101563
101564 /*
101565 @@ -973,7 +973,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
101566
101567 ieee80211_recalc_ps(local, -1);
101568
101569 - if (local->open_count == 0) {
101570 + if (local_read(&local->open_count) == 0) {
101571 ieee80211_stop_device(local);
101572
101573 /* no reconfiguring after stop! */
101574 @@ -984,7 +984,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
101575 ieee80211_configure_filter(local);
101576 ieee80211_hw_config(local, hw_reconf_flags);
101577
101578 - if (local->monitors == local->open_count)
101579 + if (local->monitors == local_read(&local->open_count))
101580 ieee80211_add_virtual_monitor(local);
101581 }
101582
101583 diff --git a/net/mac80211/main.c b/net/mac80211/main.c
101584 index c7a7a86..a74f57b 100644
101585 --- a/net/mac80211/main.c
101586 +++ b/net/mac80211/main.c
101587 @@ -174,7 +174,7 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
101588 changed &= ~(IEEE80211_CONF_CHANGE_CHANNEL |
101589 IEEE80211_CONF_CHANGE_POWER);
101590
101591 - if (changed && local->open_count) {
101592 + if (changed && local_read(&local->open_count)) {
101593 ret = drv_config(local, changed);
101594 /*
101595 * Goal:
101596 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
101597 index d478b88..8c8d157 100644
101598 --- a/net/mac80211/pm.c
101599 +++ b/net/mac80211/pm.c
101600 @@ -12,7 +12,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
101601 struct ieee80211_sub_if_data *sdata;
101602 struct sta_info *sta;
101603
101604 - if (!local->open_count)
101605 + if (!local_read(&local->open_count))
101606 goto suspend;
101607
101608 ieee80211_scan_cancel(local);
101609 @@ -58,7 +58,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
101610 cancel_work_sync(&local->dynamic_ps_enable_work);
101611 del_timer_sync(&local->dynamic_ps_timer);
101612
101613 - local->wowlan = wowlan && local->open_count;
101614 + local->wowlan = wowlan && local_read(&local->open_count);
101615 if (local->wowlan) {
101616 int err = drv_suspend(local, wowlan);
101617 if (err < 0) {
101618 @@ -123,7 +123,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
101619 WARN_ON(!list_empty(&local->chanctx_list));
101620
101621 /* stop hardware - this must stop RX */
101622 - if (local->open_count)
101623 + if (local_read(&local->open_count))
101624 ieee80211_stop_device(local);
101625
101626 suspend:
101627 diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
101628 index 22b223f..ab70070 100644
101629 --- a/net/mac80211/rate.c
101630 +++ b/net/mac80211/rate.c
101631 @@ -734,7 +734,7 @@ int ieee80211_init_rate_ctrl_alg(struct ieee80211_local *local,
101632
101633 ASSERT_RTNL();
101634
101635 - if (local->open_count)
101636 + if (local_read(&local->open_count))
101637 return -EBUSY;
101638
101639 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
101640 diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
101641 index 6ff1346..936ca9a 100644
101642 --- a/net/mac80211/rc80211_pid_debugfs.c
101643 +++ b/net/mac80211/rc80211_pid_debugfs.c
101644 @@ -193,7 +193,7 @@ static ssize_t rate_control_pid_events_read(struct file *file, char __user *buf,
101645
101646 spin_unlock_irqrestore(&events->lock, status);
101647
101648 - if (copy_to_user(buf, pb, p))
101649 + if (p > sizeof(pb) || copy_to_user(buf, pb, p))
101650 return -EFAULT;
101651
101652 return p;
101653 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
101654 index b8700d4..89086d5 100644
101655 --- a/net/mac80211/util.c
101656 +++ b/net/mac80211/util.c
101657 @@ -1483,7 +1483,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
101658 }
101659 #endif
101660 /* everything else happens only if HW was up & running */
101661 - if (!local->open_count)
101662 + if (!local_read(&local->open_count))
101663 goto wake_up;
101664
101665 /*
101666 @@ -1708,7 +1708,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
101667 local->in_reconfig = false;
101668 barrier();
101669
101670 - if (local->monitors == local->open_count && local->monitors > 0)
101671 + if (local->monitors == local_read(&local->open_count) && local->monitors > 0)
101672 ieee80211_add_virtual_monitor(local);
101673
101674 /*
101675 diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
101676 index e9410d1..77b6378 100644
101677 --- a/net/netfilter/Kconfig
101678 +++ b/net/netfilter/Kconfig
101679 @@ -1081,6 +1081,16 @@ config NETFILTER_XT_MATCH_ESP
101680
101681 To compile it as a module, choose M here. If unsure, say N.
101682
101683 +config NETFILTER_XT_MATCH_GRADM
101684 + tristate '"gradm" match support'
101685 + depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
101686 + depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
101687 + ---help---
101688 + The gradm match allows to match on grsecurity RBAC being enabled.
101689 + It is useful when iptables rules are applied early on bootup to
101690 + prevent connections to the machine (except from a trusted host)
101691 + while the RBAC system is disabled.
101692 +
101693 config NETFILTER_XT_MATCH_HASHLIMIT
101694 tristate '"hashlimit" match support'
101695 depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
101696 diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
101697 index bffdad7..f9317d1 100644
101698 --- a/net/netfilter/Makefile
101699 +++ b/net/netfilter/Makefile
101700 @@ -133,6 +133,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
101701 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
101702 obj-$(CONFIG_NETFILTER_XT_MATCH_ECN) += xt_ecn.o
101703 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
101704 +obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
101705 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
101706 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
101707 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
101708 diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
101709 index de770ec..3fc49d2 100644
101710 --- a/net/netfilter/ipset/ip_set_core.c
101711 +++ b/net/netfilter/ipset/ip_set_core.c
101712 @@ -1922,7 +1922,7 @@ done:
101713 return ret;
101714 }
101715
101716 -static struct nf_sockopt_ops so_set __read_mostly = {
101717 +static struct nf_sockopt_ops so_set = {
101718 .pf = PF_INET,
101719 .get_optmin = SO_IP_SET,
101720 .get_optmax = SO_IP_SET + 1,
101721 diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
101722 index a8eb0a8..86f2de4 100644
101723 --- a/net/netfilter/ipvs/ip_vs_conn.c
101724 +++ b/net/netfilter/ipvs/ip_vs_conn.c
101725 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
101726 /* Increase the refcnt counter of the dest */
101727 ip_vs_dest_hold(dest);
101728
101729 - conn_flags = atomic_read(&dest->conn_flags);
101730 + conn_flags = atomic_read_unchecked(&dest->conn_flags);
101731 if (cp->protocol != IPPROTO_UDP)
101732 conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
101733 flags = cp->flags;
101734 @@ -900,7 +900,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
101735
101736 cp->control = NULL;
101737 atomic_set(&cp->n_control, 0);
101738 - atomic_set(&cp->in_pkts, 0);
101739 + atomic_set_unchecked(&cp->in_pkts, 0);
101740
101741 cp->packet_xmit = NULL;
101742 cp->app = NULL;
101743 @@ -1188,7 +1188,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
101744
101745 /* Don't drop the entry if its number of incoming packets is not
101746 located in [0, 8] */
101747 - i = atomic_read(&cp->in_pkts);
101748 + i = atomic_read_unchecked(&cp->in_pkts);
101749 if (i > 8 || i < 0) return 0;
101750
101751 if (!todrop_rate[i]) return 0;
101752 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
101753 index 4f26ee4..6a9d7c3 100644
101754 --- a/net/netfilter/ipvs/ip_vs_core.c
101755 +++ b/net/netfilter/ipvs/ip_vs_core.c
101756 @@ -567,7 +567,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
101757 ret = cp->packet_xmit(skb, cp, pd->pp, iph);
101758 /* do not touch skb anymore */
101759
101760 - atomic_inc(&cp->in_pkts);
101761 + atomic_inc_unchecked(&cp->in_pkts);
101762 ip_vs_conn_put(cp);
101763 return ret;
101764 }
101765 @@ -1706,7 +1706,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb, int af)
101766 if (cp->flags & IP_VS_CONN_F_ONE_PACKET)
101767 pkts = sysctl_sync_threshold(ipvs);
101768 else
101769 - pkts = atomic_add_return(1, &cp->in_pkts);
101770 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
101771
101772 if (ipvs->sync_state & IP_VS_STATE_MASTER)
101773 ip_vs_sync_conn(net, cp, pkts);
101774 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
101775 index 35be035..50f8834 100644
101776 --- a/net/netfilter/ipvs/ip_vs_ctl.c
101777 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
101778 @@ -794,7 +794,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
101779 */
101780 ip_vs_rs_hash(ipvs, dest);
101781 }
101782 - atomic_set(&dest->conn_flags, conn_flags);
101783 + atomic_set_unchecked(&dest->conn_flags, conn_flags);
101784
101785 /* bind the service */
101786 old_svc = rcu_dereference_protected(dest->svc, 1);
101787 @@ -1654,7 +1654,7 @@ proc_do_sync_ports(struct ctl_table *table, int write,
101788 * align with netns init in ip_vs_control_net_init()
101789 */
101790
101791 -static struct ctl_table vs_vars[] = {
101792 +static ctl_table_no_const vs_vars[] __read_only = {
101793 {
101794 .procname = "amemthresh",
101795 .maxlen = sizeof(int),
101796 @@ -2075,7 +2075,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
101797 " %-7s %-6d %-10d %-10d\n",
101798 &dest->addr.in6,
101799 ntohs(dest->port),
101800 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
101801 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
101802 atomic_read(&dest->weight),
101803 atomic_read(&dest->activeconns),
101804 atomic_read(&dest->inactconns));
101805 @@ -2086,7 +2086,7 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v)
101806 "%-7s %-6d %-10d %-10d\n",
101807 ntohl(dest->addr.ip),
101808 ntohs(dest->port),
101809 - ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
101810 + ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
101811 atomic_read(&dest->weight),
101812 atomic_read(&dest->activeconns),
101813 atomic_read(&dest->inactconns));
101814 @@ -2564,7 +2564,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
101815
101816 entry.addr = dest->addr.ip;
101817 entry.port = dest->port;
101818 - entry.conn_flags = atomic_read(&dest->conn_flags);
101819 + entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
101820 entry.weight = atomic_read(&dest->weight);
101821 entry.u_threshold = dest->u_threshold;
101822 entry.l_threshold = dest->l_threshold;
101823 @@ -3107,7 +3107,7 @@ static int ip_vs_genl_fill_dest(struct sk_buff *skb, struct ip_vs_dest *dest)
101824 if (nla_put(skb, IPVS_DEST_ATTR_ADDR, sizeof(dest->addr), &dest->addr) ||
101825 nla_put_be16(skb, IPVS_DEST_ATTR_PORT, dest->port) ||
101826 nla_put_u32(skb, IPVS_DEST_ATTR_FWD_METHOD,
101827 - (atomic_read(&dest->conn_flags) &
101828 + (atomic_read_unchecked(&dest->conn_flags) &
101829 IP_VS_CONN_F_FWD_MASK)) ||
101830 nla_put_u32(skb, IPVS_DEST_ATTR_WEIGHT,
101831 atomic_read(&dest->weight)) ||
101832 @@ -3580,7 +3580,7 @@ out:
101833 }
101834
101835
101836 -static const struct genl_ops ip_vs_genl_ops[] __read_mostly = {
101837 +static const struct genl_ops ip_vs_genl_ops[] = {
101838 {
101839 .cmd = IPVS_CMD_NEW_SERVICE,
101840 .flags = GENL_ADMIN_PERM,
101841 @@ -3697,7 +3697,7 @@ static int __net_init ip_vs_control_net_init_sysctl(struct net *net)
101842 {
101843 int idx;
101844 struct netns_ipvs *ipvs = net_ipvs(net);
101845 - struct ctl_table *tbl;
101846 + ctl_table_no_const *tbl;
101847
101848 atomic_set(&ipvs->dropentry, 0);
101849 spin_lock_init(&ipvs->dropentry_lock);
101850 diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
101851 index ca056a3..9cf01ef 100644
101852 --- a/net/netfilter/ipvs/ip_vs_lblc.c
101853 +++ b/net/netfilter/ipvs/ip_vs_lblc.c
101854 @@ -118,7 +118,7 @@ struct ip_vs_lblc_table {
101855 * IPVS LBLC sysctl table
101856 */
101857 #ifdef CONFIG_SYSCTL
101858 -static struct ctl_table vs_vars_table[] = {
101859 +static ctl_table_no_const vs_vars_table[] __read_only = {
101860 {
101861 .procname = "lblc_expiration",
101862 .data = NULL,
101863 diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
101864 index 3f21a2f..a112e85 100644
101865 --- a/net/netfilter/ipvs/ip_vs_lblcr.c
101866 +++ b/net/netfilter/ipvs/ip_vs_lblcr.c
101867 @@ -289,7 +289,7 @@ struct ip_vs_lblcr_table {
101868 * IPVS LBLCR sysctl table
101869 */
101870
101871 -static struct ctl_table vs_vars_table[] = {
101872 +static ctl_table_no_const vs_vars_table[] __read_only = {
101873 {
101874 .procname = "lblcr_expiration",
101875 .data = NULL,
101876 diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
101877 index db80126..ef7110e 100644
101878 --- a/net/netfilter/ipvs/ip_vs_sync.c
101879 +++ b/net/netfilter/ipvs/ip_vs_sync.c
101880 @@ -609,7 +609,7 @@ static void ip_vs_sync_conn_v0(struct net *net, struct ip_vs_conn *cp,
101881 cp = cp->control;
101882 if (cp) {
101883 if (cp->flags & IP_VS_CONN_F_TEMPLATE)
101884 - pkts = atomic_add_return(1, &cp->in_pkts);
101885 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
101886 else
101887 pkts = sysctl_sync_threshold(ipvs);
101888 ip_vs_sync_conn(net, cp->control, pkts);
101889 @@ -771,7 +771,7 @@ control:
101890 if (!cp)
101891 return;
101892 if (cp->flags & IP_VS_CONN_F_TEMPLATE)
101893 - pkts = atomic_add_return(1, &cp->in_pkts);
101894 + pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
101895 else
101896 pkts = sysctl_sync_threshold(ipvs);
101897 goto sloop;
101898 @@ -895,7 +895,7 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
101899
101900 if (opt)
101901 memcpy(&cp->in_seq, opt, sizeof(*opt));
101902 - atomic_set(&cp->in_pkts, sysctl_sync_threshold(ipvs));
101903 + atomic_set_unchecked(&cp->in_pkts, sysctl_sync_threshold(ipvs));
101904 cp->state = state;
101905 cp->old_state = cp->state;
101906 /*
101907 diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
101908 index c47444e..b0961c6 100644
101909 --- a/net/netfilter/ipvs/ip_vs_xmit.c
101910 +++ b/net/netfilter/ipvs/ip_vs_xmit.c
101911 @@ -1102,7 +1102,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
101912 else
101913 rc = NF_ACCEPT;
101914 /* do not touch skb anymore */
101915 - atomic_inc(&cp->in_pkts);
101916 + atomic_inc_unchecked(&cp->in_pkts);
101917 goto out;
101918 }
101919
101920 @@ -1194,7 +1194,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
101921 else
101922 rc = NF_ACCEPT;
101923 /* do not touch skb anymore */
101924 - atomic_inc(&cp->in_pkts);
101925 + atomic_inc_unchecked(&cp->in_pkts);
101926 goto out;
101927 }
101928
101929 diff --git a/net/netfilter/nf_conntrack_acct.c b/net/netfilter/nf_conntrack_acct.c
101930 index a4b5e2a..13b1de3 100644
101931 --- a/net/netfilter/nf_conntrack_acct.c
101932 +++ b/net/netfilter/nf_conntrack_acct.c
101933 @@ -62,7 +62,7 @@ static struct nf_ct_ext_type acct_extend __read_mostly = {
101934 #ifdef CONFIG_SYSCTL
101935 static int nf_conntrack_acct_init_sysctl(struct net *net)
101936 {
101937 - struct ctl_table *table;
101938 + ctl_table_no_const *table;
101939
101940 table = kmemdup(acct_sysctl_table, sizeof(acct_sysctl_table),
101941 GFP_KERNEL);
101942 diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
101943 index 356bef5..99932cb 100644
101944 --- a/net/netfilter/nf_conntrack_core.c
101945 +++ b/net/netfilter/nf_conntrack_core.c
101946 @@ -1627,6 +1627,10 @@ void nf_conntrack_init_end(void)
101947 #define DYING_NULLS_VAL ((1<<30)+1)
101948 #define TEMPLATE_NULLS_VAL ((1<<30)+2)
101949
101950 +#ifdef CONFIG_GRKERNSEC_HIDESYM
101951 +static atomic_unchecked_t conntrack_cache_id = ATOMIC_INIT(0);
101952 +#endif
101953 +
101954 int nf_conntrack_init_net(struct net *net)
101955 {
101956 int ret;
101957 @@ -1641,7 +1645,11 @@ int nf_conntrack_init_net(struct net *net)
101958 goto err_stat;
101959 }
101960
101961 +#ifdef CONFIG_GRKERNSEC_HIDESYM
101962 + net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%08lx", atomic_inc_return_unchecked(&conntrack_cache_id));
101963 +#else
101964 net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
101965 +#endif
101966 if (!net->ct.slabname) {
101967 ret = -ENOMEM;
101968 goto err_slabname;
101969 diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
101970 index 1df1761..ce8b88a 100644
101971 --- a/net/netfilter/nf_conntrack_ecache.c
101972 +++ b/net/netfilter/nf_conntrack_ecache.c
101973 @@ -188,7 +188,7 @@ static struct nf_ct_ext_type event_extend __read_mostly = {
101974 #ifdef CONFIG_SYSCTL
101975 static int nf_conntrack_event_init_sysctl(struct net *net)
101976 {
101977 - struct ctl_table *table;
101978 + ctl_table_no_const *table;
101979
101980 table = kmemdup(event_sysctl_table, sizeof(event_sysctl_table),
101981 GFP_KERNEL);
101982 diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
101983 index 974a2a4..52cc6ff 100644
101984 --- a/net/netfilter/nf_conntrack_helper.c
101985 +++ b/net/netfilter/nf_conntrack_helper.c
101986 @@ -57,7 +57,7 @@ static struct ctl_table helper_sysctl_table[] = {
101987
101988 static int nf_conntrack_helper_init_sysctl(struct net *net)
101989 {
101990 - struct ctl_table *table;
101991 + ctl_table_no_const *table;
101992
101993 table = kmemdup(helper_sysctl_table, sizeof(helper_sysctl_table),
101994 GFP_KERNEL);
101995 diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
101996 index b65d586..beec902 100644
101997 --- a/net/netfilter/nf_conntrack_proto.c
101998 +++ b/net/netfilter/nf_conntrack_proto.c
101999 @@ -52,7 +52,7 @@ nf_ct_register_sysctl(struct net *net,
102000
102001 static void
102002 nf_ct_unregister_sysctl(struct ctl_table_header **header,
102003 - struct ctl_table **table,
102004 + ctl_table_no_const **table,
102005 unsigned int users)
102006 {
102007 if (users > 0)
102008 diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
102009 index f641751..d3c5b51 100644
102010 --- a/net/netfilter/nf_conntrack_standalone.c
102011 +++ b/net/netfilter/nf_conntrack_standalone.c
102012 @@ -471,7 +471,7 @@ static struct ctl_table nf_ct_netfilter_table[] = {
102013
102014 static int nf_conntrack_standalone_init_sysctl(struct net *net)
102015 {
102016 - struct ctl_table *table;
102017 + ctl_table_no_const *table;
102018
102019 table = kmemdup(nf_ct_sysctl_table, sizeof(nf_ct_sysctl_table),
102020 GFP_KERNEL);
102021 diff --git a/net/netfilter/nf_conntrack_timestamp.c b/net/netfilter/nf_conntrack_timestamp.c
102022 index 7a394df..bd91a8a 100644
102023 --- a/net/netfilter/nf_conntrack_timestamp.c
102024 +++ b/net/netfilter/nf_conntrack_timestamp.c
102025 @@ -42,7 +42,7 @@ static struct nf_ct_ext_type tstamp_extend __read_mostly = {
102026 #ifdef CONFIG_SYSCTL
102027 static int nf_conntrack_tstamp_init_sysctl(struct net *net)
102028 {
102029 - struct ctl_table *table;
102030 + ctl_table_no_const *table;
102031
102032 table = kmemdup(tstamp_sysctl_table, sizeof(tstamp_sysctl_table),
102033 GFP_KERNEL);
102034 diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
102035 index 85296d4..8becdec 100644
102036 --- a/net/netfilter/nf_log.c
102037 +++ b/net/netfilter/nf_log.c
102038 @@ -243,7 +243,7 @@ static const struct file_operations nflog_file_ops = {
102039
102040 #ifdef CONFIG_SYSCTL
102041 static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
102042 -static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
102043 +static ctl_table_no_const nf_log_sysctl_table[NFPROTO_NUMPROTO+1] __read_only;
102044
102045 static int nf_log_proc_dostring(struct ctl_table *table, int write,
102046 void __user *buffer, size_t *lenp, loff_t *ppos)
102047 @@ -274,14 +274,16 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write,
102048 rcu_assign_pointer(net->nf.nf_loggers[tindex], logger);
102049 mutex_unlock(&nf_log_mutex);
102050 } else {
102051 + ctl_table_no_const nf_log_table = *table;
102052 +
102053 mutex_lock(&nf_log_mutex);
102054 logger = rcu_dereference_protected(net->nf.nf_loggers[tindex],
102055 lockdep_is_held(&nf_log_mutex));
102056 if (!logger)
102057 - table->data = "NONE";
102058 + nf_log_table.data = "NONE";
102059 else
102060 - table->data = logger->name;
102061 - r = proc_dostring(table, write, buffer, lenp, ppos);
102062 + nf_log_table.data = logger->name;
102063 + r = proc_dostring(&nf_log_table, write, buffer, lenp, ppos);
102064 mutex_unlock(&nf_log_mutex);
102065 }
102066
102067 diff --git a/net/netfilter/nf_sockopt.c b/net/netfilter/nf_sockopt.c
102068 index f042ae5..30ea486 100644
102069 --- a/net/netfilter/nf_sockopt.c
102070 +++ b/net/netfilter/nf_sockopt.c
102071 @@ -45,7 +45,7 @@ int nf_register_sockopt(struct nf_sockopt_ops *reg)
102072 }
102073 }
102074
102075 - list_add(&reg->list, &nf_sockopts);
102076 + pax_list_add((struct list_head *)&reg->list, &nf_sockopts);
102077 out:
102078 mutex_unlock(&nf_sockopt_mutex);
102079 return ret;
102080 @@ -55,7 +55,7 @@ EXPORT_SYMBOL(nf_register_sockopt);
102081 void nf_unregister_sockopt(struct nf_sockopt_ops *reg)
102082 {
102083 mutex_lock(&nf_sockopt_mutex);
102084 - list_del(&reg->list);
102085 + pax_list_del((struct list_head *)&reg->list);
102086 mutex_unlock(&nf_sockopt_mutex);
102087 }
102088 EXPORT_SYMBOL(nf_unregister_sockopt);
102089 diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
102090 index c68e5e0..8d52d50 100644
102091 --- a/net/netfilter/nf_tables_api.c
102092 +++ b/net/netfilter/nf_tables_api.c
102093 @@ -152,8 +152,8 @@ nf_tables_chain_type_lookup(const struct nft_af_info *afi,
102094 #ifdef CONFIG_MODULES
102095 if (autoload) {
102096 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
102097 - request_module("nft-chain-%u-%*.s", afi->family,
102098 - nla_len(nla)-1, (const char *)nla_data(nla));
102099 + request_module("nft-chain-%u-%.*s", afi->family,
102100 + nla_len(nla), (const char *)nla_data(nla));
102101 nfnl_lock(NFNL_SUBSYS_NFTABLES);
102102 type = __nf_tables_chain_type_lookup(afi->family, nla);
102103 if (type != NULL)
102104 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
102105 index a155d19..726b0f2 100644
102106 --- a/net/netfilter/nfnetlink_log.c
102107 +++ b/net/netfilter/nfnetlink_log.c
102108 @@ -82,7 +82,7 @@ static int nfnl_log_net_id __read_mostly;
102109 struct nfnl_log_net {
102110 spinlock_t instances_lock;
102111 struct hlist_head instance_table[INSTANCE_BUCKETS];
102112 - atomic_t global_seq;
102113 + atomic_unchecked_t global_seq;
102114 };
102115
102116 static struct nfnl_log_net *nfnl_log_pernet(struct net *net)
102117 @@ -564,7 +564,7 @@ __build_packet_message(struct nfnl_log_net *log,
102118 /* global sequence number */
102119 if ((inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) &&
102120 nla_put_be32(inst->skb, NFULA_SEQ_GLOBAL,
102121 - htonl(atomic_inc_return(&log->global_seq))))
102122 + htonl(atomic_inc_return_unchecked(&log->global_seq))))
102123 goto nla_put_failure;
102124
102125 if (data_len) {
102126 diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
102127 index 82cb823..5685dd5 100644
102128 --- a/net/netfilter/nft_compat.c
102129 +++ b/net/netfilter/nft_compat.c
102130 @@ -216,7 +216,7 @@ target_dump_info(struct sk_buff *skb, const struct xt_target *t, const void *in)
102131 /* We want to reuse existing compat_to_user */
102132 old_fs = get_fs();
102133 set_fs(KERNEL_DS);
102134 - t->compat_to_user(out, in);
102135 + t->compat_to_user((void __force_user *)out, in);
102136 set_fs(old_fs);
102137 ret = nla_put(skb, NFTA_TARGET_INFO, XT_ALIGN(t->targetsize), out);
102138 kfree(out);
102139 @@ -403,7 +403,7 @@ match_dump_info(struct sk_buff *skb, const struct xt_match *m, const void *in)
102140 /* We want to reuse existing compat_to_user */
102141 old_fs = get_fs();
102142 set_fs(KERNEL_DS);
102143 - m->compat_to_user(out, in);
102144 + m->compat_to_user((void __force_user *)out, in);
102145 set_fs(old_fs);
102146 ret = nla_put(skb, NFTA_MATCH_INFO, XT_ALIGN(m->matchsize), out);
102147 kfree(out);
102148 diff --git a/net/netfilter/xt_gradm.c b/net/netfilter/xt_gradm.c
102149 new file mode 100644
102150 index 0000000..c566332
102151 --- /dev/null
102152 +++ b/net/netfilter/xt_gradm.c
102153 @@ -0,0 +1,51 @@
102154 +/*
102155 + * gradm match for netfilter
102156 + * Copyright © Zbigniew Krzystolik, 2010
102157 + *
102158 + * This program is free software; you can redistribute it and/or modify
102159 + * it under the terms of the GNU General Public License; either version
102160 + * 2 or 3 as published by the Free Software Foundation.
102161 + */
102162 +#include <linux/module.h>
102163 +#include <linux/moduleparam.h>
102164 +#include <linux/skbuff.h>
102165 +#include <linux/netfilter/x_tables.h>
102166 +#include <linux/grsecurity.h>
102167 +#include <linux/netfilter/xt_gradm.h>
102168 +
102169 +static bool
102170 +gradm_mt(const struct sk_buff *skb, struct xt_action_param *par)
102171 +{
102172 + const struct xt_gradm_mtinfo *info = par->matchinfo;
102173 + bool retval = false;
102174 + if (gr_acl_is_enabled())
102175 + retval = true;
102176 + return retval ^ info->invflags;
102177 +}
102178 +
102179 +static struct xt_match gradm_mt_reg __read_mostly = {
102180 + .name = "gradm",
102181 + .revision = 0,
102182 + .family = NFPROTO_UNSPEC,
102183 + .match = gradm_mt,
102184 + .matchsize = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
102185 + .me = THIS_MODULE,
102186 +};
102187 +
102188 +static int __init gradm_mt_init(void)
102189 +{
102190 + return xt_register_match(&gradm_mt_reg);
102191 +}
102192 +
102193 +static void __exit gradm_mt_exit(void)
102194 +{
102195 + xt_unregister_match(&gradm_mt_reg);
102196 +}
102197 +
102198 +module_init(gradm_mt_init);
102199 +module_exit(gradm_mt_exit);
102200 +MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
102201 +MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
102202 +MODULE_LICENSE("GPL");
102203 +MODULE_ALIAS("ipt_gradm");
102204 +MODULE_ALIAS("ip6t_gradm");
102205 diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
102206 index a3910fc..2d2ba14 100644
102207 --- a/net/netfilter/xt_hashlimit.c
102208 +++ b/net/netfilter/xt_hashlimit.c
102209 @@ -870,11 +870,11 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
102210 {
102211 struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
102212
102213 - hashlimit_net->ipt_hashlimit = proc_mkdir("ipt_hashlimit", net->proc_net);
102214 + hashlimit_net->ipt_hashlimit = proc_mkdir_restrict("ipt_hashlimit", net->proc_net);
102215 if (!hashlimit_net->ipt_hashlimit)
102216 return -ENOMEM;
102217 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
102218 - hashlimit_net->ip6t_hashlimit = proc_mkdir("ip6t_hashlimit", net->proc_net);
102219 + hashlimit_net->ip6t_hashlimit = proc_mkdir_restrict("ip6t_hashlimit", net->proc_net);
102220 if (!hashlimit_net->ip6t_hashlimit) {
102221 remove_proc_entry("ipt_hashlimit", net->proc_net);
102222 return -ENOMEM;
102223 diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
102224 index 1e657cf..1eb1c34 100644
102225 --- a/net/netfilter/xt_recent.c
102226 +++ b/net/netfilter/xt_recent.c
102227 @@ -618,7 +618,7 @@ static int __net_init recent_proc_net_init(struct net *net)
102228 {
102229 struct recent_net *recent_net = recent_pernet(net);
102230
102231 - recent_net->xt_recent = proc_mkdir("xt_recent", net->proc_net);
102232 + recent_net->xt_recent = proc_mkdir_restrict("xt_recent", net->proc_net);
102233 if (!recent_net->xt_recent)
102234 return -ENOMEM;
102235 return 0;
102236 diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c
102237 index 11de55e..f25e448 100644
102238 --- a/net/netfilter/xt_statistic.c
102239 +++ b/net/netfilter/xt_statistic.c
102240 @@ -19,7 +19,7 @@
102241 #include <linux/module.h>
102242
102243 struct xt_statistic_priv {
102244 - atomic_t count;
102245 + atomic_unchecked_t count;
102246 } ____cacheline_aligned_in_smp;
102247
102248 MODULE_LICENSE("GPL");
102249 @@ -42,9 +42,9 @@ statistic_mt(const struct sk_buff *skb, struct xt_action_param *par)
102250 break;
102251 case XT_STATISTIC_MODE_NTH:
102252 do {
102253 - oval = atomic_read(&info->master->count);
102254 + oval = atomic_read_unchecked(&info->master->count);
102255 nval = (oval == info->u.nth.every) ? 0 : oval + 1;
102256 - } while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
102257 + } while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
102258 if (nval == 0)
102259 ret = !ret;
102260 break;
102261 @@ -64,7 +64,7 @@ static int statistic_mt_check(const struct xt_mtchk_param *par)
102262 info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
102263 if (info->master == NULL)
102264 return -ENOMEM;
102265 - atomic_set(&info->master->count, info->u.nth.count);
102266 + atomic_set_unchecked(&info->master->count, info->u.nth.count);
102267
102268 return 0;
102269 }
102270 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
102271 index 04748ab6..c72ef1f 100644
102272 --- a/net/netlink/af_netlink.c
102273 +++ b/net/netlink/af_netlink.c
102274 @@ -257,7 +257,7 @@ static void netlink_overrun(struct sock *sk)
102275 sk->sk_error_report(sk);
102276 }
102277 }
102278 - atomic_inc(&sk->sk_drops);
102279 + atomic_inc_unchecked(&sk->sk_drops);
102280 }
102281
102282 static void netlink_rcv_wake(struct sock *sk)
102283 @@ -1360,7 +1360,74 @@ retry:
102284 return err;
102285 }
102286
102287 -static inline int netlink_capable(const struct socket *sock, unsigned int flag)
102288 +/**
102289 + * __netlink_ns_capable - General netlink message capability test
102290 + * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace.
102291 + * @user_ns: The user namespace of the capability to use
102292 + * @cap: The capability to use
102293 + *
102294 + * Test to see if the opener of the socket we received the message
102295 + * from had when the netlink socket was created and the sender of the
102296 + * message has has the capability @cap in the user namespace @user_ns.
102297 + */
102298 +bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
102299 + struct user_namespace *user_ns, int cap)
102300 +{
102301 + return ((nsp->flags & NETLINK_SKB_DST) ||
102302 + file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
102303 + ns_capable(user_ns, cap);
102304 +}
102305 +EXPORT_SYMBOL(__netlink_ns_capable);
102306 +
102307 +/**
102308 + * netlink_ns_capable - General netlink message capability test
102309 + * @skb: socket buffer holding a netlink command from userspace
102310 + * @user_ns: The user namespace of the capability to use
102311 + * @cap: The capability to use
102312 + *
102313 + * Test to see if the opener of the socket we received the message
102314 + * from had when the netlink socket was created and the sender of the
102315 + * message has has the capability @cap in the user namespace @user_ns.
102316 + */
102317 +bool netlink_ns_capable(const struct sk_buff *skb,
102318 + struct user_namespace *user_ns, int cap)
102319 +{
102320 + return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap);
102321 +}
102322 +EXPORT_SYMBOL(netlink_ns_capable);
102323 +
102324 +/**
102325 + * netlink_capable - Netlink global message capability test
102326 + * @skb: socket buffer holding a netlink command from userspace
102327 + * @cap: The capability to use
102328 + *
102329 + * Test to see if the opener of the socket we received the message
102330 + * from had when the netlink socket was created and the sender of the
102331 + * message has has the capability @cap in all user namespaces.
102332 + */
102333 +bool netlink_capable(const struct sk_buff *skb, int cap)
102334 +{
102335 + return netlink_ns_capable(skb, &init_user_ns, cap);
102336 +}
102337 +EXPORT_SYMBOL(netlink_capable);
102338 +
102339 +/**
102340 + * netlink_net_capable - Netlink network namespace message capability test
102341 + * @skb: socket buffer holding a netlink command from userspace
102342 + * @cap: The capability to use
102343 + *
102344 + * Test to see if the opener of the socket we received the message
102345 + * from had when the netlink socket was created and the sender of the
102346 + * message has has the capability @cap over the network namespace of
102347 + * the socket we received the message from.
102348 + */
102349 +bool netlink_net_capable(const struct sk_buff *skb, int cap)
102350 +{
102351 + return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap);
102352 +}
102353 +EXPORT_SYMBOL(netlink_net_capable);
102354 +
102355 +static inline int netlink_allowed(const struct socket *sock, unsigned int flag)
102356 {
102357 return (nl_table[sock->sk->sk_protocol].flags & flag) ||
102358 ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN);
102359 @@ -1428,7 +1495,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
102360
102361 /* Only superuser is allowed to listen multicasts */
102362 if (nladdr->nl_groups) {
102363 - if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV))
102364 + if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
102365 return -EPERM;
102366 err = netlink_realloc_groups(sk);
102367 if (err)
102368 @@ -1490,7 +1557,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
102369 return -EINVAL;
102370
102371 if ((nladdr->nl_groups || nladdr->nl_pid) &&
102372 - !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
102373 + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
102374 return -EPERM;
102375
102376 if (!nlk->portid)
102377 @@ -2096,7 +2163,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,
102378 break;
102379 case NETLINK_ADD_MEMBERSHIP:
102380 case NETLINK_DROP_MEMBERSHIP: {
102381 - if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV))
102382 + if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV))
102383 return -EPERM;
102384 err = netlink_realloc_groups(sk);
102385 if (err)
102386 @@ -2228,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
102387 struct sk_buff *skb;
102388 int err;
102389 struct scm_cookie scm;
102390 + u32 netlink_skb_flags = 0;
102391
102392 if (msg->msg_flags&MSG_OOB)
102393 return -EOPNOTSUPP;
102394 @@ -2247,8 +2315,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
102395 dst_group = ffs(addr->nl_groups);
102396 err = -EPERM;
102397 if ((dst_group || dst_portid) &&
102398 - !netlink_capable(sock, NL_CFG_F_NONROOT_SEND))
102399 + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
102400 goto out;
102401 + netlink_skb_flags |= NETLINK_SKB_DST;
102402 } else {
102403 dst_portid = nlk->dst_portid;
102404 dst_group = nlk->dst_group;
102405 @@ -2278,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
102406 NETLINK_CB(skb).portid = nlk->portid;
102407 NETLINK_CB(skb).dst_group = dst_group;
102408 NETLINK_CB(skb).creds = siocb->scm->creds;
102409 + NETLINK_CB(skb).flags = netlink_skb_flags;
102410
102411 err = -EFAULT;
102412 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
102413 @@ -2933,7 +3003,7 @@ static int netlink_seq_show(struct seq_file *seq, void *v)
102414 sk_wmem_alloc_get(s),
102415 nlk->cb_running,
102416 atomic_read(&s->sk_refcnt),
102417 - atomic_read(&s->sk_drops),
102418 + atomic_read_unchecked(&s->sk_drops),
102419 sock_i_ino(s)
102420 );
102421
102422 diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
102423 index b74aa07..d41926e 100644
102424 --- a/net/netrom/af_netrom.c
102425 +++ b/net/netrom/af_netrom.c
102426 @@ -850,7 +850,6 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
102427 *uaddr_len = sizeof(struct full_sockaddr_ax25);
102428 } else {
102429 sax->fsa_ax25.sax25_family = AF_NETROM;
102430 - sax->fsa_ax25.sax25_ndigis = 0;
102431 sax->fsa_ax25.sax25_call = nr->source_addr;
102432 *uaddr_len = sizeof(struct sockaddr_ax25);
102433 }
102434 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
102435 index 48a6a93..0b0496e 100644
102436 --- a/net/packet/af_packet.c
102437 +++ b/net/packet/af_packet.c
102438 @@ -1845,7 +1845,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
102439
102440 spin_lock(&sk->sk_receive_queue.lock);
102441 po->stats.stats1.tp_packets++;
102442 - skb->dropcount = atomic_read(&sk->sk_drops);
102443 + skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
102444 __skb_queue_tail(&sk->sk_receive_queue, skb);
102445 spin_unlock(&sk->sk_receive_queue.lock);
102446 sk->sk_data_ready(sk, skb->len);
102447 @@ -1854,7 +1854,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
102448 drop_n_acct:
102449 spin_lock(&sk->sk_receive_queue.lock);
102450 po->stats.stats1.tp_drops++;
102451 - atomic_inc(&sk->sk_drops);
102452 + atomic_inc_unchecked(&sk->sk_drops);
102453 spin_unlock(&sk->sk_receive_queue.lock);
102454
102455 drop_n_restore:
102456 @@ -3449,7 +3449,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
102457 case PACKET_HDRLEN:
102458 if (len > sizeof(int))
102459 len = sizeof(int);
102460 - if (copy_from_user(&val, optval, len))
102461 + if (len > sizeof(val) || copy_from_user(&val, optval, len))
102462 return -EFAULT;
102463 switch (val) {
102464 case TPACKET_V1:
102465 @@ -3495,7 +3495,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
102466 len = lv;
102467 if (put_user(len, optlen))
102468 return -EFAULT;
102469 - if (copy_to_user(optval, data, len))
102470 + if (len > sizeof(st) || copy_to_user(optval, data, len))
102471 return -EFAULT;
102472 return 0;
102473 }
102474 diff --git a/net/phonet/pep.c b/net/phonet/pep.c
102475 index e774117..900b8b7 100644
102476 --- a/net/phonet/pep.c
102477 +++ b/net/phonet/pep.c
102478 @@ -388,7 +388,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
102479
102480 case PNS_PEP_CTRL_REQ:
102481 if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
102482 - atomic_inc(&sk->sk_drops);
102483 + atomic_inc_unchecked(&sk->sk_drops);
102484 break;
102485 }
102486 __skb_pull(skb, 4);
102487 @@ -409,7 +409,7 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
102488 }
102489
102490 if (pn->rx_credits == 0) {
102491 - atomic_inc(&sk->sk_drops);
102492 + atomic_inc_unchecked(&sk->sk_drops);
102493 err = -ENOBUFS;
102494 break;
102495 }
102496 @@ -580,7 +580,7 @@ static int pipe_handler_do_rcv(struct sock *sk, struct sk_buff *skb)
102497 }
102498
102499 if (pn->rx_credits == 0) {
102500 - atomic_inc(&sk->sk_drops);
102501 + atomic_inc_unchecked(&sk->sk_drops);
102502 err = NET_RX_DROP;
102503 break;
102504 }
102505 diff --git a/net/phonet/socket.c b/net/phonet/socket.c
102506 index 008214a..bb68240 100644
102507 --- a/net/phonet/socket.c
102508 +++ b/net/phonet/socket.c
102509 @@ -611,7 +611,7 @@ static int pn_sock_seq_show(struct seq_file *seq, void *v)
102510 from_kuid_munged(seq_user_ns(seq), sock_i_uid(sk)),
102511 sock_i_ino(sk),
102512 atomic_read(&sk->sk_refcnt), sk,
102513 - atomic_read(&sk->sk_drops));
102514 + atomic_read_unchecked(&sk->sk_drops));
102515 }
102516 seq_pad(seq, '\n');
102517 return 0;
102518 diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
102519 index c02a8c4..3c5b600 100644
102520 --- a/net/phonet/sysctl.c
102521 +++ b/net/phonet/sysctl.c
102522 @@ -67,7 +67,7 @@ static int proc_local_port_range(struct ctl_table *table, int write,
102523 {
102524 int ret;
102525 int range[2] = {local_port_range[0], local_port_range[1]};
102526 - struct ctl_table tmp = {
102527 + ctl_table_no_const tmp = {
102528 .data = &range,
102529 .maxlen = sizeof(range),
102530 .mode = table->mode,
102531 diff --git a/net/rds/cong.c b/net/rds/cong.c
102532 index e5b65ac..f3b6fb7 100644
102533 --- a/net/rds/cong.c
102534 +++ b/net/rds/cong.c
102535 @@ -78,7 +78,7 @@
102536 * finds that the saved generation number is smaller than the global generation
102537 * number, it wakes up the process.
102538 */
102539 -static atomic_t rds_cong_generation = ATOMIC_INIT(0);
102540 +static atomic_unchecked_t rds_cong_generation = ATOMIC_INIT(0);
102541
102542 /*
102543 * Congestion monitoring
102544 @@ -233,7 +233,7 @@ void rds_cong_map_updated(struct rds_cong_map *map, uint64_t portmask)
102545 rdsdebug("waking map %p for %pI4\n",
102546 map, &map->m_addr);
102547 rds_stats_inc(s_cong_update_received);
102548 - atomic_inc(&rds_cong_generation);
102549 + atomic_inc_unchecked(&rds_cong_generation);
102550 if (waitqueue_active(&map->m_waitq))
102551 wake_up(&map->m_waitq);
102552 if (waitqueue_active(&rds_poll_waitq))
102553 @@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
102554
102555 int rds_cong_updated_since(unsigned long *recent)
102556 {
102557 - unsigned long gen = atomic_read(&rds_cong_generation);
102558 + unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
102559
102560 if (likely(*recent == gen))
102561 return 0;
102562 diff --git a/net/rds/ib.h b/net/rds/ib.h
102563 index 7280ab8..e04f4ea 100644
102564 --- a/net/rds/ib.h
102565 +++ b/net/rds/ib.h
102566 @@ -128,7 +128,7 @@ struct rds_ib_connection {
102567 /* sending acks */
102568 unsigned long i_ack_flags;
102569 #ifdef KERNEL_HAS_ATOMIC64
102570 - atomic64_t i_ack_next; /* next ACK to send */
102571 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
102572 #else
102573 spinlock_t i_ack_lock; /* protect i_ack_next */
102574 u64 i_ack_next; /* next ACK to send */
102575 diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
102576 index 31b74f5..dc1fbfa 100644
102577 --- a/net/rds/ib_cm.c
102578 +++ b/net/rds/ib_cm.c
102579 @@ -717,7 +717,7 @@ void rds_ib_conn_shutdown(struct rds_connection *conn)
102580 /* Clear the ACK state */
102581 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
102582 #ifdef KERNEL_HAS_ATOMIC64
102583 - atomic64_set(&ic->i_ack_next, 0);
102584 + atomic64_set_unchecked(&ic->i_ack_next, 0);
102585 #else
102586 ic->i_ack_next = 0;
102587 #endif
102588 diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
102589 index b7ebe23..b6352f6 100644
102590 --- a/net/rds/ib_recv.c
102591 +++ b/net/rds/ib_recv.c
102592 @@ -596,7 +596,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
102593 static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
102594 int ack_required)
102595 {
102596 - atomic64_set(&ic->i_ack_next, seq);
102597 + atomic64_set_unchecked(&ic->i_ack_next, seq);
102598 if (ack_required) {
102599 smp_mb__before_clear_bit();
102600 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
102601 @@ -608,7 +608,7 @@ static u64 rds_ib_get_ack(struct rds_ib_connection *ic)
102602 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
102603 smp_mb__after_clear_bit();
102604
102605 - return atomic64_read(&ic->i_ack_next);
102606 + return atomic64_read_unchecked(&ic->i_ack_next);
102607 }
102608 #endif
102609
102610 diff --git a/net/rds/iw.h b/net/rds/iw.h
102611 index 04ce3b1..48119a6 100644
102612 --- a/net/rds/iw.h
102613 +++ b/net/rds/iw.h
102614 @@ -134,7 +134,7 @@ struct rds_iw_connection {
102615 /* sending acks */
102616 unsigned long i_ack_flags;
102617 #ifdef KERNEL_HAS_ATOMIC64
102618 - atomic64_t i_ack_next; /* next ACK to send */
102619 + atomic64_unchecked_t i_ack_next; /* next ACK to send */
102620 #else
102621 spinlock_t i_ack_lock; /* protect i_ack_next */
102622 u64 i_ack_next; /* next ACK to send */
102623 diff --git a/net/rds/iw_cm.c b/net/rds/iw_cm.c
102624 index a91e1db..cf3053f 100644
102625 --- a/net/rds/iw_cm.c
102626 +++ b/net/rds/iw_cm.c
102627 @@ -663,7 +663,7 @@ void rds_iw_conn_shutdown(struct rds_connection *conn)
102628 /* Clear the ACK state */
102629 clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
102630 #ifdef KERNEL_HAS_ATOMIC64
102631 - atomic64_set(&ic->i_ack_next, 0);
102632 + atomic64_set_unchecked(&ic->i_ack_next, 0);
102633 #else
102634 ic->i_ack_next = 0;
102635 #endif
102636 diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
102637 index 4503335..db566b4 100644
102638 --- a/net/rds/iw_recv.c
102639 +++ b/net/rds/iw_recv.c
102640 @@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
102641 static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
102642 int ack_required)
102643 {
102644 - atomic64_set(&ic->i_ack_next, seq);
102645 + atomic64_set_unchecked(&ic->i_ack_next, seq);
102646 if (ack_required) {
102647 smp_mb__before_clear_bit();
102648 set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
102649 @@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_connection *ic)
102650 clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
102651 smp_mb__after_clear_bit();
102652
102653 - return atomic64_read(&ic->i_ack_next);
102654 + return atomic64_read_unchecked(&ic->i_ack_next);
102655 }
102656 #endif
102657
102658 diff --git a/net/rds/rds.h b/net/rds/rds.h
102659 index 48f8ffc..0ef3eec 100644
102660 --- a/net/rds/rds.h
102661 +++ b/net/rds/rds.h
102662 @@ -449,7 +449,7 @@ struct rds_transport {
102663 void (*sync_mr)(void *trans_private, int direction);
102664 void (*free_mr)(void *trans_private, int invalidate);
102665 void (*flush_mrs)(void);
102666 -};
102667 +} __do_const;
102668
102669 struct rds_sock {
102670 struct sock rs_sk;
102671 diff --git a/net/rds/tcp.c b/net/rds/tcp.c
102672 index edac9ef..16bcb98 100644
102673 --- a/net/rds/tcp.c
102674 +++ b/net/rds/tcp.c
102675 @@ -59,7 +59,7 @@ void rds_tcp_nonagle(struct socket *sock)
102676 int val = 1;
102677
102678 set_fs(KERNEL_DS);
102679 - sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val,
102680 + sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val,
102681 sizeof(val));
102682 set_fs(oldfs);
102683 }
102684 diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
102685 index 81cf5a4..b5826ff 100644
102686 --- a/net/rds/tcp_send.c
102687 +++ b/net/rds/tcp_send.c
102688 @@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket *sock, int val)
102689
102690 oldfs = get_fs();
102691 set_fs(KERNEL_DS);
102692 - sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val,
102693 + sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val,
102694 sizeof(val));
102695 set_fs(oldfs);
102696 }
102697 diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
102698 index e61aa60..f07cc89 100644
102699 --- a/net/rxrpc/af_rxrpc.c
102700 +++ b/net/rxrpc/af_rxrpc.c
102701 @@ -40,7 +40,7 @@ static const struct proto_ops rxrpc_rpc_ops;
102702 __be32 rxrpc_epoch;
102703
102704 /* current debugging ID */
102705 -atomic_t rxrpc_debug_id;
102706 +atomic_unchecked_t rxrpc_debug_id;
102707
102708 /* count of skbs currently in use */
102709 atomic_t rxrpc_n_skbs;
102710 diff --git a/net/rxrpc/ar-ack.c b/net/rxrpc/ar-ack.c
102711 index cd97a0c..0041649 100644
102712 --- a/net/rxrpc/ar-ack.c
102713 +++ b/net/rxrpc/ar-ack.c
102714 @@ -182,7 +182,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
102715
102716 _enter("{%d,%d,%d,%d},",
102717 call->acks_hard, call->acks_unacked,
102718 - atomic_read(&call->sequence),
102719 + atomic_read_unchecked(&call->sequence),
102720 CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
102721
102722 stop = 0;
102723 @@ -206,7 +206,7 @@ static void rxrpc_resend(struct rxrpc_call *call)
102724
102725 /* each Tx packet has a new serial number */
102726 sp->hdr.serial =
102727 - htonl(atomic_inc_return(&call->conn->serial));
102728 + htonl(atomic_inc_return_unchecked(&call->conn->serial));
102729
102730 hdr = (struct rxrpc_header *) txb->head;
102731 hdr->serial = sp->hdr.serial;
102732 @@ -410,7 +410,7 @@ static void rxrpc_rotate_tx_window(struct rxrpc_call *call, u32 hard)
102733 */
102734 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
102735 {
102736 - rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
102737 + rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
102738 }
102739
102740 /*
102741 @@ -636,7 +636,7 @@ process_further:
102742
102743 latest = ntohl(sp->hdr.serial);
102744 hard = ntohl(ack.firstPacket);
102745 - tx = atomic_read(&call->sequence);
102746 + tx = atomic_read_unchecked(&call->sequence);
102747
102748 _proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
102749 latest,
102750 @@ -1168,7 +1168,7 @@ void rxrpc_process_call(struct work_struct *work)
102751 goto maybe_reschedule;
102752
102753 send_ACK_with_skew:
102754 - ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
102755 + ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
102756 ntohl(ack.serial));
102757 send_ACK:
102758 mtu = call->conn->trans->peer->if_mtu;
102759 @@ -1180,7 +1180,7 @@ send_ACK:
102760 ackinfo.rxMTU = htonl(5692);
102761 ackinfo.jumbo_max = htonl(4);
102762
102763 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
102764 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
102765 _proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
102766 ntohl(hdr.serial),
102767 ntohs(ack.maxSkew),
102768 @@ -1198,7 +1198,7 @@ send_ACK:
102769 send_message:
102770 _debug("send message");
102771
102772 - hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
102773 + hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
102774 _proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
102775 send_message_2:
102776
102777 diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
102778 index a3bbb36..3341fb9 100644
102779 --- a/net/rxrpc/ar-call.c
102780 +++ b/net/rxrpc/ar-call.c
102781 @@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
102782 spin_lock_init(&call->lock);
102783 rwlock_init(&call->state_lock);
102784 atomic_set(&call->usage, 1);
102785 - call->debug_id = atomic_inc_return(&rxrpc_debug_id);
102786 + call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
102787 call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
102788
102789 memset(&call->sock_node, 0xed, sizeof(call->sock_node));
102790 diff --git a/net/rxrpc/ar-connection.c b/net/rxrpc/ar-connection.c
102791 index 7bf5b5b..4a3bf2c 100644
102792 --- a/net/rxrpc/ar-connection.c
102793 +++ b/net/rxrpc/ar-connection.c
102794 @@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_alloc_connection(gfp_t gfp)
102795 rwlock_init(&conn->lock);
102796 spin_lock_init(&conn->state_lock);
102797 atomic_set(&conn->usage, 1);
102798 - conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
102799 + conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
102800 conn->avail_calls = RXRPC_MAXCALLS;
102801 conn->size_align = 4;
102802 conn->header_size = sizeof(struct rxrpc_header);
102803 diff --git a/net/rxrpc/ar-connevent.c b/net/rxrpc/ar-connevent.c
102804 index e7ed43a..6afa140 100644
102805 --- a/net/rxrpc/ar-connevent.c
102806 +++ b/net/rxrpc/ar-connevent.c
102807 @@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct rxrpc_connection *conn,
102808
102809 len = iov[0].iov_len + iov[1].iov_len;
102810
102811 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
102812 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
102813 _proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
102814
102815 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
102816 diff --git a/net/rxrpc/ar-input.c b/net/rxrpc/ar-input.c
102817 index 529572f..c758ca7 100644
102818 --- a/net/rxrpc/ar-input.c
102819 +++ b/net/rxrpc/ar-input.c
102820 @@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rxrpc_call *call, struct sk_buff *skb)
102821 /* track the latest serial number on this connection for ACK packet
102822 * information */
102823 serial = ntohl(sp->hdr.serial);
102824 - hi_serial = atomic_read(&call->conn->hi_serial);
102825 + hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
102826 while (serial > hi_serial)
102827 - hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
102828 + hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
102829 serial);
102830
102831 /* request ACK generation for any ACK or DATA packet that requests
102832 diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
102833 index 5f43675..ca07817 100644
102834 --- a/net/rxrpc/ar-internal.h
102835 +++ b/net/rxrpc/ar-internal.h
102836 @@ -272,8 +272,8 @@ struct rxrpc_connection {
102837 int error; /* error code for local abort */
102838 int debug_id; /* debug ID for printks */
102839 unsigned int call_counter; /* call ID counter */
102840 - atomic_t serial; /* packet serial number counter */
102841 - atomic_t hi_serial; /* highest serial number received */
102842 + atomic_unchecked_t serial; /* packet serial number counter */
102843 + atomic_unchecked_t hi_serial; /* highest serial number received */
102844 u8 avail_calls; /* number of calls available */
102845 u8 size_align; /* data size alignment (for security) */
102846 u8 header_size; /* rxrpc + security header size */
102847 @@ -346,7 +346,7 @@ struct rxrpc_call {
102848 spinlock_t lock;
102849 rwlock_t state_lock; /* lock for state transition */
102850 atomic_t usage;
102851 - atomic_t sequence; /* Tx data packet sequence counter */
102852 + atomic_unchecked_t sequence; /* Tx data packet sequence counter */
102853 u32 abort_code; /* local/remote abort code */
102854 enum { /* current state of call */
102855 RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
102856 @@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(struct rxrpc_call *call, u32 abort_code)
102857 */
102858 extern atomic_t rxrpc_n_skbs;
102859 extern __be32 rxrpc_epoch;
102860 -extern atomic_t rxrpc_debug_id;
102861 +extern atomic_unchecked_t rxrpc_debug_id;
102862 extern struct workqueue_struct *rxrpc_workqueue;
102863
102864 /*
102865 diff --git a/net/rxrpc/ar-local.c b/net/rxrpc/ar-local.c
102866 index 87f7135..74d3703 100644
102867 --- a/net/rxrpc/ar-local.c
102868 +++ b/net/rxrpc/ar-local.c
102869 @@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(struct sockaddr_rxrpc *srx)
102870 spin_lock_init(&local->lock);
102871 rwlock_init(&local->services_lock);
102872 atomic_set(&local->usage, 1);
102873 - local->debug_id = atomic_inc_return(&rxrpc_debug_id);
102874 + local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
102875 memcpy(&local->srx, srx, sizeof(*srx));
102876 }
102877
102878 diff --git a/net/rxrpc/ar-output.c b/net/rxrpc/ar-output.c
102879 index d0e8f1c..a3a1686 100644
102880 --- a/net/rxrpc/ar-output.c
102881 +++ b/net/rxrpc/ar-output.c
102882 @@ -682,9 +682,9 @@ static int rxrpc_send_data(struct kiocb *iocb,
102883 sp->hdr.cid = call->cid;
102884 sp->hdr.callNumber = call->call_id;
102885 sp->hdr.seq =
102886 - htonl(atomic_inc_return(&call->sequence));
102887 + htonl(atomic_inc_return_unchecked(&call->sequence));
102888 sp->hdr.serial =
102889 - htonl(atomic_inc_return(&conn->serial));
102890 + htonl(atomic_inc_return_unchecked(&conn->serial));
102891 sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
102892 sp->hdr.userStatus = 0;
102893 sp->hdr.securityIndex = conn->security_ix;
102894 diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
102895 index bebaa43..2644591 100644
102896 --- a/net/rxrpc/ar-peer.c
102897 +++ b/net/rxrpc/ar-peer.c
102898 @@ -72,7 +72,7 @@ static struct rxrpc_peer *rxrpc_alloc_peer(struct sockaddr_rxrpc *srx,
102899 INIT_LIST_HEAD(&peer->error_targets);
102900 spin_lock_init(&peer->lock);
102901 atomic_set(&peer->usage, 1);
102902 - peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
102903 + peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
102904 memcpy(&peer->srx, srx, sizeof(*srx));
102905
102906 rxrpc_assess_MTU_size(peer);
102907 diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
102908 index 38047f7..9f48511 100644
102909 --- a/net/rxrpc/ar-proc.c
102910 +++ b/net/rxrpc/ar-proc.c
102911 @@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(struct seq_file *seq, void *v)
102912 atomic_read(&conn->usage),
102913 rxrpc_conn_states[conn->state],
102914 key_serial(conn->key),
102915 - atomic_read(&conn->serial),
102916 - atomic_read(&conn->hi_serial));
102917 + atomic_read_unchecked(&conn->serial),
102918 + atomic_read_unchecked(&conn->hi_serial));
102919
102920 return 0;
102921 }
102922 diff --git a/net/rxrpc/ar-transport.c b/net/rxrpc/ar-transport.c
102923 index 92df566..87ec1bf 100644
102924 --- a/net/rxrpc/ar-transport.c
102925 +++ b/net/rxrpc/ar-transport.c
102926 @@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_alloc_transport(struct rxrpc_local *local,
102927 spin_lock_init(&trans->client_lock);
102928 rwlock_init(&trans->conn_lock);
102929 atomic_set(&trans->usage, 1);
102930 - trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
102931 + trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
102932
102933 if (peer->srx.transport.family == AF_INET) {
102934 switch (peer->srx.transport_type) {
102935 diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
102936 index f226709..0e735a8 100644
102937 --- a/net/rxrpc/rxkad.c
102938 +++ b/net/rxrpc/rxkad.c
102939 @@ -610,7 +610,7 @@ static int rxkad_issue_challenge(struct rxrpc_connection *conn)
102940
102941 len = iov[0].iov_len + iov[1].iov_len;
102942
102943 - hdr.serial = htonl(atomic_inc_return(&conn->serial));
102944 + hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
102945 _proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
102946
102947 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
102948 @@ -660,7 +660,7 @@ static int rxkad_send_response(struct rxrpc_connection *conn,
102949
102950 len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
102951
102952 - hdr->serial = htonl(atomic_inc_return(&conn->serial));
102953 + hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
102954 _proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
102955
102956 ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
102957 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
102958 index 2b1738e..a9d0fc9 100644
102959 --- a/net/sctp/ipv6.c
102960 +++ b/net/sctp/ipv6.c
102961 @@ -966,7 +966,7 @@ static const struct inet6_protocol sctpv6_protocol = {
102962 .flags = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
102963 };
102964
102965 -static struct sctp_af sctp_af_inet6 = {
102966 +static struct sctp_af sctp_af_inet6 __read_only = {
102967 .sa_family = AF_INET6,
102968 .sctp_xmit = sctp_v6_xmit,
102969 .setsockopt = ipv6_setsockopt,
102970 @@ -998,7 +998,7 @@ static struct sctp_af sctp_af_inet6 = {
102971 #endif
102972 };
102973
102974 -static struct sctp_pf sctp_pf_inet6 = {
102975 +static struct sctp_pf sctp_pf_inet6 __read_only = {
102976 .event_msgname = sctp_inet6_event_msgname,
102977 .skb_msgname = sctp_inet6_skb_msgname,
102978 .af_supported = sctp_inet6_af_supported,
102979 @@ -1023,7 +1023,7 @@ void sctp_v6_pf_init(void)
102980
102981 void sctp_v6_pf_exit(void)
102982 {
102983 - list_del(&sctp_af_inet6.list);
102984 + pax_list_del(&sctp_af_inet6.list);
102985 }
102986
102987 /* Initialize IPv6 support and register with socket layer. */
102988 diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
102989 index a62a215..0976540 100644
102990 --- a/net/sctp/protocol.c
102991 +++ b/net/sctp/protocol.c
102992 @@ -836,8 +836,10 @@ int sctp_register_af(struct sctp_af *af)
102993 return 0;
102994 }
102995
102996 + pax_open_kernel();
102997 INIT_LIST_HEAD(&af->list);
102998 - list_add_tail(&af->list, &sctp_address_families);
102999 + pax_close_kernel();
103000 + pax_list_add_tail(&af->list, &sctp_address_families);
103001 return 1;
103002 }
103003
103004 @@ -967,7 +969,7 @@ static inline int sctp_v4_xmit(struct sk_buff *skb,
103005
103006 static struct sctp_af sctp_af_inet;
103007
103008 -static struct sctp_pf sctp_pf_inet = {
103009 +static struct sctp_pf sctp_pf_inet __read_only = {
103010 .event_msgname = sctp_inet_event_msgname,
103011 .skb_msgname = sctp_inet_skb_msgname,
103012 .af_supported = sctp_inet_af_supported,
103013 @@ -1039,7 +1041,7 @@ static const struct net_protocol sctp_protocol = {
103014 };
103015
103016 /* IPv4 address related functions. */
103017 -static struct sctp_af sctp_af_inet = {
103018 +static struct sctp_af sctp_af_inet __read_only = {
103019 .sa_family = AF_INET,
103020 .sctp_xmit = sctp_v4_xmit,
103021 .setsockopt = ip_setsockopt,
103022 @@ -1124,7 +1126,7 @@ static void sctp_v4_pf_init(void)
103023
103024 static void sctp_v4_pf_exit(void)
103025 {
103026 - list_del(&sctp_af_inet.list);
103027 + pax_list_del(&sctp_af_inet.list);
103028 }
103029
103030 static int sctp_v4_protosw_init(void)
103031 diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
103032 index fef2acd..c705c4f 100644
103033 --- a/net/sctp/sm_sideeffect.c
103034 +++ b/net/sctp/sm_sideeffect.c
103035 @@ -439,7 +439,7 @@ static void sctp_generate_sack_event(unsigned long data)
103036 sctp_generate_timeout_event(asoc, SCTP_EVENT_TIMEOUT_SACK);
103037 }
103038
103039 -sctp_timer_event_t *sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
103040 +sctp_timer_event_t * const sctp_timer_events[SCTP_NUM_TIMEOUT_TYPES] = {
103041 NULL,
103042 sctp_generate_t1_cookie_event,
103043 sctp_generate_t1_init_event,
103044 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
103045 index 604a6ac..f87f0a3 100644
103046 --- a/net/sctp/socket.c
103047 +++ b/net/sctp/socket.c
103048 @@ -2175,11 +2175,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
103049 {
103050 struct sctp_association *asoc;
103051 struct sctp_ulpevent *event;
103052 + struct sctp_event_subscribe subscribe;
103053
103054 if (optlen > sizeof(struct sctp_event_subscribe))
103055 return -EINVAL;
103056 - if (copy_from_user(&sctp_sk(sk)->subscribe, optval, optlen))
103057 + if (copy_from_user(&subscribe, optval, optlen))
103058 return -EFAULT;
103059 + sctp_sk(sk)->subscribe = subscribe;
103060
103061 /*
103062 * At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
103063 @@ -4259,13 +4261,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
103064 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
103065 int __user *optlen)
103066 {
103067 + struct sctp_event_subscribe subscribe;
103068 +
103069 if (len <= 0)
103070 return -EINVAL;
103071 if (len > sizeof(struct sctp_event_subscribe))
103072 len = sizeof(struct sctp_event_subscribe);
103073 if (put_user(len, optlen))
103074 return -EFAULT;
103075 - if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
103076 + subscribe = sctp_sk(sk)->subscribe;
103077 + if (copy_to_user(optval, &subscribe, len))
103078 return -EFAULT;
103079 return 0;
103080 }
103081 @@ -4283,6 +4288,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
103082 */
103083 static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
103084 {
103085 + __u32 autoclose;
103086 +
103087 /* Applicable to UDP-style socket only */
103088 if (sctp_style(sk, TCP))
103089 return -EOPNOTSUPP;
103090 @@ -4291,7 +4298,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
103091 len = sizeof(int);
103092 if (put_user(len, optlen))
103093 return -EFAULT;
103094 - if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
103095 + autoclose = sctp_sk(sk)->autoclose;
103096 + if (copy_to_user(optval, &autoclose, sizeof(int)))
103097 return -EFAULT;
103098 return 0;
103099 }
103100 @@ -4666,12 +4674,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
103101 */
103102 static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
103103 {
103104 + struct sctp_initmsg initmsg;
103105 +
103106 if (len < sizeof(struct sctp_initmsg))
103107 return -EINVAL;
103108 len = sizeof(struct sctp_initmsg);
103109 if (put_user(len, optlen))
103110 return -EFAULT;
103111 - if (copy_to_user(optval, &sctp_sk(sk)->initmsg, len))
103112 + initmsg = sctp_sk(sk)->initmsg;
103113 + if (copy_to_user(optval, &initmsg, len))
103114 return -EFAULT;
103115 return 0;
103116 }
103117 @@ -4712,6 +4723,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
103118 addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
103119 if (space_left < addrlen)
103120 return -ENOMEM;
103121 + if (addrlen > sizeof(temp) || addrlen < 0)
103122 + return -EFAULT;
103123 if (copy_to_user(to, &temp, addrlen))
103124 return -EFAULT;
103125 to += addrlen;
103126 diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
103127 index c82fdc1..4ca1f95 100644
103128 --- a/net/sctp/sysctl.c
103129 +++ b/net/sctp/sysctl.c
103130 @@ -308,7 +308,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
103131 {
103132 struct net *net = current->nsproxy->net_ns;
103133 char tmp[8];
103134 - struct ctl_table tbl;
103135 + ctl_table_no_const tbl;
103136 int ret;
103137 int changed = 0;
103138 char *none = "none";
103139 @@ -355,7 +355,7 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
103140 {
103141 struct net *net = current->nsproxy->net_ns;
103142 int new_value;
103143 - struct ctl_table tbl;
103144 + ctl_table_no_const tbl;
103145 unsigned int min = *(unsigned int *) ctl->extra1;
103146 unsigned int max = *(unsigned int *) ctl->extra2;
103147 int ret;
103148 @@ -382,7 +382,7 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
103149 {
103150 struct net *net = current->nsproxy->net_ns;
103151 int new_value;
103152 - struct ctl_table tbl;
103153 + ctl_table_no_const tbl;
103154 unsigned int min = *(unsigned int *) ctl->extra1;
103155 unsigned int max = *(unsigned int *) ctl->extra2;
103156 int ret;
103157 @@ -408,7 +408,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
103158 loff_t *ppos)
103159 {
103160 struct net *net = current->nsproxy->net_ns;
103161 - struct ctl_table tbl;
103162 + ctl_table_no_const tbl;
103163 int new_value, ret;
103164
103165 memset(&tbl, 0, sizeof(struct ctl_table));
103166 @@ -436,7 +436,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
103167
103168 int sctp_sysctl_net_register(struct net *net)
103169 {
103170 - struct ctl_table *table = sctp_net_table;
103171 + ctl_table_no_const *table = NULL;
103172
103173 if (!net_eq(net, &init_net)) {
103174 int i;
103175 @@ -449,7 +449,10 @@ int sctp_sysctl_net_register(struct net *net)
103176 table[i].data += (char *)(&net->sctp) - (char *)&init_net.sctp;
103177 }
103178
103179 - net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
103180 + if (!net_eq(net, &init_net))
103181 + net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", table);
103182 + else
103183 + net->sctp.sysctl_header = register_net_sysctl(net, "net/sctp", sctp_net_table);
103184 return 0;
103185 }
103186
103187 diff --git a/net/socket.c b/net/socket.c
103188 index a19ae19..89554dc 100644
103189 --- a/net/socket.c
103190 +++ b/net/socket.c
103191 @@ -88,6 +88,7 @@
103192 #include <linux/magic.h>
103193 #include <linux/slab.h>
103194 #include <linux/xattr.h>
103195 +#include <linux/in.h>
103196
103197 #include <asm/uaccess.h>
103198 #include <asm/unistd.h>
103199 @@ -111,6 +112,8 @@ unsigned int sysctl_net_busy_read __read_mostly;
103200 unsigned int sysctl_net_busy_poll __read_mostly;
103201 #endif
103202
103203 +#include <linux/grsock.h>
103204 +
103205 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
103206 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
103207 unsigned long nr_segs, loff_t pos);
103208 @@ -162,7 +165,7 @@ static const struct file_operations socket_file_ops = {
103209 */
103210
103211 static DEFINE_SPINLOCK(net_family_lock);
103212 -static const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
103213 +const struct net_proto_family __rcu *net_families[NPROTO] __read_mostly;
103214
103215 /*
103216 * Statistics counters of the socket lists
103217 @@ -328,7 +331,7 @@ static struct dentry *sockfs_mount(struct file_system_type *fs_type,
103218 &sockfs_dentry_operations, SOCKFS_MAGIC);
103219 }
103220
103221 -static struct vfsmount *sock_mnt __read_mostly;
103222 +struct vfsmount *sock_mnt __read_mostly;
103223
103224 static struct file_system_type sock_fs_type = {
103225 .name = "sockfs",
103226 @@ -1256,6 +1259,8 @@ int __sock_create(struct net *net, int family, int type, int protocol,
103227 return -EAFNOSUPPORT;
103228 if (type < 0 || type >= SOCK_MAX)
103229 return -EINVAL;
103230 + if (protocol < 0)
103231 + return -EINVAL;
103232
103233 /* Compatibility.
103234
103235 @@ -1276,6 +1281,20 @@ int __sock_create(struct net *net, int family, int type, int protocol,
103236 if (err)
103237 return err;
103238
103239 + if(!kern && !gr_search_socket(family, type, protocol)) {
103240 + if (rcu_access_pointer(net_families[family]) == NULL)
103241 + return -EAFNOSUPPORT;
103242 + else
103243 + return -EACCES;
103244 + }
103245 +
103246 + if (!kern && gr_handle_sock_all(family, type, protocol)) {
103247 + if (rcu_access_pointer(net_families[family]) == NULL)
103248 + return -EAFNOSUPPORT;
103249 + else
103250 + return -EACCES;
103251 + }
103252 +
103253 /*
103254 * Allocate the socket and allow the family to set things up. if
103255 * the protocol is 0, the family is instructed to select an appropriate
103256 @@ -1527,6 +1546,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
103257 if (sock) {
103258 err = move_addr_to_kernel(umyaddr, addrlen, &address);
103259 if (err >= 0) {
103260 + if (gr_handle_sock_server((struct sockaddr *)&address)) {
103261 + err = -EACCES;
103262 + goto error;
103263 + }
103264 + err = gr_search_bind(sock, (struct sockaddr_in *)&address);
103265 + if (err)
103266 + goto error;
103267 +
103268 err = security_socket_bind(sock,
103269 (struct sockaddr *)&address,
103270 addrlen);
103271 @@ -1535,6 +1562,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct sockaddr __user *, umyaddr, int, addrlen)
103272 (struct sockaddr *)
103273 &address, addrlen);
103274 }
103275 +error:
103276 fput_light(sock->file, fput_needed);
103277 }
103278 return err;
103279 @@ -1558,10 +1586,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, backlog)
103280 if ((unsigned int)backlog > somaxconn)
103281 backlog = somaxconn;
103282
103283 + if (gr_handle_sock_server_other(sock->sk)) {
103284 + err = -EPERM;
103285 + goto error;
103286 + }
103287 +
103288 + err = gr_search_listen(sock);
103289 + if (err)
103290 + goto error;
103291 +
103292 err = security_socket_listen(sock, backlog);
103293 if (!err)
103294 err = sock->ops->listen(sock, backlog);
103295
103296 +error:
103297 fput_light(sock->file, fput_needed);
103298 }
103299 return err;
103300 @@ -1605,6 +1643,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
103301 newsock->type = sock->type;
103302 newsock->ops = sock->ops;
103303
103304 + if (gr_handle_sock_server_other(sock->sk)) {
103305 + err = -EPERM;
103306 + sock_release(newsock);
103307 + goto out_put;
103308 + }
103309 +
103310 + err = gr_search_accept(sock);
103311 + if (err) {
103312 + sock_release(newsock);
103313 + goto out_put;
103314 + }
103315 +
103316 /*
103317 * We don't need try_module_get here, as the listening socket (sock)
103318 * has the protocol module (sock->ops->owner) held.
103319 @@ -1650,6 +1700,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
103320 fd_install(newfd, newfile);
103321 err = newfd;
103322
103323 + gr_attach_curr_ip(newsock->sk);
103324 +
103325 out_put:
103326 fput_light(sock->file, fput_needed);
103327 out:
103328 @@ -1682,6 +1734,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
103329 int, addrlen)
103330 {
103331 struct socket *sock;
103332 + struct sockaddr *sck;
103333 struct sockaddr_storage address;
103334 int err, fput_needed;
103335
103336 @@ -1692,6 +1745,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr,
103337 if (err < 0)
103338 goto out_put;
103339
103340 + sck = (struct sockaddr *)&address;
103341 +
103342 + if (gr_handle_sock_client(sck)) {
103343 + err = -EACCES;
103344 + goto out_put;
103345 + }
103346 +
103347 + err = gr_search_connect(sock, (struct sockaddr_in *)sck);
103348 + if (err)
103349 + goto out_put;
103350 +
103351 err =
103352 security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
103353 if (err)
103354 @@ -1773,6 +1837,8 @@ SYSCALL_DEFINE3(getpeername, int, fd, struct sockaddr __user *, usockaddr,
103355 * the protocol.
103356 */
103357
103358 +asmlinkage long sys_sendto(int, void __user *, size_t, unsigned, struct sockaddr __user *, int);
103359 +
103360 SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
103361 unsigned int, flags, struct sockaddr __user *, addr,
103362 int, addr_len)
103363 @@ -1839,7 +1905,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
103364 struct socket *sock;
103365 struct iovec iov;
103366 struct msghdr msg;
103367 - struct sockaddr_storage address;
103368 + struct sockaddr_storage address = { };
103369 int err, err2;
103370 int fput_needed;
103371
103372 @@ -2065,7 +2131,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
103373 * checking falls down on this.
103374 */
103375 if (copy_from_user(ctl_buf,
103376 - (void __user __force *)msg_sys->msg_control,
103377 + (void __force_user *)msg_sys->msg_control,
103378 ctl_len))
103379 goto out_freectl;
103380 msg_sys->msg_control = ctl_buf;
103381 @@ -2216,7 +2282,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
103382 int err, total_len, len;
103383
103384 /* kernel mode address */
103385 - struct sockaddr_storage addr;
103386 + struct sockaddr_storage addr = { };
103387
103388 /* user mode address pointers */
103389 struct sockaddr __user *uaddr;
103390 @@ -2245,7 +2311,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
103391 /* Save the user-mode address (verify_iovec will change the
103392 * kernel msghdr to use the kernel address space)
103393 */
103394 - uaddr = (__force void __user *)msg_sys->msg_name;
103395 + uaddr = (void __force_user *)msg_sys->msg_name;
103396 uaddr_len = COMPAT_NAMELEN(msg);
103397 if (MSG_CMSG_COMPAT & flags)
103398 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
103399 @@ -2889,7 +2955,7 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
103400 ifr = compat_alloc_user_space(buf_size);
103401 rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8);
103402
103403 - if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ))
103404 + if (copy_in_user(ifr->ifr_name, ifr32->ifr_name, IFNAMSIZ))
103405 return -EFAULT;
103406
103407 if (put_user(convert_in ? rxnfc : compat_ptr(data),
103408 @@ -3000,7 +3066,7 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
103409 old_fs = get_fs();
103410 set_fs(KERNEL_DS);
103411 err = dev_ioctl(net, cmd,
103412 - (struct ifreq __user __force *) &kifr);
103413 + (struct ifreq __force_user *) &kifr);
103414 set_fs(old_fs);
103415
103416 return err;
103417 @@ -3093,7 +3159,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
103418
103419 old_fs = get_fs();
103420 set_fs(KERNEL_DS);
103421 - err = dev_ioctl(net, cmd, (void __user __force *)&ifr);
103422 + err = dev_ioctl(net, cmd, (void __force_user *)&ifr);
103423 set_fs(old_fs);
103424
103425 if (cmd == SIOCGIFMAP && !err) {
103426 @@ -3177,7 +3243,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
103427 ret |= get_user(rtdev, &(ur4->rt_dev));
103428 if (rtdev) {
103429 ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
103430 - r4.rt_dev = (char __user __force *)devname;
103431 + r4.rt_dev = (char __force_user *)devname;
103432 devname[15] = 0;
103433 } else
103434 r4.rt_dev = NULL;
103435 @@ -3404,8 +3470,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
103436 int __user *uoptlen;
103437 int err;
103438
103439 - uoptval = (char __user __force *) optval;
103440 - uoptlen = (int __user __force *) optlen;
103441 + uoptval = (char __force_user *) optval;
103442 + uoptlen = (int __force_user *) optlen;
103443
103444 set_fs(KERNEL_DS);
103445 if (level == SOL_SOCKET)
103446 @@ -3425,7 +3491,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
103447 char __user *uoptval;
103448 int err;
103449
103450 - uoptval = (char __user __force *) optval;
103451 + uoptval = (char __force_user *) optval;
103452
103453 set_fs(KERNEL_DS);
103454 if (level == SOL_SOCKET)
103455 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
103456 index 0f73f45..a96aa52 100644
103457 --- a/net/sunrpc/auth_gss/svcauth_gss.c
103458 +++ b/net/sunrpc/auth_gss/svcauth_gss.c
103459 @@ -1140,7 +1140,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
103460 uint64_t *handle)
103461 {
103462 struct rsc rsci, *rscp = NULL;
103463 - static atomic64_t ctxhctr;
103464 + static atomic64_unchecked_t ctxhctr = ATOMIC64_INIT(0);
103465 long long ctxh;
103466 struct gss_api_mech *gm = NULL;
103467 time_t expiry;
103468 @@ -1151,7 +1151,7 @@ static int gss_proxy_save_rsc(struct cache_detail *cd,
103469 status = -ENOMEM;
103470 /* the handle needs to be just a unique id,
103471 * use a static counter */
103472 - ctxh = atomic64_inc_return(&ctxhctr);
103473 + ctxh = atomic64_inc_return_unchecked(&ctxhctr);
103474
103475 /* make a copy for the caller */
103476 *handle = ctxh;
103477 diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
103478 index ae333c1..18521f0 100644
103479 --- a/net/sunrpc/cache.c
103480 +++ b/net/sunrpc/cache.c
103481 @@ -1609,7 +1609,7 @@ static int create_cache_proc_entries(struct cache_detail *cd, struct net *net)
103482 struct sunrpc_net *sn;
103483
103484 sn = net_generic(net, sunrpc_net_id);
103485 - cd->u.procfs.proc_ent = proc_mkdir(cd->name, sn->proc_net_rpc);
103486 + cd->u.procfs.proc_ent = proc_mkdir_restrict(cd->name, sn->proc_net_rpc);
103487 if (cd->u.procfs.proc_ent == NULL)
103488 goto out_nomem;
103489 cd->u.procfs.channel_ent = NULL;
103490 diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
103491 index 3ea5cda..bfb3e08 100644
103492 --- a/net/sunrpc/clnt.c
103493 +++ b/net/sunrpc/clnt.c
103494 @@ -1415,7 +1415,9 @@ call_start(struct rpc_task *task)
103495 (RPC_IS_ASYNC(task) ? "async" : "sync"));
103496
103497 /* Increment call count */
103498 - task->tk_msg.rpc_proc->p_count++;
103499 + pax_open_kernel();
103500 + (*(unsigned int *)&task->tk_msg.rpc_proc->p_count)++;
103501 + pax_close_kernel();
103502 clnt->cl_stats->rpccnt++;
103503 task->tk_action = call_reserve;
103504 }
103505 diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
103506 index ff3cc4b..7612a9e 100644
103507 --- a/net/sunrpc/sched.c
103508 +++ b/net/sunrpc/sched.c
103509 @@ -261,9 +261,9 @@ static int rpc_wait_bit_killable(void *word)
103510 #if defined(RPC_DEBUG) || defined(RPC_TRACEPOINTS)
103511 static void rpc_task_set_debuginfo(struct rpc_task *task)
103512 {
103513 - static atomic_t rpc_pid;
103514 + static atomic_unchecked_t rpc_pid;
103515
103516 - task->tk_pid = atomic_inc_return(&rpc_pid);
103517 + task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
103518 }
103519 #else
103520 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
103521 diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
103522 index 5453049..465669a 100644
103523 --- a/net/sunrpc/stats.c
103524 +++ b/net/sunrpc/stats.c
103525 @@ -267,7 +267,7 @@ int rpc_proc_init(struct net *net)
103526
103527 dprintk("RPC: registering /proc/net/rpc\n");
103528 sn = net_generic(net, sunrpc_net_id);
103529 - sn->proc_net_rpc = proc_mkdir("rpc", net->proc_net);
103530 + sn->proc_net_rpc = proc_mkdir_restrict("rpc", net->proc_net);
103531 if (sn->proc_net_rpc == NULL)
103532 return -ENOMEM;
103533
103534 diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
103535 index 5de6801..b4e330d 100644
103536 --- a/net/sunrpc/svc.c
103537 +++ b/net/sunrpc/svc.c
103538 @@ -1167,7 +1167,9 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
103539 svc_putnl(resv, RPC_SUCCESS);
103540
103541 /* Bump per-procedure stats counter */
103542 - procp->pc_count++;
103543 + pax_open_kernel();
103544 + (*(unsigned int *)&procp->pc_count)++;
103545 + pax_close_kernel();
103546
103547 /* Initialize storage for argp and resp */
103548 memset(rqstp->rq_argp, 0, procp->pc_argsize);
103549 diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
103550 index 621ca7b..59421dd 100644
103551 --- a/net/sunrpc/svcauth_unix.c
103552 +++ b/net/sunrpc/svcauth_unix.c
103553 @@ -414,7 +414,7 @@ struct unix_gid {
103554 struct group_info *gi;
103555 };
103556
103557 -static int unix_gid_hash(kuid_t uid)
103558 +static int __intentional_overflow(-1) unix_gid_hash(kuid_t uid)
103559 {
103560 return hash_long(from_kuid(&init_user_ns, uid), GID_HASHBITS);
103561 }
103562 @@ -470,7 +470,7 @@ static void unix_gid_request(struct cache_detail *cd,
103563 (*bpp)[-1] = '\n';
103564 }
103565
103566 -static struct unix_gid *unix_gid_lookup(struct cache_detail *cd, kuid_t uid);
103567 +static struct unix_gid * __intentional_overflow(-1) unix_gid_lookup(struct cache_detail *cd, kuid_t uid);
103568
103569 static int unix_gid_parse(struct cache_detail *cd,
103570 char *mesg, int mlen)
103571 diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
103572 index c1b6270..05089c1 100644
103573 --- a/net/sunrpc/xprtrdma/svc_rdma.c
103574 +++ b/net/sunrpc/xprtrdma/svc_rdma.c
103575 @@ -62,15 +62,15 @@ unsigned int svcrdma_max_req_size = RPCRDMA_MAX_REQ_SIZE;
103576 static unsigned int min_max_inline = 4096;
103577 static unsigned int max_max_inline = 65536;
103578
103579 -atomic_t rdma_stat_recv;
103580 -atomic_t rdma_stat_read;
103581 -atomic_t rdma_stat_write;
103582 -atomic_t rdma_stat_sq_starve;
103583 -atomic_t rdma_stat_rq_starve;
103584 -atomic_t rdma_stat_rq_poll;
103585 -atomic_t rdma_stat_rq_prod;
103586 -atomic_t rdma_stat_sq_poll;
103587 -atomic_t rdma_stat_sq_prod;
103588 +atomic_unchecked_t rdma_stat_recv;
103589 +atomic_unchecked_t rdma_stat_read;
103590 +atomic_unchecked_t rdma_stat_write;
103591 +atomic_unchecked_t rdma_stat_sq_starve;
103592 +atomic_unchecked_t rdma_stat_rq_starve;
103593 +atomic_unchecked_t rdma_stat_rq_poll;
103594 +atomic_unchecked_t rdma_stat_rq_prod;
103595 +atomic_unchecked_t rdma_stat_sq_poll;
103596 +atomic_unchecked_t rdma_stat_sq_prod;
103597
103598 /* Temporary NFS request map and context caches */
103599 struct kmem_cache *svc_rdma_map_cachep;
103600 @@ -110,7 +110,7 @@ static int read_reset_stat(struct ctl_table *table, int write,
103601 len -= *ppos;
103602 if (len > *lenp)
103603 len = *lenp;
103604 - if (len && copy_to_user(buffer, str_buf, len))
103605 + if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
103606 return -EFAULT;
103607 *lenp = len;
103608 *ppos += len;
103609 @@ -151,63 +151,63 @@ static struct ctl_table svcrdma_parm_table[] = {
103610 {
103611 .procname = "rdma_stat_read",
103612 .data = &rdma_stat_read,
103613 - .maxlen = sizeof(atomic_t),
103614 + .maxlen = sizeof(atomic_unchecked_t),
103615 .mode = 0644,
103616 .proc_handler = read_reset_stat,
103617 },
103618 {
103619 .procname = "rdma_stat_recv",
103620 .data = &rdma_stat_recv,
103621 - .maxlen = sizeof(atomic_t),
103622 + .maxlen = sizeof(atomic_unchecked_t),
103623 .mode = 0644,
103624 .proc_handler = read_reset_stat,
103625 },
103626 {
103627 .procname = "rdma_stat_write",
103628 .data = &rdma_stat_write,
103629 - .maxlen = sizeof(atomic_t),
103630 + .maxlen = sizeof(atomic_unchecked_t),
103631 .mode = 0644,
103632 .proc_handler = read_reset_stat,
103633 },
103634 {
103635 .procname = "rdma_stat_sq_starve",
103636 .data = &rdma_stat_sq_starve,
103637 - .maxlen = sizeof(atomic_t),
103638 + .maxlen = sizeof(atomic_unchecked_t),
103639 .mode = 0644,
103640 .proc_handler = read_reset_stat,
103641 },
103642 {
103643 .procname = "rdma_stat_rq_starve",
103644 .data = &rdma_stat_rq_starve,
103645 - .maxlen = sizeof(atomic_t),
103646 + .maxlen = sizeof(atomic_unchecked_t),
103647 .mode = 0644,
103648 .proc_handler = read_reset_stat,
103649 },
103650 {
103651 .procname = "rdma_stat_rq_poll",
103652 .data = &rdma_stat_rq_poll,
103653 - .maxlen = sizeof(atomic_t),
103654 + .maxlen = sizeof(atomic_unchecked_t),
103655 .mode = 0644,
103656 .proc_handler = read_reset_stat,
103657 },
103658 {
103659 .procname = "rdma_stat_rq_prod",
103660 .data = &rdma_stat_rq_prod,
103661 - .maxlen = sizeof(atomic_t),
103662 + .maxlen = sizeof(atomic_unchecked_t),
103663 .mode = 0644,
103664 .proc_handler = read_reset_stat,
103665 },
103666 {
103667 .procname = "rdma_stat_sq_poll",
103668 .data = &rdma_stat_sq_poll,
103669 - .maxlen = sizeof(atomic_t),
103670 + .maxlen = sizeof(atomic_unchecked_t),
103671 .mode = 0644,
103672 .proc_handler = read_reset_stat,
103673 },
103674 {
103675 .procname = "rdma_stat_sq_prod",
103676 .data = &rdma_stat_sq_prod,
103677 - .maxlen = sizeof(atomic_t),
103678 + .maxlen = sizeof(atomic_unchecked_t),
103679 .mode = 0644,
103680 .proc_handler = read_reset_stat,
103681 },
103682 diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
103683 index 0ce7552..d074459 100644
103684 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
103685 +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
103686 @@ -501,7 +501,7 @@ next_sge:
103687 svc_rdma_put_context(ctxt, 0);
103688 goto out;
103689 }
103690 - atomic_inc(&rdma_stat_read);
103691 + atomic_inc_unchecked(&rdma_stat_read);
103692
103693 if (read_wr.num_sge < chl_map->ch[ch_no].count) {
103694 chl_map->ch[ch_no].count -= read_wr.num_sge;
103695 @@ -611,7 +611,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
103696 dto_q);
103697 list_del_init(&ctxt->dto_q);
103698 } else {
103699 - atomic_inc(&rdma_stat_rq_starve);
103700 + atomic_inc_unchecked(&rdma_stat_rq_starve);
103701 clear_bit(XPT_DATA, &xprt->xpt_flags);
103702 ctxt = NULL;
103703 }
103704 @@ -631,7 +631,7 @@ int svc_rdma_recvfrom(struct svc_rqst *rqstp)
103705 dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
103706 ctxt, rdma_xprt, rqstp, ctxt->wc_status);
103707 BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
103708 - atomic_inc(&rdma_stat_recv);
103709 + atomic_inc_unchecked(&rdma_stat_recv);
103710
103711 /* Build up the XDR from the receive buffers. */
103712 rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
103713 diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
103714 index c1d124d..acfc59e 100644
103715 --- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
103716 +++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
103717 @@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdma *xprt, struct svc_rqst *rqstp,
103718 write_wr.wr.rdma.remote_addr = to;
103719
103720 /* Post It */
103721 - atomic_inc(&rdma_stat_write);
103722 + atomic_inc_unchecked(&rdma_stat_write);
103723 if (svc_rdma_send(xprt, &write_wr))
103724 goto err;
103725 return 0;
103726 diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
103727 index 62e4f9b..dd3f2d7 100644
103728 --- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
103729 +++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
103730 @@ -292,7 +292,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
103731 return;
103732
103733 ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
103734 - atomic_inc(&rdma_stat_rq_poll);
103735 + atomic_inc_unchecked(&rdma_stat_rq_poll);
103736
103737 while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
103738 ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
103739 @@ -314,7 +314,7 @@ static void rq_cq_reap(struct svcxprt_rdma *xprt)
103740 }
103741
103742 if (ctxt)
103743 - atomic_inc(&rdma_stat_rq_prod);
103744 + atomic_inc_unchecked(&rdma_stat_rq_prod);
103745
103746 set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
103747 /*
103748 @@ -386,7 +386,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
103749 return;
103750
103751 ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
103752 - atomic_inc(&rdma_stat_sq_poll);
103753 + atomic_inc_unchecked(&rdma_stat_sq_poll);
103754 while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
103755 if (wc.status != IB_WC_SUCCESS)
103756 /* Close the transport */
103757 @@ -404,7 +404,7 @@ static void sq_cq_reap(struct svcxprt_rdma *xprt)
103758 }
103759
103760 if (ctxt)
103761 - atomic_inc(&rdma_stat_sq_prod);
103762 + atomic_inc_unchecked(&rdma_stat_sq_prod);
103763 }
103764
103765 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
103766 @@ -1262,7 +1262,7 @@ int svc_rdma_send(struct svcxprt_rdma *xprt, struct ib_send_wr *wr)
103767 spin_lock_bh(&xprt->sc_lock);
103768 if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
103769 spin_unlock_bh(&xprt->sc_lock);
103770 - atomic_inc(&rdma_stat_sq_starve);
103771 + atomic_inc_unchecked(&rdma_stat_sq_starve);
103772
103773 /* See if we can opportunistically reap SQ WR to make room */
103774 sq_cq_reap(xprt);
103775 diff --git a/net/sysctl_net.c b/net/sysctl_net.c
103776 index e7000be..e3b0ba7 100644
103777 --- a/net/sysctl_net.c
103778 +++ b/net/sysctl_net.c
103779 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ctl_table_header *head,
103780 kgid_t root_gid = make_kgid(net->user_ns, 0);
103781
103782 /* Allow network administrator to have same access as root. */
103783 - if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
103784 + if (ns_capable_nolog(net->user_ns, CAP_NET_ADMIN) ||
103785 uid_eq(root_uid, current_euid())) {
103786 int mode = (table->mode >> 6) & 7;
103787 return (mode << 6) | (mode << 3) | mode;
103788 diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
103789 index 6424372..afd36e9 100644
103790 --- a/net/tipc/subscr.c
103791 +++ b/net/tipc/subscr.c
103792 @@ -97,7 +97,7 @@ static void subscr_send_event(struct tipc_subscription *sub, u32 found_lower,
103793 struct tipc_subscriber *subscriber = sub->subscriber;
103794 struct kvec msg_sect;
103795
103796 - msg_sect.iov_base = (void *)&sub->evt;
103797 + msg_sect.iov_base = &sub->evt;
103798 msg_sect.iov_len = sizeof(struct tipc_event);
103799 sub->evt.event = htohl(event, sub->swap);
103800 sub->evt.found_lower = htohl(found_lower, sub->swap);
103801 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
103802 index 94404f1..5782191 100644
103803 --- a/net/unix/af_unix.c
103804 +++ b/net/unix/af_unix.c
103805 @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
103806 err = -ECONNREFUSED;
103807 if (!S_ISSOCK(inode->i_mode))
103808 goto put_fail;
103809 +
103810 + if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
103811 + err = -EACCES;
103812 + goto put_fail;
103813 + }
103814 +
103815 u = unix_find_socket_byinode(inode);
103816 if (!u)
103817 goto put_fail;
103818 @@ -811,6 +817,13 @@ static struct sock *unix_find_other(struct net *net,
103819 if (u) {
103820 struct dentry *dentry;
103821 dentry = unix_sk(u)->path.dentry;
103822 +
103823 + if (!gr_handle_chroot_unix(pid_vnr(u->sk_peer_pid))) {
103824 + err = -EPERM;
103825 + sock_put(u);
103826 + goto fail;
103827 + }
103828 +
103829 if (dentry)
103830 touch_atime(&unix_sk(u)->path);
103831 } else
103832 @@ -844,12 +857,18 @@ static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
103833 */
103834 err = security_path_mknod(&path, dentry, mode, 0);
103835 if (!err) {
103836 + if (!gr_acl_handle_mknod(dentry, path.dentry, path.mnt, mode)) {
103837 + err = -EACCES;
103838 + goto out;
103839 + }
103840 err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
103841 if (!err) {
103842 res->mnt = mntget(path.mnt);
103843 res->dentry = dget(dentry);
103844 + gr_handle_create(dentry, path.mnt);
103845 }
103846 }
103847 +out:
103848 done_path_create(&path, dentry);
103849 return err;
103850 }
103851 @@ -2344,9 +2363,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
103852 seq_puts(seq, "Num RefCount Protocol Flags Type St "
103853 "Inode Path\n");
103854 else {
103855 - struct sock *s = v;
103856 + struct sock *s = v, *peer;
103857 struct unix_sock *u = unix_sk(s);
103858 unix_state_lock(s);
103859 + peer = unix_peer(s);
103860 + unix_state_unlock(s);
103861 +
103862 + unix_state_double_lock(s, peer);
103863
103864 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
103865 s,
103866 @@ -2373,8 +2396,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
103867 }
103868 for ( ; i < len; i++)
103869 seq_putc(seq, u->addr->name->sun_path[i]);
103870 - }
103871 - unix_state_unlock(s);
103872 + } else if (peer)
103873 + seq_printf(seq, " P%lu", sock_i_ino(peer));
103874 +
103875 + unix_state_double_unlock(s, peer);
103876 seq_putc(seq, '\n');
103877 }
103878
103879 diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
103880 index b3d5150..ff3a837 100644
103881 --- a/net/unix/sysctl_net_unix.c
103882 +++ b/net/unix/sysctl_net_unix.c
103883 @@ -28,7 +28,7 @@ static struct ctl_table unix_table[] = {
103884
103885 int __net_init unix_sysctl_register(struct net *net)
103886 {
103887 - struct ctl_table *table;
103888 + ctl_table_no_const *table;
103889
103890 table = kmemdup(unix_table, sizeof(unix_table), GFP_KERNEL);
103891 if (table == NULL)
103892 diff --git a/net/vmw_vsock/vmci_transport_notify.c b/net/vmw_vsock/vmci_transport_notify.c
103893 index 9a73074..aecba9a 100644
103894 --- a/net/vmw_vsock/vmci_transport_notify.c
103895 +++ b/net/vmw_vsock/vmci_transport_notify.c
103896 @@ -662,19 +662,19 @@ static void vmci_transport_notify_pkt_process_negotiate(struct sock *sk)
103897
103898 /* Socket control packet based operations. */
103899 struct vmci_transport_notify_ops vmci_transport_notify_pkt_ops = {
103900 - vmci_transport_notify_pkt_socket_init,
103901 - vmci_transport_notify_pkt_socket_destruct,
103902 - vmci_transport_notify_pkt_poll_in,
103903 - vmci_transport_notify_pkt_poll_out,
103904 - vmci_transport_notify_pkt_handle_pkt,
103905 - vmci_transport_notify_pkt_recv_init,
103906 - vmci_transport_notify_pkt_recv_pre_block,
103907 - vmci_transport_notify_pkt_recv_pre_dequeue,
103908 - vmci_transport_notify_pkt_recv_post_dequeue,
103909 - vmci_transport_notify_pkt_send_init,
103910 - vmci_transport_notify_pkt_send_pre_block,
103911 - vmci_transport_notify_pkt_send_pre_enqueue,
103912 - vmci_transport_notify_pkt_send_post_enqueue,
103913 - vmci_transport_notify_pkt_process_request,
103914 - vmci_transport_notify_pkt_process_negotiate,
103915 + .socket_init = vmci_transport_notify_pkt_socket_init,
103916 + .socket_destruct = vmci_transport_notify_pkt_socket_destruct,
103917 + .poll_in = vmci_transport_notify_pkt_poll_in,
103918 + .poll_out = vmci_transport_notify_pkt_poll_out,
103919 + .handle_notify_pkt = vmci_transport_notify_pkt_handle_pkt,
103920 + .recv_init = vmci_transport_notify_pkt_recv_init,
103921 + .recv_pre_block = vmci_transport_notify_pkt_recv_pre_block,
103922 + .recv_pre_dequeue = vmci_transport_notify_pkt_recv_pre_dequeue,
103923 + .recv_post_dequeue = vmci_transport_notify_pkt_recv_post_dequeue,
103924 + .send_init = vmci_transport_notify_pkt_send_init,
103925 + .send_pre_block = vmci_transport_notify_pkt_send_pre_block,
103926 + .send_pre_enqueue = vmci_transport_notify_pkt_send_pre_enqueue,
103927 + .send_post_enqueue = vmci_transport_notify_pkt_send_post_enqueue,
103928 + .process_request = vmci_transport_notify_pkt_process_request,
103929 + .process_negotiate = vmci_transport_notify_pkt_process_negotiate,
103930 };
103931 diff --git a/net/vmw_vsock/vmci_transport_notify_qstate.c b/net/vmw_vsock/vmci_transport_notify_qstate.c
103932 index 622bd7a..b92086c 100644
103933 --- a/net/vmw_vsock/vmci_transport_notify_qstate.c
103934 +++ b/net/vmw_vsock/vmci_transport_notify_qstate.c
103935 @@ -420,19 +420,19 @@ vmci_transport_notify_pkt_send_pre_enqueue(
103936
103937 /* Socket always on control packet based operations. */
103938 struct vmci_transport_notify_ops vmci_transport_notify_pkt_q_state_ops = {
103939 - vmci_transport_notify_pkt_socket_init,
103940 - vmci_transport_notify_pkt_socket_destruct,
103941 - vmci_transport_notify_pkt_poll_in,
103942 - vmci_transport_notify_pkt_poll_out,
103943 - vmci_transport_notify_pkt_handle_pkt,
103944 - vmci_transport_notify_pkt_recv_init,
103945 - vmci_transport_notify_pkt_recv_pre_block,
103946 - vmci_transport_notify_pkt_recv_pre_dequeue,
103947 - vmci_transport_notify_pkt_recv_post_dequeue,
103948 - vmci_transport_notify_pkt_send_init,
103949 - vmci_transport_notify_pkt_send_pre_block,
103950 - vmci_transport_notify_pkt_send_pre_enqueue,
103951 - vmci_transport_notify_pkt_send_post_enqueue,
103952 - vmci_transport_notify_pkt_process_request,
103953 - vmci_transport_notify_pkt_process_negotiate,
103954 + .socket_init = vmci_transport_notify_pkt_socket_init,
103955 + .socket_destruct = vmci_transport_notify_pkt_socket_destruct,
103956 + .poll_in = vmci_transport_notify_pkt_poll_in,
103957 + .poll_out = vmci_transport_notify_pkt_poll_out,
103958 + .handle_notify_pkt = vmci_transport_notify_pkt_handle_pkt,
103959 + .recv_init = vmci_transport_notify_pkt_recv_init,
103960 + .recv_pre_block = vmci_transport_notify_pkt_recv_pre_block,
103961 + .recv_pre_dequeue = vmci_transport_notify_pkt_recv_pre_dequeue,
103962 + .recv_post_dequeue = vmci_transport_notify_pkt_recv_post_dequeue,
103963 + .send_init = vmci_transport_notify_pkt_send_init,
103964 + .send_pre_block = vmci_transport_notify_pkt_send_pre_block,
103965 + .send_pre_enqueue = vmci_transport_notify_pkt_send_pre_enqueue,
103966 + .send_post_enqueue = vmci_transport_notify_pkt_send_post_enqueue,
103967 + .process_request = vmci_transport_notify_pkt_process_request,
103968 + .process_negotiate = vmci_transport_notify_pkt_process_negotiate,
103969 };
103970 diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
103971 index c8717c1..08539f5 100644
103972 --- a/net/wireless/wext-core.c
103973 +++ b/net/wireless/wext-core.c
103974 @@ -748,8 +748,7 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
103975 */
103976
103977 /* Support for very large requests */
103978 - if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
103979 - (user_length > descr->max_tokens)) {
103980 + if (user_length > descr->max_tokens) {
103981 /* Allow userspace to GET more than max so
103982 * we can support any size GET requests.
103983 * There is still a limit : -ENOMEM.
103984 @@ -788,22 +787,6 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
103985 }
103986 }
103987
103988 - if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
103989 - /*
103990 - * If this is a GET, but not NOMAX, it means that the extra
103991 - * data is not bounded by userspace, but by max_tokens. Thus
103992 - * set the length to max_tokens. This matches the extra data
103993 - * allocation.
103994 - * The driver should fill it with the number of tokens it
103995 - * provided, and it may check iwp->length rather than having
103996 - * knowledge of max_tokens. If the driver doesn't change the
103997 - * iwp->length, this ioctl just copies back max_token tokens
103998 - * filled with zeroes. Hopefully the driver isn't claiming
103999 - * them to be valid data.
104000 - */
104001 - iwp->length = descr->max_tokens;
104002 - }
104003 -
104004 err = handler(dev, info, (union iwreq_data *) iwp, extra);
104005
104006 iwp->length += essid_compat;
104007 diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
104008 index 4323952..a06dfe1 100644
104009 --- a/net/x25/sysctl_net_x25.c
104010 +++ b/net/x25/sysctl_net_x25.c
104011 @@ -70,7 +70,7 @@ static struct ctl_table x25_table[] = {
104012 .mode = 0644,
104013 .proc_handler = proc_dointvec,
104014 },
104015 - { 0, },
104016 + { },
104017 };
104018
104019 void __init x25_register_sysctl(void)
104020 diff --git a/net/x25/x25_proc.c b/net/x25/x25_proc.c
104021 index 0917f04..f4e3d8c 100644
104022 --- a/net/x25/x25_proc.c
104023 +++ b/net/x25/x25_proc.c
104024 @@ -209,7 +209,7 @@ static const struct file_operations x25_seq_forward_fops = {
104025
104026 int __init x25_proc_init(void)
104027 {
104028 - if (!proc_mkdir("x25", init_net.proc_net))
104029 + if (!proc_mkdir_restrict("x25", init_net.proc_net))
104030 return -ENOMEM;
104031
104032 if (!proc_create("x25/route", S_IRUGO, init_net.proc_net,
104033 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
104034 index 1d5c7bf..f762f1f 100644
104035 --- a/net/xfrm/xfrm_policy.c
104036 +++ b/net/xfrm/xfrm_policy.c
104037 @@ -327,7 +327,7 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
104038 {
104039 policy->walk.dead = 1;
104040
104041 - atomic_inc(&policy->genid);
104042 + atomic_inc_unchecked(&policy->genid);
104043
104044 if (del_timer(&policy->polq.hold_timer))
104045 xfrm_pol_put(policy);
104046 @@ -661,7 +661,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
104047 hlist_add_head(&policy->bydst, chain);
104048 xfrm_pol_hold(policy);
104049 net->xfrm.policy_count[dir]++;
104050 - atomic_inc(&flow_cache_genid);
104051 + atomic_inc_unchecked(&flow_cache_genid);
104052
104053 /* After previous checking, family can either be AF_INET or AF_INET6 */
104054 if (policy->family == AF_INET)
104055 @@ -1761,7 +1761,7 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
104056
104057 xdst->num_pols = num_pols;
104058 memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
104059 - xdst->policy_genid = atomic_read(&pols[0]->genid);
104060 + xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
104061
104062 return xdst;
104063 }
104064 @@ -2572,11 +2572,12 @@ void xfrm_garbage_collect(struct net *net)
104065 }
104066 EXPORT_SYMBOL(xfrm_garbage_collect);
104067
104068 -static void xfrm_garbage_collect_deferred(struct net *net)
104069 +void xfrm_garbage_collect_deferred(struct net *net)
104070 {
104071 flow_cache_flush_deferred();
104072 __xfrm_garbage_collect(net);
104073 }
104074 +EXPORT_SYMBOL(xfrm_garbage_collect_deferred);
104075
104076 static void xfrm_init_pmtu(struct dst_entry *dst)
104077 {
104078 @@ -2626,7 +2627,7 @@ static int xfrm_bundle_ok(struct xfrm_dst *first)
104079 if (xdst->xfrm_genid != dst->xfrm->genid)
104080 return 0;
104081 if (xdst->num_pols > 0 &&
104082 - xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
104083 + xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
104084 return 0;
104085
104086 mtu = dst_mtu(dst->child);
104087 @@ -2714,8 +2715,6 @@ int xfrm_policy_register_afinfo(struct xfrm_policy_afinfo *afinfo)
104088 dst_ops->link_failure = xfrm_link_failure;
104089 if (likely(dst_ops->neigh_lookup == NULL))
104090 dst_ops->neigh_lookup = xfrm_neigh_lookup;
104091 - if (likely(afinfo->garbage_collect == NULL))
104092 - afinfo->garbage_collect = xfrm_garbage_collect_deferred;
104093 rcu_assign_pointer(xfrm_policy_afinfo[afinfo->family], afinfo);
104094 }
104095 spin_unlock(&xfrm_policy_afinfo_lock);
104096 @@ -2769,7 +2768,6 @@ int xfrm_policy_unregister_afinfo(struct xfrm_policy_afinfo *afinfo)
104097 dst_ops->check = NULL;
104098 dst_ops->negative_advice = NULL;
104099 dst_ops->link_failure = NULL;
104100 - afinfo->garbage_collect = NULL;
104101 }
104102 return err;
104103 }
104104 @@ -3159,7 +3157,7 @@ static int xfrm_policy_migrate(struct xfrm_policy *pol,
104105 sizeof(pol->xfrm_vec[i].saddr));
104106 pol->xfrm_vec[i].encap_family = mp->new_family;
104107 /* flush bundles */
104108 - atomic_inc(&pol->genid);
104109 + atomic_inc_unchecked(&pol->genid);
104110 }
104111 }
104112
104113 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
104114 index 40f1b3e..e33fdfa 100644
104115 --- a/net/xfrm/xfrm_state.c
104116 +++ b/net/xfrm/xfrm_state.c
104117 @@ -172,12 +172,14 @@ int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
104118
104119 if (unlikely(afinfo == NULL))
104120 return -EAFNOSUPPORT;
104121 - typemap = afinfo->type_map;
104122 + typemap = (const struct xfrm_type **)afinfo->type_map;
104123 spin_lock_bh(&xfrm_type_lock);
104124
104125 - if (likely(typemap[type->proto] == NULL))
104126 + if (likely(typemap[type->proto] == NULL)) {
104127 + pax_open_kernel();
104128 typemap[type->proto] = type;
104129 - else
104130 + pax_close_kernel();
104131 + } else
104132 err = -EEXIST;
104133 spin_unlock_bh(&xfrm_type_lock);
104134 xfrm_state_put_afinfo(afinfo);
104135 @@ -193,13 +195,16 @@ int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
104136
104137 if (unlikely(afinfo == NULL))
104138 return -EAFNOSUPPORT;
104139 - typemap = afinfo->type_map;
104140 + typemap = (const struct xfrm_type **)afinfo->type_map;
104141 spin_lock_bh(&xfrm_type_lock);
104142
104143 if (unlikely(typemap[type->proto] != type))
104144 err = -ENOENT;
104145 - else
104146 + else {
104147 + pax_open_kernel();
104148 typemap[type->proto] = NULL;
104149 + pax_close_kernel();
104150 + }
104151 spin_unlock_bh(&xfrm_type_lock);
104152 xfrm_state_put_afinfo(afinfo);
104153 return err;
104154 @@ -209,7 +214,6 @@ EXPORT_SYMBOL(xfrm_unregister_type);
104155 static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
104156 {
104157 struct xfrm_state_afinfo *afinfo;
104158 - const struct xfrm_type **typemap;
104159 const struct xfrm_type *type;
104160 int modload_attempted = 0;
104161
104162 @@ -217,9 +221,8 @@ retry:
104163 afinfo = xfrm_state_get_afinfo(family);
104164 if (unlikely(afinfo == NULL))
104165 return NULL;
104166 - typemap = afinfo->type_map;
104167
104168 - type = typemap[proto];
104169 + type = afinfo->type_map[proto];
104170 if (unlikely(type && !try_module_get(type->owner)))
104171 type = NULL;
104172 if (!type && !modload_attempted) {
104173 @@ -253,7 +256,7 @@ int xfrm_register_mode(struct xfrm_mode *mode, int family)
104174 return -EAFNOSUPPORT;
104175
104176 err = -EEXIST;
104177 - modemap = afinfo->mode_map;
104178 + modemap = (struct xfrm_mode **)afinfo->mode_map;
104179 spin_lock_bh(&xfrm_mode_lock);
104180 if (modemap[mode->encap])
104181 goto out;
104182 @@ -262,8 +265,10 @@ int xfrm_register_mode(struct xfrm_mode *mode, int family)
104183 if (!try_module_get(afinfo->owner))
104184 goto out;
104185
104186 - mode->afinfo = afinfo;
104187 + pax_open_kernel();
104188 + *(const void **)&mode->afinfo = afinfo;
104189 modemap[mode->encap] = mode;
104190 + pax_close_kernel();
104191 err = 0;
104192
104193 out:
104194 @@ -287,10 +292,12 @@ int xfrm_unregister_mode(struct xfrm_mode *mode, int family)
104195 return -EAFNOSUPPORT;
104196
104197 err = -ENOENT;
104198 - modemap = afinfo->mode_map;
104199 + modemap = (struct xfrm_mode **)afinfo->mode_map;
104200 spin_lock_bh(&xfrm_mode_lock);
104201 if (likely(modemap[mode->encap] == mode)) {
104202 + pax_open_kernel();
104203 modemap[mode->encap] = NULL;
104204 + pax_close_kernel();
104205 module_put(mode->afinfo->owner);
104206 err = 0;
104207 }
104208 @@ -1512,10 +1519,10 @@ EXPORT_SYMBOL(xfrm_find_acq_byseq);
104209 u32 xfrm_get_acqseq(void)
104210 {
104211 u32 res;
104212 - static atomic_t acqseq;
104213 + static atomic_unchecked_t acqseq;
104214
104215 do {
104216 - res = atomic_inc_return(&acqseq);
104217 + res = atomic_inc_return_unchecked(&acqseq);
104218 } while (!res);
104219
104220 return res;
104221 diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
104222 index 05a6e3d..6716ec9 100644
104223 --- a/net/xfrm/xfrm_sysctl.c
104224 +++ b/net/xfrm/xfrm_sysctl.c
104225 @@ -42,7 +42,7 @@ static struct ctl_table xfrm_table[] = {
104226
104227 int __net_init xfrm_sysctl_init(struct net *net)
104228 {
104229 - struct ctl_table *table;
104230 + ctl_table_no_const *table;
104231
104232 __xfrm_sysctl_init(net);
104233
104234 diff --git a/scripts/Makefile b/scripts/Makefile
104235 index 01e7adb..6176d5d 100644
104236 --- a/scripts/Makefile
104237 +++ b/scripts/Makefile
104238 @@ -40,3 +40,5 @@ subdir-$(CONFIG_DTC) += dtc
104239
104240 # Let clean descend into subdirs
104241 subdir- += basic kconfig package selinux
104242 +
104243 +clean-files := randstruct.seed
104244 diff --git a/scripts/Makefile.build b/scripts/Makefile.build
104245 index d5d859c..781cbcb 100644
104246 --- a/scripts/Makefile.build
104247 +++ b/scripts/Makefile.build
104248 @@ -111,7 +111,7 @@ endif
104249 endif
104250
104251 # Do not include host rules unless needed
104252 -ifneq ($(hostprogs-y)$(hostprogs-m),)
104253 +ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m)$(hostcxxlibs-y)$(hostcxxlibs-m),)
104254 include scripts/Makefile.host
104255 endif
104256
104257 diff --git a/scripts/Makefile.clean b/scripts/Makefile.clean
104258 index 686cb0d..9d653bf 100644
104259 --- a/scripts/Makefile.clean
104260 +++ b/scripts/Makefile.clean
104261 @@ -43,7 +43,8 @@ subdir-ymn := $(addprefix $(obj)/,$(subdir-ymn))
104262 __clean-files := $(extra-y) $(always) \
104263 $(targets) $(clean-files) \
104264 $(host-progs) \
104265 - $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
104266 + $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
104267 + $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
104268
104269 __clean-files := $(filter-out $(no-clean-files), $(__clean-files))
104270
104271 diff --git a/scripts/Makefile.host b/scripts/Makefile.host
104272 index 1ac414f..38575f7 100644
104273 --- a/scripts/Makefile.host
104274 +++ b/scripts/Makefile.host
104275 @@ -31,6 +31,8 @@
104276 # Note: Shared libraries consisting of C++ files are not supported
104277
104278 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
104279 +__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
104280 +__hostcxxlibs := $(sort $(hostcxxlibs-y) $(hostcxxlibs-m))
104281
104282 # C code
104283 # Executables compiled from a single .c file
104284 @@ -54,11 +56,15 @@ host-cxxobjs := $(sort $(foreach m,$(host-cxxmulti),$($(m)-cxxobjs)))
104285 # Shared libaries (only .c supported)
104286 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
104287 host-cshlib := $(sort $(filter %.so, $(host-cobjs)))
104288 +host-cshlib += $(sort $(filter %.so, $(__hostlibs)))
104289 +host-cxxshlib := $(sort $(filter %.so, $(__hostcxxlibs)))
104290 # Remove .so files from "xxx-objs"
104291 host-cobjs := $(filter-out %.so,$(host-cobjs))
104292 +host-cxxobjs := $(filter-out %.so,$(host-cxxobjs))
104293
104294 -#Object (.o) files used by the shared libaries
104295 +# Object (.o) files used by the shared libaries
104296 host-cshobjs := $(sort $(foreach m,$(host-cshlib),$($(m:.so=-objs))))
104297 +host-cxxshobjs := $(sort $(foreach m,$(host-cxxshlib),$($(m:.so=-objs))))
104298
104299 # output directory for programs/.o files
104300 # hostprogs-y := tools/build may have been specified. Retrieve directory
104301 @@ -82,7 +88,9 @@ host-cobjs := $(addprefix $(obj)/,$(host-cobjs))
104302 host-cxxmulti := $(addprefix $(obj)/,$(host-cxxmulti))
104303 host-cxxobjs := $(addprefix $(obj)/,$(host-cxxobjs))
104304 host-cshlib := $(addprefix $(obj)/,$(host-cshlib))
104305 +host-cxxshlib := $(addprefix $(obj)/,$(host-cxxshlib))
104306 host-cshobjs := $(addprefix $(obj)/,$(host-cshobjs))
104307 +host-cxxshobjs := $(addprefix $(obj)/,$(host-cxxshobjs))
104308 host-objdirs := $(addprefix $(obj)/,$(host-objdirs))
104309
104310 obj-dirs += $(host-objdirs)
104311 @@ -156,6 +164,13 @@ quiet_cmd_host-cshobjs = HOSTCC -fPIC $@
104312 $(host-cshobjs): $(obj)/%.o: $(src)/%.c FORCE
104313 $(call if_changed_dep,host-cshobjs)
104314
104315 +# Compile .c file, create position independent .o file
104316 +# host-cxxshobjs -> .o
104317 +quiet_cmd_host-cxxshobjs = HOSTCXX -fPIC $@
104318 + cmd_host-cxxshobjs = $(HOSTCXX) $(hostcxx_flags) -fPIC -c -o $@ $<
104319 +$(host-cxxshobjs): $(obj)/%.o: $(src)/%.c FORCE
104320 + $(call if_changed_dep,host-cxxshobjs)
104321 +
104322 # Link a shared library, based on position independent .o files
104323 # *.o -> .so shared library (host-cshlib)
104324 quiet_cmd_host-cshlib = HOSTLLD -shared $@
104325 @@ -165,6 +180,15 @@ quiet_cmd_host-cshlib = HOSTLLD -shared $@
104326 $(host-cshlib): $(obj)/%: $(host-cshobjs) FORCE
104327 $(call if_changed,host-cshlib)
104328
104329 +# Link a shared library, based on position independent .o files
104330 +# *.o -> .so shared library (host-cxxshlib)
104331 +quiet_cmd_host-cxxshlib = HOSTLLD -shared $@
104332 + cmd_host-cxxshlib = $(HOSTCXX) $(HOSTLDFLAGS) -shared -o $@ \
104333 + $(addprefix $(obj)/,$($(@F:.so=-objs))) \
104334 + $(HOST_LOADLIBES) $(HOSTLOADLIBES_$(@F))
104335 +$(host-cxxshlib): $(obj)/%: $(host-cxxshobjs) FORCE
104336 + $(call if_changed,host-cxxshlib)
104337 +
104338 targets += $(host-csingle) $(host-cmulti) $(host-cobjs)\
104339 - $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs)
104340 + $(host-cxxmulti) $(host-cxxobjs) $(host-cshlib) $(host-cshobjs) $(host-cxxshlib) $(host-cxxshobjs)
104341
104342 diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c
104343 index 078fe1d..fbdb363 100644
104344 --- a/scripts/basic/fixdep.c
104345 +++ b/scripts/basic/fixdep.c
104346 @@ -161,7 +161,7 @@ static unsigned int strhash(const char *str, unsigned int sz)
104347 /*
104348 * Lookup a value in the configuration string.
104349 */
104350 -static int is_defined_config(const char *name, int len, unsigned int hash)
104351 +static int is_defined_config(const char *name, unsigned int len, unsigned int hash)
104352 {
104353 struct item *aux;
104354
104355 @@ -211,10 +211,10 @@ static void clear_config(void)
104356 /*
104357 * Record the use of a CONFIG_* word.
104358 */
104359 -static void use_config(const char *m, int slen)
104360 +static void use_config(const char *m, unsigned int slen)
104361 {
104362 unsigned int hash = strhash(m, slen);
104363 - int c, i;
104364 + unsigned int c, i;
104365
104366 if (is_defined_config(m, slen, hash))
104367 return;
104368 @@ -235,9 +235,9 @@ static void use_config(const char *m, int slen)
104369
104370 static void parse_config_file(const char *map, size_t len)
104371 {
104372 - const int *end = (const int *) (map + len);
104373 + const unsigned int *end = (const unsigned int *) (map + len);
104374 /* start at +1, so that p can never be < map */
104375 - const int *m = (const int *) map + 1;
104376 + const unsigned int *m = (const unsigned int *) map + 1;
104377 const char *p, *q;
104378
104379 for (; m < end; m++) {
104380 @@ -435,7 +435,7 @@ static void print_deps(void)
104381 static void traps(void)
104382 {
104383 static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
104384 - int *p = (int *)test;
104385 + unsigned int *p = (unsigned int *)test;
104386
104387 if (*p != INT_CONF) {
104388 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
104389 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
104390 new file mode 100644
104391 index 0000000..edcbc3a
104392 --- /dev/null
104393 +++ b/scripts/gcc-plugin.sh
104394 @@ -0,0 +1,16 @@
104395 +#!/bin/bash
104396 +srctree=$(dirname "$0")
104397 +gccplugins_dir=$($3 -print-file-name=plugin)
104398 +plugincc=$($1 -E -shared - -o /dev/null -I${srctree}/../tools/gcc -I${gccplugins_dir}/include 2>&1 <<EOF
104399 +#include "gcc-common.h"
104400 +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
104401 +#warning $2
104402 +#else
104403 +#warning $1
104404 +#endif
104405 +EOF
104406 +)
104407 +if [ $? -eq 0 ]
104408 +then
104409 + ( [[ "$plugincc" =~ "$1" ]] && echo "$1" ) || ( [[ "$plugincc" =~ "$2" ]] && echo "$2" )
104410 +fi
104411 diff --git a/scripts/headers_install.sh b/scripts/headers_install.sh
104412 index 5de5660..d3deb89 100644
104413 --- a/scripts/headers_install.sh
104414 +++ b/scripts/headers_install.sh
104415 @@ -32,6 +32,7 @@ do
104416 FILE="$(basename "$i")"
104417 sed -r \
104418 -e 's/([ \t(])(__user|__force|__iomem)[ \t]/\1/g' \
104419 + -e 's/__intentional_overflow\([- \t,0-9]*\)//g' \
104420 -e 's/__attribute_const__([ \t]|$)/\1/g' \
104421 -e 's@^#include <linux/compiler.h>@@' \
104422 -e 's/(^|[^a-zA-Z0-9])__packed([^a-zA-Z0-9_]|$)/\1__attribute__((packed))\2/g' \
104423 diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
104424 index 2dcb377..a82c500 100644
104425 --- a/scripts/link-vmlinux.sh
104426 +++ b/scripts/link-vmlinux.sh
104427 @@ -162,7 +162,7 @@ else
104428 fi;
104429
104430 # final build of init/
104431 -${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init
104432 +${MAKE} -f "${srctree}/scripts/Makefile.build" obj=init GCC_PLUGINS_CFLAGS="${GCC_PLUGINS_CFLAGS}" GCC_PLUGINS_AFLAGS="${GCC_PLUGINS_AFLAGS}"
104433
104434 kallsymso=""
104435 kallsyms_vmlinux=""
104436 diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
104437 index 25e5cb0..6e85821 100644
104438 --- a/scripts/mod/file2alias.c
104439 +++ b/scripts/mod/file2alias.c
104440 @@ -142,7 +142,7 @@ static void device_id_check(const char *modname, const char *device_id,
104441 unsigned long size, unsigned long id_size,
104442 void *symval)
104443 {
104444 - int i;
104445 + unsigned int i;
104446
104447 if (size % id_size || size < id_size) {
104448 fatal("%s: sizeof(struct %s_device_id)=%lu is not a modulo "
104449 @@ -170,7 +170,7 @@ static void device_id_check(const char *modname, const char *device_id,
104450 /* USB is special because the bcdDevice can be matched against a numeric range */
104451 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipNinN" */
104452 static void do_usb_entry(void *symval,
104453 - unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
104454 + unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
104455 unsigned char range_lo, unsigned char range_hi,
104456 unsigned char max, struct module *mod)
104457 {
104458 @@ -280,7 +280,7 @@ static void do_usb_entry_multi(void *symval, struct module *mod)
104459 {
104460 unsigned int devlo, devhi;
104461 unsigned char chi, clo, max;
104462 - int ndigits;
104463 + unsigned int ndigits;
104464
104465 DEF_FIELD(symval, usb_device_id, match_flags);
104466 DEF_FIELD(symval, usb_device_id, idVendor);
104467 @@ -533,7 +533,7 @@ static void do_pnp_device_entry(void *symval, unsigned long size,
104468 for (i = 0; i < count; i++) {
104469 DEF_FIELD_ADDR(symval + i*id_size, pnp_device_id, id);
104470 char acpi_id[sizeof(*id)];
104471 - int j;
104472 + unsigned int j;
104473
104474 buf_printf(&mod->dev_table_buf,
104475 "MODULE_ALIAS(\"pnp:d%s*\");\n", *id);
104476 @@ -562,7 +562,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
104477
104478 for (j = 0; j < PNP_MAX_DEVICES; j++) {
104479 const char *id = (char *)(*devs)[j].id;
104480 - int i2, j2;
104481 + unsigned int i2, j2;
104482 int dup = 0;
104483
104484 if (!id[0])
104485 @@ -588,7 +588,7 @@ static void do_pnp_card_entries(void *symval, unsigned long size,
104486 /* add an individual alias for every device entry */
104487 if (!dup) {
104488 char acpi_id[PNP_ID_LEN];
104489 - int k;
104490 + unsigned int k;
104491
104492 buf_printf(&mod->dev_table_buf,
104493 "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
104494 @@ -940,7 +940,7 @@ static void dmi_ascii_filter(char *d, const char *s)
104495 static int do_dmi_entry(const char *filename, void *symval,
104496 char *alias)
104497 {
104498 - int i, j;
104499 + unsigned int i, j;
104500 DEF_FIELD_ADDR(symval, dmi_system_id, matches);
104501 sprintf(alias, "dmi*");
104502
104503 diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
104504 index 99a45fd..4b995a3 100644
104505 --- a/scripts/mod/modpost.c
104506 +++ b/scripts/mod/modpost.c
104507 @@ -945,6 +945,7 @@ enum mismatch {
104508 ANY_INIT_TO_ANY_EXIT,
104509 ANY_EXIT_TO_ANY_INIT,
104510 EXPORT_TO_INIT_EXIT,
104511 + DATA_TO_TEXT
104512 };
104513
104514 struct sectioncheck {
104515 @@ -1031,6 +1032,12 @@ const struct sectioncheck sectioncheck[] = {
104516 .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
104517 .mismatch = EXPORT_TO_INIT_EXIT,
104518 .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
104519 +},
104520 +/* Do not reference code from writable data */
104521 +{
104522 + .fromsec = { DATA_SECTIONS, NULL },
104523 + .tosec = { TEXT_SECTIONS, NULL },
104524 + .mismatch = DATA_TO_TEXT
104525 }
104526 };
104527
104528 @@ -1151,10 +1158,10 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
104529 continue;
104530 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
104531 continue;
104532 - if (sym->st_value == addr)
104533 - return sym;
104534 /* Find a symbol nearby - addr are maybe negative */
104535 d = sym->st_value - addr;
104536 + if (d == 0)
104537 + return sym;
104538 if (d < 0)
104539 d = addr - sym->st_value;
104540 if (d < distance) {
104541 @@ -1432,6 +1439,14 @@ static void report_sec_mismatch(const char *modname,
104542 tosym, prl_to, prl_to, tosym);
104543 free(prl_to);
104544 break;
104545 + case DATA_TO_TEXT:
104546 +#if 0
104547 + fprintf(stderr,
104548 + "The %s %s:%s references\n"
104549 + "the %s %s:%s%s\n",
104550 + from, fromsec, fromsym, to, tosec, tosym, to_p);
104551 +#endif
104552 + break;
104553 }
104554 fprintf(stderr, "\n");
104555 }
104556 @@ -1679,7 +1694,7 @@ static void section_rel(const char *modname, struct elf_info *elf,
104557 static void check_sec_ref(struct module *mod, const char *modname,
104558 struct elf_info *elf)
104559 {
104560 - int i;
104561 + unsigned int i;
104562 Elf_Shdr *sechdrs = elf->sechdrs;
104563
104564 /* Walk through all sections */
104565 @@ -1798,7 +1813,7 @@ void __attribute__((format(printf, 2, 3))) buf_printf(struct buffer *buf,
104566 va_end(ap);
104567 }
104568
104569 -void buf_write(struct buffer *buf, const char *s, int len)
104570 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
104571 {
104572 if (buf->size - buf->pos < len) {
104573 buf->size += len + SZ;
104574 @@ -2017,7 +2032,7 @@ static void write_if_changed(struct buffer *b, const char *fname)
104575 if (fstat(fileno(file), &st) < 0)
104576 goto close_write;
104577
104578 - if (st.st_size != b->pos)
104579 + if (st.st_size != (off_t)b->pos)
104580 goto close_write;
104581
104582 tmp = NOFAIL(malloc(b->pos));
104583 diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
104584 index 51207e4..f7d603d 100644
104585 --- a/scripts/mod/modpost.h
104586 +++ b/scripts/mod/modpost.h
104587 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *expr);
104588
104589 struct buffer {
104590 char *p;
104591 - int pos;
104592 - int size;
104593 + unsigned int pos;
104594 + unsigned int size;
104595 };
104596
104597 void __attribute__((format(printf, 2, 3)))
104598 buf_printf(struct buffer *buf, const char *fmt, ...);
104599
104600 void
104601 -buf_write(struct buffer *buf, const char *s, int len);
104602 +buf_write(struct buffer *buf, const char *s, unsigned int len);
104603
104604 struct module {
104605 struct module *next;
104606 diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
104607 index deb2994..af4f63e 100644
104608 --- a/scripts/mod/sumversion.c
104609 +++ b/scripts/mod/sumversion.c
104610 @@ -470,7 +470,7 @@ static void write_version(const char *filename, const char *sum,
104611 goto out;
104612 }
104613
104614 - if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
104615 + if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
104616 warn("writing sum in %s failed: %s\n",
104617 filename, strerror(errno));
104618 goto out;
104619 diff --git a/scripts/module-common.lds b/scripts/module-common.lds
104620 index 0865b3e..7235dd4 100644
104621 --- a/scripts/module-common.lds
104622 +++ b/scripts/module-common.lds
104623 @@ -6,6 +6,10 @@
104624 SECTIONS {
104625 /DISCARD/ : { *(.discard) }
104626
104627 + .rodata : {
104628 + *(.rodata) *(.rodata.*)
104629 + *(.data..read_only)
104630 + }
104631 __ksymtab : { *(SORT(___ksymtab+*)) }
104632 __ksymtab_gpl : { *(SORT(___ksymtab_gpl+*)) }
104633 __ksymtab_unused : { *(SORT(___ksymtab_unused+*)) }
104634 diff --git a/scripts/package/builddeb b/scripts/package/builddeb
104635 index f46e4dd..090e168 100644
104636 --- a/scripts/package/builddeb
104637 +++ b/scripts/package/builddeb
104638 @@ -291,6 +291,7 @@ fi
104639 (cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
104640 (cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
104641 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
104642 +(cd $objtree; find tools/gcc -name \*.so >> "$objtree/debian/hdrobjfiles")
104643 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
104644 mkdir -p "$destdir"
104645 (cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
104646 diff --git a/scripts/pnmtologo.c b/scripts/pnmtologo.c
104647 index 68bb4ef..2f419e1 100644
104648 --- a/scripts/pnmtologo.c
104649 +++ b/scripts/pnmtologo.c
104650 @@ -244,14 +244,14 @@ static void write_header(void)
104651 fprintf(out, " * Linux logo %s\n", logoname);
104652 fputs(" */\n\n", out);
104653 fputs("#include <linux/linux_logo.h>\n\n", out);
104654 - fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
104655 + fprintf(out, "static unsigned char %s_data[] = {\n",
104656 logoname);
104657 }
104658
104659 static void write_footer(void)
104660 {
104661 fputs("\n};\n\n", out);
104662 - fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
104663 + fprintf(out, "const struct linux_logo %s = {\n", logoname);
104664 fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
104665 fprintf(out, "\t.width\t\t= %d,\n", logo_width);
104666 fprintf(out, "\t.height\t\t= %d,\n", logo_height);
104667 @@ -381,7 +381,7 @@ static void write_logo_clut224(void)
104668 fputs("\n};\n\n", out);
104669
104670 /* write logo clut */
104671 - fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
104672 + fprintf(out, "static unsigned char %s_clut[] = {\n",
104673 logoname);
104674 write_hex_cnt = 0;
104675 for (i = 0; i < logo_clutsize; i++) {
104676 diff --git a/scripts/sortextable.h b/scripts/sortextable.h
104677 index 8fac3fd..32ff38d 100644
104678 --- a/scripts/sortextable.h
104679 +++ b/scripts/sortextable.h
104680 @@ -108,9 +108,9 @@ do_func(Elf_Ehdr *ehdr, char const *const fname, table_sort_t custom_sort)
104681 const char *secstrtab;
104682 const char *strtab;
104683 char *extab_image;
104684 - int extab_index = 0;
104685 - int i;
104686 - int idx;
104687 + unsigned int extab_index = 0;
104688 + unsigned int i;
104689 + unsigned int idx;
104690 unsigned int num_sections;
104691 unsigned int secindex_strings;
104692
104693 diff --git a/security/Kconfig b/security/Kconfig
104694 index beb86b5..1ea5a01 100644
104695 --- a/security/Kconfig
104696 +++ b/security/Kconfig
104697 @@ -4,6 +4,960 @@
104698
104699 menu "Security options"
104700
104701 +menu "Grsecurity"
104702 +
104703 + config ARCH_TRACK_EXEC_LIMIT
104704 + bool
104705 +
104706 + config PAX_KERNEXEC_PLUGIN
104707 + bool
104708 +
104709 + config PAX_PER_CPU_PGD
104710 + bool
104711 +
104712 + config TASK_SIZE_MAX_SHIFT
104713 + int
104714 + depends on X86_64
104715 + default 47 if !PAX_PER_CPU_PGD
104716 + default 42 if PAX_PER_CPU_PGD
104717 +
104718 + config PAX_ENABLE_PAE
104719 + bool
104720 + default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
104721 +
104722 + config PAX_USERCOPY_SLABS
104723 + bool
104724 +
104725 +config GRKERNSEC
104726 + bool "Grsecurity"
104727 + select CRYPTO
104728 + select CRYPTO_SHA256
104729 + select PROC_FS
104730 + select STOP_MACHINE
104731 + select TTY
104732 + select DEBUG_KERNEL
104733 + select DEBUG_LIST
104734 + help
104735 + If you say Y here, you will be able to configure many features
104736 + that will enhance the security of your system. It is highly
104737 + recommended that you say Y here and read through the help
104738 + for each option so that you fully understand the features and
104739 + can evaluate their usefulness for your machine.
104740 +
104741 +choice
104742 + prompt "Configuration Method"
104743 + depends on GRKERNSEC
104744 + default GRKERNSEC_CONFIG_CUSTOM
104745 + help
104746 +
104747 +config GRKERNSEC_CONFIG_AUTO
104748 + bool "Automatic"
104749 + help
104750 + If you choose this configuration method, you'll be able to answer a small
104751 + number of simple questions about how you plan to use this kernel.
104752 + The settings of grsecurity and PaX will be automatically configured for
104753 + the highest commonly-used settings within the provided constraints.
104754 +
104755 + If you require additional configuration, custom changes can still be made
104756 + from the "custom configuration" menu.
104757 +
104758 +config GRKERNSEC_CONFIG_CUSTOM
104759 + bool "Custom"
104760 + help
104761 + If you choose this configuration method, you'll be able to configure all
104762 + grsecurity and PaX settings manually. Via this method, no options are
104763 + automatically enabled.
104764 +
104765 +endchoice
104766 +
104767 +choice
104768 + prompt "Usage Type"
104769 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
104770 + default GRKERNSEC_CONFIG_SERVER
104771 + help
104772 +
104773 +config GRKERNSEC_CONFIG_SERVER
104774 + bool "Server"
104775 + help
104776 + Choose this option if you plan to use this kernel on a server.
104777 +
104778 +config GRKERNSEC_CONFIG_DESKTOP
104779 + bool "Desktop"
104780 + help
104781 + Choose this option if you plan to use this kernel on a desktop.
104782 +
104783 +endchoice
104784 +
104785 +choice
104786 + prompt "Virtualization Type"
104787 + depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO)
104788 + default GRKERNSEC_CONFIG_VIRT_NONE
104789 + help
104790 +
104791 +config GRKERNSEC_CONFIG_VIRT_NONE
104792 + bool "None"
104793 + help
104794 + Choose this option if this kernel will be run on bare metal.
104795 +
104796 +config GRKERNSEC_CONFIG_VIRT_GUEST
104797 + bool "Guest"
104798 + help
104799 + Choose this option if this kernel will be run as a VM guest.
104800 +
104801 +config GRKERNSEC_CONFIG_VIRT_HOST
104802 + bool "Host"
104803 + help
104804 + Choose this option if this kernel will be run as a VM host.
104805 +
104806 +endchoice
104807 +
104808 +choice
104809 + prompt "Virtualization Hardware"
104810 + depends on (GRKERNSEC && X86 && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
104811 + help
104812 +
104813 +config GRKERNSEC_CONFIG_VIRT_EPT
104814 + bool "EPT/RVI Processor Support"
104815 + depends on X86
104816 + help
104817 + Choose this option if your CPU supports the EPT or RVI features of 2nd-gen
104818 + hardware virtualization. This allows for additional kernel hardening protections
104819 + to operate without additional performance impact.
104820 +
104821 + To see if your Intel processor supports EPT, see:
104822 + http://ark.intel.com/Products/VirtualizationTechnology
104823 + (Most Core i3/5/7 support EPT)
104824 +
104825 + To see if your AMD processor supports RVI, see:
104826 + http://support.amd.com/us/kbarticles/Pages/GPU120AMDRVICPUsHyperVWin8.aspx
104827 +
104828 +config GRKERNSEC_CONFIG_VIRT_SOFT
104829 + bool "First-gen/No Hardware Virtualization"
104830 + help
104831 + Choose this option if you use an Atom/Pentium/Core 2 processor that either doesn't
104832 + support hardware virtualization or doesn't support the EPT/RVI extensions.
104833 +
104834 +endchoice
104835 +
104836 +choice
104837 + prompt "Virtualization Software"
104838 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO && (GRKERNSEC_CONFIG_VIRT_GUEST || GRKERNSEC_CONFIG_VIRT_HOST))
104839 + help
104840 +
104841 +config GRKERNSEC_CONFIG_VIRT_XEN
104842 + bool "Xen"
104843 + help
104844 + Choose this option if this kernel is running as a Xen guest or host.
104845 +
104846 +config GRKERNSEC_CONFIG_VIRT_VMWARE
104847 + bool "VMWare"
104848 + help
104849 + Choose this option if this kernel is running as a VMWare guest or host.
104850 +
104851 +config GRKERNSEC_CONFIG_VIRT_KVM
104852 + bool "KVM"
104853 + help
104854 + Choose this option if this kernel is running as a KVM guest or host.
104855 +
104856 +config GRKERNSEC_CONFIG_VIRT_VIRTUALBOX
104857 + bool "VirtualBox"
104858 + help
104859 + Choose this option if this kernel is running as a VirtualBox guest or host.
104860 +
104861 +endchoice
104862 +
104863 +choice
104864 + prompt "Required Priorities"
104865 + depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
104866 + default GRKERNSEC_CONFIG_PRIORITY_PERF
104867 + help
104868 +
104869 +config GRKERNSEC_CONFIG_PRIORITY_PERF
104870 + bool "Performance"
104871 + help
104872 + Choose this option if performance is of highest priority for this deployment
104873 + of grsecurity. Features like UDEREF on a 64bit kernel, kernel stack clearing,
104874 + clearing of structures intended for userland, and freed memory sanitizing will
104875 + be disabled.
104876 +
104877 +config GRKERNSEC_CONFIG_PRIORITY_SECURITY
104878 + bool "Security"
104879 + help
104880 + Choose this option if security is of highest priority for this deployment of
104881 + grsecurity. UDEREF, kernel stack clearing, clearing of structures intended
104882 + for userland, and freed memory sanitizing will be enabled for this kernel.
104883 + In a worst-case scenario, these features can introduce a 20% performance hit
104884 + (UDEREF on x64 contributing half of this hit).
104885 +
104886 +endchoice
104887 +
104888 +menu "Default Special Groups"
104889 +depends on (GRKERNSEC && GRKERNSEC_CONFIG_AUTO)
104890 +
104891 +config GRKERNSEC_PROC_GID
104892 + int "GID exempted from /proc restrictions"
104893 + default 1001
104894 + help
104895 + Setting this GID determines which group will be exempted from
104896 + grsecurity's /proc restrictions, allowing users of the specified
104897 + group to view network statistics and the existence of other users'
104898 + processes on the system. This GID may also be chosen at boot time
104899 + via "grsec_proc_gid=" on the kernel commandline.
104900 +
104901 +config GRKERNSEC_TPE_UNTRUSTED_GID
104902 + int "GID for TPE-untrusted users"
104903 + depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
104904 + default 1005
104905 + help
104906 + Setting this GID determines which group untrusted users should
104907 + be added to. These users will be placed under grsecurity's Trusted Path
104908 + Execution mechanism, preventing them from executing their own binaries.
104909 + The users will only be able to execute binaries in directories owned and
104910 + writable only by the root user. If the sysctl option is enabled, a sysctl
104911 + option with name "tpe_gid" is created.
104912 +
104913 +config GRKERNSEC_TPE_TRUSTED_GID
104914 + int "GID for TPE-trusted users"
104915 + depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
104916 + default 1005
104917 + help
104918 + Setting this GID determines what group TPE restrictions will be
104919 + *disabled* for. If the sysctl option is enabled, a sysctl option
104920 + with name "tpe_gid" is created.
104921 +
104922 +config GRKERNSEC_SYMLINKOWN_GID
104923 + int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
104924 + depends on GRKERNSEC_CONFIG_SERVER
104925 + default 1006
104926 + help
104927 + Setting this GID determines what group kernel-enforced
104928 + SymlinksIfOwnerMatch will be enabled for. If the sysctl option
104929 + is enabled, a sysctl option with name "symlinkown_gid" is created.
104930 +
104931 +
104932 +endmenu
104933 +
104934 +menu "Customize Configuration"
104935 +depends on GRKERNSEC
104936 +
104937 +menu "PaX"
104938 +
104939 +config PAX
104940 + bool "Enable various PaX features"
104941 + default y if GRKERNSEC_CONFIG_AUTO
104942 + depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
104943 + help
104944 + This allows you to enable various PaX features. PaX adds
104945 + intrusion prevention mechanisms to the kernel that reduce
104946 + the risks posed by exploitable memory corruption bugs.
104947 +
104948 +menu "PaX Control"
104949 + depends on PAX
104950 +
104951 +config PAX_SOFTMODE
104952 + bool 'Support soft mode'
104953 + help
104954 + Enabling this option will allow you to run PaX in soft mode, that
104955 + is, PaX features will not be enforced by default, only on executables
104956 + marked explicitly. You must also enable PT_PAX_FLAGS or XATTR_PAX_FLAGS
104957 + support as they are the only way to mark executables for soft mode use.
104958 +
104959 + Soft mode can be activated by using the "pax_softmode=1" kernel command
104960 + line option on boot. Furthermore you can control various PaX features
104961 + at runtime via the entries in /proc/sys/kernel/pax.
104962 +
104963 +config PAX_EI_PAX
104964 + bool 'Use legacy ELF header marking'
104965 + default y if GRKERNSEC_CONFIG_AUTO
104966 + help
104967 + Enabling this option will allow you to control PaX features on
104968 + a per executable basis via the 'chpax' utility available at
104969 + http://pax.grsecurity.net/. The control flags will be read from
104970 + an otherwise reserved part of the ELF header. This marking has
104971 + numerous drawbacks (no support for soft-mode, toolchain does not
104972 + know about the non-standard use of the ELF header) therefore it
104973 + has been deprecated in favour of PT_PAX_FLAGS and XATTR_PAX_FLAGS
104974 + support.
104975 +
104976 + Note that if you enable PT_PAX_FLAGS or XATTR_PAX_FLAGS marking
104977 + support as well, they will override the legacy EI_PAX marks.
104978 +
104979 + If you enable none of the marking options then all applications
104980 + will run with PaX enabled on them by default.
104981 +
104982 +config PAX_PT_PAX_FLAGS
104983 + bool 'Use ELF program header marking'
104984 + default y if GRKERNSEC_CONFIG_AUTO
104985 + help
104986 + Enabling this option will allow you to control PaX features on
104987 + a per executable basis via the 'paxctl' utility available at
104988 + http://pax.grsecurity.net/. The control flags will be read from
104989 + a PaX specific ELF program header (PT_PAX_FLAGS). This marking
104990 + has the benefits of supporting both soft mode and being fully
104991 + integrated into the toolchain (the binutils patch is available
104992 + from http://pax.grsecurity.net).
104993 +
104994 + Note that if you enable the legacy EI_PAX marking support as well,
104995 + the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
104996 +
104997 + If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
104998 + must make sure that the marks are the same if a binary has both marks.
104999 +
105000 + If you enable none of the marking options then all applications
105001 + will run with PaX enabled on them by default.
105002 +
105003 +config PAX_XATTR_PAX_FLAGS
105004 + bool 'Use filesystem extended attributes marking'
105005 + default y if GRKERNSEC_CONFIG_AUTO
105006 + select CIFS_XATTR if CIFS
105007 + select EXT2_FS_XATTR if EXT2_FS
105008 + select EXT3_FS_XATTR if EXT3_FS
105009 + select JFFS2_FS_XATTR if JFFS2_FS
105010 + select REISERFS_FS_XATTR if REISERFS_FS
105011 + select SQUASHFS_XATTR if SQUASHFS
105012 + select TMPFS_XATTR if TMPFS
105013 + select UBIFS_FS_XATTR if UBIFS_FS
105014 + help
105015 + Enabling this option will allow you to control PaX features on
105016 + a per executable basis via the 'setfattr' utility. The control
105017 + flags will be read from the user.pax.flags extended attribute of
105018 + the file. This marking has the benefit of supporting binary-only
105019 + applications that self-check themselves (e.g., skype) and would
105020 + not tolerate chpax/paxctl changes. The main drawback is that
105021 + extended attributes are not supported by some filesystems (e.g.,
105022 + isofs, udf, vfat) so copying files through such filesystems will
105023 + lose the extended attributes and these PaX markings.
105024 +
105025 + Note that if you enable the legacy EI_PAX marking support as well,
105026 + the EI_PAX marks will be overridden by the XATTR_PAX_FLAGS marks.
105027 +
105028 + If you enable both PT_PAX_FLAGS and XATTR_PAX_FLAGS support then you
105029 + must make sure that the marks are the same if a binary has both marks.
105030 +
105031 + If you enable none of the marking options then all applications
105032 + will run with PaX enabled on them by default.
105033 +
105034 +choice
105035 + prompt 'MAC system integration'
105036 + default PAX_HAVE_ACL_FLAGS
105037 + help
105038 + Mandatory Access Control systems have the option of controlling
105039 + PaX flags on a per executable basis, choose the method supported
105040 + by your particular system.
105041 +
105042 + - "none": if your MAC system does not interact with PaX,
105043 + - "direct": if your MAC system defines pax_set_initial_flags() itself,
105044 + - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
105045 +
105046 + NOTE: this option is for developers/integrators only.
105047 +
105048 + config PAX_NO_ACL_FLAGS
105049 + bool 'none'
105050 +
105051 + config PAX_HAVE_ACL_FLAGS
105052 + bool 'direct'
105053 +
105054 + config PAX_HOOK_ACL_FLAGS
105055 + bool 'hook'
105056 +endchoice
105057 +
105058 +endmenu
105059 +
105060 +menu "Non-executable pages"
105061 + depends on PAX
105062 +
105063 +config PAX_NOEXEC
105064 + bool "Enforce non-executable pages"
105065 + default y if GRKERNSEC_CONFIG_AUTO
105066 + depends on ALPHA || (ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86
105067 + help
105068 + By design some architectures do not allow for protecting memory
105069 + pages against execution or even if they do, Linux does not make
105070 + use of this feature. In practice this means that if a page is
105071 + readable (such as the stack or heap) it is also executable.
105072 +
105073 + There is a well known exploit technique that makes use of this
105074 + fact and a common programming mistake where an attacker can
105075 + introduce code of his choice somewhere in the attacked program's
105076 + memory (typically the stack or the heap) and then execute it.
105077 +
105078 + If the attacked program was running with different (typically
105079 + higher) privileges than that of the attacker, then he can elevate
105080 + his own privilege level (e.g. get a root shell, write to files for
105081 + which he does not have write access to, etc).
105082 +
105083 + Enabling this option will let you choose from various features
105084 + that prevent the injection and execution of 'foreign' code in
105085 + a program.
105086 +
105087 + This will also break programs that rely on the old behaviour and
105088 + expect that dynamically allocated memory via the malloc() family
105089 + of functions is executable (which it is not). Notable examples
105090 + are the XFree86 4.x server, the java runtime and wine.
105091 +
105092 +config PAX_PAGEEXEC
105093 + bool "Paging based non-executable pages"
105094 + default y if GRKERNSEC_CONFIG_AUTO
105095 + depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
105096 + select ARCH_TRACK_EXEC_LIMIT if X86_32
105097 + help
105098 + This implementation is based on the paging feature of the CPU.
105099 + On i386 without hardware non-executable bit support there is a
105100 + variable but usually low performance impact, however on Intel's
105101 + P4 core based CPUs it is very high so you should not enable this
105102 + for kernels meant to be used on such CPUs.
105103 +
105104 + On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
105105 + with hardware non-executable bit support there is no performance
105106 + impact, on ppc the impact is negligible.
105107 +
105108 + Note that several architectures require various emulations due to
105109 + badly designed userland ABIs, this will cause a performance impact
105110 + but will disappear as soon as userland is fixed. For example, ppc
105111 + userland MUST have been built with secure-plt by a recent toolchain.
105112 +
105113 +config PAX_SEGMEXEC
105114 + bool "Segmentation based non-executable pages"
105115 + default y if GRKERNSEC_CONFIG_AUTO
105116 + depends on PAX_NOEXEC && X86_32
105117 + help
105118 + This implementation is based on the segmentation feature of the
105119 + CPU and has a very small performance impact, however applications
105120 + will be limited to a 1.5 GB address space instead of the normal
105121 + 3 GB.
105122 +
105123 +config PAX_EMUTRAMP
105124 + bool "Emulate trampolines"
105125 + default y if PARISC || GRKERNSEC_CONFIG_AUTO
105126 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
105127 + help
105128 + There are some programs and libraries that for one reason or
105129 + another attempt to execute special small code snippets from
105130 + non-executable memory pages. Most notable examples are the
105131 + signal handler return code generated by the kernel itself and
105132 + the GCC trampolines.
105133 +
105134 + If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
105135 + such programs will no longer work under your kernel.
105136 +
105137 + As a remedy you can say Y here and use the 'chpax' or 'paxctl'
105138 + utilities to enable trampoline emulation for the affected programs
105139 + yet still have the protection provided by the non-executable pages.
105140 +
105141 + On parisc you MUST enable this option and EMUSIGRT as well, otherwise
105142 + your system will not even boot.
105143 +
105144 + Alternatively you can say N here and use the 'chpax' or 'paxctl'
105145 + utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
105146 + for the affected files.
105147 +
105148 + NOTE: enabling this feature *may* open up a loophole in the
105149 + protection provided by non-executable pages that an attacker
105150 + could abuse. Therefore the best solution is to not have any
105151 + files on your system that would require this option. This can
105152 + be achieved by not using libc5 (which relies on the kernel
105153 + signal handler return code) and not using or rewriting programs
105154 + that make use of the nested function implementation of GCC.
105155 + Skilled users can just fix GCC itself so that it implements
105156 + nested function calls in a way that does not interfere with PaX.
105157 +
105158 +config PAX_EMUSIGRT
105159 + bool "Automatically emulate sigreturn trampolines"
105160 + depends on PAX_EMUTRAMP && PARISC
105161 + default y
105162 + help
105163 + Enabling this option will have the kernel automatically detect
105164 + and emulate signal return trampolines executing on the stack
105165 + that would otherwise lead to task termination.
105166 +
105167 + This solution is intended as a temporary one for users with
105168 + legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
105169 + Modula-3 runtime, etc) or executables linked to such, basically
105170 + everything that does not specify its own SA_RESTORER function in
105171 + normal executable memory like glibc 2.1+ does.
105172 +
105173 + On parisc you MUST enable this option, otherwise your system will
105174 + not even boot.
105175 +
105176 + NOTE: this feature cannot be disabled on a per executable basis
105177 + and since it *does* open up a loophole in the protection provided
105178 + by non-executable pages, the best solution is to not have any
105179 + files on your system that would require this option.
105180 +
105181 +config PAX_MPROTECT
105182 + bool "Restrict mprotect()"
105183 + default y if GRKERNSEC_CONFIG_AUTO
105184 + depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
105185 + help
105186 + Enabling this option will prevent programs from
105187 + - changing the executable status of memory pages that were
105188 + not originally created as executable,
105189 + - making read-only executable pages writable again,
105190 + - creating executable pages from anonymous memory,
105191 + - making read-only-after-relocations (RELRO) data pages writable again.
105192 +
105193 + You should say Y here to complete the protection provided by
105194 + the enforcement of non-executable pages.
105195 +
105196 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
105197 + this feature on a per file basis.
105198 +
105199 +config PAX_MPROTECT_COMPAT
105200 + bool "Use legacy/compat protection demoting (read help)"
105201 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
105202 + depends on PAX_MPROTECT
105203 + help
105204 + The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
105205 + by sending the proper error code to the application. For some broken
105206 + userland, this can cause problems with Python or other applications. The
105207 + current implementation however allows for applications like clamav to
105208 + detect if JIT compilation/execution is allowed and to fall back gracefully
105209 + to an interpreter-based mode if it does not. While we encourage everyone
105210 + to use the current implementation as-is and push upstream to fix broken
105211 + userland (note that the RWX logging option can assist with this), in some
105212 + environments this may not be possible. Having to disable MPROTECT
105213 + completely on certain binaries reduces the security benefit of PaX,
105214 + so this option is provided for those environments to revert to the old
105215 + behavior.
105216 +
105217 +config PAX_ELFRELOCS
105218 + bool "Allow ELF text relocations (read help)"
105219 + depends on PAX_MPROTECT
105220 + default n
105221 + help
105222 + Non-executable pages and mprotect() restrictions are effective
105223 + in preventing the introduction of new executable code into an
105224 + attacked task's address space. There remain only two venues
105225 + for this kind of attack: if the attacker can execute already
105226 + existing code in the attacked task then he can either have it
105227 + create and mmap() a file containing his code or have it mmap()
105228 + an already existing ELF library that does not have position
105229 + independent code in it and use mprotect() on it to make it
105230 + writable and copy his code there. While protecting against
105231 + the former approach is beyond PaX, the latter can be prevented
105232 + by having only PIC ELF libraries on one's system (which do not
105233 + need to relocate their code). If you are sure this is your case,
105234 + as is the case with all modern Linux distributions, then leave
105235 + this option disabled. You should say 'n' here.
105236 +
105237 +config PAX_ETEXECRELOCS
105238 + bool "Allow ELF ET_EXEC text relocations"
105239 + depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
105240 + select PAX_ELFRELOCS
105241 + default y
105242 + help
105243 + On some architectures there are incorrectly created applications
105244 + that require text relocations and would not work without enabling
105245 + this option. If you are an alpha, ia64 or parisc user, you should
105246 + enable this option and disable it once you have made sure that
105247 + none of your applications need it.
105248 +
105249 +config PAX_EMUPLT
105250 + bool "Automatically emulate ELF PLT"
105251 + depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
105252 + default y
105253 + help
105254 + Enabling this option will have the kernel automatically detect
105255 + and emulate the Procedure Linkage Table entries in ELF files.
105256 + On some architectures such entries are in writable memory, and
105257 + become non-executable leading to task termination. Therefore
105258 + it is mandatory that you enable this option on alpha, parisc,
105259 + sparc and sparc64, otherwise your system would not even boot.
105260 +
105261 + NOTE: this feature *does* open up a loophole in the protection
105262 + provided by the non-executable pages, therefore the proper
105263 + solution is to modify the toolchain to produce a PLT that does
105264 + not need to be writable.
105265 +
105266 +config PAX_DLRESOLVE
105267 + bool 'Emulate old glibc resolver stub'
105268 + depends on PAX_EMUPLT && SPARC
105269 + default n
105270 + help
105271 + This option is needed if userland has an old glibc (before 2.4)
105272 + that puts a 'save' instruction into the runtime generated resolver
105273 + stub that needs special emulation.
105274 +
105275 +config PAX_KERNEXEC
105276 + bool "Enforce non-executable kernel pages"
105277 + default y if GRKERNSEC_CONFIG_AUTO && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_GUEST) || (GRKERNSEC_CONFIG_VIRT_EPT && GRKERNSEC_CONFIG_VIRT_KVM))
105278 + depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !(ARM_LPAE && MODULES))) && !XEN
105279 + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
105280 + select PAX_KERNEXEC_PLUGIN if X86_64
105281 + help
105282 + This is the kernel land equivalent of PAGEEXEC and MPROTECT,
105283 + that is, enabling this option will make it harder to inject
105284 + and execute 'foreign' code in kernel memory itself.
105285 +
105286 +choice
105287 + prompt "Return Address Instrumentation Method"
105288 + default PAX_KERNEXEC_PLUGIN_METHOD_BTS
105289 + depends on PAX_KERNEXEC_PLUGIN
105290 + help
105291 + Select the method used to instrument function pointer dereferences.
105292 + Note that binary modules cannot be instrumented by this approach.
105293 +
105294 + Note that the implementation requires a gcc with plugin support,
105295 + i.e., gcc 4.5 or newer. You may need to install the supporting
105296 + headers explicitly in addition to the normal gcc package.
105297 +
105298 + config PAX_KERNEXEC_PLUGIN_METHOD_BTS
105299 + bool "bts"
105300 + help
105301 + This method is compatible with binary only modules but has
105302 + a higher runtime overhead.
105303 +
105304 + config PAX_KERNEXEC_PLUGIN_METHOD_OR
105305 + bool "or"
105306 + depends on !PARAVIRT
105307 + help
105308 + This method is incompatible with binary only modules but has
105309 + a lower runtime overhead.
105310 +endchoice
105311 +
105312 +config PAX_KERNEXEC_PLUGIN_METHOD
105313 + string
105314 + default "bts" if PAX_KERNEXEC_PLUGIN_METHOD_BTS
105315 + default "or" if PAX_KERNEXEC_PLUGIN_METHOD_OR
105316 + default ""
105317 +
105318 +config PAX_KERNEXEC_MODULE_TEXT
105319 + int "Minimum amount of memory reserved for module code"
105320 + default "4" if (!GRKERNSEC_CONFIG_AUTO || GRKERNSEC_CONFIG_SERVER)
105321 + default "12" if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_DESKTOP)
105322 + depends on PAX_KERNEXEC && X86_32
105323 + help
105324 + Due to implementation details the kernel must reserve a fixed
105325 + amount of memory for runtime allocated code (such as modules)
105326 + at compile time that cannot be changed at runtime. Here you
105327 + can specify the minimum amount in MB that will be reserved.
105328 + Due to the same implementation details this size will always
105329 + be rounded up to the next 2/4 MB boundary (depends on PAE) so
105330 + the actually available memory for runtime allocated code will
105331 + usually be more than this minimum.
105332 +
105333 + The default 4 MB should be enough for most users but if you have
105334 + an excessive number of modules (e.g., most distribution configs
105335 + compile many drivers as modules) or use huge modules such as
105336 + nvidia's kernel driver, you will need to adjust this amount.
105337 + A good rule of thumb is to look at your currently loaded kernel
105338 + modules and add up their sizes.
105339 +
105340 +endmenu
105341 +
105342 +menu "Address Space Layout Randomization"
105343 + depends on PAX
105344 +
105345 +config PAX_ASLR
105346 + bool "Address Space Layout Randomization"
105347 + default y if GRKERNSEC_CONFIG_AUTO
105348 + help
105349 + Many if not most exploit techniques rely on the knowledge of
105350 + certain addresses in the attacked program. The following options
105351 + will allow the kernel to apply a certain amount of randomization
105352 + to specific parts of the program thereby forcing an attacker to
105353 + guess them in most cases. Any failed guess will most likely crash
105354 + the attacked program which allows the kernel to detect such attempts
105355 + and react on them. PaX itself provides no reaction mechanisms,
105356 + instead it is strongly encouraged that you make use of Nergal's
105357 + segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
105358 + (http://www.grsecurity.net/) built-in crash detection features or
105359 + develop one yourself.
105360 +
105361 + By saying Y here you can choose to randomize the following areas:
105362 + - top of the task's kernel stack
105363 + - top of the task's userland stack
105364 + - base address for mmap() requests that do not specify one
105365 + (this includes all libraries)
105366 + - base address of the main executable
105367 +
105368 + It is strongly recommended to say Y here as address space layout
105369 + randomization has negligible impact on performance yet it provides
105370 + a very effective protection.
105371 +
105372 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control
105373 + this feature on a per file basis.
105374 +
105375 +config PAX_RANDKSTACK
105376 + bool "Randomize kernel stack base"
105377 + default y if GRKERNSEC_CONFIG_AUTO && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_VIRTUALBOX)
105378 + depends on X86_TSC && X86
105379 + help
105380 + By saying Y here the kernel will randomize every task's kernel
105381 + stack on every system call. This will not only force an attacker
105382 + to guess it but also prevent him from making use of possible
105383 + leaked information about it.
105384 +
105385 + Since the kernel stack is a rather scarce resource, randomization
105386 + may cause unexpected stack overflows, therefore you should very
105387 + carefully test your system. Note that once enabled in the kernel
105388 + configuration, this feature cannot be disabled on a per file basis.
105389 +
105390 +config PAX_RANDUSTACK
105391 + bool "Randomize user stack base"
105392 + default y if GRKERNSEC_CONFIG_AUTO
105393 + depends on PAX_ASLR
105394 + help
105395 + By saying Y here the kernel will randomize every task's userland
105396 + stack. The randomization is done in two steps where the second
105397 + one may apply a big amount of shift to the top of the stack and
105398 + cause problems for programs that want to use lots of memory (more
105399 + than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
105400 + For this reason the second step can be controlled by 'chpax' or
105401 + 'paxctl' on a per file basis.
105402 +
105403 +config PAX_RANDMMAP
105404 + bool "Randomize mmap() base"
105405 + default y if GRKERNSEC_CONFIG_AUTO
105406 + depends on PAX_ASLR
105407 + help
105408 + By saying Y here the kernel will use a randomized base address for
105409 + mmap() requests that do not specify one themselves. As a result
105410 + all dynamically loaded libraries will appear at random addresses
105411 + and therefore be harder to exploit by a technique where an attacker
105412 + attempts to execute library code for his purposes (e.g. spawn a
105413 + shell from an exploited program that is running at an elevated
105414 + privilege level).
105415 +
105416 + Furthermore, if a program is relinked as a dynamic ELF file, its
105417 + base address will be randomized as well, completing the full
105418 + randomization of the address space layout. Attacking such programs
105419 + becomes a guess game. You can find an example of doing this at
105420 + http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
105421 + http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
105422 +
105423 + NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
105424 + feature on a per file basis.
105425 +
105426 +endmenu
105427 +
105428 +menu "Miscellaneous hardening features"
105429 +
105430 +config PAX_MEMORY_SANITIZE
105431 + bool "Sanitize all freed memory"
105432 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
105433 + help
105434 + By saying Y here the kernel will erase memory pages and slab objects
105435 + as soon as they are freed. This in turn reduces the lifetime of data
105436 + stored in them, making it less likely that sensitive information such
105437 + as passwords, cryptographic secrets, etc stay in memory for too long.
105438 +
105439 + This is especially useful for programs whose runtime is short, long
105440 + lived processes and the kernel itself benefit from this as long as
105441 + they ensure timely freeing of memory that may hold sensitive
105442 + information.
105443 +
105444 + A nice side effect of the sanitization of slab objects is the
105445 + reduction of possible info leaks caused by padding bytes within the
105446 + leaky structures. Use-after-free bugs for structures containing
105447 + pointers can also be detected as dereferencing the sanitized pointer
105448 + will generate an access violation.
105449 +
105450 + The tradeoff is performance impact, on a single CPU system kernel
105451 + compilation sees a 3% slowdown, other systems and workloads may vary
105452 + and you are advised to test this feature on your expected workload
105453 + before deploying it.
105454 +
105455 + To reduce the performance penalty by sanitizing pages only, albeit
105456 + limiting the effectiveness of this feature at the same time, slab
105457 + sanitization can be disabled with the kernel commandline parameter
105458 + "pax_sanitize_slab=0".
105459 +
105460 + Note that this feature does not protect data stored in live pages,
105461 + e.g., process memory swapped to disk may stay there for a long time.
105462 +
105463 +config PAX_MEMORY_STACKLEAK
105464 + bool "Sanitize kernel stack"
105465 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
105466 + depends on X86
105467 + help
105468 + By saying Y here the kernel will erase the kernel stack before it
105469 + returns from a system call. This in turn reduces the information
105470 + that a kernel stack leak bug can reveal.
105471 +
105472 + Note that such a bug can still leak information that was put on
105473 + the stack by the current system call (the one eventually triggering
105474 + the bug) but traces of earlier system calls on the kernel stack
105475 + cannot leak anymore.
105476 +
105477 + The tradeoff is performance impact: on a single CPU system kernel
105478 + compilation sees a 1% slowdown, other systems and workloads may vary
105479 + and you are advised to test this feature on your expected workload
105480 + before deploying it.
105481 +
105482 + Note that the full feature requires a gcc with plugin support,
105483 + i.e., gcc 4.5 or newer. You may need to install the supporting
105484 + headers explicitly in addition to the normal gcc package. Using
105485 + older gcc versions means that functions with large enough stack
105486 + frames may leave uninitialized memory behind that may be exposed
105487 + to a later syscall leaking the stack.
105488 +
105489 +config PAX_MEMORY_STRUCTLEAK
105490 + bool "Forcibly initialize local variables copied to userland"
105491 + default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
105492 + help
105493 + By saying Y here the kernel will zero initialize some local
105494 + variables that are going to be copied to userland. This in
105495 + turn prevents unintended information leakage from the kernel
105496 + stack should later code forget to explicitly set all parts of
105497 + the copied variable.
105498 +
105499 + The tradeoff is less performance impact than PAX_MEMORY_STACKLEAK
105500 + at a much smaller coverage.
105501 +
105502 + Note that the implementation requires a gcc with plugin support,
105503 + i.e., gcc 4.5 or newer. You may need to install the supporting
105504 + headers explicitly in addition to the normal gcc package.
105505 +
105506 +config PAX_MEMORY_UDEREF
105507 + bool "Prevent invalid userland pointer dereference"
105508 + default y if GRKERNSEC_CONFIG_AUTO && !(X86_64 && GRKERNSEC_CONFIG_PRIORITY_PERF) && (!X86 || GRKERNSEC_CONFIG_VIRT_NONE || GRKERNSEC_CONFIG_VIRT_EPT)
105509 + depends on (X86 || (ARM && (CPU_V6 || CPU_V6K || CPU_V7) && !ARM_LPAE)) && !UML_X86 && !XEN
105510 + select PAX_PER_CPU_PGD if X86_64
105511 + help
105512 + By saying Y here the kernel will be prevented from dereferencing
105513 + userland pointers in contexts where the kernel expects only kernel
105514 + pointers. This is both a useful runtime debugging feature and a
105515 + security measure that prevents exploiting a class of kernel bugs.
105516 +
105517 + The tradeoff is that some virtualization solutions may experience
105518 + a huge slowdown and therefore you should not enable this feature
105519 + for kernels meant to run in such environments. Whether a given VM
105520 + solution is affected or not is best determined by simply trying it
105521 + out, the performance impact will be obvious right on boot as this
105522 + mechanism engages from very early on. A good rule of thumb is that
105523 + VMs running on CPUs without hardware virtualization support (i.e.,
105524 + the majority of IA-32 CPUs) will likely experience the slowdown.
105525 +
105526 + On X86_64 the kernel will make use of PCID support when available
105527 + (Intel's Westmere, Sandy Bridge, etc) for better security (default)
105528 + or performance impact. Pass pax_weakuderef on the kernel command
105529 + line to choose the latter.
105530 +
105531 +config PAX_REFCOUNT
105532 + bool "Prevent various kernel object reference counter overflows"
105533 + default y if GRKERNSEC_CONFIG_AUTO
105534 + depends on GRKERNSEC && ((ARM && (CPU_V6 || CPU_V6K || CPU_V7)) || MIPS || SPARC64 || X86)
105535 + help
105536 + By saying Y here the kernel will detect and prevent overflowing
105537 + various (but not all) kinds of object reference counters. Such
105538 + overflows can normally occur due to bugs only and are often, if
105539 + not always, exploitable.
105540 +
105541 + The tradeoff is that data structures protected by an overflowed
105542 + refcount will never be freed and therefore will leak memory. Note
105543 + that this leak also happens even without this protection but in
105544 + that case the overflow can eventually trigger the freeing of the
105545 + data structure while it is still being used elsewhere, resulting
105546 + in the exploitable situation that this feature prevents.
105547 +
105548 + Since this has a negligible performance impact, you should enable
105549 + this feature.
105550 +
105551 +config PAX_CONSTIFY_PLUGIN
105552 + bool "Automatically constify eligible structures"
105553 + default y
105554 + depends on !UML && PAX_KERNEXEC
105555 + help
105556 + By saying Y here the compiler will automatically constify a class
105557 + of types that contain only function pointers. This reduces the
105558 + kernel's attack surface and also produces a better memory layout.
105559 +
105560 + Note that the implementation requires a gcc with plugin support,
105561 + i.e., gcc 4.5 or newer. You may need to install the supporting
105562 + headers explicitly in addition to the normal gcc package.
105563 +
105564 + Note that if some code really has to modify constified variables
105565 + then the source code will have to be patched to allow it. Examples
105566 + can be found in PaX itself (the no_const attribute) and for some
105567 + out-of-tree modules at http://www.grsecurity.net/~paxguy1/ .
105568 +
105569 +config PAX_USERCOPY
105570 + bool "Harden heap object copies between kernel and userland"
105571 + default y if GRKERNSEC_CONFIG_AUTO
105572 + depends on ARM || IA64 || PPC || SPARC || X86
105573 + depends on GRKERNSEC && (SLAB || SLUB || SLOB)
105574 + select PAX_USERCOPY_SLABS
105575 + help
105576 + By saying Y here the kernel will enforce the size of heap objects
105577 + when they are copied in either direction between the kernel and
105578 + userland, even if only a part of the heap object is copied.
105579 +
105580 + Specifically, this checking prevents information leaking from the
105581 + kernel heap during kernel to userland copies (if the kernel heap
105582 + object is otherwise fully initialized) and prevents kernel heap
105583 + overflows during userland to kernel copies.
105584 +
105585 + Note that the current implementation provides the strictest bounds
105586 + checks for the SLUB allocator.
105587 +
105588 + Enabling this option also enables per-slab cache protection against
105589 + data in a given cache being copied into/out of via userland
105590 + accessors. Though the whitelist of regions will be reduced over
105591 + time, it notably protects important data structures like task structs.
105592 +
105593 + If frame pointers are enabled on x86, this option will also restrict
105594 + copies into and out of the kernel stack to local variables within a
105595 + single frame.
105596 +
105597 + Since this has a negligible performance impact, you should enable
105598 + this feature.
105599 +
105600 +config PAX_USERCOPY_DEBUG
105601 + bool
105602 + depends on X86 && PAX_USERCOPY
105603 + default n
105604 +
105605 +config PAX_SIZE_OVERFLOW
105606 + bool "Prevent various integer overflows in function size parameters"
105607 + default y if GRKERNSEC_CONFIG_AUTO
105608 + depends on X86
105609 + help
105610 + By saying Y here the kernel recomputes expressions of function
105611 + arguments marked by a size_overflow attribute with double integer
105612 + precision (DImode/TImode for 32/64 bit integer types).
105613 +
105614 + The recomputed argument is checked against TYPE_MAX and an event
105615 + is logged on overflow and the triggering process is killed.
105616 +
105617 + Homepage: http://www.grsecurity.net/~ephox/overflow_plugin/
105618 +
105619 + Note that the implementation requires a gcc with plugin support,
105620 + i.e., gcc 4.5 or newer. You may need to install the supporting
105621 + headers explicitly in addition to the normal gcc package.
105622 +
105623 +config PAX_LATENT_ENTROPY
105624 + bool "Generate some entropy during boot and runtime"
105625 + default y if GRKERNSEC_CONFIG_AUTO
105626 + help
105627 + By saying Y here the kernel will instrument some kernel code to
105628 + extract some entropy from both original and artificially created
105629 + program state. This will help especially embedded systems where
105630 + there is little 'natural' source of entropy normally. The cost
105631 + is some slowdown of the boot process and fork and irq processing.
105632 +
105633 + When pax_extra_latent_entropy is passed on the kernel command line,
105634 + entropy will be extracted from up to the first 4GB of RAM while the
105635 + runtime memory allocator is being initialized. This costs even more
105636 + slowdown of the boot process.
105637 +
105638 + Note that the implementation requires a gcc with plugin support,
105639 + i.e., gcc 4.5 or newer. You may need to install the supporting
105640 + headers explicitly in addition to the normal gcc package.
105641 +
105642 + Note that entropy extracted this way is not cryptographically
105643 + secure!
105644 +
105645 +endmenu
105646 +
105647 +endmenu
105648 +
105649 +source grsecurity/Kconfig
105650 +
105651 +endmenu
105652 +
105653 +endmenu
105654 +
105655 source security/keys/Kconfig
105656
105657 config SECURITY_DMESG_RESTRICT
105658 @@ -103,7 +1057,7 @@ config INTEL_TXT
105659 config LSM_MMAP_MIN_ADDR
105660 int "Low address space for LSM to protect from user allocation"
105661 depends on SECURITY && SECURITY_SELINUX
105662 - default 32768 if ARM || (ARM64 && COMPAT)
105663 + default 32768 if ALPHA || ARM || (ARM64 && COMPAT) || PARISC || SPARC32
105664 default 65536
105665 help
105666 This is the portion of low virtual memory which should be protected
105667 diff --git a/security/apparmor/file.c b/security/apparmor/file.c
105668 index fdaa50c..2761dcb 100644
105669 --- a/security/apparmor/file.c
105670 +++ b/security/apparmor/file.c
105671 @@ -348,8 +348,8 @@ static inline bool xindex_is_subset(u32 link, u32 target)
105672 int aa_path_link(struct aa_profile *profile, struct dentry *old_dentry,
105673 struct path *new_dir, struct dentry *new_dentry)
105674 {
105675 - struct path link = { new_dir->mnt, new_dentry };
105676 - struct path target = { new_dir->mnt, old_dentry };
105677 + struct path link = { .mnt = new_dir->mnt, .dentry = new_dentry };
105678 + struct path target = { .mnt = new_dir->mnt, .dentry = old_dentry };
105679 struct path_cond cond = {
105680 old_dentry->d_inode->i_uid,
105681 old_dentry->d_inode->i_mode
105682 diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
105683 index 4257b7e..2d0732d 100644
105684 --- a/security/apparmor/lsm.c
105685 +++ b/security/apparmor/lsm.c
105686 @@ -186,7 +186,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
105687 struct dentry *dentry, u32 mask,
105688 struct path_cond *cond)
105689 {
105690 - struct path path = { dir->mnt, dentry };
105691 + struct path path = { .mnt = dir->mnt, .dentry = dentry };
105692
105693 return common_perm(op, &path, mask, cond);
105694 }
105695 @@ -203,7 +203,7 @@ static int common_perm_dir_dentry(int op, struct path *dir,
105696 static int common_perm_mnt_dentry(int op, struct vfsmount *mnt,
105697 struct dentry *dentry, u32 mask)
105698 {
105699 - struct path path = { mnt, dentry };
105700 + struct path path = { .mnt = mnt, .dentry = dentry };
105701 struct path_cond cond = { dentry->d_inode->i_uid,
105702 dentry->d_inode->i_mode
105703 };
105704 @@ -325,8 +325,8 @@ static int apparmor_path_rename(struct path *old_dir, struct dentry *old_dentry,
105705
105706 profile = aa_current_profile();
105707 if (!unconfined(profile)) {
105708 - struct path old_path = { old_dir->mnt, old_dentry };
105709 - struct path new_path = { new_dir->mnt, new_dentry };
105710 + struct path old_path = { .mnt = old_dir->mnt, .dentry = old_dentry };
105711 + struct path new_path = { .mnt = new_dir->mnt, .dentry = new_dentry };
105712 struct path_cond cond = { old_dentry->d_inode->i_uid,
105713 old_dentry->d_inode->i_mode
105714 };
105715 @@ -615,7 +615,7 @@ static int apparmor_task_setrlimit(struct task_struct *task,
105716 return error;
105717 }
105718
105719 -static struct security_operations apparmor_ops = {
105720 +static struct security_operations apparmor_ops __read_only = {
105721 .name = "apparmor",
105722
105723 .ptrace_access_check = apparmor_ptrace_access_check,
105724 diff --git a/security/commoncap.c b/security/commoncap.c
105725 index b9d613e..f68305c 100644
105726 --- a/security/commoncap.c
105727 +++ b/security/commoncap.c
105728 @@ -424,6 +424,32 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
105729 return 0;
105730 }
105731
105732 +/* returns:
105733 + 1 for suid privilege
105734 + 2 for sgid privilege
105735 + 3 for fscap privilege
105736 +*/
105737 +int is_privileged_binary(const struct dentry *dentry)
105738 +{
105739 + struct cpu_vfs_cap_data capdata;
105740 + struct inode *inode = dentry->d_inode;
105741 +
105742 + if (!inode || S_ISDIR(inode->i_mode))
105743 + return 0;
105744 +
105745 + if (inode->i_mode & S_ISUID)
105746 + return 1;
105747 + if ((inode->i_mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
105748 + return 2;
105749 +
105750 + if (!get_vfs_caps_from_disk(dentry, &capdata)) {
105751 + if (!cap_isclear(capdata.inheritable) || !cap_isclear(capdata.permitted))
105752 + return 3;
105753 + }
105754 +
105755 + return 0;
105756 +}
105757 +
105758 /*
105759 * Attempt to get the on-exec apply capability sets for an executable file from
105760 * its xattrs and, if present, apply them to the proposed credentials being
105761 @@ -592,6 +618,9 @@ int cap_bprm_secureexec(struct linux_binprm *bprm)
105762 const struct cred *cred = current_cred();
105763 kuid_t root_uid = make_kuid(cred->user_ns, 0);
105764
105765 + if (gr_acl_enable_at_secure())
105766 + return 1;
105767 +
105768 if (!uid_eq(cred->uid, root_uid)) {
105769 if (bprm->cap_effective)
105770 return 1;
105771 diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
105772 index f79fa8b..6161868 100644
105773 --- a/security/integrity/ima/ima.h
105774 +++ b/security/integrity/ima/ima.h
105775 @@ -118,8 +118,8 @@ int ima_init_template(void);
105776 extern spinlock_t ima_queue_lock;
105777
105778 struct ima_h_table {
105779 - atomic_long_t len; /* number of stored measurements in the list */
105780 - atomic_long_t violations;
105781 + atomic_long_unchecked_t len; /* number of stored measurements in the list */
105782 + atomic_long_unchecked_t violations;
105783 struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
105784 };
105785 extern struct ima_h_table ima_htable;
105786 diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
105787 index c38bbce..f45133d 100644
105788 --- a/security/integrity/ima/ima_api.c
105789 +++ b/security/integrity/ima/ima_api.c
105790 @@ -137,7 +137,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
105791 int result;
105792
105793 /* can overflow, only indicator */
105794 - atomic_long_inc(&ima_htable.violations);
105795 + atomic_long_inc_unchecked(&ima_htable.violations);
105796
105797 result = ima_alloc_init_template(NULL, file, filename,
105798 NULL, 0, &entry);
105799 diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
105800 index 468a3ba..9af5cae 100644
105801 --- a/security/integrity/ima/ima_fs.c
105802 +++ b/security/integrity/ima/ima_fs.c
105803 @@ -28,12 +28,12 @@
105804 static int valid_policy = 1;
105805 #define TMPBUFLEN 12
105806 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
105807 - loff_t *ppos, atomic_long_t *val)
105808 + loff_t *ppos, atomic_long_unchecked_t *val)
105809 {
105810 char tmpbuf[TMPBUFLEN];
105811 ssize_t len;
105812
105813 - len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
105814 + len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
105815 return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
105816 }
105817
105818 diff --git a/security/integrity/ima/ima_queue.c b/security/integrity/ima/ima_queue.c
105819 index d85e997..6992813 100644
105820 --- a/security/integrity/ima/ima_queue.c
105821 +++ b/security/integrity/ima/ima_queue.c
105822 @@ -80,7 +80,7 @@ static int ima_add_digest_entry(struct ima_template_entry *entry)
105823 INIT_LIST_HEAD(&qe->later);
105824 list_add_tail_rcu(&qe->later, &ima_measurements);
105825
105826 - atomic_long_inc(&ima_htable.len);
105827 + atomic_long_inc_unchecked(&ima_htable.len);
105828 key = ima_hash_key(entry->digest);
105829 hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
105830 return 0;
105831 diff --git a/security/keys/compat.c b/security/keys/compat.c
105832 index bbd32c7..c60c927 100644
105833 --- a/security/keys/compat.c
105834 +++ b/security/keys/compat.c
105835 @@ -44,7 +44,7 @@ static long compat_keyctl_instantiate_key_iov(
105836 if (ret == 0)
105837 goto no_payload_free;
105838
105839 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
105840 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
105841 err:
105842 if (iov != iovstack)
105843 kfree(iov);
105844 diff --git a/security/keys/internal.h b/security/keys/internal.h
105845 index 80b2aac..bb7ee65 100644
105846 --- a/security/keys/internal.h
105847 +++ b/security/keys/internal.h
105848 @@ -253,7 +253,7 @@ extern long keyctl_instantiate_key_iov(key_serial_t,
105849 extern long keyctl_invalidate_key(key_serial_t);
105850
105851 extern long keyctl_instantiate_key_common(key_serial_t,
105852 - const struct iovec *,
105853 + const struct iovec __user *,
105854 unsigned, size_t, key_serial_t);
105855 #ifdef CONFIG_PERSISTENT_KEYRINGS
105856 extern long keyctl_get_persistent(uid_t, key_serial_t);
105857 diff --git a/security/keys/key.c b/security/keys/key.c
105858 index 6e21c11..9ed67ca 100644
105859 --- a/security/keys/key.c
105860 +++ b/security/keys/key.c
105861 @@ -285,7 +285,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
105862
105863 atomic_set(&key->usage, 1);
105864 init_rwsem(&key->sem);
105865 - lockdep_set_class(&key->sem, &type->lock_class);
105866 + lockdep_set_class(&key->sem, (struct lock_class_key *)&type->lock_class);
105867 key->index_key.type = type;
105868 key->user = user;
105869 key->quotalen = quotalen;
105870 @@ -1036,7 +1036,9 @@ int register_key_type(struct key_type *ktype)
105871 struct key_type *p;
105872 int ret;
105873
105874 - memset(&ktype->lock_class, 0, sizeof(ktype->lock_class));
105875 + pax_open_kernel();
105876 + memset((void *)&ktype->lock_class, 0, sizeof(ktype->lock_class));
105877 + pax_close_kernel();
105878
105879 ret = -EEXIST;
105880 down_write(&key_types_sem);
105881 @@ -1048,7 +1050,7 @@ int register_key_type(struct key_type *ktype)
105882 }
105883
105884 /* store the type */
105885 - list_add(&ktype->link, &key_types_list);
105886 + pax_list_add((struct list_head *)&ktype->link, &key_types_list);
105887
105888 pr_notice("Key type %s registered\n", ktype->name);
105889 ret = 0;
105890 @@ -1070,7 +1072,7 @@ EXPORT_SYMBOL(register_key_type);
105891 void unregister_key_type(struct key_type *ktype)
105892 {
105893 down_write(&key_types_sem);
105894 - list_del_init(&ktype->link);
105895 + pax_list_del_init((struct list_head *)&ktype->link);
105896 downgrade_write(&key_types_sem);
105897 key_gc_keytype(ktype);
105898 pr_notice("Key type %s unregistered\n", ktype->name);
105899 @@ -1088,10 +1090,10 @@ void __init key_init(void)
105900 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
105901
105902 /* add the special key types */
105903 - list_add_tail(&key_type_keyring.link, &key_types_list);
105904 - list_add_tail(&key_type_dead.link, &key_types_list);
105905 - list_add_tail(&key_type_user.link, &key_types_list);
105906 - list_add_tail(&key_type_logon.link, &key_types_list);
105907 + pax_list_add_tail((struct list_head *)&key_type_keyring.link, &key_types_list);
105908 + pax_list_add_tail((struct list_head *)&key_type_dead.link, &key_types_list);
105909 + pax_list_add_tail((struct list_head *)&key_type_user.link, &key_types_list);
105910 + pax_list_add_tail((struct list_head *)&key_type_logon.link, &key_types_list);
105911
105912 /* record the root user tracking */
105913 rb_link_node(&root_key_user.node,
105914 diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
105915 index cee72ce..e46074a 100644
105916 --- a/security/keys/keyctl.c
105917 +++ b/security/keys/keyctl.c
105918 @@ -987,7 +987,7 @@ static int keyctl_change_reqkey_auth(struct key *key)
105919 /*
105920 * Copy the iovec data from userspace
105921 */
105922 -static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
105923 +static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov,
105924 unsigned ioc)
105925 {
105926 for (; ioc > 0; ioc--) {
105927 @@ -1009,7 +1009,7 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
105928 * If successful, 0 will be returned.
105929 */
105930 long keyctl_instantiate_key_common(key_serial_t id,
105931 - const struct iovec *payload_iov,
105932 + const struct iovec __user *payload_iov,
105933 unsigned ioc,
105934 size_t plen,
105935 key_serial_t ringid)
105936 @@ -1104,7 +1104,7 @@ long keyctl_instantiate_key(key_serial_t id,
105937 [0].iov_len = plen
105938 };
105939
105940 - return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
105941 + return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid);
105942 }
105943
105944 return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
105945 @@ -1137,7 +1137,7 @@ long keyctl_instantiate_key_iov(key_serial_t id,
105946 if (ret == 0)
105947 goto no_payload_free;
105948
105949 - ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
105950 + ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
105951 err:
105952 if (iov != iovstack)
105953 kfree(iov);
105954 diff --git a/security/min_addr.c b/security/min_addr.c
105955 index f728728..6457a0c 100644
105956 --- a/security/min_addr.c
105957 +++ b/security/min_addr.c
105958 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG_DEFAULT_MMAP_MIN_ADDR;
105959 */
105960 static void update_mmap_min_addr(void)
105961 {
105962 +#ifndef SPARC
105963 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
105964 if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
105965 mmap_min_addr = dac_mmap_min_addr;
105966 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
105967 #else
105968 mmap_min_addr = dac_mmap_min_addr;
105969 #endif
105970 +#endif
105971 }
105972
105973 /*
105974 diff --git a/security/security.c b/security/security.c
105975 index 919cad9..2127be1 100644
105976 --- a/security/security.c
105977 +++ b/security/security.c
105978 @@ -33,8 +33,8 @@
105979 static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
105980 CONFIG_DEFAULT_SECURITY;
105981
105982 -static struct security_operations *security_ops;
105983 -static struct security_operations default_security_ops = {
105984 +struct security_operations *security_ops __read_only;
105985 +struct security_operations default_security_ops __read_only = {
105986 .name = "default",
105987 };
105988
105989 @@ -73,11 +73,6 @@ int __init security_init(void)
105990 return 0;
105991 }
105992
105993 -void reset_security_ops(void)
105994 -{
105995 - security_ops = &default_security_ops;
105996 -}
105997 -
105998 /* Save user chosen LSM */
105999 static int __init choose_lsm(char *str)
106000 {
106001 diff --git a/security/selinux/avc.c b/security/selinux/avc.c
106002 index fc3e662..7844c60 100644
106003 --- a/security/selinux/avc.c
106004 +++ b/security/selinux/avc.c
106005 @@ -59,7 +59,7 @@ struct avc_node {
106006 struct avc_cache {
106007 struct hlist_head slots[AVC_CACHE_SLOTS]; /* head for avc_node->list */
106008 spinlock_t slots_lock[AVC_CACHE_SLOTS]; /* lock for writes */
106009 - atomic_t lru_hint; /* LRU hint for reclaim scan */
106010 + atomic_unchecked_t lru_hint; /* LRU hint for reclaim scan */
106011 atomic_t active_nodes;
106012 u32 latest_notif; /* latest revocation notification */
106013 };
106014 @@ -167,7 +167,7 @@ void __init avc_init(void)
106015 spin_lock_init(&avc_cache.slots_lock[i]);
106016 }
106017 atomic_set(&avc_cache.active_nodes, 0);
106018 - atomic_set(&avc_cache.lru_hint, 0);
106019 + atomic_set_unchecked(&avc_cache.lru_hint, 0);
106020
106021 avc_node_cachep = kmem_cache_create("avc_node", sizeof(struct avc_node),
106022 0, SLAB_PANIC, NULL);
106023 @@ -242,7 +242,7 @@ static inline int avc_reclaim_node(void)
106024 spinlock_t *lock;
106025
106026 for (try = 0, ecx = 0; try < AVC_CACHE_SLOTS; try++) {
106027 - hvalue = atomic_inc_return(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
106028 + hvalue = atomic_inc_return_unchecked(&avc_cache.lru_hint) & (AVC_CACHE_SLOTS - 1);
106029 head = &avc_cache.slots[hvalue];
106030 lock = &avc_cache.slots_lock[hvalue];
106031
106032 diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
106033 index e294b86..eda45c55 100644
106034 --- a/security/selinux/hooks.c
106035 +++ b/security/selinux/hooks.c
106036 @@ -95,8 +95,6 @@
106037 #include "audit.h"
106038 #include "avc_ss.h"
106039
106040 -extern struct security_operations *security_ops;
106041 -
106042 /* SECMARK reference count */
106043 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
106044
106045 @@ -5759,7 +5757,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
106046
106047 #endif
106048
106049 -static struct security_operations selinux_ops = {
106050 +static struct security_operations selinux_ops __read_only = {
106051 .name = "selinux",
106052
106053 .ptrace_access_check = selinux_ptrace_access_check,
106054 @@ -6112,6 +6110,9 @@ static void selinux_nf_ip_exit(void)
106055 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
106056 static int selinux_disabled;
106057
106058 +extern struct security_operations *security_ops;
106059 +extern struct security_operations default_security_ops;
106060 +
106061 int selinux_disable(void)
106062 {
106063 if (ss_initialized) {
106064 @@ -6129,7 +6130,9 @@ int selinux_disable(void)
106065 selinux_disabled = 1;
106066 selinux_enabled = 0;
106067
106068 - reset_security_ops();
106069 + pax_open_kernel();
106070 + security_ops = &default_security_ops;
106071 + pax_close_kernel();
106072
106073 /* Try to destroy the avc node cache */
106074 avc_disable();
106075 diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
106076 index 9f05847..7933395 100644
106077 --- a/security/selinux/include/xfrm.h
106078 +++ b/security/selinux/include/xfrm.h
106079 @@ -46,7 +46,7 @@ static inline void selinux_xfrm_notify_policyload(void)
106080 {
106081 struct net *net;
106082
106083 - atomic_inc(&flow_cache_genid);
106084 + atomic_inc_unchecked(&flow_cache_genid);
106085 rtnl_lock();
106086 for_each_net(net)
106087 rt_genid_bump_all(net);
106088 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
106089 index 14f52be..7352368 100644
106090 --- a/security/smack/smack_lsm.c
106091 +++ b/security/smack/smack_lsm.c
106092 @@ -3726,7 +3726,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
106093 return 0;
106094 }
106095
106096 -struct security_operations smack_ops = {
106097 +struct security_operations smack_ops __read_only = {
106098 .name = "smack",
106099
106100 .ptrace_access_check = smack_ptrace_access_check,
106101 diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
106102 index 4003907..13a2b55 100644
106103 --- a/security/tomoyo/file.c
106104 +++ b/security/tomoyo/file.c
106105 @@ -692,7 +692,7 @@ int tomoyo_path_number_perm(const u8 type, struct path *path,
106106 {
106107 struct tomoyo_request_info r;
106108 struct tomoyo_obj_info obj = {
106109 - .path1 = *path,
106110 + .path1 = { .mnt = path->mnt, .dentry = path->dentry },
106111 };
106112 int error = -ENOMEM;
106113 struct tomoyo_path_info buf;
106114 @@ -740,7 +740,7 @@ int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
106115 struct tomoyo_path_info buf;
106116 struct tomoyo_request_info r;
106117 struct tomoyo_obj_info obj = {
106118 - .path1 = *path,
106119 + .path1 = { .mnt = path->mnt, .dentry = path->dentry },
106120 };
106121 int idx;
106122
106123 @@ -786,7 +786,7 @@ int tomoyo_path_perm(const u8 operation, struct path *path, const char *target)
106124 {
106125 struct tomoyo_request_info r;
106126 struct tomoyo_obj_info obj = {
106127 - .path1 = *path,
106128 + .path1 = { .mnt = path->mnt, .dentry = path->dentry },
106129 };
106130 int error;
106131 struct tomoyo_path_info buf;
106132 @@ -843,7 +843,7 @@ int tomoyo_mkdev_perm(const u8 operation, struct path *path,
106133 {
106134 struct tomoyo_request_info r;
106135 struct tomoyo_obj_info obj = {
106136 - .path1 = *path,
106137 + .path1 = { .mnt = path->mnt, .dentry = path->dentry },
106138 };
106139 int error = -ENOMEM;
106140 struct tomoyo_path_info buf;
106141 @@ -890,8 +890,8 @@ int tomoyo_path2_perm(const u8 operation, struct path *path1,
106142 struct tomoyo_path_info buf2;
106143 struct tomoyo_request_info r;
106144 struct tomoyo_obj_info obj = {
106145 - .path1 = *path1,
106146 - .path2 = *path2,
106147 + .path1 = { .mnt = path1->mnt, .dentry = path1->dentry },
106148 + .path2 = { .mnt = path2->mnt, .dentry = path2->dentry }
106149 };
106150 int idx;
106151
106152 diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
106153 index 390c646..f2f8db3 100644
106154 --- a/security/tomoyo/mount.c
106155 +++ b/security/tomoyo/mount.c
106156 @@ -118,6 +118,10 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r,
106157 type == tomoyo_mounts[TOMOYO_MOUNT_MOVE]) {
106158 need_dev = -1; /* dev_name is a directory */
106159 } else {
106160 + if (!capable(CAP_SYS_ADMIN)) {
106161 + error = -EPERM;
106162 + goto out;
106163 + }
106164 fstype = get_fs_type(type);
106165 if (!fstype) {
106166 error = -ENODEV;
106167 diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
106168 index f0b756e..8aa497b 100644
106169 --- a/security/tomoyo/tomoyo.c
106170 +++ b/security/tomoyo/tomoyo.c
106171 @@ -146,7 +146,7 @@ static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
106172 */
106173 static int tomoyo_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
106174 {
106175 - struct path path = { mnt, dentry };
106176 + struct path path = { .mnt = mnt, .dentry = dentry };
106177 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, &path, NULL);
106178 }
106179
106180 @@ -172,7 +172,7 @@ static int tomoyo_path_truncate(struct path *path)
106181 */
106182 static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
106183 {
106184 - struct path path = { parent->mnt, dentry };
106185 + struct path path = { .mnt = parent->mnt, .dentry = dentry };
106186 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
106187 }
106188
106189 @@ -188,7 +188,7 @@ static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry)
106190 static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
106191 umode_t mode)
106192 {
106193 - struct path path = { parent->mnt, dentry };
106194 + struct path path = { .mnt = parent->mnt, .dentry = dentry };
106195 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
106196 mode & S_IALLUGO);
106197 }
106198 @@ -203,7 +203,7 @@ static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry,
106199 */
106200 static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
106201 {
106202 - struct path path = { parent->mnt, dentry };
106203 + struct path path = { .mnt = parent->mnt, .dentry = dentry };
106204 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
106205 }
106206
106207 @@ -219,7 +219,7 @@ static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry)
106208 static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
106209 const char *old_name)
106210 {
106211 - struct path path = { parent->mnt, dentry };
106212 + struct path path = { .mnt = parent->mnt, .dentry = dentry };
106213 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
106214 }
106215
106216 @@ -236,7 +236,7 @@ static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry,
106217 static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
106218 umode_t mode, unsigned int dev)
106219 {
106220 - struct path path = { parent->mnt, dentry };
106221 + struct path path = { .mnt = parent->mnt, .dentry = dentry };
106222 int type = TOMOYO_TYPE_CREATE;
106223 const unsigned int perm = mode & S_IALLUGO;
106224
106225 @@ -275,8 +275,8 @@ static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry,
106226 static int tomoyo_path_link(struct dentry *old_dentry, struct path *new_dir,
106227 struct dentry *new_dentry)
106228 {
106229 - struct path path1 = { new_dir->mnt, old_dentry };
106230 - struct path path2 = { new_dir->mnt, new_dentry };
106231 + struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
106232 + struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
106233 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
106234 }
106235
106236 @@ -295,8 +295,8 @@ static int tomoyo_path_rename(struct path *old_parent,
106237 struct path *new_parent,
106238 struct dentry *new_dentry)
106239 {
106240 - struct path path1 = { old_parent->mnt, old_dentry };
106241 - struct path path2 = { new_parent->mnt, new_dentry };
106242 + struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
106243 + struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
106244 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
106245 }
106246
106247 @@ -424,7 +424,7 @@ static int tomoyo_sb_mount(const char *dev_name, struct path *path,
106248 */
106249 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
106250 {
106251 - struct path path = { mnt, mnt->mnt_root };
106252 + struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
106253 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
106254 }
106255
106256 @@ -503,7 +503,7 @@ static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
106257 * tomoyo_security_ops is a "struct security_operations" which is used for
106258 * registering TOMOYO.
106259 */
106260 -static struct security_operations tomoyo_security_ops = {
106261 +static struct security_operations tomoyo_security_ops __read_only = {
106262 .name = "tomoyo",
106263 .cred_alloc_blank = tomoyo_cred_alloc_blank,
106264 .cred_prepare = tomoyo_cred_prepare,
106265 diff --git a/security/yama/Kconfig b/security/yama/Kconfig
106266 index 20ef514..4182bed 100644
106267 --- a/security/yama/Kconfig
106268 +++ b/security/yama/Kconfig
106269 @@ -1,6 +1,6 @@
106270 config SECURITY_YAMA
106271 bool "Yama support"
106272 - depends on SECURITY
106273 + depends on SECURITY && !GRKERNSEC
106274 select SECURITYFS
106275 select SECURITY_PATH
106276 default n
106277 diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
106278 index 13c88fbc..f8c115e 100644
106279 --- a/security/yama/yama_lsm.c
106280 +++ b/security/yama/yama_lsm.c
106281 @@ -365,7 +365,7 @@ int yama_ptrace_traceme(struct task_struct *parent)
106282 }
106283
106284 #ifndef CONFIG_SECURITY_YAMA_STACKED
106285 -static struct security_operations yama_ops = {
106286 +static struct security_operations yama_ops __read_only = {
106287 .name = "yama",
106288
106289 .ptrace_access_check = yama_ptrace_access_check,
106290 @@ -376,28 +376,24 @@ static struct security_operations yama_ops = {
106291 #endif
106292
106293 #ifdef CONFIG_SYSCTL
106294 +static int zero __read_only;
106295 +static int max_scope __read_only = YAMA_SCOPE_NO_ATTACH;
106296 +
106297 static int yama_dointvec_minmax(struct ctl_table *table, int write,
106298 void __user *buffer, size_t *lenp, loff_t *ppos)
106299 {
106300 - int rc;
106301 + ctl_table_no_const yama_table;
106302
106303 if (write && !capable(CAP_SYS_PTRACE))
106304 return -EPERM;
106305
106306 - rc = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
106307 - if (rc)
106308 - return rc;
106309 -
106310 + yama_table = *table;
106311 /* Lock the max value if it ever gets set. */
106312 - if (write && *(int *)table->data == *(int *)table->extra2)
106313 - table->extra1 = table->extra2;
106314 -
106315 - return rc;
106316 + if (ptrace_scope == max_scope)
106317 + yama_table.extra1 = &max_scope;
106318 + return proc_dointvec_minmax(&yama_table, write, buffer, lenp, ppos);
106319 }
106320
106321 -static int zero;
106322 -static int max_scope = YAMA_SCOPE_NO_ATTACH;
106323 -
106324 struct ctl_path yama_sysctl_path[] = {
106325 { .procname = "kernel", },
106326 { .procname = "yama", },
106327 diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
106328 index 4cedc69..e59d8a3 100644
106329 --- a/sound/aoa/codecs/onyx.c
106330 +++ b/sound/aoa/codecs/onyx.c
106331 @@ -54,7 +54,7 @@ struct onyx {
106332 spdif_locked:1,
106333 analog_locked:1,
106334 original_mute:2;
106335 - int open_count;
106336 + local_t open_count;
106337 struct codec_info *codec_info;
106338
106339 /* mutex serializes concurrent access to the device
106340 @@ -753,7 +753,7 @@ static int onyx_open(struct codec_info_item *cii,
106341 struct onyx *onyx = cii->codec_data;
106342
106343 mutex_lock(&onyx->mutex);
106344 - onyx->open_count++;
106345 + local_inc(&onyx->open_count);
106346 mutex_unlock(&onyx->mutex);
106347
106348 return 0;
106349 @@ -765,8 +765,7 @@ static int onyx_close(struct codec_info_item *cii,
106350 struct onyx *onyx = cii->codec_data;
106351
106352 mutex_lock(&onyx->mutex);
106353 - onyx->open_count--;
106354 - if (!onyx->open_count)
106355 + if (local_dec_and_test(&onyx->open_count))
106356 onyx->spdif_locked = onyx->analog_locked = 0;
106357 mutex_unlock(&onyx->mutex);
106358
106359 diff --git a/sound/aoa/codecs/onyx.h b/sound/aoa/codecs/onyx.h
106360 index ffd2025..df062c9 100644
106361 --- a/sound/aoa/codecs/onyx.h
106362 +++ b/sound/aoa/codecs/onyx.h
106363 @@ -11,6 +11,7 @@
106364 #include <linux/i2c.h>
106365 #include <asm/pmac_low_i2c.h>
106366 #include <asm/prom.h>
106367 +#include <asm/local.h>
106368
106369 /* PCM3052 register definitions */
106370
106371 diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
106372 index 4c1cc51..16040040 100644
106373 --- a/sound/core/oss/pcm_oss.c
106374 +++ b/sound/core/oss/pcm_oss.c
106375 @@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream, const
106376 if (in_kernel) {
106377 mm_segment_t fs;
106378 fs = snd_enter_user();
106379 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
106380 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
106381 snd_leave_user(fs);
106382 } else {
106383 - ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames);
106384 + ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames);
106385 }
106386 if (ret != -EPIPE && ret != -ESTRPIPE)
106387 break;
106388 @@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(struct snd_pcm_substream *substream, char *p
106389 if (in_kernel) {
106390 mm_segment_t fs;
106391 fs = snd_enter_user();
106392 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
106393 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
106394 snd_leave_user(fs);
106395 } else {
106396 - ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames);
106397 + ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames);
106398 }
106399 if (ret == -EPIPE) {
106400 if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) {
106401 @@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha
106402 struct snd_pcm_plugin_channel *channels;
106403 size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8;
106404 if (!in_kernel) {
106405 - if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes))
106406 + if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes))
106407 return -EFAULT;
106408 buf = runtime->oss.buffer;
106409 }
106410 @@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
106411 }
106412 } else {
106413 tmp = snd_pcm_oss_write2(substream,
106414 - (const char __force *)buf,
106415 + (const char __force_kernel *)buf,
106416 runtime->oss.period_bytes, 0);
106417 if (tmp <= 0)
106418 goto err;
106419 @@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf,
106420 struct snd_pcm_runtime *runtime = substream->runtime;
106421 snd_pcm_sframes_t frames, frames1;
106422 #ifdef CONFIG_SND_PCM_OSS_PLUGINS
106423 - char __user *final_dst = (char __force __user *)buf;
106424 + char __user *final_dst = (char __force_user *)buf;
106425 if (runtime->oss.plugin_first) {
106426 struct snd_pcm_plugin_channel *channels;
106427 size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8;
106428 @@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use
106429 xfer += tmp;
106430 runtime->oss.buffer_used -= tmp;
106431 } else {
106432 - tmp = snd_pcm_oss_read2(substream, (char __force *)buf,
106433 + tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf,
106434 runtime->oss.period_bytes, 0);
106435 if (tmp <= 0)
106436 goto err;
106437 @@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
106438 size1);
106439 size1 /= runtime->channels; /* frames */
106440 fs = snd_enter_user();
106441 - snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1);
106442 + snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1);
106443 snd_leave_user(fs);
106444 }
106445 } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) {
106446 diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
106447 index af49721..e85058e 100644
106448 --- a/sound/core/pcm_compat.c
106449 +++ b/sound/core/pcm_compat.c
106450 @@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream,
106451 int err;
106452
106453 fs = snd_enter_user();
106454 - err = snd_pcm_delay(substream, &delay);
106455 + err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay);
106456 snd_leave_user(fs);
106457 if (err < 0)
106458 return err;
106459 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
106460 index 01a5e05..c6bb425 100644
106461 --- a/sound/core/pcm_native.c
106462 +++ b/sound/core/pcm_native.c
106463 @@ -2811,11 +2811,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
106464 switch (substream->stream) {
106465 case SNDRV_PCM_STREAM_PLAYBACK:
106466 result = snd_pcm_playback_ioctl1(NULL, substream, cmd,
106467 - (void __user *)arg);
106468 + (void __force_user *)arg);
106469 break;
106470 case SNDRV_PCM_STREAM_CAPTURE:
106471 result = snd_pcm_capture_ioctl1(NULL, substream, cmd,
106472 - (void __user *)arg);
106473 + (void __force_user *)arg);
106474 break;
106475 default:
106476 result = -EINVAL;
106477 diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
106478 index 8d4d5e8..fdd0826 100644
106479 --- a/sound/core/seq/oss/seq_oss.c
106480 +++ b/sound/core/seq/oss/seq_oss.c
106481 @@ -75,8 +75,8 @@ static int __init alsa_seq_oss_init(void)
106482 {
106483 int rc;
106484 static struct snd_seq_dev_ops ops = {
106485 - snd_seq_oss_synth_register,
106486 - snd_seq_oss_synth_unregister,
106487 + .init_device = snd_seq_oss_synth_register,
106488 + .free_device = snd_seq_oss_synth_unregister,
106489 };
106490
106491 snd_seq_autoload_lock();
106492 diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
106493 index 040c60e..989a19a 100644
106494 --- a/sound/core/seq/seq_device.c
106495 +++ b/sound/core/seq/seq_device.c
106496 @@ -64,7 +64,7 @@ struct ops_list {
106497 int argsize; /* argument size */
106498
106499 /* operators */
106500 - struct snd_seq_dev_ops ops;
106501 + struct snd_seq_dev_ops *ops;
106502
106503 /* registered devices */
106504 struct list_head dev_list; /* list of devices */
106505 @@ -333,7 +333,7 @@ int snd_seq_device_register_driver(char *id, struct snd_seq_dev_ops *entry,
106506
106507 mutex_lock(&ops->reg_mutex);
106508 /* copy driver operators */
106509 - ops->ops = *entry;
106510 + ops->ops = entry;
106511 ops->driver |= DRIVER_LOADED;
106512 ops->argsize = argsize;
106513
106514 @@ -463,7 +463,7 @@ static int init_device(struct snd_seq_device *dev, struct ops_list *ops)
106515 dev->name, ops->id, ops->argsize, dev->argsize);
106516 return -EINVAL;
106517 }
106518 - if (ops->ops.init_device(dev) >= 0) {
106519 + if (ops->ops->init_device(dev) >= 0) {
106520 dev->status = SNDRV_SEQ_DEVICE_REGISTERED;
106521 ops->num_init_devices++;
106522 } else {
106523 @@ -490,7 +490,7 @@ static int free_device(struct snd_seq_device *dev, struct ops_list *ops)
106524 dev->name, ops->id, ops->argsize, dev->argsize);
106525 return -EINVAL;
106526 }
106527 - if ((result = ops->ops.free_device(dev)) >= 0 || result == -ENXIO) {
106528 + if ((result = ops->ops->free_device(dev)) >= 0 || result == -ENXIO) {
106529 dev->status = SNDRV_SEQ_DEVICE_FREE;
106530 dev->driver_data = NULL;
106531 ops->num_init_devices--;
106532 diff --git a/sound/core/seq/seq_midi.c b/sound/core/seq/seq_midi.c
106533 index 64069db..3c6d392 100644
106534 --- a/sound/core/seq/seq_midi.c
106535 +++ b/sound/core/seq/seq_midi.c
106536 @@ -462,8 +462,8 @@ snd_seq_midisynth_unregister_port(struct snd_seq_device *dev)
106537 static int __init alsa_seq_midi_init(void)
106538 {
106539 static struct snd_seq_dev_ops ops = {
106540 - snd_seq_midisynth_register_port,
106541 - snd_seq_midisynth_unregister_port,
106542 + .init_device = snd_seq_midisynth_register_port,
106543 + .free_device = snd_seq_midisynth_unregister_port,
106544 };
106545 memset(&synths, 0, sizeof(synths));
106546 snd_seq_autoload_lock();
106547 diff --git a/sound/core/sound.c b/sound/core/sound.c
106548 index 437c25e..cd040ab 100644
106549 --- a/sound/core/sound.c
106550 +++ b/sound/core/sound.c
106551 @@ -86,7 +86,7 @@ static void snd_request_other(int minor)
106552 case SNDRV_MINOR_TIMER: str = "snd-timer"; break;
106553 default: return;
106554 }
106555 - request_module(str);
106556 + request_module("%s", str);
106557 }
106558
106559 #endif /* modular kernel */
106560 diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
106561 index 4e0dd22..7a1f32c 100644
106562 --- a/sound/drivers/mts64.c
106563 +++ b/sound/drivers/mts64.c
106564 @@ -29,6 +29,7 @@
106565 #include <sound/initval.h>
106566 #include <sound/rawmidi.h>
106567 #include <sound/control.h>
106568 +#include <asm/local.h>
106569
106570 #define CARD_NAME "Miditerminal 4140"
106571 #define DRIVER_NAME "MTS64"
106572 @@ -67,7 +68,7 @@ struct mts64 {
106573 struct pardevice *pardev;
106574 int pardev_claimed;
106575
106576 - int open_count;
106577 + local_t open_count;
106578 int current_midi_output_port;
106579 int current_midi_input_port;
106580 u8 mode[MTS64_NUM_INPUT_PORTS];
106581 @@ -697,7 +698,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
106582 {
106583 struct mts64 *mts = substream->rmidi->private_data;
106584
106585 - if (mts->open_count == 0) {
106586 + if (local_read(&mts->open_count) == 0) {
106587 /* We don't need a spinlock here, because this is just called
106588 if the device has not been opened before.
106589 So there aren't any IRQs from the device */
106590 @@ -705,7 +706,7 @@ static int snd_mts64_rawmidi_open(struct snd_rawmidi_substream *substream)
106591
106592 msleep(50);
106593 }
106594 - ++(mts->open_count);
106595 + local_inc(&mts->open_count);
106596
106597 return 0;
106598 }
106599 @@ -715,8 +716,7 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
106600 struct mts64 *mts = substream->rmidi->private_data;
106601 unsigned long flags;
106602
106603 - --(mts->open_count);
106604 - if (mts->open_count == 0) {
106605 + if (local_dec_return(&mts->open_count) == 0) {
106606 /* We need the spinlock_irqsave here because we can still
106607 have IRQs at this point */
106608 spin_lock_irqsave(&mts->lock, flags);
106609 @@ -725,8 +725,8 @@ static int snd_mts64_rawmidi_close(struct snd_rawmidi_substream *substream)
106610
106611 msleep(500);
106612
106613 - } else if (mts->open_count < 0)
106614 - mts->open_count = 0;
106615 + } else if (local_read(&mts->open_count) < 0)
106616 + local_set(&mts->open_count, 0);
106617
106618 return 0;
106619 }
106620 diff --git a/sound/drivers/opl3/opl3_seq.c b/sound/drivers/opl3/opl3_seq.c
106621 index 6839953..7a0f4b9 100644
106622 --- a/sound/drivers/opl3/opl3_seq.c
106623 +++ b/sound/drivers/opl3/opl3_seq.c
106624 @@ -281,8 +281,8 @@ static int __init alsa_opl3_seq_init(void)
106625 {
106626 static struct snd_seq_dev_ops ops =
106627 {
106628 - snd_opl3_seq_new_device,
106629 - snd_opl3_seq_delete_device
106630 + .init_device = snd_opl3_seq_new_device,
106631 + .free_device = snd_opl3_seq_delete_device
106632 };
106633
106634 return snd_seq_device_register_driver(SNDRV_SEQ_DEV_ID_OPL3, &ops,
106635 diff --git a/sound/drivers/opl4/opl4_lib.c b/sound/drivers/opl4/opl4_lib.c
106636 index b953fb4..1999c01 100644
106637 --- a/sound/drivers/opl4/opl4_lib.c
106638 +++ b/sound/drivers/opl4/opl4_lib.c
106639 @@ -29,7 +29,7 @@ MODULE_AUTHOR("Clemens Ladisch <clemens@ladisch.de>");
106640 MODULE_DESCRIPTION("OPL4 driver");
106641 MODULE_LICENSE("GPL");
106642
106643 -static void inline snd_opl4_wait(struct snd_opl4 *opl4)
106644 +static inline void snd_opl4_wait(struct snd_opl4 *opl4)
106645 {
106646 int timeout = 10;
106647 while ((inb(opl4->fm_port) & OPL4_STATUS_BUSY) && --timeout > 0)
106648 diff --git a/sound/drivers/opl4/opl4_seq.c b/sound/drivers/opl4/opl4_seq.c
106649 index 9919769..d7de36c 100644
106650 --- a/sound/drivers/opl4/opl4_seq.c
106651 +++ b/sound/drivers/opl4/opl4_seq.c
106652 @@ -198,8 +198,8 @@ static int snd_opl4_seq_delete_device(struct snd_seq_device *dev)
106653 static int __init alsa_opl4_synth_init(void)
106654 {
106655 static struct snd_seq_dev_ops ops = {
106656 - snd_opl4_seq_new_device,
106657 - snd_opl4_seq_delete_device
106658 + .init_device = snd_opl4_seq_new_device,
106659 + .free_device = snd_opl4_seq_delete_device
106660 };
106661
106662 return snd_seq_device_register_driver(SNDRV_SEQ_DEV_ID_OPL4, &ops,
106663 diff --git a/sound/drivers/portman2x4.c b/sound/drivers/portman2x4.c
106664 index 991018d..8984740 100644
106665 --- a/sound/drivers/portman2x4.c
106666 +++ b/sound/drivers/portman2x4.c
106667 @@ -48,6 +48,7 @@
106668 #include <sound/initval.h>
106669 #include <sound/rawmidi.h>
106670 #include <sound/control.h>
106671 +#include <asm/local.h>
106672
106673 #define CARD_NAME "Portman 2x4"
106674 #define DRIVER_NAME "portman"
106675 @@ -85,7 +86,7 @@ struct portman {
106676 struct pardevice *pardev;
106677 int pardev_claimed;
106678
106679 - int open_count;
106680 + local_t open_count;
106681 int mode[PORTMAN_NUM_INPUT_PORTS];
106682 struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
106683 };
106684 diff --git a/sound/firewire/amdtp.c b/sound/firewire/amdtp.c
106685 index 9048777..2d8b1fc 100644
106686 --- a/sound/firewire/amdtp.c
106687 +++ b/sound/firewire/amdtp.c
106688 @@ -488,7 +488,7 @@ static void queue_out_packet(struct amdtp_out_stream *s, unsigned int cycle)
106689 ptr = s->pcm_buffer_pointer + data_blocks;
106690 if (ptr >= pcm->runtime->buffer_size)
106691 ptr -= pcm->runtime->buffer_size;
106692 - ACCESS_ONCE(s->pcm_buffer_pointer) = ptr;
106693 + ACCESS_ONCE_RW(s->pcm_buffer_pointer) = ptr;
106694
106695 s->pcm_period_pointer += data_blocks;
106696 if (s->pcm_period_pointer >= pcm->runtime->period_size) {
106697 @@ -655,7 +655,7 @@ EXPORT_SYMBOL(amdtp_out_stream_pcm_pointer);
106698 */
106699 void amdtp_out_stream_update(struct amdtp_out_stream *s)
106700 {
106701 - ACCESS_ONCE(s->source_node_id_field) =
106702 + ACCESS_ONCE_RW(s->source_node_id_field) =
106703 (fw_parent_device(s->unit)->card->node_id & 0x3f) << 24;
106704 }
106705 EXPORT_SYMBOL(amdtp_out_stream_update);
106706 diff --git a/sound/firewire/amdtp.h b/sound/firewire/amdtp.h
106707 index 2746ecd..c35dedd 100644
106708 --- a/sound/firewire/amdtp.h
106709 +++ b/sound/firewire/amdtp.h
106710 @@ -135,7 +135,7 @@ static inline bool amdtp_out_streaming_error(struct amdtp_out_stream *s)
106711 static inline void amdtp_out_stream_pcm_trigger(struct amdtp_out_stream *s,
106712 struct snd_pcm_substream *pcm)
106713 {
106714 - ACCESS_ONCE(s->pcm) = pcm;
106715 + ACCESS_ONCE_RW(s->pcm) = pcm;
106716 }
106717
106718 static inline bool cip_sfc_is_base_44100(enum cip_sfc sfc)
106719 diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
106720 index fd42e6b..c041971 100644
106721 --- a/sound/firewire/isight.c
106722 +++ b/sound/firewire/isight.c
106723 @@ -96,7 +96,7 @@ static void isight_update_pointers(struct isight *isight, unsigned int count)
106724 ptr += count;
106725 if (ptr >= runtime->buffer_size)
106726 ptr -= runtime->buffer_size;
106727 - ACCESS_ONCE(isight->buffer_pointer) = ptr;
106728 + ACCESS_ONCE_RW(isight->buffer_pointer) = ptr;
106729
106730 isight->period_counter += count;
106731 if (isight->period_counter >= runtime->period_size) {
106732 @@ -299,7 +299,7 @@ static int isight_hw_params(struct snd_pcm_substream *substream,
106733 if (err < 0)
106734 return err;
106735
106736 - ACCESS_ONCE(isight->pcm_active) = true;
106737 + ACCESS_ONCE_RW(isight->pcm_active) = true;
106738
106739 return 0;
106740 }
106741 @@ -337,7 +337,7 @@ static int isight_hw_free(struct snd_pcm_substream *substream)
106742 {
106743 struct isight *isight = substream->private_data;
106744
106745 - ACCESS_ONCE(isight->pcm_active) = false;
106746 + ACCESS_ONCE_RW(isight->pcm_active) = false;
106747
106748 mutex_lock(&isight->mutex);
106749 isight_stop_streaming(isight);
106750 @@ -430,10 +430,10 @@ static int isight_trigger(struct snd_pcm_substream *substream, int cmd)
106751
106752 switch (cmd) {
106753 case SNDRV_PCM_TRIGGER_START:
106754 - ACCESS_ONCE(isight->pcm_running) = true;
106755 + ACCESS_ONCE_RW(isight->pcm_running) = true;
106756 break;
106757 case SNDRV_PCM_TRIGGER_STOP:
106758 - ACCESS_ONCE(isight->pcm_running) = false;
106759 + ACCESS_ONCE_RW(isight->pcm_running) = false;
106760 break;
106761 default:
106762 return -EINVAL;
106763 diff --git a/sound/firewire/scs1x.c b/sound/firewire/scs1x.c
106764 index 858023c..83b3d3c 100644
106765 --- a/sound/firewire/scs1x.c
106766 +++ b/sound/firewire/scs1x.c
106767 @@ -74,7 +74,7 @@ static void scs_output_trigger(struct snd_rawmidi_substream *stream, int up)
106768 {
106769 struct scs *scs = stream->rmidi->private_data;
106770
106771 - ACCESS_ONCE(scs->output) = up ? stream : NULL;
106772 + ACCESS_ONCE_RW(scs->output) = up ? stream : NULL;
106773 if (up) {
106774 scs->output_idle = false;
106775 tasklet_schedule(&scs->tasklet);
106776 @@ -257,7 +257,7 @@ static void scs_input_trigger(struct snd_rawmidi_substream *stream, int up)
106777 {
106778 struct scs *scs = stream->rmidi->private_data;
106779
106780 - ACCESS_ONCE(scs->input) = up ? stream : NULL;
106781 + ACCESS_ONCE_RW(scs->input) = up ? stream : NULL;
106782 }
106783
106784 static void scs_input_escaped_byte(struct snd_rawmidi_substream *stream,
106785 @@ -473,8 +473,8 @@ static void scs_remove(struct fw_unit *unit)
106786
106787 snd_card_disconnect(scs->card);
106788
106789 - ACCESS_ONCE(scs->output) = NULL;
106790 - ACCESS_ONCE(scs->input) = NULL;
106791 + ACCESS_ONCE_RW(scs->output) = NULL;
106792 + ACCESS_ONCE_RW(scs->input) = NULL;
106793
106794 wait_event(scs->idle_wait, scs->output_idle);
106795
106796 diff --git a/sound/isa/sb/emu8000_synth.c b/sound/isa/sb/emu8000_synth.c
106797 index 4e3fcfb..ab45a9d 100644
106798 --- a/sound/isa/sb/emu8000_synth.c
106799 +++ b/sound/isa/sb/emu8000_synth.c
106800 @@ -120,8 +120,8 @@ static int __init alsa_emu8000_init(void)
106801 {
106802
106803 static struct snd_seq_dev_ops ops = {
106804 - snd_emu8000_new_device,
106805 - snd_emu8000_delete_device,
106806 + .init_device = snd_emu8000_new_device,
106807 + .free_device = snd_emu8000_delete_device,
106808 };
106809 return snd_seq_device_register_driver(SNDRV_SEQ_DEV_ID_EMU8000, &ops,
106810 sizeof(struct snd_emu8000*));
106811 diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
106812 index 048439a..3be9f6f 100644
106813 --- a/sound/oss/sb_audio.c
106814 +++ b/sound/oss/sb_audio.c
106815 @@ -904,7 +904,7 @@ sb16_copy_from_user(int dev,
106816 buf16 = (signed short *)(localbuf + localoffs);
106817 while (c)
106818 {
106819 - locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
106820 + locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
106821 if (copy_from_user(lbuf8,
106822 userbuf+useroffs + p,
106823 locallen))
106824 diff --git a/sound/oss/swarm_cs4297a.c b/sound/oss/swarm_cs4297a.c
106825 index f851fd0..92576fb 100644
106826 --- a/sound/oss/swarm_cs4297a.c
106827 +++ b/sound/oss/swarm_cs4297a.c
106828 @@ -2623,7 +2623,6 @@ static int __init cs4297a_init(void)
106829 {
106830 struct cs4297a_state *s;
106831 u32 pwr, id;
106832 - mm_segment_t fs;
106833 int rval;
106834 #ifndef CONFIG_BCM_CS4297A_CSWARM
106835 u64 cfg;
106836 @@ -2713,22 +2712,23 @@ static int __init cs4297a_init(void)
106837 if (!rval) {
106838 char *sb1250_duart_present;
106839
106840 +#if 0
106841 + mm_segment_t fs;
106842 fs = get_fs();
106843 set_fs(KERNEL_DS);
106844 -#if 0
106845 val = SOUND_MASK_LINE;
106846 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
106847 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
106848 val = initvol[i].vol;
106849 mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
106850 }
106851 + set_fs(fs);
106852 // cs4297a_write_ac97(s, 0x18, 0x0808);
106853 #else
106854 // cs4297a_write_ac97(s, 0x5e, 0x180);
106855 cs4297a_write_ac97(s, 0x02, 0x0808);
106856 cs4297a_write_ac97(s, 0x18, 0x0808);
106857 #endif
106858 - set_fs(fs);
106859
106860 list_add(&s->list, &cs4297a_devs);
106861
106862 diff --git a/sound/pci/emu10k1/emu10k1_synth.c b/sound/pci/emu10k1/emu10k1_synth.c
106863 index 4c41c90..37f3631 100644
106864 --- a/sound/pci/emu10k1/emu10k1_synth.c
106865 +++ b/sound/pci/emu10k1/emu10k1_synth.c
106866 @@ -108,8 +108,8 @@ static int __init alsa_emu10k1_synth_init(void)
106867 {
106868
106869 static struct snd_seq_dev_ops ops = {
106870 - snd_emu10k1_synth_new_device,
106871 - snd_emu10k1_synth_delete_device,
106872 + .init_device = snd_emu10k1_synth_new_device,
106873 + .free_device = snd_emu10k1_synth_delete_device,
106874 };
106875 return snd_seq_device_register_driver(SNDRV_SEQ_DEV_ID_EMU10K1_SYNTH, &ops,
106876 sizeof(struct snd_emu10k1_synth_arg));
106877 diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
106878 index dafcf82..dd9356f 100644
106879 --- a/sound/pci/hda/hda_codec.c
106880 +++ b/sound/pci/hda/hda_codec.c
106881 @@ -983,14 +983,10 @@ find_codec_preset(struct hda_codec *codec)
106882 mutex_unlock(&preset_mutex);
106883
106884 if (mod_requested < HDA_MODREQ_MAX_COUNT) {
106885 - char name[32];
106886 if (!mod_requested)
106887 - snprintf(name, sizeof(name), "snd-hda-codec-id:%08x",
106888 - codec->vendor_id);
106889 + request_module("snd-hda-codec-id:%08x", codec->vendor_id);
106890 else
106891 - snprintf(name, sizeof(name), "snd-hda-codec-id:%04x*",
106892 - (codec->vendor_id >> 16) & 0xffff);
106893 - request_module(name);
106894 + request_module("snd-hda-codec-id:%04x*", (codec->vendor_id >> 16) & 0xffff);
106895 mod_requested++;
106896 goto again;
106897 }
106898 @@ -2739,7 +2735,7 @@ static int get_kctl_0dB_offset(struct snd_kcontrol *kctl, int *step_to_check)
106899 /* FIXME: set_fs() hack for obtaining user-space TLV data */
106900 mm_segment_t fs = get_fs();
106901 set_fs(get_ds());
106902 - if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), _tlv))
106903 + if (!kctl->tlv.c(kctl, 0, sizeof(_tlv), (unsigned int __force_user *)_tlv))
106904 tlv = _tlv;
106905 set_fs(fs);
106906 } else if (kctl->vd[0].access & SNDRV_CTL_ELEM_ACCESS_TLV_READ)
106907 diff --git a/sound/pci/ymfpci/ymfpci.h b/sound/pci/ymfpci/ymfpci.h
106908 index 4631a23..001ae57 100644
106909 --- a/sound/pci/ymfpci/ymfpci.h
106910 +++ b/sound/pci/ymfpci/ymfpci.h
106911 @@ -358,7 +358,7 @@ struct snd_ymfpci {
106912 spinlock_t reg_lock;
106913 spinlock_t voice_lock;
106914 wait_queue_head_t interrupt_sleep;
106915 - atomic_t interrupt_sleep_count;
106916 + atomic_unchecked_t interrupt_sleep_count;
106917 struct snd_info_entry *proc_entry;
106918 const struct firmware *dsp_microcode;
106919 const struct firmware *controller_microcode;
106920 diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
106921 index d591c15..8cb8f94 100644
106922 --- a/sound/pci/ymfpci/ymfpci_main.c
106923 +++ b/sound/pci/ymfpci/ymfpci_main.c
106924 @@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct snd_ymfpci *chip)
106925 if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
106926 break;
106927 }
106928 - if (atomic_read(&chip->interrupt_sleep_count)) {
106929 - atomic_set(&chip->interrupt_sleep_count, 0);
106930 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
106931 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
106932 wake_up(&chip->interrupt_sleep);
106933 }
106934 __end:
106935 @@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct snd_ymfpci *chip)
106936 continue;
106937 init_waitqueue_entry(&wait, current);
106938 add_wait_queue(&chip->interrupt_sleep, &wait);
106939 - atomic_inc(&chip->interrupt_sleep_count);
106940 + atomic_inc_unchecked(&chip->interrupt_sleep_count);
106941 schedule_timeout_uninterruptible(msecs_to_jiffies(50));
106942 remove_wait_queue(&chip->interrupt_sleep, &wait);
106943 }
106944 @@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(int irq, void *dev_id)
106945 snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
106946 spin_unlock(&chip->reg_lock);
106947
106948 - if (atomic_read(&chip->interrupt_sleep_count)) {
106949 - atomic_set(&chip->interrupt_sleep_count, 0);
106950 + if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
106951 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
106952 wake_up(&chip->interrupt_sleep);
106953 }
106954 }
106955 @@ -2421,7 +2421,7 @@ int snd_ymfpci_create(struct snd_card *card,
106956 spin_lock_init(&chip->reg_lock);
106957 spin_lock_init(&chip->voice_lock);
106958 init_waitqueue_head(&chip->interrupt_sleep);
106959 - atomic_set(&chip->interrupt_sleep_count, 0);
106960 + atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
106961 chip->card = card;
106962 chip->pci = pci;
106963 chip->irq = -1;
106964 diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
106965 index 5428a1f..474f651 100644
106966 --- a/sound/soc/fsl/fsl_ssi.c
106967 +++ b/sound/soc/fsl/fsl_ssi.c
106968 @@ -1255,7 +1255,6 @@ static int fsl_ssi_probe(struct platform_device *pdev)
106969 {
106970 struct fsl_ssi_private *ssi_private;
106971 int ret = 0;
106972 - struct device_attribute *dev_attr = NULL;
106973 struct device_node *np = pdev->dev.of_node;
106974 const struct of_device_id *of_id;
106975 enum fsl_ssi_type hw_type;
106976 @@ -1481,7 +1480,7 @@ static int fsl_ssi_probe(struct platform_device *pdev)
106977 &ssi_private->cpu_dai_drv, 1);
106978 if (ret) {
106979 dev_err(&pdev->dev, "failed to register DAI: %d\n", ret);
106980 - goto error_dev;
106981 + goto error_clk;
106982 }
106983
106984 ret = fsl_ssi_debugfs_create(ssi_private, &pdev->dev);
106985 @@ -1562,9 +1561,6 @@ error_pcm:
106986 error_dbgfs:
106987 snd_soc_unregister_component(&pdev->dev);
106988
106989 -error_dev:
106990 - device_remove_file(&pdev->dev, dev_attr);
106991 -
106992 error_clk:
106993 if (ssi_private->ssi_on_imx) {
106994 if (!IS_ERR(ssi_private->baudclk))
106995 diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
106996 index fe1df50..09d3be6 100644
106997 --- a/sound/soc/soc-core.c
106998 +++ b/sound/soc/soc-core.c
106999 @@ -2254,8 +2254,10 @@ int snd_soc_set_ac97_ops_of_reset(struct snd_ac97_bus_ops *ops,
107000 if (ret)
107001 return ret;
107002
107003 - ops->warm_reset = snd_soc_ac97_warm_reset;
107004 - ops->reset = snd_soc_ac97_reset;
107005 + pax_open_kernel();
107006 + *(void **)&ops->warm_reset = snd_soc_ac97_warm_reset;
107007 + *(void **)&ops->reset = snd_soc_ac97_reset;
107008 + pax_close_kernel();
107009
107010 snd_ac97_rst_cfg = cfg;
107011 return 0;
107012 diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
107013 index 7778b8e..3d619fc 100644
107014 --- a/sound/synth/emux/emux_seq.c
107015 +++ b/sound/synth/emux/emux_seq.c
107016 @@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
107017 * MIDI emulation operators
107018 */
107019 static struct snd_midi_op emux_ops = {
107020 - snd_emux_note_on,
107021 - snd_emux_note_off,
107022 - snd_emux_key_press,
107023 - snd_emux_terminate_note,
107024 - snd_emux_control,
107025 - snd_emux_nrpn,
107026 - snd_emux_sysex,
107027 + .note_on = snd_emux_note_on,
107028 + .note_off = snd_emux_note_off,
107029 + .key_press = snd_emux_key_press,
107030 + .note_terminate = snd_emux_terminate_note,
107031 + .control = snd_emux_control,
107032 + .nrpn = snd_emux_nrpn,
107033 + .sysex = snd_emux_sysex,
107034 };
107035
107036
107037 diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
107038 new file mode 100644
107039 index 0000000..60e7af2
107040 --- /dev/null
107041 +++ b/tools/gcc/.gitignore
107042 @@ -0,0 +1,2 @@
107043 +randomize_layout_seed.h
107044 +randomize_layout_hash.h
107045 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
107046 new file mode 100644
107047 index 0000000..7b8921f
107048 --- /dev/null
107049 +++ b/tools/gcc/Makefile
107050 @@ -0,0 +1,52 @@
107051 +#CC := gcc
107052 +#PLUGIN_SOURCE_FILES := pax_plugin.c
107053 +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
107054 +GCCPLUGINS_DIR := $(shell $(CC) -print-file-name=plugin)
107055 +#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W -std=gnu99
107056 +
107057 +ifeq ($(PLUGINCC),$(HOSTCC))
107058 +HOSTLIBS := hostlibs
107059 +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu99 -ggdb
107060 +export HOST_EXTRACFLAGS
107061 +else
107062 +HOSTLIBS := hostcxxlibs
107063 +HOST_EXTRACXXFLAGS += -I$(GCCPLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti -ggdb -Wno-unused-parameter -Wno-narrowing -Wno-unused-variable
107064 +export HOST_EXTRACXXFLAGS
107065 +endif
107066 +
107067 +export GCCPLUGINS_DIR HOSTLIBS
107068 +
107069 +$(HOSTLIBS)-$(CONFIG_PAX_CONSTIFY_PLUGIN) := constify_plugin.so
107070 +$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so
107071 +$(HOSTLIBS)-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so
107072 +$(HOSTLIBS)-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so
107073 +$(HOSTLIBS)-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so
107074 +$(HOSTLIBS)-y += colorize_plugin.so
107075 +$(HOSTLIBS)-$(CONFIG_PAX_LATENT_ENTROPY) += latent_entropy_plugin.so
107076 +$(HOSTLIBS)-$(CONFIG_PAX_MEMORY_STRUCTLEAK) += structleak_plugin.so
107077 +$(HOSTLIBS)-$(CONFIG_GRKERNSEC_RANDSTRUCT) += randomize_layout_plugin.so
107078 +
107079 +subdir-$(CONFIG_PAX_SIZE_OVERFLOW) := size_overflow_plugin
107080 +subdir- += size_overflow_plugin
107081 +
107082 +always := $($(HOSTLIBS)-y)
107083 +
107084 +constify_plugin-objs := constify_plugin.o
107085 +stackleak_plugin-objs := stackleak_plugin.o
107086 +kallocstat_plugin-objs := kallocstat_plugin.o
107087 +kernexec_plugin-objs := kernexec_plugin.o
107088 +checker_plugin-objs := checker_plugin.o
107089 +colorize_plugin-objs := colorize_plugin.o
107090 +latent_entropy_plugin-objs := latent_entropy_plugin.o
107091 +structleak_plugin-objs := structleak_plugin.o
107092 +randomize_layout_plugin-objs := randomize_layout_plugin.o
107093 +
107094 +$(obj)/randomize_layout_plugin.o: $(objtree)/$(obj)/randomize_layout_seed.h
107095 +
107096 +quiet_cmd_create_randomize_layout_seed = GENSEED $@
107097 + cmd_create_randomize_layout_seed = \
107098 + $(CONFIG_SHELL) $(srctree)/$(src)/gen-random-seed.sh $@ $(objtree)/include/generated/randomize_layout_hash.h
107099 +$(objtree)/$(obj)/randomize_layout_seed.h: FORCE
107100 + $(call if_changed,create_randomize_layout_seed)
107101 +
107102 +targets += randomize_layout_seed.h randomize_layout_hash.h
107103 diff --git a/tools/gcc/checker_plugin.c b/tools/gcc/checker_plugin.c
107104 new file mode 100644
107105 index 0000000..5452feea
107106 --- /dev/null
107107 +++ b/tools/gcc/checker_plugin.c
107108 @@ -0,0 +1,150 @@
107109 +/*
107110 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
107111 + * Licensed under the GPL v2
107112 + *
107113 + * Note: the choice of the license means that the compilation process is
107114 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
107115 + * but for the kernel it doesn't matter since it doesn't link against
107116 + * any of the gcc libraries
107117 + *
107118 + * gcc plugin to implement various sparse (source code checker) features
107119 + *
107120 + * TODO:
107121 + * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch)
107122 + *
107123 + * BUGS:
107124 + * - none known
107125 + */
107126 +
107127 +#include "gcc-common.h"
107128 +
107129 +extern void c_register_addr_space (const char *str, addr_space_t as);
107130 +extern enum machine_mode default_addr_space_pointer_mode (addr_space_t);
107131 +extern enum machine_mode default_addr_space_address_mode (addr_space_t);
107132 +extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as);
107133 +extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as);
107134 +extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as);
107135 +
107136 +int plugin_is_GPL_compatible;
107137 +
107138 +static struct plugin_info checker_plugin_info = {
107139 + .version = "201304082245",
107140 + .help = NULL,
107141 +};
107142 +
107143 +#define ADDR_SPACE_KERNEL 0
107144 +#define ADDR_SPACE_FORCE_KERNEL 1
107145 +#define ADDR_SPACE_USER 2
107146 +#define ADDR_SPACE_FORCE_USER 3
107147 +#define ADDR_SPACE_IOMEM 0
107148 +#define ADDR_SPACE_FORCE_IOMEM 0
107149 +#define ADDR_SPACE_PERCPU 0
107150 +#define ADDR_SPACE_FORCE_PERCPU 0
107151 +#define ADDR_SPACE_RCU 0
107152 +#define ADDR_SPACE_FORCE_RCU 0
107153 +
107154 +static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace)
107155 +{
107156 + return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC);
107157 +}
107158 +
107159 +static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace)
107160 +{
107161 + return default_addr_space_address_mode(ADDR_SPACE_GENERIC);
107162 +}
107163 +
107164 +static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as)
107165 +{
107166 + return default_addr_space_valid_pointer_mode(mode, as);
107167 +}
107168 +
107169 +static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as)
107170 +{
107171 + return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC);
107172 +}
107173 +
107174 +static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as)
107175 +{
107176 + return default_addr_space_legitimize_address(x, oldx, mode, as);
107177 +}
107178 +
107179 +static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset)
107180 +{
107181 + if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL)
107182 + return true;
107183 +
107184 + if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER)
107185 + return true;
107186 +
107187 + if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM)
107188 + return true;
107189 +
107190 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER)
107191 + return true;
107192 +
107193 + if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM)
107194 + return true;
107195 +
107196 + if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL)
107197 + return true;
107198 +
107199 + if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL)
107200 + return true;
107201 +
107202 + return subset == superset;
107203 +}
107204 +
107205 +static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type)
107206 +{
107207 +// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type));
107208 +// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type));
107209 +
107210 + return op;
107211 +}
107212 +
107213 +static void register_checker_address_spaces(void *event_data, void *data)
107214 +{
107215 + c_register_addr_space("__kernel", ADDR_SPACE_KERNEL);
107216 + c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL);
107217 + c_register_addr_space("__user", ADDR_SPACE_USER);
107218 + c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER);
107219 +// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM);
107220 +// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM);
107221 +// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU);
107222 +// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU);
107223 +// c_register_addr_space("__rcu", ADDR_SPACE_RCU);
107224 +// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU);
107225 +
107226 + targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode;
107227 + targetm.addr_space.address_mode = checker_addr_space_address_mode;
107228 + targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode;
107229 + targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p;
107230 +// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address;
107231 + targetm.addr_space.subset_p = checker_addr_space_subset_p;
107232 + targetm.addr_space.convert = checker_addr_space_convert;
107233 +}
107234 +
107235 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
107236 +{
107237 + const char * const plugin_name = plugin_info->base_name;
107238 + const int argc = plugin_info->argc;
107239 + const struct plugin_argument * const argv = plugin_info->argv;
107240 + int i;
107241 +
107242 + if (!plugin_default_version_check(version, &gcc_version)) {
107243 + error(G_("incompatible gcc/plugin versions"));
107244 + return 1;
107245 + }
107246 +
107247 + register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info);
107248 +
107249 + for (i = 0; i < argc; ++i)
107250 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
107251 +
107252 + if (TARGET_64BIT == 0)
107253 + return 0;
107254 +
107255 + register_callback(plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL);
107256 +
107257 + return 0;
107258 +}
107259 diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
107260 new file mode 100644
107261 index 0000000..54461af
107262 --- /dev/null
107263 +++ b/tools/gcc/colorize_plugin.c
107264 @@ -0,0 +1,210 @@
107265 +/*
107266 + * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
107267 + * Licensed under the GPL v2
107268 + *
107269 + * Note: the choice of the license means that the compilation process is
107270 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
107271 + * but for the kernel it doesn't matter since it doesn't link against
107272 + * any of the gcc libraries
107273 + *
107274 + * gcc plugin to colorize diagnostic output
107275 + *
107276 + */
107277 +
107278 +#include "gcc-common.h"
107279 +
107280 +int plugin_is_GPL_compatible;
107281 +
107282 +static struct plugin_info colorize_plugin_info = {
107283 + .version = "201404202350",
107284 + .help = "color=[never|always|auto]\tdetermine when to colorize\n",
107285 +};
107286 +
107287 +#define GREEN "\033[32m\033[K"
107288 +#define LIGHTGREEN "\033[1;32m\033[K"
107289 +#define YELLOW "\033[33m\033[K"
107290 +#define LIGHTYELLOW "\033[1;33m\033[K"
107291 +#define RED "\033[31m\033[K"
107292 +#define LIGHTRED "\033[1;31m\033[K"
107293 +#define BLUE "\033[34m\033[K"
107294 +#define LIGHTBLUE "\033[1;34m\033[K"
107295 +#define BRIGHT "\033[1;m\033[K"
107296 +#define NORMAL "\033[m\033[K"
107297 +
107298 +static diagnostic_starter_fn old_starter;
107299 +static diagnostic_finalizer_fn old_finalizer;
107300 +
107301 +static void start_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
107302 +{
107303 + const char *color;
107304 + char *newprefix;
107305 +
107306 + switch (diagnostic->kind) {
107307 + case DK_NOTE:
107308 + color = LIGHTBLUE;
107309 + break;
107310 +
107311 + case DK_PEDWARN:
107312 + case DK_WARNING:
107313 + color = LIGHTYELLOW;
107314 + break;
107315 +
107316 + case DK_ERROR:
107317 + case DK_FATAL:
107318 + case DK_ICE:
107319 + case DK_PERMERROR:
107320 + case DK_SORRY:
107321 + color = LIGHTRED;
107322 + break;
107323 +
107324 + default:
107325 + color = NORMAL;
107326 + }
107327 +
107328 + old_starter(context, diagnostic);
107329 + if (-1 == asprintf(&newprefix, "%s%s" NORMAL, color, context->printer->prefix))
107330 + return;
107331 + pp_destroy_prefix(context->printer);
107332 + pp_set_prefix(context->printer, newprefix);
107333 +}
107334 +
107335 +static void finalize_colorize(diagnostic_context *context, diagnostic_info *diagnostic)
107336 +{
107337 + old_finalizer(context, diagnostic);
107338 +}
107339 +
107340 +static void colorize_arm(void)
107341 +{
107342 + old_starter = diagnostic_starter(global_dc);
107343 + old_finalizer = diagnostic_finalizer(global_dc);
107344 +
107345 + diagnostic_starter(global_dc) = start_colorize;
107346 + diagnostic_finalizer(global_dc) = finalize_colorize;
107347 +}
107348 +
107349 +static unsigned int execute_colorize_rearm(void)
107350 +{
107351 + if (diagnostic_starter(global_dc) == start_colorize)
107352 + return 0;
107353 +
107354 + colorize_arm();
107355 + return 0;
107356 +}
107357 +
107358 +#if BUILDING_GCC_VERSION >= 4009
107359 +static const struct pass_data colorize_rearm_pass_data = {
107360 +#else
107361 +struct simple_ipa_opt_pass colorize_rearm_pass = {
107362 + .pass = {
107363 +#endif
107364 + .type = SIMPLE_IPA_PASS,
107365 + .name = "colorize_rearm",
107366 +#if BUILDING_GCC_VERSION >= 4008
107367 + .optinfo_flags = OPTGROUP_NONE,
107368 +#endif
107369 +#if BUILDING_GCC_VERSION >= 4009
107370 + .has_gate = false,
107371 + .has_execute = true,
107372 +#else
107373 + .gate = NULL,
107374 + .execute = execute_colorize_rearm,
107375 + .sub = NULL,
107376 + .next = NULL,
107377 + .static_pass_number = 0,
107378 +#endif
107379 + .tv_id = TV_NONE,
107380 + .properties_required = 0,
107381 + .properties_provided = 0,
107382 + .properties_destroyed = 0,
107383 + .todo_flags_start = 0,
107384 + .todo_flags_finish = 0
107385 +#if BUILDING_GCC_VERSION < 4009
107386 + }
107387 +#endif
107388 +};
107389 +
107390 +#if BUILDING_GCC_VERSION >= 4009
107391 +namespace {
107392 +class colorize_rearm_pass : public simple_ipa_opt_pass {
107393 +public:
107394 + colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
107395 + unsigned int execute() { return execute_colorize_rearm(); }
107396 +};
107397 +}
107398 +
107399 +static opt_pass *make_colorize_rearm_pass(void)
107400 +{
107401 + return new colorize_rearm_pass();
107402 +}
107403 +#else
107404 +static struct opt_pass *make_colorize_rearm_pass(void)
107405 +{
107406 + return &colorize_rearm_pass.pass;
107407 +}
107408 +#endif
107409 +
107410 +static void colorize_start_unit(void *gcc_data, void *user_data)
107411 +{
107412 + colorize_arm();
107413 +}
107414 +
107415 +static bool should_colorize(void)
107416 +{
107417 +#if BUILDING_GCC_VERSION >= 4009
107418 + return false;
107419 +#else
107420 + char const *t = getenv("TERM");
107421 +
107422 + return t && strcmp(t, "dumb") && isatty(STDERR_FILENO);
107423 +#endif
107424 +}
107425 +
107426 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
107427 +{
107428 + const char * const plugin_name = plugin_info->base_name;
107429 + const int argc = plugin_info->argc;
107430 + const struct plugin_argument * const argv = plugin_info->argv;
107431 + int i;
107432 + struct register_pass_info colorize_rearm_pass_info;
107433 + bool colorize;
107434 +
107435 + colorize_rearm_pass_info.pass = make_colorize_rearm_pass();
107436 + colorize_rearm_pass_info.reference_pass_name = "*free_lang_data";
107437 + colorize_rearm_pass_info.ref_pass_instance_number = 1;
107438 + colorize_rearm_pass_info.pos_op = PASS_POS_INSERT_AFTER;
107439 +
107440 + if (!plugin_default_version_check(version, &gcc_version)) {
107441 + error(G_("incompatible gcc/plugin versions"));
107442 + return 1;
107443 + }
107444 +
107445 + register_callback(plugin_name, PLUGIN_INFO, NULL, &colorize_plugin_info);
107446 +
107447 + colorize = getenv("GCC_COLORS") ? should_colorize() : false;
107448 +
107449 + for (i = 0; i < argc; ++i) {
107450 + if (!strcmp(argv[i].key, "color")) {
107451 + if (!argv[i].value) {
107452 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
107453 + continue;
107454 + }
107455 + if (!strcmp(argv[i].value, "always"))
107456 + colorize = true;
107457 + else if (!strcmp(argv[i].value, "never"))
107458 + colorize = false;
107459 + else if (!strcmp(argv[i].value, "auto"))
107460 + colorize = should_colorize();
107461 + else
107462 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
107463 + continue;
107464 + }
107465 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
107466 + }
107467 +
107468 + if (colorize) {
107469 + // TODO: parse GCC_COLORS as used by gcc 4.9+
107470 + register_callback(plugin_name, PLUGIN_START_UNIT, &colorize_start_unit, NULL);
107471 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &colorize_rearm_pass_info);
107472 + }
107473 + return 0;
107474 +}
107475 diff --git a/tools/gcc/constify_plugin.c b/tools/gcc/constify_plugin.c
107476 new file mode 100644
107477 index 0000000..82bc5a8
107478 --- /dev/null
107479 +++ b/tools/gcc/constify_plugin.c
107480 @@ -0,0 +1,557 @@
107481 +/*
107482 + * Copyright 2011 by Emese Revfy <re.emese@gmail.com>
107483 + * Copyright 2011-2014 by PaX Team <pageexec@freemail.hu>
107484 + * Licensed under the GPL v2, or (at your option) v3
107485 + *
107486 + * This gcc plugin constifies all structures which contain only function pointers or are explicitly marked for constification.
107487 + *
107488 + * Homepage:
107489 + * http://www.grsecurity.net/~ephox/const_plugin/
107490 + *
107491 + * Usage:
107492 + * $ gcc -I`gcc -print-file-name=plugin`/include -fPIC -shared -O2 -o constify_plugin.so constify_plugin.c
107493 + * $ gcc -fplugin=constify_plugin.so test.c -O2
107494 + */
107495 +
107496 +#include "gcc-common.h"
107497 +
107498 +// unused C type flag in all versions 4.5-4.9
107499 +#define TYPE_CONSTIFY_VISITED(TYPE) TYPE_LANG_FLAG_4(TYPE)
107500 +
107501 +int plugin_is_GPL_compatible;
107502 +
107503 +static struct plugin_info const_plugin_info = {
107504 + .version = "201401270210",
107505 + .help = "no-constify\tturn off constification\n",
107506 +};
107507 +
107508 +typedef struct {
107509 + bool has_fptr_field;
107510 + bool has_writable_field;
107511 + bool has_do_const_field;
107512 + bool has_no_const_field;
107513 +} constify_info;
107514 +
107515 +static const_tree get_field_type(const_tree field)
107516 +{
107517 + return strip_array_types(TREE_TYPE(field));
107518 +}
107519 +
107520 +static bool is_fptr(const_tree field)
107521 +{
107522 + const_tree ptr = get_field_type(field);
107523 +
107524 + if (TREE_CODE(ptr) != POINTER_TYPE)
107525 + return false;
107526 +
107527 + return TREE_CODE(TREE_TYPE(ptr)) == FUNCTION_TYPE;
107528 +}
107529 +
107530 +/*
107531 + * determine whether the given structure type meets the requirements for automatic constification,
107532 + * including the constification attributes on nested structure types
107533 + */
107534 +static void constifiable(const_tree node, constify_info *cinfo)
107535 +{
107536 + const_tree field;
107537 +
107538 + gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
107539 +
107540 + // e.g., pointer to structure fields while still constructing the structure type
107541 + if (TYPE_FIELDS(node) == NULL_TREE)
107542 + return;
107543 +
107544 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
107545 + const_tree type = get_field_type(field);
107546 + enum tree_code code = TREE_CODE(type);
107547 +
107548 + if (node == type)
107549 + continue;
107550 +
107551 + if (is_fptr(field))
107552 + cinfo->has_fptr_field = true;
107553 + else if (!TREE_READONLY(field))
107554 + cinfo->has_writable_field = true;
107555 +
107556 + if (code == RECORD_TYPE || code == UNION_TYPE) {
107557 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
107558 + cinfo->has_do_const_field = true;
107559 + else if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type)))
107560 + cinfo->has_no_const_field = true;
107561 + else
107562 + constifiable(type, cinfo);
107563 + }
107564 + }
107565 +}
107566 +
107567 +static bool constified(const_tree node)
107568 +{
107569 + constify_info cinfo = {
107570 + .has_fptr_field = false,
107571 + .has_writable_field = false,
107572 + .has_do_const_field = false,
107573 + .has_no_const_field = false
107574 + };
107575 +
107576 + gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
107577 +
107578 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(node))) {
107579 +// gcc_assert(!TYPE_READONLY(node));
107580 + return false;
107581 + }
107582 +
107583 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(node))) {
107584 + gcc_assert(TYPE_READONLY(node));
107585 + return true;
107586 + }
107587 +
107588 + constifiable(node, &cinfo);
107589 + if ((!cinfo.has_fptr_field || cinfo.has_writable_field) && !cinfo.has_do_const_field)
107590 + return false;
107591 +
107592 + return TYPE_READONLY(node);
107593 +}
107594 +
107595 +static void deconstify_tree(tree node);
107596 +
107597 +static void deconstify_type(tree type)
107598 +{
107599 + tree field;
107600 +
107601 + gcc_assert(TREE_CODE(type) == RECORD_TYPE || TREE_CODE(type) == UNION_TYPE);
107602 +
107603 + for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
107604 + const_tree fieldtype = get_field_type(field);
107605 +
107606 + // special case handling of simple ptr-to-same-array-type members
107607 + if (TREE_CODE(TREE_TYPE(field)) == POINTER_TYPE) {
107608 + tree ptrtype = TREE_TYPE(TREE_TYPE(field));
107609 +
107610 + if (TREE_TYPE(TREE_TYPE(field)) == type)
107611 + continue;
107612 + if (TREE_CODE(ptrtype) != RECORD_TYPE && TREE_CODE(ptrtype) != UNION_TYPE)
107613 + continue;
107614 + if (!constified(ptrtype))
107615 + continue;
107616 + if (TYPE_MAIN_VARIANT(ptrtype) == TYPE_MAIN_VARIANT(type)) {
107617 + TREE_TYPE(field) = copy_node(TREE_TYPE(field));
107618 + TREE_TYPE(TREE_TYPE(field)) = build_qualified_type(type, TYPE_QUALS(ptrtype) & ~TYPE_QUAL_CONST);
107619 + }
107620 + continue;
107621 + }
107622 + if (TREE_CODE(fieldtype) != RECORD_TYPE && TREE_CODE(fieldtype) != UNION_TYPE)
107623 + continue;
107624 + if (!constified(fieldtype))
107625 + continue;
107626 +
107627 + deconstify_tree(field);
107628 + TREE_READONLY(field) = 0;
107629 + }
107630 + TYPE_READONLY(type) = 0;
107631 + C_TYPE_FIELDS_READONLY(type) = 0;
107632 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
107633 + TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
107634 + TYPE_ATTRIBUTES(type) = remove_attribute("do_const", TYPE_ATTRIBUTES(type));
107635 + }
107636 +}
107637 +
107638 +static void deconstify_tree(tree node)
107639 +{
107640 + tree old_type, new_type, field;
107641 +
107642 + old_type = TREE_TYPE(node);
107643 + while (TREE_CODE(old_type) == ARRAY_TYPE && TREE_CODE(TREE_TYPE(old_type)) != ARRAY_TYPE) {
107644 + node = TREE_TYPE(node) = copy_node(old_type);
107645 + old_type = TREE_TYPE(old_type);
107646 + }
107647 +
107648 + gcc_assert(TREE_CODE(old_type) == RECORD_TYPE || TREE_CODE(old_type) == UNION_TYPE);
107649 + gcc_assert(TYPE_READONLY(old_type) && (TYPE_QUALS(old_type) & TYPE_QUAL_CONST));
107650 +
107651 + new_type = build_qualified_type(old_type, TYPE_QUALS(old_type) & ~TYPE_QUAL_CONST);
107652 + TYPE_FIELDS(new_type) = copy_list(TYPE_FIELDS(new_type));
107653 + for (field = TYPE_FIELDS(new_type); field; field = TREE_CHAIN(field))
107654 + DECL_FIELD_CONTEXT(field) = new_type;
107655 +
107656 + deconstify_type(new_type);
107657 +
107658 + TREE_TYPE(node) = new_type;
107659 +}
107660 +
107661 +static tree handle_no_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
107662 +{
107663 + tree type;
107664 + constify_info cinfo = {
107665 + .has_fptr_field = false,
107666 + .has_writable_field = false,
107667 + .has_do_const_field = false,
107668 + .has_no_const_field = false
107669 + };
107670 +
107671 + *no_add_attrs = true;
107672 + if (TREE_CODE(*node) == FUNCTION_DECL) {
107673 + error("%qE attribute does not apply to functions (%qF)", name, *node);
107674 + return NULL_TREE;
107675 + }
107676 +
107677 + if (TREE_CODE(*node) == PARM_DECL) {
107678 + error("%qE attribute does not apply to function parameters (%qD)", name, *node);
107679 + return NULL_TREE;
107680 + }
107681 +
107682 + if (TREE_CODE(*node) == VAR_DECL) {
107683 + error("%qE attribute does not apply to variables (%qD)", name, *node);
107684 + return NULL_TREE;
107685 + }
107686 +
107687 + if (TYPE_P(*node)) {
107688 + type = *node;
107689 + } else {
107690 + gcc_assert(TREE_CODE(*node) == TYPE_DECL);
107691 + type = TREE_TYPE(*node);
107692 + }
107693 +
107694 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE) {
107695 + error("%qE attribute used on %qT applies to struct and union types only", name, type);
107696 + return NULL_TREE;
107697 + }
107698 +
107699 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
107700 + error("%qE attribute is already applied to the type %qT", name, type);
107701 + return NULL_TREE;
107702 + }
107703 +
107704 + if (TYPE_P(*node)) {
107705 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type)))
107706 + error("%qE attribute used on type %qT is incompatible with 'do_const'", name, type);
107707 + else
107708 + *no_add_attrs = false;
107709 + return NULL_TREE;
107710 + }
107711 +
107712 + constifiable(type, &cinfo);
107713 + if ((cinfo.has_fptr_field && !cinfo.has_writable_field) || lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
107714 + deconstify_tree(*node);
107715 + TYPE_CONSTIFY_VISITED(TREE_TYPE(*node)) = 1;
107716 + return NULL_TREE;
107717 + }
107718 +
107719 + error("%qE attribute used on type %qT that is not constified", name, type);
107720 + return NULL_TREE;
107721 +}
107722 +
107723 +static void constify_type(tree type)
107724 +{
107725 + TYPE_READONLY(type) = 1;
107726 + C_TYPE_FIELDS_READONLY(type) = 1;
107727 + TYPE_CONSTIFY_VISITED(type) = 1;
107728 +// TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
107729 +// TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("do_const"), NULL_TREE, TYPE_ATTRIBUTES(type));
107730 +}
107731 +
107732 +static tree handle_do_const_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
107733 +{
107734 + *no_add_attrs = true;
107735 + if (!TYPE_P(*node)) {
107736 + error("%qE attribute applies to types only (%qD)", name, *node);
107737 + return NULL_TREE;
107738 + }
107739 +
107740 + if (TREE_CODE(*node) != RECORD_TYPE && TREE_CODE(*node) != UNION_TYPE) {
107741 + error("%qE attribute used on %qT applies to struct and union types only", name, *node);
107742 + return NULL_TREE;
107743 + }
107744 +
107745 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(*node))) {
107746 + error("%qE attribute used on %qT is already applied to the type", name, *node);
107747 + return NULL_TREE;
107748 + }
107749 +
107750 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(*node))) {
107751 + error("%qE attribute used on %qT is incompatible with 'no_const'", name, *node);
107752 + return NULL_TREE;
107753 + }
107754 +
107755 + *no_add_attrs = false;
107756 + return NULL_TREE;
107757 +}
107758 +
107759 +static struct attribute_spec no_const_attr = {
107760 + .name = "no_const",
107761 + .min_length = 0,
107762 + .max_length = 0,
107763 + .decl_required = false,
107764 + .type_required = false,
107765 + .function_type_required = false,
107766 + .handler = handle_no_const_attribute,
107767 +#if BUILDING_GCC_VERSION >= 4007
107768 + .affects_type_identity = true
107769 +#endif
107770 +};
107771 +
107772 +static struct attribute_spec do_const_attr = {
107773 + .name = "do_const",
107774 + .min_length = 0,
107775 + .max_length = 0,
107776 + .decl_required = false,
107777 + .type_required = false,
107778 + .function_type_required = false,
107779 + .handler = handle_do_const_attribute,
107780 +#if BUILDING_GCC_VERSION >= 4007
107781 + .affects_type_identity = true
107782 +#endif
107783 +};
107784 +
107785 +static void register_attributes(void *event_data, void *data)
107786 +{
107787 + register_attribute(&no_const_attr);
107788 + register_attribute(&do_const_attr);
107789 +}
107790 +
107791 +static void finish_type(void *event_data, void *data)
107792 +{
107793 + tree type = (tree)event_data;
107794 + constify_info cinfo = {
107795 + .has_fptr_field = false,
107796 + .has_writable_field = false,
107797 + .has_do_const_field = false,
107798 + .has_no_const_field = false
107799 + };
107800 +
107801 + if (type == NULL_TREE || type == error_mark_node)
107802 + return;
107803 +
107804 + if (TYPE_FIELDS(type) == NULL_TREE || TYPE_CONSTIFY_VISITED(type))
107805 + return;
107806 +
107807 + constifiable(type, &cinfo);
107808 +
107809 + if (lookup_attribute("no_const", TYPE_ATTRIBUTES(type))) {
107810 + if ((cinfo.has_fptr_field && !cinfo.has_writable_field) || cinfo.has_do_const_field) {
107811 + deconstify_type(type);
107812 + TYPE_CONSTIFY_VISITED(type) = 1;
107813 + } else
107814 + error("'no_const' attribute used on type %qT that is not constified", type);
107815 + return;
107816 + }
107817 +
107818 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
107819 + if (!cinfo.has_writable_field) {
107820 + error("'do_const' attribute used on type %qT that is%sconstified", type, cinfo.has_fptr_field ? " " : " not ");
107821 + return;
107822 + }
107823 + constify_type(type);
107824 + return;
107825 + }
107826 +
107827 + if (cinfo.has_fptr_field && !cinfo.has_writable_field) {
107828 + if (lookup_attribute("do_const", TYPE_ATTRIBUTES(type))) {
107829 + error("'do_const' attribute used on type %qT that is constified", type);
107830 + return;
107831 + }
107832 + constify_type(type);
107833 + return;
107834 + }
107835 +
107836 + deconstify_type(type);
107837 + TYPE_CONSTIFY_VISITED(type) = 1;
107838 +}
107839 +
107840 +static void check_global_variables(void *event_data, void *data)
107841 +{
107842 +#if BUILDING_GCC_VERSION >= 4009
107843 + varpool_node *node;
107844 +#else
107845 + struct varpool_node *node;
107846 +#endif
107847 +
107848 + FOR_EACH_VARIABLE(node) {
107849 + tree var = NODE_DECL(node);
107850 + tree type = TREE_TYPE(var);
107851 +
107852 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
107853 + continue;
107854 +
107855 + if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
107856 + continue;
107857 +
107858 + if (!TYPE_CONSTIFY_VISITED(type))
107859 + continue;
107860 +
107861 + if (DECL_EXTERNAL(var))
107862 + continue;
107863 +
107864 + if (DECL_INITIAL(var))
107865 + continue;
107866 +
107867 + // this works around a gcc bug/feature where uninitialized globals
107868 + // are moved into the .bss section regardless of any constification
107869 + DECL_INITIAL(var) = build_constructor(type, NULL);
107870 +// inform(DECL_SOURCE_LOCATION(var), "constified variable %qE moved into .rodata", var);
107871 + }
107872 +}
107873 +
107874 +static unsigned int check_local_variables(void)
107875 +{
107876 + unsigned int ret = 0;
107877 + tree var;
107878 +
107879 + unsigned int i;
107880 +
107881 + FOR_EACH_LOCAL_DECL(cfun, i, var) {
107882 + tree type = TREE_TYPE(var);
107883 +
107884 + gcc_assert(DECL_P(var));
107885 + if (is_global_var(var))
107886 + continue;
107887 +
107888 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
107889 + continue;
107890 +
107891 + if (!TYPE_READONLY(type) || !C_TYPE_FIELDS_READONLY(type))
107892 + continue;
107893 +
107894 + if (!TYPE_CONSTIFY_VISITED(type))
107895 + continue;
107896 +
107897 + error_at(DECL_SOURCE_LOCATION(var), "constified variable %qE cannot be local", var);
107898 + ret = 1;
107899 + }
107900 + return ret;
107901 +}
107902 +
107903 +#if BUILDING_GCC_VERSION >= 4009
107904 +static const struct pass_data check_local_variables_pass_data = {
107905 +#else
107906 +static struct gimple_opt_pass check_local_variables_pass = {
107907 + .pass = {
107908 +#endif
107909 + .type = GIMPLE_PASS,
107910 + .name = "check_local_variables",
107911 +#if BUILDING_GCC_VERSION >= 4008
107912 + .optinfo_flags = OPTGROUP_NONE,
107913 +#endif
107914 +#if BUILDING_GCC_VERSION >= 4009
107915 + .has_gate = false,
107916 + .has_execute = true,
107917 +#else
107918 + .gate = NULL,
107919 + .execute = check_local_variables,
107920 + .sub = NULL,
107921 + .next = NULL,
107922 + .static_pass_number = 0,
107923 +#endif
107924 + .tv_id = TV_NONE,
107925 + .properties_required = 0,
107926 + .properties_provided = 0,
107927 + .properties_destroyed = 0,
107928 + .todo_flags_start = 0,
107929 + .todo_flags_finish = 0
107930 +#if BUILDING_GCC_VERSION < 4009
107931 + }
107932 +#endif
107933 +};
107934 +
107935 +#if BUILDING_GCC_VERSION >= 4009
107936 +namespace {
107937 +class check_local_variables_pass : public gimple_opt_pass {
107938 +public:
107939 + check_local_variables_pass() : gimple_opt_pass(check_local_variables_pass_data, g) {}
107940 + unsigned int execute() { return check_local_variables(); }
107941 +};
107942 +}
107943 +
107944 +static opt_pass *make_check_local_variables_pass(void)
107945 +{
107946 + return new check_local_variables_pass();
107947 +}
107948 +#else
107949 +static struct opt_pass *make_check_local_variables_pass(void)
107950 +{
107951 + return &check_local_variables_pass.pass;
107952 +}
107953 +#endif
107954 +
107955 +static struct {
107956 + const char *name;
107957 + const char *asm_op;
107958 +} sections[] = {
107959 + {".init.rodata", "\t.section\t.init.rodata,\"a\""},
107960 + {".ref.rodata", "\t.section\t.ref.rodata,\"a\""},
107961 + {".devinit.rodata", "\t.section\t.devinit.rodata,\"a\""},
107962 + {".devexit.rodata", "\t.section\t.devexit.rodata,\"a\""},
107963 + {".cpuinit.rodata", "\t.section\t.cpuinit.rodata,\"a\""},
107964 + {".cpuexit.rodata", "\t.section\t.cpuexit.rodata,\"a\""},
107965 + {".meminit.rodata", "\t.section\t.meminit.rodata,\"a\""},
107966 + {".memexit.rodata", "\t.section\t.memexit.rodata,\"a\""},
107967 + {".data..read_only", "\t.section\t.data..read_only,\"a\""},
107968 +};
107969 +
107970 +static unsigned int (*old_section_type_flags)(tree decl, const char *name, int reloc);
107971 +
107972 +static unsigned int constify_section_type_flags(tree decl, const char *name, int reloc)
107973 +{
107974 + size_t i;
107975 +
107976 + for (i = 0; i < ARRAY_SIZE(sections); i++)
107977 + if (!strcmp(sections[i].name, name))
107978 + return 0;
107979 + return old_section_type_flags(decl, name, reloc);
107980 +}
107981 +
107982 +static void constify_start_unit(void *gcc_data, void *user_data)
107983 +{
107984 +// size_t i;
107985 +
107986 +// for (i = 0; i < ARRAY_SIZE(sections); i++)
107987 +// sections[i].section = get_unnamed_section(0, output_section_asm_op, sections[i].asm_op);
107988 +// sections[i].section = get_section(sections[i].name, 0, NULL);
107989 +
107990 + old_section_type_flags = targetm.section_type_flags;
107991 + targetm.section_type_flags = constify_section_type_flags;
107992 +}
107993 +
107994 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
107995 +{
107996 + const char * const plugin_name = plugin_info->base_name;
107997 + const int argc = plugin_info->argc;
107998 + const struct plugin_argument * const argv = plugin_info->argv;
107999 + int i;
108000 + bool constify = true;
108001 +
108002 + struct register_pass_info check_local_variables_pass_info;
108003 +
108004 + check_local_variables_pass_info.pass = make_check_local_variables_pass();
108005 + check_local_variables_pass_info.reference_pass_name = "ssa";
108006 + check_local_variables_pass_info.ref_pass_instance_number = 1;
108007 + check_local_variables_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
108008 +
108009 + if (!plugin_default_version_check(version, &gcc_version)) {
108010 + error(G_("incompatible gcc/plugin versions"));
108011 + return 1;
108012 + }
108013 +
108014 + for (i = 0; i < argc; ++i) {
108015 + if (!(strcmp(argv[i].key, "no-constify"))) {
108016 + constify = false;
108017 + continue;
108018 + }
108019 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
108020 + }
108021 +
108022 + if (strcmp(lang_hooks.name, "GNU C")) {
108023 + inform(UNKNOWN_LOCATION, G_("%s supports C only"), plugin_name);
108024 + constify = false;
108025 + }
108026 +
108027 + register_callback(plugin_name, PLUGIN_INFO, NULL, &const_plugin_info);
108028 + if (constify) {
108029 + register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
108030 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
108031 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &check_local_variables_pass_info);
108032 + register_callback(plugin_name, PLUGIN_START_UNIT, constify_start_unit, NULL);
108033 + }
108034 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
108035 +
108036 + return 0;
108037 +}
108038 diff --git a/tools/gcc/gcc-common.h b/tools/gcc/gcc-common.h
108039 new file mode 100644
108040 index 0000000..e90c205
108041 --- /dev/null
108042 +++ b/tools/gcc/gcc-common.h
108043 @@ -0,0 +1,295 @@
108044 +#ifndef GCC_COMMON_H_INCLUDED
108045 +#define GCC_COMMON_H_INCLUDED
108046 +
108047 +#include "plugin.h"
108048 +#include "bversion.h"
108049 +#include "plugin-version.h"
108050 +#include "config.h"
108051 +#include "system.h"
108052 +#include "coretypes.h"
108053 +#include "tm.h"
108054 +#include "line-map.h"
108055 +#include "input.h"
108056 +#include "tree.h"
108057 +
108058 +#include "tree-inline.h"
108059 +#include "version.h"
108060 +#include "rtl.h"
108061 +#include "tm_p.h"
108062 +#include "flags.h"
108063 +//#include "insn-attr.h"
108064 +//#include "insn-config.h"
108065 +//#include "insn-flags.h"
108066 +#include "hard-reg-set.h"
108067 +//#include "recog.h"
108068 +#include "output.h"
108069 +#include "except.h"
108070 +#include "function.h"
108071 +#include "toplev.h"
108072 +//#include "expr.h"
108073 +#include "basic-block.h"
108074 +#include "intl.h"
108075 +#include "ggc.h"
108076 +//#include "regs.h"
108077 +#include "timevar.h"
108078 +
108079 +#include "params.h"
108080 +#include "pointer-set.h"
108081 +#include "emit-rtl.h"
108082 +//#include "reload.h"
108083 +//#include "ira.h"
108084 +//#include "dwarf2asm.h"
108085 +#include "debug.h"
108086 +#include "target.h"
108087 +#include "langhooks.h"
108088 +#include "cfgloop.h"
108089 +//#include "hosthooks.h"
108090 +#include "cgraph.h"
108091 +#include "opts.h"
108092 +//#include "coverage.h"
108093 +//#include "value-prof.h"
108094 +
108095 +#if BUILDING_GCC_VERSION >= 4007
108096 +#include "tree-pretty-print.h"
108097 +#include "gimple-pretty-print.h"
108098 +#include "c-tree.h"
108099 +//#include "alloc-pool.h"
108100 +#endif
108101 +
108102 +#if BUILDING_GCC_VERSION <= 4008
108103 +#include "tree-flow.h"
108104 +#else
108105 +#include "tree-cfgcleanup.h"
108106 +#endif
108107 +
108108 +#include "diagnostic.h"
108109 +//#include "tree-diagnostic.h"
108110 +#include "tree-dump.h"
108111 +#include "tree-pass.h"
108112 +//#include "df.h"
108113 +#include "predict.h"
108114 +#include "ipa-utils.h"
108115 +
108116 +#if BUILDING_GCC_VERSION >= 4009
108117 +#include "varasm.h"
108118 +#include "stor-layout.h"
108119 +#include "internal-fn.h"
108120 +#include "gimple-expr.h"
108121 +//#include "diagnostic-color.h"
108122 +#include "context.h"
108123 +#include "tree-ssa-alias.h"
108124 +#include "stringpool.h"
108125 +#include "tree-ssanames.h"
108126 +#include "print-tree.h"
108127 +#include "tree-eh.h"
108128 +#include "stmt.h"
108129 +#endif
108130 +
108131 +#include "gimple.h"
108132 +
108133 +#if BUILDING_GCC_VERSION >= 4009
108134 +#include "tree-ssa-operands.h"
108135 +#include "tree-phinodes.h"
108136 +#include "tree-cfg.h"
108137 +#include "gimple-iterator.h"
108138 +#include "gimple-ssa.h"
108139 +#include "ssa-iterators.h"
108140 +#endif
108141 +
108142 +//#include "lto/lto.h"
108143 +//#include "data-streamer.h"
108144 +//#include "lto-compress.h"
108145 +
108146 +//#include "expr.h" where are you...
108147 +extern rtx emit_move_insn(rtx x, rtx y);
108148 +
108149 +// missing from basic_block.h...
108150 +extern void debug_dominance_info(enum cdi_direction dir);
108151 +extern void debug_dominance_tree(enum cdi_direction dir, basic_block root);
108152 +
108153 +#define __unused __attribute__((__unused__))
108154 +
108155 +#define DECL_NAME_POINTER(node) IDENTIFIER_POINTER(DECL_NAME(node))
108156 +#define DECL_NAME_LENGTH(node) IDENTIFIER_LENGTH(DECL_NAME(node))
108157 +#define TYPE_NAME_POINTER(node) IDENTIFIER_POINTER(TYPE_NAME(node))
108158 +#define TYPE_NAME_LENGTH(node) IDENTIFIER_LENGTH(TYPE_NAME(node))
108159 +
108160 +#if BUILDING_GCC_VERSION == 4005
108161 +#define FOR_EACH_LOCAL_DECL(FUN, I, D) for (tree vars = (FUN)->local_decls; vars && (D = TREE_VALUE(vars)); vars = TREE_CHAIN(vars), I)
108162 +#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
108163 +#define FOR_EACH_VEC_ELT(T, V, I, P) for (I = 0; VEC_iterate(T, (V), (I), (P)); ++(I))
108164 +#define TODO_rebuild_cgraph_edges 0
108165 +
108166 +static inline bool gimple_call_builtin_p(gimple stmt, enum built_in_function code)
108167 +{
108168 + tree fndecl;
108169 +
108170 + if (!is_gimple_call(stmt))
108171 + return false;
108172 + fndecl = gimple_call_fndecl(stmt);
108173 + if (!fndecl || DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL)
108174 + return false;
108175 +// print_node(stderr, "pax", fndecl, 4);
108176 + return DECL_FUNCTION_CODE(fndecl) == code;
108177 +}
108178 +
108179 +static inline bool is_simple_builtin(tree decl)
108180 +{
108181 + if (decl && DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL)
108182 + return false;
108183 +
108184 + switch (DECL_FUNCTION_CODE(decl)) {
108185 + /* Builtins that expand to constants. */
108186 + case BUILT_IN_CONSTANT_P:
108187 + case BUILT_IN_EXPECT:
108188 + case BUILT_IN_OBJECT_SIZE:
108189 + case BUILT_IN_UNREACHABLE:
108190 + /* Simple register moves or loads from stack. */
108191 + case BUILT_IN_RETURN_ADDRESS:
108192 + case BUILT_IN_EXTRACT_RETURN_ADDR:
108193 + case BUILT_IN_FROB_RETURN_ADDR:
108194 + case BUILT_IN_RETURN:
108195 + case BUILT_IN_AGGREGATE_INCOMING_ADDRESS:
108196 + case BUILT_IN_FRAME_ADDRESS:
108197 + case BUILT_IN_VA_END:
108198 + case BUILT_IN_STACK_SAVE:
108199 + case BUILT_IN_STACK_RESTORE:
108200 + /* Exception state returns or moves registers around. */
108201 + case BUILT_IN_EH_FILTER:
108202 + case BUILT_IN_EH_POINTER:
108203 + case BUILT_IN_EH_COPY_VALUES:
108204 + return true;
108205 +
108206 + default:
108207 + return false;
108208 + }
108209 +}
108210 +#endif
108211 +
108212 +#if BUILDING_GCC_VERSION <= 4006
108213 +#define ANY_RETURN_P(rtx) (GET_CODE(rtx) == RETURN)
108214 +#define C_DECL_REGISTER(EXP) DECL_LANG_FLAG_4(EXP)
108215 +
108216 +// should come from c-tree.h if only it were installed for gcc 4.5...
108217 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
108218 +
108219 +#define get_random_seed(noinit) ({ \
108220 + unsigned HOST_WIDE_INT seed; \
108221 + sscanf(get_random_seed(noinit), "%" HOST_WIDE_INT_PRINT "x", &seed); \
108222 + seed * seed; })
108223 +
108224 +static inline bool gimple_clobber_p(gimple s)
108225 +{
108226 + return false;
108227 +}
108228 +
108229 +static inline tree builtin_decl_implicit(enum built_in_function fncode)
108230 +{
108231 + return implicit_built_in_decls[fncode];
108232 +}
108233 +
108234 +static inline struct cgraph_node *cgraph_get_create_node(tree decl)
108235 +{
108236 + struct cgraph_node *node = cgraph_get_node(decl);
108237 +
108238 + return node ? node : cgraph_node(decl);
108239 +}
108240 +
108241 +static inline bool cgraph_function_with_gimple_body_p(struct cgraph_node *node)
108242 +{
108243 + return node->analyzed && !node->thunk.thunk_p && !node->alias;
108244 +}
108245 +
108246 +static inline struct cgraph_node *cgraph_first_function_with_gimple_body(void)
108247 +{
108248 + struct cgraph_node *node;
108249 +
108250 + for (node = cgraph_nodes; node; node = node->next)
108251 + if (cgraph_function_with_gimple_body_p(node))
108252 + return node;
108253 + return NULL;
108254 +}
108255 +
108256 +static inline struct cgraph_node *cgraph_next_function_with_gimple_body(struct cgraph_node *node)
108257 +{
108258 + for (node = node->next; node; node = node->next)
108259 + if (cgraph_function_with_gimple_body_p(node))
108260 + return node;
108261 + return NULL;
108262 +}
108263 +
108264 +#define FOR_EACH_FUNCTION_WITH_GIMPLE_BODY(node) \
108265 + for ((node) = cgraph_first_function_with_gimple_body(); (node); \
108266 + (node) = cgraph_next_function_with_gimple_body(node))
108267 +#endif
108268 +
108269 +#if BUILDING_GCC_VERSION == 4006
108270 +extern void debug_gimple_stmt(gimple);
108271 +extern void debug_gimple_seq(gimple_seq);
108272 +extern void print_gimple_seq(FILE *, gimple_seq, int, int);
108273 +extern void print_gimple_stmt(FILE *, gimple, int, int);
108274 +extern void print_gimple_expr(FILE *, gimple, int, int);
108275 +extern void dump_gimple_stmt(pretty_printer *, gimple, int, int);
108276 +#endif
108277 +
108278 +#if BUILDING_GCC_VERSION <= 4007
108279 +#define FOR_EACH_VARIABLE(node) for (node = varpool_nodes; node; node = node->next)
108280 +#define PROP_loops 0
108281 +
108282 +static inline int bb_loop_depth(const_basic_block bb)
108283 +{
108284 + return bb->loop_father ? loop_depth(bb->loop_father) : 0;
108285 +}
108286 +
108287 +static inline bool gimple_store_p(gimple gs)
108288 +{
108289 + tree lhs = gimple_get_lhs(gs);
108290 + return lhs && !is_gimple_reg(lhs);
108291 +}
108292 +#endif
108293 +
108294 +#if BUILDING_GCC_VERSION >= 4007
108295 +#define cgraph_create_edge(caller, callee, call_stmt, count, freq, nest) \
108296 + cgraph_create_edge((caller), (callee), (call_stmt), (count), (freq))
108297 +#define cgraph_create_edge_including_clones(caller, callee, old_call_stmt, call_stmt, count, freq, nest, reason) \
108298 + cgraph_create_edge_including_clones((caller), (callee), (old_call_stmt), (call_stmt), (count), (freq), (reason))
108299 +#endif
108300 +
108301 +#if BUILDING_GCC_VERSION <= 4008
108302 +#define ENTRY_BLOCK_PTR_FOR_FN(FN) ENTRY_BLOCK_PTR_FOR_FUNCTION(FN)
108303 +#define EXIT_BLOCK_PTR_FOR_FN(FN) EXIT_BLOCK_PTR_FOR_FUNCTION(FN)
108304 +#define basic_block_info_for_fn(FN) ((FN)->cfg->x_basic_block_info)
108305 +#define n_basic_blocks_for_fn(FN) ((FN)->cfg->x_n_basic_blocks)
108306 +#define n_edges_for_fn(FN) ((FN)->cfg->x_n_edges)
108307 +#define last_basic_block_for_fn(FN) ((FN)->cfg->x_last_basic_block)
108308 +#define label_to_block_map_for_fn(FN) ((FN)->cfg->x_label_to_block_map)
108309 +#define profile_status_for_fn(FN) ((FN)->cfg->x_profile_status)
108310 +
108311 +static inline const char *get_tree_code_name(enum tree_code code)
108312 +{
108313 + gcc_assert(code < MAX_TREE_CODES);
108314 + return tree_code_name[code];
108315 +}
108316 +
108317 +#define ipa_remove_stmt_references(cnode, stmt)
108318 +#endif
108319 +
108320 +#if BUILDING_GCC_VERSION == 4008
108321 +#define NODE_DECL(node) node->symbol.decl
108322 +#else
108323 +#define NODE_DECL(node) node->decl
108324 +#endif
108325 +
108326 +#if BUILDING_GCC_VERSION >= 4008
108327 +#define add_referenced_var(var)
108328 +#define mark_sym_for_renaming(var)
108329 +#define varpool_mark_needed_node(node)
108330 +#define TODO_dump_func 0
108331 +#define TODO_dump_cgraph 0
108332 +#endif
108333 +
108334 +#if BUILDING_GCC_VERSION >= 4009
108335 +#define TODO_ggc_collect 0
108336 +#endif
108337 +
108338 +#endif
108339 diff --git a/tools/gcc/gen-random-seed.sh b/tools/gcc/gen-random-seed.sh
108340 new file mode 100644
108341 index 0000000..7514850
108342 --- /dev/null
108343 +++ b/tools/gcc/gen-random-seed.sh
108344 @@ -0,0 +1,8 @@
108345 +#!/bin/sh
108346 +
108347 +if [ ! -f "$1" ]; then
108348 + SEED=`od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n'`
108349 + echo "const char *randstruct_seed = \"$SEED\";" > "$1"
108350 + HASH=`echo -n "$SEED" | sha256sum | cut -d" " -f1 | tr -d ' \n'`
108351 + echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
108352 +fi
108353 diff --git a/tools/gcc/kallocstat_plugin.c b/tools/gcc/kallocstat_plugin.c
108354 new file mode 100644
108355 index 0000000..d81c094
108356 --- /dev/null
108357 +++ b/tools/gcc/kallocstat_plugin.c
108358 @@ -0,0 +1,183 @@
108359 +/*
108360 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
108361 + * Licensed under the GPL v2
108362 + *
108363 + * Note: the choice of the license means that the compilation process is
108364 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
108365 + * but for the kernel it doesn't matter since it doesn't link against
108366 + * any of the gcc libraries
108367 + *
108368 + * gcc plugin to find the distribution of k*alloc sizes
108369 + *
108370 + * TODO:
108371 + *
108372 + * BUGS:
108373 + * - none known
108374 + */
108375 +
108376 +#include "gcc-common.h"
108377 +
108378 +int plugin_is_GPL_compatible;
108379 +
108380 +static struct plugin_info kallocstat_plugin_info = {
108381 + .version = "201401260140",
108382 + .help = NULL
108383 +};
108384 +
108385 +static const char * const kalloc_functions[] = {
108386 + "__kmalloc",
108387 + "kmalloc",
108388 + "kmalloc_large",
108389 + "kmalloc_node",
108390 + "kmalloc_order",
108391 + "kmalloc_order_trace",
108392 + "kmalloc_slab",
108393 + "kzalloc",
108394 + "kzalloc_node",
108395 +};
108396 +
108397 +static bool is_kalloc(const char *fnname)
108398 +{
108399 + size_t i;
108400 +
108401 + for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++)
108402 + if (!strcmp(fnname, kalloc_functions[i]))
108403 + return true;
108404 + return false;
108405 +}
108406 +
108407 +static unsigned int execute_kallocstat(void)
108408 +{
108409 + basic_block bb;
108410 +
108411 + // 1. loop through BBs and GIMPLE statements
108412 + FOR_EACH_BB_FN(bb, cfun) {
108413 + gimple_stmt_iterator gsi;
108414 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
108415 + // gimple match:
108416 + tree fndecl, size;
108417 + gimple stmt;
108418 + const char *fnname;
108419 +
108420 + // is it a call
108421 + stmt = gsi_stmt(gsi);
108422 + if (!is_gimple_call(stmt))
108423 + continue;
108424 + fndecl = gimple_call_fndecl(stmt);
108425 + if (fndecl == NULL_TREE)
108426 + continue;
108427 + if (TREE_CODE(fndecl) != FUNCTION_DECL)
108428 + continue;
108429 +
108430 + // is it a call to k*alloc
108431 + fnname = DECL_NAME_POINTER(fndecl);
108432 + if (!is_kalloc(fnname))
108433 + continue;
108434 +
108435 + // is the size arg const or the result of a simple const assignment
108436 + size = gimple_call_arg(stmt, 0);
108437 + while (true) {
108438 + expanded_location xloc;
108439 + size_t size_val;
108440 +
108441 + if (TREE_CONSTANT(size)) {
108442 + xloc = expand_location(gimple_location(stmt));
108443 + if (!xloc.file)
108444 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
108445 + size_val = TREE_INT_CST_LOW(size);
108446 + fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line);
108447 + break;
108448 + }
108449 +
108450 + if (TREE_CODE(size) != SSA_NAME)
108451 + break;
108452 + stmt = SSA_NAME_DEF_STMT(size);
108453 +//debug_gimple_stmt(stmt);
108454 +//debug_tree(size);
108455 + if (!stmt || !is_gimple_assign(stmt))
108456 + break;
108457 + if (gimple_num_ops(stmt) != 2)
108458 + break;
108459 + size = gimple_assign_rhs1(stmt);
108460 + }
108461 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
108462 +//debug_tree(gimple_call_fn(call_stmt));
108463 +//print_node(stderr, "pax", fndecl, 4);
108464 + }
108465 + }
108466 +
108467 + return 0;
108468 +}
108469 +
108470 +#if BUILDING_GCC_VERSION >= 4009
108471 +static const struct pass_data kallocstat_pass_data = {
108472 +#else
108473 +static struct gimple_opt_pass kallocstat_pass = {
108474 + .pass = {
108475 +#endif
108476 + .type = GIMPLE_PASS,
108477 + .name = "kallocstat",
108478 +#if BUILDING_GCC_VERSION >= 4008
108479 + .optinfo_flags = OPTGROUP_NONE,
108480 +#endif
108481 +#if BUILDING_GCC_VERSION >= 4009
108482 + .has_gate = false,
108483 + .has_execute = true,
108484 +#else
108485 + .gate = NULL,
108486 + .execute = execute_kallocstat,
108487 + .sub = NULL,
108488 + .next = NULL,
108489 + .static_pass_number = 0,
108490 +#endif
108491 + .tv_id = TV_NONE,
108492 + .properties_required = 0,
108493 + .properties_provided = 0,
108494 + .properties_destroyed = 0,
108495 + .todo_flags_start = 0,
108496 + .todo_flags_finish = 0
108497 +#if BUILDING_GCC_VERSION < 4009
108498 + }
108499 +#endif
108500 +};
108501 +
108502 +#if BUILDING_GCC_VERSION >= 4009
108503 +namespace {
108504 +class kallocstat_pass : public gimple_opt_pass {
108505 +public:
108506 + kallocstat_pass() : gimple_opt_pass(kallocstat_pass_data, g) {}
108507 + unsigned int execute() { return execute_kallocstat(); }
108508 +};
108509 +}
108510 +
108511 +static opt_pass *make_kallocstat_pass(void)
108512 +{
108513 + return new kallocstat_pass();
108514 +}
108515 +#else
108516 +static struct opt_pass *make_kallocstat_pass(void)
108517 +{
108518 + return &kallocstat_pass.pass;
108519 +}
108520 +#endif
108521 +
108522 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
108523 +{
108524 + const char * const plugin_name = plugin_info->base_name;
108525 + struct register_pass_info kallocstat_pass_info;
108526 +
108527 + kallocstat_pass_info.pass = make_kallocstat_pass();
108528 + kallocstat_pass_info.reference_pass_name = "ssa";
108529 + kallocstat_pass_info.ref_pass_instance_number = 1;
108530 + kallocstat_pass_info.pos_op = PASS_POS_INSERT_AFTER;
108531 +
108532 + if (!plugin_default_version_check(version, &gcc_version)) {
108533 + error(G_("incompatible gcc/plugin versions"));
108534 + return 1;
108535 + }
108536 +
108537 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info);
108538 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info);
108539 +
108540 + return 0;
108541 +}
108542 diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c
108543 new file mode 100644
108544 index 0000000..89f256d
108545 --- /dev/null
108546 +++ b/tools/gcc/kernexec_plugin.c
108547 @@ -0,0 +1,522 @@
108548 +/*
108549 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
108550 + * Licensed under the GPL v2
108551 + *
108552 + * Note: the choice of the license means that the compilation process is
108553 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
108554 + * but for the kernel it doesn't matter since it doesn't link against
108555 + * any of the gcc libraries
108556 + *
108557 + * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386
108558 + *
108559 + * TODO:
108560 + *
108561 + * BUGS:
108562 + * - none known
108563 + */
108564 +
108565 +#include "gcc-common.h"
108566 +
108567 +int plugin_is_GPL_compatible;
108568 +
108569 +static struct plugin_info kernexec_plugin_info = {
108570 + .version = "201401260140",
108571 + .help = "method=[bts|or]\tinstrumentation method\n"
108572 +};
108573 +
108574 +static void (*kernexec_instrument_fptr)(gimple_stmt_iterator *);
108575 +static void (*kernexec_instrument_retaddr)(rtx);
108576 +
108577 +/*
108578 + * add special KERNEXEC instrumentation: reload %r12 after it has been clobbered
108579 + */
108580 +static void kernexec_reload_fptr_mask(gimple_stmt_iterator *gsi)
108581 +{
108582 + gimple asm_movabs_stmt;
108583 +
108584 + // build asm volatile("movabs $0x8000000000000000, %%r12\n\t" : : : );
108585 + asm_movabs_stmt = gimple_build_asm_vec("movabs $0x8000000000000000, %%r12\n\t", NULL, NULL, NULL, NULL);
108586 + gimple_asm_set_volatile(asm_movabs_stmt, true);
108587 + gsi_insert_after(gsi, asm_movabs_stmt, GSI_CONTINUE_LINKING);
108588 + update_stmt(asm_movabs_stmt);
108589 +}
108590 +
108591 +/*
108592 + * find all asm() stmts that clobber r12 and add a reload of r12
108593 + */
108594 +static unsigned int execute_kernexec_reload(void)
108595 +{
108596 + basic_block bb;
108597 +
108598 + // 1. loop through BBs and GIMPLE statements
108599 + FOR_EACH_BB_FN(bb, cfun) {
108600 + gimple_stmt_iterator gsi;
108601 +
108602 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
108603 + // gimple match: __asm__ ("" : : : "r12");
108604 + gimple asm_stmt;
108605 + size_t nclobbers;
108606 +
108607 + // is it an asm ...
108608 + asm_stmt = gsi_stmt(gsi);
108609 + if (gimple_code(asm_stmt) != GIMPLE_ASM)
108610 + continue;
108611 +
108612 + // ... clobbering r12
108613 + nclobbers = gimple_asm_nclobbers(asm_stmt);
108614 + while (nclobbers--) {
108615 + tree op = gimple_asm_clobber_op(asm_stmt, nclobbers);
108616 + if (strcmp(TREE_STRING_POINTER(TREE_VALUE(op)), "r12"))
108617 + continue;
108618 + kernexec_reload_fptr_mask(&gsi);
108619 +//print_gimple_stmt(stderr, asm_stmt, 0, TDF_LINENO);
108620 + break;
108621 + }
108622 + }
108623 + }
108624 +
108625 + return 0;
108626 +}
108627 +
108628 +/*
108629 + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce
108630 + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference
108631 + */
108632 +static void kernexec_instrument_fptr_bts(gimple_stmt_iterator *gsi)
108633 +{
108634 + gimple assign_intptr, assign_new_fptr, call_stmt;
108635 + tree intptr, orptr, old_fptr, new_fptr, kernexec_mask;
108636 +
108637 + call_stmt = gsi_stmt(*gsi);
108638 + old_fptr = gimple_call_fn(call_stmt);
108639 +
108640 + // create temporary unsigned long variable used for bitops and cast fptr to it
108641 + intptr = create_tmp_var(long_unsigned_type_node, "kernexec_bts");
108642 + add_referenced_var(intptr);
108643 + intptr = make_ssa_name(intptr, NULL);
108644 + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr));
108645 + SSA_NAME_DEF_STMT(intptr) = assign_intptr;
108646 + gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
108647 + update_stmt(assign_intptr);
108648 +
108649 + // apply logical or to temporary unsigned long and bitmask
108650 + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL);
108651 +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL);
108652 + orptr = fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask);
108653 + intptr = make_ssa_name(SSA_NAME_VAR(intptr), NULL);
108654 + assign_intptr = gimple_build_assign(intptr, orptr);
108655 + SSA_NAME_DEF_STMT(intptr) = assign_intptr;
108656 + gsi_insert_before(gsi, assign_intptr, GSI_SAME_STMT);
108657 + update_stmt(assign_intptr);
108658 +
108659 + // cast temporary unsigned long back to a temporary fptr variable
108660 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_fptr");
108661 + add_referenced_var(new_fptr);
108662 + new_fptr = make_ssa_name(new_fptr, NULL);
108663 + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr));
108664 + SSA_NAME_DEF_STMT(new_fptr) = assign_new_fptr;
108665 + gsi_insert_before(gsi, assign_new_fptr, GSI_SAME_STMT);
108666 + update_stmt(assign_new_fptr);
108667 +
108668 + // replace call stmt fn with the new fptr
108669 + gimple_call_set_fn(call_stmt, new_fptr);
108670 + update_stmt(call_stmt);
108671 +}
108672 +
108673 +static void kernexec_instrument_fptr_or(gimple_stmt_iterator *gsi)
108674 +{
108675 + gimple asm_or_stmt, call_stmt;
108676 + tree old_fptr, new_fptr, input, output;
108677 +#if BUILDING_GCC_VERSION <= 4007
108678 + VEC(tree, gc) *inputs = NULL;
108679 + VEC(tree, gc) *outputs = NULL;
108680 +#else
108681 + vec<tree, va_gc> *inputs = NULL;
108682 + vec<tree, va_gc> *outputs = NULL;
108683 +#endif
108684 +
108685 + call_stmt = gsi_stmt(*gsi);
108686 + old_fptr = gimple_call_fn(call_stmt);
108687 +
108688 + // create temporary fptr variable
108689 + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), "kernexec_or");
108690 + add_referenced_var(new_fptr);
108691 + new_fptr = make_ssa_name(new_fptr, NULL);
108692 +
108693 + // build asm volatile("orq %%r12, %0\n\t" : "=r"(new_fptr) : "0"(old_fptr));
108694 + input = build_tree_list(NULL_TREE, build_string(1, "0"));
108695 + input = chainon(NULL_TREE, build_tree_list(input, old_fptr));
108696 + output = build_tree_list(NULL_TREE, build_string(2, "=r"));
108697 + output = chainon(NULL_TREE, build_tree_list(output, new_fptr));
108698 +#if BUILDING_GCC_VERSION <= 4007
108699 + VEC_safe_push(tree, gc, inputs, input);
108700 + VEC_safe_push(tree, gc, outputs, output);
108701 +#else
108702 + vec_safe_push(inputs, input);
108703 + vec_safe_push(outputs, output);
108704 +#endif
108705 + asm_or_stmt = gimple_build_asm_vec("orq %%r12, %0\n\t", inputs, outputs, NULL, NULL);
108706 + SSA_NAME_DEF_STMT(new_fptr) = asm_or_stmt;
108707 + gimple_asm_set_volatile(asm_or_stmt, true);
108708 + gsi_insert_before(gsi, asm_or_stmt, GSI_SAME_STMT);
108709 + update_stmt(asm_or_stmt);
108710 +
108711 + // replace call stmt fn with the new fptr
108712 + gimple_call_set_fn(call_stmt, new_fptr);
108713 + update_stmt(call_stmt);
108714 +}
108715 +
108716 +/*
108717 + * find all C level function pointer dereferences and forcibly set the highest bit of the pointer
108718 + */
108719 +static unsigned int execute_kernexec_fptr(void)
108720 +{
108721 + basic_block bb;
108722 +
108723 + // 1. loop through BBs and GIMPLE statements
108724 + FOR_EACH_BB_FN(bb, cfun) {
108725 + gimple_stmt_iterator gsi;
108726 +
108727 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
108728 + // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D));
108729 + tree fn;
108730 + gimple call_stmt;
108731 +
108732 + // is it a call ...
108733 + call_stmt = gsi_stmt(gsi);
108734 + if (!is_gimple_call(call_stmt))
108735 + continue;
108736 + fn = gimple_call_fn(call_stmt);
108737 + if (TREE_CODE(fn) == ADDR_EXPR)
108738 + continue;
108739 + if (TREE_CODE(fn) != SSA_NAME)
108740 + gcc_unreachable();
108741 +
108742 + // ... through a function pointer
108743 + if (SSA_NAME_VAR(fn) != NULL_TREE) {
108744 + fn = SSA_NAME_VAR(fn);
108745 + if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL) {
108746 + debug_tree(fn);
108747 + gcc_unreachable();
108748 + }
108749 + }
108750 + fn = TREE_TYPE(fn);
108751 + if (TREE_CODE(fn) != POINTER_TYPE)
108752 + continue;
108753 + fn = TREE_TYPE(fn);
108754 + if (TREE_CODE(fn) != FUNCTION_TYPE)
108755 + continue;
108756 +
108757 + kernexec_instrument_fptr(&gsi);
108758 +
108759 +//debug_tree(gimple_call_fn(call_stmt));
108760 +//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO);
108761 + }
108762 + }
108763 +
108764 + return 0;
108765 +}
108766 +
108767 +// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn
108768 +static void kernexec_instrument_retaddr_bts(rtx insn)
108769 +{
108770 + rtx btsq;
108771 + rtvec argvec, constraintvec, labelvec;
108772 + int line;
108773 +
108774 + // create asm volatile("btsq $63,(%%rsp)":::)
108775 + argvec = rtvec_alloc(0);
108776 + constraintvec = rtvec_alloc(0);
108777 + labelvec = rtvec_alloc(0);
108778 + line = expand_location(RTL_LOCATION(insn)).line;
108779 + btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
108780 + MEM_VOLATILE_P(btsq) = 1;
108781 +// RTX_FRAME_RELATED_P(btsq) = 1; // not for ASM_OPERANDS
108782 + emit_insn_before(btsq, insn);
108783 +}
108784 +
108785 +// add special KERNEXEC instrumentation: orq %r12,(%rsp) just before retn
108786 +static void kernexec_instrument_retaddr_or(rtx insn)
108787 +{
108788 + rtx orq;
108789 + rtvec argvec, constraintvec, labelvec;
108790 + int line;
108791 +
108792 + // create asm volatile("orq %%r12,(%%rsp)":::)
108793 + argvec = rtvec_alloc(0);
108794 + constraintvec = rtvec_alloc(0);
108795 + labelvec = rtvec_alloc(0);
108796 + line = expand_location(RTL_LOCATION(insn)).line;
108797 + orq = gen_rtx_ASM_OPERANDS(VOIDmode, "orq %%r12,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line);
108798 + MEM_VOLATILE_P(orq) = 1;
108799 +// RTX_FRAME_RELATED_P(orq) = 1; // not for ASM_OPERANDS
108800 + emit_insn_before(orq, insn);
108801 +}
108802 +
108803 +/*
108804 + * find all asm level function returns and forcibly set the highest bit of the return address
108805 + */
108806 +static unsigned int execute_kernexec_retaddr(void)
108807 +{
108808 + rtx insn;
108809 +
108810 +// if (stack_realign_drap)
108811 +// inform(DECL_SOURCE_LOCATION(current_function_decl), "drap detected in %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
108812 +
108813 + // 1. find function returns
108814 + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
108815 + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil))
108816 + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil))
108817 + // (jump_insn 97 96 98 6 (simple_return) fptr.c:50 -1 (nil) -> simple_return)
108818 + rtx body;
108819 +
108820 + // is it a retn
108821 + if (!JUMP_P(insn))
108822 + continue;
108823 + body = PATTERN(insn);
108824 + if (GET_CODE(body) == PARALLEL)
108825 + body = XVECEXP(body, 0, 0);
108826 + if (!ANY_RETURN_P(body))
108827 + continue;
108828 + kernexec_instrument_retaddr(insn);
108829 + }
108830 +
108831 +// print_simple_rtl(stderr, get_insns());
108832 +// print_rtl(stderr, get_insns());
108833 +
108834 + return 0;
108835 +}
108836 +
108837 +static bool kernexec_cmodel_check(void)
108838 +{
108839 + tree section;
108840 +
108841 + if (ix86_cmodel != CM_KERNEL)
108842 + return false;
108843 +
108844 + section = lookup_attribute("section", DECL_ATTRIBUTES(current_function_decl));
108845 + if (!section || !TREE_VALUE(section))
108846 + return true;
108847 +
108848 + section = TREE_VALUE(TREE_VALUE(section));
108849 + if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10))
108850 + return true;
108851 +
108852 + return false;
108853 +}
108854 +
108855 +#if BUILDING_GCC_VERSION >= 4009
108856 +static const struct pass_data kernexec_reload_pass_data = {
108857 +#else
108858 +static struct gimple_opt_pass kernexec_reload_pass = {
108859 + .pass = {
108860 +#endif
108861 + .type = GIMPLE_PASS,
108862 + .name = "kernexec_reload",
108863 +#if BUILDING_GCC_VERSION >= 4008
108864 + .optinfo_flags = OPTGROUP_NONE,
108865 +#endif
108866 +#if BUILDING_GCC_VERSION >= 4009
108867 + .has_gate = true,
108868 + .has_execute = true,
108869 +#else
108870 + .gate = kernexec_cmodel_check,
108871 + .execute = execute_kernexec_reload,
108872 + .sub = NULL,
108873 + .next = NULL,
108874 + .static_pass_number = 0,
108875 +#endif
108876 + .tv_id = TV_NONE,
108877 + .properties_required = 0,
108878 + .properties_provided = 0,
108879 + .properties_destroyed = 0,
108880 + .todo_flags_start = 0,
108881 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
108882 +#if BUILDING_GCC_VERSION < 4009
108883 + }
108884 +#endif
108885 +};
108886 +
108887 +#if BUILDING_GCC_VERSION >= 4009
108888 +static const struct pass_data kernexec_fptr_pass_data = {
108889 +#else
108890 +static struct gimple_opt_pass kernexec_fptr_pass = {
108891 + .pass = {
108892 +#endif
108893 + .type = GIMPLE_PASS,
108894 + .name = "kernexec_fptr",
108895 +#if BUILDING_GCC_VERSION >= 4008
108896 + .optinfo_flags = OPTGROUP_NONE,
108897 +#endif
108898 +#if BUILDING_GCC_VERSION >= 4009
108899 + .has_gate = true,
108900 + .has_execute = true,
108901 +#else
108902 + .gate = kernexec_cmodel_check,
108903 + .execute = execute_kernexec_fptr,
108904 + .sub = NULL,
108905 + .next = NULL,
108906 + .static_pass_number = 0,
108907 +#endif
108908 + .tv_id = TV_NONE,
108909 + .properties_required = 0,
108910 + .properties_provided = 0,
108911 + .properties_destroyed = 0,
108912 + .todo_flags_start = 0,
108913 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi
108914 +#if BUILDING_GCC_VERSION < 4009
108915 + }
108916 +#endif
108917 +};
108918 +
108919 +#if BUILDING_GCC_VERSION >= 4009
108920 +static const struct pass_data kernexec_retaddr_pass_data = {
108921 +#else
108922 +static struct rtl_opt_pass kernexec_retaddr_pass = {
108923 + .pass = {
108924 +#endif
108925 + .type = RTL_PASS,
108926 + .name = "kernexec_retaddr",
108927 +#if BUILDING_GCC_VERSION >= 4008
108928 + .optinfo_flags = OPTGROUP_NONE,
108929 +#endif
108930 +#if BUILDING_GCC_VERSION >= 4009
108931 + .has_gate = true,
108932 + .has_execute = true,
108933 +#else
108934 + .gate = kernexec_cmodel_check,
108935 + .execute = execute_kernexec_retaddr,
108936 + .sub = NULL,
108937 + .next = NULL,
108938 + .static_pass_number = 0,
108939 +#endif
108940 + .tv_id = TV_NONE,
108941 + .properties_required = 0,
108942 + .properties_provided = 0,
108943 + .properties_destroyed = 0,
108944 + .todo_flags_start = 0,
108945 + .todo_flags_finish = TODO_dump_func | TODO_ggc_collect
108946 +#if BUILDING_GCC_VERSION < 4009
108947 + }
108948 +#endif
108949 +};
108950 +
108951 +#if BUILDING_GCC_VERSION >= 4009
108952 +namespace {
108953 +class kernexec_reload_pass : public gimple_opt_pass {
108954 +public:
108955 + kernexec_reload_pass() : gimple_opt_pass(kernexec_reload_pass_data, g) {}
108956 + bool gate() { return kernexec_cmodel_check(); }
108957 + unsigned int execute() { return execute_kernexec_reload(); }
108958 +};
108959 +
108960 +class kernexec_fptr_pass : public gimple_opt_pass {
108961 +public:
108962 + kernexec_fptr_pass() : gimple_opt_pass(kernexec_fptr_pass_data, g) {}
108963 + bool gate() { return kernexec_cmodel_check(); }
108964 + unsigned int execute() { return execute_kernexec_fptr(); }
108965 +};
108966 +
108967 +class kernexec_retaddr_pass : public rtl_opt_pass {
108968 +public:
108969 + kernexec_retaddr_pass() : rtl_opt_pass(kernexec_retaddr_pass_data, g) {}
108970 + bool gate() { return kernexec_cmodel_check(); }
108971 + unsigned int execute() { return execute_kernexec_retaddr(); }
108972 +};
108973 +}
108974 +
108975 +static opt_pass *make_kernexec_reload_pass(void)
108976 +{
108977 + return new kernexec_reload_pass();
108978 +}
108979 +
108980 +static opt_pass *make_kernexec_fptr_pass(void)
108981 +{
108982 + return new kernexec_fptr_pass();
108983 +}
108984 +
108985 +static opt_pass *make_kernexec_retaddr_pass(void)
108986 +{
108987 + return new kernexec_retaddr_pass();
108988 +}
108989 +#else
108990 +static struct opt_pass *make_kernexec_reload_pass(void)
108991 +{
108992 + return &kernexec_reload_pass.pass;
108993 +}
108994 +
108995 +static struct opt_pass *make_kernexec_fptr_pass(void)
108996 +{
108997 + return &kernexec_fptr_pass.pass;
108998 +}
108999 +
109000 +static struct opt_pass *make_kernexec_retaddr_pass(void)
109001 +{
109002 + return &kernexec_retaddr_pass.pass;
109003 +}
109004 +#endif
109005 +
109006 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
109007 +{
109008 + const char * const plugin_name = plugin_info->base_name;
109009 + const int argc = plugin_info->argc;
109010 + const struct plugin_argument * const argv = plugin_info->argv;
109011 + int i;
109012 + struct register_pass_info kernexec_reload_pass_info;
109013 + struct register_pass_info kernexec_fptr_pass_info;
109014 + struct register_pass_info kernexec_retaddr_pass_info;
109015 +
109016 + kernexec_reload_pass_info.pass = make_kernexec_reload_pass();
109017 + kernexec_reload_pass_info.reference_pass_name = "ssa";
109018 + kernexec_reload_pass_info.ref_pass_instance_number = 1;
109019 + kernexec_reload_pass_info.pos_op = PASS_POS_INSERT_AFTER;
109020 +
109021 + kernexec_fptr_pass_info.pass = make_kernexec_fptr_pass();
109022 + kernexec_fptr_pass_info.reference_pass_name = "ssa";
109023 + kernexec_fptr_pass_info.ref_pass_instance_number = 1;
109024 + kernexec_fptr_pass_info.pos_op = PASS_POS_INSERT_AFTER;
109025 +
109026 + kernexec_retaddr_pass_info.pass = make_kernexec_retaddr_pass();
109027 + kernexec_retaddr_pass_info.reference_pass_name = "pro_and_epilogue";
109028 + kernexec_retaddr_pass_info.ref_pass_instance_number = 1;
109029 + kernexec_retaddr_pass_info.pos_op = PASS_POS_INSERT_AFTER;
109030 +
109031 + if (!plugin_default_version_check(version, &gcc_version)) {
109032 + error(G_("incompatible gcc/plugin versions"));
109033 + return 1;
109034 + }
109035 +
109036 + register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info);
109037 +
109038 + if (TARGET_64BIT == 0)
109039 + return 0;
109040 +
109041 + for (i = 0; i < argc; ++i) {
109042 + if (!strcmp(argv[i].key, "method")) {
109043 + if (!argv[i].value) {
109044 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
109045 + continue;
109046 + }
109047 + if (!strcmp(argv[i].value, "bts")) {
109048 + kernexec_instrument_fptr = kernexec_instrument_fptr_bts;
109049 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_bts;
109050 + } else if (!strcmp(argv[i].value, "or")) {
109051 + kernexec_instrument_fptr = kernexec_instrument_fptr_or;
109052 + kernexec_instrument_retaddr = kernexec_instrument_retaddr_or;
109053 + fix_register("r12", 1, 1);
109054 + } else
109055 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
109056 + continue;
109057 + }
109058 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
109059 + }
109060 + if (!kernexec_instrument_fptr || !kernexec_instrument_retaddr)
109061 + error(G_("no instrumentation method was selected via '-fplugin-arg-%s-method'"), plugin_name);
109062 +
109063 + if (kernexec_instrument_fptr == kernexec_instrument_fptr_or)
109064 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_reload_pass_info);
109065 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info);
109066 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info);
109067 +
109068 + return 0;
109069 +}
109070 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
109071 new file mode 100644
109072 index 0000000..39d7cc7
109073 --- /dev/null
109074 +++ b/tools/gcc/latent_entropy_plugin.c
109075 @@ -0,0 +1,462 @@
109076 +/*
109077 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
109078 + * Licensed under the GPL v2
109079 + *
109080 + * Note: the choice of the license means that the compilation process is
109081 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
109082 + * but for the kernel it doesn't matter since it doesn't link against
109083 + * any of the gcc libraries
109084 + *
109085 + * gcc plugin to help generate a little bit of entropy from program state,
109086 + * used throughout the uptime of the kernel
109087 + *
109088 + * TODO:
109089 + * - add ipa pass to identify not explicitly marked candidate functions
109090 + * - mix in more program state (function arguments/return values, loop variables, etc)
109091 + * - more instrumentation control via attribute parameters
109092 + *
109093 + * BUGS:
109094 + * - LTO needs -flto-partition=none for now
109095 + */
109096 +
109097 +#include "gcc-common.h"
109098 +
109099 +int plugin_is_GPL_compatible;
109100 +
109101 +static tree latent_entropy_decl;
109102 +
109103 +static struct plugin_info latent_entropy_plugin_info = {
109104 + .version = "201403280150",
109105 + .help = NULL
109106 +};
109107 +
109108 +static unsigned HOST_WIDE_INT seed;
109109 +static unsigned HOST_WIDE_INT get_random_const(void)
109110 +{
109111 + unsigned int i;
109112 + unsigned HOST_WIDE_INT ret = 0;
109113 +
109114 + for (i = 0; i < 8 * sizeof ret; i++) {
109115 + ret = (ret << 1) | (seed & 1);
109116 + seed >>= 1;
109117 + if (ret & 1)
109118 + seed ^= 0xD800000000000000ULL;
109119 + }
109120 +
109121 + return ret;
109122 +}
109123 +
109124 +static tree handle_latent_entropy_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
109125 +{
109126 + tree type;
109127 + unsigned long long mask;
109128 +#if BUILDING_GCC_VERSION <= 4007
109129 + VEC(constructor_elt, gc) *vals;
109130 +#else
109131 + vec<constructor_elt, va_gc> *vals;
109132 +#endif
109133 +
109134 + switch (TREE_CODE(*node)) {
109135 + default:
109136 + *no_add_attrs = true;
109137 + error("%qE attribute only applies to functions and variables", name);
109138 + break;
109139 +
109140 + case VAR_DECL:
109141 + if (DECL_INITIAL(*node)) {
109142 + *no_add_attrs = true;
109143 + error("variable %qD with %qE attribute must not be initialized", *node, name);
109144 + break;
109145 + }
109146 +
109147 + if (!TREE_STATIC(*node)) {
109148 + *no_add_attrs = true;
109149 + error("variable %qD with %qE attribute must not be local", *node, name);
109150 + break;
109151 + }
109152 +
109153 + type = TREE_TYPE(*node);
109154 + switch (TREE_CODE(type)) {
109155 + default:
109156 + *no_add_attrs = true;
109157 + error("variable %qD with %qE attribute must be an integer or a fixed length integer array type or a fixed sized structure with integer fields", *node, name);
109158 + break;
109159 +
109160 + case RECORD_TYPE: {
109161 + tree field;
109162 + unsigned int nelt = 0;
109163 +
109164 + for (field = TYPE_FIELDS(type); field; nelt++, field = TREE_CHAIN(field)) {
109165 + tree fieldtype;
109166 +
109167 + fieldtype = TREE_TYPE(field);
109168 + if (TREE_CODE(fieldtype) != INTEGER_TYPE) {
109169 + *no_add_attrs = true;
109170 + error("structure variable %qD with %qE attribute has a non-integer field %qE", *node, name, field);
109171 + break;
109172 + }
109173 + }
109174 +
109175 + if (field)
109176 + break;
109177 +
109178 +#if BUILDING_GCC_VERSION <= 4007
109179 + vals = VEC_alloc(constructor_elt, gc, nelt);
109180 +#else
109181 + vec_alloc(vals, nelt);
109182 +#endif
109183 +
109184 + for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
109185 + tree fieldtype;
109186 +
109187 + fieldtype = TREE_TYPE(field);
109188 + mask = 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(fieldtype)) - 1);
109189 + mask = 2 * (mask - 1) + 1;
109190 +
109191 + if (TYPE_UNSIGNED(fieldtype))
109192 + CONSTRUCTOR_APPEND_ELT(vals, field, build_int_cstu(fieldtype, mask & get_random_const()));
109193 + else
109194 + CONSTRUCTOR_APPEND_ELT(vals, field, build_int_cst(fieldtype, mask & get_random_const()));
109195 + }
109196 +
109197 + DECL_INITIAL(*node) = build_constructor(type, vals);
109198 +//debug_tree(DECL_INITIAL(*node));
109199 + break;
109200 + }
109201 +
109202 + case INTEGER_TYPE:
109203 + mask = 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(type)) - 1);
109204 + mask = 2 * (mask - 1) + 1;
109205 +
109206 + if (TYPE_UNSIGNED(type))
109207 + DECL_INITIAL(*node) = build_int_cstu(type, mask & get_random_const());
109208 + else
109209 + DECL_INITIAL(*node) = build_int_cst(type, mask & get_random_const());
109210 + break;
109211 +
109212 + case ARRAY_TYPE: {
109213 + tree elt_type, array_size, elt_size;
109214 + unsigned int i, nelt;
109215 +
109216 + elt_type = TREE_TYPE(type);
109217 + elt_size = TYPE_SIZE_UNIT(TREE_TYPE(type));
109218 + array_size = TYPE_SIZE_UNIT(type);
109219 +
109220 + if (TREE_CODE(elt_type) != INTEGER_TYPE || !array_size || TREE_CODE(array_size) != INTEGER_CST) {
109221 + *no_add_attrs = true;
109222 + error("array variable %qD with %qE attribute must be a fixed length integer array type", *node, name);
109223 + break;
109224 + }
109225 +
109226 + nelt = TREE_INT_CST_LOW(array_size) / TREE_INT_CST_LOW(elt_size);
109227 +#if BUILDING_GCC_VERSION <= 4007
109228 + vals = VEC_alloc(constructor_elt, gc, nelt);
109229 +#else
109230 + vec_alloc(vals, nelt);
109231 +#endif
109232 +
109233 + mask = 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(elt_type)) - 1);
109234 + mask = 2 * (mask - 1) + 1;
109235 +
109236 + for (i = 0; i < nelt; i++)
109237 + if (TYPE_UNSIGNED(elt_type))
109238 + CONSTRUCTOR_APPEND_ELT(vals, size_int(i), build_int_cstu(elt_type, mask & get_random_const()));
109239 + else
109240 + CONSTRUCTOR_APPEND_ELT(vals, size_int(i), build_int_cst(elt_type, mask & get_random_const()));
109241 +
109242 + DECL_INITIAL(*node) = build_constructor(type, vals);
109243 +//debug_tree(DECL_INITIAL(*node));
109244 + break;
109245 + }
109246 + }
109247 + break;
109248 +
109249 + case FUNCTION_DECL:
109250 + break;
109251 + }
109252 +
109253 + return NULL_TREE;
109254 +}
109255 +
109256 +static struct attribute_spec latent_entropy_attr = {
109257 + .name = "latent_entropy",
109258 + .min_length = 0,
109259 + .max_length = 0,
109260 + .decl_required = true,
109261 + .type_required = false,
109262 + .function_type_required = false,
109263 + .handler = handle_latent_entropy_attribute,
109264 +#if BUILDING_GCC_VERSION >= 4007
109265 + .affects_type_identity = false
109266 +#endif
109267 +};
109268 +
109269 +static void register_attributes(void *event_data, void *data)
109270 +{
109271 + register_attribute(&latent_entropy_attr);
109272 +}
109273 +
109274 +static bool gate_latent_entropy(void)
109275 +{
109276 + // don't bother with noreturn functions for now
109277 + if (TREE_THIS_VOLATILE(current_function_decl))
109278 + return false;
109279 +
109280 + return lookup_attribute("latent_entropy", DECL_ATTRIBUTES(current_function_decl)) != NULL_TREE;
109281 +}
109282 +
109283 +static enum tree_code get_op(tree *rhs)
109284 +{
109285 + static enum tree_code op;
109286 + unsigned HOST_WIDE_INT random_const;
109287 +
109288 + random_const = get_random_const();
109289 +
109290 + switch (op) {
109291 + case BIT_XOR_EXPR:
109292 + op = PLUS_EXPR;
109293 + break;
109294 +
109295 + case PLUS_EXPR:
109296 + if (rhs) {
109297 + op = LROTATE_EXPR;
109298 + random_const &= HOST_BITS_PER_WIDE_INT - 1;
109299 + break;
109300 + }
109301 +
109302 + case LROTATE_EXPR:
109303 + default:
109304 + op = BIT_XOR_EXPR;
109305 + break;
109306 + }
109307 + if (rhs)
109308 + *rhs = build_int_cstu(unsigned_intDI_type_node, random_const);
109309 + return op;
109310 +}
109311 +
109312 +static void perturb_local_entropy(basic_block bb, tree local_entropy)
109313 +{
109314 + gimple_stmt_iterator gsi;
109315 + gimple assign;
109316 + tree addxorrol, rhs;
109317 + enum tree_code op;
109318 +
109319 + op = get_op(&rhs);
109320 + addxorrol = fold_build2_loc(UNKNOWN_LOCATION, op, unsigned_intDI_type_node, local_entropy, rhs);
109321 + assign = gimple_build_assign(local_entropy, addxorrol);
109322 + gsi = gsi_after_labels(bb);
109323 + gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
109324 + update_stmt(assign);
109325 +//debug_bb(bb);
109326 +}
109327 +
109328 +static void perturb_latent_entropy(basic_block bb, tree rhs)
109329 +{
109330 + gimple_stmt_iterator gsi;
109331 + gimple assign;
109332 + tree addxorrol, temp;
109333 +
109334 + // 1. create temporary copy of latent_entropy
109335 + temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
109336 + add_referenced_var(temp);
109337 +
109338 + // 2. read...
109339 + temp = make_ssa_name(temp, NULL);
109340 + assign = gimple_build_assign(temp, latent_entropy_decl);
109341 + SSA_NAME_DEF_STMT(temp) = assign;
109342 + add_referenced_var(latent_entropy_decl);
109343 + gsi = gsi_after_labels(bb);
109344 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
109345 + update_stmt(assign);
109346 +
109347 + // 3. ...modify...
109348 + addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
109349 + temp = make_ssa_name(SSA_NAME_VAR(temp), NULL);
109350 + assign = gimple_build_assign(temp, addxorrol);
109351 + SSA_NAME_DEF_STMT(temp) = assign;
109352 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
109353 + update_stmt(assign);
109354 +
109355 + // 4. ...write latent_entropy
109356 + assign = gimple_build_assign(latent_entropy_decl, temp);
109357 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
109358 + update_stmt(assign);
109359 +}
109360 +
109361 +static unsigned int execute_latent_entropy(void)
109362 +{
109363 + basic_block bb;
109364 + gimple assign;
109365 + gimple_stmt_iterator gsi;
109366 + tree local_entropy;
109367 +
109368 + if (!latent_entropy_decl) {
109369 +#if BUILDING_GCC_VERSION >= 4009
109370 + varpool_node *node;
109371 +#else
109372 + struct varpool_node *node;
109373 +#endif
109374 +
109375 + FOR_EACH_VARIABLE(node) {
109376 + tree var = NODE_DECL(node);
109377 +
109378 + if (strcmp(IDENTIFIER_POINTER(DECL_NAME(var)), "latent_entropy"))
109379 + continue;
109380 + latent_entropy_decl = var;
109381 +// debug_tree(var);
109382 + break;
109383 + }
109384 + if (!latent_entropy_decl) {
109385 +// debug_tree(current_function_decl);
109386 + return 0;
109387 + }
109388 + }
109389 +
109390 +//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
109391 +
109392 + // 1. create local entropy variable
109393 + local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
109394 + add_referenced_var(local_entropy);
109395 + mark_sym_for_renaming(local_entropy);
109396 +
109397 + // 2. initialize local entropy variable
109398 + bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
109399 + if (dom_info_available_p(CDI_DOMINATORS))
109400 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
109401 + gsi = gsi_start_bb(bb);
109402 +
109403 + assign = gimple_build_assign(local_entropy, build_int_cstu(unsigned_intDI_type_node, get_random_const()));
109404 +// gimple_set_location(assign, loc);
109405 + gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
109406 + update_stmt(assign);
109407 +//debug_bb(bb);
109408 + gcc_assert(single_succ_p(bb));
109409 + bb = single_succ(bb);
109410 +
109411 + // 3. instrument each BB with an operation on the local entropy variable
109412 + while (bb != EXIT_BLOCK_PTR_FOR_FN(cfun)) {
109413 + perturb_local_entropy(bb, local_entropy);
109414 +//debug_bb(bb);
109415 + bb = bb->next_bb;
109416 + };
109417 +
109418 + // 4. mix local entropy into the global entropy variable
109419 + gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
109420 + perturb_latent_entropy(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)), local_entropy);
109421 +//debug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
109422 + return 0;
109423 +}
109424 +
109425 +static void latent_entropy_start_unit(void *gcc_data, void *user_data)
109426 +{
109427 + tree latent_entropy_type;
109428 +
109429 + seed = get_random_seed(false);
109430 +
109431 + if (in_lto_p)
109432 + return;
109433 +
109434 + // extern volatile u64 latent_entropy
109435 + gcc_assert(TYPE_PRECISION(long_long_unsigned_type_node) == 64);
109436 + latent_entropy_type = build_qualified_type(long_long_unsigned_type_node, TYPE_QUALS(long_long_unsigned_type_node) | TYPE_QUAL_VOLATILE);
109437 + latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), latent_entropy_type);
109438 +
109439 + TREE_STATIC(latent_entropy_decl) = 1;
109440 + TREE_PUBLIC(latent_entropy_decl) = 1;
109441 + TREE_USED(latent_entropy_decl) = 1;
109442 + TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
109443 + DECL_EXTERNAL(latent_entropy_decl) = 1;
109444 + DECL_ARTIFICIAL(latent_entropy_decl) = 1;
109445 + lang_hooks.decls.pushdecl(latent_entropy_decl);
109446 +// DECL_ASSEMBLER_NAME(latent_entropy_decl);
109447 +// varpool_finalize_decl(latent_entropy_decl);
109448 +// varpool_mark_needed_node(latent_entropy_decl);
109449 +}
109450 +
109451 +#if BUILDING_GCC_VERSION >= 4009
109452 +static const struct pass_data latent_entropy_pass_data = {
109453 +#else
109454 +static struct gimple_opt_pass latent_entropy_pass = {
109455 + .pass = {
109456 +#endif
109457 + .type = GIMPLE_PASS,
109458 + .name = "latent_entropy",
109459 +#if BUILDING_GCC_VERSION >= 4008
109460 + .optinfo_flags = OPTGROUP_NONE,
109461 +#endif
109462 +#if BUILDING_GCC_VERSION >= 4009
109463 + .has_gate = true,
109464 + .has_execute = true,
109465 +#else
109466 + .gate = gate_latent_entropy,
109467 + .execute = execute_latent_entropy,
109468 + .sub = NULL,
109469 + .next = NULL,
109470 + .static_pass_number = 0,
109471 +#endif
109472 + .tv_id = TV_NONE,
109473 + .properties_required = PROP_gimple_leh | PROP_cfg,
109474 + .properties_provided = 0,
109475 + .properties_destroyed = 0,
109476 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
109477 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa
109478 +#if BUILDING_GCC_VERSION < 4009
109479 + }
109480 +#endif
109481 +};
109482 +
109483 +#if BUILDING_GCC_VERSION >= 4009
109484 +namespace {
109485 +class latent_entropy_pass : public gimple_opt_pass {
109486 +public:
109487 + latent_entropy_pass() : gimple_opt_pass(latent_entropy_pass_data, g) {}
109488 + bool gate() { return gate_latent_entropy(); }
109489 + unsigned int execute() { return execute_latent_entropy(); }
109490 +};
109491 +}
109492 +
109493 +static opt_pass *make_latent_entropy_pass(void)
109494 +{
109495 + return new latent_entropy_pass();
109496 +}
109497 +#else
109498 +static struct opt_pass *make_latent_entropy_pass(void)
109499 +{
109500 + return &latent_entropy_pass.pass;
109501 +}
109502 +#endif
109503 +
109504 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
109505 +{
109506 + const char * const plugin_name = plugin_info->base_name;
109507 + struct register_pass_info latent_entropy_pass_info;
109508 +
109509 + latent_entropy_pass_info.pass = make_latent_entropy_pass();
109510 + latent_entropy_pass_info.reference_pass_name = "optimized";
109511 + latent_entropy_pass_info.ref_pass_instance_number = 1;
109512 + latent_entropy_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
109513 + static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
109514 + {
109515 + .base = &latent_entropy_decl,
109516 + .nelt = 1,
109517 + .stride = sizeof(latent_entropy_decl),
109518 + .cb = &gt_ggc_mx_tree_node,
109519 + .pchw = &gt_pch_nx_tree_node
109520 + },
109521 + LAST_GGC_ROOT_TAB
109522 + };
109523 +
109524 + if (!plugin_default_version_check(version, &gcc_version)) {
109525 + error(G_("incompatible gcc/plugin versions"));
109526 + return 1;
109527 + }
109528 +
109529 + register_callback(plugin_name, PLUGIN_INFO, NULL, &latent_entropy_plugin_info);
109530 + register_callback(plugin_name, PLUGIN_START_UNIT, &latent_entropy_start_unit, NULL);
109531 + if (!in_lto_p)
109532 + register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_latent_entropy);
109533 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &latent_entropy_pass_info);
109534 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
109535 +
109536 + return 0;
109537 +}
109538 diff --git a/tools/gcc/randomize_layout_plugin.c b/tools/gcc/randomize_layout_plugin.c
109539 new file mode 100644
109540 index 0000000..8dafb22
109541 --- /dev/null
109542 +++ b/tools/gcc/randomize_layout_plugin.c
109543 @@ -0,0 +1,910 @@
109544 +/*
109545 + * Copyright 2014 by Open Source Security, Inc., Brad Spengler <spender@grsecurity.net>
109546 + * and PaX Team <pageexec@freemail.hu>
109547 + * Licensed under the GPL v2
109548 + *
109549 + * Usage:
109550 + * $ # for 4.5/4.6/C based 4.7
109551 + * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o randomize_layout_plugin.so randomize_layout_plugin.c
109552 + * $ # for C++ based 4.7/4.8+
109553 + * $ g++ -I`g++ -print-file-name=plugin`/include -I`g++ -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o randomize_layout_plugin.so randomize_layout_plugin.c
109554 + * $ gcc -fplugin=./randomize_layout_plugin.so test.c -O2
109555 + */
109556 +
109557 +#include "gcc-common.h"
109558 +#include "randomize_layout_seed.h"
109559 +
109560 +#if BUILDING_GCC_MAJOR < 4 || BUILDING_GCC_MINOR < 6 || (BUILDING_GCC_MINOR == 6 && BUILDING_GCC_PATCHLEVEL < 4)
109561 +#error "The RANDSTRUCT plugin requires GCC 4.6.4 or newer."
109562 +#endif
109563 +
109564 +#define ORIG_TYPE_NAME(node) \
109565 + (TYPE_NAME(TYPE_MAIN_VARIANT(node)) != NULL_TREE ? ((const unsigned char *)IDENTIFIER_POINTER(TYPE_NAME(TYPE_MAIN_VARIANT(node)))) : (const unsigned char *)"anonymous")
109566 +
109567 +int plugin_is_GPL_compatible;
109568 +
109569 +static int performance_mode;
109570 +
109571 +static struct plugin_info randomize_layout_plugin_info = {
109572 + .version = "201402201816",
109573 + .help = "disable\t\t\tdo not activate plugin\n"
109574 + "performance-mode\tenable cacheline-aware layout randomization\n"
109575 +};
109576 +
109577 +/* from old Linux dcache.h */
109578 +static inline unsigned long
109579 +partial_name_hash(unsigned long c, unsigned long prevhash)
109580 +{
109581 + return (prevhash + (c << 4) + (c >> 4)) * 11;
109582 +}
109583 +static inline unsigned int
109584 +name_hash(const unsigned char *name)
109585 +{
109586 + unsigned long hash = 0;
109587 + unsigned int len = strlen((const char *)name);
109588 + while (len--)
109589 + hash = partial_name_hash(*name++, hash);
109590 + return (unsigned int)hash;
109591 +}
109592 +
109593 +static tree handle_randomize_layout_attr(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
109594 +{
109595 + tree type;
109596 +
109597 + *no_add_attrs = true;
109598 + if (TREE_CODE(*node) == FUNCTION_DECL) {
109599 + error("%qE attribute does not apply to functions (%qF)", name, *node);
109600 + return NULL_TREE;
109601 + }
109602 +
109603 + if (TREE_CODE(*node) == PARM_DECL) {
109604 + error("%qE attribute does not apply to function parameters (%qD)", name, *node);
109605 + return NULL_TREE;
109606 + }
109607 +
109608 + if (TREE_CODE(*node) == VAR_DECL) {
109609 + error("%qE attribute does not apply to variables (%qD)", name, *node);
109610 + return NULL_TREE;
109611 + }
109612 +
109613 + if (TYPE_P(*node)) {
109614 + type = *node;
109615 + } else {
109616 + gcc_assert(TREE_CODE(*node) == TYPE_DECL);
109617 + type = TREE_TYPE(*node);
109618 + }
109619 +
109620 + if (TREE_CODE(type) != RECORD_TYPE) {
109621 + error("%qE attribute used on %qT applies to struct types only", name, type);
109622 + return NULL_TREE;
109623 + }
109624 +
109625 + if (lookup_attribute(IDENTIFIER_POINTER(name), TYPE_ATTRIBUTES(type))) {
109626 + error("%qE attribute is already applied to the type %qT", name, type);
109627 + return NULL_TREE;
109628 + }
109629 +
109630 + *no_add_attrs = false;
109631 +
109632 + return NULL_TREE;
109633 +}
109634 +
109635 +/* set on complete types that we don't need to inspect further at all */
109636 +static tree handle_randomize_considered_attr(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
109637 +{
109638 + *no_add_attrs = false;
109639 + return NULL_TREE;
109640 +}
109641 +
109642 +/*
109643 + * set on types that we've performed a shuffle on, to prevent re-shuffling
109644 + * this does not preclude us from inspecting its fields for potential shuffles
109645 + */
109646 +static tree handle_randomize_performed_attr(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
109647 +{
109648 + *no_add_attrs = false;
109649 + return NULL_TREE;
109650 +}
109651 +
109652 +/*
109653 + * 64bit variant of Bob Jenkins' public domain PRNG
109654 + * 256 bits of internal state
109655 + */
109656 +
109657 +typedef unsigned long long u64;
109658 +
109659 +typedef struct ranctx { u64 a; u64 b; u64 c; u64 d; } ranctx;
109660 +
109661 +#define rot(x,k) (((x)<<(k))|((x)>>(64-(k))))
109662 +static u64 ranval(ranctx *x) {
109663 + u64 e = x->a - rot(x->b, 7);
109664 + x->a = x->b ^ rot(x->c, 13);
109665 + x->b = x->c + rot(x->d, 37);
109666 + x->c = x->d + e;
109667 + x->d = e + x->a;
109668 + return x->d;
109669 +}
109670 +
109671 +static void raninit(ranctx *x, u64 *seed) {
109672 + int i;
109673 +
109674 + x->a = seed[0];
109675 + x->b = seed[1];
109676 + x->c = seed[2];
109677 + x->d = seed[3];
109678 +
109679 + for (i=0; i < 30; ++i)
109680 + (void)ranval(x);
109681 +}
109682 +
109683 +static u64 shuffle_seed[4];
109684 +
109685 +struct partition_group {
109686 + tree tree_start;
109687 + unsigned long start;
109688 + unsigned long length;
109689 +};
109690 +
109691 +static void partition_struct(tree *fields, unsigned long length, struct partition_group *size_groups, unsigned long *num_groups)
109692 +{
109693 + unsigned long i;
109694 + unsigned long accum_size = 0;
109695 + unsigned long accum_length = 0;
109696 + unsigned long group_idx = 0;
109697 +
109698 + gcc_assert(length < INT_MAX);
109699 +
109700 + memset(size_groups, 0, sizeof(struct partition_group) * length);
109701 +
109702 + for (i = 0; i < length; i++) {
109703 + if (size_groups[group_idx].tree_start == NULL_TREE) {
109704 + size_groups[group_idx].tree_start = fields[i];
109705 + size_groups[group_idx].start = i;
109706 + accum_length = 0;
109707 + accum_size = 0;
109708 + }
109709 + accum_size += (unsigned long)int_size_in_bytes(TREE_TYPE(fields[i]));
109710 + accum_length++;
109711 + if (accum_size >= 64) {
109712 + size_groups[group_idx].length = accum_length;
109713 + accum_length = 0;
109714 + group_idx++;
109715 + }
109716 + }
109717 +
109718 + if (size_groups[group_idx].tree_start != NULL_TREE &&
109719 + !size_groups[group_idx].length) {
109720 + size_groups[group_idx].length = accum_length;
109721 + group_idx++;
109722 + }
109723 +
109724 + *num_groups = group_idx;
109725 +}
109726 +
109727 +static void performance_shuffle(tree *newtree, unsigned long length, ranctx *prng_state)
109728 +{
109729 + unsigned long i, x;
109730 + struct partition_group size_group[length];
109731 + unsigned long num_groups = 0;
109732 + unsigned long randnum;
109733 +
109734 + partition_struct(newtree, length, (struct partition_group *)&size_group, &num_groups);
109735 + for (i = num_groups - 1; i > 0; i--) {
109736 + struct partition_group tmp;
109737 + randnum = ranval(prng_state) % (i + 1);
109738 + tmp = size_group[i];
109739 + size_group[i] = size_group[randnum];
109740 + size_group[randnum] = tmp;
109741 + }
109742 +
109743 + for (x = 0; x < num_groups; x++) {
109744 + for (i = size_group[x].start + size_group[x].length - 1; i > size_group[x].start; i--) {
109745 + tree tmp;
109746 + if (DECL_BIT_FIELD_TYPE(newtree[i]))
109747 + continue;
109748 + randnum = ranval(prng_state) % (i + 1);
109749 + // we could handle this case differently if desired
109750 + if (DECL_BIT_FIELD_TYPE(newtree[randnum]))
109751 + continue;
109752 + tmp = newtree[i];
109753 + newtree[i] = newtree[randnum];
109754 + newtree[randnum] = tmp;
109755 + }
109756 + }
109757 +}
109758 +
109759 +static void full_shuffle(tree *newtree, unsigned long length, ranctx *prng_state)
109760 +{
109761 + unsigned long i, randnum;
109762 +
109763 + for (i = length - 1; i > 0; i--) {
109764 + tree tmp;
109765 + randnum = ranval(prng_state) % (i + 1);
109766 + tmp = newtree[i];
109767 + newtree[i] = newtree[randnum];
109768 + newtree[randnum] = tmp;
109769 + }
109770 +}
109771 +
109772 +/* modern in-place Fisher-Yates shuffle */
109773 +static void shuffle(const_tree type, tree *newtree, unsigned long length)
109774 +{
109775 + unsigned long i;
109776 + u64 seed[4];
109777 + ranctx prng_state;
109778 + const unsigned char *structname;
109779 +
109780 + if (length == 0)
109781 + return;
109782 +
109783 + gcc_assert(TREE_CODE(type) == RECORD_TYPE);
109784 +
109785 + structname = ORIG_TYPE_NAME(type);
109786 +
109787 +#ifdef __DEBUG_PLUGIN
109788 + fprintf(stderr, "Shuffling struct %s %p\n", (const char *)structname, type);
109789 +#ifdef __DEBUG_VERBOSE
109790 + debug_tree((tree)type);
109791 +#endif
109792 +#endif
109793 +
109794 + for (i = 0; i < 4; i++) {
109795 + seed[i] = shuffle_seed[i];
109796 + seed[i] ^= name_hash(structname);
109797 + }
109798 +
109799 + raninit(&prng_state, (u64 *)&seed);
109800 +
109801 + if (performance_mode)
109802 + performance_shuffle(newtree, length, &prng_state);
109803 + else
109804 + full_shuffle(newtree, length, &prng_state);
109805 +}
109806 +
109807 +static bool is_flexible_array(const_tree field)
109808 +{
109809 + const_tree fieldtype;
109810 + const_tree typesize;
109811 + const_tree elemtype;
109812 + const_tree elemsize;
109813 +
109814 + fieldtype = TREE_TYPE(field);
109815 + typesize = TYPE_SIZE(fieldtype);
109816 +
109817 + if (TREE_CODE(fieldtype) != ARRAY_TYPE)
109818 + return false;
109819 +
109820 + elemtype = TREE_TYPE(fieldtype);
109821 + elemsize = TYPE_SIZE(elemtype);
109822 +
109823 + /* size of type is represented in bits */
109824 +
109825 + if (typesize == NULL_TREE && TYPE_DOMAIN(fieldtype) != NULL_TREE &&
109826 + TYPE_MAX_VALUE(TYPE_DOMAIN(fieldtype)) == NULL_TREE)
109827 + return true;
109828 +
109829 + if (typesize != NULL_TREE &&
109830 + (TREE_CONSTANT(typesize) && (!TREE_INT_CST_LOW(typesize) ||
109831 + TREE_INT_CST_LOW(typesize) == TREE_INT_CST_LOW(elemsize))))
109832 + return true;
109833 +
109834 + return false;
109835 +}
109836 +
109837 +static int relayout_struct(tree type)
109838 +{
109839 + unsigned long num_fields = (unsigned long)list_length(TYPE_FIELDS(type));
109840 + unsigned long shuffle_length = num_fields;
109841 + tree field;
109842 + tree newtree[num_fields];
109843 + unsigned long i;
109844 + tree list;
109845 + tree variant;
109846 + expanded_location xloc;
109847 +
109848 + if (TYPE_FIELDS(type) == NULL_TREE)
109849 + return 0;
109850 +
109851 + if (num_fields < 2)
109852 + return 0;
109853 +
109854 + gcc_assert(TREE_CODE(type) == RECORD_TYPE);
109855 +
109856 + gcc_assert(num_fields < INT_MAX);
109857 +
109858 + if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(type)) ||
109859 + lookup_attribute("no_randomize_layout", TYPE_ATTRIBUTES(TYPE_MAIN_VARIANT(type))))
109860 + return 0;
109861 +
109862 + /* throw out any structs in uapi */
109863 + xloc = expand_location(DECL_SOURCE_LOCATION(TYPE_FIELDS(type)));
109864 +
109865 + if (strstr(xloc.file, "/uapi/"))
109866 + error(G_("attempted to randomize userland API struct %s"), ORIG_TYPE_NAME(type));
109867 +
109868 + for (field = TYPE_FIELDS(type), i = 0; field; field = TREE_CHAIN(field), i++) {
109869 + gcc_assert(TREE_CODE(field) == FIELD_DECL);
109870 + newtree[i] = field;
109871 + }
109872 +
109873 + /*
109874 + * enforce that we don't randomize the layout of the last
109875 + * element of a struct if it's a 0 or 1-length array
109876 + * or a proper flexible array
109877 + */
109878 + if (is_flexible_array(newtree[num_fields - 1]))
109879 + shuffle_length--;
109880 +
109881 + shuffle(type, (tree *)newtree, shuffle_length);
109882 +
109883 + /*
109884 + * set up a bogus anonymous struct field designed to error out on unnamed struct initializers
109885 + * as gcc provides no other way to detect such code
109886 + */
109887 + list = make_node(FIELD_DECL);
109888 + TREE_CHAIN(list) = newtree[0];
109889 + TREE_TYPE(list) = void_type_node;
109890 + DECL_SIZE(list) = bitsize_zero_node;
109891 + DECL_NONADDRESSABLE_P(list) = 1;
109892 + DECL_FIELD_BIT_OFFSET(list) = bitsize_zero_node;
109893 + DECL_SIZE_UNIT(list) = size_zero_node;
109894 + DECL_FIELD_OFFSET(list) = size_zero_node;
109895 + // to satisfy the constify plugin
109896 + TREE_READONLY(list) = 1;
109897 +
109898 + for (i = 0; i < num_fields - 1; i++)
109899 + TREE_CHAIN(newtree[i]) = newtree[i+1];
109900 + TREE_CHAIN(newtree[num_fields - 1]) = NULL_TREE;
109901 +
109902 + for (variant = TYPE_MAIN_VARIANT(type); variant; variant = TYPE_NEXT_VARIANT(variant)) {
109903 + TYPE_FIELDS(variant) = list;
109904 + TYPE_ATTRIBUTES(variant) = copy_list(TYPE_ATTRIBUTES(variant));
109905 + TYPE_ATTRIBUTES(variant) = tree_cons(get_identifier("randomize_performed"), NULL_TREE, TYPE_ATTRIBUTES(variant));
109906 + // force a re-layout
109907 + TYPE_SIZE(variant) = NULL_TREE;
109908 + layout_type(variant);
109909 + }
109910 +
109911 + return 1;
109912 +}
109913 +
109914 +/* from constify plugin */
109915 +static const_tree get_field_type(const_tree field)
109916 +{
109917 + return strip_array_types(TREE_TYPE(field));
109918 +}
109919 +
109920 +/* from constify plugin */
109921 +static bool is_fptr(const_tree fieldtype)
109922 +{
109923 + if (TREE_CODE(fieldtype) != POINTER_TYPE)
109924 + return false;
109925 +
109926 + return TREE_CODE(TREE_TYPE(fieldtype)) == FUNCTION_TYPE;
109927 +}
109928 +
109929 +/* derived from constify plugin */
109930 +static int is_pure_ops_struct(const_tree node)
109931 +{
109932 + const_tree field;
109933 +
109934 + gcc_assert(TREE_CODE(node) == RECORD_TYPE || TREE_CODE(node) == UNION_TYPE);
109935 +
109936 + for (field = TYPE_FIELDS(node); field; field = TREE_CHAIN(field)) {
109937 + const_tree fieldtype = get_field_type(field);
109938 + enum tree_code code = TREE_CODE(fieldtype);
109939 +
109940 + if (node == fieldtype)
109941 + continue;
109942 +
109943 + if (!is_fptr(fieldtype))
109944 + return 0;
109945 +
109946 + if (code != RECORD_TYPE && code != UNION_TYPE)
109947 + continue;
109948 +
109949 + if (!is_pure_ops_struct(fieldtype))
109950 + return 0;
109951 + }
109952 +
109953 + return 1;
109954 +}
109955 +
109956 +static void randomize_type(tree type)
109957 +{
109958 + tree variant;
109959 +
109960 + gcc_assert(TREE_CODE(type) == RECORD_TYPE);
109961 +
109962 + if (lookup_attribute("randomize_considered", TYPE_ATTRIBUTES(type)))
109963 + return;
109964 +
109965 + if (lookup_attribute("randomize_layout", TYPE_ATTRIBUTES(TYPE_MAIN_VARIANT(type))) || is_pure_ops_struct(type))
109966 + relayout_struct(type);
109967 +
109968 + for (variant = TYPE_MAIN_VARIANT(type); variant; variant = TYPE_NEXT_VARIANT(variant)) {
109969 + TYPE_ATTRIBUTES(type) = copy_list(TYPE_ATTRIBUTES(type));
109970 + TYPE_ATTRIBUTES(type) = tree_cons(get_identifier("randomize_considered"), NULL_TREE, TYPE_ATTRIBUTES(type));
109971 + }
109972 +#ifdef __DEBUG_PLUGIN
109973 + fprintf(stderr, "Marking randomize_considered on struct %s\n", ORIG_TYPE_NAME(type));
109974 +#ifdef __DEBUG_VERBOSE
109975 + debug_tree(type);
109976 +#endif
109977 +#endif
109978 +}
109979 +
109980 +static void randomize_layout_finish_decl(void *event_data, void *data)
109981 +{
109982 + tree decl = (tree)event_data;
109983 + tree type;
109984 +
109985 + if (decl == NULL_TREE || decl == error_mark_node)
109986 + return;
109987 +
109988 + type = TREE_TYPE(decl);
109989 +
109990 + if (TREE_CODE(decl) != VAR_DECL)
109991 + return;
109992 +
109993 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
109994 + return;
109995 +
109996 + if (!lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(type)))
109997 + return;
109998 +
109999 + relayout_decl(decl);
110000 +}
110001 +
110002 +static void finish_type(void *event_data, void *data)
110003 +{
110004 + tree type = (tree)event_data;
110005 +
110006 + if (type == NULL_TREE || type == error_mark_node)
110007 + return;
110008 +
110009 + if (TREE_CODE(type) != RECORD_TYPE)
110010 + return;
110011 +
110012 + if (TYPE_FIELDS(type) == NULL_TREE)
110013 + return;
110014 +
110015 + if (lookup_attribute("randomize_considered", TYPE_ATTRIBUTES(type)))
110016 + return;
110017 +
110018 +#ifdef __DEBUG_PLUGIN
110019 + fprintf(stderr, "Calling randomize_type on %s\n", ORIG_TYPE_NAME(type));
110020 +#endif
110021 +#ifdef __DEBUG_VERBOSE
110022 + debug_tree(type);
110023 +#endif
110024 + randomize_type(type);
110025 +
110026 + return;
110027 +}
110028 +
110029 +static struct attribute_spec randomize_layout_attr = {
110030 + .name = "randomize_layout",
110031 + // related to args
110032 + .min_length = 0,
110033 + .max_length = 0,
110034 + .decl_required = false,
110035 + // need type declaration
110036 + .type_required = true,
110037 + .function_type_required = false,
110038 + .handler = handle_randomize_layout_attr,
110039 +#if BUILDING_GCC_VERSION >= 4007
110040 + .affects_type_identity = true
110041 +#endif
110042 +};
110043 +
110044 +static struct attribute_spec no_randomize_layout_attr = {
110045 + .name = "no_randomize_layout",
110046 + // related to args
110047 + .min_length = 0,
110048 + .max_length = 0,
110049 + .decl_required = false,
110050 + // need type declaration
110051 + .type_required = true,
110052 + .function_type_required = false,
110053 + .handler = handle_randomize_layout_attr,
110054 +#if BUILDING_GCC_VERSION >= 4007
110055 + .affects_type_identity = true
110056 +#endif
110057 +};
110058 +
110059 +static struct attribute_spec randomize_considered_attr = {
110060 + .name = "randomize_considered",
110061 + // related to args
110062 + .min_length = 0,
110063 + .max_length = 0,
110064 + .decl_required = false,
110065 + // need type declaration
110066 + .type_required = true,
110067 + .function_type_required = false,
110068 + .handler = handle_randomize_considered_attr,
110069 +#if BUILDING_GCC_VERSION >= 4007
110070 + .affects_type_identity = false
110071 +#endif
110072 +};
110073 +
110074 +static struct attribute_spec randomize_performed_attr = {
110075 + .name = "randomize_performed",
110076 + // related to args
110077 + .min_length = 0,
110078 + .max_length = 0,
110079 + .decl_required = false,
110080 + // need type declaration
110081 + .type_required = true,
110082 + .function_type_required = false,
110083 + .handler = handle_randomize_performed_attr,
110084 +#if BUILDING_GCC_VERSION >= 4007
110085 + .affects_type_identity = false
110086 +#endif
110087 +};
110088 +
110089 +static void register_attributes(void *event_data, void *data)
110090 +{
110091 + register_attribute(&randomize_layout_attr);
110092 + register_attribute(&no_randomize_layout_attr);
110093 + register_attribute(&randomize_considered_attr);
110094 + register_attribute(&randomize_performed_attr);
110095 +}
110096 +
110097 +static void check_bad_casts_in_constructor(tree var, tree init)
110098 +{
110099 + unsigned HOST_WIDE_INT idx;
110100 + tree field, val;
110101 + tree field_type, val_type;
110102 +
110103 + FOR_EACH_CONSTRUCTOR_ELT(CONSTRUCTOR_ELTS(init), idx, field, val) {
110104 + if (TREE_CODE(val) == CONSTRUCTOR) {
110105 + check_bad_casts_in_constructor(var, val);
110106 + continue;
110107 + }
110108 +
110109 + /* pipacs' plugin creates franken-arrays that differ from those produced by
110110 + normal code which all have valid 'field' trees. work around this */
110111 + if (field == NULL_TREE)
110112 + continue;
110113 + field_type = TREE_TYPE(field);
110114 + val_type = TREE_TYPE(val);
110115 +
110116 + if (TREE_CODE(field_type) != POINTER_TYPE || TREE_CODE(val_type) != POINTER_TYPE)
110117 + continue;
110118 +
110119 + if (field_type == val_type)
110120 + continue;
110121 +
110122 + field_type = TYPE_MAIN_VARIANT(strip_array_types(TYPE_MAIN_VARIANT(TREE_TYPE(field_type))));
110123 + val_type = TYPE_MAIN_VARIANT(strip_array_types(TYPE_MAIN_VARIANT(TREE_TYPE(val_type))));
110124 +
110125 + if (field_type == void_type_node)
110126 + continue;
110127 + if (field_type == val_type)
110128 + continue;
110129 + if (TREE_CODE(val_type) != RECORD_TYPE)
110130 + continue;
110131 +
110132 + if (!lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(val_type)))
110133 + continue;
110134 + inform(DECL_SOURCE_LOCATION(var), "found mismatched struct pointer types: %qT and %qT\n", TYPE_MAIN_VARIANT(field_type), TYPE_MAIN_VARIANT(val_type));
110135 + }
110136 +}
110137 +
110138 +/* derived from the constify plugin */
110139 +static void check_global_variables(void *event_data, void *data)
110140 +{
110141 + struct varpool_node *node;
110142 + tree init;
110143 +
110144 + FOR_EACH_VARIABLE(node) {
110145 + tree var = NODE_DECL(node);
110146 + init = DECL_INITIAL(var);
110147 + if (init == NULL_TREE)
110148 + continue;
110149 +
110150 + if (TREE_CODE(init) != CONSTRUCTOR)
110151 + continue;
110152 +
110153 + check_bad_casts_in_constructor(var, init);
110154 + }
110155 +}
110156 +
110157 +static bool dominated_by_is_err(const_tree rhs, basic_block bb)
110158 +{
110159 + basic_block dom;
110160 + gimple dom_stmt;
110161 + gimple call_stmt;
110162 + const_tree dom_lhs;
110163 + const_tree poss_is_err_cond;
110164 + const_tree poss_is_err_func;
110165 + const_tree is_err_arg;
110166 +
110167 + dom = get_immediate_dominator(CDI_DOMINATORS, bb);
110168 + if (!dom)
110169 + return false;
110170 +
110171 + dom_stmt = last_stmt(dom);
110172 + if (!dom_stmt)
110173 + return false;
110174 +
110175 + if (gimple_code(dom_stmt) != GIMPLE_COND)
110176 + return false;
110177 +
110178 + if (gimple_cond_code(dom_stmt) != NE_EXPR)
110179 + return false;
110180 +
110181 + if (!integer_zerop(gimple_cond_rhs(dom_stmt)))
110182 + return false;
110183 +
110184 + poss_is_err_cond = gimple_cond_lhs(dom_stmt);
110185 +
110186 + if (TREE_CODE(poss_is_err_cond) != SSA_NAME)
110187 + return false;
110188 +
110189 + call_stmt = SSA_NAME_DEF_STMT(poss_is_err_cond);
110190 +
110191 + if (gimple_code(call_stmt) != GIMPLE_CALL)
110192 + return false;
110193 +
110194 + dom_lhs = gimple_get_lhs(call_stmt);
110195 + poss_is_err_func = gimple_call_fndecl(call_stmt);
110196 + if (!poss_is_err_func)
110197 + return false;
110198 + if (dom_lhs != poss_is_err_cond)
110199 + return false;
110200 + if (strcmp(DECL_NAME_POINTER(poss_is_err_func), "IS_ERR"))
110201 + return false;
110202 +
110203 + is_err_arg = gimple_call_arg(call_stmt, 0);
110204 + if (!is_err_arg)
110205 + return false;
110206 +
110207 + if (is_err_arg != rhs)
110208 + return false;
110209 +
110210 + return true;
110211 +}
110212 +
110213 +static void handle_local_var_initializers(void)
110214 +{
110215 + tree var;
110216 + unsigned int i;
110217 +
110218 + FOR_EACH_LOCAL_DECL(cfun, i, var) {
110219 + tree init = DECL_INITIAL(var);
110220 + if (!init)
110221 + continue;
110222 + if (TREE_CODE(init) != CONSTRUCTOR)
110223 + continue;
110224 + check_bad_casts_in_constructor(var, init);
110225 + }
110226 +}
110227 +
110228 +/*
110229 + * iterate over all statements to find "bad" casts:
110230 + * those where the address of the start of a structure is cast
110231 + * to a pointer of a structure of a different type, or a
110232 + * structure pointer type is cast to a different structure pointer type
110233 + */
110234 +static unsigned int find_bad_casts(void)
110235 +{
110236 + basic_block bb;
110237 +
110238 + handle_local_var_initializers();
110239 +
110240 + FOR_ALL_BB_FN(bb, cfun) {
110241 + gimple_stmt_iterator gsi;
110242 +
110243 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
110244 + gimple stmt;
110245 + const_tree lhs;
110246 + const_tree lhs_type;
110247 + const_tree rhs1;
110248 + const_tree rhs_type;
110249 + const_tree ptr_lhs_type;
110250 + const_tree ptr_rhs_type;
110251 + const_tree op0;
110252 + const_tree op0_type;
110253 + enum tree_code rhs_code;
110254 +
110255 + stmt = gsi_stmt(gsi);
110256 +
110257 +#ifdef __DEBUG_PLUGIN
110258 +#ifdef __DEBUG_VERBOSE
110259 + debug_gimple_stmt(stmt);
110260 + debug_tree(gimple_get_lhs(stmt));
110261 +#endif
110262 +#endif
110263 +
110264 + if (gimple_code(stmt) != GIMPLE_ASSIGN)
110265 + continue;
110266 +
110267 +#ifdef __DEBUG_PLUGIN
110268 +#ifdef __DEBUG_VERBOSE
110269 + debug_tree(gimple_assign_rhs1(stmt));
110270 +#endif
110271 +#endif
110272 +
110273 + rhs_code = gimple_assign_rhs_code(stmt);
110274 +
110275 + if (rhs_code != ADDR_EXPR && rhs_code != SSA_NAME)
110276 + continue;
110277 +
110278 + lhs = gimple_get_lhs(stmt);
110279 + lhs_type = TREE_TYPE(lhs);
110280 + rhs1 = gimple_assign_rhs1(stmt);
110281 + rhs_type = TREE_TYPE(rhs1);
110282 +
110283 + if (TREE_CODE(rhs_type) != POINTER_TYPE ||
110284 + TREE_CODE(lhs_type) != POINTER_TYPE)
110285 + continue;
110286 +
110287 + ptr_lhs_type = TYPE_MAIN_VARIANT(strip_array_types(TYPE_MAIN_VARIANT(TREE_TYPE(lhs_type))));
110288 + ptr_rhs_type = TYPE_MAIN_VARIANT(strip_array_types(TYPE_MAIN_VARIANT(TREE_TYPE(rhs_type))));
110289 +
110290 + if (ptr_rhs_type == void_type_node)
110291 + continue;
110292 +
110293 + if (ptr_lhs_type == void_type_node)
110294 + continue;
110295 +
110296 + if (dominated_by_is_err(rhs1, bb))
110297 + continue;
110298 +
110299 + if (TREE_CODE(ptr_rhs_type) != RECORD_TYPE) {
110300 +#ifndef __DEBUG_PLUGIN
110301 + if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(ptr_lhs_type)))
110302 +#endif
110303 + inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type);
110304 + continue;
110305 + }
110306 +
110307 + if (rhs_code == SSA_NAME && ptr_lhs_type == ptr_rhs_type)
110308 + continue;
110309 +
110310 + if (rhs_code == ADDR_EXPR) {
110311 + op0 = TREE_OPERAND(rhs1, 0);
110312 +
110313 + if (op0 == NULL_TREE)
110314 + continue;
110315 +
110316 + if (TREE_CODE(op0) != VAR_DECL)
110317 + continue;
110318 +
110319 + op0_type = TYPE_MAIN_VARIANT(strip_array_types(TYPE_MAIN_VARIANT(TREE_TYPE(op0))));
110320 + if (op0_type == ptr_lhs_type)
110321 + continue;
110322 +
110323 +#ifndef __DEBUG_PLUGIN
110324 + if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(op0_type)))
110325 +#endif
110326 + inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, op0_type);
110327 + } else {
110328 + const_tree ssa_name_var = SSA_NAME_VAR(rhs1);
110329 + /* skip bogus type casts introduced by container_of */
110330 + if (ssa_name_var != NULL_TREE && DECL_NAME(ssa_name_var) &&
110331 + !strcmp((const char *)DECL_NAME_POINTER(ssa_name_var), "__mptr"))
110332 + continue;
110333 +#ifndef __DEBUG_PLUGIN
110334 + if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(ptr_rhs_type)))
110335 +#endif
110336 + inform(gimple_location(stmt), "found mismatched struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type);
110337 + }
110338 +
110339 + }
110340 + }
110341 + return 0;
110342 +}
110343 +
110344 +#if BUILDING_GCC_VERSION >= 4009
110345 +static const struct pass_data randomize_layout_bad_cast_data = {
110346 +#else
110347 +static struct gimple_opt_pass randomize_layout_bad_cast = {
110348 + .pass = {
110349 +#endif
110350 + .type = GIMPLE_PASS,
110351 + .name = "randomize_layout_bad_cast",
110352 +#if BUILDING_GCC_VERSION >= 4008
110353 + .optinfo_flags = OPTGROUP_NONE,
110354 +#endif
110355 +#if BUILDING_GCC_VERSION >= 4009
110356 + .has_gate = false,
110357 + .has_execute = true,
110358 +#else
110359 + .gate = NULL,
110360 + .execute = find_bad_casts,
110361 + .sub = NULL,
110362 + .next = NULL,
110363 + .static_pass_number = 0,
110364 +#endif
110365 + .tv_id = TV_NONE,
110366 + .properties_required = PROP_cfg,
110367 + .properties_provided = 0,
110368 + .properties_destroyed = 0,
110369 + .todo_flags_start = 0,
110370 + .todo_flags_finish = TODO_dump_func
110371 +#if BUILDING_GCC_VERSION < 4009
110372 + }
110373 +#endif
110374 +};
110375 +
110376 +#if BUILDING_GCC_VERSION >= 4009
110377 +namespace {
110378 +class randomize_layout_bad_cast : public gimple_opt_pass {
110379 +public:
110380 + randomize_layout_bad_cast() : gimple_opt_pass(randomize_layout_bad_cast_data, g) {}
110381 + unsigned int execute() { return find_bad_casts(); }
110382 +};
110383 +}
110384 +#endif
110385 +
110386 +static struct opt_pass *make_randomize_layout_bad_cast(void)
110387 +{
110388 +#if BUILDING_GCC_VERSION >= 4009
110389 + return new randomize_layout_bad_cast();
110390 +#else
110391 + return &randomize_layout_bad_cast.pass;
110392 +#endif
110393 +}
110394 +
110395 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
110396 +{
110397 + int i;
110398 + const char * const plugin_name = plugin_info->base_name;
110399 + const int argc = plugin_info->argc;
110400 + const struct plugin_argument * const argv = plugin_info->argv;
110401 + bool enable = true;
110402 + int obtained_seed = 0;
110403 + struct register_pass_info randomize_layout_bad_cast_info;
110404 +
110405 + randomize_layout_bad_cast_info.pass = make_randomize_layout_bad_cast();
110406 + randomize_layout_bad_cast_info.reference_pass_name = "ssa";
110407 + randomize_layout_bad_cast_info.ref_pass_instance_number = 1;
110408 + randomize_layout_bad_cast_info.pos_op = PASS_POS_INSERT_AFTER;
110409 +
110410 + if (!plugin_default_version_check(version, &gcc_version)) {
110411 + error(G_("incompatible gcc/plugin versions"));
110412 + return 1;
110413 + }
110414 +
110415 + if (strcmp(lang_hooks.name, "GNU C")) {
110416 + inform(UNKNOWN_LOCATION, G_("%s supports C only"), plugin_name);
110417 + enable = false;
110418 + }
110419 +
110420 + for (i = 0; i < argc; ++i) {
110421 + if (!strcmp(argv[i].key, "disable")) {
110422 + enable = false;
110423 + continue;
110424 + }
110425 + if (!strcmp(argv[i].key, "performance-mode")) {
110426 + performance_mode = 1;
110427 + continue;
110428 + }
110429 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
110430 + }
110431 +
110432 + if (strlen(randstruct_seed) != 64) {
110433 + error(G_("invalid seed value supplied for %s plugin"), plugin_name);
110434 + return 1;
110435 + }
110436 + obtained_seed = sscanf(randstruct_seed, "%016llx%016llx%016llx%016llx",
110437 + &shuffle_seed[0], &shuffle_seed[1], &shuffle_seed[2], &shuffle_seed[3]);
110438 + if (obtained_seed != 4) {
110439 + error(G_("Invalid seed supplied for %s plugin"), plugin_name);
110440 + return 1;
110441 + }
110442 +
110443 + register_callback(plugin_name, PLUGIN_INFO, NULL, &randomize_layout_plugin_info);
110444 + if (enable) {
110445 + register_callback(plugin_name, PLUGIN_ALL_IPA_PASSES_START, check_global_variables, NULL);
110446 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &randomize_layout_bad_cast_info);
110447 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
110448 + register_callback(plugin_name, PLUGIN_FINISH_DECL, randomize_layout_finish_decl, NULL);
110449 + }
110450 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
110451 +
110452 + return 0;
110453 +}
110454 diff --git a/tools/gcc/size_overflow_plugin/.gitignore b/tools/gcc/size_overflow_plugin/.gitignore
110455 new file mode 100644
110456 index 0000000..92d3b0c
110457 --- /dev/null
110458 +++ b/tools/gcc/size_overflow_plugin/.gitignore
110459 @@ -0,0 +1,2 @@
110460 +size_overflow_hash.h
110461 +size_overflow_hash_aux.h
110462 diff --git a/tools/gcc/size_overflow_plugin/Makefile b/tools/gcc/size_overflow_plugin/Makefile
110463 new file mode 100644
110464 index 0000000..1ae2ed5
110465 --- /dev/null
110466 +++ b/tools/gcc/size_overflow_plugin/Makefile
110467 @@ -0,0 +1,20 @@
110468 +$(HOSTLIBS)-$(CONFIG_PAX_SIZE_OVERFLOW) += size_overflow_plugin.so
110469 +always := $($(HOSTLIBS)-y)
110470 +
110471 +size_overflow_plugin-objs := $(patsubst $(srctree)/$(src)/%.c,%.o,$(wildcard $(srctree)/$(src)/*.c))
110472 +
110473 +$(patsubst $(srctree)/$(src)/%.c,$(obj)/%.o,$(wildcard $(srctree)/$(src)/*.c)): $(objtree)/$(obj)/size_overflow_hash.h $(objtree)/$(obj)/size_overflow_hash_aux.h
110474 +
110475 +quiet_cmd_build_size_overflow_hash = GENHASH $@
110476 + cmd_build_size_overflow_hash = \
110477 + $(CONFIG_SHELL) $(srctree)/$(src)/generate_size_overflow_hash.sh -s size_overflow_hash -d $< -o $@
110478 +$(objtree)/$(obj)/size_overflow_hash.h: $(src)/size_overflow_hash.data FORCE
110479 + $(call if_changed,build_size_overflow_hash)
110480 +
110481 +quiet_cmd_build_size_overflow_hash_aux = GENHASH $@
110482 + cmd_build_size_overflow_hash_aux = \
110483 + $(CONFIG_SHELL) $(srctree)/$(src)/generate_size_overflow_hash.sh -s size_overflow_hash_aux -d $< -o $@
110484 +$(objtree)/$(obj)/size_overflow_hash_aux.h: $(src)/size_overflow_hash_aux.data FORCE
110485 + $(call if_changed,build_size_overflow_hash_aux)
110486 +
110487 +targets += size_overflow_hash.h size_overflow_hash_aux.h
110488 diff --git a/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
110489 new file mode 100644
110490 index 0000000..12b1e3b
110491 --- /dev/null
110492 +++ b/tools/gcc/size_overflow_plugin/generate_size_overflow_hash.sh
110493 @@ -0,0 +1,102 @@
110494 +#!/bin/bash
110495 +
110496 +# This script generates the hash table (size_overflow_hash.h) for the size_overflow gcc plugin (size_overflow_plugin.c).
110497 +
110498 +header1="size_overflow_hash.h"
110499 +database="size_overflow_hash.data"
110500 +n=65536
110501 +hashtable_name="size_overflow_hash"
110502 +
110503 +usage() {
110504 +cat <<EOF
110505 +usage: $0 options
110506 +OPTIONS:
110507 + -h|--help help
110508 + -o header file
110509 + -d database file
110510 + -n hash array size
110511 + -s name of the hash table
110512 +EOF
110513 + return 0
110514 +}
110515 +
110516 +while true
110517 +do
110518 + case "$1" in
110519 + -h|--help) usage && exit 0;;
110520 + -n) n=$2; shift 2;;
110521 + -o) header1="$2"; shift 2;;
110522 + -d) database="$2"; shift 2;;
110523 + -s) hashtable_name="$2"; shift 2;;
110524 + --) shift 1; break ;;
110525 + *) break ;;
110526 + esac
110527 +done
110528 +
110529 +create_defines() {
110530 + for i in `seq 0 31`
110531 + do
110532 + echo -e "#define PARAM"$i" (1U << "$i")" >> "$header1"
110533 + done
110534 + echo >> "$header1"
110535 +}
110536 +
110537 +create_structs() {
110538 + rm -f "$header1"
110539 +
110540 + create_defines
110541 +
110542 + cat "$database" | while read data
110543 + do
110544 + data_array=($data)
110545 + struct_hash_name="${data_array[0]}"
110546 + funcn="${data_array[1]}"
110547 + params="${data_array[2]}"
110548 + next="${data_array[4]}"
110549 +
110550 + echo "const struct size_overflow_hash $struct_hash_name = {" >> "$header1"
110551 +
110552 + echo -e "\t.next\t= $next,\n\t.name\t= \"$funcn\"," >> "$header1"
110553 + echo -en "\t.param\t= " >> "$header1"
110554 + line=
110555 + for param_num in ${params//-/ };
110556 + do
110557 + line="${line}PARAM"$param_num"|"
110558 + done
110559 +
110560 + echo -e "${line%?},\n};\n" >> "$header1"
110561 + done
110562 +}
110563 +
110564 +create_headers() {
110565 + echo "const struct size_overflow_hash * const $hashtable_name[$n] = {" >> "$header1"
110566 +}
110567 +
110568 +create_array_elements() {
110569 + index=0
110570 + grep -v "nohasharray" $database | sort -n -k 4 | while read data
110571 + do
110572 + data_array=($data)
110573 + i="${data_array[3]}"
110574 + hash="${data_array[0]}"
110575 + while [[ $index -lt $i ]]
110576 + do
110577 + echo -e "\t["$index"]\t= NULL," >> "$header1"
110578 + index=$(($index + 1))
110579 + done
110580 + index=$(($index + 1))
110581 + echo -e "\t["$i"]\t= &"$hash"," >> "$header1"
110582 + done
110583 + echo '};' >> $header1
110584 +}
110585 +
110586 +size_overflow_plugin_dir=`dirname $header1`
110587 +if [ "$size_overflow_plugin_dir" != '.' ]; then
110588 + mkdir -p "$size_overflow_plugin_dir" 2> /dev/null
110589 +fi
110590 +
110591 +create_structs
110592 +create_headers
110593 +create_array_elements
110594 +
110595 +exit 0
110596 diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
110597 new file mode 100644
110598 index 0000000..3e8148c
110599 --- /dev/null
110600 +++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_asm.c
110601 @@ -0,0 +1,790 @@
110602 +/*
110603 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
110604 + * Licensed under the GPL v2, or (at your option) v3
110605 + *
110606 + * Homepage:
110607 + * http://www.grsecurity.net/~ephox/overflow_plugin/
110608 + *
110609 + * Documentation:
110610 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
110611 + *
110612 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
110613 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
110614 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
110615 + *
110616 + * Usage:
110617 + * $ make
110618 + * $ make run
110619 + */
110620 +
110621 +#include "gcc-common.h"
110622 +#include "size_overflow.h"
110623 +
110624 +static void search_size_overflow_attribute(struct pointer_set_t *visited, tree lhs);
110625 +static enum mark search_intentional(struct pointer_set_t *visited, const_tree lhs);
110626 +
110627 +// data for the size_overflow asm stmt
110628 +struct asm_data {
110629 + gimple def_stmt;
110630 + tree input;
110631 + tree output;
110632 +};
110633 +
110634 +#if BUILDING_GCC_VERSION <= 4007
110635 +static VEC(tree, gc) *create_asm_io_list(tree string, tree io)
110636 +#else
110637 +static vec<tree, va_gc> *create_asm_io_list(tree string, tree io)
110638 +#endif
110639 +{
110640 + tree list;
110641 +#if BUILDING_GCC_VERSION <= 4007
110642 + VEC(tree, gc) *vec_list = NULL;
110643 +#else
110644 + vec<tree, va_gc> *vec_list = NULL;
110645 +#endif
110646 +
110647 + list = build_tree_list(NULL_TREE, string);
110648 + list = chainon(NULL_TREE, build_tree_list(list, io));
110649 +#if BUILDING_GCC_VERSION <= 4007
110650 + VEC_safe_push(tree, gc, vec_list, list);
110651 +#else
110652 + vec_safe_push(vec_list, list);
110653 +#endif
110654 + return vec_list;
110655 +}
110656 +
110657 +static void create_asm_stmt(const char *str, tree str_input, tree str_output, struct asm_data *asm_data)
110658 +{
110659 + gimple asm_stmt;
110660 + gimple_stmt_iterator gsi;
110661 +#if BUILDING_GCC_VERSION <= 4007
110662 + VEC(tree, gc) *input, *output = NULL;
110663 +#else
110664 + vec<tree, va_gc> *input, *output = NULL;
110665 +#endif
110666 +
110667 + input = create_asm_io_list(str_input, asm_data->input);
110668 +
110669 + if (asm_data->output)
110670 + output = create_asm_io_list(str_output, asm_data->output);
110671 +
110672 + asm_stmt = gimple_build_asm_vec(str, input, output, NULL, NULL);
110673 + gsi = gsi_for_stmt(asm_data->def_stmt);
110674 + gsi_insert_after(&gsi, asm_stmt, GSI_NEW_STMT);
110675 +
110676 + if (asm_data->output)
110677 + SSA_NAME_DEF_STMT(asm_data->output) = asm_stmt;
110678 +}
110679 +
110680 +static void replace_call_lhs(const struct asm_data *asm_data)
110681 +{
110682 + gimple_set_lhs(asm_data->def_stmt, asm_data->input);
110683 + update_stmt(asm_data->def_stmt);
110684 + SSA_NAME_DEF_STMT(asm_data->input) = asm_data->def_stmt;
110685 +}
110686 +
110687 +static enum mark search_intentional_phi(struct pointer_set_t *visited, const_tree result)
110688 +{
110689 + enum mark cur_fndecl_attr;
110690 + gimple phi = get_def_stmt(result);
110691 + unsigned int i, n = gimple_phi_num_args(phi);
110692 +
110693 + pointer_set_insert(visited, phi);
110694 + for (i = 0; i < n; i++) {
110695 + tree arg = gimple_phi_arg_def(phi, i);
110696 +
110697 + cur_fndecl_attr = search_intentional(visited, arg);
110698 + if (cur_fndecl_attr != MARK_NO)
110699 + return cur_fndecl_attr;
110700 + }
110701 + return MARK_NO;
110702 +}
110703 +
110704 +static enum mark search_intentional_binary(struct pointer_set_t *visited, const_tree lhs)
110705 +{
110706 + enum mark cur_fndecl_attr;
110707 + const_tree rhs1, rhs2;
110708 + gimple def_stmt = get_def_stmt(lhs);
110709 +
110710 + rhs1 = gimple_assign_rhs1(def_stmt);
110711 + rhs2 = gimple_assign_rhs2(def_stmt);
110712 +
110713 + cur_fndecl_attr = search_intentional(visited, rhs1);
110714 + if (cur_fndecl_attr != MARK_NO)
110715 + return cur_fndecl_attr;
110716 + return search_intentional(visited, rhs2);
110717 +}
110718 +
110719 +// Look up the intentional_overflow attribute on the caller and the callee functions.
110720 +static enum mark search_intentional(struct pointer_set_t *visited, const_tree lhs)
110721 +{
110722 + const_gimple def_stmt;
110723 +
110724 + if (TREE_CODE(lhs) != SSA_NAME)
110725 + return get_intentional_attr_type(lhs);
110726 +
110727 + def_stmt = get_def_stmt(lhs);
110728 + if (!def_stmt)
110729 + return MARK_NO;
110730 +
110731 + if (pointer_set_contains(visited, def_stmt))
110732 + return MARK_NO;
110733 +
110734 + switch (gimple_code(def_stmt)) {
110735 + case GIMPLE_NOP:
110736 + return search_intentional(visited, SSA_NAME_VAR(lhs));
110737 + case GIMPLE_ASM:
110738 + if (is_size_overflow_intentional_asm_turn_off(def_stmt))
110739 + return MARK_TURN_OFF;
110740 + return MARK_NO;
110741 + case GIMPLE_CALL:
110742 + return MARK_NO;
110743 + case GIMPLE_PHI:
110744 + return search_intentional_phi(visited, lhs);
110745 + case GIMPLE_ASSIGN:
110746 + switch (gimple_num_ops(def_stmt)) {
110747 + case 2:
110748 + return search_intentional(visited, gimple_assign_rhs1(def_stmt));
110749 + case 3:
110750 + return search_intentional_binary(visited, lhs);
110751 + }
110752 + case GIMPLE_RETURN:
110753 + return MARK_NO;
110754 + default:
110755 + debug_gimple_stmt((gimple)def_stmt);
110756 + error("%s: unknown gimple code", __func__);
110757 + gcc_unreachable();
110758 + }
110759 +}
110760 +
110761 +// Check the intentional_overflow attribute and create the asm comment string for the size_overflow asm stmt.
110762 +static enum mark check_intentional_attribute_gimple(const_tree arg, const_gimple stmt, unsigned int argnum)
110763 +{
110764 + const_tree fndecl;
110765 + struct pointer_set_t *visited;
110766 + enum mark cur_fndecl_attr, decl_attr = MARK_NO;
110767 +
110768 + fndecl = get_interesting_orig_fndecl(stmt, argnum);
110769 + if (is_end_intentional_intentional_attr(fndecl, argnum))
110770 + decl_attr = MARK_NOT_INTENTIONAL;
110771 + else if (is_yes_intentional_attr(fndecl, argnum))
110772 + decl_attr = MARK_YES;
110773 + else if (is_turn_off_intentional_attr(fndecl) || is_turn_off_intentional_attr(DECL_ORIGIN(current_function_decl))) {
110774 + return MARK_TURN_OFF;
110775 + }
110776 +
110777 + visited = pointer_set_create();
110778 + cur_fndecl_attr = search_intentional(visited, arg);
110779 + pointer_set_destroy(visited);
110780 +
110781 + switch (cur_fndecl_attr) {
110782 + case MARK_NO:
110783 + case MARK_TURN_OFF:
110784 + return cur_fndecl_attr;
110785 + default:
110786 + print_missing_intentional(decl_attr, cur_fndecl_attr, fndecl, argnum);
110787 + return MARK_YES;
110788 + }
110789 +}
110790 +
110791 +static void check_missing_size_overflow_attribute(tree var)
110792 +{
110793 + tree orig_fndecl;
110794 + unsigned int num;
110795 +
110796 + if (is_a_return_check(var))
110797 + orig_fndecl = DECL_ORIGIN(var);
110798 + else
110799 + orig_fndecl = DECL_ORIGIN(current_function_decl);
110800 +
110801 + num = get_function_num(var, orig_fndecl);
110802 + if (num == CANNOT_FIND_ARG)
110803 + return;
110804 +
110805 + is_missing_function(orig_fndecl, num);
110806 +}
110807 +
110808 +static void search_size_overflow_attribute_phi(struct pointer_set_t *visited, const_tree result)
110809 +{
110810 + gimple phi = get_def_stmt(result);
110811 + unsigned int i, n = gimple_phi_num_args(phi);
110812 +
110813 + pointer_set_insert(visited, phi);
110814 + for (i = 0; i < n; i++) {
110815 + tree arg = gimple_phi_arg_def(phi, i);
110816 +
110817 + search_size_overflow_attribute(visited, arg);
110818 + }
110819 +}
110820 +
110821 +static void search_size_overflow_attribute_binary(struct pointer_set_t *visited, const_tree lhs)
110822 +{
110823 + const_gimple def_stmt = get_def_stmt(lhs);
110824 + tree rhs1, rhs2;
110825 +
110826 + rhs1 = gimple_assign_rhs1(def_stmt);
110827 + rhs2 = gimple_assign_rhs2(def_stmt);
110828 +
110829 + search_size_overflow_attribute(visited, rhs1);
110830 + search_size_overflow_attribute(visited, rhs2);
110831 +}
110832 +
110833 +static void search_size_overflow_attribute(struct pointer_set_t *visited, tree lhs)
110834 +{
110835 + const_gimple def_stmt;
110836 +
110837 + if (TREE_CODE(lhs) == PARM_DECL) {
110838 + check_missing_size_overflow_attribute(lhs);
110839 + return;
110840 + }
110841 +
110842 + def_stmt = get_def_stmt(lhs);
110843 + if (!def_stmt)
110844 + return;
110845 +
110846 + if (pointer_set_insert(visited, def_stmt))
110847 + return;
110848 +
110849 + switch (gimple_code(def_stmt)) {
110850 + case GIMPLE_NOP:
110851 + return search_size_overflow_attribute(visited, SSA_NAME_VAR(lhs));
110852 + case GIMPLE_ASM:
110853 + return;
110854 + case GIMPLE_CALL: {
110855 + tree fndecl = gimple_call_fndecl(def_stmt);
110856 +
110857 + if (fndecl == NULL_TREE)
110858 + return;
110859 + check_missing_size_overflow_attribute(fndecl);
110860 + return;
110861 + }
110862 + case GIMPLE_PHI:
110863 + return search_size_overflow_attribute_phi(visited, lhs);
110864 + case GIMPLE_ASSIGN:
110865 + switch (gimple_num_ops(def_stmt)) {
110866 + case 2:
110867 + return search_size_overflow_attribute(visited, gimple_assign_rhs1(def_stmt));
110868 + case 3:
110869 + return search_size_overflow_attribute_binary(visited, lhs);
110870 + }
110871 + default:
110872 + debug_gimple_stmt((gimple)def_stmt);
110873 + error("%s: unknown gimple code", __func__);
110874 + gcc_unreachable();
110875 + }
110876 +}
110877 +
110878 +// Search missing entries in the hash table (invoked from the gimple pass)
110879 +static void search_missing_size_overflow_attribute_gimple(const_gimple stmt, unsigned int num)
110880 +{
110881 + tree fndecl = NULL_TREE;
110882 + tree lhs;
110883 + struct pointer_set_t *visited;
110884 +
110885 + if (is_turn_off_intentional_attr(DECL_ORIGIN(current_function_decl)))
110886 + return;
110887 +
110888 + if (num == 0) {
110889 + gcc_assert(gimple_code(stmt) == GIMPLE_RETURN);
110890 + lhs = gimple_return_retval(stmt);
110891 + } else {
110892 + gcc_assert(is_gimple_call(stmt));
110893 + lhs = gimple_call_arg(stmt, num - 1);
110894 + fndecl = gimple_call_fndecl(stmt);
110895 + }
110896 +
110897 + if (fndecl != NULL_TREE && is_turn_off_intentional_attr(DECL_ORIGIN(fndecl)))
110898 + return;
110899 +
110900 + visited = pointer_set_create();
110901 + search_size_overflow_attribute(visited, lhs);
110902 + pointer_set_destroy(visited);
110903 +}
110904 +
110905 +static void create_output_from_phi(gimple stmt, unsigned int argnum, struct asm_data *asm_data)
110906 +{
110907 + gimple_stmt_iterator gsi;
110908 + gimple assign;
110909 +
110910 + assign = gimple_build_assign(asm_data->input, asm_data->output);
110911 + gsi = gsi_for_stmt(stmt);
110912 + gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
110913 + asm_data->def_stmt = assign;
110914 +
110915 + asm_data->output = create_new_var(TREE_TYPE(asm_data->output));
110916 + asm_data->output = make_ssa_name(asm_data->output, stmt);
110917 + if (gimple_code(stmt) == GIMPLE_RETURN)
110918 + gimple_return_set_retval(stmt, asm_data->output);
110919 + else
110920 + gimple_call_set_arg(stmt, argnum - 1, asm_data->output);
110921 + update_stmt(stmt);
110922 +}
110923 +
110924 +static char *create_asm_comment(unsigned int argnum, const_gimple stmt , const char *mark_str)
110925 +{
110926 + const char *fn_name;
110927 + char *asm_comment;
110928 + unsigned int len;
110929 +
110930 + if (argnum == 0)
110931 + fn_name = DECL_NAME_POINTER(current_function_decl);
110932 + else
110933 + fn_name = DECL_NAME_POINTER(gimple_call_fndecl(stmt));
110934 +
110935 + len = asprintf(&asm_comment, "%s %s %u", mark_str, fn_name, argnum);
110936 + gcc_assert(len > 0);
110937 +
110938 + return asm_comment;
110939 +}
110940 +
110941 +static const char *convert_mark_to_str(enum mark mark)
110942 +{
110943 + switch (mark) {
110944 + case MARK_NO:
110945 + return OK_ASM_STR;
110946 + case MARK_YES:
110947 + case MARK_NOT_INTENTIONAL:
110948 + return YES_ASM_STR;
110949 + case MARK_TURN_OFF:
110950 + return TURN_OFF_ASM_STR;
110951 + }
110952 +
110953 + gcc_unreachable();
110954 +}
110955 +
110956 +/* Create the input of the size_overflow asm stmt.
110957 + * When the arg of the callee function is a parm_decl it creates this kind of size_overflow asm stmt:
110958 + * __asm__("# size_overflow MARK_YES" : : "rm" size_1(D));
110959 + * The input field in asm_data will be empty if there is no need for further size_overflow asm stmt insertion.
110960 + * otherwise create the input (for a phi stmt the output too) of the asm stmt.
110961 + */
110962 +static void create_asm_input(gimple stmt, unsigned int argnum, struct asm_data *asm_data)
110963 +{
110964 + if (!asm_data->def_stmt) {
110965 + asm_data->input = NULL_TREE;
110966 + return;
110967 + }
110968 +
110969 + asm_data->input = create_new_var(TREE_TYPE(asm_data->output));
110970 + asm_data->input = make_ssa_name(asm_data->input, asm_data->def_stmt);
110971 +
110972 + switch (gimple_code(asm_data->def_stmt)) {
110973 + case GIMPLE_ASSIGN:
110974 + case GIMPLE_CALL:
110975 + replace_call_lhs(asm_data);
110976 + break;
110977 + case GIMPLE_PHI:
110978 + create_output_from_phi(stmt, argnum, asm_data);
110979 + break;
110980 + case GIMPLE_NOP: {
110981 + enum mark mark;
110982 + const char *mark_str;
110983 + char *asm_comment;
110984 +
110985 + mark = check_intentional_attribute_gimple(asm_data->output, stmt, argnum);
110986 +
110987 + asm_data->input = asm_data->output;
110988 + asm_data->output = NULL;
110989 + asm_data->def_stmt = stmt;
110990 +
110991 + mark_str = convert_mark_to_str(mark);
110992 + asm_comment = create_asm_comment(argnum, stmt, mark_str);
110993 +
110994 + create_asm_stmt(asm_comment, build_string(3, "rm"), NULL, asm_data);
110995 + free(asm_comment);
110996 + asm_data->input = NULL_TREE;
110997 + break;
110998 + }
110999 + case GIMPLE_ASM:
111000 + if (is_size_overflow_asm(asm_data->def_stmt)) {
111001 + asm_data->input = NULL_TREE;
111002 + break;
111003 + }
111004 + default:
111005 + debug_gimple_stmt(asm_data->def_stmt);
111006 + gcc_unreachable();
111007 + }
111008 +}
111009 +
111010 +/* This is the gimple part of searching for a missing size_overflow attribute. If the intentional_overflow attribute type
111011 + * is of the right kind create the appropriate size_overflow asm stmts:
111012 + * __asm__("# size_overflow" : =rm" D.3344_8 : "0" cicus.4_16);
111013 + * __asm__("# size_overflow MARK_YES" : : "rm" size_1(D));
111014 + */
111015 +static void create_size_overflow_asm(gimple stmt, tree output_node, unsigned int argnum)
111016 +{
111017 + struct asm_data asm_data;
111018 + const char *mark_str;
111019 + char *asm_comment;
111020 + enum mark mark;
111021 +
111022 + if (is_gimple_constant(output_node))
111023 + return;
111024 +
111025 + asm_data.output = output_node;
111026 + mark = check_intentional_attribute_gimple(asm_data.output, stmt, argnum);
111027 + if (mark != MARK_TURN_OFF)
111028 + search_missing_size_overflow_attribute_gimple(stmt, argnum);
111029 +
111030 + asm_data.def_stmt = get_def_stmt(asm_data.output);
111031 + if (is_size_overflow_intentional_asm_turn_off(asm_data.def_stmt))
111032 + return;
111033 +
111034 + create_asm_input(stmt, argnum, &asm_data);
111035 + if (asm_data.input == NULL_TREE)
111036 + return;
111037 +
111038 + mark_str = convert_mark_to_str(mark);
111039 + asm_comment = create_asm_comment(argnum, stmt, mark_str);
111040 + create_asm_stmt(asm_comment, build_string(2, "0"), build_string(4, "=rm"), &asm_data);
111041 + free(asm_comment);
111042 +}
111043 +
111044 +// Insert an asm stmt with "MARK_TURN_OFF", "MARK_YES" or "MARK_NOT_INTENTIONAL".
111045 +static bool create_mark_asm(gimple stmt, enum mark mark)
111046 +{
111047 + struct asm_data asm_data;
111048 + const char *asm_str;
111049 +
111050 + switch (mark) {
111051 + case MARK_TURN_OFF:
111052 + asm_str = TURN_OFF_ASM_STR;
111053 + break;
111054 + case MARK_NOT_INTENTIONAL:
111055 + case MARK_YES:
111056 + asm_str = YES_ASM_STR;
111057 + break;
111058 + default:
111059 + gcc_unreachable();
111060 + }
111061 +
111062 + asm_data.def_stmt = stmt;
111063 + asm_data.output = gimple_call_lhs(stmt);
111064 +
111065 + if (asm_data.output == NULL_TREE) {
111066 + asm_data.input = gimple_call_arg(stmt, 0);
111067 + if (is_gimple_constant(asm_data.input))
111068 + return false;
111069 + asm_data.output = NULL;
111070 + create_asm_stmt(asm_str, build_string(3, "rm"), NULL, &asm_data);
111071 + return true;
111072 + }
111073 +
111074 + create_asm_input(stmt, 0, &asm_data);
111075 + gcc_assert(asm_data.input != NULL_TREE);
111076 +
111077 + create_asm_stmt(asm_str, build_string(2, "0"), build_string(4, "=rm"), &asm_data);
111078 + return true;
111079 +}
111080 +
111081 +static bool is_from_cast(const_tree node)
111082 +{
111083 + gimple def_stmt = get_def_stmt(node);
111084 +
111085 + if (!def_stmt)
111086 + return false;
111087 +
111088 + if (gimple_assign_cast_p(def_stmt))
111089 + return true;
111090 +
111091 + return false;
111092 +}
111093 +
111094 +// Skip duplication when there is a minus expr and the type of rhs1 or rhs2 is a pointer_type.
111095 +static bool skip_ptr_minus(gimple stmt)
111096 +{
111097 + const_tree rhs1, rhs2, ptr1_rhs, ptr2_rhs;
111098 +
111099 + if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
111100 + return false;
111101 +
111102 + rhs1 = gimple_assign_rhs1(stmt);
111103 + if (!is_from_cast(rhs1))
111104 + return false;
111105 +
111106 + rhs2 = gimple_assign_rhs2(stmt);
111107 + if (!is_from_cast(rhs2))
111108 + return false;
111109 +
111110 + ptr1_rhs = gimple_assign_rhs1(get_def_stmt(rhs1));
111111 + ptr2_rhs = gimple_assign_rhs1(get_def_stmt(rhs2));
111112 +
111113 + if (TREE_CODE(TREE_TYPE(ptr1_rhs)) != POINTER_TYPE && TREE_CODE(TREE_TYPE(ptr2_rhs)) != POINTER_TYPE)
111114 + return false;
111115 +
111116 + create_mark_asm(stmt, MARK_YES);
111117 + return true;
111118 +}
111119 +
111120 +static void walk_use_def_ptr(struct pointer_set_t *visited, const_tree lhs)
111121 +{
111122 + gimple def_stmt;
111123 +
111124 + def_stmt = get_def_stmt(lhs);
111125 + if (!def_stmt)
111126 + return;
111127 +
111128 + if (pointer_set_insert(visited, def_stmt))
111129 + return;
111130 +
111131 + switch (gimple_code(def_stmt)) {
111132 + case GIMPLE_NOP:
111133 + case GIMPLE_ASM:
111134 + case GIMPLE_CALL:
111135 + break;
111136 + case GIMPLE_PHI: {
111137 + unsigned int i, n = gimple_phi_num_args(def_stmt);
111138 +
111139 + pointer_set_insert(visited, def_stmt);
111140 +
111141 + for (i = 0; i < n; i++) {
111142 + tree arg = gimple_phi_arg_def(def_stmt, i);
111143 +
111144 + walk_use_def_ptr(visited, arg);
111145 + }
111146 + }
111147 + case GIMPLE_ASSIGN:
111148 + switch (gimple_num_ops(def_stmt)) {
111149 + case 2:
111150 + walk_use_def_ptr(visited, gimple_assign_rhs1(def_stmt));
111151 + return;
111152 + case 3:
111153 + if (skip_ptr_minus(def_stmt))
111154 + return;
111155 +
111156 + walk_use_def_ptr(visited, gimple_assign_rhs1(def_stmt));
111157 + walk_use_def_ptr(visited, gimple_assign_rhs2(def_stmt));
111158 + return;
111159 + default:
111160 + return;
111161 + }
111162 + default:
111163 + debug_gimple_stmt((gimple)def_stmt);
111164 + error("%s: unknown gimple code", __func__);
111165 + gcc_unreachable();
111166 + }
111167 +}
111168 +
111169 +// Look for a ptr - ptr expression (e.g., cpuset_common_file_read() s - page)
111170 +static void insert_mark_not_intentional_asm_at_ptr(const_tree arg)
111171 +{
111172 + struct pointer_set_t *visited;
111173 +
111174 + visited = pointer_set_create();
111175 + walk_use_def_ptr(visited, arg);
111176 + pointer_set_destroy(visited);
111177 +}
111178 +
111179 +// Determine the return value and insert the asm stmt to mark the return stmt.
111180 +static void insert_asm_ret(gimple stmt)
111181 +{
111182 + tree ret;
111183 +
111184 + ret = gimple_return_retval(stmt);
111185 + create_size_overflow_asm(stmt, ret, 0);
111186 +}
111187 +
111188 +// Determine the correct arg index and arg and insert the asm stmt to mark the stmt.
111189 +static void insert_asm_arg(gimple stmt, unsigned int orig_argnum)
111190 +{
111191 + tree arg;
111192 + unsigned int argnum;
111193 +
111194 + argnum = get_correct_arg_count(orig_argnum, gimple_call_fndecl(stmt));
111195 + gcc_assert(argnum != 0);
111196 + if (argnum == CANNOT_FIND_ARG)
111197 + return;
111198 +
111199 + arg = gimple_call_arg(stmt, argnum - 1);
111200 + gcc_assert(arg != NULL_TREE);
111201 +
111202 + // skip all ptr - ptr expressions
111203 + insert_mark_not_intentional_asm_at_ptr(arg);
111204 +
111205 + create_size_overflow_asm(stmt, arg, argnum);
111206 +}
111207 +
111208 +// If a function arg or the return value is marked by the size_overflow attribute then set its index in the array.
111209 +static void set_argnum_attribute(const_tree attr, bool *argnums)
111210 +{
111211 + unsigned int argnum;
111212 + tree attr_value;
111213 +
111214 + for (attr_value = TREE_VALUE(attr); attr_value; attr_value = TREE_CHAIN(attr_value)) {
111215 + argnum = TREE_INT_CST_LOW(TREE_VALUE(attr_value));
111216 + argnums[argnum] = true;
111217 + }
111218 +}
111219 +
111220 +// If a function arg or the return value is in the hash table then set its index in the array.
111221 +static void set_argnum_hash(tree fndecl, bool *argnums)
111222 +{
111223 + unsigned int num;
111224 + const struct size_overflow_hash *hash;
111225 +
111226 + hash = get_function_hash(DECL_ORIGIN(fndecl));
111227 + if (!hash)
111228 + return;
111229 +
111230 + for (num = 0; num <= MAX_PARAM; num++) {
111231 + if (!(hash->param & (1U << num)))
111232 + continue;
111233 +
111234 + argnums[num] = true;
111235 + }
111236 +}
111237 +
111238 +static bool is_all_the_argnums_empty(bool *argnums)
111239 +{
111240 + unsigned int i;
111241 +
111242 + for (i = 0; i <= MAX_PARAM; i++)
111243 + if (argnums[i])
111244 + return false;
111245 + return true;
111246 +}
111247 +
111248 +// Check whether the arguments or the return value of the function are in the hash table or are marked by the size_overflow attribute.
111249 +static void search_interesting_args(tree fndecl, bool *argnums)
111250 +{
111251 + const_tree attr;
111252 +
111253 + set_argnum_hash(fndecl, argnums);
111254 + if (!is_all_the_argnums_empty(argnums))
111255 + return;
111256 +
111257 + attr = lookup_attribute("size_overflow", DECL_ATTRIBUTES(fndecl));
111258 + if (attr && TREE_VALUE(attr))
111259 + set_argnum_attribute(attr, argnums);
111260 +}
111261 +
111262 +/*
111263 + * Look up the intentional_overflow attribute that turns off ipa based duplication
111264 + * on the callee function.
111265 + */
111266 +static bool is_mark_turn_off_attribute(gimple stmt)
111267 +{
111268 + enum mark mark;
111269 + const_tree fndecl = gimple_call_fndecl(stmt);
111270 +
111271 + mark = get_intentional_attr_type(DECL_ORIGIN(fndecl));
111272 + if (mark == MARK_TURN_OFF)
111273 + return true;
111274 + return false;
111275 +}
111276 +
111277 +// If the argument(s) of the callee function is/are in the hash table or are marked by an attribute then mark the call stmt with an asm stmt
111278 +static void handle_interesting_function(gimple stmt)
111279 +{
111280 + unsigned int argnum;
111281 + tree fndecl;
111282 + bool orig_argnums[MAX_PARAM + 1] = {false};
111283 +
111284 + if (gimple_call_num_args(stmt) == 0)
111285 + return;
111286 + fndecl = gimple_call_fndecl(stmt);
111287 + if (fndecl == NULL_TREE)
111288 + return;
111289 + fndecl = DECL_ORIGIN(fndecl);
111290 +
111291 + if (is_mark_turn_off_attribute(stmt)) {
111292 + create_mark_asm(stmt, MARK_TURN_OFF);
111293 + return;
111294 + }
111295 +
111296 + search_interesting_args(fndecl, orig_argnums);
111297 +
111298 + for (argnum = 1; argnum < MAX_PARAM; argnum++)
111299 + if (orig_argnums[argnum])
111300 + insert_asm_arg(stmt, argnum);
111301 +}
111302 +
111303 +// If the return value of the caller function is in hash table (its index is 0) then mark the return stmt with an asm stmt
111304 +static void handle_interesting_ret(gimple stmt)
111305 +{
111306 + bool orig_argnums[MAX_PARAM + 1] = {false};
111307 +
111308 + search_interesting_args(current_function_decl, orig_argnums);
111309 +
111310 + if (orig_argnums[0])
111311 + insert_asm_ret(stmt);
111312 +}
111313 +
111314 +// Iterate over all the stmts and search for call and return stmts and mark them if they're in the hash table
111315 +static unsigned int search_interesting_functions(void)
111316 +{
111317 + basic_block bb;
111318 +
111319 + FOR_ALL_BB_FN(bb, cfun) {
111320 + gimple_stmt_iterator gsi;
111321 +
111322 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
111323 + gimple stmt = gsi_stmt(gsi);
111324 +
111325 + if (is_size_overflow_asm(stmt))
111326 + continue;
111327 +
111328 + if (is_gimple_call(stmt))
111329 + handle_interesting_function(stmt);
111330 + else if (gimple_code(stmt) == GIMPLE_RETURN)
111331 + handle_interesting_ret(stmt);
111332 + }
111333 + }
111334 + return 0;
111335 +}
111336 +
111337 +/*
111338 + * A lot of functions get inlined before the ipa passes so after the build_ssa gimple pass
111339 + * this pass inserts asm stmts to mark the interesting args
111340 + * that the ipa pass will detect and insert the size overflow checks for.
111341 + */
111342 +#if BUILDING_GCC_VERSION >= 4009
111343 +static const struct pass_data insert_size_overflow_asm_pass_data = {
111344 +#else
111345 +static struct gimple_opt_pass insert_size_overflow_asm_pass = {
111346 + .pass = {
111347 +#endif
111348 + .type = GIMPLE_PASS,
111349 + .name = "insert_size_overflow_asm",
111350 +#if BUILDING_GCC_VERSION >= 4008
111351 + .optinfo_flags = OPTGROUP_NONE,
111352 +#endif
111353 +#if BUILDING_GCC_VERSION >= 4009
111354 + .has_gate = false,
111355 + .has_execute = true,
111356 +#else
111357 + .gate = NULL,
111358 + .execute = search_interesting_functions,
111359 + .sub = NULL,
111360 + .next = NULL,
111361 + .static_pass_number = 0,
111362 +#endif
111363 + .tv_id = TV_NONE,
111364 + .properties_required = PROP_cfg,
111365 + .properties_provided = 0,
111366 + .properties_destroyed = 0,
111367 + .todo_flags_start = 0,
111368 + .todo_flags_finish = TODO_dump_func | TODO_verify_ssa | TODO_verify_stmts | TODO_remove_unused_locals | TODO_update_ssa_no_phi | TODO_cleanup_cfg | TODO_ggc_collect | TODO_verify_flow
111369 +#if BUILDING_GCC_VERSION < 4009
111370 + }
111371 +#endif
111372 +};
111373 +
111374 +#if BUILDING_GCC_VERSION >= 4009
111375 +namespace {
111376 +class insert_size_overflow_asm_pass : public gimple_opt_pass {
111377 +public:
111378 + insert_size_overflow_asm_pass() : gimple_opt_pass(insert_size_overflow_asm_pass_data, g) {}
111379 + unsigned int execute() { return search_interesting_functions(); }
111380 +};
111381 +}
111382 +#endif
111383 +
111384 +struct opt_pass *make_insert_size_overflow_asm_pass(void)
111385 +{
111386 +#if BUILDING_GCC_VERSION >= 4009
111387 + return new insert_size_overflow_asm_pass();
111388 +#else
111389 + return &insert_size_overflow_asm_pass.pass;
111390 +#endif
111391 +}
111392 diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c
111393 new file mode 100644
111394 index 0000000..88469e9
111395 --- /dev/null
111396 +++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_core.c
111397 @@ -0,0 +1,902 @@
111398 +/*
111399 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
111400 + * Licensed under the GPL v2, or (at your option) v3
111401 + *
111402 + * Homepage:
111403 + * http://www.grsecurity.net/~ephox/overflow_plugin/
111404 + *
111405 + * Documentation:
111406 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
111407 + *
111408 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
111409 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
111410 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
111411 + *
111412 + * Usage:
111413 + * $ make
111414 + * $ make run
111415 + */
111416 +
111417 +#include "gcc-common.h"
111418 +#include "size_overflow.h"
111419 +
111420 +#define MIN_CHECK true
111421 +#define MAX_CHECK false
111422 +
111423 +static tree get_size_overflow_type(struct visited *visited, const_gimple stmt, const_tree node)
111424 +{
111425 + const_tree type;
111426 + tree new_type;
111427 +
111428 + gcc_assert(node != NULL_TREE);
111429 +
111430 + type = TREE_TYPE(node);
111431 +
111432 + if (pointer_set_contains(visited->my_stmts, stmt))
111433 + return TREE_TYPE(node);
111434 +
111435 + switch (TYPE_MODE(type)) {
111436 + case QImode:
111437 + new_type = size_overflow_type_HI;
111438 + break;
111439 + case HImode:
111440 + new_type = size_overflow_type_SI;
111441 + break;
111442 + case SImode:
111443 + new_type = size_overflow_type_DI;
111444 + break;
111445 + case DImode:
111446 + if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
111447 + new_type = TYPE_UNSIGNED(type) ? unsigned_intDI_type_node : intDI_type_node;
111448 + else
111449 + new_type = size_overflow_type_TI;
111450 + break;
111451 + case TImode:
111452 + gcc_assert(!TYPE_UNSIGNED(type));
111453 + new_type = size_overflow_type_TI;
111454 + break;
111455 + default:
111456 + debug_tree((tree)node);
111457 + error("%s: unsupported gcc configuration (%qE).", __func__, current_function_decl);
111458 + gcc_unreachable();
111459 + }
111460 +
111461 + if (TYPE_QUALS(type) != 0)
111462 + return build_qualified_type(new_type, TYPE_QUALS(type));
111463 + return new_type;
111464 +}
111465 +
111466 +static tree get_lhs(const_gimple stmt)
111467 +{
111468 + switch (gimple_code(stmt)) {
111469 + case GIMPLE_ASSIGN:
111470 + case GIMPLE_CALL:
111471 + return gimple_get_lhs(stmt);
111472 + case GIMPLE_PHI:
111473 + return gimple_phi_result(stmt);
111474 + default:
111475 + return NULL_TREE;
111476 + }
111477 +}
111478 +
111479 +static tree cast_to_new_size_overflow_type(struct visited *visited, gimple stmt, tree rhs, tree size_overflow_type, bool before)
111480 +{
111481 + gimple_stmt_iterator gsi;
111482 + tree lhs;
111483 + gimple new_stmt;
111484 +
111485 + if (rhs == NULL_TREE)
111486 + return NULL_TREE;
111487 +
111488 + gsi = gsi_for_stmt(stmt);
111489 + new_stmt = build_cast_stmt(visited, size_overflow_type, rhs, CREATE_NEW_VAR, &gsi, before, false);
111490 + pointer_set_insert(visited->my_stmts, new_stmt);
111491 +
111492 + lhs = get_lhs(new_stmt);
111493 + gcc_assert(lhs != NULL_TREE);
111494 + return lhs;
111495 +}
111496 +
111497 +tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before)
111498 +{
111499 + tree lhs, dst_type;
111500 + gimple_stmt_iterator gsi;
111501 +
111502 + if (rhs1 == NULL_TREE) {
111503 + debug_gimple_stmt(oldstmt);
111504 + error("%s: rhs1 is NULL_TREE", __func__);
111505 + gcc_unreachable();
111506 + }
111507 +
111508 + switch (gimple_code(oldstmt)) {
111509 + case GIMPLE_ASM:
111510 + lhs = rhs1;
111511 + break;
111512 + case GIMPLE_CALL:
111513 + case GIMPLE_ASSIGN:
111514 + lhs = gimple_get_lhs(oldstmt);
111515 + break;
111516 + default:
111517 + debug_gimple_stmt(oldstmt);
111518 + gcc_unreachable();
111519 + }
111520 +
111521 + gsi = gsi_for_stmt(oldstmt);
111522 + pointer_set_insert(visited->stmts, oldstmt);
111523 + if (lookup_stmt_eh_lp(oldstmt) != 0) {
111524 + basic_block next_bb, cur_bb;
111525 + const_edge e;
111526 +
111527 + gcc_assert(before == false);
111528 + gcc_assert(stmt_can_throw_internal(oldstmt));
111529 + gcc_assert(gimple_code(oldstmt) == GIMPLE_CALL);
111530 + gcc_assert(!gsi_end_p(gsi));
111531 +
111532 + cur_bb = gimple_bb(oldstmt);
111533 + next_bb = cur_bb->next_bb;
111534 + e = find_edge(cur_bb, next_bb);
111535 + gcc_assert(e != NULL);
111536 + gcc_assert(e->flags & EDGE_FALLTHRU);
111537 +
111538 + gsi = gsi_after_labels(next_bb);
111539 + gcc_assert(!gsi_end_p(gsi));
111540 +
111541 + before = true;
111542 + oldstmt = gsi_stmt(gsi);
111543 + }
111544 +
111545 + dst_type = get_size_overflow_type(visited, oldstmt, lhs);
111546 +
111547 + if (is_gimple_constant(rhs1))
111548 + return cast_a_tree(dst_type, rhs1);
111549 + return cast_to_new_size_overflow_type(visited, oldstmt, rhs1, dst_type, before);
111550 +}
111551 +
111552 +tree dup_assign(struct visited *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3)
111553 +{
111554 + gimple stmt;
111555 + gimple_stmt_iterator gsi;
111556 + tree size_overflow_type, new_var, lhs = gimple_assign_lhs(oldstmt);
111557 +
111558 + if (pointer_set_contains(visited->my_stmts, oldstmt))
111559 + return lhs;
111560 +
111561 + if (gimple_num_ops(oldstmt) != 4 && rhs1 == NULL_TREE) {
111562 + rhs1 = gimple_assign_rhs1(oldstmt);
111563 + rhs1 = create_assign(visited, oldstmt, rhs1, BEFORE_STMT);
111564 + }
111565 + if (gimple_num_ops(oldstmt) == 3 && rhs2 == NULL_TREE) {
111566 + rhs2 = gimple_assign_rhs2(oldstmt);
111567 + rhs2 = create_assign(visited, oldstmt, rhs2, BEFORE_STMT);
111568 + }
111569 +
111570 + stmt = gimple_copy(oldstmt);
111571 + gimple_set_location(stmt, gimple_location(oldstmt));
111572 + pointer_set_insert(visited->my_stmts, stmt);
111573 +
111574 + if (gimple_assign_rhs_code(oldstmt) == WIDEN_MULT_EXPR)
111575 + gimple_assign_set_rhs_code(stmt, MULT_EXPR);
111576 +
111577 + size_overflow_type = get_size_overflow_type(visited, oldstmt, node);
111578 +
111579 + new_var = create_new_var(size_overflow_type);
111580 + new_var = make_ssa_name(new_var, stmt);
111581 + gimple_assign_set_lhs(stmt, new_var);
111582 +
111583 + if (rhs1 != NULL_TREE)
111584 + gimple_assign_set_rhs1(stmt, rhs1);
111585 +
111586 + if (rhs2 != NULL_TREE)
111587 + gimple_assign_set_rhs2(stmt, rhs2);
111588 +#if BUILDING_GCC_VERSION >= 4006
111589 + if (rhs3 != NULL_TREE)
111590 + gimple_assign_set_rhs3(stmt, rhs3);
111591 +#endif
111592 + gimple_set_vuse(stmt, gimple_vuse(oldstmt));
111593 + gimple_set_vdef(stmt, gimple_vdef(oldstmt));
111594 +
111595 + gsi = gsi_for_stmt(oldstmt);
111596 + gsi_insert_after(&gsi, stmt, GSI_SAME_STMT);
111597 + update_stmt(stmt);
111598 + pointer_set_insert(visited->stmts, oldstmt);
111599 + return gimple_assign_lhs(stmt);
111600 +}
111601 +
111602 +static tree cast_parm_decl(struct visited *visited, tree phi_ssa_name, tree arg, tree size_overflow_type, basic_block bb)
111603 +{
111604 + gimple assign;
111605 + gimple_stmt_iterator gsi;
111606 + basic_block first_bb;
111607 +
111608 + gcc_assert(SSA_NAME_IS_DEFAULT_DEF(arg));
111609 +
111610 + if (bb->index == 0) {
111611 + first_bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
111612 + gcc_assert(dom_info_available_p(CDI_DOMINATORS));
111613 + set_immediate_dominator(CDI_DOMINATORS, first_bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
111614 + bb = first_bb;
111615 + }
111616 +
111617 + gsi = gsi_after_labels(bb);
111618 + assign = build_cast_stmt(visited, size_overflow_type, arg, phi_ssa_name, &gsi, BEFORE_STMT, false);
111619 + pointer_set_insert(visited->my_stmts, assign);
111620 +
111621 + return gimple_assign_lhs(assign);
111622 +}
111623 +
111624 +static tree use_phi_ssa_name(struct visited *visited, tree ssa_name_var, tree new_arg)
111625 +{
111626 + gimple_stmt_iterator gsi;
111627 + gimple assign, def_stmt = get_def_stmt(new_arg);
111628 +
111629 + if (gimple_code(def_stmt) == GIMPLE_PHI) {
111630 + gsi = gsi_after_labels(gimple_bb(def_stmt));
111631 + assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, BEFORE_STMT, true);
111632 + } else {
111633 + gsi = gsi_for_stmt(def_stmt);
111634 + assign = build_cast_stmt(visited, TREE_TYPE(new_arg), new_arg, ssa_name_var, &gsi, AFTER_STMT, true);
111635 + }
111636 +
111637 + pointer_set_insert(visited->my_stmts, assign);
111638 + return gimple_assign_lhs(assign);
111639 +}
111640 +
111641 +static tree cast_visited_phi_arg(struct visited *visited, tree ssa_name_var, tree arg, tree size_overflow_type)
111642 +{
111643 + basic_block bb;
111644 + gimple_stmt_iterator gsi;
111645 + const_gimple def_stmt;
111646 + gimple assign;
111647 +
111648 + def_stmt = get_def_stmt(arg);
111649 + bb = gimple_bb(def_stmt);
111650 + gcc_assert(bb->index != 0);
111651 + gsi = gsi_after_labels(bb);
111652 +
111653 + assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, BEFORE_STMT, false);
111654 + pointer_set_insert(visited->my_stmts, assign);
111655 + return gimple_assign_lhs(assign);
111656 +}
111657 +
111658 +static tree create_new_phi_arg(struct visited *visited, tree ssa_name_var, tree new_arg, gimple oldstmt, unsigned int i)
111659 +{
111660 + tree size_overflow_type;
111661 + tree arg;
111662 + const_gimple def_stmt;
111663 +
111664 + if (new_arg != NULL_TREE && is_gimple_constant(new_arg))
111665 + return new_arg;
111666 +
111667 + arg = gimple_phi_arg_def(oldstmt, i);
111668 + def_stmt = get_def_stmt(arg);
111669 + gcc_assert(def_stmt != NULL);
111670 + size_overflow_type = get_size_overflow_type(visited, oldstmt, arg);
111671 +
111672 + switch (gimple_code(def_stmt)) {
111673 + case GIMPLE_PHI:
111674 + return cast_visited_phi_arg(visited, ssa_name_var, arg, size_overflow_type);
111675 + case GIMPLE_NOP: {
111676 + basic_block bb;
111677 +
111678 + bb = gimple_phi_arg_edge(oldstmt, i)->src;
111679 + return cast_parm_decl(visited, ssa_name_var, arg, size_overflow_type, bb);
111680 + }
111681 + case GIMPLE_ASM: {
111682 + gimple_stmt_iterator gsi;
111683 + gimple assign, stmt = get_def_stmt(arg);
111684 +
111685 + gsi = gsi_for_stmt(stmt);
111686 + assign = build_cast_stmt(visited, size_overflow_type, arg, ssa_name_var, &gsi, AFTER_STMT, false);
111687 + pointer_set_insert(visited->my_stmts, assign);
111688 + return gimple_assign_lhs(assign);
111689 + }
111690 + default:
111691 + gcc_assert(new_arg != NULL_TREE);
111692 + gcc_assert(types_compatible_p(TREE_TYPE(new_arg), size_overflow_type));
111693 + return use_phi_ssa_name(visited, ssa_name_var, new_arg);
111694 + }
111695 +}
111696 +
111697 +static gimple overflow_create_phi_node(struct visited *visited, gimple oldstmt, tree result)
111698 +{
111699 + basic_block bb;
111700 + gimple phi;
111701 + gimple_seq seq;
111702 + gimple_stmt_iterator gsi = gsi_for_stmt(oldstmt);
111703 +
111704 + bb = gsi_bb(gsi);
111705 +
111706 + if (result == NULL_TREE) {
111707 + tree old_result = gimple_phi_result(oldstmt);
111708 + tree size_overflow_type = get_size_overflow_type(visited, oldstmt, old_result);
111709 +
111710 + result = create_new_var(size_overflow_type);
111711 + }
111712 +
111713 + phi = create_phi_node(result, bb);
111714 + gimple_phi_set_result(phi, make_ssa_name(result, phi));
111715 + seq = phi_nodes(bb);
111716 + gsi = gsi_last(seq);
111717 + gsi_remove(&gsi, false);
111718 +
111719 + gsi = gsi_for_stmt(oldstmt);
111720 + gsi_insert_after(&gsi, phi, GSI_NEW_STMT);
111721 + gimple_set_bb(phi, bb);
111722 + return phi;
111723 +}
111724 +
111725 +#if BUILDING_GCC_VERSION <= 4007
111726 +static tree create_new_phi_node(struct visited *visited, VEC(tree, heap) **args, tree ssa_name_var, gimple oldstmt)
111727 +#else
111728 +static tree create_new_phi_node(struct visited *visited, vec<tree, va_heap, vl_embed> *&args, tree ssa_name_var, gimple oldstmt)
111729 +#endif
111730 +{
111731 + gimple new_phi;
111732 + unsigned int i;
111733 + tree arg, result;
111734 + location_t loc = gimple_location(oldstmt);
111735 +
111736 +#if BUILDING_GCC_VERSION <= 4007
111737 + gcc_assert(!VEC_empty(tree, *args));
111738 +#else
111739 + gcc_assert(!args->is_empty());
111740 +#endif
111741 +
111742 + new_phi = overflow_create_phi_node(visited, oldstmt, ssa_name_var);
111743 + result = gimple_phi_result(new_phi);
111744 + ssa_name_var = SSA_NAME_VAR(result);
111745 +
111746 +#if BUILDING_GCC_VERSION <= 4007
111747 + FOR_EACH_VEC_ELT(tree, *args, i, arg) {
111748 +#else
111749 + FOR_EACH_VEC_SAFE_ELT(args, i, arg) {
111750 +#endif
111751 + arg = create_new_phi_arg(visited, ssa_name_var, arg, oldstmt, i);
111752 + add_phi_arg(new_phi, arg, gimple_phi_arg_edge(oldstmt, i), loc);
111753 + }
111754 +
111755 +#if BUILDING_GCC_VERSION <= 4007
111756 + VEC_free(tree, heap, *args);
111757 +#else
111758 + vec_free(args);
111759 +#endif
111760 + update_stmt(new_phi);
111761 + pointer_set_insert(visited->my_stmts, new_phi);
111762 + return result;
111763 +}
111764 +
111765 +static tree handle_phi(struct visited *visited, struct cgraph_node *caller_node, tree orig_result)
111766 +{
111767 + tree ssa_name_var = NULL_TREE;
111768 +#if BUILDING_GCC_VERSION <= 4007
111769 + VEC(tree, heap) *args = NULL;
111770 +#else
111771 + vec<tree, va_heap, vl_embed> *args = NULL;
111772 +#endif
111773 + gimple oldstmt = get_def_stmt(orig_result);
111774 + unsigned int i, len = gimple_phi_num_args(oldstmt);
111775 +
111776 + pointer_set_insert(visited->stmts, oldstmt);
111777 + for (i = 0; i < len; i++) {
111778 + tree arg, new_arg;
111779 +
111780 + arg = gimple_phi_arg_def(oldstmt, i);
111781 + new_arg = expand(visited, caller_node, arg);
111782 +
111783 + if (ssa_name_var == NULL_TREE && new_arg != NULL_TREE)
111784 + ssa_name_var = SSA_NAME_VAR(new_arg);
111785 +
111786 + if (is_gimple_constant(arg)) {
111787 + tree size_overflow_type = get_size_overflow_type(visited, oldstmt, arg);
111788 +
111789 + new_arg = cast_a_tree(size_overflow_type, arg);
111790 + }
111791 +
111792 +#if BUILDING_GCC_VERSION <= 4007
111793 + VEC_safe_push(tree, heap, args, new_arg);
111794 +#else
111795 + vec_safe_push(args, new_arg);
111796 +#endif
111797 + }
111798 +
111799 +#if BUILDING_GCC_VERSION <= 4007
111800 + return create_new_phi_node(visited, &args, ssa_name_var, oldstmt);
111801 +#else
111802 + return create_new_phi_node(visited, args, ssa_name_var, oldstmt);
111803 +#endif
111804 +}
111805 +
111806 +static tree create_cast_assign(struct visited *visited, gimple stmt)
111807 +{
111808 + tree rhs1 = gimple_assign_rhs1(stmt);
111809 + tree lhs = gimple_assign_lhs(stmt);
111810 + const_tree rhs1_type = TREE_TYPE(rhs1);
111811 + const_tree lhs_type = TREE_TYPE(lhs);
111812 +
111813 + if (TYPE_UNSIGNED(rhs1_type) == TYPE_UNSIGNED(lhs_type))
111814 + return create_assign(visited, stmt, lhs, AFTER_STMT);
111815 +
111816 + return create_assign(visited, stmt, rhs1, AFTER_STMT);
111817 +}
111818 +
111819 +static bool skip_lhs_cast_check(const_gimple stmt)
111820 +{
111821 + const_tree rhs = gimple_assign_rhs1(stmt);
111822 + const_gimple def_stmt = get_def_stmt(rhs);
111823 +
111824 + // 3.8.2 kernel/futex_compat.c compat_exit_robust_list(): get_user() 64 ulong -> int (compat_long_t), int max
111825 + if (gimple_code(def_stmt) == GIMPLE_ASM)
111826 + return true;
111827 +
111828 + if (is_const_plus_unsigned_signed_truncation(rhs))
111829 + return true;
111830 +
111831 + return false;
111832 +}
111833 +
111834 +static tree create_string_param(tree string)
111835 +{
111836 + tree i_type, a_type;
111837 + const int length = TREE_STRING_LENGTH(string);
111838 +
111839 + gcc_assert(length > 0);
111840 +
111841 + i_type = build_index_type(build_int_cst(NULL_TREE, length - 1));
111842 + a_type = build_array_type(char_type_node, i_type);
111843 +
111844 + TREE_TYPE(string) = a_type;
111845 + TREE_CONSTANT(string) = 1;
111846 + TREE_READONLY(string) = 1;
111847 +
111848 + return build1(ADDR_EXPR, ptr_type_node, string);
111849 +}
111850 +
111851 +static void insert_cond(basic_block cond_bb, tree arg, enum tree_code cond_code, tree type_value)
111852 +{
111853 + gimple cond_stmt;
111854 + gimple_stmt_iterator gsi = gsi_last_bb(cond_bb);
111855 +
111856 + cond_stmt = gimple_build_cond(cond_code, arg, type_value, NULL_TREE, NULL_TREE);
111857 + gsi_insert_after(&gsi, cond_stmt, GSI_CONTINUE_LINKING);
111858 + update_stmt(cond_stmt);
111859 +}
111860 +
111861 +static void insert_cond_result(struct cgraph_node *caller_node, basic_block bb_true, const_gimple stmt, const_tree arg, bool min)
111862 +{
111863 + gimple func_stmt;
111864 + const_gimple def_stmt;
111865 + const_tree loc_line;
111866 + tree loc_file, ssa_name, current_func;
111867 + expanded_location xloc;
111868 + char *ssa_name_buf;
111869 + int len;
111870 + struct cgraph_edge *edge;
111871 + struct cgraph_node *callee_node;
111872 + int frequency;
111873 + gimple_stmt_iterator gsi = gsi_start_bb(bb_true);
111874 +
111875 + def_stmt = get_def_stmt(arg);
111876 + xloc = expand_location(gimple_location(def_stmt));
111877 +
111878 + if (!gimple_has_location(def_stmt)) {
111879 + xloc = expand_location(gimple_location(stmt));
111880 + if (!gimple_has_location(stmt))
111881 + xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl));
111882 + }
111883 +
111884 + loc_line = build_int_cstu(unsigned_type_node, xloc.line);
111885 +
111886 + loc_file = build_string(strlen(xloc.file) + 1, xloc.file);
111887 + loc_file = create_string_param(loc_file);
111888 +
111889 + current_func = build_string(DECL_NAME_LENGTH(current_function_decl) + 1, DECL_NAME_POINTER(current_function_decl));
111890 + current_func = create_string_param(current_func);
111891 +
111892 + gcc_assert(DECL_NAME(SSA_NAME_VAR(arg)) != NULL);
111893 + call_count++;
111894 + len = asprintf(&ssa_name_buf, "%s_%u %s, count: %u\n", DECL_NAME_POINTER(SSA_NAME_VAR(arg)), SSA_NAME_VERSION(arg), min ? "min" : "max", call_count);
111895 + gcc_assert(len > 0);
111896 + ssa_name = build_string(len + 1, ssa_name_buf);
111897 + free(ssa_name_buf);
111898 + ssa_name = create_string_param(ssa_name);
111899 +
111900 + // void report_size_overflow(const char *file, unsigned int line, const char *func, const char *ssa_name)
111901 + func_stmt = gimple_build_call(report_size_overflow_decl, 4, loc_file, loc_line, current_func, ssa_name);
111902 + gsi_insert_after(&gsi, func_stmt, GSI_CONTINUE_LINKING);
111903 +
111904 + callee_node = cgraph_get_create_node(report_size_overflow_decl);
111905 + frequency = compute_call_stmt_bb_frequency(current_function_decl, bb_true);
111906 +
111907 + edge = cgraph_create_edge(caller_node, callee_node, func_stmt, bb_true->count, frequency, bb_true->loop_depth);
111908 + gcc_assert(edge != NULL);
111909 +}
111910 +
111911 +static void insert_check_size_overflow(struct cgraph_node *caller_node, gimple stmt, enum tree_code cond_code, tree arg, tree type_value, bool before, bool min)
111912 +{
111913 + basic_block cond_bb, join_bb, bb_true;
111914 + edge e;
111915 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
111916 +
111917 + cond_bb = gimple_bb(stmt);
111918 + if (before)
111919 + gsi_prev(&gsi);
111920 + if (gsi_end_p(gsi))
111921 + e = split_block_after_labels(cond_bb);
111922 + else
111923 + e = split_block(cond_bb, gsi_stmt(gsi));
111924 + cond_bb = e->src;
111925 + join_bb = e->dest;
111926 + e->flags = EDGE_FALSE_VALUE;
111927 + e->probability = REG_BR_PROB_BASE;
111928 +
111929 + bb_true = create_empty_bb(cond_bb);
111930 + make_edge(cond_bb, bb_true, EDGE_TRUE_VALUE);
111931 + make_edge(cond_bb, join_bb, EDGE_FALSE_VALUE);
111932 + make_edge(bb_true, join_bb, EDGE_FALLTHRU);
111933 +
111934 + gcc_assert(dom_info_available_p(CDI_DOMINATORS));
111935 + set_immediate_dominator(CDI_DOMINATORS, bb_true, cond_bb);
111936 + set_immediate_dominator(CDI_DOMINATORS, join_bb, cond_bb);
111937 +
111938 + if (current_loops != NULL) {
111939 + gcc_assert(cond_bb->loop_father == join_bb->loop_father);
111940 + add_bb_to_loop(bb_true, cond_bb->loop_father);
111941 + }
111942 +
111943 + insert_cond(cond_bb, arg, cond_code, type_value);
111944 + insert_cond_result(caller_node, bb_true, stmt, arg, min);
111945 +
111946 +// print_the_code_insertions(stmt);
111947 +}
111948 +
111949 +void check_size_overflow(struct cgraph_node *caller_node, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before)
111950 +{
111951 + const_tree rhs_type = TREE_TYPE(rhs);
111952 + tree cast_rhs_type, type_max_type, type_min_type, type_max, type_min;
111953 +
111954 + gcc_assert(rhs_type != NULL_TREE);
111955 + if (TREE_CODE(rhs_type) == POINTER_TYPE)
111956 + return;
111957 +
111958 + gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
111959 +
111960 + if (is_const_plus_unsigned_signed_truncation(rhs))
111961 + return;
111962 +
111963 + type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
111964 + // typemax (-1) < typemin (0)
111965 + if (TREE_OVERFLOW(type_max))
111966 + return;
111967 +
111968 + type_min = cast_a_tree(size_overflow_type, TYPE_MIN_VALUE(rhs_type));
111969 +
111970 + cast_rhs_type = TREE_TYPE(cast_rhs);
111971 + type_max_type = TREE_TYPE(type_max);
111972 + gcc_assert(types_compatible_p(cast_rhs_type, type_max_type));
111973 +
111974 + insert_check_size_overflow(caller_node, stmt, GT_EXPR, cast_rhs, type_max, before, MAX_CHECK);
111975 +
111976 + // special case: get_size_overflow_type(), 32, u64->s
111977 + if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode) && TYPE_UNSIGNED(size_overflow_type) && !TYPE_UNSIGNED(rhs_type))
111978 + return;
111979 +
111980 + type_min_type = TREE_TYPE(type_min);
111981 + gcc_assert(types_compatible_p(type_max_type, type_min_type));
111982 + insert_check_size_overflow(caller_node, stmt, LT_EXPR, cast_rhs, type_min, before, MIN_CHECK);
111983 +}
111984 +
111985 +static tree create_cast_overflow_check(struct visited *visited, struct cgraph_node *caller_node, tree new_rhs1, gimple stmt)
111986 +{
111987 + bool cast_lhs, cast_rhs;
111988 + tree lhs = gimple_assign_lhs(stmt);
111989 + tree rhs = gimple_assign_rhs1(stmt);
111990 + const_tree lhs_type = TREE_TYPE(lhs);
111991 + const_tree rhs_type = TREE_TYPE(rhs);
111992 + enum machine_mode lhs_mode = TYPE_MODE(lhs_type);
111993 + enum machine_mode rhs_mode = TYPE_MODE(rhs_type);
111994 + unsigned int lhs_size = GET_MODE_BITSIZE(lhs_mode);
111995 + unsigned int rhs_size = GET_MODE_BITSIZE(rhs_mode);
111996 +
111997 + static bool check_lhs[3][4] = {
111998 + // ss su us uu
111999 + { false, true, true, false }, // lhs > rhs
112000 + { false, false, false, false }, // lhs = rhs
112001 + { true, true, true, true }, // lhs < rhs
112002 + };
112003 +
112004 + static bool check_rhs[3][4] = {
112005 + // ss su us uu
112006 + { true, false, true, true }, // lhs > rhs
112007 + { true, false, true, true }, // lhs = rhs
112008 + { true, false, true, true }, // lhs < rhs
112009 + };
112010 +
112011 + // skip lhs check on signed SI -> HI cast or signed SI -> QI cast !!!!
112012 + if (rhs_mode == SImode && !TYPE_UNSIGNED(rhs_type) && (lhs_mode == HImode || lhs_mode == QImode))
112013 + return create_assign(visited, stmt, lhs, AFTER_STMT);
112014 +
112015 + if (lhs_size > rhs_size) {
112016 + cast_lhs = check_lhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112017 + cast_rhs = check_rhs[0][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112018 + } else if (lhs_size == rhs_size) {
112019 + cast_lhs = check_lhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112020 + cast_rhs = check_rhs[1][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112021 + } else {
112022 + cast_lhs = check_lhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112023 + cast_rhs = check_rhs[2][TYPE_UNSIGNED(rhs_type) + 2 * TYPE_UNSIGNED(lhs_type)];
112024 + }
112025 +
112026 + if (!cast_lhs && !cast_rhs)
112027 + return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
112028 +
112029 + if (cast_lhs && !skip_lhs_cast_check(stmt))
112030 + check_size_overflow(caller_node, stmt, TREE_TYPE(new_rhs1), new_rhs1, lhs, BEFORE_STMT);
112031 +
112032 + if (cast_rhs)
112033 + check_size_overflow(caller_node, stmt, TREE_TYPE(new_rhs1), new_rhs1, rhs, BEFORE_STMT);
112034 +
112035 + return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
112036 +}
112037 +
112038 +static tree handle_unary_rhs(struct visited *visited, struct cgraph_node *caller_node, gimple stmt)
112039 +{
112040 + enum tree_code rhs_code;
112041 + tree rhs1, new_rhs1, lhs = gimple_assign_lhs(stmt);
112042 +
112043 + if (pointer_set_contains(visited->my_stmts, stmt))
112044 + return lhs;
112045 +
112046 + rhs1 = gimple_assign_rhs1(stmt);
112047 + if (TREE_CODE(TREE_TYPE(rhs1)) == POINTER_TYPE)
112048 + return create_assign(visited, stmt, lhs, AFTER_STMT);
112049 +
112050 + new_rhs1 = expand(visited, caller_node, rhs1);
112051 +
112052 + if (new_rhs1 == NULL_TREE)
112053 + return create_cast_assign(visited, stmt);
112054 +
112055 + if (pointer_set_contains(visited->no_cast_check, stmt))
112056 + return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
112057 +
112058 + rhs_code = gimple_assign_rhs_code(stmt);
112059 + if (rhs_code == BIT_NOT_EXPR || rhs_code == NEGATE_EXPR) {
112060 + tree size_overflow_type = get_size_overflow_type(visited, stmt, rhs1);
112061 +
112062 + new_rhs1 = cast_to_new_size_overflow_type(visited, stmt, new_rhs1, size_overflow_type, BEFORE_STMT);
112063 + check_size_overflow(caller_node, stmt, size_overflow_type, new_rhs1, rhs1, BEFORE_STMT);
112064 + return create_assign(visited, stmt, lhs, AFTER_STMT);
112065 + }
112066 +
112067 + if (!gimple_assign_cast_p(stmt))
112068 + return dup_assign(visited, stmt, lhs, new_rhs1, NULL_TREE, NULL_TREE);
112069 +
112070 + return create_cast_overflow_check(visited, caller_node, new_rhs1, stmt);
112071 +}
112072 +
112073 +static tree handle_unary_ops(struct visited *visited, struct cgraph_node *caller_node, gimple stmt)
112074 +{
112075 + tree rhs1, lhs = gimple_assign_lhs(stmt);
112076 + gimple def_stmt = get_def_stmt(lhs);
112077 +
112078 + gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP);
112079 + rhs1 = gimple_assign_rhs1(def_stmt);
112080 +
112081 + if (is_gimple_constant(rhs1))
112082 + return create_assign(visited, def_stmt, lhs, AFTER_STMT);
112083 +
112084 + switch (TREE_CODE(rhs1)) {
112085 + case SSA_NAME: {
112086 + tree ret = handle_unary_rhs(visited, caller_node, def_stmt);
112087 +
112088 + if (gimple_assign_cast_p(stmt))
112089 + unsigned_signed_cast_intentional_overflow(visited, stmt);
112090 + return ret;
112091 + }
112092 + case ARRAY_REF:
112093 + case BIT_FIELD_REF:
112094 + case ADDR_EXPR:
112095 + case COMPONENT_REF:
112096 + case INDIRECT_REF:
112097 +#if BUILDING_GCC_VERSION >= 4006
112098 + case MEM_REF:
112099 +#endif
112100 + case TARGET_MEM_REF:
112101 + case VIEW_CONVERT_EXPR:
112102 + return create_assign(visited, def_stmt, lhs, AFTER_STMT);
112103 + case PARM_DECL:
112104 + case VAR_DECL:
112105 + return create_assign(visited, stmt, lhs, AFTER_STMT);
112106 +
112107 + default:
112108 + debug_gimple_stmt(def_stmt);
112109 + debug_tree(rhs1);
112110 + gcc_unreachable();
112111 + }
112112 +}
112113 +
112114 +static void __unused print_the_code_insertions(const_gimple stmt)
112115 +{
112116 + location_t loc = gimple_location(stmt);
112117 +
112118 + inform(loc, "Integer size_overflow check applied here.");
112119 +}
112120 +
112121 +static tree handle_binary_ops(struct visited *visited, struct cgraph_node *caller_node, tree lhs)
112122 +{
112123 + enum intentional_overflow_type res;
112124 + tree rhs1, rhs2, new_lhs;
112125 + gimple def_stmt = get_def_stmt(lhs);
112126 + tree new_rhs1 = NULL_TREE;
112127 + tree new_rhs2 = NULL_TREE;
112128 +
112129 + rhs1 = gimple_assign_rhs1(def_stmt);
112130 + rhs2 = gimple_assign_rhs2(def_stmt);
112131 +
112132 + /* no DImode/TImode division in the 32/64 bit kernel */
112133 + switch (gimple_assign_rhs_code(def_stmt)) {
112134 + case RDIV_EXPR:
112135 + case TRUNC_DIV_EXPR:
112136 + case CEIL_DIV_EXPR:
112137 + case FLOOR_DIV_EXPR:
112138 + case ROUND_DIV_EXPR:
112139 + case TRUNC_MOD_EXPR:
112140 + case CEIL_MOD_EXPR:
112141 + case FLOOR_MOD_EXPR:
112142 + case ROUND_MOD_EXPR:
112143 + case EXACT_DIV_EXPR:
112144 + case POINTER_PLUS_EXPR:
112145 + case BIT_AND_EXPR:
112146 + return create_assign(visited, def_stmt, lhs, AFTER_STMT);
112147 + default:
112148 + break;
112149 + }
112150 +
112151 + new_lhs = handle_integer_truncation(visited, caller_node, lhs);
112152 + if (new_lhs != NULL_TREE)
112153 + return new_lhs;
112154 +
112155 + if (TREE_CODE(rhs1) == SSA_NAME)
112156 + new_rhs1 = expand(visited, caller_node, rhs1);
112157 + if (TREE_CODE(rhs2) == SSA_NAME)
112158 + new_rhs2 = expand(visited, caller_node, rhs2);
112159 +
112160 + res = add_mul_intentional_overflow(def_stmt);
112161 + if (res != NO_INTENTIONAL_OVERFLOW) {
112162 + new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
112163 + insert_cast_expr(visited, get_def_stmt(new_lhs), res);
112164 + return new_lhs;
112165 + }
112166 +
112167 + if (skip_expr_on_double_type(def_stmt)) {
112168 + new_lhs = dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
112169 + insert_cast_expr(visited, get_def_stmt(new_lhs), NO_INTENTIONAL_OVERFLOW);
112170 + return new_lhs;
112171 + }
112172 +
112173 + if (is_a_neg_overflow(def_stmt, rhs2))
112174 + return handle_intentional_overflow(visited, caller_node, true, def_stmt, new_rhs1, NULL_TREE);
112175 + if (is_a_neg_overflow(def_stmt, rhs1))
112176 + return handle_intentional_overflow(visited, caller_node, true, def_stmt, new_rhs2, new_rhs2);
112177 +
112178 +
112179 + if (is_a_constant_overflow(def_stmt, rhs2))
112180 + return handle_intentional_overflow(visited, caller_node, !is_a_cast_and_const_overflow(rhs1), def_stmt, new_rhs1, NULL_TREE);
112181 + if (is_a_constant_overflow(def_stmt, rhs1))
112182 + return handle_intentional_overflow(visited, caller_node, !is_a_cast_and_const_overflow(rhs2), def_stmt, new_rhs2, new_rhs2);
112183 +
112184 + // the const is between 0 and (signed) MAX
112185 + if (is_gimple_constant(rhs1))
112186 + new_rhs1 = create_assign(visited, def_stmt, rhs1, BEFORE_STMT);
112187 + if (is_gimple_constant(rhs2))
112188 + new_rhs2 = create_assign(visited, def_stmt, rhs2, BEFORE_STMT);
112189 +
112190 + return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
112191 +}
112192 +
112193 +#if BUILDING_GCC_VERSION >= 4006
112194 +static tree get_new_rhs(struct visited *visited, struct cgraph_node *caller_node, tree size_overflow_type, tree rhs)
112195 +{
112196 + if (is_gimple_constant(rhs))
112197 + return cast_a_tree(size_overflow_type, rhs);
112198 + if (TREE_CODE(rhs) != SSA_NAME)
112199 + return NULL_TREE;
112200 + return expand(visited, caller_node, rhs);
112201 +}
112202 +
112203 +static tree handle_ternary_ops(struct visited *visited, struct cgraph_node *caller_node, tree lhs)
112204 +{
112205 + tree rhs1, rhs2, rhs3, new_rhs1, new_rhs2, new_rhs3, size_overflow_type;
112206 + gimple def_stmt = get_def_stmt(lhs);
112207 +
112208 + size_overflow_type = get_size_overflow_type(visited, def_stmt, lhs);
112209 +
112210 + rhs1 = gimple_assign_rhs1(def_stmt);
112211 + rhs2 = gimple_assign_rhs2(def_stmt);
112212 + rhs3 = gimple_assign_rhs3(def_stmt);
112213 + new_rhs1 = get_new_rhs(visited, caller_node, size_overflow_type, rhs1);
112214 + new_rhs2 = get_new_rhs(visited, caller_node, size_overflow_type, rhs2);
112215 + new_rhs3 = get_new_rhs(visited, caller_node, size_overflow_type, rhs3);
112216 +
112217 + return dup_assign(visited, def_stmt, lhs, new_rhs1, new_rhs2, new_rhs3);
112218 +}
112219 +#endif
112220 +
112221 +static tree get_my_stmt_lhs(struct visited *visited, gimple stmt)
112222 +{
112223 + gimple_stmt_iterator gsi;
112224 + gimple next_stmt = NULL;
112225 +
112226 + gsi = gsi_for_stmt(stmt);
112227 +
112228 + do {
112229 + gsi_next(&gsi);
112230 + next_stmt = gsi_stmt(gsi);
112231 +
112232 + if (gimple_code(stmt) == GIMPLE_PHI && !pointer_set_contains(visited->my_stmts, next_stmt))
112233 + return NULL_TREE;
112234 +
112235 + if (pointer_set_contains(visited->my_stmts, next_stmt) && !pointer_set_contains(visited->skip_expr_casts, next_stmt))
112236 + break;
112237 +
112238 + gcc_assert(pointer_set_contains(visited->my_stmts, next_stmt));
112239 + } while (!gsi_end_p(gsi));
112240 +
112241 + gcc_assert(next_stmt);
112242 + return get_lhs(next_stmt);
112243 +}
112244 +
112245 +static tree expand_visited(struct visited *visited, gimple def_stmt)
112246 +{
112247 + gimple_stmt_iterator gsi;
112248 + enum gimple_code code = gimple_code(def_stmt);
112249 +
112250 + if (code == GIMPLE_ASM)
112251 + return NULL_TREE;
112252 +
112253 + gsi = gsi_for_stmt(def_stmt);
112254 + gsi_next(&gsi);
112255 +
112256 + if (gimple_code(def_stmt) == GIMPLE_PHI && gsi_end_p(gsi))
112257 + return NULL_TREE;
112258 + return get_my_stmt_lhs(visited, def_stmt);
112259 +}
112260 +
112261 +tree expand(struct visited *visited, struct cgraph_node *caller_node, tree lhs)
112262 +{
112263 + gimple def_stmt;
112264 +
112265 + def_stmt = get_def_stmt(lhs);
112266 +
112267 + if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
112268 + return NULL_TREE;
112269 +
112270 + if (pointer_set_contains(visited->my_stmts, def_stmt))
112271 + return lhs;
112272 +
112273 + if (pointer_set_contains(visited->stmts, def_stmt))
112274 + return expand_visited(visited, def_stmt);
112275 +
112276 + switch (gimple_code(def_stmt)) {
112277 + case GIMPLE_PHI:
112278 + return handle_phi(visited, caller_node, lhs);
112279 + case GIMPLE_CALL:
112280 + case GIMPLE_ASM:
112281 + return create_assign(visited, def_stmt, lhs, AFTER_STMT);
112282 + case GIMPLE_ASSIGN:
112283 + switch (gimple_num_ops(def_stmt)) {
112284 + case 2:
112285 + return handle_unary_ops(visited, caller_node, def_stmt);
112286 + case 3:
112287 + return handle_binary_ops(visited, caller_node, lhs);
112288 +#if BUILDING_GCC_VERSION >= 4006
112289 + case 4:
112290 + return handle_ternary_ops(visited, caller_node, lhs);
112291 +#endif
112292 + }
112293 + default:
112294 + debug_gimple_stmt(def_stmt);
112295 + error("%s: unknown gimple code", __func__);
112296 + gcc_unreachable();
112297 + }
112298 +}
112299 +
112300 diff --git a/tools/gcc/size_overflow_plugin/insert_size_overflow_check_ipa.c b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_ipa.c
112301 new file mode 100644
112302 index 0000000..f8f5dd5
112303 --- /dev/null
112304 +++ b/tools/gcc/size_overflow_plugin/insert_size_overflow_check_ipa.c
112305 @@ -0,0 +1,1133 @@
112306 +/*
112307 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
112308 + * Licensed under the GPL v2, or (at your option) v3
112309 + *
112310 + * Homepage:
112311 + * http://www.grsecurity.net/~ephox/overflow_plugin/
112312 + *
112313 + * Documentation:
112314 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
112315 + *
112316 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
112317 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
112318 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
112319 + *
112320 + * Usage:
112321 + * $ make
112322 + * $ make run
112323 + */
112324 +
112325 +#include "gcc-common.h"
112326 +#include "size_overflow.h"
112327 +
112328 +#define VEC_LEN 128
112329 +#define RET_CHECK NULL_TREE
112330 +#define WRONG_NODE 32
112331 +#define NOT_INTENTIONAL_ASM NULL
112332 +
112333 +unsigned int call_count;
112334 +
112335 +static void set_conditions(struct pointer_set_t *visited, bool *interesting_conditions, const_tree lhs);
112336 +static void walk_use_def(struct pointer_set_t *visited, struct interesting_node *cur_node, tree lhs);
112337 +
112338 +struct visited_fns {
112339 + struct visited_fns *next;
112340 + const_tree fndecl;
112341 + unsigned int num;
112342 + const_gimple first_stmt;
112343 +};
112344 +
112345 +struct next_cgraph_node {
112346 + struct next_cgraph_node *next;
112347 + struct cgraph_node *current_function;
112348 + tree callee_fndecl;
112349 + unsigned int num;
112350 +};
112351 +
112352 +// Don't want to duplicate entries in next_cgraph_node
112353 +static bool is_in_next_cgraph_node(struct next_cgraph_node *head, struct cgraph_node *node, const_tree fndecl, unsigned int num)
112354 +{
112355 + const_tree new_callee_fndecl;
112356 + struct next_cgraph_node *cur_node;
112357 +
112358 + if (fndecl == RET_CHECK)
112359 + new_callee_fndecl = NODE_DECL(node);
112360 + else
112361 + new_callee_fndecl = fndecl;
112362 +
112363 + for (cur_node = head; cur_node; cur_node = cur_node->next) {
112364 + if (!operand_equal_p(NODE_DECL(cur_node->current_function), NODE_DECL(node), 0))
112365 + continue;
112366 + if (!operand_equal_p(cur_node->callee_fndecl, new_callee_fndecl, 0))
112367 + continue;
112368 + if (num == cur_node->num)
112369 + return true;
112370 + }
112371 + return false;
112372 +}
112373 +
112374 +/* Add a next_cgraph_node into the list for handle_function().
112375 + * handle_function() iterates over all the next cgraph nodes and
112376 + * starts the overflow check insertion process.
112377 + */
112378 +static struct next_cgraph_node *create_new_next_cgraph_node(struct next_cgraph_node *head, struct cgraph_node *node, tree fndecl, unsigned int num)
112379 +{
112380 + struct next_cgraph_node *new_node;
112381 +
112382 + if (is_in_next_cgraph_node(head, node, fndecl, num))
112383 + return head;
112384 +
112385 + new_node = (struct next_cgraph_node *)xmalloc(sizeof(*new_node));
112386 + new_node->current_function = node;
112387 + new_node->next = NULL;
112388 + new_node->num = num;
112389 + if (fndecl == RET_CHECK)
112390 + new_node->callee_fndecl = NODE_DECL(node);
112391 + else
112392 + new_node->callee_fndecl = fndecl;
112393 +
112394 + if (!head)
112395 + return new_node;
112396 +
112397 + new_node->next = head;
112398 + return new_node;
112399 +}
112400 +
112401 +static struct next_cgraph_node *create_new_next_cgraph_nodes(struct next_cgraph_node *head, struct cgraph_node *node, unsigned int num)
112402 +{
112403 + struct cgraph_edge *e;
112404 +
112405 + if (num == 0)
112406 + return create_new_next_cgraph_node(head, node, RET_CHECK, num);
112407 +
112408 + for (e = node->callers; e; e = e->next_caller) {
112409 + tree fndecl = gimple_call_fndecl(e->call_stmt);
112410 +
112411 + gcc_assert(fndecl != NULL_TREE);
112412 + head = create_new_next_cgraph_node(head, e->caller, fndecl, num);
112413 + }
112414 +
112415 + return head;
112416 +}
112417 +
112418 +struct missing_functions {
112419 + struct missing_functions *next;
112420 + const_tree node;
112421 + tree fndecl;
112422 +};
112423 +
112424 +static struct missing_functions *create_new_missing_function(struct missing_functions *missing_fn_head, tree node)
112425 +{
112426 + struct missing_functions *new_function;
112427 +
112428 + new_function = (struct missing_functions *)xmalloc(sizeof(*new_function));
112429 + new_function->node = node;
112430 + new_function->next = NULL;
112431 +
112432 + if (TREE_CODE(node) == FUNCTION_DECL)
112433 + new_function->fndecl = node;
112434 + else
112435 + new_function->fndecl = current_function_decl;
112436 + gcc_assert(new_function->fndecl);
112437 +
112438 + if (!missing_fn_head)
112439 + return new_function;
112440 +
112441 + new_function->next = missing_fn_head;
112442 + return new_function;
112443 +}
112444 +
112445 +/* If the function is missing from the hash table and it is a static function
112446 + * then create a next_cgraph_node from it for handle_function()
112447 + */
112448 +static struct next_cgraph_node *check_missing_overflow_attribute_and_create_next_node(struct next_cgraph_node *cnodes, struct missing_functions *missing_fn_head)
112449 +{
112450 + unsigned int num;
112451 + const_tree orig_fndecl;
112452 + struct cgraph_node *next_node = NULL;
112453 +
112454 + orig_fndecl = DECL_ORIGIN(missing_fn_head->fndecl);
112455 +
112456 + num = get_function_num(missing_fn_head->node, orig_fndecl);
112457 + if (num == CANNOT_FIND_ARG)
112458 + return cnodes;
112459 +
112460 + if (!is_missing_function(orig_fndecl, num))
112461 + return cnodes;
112462 +
112463 + next_node = cgraph_get_node(missing_fn_head->fndecl);
112464 + if (next_node && next_node->local.local)
112465 + cnodes = create_new_next_cgraph_nodes(cnodes, next_node, num);
112466 + return cnodes;
112467 +}
112468 +
112469 +/* Search for missing size_overflow attributes on the last nodes in ipa and collect them
112470 + * into the next_cgraph_node list. They will be the next interesting returns or callees.
112471 + */
112472 +static struct next_cgraph_node *search_overflow_attribute(struct next_cgraph_node *cnodes, struct interesting_node *cur_node)
112473 +{
112474 + unsigned int i;
112475 + tree node;
112476 + struct missing_functions *cur, *missing_fn_head = NULL;
112477 +
112478 +#if BUILDING_GCC_VERSION <= 4007
112479 + FOR_EACH_VEC_ELT(tree, cur_node->last_nodes, i, node) {
112480 +#else
112481 + FOR_EACH_VEC_ELT(*cur_node->last_nodes, i, node) {
112482 +#endif
112483 + switch (TREE_CODE(node)) {
112484 + case PARM_DECL:
112485 + if (TREE_CODE(TREE_TYPE(node)) != INTEGER_TYPE)
112486 + break;
112487 + case FUNCTION_DECL:
112488 + missing_fn_head = create_new_missing_function(missing_fn_head, node);
112489 + break;
112490 + default:
112491 + break;
112492 + }
112493 + }
112494 +
112495 + while (missing_fn_head) {
112496 + cnodes = check_missing_overflow_attribute_and_create_next_node(cnodes, missing_fn_head);
112497 +
112498 + cur = missing_fn_head->next;
112499 + free(missing_fn_head);
112500 + missing_fn_head = cur;
112501 + }
112502 +
112503 + return cnodes;
112504 +}
112505 +
112506 +static void walk_phi_set_conditions(struct pointer_set_t *visited, bool *interesting_conditions, const_tree result)
112507 +{
112508 + gimple phi = get_def_stmt(result);
112509 + unsigned int i, n = gimple_phi_num_args(phi);
112510 +
112511 + pointer_set_insert(visited, phi);
112512 + for (i = 0; i < n; i++) {
112513 + const_tree arg = gimple_phi_arg_def(phi, i);
112514 +
112515 + set_conditions(visited, interesting_conditions, arg);
112516 + }
112517 +}
112518 +
112519 +enum conditions {
112520 + FROM_CONST, NOT_UNARY, CAST
112521 +};
112522 +
112523 +// Search for constants, cast assignments and binary/ternary assignments
112524 +static void set_conditions(struct pointer_set_t *visited, bool *interesting_conditions, const_tree lhs)
112525 +{
112526 + gimple def_stmt = get_def_stmt(lhs);
112527 +
112528 + if (is_gimple_constant(lhs)) {
112529 + interesting_conditions[FROM_CONST] = true;
112530 + return;
112531 + }
112532 +
112533 + if (!def_stmt)
112534 + return;
112535 +
112536 + if (pointer_set_contains(visited, def_stmt))
112537 + return;
112538 +
112539 + switch (gimple_code(def_stmt)) {
112540 + case GIMPLE_NOP:
112541 + case GIMPLE_CALL:
112542 + case GIMPLE_ASM:
112543 + return;
112544 + case GIMPLE_PHI:
112545 + return walk_phi_set_conditions(visited, interesting_conditions, lhs);
112546 + case GIMPLE_ASSIGN:
112547 + if (gimple_num_ops(def_stmt) == 2) {
112548 + const_tree rhs = gimple_assign_rhs1(def_stmt);
112549 +
112550 + if (gimple_assign_cast_p(def_stmt))
112551 + interesting_conditions[CAST] = true;
112552 +
112553 + return set_conditions(visited, interesting_conditions, rhs);
112554 + } else {
112555 + interesting_conditions[NOT_UNARY] = true;
112556 + return;
112557 + }
112558 + default:
112559 + debug_gimple_stmt(def_stmt);
112560 + gcc_unreachable();
112561 + }
112562 +}
112563 +
112564 +// determine whether duplication will be necessary or not.
112565 +static void search_interesting_conditions(struct interesting_node *cur_node, bool *interesting_conditions)
112566 +{
112567 + struct pointer_set_t *visited;
112568 +
112569 + if (gimple_assign_cast_p(cur_node->first_stmt))
112570 + interesting_conditions[CAST] = true;
112571 + else if (is_gimple_assign(cur_node->first_stmt) && gimple_num_ops(cur_node->first_stmt) > 2)
112572 + interesting_conditions[NOT_UNARY] = true;
112573 +
112574 + visited = pointer_set_create();
112575 + set_conditions(visited, interesting_conditions, cur_node->node);
112576 + pointer_set_destroy(visited);
112577 +}
112578 +
112579 +// Remove the size_overflow asm stmt and create an assignment from the input and output of the asm
112580 +static void replace_size_overflow_asm_with_assign(gimple asm_stmt, tree lhs, tree rhs)
112581 +{
112582 + gimple assign;
112583 + gimple_stmt_iterator gsi;
112584 +
112585 + // already removed
112586 + if (gimple_bb(asm_stmt) == NULL)
112587 + return;
112588 + gsi = gsi_for_stmt(asm_stmt);
112589 +
112590 + assign = gimple_build_assign(lhs, rhs);
112591 + gsi_insert_before(&gsi, assign, GSI_SAME_STMT);
112592 + SSA_NAME_DEF_STMT(lhs) = assign;
112593 +
112594 + gsi_remove(&gsi, true);
112595 +}
112596 +
112597 +/* Get the fndecl of an interesting stmt, the fndecl is the caller function if the interesting
112598 + * stmt is a return otherwise it is the callee function.
112599 + */
112600 +const_tree get_interesting_orig_fndecl(const_gimple stmt, unsigned int argnum)
112601 +{
112602 + const_tree fndecl;
112603 +
112604 + if (argnum == 0)
112605 + fndecl = current_function_decl;
112606 + else
112607 + fndecl = gimple_call_fndecl(stmt);
112608 +
112609 + if (fndecl == NULL_TREE)
112610 + return NULL_TREE;
112611 +
112612 + return DECL_ORIGIN(fndecl);
112613 +}
112614 +
112615 +// e.g., 3.8.2, 64, arch/x86/ia32/ia32_signal.c copy_siginfo_from_user32(): compat_ptr() u32 max
112616 +static bool skip_asm(const_tree arg)
112617 +{
112618 + gimple def_stmt = get_def_stmt(arg);
112619 +
112620 + if (!def_stmt || !gimple_assign_cast_p(def_stmt))
112621 + return false;
112622 +
112623 + def_stmt = get_def_stmt(gimple_assign_rhs1(def_stmt));
112624 + return def_stmt && gimple_code(def_stmt) == GIMPLE_ASM;
112625 +}
112626 +
112627 +static void walk_use_def_phi(struct pointer_set_t *visited, struct interesting_node *cur_node, tree result)
112628 +{
112629 + gimple phi = get_def_stmt(result);
112630 + unsigned int i, n = gimple_phi_num_args(phi);
112631 +
112632 + pointer_set_insert(visited, phi);
112633 + for (i = 0; i < n; i++) {
112634 + tree arg = gimple_phi_arg_def(phi, i);
112635 +
112636 + walk_use_def(visited, cur_node, arg);
112637 + }
112638 +}
112639 +
112640 +static void walk_use_def_binary(struct pointer_set_t *visited, struct interesting_node *cur_node, tree lhs)
112641 +{
112642 + gimple def_stmt = get_def_stmt(lhs);
112643 + tree rhs1, rhs2;
112644 +
112645 + rhs1 = gimple_assign_rhs1(def_stmt);
112646 + rhs2 = gimple_assign_rhs2(def_stmt);
112647 +
112648 + walk_use_def(visited, cur_node, rhs1);
112649 + walk_use_def(visited, cur_node, rhs2);
112650 +}
112651 +
112652 +static void insert_last_node(struct interesting_node *cur_node, tree node)
112653 +{
112654 + unsigned int i;
112655 + tree element;
112656 + enum tree_code code;
112657 +
112658 + gcc_assert(node != NULL_TREE);
112659 +
112660 + if (is_gimple_constant(node))
112661 + return;
112662 +
112663 + code = TREE_CODE(node);
112664 + if (code == VAR_DECL) {
112665 + node = DECL_ORIGIN(node);
112666 + code = TREE_CODE(node);
112667 + }
112668 +
112669 + if (code != PARM_DECL && code != FUNCTION_DECL && code != COMPONENT_REF)
112670 + return;
112671 +
112672 +#if BUILDING_GCC_VERSION <= 4007
112673 + FOR_EACH_VEC_ELT(tree, cur_node->last_nodes, i, element) {
112674 +#else
112675 + FOR_EACH_VEC_ELT(*cur_node->last_nodes, i, element) {
112676 +#endif
112677 + if (operand_equal_p(node, element, 0))
112678 + return;
112679 + }
112680 +
112681 +#if BUILDING_GCC_VERSION <= 4007
112682 + gcc_assert(VEC_length(tree, cur_node->last_nodes) < VEC_LEN);
112683 + VEC_safe_push(tree, gc, cur_node->last_nodes, node);
112684 +#else
112685 + gcc_assert(cur_node->last_nodes->length() < VEC_LEN);
112686 + vec_safe_push(cur_node->last_nodes, node);
112687 +#endif
112688 +}
112689 +
112690 +// a size_overflow asm stmt in the control flow doesn't stop the recursion
112691 +static void handle_asm_stmt(struct pointer_set_t *visited, struct interesting_node *cur_node, tree lhs, const_gimple stmt)
112692 +{
112693 + if (!is_size_overflow_asm(stmt))
112694 + walk_use_def(visited, cur_node, SSA_NAME_VAR(lhs));
112695 +}
112696 +
112697 +/* collect the parm_decls and fndecls (for checking a missing size_overflow attribute (ret or arg) or intentional_overflow)
112698 + * and component refs (for checking the intentional_overflow attribute).
112699 + */
112700 +static void walk_use_def(struct pointer_set_t *visited, struct interesting_node *cur_node, tree lhs)
112701 +{
112702 + const_gimple def_stmt;
112703 +
112704 + if (TREE_CODE(lhs) != SSA_NAME) {
112705 + insert_last_node(cur_node, lhs);
112706 + return;
112707 + }
112708 +
112709 + def_stmt = get_def_stmt(lhs);
112710 + if (!def_stmt)
112711 + return;
112712 +
112713 + if (pointer_set_insert(visited, def_stmt))
112714 + return;
112715 +
112716 + switch (gimple_code(def_stmt)) {
112717 + case GIMPLE_NOP:
112718 + return walk_use_def(visited, cur_node, SSA_NAME_VAR(lhs));
112719 + case GIMPLE_ASM:
112720 + return handle_asm_stmt(visited, cur_node, lhs, def_stmt);
112721 + case GIMPLE_CALL: {
112722 + tree fndecl = gimple_call_fndecl(def_stmt);
112723 +
112724 + if (fndecl == NULL_TREE)
112725 + return;
112726 + insert_last_node(cur_node, fndecl);
112727 + return;
112728 + }
112729 + case GIMPLE_PHI:
112730 + return walk_use_def_phi(visited, cur_node, lhs);
112731 + case GIMPLE_ASSIGN:
112732 + switch (gimple_num_ops(def_stmt)) {
112733 + case 2:
112734 + return walk_use_def(visited, cur_node, gimple_assign_rhs1(def_stmt));
112735 + case 3:
112736 + return walk_use_def_binary(visited, cur_node, lhs);
112737 + }
112738 + default:
112739 + debug_gimple_stmt((gimple)def_stmt);
112740 + error("%s: unknown gimple code", __func__);
112741 + gcc_unreachable();
112742 + }
112743 +}
112744 +
112745 +// Collect all the last nodes for checking the intentional_overflow and size_overflow attributes
112746 +static void set_last_nodes(struct interesting_node *cur_node)
112747 +{
112748 + struct pointer_set_t *visited;
112749 +
112750 + visited = pointer_set_create();
112751 + walk_use_def(visited, cur_node, cur_node->node);
112752 + pointer_set_destroy(visited);
112753 +}
112754 +
112755 +enum precond {
112756 + NO_ATTRIBUTE_SEARCH, NO_CHECK_INSERT, NONE
112757 +};
112758 +
112759 +/* If there is a mark_turn_off intentional attribute on the caller or the callee then there is no duplication and missing size_overflow attribute check anywhere.
112760 + * There is only missing size_overflow attribute checking if the intentional_overflow attribute is the mark_no type.
112761 + * Stmt duplication is unnecessary if there are no binary/ternary assignements or if the unary assignment isn't a cast.
112762 + * It skips the possible error codes too. If the def_stmts trace back to a constant and there are no binary/ternary assigments then we assume that it is some kind of error code.
112763 + */
112764 +static enum precond check_preconditions(struct interesting_node *cur_node)
112765 +{
112766 + bool interesting_conditions[3] = {false, false, false};
112767 +
112768 + set_last_nodes(cur_node);
112769 +
112770 + check_intentional_attribute_ipa(cur_node);
112771 + if (cur_node->intentional_attr_decl == MARK_TURN_OFF || cur_node->intentional_attr_cur_fndecl == MARK_TURN_OFF)
112772 + return NO_ATTRIBUTE_SEARCH;
112773 +
112774 + search_interesting_conditions(cur_node, interesting_conditions);
112775 +
112776 + // error code
112777 + if (interesting_conditions[CAST] && interesting_conditions[FROM_CONST] && !interesting_conditions[NOT_UNARY])
112778 + return NO_ATTRIBUTE_SEARCH;
112779 +
112780 + // unnecessary overflow check
112781 + if (!interesting_conditions[CAST] && !interesting_conditions[NOT_UNARY])
112782 + return NO_CHECK_INSERT;
112783 +
112784 + if (cur_node->intentional_attr_cur_fndecl != MARK_NO)
112785 + return NO_CHECK_INSERT;
112786 +
112787 + return NONE;
112788 +}
112789 +
112790 +static tree cast_to_orig_type(struct visited *visited, gimple stmt, const_tree orig_node, tree new_node)
112791 +{
112792 + const_gimple assign;
112793 + tree orig_type = TREE_TYPE(orig_node);
112794 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
112795 +
112796 + assign = build_cast_stmt(visited, orig_type, new_node, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
112797 + return gimple_assign_lhs(assign);
112798 +}
112799 +
112800 +static void change_orig_node(struct visited *visited, struct interesting_node *cur_node, tree new_node)
112801 +{
112802 + void (*set_rhs)(gimple, tree);
112803 + gimple stmt = cur_node->first_stmt;
112804 + const_tree orig_node = cur_node->node;
112805 +
112806 + switch (gimple_code(stmt)) {
112807 + case GIMPLE_RETURN:
112808 + gimple_return_set_retval(stmt, cast_to_orig_type(visited, stmt, orig_node, new_node));
112809 + break;
112810 + case GIMPLE_CALL:
112811 + gimple_call_set_arg(stmt, cur_node->num - 1, cast_to_orig_type(visited, stmt, orig_node, new_node));
112812 + break;
112813 + case GIMPLE_ASSIGN:
112814 + switch (cur_node->num) {
112815 + case 1:
112816 + set_rhs = &gimple_assign_set_rhs1;
112817 + break;
112818 + case 2:
112819 + set_rhs = &gimple_assign_set_rhs2;
112820 + break;
112821 +#if BUILDING_GCC_VERSION >= 4006
112822 + case 3:
112823 + set_rhs = &gimple_assign_set_rhs3;
112824 + break;
112825 +#endif
112826 + default:
112827 + gcc_unreachable();
112828 + }
112829 +
112830 + set_rhs(stmt, cast_to_orig_type(visited, stmt, orig_node, new_node));
112831 + break;
112832 + default:
112833 + debug_gimple_stmt(stmt);
112834 + gcc_unreachable();
112835 + }
112836 +
112837 + update_stmt(stmt);
112838 +}
112839 +
112840 +static struct visited *create_visited(void)
112841 +{
112842 + struct visited *new_node;
112843 +
112844 + new_node = (struct visited *)xmalloc(sizeof(*new_node));
112845 + new_node->stmts = pointer_set_create();
112846 + new_node->my_stmts = pointer_set_create();
112847 + new_node->skip_expr_casts = pointer_set_create();
112848 + new_node->no_cast_check = pointer_set_create();
112849 + return new_node;
112850 +}
112851 +
112852 +static void free_visited(struct visited *visited)
112853 +{
112854 + pointer_set_destroy(visited->stmts);
112855 + pointer_set_destroy(visited->my_stmts);
112856 + pointer_set_destroy(visited->skip_expr_casts);
112857 + pointer_set_destroy(visited->no_cast_check);
112858 +
112859 + free(visited);
112860 +}
112861 +
112862 +/* This function calls the main recursion function (expand) that duplicates the stmts. Before that it checks the intentional_overflow attribute and asm stmts,
112863 + * it decides whether the duplication is necessary or not and it searches for missing size_overflow attributes. After expand() it changes the orig node to the duplicated node
112864 + * in the original stmt (first stmt) and it inserts the overflow check for the arg of the callee or for the return value.
112865 + */
112866 +static struct next_cgraph_node *handle_interesting_stmt(struct visited *visited, struct next_cgraph_node *cnodes, struct interesting_node *cur_node, struct cgraph_node *caller_node)
112867 +{
112868 + enum precond ret;
112869 + tree new_node, orig_node = cur_node->node;
112870 +
112871 + ret = check_preconditions(cur_node);
112872 + if (ret == NO_ATTRIBUTE_SEARCH)
112873 + return cnodes;
112874 +
112875 + cnodes = search_overflow_attribute(cnodes, cur_node);
112876 +
112877 + if (ret == NO_CHECK_INSERT)
112878 + return cnodes;
112879 +
112880 + new_node = expand(visited, caller_node, orig_node);
112881 + if (new_node == NULL_TREE)
112882 + return cnodes;
112883 +
112884 + change_orig_node(visited, cur_node, new_node);
112885 + check_size_overflow(caller_node, cur_node->first_stmt, TREE_TYPE(new_node), new_node, orig_node, BEFORE_STMT);
112886 +
112887 + return cnodes;
112888 +}
112889 +
112890 +// Check visited_fns interesting nodes.
112891 +static bool is_in_interesting_node(struct interesting_node *head, const_gimple first_stmt, const_tree node, unsigned int num)
112892 +{
112893 + struct interesting_node *cur;
112894 +
112895 + for (cur = head; cur; cur = cur->next) {
112896 + if (!operand_equal_p(node, cur->node, 0))
112897 + continue;
112898 + if (num != cur->num)
112899 + continue;
112900 + if (first_stmt == cur->first_stmt)
112901 + return true;
112902 + }
112903 + return false;
112904 +}
112905 +
112906 +/* Create an interesting node. The ipa pass starts to duplicate from these stmts.
112907 + first_stmt: it is the call or assignment or ret stmt, change_orig_node() will change the original node (retval, or function arg) in this
112908 + last_nodes: they are the last stmts in the recursion (they haven't a def_stmt). They are useful in the missing size_overflow attribute check and
112909 + the intentional_overflow attribute check. They are collected by set_last_nodes().
112910 + num: arg count of a call stmt or 0 when it is a ret
112911 + node: the recursion starts from here, it is a call arg or a return value
112912 + fndecl: the fndecl of the interesting node when the node is an arg. it is the fndecl of the callee function otherwise it is the fndecl of the caller (current_function_fndecl) function.
112913 + intentional_attr_decl: intentional_overflow attribute of the callee function
112914 + intentional_attr_cur_fndecl: intentional_overflow attribute of the caller function
112915 + intentional_mark_from_gimple: the intentional overflow type of size_overflow asm stmt from gimple if it exists
112916 + */
112917 +static struct interesting_node *create_new_interesting_node(struct interesting_node *head, gimple first_stmt, tree node, unsigned int num, gimple asm_stmt)
112918 +{
112919 + struct interesting_node *new_node;
112920 + tree fndecl;
112921 + enum gimple_code code;
112922 +
112923 + gcc_assert(node != NULL_TREE);
112924 + code = gimple_code(first_stmt);
112925 + gcc_assert(code == GIMPLE_CALL || code == GIMPLE_ASM || code == GIMPLE_ASSIGN || code == GIMPLE_RETURN);
112926 +
112927 + if (num == CANNOT_FIND_ARG)
112928 + return head;
112929 +
112930 + if (skip_types(node))
112931 + return head;
112932 +
112933 + if (skip_asm(node))
112934 + return head;
112935 +
112936 + if (is_gimple_call(first_stmt))
112937 + fndecl = gimple_call_fndecl(first_stmt);
112938 + else
112939 + fndecl = current_function_decl;
112940 +
112941 + if (fndecl == NULL_TREE)
112942 + return head;
112943 +
112944 + if (is_in_interesting_node(head, first_stmt, node, num))
112945 + return head;
112946 +
112947 + new_node = (struct interesting_node *)xmalloc(sizeof(*new_node));
112948 +
112949 + new_node->next = NULL;
112950 + new_node->first_stmt = first_stmt;
112951 +#if BUILDING_GCC_VERSION <= 4007
112952 + new_node->last_nodes = VEC_alloc(tree, gc, VEC_LEN);
112953 +#else
112954 + vec_alloc(new_node->last_nodes, VEC_LEN);
112955 +#endif
112956 + new_node->num = num;
112957 + new_node->node = node;
112958 + new_node->fndecl = fndecl;
112959 + new_node->intentional_attr_decl = MARK_NO;
112960 + new_node->intentional_attr_cur_fndecl = MARK_NO;
112961 + new_node->intentional_mark_from_gimple = asm_stmt;
112962 +
112963 + if (!head)
112964 + return new_node;
112965 +
112966 + new_node->next = head;
112967 + return new_node;
112968 +}
112969 +
112970 +/* Check the ret stmts in the functions on the next cgraph node list (these functions will be in the hash table and they are reachable from ipa).
112971 + * If the ret stmt is in the next cgraph node list then it's an interesting ret.
112972 + */
112973 +static struct interesting_node *handle_stmt_by_cgraph_nodes_ret(struct interesting_node *head, gimple stmt, struct next_cgraph_node *next_node)
112974 +{
112975 + struct next_cgraph_node *cur_node;
112976 + tree ret = gimple_return_retval(stmt);
112977 +
112978 + if (ret == NULL_TREE)
112979 + return head;
112980 +
112981 + for (cur_node = next_node; cur_node; cur_node = cur_node->next) {
112982 + if (!operand_equal_p(cur_node->callee_fndecl, DECL_ORIGIN(current_function_decl), 0))
112983 + continue;
112984 + if (cur_node->num == 0)
112985 + head = create_new_interesting_node(head, stmt, ret, 0, NOT_INTENTIONAL_ASM);
112986 + }
112987 +
112988 + return head;
112989 +}
112990 +
112991 +/* Check the call stmts in the functions on the next cgraph node list (these functions will be in the hash table and they are reachable from ipa).
112992 + * If the call stmt is in the next cgraph node list then it's an interesting call.
112993 + */
112994 +static struct interesting_node *handle_stmt_by_cgraph_nodes_call(struct interesting_node *head, gimple stmt, struct next_cgraph_node *next_node)
112995 +{
112996 + unsigned int argnum;
112997 + tree arg;
112998 + const_tree fndecl;
112999 + struct next_cgraph_node *cur_node;
113000 +
113001 + fndecl = gimple_call_fndecl(stmt);
113002 + if (fndecl == NULL_TREE)
113003 + return head;
113004 +
113005 + for (cur_node = next_node; cur_node; cur_node = cur_node->next) {
113006 + if (!operand_equal_p(cur_node->callee_fndecl, fndecl, 0))
113007 + continue;
113008 + argnum = get_correct_arg_count(cur_node->num, fndecl);
113009 + gcc_assert(argnum != CANNOT_FIND_ARG);
113010 + if (argnum == 0)
113011 + continue;
113012 +
113013 + arg = gimple_call_arg(stmt, argnum - 1);
113014 + head = create_new_interesting_node(head, stmt, arg, argnum, NOT_INTENTIONAL_ASM);
113015 + }
113016 +
113017 + return head;
113018 +}
113019 +
113020 +static unsigned int check_ops(const_tree orig_node, const_tree node, unsigned int ret_count)
113021 +{
113022 + if (!operand_equal_p(orig_node, node, 0))
113023 + return WRONG_NODE;
113024 + if (skip_types(node))
113025 + return WRONG_NODE;
113026 + return ret_count;
113027 +}
113028 +
113029 +// Get the index of the rhs node in an assignment
113030 +static unsigned int get_assign_ops_count(const_gimple stmt, tree node)
113031 +{
113032 + const_tree rhs1, rhs2;
113033 + unsigned int ret;
113034 +
113035 + gcc_assert(stmt);
113036 + gcc_assert(is_gimple_assign(stmt));
113037 +
113038 + rhs1 = gimple_assign_rhs1(stmt);
113039 + gcc_assert(rhs1 != NULL_TREE);
113040 +
113041 + switch (gimple_num_ops(stmt)) {
113042 + case 2:
113043 + return check_ops(node, rhs1, 1);
113044 + case 3:
113045 + ret = check_ops(node, rhs1, 1);
113046 + if (ret != WRONG_NODE)
113047 + return ret;
113048 +
113049 + rhs2 = gimple_assign_rhs2(stmt);
113050 + gcc_assert(rhs2 != NULL_TREE);
113051 + return check_ops(node, rhs2, 2);
113052 + default:
113053 + gcc_unreachable();
113054 + }
113055 +}
113056 +
113057 +// Find the correct arg number of a call stmt. It is needed when the interesting function is a cloned function.
113058 +static unsigned int find_arg_number_gimple(const_tree arg, const_gimple stmt)
113059 +{
113060 + unsigned int i;
113061 +
113062 + if (gimple_call_fndecl(stmt) == NULL_TREE)
113063 + return CANNOT_FIND_ARG;
113064 +
113065 + for (i = 0; i < gimple_call_num_args(stmt); i++) {
113066 + tree node;
113067 +
113068 + node = gimple_call_arg(stmt, i);
113069 + if (!operand_equal_p(arg, node, 0))
113070 + continue;
113071 + if (!skip_types(node))
113072 + return i + 1;
113073 + }
113074 +
113075 + return CANNOT_FIND_ARG;
113076 +}
113077 +
113078 +/* starting from the size_overflow asm stmt collect interesting stmts. They can be
113079 + * any of return, call or assignment stmts (because of inlining).
113080 + */
113081 +static struct interesting_node *get_interesting_ret_or_call(struct pointer_set_t *visited, struct interesting_node *head, tree node, gimple intentional_asm)
113082 +{
113083 + use_operand_p use_p;
113084 + imm_use_iterator imm_iter;
113085 + unsigned int argnum;
113086 +
113087 + gcc_assert(TREE_CODE(node) == SSA_NAME);
113088 +
113089 + if (pointer_set_insert(visited, node))
113090 + return head;
113091 +
113092 + FOR_EACH_IMM_USE_FAST(use_p, imm_iter, node) {
113093 + gimple stmt = USE_STMT(use_p);
113094 +
113095 + if (stmt == NULL)
113096 + return head;
113097 + if (is_gimple_debug(stmt))
113098 + continue;
113099 +
113100 + switch (gimple_code(stmt)) {
113101 + case GIMPLE_CALL:
113102 + argnum = find_arg_number_gimple(node, stmt);
113103 + head = create_new_interesting_node(head, stmt, node, argnum, intentional_asm);
113104 + break;
113105 + case GIMPLE_RETURN:
113106 + head = create_new_interesting_node(head, stmt, node, 0, intentional_asm);
113107 + break;
113108 + case GIMPLE_ASSIGN:
113109 + argnum = get_assign_ops_count(stmt, node);
113110 + head = create_new_interesting_node(head, stmt, node, argnum, intentional_asm);
113111 + break;
113112 + case GIMPLE_PHI: {
113113 + tree result = gimple_phi_result(stmt);
113114 + head = get_interesting_ret_or_call(visited, head, result, intentional_asm);
113115 + break;
113116 + }
113117 + case GIMPLE_ASM:
113118 + if (gimple_asm_noutputs(stmt) != 0)
113119 + break;
113120 + if (!is_size_overflow_asm(stmt))
113121 + break;
113122 + head = create_new_interesting_node(head, stmt, node, 1, intentional_asm);
113123 + break;
113124 + case GIMPLE_COND:
113125 + case GIMPLE_SWITCH:
113126 + break;
113127 + default:
113128 + debug_gimple_stmt(stmt);
113129 + gcc_unreachable();
113130 + break;
113131 + }
113132 + }
113133 + return head;
113134 +}
113135 +
113136 +static void remove_size_overflow_asm(gimple stmt)
113137 +{
113138 + gimple_stmt_iterator gsi;
113139 + tree input, output;
113140 +
113141 + if (!is_size_overflow_asm(stmt))
113142 + return;
113143 +
113144 + if (gimple_asm_noutputs(stmt) == 0) {
113145 + gsi = gsi_for_stmt(stmt);
113146 + ipa_remove_stmt_references(cgraph_get_create_node(current_function_decl), stmt);
113147 + gsi_remove(&gsi, true);
113148 + return;
113149 + }
113150 +
113151 + input = gimple_asm_input_op(stmt, 0);
113152 + output = gimple_asm_output_op(stmt, 0);
113153 + replace_size_overflow_asm_with_assign(stmt, TREE_VALUE(output), TREE_VALUE(input));
113154 +}
113155 +
113156 +/* handle the size_overflow asm stmts from the gimple pass and collect the interesting stmts.
113157 + * If the asm stmt is a parm_decl kind (noutputs == 0) then remove it.
113158 + * If it is a simple asm stmt then replace it with an assignment from the asm input to the asm output.
113159 + */
113160 +static struct interesting_node *handle_stmt_by_size_overflow_asm(gimple stmt, struct interesting_node *head)
113161 +{
113162 + const_tree output;
113163 + struct pointer_set_t *visited;
113164 + gimple intentional_asm = NOT_INTENTIONAL_ASM;
113165 +
113166 + if (!is_size_overflow_asm(stmt))
113167 + return head;
113168 +
113169 + if (is_size_overflow_intentional_asm_yes(stmt) || is_size_overflow_intentional_asm_turn_off(stmt))
113170 + intentional_asm = stmt;
113171 +
113172 + gcc_assert(gimple_asm_ninputs(stmt) == 1);
113173 +
113174 + if (gimple_asm_noutputs(stmt) == 0 && is_size_overflow_intentional_asm_turn_off(stmt))
113175 + return head;
113176 +
113177 + if (gimple_asm_noutputs(stmt) == 0) {
113178 + const_tree input;
113179 +
113180 + if (!is_size_overflow_intentional_asm_turn_off(stmt))
113181 + return head;
113182 +
113183 + input = gimple_asm_input_op(stmt, 0);
113184 + remove_size_overflow_asm(stmt);
113185 + if (is_gimple_constant(TREE_VALUE(input)))
113186 + return head;
113187 + visited = pointer_set_create();
113188 + head = get_interesting_ret_or_call(visited, head, TREE_VALUE(input), intentional_asm);
113189 + pointer_set_destroy(visited);
113190 + return head;
113191 + }
113192 +
113193 + if (!is_size_overflow_intentional_asm_yes(stmt) && !is_size_overflow_intentional_asm_turn_off(stmt))
113194 + remove_size_overflow_asm(stmt);
113195 +
113196 + visited = pointer_set_create();
113197 + output = gimple_asm_output_op(stmt, 0);
113198 + head = get_interesting_ret_or_call(visited, head, TREE_VALUE(output), intentional_asm);
113199 + pointer_set_destroy(visited);
113200 + return head;
113201 +}
113202 +
113203 +/* Iterate over all the stmts of a function and look for the size_overflow asm stmts (they were created in the gimple pass)
113204 + * or a call stmt or a return stmt and store them in the interesting_node list
113205 + */
113206 +static struct interesting_node *collect_interesting_stmts(struct next_cgraph_node *next_node)
113207 +{
113208 + basic_block bb;
113209 + struct interesting_node *head = NULL;
113210 +
113211 + FOR_ALL_BB_FN(bb, cfun) {
113212 + gimple_stmt_iterator gsi;
113213 +
113214 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
113215 + enum gimple_code code;
113216 + gimple stmt = gsi_stmt(gsi);
113217 +
113218 + code = gimple_code(stmt);
113219 +
113220 + if (code == GIMPLE_ASM)
113221 + head = handle_stmt_by_size_overflow_asm(stmt, head);
113222 +
113223 + if (!next_node)
113224 + continue;
113225 + if (code == GIMPLE_CALL)
113226 + head = handle_stmt_by_cgraph_nodes_call(head, stmt, next_node);
113227 + if (code == GIMPLE_RETURN)
113228 + head = handle_stmt_by_cgraph_nodes_ret(head, stmt, next_node);
113229 + }
113230 + }
113231 + return head;
113232 +}
113233 +
113234 +static void free_interesting_node(struct interesting_node *head)
113235 +{
113236 + struct interesting_node *cur;
113237 +
113238 + while (head) {
113239 + cur = head->next;
113240 +#if BUILDING_GCC_VERSION <= 4007
113241 + VEC_free(tree, gc, head->last_nodes);
113242 +#else
113243 + vec_free(head->last_nodes);
113244 +#endif
113245 + free(head);
113246 + head = cur;
113247 + }
113248 +}
113249 +
113250 +static struct visited_fns *insert_visited_fns_function(struct visited_fns *head, struct interesting_node *cur_node)
113251 +{
113252 + struct visited_fns *new_visited_fns;
113253 +
113254 + new_visited_fns = (struct visited_fns *)xmalloc(sizeof(*new_visited_fns));
113255 + new_visited_fns->fndecl = cur_node->fndecl;
113256 + new_visited_fns->num = cur_node->num;
113257 + new_visited_fns->first_stmt = cur_node->first_stmt;
113258 + new_visited_fns->next = NULL;
113259 +
113260 + if (!head)
113261 + return new_visited_fns;
113262 +
113263 + new_visited_fns->next = head;
113264 + return new_visited_fns;
113265 +}
113266 +
113267 +/* Check whether the function was already visited_fns. If the fndecl, the arg count of the fndecl and the first_stmt (call or return) are same then
113268 + * it is a visited_fns function.
113269 + */
113270 +static bool is_visited_fns_function(struct visited_fns *head, struct interesting_node *cur_node)
113271 +{
113272 + struct visited_fns *cur;
113273 +
113274 + if (!head)
113275 + return false;
113276 +
113277 + for (cur = head; cur; cur = cur->next) {
113278 + if (cur_node->first_stmt != cur->first_stmt)
113279 + continue;
113280 + if (!operand_equal_p(cur_node->fndecl, cur->fndecl, 0))
113281 + continue;
113282 + if (cur_node->num == cur->num)
113283 + return true;
113284 + }
113285 + return false;
113286 +}
113287 +
113288 +static void free_next_cgraph_node(struct next_cgraph_node *head)
113289 +{
113290 + struct next_cgraph_node *cur;
113291 +
113292 + while (head) {
113293 + cur = head->next;
113294 + free(head);
113295 + head = cur;
113296 + }
113297 +}
113298 +
113299 +static void remove_all_size_overflow_asm(void)
113300 +{
113301 + basic_block bb;
113302 +
113303 + FOR_ALL_BB_FN(bb, cfun) {
113304 + gimple_stmt_iterator si;
113305 +
113306 + for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
113307 + remove_size_overflow_asm(gsi_stmt(si));
113308 + }
113309 +}
113310 +
113311 +/* Main recursive walk of the ipa pass: iterate over the collected interesting stmts in a function
113312 + * (they are interesting if they have an associated size_overflow asm stmt) and recursively walk
113313 + * the newly collected interesting functions (they are interesting if there is control flow between
113314 + * the interesting stmts and them).
113315 + */
113316 +static struct visited_fns *handle_function(struct cgraph_node *node, struct next_cgraph_node *next_node, struct visited_fns *visited_fns)
113317 +{
113318 + struct visited *visited;
113319 + struct interesting_node *head, *cur_node;
113320 + struct next_cgraph_node *cur_cnodes, *cnodes_head = NULL;
113321 +
113322 + set_current_function_decl(NODE_DECL(node));
113323 + call_count = 0;
113324 +
113325 + head = collect_interesting_stmts(next_node);
113326 +
113327 + visited = create_visited();
113328 + for (cur_node = head; cur_node; cur_node = cur_node->next) {
113329 + if (is_visited_fns_function(visited_fns, cur_node))
113330 + continue;
113331 + cnodes_head = handle_interesting_stmt(visited, cnodes_head, cur_node, node);
113332 + visited_fns = insert_visited_fns_function(visited_fns, cur_node);
113333 + }
113334 +
113335 + free_visited(visited);
113336 + free_interesting_node(head);
113337 + remove_all_size_overflow_asm();
113338 + unset_current_function_decl();
113339 +
113340 + for (cur_cnodes = cnodes_head; cur_cnodes; cur_cnodes = cur_cnodes->next)
113341 + visited_fns = handle_function(cur_cnodes->current_function, cur_cnodes, visited_fns);
113342 +
113343 + free_next_cgraph_node(cnodes_head);
113344 + return visited_fns;
113345 +}
113346 +
113347 +static void free_visited_fns(struct visited_fns *head)
113348 +{
113349 + struct visited_fns *cur;
113350 +
113351 + while (head) {
113352 + cur = head->next;
113353 + free(head);
113354 + head = cur;
113355 + }
113356 +}
113357 +
113358 +// Main entry point of the ipa pass: erases the plf flag of all stmts and iterates over all the functions
113359 +unsigned int search_function(void)
113360 +{
113361 + struct cgraph_node *node;
113362 + struct visited_fns *visited_fns = NULL;
113363 +
113364 + FOR_EACH_FUNCTION_WITH_GIMPLE_BODY(node) {
113365 + gcc_assert(cgraph_function_flags_ready);
113366 +#if BUILDING_GCC_VERSION <= 4007
113367 + gcc_assert(node->reachable);
113368 +#endif
113369 +
113370 + visited_fns = handle_function(node, NULL, visited_fns);
113371 + }
113372 +
113373 + free_visited_fns(visited_fns);
113374 + return 0;
113375 +}
113376 +
113377 +#if BUILDING_GCC_VERSION >= 4009
113378 +static const struct pass_data insert_size_overflow_check_data = {
113379 +#else
113380 +static struct ipa_opt_pass_d insert_size_overflow_check = {
113381 + .pass = {
113382 +#endif
113383 + .type = SIMPLE_IPA_PASS,
113384 + .name = "size_overflow",
113385 +#if BUILDING_GCC_VERSION >= 4008
113386 + .optinfo_flags = OPTGROUP_NONE,
113387 +#endif
113388 +#if BUILDING_GCC_VERSION >= 4009
113389 + .has_gate = false,
113390 + .has_execute = true,
113391 +#else
113392 + .gate = NULL,
113393 + .execute = search_function,
113394 + .sub = NULL,
113395 + .next = NULL,
113396 + .static_pass_number = 0,
113397 +#endif
113398 + .tv_id = TV_NONE,
113399 + .properties_required = 0,
113400 + .properties_provided = 0,
113401 + .properties_destroyed = 0,
113402 + .todo_flags_start = 0,
113403 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_remove_unused_locals | TODO_ggc_collect | TODO_verify_flow | TODO_dump_cgraph | TODO_dump_func | TODO_update_ssa_no_phi,
113404 +#if BUILDING_GCC_VERSION < 4009
113405 + },
113406 + .generate_summary = NULL,
113407 + .write_summary = NULL,
113408 + .read_summary = NULL,
113409 +#if BUILDING_GCC_VERSION >= 4006
113410 + .write_optimization_summary = NULL,
113411 + .read_optimization_summary = NULL,
113412 +#endif
113413 + .stmt_fixup = NULL,
113414 + .function_transform_todo_flags_start = 0,
113415 + .function_transform = NULL,
113416 + .variable_transform = NULL,
113417 +#endif
113418 +};
113419 +
113420 +#if BUILDING_GCC_VERSION >= 4009
113421 +namespace {
113422 +class insert_size_overflow_check : public ipa_opt_pass_d {
113423 +public:
113424 + insert_size_overflow_check() : ipa_opt_pass_d(insert_size_overflow_check_data, g, NULL, NULL, NULL, NULL, NULL, NULL, 0, NULL, NULL) {}
113425 + unsigned int execute() { return search_function(); }
113426 +};
113427 +}
113428 +#endif
113429 +
113430 +struct opt_pass *make_insert_size_overflow_check(void)
113431 +{
113432 +#if BUILDING_GCC_VERSION >= 4009
113433 + return new insert_size_overflow_check();
113434 +#else
113435 + return &insert_size_overflow_check.pass;
113436 +#endif
113437 +}
113438 +
113439 diff --git a/tools/gcc/size_overflow_plugin/intentional_overflow.c b/tools/gcc/size_overflow_plugin/intentional_overflow.c
113440 new file mode 100644
113441 index 0000000..38904bc
113442 --- /dev/null
113443 +++ b/tools/gcc/size_overflow_plugin/intentional_overflow.c
113444 @@ -0,0 +1,733 @@
113445 +/*
113446 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
113447 + * Licensed under the GPL v2, or (at your option) v3
113448 + *
113449 + * Homepage:
113450 + * http://www.grsecurity.net/~ephox/overflow_plugin/
113451 + *
113452 + * Documentation:
113453 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
113454 + *
113455 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
113456 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
113457 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
113458 + *
113459 + * Usage:
113460 + * $ make
113461 + * $ make run
113462 + */
113463 +
113464 +#include "gcc-common.h"
113465 +#include "size_overflow.h"
113466 +
113467 +/* Get the param of the intentional_overflow attribute.
113468 + * * 0: MARK_NOT_INTENTIONAL
113469 + * * 1..MAX_PARAM: MARK_YES
113470 + * * -1: MARK_TURN_OFF
113471 + */
113472 +static tree get_attribute_param(const_tree decl)
113473 +{
113474 + const_tree attr;
113475 +
113476 + if (decl == NULL_TREE)
113477 + return NULL_TREE;
113478 +
113479 + attr = lookup_attribute("intentional_overflow", DECL_ATTRIBUTES(decl));
113480 + if (!attr || !TREE_VALUE(attr))
113481 + return NULL_TREE;
113482 +
113483 + return TREE_VALUE(attr);
113484 +}
113485 +
113486 +// MARK_TURN_OFF
113487 +bool is_turn_off_intentional_attr(const_tree decl)
113488 +{
113489 + const_tree param_head;
113490 +
113491 + param_head = get_attribute_param(decl);
113492 + if (param_head == NULL_TREE)
113493 + return false;
113494 +
113495 + if (TREE_INT_CST_HIGH(TREE_VALUE(param_head)) == -1)
113496 + return true;
113497 + return false;
113498 +}
113499 +
113500 +// MARK_NOT_INTENTIONAL
113501 +bool is_end_intentional_intentional_attr(const_tree decl, unsigned int argnum)
113502 +{
113503 + const_tree param_head;
113504 +
113505 + if (argnum == 0)
113506 + return false;
113507 +
113508 + param_head = get_attribute_param(decl);
113509 + if (param_head == NULL_TREE)
113510 + return false;
113511 +
113512 + if (!TREE_INT_CST_LOW(TREE_VALUE(param_head)))
113513 + return true;
113514 + return false;
113515 +}
113516 +
113517 +// MARK_YES
113518 +bool is_yes_intentional_attr(const_tree decl, unsigned int argnum)
113519 +{
113520 + tree param, param_head;
113521 +
113522 + if (argnum == 0)
113523 + return false;
113524 +
113525 + param_head = get_attribute_param(decl);
113526 + for (param = param_head; param; param = TREE_CHAIN(param))
113527 + if (argnum == TREE_INT_CST_LOW(TREE_VALUE(param)))
113528 + return true;
113529 + return false;
113530 +}
113531 +
113532 +void print_missing_intentional(enum mark callee_attr, enum mark caller_attr, const_tree decl, unsigned int argnum)
113533 +{
113534 + location_t loc;
113535 +
113536 + if (caller_attr == MARK_NO || caller_attr == MARK_NOT_INTENTIONAL || caller_attr == MARK_TURN_OFF)
113537 + return;
113538 +
113539 + if (callee_attr == MARK_NOT_INTENTIONAL || callee_attr == MARK_YES)
113540 + return;
113541 +
113542 + loc = DECL_SOURCE_LOCATION(decl);
113543 + inform(loc, "The intentional_overflow attribute is missing from +%s+%u+", DECL_NAME_POINTER(decl), argnum);
113544 +}
113545 +
113546 +// Get the field decl of a component ref for intentional_overflow checking
113547 +static const_tree search_field_decl(const_tree comp_ref)
113548 +{
113549 + const_tree field = NULL_TREE;
113550 + unsigned int i, len = TREE_OPERAND_LENGTH(comp_ref);
113551 +
113552 + for (i = 0; i < len; i++) {
113553 + field = TREE_OPERAND(comp_ref, i);
113554 + if (TREE_CODE(field) == FIELD_DECL)
113555 + break;
113556 + }
113557 + gcc_assert(TREE_CODE(field) == FIELD_DECL);
113558 + return field;
113559 +}
113560 +
113561 +/* Get the type of the intentional_overflow attribute of a node
113562 + * * MARK_TURN_OFF
113563 + * * MARK_YES
113564 + * * MARK_NO
113565 + * * MARK_NOT_INTENTIONAL
113566 + */
113567 +enum mark get_intentional_attr_type(const_tree node)
113568 +{
113569 + const_tree cur_decl;
113570 +
113571 + if (node == NULL_TREE)
113572 + return MARK_NO;
113573 +
113574 + switch (TREE_CODE(node)) {
113575 + case COMPONENT_REF:
113576 + cur_decl = search_field_decl(node);
113577 + if (is_turn_off_intentional_attr(cur_decl))
113578 + return MARK_TURN_OFF;
113579 + if (is_end_intentional_intentional_attr(cur_decl, 1))
113580 + return MARK_YES;
113581 + break;
113582 + case PARM_DECL: {
113583 + unsigned int argnum;
113584 +
113585 + cur_decl = DECL_ORIGIN(current_function_decl);
113586 + argnum = find_arg_number_tree(node, cur_decl);
113587 + if (argnum == CANNOT_FIND_ARG)
113588 + return MARK_NO;
113589 + if (is_yes_intentional_attr(cur_decl, argnum))
113590 + return MARK_YES;
113591 + if (is_end_intentional_intentional_attr(cur_decl, argnum))
113592 + return MARK_NOT_INTENTIONAL;
113593 + break;
113594 + }
113595 + case FUNCTION_DECL:
113596 + if (is_turn_off_intentional_attr(DECL_ORIGIN(node)))
113597 + return MARK_TURN_OFF;
113598 + break;
113599 + default:
113600 + break;
113601 + }
113602 + return MARK_NO;
113603 +}
113604 +
113605 +// Search for the intentional_overflow attribute on the last nodes
113606 +static enum mark search_last_nodes_intentional(struct interesting_node *cur_node)
113607 +{
113608 + unsigned int i;
113609 + tree last_node;
113610 + enum mark mark = MARK_NO;
113611 +
113612 +#if BUILDING_GCC_VERSION <= 4007
113613 + FOR_EACH_VEC_ELT(tree, cur_node->last_nodes, i, last_node) {
113614 +#else
113615 + FOR_EACH_VEC_ELT(*cur_node->last_nodes, i, last_node) {
113616 +#endif
113617 + mark = get_intentional_attr_type(last_node);
113618 + if (mark != MARK_NO)
113619 + break;
113620 + }
113621 + return mark;
113622 +}
113623 +
113624 +/* Check the intentional kind of size_overflow asm stmt (created by the gimple pass) and
113625 + * set the appropriate intentional_overflow type. Delete the asm stmt in the end.
113626 + */
113627 +static bool is_intentional_attribute_from_gimple(struct interesting_node *cur_node)
113628 +{
113629 + if (!cur_node->intentional_mark_from_gimple)
113630 + return false;
113631 +
113632 + if (is_size_overflow_intentional_asm_yes(cur_node->intentional_mark_from_gimple))
113633 + cur_node->intentional_attr_cur_fndecl = MARK_YES;
113634 + else
113635 + cur_node->intentional_attr_cur_fndecl = MARK_TURN_OFF;
113636 +
113637 + // skip param decls
113638 + if (gimple_asm_noutputs(cur_node->intentional_mark_from_gimple) == 0)
113639 + return true;
113640 + return true;
113641 +}
113642 +
113643 +/* Search intentional_overflow attribute on caller and on callee too.
113644 + * 0</MARK_YES: no dup, search size_overflow and intentional_overflow attributes
113645 + * 0/MARK_NOT_INTENTIONAL: no dup, search size_overflow attribute (int)
113646 + * -1/MARK_TURN_OFF: no dup, no search, current_function_decl -> no dup
113647 +*/
113648 +void check_intentional_attribute_ipa(struct interesting_node *cur_node)
113649 +{
113650 + const_tree fndecl;
113651 +
113652 + if (is_intentional_attribute_from_gimple(cur_node))
113653 + return;
113654 +
113655 + if (is_turn_off_intentional_attr(DECL_ORIGIN(current_function_decl))) {
113656 + cur_node->intentional_attr_cur_fndecl = MARK_TURN_OFF;
113657 + return;
113658 + }
113659 +
113660 + if (gimple_code(cur_node->first_stmt) == GIMPLE_ASM) {
113661 + cur_node->intentional_attr_cur_fndecl = MARK_NOT_INTENTIONAL;
113662 + return;
113663 + }
113664 +
113665 + if (gimple_code(cur_node->first_stmt) == GIMPLE_ASSIGN)
113666 + return;
113667 +
113668 + fndecl = get_interesting_orig_fndecl(cur_node->first_stmt, cur_node->num);
113669 + if (is_turn_off_intentional_attr(fndecl)) {
113670 + cur_node->intentional_attr_decl = MARK_TURN_OFF;
113671 + return;
113672 + }
113673 +
113674 + if (is_end_intentional_intentional_attr(fndecl, cur_node->num))
113675 + cur_node->intentional_attr_decl = MARK_NOT_INTENTIONAL;
113676 + else if (is_yes_intentional_attr(fndecl, cur_node->num))
113677 + cur_node->intentional_attr_decl = MARK_YES;
113678 +
113679 + cur_node->intentional_attr_cur_fndecl = search_last_nodes_intentional(cur_node);
113680 + print_missing_intentional(cur_node->intentional_attr_decl, cur_node->intentional_attr_cur_fndecl, cur_node->fndecl, cur_node->num);
113681 +}
113682 +
113683 +bool is_a_cast_and_const_overflow(const_tree no_const_rhs)
113684 +{
113685 + const_tree rhs1, lhs, rhs1_type, lhs_type;
113686 + enum machine_mode lhs_mode, rhs_mode;
113687 + gimple def_stmt = get_def_stmt(no_const_rhs);
113688 +
113689 + if (!def_stmt || !gimple_assign_cast_p(def_stmt))
113690 + return false;
113691 +
113692 + rhs1 = gimple_assign_rhs1(def_stmt);
113693 + lhs = gimple_assign_lhs(def_stmt);
113694 + rhs1_type = TREE_TYPE(rhs1);
113695 + lhs_type = TREE_TYPE(lhs);
113696 + rhs_mode = TYPE_MODE(rhs1_type);
113697 + lhs_mode = TYPE_MODE(lhs_type);
113698 + if (TYPE_UNSIGNED(lhs_type) == TYPE_UNSIGNED(rhs1_type) || lhs_mode != rhs_mode)
113699 + return false;
113700 +
113701 + return true;
113702 +}
113703 +
113704 +static unsigned int uses_num(tree node)
113705 +{
113706 + imm_use_iterator imm_iter;
113707 + use_operand_p use_p;
113708 + unsigned int num = 0;
113709 +
113710 + FOR_EACH_IMM_USE_FAST(use_p, imm_iter, node) {
113711 + gimple use_stmt = USE_STMT(use_p);
113712 +
113713 + if (use_stmt == NULL)
113714 + return num;
113715 + if (is_gimple_debug(use_stmt))
113716 + continue;
113717 + if (gimple_assign_cast_p(use_stmt) && is_size_overflow_type(gimple_assign_lhs(use_stmt)))
113718 + continue;
113719 + num++;
113720 + }
113721 + return num;
113722 +}
113723 +
113724 +static bool no_uses(tree node)
113725 +{
113726 + return !uses_num(node);
113727 +}
113728 +
113729 +// 3.8.5 mm/page-writeback.c __ilog2_u64(): ret, uint + uintmax; uint -> int; int max
113730 +bool is_const_plus_unsigned_signed_truncation(const_tree lhs)
113731 +{
113732 + tree rhs1, lhs_type, rhs_type, rhs2, not_const_rhs;
113733 + gimple def_stmt = get_def_stmt(lhs);
113734 +
113735 + if (!def_stmt || !gimple_assign_cast_p(def_stmt))
113736 + return false;
113737 +
113738 + rhs1 = gimple_assign_rhs1(def_stmt);
113739 + rhs_type = TREE_TYPE(rhs1);
113740 + lhs_type = TREE_TYPE(lhs);
113741 + if (TYPE_UNSIGNED(lhs_type) || !TYPE_UNSIGNED(rhs_type))
113742 + return false;
113743 + if (TYPE_MODE(lhs_type) != TYPE_MODE(rhs_type))
113744 + return false;
113745 +
113746 + def_stmt = get_def_stmt(rhs1);
113747 + if (!def_stmt || !is_gimple_assign(def_stmt) || gimple_num_ops(def_stmt) != 3)
113748 + return false;
113749 +
113750 + if (gimple_assign_rhs_code(def_stmt) != PLUS_EXPR)
113751 + return false;
113752 +
113753 + rhs1 = gimple_assign_rhs1(def_stmt);
113754 + rhs2 = gimple_assign_rhs2(def_stmt);
113755 + if (!is_gimple_constant(rhs1) && !is_gimple_constant(rhs2))
113756 + return false;
113757 +
113758 + if (is_gimple_constant(rhs2))
113759 + not_const_rhs = rhs1;
113760 + else
113761 + not_const_rhs = rhs2;
113762 +
113763 + return no_uses(not_const_rhs);
113764 +}
113765 +
113766 +static bool is_lt_signed_type_max(const_tree rhs)
113767 +{
113768 + const_tree new_type, type_max, type = TREE_TYPE(rhs);
113769 +
113770 + if (!TYPE_UNSIGNED(type))
113771 + return true;
113772 +
113773 + switch (TYPE_MODE(type)) {
113774 + case QImode:
113775 + new_type = intQI_type_node;
113776 + break;
113777 + case HImode:
113778 + new_type = intHI_type_node;
113779 + break;
113780 + case SImode:
113781 + new_type = intSI_type_node;
113782 + break;
113783 + case DImode:
113784 + new_type = intDI_type_node;
113785 + break;
113786 + default:
113787 + debug_tree((tree)type);
113788 + gcc_unreachable();
113789 + }
113790 +
113791 + type_max = TYPE_MAX_VALUE(new_type);
113792 + if (!tree_int_cst_lt(type_max, rhs))
113793 + return true;
113794 +
113795 + return false;
113796 +}
113797 +
113798 +static bool is_gt_zero(const_tree rhs)
113799 +{
113800 + const_tree type = TREE_TYPE(rhs);
113801 +
113802 + if (TYPE_UNSIGNED(type))
113803 + return true;
113804 +
113805 + if (!tree_int_cst_lt(rhs, integer_zero_node))
113806 + return true;
113807 +
113808 + return false;
113809 +}
113810 +
113811 +bool is_a_constant_overflow(const_gimple stmt, const_tree rhs)
113812 +{
113813 + if (gimple_assign_rhs_code(stmt) == MIN_EXPR)
113814 + return false;
113815 + if (!is_gimple_constant(rhs))
113816 + return false;
113817 +
113818 + // If the const is between 0 and the max value of the signed type of the same bitsize then there is no intentional overflow
113819 + if (is_lt_signed_type_max(rhs) && is_gt_zero(rhs))
113820 + return false;
113821 +
113822 + return true;
113823 +}
113824 +
113825 +static tree change_assign_rhs(struct visited *visited, gimple stmt, const_tree orig_rhs, tree new_rhs)
113826 +{
113827 + gimple assign;
113828 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
113829 + tree origtype = TREE_TYPE(orig_rhs);
113830 +
113831 + gcc_assert(is_gimple_assign(stmt));
113832 +
113833 + assign = build_cast_stmt(visited, origtype, new_rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
113834 + pointer_set_insert(visited->my_stmts, assign);
113835 + return gimple_assign_lhs(assign);
113836 +}
113837 +
113838 +tree handle_intentional_overflow(struct visited *visited, struct cgraph_node *caller_node, bool check_overflow, gimple stmt, tree change_rhs, tree new_rhs2)
113839 +{
113840 + tree new_rhs, orig_rhs;
113841 + void (*gimple_assign_set_rhs)(gimple, tree);
113842 + tree rhs1 = gimple_assign_rhs1(stmt);
113843 + tree rhs2 = gimple_assign_rhs2(stmt);
113844 + tree lhs = gimple_assign_lhs(stmt);
113845 +
113846 + if (!check_overflow)
113847 + return create_assign(visited, stmt, lhs, AFTER_STMT);
113848 +
113849 + if (change_rhs == NULL_TREE)
113850 + return create_assign(visited, stmt, lhs, AFTER_STMT);
113851 +
113852 + if (new_rhs2 == NULL_TREE) {
113853 + orig_rhs = rhs1;
113854 + gimple_assign_set_rhs = &gimple_assign_set_rhs1;
113855 + } else {
113856 + orig_rhs = rhs2;
113857 + gimple_assign_set_rhs = &gimple_assign_set_rhs2;
113858 + }
113859 +
113860 + check_size_overflow(caller_node, stmt, TREE_TYPE(change_rhs), change_rhs, orig_rhs, BEFORE_STMT);
113861 +
113862 + new_rhs = change_assign_rhs(visited, stmt, orig_rhs, change_rhs);
113863 + gimple_assign_set_rhs(stmt, new_rhs);
113864 + update_stmt(stmt);
113865 +
113866 + return create_assign(visited, stmt, lhs, AFTER_STMT);
113867 +}
113868 +
113869 +static bool is_subtraction_special(struct visited *visited, const_gimple stmt)
113870 +{
113871 + gimple rhs1_def_stmt, rhs2_def_stmt;
113872 + const_tree rhs1_def_stmt_rhs1, rhs2_def_stmt_rhs1, rhs1_def_stmt_lhs, rhs2_def_stmt_lhs;
113873 + enum machine_mode rhs1_def_stmt_rhs1_mode, rhs2_def_stmt_rhs1_mode, rhs1_def_stmt_lhs_mode, rhs2_def_stmt_lhs_mode;
113874 + const_tree rhs1 = gimple_assign_rhs1(stmt);
113875 + const_tree rhs2 = gimple_assign_rhs2(stmt);
113876 +
113877 + if (is_gimple_constant(rhs1) || is_gimple_constant(rhs2))
113878 + return false;
113879 +
113880 + gcc_assert(TREE_CODE(rhs1) == SSA_NAME && TREE_CODE(rhs2) == SSA_NAME);
113881 +
113882 + if (gimple_assign_rhs_code(stmt) != MINUS_EXPR)
113883 + return false;
113884 +
113885 + rhs1_def_stmt = get_def_stmt(rhs1);
113886 + rhs2_def_stmt = get_def_stmt(rhs2);
113887 + if (!gimple_assign_cast_p(rhs1_def_stmt) || !gimple_assign_cast_p(rhs2_def_stmt))
113888 + return false;
113889 +
113890 + rhs1_def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
113891 + rhs2_def_stmt_rhs1 = gimple_assign_rhs1(rhs2_def_stmt);
113892 + rhs1_def_stmt_lhs = gimple_assign_lhs(rhs1_def_stmt);
113893 + rhs2_def_stmt_lhs = gimple_assign_lhs(rhs2_def_stmt);
113894 + rhs1_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_rhs1));
113895 + rhs2_def_stmt_rhs1_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_rhs1));
113896 + rhs1_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs1_def_stmt_lhs));
113897 + rhs2_def_stmt_lhs_mode = TYPE_MODE(TREE_TYPE(rhs2_def_stmt_lhs));
113898 + if (GET_MODE_BITSIZE(rhs1_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs1_def_stmt_lhs_mode))
113899 + return false;
113900 + if (GET_MODE_BITSIZE(rhs2_def_stmt_rhs1_mode) <= GET_MODE_BITSIZE(rhs2_def_stmt_lhs_mode))
113901 + return false;
113902 +
113903 + pointer_set_insert(visited->no_cast_check, rhs1_def_stmt);
113904 + pointer_set_insert(visited->no_cast_check, rhs2_def_stmt);
113905 + return true;
113906 +}
113907 +
113908 +static gimple create_binary_assign(struct visited *visited, enum tree_code code, gimple stmt, tree rhs1, tree rhs2)
113909 +{
113910 + gimple assign;
113911 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
113912 + tree type = TREE_TYPE(rhs1);
113913 + tree lhs = create_new_var(type);
113914 +
113915 + gcc_assert(types_compatible_p(type, TREE_TYPE(rhs2)));
113916 + assign = gimple_build_assign_with_ops(code, lhs, rhs1, rhs2);
113917 + gimple_assign_set_lhs(assign, make_ssa_name(lhs, assign));
113918 +
113919 + gsi_insert_before(&gsi, assign, GSI_NEW_STMT);
113920 + update_stmt(assign);
113921 + pointer_set_insert(visited->my_stmts, assign);
113922 + return assign;
113923 +}
113924 +
113925 +static tree cast_to_TI_type(struct visited *visited, gimple stmt, tree node)
113926 +{
113927 + gimple_stmt_iterator gsi;
113928 + gimple cast_stmt;
113929 + tree type = TREE_TYPE(node);
113930 +
113931 + if (types_compatible_p(type, intTI_type_node))
113932 + return node;
113933 +
113934 + gsi = gsi_for_stmt(stmt);
113935 + cast_stmt = build_cast_stmt(visited, intTI_type_node, node, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
113936 + pointer_set_insert(visited->my_stmts, cast_stmt);
113937 + return gimple_assign_lhs(cast_stmt);
113938 +}
113939 +
113940 +static tree get_def_stmt_rhs(struct visited *visited, const_tree var)
113941 +{
113942 + tree rhs1, def_stmt_rhs1;
113943 + gimple rhs1_def_stmt, def_stmt_rhs1_def_stmt, def_stmt;
113944 +
113945 + def_stmt = get_def_stmt(var);
113946 + if (!gimple_assign_cast_p(def_stmt))
113947 + return NULL_TREE;
113948 + gcc_assert(gimple_code(def_stmt) != GIMPLE_NOP && pointer_set_contains(visited->my_stmts, def_stmt) && gimple_assign_cast_p(def_stmt));
113949 +
113950 + rhs1 = gimple_assign_rhs1(def_stmt);
113951 + rhs1_def_stmt = get_def_stmt(rhs1);
113952 + if (!gimple_assign_cast_p(rhs1_def_stmt))
113953 + return rhs1;
113954 +
113955 + def_stmt_rhs1 = gimple_assign_rhs1(rhs1_def_stmt);
113956 + def_stmt_rhs1_def_stmt = get_def_stmt(def_stmt_rhs1);
113957 +
113958 + switch (gimple_code(def_stmt_rhs1_def_stmt)) {
113959 + case GIMPLE_CALL:
113960 + case GIMPLE_NOP:
113961 + case GIMPLE_ASM:
113962 + case GIMPLE_PHI:
113963 + return def_stmt_rhs1;
113964 + case GIMPLE_ASSIGN:
113965 + return rhs1;
113966 + default:
113967 + debug_gimple_stmt(def_stmt_rhs1_def_stmt);
113968 + gcc_unreachable();
113969 + }
113970 +}
113971 +
113972 +tree handle_integer_truncation(struct visited *visited, struct cgraph_node *caller_node, const_tree lhs)
113973 +{
113974 + tree new_rhs1, new_rhs2;
113975 + tree new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1, new_lhs;
113976 + gimple assign, stmt = get_def_stmt(lhs);
113977 + tree rhs1 = gimple_assign_rhs1(stmt);
113978 + tree rhs2 = gimple_assign_rhs2(stmt);
113979 +
113980 + if (!is_subtraction_special(visited, stmt))
113981 + return NULL_TREE;
113982 +
113983 + new_rhs1 = expand(visited, caller_node, rhs1);
113984 + new_rhs2 = expand(visited, caller_node, rhs2);
113985 +
113986 + new_rhs1_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs1);
113987 + new_rhs2_def_stmt_rhs1 = get_def_stmt_rhs(visited, new_rhs2);
113988 +
113989 + if (new_rhs1_def_stmt_rhs1 == NULL_TREE || new_rhs2_def_stmt_rhs1 == NULL_TREE)
113990 + return NULL_TREE;
113991 +
113992 + if (!types_compatible_p(TREE_TYPE(new_rhs1_def_stmt_rhs1), TREE_TYPE(new_rhs2_def_stmt_rhs1))) {
113993 + new_rhs1_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs1_def_stmt_rhs1);
113994 + new_rhs2_def_stmt_rhs1 = cast_to_TI_type(visited, stmt, new_rhs2_def_stmt_rhs1);
113995 + }
113996 +
113997 + assign = create_binary_assign(visited, MINUS_EXPR, stmt, new_rhs1_def_stmt_rhs1, new_rhs2_def_stmt_rhs1);
113998 + new_lhs = gimple_assign_lhs(assign);
113999 + check_size_overflow(caller_node, assign, TREE_TYPE(new_lhs), new_lhs, rhs1, AFTER_STMT);
114000 +
114001 + return dup_assign(visited, stmt, lhs, new_rhs1, new_rhs2, NULL_TREE);
114002 +}
114003 +
114004 +bool is_a_neg_overflow(const_gimple stmt, const_tree rhs)
114005 +{
114006 + const_gimple def_stmt;
114007 +
114008 + if (TREE_CODE(rhs) != SSA_NAME)
114009 + return false;
114010 +
114011 + if (gimple_assign_rhs_code(stmt) != PLUS_EXPR)
114012 + return false;
114013 +
114014 + def_stmt = get_def_stmt(rhs);
114015 + if (!is_gimple_assign(def_stmt) || gimple_assign_rhs_code(def_stmt) != BIT_NOT_EXPR)
114016 + return false;
114017 +
114018 + return true;
114019 +}
114020 +
114021 +/* e.g., drivers/acpi/acpica/utids.c acpi_ut_execute_CID()
114022 + * ((count - 1) * sizeof(struct acpi_pnp_dee_id_list) -> (count + fffffff) * 16
114023 + * fffffff * 16 > signed max -> truncate
114024 + */
114025 +static bool look_for_mult_and_add(const_gimple stmt)
114026 +{
114027 + const_tree res;
114028 + tree rhs1, rhs2, def_rhs1, def_rhs2, const_rhs, def_const_rhs;
114029 + const_gimple def_stmt;
114030 +
114031 + if (!stmt || gimple_code(stmt) == GIMPLE_NOP)
114032 + return false;
114033 + if (!is_gimple_assign(stmt))
114034 + return false;
114035 + if (gimple_assign_rhs_code(stmt) != MULT_EXPR)
114036 + return false;
114037 +
114038 + rhs1 = gimple_assign_rhs1(stmt);
114039 + rhs2 = gimple_assign_rhs2(stmt);
114040 + if (is_gimple_constant(rhs1)) {
114041 + const_rhs = rhs1;
114042 + def_stmt = get_def_stmt(rhs2);
114043 + } else if (is_gimple_constant(rhs2)) {
114044 + const_rhs = rhs2;
114045 + def_stmt = get_def_stmt(rhs1);
114046 + } else
114047 + return false;
114048 +
114049 + if (gimple_assign_rhs_code(def_stmt) != PLUS_EXPR && gimple_assign_rhs_code(def_stmt) != MINUS_EXPR)
114050 + return false;
114051 +
114052 + def_rhs1 = gimple_assign_rhs1(def_stmt);
114053 + def_rhs2 = gimple_assign_rhs2(def_stmt);
114054 + if (is_gimple_constant(def_rhs1))
114055 + def_const_rhs = def_rhs1;
114056 + else if (is_gimple_constant(def_rhs2))
114057 + def_const_rhs = def_rhs2;
114058 + else
114059 + return false;
114060 +
114061 + res = fold_binary_loc(gimple_location(def_stmt), MULT_EXPR, TREE_TYPE(const_rhs), const_rhs, def_const_rhs);
114062 + if (is_lt_signed_type_max(res) && is_gt_zero(res))
114063 + return false;
114064 + return true;
114065 +}
114066 +
114067 +enum intentional_overflow_type add_mul_intentional_overflow(const_gimple stmt)
114068 +{
114069 + const_gimple def_stmt_1, def_stmt_2;
114070 + const_tree rhs1, rhs2;
114071 + bool add_mul_rhs1, add_mul_rhs2;
114072 +
114073 + rhs1 = gimple_assign_rhs1(stmt);
114074 + def_stmt_1 = get_def_stmt(rhs1);
114075 + add_mul_rhs1 = look_for_mult_and_add(def_stmt_1);
114076 +
114077 + rhs2 = gimple_assign_rhs2(stmt);
114078 + def_stmt_2 = get_def_stmt(rhs2);
114079 + add_mul_rhs2 = look_for_mult_and_add(def_stmt_2);
114080 +
114081 + if (add_mul_rhs1)
114082 + return RHS1_INTENTIONAL_OVERFLOW;
114083 + if (add_mul_rhs2)
114084 + return RHS2_INTENTIONAL_OVERFLOW;
114085 + return NO_INTENTIONAL_OVERFLOW;
114086 +}
114087 +
114088 +static gimple get_dup_stmt(struct visited *visited, gimple stmt)
114089 +{
114090 + gimple my_stmt;
114091 + gimple_stmt_iterator gsi = gsi_for_stmt(stmt);
114092 +
114093 + gsi_next(&gsi);
114094 + my_stmt = gsi_stmt(gsi);
114095 +
114096 + gcc_assert(pointer_set_contains(visited->my_stmts, my_stmt));
114097 + gcc_assert(gimple_assign_rhs_code(stmt) == gimple_assign_rhs_code(my_stmt));
114098 +
114099 + return my_stmt;
114100 +}
114101 +
114102 +/* unsigned type -> unary or binary assign (rhs1 or rhs2 is constant)
114103 + * unsigned type cast to signed type, unsigned type: no more uses
114104 + * e.g., lib/vsprintf.c:simple_strtol()
114105 + * _10 = (unsigned long int) _9
114106 + * _11 = -_10;
114107 + * _12 = (long int) _11; (_11_ no more uses)
114108 + */
114109 +static bool is_call_or_cast(gimple stmt)
114110 +{
114111 + return gimple_assign_cast_p(stmt) || is_gimple_call(stmt);
114112 +}
114113 +
114114 +static bool is_unsigned_cast_or_call_def_stmt(const_tree node)
114115 +{
114116 + const_tree rhs;
114117 + gimple def_stmt;
114118 +
114119 + if (node == NULL_TREE)
114120 + return true;
114121 + if (is_gimple_constant(node))
114122 + return true;
114123 +
114124 + def_stmt = get_def_stmt(node);
114125 + if (!def_stmt)
114126 + return false;
114127 +
114128 + if (is_call_or_cast(def_stmt))
114129 + return true;
114130 +
114131 + if (!is_gimple_assign(def_stmt) || gimple_num_ops(def_stmt) != 2)
114132 + return false;
114133 + rhs = gimple_assign_rhs1(def_stmt);
114134 + def_stmt = get_def_stmt(rhs);
114135 + if (!def_stmt)
114136 + return false;
114137 + return is_call_or_cast(def_stmt);
114138 +}
114139 +
114140 +void unsigned_signed_cast_intentional_overflow(struct visited *visited, gimple stmt)
114141 +{
114142 + unsigned int use_num;
114143 + gimple so_stmt;
114144 + const_gimple def_stmt;
114145 + const_tree rhs1, rhs2;
114146 + tree rhs = gimple_assign_rhs1(stmt);
114147 + tree lhs_type = TREE_TYPE(gimple_assign_lhs(stmt));
114148 + const_tree rhs_type = TREE_TYPE(rhs);
114149 +
114150 + if (!(TYPE_UNSIGNED(rhs_type) && !TYPE_UNSIGNED(lhs_type)))
114151 + return;
114152 + if (GET_MODE_BITSIZE(TYPE_MODE(rhs_type)) != GET_MODE_BITSIZE(TYPE_MODE(lhs_type)))
114153 + return;
114154 + use_num = uses_num(rhs);
114155 + if (use_num != 1)
114156 + return;
114157 +
114158 + def_stmt = get_def_stmt(rhs);
114159 + if (!def_stmt)
114160 + return;
114161 + if (!is_gimple_assign(def_stmt))
114162 + return;
114163 +
114164 + rhs1 = gimple_assign_rhs1(def_stmt);
114165 + if (!is_unsigned_cast_or_call_def_stmt(rhs1))
114166 + return;
114167 +
114168 + rhs2 = gimple_assign_rhs2(def_stmt);
114169 + if (!is_unsigned_cast_or_call_def_stmt(rhs2))
114170 + return;
114171 + if (gimple_num_ops(def_stmt) == 3 && !is_gimple_constant(rhs1) && !is_gimple_constant(rhs2))
114172 + return;
114173 +
114174 + so_stmt = get_dup_stmt(visited, stmt);
114175 + create_up_and_down_cast(visited, so_stmt, lhs_type, gimple_assign_rhs1(so_stmt));
114176 +}
114177 +
114178 diff --git a/tools/gcc/size_overflow_plugin/misc.c b/tools/gcc/size_overflow_plugin/misc.c
114179 new file mode 100644
114180 index 0000000..4bddad2
114181 --- /dev/null
114182 +++ b/tools/gcc/size_overflow_plugin/misc.c
114183 @@ -0,0 +1,203 @@
114184 +/*
114185 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
114186 + * Licensed under the GPL v2, or (at your option) v3
114187 + *
114188 + * Homepage:
114189 + * http://www.grsecurity.net/~ephox/overflow_plugin/
114190 + *
114191 + * Documentation:
114192 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
114193 + *
114194 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
114195 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
114196 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
114197 + *
114198 + * Usage:
114199 + * $ make
114200 + * $ make run
114201 + */
114202 +
114203 +#include "gcc-common.h"
114204 +#include "size_overflow.h"
114205 +
114206 +void set_current_function_decl(tree fndecl)
114207 +{
114208 + gcc_assert(fndecl != NULL_TREE);
114209 +
114210 + push_cfun(DECL_STRUCT_FUNCTION(fndecl));
114211 + calculate_dominance_info(CDI_DOMINATORS);
114212 + current_function_decl = fndecl;
114213 +}
114214 +
114215 +void unset_current_function_decl(void)
114216 +{
114217 + free_dominance_info(CDI_DOMINATORS);
114218 + pop_cfun();
114219 + current_function_decl = NULL_TREE;
114220 +}
114221 +
114222 +static bool is_bool(const_tree node)
114223 +{
114224 + const_tree type;
114225 +
114226 + if (node == NULL_TREE)
114227 + return false;
114228 +
114229 + type = TREE_TYPE(node);
114230 + if (!INTEGRAL_TYPE_P(type))
114231 + return false;
114232 + if (TREE_CODE(type) == BOOLEAN_TYPE)
114233 + return true;
114234 + if (TYPE_PRECISION(type) == 1)
114235 + return true;
114236 + return false;
114237 +}
114238 +
114239 +bool skip_types(const_tree var)
114240 +{
114241 + tree type;
114242 + enum tree_code code;
114243 +
114244 + if (is_gimple_constant(var))
114245 + return true;
114246 +
114247 + switch (TREE_CODE(var)) {
114248 + case ADDR_EXPR:
114249 +#if BUILDING_GCC_VERSION >= 4006
114250 + case MEM_REF:
114251 +#endif
114252 + case ARRAY_REF:
114253 + case BIT_FIELD_REF:
114254 + case INDIRECT_REF:
114255 + case TARGET_MEM_REF:
114256 + case COMPONENT_REF:
114257 + case VAR_DECL:
114258 + case VIEW_CONVERT_EXPR:
114259 + return true;
114260 + default:
114261 + break;
114262 + }
114263 +
114264 + code = TREE_CODE(var);
114265 + gcc_assert(code == SSA_NAME || code == PARM_DECL);
114266 +
114267 + type = TREE_TYPE(var);
114268 + switch (TREE_CODE(type)) {
114269 + case INTEGER_TYPE:
114270 + case ENUMERAL_TYPE:
114271 + return false;
114272 + case BOOLEAN_TYPE:
114273 + return is_bool(var);
114274 + default:
114275 + return true;
114276 + }
114277 +}
114278 +
114279 +gimple get_def_stmt(const_tree node)
114280 +{
114281 + gcc_assert(node != NULL_TREE);
114282 +
114283 + if (skip_types(node))
114284 + return NULL;
114285 +
114286 + if (TREE_CODE(node) != SSA_NAME)
114287 + return NULL;
114288 + return SSA_NAME_DEF_STMT(node);
114289 +}
114290 +
114291 +tree create_new_var(tree type)
114292 +{
114293 + tree new_var = create_tmp_var(type, "cicus");
114294 +
114295 + add_referenced_var(new_var);
114296 + return new_var;
114297 +}
114298 +
114299 +static bool skip_cast(tree dst_type, const_tree rhs, bool force)
114300 +{
114301 + const_gimple def_stmt = get_def_stmt(rhs);
114302 +
114303 + if (force)
114304 + return false;
114305 +
114306 + if (is_gimple_constant(rhs))
114307 + return false;
114308 +
114309 + if (!def_stmt || gimple_code(def_stmt) == GIMPLE_NOP)
114310 + return false;
114311 +
114312 + if (!types_compatible_p(dst_type, TREE_TYPE(rhs)))
114313 + return false;
114314 +
114315 + // DI type can be on 32 bit (from create_assign) but overflow type stays DI
114316 + if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode))
114317 + return false;
114318 +
114319 + return true;
114320 +}
114321 +
114322 +tree cast_a_tree(tree type, tree var)
114323 +{
114324 + gcc_assert(type != NULL_TREE);
114325 + gcc_assert(var != NULL_TREE);
114326 + gcc_assert(fold_convertible_p(type, var));
114327 +
114328 + return fold_convert(type, var);
114329 +}
114330 +
114331 +gimple build_cast_stmt(struct visited *visited, tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before, bool force)
114332 +{
114333 + gimple assign, def_stmt;
114334 +
114335 + gcc_assert(dst_type != NULL_TREE && rhs != NULL_TREE);
114336 + gcc_assert(!is_gimple_constant(rhs));
114337 + if (gsi_end_p(*gsi) && before == AFTER_STMT)
114338 + gcc_unreachable();
114339 +
114340 + def_stmt = get_def_stmt(rhs);
114341 + if (def_stmt && gimple_code(def_stmt) != GIMPLE_NOP && skip_cast(dst_type, rhs, force) && pointer_set_contains(visited->my_stmts, def_stmt))
114342 + return def_stmt;
114343 +
114344 + if (lhs == CREATE_NEW_VAR)
114345 + lhs = create_new_var(dst_type);
114346 +
114347 + assign = gimple_build_assign(lhs, cast_a_tree(dst_type, rhs));
114348 +
114349 + if (!gsi_end_p(*gsi)) {
114350 + location_t loc = gimple_location(gsi_stmt(*gsi));
114351 + gimple_set_location(assign, loc);
114352 + }
114353 +
114354 + gimple_assign_set_lhs(assign, make_ssa_name(lhs, assign));
114355 +
114356 + if (before)
114357 + gsi_insert_before(gsi, assign, GSI_NEW_STMT);
114358 + else
114359 + gsi_insert_after(gsi, assign, GSI_NEW_STMT);
114360 + update_stmt(assign);
114361 + return assign;
114362 +}
114363 +
114364 +bool is_size_overflow_type(const_tree var)
114365 +{
114366 + const char *name;
114367 + const_tree type_name, type;
114368 +
114369 + if (var == NULL_TREE)
114370 + return false;
114371 +
114372 + type = TREE_TYPE(var);
114373 + type_name = TYPE_NAME(type);
114374 + if (type_name == NULL_TREE)
114375 + return false;
114376 +
114377 + if (DECL_P(type_name))
114378 + name = DECL_NAME_POINTER(type_name);
114379 + else
114380 + name = IDENTIFIER_POINTER(type_name);
114381 +
114382 + if (!strncmp(name, "size_overflow_type", 18))
114383 + return true;
114384 + return false;
114385 +}
114386 +
114387 diff --git a/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
114388 new file mode 100644
114389 index 0000000..7c9e6d1
114390 --- /dev/null
114391 +++ b/tools/gcc/size_overflow_plugin/remove_unnecessary_dup.c
114392 @@ -0,0 +1,138 @@
114393 +/*
114394 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
114395 + * Licensed under the GPL v2, or (at your option) v3
114396 + *
114397 + * Homepage:
114398 + * http://www.grsecurity.net/~ephox/overflow_plugin/
114399 + *
114400 + * Documentation:
114401 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
114402 + *
114403 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
114404 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
114405 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
114406 + *
114407 + * Usage:
114408 + * $ make
114409 + * $ make run
114410 + */
114411 +
114412 +#include "gcc-common.h"
114413 +#include "size_overflow.h"
114414 +
114415 +bool skip_expr_on_double_type(const_gimple stmt)
114416 +{
114417 + enum tree_code code = gimple_assign_rhs_code(stmt);
114418 +
114419 + switch (code) {
114420 + case RSHIFT_EXPR:
114421 + case TRUNC_DIV_EXPR:
114422 + case CEIL_DIV_EXPR:
114423 + case FLOOR_DIV_EXPR:
114424 + case ROUND_DIV_EXPR:
114425 + case EXACT_DIV_EXPR:
114426 + case RDIV_EXPR:
114427 + case TRUNC_MOD_EXPR:
114428 + case CEIL_MOD_EXPR:
114429 + case FLOOR_MOD_EXPR:
114430 + case ROUND_MOD_EXPR:
114431 + return true;
114432 + default:
114433 + return false;
114434 + }
114435 +}
114436 +
114437 +void create_up_and_down_cast(struct visited *visited, gimple use_stmt, tree orig_type, tree rhs)
114438 +{
114439 + const_tree orig_rhs1;
114440 + tree down_lhs, new_lhs, dup_type = TREE_TYPE(rhs);
114441 + gimple down_cast, up_cast;
114442 + gimple_stmt_iterator gsi = gsi_for_stmt(use_stmt);
114443 +
114444 + down_cast = build_cast_stmt(visited, orig_type, rhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
114445 + down_lhs = gimple_assign_lhs(down_cast);
114446 +
114447 + gsi = gsi_for_stmt(use_stmt);
114448 + up_cast = build_cast_stmt(visited, dup_type, down_lhs, CREATE_NEW_VAR, &gsi, BEFORE_STMT, false);
114449 + new_lhs = gimple_assign_lhs(up_cast);
114450 +
114451 + orig_rhs1 = gimple_assign_rhs1(use_stmt);
114452 + if (operand_equal_p(orig_rhs1, rhs, 0))
114453 + gimple_assign_set_rhs1(use_stmt, new_lhs);
114454 + else
114455 + gimple_assign_set_rhs2(use_stmt, new_lhs);
114456 + update_stmt(use_stmt);
114457 +
114458 + pointer_set_insert(visited->my_stmts, up_cast);
114459 + pointer_set_insert(visited->my_stmts, down_cast);
114460 + pointer_set_insert(visited->skip_expr_casts, up_cast);
114461 + pointer_set_insert(visited->skip_expr_casts, down_cast);
114462 +}
114463 +
114464 +static tree get_proper_unsigned_half_type(const_tree node)
114465 +{
114466 + tree new_type, type;
114467 +
114468 + gcc_assert(is_size_overflow_type(node));
114469 +
114470 + type = TREE_TYPE(node);
114471 + switch (TYPE_MODE(type)) {
114472 + case HImode:
114473 + new_type = unsigned_intQI_type_node;
114474 + break;
114475 + case SImode:
114476 + new_type = unsigned_intHI_type_node;
114477 + break;
114478 + case DImode:
114479 + new_type = unsigned_intSI_type_node;
114480 + break;
114481 + case TImode:
114482 + new_type = unsigned_intDI_type_node;
114483 + break;
114484 + default:
114485 + gcc_unreachable();
114486 + }
114487 +
114488 + if (TYPE_QUALS(type) != 0)
114489 + return build_qualified_type(new_type, TYPE_QUALS(type));
114490 + return new_type;
114491 +}
114492 +
114493 +static void insert_cast_rhs(struct visited *visited, gimple stmt, tree rhs)
114494 +{
114495 + tree type;
114496 +
114497 + if (rhs == NULL_TREE)
114498 + return;
114499 + if (!is_size_overflow_type(rhs))
114500 + return;
114501 +
114502 + type = get_proper_unsigned_half_type(rhs);
114503 + if (is_gimple_constant(rhs))
114504 + return;
114505 + create_up_and_down_cast(visited, stmt, type, rhs);
114506 +}
114507 +
114508 +static void insert_cast(struct visited *visited, gimple stmt, tree rhs)
114509 +{
114510 + if (LONG_TYPE_SIZE == GET_MODE_BITSIZE(SImode) && !is_size_overflow_type(rhs))
114511 + return;
114512 + gcc_assert(is_size_overflow_type(rhs));
114513 + insert_cast_rhs(visited, stmt, rhs);
114514 +}
114515 +
114516 +void insert_cast_expr(struct visited *visited, gimple stmt, enum intentional_overflow_type type)
114517 +{
114518 + tree rhs1, rhs2;
114519 +
114520 + if (type == NO_INTENTIONAL_OVERFLOW || type == RHS1_INTENTIONAL_OVERFLOW) {
114521 + rhs1 = gimple_assign_rhs1(stmt);
114522 + insert_cast(visited, stmt, rhs1);
114523 + }
114524 +
114525 + if (type == NO_INTENTIONAL_OVERFLOW || type == RHS2_INTENTIONAL_OVERFLOW) {
114526 + rhs2 = gimple_assign_rhs2(stmt);
114527 + insert_cast(visited, stmt, rhs2);
114528 + }
114529 +}
114530 +
114531 diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
114532 new file mode 100644
114533 index 0000000..e5b4e50
114534 --- /dev/null
114535 +++ b/tools/gcc/size_overflow_plugin/size_overflow.h
114536 @@ -0,0 +1,127 @@
114537 +#ifndef SIZE_OVERFLOW_H
114538 +#define SIZE_OVERFLOW_H
114539 +
114540 +#define CREATE_NEW_VAR NULL_TREE
114541 +#define CANNOT_FIND_ARG 32
114542 +#define MAX_PARAM 31
114543 +#define BEFORE_STMT true
114544 +#define AFTER_STMT false
114545 +
114546 +#define TURN_OFF_ASM_STR "# size_overflow MARK_TURN_OFF "
114547 +#define YES_ASM_STR "# size_overflow MARK_YES "
114548 +#define OK_ASM_STR "# size_overflow "
114549 +
114550 +enum mark {
114551 + MARK_NO, MARK_YES, MARK_NOT_INTENTIONAL, MARK_TURN_OFF
114552 +};
114553 +
114554 +enum intentional_overflow_type {
114555 + NO_INTENTIONAL_OVERFLOW, RHS1_INTENTIONAL_OVERFLOW, RHS2_INTENTIONAL_OVERFLOW
114556 +};
114557 +
114558 +struct visited {
114559 + struct pointer_set_t *stmts;
114560 + struct pointer_set_t *my_stmts;
114561 + struct pointer_set_t *skip_expr_casts;
114562 + struct pointer_set_t *no_cast_check;
114563 +};
114564 +
114565 +// size_overflow_plugin.c
114566 +extern tree report_size_overflow_decl;
114567 +extern tree size_overflow_type_HI;
114568 +extern tree size_overflow_type_SI;
114569 +extern tree size_overflow_type_DI;
114570 +extern tree size_overflow_type_TI;
114571 +
114572 +
114573 +// size_overflow_plugin_hash.c
114574 +struct size_overflow_hash {
114575 + const struct size_overflow_hash * const next;
114576 + const char * const name;
114577 + const unsigned int param;
114578 +};
114579 +
114580 +struct interesting_node {
114581 + struct interesting_node *next;
114582 + gimple first_stmt;
114583 + const_tree fndecl;
114584 + tree node;
114585 +#if BUILDING_GCC_VERSION <= 4007
114586 + VEC(tree, gc) *last_nodes;
114587 +#else
114588 + vec<tree, va_gc> *last_nodes;
114589 +#endif
114590 + unsigned int num;
114591 + enum mark intentional_attr_decl;
114592 + enum mark intentional_attr_cur_fndecl;
114593 + gimple intentional_mark_from_gimple;
114594 +};
114595 +
114596 +extern bool is_size_overflow_asm(const_gimple stmt);
114597 +extern unsigned int get_function_num(const_tree node, const_tree orig_fndecl);
114598 +extern unsigned int get_correct_arg_count(unsigned int argnum, const_tree fndecl);
114599 +extern bool is_missing_function(const_tree orig_fndecl, unsigned int num);
114600 +extern bool is_a_return_check(const_tree node);
114601 +extern const struct size_overflow_hash *get_function_hash(const_tree fndecl);
114602 +extern unsigned int find_arg_number_tree(const_tree arg, const_tree func);
114603 +
114604 +
114605 +// size_overflow_debug.c
114606 +extern struct opt_pass *make_dump_pass(void);
114607 +
114608 +
114609 +// intentional_overflow.c
114610 +extern enum mark get_intentional_attr_type(const_tree node);
114611 +extern bool is_size_overflow_intentional_asm_yes(const_gimple stmt);
114612 +extern bool is_size_overflow_intentional_asm_turn_off(const_gimple stmt);
114613 +extern bool is_end_intentional_intentional_attr(const_tree decl, unsigned int argnum);
114614 +extern bool is_yes_intentional_attr(const_tree decl, unsigned int argnum);
114615 +extern bool is_turn_off_intentional_attr(const_tree decl);
114616 +extern void print_missing_intentional(enum mark callee_attr, enum mark caller_attr, const_tree decl, unsigned int argnum);
114617 +extern void check_intentional_attribute_ipa(struct interesting_node *cur_node);
114618 +extern bool is_a_cast_and_const_overflow(const_tree no_const_rhs);
114619 +extern bool is_const_plus_unsigned_signed_truncation(const_tree lhs);
114620 +extern bool is_a_constant_overflow(const_gimple stmt, const_tree rhs);
114621 +extern tree handle_intentional_overflow(struct visited *visited, struct cgraph_node *caller_node, bool check_overflow, gimple stmt, tree change_rhs, tree new_rhs2);
114622 +extern tree handle_integer_truncation(struct visited *visited, struct cgraph_node *caller_node, const_tree lhs);
114623 +extern bool is_a_neg_overflow(const_gimple stmt, const_tree rhs);
114624 +extern enum intentional_overflow_type add_mul_intentional_overflow(const_gimple def_stmt);
114625 +extern void unsigned_signed_cast_intentional_overflow(struct visited *visited, gimple stmt);
114626 +
114627 +
114628 +// insert_size_overflow_check_ipa.c
114629 +extern unsigned int search_function(void);
114630 +extern unsigned int call_count;
114631 +extern struct opt_pass *make_insert_size_overflow_check(void);
114632 +extern const_tree get_interesting_orig_fndecl(const_gimple stmt, unsigned int argnum);
114633 +
114634 +
114635 +// insert_size_overflow_asm.c
114636 +extern struct opt_pass *make_insert_size_overflow_asm_pass(void);
114637 +
114638 +
114639 +// misc.c
114640 +extern void set_current_function_decl(tree fndecl);
114641 +extern void unset_current_function_decl(void);
114642 +extern gimple get_def_stmt(const_tree node);
114643 +extern tree create_new_var(tree type);
114644 +extern gimple build_cast_stmt(struct visited *visited, tree dst_type, tree rhs, tree lhs, gimple_stmt_iterator *gsi, bool before, bool force);
114645 +extern bool skip_types(const_tree var);
114646 +extern tree cast_a_tree(tree type, tree var);
114647 +extern bool is_size_overflow_type(const_tree var);
114648 +
114649 +
114650 +// insert_size_overflow_check_core.c
114651 +extern tree expand(struct visited *visited, struct cgraph_node *caller_node, tree lhs);
114652 +extern void check_size_overflow(struct cgraph_node *caller_node, gimple stmt, tree size_overflow_type, tree cast_rhs, tree rhs, bool before);
114653 +extern tree dup_assign(struct visited *visited, gimple oldstmt, const_tree node, tree rhs1, tree rhs2, tree __unused rhs3);
114654 +extern tree create_assign(struct visited *visited, gimple oldstmt, tree rhs1, bool before);
114655 +
114656 +
114657 +// remove_unnecessary_dup.c
114658 +extern struct opt_pass *make_remove_unnecessary_dup_pass(void);
114659 +extern void insert_cast_expr(struct visited *visited, gimple stmt, enum intentional_overflow_type type);
114660 +extern bool skip_expr_on_double_type(const_gimple stmt);
114661 +extern void create_up_and_down_cast(struct visited *visited, gimple use_stmt, tree orig_type, tree rhs);
114662 +
114663 +#endif
114664 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_debug.c b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
114665 new file mode 100644
114666 index 0000000..4378111
114667 --- /dev/null
114668 +++ b/tools/gcc/size_overflow_plugin/size_overflow_debug.c
114669 @@ -0,0 +1,116 @@
114670 +/*
114671 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
114672 + * Licensed under the GPL v2, or (at your option) v3
114673 + *
114674 + * Homepage:
114675 + * http://www.grsecurity.net/~ephox/overflow_plugin/
114676 + *
114677 + * Documentation:
114678 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
114679 + *
114680 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
114681 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
114682 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
114683 + *
114684 + * Usage:
114685 + * $ make
114686 + * $ make run
114687 + */
114688 +
114689 +#include "gcc-common.h"
114690 +
114691 +static unsigned int dump_functions(void)
114692 +{
114693 + struct cgraph_node *node;
114694 +
114695 + FOR_EACH_FUNCTION_WITH_GIMPLE_BODY(node) {
114696 + basic_block bb;
114697 +
114698 + push_cfun(DECL_STRUCT_FUNCTION(NODE_DECL(node)));
114699 + current_function_decl = NODE_DECL(node);
114700 +
114701 + fprintf(stderr, "-----------------------------------------\n%s\n-----------------------------------------\n", DECL_NAME_POINTER(current_function_decl));
114702 +
114703 + FOR_ALL_BB_FN(bb, cfun) {
114704 + gimple_stmt_iterator si;
114705 +
114706 + fprintf(stderr, "<bb %u>:\n", bb->index);
114707 + for (si = gsi_start_phis(bb); !gsi_end_p(si); gsi_next(&si))
114708 + debug_gimple_stmt(gsi_stmt(si));
114709 + for (si = gsi_start_bb(bb); !gsi_end_p(si); gsi_next(&si))
114710 + debug_gimple_stmt(gsi_stmt(si));
114711 + fprintf(stderr, "\n");
114712 + }
114713 +
114714 + fprintf(stderr, "-------------------------------------------------------------------------\n");
114715 +
114716 + pop_cfun();
114717 + current_function_decl = NULL_TREE;
114718 + }
114719 +
114720 + fprintf(stderr, "###############################################################################\n");
114721 +
114722 + return 0;
114723 +}
114724 +
114725 +#if BUILDING_GCC_VERSION >= 4009
114726 +static const struct pass_data dump_pass_data = {
114727 +#else
114728 +static struct ipa_opt_pass_d dump_pass = {
114729 + .pass = {
114730 +#endif
114731 + .type = SIMPLE_IPA_PASS,
114732 + .name = "dump",
114733 +#if BUILDING_GCC_VERSION >= 4008
114734 + .optinfo_flags = OPTGROUP_NONE,
114735 +#endif
114736 +#if BUILDING_GCC_VERSION >= 4009
114737 + .has_gate = false,
114738 + .has_execute = true,
114739 +#else
114740 + .gate = NULL,
114741 + .execute = dump_functions,
114742 + .sub = NULL,
114743 + .next = NULL,
114744 + .static_pass_number = 0,
114745 +#endif
114746 + .tv_id = TV_NONE,
114747 + .properties_required = 0,
114748 + .properties_provided = 0,
114749 + .properties_destroyed = 0,
114750 + .todo_flags_start = 0,
114751 + .todo_flags_finish = 0,
114752 +#if BUILDING_GCC_VERSION < 4009
114753 + },
114754 + .generate_summary = NULL,
114755 + .write_summary = NULL,
114756 + .read_summary = NULL,
114757 +#if BUILDING_GCC_VERSION >= 4006
114758 + .write_optimization_summary = NULL,
114759 + .read_optimization_summary = NULL,
114760 +#endif
114761 + .stmt_fixup = NULL,
114762 + .function_transform_todo_flags_start = 0,
114763 + .function_transform = NULL,
114764 + .variable_transform = NULL,
114765 +#endif
114766 +};
114767 +
114768 +#if BUILDING_GCC_VERSION >= 4009
114769 +namespace {
114770 +class dump_pass : public ipa_opt_pass_d {
114771 +public:
114772 + dump_pass() : ipa_opt_pass_d(dump_pass_data, g, NULL, NULL, NULL, NULL, NULL, NULL, 0, NULL, NULL) {}
114773 + unsigned int execute() { return dump_functions(); }
114774 +};
114775 +}
114776 +#endif
114777 +
114778 +struct opt_pass *make_dump_pass(void)
114779 +{
114780 +#if BUILDING_GCC_VERSION >= 4009
114781 + return new dump_pass();
114782 +#else
114783 + return &dump_pass.pass;
114784 +#endif
114785 +}
114786 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
114787 new file mode 100644
114788 index 0000000..72e9c0e
114789 --- /dev/null
114790 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
114791 @@ -0,0 +1,5986 @@
114792 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
114793 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
114794 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
114795 +compat_sock_setsockopt_23 compat_sock_setsockopt 5 23 NULL
114796 +carl9170_alloc_27 carl9170_alloc 1 27 NULL
114797 +sel_read_policyvers_55 sel_read_policyvers 3 55 NULL nohasharray
114798 +padzero_55 padzero 1 55 &sel_read_policyvers_55
114799 +cfg80211_disconnected_57 cfg80211_disconnected 4 57 NULL
114800 +__skb_to_sgvec_72 __skb_to_sgvec 0 72 NULL
114801 +snd_korg1212_copy_to_92 snd_korg1212_copy_to 6 92 NULL
114802 +load_msg_95 load_msg 2 95 NULL
114803 +ipath_verbs_send_117 ipath_verbs_send 5-3 117 NULL
114804 +init_q_132 init_q 4 132 NULL
114805 +memstick_alloc_host_142 memstick_alloc_host 1 142 NULL
114806 +gfs2_glock_get_147 gfs2_glock_get 0 147 NULL
114807 +hva_to_gfn_memslot_149 hva_to_gfn_memslot 0-1 149 NULL
114808 +ping_v6_sendmsg_152 ping_v6_sendmsg 4 152 NULL
114809 +ext4_ext_get_actual_len_153 ext4_ext_get_actual_len 0 153 NULL nohasharray
114810 +tracing_trace_options_write_153 tracing_trace_options_write 3 153 &ext4_ext_get_actual_len_153
114811 +pci_request_selected_regions_169 pci_request_selected_regions 0 169 NULL
114812 +xfs_buf_item_get_format_189 xfs_buf_item_get_format 2 189 NULL
114813 +xfs_bmap_btalloc_192 xfs_bmap_btalloc 0 192 NULL
114814 +iscsi_session_setup_196 iscsi_session_setup 4-5 196 NULL
114815 +ll_xattr_cache_seq_write_250 ll_xattr_cache_seq_write 3 250 NULL
114816 +br_port_info_size_268 br_port_info_size 0 268 NULL
114817 +generic_file_direct_write_291 generic_file_direct_write 0 291 NULL
114818 +read_file_war_stats_292 read_file_war_stats 3 292 NULL
114819 +xfs_zero_last_block_298 xfs_zero_last_block 0 298 NULL
114820 +SYSC_connect_304 SYSC_connect 3 304 NULL
114821 +syslog_print_307 syslog_print 2 307 NULL
114822 +dn_setsockopt_314 dn_setsockopt 5 314 NULL
114823 +mlx5_core_access_reg_361 mlx5_core_access_reg 3-5 361 NULL
114824 +aio_read_events_ring_410 aio_read_events_ring 3-0 410 NULL
114825 +lbs_rdmac_read_418 lbs_rdmac_read 3 418 NULL
114826 +snd_ca0106_ptr_read_467 snd_ca0106_ptr_read 0 467 NULL
114827 +cfs_trace_set_debug_mb_usrstr_486 cfs_trace_set_debug_mb_usrstr 2 486 NULL
114828 +nvme_trans_modesel_data_488 nvme_trans_modesel_data 4 488 NULL
114829 +iwl_dbgfs_protection_mode_write_502 iwl_dbgfs_protection_mode_write 3 502 NULL
114830 +rx_rx_defrag_end_read_505 rx_rx_defrag_end_read 3 505 NULL
114831 +ocfs2_validate_meta_ecc_bhs_527 ocfs2_validate_meta_ecc_bhs 0 527 NULL
114832 +zlib_deflate_workspacesize_537 zlib_deflate_workspacesize 0-1-2 537 NULL
114833 +iwl_dbgfs_wowlan_sram_read_540 iwl_dbgfs_wowlan_sram_read 3 540 NULL
114834 +sco_sock_setsockopt_552 sco_sock_setsockopt 5 552 NULL
114835 +lpfc_nlp_state_name_556 lpfc_nlp_state_name 2 556 NULL
114836 +snd_aw2_saa7146_get_hw_ptr_playback_558 snd_aw2_saa7146_get_hw_ptr_playback 0 558 NULL
114837 +start_isoc_chain_565 start_isoc_chain 2 565 NULL nohasharray
114838 +dev_hard_header_565 dev_hard_header 0 565 &start_isoc_chain_565
114839 +ocfs2_refcounted_xattr_delete_need_584 ocfs2_refcounted_xattr_delete_need 0 584 NULL
114840 +smk_write_load_self2_591 smk_write_load_self2 3 591 NULL
114841 +btrfs_stack_file_extent_offset_607 btrfs_stack_file_extent_offset 0 607 NULL
114842 +ni_gpct_device_construct_610 ni_gpct_device_construct 5 610 NULL
114843 +fuse_request_alloc_nofs_617 fuse_request_alloc_nofs 1 617 NULL
114844 +ptlrpc_lprocfs_nrs_seq_write_621 ptlrpc_lprocfs_nrs_seq_write 3 621 NULL
114845 +viafb_dfpl_proc_write_627 viafb_dfpl_proc_write 3 627 NULL
114846 +ceph_osdc_new_request_635 ceph_osdc_new_request 6 635 NULL
114847 +cfs_hash_bkt_size_643 cfs_hash_bkt_size 0 643 NULL
114848 +unlink_queued_645 unlink_queued 4 645 NULL
114849 +dtim_interval_read_654 dtim_interval_read 3 654 NULL
114850 +mem_rx_free_mem_blks_read_675 mem_rx_free_mem_blks_read 3 675 NULL
114851 +persistent_ram_vmap_709 persistent_ram_vmap 1-2 709 NULL
114852 +xfs_bmap_eof_728 xfs_bmap_eof 0 728 NULL
114853 +sctp_setsockopt_peer_addr_params_734 sctp_setsockopt_peer_addr_params 3 734 NULL
114854 +dvb_video_write_754 dvb_video_write 3 754 NULL
114855 +cfs_trace_allocate_string_buffer_781 cfs_trace_allocate_string_buffer 2 781 NULL
114856 +ath6kl_disconnect_timeout_write_794 ath6kl_disconnect_timeout_write 3 794 NULL
114857 +if_writecmd_815 if_writecmd 2 815 NULL
114858 +aac_change_queue_depth_825 aac_change_queue_depth 2 825 NULL
114859 +error_state_read_859 error_state_read 6 859 NULL
114860 +o2net_send_message_vec_879 o2net_send_message_vec 4 879 NULL nohasharray
114861 +iwl_dbgfs_fh_reg_read_879 iwl_dbgfs_fh_reg_read 3 879 &o2net_send_message_vec_879
114862 +snd_pcm_action_single_905 snd_pcm_action_single 0 905 NULL
114863 +carl9170_cmd_buf_950 carl9170_cmd_buf 3 950 NULL
114864 +__nodes_weight_956 __nodes_weight 2-0 956 NULL
114865 +bnx2x_fill_fw_str_968 bnx2x_fill_fw_str 3 968 NULL
114866 +mnt_want_write_975 mnt_want_write 0 975 NULL
114867 +usnic_ib_qp_grp_dump_hdr_989 usnic_ib_qp_grp_dump_hdr 2 989 NULL
114868 +memcmp_990 memcmp 0 990 NULL
114869 +readreg_1017 readreg 0-1 1017 NULL
114870 +smk_write_cipso2_1021 smk_write_cipso2 3 1021 NULL
114871 +gigaset_initdriver_1060 gigaset_initdriver 2 1060 NULL
114872 +mce_request_packet_1073 mce_request_packet 3 1073 NULL
114873 +agp_create_memory_1075 agp_create_memory 1 1075 NULL
114874 +_scsih_adjust_queue_depth_1083 _scsih_adjust_queue_depth 2 1083 NULL
114875 +llcp_sock_sendmsg_1092 llcp_sock_sendmsg 4 1092 NULL
114876 +nfs4_init_nonuniform_client_string_1097 nfs4_init_nonuniform_client_string 3 1097 NULL
114877 +utf8s_to_utf16s_1115 utf8s_to_utf16s 0 1115 NULL
114878 +cfg80211_report_obss_beacon_1133 cfg80211_report_obss_beacon 3 1133 NULL
114879 +i2400m_rx_ctl_1157 i2400m_rx_ctl 4 1157 NULL
114880 +ipc_alloc_1192 ipc_alloc 1 1192 NULL
114881 +ib_create_send_mad_1196 ib_create_send_mad 5 1196 NULL
114882 +pstore_ftrace_knob_write_1198 pstore_ftrace_knob_write 3 1198 NULL
114883 +i2400m_rx_ctl_ack_1199 i2400m_rx_ctl_ack 3 1199 NULL
114884 +dgrp_dpa_read_1204 dgrp_dpa_read 3 1204 NULL
114885 +i2cdev_read_1206 i2cdev_read 3 1206 NULL
114886 +lov_ost_pool_init_1215 lov_ost_pool_init 2 1215 NULL
114887 +fsync_buffers_list_1219 fsync_buffers_list 0 1219 NULL
114888 +kernfs_file_direct_read_1238 kernfs_file_direct_read 3 1238 NULL
114889 +ocfs2_extend_file_1266 ocfs2_extend_file 3 1266 NULL
114890 +qla4xxx_change_queue_depth_1268 qla4xxx_change_queue_depth 2 1268 NULL
114891 +ioctl_private_iw_point_1273 ioctl_private_iw_point 7 1273 NULL
114892 +SyS_flistxattr_1287 SyS_flistxattr 3 1287 NULL
114893 +tx_frag_in_process_called_read_1290 tx_frag_in_process_called_read 3 1290 NULL
114894 +posix_acl_xattr_set_1301 posix_acl_xattr_set 4 1301 NULL
114895 +tcf_hash_create_1305 tcf_hash_create 4 1305 NULL
114896 +ffs_1322 ffs 0 1322 NULL
114897 +qlcnic_pci_sriov_configure_1327 qlcnic_pci_sriov_configure 2 1327 NULL
114898 +btrfs_submit_compressed_write_1347 btrfs_submit_compressed_write 5 1347 NULL
114899 +snd_pcm_lib_write1_1358 snd_pcm_lib_write1 0-3 1358 NULL
114900 +ipx_sendmsg_1362 ipx_sendmsg 4 1362 NULL
114901 +fw_stats_raw_read_1369 fw_stats_raw_read 3 1369 NULL
114902 +ocfs2_prepare_inode_for_write_1372 ocfs2_prepare_inode_for_write 3 1372 NULL
114903 +sctp_setsockopt_initmsg_1383 sctp_setsockopt_initmsg 3 1383 NULL
114904 +do_msgsnd_1387 do_msgsnd 4 1387 NULL
114905 +SYSC_io_getevents_1392 SYSC_io_getevents 3 1392 NULL
114906 +file_read_actor_1401 file_read_actor 4-0 1401 NULL
114907 +cfs_trace_copyout_string_1416 cfs_trace_copyout_string 2 1416 NULL
114908 +init_rs_internal_1436 init_rs_internal 1 1436 NULL
114909 +stack_max_size_read_1445 stack_max_size_read 3 1445 NULL
114910 +tx_queue_len_read_1463 tx_queue_len_read 3 1463 NULL
114911 +xprt_alloc_1475 xprt_alloc 2 1475 NULL
114912 +SYSC_syslog_1477 SYSC_syslog 3 1477 NULL
114913 +sta_num_ps_buf_frames_read_1488 sta_num_ps_buf_frames_read 3 1488 NULL
114914 +fpregs_set_1497 fpregs_set 4 1497 NULL
114915 +tomoyo_round2_1518 tomoyo_round2 0 1518 NULL
114916 +alloc_perm_bits_1532 alloc_perm_bits 2 1532 NULL
114917 +ath6kl_init_get_fwcaps_1557 ath6kl_init_get_fwcaps 3 1557 NULL
114918 +ffs_mutex_lock_1564 ffs_mutex_lock 0 1564 NULL
114919 +ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime_1589 ieee80211_if_read_dot11MeshHWMPnetDiameterTraversalTime 3 1589 NULL
114920 +ipath_ht_handle_hwerrors_1592 ipath_ht_handle_hwerrors 3 1592 NULL
114921 +packet_buffer_init_1607 packet_buffer_init 2 1607 NULL
114922 +btmrvl_hscmd_read_1614 btmrvl_hscmd_read 3 1614 NULL
114923 +v9fs_fid_xattr_get_1618 v9fs_fid_xattr_get 0 1618 NULL
114924 +ikconfig_read_current_1658 ikconfig_read_current 3 1658 NULL
114925 +mei_cl_recv_1665 mei_cl_recv 3 1665 NULL
114926 +rmap_add_1677 rmap_add 3 1677 NULL
114927 +configfs_read_file_1683 configfs_read_file 3 1683 NULL
114928 +pdu_write_u_1710 pdu_write_u 3 1710 NULL
114929 +coda_psdev_write_1711 coda_psdev_write 3 1711 NULL
114930 +btrfs_dir_data_len_1714 btrfs_dir_data_len 0 1714 NULL
114931 +internal_create_group_1733 internal_create_group 0 1733 NULL
114932 +dev_irnet_read_1741 dev_irnet_read 3 1741 NULL
114933 +usb_ep_align_maybe_1743 usb_ep_align_maybe 0-3 1743 NULL
114934 +tx_frag_called_read_1748 tx_frag_called_read 3 1748 NULL
114935 +cosa_write_1774 cosa_write 3 1774 NULL
114936 +fcoe_ctlr_device_add_1793 fcoe_ctlr_device_add 3 1793 NULL
114937 +__nodelist_scnprintf_1815 __nodelist_scnprintf 2-0 1815 NULL
114938 +sb_issue_zeroout_1884 sb_issue_zeroout 3 1884 NULL
114939 +rx_defrag_called_read_1897 rx_defrag_called_read 3 1897 NULL
114940 +nfs_parse_server_name_1899 nfs_parse_server_name 2 1899 NULL
114941 +SyS_add_key_1900 SyS_add_key 4 1900 NULL
114942 +uhid_char_read_1920 uhid_char_read 3 1920 NULL
114943 +tx_tx_retry_data_read_1926 tx_tx_retry_data_read 3 1926 NULL
114944 +bdev_erase_1933 bdev_erase 3 1933 NULL
114945 +ext3_fiemap_1936 ext3_fiemap 4 1936 NULL
114946 +cyttsp_probe_1940 cyttsp_probe 4 1940 NULL
114947 +ieee80211_if_fmt_dot11MeshConfirmTimeout_1945 ieee80211_if_fmt_dot11MeshConfirmTimeout 3 1945 NULL
114948 +update_qd_1955 update_qd 0 1955 NULL
114949 +ivtv_v4l2_read_1964 ivtv_v4l2_read 3 1964 NULL
114950 +sel_read_avc_hash_stats_1984 sel_read_avc_hash_stats 3 1984 NULL
114951 +gpio_power_write_1991 gpio_power_write 3 1991 NULL
114952 +__alloc_bootmem_node_1992 __alloc_bootmem_node 2 1992 NULL
114953 +rx_rx_defrag_read_2010 rx_rx_defrag_read 3 2010 NULL
114954 +xfs_mru_cache_insert_2013 xfs_mru_cache_insert 0 2013 NULL
114955 +ocfs2_global_qinit_alloc_2018 ocfs2_global_qinit_alloc 0 2018 NULL
114956 +write_flush_pipefs_2021 write_flush_pipefs 3 2021 NULL
114957 +BcmCopySection_2035 BcmCopySection 5 2035 NULL
114958 +ath6kl_fwlog_mask_read_2050 ath6kl_fwlog_mask_read 3 2050 NULL
114959 +ocfs2_expand_inline_dir_2063 ocfs2_expand_inline_dir 3 2063 NULL
114960 +__generic_copy_from_user_intel_2073 __generic_copy_from_user_intel 0-3 2073 NULL
114961 +diva_set_driver_dbg_mask_2077 diva_set_driver_dbg_mask 0 2077 NULL
114962 +iwl_dbgfs_current_sleep_command_read_2081 iwl_dbgfs_current_sleep_command_read 3 2081 NULL
114963 +idetape_chrdev_read_2097 idetape_chrdev_read 3 2097 NULL
114964 +audit_expand_2098 audit_expand 0 2098 NULL
114965 +__set_print_fmt_2106 __set_print_fmt 0 2106 NULL
114966 +iwl_dbgfs_log_event_read_2107 iwl_dbgfs_log_event_read 3 2107 NULL
114967 +ecryptfs_encrypt_and_encode_filename_2109 ecryptfs_encrypt_and_encode_filename 6 2109 NULL
114968 +btrfs_file_extent_inline_len_2116 btrfs_file_extent_inline_len 0 2116 NULL
114969 +enable_read_2117 enable_read 3 2117 NULL
114970 +pcf50633_write_block_2124 pcf50633_write_block 2-3 2124 NULL
114971 +xfs_recover_inode_owner_change_2132 xfs_recover_inode_owner_change 0 2132 NULL
114972 +check_load_and_stores_2143 check_load_and_stores 2 2143 NULL
114973 +iov_iter_count_2152 iov_iter_count 0 2152 NULL
114974 +__copy_to_user_ll_2157 __copy_to_user_ll 0-3 2157 NULL
114975 +_ore_get_io_state_2166 _ore_get_io_state 3-4-5 2166 NULL
114976 +bio_integrity_alloc_2194 bio_integrity_alloc 3 2194 NULL
114977 +picolcd_debug_reset_write_2195 picolcd_debug_reset_write 3 2195 NULL
114978 +xfs_inobt_update_2206 xfs_inobt_update 0 2206 NULL
114979 +u32_array_read_2219 u32_array_read 3 2219 NULL nohasharray
114980 +mei_dbgfs_read_meclients_2219 mei_dbgfs_read_meclients 3 2219 &u32_array_read_2219
114981 +__ocfs2_journal_access_2241 __ocfs2_journal_access 0 2241 NULL
114982 +ieee80211_if_read_dot11MeshHWMPRannInterval_2249 ieee80211_if_read_dot11MeshHWMPRannInterval 3 2249 NULL
114983 +netlbl_secattr_catmap_walk_2255 netlbl_secattr_catmap_walk 0-2 2255 NULL
114984 +sel_write_avc_cache_threshold_2256 sel_write_avc_cache_threshold 3 2256 NULL
114985 +do_update_counters_2259 do_update_counters 4 2259 NULL
114986 +ath6kl_wmi_bssinfo_event_rx_2275 ath6kl_wmi_bssinfo_event_rx 3 2275 NULL
114987 +debug_debug5_read_2291 debug_debug5_read 3 2291 NULL
114988 +sr_read_cmd_2299 sr_read_cmd 5 2299 NULL
114989 +kvm_clear_guest_page_2308 kvm_clear_guest_page 4 2308 NULL
114990 +intel_sdvo_set_value_2311 intel_sdvo_set_value 4 2311 NULL
114991 +hfsplus_find_init_2318 hfsplus_find_init 0 2318 NULL nohasharray
114992 +picolcd_fb_write_2318 picolcd_fb_write 3 2318 &hfsplus_find_init_2318
114993 +dice_hwdep_read_2326 dice_hwdep_read 3 2326 NULL
114994 +__erst_read_to_erange_2341 __erst_read_to_erange 0 2341 NULL
114995 +zr364xx_read_2354 zr364xx_read 3 2354 NULL
114996 +ntfs_file_aio_write_nolock_2360 ntfs_file_aio_write_nolock 0 2360 NULL
114997 +viafb_iga2_odev_proc_write_2363 viafb_iga2_odev_proc_write 3 2363 NULL
114998 +xfs_buf_map_from_irec_2368 xfs_buf_map_from_irec 5-0 2368 NULL nohasharray
114999 +rose_recvmsg_2368 rose_recvmsg 4 2368 &xfs_buf_map_from_irec_2368
115000 +il_dbgfs_sensitivity_read_2370 il_dbgfs_sensitivity_read 3 2370 NULL
115001 +rxpipe_rx_prep_beacon_drop_read_2403 rxpipe_rx_prep_beacon_drop_read 3 2403 NULL
115002 +isdn_v110_open_2418 isdn_v110_open 3 2418 NULL
115003 +raid1_size_2419 raid1_size 0-2 2419 NULL
115004 +b43legacy_debugfs_read_2473 b43legacy_debugfs_read 3 2473 NULL
115005 +wiphy_new_2482 wiphy_new 2 2482 NULL
115006 +bio_alloc_bioset_2484 bio_alloc_bioset 2 2484 NULL
115007 +squashfs_read_fragment_index_table_2506 squashfs_read_fragment_index_table 4 2506 NULL
115008 +v9fs_cached_file_read_2514 v9fs_cached_file_read 3 2514 NULL
115009 +ext4_get_inode_loc_2516 ext4_get_inode_loc 0 2516 NULL
115010 +batadv_tvlv_container_list_size_2524 batadv_tvlv_container_list_size 0 2524 NULL
115011 +smk_write_syslog_2529 smk_write_syslog 3 2529 NULL
115012 +__ceph_setxattr_2532 __ceph_setxattr 4 2532 NULL
115013 +gspca_dev_probe_2570 gspca_dev_probe 4 2570 NULL
115014 +pcm_sanity_check_2574 pcm_sanity_check 0 2574 NULL
115015 +mdc_max_rpcs_in_flight_seq_write_2594 mdc_max_rpcs_in_flight_seq_write 3 2594 NULL
115016 +slot_bytes_2609 slot_bytes 0 2609 NULL
115017 +smk_write_logging_2618 smk_write_logging 3 2618 NULL
115018 +switch_status_2629 switch_status 5 2629 NULL
115019 +tcp_xmit_size_goal_2661 tcp_xmit_size_goal 2 2661 NULL
115020 +osc_build_ppga_2670 osc_build_ppga 2 2670 NULL
115021 +ffs_ep0_read_2672 ffs_ep0_read 3 2672 NULL
115022 +oti6858_write_2692 oti6858_write 4 2692 NULL
115023 +nfc_llcp_send_ui_frame_2702 nfc_llcp_send_ui_frame 5 2702 NULL
115024 +memcpy_fromiovecend_2707 memcpy_fromiovecend 3-4 2707 NULL
115025 +lprocfs_stats_counter_size_2708 lprocfs_stats_counter_size 0 2708 NULL
115026 +gfs2_glock_nq_num_2747 gfs2_glock_nq_num 0 2747 NULL
115027 +xfs_readdir_2767 xfs_readdir 3 2767 NULL
115028 +mon_bin_ioctl_2771 mon_bin_ioctl 3 2771 NULL
115029 +set_msr_hyperv_pw_2785 set_msr_hyperv_pw 3 2785 NULL
115030 +device_add_attrs_2789 device_add_attrs 0 2789 NULL
115031 +iwl_dbgfs_clear_ucode_statistics_write_2804 iwl_dbgfs_clear_ucode_statistics_write 3 2804 NULL
115032 +sel_read_enforce_2828 sel_read_enforce 3 2828 NULL
115033 +vb2_dc_get_userptr_2829 vb2_dc_get_userptr 2-3 2829 NULL
115034 +wait_for_avail_2847 wait_for_avail 0 2847 NULL
115035 +sfq_alloc_2861 sfq_alloc 1 2861 NULL
115036 +irnet_ctrl_read_2863 irnet_ctrl_read 4 2863 NULL
115037 +move_addr_to_user_2868 move_addr_to_user 2 2868 NULL
115038 +nla_padlen_2883 nla_padlen 1 2883 NULL
115039 +cmm_write_2896 cmm_write 3 2896 NULL
115040 +osc_import_seq_write_2923 osc_import_seq_write 3 2923 NULL
115041 +xfs_trans_get_buf_map_2927 xfs_trans_get_buf_map 4 2927 NULL
115042 +nes_read_indexed_2946 nes_read_indexed 0 2946 NULL
115043 +tm6000_i2c_recv_regs16_2949 tm6000_i2c_recv_regs16 5 2949 NULL
115044 +i40e_dbg_prep_dump_buf_2951 i40e_dbg_prep_dump_buf 2 2951 NULL
115045 +set_fast_connectable_2952 set_fast_connectable 4 2952 NULL
115046 +free_area_init_core_2962 free_area_init_core 2-3 2962 NULL
115047 +bio_setup_sector_2970 bio_setup_sector 3 2970 NULL
115048 +do_strnlen_user_2976 do_strnlen_user 0-2 2976 NULL
115049 +p9_nr_pages_2992 p9_nr_pages 0-2 2992 NULL
115050 +_xfs_filestream_pick_ag_3007 _xfs_filestream_pick_ag 0 3007 NULL
115051 +lov_stripetype_seq_write_3013 lov_stripetype_seq_write 3 3013 NULL
115052 +do_dmabuf_dirty_sou_3017 do_dmabuf_dirty_sou 7 3017 NULL
115053 +depth_write_3021 depth_write 3 3021 NULL
115054 +snd_azf3328_codec_inl_3022 snd_azf3328_codec_inl 0 3022 NULL
115055 +nvme_split_and_submit_3027 nvme_split_and_submit 3 3027 NULL
115056 +kvm_unmap_hva_3028 kvm_unmap_hva 2 3028 NULL
115057 +xfrm_dst_alloc_copy_3034 xfrm_dst_alloc_copy 3 3034 NULL
115058 +lpfc_idiag_mbxacc_write_3038 lpfc_idiag_mbxacc_write 3 3038 NULL nohasharray
115059 +iwl_dbgfs_sleep_level_override_read_3038 iwl_dbgfs_sleep_level_override_read 3 3038 &lpfc_idiag_mbxacc_write_3038
115060 +nr_free_buffer_pages_3044 nr_free_buffer_pages 0 3044 NULL
115061 +il3945_ucode_rx_stats_read_3048 il3945_ucode_rx_stats_read 3 3048 NULL
115062 +qp_alloc_ppn_set_3068 qp_alloc_ppn_set 2-4 3068 NULL
115063 +__blk_end_bidi_request_3070 __blk_end_bidi_request 3-4 3070 NULL
115064 +dac960_user_command_proc_write_3071 dac960_user_command_proc_write 3 3071 NULL
115065 +read_file_antenna_diversity_3077 read_file_antenna_diversity 3 3077 NULL
115066 +ttusb2_msg_3100 ttusb2_msg 4 3100 NULL
115067 +rb_alloc_3102 rb_alloc 1 3102 NULL
115068 +simple_write_to_buffer_3122 simple_write_to_buffer 5-2 3122 NULL
115069 +print_time_3132 print_time 0 3132 NULL
115070 +fill_write_buffer_3142 fill_write_buffer 3 3142 NULL
115071 +CIFSSMBSetPosixACL_3154 CIFSSMBSetPosixACL 5 3154 NULL
115072 +compat_sys_migrate_pages_3157 compat_sys_migrate_pages 2 3157 NULL
115073 +gfs2_rindex_update_3165 gfs2_rindex_update 0 3165 NULL
115074 +uv_num_possible_blades_3177 uv_num_possible_blades 0 3177 NULL
115075 +uvc_video_stats_dump_3181 uvc_video_stats_dump 3 3181 NULL
115076 +compat_do_ip6t_set_ctl_3184 compat_do_ip6t_set_ctl 4 3184 NULL
115077 +mempool_create_node_3191 mempool_create_node 1 3191 NULL
115078 +alloc_context_3194 alloc_context 1 3194 NULL
115079 +shmem_pread_slow_3198 shmem_pread_slow 3-2 3198 NULL
115080 +codec_reg_write_file_3204 codec_reg_write_file 3 3204 NULL
115081 +SyS_sendto_3219 SyS_sendto 6 3219 NULL
115082 +btrfs_prealloc_file_range_3227 btrfs_prealloc_file_range 3 3227 NULL
115083 +kimage_crash_alloc_3233 kimage_crash_alloc 3 3233 NULL
115084 +write_adapter_mem_3234 write_adapter_mem 3 3234 NULL
115085 +do_read_log_to_user_3236 do_read_log_to_user 4 3236 NULL
115086 +ext3_xattr_find_entry_3237 ext3_xattr_find_entry 0 3237 NULL
115087 +key_key_read_3241 key_key_read 3 3241 NULL
115088 +__ilog2_u64_3284 __ilog2_u64 0 3284 NULL
115089 +__set_extent_bit_3305 __set_extent_bit 0 3305 NULL
115090 +__iovec_copy_from_user_inatomic_3314 __iovec_copy_from_user_inatomic 0-4-3 3314 NULL
115091 +_iwl_dbgfs_d3_sram_write_3315 _iwl_dbgfs_d3_sram_write 3 3315 NULL
115092 +dbDiscardAG_3322 dbDiscardAG 3 3322 NULL
115093 +compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
115094 +read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
115095 +sysfs_create_group_3339 sysfs_create_group 0 3339 NULL
115096 +tty_port_register_device_attr_3341 tty_port_register_device_attr 3 3341 NULL
115097 +il_dbgfs_interrupt_read_3351 il_dbgfs_interrupt_read 3 3351 NULL
115098 +gsm_control_rls_3353 gsm_control_rls 3 3353 NULL
115099 +scnprintf_3360 scnprintf 0-2 3360 NULL
115100 +ReadByteAmd7930_3365 ReadByteAmd7930 0 3365 NULL
115101 +sr_read_3366 sr_read 3 3366 NULL
115102 +mtdchar_writeoob_3393 mtdchar_writeoob 4 3393 NULL
115103 +send_stream_3397 send_stream 4 3397 NULL
115104 +isdn_readbchan_3401 isdn_readbchan 0-5 3401 NULL
115105 +mei_io_cb_alloc_resp_buf_3414 mei_io_cb_alloc_resp_buf 2 3414 NULL
115106 +pci_add_cap_save_buffer_3426 pci_add_cap_save_buffer 3 3426 NULL
115107 +crystalhd_create_dio_pool_3427 crystalhd_create_dio_pool 2 3427 NULL
115108 +SyS_msgsnd_3436 SyS_msgsnd 3 3436 NULL
115109 +pipe_iov_copy_to_user_3447 pipe_iov_copy_to_user 3 3447 NULL
115110 +softsynth_write_3455 softsynth_write 3 3455 NULL
115111 +snd_pcm_lib_readv_transfer_3464 snd_pcm_lib_readv_transfer 5-4-2 3464 NULL
115112 +security_context_to_sid_default_3492 security_context_to_sid_default 2 3492 NULL
115113 +xfrm_migrate_msgsize_3496 xfrm_migrate_msgsize 1 3496 NULL
115114 +mem_tx_free_mem_blks_read_3521 mem_tx_free_mem_blks_read 3 3521 NULL
115115 +SyS_semtimedop_3532 SyS_semtimedop 3 3532 NULL
115116 +SyS_readv_3539 SyS_readv 3 3539 NULL
115117 +btrfs_dir_name_len_3549 btrfs_dir_name_len 0 3549 NULL
115118 +alloc_smp_resp_3566 alloc_smp_resp 1 3566 NULL
115119 +evtchn_read_3569 evtchn_read 3 3569 NULL
115120 +ll_track_ppid_seq_write_3582 ll_track_ppid_seq_write 3 3582 NULL
115121 +vc_resize_3585 vc_resize 3-2 3585 NULL
115122 +kvm_mmu_notifier_change_pte_3596 kvm_mmu_notifier_change_pte 3 3596 NULL
115123 +sctp_getsockopt_events_3607 sctp_getsockopt_events 2 3607 NULL
115124 +edac_mc_alloc_3611 edac_mc_alloc 4 3611 NULL
115125 +tx_tx_starts_read_3617 tx_tx_starts_read 3 3617 NULL
115126 +aligned_kmalloc_3628 aligned_kmalloc 1 3628 NULL
115127 +ath6kl_disconnect_timeout_read_3650 ath6kl_disconnect_timeout_read 3 3650 NULL
115128 +i915_compat_ioctl_3656 i915_compat_ioctl 2 3656 NULL
115129 +xfs_attr3_leaf_list_int_3661 xfs_attr3_leaf_list_int 0 3661 NULL
115130 +_iwl_dbgfs_tx_flush_write_3675 _iwl_dbgfs_tx_flush_write 3 3675 NULL
115131 +snd_m3_assp_read_3703 snd_m3_assp_read 0 3703 NULL
115132 +ci_ll_write_3740 ci_ll_write 4 3740 NULL
115133 +sctp_setsockopt_auth_key_3793 sctp_setsockopt_auth_key 3 3793 NULL
115134 +ncp_file_write_3813 ncp_file_write 3 3813 NULL
115135 +llc_ui_recvmsg_3826 llc_ui_recvmsg 4 3826 NULL
115136 +hfsplus_direct_IO_3835 hfsplus_direct_IO 4 3835 NULL
115137 +create_one_cdev_3852 create_one_cdev 2 3852 NULL
115138 +smk_read_onlycap_3855 smk_read_onlycap 3 3855 NULL
115139 +get_fd_set_3866 get_fd_set 1 3866 NULL
115140 +apei_res_sub_3873 apei_res_sub 0 3873 NULL
115141 +garp_attr_create_3883 garp_attr_create 3 3883 NULL
115142 +efivarfs_file_read_3893 efivarfs_file_read 3 3893 NULL
115143 +nvram_write_3894 nvram_write 3 3894 NULL
115144 +pipeline_pre_proc_swi_read_3898 pipeline_pre_proc_swi_read 3 3898 NULL
115145 +comedi_buf_read_n_available_3899 comedi_buf_read_n_available 0 3899 NULL
115146 +vcs_write_3910 vcs_write 3 3910 NULL
115147 +SyS_move_pages_3920 SyS_move_pages 2 3920 NULL
115148 +hdlc_irq_one_3944 hdlc_irq_one 2 3944 NULL
115149 +brcmf_debugfs_fws_stats_read_3947 brcmf_debugfs_fws_stats_read 3 3947 NULL
115150 +mite_bytes_written_to_memory_lb_3987 mite_bytes_written_to_memory_lb 0 3987 NULL
115151 +do_add_counters_3992 do_add_counters 3 3992 NULL
115152 +xfs_bmbt_lookup_eq_3997 xfs_bmbt_lookup_eq 0 3997 NULL
115153 +obd_alloc_memmd_4002 obd_alloc_memmd 0 4002 NULL
115154 +userspace_status_4004 userspace_status 4 4004 NULL
115155 +xfs_check_block_4005 xfs_check_block 4 4005 NULL nohasharray
115156 +mei_write_4005 mei_write 3 4005 &xfs_check_block_4005
115157 +snd_hdsp_capture_copy_4011 snd_hdsp_capture_copy 5 4011 NULL
115158 +blk_end_request_4024 blk_end_request 3 4024 NULL
115159 +ext4_xattr_find_entry_4025 ext4_xattr_find_entry 0 4025 NULL
115160 +xfs_free_ag_extent_4036 xfs_free_ag_extent 0 4036 NULL
115161 +mtip_hw_read_registers_4037 mtip_hw_read_registers 3 4037 NULL
115162 +read_file_queues_4078 read_file_queues 3 4078 NULL
115163 +fbcon_do_set_font_4079 fbcon_do_set_font 2-3 4079 NULL
115164 +tm6000_read_4151 tm6000_read 3 4151 NULL
115165 +mpt_raid_phys_disk_get_num_paths_4155 mpt_raid_phys_disk_get_num_paths 0 4155 NULL
115166 +msg_bits_4158 msg_bits 0-3-4 4158 NULL
115167 +get_alua_req_4166 get_alua_req 3 4166 NULL
115168 +blk_dropped_read_4168 blk_dropped_read 3 4168 NULL
115169 +read_file_bool_4180 read_file_bool 3 4180 NULL
115170 +ocfs2_find_cpos_for_right_leaf_4194 ocfs2_find_cpos_for_right_leaf 0 4194 NULL
115171 +vring_new_virtqueue_4199 vring_new_virtqueue 2 4199 NULL
115172 +f1x_determine_channel_4202 f1x_determine_channel 2 4202 NULL
115173 +_osd_req_list_objects_4204 _osd_req_list_objects 6 4204 NULL
115174 +__snd_gf1_read_addr_4210 __snd_gf1_read_addr 0 4210 NULL
115175 +ath6kl_force_roam_write_4282 ath6kl_force_roam_write 3 4282 NULL
115176 +goldfish_audio_write_4284 goldfish_audio_write 3 4284 NULL
115177 +__usbnet_read_cmd_4299 __usbnet_read_cmd 7 4299 NULL
115178 +dvb_ringbuffer_pkt_read_user_4303 dvb_ringbuffer_pkt_read_user 2-3-5 4303 NULL
115179 +count_strings_4315 count_strings 0 4315 NULL
115180 +nouveau_fifo_create__4327 nouveau_fifo_create_ 5-6 4327 NULL
115181 +snd_rawmidi_kernel_read_4328 snd_rawmidi_kernel_read 3 4328 NULL
115182 +ima_eventdigest_init_common_4338 ima_eventdigest_init_common 2 4338 NULL
115183 +__copy_from_user_inatomic_4365 __copy_from_user_inatomic 0-3 4365 NULL nohasharray
115184 +lookup_string_4365 lookup_string 0 4365 &__copy_from_user_inatomic_4365
115185 +irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
115186 +access_process_vm_4412 access_process_vm 0 4412 NULL nohasharray
115187 +cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 &access_process_vm_4412
115188 +libfc_vport_create_4415 libfc_vport_create 2 4415 NULL
115189 +rtw_android_get_rssi_4421 rtw_android_get_rssi 0 4421 NULL
115190 +do_pages_stat_4437 do_pages_stat 2 4437 NULL
115191 +at76_set_card_command_4471 at76_set_card_command 4 4471 NULL
115192 +snd_seq_expand_var_event_4481 snd_seq_expand_var_event 5-0 4481 NULL
115193 +vmbus_establish_gpadl_4495 vmbus_establish_gpadl 3 4495 NULL
115194 +set_link_security_4502 set_link_security 4 4502 NULL
115195 +xfs_btree_kill_root_4526 xfs_btree_kill_root 0 4526 NULL
115196 +ll_max_readahead_per_file_mb_seq_write_4531 ll_max_readahead_per_file_mb_seq_write 3 4531 NULL
115197 +tty_register_device_4544 tty_register_device 2 4544 NULL
115198 +btrfs_file_extent_inline_item_len_4575 btrfs_file_extent_inline_item_len 0 4575 NULL
115199 +xfs_buf_get_maps_4581 xfs_buf_get_maps 2 4581 NULL
115200 +bch_alloc_4593 bch_alloc 1 4593 NULL
115201 +ocfs2_refcount_lock_4595 ocfs2_refcount_lock 0 4595 NULL
115202 +ll_rw_extents_stats_seq_write_4633 ll_rw_extents_stats_seq_write 3 4633 NULL
115203 +iwl_dbgfs_tx_queue_read_4635 iwl_dbgfs_tx_queue_read 3 4635 NULL
115204 +skb_add_data_nocache_4682 skb_add_data_nocache 4 4682 NULL
115205 +cx18_read_pos_4683 cx18_read_pos 3 4683 NULL
115206 +short_retry_limit_read_4687 short_retry_limit_read 3 4687 NULL
115207 +kone_receive_4690 kone_receive 4 4690 NULL
115208 +hash_netportnet6_expire_4702 hash_netportnet6_expire 4 4702 NULL
115209 +cxgbi_alloc_big_mem_4707 cxgbi_alloc_big_mem 1 4707 NULL
115210 +ati_create_gatt_pages_4722 ati_create_gatt_pages 1 4722 NULL nohasharray
115211 +show_header_4722 show_header 3 4722 &ati_create_gatt_pages_4722
115212 +bitmap_startwrite_4736 bitmap_startwrite 2 4736 NULL nohasharray
115213 +ll_rw_offset_stats_seq_write_4736 ll_rw_offset_stats_seq_write 3 4736 &bitmap_startwrite_4736
115214 +lu_buf_alloc_4753 lu_buf_alloc 2 4753 NULL
115215 +pwr_rcvd_bcns_cnt_read_4774 pwr_rcvd_bcns_cnt_read 3 4774 NULL
115216 +create_subvol_4791 create_subvol 4 4791 NULL
115217 +ncp__vol2io_4804 ncp__vol2io 5 4804 NULL
115218 +repair_io_failure_4815 repair_io_failure 4-3 4815 NULL
115219 +comedi_buf_write_free_4847 comedi_buf_write_free 2 4847 NULL
115220 +gigaset_if_receive_4861 gigaset_if_receive 3 4861 NULL
115221 +key_tx_spec_read_4862 key_tx_spec_read 3 4862 NULL
115222 +ocfs2_defrag_extent_4873 ocfs2_defrag_extent 2 4873 NULL
115223 +hid_register_field_4874 hid_register_field 2-3 4874 NULL
115224 +vga_arb_read_4886 vga_arb_read 3 4886 NULL
115225 +ieee80211_if_fmt_ave_beacon_4941 ieee80211_if_fmt_ave_beacon 3 4941 NULL
115226 +ocfs2_should_refresh_lock_res_4958 ocfs2_should_refresh_lock_res 0 4958 NULL
115227 +compat_rawv6_setsockopt_4967 compat_rawv6_setsockopt 5 4967 NULL
115228 +ath10k_read_chip_id_4969 ath10k_read_chip_id 3 4969 NULL
115229 +skb_network_header_len_4971 skb_network_header_len 0 4971 NULL
115230 +ieee80211_if_fmt_dot11MeshHWMPconfirmationInterval_4976 ieee80211_if_fmt_dot11MeshHWMPconfirmationInterval 3 4976 NULL
115231 +compat_SyS_ipc_5000 compat_SyS_ipc 3 5000 NULL
115232 +do_mincore_5018 do_mincore 0-2-1 5018 NULL
115233 +btrfs_punch_hole_5041 btrfs_punch_hole 2 5041 NULL
115234 +cfg80211_rx_mgmt_5056 cfg80211_rx_mgmt 5 5056 NULL
115235 +ocfs2_check_range_for_holes_5066 ocfs2_check_range_for_holes 3-2 5066 NULL
115236 +snd_mixart_BA1_read_5082 snd_mixart_BA1_read 5 5082 NULL
115237 +snd_emu10k1_ptr20_read_5087 snd_emu10k1_ptr20_read 0 5087 NULL
115238 +kfifo_copy_from_user_5091 kfifo_copy_from_user 3-4-0 5091 NULL nohasharray
115239 +get_random_bytes_5091 get_random_bytes 2 5091 &kfifo_copy_from_user_5091 nohasharray
115240 +blk_rq_sectors_5091 blk_rq_sectors 0 5091 &get_random_bytes_5091
115241 +sound_write_5102 sound_write 3 5102 NULL
115242 +i40e_dbg_netdev_ops_write_5117 i40e_dbg_netdev_ops_write 3 5117 NULL
115243 +qib_7220_handle_hwerrors_5142 qib_7220_handle_hwerrors 3 5142 NULL
115244 +__uwb_addr_print_5161 __uwb_addr_print 2 5161 NULL
115245 +iwl_dbgfs_status_read_5171 iwl_dbgfs_status_read 3 5171 NULL
115246 +acpi_pcc_get_sqty_5176 acpi_pcc_get_sqty 0 5176 NULL
115247 +ppp_cp_parse_cr_5214 ppp_cp_parse_cr 4 5214 NULL
115248 +dwc2_hcd_urb_alloc_5217 dwc2_hcd_urb_alloc 2 5217 NULL
115249 +ath6kl_debug_roam_tbl_event_5224 ath6kl_debug_roam_tbl_event 3 5224 NULL
115250 +usb_descriptor_fillbuf_5302 usb_descriptor_fillbuf 0 5302 NULL
115251 +r592_write_fifo_pio_5315 r592_write_fifo_pio 3 5315 NULL
115252 +sbc_get_write_same_sectors_5317 sbc_get_write_same_sectors 0 5317 NULL
115253 +pwr_elp_enter_read_5324 pwr_elp_enter_read 3 5324 NULL
115254 +cq_free_res_5355 cq_free_res 5 5355 NULL
115255 +ps_pspoll_utilization_read_5361 ps_pspoll_utilization_read 3 5361 NULL
115256 +cciss_allocate_sg_chain_blocks_5368 cciss_allocate_sg_chain_blocks 3-2 5368 NULL
115257 +xfs_free_extent_5411 xfs_free_extent 0 5411 NULL
115258 +xfs_efd_init_5463 xfs_efd_init 3 5463 NULL
115259 +ll_xattr_cache_refill_5468 ll_xattr_cache_refill 0 5468 NULL
115260 +kernfs_fop_write_5471 kernfs_fop_write 3 5471 NULL
115261 +xfs_efi_init_5476 xfs_efi_init 2 5476 NULL
115262 +cifs_security_flags_proc_write_5484 cifs_security_flags_proc_write 3 5484 NULL
115263 +tty_write_5494 tty_write 3 5494 NULL
115264 +tomoyo_update_domain_5498 tomoyo_update_domain 2 5498 NULL nohasharray
115265 +ieee80211_if_fmt_last_beacon_5498 ieee80211_if_fmt_last_beacon 3 5498 &tomoyo_update_domain_5498
115266 +__max_nr_grant_frames_5505 __max_nr_grant_frames 0 5505 NULL
115267 +ieee80211_if_fmt_auto_open_plinks_5534 ieee80211_if_fmt_auto_open_plinks 3 5534 NULL
115268 +get_entry_msg_len_5552 get_entry_msg_len 0 5552 NULL
115269 +le_readq_5557 le_readq 0 5557 NULL
115270 +inw_5558 inw 0 5558 NULL
115271 +gfs2_extent_map_5561 gfs2_extent_map 0 5561 NULL
115272 +bioset_create_5580 bioset_create 1 5580 NULL
115273 +oz_ep_alloc_5587 oz_ep_alloc 1 5587 NULL
115274 +__remove_suid_5618 __remove_suid 0 5618 NULL
115275 +gfs2_unstuffer_page_5620 gfs2_unstuffer_page 0 5620 NULL
115276 +SYSC_fsetxattr_5639 SYSC_fsetxattr 4 5639 NULL
115277 +ext4_xattr_get_5661 ext4_xattr_get 0 5661 NULL
115278 +posix_clock_register_5662 posix_clock_register 2 5662 NULL
115279 +get_arg_5694 get_arg 3 5694 NULL
115280 +subbuf_read_actor_5708 subbuf_read_actor 3 5708 NULL
115281 +vmw_kms_readback_5727 vmw_kms_readback 6 5727 NULL
115282 +rts51x_transfer_data_partial_5735 rts51x_transfer_data_partial 6 5735 NULL
115283 +sctp_setsockopt_autoclose_5775 sctp_setsockopt_autoclose 3 5775 NULL
115284 +__vxge_hw_blockpool_malloc_5786 __vxge_hw_blockpool_malloc 2 5786 NULL
115285 +nvme_trans_bdev_char_page_5797 nvme_trans_bdev_char_page 3 5797 NULL
115286 +skb_copy_datagram_iovec_5806 skb_copy_datagram_iovec 2-4 5806 NULL
115287 +nv50_disp_pioc_create__5812 nv50_disp_pioc_create_ 5 5812 NULL
115288 +ceph_x_encrypt_buflen_5829 ceph_x_encrypt_buflen 0-1 5829 NULL
115289 +ceph_msg_new_5846 ceph_msg_new 2 5846 NULL
115290 +setup_req_5848 setup_req 3 5848 NULL
115291 +ria_page_count_5849 ria_page_count 0 5849 NULL
115292 +rx_filter_max_arp_queue_dep_read_5851 rx_filter_max_arp_queue_dep_read 3 5851 NULL
115293 +config_buf_5862 config_buf 0 5862 NULL
115294 +lprocfs_fid_width_seq_write_5889 lprocfs_fid_width_seq_write 3 5889 NULL
115295 +port_show_regs_5904 port_show_regs 3 5904 NULL
115296 +rbd_segment_length_5907 rbd_segment_length 0-3-2 5907 NULL
115297 +uhci_debug_read_5911 uhci_debug_read 3 5911 NULL
115298 +lbs_highsnr_read_5931 lbs_highsnr_read 3 5931 NULL
115299 +ps_poll_ps_poll_timeouts_read_5934 ps_poll_ps_poll_timeouts_read 3 5934 NULL
115300 +edac_device_alloc_ctl_info_5941 edac_device_alloc_ctl_info 1 5941 NULL
115301 +ll_statahead_one_5962 ll_statahead_one 3 5962 NULL
115302 +__apu_get_register_5967 __apu_get_register 0 5967 NULL
115303 +ieee80211_if_fmt_rc_rateidx_mask_5ghz_5971 ieee80211_if_fmt_rc_rateidx_mask_5ghz 3 5971 NULL
115304 +alloc_msg_6072 alloc_msg 1 6072 NULL
115305 +sctp_setsockopt_connectx_6073 sctp_setsockopt_connectx 3 6073 NULL
115306 +rts51x_ms_rw_multi_sector_6076 rts51x_ms_rw_multi_sector 3-4 6076 NULL
115307 +__mnt_want_write_6091 __mnt_want_write 0 6091 NULL
115308 +ipmi_addr_length_6110 ipmi_addr_length 0 6110 NULL
115309 +dfs_global_file_write_6112 dfs_global_file_write 3 6112 NULL
115310 +nouveau_parent_create__6131 nouveau_parent_create_ 7 6131 NULL
115311 +ieee80211_if_fmt_beacon_timeout_6153 ieee80211_if_fmt_beacon_timeout 3 6153 NULL
115312 +ivtv_copy_buf_to_user_6159 ivtv_copy_buf_to_user 4 6159 NULL
115313 +maybe_insert_hole_6167 maybe_insert_hole 3 6167 NULL
115314 +wl1251_cmd_template_set_6172 wl1251_cmd_template_set 4 6172 NULL
115315 +SyS_setgroups_6182 SyS_setgroups 1 6182 NULL
115316 +mxt_show_instance_6207 mxt_show_instance 2-0 6207 NULL
115317 +v4l2_ctrl_new_std_menu_6221 v4l2_ctrl_new_std_menu 4 6221 NULL
115318 +mqueue_read_file_6228 mqueue_read_file 3 6228 NULL
115319 +f_hidg_read_6238 f_hidg_read 3 6238 NULL
115320 +fbcon_prepare_logo_6246 fbcon_prepare_logo 5 6246 NULL
115321 +tx_tx_start_null_frame_read_6281 tx_tx_start_null_frame_read 3 6281 NULL
115322 +snd_hda_override_conn_list_6282 snd_hda_override_conn_list 3-0 6282 NULL nohasharray
115323 +xenbus_file_write_6282 xenbus_file_write 3 6282 &snd_hda_override_conn_list_6282
115324 +posix_acl_fix_xattr_to_user_6283 posix_acl_fix_xattr_to_user 2 6283 NULL
115325 +serial_port_in_6291 serial_port_in 0 6291 NULL
115326 +qlcnic_sriov_alloc_bc_msg_6309 qlcnic_sriov_alloc_bc_msg 2 6309 NULL
115327 +hfa384x_inw_6329 hfa384x_inw 0 6329 NULL nohasharray
115328 +SyS_mincore_6329 SyS_mincore 2-1 6329 &hfa384x_inw_6329
115329 +fuse_get_req_for_background_6337 fuse_get_req_for_background 2 6337 NULL
115330 +ucs2_strnlen_6342 ucs2_strnlen 0 6342 NULL
115331 +regcache_sync_block_raw_6350 regcache_sync_block_raw 5-4 6350 NULL
115332 +mei_dbgfs_read_devstate_6352 mei_dbgfs_read_devstate 3 6352 NULL
115333 +_proc_do_string_6376 _proc_do_string 2 6376 NULL
115334 +osd_req_read_sg_kern_6378 osd_req_read_sg_kern 5 6378 NULL
115335 +xfs_bmap_extents_to_btree_6387 xfs_bmap_extents_to_btree 0 6387 NULL
115336 +posix_acl_fix_xattr_userns_6420 posix_acl_fix_xattr_userns 4 6420 NULL
115337 +add_transaction_credits_6422 add_transaction_credits 2-3 6422 NULL
115338 +ipr_change_queue_depth_6431 ipr_change_queue_depth 2 6431 NULL
115339 +__alloc_bootmem_node_nopanic_6432 __alloc_bootmem_node_nopanic 2 6432 NULL
115340 +ieee80211_if_fmt_dot11MeshMaxRetries_6476 ieee80211_if_fmt_dot11MeshMaxRetries 3 6476 NULL
115341 +qp_memcpy_from_queue_6479 qp_memcpy_from_queue 5-4 6479 NULL
115342 +cipso_v4_map_lvl_hton_6490 cipso_v4_map_lvl_hton 0 6490 NULL
115343 +dbg_intr_buf_6501 dbg_intr_buf 2 6501 NULL
115344 +mei_read_6507 mei_read 3 6507 NULL
115345 +rndis_set_oid_6547 rndis_set_oid 4 6547 NULL
115346 +wdm_read_6549 wdm_read 3 6549 NULL
115347 +dm_stats_create_6551 dm_stats_create 4-2-3 6551 NULL
115348 +fb_alloc_cmap_6554 fb_alloc_cmap 2 6554 NULL
115349 +SyS_semtimedop_6563 SyS_semtimedop 3 6563 NULL
115350 +xfs_iozero_6573 xfs_iozero 0 6573 NULL
115351 +ecryptfs_filldir_6622 ecryptfs_filldir 3 6622 NULL
115352 +process_rcvd_data_6679 process_rcvd_data 3 6679 NULL
115353 +btrfs_lookup_csums_range_6696 btrfs_lookup_csums_range 2-3 6696 NULL
115354 +ps_pspoll_max_apturn_read_6699 ps_pspoll_max_apturn_read 3 6699 NULL
115355 +bnad_debugfs_write_regrd_6706 bnad_debugfs_write_regrd 3 6706 NULL
115356 +mpeg_read_6708 mpeg_read 3 6708 NULL
115357 +ibmpex_query_sensor_count_6709 ibmpex_query_sensor_count 0 6709 NULL
115358 +video_proc_write_6724 video_proc_write 3 6724 NULL
115359 +posix_acl_xattr_count_6725 posix_acl_xattr_count 0-1 6725 NULL
115360 +kobject_add_varg_6781 kobject_add_varg 0 6781 NULL
115361 +iwl_dbgfs_channels_read_6784 iwl_dbgfs_channels_read 3 6784 NULL
115362 +ieee80211_if_read_6785 ieee80211_if_read 3 6785 NULL
115363 +zone_spanned_pages_in_node_6787 zone_spanned_pages_in_node 0-3-4 6787 NULL
115364 +hdlcdrv_register_6792 hdlcdrv_register 2 6792 NULL
115365 +ll_xattr_cache_find_6798 ll_xattr_cache_find 0 6798 NULL
115366 +tx_tx_done_data_read_6799 tx_tx_done_data_read 3 6799 NULL
115367 +lbs_rdrf_write_6826 lbs_rdrf_write 3 6826 NULL
115368 +calc_pages_for_6838 calc_pages_for 0-1-2 6838 NULL
115369 +mon_bin_read_6841 mon_bin_read 3 6841 NULL
115370 +snd_cs4281_BA0_read_6847 snd_cs4281_BA0_read 5 6847 NULL
115371 +xfs_rtany_summary_6851 xfs_rtany_summary 0 6851 NULL
115372 +perf_output_sample_ustack_6868 perf_output_sample_ustack 2 6868 NULL
115373 +dio_complete_6879 dio_complete 0-2-3 6879 NULL
115374 +raw_seticmpfilter_6888 raw_seticmpfilter 3 6888 NULL nohasharray
115375 +ieee80211_if_fmt_path_refresh_time_6888 ieee80211_if_fmt_path_refresh_time 3 6888 &raw_seticmpfilter_6888
115376 +dlmfs_file_write_6892 dlmfs_file_write 3 6892 NULL
115377 +proc_sessionid_read_6911 proc_sessionid_read 3 6911 NULL nohasharray
115378 +spi_show_regs_6911 spi_show_regs 3 6911 &proc_sessionid_read_6911 nohasharray
115379 +acm_alloc_minor_6911 acm_alloc_minor 0 6911 &spi_show_regs_6911
115380 +__kfifo_dma_in_finish_r_6913 __kfifo_dma_in_finish_r 2-3 6913 NULL
115381 +lops_scan_elements_6916 lops_scan_elements 0 6916 NULL
115382 +cache_do_downcall_6926 cache_do_downcall 3 6926 NULL
115383 +ipath_verbs_send_dma_6929 ipath_verbs_send_dma 6 6929 NULL
115384 +qsfp_cks_6945 qsfp_cks 2-0 6945 NULL
115385 +tg3_nvram_write_block_unbuffered_6955 tg3_nvram_write_block_unbuffered 3 6955 NULL
115386 +pch_uart_hal_read_6961 pch_uart_hal_read 0 6961 NULL
115387 +rsa_extract_mpi_6973 rsa_extract_mpi 5 6973 NULL nohasharray
115388 +i40e_dbg_dump_write_6973 i40e_dbg_dump_write 3 6973 &rsa_extract_mpi_6973
115389 +request_key_async_6990 request_key_async 4 6990 NULL
115390 +tpl_write_6998 tpl_write 3 6998 NULL
115391 +r871x_set_wpa_ie_7000 r871x_set_wpa_ie 3 7000 NULL
115392 +cipso_v4_gentag_enum_7006 cipso_v4_gentag_enum 0 7006 NULL
115393 +tracing_cpumask_read_7010 tracing_cpumask_read 3 7010 NULL
115394 +ld_usb_write_7022 ld_usb_write 3 7022 NULL
115395 +wimax_msg_7030 wimax_msg 4 7030 NULL
115396 +ceph_kvmalloc_7033 ceph_kvmalloc 1 7033 NULL
115397 +ipath_get_base_info_7043 ipath_get_base_info 3 7043 NULL
115398 +snd_pcm_oss_bytes_7051 snd_pcm_oss_bytes 2 7051 NULL
115399 +hci_sock_recvmsg_7072 hci_sock_recvmsg 4 7072 NULL
115400 +event_enable_read_7074 event_enable_read 3 7074 NULL
115401 +beacon_interval_read_7091 beacon_interval_read 3 7091 NULL
115402 +pipeline_enc_rx_stat_fifo_int_read_7107 pipeline_enc_rx_stat_fifo_int_read 3 7107 NULL
115403 +osc_resend_count_seq_write_7120 osc_resend_count_seq_write 3 7120 NULL
115404 +qib_format_hwerrors_7133 qib_format_hwerrors 5 7133 NULL
115405 +kvm_mmu_notifier_test_young_7139 kvm_mmu_notifier_test_young 3 7139 NULL
115406 +__alloc_objio_seg_7203 __alloc_objio_seg 1 7203 NULL
115407 +hdlc_loop_7255 hdlc_loop 0 7255 NULL
115408 +f_midi_start_ep_7270 f_midi_start_ep 0 7270 NULL
115409 +rx_rate_rx_frames_per_rates_read_7282 rx_rate_rx_frames_per_rates_read 3 7282 NULL
115410 +get_string_7302 get_string 0 7302 NULL
115411 +security_inode_need_killpriv_7322 security_inode_need_killpriv 0 7322 NULL
115412 +pci_vpd_info_field_size_7324 pci_vpd_info_field_size 0 7324 NULL
115413 +mgmt_control_7349 mgmt_control 3 7349 NULL
115414 +at_est2timeout_7365 at_est2timeout 0-1 7365 NULL
115415 +ieee80211_if_read_dot11MeshHWMPactivePathTimeout_7368 ieee80211_if_read_dot11MeshHWMPactivePathTimeout 3 7368 NULL
115416 +xfs_btree_delete_7384 xfs_btree_delete 0 7384 NULL
115417 +ath10k_read_fw_stats_7387 ath10k_read_fw_stats 3 7387 NULL
115418 +hweight_long_7388 hweight_long 1-0 7388 NULL
115419 +sl_change_mtu_7396 sl_change_mtu 2 7396 NULL
115420 +_ore_add_stripe_unit_7399 _ore_add_stripe_unit 6-3 7399 NULL
115421 +readb_7401 readb 0 7401 NULL
115422 +drm_property_create_blob_7414 drm_property_create_blob 2 7414 NULL
115423 +__copy_to_user_nocheck_7443 __copy_to_user_nocheck 0-3 7443 NULL
115424 +ip_options_get_alloc_7448 ip_options_get_alloc 1 7448 NULL
115425 +SYSC_setgroups_7454 SYSC_setgroups 1 7454 NULL
115426 +rt2x00debug_read_queue_stats_7455 rt2x00debug_read_queue_stats 3 7455 NULL
115427 +l2tp_ip6_sendmsg_7461 l2tp_ip6_sendmsg 4 7461 NULL
115428 +garp_request_join_7471 garp_request_join 4 7471 NULL nohasharray
115429 +ReadHSCX_7471 ReadHSCX 0 7471 &garp_request_join_7471
115430 +snd_pcm_lib_read1_7491 snd_pcm_lib_read1 0-3 7491 NULL
115431 +iwl_mvm_power_dbgfs_read_7502 iwl_mvm_power_dbgfs_read 0 7502 NULL
115432 +ahash_instance_headroom_7509 ahash_instance_headroom 0 7509 NULL nohasharray
115433 +sdhci_alloc_host_7509 sdhci_alloc_host 2 7509 &ahash_instance_headroom_7509
115434 +array_zalloc_7519 array_zalloc 1-2 7519 NULL
115435 +ath10k_read_htt_stats_mask_7557 ath10k_read_htt_stats_mask 3 7557 NULL
115436 +smk_read_mapped_7562 smk_read_mapped 3 7562 NULL
115437 +cfs_cpt_num_estimate_7571 cfs_cpt_num_estimate 0 7571 NULL
115438 +ocfs2_lock_create_7612 ocfs2_lock_create 0 7612 NULL
115439 +groups_alloc_7614 groups_alloc 1 7614 NULL nohasharray
115440 +create_dir_7614 create_dir 0 7614 &groups_alloc_7614
115441 +_rtw_zmalloc_7636 _rtw_zmalloc 1 7636 NULL
115442 +xfs_bmap_btalloc_nullfb_7654 xfs_bmap_btalloc_nullfb 0 7654 NULL
115443 +fault_inject_write_7662 fault_inject_write 3 7662 NULL
115444 +acpi_ex_allocate_name_string_7685 acpi_ex_allocate_name_string 2-1 7685 NULL
115445 +acpi_ns_get_pathname_length_7699 acpi_ns_get_pathname_length 0 7699 NULL
115446 +dev_write_7708 dev_write 3 7708 NULL
115447 +pci_raw_set_power_state_7729 pci_raw_set_power_state 0 7729 NULL
115448 +vxge_device_register_7752 vxge_device_register 4 7752 NULL
115449 +iwl_dbgfs_bt_cmd_read_7770 iwl_dbgfs_bt_cmd_read 3 7770 NULL
115450 +alloc_candev_7776 alloc_candev 1-2 7776 NULL
115451 +dfs_global_file_read_7787 dfs_global_file_read 3 7787 NULL
115452 +bnx2_nvram_write_7790 bnx2_nvram_write 4-2 7790 NULL
115453 +diva_os_copy_from_user_7792 diva_os_copy_from_user 4 7792 NULL nohasharray
115454 +lustre_packed_msg_size_7792 lustre_packed_msg_size 0 7792 &diva_os_copy_from_user_7792
115455 +xfs_alloc_find_best_extent_7837 xfs_alloc_find_best_extent 0 7837 NULL
115456 +cfs_trace_dump_debug_buffer_usrstr_7861 cfs_trace_dump_debug_buffer_usrstr 2 7861 NULL
115457 +tipc_alloc_entry_7875 tipc_alloc_entry 2 7875 NULL
115458 +config_desc_7878 config_desc 0 7878 NULL
115459 +gfs2_permission_7884 gfs2_permission 0 7884 NULL
115460 +dvb_dmxdev_read_sec_7892 dvb_dmxdev_read_sec 4 7892 NULL
115461 +xfs_trans_get_efi_7898 xfs_trans_get_efi 2 7898 NULL
115462 +libfc_host_alloc_7917 libfc_host_alloc 2 7917 NULL
115463 +f_hidg_write_7932 f_hidg_write 3 7932 NULL
115464 +integrity_digsig_verify_7956 integrity_digsig_verify 3-0 7956 NULL
115465 +smk_write_load_self_7958 smk_write_load_self 3 7958 NULL
115466 +tt3650_ci_msg_locked_8013 tt3650_ci_msg_locked 4 8013 NULL
115467 +vcs_read_8017 vcs_read 3 8017 NULL
115468 +vhost_add_used_and_signal_n_8038 vhost_add_used_and_signal_n 4 8038 NULL
115469 +ms_read_multiple_pages_8052 ms_read_multiple_pages 5-4 8052 NULL
115470 +dgrp_mon_read_8065 dgrp_mon_read 3 8065 NULL
115471 +spi_write_then_read_8073 spi_write_then_read 5-3 8073 NULL
115472 +qla4xxx_post_ping_evt_work_8074 qla4xxx_post_ping_evt_work 4 8074 NULL
115473 +venus_lookup_8121 venus_lookup 4 8121 NULL
115474 +ieee80211_if_fmt_num_buffered_multicast_8127 ieee80211_if_fmt_num_buffered_multicast 3 8127 NULL
115475 +__sk_mem_schedule_8185 __sk_mem_schedule 2 8185 NULL
115476 +ieee80211_if_fmt_dot11MeshHoldingTimeout_8187 ieee80211_if_fmt_dot11MeshHoldingTimeout 3 8187 NULL
115477 +recent_mt_proc_write_8206 recent_mt_proc_write 3 8206 NULL
115478 +__ocfs2_lock_refcount_tree_8207 __ocfs2_lock_refcount_tree 0 8207 NULL
115479 +rt2x00debug_write_bbp_8212 rt2x00debug_write_bbp 3 8212 NULL
115480 +ad7879_spi_multi_read_8218 ad7879_spi_multi_read 3 8218 NULL
115481 +play_iframe_8219 play_iframe 3 8219 NULL
115482 +kvm_mmu_page_set_gfn_8225 kvm_mmu_page_set_gfn 2 8225 NULL
115483 +sctp_ssnmap_size_8228 sctp_ssnmap_size 0-1-2 8228 NULL
115484 +check_xattr_ref_inode_8244 check_xattr_ref_inode 0 8244 NULL
115485 +t3_init_l2t_8261 t3_init_l2t 1 8261 NULL
115486 +init_cdev_8274 init_cdev 1 8274 NULL
115487 +rproc_recovery_write_8281 rproc_recovery_write 3 8281 NULL
115488 +qib_decode_7220_err_8315 qib_decode_7220_err 3 8315 NULL
115489 +ipwireless_send_packet_8328 ipwireless_send_packet 4 8328 NULL
115490 +tracing_entries_read_8345 tracing_entries_read 3 8345 NULL
115491 +ieee80211_if_fmt_ht_opmode_8347 ieee80211_if_fmt_ht_opmode 3 8347 NULL
115492 +generic_write_sync_8358 generic_write_sync 0 8358 NULL
115493 +ping_getfrag_8360 ping_getfrag 4-3 8360 NULL
115494 +ath6kl_lrssi_roam_write_8362 ath6kl_lrssi_roam_write 3 8362 NULL
115495 +xdi_copy_from_user_8395 xdi_copy_from_user 4 8395 NULL
115496 +zd_rf_scnprint_id_8406 zd_rf_scnprint_id 0-3 8406 NULL
115497 +smk_write_change_rule_8411 smk_write_change_rule 3 8411 NULL nohasharray
115498 +uvc_v4l2_ioctl_8411 uvc_v4l2_ioctl 2 8411 &smk_write_change_rule_8411
115499 +roccat_common2_sysfs_read_8431 roccat_common2_sysfs_read 6 8431 NULL
115500 +afs_cell_lookup_8482 afs_cell_lookup 2 8482 NULL
115501 +fore200e_chunk_alloc_8501 fore200e_chunk_alloc 4-3 8501 NULL
115502 +batadv_tt_len_8502 batadv_tt_len 0-1 8502 NULL
115503 +dev_config_8506 dev_config 3 8506 NULL
115504 +ACL_to_cifs_posix_8509 ACL_to_cifs_posix 3 8509 NULL
115505 +opticon_process_data_packet_8524 opticon_process_data_packet 3 8524 NULL
115506 +user_on_off_8552 user_on_off 2 8552 NULL
115507 +profile_remove_8556 profile_remove 3 8556 NULL
115508 +cache_slow_downcall_8570 cache_slow_downcall 2 8570 NULL
115509 +isr_dma0_done_read_8574 isr_dma0_done_read 3 8574 NULL
115510 +tower_write_8580 tower_write 3 8580 NULL
115511 +cfs_cpt_number_8618 cfs_cpt_number 0 8618 NULL
115512 +shash_setkey_unaligned_8620 shash_setkey_unaligned 3 8620 NULL
115513 +xfs_qm_dqattach_locked_8625 xfs_qm_dqattach_locked 0 8625 NULL
115514 +it821x_firmware_command_8628 it821x_firmware_command 3 8628 NULL
115515 +scsi_dma_map_8632 scsi_dma_map 0 8632 NULL
115516 +fuse_send_write_pages_8636 fuse_send_write_pages 0-5 8636 NULL
115517 +mlx5_vzalloc_8663 mlx5_vzalloc 1 8663 NULL
115518 +dio_bio_alloc_8677 dio_bio_alloc 5 8677 NULL
115519 +lbs_bcnmiss_read_8678 lbs_bcnmiss_read 3 8678 NULL
115520 +rproc_trace_read_8686 rproc_trace_read 3 8686 NULL
115521 +skb_frag_size_8695 skb_frag_size 0 8695 NULL
115522 +arcfb_write_8702 arcfb_write 3 8702 NULL
115523 +i_size_read_8703 i_size_read 0 8703 NULL nohasharray
115524 +init_header_8703 init_header 0 8703 &i_size_read_8703
115525 +HDLC_irq_8709 HDLC_irq 2 8709 NULL
115526 +ctrl_out_8712 ctrl_out 3-5 8712 NULL
115527 +tracing_max_lat_write_8728 tracing_max_lat_write 3 8728 NULL
115528 +jffs2_acl_count_8729 jffs2_acl_count 0-1 8729 NULL
115529 +__create_irqs_8733 __create_irqs 2 8733 NULL
115530 +tx_tx_exch_expiry_read_8749 tx_tx_exch_expiry_read 3 8749 NULL
115531 +compound_order_8750 compound_order 0 8750 NULL
115532 +ocfs2_find_path_8754 ocfs2_find_path 0 8754 NULL
115533 +yurex_write_8761 yurex_write 3 8761 NULL
115534 +joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
115535 +kstrtoint_from_user_8778 kstrtoint_from_user 2 8778 NULL
115536 +paging32_prefetch_gpte_8783 paging32_prefetch_gpte 4 8783 NULL
115537 +ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 3-4 8785 NULL
115538 +__bitmap_weight_8796 __bitmap_weight 0-2 8796 NULL
115539 +gfs2_glock_nq_8808 gfs2_glock_nq 0 8808 NULL
115540 +ntfs_commit_pages_after_write_8809 ntfs_commit_pages_after_write 0 8809 NULL
115541 +metronomefb_write_8823 metronomefb_write 3 8823 NULL
115542 +SyS_llistxattr_8824 SyS_llistxattr 3 8824 NULL
115543 +extent_read_full_page_8826 extent_read_full_page 0 8826 NULL
115544 +ll_xattr_cache_get_8829 ll_xattr_cache_get 0 8829 NULL
115545 +get_queue_depth_8833 get_queue_depth 0 8833 NULL
115546 +dvb_ringbuffer_pkt_next_8834 dvb_ringbuffer_pkt_next 0-2 8834 NULL
115547 +usb_ep_queue_8839 usb_ep_queue 0 8839 NULL
115548 +iwl_rx_packet_len_8854 iwl_rx_packet_len 0 8854 NULL
115549 +debug_debug1_read_8856 debug_debug1_read 3 8856 NULL
115550 +wa_nep_queue_8858 wa_nep_queue 2 8858 NULL
115551 +radeon_drm_ioctl_8875 radeon_drm_ioctl 2 8875 NULL
115552 +compressed_bio_size_8887 compressed_bio_size 0-2 8887 NULL
115553 +ab3100_get_set_reg_8890 ab3100_get_set_reg 3 8890 NULL nohasharray
115554 +tracing_max_lat_read_8890 tracing_max_lat_read 3 8890 &ab3100_get_set_reg_8890
115555 +sdio_max_byte_size_8907 sdio_max_byte_size 0 8907 NULL
115556 +sysfs_merge_group_8917 sysfs_merge_group 0 8917 NULL
115557 +write_file_ani_8918 write_file_ani 3 8918 NULL
115558 +layout_commit_8926 layout_commit 3 8926 NULL
115559 +adjust_priv_size_8935 adjust_priv_size 0-1 8935 NULL
115560 +driver_stats_read_8944 driver_stats_read 3 8944 NULL
115561 +read_file_tgt_stats_8959 read_file_tgt_stats 3 8959 NULL
115562 +usb_allocate_stream_buffers_8964 usb_allocate_stream_buffers 3 8964 NULL
115563 +qib_qsfp_dump_8966 qib_qsfp_dump 0-3 8966 NULL
115564 +venus_mkdir_8967 venus_mkdir 4 8967 NULL
115565 +seq_open_net_8968 seq_open_net 4 8968 NULL nohasharray
115566 +vol_cdev_read_8968 vol_cdev_read 3 8968 &seq_open_net_8968
115567 +bio_integrity_get_tag_8974 bio_integrity_get_tag 3 8974 NULL
115568 +jbd2_journal_blocks_per_page_9004 jbd2_journal_blocks_per_page 0 9004 NULL
115569 +il_dbgfs_clear_ucode_stats_write_9016 il_dbgfs_clear_ucode_stats_write 3 9016 NULL
115570 +xfs_inobt_get_rec_9023 xfs_inobt_get_rec 0 9023 NULL
115571 +snd_emu10k1_ptr_read_9026 snd_emu10k1_ptr_read 0-2 9026 NULL
115572 +fd_ioctl_9028 fd_ioctl 3 9028 NULL
115573 +nla_put_9042 nla_put 3 9042 NULL
115574 +ffs_func_revmap_intf_9043 ffs_func_revmap_intf 0 9043 NULL
115575 +sta_tx_latency_stat_header_9050 sta_tx_latency_stat_header 0-3-4 9050 NULL
115576 +snd_emu10k1_synth_copy_from_user_9061 snd_emu10k1_synth_copy_from_user 3-5 9061 NULL
115577 +snd_gus_dram_peek_9062 snd_gus_dram_peek 4 9062 NULL
115578 +fib_info_hash_alloc_9075 fib_info_hash_alloc 1 9075 NULL
115579 +create_queues_9088 create_queues 2-3 9088 NULL
115580 +ftdi_prepare_write_buffer_9093 ftdi_prepare_write_buffer 3 9093 NULL
115581 +adxl34x_spi_read_block_9108 adxl34x_spi_read_block 3 9108 NULL
115582 +caif_stream_sendmsg_9110 caif_stream_sendmsg 4 9110 NULL nohasharray
115583 +gfn_to_rmap_9110 gfn_to_rmap 3-2 9110 &caif_stream_sendmsg_9110 nohasharray
115584 +jhead_scan_9110 jhead_scan 0 9110 &gfn_to_rmap_9110
115585 +udf_direct_IO_9111 udf_direct_IO 4 9111 NULL
115586 +pmcraid_change_queue_depth_9116 pmcraid_change_queue_depth 2 9116 NULL
115587 +apei_resources_merge_9149 apei_resources_merge 0 9149 NULL
115588 +vb2_dma_sg_alloc_9157 vb2_dma_sg_alloc 2 9157 NULL
115589 +dbg_command_buf_9165 dbg_command_buf 2 9165 NULL
115590 +isr_irqs_read_9181 isr_irqs_read 3 9181 NULL
115591 +count_leading_zeros_9183 count_leading_zeros 0 9183 NULL
115592 +xfs_btree_rshift_9187 xfs_btree_rshift 0 9187 NULL
115593 +altera_swap_ir_9194 altera_swap_ir 2 9194 NULL
115594 +snd_m3_get_pointer_9206 snd_m3_get_pointer 0 9206 NULL
115595 +virtqueue_add_9217 virtqueue_add 4-5 9217 NULL
115596 +tx_tx_prepared_descs_read_9221 tx_tx_prepared_descs_read 3 9221 NULL
115597 +sctp_getsockopt_delayed_ack_9232 sctp_getsockopt_delayed_ack 2 9232 NULL
115598 +xfs_error_trap_9239 xfs_error_trap 0-1 9239 NULL
115599 +hfsplus_bnode_read_u16_9262 hfsplus_bnode_read_u16 0 9262 NULL
115600 +hdpvr_read_9273 hdpvr_read 3 9273 NULL
115601 +flakey_status_9274 flakey_status 5 9274 NULL
115602 +iwl_dbgfs_stations_read_9309 iwl_dbgfs_stations_read 3 9309 NULL
115603 +ceph_sync_setxattr_9310 ceph_sync_setxattr 4 9310 NULL
115604 +ieee80211_if_fmt_txpower_9334 ieee80211_if_fmt_txpower 3 9334 NULL
115605 +nvme_trans_fmt_get_parm_header_9340 nvme_trans_fmt_get_parm_header 2 9340 NULL
115606 +ocfs2_orphan_for_truncate_9342 ocfs2_orphan_for_truncate 4 9342 NULL
115607 +ll_direct_rw_pages_9361 ll_direct_rw_pages 0 9361 NULL
115608 +sta_beacon_loss_count_read_9370 sta_beacon_loss_count_read 3 9370 NULL
115609 +get_request_type_9393 get_request_type 0 9393 NULL nohasharray
115610 +mlx4_bitmap_init_9393 mlx4_bitmap_init 5-2 9393 &get_request_type_9393
115611 +virtqueue_add_outbuf_9395 virtqueue_add_outbuf 3 9395 NULL
115612 +read_9397 read 3 9397 NULL
115613 +hash_ipportip4_expire_9415 hash_ipportip4_expire 4 9415 NULL
115614 +btrfs_drop_extents_9423 btrfs_drop_extents 4 9423 NULL
115615 +bm_realloc_pages_9431 bm_realloc_pages 2 9431 NULL
115616 +ffs_ep0_write_9438 ffs_ep0_write 3 9438 NULL
115617 +ieee80211_if_fmt_fwded_unicast_9454 ieee80211_if_fmt_fwded_unicast 3 9454 NULL
115618 +agp_generic_alloc_user_9470 agp_generic_alloc_user 1 9470 NULL nohasharray
115619 +get_registers_9470 get_registers 4 9470 &agp_generic_alloc_user_9470
115620 +crypt_status_9492 crypt_status 5 9492 NULL
115621 +lbs_threshold_write_9502 lbs_threshold_write 5 9502 NULL
115622 +lp_write_9511 lp_write 3 9511 NULL
115623 +mext_calc_swap_extents_9517 mext_calc_swap_extents 4 9517 NULL
115624 +scsi_tgt_kspace_exec_9522 scsi_tgt_kspace_exec 8 9522 NULL
115625 +ll_max_read_ahead_whole_mb_seq_write_9528 ll_max_read_ahead_whole_mb_seq_write 3 9528 NULL
115626 +read_file_dma_9530 read_file_dma 3 9530 NULL
115627 +iwl_dbgfs_bf_params_read_9542 iwl_dbgfs_bf_params_read 3 9542 NULL
115628 +xfs_ialloc_read_agi_9545 xfs_ialloc_read_agi 0 9545 NULL
115629 +il_dbgfs_missed_beacon_write_9546 il_dbgfs_missed_beacon_write 3 9546 NULL
115630 +compat_SyS_pwritev64_9548 compat_SyS_pwritev64 3 9548 NULL
115631 +fw_node_create_9559 fw_node_create 2 9559 NULL
115632 +kobj_map_9566 kobj_map 2-3 9566 NULL
115633 +f2fs_read_data_pages_9574 f2fs_read_data_pages 4 9574 NULL
115634 +snd_emu10k1_fx8010_read_9605 snd_emu10k1_fx8010_read 5-6 9605 NULL
115635 +xfs_qm_dqattach_one_9612 xfs_qm_dqattach_one 0 9612 NULL
115636 +lov_ost_pool_add_9626 lov_ost_pool_add 3 9626 NULL
115637 +saa7164_buffer_alloc_user_9627 saa7164_buffer_alloc_user 2 9627 NULL
115638 +ceph_copy_user_to_page_vector_9635 ceph_copy_user_to_page_vector 4-3 9635 NULL
115639 +acpi_ex_insert_into_field_9638 acpi_ex_insert_into_field 3 9638 NULL
115640 +compat_sys_keyctl_9639 compat_sys_keyctl 4 9639 NULL
115641 +ll_checksum_seq_write_9648 ll_checksum_seq_write 3 9648 NULL
115642 +ocfs2_xattr_get_rec_9652 ocfs2_xattr_get_rec 0 9652 NULL
115643 +queue_received_packet_9657 queue_received_packet 5 9657 NULL
115644 +snd_opl4_mem_proc_write_9670 snd_opl4_mem_proc_write 5 9670 NULL
115645 +dns_query_9676 dns_query 3 9676 NULL
115646 +qib_7322_handle_hwerrors_9678 qib_7322_handle_hwerrors 3 9678 NULL
115647 +__erst_read_from_storage_9690 __erst_read_from_storage 0 9690 NULL
115648 +vx_transfer_end_9701 vx_transfer_end 0 9701 NULL
115649 +fuse_iter_npages_9705 fuse_iter_npages 0 9705 NULL nohasharray
115650 +ieee80211_if_read_aid_9705 ieee80211_if_read_aid 3 9705 &fuse_iter_npages_9705
115651 +cfg80211_tx_mlme_mgmt_9715 cfg80211_tx_mlme_mgmt 3 9715 NULL
115652 +btrfs_stack_file_extent_num_bytes_9720 btrfs_stack_file_extent_num_bytes 0 9720 NULL
115653 +SYSC_ppoll_9721 SYSC_ppoll 2 9721 NULL
115654 +nla_get_u8_9736 nla_get_u8 0 9736 NULL
115655 +ieee80211_if_fmt_num_mcast_sta_9738 ieee80211_if_fmt_num_mcast_sta 3 9738 NULL
115656 +shmem_replace_page_9740 shmem_replace_page 0 9740 NULL
115657 +ddb_input_read_9743 ddb_input_read 3-0 9743 NULL
115658 +sta_last_ack_signal_read_9751 sta_last_ack_signal_read 3 9751 NULL
115659 +btrfs_super_root_9763 btrfs_super_root 0 9763 NULL
115660 +__blk_queue_init_tags_9778 __blk_queue_init_tags 2 9778 NULL
115661 +kvm_age_hva_9795 kvm_age_hva 2 9795 NULL
115662 +parse_uac2_sample_rate_range_9801 parse_uac2_sample_rate_range 0 9801 NULL
115663 +tpm_data_in_9802 tpm_data_in 0 9802 NULL
115664 +ieee80211_if_read_state_9813 ieee80211_if_read_state 3 9813 NULL nohasharray
115665 +udpv6_recvmsg_9813 udpv6_recvmsg 4 9813 &ieee80211_if_read_state_9813
115666 +pmcraid_alloc_sglist_9864 pmcraid_alloc_sglist 1 9864 NULL
115667 +btrfs_free_reserved_extent_9867 btrfs_free_reserved_extent 2 9867 NULL
115668 +f1x_translate_sysaddr_to_cs_9868 f1x_translate_sysaddr_to_cs 2 9868 NULL
115669 +wil_read_file_ioblob_9878 wil_read_file_ioblob 3 9878 NULL
115670 +snd_midi_event_new_9893 snd_midi_event_new 1 9893 NULL nohasharray
115671 +bm_register_write_9893 bm_register_write 3 9893 &snd_midi_event_new_9893
115672 +snd_gf1_pcm_playback_copy_9895 snd_gf1_pcm_playback_copy 5-3 9895 NULL
115673 +nonpaging_page_fault_9908 nonpaging_page_fault 2 9908 NULL
115674 +root_nfs_parse_options_9937 root_nfs_parse_options 3 9937 NULL
115675 +pstore_ftrace_knob_read_9947 pstore_ftrace_knob_read 3 9947 NULL
115676 +read_file_misc_9948 read_file_misc 3 9948 NULL
115677 +csum_partial_copy_fromiovecend_9957 csum_partial_copy_fromiovecend 3-4 9957 NULL
115678 +xfs_buf_geterror_9959 xfs_buf_geterror 0 9959 NULL
115679 +SyS_gethostname_9964 SyS_gethostname 2 9964 NULL
115680 +get_free_serial_index_9969 get_free_serial_index 0 9969 NULL
115681 +btrfs_add_link_9973 btrfs_add_link 5 9973 NULL
115682 +gameport_read_9983 gameport_read 0 9983 NULL
115683 +SYSC_move_pages_9986 SYSC_move_pages 2 9986 NULL
115684 +ceph_oloc_oid_to_pg_10003 ceph_oloc_oid_to_pg 0 10003 NULL
115685 +aat2870_dump_reg_10019 aat2870_dump_reg 0 10019 NULL
115686 +ieee80211_set_probe_resp_10077 ieee80211_set_probe_resp 3 10077 NULL
115687 +xfs_attr_rmtval_get_10092 xfs_attr_rmtval_get 0 10092 NULL
115688 +xfs_btree_check_lptr_10104 xfs_btree_check_lptr 0 10104 NULL
115689 +get_elem_size_10110 get_elem_size 0-2 10110 NULL nohasharray
115690 +dynamic_ps_timeout_read_10110 dynamic_ps_timeout_read 3 10110 &get_elem_size_10110
115691 +gfs2_meta_read_10112 gfs2_meta_read 0 10112 NULL
115692 +SyS_migrate_pages_10134 SyS_migrate_pages 2 10134 NULL
115693 +aes_decrypt_packets_read_10155 aes_decrypt_packets_read 3 10155 NULL
115694 +rx_out_of_mem_read_10157 rx_out_of_mem_read 3 10157 NULL
115695 +hidg_alloc_ep_req_10159 hidg_alloc_ep_req 2 10159 NULL
115696 +asd_store_update_bios_10165 asd_store_update_bios 4 10165 NULL
115697 +kstrtol_from_user_10168 kstrtol_from_user 2 10168 NULL
115698 +proc_pid_attr_read_10173 proc_pid_attr_read 3 10173 NULL
115699 +jffs2_user_setxattr_10182 jffs2_user_setxattr 4 10182 NULL
115700 +xfs_attr_rmtval_copyout_10222 xfs_attr_rmtval_copyout 0 10222 NULL nohasharray
115701 +xfs_btree_read_buf_block_10222 xfs_btree_read_buf_block 0 10222 &xfs_attr_rmtval_copyout_10222
115702 +hdlc_rpr_irq_10240 hdlc_rpr_irq 2 10240 NULL
115703 +cciss_proc_write_10259 cciss_proc_write 3 10259 NULL
115704 +__qlcnic_pci_sriov_enable_10281 __qlcnic_pci_sriov_enable 2 10281 NULL
115705 +snd_rme9652_capture_copy_10287 snd_rme9652_capture_copy 5 10287 NULL
115706 +read_emulate_10310 read_emulate 2-4 10310 NULL
115707 +read_file_spectral_count_10320 read_file_spectral_count 3 10320 NULL
115708 +compat_SyS_writev_10327 compat_SyS_writev 3 10327 NULL
115709 +tun_sendmsg_10337 tun_sendmsg 4 10337 NULL
115710 +ufx_alloc_urb_list_10349 ufx_alloc_urb_list 3 10349 NULL
115711 +whci_add_cap_10350 whci_add_cap 0 10350 NULL
115712 +dbAllocAny_10354 dbAllocAny 0 10354 NULL
115713 +ath6kl_listen_int_read_10355 ath6kl_listen_int_read 3 10355 NULL
115714 +ms_write_multiple_pages_10362 ms_write_multiple_pages 6-5 10362 NULL
115715 +sta_ht_capa_read_10366 sta_ht_capa_read 3 10366 NULL
115716 +ecryptfs_decode_and_decrypt_filename_10379 ecryptfs_decode_and_decrypt_filename 5 10379 NULL
115717 +do_compat_pselect_10398 do_compat_pselect 1 10398 NULL
115718 +fwtty_rx_10434 fwtty_rx 3 10434 NULL
115719 +event_phy_transmit_error_read_10471 event_phy_transmit_error_read 3 10471 NULL
115720 +hash_ipportip6_expire_10478 hash_ipportip6_expire 4 10478 NULL
115721 +nouveau_pwr_create__10483 nouveau_pwr_create_ 4 10483 NULL
115722 +ext4_itable_unused_count_10501 ext4_itable_unused_count 0 10501 NULL
115723 +qib_alloc_fast_reg_page_list_10507 qib_alloc_fast_reg_page_list 2 10507 NULL
115724 +sel_write_disable_10511 sel_write_disable 3 10511 NULL
115725 +osd_req_write_sg_kern_10514 osd_req_write_sg_kern 5 10514 NULL
115726 +rds_message_alloc_10517 rds_message_alloc 1 10517 NULL
115727 +qlcnic_pci_sriov_enable_10519 qlcnic_pci_sriov_enable 2 10519 NULL
115728 +kstrtouint_from_user_10536 kstrtouint_from_user 2 10536 NULL nohasharray
115729 +snd_pcm_lib_read_10536 snd_pcm_lib_read 0-3 10536 &kstrtouint_from_user_10536
115730 +ext4_write_begin_10576 ext4_write_begin 3-4 10576 NULL
115731 +scrub_remap_extent_10588 scrub_remap_extent 2 10588 NULL
115732 +otp_read_10594 otp_read 2-4-5 10594 NULL
115733 +supply_map_read_file_10608 supply_map_read_file 3 10608 NULL
115734 +ima_show_htable_violations_10619 ima_show_htable_violations 3 10619 NULL
115735 +fq_alloc_node_10633 fq_alloc_node 1 10633 NULL
115736 +nfs_idmap_lookup_id_10660 nfs_idmap_lookup_id 2 10660 NULL
115737 +efx_max_tx_len_10662 efx_max_tx_len 0-2 10662 NULL
115738 +parport_write_10669 parport_write 0 10669 NULL
115739 +edge_write_10692 edge_write 4 10692 NULL
115740 +selinux_inode_setxattr_10708 selinux_inode_setxattr 4 10708 NULL nohasharray
115741 +inl_10708 inl 0 10708 &selinux_inode_setxattr_10708
115742 +shash_async_setkey_10720 shash_async_setkey 3 10720 NULL nohasharray
115743 +pvr2_ioread_read_10720 pvr2_ioread_read 3 10720 &shash_async_setkey_10720
115744 +spi_sync_10731 spi_sync 0 10731 NULL
115745 +sctp_getsockopt_maxseg_10737 sctp_getsockopt_maxseg 2 10737 NULL nohasharray
115746 +apu_get_register_10737 apu_get_register 0 10737 &sctp_getsockopt_maxseg_10737
115747 +SyS_io_getevents_10756 SyS_io_getevents 3 10756 NULL
115748 +vhost_add_used_n_10760 vhost_add_used_n 3 10760 NULL
115749 +rd_build_prot_space_10761 rd_build_prot_space 2-3 10761 NULL
115750 +kvm_read_guest_atomic_10765 kvm_read_guest_atomic 4 10765 NULL
115751 +__qp_memcpy_to_queue_10779 __qp_memcpy_to_queue 2-4 10779 NULL
115752 +diva_set_trace_filter_10820 diva_set_trace_filter 0-1 10820 NULL
115753 +lbs_sleepparams_read_10840 lbs_sleepparams_read 3 10840 NULL
115754 +ida_get_new_above_10853 ida_get_new_above 0 10853 NULL
115755 +fuse_conn_max_background_read_10855 fuse_conn_max_background_read 3 10855 NULL
115756 +snd_pcm_oss_write1_10872 snd_pcm_oss_write1 3 10872 NULL
115757 +wiidebug_drm_write_10879 wiidebug_drm_write 3 10879 NULL
115758 +get_scq_10897 get_scq 2 10897 NULL
115759 +tifm_alloc_adapter_10903 tifm_alloc_adapter 1 10903 NULL
115760 +lprocfs_wr_atomic_10912 lprocfs_wr_atomic 3 10912 NULL
115761 +__copy_from_user_10918 __copy_from_user 0-3 10918 NULL
115762 +kobject_add_10919 kobject_add 0 10919 NULL
115763 +ar9003_dump_modal_eeprom_10959 ar9003_dump_modal_eeprom 3-2-0 10959 NULL
115764 +ci_port_test_write_10962 ci_port_test_write 3 10962 NULL
115765 +bm_entry_read_10976 bm_entry_read 3 10976 NULL
115766 +sched_autogroup_write_10984 sched_autogroup_write 3 10984 NULL
115767 +xfrm_hash_alloc_10997 xfrm_hash_alloc 1 10997 NULL
115768 +rx_filter_accum_arp_pend_requests_read_11003 rx_filter_accum_arp_pend_requests_read 3 11003 NULL
115769 +gfs2_dir_read_11017 gfs2_dir_read 0 11017 NULL
115770 +SetLineNumber_11023 SetLineNumber 0 11023 NULL
115771 +tda10048_writeregbulk_11050 tda10048_writeregbulk 4 11050 NULL
115772 +insert_inline_extent_backref_11063 insert_inline_extent_backref 8 11063 NULL
115773 +tcp_send_mss_11079 tcp_send_mss 0 11079 NULL
115774 +count_argc_11083 count_argc 0 11083 NULL
115775 +kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
115776 +tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
115777 +page_offset_11120 page_offset 0 11120 NULL
115778 +cea_db_payload_len_11124 cea_db_payload_len 0 11124 NULL nohasharray
115779 +tracing_buffers_read_11124 tracing_buffers_read 3 11124 &cea_db_payload_len_11124
115780 +snd_gf1_pcm_playback_silence_11172 snd_gf1_pcm_playback_silence 4-3 11172 NULL
115781 +il_dbgfs_rx_queue_read_11221 il_dbgfs_rx_queue_read 3 11221 NULL
115782 +comedi_alloc_spriv_11234 comedi_alloc_spriv 2 11234 NULL
115783 +hugetlbfs_read_11268 hugetlbfs_read 3 11268 NULL
115784 +ath6kl_power_params_write_11274 ath6kl_power_params_write 3 11274 NULL
115785 +__proc_daemon_file_11305 __proc_daemon_file 5 11305 NULL
115786 +ext4_xattr_check_names_11314 ext4_xattr_check_names 0 11314 NULL
115787 +bcache_dev_sectors_dirty_add_11315 bcache_dev_sectors_dirty_add 3-4 11315 NULL
115788 +sk_filter_size_11316 sk_filter_size 0 11316 NULL nohasharray
115789 +tcp_send_rcvq_11316 tcp_send_rcvq 3 11316 &sk_filter_size_11316
115790 +shmem_radix_tree_replace_11325 shmem_radix_tree_replace 0 11325 NULL
115791 +construct_key_11329 construct_key 3 11329 NULL nohasharray
115792 +__kfifo_out_peek_11329 __kfifo_out_peek 0-3 11329 &construct_key_11329
115793 +next_segment_11330 next_segment 0-2-1 11330 NULL
115794 +persistent_ram_buffer_map_11332 persistent_ram_buffer_map 2-1 11332 NULL
115795 +ext4_get_inline_size_11349 ext4_get_inline_size 0 11349 NULL
115796 +sel_write_create_11353 sel_write_create 3 11353 NULL nohasharray
115797 +nl80211_send_mgmt_11353 nl80211_send_mgmt 7 11353 &sel_write_create_11353
115798 +qib_get_base_info_11369 qib_get_base_info 3 11369 NULL
115799 +nft_value_dump_11381 nft_value_dump 3 11381 NULL
115800 +isku_sysfs_read_keys_capslock_11392 isku_sysfs_read_keys_capslock 6 11392 NULL
115801 +dev_irnet_write_11398 dev_irnet_write 3 11398 NULL
115802 +lprocfs_wr_evict_client_11402 lprocfs_wr_evict_client 3 11402 NULL
115803 +___alloc_bootmem_11410 ___alloc_bootmem 1 11410 NULL
115804 +str_to_user_11411 str_to_user 2 11411 NULL
115805 +mem_fw_gen_free_mem_blks_read_11413 mem_fw_gen_free_mem_blks_read 3 11413 NULL
115806 +ath6kl_wmi_test_rx_11414 ath6kl_wmi_test_rx 3 11414 NULL
115807 +xfs_btree_lookup_11417 xfs_btree_lookup 0 11417 NULL nohasharray
115808 +adis16480_show_firmware_revision_11417 adis16480_show_firmware_revision 3 11417 &xfs_btree_lookup_11417
115809 +trace_options_read_11419 trace_options_read 3 11419 NULL
115810 +i40e_dbg_command_write_11421 i40e_dbg_command_write 3 11421 NULL
115811 +xd_read_multiple_pages_11422 xd_read_multiple_pages 5-4 11422 NULL
115812 +bttv_read_11432 bttv_read 3 11432 NULL
115813 +create_zero_mask_11453 create_zero_mask 0-1 11453 NULL
115814 +do_blockdev_direct_IO_11455 do_blockdev_direct_IO 0-6 11455 NULL
115815 +pci_set_power_state_11479 pci_set_power_state 0 11479 NULL nohasharray
115816 +sca3000_read_first_n_hw_rb_11479 sca3000_read_first_n_hw_rb 2 11479 &pci_set_power_state_11479
115817 +xfs_file_buffered_aio_write_11492 xfs_file_buffered_aio_write 4-0 11492 NULL
115818 +sd_do_mode_sense_11507 sd_do_mode_sense 5 11507 NULL
115819 +kmem_zalloc_11510 kmem_zalloc 1 11510 NULL
115820 +ll_direct_IO_26_seg_11518 ll_direct_IO_26_seg 0 11518 NULL
115821 +twl_direction_in_11527 twl_direction_in 2 11527 NULL
115822 +xfs_rtcheck_alloc_range_11553 xfs_rtcheck_alloc_range 0 11553 NULL
115823 +radix_tree_extend_11555 radix_tree_extend 0 11555 NULL
115824 +skb_cow_data_11565 skb_cow_data 0 11565 NULL
115825 +lpfc_idiag_ctlacc_write_11576 lpfc_idiag_ctlacc_write 3 11576 NULL
115826 +oprofilefs_ulong_to_user_11582 oprofilefs_ulong_to_user 3 11582 NULL
115827 +batadv_iv_ogm_orig_add_if_11586 batadv_iv_ogm_orig_add_if 2 11586 NULL
115828 +snd_pcm_action_11589 snd_pcm_action 0 11589 NULL
115829 +fw_device_op_ioctl_11595 fw_device_op_ioctl 2 11595 NULL
115830 +batadv_iv_ogm_orig_del_if_11604 batadv_iv_ogm_orig_del_if 2 11604 NULL
115831 +SYSC_mq_timedsend_11607 SYSC_mq_timedsend 3 11607 NULL
115832 +sisusb_send_bridge_packet_11649 sisusb_send_bridge_packet 2 11649 NULL
115833 +nla_total_size_11658 nla_total_size 1-0 11658 NULL
115834 +slab_ksize_11664 slab_ksize 0 11664 NULL
115835 +ide_queue_pc_tail_11673 ide_queue_pc_tail 5 11673 NULL
115836 +compat_SyS_msgsnd_11675 compat_SyS_msgsnd 3 11675 NULL
115837 +btrfs_alloc_delayed_item_11678 btrfs_alloc_delayed_item 1 11678 NULL
115838 +sctp_setsockopt_hmac_ident_11687 sctp_setsockopt_hmac_ident 3 11687 NULL
115839 +split_11691 split 2 11691 NULL
115840 +snd_ctl_elem_user_tlv_11695 snd_ctl_elem_user_tlv 3 11695 NULL
115841 +blk_rq_cur_bytes_11723 blk_rq_cur_bytes 0 11723 NULL
115842 +dm_bio_prison_create_11749 dm_bio_prison_create 1 11749 NULL
115843 +iwl_dbgfs_qos_read_11753 iwl_dbgfs_qos_read 3 11753 NULL
115844 +ieee80211_get_num_supported_channels_11768 ieee80211_get_num_supported_channels 0 11768 NULL
115845 +ps_pspoll_timeouts_read_11776 ps_pspoll_timeouts_read 3 11776 NULL
115846 +btrfs_key_blockptr_11786 btrfs_key_blockptr 0 11786 NULL
115847 +pcpu_fc_alloc_11818 pcpu_fc_alloc 2 11818 NULL
115848 +xfs_ialloc_11819 xfs_ialloc 0 11819 NULL
115849 +umc_device_register_11824 umc_device_register 0 11824 NULL
115850 +zerocopy_sg_from_iovec_11828 zerocopy_sg_from_iovec 3 11828 NULL
115851 +sctp_setsockopt_maxseg_11829 sctp_setsockopt_maxseg 3 11829 NULL
115852 +rts51x_read_status_11830 rts51x_read_status 4 11830 NULL
115853 +unix_stream_connect_11844 unix_stream_connect 3 11844 NULL
115854 +xfs_file_aio_write_checks_11851 xfs_file_aio_write_checks 0 11851 NULL
115855 +ecryptfs_copy_filename_11868 ecryptfs_copy_filename 4 11868 NULL
115856 +ieee80211_rx_bss_info_11887 ieee80211_rx_bss_info 3 11887 NULL
115857 +mdc_rename_11899 mdc_rename 4-6 11899 NULL
115858 +xstateregs_get_11906 xstateregs_get 4 11906 NULL
115859 +ti_write_11916 ti_write 4 11916 NULL
115860 +fs_devrw_entry_11924 fs_devrw_entry 3 11924 NULL
115861 +bitmap_remap_11929 bitmap_remap 5 11929 NULL
115862 +atomic_sub_return_11939 atomic_sub_return 0-1 11939 NULL
115863 +r1_sync_page_io_11963 r1_sync_page_io 3 11963 NULL
115864 +f1x_swap_interleaved_region_11970 f1x_swap_interleaved_region 0-2 11970 NULL
115865 +read_and_add_raw_conns_11987 read_and_add_raw_conns 0 11987 NULL
115866 +i40e_pci_sriov_configure_12011 i40e_pci_sriov_configure 2 12011 NULL
115867 +ftdi_elan_total_command_size_12045 ftdi_elan_total_command_size 0 12045 NULL
115868 +ieee80211_if_read_user_power_level_12050 ieee80211_if_read_user_power_level 3 12050 NULL
115869 +il4965_ucode_tx_stats_read_12064 il4965_ucode_tx_stats_read 3 12064 NULL
115870 +ptc_proc_write_12076 ptc_proc_write 3 12076 NULL
115871 +batadv_tt_global_size_mod_12085 batadv_tt_global_size_mod 3 12085 NULL
115872 +rtw_malloc2d_12102 rtw_malloc2d 1-2-3 12102 NULL
115873 +gfs2_find_jhead_12117 gfs2_find_jhead 0 12117 NULL
115874 +alloc_bulk_urbs_generic_12127 alloc_bulk_urbs_generic 5 12127 NULL
115875 +set_powered_12129 set_powered 4 12129 NULL
115876 +ramoops_init_prz_12134 ramoops_init_prz 5 12134 NULL
115877 +xfs_handle_to_dentry_12135 xfs_handle_to_dentry 3 12135 NULL
115878 +rawv6_seticmpfilter_12137 rawv6_seticmpfilter 5 12137 NULL
115879 +rawsock_recvmsg_12144 rawsock_recvmsg 4 12144 NULL
115880 +btmrvl_sdio_host_to_card_12152 btmrvl_sdio_host_to_card 3 12152 NULL
115881 +vmbus_open_12154 vmbus_open 2-3 12154 NULL
115882 +fnic_reset_stats_write_12177 fnic_reset_stats_write 3 12177 NULL
115883 +LNetEQAlloc_12178 LNetEQAlloc 1 12178 NULL
115884 +ddp_make_gl_12179 ddp_make_gl 1 12179 NULL
115885 +compat_do_arpt_set_ctl_12184 compat_do_arpt_set_ctl 4 12184 NULL
115886 +ip_generic_getfrag_12187 ip_generic_getfrag 3-4 12187 NULL
115887 +snd_pcm_kernel_ioctl_12219 snd_pcm_kernel_ioctl 0 12219 NULL
115888 +fuse_get_req_12221 fuse_get_req 2 12221 NULL nohasharray
115889 +aat2870_reg_read_file_12221 aat2870_reg_read_file 3 12221 &fuse_get_req_12221
115890 +xfs_attr3_leaf_read_12222 xfs_attr3_leaf_read 0 12222 NULL
115891 +__alloc_bootmem_low_nopanic_12235 __alloc_bootmem_low_nopanic 1 12235 NULL
115892 +usnic_ib_qp_grp_dump_rows_12239 usnic_ib_qp_grp_dump_rows 3 12239 NULL
115893 +ib_uverbs_unmarshall_recv_12251 ib_uverbs_unmarshall_recv 5 12251 NULL
115894 +shash_compat_setkey_12267 shash_compat_setkey 3 12267 NULL
115895 +add_sctp_bind_addr_12269 add_sctp_bind_addr 3 12269 NULL
115896 +note_last_dentry_12285 note_last_dentry 3 12285 NULL
115897 +roundup_to_multiple_of_64_12288 roundup_to_multiple_of_64 0-1 12288 NULL nohasharray
115898 +il_dbgfs_nvm_read_12288 il_dbgfs_nvm_read 3 12288 &roundup_to_multiple_of_64_12288
115899 +bt_sock_recvmsg_12316 bt_sock_recvmsg 4 12316 NULL
115900 +usnic_transport_sock_to_str_12322 usnic_transport_sock_to_str 2-0 12322 NULL
115901 +pcbit_writecmd_12332 pcbit_writecmd 2 12332 NULL
115902 +xfs_bmap_last_extent_12335 xfs_bmap_last_extent 0 12335 NULL
115903 +mptctl_ioctl_12355 mptctl_ioctl 2 12355 NULL
115904 +__nf_ct_ext_add_length_12364 __nf_ct_ext_add_length 3 12364 NULL
115905 +xfs_iext_inline_to_direct_12384 xfs_iext_inline_to_direct 2 12384 NULL
115906 +populate_dir_12391 populate_dir 0 12391 NULL nohasharray
115907 +write_file_dump_12391 write_file_dump 3 12391 &populate_dir_12391
115908 +hbucket_elem_add_12416 hbucket_elem_add 3 12416 NULL
115909 +ieee80211_if_read_num_mcast_sta_12419 ieee80211_if_read_num_mcast_sta 3 12419 NULL
115910 +cfs_array_alloc_12441 cfs_array_alloc 2 12441 NULL
115911 +skb_do_copy_data_nocache_12465 skb_do_copy_data_nocache 5 12465 NULL
115912 +x25_sendmsg_12487 x25_sendmsg 4 12487 NULL
115913 +fnic_trace_ctrl_read_12497 fnic_trace_ctrl_read 3 12497 NULL
115914 +__ceph_osdc_start_request_12502 __ceph_osdc_start_request 0 12502 NULL
115915 +qib_alloc_fast_reg_mr_12526 qib_alloc_fast_reg_mr 2 12526 NULL
115916 +write_inode_now_12565 write_inode_now 0 12565 NULL
115917 +hvc_alloc_12579 hvc_alloc 4 12579 NULL
115918 +pcpu_extend_area_map_12589 pcpu_extend_area_map 2 12589 NULL
115919 +tlbflush_write_file_12598 tlbflush_write_file 3 12598 NULL
115920 +vhci_put_user_12604 vhci_put_user 4 12604 NULL
115921 +sdhci_pltfm_init_12627 sdhci_pltfm_init 3 12627 NULL
115922 +pwr_rcvd_awake_bcns_cnt_read_12632 pwr_rcvd_awake_bcns_cnt_read 3 12632 NULL
115923 +pn_sendmsg_12640 pn_sendmsg 4 12640 NULL
115924 +dwc3_link_state_write_12641 dwc3_link_state_write 3 12641 NULL
115925 +nr_recvmsg_12649 nr_recvmsg 4 12649 NULL
115926 +rtw_android_get_link_speed_12655 rtw_android_get_link_speed 0 12655 NULL
115927 +ocfs2_read_block_12659 ocfs2_read_block 0 12659 NULL
115928 +sel_read_class_12669 sel_read_class 3 12669 NULL nohasharray
115929 +sparse_mem_maps_populate_node_12669 sparse_mem_maps_populate_node 4 12669 &sel_read_class_12669
115930 +iwl_dbgfs_calib_disabled_write_12707 iwl_dbgfs_calib_disabled_write 3 12707 NULL
115931 +ieee80211_if_read_num_buffered_multicast_12716 ieee80211_if_read_num_buffered_multicast 3 12716 NULL
115932 +ivtv_write_12721 ivtv_write 3 12721 NULL
115933 +key_rx_spec_read_12736 key_rx_spec_read 3 12736 NULL
115934 +__mei_cl_async_send_12737 __mei_cl_async_send 3 12737 NULL
115935 +ieee80211_if_read_dot11MeshMaxRetries_12756 ieee80211_if_read_dot11MeshMaxRetries 3 12756 NULL
115936 +listxattr_12769 listxattr 3 12769 NULL
115937 +sctp_ssnmap_init_12772 sctp_ssnmap_init 2-3 12772 NULL
115938 +scsi_adjust_queue_depth_12802 scsi_adjust_queue_depth 3 12802 NULL
115939 +xfs_inumbers_fmt_12817 xfs_inumbers_fmt 3 12817 NULL
115940 +readq_12825 readq 0 12825 NULL
115941 +SyS_add_key_12834 SyS_add_key 4 12834 NULL
115942 +gfs2_log_reserve_12835 gfs2_log_reserve 0 12835 NULL
115943 +TSS_authhmac_12839 TSS_authhmac 3 12839 NULL
115944 +spidev_sync_12842 spidev_sync 0 12842 NULL
115945 +spidev_ioctl_12846 spidev_ioctl 2 12846 NULL
115946 +xfs_rtallocate_extent_exact_12865 xfs_rtallocate_extent_exact 0 12865 NULL
115947 +ath9k_dump_4k_modal_eeprom_12883 ath9k_dump_4k_modal_eeprom 3-2 12883 NULL
115948 +get_leb_cnt_12892 get_leb_cnt 0-2 12892 NULL
115949 +get_virtual_node_size_12908 get_virtual_node_size 0 12908 NULL
115950 +rds_pages_in_vec_12922 rds_pages_in_vec 0 12922 NULL
115951 +do_inode_permission_12946 do_inode_permission 0 12946 NULL
115952 +bm_status_write_12964 bm_status_write 3 12964 NULL
115953 +raid56_parity_recover_12987 raid56_parity_recover 5 12987 NULL
115954 +TransmitTcb_12989 TransmitTcb 4 12989 NULL
115955 +sk_peek_offset_12991 sk_peek_offset 0 12991 NULL
115956 +bset_prev_bytes_13020 bset_prev_bytes 0 13020 NULL
115957 +subsystem_filter_write_13022 subsystem_filter_write 3 13022 NULL
115958 +generic_segment_checks_13041 generic_segment_checks 0 13041 NULL
115959 +ocfs2_write_begin_13045 ocfs2_write_begin 3-4 13045 NULL
115960 +__dn_setsockopt_13060 __dn_setsockopt 5 13060 NULL nohasharray
115961 +ptlrpc_lprocfs_threads_min_seq_write_13060 ptlrpc_lprocfs_threads_min_seq_write 3 13060 &__dn_setsockopt_13060
115962 +biovec_create_pool_13079 biovec_create_pool 2 13079 NULL
115963 +xattr_getsecurity_13090 xattr_getsecurity 0 13090 NULL
115964 +ttm_dma_pool_alloc_new_pages_13105 ttm_dma_pool_alloc_new_pages 3 13105 NULL
115965 +snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
115966 +bfad_debugfs_read_13119 bfad_debugfs_read 3 13119 NULL
115967 +blk_update_request_13146 blk_update_request 3 13146 NULL
115968 +caif_stream_recvmsg_13173 caif_stream_recvmsg 4 13173 NULL
115969 +pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
115970 +ucs2_strlen_13178 ucs2_strlen 0 13178 NULL
115971 +dgrp_net_ioctl_13183 dgrp_net_ioctl 2 13183 NULL
115972 +create_trace_uprobe_13184 create_trace_uprobe 1 13184 NULL
115973 +comedi_read_13199 comedi_read 3 13199 NULL
115974 +hash_ipport4_expire_13201 hash_ipport4_expire 4 13201 NULL
115975 +mmc_ext_csd_read_13205 mmc_ext_csd_read 3 13205 NULL
115976 +svm_msrpm_offset_13220 svm_msrpm_offset 0-1 13220 NULL
115977 +fnic_trace_ctrl_write_13229 fnic_trace_ctrl_write 3 13229 NULL
115978 +_iwl_dbgfs_disable_power_off_write_13243 _iwl_dbgfs_disable_power_off_write 3 13243 NULL
115979 +asix_read_cmd_13245 asix_read_cmd 5 13245 NULL
115980 +init_tid_tabs_13252 init_tid_tabs 2-3-4 13252 NULL
115981 +bio_integrity_trim_13259 bio_integrity_trim 3-2 13259 NULL
115982 +simple_attr_write_13260 simple_attr_write 3 13260 NULL
115983 +pmcraid_notify_aen_13274 pmcraid_notify_aen 3 13274 NULL
115984 +il4965_stats_flag_13281 il4965_stats_flag 0-3 13281 NULL
115985 +lpfc_idiag_mbxacc_get_setup_13282 lpfc_idiag_mbxacc_get_setup 0 13282 NULL
115986 +sd_major_13294 sd_major 0-1 13294 NULL
115987 +module_param_sysfs_setup_13296 module_param_sysfs_setup 0 13296 NULL
115988 +read_file_phy_err_13318 read_file_phy_err 3 13318 NULL
115989 +kvm_read_nested_guest_page_13337 kvm_read_nested_guest_page 5 13337 NULL
115990 +round_event_name_len_13348 round_event_name_len 0 13348 NULL
115991 +hscx_empty_fifo_13360 hscx_empty_fifo 2 13360 NULL
115992 +xfs_btree_delrec_13364 xfs_btree_delrec 0 13364 NULL
115993 +iso_sched_alloc_13377 iso_sched_alloc 1 13377 NULL nohasharray
115994 +wep_key_not_found_read_13377 wep_key_not_found_read 3 13377 &iso_sched_alloc_13377
115995 +ext4_meta_trans_blocks_13380 ext4_meta_trans_blocks 0-3-2 13380 NULL
115996 +lov_mds_md_size_13388 lov_mds_md_size 0-1 13388 NULL nohasharray
115997 +dis_bypass_write_13388 dis_bypass_write 3 13388 &lov_mds_md_size_13388
115998 +netxen_alloc_sds_rings_13417 netxen_alloc_sds_rings 2 13417 NULL
115999 +sctp_setsockopt_peer_primary_addr_13440 sctp_setsockopt_peer_primary_addr 3 13440 NULL
116000 +ath6kl_cfg80211_connect_event_13443 ath6kl_cfg80211_connect_event 8-9-7 13443 NULL
116001 +sb_init_dio_done_wq_13482 sb_init_dio_done_wq 0 13482 NULL
116002 +data_read_13494 data_read 3 13494 NULL
116003 +ioat_chansts_32_13506 ioat_chansts_32 0 13506 NULL
116004 +core_status_13515 core_status 4 13515 NULL
116005 +smk_write_mapped_13519 smk_write_mapped 3 13519 NULL
116006 +bm_init_13529 bm_init 2 13529 NULL
116007 +llcp_sock_recvmsg_13556 llcp_sock_recvmsg 4 13556 NULL
116008 +ieee80211_if_read_ap_power_level_13558 ieee80211_if_read_ap_power_level 3 13558 NULL
116009 +hash_net4_expire_13559 hash_net4_expire 4 13559 NULL
116010 +read_file_antenna_13574 read_file_antenna 3 13574 NULL
116011 +cache_write_13589 cache_write 3 13589 NULL
116012 +Rd_Indx_13602 Rd_Indx 3-2 13602 NULL
116013 +wm8994_bulk_write_13615 wm8994_bulk_write 2-3 13615 NULL
116014 +__ntfs_grab_cache_pages_13617 __ntfs_grab_cache_pages 0 13617 NULL
116015 +pmcraid_get_minor_13619 pmcraid_get_minor 0 13619 NULL
116016 +packet_snd_13634 packet_snd 3 13634 NULL
116017 +blk_msg_write_13655 blk_msg_write 3 13655 NULL
116018 +cache_downcall_13666 cache_downcall 3 13666 NULL
116019 +ext3_xattr_list_entries_13682 ext3_xattr_list_entries 0 13682 NULL
116020 +usb_get_string_13693 usb_get_string 0 13693 NULL
116021 +fw_iso_buffer_alloc_13704 fw_iso_buffer_alloc 2 13704 NULL
116022 +audit_unpack_string_13748 audit_unpack_string 3 13748 NULL
116023 +ieee802154_alloc_device_13767 ieee802154_alloc_device 1 13767 NULL
116024 +fb_sys_read_13778 fb_sys_read 3 13778 NULL
116025 +ath6kl_mgmt_powersave_ap_13791 ath6kl_mgmt_powersave_ap 6 13791 NULL
116026 +random_read_13815 random_read 3 13815 NULL
116027 +mutex_lock_interruptible_nested_13817 mutex_lock_interruptible_nested 0 13817 NULL
116028 +hsi_register_board_info_13820 hsi_register_board_info 2 13820 NULL
116029 +___mei_cl_send_13821 ___mei_cl_send 3 13821 NULL
116030 +enc_pools_insert_13849 enc_pools_insert 3 13849 NULL
116031 +evdev_ioctl_compat_13851 evdev_ioctl_compat 2 13851 NULL
116032 +compat_ip_setsockopt_13870 compat_ip_setsockopt 5 13870 NULL
116033 +qp_memcpy_to_queue_13886 qp_memcpy_to_queue 5-2 13886 NULL
116034 +snd_pcm_aio_read_13900 snd_pcm_aio_read 3 13900 NULL
116035 +cfg80211_inform_bss_width_13933 cfg80211_inform_bss_width 9 13933 NULL
116036 +ext3_xattr_block_get_13936 ext3_xattr_block_get 0 13936 NULL
116037 +ieee80211_if_read_dot11MeshForwarding_13940 ieee80211_if_read_dot11MeshForwarding 3 13940 NULL nohasharray
116038 +ocfs2_xa_value_truncate_13940 ocfs2_xa_value_truncate 2 13940 &ieee80211_if_read_dot11MeshForwarding_13940
116039 +iwl_dbgfs_protection_mode_read_13943 iwl_dbgfs_protection_mode_read 3 13943 NULL
116040 +ieee80211_if_read_min_discovery_timeout_13946 ieee80211_if_read_min_discovery_timeout 3 13946 NULL
116041 +lpfc_idiag_queacc_read_13950 lpfc_idiag_queacc_read 3 13950 NULL nohasharray
116042 +pagecache_write_end_13950 pagecache_write_end 0 13950 &lpfc_idiag_queacc_read_13950
116043 +osc_grant_shrink_interval_seq_write_13952 osc_grant_shrink_interval_seq_write 3 13952 NULL
116044 +ocfs2_refresh_slot_info_13957 ocfs2_refresh_slot_info 0 13957 NULL
116045 +snd_pcm_plug_slave_size_13967 snd_pcm_plug_slave_size 0-2 13967 NULL
116046 +qcam_read_13977 qcam_read 3 13977 NULL
116047 +dsp_read_13980 dsp_read 2 13980 NULL
116048 +dvb_demux_read_13981 dvb_demux_read 3 13981 NULL
116049 +sddr09_write_data_14014 sddr09_write_data 3 14014 NULL
116050 +btrfs_get_blocks_direct_14016 btrfs_get_blocks_direct 2 14016 NULL
116051 +dmi_format_ids_14018 dmi_format_ids 2 14018 NULL
116052 +iscsi_create_flashnode_conn_14022 iscsi_create_flashnode_conn 4 14022 NULL
116053 +pci_add_ext_cap_save_buffer_14032 pci_add_ext_cap_save_buffer 3 14032 NULL
116054 +dvb_usercopy_14036 dvb_usercopy 2 14036 NULL
116055 +read_def_modal_eeprom_14041 read_def_modal_eeprom 3 14041 NULL
116056 +xfs_bmap_alloc_14044 xfs_bmap_alloc 0 14044 NULL
116057 +ieee80211_if_fmt_aid_14055 ieee80211_if_fmt_aid 3 14055 NULL
116058 +ovs_nla_alloc_flow_actions_14056 ovs_nla_alloc_flow_actions 1 14056 NULL
116059 +sta_agg_status_read_14058 sta_agg_status_read 3 14058 NULL
116060 +lov_stripeoffset_seq_write_14078 lov_stripeoffset_seq_write 3 14078 NULL
116061 +do_proc_readlink_14096 do_proc_readlink 3 14096 NULL
116062 +compat_sys_pselect6_14105 compat_sys_pselect6 1 14105 NULL
116063 +ext4_journal_blocks_per_page_14127 ext4_journal_blocks_per_page 0 14127 NULL
116064 +isku_sysfs_read_light_14140 isku_sysfs_read_light 6 14140 NULL
116065 +em_canid_change_14150 em_canid_change 3 14150 NULL
116066 +gsm_dlci_data_14155 gsm_dlci_data 3 14155 NULL
116067 +midi_alloc_ep_req_14159 midi_alloc_ep_req 2 14159 NULL
116068 +print_input_mask_14168 print_input_mask 3-0 14168 NULL
116069 +ocfs2_xattr_value_truncate_14183 ocfs2_xattr_value_truncate 3 14183 NULL
116070 +datafab_read_data_14186 datafab_read_data 4 14186 NULL
116071 +hfsplus_brec_find_14200 hfsplus_brec_find 0 14200 NULL
116072 +alloc_async_14208 alloc_async 1 14208 NULL
116073 +ath6kl_regread_write_14220 ath6kl_regread_write 3 14220 NULL
116074 +ieee80211_if_write_uapsd_max_sp_len_14233 ieee80211_if_write_uapsd_max_sp_len 3 14233 NULL
116075 +dma_declare_coherent_memory_14244 dma_declare_coherent_memory 4 14244 NULL
116076 +btrfs_token_file_extent_ram_bytes_14247 btrfs_token_file_extent_ram_bytes 0 14247 NULL
116077 +ath6kl_connect_event_14267 ath6kl_connect_event 7-8-9 14267 NULL
116078 +rr_status_14293 rr_status 5 14293 NULL
116079 +read_default_ldt_14302 read_default_ldt 2 14302 NULL
116080 +update_rgrp_lvb_14303 update_rgrp_lvb 0 14303 NULL
116081 +xfs_qm_qino_alloc_14309 xfs_qm_qino_alloc 0 14309 NULL
116082 +oo_objects_14319 oo_objects 0 14319 NULL
116083 +ll_get_user_pages_14328 ll_get_user_pages 3-2-0 14328 NULL
116084 +p9_client_zc_rpc_14345 p9_client_zc_rpc 7 14345 NULL
116085 +alloc_tx_struct_14349 alloc_tx_struct 1 14349 NULL
116086 +hash_ipportnet4_expire_14354 hash_ipportnet4_expire 4 14354 NULL
116087 +snd_pcm_lib_readv_14363 snd_pcm_lib_readv 0-3 14363 NULL
116088 +lowpan_read_14369 lowpan_read 3 14369 NULL
116089 +ath6kl_regdump_read_14393 ath6kl_regdump_read 3 14393 NULL
116090 +smk_write_onlycap_14400 smk_write_onlycap 3 14400 NULL
116091 +mtd_concat_create_14416 mtd_concat_create 2 14416 NULL
116092 +get_kcore_size_14425 get_kcore_size 0 14425 NULL
116093 +_iwl_dbgfs_sram_write_14439 _iwl_dbgfs_sram_write 3 14439 NULL
116094 +block_size_14443 block_size 0 14443 NULL
116095 +lmv_user_md_size_14456 lmv_user_md_size 0-1 14456 NULL
116096 +snd_emu10k1_proc_spdif_status_14457 snd_emu10k1_proc_spdif_status 4-5 14457 NULL
116097 +ath10k_write_htt_stats_mask_14458 ath10k_write_htt_stats_mask 3 14458 NULL
116098 +lustre_msg_size_v2_14470 lustre_msg_size_v2 0 14470 NULL
116099 +dma_transfer_size_14473 dma_transfer_size 0 14473 NULL
116100 +udplite_getfrag_14479 udplite_getfrag 3-4 14479 NULL
116101 +ieee80211_if_read_dot11MeshGateAnnouncementProtocol_14486 ieee80211_if_read_dot11MeshGateAnnouncementProtocol 3 14486 NULL
116102 +split_state_14491 split_state 0 14491 NULL
116103 +ocfs2_debug_read_14507 ocfs2_debug_read 3 14507 NULL
116104 +ep0_write_14536 ep0_write 3 14536 NULL nohasharray
116105 +dataflash_read_user_otp_14536 dataflash_read_user_otp 3-2 14536 &ep0_write_14536
116106 +picolcd_debug_eeprom_read_14549 picolcd_debug_eeprom_read 3 14549 NULL
116107 +qp_host_alloc_queue_14566 qp_host_alloc_queue 1 14566 NULL
116108 +SyS_setdomainname_14569 SyS_setdomainname 2 14569 NULL
116109 +stuffed_readpage_14581 stuffed_readpage 0 14581 NULL
116110 +idmap_pipe_downcall_14591 idmap_pipe_downcall 3 14591 NULL
116111 +ceph_osdc_alloc_request_14597 ceph_osdc_alloc_request 3 14597 NULL
116112 +dbJoin_14644 dbJoin 0 14644 NULL
116113 +profile_replace_14652 profile_replace 3 14652 NULL
116114 +usnic_vnic_dump_14662 usnic_vnic_dump 3 14662 NULL
116115 +add_to_page_cache_locked_14668 add_to_page_cache_locked 0 14668 NULL
116116 +min_bytes_needed_14675 min_bytes_needed 0 14675 NULL
116117 +nvme_trans_log_info_exceptions_14677 nvme_trans_log_info_exceptions 3 14677 NULL
116118 +pipeline_enc_tx_stat_fifo_int_read_14680 pipeline_enc_tx_stat_fifo_int_read 3 14680 NULL
116119 +ieee80211_if_fmt_rc_rateidx_mask_2ghz_14683 ieee80211_if_fmt_rc_rateidx_mask_2ghz 3 14683 NULL
116120 +SyS_fsetxattr_14702 SyS_fsetxattr 4 14702 NULL
116121 +persistent_ram_ecc_string_14704 persistent_ram_ecc_string 0 14704 NULL
116122 +u_audio_playback_14709 u_audio_playback 3 14709 NULL
116123 +rtw_cbuf_alloc_14710 rtw_cbuf_alloc 1 14710 NULL
116124 +cgroup_path_14713 cgroup_path 3 14713 NULL
116125 +vfd_write_14717 vfd_write 3 14717 NULL
116126 +__blk_end_request_14729 __blk_end_request 3 14729 NULL
116127 +raid1_resize_14740 raid1_resize 2 14740 NULL
116128 +i915_error_state_buf_init_14742 i915_error_state_buf_init 2 14742 NULL
116129 +btrfs_inode_extref_name_len_14752 btrfs_inode_extref_name_len 0 14752 NULL
116130 +rx_rx_cmplt_read_14753 rx_rx_cmplt_read 3 14753 NULL
116131 +regmap_range_read_file_14775 regmap_range_read_file 3 14775 NULL
116132 +sta_dev_read_14782 sta_dev_read 3 14782 NULL
116133 +keys_proc_write_14792 keys_proc_write 3 14792 NULL
116134 +ext4_kvmalloc_14796 ext4_kvmalloc 1 14796 NULL
116135 +__kfifo_in_14797 __kfifo_in 3-0 14797 NULL
116136 +hpet_readl_14801 hpet_readl 0 14801 NULL nohasharray
116137 +snd_als300_gcr_read_14801 snd_als300_gcr_read 0 14801 &hpet_readl_14801
116138 +security_inode_rename_14805 security_inode_rename 0 14805 NULL
116139 +xfs_btree_kill_iroot_14824 xfs_btree_kill_iroot 0 14824 NULL
116140 +mrp_attr_create_14853 mrp_attr_create 3 14853 NULL
116141 +lcd_write_14857 lcd_write 3 14857 NULL
116142 +get_user_cpu_mask_14861 get_user_cpu_mask 2 14861 NULL
116143 +xfs_bmapi_convert_unwritten_14886 xfs_bmapi_convert_unwritten 0 14886 NULL
116144 +gmux_index_read8_14890 gmux_index_read8 0 14890 NULL
116145 +acpi_os_allocate_14892 acpi_os_allocate 1 14892 NULL
116146 +SYSC_readv_14901 SYSC_readv 3 14901 NULL
116147 +__arch_hweight64_14923 __arch_hweight64 0 14923 NULL nohasharray
116148 +qp_memcpy_to_queue_iov_14923 qp_memcpy_to_queue_iov 5-2 14923 &__arch_hweight64_14923
116149 +ocfs2_expand_nonsparse_inode_14936 ocfs2_expand_nonsparse_inode 3-4 14936 NULL
116150 +queue_cnt_14951 queue_cnt 0 14951 NULL
116151 +unix_dgram_recvmsg_14952 unix_dgram_recvmsg 4 14952 NULL
116152 +videobuf_read_stream_14956 videobuf_read_stream 3 14956 NULL
116153 +mce_flush_rx_buffer_14976 mce_flush_rx_buffer 2 14976 NULL
116154 +setkey_14987 setkey 3 14987 NULL nohasharray
116155 +gpio_twl4030_write_14987 gpio_twl4030_write 1 14987 &setkey_14987
116156 +blk_integrity_tuple_size_15027 blk_integrity_tuple_size 0 15027 NULL
116157 +read_file_node_aggr_15040 read_file_node_aggr 3 15040 NULL
116158 +cld_pipe_downcall_15058 cld_pipe_downcall 3 15058 NULL
116159 +ieee80211_if_read_uapsd_max_sp_len_15067 ieee80211_if_read_uapsd_max_sp_len 3 15067 NULL
116160 +nfs4_write_cached_acl_15070 nfs4_write_cached_acl 4 15070 NULL
116161 +ntfs_copy_from_user_15072 ntfs_copy_from_user 3-5-0 15072 NULL
116162 +pppoe_recvmsg_15073 pppoe_recvmsg 4 15073 NULL
116163 +smscore_load_firmware_family2_15086 smscore_load_firmware_family2 3 15086 NULL
116164 +xfs_btree_insrec_15090 xfs_btree_insrec 0 15090 NULL
116165 +btrfs_readpage_15094 btrfs_readpage 0 15094 NULL
116166 +hex_dump_to_buffer_15121 hex_dump_to_buffer 6 15121 NULL
116167 +start_port_15124 start_port 0 15124 NULL
116168 +ipwireless_ppp_mru_15153 ipwireless_ppp_mru 0 15153 NULL
116169 +SYSC_setdomainname_15180 SYSC_setdomainname 2 15180 NULL
116170 +iscsi_create_endpoint_15193 iscsi_create_endpoint 1 15193 NULL
116171 +mtt_alloc_res_15211 mtt_alloc_res 5 15211 NULL
116172 +bfad_debugfs_write_regrd_15218 bfad_debugfs_write_regrd 3 15218 NULL
116173 +iwl_dbgfs_sram_write_15239 iwl_dbgfs_sram_write 3 15239 NULL
116174 +il_dbgfs_rx_stats_read_15243 il_dbgfs_rx_stats_read 3 15243 NULL
116175 +simple_strtol_15273 simple_strtol 0 15273 NULL
116176 +fw_realloc_buffer_15280 fw_realloc_buffer 2 15280 NULL
116177 +ocfs2_read_refcount_block_15305 ocfs2_read_refcount_block 0 15305 NULL
116178 +kovaplus_sysfs_read_15337 kovaplus_sysfs_read 6 15337 NULL
116179 +ioread16_15342 ioread16 0 15342 NULL
116180 +ept_prefetch_gpte_15348 ept_prefetch_gpte 4 15348 NULL
116181 +acpi_ut_create_string_object_15360 acpi_ut_create_string_object 1 15360 NULL
116182 +ext4_direct_IO_15369 ext4_direct_IO 4 15369 NULL
116183 +graph_depth_read_15371 graph_depth_read 3 15371 NULL
116184 +compat_sys_process_vm_readv_15374 compat_sys_process_vm_readv 3-5 15374 NULL
116185 +fq_codel_zalloc_15378 fq_codel_zalloc 1 15378 NULL
116186 +alloc_fddidev_15382 alloc_fddidev 1 15382 NULL
116187 +pipeline_csum_to_rx_xfer_swi_read_15403 pipeline_csum_to_rx_xfer_swi_read 3 15403 NULL
116188 +get_modalias_15406 get_modalias 2 15406 NULL
116189 +blockdev_direct_IO_15408 blockdev_direct_IO 5 15408 NULL
116190 +__videobuf_copy_to_user_15423 __videobuf_copy_to_user 4-0 15423 NULL
116191 +tcp_mtu_to_mss_15438 tcp_mtu_to_mss 2-0 15438 NULL
116192 +hpsa_change_queue_depth_15449 hpsa_change_queue_depth 2 15449 NULL
116193 +memweight_15450 memweight 2 15450 NULL
116194 +zd_chip_is_zd1211b_15518 zd_chip_is_zd1211b 0 15518 NULL
116195 +ifx_spi_write_15531 ifx_spi_write 3 15531 NULL
116196 +p9_check_zc_errors_15534 p9_check_zc_errors 4 15534 NULL
116197 +xfrm_state_mtu_15548 xfrm_state_mtu 0-2 15548 NULL
116198 +persistent_status_15574 persistent_status 4 15574 NULL
116199 +bnx2fc_process_unsol_compl_15576 bnx2fc_process_unsol_compl 2 15576 NULL
116200 +vme_user_write_15587 vme_user_write 3 15587 NULL
116201 +compat_fillonedir_15620 compat_fillonedir 3 15620 NULL
116202 +proc_loginuid_read_15631 proc_loginuid_read 3 15631 NULL
116203 +tomoyo_scan_bprm_15642 tomoyo_scan_bprm 2-4 15642 NULL nohasharray
116204 +sk_memory_allocated_add_15642 sk_memory_allocated_add 2 15642 &tomoyo_scan_bprm_15642 nohasharray
116205 +pipeline_hs_tx_stat_fifo_int_read_15642 pipeline_hs_tx_stat_fifo_int_read 3 15642 &sk_memory_allocated_add_15642
116206 +joydev_handle_JSIOCSBTNMAP_15643 joydev_handle_JSIOCSBTNMAP 3 15643 NULL
116207 +fs_path_add_15648 fs_path_add 3 15648 NULL
116208 +__do_readpage_15652 __do_readpage 0 15652 NULL
116209 +xsd_read_15653 xsd_read 3 15653 NULL
116210 +unix_bind_15668 unix_bind 3 15668 NULL
116211 +dm_read_15674 dm_read 3 15674 NULL nohasharray
116212 +SyS_connect_15674 SyS_connect 3 15674 &dm_read_15674
116213 +tracing_snapshot_write_15719 tracing_snapshot_write 3 15719 NULL
116214 +HiSax_readstatus_15752 HiSax_readstatus 2 15752 NULL
116215 +smk_read_direct_15803 smk_read_direct 3 15803 NULL
116216 +nameseq_list_15817 nameseq_list 3-0 15817 NULL nohasharray
116217 +gnttab_expand_15817 gnttab_expand 1 15817 &nameseq_list_15817
116218 +afs_proc_rootcell_write_15822 afs_proc_rootcell_write 3 15822 NULL
116219 +table_size_15851 table_size 0-1-2 15851 NULL
116220 +write_file_tx99_15856 write_file_tx99 3 15856 NULL
116221 +media_entity_init_15870 media_entity_init 2-4 15870 NULL
116222 +__mptctl_ioctl_15875 __mptctl_ioctl 2 15875 NULL
116223 +native_read_msr_15905 native_read_msr 0 15905 NULL
116224 +parse_audio_stream_data_15937 parse_audio_stream_data 3 15937 NULL
116225 +power_read_15939 power_read 3 15939 NULL
116226 +lpfc_idiag_drbacc_read_15948 lpfc_idiag_drbacc_read 3 15948 NULL
116227 +snd_pcm_lib_read_transfer_15952 snd_pcm_lib_read_transfer 5-2-4 15952 NULL
116228 +memblock_virt_alloc_try_nid_15954 memblock_virt_alloc_try_nid 1 15954 NULL
116229 +viafb_vt1636_proc_write_16018 viafb_vt1636_proc_write 3 16018 NULL
116230 +dccp_recvmsg_16056 dccp_recvmsg 4 16056 NULL
116231 +read_file_spectral_period_16057 read_file_spectral_period 3 16057 NULL
116232 +si5351_msynth_params_address_16062 si5351_msynth_params_address 0-1 16062 NULL
116233 +isr_tx_exch_complete_read_16103 isr_tx_exch_complete_read 3 16103 NULL
116234 +isr_hw_pm_mode_changes_read_16110 isr_hw_pm_mode_changes_read 3 16110 NULL nohasharray
116235 +dma_tx_requested_read_16110 dma_tx_requested_read 3 16110 &isr_hw_pm_mode_changes_read_16110
116236 +gfs2_jdesc_check_16122 gfs2_jdesc_check 0 16122 NULL
116237 +snd_dma_pointer_16126 snd_dma_pointer 0-2 16126 NULL
116238 +compat_sys_select_16131 compat_sys_select 1 16131 NULL
116239 +fsm_init_16134 fsm_init 2 16134 NULL
116240 +ext4_xattr_block_get_16148 ext4_xattr_block_get 0 16148 NULL
116241 +optimal_reclaimed_pages_16172 optimal_reclaimed_pages 0 16172 NULL
116242 +mapping_level_16188 mapping_level 2-0 16188 NULL
116243 +i40e_allocate_virt_mem_d_16191 i40e_allocate_virt_mem_d 3 16191 NULL
116244 +ath10k_htt_rx_ring_size_16201 ath10k_htt_rx_ring_size 0 16201 NULL
116245 +cipso_v4_map_cat_rng_hton_16203 cipso_v4_map_cat_rng_hton 0 16203 NULL
116246 +SyS_pselect6_16210 SyS_pselect6 1 16210 NULL
116247 +create_table_16213 create_table 2 16213 NULL
116248 +ath9k_hw_ar9287_dump_eeprom_16224 ath9k_hw_ar9287_dump_eeprom 5-4 16224 NULL
116249 +atomic_read_file_16227 atomic_read_file 3 16227 NULL
116250 +BcmGetSectionValStartOffset_16235 BcmGetSectionValStartOffset 0 16235 NULL
116251 +lov_prep_brw_set_16246 lov_prep_brw_set 3 16246 NULL
116252 +btrfs_dev_extent_chunk_offset_16247 btrfs_dev_extent_chunk_offset 0 16247 NULL nohasharray
116253 +i40e_dbg_dump_read_16247 i40e_dbg_dump_read 3 16247 &btrfs_dev_extent_chunk_offset_16247
116254 +il_dbgfs_disable_ht40_write_16249 il_dbgfs_disable_ht40_write 3 16249 NULL
116255 +SyS_fgetxattr_16254 SyS_fgetxattr 4 16254 NULL
116256 +reiserfs_acl_count_16265 reiserfs_acl_count 0-1 16265 NULL
116257 +ocfs2_xattr_bucket_value_truncate_16279 ocfs2_xattr_bucket_value_truncate 4 16279 NULL
116258 +nand_bch_init_16280 nand_bch_init 3-2 16280 NULL nohasharray
116259 +drbd_setsockopt_16280 drbd_setsockopt 5 16280 &nand_bch_init_16280
116260 +account_16283 account 0-4-2 16283 NULL nohasharray
116261 +mirror_status_16283 mirror_status 5 16283 &account_16283
116262 +jumpshot_read_data_16287 jumpshot_read_data 4 16287 NULL
116263 +mo_xattr_get_16288 mo_xattr_get 0 16288 NULL
116264 +stk_allocate_buffers_16291 stk_allocate_buffers 2 16291 NULL
116265 +rbd_segment_offset_16293 rbd_segment_offset 0-2 16293 NULL
116266 +rsc_mgr_init_16299 rsc_mgr_init 3 16299 NULL
116267 +kvm_handle_hva_range_16312 kvm_handle_hva_range 3-2 16312 NULL
116268 +sysfs_create_groups_16360 sysfs_create_groups 0 16360 NULL
116269 +total_ps_buffered_read_16365 total_ps_buffered_read 3 16365 NULL
116270 +xfs_inobt_lookup_16367 xfs_inobt_lookup 0 16367 NULL
116271 +iscsi_tcp_conn_setup_16376 iscsi_tcp_conn_setup 2 16376 NULL
116272 +gfs2_dinode_in_16378 gfs2_dinode_in 0 16378 NULL
116273 +xfs_btree_check_block_16419 xfs_btree_check_block 0 16419 NULL
116274 +ieee80211_if_read_tsf_16420 ieee80211_if_read_tsf 3 16420 NULL
116275 +rxrpc_server_keyring_16431 rxrpc_server_keyring 3 16431 NULL
116276 +__bio_add_page_16435 __bio_add_page 0-4 16435 NULL
116277 +cmdline_store_16442 cmdline_store 4 16442 NULL
116278 +btrfs_truncate_inode_items_16452 btrfs_truncate_inode_items 4 16452 NULL
116279 +netlink_change_ngroups_16457 netlink_change_ngroups 2 16457 NULL
116280 +req_capsule_get_size_16467 req_capsule_get_size 0 16467 NULL
116281 +tracing_readme_read_16493 tracing_readme_read 3 16493 NULL
116282 +KEY_OFFSET_16504 KEY_OFFSET 0 16504 NULL
116283 +snd_interval_max_16529 snd_interval_max 0 16529 NULL
116284 +raid10_resize_16537 raid10_resize 2 16537 NULL
116285 +lpfc_debugfs_read_16566 lpfc_debugfs_read 3 16566 NULL
116286 +agp_allocate_memory_wrap_16576 agp_allocate_memory_wrap 1 16576 NULL
116287 +lustre_msg_hdr_size_v2_16589 lustre_msg_hdr_size_v2 0 16589 NULL
116288 +gmux_index_read32_16604 gmux_index_read32 0 16604 NULL
116289 +rtw_set_wpa_ie_16633 rtw_set_wpa_ie 3 16633 NULL
116290 +btrfs_get_token_32_16651 btrfs_get_token_32 0 16651 NULL
116291 +__wa_populate_dto_urb_16699 __wa_populate_dto_urb 3-4 16699 NULL
116292 +__proc_lnet_buffers_16717 __proc_lnet_buffers 5 16717 NULL
116293 +__copy_to_user_swizzled_16748 __copy_to_user_swizzled 3-4 16748 NULL
116294 +arcmsr_adjust_disk_queue_depth_16756 arcmsr_adjust_disk_queue_depth 2 16756 NULL
116295 +blk_rq_map_user_iov_16772 blk_rq_map_user_iov 5 16772 NULL
116296 +i2o_parm_issue_16790 i2o_parm_issue 0 16790 NULL
116297 +get_server_iovec_16804 get_server_iovec 2 16804 NULL
116298 +drm_malloc_ab_16831 drm_malloc_ab 1-2 16831 NULL
116299 +scsi_mode_sense_16835 scsi_mode_sense 5 16835 NULL
116300 +hfsplus_min_io_size_16859 hfsplus_min_io_size 0 16859 NULL
116301 +xfs_dialloc_ag_16868 xfs_dialloc_ag 0 16868 NULL
116302 +alloc_idx_lebs_16872 alloc_idx_lebs 2 16872 NULL nohasharray
116303 +xfs_iget_16872 xfs_iget 0 16872 &alloc_idx_lebs_16872
116304 +carl9170_debugfs_ampdu_state_read_16873 carl9170_debugfs_ampdu_state_read 3 16873 NULL
116305 +st_write_16874 st_write 3 16874 NULL
116306 +__kfifo_peek_n_16877 __kfifo_peek_n 0 16877 NULL
116307 +transport_init_session_tags_16878 transport_init_session_tags 1-2 16878 NULL
116308 +snd_gf1_mem_proc_dump_16926 snd_gf1_mem_proc_dump 5 16926 NULL nohasharray
116309 +psb_unlocked_ioctl_16926 psb_unlocked_ioctl 2 16926 &snd_gf1_mem_proc_dump_16926
116310 +_sp2d_alloc_16944 _sp2d_alloc 1-2-3 16944 NULL
116311 +squashfs_read_table_16945 squashfs_read_table 3 16945 NULL
116312 +keyctl_instantiate_key_iov_16969 keyctl_instantiate_key_iov 3 16969 NULL
116313 +ocfs2_read_quota_phys_block_16990 ocfs2_read_quota_phys_block 0 16990 NULL
116314 +ceph_read_dir_17005 ceph_read_dir 3 17005 NULL
116315 +copy_counters_to_user_17027 copy_counters_to_user 5 17027 NULL
116316 +jffs2_trusted_setxattr_17048 jffs2_trusted_setxattr 4 17048 NULL
116317 +__arch_hweight32_17060 __arch_hweight32 0 17060 NULL
116318 +sddr55_read_data_17072 sddr55_read_data 4 17072 NULL
116319 +dvb_dvr_read_17073 dvb_dvr_read 3 17073 NULL
116320 +simple_transaction_read_17076 simple_transaction_read 3 17076 NULL
116321 +carl9170_debugfs_mem_usage_read_17084 carl9170_debugfs_mem_usage_read 3 17084 NULL
116322 +entry_length_17093 entry_length 0 17093 NULL
116323 +ocfs2_get_refcount_cpos_end_17113 ocfs2_get_refcount_cpos_end 0 17113 NULL
116324 +write_mem_17114 write_mem 3 17114 NULL
116325 +pvr2_hdw_state_report_17121 pvr2_hdw_state_report 3 17121 NULL
116326 +nouveau_instobj_create__17144 nouveau_instobj_create_ 4 17144 NULL
116327 +jumpshot_write_data_17151 jumpshot_write_data 4 17151 NULL
116328 +sep_read_17161 sep_read 3 17161 NULL
116329 +befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
116330 +tx_tx_start_templates_read_17164 tx_tx_start_templates_read 3 17164 NULL
116331 +UniStrnlen_17169 UniStrnlen 0 17169 NULL
116332 +access_remote_vm_17189 access_remote_vm 0 17189 NULL nohasharray
116333 +iwl_dbgfs_txfifo_flush_write_17189 iwl_dbgfs_txfifo_flush_write 3 17189 &access_remote_vm_17189 nohasharray
116334 +ocfs2_flock_handle_signal_17189 ocfs2_flock_handle_signal 0 17189 &iwl_dbgfs_txfifo_flush_write_17189
116335 +iscsit_find_cmd_from_itt_or_dump_17194 iscsit_find_cmd_from_itt_or_dump 3 17194 NULL nohasharray
116336 +driver_state_read_17194 driver_state_read 3 17194 &iscsit_find_cmd_from_itt_or_dump_17194
116337 +sync_request_17208 sync_request 2 17208 NULL
116338 +dn_recvmsg_17213 dn_recvmsg 4 17213 NULL
116339 +lprocfs_read_frac_helper_17261 lprocfs_read_frac_helper 0 17261 NULL
116340 +error_error_frame_cts_nul_flid_read_17262 error_error_frame_cts_nul_flid_read 3 17262 NULL
116341 +alloc_ep_17269 alloc_ep 1 17269 NULL
116342 +pg_read_17276 pg_read 3 17276 NULL
116343 +raw_recvmsg_17277 raw_recvmsg 4 17277 NULL
116344 +hmac_sha256_17278 hmac_sha256 2 17278 NULL
116345 +neigh_hash_grow_17283 neigh_hash_grow 2 17283 NULL
116346 +minstrel_stats_read_17290 minstrel_stats_read 3 17290 NULL
116347 +ieee80211_if_fmt_dot11MeshForwarding_17301 ieee80211_if_fmt_dot11MeshForwarding 3 17301 NULL
116348 +mb_cache_create_17307 mb_cache_create 2 17307 NULL
116349 +gnttab_map_frames_v2_17314 gnttab_map_frames_v2 2 17314 NULL
116350 +ieee80211_if_read_dot11MeshHWMPperrMinInterval_17346 ieee80211_if_read_dot11MeshHWMPperrMinInterval 3 17346 NULL
116351 +ath6kl_wmi_send_mgmt_cmd_17347 ath6kl_wmi_send_mgmt_cmd 7 17347 NULL
116352 +mdc_import_seq_write_17409 mdc_import_seq_write 3 17409 NULL
116353 +lpfc_debugfs_dif_err_write_17424 lpfc_debugfs_dif_err_write 3 17424 NULL
116354 +compat_sys_ppoll_17430 compat_sys_ppoll 2 17430 NULL
116355 +sta_connected_time_read_17435 sta_connected_time_read 3 17435 NULL
116356 +libcfs_ipif_enumerate_17445 libcfs_ipif_enumerate 0 17445 NULL
116357 +xfs_btree_lshift_17448 xfs_btree_lshift 0 17448 NULL
116358 +nla_get_u32_17455 nla_get_u32 0 17455 NULL
116359 +__ref_totlen_17461 __ref_totlen 0 17461 NULL
116360 +probe_kernel_write_17481 probe_kernel_write 3 17481 NULL
116361 +TSS_rawhmac_17486 TSS_rawhmac 3 17486 NULL
116362 +lbs_highrssi_write_17515 lbs_highrssi_write 3 17515 NULL
116363 +qp_free_res_17541 qp_free_res 5 17541 NULL
116364 +__copy_to_user_17551 __copy_to_user 3-0 17551 NULL
116365 +copy_from_user_17559 copy_from_user 0-3 17559 NULL
116366 +hash_netport4_expire_17573 hash_netport4_expire 4 17573 NULL
116367 +acpi_ut_create_package_object_17594 acpi_ut_create_package_object 1 17594 NULL
116368 +neigh_hash_alloc_17595 neigh_hash_alloc 1 17595 NULL
116369 +osst_execute_17607 osst_execute 7-6 17607 NULL
116370 +ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout_17618 ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout 3 17618 NULL
116371 +dma_map_page_17628 dma_map_page 0 17628 NULL
116372 +twl4030_set_gpio_direction_17645 twl4030_set_gpio_direction 1 17645 NULL
116373 +SYSC_migrate_pages_17657 SYSC_migrate_pages 2 17657 NULL
116374 +packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
116375 +pwr_enable_ps_read_17686 pwr_enable_ps_read 3 17686 NULL
116376 +filemap_fdatawait_17688 filemap_fdatawait 0 17688 NULL
116377 +venus_rename_17707 venus_rename 4-5 17707 NULL nohasharray
116378 +__einj_error_trigger_17707 __einj_error_trigger 0 17707 &venus_rename_17707
116379 +exofs_read_lookup_dev_table_17733 exofs_read_lookup_dev_table 3 17733 NULL
116380 +sctpprobe_read_17741 sctpprobe_read 3 17741 NULL
116381 +dgap_do_fep_load_17765 dgap_do_fep_load 3 17765 NULL
116382 +shrink_slab_node_17794 shrink_slab_node 3 17794 NULL
116383 +gnet_stats_copy_app_17821 gnet_stats_copy_app 3 17821 NULL
116384 +cipso_v4_gentag_rbm_17836 cipso_v4_gentag_rbm 0 17836 NULL
116385 +em28xx_audio_ep_packet_size_17844 em28xx_audio_ep_packet_size 0 17844 NULL
116386 +dm_stats_message_17863 dm_stats_message 5 17863 NULL
116387 +sisusb_send_bulk_msg_17864 sisusb_send_bulk_msg 3 17864 NULL
116388 +alloc_sja1000dev_17868 alloc_sja1000dev 1 17868 NULL
116389 +virtio_cread32_17873 virtio_cread32 0 17873 NULL
116390 +ray_cs_essid_proc_write_17875 ray_cs_essid_proc_write 3 17875 NULL
116391 +orinoco_set_key_17878 orinoco_set_key 5-7 17878 NULL nohasharray
116392 +i40e_align_l2obj_base_17878 i40e_align_l2obj_base 0-1 17878 &orinoco_set_key_17878
116393 +init_per_cpu_17880 init_per_cpu 1 17880 NULL
116394 +ieee80211_if_fmt_dot11MeshMaxPeerLinks_17883 ieee80211_if_fmt_dot11MeshMaxPeerLinks 3 17883 NULL
116395 +ieee80211_if_fmt_dot11MeshHWMPRootMode_17890 ieee80211_if_fmt_dot11MeshHWMPRootMode 3 17890 NULL
116396 +xfs_buf_associate_memory_17915 xfs_buf_associate_memory 3 17915 NULL
116397 +xfs_rtallocate_extent_near_17916 xfs_rtallocate_extent_near 0 17916 NULL
116398 +scsi_bufflen_17933 scsi_bufflen 0 17933 NULL
116399 +__mutex_lock_check_stamp_17947 __mutex_lock_check_stamp 0 17947 NULL
116400 +beacon_interval_write_17952 beacon_interval_write 3 17952 NULL
116401 +calc_nr_buckets_17976 calc_nr_buckets 0 17976 NULL
116402 +ext4_ext_calc_credits_for_single_extent_17983 ext4_ext_calc_credits_for_single_extent 0-2 17983 NULL
116403 +smk_write_cipso_17989 smk_write_cipso 3 17989 NULL
116404 +gnttab_max_grant_frames_17993 gnttab_max_grant_frames 0 17993 NULL
116405 +pvr2_v4l2_read_18006 pvr2_v4l2_read 3 18006 NULL
116406 +alloc_rx_desc_ring_18016 alloc_rx_desc_ring 2 18016 NULL
116407 +cpufreq_add_dev_symlink_18028 cpufreq_add_dev_symlink 0 18028 NULL
116408 +o2hb_highest_node_18034 o2hb_highest_node 0 18034 NULL
116409 +cryptd_alloc_instance_18048 cryptd_alloc_instance 2-3 18048 NULL
116410 +__btrfs_drop_extents_18049 __btrfs_drop_extents 5 18049 NULL
116411 +ddebug_proc_write_18055 ddebug_proc_write 3 18055 NULL
116412 +lua_sysfs_read_18062 lua_sysfs_read 6 18062 NULL
116413 +fpregs_get_18066 fpregs_get 4 18066 NULL
116414 +kvm_read_guest_page_18074 kvm_read_guest_page 5 18074 NULL
116415 +SYSC_pselect6_18076 SYSC_pselect6 1 18076 NULL
116416 +SYSC_semtimedop_18091 SYSC_semtimedop 3 18091 NULL
116417 +mpi_alloc_18094 mpi_alloc 1 18094 NULL
116418 +hfs_direct_IO_18104 hfs_direct_IO 4 18104 NULL
116419 +dfs_file_read_18116 dfs_file_read 3 18116 NULL
116420 +svc_getnl_18120 svc_getnl 0 18120 NULL
116421 +paging32_gpte_to_gfn_lvl_18131 paging32_gpte_to_gfn_lvl 0-2-1 18131 NULL
116422 +xfs_zero_eof_18134 xfs_zero_eof 0 18134 NULL
116423 +selinux_inode_setsecurity_18148 selinux_inode_setsecurity 4 18148 NULL
116424 +pccard_store_cis_18176 pccard_store_cis 6 18176 NULL
116425 +orinoco_add_extscan_result_18207 orinoco_add_extscan_result 3 18207 NULL
116426 +gsm_control_message_18209 gsm_control_message 4 18209 NULL
116427 +read_rindex_entry_18213 read_rindex_entry 0 18213 NULL
116428 +do_ipv6_setsockopt_18215 do_ipv6_setsockopt 5 18215 NULL
116429 +gnttab_alloc_grant_references_18240 gnttab_alloc_grant_references 1 18240 NULL
116430 +alloc_trace_uprobe_18247 alloc_trace_uprobe 3 18247 NULL
116431 +rfcomm_sock_setsockopt_18254 rfcomm_sock_setsockopt 5 18254 NULL
116432 +qdisc_class_hash_alloc_18262 qdisc_class_hash_alloc 1 18262 NULL
116433 +gfs2_alloc_sort_buffer_18275 gfs2_alloc_sort_buffer 1 18275 NULL
116434 +alloc_ring_18278 alloc_ring 2-4 18278 NULL
116435 +bio_phys_segments_18281 bio_phys_segments 0 18281 NULL nohasharray
116436 +nouveau_subdev_create__18281 nouveau_subdev_create_ 7 18281 &bio_phys_segments_18281
116437 +ext4_readpages_18283 ext4_readpages 4 18283 NULL
116438 +mmc_send_bus_test_18285 mmc_send_bus_test 4 18285 NULL
116439 +um_idi_write_18293 um_idi_write 3 18293 NULL
116440 +nouveau_disp_create__18305 nouveau_disp_create_ 4-7 18305 NULL
116441 +vga_r_18310 vga_r 0 18310 NULL
116442 +class_add_profile_18315 class_add_profile 1-3-5 18315 NULL
116443 +csio_mem_read_18319 csio_mem_read 3 18319 NULL
116444 +alloc_and_copy_string_18321 alloc_and_copy_string 2 18321 NULL
116445 +ecryptfs_send_message_18322 ecryptfs_send_message 2 18322 NULL
116446 +bio_integrity_advance_18324 bio_integrity_advance 2 18324 NULL
116447 +lcd_proc_write_18351 lcd_proc_write 3 18351 NULL
116448 +pwr_power_save_off_read_18355 pwr_power_save_off_read 3 18355 NULL
116449 +SyS_process_vm_readv_18366 SyS_process_vm_readv 3-5 18366 NULL
116450 +ep_io_18367 ep_io 0 18367 NULL
116451 +qib_user_sdma_num_pages_18371 qib_user_sdma_num_pages 0 18371 NULL
116452 +__ceph_getxattr_18386 __ceph_getxattr 0 18386 NULL
116453 +ci_role_write_18388 ci_role_write 3 18388 NULL
116454 +hdlc_empty_fifo_18397 hdlc_empty_fifo 2 18397 NULL
116455 +adis16136_show_serial_18402 adis16136_show_serial 3 18402 NULL
116456 +crystalhd_user_data_18407 crystalhd_user_data 3 18407 NULL
116457 +memblock_virt_alloc_node_nopanic_18431 memblock_virt_alloc_node_nopanic 1 18431 NULL
116458 +iscsi_create_flashnode_sess_18433 iscsi_create_flashnode_sess 4 18433 NULL
116459 +snd_hda_get_connections_18437 snd_hda_get_connections 0 18437 NULL
116460 +flash_dev_cache_miss_18454 flash_dev_cache_miss 4 18454 NULL
116461 +fuse_perform_write_18457 fuse_perform_write 4 18457 NULL
116462 +regset_tls_set_18459 regset_tls_set 4 18459 NULL
116463 +pci_vpd_lrdt_size_18479 pci_vpd_lrdt_size 0 18479 NULL nohasharray
116464 +mite_bytes_in_transit_18479 mite_bytes_in_transit 0 18479 &pci_vpd_lrdt_size_18479
116465 +udpv6_setsockopt_18487 udpv6_setsockopt 5 18487 NULL
116466 +btrfs_fiemap_18501 btrfs_fiemap 3 18501 NULL
116467 +__copy_user_zeroing_intel_18510 __copy_user_zeroing_intel 0-3 18510 NULL
116468 +__block_write_begin_18511 __block_write_begin 0 18511 NULL
116469 +snd_vx_inb_18514 snd_vx_inb 0 18514 NULL
116470 +snd_gus_dram_poke_18525 snd_gus_dram_poke 4 18525 NULL
116471 +nouveau_fifo_channel_create__18530 nouveau_fifo_channel_create_ 9 18530 NULL
116472 +seq_copy_in_user_18543 seq_copy_in_user 3 18543 NULL
116473 +sas_change_queue_depth_18555 sas_change_queue_depth 2 18555 NULL
116474 +smk_write_rules_list_18565 smk_write_rules_list 3 18565 NULL
116475 +debug_output_18575 debug_output 3 18575 NULL
116476 +xfs_btree_read_bufl_18597 xfs_btree_read_bufl 0 18597 NULL
116477 +filemap_fdatawait_range_18600 filemap_fdatawait_range 0 18600 NULL
116478 +iowarrior_write_18604 iowarrior_write 3 18604 NULL
116479 +nvc0_ram_create__18624 nvc0_ram_create_ 4 18624 NULL
116480 +from_buffer_18625 from_buffer 3 18625 NULL
116481 +snd_pcm_oss_write3_18657 snd_pcm_oss_write3 0-3 18657 NULL
116482 +ieee80211_if_fmt_rssi_threshold_18664 ieee80211_if_fmt_rssi_threshold 3 18664 NULL
116483 +xfs_iext_insert_18667 xfs_iext_insert 3 18667 NULL
116484 +fnic_stats_debugfs_read_18688 fnic_stats_debugfs_read 3 18688 NULL
116485 +echo_client_prep_commit_18693 echo_client_prep_commit 8 18693 NULL
116486 +iwl_dbgfs_rx_handlers_read_18708 iwl_dbgfs_rx_handlers_read 3 18708 NULL
116487 +ceph_alloc_page_vector_18710 ceph_alloc_page_vector 1 18710 NULL
116488 +blk_rq_bytes_18715 blk_rq_bytes 0 18715 NULL
116489 +snd_als4k_gcr_read_addr_18741 snd_als4k_gcr_read_addr 0 18741 NULL
116490 +o2hb_debug_create_18744 o2hb_debug_create 4 18744 NULL
116491 +__erst_read_to_erange_from_nvram_18748 __erst_read_to_erange_from_nvram 0 18748 NULL
116492 +wep_packets_read_18751 wep_packets_read 3 18751 NULL
116493 +read_file_dump_nfcal_18766 read_file_dump_nfcal 3 18766 NULL
116494 +ffs_epfile_read_18775 ffs_epfile_read 3 18775 NULL
116495 +SyS_lsetxattr_18776 SyS_lsetxattr 4 18776 NULL
116496 +alloc_fcdev_18780 alloc_fcdev 1 18780 NULL
116497 +dm_stats_print_18815 dm_stats_print 7 18815 NULL
116498 +sys_modify_ldt_18824 sys_modify_ldt 3 18824 NULL
116499 +mtf_test_write_18844 mtf_test_write 3 18844 NULL
116500 +sctp_setsockopt_events_18862 sctp_setsockopt_events 3 18862 NULL
116501 +ieee80211_if_read_element_ttl_18869 ieee80211_if_read_element_ttl 3 18869 NULL
116502 +xlog_find_verify_log_record_18870 xlog_find_verify_log_record 2 18870 NULL
116503 +ceph_setxattr_18913 ceph_setxattr 4 18913 NULL
116504 +ieee80211_rx_mgmt_disassoc_18927 ieee80211_rx_mgmt_disassoc 3 18927 NULL
116505 +snapshot_write_next_18937 snapshot_write_next 0 18937 NULL
116506 +clean_journal_18955 clean_journal 0 18955 NULL
116507 +__nla_reserve_18974 __nla_reserve 3 18974 NULL
116508 +__blockdev_direct_IO_18977 __blockdev_direct_IO 0-6 18977 NULL
116509 +layout_in_gaps_19006 layout_in_gaps 2 19006 NULL
116510 +huge_page_size_19008 huge_page_size 0 19008 NULL
116511 +hash_netport6_expire_19013 hash_netport6_expire 4 19013 NULL
116512 +sysfs_create_dir_ns_19033 sysfs_create_dir_ns 0 19033 NULL
116513 +revalidate_19043 revalidate 2 19043 NULL
116514 +afs_vnode_store_data_19048 afs_vnode_store_data 2-3-4-5 19048 NULL
116515 +osc_pinger_recov_seq_write_19056 osc_pinger_recov_seq_write 3 19056 NULL
116516 +get_log_header_19063 get_log_header 0 19063 NULL
116517 +create_gpadl_header_19064 create_gpadl_header 2 19064 NULL
116518 +ceph_create_snap_context_19082 ceph_create_snap_context 1 19082 NULL
116519 +sta_last_seq_ctrl_read_19106 sta_last_seq_ctrl_read 3 19106 NULL
116520 +cifs_readv_from_socket_19109 cifs_readv_from_socket 3 19109 NULL
116521 +snd_als4k_iobase_readl_19136 snd_als4k_iobase_readl 0 19136 NULL
116522 +alloc_irdadev_19140 alloc_irdadev 1 19140 NULL
116523 +sleep_auth_read_19159 sleep_auth_read 3 19159 NULL
116524 +smk_write_access2_19170 smk_write_access2 3 19170 NULL
116525 +iwl_dbgfs_reply_tx_error_read_19205 iwl_dbgfs_reply_tx_error_read 3 19205 NULL
116526 +vmw_unlocked_ioctl_19212 vmw_unlocked_ioctl 2 19212 NULL
116527 +__copy_to_user_inatomic_19214 __copy_to_user_inatomic 3-0 19214 NULL
116528 +dev_counters_read_19216 dev_counters_read 3 19216 NULL
116529 +wbcir_tx_19219 wbcir_tx 3 19219 NULL
116530 +snd_mask_max_19224 snd_mask_max 0 19224 NULL
116531 +bio_alloc_mddev_19238 bio_alloc_mddev 2 19238 NULL
116532 +ucma_query_19260 ucma_query 4 19260 NULL
116533 +il_dbgfs_rxon_filter_flags_read_19281 il_dbgfs_rxon_filter_flags_read 3 19281 NULL
116534 +batadv_tt_save_orig_buffer_19288 batadv_tt_save_orig_buffer 4 19288 NULL nohasharray
116535 +cfg80211_rx_unprot_mlme_mgmt_19288 cfg80211_rx_unprot_mlme_mgmt 3 19288 &batadv_tt_save_orig_buffer_19288
116536 +qc_capture_19298 qc_capture 3 19298 NULL
116537 +ocfs2_prepare_inode_for_refcount_19303 ocfs2_prepare_inode_for_refcount 4-3 19303 NULL
116538 +event_tx_stuck_read_19305 event_tx_stuck_read 3 19305 NULL
116539 +debug_read_19322 debug_read 3 19322 NULL
116540 +lbs_host_sleep_write_19332 lbs_host_sleep_write 3 19332 NULL nohasharray
116541 +cfg80211_inform_bss_19332 cfg80211_inform_bss 8 19332 &lbs_host_sleep_write_19332
116542 +closure_sub_19359 closure_sub 2 19359 NULL
116543 +firmware_data_write_19360 firmware_data_write 6-5 19360 NULL
116544 +read_zero_19366 read_zero 3 19366 NULL
116545 +interpret_user_input_19393 interpret_user_input 2 19393 NULL
116546 +sync_fill_pt_info_19397 sync_fill_pt_info 0 19397 NULL
116547 +pep_recvmsg_19402 pep_recvmsg 4 19402 NULL
116548 +dvbdmx_write_19423 dvbdmx_write 3 19423 NULL
116549 +SyS_sched_getaffinity_19444 SyS_sched_getaffinity 2 19444 NULL
116550 +xfrm_alg_auth_len_19454 xfrm_alg_auth_len 0 19454 NULL
116551 +gnet_stats_copy_19458 gnet_stats_copy 4 19458 NULL
116552 +gp2ap020a00f_get_thresh_reg_19468 gp2ap020a00f_get_thresh_reg 0 19468 NULL
116553 +sky2_read16_19475 sky2_read16 0 19475 NULL
116554 +__read_status_pciv2_19492 __read_status_pciv2 0 19492 NULL
116555 +kstrtoll_from_user_19500 kstrtoll_from_user 2 19500 NULL
116556 +ext4_add_new_descs_19509 ext4_add_new_descs 3 19509 NULL
116557 +batadv_tvlv_container_register_19520 batadv_tvlv_container_register 5 19520 NULL
116558 +apei_exec_pre_map_gars_19529 apei_exec_pre_map_gars 0 19529 NULL nohasharray
116559 +cfc_write_array_to_buffer_19529 cfc_write_array_to_buffer 3 19529 &apei_exec_pre_map_gars_19529
116560 +nfc_llcp_build_tlv_19536 nfc_llcp_build_tlv 3 19536 NULL
116561 +gfn_to_index_19558 gfn_to_index 0-1-3-2 19558 NULL
116562 +ocfs2_control_message_19564 ocfs2_control_message 3 19564 NULL
116563 +nfsd_read_19568 nfsd_read 5 19568 NULL
116564 +ieee80211_key_alloc_19575 ieee80211_key_alloc 3 19575 NULL
116565 +mnt_want_write_file_19579 mnt_want_write_file 0 19579 NULL
116566 +bm_status_read_19583 bm_status_read 3 19583 NULL
116567 +load_xattr_datum_19594 load_xattr_datum 0 19594 NULL
116568 +fallocate_chunk_19610 fallocate_chunk 0 19610 NULL
116569 +__mei_cl_recv_19636 __mei_cl_recv 3 19636 NULL
116570 +LoadBitmap_19658 LoadBitmap 2 19658 NULL
116571 +memblock_virt_alloc_low_nopanic_19714 memblock_virt_alloc_low_nopanic 1 19714 NULL
116572 +ocfs2_control_get_this_node_19721 ocfs2_control_get_this_node 0 19721 NULL
116573 +read_reg_19723 read_reg 0 19723 NULL
116574 +wm8350_block_write_19727 wm8350_block_write 2-3 19727 NULL
116575 +memcpy_toiovecend_19736 memcpy_toiovecend 4-3 19736 NULL
116576 +snd_es1968_get_dma_ptr_19747 snd_es1968_get_dma_ptr 0 19747 NULL
116577 +p9_client_read_19750 p9_client_read 5-0 19750 NULL
116578 +pnpbios_proc_write_19758 pnpbios_proc_write 3 19758 NULL
116579 +ocfs2_readpages_19759 ocfs2_readpages 4 19759 NULL
116580 +jffs2_acl_from_medium_19762 jffs2_acl_from_medium 2 19762 NULL
116581 +readhscx_19769 readhscx 0 19769 NULL
116582 +irda_setsockopt_19824 irda_setsockopt 5 19824 NULL
116583 +xfs_bmap_add_extent_hole_real_19828 xfs_bmap_add_extent_hole_real 0 19828 NULL
116584 +vfs_getxattr_19832 vfs_getxattr 0 19832 NULL
116585 +crypt_alloc_buffer_19846 crypt_alloc_buffer 2 19846 NULL
116586 +cfg80211_mlme_register_mgmt_19852 cfg80211_mlme_register_mgmt 5 19852 NULL
116587 +__nla_put_19857 __nla_put 3 19857 NULL
116588 +mrp_request_join_19882 mrp_request_join 4 19882 NULL
116589 +aes_decrypt_interrupt_read_19910 aes_decrypt_interrupt_read 3 19910 NULL
116590 +ps_upsd_max_apturn_read_19918 ps_upsd_max_apturn_read 3 19918 NULL
116591 +mangle_name_19923 mangle_name 0 19923 NULL
116592 +cgroup_task_count_19930 cgroup_task_count 0 19930 NULL
116593 +guest_read_tsc_19931 guest_read_tsc 0 19931 NULL
116594 +iwl_dbgfs_rx_queue_read_19943 iwl_dbgfs_rx_queue_read 3 19943 NULL
116595 +cfg80211_rx_assoc_resp_19944 cfg80211_rx_assoc_resp 4 19944 NULL
116596 +ll_xattr_cache_list_19954 ll_xattr_cache_list 0 19954 NULL
116597 +get_jack_mode_name_19976 get_jack_mode_name 4 19976 NULL
116598 +attach_hdlc_protocol_19986 attach_hdlc_protocol 3 19986 NULL
116599 +rtw_set_wps_probe_resp_19989 rtw_set_wps_probe_resp 3 19989 NULL
116600 +diva_um_idi_read_20003 diva_um_idi_read 0 20003 NULL
116601 +lov_stripe_md_size_20009 lov_stripe_md_size 0-1 20009 NULL nohasharray
116602 +event_trigger_write_20009 event_trigger_write 3 20009 &lov_stripe_md_size_20009
116603 +tree_mod_log_eb_move_20011 tree_mod_log_eb_move 5 20011 NULL
116604 +SYSC_fgetxattr_20027 SYSC_fgetxattr 4 20027 NULL
116605 +split_scan_timeout_read_20029 split_scan_timeout_read 3 20029 NULL
116606 +alloc_ieee80211_20063 alloc_ieee80211 1 20063 NULL
116607 +iwl_mvm_power_mac_dbgfs_read_20067 iwl_mvm_power_mac_dbgfs_read 4 20067 NULL
116608 +target_message_20072 target_message 2 20072 NULL
116609 +rawv6_sendmsg_20080 rawv6_sendmsg 4 20080 NULL
116610 +fuse_conn_limit_read_20084 fuse_conn_limit_read 3 20084 NULL
116611 +aat2870_reg_write_file_20086 aat2870_reg_write_file 3 20086 NULL
116612 +team_options_register_20091 team_options_register 3 20091 NULL
116613 +qla2x00_adjust_sdev_qdepth_up_20097 qla2x00_adjust_sdev_qdepth_up 2 20097 NULL
116614 +xfs_qm_dqget_20103 xfs_qm_dqget 0 20103 NULL
116615 +root_nfs_copy_20111 root_nfs_copy 3 20111 NULL
116616 +hptiop_adjust_disk_queue_depth_20122 hptiop_adjust_disk_queue_depth 2 20122 NULL
116617 +tomoyo_commit_ok_20167 tomoyo_commit_ok 2 20167 NULL
116618 +read_flush_pipefs_20171 read_flush_pipefs 3 20171 NULL
116619 +wep_addr_key_count_read_20174 wep_addr_key_count_read 3 20174 NULL
116620 +crystalhd_map_dio_20181 crystalhd_map_dio 3 20181 NULL
116621 +pvr2_ctrl_value_to_sym_20229 pvr2_ctrl_value_to_sym 5 20229 NULL
116622 +rose_sendmsg_20249 rose_sendmsg 4 20249 NULL
116623 +tm6000_i2c_send_regs_20250 tm6000_i2c_send_regs 5 20250 NULL
116624 +btrfs_header_nritems_20296 btrfs_header_nritems 0 20296 NULL
116625 +r10_sync_page_io_20307 r10_sync_page_io 3 20307 NULL
116626 +dm_get_reserved_bio_based_ios_20315 dm_get_reserved_bio_based_ios 0 20315 NULL
116627 +tx_tx_burst_programmed_read_20320 tx_tx_burst_programmed_read 3 20320 NULL
116628 +vx_send_msg_nolock_20322 vx_send_msg_nolock 0 20322 NULL
116629 +snd_cs4281_BA1_read_20323 snd_cs4281_BA1_read 5 20323 NULL
116630 +gfs2_glock_nq_m_20347 gfs2_glock_nq_m 1 20347 NULL
116631 +handle_arr_calc_size_20355 handle_arr_calc_size 0-1 20355 NULL
116632 +smk_set_cipso_20379 smk_set_cipso 3 20379 NULL
116633 +snd_nm256_readl_20394 snd_nm256_readl 0 20394 NULL nohasharray
116634 +read_7220_creg32_20394 read_7220_creg32 0 20394 &snd_nm256_readl_20394
116635 +__kfifo_from_user_20399 __kfifo_from_user 3 20399 NULL nohasharray
116636 +SyS_get_mempolicy_20399 SyS_get_mempolicy 3 20399 &__kfifo_from_user_20399
116637 +compat_ipv6_setsockopt_20468 compat_ipv6_setsockopt 5 20468 NULL
116638 +read_buf_20469 read_buf 2 20469 NULL
116639 +bio_trim_20472 bio_trim 2 20472 NULL
116640 +btrfs_get_32_20476 btrfs_get_32 0 20476 NULL
116641 +xfs_iext_realloc_direct_20521 xfs_iext_realloc_direct 2 20521 NULL
116642 +drbd_bm_resize_20522 drbd_bm_resize 2 20522 NULL
116643 +amd_create_gatt_pages_20537 amd_create_gatt_pages 1 20537 NULL
116644 +scsi_report_opcode_20551 scsi_report_opcode 3 20551 NULL
116645 +venus_create_20555 venus_create 4 20555 NULL
116646 +btrfs_super_log_root_20565 btrfs_super_log_root 0 20565 NULL
116647 +crypto_ahash_reqsize_20569 crypto_ahash_reqsize 0 20569 NULL
116648 +xfs_bmap_isaeof_20570 xfs_bmap_isaeof 0 20570 NULL
116649 +ocfs2_cluster_lock_20588 ocfs2_cluster_lock 0 20588 NULL
116650 +kvm_test_age_hva_20593 kvm_test_age_hva 2 20593 NULL
116651 +sync_timeline_create_20601 sync_timeline_create 2 20601 NULL
116652 +lirc_write_20604 lirc_write 3 20604 NULL
116653 +qib_qsfp_write_20614 qib_qsfp_write 0-2-4 20614 NULL
116654 +snd_pcm_oss_prepare_20641 snd_pcm_oss_prepare 0 20641 NULL
116655 +get_extent_skip_holes_20642 get_extent_skip_holes 2 20642 NULL
116656 +kfifo_copy_to_user_20646 kfifo_copy_to_user 3-4 20646 NULL
116657 +cpulist_scnprintf_20648 cpulist_scnprintf 2-0 20648 NULL
116658 +oz_add_farewell_20652 oz_add_farewell 5 20652 NULL
116659 +oz_cdev_read_20659 oz_cdev_read 3 20659 NULL
116660 +snd_hdsp_playback_copy_20676 snd_hdsp_playback_copy 5 20676 NULL nohasharray
116661 +btrfs_qgroup_reserve_20676 btrfs_qgroup_reserve 0 20676 &snd_hdsp_playback_copy_20676
116662 +dvb_dmxdev_buffer_read_20682 dvb_dmxdev_buffer_read 0-4 20682 NULL
116663 +cpumask_size_20683 cpumask_size 0 20683 NULL
116664 +btrfs_node_blockptr_20685 btrfs_node_blockptr 0 20685 NULL
116665 +read_file_tgt_int_stats_20697 read_file_tgt_int_stats 3 20697 NULL
116666 +__maestro_read_20700 __maestro_read 0 20700 NULL
116667 +cipso_v4_gentag_rng_20703 cipso_v4_gentag_rng 0 20703 NULL
116668 +pcpu_page_first_chunk_20712 pcpu_page_first_chunk 1 20712 NULL
116669 +ocfs2_read_xattr_bucket_20722 ocfs2_read_xattr_bucket 0 20722 NULL
116670 +security_context_to_sid_force_20724 security_context_to_sid_force 2 20724 NULL
116671 +fb_prepare_logo_20743 fb_prepare_logo 0 20743 NULL
116672 +vol_cdev_direct_write_20751 vol_cdev_direct_write 3 20751 NULL
116673 +ocfs2_align_bytes_to_clusters_20754 ocfs2_align_bytes_to_clusters 2 20754 NULL
116674 +brcmf_p2p_escan_20763 brcmf_p2p_escan 2 20763 NULL nohasharray
116675 +mnt_clone_write_20763 mnt_clone_write 0 20763 &brcmf_p2p_escan_20763
116676 +fb_alloc_cmap_gfp_20792 fb_alloc_cmap_gfp 2 20792 NULL
116677 +iwl_dbgfs_rxon_flags_read_20795 iwl_dbgfs_rxon_flags_read 3 20795 NULL
116678 +lowpan_write_20800 lowpan_write 3 20800 NULL
116679 +strndup_user_20819 strndup_user 2 20819 NULL nohasharray
116680 +do_glock_20819 do_glock 0 20819 &strndup_user_20819
116681 +tipc_msg_build_20825 tipc_msg_build 3 20825 NULL
116682 +wl1271_format_buffer_20834 wl1271_format_buffer 2 20834 NULL
116683 +uvc_alloc_entity_20836 uvc_alloc_entity 4-3 20836 NULL
116684 +p9_tag_alloc_20845 p9_tag_alloc 3 20845 NULL
116685 +nvme_trans_supported_vpd_pages_20847 nvme_trans_supported_vpd_pages 4 20847 NULL
116686 +get_name_20855 get_name 4 20855 NULL
116687 +iwl_dbgfs_pm_params_read_20866 iwl_dbgfs_pm_params_read 3 20866 NULL
116688 +snd_pcm_capture_avail_20867 snd_pcm_capture_avail 0 20867 NULL
116689 +srq_free_res_20868 srq_free_res 5 20868 NULL
116690 +cfs_cpt_table_create_20884 cfs_cpt_table_create 1 20884 NULL
116691 +rb_simple_write_20890 rb_simple_write 3 20890 NULL
116692 +sisusb_send_packet_20891 sisusb_send_packet 2 20891 NULL
116693 +key_icverrors_read_20895 key_icverrors_read 3 20895 NULL
116694 +vfio_msi_enable_20906 vfio_msi_enable 2 20906 NULL
116695 +lbs_rdbbp_write_20918 lbs_rdbbp_write 3 20918 NULL
116696 +htable_bits_20933 htable_bits 0 20933 NULL
116697 +altera_set_ir_post_20948 altera_set_ir_post 2 20948 NULL
116698 +rx_rx_phy_hdr_read_20950 rx_rx_phy_hdr_read 3 20950 NULL
116699 +rsxx_cram_read_20957 rsxx_cram_read 3 20957 NULL
116700 +nfs_map_name_to_uid_20962 nfs_map_name_to_uid 3 20962 NULL
116701 +snd_rme9652_playback_copy_20970 snd_rme9652_playback_copy 5 20970 NULL
116702 +alg_setsockopt_20985 alg_setsockopt 5 20985 NULL
116703 +qib_verbs_send_20999 qib_verbs_send 5-3 20999 NULL
116704 +btrfs_dirty_pages_21019 btrfs_dirty_pages 0 21019 NULL
116705 +btrfs_inode_ref_name_len_21024 btrfs_inode_ref_name_len 0 21024 NULL
116706 +xfs_btree_new_root_21028 xfs_btree_new_root 0 21028 NULL
116707 +rx_defrag_tkip_called_read_21031 rx_defrag_tkip_called_read 3 21031 NULL
116708 +srp_change_queue_depth_21038 srp_change_queue_depth 2 21038 NULL
116709 +lbs_threshold_read_21046 lbs_threshold_read 5 21046 NULL
116710 +reiserfs_direct_IO_21051 reiserfs_direct_IO 4 21051 NULL
116711 +proc_fault_inject_write_21058 proc_fault_inject_write 3 21058 NULL
116712 +qdisc_get_default_21072 qdisc_get_default 2 21072 NULL
116713 +event_calibration_read_21083 event_calibration_read 3 21083 NULL
116714 +bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
116715 +multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
116716 +rate_control_pid_events_read_21099 rate_control_pid_events_read 3 21099 NULL
116717 +ath6kl_send_go_probe_resp_21113 ath6kl_send_go_probe_resp 3 21113 NULL
116718 +_efx_mcdi_rpc_async_21119 _efx_mcdi_rpc_async 4-5 21119 NULL
116719 +i2400m_rx_trace_21127 i2400m_rx_trace 3 21127 NULL
116720 +cx18_v4l2_read_21196 cx18_v4l2_read 3 21196 NULL
116721 +ipc_rcu_alloc_21208 ipc_rcu_alloc 1 21208 NULL
116722 +scsi_execute_req_flags_21215 scsi_execute_req_flags 5 21215 NULL
116723 +get_numpages_21227 get_numpages 0-1-2 21227 NULL
116724 +input_ff_create_21240 input_ff_create 2 21240 NULL
116725 +cfg80211_notify_new_peer_candidate_21242 cfg80211_notify_new_peer_candidate 4 21242 NULL
116726 +use_debug_keys_read_21251 use_debug_keys_read 3 21251 NULL
116727 +fru_length_21257 fru_length 0 21257 NULL
116728 +rtw_set_wps_beacon_21262 rtw_set_wps_beacon 3 21262 NULL
116729 +xfs_alloc_ag_vextent_size_21276 xfs_alloc_ag_vextent_size 0 21276 NULL
116730 +do_msg_fill_21307 do_msg_fill 3 21307 NULL
116731 +add_res_range_21310 add_res_range 4 21310 NULL
116732 +get_zeroed_page_21322 get_zeroed_page 0 21322 NULL
116733 +ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
116734 +read_file_bool_bmps_21344 read_file_bool_bmps 3 21344 NULL
116735 +gfs2_ea_get_copy_21353 gfs2_ea_get_copy 0 21353 NULL
116736 +alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
116737 +SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
116738 +video_ioctl2_21380 video_ioctl2 2 21380 NULL
116739 +insert_ptr_21386 insert_ptr 6 21386 NULL
116740 +diva_get_driver_dbg_mask_21399 diva_get_driver_dbg_mask 0 21399 NULL
116741 +__clone_and_map_simple_bio_21404 __clone_and_map_simple_bio 4 21404 NULL
116742 +snd_m3_inw_21406 snd_m3_inw 0 21406 NULL
116743 +usnic_ib_dump_vf_hdr_21423 usnic_ib_dump_vf_hdr 3 21423 NULL
116744 +snapshot_read_next_21426 snapshot_read_next 0 21426 NULL
116745 +tcp_bound_to_half_wnd_21429 tcp_bound_to_half_wnd 0-2 21429 NULL
116746 +tracing_saved_cmdlines_read_21434 tracing_saved_cmdlines_read 3 21434 NULL
116747 +aggr_size_tx_agg_vs_rate_read_21438 aggr_size_tx_agg_vs_rate_read 3 21438 NULL
116748 +__ertm_hdr_size_21450 __ertm_hdr_size 0 21450 NULL
116749 +ReadISAR_21453 ReadISAR 0 21453 NULL
116750 +mei_nfc_send_21477 mei_nfc_send 3 21477 NULL
116751 +read_file_xmit_21487 read_file_xmit 3 21487 NULL
116752 +mmc_alloc_sg_21504 mmc_alloc_sg 1 21504 NULL
116753 +btrfs_file_aio_write_21520 btrfs_file_aio_write 4 21520 NULL
116754 +il_dbgfs_stations_read_21532 il_dbgfs_stations_read 3 21532 NULL
116755 +cipso_v4_map_cat_enum_hton_21540 cipso_v4_map_cat_enum_hton 0 21540 NULL
116756 +rxrpc_send_data_21553 rxrpc_send_data 5 21553 NULL
116757 +rx_rx_beacon_early_term_read_21559 rx_rx_beacon_early_term_read 3 21559 NULL
116758 +xfs_buf_read_uncached_21585 xfs_buf_read_uncached 3 21585 NULL
116759 +snd_es18xx_mixer_read_21586 snd_es18xx_mixer_read 0 21586 NULL
116760 +ocfs2_acl_from_xattr_21604 ocfs2_acl_from_xattr 2 21604 NULL
116761 +filemap_get_page_21606 filemap_get_page 2 21606 NULL
116762 +gfs2_glock_nq_init_21624 gfs2_glock_nq_init 0 21624 NULL
116763 +__jfs_getxattr_21631 __jfs_getxattr 0 21631 NULL
116764 +atalk_sendmsg_21677 atalk_sendmsg 4 21677 NULL
116765 +ocfs2_xattr_get_nolock_21678 ocfs2_xattr_get_nolock 0 21678 NULL
116766 +rtllib_alloc_txb_21687 rtllib_alloc_txb 1 21687 NULL
116767 +evdev_ioctl_handler_21705 evdev_ioctl_handler 2 21705 NULL
116768 +xfs_btree_insert_21712 xfs_btree_insert 0 21712 NULL
116769 +update_time_21719 update_time 0 21719 NULL
116770 +unix_skb_len_21722 unix_skb_len 0 21722 NULL
116771 +lprocfs_wr_import_21728 lprocfs_wr_import 3 21728 NULL
116772 +mthca_alloc_init_21754 mthca_alloc_init 2 21754 NULL
116773 +usbat_flash_read_data_21762 usbat_flash_read_data 4 21762 NULL
116774 +gen_pool_add_21776 gen_pool_add 3 21776 NULL
116775 +xfs_da_grow_inode_int_21785 xfs_da_grow_inode_int 3 21785 NULL
116776 +dvb_generic_ioctl_21810 dvb_generic_ioctl 2 21810 NULL
116777 +__ocfs2_cluster_lock_21812 __ocfs2_cluster_lock 0 21812 NULL
116778 +_iwl_dbgfs_sta_drain_write_21837 _iwl_dbgfs_sta_drain_write 3 21837 NULL
116779 +oom_adj_read_21847 oom_adj_read 3 21847 NULL
116780 +lpfc_idiag_extacc_avail_get_21865 lpfc_idiag_extacc_avail_get 0-3 21865 NULL
116781 +brcms_debugfs_hardware_read_21867 brcms_debugfs_hardware_read 3 21867 NULL
116782 +sisusbcon_bmove_21873 sisusbcon_bmove 6-5-7 21873 NULL
116783 +ldlm_lock_create_21888 ldlm_lock_create 7 21888 NULL
116784 +dbAllocCtl_21911 dbAllocCtl 0 21911 NULL
116785 +qsfp_1_read_21915 qsfp_1_read 3 21915 NULL
116786 +__build_xattrs_21979 __build_xattrs 0 21979 NULL
116787 +SYSC_prctl_21980 SYSC_prctl 4 21980 NULL
116788 +compat_rw_copy_check_uvector_22001 compat_rw_copy_check_uvector 0-3 22001 NULL nohasharray
116789 +rxpipe_descr_host_int_trig_rx_data_read_22001 rxpipe_descr_host_int_trig_rx_data_read 3 22001 &compat_rw_copy_check_uvector_22001
116790 +regcache_sync_block_raw_flush_22021 regcache_sync_block_raw_flush 3-4 22021 NULL
116791 +btrfs_get_16_22023 btrfs_get_16 0 22023 NULL
116792 +_sp2d_min_pg_22032 _sp2d_min_pg 0 22032 NULL
116793 +lookup_metapath_22039 lookup_metapath 0 22039 NULL
116794 +zd_usb_read_fw_22049 zd_usb_read_fw 4 22049 NULL
116795 +ieee80211_if_fmt_dropped_frames_ttl_22054 ieee80211_if_fmt_dropped_frames_ttl 3 22054 NULL
116796 +btrfs_reloc_clone_csums_22077 btrfs_reloc_clone_csums 2-3 22077 NULL
116797 +mem_rw_22085 mem_rw 3 22085 NULL
116798 +xfs_bmapi_reserve_delalloc_22086 xfs_bmapi_reserve_delalloc 0 22086 NULL
116799 +kstrtos32_from_user_22087 kstrtos32_from_user 2 22087 NULL
116800 +rt2x00debug_read_crypto_stats_22109 rt2x00debug_read_crypto_stats 3 22109 NULL
116801 +shmem_add_to_page_cache_22121 shmem_add_to_page_cache 0 22121 NULL
116802 +snd_hda_codec_read_22130 snd_hda_codec_read 0 22130 NULL
116803 +SyS_sched_setaffinity_22148 SyS_sched_setaffinity 2 22148 NULL
116804 +do_tcp_sendpages_22155 do_tcp_sendpages 4 22155 NULL
116805 +__kfifo_alloc_22173 __kfifo_alloc 3 22173 NULL
116806 +rfcomm_sock_recvmsg_22227 rfcomm_sock_recvmsg 4 22227 NULL
116807 +mem_write_22232 mem_write 3 22232 NULL
116808 +p9_virtio_zc_request_22240 p9_virtio_zc_request 6-5 22240 NULL
116809 +prepare_to_wait_event_22247 prepare_to_wait_event 0 22247 NULL
116810 +compat_process_vm_rw_22254 compat_process_vm_rw 3-5 22254 NULL
116811 +ping_common_sendmsg_22261 ping_common_sendmsg 5 22261 NULL
116812 +add_res_tree_22263 add_res_tree 7 22263 NULL
116813 +__btrfs_direct_write_22273 __btrfs_direct_write 4-0 22273 NULL
116814 +queue_max_sectors_22280 queue_max_sectors 0 22280 NULL
116815 +__tun_chr_ioctl_22300 __tun_chr_ioctl 4 22300 NULL nohasharray
116816 +pci_vpd_srdt_size_22300 pci_vpd_srdt_size 0 22300 &__tun_chr_ioctl_22300
116817 +mesh_table_alloc_22305 mesh_table_alloc 1 22305 NULL
116818 +lov_setstripe_22307 lov_setstripe 2 22307 NULL
116819 +udpv6_sendmsg_22316 udpv6_sendmsg 4 22316 NULL
116820 +atomic_read_22342 atomic_read 0 22342 NULL
116821 +ll_lazystatfs_seq_write_22353 ll_lazystatfs_seq_write 3 22353 NULL
116822 +snd_pcm_alsa_frames_22363 snd_pcm_alsa_frames 2 22363 NULL
116823 +evdev_ioctl_22371 evdev_ioctl 2 22371 NULL
116824 +alloc_large_system_hash_22391 alloc_large_system_hash 2 22391 NULL
116825 +zoran_write_22404 zoran_write 3 22404 NULL
116826 +queue_reply_22416 queue_reply 3 22416 NULL
116827 +__set_enter_print_fmt_22431 __set_enter_print_fmt 0 22431 NULL
116828 +queue_max_segments_22441 queue_max_segments 0 22441 NULL
116829 +handle_received_packet_22457 handle_received_packet 3 22457 NULL
116830 +ecryptfs_write_22488 ecryptfs_write 4-3 22488 NULL
116831 +qib_user_sdma_alloc_header_22490 qib_user_sdma_alloc_header 2 22490 NULL
116832 +cache_write_procfs_22491 cache_write_procfs 3 22491 NULL
116833 +mutex_lock_interruptible_22505 mutex_lock_interruptible 0 22505 NULL
116834 +trim_no_bitmap_22524 trim_no_bitmap 4-3 22524 NULL
116835 +ocfs2_read_extent_block_22550 ocfs2_read_extent_block 0 22550 NULL
116836 +agp_alloc_page_array_22554 agp_alloc_page_array 1 22554 NULL
116837 +dbFindCtl_22587 dbFindCtl 0 22587 NULL
116838 +snapshot_read_22601 snapshot_read 3 22601 NULL
116839 +sctp_setsockopt_connectx_old_22631 sctp_setsockopt_connectx_old 3 22631 NULL
116840 +ide_core_cp_entry_22636 ide_core_cp_entry 3 22636 NULL
116841 +wl1271_rx_filter_get_fields_size_22638 wl1271_rx_filter_get_fields_size 0 22638 NULL
116842 +pwr_wake_on_timer_exp_read_22640 pwr_wake_on_timer_exp_read 3 22640 NULL
116843 +iwl_dbgfs_calib_disabled_read_22649 iwl_dbgfs_calib_disabled_read 3 22649 NULL
116844 +ext4_ext_direct_IO_22679 ext4_ext_direct_IO 4 22679 NULL
116845 +l2tp_ip_recvmsg_22681 l2tp_ip_recvmsg 4 22681 NULL
116846 +bch_dump_read_22685 bch_dump_read 3 22685 NULL
116847 +reg_umr_22686 reg_umr 5 22686 NULL
116848 +alloc_libipw_22708 alloc_libipw 1 22708 NULL
116849 +cx18_copy_buf_to_user_22735 cx18_copy_buf_to_user 4-0 22735 NULL
116850 +ceph_decode_32_22738 ceph_decode_32 0 22738 NULL nohasharray
116851 +__mei_cl_send_22738 __mei_cl_send 3 22738 &ceph_decode_32_22738
116852 +__writeback_single_inode_22739 __writeback_single_inode 0 22739 NULL
116853 +iio_debugfs_write_reg_22742 iio_debugfs_write_reg 3 22742 NULL
116854 +qlcnic_sriov_init_22762 qlcnic_sriov_init 2 22762 NULL
116855 +print_frame_22769 print_frame 0 22769 NULL
116856 +ftrace_arch_read_dyn_info_22773 ftrace_arch_read_dyn_info 0 22773 NULL
116857 +__break_lease_22777 __break_lease 0 22777 NULL
116858 +vnic_dev_get_res_count_22791 vnic_dev_get_res_count 0 22791 NULL
116859 +pla_ocp_write_22802 pla_ocp_write 4 22802 NULL
116860 +__generic_copy_to_user_intel_22806 __generic_copy_to_user_intel 0-3 22806 NULL
116861 +read_file_rcstat_22854 read_file_rcstat 3 22854 NULL
116862 +create_attr_set_22861 create_attr_set 1 22861 NULL
116863 +hash_ip6_expire_22867 hash_ip6_expire 4 22867 NULL
116864 +vmw_execbuf_process_22885 vmw_execbuf_process 5 22885 NULL
116865 +usblp_new_writeurb_22894 usblp_new_writeurb 2 22894 NULL
116866 +mdc800_device_read_22896 mdc800_device_read 3 22896 NULL
116867 +ion_handle_test_kernel_22900 ion_handle_test_kernel 4-3 22900 NULL nohasharray
116868 +policy_emit_config_values_22900 policy_emit_config_values 3 22900 &ion_handle_test_kernel_22900
116869 +__set_xattr_22923 __set_xattr 0 22923 NULL
116870 +xstateregs_set_22932 xstateregs_set 4 22932 NULL
116871 +pcpu_mem_zalloc_22948 pcpu_mem_zalloc 1 22948 NULL
116872 +alloc_sglist_22960 alloc_sglist 2-3 22960 NULL
116873 +caif_seqpkt_sendmsg_22961 caif_seqpkt_sendmsg 4 22961 NULL
116874 +vme_get_size_22964 vme_get_size 0 22964 NULL
116875 +tx_frag_key_not_found_read_22971 tx_frag_key_not_found_read 3 22971 NULL
116876 +cached_dev_cache_miss_22979 cached_dev_cache_miss 4 22979 NULL
116877 +usb_get_langid_22983 usb_get_langid 0 22983 NULL
116878 +remote_settings_file_write_22987 remote_settings_file_write 3 22987 NULL
116879 +viafb_dvp0_proc_write_23023 viafb_dvp0_proc_write 3 23023 NULL
116880 +cifs_local_to_utf16_bytes_23025 cifs_local_to_utf16_bytes 0 23025 NULL
116881 +ocfs2_refcount_cow_xattr_23029 ocfs2_refcount_cow_xattr 0 23029 NULL
116882 +st_status_23032 st_status 5 23032 NULL
116883 +nv50_disp_chan_create__23056 nv50_disp_chan_create_ 5 23056 NULL
116884 +comedi_buf_write_n_available_23057 comedi_buf_write_n_available 0 23057 NULL
116885 +security_inode_killpriv_23060 security_inode_killpriv 0 23060 NULL
116886 +reiserfs_add_entry_23062 reiserfs_add_entry 4 23062 NULL nohasharray
116887 +unix_seqpacket_recvmsg_23062 unix_seqpacket_recvmsg 4 23062 &reiserfs_add_entry_23062
116888 +mei_cl_send_23068 mei_cl_send 3 23068 NULL
116889 +kvm_mmu_gva_to_gpa_write_23075 kvm_mmu_gva_to_gpa_write 0 23075 NULL
116890 +raw_sendmsg_23078 raw_sendmsg 4 23078 NULL
116891 +get_user_hdr_len_23079 get_user_hdr_len 0 23079 NULL
116892 +isr_tx_procs_read_23084 isr_tx_procs_read 3 23084 NULL
116893 +rt2x00debug_write_eeprom_23091 rt2x00debug_write_eeprom 3 23091 NULL
116894 +ntfs_ucstonls_23097 ntfs_ucstonls 3-5 23097 NULL
116895 +xfs_dir_ialloc_23100 xfs_dir_ialloc 0 23100 NULL
116896 +pipe_iov_copy_from_user_23102 pipe_iov_copy_from_user 3 23102 NULL
116897 +dgram_recvmsg_23104 dgram_recvmsg 4 23104 NULL
116898 +mwl8k_cmd_set_beacon_23110 mwl8k_cmd_set_beacon 4 23110 NULL
116899 +nl80211_send_rx_auth_23111 nl80211_send_rx_auth 4 23111 NULL nohasharray
116900 +bset_tree_bytes_23111 bset_tree_bytes 0 23111 &nl80211_send_rx_auth_23111
116901 +__clear_user_23118 __clear_user 0-2 23118 NULL
116902 +drm_mode_create_tv_properties_23122 drm_mode_create_tv_properties 2 23122 NULL
116903 +ata_scsi_change_queue_depth_23126 ata_scsi_change_queue_depth 2 23126 NULL
116904 +read_file_ani_23161 read_file_ani 3 23161 NULL
116905 +usblp_write_23178 usblp_write 3 23178 NULL
116906 +gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
116907 +mpi_alloc_limb_space_23190 mpi_alloc_limb_space 1 23190 NULL
116908 +tty_buffer_request_room_23228 tty_buffer_request_room 2-0 23228 NULL
116909 +xlog_get_bp_23229 xlog_get_bp 2 23229 NULL nohasharray
116910 +__read_status_pci_23229 __read_status_pci 0 23229 &xlog_get_bp_23229
116911 +ft1000_read_dpram_mag_32_23232 ft1000_read_dpram_mag_32 0 23232 NULL
116912 +rxrpc_client_sendmsg_23236 rxrpc_client_sendmsg 5 23236 NULL
116913 +__gfn_to_rmap_23240 __gfn_to_rmap 2-1 23240 NULL
116914 +nv50_ram_create__23241 nv50_ram_create_ 4 23241 NULL
116915 +sctp_recvmsg_23265 sctp_recvmsg 4 23265 NULL
116916 +uwb_dev_addr_print_23282 uwb_dev_addr_print 2 23282 NULL
116917 +diva_get_trace_filter_23286 diva_get_trace_filter 0 23286 NULL
116918 +i2cdev_write_23310 i2cdev_write 3 23310 NULL
116919 +__aa_kvmalloc_23320 __aa_kvmalloc 1 23320 NULL
116920 +page_readlink_23346 page_readlink 3 23346 NULL
116921 +kmem_zalloc_large_23351 kmem_zalloc_large 1 23351 NULL
116922 +get_dst_timing_23358 get_dst_timing 0 23358 NULL nohasharray
116923 +write_inode_23358 write_inode 0 23358 &get_dst_timing_23358
116924 +fd_setup_write_same_buf_23369 fd_setup_write_same_buf 3 23369 NULL
116925 +iscsi_change_queue_depth_23416 iscsi_change_queue_depth 2 23416 NULL
116926 +vga_mm_r_23419 vga_mm_r 0 23419 NULL
116927 +ocfs2_zero_tail_23447 ocfs2_zero_tail 3 23447 NULL
116928 +hidraw_send_report_23449 hidraw_send_report 3 23449 NULL
116929 +__ata_change_queue_depth_23484 __ata_change_queue_depth 3 23484 NULL
116930 +linear_conf_23485 linear_conf 2 23485 NULL nohasharray
116931 +sync_mapping_buffers_23485 sync_mapping_buffers 0 23485 &linear_conf_23485
116932 +event_filter_read_23494 event_filter_read 3 23494 NULL
116933 +lustre_acl_xattr_merge2ext_23502 lustre_acl_xattr_merge2ext 2 23502 NULL
116934 +devm_iio_device_alloc_23511 devm_iio_device_alloc 2 23511 NULL
116935 +__proc_cpt_table_23516 __proc_cpt_table 5 23516 NULL
116936 +ima_show_measurements_count_23536 ima_show_measurements_count 3 23536 NULL
116937 +tcp_current_mss_23552 tcp_current_mss 0 23552 NULL
116938 +btrfs_super_bytenr_23561 btrfs_super_bytenr 0 23561 NULL
116939 +venus_symlink_23570 venus_symlink 6-4 23570 NULL
116940 +iwl_dbgfs_interrupt_read_23574 iwl_dbgfs_interrupt_read 3 23574 NULL
116941 +xfpregs_get_23586 xfpregs_get 4 23586 NULL
116942 +snd_interval_min_23590 snd_interval_min 0 23590 NULL
116943 +islpci_mgt_transaction_23610 islpci_mgt_transaction 5 23610 NULL
116944 +xfs_qm_dqread_23613 xfs_qm_dqread 0 23613 NULL
116945 +ocfs2_journal_access_23616 ocfs2_journal_access 0 23616 NULL
116946 +__i2400mu_send_barker_23652 __i2400mu_send_barker 3 23652 NULL
116947 +sInW_23663 sInW 0 23663 NULL
116948 +SyS_connect_23669 SyS_connect 3 23669 NULL
116949 +cx18_read_23699 cx18_read 3 23699 NULL
116950 +at_get_23708 at_get 0 23708 NULL
116951 +rx_rx_dropped_frame_read_23748 rx_rx_dropped_frame_read 3 23748 NULL
116952 +__kfifo_max_r_23768 __kfifo_max_r 0-2-1 23768 NULL
116953 +__build_packet_message_23778 __build_packet_message 4-10 23778 NULL
116954 +security_inode_getxattr_23781 security_inode_getxattr 0 23781 NULL
116955 +cfg80211_inform_bss_width_frame_23782 cfg80211_inform_bss_width_frame 5 23782 NULL
116956 +mpt_free_res_23793 mpt_free_res 5 23793 NULL
116957 +map_write_23795 map_write 3 23795 NULL
116958 +rx_path_reset_read_23801 rx_path_reset_read 3 23801 NULL
116959 +ocfs2_replace_cow_23803 ocfs2_replace_cow 0 23803 NULL
116960 +__earlyonly_bootmem_alloc_23824 __earlyonly_bootmem_alloc 2 23824 NULL
116961 +lustre_msg_buflen_23827 lustre_msg_buflen 0 23827 NULL
116962 +ceph_copy_page_vector_to_user_23829 ceph_copy_page_vector_to_user 0-4-3 23829 NULL
116963 +pgdat_end_pfn_23842 pgdat_end_pfn 0 23842 NULL
116964 +iwl_dbgfs_nvm_read_23845 iwl_dbgfs_nvm_read 3 23845 NULL
116965 +p54_init_common_23850 p54_init_common 1 23850 NULL
116966 +bin_to_hex_dup_23853 bin_to_hex_dup 2 23853 NULL
116967 +ocfs2_xattr_get_clusters_23857 ocfs2_xattr_get_clusters 0 23857 NULL
116968 +ieee80211_if_read_dot11MeshMaxPeerLinks_23878 ieee80211_if_read_dot11MeshMaxPeerLinks 3 23878 NULL
116969 +nouveau_clock_create__23881 nouveau_clock_create_ 5 23881 NULL nohasharray
116970 +writeback_single_inode_23881 writeback_single_inode 0 23881 &nouveau_clock_create__23881
116971 +tipc_snprintf_23893 tipc_snprintf 2-0 23893 NULL
116972 +add_new_gdb_meta_bg_23911 add_new_gdb_meta_bg 3 23911 NULL nohasharray
116973 +ieee80211_if_read_hw_queues_23911 ieee80211_if_read_hw_queues 3 23911 &add_new_gdb_meta_bg_23911
116974 +f2fs_getxattr_23917 f2fs_getxattr 0 23917 NULL
116975 +mpihelp_mul_karatsuba_case_23918 mpihelp_mul_karatsuba_case 5-3 23918 NULL nohasharray
116976 +ipath_reg_phys_mr_23918 ipath_reg_phys_mr 3 23918 &mpihelp_mul_karatsuba_case_23918
116977 +kvm_read_guest_23928 kvm_read_guest 4-2 23928 NULL
116978 +uvc_endpoint_max_bpi_23944 uvc_endpoint_max_bpi 0 23944 NULL
116979 +cifs_setxattr_23957 cifs_setxattr 4 23957 NULL
116980 +size_roundup_power2_23958 size_roundup_power2 0-1 23958 NULL
116981 +sddr55_write_data_23983 sddr55_write_data 4 23983 NULL
116982 +zd_usb_iowrite16v_async_23984 zd_usb_iowrite16v_async 3 23984 NULL
116983 +cxgb_alloc_mem_24007 cxgb_alloc_mem 1 24007 NULL
116984 +give_pages_24021 give_pages 3 24021 NULL
116985 +adis16400_show_serial_number_24037 adis16400_show_serial_number 3 24037 NULL
116986 +hmac_setkey_24043 hmac_setkey 3 24043 NULL
116987 +afs_cell_alloc_24052 afs_cell_alloc 2 24052 NULL
116988 +blkcipher_copy_iv_24075 blkcipher_copy_iv 3 24075 NULL
116989 +vb2_fop_read_24080 vb2_fop_read 3 24080 NULL
116990 +pipeline_post_proc_swi_read_24108 pipeline_post_proc_swi_read 3 24108 NULL
116991 +request_key_auth_read_24109 request_key_auth_read 3 24109 NULL
116992 +lov_brw_24122 lov_brw 4 24122 NULL
116993 +mpu401_read_24126 mpu401_read 3-0 24126 NULL
116994 +_picolcd_flash_write_24134 _picolcd_flash_write 4 24134 NULL
116995 +irnet_ctrl_write_24139 irnet_ctrl_write 3 24139 NULL nohasharray
116996 +xfs_btree_increment_24139 xfs_btree_increment 0 24139 &irnet_ctrl_write_24139
116997 +SyS_sethostname_24150 SyS_sethostname 2 24150 NULL
116998 +trim_bitmaps_24158 trim_bitmaps 3 24158 NULL
116999 +adu_read_24177 adu_read 3 24177 NULL
117000 +safe_prepare_write_buffer_24187 safe_prepare_write_buffer 3 24187 NULL
117001 +irq_remapping_setup_msi_irqs_24194 irq_remapping_setup_msi_irqs 2 24194 NULL
117002 +ieee80211_if_read_dot11MeshHWMPpreqMinInterval_24208 ieee80211_if_read_dot11MeshHWMPpreqMinInterval 3 24208 NULL
117003 +tcpprobe_sprint_24222 tcpprobe_sprint 0-2 24222 NULL
117004 +pcpu_embed_first_chunk_24224 pcpu_embed_first_chunk 3-2-1 24224 NULL nohasharray
117005 +mei_amthif_read_24224 mei_amthif_read 4 24224 &pcpu_embed_first_chunk_24224
117006 +pci_num_vf_24235 pci_num_vf 0 24235 NULL
117007 +sel_read_bool_24236 sel_read_bool 3 24236 NULL
117008 +xfs_bmap_rtalloc_24237 xfs_bmap_rtalloc 0 24237 NULL
117009 +em28xx_alloc_urbs_24260 em28xx_alloc_urbs 4-6 24260 NULL
117010 +calculate_sizes_24273 calculate_sizes 2 24273 NULL
117011 +thin_status_24278 thin_status 5 24278 NULL
117012 +msg_size_24288 msg_size 0 24288 NULL
117013 +gserial_connect_24302 gserial_connect 0 24302 NULL
117014 +btmrvl_pscmd_read_24308 btmrvl_pscmd_read 3 24308 NULL
117015 +reserve_metadata_bytes_24313 reserve_metadata_bytes 0 24313 NULL
117016 +ath6kl_add_bss_if_needed_24317 ath6kl_add_bss_if_needed 6 24317 NULL
117017 +si476x_radio_read_acf_blob_24336 si476x_radio_read_acf_blob 3 24336 NULL
117018 +prepare_pages_24349 prepare_pages 0 24349 NULL
117019 +kzalloc_node_24352 kzalloc_node 1 24352 NULL
117020 +qla2x00_handle_queue_full_24365 qla2x00_handle_queue_full 2 24365 NULL
117021 +cfi_read_pri_24366 cfi_read_pri 3 24366 NULL
117022 +btrfs_item_size_nr_24367 btrfs_item_size_nr 0 24367 NULL
117023 +igetword_24373 igetword 0 24373 NULL nohasharray
117024 +break_deleg_24373 break_deleg 0 24373 &igetword_24373
117025 +max_io_len_24384 max_io_len 0-1 24384 NULL
117026 +mpt_alloc_res_24387 mpt_alloc_res 5 24387 NULL
117027 +xfs_bmapi_read_24392 xfs_bmapi_read 0 24392 NULL
117028 +osc_cur_grant_bytes_seq_write_24396 osc_cur_grant_bytes_seq_write 3 24396 NULL
117029 +getxattr_24398 getxattr 4 24398 NULL nohasharray
117030 +pvr2_v4l2_ioctl_24398 pvr2_v4l2_ioctl 2 24398 &getxattr_24398
117031 +blk_update_bidi_request_24415 blk_update_bidi_request 3-4 24415 NULL
117032 +nvme_trans_log_supp_pages_24418 nvme_trans_log_supp_pages 3 24418 NULL
117033 +b43_debugfs_read_24425 b43_debugfs_read 3 24425 NULL
117034 +xenbus_file_read_24427 xenbus_file_read 3 24427 NULL
117035 +ieee80211_rx_mgmt_beacon_24430 ieee80211_rx_mgmt_beacon 3 24430 NULL
117036 +copy_and_ioctl_24434 copy_and_ioctl 4 24434 NULL
117037 +ixgbe_alloc_q_vector_24439 ixgbe_alloc_q_vector 4-6 24439 NULL
117038 +smk_user_access_24440 smk_user_access 3 24440 NULL nohasharray
117039 +rtw_set_wps_assoc_resp_24440 rtw_set_wps_assoc_resp 3 24440 &smk_user_access_24440
117040 +evdev_do_ioctl_24459 evdev_do_ioctl 2 24459 NULL
117041 +lbs_highsnr_write_24460 lbs_highsnr_write 3 24460 NULL
117042 +skb_copy_and_csum_datagram_iovec_24466 skb_copy_and_csum_datagram_iovec 2 24466 NULL
117043 +dut_mode_read_24489 dut_mode_read 3 24489 NULL
117044 +read_file_spec_scan_ctl_24491 read_file_spec_scan_ctl 3 24491 NULL
117045 +pd_video_read_24510 pd_video_read 3 24510 NULL
117046 +request_key_with_auxdata_24515 request_key_with_auxdata 4 24515 NULL
117047 +xfs_buf_get_map_24522 xfs_buf_get_map 3 24522 NULL
117048 +do_mpage_readpage_24536 do_mpage_readpage 3 24536 NULL
117049 +write_cache_pages_24562 write_cache_pages 0 24562 NULL
117050 +SyS_pselect6_24582 SyS_pselect6 1 24582 NULL
117051 +udf_compute_nr_groups_24594 udf_compute_nr_groups 0 24594 NULL
117052 +sensor_hub_get_physical_device_count_24605 sensor_hub_get_physical_device_count 0 24605 NULL nohasharray
117053 +lov_alloc_memmd_24605 lov_alloc_memmd 2 24605 &sensor_hub_get_physical_device_count_24605
117054 +SyS_poll_24620 SyS_poll 2 24620 NULL
117055 +context_alloc_24645 context_alloc 3 24645 NULL
117056 +blk_rq_err_bytes_24650 blk_rq_err_bytes 0 24650 NULL
117057 +xfs_log_commit_cil_24653 xfs_log_commit_cil 0 24653 NULL
117058 +btrfs_check_data_free_space_24692 btrfs_check_data_free_space 0 24692 NULL
117059 +datafab_write_data_24696 datafab_write_data 4 24696 NULL
117060 +intelfbhw_get_p1p2_24703 intelfbhw_get_p1p2 2 24703 NULL
117061 +simple_attr_read_24738 simple_attr_read 3 24738 NULL
117062 +qla2x00_change_queue_depth_24742 qla2x00_change_queue_depth 2 24742 NULL
117063 +get_dma_residue_24749 get_dma_residue 0 24749 NULL
117064 +kgdb_hex2mem_24755 kgdb_hex2mem 3 24755 NULL
117065 +ocfs2_read_blocks_24777 ocfs2_read_blocks 0 24777 NULL
117066 +datablob_hmac_verify_24786 datablob_hmac_verify 4 24786 NULL
117067 +cache_read_24790 cache_read 3 24790 NULL
117068 +user_regset_copyout_24796 user_regset_copyout 7 24796 NULL
117069 +kvm_read_guest_virt_helper_24804 kvm_read_guest_virt_helper 3-1 24804 NULL
117070 +ath6kl_fwlog_mask_write_24810 ath6kl_fwlog_mask_write 3 24810 NULL
117071 +net2272_read_24825 net2272_read 0 24825 NULL
117072 +snd_als4k_gcr_read_24840 snd_als4k_gcr_read 0 24840 NULL
117073 +snd_pcm_lib_buffer_bytes_24865 snd_pcm_lib_buffer_bytes 0 24865 NULL
117074 +pnp_alloc_24869 pnp_alloc 1 24869 NULL nohasharray
117075 +l2cap_create_basic_pdu_24869 l2cap_create_basic_pdu 3 24869 &pnp_alloc_24869
117076 +queues_read_24877 queues_read 3 24877 NULL
117077 +__vxge_hw_vp_initialize_24885 __vxge_hw_vp_initialize 2 24885 NULL
117078 +xfs_qm_dqattach_24898 xfs_qm_dqattach 0 24898 NULL
117079 +codec_list_read_file_24910 codec_list_read_file 3 24910 NULL
117080 +v4l2_ctrl_new_24927 v4l2_ctrl_new 7 24927 NULL nohasharray
117081 +__btrfs_free_extent_24927 __btrfs_free_extent 7 24927 &v4l2_ctrl_new_24927
117082 +ocfs2_fiemap_24949 ocfs2_fiemap 4-3 24949 NULL
117083 +packet_sendmsg_24954 packet_sendmsg 4 24954 NULL
117084 +twl_i2c_write_u8_24976 twl_i2c_write_u8 3 24976 NULL
117085 +llc_ui_sendmsg_24987 llc_ui_sendmsg 4 24987 NULL
117086 +slot_get_24999 slot_get 0 24999 NULL
117087 +key_conf_hw_key_idx_read_25003 key_conf_hw_key_idx_read 3 25003 NULL
117088 +il_dbgfs_channels_read_25005 il_dbgfs_channels_read 3 25005 NULL
117089 +ni_660x_num_counters_25031 ni_660x_num_counters 0 25031 NULL
117090 +nfs_dns_resolve_name_25036 nfs_dns_resolve_name 3 25036 NULL
117091 +load_unaligned_zeropad_25050 load_unaligned_zeropad 0 25050 NULL
117092 +btrfs_stack_key_blockptr_25058 btrfs_stack_key_blockptr 0 25058 NULL
117093 +gs_buf_alloc_25067 gs_buf_alloc 2 25067 NULL
117094 +ll_track_pid_seq_write_25068 ll_track_pid_seq_write 3 25068 NULL
117095 +SYSC_listxattr_25072 SYSC_listxattr 3 25072 NULL
117096 +ima_appraise_measurement_25093 ima_appraise_measurement 6 25093 NULL
117097 +blkg_path_25099 blkg_path 3 25099 NULL
117098 +snd_rawmidi_kernel_write_25106 snd_rawmidi_kernel_write 3 25106 NULL
117099 +gfs2_quota_check_25130 gfs2_quota_check 0 25130 NULL
117100 +ipath_init_qp_table_25167 ipath_init_qp_table 2 25167 NULL
117101 +kvm_mmu_notifier_change_pte_25169 kvm_mmu_notifier_change_pte 3 25169 NULL
117102 +sctp_getsockopt_local_addrs_25178 sctp_getsockopt_local_addrs 2 25178 NULL
117103 +mon_stat_read_25238 mon_stat_read 3 25238 NULL
117104 +stripe_status_25259 stripe_status 5 25259 NULL
117105 +snd_pcm_start_25273 snd_pcm_start 0 25273 NULL
117106 +crypto_alloc_instance2_25277 crypto_alloc_instance2 3 25277 NULL
117107 +vfs_writev_25278 vfs_writev 3 25278 NULL
117108 +l2tp_session_create_25286 l2tp_session_create 1 25286 NULL
117109 +ath9k_debugfs_read_buf_25316 ath9k_debugfs_read_buf 3 25316 NULL
117110 +rng_buffer_size_25348 rng_buffer_size 0 25348 NULL
117111 +SYSC_kexec_load_25361 SYSC_kexec_load 2 25361 NULL
117112 +unix_mkname_25368 unix_mkname 0-2 25368 NULL
117113 +sel_read_mls_25369 sel_read_mls 3 25369 NULL
117114 +vsp1_entity_init_25407 vsp1_entity_init 3 25407 NULL
117115 +xfs_ialloc_pagi_init_25411 xfs_ialloc_pagi_init 0 25411 NULL
117116 +dai_list_read_file_25421 dai_list_read_file 3 25421 NULL
117117 +xfs_qm_dqtobp_25448 xfs_qm_dqtobp 0 25448 NULL
117118 +generic_file_buffered_write_25464 generic_file_buffered_write 4-0-7 25464 NULL
117119 +ipath_decode_err_25468 ipath_decode_err 3 25468 NULL
117120 +crypto_hash_digestsize_25469 crypto_hash_digestsize 0 25469 NULL
117121 +ivtv_buf_copy_from_user_25502 ivtv_buf_copy_from_user 4-0 25502 NULL
117122 +snd_pcm_plugin_build_25505 snd_pcm_plugin_build 5 25505 NULL
117123 +xfs_alloc_fix_freelist_25514 xfs_alloc_fix_freelist 0 25514 NULL
117124 +sb_permission_25523 sb_permission 0 25523 NULL
117125 +ext3_get_inode_loc_25542 ext3_get_inode_loc 0 25542 NULL
117126 +ieee80211_if_read_path_refresh_time_25545 ieee80211_if_read_path_refresh_time 3 25545 NULL
117127 +wimax_addr_scnprint_25548 wimax_addr_scnprint 2 25548 NULL
117128 +ht_print_chan_25556 ht_print_chan 0-3-4 25556 NULL
117129 +skb_tailroom_25567 skb_tailroom 0 25567 NULL
117130 +ping_recvmsg_25597 ping_recvmsg 4 25597 NULL
117131 +copy_user_generic_25611 copy_user_generic 0 25611 NULL
117132 +proc_coredump_filter_write_25625 proc_coredump_filter_write 3 25625 NULL
117133 +befs_utf2nls_25628 befs_utf2nls 3 25628 NULL nohasharray
117134 +__get_user_pages_25628 __get_user_pages 0 25628 &befs_utf2nls_25628
117135 +__direct_map_25647 __direct_map 5-6 25647 NULL
117136 +aircable_prepare_write_buffer_25669 aircable_prepare_write_buffer 3 25669 NULL
117137 +lpfc_idiag_cmd_get_25672 lpfc_idiag_cmd_get 2 25672 NULL
117138 +sta_inactive_ms_read_25690 sta_inactive_ms_read 3 25690 NULL
117139 +rx_filter_mc_filter_read_25712 rx_filter_mc_filter_read 3 25712 NULL
117140 +ibmasm_new_command_25714 ibmasm_new_command 2 25714 NULL
117141 +__alloc_bootmem_low_node_25726 __alloc_bootmem_low_node 2 25726 NULL nohasharray
117142 +sel_write_context_25726 sel_write_context 3 25726 &__alloc_bootmem_low_node_25726
117143 +cxgbi_device_portmap_create_25747 cxgbi_device_portmap_create 3 25747 NULL
117144 +event_rx_pool_read_25792 event_rx_pool_read 3 25792 NULL
117145 +sg_read_25799 sg_read 3 25799 NULL
117146 +xfs_alloc_ag_vextent_exact_25810 xfs_alloc_ag_vextent_exact 0 25810 NULL
117147 +system_enable_read_25815 system_enable_read 3 25815 NULL
117148 +realloc_buffer_25816 realloc_buffer 2 25816 NULL
117149 +pwr_missing_bcns_read_25824 pwr_missing_bcns_read 3 25824 NULL
117150 +parport_read_25855 parport_read 0 25855 NULL
117151 +xfs_dir2_sf_hdr_size_25858 xfs_dir2_sf_hdr_size 0 25858 NULL
117152 +key_attr_size_25865 key_attr_size 0 25865 NULL
117153 +ath6kl_regread_read_25884 ath6kl_regread_read 3 25884 NULL
117154 +run_delalloc_nocow_25896 run_delalloc_nocow 3-4 25896 NULL
117155 +sisusbcon_scroll_area_25899 sisusbcon_scroll_area 4-3 25899 NULL
117156 +lpfc_change_queue_depth_25905 lpfc_change_queue_depth 2 25905 NULL
117157 +nvme_trans_mode_page_create_25908 nvme_trans_mode_page_create 7-4 25908 NULL
117158 +do_jffs2_setxattr_25910 do_jffs2_setxattr 5 25910 NULL
117159 +rcname_read_25919 rcname_read 3 25919 NULL
117160 +snd_es1938_capture_copy_25930 snd_es1938_capture_copy 5 25930 NULL
117161 +key_flags_read_25931 key_flags_read 3 25931 NULL
117162 +copy_play_buf_25932 copy_play_buf 3 25932 NULL
117163 +flush_25957 flush 2 25957 NULL
117164 +udp_setsockopt_25985 udp_setsockopt 5 25985 NULL
117165 +lustre_msg_buflen_v2_25997 lustre_msg_buflen_v2 0 25997 NULL
117166 +SyS_process_vm_readv_26019 SyS_process_vm_readv 3-5 26019 NULL
117167 +mptscsih_change_queue_depth_26036 mptscsih_change_queue_depth 2 26036 NULL
117168 +selinux_inode_post_setxattr_26037 selinux_inode_post_setxattr 4 26037 NULL
117169 +keyctl_update_key_26061 keyctl_update_key 3 26061 NULL
117170 +btrfs_wait_ordered_range_26086 btrfs_wait_ordered_range 0 26086 NULL
117171 +rx_rx_wa_density_dropped_frame_read_26095 rx_rx_wa_density_dropped_frame_read 3 26095 NULL
117172 +read_sb_page_26119 read_sb_page 5 26119 NULL
117173 +ath9k_hw_name_26146 ath9k_hw_name 3 26146 NULL
117174 +copy_oldmem_page_26164 copy_oldmem_page 3 26164 NULL
117175 +gfs2_xattr_acl_get_26166 gfs2_xattr_acl_get 0 26166 NULL nohasharray
117176 +ath6kl_roam_table_read_26166 ath6kl_roam_table_read 3 26166 &gfs2_xattr_acl_get_26166
117177 +disk_devt_26180 disk_devt 0 26180 NULL
117178 +cgroup_setxattr_26188 cgroup_setxattr 4 26188 NULL
117179 +ieee80211_if_fmt_dot11MeshTTL_26198 ieee80211_if_fmt_dot11MeshTTL 3 26198 NULL
117180 +xfs_idata_realloc_26199 xfs_idata_realloc 2 26199 NULL
117181 +mce_write_26201 mce_write 3 26201 NULL
117182 +mwifiex_regrdwr_write_26225 mwifiex_regrdwr_write 3 26225 NULL
117183 +_scsih_change_queue_depth_26230 _scsih_change_queue_depth 2 26230 NULL
117184 +rxrpc_recvmsg_26233 rxrpc_recvmsg 4 26233 NULL
117185 +simple_setattr_26234 simple_setattr 0 26234 NULL
117186 +genwqe_ffdc_buff_size_26263 genwqe_ffdc_buff_size 0 26263 NULL
117187 +crypto_ctxsize_26278 crypto_ctxsize 0 26278 NULL
117188 +apei_resources_request_26279 apei_resources_request 0 26279 NULL
117189 +wacom_set_device_mode_26280 wacom_set_device_mode 3 26280 NULL
117190 +snd_pcm_plug_client_channels_buf_26309 snd_pcm_plug_client_channels_buf 0-3 26309 NULL
117191 +pwr_wake_on_host_read_26321 pwr_wake_on_host_read 3 26321 NULL
117192 +check_can_nocow_26336 check_can_nocow 2 26336 NULL
117193 +snd_vx_check_reg_bit_26344 snd_vx_check_reg_bit 0 26344 NULL
117194 +ocfs2_duplicate_clusters_by_page_26357 ocfs2_duplicate_clusters_by_page 6-3 26357 NULL
117195 +cifs_readdata_alloc_26360 cifs_readdata_alloc 1 26360 NULL
117196 +invalidate_inode_pages2_range_26403 invalidate_inode_pages2_range 0 26403 NULL
117197 +ntty_write_26404 ntty_write 3 26404 NULL
117198 +firmware_store_26408 firmware_store 4 26408 NULL
117199 +pagemap_read_26441 pagemap_read 3 26441 NULL
117200 +tower_read_26461 tower_read 3 26461 NULL nohasharray
117201 +enc_pools_add_pages_26461 enc_pools_add_pages 1 26461 &tower_read_26461
117202 +ib_alloc_device_26483 ib_alloc_device 1 26483 NULL
117203 +ulong_write_file_26485 ulong_write_file 3 26485 NULL
117204 +dvb_ca_en50221_io_ioctl_26490 dvb_ca_en50221_io_ioctl 2 26490 NULL
117205 +read_vmcore_26501 read_vmcore 3 26501 NULL
117206 +uhid_char_write_26502 uhid_char_write 3 26502 NULL
117207 +vfio_pci_set_msi_trigger_26507 vfio_pci_set_msi_trigger 4-3 26507 NULL
117208 +iwl_dbgfs_rf_reset_read_26512 iwl_dbgfs_rf_reset_read 3 26512 NULL
117209 +alloc_ep_req_26521 alloc_ep_req 3-2 26521 NULL
117210 +SyS_rt_sigpending_26538 SyS_rt_sigpending 2 26538 NULL
117211 +__vhost_add_used_n_26554 __vhost_add_used_n 3 26554 NULL
117212 +dio_new_bio_26562 dio_new_bio 0 26562 NULL
117213 +rts51x_read_mem_26577 rts51x_read_mem 4 26577 NULL
117214 +xfs_rtcheck_range_26614 xfs_rtcheck_range 0 26614 NULL
117215 +pwr_fix_tsf_ps_read_26627 pwr_fix_tsf_ps_read 3 26627 NULL
117216 +irq_alloc_generic_chip_26650 irq_alloc_generic_chip 2 26650 NULL nohasharray
117217 +inb_p_26650 inb_p 0 26650 &irq_alloc_generic_chip_26650
117218 +nouveau_volt_create__26654 nouveau_volt_create_ 4 26654 NULL
117219 +cipso_v4_map_cat_rbm_hton_26680 cipso_v4_map_cat_rbm_hton 0 26680 NULL
117220 +flowinfo_read_26683 flowinfo_read 3 26683 NULL
117221 +sysfs_add_file_26716 sysfs_add_file 0 26716 NULL
117222 +nouveau_namedb_create__26732 nouveau_namedb_create_ 7 26732 NULL
117223 +pipeline_tcp_rx_stat_fifo_int_read_26745 pipeline_tcp_rx_stat_fifo_int_read 3 26745 NULL
117224 +bos_desc_26752 bos_desc 0 26752 NULL
117225 +snd_hda_get_raw_connections_26762 snd_hda_get_raw_connections 0 26762 NULL
117226 +dma_map_single_attrs_26779 dma_map_single_attrs 0 26779 NULL
117227 +qlcnic_alloc_sds_rings_26795 qlcnic_alloc_sds_rings 2 26795 NULL
117228 +cipso_v4_genopt_26812 cipso_v4_genopt 0 26812 NULL
117229 +iwl_trans_read_mem32_26825 iwl_trans_read_mem32 0 26825 NULL
117230 +smk_write_load_26829 smk_write_load 3 26829 NULL
117231 +xfs_alloc_pagf_init_26834 xfs_alloc_pagf_init 0 26834 NULL
117232 +scnprint_id_26842 scnprint_id 3-0 26842 NULL
117233 +ecryptfs_miscdev_write_26847 ecryptfs_miscdev_write 3 26847 NULL
117234 +ss_alloc_ep_req_26848 ss_alloc_ep_req 2 26848 NULL
117235 +tipc_conn_sendmsg_26867 tipc_conn_sendmsg 5 26867 NULL
117236 +ath6kl_create_qos_write_26879 ath6kl_create_qos_write 3 26879 NULL
117237 +svc_print_xprts_26881 svc_print_xprts 0 26881 NULL
117238 +skb_zerocopy_headlen_26910 skb_zerocopy_headlen 0 26910 NULL
117239 +hhf_zalloc_26912 hhf_zalloc 1 26912 NULL
117240 +cfg80211_process_auth_26916 cfg80211_process_auth 3 26916 NULL
117241 +x25_asy_change_mtu_26928 x25_asy_change_mtu 2 26928 NULL
117242 +scsi_tgt_copy_sense_26933 scsi_tgt_copy_sense 3 26933 NULL
117243 +sctp_setsockopt_adaptation_layer_26935 sctp_setsockopt_adaptation_layer 3 26935 NULL nohasharray
117244 +pwr_ps_enter_read_26935 pwr_ps_enter_read 3 26935 &sctp_setsockopt_adaptation_layer_26935
117245 +hecubafb_write_26942 hecubafb_write 3 26942 NULL
117246 +do_trimming_26952 do_trimming 3 26952 NULL nohasharray
117247 +extract_entropy_user_26952 extract_entropy_user 3 26952 &do_trimming_26952
117248 +do_direct_IO_26979 do_direct_IO 0 26979 NULL
117249 +xfs_filestream_associate_27030 xfs_filestream_associate 0 27030 NULL
117250 +__videobuf_alloc_vb_27062 __videobuf_alloc_vb 1 27062 NULL
117251 +ext4_convert_unwritten_extents_27064 ext4_convert_unwritten_extents 4-3-0 27064 NULL
117252 +snd_pcm_lib_period_bytes_27071 snd_pcm_lib_period_bytes 0 27071 NULL
117253 +paravirt_read_msr_27077 paravirt_read_msr 0 27077 NULL
117254 +alloc_fdmem_27083 alloc_fdmem 1 27083 NULL
117255 +btmrvl_hscmd_write_27089 btmrvl_hscmd_write 3 27089 NULL nohasharray
117256 +ath9k_hw_4k_dump_eeprom_27089 ath9k_hw_4k_dump_eeprom 5-4 27089 &btmrvl_hscmd_write_27089
117257 +__devcgroup_inode_permission_27108 __devcgroup_inode_permission 0 27108 NULL
117258 +get_kernel_page_27133 get_kernel_page 0 27133 NULL
117259 +drbd_get_capacity_27141 drbd_get_capacity 0 27141 NULL
117260 +pms_capture_27142 pms_capture 4 27142 NULL
117261 +btmrvl_hscfgcmd_write_27143 btmrvl_hscfgcmd_write 3 27143 NULL
117262 +snd_compr_calc_avail_27165 snd_compr_calc_avail 0 27165 NULL
117263 +ieee80211_if_read_rc_rateidx_mask_5ghz_27183 ieee80211_if_read_rc_rateidx_mask_5ghz 3 27183 NULL
117264 +__sg_alloc_table_27198 __sg_alloc_table 0 27198 NULL
117265 +write_kmem_27225 write_kmem 3 27225 NULL
117266 +dbAllocAG_27228 dbAllocAG 0 27228 NULL
117267 +rxrpc_request_key_27235 rxrpc_request_key 3 27235 NULL
117268 +ll_track_gid_seq_write_27267 ll_track_gid_seq_write 3 27267 NULL
117269 +comedi_alloc_devpriv_27272 comedi_alloc_devpriv 2 27272 NULL
117270 +copy_from_buf_27308 copy_from_buf 4-2 27308 NULL
117271 +virtqueue_add_inbuf_27312 virtqueue_add_inbuf 3 27312 NULL
117272 +snd_pcm_oss_write2_27332 snd_pcm_oss_write2 3-0 27332 NULL
117273 +afs_cell_create_27346 afs_cell_create 2 27346 NULL
117274 +iwl_dbgfs_csr_write_27363 iwl_dbgfs_csr_write 3 27363 NULL
117275 +pcbit_stat_27364 pcbit_stat 2 27364 NULL
117276 +seq_read_27411 seq_read 3 27411 NULL
117277 +ib_dma_map_sg_27413 ib_dma_map_sg 0 27413 NULL
117278 +ieee80211_if_read_smps_27416 ieee80211_if_read_smps 3 27416 NULL
117279 +ocfs2_refcount_cal_cow_clusters_27422 ocfs2_refcount_cal_cow_clusters 0 27422 NULL
117280 +cypress_write_27423 cypress_write 4 27423 NULL
117281 +sddr09_read_data_27447 sddr09_read_data 3 27447 NULL
117282 +xfs_btree_lookup_get_block_27448 xfs_btree_lookup_get_block 0 27448 NULL
117283 +v4l2_ctrl_new_std_menu_items_27487 v4l2_ctrl_new_std_menu_items 4 27487 NULL
117284 +hcd_buffer_alloc_27495 hcd_buffer_alloc 2 27495 NULL
117285 +ip_set_get_h32_27498 ip_set_get_h32 0 27498 NULL
117286 +btrfs_get_64_27499 btrfs_get_64 0 27499 NULL
117287 +garmin_read_process_27509 garmin_read_process 3 27509 NULL
117288 +oti_alloc_cookies_27510 oti_alloc_cookies 2 27510 NULL
117289 +ib_copy_to_udata_27525 ib_copy_to_udata 3 27525 NULL
117290 +snd_sonicvibes_getdmaa_27552 snd_sonicvibes_getdmaa 0 27552 NULL
117291 +SyS_fgetxattr_27571 SyS_fgetxattr 4 27571 NULL
117292 +sco_sock_recvmsg_27572 sco_sock_recvmsg 4 27572 NULL
117293 +libipw_alloc_txb_27579 libipw_alloc_txb 1 27579 NULL
117294 +ocfs2_xattr_ibody_get_27642 ocfs2_xattr_ibody_get 0 27642 NULL nohasharray
117295 +nl80211_send_connect_result_27642 nl80211_send_connect_result 5-7 27642 &ocfs2_xattr_ibody_get_27642 nohasharray
117296 +read_flush_procfs_27642 read_flush_procfs 3 27642 &nl80211_send_connect_result_27642 nohasharray
117297 +ocfs2_direct_IO_27642 ocfs2_direct_IO 4 27642 &read_flush_procfs_27642 nohasharray
117298 +xfs_alloc_vextent_27642 xfs_alloc_vextent 0 27642 &ocfs2_direct_IO_27642
117299 +add_new_gdb_27643 add_new_gdb 3 27643 NULL
117300 +btrfs_fallocate_27647 btrfs_fallocate 3-4 27647 NULL
117301 +qnx6_readpages_27657 qnx6_readpages 4 27657 NULL
117302 +cdrom_read_cdda_old_27664 cdrom_read_cdda_old 4 27664 NULL
117303 +ocfs2_extend_dir_27695 ocfs2_extend_dir 4 27695 NULL
117304 +fs_path_add_from_extent_buffer_27702 fs_path_add_from_extent_buffer 4 27702 NULL
117305 +evm_write_key_27715 evm_write_key 3 27715 NULL
117306 +ieee80211_if_fmt_dot11MeshGateAnnouncementProtocol_27722 ieee80211_if_fmt_dot11MeshGateAnnouncementProtocol 3 27722 NULL
117307 +xfs_dir2_block_sfsize_27727 xfs_dir2_block_sfsize 0 27727 NULL
117308 +SyS_setsockopt_27759 SyS_setsockopt 5 27759 NULL
117309 +__lov_setstripe_27782 __lov_setstripe 2 27782 NULL
117310 +twl4030_set_gpio_dataout_27792 twl4030_set_gpio_dataout 1 27792 NULL
117311 +SyS_readv_27804 SyS_readv 3 27804 NULL
117312 +mpihelp_mul_27805 mpihelp_mul 5-3 27805 NULL
117313 +hpt374_read_freq_27828 hpt374_read_freq 0 27828 NULL
117314 +init_header_complete_27833 init_header_complete 0 27833 NULL
117315 +read_profile_27859 read_profile 3 27859 NULL
117316 +sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
117317 +ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
117318 +unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
117319 +check_mapped_name_27943 check_mapped_name 3 27943 NULL
117320 +bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
117321 +tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
117322 +security_path_chown_27966 security_path_chown 0 27966 NULL
117323 +tipc_media_addr_printf_27971 tipc_media_addr_printf 2 27971 NULL
117324 +device_register_27972 device_register 0 27972 NULL nohasharray
117325 +mic_rx_pkts_read_27972 mic_rx_pkts_read 3 27972 &device_register_27972
117326 +xfs_alloc_fixup_trees_27975 xfs_alloc_fixup_trees 0 27975 NULL
117327 +pci_enable_device_flags_27977 pci_enable_device_flags 0 27977 NULL nohasharray
117328 +__kernfs_setattr_27977 __kernfs_setattr 0 27977 &pci_enable_device_flags_27977
117329 +edt_ft5x06_debugfs_raw_data_read_28002 edt_ft5x06_debugfs_raw_data_read 3 28002 NULL
117330 +seq_get_buf_28006 seq_get_buf 0 28006 NULL
117331 +snd_rawmidi_write_28008 snd_rawmidi_write 3 28008 NULL
117332 +powercap_register_zone_28028 powercap_register_zone 6 28028 NULL
117333 +sctp_setsockopt_maxburst_28041 sctp_setsockopt_maxburst 3 28041 NULL
117334 +rts51x_xd_rw_28046 rts51x_xd_rw 3-4 28046 NULL
117335 +cx231xx_init_vbi_isoc_28053 cx231xx_init_vbi_isoc 3-2-4 28053 NULL
117336 +pool_status_28055 pool_status 5 28055 NULL
117337 +init_rs_non_canonical_28059 init_rs_non_canonical 1 28059 NULL
117338 +lpfc_idiag_mbxacc_read_28061 lpfc_idiag_mbxacc_read 3 28061 NULL
117339 +tx_frag_bad_mblk_num_read_28064 tx_frag_bad_mblk_num_read 3 28064 NULL
117340 +mmc_test_alloc_mem_28102 mmc_test_alloc_mem 3-2 28102 NULL
117341 +rx_defrag_need_defrag_read_28117 rx_defrag_need_defrag_read 3 28117 NULL
117342 +vgacon_adjust_height_28124 vgacon_adjust_height 2 28124 NULL
117343 +memblock_virt_alloc_from_nopanic_28146 memblock_virt_alloc_from_nopanic 1 28146 NULL
117344 +video_read_28148 video_read 3 28148 NULL
117345 +snd_midi_channel_alloc_set_28153 snd_midi_channel_alloc_set 1 28153 NULL
117346 +stats_dot11FCSErrorCount_read_28154 stats_dot11FCSErrorCount_read 3 28154 NULL
117347 +vread_28173 vread 0-3 28173 NULL
117348 +macvtap_get_user_28185 macvtap_get_user 4 28185 NULL
117349 +counter_free_res_28187 counter_free_res 5 28187 NULL
117350 +read_disk_sb_28188 read_disk_sb 2 28188 NULL
117351 +nouveau_mxm_create__28200 nouveau_mxm_create_ 4 28200 NULL
117352 +__qp_memcpy_from_queue_28220 __qp_memcpy_from_queue 3-4 28220 NULL
117353 +line6_alloc_sysex_buffer_28225 line6_alloc_sysex_buffer 4 28225 NULL
117354 +amd_nb_num_28228 amd_nb_num 0 28228 NULL
117355 +fuse_direct_IO_28275 fuse_direct_IO 4 28275 NULL
117356 +usemap_size_28281 usemap_size 0 28281 NULL
117357 +inline_xattr_size_28285 inline_xattr_size 0 28285 NULL
117358 +dma_map_sg_attrs_28289 dma_map_sg_attrs 0 28289 NULL
117359 +SyS_ppoll_28290 SyS_ppoll 2 28290 NULL
117360 +kstrtos16_from_user_28300 kstrtos16_from_user 2 28300 NULL
117361 +nouveau_compat_ioctl_28305 nouveau_compat_ioctl 2 28305 NULL
117362 +snd_pcm_oss_read_28317 snd_pcm_oss_read 3 28317 NULL
117363 +security_inode_link_28327 security_inode_link 0 28327 NULL
117364 +generic_write_checks_28329 generic_write_checks 0 28329 NULL
117365 +bm_entry_write_28338 bm_entry_write 3 28338 NULL
117366 +tcp_copy_to_iovec_28344 tcp_copy_to_iovec 3 28344 NULL
117367 +snapshot_write_28351 snapshot_write 3 28351 NULL
117368 +xfs_iomap_write_unwritten_28365 xfs_iomap_write_unwritten 3-2 28365 NULL
117369 +batadv_handle_tt_response_28370 batadv_handle_tt_response 4 28370 NULL
117370 +dlmfs_file_read_28385 dlmfs_file_read 3 28385 NULL
117371 +tx_frag_cache_miss_read_28394 tx_frag_cache_miss_read 3 28394 NULL
117372 +bypass_pwup_write_28416 bypass_pwup_write 3 28416 NULL
117373 +subdev_ioctl_28417 subdev_ioctl 2 28417 NULL
117374 +ksocknal_alloc_tx_28426 ksocknal_alloc_tx 2 28426 NULL
117375 +mpage_readpages_28436 mpage_readpages 3 28436 NULL
117376 +xfs_rtfind_back_28450 xfs_rtfind_back 0 28450 NULL
117377 +snd_emu10k1_efx_read_28452 snd_emu10k1_efx_read 2 28452 NULL
117378 +key_mic_failures_read_28457 key_mic_failures_read 3 28457 NULL
117379 +alloc_irq_cpu_rmap_28459 alloc_irq_cpu_rmap 1 28459 NULL
117380 +__filemap_fdatawrite_28485 __filemap_fdatawrite 0 28485 NULL
117381 +ps_poll_upsd_utilization_read_28519 ps_poll_upsd_utilization_read 3 28519 NULL
117382 +i2400m_tx_stats_read_28527 i2400m_tx_stats_read 3 28527 NULL
117383 +sel_read_policycap_28544 sel_read_policycap 3 28544 NULL
117384 +mptctl_getiocinfo_28545 mptctl_getiocinfo 2 28545 NULL nohasharray
117385 +run_delalloc_range_28545 run_delalloc_range 3-4 28545 &mptctl_getiocinfo_28545 nohasharray
117386 +aio_read_events_28545 aio_read_events 3 28545 &run_delalloc_range_28545
117387 +sysfs_create_bin_file_28551 sysfs_create_bin_file 0 28551 NULL
117388 +b43legacy_debugfs_write_28556 b43legacy_debugfs_write 3 28556 NULL
117389 +asymmetric_verify_28567 asymmetric_verify 3 28567 NULL
117390 +gfs2_meta_indirect_buffer_28573 gfs2_meta_indirect_buffer 0 28573 NULL
117391 +oxygen_read32_28582 oxygen_read32 0 28582 NULL
117392 +extract_entropy_28604 extract_entropy 5-3 28604 NULL
117393 +kfifo_unused_28612 kfifo_unused 0 28612 NULL
117394 +snd_nm256_capture_copy_28622 snd_nm256_capture_copy 5-3 28622 NULL
117395 +setup_usemap_28636 setup_usemap 3-4 28636 NULL
117396 +qib_handle_6120_hwerrors_28642 qib_handle_6120_hwerrors 3 28642 NULL
117397 +xfs_bmap_finish_28644 xfs_bmap_finish 0 28644 NULL
117398 +p9_fcall_alloc_28652 p9_fcall_alloc 1 28652 NULL
117399 +read_nic_io_byte_28654 read_nic_io_byte 0 28654 NULL
117400 +blk_queue_resize_tags_28670 blk_queue_resize_tags 2 28670 NULL
117401 +SyS_setgroups16_28686 SyS_setgroups16 1 28686 NULL
117402 +kvm_mmu_get_page_28692 kvm_mmu_get_page 2 28692 NULL
117403 +drm_plane_init_28731 drm_plane_init 6 28731 NULL
117404 +spi_execute_28736 spi_execute 5 28736 NULL
117405 +snd_pcm_aio_write_28738 snd_pcm_aio_write 3 28738 NULL
117406 +read_file_btcoex_28743 read_file_btcoex 3 28743 NULL
117407 +max_hw_blocks_28748 max_hw_blocks 0 28748 NULL
117408 +rpc_pipe_generic_upcall_28766 rpc_pipe_generic_upcall 4 28766 NULL
117409 +ath6kl_get_num_reg_28780 ath6kl_get_num_reg 0 28780 NULL
117410 +sel_write_member_28800 sel_write_member 3 28800 NULL
117411 +iwl_dbgfs_rxon_filter_flags_read_28832 iwl_dbgfs_rxon_filter_flags_read 3 28832 NULL
117412 +vp_request_msix_vectors_28849 vp_request_msix_vectors 2 28849 NULL
117413 +ipv6_renew_options_28867 ipv6_renew_options 5 28867 NULL
117414 +max_io_len_target_boundary_28879 max_io_len_target_boundary 0-1 28879 NULL
117415 +packet_sendmsg_spkt_28885 packet_sendmsg_spkt 4 28885 NULL
117416 +da9055_group_write_28904 da9055_group_write 2-3 28904 NULL
117417 +ps_upsd_timeouts_read_28924 ps_upsd_timeouts_read 3 28924 NULL
117418 +iwl_dbgfs_sleep_level_override_write_28925 iwl_dbgfs_sleep_level_override_write 3 28925 NULL
117419 +push_rx_28939 push_rx 3 28939 NULL
117420 +mxuport_prepare_write_buffer_28943 mxuport_prepare_write_buffer 3 28943 NULL
117421 +btrfs_trim_block_group_28963 btrfs_trim_block_group 3-4 28963 NULL
117422 +alloc_sched_domains_28972 alloc_sched_domains 1 28972 NULL
117423 +hash_net6_expire_28979 hash_net6_expire 4 28979 NULL
117424 +xfs_alloc_update_28982 xfs_alloc_update 0 28982 NULL
117425 +hci_sock_setsockopt_28993 hci_sock_setsockopt 5 28993 NULL
117426 +bin_uuid_28999 bin_uuid 3 28999 NULL
117427 +fd_execute_rw_29004 fd_execute_rw 3 29004 NULL
117428 +ieee80211_if_read_ht_opmode_29044 ieee80211_if_read_ht_opmode 3 29044 NULL
117429 +rxrpc_sendmsg_29049 rxrpc_sendmsg 4 29049 NULL
117430 +btrfs_root_bytenr_29058 btrfs_root_bytenr 0 29058 NULL
117431 +iso_packets_buffer_init_29061 iso_packets_buffer_init 3-4 29061 NULL
117432 +lpfc_idiag_extacc_drivr_get_29067 lpfc_idiag_extacc_drivr_get 0-3 29067 NULL
117433 +sctp_getsockopt_assoc_stats_29074 sctp_getsockopt_assoc_stats 2 29074 NULL
117434 +xfs_alloc_ag_vextent_small_29084 xfs_alloc_ag_vextent_small 0 29084 NULL
117435 +iwl_dbgfs_log_event_write_29088 iwl_dbgfs_log_event_write 3 29088 NULL
117436 +i915_error_object_create_sized_29091 i915_error_object_create_sized 3 29091 NULL
117437 +ccp_init_dm_workarea_29097 ccp_init_dm_workarea 3 29097 NULL
117438 +isdn_ppp_write_29109 isdn_ppp_write 4 29109 NULL
117439 +snprintf_29125 snprintf 0 29125 NULL
117440 +iov_shorten_29130 iov_shorten 0 29130 NULL
117441 +proc_scsi_write_29142 proc_scsi_write 3 29142 NULL
117442 +kvm_mmu_notifier_clear_flush_young_29154 kvm_mmu_notifier_clear_flush_young 3 29154 NULL
117443 +drm_property_create_enum_29201 drm_property_create_enum 5 29201 NULL
117444 +wusb_prf_256_29203 wusb_prf_256 7 29203 NULL
117445 +iwl_dbgfs_temperature_read_29224 iwl_dbgfs_temperature_read 3 29224 NULL
117446 +nvme_trans_copy_from_user_29227 nvme_trans_copy_from_user 3 29227 NULL
117447 +irq_domain_add_linear_29236 irq_domain_add_linear 2 29236 NULL
117448 +evdev_handle_get_val_29242 evdev_handle_get_val 5-6 29242 NULL
117449 +security_context_to_sid_core_29248 security_context_to_sid_core 2 29248 NULL
117450 +prism2_set_genericelement_29277 prism2_set_genericelement 3 29277 NULL
117451 +ext4_fiemap_29296 ext4_fiemap 4 29296 NULL
117452 +xfs_bmap_btree_to_extents_29297 xfs_bmap_btree_to_extents 0 29297 NULL
117453 +sn9c102_read_29305 sn9c102_read 3 29305 NULL
117454 +__fuse_get_req_29315 __fuse_get_req 2 29315 NULL
117455 +lprocfs_write_helper_29323 lprocfs_write_helper 2 29323 NULL
117456 +xfs_bmbt_change_owner_29325 xfs_bmbt_change_owner 0 29325 NULL
117457 +kvm_handle_hva_29326 kvm_handle_hva 2 29326 NULL
117458 +tun_put_user_29337 tun_put_user 5 29337 NULL
117459 +__alloc_ei_netdev_29338 __alloc_ei_netdev 1 29338 NULL
117460 +l2cap_sock_setsockopt_old_29346 l2cap_sock_setsockopt_old 4 29346 NULL
117461 +read_file_tx99_power_29405 read_file_tx99_power 3 29405 NULL
117462 +mempool_create_29437 mempool_create 1 29437 NULL
117463 +crypto_ahash_alignmask_29445 crypto_ahash_alignmask 0 29445 NULL
117464 +p9_client_prepare_req_29448 p9_client_prepare_req 3 29448 NULL
117465 +validate_scan_freqs_29462 validate_scan_freqs 0 29462 NULL
117466 +SyS_flistxattr_29474 SyS_flistxattr 3 29474 NULL
117467 +do_register_entry_29478 do_register_entry 4 29478 NULL
117468 +simple_strtoul_29480 simple_strtoul 0 29480 NULL
117469 +btmrvl_pscmd_write_29504 btmrvl_pscmd_write 3 29504 NULL
117470 +btrfs_file_extent_disk_bytenr_29505 btrfs_file_extent_disk_bytenr 0 29505 NULL
117471 +usnic_vnic_spec_dump_29508 usnic_vnic_spec_dump 2 29508 NULL
117472 +write_file_regidx_29517 write_file_regidx 3 29517 NULL
117473 +atk_debugfs_ggrp_read_29522 atk_debugfs_ggrp_read 3 29522 NULL
117474 +add_to_page_cache_lru_29534 add_to_page_cache_lru 0 29534 NULL
117475 +ftrace_write_29551 ftrace_write 3 29551 NULL
117476 +idetape_queue_rw_tail_29562 idetape_queue_rw_tail 3 29562 NULL
117477 +leaf_dealloc_29566 leaf_dealloc 3 29566 NULL
117478 +kvm_read_guest_virt_system_29569 kvm_read_guest_virt_system 4-2 29569 NULL
117479 +lbs_lowsnr_read_29571 lbs_lowsnr_read 3 29571 NULL
117480 +security_path_chmod_29578 security_path_chmod 0 29578 NULL
117481 +iwl_dbgfs_missed_beacon_write_29586 iwl_dbgfs_missed_beacon_write 3 29586 NULL
117482 +pvr2_hdw_report_unlocked_29589 pvr2_hdw_report_unlocked 4-0 29589 NULL
117483 +dio_set_defer_completion_29599 dio_set_defer_completion 0 29599 NULL
117484 +slots_per_page_29601 slots_per_page 0 29601 NULL
117485 +osc_cached_mb_seq_write_29610 osc_cached_mb_seq_write 3 29610 NULL
117486 +nla_get_u16_29624 nla_get_u16 0 29624 NULL
117487 +gfs2_alloc_blocks_29630 gfs2_alloc_blocks 0 29630 NULL
117488 +tx_frag_cache_hit_read_29639 tx_frag_cache_hit_read 3 29639 NULL
117489 +sctp_make_abort_user_29654 sctp_make_abort_user 3 29654 NULL
117490 +sisusb_write_mem_bulk_29678 sisusb_write_mem_bulk 4 29678 NULL
117491 +lustre_posix_acl_xattr_2ext_29693 lustre_posix_acl_xattr_2ext 2 29693 NULL
117492 +posix_acl_from_xattr_29708 posix_acl_from_xattr 3 29708 NULL
117493 +probes_write_29711 probes_write 3 29711 NULL
117494 +read_cis_cache_29735 read_cis_cache 4 29735 NULL
117495 +xfs_new_eof_29737 xfs_new_eof 2 29737 NULL
117496 +std_nic_write_29752 std_nic_write 3 29752 NULL
117497 +dbAlloc_29794 dbAlloc 0 29794 NULL
117498 +tcp_sendpage_29829 tcp_sendpage 4 29829 NULL
117499 +__probe_kernel_write_29842 __probe_kernel_write 3 29842 NULL
117500 +kvm_read_hva_atomic_29848 kvm_read_hva_atomic 3 29848 NULL
117501 +count_partial_29850 count_partial 0 29850 NULL
117502 +xfs_rtfind_forw_29866 xfs_rtfind_forw 0 29866 NULL
117503 +write_file_bool_bmps_29870 write_file_bool_bmps 3 29870 NULL
117504 +ipv6_setsockopt_29871 ipv6_setsockopt 5 29871 NULL
117505 +scsi_end_request_29876 scsi_end_request 3 29876 NULL
117506 +crypto_aead_alignmask_29885 crypto_aead_alignmask 0 29885 NULL
117507 +xfs_alloc_read_agf_29893 xfs_alloc_read_agf 0 29893 NULL
117508 +lov_ost_pool_extend_29914 lov_ost_pool_extend 2 29914 NULL
117509 +write_file_queue_29922 write_file_queue 3 29922 NULL
117510 +__btrfs_getxattr_29947 __btrfs_getxattr 0 29947 NULL nohasharray
117511 +ipv6_recv_error_29947 ipv6_recv_error 3 29947 &__btrfs_getxattr_29947
117512 +dev_mem_write_30028 dev_mem_write 3 30028 NULL
117513 +alloc_netdev_mqs_30030 alloc_netdev_mqs 1 30030 NULL
117514 +sysfs_add_file_mode_ns_30038 sysfs_add_file_mode_ns 0 30038 NULL
117515 +scsi_vpd_inquiry_30040 scsi_vpd_inquiry 4 30040 NULL
117516 +drp_wmove_30043 drp_wmove 4 30043 NULL
117517 +mem_cgroup_charge_common_30047 mem_cgroup_charge_common 0 30047 NULL
117518 +__pci_request_selected_regions_30058 __pci_request_selected_regions 0 30058 NULL
117519 +cxgbi_ddp_reserve_30091 cxgbi_ddp_reserve 4 30091 NULL
117520 +snd_midi_channel_init_set_30092 snd_midi_channel_init_set 1 30092 NULL
117521 +rx_filter_data_filter_read_30098 rx_filter_data_filter_read 3 30098 NULL
117522 +defragment_dma_buffer_30113 defragment_dma_buffer 0 30113 NULL
117523 +xfs_iget_cache_miss_30115 xfs_iget_cache_miss 0 30115 NULL
117524 +spi_async_locked_30117 spi_async_locked 0 30117 NULL
117525 +recv_stream_30138 recv_stream 4 30138 NULL
117526 +u_memcpya_30139 u_memcpya 3-2 30139 NULL
117527 +dbg_port_buf_30145 dbg_port_buf 2 30145 NULL
117528 +elfcorehdr_read_30159 elfcorehdr_read 2 30159 NULL
117529 +alloc_switch_ctx_30165 alloc_switch_ctx 2 30165 NULL
117530 +expand_inode_data_30169 expand_inode_data 3-2 30169 NULL
117531 +mempool_create_page_pool_30189 mempool_create_page_pool 1 30189 NULL
117532 +drm_property_create_bitmask_30195 drm_property_create_bitmask 5 30195 NULL
117533 +__genwqe_readq_30197 __genwqe_readq 0 30197 NULL
117534 +usblp_ioctl_30203 usblp_ioctl 2 30203 NULL
117535 +read_4k_modal_eeprom_30212 read_4k_modal_eeprom 3 30212 NULL
117536 +bitmap_file_set_bit_30228 bitmap_file_set_bit 2 30228 NULL
117537 +shmem_unuse_inode_30263 shmem_unuse_inode 0 30263 NULL
117538 +rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
117539 +try_break_deleg_30271 try_break_deleg 0 30271 NULL nohasharray
117540 +isr_pci_pm_read_30271 isr_pci_pm_read 3 30271 &try_break_deleg_30271
117541 +compat_readv_30273 compat_readv 3 30273 NULL
117542 +skcipher_sendmsg_30290 skcipher_sendmsg 4 30290 NULL
117543 +pipeline_sec_frag_swi_read_30294 pipeline_sec_frag_swi_read 3 30294 NULL
117544 +tcp_sendmsg_30296 tcp_sendmsg 4 30296 NULL
117545 +osc_contention_seconds_seq_write_30305 osc_contention_seconds_seq_write 3 30305 NULL
117546 +ext4_acl_from_disk_30320 ext4_acl_from_disk 2 30320 NULL
117547 +i8254_read_30330 i8254_read 0 30330 NULL
117548 +resource_from_user_30341 resource_from_user 3 30341 NULL
117549 +o2nm_this_node_30342 o2nm_this_node 0 30342 NULL
117550 +gfs2_trans_begin_30359 gfs2_trans_begin 0 30359 NULL
117551 +kstrtou32_from_user_30361 kstrtou32_from_user 2 30361 NULL
117552 +pagecache_write_begin_30364 pagecache_write_begin 0 30364 NULL
117553 +C_SYSC_readv_30369 C_SYSC_readv 3 30369 NULL
117554 +blkdev_issue_zeroout_30392 blkdev_issue_zeroout 3 30392 NULL
117555 +c4iw_init_resource_30393 c4iw_init_resource 2-3 30393 NULL
117556 +get_kernel_pages_30397 get_kernel_pages 0 30397 NULL
117557 +vb2_fop_write_30420 vb2_fop_write 3 30420 NULL
117558 +tx_tx_template_prepared_read_30424 tx_tx_template_prepared_read 3 30424 NULL
117559 +lstcon_session_info_30425 lstcon_session_info 6 30425 NULL
117560 +enable_write_30456 enable_write 3 30456 NULL
117561 +tx_tx_template_programmed_read_30461 tx_tx_template_programmed_read 3 30461 NULL
117562 +urandom_read_30462 urandom_read 3 30462 NULL
117563 +zoran_ioctl_30465 zoran_ioctl 2 30465 NULL
117564 +i2c_ctrl_read_30467 i2c_ctrl_read 0 30467 NULL
117565 +adu_write_30487 adu_write 3 30487 NULL
117566 +dtim_interval_write_30489 dtim_interval_write 3 30489 NULL
117567 +batadv_send_tt_request_30493 batadv_send_tt_request 5 30493 NULL
117568 +__send_duplicate_bios_30498 __send_duplicate_bios 4 30498 NULL
117569 +memblock_virt_alloc_node_30515 memblock_virt_alloc_node 1 30515 NULL
117570 +dwc3_testmode_write_30516 dwc3_testmode_write 3 30516 NULL
117571 +set_config_30526 set_config 0 30526 NULL nohasharray
117572 +debug_debug2_read_30526 debug_debug2_read 3 30526 &set_config_30526
117573 +xfs_sb_version_hasftype_30559 xfs_sb_version_hasftype 0 30559 NULL
117574 +disk_expand_part_tbl_30561 disk_expand_part_tbl 2 30561 NULL
117575 +set_le_30581 set_le 4 30581 NULL
117576 +blk_init_tags_30592 blk_init_tags 1 30592 NULL
117577 +sgl_map_user_pages_30610 sgl_map_user_pages 2 30610 NULL
117578 +macvtap_sendmsg_30629 macvtap_sendmsg 4 30629 NULL
117579 +ieee80211_if_read_dot11MeshAwakeWindowDuration_30631 ieee80211_if_read_dot11MeshAwakeWindowDuration 3 30631 NULL
117580 +compat_raw_setsockopt_30634 compat_raw_setsockopt 5 30634 NULL
117581 +mlx5_ib_alloc_fast_reg_page_list_30638 mlx5_ib_alloc_fast_reg_page_list 2 30638 NULL
117582 +SyS_listxattr_30647 SyS_listxattr 3 30647 NULL
117583 +jffs2_flash_read_30667 jffs2_flash_read 0 30667 NULL
117584 +ni_ai_fifo_read_30681 ni_ai_fifo_read 3 30681 NULL
117585 +dccp_setsockopt_ccid_30701 dccp_setsockopt_ccid 4 30701 NULL nohasharray
117586 +xfs_bmap_add_extent_unwritten_real_30701 xfs_bmap_add_extent_unwritten_real 0 30701 &dccp_setsockopt_ccid_30701
117587 +lbs_wrbbp_write_30712 lbs_wrbbp_write 3 30712 NULL
117588 +lbs_debugfs_read_30721 lbs_debugfs_read 3 30721 NULL
117589 +snd_nm256_playback_silence_30727 snd_nm256_playback_silence 4-3 30727 NULL
117590 +snapshot_status_30744 snapshot_status 5 30744 NULL
117591 +fuse_conn_limit_write_30777 fuse_conn_limit_write 3 30777 NULL
117592 +__bio_alloc_30787 __bio_alloc 3 30787 NULL
117593 +smk_read_doi_30813 smk_read_doi 3 30813 NULL
117594 +xlog_grant_head_wait_30829 xlog_grant_head_wait 0 30829 NULL
117595 +get_kobj_path_length_30831 get_kobj_path_length 0 30831 NULL
117596 +ath10k_write_fw_dbglog_30835 ath10k_write_fw_dbglog 3 30835 NULL
117597 +sctp_setsockopt_auth_chunk_30843 sctp_setsockopt_auth_chunk 3 30843 NULL
117598 +wd_autoreset_write_30862 wd_autoreset_write 3 30862 NULL
117599 +ieee80211_if_fmt_dropped_frames_no_route_30884 ieee80211_if_fmt_dropped_frames_no_route 3 30884 NULL
117600 +pn_recvmsg_30887 pn_recvmsg 4 30887 NULL
117601 +usnic_debugfs_buildinfo_read_30928 usnic_debugfs_buildinfo_read 3 30928 NULL
117602 +sctp_setsockopt_rtoinfo_30941 sctp_setsockopt_rtoinfo 3 30941 NULL
117603 +tty_insert_flip_string_flags_30969 tty_insert_flip_string_flags 4 30969 NULL
117604 +huge_page_mask_30981 huge_page_mask 0 30981 NULL
117605 +read_file_bt_ant_diversity_30983 read_file_bt_ant_diversity 3 30983 NULL
117606 +lbs_host_sleep_read_31013 lbs_host_sleep_read 3 31013 NULL
117607 +ima_eventsig_init_31022 ima_eventsig_init 5 31022 NULL
117608 +template_fmt_size_31033 template_fmt_size 0 31033 NULL
117609 +do_setup_msi_irqs_31043 do_setup_msi_irqs 2 31043 NULL
117610 +stride_pg_count_31053 stride_pg_count 0-3-2-1-4-5 31053 NULL
117611 +lbs_failcount_read_31063 lbs_failcount_read 3 31063 NULL
117612 +sctp_setsockopt_context_31091 sctp_setsockopt_context 3 31091 NULL
117613 +proc_gid_map_write_31093 proc_gid_map_write 3 31093 NULL
117614 +compat_sys_get_mempolicy_31109 compat_sys_get_mempolicy 3 31109 NULL
117615 +depth_read_31112 depth_read 3 31112 NULL
117616 +hash_ipportnet6_expire_31118 hash_ipportnet6_expire 4 31118 NULL
117617 +kimage_normal_alloc_31140 kimage_normal_alloc 3 31140 NULL
117618 +size_inside_page_31141 size_inside_page 0 31141 NULL
117619 +w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
117620 +ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
117621 +r592_read_fifo_pio_31198 r592_read_fifo_pio 3 31198 NULL
117622 +mtdchar_readoob_31200 mtdchar_readoob 4 31200 NULL
117623 +__btrfs_free_reserved_extent_31207 __btrfs_free_reserved_extent 2 31207 NULL
117624 +cpumask_weight_31215 cpumask_weight 0 31215 NULL
117625 +__read_reg_31216 __read_reg 0 31216 NULL
117626 +atm_get_addr_31221 atm_get_addr 3 31221 NULL
117627 +tcp_recvmsg_31238 tcp_recvmsg 4 31238 NULL
117628 +cyy_readb_31240 cyy_readb 0 31240 NULL
117629 +_create_sg_bios_31244 _create_sg_bios 4 31244 NULL
117630 +ieee80211_if_read_last_beacon_31257 ieee80211_if_read_last_beacon 3 31257 NULL
117631 +hash_netportnet4_expire_31290 hash_netportnet4_expire 4 31290 NULL
117632 +uvc_simplify_fraction_31303 uvc_simplify_fraction 3 31303 NULL
117633 +sisusbcon_scroll_31315 sisusbcon_scroll 5-2-3 31315 NULL
117634 +command_file_write_31318 command_file_write 3 31318 NULL
117635 +hwerr_crcbits_31334 hwerr_crcbits 4 31334 NULL
117636 +radix_tree_insert_31336 radix_tree_insert 0 31336 NULL
117637 +em28xx_init_usb_xfer_31337 em28xx_init_usb_xfer 4-6 31337 NULL
117638 +outlen_write_31358 outlen_write 3 31358 NULL
117639 +ieee80211_rx_mgmt_auth_31366 ieee80211_rx_mgmt_auth 3 31366 NULL
117640 +xprt_rdma_allocate_31372 xprt_rdma_allocate 2 31372 NULL
117641 +vb2_vmalloc_get_userptr_31374 vb2_vmalloc_get_userptr 3-2 31374 NULL
117642 +trace_parser_get_init_31379 trace_parser_get_init 2 31379 NULL
117643 +inb_31388 inb 0 31388 NULL
117644 +key_ifindex_read_31411 key_ifindex_read 3 31411 NULL
117645 +_sp2d_max_pg_31422 _sp2d_max_pg 0 31422 NULL
117646 +TSS_checkhmac1_31429 TSS_checkhmac1 5 31429 NULL
117647 +snd_aw2_saa7146_get_hw_ptr_capture_31431 snd_aw2_saa7146_get_hw_ptr_capture 0 31431 NULL
117648 +transport_alloc_session_tags_31449 transport_alloc_session_tags 2-3 31449 NULL
117649 +opera1_xilinx_rw_31453 opera1_xilinx_rw 5 31453 NULL
117650 +xfs_btree_get_numrecs_31477 xfs_btree_get_numrecs 0 31477 NULL
117651 +alg_setkey_31485 alg_setkey 3 31485 NULL
117652 +rds_message_map_pages_31487 rds_message_map_pages 2 31487 NULL
117653 +qsfp_2_read_31491 qsfp_2_read 3 31491 NULL
117654 +__alloc_bootmem_31498 __alloc_bootmem 1 31498 NULL
117655 +hidraw_write_31536 hidraw_write 3 31536 NULL
117656 +usbvision_read_31555 usbvision_read 3 31555 NULL
117657 +tx_frag_tkip_called_read_31575 tx_frag_tkip_called_read 3 31575 NULL
117658 +get_max_inline_xattr_value_size_31578 get_max_inline_xattr_value_size 0 31578 NULL
117659 +osst_write_31581 osst_write 3 31581 NULL
117660 +snd_compr_get_avail_31584 snd_compr_get_avail 0 31584 NULL
117661 +iwl_dbgfs_ucode_tx_stats_read_31611 iwl_dbgfs_ucode_tx_stats_read 3 31611 NULL
117662 +mtd_get_user_prot_info_31616 mtd_get_user_prot_info 0 31616 NULL
117663 +arvo_sysfs_read_31617 arvo_sysfs_read 6 31617 NULL nohasharray
117664 +memblock_virt_alloc_nopanic_31617 memblock_virt_alloc_nopanic 1 31617 &arvo_sysfs_read_31617
117665 +usnic_ib_dump_vf_31623 usnic_ib_dump_vf 3 31623 NULL
117666 +videobuf_read_one_31637 videobuf_read_one 3 31637 NULL
117667 +pod_alloc_sysex_buffer_31651 pod_alloc_sysex_buffer 3 31651 NULL
117668 +xfer_secondary_pool_31661 xfer_secondary_pool 2 31661 NULL
117669 +__lgread_31668 __lgread 4 31668 NULL
117670 +copy_from_user_nmi_31672 copy_from_user_nmi 3-0 31672 NULL
117671 +forced_ps_read_31685 forced_ps_read 3 31685 NULL
117672 +fst_recover_rx_error_31687 fst_recover_rx_error 3 31687 NULL
117673 +gfs2_dir_check_31711 gfs2_dir_check 0 31711 NULL
117674 +rs_pretty_print_rate_31727 rs_pretty_print_rate 0 31727 NULL
117675 +utf16s_to_utf8s_31735 utf16s_to_utf8s 0 31735 NULL nohasharray
117676 +lu_buf_check_and_grow_31735 lu_buf_check_and_grow 2 31735 &utf16s_to_utf8s_31735
117677 +shmem_pwrite_slow_31741 shmem_pwrite_slow 3-2 31741 NULL
117678 +input_abs_get_max_31742 input_abs_get_max 0 31742 NULL nohasharray
117679 +NCR_700_change_queue_depth_31742 NCR_700_change_queue_depth 2 31742 &input_abs_get_max_31742
117680 +bcm_char_read_31750 bcm_char_read 3 31750 NULL
117681 +snd_seq_device_new_31753 snd_seq_device_new 4 31753 NULL
117682 +SyS_lsetxattr_31766 SyS_lsetxattr 4 31766 NULL
117683 +osync_buffers_list_31789 osync_buffers_list 0 31789 NULL
117684 +usblp_cache_device_id_string_31790 usblp_cache_device_id_string 0 31790 NULL
117685 +ecryptfs_send_message_locked_31801 ecryptfs_send_message_locked 2 31801 NULL
117686 +isr_rx_procs_read_31804 isr_rx_procs_read 3 31804 NULL
117687 +data_write_31805 data_write 3 31805 NULL
117688 +SyS_msgsnd_31814 SyS_msgsnd 3 31814 NULL
117689 +strnlen_user_31815 strnlen_user 0-2 31815 NULL
117690 +sta_last_signal_read_31818 sta_last_signal_read 3 31818 NULL
117691 +clone_bio_31854 clone_bio 4-3 31854 NULL
117692 +SyS_ppoll_31855 SyS_ppoll 2 31855 NULL
117693 +foreach_descriptor_31873 foreach_descriptor 0 31873 NULL
117694 +iwl_dbgfs_disable_ht40_write_31876 iwl_dbgfs_disable_ht40_write 3 31876 NULL
117695 +drm_mode_crtc_set_gamma_size_31881 drm_mode_crtc_set_gamma_size 2 31881 NULL
117696 +ddb_output_write_31902 ddb_output_write 3-0 31902 NULL
117697 +xattr_permission_31907 xattr_permission 0 31907 NULL
117698 +lu_buf_realloc_31915 lu_buf_realloc 2 31915 NULL
117699 +new_dir_31919 new_dir 3 31919 NULL
117700 +kmem_alloc_31920 kmem_alloc 1 31920 NULL
117701 +SYSC_sethostname_31940 SYSC_sethostname 2 31940 NULL
117702 +read_mem_31942 read_mem 3 31942 NULL nohasharray
117703 +iov_iter_copy_from_user_31942 iov_iter_copy_from_user 4-0 31942 &read_mem_31942
117704 +vb2_write_31948 vb2_write 3 31948 NULL
117705 +pvr2_ctrl_get_valname_31951 pvr2_ctrl_get_valname 4 31951 NULL
117706 +regcache_rbtree_sync_31964 regcache_rbtree_sync 2 31964 NULL
117707 +iwl_rx_packet_payload_len_31965 iwl_rx_packet_payload_len 0 31965 NULL
117708 +copy_from_user_toio_31966 copy_from_user_toio 3 31966 NULL
117709 +iblock_execute_rw_31982 iblock_execute_rw 3 31982 NULL nohasharray
117710 +vx_read_status_31982 vx_read_status 0 31982 &iblock_execute_rw_31982
117711 +find_next_zero_bit_31990 find_next_zero_bit 0 31990 NULL
117712 +lustre_acl_xattr_merge2posix_31992 lustre_acl_xattr_merge2posix 2 31992 NULL
117713 +sysfs_create_file_31996 sysfs_create_file 0 31996 NULL
117714 +calc_hmac_32010 calc_hmac 3 32010 NULL
117715 +aead_len_32021 aead_len 0 32021 NULL
117716 +stk_read_32038 stk_read 3 32038 NULL
117717 +SYSC_llistxattr_32061 SYSC_llistxattr 3 32061 NULL
117718 +proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
117719 +xfs_buf_iowait_32068 xfs_buf_iowait 0 32068 NULL
117720 +cow_file_range_inline_32091 cow_file_range_inline 3 32091 NULL
117721 +bio_alloc_32095 bio_alloc 2 32095 NULL
117722 +ath6kl_fwlog_read_32101 ath6kl_fwlog_read 3 32101 NULL
117723 +disk_status_32120 disk_status 4 32120 NULL
117724 +kobject_add_internal_32133 kobject_add_internal 0 32133 NULL
117725 +venus_link_32165 venus_link 5 32165 NULL
117726 +do_writepages_32173 do_writepages 0 32173 NULL
117727 +del_ptr_32197 del_ptr 4 32197 NULL
117728 +wusb_ccm_mac_32199 wusb_ccm_mac 7 32199 NULL
117729 +__mem_cgroup_try_charge_swapin_32204 __mem_cgroup_try_charge_swapin 0 32204 NULL
117730 +riva_get_cmap_len_32218 riva_get_cmap_len 0 32218 NULL
117731 +caif_seqpkt_recvmsg_32241 caif_seqpkt_recvmsg 4 32241 NULL
117732 +lbs_lowrssi_read_32242 lbs_lowrssi_read 3 32242 NULL
117733 +ocfs2_xattr_find_entry_32260 ocfs2_xattr_find_entry 0 32260 NULL
117734 +kvm_set_spte_hva_32312 kvm_set_spte_hva 2 32312 NULL
117735 +cas_calc_tabort_32316 cas_calc_tabort 0 32316 NULL
117736 +SyS_select_32319 SyS_select 1 32319 NULL
117737 +nouveau_bar_create__32332 nouveau_bar_create_ 4 32332 NULL
117738 +nl80211_send_mlme_event_32337 nl80211_send_mlme_event 4 32337 NULL
117739 +xfs_bmap_extsize_align_32338 xfs_bmap_extsize_align 0 32338 NULL
117740 +t4_alloc_mem_32342 t4_alloc_mem 1 32342 NULL
117741 +dispatch_ioctl_32357 dispatch_ioctl 2 32357 NULL nohasharray
117742 +rx_streaming_always_write_32357 rx_streaming_always_write 3 32357 &dispatch_ioctl_32357
117743 +ReadHDLCPCI_32362 ReadHDLCPCI 0 32362 NULL nohasharray
117744 +sel_read_initcon_32362 sel_read_initcon 3 32362 &ReadHDLCPCI_32362
117745 +ocfs2_cancel_convert_32392 ocfs2_cancel_convert 0 32392 NULL
117746 +ll_setxattr_common_32398 ll_setxattr_common 4 32398 NULL
117747 +xfs_iext_add_indirect_multi_32400 xfs_iext_add_indirect_multi 3 32400 NULL
117748 +vmci_qp_alloc_32405 vmci_qp_alloc 5-3 32405 NULL
117749 +xfs_alloc_put_freelist_32437 xfs_alloc_put_freelist 0 32437 NULL
117750 +cache_status_32462 cache_status 5 32462 NULL
117751 +fill_readbuf_32464 fill_readbuf 3 32464 NULL
117752 +dgap_usertoboard_32490 dgap_usertoboard 4 32490 NULL
117753 +ide_driver_proc_write_32493 ide_driver_proc_write 3 32493 NULL
117754 +bypass_pwoff_write_32499 bypass_pwoff_write 3 32499 NULL
117755 +mdc_pinger_recov_seq_write_32510 mdc_pinger_recov_seq_write 3 32510 NULL
117756 +ctrl_std_val_to_sym_32516 ctrl_std_val_to_sym 5 32516 NULL
117757 +disconnect_32521 disconnect 4 32521 NULL
117758 +qsfp_read_32522 qsfp_read 0-2-4 32522 NULL
117759 +ocfs2_refresh_qinfo_32524 ocfs2_refresh_qinfo 0 32524 NULL
117760 +ilo_read_32531 ilo_read 3 32531 NULL
117761 +ieee80211_if_read_estab_plinks_32533 ieee80211_if_read_estab_plinks 3 32533 NULL
117762 +format_devstat_counter_32550 format_devstat_counter 3 32550 NULL
117763 +aes_encrypt_fail_read_32562 aes_encrypt_fail_read 3 32562 NULL
117764 +osc_iocontrol_32565 osc_iocontrol 3 32565 NULL
117765 +mem_swapout_entry_32586 mem_swapout_entry 3 32586 NULL
117766 +pipeline_tcp_tx_stat_fifo_int_read_32589 pipeline_tcp_tx_stat_fifo_int_read 3 32589 NULL
117767 +read_file_beacon_32595 read_file_beacon 3 32595 NULL
117768 +ieee80211_if_read_dropped_frames_congestion_32603 ieee80211_if_read_dropped_frames_congestion 3 32603 NULL
117769 +xfs_bmap_last_offset_32614 xfs_bmap_last_offset 0 32614 NULL
117770 +irda_recvmsg_dgram_32631 irda_recvmsg_dgram 4 32631 NULL
117771 +cfg80211_roamed_32632 cfg80211_roamed 5-7 32632 NULL
117772 +kvmalloc_32646 kvmalloc 1 32646 NULL
117773 +ib_sg_dma_len_32649 ib_sg_dma_len 0 32649 NULL
117774 +generic_readlink_32654 generic_readlink 3 32654 NULL
117775 +move_addr_to_kernel_32673 move_addr_to_kernel 2 32673 NULL
117776 +apei_res_add_32674 apei_res_add 0 32674 NULL
117777 +jfs_readpages_32702 jfs_readpages 4 32702 NULL
117778 +xfs_filestream_new_ag_32711 xfs_filestream_new_ag 0 32711 NULL
117779 +rt2x00debug_read_queue_dump_32712 rt2x00debug_read_queue_dump 3 32712 NULL
117780 +xfs_bmbt_update_32713 xfs_bmbt_update 0 32713 NULL
117781 +i40e_pci_sriov_enable_32742 i40e_pci_sriov_enable 2 32742 NULL
117782 +megasas_change_queue_depth_32747 megasas_change_queue_depth 2 32747 NULL
117783 +stats_read_ul_32751 stats_read_ul 3 32751 NULL
117784 +vmci_transport_dgram_dequeue_32775 vmci_transport_dgram_dequeue 4 32775 NULL
117785 +sctp_tsnmap_grow_32784 sctp_tsnmap_grow 2 32784 NULL
117786 +xfs_trans_read_buf_32795 xfs_trans_read_buf 0 32795 NULL
117787 +rproc_name_read_32805 rproc_name_read 3 32805 NULL
117788 +sta_tx_latency_stat_read_32862 sta_tx_latency_stat_read 3 32862 NULL
117789 +new_tape_buffer_32866 new_tape_buffer 2 32866 NULL
117790 +cifs_writedata_alloc_32880 cifs_writedata_alloc 1 32880 NULL nohasharray
117791 +ath6kl_usb_submit_ctrl_in_32880 ath6kl_usb_submit_ctrl_in 6 32880 &cifs_writedata_alloc_32880
117792 +vp702x_usb_inout_cmd_32884 vp702x_usb_inout_cmd 4-6 32884 NULL
117793 +il_dbgfs_tx_stats_read_32913 il_dbgfs_tx_stats_read 3 32913 NULL
117794 +zlib_inflate_workspacesize_32927 zlib_inflate_workspacesize 0 32927 NULL
117795 +rmap_recycle_32938 rmap_recycle 3 32938 NULL
117796 +xfs_log_reserve_32959 xfs_log_reserve 0 32959 NULL
117797 +compat_filldir_32999 compat_filldir 3 32999 NULL
117798 +SyS_syslog_33007 SyS_syslog 3 33007 NULL
117799 +br_multicast_set_hash_max_33012 br_multicast_set_hash_max 2 33012 NULL
117800 +write_file_bt_ant_diversity_33019 write_file_bt_ant_diversity 3 33019 NULL
117801 +mic_virtio_copy_to_user_33048 mic_virtio_copy_to_user 3 33048 NULL
117802 +SYSC_lgetxattr_33049 SYSC_lgetxattr 4 33049 NULL
117803 +pipeline_dec_packet_in_fifo_full_read_33052 pipeline_dec_packet_in_fifo_full_read 3 33052 NULL
117804 +ebt_compat_match_offset_33053 ebt_compat_match_offset 0-2 33053 NULL
117805 +bitmap_resize_33054 bitmap_resize 2 33054 NULL
117806 +stats_dot11RTSSuccessCount_read_33065 stats_dot11RTSSuccessCount_read 3 33065 NULL
117807 +sel_read_checkreqprot_33068 sel_read_checkreqprot 3 33068 NULL
117808 +alloc_tio_33077 alloc_tio 3 33077 NULL
117809 +acl_permission_check_33083 acl_permission_check 0 33083 NULL
117810 +fb_sys_write_33130 fb_sys_write 3 33130 NULL
117811 +notify_change_33143 notify_change 0 33143 NULL
117812 +SyS_poll_33152 SyS_poll 2 33152 NULL
117813 +_pci_add_cap_save_buffer_33153 _pci_add_cap_save_buffer 4 33153 NULL
117814 +debug_debug6_read_33168 debug_debug6_read 3 33168 NULL
117815 +dataflash_read_fact_otp_33204 dataflash_read_fact_otp 3-2 33204 NULL
117816 +pp_read_33210 pp_read 3 33210 NULL
117817 +xfs_file_aio_write_33234 xfs_file_aio_write 4 33234 NULL
117818 +snd_pcm_plug_client_size_33267 snd_pcm_plug_client_size 0-2 33267 NULL
117819 +cachefiles_cook_key_33274 cachefiles_cook_key 2 33274 NULL
117820 +sync_pt_create_33282 sync_pt_create 2 33282 NULL
117821 +mcs7830_get_reg_33308 mcs7830_get_reg 3 33308 NULL
117822 +isku_sysfs_read_keys_easyzone_33318 isku_sysfs_read_keys_easyzone 6 33318 NULL
117823 +vx_send_irq_dsp_33329 vx_send_irq_dsp 0 33329 NULL
117824 +joydev_ioctl_33343 joydev_ioctl 2 33343 NULL
117825 +lov_stripesize_seq_write_33353 lov_stripesize_seq_write 3 33353 NULL
117826 +create_xattr_datum_33356 create_xattr_datum 5 33356 NULL nohasharray
117827 +irq_pkt_threshold_read_33356 irq_pkt_threshold_read 3 33356 &create_xattr_datum_33356
117828 +read_file_regidx_33370 read_file_regidx 3 33370 NULL
117829 +ieee80211_if_read_dropped_frames_no_route_33383 ieee80211_if_read_dropped_frames_no_route 3 33383 NULL
117830 +scsi_varlen_cdb_length_33385 scsi_varlen_cdb_length 0 33385 NULL
117831 +ocfs2_allocate_unwritten_extents_33394 ocfs2_allocate_unwritten_extents 3-2 33394 NULL
117832 +cfs_trace_copyin_string_33396 cfs_trace_copyin_string 4 33396 NULL
117833 +snd_pcm_capture_ioctl1_33408 snd_pcm_capture_ioctl1 0 33408 NULL
117834 +filemap_fdatawrite_33415 filemap_fdatawrite 0 33415 NULL
117835 +hash_netiface6_expire_33421 hash_netiface6_expire 4 33421 NULL
117836 +dis_tap_write_33426 dis_tap_write 3 33426 NULL
117837 +message_stats_list_33440 message_stats_list 5 33440 NULL
117838 +ovs_vport_alloc_33475 ovs_vport_alloc 1 33475 NULL
117839 +create_entry_33479 create_entry 2 33479 NULL
117840 +ip_setsockopt_33487 ip_setsockopt 5 33487 NULL
117841 +res_counter_read_33499 res_counter_read 4 33499 NULL
117842 +hash_netnet4_expire_33500 hash_netnet4_expire 4 33500 NULL
117843 +fb_read_33506 fb_read 3 33506 NULL
117844 +musb_test_mode_write_33518 musb_test_mode_write 3 33518 NULL
117845 +ahash_setkey_unaligned_33521 ahash_setkey_unaligned 3 33521 NULL
117846 +nes_alloc_fast_reg_page_list_33523 nes_alloc_fast_reg_page_list 2 33523 NULL
117847 +aggr_size_rx_size_read_33526 aggr_size_rx_size_read 3 33526 NULL
117848 +tomoyo_read_self_33539 tomoyo_read_self 3 33539 NULL nohasharray
117849 +osc_max_rpcs_in_flight_seq_write_33539 osc_max_rpcs_in_flight_seq_write 3 33539 &tomoyo_read_self_33539
117850 +count_subheaders_33591 count_subheaders 0 33591 NULL
117851 +scsi_execute_33596 scsi_execute 5 33596 NULL
117852 +comedi_buf_write_n_allocated_33604 comedi_buf_write_n_allocated 0 33604 NULL
117853 +xt_compat_target_offset_33608 xt_compat_target_offset 0 33608 NULL
117854 +usb_gstrings_attach_33615 usb_gstrings_attach 3 33615 NULL nohasharray
117855 +il_dbgfs_qos_read_33615 il_dbgfs_qos_read 3 33615 &usb_gstrings_attach_33615
117856 +xfs_btree_check_sblock_33618 xfs_btree_check_sblock 0 33618 NULL
117857 +stride_page_count_33641 stride_page_count 2 33641 NULL
117858 +irq_blk_threshold_read_33666 irq_blk_threshold_read 3 33666 NULL
117859 +inw_p_33668 inw_p 0 33668 NULL
117860 +arp_hdr_len_33671 arp_hdr_len 0 33671 NULL
117861 +i2c_hid_alloc_buffers_33673 i2c_hid_alloc_buffers 2 33673 NULL
117862 +submit_one_bio_33683 submit_one_bio 0 33683 NULL
117863 +nv50_disp_dmac_create__33696 nv50_disp_dmac_create_ 6 33696 NULL
117864 +netlink_sendmsg_33708 netlink_sendmsg 4 33708 NULL
117865 +tipc_link_stats_33716 tipc_link_stats 3 33716 NULL
117866 +ext4_wb_update_i_disksize_33717 ext4_wb_update_i_disksize 2 33717 NULL
117867 +pvr2_stream_buffer_count_33719 pvr2_stream_buffer_count 2 33719 NULL
117868 +write_file_spectral_count_33723 write_file_spectral_count 3 33723 NULL
117869 +read_file_node_recv_33729 read_file_node_recv 3 33729 NULL
117870 +__mutex_lock_interruptible_slowpath_33735 __mutex_lock_interruptible_slowpath 0 33735 NULL
117871 +vifs_state_read_33762 vifs_state_read 3 33762 NULL
117872 +hashtab_create_33769 hashtab_create 3 33769 NULL
117873 +if_sdio_read_rx_len_33800 if_sdio_read_rx_len 0 33800 NULL
117874 +filter_write_33819 filter_write 3 33819 NULL
117875 +sep_create_msgarea_context_33829 sep_create_msgarea_context 4 33829 NULL
117876 +scrub_setup_recheck_block_33831 scrub_setup_recheck_block 5-4 33831 NULL
117877 +ext4_journal_extend_33835 ext4_journal_extend 2 33835 NULL
117878 +oz_cdev_write_33852 oz_cdev_write 3 33852 NULL
117879 +get_user_pages_33908 get_user_pages 0 33908 NULL
117880 +sg_nents_33909 sg_nents 0 33909 NULL
117881 +ath6kl_roam_mode_write_33912 ath6kl_roam_mode_write 3 33912 NULL
117882 +queue_logical_block_size_33918 queue_logical_block_size 0 33918 NULL
117883 +sel_read_avc_cache_threshold_33942 sel_read_avc_cache_threshold 3 33942 NULL
117884 +lpfc_idiag_ctlacc_read_33943 lpfc_idiag_ctlacc_read 3 33943 NULL
117885 +read_file_tgt_rx_stats_33944 read_file_tgt_rx_stats 3 33944 NULL
117886 +__proc_dump_kernel_33954 __proc_dump_kernel 5 33954 NULL
117887 +btrfs_delalloc_reserve_metadata_33963 btrfs_delalloc_reserve_metadata 0 33963 NULL
117888 +vga_switcheroo_debugfs_write_33984 vga_switcheroo_debugfs_write 3 33984 NULL
117889 +lbs_lowrssi_write_34025 lbs_lowrssi_write 3 34025 NULL
117890 +ppp_write_34034 ppp_write 3 34034 NULL
117891 +tty_insert_flip_string_34042 tty_insert_flip_string 3-0 34042 NULL
117892 +memcg_update_all_caches_34068 memcg_update_all_caches 1 34068 NULL
117893 +xfs_dialloc_34078 xfs_dialloc 0 34078 NULL
117894 +pipeline_pipeline_fifo_full_read_34095 pipeline_pipeline_fifo_full_read 3 34095 NULL
117895 +__irq_domain_add_34101 __irq_domain_add 2 34101 NULL
117896 +proc_scsi_host_write_34107 proc_scsi_host_write 3 34107 NULL
117897 +islpci_mgt_transmit_34133 islpci_mgt_transmit 5 34133 NULL
117898 +ttm_dma_page_pool_free_34135 ttm_dma_page_pool_free 2-0 34135 NULL
117899 +ixgbe_dbg_netdev_ops_write_34141 ixgbe_dbg_netdev_ops_write 3 34141 NULL
117900 +shmem_pread_fast_34147 shmem_pread_fast 3 34147 NULL
117901 +ocfs2_xattr_list_entry_34165 ocfs2_xattr_list_entry 0 34165 NULL
117902 +skb_to_sgvec_34171 skb_to_sgvec 0 34171 NULL
117903 +xfs_bmapi_write_34208 xfs_bmapi_write 0 34208 NULL
117904 +ext4_da_write_begin_34215 ext4_da_write_begin 3-4 34215 NULL
117905 +bl_pipe_downcall_34264 bl_pipe_downcall 3 34264 NULL
117906 +ocfs2_dlm_lock_34265 ocfs2_dlm_lock 0 34265 NULL
117907 +device_private_init_34279 device_private_init 0 34279 NULL
117908 +ext4_get_groups_count_34324 ext4_get_groups_count 0 34324 NULL
117909 +pcpu_need_to_extend_34326 pcpu_need_to_extend 0 34326 NULL nohasharray
117910 +iov_iter_single_seg_count_34326 iov_iter_single_seg_count 0 34326 &pcpu_need_to_extend_34326
117911 +crypto_ablkcipher_ivsize_34363 crypto_ablkcipher_ivsize 0 34363 NULL nohasharray
117912 +sync_page_io_34363 sync_page_io 3 34363 &crypto_ablkcipher_ivsize_34363
117913 +rngapi_reset_34366 rngapi_reset 3 34366 NULL
117914 +ea_read_34378 ea_read 0 34378 NULL
117915 +fuse_send_read_34379 fuse_send_read 4 34379 NULL
117916 +av7110_vbi_write_34384 av7110_vbi_write 3 34384 NULL
117917 +usbvision_v4l2_read_34386 usbvision_v4l2_read 3 34386 NULL
117918 +read_rbu_image_type_34387 read_rbu_image_type 6 34387 NULL
117919 +iwl_calib_set_34400 iwl_calib_set 3 34400 NULL nohasharray
117920 +ivtv_read_pos_34400 ivtv_read_pos 3 34400 &iwl_calib_set_34400
117921 +wd_exp_mode_write_34407 wd_exp_mode_write 3 34407 NULL
117922 +nl80211_send_disassoc_34424 nl80211_send_disassoc 4 34424 NULL
117923 +__extent_read_full_page_34437 __extent_read_full_page 0 34437 NULL
117924 +usbtest_alloc_urb_34446 usbtest_alloc_urb 3-5 34446 NULL
117925 +mwifiex_regrdwr_read_34472 mwifiex_regrdwr_read 3 34472 NULL
117926 +skcipher_sndbuf_34476 skcipher_sndbuf 0 34476 NULL
117927 +i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
117928 +security_inode_permission_34488 security_inode_permission 0 34488 NULL
117929 +SyS_pwritev_34494 SyS_pwritev 3 34494 NULL
117930 +qp_alloc_res_34496 qp_alloc_res 5 34496 NULL
117931 +lu_buf_check_and_alloc_34505 lu_buf_check_and_alloc 2 34505 NULL
117932 +ext4_fallocate_34537 ext4_fallocate 4-3 34537 NULL nohasharray
117933 +tracing_stats_read_34537 tracing_stats_read 3 34537 &ext4_fallocate_34537
117934 +hugetlbfs_read_actor_34547 hugetlbfs_read_actor 2-5-4-0 34547 NULL
117935 +dbBackSplit_34561 dbBackSplit 0 34561 NULL
117936 +alloc_ieee80211_rsl_34564 alloc_ieee80211_rsl 1 34564 NULL
117937 +lov_stripecount_seq_write_34582 lov_stripecount_seq_write 3 34582 NULL
117938 +init_send_hfcd_34586 init_send_hfcd 1 34586 NULL
117939 +inet6_ifla6_size_34591 inet6_ifla6_size 0 34591 NULL
117940 +ceph_msgpool_init_34599 ceph_msgpool_init 4 34599 NULL nohasharray
117941 +cw1200_queue_init_34599 cw1200_queue_init 4 34599 &ceph_msgpool_init_34599
117942 +bio_integrity_bytes_34602 bio_integrity_bytes 2 34602 NULL
117943 +__jffs2_ref_totlen_34609 __jffs2_ref_totlen 0 34609 NULL
117944 +apei_get_nvs_resources_34616 apei_get_nvs_resources 0 34616 NULL
117945 +__cfg80211_disconnected_34622 __cfg80211_disconnected 3 34622 NULL
117946 +cnic_alloc_dma_34641 cnic_alloc_dma 3 34641 NULL
117947 +kvm_set_spte_hva_34671 kvm_set_spte_hva 2 34671 NULL
117948 +sleep_auth_write_34676 sleep_auth_write 3 34676 NULL
117949 +isr_fiqs_read_34687 isr_fiqs_read 3 34687 NULL
117950 +batadv_tvlv_realloc_packet_buff_34688 batadv_tvlv_realloc_packet_buff 3-4 34688 NULL
117951 +port_print_34704 port_print 3 34704 NULL
117952 +ieee80211_if_read_num_sta_ps_34722 ieee80211_if_read_num_sta_ps 3 34722 NULL
117953 +platform_list_read_file_34734 platform_list_read_file 3 34734 NULL
117954 +reg_w_ixbuf_34736 reg_w_ixbuf 4 34736 NULL
117955 +lsm_alloc_plain_34755 lsm_alloc_plain 1 34755 NULL
117956 +bootmode_store_34762 bootmode_store 4 34762 NULL
117957 +device_add_34766 device_add 0 34766 NULL
117958 +xfs_iget_cache_hit_34767 xfs_iget_cache_hit 0 34767 NULL
117959 +qib_cdev_init_34778 qib_cdev_init 1 34778 NULL
117960 +SYSC_keyctl_34800 SYSC_keyctl 4 34800 NULL
117961 +can_nocow_extent_34801 can_nocow_extent 2 34801 NULL
117962 +drbd_get_max_capacity_34804 drbd_get_max_capacity 0 34804 NULL
117963 +ll_setxattr_34806 ll_setxattr 4 34806 NULL
117964 +file_page_index_34820 file_page_index 0-2 34820 NULL
117965 +bio_segments_34832 bio_segments 0 34832 NULL
117966 +b43_debugfs_write_34838 b43_debugfs_write 3 34838 NULL
117967 +nl_portid_hash_zalloc_34843 nl_portid_hash_zalloc 1 34843 NULL
117968 +acpi_system_write_wakeup_device_34853 acpi_system_write_wakeup_device 3 34853 NULL
117969 +usb_serial_generic_prepare_write_buffer_34857 usb_serial_generic_prepare_write_buffer 3 34857 NULL
117970 +ieee80211_if_read_txpower_34871 ieee80211_if_read_txpower 3 34871 NULL
117971 +msg_print_text_34889 msg_print_text 0 34889 NULL
117972 +ieee80211_if_write_34894 ieee80211_if_write 3 34894 NULL
117973 +gfs2_glock_wait_34913 gfs2_glock_wait 0 34913 NULL
117974 +si476x_radio_read_rsq_primary_blob_34916 si476x_radio_read_rsq_primary_blob 3 34916 NULL
117975 +btrfs_super_chunk_root_34925 btrfs_super_chunk_root 0 34925 NULL nohasharray
117976 +__inode_permission_34925 __inode_permission 0 34925 &btrfs_super_chunk_root_34925
117977 +ceph_aio_write_34930 ceph_aio_write 4 34930 NULL
117978 +sec_flags2str_34933 sec_flags2str 3 34933 NULL
117979 +snd_info_entry_read_34938 snd_info_entry_read 3 34938 NULL
117980 +i2c_transfer_34958 i2c_transfer 0 34958 NULL
117981 +do_add_page_to_bio_34974 do_add_page_to_bio 2-10 34974 NULL
117982 +print_message_35000 print_message 0 35000 NULL
117983 +rx_rx_hdr_overflow_read_35002 rx_rx_hdr_overflow_read 3 35002 NULL
117984 +l2cap_skbuff_fromiovec_35003 l2cap_skbuff_fromiovec 4-3 35003 NULL
117985 +sisusb_copy_memory_35016 sisusb_copy_memory 4 35016 NULL
117986 +coda_psdev_read_35029 coda_psdev_read 3 35029 NULL
117987 +xfs_rtallocate_extent_35052 xfs_rtallocate_extent 0 35052 NULL
117988 +pwr_connection_out_of_sync_read_35061 pwr_connection_out_of_sync_read 3 35061 NULL
117989 +ntfs_attr_extend_initialized_35084 ntfs_attr_extend_initialized 0 35084 NULL
117990 +__kfifo_uint_must_check_helper_35097 __kfifo_uint_must_check_helper 0-1 35097 NULL
117991 +capi_write_35104 capi_write 3 35104 NULL nohasharray
117992 +tx_tx_done_template_read_35104 tx_tx_done_template_read 3 35104 &capi_write_35104
117993 +ide_settings_proc_write_35110 ide_settings_proc_write 3 35110 NULL
117994 +ceph_osdc_start_request_35122 ceph_osdc_start_request 0 35122 NULL
117995 +message_stats_print_35158 message_stats_print 6 35158 NULL
117996 +iscsi_conn_setup_35159 iscsi_conn_setup 2 35159 NULL
117997 +ieee80211_if_read_bssid_35161 ieee80211_if_read_bssid 3 35161 NULL
117998 +unix_stream_recvmsg_35210 unix_stream_recvmsg 4 35210 NULL
117999 +striped_read_35218 striped_read 0-2 35218 NULL nohasharray
118000 +security_key_getsecurity_35218 security_key_getsecurity 0 35218 &striped_read_35218
118001 +rx_rx_cmplt_task_read_35226 rx_rx_cmplt_task_read 3 35226 NULL
118002 +set_fd_set_35249 set_fd_set 1 35249 NULL
118003 +ioapic_setup_resources_35255 ioapic_setup_resources 1 35255 NULL
118004 +jbd2_journal_get_write_access_35263 jbd2_journal_get_write_access 0 35263 NULL
118005 +dis_disc_write_35265 dis_disc_write 3 35265 NULL
118006 +dma_show_regs_35266 dma_show_regs 3 35266 NULL
118007 +irda_recvmsg_stream_35280 irda_recvmsg_stream 4 35280 NULL
118008 +i2o_block_end_request_35282 i2o_block_end_request 3 35282 NULL
118009 +isr_rx_rdys_read_35283 isr_rx_rdys_read 3 35283 NULL
118010 +__btrfs_buffered_write_35311 __btrfs_buffered_write 3-0 35311 NULL nohasharray
118011 +brcmf_sdio_forensic_read_35311 brcmf_sdio_forensic_read 3 35311 &__btrfs_buffered_write_35311
118012 +tracing_read_pipe_35312 tracing_read_pipe 3 35312 NULL
118013 +sta_tx_latency_stat_write_35323 sta_tx_latency_stat_write 3 35323 NULL
118014 +xfs_btree_check_lblock_35333 xfs_btree_check_lblock 0 35333 NULL
118015 +ieee80211_if_fmt_ap_power_level_35347 ieee80211_if_fmt_ap_power_level 3 35347 NULL
118016 +nouveau_devinit_create__35348 nouveau_devinit_create_ 4 35348 NULL
118017 +ieee80211_rx_mgmt_deauth_35351 ieee80211_rx_mgmt_deauth 3 35351 NULL
118018 +compat_filldir64_35354 compat_filldir64 3 35354 NULL
118019 +read_kmem_35372 read_kmem 3 35372 NULL
118020 +SyS_getxattr_35408 SyS_getxattr 4 35408 NULL
118021 +rawv6_send_hdrinc_35425 rawv6_send_hdrinc 3 35425 NULL
118022 +buffer_to_user_35439 buffer_to_user 3 35439 NULL
118023 +efx_mcdi_rpc_async_quiet_35460 efx_mcdi_rpc_async_quiet 4-5 35460 NULL
118024 +macvtap_do_read_35475 macvtap_do_read 3 35475 NULL
118025 +fiemap_prepare_and_copy_exts_35494 fiemap_prepare_and_copy_exts 5 35494 NULL
118026 +btrfs_prealloc_file_range_trans_35500 btrfs_prealloc_file_range_trans 4 35500 NULL
118027 +async_setkey_35521 async_setkey 3 35521 NULL
118028 +__filemap_fdatawrite_range_35528 __filemap_fdatawrite_range 0 35528 NULL
118029 +iwl_dbgfs_bt_traffic_read_35534 iwl_dbgfs_bt_traffic_read 3 35534 NULL
118030 +pstore_mkfile_35536 pstore_mkfile 7 35536 NULL
118031 +rxpipe_tx_xfr_host_int_trig_rx_data_read_35538 rxpipe_tx_xfr_host_int_trig_rx_data_read 3 35538 NULL
118032 +ocfs2_write_zero_page_35539 ocfs2_write_zero_page 3 35539 NULL
118033 +ibnl_put_attr_35541 ibnl_put_attr 3 35541 NULL
118034 +ieee80211_if_write_smps_35550 ieee80211_if_write_smps 3 35550 NULL
118035 +ext4_blocks_for_truncate_35579 ext4_blocks_for_truncate 0 35579 NULL
118036 +ext2_acl_from_disk_35580 ext2_acl_from_disk 2 35580 NULL
118037 +spk_msg_set_35586 spk_msg_set 3 35586 NULL
118038 +kernel_readv_35617 kernel_readv 3 35617 NULL
118039 +reiserfs_readpages_35629 reiserfs_readpages 4 35629 NULL
118040 +pci_request_regions_35635 pci_request_regions 0 35635 NULL
118041 +ptlrpcd_steal_rqset_35637 ptlrpcd_steal_rqset 0 35637 NULL
118042 +spi_register_board_info_35651 spi_register_board_info 2 35651 NULL
118043 +rdmaltWithLock_35669 rdmaltWithLock 0 35669 NULL
118044 +SYSC_pwritev_35690 SYSC_pwritev 3 35690 NULL
118045 +rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
118046 +md_super_write_35703 md_super_write 4 35703 NULL
118047 +iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
118048 +udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
118049 +pvr2_hdw_cpufw_get_35824 pvr2_hdw_cpufw_get 0-4-2 35824 NULL
118050 +tx_tx_cmplt_read_35854 tx_tx_cmplt_read 3 35854 NULL
118051 +vx_query_hbuffer_size_35859 vx_query_hbuffer_size 0 35859 NULL
118052 +mthca_buf_alloc_35861 mthca_buf_alloc 2 35861 NULL
118053 +fls64_35862 fls64 0 35862 NULL
118054 +kvm_dirty_bitmap_bytes_35886 kvm_dirty_bitmap_bytes 0 35886 NULL
118055 +ieee80211_if_fmt_dot11MeshRetryTimeout_35890 ieee80211_if_fmt_dot11MeshRetryTimeout 3 35890 NULL
118056 +uwb_rc_cmd_done_35892 uwb_rc_cmd_done 4 35892 NULL
118057 +SyS_set_mempolicy_35909 SyS_set_mempolicy 3 35909 NULL
118058 +kernel_setsockopt_35913 kernel_setsockopt 5 35913 NULL
118059 +rbio_nr_pages_35916 rbio_nr_pages 0-1-2 35916 NULL
118060 +sctp_tsnmap_mark_35929 sctp_tsnmap_mark 2 35929 NULL
118061 +rx_defrag_init_called_read_35935 rx_defrag_init_called_read 3 35935 NULL
118062 +put_cmsg_compat_35937 put_cmsg_compat 4 35937 NULL
118063 +ext_rts51x_sd_execute_write_data_35971 ext_rts51x_sd_execute_write_data 9 35971 NULL
118064 +ceph_buffer_new_35974 ceph_buffer_new 1 35974 NULL nohasharray
118065 +generic_ocp_read_35974 generic_ocp_read 3 35974 &ceph_buffer_new_35974
118066 +acl_alloc_35979 acl_alloc 1 35979 NULL
118067 +device_add_class_symlinks_35985 device_add_class_symlinks 0 35985 NULL
118068 +write_file_antenna_35998 write_file_antenna 3 35998 NULL nohasharray
118069 +kuc_alloc_35998 kuc_alloc 1 35998 &write_file_antenna_35998
118070 +il3945_ucode_tx_stats_read_36016 il3945_ucode_tx_stats_read 3 36016 NULL
118071 +__videobuf_alloc_36031 __videobuf_alloc 1 36031 NULL
118072 +account_shadowed_36048 account_shadowed 2 36048 NULL
118073 +gpio_power_read_36059 gpio_power_read 3 36059 NULL
118074 +write_emulate_36065 write_emulate 2-4 36065 NULL
118075 +stack_max_size_write_36068 stack_max_size_write 3 36068 NULL
118076 +radeon_vm_num_pdes_36070 radeon_vm_num_pdes 0 36070 NULL
118077 +ieee80211_if_fmt_peer_36071 ieee80211_if_fmt_peer 3 36071 NULL
118078 +ieee80211_if_write_tsf_36077 ieee80211_if_write_tsf 3 36077 NULL
118079 +snd_pcm_plug_read_transfer_36080 snd_pcm_plug_read_transfer 0-3 36080 NULL
118080 +mtip_hw_read_device_status_36082 mtip_hw_read_device_status 3 36082 NULL
118081 +vga_arb_write_36112 vga_arb_write 3 36112 NULL
118082 +simple_xattr_alloc_36118 simple_xattr_alloc 2 36118 NULL
118083 +ext3_readpages_36144 ext3_readpages 4 36144 NULL
118084 +twl_set_36154 twl_set 2 36154 NULL
118085 +b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
118086 +snd_korg1212_copy_from_36169 snd_korg1212_copy_from 6 36169 NULL
118087 +SyS_kexec_load_36176 SyS_kexec_load 2 36176 NULL
118088 +ramoops_init_przs_36199 ramoops_init_przs 4 36199 NULL
118089 +SYSC_sched_getaffinity_36208 SYSC_sched_getaffinity 2 36208 NULL
118090 +SYSC_process_vm_readv_36216 SYSC_process_vm_readv 3-5 36216 NULL
118091 +atomic_stats_read_36228 atomic_stats_read 3 36228 NULL
118092 +viafb_iga1_odev_proc_write_36241 viafb_iga1_odev_proc_write 3 36241 NULL
118093 +SYSC_getxattr_36242 SYSC_getxattr 4 36242 NULL
118094 +rproc_recovery_read_36245 rproc_recovery_read 3 36245 NULL
118095 +scrub_stripe_36248 scrub_stripe 5-4 36248 NULL
118096 +compat_sys_mbind_36256 compat_sys_mbind 5 36256 NULL
118097 +usb_buffer_alloc_36276 usb_buffer_alloc 2 36276 NULL nohasharray
118098 +cfs_hash_buckets_realloc_36276 cfs_hash_buckets_realloc 4 36276 &usb_buffer_alloc_36276
118099 +codec_reg_read_file_36280 codec_reg_read_file 3 36280 NULL
118100 +crypto_shash_digestsize_36284 crypto_shash_digestsize 0 36284 NULL
118101 +nouveau_cli_create_36293 nouveau_cli_create 3 36293 NULL
118102 +lpfc_debugfs_dif_err_read_36303 lpfc_debugfs_dif_err_read 3 36303 NULL
118103 +cfg80211_rx_mlme_mgmt_36306 cfg80211_rx_mlme_mgmt 3 36306 NULL
118104 +ad7879_spi_xfer_36311 ad7879_spi_xfer 3 36311 NULL
118105 +fat_compat_ioctl_filldir_36328 fat_compat_ioctl_filldir 3 36328 NULL
118106 +lc_create_36332 lc_create 4 36332 NULL
118107 +jbd2_journal_init_revoke_table_36336 jbd2_journal_init_revoke_table 1 36336 NULL
118108 +isku_sysfs_read_key_mask_36343 isku_sysfs_read_key_mask 6 36343 NULL
118109 +ath6kl_regwrite_write_36351 ath6kl_regwrite_write 3 36351 NULL
118110 +v9fs_file_readn_36353 v9fs_file_readn 4 36353 NULL
118111 +to_sector_36361 to_sector 0-1 36361 NULL
118112 +tunables_read_36385 tunables_read 3 36385 NULL
118113 +afs_alloc_flat_call_36399 afs_alloc_flat_call 2-3 36399 NULL
118114 +sierra_write_36402 sierra_write 4 36402 NULL
118115 +qdsb_get_36409 qdsb_get 0 36409 NULL
118116 +SyS_sethostname_36417 SyS_sethostname 2 36417 NULL
118117 +ReadW6692B_36445 ReadW6692B 0 36445 NULL
118118 +sctp_tsnmap_init_36446 sctp_tsnmap_init 2 36446 NULL
118119 +alloc_etherdev_mqs_36450 alloc_etherdev_mqs 1 36450 NULL
118120 +SyS_process_vm_writev_36476 SyS_process_vm_writev 3-5 36476 NULL
118121 +lock_and_cleanup_extent_if_need_36480 lock_and_cleanup_extent_if_need 0 36480 NULL
118122 +b43_nphy_load_samples_36481 b43_nphy_load_samples 3 36481 NULL
118123 +ip6_append_data_36490 ip6_append_data 4 36490 NULL nohasharray
118124 +tx_tx_checksum_result_read_36490 tx_tx_checksum_result_read 3 36490 &ip6_append_data_36490
118125 +cmd_loop_36491 cmd_loop 0 36491 NULL
118126 +__hwahc_op_set_ptk_36510 __hwahc_op_set_ptk 5 36510 NULL
118127 +mcam_v4l_read_36513 mcam_v4l_read 3 36513 NULL
118128 +_iwl_dbgfs_fw_nmi_write_36515 _iwl_dbgfs_fw_nmi_write 3 36515 NULL
118129 +get_param_l_36518 get_param_l 0 36518 NULL
118130 +ieee80211_if_read_fwded_frames_36520 ieee80211_if_read_fwded_frames 3 36520 NULL
118131 +crypto_aead_authsize_36537 crypto_aead_authsize 0 36537 NULL
118132 +cpu_type_read_36540 cpu_type_read 3 36540 NULL
118133 +__kfifo_to_user_36555 __kfifo_to_user 3-0 36555 NULL
118134 +btrfs_get_token_64_36572 btrfs_get_token_64 0 36572 NULL
118135 +__erst_read_36579 __erst_read 0 36579 NULL
118136 +put_cmsg_36589 put_cmsg 4 36589 NULL
118137 +fat_ioctl_filldir_36621 fat_ioctl_filldir 3 36621 NULL
118138 +vxge_config_vpaths_36636 vxge_config_vpaths 0 36636 NULL
118139 +convert_extent_item_v0_36645 convert_extent_item_v0 4 36645 NULL
118140 +ced_ioctl_36647 ced_ioctl 2 36647 NULL
118141 +lpfc_idiag_extacc_alloc_get_36648 lpfc_idiag_extacc_alloc_get 0-3 36648 NULL
118142 +osd_req_list_collection_objects_36664 osd_req_list_collection_objects 5 36664 NULL
118143 +iscsi_host_alloc_36671 iscsi_host_alloc 2 36671 NULL
118144 +xillybus_read_36678 xillybus_read 3 36678 NULL
118145 +gsmtty_write_36702 gsmtty_write 3 36702 NULL
118146 +snd_rawmidi_kernel_read1_36740 snd_rawmidi_kernel_read1 4-0 36740 NULL
118147 +cxgbi_device_register_36746 cxgbi_device_register 1-2 36746 NULL
118148 +ps_poll_upsd_timeouts_read_36755 ps_poll_upsd_timeouts_read 3 36755 NULL
118149 +ptp_filter_init_36780 ptp_filter_init 2 36780 NULL
118150 +i40e_init_lan_hmc_36796 i40e_init_lan_hmc 5-4-3-2 36796 NULL
118151 +proc_fault_inject_read_36802 proc_fault_inject_read 3 36802 NULL
118152 +hiddev_ioctl_36816 hiddev_ioctl 2 36816 NULL
118153 +int_hardware_entry_36833 int_hardware_entry 3 36833 NULL
118154 +fc_change_queue_depth_36841 fc_change_queue_depth 2 36841 NULL
118155 +keyctl_describe_key_36853 keyctl_describe_key 3 36853 NULL
118156 +cm_write_36858 cm_write 3 36858 NULL
118157 +tx_tx_data_programmed_read_36871 tx_tx_data_programmed_read 3 36871 NULL
118158 +svc_setsockopt_36876 svc_setsockopt 5 36876 NULL
118159 +raid56_parity_write_36877 raid56_parity_write 5 36877 NULL
118160 +__btrfs_map_block_36883 __btrfs_map_block 3 36883 NULL
118161 +ib_ucm_alloc_data_36885 ib_ucm_alloc_data 3 36885 NULL
118162 +selinux_inode_notifysecctx_36896 selinux_inode_notifysecctx 3 36896 NULL
118163 +OS_kmalloc_36909 OS_kmalloc 1 36909 NULL
118164 +crypto_blkcipher_ivsize_36944 crypto_blkcipher_ivsize 0 36944 NULL
118165 +il4965_rs_sta_dbgfs_scale_table_write_36979 il4965_rs_sta_dbgfs_scale_table_write 3 36979 NULL
118166 +xfs_btree_check_sptr_36984 xfs_btree_check_sptr 0 36984 NULL
118167 +drbd_new_dev_size_36998 drbd_new_dev_size 0-3 36998 NULL
118168 +auok190xfb_write_37001 auok190xfb_write 3 37001 NULL
118169 +setxattr_37006 setxattr 4 37006 NULL
118170 +ocfs2_dlm_unlock_37037 ocfs2_dlm_unlock 0 37037 NULL
118171 +command_file_read_37038 command_file_read 3 37038 NULL
118172 +figure_loop_size_37051 figure_loop_size 2-3 37051 NULL
118173 +ieee80211_if_read_drop_unencrypted_37053 ieee80211_if_read_drop_unencrypted 3 37053 NULL nohasharray
118174 +qp_broker_create_37053 qp_broker_create 6-5 37053 &ieee80211_if_read_drop_unencrypted_37053
118175 +SYSC_setxattr_37078 SYSC_setxattr 4 37078 NULL
118176 +parse_command_37079 parse_command 2 37079 NULL
118177 +pipeline_cs_rx_packet_in_read_37089 pipeline_cs_rx_packet_in_read 3 37089 NULL
118178 +tun_get_user_37094 tun_get_user 5 37094 NULL
118179 +xlog_grant_head_check_37116 xlog_grant_head_check 0 37116 NULL
118180 +has_wrprotected_page_37123 has_wrprotected_page 3-2 37123 NULL
118181 +snd_hda_get_conn_list_37132 snd_hda_get_conn_list 0 37132 NULL
118182 +mtt_free_res_37144 mtt_free_res 5 37144 NULL
118183 +msg_word_37164 msg_word 0 37164 NULL
118184 +f2fs_direct_IO_37167 f2fs_direct_IO 4 37167 NULL
118185 +vcc_recvmsg_37198 vcc_recvmsg 4 37198 NULL
118186 +forced_ps_write_37209 forced_ps_write 3 37209 NULL
118187 +crypto_shash_descsize_37212 crypto_shash_descsize 0 37212 NULL nohasharray
118188 +ext4_ind_direct_IO_37212 ext4_ind_direct_IO 0-4 37212 &crypto_shash_descsize_37212
118189 +bchannel_get_rxbuf_37213 bchannel_get_rxbuf 2-0 37213 NULL
118190 +regmap_access_read_file_37223 regmap_access_read_file 3 37223 NULL
118191 +__do_replace_37227 __do_replace 5 37227 NULL
118192 +iwl_dbgfs_d3_sram_read_37237 iwl_dbgfs_d3_sram_read 3 37237 NULL
118193 +rx_filter_dup_filter_read_37238 rx_filter_dup_filter_read 3 37238 NULL
118194 +xfs_reclaim_inode_37257 xfs_reclaim_inode 0 37257 NULL
118195 +exofs_max_io_pages_37263 exofs_max_io_pages 0-2 37263 NULL
118196 +_iwl_dbgfs_fw_restart_write_37270 _iwl_dbgfs_fw_restart_write 3 37270 NULL
118197 +ieee80211_if_read_power_mode_37305 ieee80211_if_read_power_mode 3 37305 NULL
118198 +ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
118199 +jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
118200 +send_msg_37323 send_msg 4 37323 NULL
118201 +l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
118202 +bnx2x_vf_fill_fw_str_37327 bnx2x_vf_fill_fw_str 3 37327 &l2cap_create_connless_pdu_37327
118203 +scsi_mode_select_37330 scsi_mode_select 6 37330 NULL
118204 +rxrpc_server_sendmsg_37331 rxrpc_server_sendmsg 4 37331 NULL
118205 +xfs_iomap_write_allocate_37336 xfs_iomap_write_allocate 0 37336 NULL
118206 +security_inode_getsecurity_37354 security_inode_getsecurity 0 37354 NULL
118207 +hci_sock_sendmsg_37420 hci_sock_sendmsg 4 37420 NULL
118208 +acpi_os_allocate_zeroed_37422 acpi_os_allocate_zeroed 1 37422 NULL
118209 +tty_insert_flip_string_fixed_flag_37428 tty_insert_flip_string_fixed_flag 4-0 37428 NULL
118210 +iwl_print_last_event_logs_37433 iwl_print_last_event_logs 0-7-9 37433 NULL
118211 +fru_alloc_37442 fru_alloc 1 37442 NULL
118212 +tcp_established_options_37450 tcp_established_options 0 37450 NULL nohasharray
118213 +tipc_send2port_37450 tipc_send2port 4 37450 &tcp_established_options_37450
118214 +xfs_btree_dec_cursor_37452 xfs_btree_dec_cursor 0 37452 NULL
118215 +brcmf_sdio_dump_console_37455 brcmf_sdio_dump_console 4 37455 NULL
118216 +get_est_timing_37484 get_est_timing 0 37484 NULL
118217 +kmem_realloc_37489 kmem_realloc 2 37489 NULL
118218 +bitmap_dirty_bits_37503 bitmap_dirty_bits 2 37503 NULL
118219 +osc_active_seq_write_37514 osc_active_seq_write 3 37514 NULL
118220 +bdev_writeseg_37519 bdev_writeseg 2-3 37519 NULL
118221 +xz_dec_test_write_37527 xz_dec_test_write 3 37527 NULL
118222 +fault_inject_read_37534 fault_inject_read 3 37534 NULL
118223 +hdr_size_37536 hdr_size 0 37536 NULL
118224 +extent_map_end_37550 extent_map_end 0 37550 NULL
118225 +sep_create_dcb_dmatables_context_37551 sep_create_dcb_dmatables_context 6 37551 NULL
118226 +fat_cont_expand_37552 fat_cont_expand 0 37552 NULL
118227 +ioat_chansts_37558 ioat_chansts 0 37558 NULL
118228 +xhci_alloc_streams_37586 xhci_alloc_streams 5 37586 NULL
118229 +qla2x00_debounce_register_37597 qla2x00_debounce_register 0 37597 NULL
118230 +kvm_read_guest_page_mmu_37611 kvm_read_guest_page_mmu 6 37611 NULL
118231 +SYSC_mbind_37622 SYSC_mbind 5 37622 NULL
118232 +SyS_mbind_37638 SyS_mbind 5 37638 NULL
118233 +may_delete_37656 may_delete 0 37656 NULL
118234 +bio_copy_user_iov_37660 bio_copy_user_iov 4 37660 NULL
118235 +rfcomm_sock_sendmsg_37661 rfcomm_sock_sendmsg 4 37661 NULL nohasharray
118236 +vmw_framebuffer_dmabuf_dirty_37661 vmw_framebuffer_dmabuf_dirty 6 37661 &rfcomm_sock_sendmsg_37661
118237 +SYSC_get_mempolicy_37664 SYSC_get_mempolicy 3 37664 NULL
118238 +__wa_seg_calculate_isoc_frame_count_37672 __wa_seg_calculate_isoc_frame_count 0 37672 NULL
118239 +ieee80211_if_read_rc_rateidx_mcs_mask_2ghz_37675 ieee80211_if_read_rc_rateidx_mcs_mask_2ghz 3 37675 NULL
118240 +regmap_map_read_file_37685 regmap_map_read_file 3 37685 NULL
118241 +nametbl_header_37698 nametbl_header 2-0 37698 NULL
118242 +__le32_to_cpup_37702 __le32_to_cpup 0 37702 NULL
118243 +dynamic_ps_timeout_write_37713 dynamic_ps_timeout_write 3 37713 NULL
118244 +read_enabled_file_bool_37744 read_enabled_file_bool 3 37744 NULL
118245 +xfs_read_agf_37749 xfs_read_agf 0 37749 NULL
118246 +ocfs2_control_cfu_37750 ocfs2_control_cfu 2 37750 NULL
118247 +ipath_cdev_init_37752 ipath_cdev_init 1 37752 NULL
118248 +dccp_setsockopt_cscov_37766 dccp_setsockopt_cscov 2 37766 NULL
118249 +il4965_rs_sta_dbgfs_rate_scale_data_read_37792 il4965_rs_sta_dbgfs_rate_scale_data_read 3 37792 NULL
118250 +smk_read_logging_37804 smk_read_logging 3 37804 NULL
118251 +ocrdma_alloc_frmr_page_list_37815 ocrdma_alloc_frmr_page_list 2 37815 NULL
118252 +rx_decrypt_key_not_found_read_37820 rx_decrypt_key_not_found_read 3 37820 NULL
118253 +android_get_p2p_addr_37832 android_get_p2p_addr 0 37832 NULL
118254 +jbd2_journal_get_undo_access_37837 jbd2_journal_get_undo_access 0 37837 NULL
118255 +o2hb_debug_read_37851 o2hb_debug_read 3 37851 NULL
118256 +xfs_dir2_block_to_sf_37868 xfs_dir2_block_to_sf 3 37868 NULL
118257 +set_registers_37883 set_registers 4 37883 NULL
118258 +btrfs_stack_file_extent_disk_bytenr_37888 btrfs_stack_file_extent_disk_bytenr 0 37888 NULL
118259 +pkt_alloc_packet_data_37928 pkt_alloc_packet_data 1 37928 NULL nohasharray
118260 +_rtw_malloc_37928 _rtw_malloc 1 37928 &pkt_alloc_packet_data_37928
118261 +read_rbu_packet_size_37939 read_rbu_packet_size 6 37939 NULL
118262 +write_file_bool_37957 write_file_bool 3 37957 NULL
118263 +fifo_alloc_37961 fifo_alloc 1 37961 NULL
118264 +rds_rdma_extra_size_37990 rds_rdma_extra_size 0 37990 NULL
118265 +persistent_ram_old_size_37997 persistent_ram_old_size 0 37997 NULL
118266 +vfs_readv_38011 vfs_readv 3 38011 NULL
118267 +aggr_recv_addba_req_evt_38037 aggr_recv_addba_req_evt 4 38037 NULL
118268 +il_dbgfs_chain_noise_read_38044 il_dbgfs_chain_noise_read 3 38044 NULL nohasharray
118269 +klsi_105_prepare_write_buffer_38044 klsi_105_prepare_write_buffer 3 38044 &il_dbgfs_chain_noise_read_38044
118270 +SyS_llistxattr_38048 SyS_llistxattr 3 38048 NULL
118271 +sysfs_do_create_link_38051 sysfs_do_create_link 0 38051 NULL
118272 +_xfs_buf_alloc_38058 _xfs_buf_alloc 3 38058 NULL
118273 +nsm_create_handle_38060 nsm_create_handle 4 38060 NULL
118274 +alloc_ltalkdev_38071 alloc_ltalkdev 1 38071 NULL
118275 +xfs_buf_readahead_map_38081 xfs_buf_readahead_map 3 38081 NULL nohasharray
118276 +wcn36xx_smd_rsp_process_38081 wcn36xx_smd_rsp_process 3 38081 &xfs_buf_readahead_map_38081
118277 +uwb_mac_addr_print_38085 uwb_mac_addr_print 2 38085 NULL
118278 +request_key_auth_new_38092 request_key_auth_new 3 38092 NULL
118279 +proc_self_readlink_38094 proc_self_readlink 3 38094 NULL
118280 +ep0_read_38095 ep0_read 3 38095 NULL
118281 +sk_wmem_schedule_38096 sk_wmem_schedule 2 38096 NULL nohasharray
118282 +osc_checksum_seq_write_38096 osc_checksum_seq_write 3 38096 &sk_wmem_schedule_38096
118283 +o2hb_read_slots_38105 o2hb_read_slots 2 38105 NULL
118284 +snd_pcm_oss_write_38108 snd_pcm_oss_write 3 38108 NULL
118285 +vmw_kms_present_38130 vmw_kms_present 9 38130 NULL
118286 +__ntfs_copy_from_user_iovec_inatomic_38153 __ntfs_copy_from_user_iovec_inatomic 0-4-3 38153 NULL
118287 +btrfs_extent_same_38163 btrfs_extent_same 3-2 38163 NULL
118288 +kvm_clear_guest_38164 kvm_clear_guest 3-2 38164 NULL
118289 +cdev_add_38176 cdev_add 2-3 38176 NULL
118290 +rt2x00debug_write_rf_38195 rt2x00debug_write_rf 3 38195 NULL
118291 +get_ucode_user_38202 get_ucode_user 3 38202 NULL
118292 +osd_req_list_partition_collections_38223 osd_req_list_partition_collections 5 38223 NULL nohasharray
118293 +xfs_rtallocate_range_38223 xfs_rtallocate_range 0 38223 &osd_req_list_partition_collections_38223
118294 +ceph_decode_16_38239 ceph_decode_16 0 38239 NULL
118295 +_ipw_read_reg32_38245 _ipw_read_reg32 0 38245 NULL
118296 +xfs_qm_dqrepair_38262 xfs_qm_dqrepair 0 38262 NULL
118297 +mthca_alloc_icm_table_38268 mthca_alloc_icm_table 4-3 38268 NULL nohasharray
118298 +ieee80211_if_read_auto_open_plinks_38268 ieee80211_if_read_auto_open_plinks 3 38268 &mthca_alloc_icm_table_38268
118299 +xfs_bmbt_to_bmdr_38275 xfs_bmbt_to_bmdr 3 38275 NULL nohasharray
118300 +xfs_bmdr_to_bmbt_38275 xfs_bmdr_to_bmbt 5 38275 &xfs_bmbt_to_bmdr_38275
118301 +ftdi_process_packet_38281 ftdi_process_packet 4 38281 NULL
118302 +ucma_query_path_38305 ucma_query_path 3 38305 NULL
118303 +isr_rx_headers_read_38325 isr_rx_headers_read 3 38325 NULL
118304 +ida_simple_get_38326 ida_simple_get 0 38326 NULL
118305 +__snd_gf1_look8_38333 __snd_gf1_look8 0 38333 NULL
118306 +btrfs_file_extent_disk_num_bytes_38363 btrfs_file_extent_disk_num_bytes 0 38363 NULL
118307 +dn_sendmsg_38390 dn_sendmsg 4 38390 NULL
118308 +ieee80211_if_read_dtim_count_38419 ieee80211_if_read_dtim_count 3 38419 NULL
118309 +pmcraid_copy_sglist_38431 pmcraid_copy_sglist 3 38431 NULL
118310 +kvm_write_guest_38454 kvm_write_guest 4-2 38454 NULL
118311 +_iwl_dbgfs_scan_ant_rxchain_write_38479 _iwl_dbgfs_scan_ant_rxchain_write 3 38479 NULL
118312 +blk_end_bidi_request_38482 blk_end_bidi_request 3-4 38482 NULL
118313 +dev_names_read_38509 dev_names_read 3 38509 NULL
118314 +iscsi_create_iface_38510 iscsi_create_iface 5 38510 NULL
118315 +event_rx_mismatch_read_38518 event_rx_mismatch_read 3 38518 NULL
118316 +ubifs_idx_node_sz_38546 ubifs_idx_node_sz 0-2 38546 NULL
118317 +btrfs_discard_extent_38547 btrfs_discard_extent 2 38547 NULL
118318 +kuc_len_38557 kuc_len 0-1 38557 NULL
118319 +irda_sendmsg_dgram_38563 irda_sendmsg_dgram 4 38563 NULL
118320 +il4965_rs_sta_dbgfs_scale_table_read_38564 il4965_rs_sta_dbgfs_scale_table_read 3 38564 NULL
118321 +_ipw_read32_38565 _ipw_read32 0 38565 NULL
118322 +snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5-3 38567 NULL
118323 +copy_ctl_value_to_user_38587 copy_ctl_value_to_user 4 38587 NULL
118324 +rd_allocate_sgl_table_38607 rd_allocate_sgl_table 3 38607 NULL
118325 +icn_writecmd_38629 icn_writecmd 2 38629 NULL
118326 +write_enabled_file_bool_38630 write_enabled_file_bool 3 38630 NULL
118327 +ext2_readpages_38640 ext2_readpages 4 38640 NULL
118328 +audit_init_entry_38644 audit_init_entry 1 38644 NULL
118329 +qp_broker_alloc_38646 qp_broker_alloc 6-5 38646 NULL
118330 +mmc_send_cxd_data_38655 mmc_send_cxd_data 5 38655 NULL
118331 +nouveau_instmem_create__38664 nouveau_instmem_create_ 4 38664 NULL
118332 +snd_es1371_wait_src_ready_38673 snd_es1371_wait_src_ready 0 38673 NULL
118333 +iscsit_dump_data_payload_38683 iscsit_dump_data_payload 2 38683 NULL
118334 +rbio_add_io_page_38700 rbio_add_io_page 6 38700 NULL
118335 +w83977af_sir_interrupt_38738 w83977af_sir_interrupt 0 38738 NULL
118336 +udf_readpages_38761 udf_readpages 4 38761 NULL
118337 +iwl_dbgfs_thermal_throttling_read_38779 iwl_dbgfs_thermal_throttling_read 3 38779 NULL
118338 +bcache_device_init_38781 bcache_device_init 3 38781 NULL
118339 +snd_gus_dram_write_38784 snd_gus_dram_write 4 38784 NULL
118340 +do_pci_enable_device_38802 do_pci_enable_device 0 38802 NULL
118341 +err_decode_38804 err_decode 2 38804 NULL
118342 +ipv6_renew_option_38813 ipv6_renew_option 3 38813 NULL
118343 +direct_entry_38836 direct_entry 3 38836 NULL
118344 +compat_udp_setsockopt_38840 compat_udp_setsockopt 5 38840 NULL
118345 +read_nic_io_word_38853 read_nic_io_word 0 38853 NULL
118346 +interfaces_38859 interfaces 2 38859 NULL
118347 +dbgfs_state_38894 dbgfs_state 3 38894 NULL
118348 +il_dbgfs_sram_write_38942 il_dbgfs_sram_write 3 38942 NULL
118349 +__ath6kl_wmi_send_mgmt_cmd_38971 __ath6kl_wmi_send_mgmt_cmd 7 38971 NULL
118350 +usb_maxpacket_38977 usb_maxpacket 0 38977 NULL nohasharray
118351 +C_SYSC_preadv64_38977 C_SYSC_preadv64 3 38977 &usb_maxpacket_38977
118352 +OSDSetBlock_38986 OSDSetBlock 2-4 38986 NULL
118353 +bio_clone_range_38997 bio_clone_range 2 38997 NULL
118354 +lpfc_idiag_extacc_write_38998 lpfc_idiag_extacc_write 3 38998 NULL
118355 +get_nodes_39012 get_nodes 3 39012 NULL
118356 +twl6030_interrupt_unmask_39013 twl6030_interrupt_unmask 2 39013 NULL
118357 +__blkdev_issue_zeroout_39020 __blkdev_issue_zeroout 3 39020 NULL
118358 +_zd_iowrite32v_async_locked_39034 _zd_iowrite32v_async_locked 3 39034 NULL
118359 +do_write_kmem_39051 do_write_kmem 0-1-3 39051 NULL
118360 +ReadHFC_39104 ReadHFC 0 39104 NULL
118361 +tomoyo_truncate_39105 tomoyo_truncate 0 39105 NULL
118362 +__kfifo_to_user_r_39123 __kfifo_to_user_r 5-3 39123 NULL
118363 +ea_foreach_39133 ea_foreach 0 39133 NULL
118364 +generic_permission_39150 generic_permission 0 39150 NULL
118365 +proc_coredump_filter_read_39153 proc_coredump_filter_read 3 39153 NULL
118366 +ath9k_hw_ar9003_dump_eeprom_39156 ath9k_hw_ar9003_dump_eeprom 5-4 39156 NULL
118367 +echo_client_kbrw_39170 echo_client_kbrw 6 39170 NULL
118368 +ext3_xattr_check_names_39174 ext3_xattr_check_names 0 39174 NULL
118369 +ubi_more_update_data_39189 ubi_more_update_data 4 39189 NULL
118370 +qcam_read_bytes_39205 qcam_read_bytes 0 39205 NULL
118371 +ivtv_v4l2_write_39226 ivtv_v4l2_write 3 39226 NULL
118372 +posix_acl_to_xattr_39237 posix_acl_to_xattr 0 39237 NULL
118373 +snd_pcm_capture_forward_39248 snd_pcm_capture_forward 2 39248 NULL
118374 +r128_compat_ioctl_39250 r128_compat_ioctl 2 39250 NULL nohasharray
118375 +pwr_cont_miss_bcns_spread_read_39250 pwr_cont_miss_bcns_spread_read 3 39250 &r128_compat_ioctl_39250
118376 +i915_error_state_read_39254 i915_error_state_read 3 39254 NULL
118377 +rx_filter_protection_filter_read_39282 rx_filter_protection_filter_read 3 39282 NULL
118378 +_iwl_dbgfs_pm_params_write_39325 _iwl_dbgfs_pm_params_write 3 39325 NULL
118379 +__cfg80211_connect_result_39326 __cfg80211_connect_result 4-6 39326 NULL
118380 +insert_reserved_file_extent_39327 insert_reserved_file_extent 3 39327 NULL
118381 +wimax_msg_alloc_39343 wimax_msg_alloc 4 39343 NULL
118382 +ide_complete_rq_39354 ide_complete_rq 3 39354 NULL
118383 +do_write_log_from_user_39362 do_write_log_from_user 3-0 39362 NULL
118384 +vortex_wtdma_getlinearpos_39371 vortex_wtdma_getlinearpos 0 39371 NULL
118385 +regmap_name_read_file_39379 regmap_name_read_file 3 39379 NULL
118386 +fnic_trace_debugfs_read_39380 fnic_trace_debugfs_read 3 39380 NULL
118387 +ps_poll_ps_poll_utilization_read_39383 ps_poll_ps_poll_utilization_read 3 39383 NULL
118388 +__send_to_port_39386 __send_to_port 3 39386 NULL
118389 +xfs_btree_dup_cursor_39394 xfs_btree_dup_cursor 0 39394 NULL
118390 +gfs2_internal_read_39413 gfs2_internal_read 0 39413 NULL
118391 +user_power_read_39414 user_power_read 3 39414 NULL
118392 +alloc_agpphysmem_i8xx_39427 alloc_agpphysmem_i8xx 1 39427 NULL
118393 +mic_desc_size_39464 mic_desc_size 0 39464 NULL
118394 +apei_resources_add_39470 apei_resources_add 0 39470 NULL
118395 +setkey_unaligned_39474 setkey_unaligned 3 39474 NULL
118396 +ieee80211_if_fmt_dot11MeshHWMPmaxPREQretries_39499 ieee80211_if_fmt_dot11MeshHWMPmaxPREQretries 3 39499 NULL
118397 +cl_req_alloc_39523 cl_req_alloc 4 39523 NULL
118398 +int_proc_write_39542 int_proc_write 3 39542 NULL
118399 +pp_write_39554 pp_write 3 39554 NULL
118400 +datablob_format_39571 datablob_format 2 39571 NULL nohasharray
118401 +ieee80211_if_read_fwded_mcast_39571 ieee80211_if_read_fwded_mcast 3 39571 &datablob_format_39571
118402 +memblock_virt_alloc_internal_39600 memblock_virt_alloc_internal 1 39600 NULL
118403 +ext_depth_39607 ext_depth 0 39607 NULL
118404 +batadv_tt_tvlv_generate_39615 batadv_tt_tvlv_generate 4 39615 NULL
118405 +nfs_idmap_get_key_39616 nfs_idmap_get_key 2 39616 NULL
118406 +sdio_readb_39618 sdio_readb 0 39618 NULL
118407 +prepare_uptodate_page_39622 prepare_uptodate_page 0 39622 NULL
118408 +set_dev_class_39645 set_dev_class 4 39645 NULL
118409 +snd_rme32_capture_copy_39653 snd_rme32_capture_copy 5 39653 NULL
118410 +tcp_try_rmem_schedule_39657 tcp_try_rmem_schedule 3 39657 NULL
118411 +kvm_read_guest_cached_39666 kvm_read_guest_cached 4 39666 NULL
118412 +v4l_stk_read_39672 v4l_stk_read 3 39672 NULL
118413 +hsc_msg_len_get_39673 hsc_msg_len_get 0 39673 NULL
118414 +do_surface_dirty_sou_39678 do_surface_dirty_sou 7 39678 NULL
118415 +sd_completed_bytes_39705 sd_completed_bytes 0 39705 NULL
118416 +ftrace_pid_write_39710 ftrace_pid_write 3 39710 NULL
118417 +adt7316_spi_multi_read_39765 adt7316_spi_multi_read 3 39765 NULL
118418 +security_inode_listsecurity_39812 security_inode_listsecurity 0 39812 NULL
118419 +snd_pcm_oss_writev3_39818 snd_pcm_oss_writev3 3 39818 NULL
118420 +get_priv_size_39828 get_priv_size 0-1 39828 NULL
118421 +pkt_add_39897 pkt_add 3 39897 NULL
118422 +read_file_modal_eeprom_39909 read_file_modal_eeprom 3 39909 NULL
118423 +gen_pool_add_virt_39913 gen_pool_add_virt 4 39913 NULL
118424 +dw210x_op_rw_39915 dw210x_op_rw 6 39915 NULL
118425 +__mnt_want_write_file_39917 __mnt_want_write_file 0 39917 NULL
118426 +aes_encrypt_interrupt_read_39919 aes_encrypt_interrupt_read 3 39919 NULL
118427 +exofs_read_kern_39921 exofs_read_kern 6 39921 NULL nohasharray
118428 +oom_score_adj_read_39921 oom_score_adj_read 3 39921 &exofs_read_kern_39921
118429 +__spi_async_39932 __spi_async 0 39932 NULL
118430 +__get_order_39935 __get_order 0 39935 NULL
118431 +error_error_frame_read_39947 error_error_frame_read 3 39947 NULL
118432 +tty_prepare_flip_string_39955 tty_prepare_flip_string 3-0 39955 NULL
118433 +lstcon_group_list_39958 lstcon_group_list 2 39958 NULL
118434 +bio_chain_clone_range_39967 bio_chain_clone_range 3 39967 NULL
118435 +dma_push_rx_39973 dma_push_rx 2 39973 NULL
118436 +broadsheetfb_write_39976 broadsheetfb_write 3 39976 NULL
118437 +mthca_array_init_39987 mthca_array_init 2 39987 NULL
118438 +fw_device_op_read_39990 fw_device_op_read 3 39990 NULL
118439 +server_name2svname_39998 server_name2svname 4 39998 NULL
118440 +xen_hvm_config_40018 xen_hvm_config 2 40018 NULL
118441 +ivtvfb_write_40023 ivtvfb_write 3 40023 NULL
118442 +disc_pwup_write_40027 disc_pwup_write 3 40027 NULL
118443 +ea_foreach_i_40028 ea_foreach_i 0 40028 NULL
118444 +datablob_hmac_append_40038 datablob_hmac_append 3 40038 NULL
118445 +l2cap_create_iframe_pdu_40055 l2cap_create_iframe_pdu 3 40055 NULL nohasharray
118446 +add_tty_40055 add_tty 1 40055 &l2cap_create_iframe_pdu_40055
118447 +atomic_xchg_40070 atomic_xchg 0 40070 NULL
118448 +xfs_rtbuf_get_40107 xfs_rtbuf_get 0 40107 NULL
118449 +sctp_setsockopt_delayed_ack_40129 sctp_setsockopt_delayed_ack 3 40129 NULL
118450 +dwc2_max_desc_num_40132 dwc2_max_desc_num 0 40132 NULL
118451 +rx_rx_frame_checksum_read_40140 rx_rx_frame_checksum_read 3 40140 NULL
118452 +ath10k_write_simulate_fw_crash_40143 ath10k_write_simulate_fw_crash 3 40143 NULL
118453 +iwch_alloc_fastreg_pbl_40153 iwch_alloc_fastreg_pbl 2 40153 NULL
118454 +pt_write_40159 pt_write 3 40159 NULL
118455 +scsi_sg_count_40182 scsi_sg_count 0 40182 NULL
118456 +ipr_alloc_ucode_buffer_40199 ipr_alloc_ucode_buffer 1 40199 NULL
118457 +allocate_probes_40204 allocate_probes 1 40204 NULL
118458 +au0828_v4l2_read_40220 au0828_v4l2_read 3 40220 NULL
118459 +compress_file_range_40225 compress_file_range 3-4 40225 NULL
118460 +osst_read_40237 osst_read 3 40237 NULL
118461 +lpage_info_slot_40243 lpage_info_slot 3-1 40243 NULL
118462 +ocfs2_zero_extend_get_range_40248 ocfs2_zero_extend_get_range 4 40248 NULL
118463 +rs_sta_dbgfs_scale_table_read_40262 rs_sta_dbgfs_scale_table_read 3 40262 NULL
118464 +ext2_fiemap_40271 ext2_fiemap 4 40271 NULL
118465 +usbnet_read_cmd_40275 usbnet_read_cmd 7 40275 NULL
118466 +rx_xfr_hint_trig_read_40283 rx_xfr_hint_trig_read 3 40283 NULL
118467 +SyS_bind_40303 SyS_bind 3 40303 NULL
118468 +ib_get_mad_data_offset_40336 ib_get_mad_data_offset 0 40336 NULL
118469 +mmio_read_40348 mmio_read 4 40348 NULL
118470 +event_rx_mem_empty_read_40363 event_rx_mem_empty_read 3 40363 NULL
118471 +ocfs2_check_range_for_refcount_40365 ocfs2_check_range_for_refcount 3-2 40365 NULL
118472 +get_chars_40373 get_chars 3 40373 NULL
118473 +fb_prepare_extra_logos_40429 fb_prepare_extra_logos 0-2 40429 NULL
118474 +tomoyo_update_policy_40458 tomoyo_update_policy 2 40458 NULL
118475 +zd_usb_scnprint_id_40459 zd_usb_scnprint_id 0-3 40459 NULL
118476 +gp2ap020a00f_write_event_threshold_40461 gp2ap020a00f_write_event_threshold 2 40461 NULL
118477 +SyS_writev_40467 SyS_writev 3 40467 NULL
118478 +SyS_select_40473 SyS_select 1 40473 NULL
118479 +afs_fs_store_data_40484 afs_fs_store_data 3-4-5-6 40484 NULL
118480 +batadv_hash_new_40491 batadv_hash_new 1 40491 NULL
118481 +devcgroup_inode_permission_40492 devcgroup_inode_permission 0 40492 NULL
118482 +xfs_iread_extents_40510 xfs_iread_extents 0 40510 NULL
118483 +__ethtool_get_sset_count_40511 __ethtool_get_sset_count 0 40511 NULL
118484 +TSS_checkhmac2_40520 TSS_checkhmac2 5-7 40520 NULL
118485 +ixgbe_dbg_reg_ops_read_40540 ixgbe_dbg_reg_ops_read 3 40540 NULL
118486 +ima_write_policy_40548 ima_write_policy 3 40548 NULL
118487 +esp_alloc_tmp_40558 esp_alloc_tmp 3-2 40558 NULL
118488 +b1_get_byte_40597 b1_get_byte 0 40597 NULL
118489 +get_priv_descr_and_size_40612 get_priv_descr_and_size 0 40612 NULL
118490 +twl4030_kpwrite_u8_40665 twl4030_kpwrite_u8 3 40665 NULL
118491 +__cfg80211_roamed_40668 __cfg80211_roamed 4-6 40668 NULL
118492 +pipeline_rx_complete_stat_fifo_int_read_40671 pipeline_rx_complete_stat_fifo_int_read 3 40671 NULL
118493 +fops_read_40672 fops_read 3 40672 NULL
118494 +idr_get_empty_slot_40674 idr_get_empty_slot 0 40674 NULL
118495 +alloc_rbio_40676 alloc_rbio 4 40676 NULL
118496 +videobuf_dma_init_user_locked_40678 videobuf_dma_init_user_locked 4-3 40678 NULL
118497 +pci_enable_resources_40680 pci_enable_resources 0 40680 NULL
118498 +nfc_hci_set_param_40697 nfc_hci_set_param 5 40697 NULL
118499 +__seq_open_private_40715 __seq_open_private 3 40715 NULL
118500 +set_extent_bit_40719 set_extent_bit 0 40719 NULL
118501 +fuse_readpages_40737 fuse_readpages 4 40737 NULL
118502 +xfs_iext_remove_direct_40744 xfs_iext_remove_direct 3 40744 NULL
118503 +security_inode_listxattr_40752 security_inode_listxattr 0 40752 NULL
118504 +card_send_command_40757 card_send_command 3 40757 NULL
118505 +ad1889_readl_40765 ad1889_readl 0 40765 NULL
118506 +pg_write_40766 pg_write 3 40766 NULL
118507 +kernfs_fop_read_40770 kernfs_fop_read 3 40770 NULL
118508 +show_list_40775 show_list 3-0 40775 NULL
118509 +kfifo_out_copy_r_40784 kfifo_out_copy_r 3-0 40784 NULL
118510 +bitmap_weight_40791 bitmap_weight 0-2 40791 NULL
118511 +pyra_sysfs_read_40795 pyra_sysfs_read 6 40795 NULL
118512 +add_action_40811 add_action 4 40811 NULL
118513 +nl80211_send_roamed_40825 nl80211_send_roamed 5-7 40825 NULL
118514 +SyS_mbind_40828 SyS_mbind 5 40828 NULL
118515 +nilfs_mdt_init_40849 nilfs_mdt_init 3 40849 NULL
118516 +v9fs_file_read_40858 v9fs_file_read 3 40858 NULL
118517 +read_file_queue_40895 read_file_queue 3 40895 NULL
118518 +waiters_read_40902 waiters_read 3 40902 NULL
118519 +isdn_add_channels_40905 isdn_add_channels 3 40905 NULL
118520 +gfs2_ea_find_40913 gfs2_ea_find 0 40913 NULL
118521 +vol_cdev_write_40915 vol_cdev_write 3 40915 NULL
118522 +snd_vx_create_40948 snd_vx_create 4 40948 NULL nohasharray
118523 +sg_alloc_table_40948 sg_alloc_table 0 40948 &snd_vx_create_40948
118524 +rds_sendmsg_40976 rds_sendmsg 4 40976 NULL
118525 +il_dbgfs_fh_reg_read_40993 il_dbgfs_fh_reg_read 3 40993 NULL
118526 +iwl_dbgfs_scan_ant_rxchain_read_40999 iwl_dbgfs_scan_ant_rxchain_read 3 40999 NULL
118527 +mac80211_format_buffer_41010 mac80211_format_buffer 2 41010 NULL
118528 +__proc_dobitmasks_41029 __proc_dobitmasks 5 41029 NULL
118529 +_req_append_segment_41031 _req_append_segment 2 41031 NULL
118530 +mISDN_sock_sendmsg_41035 mISDN_sock_sendmsg 4 41035 NULL
118531 +ocfs2_xattr_index_block_find_41040 ocfs2_xattr_index_block_find 0 41040 NULL
118532 +lprocfs_write_frac_helper_41050 lprocfs_write_frac_helper 2 41050 NULL
118533 +vfs_listxattr_41062 vfs_listxattr 0 41062 NULL nohasharray
118534 +beacon_filtering_write_41062 beacon_filtering_write 3 41062 &vfs_listxattr_41062
118535 +cfg80211_inform_bss_frame_41078 cfg80211_inform_bss_frame 4 41078 NULL
118536 +nvme_map_user_pages_41093 nvme_map_user_pages 4-3 41093 NULL nohasharray
118537 +roccat_read_41093 roccat_read 3 41093 &nvme_map_user_pages_41093
118538 +dma_attach_41094 dma_attach 5-6 41094 NULL
118539 +provide_user_output_41105 provide_user_output 3 41105 NULL
118540 +f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
118541 +ath10k_read_wmi_services_41112 ath10k_read_wmi_services 3 41112 NULL
118542 +v4l2_ctrl_new_int_menu_41151 v4l2_ctrl_new_int_menu 4 41151 NULL
118543 +tx_frag_mpdu_alloc_failed_read_41167 tx_frag_mpdu_alloc_failed_read 3 41167 NULL
118544 +dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
118545 +compat_sys_process_vm_writev_41194 compat_sys_process_vm_writev 3-5 41194 NULL
118546 +dfs_file_write_41196 dfs_file_write 3 41196 NULL
118547 +nfs_page_array_len_41219 nfs_page_array_len 0-2-1 41219 NULL
118548 +cfg80211_process_disassoc_41231 cfg80211_process_disassoc 3 41231 NULL
118549 +hiddev_compat_ioctl_41255 hiddev_compat_ioctl 2 41255 NULL
118550 +erst_read_41260 erst_read 0 41260 NULL
118551 +alloc_context_41283 alloc_context 1 41283 NULL
118552 +o2hb_setup_one_bio_41341 o2hb_setup_one_bio 4 41341 NULL
118553 +twl_change_queue_depth_41342 twl_change_queue_depth 2 41342 NULL
118554 +rtw_android_set_block_41347 rtw_android_set_block 0 41347 NULL
118555 +ceph_do_getattr_41349 ceph_do_getattr 0 41349 NULL
118556 +cnic_init_id_tbl_41354 cnic_init_id_tbl 2 41354 NULL
118557 +kmp_init_41373 kmp_init 2 41373 NULL
118558 +isr_commands_read_41398 isr_commands_read 3 41398 NULL
118559 +rx_defrag_decrypt_failed_read_41411 rx_defrag_decrypt_failed_read 3 41411 NULL
118560 +xfs_iext_add_41422 xfs_iext_add 3 41422 NULL
118561 +isdn_ppp_fill_rq_41428 isdn_ppp_fill_rq 2 41428 NULL
118562 +lbs_rdrf_read_41431 lbs_rdrf_read 3 41431 NULL
118563 +iio_device_alloc_41440 iio_device_alloc 1 41440 NULL
118564 +ntfs_file_buffered_write_41442 ntfs_file_buffered_write 6-4-0 41442 NULL
118565 +pcpu_build_alloc_info_41443 pcpu_build_alloc_info 1-2-3 41443 NULL
118566 +se_io_cb_41461 se_io_cb 3 41461 NULL
118567 +layout_leb_in_gaps_41470 layout_leb_in_gaps 0 41470 NULL
118568 +rt2x00debug_write_rfcsr_41473 rt2x00debug_write_rfcsr 3 41473 NULL
118569 +bl_alloc_init_bio_41478 bl_alloc_init_bio 1 41478 NULL
118570 +kvm_unmap_hva_range_41484 kvm_unmap_hva_range 3-2 41484 NULL
118571 +wep_interrupt_read_41492 wep_interrupt_read 3 41492 NULL
118572 +SyS_get_mempolicy_41495 SyS_get_mempolicy 3 41495 NULL
118573 +hpfs_translate_name_41497 hpfs_translate_name 3 41497 NULL
118574 +xfrm_hash_new_size_41505 xfrm_hash_new_size 0-1 41505 NULL
118575 +SyS_preadv_41523 SyS_preadv 3 41523 NULL
118576 +dm_get_reserved_rq_based_ios_41529 dm_get_reserved_rq_based_ios 0 41529 NULL
118577 +tx_tx_frame_checksum_read_41553 tx_tx_frame_checksum_read 3 41553 NULL
118578 +ath6kl_endpoint_stats_read_41554 ath6kl_endpoint_stats_read 3 41554 NULL
118579 +nr_status_frames_41559 nr_status_frames 0-1 41559 NULL nohasharray
118580 +si476x_radio_fops_read_41559 si476x_radio_fops_read 3 41559 &nr_status_frames_41559
118581 +rng_dev_read_41581 rng_dev_read 3 41581 NULL
118582 +batadv_tvlv_container_ogm_append_41588 batadv_tvlv_container_ogm_append 4 41588 NULL
118583 +vga_io_r_41609 vga_io_r 0 41609 NULL
118584 +tcp_hdrlen_41610 tcp_hdrlen 0 41610 NULL
118585 +lbs_bcnmiss_write_41613 lbs_bcnmiss_write 3 41613 NULL nohasharray
118586 +usb_endpoint_maxp_41613 usb_endpoint_maxp 0 41613 &lbs_bcnmiss_write_41613
118587 +a2mp_send_41615 a2mp_send 4 41615 NULL
118588 +lstcon_batch_list_41627 lstcon_batch_list 2 41627 NULL
118589 +mempool_create_kmalloc_pool_41650 mempool_create_kmalloc_pool 1 41650 NULL
118590 +rx_rx_pre_complt_read_41653 rx_rx_pre_complt_read 3 41653 NULL
118591 +get_std_timing_41654 get_std_timing 0 41654 NULL
118592 +ieee80211_if_fmt_bssid_41677 ieee80211_if_fmt_bssid 3 41677 NULL
118593 +fill_pcm_stream_name_41685 fill_pcm_stream_name 2 41685 NULL
118594 +lov_unpackmd_41701 lov_unpackmd 4 41701 NULL
118595 +apei_exec_for_each_entry_41717 apei_exec_for_each_entry 0 41717 NULL
118596 +fillonedir_41746 fillonedir 3 41746 NULL
118597 +iwl_dbgfs_bt_notif_read_41794 iwl_dbgfs_bt_notif_read 3 41794 NULL
118598 +hsi_alloc_controller_41802 hsi_alloc_controller 1 41802 NULL
118599 +rtw_android_get_macaddr_41812 rtw_android_get_macaddr 0 41812 NULL
118600 +sco_send_frame_41815 sco_send_frame 3 41815 NULL
118601 +ixgbe_dbg_netdev_ops_read_41839 ixgbe_dbg_netdev_ops_read 3 41839 NULL
118602 +do_ip_setsockopt_41852 do_ip_setsockopt 5 41852 NULL
118603 +keyctl_instantiate_key_41855 keyctl_instantiate_key 3 41855 NULL
118604 +xfs_rtget_summary_41864 xfs_rtget_summary 0 41864 NULL
118605 +pci_map_single_41869 pci_map_single 0 41869 NULL
118606 +usb_gadget_get_string_41871 usb_gadget_get_string 0 41871 NULL
118607 +v_APCI3120_InterruptDmaMoveBlock16bit_41914 v_APCI3120_InterruptDmaMoveBlock16bit 4 41914 NULL
118608 +get_fdb_entries_41916 get_fdb_entries 3 41916 NULL
118609 +ext4_da_write_inline_data_begin_41935 ext4_da_write_inline_data_begin 3-4 41935 NULL
118610 +sci_rxfill_41945 sci_rxfill 0 41945 NULL
118611 +read_gssp_41947 read_gssp 3 41947 NULL
118612 +ocfs2_xattr_bucket_get_name_value_41949 ocfs2_xattr_bucket_get_name_value 0 41949 NULL
118613 +portnames_read_41958 portnames_read 3 41958 NULL
118614 +dst_mtu_41969 dst_mtu 0 41969 NULL
118615 +cx24116_writeregN_41975 cx24116_writeregN 4 41975 NULL
118616 +xfs_qm_dqalloc_41985 xfs_qm_dqalloc 0 41985 NULL
118617 +pool_allocate_42012 pool_allocate 3 42012 NULL
118618 +spidev_sync_read_42014 spidev_sync_read 0 42014 NULL
118619 +rs_sta_dbgfs_scale_table_write_42017 rs_sta_dbgfs_scale_table_write 3 42017 NULL
118620 +acpi_ut_create_buffer_object_42030 acpi_ut_create_buffer_object 1 42030 NULL
118621 +__hwahc_op_set_gtk_42038 __hwahc_op_set_gtk 4 42038 NULL
118622 +alloc_trace_kprobe_42041 alloc_trace_kprobe 6 42041 NULL
118623 +irda_sendmsg_ultra_42047 irda_sendmsg_ultra 4 42047 NULL
118624 +jffs2_do_link_42048 jffs2_do_link 6 42048 NULL
118625 +ps_poll_upsd_max_ap_turn_read_42050 ps_poll_upsd_max_ap_turn_read 3 42050 NULL
118626 +InterfaceTransmitPacket_42058 InterfaceTransmitPacket 3 42058 NULL
118627 +scsi_execute_req_42088 scsi_execute_req 5 42088 NULL
118628 +sk_chk_filter_42095 sk_chk_filter 2 42095 NULL
118629 +submit_inquiry_42108 submit_inquiry 3 42108 NULL
118630 +dw_dma_cyclic_prep_42113 dw_dma_cyclic_prep 3-4 42113 NULL
118631 +blk_ioctl_zeroout_42160 blk_ioctl_zeroout 3 42160 NULL
118632 +mmc_align_data_size_42161 mmc_align_data_size 0-2 42161 NULL
118633 +read_file_base_eeprom_42168 read_file_base_eeprom 3 42168 NULL
118634 +oprofilefs_str_to_user_42182 oprofilefs_str_to_user 3 42182 NULL
118635 +write_file_beacon_42185 write_file_beacon 3 42185 NULL
118636 +get_znodes_to_commit_42201 get_znodes_to_commit 0 42201 NULL
118637 +pla_ocp_read_42235 pla_ocp_read 3 42235 NULL
118638 +xfs_rtfree_range_42244 xfs_rtfree_range 0 42244 NULL
118639 +rx_defrag_need_decrypt_read_42253 rx_defrag_need_decrypt_read 3 42253 NULL
118640 +find_last_bit_42260 find_last_bit 0 42260 NULL
118641 +__pcpu_size_to_slot_42271 __pcpu_size_to_slot 0 42271 NULL
118642 +__tty_buffer_request_room_42276 __tty_buffer_request_room 2-0 42276 NULL
118643 +snd_pcm_hw_param_value_max_42280 snd_pcm_hw_param_value_max 0 42280 NULL
118644 +__cpus_weight_42299 __cpus_weight 2-0 42299 NULL
118645 +sel_read_perm_42302 sel_read_perm 3 42302 NULL
118646 +sctp_setsockopt_del_key_42304 sctp_setsockopt_del_key 3 42304 NULL nohasharray
118647 +ulong_read_file_42304 ulong_read_file 3 42304 &sctp_setsockopt_del_key_42304
118648 +xfs_vm_readpages_42308 xfs_vm_readpages 4 42308 NULL
118649 +hysdn_conf_read_42324 hysdn_conf_read 3 42324 NULL
118650 +tcp_sync_mss_42330 tcp_sync_mss 2-0 42330 NULL
118651 +ide_raw_taskfile_42355 ide_raw_taskfile 4 42355 NULL
118652 +tipc_send_42374 tipc_send 3 42374 NULL
118653 +drbd_md_last_sector_42378 drbd_md_last_sector 0 42378 NULL
118654 +il_dbgfs_disable_ht40_read_42386 il_dbgfs_disable_ht40_read 3 42386 NULL
118655 +msnd_fifo_read_42406 msnd_fifo_read 0-3 42406 NULL
118656 +krng_get_random_42420 krng_get_random 3 42420 NULL
118657 +gsm_data_alloc_42437 gsm_data_alloc 3 42437 NULL
118658 +key_conf_keyidx_read_42443 key_conf_keyidx_read 3 42443 NULL
118659 +snd_pcm_action_group_42452 snd_pcm_action_group 0 42452 NULL
118660 +tcm_loop_change_queue_depth_42454 tcm_loop_change_queue_depth 2 42454 NULL
118661 +kuc_free_42455 kuc_free 2 42455 NULL
118662 +__simple_xattr_set_42474 __simple_xattr_set 4 42474 NULL
118663 +omfs_readpages_42490 omfs_readpages 4 42490 NULL
118664 +bypass_write_42498 bypass_write 3 42498 NULL
118665 +SyS_mincore_42511 SyS_mincore 1-2 42511 NULL
118666 +kvm_write_wall_clock_42520 kvm_write_wall_clock 2 42520 NULL
118667 +dio_bio_complete_42524 dio_bio_complete 0 42524 NULL
118668 +smk_write_netlbladdr_42525 smk_write_netlbladdr 3 42525 NULL
118669 +dbAllocNear_42546 dbAllocNear 0 42546 NULL
118670 +ath6kl_wmi_proc_events_vif_42549 ath6kl_wmi_proc_events_vif 5 42549 NULL
118671 +udp_recvmsg_42558 udp_recvmsg 4 42558 NULL
118672 +iwl_print_event_log_42566 iwl_print_event_log 7-5-0 42566 NULL
118673 +xfrm_new_hash_mask_42579 xfrm_new_hash_mask 0-1 42579 NULL
118674 +oom_score_adj_write_42594 oom_score_adj_write 3 42594 NULL
118675 +ieee80211_if_fmt_dot11MeshHWMPactivePathTimeout_42635 ieee80211_if_fmt_dot11MeshHWMPactivePathTimeout 3 42635 NULL
118676 +scsi_activate_tcq_42640 scsi_activate_tcq 2 42640 NULL
118677 +br_mdb_rehash_42643 br_mdb_rehash 2 42643 NULL
118678 +parport_pc_compat_write_block_pio_42644 parport_pc_compat_write_block_pio 3 42644 NULL
118679 +_regmap_raw_write_42652 _regmap_raw_write 4-2 42652 NULL
118680 +request_key_and_link_42693 request_key_and_link 4 42693 NULL
118681 +vb2_read_42703 vb2_read 3 42703 NULL
118682 +read_status_42722 read_status 0 42722 NULL
118683 +dvb_demux_ioctl_42733 dvb_demux_ioctl 2 42733 NULL
118684 +set_aoe_iflist_42737 set_aoe_iflist 2 42737 NULL
118685 +ax25_setsockopt_42740 ax25_setsockopt 5 42740 NULL
118686 +dpm_sysfs_add_42756 dpm_sysfs_add 0 42756 NULL
118687 +x25_recvmsg_42777 x25_recvmsg 4 42777 NULL
118688 +snd_midi_event_decode_42780 snd_midi_event_decode 0 42780 NULL
118689 +cryptd_hash_setkey_42781 cryptd_hash_setkey 3 42781 NULL nohasharray
118690 +isku_sysfs_read_info_42781 isku_sysfs_read_info 6 42781 &cryptd_hash_setkey_42781
118691 +elfcorehdr_read_notes_42786 elfcorehdr_read_notes 2 42786 NULL
118692 +koneplus_sysfs_read_42792 koneplus_sysfs_read 6 42792 NULL
118693 +ntfs_attr_extend_allocation_42796 ntfs_attr_extend_allocation 0 42796 NULL
118694 +fw_device_op_compat_ioctl_42804 fw_device_op_compat_ioctl 2 42804 NULL
118695 +drm_ioctl_42813 drm_ioctl 2 42813 NULL
118696 +iwl_dbgfs_ucode_bt_stats_read_42820 iwl_dbgfs_ucode_bt_stats_read 3 42820 NULL
118697 +set_arg_42824 set_arg 3 42824 NULL
118698 +si476x_radio_read_rsq_blob_42827 si476x_radio_read_rsq_blob 3 42827 NULL
118699 +ocfs2_clusters_for_bytes_42872 ocfs2_clusters_for_bytes 0-2 42872 NULL
118700 +nvme_trans_unit_serial_page_42879 nvme_trans_unit_serial_page 4 42879 NULL
118701 +xpc_kmalloc_cacheline_aligned_42895 xpc_kmalloc_cacheline_aligned 1 42895 NULL
118702 +hd_end_request_42904 hd_end_request 2 42904 NULL
118703 +sta_last_rx_rate_read_42909 sta_last_rx_rate_read 3 42909 NULL
118704 +xfs_bmapi_allocate_42938 xfs_bmapi_allocate 0 42938 NULL
118705 +sctp_getsockopt_maxburst_42941 sctp_getsockopt_maxburst 2 42941 NULL
118706 +vx_reset_chk_42946 vx_reset_chk 0 42946 NULL
118707 +blkdev_direct_IO_42962 blkdev_direct_IO 4 42962 NULL
118708 +compat_udpv6_setsockopt_42981 compat_udpv6_setsockopt 5 42981 NULL
118709 +nfs_idmap_get_desc_42990 nfs_idmap_get_desc 4-2 42990 NULL nohasharray
118710 +rtw_os_xmit_resource_alloc_42990 rtw_os_xmit_resource_alloc 3 42990 &nfs_idmap_get_desc_42990
118711 +xfs_da_read_buf_43008 xfs_da_read_buf 0 43008 NULL
118712 +isr_rx_mem_overflow_read_43025 isr_rx_mem_overflow_read 3 43025 NULL
118713 +wep_default_key_count_read_43035 wep_default_key_count_read 3 43035 NULL
118714 +nouveau_gpuobj_create__43072 nouveau_gpuobj_create_ 9 43072 NULL
118715 +nfs_map_group_to_gid_43082 nfs_map_group_to_gid 3 43082 NULL
118716 +_xfer_secondary_pool_43089 _xfer_secondary_pool 2 43089 NULL
118717 +sysfs_create_file_ns_43103 sysfs_create_file_ns 0 43103 NULL
118718 +ieee80211_if_fmt_drop_unencrypted_43107 ieee80211_if_fmt_drop_unencrypted 3 43107 NULL
118719 +calculate_node_totalpages_43118 calculate_node_totalpages 2-3 43118 NULL
118720 +read_file_dfs_43145 read_file_dfs 3 43145 NULL
118721 +cfs_cpt_table_alloc_43159 cfs_cpt_table_alloc 1 43159 NULL
118722 +usb_string_sub_43164 usb_string_sub 0 43164 NULL
118723 +il_dbgfs_power_save_status_read_43165 il_dbgfs_power_save_status_read 3 43165 NULL
118724 +ath6kl_set_assoc_req_ies_43185 ath6kl_set_assoc_req_ies 3 43185 NULL
118725 +ext4_xattr_ibody_get_43200 ext4_xattr_ibody_get 0 43200 NULL
118726 +uio_write_43202 uio_write 3 43202 NULL
118727 +iso_callback_43208 iso_callback 3 43208 NULL
118728 +ath10k_p2p_calc_noa_ie_len_43209 ath10k_p2p_calc_noa_ie_len 0 43209 NULL
118729 +f2fs_acl_from_disk_43210 f2fs_acl_from_disk 2 43210 NULL
118730 +atomic_long_add_return_43217 atomic_long_add_return 1-0 43217 NULL
118731 +inode_init_always_43225 inode_init_always 0 43225 NULL
118732 +batadv_tt_tvlv_unicast_handler_v1_43239 batadv_tt_tvlv_unicast_handler_v1 5 43239 NULL
118733 +vmemmap_alloc_block_43245 vmemmap_alloc_block 1 43245 NULL
118734 +ide_end_rq_43269 ide_end_rq 4 43269 NULL
118735 +nilfs_direct_IO_43271 nilfs_direct_IO 4 43271 NULL
118736 +parport_pc_ecp_write_block_pio_43278 parport_pc_ecp_write_block_pio 3 43278 NULL nohasharray
118737 +evtchn_write_43278 evtchn_write 3 43278 &parport_pc_ecp_write_block_pio_43278
118738 +filemap_write_and_wait_range_43279 filemap_write_and_wait_range 0 43279 NULL
118739 +mpage_alloc_43299 mpage_alloc 3 43299 NULL
118740 +mmu_set_spte_43327 mmu_set_spte 6-7 43327 NULL
118741 +__ext4_get_inode_loc_43332 __ext4_get_inode_loc 0 43332 NULL
118742 +xfs_log_regrant_43350 xfs_log_regrant 0 43350 NULL
118743 +gfs2_rgrp_bh_get_43375 gfs2_rgrp_bh_get 0 43375 NULL
118744 +xfs_btree_new_iroot_43392 xfs_btree_new_iroot 0 43392 NULL
118745 +xenfb_write_43412 xenfb_write 3 43412 NULL
118746 +__alloc_bootmem_low_43423 __alloc_bootmem_low 1 43423 NULL
118747 +usb_alloc_urb_43436 usb_alloc_urb 1 43436 NULL
118748 +cifs_writev_43437 cifs_writev 4 43437 NULL
118749 +ath6kl_wmi_roam_tbl_event_rx_43440 ath6kl_wmi_roam_tbl_event_rx 3 43440 NULL
118750 +usb_string_43443 usb_string 0 43443 NULL nohasharray
118751 +usemap_size_43443 usemap_size 0-2-1 43443 &usb_string_43443
118752 +get_vm_area_size_43444 get_vm_area_size 0 43444 NULL
118753 +nvme_trans_device_id_page_43466 nvme_trans_device_id_page 4 43466 NULL
118754 +tx_tx_data_prepared_read_43497 tx_tx_data_prepared_read 3 43497 NULL
118755 +ieee80211_if_fmt_dot11MeshHWMPnetDiameterTraversalTime_43505 ieee80211_if_fmt_dot11MeshHWMPnetDiameterTraversalTime 3 43505 NULL
118756 +do_readlink_43518 do_readlink 2 43518 NULL
118757 +dvb_ca_en50221_io_write_43533 dvb_ca_en50221_io_write 3 43533 NULL
118758 +read_events_43534 read_events 3 43534 NULL
118759 +cachefiles_daemon_write_43535 cachefiles_daemon_write 3 43535 NULL
118760 +tx_frag_failed_read_43540 tx_frag_failed_read 3 43540 NULL
118761 +request_resource_43548 request_resource 0 43548 NULL
118762 +rpc_malloc_43573 rpc_malloc 2 43573 NULL
118763 +handle_frequent_errors_43599 handle_frequent_errors 4 43599 NULL
118764 +lpfc_idiag_drbacc_read_reg_43606 lpfc_idiag_drbacc_read_reg 0-3 43606 NULL
118765 +proc_read_43614 proc_read 3 43614 NULL
118766 +disable_dma_on_even_43618 disable_dma_on_even 0 43618 NULL
118767 +alloc_thread_groups_43625 alloc_thread_groups 2 43625 NULL
118768 +random_write_43656 random_write 3 43656 NULL
118769 +bio_integrity_tag_43658 bio_integrity_tag 3 43658 NULL
118770 +ext4_acl_count_43659 ext4_acl_count 0-1 43659 NULL
118771 +write_file_tx99_power_43670 write_file_tx99_power 3 43670 NULL
118772 +dmam_declare_coherent_memory_43679 dmam_declare_coherent_memory 4 43679 NULL
118773 +max77693_bulk_write_43698 max77693_bulk_write 2-3 43698 NULL
118774 +drbd_md_first_sector_43729 drbd_md_first_sector 0 43729 NULL
118775 +snd_rme32_playback_copy_43732 snd_rme32_playback_copy 5 43732 NULL
118776 +fuse_conn_congestion_threshold_write_43736 fuse_conn_congestion_threshold_write 3 43736 NULL
118777 +gigaset_initcs_43753 gigaset_initcs 2 43753 NULL
118778 +sctp_setsockopt_active_key_43755 sctp_setsockopt_active_key 3 43755 NULL
118779 +xfs_alloc_lookup_eq_43775 xfs_alloc_lookup_eq 0 43775 NULL
118780 +ocfs2_xattr_get_value_outside_43787 ocfs2_xattr_get_value_outside 0 43787 NULL nohasharray
118781 +byte_pos_43787 byte_pos 0-2 43787 &ocfs2_xattr_get_value_outside_43787
118782 +xfs_trans_reserve_quota_bydquots_43797 xfs_trans_reserve_quota_bydquots 0 43797 NULL
118783 +btrfs_copy_from_user_43806 btrfs_copy_from_user 0-3-1 43806 NULL
118784 +_xfs_filestream_update_ag_43824 _xfs_filestream_update_ag 0 43824 NULL
118785 +ieee80211_if_fmt_element_ttl_43825 ieee80211_if_fmt_element_ttl 3 43825 NULL
118786 +ieee80211_alloc_hw_43829 ieee80211_alloc_hw 1 43829 NULL
118787 +read_flush_43851 read_flush 3 43851 NULL
118788 +pm860x_bulk_write_43875 pm860x_bulk_write 2-3 43875 NULL
118789 +SendString_43928 SendString 3 43928 NULL
118790 +stats_dot11RTSFailureCount_read_43948 stats_dot11RTSFailureCount_read 3 43948 NULL
118791 +xfs_trans_dqresv_43960 xfs_trans_dqresv 0 43960 NULL
118792 +__get_required_blob_size_43980 __get_required_blob_size 0-3-2 43980 NULL
118793 +nla_reserve_43984 nla_reserve 3 43984 NULL
118794 +__clkdev_alloc_43990 __clkdev_alloc 1 43990 NULL
118795 +scsi_command_size_43992 scsi_command_size 0 43992 NULL nohasharray
118796 +kvm_read_guest_virt_43992 kvm_read_guest_virt 4-2 43992 &scsi_command_size_43992 nohasharray
118797 +bcm_recvmsg_43992 bcm_recvmsg 4 43992 &kvm_read_guest_virt_43992
118798 +ulist_add_43994 ulist_add 0 43994 NULL
118799 +emit_flags_44006 emit_flags 4-3 44006 NULL
118800 +write_flush_procfs_44011 write_flush_procfs 3 44011 NULL
118801 +fru_strlen_44046 fru_strlen 0 44046 NULL
118802 +ath9k_def_dump_modal_eeprom_44078 ath9k_def_dump_modal_eeprom 3-2-0 44078 NULL
118803 +SYSC_add_key_44079 SYSC_add_key 4 44079 NULL
118804 +pci_msix_vec_count_44093 pci_msix_vec_count 0 44093 NULL nohasharray
118805 +__vxge_hw_vpath_tim_configure_44093 __vxge_hw_vpath_tim_configure 2 44093 &pci_msix_vec_count_44093
118806 +xlog_recover_add_to_cont_trans_44102 xlog_recover_add_to_cont_trans 4 44102 NULL
118807 +skb_frag_dma_map_44112 skb_frag_dma_map 0 44112 NULL
118808 +file_remove_suid_44122 file_remove_suid 0 44122 NULL nohasharray
118809 +tracing_set_trace_read_44122 tracing_set_trace_read 3 44122 &file_remove_suid_44122
118810 +SyS_process_vm_writev_44129 SyS_process_vm_writev 3-5 44129 NULL
118811 +ttm_get_pages_44142 ttm_get_pages 2 44142 NULL
118812 +scsi_get_resid_44147 scsi_get_resid 0 44147 NULL
118813 +ocfs2_xattr_bucket_find_44174 ocfs2_xattr_bucket_find 0 44174 NULL
118814 +SYSC_set_mempolicy_44176 SYSC_set_mempolicy 3 44176 NULL
118815 +readreg_ipac_44186 readreg_ipac 0 44186 NULL
118816 +handle_eviocgbit_44193 handle_eviocgbit 3 44193 NULL
118817 +srp_alloc_iu_44227 srp_alloc_iu 2 44227 NULL
118818 +scsi_track_queue_full_44239 scsi_track_queue_full 2 44239 NULL
118819 +sigma_action_write_regmap_44240 sigma_action_write_regmap 3 44240 NULL
118820 +apei_resources_sub_44252 apei_resources_sub 0 44252 NULL
118821 +device_create_file_44285 device_create_file 0 44285 NULL
118822 +ath6kl_keepalive_read_44303 ath6kl_keepalive_read 3 44303 NULL
118823 +bitmap_scnprintf_44318 bitmap_scnprintf 0-2 44318 NULL
118824 +dispatch_proc_write_44320 dispatch_proc_write 3 44320 NULL
118825 +ccp_init_data_44324 ccp_init_data 5 44324 NULL
118826 +rs_init_44327 rs_init 1 44327 NULL
118827 +radix_tree_maybe_preload_44346 radix_tree_maybe_preload 0 44346 NULL
118828 +blk_queue_init_tags_44355 blk_queue_init_tags 2 44355 NULL nohasharray
118829 +nfs_fscache_get_super_cookie_44355 nfs_fscache_get_super_cookie 3 44355 &blk_queue_init_tags_44355
118830 +rts_threshold_read_44384 rts_threshold_read 3 44384 NULL
118831 +mtip_hw_read_flags_44396 mtip_hw_read_flags 3 44396 NULL
118832 +aoedev_flush_44398 aoedev_flush 2 44398 NULL
118833 +strlcpy_44400 strlcpy 3 44400 NULL
118834 +drm_buffer_alloc_44405 drm_buffer_alloc 2 44405 NULL
118835 +osst_do_scsi_44410 osst_do_scsi 4 44410 NULL
118836 +ieee80211_if_read_rc_rateidx_mcs_mask_5ghz_44423 ieee80211_if_read_rc_rateidx_mcs_mask_5ghz 3 44423 NULL
118837 +xfs_mod_incore_sb_44439 xfs_mod_incore_sb 0 44439 NULL
118838 +write_file_debug_44476 write_file_debug 3 44476 NULL
118839 +btrfs_chunk_item_size_44478 btrfs_chunk_item_size 0-1 44478 NULL
118840 +sdio_align_size_44489 sdio_align_size 0-2 44489 NULL
118841 +bio_advance_44496 bio_advance 2 44496 NULL
118842 +ieee80211_if_read_dropped_frames_ttl_44500 ieee80211_if_read_dropped_frames_ttl 3 44500 NULL
118843 +ac_register_board_44504 ac_register_board 3 44504 NULL
118844 +security_getprocattr_44505 security_getprocattr 0 44505 NULL nohasharray
118845 +iwl_dbgfs_sram_read_44505 iwl_dbgfs_sram_read 3 44505 &security_getprocattr_44505
118846 +spidev_write_44510 spidev_write 3 44510 NULL
118847 +SyS_io_getevents_44519 SyS_io_getevents 3 44519 NULL
118848 +ieee80211_rx_mgmt_assoc_resp_44525 ieee80211_rx_mgmt_assoc_resp 3 44525 NULL
118849 +comm_write_44537 comm_write 3 44537 NULL
118850 +dgrp_config_proc_write_44571 dgrp_config_proc_write 3 44571 NULL
118851 +btrfs_set_extent_delalloc_44587 btrfs_set_extent_delalloc 0 44587 NULL
118852 +nouveau_perfmon_create__44602 nouveau_perfmon_create_ 4 44602 NULL
118853 +xfs_bmapi_delay_44630 xfs_bmapi_delay 0 44630 NULL
118854 +alloc_ctrl_packet_44667 alloc_ctrl_packet 1 44667 NULL
118855 +mpi_resize_44674 mpi_resize 2 44674 NULL
118856 +sysfs_create_link_44685 sysfs_create_link 0 44685 NULL
118857 +ts_read_44687 ts_read 3 44687 NULL
118858 +lov_emerg_alloc_44698 lov_emerg_alloc 1 44698 NULL
118859 +xfer_to_user_44713 xfer_to_user 3 44713 NULL nohasharray
118860 +__generic_block_fiemap_44713 __generic_block_fiemap 4 44713 &xfer_to_user_44713
118861 +_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
118862 +clusterip_proc_write_44729 clusterip_proc_write 3 44729 NULL
118863 +fib_count_nexthops_44730 fib_count_nexthops 0 44730 NULL
118864 +key_tx_rx_count_read_44742 key_tx_rx_count_read 3 44742 NULL
118865 +bch_bio_max_sectors_44755 bch_bio_max_sectors 0 44755 NULL
118866 +tnode_new_44757 tnode_new 3 44757 NULL nohasharray
118867 +pty_write_44757 pty_write 3 44757 &tnode_new_44757
118868 +__videobuf_copy_stream_44769 __videobuf_copy_stream 4-0 44769 NULL
118869 +handsfree_ramp_44777 handsfree_ramp 2 44777 NULL
118870 +irq_domain_add_legacy_44781 irq_domain_add_legacy 4-2 44781 NULL
118871 +sctp_setsockopt_44788 sctp_setsockopt 5 44788 NULL
118872 +rx_dropped_read_44799 rx_dropped_read 3 44799 NULL
118873 +qla4xxx_alloc_work_44813 qla4xxx_alloc_work 2 44813 NULL
118874 +mei_cl_read_start_44824 mei_cl_read_start 2 44824 NULL
118875 +rmap_write_protect_44833 rmap_write_protect 2 44833 NULL
118876 +sisusb_write_44834 sisusb_write 3 44834 NULL
118877 +kvm_read_hva_44847 kvm_read_hva 3 44847 NULL
118878 +qib_verbs_send_dma_44850 qib_verbs_send_dma 6 44850 NULL
118879 +copydesc_user_44855 copydesc_user 3 44855 NULL
118880 +set_advertising_44870 set_advertising 4 44870 NULL
118881 +init_rs_44873 init_rs 1 44873 NULL
118882 +skb_availroom_44883 skb_availroom 0 44883 NULL
118883 +ocfs2_wait_for_mask_44893 ocfs2_wait_for_mask 0 44893 NULL
118884 +do_tty_write_44896 do_tty_write 5 44896 NULL
118885 +regmap_spi_read_44921 regmap_spi_read 3-5 44921 NULL
118886 +tx_queue_status_read_44978 tx_queue_status_read 3 44978 NULL
118887 +bytepos_delta_45017 bytepos_delta 0-2 45017 NULL
118888 +ptrace_writedata_45021 ptrace_writedata 4 45021 NULL
118889 +dm_kvzalloc_45025 dm_kvzalloc 1 45025 NULL
118890 +sysfs_do_create_link_sd_45057 sysfs_do_create_link_sd 0 45057 NULL
118891 +sel_write_user_45060 sel_write_user 3 45060 NULL
118892 +snd_mixart_BA0_read_45069 snd_mixart_BA0_read 5 45069 NULL
118893 +kvm_mmu_page_get_gfn_45110 kvm_mmu_page_get_gfn 0-2 45110 NULL
118894 +pwr_missing_bcns_cnt_read_45113 pwr_missing_bcns_cnt_read 3 45113 NULL
118895 +usbdev_read_45114 usbdev_read 3 45114 NULL
118896 +send_to_tty_45141 send_to_tty 3 45141 NULL
118897 +cfs_trace_daemon_command_usrstr_45147 cfs_trace_daemon_command_usrstr 2 45147 NULL
118898 +gen_bitmask_string_45149 gen_bitmask_string 6 45149 NULL
118899 +device_write_45156 device_write 3 45156 NULL nohasharray
118900 +ocfs2_remove_inode_range_45156 ocfs2_remove_inode_range 3 45156 &device_write_45156
118901 +tomoyo_write_self_45161 tomoyo_write_self 3 45161 NULL
118902 +sta_agg_status_write_45164 sta_agg_status_write 3 45164 NULL
118903 +snd_sb_csp_load_user_45190 snd_sb_csp_load_user 3 45190 NULL nohasharray
118904 +sctp_pack_cookie_45190 sctp_pack_cookie 6 45190 &snd_sb_csp_load_user_45190
118905 +__radix_tree_preload_45197 __radix_tree_preload 0 45197 NULL
118906 +iso_alloc_urb_45206 iso_alloc_urb 4-5 45206 NULL
118907 +spi_alloc_master_45223 spi_alloc_master 2 45223 NULL
118908 +ieee80211_if_read_peer_45233 ieee80211_if_read_peer 3 45233 NULL
118909 +event_enable_write_45238 event_enable_write 3 45238 NULL
118910 +prism2_pda_proc_read_45246 prism2_pda_proc_read 3 45246 NULL
118911 +input_mt_init_slots_45279 input_mt_init_slots 2 45279 NULL
118912 +gfs2_fiemap_45282 gfs2_fiemap 4 45282 NULL
118913 +snd_pcm_oss_sync1_45298 snd_pcm_oss_sync1 2 45298 NULL
118914 +xfs_alert_fsblock_zero_45304 xfs_alert_fsblock_zero 0 45304 NULL
118915 +e1000_tx_map_45309 e1000_tx_map 5 45309 NULL
118916 +copy_vm86_regs_from_user_45340 copy_vm86_regs_from_user 3 45340 NULL
118917 +brcmf_sdio_died_dump_45359 brcmf_sdio_died_dump 3 45359 NULL
118918 +null_alloc_repbuf_45375 null_alloc_repbuf 3 45375 NULL
118919 +sock_recv_errqueue_45412 sock_recv_errqueue 3 45412 NULL
118920 +ieee80211_if_fmt_dot11MeshHWMProotInterval_45421 ieee80211_if_fmt_dot11MeshHWMProotInterval 3 45421 NULL
118921 +ll_iocontrol_register_45430 ll_iocontrol_register 2 45430 NULL
118922 +tty_buffer_alloc_45437 tty_buffer_alloc 2 45437 NULL
118923 +__node_remap_45458 __node_remap 4 45458 NULL
118924 +rds_ib_set_wr_signal_state_45463 rds_ib_set_wr_signal_state 0 45463 NULL
118925 +tracing_read_dyn_info_45468 tracing_read_dyn_info 3 45468 NULL
118926 +__calc_request_pg_45470 __calc_request_pg 0 45470 NULL
118927 +xfs_btree_block_change_owner_45476 xfs_btree_block_change_owner 0 45476 NULL
118928 +rds_message_copy_from_user_45510 rds_message_copy_from_user 3 45510 NULL
118929 +i40e_alloc_vfs_45511 i40e_alloc_vfs 2 45511 NULL
118930 +copy_macs_45534 copy_macs 4 45534 NULL
118931 +nla_attr_size_45545 nla_attr_size 0-1 45545 NULL
118932 +v9fs_direct_read_45546 v9fs_direct_read 3 45546 NULL
118933 +cx18_copy_mdl_to_user_45549 cx18_copy_mdl_to_user 4 45549 NULL
118934 +stats_dot11ACKFailureCount_read_45558 stats_dot11ACKFailureCount_read 3 45558 NULL
118935 +_regmap_bus_raw_write_45559 _regmap_bus_raw_write 2 45559 NULL
118936 +posix_acl_xattr_size_45561 posix_acl_xattr_size 0-1 45561 NULL
118937 +venus_rmdir_45564 venus_rmdir 4 45564 NULL
118938 +ath6kl_keepalive_write_45600 ath6kl_keepalive_write 3 45600 NULL
118939 +hidraw_get_report_45609 hidraw_get_report 3 45609 NULL
118940 +compat_mpctl_ioctl_45671 compat_mpctl_ioctl 2 45671 NULL
118941 +dgram_sendmsg_45679 dgram_sendmsg 4 45679 NULL
118942 +smk_write_ambient_45691 smk_write_ambient 3 45691 NULL
118943 +unix_dgram_sendmsg_45699 unix_dgram_sendmsg 4 45699 NULL nohasharray
118944 +bscnl_emit_45699 bscnl_emit 2-5-0 45699 &unix_dgram_sendmsg_45699
118945 +sg_proc_write_adio_45704 sg_proc_write_adio 3 45704 NULL
118946 +snd_cs46xx_io_read_45734 snd_cs46xx_io_read 5 45734 NULL nohasharray
118947 +task_cgroup_path_45734 task_cgroup_path 3 45734 &snd_cs46xx_io_read_45734
118948 +rw_copy_check_uvector_45748 rw_copy_check_uvector 3-0 45748 NULL nohasharray
118949 +v4l2_ctrl_new_std_45748 v4l2_ctrl_new_std 5 45748 &rw_copy_check_uvector_45748
118950 +lkdtm_debugfs_read_45752 lkdtm_debugfs_read 3 45752 NULL
118951 +alloc_ts_config_45775 alloc_ts_config 1 45775 NULL
118952 +osc_checksum_type_seq_write_45785 osc_checksum_type_seq_write 3 45785 NULL
118953 +raw_setsockopt_45800 raw_setsockopt 5 45800 NULL
118954 +rds_tcp_inc_copy_to_user_45804 rds_tcp_inc_copy_to_user 3 45804 NULL
118955 +lbs_rdbbp_read_45805 lbs_rdbbp_read 3 45805 NULL
118956 +pcpu_alloc_alloc_info_45813 pcpu_alloc_alloc_info 1-2 45813 NULL
118957 +ll_max_readahead_mb_seq_write_45815 ll_max_readahead_mb_seq_write 3 45815 NULL
118958 +memcg_update_cache_size_45828 memcg_update_cache_size 2 45828 NULL
118959 +ipv6_recv_rxpmtu_45830 ipv6_recv_rxpmtu 3 45830 NULL
118960 +insert_state_45848 insert_state 0 45848 NULL
118961 +x509_process_extension_45854 x509_process_extension 5 45854 NULL
118962 +efx_tx_queue_insert_45859 efx_tx_queue_insert 2 45859 NULL
118963 +isdn_write_45863 isdn_write 3 45863 NULL
118964 +tpm_config_in_45880 tpm_config_in 0 45880 NULL
118965 +get_rdac_req_45882 get_rdac_req 3 45882 NULL
118966 +ocfs2_xattr_block_find_45891 ocfs2_xattr_block_find 0 45891 NULL
118967 +cfs_cpt_weight_45903 cfs_cpt_weight 0 45903 NULL
118968 +wm_adsp_region_to_reg_45915 wm_adsp_region_to_reg 0-2 45915 NULL
118969 +dbgfs_frame_45917 dbgfs_frame 3 45917 NULL
118970 +btree_keys_cachelines_45928 btree_keys_cachelines 0 45928 NULL
118971 +alloc_mr_45935 alloc_mr 1 45935 NULL
118972 +copy_to_45969 copy_to 3 45969 NULL
118973 +rb_simple_read_45972 rb_simple_read 3 45972 NULL
118974 +ioat2_dca_count_dca_slots_45984 ioat2_dca_count_dca_slots 0 45984 NULL
118975 +kobject_init_and_add_46003 kobject_init_and_add 0 46003 NULL
118976 +sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
118977 +fnic_reset_stats_read_46030 fnic_reset_stats_read 3 46030 NULL nohasharray
118978 +get_free_entries_46030 get_free_entries 1 46030 &fnic_reset_stats_read_46030
118979 +__access_remote_vm_46031 __access_remote_vm 0 46031 NULL
118980 +snd_emu10k1x_ptr_read_46049 snd_emu10k1x_ptr_read 0 46049 NULL
118981 +__ocfs2_move_extent_46060 __ocfs2_move_extent 3-4 46060 NULL nohasharray
118982 +dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 &__ocfs2_move_extent_46060
118983 +sel_commit_bools_write_46077 sel_commit_bools_write 3 46077 NULL
118984 +il3945_ucode_general_stats_read_46111 il3945_ucode_general_stats_read 3 46111 NULL nohasharray
118985 +memcg_update_array_size_46111 memcg_update_array_size 1 46111 &il3945_ucode_general_stats_read_46111
118986 +C_SYSC_writev_46113 C_SYSC_writev 3 46113 NULL
118987 +mlx4_ib_alloc_fast_reg_page_list_46119 mlx4_ib_alloc_fast_reg_page_list 2 46119 NULL
118988 +rtw_buf_update_46138 rtw_buf_update 4 46138 NULL
118989 +vb2_dma_sg_get_userptr_46146 vb2_dma_sg_get_userptr 3-2 46146 NULL
118990 +__netlink_change_ngroups_46156 __netlink_change_ngroups 2 46156 NULL
118991 +twl_direction_out_46182 twl_direction_out 2 46182 NULL
118992 +vxge_os_dma_malloc_46184 vxge_os_dma_malloc 2 46184 NULL
118993 +fq_resize_46195 fq_resize 2 46195 NULL
118994 +add_conn_list_46197 add_conn_list 3-0 46197 NULL
118995 +i2400m_op_msg_from_user_46213 i2400m_op_msg_from_user 4 46213 NULL
118996 +tm6000_i2c_recv_regs_46215 tm6000_i2c_recv_regs 5 46215 NULL
118997 +dsp_write_46218 dsp_write 2 46218 NULL
118998 +hash_netiface4_expire_46226 hash_netiface4_expire 4 46226 NULL
118999 +xen_setup_msi_irqs_46245 xen_setup_msi_irqs 2 46245 NULL
119000 +mpi_read_raw_data_46248 mpi_read_raw_data 2 46248 NULL
119001 +ReadReg_46277 ReadReg 0 46277 NULL
119002 +sg_proc_write_dressz_46316 sg_proc_write_dressz 3 46316 NULL
119003 +__hwahc_dev_set_key_46328 __hwahc_dev_set_key 5 46328 NULL nohasharray
119004 +compat_SyS_readv_46328 compat_SyS_readv 3 46328 &__hwahc_dev_set_key_46328
119005 +iwl_dbgfs_chain_noise_read_46355 iwl_dbgfs_chain_noise_read 3 46355 NULL
119006 +smk_write_direct_46363 smk_write_direct 3 46363 NULL
119007 +fuse_file_aio_write_46399 fuse_file_aio_write 4 46399 NULL
119008 +crypto_ablkcipher_reqsize_46411 crypto_ablkcipher_reqsize 0 46411 NULL
119009 +ttm_page_pool_get_pages_46431 ttm_page_pool_get_pages 0-5 46431 NULL
119010 +cfs_power2_roundup_46433 cfs_power2_roundup 0-1 46433 NULL
119011 +cp210x_set_config_46447 cp210x_set_config 4 46447 NULL
119012 +parport_pc_fifo_write_block_46455 parport_pc_fifo_write_block 3 46455 NULL
119013 +il_dbgfs_clear_traffic_stats_write_46458 il_dbgfs_clear_traffic_stats_write 3 46458 NULL
119014 +filldir64_46469 filldir64 3 46469 NULL
119015 +fill_in_write_vector_46498 fill_in_write_vector 0 46498 NULL
119016 +pin_code_reply_46510 pin_code_reply 4 46510 NULL
119017 +mthca_alloc_cq_buf_46512 mthca_alloc_cq_buf 3 46512 NULL
119018 +kmsg_read_46514 kmsg_read 3 46514 NULL nohasharray
119019 +nouveau_drm_ioctl_46514 nouveau_drm_ioctl 2 46514 &kmsg_read_46514
119020 +nl80211_send_rx_assoc_46538 nl80211_send_rx_assoc 4 46538 NULL
119021 +dn_current_mss_46574 dn_current_mss 0 46574 NULL
119022 +serverworks_create_gatt_pages_46582 serverworks_create_gatt_pages 1 46582 NULL
119023 +snd_compr_write_data_46592 snd_compr_write_data 3 46592 NULL
119024 +il3945_stats_flag_46606 il3945_stats_flag 0-3 46606 NULL
119025 +vscnprintf_46617 vscnprintf 0-2 46617 NULL
119026 +__kfifo_out_r_46623 __kfifo_out_r 3-0 46623 NULL
119027 +request_key_async_with_auxdata_46624 request_key_async_with_auxdata 4 46624 NULL
119028 +pci_enable_device_46642 pci_enable_device 0 46642 NULL
119029 +vfs_getxattr_alloc_46649 vfs_getxattr_alloc 0 46649 NULL
119030 +e1000_tx_map_46672 e1000_tx_map 4 46672 NULL
119031 +l2cap_create_le_flowctl_pdu_46682 l2cap_create_le_flowctl_pdu 3 46682 NULL
119032 +alloc_data_packet_46698 alloc_data_packet 1 46698 NULL
119033 +__ilog2_u32_46706 __ilog2_u32 0 46706 NULL
119034 +erst_dbg_write_46715 erst_dbg_write 3 46715 NULL
119035 +wl1271_rx_filter_alloc_field_46721 wl1271_rx_filter_alloc_field 5 46721 NULL
119036 +irq_domain_add_simple_46734 irq_domain_add_simple 2 46734 NULL
119037 +read_file_tx99_46741 read_file_tx99 3 46741 NULL
119038 +ext4_count_free_46754 ext4_count_free 2 46754 NULL
119039 +hest_ghes_dev_register_46766 hest_ghes_dev_register 1 46766 NULL
119040 +int_hw_irq_en_46776 int_hw_irq_en 3 46776 NULL
119041 +_xfs_buf_get_pages_46811 _xfs_buf_get_pages 2 46811 NULL
119042 +xfs_iroot_realloc_46826 xfs_iroot_realloc 2 46826 NULL
119043 +readreg_46845 readreg 0 46845 NULL
119044 +spi_async_46857 spi_async 0 46857 NULL
119045 +SyS_move_pages_46863 SyS_move_pages 2 46863 NULL nohasharray
119046 +vsnprintf_46863 vsnprintf 0 46863 &SyS_move_pages_46863
119047 +nvme_alloc_queue_46865 nvme_alloc_queue 3 46865 NULL
119048 +qp_memcpy_from_queue_iov_46874 qp_memcpy_from_queue_iov 5-4 46874 NULL
119049 +lov_iocontrol_46876 lov_iocontrol 3 46876 NULL
119050 +ixgbe_dbg_reg_ops_write_46895 ixgbe_dbg_reg_ops_write 3 46895 NULL
119051 +sk_mem_pages_46896 sk_mem_pages 0-1 46896 NULL
119052 +ieee80211_if_fmt_power_mode_46906 ieee80211_if_fmt_power_mode 3 46906 NULL
119053 +wlcore_alloc_hw_46917 wlcore_alloc_hw 1-3 46917 NULL
119054 +fb_write_46924 fb_write 3 46924 NULL
119055 +__sctp_setsockopt_connectx_46949 __sctp_setsockopt_connectx 3 46949 NULL
119056 +qla4xxx_post_aen_work_46953 qla4xxx_post_aen_work 3 46953 NULL nohasharray
119057 +ntfs_truncate_46953 ntfs_truncate 0 46953 &qla4xxx_post_aen_work_46953
119058 +SYSC_poll_46965 SYSC_poll 2 46965 NULL
119059 +crypto_tfm_alg_alignmask_46971 crypto_tfm_alg_alignmask 0 46971 NULL
119060 +mgmt_pending_add_46976 mgmt_pending_add 5 46976 NULL
119061 +strlcat_46985 strlcat 3 46985 NULL
119062 +bitmap_file_clear_bit_46990 bitmap_file_clear_bit 2 46990 NULL
119063 +sel_write_bool_46996 sel_write_bool 3 46996 NULL
119064 +blk_rq_map_kern_47004 blk_rq_map_kern 4 47004 NULL
119065 +cx231xx_init_bulk_47024 cx231xx_init_bulk 3-2-4 47024 NULL
119066 +fs_path_len_47060 fs_path_len 0 47060 NULL
119067 +event_trigger_regex_write_47067 event_trigger_regex_write 3 47067 NULL
119068 +ext4_xattr_list_entries_47070 ext4_xattr_list_entries 0 47070 NULL
119069 +pipeline_dec_packet_in_read_47076 pipeline_dec_packet_in_read 3 47076 NULL
119070 +scsi_deactivate_tcq_47086 scsi_deactivate_tcq 2 47086 NULL
119071 +iwl_dump_nic_event_log_47089 iwl_dump_nic_event_log 0 47089 NULL
119072 +ptlrpc_lprocfs_threads_max_seq_write_47104 ptlrpc_lprocfs_threads_max_seq_write 3 47104 NULL
119073 +mousedev_read_47123 mousedev_read 3 47123 NULL
119074 +upcall_msg_size_47141 upcall_msg_size 2 47141 NULL
119075 +acpi_ut_initialize_buffer_47143 acpi_ut_initialize_buffer 2 47143 NULL nohasharray
119076 +ses_recv_diag_47143 ses_recv_diag 4 47143 &acpi_ut_initialize_buffer_47143
119077 +mxms_headerlen_47161 mxms_headerlen 0 47161 NULL
119078 +rs_sta_dbgfs_rate_scale_data_read_47165 rs_sta_dbgfs_rate_scale_data_read 3 47165 NULL
119079 +rts51x_ms_rw_47171 rts51x_ms_rw 3-4 47171 NULL
119080 +xfs_btree_get_buf_block_47197 xfs_btree_get_buf_block 0 47197 NULL
119081 +options_write_47243 options_write 3 47243 NULL
119082 +portcntrs_1_read_47253 portcntrs_1_read 3 47253 NULL
119083 +ablkcipher_next_slow_47274 ablkcipher_next_slow 4-3 47274 NULL
119084 +gfs2_readpages_47285 gfs2_readpages 4 47285 NULL
119085 +vsnprintf_47291 vsnprintf 0 47291 NULL
119086 +tx_internal_desc_overflow_read_47300 tx_internal_desc_overflow_read 3 47300 NULL
119087 +xfs_trans_reserve_quota_nblks_47313 xfs_trans_reserve_quota_nblks 0 47313 NULL
119088 +nouveau_fb_create__47316 nouveau_fb_create_ 4 47316 NULL
119089 +ieee80211_if_read_dot11MeshHoldingTimeout_47356 ieee80211_if_read_dot11MeshHoldingTimeout 3 47356 NULL
119090 +gfs2_replay_read_block_47357 gfs2_replay_read_block 0 47357 NULL
119091 +avc_get_hash_stats_47359 avc_get_hash_stats 0 47359 NULL
119092 +kvm_arch_create_memslot_47364 kvm_arch_create_memslot 3 47364 NULL nohasharray
119093 +__output_copy_user_47364 __output_copy_user 3 47364 &kvm_arch_create_memslot_47364
119094 +__bio_map_kern_47379 __bio_map_kern 3 47379 NULL
119095 +trace_options_core_read_47390 trace_options_core_read 3 47390 NULL nohasharray
119096 +nv_rd32_47390 nv_rd32 0 47390 &trace_options_core_read_47390
119097 +nametbl_list_47391 nametbl_list 2 47391 NULL
119098 +dgrp_net_write_47392 dgrp_net_write 3 47392 NULL
119099 +pfkey_sendmsg_47394 pfkey_sendmsg 4 47394 NULL
119100 +lbs_wrmac_write_47400 lbs_wrmac_write 3 47400 NULL
119101 +sta_vht_capa_read_47409 sta_vht_capa_read 3 47409 NULL
119102 +crypto_ablkcipher_alignmask_47410 crypto_ablkcipher_alignmask 0 47410 NULL
119103 +lbs_wrrf_write_47418 lbs_wrrf_write 3 47418 NULL
119104 +nvme_trans_send_fw_cmd_47479 nvme_trans_send_fw_cmd 4 47479 NULL
119105 +newpart_47485 newpart 6-4 47485 NULL
119106 +core_sys_select_47494 core_sys_select 1 47494 NULL
119107 +unlink_simple_47506 unlink_simple 3 47506 NULL
119108 +pstore_decompress_47510 pstore_decompress 0 47510 NULL
119109 +__proc_lnet_portal_rotor_47529 __proc_lnet_portal_rotor 5 47529 NULL
119110 +process_vm_rw_47533 process_vm_rw 3-5 47533 NULL nohasharray
119111 +vscnprintf_47533 vscnprintf 0-2 47533 &process_vm_rw_47533
119112 +einj_check_trigger_header_47534 einj_check_trigger_header 0 47534 NULL
119113 +ieee80211_if_fmt_min_discovery_timeout_47539 ieee80211_if_fmt_min_discovery_timeout 3 47539 NULL
119114 +read_ldt_47570 read_ldt 2 47570 NULL
119115 +isku_sysfs_read_last_set_47572 isku_sysfs_read_last_set 6 47572 NULL
119116 +btrfs_stack_header_bytenr_47589 btrfs_stack_header_bytenr 0 47589 NULL
119117 +ext4_kvzalloc_47605 ext4_kvzalloc 1 47605 NULL
119118 +sctp_ssnmap_new_47608 sctp_ssnmap_new 2-1 47608 NULL
119119 +cache_read_pipefs_47615 cache_read_pipefs 3 47615 NULL
119120 +twl4030_clear_set_47624 twl4030_clear_set 4 47624 NULL
119121 +ccp_sha_setkey_47633 ccp_sha_setkey 3 47633 NULL
119122 +get_size_47644 get_size 1-2 47644 NULL
119123 +packet_recvmsg_47700 packet_recvmsg 4 47700 NULL nohasharray
119124 +ipath_format_hwmsg_47700 ipath_format_hwmsg 2 47700 &packet_recvmsg_47700
119125 +save_microcode_47717 save_microcode 3 47717 NULL
119126 +bits_to_user_47733 bits_to_user 2-3 47733 NULL
119127 +carl9170_debugfs_read_47738 carl9170_debugfs_read 3 47738 NULL
119128 +ir_prepare_write_buffer_47747 ir_prepare_write_buffer 3 47747 NULL
119129 +mvumi_alloc_mem_resource_47750 mvumi_alloc_mem_resource 3 47750 NULL
119130 +alloc_sched_domains_47756 alloc_sched_domains 1 47756 NULL
119131 +uwb_ie_dump_hex_47774 uwb_ie_dump_hex 4 47774 NULL
119132 +SyS_setgroups16_47780 SyS_setgroups16 1 47780 NULL
119133 +error_error_numll_frame_cts_start_read_47781 error_error_numll_frame_cts_start_read 3 47781 NULL
119134 +posix_acl_fix_xattr_from_user_47793 posix_acl_fix_xattr_from_user 2 47793 NULL
119135 +W6692_empty_Bfifo_47804 W6692_empty_Bfifo 2 47804 NULL
119136 +lov_packmd_47810 lov_packmd 0 47810 NULL
119137 +tree_mod_log_insert_move_47823 tree_mod_log_insert_move 5 47823 NULL
119138 +pinconf_dbg_config_write_47835 pinconf_dbg_config_write 3 47835 NULL
119139 +KEY_SIZE_47855 KEY_SIZE 0 47855 NULL
119140 +vhci_read_47878 vhci_read 3 47878 NULL
119141 +keyctl_instantiate_key_common_47889 keyctl_instantiate_key_common 4 47889 NULL
119142 +cfs_percpt_alloc_47918 cfs_percpt_alloc 2 47918 NULL
119143 +comedi_write_47926 comedi_write 3 47926 NULL
119144 +nvme_trans_get_blk_desc_len_47946 nvme_trans_get_blk_desc_len 0-2 47946 NULL
119145 +gether_get_ifname_47972 gether_get_ifname 3 47972 NULL
119146 +mempool_resize_47983 mempool_resize 2 47983 NULL nohasharray
119147 +iwl_dbgfs_ucode_tracing_read_47983 iwl_dbgfs_ucode_tracing_read 3 47983 &mempool_resize_47983
119148 +dbg_port_buf_47990 dbg_port_buf 2 47990 NULL
119149 +ib_umad_write_47993 ib_umad_write 3 47993 NULL
119150 +lustre_cfg_len_48002 lustre_cfg_len 0 48002 NULL
119151 +gdm_tty_recv_complete_48011 gdm_tty_recv_complete 2 48011 NULL
119152 +ffs_epfile_write_48014 ffs_epfile_write 3 48014 NULL
119153 +bio_integrity_set_tag_48035 bio_integrity_set_tag 3 48035 NULL
119154 +pppoe_sendmsg_48039 pppoe_sendmsg 4 48039 NULL
119155 +SYSC_writev_48040 SYSC_writev 3 48040 NULL
119156 +wpan_phy_alloc_48056 wpan_phy_alloc 1 48056 NULL
119157 +posix_acl_alloc_48063 posix_acl_alloc 1 48063 NULL
119158 +palmas_bulk_write_48068 palmas_bulk_write 2-3-5 48068 NULL
119159 +disc_write_48070 disc_write 3 48070 NULL
119160 +mmc_alloc_host_48097 mmc_alloc_host 1 48097 NULL
119161 +xfs_read_agi_48100 xfs_read_agi 0 48100 NULL
119162 +skb_copy_datagram_const_iovec_48102 skb_copy_datagram_const_iovec 4-2-5 48102 NULL
119163 +vmw_framebuffer_surface_dirty_48132 vmw_framebuffer_surface_dirty 6 48132 NULL
119164 +set_discoverable_48141 set_discoverable 4 48141 NULL
119165 +dn_fib_count_nhs_48145 dn_fib_count_nhs 0 48145 NULL
119166 +_add_to_r4w_48152 _add_to_r4w 4 48152 NULL
119167 +isr_dma1_done_read_48159 isr_dma1_done_read 3 48159 NULL
119168 +c4iw_id_table_alloc_48163 c4iw_id_table_alloc 3 48163 NULL
119169 +rbd_obj_method_sync_48170 rbd_obj_method_sync 8 48170 NULL
119170 +alloc_cc770dev_48186 alloc_cc770dev 1 48186 NULL
119171 +cfg80211_process_deauth_48200 cfg80211_process_deauth 3 48200 NULL
119172 +ext4_index_trans_blocks_48205 ext4_index_trans_blocks 0-2 48205 NULL
119173 +snd_seq_dump_var_event_48209 snd_seq_dump_var_event 0 48209 NULL
119174 +ll_direct_IO_26_48216 ll_direct_IO_26 4 48216 NULL
119175 +uv_blade_nr_possible_cpus_48226 uv_blade_nr_possible_cpus 0 48226 NULL
119176 +nilfs_readpages_48229 nilfs_readpages 4 48229 NULL
119177 +read_file_recv_48232 read_file_recv 3 48232 NULL
119178 +unaccount_shadowed_48233 unaccount_shadowed 2 48233 NULL
119179 +nouveau_i2c_port_create__48240 nouveau_i2c_port_create_ 7 48240 NULL
119180 +nfsctl_transaction_read_48250 nfsctl_transaction_read 3 48250 NULL
119181 +batadv_socket_read_48257 batadv_socket_read 3 48257 NULL
119182 +cache_write_pipefs_48270 cache_write_pipefs 3 48270 NULL
119183 +trace_options_write_48275 trace_options_write 3 48275 NULL
119184 +send_set_info_48288 send_set_info 7 48288 NULL
119185 +lpfc_idiag_extacc_read_48301 lpfc_idiag_extacc_read 3 48301 NULL
119186 +timblogiw_read_48305 timblogiw_read 3 48305 NULL
119187 +hash_setkey_48310 hash_setkey 3 48310 NULL
119188 +kvm_mmu_pte_write_48340 kvm_mmu_pte_write 2 48340 NULL
119189 +skb_add_data_48363 skb_add_data 3 48363 NULL
119190 +tx_frag_init_called_read_48377 tx_frag_init_called_read 3 48377 NULL
119191 +lbs_debugfs_write_48413 lbs_debugfs_write 3 48413 NULL
119192 +uhid_event_from_user_48417 uhid_event_from_user 2 48417 NULL
119193 +div64_u64_rem_48418 div64_u64_rem 0-1-2 48418 NULL
119194 +pwr_tx_without_ps_read_48423 pwr_tx_without_ps_read 3 48423 NULL
119195 +print_filtered_48442 print_filtered 2-0 48442 NULL
119196 +tun_recvmsg_48463 tun_recvmsg 4 48463 NULL
119197 +compat_SyS_preadv64_48469 compat_SyS_preadv64 3 48469 NULL
119198 +ipath_format_hwerrors_48487 ipath_format_hwerrors 5 48487 NULL
119199 +r8712_usbctrl_vendorreq_48489 r8712_usbctrl_vendorreq 6 48489 NULL
119200 +send_control_msg_48498 send_control_msg 6 48498 NULL
119201 +count_masked_bytes_48507 count_masked_bytes 0-1 48507 NULL
119202 +diva_os_copy_to_user_48508 diva_os_copy_to_user 4 48508 NULL
119203 +brcmf_sdio_trap_info_48510 brcmf_sdio_trap_info 4 48510 NULL
119204 +phantom_get_free_48514 phantom_get_free 0 48514 NULL
119205 +drbd_bm_capacity_48530 drbd_bm_capacity 0 48530 NULL
119206 +raid10_size_48571 raid10_size 0-2-3 48571 NULL
119207 +llog_data_len_48607 llog_data_len 1 48607 NULL
119208 +do_ip_vs_set_ctl_48641 do_ip_vs_set_ctl 4 48641 NULL
119209 +ll_rw_extents_stats_pp_seq_write_48651 ll_rw_extents_stats_pp_seq_write 3 48651 NULL
119210 +mtd_read_48655 mtd_read 0 48655 NULL
119211 +aes_encrypt_packets_read_48666 aes_encrypt_packets_read 3 48666 NULL
119212 +sm501_create_subdev_48668 sm501_create_subdev 3-4 48668 NULL
119213 +security_inode_setattr_48689 security_inode_setattr 0 48689 NULL
119214 +hysdn_log_write_48694 hysdn_log_write 3 48694 NULL
119215 +altera_drscan_48698 altera_drscan 2 48698 NULL
119216 +kvm_set_irq_routing_48704 kvm_set_irq_routing 3 48704 NULL
119217 +recv_msg_48709 recv_msg 4 48709 NULL
119218 +lpfc_idiag_drbacc_write_48712 lpfc_idiag_drbacc_write 3 48712 NULL
119219 +SyS_lgetxattr_48719 SyS_lgetxattr 4 48719 NULL
119220 +ath6kl_usb_bmi_read_48745 ath6kl_usb_bmi_read 3 48745 NULL
119221 +ath6kl_regwrite_read_48747 ath6kl_regwrite_read 3 48747 NULL
119222 +l2cap_segment_sdu_48772 l2cap_segment_sdu 4 48772 NULL
119223 +gfs2_direct_IO_48774 gfs2_direct_IO 4 48774 NULL
119224 +il3945_sta_dbgfs_stats_table_read_48802 il3945_sta_dbgfs_stats_table_read 3 48802 NULL
119225 +twa_change_queue_depth_48808 twa_change_queue_depth 2 48808 NULL
119226 +atomic_counters_read_48827 atomic_counters_read 3 48827 NULL
119227 +azx_get_position_48841 azx_get_position 0 48841 NULL
119228 +vc_do_resize_48842 vc_do_resize 3-4 48842 NULL
119229 +comedi_buf_write_alloc_48846 comedi_buf_write_alloc 0-2 48846 NULL
119230 +suspend_dtim_interval_write_48854 suspend_dtim_interval_write 3 48854 NULL
119231 +C_SYSC_pwritev64_48864 C_SYSC_pwritev64 3 48864 NULL nohasharray
119232 +viafb_dvp1_proc_write_48864 viafb_dvp1_proc_write 3 48864 &C_SYSC_pwritev64_48864
119233 +__ffs_ep0_read_events_48868 __ffs_ep0_read_events 3 48868 NULL
119234 +crypto_cipher_ctxsize_48890 crypto_cipher_ctxsize 0 48890 NULL
119235 +joydev_handle_JSIOCSAXMAP_48898 joydev_handle_JSIOCSAXMAP 3 48898 NULL
119236 +xdi_copy_to_user_48900 xdi_copy_to_user 4 48900 NULL
119237 +msg_hdr_sz_48908 msg_hdr_sz 0 48908 NULL
119238 +sep_crypto_dma_48937 sep_crypto_dma 0 48937 NULL
119239 +si5351_write_parameters_48940 si5351_write_parameters 2 48940 NULL
119240 +event_heart_beat_read_48961 event_heart_beat_read 3 48961 NULL
119241 +nand_ecc_test_run_48966 nand_ecc_test_run 1 48966 NULL
119242 +vmci_handle_arr_create_48971 vmci_handle_arr_create 1 48971 NULL
119243 +xfs_trans_commit_48982 xfs_trans_commit 0 48982 NULL
119244 +gfs2_dir_add_48987 gfs2_dir_add 0 48987 NULL
119245 +rds_rm_size_48996 rds_rm_size 0-2 48996 NULL
119246 +sel_write_enforce_48998 sel_write_enforce 3 48998 NULL
119247 +null_alloc_rs_49019 null_alloc_rs 2 49019 NULL
119248 +filemap_check_errors_49022 filemap_check_errors 0 49022 NULL
119249 +transient_status_49027 transient_status 4 49027 NULL
119250 +ll_xattr_cache_add_49032 ll_xattr_cache_add 4-0 49032 NULL
119251 +iwl_mvm_power_legacy_dbgfs_read_49038 iwl_mvm_power_legacy_dbgfs_read 4 49038 NULL
119252 +scsi_register_49094 scsi_register 2 49094 NULL
119253 +compat_do_readv_writev_49102 compat_do_readv_writev 4 49102 NULL
119254 +gfs2_diradd_alloc_required_49105 gfs2_diradd_alloc_required 0 49105 NULL
119255 +xfrm_replay_state_esn_len_49119 xfrm_replay_state_esn_len 0 49119 NULL
119256 +ll_max_cached_mb_seq_write_49122 ll_max_cached_mb_seq_write 3 49122 NULL
119257 +pt_read_49136 pt_read 3 49136 NULL
119258 +ipwireless_tty_received_49154 ipwireless_tty_received 3 49154 NULL
119259 +f2fs_acl_count_49155 f2fs_acl_count 0-1 49155 NULL
119260 +ipw_queue_tx_init_49161 ipw_queue_tx_init 3 49161 NULL
119261 +__jfs_setxattr_49175 __jfs_setxattr 5 49175 NULL
119262 +ath6kl_bgscan_int_write_49178 ath6kl_bgscan_int_write 3 49178 NULL
119263 +dvb_dvr_ioctl_49182 dvb_dvr_ioctl 2 49182 NULL
119264 +print_queue_49191 print_queue 4-0 49191 NULL
119265 +root_nfs_cat_49192 root_nfs_cat 3 49192 NULL
119266 +iwl_dbgfs_ucode_general_stats_read_49199 iwl_dbgfs_ucode_general_stats_read 3 49199 NULL
119267 +il4965_rs_sta_dbgfs_stats_table_read_49206 il4965_rs_sta_dbgfs_stats_table_read 3 49206 NULL
119268 +do_jffs2_getxattr_49210 do_jffs2_getxattr 0 49210 NULL
119269 +nouveau_therm_create__49228 nouveau_therm_create_ 4 49228 NULL
119270 +ieee80211_if_read_rssi_threshold_49260 ieee80211_if_read_rssi_threshold 3 49260 NULL
119271 +isku_sysfs_read_keys_media_49268 isku_sysfs_read_keys_media 6 49268 NULL
119272 +ptlrpc_check_set_49277 ptlrpc_check_set 0 49277 NULL
119273 +rx_filter_beacon_filter_read_49279 rx_filter_beacon_filter_read 3 49279 NULL
119274 +viafb_dfph_proc_write_49288 viafb_dfph_proc_write 3 49288 NULL
119275 +uio_read_49300 uio_read 3 49300 NULL
119276 +isku_sysfs_read_keys_macro_49312 isku_sysfs_read_keys_macro 6 49312 NULL
119277 +SYSC_mincore_49319 SYSC_mincore 2-1 49319 NULL
119278 +fwtty_port_handler_49327 fwtty_port_handler 9 49327 NULL
119279 +srpt_alloc_ioctx_ring_49330 srpt_alloc_ioctx_ring 2-4-3 49330 NULL
119280 +joydev_ioctl_common_49359 joydev_ioctl_common 2 49359 NULL
119281 +iscsi_alloc_session_49390 iscsi_alloc_session 3 49390 NULL
119282 +ext4_ext_index_trans_blocks_49396 ext4_ext_index_trans_blocks 0 49396 NULL
119283 +rx_streaming_always_read_49401 rx_streaming_always_read 3 49401 NULL
119284 +tnode_alloc_49407 tnode_alloc 1 49407 NULL
119285 +samples_to_bytes_49426 samples_to_bytes 0-2 49426 NULL
119286 +compat_do_msg_fill_49440 compat_do_msg_fill 3 49440 NULL
119287 +__hfsplus_getxattr_49460 __hfsplus_getxattr 0 49460 NULL
119288 +agp_3_5_isochronous_node_enable_49465 agp_3_5_isochronous_node_enable 3 49465 NULL
119289 +xfs_iformat_local_49472 xfs_iformat_local 4-0 49472 NULL
119290 +isr_decrypt_done_read_49490 isr_decrypt_done_read 3 49490 NULL
119291 +iwl_dbgfs_disable_power_off_read_49517 iwl_dbgfs_disable_power_off_read 3 49517 NULL
119292 +SyS_listxattr_49519 SyS_listxattr 3 49519 NULL
119293 +emulator_write_phys_49520 emulator_write_phys 2-4 49520 NULL
119294 +smk_write_access_49561 smk_write_access 3 49561 NULL
119295 +alloc_chunk_49575 alloc_chunk 1 49575 NULL
119296 +sctp_setsockopt_default_send_param_49578 sctp_setsockopt_default_send_param 3 49578 NULL
119297 +readfifo_49583 readfifo 1 49583 NULL
119298 +gfs2_quota_lock_49587 gfs2_quota_lock 0 49587 NULL
119299 +evm_inode_setattr_49594 evm_inode_setattr 0 49594 NULL
119300 +tap_write_49595 tap_write 3 49595 NULL
119301 +isr_wakeups_read_49607 isr_wakeups_read 3 49607 NULL
119302 +btrfs_mksubvol_49616 btrfs_mksubvol 3 49616 NULL
119303 +heap_init_49617 heap_init 2 49617 NULL
119304 +smk_write_doi_49621 smk_write_doi 3 49621 NULL
119305 +port_fops_read_49626 port_fops_read 3 49626 NULL
119306 +btrfsic_cmp_log_and_dev_bytenr_49628 btrfsic_cmp_log_and_dev_bytenr 2 49628 NULL
119307 +xfs_ialloc_get_rec_49648 xfs_ialloc_get_rec 0 49648 NULL
119308 +aa_simple_write_to_buffer_49683 aa_simple_write_to_buffer 4-3 49683 NULL
119309 +SyS_pwritev_49688 SyS_pwritev 3 49688 NULL
119310 +__copy_from_user_nocheck_49699 __copy_from_user_nocheck 0-3 49699 NULL
119311 +cx2341x_ctrl_new_menu_49700 cx2341x_ctrl_new_menu 3 49700 NULL
119312 +write_pool_49718 write_pool 3 49718 NULL
119313 +kvm_mmu_notifier_invalidate_page_49723 kvm_mmu_notifier_invalidate_page 3 49723 NULL
119314 +sep_create_dcb_dmatables_context_kernel_49728 sep_create_dcb_dmatables_context_kernel 6 49728 NULL
119315 +zd_usb_iowrite16v_49744 zd_usb_iowrite16v 3 49744 NULL
119316 +btrfs_chunk_num_stripes_49751 btrfs_chunk_num_stripes 0 49751 NULL
119317 +fuse_wr_pages_49753 fuse_wr_pages 0-1-2 49753 NULL
119318 +key_conf_keylen_read_49758 key_conf_keylen_read 3 49758 NULL
119319 +fuse_conn_waiting_read_49762 fuse_conn_waiting_read 3 49762 NULL
119320 +w83977af_fir_interrupt_49775 w83977af_fir_interrupt 0 49775 NULL
119321 +ceph_osdc_readpages_49789 ceph_osdc_readpages 0 49789 NULL
119322 +nfs4_acl_new_49806 nfs4_acl_new 1 49806 NULL
119323 +ntfs_copy_from_user_iovec_49829 ntfs_copy_from_user_iovec 3-6-0 49829 NULL
119324 +add_uuid_49831 add_uuid 4 49831 NULL
119325 +iraw_loop_49842 iraw_loop 0-1 49842 NULL
119326 +twl4030_write_49846 twl4030_write 2 49846 NULL
119327 +scsi_dispatch_cmd_entry_49848 scsi_dispatch_cmd_entry 3 49848 NULL
119328 +timeradd_entry_49850 timeradd_entry 3 49850 NULL
119329 +fiemap_count_to_size_49869 fiemap_count_to_size 0-1 49869 NULL
119330 +sctp_setsockopt_bindx_49870 sctp_setsockopt_bindx 3 49870 NULL
119331 +osc_brw_49896 osc_brw 4 49896 NULL
119332 +config_ep_by_speed_49939 config_ep_by_speed 0 49939 NULL
119333 +xfs_ialloc_ag_alloc_49960 xfs_ialloc_ag_alloc 0 49960 NULL
119334 +ieee80211_if_fmt_dtim_count_49987 ieee80211_if_fmt_dtim_count 3 49987 NULL
119335 +drm_buffer_copy_from_user_49990 drm_buffer_copy_from_user 3 49990 NULL
119336 +l2cap_chan_send_49995 l2cap_chan_send 3 49995 NULL
119337 +dn_mss_from_pmtu_50011 dn_mss_from_pmtu 0-2 50011 NULL
119338 +xfs_ialloc_inode_init_50015 xfs_ialloc_inode_init 0 50015 NULL
119339 +security_context_to_sid_50019 security_context_to_sid 2 50019 NULL
119340 +isdn_read_50021 isdn_read 3 50021 NULL
119341 +mdc_rename_pack_50023 mdc_rename_pack 4-6 50023 NULL
119342 +brcmf_debugfs_chipinfo_read_50033 brcmf_debugfs_chipinfo_read 3 50033 NULL
119343 +ioread8_50049 ioread8 0 50049 NULL
119344 +fuse_conn_max_background_write_50061 fuse_conn_max_background_write 3 50061 NULL
119345 +__kfifo_dma_in_prepare_50081 __kfifo_dma_in_prepare 4 50081 NULL
119346 +dev_set_alias_50084 dev_set_alias 3 50084 NULL
119347 +libcfs_ioctl_popdata_50087 libcfs_ioctl_popdata 3 50087 NULL
119348 +sock_setsockopt_50088 sock_setsockopt 5 50088 NULL
119349 +altera_swap_dr_50090 altera_swap_dr 2 50090 NULL
119350 +android_set_cntry_50100 android_set_cntry 0 50100 NULL
119351 +read_file_slot_50111 read_file_slot 3 50111 NULL
119352 +rx_streaming_interval_write_50120 rx_streaming_interval_write 3 50120 NULL
119353 +jfs_direct_IO_50125 jfs_direct_IO 4 50125 NULL
119354 +SYSC_preadv_50134 SYSC_preadv 3 50134 NULL
119355 +tx_frag_need_fragmentation_read_50153 tx_frag_need_fragmentation_read 3 50153 NULL
119356 +xfs_bwrite_50154 xfs_bwrite 0 50154 NULL
119357 +kmalloc_node_50163 kmalloc_node 1 50163 NULL
119358 +rx_filter_ibss_filter_read_50167 rx_filter_ibss_filter_read 3 50167 NULL
119359 +ahd_probe_stack_size_50168 ahd_probe_stack_size 0 50168 NULL
119360 +odev_update_50169 odev_update 2 50169 NULL
119361 +ubi_resize_volume_50172 ubi_resize_volume 2 50172 NULL nohasharray
119362 +ieee80211_if_fmt_dot11MeshHWMPRannInterval_50172 ieee80211_if_fmt_dot11MeshHWMPRannInterval 3 50172 &ubi_resize_volume_50172
119363 +cfg80211_roamed_bss_50198 cfg80211_roamed_bss 4-6 50198 NULL
119364 +cyttsp4_probe_50201 cyttsp4_probe 4 50201 NULL
119365 +rx_rx_timeout_wa_read_50204 rx_rx_timeout_wa_read 3 50204 NULL
119366 +mthca_buddy_init_50206 mthca_buddy_init 2 50206 NULL
119367 +l2cap_sock_setsockopt_50207 l2cap_sock_setsockopt 5 50207 NULL
119368 +mon_bin_compat_ioctl_50234 mon_bin_compat_ioctl 3 50234 NULL
119369 +sg_kmalloc_50240 sg_kmalloc 1 50240 NULL
119370 +rxrpc_setsockopt_50286 rxrpc_setsockopt 5 50286 NULL
119371 +soc_codec_reg_show_50302 soc_codec_reg_show 0-3 50302 NULL
119372 +SYSC_flistxattr_50307 SYSC_flistxattr 3 50307 NULL
119373 +SYSC_sched_setaffinity_50310 SYSC_sched_setaffinity 2 50310 NULL
119374 +soc_camera_read_50319 soc_camera_read 3 50319 NULL
119375 +do_launder_page_50329 do_launder_page 0 50329 NULL
119376 +nouveau_engine_create__50331 nouveau_engine_create_ 7 50331 NULL
119377 +lpfc_idiag_pcicfg_read_50334 lpfc_idiag_pcicfg_read 3 50334 NULL
119378 +snd_pcm_lib_writev_50337 snd_pcm_lib_writev 0-3 50337 NULL
119379 +tpm_read_50344 tpm_read 3 50344 NULL
119380 +isdn_ppp_read_50356 isdn_ppp_read 4 50356 NULL
119381 +iwl_dbgfs_echo_test_write_50362 iwl_dbgfs_echo_test_write 3 50362 NULL
119382 +xfrm_send_migrate_50365 xfrm_send_migrate 5 50365 NULL
119383 +roccat_common2_receive_50369 roccat_common2_receive 4 50369 NULL
119384 +sl_alloc_bufs_50380 sl_alloc_bufs 2 50380 NULL
119385 +l2tp_ip_sendmsg_50411 l2tp_ip_sendmsg 4 50411 NULL
119386 +iscsi_create_conn_50425 iscsi_create_conn 2 50425 NULL
119387 +validate_acl_mac_addrs_50429 validate_acl_mac_addrs 0 50429 NULL
119388 +xfs_alloc_update_counters_50441 xfs_alloc_update_counters 0 50441 NULL
119389 +btrfs_error_discard_extent_50444 btrfs_error_discard_extent 2 50444 NULL
119390 +pgctrl_write_50453 pgctrl_write 3 50453 NULL
119391 +device_create_sys_dev_entry_50458 device_create_sys_dev_entry 0 50458 NULL
119392 +cfs_size_round_50472 cfs_size_round 0-1 50472 NULL
119393 +cdrom_read_cdda_50478 cdrom_read_cdda 4 50478 NULL
119394 +xfs_iformat_extents_50486 xfs_iformat_extents 0 50486 NULL
119395 +gfs2_block_map_50492 gfs2_block_map 0 50492 NULL
119396 +mei_io_cb_alloc_req_buf_50493 mei_io_cb_alloc_req_buf 2 50493 NULL
119397 +pwr_rcvd_awake_beacons_read_50505 pwr_rcvd_awake_beacons_read 3 50505 NULL
119398 +ath6kl_set_ap_probe_resp_ies_50539 ath6kl_set_ap_probe_resp_ies 3 50539 NULL
119399 +bh_get_50543 bh_get 0 50543 NULL
119400 +gfs2_meta_inode_buffer_50544 gfs2_meta_inode_buffer 0 50544 NULL
119401 +usbat_flash_write_data_50553 usbat_flash_write_data 4 50553 NULL
119402 +fat_readpages_50582 fat_readpages 4 50582 NULL
119403 +iwl_dbgfs_missed_beacon_read_50584 iwl_dbgfs_missed_beacon_read 3 50584 NULL
119404 +xillybus_write_50605 xillybus_write 3 50605 NULL
119405 +rx_rx_checksum_result_read_50617 rx_rx_checksum_result_read 3 50617 NULL
119406 +sparse_early_usemaps_alloc_node_50623 sparse_early_usemaps_alloc_node 4 50623 NULL
119407 +simple_transaction_get_50633 simple_transaction_get 3 50633 NULL
119408 +gfs2_unstuff_dinode_50644 gfs2_unstuff_dinode 0 50644 NULL
119409 +ath6kl_tm_rx_event_50664 ath6kl_tm_rx_event 3 50664 NULL
119410 +bnad_debugfs_read_50665 bnad_debugfs_read 3 50665 NULL
119411 +prism2_read_fid_reg_50689 prism2_read_fid_reg 0 50689 NULL
119412 +xfs_growfs_get_hdr_buf_50697 xfs_growfs_get_hdr_buf 3 50697 NULL
119413 +dev_mem_read_50706 dev_mem_read 3 50706 NULL
119414 +blk_check_plugged_50736 blk_check_plugged 3 50736 NULL
119415 +__ext3_get_inode_loc_50744 __ext3_get_inode_loc 0 50744 NULL
119416 +ocfs2_xattr_block_get_50773 ocfs2_xattr_block_get 0 50773 NULL
119417 +tm6000_read_write_usb_50774 tm6000_read_write_usb 7 50774 NULL
119418 +bio_alloc_map_data_50782 bio_alloc_map_data 2 50782 NULL
119419 +tpm_write_50798 tpm_write 3 50798 NULL
119420 +tun_do_read_50800 tun_do_read 4 50800 NULL
119421 +write_flush_50803 write_flush 3 50803 NULL
119422 +dvb_play_50814 dvb_play 3 50814 NULL
119423 +btrfs_stack_file_extent_disk_num_bytes_50825 btrfs_stack_file_extent_disk_num_bytes 0 50825 NULL
119424 +dpcm_show_state_50827 dpcm_show_state 0 50827 NULL
119425 +SetArea_50835 SetArea 4 50835 NULL
119426 +videobuf_dma_init_user_50839 videobuf_dma_init_user 4-3 50839 NULL
119427 +carl9170_debugfs_write_50857 carl9170_debugfs_write 3 50857 NULL
119428 +SyS_lgetxattr_50889 SyS_lgetxattr 4 50889 NULL
119429 +netlbl_secattr_catmap_walk_rng_50894 netlbl_secattr_catmap_walk_rng 0-2 50894 NULL
119430 +__bdev_writeseg_50903 __bdev_writeseg 4 50903 NULL
119431 +xfs_alloc_get_freelist_50906 xfs_alloc_get_freelist 0 50906 NULL
119432 +xfs_iext_remove_50909 xfs_iext_remove 3 50909 NULL
119433 +blk_rq_cur_sectors_50910 blk_rq_cur_sectors 0 50910 NULL
119434 +hash_recvmsg_50924 hash_recvmsg 4 50924 NULL
119435 +chd_dec_fetch_cdata_50926 chd_dec_fetch_cdata 3 50926 NULL
119436 +show_device_status_50947 show_device_status 0 50947 NULL
119437 +irq_timeout_write_50950 irq_timeout_write 3 50950 NULL
119438 +virtio_cread16_50951 virtio_cread16 0 50951 NULL
119439 +sdio_uart_write_50954 sdio_uart_write 3 50954 NULL
119440 +SyS_setxattr_50957 SyS_setxattr 4 50957 NULL
119441 +iwl_statistics_flag_50981 iwl_statistics_flag 0-3 50981 NULL
119442 +timeout_write_50991 timeout_write 3 50991 NULL
119443 +proc_write_51003 proc_write 3 51003 NULL
119444 +jbd2_journal_extend_51012 jbd2_journal_extend 2 51012 NULL
119445 +lbs_dev_info_51023 lbs_dev_info 3 51023 NULL
119446 +fuse_conn_congestion_threshold_read_51028 fuse_conn_congestion_threshold_read 3 51028 NULL
119447 +BcmGetSectionValEndOffset_51039 BcmGetSectionValEndOffset 0 51039 NULL
119448 +dump_midi_51040 dump_midi 3 51040 NULL
119449 +usb_get_descriptor_51041 usb_get_descriptor 0 51041 NULL
119450 +srpt_alloc_ioctx_51042 srpt_alloc_ioctx 2-3 51042 NULL
119451 +do_arpt_set_ctl_51053 do_arpt_set_ctl 4 51053 NULL
119452 +wusb_prf_64_51065 wusb_prf_64 7 51065 NULL
119453 +jbd2_journal_init_revoke_51088 jbd2_journal_init_revoke 2 51088 NULL
119454 +__ocfs2_find_path_51096 __ocfs2_find_path 0 51096 NULL
119455 +ti_recv_51110 ti_recv 3 51110 NULL
119456 +alloc_rtllib_51136 alloc_rtllib 1 51136 NULL
119457 +simple_xattr_set_51140 simple_xattr_set 4 51140 NULL
119458 +xfs_trans_get_efd_51148 xfs_trans_get_efd 3 51148 NULL
119459 +nf_ct_ext_create_51232 nf_ct_ext_create 3 51232 NULL
119460 +snd_pcm_write_51235 snd_pcm_write 3 51235 NULL
119461 +drm_property_create_51239 drm_property_create 4 51239 NULL
119462 +__mxt_read_reg_51249 __mxt_read_reg 0 51249 NULL
119463 +st_read_51251 st_read 3 51251 NULL
119464 +compat_dccp_setsockopt_51263 compat_dccp_setsockopt 5 51263 NULL
119465 +target_alloc_sgl_51264 target_alloc_sgl 3 51264 NULL
119466 +dvb_audio_write_51275 dvb_audio_write 3 51275 NULL
119467 +ipwireless_network_packet_received_51277 ipwireless_network_packet_received 4 51277 NULL
119468 +pvr2_std_id_to_str_51288 pvr2_std_id_to_str 2 51288 NULL
119469 +bnad_debugfs_read_regrd_51308 bnad_debugfs_read_regrd 3 51308 NULL
119470 +init_map_ipmac_51317 init_map_ipmac 5 51317 NULL
119471 +alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
119472 +ext2_xattr_get_51327 ext2_xattr_get 0 51327 NULL
119473 +alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
119474 +ipw_get_event_log_len_51341 ipw_get_event_log_len 0 51341 NULL
119475 +ieee80211_if_fmt_estab_plinks_51370 ieee80211_if_fmt_estab_plinks 3 51370 NULL
119476 +radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
119477 +blk_register_region_51424 blk_register_region 1-2 51424 NULL
119478 +mwifiex_rdeeprom_read_51429 mwifiex_rdeeprom_read 3 51429 NULL
119479 +hfsplus_brec_read_51436 hfsplus_brec_read 0 51436 NULL
119480 +xfs_mod_incore_sb_unlocked_51439 xfs_mod_incore_sb_unlocked 0 51439 NULL
119481 +ieee80211_if_read_dot11MeshHWMPRootMode_51441 ieee80211_if_read_dot11MeshHWMPRootMode 3 51441 NULL
119482 +print_devstats_dot11ACKFailureCount_51443 print_devstats_dot11ACKFailureCount 3 51443 NULL
119483 +____alloc_ei_netdev_51475 ____alloc_ei_netdev 1 51475 NULL
119484 +xfs_buf_get_uncached_51477 xfs_buf_get_uncached 2 51477 NULL
119485 +kvm_fetch_guest_virt_51493 kvm_fetch_guest_virt 4-2 51493 NULL
119486 +ieee80211_if_write_uapsd_queues_51526 ieee80211_if_write_uapsd_queues 3 51526 NULL
119487 +__alloc_eip_netdev_51549 __alloc_eip_netdev 1 51549 NULL
119488 +batadv_tt_prepare_tvlv_local_data_51568 batadv_tt_prepare_tvlv_local_data 0 51568 NULL
119489 +ixgb_get_eeprom_len_51586 ixgb_get_eeprom_len 0 51586 NULL
119490 +aac_convert_sgraw2_51598 aac_convert_sgraw2 4 51598 NULL
119491 +table_size_to_number_of_entries_51613 table_size_to_number_of_entries 0-1 51613 NULL
119492 +extent_fiemap_51621 extent_fiemap 3 51621 NULL
119493 +sctp_auth_create_key_51641 sctp_auth_create_key 1 51641 NULL
119494 +iscsi_create_session_51647 iscsi_create_session 3 51647 NULL
119495 +xfs_iformat_btree_51651 xfs_iformat_btree 0 51651 NULL
119496 +ps_upsd_utilization_read_51669 ps_upsd_utilization_read 3 51669 NULL
119497 +sctp_setsockopt_associnfo_51684 sctp_setsockopt_associnfo 3 51684 NULL
119498 +host_mapping_level_51696 host_mapping_level 0 51696 NULL
119499 +sel_write_access_51704 sel_write_access 3 51704 NULL
119500 +tty_cdev_add_51714 tty_cdev_add 2-4 51714 NULL
119501 +v9fs_alloc_rdir_buf_51716 v9fs_alloc_rdir_buf 2 51716 NULL
119502 +drm_compat_ioctl_51717 drm_compat_ioctl 2 51717 NULL
119503 +sg_read_oxfer_51724 sg_read_oxfer 3 51724 NULL
119504 +cm4040_read_51732 cm4040_read 3 51732 NULL
119505 +get_user_pages_fast_51751 get_user_pages_fast 0 51751 NULL
119506 +ifx_spi_insert_flip_string_51752 ifx_spi_insert_flip_string 3 51752 NULL
119507 +if_write_51756 if_write 3 51756 NULL
119508 +qib_alloc_devdata_51819 qib_alloc_devdata 2 51819 NULL
119509 +buffer_from_user_51826 buffer_from_user 3 51826 NULL
119510 +ioread32_51847 ioread32 0 51847 NULL nohasharray
119511 +read_file_tgt_tx_stats_51847 read_file_tgt_tx_stats 3 51847 &ioread32_51847
119512 +do_readv_writev_51849 do_readv_writev 4 51849 NULL
119513 +SYSC_sendto_51852 SYSC_sendto 6 51852 NULL
119514 +bm_page_io_async_51858 bm_page_io_async 2 51858 NULL
119515 +pointer_size_read_51863 pointer_size_read 3 51863 NULL
119516 +get_indirect_ea_51869 get_indirect_ea 4 51869 NULL
119517 +user_read_51881 user_read 3 51881 NULL
119518 +dbAdjCtl_51888 dbAdjCtl 0 51888 NULL
119519 +SyS_mq_timedsend_51896 SyS_mq_timedsend 3 51896 NULL
119520 +wmi_set_ie_51919 wmi_set_ie 3 51919 NULL
119521 +dbg_status_buf_51930 dbg_status_buf 2 51930 NULL
119522 +__tcp_mtu_to_mss_51938 __tcp_mtu_to_mss 0-2 51938 NULL
119523 +xfrm_alg_len_51940 xfrm_alg_len 0 51940 NULL
119524 +scsi_get_vpd_page_51951 scsi_get_vpd_page 4 51951 NULL
119525 +snd_mask_min_51969 snd_mask_min 0 51969 NULL
119526 +__blkdev_get_51972 __blkdev_get 0 51972 NULL
119527 +get_zone_51981 get_zone 0-1 51981 NULL
119528 +cifs_strict_writev_51984 cifs_strict_writev 4 51984 NULL
119529 +ath6kl_sdio_alloc_prep_scat_req_51986 ath6kl_sdio_alloc_prep_scat_req 2 51986 NULL
119530 +_c4iw_write_mem_dma_51991 _c4iw_write_mem_dma 3 51991 NULL
119531 +dwc3_mode_write_51997 dwc3_mode_write 3 51997 NULL
119532 +skb_copy_datagram_from_iovec_52014 skb_copy_datagram_from_iovec 4-2-5 52014 NULL
119533 +rdmalt_52022 rdmalt 0 52022 NULL
119534 +override_release_52032 override_release 2 52032 NULL
119535 +end_port_52042 end_port 0 52042 NULL
119536 +dma_rx_errors_read_52045 dma_rx_errors_read 3 52045 NULL
119537 +msnd_fifo_write_52052 msnd_fifo_write 0-3 52052 NULL
119538 +dvb_ringbuffer_avail_52057 dvb_ringbuffer_avail 0 52057 NULL
119539 +__fuse_request_alloc_52060 __fuse_request_alloc 1 52060 NULL
119540 +isofs_readpages_52067 isofs_readpages 4 52067 NULL
119541 +mxuport_process_read_urb_data_52072 mxuport_process_read_urb_data 3 52072 NULL
119542 +nsm_get_handle_52089 nsm_get_handle 4 52089 NULL
119543 +ulist_add_merge_52096 ulist_add_merge 0 52096 NULL
119544 +o2net_debug_read_52105 o2net_debug_read 3 52105 NULL
119545 +split_scan_timeout_write_52128 split_scan_timeout_write 3 52128 NULL
119546 +retry_count_read_52129 retry_count_read 3 52129 NULL
119547 +xfs_btree_change_owner_52137 xfs_btree_change_owner 0 52137 NULL
119548 +gdm_usb_hci_send_52138 gdm_usb_hci_send 3 52138 NULL
119549 +sub_alloc_52140 sub_alloc 0 52140 NULL
119550 +hysdn_conf_write_52145 hysdn_conf_write 3 52145 NULL
119551 +htable_size_52148 htable_size 0-1 52148 NULL
119552 +gfs2_rs_alloc_52152 gfs2_rs_alloc 0 52152 NULL
119553 +smk_write_load2_52155 smk_write_load2 3 52155 NULL
119554 +ieee80211_if_read_dot11MeshRetryTimeout_52168 ieee80211_if_read_dot11MeshRetryTimeout 3 52168 NULL
119555 +mga_compat_ioctl_52170 mga_compat_ioctl 2 52170 NULL
119556 +print_prefix_52176 print_prefix 0 52176 NULL
119557 +proc_pid_readlink_52186 proc_pid_readlink 3 52186 NULL
119558 +reiserfs_posix_acl_from_disk_52191 reiserfs_posix_acl_from_disk 2 52191 NULL
119559 +vmci_qp_broker_alloc_52216 vmci_qp_broker_alloc 6-5 52216 NULL
119560 +fuse_request_alloc_52243 fuse_request_alloc 1 52243 NULL nohasharray
119561 +xfs_iomap_eof_align_last_fsb_52243 xfs_iomap_eof_align_last_fsb 0 52243 &fuse_request_alloc_52243
119562 +mdiobus_alloc_size_52259 mdiobus_alloc_size 1 52259 NULL
119563 +shrink_slab_52261 shrink_slab 2 52261 NULL
119564 +sisusbcon_do_font_op_52271 sisusbcon_do_font_op 9 52271 NULL
119565 +handle_supp_msgs_52284 handle_supp_msgs 4 52284 NULL
119566 +kobject_set_name_vargs_52309 kobject_set_name_vargs 0 52309 NULL
119567 +read_file_reset_52310 read_file_reset 3 52310 NULL
119568 +request_asymmetric_key_52317 request_asymmetric_key 2-4 52317 NULL
119569 +hwflags_read_52318 hwflags_read 3 52318 NULL
119570 +test_unaligned_bulk_52333 test_unaligned_bulk 3 52333 NULL
119571 +hur_len_52339 hur_len 0 52339 NULL
119572 +bytes_to_frames_52362 bytes_to_frames 0-2 52362 NULL nohasharray
119573 +cap_inode_killpriv_52362 cap_inode_killpriv 0 52362 &bytes_to_frames_52362
119574 +copy_entries_to_user_52367 copy_entries_to_user 1 52367 NULL
119575 +iwl_dump_fh_52371 iwl_dump_fh 0 52371 NULL
119576 +hfsplus_find_attr_52374 hfsplus_find_attr 0 52374 NULL
119577 +mq_emit_config_values_52378 mq_emit_config_values 3 52378 NULL
119578 +isdn_writebuf_stub_52383 isdn_writebuf_stub 4 52383 NULL
119579 +jfs_setxattr_52389 jfs_setxattr 4 52389 NULL
119580 +aer_inject_write_52399 aer_inject_write 3 52399 NULL
119581 +cgroup_file_write_52417 cgroup_file_write 3 52417 NULL
119582 +line6_midibuf_init_52425 line6_midibuf_init 2 52425 NULL
119583 +hso_serial_common_create_52428 hso_serial_common_create 4 52428 NULL
119584 +delay_status_52431 delay_status 5 52431 NULL
119585 +ath6kl_delete_qos_write_52435 ath6kl_delete_qos_write 3 52435 NULL
119586 +ieee80211_if_fmt_num_sta_ps_52438 ieee80211_if_fmt_num_sta_ps 3 52438 NULL
119587 +acpi_nvs_for_each_region_52448 acpi_nvs_for_each_region 0 52448 NULL
119588 +alauda_read_data_52452 alauda_read_data 3 52452 NULL
119589 +ieee80211_alloc_txb_52477 ieee80211_alloc_txb 1 52477 NULL
119590 +usb_tranzport_write_52479 usb_tranzport_write 3 52479 NULL
119591 +ocfs2_extend_no_holes_52483 ocfs2_extend_no_holes 3-4 52483 NULL
119592 +fd_do_rw_52495 fd_do_rw 3 52495 NULL
119593 +int_tasklet_entry_52500 int_tasklet_entry 3 52500 NULL
119594 +xfs_alloc_get_rec_52502 xfs_alloc_get_rec 0 52502 NULL
119595 +lmv_get_easize_52504 lmv_get_easize 0 52504 NULL
119596 +pm_qos_power_write_52513 pm_qos_power_write 3 52513 NULL
119597 +bt_sock_stream_recvmsg_52518 bt_sock_stream_recvmsg 4 52518 NULL
119598 +dup_variable_bug_52525 dup_variable_bug 3 52525 NULL
119599 +raw_recvmsg_52529 raw_recvmsg 4 52529 NULL
119600 +dccpprobe_read_52549 dccpprobe_read 3 52549 NULL
119601 +ntfs_prepare_pages_for_non_resident_write_52556 ntfs_prepare_pages_for_non_resident_write 0 52556 NULL
119602 +debug_level_proc_write_52572 debug_level_proc_write 3 52572 NULL
119603 +kernfs_setattr_52583 kernfs_setattr 0 52583 NULL
119604 +isku_sysfs_read_macro_52587 isku_sysfs_read_macro 6 52587 NULL
119605 +SyS_setsockopt_52610 SyS_setsockopt 5 52610 NULL
119606 +ll_sa_entry_alloc_52611 ll_sa_entry_alloc 4 52611 NULL
119607 +tps80031_writes_52638 tps80031_writes 3-4 52638 NULL
119608 +brcmf_sdio_assert_info_52653 brcmf_sdio_assert_info 4 52653 NULL
119609 +nvme_queue_extra_52661 nvme_queue_extra 0-1 52661 NULL
119610 +SYSC_gethostname_52677 SYSC_gethostname 2 52677 NULL
119611 +nvd0_disp_pioc_create__52693 nvd0_disp_pioc_create_ 5 52693 NULL
119612 +nouveau_client_create__52715 nouveau_client_create_ 5 52715 NULL
119613 +__dm_stat_bio_52722 __dm_stat_bio 3 52722 NULL
119614 +cx25840_ir_rx_read_52724 cx25840_ir_rx_read 3 52724 NULL
119615 +blkcipher_next_slow_52733 blkcipher_next_slow 3-4 52733 NULL
119616 +relay_alloc_page_array_52735 relay_alloc_page_array 1 52735 NULL
119617 +hfcsusb_rx_frame_52745 hfcsusb_rx_frame 3 52745 NULL
119618 +carl9170_debugfs_vif_dump_read_52755 carl9170_debugfs_vif_dump_read 3 52755 NULL
119619 +ieee80211_if_read_beacon_timeout_52756 ieee80211_if_read_beacon_timeout 3 52756 NULL
119620 +nvme_trans_ext_inq_page_52776 nvme_trans_ext_inq_page 3 52776 NULL
119621 +pwr_rcvd_beacons_read_52836 pwr_rcvd_beacons_read 3 52836 NULL
119622 +lb_alloc_ep_req_52837 lb_alloc_ep_req 2 52837 NULL
119623 +mon_bin_get_event_52863 mon_bin_get_event 4-6 52863 NULL
119624 +twl6030_gpadc_write_52867 twl6030_gpadc_write 1 52867 NULL
119625 +qib_decode_6120_err_52876 qib_decode_6120_err 3 52876 NULL
119626 +twlreg_write_52880 twlreg_write 3 52880 NULL
119627 +pvr2_ctrl_value_to_sym_internal_52881 pvr2_ctrl_value_to_sym_internal 5 52881 NULL
119628 +cache_read_procfs_52882 cache_read_procfs 3 52882 NULL
119629 +kvm_kvzalloc_52894 kvm_kvzalloc 1 52894 NULL
119630 +dio_bio_reap_52913 dio_bio_reap 0 52913 NULL
119631 +__kfifo_out_peek_r_52919 __kfifo_out_peek_r 3 52919 NULL
119632 +iblock_get_bio_52936 iblock_get_bio 3 52936 NULL
119633 +__nodes_remap_52951 __nodes_remap 5 52951 NULL
119634 +send_packet_52960 send_packet 4 52960 NULL
119635 +ieee80211_if_fmt_fwded_mcast_52961 ieee80211_if_fmt_fwded_mcast 3 52961 NULL
119636 +tx_tx_exch_read_52986 tx_tx_exch_read 3 52986 NULL
119637 +num_node_state_52989 num_node_state 0 52989 NULL
119638 +btrfs_free_and_pin_reserved_extent_53016 btrfs_free_and_pin_reserved_extent 2 53016 NULL
119639 +tx_tx_exch_pending_read_53018 tx_tx_exch_pending_read 3 53018 NULL
119640 +xfs_rtfree_extent_53024 xfs_rtfree_extent 0 53024 NULL
119641 +bio_cur_bytes_53037 bio_cur_bytes 0 53037 NULL
119642 +regcache_lzo_block_count_53056 regcache_lzo_block_count 0 53056 NULL
119643 +cfi_read_query_53066 cfi_read_query 0 53066 NULL
119644 +iwl_dbgfs_interrupt_write_53069 iwl_dbgfs_interrupt_write 3 53069 NULL
119645 +mwifiex_debug_read_53074 mwifiex_debug_read 3 53074 NULL
119646 +mic_virtio_copy_from_user_53107 mic_virtio_copy_from_user 3 53107 NULL
119647 +verity_status_53120 verity_status 5 53120 NULL
119648 +brcmf_usb_dl_cmd_53130 brcmf_usb_dl_cmd 4 53130 NULL
119649 +inode_newsize_ok_53140 inode_newsize_ok 0 53140 NULL nohasharray
119650 +ps_poll_ps_poll_max_ap_turn_read_53140 ps_poll_ps_poll_max_ap_turn_read 3 53140 &inode_newsize_ok_53140
119651 +ieee80211_bss_info_update_53170 ieee80211_bss_info_update 4 53170 NULL
119652 +btrfs_io_bio_alloc_53179 btrfs_io_bio_alloc 2 53179 NULL
119653 +find_good_lh_53183 find_good_lh 0 53183 NULL
119654 +clear_capture_buf_53192 clear_capture_buf 2 53192 NULL
119655 +xfs_btree_updkey_53195 xfs_btree_updkey 0 53195 NULL
119656 +tx_tx_start_data_read_53219 tx_tx_start_data_read 3 53219 NULL
119657 +ptlrpc_lprocfs_req_history_max_seq_write_53243 ptlrpc_lprocfs_req_history_max_seq_write 3 53243 NULL
119658 +xfs_trans_read_buf_map_53258 xfs_trans_read_buf_map 5-0 53258 NULL
119659 +wil_write_file_ssid_53266 wil_write_file_ssid 3 53266 NULL
119660 +btrfs_file_extent_num_bytes_53269 btrfs_file_extent_num_bytes 0 53269 NULL
119661 +ftrace_profile_write_53327 ftrace_profile_write 3 53327 NULL
119662 +find_nr_power_limit_53330 find_nr_power_limit 0 53330 NULL
119663 +gsm_control_reply_53333 gsm_control_reply 4 53333 NULL
119664 +btree_keys_bytes_53348 btree_keys_bytes 0 53348 NULL
119665 +read_6120_creg32_53363 read_6120_creg32 0 53363 NULL
119666 +sock_setbindtodevice_53369 sock_setbindtodevice 3 53369 NULL
119667 +get_random_bytes_arch_53370 get_random_bytes_arch 2 53370 NULL
119668 +xfs_imap_53389 xfs_imap 0 53389 NULL
119669 +isr_cmd_cmplt_read_53439 isr_cmd_cmplt_read 3 53439 NULL
119670 +mwifiex_info_read_53447 mwifiex_info_read 3 53447 NULL
119671 +apei_exec_run_optional_53452 apei_exec_run_optional 0 53452 NULL
119672 +paging64_prefetch_gpte_53468 paging64_prefetch_gpte 4 53468 NULL
119673 +ima_write_template_field_data_53475 ima_write_template_field_data 2 53475 NULL nohasharray
119674 +create_trace_kprobe_53475 create_trace_kprobe 1 53475 &ima_write_template_field_data_53475
119675 +iowarrior_read_53483 iowarrior_read 3 53483 NULL
119676 +osd_req_write_kern_53486 osd_req_write_kern 5 53486 NULL
119677 +do_verify_xattr_datum_53499 do_verify_xattr_datum 0 53499 NULL
119678 +snd_pcm_format_physical_width_53505 snd_pcm_format_physical_width 0 53505 NULL
119679 +dbAllocNext_53506 dbAllocNext 0 53506 NULL
119680 +check_acl_53512 check_acl 0 53512 NULL
119681 +ll_xattr_cache_update_53515 ll_xattr_cache_update 4 53515 NULL
119682 +nft_data_dump_53549 nft_data_dump 5 53549 NULL
119683 +SYSC_bind_53582 SYSC_bind 3 53582 NULL
119684 +cifs_utf16_bytes_53593 cifs_utf16_bytes 0 53593 NULL
119685 +proc_uid_map_write_53596 proc_uid_map_write 3 53596 NULL
119686 +pfkey_recvmsg_53604 pfkey_recvmsg 4 53604 NULL
119687 +___alloc_bootmem_nopanic_53626 ___alloc_bootmem_nopanic 1 53626 NULL
119688 +xd_write_multiple_pages_53633 xd_write_multiple_pages 6-5 53633 NULL
119689 +ccid_getsockopt_builtin_ccids_53634 ccid_getsockopt_builtin_ccids 2 53634 NULL
119690 +nr_sendmsg_53656 nr_sendmsg 4 53656 NULL
119691 +fuse_fill_write_pages_53682 fuse_fill_write_pages 0-4 53682 NULL
119692 +v4l2_event_subscribe_53687 v4l2_event_subscribe 3 53687 NULL
119693 +bdev_logical_block_size_53690 bdev_logical_block_size 0 53690 NULL nohasharray
119694 +igb_alloc_q_vector_53690 igb_alloc_q_vector 4-6 53690 &bdev_logical_block_size_53690
119695 +find_overflow_devnum_53711 find_overflow_devnum 0 53711 NULL
119696 +__proc_debug_mb_53732 __proc_debug_mb 5 53732 NULL
119697 +wdm_write_53735 wdm_write 3 53735 NULL
119698 +amdtp_out_stream_get_max_payload_53755 amdtp_out_stream_get_max_payload 0 53755 NULL nohasharray
119699 +lpfc_idiag_queacc_read_qe_53755 lpfc_idiag_queacc_read_qe 0-2 53755 &amdtp_out_stream_get_max_payload_53755
119700 +wa_populate_buf_in_urb_53758 wa_populate_buf_in_urb 3-4 53758 NULL
119701 +ext2_acl_count_53773 ext2_acl_count 0-1 53773 NULL
119702 +__kfifo_dma_in_prepare_r_53792 __kfifo_dma_in_prepare_r 4-5 53792 NULL
119703 +qp_alloc_host_work_53798 qp_alloc_host_work 5-3 53798 NULL
119704 +regmap_raw_write_53803 regmap_raw_write 2-4 53803 NULL
119705 +lpfc_idiag_ctlacc_read_reg_53809 lpfc_idiag_ctlacc_read_reg 0-3 53809 NULL
119706 +nls_nullsize_53815 nls_nullsize 0 53815 NULL
119707 +setup_data_read_53822 setup_data_read 3 53822 NULL
119708 +pms_read_53873 pms_read 3 53873 NULL
119709 +ieee80211_if_fmt_dropped_frames_congestion_53883 ieee80211_if_fmt_dropped_frames_congestion 3 53883 NULL
119710 +SyS_setgroups_53900 SyS_setgroups 1 53900 NULL
119711 +posix_acl_chmod_53904 posix_acl_chmod 0 53904 NULL
119712 +batadv_tt_tvlv_ogm_handler_v1_53909 batadv_tt_tvlv_ogm_handler_v1 5 53909 NULL
119713 +usb_serial_generic_write_53927 usb_serial_generic_write 4 53927 NULL
119714 +ocfs2_make_clusters_writable_53938 ocfs2_make_clusters_writable 0 53938 NULL
119715 +idetape_chrdev_write_53976 idetape_chrdev_write 3 53976 NULL
119716 +__ocfs2_xattr_set_value_outside_53981 __ocfs2_xattr_set_value_outside 5 53981 NULL
119717 +ieee80211_if_fmt_dot11MeshHWMPperrMinInterval_53998 ieee80211_if_fmt_dot11MeshHWMPperrMinInterval 3 53998 NULL
119718 +hfsplus_attr_build_key_54013 hfsplus_attr_build_key 0 54013 NULL
119719 +snd_pcm_lib_write_transfer_54018 snd_pcm_lib_write_transfer 5-2-4 54018 NULL
119720 +mdc_kuc_write_54019 mdc_kuc_write 3 54019 NULL
119721 +ipxrtr_route_packet_54036 ipxrtr_route_packet 4 54036 NULL
119722 +batadv_tt_update_orig_54049 batadv_tt_update_orig 6-4 54049 NULL
119723 +pipeline_dec_packet_out_read_54052 pipeline_dec_packet_out_read 3 54052 NULL
119724 +nl80211_send_disconnected_54056 nl80211_send_disconnected 5 54056 NULL
119725 +rproc_state_read_54057 rproc_state_read 3 54057 NULL
119726 +_malloc_54077 _malloc 1 54077 NULL
119727 +bitmap_bitremap_54096 bitmap_bitremap 4 54096 NULL
119728 +altera_set_ir_pre_54103 altera_set_ir_pre 2 54103 NULL nohasharray
119729 +lustre_posix_acl_xattr_filter_54103 lustre_posix_acl_xattr_filter 2-0 54103 &altera_set_ir_pre_54103
119730 +__comedi_buf_write_alloc_54112 __comedi_buf_write_alloc 0-2 54112 NULL
119731 +strn_len_54122 strn_len 0 54122 NULL
119732 +isku_receive_54130 isku_receive 4 54130 NULL
119733 +isr_host_acknowledges_read_54136 isr_host_acknowledges_read 3 54136 NULL
119734 +irq_blk_threshold_write_54138 irq_blk_threshold_write 3 54138 NULL
119735 +memcpy_toiovec_54166 memcpy_toiovec 3 54166 NULL
119736 +nouveau_falcon_create__54169 nouveau_falcon_create_ 8 54169 NULL
119737 +p9_client_prepare_req_54175 p9_client_prepare_req 3 54175 NULL
119738 +do_sys_poll_54221 do_sys_poll 2 54221 NULL
119739 +__register_chrdev_54223 __register_chrdev 2-3 54223 NULL
119740 +pi_read_regr_54231 pi_read_regr 0 54231 NULL
119741 +reada_add_block_54247 reada_add_block 2 54247 NULL
119742 +xfs_dir2_sf_addname_hard_54254 xfs_dir2_sf_addname_hard 3 54254 NULL
119743 +ceph_msgpool_get_54258 ceph_msgpool_get 2 54258 NULL
119744 +audio_write_54261 audio_write 4 54261 NULL nohasharray
119745 +wusb_prf_54261 wusb_prf 7 54261 &audio_write_54261
119746 +mwifiex_getlog_read_54269 mwifiex_getlog_read 3 54269 NULL
119747 +kstrtou16_from_user_54274 kstrtou16_from_user 2 54274 NULL
119748 +tipc_multicast_54285 tipc_multicast 4 54285 NULL
119749 +altera_set_dr_post_54291 altera_set_dr_post 2 54291 NULL
119750 +dlm_alloc_pagevec_54296 dlm_alloc_pagevec 1 54296 NULL
119751 +reclaim_pages_54301 reclaim_pages 3 54301 NULL
119752 +sprintf_54306 sprintf 0 54306 NULL
119753 +bio_add_pc_page_54319 bio_add_pc_page 4 54319 NULL
119754 +br_fdb_fillbuf_54339 br_fdb_fillbuf 0 54339 NULL
119755 +__alloc_dev_table_54343 __alloc_dev_table 2 54343 NULL
119756 +__get_free_pages_54352 __get_free_pages 0 54352 NULL
119757 +read_file_credit_dist_stats_54367 read_file_credit_dist_stats 3 54367 NULL
119758 +vfs_readlink_54368 vfs_readlink 3 54368 NULL
119759 +do_dccp_setsockopt_54377 do_dccp_setsockopt 5 54377 NULL nohasharray
119760 +intel_sdvo_write_cmd_54377 intel_sdvo_write_cmd 4 54377 &do_dccp_setsockopt_54377
119761 +ah_alloc_tmp_54378 ah_alloc_tmp 3-2 54378 NULL
119762 +snd_pcm_oss_read2_54387 snd_pcm_oss_read2 3-0 54387 NULL
119763 +iwl_dbgfs_power_save_status_read_54392 iwl_dbgfs_power_save_status_read 3 54392 NULL
119764 +ll_ra_count_get_54410 ll_ra_count_get 3 54410 NULL
119765 +copy_gadget_strings_54417 copy_gadget_strings 2-3 54417 NULL
119766 +sparse_early_mem_maps_alloc_node_54485 sparse_early_mem_maps_alloc_node 4 54485 NULL
119767 +simple_strtoull_54493 simple_strtoull 0 54493 NULL
119768 +btrfs_ordered_sum_size_54509 btrfs_ordered_sum_size 0-2 54509 NULL
119769 +rfc4106_set_key_54519 rfc4106_set_key 3 54519 NULL
119770 +vmci_transport_dgram_enqueue_54525 vmci_transport_dgram_enqueue 4 54525 NULL
119771 +viacam_read_54526 viacam_read 3 54526 NULL
119772 +unix_dgram_connect_54535 unix_dgram_connect 3 54535 NULL
119773 +setsockopt_54539 setsockopt 5 54539 NULL
119774 +lbs_lowsnr_write_54549 lbs_lowsnr_write 3 54549 NULL
119775 +SYSC_setsockopt_54561 SYSC_setsockopt 5 54561 NULL
119776 +nfsd_vfs_write_54577 nfsd_vfs_write 6 54577 NULL
119777 +fw_iso_buffer_init_54582 fw_iso_buffer_init 3 54582 NULL
119778 +nvme_npages_54601 nvme_npages 0-1 54601 NULL
119779 +irq_pkt_threshold_write_54605 irq_pkt_threshold_write 3 54605 NULL
119780 +port_fops_write_54627 port_fops_write 3 54627 NULL
119781 +irq_timeout_read_54653 irq_timeout_read 3 54653 NULL
119782 +dns_resolver_read_54658 dns_resolver_read 3 54658 NULL
119783 +twl6030_interrupt_mask_54659 twl6030_interrupt_mask 2 54659 NULL
119784 +tdp_page_fault_54663 tdp_page_fault 2 54663 NULL
119785 +bus_add_device_54665 bus_add_device 0 54665 NULL
119786 +cw1200_queue_stats_init_54670 cw1200_queue_stats_init 2 54670 NULL
119787 +bio_kmalloc_54672 bio_kmalloc 2 54672 NULL
119788 +evm_read_key_54674 evm_read_key 3 54674 NULL
119789 +tipc_link_send_sections_fast_54689 tipc_link_send_sections_fast 3 54689 NULL
119790 +__btrfs_inc_extent_ref_54706 __btrfs_inc_extent_ref 7 54706 NULL
119791 +rfkill_fop_read_54711 rfkill_fop_read 3 54711 NULL
119792 +ocfs2_control_write_54737 ocfs2_control_write 3 54737 NULL
119793 +kzalloc_54740 kzalloc 1 54740 NULL
119794 +wep_iv_read_54744 wep_iv_read 3 54744 NULL
119795 +lpfc_idiag_pcicfg_write_54749 lpfc_idiag_pcicfg_write 3 54749 NULL
119796 +iio_event_chrdev_read_54757 iio_event_chrdev_read 3 54757 NULL
119797 +adis16480_show_firmware_date_54762 adis16480_show_firmware_date 3 54762 NULL
119798 +ldsem_atomic_update_54774 ldsem_atomic_update 1 54774 NULL
119799 +xfs_rtallocate_extent_block_54791 xfs_rtallocate_extent_block 0 54791 NULL
119800 +flexcop_device_kmalloc_54793 flexcop_device_kmalloc 1 54793 NULL
119801 +nfsd_write_54809 nfsd_write 6 54809 NULL
119802 +ar9287_dump_modal_eeprom_54814 ar9287_dump_modal_eeprom 3-2 54814 NULL
119803 +crypto_tfm_ctx_alignment_54815 crypto_tfm_ctx_alignment 0 54815 NULL nohasharray
119804 +kvzalloc_54815 kvzalloc 1 54815 &crypto_tfm_ctx_alignment_54815 nohasharray
119805 +aes_decrypt_fail_read_54815 aes_decrypt_fail_read 3 54815 &kvzalloc_54815
119806 +generic_perform_write_54832 generic_perform_write 3-0 54832 NULL
119807 +write_rio_54837 write_rio 3 54837 NULL
119808 +ext3_acl_from_disk_54839 ext3_acl_from_disk 2 54839 NULL nohasharray
119809 +nouveau_engctx_create__54839 nouveau_engctx_create_ 8 54839 &ext3_acl_from_disk_54839
119810 +ufx_ops_write_54848 ufx_ops_write 3 54848 NULL
119811 +printer_read_54851 printer_read 3 54851 NULL
119812 +broadsheet_spiflash_rewrite_sector_54864 broadsheet_spiflash_rewrite_sector 2 54864 NULL
119813 +prism_build_supp_rates_54865 prism_build_supp_rates 0 54865 NULL
119814 +xfs_alloc_read_agfl_54879 xfs_alloc_read_agfl 0 54879 NULL
119815 +iscsi_pool_init_54913 iscsi_pool_init 2-4 54913 NULL nohasharray
119816 +kobject_set_name_vargs_54913 kobject_set_name_vargs 0 54913 &iscsi_pool_init_54913
119817 +btrfs_stack_chunk_num_stripes_54923 btrfs_stack_chunk_num_stripes 0 54923 NULL
119818 +bio_add_page_54933 bio_add_page 0-3 54933 NULL
119819 +mxms_structlen_54939 mxms_structlen 0 54939 NULL
119820 +add_port_54941 add_port 2 54941 NULL
119821 +ath9k_dump_btcoex_54949 ath9k_dump_btcoex 3-0 54949 NULL
119822 +alauda_write_data_54967 alauda_write_data 3 54967 NULL
119823 +c4_add_card_54968 c4_add_card 3 54968 NULL
119824 +ext3_xattr_get_54989 ext3_xattr_get 0 54989 NULL
119825 +cx231xx_v4l2_read_55014 cx231xx_v4l2_read 3 55014 NULL
119826 +error_error_null_Frame_tx_start_read_55024 error_error_null_Frame_tx_start_read 3 55024 NULL
119827 +dgap_do_bios_load_55025 dgap_do_bios_load 3 55025 NULL
119828 +apei_exec_run_55075 apei_exec_run 0 55075 NULL
119829 +bitmap_storage_alloc_55077 bitmap_storage_alloc 2 55077 NULL
119830 +read_dma_55086 read_dma 3 55086 NULL
119831 +rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read_55106 rxpipe_beacon_buffer_thres_host_int_trig_rx_data_read 3 55106 NULL
119832 +crypto_ahash_setkey_55134 crypto_ahash_setkey 3 55134 NULL
119833 +filldir_55137 filldir 3 55137 NULL
119834 +ocfs2_truncate_file_55148 ocfs2_truncate_file 3 55148 NULL
119835 +xfs_check_agi_freecount_55149 xfs_check_agi_freecount 0 55149 NULL nohasharray
119836 +npages_to_npools_55149 npages_to_npools 0-1 55149 &xfs_check_agi_freecount_55149
119837 +ieee80211_if_read_uapsd_queues_55150 ieee80211_if_read_uapsd_queues 3 55150 NULL
119838 +xfs_icsb_modify_counters_55156 xfs_icsb_modify_counters 0 55156 NULL
119839 +gfs2_ri_update_55185 gfs2_ri_update 0 55185 NULL
119840 +mtd_get_fact_prot_info_55186 mtd_get_fact_prot_info 0 55186 NULL
119841 +sel_write_relabel_55195 sel_write_relabel 3 55195 NULL
119842 +sched_feat_write_55202 sched_feat_write 3 55202 NULL
119843 +ht40allow_map_read_55209 ht40allow_map_read 3 55209 NULL
119844 +__kfifo_dma_out_prepare_r_55211 __kfifo_dma_out_prepare_r 4-5 55211 NULL
119845 +do_raw_setsockopt_55215 do_raw_setsockopt 5 55215 NULL
119846 +qxl_alloc_client_monitors_config_55216 qxl_alloc_client_monitors_config 2 55216 NULL
119847 +nouveau_mc_create__55217 nouveau_mc_create_ 4 55217 NULL
119848 +dbAllocDmap_55227 dbAllocDmap 0 55227 NULL
119849 +memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
119850 +lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
119851 +persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
119852 +rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL
119853 +lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
119854 +gsm_control_modem_55303 gsm_control_modem 3 55303 NULL
119855 +wimax_msg_len_55304 wimax_msg_len 0 55304 NULL
119856 +qp_alloc_guest_work_55305 qp_alloc_guest_work 5-3 55305 NULL
119857 +__vxge_hw_vpath_initialize_55328 __vxge_hw_vpath_initialize 2 55328 NULL
119858 +vme_user_read_55338 vme_user_read 3 55338 NULL
119859 +__wa_xfer_setup_sizes_55342 __wa_xfer_setup_sizes 0 55342 NULL nohasharray
119860 +sctp_datamsg_from_user_55342 sctp_datamsg_from_user 4 55342 &__wa_xfer_setup_sizes_55342
119861 +tipc_send2name_55373 tipc_send2name 5 55373 NULL
119862 +cw1200_sdio_align_size_55391 cw1200_sdio_align_size 2 55391 NULL
119863 +iwl_dbgfs_plcp_delta_read_55407 iwl_dbgfs_plcp_delta_read 3 55407 NULL
119864 +sysfs_chmod_file_55408 sysfs_chmod_file 0 55408 NULL
119865 +si476x_radio_read_rds_blckcnt_blob_55427 si476x_radio_read_rds_blckcnt_blob 3 55427 NULL
119866 +__vxge_hw_channel_allocate_55462 __vxge_hw_channel_allocate 3 55462 NULL
119867 +cx23888_ir_rx_read_55473 cx23888_ir_rx_read 3 55473 NULL
119868 +snd_pcm_lib_write_55483 snd_pcm_lib_write 0-3 55483 NULL
119869 +i2o_pool_alloc_55485 i2o_pool_alloc 4 55485 NULL
119870 +batadv_tt_entries_55487 batadv_tt_entries 0-1 55487 NULL
119871 +ras_stride_increase_window_55501 ras_stride_increase_window 3 55501 NULL
119872 +tx_tx_done_int_template_read_55511 tx_tx_done_int_template_read 3 55511 NULL
119873 +xfs_btree_split_55515 xfs_btree_split 0 55515 NULL
119874 +ea_get_55522 ea_get 3-0 55522 NULL
119875 +buffer_size_55534 buffer_size 0 55534 NULL
119876 +set_msr_interception_55538 set_msr_interception 2 55538 NULL
119877 +tty_port_register_device_55543 tty_port_register_device 3 55543 NULL
119878 +dgap_do_config_load_55548 dgap_do_config_load 2 55548 NULL
119879 +hash_ipport6_expire_55549 hash_ipport6_expire 4 55549 NULL
119880 +dm_stats_list_55551 dm_stats_list 4 55551 NULL
119881 +add_partition_55588 add_partition 2 55588 NULL
119882 +kstrtou8_from_user_55599 kstrtou8_from_user 2 55599 NULL
119883 +SyS_keyctl_55602 SyS_keyctl 4 55602 NULL
119884 +macvtap_put_user_55609 macvtap_put_user 4 55609 NULL
119885 +selinux_setprocattr_55611 selinux_setprocattr 4 55611 NULL
119886 +edge_tty_recv_55622 edge_tty_recv 3 55622 NULL
119887 +pktgen_if_write_55628 pktgen_if_write 3 55628 NULL nohasharray
119888 +reiserfs_xattr_get_55628 reiserfs_xattr_get 0 55628 &pktgen_if_write_55628
119889 +osc_obd_max_pages_per_rpc_seq_write_55636 osc_obd_max_pages_per_rpc_seq_write 3 55636 NULL
119890 +xfs_bmbt_maxrecs_55649 xfs_bmbt_maxrecs 0-2 55649 NULL
119891 +lpfc_idiag_queinfo_read_55662 lpfc_idiag_queinfo_read 3 55662 NULL
119892 +il_dbgfs_tx_queue_read_55668 il_dbgfs_tx_queue_read 3 55668 NULL
119893 +get_info_55681 get_info 3 55681 NULL
119894 +iwl_dbgfs_plcp_delta_write_55682 iwl_dbgfs_plcp_delta_write 3 55682 NULL
119895 +genl_allocate_reserve_groups_55705 genl_allocate_reserve_groups 1 55705 NULL
119896 +pm8001_store_update_fw_55716 pm8001_store_update_fw 4 55716 NULL
119897 +ocfs2_lock_refcount_tree_55719 ocfs2_lock_refcount_tree 0 55719 NULL
119898 +tap_pwup_write_55723 tap_pwup_write 3 55723 NULL
119899 +__iio_allocate_kfifo_55738 __iio_allocate_kfifo 2 55738 NULL
119900 +set_local_name_55757 set_local_name 4 55757 NULL
119901 +strlen_55778 strlen 0 55778 NULL
119902 +set_spte_55783 set_spte 4-5 55783 NULL
119903 +req_bio_endio_55786 req_bio_endio 3 55786 NULL nohasharray
119904 +conf_read_55786 conf_read 3 55786 &req_bio_endio_55786
119905 +uwb_rc_neh_grok_event_55799 uwb_rc_neh_grok_event 3 55799 NULL
119906 +sb16_copy_from_user_55836 sb16_copy_from_user 10-6-7 55836 NULL
119907 +ip_hdrlen_55849 ip_hdrlen 0 55849 NULL
119908 +hcd_alloc_coherent_55862 hcd_alloc_coherent 5 55862 NULL
119909 +shmem_setxattr_55867 shmem_setxattr 4 55867 NULL
119910 +hsc_write_55875 hsc_write 3 55875 NULL
119911 +ramdisk_store_55885 ramdisk_store 4 55885 NULL
119912 +pm_qos_power_read_55891 pm_qos_power_read 3 55891 NULL
119913 +hash_ip4_expire_55911 hash_ip4_expire 4 55911 NULL
119914 +snd_pcm_hw_param_value_min_55917 snd_pcm_hw_param_value_min 0 55917 NULL
119915 +ext2_direct_IO_55932 ext2_direct_IO 4 55932 NULL
119916 +kvm_write_guest_virt_system_55944 kvm_write_guest_virt_system 4-2 55944 NULL
119917 +sel_read_policy_55947 sel_read_policy 3 55947 NULL
119918 +ceph_get_direct_page_vector_55956 ceph_get_direct_page_vector 2 55956 NULL
119919 +simple_read_from_buffer_55957 simple_read_from_buffer 2-5 55957 NULL
119920 +tx_tx_imm_resp_read_55964 tx_tx_imm_resp_read 3 55964 NULL
119921 +btrfs_clone_55977 btrfs_clone 5-3 55977 NULL
119922 +wa_xfer_create_subset_sg_55992 wa_xfer_create_subset_sg 3-2 55992 NULL
119923 +nvme_alloc_iod_56027 nvme_alloc_iod 1-2 56027 NULL
119924 +usb_ocp_write_56047 usb_ocp_write 4 56047 NULL
119925 +dccp_sendmsg_56058 dccp_sendmsg 4 56058 NULL
119926 +pscsi_get_bio_56103 pscsi_get_bio 1 56103 NULL
119927 +add_sysfs_param_56108 add_sysfs_param 0 56108 NULL
119928 +usb_alloc_stream_buffers_56123 usb_alloc_stream_buffers 3 56123 NULL
119929 +sel_read_handle_status_56139 sel_read_handle_status 3 56139 NULL
119930 +write_file_frameerrors_56145 write_file_frameerrors 3 56145 NULL
119931 +__i2c_transfer_56162 __i2c_transfer 0 56162 NULL
119932 +rawv6_setsockopt_56165 rawv6_setsockopt 5 56165 NULL
119933 +ath9k_dump_legacy_btcoex_56194 ath9k_dump_legacy_btcoex 3-0 56194 NULL
119934 +vring_add_indirect_56222 vring_add_indirect 4 56222 NULL
119935 +ocfs2_find_xe_in_bucket_56224 ocfs2_find_xe_in_bucket 0 56224 NULL
119936 +do_ipt_set_ctl_56238 do_ipt_set_ctl 4 56238 NULL
119937 +fd_copyin_56247 fd_copyin 3 56247 NULL
119938 +sk_rmem_schedule_56255 sk_rmem_schedule 3 56255 NULL
119939 +il4965_ucode_general_stats_read_56277 il4965_ucode_general_stats_read 3 56277 NULL
119940 +ieee80211_if_fmt_user_power_level_56283 ieee80211_if_fmt_user_power_level 3 56283 NULL
119941 +RESIZE_IF_NEEDED_56286 RESIZE_IF_NEEDED 2 56286 NULL
119942 +dvb_aplay_56296 dvb_aplay 3 56296 NULL
119943 +btmrvl_hscfgcmd_read_56303 btmrvl_hscfgcmd_read 3 56303 NULL
119944 +speakup_file_write_56310 speakup_file_write 3 56310 NULL
119945 +pipeline_pre_to_defrag_swi_read_56321 pipeline_pre_to_defrag_swi_read 3 56321 NULL
119946 +journal_init_revoke_table_56331 journal_init_revoke_table 1 56331 NULL
119947 +snd_rawmidi_read_56337 snd_rawmidi_read 3 56337 NULL
119948 +vxge_os_dma_malloc_async_56348 vxge_os_dma_malloc_async 3 56348 NULL
119949 +mite_device_bytes_transferred_56355 mite_device_bytes_transferred 0 56355 NULL
119950 +qd_get_56365 qd_get 0 56365 NULL
119951 +iov_iter_copy_from_user_atomic_56368 iov_iter_copy_from_user_atomic 4-0 56368 NULL
119952 +dev_read_56369 dev_read 3 56369 NULL
119953 +ath10k_read_simulate_fw_crash_56371 ath10k_read_simulate_fw_crash 3 56371 NULL
119954 +write_gssp_56404 write_gssp 3 56404 NULL
119955 +ocfs2_control_read_56405 ocfs2_control_read 3 56405 NULL
119956 +do_get_write_access_56410 do_get_write_access 0 56410 NULL
119957 +store_msg_56417 store_msg 3 56417 NULL
119958 +pppol2tp_sendmsg_56420 pppol2tp_sendmsg 4 56420 NULL
119959 +l2cap_segment_le_sdu_56426 l2cap_segment_le_sdu 4 56426 NULL
119960 +fl_create_56435 fl_create 5 56435 NULL
119961 +gnttab_map_56439 gnttab_map 2 56439 NULL
119962 +cx231xx_init_isoc_56453 cx231xx_init_isoc 3-2-4 56453 NULL
119963 +set_connectable_56458 set_connectable 4 56458 NULL
119964 +osd_req_list_partition_objects_56464 osd_req_list_partition_objects 5 56464 NULL
119965 +putused_user_56467 putused_user 3 56467 NULL
119966 +ocfs2_zero_extend_range_56468 ocfs2_zero_extend_range 3-2 56468 NULL
119967 +lbs_rdmac_write_56471 lbs_rdmac_write 3 56471 NULL
119968 +calc_linear_pos_56472 calc_linear_pos 0-3 56472 NULL
119969 +crypto_shash_alignmask_56486 crypto_shash_alignmask 0 56486 NULL
119970 +ieee80211_rx_mgmt_probe_beacon_56491 ieee80211_rx_mgmt_probe_beacon 3 56491 NULL
119971 +memblock_virt_alloc_56501 memblock_virt_alloc 1 56501 NULL
119972 +init_map_ip_56508 init_map_ip 5 56508 NULL
119973 +lustre_posix_acl_xattr_reduce_space_56512 lustre_posix_acl_xattr_reduce_space 3-0-2 56512 NULL
119974 +cfg80211_connect_result_56515 cfg80211_connect_result 4-6 56515 NULL
119975 +ip_options_get_56538 ip_options_get 4 56538 NULL
119976 +ll_wr_track_id_56544 ll_wr_track_id 2 56544 NULL
119977 +alloc_apertures_56561 alloc_apertures 1 56561 NULL
119978 +rs_sta_dbgfs_stats_table_read_56573 rs_sta_dbgfs_stats_table_read 3 56573 NULL
119979 +portcntrs_2_read_56586 portcntrs_2_read 3 56586 NULL
119980 +event_filter_write_56609 event_filter_write 3 56609 NULL
119981 +nvme_trans_log_temperature_56613 nvme_trans_log_temperature 3 56613 NULL
119982 +edac_device_create_block_56619 edac_device_create_block 0 56619 NULL
119983 +gather_array_56641 gather_array 3 56641 NULL
119984 +lookup_extent_backref_56644 lookup_extent_backref 9 56644 NULL
119985 +uvc_debugfs_stats_read_56651 uvc_debugfs_stats_read 3 56651 NULL
119986 +tg3_nvram_write_block_56666 tg3_nvram_write_block 3 56666 NULL
119987 +snd_gus_dram_read_56686 snd_gus_dram_read 4 56686 NULL
119988 +dvb_ringbuffer_read_user_56702 dvb_ringbuffer_read_user 3-0 56702 NULL
119989 +sta_flags_read_56710 sta_flags_read 3 56710 NULL
119990 +ipv6_getsockopt_sticky_56711 ipv6_getsockopt_sticky 5 56711 NULL
119991 +xfs_btree_decrement_56718 xfs_btree_decrement 0 56718 NULL
119992 +__wa_xfer_setup_segs_56725 __wa_xfer_setup_segs 2 56725 NULL
119993 +__copy_from_user_ll_56738 __copy_from_user_ll 0-3 56738 NULL
119994 +drm_agp_bind_pages_56748 drm_agp_bind_pages 3 56748 NULL
119995 +btrfsic_map_block_56751 btrfsic_map_block 2 56751 NULL
119996 +ttm_alloc_new_pages_56792 ttm_alloc_new_pages 5 56792 NULL
119997 +ion_ioctl_56806 ion_ioctl 2 56806 NULL
119998 +do_syslog_56807 do_syslog 3 56807 NULL
119999 +mtdchar_write_56831 mtdchar_write 3 56831 NULL
120000 +snd_rawmidi_kernel_write1_56847 snd_rawmidi_kernel_write1 4-0 56847 NULL
120001 +si476x_radio_read_agc_blob_56849 si476x_radio_read_agc_blob 3 56849 NULL
120002 +ext3_xattr_ibody_get_56880 ext3_xattr_ibody_get 0 56880 NULL
120003 +pvr2_debugifc_print_status_56890 pvr2_debugifc_print_status 3 56890 NULL
120004 +debug_debug3_read_56894 debug_debug3_read 3 56894 NULL
120005 +batadv_tt_update_changes_56895 batadv_tt_update_changes 3 56895 NULL
120006 +hfsplus_find_cat_56899 hfsplus_find_cat 0 56899 NULL
120007 +strcspn_56913 strcspn 0 56913 NULL
120008 +__kfifo_out_56927 __kfifo_out 0-3 56927 NULL
120009 +journal_init_revoke_56933 journal_init_revoke 2 56933 NULL
120010 +xfs_alloc_ag_vextent_56943 xfs_alloc_ag_vextent 0 56943 NULL
120011 +nouveau_xtensa_create__56952 nouveau_xtensa_create_ 8 56952 NULL
120012 +diva_get_driver_info_56967 diva_get_driver_info 0 56967 NULL
120013 +nouveau_device_create__56984 nouveau_device_create_ 6 56984 NULL
120014 +sptlrpc_secflags2str_56995 sptlrpc_secflags2str 3 56995 NULL
120015 +vlsi_alloc_ring_57003 vlsi_alloc_ring 3-4 57003 NULL
120016 +btrfs_super_csum_size_57004 btrfs_super_csum_size 0 57004 NULL
120017 +aircable_process_packet_57027 aircable_process_packet 4 57027 NULL
120018 +ieee80211_if_fmt_state_57043 ieee80211_if_fmt_state 3 57043 NULL nohasharray
120019 +skb_network_offset_57043 skb_network_offset 0 57043 &ieee80211_if_fmt_state_57043
120020 +bytes_to_samples_57049 bytes_to_samples 0-2 57049 NULL
120021 +xfs_buf_read_map_57053 xfs_buf_read_map 3 57053 NULL
120022 +cx2341x_ctrl_new_std_57061 cx2341x_ctrl_new_std 4 57061 NULL
120023 +sca3000_read_data_57064 sca3000_read_data 4 57064 NULL
120024 +pcmcia_replace_cis_57066 pcmcia_replace_cis 3 57066 NULL
120025 +tracing_set_trace_write_57096 tracing_set_trace_write 3 57096 NULL
120026 +altera_get_note_57099 altera_get_note 6 57099 NULL
120027 +hpfs_readpages_57106 hpfs_readpages 4 57106 NULL
120028 +crypto_compress_ctxsize_57109 crypto_compress_ctxsize 0 57109 NULL
120029 +cipso_v4_gentag_loc_57119 cipso_v4_gentag_loc 0 57119 NULL
120030 +rds_ib_sub_signaled_57136 rds_ib_sub_signaled 2 57136 NULL nohasharray
120031 +nl80211_send_deauth_57136 nl80211_send_deauth 4 57136 &rds_ib_sub_signaled_57136 nohasharray
120032 +ima_show_htable_value_57136 ima_show_htable_value 2 57136 &nl80211_send_deauth_57136
120033 +snd_sonicvibes_getdmac_57140 snd_sonicvibes_getdmac 0 57140 NULL
120034 +_iwl_dbgfs_bf_params_write_57141 _iwl_dbgfs_bf_params_write 3 57141 NULL
120035 +udl_prime_create_57159 udl_prime_create 2 57159 NULL
120036 +stk_prepare_sio_buffers_57168 stk_prepare_sio_buffers 2 57168 NULL
120037 +rx_hw_stuck_read_57179 rx_hw_stuck_read 3 57179 NULL
120038 +hash_netnet6_expire_57191 hash_netnet6_expire 4 57191 NULL
120039 +tt3650_ci_msg_57219 tt3650_ci_msg 4 57219 NULL
120040 +dma_fifo_alloc_57236 dma_fifo_alloc 5-3-2 57236 NULL
120041 +flush_space_57241 flush_space 0 57241 NULL
120042 +rsxx_cram_write_57244 rsxx_cram_write 3 57244 NULL
120043 +ieee80211_if_fmt_tsf_57249 ieee80211_if_fmt_tsf 3 57249 NULL
120044 +oprofilefs_ulong_from_user_57251 oprofilefs_ulong_from_user 3 57251 NULL
120045 +alloc_flex_gd_57259 alloc_flex_gd 1 57259 NULL
120046 +lbs_sleepparams_write_57283 lbs_sleepparams_write 3 57283 NULL
120047 +pstore_file_read_57288 pstore_file_read 3 57288 NULL
120048 +snd_pcm_read_57289 snd_pcm_read 3 57289 NULL
120049 +ftdi_elan_write_57309 ftdi_elan_write 3 57309 NULL
120050 +xfs_iread_57313 xfs_iread 0 57313 NULL nohasharray
120051 +write_file_regval_57313 write_file_regval 3 57313 &xfs_iread_57313
120052 +__mxt_write_reg_57326 __mxt_write_reg 3 57326 NULL
120053 +usblp_read_57342 usblp_read 3 57342 NULL
120054 +print_devstats_dot11RTSFailureCount_57347 print_devstats_dot11RTSFailureCount 3 57347 NULL
120055 +dio_send_cur_page_57348 dio_send_cur_page 0 57348 NULL
120056 +tipc_bclink_stats_57372 tipc_bclink_stats 2 57372 NULL
120057 +tty_register_device_attr_57381 tty_register_device_attr 2 57381 NULL
120058 +read_file_blob_57406 read_file_blob 3 57406 NULL
120059 +enclosure_register_57412 enclosure_register 3 57412 NULL
120060 +compat_keyctl_instantiate_key_iov_57431 compat_keyctl_instantiate_key_iov 3 57431 NULL
120061 +copy_to_user_fromio_57432 copy_to_user_fromio 3 57432 NULL
120062 +__roundup_pow_of_two_57461 __roundup_pow_of_two 0 57461 NULL
120063 +sisusb_clear_vram_57466 sisusb_clear_vram 2-3 57466 NULL
120064 +ieee80211_if_read_flags_57470 ieee80211_if_read_flags 3 57470 NULL
120065 +tipc_port_reject_sections_57478 tipc_port_reject_sections 4 57478 NULL
120066 +bnad_debugfs_write_regwr_57500 bnad_debugfs_write_regwr 3 57500 NULL
120067 +skb_headlen_57501 skb_headlen 0 57501 NULL
120068 +copy_in_user_57502 copy_in_user 3 57502 NULL
120069 +ckhdid_printf_57505 ckhdid_printf 2 57505 NULL nohasharray
120070 +gfs2_quota_hold_57505 gfs2_quota_hold 0 57505 &ckhdid_printf_57505
120071 +init_tag_map_57515 init_tag_map 3 57515 NULL
120072 +il_dbgfs_force_reset_read_57517 il_dbgfs_force_reset_read 3 57517 NULL nohasharray
120073 +wil_read_file_ssid_57517 wil_read_file_ssid 3 57517 &il_dbgfs_force_reset_read_57517
120074 +cmm_read_57520 cmm_read 3 57520 NULL
120075 +inode_permission_57531 inode_permission 0 57531 NULL
120076 +acpi_dev_get_resources_57534 acpi_dev_get_resources 0 57534 NULL
120077 +ptlrpc_lprocfs_hp_ratio_seq_write_57537 ptlrpc_lprocfs_hp_ratio_seq_write 3 57537 NULL
120078 +ReadHDLCPnP_57559 ReadHDLCPnP 0 57559 NULL
120079 +obd_unpackmd_57563 obd_unpackmd 0 57563 NULL
120080 +snd_pcm_playback_ioctl1_57569 snd_pcm_playback_ioctl1 0 57569 NULL
120081 +get_bridge_ifindices_57579 get_bridge_ifindices 0 57579 NULL
120082 +ldlm_cli_enqueue_local_57582 ldlm_cli_enqueue_local 11 57582 NULL
120083 +il_dbgfs_interrupt_write_57591 il_dbgfs_interrupt_write 3 57591 NULL
120084 +read_file_spectral_fft_period_57593 read_file_spectral_fft_period 3 57593 NULL
120085 +tx_tx_retry_template_read_57623 tx_tx_retry_template_read 3 57623 NULL
120086 +sisusbcon_putcs_57630 sisusbcon_putcs 3 57630 NULL
120087 +mem_read_57631 mem_read 3 57631 NULL
120088 +xfs_alloc_ag_vextent_near_57653 xfs_alloc_ag_vextent_near 0 57653 NULL
120089 +r3964_write_57662 r3964_write 4 57662 NULL
120090 +proc_ns_readlink_57664 proc_ns_readlink 3 57664 NULL
120091 +__lgwrite_57669 __lgwrite 4 57669 NULL
120092 +f1x_match_to_this_node_57695 f1x_match_to_this_node 3 57695 NULL
120093 +i2400m_rx_stats_read_57706 i2400m_rx_stats_read 3 57706 NULL
120094 +ieee80211_if_read_dot11MeshHWMPconfirmationInterval_57722 ieee80211_if_read_dot11MeshHWMPconfirmationInterval 3 57722 NULL
120095 +nouveau_gpio_create__57735 nouveau_gpio_create_ 4-5 57735 NULL
120096 +pppol2tp_recvmsg_57742 pppol2tp_recvmsg 4 57742 NULL nohasharray
120097 +compat_sys_set_mempolicy_57742 compat_sys_set_mempolicy 3 57742 &pppol2tp_recvmsg_57742
120098 +ieee80211_if_fmt_dot11MeshHWMPpreqMinInterval_57762 ieee80211_if_fmt_dot11MeshHWMPpreqMinInterval 3 57762 NULL
120099 +SYSC_process_vm_writev_57776 SYSC_process_vm_writev 3-5 57776 NULL
120100 +apei_exec_collect_resources_57788 apei_exec_collect_resources 0 57788 NULL
120101 +security_inode_unlink_57791 security_inode_unlink 0 57791 NULL
120102 +ld2_57794 ld2 0 57794 NULL
120103 +ivtv_read_57796 ivtv_read 3 57796 NULL
120104 +ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
120105 +bfad_debugfs_read_regrd_57830 bfad_debugfs_read_regrd 3 57830 NULL
120106 +copy_to_user_57835 copy_to_user 3-0 57835 NULL
120107 +xfs_rtpick_extent_57843 xfs_rtpick_extent 0 57843 NULL nohasharray
120108 +flash_read_57843 flash_read 3 57843 &xfs_rtpick_extent_57843
120109 +kiblnd_create_tx_pool_57846 kiblnd_create_tx_pool 2 57846 NULL
120110 +radeon_ttm_gtt_read_57879 radeon_ttm_gtt_read 3 57879 NULL
120111 +xt_alloc_table_info_57903 xt_alloc_table_info 1 57903 NULL
120112 +iio_read_first_n_kfifo_57910 iio_read_first_n_kfifo 2 57910 NULL
120113 +ll_xattr_find_get_lock_57912 ll_xattr_find_get_lock 0 57912 NULL
120114 +memcg_caches_array_size_57918 memcg_caches_array_size 0-1 57918 NULL
120115 +twl_i2c_write_57923 twl_i2c_write 3-4 57923 NULL
120116 +__snd_gf1_look16_57925 __snd_gf1_look16 0 57925 NULL
120117 +sel_read_handle_unknown_57933 sel_read_handle_unknown 3 57933 NULL
120118 +xfs_inode_item_format_convert_57937 xfs_inode_item_format_convert 0 57937 NULL
120119 +xfs_mru_cache_create_57943 xfs_mru_cache_create 3 57943 NULL
120120 +key_algorithm_read_57946 key_algorithm_read 3 57946 NULL
120121 +ip_set_alloc_57953 ip_set_alloc 1 57953 NULL nohasharray
120122 +ioat3_dca_count_dca_slots_57953 ioat3_dca_count_dca_slots 0 57953 &ip_set_alloc_57953
120123 +rx_reset_counter_read_58001 rx_reset_counter_read 3 58001 NULL
120124 +iwl_dbgfs_ucode_rx_stats_read_58023 iwl_dbgfs_ucode_rx_stats_read 3 58023 NULL
120125 +io_playback_transfer_58030 io_playback_transfer 4 58030 NULL
120126 +mce_async_out_58056 mce_async_out 3 58056 NULL
120127 +ocfs2_find_leaf_58065 ocfs2_find_leaf 0 58065 NULL
120128 +dt3155_alloc_coherent_58073 dt3155_alloc_coherent 2 58073 NULL
120129 +cm4040_write_58079 cm4040_write 3 58079 NULL
120130 +ipv6_flowlabel_opt_58135 ipv6_flowlabel_opt 3 58135 NULL nohasharray
120131 +slhc_init_58135 slhc_init 1-2 58135 &ipv6_flowlabel_opt_58135
120132 +rd_build_prot_space_58137 rd_build_prot_space 2 58137 NULL
120133 +xfs_bmap_add_extent_delay_real_58151 xfs_bmap_add_extent_delay_real 0 58151 NULL
120134 +xfs_btree_update_58167 xfs_btree_update 0 58167 NULL
120135 +garmin_write_bulk_58191 garmin_write_bulk 3 58191 NULL
120136 +ieee80211_if_fmt_flags_58205 ieee80211_if_fmt_flags 3 58205 NULL
120137 +i40evf_allocate_virt_mem_d_58210 i40evf_allocate_virt_mem_d 3 58210 NULL
120138 +btrfsic_create_link_to_next_block_58246 btrfsic_create_link_to_next_block 4 58246 NULL
120139 +read_file_debug_58256 read_file_debug 3 58256 NULL
120140 +osc_max_dirty_mb_seq_write_58263 osc_max_dirty_mb_seq_write 3 58263 NULL
120141 +cfg80211_mgmt_tx_status_58266 cfg80211_mgmt_tx_status 4 58266 NULL
120142 +profile_load_58267 profile_load 3 58267 NULL
120143 +kstrtos8_from_user_58268 kstrtos8_from_user 2 58268 NULL
120144 +acpi_ds_build_internal_package_obj_58271 acpi_ds_build_internal_package_obj 3 58271 NULL
120145 +iscsi_decode_text_input_58292 iscsi_decode_text_input 4 58292 NULL
120146 +ieee80211_if_read_dot11MeshTTL_58307 ieee80211_if_read_dot11MeshTTL 3 58307 NULL
120147 +tx_tx_start_int_templates_read_58324 tx_tx_start_int_templates_read 3 58324 NULL
120148 +ext4_ext_truncate_extend_restart_58331 ext4_ext_truncate_extend_restart 3 58331 NULL
120149 +__copy_from_user_swizzled_58337 __copy_from_user_swizzled 2-4 58337 NULL
120150 +SyS_migrate_pages_58348 SyS_migrate_pages 2 58348 NULL
120151 +brcmf_debugfs_sdio_counter_read_58369 brcmf_debugfs_sdio_counter_read 3 58369 NULL
120152 +il_dbgfs_status_read_58388 il_dbgfs_status_read 3 58388 NULL
120153 +_drbd_md_sync_page_io_58403 _drbd_md_sync_page_io 6 58403 NULL
120154 +kvm_mmu_write_protect_pt_masked_58406 kvm_mmu_write_protect_pt_masked 3 58406 NULL nohasharray
120155 +idetape_pad_zeros_58406 idetape_pad_zeros 2 58406 &kvm_mmu_write_protect_pt_masked_58406
120156 +xfs_btree_get_rec_58410 xfs_btree_get_rec 0 58410 NULL
120157 +i2400m_pld_size_58415 i2400m_pld_size 0 58415 NULL
120158 +capabilities_read_58457 capabilities_read 3 58457 NULL
120159 +usnic_vnic_get_resources_58462 usnic_vnic_get_resources 3 58462 NULL
120160 +lpfc_idiag_baracc_read_58466 lpfc_idiag_baracc_read 3 58466 NULL nohasharray
120161 +compat_do_ipt_set_ctl_58466 compat_do_ipt_set_ctl 4 58466 &lpfc_idiag_baracc_read_58466
120162 +nv_rd08_58472 nv_rd08 0 58472 NULL
120163 +acpi_tables_sysfs_init_58477 acpi_tables_sysfs_init 0 58477 NULL
120164 +snd_gf1_read_addr_58483 snd_gf1_read_addr 0 58483 NULL
120165 +snd_rme96_capture_copy_58484 snd_rme96_capture_copy 5 58484 NULL
120166 +btrfs_cont_expand_58498 btrfs_cont_expand 0-2-3 58498 NULL
120167 +gfs2_dir_get_new_buffer_58509 gfs2_dir_get_new_buffer 0 58509 NULL
120168 +rndis_add_response_58544 rndis_add_response 2 58544 NULL
120169 +wep_decrypt_fail_read_58567 wep_decrypt_fail_read 3 58567 NULL
120170 +scnprint_mac_oui_58578 scnprint_mac_oui 3-0 58578 NULL
120171 +get_rhf_errstring_58582 get_rhf_errstring 3 58582 NULL
120172 +ea_read_inline_58589 ea_read_inline 0 58589 NULL
120173 +isku_sysfs_read_keys_thumbster_58590 isku_sysfs_read_keys_thumbster 6 58590 NULL
120174 +xip_file_read_58592 xip_file_read 3 58592 NULL
120175 +ecryptfs_write_end_58594 ecryptfs_write_end 5-3 58594 NULL
120176 +radeon_bo_size_58606 radeon_bo_size 0 58606 NULL
120177 +skb_copy_to_page_nocache_58624 skb_copy_to_page_nocache 6 58624 NULL
120178 +filemap_fdatawrite_range_58630 filemap_fdatawrite_range 0 58630 NULL
120179 +tx_tx_start_fw_gen_read_58648 tx_tx_start_fw_gen_read 3 58648 NULL
120180 +iwl_dbgfs_rx_handlers_write_58655 iwl_dbgfs_rx_handlers_write 3 58655 NULL
120181 +find_zero_58685 find_zero 0-1 58685 NULL
120182 +uwb_bce_print_IEs_58686 uwb_bce_print_IEs 4 58686 NULL
120183 +tps6586x_writes_58689 tps6586x_writes 2-3 58689 NULL
120184 +vx_send_msg_58711 vx_send_msg 0 58711 NULL
120185 +csum_exist_in_range_58730 csum_exist_in_range 2-3 58730 NULL
120186 +frames_to_bytes_58741 frames_to_bytes 0-2 58741 NULL
120187 +ieee80211_if_write_tkip_mic_test_58748 ieee80211_if_write_tkip_mic_test 3 58748 NULL
120188 +agp_allocate_memory_58761 agp_allocate_memory 2 58761 NULL
120189 +regmap_calc_reg_len_58795 regmap_calc_reg_len 0 58795 NULL
120190 +raw_send_hdrinc_58803 raw_send_hdrinc 4 58803 NULL
120191 +isku_sysfs_read_58806 isku_sysfs_read 5 58806 NULL
120192 +ep_read_58813 ep_read 3 58813 NULL
120193 +command_write_58841 command_write 3 58841 NULL
120194 +ath6kl_wmi_send_action_cmd_58860 ath6kl_wmi_send_action_cmd 7 58860 NULL
120195 +gs_alloc_req_58883 gs_alloc_req 2 58883 NULL
120196 +esas2r_change_queue_depth_58886 esas2r_change_queue_depth 2 58886 NULL
120197 +lprocfs_wr_pinger_recov_58914 lprocfs_wr_pinger_recov 3 58914 NULL
120198 +print_devstats_dot11FCSErrorCount_58919 print_devstats_dot11FCSErrorCount 3 58919 NULL
120199 +pipeline_cs_rx_packet_out_read_58926 pipeline_cs_rx_packet_out_read 3 58926 NULL
120200 +xfs_bmap_read_extents_58936 xfs_bmap_read_extents 0 58936 NULL
120201 +wait_table_hash_nr_entries_58962 wait_table_hash_nr_entries 0 58962 NULL
120202 +ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout_58965 ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout 3 58965 NULL
120203 +crypto_aead_ivsize_58970 crypto_aead_ivsize 0 58970 NULL
120204 +__mem_cgroup_try_charge_58976 __mem_cgroup_try_charge 0 58976 NULL
120205 +init_list_set_59005 init_list_set 3 59005 NULL
120206 +ep_write_59008 ep_write 3 59008 NULL
120207 +lpfc_idiag_baracc_write_59014 lpfc_idiag_baracc_write 3 59014 NULL
120208 +SyS_preadv_59029 SyS_preadv 3 59029 NULL
120209 +init_pci_cap_msi_perm_59033 init_pci_cap_msi_perm 2 59033 NULL
120210 +selinux_transaction_write_59038 selinux_transaction_write 3 59038 NULL
120211 +crypto_aead_reqsize_59039 crypto_aead_reqsize 0 59039 NULL
120212 +regmap_bulk_write_59049 regmap_bulk_write 2-4 59049 NULL
120213 +mmc_sd_num_wr_blocks_59112 mmc_sd_num_wr_blocks 0 59112 NULL
120214 +scsi_io_completion_59122 scsi_io_completion 2 59122 NULL nohasharray
120215 +sta_tx_latency_stat_table_59122 sta_tx_latency_stat_table 0-4-5 59122 &scsi_io_completion_59122
120216 +nfc_llcp_send_i_frame_59130 nfc_llcp_send_i_frame 3 59130 NULL
120217 +print_devstats_dot11RTSSuccessCount_59145 print_devstats_dot11RTSSuccessCount 3 59145 NULL nohasharray
120218 +framebuffer_alloc_59145 framebuffer_alloc 1 59145 &print_devstats_dot11RTSSuccessCount_59145
120219 +radeon_compat_ioctl_59150 radeon_compat_ioctl 2 59150 NULL
120220 +pvr2_hdw_report_clients_59152 pvr2_hdw_report_clients 3 59152 NULL
120221 +ksize_59176 ksize 0 59176 NULL
120222 +setup_window_59178 setup_window 4-2-5-7 59178 NULL
120223 +ocfs2_move_extent_59187 ocfs2_move_extent 2-5 59187 NULL
120224 +xfs_ialloc_next_rec_59193 xfs_ialloc_next_rec 0 59193 NULL
120225 +xfs_iext_realloc_indirect_59211 xfs_iext_realloc_indirect 2 59211 NULL
120226 +check_mapped_selector_name_59216 check_mapped_selector_name 5 59216 NULL
120227 +dt3155_read_59226 dt3155_read 3 59226 NULL
120228 +paging64_gpte_to_gfn_lvl_59229 paging64_gpte_to_gfn_lvl 0-1-2 59229 NULL
120229 +nla_len_59258 nla_len 0 59258 NULL
120230 +drbd_bm_write_page_59290 drbd_bm_write_page 2 59290 NULL
120231 +btrfs_insert_dir_item_59304 btrfs_insert_dir_item 4 59304 NULL
120232 +xfs_iformat_fork_59312 xfs_iformat_fork 0 59312 NULL
120233 +fd_copyout_59323 fd_copyout 3 59323 NULL
120234 +read_9287_modal_eeprom_59327 read_9287_modal_eeprom 3 59327 NULL
120235 +rx_defrag_in_process_called_read_59338 rx_defrag_in_process_called_read 3 59338 NULL
120236 +xfs_attrmulti_attr_set_59346 xfs_attrmulti_attr_set 4 59346 NULL nohasharray
120237 +xfs_alloc_lookup_le_59346 xfs_alloc_lookup_le 0 59346 &xfs_attrmulti_attr_set_59346
120238 +__map_request_59350 __map_request 0 59350 NULL
120239 +gfs2_quota_lock_check_59353 gfs2_quota_lock_check 0 59353 NULL
120240 +f2fs_fallocate_59377 f2fs_fallocate 4-3 59377 NULL
120241 +pvr2_debugifc_print_info_59380 pvr2_debugifc_print_info 3 59380 NULL
120242 +journal_init_dev_59384 journal_init_dev 5 59384 NULL
120243 +__net_get_random_once_59389 __net_get_random_once 2 59389 NULL
120244 +isku_sysfs_read_keys_function_59412 isku_sysfs_read_keys_function 6 59412 NULL
120245 +pci_ctrl_read_59424 pci_ctrl_read 0 59424 NULL
120246 +vxge_hw_ring_rxds_per_block_get_59425 vxge_hw_ring_rxds_per_block_get 0 59425 NULL
120247 +SyS_sched_setaffinity_59442 SyS_sched_setaffinity 2 59442 NULL
120248 +fs_path_ensure_buf_59445 fs_path_ensure_buf 2 59445 NULL
120249 +ib_copy_from_udata_59502 ib_copy_from_udata 3 59502 NULL
120250 +mic_vringh_copy_59523 mic_vringh_copy 4 59523 NULL
120251 +mpi_get_nbits_59551 mpi_get_nbits 0 59551 NULL
120252 +tunables_write_59563 tunables_write 3 59563 NULL
120253 +bio_split_59564 bio_split 2 59564 NULL
120254 +__copy_from_user_ll_nozero_59571 __copy_from_user_ll_nozero 0-3 59571 NULL
120255 +write_pbl_59583 write_pbl 4 59583 NULL
120256 +memdup_user_59590 memdup_user 2 59590 NULL
120257 +xrcdn_free_res_59616 xrcdn_free_res 5 59616 NULL nohasharray
120258 +mem_fwlog_free_mem_blks_read_59616 mem_fwlog_free_mem_blks_read 3 59616 &xrcdn_free_res_59616
120259 +ath6kl_endpoint_stats_write_59621 ath6kl_endpoint_stats_write 3 59621 NULL
120260 +mtrr_write_59622 mtrr_write 3 59622 NULL
120261 +find_first_zero_bit_59636 find_first_zero_bit 0 59636 NULL
120262 +SyS_setdomainname_59646 SyS_setdomainname 2 59646 NULL
120263 +file_update_time_59647 file_update_time 0 59647 NULL
120264 +hidraw_read_59650 hidraw_read 3 59650 NULL
120265 +v9fs_xattr_set_acl_59651 v9fs_xattr_set_acl 4 59651 NULL
120266 +__devcgroup_check_permission_59665 __devcgroup_check_permission 0 59665 NULL
120267 +iwl_dbgfs_mac_params_read_59666 iwl_dbgfs_mac_params_read 3 59666 NULL
120268 +alloc_dca_provider_59670 alloc_dca_provider 2 59670 NULL
120269 +mic_calc_failure_read_59700 mic_calc_failure_read 3 59700 NULL
120270 +ioperm_get_59701 ioperm_get 4-3 59701 NULL
120271 +prism2_info_scanresults_59729 prism2_info_scanresults 3 59729 NULL
120272 +ieee80211_if_read_fwded_unicast_59740 ieee80211_if_read_fwded_unicast 3 59740 NULL
120273 +fat_direct_IO_59741 fat_direct_IO 4 59741 NULL
120274 +qib_decode_7220_sdma_errs_59745 qib_decode_7220_sdma_errs 4 59745 NULL
120275 +strnlen_59746 strnlen 0 59746 NULL
120276 +ext3_acl_count_59754 ext3_acl_count 0-1 59754 NULL
120277 +long_retry_limit_read_59766 long_retry_limit_read 3 59766 NULL nohasharray
120278 +cap_inode_need_killpriv_59766 cap_inode_need_killpriv 0 59766 &long_retry_limit_read_59766
120279 +venus_remove_59781 venus_remove 4 59781 NULL
120280 +mei_nfc_recv_59784 mei_nfc_recv 3 59784 NULL
120281 +ipw_write_59807 ipw_write 3 59807 NULL
120282 +scsi_init_shared_tag_map_59812 scsi_init_shared_tag_map 2 59812 NULL
120283 +ieee80211_if_read_dot11MeshHWMPmaxPREQretries_59829 ieee80211_if_read_dot11MeshHWMPmaxPREQretries 3 59829 NULL
120284 +gspca_dev_probe2_59833 gspca_dev_probe2 4 59833 NULL
120285 +regmap_raw_write_async_59849 regmap_raw_write_async 2-4 59849 NULL
120286 +pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
120287 +l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
120288 +ffs_prepare_buffer_59892 ffs_prepare_buffer 2 59892 NULL
120289 +kvm_mmu_notifier_invalidate_range_start_59944 kvm_mmu_notifier_invalidate_range_start 3-4 59944 NULL
120290 +ath10k_read_dfs_stats_59949 ath10k_read_dfs_stats 3 59949 NULL
120291 +dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL nohasharray
120292 +il_dbgfs_rxon_flags_read_59950 il_dbgfs_rxon_flags_read 3 59950 &dapm_widget_power_read_file_59950
120293 +il_dbgfs_missed_beacon_read_59956 il_dbgfs_missed_beacon_read 3 59956 NULL
120294 +__arch_hweight16_59975 __arch_hweight16 0 59975 NULL
120295 +osd_req_read_kern_59990 osd_req_read_kern 5 59990 NULL
120296 +ghash_async_setkey_60001 ghash_async_setkey 3 60001 NULL
120297 +ieee80211_if_fmt_dot11MeshAwakeWindowDuration_60006 ieee80211_if_fmt_dot11MeshAwakeWindowDuration 3 60006 NULL
120298 +copy_items_60009 copy_items 7 60009 NULL
120299 +rawsock_sendmsg_60010 rawsock_sendmsg 4 60010 NULL
120300 +mthca_init_cq_60011 mthca_init_cq 2 60011 NULL
120301 +osd_req_list_dev_partitions_60027 osd_req_list_dev_partitions 4 60027 NULL
120302 +xlog_bread_offset_60030 xlog_bread_offset 3 60030 NULL
120303 +xfs_imap_to_bp_60034 xfs_imap_to_bp 0 60034 NULL
120304 +bio_integrity_hw_sectors_60039 bio_integrity_hw_sectors 0-2 60039 NULL
120305 +do_ip6t_set_ctl_60040 do_ip6t_set_ctl 4 60040 NULL
120306 +vcs_size_60050 vcs_size 0 60050 NULL
120307 +gru_alloc_gts_60056 gru_alloc_gts 3-2 60056 NULL
120308 +compat_writev_60063 compat_writev 3 60063 NULL
120309 +ath6kl_listen_int_write_60066 ath6kl_listen_int_write 3 60066 NULL
120310 +c4iw_num_stags_60073 c4iw_num_stags 0 60073 NULL
120311 +rxrpc_kernel_send_data_60083 rxrpc_kernel_send_data 3 60083 NULL
120312 +ieee80211_if_fmt_fwded_frames_60103 ieee80211_if_fmt_fwded_frames 3 60103 NULL
120313 +SYSC_msgsnd_60113 SYSC_msgsnd 3 60113 NULL
120314 +nfs_idmap_request_key_60124 nfs_idmap_request_key 2 60124 NULL
120315 +__mutex_lock_common_60134 __mutex_lock_common 0 60134 NULL
120316 +ld_usb_read_60156 ld_usb_read 3 60156 NULL
120317 +jmb38x_ms_count_slots_60164 jmb38x_ms_count_slots 0 60164 NULL
120318 +init_state_60165 init_state 2 60165 NULL
120319 +jffs2_alloc_full_dirent_60179 jffs2_alloc_full_dirent 1 60179 NULL nohasharray
120320 +sg_build_sgat_60179 sg_build_sgat 3 60179 &jffs2_alloc_full_dirent_60179
120321 +fuse_async_req_send_60183 fuse_async_req_send 0-3 60183 NULL
120322 +rx_rx_tkip_replays_read_60193 rx_rx_tkip_replays_read 3 60193 NULL
120323 +qib_reg_phys_mr_60202 qib_reg_phys_mr 3 60202 NULL
120324 +btrfs_get_token_16_60220 btrfs_get_token_16 0 60220 NULL
120325 +irq_alloc_domain_generic_chips_60264 irq_alloc_domain_generic_chips 2-3 60264 NULL
120326 +display_crc_ctl_write_60273 display_crc_ctl_write 3 60273 NULL
120327 +printer_write_60276 printer_write 3 60276 NULL
120328 +do_xip_mapping_read_60297 do_xip_mapping_read 5 60297 NULL
120329 +getDataLength_60301 getDataLength 0 60301 NULL
120330 +usb_alphatrack_write_60341 usb_alphatrack_write 3 60341 NULL
120331 +__kfifo_from_user_r_60345 __kfifo_from_user_r 5-3 60345 NULL
120332 +dccp_setsockopt_60367 dccp_setsockopt 5 60367 NULL
120333 +mthca_alloc_resize_buf_60394 mthca_alloc_resize_buf 3 60394 NULL
120334 +ocfs2_zero_extend_60396 ocfs2_zero_extend 3 60396 NULL
120335 +driver_names_read_60399 driver_names_read 3 60399 NULL
120336 +simple_alloc_urb_60420 simple_alloc_urb 3 60420 NULL
120337 +excessive_retries_read_60425 excessive_retries_read 3 60425 NULL
120338 +kmalloc_60432 kmalloc 1 60432 NULL nohasharray
120339 +tstats_write_60432 tstats_write 3 60432 &kmalloc_60432
120340 +snd_hda_get_num_raw_conns_60462 snd_hda_get_num_raw_conns 0 60462 NULL
120341 +crypto_shash_setkey_60483 crypto_shash_setkey 3 60483 NULL
120342 +lustre_msg_early_size_60496 lustre_msg_early_size 0 60496 NULL
120343 +xfs_btree_make_block_unfull_60511 xfs_btree_make_block_unfull 0 60511 NULL
120344 +v9fs_fid_readn_60544 v9fs_fid_readn 4 60544 NULL
120345 +nonpaging_map_60551 nonpaging_map 4 60551 NULL
120346 +osc_lockless_truncate_seq_write_60553 osc_lockless_truncate_seq_write 3 60553 NULL
120347 +tracing_entries_write_60563 tracing_entries_write 3 60563 NULL
120348 +memblock_virt_alloc_try_nid_nopanic_60604 memblock_virt_alloc_try_nid_nopanic 1 60604 NULL
120349 +inode_change_ok_60614 inode_change_ok 0 60614 NULL
120350 +skb_transport_offset_60619 skb_transport_offset 0 60619 NULL
120351 +wl1273_fm_fops_write_60621 wl1273_fm_fops_write 3 60621 NULL
120352 +acl_alloc_stack_init_60630 acl_alloc_stack_init 1 60630 NULL
120353 +__proc_lnet_stats_60647 __proc_lnet_stats 5 60647 NULL
120354 +if_sdio_host_to_card_60666 if_sdio_host_to_card 4 60666 NULL
120355 +ieee80211_if_read_dot11MeshConfirmTimeout_60670 ieee80211_if_read_dot11MeshConfirmTimeout 3 60670 NULL
120356 +vga_rcrt_60731 vga_rcrt 0 60731 NULL
120357 +snd_ice1712_ds_read_60754 snd_ice1712_ds_read 0 60754 NULL
120358 +raid_status_60755 raid_status 5 60755 NULL
120359 +sel_write_checkreqprot_60774 sel_write_checkreqprot 3 60774 NULL
120360 +opticon_write_60775 opticon_write 4 60775 NULL
120361 +acl_alloc_num_60778 acl_alloc_num 1-2 60778 NULL
120362 +snd_pcm_oss_readv3_60792 snd_pcm_oss_readv3 3 60792 NULL
120363 +gfs2_bmap_alloc_60822 gfs2_bmap_alloc 0 60822 NULL
120364 +pwr_tx_with_ps_read_60851 pwr_tx_with_ps_read 3 60851 NULL
120365 +__clone_and_map_data_bio_60861 __clone_and_map_data_bio 4-3 60861 NULL
120366 +alloc_buf_60864 alloc_buf 3-2 60864 NULL
120367 +generic_writepages_60871 generic_writepages 0 60871 NULL
120368 +ext4_update_inline_data_60888 ext4_update_inline_data 3 60888 NULL
120369 +iio_debugfs_read_reg_60908 iio_debugfs_read_reg 3 60908 NULL
120370 +libcfs_sock_ioctl_60915 libcfs_sock_ioctl 0 60915 NULL
120371 +mgt_set_varlen_60916 mgt_set_varlen 4 60916 NULL
120372 +scrub_chunk_60926 scrub_chunk 5 60926 NULL
120373 +submit_extent_page_60928 submit_extent_page 5 60928 NULL
120374 +xfs_rtallocate_extent_size_60939 xfs_rtallocate_extent_size 0 60939 NULL
120375 +pti_char_write_60960 pti_char_write 3 60960 NULL
120376 +mwifiex_alloc_sdio_mpa_buffers_60961 mwifiex_alloc_sdio_mpa_buffers 2-3 60961 NULL
120377 +__a2mp_build_60987 __a2mp_build 3 60987 NULL
120378 +hsc_msg_alloc_60990 hsc_msg_alloc 1 60990 NULL
120379 +ath6kl_lrssi_roam_read_61022 ath6kl_lrssi_roam_read 3 61022 NULL
120380 +graph_depth_write_61024 graph_depth_write 3 61024 NULL
120381 +sdhci_pltfm_register_61031 sdhci_pltfm_register 3 61031 NULL
120382 +lpfc_idiag_queacc_write_61043 lpfc_idiag_queacc_write 3 61043 NULL
120383 +symtab_init_61050 symtab_init 2 61050 NULL
120384 +fuse_send_write_61053 fuse_send_write 0-4 61053 NULL
120385 +bitmap_scnlistprintf_61062 bitmap_scnlistprintf 0-2 61062 NULL
120386 +ahash_align_buffer_size_61070 ahash_align_buffer_size 0-1-2 61070 NULL
120387 +xfs_dabuf_map_61093 xfs_dabuf_map 0 61093 NULL
120388 +get_derived_key_61100 get_derived_key 4 61100 NULL
120389 +mem_cgroup_cache_charge_61101 mem_cgroup_cache_charge 0 61101 NULL
120390 +i40e_calculate_l2fpm_size_61104 i40e_calculate_l2fpm_size 0-4-3-2-1 61104 NULL
120391 +alloc_chrdev_region_61112 alloc_chrdev_region 0 61112 NULL
120392 +__probe_kernel_read_61119 __probe_kernel_read 3 61119 NULL
120393 +vmemmap_alloc_block_buf_61126 vmemmap_alloc_block_buf 1 61126 NULL
120394 +afs_proc_cells_write_61139 afs_proc_cells_write 3 61139 NULL
120395 +pair_device_61175 pair_device 4 61175 NULL nohasharray
120396 +event_oom_late_read_61175 event_oom_late_read 3 61175 &pair_device_61175
120397 +dio_bio_add_page_61178 dio_bio_add_page 0 61178 NULL
120398 +SyS_prctl_61202 SyS_prctl 4 61202 NULL
120399 +arch_hibernation_header_save_61212 arch_hibernation_header_save 0 61212 NULL
120400 +smk_read_ambient_61220 smk_read_ambient 3 61220 NULL
120401 +v9fs_mmap_file_read_61262 v9fs_mmap_file_read 3 61262 NULL
120402 +btrfs_bio_alloc_61270 btrfs_bio_alloc 3 61270 NULL nohasharray
120403 +find_get_pages_tag_61270 find_get_pages_tag 0 61270 &btrfs_bio_alloc_61270 nohasharray
120404 +ifalias_store_61270 ifalias_store 4 61270 &find_get_pages_tag_61270
120405 +vortex_adbdma_getlinearpos_61283 vortex_adbdma_getlinearpos 0 61283 NULL nohasharray
120406 +hfsplus_getxattr_finder_info_61283 hfsplus_getxattr_finder_info 0 61283 &vortex_adbdma_getlinearpos_61283
120407 +nvme_trans_copy_to_user_61288 nvme_trans_copy_to_user 3 61288 NULL
120408 +xfer_from_user_61307 xfer_from_user 3 61307 NULL
120409 +xfrm_user_sec_ctx_size_61320 xfrm_user_sec_ctx_size 0 61320 NULL
120410 +C_SYSC_msgsnd_61330 C_SYSC_msgsnd 3 61330 NULL
120411 +write_file_spectral_short_repeat_61335 write_file_spectral_short_repeat 3 61335 NULL
120412 +st5481_setup_isocpipes_61340 st5481_setup_isocpipes 6-4 61340 NULL
120413 +rx_rx_wa_ba_not_expected_read_61341 rx_rx_wa_ba_not_expected_read 3 61341 NULL
120414 +__dm_get_reserved_ios_61342 __dm_get_reserved_ios 0-3-2 61342 NULL
120415 +f1x_map_sysaddr_to_csrow_61344 f1x_map_sysaddr_to_csrow 2 61344 NULL
120416 +debug_debug4_read_61367 debug_debug4_read 3 61367 NULL
120417 +system_enable_write_61396 system_enable_write 3 61396 NULL
120418 +unix_stream_sendmsg_61455 unix_stream_sendmsg 4 61455 NULL
120419 +snd_pcm_lib_writev_transfer_61483 snd_pcm_lib_writev_transfer 5-4-2 61483 NULL
120420 +btrfs_item_size_61485 btrfs_item_size 0 61485 NULL
120421 +ocfs2_get_refcount_rec_61514 ocfs2_get_refcount_rec 0 61514 NULL
120422 +erst_errno_61526 erst_errno 0 61526 NULL
120423 +trace_options_core_write_61551 trace_options_core_write 3 61551 NULL
120424 +dvb_net_ioctl_61559 dvb_net_ioctl 2 61559 NULL
120425 +parport_pc_fifo_write_block_dma_61568 parport_pc_fifo_write_block_dma 3 61568 NULL
120426 +fan_proc_write_61569 fan_proc_write 3 61569 NULL
120427 +ieee80211_if_read_rc_rateidx_mask_2ghz_61570 ieee80211_if_read_rc_rateidx_mask_2ghz 3 61570 NULL
120428 +ldlm_pool_rw_atomic_seq_write_61572 ldlm_pool_rw_atomic_seq_write 3 61572 NULL
120429 +seq_open_private_61589 seq_open_private 3 61589 NULL
120430 +ept_gpte_to_gfn_lvl_61591 ept_gpte_to_gfn_lvl 0-1-2 61591 NULL
120431 +netlink_recvmsg_61600 netlink_recvmsg 4 61600 NULL
120432 +nfs4_init_uniform_client_string_61601 nfs4_init_uniform_client_string 3 61601 NULL
120433 +configfs_write_file_61621 configfs_write_file 3 61621 NULL
120434 +ieee80211_if_fmt_hw_queues_61629 ieee80211_if_fmt_hw_queues 3 61629 NULL
120435 +i2o_parm_table_get_61635 i2o_parm_table_get 6 61635 NULL
120436 +snd_pcm_oss_read3_61643 snd_pcm_oss_read3 0-3 61643 NULL nohasharray
120437 +tcf_hashinfo_init_61643 tcf_hashinfo_init 2 61643 &snd_pcm_oss_read3_61643
120438 +resize_stripes_61650 resize_stripes 2 61650 NULL
120439 +ttm_page_pool_free_61661 ttm_page_pool_free 2-0 61661 NULL
120440 +insert_one_name_61668 insert_one_name 7 61668 NULL
120441 +qib_format_hwmsg_61679 qib_format_hwmsg 2 61679 NULL
120442 +lock_loop_61681 lock_loop 1 61681 NULL
120443 +filter_read_61692 filter_read 3 61692 NULL
120444 +iov_length_61716 iov_length 0 61716 NULL
120445 +fragmentation_threshold_read_61718 fragmentation_threshold_read 3 61718 NULL
120446 +null_alloc_reqbuf_61719 null_alloc_reqbuf 3 61719 NULL
120447 +read_file_interrupt_61742 read_file_interrupt 3 61742 NULL nohasharray
120448 +read_file_regval_61742 read_file_regval 3 61742 &read_file_interrupt_61742
120449 +SyS_sendto_61763 SyS_sendto 6 61763 NULL
120450 +gfs2_meta_wait_61773 gfs2_meta_wait 0 61773 NULL
120451 +xfs_file_dio_aio_write_61801 xfs_file_dio_aio_write 0 61801 NULL
120452 +mls_compute_context_len_61812 mls_compute_context_len 0 61812 NULL
120453 +bfad_debugfs_write_regwr_61841 bfad_debugfs_write_regwr 3 61841 NULL
120454 +regcache_sync_block_61846 regcache_sync_block 5-4 61846 NULL
120455 +ath9k_hw_def_dump_eeprom_61853 ath9k_hw_def_dump_eeprom 5-4 61853 NULL
120456 +fs_path_prepare_for_add_61854 fs_path_prepare_for_add 2 61854 NULL
120457 +evdev_compute_buffer_size_61863 evdev_compute_buffer_size 0 61863 NULL
120458 +SYSC_lsetxattr_61869 SYSC_lsetxattr 4 61869 NULL
120459 +get_fw_name_61874 get_fw_name 3 61874 NULL
120460 +btrfs_ioctl_clone_61886 btrfs_ioctl_clone 3-4-5 61886 NULL
120461 +lprocfs_write_frac_u64_helper_61897 lprocfs_write_frac_u64_helper 2 61897 NULL
120462 +lov_mds_md_stripecnt_61899 lov_mds_md_stripecnt 0-1 61899 NULL
120463 +clear_refs_write_61904 clear_refs_write 3 61904 NULL
120464 +rx_filter_arp_filter_read_61914 rx_filter_arp_filter_read 3 61914 NULL
120465 +au0828_init_isoc_61917 au0828_init_isoc 3-2-4 61917 NULL
120466 +sctp_sendmsg_61919 sctp_sendmsg 4 61919 NULL
120467 +edac_device_create_instance_61940 edac_device_create_instance 0 61940 NULL
120468 +SyS_kexec_load_61946 SyS_kexec_load 2 61946 NULL
120469 +il4965_ucode_rx_stats_read_61948 il4965_ucode_rx_stats_read 3 61948 NULL
120470 +squashfs_read_id_index_table_61961 squashfs_read_id_index_table 4 61961 NULL
120471 +fix_read_error_61965 fix_read_error 4 61965 NULL
120472 +fd_locked_ioctl_61978 fd_locked_ioctl 3 61978 NULL
120473 +cow_file_range_61979 cow_file_range 3 61979 NULL
120474 +set_extent_delalloc_61982 set_extent_delalloc 0 61982 NULL
120475 +dequeue_event_62000 dequeue_event 3 62000 NULL
120476 +xt_compat_match_offset_62011 xt_compat_match_offset 0 62011 NULL
120477 +SyS_setxattr_62019 SyS_setxattr 4 62019 NULL
120478 +jffs2_do_unlink_62020 jffs2_do_unlink 4 62020 NULL
120479 +SYSC_select_62024 SYSC_select 1 62024 NULL
120480 +pmcraid_build_passthrough_ioadls_62034 pmcraid_build_passthrough_ioadls 2 62034 NULL
120481 +sctp_user_addto_chunk_62047 sctp_user_addto_chunk 2-3 62047 NULL
120482 +do_pselect_62061 do_pselect 1 62061 NULL
120483 +pcpu_alloc_bootmem_62074 pcpu_alloc_bootmem 2 62074 NULL
120484 +_xfs_log_force_lsn_62083 _xfs_log_force_lsn 0 62083 NULL
120485 +fat_setattr_62084 fat_setattr 0 62084 NULL
120486 +jffs2_security_setxattr_62107 jffs2_security_setxattr 4 62107 NULL
120487 +btrfs_direct_IO_62114 btrfs_direct_IO 4 62114 NULL
120488 +ip_recv_error_62117 ip_recv_error 3 62117 NULL
120489 +generic_block_fiemap_62122 generic_block_fiemap 4 62122 NULL
120490 +llc_ui_header_len_62131 llc_ui_header_len 0 62131 NULL
120491 +kobject_add_varg_62133 kobject_add_varg 0 62133 NULL nohasharray
120492 +qib_diag_write_62133 qib_diag_write 3 62133 &kobject_add_varg_62133
120493 +device_add_attrs_62135 device_add_attrs 0 62135 NULL nohasharray
120494 +ql_status_62135 ql_status 5 62135 &device_add_attrs_62135
120495 +video_usercopy_62151 video_usercopy 2 62151 NULL
120496 +SyS_getxattr_62166 SyS_getxattr 4 62166 NULL
120497 +prism54_wpa_bss_ie_get_62173 prism54_wpa_bss_ie_get 0 62173 NULL
120498 +write_file_dfs_62180 write_file_dfs 3 62180 NULL
120499 +alloc_upcall_62186 alloc_upcall 2 62186 NULL
120500 +sock_kmalloc_62205 sock_kmalloc 2 62205 NULL
120501 +smk_read_syslog_62227 smk_read_syslog 3 62227 NULL
120502 +SYSC_setgroups16_62232 SYSC_setgroups16 1 62232 NULL
120503 +nfsd_read_file_62241 nfsd_read_file 6 62241 NULL
120504 +subtract_dirty_62242 subtract_dirty 2-3 62242 NULL
120505 +ion_handle_test_dma_62262 ion_handle_test_dma 4-5 62262 NULL
120506 +il_dbgfs_sram_read_62296 il_dbgfs_sram_read 3 62296 NULL
120507 +sparse_early_usemaps_alloc_pgdat_section_62304 sparse_early_usemaps_alloc_pgdat_section 2 62304 NULL
120508 +subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
120509 +Wb35Reg_BurstWrite_62327 Wb35Reg_BurstWrite 4 62327 NULL
120510 +subseq_list_62332 subseq_list 3-0 62332 NULL
120511 +ll_statahead_max_seq_write_62333 ll_statahead_max_seq_write 3 62333 NULL
120512 +flash_write_62354 flash_write 3 62354 NULL
120513 +xfpregs_set_62363 xfpregs_set 4 62363 NULL
120514 +rx_rx_timeout_read_62389 rx_rx_timeout_read 3 62389 NULL
120515 +altera_irscan_62396 altera_irscan 2 62396 NULL
120516 +set_ssp_62411 set_ssp 4 62411 NULL
120517 +udf_expand_file_adinicb_62470 udf_expand_file_adinicb 0 62470 NULL
120518 +ext_rts51x_sd_execute_read_data_62501 ext_rts51x_sd_execute_read_data 9 62501 NULL
120519 +pep_sendmsg_62524 pep_sendmsg 4 62524 NULL
120520 +test_iso_queue_62534 test_iso_queue 5 62534 NULL
120521 +debugfs_read_62535 debugfs_read 3 62535 NULL
120522 +sco_sock_sendmsg_62542 sco_sock_sendmsg 4 62542 NULL
120523 +qib_refresh_qsfp_cache_62547 qib_refresh_qsfp_cache 0 62547 NULL
120524 +link_send_sections_long_62557 link_send_sections_long 3 62557 NULL
120525 +compute_bitstructs_62570 compute_bitstructs 0 62570 NULL
120526 +xfrm_user_policy_62573 xfrm_user_policy 4 62573 NULL
120527 +get_subdir_62581 get_subdir 3 62581 NULL
120528 +nfsd_vfs_read_62605 nfsd_vfs_read 6 62605 NULL
120529 +tipc_port_recv_sections_62609 tipc_port_recv_sections 3 62609 NULL
120530 +dut_mode_write_62630 dut_mode_write 3 62630 NULL
120531 +vfs_fsync_range_62635 vfs_fsync_range 0 62635 NULL
120532 +lpfc_sli4_queue_alloc_62646 lpfc_sli4_queue_alloc 3 62646 NULL
120533 +printer_req_alloc_62687 printer_req_alloc 2 62687 NULL
120534 +bioset_integrity_create_62708 bioset_integrity_create 2 62708 NULL
120535 +gfs2_log_write_62717 gfs2_log_write 3 62717 NULL
120536 +rdm_62719 rdm 0 62719 NULL
120537 +add_to_page_cache_62724 add_to_page_cache 0 62724 NULL
120538 +obd_ioctl_popdata_62741 obd_ioctl_popdata 3 62741 NULL
120539 +key_replays_read_62746 key_replays_read 3 62746 NULL
120540 +lov_verify_lmm_62747 lov_verify_lmm 2 62747 NULL
120541 +mwifiex_rdeeprom_write_62754 mwifiex_rdeeprom_write 3 62754 NULL
120542 +ax25_sendmsg_62770 ax25_sendmsg 4 62770 NULL
120543 +C_SYSC_ipc_62776 C_SYSC_ipc 3 62776 NULL
120544 +SyS_sched_getaffinity_62786 SyS_sched_getaffinity 2 62786 NULL
120545 +dm_stats_account_io_62787 dm_stats_account_io 3 62787 NULL
120546 +tracing_total_entries_read_62817 tracing_total_entries_read 3 62817 NULL
120547 +__rounddown_pow_of_two_62836 __rounddown_pow_of_two 0 62836 NULL
120548 +bio_get_nr_vecs_62838 bio_get_nr_vecs 0 62838 NULL
120549 +xlog_recover_add_to_trans_62839 xlog_recover_add_to_trans 4 62839 NULL
120550 +rx_fcs_err_read_62844 rx_fcs_err_read 3 62844 NULL
120551 +read_nic_io_dword_62859 read_nic_io_dword 0 62859 NULL
120552 +l2tp_ip6_recvmsg_62874 l2tp_ip6_recvmsg 4 62874 NULL
120553 +xfs_rtmodify_range_62877 xfs_rtmodify_range 0 62877 NULL
120554 +aoechr_write_62883 aoechr_write 3 62883 NULL
120555 +if_spi_host_to_card_62890 if_spi_host_to_card 4 62890 NULL
120556 +ocfs2_validate_gd_parent_62905 ocfs2_validate_gd_parent 0 62905 NULL
120557 +mempool_create_slab_pool_62907 mempool_create_slab_pool 1 62907 NULL
120558 +getdqbuf_62908 getdqbuf 1 62908 NULL
120559 +ll_statahead_agl_seq_write_62928 ll_statahead_agl_seq_write 3 62928 NULL
120560 +agp_create_user_memory_62955 agp_create_user_memory 1 62955 NULL
120561 +kstrtoull_from_user_63026 kstrtoull_from_user 2 63026 NULL nohasharray
120562 +xfs_trans_reserve_63026 xfs_trans_reserve 0 63026 &kstrtoull_from_user_63026
120563 +__vb2_perform_fileio_63033 __vb2_perform_fileio 3 63033 NULL
120564 +pipeline_defrag_to_csum_swi_read_63037 pipeline_defrag_to_csum_swi_read 3 63037 NULL
120565 +scsi_host_alloc_63041 scsi_host_alloc 2 63041 NULL
120566 +unlink1_63059 unlink1 3 63059 NULL
120567 +xen_set_nslabs_63066 xen_set_nslabs 0 63066 NULL
120568 +iwl_dbgfs_fw_rx_stats_read_63070 iwl_dbgfs_fw_rx_stats_read 3 63070 NULL
120569 +sep_prepare_input_output_dma_table_in_dcb_63087 sep_prepare_input_output_dma_table_in_dcb 4-5 63087 NULL
120570 +iwl_dbgfs_sensitivity_read_63116 iwl_dbgfs_sensitivity_read 3 63116 NULL
120571 +ext4_chunk_trans_blocks_63123 ext4_chunk_trans_blocks 0-2 63123 NULL
120572 +smk_write_revoke_subj_63173 smk_write_revoke_subj 3 63173 NULL
120573 +SyS_syslog_63178 SyS_syslog 3 63178 NULL
120574 +vme_master_read_63221 vme_master_read 0 63221 NULL
120575 +SyS_gethostname_63227 SyS_gethostname 2 63227 NULL
120576 +ptp_read_63251 ptp_read 4 63251 NULL
120577 +xfs_dir2_leaf_getdents_63262 xfs_dir2_leaf_getdents 3 63262 NULL
120578 +raid5_resize_63306 raid5_resize 2 63306 NULL
120579 +ath10k_read_fw_dbglog_63323 ath10k_read_fw_dbglog 3 63323 NULL
120580 +proc_info_read_63344 proc_info_read 3 63344 NULL
120581 +ps_upsd_max_sptime_read_63362 ps_upsd_max_sptime_read 3 63362 NULL
120582 +idmouse_read_63374 idmouse_read 3 63374 NULL
120583 +usbnet_read_cmd_nopm_63388 usbnet_read_cmd_nopm 7 63388 NULL nohasharray
120584 +edac_pci_alloc_ctl_info_63388 edac_pci_alloc_ctl_info 1 63388 &usbnet_read_cmd_nopm_63388
120585 +rxpipe_missed_beacon_host_int_trig_rx_data_read_63405 rxpipe_missed_beacon_host_int_trig_rx_data_read 3 63405 NULL
120586 +nouveau_event_create_63411 nouveau_event_create 1 63411 NULL
120587 +l2cap_sock_sendmsg_63427 l2cap_sock_sendmsg 4 63427 NULL
120588 +nfsd_symlink_63442 nfsd_symlink 6 63442 NULL
120589 +si5351_bulk_write_63468 si5351_bulk_write 2-3 63468 NULL
120590 +snd_info_entry_write_63474 snd_info_entry_write 3 63474 NULL
120591 +reada_find_extent_63486 reada_find_extent 2 63486 NULL
120592 +read_kcore_63488 read_kcore 3 63488 NULL
120593 +snd_pcm_plug_write_transfer_63503 snd_pcm_plug_write_transfer 0-3 63503 NULL
120594 +efx_mcdi_rpc_async_63529 efx_mcdi_rpc_async 4-5 63529 NULL
120595 +ubi_more_leb_change_data_63534 ubi_more_leb_change_data 4 63534 NULL nohasharray
120596 +generic_cont_expand_simple_63534 generic_cont_expand_simple 0 63534 &ubi_more_leb_change_data_63534
120597 +write_file_spectral_period_63536 write_file_spectral_period 3 63536 NULL
120598 +if_sdio_read_scratch_63540 if_sdio_read_scratch 0 63540 NULL
120599 +append_to_buffer_63550 append_to_buffer 3 63550 NULL
120600 +kvm_write_guest_page_63555 kvm_write_guest_page 5 63555 NULL
120601 +rproc_alloc_63577 rproc_alloc 5 63577 NULL
120602 +write_debug_level_63613 write_debug_level 3 63613 NULL
120603 +__spi_validate_63618 __spi_validate 0 63618 NULL
120604 +symbol_build_supp_rates_63634 symbol_build_supp_rates 0 63634 NULL
120605 +proc_loginuid_write_63648 proc_loginuid_write 3 63648 NULL
120606 +ValidateDSDParamsChecksum_63654 ValidateDSDParamsChecksum 3 63654 NULL
120607 +ldlm_cli_enqueue_63657 ldlm_cli_enqueue 8 63657 NULL
120608 +hidraw_ioctl_63658 hidraw_ioctl 2 63658 NULL
120609 +vbi_read_63673 vbi_read 3 63673 NULL
120610 +write_file_spectral_fft_period_63696 write_file_spectral_fft_period 3 63696 NULL
120611 +nouveau_object_create__63715 nouveau_object_create_ 5 63715 NULL
120612 +btrfs_insert_delayed_dir_index_63720 btrfs_insert_delayed_dir_index 4 63720 NULL
120613 +selinux_secctx_to_secid_63744 selinux_secctx_to_secid 2 63744 NULL
120614 +snd_pcm_oss_read1_63771 snd_pcm_oss_read1 3 63771 NULL
120615 +snd_opl4_mem_proc_read_63774 snd_opl4_mem_proc_read 5 63774 NULL
120616 +spidev_compat_ioctl_63778 spidev_compat_ioctl 2 63778 NULL
120617 +mwifiex_11n_create_rx_reorder_tbl_63806 mwifiex_11n_create_rx_reorder_tbl 4 63806 NULL
120618 +copy_nodes_to_user_63807 copy_nodes_to_user 2 63807 NULL
120619 +sel_write_load_63830 sel_write_load 3 63830 NULL
120620 +ll_readlink_63836 ll_readlink 3 63836 NULL
120621 +proc_pid_attr_write_63845 proc_pid_attr_write 3 63845 NULL
120622 +xhci_alloc_stream_info_63902 xhci_alloc_stream_info 3 63902 NULL
120623 +uvc_alloc_urb_buffers_63922 uvc_alloc_urb_buffers 0-2-3 63922 NULL
120624 +snd_compr_write_63923 snd_compr_write 3 63923 NULL
120625 +afs_send_simple_reply_63940 afs_send_simple_reply 3 63940 NULL
120626 +__team_options_register_63941 __team_options_register 3 63941 NULL
120627 +macvtap_recvmsg_63949 macvtap_recvmsg 4 63949 NULL
120628 +xfs_iflush_63956 xfs_iflush 0 63956 NULL
120629 +set_bredr_63975 set_bredr 4 63975 NULL
120630 +construct_key_and_link_63985 construct_key_and_link 3 63985 NULL
120631 +rs_extent_to_bm_page_63996 rs_extent_to_bm_page 0-1 63996 NULL
120632 +read_file_frameerrors_64001 read_file_frameerrors 3 64001 NULL
120633 +SyS_rt_sigpending_64018 SyS_rt_sigpending 2 64018 NULL
120634 +dbAllocDmapLev_64030 dbAllocDmapLev 0 64030 NULL
120635 +SyS_fsetxattr_64039 SyS_fsetxattr 4 64039 NULL
120636 +__generic_file_aio_write_64049 __generic_file_aio_write 0 64049 NULL
120637 +get_u8_64076 get_u8 0 64076 NULL
120638 +xilly_malloc_64077 xilly_malloc 2 64077 NULL
120639 +sl_realloc_bufs_64086 sl_realloc_bufs 2 64086 NULL
120640 +vmci_handle_arr_get_size_64088 vmci_handle_arr_get_size 0 64088 NULL
120641 +lbs_highrssi_read_64089 lbs_highrssi_read 3 64089 NULL
120642 +gfs2_inplace_reserve_64096 gfs2_inplace_reserve 0 64096 NULL nohasharray
120643 +SyS_set_mempolicy_64096 SyS_set_mempolicy 3 64096 &gfs2_inplace_reserve_64096
120644 +to_bytes_64103 to_bytes 0-1 64103 NULL
120645 +SyS_mq_timedsend_64107 SyS_mq_timedsend 3 64107 NULL
120646 +rdma_addr_size_64116 rdma_addr_size 0 64116 NULL
120647 +do_load_xattr_datum_64118 do_load_xattr_datum 0 64118 NULL
120648 +bypass_wd_write_64120 bypass_wd_write 3 64120 NULL
120649 +ext4_prepare_inline_data_64124 ext4_prepare_inline_data 3 64124 NULL
120650 +init_bch_64130 init_bch 1-2 64130 NULL
120651 +ablkcipher_copy_iv_64140 ablkcipher_copy_iv 3 64140 NULL
120652 +dlfb_ops_write_64150 dlfb_ops_write 3 64150 NULL
120653 +cpumask_scnprintf_64170 cpumask_scnprintf 0-2 64170 NULL
120654 +kernfs_iop_setxattr_64220 kernfs_iop_setxattr 4 64220 NULL
120655 +xfs_vm_direct_IO_64223 xfs_vm_direct_IO 4 64223 NULL
120656 +read_pulse_64227 read_pulse 0-3 64227 NULL
120657 +ea_len_64229 ea_len 0 64229 NULL
120658 +xfs_rtmodify_summary_64265 xfs_rtmodify_summary 0 64265 NULL
120659 +io_capture_transfer_64276 io_capture_transfer 4 64276 NULL
120660 +btrfs_file_extent_offset_64278 btrfs_file_extent_offset 0 64278 NULL
120661 +sta_current_tx_rate_read_64286 sta_current_tx_rate_read 3 64286 NULL
120662 +xfs_dir_cilookup_result_64288 xfs_dir_cilookup_result 3-0 64288 NULL nohasharray
120663 +event_id_read_64288 event_id_read 3 64288 &xfs_dir_cilookup_result_64288
120664 +ocfs2_block_check_validate_bhs_64302 ocfs2_block_check_validate_bhs 0 64302 NULL
120665 +snd_hda_get_sub_nodes_64304 snd_hda_get_sub_nodes 0 64304 NULL
120666 +error_error_bar_retry_read_64305 error_error_bar_retry_read 3 64305 NULL
120667 +sisusbcon_clear_64329 sisusbcon_clear 4-3-5 64329 NULL
120668 +ts_write_64336 ts_write 3 64336 NULL
120669 +usbtmc_write_64340 usbtmc_write 3 64340 NULL
120670 +bnx2x_vfop_mcast_cmd_64354 bnx2x_vfop_mcast_cmd 5 64354 NULL
120671 +user_regset_copyin_64360 user_regset_copyin 7 64360 NULL
120672 +wlc_phy_loadsampletable_nphy_64367 wlc_phy_loadsampletable_nphy 3 64367 NULL
120673 +reg_create_64372 reg_create 5 64372 NULL
120674 +ilo_write_64378 ilo_write 3 64378 NULL
120675 +btrfs_map_block_64379 btrfs_map_block 3 64379 NULL
120676 +vmcs_readl_64381 vmcs_readl 0 64381 NULL
120677 +nilfs_alloc_seg_bio_64383 nilfs_alloc_seg_bio 3 64383 NULL
120678 +ir_lirc_transmit_ir_64403 ir_lirc_transmit_ir 3 64403 NULL
120679 +pidlist_allocate_64404 pidlist_allocate 1 64404 NULL
120680 +rx_hdr_overflow_read_64407 rx_hdr_overflow_read 3 64407 NULL
120681 +snd_card_create_64418 snd_card_create 4 64418 NULL nohasharray
120682 +keyctl_get_security_64418 keyctl_get_security 3 64418 &snd_card_create_64418
120683 +oom_adj_write_64428 oom_adj_write 3 64428 NULL
120684 +read_file_spectral_short_repeat_64431 read_file_spectral_short_repeat 3 64431 NULL
120685 +ax25_recvmsg_64441 ax25_recvmsg 4 64441 NULL
120686 +single_open_size_64483 single_open_size 4 64483 NULL
120687 +p54_parse_rssical_64493 p54_parse_rssical 3 64493 NULL nohasharray
120688 +xfs_inode_ag_walk_64493 xfs_inode_ag_walk 0 64493 &p54_parse_rssical_64493
120689 +msg_data_sz_64503 msg_data_sz 0 64503 NULL
120690 +remove_uuid_64505 remove_uuid 4 64505 NULL
120691 +crypto_blkcipher_alignmask_64520 crypto_blkcipher_alignmask 0 64520 NULL
120692 +opera1_usb_i2c_msgxfer_64521 opera1_usb_i2c_msgxfer 4 64521 NULL
120693 +iwl_dbgfs_ucode_tracing_write_64524 iwl_dbgfs_ucode_tracing_write 3 64524 NULL
120694 +ses_send_diag_64527 ses_send_diag 4 64527 NULL
120695 +prctl_set_mm_64538 prctl_set_mm 3 64538 NULL
120696 +SyS_bind_64544 SyS_bind 3 64544 NULL
120697 +rbd_obj_read_sync_64554 rbd_obj_read_sync 4-3 64554 NULL
120698 +__btrfs_prealloc_file_range_64557 __btrfs_prealloc_file_range 3 64557 NULL
120699 +__spi_sync_64561 __spi_sync 0 64561 NULL nohasharray
120700 +ll_max_rw_chunk_seq_write_64561 ll_max_rw_chunk_seq_write 3 64561 &__spi_sync_64561
120701 +__apei_exec_run_64563 __apei_exec_run 0 64563 NULL
120702 +kstrtoul_from_user_64569 kstrtoul_from_user 2 64569 NULL
120703 +do_erase_64574 do_erase 4 64574 NULL
120704 +fanotify_write_64623 fanotify_write 3 64623 NULL
120705 +regmap_read_debugfs_64658 regmap_read_debugfs 5 64658 NULL
120706 +ocfs2_read_xattr_block_64661 ocfs2_read_xattr_block 0 64661 NULL nohasharray
120707 +tlbflush_read_file_64661 tlbflush_read_file 3 64661 &ocfs2_read_xattr_block_64661
120708 +efx_tsoh_get_buffer_64664 efx_tsoh_get_buffer 3 64664 NULL
120709 +rx_rx_out_of_mpdu_nodes_read_64668 rx_rx_out_of_mpdu_nodes_read 3 64668 NULL
120710 +nr_free_zone_pages_64680 nr_free_zone_pages 0 64680 NULL
120711 +snd_pcm_oss_capture_position_fixup_64713 snd_pcm_oss_capture_position_fixup 0 64713 NULL
120712 +dapm_bias_read_file_64715 dapm_bias_read_file 3 64715 NULL
120713 +atomic_add_return_64720 atomic_add_return 0-1 64720 NULL
120714 +i2400m_msg_to_dev_64722 i2400m_msg_to_dev 3 64722 NULL
120715 +AscGetChipVersion_64737 AscGetChipVersion 0 64737 NULL
120716 +squashfs_read_inode_lookup_table_64739 squashfs_read_inode_lookup_table 4 64739 NULL
120717 +bio_map_kern_64751 bio_map_kern 3 64751 NULL
120718 +rt2x00debug_write_csr_64753 rt2x00debug_write_csr 3 64753 NULL
120719 +message_for_md_64777 message_for_md 5 64777 NULL
120720 +isr_low_rssi_read_64789 isr_low_rssi_read 3 64789 NULL
120721 +regmap_reg_ranges_read_file_64798 regmap_reg_ranges_read_file 3 64798 NULL
120722 +nfsctl_transaction_write_64800 nfsctl_transaction_write 3 64800 NULL
120723 +rfkill_fop_write_64808 rfkill_fop_write 3 64808 NULL
120724 +proc_projid_map_write_64810 proc_projid_map_write 3 64810 NULL
120725 +megaraid_change_queue_depth_64815 megaraid_change_queue_depth 2 64815 NULL
120726 +ecryptfs_send_miscdev_64816 ecryptfs_send_miscdev 2 64816 NULL
120727 +do_kimage_alloc_64827 do_kimage_alloc 3 64827 NULL
120728 +altera_set_dr_pre_64862 altera_set_dr_pre 2 64862 NULL
120729 +pci_vc_do_save_buffer_64876 pci_vc_do_save_buffer 0 64876 NULL
120730 +lprocfs_write_u64_helper_64880 lprocfs_write_u64_helper 2 64880 NULL
120731 +ffs_epfile_io_64886 ffs_epfile_io 3 64886 NULL
120732 +xfs_imap_lookup_64906 xfs_imap_lookup 0 64906 NULL
120733 +ieee80211_if_read_ave_beacon_64924 ieee80211_if_read_ave_beacon 3 64924 NULL
120734 +ip_options_get_from_user_64958 ip_options_get_from_user 4 64958 NULL
120735 +traceprobe_probes_write_64969 traceprobe_probes_write 3 64969 NULL
120736 +suspend_dtim_interval_read_64971 suspend_dtim_interval_read 3 64971 NULL
120737 +crypto_ahash_digestsize_65014 crypto_ahash_digestsize 0 65014 NULL
120738 +insert_dent_65034 insert_dent 7 65034 NULL
120739 +snd_hda_get_pin_label_65035 snd_hda_get_pin_label 5 65035 NULL
120740 +ext4_ind_trans_blocks_65053 ext4_ind_trans_blocks 0-2 65053 NULL
120741 +pcibios_enable_device_65059 pcibios_enable_device 0 65059 NULL
120742 +__alloc_bootmem_node_high_65076 __alloc_bootmem_node_high 2 65076 NULL
120743 +batadv_socket_write_65083 batadv_socket_write 3 65083 NULL
120744 +ocfs2_truncate_cluster_pages_65086 ocfs2_truncate_cluster_pages 2 65086 NULL
120745 +ath9k_dump_mci_btcoex_65090 ath9k_dump_mci_btcoex 3-0 65090 NULL
120746 +generic_ocp_write_65107 generic_ocp_write 4 65107 NULL
120747 +__xfs_bmapi_allocate_65142 __xfs_bmapi_allocate 0 65142 NULL
120748 +rx_rx_done_read_65217 rx_rx_done_read 3 65217 NULL
120749 +print_endpoint_stat_65232 print_endpoint_stat 3-4-0 65232 NULL
120750 +whci_n_caps_65247 whci_n_caps 0 65247 NULL
120751 +kmalloc_parameter_65279 kmalloc_parameter 1 65279 NULL
120752 +xfs_btree_check_ptr_65281 xfs_btree_check_ptr 0 65281 NULL
120753 +compat_core_sys_select_65285 compat_core_sys_select 1 65285 NULL
120754 +mpi_set_buffer_65294 mpi_set_buffer 3 65294 NULL
120755 +redirected_tty_write_65297 redirected_tty_write 3 65297 NULL
120756 +get_var_len_65304 get_var_len 0 65304 NULL
120757 +unpack_array_65318 unpack_array 0 65318 NULL
120758 +pci_vpd_find_tag_65325 pci_vpd_find_tag 0-2 65325 NULL
120759 +dccp_setsockopt_service_65336 dccp_setsockopt_service 4 65336 NULL
120760 +dma_rx_requested_read_65354 dma_rx_requested_read 3 65354 NULL
120761 +alloc_cpu_rmap_65363 alloc_cpu_rmap 1 65363 NULL
120762 +SyS_writev_65372 SyS_writev 3 65372 NULL
120763 +__alloc_bootmem_nopanic_65397 __alloc_bootmem_nopanic 1 65397 NULL
120764 +trace_seq_to_user_65398 trace_seq_to_user 3 65398 NULL
120765 +__read_vmcore_65402 __read_vmcore 2 65402 NULL
120766 +usb_ep_enable_65405 usb_ep_enable 0 65405 NULL
120767 +ocfs2_write_begin_nolock_65410 ocfs2_write_begin_nolock 3-4 65410 NULL
120768 +device_add_groups_65423 device_add_groups 0 65423 NULL
120769 +xpc_kzalloc_cacheline_aligned_65433 xpc_kzalloc_cacheline_aligned 1 65433 NULL
120770 +usb_alloc_coherent_65444 usb_alloc_coherent 2 65444 NULL
120771 +il_dbgfs_wd_timeout_write_65464 il_dbgfs_wd_timeout_write 3 65464 NULL
120772 +clear_user_65470 clear_user 2 65470 NULL
120773 +xfs_alloc_lookup_ge_65481 xfs_alloc_lookup_ge 0 65481 NULL
120774 +dpcm_state_read_file_65489 dpcm_state_read_file 3 65489 NULL
120775 +lookup_inline_extent_backref_65493 lookup_inline_extent_backref 9 65493 NULL
120776 +nvme_trans_standard_inquiry_page_65526 nvme_trans_standard_inquiry_page 4 65526 NULL
120777 +tree_mod_log_eb_copy_65535 tree_mod_log_eb_copy 6 65535 NULL
120778 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data b/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data
120779 new file mode 100644
120780 index 0000000..560cd7b
120781 --- /dev/null
120782 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash_aux.data
120783 @@ -0,0 +1,92 @@
120784 +spa_set_aux_vdevs_746 spa_set_aux_vdevs 3 746 NULL
120785 +zfs_lookup_2144 zfs_lookup 0 2144 NULL
120786 +mappedread_2627 mappedread 2 2627 NULL
120787 +vdev_disk_dio_alloc_2957 vdev_disk_dio_alloc 1 2957 NULL
120788 +nv_alloc_pushpage_spl_4286 nv_alloc_pushpage_spl 2 4286 NULL
120789 +zpl_xattr_get_4574 zpl_xattr_get 0 4574 NULL
120790 +sa_replace_all_by_template_5699 sa_replace_all_by_template 3 5699 NULL
120791 +dmu_write_6048 dmu_write 4-3 6048 NULL
120792 +dmu_buf_hold_array_6095 dmu_buf_hold_array 4-3 6095 NULL
120793 +update_pages_6225 update_pages 2-3 6225 NULL
120794 +bio_nr_pages_7117 bio_nr_pages 0-2 7117 NULL
120795 +dmu_buf_hold_array_by_bonus_8562 dmu_buf_hold_array_by_bonus 3-2 8562 NULL
120796 +zpios_dmu_write_8858 zpios_dmu_write 4-5 8858 NULL
120797 +ddi_copyout_9401 ddi_copyout 3 9401 NULL
120798 +avl_numnodes_12384 avl_numnodes 0 12384 NULL
120799 +dmu_write_uio_dnode_12473 dmu_write_uio_dnode 3 12473 NULL
120800 +dmu_xuio_init_12866 dmu_xuio_init 2 12866 NULL
120801 +zpl_read_common_14389 zpl_read_common 0 14389 NULL
120802 +dmu_snapshot_realname_14632 dmu_snapshot_realname 4 14632 NULL
120803 +kmem_alloc_debug_14852 kmem_alloc_debug 1 14852 NULL
120804 +kmalloc_node_nofail_15151 kmalloc_node_nofail 1 15151 NULL
120805 +dmu_write_uio_16351 dmu_write_uio 4 16351 NULL
120806 +zfs_log_write_16524 zfs_log_write 6-5 16524 NULL
120807 +sa_build_layouts_16910 sa_build_layouts 3 16910 NULL
120808 +dsl_dir_namelen_17053 dsl_dir_namelen 0 17053 NULL
120809 +kcopy_copy_to_user_17336 kcopy_copy_to_user 5 17336 NULL
120810 +sa_add_layout_entry_17507 sa_add_layout_entry 3 17507 NULL
120811 +sa_attr_table_setup_18029 sa_attr_table_setup 3 18029 NULL
120812 +uiocopy_18680 uiocopy 2 18680 NULL
120813 +dmu_buf_hold_array_by_dnode_19125 dmu_buf_hold_array_by_dnode 2-3 19125 NULL
120814 +zpl_acl_from_xattr_21141 zpl_acl_from_xattr 2 21141 NULL
120815 +dsl_pool_tx_assign_init_22518 dsl_pool_tx_assign_init 2 22518 NULL
120816 +nvlist_lookup_byte_array_22527 nvlist_lookup_byte_array 0 22527 NULL
120817 +sa_replace_all_by_template_locked_22533 sa_replace_all_by_template_locked 3 22533 NULL
120818 +tsd_hash_table_init_22559 tsd_hash_table_init 1 22559 NULL
120819 +spa_vdev_remove_aux_23966 spa_vdev_remove_aux 4 23966 NULL
120820 +zpl_xattr_acl_set_access_24129 zpl_xattr_acl_set_access 4 24129 NULL
120821 +dmu_assign_arcbuf_24622 dmu_assign_arcbuf 2 24622 NULL
120822 +zap_lookup_norm_25166 zap_lookup_norm 9 25166 NULL
120823 +dmu_prealloc_25456 dmu_prealloc 4-3 25456 NULL
120824 +kmalloc_nofail_26347 kmalloc_nofail 1 26347 NULL
120825 +zfsctl_snapshot_zpath_27578 zfsctl_snapshot_zpath 2 27578 NULL
120826 +zpios_dmu_read_30015 zpios_dmu_read 4-5 30015 NULL
120827 +splat_write_30943 splat_write 3 30943 NULL
120828 +zpl_xattr_get_sa_31183 zpl_xattr_get_sa 0 31183 NULL
120829 +dmu_read_uio_31467 dmu_read_uio 4 31467 NULL
120830 +zfs_replay_fuids_31479 zfs_replay_fuids 4 31479 NULL
120831 +spa_history_log_to_phys_31632 spa_history_log_to_phys 0-1 31632 NULL
120832 +__zpl_xattr_get_32601 __zpl_xattr_get 0 32601 NULL
120833 +proc_copyout_string_34049 proc_copyout_string 2 34049 NULL
120834 +nv_alloc_sleep_spl_34544 nv_alloc_sleep_spl 2 34544 NULL
120835 +nv_alloc_nosleep_spl_34761 nv_alloc_nosleep_spl 2 34761 NULL
120836 +zap_leaf_array_match_36922 zap_leaf_array_match 4 36922 NULL
120837 +copyinstr_36980 copyinstr 3 36980 NULL
120838 +zpl_xattr_acl_set_default_37864 zpl_xattr_acl_set_default 4 37864 NULL
120839 +splat_read_38116 splat_read 3 38116 NULL
120840 +sa_setup_38756 sa_setup 4 38756 NULL
120841 +vdev_disk_physio_39898 vdev_disk_physio 3 39898 NULL
120842 +arc_buf_size_39982 arc_buf_size 0 39982 NULL
120843 +kzalloc_nofail_40719 kzalloc_nofail 1 40719 NULL
120844 +fuidstr_to_sid_40777 fuidstr_to_sid 4 40777 NULL
120845 +vdev_raidz_matrix_reconstruct_40852 vdev_raidz_matrix_reconstruct 2-3 40852 NULL
120846 +sa_find_layout_40892 sa_find_layout 4 40892 NULL
120847 +zpl_xattr_get_dir_41918 zpl_xattr_get_dir 0 41918 NULL
120848 +zfs_sa_get_xattr_42600 zfs_sa_get_xattr 0 42600 NULL
120849 +zpl_xattr_acl_set_42808 zpl_xattr_acl_set 4 42808 NULL
120850 +xdr_dec_array_43091 xdr_dec_array 5 43091 NULL
120851 +dsl_dataset_namelen_43136 dsl_dataset_namelen 0 43136 NULL
120852 +kcopy_write_43683 kcopy_write 3 43683 NULL
120853 +uiomove_44355 uiomove 2 44355 NULL
120854 +dmu_read_44418 dmu_read 4-3 44418 NULL
120855 +ddi_copyin_44846 ddi_copyin 3 44846 NULL
120856 +kcopy_do_get_45061 kcopy_do_get 5 45061 NULL
120857 +copyin_45945 copyin 3 45945 NULL
120858 +zil_itx_create_46555 zil_itx_create 2 46555 NULL
120859 +dmu_write_uio_dbuf_48064 dmu_write_uio_dbuf 3 48064 NULL
120860 +blk_rq_pos_48233 blk_rq_pos 0 48233 NULL
120861 +spa_history_write_49650 spa_history_write 3 49650 NULL
120862 +kcopy_copy_pages_to_user_49823 kcopy_copy_pages_to_user 3-4 49823 NULL
120863 +zfs_log_write_50162 zfs_log_write 6-5 50162 NULL
120864 +i_fm_alloc_51038 i_fm_alloc 2 51038 NULL
120865 +copyout_51409 copyout 3 51409 NULL
120866 +zvol_log_write_54898 zvol_log_write 4-3 54898 NULL
120867 +zfs_acl_node_alloc_55641 zfs_acl_node_alloc 1 55641 NULL
120868 +get_nvlist_56685 get_nvlist 2 56685 NULL
120869 +zprop_get_numprops_56820 zprop_get_numprops 0 56820 NULL
120870 +splat_taskq_test4_common_59829 splat_taskq_test4_common 5 59829 NULL
120871 +zfs_replay_domain_cnt_61399 zfs_replay_domain_cnt 0 61399 NULL
120872 +zpios_write_61823 zpios_write 3 61823 NULL
120873 +proc_copyin_string_62019 proc_copyin_string 4 62019 NULL
120874 +random_get_pseudo_bytes_64611 random_get_pseudo_bytes 2 64611 NULL
120875 +zpios_read_64734 zpios_read 3 64734 NULL
120876 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
120877 new file mode 100644
120878 index 0000000..e6fe17b
120879 --- /dev/null
120880 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
120881 @@ -0,0 +1,259 @@
120882 +/*
120883 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
120884 + * Licensed under the GPL v2, or (at your option) v3
120885 + *
120886 + * Homepage:
120887 + * http://www.grsecurity.net/~ephox/overflow_plugin/
120888 + *
120889 + * Documentation:
120890 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
120891 + *
120892 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
120893 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
120894 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
120895 + *
120896 + * Usage:
120897 + * $ make
120898 + * $ make run
120899 + */
120900 +
120901 +#include "gcc-common.h"
120902 +#include "size_overflow.h"
120903 +
120904 +int plugin_is_GPL_compatible;
120905 +
120906 +tree report_size_overflow_decl;
120907 +
120908 +tree size_overflow_type_HI;
120909 +tree size_overflow_type_SI;
120910 +tree size_overflow_type_DI;
120911 +tree size_overflow_type_TI;
120912 +
120913 +static struct plugin_info size_overflow_plugin_info = {
120914 + .version = "20140517",
120915 + .help = "no-size-overflow\tturn off size overflow checking\n",
120916 +};
120917 +
120918 +static tree handle_size_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
120919 +{
120920 + unsigned int arg_count;
120921 + enum tree_code code = TREE_CODE(*node);
120922 +
120923 + switch (code) {
120924 + case FUNCTION_DECL:
120925 + arg_count = type_num_arguments(TREE_TYPE(*node));
120926 + break;
120927 + case FUNCTION_TYPE:
120928 + case METHOD_TYPE:
120929 + arg_count = type_num_arguments(*node);
120930 + break;
120931 + default:
120932 + *no_add_attrs = true;
120933 + error("%s: %qE attribute only applies to functions", __func__, name);
120934 + return NULL_TREE;
120935 + }
120936 +
120937 + for (; args; args = TREE_CHAIN(args)) {
120938 + tree position = TREE_VALUE(args);
120939 + if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_LOW(position) > arg_count ) {
120940 + error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
120941 + *no_add_attrs = true;
120942 + }
120943 + }
120944 + return NULL_TREE;
120945 +}
120946 +
120947 +static tree handle_intentional_overflow_attribute(tree *node, tree __unused name, tree args, int __unused flags, bool *no_add_attrs)
120948 +{
120949 + unsigned int arg_count;
120950 + enum tree_code code = TREE_CODE(*node);
120951 +
120952 + switch (code) {
120953 + case FUNCTION_DECL:
120954 + arg_count = type_num_arguments(TREE_TYPE(*node));
120955 + break;
120956 + case FUNCTION_TYPE:
120957 + case METHOD_TYPE:
120958 + arg_count = type_num_arguments(*node);
120959 + break;
120960 + case FIELD_DECL:
120961 + return NULL_TREE;
120962 + default:
120963 + *no_add_attrs = true;
120964 + error("%qE attribute only applies to functions", name);
120965 + return NULL_TREE;
120966 + }
120967 +
120968 + if (TREE_INT_CST_HIGH(TREE_VALUE(args)) != 0)
120969 + return NULL_TREE;
120970 +
120971 + for (; args; args = TREE_CHAIN(args)) {
120972 + tree position = TREE_VALUE(args);
120973 + if (TREE_CODE(position) != INTEGER_CST || TREE_INT_CST_LOW(position) > arg_count ) {
120974 + error("%s: parameter %u is outside range.", __func__, (unsigned int)TREE_INT_CST_LOW(position));
120975 + *no_add_attrs = true;
120976 + }
120977 + }
120978 + return NULL_TREE;
120979 +}
120980 +
120981 +static struct attribute_spec size_overflow_attr = {
120982 + .name = "size_overflow",
120983 + .min_length = 1,
120984 + .max_length = -1,
120985 + .decl_required = true,
120986 + .type_required = false,
120987 + .function_type_required = false,
120988 + .handler = handle_size_overflow_attribute,
120989 +#if BUILDING_GCC_VERSION >= 4007
120990 + .affects_type_identity = false
120991 +#endif
120992 +};
120993 +
120994 +static struct attribute_spec intentional_overflow_attr = {
120995 + .name = "intentional_overflow",
120996 + .min_length = 1,
120997 + .max_length = -1,
120998 + .decl_required = true,
120999 + .type_required = false,
121000 + .function_type_required = false,
121001 + .handler = handle_intentional_overflow_attribute,
121002 +#if BUILDING_GCC_VERSION >= 4007
121003 + .affects_type_identity = false
121004 +#endif
121005 +};
121006 +
121007 +static void register_attributes(void __unused *event_data, void __unused *data)
121008 +{
121009 + register_attribute(&size_overflow_attr);
121010 + register_attribute(&intentional_overflow_attr);
121011 +}
121012 +
121013 +static tree create_typedef(tree type, const char* ident)
121014 +{
121015 + tree new_type, decl;
121016 +
121017 + new_type = build_variant_type_copy(type);
121018 + decl = build_decl(BUILTINS_LOCATION, TYPE_DECL, get_identifier(ident), new_type);
121019 + DECL_ORIGINAL_TYPE(decl) = type;
121020 + TYPE_NAME(new_type) = decl;
121021 + return new_type;
121022 +}
121023 +
121024 +// Create the noreturn report_size_overflow() function decl.
121025 +static void size_overflow_start_unit(void __unused *gcc_data, void __unused *user_data)
121026 +{
121027 + tree const_char_ptr_type_node;
121028 + tree fntype;
121029 +
121030 + const_char_ptr_type_node = build_pointer_type(build_type_variant(char_type_node, 1, 0));
121031 +
121032 + size_overflow_type_HI = create_typedef(intHI_type_node, "size_overflow_type_HI");
121033 + size_overflow_type_SI = create_typedef(intSI_type_node, "size_overflow_type_SI");
121034 + size_overflow_type_DI = create_typedef(intDI_type_node, "size_overflow_type_DI");
121035 + size_overflow_type_TI = create_typedef(intTI_type_node, "size_overflow_type_TI");
121036 +
121037 + // void report_size_overflow(const char *loc_file, unsigned int loc_line, const char *current_func, const char *ssa_var)
121038 + fntype = build_function_type_list(void_type_node,
121039 + const_char_ptr_type_node,
121040 + unsigned_type_node,
121041 + const_char_ptr_type_node,
121042 + const_char_ptr_type_node,
121043 + NULL_TREE);
121044 + report_size_overflow_decl = build_fn_decl("report_size_overflow", fntype);
121045 +
121046 + DECL_ASSEMBLER_NAME(report_size_overflow_decl);
121047 + TREE_PUBLIC(report_size_overflow_decl) = 1;
121048 + DECL_EXTERNAL(report_size_overflow_decl) = 1;
121049 + DECL_ARTIFICIAL(report_size_overflow_decl) = 1;
121050 + TREE_THIS_VOLATILE(report_size_overflow_decl) = 1;
121051 +}
121052 +
121053 +
121054 +extern struct gimple_opt_pass pass_dce;
121055 +
121056 +static struct opt_pass *make_dce_pass(void)
121057 +{
121058 +#if BUILDING_GCC_VERSION >= 4009
121059 + return make_pass_dce(g);
121060 +#else
121061 + return &pass_dce.pass;
121062 +#endif
121063 +}
121064 +
121065 +
121066 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
121067 +{
121068 + int i;
121069 + const char * const plugin_name = plugin_info->base_name;
121070 + const int argc = plugin_info->argc;
121071 + const struct plugin_argument * const argv = plugin_info->argv;
121072 + bool enable = true;
121073 + struct register_pass_info insert_size_overflow_asm_pass_info;
121074 + struct register_pass_info __unused dump_before_pass_info;
121075 + struct register_pass_info __unused dump_after_pass_info;
121076 + struct register_pass_info insert_size_overflow_check_info;
121077 + struct register_pass_info dce_pass_info;
121078 + static const struct ggc_root_tab gt_ggc_r_gt_size_overflow[] = {
121079 + {
121080 + .base = &report_size_overflow_decl,
121081 + .nelt = 1,
121082 + .stride = sizeof(report_size_overflow_decl),
121083 + .cb = &gt_ggc_mx_tree_node,
121084 + .pchw = &gt_pch_nx_tree_node
121085 + },
121086 + LAST_GGC_ROOT_TAB
121087 + };
121088 +
121089 + insert_size_overflow_asm_pass_info.pass = make_insert_size_overflow_asm_pass();
121090 + insert_size_overflow_asm_pass_info.reference_pass_name = "ssa";
121091 + insert_size_overflow_asm_pass_info.ref_pass_instance_number = 1;
121092 + insert_size_overflow_asm_pass_info.pos_op = PASS_POS_INSERT_AFTER;
121093 +
121094 + dump_before_pass_info.pass = make_dump_pass();
121095 + dump_before_pass_info.reference_pass_name = "increase_alignment";
121096 + dump_before_pass_info.ref_pass_instance_number = 1;
121097 + dump_before_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
121098 +
121099 + insert_size_overflow_check_info.pass = make_insert_size_overflow_check();
121100 + insert_size_overflow_check_info.reference_pass_name = "increase_alignment";
121101 + insert_size_overflow_check_info.ref_pass_instance_number = 1;
121102 + insert_size_overflow_check_info.pos_op = PASS_POS_INSERT_BEFORE;
121103 +
121104 + dump_after_pass_info.pass = make_dump_pass();
121105 + dump_after_pass_info.reference_pass_name = "increase_alignment";
121106 + dump_after_pass_info.ref_pass_instance_number = 1;
121107 + dump_after_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
121108 +
121109 + dce_pass_info.pass = make_dce_pass();
121110 + dce_pass_info.reference_pass_name = "vrp";
121111 + dce_pass_info.ref_pass_instance_number = 1;
121112 + dce_pass_info.pos_op = PASS_POS_INSERT_AFTER;
121113 +
121114 + if (!plugin_default_version_check(version, &gcc_version)) {
121115 + error(G_("incompatible gcc/plugin versions"));
121116 + return 1;
121117 + }
121118 +
121119 + for (i = 0; i < argc; ++i) {
121120 + if (!strcmp(argv[i].key, "no-size-overflow")) {
121121 + enable = false;
121122 + continue;
121123 + }
121124 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
121125 + }
121126 +
121127 + register_callback(plugin_name, PLUGIN_INFO, NULL, &size_overflow_plugin_info);
121128 + if (enable) {
121129 + register_callback(plugin_name, PLUGIN_START_UNIT, &size_overflow_start_unit, NULL);
121130 + register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_size_overflow);
121131 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_asm_pass_info);
121132 +// register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &dump_before_pass_info);
121133 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &insert_size_overflow_check_info);
121134 +// register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &dump_after_pass_info);
121135 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &dce_pass_info);
121136 + }
121137 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
121138 +
121139 + return 0;
121140 +}
121141 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
121142 new file mode 100644
121143 index 0000000..0888f6c
121144 --- /dev/null
121145 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin_hash.c
121146 @@ -0,0 +1,364 @@
121147 +/*
121148 + * Copyright 2011-2014 by Emese Revfy <re.emese@gmail.com>
121149 + * Licensed under the GPL v2, or (at your option) v3
121150 + *
121151 + * Homepage:
121152 + * http://www.grsecurity.net/~ephox/overflow_plugin/
121153 + *
121154 + * Documentation:
121155 + * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
121156 + *
121157 + * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
121158 + * with double integer precision (DImode/TImode for 32/64 bit integer types).
121159 + * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
121160 + *
121161 + * Usage:
121162 + * $ make
121163 + * $ make run
121164 + */
121165 +
121166 +#include "gcc-common.h"
121167 +#include "size_overflow.h"
121168 +
121169 +#include "size_overflow_hash.h"
121170 +#include "size_overflow_hash_aux.h"
121171 +
121172 +#define CODES_LIMIT 32
121173 +
121174 +static unsigned char get_tree_code(const_tree type)
121175 +{
121176 + switch (TREE_CODE(type)) {
121177 + case ARRAY_TYPE:
121178 + return 0;
121179 + case BOOLEAN_TYPE:
121180 + return 1;
121181 + case ENUMERAL_TYPE:
121182 + return 2;
121183 + case FUNCTION_TYPE:
121184 + return 3;
121185 + case INTEGER_TYPE:
121186 + return 4;
121187 + case POINTER_TYPE:
121188 + return 5;
121189 + case RECORD_TYPE:
121190 + return 6;
121191 + case UNION_TYPE:
121192 + return 7;
121193 + case VOID_TYPE:
121194 + return 8;
121195 + case REAL_TYPE:
121196 + return 9;
121197 + case VECTOR_TYPE:
121198 + return 10;
121199 + case REFERENCE_TYPE:
121200 + return 11;
121201 + case OFFSET_TYPE:
121202 + return 12;
121203 + case COMPLEX_TYPE:
121204 + return 13;
121205 + default:
121206 + debug_tree((tree)type);
121207 + gcc_unreachable();
121208 + }
121209 +}
121210 +
121211 +struct function_hash {
121212 + size_t tree_codes_len;
121213 + unsigned char tree_codes[CODES_LIMIT];
121214 + const_tree fndecl;
121215 + unsigned int hash;
121216 +};
121217 +
121218 +// http://www.team5150.com/~andrew/noncryptohashzoo2~/CrapWow.html
121219 +static unsigned int CrapWow(const char *key, unsigned int len, unsigned int seed)
121220 +{
121221 +#define cwfold( a, b, lo, hi ) { p = (unsigned int)(a) * (unsigned long long)(b); lo ^= (unsigned int)p; hi ^= (unsigned int)(p >> 32); }
121222 +#define cwmixa( in ) { cwfold( in, m, k, h ); }
121223 +#define cwmixb( in ) { cwfold( in, n, h, k ); }
121224 +
121225 + unsigned int m = 0x57559429;
121226 + unsigned int n = 0x5052acdb;
121227 + const unsigned int *key4 = (const unsigned int *)key;
121228 + unsigned int h = len;
121229 + unsigned int k = len + seed + n;
121230 + unsigned long long p;
121231 +
121232 + while (len >= 8) {
121233 + cwmixb(key4[0]) cwmixa(key4[1]) key4 += 2;
121234 + len -= 8;
121235 + }
121236 + if (len >= 4) {
121237 + cwmixb(key4[0]) key4 += 1;
121238 + len -= 4;
121239 + }
121240 + if (len)
121241 + cwmixa(key4[0] & ((1 << (len * 8)) - 1 ));
121242 + cwmixb(h ^ (k + n));
121243 + return k ^ h;
121244 +
121245 +#undef cwfold
121246 +#undef cwmixa
121247 +#undef cwmixb
121248 +}
121249 +
121250 +static void set_hash(const char *fn_name, struct function_hash *fn_hash_data)
121251 +{
121252 + unsigned int fn, codes, seed = 0;
121253 +
121254 + fn = CrapWow(fn_name, strlen(fn_name), seed) & 0xffff;
121255 + codes = CrapWow((const char*)fn_hash_data->tree_codes, fn_hash_data->tree_codes_len, seed) & 0xffff;
121256 +
121257 + fn_hash_data->hash = fn ^ codes;
121258 +}
121259 +
121260 +static void set_node_codes(const_tree type, struct function_hash *fn_hash_data)
121261 +{
121262 + gcc_assert(type != NULL_TREE);
121263 + gcc_assert(TREE_CODE_CLASS(TREE_CODE(type)) == tcc_type);
121264 +
121265 + while (type && fn_hash_data->tree_codes_len < CODES_LIMIT) {
121266 + fn_hash_data->tree_codes[fn_hash_data->tree_codes_len] = get_tree_code(type);
121267 + fn_hash_data->tree_codes_len++;
121268 + type = TREE_TYPE(type);
121269 + }
121270 +}
121271 +
121272 +static void set_result_codes(const_tree node, struct function_hash *fn_hash_data)
121273 +{
121274 + const_tree result;
121275 +
121276 + gcc_assert(node != NULL_TREE);
121277 +
121278 + if (DECL_P(node)) {
121279 + result = DECL_RESULT(node);
121280 + if (result != NULL_TREE)
121281 + return set_node_codes(TREE_TYPE(result), fn_hash_data);
121282 + return set_result_codes(TREE_TYPE(node), fn_hash_data);
121283 + }
121284 +
121285 + gcc_assert(TYPE_P(node));
121286 +
121287 + if (TREE_CODE(node) == FUNCTION_TYPE)
121288 + return set_result_codes(TREE_TYPE(node), fn_hash_data);
121289 +
121290 + return set_node_codes(node, fn_hash_data);
121291 +}
121292 +
121293 +static void set_function_codes(struct function_hash *fn_hash_data)
121294 +{
121295 + const_tree arg, type = TREE_TYPE(fn_hash_data->fndecl);
121296 + enum tree_code code = TREE_CODE(type);
121297 +
121298 + gcc_assert(code == FUNCTION_TYPE || code == METHOD_TYPE);
121299 +
121300 + set_result_codes(fn_hash_data->fndecl, fn_hash_data);
121301 +
121302 + for (arg = TYPE_ARG_TYPES(type); arg != NULL_TREE && fn_hash_data->tree_codes_len < CODES_LIMIT; arg = TREE_CHAIN(arg))
121303 + set_node_codes(TREE_VALUE(arg), fn_hash_data);
121304 +}
121305 +
121306 +static const struct size_overflow_hash *get_proper_hash_chain(const struct size_overflow_hash *entry, const char *func_name)
121307 +{
121308 + while (entry) {
121309 + if (!strcmp(entry->name, func_name))
121310 + return entry;
121311 + entry = entry->next;
121312 + }
121313 + return NULL;
121314 +}
121315 +
121316 +const struct size_overflow_hash *get_function_hash(const_tree fndecl)
121317 +{
121318 + const struct size_overflow_hash *entry;
121319 + struct function_hash fn_hash_data;
121320 + const char *func_name;
121321 +
121322 + // skip builtins __builtin_constant_p
121323 + if (DECL_BUILT_IN(fndecl))
121324 + return NULL;
121325 +
121326 + fn_hash_data.fndecl = fndecl;
121327 + fn_hash_data.tree_codes_len = 0;
121328 +
121329 + set_function_codes(&fn_hash_data);
121330 + gcc_assert(fn_hash_data.tree_codes_len != 0);
121331 +
121332 + func_name = DECL_NAME_POINTER(fn_hash_data.fndecl);
121333 + set_hash(func_name, &fn_hash_data);
121334 +
121335 + entry = size_overflow_hash[fn_hash_data.hash];
121336 + entry = get_proper_hash_chain(entry, func_name);
121337 + if (entry)
121338 + return entry;
121339 + entry = size_overflow_hash_aux[fn_hash_data.hash];
121340 + return get_proper_hash_chain(entry, func_name);
121341 +}
121342 +
121343 +static void print_missing_msg(const_tree func, unsigned int argnum)
121344 +{
121345 + location_t loc;
121346 + const char *curfunc;
121347 + struct function_hash fn_hash_data;
121348 +
121349 + fn_hash_data.fndecl = DECL_ORIGIN(func);
121350 + fn_hash_data.tree_codes_len = 0;
121351 +
121352 + loc = DECL_SOURCE_LOCATION(fn_hash_data.fndecl);
121353 + curfunc = DECL_NAME_POINTER(fn_hash_data.fndecl);
121354 +
121355 + set_function_codes(&fn_hash_data);
121356 + set_hash(curfunc, &fn_hash_data);
121357 +
121358 + inform(loc, "Function %s is missing from the size_overflow hash table +%s+%u+%u+", curfunc, curfunc, argnum, fn_hash_data.hash);
121359 +}
121360 +
121361 +unsigned int find_arg_number_tree(const_tree arg, const_tree func)
121362 +{
121363 + tree var;
121364 + unsigned int argnum = 1;
121365 +
121366 + if (TREE_CODE(arg) == SSA_NAME)
121367 + arg = SSA_NAME_VAR(arg);
121368 +
121369 + for (var = DECL_ARGUMENTS(func); var; var = TREE_CHAIN(var), argnum++) {
121370 + if (!operand_equal_p(arg, var, 0) && strcmp(DECL_NAME_POINTER(var), DECL_NAME_POINTER(arg)))
121371 + continue;
121372 + if (!skip_types(var))
121373 + return argnum;
121374 + }
121375 +
121376 + return CANNOT_FIND_ARG;
121377 +}
121378 +
121379 +static const char *get_asm_string(const_gimple stmt)
121380 +{
121381 + if (!stmt)
121382 + return NULL;
121383 + if (gimple_code(stmt) != GIMPLE_ASM)
121384 + return NULL;
121385 +
121386 + return gimple_asm_string(stmt);
121387 +}
121388 +
121389 +bool is_size_overflow_intentional_asm_turn_off(const_gimple stmt)
121390 +{
121391 + const char *str;
121392 +
121393 + str = get_asm_string(stmt);
121394 + if (!str)
121395 + return false;
121396 + return !strncmp(str, TURN_OFF_ASM_STR, sizeof(TURN_OFF_ASM_STR) - 1);
121397 +}
121398 +
121399 +bool is_size_overflow_intentional_asm_yes(const_gimple stmt)
121400 +{
121401 + const char *str;
121402 +
121403 + str = get_asm_string(stmt);
121404 + if (!str)
121405 + return false;
121406 + return !strncmp(str, YES_ASM_STR, sizeof(YES_ASM_STR) - 1);
121407 +}
121408 +
121409 +bool is_size_overflow_asm(const_gimple stmt)
121410 +{
121411 + const char *str;
121412 +
121413 + str = get_asm_string(stmt);
121414 + if (!str)
121415 + return false;
121416 + return !strncmp(str, OK_ASM_STR, sizeof(OK_ASM_STR) - 1);
121417 +}
121418 +
121419 +bool is_a_return_check(const_tree node)
121420 +{
121421 + if (TREE_CODE(node) == FUNCTION_DECL)
121422 + return true;
121423 +
121424 + gcc_assert(TREE_CODE(node) == PARM_DECL);
121425 + return false;
121426 +}
121427 +
121428 +// Get the argnum of a function decl, if node is a return then the argnum is 0
121429 +unsigned int get_function_num(const_tree node, const_tree orig_fndecl)
121430 +{
121431 + if (is_a_return_check(node))
121432 + return 0;
121433 + else
121434 + return find_arg_number_tree(node, orig_fndecl);
121435 +}
121436 +
121437 +unsigned int get_correct_arg_count(unsigned int argnum, const_tree fndecl)
121438 +{
121439 + const struct size_overflow_hash *hash;
121440 + unsigned int new_argnum;
121441 + tree arg;
121442 + const_tree origarg;
121443 +
121444 + if (argnum == 0)
121445 + return argnum;
121446 +
121447 + hash = get_function_hash(fndecl);
121448 + if (hash && hash->param & (1U << argnum))
121449 + return argnum;
121450 +
121451 + if (DECL_EXTERNAL(fndecl))
121452 + return argnum;
121453 +
121454 + origarg = DECL_ARGUMENTS(DECL_ORIGIN(fndecl));
121455 + argnum--;
121456 + while (origarg && argnum) {
121457 + origarg = TREE_CHAIN(origarg);
121458 + argnum--;
121459 + }
121460 + gcc_assert(argnum == 0);
121461 + gcc_assert(origarg != NULL_TREE);
121462 +
121463 + for (arg = DECL_ARGUMENTS(fndecl), new_argnum = 1; arg; arg = TREE_CHAIN(arg), new_argnum++)
121464 + if (operand_equal_p(origarg, arg, 0) || !strcmp(DECL_NAME_POINTER(origarg), DECL_NAME_POINTER(arg)))
121465 + return new_argnum;
121466 +
121467 + return CANNOT_FIND_ARG;
121468 +}
121469 +
121470 +static bool is_in_hash_table(const_tree fndecl, unsigned int num)
121471 +{
121472 + const struct size_overflow_hash *hash;
121473 +
121474 + hash = get_function_hash(fndecl);
121475 + if (hash && (hash->param & (1U << num)))
121476 + return true;
121477 + return false;
121478 +}
121479 +
121480 +/* Check if the function has a size_overflow attribute or it is in the size_overflow hash table.
121481 + * If the function is missing everywhere then print the missing message into stderr.
121482 + */
121483 +bool is_missing_function(const_tree orig_fndecl, unsigned int num)
121484 +{
121485 + switch (DECL_FUNCTION_CODE(orig_fndecl)) {
121486 +#if BUILDING_GCC_VERSION >= 4008
121487 + case BUILT_IN_BSWAP16:
121488 +#endif
121489 + case BUILT_IN_BSWAP32:
121490 + case BUILT_IN_BSWAP64:
121491 + case BUILT_IN_EXPECT:
121492 + case BUILT_IN_MEMCMP:
121493 + return false;
121494 + default:
121495 + break;
121496 + }
121497 +
121498 + // skip test.c
121499 + if (strcmp(DECL_NAME_POINTER(current_function_decl), "coolmalloc")) {
121500 + if (lookup_attribute("size_overflow", DECL_ATTRIBUTES(orig_fndecl)))
121501 + warning(0, "unnecessary size_overflow attribute on: %s\n", DECL_NAME_POINTER(orig_fndecl));
121502 + }
121503 +
121504 + if (is_in_hash_table(orig_fndecl, num))
121505 + return false;
121506 +
121507 + print_missing_msg(orig_fndecl, num);
121508 + return true;
121509 +}
121510 +
121511 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
121512 new file mode 100644
121513 index 0000000..dd94983
121514 --- /dev/null
121515 +++ b/tools/gcc/stackleak_plugin.c
121516 @@ -0,0 +1,376 @@
121517 +/*
121518 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
121519 + * Licensed under the GPL v2
121520 + *
121521 + * Note: the choice of the license means that the compilation process is
121522 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
121523 + * but for the kernel it doesn't matter since it doesn't link against
121524 + * any of the gcc libraries
121525 + *
121526 + * gcc plugin to help implement various PaX features
121527 + *
121528 + * - track lowest stack pointer
121529 + *
121530 + * TODO:
121531 + * - initialize all local variables
121532 + *
121533 + * BUGS:
121534 + * - none known
121535 + */
121536 +
121537 +#include "gcc-common.h"
121538 +
121539 +int plugin_is_GPL_compatible;
121540 +
121541 +static int track_frame_size = -1;
121542 +static const char track_function[] = "pax_track_stack";
121543 +static const char check_function[] = "pax_check_alloca";
121544 +static tree track_function_decl, check_function_decl;
121545 +static bool init_locals;
121546 +
121547 +static struct plugin_info stackleak_plugin_info = {
121548 + .version = "201402131920",
121549 + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
121550 +// "initialize-locals\t\tforcibly initialize all stack frames\n"
121551 +};
121552 +
121553 +static void stackleak_check_alloca(gimple_stmt_iterator *gsi)
121554 +{
121555 + gimple check_alloca;
121556 + tree alloca_size;
121557 +
121558 + // insert call to void pax_check_alloca(unsigned long size)
121559 + alloca_size = gimple_call_arg(gsi_stmt(*gsi), 0);
121560 + check_alloca = gimple_build_call(check_function_decl, 1, alloca_size);
121561 + gsi_insert_before(gsi, check_alloca, GSI_SAME_STMT);
121562 +}
121563 +
121564 +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi)
121565 +{
121566 + gimple track_stack;
121567 +
121568 + // insert call to void pax_track_stack(void)
121569 + track_stack = gimple_build_call(track_function_decl, 0);
121570 + gsi_insert_after(gsi, track_stack, GSI_CONTINUE_LINKING);
121571 +}
121572 +
121573 +static bool is_alloca(gimple stmt)
121574 +{
121575 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA))
121576 + return true;
121577 +
121578 +#if BUILDING_GCC_VERSION >= 4007
121579 + if (gimple_call_builtin_p(stmt, BUILT_IN_ALLOCA_WITH_ALIGN))
121580 + return true;
121581 +#endif
121582 +
121583 + return false;
121584 +}
121585 +
121586 +static unsigned int execute_stackleak_tree_instrument(void)
121587 +{
121588 + basic_block bb, entry_bb;
121589 + bool prologue_instrumented = false, is_leaf = true;
121590 +
121591 + entry_bb = ENTRY_BLOCK_PTR_FOR_FN(cfun)->next_bb;
121592 +
121593 + // 1. loop through BBs and GIMPLE statements
121594 + FOR_EACH_BB_FN(bb, cfun) {
121595 + gimple_stmt_iterator gsi;
121596 +
121597 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
121598 + gimple stmt;
121599 +
121600 + stmt = gsi_stmt(gsi);
121601 +
121602 + if (is_gimple_call(stmt))
121603 + is_leaf = false;
121604 +
121605 + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
121606 + if (!is_alloca(stmt))
121607 + continue;
121608 +
121609 + // 2. insert stack overflow check before each __builtin_alloca call
121610 + stackleak_check_alloca(&gsi);
121611 +
121612 + // 3. insert track call after each __builtin_alloca call
121613 + stackleak_add_instrumentation(&gsi);
121614 + if (bb == entry_bb)
121615 + prologue_instrumented = true;
121616 + }
121617 + }
121618 +
121619 + // special cases for some bad linux code: taking the address of static inline functions will materialize them
121620 + // but we mustn't instrument some of them as the resulting stack alignment required by the function call ABI
121621 + // will break other assumptions regarding the expected (but not otherwise enforced) register clobbering ABI.
121622 + // case in point: native_save_fl on amd64 when optimized for size clobbers rdx if it were instrumented here.
121623 + if (is_leaf && !TREE_PUBLIC(current_function_decl) && DECL_DECLARED_INLINE_P(current_function_decl))
121624 + return 0;
121625 + if (is_leaf && !strncmp(IDENTIFIER_POINTER(DECL_NAME(current_function_decl)), "_paravirt_", 10))
121626 + return 0;
121627 +
121628 + // 4. insert track call at the beginning
121629 + if (!prologue_instrumented) {
121630 + gimple_stmt_iterator gsi;
121631 +
121632 + bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
121633 + if (dom_info_available_p(CDI_DOMINATORS))
121634 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
121635 + gsi = gsi_start_bb(bb);
121636 + stackleak_add_instrumentation(&gsi);
121637 + }
121638 +
121639 + return 0;
121640 +}
121641 +
121642 +static unsigned int execute_stackleak_final(void)
121643 +{
121644 + rtx insn, next;
121645 +
121646 + if (cfun->calls_alloca)
121647 + return 0;
121648 +
121649 + // keep calls only if function frame is big enough
121650 + if (get_frame_size() >= track_frame_size)
121651 + return 0;
121652 +
121653 + // 1. find pax_track_stack calls
121654 + for (insn = get_insns(); insn; insn = next) {
121655 + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
121656 + rtx body;
121657 +
121658 + next = NEXT_INSN(insn);
121659 + if (!CALL_P(insn))
121660 + continue;
121661 + body = PATTERN(insn);
121662 + if (GET_CODE(body) != CALL)
121663 + continue;
121664 + body = XEXP(body, 0);
121665 + if (GET_CODE(body) != MEM)
121666 + continue;
121667 + body = XEXP(body, 0);
121668 + if (GET_CODE(body) != SYMBOL_REF)
121669 + continue;
121670 +// if (strcmp(XSTR(body, 0), track_function))
121671 + if (SYMBOL_REF_DECL(body) != track_function_decl)
121672 + continue;
121673 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
121674 + // 2. delete call
121675 + delete_insn_and_edges(insn);
121676 +#if BUILDING_GCC_VERSION >= 4007
121677 + if (GET_CODE(next) == NOTE && NOTE_KIND(next) == NOTE_INSN_CALL_ARG_LOCATION) {
121678 + insn = next;
121679 + next = NEXT_INSN(insn);
121680 + delete_insn_and_edges(insn);
121681 + }
121682 +#endif
121683 + }
121684 +
121685 +// print_simple_rtl(stderr, get_insns());
121686 +// print_rtl(stderr, get_insns());
121687 +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
121688 +
121689 + return 0;
121690 +}
121691 +
121692 +static bool gate_stackleak_track_stack(void)
121693 +{
121694 + return track_frame_size >= 0;
121695 +}
121696 +
121697 +static void stackleak_start_unit(void *gcc_data, void *user_data)
121698 +{
121699 + tree fntype;
121700 +
121701 + // void pax_track_stack(void)
121702 + fntype = build_function_type_list(void_type_node, NULL_TREE);
121703 + track_function_decl = build_fn_decl(track_function, fntype);
121704 + DECL_ASSEMBLER_NAME(track_function_decl); // for LTO
121705 + TREE_PUBLIC(track_function_decl) = 1;
121706 + DECL_EXTERNAL(track_function_decl) = 1;
121707 + DECL_ARTIFICIAL(track_function_decl) = 1;
121708 +
121709 + // void pax_check_alloca(unsigned long)
121710 + fntype = build_function_type_list(void_type_node, long_unsigned_type_node, NULL_TREE);
121711 + check_function_decl = build_fn_decl(check_function, fntype);
121712 + DECL_ASSEMBLER_NAME(check_function_decl); // for LTO
121713 + TREE_PUBLIC(check_function_decl) = 1;
121714 + DECL_EXTERNAL(check_function_decl) = 1;
121715 + DECL_ARTIFICIAL(check_function_decl) = 1;
121716 +}
121717 +
121718 +#if BUILDING_GCC_VERSION >= 4009
121719 +static const struct pass_data stackleak_tree_instrument_pass_data = {
121720 +#else
121721 +static struct gimple_opt_pass stackleak_tree_instrument_pass = {
121722 + .pass = {
121723 +#endif
121724 + .type = GIMPLE_PASS,
121725 + .name = "stackleak_tree_instrument",
121726 +#if BUILDING_GCC_VERSION >= 4008
121727 + .optinfo_flags = OPTGROUP_NONE,
121728 +#endif
121729 +#if BUILDING_GCC_VERSION >= 4009
121730 + .has_gate = true,
121731 + .has_execute = true,
121732 +#else
121733 + .gate = gate_stackleak_track_stack,
121734 + .execute = execute_stackleak_tree_instrument,
121735 + .sub = NULL,
121736 + .next = NULL,
121737 + .static_pass_number = 0,
121738 +#endif
121739 + .tv_id = TV_NONE,
121740 + .properties_required = PROP_gimple_leh | PROP_cfg,
121741 + .properties_provided = 0,
121742 + .properties_destroyed = 0,
121743 + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
121744 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_update_ssa | TODO_rebuild_cgraph_edges
121745 +#if BUILDING_GCC_VERSION < 4009
121746 + }
121747 +#endif
121748 +};
121749 +
121750 +#if BUILDING_GCC_VERSION >= 4009
121751 +static const struct pass_data stackleak_final_rtl_opt_pass_data = {
121752 +#else
121753 +static struct rtl_opt_pass stackleak_final_rtl_opt_pass = {
121754 + .pass = {
121755 +#endif
121756 + .type = RTL_PASS,
121757 + .name = "stackleak_final",
121758 +#if BUILDING_GCC_VERSION >= 4008
121759 + .optinfo_flags = OPTGROUP_NONE,
121760 +#endif
121761 +#if BUILDING_GCC_VERSION >= 4009
121762 + .has_gate = true,
121763 + .has_execute = true,
121764 +#else
121765 + .gate = gate_stackleak_track_stack,
121766 + .execute = execute_stackleak_final,
121767 + .sub = NULL,
121768 + .next = NULL,
121769 + .static_pass_number = 0,
121770 +#endif
121771 + .tv_id = TV_NONE,
121772 + .properties_required = 0,
121773 + .properties_provided = 0,
121774 + .properties_destroyed = 0,
121775 + .todo_flags_start = 0,
121776 + .todo_flags_finish = TODO_dump_func
121777 +#if BUILDING_GCC_VERSION < 4009
121778 + }
121779 +#endif
121780 +};
121781 +
121782 +#if BUILDING_GCC_VERSION >= 4009
121783 +namespace {
121784 +class stackleak_tree_instrument_pass : public gimple_opt_pass {
121785 +public:
121786 + stackleak_tree_instrument_pass() : gimple_opt_pass(stackleak_tree_instrument_pass_data, g) {}
121787 + bool gate() { return gate_stackleak_track_stack(); }
121788 + unsigned int execute() { return execute_stackleak_tree_instrument(); }
121789 +};
121790 +
121791 +class stackleak_final_rtl_opt_pass : public rtl_opt_pass {
121792 +public:
121793 + stackleak_final_rtl_opt_pass() : rtl_opt_pass(stackleak_final_rtl_opt_pass_data, g) {}
121794 + bool gate() { return gate_stackleak_track_stack(); }
121795 + unsigned int execute() { return execute_stackleak_final(); }
121796 +};
121797 +}
121798 +
121799 +static opt_pass *make_stackleak_tree_instrument_pass(void)
121800 +{
121801 + return new stackleak_tree_instrument_pass();
121802 +}
121803 +
121804 +static opt_pass *make_stackleak_final_rtl_opt_pass(void)
121805 +{
121806 + return new stackleak_final_rtl_opt_pass();
121807 +}
121808 +#else
121809 +static struct opt_pass *make_stackleak_tree_instrument_pass(void)
121810 +{
121811 + return &stackleak_tree_instrument_pass.pass;
121812 +}
121813 +
121814 +static struct opt_pass *make_stackleak_final_rtl_opt_pass(void)
121815 +{
121816 + return &stackleak_final_rtl_opt_pass.pass;
121817 +}
121818 +#endif
121819 +
121820 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
121821 +{
121822 + const char * const plugin_name = plugin_info->base_name;
121823 + const int argc = plugin_info->argc;
121824 + const struct plugin_argument * const argv = plugin_info->argv;
121825 + int i;
121826 + struct register_pass_info stackleak_tree_instrument_pass_info;
121827 + struct register_pass_info stackleak_final_pass_info;
121828 + static const struct ggc_root_tab gt_ggc_r_gt_stackleak[] = {
121829 + {
121830 + .base = &track_function_decl,
121831 + .nelt = 1,
121832 + .stride = sizeof(track_function_decl),
121833 + .cb = &gt_ggc_mx_tree_node,
121834 + .pchw = &gt_pch_nx_tree_node
121835 + },
121836 + {
121837 + .base = &check_function_decl,
121838 + .nelt = 1,
121839 + .stride = sizeof(check_function_decl),
121840 + .cb = &gt_ggc_mx_tree_node,
121841 + .pchw = &gt_pch_nx_tree_node
121842 + },
121843 + LAST_GGC_ROOT_TAB
121844 + };
121845 +
121846 + stackleak_tree_instrument_pass_info.pass = make_stackleak_tree_instrument_pass();
121847 +// stackleak_tree_instrument_pass_info.reference_pass_name = "tree_profile";
121848 + stackleak_tree_instrument_pass_info.reference_pass_name = "optimized";
121849 + stackleak_tree_instrument_pass_info.ref_pass_instance_number = 1;
121850 + stackleak_tree_instrument_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
121851 +
121852 + stackleak_final_pass_info.pass = make_stackleak_final_rtl_opt_pass();
121853 + stackleak_final_pass_info.reference_pass_name = "final";
121854 + stackleak_final_pass_info.ref_pass_instance_number = 1;
121855 + stackleak_final_pass_info.pos_op = PASS_POS_INSERT_BEFORE;
121856 +
121857 + if (!plugin_default_version_check(version, &gcc_version)) {
121858 + error(G_("incompatible gcc/plugin versions"));
121859 + return 1;
121860 + }
121861 +
121862 + register_callback(plugin_name, PLUGIN_INFO, NULL, &stackleak_plugin_info);
121863 +
121864 + for (i = 0; i < argc; ++i) {
121865 + if (!strcmp(argv[i].key, "track-lowest-sp")) {
121866 + if (!argv[i].value) {
121867 + error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
121868 + continue;
121869 + }
121870 + track_frame_size = atoi(argv[i].value);
121871 + if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
121872 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
121873 + continue;
121874 + }
121875 + if (!strcmp(argv[i].key, "initialize-locals")) {
121876 + if (argv[i].value) {
121877 + error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
121878 + continue;
121879 + }
121880 + init_locals = true;
121881 + continue;
121882 + }
121883 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
121884 + }
121885 +
121886 + register_callback(plugin_name, PLUGIN_START_UNIT, &stackleak_start_unit, NULL);
121887 + register_callback(plugin_name, PLUGIN_REGISTER_GGC_ROOTS, NULL, (void *)&gt_ggc_r_gt_stackleak);
121888 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_tree_instrument_pass_info);
121889 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &stackleak_final_pass_info);
121890 +
121891 + return 0;
121892 +}
121893 diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
121894 new file mode 100644
121895 index 0000000..4ee2231
121896 --- /dev/null
121897 +++ b/tools/gcc/structleak_plugin.c
121898 @@ -0,0 +1,274 @@
121899 +/*
121900 + * Copyright 2013-2014 by PaX Team <pageexec@freemail.hu>
121901 + * Licensed under the GPL v2
121902 + *
121903 + * Note: the choice of the license means that the compilation process is
121904 + * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
121905 + * but for the kernel it doesn't matter since it doesn't link against
121906 + * any of the gcc libraries
121907 + *
121908 + * gcc plugin to forcibly initialize certain local variables that could
121909 + * otherwise leak kernel stack to userland if they aren't properly initialized
121910 + * by later code
121911 + *
121912 + * Homepage: http://pax.grsecurity.net/
121913 + *
121914 + * Usage:
121915 + * $ # for 4.5/4.6/C based 4.7
121916 + * $ gcc -I`gcc -print-file-name=plugin`/include -I`gcc -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
121917 + * $ # for C++ based 4.7/4.8+
121918 + * $ g++ -I`g++ -print-file-name=plugin`/include -I`g++ -print-file-name=plugin`/include/c-family -fPIC -shared -O2 -o structleak_plugin.so structleak_plugin.c
121919 + * $ gcc -fplugin=./structleak_plugin.so test.c -O2
121920 + *
121921 + * TODO: eliminate redundant initializers
121922 + * increase type coverage
121923 + */
121924 +
121925 +#include "gcc-common.h"
121926 +
121927 +// unused C type flag in all versions 4.5-4.9
121928 +#define TYPE_USERSPACE(TYPE) TYPE_LANG_FLAG_3(TYPE)
121929 +
121930 +int plugin_is_GPL_compatible;
121931 +
121932 +static struct plugin_info structleak_plugin_info = {
121933 + .version = "201401260140",
121934 + .help = "disable\tdo not activate plugin\n",
121935 +};
121936 +
121937 +static tree handle_user_attribute(tree *node, tree name, tree args, int flags, bool *no_add_attrs)
121938 +{
121939 + *no_add_attrs = true;
121940 +
121941 + // check for types? for now accept everything linux has to offer
121942 + if (TREE_CODE(*node) != FIELD_DECL)
121943 + return NULL_TREE;
121944 +
121945 + *no_add_attrs = false;
121946 + return NULL_TREE;
121947 +}
121948 +
121949 +static struct attribute_spec user_attr = {
121950 + .name = "user",
121951 + .min_length = 0,
121952 + .max_length = 0,
121953 + .decl_required = false,
121954 + .type_required = false,
121955 + .function_type_required = false,
121956 + .handler = handle_user_attribute,
121957 +#if BUILDING_GCC_VERSION >= 4007
121958 + .affects_type_identity = true
121959 +#endif
121960 +};
121961 +
121962 +static void register_attributes(void *event_data, void *data)
121963 +{
121964 + register_attribute(&user_attr);
121965 +// register_attribute(&force_attr);
121966 +}
121967 +
121968 +static tree get_field_type(tree field)
121969 +{
121970 + return strip_array_types(TREE_TYPE(field));
121971 +}
121972 +
121973 +static bool is_userspace_type(tree type)
121974 +{
121975 + tree field;
121976 +
121977 + for (field = TYPE_FIELDS(type); field; field = TREE_CHAIN(field)) {
121978 + tree fieldtype = get_field_type(field);
121979 + enum tree_code code = TREE_CODE(fieldtype);
121980 +
121981 + if (code == RECORD_TYPE || code == UNION_TYPE)
121982 + if (is_userspace_type(fieldtype))
121983 + return true;
121984 +
121985 + if (lookup_attribute("user", DECL_ATTRIBUTES(field)))
121986 + return true;
121987 + }
121988 + return false;
121989 +}
121990 +
121991 +static void finish_type(void *event_data, void *data)
121992 +{
121993 + tree type = (tree)event_data;
121994 +
121995 + if (TYPE_USERSPACE(type))
121996 + return;
121997 +
121998 + if (is_userspace_type(type))
121999 + TYPE_USERSPACE(type) = 1;
122000 +}
122001 +
122002 +static void initialize(tree var)
122003 +{
122004 + basic_block bb;
122005 + gimple_stmt_iterator gsi;
122006 + tree initializer;
122007 + gimple init_stmt;
122008 +
122009 + // this is the original entry bb before the forced split
122010 + // TODO: check further BBs in case more splits occured before us
122011 + bb = ENTRY_BLOCK_PTR_FOR_FN(cfun)->next_bb->next_bb;
122012 +
122013 + // first check if the variable is already initialized, warn otherwise
122014 + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
122015 + gimple stmt = gsi_stmt(gsi);
122016 + tree rhs1;
122017 +
122018 + // we're looking for an assignment of a single rhs...
122019 + if (!gimple_assign_single_p(stmt))
122020 + continue;
122021 + rhs1 = gimple_assign_rhs1(stmt);
122022 +#if BUILDING_GCC_VERSION >= 4007
122023 + // ... of a non-clobbering expression...
122024 + if (TREE_CLOBBER_P(rhs1))
122025 + continue;
122026 +#endif
122027 + // ... to our variable...
122028 + if (gimple_get_lhs(stmt) != var)
122029 + continue;
122030 + // if it's an initializer then we're good
122031 + if (TREE_CODE(rhs1) == CONSTRUCTOR)
122032 + return;
122033 + }
122034 +
122035 + // these aren't the 0days you're looking for
122036 +// inform(DECL_SOURCE_LOCATION(var), "userspace variable will be forcibly initialized");
122037 +
122038 + // build the initializer expression
122039 + initializer = build_constructor(TREE_TYPE(var), NULL);
122040 +
122041 + // build the initializer stmt
122042 + init_stmt = gimple_build_assign(var, initializer);
122043 + gsi = gsi_start_bb(ENTRY_BLOCK_PTR_FOR_FN(cfun)->next_bb);
122044 + gsi_insert_before(&gsi, init_stmt, GSI_NEW_STMT);
122045 + update_stmt(init_stmt);
122046 +}
122047 +
122048 +static unsigned int handle_function(void)
122049 +{
122050 + basic_block bb;
122051 + unsigned int ret = 0;
122052 + tree var;
122053 + unsigned int i;
122054 +
122055 + // split the first bb where we can put the forced initializers
122056 + bb = split_block_after_labels(ENTRY_BLOCK_PTR_FOR_FN(cfun))->dest;
122057 + if (dom_info_available_p(CDI_DOMINATORS))
122058 + set_immediate_dominator(CDI_DOMINATORS, bb, ENTRY_BLOCK_PTR_FOR_FN(cfun));
122059 +
122060 + // enumarate all local variables and forcibly initialize our targets
122061 + FOR_EACH_LOCAL_DECL(cfun, i, var) {
122062 + tree type = TREE_TYPE(var);
122063 +
122064 + gcc_assert(DECL_P(var));
122065 + if (!auto_var_in_fn_p(var, current_function_decl))
122066 + continue;
122067 +
122068 + // only care about structure types
122069 + if (TREE_CODE(type) != RECORD_TYPE && TREE_CODE(type) != UNION_TYPE)
122070 + continue;
122071 +
122072 + // if the type is of interest, examine the variable
122073 + if (TYPE_USERSPACE(type))
122074 + initialize(var);
122075 + }
122076 +
122077 + return ret;
122078 +}
122079 +
122080 +#if BUILDING_GCC_VERSION >= 4009
122081 +static const struct pass_data structleak_pass_data = {
122082 +#else
122083 +static struct gimple_opt_pass structleak_pass = {
122084 + .pass = {
122085 +#endif
122086 + .type = GIMPLE_PASS,
122087 + .name = "structleak",
122088 +#if BUILDING_GCC_VERSION >= 4008
122089 + .optinfo_flags = OPTGROUP_NONE,
122090 +#endif
122091 +#if BUILDING_GCC_VERSION >= 4009
122092 + .has_gate = false,
122093 + .has_execute = true,
122094 +#else
122095 + .gate = NULL,
122096 + .execute = handle_function,
122097 + .sub = NULL,
122098 + .next = NULL,
122099 + .static_pass_number = 0,
122100 +#endif
122101 + .tv_id = TV_NONE,
122102 + .properties_required = PROP_cfg,
122103 + .properties_provided = 0,
122104 + .properties_destroyed = 0,
122105 + .todo_flags_start = 0,
122106 + .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa | TODO_ggc_collect | TODO_verify_flow
122107 +#if BUILDING_GCC_VERSION < 4009
122108 + }
122109 +#endif
122110 +};
122111 +
122112 +#if BUILDING_GCC_VERSION >= 4009
122113 +namespace {
122114 +class structleak_pass : public gimple_opt_pass {
122115 +public:
122116 + structleak_pass() : gimple_opt_pass(structleak_pass_data, g) {}
122117 + unsigned int execute() { return handle_function(); }
122118 +};
122119 +}
122120 +
122121 +static opt_pass *make_structleak_pass(void)
122122 +{
122123 + return new structleak_pass();
122124 +}
122125 +#else
122126 +static struct opt_pass *make_structleak_pass(void)
122127 +{
122128 + return &structleak_pass.pass;
122129 +}
122130 +#endif
122131 +
122132 +int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
122133 +{
122134 + int i;
122135 + const char * const plugin_name = plugin_info->base_name;
122136 + const int argc = plugin_info->argc;
122137 + const struct plugin_argument * const argv = plugin_info->argv;
122138 + bool enable = true;
122139 + struct register_pass_info structleak_pass_info;
122140 +
122141 + structleak_pass_info.pass = make_structleak_pass();
122142 + structleak_pass_info.reference_pass_name = "ssa";
122143 + structleak_pass_info.ref_pass_instance_number = 1;
122144 + structleak_pass_info.pos_op = PASS_POS_INSERT_AFTER;
122145 +
122146 + if (!plugin_default_version_check(version, &gcc_version)) {
122147 + error(G_("incompatible gcc/plugin versions"));
122148 + return 1;
122149 + }
122150 +
122151 + if (strcmp(lang_hooks.name, "GNU C")) {
122152 + inform(UNKNOWN_LOCATION, G_("%s supports C only"), plugin_name);
122153 + enable = false;
122154 + }
122155 +
122156 + for (i = 0; i < argc; ++i) {
122157 + if (!strcmp(argv[i].key, "disable")) {
122158 + enable = false;
122159 + continue;
122160 + }
122161 + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
122162 + }
122163 +
122164 + register_callback(plugin_name, PLUGIN_INFO, NULL, &structleak_plugin_info);
122165 + if (enable) {
122166 + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &structleak_pass_info);
122167 + register_callback(plugin_name, PLUGIN_FINISH_TYPE, finish_type, NULL);
122168 + }
122169 + register_callback(plugin_name, PLUGIN_ATTRIBUTES, register_attributes, NULL);
122170 +
122171 + return 0;
122172 +}
122173 diff --git a/tools/include/linux/compiler.h b/tools/include/linux/compiler.h
122174 index fbc6665..5e9ce79 100644
122175 --- a/tools/include/linux/compiler.h
122176 +++ b/tools/include/linux/compiler.h
122177 @@ -35,4 +35,12 @@
122178 # define unlikely(x) __builtin_expect(!!(x), 0)
122179 #endif
122180
122181 +#ifndef __size_overflow
122182 +# define __size_overflow(...)
122183 +#endif
122184 +
122185 +#ifndef __intentional_overflow
122186 +# define __intentional_overflow(...)
122187 +#endif
122188 +
122189 #endif /* _TOOLS_LINUX_COMPILER_H */
122190 diff --git a/tools/lib/api/Makefile b/tools/lib/api/Makefile
122191 index ed2f51e..cc2d8f6 100644
122192 --- a/tools/lib/api/Makefile
122193 +++ b/tools/lib/api/Makefile
122194 @@ -14,7 +14,7 @@ LIB_OBJS += $(OUTPUT)fs/debugfs.o
122195
122196 LIBFILE = libapikfs.a
122197
122198 -CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror -O6 -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS) -fPIC
122199 +CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror -O6 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS) -fPIC
122200 EXTLIBS = -lelf -lpthread -lrt -lm
122201 ALL_CFLAGS = $(CFLAGS) $(BASIC_CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
122202 ALL_LDFLAGS = $(LDFLAGS)
122203 diff --git a/tools/perf/util/include/asm/alternative-asm.h b/tools/perf/util/include/asm/alternative-asm.h
122204 index 6789d788..4afd019e 100644
122205 --- a/tools/perf/util/include/asm/alternative-asm.h
122206 +++ b/tools/perf/util/include/asm/alternative-asm.h
122207 @@ -5,4 +5,7 @@
122208
122209 #define altinstruction_entry #
122210
122211 + .macro pax_force_retaddr rip=0, reload=0
122212 + .endm
122213 +
122214 #endif
122215 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
122216 index 03a0381..8b31923 100644
122217 --- a/virt/kvm/kvm_main.c
122218 +++ b/virt/kvm/kvm_main.c
122219 @@ -76,12 +76,17 @@ LIST_HEAD(vm_list);
122220
122221 static cpumask_var_t cpus_hardware_enabled;
122222 static int kvm_usage_count = 0;
122223 -static atomic_t hardware_enable_failed;
122224 +static atomic_unchecked_t hardware_enable_failed;
122225
122226 struct kmem_cache *kvm_vcpu_cache;
122227 EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
122228
122229 -static __read_mostly struct preempt_ops kvm_preempt_ops;
122230 +static void kvm_sched_in(struct preempt_notifier *pn, int cpu);
122231 +static void kvm_sched_out(struct preempt_notifier *pn, struct task_struct *next);
122232 +static struct preempt_ops kvm_preempt_ops = {
122233 + .sched_in = kvm_sched_in,
122234 + .sched_out = kvm_sched_out,
122235 +};
122236
122237 struct dentry *kvm_debugfs_dir;
122238
122239 @@ -758,7 +763,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
122240 /* We can read the guest memory with __xxx_user() later on. */
122241 if ((mem->slot < KVM_USER_MEM_SLOTS) &&
122242 ((mem->userspace_addr & (PAGE_SIZE - 1)) ||
122243 - !access_ok(VERIFY_WRITE,
122244 + !access_ok_noprefault(VERIFY_WRITE,
122245 (void __user *)(unsigned long)mem->userspace_addr,
122246 mem->memory_size)))
122247 goto out;
122248 @@ -1615,9 +1620,17 @@ EXPORT_SYMBOL_GPL(kvm_read_guest_cached);
122249
122250 int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len)
122251 {
122252 - const void *zero_page = (const void *) __va(page_to_phys(ZERO_PAGE(0)));
122253 + int r;
122254 + unsigned long addr;
122255
122256 - return kvm_write_guest_page(kvm, gfn, zero_page, offset, len);
122257 + addr = gfn_to_hva(kvm, gfn);
122258 + if (kvm_is_error_hva(addr))
122259 + return -EFAULT;
122260 + r = __clear_user((void __user *)addr + offset, len);
122261 + if (r)
122262 + return -EFAULT;
122263 + mark_page_dirty(kvm, gfn);
122264 + return 0;
122265 }
122266 EXPORT_SYMBOL_GPL(kvm_clear_guest_page);
122267
122268 @@ -1867,7 +1880,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
122269 return 0;
122270 }
122271
122272 -static struct file_operations kvm_vcpu_fops = {
122273 +static file_operations_no_const kvm_vcpu_fops __read_only = {
122274 .release = kvm_vcpu_release,
122275 .unlocked_ioctl = kvm_vcpu_ioctl,
122276 #ifdef CONFIG_COMPAT
122277 @@ -2532,7 +2545,7 @@ out:
122278 }
122279 #endif
122280
122281 -static struct file_operations kvm_vm_fops = {
122282 +static file_operations_no_const kvm_vm_fops __read_only = {
122283 .release = kvm_vm_release,
122284 .unlocked_ioctl = kvm_vm_ioctl,
122285 #ifdef CONFIG_COMPAT
122286 @@ -2632,7 +2645,7 @@ out:
122287 return r;
122288 }
122289
122290 -static struct file_operations kvm_chardev_ops = {
122291 +static file_operations_no_const kvm_chardev_ops __read_only = {
122292 .unlocked_ioctl = kvm_dev_ioctl,
122293 .compat_ioctl = kvm_dev_ioctl,
122294 .llseek = noop_llseek,
122295 @@ -2658,7 +2671,7 @@ static void hardware_enable_nolock(void *junk)
122296
122297 if (r) {
122298 cpumask_clear_cpu(cpu, cpus_hardware_enabled);
122299 - atomic_inc(&hardware_enable_failed);
122300 + atomic_inc_unchecked(&hardware_enable_failed);
122301 printk(KERN_INFO "kvm: enabling virtualization on "
122302 "CPU%d failed\n", cpu);
122303 }
122304 @@ -2714,10 +2727,10 @@ static int hardware_enable_all(void)
122305
122306 kvm_usage_count++;
122307 if (kvm_usage_count == 1) {
122308 - atomic_set(&hardware_enable_failed, 0);
122309 + atomic_set_unchecked(&hardware_enable_failed, 0);
122310 on_each_cpu(hardware_enable_nolock, NULL, 1);
122311
122312 - if (atomic_read(&hardware_enable_failed)) {
122313 + if (atomic_read_unchecked(&hardware_enable_failed)) {
122314 hardware_disable_all_nolock();
122315 r = -EBUSY;
122316 }
122317 @@ -3121,7 +3134,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
122318 kvm_arch_vcpu_put(vcpu);
122319 }
122320
122321 -int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
122322 +int kvm_init(const void *opaque, unsigned vcpu_size, unsigned vcpu_align,
122323 struct module *module)
122324 {
122325 int r;
122326 @@ -3168,7 +3181,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
122327 if (!vcpu_align)
122328 vcpu_align = __alignof__(struct kvm_vcpu);
122329 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
122330 - 0, NULL);
122331 + SLAB_USERCOPY, NULL);
122332 if (!kvm_vcpu_cache) {
122333 r = -ENOMEM;
122334 goto out_free_3;
122335 @@ -3178,9 +3191,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
122336 if (r)
122337 goto out_free;
122338
122339 + pax_open_kernel();
122340 kvm_chardev_ops.owner = module;
122341 kvm_vm_fops.owner = module;
122342 kvm_vcpu_fops.owner = module;
122343 + pax_close_kernel();
122344
122345 r = misc_register(&kvm_dev);
122346 if (r) {
122347 @@ -3190,9 +3205,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
122348
122349 register_syscore_ops(&kvm_syscore_ops);
122350
122351 - kvm_preempt_ops.sched_in = kvm_sched_in;
122352 - kvm_preempt_ops.sched_out = kvm_sched_out;
122353 -
122354 r = kvm_init_debug();
122355 if (r) {
122356 printk(KERN_ERR "kvm: create debugfs files failed\n");
Unofficial grsecurity patch archive (https://github.com/slashbeast/grsecurity-scrape)