diff options
| -rw-r--r-- | main/linux-grsec/APKBUILD | 10 | ||||
| -rw-r--r-- | main/linux-grsec/grsecurity-2.9.1-3.6.8-201211261714.patch (renamed from main/linux-grsec/grsecurity-2.9.1-3.6.7-201211181105.patch) | 652 |
2 files changed, 420 insertions, 242 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD index ec40286cac..6124970174 100644 --- a/main/linux-grsec/APKBUILD +++ b/main/linux-grsec/APKBUILD @@ -2,9 +2,9 @@ _flavor=grsec pkgname=linux-${_flavor} -pkgver=3.6.7 +pkgver=3.6.8 _kernver=3.6 -pkgrel=0 +pkgrel=1 pkgdesc="Linux kernel with grsecurity" url=http://grsecurity.net depends="mkinitfs linux-firmware" @@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}} install= source="http://ftp.kernel.org/pub/linux/kernel/v3.x/linux-$_kernver.tar.xz http://ftp.kernel.org/pub/linux/kernel/v3.x/patch-$pkgver.xz - grsecurity-2.9.1-3.6.7-201211181105.patch + grsecurity-2.9.1-3.6.8-201211261714.patch 0004-arp-flush-arp-cache-on-device-change.patch @@ -139,8 +139,8 @@ dev() { } md5sums="1a1760420eac802c541a20ab51a093d1 linux-3.6.tar.xz -134936c362d8812b5cafcf3c67afdce0 patch-3.6.7.xz -af1f2097a6e26d36801188193d3eb185 grsecurity-2.9.1-3.6.7-201211181105.patch +f248294551c34753c5c019c8d513280c patch-3.6.8.xz +0dbb7227ccf77f6e02772a5bd505b10d grsecurity-2.9.1-3.6.8-201211261714.patch 776adeeb5272093574f8836c5037dd7d 0004-arp-flush-arp-cache-on-device-change.patch 0b4abb6b3e32cc7ba656c24e30581349 kernelconfig.x86 0971129c59c7fe0011b3ec46982d9f5c kernelconfig.x86_64" diff --git a/main/linux-grsec/grsecurity-2.9.1-3.6.7-201211181105.patch b/main/linux-grsec/grsecurity-2.9.1-3.6.8-201211261714.patch index 6f0229a48a..13615ed6dd 100644 --- a/main/linux-grsec/grsecurity-2.9.1-3.6.7-201211181105.patch +++ b/main/linux-grsec/grsecurity-2.9.1-3.6.8-201211261714.patch @@ -251,7 +251,7 @@ index ad7e2e5..199f49e 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index 07f2308..7271d99 100644 +index c5cc2f0..6570abb 100644 --- a/Makefile +++ b/Makefile @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -3470,6 +3470,30 @@ index 5e34ccf..672bc9c 100644 DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n", me->arch.unwind_section, table, end, gp); +diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c +index fd49aed..5dede04 100644 +--- a/arch/parisc/kernel/signal32.c ++++ b/arch/parisc/kernel/signal32.c +@@ -65,7 +65,8 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz) + { + compat_sigset_t s; + +- if (sz != sizeof *set) panic("put_sigset32()"); ++ if (sz != sizeof *set) ++ return -EINVAL; + sigset_64to32(&s, set); + + return copy_to_user(up, &s, sizeof s); +@@ -77,7 +78,8 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz) + compat_sigset_t s; + int r; + +- if (sz != sizeof *set) panic("put_sigset32()"); ++ if (sz != sizeof *set) ++ return -EINVAL; + + if ((r = copy_from_user(&s, up, sz)) == 0) { + sigset_32to64(set, &s); diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c index 7426e40..30c8dbe 100644 --- a/arch/parisc/kernel/sys_parisc.c @@ -20537,7 +20561,7 @@ index baead95..90feeb4 100644 local_irq_disable(); diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index b1eb202..254e292 100644 +index ff66a3b..48ad872 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -1331,7 +1331,11 @@ static void reload_tss(void) @@ -26100,10 +26124,139 @@ index 877b9a1..a8ecf42 100644 + pax_force_retaddr ret diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 33643a8..8e44870 100644 +index 33643a8..f6211a0 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c -@@ -120,6 +120,11 @@ static inline void bpf_flush_icache(void *start, void *end) +@@ -11,6 +11,7 @@ + #include <asm/cacheflush.h> + #include <linux/netdevice.h> + #include <linux/filter.h> ++#include <linux/random.h> + + /* + * Conventions : +@@ -48,13 +49,87 @@ static inline u8 *emit_code(u8 *ptr, u32 bytes, unsigned int len) + return ptr + len; + } + ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++#define MAX_INSTR_CODE_SIZE 96 ++#else ++#define MAX_INSTR_CODE_SIZE 64 ++#endif ++ + #define EMIT(bytes, len) do { prog = emit_code(prog, bytes, len); } while (0) + + #define EMIT1(b1) EMIT(b1, 1) + #define EMIT2(b1, b2) EMIT((b1) + ((b2) << 8), 2) + #define EMIT3(b1, b2, b3) EMIT((b1) + ((b2) << 8) + ((b3) << 16), 3) + #define EMIT4(b1, b2, b3, b4) EMIT((b1) + ((b2) << 8) + ((b3) << 16) + ((b4) << 24), 4) ++ ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++/* original constant will appear in ecx */ ++#define DILUTE_CONST_SEQUENCE(_off, _key) \ ++do { \ ++ /* mov ecx, randkey */ \ ++ EMIT1(0xb9); \ ++ EMIT(_key, 4); \ ++ /* xor ecx, randkey ^ off */ \ ++ EMIT2(0x81, 0xf1); \ ++ EMIT((_key) ^ (_off), 4); \ ++} while (0) ++ ++#define EMIT1_off32(b1, _off) \ ++do { \ ++ switch (b1) { \ ++ case 0x05: /* add eax, imm32 */ \ ++ case 0x2d: /* sub eax, imm32 */ \ ++ case 0x25: /* and eax, imm32 */ \ ++ case 0x0d: /* or eax, imm32 */ \ ++ case 0xb8: /* mov eax, imm32 */ \ ++ case 0x3d: /* cmp eax, imm32 */ \ ++ case 0xa9: /* test eax, imm32 */ \ ++ DILUTE_CONST_SEQUENCE(_off, randkey); \ ++ EMIT2((b1) - 4, 0xc8); /* convert imm instruction to eax, ecx */\ ++ break; \ ++ case 0xbb: /* mov ebx, imm32 */ \ ++ DILUTE_CONST_SEQUENCE(_off, randkey); \ ++ /* mov ebx, ecx */ \ ++ EMIT2(0x89, 0xcb); \ ++ break; \ ++ case 0xbe: /* mov esi, imm32 */ \ ++ DILUTE_CONST_SEQUENCE(_off, randkey); \ ++ /* mov esi, ecx */ \ ++ EMIT2(0x89, 0xce); \ ++ break; \ ++ case 0xe9: /* jmp rel imm32 */ \ ++ EMIT1(b1); \ ++ EMIT(_off, 4); \ ++ /* prevent fall-through, we're not called if off = 0 */ \ ++ EMIT(0xcccccccc, 4); \ ++ EMIT(0xcccccccc, 4); \ ++ break; \ ++ default: \ ++ EMIT1(b1); \ ++ EMIT(_off, 4); \ ++ } \ ++} while (0) ++ ++#define EMIT2_off32(b1, b2, _off) \ ++do { \ ++ if ((b1) == 0x8d && (b2) == 0xb3) { /* lea esi, [rbx+imm32] */ \ ++ EMIT2(0x8d, 0xb3); /* lea esi, [rbx+randkey] */ \ ++ EMIT(randkey, 4); \ ++ EMIT2(0x8d, 0xb6); /* lea esi, [esi+off-randkey] */ \ ++ EMIT((_off) - randkey, 4); \ ++ } else if ((b1) == 0x69 && (b2) == 0xc0) { /* imul eax, imm32 */\ ++ DILUTE_CONST_SEQUENCE(_off, randkey); \ ++ /* imul eax, ecx */ \ ++ EMIT3(0x0f, 0xaf, 0xc1); \ ++ } else { \ ++ EMIT2(b1, b2); \ ++ EMIT(_off, 4); \ ++ } \ ++} while (0) ++#else + #define EMIT1_off32(b1, off) do { EMIT1(b1); EMIT(off, 4);} while (0) ++#define EMIT2_off32(b1, b2, off) do { EMIT2(b1, b2); EMIT(off, 4);} while (0) ++#endif + + #define CLEAR_A() EMIT2(0x31, 0xc0) /* xor %eax,%eax */ + #define CLEAR_X() EMIT2(0x31, 0xdb) /* xor %ebx,%ebx */ +@@ -89,6 +164,24 @@ do { \ + #define X86_JBE 0x76 + #define X86_JA 0x77 + ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++#define APPEND_FLOW_VERIFY() \ ++do { \ ++ /* mov ecx, randkey */ \ ++ EMIT1(0xb9); \ ++ EMIT(randkey, 4); \ ++ /* cmp ecx, randkey */ \ ++ EMIT2(0x81, 0xf9); \ ++ EMIT(randkey, 4); \ ++ /* jz after 8 int 3s */ \ ++ EMIT2(0x74, 0x08); \ ++ EMIT(0xcccccccc, 4); \ ++ EMIT(0xcccccccc, 4); \ ++} while (0) ++#else ++#define APPEND_FLOW_VERIFY() do { } while (0) ++#endif ++ + #define EMIT_COND_JMP(op, offset) \ + do { \ + if (is_near(offset)) \ +@@ -96,6 +189,7 @@ do { \ + else { \ + EMIT2(0x0f, op + 0x10); \ + EMIT(offset, 4); /* jxx .+off32 */ \ ++ APPEND_FLOW_VERIFY(); \ + } \ + } while (0) + +@@ -120,12 +214,17 @@ static inline void bpf_flush_icache(void *start, void *end) set_fs(old_fs); } @@ -26115,7 +26268,24 @@ index 33643a8..8e44870 100644 #define CHOOSE_LOAD_FUNC(K, func) \ ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset) -@@ -146,6 +151,10 @@ void bpf_jit_compile(struct sk_filter *fp) + void bpf_jit_compile(struct sk_filter *fp) + { +- u8 temp[64]; ++ u8 temp[MAX_INSTR_CODE_SIZE]; + u8 *prog; + unsigned int proglen, oldproglen = 0; + int ilen, i; +@@ -138,6 +237,9 @@ void bpf_jit_compile(struct sk_filter *fp) + unsigned int *addrs; + const struct sock_filter *filter = fp->insns; + int flen = fp->len; ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++ unsigned int randkey; ++#endif + + if (!bpf_jit_enable) + return; +@@ -146,11 +248,19 @@ void bpf_jit_compile(struct sk_filter *fp) if (addrs == NULL) return; @@ -26123,10 +26293,59 @@ index 33643a8..8e44870 100644 + if (!fp->work) + goto out; + ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++ randkey = get_random_int(); ++#endif ++ /* Before first pass, make a rough estimation of addrs[] - * each bpf instruction is translated to less than 64 bytes +- * each bpf instruction is translated to less than 64 bytes ++ * each bpf instruction is translated to less than MAX_INSTR_CODE_SIZE bytes */ -@@ -593,17 +602,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; + for (proglen = 0, i = 0; i < flen; i++) { +- proglen += 64; ++ proglen += MAX_INSTR_CODE_SIZE; + addrs[i] = proglen; + } + cleanup_addr = proglen; /* epilogue address */ +@@ -258,10 +368,8 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ALU_MUL_K: /* A *= K */ + if (is_imm8(K)) + EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */ +- else { +- EMIT2(0x69, 0xc0); /* imul imm32,%eax */ +- EMIT(K, 4); +- } ++ else ++ EMIT2_off32(0x69, 0xc0, K); /* imul imm32,%eax */ + break; + case BPF_S_ALU_DIV_X: /* A /= X; */ + seen |= SEEN_XREG; +@@ -281,8 +389,14 @@ void bpf_jit_compile(struct sk_filter *fp) + EMIT4(0x31, 0xd2, 0xf7, 0xf3); /* xor %edx,%edx; div %ebx */ + break; + case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */ ++#ifdef CONFIG_GRKERNSEC_JIT_HARDEN ++ DILUTE_CONST_SEQUENCE(K, randkey); ++ // imul rax, rcx ++ EMIT4(0x48, 0x0f, 0xaf, 0xc1); ++#else + EMIT3(0x48, 0x69, 0xc0); /* imul imm32,%rax,%rax */ + EMIT(K, 4); ++#endif + EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */ + break; + case BPF_S_ALU_AND_X: +@@ -509,8 +623,7 @@ common_load_ind: seen |= SEEN_DATAREF | SEEN_XREG; + if (is_imm8(K)) { + EMIT3(0x8d, 0x73, K); /* lea imm8(%rbx), %esi */ + } else { +- EMIT2(0x8d, 0xb3); /* lea imm32(%rbx),%esi */ +- EMIT(K, 4); ++ EMIT2_off32(0x8d, 0xb3, K); /* lea imm32(%rbx),%esi */ + } + } else { + EMIT2(0x89,0xde); /* mov %ebx,%esi */ +@@ -593,17 +706,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; break; default: /* hmm, too complex filter, give up with jit compiler */ @@ -26149,7 +26368,7 @@ index 33643a8..8e44870 100644 } proglen += ilen; addrs[i] = proglen; -@@ -624,11 +634,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; +@@ -624,11 +738,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; break; } if (proglen == oldproglen) { @@ -26163,7 +26382,7 @@ index 33643a8..8e44870 100644 } oldproglen = proglen; } -@@ -644,7 +652,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; +@@ -644,7 +756,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i]; bpf_flush_icache(image, image + proglen); fp->bpf_func = (void *)image; @@ -26175,7 +26394,7 @@ index 33643a8..8e44870 100644 out: kfree(addrs); return; -@@ -652,18 +663,20 @@ out: +@@ -652,18 +767,20 @@ out: static void jit_free_defer(struct work_struct *arg) { @@ -27822,7 +28041,7 @@ index 9a87daa..fb17486 100644 goto error; diff --git a/crypto/cryptd.c b/crypto/cryptd.c -index 671d4d6..afec999 100644 +index 7bdd61b..afec999 100644 --- a/crypto/cryptd.c +++ b/crypto/cryptd.c @@ -63,7 +63,7 @@ struct cryptd_blkcipher_ctx { @@ -27843,28 +28062,6 @@ index 671d4d6..afec999 100644 static void cryptd_queue_worker(struct work_struct *work); -@@ -137,13 +137,18 @@ static void cryptd_queue_worker(struct work_struct *work) - struct crypto_async_request *req, *backlog; - - cpu_queue = container_of(work, struct cryptd_cpu_queue, work); -- /* Only handle one request at a time to avoid hogging crypto -- * workqueue. preempt_disable/enable is used to prevent -- * being preempted by cryptd_enqueue_request() */ -+ /* -+ * Only handle one request at a time to avoid hogging crypto workqueue. -+ * preempt_disable/enable is used to prevent being preempted by -+ * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent -+ * cryptd_enqueue_request() being accessed from software interrupts. -+ */ -+ local_bh_disable(); - preempt_disable(); - backlog = crypto_get_backlog(&cpu_queue->queue); - req = crypto_dequeue_request(&cpu_queue->queue); - preempt_enable(); -+ local_bh_enable(); - - if (!req) - return; diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c index e6defd8..c26a225 100644 --- a/drivers/acpi/apei/cper.c @@ -31360,7 +31557,7 @@ index 3b663fc..57850f4 100644 if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full && rdev->pm.k8_bandwidth.full) diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c -index ebc6fac..a8313ed 100644 +index 578207e..1073f25 100644 --- a/drivers/gpu/drm/ttm/ttm_page_alloc.c +++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c @@ -394,9 +394,9 @@ static int ttm_pool_get_num_unused_pages(void) @@ -35401,7 +35598,7 @@ index 4a518a3..936b334 100644 #define VXGE_HW_VIRTUAL_PATH_HANDLE(vpath) \ ((struct __vxge_hw_vpath_handle *)(vpath)->vpath_handles.next) diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index b47d5b3..273a516 100644 +index df7bbba..162f850 100644 --- a/drivers/net/ethernet/realtek/r8169.c +++ b/drivers/net/ethernet/realtek/r8169.c @@ -745,22 +745,22 @@ struct rtl8169_private { @@ -36386,10 +36583,10 @@ index 61859d0..124539e 100644 /* No printks while decoding is disabled! */ if (!dev->mmio_always_on) { diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c -index 27911b5..5b6db88 100644 +index af028c7..654cdfc 100644 --- a/drivers/pci/proc.c +++ b/drivers/pci/proc.c -@@ -476,7 +476,16 @@ static const struct file_operations proc_bus_pci_dev_operations = { +@@ -484,7 +484,16 @@ static const struct file_operations proc_bus_pci_dev_operations = { static int __init pci_proc_init(void) { struct pci_dev *dev = NULL; @@ -42737,22 +42934,6 @@ index 88714ae..16c2e11 100644 static inline u32 get_pll_internal_frequency(u32 ref_freq, -diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c -index c3b3f7f..abd47c7 100644 ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -225,8 +225,10 @@ EXPORT_SYMBOL_GPL(register_virtio_device); - - void unregister_virtio_device(struct virtio_device *dev) - { -+ int index = dev->index; /* save for after device release */ -+ - device_unregister(&dev->dev); -- ida_simple_remove(&virtio_index_ida, dev->index); -+ ida_simple_remove(&virtio_index_ida, index); - } - EXPORT_SYMBOL_GPL(unregister_virtio_device); - diff --git a/drivers/virtio/virtio_mmio.c b/drivers/virtio/virtio_mmio.c index 453db0c..604973e 100644 --- a/drivers/virtio/virtio_mmio.c @@ -45008,7 +45189,7 @@ index b2a34a1..162fa69 100644 return rc; } diff --git a/fs/exec.c b/fs/exec.c -index fab2c6d..4fa20c0 100644 +index fab2c6d..6a13dff 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -55,6 +55,15 @@ @@ -45034,7 +45215,7 @@ index fab2c6d..4fa20c0 100644 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS +void __weak pax_set_initial_flags(struct linux_binprm *bprm) +{ -+ WARN_ONCE(1, "PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n"); ++ pr_warn_once("PAX: PAX_HAVE_ACL_FLAGS was enabled without providing the pax_set_initial_flags callback, this is probably not what you wanted.\n"); +} +#endif + @@ -45847,7 +46028,7 @@ index cf18217..8f6b9c3 100644 if (free_clusters >= (nclusters + dirty_clusters)) return 1; diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 5c69f2b..05dec7f 100644 +index b686b43..4b46d01 100644 --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -1248,19 +1248,19 @@ struct ext4_sb_info { @@ -46151,7 +46332,7 @@ index 96f2428..f5eeb8e 100644 if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) { diff --git a/fs/fs_struct.c b/fs/fs_struct.c -index 5df4775..9d9336f 100644 +index 5df4775..f656176 100644 --- a/fs/fs_struct.c +++ b/fs/fs_struct.c @@ -4,6 +4,7 @@ @@ -46201,7 +46382,14 @@ index 5df4775..9d9336f 100644 hits += replace_path(&fs->pwd, old_root, new_root); write_seqcount_end(&fs->seq); while (hits--) { -@@ -99,7 +116,8 @@ void exit_fs(struct task_struct *tsk) +@@ -94,12 +111,15 @@ void exit_fs(struct task_struct *tsk) + { + struct fs_struct *fs = tsk->fs; + ++ gr_put_exec_file(tsk); ++ + if (fs) { + int kill; task_lock(tsk); spin_lock(&fs->lock); tsk->fs = NULL; @@ -46211,7 +46399,7 @@ index 5df4775..9d9336f 100644 spin_unlock(&fs->lock); task_unlock(tsk); if (kill) -@@ -112,7 +130,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old) +@@ -112,7 +132,7 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old) struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL); /* We don't need to lock fs - think why ;-) */ if (fs) { @@ -46220,7 +46408,7 @@ index 5df4775..9d9336f 100644 fs->in_exec = 0; spin_lock_init(&fs->lock); seqcount_init(&fs->seq); -@@ -121,6 +139,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old) +@@ -121,6 +141,9 @@ struct fs_struct *copy_fs_struct(struct fs_struct *old) spin_lock(&old->lock); fs->root = old->root; path_get(&fs->root); @@ -46230,7 +46418,7 @@ index 5df4775..9d9336f 100644 fs->pwd = old->pwd; path_get(&fs->pwd); spin_unlock(&old->lock); -@@ -139,8 +160,9 @@ int unshare_fs_struct(void) +@@ -139,8 +162,9 @@ int unshare_fs_struct(void) task_lock(current); spin_lock(&fs->lock); @@ -46241,7 +46429,7 @@ index 5df4775..9d9336f 100644 spin_unlock(&fs->lock); task_unlock(current); -@@ -153,13 +175,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct); +@@ -153,13 +177,13 @@ EXPORT_SYMBOL_GPL(unshare_fs_struct); int current_umask(void) { @@ -46257,7 +46445,15 @@ index 5df4775..9d9336f 100644 .lock = __SPIN_LOCK_UNLOCKED(init_fs.lock), .seq = SEQCNT_ZERO, .umask = 0022, -@@ -175,12 +197,13 @@ void daemonize_fs_struct(void) +@@ -169,18 +193,21 @@ void daemonize_fs_struct(void) + { + struct fs_struct *fs = current->fs; + ++ gr_put_exec_file(current); ++ + if (fs) { + int kill; + task_lock(current); spin_lock(&init_fs.lock); @@ -48545,18 +48741,6 @@ index a9269f1..5490437 100644 set_fs(oldfs); if (host_err < 0) -diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c -index f35794b..a506360 100644 ---- a/fs/notify/fanotify/fanotify.c -+++ b/fs/notify/fanotify/fanotify.c -@@ -21,6 +21,7 @@ static bool should_merge(struct fsnotify_event *old, struct fsnotify_event *new) - if ((old->path.mnt == new->path.mnt) && - (old->path.dentry == new->path.dentry)) - return true; -+ break; - case (FSNOTIFY_EVENT_NONE): - return true; - default: diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c index d438036..0ecadde 100644 --- a/fs/notify/fanotify/fanotify_user.c @@ -50187,25 +50371,6 @@ index 1ccfa53..0848f95 100644 } else if (mm) { pid_t tid = vm_is_stack(priv->task, vma, is_pid); -diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c -index 29996e8..2d1e0f3 100644 ---- a/fs/pstore/platform.c -+++ b/fs/pstore/platform.c -@@ -161,12 +161,13 @@ static void pstore_console_write(struct console *con, const char *s, unsigned c) - - while (s < e) { - unsigned long flags; -+ u64 id; - - if (c > psinfo->bufsize) - c = psinfo->bufsize; - spin_lock_irqsave(&psinfo->buf_lock, flags); - memcpy(psinfo->buf, s, c); -- psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo); -+ psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo); - spin_unlock_irqrestore(&psinfo->buf_lock, flags); - s += c; - c = e - s; diff --git a/fs/quota/netlink.c b/fs/quota/netlink.c index d67908b..d13f6a6 100644 --- a/fs/quota/netlink.c @@ -50872,10 +51037,10 @@ index 4e00cf0..3374374 100644 kfree(s); diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig new file mode 100644 -index 0000000..d38b430 +index 0000000..10c36fb --- /dev/null +++ b/grsecurity/Kconfig -@@ -0,0 +1,947 @@ +@@ -0,0 +1,964 @@ +# +# grecurity configuration +# @@ -50938,6 +51103,23 @@ index 0000000..d38b430 + IF YOU USE XFree86. If you use XFree86 and you still want to + protect your kernel against modification, use the RBAC system. + ++config GRKERNSEC_JIT_HARDEN ++ bool "Harden BPF JIT against spray attacks" ++ default y if GRKERNSEC_CONFIG_AUTO ++ depends on BPF_JIT ++ help ++ If you say Y here, the native code generated by the kernel's Berkeley ++ Packet Filter (BPF) JIT engine will be hardened against JIT-spraying ++ attacks that attempt to fit attacker-beneficial instructions in ++ 32bit immediate fields of JIT-generated native instructions. The ++ attacker will generally aim to cause an unintended instruction sequence ++ of JIT-generated native code to execute by jumping into the middle of ++ a generated instruction. This feature effectively randomizes the 32bit ++ immediate constants present in the generated code to thwart such attacks. ++ ++ If you're using KERNEXEC, it's recommended that you enable this option ++ to supplement the hardening of the kernel. ++ +config GRKERNSEC_PROC_MEMMAP + bool "Harden ASLR against information leaks and entropy reduction" + default y if (GRKERNSEC_CONFIG_AUTO || PAX_NOEXEC || PAX_ASLR) @@ -51869,10 +52051,10 @@ index 0000000..1b9afa9 +endif diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c new file mode 100644 -index 0000000..b736032 +index 0000000..4428c82 --- /dev/null +++ b/grsecurity/gracl.c -@@ -0,0 +1,4040 @@ +@@ -0,0 +1,4056 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -55903,6 +56085,22 @@ index 0000000..b736032 + return (obj->mode & GR_FIND) ? 1 : 0; +} + ++void gr_put_exec_file(struct task_struct *task) ++{ ++ struct file *filp; ++ ++ write_lock(&grsec_exec_file_lock); ++ filp = task->exec_file; ++ task->exec_file = NULL; ++ write_unlock(&grsec_exec_file_lock); ++ ++ if (filp) ++ fput(filp); ++ ++ return; ++} ++ ++ +#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE +EXPORT_SYMBOL(gr_acl_is_enabled); +#endif @@ -58012,10 +58210,10 @@ index 0000000..9807ee2 +} diff --git a/grsecurity/grsec_disabled.c b/grsecurity/grsec_disabled.c new file mode 100644 -index 0000000..213ad8b +index 0000000..b79fe50 --- /dev/null +++ b/grsecurity/grsec_disabled.c -@@ -0,0 +1,437 @@ +@@ -0,0 +1,442 @@ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/sched.h> @@ -58447,6 +58645,11 @@ index 0000000..213ad8b + return dentry->d_inode->i_sb->s_dev; +} + ++void gr_put_exec_file(struct task_struct *task) ++{ ++ return; ++} ++ +EXPORT_SYMBOL(gr_learn_resource); +EXPORT_SYMBOL(gr_set_kernel_label); +#ifdef CONFIG_SECURITY @@ -62887,10 +63090,10 @@ index 0000000..54f4e85 +#define GR_SYMLINKOWNER_MSG "denied following symlink %.950s since symlink owner %u does not match target owner %u, by " diff --git a/include/linux/grsecurity.h b/include/linux/grsecurity.h new file mode 100644 -index 0000000..f9b9a21 +index 0000000..187b3ed --- /dev/null +++ b/include/linux/grsecurity.h -@@ -0,0 +1,238 @@ +@@ -0,0 +1,239 @@ +#ifndef GR_SECURITY_H +#define GR_SECURITY_H +#include <linux/fs.h> @@ -63103,6 +63306,7 @@ index 0000000..f9b9a21 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode); +void gr_audit_ptrace(struct task_struct *task); +dev_t gr_get_dev_from_dentry(struct dentry *dentry); ++void gr_put_exec_file(struct task_struct *task); + +int gr_ptrace_readexec(struct file *file, int unsafe_flags); + @@ -63237,50 +63441,68 @@ index aa2e167..84024ce 100644 }; diff --git a/include/linux/init.h b/include/linux/init.h -index 5e664f6..0a1225c 100644 +index 5e664f6..15ae326 100644 --- a/include/linux/init.h +++ b/include/linux/init.h -@@ -39,9 +39,15 @@ +@@ -39,9 +39,33 @@ * Also note, that this data cannot be "const". */ +#ifdef MODULE -+#define add_latent_entropy ++#define add_init_latent_entropy ++#else ++#define add_init_latent_entropy __latent_entropy ++#endif ++ ++#ifdef CONFIG_HOTPLUG ++#define add_devinit_latent_entropy ++#else ++#define add_devinit_latent_entropy __latent_entropy ++#endif ++ ++#ifdef CONFIG_HOTPLUG_CPU ++#define add_cpuinit_latent_entropy ++#else ++#define add_cpuinit_latent_entropy __latent_entropy ++#endif ++ ++#ifdef CONFIG_MEMORY_HOTPLUG ++#define add_meminit_latent_entropy +#else -+#define add_latent_entropy __latent_entropy ++#define add_meminit_latent_entropy __latent_entropy +#endif + /* These are for everybody (although not all archs will actually discard it in modules) */ -#define __init __section(.init.text) __cold notrace -+#define __init __section(.init.text) __cold notrace add_latent_entropy ++#define __init __section(.init.text) __cold notrace add_init_latent_entropy #define __initdata __section(.init.data) #define __initconst __section(.init.rodata) #define __exitdata __section(.exit.data) -@@ -83,7 +89,7 @@ +@@ -83,7 +107,7 @@ #define __exit __section(.exit.text) __exitused __cold notrace /* Used for HOTPLUG */ -#define __devinit __section(.devinit.text) __cold notrace -+#define __devinit __section(.devinit.text) __cold notrace add_latent_entropy ++#define __devinit __section(.devinit.text) __cold notrace add_devinit_latent_entropy #define __devinitdata __section(.devinit.data) #define __devinitconst __section(.devinit.rodata) #define __devexit __section(.devexit.text) __exitused __cold notrace -@@ -91,7 +97,7 @@ +@@ -91,7 +115,7 @@ #define __devexitconst __section(.devexit.rodata) /* Used for HOTPLUG_CPU */ -#define __cpuinit __section(.cpuinit.text) __cold notrace -+#define __cpuinit __section(.cpuinit.text) __cold notrace add_latent_entropy ++#define __cpuinit __section(.cpuinit.text) __cold notrace add_cpuinit_latent_entropy #define __cpuinitdata __section(.cpuinit.data) #define __cpuinitconst __section(.cpuinit.rodata) #define __cpuexit __section(.cpuexit.text) __exitused __cold notrace -@@ -99,7 +105,7 @@ +@@ -99,7 +123,7 @@ #define __cpuexitconst __section(.cpuexit.rodata) /* Used for MEMORY_HOTPLUG */ -#define __meminit __section(.meminit.text) __cold notrace -+#define __meminit __section(.meminit.text) __cold notrace add_latent_entropy ++#define __meminit __section(.meminit.text) __cold notrace add_meminit_latent_entropy #define __meminitdata __section(.meminit.data) #define __meminitconst __section(.meminit.rodata) #define __memexit __section(.memexit.text) __exitused __cold notrace @@ -63762,7 +63984,7 @@ index 1d1b1e1..2a13c78 100644 #define pmdp_clear_flush_notify(__vma, __address, __pmdp) \ diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 2daa54f..bfdf2f5 100644 +index a16d929..860ae00 100644 --- a/include/linux/mmzone.h +++ b/include/linux/mmzone.h @@ -414,7 +414,7 @@ struct zone { @@ -67384,21 +67606,10 @@ index 7fee567..8affa2c 100644 /* diff --git a/kernel/exit.c b/kernel/exit.c -index f65345f9..9c28dab 100644 +index f65345f9..1423231 100644 --- a/kernel/exit.c +++ b/kernel/exit.c -@@ -59,6 +59,10 @@ - #include <asm/pgtable.h> - #include <asm/mmu_context.h> - -+#ifdef CONFIG_GRKERNSEC -+extern rwlock_t grsec_exec_file_lock; -+#endif -+ - static void exit_mm(struct task_struct * tsk); - - static void __unhash_process(struct task_struct *p, bool group_dead) -@@ -182,6 +186,10 @@ void release_task(struct task_struct * p) +@@ -182,6 +182,10 @@ void release_task(struct task_struct * p) struct task_struct *leader; int zap_leader; repeat: @@ -67409,7 +67620,7 @@ index f65345f9..9c28dab 100644 /* don't need to get the RCU readlock here - the process is dead and * can't be modifying its own credentials. But shut RCU-lockdep up */ rcu_read_lock(); -@@ -394,7 +402,7 @@ int allow_signal(int sig) +@@ -394,7 +398,7 @@ int allow_signal(int sig) * know it'll be handled, so that they don't get converted to * SIGKILL or just silently dropped. */ @@ -67418,25 +67629,16 @@ index f65345f9..9c28dab 100644 recalc_sigpending(); spin_unlock_irq(¤t->sighand->siglock); return 0; -@@ -430,6 +438,17 @@ void daemonize(const char *name, ...) +@@ -430,6 +434,8 @@ void daemonize(const char *name, ...) vsnprintf(current->comm, sizeof(current->comm), name, args); va_end(args); -+#ifdef CONFIG_GRKERNSEC -+ write_lock(&grsec_exec_file_lock); -+ if (current->exec_file) { -+ fput(current->exec_file); -+ current->exec_file = NULL; -+ } -+ write_unlock(&grsec_exec_file_lock); -+#endif -+ + gr_set_kernel_label(current); + /* * If we were started as result of loading a module, close all of the * user space pages. We don't need them, and if we didn't close them -@@ -907,6 +926,8 @@ void do_exit(long code) +@@ -907,6 +913,8 @@ void do_exit(long code) struct task_struct *tsk = current; int group_dead; @@ -67445,7 +67647,7 @@ index f65345f9..9c28dab 100644 profile_task_exit(tsk); WARN_ON(blk_needs_flush_plug(tsk)); -@@ -923,7 +944,6 @@ void do_exit(long code) +@@ -923,7 +931,6 @@ void do_exit(long code) * mm_release()->clear_child_tid() from writing to a user-controlled * kernel address. */ @@ -67453,7 +67655,7 @@ index f65345f9..9c28dab 100644 ptrace_event(PTRACE_EVENT_EXIT, code); -@@ -982,6 +1002,9 @@ void do_exit(long code) +@@ -982,6 +989,9 @@ void do_exit(long code) tsk->exit_code = code; taskstats_exit(tsk, group_dead); @@ -67463,7 +67665,7 @@ index f65345f9..9c28dab 100644 exit_mm(tsk); if (group_dead) -@@ -1099,7 +1122,7 @@ SYSCALL_DEFINE1(exit, int, error_code) +@@ -1099,7 +1109,7 @@ SYSCALL_DEFINE1(exit, int, error_code) * Take down every thread in the group. This is called by fatal signals * as well as by sys_exit_group (below). */ @@ -68331,7 +68533,7 @@ index 91c32a0..7b88d63 100644 seq_printf(m, "%40s %14lu %29s %pS\n", name, stats->contending_point[i], diff --git a/kernel/module.c b/kernel/module.c -index 9ad9ee9..731c128 100644 +index 2a15c59..731c128 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -58,6 +58,7 @@ @@ -68620,7 +68822,7 @@ index 9ad9ee9..731c128 100644 } } -@@ -2266,28 +2284,33 @@ static void layout_symtab(struct module *mod, struct load_info *info) +@@ -2266,7 +2284,7 @@ static void layout_symtab(struct module *mod, struct load_info *info) /* Put symbol section at end of init part of module. */ symsect->sh_flags |= SHF_ALLOC; @@ -68629,23 +68831,8 @@ index 9ad9ee9..731c128 100644 info->index.sym) | INIT_OFFSET_MASK; pr_debug("\t%s\n", info->secstrings + symsect->sh_name); - src = (void *)info->hdr + symsect->sh_offset; - nsrc = symsect->sh_size / sizeof(*src); - -+ /* strtab always starts with a nul, so offset 0 is the empty string. */ -+ strtab_size = 1; -+ - /* Compute total space required for the core symbols' strtab. */ -- for (ndst = i = strtab_size = 1; i < nsrc; ++i, ++src) -- if (is_core_symbol(src, info->sechdrs, info->hdr->e_shnum)) { -- strtab_size += strlen(&info->strtab[src->st_name]) + 1; -+ for (ndst = i = 0; i < nsrc; i++) { -+ if (i == 0 || -+ is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { -+ strtab_size += strlen(&info->strtab[src[i].st_name])+1; - ndst++; - } -+ } +@@ -2286,13 +2304,13 @@ static void layout_symtab(struct module *mod, struct load_info *info) + } /* Append room for core symbols at end of core part. */ - info->symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1); @@ -68662,7 +68849,7 @@ index 9ad9ee9..731c128 100644 info->index.str) | INIT_OFFSET_MASK; pr_debug("\t%s\n", info->secstrings + strsect->sh_name); } -@@ -2305,24 +2328,28 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) +@@ -2310,12 +2328,14 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) /* Make sure we get permanent strtab: don't use info->strtab. */ mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; @@ -68677,23 +68864,10 @@ index 9ad9ee9..731c128 100644 + mod->core_symtab = dst = mod->module_core_rx + info->symoffs; + mod->core_strtab = s = mod->module_core_rx + info->stroffs; src = mod->symtab; -- *dst = *src; *s++ = 0; -- for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) { -- if (!is_core_symbol(src, info->sechdrs, info->hdr->e_shnum)) -- continue; -- -- dst[ndst] = *src; -- dst[ndst++].st_name = s - mod->core_strtab; -- s += strlcpy(s, &mod->strtab[src->st_name], KSYM_NAME_LEN) + 1; -+ for (ndst = i = 0; i < mod->num_symtab; i++) { -+ if (i == 0 || -+ is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { -+ dst[ndst] = src[i]; -+ dst[ndst++].st_name = s - mod->core_strtab; -+ s += strlcpy(s, &mod->strtab[src[i].st_name], -+ KSYM_NAME_LEN) + 1; -+ } + for (ndst = i = 0; i < mod->num_symtab; i++) { +@@ -2328,6 +2348,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) + } } mod->core_num_syms = ndst; + @@ -68701,7 +68875,7 @@ index 9ad9ee9..731c128 100644 } #else static inline void layout_symtab(struct module *mod, struct load_info *info) -@@ -2356,17 +2383,33 @@ void * __weak module_alloc(unsigned long size) +@@ -2361,17 +2383,33 @@ void * __weak module_alloc(unsigned long size) return size == 0 ? NULL : vmalloc_exec(size); } @@ -68740,7 +68914,7 @@ index 9ad9ee9..731c128 100644 mutex_unlock(&module_mutex); } return ret; -@@ -2544,8 +2587,14 @@ static struct module *setup_load_info(struct load_info *info) +@@ -2549,8 +2587,14 @@ static struct module *setup_load_info(struct load_info *info) static int check_modinfo(struct module *mod, struct load_info *info) { const char *modmagic = get_modinfo(info, "vermagic"); @@ -68755,7 +68929,7 @@ index 9ad9ee9..731c128 100644 /* This is allowed: modprobe --force will invalidate it. */ if (!modmagic) { err = try_to_force_load(mod, "bad vermagic"); -@@ -2568,7 +2617,7 @@ static int check_modinfo(struct module *mod, struct load_info *info) +@@ -2573,7 +2617,7 @@ static int check_modinfo(struct module *mod, struct load_info *info) } /* Set up license info based on the info section */ @@ -68764,7 +68938,7 @@ index 9ad9ee9..731c128 100644 return 0; } -@@ -2662,7 +2711,7 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2667,7 +2711,7 @@ static int move_module(struct module *mod, struct load_info *info) void *ptr; /* Do the allocs. */ @@ -68773,7 +68947,7 @@ index 9ad9ee9..731c128 100644 /* * The pointer to this block is stored in the module structure * which is inside the block. Just mark it as not being a -@@ -2672,23 +2721,50 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2677,23 +2721,50 @@ static int move_module(struct module *mod, struct load_info *info) if (!ptr) return -ENOMEM; @@ -68832,7 +69006,7 @@ index 9ad9ee9..731c128 100644 /* Transfer each section which specifies SHF_ALLOC */ pr_debug("final section addresses:\n"); -@@ -2699,16 +2775,45 @@ static int move_module(struct module *mod, struct load_info *info) +@@ -2704,16 +2775,45 @@ static int move_module(struct module *mod, struct load_info *info) if (!(shdr->sh_flags & SHF_ALLOC)) continue; @@ -68885,7 +69059,7 @@ index 9ad9ee9..731c128 100644 pr_debug("\t0x%lx %s\n", (long)shdr->sh_addr, info->secstrings + shdr->sh_name); } -@@ -2763,12 +2868,12 @@ static void flush_module_icache(const struct module *mod) +@@ -2768,12 +2868,12 @@ static void flush_module_icache(const struct module *mod) * Do it before processing of module parameters, so the module * can provide parameter accessor functions of its own. */ @@ -68904,7 +69078,7 @@ index 9ad9ee9..731c128 100644 set_fs(old_fs); } -@@ -2838,8 +2943,10 @@ out: +@@ -2843,8 +2943,10 @@ out: static void module_deallocate(struct module *mod, struct load_info *info) { percpu_modfree(mod); @@ -68917,7 +69091,7 @@ index 9ad9ee9..731c128 100644 } int __weak module_finalize(const Elf_Ehdr *hdr, -@@ -2852,7 +2959,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, +@@ -2857,7 +2959,9 @@ int __weak module_finalize(const Elf_Ehdr *hdr, static int post_relocation(struct module *mod, const struct load_info *info) { /* Sort exception table now relocations are done. */ @@ -68927,7 +69101,7 @@ index 9ad9ee9..731c128 100644 /* Copy relocated percpu area over. */ percpu_modcopy(mod, (void *)info->sechdrs[info->index.pcpu].sh_addr, -@@ -2903,9 +3012,38 @@ static struct module *load_module(void __user *umod, +@@ -2908,9 +3012,38 @@ static struct module *load_module(void __user *umod, if (err) goto free_unload; @@ -68966,7 +69140,7 @@ index 9ad9ee9..731c128 100644 /* Fix up syms, so that st_value is a pointer to location. */ err = simplify_symbols(mod, &info); if (err < 0) -@@ -2921,13 +3059,6 @@ static struct module *load_module(void __user *umod, +@@ -2926,13 +3059,6 @@ static struct module *load_module(void __user *umod, flush_module_icache(mod); @@ -68980,7 +69154,7 @@ index 9ad9ee9..731c128 100644 /* Mark state as coming so strong_try_module_get() ignores us. */ mod->state = MODULE_STATE_COMING; -@@ -2985,11 +3116,10 @@ static struct module *load_module(void __user *umod, +@@ -2990,11 +3116,10 @@ static struct module *load_module(void __user *umod, unlock: mutex_unlock(&module_mutex); synchronize_sched(); @@ -68993,7 +69167,7 @@ index 9ad9ee9..731c128 100644 free_unload: module_unload_free(mod); free_module: -@@ -3030,16 +3160,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -3035,16 +3160,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, MODULE_STATE_COMING, mod); /* Set RO and NX regions for core */ @@ -69018,7 +69192,7 @@ index 9ad9ee9..731c128 100644 do_mod_ctors(mod); /* Start the module */ -@@ -3085,11 +3215,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -3090,11 +3215,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, mod->strtab = mod->core_strtab; #endif unset_module_init_ro_nx(mod); @@ -69036,7 +69210,7 @@ index 9ad9ee9..731c128 100644 mutex_unlock(&module_mutex); return 0; -@@ -3120,10 +3251,16 @@ static const char *get_ksymbol(struct module *mod, +@@ -3125,10 +3251,16 @@ static const char *get_ksymbol(struct module *mod, unsigned long nextval; /* At worse, next value is at end of module */ @@ -69056,7 +69230,7 @@ index 9ad9ee9..731c128 100644 /* Scan for closest preceding symbol, and next symbol. (ELF starts real symbols at 1). */ -@@ -3358,7 +3495,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3363,7 +3495,7 @@ static int m_show(struct seq_file *m, void *p) char buf[8]; seq_printf(m, "%s %u", @@ -69065,7 +69239,7 @@ index 9ad9ee9..731c128 100644 print_unload_info(m, mod); /* Informative for users. */ -@@ -3367,7 +3504,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3372,7 +3504,7 @@ static int m_show(struct seq_file *m, void *p) mod->state == MODULE_STATE_COMING ? "Loading": "Live"); /* Used by oprofile and other similar tools. */ @@ -69074,7 +69248,7 @@ index 9ad9ee9..731c128 100644 /* Taints info */ if (mod->taints) -@@ -3403,7 +3540,17 @@ static const struct file_operations proc_modules_operations = { +@@ -3408,7 +3540,17 @@ static const struct file_operations proc_modules_operations = { static int __init proc_modules_init(void) { @@ -69092,7 +69266,7 @@ index 9ad9ee9..731c128 100644 return 0; } module_init(proc_modules_init); -@@ -3462,12 +3609,12 @@ struct module *__module_address(unsigned long addr) +@@ -3467,12 +3609,12 @@ struct module *__module_address(unsigned long addr) { struct module *mod; @@ -69108,7 +69282,7 @@ index 9ad9ee9..731c128 100644 return mod; return NULL; } -@@ -3501,11 +3648,20 @@ bool is_module_text_address(unsigned long addr) +@@ -3506,11 +3648,20 @@ bool is_module_text_address(unsigned long addr) */ struct module *__module_text_address(unsigned long addr) { @@ -71861,9 +72035,18 @@ index 9ed4fd4..c42648d 100644 * Make sure the vma is shared, that it supports prefaulting, * and that the remapped range is valid and fully within diff --git a/mm/highmem.c b/mm/highmem.c -index d517cd1..006a1c5 100644 +index d517cd1..9568fec 100644 --- a/mm/highmem.c +++ b/mm/highmem.c +@@ -98,7 +98,7 @@ struct page *kmap_to_page(void *vaddr) + { + unsigned long addr = (unsigned long)vaddr; + +- if (addr >= PKMAP_ADDR(0) && addr <= PKMAP_ADDR(LAST_PKMAP)) { ++ if (addr >= PKMAP_ADDR(0) && addr < PKMAP_ADDR(LAST_PKMAP)) { + int i = (addr - PKMAP_ADDR(0)) >> PAGE_SHIFT; + return pte_page(pkmap_page_table[i]); + } @@ -137,9 +137,10 @@ static void flush_all_zero_pkmaps(void) * So no dangers, even with speculative execution. */ @@ -74671,7 +74854,7 @@ index d4b0c10..ed421b5 100644 new->vm_region = region; diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index c13ea75..081ab2c 100644 +index d2d8f54..be2a87c 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -340,7 +340,7 @@ out: @@ -74887,7 +75070,7 @@ index aa95e59..b681a63 100644 struct anon_vma_chain *avc; struct anon_vma *anon_vma; diff --git a/mm/shmem.c b/mm/shmem.c -index d2eeca1..92f3123 100644 +index 31e1506..dbf3647 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -31,7 +31,7 @@ @@ -74908,7 +75091,7 @@ index d2eeca1..92f3123 100644 struct shmem_xattr { struct list_head list; /* anchored by shmem_inode_info->xattr_list */ -@@ -2207,6 +2207,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { +@@ -2219,6 +2219,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = { static int shmem_xattr_validate(const char *name) { struct { const char *prefix; size_t len; } arr[] = { @@ -74920,7 +75103,7 @@ index d2eeca1..92f3123 100644 { XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN }, { XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN } }; -@@ -2260,6 +2265,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name, +@@ -2272,6 +2277,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name, if (err) return err; @@ -74936,7 +75119,7 @@ index d2eeca1..92f3123 100644 if (size == 0) value = ""; /* empty EA, do not remove */ -@@ -2594,8 +2608,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) +@@ -2606,8 +2620,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) int err = -ENOMEM; /* Round up to L1_CACHE_BYTES to resist false sharing */ @@ -76125,19 +76308,6 @@ index 2bb90b1..3795e47 100644 v->addr, v->addr + v->size, v->size); if (v->caller) -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 99b434b..a018dfc 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -2953,6 +2953,8 @@ static int kswapd(void *p) - &balanced_classzone_idx); - } - } -+ -+ current->reclaim_state = NULL; - return 0; - } - diff --git a/mm/vmstat.c b/mm/vmstat.c index df7a674..8b4a4f3 100644 --- a/mm/vmstat.c @@ -76823,7 +76993,7 @@ index 0337e2b..47914a0 100644 return err; diff --git a/net/core/dev.c b/net/core/dev.c -index aed87a4..72cc526 100644 +index 1dce5b5..363a522 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1138,9 +1138,13 @@ void dev_load(struct net *net, const char *name) @@ -76867,7 +77037,7 @@ index aed87a4..72cc526 100644 #define DEV_GSO_CB(skb) ((struct dev_gso_cb *)(skb)->cb) -@@ -2928,7 +2932,7 @@ enqueue: +@@ -2930,7 +2934,7 @@ enqueue: local_irq_restore(flags); @@ -76876,7 +77046,7 @@ index aed87a4..72cc526 100644 kfree_skb(skb); return NET_RX_DROP; } -@@ -3000,7 +3004,7 @@ int netif_rx_ni(struct sk_buff *skb) +@@ -3002,7 +3006,7 @@ int netif_rx_ni(struct sk_buff *skb) } EXPORT_SYMBOL(netif_rx_ni); @@ -76885,7 +77055,7 @@ index aed87a4..72cc526 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); -@@ -3331,7 +3335,7 @@ ncls: +@@ -3333,7 +3337,7 @@ ncls: ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev); } else { drop: @@ -76894,7 +77064,7 @@ index aed87a4..72cc526 100644 kfree_skb(skb); /* Jamal, now you will not able to escape explaining * me how you were going to use this. :-) -@@ -3898,7 +3902,7 @@ void netif_napi_del(struct napi_struct *napi) +@@ -3900,7 +3904,7 @@ void netif_napi_del(struct napi_struct *napi) } EXPORT_SYMBOL(netif_napi_del); @@ -76903,7 +77073,7 @@ index aed87a4..72cc526 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); unsigned long time_limit = jiffies + 2; -@@ -4368,8 +4372,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) +@@ -4370,8 +4374,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) else seq_printf(seq, "%04x", ntohs(pt->type)); @@ -76917,7 +77087,7 @@ index aed87a4..72cc526 100644 } return 0; -@@ -5922,7 +5931,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, +@@ -5924,7 +5933,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, } else { netdev_stats_to_stats64(storage, &dev->stats); } @@ -77291,10 +77461,10 @@ index 8d07c97..d0812ef 100644 rc = qp->q.fragments && (end - start) > max; diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 5eea4a8..49819c2 100644 +index 14bbfcf..644f472 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c -@@ -1142,7 +1142,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, +@@ -1151,7 +1151,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, len = min_t(unsigned int, len, opt->optlen); if (put_user(len, optlen)) return -EFAULT; @@ -77304,7 +77474,7 @@ index 5eea4a8..49819c2 100644 return -EFAULT; return 0; } -@@ -1273,7 +1274,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, +@@ -1282,7 +1283,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, if (sk->sk_type != SOCK_STREAM) return -ENOPROTOOPT; @@ -77849,10 +78019,10 @@ index b10374d..0baa1f9 100644 if (ops->ndo_do_ioctl) { mm_segment_t oldfs = get_fs(); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index ba6d13d..6899122 100644 +index e02faed..9780f28 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c -@@ -989,7 +989,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, +@@ -990,7 +990,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, if (sk->sk_type != SOCK_STREAM) return -ENOPROTOOPT; @@ -78332,7 +78502,7 @@ index 34e4185..8823368 100644 return res; } diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index bb61f77..3788d63 100644 +index 642a2a3..9dcc3dd 100644 --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -28,6 +28,7 @@ @@ -78490,7 +78660,7 @@ index c97a065..ff61928 100644 return p; diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 1cfe6d5..c428ba3 100644 +index 7883449..17c6a9a 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1279,7 +1279,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) @@ -83091,7 +83261,7 @@ index 0000000..92ed719 + return 0; +} diff --git a/tools/gcc/generate_size_overflow_hash.sh b/tools/gcc/generate_size_overflow_hash.sh -new file mode 100644 +new file mode 100755 index 0000000..02c6bec --- /dev/null +++ b/tools/gcc/generate_size_overflow_hash.sh @@ -83365,10 +83535,10 @@ index 0000000..a86e422 +} diff --git a/tools/gcc/kernexec_plugin.c b/tools/gcc/kernexec_plugin.c new file mode 100644 -index 0000000..98011fa +index 0000000..8856202 --- /dev/null +++ b/tools/gcc/kernexec_plugin.c -@@ -0,0 +1,427 @@ +@@ -0,0 +1,432 @@ +/* + * Copyright 2011 by the PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -83409,6 +83579,10 @@ index 0000000..98011fa +extern void print_gimple_stmt(FILE *, gimple, int, int); +extern rtx emit_move_insn(rtx x, rtx y); + ++#if BUILDING_GCC_VERSION <= 4006 ++#define ANY_RETURN_P(rtx) (GET_CODE(rtx) == RETURN) ++#endif ++ +int plugin_is_GPL_compatible; + +static struct plugin_info kernexec_plugin_info = { @@ -83713,6 +83887,7 @@ index 0000000..98011fa + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) { + // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil)) + // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil)) ++ // (jump_insn 97 96 98 6 (simple_return) fptr.c:50 -1 (nil) -> simple_return) + rtx body; + + // is it a retn @@ -83721,7 +83896,7 @@ index 0000000..98011fa + body = PATTERN(insn); + if (GET_CODE(body) == PARALLEL) + body = XVECEXP(body, 0, 0); -+ if (GET_CODE(body) != RETURN) ++ if (!ANY_RETURN_P(body)) + continue; + kernexec_instrument_retaddr(insn); + } @@ -84099,10 +84274,10 @@ index 0000000..b8008f7 +} diff --git a/tools/gcc/size_overflow_hash.data b/tools/gcc/size_overflow_hash.data new file mode 100644 -index 0000000..9332f17 +index 0000000..67468e3 --- /dev/null +++ b/tools/gcc/size_overflow_hash.data -@@ -0,0 +1,3597 @@ +@@ -0,0 +1,3600 @@ +_000001_hash alloc_dr 2 65495 _000001_hash NULL +_000002_hash __copy_from_user 3 10918 _000002_hash NULL +_000003_hash copy_from_user 3 17559 _000003_hash NULL @@ -87700,6 +87875,9 @@ index 0000000..9332f17 +_003894_hash io_mapping_map_wc 2 19284 _003894_hash NULL +_003895_hash nfs_dns_resolve_name 3 25036 _003895_hash NULL +_003896_hash nfs_parse_server_name 2 1899 _003896_hash NULL ++_003897_hash acl_alloc 1 35979 _003897_hash NULL ++_003898_hash acl_alloc_stack_init 1 60630 _003898_hash NULL ++_003899_hash create_table 2 16213 _003899_hash NULL diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c new file mode 100644 index 0000000..1aa0dce |