diff options
author | Anthony G. Basile <blueness@gentoo.org> | 2011-10-08 09:56:07 -0400 |
---|---|---|
committer | Anthony G. Basile <blueness@gentoo.org> | 2011-10-08 09:56:07 -0400 |
commit | dcbd363977ec7e81dc743433e3e48cd24572528e (patch) | |
tree | b7274b8e20150143ada5e2e89d3f8c9bba723f01 | |
parent | Grsec/PaX: 2.2.2-2.6.32.46-201109261052 + 2.2.2-3.0.4-201109261052.patch (diff) | |
download | hardened-patchset-dcbd363977ec7e81dc743433e3e48cd24572528e.tar.gz hardened-patchset-dcbd363977ec7e81dc743433e3e48cd24572528e.tar.bz2 hardened-patchset-dcbd363977ec7e81dc743433e3e48cd24572528e.zip |
Grsec/PaX: 2.2.2-2.6.32.46-201110061013 + 2.2.2-3.0.4-20111006042120111006
-rw-r--r-- | 2.6.32/0000_README | 2 | ||||
-rw-r--r-- | 2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201110061013.patch (renamed from 2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201109261052.patch) | 2883 | ||||
-rw-r--r-- | 2.6.32/4425_grsec-pax-without-grsec.patch | 2 | ||||
-rw-r--r-- | 2.6.32/4435_grsec-kconfig-gentoo.patch | 21 | ||||
-rw-r--r-- | 3.0.4/0000_README | 2 | ||||
-rw-r--r-- | 3.0.4/4420_grsecurity-2.2.2-3.0.4-201110060421.patch (renamed from 3.0.4/4420_grsecurity-2.2.2-3.0.4-201109261052.patch) | 3178 | ||||
-rw-r--r-- | 3.0.4/4435_grsec-kconfig-gentoo.patch | 4 |
7 files changed, 5234 insertions, 858 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index 4cb87d7..d9050ac 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -3,7 +3,7 @@ README Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.2.2-2.6.32.46-201109261052.patch +Patch: 4420_grsecurity-2.2.2-2.6.32.46-201110061013.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201109261052.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201110061013.patch index bab9029..2e6cafe 100644 --- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201109261052.patch +++ b/2.6.32/4420_grsecurity-2.2.2-2.6.32.46-201110061013.patch @@ -6727,6 +6727,83 @@ diff -urNp linux-2.6.32.46/arch/x86/boot/video-vesa.c linux-2.6.32.46/arch/x86/b } /* +diff -urNp linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S +--- linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/crypto/aes-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -8,6 +8,8 @@ + * including this sentence is retained in full. + */ + ++#include <asm/alternative-asm.h> ++ + .extern crypto_ft_tab + .extern crypto_it_tab + .extern crypto_fl_tab +@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \ + je B192; \ + leaq 32(r9),r9; + ++#define ret pax_force_retaddr; ret ++ + #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \ + movq r1,r2; \ + movq r3,r4; \ +diff -urNp linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S +--- linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -1,3 +1,5 @@ ++#include <asm/alternative-asm.h> ++ + # enter ECRYPT_encrypt_bytes + .text + .p2align 5 +@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes: + add %r11,%rsp + mov %rdi,%rax + mov %rsi,%rdx ++ pax_force_retaddr + ret + # bytesatleast65: + ._bytesatleast65: +@@ -891,6 +894,7 @@ ECRYPT_keysetup: + add %r11,%rsp + mov %rdi,%rax + mov %rsi,%rdx ++ pax_force_retaddr + ret + # enter ECRYPT_ivsetup + .text +@@ -917,4 +921,5 @@ ECRYPT_ivsetup: + add %r11,%rsp + mov %rdi,%rax + mov %rsi,%rdx ++ pax_force_retaddr + ret +diff -urNp linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S +--- linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -21,6 +21,7 @@ + .text + + #include <asm/asm-offsets.h> ++#include <asm/alternative-asm.h> + + #define a_offset 0 + #define b_offset 4 +@@ -269,6 +270,7 @@ twofish_enc_blk: + + popq R1 + movq $1,%rax ++ pax_force_retaddr + ret + + twofish_dec_blk: +@@ -321,4 +323,5 @@ twofish_dec_blk: + + popq R1 + movq $1,%rax ++ pax_force_retaddr + ret diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_aout.c linux-2.6.32.46/arch/x86/ia32/ia32_aout.c --- linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/ia32/ia32_aout.c 2011-04-17 15:56:46.000000000 -0400 @@ -6933,7 +7010,34 @@ diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32entry.S linux-2.6.32.46/arch/x86/ia cmpq $(IA32_NR_syscalls-1),%rax diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_signal.c linux-2.6.32.46/arch/x86/ia32/ia32_signal.c --- linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/ia32/ia32_signal.c 2011-10-06 09:37:08.000000000 -0400 +@@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const + } + seg = get_fs(); + set_fs(KERNEL_DS); +- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp); ++ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp); + set_fs(seg); + if (ret >= 0 && uoss_ptr) { + if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t))) +@@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct + */ + static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, + size_t frame_size, +- void **fpstate) ++ void __user **fpstate) + { + unsigned long sp; + +@@ -395,7 +395,7 @@ static void __user *get_sigframe(struct + + if (used_math()) { + sp = sp - sig_xstate_ia32_size; +- *fpstate = (struct _fpstate_ia32 *) sp; ++ *fpstate = (struct _fpstate_ia32 __user *) sp; + if (save_i387_xstate_ia32(*fpstate) < 0) + return (void __user *) -1L; + } @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct sp -= frame_size; /* Align the stack pointer according to the i386 ABI, @@ -6948,7 +7052,7 @@ diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_signal.c linux-2.6.32.46/arch/x86/ * gdb versions depend on them as a marker. */ - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); -+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); ++ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode); } put_user_catch(err); if (err) @@ -6979,10 +7083,88 @@ diff -urNp linux-2.6.32.46/arch/x86/ia32/ia32_signal.c linux-2.6.32.46/arch/x86/ * versions need it. */ - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); -+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); ++ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode); } put_user_catch(err); if (err) +diff -urNp linux-2.6.32.46/arch/x86/ia32/sys_ia32.c linux-2.6.32.46/arch/x86/ia32/sys_ia32.c +--- linux-2.6.32.46/arch/x86/ia32/sys_ia32.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/ia32/sys_ia32.c 2011-10-06 09:37:14.000000000 -0400 +@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign + */ + static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat) + { +- typeof(ubuf->st_uid) uid = 0; +- typeof(ubuf->st_gid) gid = 0; ++ typeof(((struct stat64 *)0)->st_uid) uid = 0; ++ typeof(((struct stat64 *)0)->st_gid) gid = 0; + SET_UID(uid, stat->uid); + SET_GID(gid, stat->gid); + if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) || +@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int + } + set_fs(KERNEL_DS); + ret = sys_rt_sigprocmask(how, +- set ? (sigset_t __user *)&s : NULL, +- oset ? (sigset_t __user *)&s : NULL, ++ set ? (sigset_t __force_user *)&s : NULL, ++ oset ? (sigset_t __force_user *)&s : NULL, + sigsetsize); + set_fs(old_fs); + if (ret) +@@ -371,7 +371,7 @@ asmlinkage long sys32_sched_rr_get_inter + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t); ++ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t); + set_fs(old_fs); + if (put_compat_timespec(&t, interval)) + return -EFAULT; +@@ -387,7 +387,7 @@ asmlinkage long sys32_rt_sigpending(comp + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize); ++ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize); + set_fs(old_fs); + if (!ret) { + switch (_NSIG_WORDS) { +@@ -412,7 +412,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in + if (copy_siginfo_from_user32(&info, uinfo)) + return -EFAULT; + set_fs(KERNEL_DS); +- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info); ++ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info); + set_fs(old_fs); + return ret; + } +@@ -513,7 +513,7 @@ asmlinkage long sys32_sendfile(int out_f + return -EFAULT; + + set_fs(KERNEL_DS); +- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL, ++ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL, + count); + set_fs(old_fs); + +diff -urNp linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h +--- linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/alternative-asm.h 2011-10-06 09:37:14.000000000 -0400 +@@ -19,4 +19,13 @@ + .endm + #endif + ++#ifdef CONFIG_PAX_KERNEXEC_PLUGIN ++ .macro pax_force_retaddr rip=0 ++ btsq $63,\rip(%rsp) ++ .endm ++#else ++ .macro pax_force_retaddr rip=0 ++ .endm ++#endif ++ + #endif /* __ASSEMBLY__ */ diff -urNp linux-2.6.32.46/arch/x86/include/asm/alternative.h linux-2.6.32.46/arch/x86/include/asm/alternative.h --- linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/include/asm/alternative.h 2011-04-17 15:56:46.000000000 -0400 @@ -8279,6 +8461,63 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/cache.h linux-2.6.32.46/arch/x86 #ifdef CONFIG_X86_VSMP /* vSMP Internode cacheline shift */ +diff -urNp linux-2.6.32.46/arch/x86/include/asm/calling.h linux-2.6.32.46/arch/x86/include/asm/calling.h +--- linux-2.6.32.46/arch/x86/include/asm/calling.h 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/calling.h 2011-10-06 10:08:42.000000000 -0400 +@@ -52,32 +52,32 @@ For 32-bit we have the following convent + * for assembly code: + */ + +-#define R15 0 +-#define R14 8 +-#define R13 16 +-#define R12 24 +-#define RBP 32 +-#define RBX 40 ++#define R15 (0) ++#define R14 (8) ++#define R13 (16) ++#define R12 (24) ++#define RBP (32) ++#define RBX (40) + + /* arguments: interrupts/non tracing syscalls only save up to here: */ +-#define R11 48 +-#define R10 56 +-#define R9 64 +-#define R8 72 +-#define RAX 80 +-#define RCX 88 +-#define RDX 96 +-#define RSI 104 +-#define RDI 112 +-#define ORIG_RAX 120 /* + error_code */ ++#define R11 (48) ++#define R10 (56) ++#define R9 (64) ++#define R8 (72) ++#define RAX (80) ++#define RCX (88) ++#define RDX (96) ++#define RSI (104) ++#define RDI (112) ++#define ORIG_RAX (120) /* + error_code */ + /* end of arguments */ + + /* cpu exception frame or undefined in case of fast syscall: */ +-#define RIP 128 +-#define CS 136 +-#define EFLAGS 144 +-#define RSP 152 +-#define SS 160 ++#define RIP (128) ++#define CS (136) ++#define EFLAGS (144) ++#define RSP (152) ++#define SS (160) + + #define ARGOFFSET R11 + #define SWFRAME ORIG_RAX diff -urNp linux-2.6.32.46/arch/x86/include/asm/checksum_32.h linux-2.6.32.46/arch/x86/include/asm/checksum_32.h --- linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/include/asm/checksum_32.h 2011-04-17 15:56:46.000000000 -0400 @@ -8650,12 +8889,12 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/emergency-restart.h linux-2.6.32 #endif /* _ASM_X86_EMERGENCY_RESTART_H */ diff -urNp linux-2.6.32.46/arch/x86/include/asm/futex.h linux-2.6.32.46/arch/x86/include/asm/futex.h --- linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/futex.h 2011-10-06 09:37:08.000000000 -0400 @@ -12,16 +12,18 @@ #include <asm/system.h> #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \ -+ typecheck(u32 *, uaddr); \ ++ typecheck(u32 __user *, uaddr); \ asm volatile("1:\t" insn "\n" \ "2:\t.section .fixup,\"ax\"\n" \ "3:\tmov\t%3, %1\n" \ @@ -8663,11 +8902,11 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/futex.h linux-2.6.32.46/arch/x86 "\t.previous\n" \ _ASM_EXTABLE(1b, 3b) \ - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \ -+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\ ++ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\ : "i" (-EFAULT), "0" (oparg), "1" (0)) #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \ -+ typecheck(u32 *, uaddr); \ ++ typecheck(u32 __user *, uaddr); \ asm volatile("1:\tmovl %2, %0\n" \ "\tmovl\t%0, %3\n" \ "\t" insn "\n" \ @@ -8676,7 +8915,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/futex.h linux-2.6.32.46/arch/x86 _ASM_EXTABLE(2b, 4b) \ : "=&a" (oldval), "=&r" (ret), \ - "+m" (*uaddr), "=&r" (tem) \ -+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \ ++ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \ : "r" (oparg), "i" (-EFAULT), "1" (0)) -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr) @@ -9273,7 +9512,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/mmu.h linux-2.6.32.46/arch/x86/i #ifdef CONFIG_SMP diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x86/include/asm/module.h --- linux-2.6.32.46/arch/x86/include/asm/module.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/module.h 2011-04-23 13:18:57.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/module.h 2011-10-06 09:45:50.000000000 -0400 @@ -5,6 +5,7 @@ #ifdef CONFIG_X86_64 @@ -9282,7 +9521,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x8 #elif defined CONFIG_M386 #define MODULE_PROC_FAMILY "386 " #elif defined CONFIG_M486 -@@ -59,13 +60,36 @@ +@@ -59,13 +60,42 @@ #error unknown processor family #endif @@ -9293,6 +9532,12 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x8 -# define MODULE_STACKSIZE "" -# endif -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE ++#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS) ++#define MODULE_STACKSIZE "4KSTACKS " ++#else ++#define MODULE_STACKSIZE "" + #endif + +#ifdef CONFIG_PAX_MEMORY_UDEREF +#define MODULE_PAX_UDEREF "UDEREF " +#else @@ -9309,12 +9554,12 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x8 +#define MODULE_PAX_REFCOUNT "REFCOUNT " +#else +#define MODULE_PAX_REFCOUNT "" - #endif - -+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS) -+#define MODULE_STACKSIZE "4KSTACKS " ++#endif ++ ++#ifdef CONSTIFY_PLUGIN ++#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN " +#else -+#define MODULE_STACKSIZE "" ++#define MODULE_CONSTIFY_PLUGIN "" +#endif + +#ifdef CONFIG_GRKERNSEC @@ -9323,7 +9568,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/module.h linux-2.6.32.46/arch/x8 +#define MODULE_GRSEC "" +#endif + -+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT ++#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN + #endif /* _ASM_X86_MODULE_H */ diff -urNp linux-2.6.32.46/arch/x86/include/asm/page_64_types.h linux-2.6.32.46/arch/x86/include/asm/page_64_types.h @@ -10313,8 +10558,8 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/rwsem.h linux-2.6.32.46/arch/x86 diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x86/include/asm/segment.h --- linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-04-17 15:56:46.000000000 -0400 -@@ -62,8 +62,8 @@ ++++ linux-2.6.32.46/arch/x86/include/asm/segment.h 2011-10-06 09:37:08.000000000 -0400 +@@ -62,10 +62,15 @@ * 26 - ESPFIX small SS * 27 - per-cpu [ offset to per-cpu data area ] * 28 - stack_canary-20 [ for stack protector ] @@ -10324,8 +10569,15 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x + * 30 - PCI BIOS DS * 31 - TSS for double fault handler */ ++#define GDT_ENTRY_KERNEXEC_EFI_CS (1) ++#define GDT_ENTRY_KERNEXEC_EFI_DS (2) ++#define __KERNEXEC_EFI_CS (GDT_ENTRY_KERNEXEC_EFI_CS*8) ++#define __KERNEXEC_EFI_DS (GDT_ENTRY_KERNEXEC_EFI_DS*8) ++ #define GDT_ENTRY_TLS_MIN 6 -@@ -77,6 +77,8 @@ + #define GDT_ENTRY_TLS_MAX (GDT_ENTRY_TLS_MIN + GDT_ENTRY_TLS_ENTRIES - 1) + +@@ -77,6 +82,8 @@ #define GDT_ENTRY_KERNEL_CS (GDT_ENTRY_KERNEL_BASE + 0) @@ -10334,7 +10586,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x #define GDT_ENTRY_KERNEL_DS (GDT_ENTRY_KERNEL_BASE + 1) #define GDT_ENTRY_TSS (GDT_ENTRY_KERNEL_BASE + 4) -@@ -88,7 +90,7 @@ +@@ -88,7 +95,7 @@ #define GDT_ENTRY_ESPFIX_SS (GDT_ENTRY_KERNEL_BASE + 14) #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8) @@ -10343,7 +10595,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x #ifdef CONFIG_SMP #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8) #else -@@ -102,6 +104,12 @@ +@@ -102,6 +109,12 @@ #define __KERNEL_STACK_CANARY 0 #endif @@ -10356,7 +10608,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x #define GDT_ENTRY_DOUBLEFAULT_TSS 31 /* -@@ -139,7 +147,7 @@ +@@ -139,7 +152,7 @@ */ /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */ @@ -10365,7 +10617,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x #else -@@ -163,6 +171,8 @@ +@@ -163,6 +176,8 @@ #define __USER32_CS (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3) #define __USER32_DS __USER_DS @@ -10374,7 +10626,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/segment.h linux-2.6.32.46/arch/x #define GDT_ENTRY_TSS 8 /* needs two entries */ #define GDT_ENTRY_LDT 10 /* needs two entries */ #define GDT_ENTRY_TLS_MIN 12 -@@ -183,6 +193,7 @@ +@@ -183,6 +198,7 @@ #endif #define __KERNEL_CS (GDT_ENTRY_KERNEL_CS * 8) @@ -10858,7 +11110,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_32.h linux-2.6.32.46/arc long __must_check __strncpy_from_user(char *dst, diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h --- linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h 2011-10-06 09:37:08.000000000 -0400 @@ -9,6 +9,9 @@ #include <linux/prefetch.h> #include <linux/lockdep.h> @@ -10906,7 +11158,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + src += PAX_USER_SHADOW_BASE; +#endif + -+ return copy_user_generic(dst, (__force const void *)src, size); ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); + } switch (size) { - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src, @@ -10955,7 +11207,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + src += PAX_USER_SHADOW_BASE; +#endif + -+ return copy_user_generic(dst, (__force const void *)src, size); ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); } } @@ -10968,6 +11220,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc might_fault(); - if (!__builtin_constant_p(size)) +- return copy_user_generic((__force void *)dst, src, size); + + pax_track_stack(); + @@ -10987,7 +11240,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); ++ return copy_user_generic((__force_kernel void *)dst, src, size); + } switch (size) { - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst, @@ -11029,18 +11282,18 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc ret, "q", "", "er", 8); return ret; default: +- return copy_user_generic((__force void *)dst, src, size); + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); - } - } - - static __always_inline __must_check --int __copy_in_user(void __user *dst, const void __user *src, unsigned size) ++ return copy_user_generic((__force_kernel void *)dst, src, size); ++ } ++} ++ ++static __always_inline __must_check +unsigned long copy_to_user(void __user *to, const void *from, unsigned len) +{ + if (access_ok(VERIFY_WRITE, to, len)) @@ -11060,11 +11313,12 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + if (!__builtin_constant_p(len)) + check_object_size(to, len, false); + memset(to, 0, len); -+ } + } + return len; -+} -+ -+static __always_inline __must_check + } + + static __always_inline __must_check +-int __copy_in_user(void __user *dst, const void __user *src, unsigned size) +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size) { - int ret = 0; @@ -11072,6 +11326,8 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc might_fault(); - if (!__builtin_constant_p(size)) +- return copy_user_generic((__force void *)dst, +- (__force void *)src, size); + + pax_track_stack(); + @@ -11094,9 +11350,8 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, -- (__force void *)src, size); -+ (__force const void *)src, size); ++ return copy_user_generic((__force_kernel void *)dst, ++ (__force_kernel const void *)src, size); + } switch (size) { case 1: { @@ -11137,6 +11392,8 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc return ret; } default: +- return copy_user_generic((__force void *)dst, +- (__force void *)src, size); + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)src < PAX_USER_SHADOW_BASE) @@ -11145,9 +11402,8 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, -- (__force void *)src, size); -+ (__force const void *)src, size); ++ return copy_user_generic((__force_kernel void *)dst, ++ (__force_kernel const void *)src, size); } } @@ -11164,8 +11420,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + + if ((int)size < 0) + return size; - --static __must_check __always_inline int ++ +#ifdef CONFIG_PAX_MEMORY_UDEREF + if (!__access_ok(VERIFY_READ, src, size)) + return size; @@ -11173,13 +11428,15 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + if ((unsigned long)src < PAX_USER_SHADOW_BASE) + src += PAX_USER_SHADOW_BASE; +#endif -+ -+ return copy_user_generic(dst, (__force const void *)src, size); + +-static __must_check __always_inline int ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); +} + +static __must_check __always_inline unsigned long __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size) { +- return copy_user_generic((__force void *)dst, src, size); + if ((int)size < 0) + return size; + @@ -11191,7 +11448,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); ++ return copy_user_generic((__force_kernel void *)dst, src, size); } -extern long __copy_user_nocache(void *dst, const void __user *src, @@ -11232,13 +11489,14 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess_64.h linux-2.6.32.46/arc } -unsigned long +-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest); +extern unsigned long - copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest); ++copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest); #endif /* _ASM_X86_UACCESS_64_H */ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess.h linux-2.6.32.46/arch/x86/include/asm/uaccess.h --- linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-06-25 12:55:34.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-06-25 12:56:37.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/uaccess.h 2011-10-06 09:37:08.000000000 -0400 @@ -8,12 +8,15 @@ #include <linux/thread_info.h> #include <linux/prefetch.h> @@ -11338,6 +11596,15 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess.h linux-2.6.32.46/arch/x "3:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ _ASM_EXTABLE(2b, 3b - 2b) \ +@@ -253,7 +295,7 @@ extern void __put_user_8(void); + __typeof__(*(ptr)) __pu_val; \ + __chk_user_ptr(ptr); \ + might_fault(); \ +- __pu_val = x; \ ++ __pu_val = (x); \ + switch (sizeof(*(ptr))) { \ + case 1: \ + __put_user_x(1, __pu_val, ptr, __ret_pu); \ @@ -374,7 +416,7 @@ do { \ } while (0) @@ -11457,6 +11724,18 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/uaccess.h linux-2.6.32.46/arch/x #ifdef CONFIG_X86_32 # include "uaccess_32.h" #else +diff -urNp linux-2.6.32.46/arch/x86/include/asm/vdso.h linux-2.6.32.46/arch/x86/include/asm/vdso.h +--- linux-2.6.32.46/arch/x86/include/asm/vdso.h 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/vdso.h 2011-10-06 09:37:14.000000000 -0400 +@@ -25,7 +25,7 @@ extern const char VDSO32_PRELINK[]; + #define VDSO32_SYMBOL(base, name) \ + ({ \ + extern const char VDSO32_##name[]; \ +- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \ ++ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \ + }) + #endif + diff -urNp linux-2.6.32.46/arch/x86/include/asm/vgtod.h linux-2.6.32.46/arch/x86/include/asm/vgtod.h --- linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/include/asm/vgtod.h 2011-04-17 15:56:46.000000000 -0400 @@ -11610,7 +11889,7 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/x86_init.h linux-2.6.32.46/arch/ extern struct x86_cpuinit_ops x86_cpuinit; diff -urNp linux-2.6.32.46/arch/x86/include/asm/xsave.h linux-2.6.32.46/arch/x86/include/asm/xsave.h --- linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/include/asm/xsave.h 2011-10-06 09:37:08.000000000 -0400 @@ -56,6 +56,12 @@ static inline int xrstor_checking(struct static inline int xsave_user(struct xsave_struct __user *buf) { @@ -11624,7 +11903,12 @@ diff -urNp linux-2.6.32.46/arch/x86/include/asm/xsave.h linux-2.6.32.46/arch/x86 __asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n" "2:\n" ".section .fixup,\"ax\"\n" -@@ -82,6 +88,11 @@ static inline int xrestore_user(struct x +@@ -78,10 +84,15 @@ static inline int xsave_user(struct xsav + static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask) + { + int err; +- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf); ++ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf); u32 lmask = mask; u32 hmask = mask >> 32; @@ -13067,8 +13351,8 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/early_printk.c linux-2.6.32.46/arch/x early_console->write(early_console, buf, n); diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/kernel/efi_32.c --- linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-04-17 15:56:46.000000000 -0400 -@@ -38,70 +38,38 @@ ++++ linux-2.6.32.46/arch/x86/kernel/efi_32.c 2011-10-06 09:37:08.000000000 -0400 +@@ -38,70 +38,56 @@ */ static unsigned long efi_rt_eflags; @@ -13082,7 +13366,10 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/ker - unsigned long temp; struct desc_ptr gdt_descr; - local_irq_save(efi_rt_eflags); +- local_irq_save(efi_rt_eflags); ++#ifdef CONFIG_PAX_KERNEXEC ++ struct desc_struct d; ++#endif - /* - * If I don't have PAE, I should just duplicate two entries in page @@ -13090,6 +13377,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/ker - * page directory. - */ - cr4 = read_cr4_safe(); ++ local_irq_save(efi_rt_eflags); - if (cr4 & X86_CR4_PAE) { - efi_bak_pg_dir_pointer[0].pgd = @@ -13116,8 +13404,14 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/ker */ __flush_tlb_all(); -- gdt_descr.address = __pa(get_cpu_gdt_table(0)); -+ gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0)); ++#ifdef CONFIG_PAX_KERNEXEC ++ pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S); ++ pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S); ++#endif ++ + gdt_descr.address = __pa(get_cpu_gdt_table(0)); gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); } @@ -13128,8 +13422,15 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/ker - unsigned long cr4; struct desc_ptr gdt_descr; -- gdt_descr.address = (unsigned long)get_cpu_gdt_table(0); -+ gdt_descr.address = get_cpu_gdt_table(0); ++#ifdef CONFIG_PAX_KERNEXEC ++ struct desc_struct d; ++ ++ memset(&d, 0, sizeof d); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S); ++#endif ++ + gdt_descr.address = (unsigned long)get_cpu_gdt_table(0); gdt_descr.size = GDT_SIZE - 1; load_gdt(&gdt_descr); @@ -13150,16 +13451,18 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_32.c linux-2.6.32.46/arch/x86/ker * After the lock is released, the original page table is restored. diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S --- linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-04-17 15:56:46.000000000 -0400 -@@ -6,6 +6,7 @@ ++++ linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S 2011-10-06 09:37:08.000000000 -0400 +@@ -6,7 +6,9 @@ */ #include <linux/linkage.h> +#include <linux/init.h> #include <asm/page_types.h> ++#include <asm/segment.h> /* -@@ -20,7 +21,7 @@ + * efi_call_phys(void *, ...) is a function with variable parameters. +@@ -20,7 +22,7 @@ * service functions will comply with gcc calling convention, too. */ @@ -13168,18 +13471,22 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x8 ENTRY(efi_call_phys) /* * 0. The function can only be called in Linux kernel. So CS has been -@@ -36,9 +37,7 @@ ENTRY(efi_call_phys) +@@ -36,9 +38,11 @@ ENTRY(efi_call_phys) * The mapping of lower virtual memory has been created in prelog and * epilog. */ - movl $1f, %edx - subl $__PAGE_OFFSET, %edx - jmp *%edx -+ jmp 1f-__PAGE_OFFSET ++ movl $(__KERNEXEC_EFI_DS), %edx ++ mov %edx, %ds ++ mov %edx, %es ++ mov %edx, %ss ++ ljmp $(__KERNEXEC_EFI_CS),$1f-__PAGE_OFFSET 1: /* -@@ -47,14 +46,8 @@ ENTRY(efi_call_phys) +@@ -47,14 +51,8 @@ ENTRY(efi_call_phys) * parameter 2, ..., param n. To make things easy, we save the return * address of efi_call_phys in a global variable. */ @@ -13196,7 +13503,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x8 /* * 3. Clear PG bit in %CR0. -@@ -73,9 +66,8 @@ ENTRY(efi_call_phys) +@@ -73,9 +71,8 @@ ENTRY(efi_call_phys) /* * 5. Call the physical function. */ @@ -13207,7 +13514,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x8 /* * 6. After EFI runtime service returns, control will return to * following instruction. We'd better readjust stack pointer first. -@@ -88,35 +80,28 @@ ENTRY(efi_call_phys) +@@ -88,35 +85,32 @@ ENTRY(efi_call_phys) movl %cr0, %edx orl $0x80000000, %edx movl %edx, %cr0 @@ -13220,8 +13527,12 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x8 */ - movl $1f, %edx - jmp *%edx -+ jmp 1f+__PAGE_OFFSET ++ ljmp $(__KERNEL_CS),$1f+__PAGE_OFFSET 1: ++ movl $(__KERNEL_DS), %edx ++ mov %edx, %ds ++ mov %edx, %es ++ mov %edx, %ss /* * 9. Balance the stack. And because EAX contain the return value, @@ -13249,6 +13560,72 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_32.S linux-2.6.32.46/arch/x8 saved_return_addr: .long 0 efi_rt_function_ptr: +diff -urNp linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S +--- linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/kernel/efi_stub_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -7,6 +7,7 @@ + */ + + #include <linux/linkage.h> ++#include <asm/alternative-asm.h> + + #define SAVE_XMM \ + mov %rsp, %rax; \ +@@ -40,6 +41,7 @@ ENTRY(efi_call0) + call *%rdi + addq $32, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call0) + +@@ -50,6 +52,7 @@ ENTRY(efi_call1) + call *%rdi + addq $32, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call1) + +@@ -60,6 +63,7 @@ ENTRY(efi_call2) + call *%rdi + addq $32, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call2) + +@@ -71,6 +75,7 @@ ENTRY(efi_call3) + call *%rdi + addq $32, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call3) + +@@ -83,6 +88,7 @@ ENTRY(efi_call4) + call *%rdi + addq $32, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call4) + +@@ -96,6 +102,7 @@ ENTRY(efi_call5) + call *%rdi + addq $48, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call5) + +@@ -112,5 +119,6 @@ ENTRY(efi_call6) + call *%rdi + addq $48, %rsp + RESTORE_XMM ++ pax_force_retaddr + ret + ENDPROC(efi_call6) diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_32.S linux-2.6.32.46/arch/x86/kernel/entry_32.S --- linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/kernel/entry_32.S 2011-08-30 18:19:52.000000000 -0400 @@ -13742,16 +14119,17 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_32.S linux-2.6.32.46/arch/x86/k CFI_ADJUST_CFA_OFFSET -24 diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/kernel/entry_64.S --- linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-08-26 20:19:09.000000000 -0400 -@@ -53,6 +53,7 @@ ++++ linux-2.6.32.46/arch/x86/kernel/entry_64.S 2011-10-06 10:06:40.000000000 -0400 +@@ -53,6 +53,8 @@ #include <asm/paravirt.h> #include <asm/ftrace.h> #include <asm/percpu.h> +#include <asm/pgtable.h> ++#include <asm/alternative-asm.h> /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ #include <linux/elf-em.h> -@@ -174,6 +175,264 @@ ENTRY(native_usergs_sysret64) +@@ -174,6 +176,264 @@ ENTRY(native_usergs_sysret64) ENDPROC(native_usergs_sysret64) #endif /* CONFIG_PARAVIRT */ @@ -14016,7 +14394,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k .macro TRACE_IRQS_IRETQ offset=ARGOFFSET #ifdef CONFIG_TRACE_IRQFLAGS -@@ -317,7 +576,7 @@ ENTRY(save_args) +@@ -317,7 +577,7 @@ ENTRY(save_args) leaq -ARGOFFSET+16(%rsp),%rdi /* arg1 for handler */ movq_cfi rbp, 8 /* push %rbp */ leaq 8(%rsp), %rbp /* mov %rsp, %ebp */ @@ -14025,7 +14403,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k je 1f SWAPGS /* -@@ -409,7 +668,7 @@ ENTRY(ret_from_fork) +@@ -409,7 +669,7 @@ ENTRY(ret_from_fork) RESTORE_REST @@ -14034,7 +14412,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k je int_ret_from_sys_call testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET -@@ -455,7 +714,7 @@ END(ret_from_fork) +@@ -455,7 +715,7 @@ END(ret_from_fork) ENTRY(system_call) CFI_STARTPROC simple CFI_SIGNAL_FRAME @@ -14043,7 +14421,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k CFI_REGISTER rip,rcx /*CFI_REGISTER rflags,r11*/ SWAPGS_UNSAFE_STACK -@@ -468,12 +727,13 @@ ENTRY(system_call_after_swapgs) +@@ -468,12 +728,13 @@ ENTRY(system_call_after_swapgs) movq %rsp,PER_CPU_VAR(old_rsp) movq PER_CPU_VAR(kernel_stack),%rsp @@ -14058,7 +14436,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k movq %rax,ORIG_RAX-ARGOFFSET(%rsp) movq %rcx,RIP-ARGOFFSET(%rsp) CFI_REL_OFFSET rip,RIP-ARGOFFSET -@@ -502,6 +762,8 @@ sysret_check: +@@ -502,6 +763,8 @@ sysret_check: andl %edi,%edx jnz sysret_careful CFI_REMEMBER_STATE @@ -14067,7 +14445,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k /* * sysretq will re-enable interrupts: */ -@@ -562,6 +824,9 @@ auditsys: +@@ -562,6 +825,9 @@ auditsys: movq %rax,%rsi /* 2nd arg: syscall number */ movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */ call audit_syscall_entry @@ -14077,7 +14455,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k LOAD_ARGS 0 /* reload call-clobbered registers */ jmp system_call_fastpath -@@ -592,6 +857,9 @@ tracesys: +@@ -592,6 +858,9 @@ tracesys: FIXUP_TOP_OF_STACK %rdi movq %rsp,%rdi call syscall_trace_enter @@ -14087,7 +14465,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k /* * Reload arg registers from stack in case ptrace changed them. * We don't reload %rax because syscall_trace_enter() returned -@@ -613,7 +881,7 @@ tracesys: +@@ -613,7 +882,7 @@ tracesys: GLOBAL(int_ret_from_sys_call) DISABLE_INTERRUPTS(CLBR_NONE) TRACE_IRQS_OFF @@ -14096,7 +14474,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k je retint_restore_args movl $_TIF_ALLWORK_MASK,%edi /* edi: mask to check */ -@@ -800,6 +1068,16 @@ END(interrupt) +@@ -800,6 +1069,16 @@ END(interrupt) CFI_ADJUST_CFA_OFFSET 10*8 call save_args PARTIAL_FRAME 0 @@ -14113,7 +14491,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k call \func .endm -@@ -822,7 +1100,7 @@ ret_from_intr: +@@ -822,7 +1101,7 @@ ret_from_intr: CFI_ADJUST_CFA_OFFSET -8 exit_intr: GET_THREAD_INFO(%rcx) @@ -14122,7 +14500,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k je retint_kernel /* Interrupt came from user space */ -@@ -844,12 +1122,15 @@ retint_swapgs: /* return to user-space +@@ -844,12 +1123,16 @@ retint_swapgs: /* return to user-space * The iretq could re-enable interrupts: */ DISABLE_INTERRUPTS(CLBR_ANY) @@ -14135,10 +14513,11 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k retint_restore_args: /* return to kernel space */ DISABLE_INTERRUPTS(CLBR_ANY) + pax_exit_kernel ++ pax_force_retaddr RIP-ARGOFFSET /* * The iretq could re-enable interrupts: */ -@@ -1032,6 +1313,16 @@ ENTRY(\sym) +@@ -1032,6 +1315,16 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET 15*8 call error_entry DEFAULT_FRAME 0 @@ -14155,7 +14534,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k movq %rsp,%rdi /* pt_regs pointer */ xorl %esi,%esi /* no error code */ call \do_sym -@@ -1049,6 +1340,16 @@ ENTRY(\sym) +@@ -1049,6 +1342,16 @@ ENTRY(\sym) subq $15*8, %rsp call save_paranoid TRACE_IRQS_OFF @@ -14172,7 +14551,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k movq %rsp,%rdi /* pt_regs pointer */ xorl %esi,%esi /* no error code */ call \do_sym -@@ -1066,9 +1367,24 @@ ENTRY(\sym) +@@ -1066,9 +1369,24 @@ ENTRY(\sym) subq $15*8, %rsp call save_paranoid TRACE_IRQS_OFF @@ -14198,7 +14577,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp) call \do_sym addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp) -@@ -1085,6 +1401,16 @@ ENTRY(\sym) +@@ -1085,6 +1403,16 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET 15*8 call error_entry DEFAULT_FRAME 0 @@ -14215,7 +14594,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k movq %rsp,%rdi /* pt_regs pointer */ movq ORIG_RAX(%rsp),%rsi /* get error code */ movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ -@@ -1104,6 +1430,16 @@ ENTRY(\sym) +@@ -1104,6 +1432,16 @@ ENTRY(\sym) call save_paranoid DEFAULT_FRAME 0 TRACE_IRQS_OFF @@ -14232,7 +14611,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k movq %rsp,%rdi /* pt_regs pointer */ movq ORIG_RAX(%rsp),%rsi /* get error code */ movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ -@@ -1405,14 +1741,27 @@ ENTRY(paranoid_exit) +@@ -1405,16 +1743,31 @@ ENTRY(paranoid_exit) TRACE_IRQS_OFF testl %ebx,%ebx /* swapgs needed? */ jnz paranoid_restore @@ -14244,6 +14623,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k + TRACE_IRQS_IRETQ 0 + SWAPGS_UNSAFE_STACK + RESTORE_ALL 8 ++ pax_force_retaddr + jmp irq_return +#endif paranoid_swapgs: @@ -14260,8 +14640,11 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k + pax_exit_kernel TRACE_IRQS_IRETQ 0 RESTORE_ALL 8 ++ pax_force_retaddr jmp irq_return -@@ -1470,7 +1819,7 @@ ENTRY(error_entry) + paranoid_userspace: + GET_THREAD_INFO(%rcx) +@@ -1470,7 +1823,7 @@ ENTRY(error_entry) movq_cfi r14, R14+8 movq_cfi r15, R15+8 xorl %ebx,%ebx @@ -14270,7 +14653,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k je error_kernelspace error_swapgs: SWAPGS -@@ -1529,6 +1878,16 @@ ENTRY(nmi) +@@ -1529,6 +1882,16 @@ ENTRY(nmi) CFI_ADJUST_CFA_OFFSET 15*8 call save_paranoid DEFAULT_FRAME 0 @@ -14287,7 +14670,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ movq %rsp,%rdi movq $-1,%rsi -@@ -1539,11 +1898,25 @@ ENTRY(nmi) +@@ -1539,12 +1902,28 @@ ENTRY(nmi) DISABLE_INTERRUPTS(CLBR_NONE) testl %ebx,%ebx /* swapgs needed? */ jnz nmi_restore @@ -14298,6 +14681,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k + pax_exit_kernel + SWAPGS_UNSAFE_STACK + RESTORE_ALL 8 ++ pax_force_retaddr + jmp irq_return +#endif nmi_swapgs: @@ -14312,8 +14696,10 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/entry_64.S linux-2.6.32.46/arch/x86/k nmi_restore: + pax_exit_kernel RESTORE_ALL 8 ++ pax_force_retaddr jmp irq_return nmi_userspace: + GET_THREAD_INFO(%rcx) diff -urNp linux-2.6.32.46/arch/x86/kernel/ftrace.c linux-2.6.32.46/arch/x86/kernel/ftrace.c --- linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/kernel/ftrace.c 2011-05-04 17:56:20.000000000 -0400 @@ -15786,20 +16172,20 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_core.c linux-2.6.32.46/arch * Synchronization. diff -urNp linux-2.6.32.46/arch/x86/kernel/microcode_intel.c linux-2.6.32.46/arch/x86/kernel/microcode_intel.c --- linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/kernel/microcode_intel.c 2011-10-06 09:37:08.000000000 -0400 @@ -443,13 +443,13 @@ static enum ucode_state request_microcod static int get_ucode_user(void *to, const void *from, size_t n) { - return copy_from_user(to, from, n); -+ return copy_from_user(to, (__force const void __user *)from, n); ++ return copy_from_user(to, (const void __force_user *)from, n); } static enum ucode_state request_microcode_user(int cpu, const void __user *buf, size_t size) { - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user); -+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user); ++ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user); } static void microcode_fini_cpu(int cpu) @@ -18588,7 +18974,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.46/arch EXPORT_SYMBOL(copy_page); diff -urNp linux-2.6.32.46/arch/x86/kernel/xsave.c linux-2.6.32.46/arch/x86/kernel/xsave.c --- linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/kernel/xsave.c 2011-10-06 09:37:08.000000000 -0400 @@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_ fx_sw_user->xstate_size > fx_sw_user->extended_size) return -1; @@ -18603,7 +18989,7 @@ diff -urNp linux-2.6.32.46/arch/x86/kernel/xsave.c linux-2.6.32.46/arch/x86/kern */ xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE); - return fxrstor_checking((__force struct i387_fxsave_struct *)buf); -+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf); ++ return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf); } /* @@ -19383,8 +19769,31 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/checksum_32.S linux-2.6.32.46/arch/x86/l #undef ROUND1 diff -urNp linux-2.6.32.46/arch/x86/lib/clear_page_64.S linux-2.6.32.46/arch/x86/lib/clear_page_64.S --- linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-04-17 15:56:46.000000000 -0400 -@@ -43,7 +43,7 @@ ENDPROC(clear_page) ++++ linux-2.6.32.46/arch/x86/lib/clear_page_64.S 2011-10-06 09:37:08.000000000 -0400 +@@ -1,5 +1,6 @@ + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + /* + * Zero a page. +@@ -10,6 +11,7 @@ ENTRY(clear_page_c) + movl $4096/8,%ecx + xorl %eax,%eax + rep stosq ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(clear_page_c) +@@ -33,6 +35,7 @@ ENTRY(clear_page) + leaq 64(%rdi),%rdi + jnz .Lloop + nop ++ pax_force_retaddr + ret + CFI_ENDPROC + .Lclear_page_end: +@@ -43,7 +46,7 @@ ENDPROC(clear_page) #include <asm/cpufeature.h> @@ -19395,8 +19804,31 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/clear_page_64.S linux-2.6.32.46/arch/x86 2: diff -urNp linux-2.6.32.46/arch/x86/lib/copy_page_64.S linux-2.6.32.46/arch/x86/lib/copy_page_64.S --- linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-04-17 15:56:46.000000000 -0400 -@@ -104,7 +104,7 @@ ENDPROC(copy_page) ++++ linux-2.6.32.46/arch/x86/lib/copy_page_64.S 2011-10-06 09:37:08.000000000 -0400 +@@ -2,12 +2,14 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + ALIGN + copy_page_c: + CFI_STARTPROC + movl $4096/8,%ecx + rep movsq ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(copy_page_c) +@@ -94,6 +96,7 @@ ENTRY(copy_page) + CFI_RESTORE r13 + addq $3*8,%rsp + CFI_ADJUST_CFA_OFFSET -3*8 ++ pax_force_retaddr + ret + .Lcopy_page_end: + CFI_ENDPROC +@@ -104,7 +107,7 @@ ENDPROC(copy_page) #include <asm/cpufeature.h> @@ -19407,12 +19839,13 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/copy_page_64.S linux-2.6.32.46/arch/x86/ 2: diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_64.S linux-2.6.32.46/arch/x86/lib/copy_user_64.S --- linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-06-25 12:55:34.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-06-25 12:56:37.000000000 -0400 -@@ -15,13 +15,14 @@ ++++ linux-2.6.32.46/arch/x86/lib/copy_user_64.S 2011-10-06 10:12:52.000000000 -0400 +@@ -15,13 +15,15 @@ #include <asm/asm-offsets.h> #include <asm/thread_info.h> #include <asm/cpufeature.h> +#include <asm/pgtable.h> ++#include <asm/alternative-asm.h> .macro ALTERNATIVE_JUMP feature,orig,alt 0: @@ -19424,7 +19857,7 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_64.S linux-2.6.32.46/arch/x86/ 2: .byte 0xe9 /* near jump with 32bit immediate */ .long \alt-1b /* offset */ /* or alternatively to alt */ .previous -@@ -64,49 +65,19 @@ +@@ -64,55 +66,26 @@ #endif .endm @@ -19476,10 +19909,40 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_64.S linux-2.6.32.46/arch/x86/ movl %edx,%ecx xorl %eax,%eax rep + stosb + bad_to_user: + movl %edx,%eax ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(bad_from_user) +@@ -180,6 +153,7 @@ ENTRY(copy_user_generic_unrolled) + decl %ecx + jnz 21b + 23: xor %eax,%eax ++ pax_force_retaddr + ret + + .section .fixup,"ax" +@@ -252,6 +226,7 @@ ENTRY(copy_user_generic_string) + 3: rep + movsb + 4: xorl %eax,%eax ++ pax_force_retaddr + ret + + .section .fixup,"ax" diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S --- linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-04-17 15:56:46.000000000 -0400 -@@ -14,6 +14,7 @@ ++++ linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S 2011-10-06 09:37:08.000000000 -0400 +@@ -8,12 +8,14 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + #define FIX_ALIGNMENT 1 + #include <asm/current.h> #include <asm/asm-offsets.h> #include <asm/thread_info.h> @@ -19487,7 +19950,7 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.46/a .macro ALIGN_DESTINATION #ifdef FIX_ALIGNMENT -@@ -50,6 +51,15 @@ +@@ -50,6 +52,15 @@ */ ENTRY(__copy_user_nocache) CFI_STARTPROC @@ -19503,35 +19966,66 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.46/a cmpl $8,%edx jb 20f /* less then 8 bytes, go to byte copy loop */ ALIGN_DESTINATION +@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache) + jnz 21b + 23: xorl %eax,%eax + sfence ++ pax_force_retaddr + ret + + .section .fixup,"ax" +diff -urNp linux-2.6.32.46/arch/x86/lib/csum-copy_64.S linux-2.6.32.46/arch/x86/lib/csum-copy_64.S +--- linux-2.6.32.46/arch/x86/lib/csum-copy_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/csum-copy_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -8,6 +8,7 @@ + #include <linux/linkage.h> + #include <asm/dwarf2.h> + #include <asm/errno.h> ++#include <asm/alternative-asm.h> + + /* + * Checksum copy with exception handling. +@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic) + CFI_RESTORE rbp + addq $7*8,%rsp + CFI_ADJUST_CFA_OFFSET -7*8 ++ pax_force_retaddr + ret + CFI_RESTORE_STATE + diff -urNp linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c --- linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-05-04 17:56:20.000000000 -0400 -@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _ ++++ linux-2.6.32.46/arch/x86/lib/csum-wrappers_64.c 2011-10-06 09:37:08.000000000 -0400 +@@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _ len -= 2; } } +- isum = csum_partial_copy_generic((__force const void *)src, + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)src < PAX_USER_SHADOW_BASE) + src += PAX_USER_SHADOW_BASE; +#endif + - isum = csum_partial_copy_generic((__force const void *)src, ++ isum = csum_partial_copy_generic((const void __force_kernel *)src, dst, len, isum, errp, NULL); if (unlikely(*errp)) -@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr + goto out_err; +@@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr } *errp = 0; +- return csum_partial_copy_generic(src, (void __force *)dst, + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) + dst += PAX_USER_SHADOW_BASE; +#endif + - return csum_partial_copy_generic(src, (void __force *)dst, ++ return csum_partial_copy_generic(src, (void __force_kernel *)dst, len, isum, NULL, errp); } + EXPORT_SYMBOL(csum_partial_copy_to_user); diff -urNp linux-2.6.32.46/arch/x86/lib/getuser.S linux-2.6.32.46/arch/x86/lib/getuser.S --- linux-2.6.32.46/arch/x86/lib/getuser.S 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/lib/getuser.S 2011-04-17 15:56:46.000000000 -0400 @@ -19640,10 +20134,53 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/getuser.S linux-2.6.32.46/arch/x86/lib/g 4: movq -7(%_ASM_AX),%_ASM_DX xor %eax,%eax ret +diff -urNp linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S +--- linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/iomap_copy_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -17,6 +17,7 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + /* + * override generic version in lib/iomap_copy.c +@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy) + CFI_STARTPROC + movl %edx,%ecx + rep movsd ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(__iowrite32_copy) diff -urNp linux-2.6.32.46/arch/x86/lib/memcpy_64.S linux-2.6.32.46/arch/x86/lib/memcpy_64.S --- linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-04-17 15:56:46.000000000 -0400 -@@ -128,7 +128,7 @@ ENDPROC(__memcpy) ++++ linux-2.6.32.46/arch/x86/lib/memcpy_64.S 2011-10-06 10:13:49.000000000 -0400 +@@ -4,6 +4,7 @@ + + #include <asm/cpufeature.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + /* + * memcpy - Copy a memory block. +@@ -34,6 +35,7 @@ memcpy_c: + rep movsq + movl %edx, %ecx + rep movsb ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(memcpy_c) +@@ -118,6 +120,7 @@ ENTRY(memcpy) + jnz .Lloop_1 + + .Lend: ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(memcpy) +@@ -128,7 +131,7 @@ ENDPROC(__memcpy) * It is also a lot simpler. Use this when possible: */ @@ -19654,8 +20191,32 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/memcpy_64.S linux-2.6.32.46/arch/x86/lib 2: diff -urNp linux-2.6.32.46/arch/x86/lib/memset_64.S linux-2.6.32.46/arch/x86/lib/memset_64.S --- linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-04-17 15:56:46.000000000 -0400 -@@ -118,7 +118,7 @@ ENDPROC(__memset) ++++ linux-2.6.32.46/arch/x86/lib/memset_64.S 2011-10-06 09:37:08.000000000 -0400 +@@ -2,6 +2,7 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + /* + * ISO C memset - set a memory block to a byte value. +@@ -28,6 +29,7 @@ memset_c: + movl %r8d,%ecx + rep stosb + movq %r9,%rax ++ pax_force_retaddr + ret + CFI_ENDPROC + ENDPROC(memset_c) +@@ -96,6 +98,7 @@ ENTRY(__memset) + + .Lende: + movq %r10,%rax ++ pax_force_retaddr + ret + + CFI_RESTORE_STATE +@@ -118,7 +121,7 @@ ENDPROC(__memset) #include <asm/cpufeature.h> @@ -20122,6 +20683,89 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/putuser.S linux-2.6.32.46/arch/x86/lib/p #endif xor %eax,%eax EXIT +diff -urNp linux-2.6.32.46/arch/x86/lib/rwlock_64.S linux-2.6.32.46/arch/x86/lib/rwlock_64.S +--- linux-2.6.32.46/arch/x86/lib/rwlock_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/rwlock_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -17,6 +17,7 @@ ENTRY(__write_lock_failed) + LOCK_PREFIX + subl $RW_LOCK_BIAS,(%rdi) + jnz __write_lock_failed ++ pax_force_retaddr + ret + CFI_ENDPROC + END(__write_lock_failed) +@@ -33,6 +34,7 @@ ENTRY(__read_lock_failed) + LOCK_PREFIX + decl (%rdi) + js __read_lock_failed ++ pax_force_retaddr + ret + CFI_ENDPROC + END(__read_lock_failed) +diff -urNp linux-2.6.32.46/arch/x86/lib/rwsem_64.S linux-2.6.32.46/arch/x86/lib/rwsem_64.S +--- linux-2.6.32.46/arch/x86/lib/rwsem_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/rwsem_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -48,6 +48,7 @@ ENTRY(call_rwsem_down_read_failed) + call rwsem_down_read_failed + popq %rdx + restore_common_regs ++ pax_force_retaddr + ret + ENDPROC(call_rwsem_down_read_failed) + +@@ -56,6 +57,7 @@ ENTRY(call_rwsem_down_write_failed) + movq %rax,%rdi + call rwsem_down_write_failed + restore_common_regs ++ pax_force_retaddr + ret + ENDPROC(call_rwsem_down_write_failed) + +@@ -66,7 +68,8 @@ ENTRY(call_rwsem_wake) + movq %rax,%rdi + call rwsem_wake + restore_common_regs +-1: ret ++1: pax_force_retaddr ++ ret + ENDPROC(call_rwsem_wake) + + /* Fix up special calling conventions */ +@@ -77,5 +80,6 @@ ENTRY(call_rwsem_downgrade_wake) + call rwsem_downgrade_wake + popq %rdx + restore_common_regs ++ pax_force_retaddr + ret + ENDPROC(call_rwsem_downgrade_wake) +diff -urNp linux-2.6.32.46/arch/x86/lib/thunk_64.S linux-2.6.32.46/arch/x86/lib/thunk_64.S +--- linux-2.6.32.46/arch/x86/lib/thunk_64.S 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/thunk_64.S 2011-10-06 09:37:14.000000000 -0400 +@@ -10,7 +10,8 @@ + #include <asm/dwarf2.h> + #include <asm/calling.h> + #include <asm/rwlock.h> +- ++ #include <asm/alternative-asm.h> ++ + /* rdi: arg1 ... normal C conventions. rax is saved/restored. */ + .macro thunk name,func + .globl \name +@@ -70,6 +71,7 @@ + SAVE_ARGS + restore: + RESTORE_ARGS ++ pax_force_retaddr + ret + CFI_ENDPROC + +@@ -77,5 +79,6 @@ restore: + SAVE_ARGS + restore_norax: + RESTORE_ARGS 1 ++ pax_force_retaddr + ret + CFI_ENDPROC diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_32.c linux-2.6.32.46/arch/x86/lib/usercopy_32.c --- linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/lib/usercopy_32.c 2011-04-23 21:12:28.000000000 -0400 @@ -20732,7 +21376,7 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_32.c linux-2.6.32.46/arch/x86/l +#endif diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_64.c linux-2.6.32.46/arch/x86/lib/usercopy_64.c --- linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-05-04 17:56:20.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/lib/usercopy_64.c 2011-10-06 09:37:08.000000000 -0400 @@ -42,6 +42,12 @@ long __strncpy_from_user(char *dst, const char __user *src, long count) { @@ -20764,6 +21408,9 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_64.c linux-2.6.32.46/arch/x86/l unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len) { - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { +- return copy_user_generic((__force void *)to, (__force void *)from, len); +- } +- return len; + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { + +#ifdef CONFIG_PAX_MEMORY_UDEREF @@ -20773,14 +21420,21 @@ diff -urNp linux-2.6.32.46/arch/x86/lib/usercopy_64.c linux-2.6.32.46/arch/x86/l + from += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)to, (__force void *)from, len); -- } -- return len; ++ return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len); + } + return len; } EXPORT_SYMBOL(copy_in_user); +@@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user); + * it is not necessary to optimize tail handling. + */ + unsigned long +-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest) ++copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest) + { + char c; + unsigned zero_len; diff -urNp linux-2.6.32.46/arch/x86/Makefile linux-2.6.32.46/arch/x86/Makefile --- linux-2.6.32.46/arch/x86/Makefile 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/arch/x86/Makefile 2011-07-19 18:16:02.000000000 -0400 @@ -20883,7 +21537,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/extable.c linux-2.6.32.46/arch/x86/mm/ext pnp_bios_is_utter_crap = 1; diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault.c --- linux-2.6.32.46/arch/x86/mm/fault.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/arch/x86/mm/fault.c 2011-08-17 20:06:44.000000000 -0400 ++++ linux-2.6.32.46/arch/x86/mm/fault.c 2011-10-06 09:37:08.000000000 -0400 @@ -11,10 +11,19 @@ #include <linux/kprobes.h> /* __kprobes, ... */ #include <linux/mmiotrace.h> /* kmmio_handler, ... */ @@ -20919,7 +21573,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault /* Prefetch instruction is 0x0F0D or 0x0F18 */ - if (probe_kernel_address(instr, opcode)) + if (user_mode(regs)) { -+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) ++ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1)) + return 0; + } else if (probe_kernel_address(instr, opcode)) return 0; @@ -20931,7 +21585,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault - if (probe_kernel_address(instr, opcode)) + if (user_mode(regs)) { -+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) ++ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1)) + break; + } else if (probe_kernel_address(instr, opcode)) break; @@ -21523,7 +22177,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault + printk(KERN_ERR "PAX: bytes at PC: "); + for (i = 0; i < 20; i++) { + unsigned char c; -+ if (get_user(c, (__force unsigned char __user *)pc+i)) ++ if (get_user(c, (unsigned char __force_user *)pc+i)) + printk(KERN_CONT "?? "); + else + printk(KERN_CONT "%02x ", c); @@ -21533,7 +22187,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long)); + for (i = -1; i < 80 / (long)sizeof(long); i++) { + unsigned long c; -+ if (get_user(c, (__force unsigned long __user *)sp+i)) ++ if (get_user(c, (unsigned long __force_user *)sp+i)) +#ifdef CONFIG_X86_32 + printk(KERN_CONT "???????? "); +#else @@ -21563,7 +22217,7 @@ diff -urNp linux-2.6.32.46/arch/x86/mm/fault.c linux-2.6.32.46/arch/x86/mm/fault + set_fs(KERNEL_DS); + pagefault_disable(); + pax_open_kernel(); -+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); ++ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size); + pax_close_kernel(); + pagefault_enable(); + set_fs(old_fs); @@ -24158,7 +24812,7 @@ diff -urNp linux-2.6.32.46/block/blk-sysfs.c linux-2.6.32.46/block/blk-sysfs.c }; diff -urNp linux-2.6.32.46/block/bsg.c linux-2.6.32.46/block/bsg.c --- linux-2.6.32.46/block/bsg.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/block/bsg.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/block/bsg.c 2011-10-06 09:37:08.000000000 -0400 @@ -175,16 +175,24 @@ static int blk_fill_sgv4_hdr_rq(struct r struct sg_io_v4 *hdr, struct bsg_device *bd, fmode_t has_write_perm) @@ -24176,7 +24830,7 @@ diff -urNp linux-2.6.32.46/block/bsg.c linux-2.6.32.46/block/bsg.c + cmdptr = tmpcmd; - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request, -+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request, ++ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request, hdr->request_len)) return -EFAULT; @@ -24186,6 +24840,49 @@ diff -urNp linux-2.6.32.46/block/bsg.c linux-2.6.32.46/block/bsg.c if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) { if (blk_verify_command(rq->cmd, has_write_perm)) return -EPERM; +@@ -282,7 +290,7 @@ bsg_map_hdr(struct bsg_device *bd, struc + rq->next_rq = next_rq; + next_rq->cmd_type = rq->cmd_type; + +- dxferp = (void*)(unsigned long)hdr->din_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->din_xferp; + ret = blk_rq_map_user(q, next_rq, NULL, dxferp, + hdr->din_xfer_len, GFP_KERNEL); + if (ret) +@@ -291,10 +299,10 @@ bsg_map_hdr(struct bsg_device *bd, struc + + if (hdr->dout_xfer_len) { + dxfer_len = hdr->dout_xfer_len; +- dxferp = (void*)(unsigned long)hdr->dout_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->dout_xferp; + } else if (hdr->din_xfer_len) { + dxfer_len = hdr->din_xfer_len; +- dxferp = (void*)(unsigned long)hdr->din_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->din_xferp; + } else + dxfer_len = 0; + +@@ -436,7 +444,7 @@ static int blk_complete_sgv4_hdr_rq(stru + int len = min_t(unsigned int, hdr->max_response_len, + rq->sense_len); + +- ret = copy_to_user((void*)(unsigned long)hdr->response, ++ ret = copy_to_user((void __user *)(unsigned long)hdr->response, + rq->sense, len); + if (!ret) + hdr->response_len = len; +diff -urNp linux-2.6.32.46/block/compat_ioctl.c linux-2.6.32.46/block/compat_ioctl.c +--- linux-2.6.32.46/block/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/block/compat_ioctl.c 2011-10-06 09:37:14.000000000 -0400 +@@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_ + err |= __get_user(f->spec1, &uf->spec1); + err |= __get_user(f->fmt_gap, &uf->fmt_gap); + err |= __get_user(name, &uf->name); +- f->name = compat_ptr(name); ++ f->name = (void __force_kernel *)compat_ptr(name); + if (err) { + err = -EFAULT; + goto out; diff -urNp linux-2.6.32.46/block/elevator.c linux-2.6.32.46/block/elevator.c --- linux-2.6.32.46/block/elevator.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/block/elevator.c 2011-04-17 15:56:46.000000000 -0400 @@ -27575,6 +28272,18 @@ diff -urNp linux-2.6.32.46/drivers/block/DAC960.c linux-2.6.32.46/drivers/block/ if (!init_dma_loaf(Controller->PCIDevice, &local_dma, DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) + sizeof(DAC960_SCSI_Inquiry_T) + +diff -urNp linux-2.6.32.46/drivers/block/loop.c linux-2.6.32.46/drivers/block/loop.c +--- linux-2.6.32.46/drivers/block/loop.c 2011-06-25 12:55:34.000000000 -0400 ++++ linux-2.6.32.46/drivers/block/loop.c 2011-10-06 09:37:14.000000000 -0400 +@@ -282,7 +282,7 @@ static int __do_lo_send_write(struct fil + mm_segment_t old_fs = get_fs(); + + set_fs(get_ds()); +- bw = file->f_op->write(file, buf, len, &pos); ++ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos); + set_fs(old_fs); + if (likely(bw == len)) + return 0; diff -urNp linux-2.6.32.46/drivers/block/nbd.c linux-2.6.32.46/drivers/block/nbd.c --- linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:55:34.000000000 -0400 +++ linux-2.6.32.46/drivers/block/nbd.c 2011-06-25 12:56:37.000000000 -0400 @@ -28512,7 +29221,7 @@ diff -urNp linux-2.6.32.46/drivers/char/stallion.c linux-2.6.32.46/drivers/char/ portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr, diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm_bios.c linux-2.6.32.46/drivers/char/tpm/tpm_bios.c --- linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/drivers/char/tpm/tpm_bios.c 2011-10-06 09:37:08.000000000 -0400 @@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start event = addr; @@ -28541,7 +29250,7 @@ diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm_bios.c linux-2.6.32.46/drivers/c return 0; } -@@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log +@@ -409,8 +410,13 @@ static int read_log(struct tpm_bios_log log->bios_event_log_end = log->bios_event_log + len; virt = acpi_os_map_memory(start, len); @@ -28551,8 +29260,11 @@ diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm_bios.c linux-2.6.32.46/drivers/c + return -EFAULT; + } - memcpy(log->bios_event_log, virt, len); +- memcpy(log->bios_event_log, virt, len); ++ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len); + acpi_os_unmap_memory(virt, len); + return 0; diff -urNp linux-2.6.32.46/drivers/char/tpm/tpm.c linux-2.6.32.46/drivers/char/tpm/tpm.c --- linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-04-17 17:00:52.000000000 -0400 +++ linux-2.6.32.46/drivers/char/tpm/tpm.c 2011-05-16 21:46:57.000000000 -0400 @@ -29049,7 +29761,7 @@ diff -urNp linux-2.6.32.46/drivers/firewire/core-transaction.c linux-2.6.32.46/d fw_send_request(card, &t, tcode, destination_id, generation, speed, diff -urNp linux-2.6.32.46/drivers/firmware/dmi_scan.c linux-2.6.32.46/drivers/firmware/dmi_scan.c --- linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/drivers/firmware/dmi_scan.c 2011-10-06 09:37:08.000000000 -0400 @@ -391,11 +391,6 @@ void __init dmi_scan_machine(void) } } @@ -29062,6 +29774,15 @@ diff -urNp linux-2.6.32.46/drivers/firmware/dmi_scan.c linux-2.6.32.46/drivers/f p = dmi_ioremap(0xF0000, 0x10000); if (p == NULL) goto error; +@@ -667,7 +662,7 @@ int dmi_walk(void (*decode)(const struct + if (buf == NULL) + return -1; + +- dmi_table(buf, dmi_len, dmi_num, decode, private_data); ++ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data); + + iounmap(buf); + return 0; diff -urNp linux-2.6.32.46/drivers/firmware/edd.c linux-2.6.32.46/drivers/firmware/edd.c --- linux-2.6.32.46/drivers/firmware/edd.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/drivers/firmware/edd.c 2011-04-17 15:56:46.000000000 -0400 @@ -29122,6 +29843,83 @@ diff -urNp linux-2.6.32.46/drivers/gpio/vr41xx_giu.c linux-2.6.32.46/drivers/gpi return -EINVAL; } +diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c +--- linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/drivers/gpu/drm/drm_crtc.c 2011-10-06 09:37:14.000000000 -0400 +@@ -1323,7 +1323,7 @@ int drm_mode_getconnector(struct drm_dev + */ + if ((out_resp->count_modes >= mode_count) && mode_count) { + copied = 0; +- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr; ++ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr; + list_for_each_entry(mode, &connector->modes, head) { + drm_crtc_convert_to_umode(&u_mode, mode); + if (copy_to_user(mode_ptr + copied, +@@ -1338,8 +1338,8 @@ int drm_mode_getconnector(struct drm_dev + + if ((out_resp->count_props >= props_count) && props_count) { + copied = 0; +- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr); +- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr); ++ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr); ++ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr); + for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) { + if (connector->property_ids[i] != 0) { + if (put_user(connector->property_ids[i], +@@ -1361,7 +1361,7 @@ int drm_mode_getconnector(struct drm_dev + + if ((out_resp->count_encoders >= encoders_count) && encoders_count) { + copied = 0; +- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr); ++ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr); + for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) { + if (connector->encoder_ids[i] != 0) { + if (put_user(connector->encoder_ids[i], +@@ -1513,7 +1513,7 @@ int drm_mode_setcrtc(struct drm_device * + } + + for (i = 0; i < crtc_req->count_connectors; i++) { +- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr; ++ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; + if (get_user(out_id, &set_connectors_ptr[i])) { + ret = -EFAULT; + goto out; +@@ -2118,7 +2118,7 @@ int drm_mode_getproperty_ioctl(struct dr + out_resp->flags = property->flags; + + if ((out_resp->count_values >= value_count) && value_count) { +- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr; ++ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr; + for (i = 0; i < value_count; i++) { + if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) { + ret = -EFAULT; +@@ -2131,7 +2131,7 @@ int drm_mode_getproperty_ioctl(struct dr + if (property->flags & DRM_MODE_PROP_ENUM) { + if ((out_resp->count_enum_blobs >= enum_count) && enum_count) { + copied = 0; +- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr; ++ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr; + list_for_each_entry(prop_enum, &property->enum_blob_list, head) { + + if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) { +@@ -2154,7 +2154,7 @@ int drm_mode_getproperty_ioctl(struct dr + if ((out_resp->count_enum_blobs >= blob_count) && blob_count) { + copied = 0; + blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr; +- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr; ++ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr; + + list_for_each_entry(prop_blob, &property->enum_blob_list, head) { + if (put_user(prop_blob->base.id, blob_id_ptr + copied)) { +@@ -2226,7 +2226,7 @@ int drm_mode_getblob_ioctl(struct drm_de + blob = obj_to_blob(obj); + + if (out_resp->length == blob->length) { +- blob_ptr = (void *)(unsigned long)out_resp->data; ++ blob_ptr = (void __user *)(unsigned long)out_resp->data; + if (copy_to_user(blob_ptr, blob->data, blob->length)){ + ret = -EFAULT; + goto done; diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c --- linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/drivers/gpu/drm/drm_crtc_helper.c 2011-05-16 21:46:57.000000000 -0400 @@ -29327,6 +30125,27 @@ diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_info.c linux-2.6.32.46/drivers/gp #if defined(__i386__) pgprot = pgprot_val(vma->vm_page_prot); +diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c +--- linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/drivers/gpu/drm/drm_ioc32.c 2011-10-06 09:37:14.000000000 -0400 +@@ -463,7 +463,7 @@ static int compat_drm_infobufs(struct fi + request = compat_alloc_user_space(nbytes); + if (!access_ok(VERIFY_WRITE, request, nbytes)) + return -EFAULT; +- list = (struct drm_buf_desc *) (request + 1); ++ list = (struct drm_buf_desc __user *) (request + 1); + + if (__put_user(count, &request->count) + || __put_user(list, &request->list)) +@@ -525,7 +525,7 @@ static int compat_drm_mapbufs(struct fil + request = compat_alloc_user_space(nbytes); + if (!access_ok(VERIFY_WRITE, request, nbytes)) + return -EFAULT; +- list = (struct drm_buf_pub *) (request + 1); ++ list = (struct drm_buf_pub __user *) (request + 1); + + if (__put_user(count, &request->count) + || __put_user(list, &request->list)) diff -urNp linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c --- linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/drivers/gpu/drm/drm_ioctl.c 2011-04-17 15:56:46.000000000 -0400 @@ -36883,6 +37702,18 @@ diff -urNp linux-2.6.32.46/drivers/scsi/scsi_sysfs.c linux-2.6.32.46/drivers/scs return snprintf(buf, 20, "0x%llx\n", count); \ } \ static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL) +diff -urNp linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c +--- linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/drivers/scsi/scsi_tgt_lib.c 2011-10-06 09:37:14.000000000 -0400 +@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc + int err; + + dprintk("%lx %u\n", uaddr, len); +- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL); ++ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL); + if (err) { + /* + * TODO: need to fixup sg_tablesize, max_segment_size, diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c --- linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/drivers/scsi/scsi_transport_fc.c 2011-05-04 17:56:28.000000000 -0400 @@ -36975,7 +37806,16 @@ diff -urNp linux-2.6.32.46/drivers/scsi/scsi_transport_srp.c linux-2.6.32.46/dri transport_setup_device(&rport->dev); diff -urNp linux-2.6.32.46/drivers/scsi/sg.c linux-2.6.32.46/drivers/scsi/sg.c --- linux-2.6.32.46/drivers/scsi/sg.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/drivers/scsi/sg.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/drivers/scsi/sg.c 2011-10-06 09:37:08.000000000 -0400 +@@ -1064,7 +1064,7 @@ sg_ioctl(struct inode *inode, struct fil + sdp->disk->disk_name, + MKDEV(SCSI_GENERIC_MAJOR, sdp->index), + NULL, +- (char *)arg); ++ (char __user *)arg); + case BLKTRACESTART: + return blk_trace_startstop(sdp->device->request_queue, 1); + case BLKTRACESTOP: @@ -2292,7 +2292,7 @@ struct sg_proc_leaf { const struct file_operations * fops; }; @@ -41466,6 +42306,18 @@ diff -urNp linux-2.6.32.46/fs/autofs4/symlink.c linux-2.6.32.46/fs/autofs4/symli return NULL; } +diff -urNp linux-2.6.32.46/fs/autofs4/waitq.c linux-2.6.32.46/fs/autofs4/waitq.c +--- linux-2.6.32.46/fs/autofs4/waitq.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/fs/autofs4/waitq.c 2011-10-06 09:37:14.000000000 -0400 +@@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi + { + unsigned long sigpipe, flags; + mm_segment_t fs; +- const char *data = (const char *)addr; ++ const char __user *data = (const char __force_user *)addr; + ssize_t wr = 0; + + /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/ diff -urNp linux-2.6.32.46/fs/befs/linuxvfs.c linux-2.6.32.46/fs/befs/linuxvfs.c --- linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:24:44.000000000 -0400 +++ linux-2.6.32.46/fs/befs/linuxvfs.c 2011-08-29 22:25:07.000000000 -0400 @@ -42281,7 +43133,7 @@ diff -urNp linux-2.6.32.46/fs/binfmt_flat.c linux-2.6.32.46/fs/binfmt_flat.c } diff -urNp linux-2.6.32.46/fs/bio.c linux-2.6.32.46/fs/bio.c --- linux-2.6.32.46/fs/bio.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/bio.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/fs/bio.c 2011-10-06 09:37:14.000000000 -0400 @@ -78,7 +78,7 @@ static struct kmem_cache *bio_find_or_cr i = 0; @@ -42296,7 +43148,7 @@ diff -urNp linux-2.6.32.46/fs/bio.c linux-2.6.32.46/fs/bio.c struct bio_map_data *bmd = bio->bi_private; int i; - char *p = bmd->sgvecs[0].iov_base; -+ char *p = (__force char *)bmd->sgvecs[0].iov_base; ++ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base; __bio_for_each_segment(bvec, bio, i, 0) { char *addr = page_address(bvec->bv_page); @@ -42690,13 +43542,13 @@ diff -urNp linux-2.6.32.46/fs/cachefiles/proc.c linux-2.6.32.46/fs/cachefiles/pr diff -urNp linux-2.6.32.46/fs/cachefiles/rdwr.c linux-2.6.32.46/fs/cachefiles/rdwr.c --- linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/fs/cachefiles/rdwr.c 2011-10-06 09:37:14.000000000 -0400 @@ -946,7 +946,7 @@ int cachefiles_write_page(struct fscache old_fs = get_fs(); set_fs(KERNEL_DS); ret = file->f_op->write( - file, (const void __user *) data, len, &pos); -+ file, (__force const void __user *) data, len, &pos); ++ file, (const void __force_user *) data, len, &pos); set_fs(old_fs); kunmap(page); if (ret != len) @@ -43012,7 +43864,27 @@ diff -urNp linux-2.6.32.46/fs/compat_binfmt_elf.c linux-2.6.32.46/fs/compat_binf /* diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c --- linux-2.6.32.46/fs/compat.c 2011-04-17 17:00:52.000000000 -0400 -+++ linux-2.6.32.46/fs/compat.c 2011-08-11 19:56:56.000000000 -0400 ++++ linux-2.6.32.46/fs/compat.c 2011-10-06 09:37:14.000000000 -0400 +@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(char _ + static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf) + { + compat_ino_t ino = stat->ino; +- typeof(ubuf->st_uid) uid = 0; +- typeof(ubuf->st_gid) gid = 0; ++ typeof(((struct compat_stat *)0)->st_uid) uid = 0; ++ typeof(((struct compat_stat *)0)->st_gid) gid = 0; + int err; + + SET_UID(uid, stat->uid); +@@ -533,7 +533,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3 + + set_fs(KERNEL_DS); + /* The __user pointer cast is valid because of the set_fs() */ +- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64); ++ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64); + set_fs(oldfs); + /* truncating is ok because it's a user address */ + if (!ret) @@ -830,6 +830,7 @@ struct compat_old_linux_dirent { struct compat_readdir_callback { @@ -43086,7 +43958,7 @@ diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c dirent = buf->previous; if (dirent) { -@@ -1054,6 +1071,7 @@ asmlinkage long compat_sys_getdents64(un +@@ -1054,13 +1071,14 @@ asmlinkage long compat_sys_getdents64(un buf.previous = NULL; buf.count = count; buf.error = 0; @@ -43094,6 +43966,14 @@ diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c error = vfs_readdir(file, compat_filldir64, &buf); if (error >= 0) + error = buf.error; + lastdirent = buf.previous; + if (lastdirent) { +- typeof(lastdirent->d_off) d_off = file->f_pos; ++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos; + if (__put_user_unaligned(d_off, &lastdirent->d_off)) + error = -EFAULT; + else @@ -1098,7 +1116,7 @@ static ssize_t compat_do_readv_writev(in * verify all the pointers */ @@ -43221,9 +44101,18 @@ diff -urNp linux-2.6.32.46/fs/compat.c linux-2.6.32.46/fs/compat.c if (n < 0) goto out_nofds; +@@ -2151,7 +2243,7 @@ asmlinkage long compat_sys_nfsservctl(in + oldfs = get_fs(); + set_fs(KERNEL_DS); + /* The __user pointer casts are valid because of the set_fs() */ +- err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres); ++ err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres); + set_fs(oldfs); + + if (err) diff -urNp linux-2.6.32.46/fs/compat_ioctl.c linux-2.6.32.46/fs/compat_ioctl.c --- linux-2.6.32.46/fs/compat_ioctl.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/compat_ioctl.c 2011-04-23 12:56:11.000000000 -0400 ++++ linux-2.6.32.46/fs/compat_ioctl.c 2011-10-06 09:37:14.000000000 -0400 @@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsi up = (struct compat_video_spu_palette __user *) arg; err = get_user(palp, &up->palette); @@ -43233,6 +44122,24 @@ diff -urNp linux-2.6.32.46/fs/compat_ioctl.c linux-2.6.32.46/fs/compat_ioctl.c up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); err = put_user(compat_ptr(palp), &up_native->palette); +@@ -1513,7 +1515,7 @@ static int serial_struct_ioctl(unsigned + return -EFAULT; + if (__get_user(udata, &ss32->iomem_base)) + return -EFAULT; +- ss.iomem_base = compat_ptr(udata); ++ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata); + if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) || + __get_user(ss.port_high, &ss32->port_high)) + return -EFAULT; +@@ -1809,7 +1811,7 @@ static int compat_ioctl_preallocate(stru + copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) || + copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) || + copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) || +- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32))) ++ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32))) + return -EFAULT; + + return ioctl_preallocate(file, p); diff -urNp linux-2.6.32.46/fs/configfs/dir.c linux-2.6.32.46/fs/configfs/dir.c --- linux-2.6.32.46/fs/configfs/dir.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/fs/configfs/dir.c 2011-05-11 18:25:15.000000000 -0400 @@ -43295,13 +44202,13 @@ diff -urNp linux-2.6.32.46/fs/dlm/lockspace.c linux-2.6.32.46/fs/dlm/lockspace.c }; diff -urNp linux-2.6.32.46/fs/ecryptfs/inode.c linux-2.6.32.46/fs/ecryptfs/inode.c --- linux-2.6.32.46/fs/ecryptfs/inode.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/ecryptfs/inode.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/fs/ecryptfs/inode.c 2011-10-06 09:37:14.000000000 -0400 @@ -660,7 +660,7 @@ static int ecryptfs_readlink_lower(struc old_fs = get_fs(); set_fs(get_ds()); rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, - (char __user *)lower_buf, -+ (__force char __user *)lower_buf, ++ (char __force_user *)lower_buf, lower_bufsiz); set_fs(old_fs); if (rc < 0) @@ -43316,7 +44223,7 @@ diff -urNp linux-2.6.32.46/fs/ecryptfs/inode.c linux-2.6.32.46/fs/ecryptfs/inode goto out_free; diff -urNp linux-2.6.32.46/fs/exec.c linux-2.6.32.46/fs/exec.c --- linux-2.6.32.46/fs/exec.c 2011-06-25 12:55:34.000000000 -0400 -+++ linux-2.6.32.46/fs/exec.c 2011-08-11 19:56:19.000000000 -0400 ++++ linux-2.6.32.46/fs/exec.c 2011-10-06 09:37:14.000000000 -0400 @@ -56,12 +56,24 @@ #include <linux/fsnotify.h> #include <linux/fs_struct.h> @@ -43500,7 +44407,7 @@ diff -urNp linux-2.6.32.46/fs/exec.c linux-2.6.32.46/fs/exec.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - result = vfs_read(file, (void __user *)addr, count, &pos); -+ result = vfs_read(file, (__force void __user *)addr, count, &pos); ++ result = vfs_read(file, (void __force_user *)addr, count, &pos); set_fs(old_fs); return result; } @@ -44118,7 +45025,7 @@ diff -urNp linux-2.6.32.46/fs/ext4/super.c linux-2.6.32.46/fs/ext4/super.c }; diff -urNp linux-2.6.32.46/fs/fcntl.c linux-2.6.32.46/fs/fcntl.c --- linux-2.6.32.46/fs/fcntl.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/fcntl.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/fs/fcntl.c 2011-10-06 09:37:14.000000000 -0400 @@ -223,6 +223,11 @@ int __f_setown(struct file *filp, struct if (err) return err; @@ -44131,6 +45038,24 @@ diff -urNp linux-2.6.32.46/fs/fcntl.c linux-2.6.32.46/fs/fcntl.c f_modown(filp, pid, type, force); return 0; } +@@ -265,7 +270,7 @@ pid_t f_getown(struct file *filp) + + static int f_setown_ex(struct file *filp, unsigned long arg) + { +- struct f_owner_ex * __user owner_p = (void * __user)arg; ++ struct f_owner_ex __user *owner_p = (void __user *)arg; + struct f_owner_ex owner; + struct pid *pid; + int type; +@@ -305,7 +310,7 @@ static int f_setown_ex(struct file *filp + + static int f_getown_ex(struct file *filp, unsigned long arg) + { +- struct f_owner_ex * __user owner_p = (void * __user)arg; ++ struct f_owner_ex __user *owner_p = (void __user *)arg; + struct f_owner_ex owner; + int ret = 0; + @@ -344,6 +349,7 @@ static long do_fcntl(int fd, unsigned in switch (cmd) { case F_DUPFD: @@ -46162,7 +47087,7 @@ diff -urNp linux-2.6.32.46/fs/mbcache.c linux-2.6.32.46/fs/mbcache.c #ifdef MB_CACHE_INDEXES_COUNT diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c --- linux-2.6.32.46/fs/namei.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/namei.c 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/fs/namei.c 2011-10-06 03:36:41.000000000 -0400 @@ -224,14 +224,6 @@ int generic_permission(struct inode *ino return ret; @@ -46212,7 +47137,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = 0; if (s) error = __vfs_follow_link(nd, s); -@@ -669,6 +670,13 @@ static inline int do_follow_link(struct +@@ -669,6 +670,18 @@ static inline int do_follow_link(struct err = security_inode_follow_link(path->dentry, nd); if (err) goto loop; @@ -46223,10 +47148,15 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c + goto loop; + } + ++ if (!gr_acl_handle_hidden_file(path->dentry, nd->path.mnt)) { ++ err = -ENOENT; ++ goto loop; ++ } ++ current->link_count++; current->total_link_count++; nd->depth++; -@@ -1016,11 +1024,18 @@ return_reval: +@@ -1016,11 +1029,18 @@ return_reval: break; } return_base: @@ -46245,7 +47175,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c path_put(&nd->path); return_err: return err; -@@ -1091,13 +1106,20 @@ static int do_path_lookup(int dfd, const +@@ -1091,13 +1111,20 @@ static int do_path_lookup(int dfd, const int retval = path_init(dfd, name, flags, nd); if (!retval) retval = path_walk(name, nd); @@ -46269,7 +47199,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c return retval; } -@@ -1576,6 +1598,20 @@ int may_open(struct path *path, int acc_ +@@ -1576,6 +1603,20 @@ int may_open(struct path *path, int acc_ if (error) goto err_out; @@ -46290,7 +47220,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c if (flag & O_TRUNC) { error = get_write_access(inode); if (error) -@@ -1621,12 +1657,19 @@ static int __open_namei_create(struct na +@@ -1621,12 +1662,19 @@ static int __open_namei_create(struct na int error; struct dentry *dir = nd->path.dentry; @@ -46310,7 +47240,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c out_unlock: mutex_unlock(&dir->d_inode->i_mutex); dput(nd->path.dentry); -@@ -1709,6 +1752,22 @@ struct file *do_filp_open(int dfd, const +@@ -1709,6 +1757,22 @@ struct file *do_filp_open(int dfd, const &nd, flag); if (error) return ERR_PTR(error); @@ -46333,7 +47263,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c goto ok; } -@@ -1795,6 +1854,14 @@ do_last: +@@ -1795,6 +1859,14 @@ do_last: /* * It already exists. */ @@ -46348,7 +47278,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c mutex_unlock(&dir->d_inode->i_mutex); audit_inode(pathname, path.dentry); -@@ -1887,6 +1954,13 @@ do_link: +@@ -1887,6 +1959,13 @@ do_link: error = security_inode_follow_link(path.dentry, &nd); if (error) goto exit_dput; @@ -46362,7 +47292,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = __do_follow_link(&path, &nd); if (error) { /* Does someone understand code flow here? Or it is only -@@ -2061,6 +2135,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const +@@ -2061,6 +2140,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const error = may_mknod(mode); if (error) goto out_dput; @@ -46380,7 +47310,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2081,6 +2166,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const +@@ -2081,6 +2171,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const } out_drop_write: mnt_drop_write(nd.path.mnt); @@ -46390,7 +47320,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c out_dput: dput(dentry); out_unlock: -@@ -2134,6 +2222,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const +@@ -2134,6 +2227,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const if (IS_ERR(dentry)) goto out_unlock; @@ -46402,7 +47332,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c if (!IS_POSIXACL(nd.path.dentry->d_inode)) mode &= ~current_umask(); error = mnt_want_write(nd.path.mnt); -@@ -2145,6 +2238,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const +@@ -2145,6 +2243,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode); out_drop_write: mnt_drop_write(nd.path.mnt); @@ -46413,7 +47343,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c out_dput: dput(dentry); out_unlock: -@@ -2226,6 +2323,8 @@ static long do_rmdir(int dfd, const char +@@ -2226,6 +2328,8 @@ static long do_rmdir(int dfd, const char char * name; struct dentry *dentry; struct nameidata nd; @@ -46422,7 +47352,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2250,6 +2349,19 @@ static long do_rmdir(int dfd, const char +@@ -2250,6 +2354,19 @@ static long do_rmdir(int dfd, const char error = PTR_ERR(dentry); if (IS_ERR(dentry)) goto exit2; @@ -46442,7 +47372,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto exit3; -@@ -2257,6 +2369,8 @@ static long do_rmdir(int dfd, const char +@@ -2257,6 +2374,8 @@ static long do_rmdir(int dfd, const char if (error) goto exit4; error = vfs_rmdir(nd.path.dentry->d_inode, dentry); @@ -46451,7 +47381,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c exit4: mnt_drop_write(nd.path.mnt); exit3: -@@ -2318,6 +2432,8 @@ static long do_unlinkat(int dfd, const c +@@ -2318,6 +2437,8 @@ static long do_unlinkat(int dfd, const c struct dentry *dentry; struct nameidata nd; struct inode *inode = NULL; @@ -46460,7 +47390,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2337,8 +2453,19 @@ static long do_unlinkat(int dfd, const c +@@ -2337,8 +2458,19 @@ static long do_unlinkat(int dfd, const c if (nd.last.name[nd.last.len]) goto slashes; inode = dentry->d_inode; @@ -46481,7 +47411,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto exit2; -@@ -2346,6 +2473,8 @@ static long do_unlinkat(int dfd, const c +@@ -2346,6 +2478,8 @@ static long do_unlinkat(int dfd, const c if (error) goto exit3; error = vfs_unlink(nd.path.dentry->d_inode, dentry); @@ -46490,7 +47420,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c exit3: mnt_drop_write(nd.path.mnt); exit2: -@@ -2424,6 +2553,11 @@ SYSCALL_DEFINE3(symlinkat, const char __ +@@ -2424,6 +2558,11 @@ SYSCALL_DEFINE3(symlinkat, const char __ if (IS_ERR(dentry)) goto out_unlock; @@ -46502,7 +47432,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2431,6 +2565,8 @@ SYSCALL_DEFINE3(symlinkat, const char __ +@@ -2431,6 +2570,8 @@ SYSCALL_DEFINE3(symlinkat, const char __ if (error) goto out_drop_write; error = vfs_symlink(nd.path.dentry->d_inode, dentry, from); @@ -46511,7 +47441,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c out_drop_write: mnt_drop_write(nd.path.mnt); out_dput: -@@ -2524,6 +2660,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con +@@ -2524,6 +2665,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con error = PTR_ERR(new_dentry); if (IS_ERR(new_dentry)) goto out_unlock; @@ -46532,7 +47462,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2531,6 +2681,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con +@@ -2531,6 +2686,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con if (error) goto out_drop_write; error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry); @@ -46541,7 +47471,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c out_drop_write: mnt_drop_write(nd.path.mnt); out_dput: -@@ -2708,6 +2860,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -2708,6 +2865,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c char *to; int error; @@ -46550,7 +47480,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = user_path_parent(olddfd, oldname, &oldnd, &from); if (error) goto exit; -@@ -2764,6 +2918,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -2764,6 +2923,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c if (new_dentry == trap) goto exit5; @@ -46563,7 +47493,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c error = mnt_want_write(oldnd.path.mnt); if (error) goto exit5; -@@ -2773,6 +2933,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -2773,6 +2938,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c goto exit6; error = vfs_rename(old_dir->d_inode, old_dentry, new_dir->d_inode, new_dentry); @@ -46573,7 +47503,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c exit6: mnt_drop_write(oldnd.path.mnt); exit5: -@@ -2798,6 +2961,8 @@ SYSCALL_DEFINE2(rename, const char __use +@@ -2798,6 +2966,8 @@ SYSCALL_DEFINE2(rename, const char __use int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) { @@ -46582,7 +47512,7 @@ diff -urNp linux-2.6.32.46/fs/namei.c linux-2.6.32.46/fs/namei.c int len; len = PTR_ERR(link); -@@ -2807,7 +2972,14 @@ int vfs_readlink(struct dentry *dentry, +@@ -2807,7 +2977,14 @@ int vfs_readlink(struct dentry *dentry, len = strlen(link); if (len > (unsigned) buflen) len = buflen; @@ -46805,13 +47735,13 @@ diff -urNp linux-2.6.32.46/fs/nfsd/nfs4xdr.c linux-2.6.32.46/fs/nfsd/nfs4xdr.c BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion)); diff -urNp linux-2.6.32.46/fs/nfsd/vfs.c linux-2.6.32.46/fs/nfsd/vfs.c --- linux-2.6.32.46/fs/nfsd/vfs.c 2011-05-10 22:12:01.000000000 -0400 -+++ linux-2.6.32.46/fs/nfsd/vfs.c 2011-05-10 22:12:33.000000000 -0400 ++++ linux-2.6.32.46/fs/nfsd/vfs.c 2011-10-06 09:37:14.000000000 -0400 @@ -937,7 +937,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st } else { oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset); -+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset); ++ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset); set_fs(oldfs); } @@ -46820,7 +47750,7 @@ diff -urNp linux-2.6.32.46/fs/nfsd/vfs.c linux-2.6.32.46/fs/nfsd/vfs.c /* Write the data. */ oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset); -+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset); ++ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset); set_fs(oldfs); if (host_err < 0) goto out_nfserr; @@ -46829,7 +47759,7 @@ diff -urNp linux-2.6.32.46/fs/nfsd/vfs.c linux-2.6.32.46/fs/nfsd/vfs.c oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = inode->i_op->readlink(dentry, buf, *lenp); -+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp); ++ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp); set_fs(oldfs); if (host_err < 0) @@ -48392,7 +49322,7 @@ diff -urNp linux-2.6.32.46/fs/proc/task_nommu.c linux-2.6.32.46/fs/proc/task_nom seq_putc(m, '\n'); diff -urNp linux-2.6.32.46/fs/readdir.c linux-2.6.32.46/fs/readdir.c --- linux-2.6.32.46/fs/readdir.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/readdir.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/fs/readdir.c 2011-10-06 09:37:14.000000000 -0400 @@ -16,6 +16,7 @@ #include <linux/security.h> #include <linux/syscalls.h> @@ -48482,6 +49412,15 @@ diff -urNp linux-2.6.32.46/fs/readdir.c linux-2.6.32.46/fs/readdir.c buf.count = count; buf.error = 0; +@@ -297,7 +316,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int + error = buf.error; + lastdirent = buf.previous; + if (lastdirent) { +- typeof(lastdirent->d_off) d_off = file->f_pos; ++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos; + if (__put_user(d_off, &lastdirent->d_off)) + error = -EFAULT; + else diff -urNp linux-2.6.32.46/fs/reiserfs/dir.c linux-2.6.32.46/fs/reiserfs/dir.c --- linux-2.6.32.46/fs/reiserfs/dir.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/fs/reiserfs/dir.c 2011-05-16 21:46:57.000000000 -0400 @@ -48809,7 +49748,7 @@ diff -urNp linux-2.6.32.46/fs/smbfs/symlink.c linux-2.6.32.46/fs/smbfs/symlink.c } diff -urNp linux-2.6.32.46/fs/splice.c linux-2.6.32.46/fs/splice.c --- linux-2.6.32.46/fs/splice.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/fs/splice.c 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/fs/splice.c 2011-10-06 09:37:14.000000000 -0400 @@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode pipe_lock(pipe); @@ -48845,7 +49784,7 @@ diff -urNp linux-2.6.32.46/fs/splice.c linux-2.6.32.46/fs/splice.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos); -+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos); ++ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos); set_fs(old_fs); return res; @@ -48854,7 +49793,7 @@ diff -urNp linux-2.6.32.46/fs/splice.c linux-2.6.32.46/fs/splice.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - res = vfs_write(file, (const char __user *)buf, count, &pos); -+ res = vfs_write(file, (__force const char __user *)buf, count, &pos); ++ res = vfs_write(file, (const char __force_user *)buf, count, &pos); set_fs(old_fs); return res; @@ -60125,8 +61064,58 @@ diff -urNp linux-2.6.32.46/include/linux/compiler-gcc4.h linux-2.6.32.46/include #endif diff -urNp linux-2.6.32.46/include/linux/compiler.h linux-2.6.32.46/include/linux/compiler.h --- linux-2.6.32.46/include/linux/compiler.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/include/linux/compiler.h 2011-08-26 20:19:09.000000000 -0400 -@@ -247,6 +247,14 @@ void ftrace_likely_update(struct ftrace_ ++++ linux-2.6.32.46/include/linux/compiler.h 2011-10-06 09:37:14.000000000 -0400 +@@ -5,11 +5,14 @@ + + #ifdef __CHECKER__ + # define __user __attribute__((noderef, address_space(1))) ++# define __force_user __force __user + # define __kernel /* default address space */ ++# define __force_kernel __force __kernel + # define __safe __attribute__((safe)) + # define __force __attribute__((force)) + # define __nocast __attribute__((nocast)) + # define __iomem __attribute__((noderef, address_space(2))) ++# define __force_iomem __force __iomem + # define __acquires(x) __attribute__((context(x,0,1))) + # define __releases(x) __attribute__((context(x,1,0))) + # define __acquire(x) __context__(x,1) +@@ -17,13 +20,34 @@ + # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0) + extern void __chk_user_ptr(const volatile void __user *); + extern void __chk_io_ptr(const volatile void __iomem *); ++#elif defined(CHECKER_PLUGIN) ++//# define __user ++//# define __force_user ++//# define __kernel ++//# define __force_kernel ++# define __safe ++# define __force ++# define __nocast ++# define __iomem ++# define __force_iomem ++# define __chk_user_ptr(x) (void)0 ++# define __chk_io_ptr(x) (void)0 ++# define __builtin_warning(x, y...) (1) ++# define __acquires(x) ++# define __releases(x) ++# define __acquire(x) (void)0 ++# define __release(x) (void)0 ++# define __cond_lock(x,c) (c) + #else + # define __user ++# define __force_user + # define __kernel ++# define __force_kernel + # define __safe + # define __force + # define __nocast + # define __iomem ++# define __force_iomem + # define __chk_user_ptr(x) (void)0 + # define __chk_io_ptr(x) (void)0 + # define __builtin_warning(x, y...) (1) +@@ -247,6 +271,14 @@ void ftrace_likely_update(struct ftrace_ # define __attribute_const__ /* unimplemented */ #endif @@ -60141,7 +61130,7 @@ diff -urNp linux-2.6.32.46/include/linux/compiler.h linux-2.6.32.46/include/linu /* * Tell gcc if a function is cold. The compiler will assume any path * directly leading to the call is unlikely. -@@ -256,6 +264,22 @@ void ftrace_likely_update(struct ftrace_ +@@ -256,6 +288,22 @@ void ftrace_likely_update(struct ftrace_ #define __cold #endif @@ -60164,7 +61153,7 @@ diff -urNp linux-2.6.32.46/include/linux/compiler.h linux-2.6.32.46/include/linu /* Simple shorthand for a section definition */ #ifndef __section # define __section(S) __attribute__ ((__section__(#S))) -@@ -278,6 +302,7 @@ void ftrace_likely_update(struct ftrace_ +@@ -278,6 +326,7 @@ void ftrace_likely_update(struct ftrace_ * use is to mediate communication between process-level code and irq/NMI * handlers, all running on the same CPU. */ @@ -63507,16 +64496,17 @@ diff -urNp linux-2.6.32.46/include/linux/types.h linux-2.6.32.46/include/linux/t struct ustat { diff -urNp linux-2.6.32.46/include/linux/uaccess.h linux-2.6.32.46/include/linux/uaccess.h --- linux-2.6.32.46/include/linux/uaccess.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/include/linux/uaccess.h 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/include/linux/uaccess.h 2011-10-06 09:37:14.000000000 -0400 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_ long ret; \ mm_segment_t old_fs = get_fs(); \ \ - set_fs(KERNEL_DS); \ pagefault_disable(); \ -+ set_fs(KERNEL_DS); \ - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ +- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ - pagefault_enable(); \ ++ set_fs(KERNEL_DS); \ ++ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \ set_fs(old_fs); \ + pagefault_enable(); \ ret; \ @@ -64290,15 +65280,15 @@ diff -urNp linux-2.6.32.46/init/do_mounts.c linux-2.6.32.46/init/do_mounts.c } diff -urNp linux-2.6.32.46/init/do_mounts.h linux-2.6.32.46/init/do_mounts.h --- linux-2.6.32.46/init/do_mounts.h 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/init/do_mounts.h 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/init/do_mounts.h 2011-10-06 09:37:14.000000000 -0400 @@ -15,15 +15,15 @@ extern int root_mountflags; static inline int create_dev(char *name, dev_t dev) { - sys_unlink(name); - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev)); -+ sys_unlink((__force char __user *)name); -+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev)); ++ sys_unlink((char __force_user *)name); ++ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev)); } #if BITS_PER_LONG == 32 @@ -64306,13 +65296,22 @@ diff -urNp linux-2.6.32.46/init/do_mounts.h linux-2.6.32.46/init/do_mounts.h { struct stat64 stat; - if (sys_stat64(name, &stat) != 0) -+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0) ++ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0) + return 0; + if (!S_ISBLK(stat.st_mode)) + return 0; +@@ -35,7 +35,7 @@ static inline u32 bstat(char *name) + static inline u32 bstat(char *name) + { + struct stat stat; +- if (sys_newstat(name, &stat) != 0) ++ if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0) return 0; if (!S_ISBLK(stat.st_mode)) return 0; diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mounts_initrd.c --- linux-2.6.32.46/init/do_mounts_initrd.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/init/do_mounts_initrd.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/init/do_mounts_initrd.c 2011-10-06 09:37:14.000000000 -0400 @@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel sys_close(old_fd);sys_close(root_fd); sys_close(0);sys_close(1);sys_close(2); @@ -64329,16 +65328,16 @@ diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mount - sys_mkdir("/old", 0700); - root_fd = sys_open("/", 0, 0); - old_fd = sys_open("/old", 0, 0); -+ sys_mkdir((__force const char __user *)"/old", 0700); -+ root_fd = sys_open((__force const char __user *)"/", 0, 0); -+ old_fd = sys_open((__force const char __user *)"/old", 0, 0); ++ sys_mkdir((const char __force_user *)"/old", 0700); ++ root_fd = sys_open((const char __force_user *)"/", 0, 0); ++ old_fd = sys_open((const char __force_user *)"/old", 0, 0); /* move initrd over / and chdir/chroot in initrd root */ - sys_chdir("/root"); - sys_mount(".", "/", NULL, MS_MOVE, NULL); - sys_chroot("."); -+ sys_chdir((__force const char __user *)"/root"); -+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL); -+ sys_chroot((__force const char __user *)"."); ++ sys_chdir((const char __force_user *)"/root"); ++ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL); ++ sys_chroot((const char __force_user *)"."); /* * In case that a resume from disk is carried out by linuxrc or one of @@ -64347,17 +65346,17 @@ diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mount /* move initrd to rootfs' /old */ sys_fchdir(old_fd); - sys_mount("/", ".", NULL, MS_MOVE, NULL); -+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL); ++ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL); /* switch root and cwd back to / of rootfs */ sys_fchdir(root_fd); - sys_chroot("."); -+ sys_chroot((__force const char __user *)"."); ++ sys_chroot((const char __force_user *)"."); sys_close(old_fd); sys_close(root_fd); if (new_decode_dev(real_root_dev) == Root_RAM0) { - sys_chdir("/old"); -+ sys_chdir((__force const char __user *)"/old"); ++ sys_chdir((const char __force_user *)"/old"); return; } @@ -64366,19 +65365,19 @@ diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mount printk(KERN_NOTICE "Trying to move old root to /initrd ... "); - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL); -+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL); ++ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL); if (!error) printk("okay\n"); else { - int fd = sys_open("/dev/root.old", O_RDWR, 0); -+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0); ++ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0); if (error == -ENOENT) printk("/initrd does not exist. Ignored.\n"); else printk("failed\n"); printk(KERN_NOTICE "Unmounting old root\n"); - sys_umount("/old", MNT_DETACH); -+ sys_umount((__force char __user *)"/old", MNT_DETACH); ++ sys_umount((char __force_user *)"/old", MNT_DETACH); printk(KERN_NOTICE "Trying to free ramdisk memory ... "); if (fd < 0) { error = fd; @@ -64387,24 +65386,24 @@ diff -urNp linux-2.6.32.46/init/do_mounts_initrd.c linux-2.6.32.46/init/do_mount */ if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) { - sys_unlink("/initrd.image"); -+ sys_unlink((__force const char __user *)"/initrd.image"); ++ sys_unlink((const char __force_user *)"/initrd.image"); handle_initrd(); return 1; } } - sys_unlink("/initrd.image"); -+ sys_unlink((__force const char __user *)"/initrd.image"); ++ sys_unlink((const char __force_user *)"/initrd.image"); return 0; } diff -urNp linux-2.6.32.46/init/do_mounts_md.c linux-2.6.32.46/init/do_mounts_md.c --- linux-2.6.32.46/init/do_mounts_md.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/init/do_mounts_md.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/init/do_mounts_md.c 2011-10-06 09:37:14.000000000 -0400 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void) partitioned ? "_d" : "", minor, md_setup_args[ent].device_names); - fd = sys_open(name, 0, 0); -+ fd = sys_open((__force char __user *)name, 0, 0); ++ fd = sys_open((char __force_user *)name, 0, 0); if (fd < 0) { printk(KERN_ERR "md: open failed - cannot start " "array %s\n", name); @@ -64413,7 +65412,7 @@ diff -urNp linux-2.6.32.46/init/do_mounts_md.c linux-2.6.32.46/init/do_mounts_md */ sys_close(fd); - fd = sys_open(name, 0, 0); -+ fd = sys_open((__force char __user *)name, 0, 0); ++ fd = sys_open((char __force_user *)name, 0, 0); sys_ioctl(fd, BLKRRPART, 0); } sys_close(fd); @@ -64428,7 +65427,7 @@ diff -urNp linux-2.6.32.46/init/do_mounts_md.c linux-2.6.32.46/init/do_mounts_md sys_close(fd); diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c --- linux-2.6.32.46/init/initramfs.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/init/initramfs.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/init/initramfs.c 2011-10-06 09:37:14.000000000 -0400 @@ -74,7 +74,7 @@ static void __init free_hash(void) } } @@ -64443,7 +65442,7 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c list_for_each_entry_safe(de, tmp, &dir_list, list) { list_del(&de->list); - do_utime(de->name, de->mtime); -+ do_utime((__force char __user *)de->name, de->mtime); ++ do_utime((char __force_user *)de->name, de->mtime); kfree(de->name); kfree(de); } @@ -64452,7 +65451,7 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c char *old = find_link(major, minor, ino, mode, collected); if (old) - return (sys_link(old, collected) < 0) ? -1 : 1; -+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1; ++ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1; } return 0; } @@ -64461,13 +65460,13 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c struct stat st; - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) { -+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) { ++ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) { if (S_ISDIR(st.st_mode)) - sys_rmdir(path); -+ sys_rmdir((__force char __user *)path); ++ sys_rmdir((char __force_user *)path); else - sys_unlink(path); -+ sys_unlink((__force char __user *)path); ++ sys_unlink((char __force_user *)path); } } @@ -64476,7 +65475,7 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c if (ml != 1) openflags |= O_TRUNC; - wfd = sys_open(collected, openflags, mode); -+ wfd = sys_open((__force char __user *)collected, openflags, mode); ++ wfd = sys_open((char __force_user *)collected, openflags, mode); if (wfd >= 0) { sys_fchown(wfd, uid, gid); @@ -64487,9 +65486,9 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c - sys_mkdir(collected, mode); - sys_chown(collected, uid, gid); - sys_chmod(collected, mode); -+ sys_mkdir((__force char __user *)collected, mode); -+ sys_chown((__force char __user *)collected, uid, gid); -+ sys_chmod((__force char __user *)collected, mode); ++ sys_mkdir((char __force_user *)collected, mode); ++ sys_chown((char __force_user *)collected, uid, gid); ++ sys_chmod((char __force_user *)collected, mode); dir_add(collected, mtime); } else if (S_ISBLK(mode) || S_ISCHR(mode) || S_ISFIFO(mode) || S_ISSOCK(mode)) { @@ -64498,10 +65497,10 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c - sys_chown(collected, uid, gid); - sys_chmod(collected, mode); - do_utime(collected, mtime); -+ sys_mknod((__force char __user *)collected, mode, rdev); -+ sys_chown((__force char __user *)collected, uid, gid); -+ sys_chmod((__force char __user *)collected, mode); -+ do_utime((__force char __user *)collected, mtime); ++ sys_mknod((char __force_user *)collected, mode, rdev); ++ sys_chown((char __force_user *)collected, uid, gid); ++ sys_chmod((char __force_user *)collected, mode); ++ do_utime((char __force_user *)collected, mtime); } } return 0; @@ -64510,17 +65509,17 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c { if (count >= body_len) { - sys_write(wfd, victim, body_len); -+ sys_write(wfd, (__force char __user *)victim, body_len); ++ sys_write(wfd, (char __force_user *)victim, body_len); sys_close(wfd); - do_utime(vcollected, mtime); -+ do_utime((__force char __user *)vcollected, mtime); ++ do_utime((char __force_user *)vcollected, mtime); kfree(vcollected); eat(body_len); state = SkipIt; return 0; } else { - sys_write(wfd, victim, count); -+ sys_write(wfd, (__force char __user *)victim, count); ++ sys_write(wfd, (char __force_user *)victim, count); body_len -= count; eat(count); return 1; @@ -64531,9 +65530,9 @@ diff -urNp linux-2.6.32.46/init/initramfs.c linux-2.6.32.46/init/initramfs.c - sys_symlink(collected + N_ALIGN(name_len), collected); - sys_lchown(collected, uid, gid); - do_utime(collected, mtime); -+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected); -+ sys_lchown((__force char __user *)collected, uid, gid); -+ do_utime((__force char __user *)collected, mtime); ++ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected); ++ sys_lchown((char __force_user *)collected, uid, gid); ++ do_utime((char __force_user *)collected, mtime); state = SkipIt; next_state = Reset; return 0; @@ -64551,7 +65550,7 @@ diff -urNp linux-2.6.32.46/init/Kconfig linux-2.6.32.46/init/Kconfig also breaks ancient binaries (including anything libc5 based). diff -urNp linux-2.6.32.46/init/main.c linux-2.6.32.46/init/main.c --- linux-2.6.32.46/init/main.c 2011-05-10 22:12:01.000000000 -0400 -+++ linux-2.6.32.46/init/main.c 2011-08-05 20:33:55.000000000 -0400 ++++ linux-2.6.32.46/init/main.c 2011-10-06 09:37:14.000000000 -0400 @@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void) #ifdef CONFIG_TC extern void tc_init(void); @@ -64685,7 +65684,7 @@ diff -urNp linux-2.6.32.46/init/main.c linux-2.6.32.46/init/main.c ramdisk_execute_command = "/init"; - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) { -+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) { ++ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) { ramdisk_execute_command = NULL; prepare_namespace(); } @@ -64886,13 +65885,13 @@ diff -urNp linux-2.6.32.46/ipc/shm.c linux-2.6.32.46/ipc/shm.c diff -urNp linux-2.6.32.46/kernel/acct.c linux-2.6.32.46/kernel/acct.c --- linux-2.6.32.46/kernel/acct.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/kernel/acct.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/kernel/acct.c 2011-10-06 09:37:14.000000000 -0400 @@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a */ flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur; current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; - file->f_op->write(file, (char *)&ac, -+ file->f_op->write(file, (__force char __user *)&ac, ++ file->f_op->write(file, (char __force_user *)&ac, sizeof(acct_t), &file->f_pos); current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; set_fs(fs); @@ -65012,6 +66011,157 @@ diff -urNp linux-2.6.32.46/kernel/cgroup.c linux-2.6.32.46/kernel/cgroup.c /* First see if we already have a cgroup group that matches * the desired set */ read_lock(&css_set_lock); +diff -urNp linux-2.6.32.46/kernel/compat.c linux-2.6.32.46/kernel/compat.c +--- linux-2.6.32.46/kernel/compat.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/kernel/compat.c 2011-10-06 09:37:14.000000000 -0400 +@@ -108,7 +108,7 @@ static long compat_nanosleep_restart(str + mm_segment_t oldfs; + long ret; + +- restart->nanosleep.rmtp = (struct timespec __user *) &rmt; ++ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt; + oldfs = get_fs(); + set_fs(KERNEL_DS); + ret = hrtimer_nanosleep_restart(restart); +@@ -140,7 +140,7 @@ asmlinkage long compat_sys_nanosleep(str + oldfs = get_fs(); + set_fs(KERNEL_DS); + ret = hrtimer_nanosleep(&tu, +- rmtp ? (struct timespec __user *)&rmt : NULL, ++ rmtp ? (struct timespec __force_user *)&rmt : NULL, + HRTIMER_MODE_REL, CLOCK_MONOTONIC); + set_fs(oldfs); + +@@ -247,7 +247,7 @@ asmlinkage long compat_sys_sigpending(co + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_sigpending((old_sigset_t __user *) &s); ++ ret = sys_sigpending((old_sigset_t __force_user *) &s); + set_fs(old_fs); + if (ret == 0) + ret = put_user(s, set); +@@ -266,8 +266,8 @@ asmlinkage long compat_sys_sigprocmask(i + old_fs = get_fs(); + set_fs(KERNEL_DS); + ret = sys_sigprocmask(how, +- set ? (old_sigset_t __user *) &s : NULL, +- oset ? (old_sigset_t __user *) &s : NULL); ++ set ? (old_sigset_t __force_user *) &s : NULL, ++ oset ? (old_sigset_t __force_user *) &s : NULL); + set_fs(old_fs); + if (ret == 0) + if (oset) +@@ -310,7 +310,7 @@ asmlinkage long compat_sys_old_getrlimit + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_old_getrlimit(resource, &r); ++ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r); + set_fs(old_fs); + + if (!ret) { +@@ -385,7 +385,7 @@ asmlinkage long compat_sys_getrusage(int + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_getrusage(who, (struct rusage __user *) &r); ++ ret = sys_getrusage(who, (struct rusage __force_user *) &r); + set_fs(old_fs); + + if (ret) +@@ -412,8 +412,8 @@ compat_sys_wait4(compat_pid_t pid, compa + set_fs (KERNEL_DS); + ret = sys_wait4(pid, + (stat_addr ? +- (unsigned int __user *) &status : NULL), +- options, (struct rusage __user *) &r); ++ (unsigned int __force_user *) &status : NULL), ++ options, (struct rusage __force_user *) &r); + set_fs (old_fs); + + if (ret > 0) { +@@ -438,8 +438,8 @@ asmlinkage long compat_sys_waitid(int wh + memset(&info, 0, sizeof(info)); + + set_fs(KERNEL_DS); +- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options, +- uru ? (struct rusage __user *)&ru : NULL); ++ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options, ++ uru ? (struct rusage __force_user *)&ru : NULL); + set_fs(old_fs); + + if ((ret < 0) || (info.si_signo == 0)) +@@ -569,8 +569,8 @@ long compat_sys_timer_settime(timer_t ti + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_timer_settime(timer_id, flags, +- (struct itimerspec __user *) &newts, +- (struct itimerspec __user *) &oldts); ++ (struct itimerspec __force_user *) &newts, ++ (struct itimerspec __force_user *) &oldts); + set_fs(oldfs); + if (!err && old && put_compat_itimerspec(old, &oldts)) + return -EFAULT; +@@ -587,7 +587,7 @@ long compat_sys_timer_gettime(timer_t ti + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_timer_gettime(timer_id, +- (struct itimerspec __user *) &ts); ++ (struct itimerspec __force_user *) &ts); + set_fs(oldfs); + if (!err && put_compat_itimerspec(setting, &ts)) + return -EFAULT; +@@ -606,7 +606,7 @@ long compat_sys_clock_settime(clockid_t + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_settime(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + return err; + } +@@ -621,7 +621,7 @@ long compat_sys_clock_gettime(clockid_t + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_gettime(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + if (!err && put_compat_timespec(&ts, tp)) + return -EFAULT; +@@ -638,7 +638,7 @@ long compat_sys_clock_getres(clockid_t w + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_getres(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + if (!err && tp && put_compat_timespec(&ts, tp)) + return -EFAULT; +@@ -650,9 +650,9 @@ static long compat_clock_nanosleep_resta + long err; + mm_segment_t oldfs; + struct timespec tu; +- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp; ++ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp; + +- restart->nanosleep.rmtp = (struct timespec __user *) &tu; ++ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu; + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = clock_nanosleep_restart(restart); +@@ -684,8 +684,8 @@ long compat_sys_clock_nanosleep(clockid_ + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_nanosleep(which_clock, flags, +- (struct timespec __user *) &in, +- (struct timespec __user *) &out); ++ (struct timespec __force_user *) &in, ++ (struct timespec __force_user *) &out); + set_fs(oldfs); + + if ((err == -ERESTART_RESTARTBLOCK) && rmtp && diff -urNp linux-2.6.32.46/kernel/configs.c linux-2.6.32.46/kernel/configs.c --- linux-2.6.32.46/kernel/configs.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/kernel/configs.c 2011-04-17 15:56:46.000000000 -0400 @@ -65761,6 +66911,19 @@ diff -urNp linux-2.6.32.46/kernel/kallsyms.c linux-2.6.32.46/kernel/kallsyms.c if (!iter) return -ENOMEM; reset_iter(iter, 0); +diff -urNp linux-2.6.32.46/kernel/kexec.c linux-2.6.32.46/kernel/kexec.c +--- linux-2.6.32.46/kernel/kexec.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/kernel/kexec.c 2011-10-06 09:37:14.000000000 -0400 +@@ -1028,7 +1028,8 @@ asmlinkage long compat_sys_kexec_load(un + unsigned long flags) + { + struct compat_kexec_segment in; +- struct kexec_segment out, __user *ksegments; ++ struct kexec_segment out; ++ struct kexec_segment __user *ksegments; + unsigned long i, result; + + /* Don't allow clients that don't understand the native diff -urNp linux-2.6.32.46/kernel/kgdb.c linux-2.6.32.46/kernel/kgdb.c --- linux-2.6.32.46/kernel/kgdb.c 2011-04-17 17:00:52.000000000 -0400 +++ linux-2.6.32.46/kernel/kgdb.c 2011-05-04 17:56:20.000000000 -0400 @@ -65845,7 +67008,7 @@ diff -urNp linux-2.6.32.46/kernel/kgdb.c linux-2.6.32.46/kernel/kgdb.c diff -urNp linux-2.6.32.46/kernel/kmod.c linux-2.6.32.46/kernel/kmod.c --- linux-2.6.32.46/kernel/kmod.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/kernel/kmod.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/kernel/kmod.c 2011-10-06 09:37:14.000000000 -0400 @@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb * If module auto-loading support is disabled then this function * becomes a no-operation. @@ -65939,6 +67102,15 @@ diff -urNp linux-2.6.32.46/kernel/kmod.c linux-2.6.32.46/kernel/kmod.c EXPORT_SYMBOL(__request_module); #endif /* CONFIG_MODULES */ +@@ -226,7 +279,7 @@ static int wait_for_helper(void *data) + * + * Thus the __user pointer cast is valid here. + */ +- sys_wait4(pid, (int __user *)&ret, 0, NULL); ++ sys_wait4(pid, (int __force_user *)&ret, 0, NULL); + + /* + * If ret is 0, either ____call_usermodehelper failed and the diff -urNp linux-2.6.32.46/kernel/kprobes.c linux-2.6.32.46/kernel/kprobes.c --- linux-2.6.32.46/kernel/kprobes.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/kernel/kprobes.c 2011-04-17 15:56:46.000000000 -0400 @@ -66919,7 +68091,7 @@ diff -urNp linux-2.6.32.46/kernel/params.c linux-2.6.32.46/kernel/params.c diff -urNp linux-2.6.32.46/kernel/perf_event.c linux-2.6.32.46/kernel/perf_event.c --- linux-2.6.32.46/kernel/perf_event.c 2011-08-09 18:35:30.000000000 -0400 -+++ linux-2.6.32.46/kernel/perf_event.c 2011-08-09 18:34:01.000000000 -0400 ++++ linux-2.6.32.46/kernel/perf_event.c 2011-10-06 09:37:14.000000000 -0400 @@ -77,7 +77,7 @@ int sysctl_perf_event_mlock __read_mostl */ int sysctl_perf_event_sample_rate __read_mostly = 100000; @@ -67044,6 +68216,21 @@ diff -urNp linux-2.6.32.46/kernel/perf_event.c linux-2.6.32.46/kernel/perf_event if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(sub); +@@ -3525,12 +3525,12 @@ static void perf_event_mmap_event(struct + * need to add enough zero bytes after the string to handle + * the 64bit alignment we do later. + */ +- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL); ++ buf = kzalloc(PATH_MAX, GFP_KERNEL); + if (!buf) { + name = strncpy(tmp, "//enomem", sizeof(tmp)); + goto got_name; + } +- name = d_path(&file->f_path, buf, PATH_MAX); ++ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64)); + if (IS_ERR(name)) { + name = strncpy(tmp, "//toolong", sizeof(tmp)); + goto got_name; @@ -3783,7 +3783,7 @@ static void perf_swevent_add(struct perf { struct hw_perf_event *hwc = &event->hw; @@ -69235,6 +70422,27 @@ diff -urNp linux-2.6.32.46/kernel/user.c linux-2.6.32.46/kernel/user.c key_put(new->uid_keyring); key_put(new->session_keyring); kmem_cache_free(uid_cachep, new); +diff -urNp linux-2.6.32.46/lib/bitmap.c linux-2.6.32.46/lib/bitmap.c +--- linux-2.6.32.46/lib/bitmap.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/lib/bitmap.c 2011-10-06 09:37:14.000000000 -0400 +@@ -341,7 +341,7 @@ int __bitmap_parse(const char *buf, unsi + { + int c, old_c, totaldigits, ndigits, nchunks, nbits; + u32 chunk; +- const char __user *ubuf = buf; ++ const char __user *ubuf = (const char __force_user *)buf; + + bitmap_zero(maskp, nmaskbits); + +@@ -426,7 +426,7 @@ int bitmap_parse_user(const char __user + { + if (!access_ok(VERIFY_READ, ubuf, ulen)) + return -EFAULT; +- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits); ++ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits); + } + EXPORT_SYMBOL(bitmap_parse_user); + diff -urNp linux-2.6.32.46/lib/bug.c linux-2.6.32.46/lib/bug.c --- linux-2.6.32.46/lib/bug.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/lib/bug.c 2011-04-17 15:56:46.000000000 -0400 @@ -69259,6 +70467,27 @@ diff -urNp linux-2.6.32.46/lib/debugobjects.c linux-2.6.32.46/lib/debugobjects.c if (is_on_stack == onstack) return; +diff -urNp linux-2.6.32.46/lib/devres.c linux-2.6.32.46/lib/devres.c +--- linux-2.6.32.46/lib/devres.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/lib/devres.c 2011-10-06 09:37:14.000000000 -0400 +@@ -80,7 +80,7 @@ void devm_iounmap(struct device *dev, vo + { + iounmap(addr); + WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match, +- (void *)addr)); ++ (void __force *)addr)); + } + EXPORT_SYMBOL(devm_iounmap); + +@@ -140,7 +140,7 @@ void devm_ioport_unmap(struct device *de + { + ioport_unmap(addr); + WARN_ON(devres_destroy(dev, devm_ioport_map_release, +- devm_ioport_map_match, (void *)addr)); ++ devm_ioport_map_match, (void __force *)addr)); + } + EXPORT_SYMBOL(devm_ioport_unmap); + diff -urNp linux-2.6.32.46/lib/dma-debug.c linux-2.6.32.46/lib/dma-debug.c --- linux-2.6.32.46/lib/dma-debug.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/lib/dma-debug.c 2011-04-17 15:56:46.000000000 -0400 @@ -69507,7 +70736,7 @@ diff -urNp linux-2.6.32.46/localversion-grsec linux-2.6.32.46/localversion-grsec +-grsec diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile --- linux-2.6.32.46/Makefile 2011-08-29 22:24:44.000000000 -0400 -+++ linux-2.6.32.46/Makefile 2011-09-01 17:24:34.000000000 -0400 ++++ linux-2.6.32.46/Makefile 2011-10-06 09:43:36.000000000 -0400 @@ -221,8 +221,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" HOSTCC = gcc @@ -69533,15 +70762,18 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile KBUILD_AFLAGS := -D__ASSEMBLY__ # Read KERNELRELEASE from include/config/kernel.release (if it exists) -@@ -377,6 +380,7 @@ export RCS_TAR_IGNORE := --exclude SCCS +@@ -376,8 +379,8 @@ export RCS_TAR_IGNORE := --exclude SCCS + # Rules shared between *config targets and build targets # Basic helpers built in scripts/ - PHONY += scripts_basic -+scripts_basic: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS)) - scripts_basic: +-PHONY += scripts_basic +-scripts_basic: ++PHONY += scripts_basic gcc-plugins ++scripts_basic: gcc-plugins $(Q)$(MAKE) $(build)=scripts/basic -@@ -403,7 +407,7 @@ endif + # To avoid any implicit rule to kick in, define an empty command. +@@ -403,7 +406,7 @@ endif # of make so .config is not included in this case either (for *config). no-dot-config-targets := clean mrproper distclean \ @@ -69550,16 +70782,28 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile include/linux/version.h headers_% \ kernelrelease kernelversion -@@ -526,6 +530,24 @@ else +@@ -526,6 +529,36 @@ else KBUILD_CFLAGS += -O2 endif -+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC)), y) ++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y) +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN +ifdef CONFIG_PAX_MEMORY_STACKLEAK +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100 +endif -+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN ++ifdef CONFIG_KALLOCSTAT_PLUGIN ++KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so ++endif ++ifdef CONFIG_PAX_KERNEXEC_PLUGIN ++KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so ++endif ++ifdef CONFIG_CHECKER_PLUGIN ++ifeq ($(call cc-ifversion, -ge, 0406, y), y) ++CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN ++endif ++endif ++GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN) ++export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN +gcc-plugins: + $(Q)$(MAKE) $(build)=tools/gcc +else @@ -69575,7 +70819,7 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile include $(srctree)/arch/$(SRCARCH)/Makefile ifneq ($(CONFIG_FRAME_WARN),0) -@@ -644,7 +666,7 @@ export mod_strip_cmd +@@ -644,7 +677,7 @@ export mod_strip_cmd ifeq ($(KBUILD_EXTMOD),) @@ -69584,34 +70828,34 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ -@@ -840,6 +862,8 @@ define rule_vmlinux-modpost +@@ -840,6 +873,8 @@ define rule_vmlinux-modpost endef # vmlinux image - including updated kernel symbols -+$(vmlinux-all): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++$(vmlinux-all): KBUILD_CFLAGS += $(GCC_PLUGINS) +$(vmlinux-all): gcc-plugins vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o $(kallsyms.o) FORCE ifdef CONFIG_HEADERS_CHECK $(Q)$(MAKE) -f $(srctree)/Makefile headers_check -@@ -874,7 +898,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) +@@ -874,7 +909,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) # Error messages still appears in the original language PHONY += $(vmlinux-dirs) -$(vmlinux-dirs): prepare scripts -+$(vmlinux-dirs): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++$(vmlinux-dirs): KBUILD_CFLAGS += $(GCC_PLUGINS) +$(vmlinux-dirs): gcc-plugins prepare scripts $(Q)$(MAKE) $(build)=$@ # Build the kernel release string -@@ -983,6 +1008,7 @@ prepare0: archprepare FORCE +@@ -983,6 +1019,7 @@ prepare0: archprepare FORCE $(Q)$(MAKE) $(build)=. missing-syscalls # All the preparing.. -+prepare: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS)) ++prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS)) prepare: prepare0 # The asm symlink changes when $(ARCH) changes. -@@ -1133,7 +1159,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_B +@@ -1133,7 +1170,7 @@ modules: $(vmlinux-dirs) $(if $(KBUILD_B # Target to prepare building external modules PHONY += modules_prepare @@ -69620,7 +70864,7 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile # Target to install modules PHONY += modules_install -@@ -1198,7 +1224,7 @@ MRPROPER_FILES += .config .config.old in +@@ -1198,7 +1235,7 @@ MRPROPER_FILES += .config .config.old in include/linux/autoconf.h include/linux/version.h \ include/linux/utsrelease.h \ include/linux/bounds.h include/asm*/asm-offsets.h \ @@ -69629,7 +70873,7 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile # clean - Delete most, but leave enough to build external modules # -@@ -1242,7 +1268,7 @@ distclean: mrproper +@@ -1242,7 +1279,7 @@ distclean: mrproper @find $(srctree) $(RCS_FIND_IGNORE) \ \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ @@ -69638,7 +70882,7 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1289,6 +1315,7 @@ help: +@@ -1289,6 +1326,7 @@ help: @echo ' modules_prepare - Set up for building external modules' @echo ' tags/TAGS - Generate tags file for editors' @echo ' cscope - Generate cscope index' @@ -69646,15 +70890,15 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile @echo ' kernelrelease - Output the release version string' @echo ' kernelversion - Output the version stored in Makefile' @echo ' headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \ -@@ -1390,6 +1417,7 @@ PHONY += $(module-dirs) modules +@@ -1390,6 +1428,7 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) -+modules: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++modules: KBUILD_CFLAGS += $(GCC_PLUGINS) modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1445,7 +1473,7 @@ endif # KBUILD_EXTMOD +@@ -1445,7 +1484,7 @@ endif # KBUILD_EXTMOD quiet_cmd_tags = GEN $@ cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@ @@ -69663,18 +70907,18 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile $(call cmd,tags) # Scripts to check various things for consistency -@@ -1510,17 +1538,19 @@ else +@@ -1510,17 +1549,19 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif -%.s: %.c prepare scripts FORCE -+%.s: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.s: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.s: %.c gcc-plugins prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.i: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -%.o: %.c prepare scripts FORCE -+%.o: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.o: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.o: %.c gcc-plugins prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.lst: %.c prepare scripts FORCE @@ -69687,18 +70931,18 @@ diff -urNp linux-2.6.32.46/Makefile linux-2.6.32.46/Makefile $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1530,11 +1560,13 @@ endif +@@ -1530,11 +1571,13 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) -%/: prepare scripts FORCE -+%/: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%/: KBUILD_CFLAGS += $(GCC_PLUGINS) +%/: gcc-plugins prepare scripts FORCE $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) -%.ko: prepare scripts FORCE -+%.ko: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.ko: gcc-plugins prepare scripts FORCE $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ @@ -69915,7 +71159,7 @@ diff -urNp linux-2.6.32.46/mm/kmemleak.c linux-2.6.32.46/mm/kmemleak.c diff -urNp linux-2.6.32.46/mm/maccess.c linux-2.6.32.46/mm/maccess.c --- linux-2.6.32.46/mm/maccess.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/mm/maccess.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/mm/maccess.c 2011-10-06 09:37:14.000000000 -0400 @@ -14,7 +14,7 @@ * Safely read from address @src to the buffer at @dst. If a kernel fault * happens, handle that and return -EFAULT. @@ -69925,7 +71169,16 @@ diff -urNp linux-2.6.32.46/mm/maccess.c linux-2.6.32.46/mm/maccess.c { long ret; mm_segment_t old_fs = get_fs(); -@@ -39,7 +39,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read); +@@ -22,7 +22,7 @@ long probe_kernel_read(void *dst, void * + set_fs(KERNEL_DS); + pagefault_disable(); + ret = __copy_from_user_inatomic(dst, +- (__force const void __user *)src, size); ++ (const void __force_user *)src, size); + pagefault_enable(); + set_fs(old_fs); + +@@ -39,14 +39,14 @@ EXPORT_SYMBOL_GPL(probe_kernel_read); * Safely write to address @dst from the buffer at @src. If a kernel fault * happens, handle that and return -EFAULT. */ @@ -69934,6 +71187,14 @@ diff -urNp linux-2.6.32.46/mm/maccess.c linux-2.6.32.46/mm/maccess.c { long ret; mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); + pagefault_disable(); +- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); ++ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size); + pagefault_enable(); + set_fs(old_fs); + diff -urNp linux-2.6.32.46/mm/madvise.c linux-2.6.32.46/mm/madvise.c --- linux-2.6.32.46/mm/madvise.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/mm/madvise.c 2011-04-17 15:56:46.000000000 -0400 @@ -70547,7 +71808,7 @@ diff -urNp linux-2.6.32.46/mm/memory.c linux-2.6.32.46/mm/memory.c * Dumping its contents makes post-mortem fully interpretable later diff -urNp linux-2.6.32.46/mm/memory-failure.c linux-2.6.32.46/mm/memory-failure.c --- linux-2.6.32.46/mm/memory-failure.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/mm/memory-failure.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/mm/memory-failure.c 2011-10-06 09:37:14.000000000 -0400 @@ -46,7 +46,7 @@ int sysctl_memory_failure_early_kill __r int sysctl_memory_failure_recovery __read_mostly = 1; @@ -70557,6 +71818,15 @@ diff -urNp linux-2.6.32.46/mm/memory-failure.c linux-2.6.32.46/mm/memory-failure /* * Send all the processes who have the page mapped an ``action optional'' +@@ -64,7 +64,7 @@ static int kill_proc_ao(struct task_stru + si.si_signo = SIGBUS; + si.si_errno = 0; + si.si_code = BUS_MCEERR_AO; +- si.si_addr = (void *)addr; ++ si.si_addr = (void __user *)addr; + #ifdef __ARCH_SI_TRAPNO + si.si_trapno = trapno; + #endif @@ -745,7 +745,7 @@ int __memory_failure(unsigned long pfn, return 0; } @@ -73650,6 +74920,18 @@ diff -urNp linux-2.6.32.46/net/8021q/vlan.c linux-2.6.32.46/net/8021q/vlan.c struct vlan_net *vn; vn = net_generic(net, vlan_net_id); +diff -urNp linux-2.6.32.46/net/9p/trans_fd.c linux-2.6.32.46/net/9p/trans_fd.c +--- linux-2.6.32.46/net/9p/trans_fd.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/9p/trans_fd.c 2011-10-06 09:37:14.000000000 -0400 +@@ -419,7 +419,7 @@ static int p9_fd_write(struct p9_client + oldfs = get_fs(); + set_fs(get_ds()); + /* The cast to a user pointer is valid due to the set_fs() */ +- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos); ++ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos); + set_fs(oldfs); + + if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN) diff -urNp linux-2.6.32.46/net/atm/atm_misc.c linux-2.6.32.46/net/atm/atm_misc.c --- linux-2.6.32.46/net/atm/atm_misc.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/net/atm/atm_misc.c 2011-04-17 15:56:46.000000000 -0400 @@ -73886,6 +75168,109 @@ diff -urNp linux-2.6.32.46/net/can/bcm.c linux-2.6.32.46/net/can/bcm.c seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs); seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex)); seq_printf(m, " <<<\n"); +diff -urNp linux-2.6.32.46/net/compat.c linux-2.6.32.46/net/compat.c +--- linux-2.6.32.46/net/compat.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/compat.c 2011-10-06 09:37:14.000000000 -0400 +@@ -69,9 +69,9 @@ int get_compat_msghdr(struct msghdr *kms + __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || + __get_user(kmsg->msg_flags, &umsg->msg_flags)) + return -EFAULT; +- kmsg->msg_name = compat_ptr(tmp1); +- kmsg->msg_iov = compat_ptr(tmp2); +- kmsg->msg_control = compat_ptr(tmp3); ++ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1); ++ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2); ++ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3); + return 0; + } + +@@ -94,7 +94,7 @@ int verify_compat_iovec(struct msghdr *k + kern_msg->msg_name = NULL; + + tot_len = iov_from_user_compat_to_kern(kern_iov, +- (struct compat_iovec __user *)kern_msg->msg_iov, ++ (struct compat_iovec __force_user *)kern_msg->msg_iov, + kern_msg->msg_iovlen); + if (tot_len >= 0) + kern_msg->msg_iov = kern_iov; +@@ -114,20 +114,20 @@ int verify_compat_iovec(struct msghdr *k + + #define CMSG_COMPAT_FIRSTHDR(msg) \ + (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \ +- (struct compat_cmsghdr __user *)((msg)->msg_control) : \ ++ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \ + (struct compat_cmsghdr __user *)NULL) + + #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \ + ((ucmlen) >= sizeof(struct compat_cmsghdr) && \ + (ucmlen) <= (unsigned long) \ + ((mhdr)->msg_controllen - \ +- ((char *)(ucmsg) - (char *)(mhdr)->msg_control))) ++ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control))) + + static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg, + struct compat_cmsghdr __user *cmsg, int cmsg_len) + { + char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len); +- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) > ++ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) > + msg->msg_controllen) + return NULL; + return (struct compat_cmsghdr __user *)ptr; +@@ -219,7 +219,7 @@ int put_cmsg_compat(struct msghdr *kmsg, + { + struct compat_timeval ctv; + struct compat_timespec cts[3]; +- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control; ++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control; + struct compat_cmsghdr cmhdr; + int cmlen; + +@@ -271,7 +271,7 @@ int put_cmsg_compat(struct msghdr *kmsg, + + void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) + { +- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control; ++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control; + int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int); + int fdnum = scm->fp->count; + struct file **fp = scm->fp->fp; +@@ -433,7 +433,7 @@ static int do_get_sock_timeout(struct so + len = sizeof(ktime); + old_fs = get_fs(); + set_fs(KERNEL_DS); +- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len); ++ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len); + set_fs(old_fs); + + if (!err) { +@@ -570,7 +570,7 @@ int compat_mc_setsockopt(struct sock *so + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + { +- struct compat_group_req __user *gr32 = (void *)optval; ++ struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req __user *kgr = + compat_alloc_user_space(sizeof(struct group_req)); + u32 interface; +@@ -591,7 +591,7 @@ int compat_mc_setsockopt(struct sock *so + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + { +- struct compat_group_source_req __user *gsr32 = (void *)optval; ++ struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req __user *kgsr = compat_alloc_user_space( + sizeof(struct group_source_req)); + u32 interface; +@@ -612,7 +612,7 @@ int compat_mc_setsockopt(struct sock *so + } + case MCAST_MSFILTER: + { +- struct compat_group_filter __user *gf32 = (void *)optval; ++ struct compat_group_filter __user *gf32 = (void __user *)optval; + struct group_filter __user *kgf; + u32 interface, fmode, numsrc; + diff -urNp linux-2.6.32.46/net/core/dev.c linux-2.6.32.46/net/core/dev.c --- linux-2.6.32.46/net/core/dev.c 2011-04-17 17:00:52.000000000 -0400 +++ linux-2.6.32.46/net/core/dev.c 2011-08-05 20:33:55.000000000 -0400 @@ -74005,6 +75390,45 @@ diff -urNp linux-2.6.32.46/net/core/rtnetlink.c linux-2.6.32.46/net/core/rtnetli static DEFINE_MUTEX(rtnl_mutex); +diff -urNp linux-2.6.32.46/net/core/scm.c linux-2.6.32.46/net/core/scm.c +--- linux-2.6.32.46/net/core/scm.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/core/scm.c 2011-10-06 09:37:14.000000000 -0400 +@@ -190,7 +190,7 @@ error: + int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) + { + struct cmsghdr __user *cm +- = (__force struct cmsghdr __user *)msg->msg_control; ++ = (struct cmsghdr __force_user *)msg->msg_control; + struct cmsghdr cmhdr; + int cmlen = CMSG_LEN(len); + int err; +@@ -213,7 +213,7 @@ int put_cmsg(struct msghdr * msg, int le + err = -EFAULT; + if (copy_to_user(cm, &cmhdr, sizeof cmhdr)) + goto out; +- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) ++ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr))) + goto out; + cmlen = CMSG_SPACE(len); + if (msg->msg_controllen < cmlen) +@@ -228,7 +228,7 @@ out: + void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) + { + struct cmsghdr __user *cm +- = (__force struct cmsghdr __user*)msg->msg_control; ++ = (struct cmsghdr __force_user *)msg->msg_control; + + int fdmax = 0; + int fdnum = scm->fp->count; +@@ -248,7 +248,7 @@ void scm_detach_fds(struct msghdr *msg, + if (fdnum < fdmax) + fdmax = fdnum; + +- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax; ++ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax; + i++, cmfptr++) + { + int new_fd; diff -urNp linux-2.6.32.46/net/core/secure_seq.c linux-2.6.32.46/net/core/secure_seq.c --- linux-2.6.32.46/net/core/secure_seq.c 2011-08-16 20:37:25.000000000 -0400 +++ linux-2.6.32.46/net/core/secure_seq.c 2011-08-07 19:48:09.000000000 -0400 @@ -74235,6 +75659,36 @@ diff -urNp linux-2.6.32.46/net/ipv4/inetpeer.c linux-2.6.32.46/net/ipv4/inetpeer n->ip_id_count = secure_ip_id(daddr); n->tcp_ts_stamp = 0; +diff -urNp linux-2.6.32.46/net/ipv4/ipconfig.c linux-2.6.32.46/net/ipv4/ipconfig.c +--- linux-2.6.32.46/net/ipv4/ipconfig.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/ipv4/ipconfig.c 2011-10-06 09:37:14.000000000 -0400 +@@ -295,7 +295,7 @@ static int __init ic_devinet_ioctl(unsig + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg); ++ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg); + set_fs(oldfs); + return res; + } +@@ -306,7 +306,7 @@ static int __init ic_dev_ioctl(unsigned + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg); ++ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg); + set_fs(oldfs); + return res; + } +@@ -317,7 +317,7 @@ static int __init ic_route_ioctl(unsigne + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg); ++ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg); + set_fs(oldfs); + return res; + } diff -urNp linux-2.6.32.46/net/ipv4/ip_fragment.c linux-2.6.32.46/net/ipv4/ip_fragment.c --- linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/net/ipv4/ip_fragment.c 2011-04-17 15:56:46.000000000 -0400 @@ -74249,7 +75703,7 @@ diff -urNp linux-2.6.32.46/net/ipv4/ip_fragment.c linux-2.6.32.46/net/ipv4/ip_fr rc = qp->q.fragments && (end - start) > max; diff -urNp linux-2.6.32.46/net/ipv4/ip_sockglue.c linux-2.6.32.46/net/ipv4/ip_sockglue.c --- linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/net/ipv4/ip_sockglue.c 2011-10-06 09:37:14.000000000 -0400 @@ -1015,6 +1015,8 @@ static int do_ip_getsockopt(struct sock int val; int len; @@ -74259,6 +75713,15 @@ diff -urNp linux-2.6.32.46/net/ipv4/ip_sockglue.c linux-2.6.32.46/net/ipv4/ip_so if (level != SOL_IP) return -EOPNOTSUPP; +@@ -1173,7 +1175,7 @@ static int do_ip_getsockopt(struct sock + if (sk->sk_type != SOCK_STREAM) + return -ENOPROTOOPT; + +- msg.msg_control = optval; ++ msg.msg_control = (void __force_kernel *)optval; + msg.msg_controllen = len; + msg.msg_flags = 0; + diff -urNp linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c --- linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:00:52.000000000 -0400 +++ linux-2.6.32.46/net/ipv4/netfilter/arp_tables.c 2011-04-17 17:04:18.000000000 -0400 @@ -74712,6 +76175,18 @@ diff -urNp linux-2.6.32.46/net/ipv4/udp.c linux-2.6.32.46/net/ipv4/udp.c } int udp4_seq_show(struct seq_file *seq, void *v) +diff -urNp linux-2.6.32.46/net/ipv6/addrconf.c linux-2.6.32.46/net/ipv6/addrconf.c +--- linux-2.6.32.46/net/ipv6/addrconf.c 2011-05-10 22:12:02.000000000 -0400 ++++ linux-2.6.32.46/net/ipv6/addrconf.c 2011-10-06 09:37:14.000000000 -0400 +@@ -2053,7 +2053,7 @@ int addrconf_set_dstaddr(struct net *net + p.iph.ihl = 5; + p.iph.protocol = IPPROTO_IPV6; + p.iph.ttl = 64; +- ifr.ifr_ifru.ifru_data = (__force void __user *)&p; ++ ifr.ifr_ifru.ifru_data = (void __force_user *)&p; + + if (ops->ndo_do_ioctl) { + mm_segment_t oldfs = get_fs(); diff -urNp linux-2.6.32.46/net/ipv6/inet6_connection_sock.c linux-2.6.32.46/net/ipv6/inet6_connection_sock.c --- linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/net/ipv6/inet6_connection_sock.c 2011-05-04 17:56:28.000000000 -0400 @@ -74768,7 +76243,7 @@ diff -urNp linux-2.6.32.46/net/ipv6/ip6_tunnel.c linux-2.6.32.46/net/ipv6/ip6_tu } diff -urNp linux-2.6.32.46/net/ipv6/ipv6_sockglue.c linux-2.6.32.46/net/ipv6/ipv6_sockglue.c --- linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/net/ipv6/ipv6_sockglue.c 2011-10-06 09:37:16.000000000 -0400 @@ -130,6 +130,8 @@ static int do_ipv6_setsockopt(struct soc int val, valbool; int retv = -ENOPROTOOPT; @@ -74787,6 +76262,15 @@ diff -urNp linux-2.6.32.46/net/ipv6/ipv6_sockglue.c linux-2.6.32.46/net/ipv6/ipv if (ip6_mroute_opt(optname)) return ip6_mroute_getsockopt(sk, optname, optval, optlen); +@@ -922,7 +926,7 @@ static int do_ipv6_getsockopt(struct soc + if (sk->sk_type != SOCK_STREAM) + return -ENOPROTOOPT; + +- msg.msg_control = optval; ++ msg.msg_control = (void __force_kernel *)optval; + msg.msg_controllen = len; + msg.msg_flags = 0; + diff -urNp linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c --- linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/net/ipv6/netfilter/ip6_queue.c 2011-08-21 18:43:32.000000000 -0400 @@ -76038,6 +77522,30 @@ diff -urNp linux-2.6.32.46/net/rds/Kconfig linux-2.6.32.46/net/rds/Kconfig ---help--- The RDS (Reliable Datagram Sockets) protocol provides reliable, sequenced delivery of datagrams over Infiniband, iWARP, +diff -urNp linux-2.6.32.46/net/rds/tcp.c linux-2.6.32.46/net/rds/tcp.c +--- linux-2.6.32.46/net/rds/tcp.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/rds/tcp.c 2011-10-06 09:37:16.000000000 -0400 +@@ -57,7 +57,7 @@ void rds_tcp_nonagle(struct socket *sock + int val = 1; + + set_fs(KERNEL_DS); +- sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val, ++ sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val, + sizeof(val)); + set_fs(oldfs); + } +diff -urNp linux-2.6.32.46/net/rds/tcp_send.c linux-2.6.32.46/net/rds/tcp_send.c +--- linux-2.6.32.46/net/rds/tcp_send.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/rds/tcp_send.c 2011-10-06 09:37:16.000000000 -0400 +@@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket * + + oldfs = get_fs(); + set_fs(KERNEL_DS); +- sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val, ++ sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val, + sizeof(val)); + set_fs(oldfs); + } diff -urNp linux-2.6.32.46/net/rxrpc/af_rxrpc.c linux-2.6.32.46/net/rxrpc/af_rxrpc.c --- linux-2.6.32.46/net/rxrpc/af_rxrpc.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/net/rxrpc/af_rxrpc.c 2011-05-04 17:56:28.000000000 -0400 @@ -76386,7 +77894,7 @@ diff -urNp linux-2.6.32.46/net/sctp/socket.c linux-2.6.32.46/net/sctp/socket.c if (pp->fastreuse && sk->sk_reuse && diff -urNp linux-2.6.32.46/net/socket.c linux-2.6.32.46/net/socket.c --- linux-2.6.32.46/net/socket.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/net/socket.c 2011-05-16 21:46:57.000000000 -0400 ++++ linux-2.6.32.46/net/socket.c 2011-10-06 09:37:16.000000000 -0400 @@ -87,6 +87,7 @@ #include <linux/wireless.h> #include <linux/nsproxy.h> @@ -76559,6 +78067,15 @@ diff -urNp linux-2.6.32.46/net/socket.c linux-2.6.32.46/net/socket.c err = -EFAULT; if (MSG_CMSG_COMPAT & flags) { if (get_compat_msghdr(&msg_sys, msg_compat)) +@@ -2022,7 +2097,7 @@ SYSCALL_DEFINE3(recvmsg, int, fd, struct + * kernel msghdr to use the kernel address space) + */ + +- uaddr = (__force void __user *)msg_sys.msg_name; ++ uaddr = (void __force_user *)msg_sys.msg_name; + uaddr_len = COMPAT_NAMELEN(msg); + if (MSG_CMSG_COMPAT & flags) { + err = verify_compat_iovec(&msg_sys, iov, diff -urNp linux-2.6.32.46/net/sunrpc/sched.c linux-2.6.32.46/net/sunrpc/sched.c --- linux-2.6.32.46/net/sunrpc/sched.c 2011-08-09 18:35:30.000000000 -0400 +++ linux-2.6.32.46/net/sunrpc/sched.c 2011-08-09 18:34:01.000000000 -0400 @@ -76787,6 +78304,39 @@ diff -urNp linux-2.6.32.46/net/sysctl_net.c linux-2.6.32.46/net/sysctl_net.c int mode = (table->mode >> 6) & 7; return (mode << 6) | (mode << 3) | mode; } +diff -urNp linux-2.6.32.46/net/tipc/link.c linux-2.6.32.46/net/tipc/link.c +--- linux-2.6.32.46/net/tipc/link.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/tipc/link.c 2011-10-06 09:37:16.000000000 -0400 +@@ -1418,7 +1418,7 @@ again: + + if (!sect_rest) { + sect_rest = msg_sect[++curr_sect].iov_len; +- sect_crs = (const unchar *)msg_sect[curr_sect].iov_base; ++ sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base; + } + + if (sect_rest < fragm_rest) +@@ -1437,7 +1437,7 @@ error: + } + } else + skb_copy_to_linear_data_offset(buf, fragm_crs, +- sect_crs, sz); ++ (const void __force_kernel *)sect_crs, sz); + sect_crs += sz; + sect_rest -= sz; + fragm_crs += sz; +diff -urNp linux-2.6.32.46/net/tipc/subscr.c linux-2.6.32.46/net/tipc/subscr.c +--- linux-2.6.32.46/net/tipc/subscr.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/net/tipc/subscr.c 2011-10-06 09:37:16.000000000 -0400 +@@ -104,7 +104,7 @@ static void subscr_send_event(struct sub + { + struct iovec msg_sect; + +- msg_sect.iov_base = (void *)&sub->evt; ++ msg_sect.iov_base = (void __force_user *)&sub->evt; + msg_sect.iov_len = sizeof(struct tipc_event); + + sub->evt.event = htohl(event, sub->swap); diff -urNp linux-2.6.32.46/net/unix/af_unix.c linux-2.6.32.46/net/unix/af_unix.c --- linux-2.6.32.46/net/unix/af_unix.c 2011-05-10 22:12:02.000000000 -0400 +++ linux-2.6.32.46/net/unix/af_unix.c 2011-07-18 18:17:33.000000000 -0400 @@ -77024,7 +78574,25 @@ diff -urNp linux-2.6.32.46/samples/kobject/kset-example.c linux-2.6.32.46/sample }; diff -urNp linux-2.6.32.46/scripts/basic/fixdep.c linux-2.6.32.46/scripts/basic/fixdep.c --- linux-2.6.32.46/scripts/basic/fixdep.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/scripts/basic/fixdep.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/scripts/basic/fixdep.c 2011-10-06 09:37:14.000000000 -0400 +@@ -162,7 +162,7 @@ static void grow_config(int len) + /* + * Lookup a value in the configuration string. + */ +-static int is_defined_config(const char * name, int len) ++static int is_defined_config(const char * name, unsigned int len) + { + const char * pconfig; + const char * plast = str_config + len_config - len; +@@ -199,7 +199,7 @@ static void clear_config(void) + /* + * Record the use of a CONFIG_* word. + */ +-static void use_config(char *m, int slen) ++static void use_config(char *m, unsigned int slen) + { + char s[PATH_MAX]; + char *p; @@ -222,9 +222,9 @@ static void use_config(char *m, int slen static void parse_config_file(char *map, size_t len) @@ -77048,10 +78616,10 @@ diff -urNp linux-2.6.32.46/scripts/basic/fixdep.c linux-2.6.32.46/scripts/basic/ fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n", diff -urNp linux-2.6.32.46/scripts/gcc-plugin.sh linux-2.6.32.46/scripts/gcc-plugin.sh --- linux-2.6.32.46/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.32.46/scripts/gcc-plugin.sh 2011-08-31 18:38:41.000000000 -0400 ++++ linux-2.6.32.46/scripts/gcc-plugin.sh 2011-10-06 09:37:14.000000000 -0400 @@ -0,0 +1,2 @@ +#!/bin/sh -+echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $* -x c -shared - -o /dev/null -I`$* -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y" ++echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y" diff -urNp linux-2.6.32.46/scripts/Makefile.build linux-2.6.32.46/scripts/Makefile.build --- linux-2.6.32.46/scripts/Makefile.build 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/scripts/Makefile.build 2011-08-23 20:45:11.000000000 -0400 @@ -77098,7 +78666,7 @@ diff -urNp linux-2.6.32.46/scripts/Makefile.host linux-2.6.32.46/scripts/Makefil diff -urNp linux-2.6.32.46/scripts/mod/file2alias.c linux-2.6.32.46/scripts/mod/file2alias.c --- linux-2.6.32.46/scripts/mod/file2alias.c 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/scripts/mod/file2alias.c 2011-04-17 15:56:46.000000000 -0400 ++++ linux-2.6.32.46/scripts/mod/file2alias.c 2011-10-06 09:37:14.000000000 -0400 @@ -72,7 +72,7 @@ static void device_id_check(const char * unsigned long size, unsigned long id_size, void *symval) @@ -77117,6 +78685,15 @@ diff -urNp linux-2.6.32.46/scripts/mod/file2alias.c linux-2.6.32.46/scripts/mod/ unsigned char range_lo, unsigned char range_hi, struct module *mod) { +@@ -151,7 +151,7 @@ static void do_usb_entry_multi(struct us + { + unsigned int devlo, devhi; + unsigned char chi, clo; +- int ndigits; ++ unsigned int ndigits; + + id->match_flags = TO_NATIVE(id->match_flags); + id->idVendor = TO_NATIVE(id->idVendor); @@ -368,7 +368,7 @@ static void do_pnp_device_entry(void *sy for (i = 0; i < count; i++) { const char *id = (char *)devs[i].id; @@ -77444,8 +79021,8 @@ diff -urNp linux-2.6.32.46/security/integrity/ima/ima_queue.c linux-2.6.32.46/se return 0; diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig --- linux-2.6.32.46/security/Kconfig 2011-03-27 14:31:47.000000000 -0400 -+++ linux-2.6.32.46/security/Kconfig 2011-07-06 19:58:11.000000000 -0400 -@@ -4,6 +4,555 @@ ++++ linux-2.6.32.46/security/Kconfig 2011-10-06 09:38:20.000000000 -0400 +@@ -4,6 +4,559 @@ menu "Security options" @@ -77456,6 +79033,9 @@ diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig + config ARCH_TRACK_EXEC_LIMIT + bool + ++ config PAX_KERNEXEC_PLUGIN ++ bool ++ + config PAX_PER_CPU_PGD + bool + @@ -77764,8 +79344,9 @@ diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig + +config PAX_KERNEXEC + bool "Enforce non-executable kernel pages" -+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN ++ depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE) ++ select PAX_KERNEXEC_PLUGIN if X86_64 + help + This is the kernel land equivalent of PAGEEXEC and MPROTECT, + that is, enabling this option will make it harder to inject @@ -77831,7 +79412,7 @@ diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig + +config PAX_RANDKSTACK + bool "Randomize kernel stack base" -+ depends on PAX_ASLR && X86_TSC && X86 ++ depends on X86_TSC && X86 + help + By saying Y here the kernel will randomize every task's kernel + stack on every system call. This will not only force an attacker @@ -78001,7 +79582,7 @@ diff -urNp linux-2.6.32.46/security/Kconfig linux-2.6.32.46/security/Kconfig config KEYS bool "Enable access key retention support" help -@@ -146,7 +695,7 @@ config INTEL_TXT +@@ -146,7 +699,7 @@ config INTEL_TXT config LSM_MMAP_MIN_ADDR int "Low address space for LSM to protect from user allocation" depends on SECURITY && SECURITY_SELINUX @@ -78205,6 +79786,56 @@ diff -urNp linux-2.6.32.46/sound/aoa/codecs/onyx.h linux-2.6.32.46/sound/aoa/cod /* PCM3052 register definitions */ +diff -urNp linux-2.6.32.46/sound/core/oss/pcm_oss.c linux-2.6.32.46/sound/core/oss/pcm_oss.c +--- linux-2.6.32.46/sound/core/oss/pcm_oss.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/sound/core/oss/pcm_oss.c 2011-10-06 09:37:16.000000000 -0400 +@@ -1395,7 +1395,7 @@ static ssize_t snd_pcm_oss_write1(struct + } + } else { + tmp = snd_pcm_oss_write2(substream, +- (const char __force *)buf, ++ (const char __force_kernel *)buf, + runtime->oss.period_bytes, 0); + if (tmp <= 0) + goto err; +@@ -1483,7 +1483,7 @@ static ssize_t snd_pcm_oss_read1(struct + xfer += tmp; + runtime->oss.buffer_used -= tmp; + } else { +- tmp = snd_pcm_oss_read2(substream, (char __force *)buf, ++ tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf, + runtime->oss.period_bytes, 0); + if (tmp <= 0) + goto err; +diff -urNp linux-2.6.32.46/sound/core/pcm_compat.c linux-2.6.32.46/sound/core/pcm_compat.c +--- linux-2.6.32.46/sound/core/pcm_compat.c 2011-08-09 18:35:30.000000000 -0400 ++++ linux-2.6.32.46/sound/core/pcm_compat.c 2011-10-06 09:37:16.000000000 -0400 +@@ -30,7 +30,7 @@ static int snd_pcm_ioctl_delay_compat(st + int err; + + fs = snd_enter_user(); +- err = snd_pcm_delay(substream, &delay); ++ err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay); + snd_leave_user(fs); + if (err < 0) + return err; +diff -urNp linux-2.6.32.46/sound/core/pcm_native.c linux-2.6.32.46/sound/core/pcm_native.c +--- linux-2.6.32.46/sound/core/pcm_native.c 2011-03-27 14:31:47.000000000 -0400 ++++ linux-2.6.32.46/sound/core/pcm_native.c 2011-10-06 09:37:16.000000000 -0400 +@@ -2747,11 +2747,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_ + switch (substream->stream) { + case SNDRV_PCM_STREAM_PLAYBACK: + result = snd_pcm_playback_ioctl1(NULL, substream, cmd, +- (void __user *)arg); ++ (void __force_user *)arg); + break; + case SNDRV_PCM_STREAM_CAPTURE: + result = snd_pcm_capture_ioctl1(NULL, substream, cmd, +- (void __user *)arg); ++ (void __force_user *)arg); + break; + default: + result = -EINVAL; diff -urNp linux-2.6.32.46/sound/core/seq/seq_device.c linux-2.6.32.46/sound/core/seq/seq_device.c --- linux-2.6.32.46/sound/core/seq/seq_device.c 2011-03-27 14:31:47.000000000 -0400 +++ linux-2.6.32.46/sound/core/seq/seq_device.c 2011-08-05 20:33:55.000000000 -0400 @@ -78970,6 +80601,179 @@ diff -urNp linux-2.6.32.46/sound/usb/usbaudio.c linux-2.6.32.46/sound/usb/usbaud break; } } +diff -urNp linux-2.6.32.46/tools/gcc/checker_plugin.c linux-2.6.32.46/tools/gcc/checker_plugin.c +--- linux-2.6.32.46/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500 ++++ linux-2.6.32.46/tools/gcc/checker_plugin.c 2011-10-06 09:37:16.000000000 -0400 +@@ -0,0 +1,169 @@ ++/* ++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu> ++ * Licensed under the GPL v2 ++ * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * ++ * gcc plugin to implement various sparse (source code checker) features ++ * ++ * TODO: ++ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch) ++ * ++ * BUGS: ++ * - none known ++ */ ++#include "gcc-plugin.h" ++#include "config.h" ++#include "system.h" ++#include "coretypes.h" ++#include "tree.h" ++#include "tree-pass.h" ++#include "intl.h" ++#include "plugin-version.h" ++#include "tm.h" ++#include "toplev.h" ++#include "basic-block.h" ++#include "gimple.h" ++//#include "expr.h" where are you... ++#include "diagnostic.h" ++#include "rtl.h" ++#include "emit-rtl.h" ++#include "function.h" ++#include "tree-flow.h" ++#include "target.h" ++ ++extern void c_register_addr_space (const char *str, addr_space_t as); ++extern enum machine_mode default_addr_space_pointer_mode (addr_space_t); ++extern enum machine_mode default_addr_space_address_mode (addr_space_t); ++extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as); ++extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as); ++extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as); ++ ++extern void print_gimple_stmt(FILE *, gimple, int, int); ++extern rtx emit_move_insn(rtx x, rtx y); ++ ++int plugin_is_GPL_compatible; ++ ++static struct plugin_info checker_plugin_info = { ++ .version = "201110031940", ++}; ++ ++#define ADDR_SPACE_KERNEL 0 ++#define ADDR_SPACE_FORCE_KERNEL 1 ++#define ADDR_SPACE_USER 2 ++#define ADDR_SPACE_FORCE_USER 3 ++#define ADDR_SPACE_IOMEM 0 ++#define ADDR_SPACE_FORCE_IOMEM 0 ++#define ADDR_SPACE_PERCPU 0 ++#define ADDR_SPACE_FORCE_PERCPU 0 ++#define ADDR_SPACE_RCU 0 ++#define ADDR_SPACE_FORCE_RCU 0 ++ ++static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace) ++{ ++ return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC); ++} ++ ++static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace) ++{ ++ return default_addr_space_address_mode(ADDR_SPACE_GENERIC); ++} ++ ++static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as) ++{ ++ return default_addr_space_valid_pointer_mode(mode, as); ++} ++ ++static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as) ++{ ++ return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC); ++} ++ ++static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as) ++{ ++ return default_addr_space_legitimize_address(x, oldx, mode, as); ++} ++ ++static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset) ++{ ++ if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL) ++ return true; ++ ++ if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER) ++ return true; ++ ++ if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM) ++ return true; ++ ++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER) ++ return true; ++ ++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM) ++ return true; ++ ++ if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL) ++ return true; ++ ++ if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL) ++ return true; ++ ++ return subset == superset; ++} ++ ++static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type) ++{ ++// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type)); ++// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type)); ++ ++ return op; ++} ++ ++static void register_checker_address_spaces(void *event_data, void *data) ++{ ++ c_register_addr_space("__kernel", ADDR_SPACE_KERNEL); ++ c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL); ++ c_register_addr_space("__user", ADDR_SPACE_USER); ++ c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER); ++// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM); ++// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM); ++// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU); ++// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU); ++// c_register_addr_space("__rcu", ADDR_SPACE_RCU); ++// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU); ++ ++ targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode; ++ targetm.addr_space.address_mode = checker_addr_space_address_mode; ++ targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode; ++ targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p; ++// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address; ++ targetm.addr_space.subset_p = checker_addr_space_subset_p; ++ targetm.addr_space.convert = checker_addr_space_convert; ++} ++ ++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) ++{ ++ const char * const plugin_name = plugin_info->base_name; ++ const int argc = plugin_info->argc; ++ const struct plugin_argument * const argv = plugin_info->argv; ++ int i; ++ ++ if (!plugin_default_version_check(version, &gcc_version)) { ++ error(G_("incompatible gcc/plugin versions")); ++ return 1; ++ } ++ ++ register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info); ++ ++ for (i = 0; i < argc; ++i) ++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); ++ ++ if (TARGET_64BIT == 0) ++ return 0; ++ ++ register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL); ++ ++ return 0; ++} diff -urNp linux-2.6.32.46/tools/gcc/constify_plugin.c linux-2.6.32.46/tools/gcc/constify_plugin.c --- linux-2.6.32.46/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-2.6.32.46/tools/gcc/constify_plugin.c 2011-08-30 18:19:52.000000000 -0400 @@ -79267,10 +81071,456 @@ diff -urNp linux-2.6.32.46/tools/gcc/constify_plugin.c linux-2.6.32.46/tools/gcc + + return 0; +} +diff -urNp linux-2.6.32.46/tools/gcc/kallocstat_plugin.c linux-2.6.32.46/tools/gcc/kallocstat_plugin.c +--- linux-2.6.32.46/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500 ++++ linux-2.6.32.46/tools/gcc/kallocstat_plugin.c 2011-10-06 09:37:16.000000000 -0400 +@@ -0,0 +1,165 @@ ++/* ++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu> ++ * Licensed under the GPL v2 ++ * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * ++ * gcc plugin to find the distribution of k*alloc sizes ++ * ++ * TODO: ++ * ++ * BUGS: ++ * - none known ++ */ ++#include "gcc-plugin.h" ++#include "config.h" ++#include "system.h" ++#include "coretypes.h" ++#include "tree.h" ++#include "tree-pass.h" ++#include "intl.h" ++#include "plugin-version.h" ++#include "tm.h" ++#include "toplev.h" ++#include "basic-block.h" ++#include "gimple.h" ++//#include "expr.h" where are you... ++#include "diagnostic.h" ++#include "rtl.h" ++#include "emit-rtl.h" ++#include "function.h" ++ ++extern void print_gimple_stmt(FILE *, gimple, int, int); ++ ++int plugin_is_GPL_compatible; ++ ++static const char * const kalloc_functions[] = { ++ "__kmalloc", ++ "kmalloc", ++ "kmalloc_large", ++ "kmalloc_node", ++ "kmalloc_order", ++ "kmalloc_order_trace", ++ "kmalloc_slab", ++ "kzalloc", ++ "kzalloc_node", ++}; ++ ++static struct plugin_info kallocstat_plugin_info = { ++ .version = "201109121100", ++}; ++ ++static unsigned int execute_kallocstat(void); ++ ++static struct gimple_opt_pass kallocstat_pass = { ++ .pass = { ++ .type = GIMPLE_PASS, ++ .name = "kallocstat", ++ .gate = NULL, ++ .execute = execute_kallocstat, ++ .sub = NULL, ++ .next = NULL, ++ .static_pass_number = 0, ++ .tv_id = TV_NONE, ++ .properties_required = 0, ++ .properties_provided = 0, ++ .properties_destroyed = 0, ++ .todo_flags_start = 0, ++ .todo_flags_finish = 0 ++ } ++}; ++ ++static bool is_kalloc(const char *fnname) ++{ ++ size_t i; ++ ++ for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++) ++ if (!strcmp(fnname, kalloc_functions[i])) ++ return true; ++ return false; ++} ++ ++static unsigned int execute_kallocstat(void) ++{ ++ basic_block bb; ++ ++ // 1. loop through BBs and GIMPLE statements ++ FOR_EACH_BB(bb) { ++ gimple_stmt_iterator gsi; ++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { ++ // gimple match: ++ tree fndecl, size; ++ gimple call_stmt; ++ const char *fnname; ++ ++ // is it a call ++ call_stmt = gsi_stmt(gsi); ++ if (!is_gimple_call(call_stmt)) ++ continue; ++ fndecl = gimple_call_fndecl(call_stmt); ++ if (fndecl == NULL_TREE) ++ continue; ++ if (TREE_CODE(fndecl) != FUNCTION_DECL) ++ continue; ++ ++ // is it a call to k*alloc ++ fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl)); ++ if (!is_kalloc(fnname)) ++ continue; ++ ++ // is the size arg the result of a simple const assignment ++ size = gimple_call_arg(call_stmt, 0); ++ while (true) { ++ gimple def_stmt; ++ expanded_location xloc; ++ size_t size_val; ++ ++ if (TREE_CODE(size) != SSA_NAME) ++ break; ++ def_stmt = SSA_NAME_DEF_STMT(size); ++ if (!def_stmt || !is_gimple_assign(def_stmt)) ++ break; ++ if (gimple_num_ops(def_stmt) != 2) ++ break; ++ size = gimple_assign_rhs1(def_stmt); ++ if (!TREE_CONSTANT(size)) ++ continue; ++ xloc = expand_location(gimple_location(def_stmt)); ++ if (!xloc.file) ++ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl)); ++ size_val = TREE_INT_CST_LOW(size); ++ fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line); ++ break; ++ } ++//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO); ++//debug_tree(gimple_call_fn(call_stmt)); ++//print_node(stderr, "pax", fndecl, 4); ++ } ++ } ++ ++ return 0; ++} ++ ++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) ++{ ++ const char * const plugin_name = plugin_info->base_name; ++ struct register_pass_info kallocstat_pass_info = { ++ .pass = &kallocstat_pass.pass, ++ .reference_pass_name = "ssa", ++ .ref_pass_instance_number = 0, ++ .pos_op = PASS_POS_INSERT_AFTER ++ }; ++ ++ if (!plugin_default_version_check(version, &gcc_version)) { ++ error(G_("incompatible gcc/plugin versions")); ++ return 1; ++ } ++ ++ register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info); ++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info); ++ ++ return 0; ++} +diff -urNp linux-2.6.32.46/tools/gcc/kernexec_plugin.c linux-2.6.32.46/tools/gcc/kernexec_plugin.c +--- linux-2.6.32.46/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500 ++++ linux-2.6.32.46/tools/gcc/kernexec_plugin.c 2011-10-06 09:37:16.000000000 -0400 +@@ -0,0 +1,273 @@ ++/* ++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu> ++ * Licensed under the GPL v2 ++ * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * ++ * gcc plugin to make KERNEXEC/amd64 almost as good as it is on i386 ++ * ++ * TODO: ++ * ++ * BUGS: ++ * - none known ++ */ ++#include "gcc-plugin.h" ++#include "config.h" ++#include "system.h" ++#include "coretypes.h" ++#include "tree.h" ++#include "tree-pass.h" ++#include "intl.h" ++#include "plugin-version.h" ++#include "tm.h" ++#include "toplev.h" ++#include "basic-block.h" ++#include "gimple.h" ++//#include "expr.h" where are you... ++#include "diagnostic.h" ++#include "rtl.h" ++#include "emit-rtl.h" ++#include "function.h" ++#include "tree-flow.h" ++ ++extern void print_gimple_stmt(FILE *, gimple, int, int); ++extern rtx emit_move_insn(rtx x, rtx y); ++ ++int plugin_is_GPL_compatible; ++ ++static struct plugin_info kernexec_plugin_info = { ++ .version = "201110032145", ++}; ++ ++static unsigned int execute_kernexec_fptr(void); ++static unsigned int execute_kernexec_retaddr(void); ++static bool kernexec_cmodel_check(void); ++ ++static struct gimple_opt_pass kernexec_fptr_pass = { ++ .pass = { ++ .type = GIMPLE_PASS, ++ .name = "kernexec_fptr", ++ .gate = kernexec_cmodel_check, ++ .execute = execute_kernexec_fptr, ++ .sub = NULL, ++ .next = NULL, ++ .static_pass_number = 0, ++ .tv_id = TV_NONE, ++ .properties_required = 0, ++ .properties_provided = 0, ++ .properties_destroyed = 0, ++ .todo_flags_start = 0, ++ .todo_flags_finish = TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func | TODO_remove_unused_locals | TODO_update_ssa_no_phi ++ } ++}; ++ ++static struct rtl_opt_pass kernexec_retaddr_pass = { ++ .pass = { ++ .type = RTL_PASS, ++ .name = "kernexec_retaddr", ++ .gate = kernexec_cmodel_check, ++ .execute = execute_kernexec_retaddr, ++ .sub = NULL, ++ .next = NULL, ++ .static_pass_number = 0, ++ .tv_id = TV_NONE, ++ .properties_required = 0, ++ .properties_provided = 0, ++ .properties_destroyed = 0, ++ .todo_flags_start = 0, ++ .todo_flags_finish = TODO_dump_func | TODO_ggc_collect ++ } ++}; ++ ++static bool kernexec_cmodel_check(void) ++{ ++ tree section; ++ ++ if (ix86_cmodel != CM_KERNEL) ++ return false; ++ ++ section = lookup_attribute("__section__", DECL_ATTRIBUTES(current_function_decl)); ++ if (!section || !TREE_VALUE(section)) ++ return true; ++ ++ section = TREE_VALUE(TREE_VALUE(section)); ++ if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10)) ++ return true; ++ ++ return false; ++} ++ ++/* ++ * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce ++ * a non-canonical address from a userland ptr and will just trigger a GPF on dereference ++ */ ++static void kernexec_instrument_fptr(gimple_stmt_iterator gsi) ++{ ++ gimple assign_intptr, assign_new_fptr, call_stmt; ++ tree intptr, old_fptr, new_fptr, kernexec_mask; ++ ++ call_stmt = gsi_stmt(gsi); ++ old_fptr = gimple_call_fn(call_stmt); ++ ++ // create temporary unsigned long variable used for bitops and cast fptr to it ++ intptr = create_tmp_var(long_unsigned_type_node, NULL); ++ add_referenced_var(intptr); ++ mark_sym_for_renaming(intptr); ++ assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr)); ++ update_stmt(assign_intptr); ++ gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT); ++ ++ // apply logical or to temporary unsigned long and bitmask ++ kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL); ++// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL); ++ assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask)); ++ update_stmt(assign_intptr); ++ gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT); ++ ++ // cast temporary unsigned long back to a temporary fptr variable ++ new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL); ++ add_referenced_var(new_fptr); ++ mark_sym_for_renaming(new_fptr); ++ assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr)); ++ update_stmt(assign_new_fptr); ++ gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT); ++ ++ // replace call stmt fn with the new fptr ++ gimple_call_set_fn(call_stmt, new_fptr); ++ update_stmt(call_stmt); ++} ++ ++/* ++ * find all C level function pointer dereferences and forcibly set the highest bit of the pointer ++ */ ++static unsigned int execute_kernexec_fptr(void) ++{ ++ basic_block bb; ++ gimple_stmt_iterator gsi; ++ ++ // 1. loop through BBs and GIMPLE statements ++ FOR_EACH_BB(bb) { ++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { ++ // gimple match: h_1 = get_fptr (); D.2709_3 = h_1 (x_2(D)); ++ tree fn; ++ gimple call_stmt; ++ ++ // is it a call ... ++ call_stmt = gsi_stmt(gsi); ++ if (!is_gimple_call(call_stmt)) ++ continue; ++ fn = gimple_call_fn(call_stmt); ++ if (TREE_CODE(fn) == ADDR_EXPR) ++ continue; ++ if (TREE_CODE(fn) != SSA_NAME) ++ gcc_unreachable(); ++ ++ // ... through a function pointer ++ fn = SSA_NAME_VAR(fn); ++ if (TREE_CODE(fn) != VAR_DECL && TREE_CODE(fn) != PARM_DECL) ++ continue; ++ fn = TREE_TYPE(fn); ++ if (TREE_CODE(fn) != POINTER_TYPE) ++ continue; ++ fn = TREE_TYPE(fn); ++ if (TREE_CODE(fn) != FUNCTION_TYPE) ++ continue; ++ ++ kernexec_instrument_fptr(gsi); ++ ++//debug_tree(gimple_call_fn(call_stmt)); ++//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO); ++ } ++ } ++ ++ return 0; ++} ++ ++// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn ++static void kernexec_instrument_retaddr(rtx insn) ++{ ++ rtx btsq; ++ rtvec argvec, constraintvec, labelvec; ++ int line; ++ ++ // create asm volatile("btsq $63,(%%rsp)":::) ++ argvec = rtvec_alloc(0); ++ constraintvec = rtvec_alloc(0); ++ labelvec = rtvec_alloc(0); ++ line = expand_location(RTL_LOCATION(insn)).line; ++ btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line); ++ MEM_VOLATILE_P(btsq) = 1; ++ RTX_FRAME_RELATED_P(btsq) = 1; ++ emit_insn_before(btsq, insn); ++} ++ ++/* ++ * find all asm level function returns and forcibly set the highest bit of the return address ++ */ ++static unsigned int execute_kernexec_retaddr(void) ++{ ++ rtx insn; ++ ++ // 1. find function returns ++ for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) { ++ // rtl match: (jump_insn 41 40 42 2 (return) fptr.c:42 634 {return_internal} (nil)) ++ // (jump_insn 12 9 11 2 (parallel [ (return) (unspec [ (0) ] UNSPEC_REP) ]) fptr.c:46 635 {return_internal_long} (nil)) ++ rtx body; ++ ++ // is it a retn ++ if (!JUMP_P(insn)) ++ continue; ++ body = PATTERN(insn); ++ if (GET_CODE(body) == PARALLEL) ++ body = XVECEXP(body, 0, 0); ++ if (GET_CODE(body) != RETURN) ++ continue; ++ kernexec_instrument_retaddr(insn); ++ } ++ ++// print_simple_rtl(stderr, get_insns()); ++// print_rtl(stderr, get_insns()); ++ ++ return 0; ++} ++ ++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) ++{ ++ const char * const plugin_name = plugin_info->base_name; ++ const int argc = plugin_info->argc; ++ const struct plugin_argument * const argv = plugin_info->argv; ++ int i; ++ struct register_pass_info kernexec_fptr_pass_info = { ++ .pass = &kernexec_fptr_pass.pass, ++ .reference_pass_name = "ssa", ++ .ref_pass_instance_number = 0, ++ .pos_op = PASS_POS_INSERT_AFTER ++ }; ++ struct register_pass_info kernexec_retaddr_pass_info = { ++ .pass = &kernexec_retaddr_pass.pass, ++ .reference_pass_name = "pro_and_epilogue", ++ .ref_pass_instance_number = 0, ++ .pos_op = PASS_POS_INSERT_AFTER ++ }; ++ ++ if (!plugin_default_version_check(version, &gcc_version)) { ++ error(G_("incompatible gcc/plugin versions")); ++ return 1; ++ } ++ ++ register_callback(plugin_name, PLUGIN_INFO, NULL, &kernexec_plugin_info); ++ ++ for (i = 0; i < argc; ++i) ++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); ++ ++ if (TARGET_64BIT == 0) ++ return 0; ++ ++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info); ++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_retaddr_pass_info); ++ ++ return 0; ++} diff -urNp linux-2.6.32.46/tools/gcc/Makefile linux-2.6.32.46/tools/gcc/Makefile --- linux-2.6.32.46/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.32.46/tools/gcc/Makefile 2011-08-05 20:33:55.000000000 -0400 -@@ -0,0 +1,12 @@ ++++ linux-2.6.32.46/tools/gcc/Makefile 2011-10-06 09:37:14.000000000 -0400 +@@ -0,0 +1,21 @@ +#CC := gcc +#PLUGIN_SOURCE_FILES := pax_plugin.c +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES)) @@ -79279,14 +81529,23 @@ diff -urNp linux-2.6.32.46/tools/gcc/Makefile linux-2.6.32.46/tools/gcc/Makefile + +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include + -+hostlibs-y := stackleak_plugin.so constify_plugin.so ++hostlibs-y := constify_plugin.so ++hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so ++hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so ++hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so ++hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so ++ +always := $(hostlibs-y) ++ +stackleak_plugin-objs := stackleak_plugin.o +constify_plugin-objs := constify_plugin.o ++kallocstat_plugin-objs := kallocstat_plugin.o ++kernexec_plugin-objs := kernexec_plugin.o ++checker_plugin-objs := checker_plugin.o diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gcc/stackleak_plugin.c --- linux-2.6.32.46/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-2.6.32.46/tools/gcc/stackleak_plugin.c 2011-08-23 20:24:26.000000000 -0400 -@@ -0,0 +1,243 @@ ++++ linux-2.6.32.46/tools/gcc/stackleak_plugin.c 2011-10-06 09:37:14.000000000 -0400 +@@ -0,0 +1,251 @@ +/* + * Copyright 2011 by the PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -79304,7 +81563,7 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + * - initialize all local variables + * + * BUGS: -+ * - cloned functions are instrumented twice ++ * - none known + */ +#include "gcc-plugin.h" +#include "config.h" @@ -79331,7 +81590,7 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc +static bool init_locals; + +static struct plugin_info stackleak_plugin_info = { -+ .version = "201106030000", ++ .version = "201109112100", + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n" +// "initialize-locals\t\tforcibly initialize all stack frames\n" +}; @@ -79354,7 +81613,7 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + .properties_provided = 0, + .properties_destroyed = 0, + .todo_flags_start = 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts, -+ .todo_flags_finish = TODO_verify_stmts // | TODO_dump_func ++ .todo_flags_finish = TODO_verify_stmts | TODO_dump_func + } +}; + @@ -79372,7 +81631,7 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + .properties_provided = 0, + .properties_destroyed = 0, + .todo_flags_start = 0, -+ .todo_flags_finish = 0 ++ .todo_flags_finish = TODO_dump_func + } +}; + @@ -79384,13 +81643,13 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before) +{ + gimple call; -+ tree decl, type; ++ tree fndecl, type; + + // insert call to void pax_track_stack(void) + type = build_function_type_list(void_type_node, NULL_TREE); -+ decl = build_fn_decl(track_function, type); -+ DECL_ASSEMBLER_NAME(decl); // for LTO -+ call = gimple_build_call(decl, 0); ++ fndecl = build_fn_decl(track_function, type); ++ DECL_ASSEMBLER_NAME(fndecl); // for LTO ++ call = gimple_build_call(fndecl, 0); + if (before) + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING); + else @@ -79399,40 +81658,46 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + +static unsigned int execute_stackleak_tree_instrument(void) +{ -+ basic_block bb; ++ basic_block bb, entry_bb; + gimple_stmt_iterator gsi; ++ bool prologue_instrumented = false; ++ ++ entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb; + + // 1. loop through BBs and GIMPLE statements + FOR_EACH_BB(bb) { + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450> -+ tree decl; ++ tree fndecl; + gimple stmt = gsi_stmt(gsi); + + if (!is_gimple_call(stmt)) + continue; -+ decl = gimple_call_fndecl(stmt); -+ if (!decl) ++ fndecl = gimple_call_fndecl(stmt); ++ if (!fndecl) + continue; -+ if (TREE_CODE(decl) != FUNCTION_DECL) ++ if (TREE_CODE(fndecl) != FUNCTION_DECL) + continue; -+ if (!DECL_BUILT_IN(decl)) ++ if (!DECL_BUILT_IN(fndecl)) + continue; -+ if (DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL) ++ if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL) + continue; -+ if (DECL_FUNCTION_CODE(decl) != BUILT_IN_ALLOCA) ++ if (DECL_FUNCTION_CODE(fndecl) != BUILT_IN_ALLOCA) + continue; + + // 2. insert track call after each __builtin_alloca call + stackleak_add_instrumentation(&gsi, false); -+// print_node(stderr, "pax", decl, 4); ++ if (bb == entry_bb) ++ prologue_instrumented = true; ++// print_node(stderr, "pax", fndecl, 4); + } + } + + // 3. insert track call at the beginning -+ bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb; -+ gsi = gsi_start_bb(bb); -+ stackleak_add_instrumentation(&gsi, true); ++ if (!prologue_instrumented) { ++ gsi = gsi_start_bb(entry_bb); ++ stackleak_add_instrumentation(&gsi, true); ++ } + + return 0; +} @@ -79444,6 +81709,10 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + if (cfun->calls_alloca) + return 0; + ++ // keep calls only if function frame is big enough ++ if (get_frame_size() >= track_frame_size) ++ return 0; ++ + // 1. find pax_track_stack calls + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) { + // rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil)) @@ -79463,9 +81732,7 @@ diff -urNp linux-2.6.32.46/tools/gcc/stackleak_plugin.c linux-2.6.32.46/tools/gc + if (strcmp(XSTR(body, 0), track_function)) + continue; +// warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size); -+ // 2. delete call if function frame is not big enough -+ if (get_frame_size() >= track_frame_size) -+ continue; ++ // 2. delete call + delete_insn_and_edges(insn); + } + diff --git a/2.6.32/4425_grsec-pax-without-grsec.patch b/2.6.32/4425_grsec-pax-without-grsec.patch index cc3b6ca..96b85a3 100644 --- a/2.6.32/4425_grsec-pax-without-grsec.patch +++ b/2.6.32/4425_grsec-pax-without-grsec.patch @@ -77,7 +77,7 @@ diff -Naur linux-2.6.32-hardened-r44.orig/fs/exec.c linux-2.6.32-hardened-r44/fs diff -Naur linux-2.6.32-hardened-r44.orig/security/Kconfig linux-2.6.32-hardened-r44/security/Kconfig --- linux-2.6.32-hardened-r44.orig/security/Kconfig 2011-04-17 18:15:55.000000000 -0400 +++ linux-2.6.32-hardened-r44/security/Kconfig 2011-04-17 18:28:11.000000000 -0400 -@@ -26,7 +26,7 @@ +@@ -29,7 +29,7 @@ config PAX bool "Enable various PaX features" diff --git a/2.6.32/4435_grsec-kconfig-gentoo.patch b/2.6.32/4435_grsec-kconfig-gentoo.patch index a2b16d6..0bb8941 100644 --- a/2.6.32/4435_grsec-kconfig-gentoo.patch +++ b/2.6.32/4435_grsec-kconfig-gentoo.patch @@ -15,9 +15,9 @@ and conflicts with some software and thus would be less suitable. The original version of this patch was conceived and created by: Ned Ludd <solar@gentoo.org> -diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-hardened-r44/grsecurity/Kconfig ---- linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig 2011-04-17 18:41:22.000000000 -0400 -+++ linux-2.6.32-hardened-r44/grsecurity/Kconfig 2011-04-17 18:42:14.000000000 -0400 +diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig +--- a/grsecurity/Kconfig 2011-04-17 18:41:22.000000000 -0400 ++++ b/grsecurity/Kconfig 2011-04-17 18:42:14.000000000 -0400 @@ -18,7 +18,7 @@ choice prompt "Security Level" @@ -286,21 +286,22 @@ diff -Naur linux-2.6.32-hardened-r44.orig/grsecurity/Kconfig linux-2.6.32-harden config GRKERNSEC_CUSTOM bool "Custom" help -diff -Naur linux-2.6.32-hardened-r44.orig/security/Kconfig linux-2.6.32-hardened-r44/security/Kconfig ---- linux-2.6.32-hardened-r44.orig/security/Kconfig 2011-04-17 18:36:55.000000000 -0400 -+++ linux-2.6.32-hardened-r44/security/Kconfig 2011-04-17 18:42:14.000000000 -0400 -@@ -319,8 +319,9 @@ +diff -Naur a/security/Kconfig b/security/Kconfig +--- a/security/Kconfig 2011-04-17 18:36:55.000000000 -0400 ++++ b/security/Kconfig 2011-04-17 18:42:14.000000000 -0400 +@@ -322,9 +322,10 @@ config PAX_KERNEXEC bool "Enforce non-executable kernel pages" -- depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN -+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION +- depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN ++ depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE) + select PAX_KERNEXEC_PLUGIN if X86_64 + default y if GRKERNSEC_HARDENED_WORKSTATION help This is the kernel land equivalent of PAGEEXEC and MPROTECT, that is, enabling this option will make it harder to inject -@@ -483,8 +484,9 @@ +@@ -487,8 +488,9 @@ config PAX_MEMORY_UDEREF bool "Prevent invalid userland pointer dereference" diff --git a/3.0.4/0000_README b/3.0.4/0000_README index 5afed8c..ccc36e4 100644 --- a/3.0.4/0000_README +++ b/3.0.4/0000_README @@ -3,7 +3,7 @@ README Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.2.2-3.0.4-201109261052.patch +Patch: 4420_grsecurity-2.2.2-3.0.4-201110060421.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109261052.patch b/3.0.4/4420_grsecurity-2.2.2-3.0.4-201110060421.patch index cce98cf..51e088f 100644 --- a/3.0.4/4420_grsecurity-2.2.2-3.0.4-201109261052.patch +++ b/3.0.4/4420_grsecurity-2.2.2-3.0.4-201110060421.patch @@ -5591,71 +5591,80 @@ diff -urNp linux-3.0.4/arch/x86/boot/video-vesa.c linux-3.0.4/arch/x86/boot/vide /* diff -urNp linux-3.0.4/arch/x86/crypto/aes-x86_64-asm_64.S linux-3.0.4/arch/x86/crypto/aes-x86_64-asm_64.S --- linux-3.0.4/arch/x86/crypto/aes-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/crypto/aes-x86_64-asm_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -71,6 +71,12 @@ FUNC: movq r1,r2; \ ++++ linux-3.0.4/arch/x86/crypto/aes-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -8,6 +8,8 @@ + * including this sentence is retained in full. + */ + ++#include <asm/alternative-asm.h> ++ + .extern crypto_ft_tab + .extern crypto_it_tab + .extern crypto_fl_tab +@@ -71,6 +73,8 @@ FUNC: movq r1,r2; \ je B192; \ leaq 32(r9),r9; -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+#define ret orb $0x80, 0x7(%rsp); ret -+#else -+#define ret ret -+#endif ++#define ret pax_force_retaddr; ret + #define epilogue(r1,r2,r3,r4,r5,r6,r7,r8,r9) \ movq r1,r2; \ movq r3,r4; \ diff -urNp linux-3.0.4/arch/x86/crypto/salsa20-x86_64-asm_64.S linux-3.0.4/arch/x86/crypto/salsa20-x86_64-asm_64.S --- linux-3.0.4/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -790,6 +790,9 @@ ECRYPT_encrypt_bytes: ++++ linux-3.0.4/arch/x86/crypto/salsa20-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -1,3 +1,5 @@ ++#include <asm/alternative-asm.h> ++ + # enter ECRYPT_encrypt_bytes + .text + .p2align 5 +@@ -790,6 +792,7 @@ ECRYPT_encrypt_bytes: add %r11,%rsp mov %rdi,%rax mov %rsi,%rdx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret # bytesatleast65: ._bytesatleast65: -@@ -891,6 +894,9 @@ ECRYPT_keysetup: +@@ -891,6 +894,7 @@ ECRYPT_keysetup: add %r11,%rsp mov %rdi,%rax mov %rsi,%rdx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret # enter ECRYPT_ivsetup .text -@@ -917,4 +923,7 @@ ECRYPT_ivsetup: +@@ -917,4 +921,5 @@ ECRYPT_ivsetup: add %r11,%rsp mov %rdi,%rax mov %rsi,%rdx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret diff -urNp linux-3.0.4/arch/x86/crypto/twofish-x86_64-asm_64.S linux-3.0.4/arch/x86/crypto/twofish-x86_64-asm_64.S --- linux-3.0.4/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -269,6 +269,9 @@ twofish_enc_blk: ++++ linux-3.0.4/arch/x86/crypto/twofish-x86_64-asm_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -21,6 +21,7 @@ + .text + + #include <asm/asm-offsets.h> ++#include <asm/alternative-asm.h> + + #define a_offset 0 + #define b_offset 4 +@@ -269,6 +270,7 @@ twofish_enc_blk: popq R1 movq $1,%rax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret twofish_dec_blk: -@@ -321,4 +324,7 @@ twofish_dec_blk: +@@ -321,4 +323,5 @@ twofish_dec_blk: popq R1 movq $1,%rax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret diff -urNp linux-3.0.4/arch/x86/ia32/ia32_aout.c linux-3.0.4/arch/x86/ia32/ia32_aout.c --- linux-3.0.4/arch/x86/ia32/ia32_aout.c 2011-07-21 22:17:23.000000000 -0400 @@ -5850,7 +5859,34 @@ diff -urNp linux-3.0.4/arch/x86/ia32/ia32entry.S linux-3.0.4/arch/x86/ia32/ia32e cmpq $(IA32_NR_syscalls-1),%rax diff -urNp linux-3.0.4/arch/x86/ia32/ia32_signal.c linux-3.0.4/arch/x86/ia32/ia32_signal.c --- linux-3.0.4/arch/x86/ia32/ia32_signal.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/ia32/ia32_signal.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/ia32/ia32_signal.c 2011-10-06 04:17:55.000000000 -0400 +@@ -167,7 +167,7 @@ asmlinkage long sys32_sigaltstack(const + } + seg = get_fs(); + set_fs(KERNEL_DS); +- ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp); ++ ret = do_sigaltstack(uss_ptr ? (const stack_t __force_user *)&uss : NULL, (stack_t __force_user *)&uoss, regs->sp); + set_fs(seg); + if (ret >= 0 && uoss_ptr) { + if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t))) +@@ -374,7 +374,7 @@ static int ia32_setup_sigcontext(struct + */ + static void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, + size_t frame_size, +- void **fpstate) ++ void __user **fpstate) + { + unsigned long sp; + +@@ -395,7 +395,7 @@ static void __user *get_sigframe(struct + + if (used_math()) { + sp = sp - sig_xstate_ia32_size; +- *fpstate = (struct _fpstate_ia32 *) sp; ++ *fpstate = (struct _fpstate_ia32 __user *) sp; + if (save_i387_xstate_ia32(*fpstate) < 0) + return (void __user *) -1L; + } @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct sp -= frame_size; /* Align the stack pointer according to the i386 ABI, @@ -5865,7 +5901,7 @@ diff -urNp linux-3.0.4/arch/x86/ia32/ia32_signal.c linux-3.0.4/arch/x86/ia32/ia3 * gdb versions depend on them as a marker. */ - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); -+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); ++ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode); } put_user_catch(err); if (err) @@ -5896,10 +5932,99 @@ diff -urNp linux-3.0.4/arch/x86/ia32/ia32_signal.c linux-3.0.4/arch/x86/ia32/ia3 * versions need it. */ - put_user_ex(*((u64 *)&code), (u64 *)frame->retcode); -+ put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode); ++ put_user_ex(*((const u64 *)&code), (u64 __user *)frame->retcode); } put_user_catch(err); if (err) +diff -urNp linux-3.0.4/arch/x86/ia32/sys_ia32.c linux-3.0.4/arch/x86/ia32/sys_ia32.c +--- linux-3.0.4/arch/x86/ia32/sys_ia32.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/arch/x86/ia32/sys_ia32.c 2011-10-06 04:17:55.000000000 -0400 +@@ -69,8 +69,8 @@ asmlinkage long sys32_ftruncate64(unsign + */ + static int cp_stat64(struct stat64 __user *ubuf, struct kstat *stat) + { +- typeof(ubuf->st_uid) uid = 0; +- typeof(ubuf->st_gid) gid = 0; ++ typeof(((struct stat64 *)0)->st_uid) uid = 0; ++ typeof(((struct stat64 *)0)->st_gid) gid = 0; + SET_UID(uid, stat->uid); + SET_GID(gid, stat->gid); + if (!access_ok(VERIFY_WRITE, ubuf, sizeof(struct stat64)) || +@@ -308,8 +308,8 @@ asmlinkage long sys32_rt_sigprocmask(int + } + set_fs(KERNEL_DS); + ret = sys_rt_sigprocmask(how, +- set ? (sigset_t __user *)&s : NULL, +- oset ? (sigset_t __user *)&s : NULL, ++ set ? (sigset_t __force_user *)&s : NULL, ++ oset ? (sigset_t __force_user *)&s : NULL, + sigsetsize); + set_fs(old_fs); + if (ret) +@@ -332,7 +332,7 @@ asmlinkage long sys32_alarm(unsigned int + return alarm_setitimer(seconds); + } + +-asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int *stat_addr, ++asmlinkage long sys32_waitpid(compat_pid_t pid, unsigned int __user *stat_addr, + int options) + { + return compat_sys_wait4(pid, stat_addr, options, NULL); +@@ -353,7 +353,7 @@ asmlinkage long sys32_sched_rr_get_inter + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_sched_rr_get_interval(pid, (struct timespec __user *)&t); ++ ret = sys_sched_rr_get_interval(pid, (struct timespec __force_user *)&t); + set_fs(old_fs); + if (put_compat_timespec(&t, interval)) + return -EFAULT; +@@ -369,7 +369,7 @@ asmlinkage long sys32_rt_sigpending(comp + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_rt_sigpending((sigset_t __user *)&s, sigsetsize); ++ ret = sys_rt_sigpending((sigset_t __force_user *)&s, sigsetsize); + set_fs(old_fs); + if (!ret) { + switch (_NSIG_WORDS) { +@@ -394,7 +394,7 @@ asmlinkage long sys32_rt_sigqueueinfo(in + if (copy_siginfo_from_user32(&info, uinfo)) + return -EFAULT; + set_fs(KERNEL_DS); +- ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __user *)&info); ++ ret = sys_rt_sigqueueinfo(pid, sig, (siginfo_t __force_user *)&info); + set_fs(old_fs); + return ret; + } +@@ -439,7 +439,7 @@ asmlinkage long sys32_sendfile(int out_f + return -EFAULT; + + set_fs(KERNEL_DS); +- ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __user *)&of : NULL, ++ ret = sys_sendfile(out_fd, in_fd, offset ? (off_t __force_user *)&of : NULL, + count); + set_fs(old_fs); + +diff -urNp linux-3.0.4/arch/x86/include/asm/alternative-asm.h linux-3.0.4/arch/x86/include/asm/alternative-asm.h +--- linux-3.0.4/arch/x86/include/asm/alternative-asm.h 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/alternative-asm.h 2011-10-06 04:17:55.000000000 -0400 +@@ -15,6 +15,15 @@ + .endm + #endif + ++#ifdef CONFIG_PAX_KERNEXEC_PLUGIN ++ .macro pax_force_retaddr rip=0 ++ btsq $63,\rip(%rsp) ++ .endm ++#else ++ .macro pax_force_retaddr rip=0 ++ .endm ++#endif ++ + .macro altinstruction_entry orig alt feature orig_len alt_len + .align 8 + .quad \orig diff -urNp linux-3.0.4/arch/x86/include/asm/alternative.h linux-3.0.4/arch/x86/include/asm/alternative.h --- linux-3.0.4/arch/x86/include/asm/alternative.h 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/arch/x86/include/asm/alternative.h 2011-08-23 21:47:55.000000000 -0400 @@ -7226,12 +7351,12 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/emergency-restart.h linux-3.0.4/arch #endif /* _ASM_X86_EMERGENCY_RESTART_H */ diff -urNp linux-3.0.4/arch/x86/include/asm/futex.h linux-3.0.4/arch/x86/include/asm/futex.h --- linux-3.0.4/arch/x86/include/asm/futex.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/futex.h 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/futex.h 2011-10-06 04:17:55.000000000 -0400 @@ -12,16 +12,18 @@ #include <asm/system.h> #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg) \ -+ typecheck(u32 *, uaddr); \ ++ typecheck(u32 __user *, uaddr); \ asm volatile("1:\t" insn "\n" \ "2:\t.section .fixup,\"ax\"\n" \ "3:\tmov\t%3, %1\n" \ @@ -7239,11 +7364,11 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/futex.h linux-3.0.4/arch/x86/include "\t.previous\n" \ _ASM_EXTABLE(1b, 3b) \ - : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \ -+ : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\ ++ : "=r" (oldval), "=r" (ret), "+m" (*(u32 __user *)____m(uaddr))\ : "i" (-EFAULT), "0" (oparg), "1" (0)) #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg) \ -+ typecheck(u32 *, uaddr); \ ++ typecheck(u32 __user *, uaddr); \ asm volatile("1:\tmovl %2, %0\n" \ "\tmovl\t%0, %3\n" \ "\t" insn "\n" \ @@ -7252,7 +7377,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/futex.h linux-3.0.4/arch/x86/include _ASM_EXTABLE(2b, 4b) \ : "=&a" (oldval), "=&r" (ret), \ - "+m" (*uaddr), "=&r" (tem) \ -+ "+m" (*(u32 *)____m(uaddr)), "=&r" (tem) \ ++ "+m" (*(u32 __user *)____m(uaddr)), "=&r" (tem) \ : "r" (oparg), "i" (-EFAULT), "1" (0)) static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr) @@ -7281,7 +7406,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/futex.h linux-3.0.4/arch/x86/include "\t.previous\n" _ASM_EXTABLE(1b, 3b) - : "+r" (ret), "=a" (oldval), "+m" (*uaddr) -+ : "+r" (ret), "=a" (oldval), "+m" (*(u32 *)____m(uaddr)) ++ : "+r" (ret), "=a" (oldval), "+m" (*(u32 __user *)____m(uaddr)) : "i" (-EFAULT), "r" (newval), "1" (oldval) : "memory" ); @@ -7301,14 +7426,14 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/hw_irq.h linux-3.0.4/arch/x86/includ extern void eisa_set_level_irq(unsigned int irq); diff -urNp linux-3.0.4/arch/x86/include/asm/i387.h linux-3.0.4/arch/x86/include/asm/i387.h --- linux-3.0.4/arch/x86/include/asm/i387.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/i387.h 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/i387.h 2011-10-06 04:17:55.000000000 -0400 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc { int err; +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF) + if ((unsigned long)fx < PAX_USER_SHADOW_BASE) -+ fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE); ++ fx = (struct i387_fxsave_struct __user *)((void *)fx + PAX_USER_SHADOW_BASE); +#endif + /* See comment in fxsave() below. */ @@ -7758,7 +7883,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/mmu.h linux-3.0.4/arch/x86/include/a #ifdef CONFIG_SMP diff -urNp linux-3.0.4/arch/x86/include/asm/module.h linux-3.0.4/arch/x86/include/asm/module.h --- linux-3.0.4/arch/x86/include/asm/module.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/module.h 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/module.h 2011-10-06 04:21:18.000000000 -0400 @@ -5,6 +5,7 @@ #ifdef CONFIG_X86_64 @@ -7767,7 +7892,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/module.h linux-3.0.4/arch/x86/includ #elif defined CONFIG_M386 #define MODULE_PROC_FAMILY "386 " #elif defined CONFIG_M486 -@@ -59,8 +60,30 @@ +@@ -59,8 +60,36 @@ #error unknown processor family #endif @@ -7783,12 +7908,18 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/module.h linux-3.0.4/arch/x86/includ +#define MODULE_PAX_KERNEXEC "KERNEXEC " +#else +#define MODULE_PAX_KERNEXEC "" - #endif - ++#endif ++ +#ifdef CONFIG_PAX_REFCOUNT +#define MODULE_PAX_REFCOUNT "REFCOUNT " +#else +#define MODULE_PAX_REFCOUNT "" + #endif + ++#ifdef CONSTIFY_PLUGIN ++#define MODULE_CONSTIFY_PLUGIN "CONSTIFY_PLUGIN " ++#else ++#define MODULE_CONSTIFY_PLUGIN "" +#endif + +#ifdef CONFIG_GRKERNSEC @@ -7797,7 +7928,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/module.h linux-3.0.4/arch/x86/includ +#define MODULE_GRSEC "" +#endif + -+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT ++#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT MODULE_CONSTIFY_PLUGIN + #endif /* _ASM_X86_MODULE_H */ diff -urNp linux-3.0.4/arch/x86/include/asm/page_64_types.h linux-3.0.4/arch/x86/include/asm/page_64_types.h @@ -8988,6 +9119,18 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/stacktrace.h linux-3.0.4/arch/x86/in }; void dump_trace(struct task_struct *tsk, struct pt_regs *regs, +diff -urNp linux-3.0.4/arch/x86/include/asm/sys_ia32.h linux-3.0.4/arch/x86/include/asm/sys_ia32.h +--- linux-3.0.4/arch/x86/include/asm/sys_ia32.h 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/sys_ia32.h 2011-10-06 04:17:55.000000000 -0400 +@@ -40,7 +40,7 @@ asmlinkage long sys32_rt_sigprocmask(int + compat_sigset_t __user *, unsigned int); + asmlinkage long sys32_alarm(unsigned int); + +-asmlinkage long sys32_waitpid(compat_pid_t, unsigned int *, int); ++asmlinkage long sys32_waitpid(compat_pid_t, unsigned int __user *, int); + asmlinkage long sys32_sysfs(int, u32, u32); + + asmlinkage long sys32_sched_rr_get_interval(compat_pid_t, diff -urNp linux-3.0.4/arch/x86/include/asm/system.h linux-3.0.4/arch/x86/include/asm/system.h --- linux-3.0.4/arch/x86/include/asm/system.h 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/arch/x86/include/asm/system.h 2011-08-23 21:47:55.000000000 -0400 @@ -9355,7 +9498,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_32.h linux-3.0.4/arch/x86/in diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/include/asm/uaccess_64.h --- linux-3.0.4/arch/x86/include/asm/uaccess_64.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/uaccess_64.h 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/uaccess_64.h 2011-10-06 04:17:55.000000000 -0400 @@ -10,6 +10,9 @@ #include <asm/alternative.h> #include <asm/cpufeature.h> @@ -9453,7 +9596,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + src += PAX_USER_SHADOW_BASE; +#endif + -+ return copy_user_generic(dst, (__force const void *)src, size); ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); + } switch (size) { - case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src, @@ -9502,7 +9645,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + src += PAX_USER_SHADOW_BASE; +#endif + -+ return copy_user_generic(dst, (__force const void *)src, size); ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); } } @@ -9516,6 +9659,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in might_fault(); - if (!__builtin_constant_p(size)) +- return copy_user_generic((__force void *)dst, src, size); + + pax_track_stack(); + @@ -9542,7 +9686,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); ++ return copy_user_generic((__force_kernel void *)dst, src, size); + } switch (size) { - case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst, @@ -9584,13 +9728,14 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in ret, "q", "", "er", 8); return ret; default: +- return copy_user_generic((__force void *)dst, src, size); + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); ++ return copy_user_generic((__force_kernel void *)dst, src, size); } } @@ -9603,6 +9748,8 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in might_fault(); - if (!__builtin_constant_p(size)) +- return copy_user_generic((__force void *)dst, +- (__force void *)src, size); + + if ((int)size < 0) + return size; @@ -9623,9 +9770,8 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, -- (__force void *)src, size); -+ (__force const void *)src, size); ++ return copy_user_generic((__force_kernel void *)dst, ++ (__force_kernel const void *)src, size); + } switch (size) { case 1: { @@ -9666,6 +9812,8 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in return ret; } default: +- return copy_user_generic((__force void *)dst, +- (__force void *)src, size); + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)src < PAX_USER_SHADOW_BASE) @@ -9674,9 +9822,8 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, -- (__force void *)src, size); -+ (__force const void *)src, size); ++ return copy_user_generic((__force_kernel void *)dst, ++ (__force_kernel const void *)src, size); } } @@ -9684,6 +9831,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in static __must_check __always_inline int __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size) { +- return copy_user_generic(dst, (__force const void *)src, size); + pax_track_stack(); + + if ((int)size < 0) @@ -9697,13 +9845,14 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + src += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic(dst, (__force const void *)src, size); ++ return copy_user_generic(dst, (__force_kernel const void *)src, size); } -static __must_check __always_inline int +static __must_check __always_inline unsigned long __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size) { +- return copy_user_generic((__force void *)dst, src, size); + if ((int)size < 0) + return size; + @@ -9715,7 +9864,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in + dst += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)dst, src, size); ++ return copy_user_generic((__force_kernel void *)dst, src, size); } -extern long __copy_user_nocache(void *dst, const void __user *src, @@ -9756,13 +9905,14 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess_64.h linux-3.0.4/arch/x86/in } -unsigned long +-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest); +extern unsigned long - copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest); ++copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest); #endif /* _ASM_X86_UACCESS_64_H */ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess.h linux-3.0.4/arch/x86/include/asm/uaccess.h --- linux-3.0.4/arch/x86/include/asm/uaccess.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/uaccess.h 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/uaccess.h 2011-10-06 04:17:55.000000000 -0400 @@ -7,12 +7,15 @@ #include <linux/compiler.h> #include <linux/thread_info.h> @@ -9862,6 +10012,15 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess.h linux-3.0.4/arch/x86/inclu "3:\n" \ _ASM_EXTABLE(1b, 2b - 1b) \ _ASM_EXTABLE(2b, 3b - 2b) \ +@@ -252,7 +294,7 @@ extern void __put_user_8(void); + __typeof__(*(ptr)) __pu_val; \ + __chk_user_ptr(ptr); \ + might_fault(); \ +- __pu_val = x; \ ++ __pu_val = (x); \ + switch (sizeof(*(ptr))) { \ + case 1: \ + __put_user_x(1, __pu_val, ptr, __ret_pu); \ @@ -373,7 +415,7 @@ do { \ } while (0) @@ -9973,6 +10132,18 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/uaccess.h linux-3.0.4/arch/x86/inclu } while (0) #ifdef CONFIG_X86_WP_WORKS_OK +diff -urNp linux-3.0.4/arch/x86/include/asm/vdso.h linux-3.0.4/arch/x86/include/asm/vdso.h +--- linux-3.0.4/arch/x86/include/asm/vdso.h 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/vdso.h 2011-10-06 04:17:55.000000000 -0400 +@@ -11,7 +11,7 @@ extern const char VDSO32_PRELINK[]; + #define VDSO32_SYMBOL(base, name) \ + ({ \ + extern const char VDSO32_##name[]; \ +- (void *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \ ++ (void __user *)(VDSO32_##name - VDSO32_PRELINK + (unsigned long)(base)); \ + }) + #endif + diff -urNp linux-3.0.4/arch/x86/include/asm/x86_init.h linux-3.0.4/arch/x86/include/asm/x86_init.h --- linux-3.0.4/arch/x86/include/asm/x86_init.h 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/arch/x86/include/asm/x86_init.h 2011-08-23 21:47:55.000000000 -0400 @@ -10095,7 +10266,7 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/x86_init.h linux-3.0.4/arch/x86/incl extern struct x86_cpuinit_ops x86_cpuinit; diff -urNp linux-3.0.4/arch/x86/include/asm/xsave.h linux-3.0.4/arch/x86/include/asm/xsave.h --- linux-3.0.4/arch/x86/include/asm/xsave.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/include/asm/xsave.h 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/include/asm/xsave.h 2011-10-06 04:17:55.000000000 -0400 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav { int err; @@ -10108,7 +10279,12 @@ diff -urNp linux-3.0.4/arch/x86/include/asm/xsave.h linux-3.0.4/arch/x86/include /* * Clear the xsave header first, so that reserved fields are * initialized to zero. -@@ -100,6 +105,11 @@ static inline int xrestore_user(struct x +@@ -96,10 +101,15 @@ static inline int xsave_user(struct xsav + static inline int xrestore_user(struct xsave_struct __user *buf, u64 mask) + { + int err; +- struct xsave_struct *xstate = ((__force struct xsave_struct *)buf); ++ struct xsave_struct *xstate = ((__force_kernel struct xsave_struct *)buf); u32 lmask = mask; u32 hmask = mask >> 32; @@ -10941,7 +11117,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/cpu/mtrr/mtrr.h linux-3.0.4/arch/x86/kern int replace_reg); diff -urNp linux-3.0.4/arch/x86/kernel/cpu/perf_event.c linux-3.0.4/arch/x86/kernel/cpu/perf_event.c --- linux-3.0.4/arch/x86/kernel/cpu/perf_event.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kernel/cpu/perf_event.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/arch/x86/kernel/cpu/perf_event.c 2011-10-06 04:17:55.000000000 -0400 @@ -781,6 +781,8 @@ static int x86_schedule_events(struct cp int i, j, w, wmax, num = 0; struct hw_perf_event *hwc; @@ -10956,7 +11132,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/cpu/perf_event.c linux-3.0.4/arch/x86/ker perf_callchain_store(entry, frame.return_address); - fp = frame.next_frame; -+ fp = (__force const void __user *)frame.next_frame; ++ fp = (const void __force_user *)frame.next_frame; } } @@ -11794,16 +11970,17 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_32.S linux-3.0.4/arch/x86/kernel/en CFI_ADJUST_CFA_OFFSET -24 diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/entry_64.S --- linux-3.0.4/arch/x86/kernel/entry_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kernel/entry_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -53,6 +53,7 @@ ++++ linux-3.0.4/arch/x86/kernel/entry_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -53,6 +53,8 @@ #include <asm/paravirt.h> #include <asm/ftrace.h> #include <asm/percpu.h> +#include <asm/pgtable.h> ++#include <asm/alternative-asm.h> /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */ #include <linux/elf-em.h> -@@ -176,6 +177,264 @@ ENTRY(native_usergs_sysret64) +@@ -176,6 +178,264 @@ ENTRY(native_usergs_sysret64) ENDPROC(native_usergs_sysret64) #endif /* CONFIG_PARAVIRT */ @@ -12068,7 +12245,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en .macro TRACE_IRQS_IRETQ offset=ARGOFFSET #ifdef CONFIG_TRACE_IRQFLAGS -@@ -318,7 +577,7 @@ ENTRY(save_args) +@@ -318,7 +578,7 @@ ENTRY(save_args) leaq -RBP+8(%rsp),%rdi /* arg1 for handler */ movq_cfi rbp, 8 /* push %rbp */ leaq 8(%rsp), %rbp /* mov %rsp, %ebp */ @@ -12077,7 +12254,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en je 1f SWAPGS /* -@@ -409,7 +668,7 @@ ENTRY(ret_from_fork) +@@ -409,7 +669,7 @@ ENTRY(ret_from_fork) RESTORE_REST @@ -12086,7 +12263,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en je int_ret_from_sys_call testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET -@@ -455,7 +714,7 @@ END(ret_from_fork) +@@ -455,7 +715,7 @@ END(ret_from_fork) ENTRY(system_call) CFI_STARTPROC simple CFI_SIGNAL_FRAME @@ -12095,7 +12272,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en CFI_REGISTER rip,rcx /*CFI_REGISTER rflags,r11*/ SWAPGS_UNSAFE_STACK -@@ -468,12 +727,13 @@ ENTRY(system_call_after_swapgs) +@@ -468,12 +728,13 @@ ENTRY(system_call_after_swapgs) movq %rsp,PER_CPU_VAR(old_rsp) movq PER_CPU_VAR(kernel_stack),%rsp @@ -12110,7 +12287,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en movq %rax,ORIG_RAX-ARGOFFSET(%rsp) movq %rcx,RIP-ARGOFFSET(%rsp) CFI_REL_OFFSET rip,RIP-ARGOFFSET -@@ -502,6 +762,8 @@ sysret_check: +@@ -502,6 +763,8 @@ sysret_check: andl %edi,%edx jnz sysret_careful CFI_REMEMBER_STATE @@ -12119,7 +12296,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en /* * sysretq will re-enable interrupts: */ -@@ -560,6 +822,9 @@ auditsys: +@@ -560,6 +823,9 @@ auditsys: movq %rax,%rsi /* 2nd arg: syscall number */ movl $AUDIT_ARCH_X86_64,%edi /* 1st arg: audit arch */ call audit_syscall_entry @@ -12129,7 +12306,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en LOAD_ARGS 0 /* reload call-clobbered registers */ jmp system_call_fastpath -@@ -590,6 +855,9 @@ tracesys: +@@ -590,6 +856,9 @@ tracesys: FIXUP_TOP_OF_STACK %rdi movq %rsp,%rdi call syscall_trace_enter @@ -12139,7 +12316,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en /* * Reload arg registers from stack in case ptrace changed them. * We don't reload %rax because syscall_trace_enter() returned -@@ -611,7 +879,7 @@ tracesys: +@@ -611,7 +880,7 @@ tracesys: GLOBAL(int_ret_from_sys_call) DISABLE_INTERRUPTS(CLBR_NONE) TRACE_IRQS_OFF @@ -12148,7 +12325,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en je retint_restore_args movl $_TIF_ALLWORK_MASK,%edi /* edi: mask to check */ -@@ -793,6 +1061,16 @@ END(interrupt) +@@ -793,6 +1062,16 @@ END(interrupt) CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP call save_args PARTIAL_FRAME 0 @@ -12165,7 +12342,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en call \func .endm -@@ -825,7 +1103,7 @@ ret_from_intr: +@@ -825,7 +1104,7 @@ ret_from_intr: CFI_ADJUST_CFA_OFFSET -8 exit_intr: GET_THREAD_INFO(%rcx) @@ -12174,7 +12351,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en je retint_kernel /* Interrupt came from user space */ -@@ -847,12 +1125,18 @@ retint_swapgs: /* return to user-space +@@ -847,12 +1126,16 @@ retint_swapgs: /* return to user-space * The iretq could re-enable interrupts: */ DISABLE_INTERRUPTS(CLBR_ANY) @@ -12187,13 +12364,11 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en retint_restore_args: /* return to kernel space */ DISABLE_INTERRUPTS(CLBR_ANY) + pax_exit_kernel -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80,0x7+RIP-ARGOFFSET(%rsp) -+#endif ++ pax_force_retaddr RIP-ARGOFFSET /* * The iretq could re-enable interrupts: */ -@@ -1027,6 +1311,16 @@ ENTRY(\sym) +@@ -1027,6 +1310,16 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call error_entry DEFAULT_FRAME 0 @@ -12210,7 +12385,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en movq %rsp,%rdi /* pt_regs pointer */ xorl %esi,%esi /* no error code */ call \do_sym -@@ -1044,6 +1338,16 @@ ENTRY(\sym) +@@ -1044,6 +1337,16 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call save_paranoid TRACE_IRQS_OFF @@ -12227,7 +12402,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en movq %rsp,%rdi /* pt_regs pointer */ xorl %esi,%esi /* no error code */ call \do_sym -@@ -1052,7 +1356,7 @@ ENTRY(\sym) +@@ -1052,7 +1355,7 @@ ENTRY(\sym) END(\sym) .endm @@ -12236,7 +12411,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en .macro paranoidzeroentry_ist sym do_sym ist ENTRY(\sym) INTR_FRAME -@@ -1062,8 +1366,24 @@ ENTRY(\sym) +@@ -1062,8 +1365,24 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call save_paranoid TRACE_IRQS_OFF @@ -12261,7 +12436,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist) call \do_sym addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist) -@@ -1080,6 +1400,16 @@ ENTRY(\sym) +@@ -1080,6 +1399,16 @@ ENTRY(\sym) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call error_entry DEFAULT_FRAME 0 @@ -12278,7 +12453,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en movq %rsp,%rdi /* pt_regs pointer */ movq ORIG_RAX(%rsp),%rsi /* get error code */ movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ -@@ -1099,6 +1429,16 @@ ENTRY(\sym) +@@ -1099,6 +1428,16 @@ ENTRY(\sym) call save_paranoid DEFAULT_FRAME 0 TRACE_IRQS_OFF @@ -12295,7 +12470,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en movq %rsp,%rdi /* pt_regs pointer */ movq ORIG_RAX(%rsp),%rsi /* get error code */ movq $-1,ORIG_RAX(%rsp) /* no syscall to restart */ -@@ -1361,16 +1701,35 @@ ENTRY(paranoid_exit) +@@ -1361,16 +1700,31 @@ ENTRY(paranoid_exit) TRACE_IRQS_OFF testl %ebx,%ebx /* swapgs needed? */ jnz paranoid_restore @@ -12307,9 +12482,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en + TRACE_IRQS_IRETQ 0 + SWAPGS_UNSAFE_STACK + RESTORE_ALL 8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80,0x7(%rsp) -+#endif ++ pax_force_retaddr + jmp irq_return +#endif paranoid_swapgs: @@ -12326,13 +12499,11 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en + pax_exit_kernel TRACE_IRQS_IRETQ 0 RESTORE_ALL 8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80,0x7(%rsp) -+#endif ++ pax_force_retaddr jmp irq_return paranoid_userspace: GET_THREAD_INFO(%rcx) -@@ -1426,7 +1785,7 @@ ENTRY(error_entry) +@@ -1426,7 +1780,7 @@ ENTRY(error_entry) movq_cfi r14, R14+8 movq_cfi r15, R15+8 xorl %ebx,%ebx @@ -12341,7 +12512,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en je error_kernelspace error_swapgs: SWAPGS -@@ -1490,6 +1849,16 @@ ENTRY(nmi) +@@ -1490,6 +1844,16 @@ ENTRY(nmi) CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15 call save_paranoid DEFAULT_FRAME 0 @@ -12358,7 +12529,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ movq %rsp,%rdi movq $-1,%rsi -@@ -1500,12 +1869,32 @@ ENTRY(nmi) +@@ -1500,12 +1864,28 @@ ENTRY(nmi) DISABLE_INTERRUPTS(CLBR_NONE) testl %ebx,%ebx /* swapgs needed? */ jnz nmi_restore @@ -12369,9 +12540,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en + pax_exit_kernel + SWAPGS_UNSAFE_STACK + RESTORE_ALL 8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80,0x7(%rsp) -+#endif ++ pax_force_retaddr + jmp irq_return +#endif nmi_swapgs: @@ -12386,9 +12555,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/entry_64.S linux-3.0.4/arch/x86/kernel/en nmi_restore: + pax_exit_kernel RESTORE_ALL 8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80,0x7(%rsp) -+#endif ++ pax_force_retaddr jmp irq_return nmi_userspace: GET_THREAD_INFO(%rcx) @@ -13750,20 +13917,20 @@ diff -urNp linux-3.0.4/arch/x86/kernel/machine_kexec_32.c linux-3.0.4/arch/x86/k page_list[PA_CONTROL_PAGE] = __pa(control_page); diff -urNp linux-3.0.4/arch/x86/kernel/microcode_intel.c linux-3.0.4/arch/x86/kernel/microcode_intel.c --- linux-3.0.4/arch/x86/kernel/microcode_intel.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kernel/microcode_intel.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/kernel/microcode_intel.c 2011-10-06 04:17:55.000000000 -0400 @@ -440,13 +440,13 @@ static enum ucode_state request_microcod static int get_ucode_user(void *to, const void *from, size_t n) { - return copy_from_user(to, from, n); -+ return copy_from_user(to, (__force const void __user *)from, n); ++ return copy_from_user(to, (const void __force_user *)from, n); } static enum ucode_state request_microcode_user(int cpu, const void __user *buf, size_t size) { - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user); -+ return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user); ++ return generic_load_microcode(cpu, (__force_kernel void *)buf, size, &get_ucode_user); } static void microcode_fini_cpu(int cpu) @@ -14593,7 +14760,16 @@ diff -urNp linux-3.0.4/arch/x86/kernel/reboot.c linux-3.0.4/arch/x86/kernel/rebo struct machine_ops machine_ops = { diff -urNp linux-3.0.4/arch/x86/kernel/setup.c linux-3.0.4/arch/x86/kernel/setup.c --- linux-3.0.4/arch/x86/kernel/setup.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kernel/setup.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/kernel/setup.c 2011-10-06 04:17:55.000000000 -0400 +@@ -447,7 +447,7 @@ static void __init parse_setup_data(void + + switch (data->type) { + case SETUP_E820_EXT: +- parse_e820_ext(data); ++ parse_e820_ext((struct setup_data __force_kernel *)data); + break; + case SETUP_DTB: + add_dtb(pa_data); @@ -650,7 +650,7 @@ static void __init trim_bios_range(void) * area (640->1Mb) as ram even though it is not. * take them out. @@ -15953,7 +16129,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/x8664_ksyms_64.c linux-3.0.4/arch/x86/ker EXPORT_SYMBOL(clear_page); diff -urNp linux-3.0.4/arch/x86/kernel/xsave.c linux-3.0.4/arch/x86/kernel/xsave.c --- linux-3.0.4/arch/x86/kernel/xsave.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kernel/xsave.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/kernel/xsave.c 2011-10-06 04:17:55.000000000 -0400 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_ fx_sw_user->xstate_size > fx_sw_user->extended_size) return -EINVAL; @@ -15968,7 +16144,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/xsave.c linux-3.0.4/arch/x86/kernel/xsave */ xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE); - return fxrstor_checking((__force struct i387_fxsave_struct *)buf); -+ return fxrstor_checking((struct i387_fxsave_struct __user *)buf); ++ return fxrstor_checking((struct i387_fxsave_struct __force_kernel *)buf); } /* @@ -15977,7 +16153,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/xsave.c linux-3.0.4/arch/x86/kernel/xsave err = restore_user_xstate(buf); else - err = fxrstor_checking((__force struct i387_fxsave_struct *) -+ err = fxrstor_checking((struct i387_fxsave_struct __user *) ++ err = fxrstor_checking((struct i387_fxsave_struct __force_kernel *) buf); if (unlikely(err)) { /* @@ -16053,7 +16229,16 @@ diff -urNp linux-3.0.4/arch/x86/kvm/mmu.c linux-3.0.4/arch/x86/kvm/mmu.c ++vcpu->kvm->stat.mmu_pte_write; diff -urNp linux-3.0.4/arch/x86/kvm/paging_tmpl.h linux-3.0.4/arch/x86/kvm/paging_tmpl.h --- linux-3.0.4/arch/x86/kvm/paging_tmpl.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kvm/paging_tmpl.h 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/arch/x86/kvm/paging_tmpl.h 2011-10-06 04:17:55.000000000 -0400 +@@ -182,7 +182,7 @@ walk: + break; + } + +- ptep_user = (pt_element_t __user *)((void *)host_addr + offset); ++ ptep_user = (pt_element_t __force_user *)((void *)host_addr + offset); + if (unlikely(__copy_from_user(&pte, ptep_user, sizeof(pte)))) { + present = false; + break; @@ -583,6 +583,8 @@ static int FNAME(page_fault)(struct kvm_ unsigned long mmu_seq; bool map_writable; @@ -16181,7 +16366,18 @@ diff -urNp linux-3.0.4/arch/x86/kvm/vmx.c linux-3.0.4/arch/x86/kvm/vmx.c vmx->exit_reason = vmcs_read32(VM_EXIT_REASON); diff -urNp linux-3.0.4/arch/x86/kvm/x86.c linux-3.0.4/arch/x86/kvm/x86.c --- linux-3.0.4/arch/x86/kvm/x86.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/kvm/x86.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/kvm/x86.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1313,8 +1313,8 @@ static int xen_hvm_config(struct kvm_vcp + { + struct kvm *kvm = vcpu->kvm; + int lm = is_long_mode(vcpu); +- u8 *blob_addr = lm ? (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_64 +- : (u8 *)(long)kvm->arch.xen_hvm_config.blob_addr_32; ++ u8 __user *blob_addr = lm ? (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_64 ++ : (u8 __user *)(long)kvm->arch.xen_hvm_config.blob_addr_32; + u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64 + : kvm->arch.xen_hvm_config.blob_size_32; + u32 page_num = data & ~PAGE_MASK; @@ -2057,6 +2057,8 @@ long kvm_arch_dev_ioctl(struct file *fil if (n < msr_list.nmsrs) goto out; @@ -16612,14 +16808,12 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_386_32.S linux-3.0.4/arch/x86/lib/a movl %edx, 4(v) diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S --- linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S 2011-09-17 18:31:51.000000000 -0400 -@@ -35,10 +35,24 @@ ENTRY(atomic64_read_cx8) ++++ linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S 2011-10-06 04:17:55.000000000 -0400 +@@ -35,10 +35,20 @@ ENTRY(atomic64_read_cx8) CFI_STARTPROC read64 %ecx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(atomic64_read_cx8) @@ -16628,9 +16822,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a + CFI_STARTPROC + + read64 %ecx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr + ret + CFI_ENDPROC +ENDPROC(atomic64_read_unchecked_cx8) @@ -16638,13 +16830,11 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a ENTRY(atomic64_set_cx8) CFI_STARTPROC -@@ -48,10 +62,29 @@ ENTRY(atomic64_set_cx8) +@@ -48,10 +58,25 @@ ENTRY(atomic64_set_cx8) cmpxchg8b (%esi) jne 1b -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(atomic64_set_cx8) @@ -16658,9 +16848,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a + cmpxchg8b (%esi) + jne 1b + -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr + ret + CFI_ENDPROC +ENDPROC(atomic64_set_unchecked_cx8) @@ -16668,13 +16856,11 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a ENTRY(atomic64_xchg_cx8) CFI_STARTPROC -@@ -62,12 +95,15 @@ ENTRY(atomic64_xchg_cx8) +@@ -62,12 +87,13 @@ ENTRY(atomic64_xchg_cx8) cmpxchg8b (%esi) jne 1b -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(atomic64_xchg_cx8) @@ -16686,7 +16872,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a CFI_STARTPROC SAVE ebp SAVE ebx -@@ -84,27 +120,46 @@ ENTRY(atomic64_\func\()_return_cx8) +@@ -84,27 +110,44 @@ ENTRY(atomic64_\func\()_return_cx8) movl %edx, %ecx \ins\()l %esi, %ebx \insc\()l %edi, %ecx @@ -16717,9 +16903,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a RESTORE esi RESTORE ebx RESTORE ebp -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC -ENDPROC(atomic64_\func\()_return_cx8) @@ -16738,7 +16922,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a CFI_STARTPROC SAVE ebx -@@ -114,21 +169,41 @@ ENTRY(atomic64_\func\()_return_cx8) +@@ -114,21 +157,39 @@ ENTRY(atomic64_\func\()_return_cx8) movl %edx, %ecx \ins\()l $1, %ebx \insc\()l $0, %ecx @@ -16766,9 +16950,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a +.endif + RESTORE ebx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC -ENDPROC(atomic64_\func\()_return_cx8) @@ -16782,7 +16964,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a ENTRY(atomic64_dec_if_positive_cx8) CFI_STARTPROC -@@ -140,6 +215,13 @@ ENTRY(atomic64_dec_if_positive_cx8) +@@ -140,6 +201,13 @@ ENTRY(atomic64_dec_if_positive_cx8) movl %edx, %ecx subl $1, %ebx sbb $0, %ecx @@ -16796,17 +16978,15 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a js 2f LOCK_PREFIX cmpxchg8b (%esi) -@@ -149,6 +231,9 @@ ENTRY(atomic64_dec_if_positive_cx8) +@@ -149,6 +217,7 @@ ENTRY(atomic64_dec_if_positive_cx8) movl %ebx, %eax movl %ecx, %edx RESTORE ebx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(atomic64_dec_if_positive_cx8) -@@ -174,6 +259,13 @@ ENTRY(atomic64_add_unless_cx8) +@@ -174,6 +243,13 @@ ENTRY(atomic64_add_unless_cx8) movl %edx, %ecx addl %esi, %ebx adcl %edi, %ecx @@ -16820,17 +17000,15 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a LOCK_PREFIX cmpxchg8b (%ebp) jne 1b -@@ -184,6 +276,9 @@ ENTRY(atomic64_add_unless_cx8) +@@ -184,6 +260,7 @@ ENTRY(atomic64_add_unless_cx8) CFI_ADJUST_CFA_OFFSET -8 RESTORE ebx RESTORE ebp -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret 4: cmpl %edx, 4(%esp) -@@ -206,6 +301,13 @@ ENTRY(atomic64_inc_not_zero_cx8) +@@ -206,6 +283,13 @@ ENTRY(atomic64_inc_not_zero_cx8) movl %edx, %ecx addl $1, %ebx adcl $0, %ecx @@ -16844,13 +17022,11 @@ diff -urNp linux-3.0.4/arch/x86/lib/atomic64_cx8_32.S linux-3.0.4/arch/x86/lib/a LOCK_PREFIX cmpxchg8b (%esi) jne 1b -@@ -213,6 +315,9 @@ ENTRY(atomic64_inc_not_zero_cx8) +@@ -213,6 +297,7 @@ ENTRY(atomic64_inc_not_zero_cx8) movl $1, %eax 3: RESTORE ebx -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret 4: testl %edx, %edx @@ -17103,38 +17279,32 @@ diff -urNp linux-3.0.4/arch/x86/lib/checksum_32.S linux-3.0.4/arch/x86/lib/check #undef ROUND1 diff -urNp linux-3.0.4/arch/x86/lib/clear_page_64.S linux-3.0.4/arch/x86/lib/clear_page_64.S --- linux-3.0.4/arch/x86/lib/clear_page_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/clear_page_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -11,6 +11,9 @@ ENTRY(clear_page_c) ++++ linux-3.0.4/arch/x86/lib/clear_page_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -11,6 +11,7 @@ ENTRY(clear_page_c) movl $4096/8,%ecx xorl %eax,%eax rep stosq -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(clear_page_c) -@@ -20,6 +23,9 @@ ENTRY(clear_page_c_e) +@@ -20,6 +21,7 @@ ENTRY(clear_page_c_e) movl $4096,%ecx xorl %eax,%eax rep stosb -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(clear_page_c_e) -@@ -43,6 +49,9 @@ ENTRY(clear_page) +@@ -43,6 +45,7 @@ ENTRY(clear_page) leaq 64(%rdi),%rdi jnz .Lloop nop -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC .Lclear_page_end: -@@ -58,7 +67,7 @@ ENDPROC(clear_page) +@@ -58,7 +61,7 @@ ENDPROC(clear_page) #include <asm/cpufeature.h> @@ -17145,28 +17315,31 @@ diff -urNp linux-3.0.4/arch/x86/lib/clear_page_64.S linux-3.0.4/arch/x86/lib/cle 2: .byte 0xeb /* jmp <disp8> */ diff -urNp linux-3.0.4/arch/x86/lib/copy_page_64.S linux-3.0.4/arch/x86/lib/copy_page_64.S --- linux-3.0.4/arch/x86/lib/copy_page_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/copy_page_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -8,6 +8,9 @@ copy_page_c: ++++ linux-3.0.4/arch/x86/lib/copy_page_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -2,12 +2,14 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + ALIGN + copy_page_c: CFI_STARTPROC movl $4096/8,%ecx rep movsq -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(copy_page_c) -@@ -94,6 +97,9 @@ ENTRY(copy_page) +@@ -94,6 +96,7 @@ ENTRY(copy_page) CFI_RESTORE r13 addq $3*8,%rsp CFI_ADJUST_CFA_OFFSET -3*8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .Lcopy_page_end: CFI_ENDPROC -@@ -104,7 +110,7 @@ ENDPROC(copy_page) +@@ -104,7 +107,7 @@ ENDPROC(copy_page) #include <asm/cpufeature.h> @@ -17177,7 +17350,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/copy_page_64.S linux-3.0.4/arch/x86/lib/copy 2: diff -urNp linux-3.0.4/arch/x86/lib/copy_user_64.S linux-3.0.4/arch/x86/lib/copy_user_64.S --- linux-3.0.4/arch/x86/lib/copy_user_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/copy_user_64.S 2011-09-17 18:31:51.000000000 -0400 ++++ linux-3.0.4/arch/x86/lib/copy_user_64.S 2011-10-06 04:17:55.000000000 -0400 @@ -16,6 +16,7 @@ #include <asm/thread_info.h> #include <asm/cpufeature.h> @@ -17195,7 +17368,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/copy_user_64.S linux-3.0.4/arch/x86/lib/copy 2: .byte 0xe9 /* near jump with 32bit immediate */ .long \alt1-1b /* offset */ /* or alternatively to alt1 */ 3: .byte 0xe9 /* near jump with 32bit immediate */ -@@ -71,47 +72,22 @@ +@@ -71,47 +72,20 @@ #endif .endm @@ -17242,46 +17415,45 @@ diff -urNp linux-3.0.4/arch/x86/lib/copy_user_64.S linux-3.0.4/arch/x86/lib/copy stosb bad_to_user: movl %edx,%eax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(bad_from_user) -@@ -179,6 +155,9 @@ ENTRY(copy_user_generic_unrolled) +@@ -179,6 +153,7 @@ ENTRY(copy_user_generic_unrolled) decl %ecx jnz 21b 23: xor %eax,%eax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .section .fixup,"ax" -@@ -251,6 +230,9 @@ ENTRY(copy_user_generic_string) +@@ -251,6 +226,7 @@ ENTRY(copy_user_generic_string) 3: rep movsb 4: xorl %eax,%eax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .section .fixup,"ax" -@@ -287,6 +269,9 @@ ENTRY(copy_user_enhanced_fast_string) +@@ -287,6 +263,7 @@ ENTRY(copy_user_enhanced_fast_string) 1: rep movsb 2: xorl %eax,%eax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .section .fixup,"ax" diff -urNp linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S --- linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -14,6 +14,7 @@ ++++ linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -8,12 +8,14 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + #define FIX_ALIGNMENT 1 + #include <asm/current.h> #include <asm/asm-offsets.h> #include <asm/thread_info.h> @@ -17289,7 +17461,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S linux-3.0.4/arch/x86/ .macro ALIGN_DESTINATION #ifdef FIX_ALIGNMENT -@@ -50,6 +51,15 @@ +@@ -50,6 +52,15 @@ */ ENTRY(__copy_user_nocache) CFI_STARTPROC @@ -17305,58 +17477,66 @@ diff -urNp linux-3.0.4/arch/x86/lib/copy_user_nocache_64.S linux-3.0.4/arch/x86/ cmpl $8,%edx jb 20f /* less then 8 bytes, go to byte copy loop */ ALIGN_DESTINATION -@@ -98,6 +108,9 @@ ENTRY(__copy_user_nocache) +@@ -98,6 +109,7 @@ ENTRY(__copy_user_nocache) jnz 21b 23: xorl %eax,%eax sfence -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .section .fixup,"ax" diff -urNp linux-3.0.4/arch/x86/lib/csum-copy_64.S linux-3.0.4/arch/x86/lib/csum-copy_64.S --- linux-3.0.4/arch/x86/lib/csum-copy_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/csum-copy_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -228,6 +228,9 @@ ENTRY(csum_partial_copy_generic) ++++ linux-3.0.4/arch/x86/lib/csum-copy_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -8,6 +8,7 @@ + #include <linux/linkage.h> + #include <asm/dwarf2.h> + #include <asm/errno.h> ++#include <asm/alternative-asm.h> + + /* + * Checksum copy with exception handling. +@@ -228,6 +229,7 @@ ENTRY(csum_partial_copy_generic) CFI_RESTORE rbp addq $7*8, %rsp CFI_ADJUST_CFA_OFFSET -7*8 -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_RESTORE_STATE diff -urNp linux-3.0.4/arch/x86/lib/csum-wrappers_64.c linux-3.0.4/arch/x86/lib/csum-wrappers_64.c --- linux-3.0.4/arch/x86/lib/csum-wrappers_64.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/csum-wrappers_64.c 2011-08-23 21:47:55.000000000 -0400 -@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _ ++++ linux-3.0.4/arch/x86/lib/csum-wrappers_64.c 2011-10-06 04:17:55.000000000 -0400 +@@ -52,7 +52,13 @@ csum_partial_copy_from_user(const void _ len -= 2; } } +- isum = csum_partial_copy_generic((__force const void *)src, + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)src < PAX_USER_SHADOW_BASE) + src += PAX_USER_SHADOW_BASE; +#endif + - isum = csum_partial_copy_generic((__force const void *)src, ++ isum = csum_partial_copy_generic((const void __force_kernel *)src, dst, len, isum, errp, NULL); if (unlikely(*errp)) -@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr + goto out_err; +@@ -105,7 +111,13 @@ csum_partial_copy_to_user(const void *sr } *errp = 0; +- return csum_partial_copy_generic(src, (void __force *)dst, + +#ifdef CONFIG_PAX_MEMORY_UDEREF + if ((unsigned long)dst < PAX_USER_SHADOW_BASE) + dst += PAX_USER_SHADOW_BASE; +#endif + - return csum_partial_copy_generic(src, (void __force *)dst, ++ return csum_partial_copy_generic(src, (void __force_kernel *)dst, len, isum, NULL, errp); } + EXPORT_SYMBOL(csum_partial_copy_to_user); diff -urNp linux-3.0.4/arch/x86/lib/getuser.S linux-3.0.4/arch/x86/lib/getuser.S --- linux-3.0.4/arch/x86/lib/getuser.S 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/arch/x86/lib/getuser.S 2011-08-23 21:47:55.000000000 -0400 @@ -17493,133 +17673,125 @@ diff -urNp linux-3.0.4/arch/x86/lib/insn.c linux-3.0.4/arch/x86/lib/insn.c if (x86_64) diff -urNp linux-3.0.4/arch/x86/lib/iomap_copy_64.S linux-3.0.4/arch/x86/lib/iomap_copy_64.S --- linux-3.0.4/arch/x86/lib/iomap_copy_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/iomap_copy_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -25,6 +25,9 @@ ENTRY(__iowrite32_copy) ++++ linux-3.0.4/arch/x86/lib/iomap_copy_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -17,6 +17,7 @@ + + #include <linux/linkage.h> + #include <asm/dwarf2.h> ++#include <asm/alternative-asm.h> + + /* + * override generic version in lib/iomap_copy.c +@@ -25,6 +26,7 @@ ENTRY(__iowrite32_copy) CFI_STARTPROC movl %edx,%ecx rep movsd -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(__iowrite32_copy) diff -urNp linux-3.0.4/arch/x86/lib/memcpy_64.S linux-3.0.4/arch/x86/lib/memcpy_64.S --- linux-3.0.4/arch/x86/lib/memcpy_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/memcpy_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -34,6 +34,9 @@ ++++ linux-3.0.4/arch/x86/lib/memcpy_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -34,6 +34,7 @@ rep movsq movl %edx, %ecx rep movsb -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .Lmemcpy_e: .previous -@@ -51,6 +54,9 @@ +@@ -51,6 +52,7 @@ movl %edx, %ecx rep movsb -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .Lmemcpy_e_e: .previous -@@ -141,6 +147,9 @@ ENTRY(memcpy) +@@ -141,6 +143,7 @@ ENTRY(memcpy) movq %r9, 1*8(%rdi) movq %r10, -2*8(%rdi, %rdx) movq %r11, -1*8(%rdi, %rdx) -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq .p2align 4 .Lless_16bytes: -@@ -153,6 +162,9 @@ ENTRY(memcpy) +@@ -153,6 +156,7 @@ ENTRY(memcpy) movq -1*8(%rsi, %rdx), %r9 movq %r8, 0*8(%rdi) movq %r9, -1*8(%rdi, %rdx) -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq .p2align 4 .Lless_8bytes: -@@ -166,6 +178,9 @@ ENTRY(memcpy) +@@ -166,6 +170,7 @@ ENTRY(memcpy) movl -4(%rsi, %rdx), %r8d movl %ecx, (%rdi) movl %r8d, -4(%rdi, %rdx) -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq .p2align 4 .Lless_3bytes: -@@ -183,6 +198,9 @@ ENTRY(memcpy) +@@ -183,6 +188,7 @@ ENTRY(memcpy) jnz .Lloop_1 .Lend: -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq CFI_ENDPROC ENDPROC(memcpy) diff -urNp linux-3.0.4/arch/x86/lib/memmove_64.S linux-3.0.4/arch/x86/lib/memmove_64.S --- linux-3.0.4/arch/x86/lib/memmove_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/memmove_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -201,6 +201,9 @@ ENTRY(memmove) ++++ linux-3.0.4/arch/x86/lib/memmove_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -9,6 +9,7 @@ + #include <linux/linkage.h> + #include <asm/dwarf2.h> + #include <asm/cpufeature.h> ++#include <asm/alternative-asm.h> + + #undef memmove + +@@ -201,6 +202,7 @@ ENTRY(memmove) movb (%rsi), %r11b movb %r11b, (%rdi) 13: -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq CFI_ENDPROC -@@ -209,6 +212,9 @@ ENTRY(memmove) +@@ -209,6 +211,7 @@ ENTRY(memmove) /* Forward moving data. */ movq %rdx, %rcx rep movsb -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr retq .Lmemmove_end_forward_efs: .previous diff -urNp linux-3.0.4/arch/x86/lib/memset_64.S linux-3.0.4/arch/x86/lib/memset_64.S --- linux-3.0.4/arch/x86/lib/memset_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/memset_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -31,6 +31,9 @@ ++++ linux-3.0.4/arch/x86/lib/memset_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -31,6 +31,7 @@ movl %r8d,%ecx rep stosb movq %r9,%rax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .Lmemset_e: .previous -@@ -53,6 +56,9 @@ +@@ -53,6 +54,7 @@ movl %edx,%ecx rep stosb movq %r9,%rax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret .Lmemset_e_e: .previous -@@ -121,6 +127,9 @@ ENTRY(__memset) +@@ -121,6 +123,7 @@ ENTRY(__memset) .Lende: movq %r10,%rax -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_RESTORE_STATE @@ -18083,81 +18255,78 @@ diff -urNp linux-3.0.4/arch/x86/lib/putuser.S linux-3.0.4/arch/x86/lib/putuser.S EXIT diff -urNp linux-3.0.4/arch/x86/lib/rwlock_64.S linux-3.0.4/arch/x86/lib/rwlock_64.S --- linux-3.0.4/arch/x86/lib/rwlock_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/rwlock_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -17,6 +17,9 @@ ENTRY(__write_lock_failed) ++++ linux-3.0.4/arch/x86/lib/rwlock_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -17,6 +17,7 @@ ENTRY(__write_lock_failed) LOCK_PREFIX subl $RW_LOCK_BIAS,(%rdi) jnz __write_lock_failed -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC END(__write_lock_failed) -@@ -33,6 +36,9 @@ ENTRY(__read_lock_failed) +@@ -33,6 +34,7 @@ ENTRY(__read_lock_failed) LOCK_PREFIX decl (%rdi) js __read_lock_failed -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC END(__read_lock_failed) diff -urNp linux-3.0.4/arch/x86/lib/rwsem_64.S linux-3.0.4/arch/x86/lib/rwsem_64.S --- linux-3.0.4/arch/x86/lib/rwsem_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/rwsem_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -51,6 +51,9 @@ ENTRY(call_rwsem_down_read_failed) ++++ linux-3.0.4/arch/x86/lib/rwsem_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -51,6 +51,7 @@ ENTRY(call_rwsem_down_read_failed) popq_cfi %rdx CFI_RESTORE rdx restore_common_regs -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(call_rwsem_down_read_failed) -@@ -61,6 +64,9 @@ ENTRY(call_rwsem_down_write_failed) +@@ -61,6 +62,7 @@ ENTRY(call_rwsem_down_write_failed) movq %rax,%rdi call rwsem_down_write_failed restore_common_regs -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(call_rwsem_down_write_failed) -@@ -73,6 +79,9 @@ ENTRY(call_rwsem_wake) +@@ -73,6 +75,7 @@ ENTRY(call_rwsem_wake) movq %rax,%rdi call rwsem_wake restore_common_regs -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr 1: ret CFI_ENDPROC ENDPROC(call_rwsem_wake) -@@ -88,6 +97,9 @@ ENTRY(call_rwsem_downgrade_wake) +@@ -88,6 +91,7 @@ ENTRY(call_rwsem_downgrade_wake) popq_cfi %rdx CFI_RESTORE rdx restore_common_regs -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret CFI_ENDPROC ENDPROC(call_rwsem_downgrade_wake) diff -urNp linux-3.0.4/arch/x86/lib/thunk_64.S linux-3.0.4/arch/x86/lib/thunk_64.S --- linux-3.0.4/arch/x86/lib/thunk_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/thunk_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -50,5 +50,8 @@ ++++ linux-3.0.4/arch/x86/lib/thunk_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -10,7 +10,8 @@ + #include <asm/dwarf2.h> + #include <asm/calling.h> + #include <asm/rwlock.h> +- ++ #include <asm/alternative-asm.h> ++ + /* rdi: arg1 ... normal C conventions. rax is saved/restored. */ + .macro thunk name,func + .globl \name +@@ -50,5 +51,6 @@ SAVE_ARGS restore: RESTORE_ARGS -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif - ret +- ret ++ pax_force_retaddr ++ ret CFI_ENDPROC diff -urNp linux-3.0.4/arch/x86/lib/usercopy_32.c linux-3.0.4/arch/x86/lib/usercopy_32.c --- linux-3.0.4/arch/x86/lib/usercopy_32.c 2011-07-21 22:17:23.000000000 -0400 @@ -18784,7 +18953,7 @@ diff -urNp linux-3.0.4/arch/x86/lib/usercopy_32.c linux-3.0.4/arch/x86/lib/userc +#endif diff -urNp linux-3.0.4/arch/x86/lib/usercopy_64.c linux-3.0.4/arch/x86/lib/usercopy_64.c --- linux-3.0.4/arch/x86/lib/usercopy_64.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/lib/usercopy_64.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/lib/usercopy_64.c 2011-10-06 04:17:55.000000000 -0400 @@ -42,6 +42,12 @@ long __strncpy_from_user(char *dst, const char __user *src, long count) { @@ -18816,6 +18985,9 @@ diff -urNp linux-3.0.4/arch/x86/lib/usercopy_64.c linux-3.0.4/arch/x86/lib/userc unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len) { - if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { +- return copy_user_generic((__force void *)to, (__force void *)from, len); +- } +- return len; + if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { + +#ifdef CONFIG_PAX_MEMORY_UDEREF @@ -18825,14 +18997,21 @@ diff -urNp linux-3.0.4/arch/x86/lib/usercopy_64.c linux-3.0.4/arch/x86/lib/userc + from += PAX_USER_SHADOW_BASE; +#endif + - return copy_user_generic((__force void *)to, (__force void *)from, len); -- } -- return len; ++ return copy_user_generic((void __force_kernel *)to, (void __force_kernel *)from, len); + } + return len; } EXPORT_SYMBOL(copy_in_user); +@@ -164,7 +184,7 @@ EXPORT_SYMBOL(copy_in_user); + * it is not necessary to optimize tail handling. + */ + unsigned long +-copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest) ++copy_user_handle_tail(char __user *to, char __user *from, unsigned len, unsigned zerorest) + { + char c; + unsigned zero_len; diff -urNp linux-3.0.4/arch/x86/Makefile linux-3.0.4/arch/x86/Makefile --- linux-3.0.4/arch/x86/Makefile 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/arch/x86/Makefile 2011-08-23 21:48:14.000000000 -0400 @@ -18871,7 +19050,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/extable.c linux-3.0.4/arch/x86/mm/extable.c pnp_bios_is_utter_crap = 1; diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c --- linux-3.0.4/arch/x86/mm/fault.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/mm/fault.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/arch/x86/mm/fault.c 2011-10-06 04:17:55.000000000 -0400 @@ -13,10 +13,18 @@ #include <linux/perf_event.h> /* perf_sw_event */ #include <linux/hugetlb.h> /* hstate_index_to_shift */ @@ -18906,7 +19085,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c /* Prefetch instruction is 0x0F0D or 0x0F18 */ - if (probe_kernel_address(instr, opcode)) + if (user_mode(regs)) { -+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) ++ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1)) + return 0; + } else if (probe_kernel_address(instr, opcode)) return 0; @@ -18918,7 +19097,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c - if (probe_kernel_address(instr, opcode)) + if (user_mode(regs)) { -+ if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1)) ++ if (__copy_from_user_inatomic(&opcode, (unsigned char __force_user *)(instr), 1)) + break; + } else if (probe_kernel_address(instr, opcode)) break; @@ -19491,7 +19670,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c + printk(KERN_ERR "PAX: bytes at PC: "); + for (i = 0; i < 20; i++) { + unsigned char c; -+ if (get_user(c, (__force unsigned char __user *)pc+i)) ++ if (get_user(c, (unsigned char __force_user *)pc+i)) + printk(KERN_CONT "?? "); + else + printk(KERN_CONT "%02x ", c); @@ -19501,7 +19680,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c + printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long)); + for (i = -1; i < 80 / (long)sizeof(long); i++) { + unsigned long c; -+ if (get_user(c, (__force unsigned long __user *)sp+i)) ++ if (get_user(c, (unsigned long __force_user *)sp+i)) +#ifdef CONFIG_X86_32 + printk(KERN_CONT "???????? "); +#else @@ -19531,7 +19710,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/fault.c linux-3.0.4/arch/x86/mm/fault.c + set_fs(KERNEL_DS); + pagefault_disable(); + pax_open_kernel(); -+ ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); ++ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size); + pax_close_kernel(); + pagefault_enable(); + set_fs(old_fs); @@ -20053,7 +20232,7 @@ diff -urNp linux-3.0.4/arch/x86/mm/init_32.c linux-3.0.4/arch/x86/mm/init_32.c size >> 10); diff -urNp linux-3.0.4/arch/x86/mm/init_64.c linux-3.0.4/arch/x86/mm/init_64.c --- linux-3.0.4/arch/x86/mm/init_64.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/mm/init_64.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/mm/init_64.c 2011-10-06 04:17:55.000000000 -0400 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpa * around without checking the pgd every time. */ @@ -20132,6 +20311,24 @@ diff -urNp linux-3.0.4/arch/x86/mm/init_64.c linux-3.0.4/arch/x86/mm/init_64.c } pmd = pmd_offset(pud, phys); BUG_ON(!pmd_none(*pmd)); +@@ -330,7 +344,7 @@ static __ref void *alloc_low_page(unsign + if (pfn >= pgt_buf_top) + panic("alloc_low_page: ran out of memory"); + +- adr = early_memremap(pfn * PAGE_SIZE, PAGE_SIZE); ++ adr = (void __force_kernel *)early_memremap(pfn * PAGE_SIZE, PAGE_SIZE); + clear_page(adr); + *phys = pfn * PAGE_SIZE; + return adr; +@@ -346,7 +360,7 @@ static __ref void *map_low_page(void *vi + + phys = __pa(virt); + left = phys & (PAGE_SIZE - 1); +- adr = early_memremap(phys & PAGE_MASK, PAGE_SIZE); ++ adr = (void __force_kernel *)early_memremap(phys & PAGE_MASK, PAGE_SIZE); + adr = (void *)(((unsigned long)adr) | left); + + return adr; @@ -693,6 +707,12 @@ void __init mem_init(void) pci_iommu_alloc(); @@ -21008,7 +21205,30 @@ diff -urNp linux-3.0.4/arch/x86/net/bpf_jit_comp.c linux-3.0.4/arch/x86/net/bpf_ if (!image) diff -urNp linux-3.0.4/arch/x86/oprofile/backtrace.c linux-3.0.4/arch/x86/oprofile/backtrace.c --- linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-09-02 18:11:21.000000000 -0400 -+++ linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-10-06 04:17:55.000000000 -0400 +@@ -83,11 +83,11 @@ dump_user_backtrace_32(struct stack_fram + struct stack_frame_ia32 *fp; + unsigned long bytes; + +- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead)); ++ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead)); + if (bytes != sizeof(bufhead)) + return NULL; + +- fp = (struct stack_frame_ia32 *) compat_ptr(bufhead[0].next_frame); ++ fp = (struct stack_frame_ia32 __force_kernel *) compat_ptr(bufhead[0].next_frame); + + oprofile_add_trace(bufhead[0].return_address); + +@@ -129,7 +129,7 @@ static struct stack_frame *dump_user_bac + struct stack_frame bufhead[2]; + unsigned long bytes; + +- bytes = copy_from_user_nmi(bufhead, head, sizeof(bufhead)); ++ bytes = copy_from_user_nmi(bufhead, (const char __force_user *)head, sizeof(bufhead)); + if (bytes != sizeof(bufhead)) + return NULL; + @@ -148,7 +148,7 @@ x86_backtrace(struct pt_regs * const reg { struct stack_frame *head = (struct stack_frame *)frame_pointer(regs); @@ -21341,7 +21561,7 @@ diff -urNp linux-3.0.4/arch/x86/pci/pcbios.c linux-3.0.4/arch/x86/pci/pcbios.c EXPORT_SYMBOL(pcibios_set_irq_routing); diff -urNp linux-3.0.4/arch/x86/platform/efi/efi_32.c linux-3.0.4/arch/x86/platform/efi/efi_32.c --- linux-3.0.4/arch/x86/platform/efi/efi_32.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/platform/efi/efi_32.c 2011-09-19 09:16:58.000000000 -0400 ++++ linux-3.0.4/arch/x86/platform/efi/efi_32.c 2011-10-06 04:17:55.000000000 -0400 @@ -38,70 +38,56 @@ */ @@ -21396,9 +21616,9 @@ diff -urNp linux-3.0.4/arch/x86/platform/efi/efi_32.c linux-3.0.4/arch/x86/platf +#ifdef CONFIG_PAX_KERNEXEC + pack_descriptor(&d, 0, 0xFFFFF, 0x9B, 0xC); -+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_EFI_CS, &d, DESCTYPE_S); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S); + pack_descriptor(&d, 0, 0xFFFFF, 0x93, 0xC); -+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_EFI_DS, &d, DESCTYPE_S); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S); +#endif + gdt_descr.address = __pa(get_cpu_gdt_table(0)); @@ -21416,8 +21636,8 @@ diff -urNp linux-3.0.4/arch/x86/platform/efi/efi_32.c linux-3.0.4/arch/x86/platf + struct desc_struct d; + + memset(&d, 0, sizeof d); -+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_EFI_CS, &d, DESCTYPE_S); -+ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_EFI_DS, &d, DESCTYPE_S); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_CS, &d, DESCTYPE_S); ++ write_gdt_entry(get_cpu_gdt_table(0), GDT_ENTRY_KERNEXEC_EFI_DS, &d, DESCTYPE_S); +#endif + gdt_descr.address = (unsigned long)get_cpu_gdt_table(0); @@ -21552,74 +21772,68 @@ diff -urNp linux-3.0.4/arch/x86/platform/efi/efi_stub_32.S linux-3.0.4/arch/x86/ efi_rt_function_ptr: diff -urNp linux-3.0.4/arch/x86/platform/efi/efi_stub_64.S linux-3.0.4/arch/x86/platform/efi/efi_stub_64.S --- linux-3.0.4/arch/x86/platform/efi/efi_stub_64.S 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/arch/x86/platform/efi/efi_stub_64.S 2011-09-17 18:31:51.000000000 -0400 -@@ -40,6 +40,9 @@ ENTRY(efi_call0) ++++ linux-3.0.4/arch/x86/platform/efi/efi_stub_64.S 2011-10-06 04:17:55.000000000 -0400 +@@ -7,6 +7,7 @@ + */ + + #include <linux/linkage.h> ++#include <asm/alternative-asm.h> + + #define SAVE_XMM \ + mov %rsp, %rax; \ +@@ -40,6 +41,7 @@ ENTRY(efi_call0) call *%rdi addq $32, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call0) -@@ -50,6 +53,9 @@ ENTRY(efi_call1) +@@ -50,6 +52,7 @@ ENTRY(efi_call1) call *%rdi addq $32, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call1) -@@ -60,6 +66,9 @@ ENTRY(efi_call2) +@@ -60,6 +63,7 @@ ENTRY(efi_call2) call *%rdi addq $32, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call2) -@@ -71,6 +80,9 @@ ENTRY(efi_call3) +@@ -71,6 +75,7 @@ ENTRY(efi_call3) call *%rdi addq $32, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call3) -@@ -83,6 +95,9 @@ ENTRY(efi_call4) +@@ -83,6 +88,7 @@ ENTRY(efi_call4) call *%rdi addq $32, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call4) -@@ -96,6 +111,9 @@ ENTRY(efi_call5) +@@ -96,6 +102,7 @@ ENTRY(efi_call5) call *%rdi addq $48, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call5) -@@ -112,5 +130,8 @@ ENTRY(efi_call6) +@@ -112,5 +119,6 @@ ENTRY(efi_call6) call *%rdi addq $48, %rsp RESTORE_XMM -+#ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+ orb $0x80, 0x7(%rsp) -+#endif ++ pax_force_retaddr ret ENDPROC(efi_call6) diff -urNp linux-3.0.4/arch/x86/platform/mrst/mrst.c linux-3.0.4/arch/x86/platform/mrst/mrst.c @@ -22136,7 +22350,7 @@ diff -urNp linux-3.0.4/block/blk-softirq.c linux-3.0.4/block/blk-softirq.c diff -urNp linux-3.0.4/block/bsg.c linux-3.0.4/block/bsg.c --- linux-3.0.4/block/bsg.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/block/bsg.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/block/bsg.c 2011-10-06 04:17:55.000000000 -0400 @@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r struct sg_io_v4 *hdr, struct bsg_device *bd, fmode_t has_write_perm) @@ -22154,7 +22368,7 @@ diff -urNp linux-3.0.4/block/bsg.c linux-3.0.4/block/bsg.c + cmdptr = tmpcmd; - if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request, -+ if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request, ++ if (copy_from_user(cmdptr, (void __user *)(unsigned long)hdr->request, hdr->request_len)) return -EFAULT; @@ -22164,6 +22378,58 @@ diff -urNp linux-3.0.4/block/bsg.c linux-3.0.4/block/bsg.c if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) { if (blk_verify_command(rq->cmd, has_write_perm)) return -EPERM; +@@ -249,7 +257,7 @@ bsg_map_hdr(struct bsg_device *bd, struc + struct request *rq, *next_rq = NULL; + int ret, rw; + unsigned int dxfer_len; +- void *dxferp = NULL; ++ void __user *dxferp = NULL; + struct bsg_class_device *bcd = &q->bsg_dev; + + /* if the LLD has been removed then the bsg_unregister_queue will +@@ -291,7 +299,7 @@ bsg_map_hdr(struct bsg_device *bd, struc + rq->next_rq = next_rq; + next_rq->cmd_type = rq->cmd_type; + +- dxferp = (void*)(unsigned long)hdr->din_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->din_xferp; + ret = blk_rq_map_user(q, next_rq, NULL, dxferp, + hdr->din_xfer_len, GFP_KERNEL); + if (ret) +@@ -300,10 +308,10 @@ bsg_map_hdr(struct bsg_device *bd, struc + + if (hdr->dout_xfer_len) { + dxfer_len = hdr->dout_xfer_len; +- dxferp = (void*)(unsigned long)hdr->dout_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->dout_xferp; + } else if (hdr->din_xfer_len) { + dxfer_len = hdr->din_xfer_len; +- dxferp = (void*)(unsigned long)hdr->din_xferp; ++ dxferp = (void __user *)(unsigned long)hdr->din_xferp; + } else + dxfer_len = 0; + +@@ -445,7 +453,7 @@ static int blk_complete_sgv4_hdr_rq(stru + int len = min_t(unsigned int, hdr->max_response_len, + rq->sense_len); + +- ret = copy_to_user((void*)(unsigned long)hdr->response, ++ ret = copy_to_user((void __user *)(unsigned long)hdr->response, + rq->sense, len); + if (!ret) + hdr->response_len = len; +diff -urNp linux-3.0.4/block/compat_ioctl.c linux-3.0.4/block/compat_ioctl.c +--- linux-3.0.4/block/compat_ioctl.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/block/compat_ioctl.c 2011-10-06 04:17:55.000000000 -0400 +@@ -354,7 +354,7 @@ static int compat_fd_ioctl(struct block_ + err |= __get_user(f->spec1, &uf->spec1); + err |= __get_user(f->fmt_gap, &uf->fmt_gap); + err |= __get_user(name, &uf->name); +- f->name = compat_ptr(name); ++ f->name = (void __force_kernel *)compat_ptr(name); + if (err) { + err = -EFAULT; + goto out; diff -urNp linux-3.0.4/block/scsi_ioctl.c linux-3.0.4/block/scsi_ioctl.c --- linux-3.0.4/block/scsi_ioctl.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/block/scsi_ioctl.c 2011-08-23 21:47:55.000000000 -0400 @@ -23578,6 +23844,18 @@ diff -urNp linux-3.0.4/drivers/atm/zatm.c linux-3.0.4/drivers/atm/zatm.c wake_up(&zatm_vcc->tx_wait); } +diff -urNp linux-3.0.4/drivers/base/devtmpfs.c linux-3.0.4/drivers/base/devtmpfs.c +--- linux-3.0.4/drivers/base/devtmpfs.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/base/devtmpfs.c 2011-10-06 04:17:55.000000000 -0400 +@@ -357,7 +357,7 @@ int devtmpfs_mount(const char *mntdir) + if (!dev_mnt) + return 0; + +- err = sys_mount("devtmpfs", (char *)mntdir, "devtmpfs", MS_SILENT, NULL); ++ err = sys_mount((char __force_user *)"devtmpfs", (char __force_user *)mntdir, (char __force_user *)"devtmpfs", MS_SILENT, NULL); + if (err) + printk(KERN_INFO "devtmpfs: error mounting %i\n", err); + else diff -urNp linux-3.0.4/drivers/base/power/wakeup.c linux-3.0.4/drivers/base/power/wakeup.c --- linux-3.0.4/drivers/base/power/wakeup.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/base/power/wakeup.c 2011-08-23 21:47:55.000000000 -0400 @@ -23908,7 +24186,7 @@ diff -urNp linux-3.0.4/drivers/block/DAC960.c linux-3.0.4/drivers/block/DAC960.c sizeof(DAC960_SCSI_Inquiry_T) + diff -urNp linux-3.0.4/drivers/block/drbd/drbd_int.h linux-3.0.4/drivers/block/drbd/drbd_int.h --- linux-3.0.4/drivers/block/drbd/drbd_int.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/block/drbd/drbd_int.h 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/block/drbd/drbd_int.h 2011-10-06 04:17:55.000000000 -0400 @@ -737,7 +737,7 @@ struct drbd_request; struct drbd_epoch { struct list_head list; @@ -23927,6 +24205,45 @@ diff -urNp linux-3.0.4/drivers/block/drbd/drbd_int.h linux-3.0.4/drivers/block/d unsigned int peer_seq; spinlock_t peer_seq_lock; unsigned int minor; +@@ -1618,30 +1618,30 @@ static inline int drbd_setsockopt(struct + + static inline void drbd_tcp_cork(struct socket *sock) + { +- int __user val = 1; ++ int val = 1; + (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK, +- (char __user *)&val, sizeof(val)); ++ (char __force_user *)&val, sizeof(val)); + } + + static inline void drbd_tcp_uncork(struct socket *sock) + { +- int __user val = 0; ++ int val = 0; + (void) drbd_setsockopt(sock, SOL_TCP, TCP_CORK, +- (char __user *)&val, sizeof(val)); ++ (char __force_user *)&val, sizeof(val)); + } + + static inline void drbd_tcp_nodelay(struct socket *sock) + { +- int __user val = 1; ++ int val = 1; + (void) drbd_setsockopt(sock, SOL_TCP, TCP_NODELAY, +- (char __user *)&val, sizeof(val)); ++ (char __force_user *)&val, sizeof(val)); + } + + static inline void drbd_tcp_quickack(struct socket *sock) + { +- int __user val = 2; ++ int val = 2; + (void) drbd_setsockopt(sock, SOL_TCP, TCP_QUICKACK, +- (char __user *)&val, sizeof(val)); ++ (char __force_user *)&val, sizeof(val)); + } + + void drbd_bump_write_ordering(struct drbd_conf *mdev, enum write_ordering_e wo); diff -urNp linux-3.0.4/drivers/block/drbd/drbd_main.c linux-3.0.4/drivers/block/drbd/drbd_main.c --- linux-3.0.4/drivers/block/drbd/drbd_main.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/block/drbd/drbd_main.c 2011-08-23 21:47:55.000000000 -0400 @@ -24104,6 +24421,18 @@ diff -urNp linux-3.0.4/drivers/block/drbd/drbd_receiver.c linux-3.0.4/drivers/bl D_ASSERT(list_empty(&mdev->current_epoch->list)); } +diff -urNp linux-3.0.4/drivers/block/loop.c linux-3.0.4/drivers/block/loop.c +--- linux-3.0.4/drivers/block/loop.c 2011-09-02 18:11:26.000000000 -0400 ++++ linux-3.0.4/drivers/block/loop.c 2011-10-06 04:17:55.000000000 -0400 +@@ -283,7 +283,7 @@ static int __do_lo_send_write(struct fil + mm_segment_t old_fs = get_fs(); + + set_fs(get_ds()); +- bw = file->f_op->write(file, buf, len, &pos); ++ bw = file->f_op->write(file, (const char __force_user *)buf, len, &pos); + set_fs(old_fs); + if (likely(bw == len)) + return 0; diff -urNp linux-3.0.4/drivers/block/nbd.c linux-3.0.4/drivers/block/nbd.c --- linux-3.0.4/drivers/block/nbd.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/block/nbd.c 2011-08-23 21:48:14.000000000 -0400 @@ -24543,7 +24872,7 @@ diff -urNp linux-3.0.4/drivers/char/sonypi.c linux-3.0.4/drivers/char/sonypi.c return 0; diff -urNp linux-3.0.4/drivers/char/tpm/tpm_bios.c linux-3.0.4/drivers/char/tpm/tpm_bios.c --- linux-3.0.4/drivers/char/tpm/tpm_bios.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/char/tpm/tpm_bios.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/char/tpm/tpm_bios.c 2011-10-06 04:17:55.000000000 -0400 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start event = addr; @@ -24572,7 +24901,7 @@ diff -urNp linux-3.0.4/drivers/char/tpm/tpm_bios.c linux-3.0.4/drivers/char/tpm/ return 0; } -@@ -410,6 +411,11 @@ static int read_log(struct tpm_bios_log +@@ -410,8 +411,13 @@ static int read_log(struct tpm_bios_log log->bios_event_log_end = log->bios_event_log + len; virt = acpi_os_map_memory(start, len); @@ -24582,8 +24911,11 @@ diff -urNp linux-3.0.4/drivers/char/tpm/tpm_bios.c linux-3.0.4/drivers/char/tpm/ + return -EFAULT; + } - memcpy(log->bios_event_log, virt, len); +- memcpy(log->bios_event_log, virt, len); ++ memcpy(log->bios_event_log, (const char __force_kernel *)virt, len); + acpi_os_unmap_memory(virt, len); + return 0; diff -urNp linux-3.0.4/drivers/char/tpm/tpm.c linux-3.0.4/drivers/char/tpm/tpm.c --- linux-3.0.4/drivers/char/tpm/tpm.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/char/tpm/tpm.c 2011-08-23 21:48:14.000000000 -0400 @@ -24605,6 +24937,27 @@ diff -urNp linux-3.0.4/drivers/char/tpm/tpm.c linux-3.0.4/drivers/char/tpm/tpm.c tpm_cmd.header.in = tpm_readpubek_header; err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, "attempting to read the PUBEK"); +diff -urNp linux-3.0.4/drivers/char/virtio_console.c linux-3.0.4/drivers/char/virtio_console.c +--- linux-3.0.4/drivers/char/virtio_console.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/char/virtio_console.c 2011-10-06 04:17:55.000000000 -0400 +@@ -555,7 +555,7 @@ static ssize_t fill_readbuf(struct port + if (to_user) { + ssize_t ret; + +- ret = copy_to_user(out_buf, buf->buf + buf->offset, out_count); ++ ret = copy_to_user((char __force_user *)out_buf, buf->buf + buf->offset, out_count); + if (ret) + return -EFAULT; + } else { +@@ -654,7 +654,7 @@ static ssize_t port_fops_read(struct fil + if (!port_has_data(port) && !port->host_connected) + return 0; + +- return fill_readbuf(port, ubuf, count, true); ++ return fill_readbuf(port, (char __force_kernel *)ubuf, count, true); + } + + static ssize_t port_fops_write(struct file *filp, const char __user *ubuf, diff -urNp linux-3.0.4/drivers/crypto/hifn_795x.c linux-3.0.4/drivers/crypto/hifn_795x.c --- linux-3.0.4/drivers/crypto/hifn_795x.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/crypto/hifn_795x.c 2011-08-23 21:48:14.000000000 -0400 @@ -24785,7 +25138,7 @@ diff -urNp linux-3.0.4/drivers/firewire/core-transaction.c linux-3.0.4/drivers/f d.payload = payload; diff -urNp linux-3.0.4/drivers/firmware/dmi_scan.c linux-3.0.4/drivers/firmware/dmi_scan.c --- linux-3.0.4/drivers/firmware/dmi_scan.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/firmware/dmi_scan.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/firmware/dmi_scan.c 2011-10-06 04:17:55.000000000 -0400 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void) } } @@ -24798,6 +25151,15 @@ diff -urNp linux-3.0.4/drivers/firmware/dmi_scan.c linux-3.0.4/drivers/firmware/ p = dmi_ioremap(0xF0000, 0x10000); if (p == NULL) goto error; +@@ -725,7 +720,7 @@ int dmi_walk(void (*decode)(const struct + if (buf == NULL) + return -1; + +- dmi_table(buf, dmi_len, dmi_num, decode, private_data); ++ dmi_table((char __force_kernel *)buf, dmi_len, dmi_num, decode, private_data); + + iounmap(buf); + return 0; diff -urNp linux-3.0.4/drivers/gpio/vr41xx_giu.c linux-3.0.4/drivers/gpio/vr41xx_giu.c --- linux-3.0.4/drivers/gpio/vr41xx_giu.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/gpio/vr41xx_giu.c 2011-08-23 21:47:55.000000000 -0400 @@ -24810,6 +25172,101 @@ diff -urNp linux-3.0.4/drivers/gpio/vr41xx_giu.c linux-3.0.4/drivers/gpio/vr41xx return -EINVAL; } +diff -urNp linux-3.0.4/drivers/gpu/drm/drm_crtc.c linux-3.0.4/drivers/gpu/drm/drm_crtc.c +--- linux-3.0.4/drivers/gpu/drm/drm_crtc.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/drm_crtc.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1372,7 +1372,7 @@ int drm_mode_getconnector(struct drm_dev + */ + if ((out_resp->count_modes >= mode_count) && mode_count) { + copied = 0; +- mode_ptr = (struct drm_mode_modeinfo *)(unsigned long)out_resp->modes_ptr; ++ mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr; + list_for_each_entry(mode, &connector->modes, head) { + drm_crtc_convert_to_umode(&u_mode, mode); + if (copy_to_user(mode_ptr + copied, +@@ -1387,8 +1387,8 @@ int drm_mode_getconnector(struct drm_dev + + if ((out_resp->count_props >= props_count) && props_count) { + copied = 0; +- prop_ptr = (uint32_t *)(unsigned long)(out_resp->props_ptr); +- prop_values = (uint64_t *)(unsigned long)(out_resp->prop_values_ptr); ++ prop_ptr = (uint32_t __user *)(unsigned long)(out_resp->props_ptr); ++ prop_values = (uint64_t __user *)(unsigned long)(out_resp->prop_values_ptr); + for (i = 0; i < DRM_CONNECTOR_MAX_PROPERTY; i++) { + if (connector->property_ids[i] != 0) { + if (put_user(connector->property_ids[i], +@@ -1410,7 +1410,7 @@ int drm_mode_getconnector(struct drm_dev + + if ((out_resp->count_encoders >= encoders_count) && encoders_count) { + copied = 0; +- encoder_ptr = (uint32_t *)(unsigned long)(out_resp->encoders_ptr); ++ encoder_ptr = (uint32_t __user *)(unsigned long)(out_resp->encoders_ptr); + for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) { + if (connector->encoder_ids[i] != 0) { + if (put_user(connector->encoder_ids[i], +@@ -1569,7 +1569,7 @@ int drm_mode_setcrtc(struct drm_device * + } + + for (i = 0; i < crtc_req->count_connectors; i++) { +- set_connectors_ptr = (uint32_t *)(unsigned long)crtc_req->set_connectors_ptr; ++ set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr; + if (get_user(out_id, &set_connectors_ptr[i])) { + ret = -EFAULT; + goto out; +@@ -1850,7 +1850,7 @@ int drm_mode_dirtyfb_ioctl(struct drm_de + fb = obj_to_fb(obj); + + num_clips = r->num_clips; +- clips_ptr = (struct drm_clip_rect *)(unsigned long)r->clips_ptr; ++ clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr; + + if (!num_clips != !clips_ptr) { + ret = -EINVAL; +@@ -2270,7 +2270,7 @@ int drm_mode_getproperty_ioctl(struct dr + out_resp->flags = property->flags; + + if ((out_resp->count_values >= value_count) && value_count) { +- values_ptr = (uint64_t *)(unsigned long)out_resp->values_ptr; ++ values_ptr = (uint64_t __user *)(unsigned long)out_resp->values_ptr; + for (i = 0; i < value_count; i++) { + if (copy_to_user(values_ptr + i, &property->values[i], sizeof(uint64_t))) { + ret = -EFAULT; +@@ -2283,7 +2283,7 @@ int drm_mode_getproperty_ioctl(struct dr + if (property->flags & DRM_MODE_PROP_ENUM) { + if ((out_resp->count_enum_blobs >= enum_count) && enum_count) { + copied = 0; +- enum_ptr = (struct drm_mode_property_enum *)(unsigned long)out_resp->enum_blob_ptr; ++ enum_ptr = (struct drm_mode_property_enum __user *)(unsigned long)out_resp->enum_blob_ptr; + list_for_each_entry(prop_enum, &property->enum_blob_list, head) { + + if (copy_to_user(&enum_ptr[copied].value, &prop_enum->value, sizeof(uint64_t))) { +@@ -2306,7 +2306,7 @@ int drm_mode_getproperty_ioctl(struct dr + if ((out_resp->count_enum_blobs >= blob_count) && blob_count) { + copied = 0; + blob_id_ptr = (uint32_t *)(unsigned long)out_resp->enum_blob_ptr; +- blob_length_ptr = (uint32_t *)(unsigned long)out_resp->values_ptr; ++ blob_length_ptr = (uint32_t __user *)(unsigned long)out_resp->values_ptr; + + list_for_each_entry(prop_blob, &property->enum_blob_list, head) { + if (put_user(prop_blob->base.id, blob_id_ptr + copied)) { +@@ -2367,7 +2367,7 @@ int drm_mode_getblob_ioctl(struct drm_de + struct drm_mode_get_blob *out_resp = data; + struct drm_property_blob *blob; + int ret = 0; +- void *blob_ptr; ++ void __user *blob_ptr; + + if (!drm_core_check_feature(dev, DRIVER_MODESET)) + return -EINVAL; +@@ -2381,7 +2381,7 @@ int drm_mode_getblob_ioctl(struct drm_de + blob = obj_to_blob(obj); + + if (out_resp->length == blob->length) { +- blob_ptr = (void *)(unsigned long)out_resp->data; ++ blob_ptr = (void __user *)(unsigned long)out_resp->data; + if (copy_to_user(blob_ptr, blob->data, blob->length)){ + ret = -EFAULT; + goto done; diff -urNp linux-3.0.4/drivers/gpu/drm/drm_crtc_helper.c linux-3.0.4/drivers/gpu/drm/drm_crtc_helper.c --- linux-3.0.4/drivers/gpu/drm/drm_crtc_helper.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/drm_crtc_helper.c 2011-08-23 21:48:14.000000000 -0400 @@ -24833,7 +25290,16 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/drm_crtc_helper.c linux-3.0.4/drivers/gpu return true; diff -urNp linux-3.0.4/drivers/gpu/drm/drm_drv.c linux-3.0.4/drivers/gpu/drm/drm_drv.c --- linux-3.0.4/drivers/gpu/drm/drm_drv.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/gpu/drm/drm_drv.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/drm_drv.c 2011-10-06 04:17:55.000000000 -0400 +@@ -307,7 +307,7 @@ module_exit(drm_core_exit); + /** + * Copy and IOCTL return string to user space + */ +-static int drm_copy_field(char *buf, size_t *buf_len, const char *value) ++static int drm_copy_field(char __user *buf, size_t *buf_len, const char *value) + { + int len; + @@ -386,7 +386,7 @@ long drm_ioctl(struct file *filp, dev = file_priv->minor->dev; @@ -24998,6 +25464,27 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/drm_info.c linux-3.0.4/drivers/gpu/drm/dr #if defined(__i386__) pgprot = pgprot_val(vma->vm_page_prot); +diff -urNp linux-3.0.4/drivers/gpu/drm/drm_ioc32.c linux-3.0.4/drivers/gpu/drm/drm_ioc32.c +--- linux-3.0.4/drivers/gpu/drm/drm_ioc32.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/drm_ioc32.c 2011-10-06 04:17:55.000000000 -0400 +@@ -455,7 +455,7 @@ static int compat_drm_infobufs(struct fi + request = compat_alloc_user_space(nbytes); + if (!access_ok(VERIFY_WRITE, request, nbytes)) + return -EFAULT; +- list = (struct drm_buf_desc *) (request + 1); ++ list = (struct drm_buf_desc __user *) (request + 1); + + if (__put_user(count, &request->count) + || __put_user(list, &request->list)) +@@ -516,7 +516,7 @@ static int compat_drm_mapbufs(struct fil + request = compat_alloc_user_space(nbytes); + if (!access_ok(VERIFY_WRITE, request, nbytes)) + return -EFAULT; +- list = (struct drm_buf_pub *) (request + 1); ++ list = (struct drm_buf_pub __user *) (request + 1); + + if (__put_user(count, &request->count) + || __put_user(list, &request->list)) diff -urNp linux-3.0.4/drivers/gpu/drm/drm_ioctl.c linux-3.0.4/drivers/gpu/drm/drm_ioctl.c --- linux-3.0.4/drivers/gpu/drm/drm_ioctl.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/drm_ioctl.c 2011-08-23 21:47:55.000000000 -0400 @@ -25072,7 +25559,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/i810/i810_drv.h linux-3.0.4/drivers/gpu/d } drm_i810_private_t; diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c --- linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c 2011-10-06 04:17:55.000000000 -0400 @@ -497,7 +497,7 @@ static int i915_interrupt_info(struct se I915_READ(GTIMR)); } @@ -25082,6 +25569,15 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.4/drivers/g for (i = 0; i < I915_NUM_RINGS; i++) { if (IS_GEN6(dev)) { seq_printf(m, "Graphics Interrupt mask (%s): %08x\n", +@@ -1147,7 +1147,7 @@ static int i915_opregion(struct seq_file + return ret; + + if (opregion->header) +- seq_write(m, opregion->header, OPREGION_SIZE); ++ seq_write(m, (const void __force_kernel *)opregion->header, OPREGION_SIZE); + + mutex_unlock(&dev->struct_mutex); + diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c --- linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:47:55.000000000 -0400 @@ -25828,6 +26324,18 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-3.0.4/drivers/g wait_queue_head_t fence_queue; wait_queue_head_t fifo_queue; atomic_t fence_queue_waiters; +diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +--- linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c 2011-10-06 04:17:55.000000000 -0400 +@@ -610,7 +610,7 @@ int vmw_execbuf_ioctl(struct drm_device + struct drm_vmw_fence_rep fence_rep; + struct drm_vmw_fence_rep __user *user_fence_rep; + int ret; +- void *user_cmd; ++ void __user *user_cmd; + void *cmd; + uint32_t sequence; + struct vmw_sw_context *sw_context = &dev_priv->ctx; diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c --- linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c 2011-08-23 21:47:55.000000000 -0400 @@ -25842,7 +26350,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-3.0.4/drivers struct vmw_fence, head); diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c --- linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-08-23 21:47:55.000000000 -0400 ++++ linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c 2011-10-06 04:17:55.000000000 -0400 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de (unsigned int) min, (unsigned int) fifo->capabilities); @@ -25852,6 +26360,15 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-3.0.4/drivers/ iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE); vmw_fence_queue_init(&fifo->fence_queue); return vmw_fifo_send_fence(dev_priv, &dummy); +@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_privat + if (reserveable) + iowrite32(bytes, fifo_mem + + SVGA_FIFO_RESERVED); +- return fifo_mem + (next_cmd >> 2); ++ return (__le32 __force_kernel *)fifo_mem + (next_cmd >> 2); + } else { + need_bounce = true; + } @@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva fm = vmw_fifo_reserve(dev_priv, bytes); @@ -32243,6 +32760,18 @@ diff -urNp linux-3.0.4/drivers/scsi/scsi_sysfs.c linux-3.0.4/drivers/scsi/scsi_s return snprintf(buf, 20, "0x%llx\n", count); \ } \ static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL) +diff -urNp linux-3.0.4/drivers/scsi/scsi_tgt_lib.c linux-3.0.4/drivers/scsi/scsi_tgt_lib.c +--- linux-3.0.4/drivers/scsi/scsi_tgt_lib.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/drivers/scsi/scsi_tgt_lib.c 2011-10-06 04:17:55.000000000 -0400 +@@ -362,7 +362,7 @@ static int scsi_map_user_pages(struct sc + int err; + + dprintk("%lx %u\n", uaddr, len); +- err = blk_rq_map_user(q, rq, NULL, (void *)uaddr, len, GFP_KERNEL); ++ err = blk_rq_map_user(q, rq, NULL, (void __user *)uaddr, len, GFP_KERNEL); + if (err) { + /* + * TODO: need to fixup sg_tablesize, max_segment_size, diff -urNp linux-3.0.4/drivers/scsi/scsi_transport_fc.c linux-3.0.4/drivers/scsi/scsi_transport_fc.c --- linux-3.0.4/drivers/scsi/scsi_transport_fc.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/drivers/scsi/scsi_transport_fc.c 2011-08-23 21:47:56.000000000 -0400 @@ -32344,7 +32873,16 @@ diff -urNp linux-3.0.4/drivers/scsi/scsi_transport_srp.c linux-3.0.4/drivers/scs transport_setup_device(&rport->dev); diff -urNp linux-3.0.4/drivers/scsi/sg.c linux-3.0.4/drivers/scsi/sg.c --- linux-3.0.4/drivers/scsi/sg.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/drivers/scsi/sg.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/drivers/scsi/sg.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1075,7 +1075,7 @@ sg_ioctl(struct file *filp, unsigned int + sdp->disk->disk_name, + MKDEV(SCSI_GENERIC_MAJOR, sdp->index), + NULL, +- (char *)arg); ++ (char __user *)arg); + case BLKTRACESTART: + return blk_trace_startstop(sdp->device->request_queue, 1); + case BLKTRACESTOP: @@ -2310,7 +2310,7 @@ struct sg_proc_leaf { const struct file_operations * fops; }; @@ -37190,6 +37728,18 @@ diff -urNp linux-3.0.4/fs/attr.c linux-3.0.4/fs/attr.c if (limit != RLIM_INFINITY && offset > limit) goto out_sig; if (offset > inode->i_sb->s_maxbytes) +diff -urNp linux-3.0.4/fs/autofs4/waitq.c linux-3.0.4/fs/autofs4/waitq.c +--- linux-3.0.4/fs/autofs4/waitq.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/fs/autofs4/waitq.c 2011-10-06 04:17:55.000000000 -0400 +@@ -60,7 +60,7 @@ static int autofs4_write(struct file *fi + { + unsigned long sigpipe, flags; + mm_segment_t fs; +- const char *data = (const char *)addr; ++ const char __user *data = (const char __force_user *)addr; + ssize_t wr = 0; + + /** WARNING: this is not safe for writing more than PIPE_BUF bytes! **/ diff -urNp linux-3.0.4/fs/befs/linuxvfs.c linux-3.0.4/fs/befs/linuxvfs.c --- linux-3.0.4/fs/befs/linuxvfs.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/fs/befs/linuxvfs.c 2011-08-29 23:26:27.000000000 -0400 @@ -38024,13 +38574,13 @@ diff -urNp linux-3.0.4/fs/binfmt_flat.c linux-3.0.4/fs/binfmt_flat.c } diff -urNp linux-3.0.4/fs/bio.c linux-3.0.4/fs/bio.c --- linux-3.0.4/fs/bio.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/bio.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/fs/bio.c 2011-10-06 04:17:55.000000000 -0400 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b const int read = bio_data_dir(bio) == READ; struct bio_map_data *bmd = bio->bi_private; int i; - char *p = bmd->sgvecs[0].iov_base; -+ char *p = (__force char *)bmd->sgvecs[0].iov_base; ++ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base; __bio_for_each_segment(bvec, bio, i, 0) { char *addr = page_address(bvec->bv_page); @@ -38094,7 +38644,7 @@ diff -urNp linux-3.0.4/fs/btrfs/inode.c linux-3.0.4/fs/btrfs/inode.c * directory. diff -urNp linux-3.0.4/fs/btrfs/ioctl.c linux-3.0.4/fs/btrfs/ioctl.c --- linux-3.0.4/fs/btrfs/ioctl.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/btrfs/ioctl.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/btrfs/ioctl.c 2011-10-06 04:17:55.000000000 -0400 @@ -2676,9 +2676,12 @@ long btrfs_ioctl_space_info(struct btrfs for (i = 0; i < num_types; i++) { struct btrfs_space_info *tmp; @@ -38108,7 +38658,7 @@ diff -urNp linux-3.0.4/fs/btrfs/ioctl.c linux-3.0.4/fs/btrfs/ioctl.c info = NULL; rcu_read_lock(); list_for_each_entry_rcu(tmp, &root->fs_info->space_info, -@@ -2700,10 +2703,7 @@ long btrfs_ioctl_space_info(struct btrfs +@@ -2700,15 +2703,12 @@ long btrfs_ioctl_space_info(struct btrfs memcpy(dest, &space, sizeof(space)); dest++; space_args.total_spaces++; @@ -38119,6 +38669,12 @@ diff -urNp linux-3.0.4/fs/btrfs/ioctl.c linux-3.0.4/fs/btrfs/ioctl.c } up_read(&info->groups_sem); } + +- user_dest = (struct btrfs_ioctl_space_info *) ++ user_dest = (struct btrfs_ioctl_space_info __user *) + (arg + sizeof(struct btrfs_ioctl_space_args)); + + if (copy_to_user(user_dest, dest_orig, alloc_size)) diff -urNp linux-3.0.4/fs/btrfs/relocation.c linux-3.0.4/fs/btrfs/relocation.c --- linux-3.0.4/fs/btrfs/relocation.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/fs/btrfs/relocation.c 2011-08-23 21:47:56.000000000 -0400 @@ -38269,13 +38825,13 @@ diff -urNp linux-3.0.4/fs/cachefiles/proc.c linux-3.0.4/fs/cachefiles/proc.c diff -urNp linux-3.0.4/fs/cachefiles/rdwr.c linux-3.0.4/fs/cachefiles/rdwr.c --- linux-3.0.4/fs/cachefiles/rdwr.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/cachefiles/rdwr.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/fs/cachefiles/rdwr.c 2011-10-06 04:17:55.000000000 -0400 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache old_fs = get_fs(); set_fs(KERNEL_DS); ret = file->f_op->write( - file, (const void __user *) data, len, &pos); -+ file, (__force const void __user *) data, len, &pos); ++ file, (const void __force_user *) data, len, &pos); set_fs(old_fs); kunmap(page); if (ret != len) @@ -38628,7 +39184,27 @@ diff -urNp linux-3.0.4/fs/compat_binfmt_elf.c linux-3.0.4/fs/compat_binfmt_elf.c /* diff -urNp linux-3.0.4/fs/compat.c linux-3.0.4/fs/compat.c --- linux-3.0.4/fs/compat.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/compat.c 2011-08-23 22:49:33.000000000 -0400 ++++ linux-3.0.4/fs/compat.c 2011-10-06 04:17:55.000000000 -0400 +@@ -133,8 +133,8 @@ asmlinkage long compat_sys_utimes(const + static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf) + { + compat_ino_t ino = stat->ino; +- typeof(ubuf->st_uid) uid = 0; +- typeof(ubuf->st_gid) gid = 0; ++ typeof(((struct compat_stat *)0)->st_uid) uid = 0; ++ typeof(((struct compat_stat *)0)->st_gid) gid = 0; + int err; + + SET_UID(uid, stat->uid); +@@ -508,7 +508,7 @@ compat_sys_io_setup(unsigned nr_reqs, u3 + + set_fs(KERNEL_DS); + /* The __user pointer cast is valid because of the set_fs() */ +- ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64); ++ ret = sys_io_setup(nr_reqs, (aio_context_t __force_user *) &ctx64); + set_fs(oldfs); + /* truncating is ok because it's a user address */ + if (!ret) @@ -566,7 +566,7 @@ ssize_t compat_rw_copy_check_uvector(int goto out; @@ -38711,7 +39287,7 @@ diff -urNp linux-3.0.4/fs/compat.c linux-3.0.4/fs/compat.c dirent = buf->previous; if (dirent) { -@@ -1073,6 +1090,7 @@ asmlinkage long compat_sys_getdents64(un +@@ -1073,13 +1090,14 @@ asmlinkage long compat_sys_getdents64(un buf.previous = NULL; buf.count = count; buf.error = 0; @@ -38719,6 +39295,14 @@ diff -urNp linux-3.0.4/fs/compat.c linux-3.0.4/fs/compat.c error = vfs_readdir(file, compat_filldir64, &buf); if (error >= 0) + error = buf.error; + lastdirent = buf.previous; + if (lastdirent) { +- typeof(lastdirent->d_off) d_off = file->f_pos; ++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos; + if (__put_user_unaligned(d_off, &lastdirent->d_off)) + error = -EFAULT; + else @@ -1446,6 +1464,8 @@ int compat_core_sys_select(int n, compat struct fdtable *fdt; long stack_fds[SELECT_STACK_ALLOC/sizeof(long)]; @@ -38728,9 +39312,18 @@ diff -urNp linux-3.0.4/fs/compat.c linux-3.0.4/fs/compat.c if (n < 0) goto out_nofds; +@@ -1904,7 +1924,7 @@ asmlinkage long compat_sys_nfsservctl(in + oldfs = get_fs(); + set_fs(KERNEL_DS); + /* The __user pointer casts are valid because of the set_fs() */ +- err = sys_nfsservctl(cmd, (void __user *) karg, (void __user *) kres); ++ err = sys_nfsservctl(cmd, (void __force_user *) karg, (void __force_user *) kres); + set_fs(oldfs); + + if (err) diff -urNp linux-3.0.4/fs/compat_ioctl.c linux-3.0.4/fs/compat_ioctl.c --- linux-3.0.4/fs/compat_ioctl.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/compat_ioctl.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/fs/compat_ioctl.c 2011-10-06 04:17:55.000000000 -0400 @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi err = get_user(palp, &up->palette); @@ -38740,6 +39333,24 @@ diff -urNp linux-3.0.4/fs/compat_ioctl.c linux-3.0.4/fs/compat_ioctl.c up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); err = put_user(compat_ptr(palp), &up_native->palette); +@@ -619,7 +621,7 @@ static int serial_struct_ioctl(unsigned + return -EFAULT; + if (__get_user(udata, &ss32->iomem_base)) + return -EFAULT; +- ss.iomem_base = compat_ptr(udata); ++ ss.iomem_base = (unsigned char __force_kernel *)compat_ptr(udata); + if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) || + __get_user(ss.port_high, &ss32->port_high)) + return -EFAULT; +@@ -794,7 +796,7 @@ static int compat_ioctl_preallocate(stru + copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) || + copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) || + copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) || +- copy_in_user(&p->l_pad, &p32->l_pad, 4*sizeof(u32))) ++ copy_in_user(p->l_pad, &p32->l_pad, 4*sizeof(u32))) + return -EFAULT; + + return ioctl_preallocate(file, p); @@ -1638,8 +1640,8 @@ asmlinkage long compat_sys_ioctl(unsigne static int __init init_sys32_ioctl_cmp(const void *p, const void *q) { @@ -38792,13 +39403,13 @@ diff -urNp linux-3.0.4/fs/dcache.c linux-3.0.4/fs/dcache.c inode_init(); diff -urNp linux-3.0.4/fs/ecryptfs/inode.c linux-3.0.4/fs/ecryptfs/inode.c --- linux-3.0.4/fs/ecryptfs/inode.c 2011-09-02 18:11:21.000000000 -0400 -+++ linux-3.0.4/fs/ecryptfs/inode.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/fs/ecryptfs/inode.c 2011-10-06 04:17:55.000000000 -0400 @@ -704,7 +704,7 @@ static int ecryptfs_readlink_lower(struc old_fs = get_fs(); set_fs(get_ds()); rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, - (char __user *)lower_buf, -+ (__force char __user *)lower_buf, ++ (char __force_user *)lower_buf, lower_bufsiz); set_fs(old_fs); if (rc < 0) @@ -38807,7 +39418,7 @@ diff -urNp linux-3.0.4/fs/ecryptfs/inode.c linux-3.0.4/fs/ecryptfs/inode.c old_fs = get_fs(); set_fs(get_ds()); - rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); -+ rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len); ++ rc = dentry->d_inode->i_op->readlink(dentry, (char __force_user *)buf, len); set_fs(old_fs); if (rc < 0) { kfree(buf); @@ -38832,9 +39443,30 @@ diff -urNp linux-3.0.4/fs/ecryptfs/miscdev.c linux-3.0.4/fs/ecryptfs/miscdev.c goto out_unlock_msg_ctx; i += packet_length_size; if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size)) +diff -urNp linux-3.0.4/fs/ecryptfs/read_write.c linux-3.0.4/fs/ecryptfs/read_write.c +--- linux-3.0.4/fs/ecryptfs/read_write.c 2011-09-02 18:11:21.000000000 -0400 ++++ linux-3.0.4/fs/ecryptfs/read_write.c 2011-10-06 04:17:55.000000000 -0400 +@@ -48,7 +48,7 @@ int ecryptfs_write_lower(struct inode *e + return -EIO; + fs_save = get_fs(); + set_fs(get_ds()); +- rc = vfs_write(lower_file, data, size, &offset); ++ rc = vfs_write(lower_file, (const char __force_user *)data, size, &offset); + set_fs(fs_save); + mark_inode_dirty_sync(ecryptfs_inode); + return rc; +@@ -235,7 +235,7 @@ int ecryptfs_read_lower(char *data, loff + return -EIO; + fs_save = get_fs(); + set_fs(get_ds()); +- rc = vfs_read(lower_file, data, size, &offset); ++ rc = vfs_read(lower_file, (char __force_user *)data, size, &offset); + set_fs(fs_save); + return rc; + } diff -urNp linux-3.0.4/fs/exec.c linux-3.0.4/fs/exec.c --- linux-3.0.4/fs/exec.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/exec.c 2011-08-25 17:26:58.000000000 -0400 ++++ linux-3.0.4/fs/exec.c 2011-10-06 04:17:55.000000000 -0400 @@ -55,12 +55,24 @@ #include <linux/pipe_fs_i.h> #include <linux/oom.h> @@ -38946,12 +39578,47 @@ diff -urNp linux-3.0.4/fs/exec.c linux-3.0.4/fs/exec.c { const char __user *native; +@@ -424,14 +427,14 @@ static const char __user *get_user_arg_p + compat_uptr_t compat; + + if (get_user(compat, argv.ptr.compat + nr)) +- return ERR_PTR(-EFAULT); ++ return (const char __force_user *)ERR_PTR(-EFAULT); + + return compat_ptr(compat); + } + #endif + + if (get_user(native, argv.ptr.native + nr)) +- return ERR_PTR(-EFAULT); ++ return (const char __force_user *)ERR_PTR(-EFAULT); + + return native; + } +@@ -450,7 +453,7 @@ static int count(struct user_arg_ptr arg + if (!p) + break; + +- if (IS_ERR(p)) ++ if (IS_ERR((const char __force_kernel *)p)) + return -EFAULT; + + if (i++ >= max) +@@ -484,7 +487,7 @@ static int copy_strings(int argc, struct + + ret = -EFAULT; + str = get_user_arg_ptr(argv, argc); +- if (IS_ERR(str)) ++ if (IS_ERR((const char __force_kernel *)str)) + goto out; + + len = strnlen_user(str, MAX_ARG_STRLEN); @@ -566,7 +569,7 @@ int copy_strings_kernel(int argc, const int r; mm_segment_t oldfs = get_fs(); struct user_arg_ptr argv = { - .ptr.native = (const char __user *const __user *)__argv, -+ .ptr.native = (__force const char __user *const __user *)__argv, ++ .ptr.native = (const char __force_user *const __force_user *)__argv, }; set_fs(KERNEL_DS); @@ -39044,7 +39711,7 @@ diff -urNp linux-3.0.4/fs/exec.c linux-3.0.4/fs/exec.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - result = vfs_read(file, (void __user *)addr, count, &pos); -+ result = vfs_read(file, (__force void __user *)addr, count, &pos); ++ result = vfs_read(file, (void __force_user *)addr, count, &pos); set_fs(old_fs); return result; } @@ -39474,6 +40141,15 @@ diff -urNp linux-3.0.4/fs/exec.c linux-3.0.4/fs/exec.c fail_unlock: kfree(cn.corename); fail_corename: +@@ -2211,7 +2519,7 @@ fail: + */ + int dump_write(struct file *file, const void *addr, int nr) + { +- return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr; ++ return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, (const char __force_user *)addr, nr, &file->f_pos) == nr; + } + EXPORT_SYMBOL(dump_write); + diff -urNp linux-3.0.4/fs/ext2/balloc.c linux-3.0.4/fs/ext2/balloc.c --- linux-3.0.4/fs/ext2/balloc.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/fs/ext2/balloc.c 2011-08-23 21:48:14.000000000 -0400 @@ -39498,6 +40174,27 @@ diff -urNp linux-3.0.4/fs/ext3/balloc.c linux-3.0.4/fs/ext3/balloc.c sbi->s_resuid != current_fsuid() && (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) { return 0; +diff -urNp linux-3.0.4/fs/ext3/ioctl.c linux-3.0.4/fs/ext3/ioctl.c +--- linux-3.0.4/fs/ext3/ioctl.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/fs/ext3/ioctl.c 2011-10-06 04:17:55.000000000 -0400 +@@ -285,7 +285,7 @@ group_add_out: + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- if (copy_from_user(&range, (struct fstrim_range *)arg, ++ if (copy_from_user(&range, (struct fstrim_range __user *)arg, + sizeof(range))) + return -EFAULT; + +@@ -293,7 +293,7 @@ group_add_out: + if (ret < 0) + return ret; + +- if (copy_to_user((struct fstrim_range *)arg, &range, ++ if (copy_to_user((struct fstrim_range __user *)arg, &range, + sizeof(range))) + return -EFAULT; + diff -urNp linux-3.0.4/fs/ext4/balloc.c linux-3.0.4/fs/ext4/balloc.c --- linux-3.0.4/fs/ext4/balloc.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/fs/ext4/balloc.c 2011-08-23 21:48:14.000000000 -0400 @@ -39545,6 +40242,27 @@ diff -urNp linux-3.0.4/fs/ext4/ext4.h linux-3.0.4/fs/ext4/ext4.h atomic_t s_lock_busy; /* locality groups */ +diff -urNp linux-3.0.4/fs/ext4/ioctl.c linux-3.0.4/fs/ext4/ioctl.c +--- linux-3.0.4/fs/ext4/ioctl.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/fs/ext4/ioctl.c 2011-10-06 04:17:55.000000000 -0400 +@@ -344,7 +344,7 @@ mext_out: + if (!blk_queue_discard(q)) + return -EOPNOTSUPP; + +- if (copy_from_user(&range, (struct fstrim_range *)arg, ++ if (copy_from_user(&range, (struct fstrim_range __user *)arg, + sizeof(range))) + return -EFAULT; + +@@ -354,7 +354,7 @@ mext_out: + if (ret < 0) + return ret; + +- if (copy_to_user((struct fstrim_range *)arg, &range, ++ if (copy_to_user((struct fstrim_range __user *)arg, &range, + sizeof(range))) + return -EFAULT; + diff -urNp linux-3.0.4/fs/ext4/mballoc.c linux-3.0.4/fs/ext4/mballoc.c --- linux-3.0.4/fs/ext4/mballoc.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/ext4/mballoc.c 2011-08-23 21:48:14.000000000 -0400 @@ -39672,7 +40390,7 @@ diff -urNp linux-3.0.4/fs/ext4/mballoc.c linux-3.0.4/fs/ext4/mballoc.c return 0; diff -urNp linux-3.0.4/fs/fcntl.c linux-3.0.4/fs/fcntl.c --- linux-3.0.4/fs/fcntl.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/fcntl.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/fcntl.c 2011-10-06 04:17:55.000000000 -0400 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct if (err) return err; @@ -39685,6 +40403,24 @@ diff -urNp linux-3.0.4/fs/fcntl.c linux-3.0.4/fs/fcntl.c f_modown(filp, pid, type, force); return 0; } +@@ -266,7 +271,7 @@ pid_t f_getown(struct file *filp) + + static int f_setown_ex(struct file *filp, unsigned long arg) + { +- struct f_owner_ex * __user owner_p = (void * __user)arg; ++ struct f_owner_ex __user *owner_p = (void __user *)arg; + struct f_owner_ex owner; + struct pid *pid; + int type; +@@ -306,7 +311,7 @@ static int f_setown_ex(struct file *filp + + static int f_getown_ex(struct file *filp, unsigned long arg) + { +- struct f_owner_ex * __user owner_p = (void * __user)arg; ++ struct f_owner_ex __user *owner_p = (void __user *)arg; + struct f_owner_ex owner; + int ret = 0; + @@ -348,6 +353,7 @@ static long do_fcntl(int fd, unsigned in switch (cmd) { case F_DUPFD: @@ -41609,7 +42345,7 @@ diff -urNp linux-3.0.4/fs/logfs/super.c linux-3.0.4/fs/logfs/super.c if (err) diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c --- linux-3.0.4/fs/namei.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/namei.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/namei.c 2011-10-06 03:40:11.000000000 -0400 @@ -237,21 +237,31 @@ int generic_permission(struct inode *ino return ret; @@ -41680,7 +42416,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c return ret; ok: -@@ -703,11 +723,19 @@ follow_link(struct path *link, struct na +@@ -703,11 +723,26 @@ follow_link(struct path *link, struct na return error; } @@ -41692,6 +42428,13 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c + return error; + } + ++ if (!gr_acl_handle_hidden_file(dentry, nd->path.mnt)) { ++ error = -ENOENT; ++ *p = ERR_PTR(error); /* no ->put_link(), please */ ++ path_put(&nd->path); ++ return error; ++ } ++ nd->last_type = LAST_BIND; *p = dentry->d_inode->i_op->follow_link(dentry, nd); error = PTR_ERR(*p); @@ -41701,7 +42444,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = 0; if (s) error = __vfs_follow_link(nd, s); -@@ -1625,6 +1653,9 @@ static int do_path_lookup(int dfd, const +@@ -1625,6 +1660,9 @@ static int do_path_lookup(int dfd, const retval = path_lookupat(dfd, name, flags | LOOKUP_REVAL, nd); if (likely(!retval)) { @@ -41711,7 +42454,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c if (unlikely(!audit_dummy_context())) { if (nd->path.dentry && nd->inode) audit_inode(name, nd->path.dentry); -@@ -1935,6 +1966,30 @@ int vfs_create(struct inode *dir, struct +@@ -1935,6 +1973,30 @@ int vfs_create(struct inode *dir, struct return error; } @@ -41742,7 +42485,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c static int may_open(struct path *path, int acc_mode, int flag) { struct dentry *dentry = path->dentry; -@@ -1987,7 +2042,27 @@ static int may_open(struct path *path, i +@@ -1987,7 +2049,27 @@ static int may_open(struct path *path, i /* * Ensure there are no outstanding leases on the file. */ @@ -41771,7 +42514,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c } static int handle_truncate(struct file *filp) -@@ -2013,30 +2088,6 @@ static int handle_truncate(struct file * +@@ -2013,30 +2095,6 @@ static int handle_truncate(struct file * } /* @@ -41802,7 +42545,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c * Handle the last step of open() */ static struct file *do_last(struct nameidata *nd, struct path *path, -@@ -2045,6 +2096,7 @@ static struct file *do_last(struct namei +@@ -2045,6 +2103,7 @@ static struct file *do_last(struct namei struct dentry *dir = nd->path.dentry; struct dentry *dentry; int open_flag = op->open_flag; @@ -41810,7 +42553,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c int will_truncate = open_flag & O_TRUNC; int want_write = 0; int acc_mode = op->acc_mode; -@@ -2132,6 +2184,12 @@ static struct file *do_last(struct namei +@@ -2132,6 +2191,12 @@ static struct file *do_last(struct namei /* Negative dentry, just create the file */ if (!dentry->d_inode) { int mode = op->mode; @@ -41823,7 +42566,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c if (!IS_POSIXACL(dir->d_inode)) mode &= ~current_umask(); /* -@@ -2155,6 +2213,8 @@ static struct file *do_last(struct namei +@@ -2155,6 +2220,8 @@ static struct file *do_last(struct namei error = vfs_create(dir->d_inode, dentry, mode, nd); if (error) goto exit_mutex_unlock; @@ -41832,7 +42575,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c mutex_unlock(&dir->d_inode->i_mutex); dput(nd->path.dentry); nd->path.dentry = dentry; -@@ -2164,6 +2224,14 @@ static struct file *do_last(struct namei +@@ -2164,6 +2231,14 @@ static struct file *do_last(struct namei /* * It already exists. */ @@ -41847,7 +42590,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c mutex_unlock(&dir->d_inode->i_mutex); audit_inode(pathname, path->dentry); -@@ -2450,6 +2518,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const +@@ -2450,6 +2525,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const error = may_mknod(mode); if (error) goto out_dput; @@ -41865,7 +42608,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2470,6 +2549,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const +@@ -2470,6 +2556,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const } out_drop_write: mnt_drop_write(nd.path.mnt); @@ -41875,7 +42618,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c out_dput: dput(dentry); out_unlock: -@@ -2522,6 +2604,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const +@@ -2522,6 +2611,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const if (IS_ERR(dentry)) goto out_unlock; @@ -41887,7 +42630,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c if (!IS_POSIXACL(nd.path.dentry->d_inode)) mode &= ~current_umask(); error = mnt_want_write(nd.path.mnt); -@@ -2533,6 +2620,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const +@@ -2533,6 +2627,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode); out_drop_write: mnt_drop_write(nd.path.mnt); @@ -41898,7 +42641,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c out_dput: dput(dentry); out_unlock: -@@ -2613,6 +2704,8 @@ static long do_rmdir(int dfd, const char +@@ -2613,6 +2711,8 @@ static long do_rmdir(int dfd, const char char * name; struct dentry *dentry; struct nameidata nd; @@ -41907,7 +42650,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2641,6 +2734,17 @@ static long do_rmdir(int dfd, const char +@@ -2641,6 +2741,17 @@ static long do_rmdir(int dfd, const char error = -ENOENT; goto exit3; } @@ -41925,7 +42668,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto exit3; -@@ -2648,6 +2752,8 @@ static long do_rmdir(int dfd, const char +@@ -2648,6 +2759,8 @@ static long do_rmdir(int dfd, const char if (error) goto exit4; error = vfs_rmdir(nd.path.dentry->d_inode, dentry); @@ -41934,7 +42677,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c exit4: mnt_drop_write(nd.path.mnt); exit3: -@@ -2710,6 +2816,8 @@ static long do_unlinkat(int dfd, const c +@@ -2710,6 +2823,8 @@ static long do_unlinkat(int dfd, const c struct dentry *dentry; struct nameidata nd; struct inode *inode = NULL; @@ -41943,7 +42686,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = user_path_parent(dfd, pathname, &nd, &name); if (error) -@@ -2732,6 +2840,16 @@ static long do_unlinkat(int dfd, const c +@@ -2732,6 +2847,16 @@ static long do_unlinkat(int dfd, const c if (!inode) goto slashes; ihold(inode); @@ -41960,7 +42703,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto exit2; -@@ -2739,6 +2857,8 @@ static long do_unlinkat(int dfd, const c +@@ -2739,6 +2864,8 @@ static long do_unlinkat(int dfd, const c if (error) goto exit3; error = vfs_unlink(nd.path.dentry->d_inode, dentry); @@ -41969,7 +42712,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c exit3: mnt_drop_write(nd.path.mnt); exit2: -@@ -2816,6 +2936,11 @@ SYSCALL_DEFINE3(symlinkat, const char __ +@@ -2816,6 +2943,11 @@ SYSCALL_DEFINE3(symlinkat, const char __ if (IS_ERR(dentry)) goto out_unlock; @@ -41981,7 +42724,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2823,6 +2948,8 @@ SYSCALL_DEFINE3(symlinkat, const char __ +@@ -2823,6 +2955,8 @@ SYSCALL_DEFINE3(symlinkat, const char __ if (error) goto out_drop_write; error = vfs_symlink(nd.path.dentry->d_inode, dentry, from); @@ -41990,7 +42733,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c out_drop_write: mnt_drop_write(nd.path.mnt); out_dput: -@@ -2931,6 +3058,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con +@@ -2931,6 +3065,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con error = PTR_ERR(new_dentry); if (IS_ERR(new_dentry)) goto out_unlock; @@ -42011,7 +42754,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(nd.path.mnt); if (error) goto out_dput; -@@ -2938,6 +3079,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con +@@ -2938,6 +3086,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con if (error) goto out_drop_write; error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry); @@ -42020,7 +42763,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c out_drop_write: mnt_drop_write(nd.path.mnt); out_dput: -@@ -3113,6 +3256,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -3113,6 +3263,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c char *to; int error; @@ -42029,7 +42772,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = user_path_parent(olddfd, oldname, &oldnd, &from); if (error) goto exit; -@@ -3169,6 +3314,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -3169,6 +3321,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c if (new_dentry == trap) goto exit5; @@ -42042,7 +42785,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c error = mnt_want_write(oldnd.path.mnt); if (error) goto exit5; -@@ -3178,6 +3329,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c +@@ -3178,6 +3336,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c goto exit6; error = vfs_rename(old_dir->d_inode, old_dentry, new_dir->d_inode, new_dentry); @@ -42052,7 +42795,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c exit6: mnt_drop_write(oldnd.path.mnt); exit5: -@@ -3203,6 +3357,8 @@ SYSCALL_DEFINE2(rename, const char __use +@@ -3203,6 +3364,8 @@ SYSCALL_DEFINE2(rename, const char __use int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link) { @@ -42061,7 +42804,7 @@ diff -urNp linux-3.0.4/fs/namei.c linux-3.0.4/fs/namei.c int len; len = PTR_ERR(link); -@@ -3212,7 +3368,14 @@ int vfs_readlink(struct dentry *dentry, +@@ -3212,7 +3375,14 @@ int vfs_readlink(struct dentry *dentry, len = strlen(link); if (len > (unsigned) buflen) len = buflen; @@ -42257,13 +43000,13 @@ diff -urNp linux-3.0.4/fs/nfsd/nfs4xdr.c linux-3.0.4/fs/nfsd/nfs4xdr.c BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion)); diff -urNp linux-3.0.4/fs/nfsd/vfs.c linux-3.0.4/fs/nfsd/vfs.c --- linux-3.0.4/fs/nfsd/vfs.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/nfsd/vfs.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/fs/nfsd/vfs.c 2011-10-06 04:17:55.000000000 -0400 @@ -896,7 +896,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st } else { oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset); -+ host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset); ++ host_err = vfs_readv(file, (struct iovec __force_user *)vec, vlen, &offset); set_fs(oldfs); } @@ -42272,7 +43015,7 @@ diff -urNp linux-3.0.4/fs/nfsd/vfs.c linux-3.0.4/fs/nfsd/vfs.c /* Write the data. */ oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset); -+ host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset); ++ host_err = vfs_writev(file, (struct iovec __force_user *)vec, vlen, &offset); set_fs(oldfs); if (host_err < 0) goto out_nfserr; @@ -42281,7 +43024,7 @@ diff -urNp linux-3.0.4/fs/nfsd/vfs.c linux-3.0.4/fs/nfsd/vfs.c oldfs = get_fs(); set_fs(KERNEL_DS); - host_err = inode->i_op->readlink(dentry, buf, *lenp); -+ host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp); ++ host_err = inode->i_op->readlink(dentry, (char __force_user *)buf, *lenp); set_fs(oldfs); if (host_err < 0) @@ -43793,7 +44536,7 @@ diff -urNp linux-3.0.4/fs/quota/netlink.c linux-3.0.4/fs/quota/netlink.c printk(KERN_ERR diff -urNp linux-3.0.4/fs/readdir.c linux-3.0.4/fs/readdir.c --- linux-3.0.4/fs/readdir.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/readdir.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/readdir.c 2011-10-06 04:17:55.000000000 -0400 @@ -17,6 +17,7 @@ #include <linux/security.h> #include <linux/syscalls.h> @@ -43883,6 +44626,15 @@ diff -urNp linux-3.0.4/fs/readdir.c linux-3.0.4/fs/readdir.c buf.count = count; buf.error = 0; +@@ -299,7 +318,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int + error = buf.error; + lastdirent = buf.previous; + if (lastdirent) { +- typeof(lastdirent->d_off) d_off = file->f_pos; ++ typeof(((struct linux_dirent64 *)0)->d_off) d_off = file->f_pos; + if (__put_user(d_off, &lastdirent->d_off)) + error = -EFAULT; + else diff -urNp linux-3.0.4/fs/reiserfs/dir.c linux-3.0.4/fs/reiserfs/dir.c --- linux-3.0.4/fs/reiserfs/dir.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/fs/reiserfs/dir.c 2011-08-23 21:48:14.000000000 -0400 @@ -44105,7 +44857,7 @@ diff -urNp linux-3.0.4/fs/seq_file.c linux-3.0.4/fs/seq_file.c if (op) { diff -urNp linux-3.0.4/fs/splice.c linux-3.0.4/fs/splice.c --- linux-3.0.4/fs/splice.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/splice.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/splice.c 2011-10-06 04:17:55.000000000 -0400 @@ -194,7 +194,7 @@ ssize_t splice_to_pipe(struct pipe_inode pipe_lock(pipe); @@ -44141,7 +44893,7 @@ diff -urNp linux-3.0.4/fs/splice.c linux-3.0.4/fs/splice.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos); -+ res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos); ++ res = vfs_readv(file, (const struct iovec __force_user *)vec, vlen, &pos); set_fs(old_fs); return res; @@ -44150,7 +44902,7 @@ diff -urNp linux-3.0.4/fs/splice.c linux-3.0.4/fs/splice.c set_fs(get_ds()); /* The cast to a user pointer is valid due to the set_fs() */ - res = vfs_write(file, (const char __user *)buf, count, &pos); -+ res = vfs_write(file, (__force const char __user *)buf, count, &pos); ++ res = vfs_write(file, (const char __force_user *)buf, count, &pos); set_fs(old_fs); return res; @@ -44168,7 +44920,7 @@ diff -urNp linux-3.0.4/fs/splice.c linux-3.0.4/fs/splice.c this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset); - vec[i].iov_base = (void __user *) page_address(page); -+ vec[i].iov_base = (__force void __user *) page_address(page); ++ vec[i].iov_base = (void __force_user *) page_address(page); vec[i].iov_len = this_len; spd.pages[i] = page; spd.nr_pages++; @@ -54992,8 +55744,81 @@ diff -urNp linux-3.0.4/include/linux/compiler-gcc4.h linux-3.0.4/include/linux/c #if __GNUC_MINOR__ > 0 diff -urNp linux-3.0.4/include/linux/compiler.h linux-3.0.4/include/linux/compiler.h --- linux-3.0.4/include/linux/compiler.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/include/linux/compiler.h 2011-08-26 19:49:56.000000000 -0400 -@@ -264,6 +264,14 @@ void ftrace_likely_update(struct ftrace_ ++++ linux-3.0.4/include/linux/compiler.h 2011-10-06 04:17:55.000000000 -0400 +@@ -5,31 +5,62 @@ + + #ifdef __CHECKER__ + # define __user __attribute__((noderef, address_space(1))) ++# define __force_user __force __user + # define __kernel __attribute__((address_space(0))) ++# define __force_kernel __force __kernel + # define __safe __attribute__((safe)) + # define __force __attribute__((force)) + # define __nocast __attribute__((nocast)) + # define __iomem __attribute__((noderef, address_space(2))) ++# define __force_iomem __force __iomem + # define __acquires(x) __attribute__((context(x,0,1))) + # define __releases(x) __attribute__((context(x,1,0))) + # define __acquire(x) __context__(x,1) + # define __release(x) __context__(x,-1) + # define __cond_lock(x,c) ((c) ? ({ __acquire(x); 1; }) : 0) + # define __percpu __attribute__((noderef, address_space(3))) ++# define __force_percpu __force __percpu + #ifdef CONFIG_SPARSE_RCU_POINTER + # define __rcu __attribute__((noderef, address_space(4))) ++# define __force_rcu __force __rcu + #else + # define __rcu ++# define __force_rcu + #endif + extern void __chk_user_ptr(const volatile void __user *); + extern void __chk_io_ptr(const volatile void __iomem *); ++#elif defined(CHECKER_PLUGIN) ++//# define __user ++//# define __force_user ++//# define __kernel ++//# define __force_kernel ++# define __safe ++# define __force ++# define __nocast ++# define __iomem ++# define __force_iomem ++# define __chk_user_ptr(x) (void)0 ++# define __chk_io_ptr(x) (void)0 ++# define __builtin_warning(x, y...) (1) ++# define __acquires(x) ++# define __releases(x) ++# define __acquire(x) (void)0 ++# define __release(x) (void)0 ++# define __cond_lock(x,c) (c) ++# define __percpu ++# define __force_percpu ++# define __rcu ++# define __force_rcu + #else + # define __user ++# define __force_user + # define __kernel ++# define __force_kernel + # define __safe + # define __force + # define __nocast + # define __iomem ++# define __force_iomem + # define __chk_user_ptr(x) (void)0 + # define __chk_io_ptr(x) (void)0 + # define __builtin_warning(x, y...) (1) +@@ -39,7 +70,9 @@ extern void __chk_io_ptr(const volatile + # define __release(x) (void)0 + # define __cond_lock(x,c) (c) + # define __percpu ++# define __force_percpu + # define __rcu ++# define __force_rcu + #endif + + #ifdef __KERNEL__ +@@ -264,6 +297,14 @@ void ftrace_likely_update(struct ftrace_ # define __attribute_const__ /* unimplemented */ #endif @@ -55008,7 +55833,7 @@ diff -urNp linux-3.0.4/include/linux/compiler.h linux-3.0.4/include/linux/compil /* * Tell gcc if a function is cold. The compiler will assume any path * directly leading to the call is unlikely. -@@ -273,6 +281,22 @@ void ftrace_likely_update(struct ftrace_ +@@ -273,6 +314,22 @@ void ftrace_likely_update(struct ftrace_ #define __cold #endif @@ -55031,7 +55856,7 @@ diff -urNp linux-3.0.4/include/linux/compiler.h linux-3.0.4/include/linux/compil /* Simple shorthand for a section definition */ #ifndef __section # define __section(S) __attribute__ ((__section__(#S))) -@@ -306,6 +330,7 @@ void ftrace_likely_update(struct ftrace_ +@@ -306,6 +363,7 @@ void ftrace_likely_update(struct ftrace_ * use is to mediate communication between process-level code and irq/NMI * handlers, all running on the same CPU. */ @@ -57980,16 +58805,17 @@ diff -urNp linux-3.0.4/include/linux/types.h linux-3.0.4/include/linux/types.h struct list_head { diff -urNp linux-3.0.4/include/linux/uaccess.h linux-3.0.4/include/linux/uaccess.h --- linux-3.0.4/include/linux/uaccess.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/include/linux/uaccess.h 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/include/linux/uaccess.h 2011-10-06 04:17:55.000000000 -0400 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_ long ret; \ mm_segment_t old_fs = get_fs(); \ \ - set_fs(KERNEL_DS); \ pagefault_disable(); \ -+ set_fs(KERNEL_DS); \ - ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ +- ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval)); \ - pagefault_enable(); \ ++ set_fs(KERNEL_DS); \ ++ ret = __copy_from_user_inatomic(&(retval), (typeof(retval) __force_user *)(addr), sizeof(retval)); \ set_fs(old_fs); \ + pagefault_enable(); \ ret; \ @@ -58735,16 +59561,21 @@ diff -urNp linux-3.0.4/include/video/uvesafb.h linux-3.0.4/include/video/uvesafb u8 *vbe_state_orig; /* diff -urNp linux-3.0.4/init/do_mounts.c linux-3.0.4/init/do_mounts.c --- linux-3.0.4/init/do_mounts.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/do_mounts.c 2011-08-23 21:47:56.000000000 -0400 -@@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa ++++ linux-3.0.4/init/do_mounts.c 2011-10-06 04:17:55.000000000 -0400 +@@ -287,11 +287,11 @@ static void __init get_fs_names(char *pa static int __init do_mount_root(char *name, char *fs, int flags, void *data) { - int err = sys_mount(name, "/root", fs, flags, data); -+ int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data); ++ int err = sys_mount((char __force_user *)name, (char __force_user *)"/root", (char __force_user *)fs, flags, (void __force_user *)data); if (err) return err; +- sys_chdir((const char __user __force *)"/root"); ++ sys_chdir((const char __force_user*)"/root"); + ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev; + printk(KERN_INFO + "VFS: Mounted root (%s filesystem)%s on device %u:%u.\n", @@ -383,18 +383,18 @@ void __init change_floppy(char *fmt, ... va_start(args, fmt); vsprintf(buf, fmt, args); @@ -58772,20 +59603,21 @@ diff -urNp linux-3.0.4/init/do_mounts.c linux-3.0.4/init/do_mounts.c out: devtmpfs_mount("dev"); - sys_mount(".", "/", NULL, MS_MOVE, NULL); -+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL); - sys_chroot((const char __user __force *)"."); +- sys_chroot((const char __user __force *)"."); ++ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL); ++ sys_chroot((const char __force_user *)"."); } diff -urNp linux-3.0.4/init/do_mounts.h linux-3.0.4/init/do_mounts.h --- linux-3.0.4/init/do_mounts.h 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/do_mounts.h 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/init/do_mounts.h 2011-10-06 04:17:55.000000000 -0400 @@ -15,15 +15,15 @@ extern int root_mountflags; static inline int create_dev(char *name, dev_t dev) { - sys_unlink(name); - return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev)); -+ sys_unlink((__force char __user *)name); -+ return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev)); ++ sys_unlink((char __force_user *)name); ++ return sys_mknod((char __force_user *)name, S_IFBLK|0600, new_encode_dev(dev)); } #if BITS_PER_LONG == 32 @@ -58793,13 +59625,22 @@ diff -urNp linux-3.0.4/init/do_mounts.h linux-3.0.4/init/do_mounts.h { struct stat64 stat; - if (sys_stat64(name, &stat) != 0) -+ if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0) ++ if (sys_stat64((char __force_user *)name, (struct stat64 __force_user *)&stat) != 0) + return 0; + if (!S_ISBLK(stat.st_mode)) + return 0; +@@ -35,7 +35,7 @@ static inline u32 bstat(char *name) + static inline u32 bstat(char *name) + { + struct stat stat; +- if (sys_newstat(name, &stat) != 0) ++ if (sys_newstat((const char __force_user *)name, (struct stat __force_user *)&stat) != 0) return 0; if (!S_ISBLK(stat.st_mode)) return 0; diff -urNp linux-3.0.4/init/do_mounts_initrd.c linux-3.0.4/init/do_mounts_initrd.c --- linux-3.0.4/init/do_mounts_initrd.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/do_mounts_initrd.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/init/do_mounts_initrd.c 2011-10-06 04:17:55.000000000 -0400 @@ -44,13 +44,13 @@ static void __init handle_initrd(void) create_dev("/dev/root.old", Root_RAM0); /* mount initrd on rootfs' /root */ @@ -58807,16 +59648,16 @@ diff -urNp linux-3.0.4/init/do_mounts_initrd.c linux-3.0.4/init/do_mounts_initrd - sys_mkdir("/old", 0700); - root_fd = sys_open("/", 0, 0); - old_fd = sys_open("/old", 0, 0); -+ sys_mkdir((__force const char __user *)"/old", 0700); -+ root_fd = sys_open((__force const char __user *)"/", 0, 0); -+ old_fd = sys_open((__force const char __user *)"/old", 0, 0); ++ sys_mkdir((const char __force_user *)"/old", 0700); ++ root_fd = sys_open((const char __force_user *)"/", 0, 0); ++ old_fd = sys_open((const char __force_user *)"/old", 0, 0); /* move initrd over / and chdir/chroot in initrd root */ - sys_chdir("/root"); - sys_mount(".", "/", NULL, MS_MOVE, NULL); - sys_chroot("."); -+ sys_chdir((__force const char __user *)"/root"); -+ sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL); -+ sys_chroot((__force const char __user *)"."); ++ sys_chdir((const char __force_user *)"/root"); ++ sys_mount((char __force_user *)".", (char __force_user *)"/", NULL, MS_MOVE, NULL); ++ sys_chroot((const char __force_user *)"."); /* * In case that a resume from disk is carried out by linuxrc or one of @@ -58825,17 +59666,17 @@ diff -urNp linux-3.0.4/init/do_mounts_initrd.c linux-3.0.4/init/do_mounts_initrd /* move initrd to rootfs' /old */ sys_fchdir(old_fd); - sys_mount("/", ".", NULL, MS_MOVE, NULL); -+ sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL); ++ sys_mount((char __force_user *)"/", (char __force_user *)".", NULL, MS_MOVE, NULL); /* switch root and cwd back to / of rootfs */ sys_fchdir(root_fd); - sys_chroot("."); -+ sys_chroot((__force const char __user *)"."); ++ sys_chroot((const char __force_user *)"."); sys_close(old_fd); sys_close(root_fd); if (new_decode_dev(real_root_dev) == Root_RAM0) { - sys_chdir("/old"); -+ sys_chdir((__force const char __user *)"/old"); ++ sys_chdir((const char __force_user *)"/old"); return; } @@ -58844,19 +59685,19 @@ diff -urNp linux-3.0.4/init/do_mounts_initrd.c linux-3.0.4/init/do_mounts_initrd printk(KERN_NOTICE "Trying to move old root to /initrd ... "); - error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL); -+ error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL); ++ error = sys_mount((char __force_user *)"/old", (char __force_user *)"/root/initrd", NULL, MS_MOVE, NULL); if (!error) printk("okay\n"); else { - int fd = sys_open("/dev/root.old", O_RDWR, 0); -+ int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0); ++ int fd = sys_open((const char __force_user *)"/dev/root.old", O_RDWR, 0); if (error == -ENOENT) printk("/initrd does not exist. Ignored.\n"); else printk("failed\n"); printk(KERN_NOTICE "Unmounting old root\n"); - sys_umount("/old", MNT_DETACH); -+ sys_umount((__force char __user *)"/old", MNT_DETACH); ++ sys_umount((char __force_user *)"/old", MNT_DETACH); printk(KERN_NOTICE "Trying to free ramdisk memory ... "); if (fd < 0) { error = fd; @@ -58865,24 +59706,24 @@ diff -urNp linux-3.0.4/init/do_mounts_initrd.c linux-3.0.4/init/do_mounts_initrd */ if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) { - sys_unlink("/initrd.image"); -+ sys_unlink((__force const char __user *)"/initrd.image"); ++ sys_unlink((const char __force_user *)"/initrd.image"); handle_initrd(); return 1; } } - sys_unlink("/initrd.image"); -+ sys_unlink((__force const char __user *)"/initrd.image"); ++ sys_unlink((const char __force_user *)"/initrd.image"); return 0; } diff -urNp linux-3.0.4/init/do_mounts_md.c linux-3.0.4/init/do_mounts_md.c --- linux-3.0.4/init/do_mounts_md.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/do_mounts_md.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/init/do_mounts_md.c 2011-10-06 04:17:55.000000000 -0400 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void) partitioned ? "_d" : "", minor, md_setup_args[ent].device_names); - fd = sys_open(name, 0, 0); -+ fd = sys_open((__force char __user *)name, 0, 0); ++ fd = sys_open((char __force_user *)name, 0, 0); if (fd < 0) { printk(KERN_ERR "md: open failed - cannot start " "array %s\n", name); @@ -58891,13 +59732,22 @@ diff -urNp linux-3.0.4/init/do_mounts_md.c linux-3.0.4/init/do_mounts_md.c */ sys_close(fd); - fd = sys_open(name, 0, 0); -+ fd = sys_open((__force char __user *)name, 0, 0); ++ fd = sys_open((char __force_user *)name, 0, 0); sys_ioctl(fd, BLKRRPART, 0); } sys_close(fd); +@@ -283,7 +283,7 @@ static void __init autodetect_raid(void) + + wait_for_device_probe(); + +- fd = sys_open((const char __user __force *) "/dev/md0", 0, 0); ++ fd = sys_open((const char __force_user *) "/dev/md0", 0, 0); + if (fd >= 0) { + sys_ioctl(fd, RAID_AUTORUN, raid_autopart); + sys_close(fd); diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c --- linux-3.0.4/init/initramfs.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/initramfs.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/init/initramfs.c 2011-10-06 04:17:55.000000000 -0400 @@ -74,7 +74,7 @@ static void __init free_hash(void) } } @@ -58912,7 +59762,7 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c list_for_each_entry_safe(de, tmp, &dir_list, list) { list_del(&de->list); - do_utime(de->name, de->mtime); -+ do_utime((__force char __user *)de->name, de->mtime); ++ do_utime((char __force_user *)de->name, de->mtime); kfree(de->name); kfree(de); } @@ -58921,7 +59771,7 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c char *old = find_link(major, minor, ino, mode, collected); if (old) - return (sys_link(old, collected) < 0) ? -1 : 1; -+ return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1; ++ return (sys_link((char __force_user *)old, (char __force_user *)collected) < 0) ? -1 : 1; } return 0; } @@ -58930,13 +59780,13 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c struct stat st; - if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) { -+ if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) { ++ if (!sys_newlstat((char __force_user *)path, (struct stat __force_user *)&st) && (st.st_mode^mode) & S_IFMT) { if (S_ISDIR(st.st_mode)) - sys_rmdir(path); -+ sys_rmdir((__force char __user *)path); ++ sys_rmdir((char __force_user *)path); else - sys_unlink(path); -+ sys_unlink((__force char __user *)path); ++ sys_unlink((char __force_user *)path); } } @@ -58945,7 +59795,7 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c if (ml != 1) openflags |= O_TRUNC; - wfd = sys_open(collected, openflags, mode); -+ wfd = sys_open((__force char __user *)collected, openflags, mode); ++ wfd = sys_open((char __force_user *)collected, openflags, mode); if (wfd >= 0) { sys_fchown(wfd, uid, gid); @@ -58956,9 +59806,9 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c - sys_mkdir(collected, mode); - sys_chown(collected, uid, gid); - sys_chmod(collected, mode); -+ sys_mkdir((__force char __user *)collected, mode); -+ sys_chown((__force char __user *)collected, uid, gid); -+ sys_chmod((__force char __user *)collected, mode); ++ sys_mkdir((char __force_user *)collected, mode); ++ sys_chown((char __force_user *)collected, uid, gid); ++ sys_chmod((char __force_user *)collected, mode); dir_add(collected, mtime); } else if (S_ISBLK(mode) || S_ISCHR(mode) || S_ISFIFO(mode) || S_ISSOCK(mode)) { @@ -58967,10 +59817,10 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c - sys_chown(collected, uid, gid); - sys_chmod(collected, mode); - do_utime(collected, mtime); -+ sys_mknod((__force char __user *)collected, mode, rdev); -+ sys_chown((__force char __user *)collected, uid, gid); -+ sys_chmod((__force char __user *)collected, mode); -+ do_utime((__force char __user *)collected, mtime); ++ sys_mknod((char __force_user *)collected, mode, rdev); ++ sys_chown((char __force_user *)collected, uid, gid); ++ sys_chmod((char __force_user *)collected, mode); ++ do_utime((char __force_user *)collected, mtime); } } return 0; @@ -58979,17 +59829,17 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c { if (count >= body_len) { - sys_write(wfd, victim, body_len); -+ sys_write(wfd, (__force char __user *)victim, body_len); ++ sys_write(wfd, (char __force_user *)victim, body_len); sys_close(wfd); - do_utime(vcollected, mtime); -+ do_utime((__force char __user *)vcollected, mtime); ++ do_utime((char __force_user *)vcollected, mtime); kfree(vcollected); eat(body_len); state = SkipIt; return 0; } else { - sys_write(wfd, victim, count); -+ sys_write(wfd, (__force char __user *)victim, count); ++ sys_write(wfd, (char __force_user *)victim, count); body_len -= count; eat(count); return 1; @@ -59000,9 +59850,9 @@ diff -urNp linux-3.0.4/init/initramfs.c linux-3.0.4/init/initramfs.c - sys_symlink(collected + N_ALIGN(name_len), collected); - sys_lchown(collected, uid, gid); - do_utime(collected, mtime); -+ sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected); -+ sys_lchown((__force char __user *)collected, uid, gid); -+ do_utime((__force char __user *)collected, mtime); ++ sys_symlink((char __force_user *)collected + N_ALIGN(name_len), (char __force_user *)collected); ++ sys_lchown((char __force_user *)collected, uid, gid); ++ do_utime((char __force_user *)collected, mtime); state = SkipIt; next_state = Reset; return 0; @@ -59020,7 +59870,7 @@ diff -urNp linux-3.0.4/init/Kconfig linux-3.0.4/init/Kconfig also breaks ancient binaries (including anything libc5 based). diff -urNp linux-3.0.4/init/main.c linux-3.0.4/init/main.c --- linux-3.0.4/init/main.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/init/main.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/init/main.c 2011-10-06 04:17:55.000000000 -0400 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) extern void tc_init(void); #endif @@ -59113,7 +59963,7 @@ diff -urNp linux-3.0.4/init/main.c linux-3.0.4/init/main.c /* Open the /dev/console on the rootfs, this should never fail */ - if (sys_open((const char __user *) "/dev/console", O_RDWR, 0) < 0) -+ if (sys_open((__force const char __user *) "/dev/console", O_RDWR, 0) < 0) ++ if (sys_open((const char __force_user *) "/dev/console", O_RDWR, 0) < 0) printk(KERN_WARNING "Warning: unable to open an initial console.\n"); (void) sys_dup(0); @@ -59122,7 +59972,7 @@ diff -urNp linux-3.0.4/init/main.c linux-3.0.4/init/main.c ramdisk_execute_command = "/init"; - if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) { -+ if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) { ++ if (sys_access((const char __force_user *) ramdisk_execute_command, 0) != 0) { ramdisk_execute_command = NULL; prepare_namespace(); } @@ -59311,13 +60161,13 @@ diff -urNp linux-3.0.4/ipc/shm.c linux-3.0.4/ipc/shm.c diff -urNp linux-3.0.4/kernel/acct.c linux-3.0.4/kernel/acct.c --- linux-3.0.4/kernel/acct.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/kernel/acct.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/kernel/acct.c 2011-10-06 04:17:55.000000000 -0400 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a */ flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur; current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; - file->f_op->write(file, (char *)&ac, -+ file->f_op->write(file, (__force char __user *)&ac, ++ file->f_op->write(file, (char __force_user *)&ac, sizeof(acct_t), &file->f_pos); current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim; set_fs(fs); @@ -59458,7 +60308,7 @@ diff -urNp linux-3.0.4/kernel/cgroup.c linux-3.0.4/kernel/cgroup.c read_lock(&css_set_lock); diff -urNp linux-3.0.4/kernel/compat.c linux-3.0.4/kernel/compat.c --- linux-3.0.4/kernel/compat.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/kernel/compat.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/kernel/compat.c 2011-10-06 04:17:55.000000000 -0400 @@ -13,6 +13,7 @@ #include <linux/linkage.h> @@ -59467,6 +60317,163 @@ diff -urNp linux-3.0.4/kernel/compat.c linux-3.0.4/kernel/compat.c #include <linux/errno.h> #include <linux/time.h> #include <linux/signal.h> +@@ -166,7 +167,7 @@ static long compat_nanosleep_restart(str + mm_segment_t oldfs; + long ret; + +- restart->nanosleep.rmtp = (struct timespec __user *) &rmt; ++ restart->nanosleep.rmtp = (struct timespec __force_user *) &rmt; + oldfs = get_fs(); + set_fs(KERNEL_DS); + ret = hrtimer_nanosleep_restart(restart); +@@ -198,7 +199,7 @@ asmlinkage long compat_sys_nanosleep(str + oldfs = get_fs(); + set_fs(KERNEL_DS); + ret = hrtimer_nanosleep(&tu, +- rmtp ? (struct timespec __user *)&rmt : NULL, ++ rmtp ? (struct timespec __force_user *)&rmt : NULL, + HRTIMER_MODE_REL, CLOCK_MONOTONIC); + set_fs(oldfs); + +@@ -307,7 +308,7 @@ asmlinkage long compat_sys_sigpending(co + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_sigpending((old_sigset_t __user *) &s); ++ ret = sys_sigpending((old_sigset_t __force_user *) &s); + set_fs(old_fs); + if (ret == 0) + ret = put_user(s, set); +@@ -330,8 +331,8 @@ asmlinkage long compat_sys_sigprocmask(i + old_fs = get_fs(); + set_fs(KERNEL_DS); + ret = sys_sigprocmask(how, +- set ? (old_sigset_t __user *) &s : NULL, +- oset ? (old_sigset_t __user *) &s : NULL); ++ set ? (old_sigset_t __force_user *) &s : NULL, ++ oset ? (old_sigset_t __force_user *) &s : NULL); + set_fs(old_fs); + if (ret == 0) + if (oset) +@@ -368,7 +369,7 @@ asmlinkage long compat_sys_old_getrlimit + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_old_getrlimit(resource, &r); ++ ret = sys_old_getrlimit(resource, (struct rlimit __force_user *)&r); + set_fs(old_fs); + + if (!ret) { +@@ -440,7 +441,7 @@ asmlinkage long compat_sys_getrusage(int + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- ret = sys_getrusage(who, (struct rusage __user *) &r); ++ ret = sys_getrusage(who, (struct rusage __force_user *) &r); + set_fs(old_fs); + + if (ret) +@@ -467,8 +468,8 @@ compat_sys_wait4(compat_pid_t pid, compa + set_fs (KERNEL_DS); + ret = sys_wait4(pid, + (stat_addr ? +- (unsigned int __user *) &status : NULL), +- options, (struct rusage __user *) &r); ++ (unsigned int __force_user *) &status : NULL), ++ options, (struct rusage __force_user *) &r); + set_fs (old_fs); + + if (ret > 0) { +@@ -493,8 +494,8 @@ asmlinkage long compat_sys_waitid(int wh + memset(&info, 0, sizeof(info)); + + set_fs(KERNEL_DS); +- ret = sys_waitid(which, pid, (siginfo_t __user *)&info, options, +- uru ? (struct rusage __user *)&ru : NULL); ++ ret = sys_waitid(which, pid, (siginfo_t __force_user *)&info, options, ++ uru ? (struct rusage __force_user *)&ru : NULL); + set_fs(old_fs); + + if ((ret < 0) || (info.si_signo == 0)) +@@ -624,8 +625,8 @@ long compat_sys_timer_settime(timer_t ti + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_timer_settime(timer_id, flags, +- (struct itimerspec __user *) &newts, +- (struct itimerspec __user *) &oldts); ++ (struct itimerspec __force_user *) &newts, ++ (struct itimerspec __force_user *) &oldts); + set_fs(oldfs); + if (!err && old && put_compat_itimerspec(old, &oldts)) + return -EFAULT; +@@ -642,7 +643,7 @@ long compat_sys_timer_gettime(timer_t ti + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_timer_gettime(timer_id, +- (struct itimerspec __user *) &ts); ++ (struct itimerspec __force_user *) &ts); + set_fs(oldfs); + if (!err && put_compat_itimerspec(setting, &ts)) + return -EFAULT; +@@ -661,7 +662,7 @@ long compat_sys_clock_settime(clockid_t + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_settime(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + return err; + } +@@ -676,7 +677,7 @@ long compat_sys_clock_gettime(clockid_t + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_gettime(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + if (!err && put_compat_timespec(&ts, tp)) + return -EFAULT; +@@ -696,7 +697,7 @@ long compat_sys_clock_adjtime(clockid_t + + oldfs = get_fs(); + set_fs(KERNEL_DS); +- ret = sys_clock_adjtime(which_clock, (struct timex __user *) &txc); ++ ret = sys_clock_adjtime(which_clock, (struct timex __force_user *) &txc); + set_fs(oldfs); + + err = compat_put_timex(utp, &txc); +@@ -716,7 +717,7 @@ long compat_sys_clock_getres(clockid_t w + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_getres(which_clock, +- (struct timespec __user *) &ts); ++ (struct timespec __force_user *) &ts); + set_fs(oldfs); + if (!err && tp && put_compat_timespec(&ts, tp)) + return -EFAULT; +@@ -728,9 +729,9 @@ static long compat_clock_nanosleep_resta + long err; + mm_segment_t oldfs; + struct timespec tu; +- struct compat_timespec *rmtp = restart->nanosleep.compat_rmtp; ++ struct compat_timespec __user *rmtp = restart->nanosleep.compat_rmtp; + +- restart->nanosleep.rmtp = (struct timespec __user *) &tu; ++ restart->nanosleep.rmtp = (struct timespec __force_user *) &tu; + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = clock_nanosleep_restart(restart); +@@ -762,8 +763,8 @@ long compat_sys_clock_nanosleep(clockid_ + oldfs = get_fs(); + set_fs(KERNEL_DS); + err = sys_clock_nanosleep(which_clock, flags, +- (struct timespec __user *) &in, +- (struct timespec __user *) &out); ++ (struct timespec __force_user *) &in, ++ (struct timespec __force_user *) &out); + set_fs(oldfs); + + if ((err == -ERESTART_RESTARTBLOCK) && rmtp && diff -urNp linux-3.0.4/kernel/configs.c linux-3.0.4/kernel/configs.c --- linux-3.0.4/kernel/configs.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/kernel/configs.c 2011-08-23 21:48:14.000000000 -0400 @@ -60538,9 +61545,22 @@ diff -urNp linux-3.0.4/kernel/kallsyms.c linux-3.0.4/kernel/kallsyms.c if (!iter) return -ENOMEM; reset_iter(iter, 0); +diff -urNp linux-3.0.4/kernel/kexec.c linux-3.0.4/kernel/kexec.c +--- linux-3.0.4/kernel/kexec.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/kernel/kexec.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1033,7 +1033,8 @@ asmlinkage long compat_sys_kexec_load(un + unsigned long flags) + { + struct compat_kexec_segment in; +- struct kexec_segment out, __user *ksegments; ++ struct kexec_segment out; ++ struct kexec_segment __user *ksegments; + unsigned long i, result; + + /* Don't allow clients that don't understand the native diff -urNp linux-3.0.4/kernel/kmod.c linux-3.0.4/kernel/kmod.c --- linux-3.0.4/kernel/kmod.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/kernel/kmod.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/kernel/kmod.c 2011-10-06 04:17:55.000000000 -0400 @@ -73,13 +73,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb * If module auto-loading support is disabled then this function * becomes a no-operation. @@ -60637,6 +61657,15 @@ diff -urNp linux-3.0.4/kernel/kmod.c linux-3.0.4/kernel/kmod.c EXPORT_SYMBOL(__request_module); #endif /* CONFIG_MODULES */ +@@ -220,7 +272,7 @@ static int wait_for_helper(void *data) + * + * Thus the __user pointer cast is valid here. + */ +- sys_wait4(pid, (int __user *)&ret, 0, NULL); ++ sys_wait4(pid, (int __force_user *)&ret, 0, NULL); + + /* + * If ret is 0, either ____call_usermodehelper failed and the diff -urNp linux-3.0.4/kernel/kprobes.c linux-3.0.4/kernel/kprobes.c --- linux-3.0.4/kernel/kprobes.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/kernel/kprobes.c 2011-08-23 21:47:56.000000000 -0400 @@ -62816,7 +63845,7 @@ diff -urNp linux-3.0.4/kernel/softirq.c linux-3.0.4/kernel/softirq.c diff -urNp linux-3.0.4/kernel/sys.c linux-3.0.4/kernel/sys.c --- linux-3.0.4/kernel/sys.c 2011-09-02 18:11:26.000000000 -0400 -+++ linux-3.0.4/kernel/sys.c 2011-08-29 23:26:27.000000000 -0400 ++++ linux-3.0.4/kernel/sys.c 2011-10-06 04:17:55.000000000 -0400 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_stru error = -EACCES; goto out; @@ -62952,6 +63981,31 @@ diff -urNp linux-3.0.4/kernel/sys.c linux-3.0.4/kernel/sys.c abort_creds(new); return old_fsgid; +@@ -1205,19 +1248,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_ + return -EFAULT; + + down_read(&uts_sem); +- error = __copy_to_user(&name->sysname, &utsname()->sysname, ++ error = __copy_to_user(name->sysname, &utsname()->sysname, + __OLD_UTS_LEN); + error |= __put_user(0, name->sysname + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->nodename, &utsname()->nodename, ++ error |= __copy_to_user(name->nodename, &utsname()->nodename, + __OLD_UTS_LEN); + error |= __put_user(0, name->nodename + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->release, &utsname()->release, ++ error |= __copy_to_user(name->release, &utsname()->release, + __OLD_UTS_LEN); + error |= __put_user(0, name->release + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->version, &utsname()->version, ++ error |= __copy_to_user(name->version, &utsname()->version, + __OLD_UTS_LEN); + error |= __put_user(0, name->version + __OLD_UTS_LEN); +- error |= __copy_to_user(&name->machine, &utsname()->machine, ++ error |= __copy_to_user(name->machine, &utsname()->machine, + __OLD_UTS_LEN); + error |= __put_user(0, name->machine + __OLD_UTS_LEN); + up_read(&uts_sem); @@ -1680,7 +1723,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi error = get_dumpable(me->mm); break; @@ -62961,6 +64015,72 @@ diff -urNp linux-3.0.4/kernel/sys.c linux-3.0.4/kernel/sys.c error = -EINVAL; break; } +diff -urNp linux-3.0.4/kernel/sysctl_binary.c linux-3.0.4/kernel/sysctl_binary.c +--- linux-3.0.4/kernel/sysctl_binary.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/kernel/sysctl_binary.c 2011-10-06 04:17:55.000000000 -0400 +@@ -989,7 +989,7 @@ static ssize_t bin_intvec(struct file *f + int i; + + set_fs(KERNEL_DS); +- result = vfs_read(file, buffer, BUFSZ - 1, &pos); ++ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos); + set_fs(old_fs); + if (result < 0) + goto out_kfree; +@@ -1034,7 +1034,7 @@ static ssize_t bin_intvec(struct file *f + } + + set_fs(KERNEL_DS); +- result = vfs_write(file, buffer, str - buffer, &pos); ++ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos); + set_fs(old_fs); + if (result < 0) + goto out_kfree; +@@ -1067,7 +1067,7 @@ static ssize_t bin_ulongvec(struct file + int i; + + set_fs(KERNEL_DS); +- result = vfs_read(file, buffer, BUFSZ - 1, &pos); ++ result = vfs_read(file, (char __force_user *)buffer, BUFSZ - 1, &pos); + set_fs(old_fs); + if (result < 0) + goto out_kfree; +@@ -1112,7 +1112,7 @@ static ssize_t bin_ulongvec(struct file + } + + set_fs(KERNEL_DS); +- result = vfs_write(file, buffer, str - buffer, &pos); ++ result = vfs_write(file, (const char __force_user *)buffer, str - buffer, &pos); + set_fs(old_fs); + if (result < 0) + goto out_kfree; +@@ -1138,7 +1138,7 @@ static ssize_t bin_uuid(struct file *fil + int i; + + set_fs(KERNEL_DS); +- result = vfs_read(file, buf, sizeof(buf) - 1, &pos); ++ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos); + set_fs(old_fs); + if (result < 0) + goto out; +@@ -1185,7 +1185,7 @@ static ssize_t bin_dn_node_address(struc + __le16 dnaddr; + + set_fs(KERNEL_DS); +- result = vfs_read(file, buf, sizeof(buf) - 1, &pos); ++ result = vfs_read(file, (char __force_user *)buf, sizeof(buf) - 1, &pos); + set_fs(old_fs); + if (result < 0) + goto out; +@@ -1233,7 +1233,7 @@ static ssize_t bin_dn_node_address(struc + le16_to_cpu(dnaddr) & 0x3ff); + + set_fs(KERNEL_DS); +- result = vfs_write(file, buf, len, &pos); ++ result = vfs_write(file, (const char __force_user *)buf, len, &pos); + set_fs(old_fs); + if (result < 0) + goto out; diff -urNp linux-3.0.4/kernel/sysctl.c linux-3.0.4/kernel/sysctl.c --- linux-3.0.4/kernel/sysctl.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/kernel/sysctl.c 2011-08-23 21:48:14.000000000 -0400 @@ -63532,6 +64652,45 @@ diff -urNp linux-3.0.4/kernel/trace/trace_events.c linux-3.0.4/kernel/trace/trac } } +diff -urNp linux-3.0.4/kernel/trace/trace_kprobe.c linux-3.0.4/kernel/trace/trace_kprobe.c +--- linux-3.0.4/kernel/trace/trace_kprobe.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/kernel/trace/trace_kprobe.c 2011-10-06 04:17:55.000000000 -0400 +@@ -217,7 +217,7 @@ static __kprobes void FETCH_FUNC_NAME(me + long ret; + int maxlen = get_rloc_len(*(u32 *)dest); + u8 *dst = get_rloc_data(dest); +- u8 *src = addr; ++ const u8 __user *src = (const u8 __force_user *)addr; + mm_segment_t old_fs = get_fs(); + if (!maxlen) + return; +@@ -229,7 +229,7 @@ static __kprobes void FETCH_FUNC_NAME(me + pagefault_disable(); + do + ret = __copy_from_user_inatomic(dst++, src++, 1); +- while (dst[-1] && ret == 0 && src - (u8 *)addr < maxlen); ++ while (dst[-1] && ret == 0 && src - (const u8 __force_user *)addr < maxlen); + dst[-1] = '\0'; + pagefault_enable(); + set_fs(old_fs); +@@ -238,7 +238,7 @@ static __kprobes void FETCH_FUNC_NAME(me + ((u8 *)get_rloc_data(dest))[0] = '\0'; + *(u32 *)dest = make_data_rloc(0, get_rloc_offs(*(u32 *)dest)); + } else +- *(u32 *)dest = make_data_rloc(src - (u8 *)addr, ++ *(u32 *)dest = make_data_rloc(src - (const u8 __force_user *)addr, + get_rloc_offs(*(u32 *)dest)); + } + /* Return the length of string -- including null terminal byte */ +@@ -252,7 +252,7 @@ static __kprobes void FETCH_FUNC_NAME(me + set_fs(KERNEL_DS); + pagefault_disable(); + do { +- ret = __copy_from_user_inatomic(&c, (u8 *)addr + len, 1); ++ ret = __copy_from_user_inatomic(&c, (const u8 __force_user *)addr + len, 1); + len++; + } while (c && ret == 0 && len < MAX_STRING_SIZE); + pagefault_enable(); diff -urNp linux-3.0.4/kernel/trace/trace_mmiotrace.c linux-3.0.4/kernel/trace/trace_mmiotrace.c --- linux-3.0.4/kernel/trace/trace_mmiotrace.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/kernel/trace/trace_mmiotrace.c 2011-08-23 21:47:56.000000000 -0400 @@ -63625,6 +64784,45 @@ diff -urNp linux-3.0.4/kernel/trace/trace_workqueue.c linux-3.0.4/kernel/trace/t tsk->comm); put_task_struct(tsk); } +diff -urNp linux-3.0.4/lib/bitmap.c linux-3.0.4/lib/bitmap.c +--- linux-3.0.4/lib/bitmap.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/lib/bitmap.c 2011-10-06 04:17:55.000000000 -0400 +@@ -421,7 +421,7 @@ int __bitmap_parse(const char *buf, unsi + { + int c, old_c, totaldigits, ndigits, nchunks, nbits; + u32 chunk; +- const char __user *ubuf = buf; ++ const char __user *ubuf = (const char __force_user *)buf; + + bitmap_zero(maskp, nmaskbits); + +@@ -506,7 +506,7 @@ int bitmap_parse_user(const char __user + { + if (!access_ok(VERIFY_READ, ubuf, ulen)) + return -EFAULT; +- return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits); ++ return __bitmap_parse((const char __force_kernel *)ubuf, ulen, 1, maskp, nmaskbits); + } + EXPORT_SYMBOL(bitmap_parse_user); + +@@ -596,7 +596,7 @@ static int __bitmap_parselist(const char + { + unsigned a, b; + int c, old_c, totaldigits; +- const char __user *ubuf = buf; ++ const char __user *ubuf = (const char __force_user *)buf; + int exp_digit, in_range; + + totaldigits = c = 0; +@@ -696,7 +696,7 @@ int bitmap_parselist_user(const char __u + { + if (!access_ok(VERIFY_READ, ubuf, ulen)) + return -EFAULT; +- return __bitmap_parselist((const char *)ubuf, ++ return __bitmap_parselist((const char __force_kernel *)ubuf, + ulen, 1, maskp, nmaskbits); + } + EXPORT_SYMBOL(bitmap_parselist_user); diff -urNp linux-3.0.4/lib/bug.c linux-3.0.4/lib/bug.c --- linux-3.0.4/lib/bug.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/lib/bug.c 2011-08-23 21:47:56.000000000 -0400 @@ -63649,6 +64847,27 @@ diff -urNp linux-3.0.4/lib/debugobjects.c linux-3.0.4/lib/debugobjects.c if (is_on_stack == onstack) return; +diff -urNp linux-3.0.4/lib/devres.c linux-3.0.4/lib/devres.c +--- linux-3.0.4/lib/devres.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/lib/devres.c 2011-10-06 04:17:55.000000000 -0400 +@@ -81,7 +81,7 @@ void devm_iounmap(struct device *dev, vo + { + iounmap(addr); + WARN_ON(devres_destroy(dev, devm_ioremap_release, devm_ioremap_match, +- (void *)addr)); ++ (void __force *)addr)); + } + EXPORT_SYMBOL(devm_iounmap); + +@@ -141,7 +141,7 @@ void devm_ioport_unmap(struct device *de + { + ioport_unmap(addr); + WARN_ON(devres_destroy(dev, devm_ioport_map_release, +- devm_ioport_map_match, (void *)addr)); ++ devm_ioport_map_match, (void __force *)addr)); + } + EXPORT_SYMBOL(devm_ioport_unmap); + diff -urNp linux-3.0.4/lib/dma-debug.c linux-3.0.4/lib/dma-debug.c --- linux-3.0.4/lib/dma-debug.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/lib/dma-debug.c 2011-08-23 21:47:56.000000000 -0400 @@ -63833,7 +65052,7 @@ diff -urNp linux-3.0.4/localversion-grsec linux-3.0.4/localversion-grsec +-grsec diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile --- linux-3.0.4/Makefile 2011-09-02 18:11:26.000000000 -0400 -+++ linux-3.0.4/Makefile 2011-09-17 00:56:07.000000000 -0400 ++++ linux-3.0.4/Makefile 2011-10-06 04:17:55.000000000 -0400 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" HOSTCC = gcc @@ -63870,23 +65089,28 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile $(Q)$(MAKE) $(build)=scripts/basic $(Q)rm -f .tmp_quiet_recordmcount -@@ -564,6 +567,31 @@ else +@@ -564,6 +567,36 @@ else KBUILD_CFLAGS += -O2 endif +ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh "$(HOSTCC)" "$(CC)"), y) +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN -+ifdef CONFIG_PAX_KERNEXEC_PLUGIN -+KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so ++ifdef CONFIG_PAX_MEMORY_STACKLEAK ++STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100 +endif +ifdef CONFIG_KALLOCSTAT_PLUGIN +KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so +endif -+ifdef CONFIG_PAX_MEMORY_STACKLEAK -+STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100 ++ifdef CONFIG_PAX_KERNEXEC_PLUGIN ++KERNEXEC_PLUGIN := -fplugin=$(objtree)/tools/gcc/kernexec_plugin.so ++endif ++ifdef CONFIG_CHECKER_PLUGIN ++ifeq ($(call cc-ifversion, -ge, 0406, y), y) ++CHECKER_PLUGIN := -fplugin=$(objtree)/tools/gcc/checker_plugin.so -DCHECKER_PLUGIN ++endif +endif -+GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) -+export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN ++GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) $(KERNEXEC_PLUGIN) $(CHECKER_PLUGIN) ++export CONSTIFY_PLUGIN STACKLEAK_PLUGIN KERNEXEC_PLUGIN CHECKER_PLUGIN +gcc-plugins: + $(Q)$(MAKE) $(build)=tools/gcc +else @@ -63902,7 +65126,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile include $(srctree)/arch/$(SRCARCH)/Makefile ifneq ($(CONFIG_FRAME_WARN),0) -@@ -708,7 +736,7 @@ export mod_strip_cmd +@@ -708,7 +741,7 @@ export mod_strip_cmd ifeq ($(KBUILD_EXTMOD),) @@ -63911,7 +65135,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ -@@ -907,6 +935,8 @@ define rule_vmlinux-modpost +@@ -907,6 +940,8 @@ define rule_vmlinux-modpost endef # vmlinux image - including updated kernel symbols @@ -63920,7 +65144,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o $(kallsyms.o) FORCE ifdef CONFIG_HEADERS_CHECK $(Q)$(MAKE) -f $(srctree)/Makefile headers_check -@@ -941,7 +971,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) +@@ -941,7 +976,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) # Error messages still appears in the original language PHONY += $(vmlinux-dirs) @@ -63930,7 +65154,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile $(Q)$(MAKE) $(build)=$@ # Store (new) KERNELRELASE string in include/config/kernel.release -@@ -986,6 +1017,7 @@ prepare0: archprepare FORCE +@@ -986,6 +1022,7 @@ prepare0: archprepare FORCE $(Q)$(MAKE) $(build)=. missing-syscalls # All the preparing.. @@ -63938,7 +65162,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile prepare: prepare0 # Generate some files -@@ -1102,7 +1134,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu +@@ -1102,7 +1139,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu # Target to prepare building external modules PHONY += modules_prepare @@ -63947,7 +65171,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile # Target to install modules PHONY += modules_install -@@ -1198,7 +1230,7 @@ distclean: mrproper +@@ -1198,7 +1235,7 @@ distclean: mrproper @find $(srctree) $(RCS_FIND_IGNORE) \ \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ @@ -63956,7 +65180,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1359,6 +1391,7 @@ PHONY += $(module-dirs) modules +@@ -1359,6 +1396,7 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) @@ -63964,7 +65188,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1485,17 +1518,19 @@ else +@@ -1485,17 +1523,19 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif @@ -63988,7 +65212,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1505,11 +1540,13 @@ endif +@@ -1505,11 +1545,13 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) @@ -64206,6 +65430,27 @@ diff -urNp linux-3.0.4/mm/kmemleak.c linux-3.0.4/mm/kmemleak.c } } +diff -urNp linux-3.0.4/mm/maccess.c linux-3.0.4/mm/maccess.c +--- linux-3.0.4/mm/maccess.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/mm/maccess.c 2011-10-06 04:17:55.000000000 -0400 +@@ -26,7 +26,7 @@ long __probe_kernel_read(void *dst, cons + set_fs(KERNEL_DS); + pagefault_disable(); + ret = __copy_from_user_inatomic(dst, +- (__force const void __user *)src, size); ++ (const void __force_user *)src, size); + pagefault_enable(); + set_fs(old_fs); + +@@ -53,7 +53,7 @@ long __probe_kernel_write(void *dst, con + + set_fs(KERNEL_DS); + pagefault_disable(); +- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); ++ ret = __copy_to_user_inatomic((void __force_user *)dst, src, size); + pagefault_enable(); + set_fs(old_fs); + diff -urNp linux-3.0.4/mm/madvise.c linux-3.0.4/mm/madvise.c --- linux-3.0.4/mm/madvise.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/mm/madvise.c 2011-08-23 21:47:56.000000000 -0400 @@ -64853,7 +66098,7 @@ diff -urNp linux-3.0.4/mm/memory.c linux-3.0.4/mm/memory.c * Dumping its contents makes post-mortem fully interpretable later diff -urNp linux-3.0.4/mm/memory-failure.c linux-3.0.4/mm/memory-failure.c --- linux-3.0.4/mm/memory-failure.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/mm/memory-failure.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/mm/memory-failure.c 2011-10-06 04:17:55.000000000 -0400 @@ -59,7 +59,7 @@ int sysctl_memory_failure_early_kill __r int sysctl_memory_failure_recovery __read_mostly = 1; @@ -64863,6 +66108,15 @@ diff -urNp linux-3.0.4/mm/memory-failure.c linux-3.0.4/mm/memory-failure.c #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE) +@@ -200,7 +200,7 @@ static int kill_proc_ao(struct task_stru + si.si_signo = SIGBUS; + si.si_errno = 0; + si.si_code = BUS_MCEERR_AO; +- si.si_addr = (void *)addr; ++ si.si_addr = (void __user *)addr; + #ifdef __ARCH_SI_TRAPNO + si.si_trapno = trapno; + #endif @@ -1008,7 +1008,7 @@ int __memory_failure(unsigned long pfn, } @@ -68153,6 +69407,39 @@ diff -urNp linux-3.0.4/net/8021q/vlan.c linux-3.0.4/net/8021q/vlan.c struct vlan_net *vn; vn = net_generic(net, vlan_net_id); +diff -urNp linux-3.0.4/net/9p/trans_fd.c linux-3.0.4/net/9p/trans_fd.c +--- linux-3.0.4/net/9p/trans_fd.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/9p/trans_fd.c 2011-10-06 04:17:55.000000000 -0400 +@@ -423,7 +423,7 @@ static int p9_fd_write(struct p9_client + oldfs = get_fs(); + set_fs(get_ds()); + /* The cast to a user pointer is valid due to the set_fs() */ +- ret = vfs_write(ts->wr, (__force void __user *)v, len, &ts->wr->f_pos); ++ ret = vfs_write(ts->wr, (void __force_user *)v, len, &ts->wr->f_pos); + set_fs(oldfs); + + if (ret <= 0 && ret != -ERESTARTSYS && ret != -EAGAIN) +diff -urNp linux-3.0.4/net/9p/trans_virtio.c linux-3.0.4/net/9p/trans_virtio.c +--- linux-3.0.4/net/9p/trans_virtio.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/9p/trans_virtio.c 2011-10-06 04:17:55.000000000 -0400 +@@ -328,7 +328,7 @@ req_retry_pinned: + } else { + char *pbuf; + if (req->tc->pubuf) +- pbuf = (__force char *) req->tc->pubuf; ++ pbuf = (char __force_kernel *) req->tc->pubuf; + else + pbuf = req->tc->pkbuf; + outp = pack_sg_list(chan->sg, out, VIRTQUEUE_NUM, pbuf, +@@ -357,7 +357,7 @@ req_retry_pinned: + } else { + char *pbuf; + if (req->tc->pubuf) +- pbuf = (__force char *) req->tc->pubuf; ++ pbuf = (char __force_kernel *) req->tc->pubuf; + else + pbuf = req->tc->pkbuf; + diff -urNp linux-3.0.4/net/atm/atm_misc.c linux-3.0.4/net/atm/atm_misc.c --- linux-3.0.4/net/atm/atm_misc.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/atm/atm_misc.c 2011-08-23 21:47:56.000000000 -0400 @@ -68583,6 +69870,136 @@ diff -urNp linux-3.0.4/net/caif/cfctrl.c linux-3.0.4/net/caif/cfctrl.c cfpkt_extr_head(pkt, &cmdrsp, 1); cmd = cmdrsp & CFCTRL_CMD_MASK; +diff -urNp linux-3.0.4/net/compat.c linux-3.0.4/net/compat.c +--- linux-3.0.4/net/compat.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/compat.c 2011-10-06 04:17:55.000000000 -0400 +@@ -70,9 +70,9 @@ int get_compat_msghdr(struct msghdr *kms + __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || + __get_user(kmsg->msg_flags, &umsg->msg_flags)) + return -EFAULT; +- kmsg->msg_name = compat_ptr(tmp1); +- kmsg->msg_iov = compat_ptr(tmp2); +- kmsg->msg_control = compat_ptr(tmp3); ++ kmsg->msg_name = (void __force_kernel *)compat_ptr(tmp1); ++ kmsg->msg_iov = (void __force_kernel *)compat_ptr(tmp2); ++ kmsg->msg_control = (void __force_kernel *)compat_ptr(tmp3); + return 0; + } + +@@ -84,7 +84,7 @@ int verify_compat_iovec(struct msghdr *k + + if (kern_msg->msg_namelen) { + if (mode == VERIFY_READ) { +- int err = move_addr_to_kernel(kern_msg->msg_name, ++ int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name, + kern_msg->msg_namelen, + kern_address); + if (err < 0) +@@ -95,7 +95,7 @@ int verify_compat_iovec(struct msghdr *k + kern_msg->msg_name = NULL; + + tot_len = iov_from_user_compat_to_kern(kern_iov, +- (struct compat_iovec __user *)kern_msg->msg_iov, ++ (struct compat_iovec __force_user *)kern_msg->msg_iov, + kern_msg->msg_iovlen); + if (tot_len >= 0) + kern_msg->msg_iov = kern_iov; +@@ -115,20 +115,20 @@ int verify_compat_iovec(struct msghdr *k + + #define CMSG_COMPAT_FIRSTHDR(msg) \ + (((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ? \ +- (struct compat_cmsghdr __user *)((msg)->msg_control) : \ ++ (struct compat_cmsghdr __force_user *)((msg)->msg_control) : \ + (struct compat_cmsghdr __user *)NULL) + + #define CMSG_COMPAT_OK(ucmlen, ucmsg, mhdr) \ + ((ucmlen) >= sizeof(struct compat_cmsghdr) && \ + (ucmlen) <= (unsigned long) \ + ((mhdr)->msg_controllen - \ +- ((char *)(ucmsg) - (char *)(mhdr)->msg_control))) ++ ((char __force_kernel *)(ucmsg) - (char *)(mhdr)->msg_control))) + + static inline struct compat_cmsghdr __user *cmsg_compat_nxthdr(struct msghdr *msg, + struct compat_cmsghdr __user *cmsg, int cmsg_len) + { + char __user *ptr = (char __user *)cmsg + CMSG_COMPAT_ALIGN(cmsg_len); +- if ((unsigned long)(ptr + 1 - (char __user *)msg->msg_control) > ++ if ((unsigned long)(ptr + 1 - (char __force_user *)msg->msg_control) > + msg->msg_controllen) + return NULL; + return (struct compat_cmsghdr __user *)ptr; +@@ -220,7 +220,7 @@ int put_cmsg_compat(struct msghdr *kmsg, + { + struct compat_timeval ctv; + struct compat_timespec cts[3]; +- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control; ++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control; + struct compat_cmsghdr cmhdr; + int cmlen; + +@@ -272,7 +272,7 @@ int put_cmsg_compat(struct msghdr *kmsg, + + void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) + { +- struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __user *) kmsg->msg_control; ++ struct compat_cmsghdr __user *cm = (struct compat_cmsghdr __force_user *) kmsg->msg_control; + int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int); + int fdnum = scm->fp->count; + struct file **fp = scm->fp->fp; +@@ -369,7 +369,7 @@ static int do_set_sock_timeout(struct so + return -EFAULT; + old_fs = get_fs(); + set_fs(KERNEL_DS); +- err = sock_setsockopt(sock, level, optname, (char *)&ktime, sizeof(ktime)); ++ err = sock_setsockopt(sock, level, optname, (char __force_user *)&ktime, sizeof(ktime)); + set_fs(old_fs); + + return err; +@@ -430,7 +430,7 @@ static int do_get_sock_timeout(struct so + len = sizeof(ktime); + old_fs = get_fs(); + set_fs(KERNEL_DS); +- err = sock_getsockopt(sock, level, optname, (char *) &ktime, &len); ++ err = sock_getsockopt(sock, level, optname, (char __force_user *) &ktime, (int __force_user *)&len); + set_fs(old_fs); + + if (!err) { +@@ -565,7 +565,7 @@ int compat_mc_setsockopt(struct sock *so + case MCAST_JOIN_GROUP: + case MCAST_LEAVE_GROUP: + { +- struct compat_group_req __user *gr32 = (void *)optval; ++ struct compat_group_req __user *gr32 = (void __user *)optval; + struct group_req __user *kgr = + compat_alloc_user_space(sizeof(struct group_req)); + u32 interface; +@@ -586,7 +586,7 @@ int compat_mc_setsockopt(struct sock *so + case MCAST_BLOCK_SOURCE: + case MCAST_UNBLOCK_SOURCE: + { +- struct compat_group_source_req __user *gsr32 = (void *)optval; ++ struct compat_group_source_req __user *gsr32 = (void __user *)optval; + struct group_source_req __user *kgsr = compat_alloc_user_space( + sizeof(struct group_source_req)); + u32 interface; +@@ -607,7 +607,7 @@ int compat_mc_setsockopt(struct sock *so + } + case MCAST_MSFILTER: + { +- struct compat_group_filter __user *gf32 = (void *)optval; ++ struct compat_group_filter __user *gf32 = (void __user *)optval; + struct group_filter __user *kgf; + u32 interface, fmode, numsrc; + +@@ -645,7 +645,7 @@ int compat_mc_getsockopt(struct sock *so + char __user *optval, int __user *optlen, + int (*getsockopt)(struct sock *, int, int, char __user *, int __user *)) + { +- struct compat_group_filter __user *gf32 = (void *)optval; ++ struct compat_group_filter __user *gf32 = (void __user *)optval; + struct group_filter __user *kgf; + int __user *koptlen; + u32 interface, fmode, numsrc; diff -urNp linux-3.0.4/net/core/datagram.c linux-3.0.4/net/core/datagram.c --- linux-3.0.4/net/core/datagram.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/core/datagram.c 2011-08-23 21:47:56.000000000 -0400 @@ -68679,6 +70096,27 @@ diff -urNp linux-3.0.4/net/core/flow.c linux-3.0.4/net/core/flow.c if (!IS_ERR(flo)) fle->object = flo; else +diff -urNp linux-3.0.4/net/core/iovec.c linux-3.0.4/net/core/iovec.c +--- linux-3.0.4/net/core/iovec.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/core/iovec.c 2011-10-06 04:17:55.000000000 -0400 +@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struc + if (m->msg_namelen) { + if (mode == VERIFY_READ) { + void __user *namep; +- namep = (void __user __force *) m->msg_name; ++ namep = (void __force_user *) m->msg_name; + err = move_addr_to_kernel(namep, m->msg_namelen, + address); + if (err < 0) +@@ -54,7 +54,7 @@ int verify_iovec(struct msghdr *m, struc + } + + size = m->msg_iovlen * sizeof(struct iovec); +- if (copy_from_user(iov, (void __user __force *) m->msg_iov, size)) ++ if (copy_from_user(iov, (void __force_user *) m->msg_iov, size)) + return -EFAULT; + + m->msg_iov = iov; diff -urNp linux-3.0.4/net/core/rtnetlink.c linux-3.0.4/net/core/rtnetlink.c --- linux-3.0.4/net/core/rtnetlink.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/core/rtnetlink.c 2011-08-23 21:47:56.000000000 -0400 @@ -68691,6 +70129,45 @@ diff -urNp linux-3.0.4/net/core/rtnetlink.c linux-3.0.4/net/core/rtnetlink.c static DEFINE_MUTEX(rtnl_mutex); +diff -urNp linux-3.0.4/net/core/scm.c linux-3.0.4/net/core/scm.c +--- linux-3.0.4/net/core/scm.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/core/scm.c 2011-10-06 04:17:55.000000000 -0400 +@@ -218,7 +218,7 @@ EXPORT_SYMBOL(__scm_send); + int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) + { + struct cmsghdr __user *cm +- = (__force struct cmsghdr __user *)msg->msg_control; ++ = (struct cmsghdr __force_user *)msg->msg_control; + struct cmsghdr cmhdr; + int cmlen = CMSG_LEN(len); + int err; +@@ -241,7 +241,7 @@ int put_cmsg(struct msghdr * msg, int le + err = -EFAULT; + if (copy_to_user(cm, &cmhdr, sizeof cmhdr)) + goto out; +- if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) ++ if (copy_to_user((void __force_user *)CMSG_DATA((void __force_kernel *)cm), data, cmlen - sizeof(struct cmsghdr))) + goto out; + cmlen = CMSG_SPACE(len); + if (msg->msg_controllen < cmlen) +@@ -257,7 +257,7 @@ EXPORT_SYMBOL(put_cmsg); + void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) + { + struct cmsghdr __user *cm +- = (__force struct cmsghdr __user*)msg->msg_control; ++ = (struct cmsghdr __force_user *)msg->msg_control; + + int fdmax = 0; + int fdnum = scm->fp->count; +@@ -277,7 +277,7 @@ void scm_detach_fds(struct msghdr *msg, + if (fdnum < fdmax) + fdmax = fdnum; + +- for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax; ++ for (i=0, cmfptr=(int __force_user *)CMSG_DATA((void __force_kernel *)cm); i<fdmax; + i++, cmfptr++) + { + int new_fd; diff -urNp linux-3.0.4/net/core/skbuff.c linux-3.0.4/net/core/skbuff.c --- linux-3.0.4/net/core/skbuff.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/core/skbuff.c 2011-08-23 21:48:14.000000000 -0400 @@ -68974,6 +70451,36 @@ diff -urNp linux-3.0.4/net/ipv4/inetpeer.c linux-3.0.4/net/ipv4/inetpeer.c p->tcp_ts_stamp = 0; p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; p->rate_tokens = 0; +diff -urNp linux-3.0.4/net/ipv4/ipconfig.c linux-3.0.4/net/ipv4/ipconfig.c +--- linux-3.0.4/net/ipv4/ipconfig.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/ipv4/ipconfig.c 2011-10-06 04:17:55.000000000 -0400 +@@ -313,7 +313,7 @@ static int __init ic_devinet_ioctl(unsig + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = devinet_ioctl(&init_net, cmd, (struct ifreq __user *) arg); ++ res = devinet_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg); + set_fs(oldfs); + return res; + } +@@ -324,7 +324,7 @@ static int __init ic_dev_ioctl(unsigned + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = dev_ioctl(&init_net, cmd, (struct ifreq __user *) arg); ++ res = dev_ioctl(&init_net, cmd, (struct ifreq __force_user *) arg); + set_fs(oldfs); + return res; + } +@@ -335,7 +335,7 @@ static int __init ic_route_ioctl(unsigne + + mm_segment_t oldfs = get_fs(); + set_fs(get_ds()); +- res = ip_rt_ioctl(&init_net, cmd, (void __user *) arg); ++ res = ip_rt_ioctl(&init_net, cmd, (void __force_user *) arg); + set_fs(oldfs); + return res; + } diff -urNp linux-3.0.4/net/ipv4/ip_fragment.c linux-3.0.4/net/ipv4/ip_fragment.c --- linux-3.0.4/net/ipv4/ip_fragment.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/ipv4/ip_fragment.c 2011-08-23 21:47:56.000000000 -0400 @@ -68988,7 +70495,7 @@ diff -urNp linux-3.0.4/net/ipv4/ip_fragment.c linux-3.0.4/net/ipv4/ip_fragment.c rc = qp->q.fragments && (end - start) > max; diff -urNp linux-3.0.4/net/ipv4/ip_sockglue.c linux-3.0.4/net/ipv4/ip_sockglue.c --- linux-3.0.4/net/ipv4/ip_sockglue.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/net/ipv4/ip_sockglue.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/net/ipv4/ip_sockglue.c 2011-10-06 04:17:55.000000000 -0400 @@ -1073,6 +1073,8 @@ static int do_ip_getsockopt(struct sock int val; int len; @@ -69008,6 +70515,15 @@ diff -urNp linux-3.0.4/net/ipv4/ip_sockglue.c linux-3.0.4/net/ipv4/ip_sockglue.c return -EFAULT; return 0; } +@@ -1238,7 +1241,7 @@ static int do_ip_getsockopt(struct sock + if (sk->sk_type != SOCK_STREAM) + return -ENOPROTOOPT; + +- msg.msg_control = optval; ++ msg.msg_control = (void __force_kernel *)optval; + msg.msg_controllen = len; + msg.msg_flags = 0; + diff -urNp linux-3.0.4/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-3.0.4/net/ipv4/netfilter/nf_nat_snmp_basic.c --- linux-3.0.4/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/ipv4/netfilter/nf_nat_snmp_basic.c 2011-08-23 21:47:56.000000000 -0400 @@ -69434,6 +70950,18 @@ diff -urNp linux-3.0.4/net/ipv4/udp.c linux-3.0.4/net/ipv4/udp.c } int udp4_seq_show(struct seq_file *seq, void *v) +diff -urNp linux-3.0.4/net/ipv6/addrconf.c linux-3.0.4/net/ipv6/addrconf.c +--- linux-3.0.4/net/ipv6/addrconf.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/ipv6/addrconf.c 2011-10-06 04:17:55.000000000 -0400 +@@ -2072,7 +2072,7 @@ int addrconf_set_dstaddr(struct net *net + p.iph.ihl = 5; + p.iph.protocol = IPPROTO_IPV6; + p.iph.ttl = 64; +- ifr.ifr_ifru.ifru_data = (__force void __user *)&p; ++ ifr.ifr_ifru.ifru_data = (void __force_user *)&p; + + if (ops->ndo_do_ioctl) { + mm_segment_t oldfs = get_fs(); diff -urNp linux-3.0.4/net/ipv6/inet6_connection_sock.c linux-3.0.4/net/ipv6/inet6_connection_sock.c --- linux-3.0.4/net/ipv6/inet6_connection_sock.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/ipv6/inet6_connection_sock.c 2011-08-23 21:47:56.000000000 -0400 @@ -69457,7 +70985,7 @@ diff -urNp linux-3.0.4/net/ipv6/inet6_connection_sock.c linux-3.0.4/net/ipv6/ine } diff -urNp linux-3.0.4/net/ipv6/ipv6_sockglue.c linux-3.0.4/net/ipv6/ipv6_sockglue.c --- linux-3.0.4/net/ipv6/ipv6_sockglue.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/net/ipv6/ipv6_sockglue.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/net/ipv6/ipv6_sockglue.c 2011-10-06 04:17:55.000000000 -0400 @@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc int val, valbool; int retv = -ENOPROTOOPT; @@ -69476,6 +71004,15 @@ diff -urNp linux-3.0.4/net/ipv6/ipv6_sockglue.c linux-3.0.4/net/ipv6/ipv6_sockgl if (ip6_mroute_opt(optname)) return ip6_mroute_getsockopt(sk, optname, optval, optlen); +@@ -960,7 +964,7 @@ static int do_ipv6_getsockopt(struct soc + if (sk->sk_type != SOCK_STREAM) + return -ENOPROTOOPT; + +- msg.msg_control = optval; ++ msg.msg_control = (void __force_kernel *)optval; + msg.msg_controllen = len; + msg.msg_flags = 0; + diff -urNp linux-3.0.4/net/ipv6/raw.c linux-3.0.4/net/ipv6/raw.c --- linux-3.0.4/net/ipv6/raw.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/ipv6/raw.c 2011-08-23 21:48:14.000000000 -0400 @@ -70754,6 +72291,30 @@ diff -urNp linux-3.0.4/net/rds/iw_recv.c linux-3.0.4/net/rds/iw_recv.c } #endif +diff -urNp linux-3.0.4/net/rds/tcp.c linux-3.0.4/net/rds/tcp.c +--- linux-3.0.4/net/rds/tcp.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/rds/tcp.c 2011-10-06 04:17:55.000000000 -0400 +@@ -58,7 +58,7 @@ void rds_tcp_nonagle(struct socket *sock + int val = 1; + + set_fs(KERNEL_DS); +- sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __user *)&val, ++ sock->ops->setsockopt(sock, SOL_TCP, TCP_NODELAY, (char __force_user *)&val, + sizeof(val)); + set_fs(oldfs); + } +diff -urNp linux-3.0.4/net/rds/tcp_send.c linux-3.0.4/net/rds/tcp_send.c +--- linux-3.0.4/net/rds/tcp_send.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/rds/tcp_send.c 2011-10-06 04:17:55.000000000 -0400 +@@ -43,7 +43,7 @@ static void rds_tcp_cork(struct socket * + + oldfs = get_fs(); + set_fs(KERNEL_DS); +- sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __user *)&val, ++ sock->ops->setsockopt(sock, SOL_TCP, TCP_CORK, (char __force_user *)&val, + sizeof(val)); + set_fs(oldfs); + } diff -urNp linux-3.0.4/net/rxrpc/af_rxrpc.c linux-3.0.4/net/rxrpc/af_rxrpc.c --- linux-3.0.4/net/rxrpc/af_rxrpc.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/rxrpc/af_rxrpc.c 2011-08-23 21:47:56.000000000 -0400 @@ -71055,7 +72616,7 @@ diff -urNp linux-3.0.4/net/sctp/socket.c linux-3.0.4/net/sctp/socket.c cnt++; diff -urNp linux-3.0.4/net/socket.c linux-3.0.4/net/socket.c --- linux-3.0.4/net/socket.c 2011-09-02 18:11:21.000000000 -0400 -+++ linux-3.0.4/net/socket.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/net/socket.c 2011-10-06 04:17:55.000000000 -0400 @@ -88,6 +88,7 @@ #include <linux/nsproxy.h> #include <linux/magic.h> @@ -71215,6 +72776,114 @@ diff -urNp linux-3.0.4/net/socket.c linux-3.0.4/net/socket.c err = -EFAULT; if (MSG_CMSG_COMPAT & flags) { if (get_compat_msghdr(msg_sys, msg_compat)) +@@ -1950,7 +2012,7 @@ static int __sys_sendmsg(struct socket * + * checking falls down on this. + */ + if (copy_from_user(ctl_buf, +- (void __user __force *)msg_sys->msg_control, ++ (void __force_user *)msg_sys->msg_control, + ctl_len)) + goto out_freectl; + msg_sys->msg_control = ctl_buf; +@@ -2118,7 +2180,7 @@ static int __sys_recvmsg(struct socket * + * kernel msghdr to use the kernel address space) + */ + +- uaddr = (__force void __user *)msg_sys->msg_name; ++ uaddr = (void __force_user *)msg_sys->msg_name; + uaddr_len = COMPAT_NAMELEN(msg); + if (MSG_CMSG_COMPAT & flags) { + err = verify_compat_iovec(msg_sys, iov, +@@ -2746,7 +2808,7 @@ static int ethtool_ioctl(struct net *net + } + + ifr = compat_alloc_user_space(buf_size); +- rxnfc = (void *)ifr + ALIGN(sizeof(struct ifreq), 8); ++ rxnfc = (void __user *)ifr + ALIGN(sizeof(struct ifreq), 8); + + if (copy_in_user(&ifr->ifr_name, &ifr32->ifr_name, IFNAMSIZ)) + return -EFAULT; +@@ -2770,12 +2832,12 @@ static int ethtool_ioctl(struct net *net + offsetof(struct ethtool_rxnfc, fs.ring_cookie)); + + if (copy_in_user(rxnfc, compat_rxnfc, +- (void *)(&rxnfc->fs.m_ext + 1) - +- (void *)rxnfc) || ++ (void __user *)(&rxnfc->fs.m_ext + 1) - ++ (void __user *)rxnfc) || + copy_in_user(&rxnfc->fs.ring_cookie, + &compat_rxnfc->fs.ring_cookie, +- (void *)(&rxnfc->fs.location + 1) - +- (void *)&rxnfc->fs.ring_cookie) || ++ (void __user *)(&rxnfc->fs.location + 1) - ++ (void __user *)&rxnfc->fs.ring_cookie) || + copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt, + sizeof(rxnfc->rule_cnt))) + return -EFAULT; +@@ -2787,12 +2849,12 @@ static int ethtool_ioctl(struct net *net + + if (convert_out) { + if (copy_in_user(compat_rxnfc, rxnfc, +- (const void *)(&rxnfc->fs.m_ext + 1) - +- (const void *)rxnfc) || ++ (const void __user *)(&rxnfc->fs.m_ext + 1) - ++ (const void __user *)rxnfc) || + copy_in_user(&compat_rxnfc->fs.ring_cookie, + &rxnfc->fs.ring_cookie, +- (const void *)(&rxnfc->fs.location + 1) - +- (const void *)&rxnfc->fs.ring_cookie) || ++ (const void __user *)(&rxnfc->fs.location + 1) - ++ (const void __user *)&rxnfc->fs.ring_cookie) || + copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt, + sizeof(rxnfc->rule_cnt))) + return -EFAULT; +@@ -2862,7 +2924,7 @@ static int bond_ioctl(struct net *net, u + old_fs = get_fs(); + set_fs(KERNEL_DS); + err = dev_ioctl(net, cmd, +- (struct ifreq __user __force *) &kifr); ++ (struct ifreq __force_user *) &kifr); + set_fs(old_fs); + + return err; +@@ -2971,7 +3033,7 @@ static int compat_sioc_ifmap(struct net + + old_fs = get_fs(); + set_fs(KERNEL_DS); +- err = dev_ioctl(net, cmd, (void __user __force *)&ifr); ++ err = dev_ioctl(net, cmd, (void __force_user *)&ifr); + set_fs(old_fs); + + if (cmd == SIOCGIFMAP && !err) { +@@ -3076,7 +3138,7 @@ static int routing_ioctl(struct net *net + ret |= __get_user(rtdev, &(ur4->rt_dev)); + if (rtdev) { + ret |= copy_from_user(devname, compat_ptr(rtdev), 15); +- r4.rt_dev = (char __user __force *)devname; ++ r4.rt_dev = (char __force_user *)devname; + devname[15] = 0; + } else + r4.rt_dev = NULL; +@@ -3316,8 +3378,8 @@ int kernel_getsockopt(struct socket *soc + int __user *uoptlen; + int err; + +- uoptval = (char __user __force *) optval; +- uoptlen = (int __user __force *) optlen; ++ uoptval = (char __force_user *) optval; ++ uoptlen = (int __force_user *) optlen; + + set_fs(KERNEL_DS); + if (level == SOL_SOCKET) +@@ -3337,7 +3399,7 @@ int kernel_setsockopt(struct socket *soc + char __user *uoptval; + int err; + +- uoptval = (char __user __force *) optval; ++ uoptval = (char __force_user *) optval; + + set_fs(KERNEL_DS); + if (level == SOL_SOCKET) diff -urNp linux-3.0.4/net/sunrpc/sched.c linux-3.0.4/net/sunrpc/sched.c --- linux-3.0.4/net/sunrpc/sched.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/sunrpc/sched.c 2011-08-23 21:47:56.000000000 -0400 @@ -71230,6 +72899,18 @@ diff -urNp linux-3.0.4/net/sunrpc/sched.c linux-3.0.4/net/sunrpc/sched.c } #else static inline void rpc_task_set_debuginfo(struct rpc_task *task) +diff -urNp linux-3.0.4/net/sunrpc/svcsock.c linux-3.0.4/net/sunrpc/svcsock.c +--- linux-3.0.4/net/sunrpc/svcsock.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/sunrpc/svcsock.c 2011-10-06 04:17:55.000000000 -0400 +@@ -392,7 +392,7 @@ static int svc_partial_recvfrom(struct s + int buflen, unsigned int base) + { + size_t save_iovlen; +- void __user *save_iovbase; ++ void *save_iovbase; + unsigned int i; + int ret; + diff -urNp linux-3.0.4/net/sunrpc/xprtrdma/svc_rdma.c linux-3.0.4/net/sunrpc/xprtrdma/svc_rdma.c --- linux-3.0.4/net/sunrpc/xprtrdma/svc_rdma.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/sunrpc/xprtrdma/svc_rdma.c 2011-08-23 21:47:56.000000000 -0400 @@ -71442,6 +73123,60 @@ diff -urNp linux-3.0.4/net/sysctl_net.c linux-3.0.4/net/sysctl_net.c int mode = (table->mode >> 6) & 7; return (mode << 6) | (mode << 3) | mode; } +diff -urNp linux-3.0.4/net/tipc/link.c linux-3.0.4/net/tipc/link.c +--- linux-3.0.4/net/tipc/link.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/tipc/link.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1170,7 +1170,7 @@ static int link_send_sections_long(struc + struct tipc_msg fragm_hdr; + struct sk_buff *buf, *buf_chain, *prev; + u32 fragm_crs, fragm_rest, hsz, sect_rest; +- const unchar *sect_crs; ++ const unchar __user *sect_crs; + int curr_sect; + u32 fragm_no; + +@@ -1214,7 +1214,7 @@ again: + + if (!sect_rest) { + sect_rest = msg_sect[++curr_sect].iov_len; +- sect_crs = (const unchar *)msg_sect[curr_sect].iov_base; ++ sect_crs = (const unchar __user *)msg_sect[curr_sect].iov_base; + } + + if (sect_rest < fragm_rest) +@@ -1233,7 +1233,7 @@ error: + } + } else + skb_copy_to_linear_data_offset(buf, fragm_crs, +- sect_crs, sz); ++ (const void __force_kernel *)sect_crs, sz); + sect_crs += sz; + sect_rest -= sz; + fragm_crs += sz; +diff -urNp linux-3.0.4/net/tipc/msg.c linux-3.0.4/net/tipc/msg.c +--- linux-3.0.4/net/tipc/msg.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/tipc/msg.c 2011-10-06 04:17:55.000000000 -0400 +@@ -101,7 +101,7 @@ int tipc_msg_build(struct tipc_msg *hdr, + msg_sect[cnt].iov_len); + else + skb_copy_to_linear_data_offset(*buf, pos, +- msg_sect[cnt].iov_base, ++ (const void __force_kernel *)msg_sect[cnt].iov_base, + msg_sect[cnt].iov_len); + pos += msg_sect[cnt].iov_len; + } +diff -urNp linux-3.0.4/net/tipc/subscr.c linux-3.0.4/net/tipc/subscr.c +--- linux-3.0.4/net/tipc/subscr.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/net/tipc/subscr.c 2011-10-06 04:17:55.000000000 -0400 +@@ -101,7 +101,7 @@ static void subscr_send_event(struct sub + { + struct iovec msg_sect; + +- msg_sect.iov_base = (void *)&sub->evt; ++ msg_sect.iov_base = (void __force_user *)&sub->evt; + msg_sect.iov_len = sizeof(struct tipc_event); + + sub->evt.event = htohl(event, sub->swap); diff -urNp linux-3.0.4/net/unix/af_unix.c linux-3.0.4/net/unix/af_unix.c --- linux-3.0.4/net/unix/af_unix.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/net/unix/af_unix.c 2011-08-23 21:48:14.000000000 -0400 @@ -71637,7 +73372,29 @@ diff -urNp linux-3.0.4/net/xfrm/xfrm_user.c linux-3.0.4/net/xfrm/xfrm_user.c diff -urNp linux-3.0.4/scripts/basic/fixdep.c linux-3.0.4/scripts/basic/fixdep.c --- linux-3.0.4/scripts/basic/fixdep.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/scripts/basic/fixdep.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/scripts/basic/fixdep.c 2011-10-06 04:17:55.000000000 -0400 +@@ -161,7 +161,7 @@ static unsigned int strhash(const char * + /* + * Lookup a value in the configuration string. + */ +-static int is_defined_config(const char *name, int len, unsigned int hash) ++static int is_defined_config(const char *name, unsigned int len, unsigned int hash) + { + struct item *aux; + +@@ -211,10 +211,10 @@ static void clear_config(void) + /* + * Record the use of a CONFIG_* word. + */ +-static void use_config(const char *m, int slen) ++static void use_config(const char *m, unsigned int slen) + { + unsigned int hash = strhash(m, slen); +- int c, i; ++ unsigned int c, i; + + if (is_defined_config(m, slen, hash)) + return; @@ -235,9 +235,9 @@ static void use_config(const char *m, in static void parse_config_file(const char *map, size_t len) @@ -71711,7 +73468,7 @@ diff -urNp linux-3.0.4/scripts/Makefile.host linux-3.0.4/scripts/Makefile.host diff -urNp linux-3.0.4/scripts/mod/file2alias.c linux-3.0.4/scripts/mod/file2alias.c --- linux-3.0.4/scripts/mod/file2alias.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/scripts/mod/file2alias.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/scripts/mod/file2alias.c 2011-10-06 04:17:55.000000000 -0400 @@ -72,7 +72,7 @@ static void device_id_check(const char * unsigned long size, unsigned long id_size, void *symval) @@ -71730,6 +73487,15 @@ diff -urNp linux-3.0.4/scripts/mod/file2alias.c linux-3.0.4/scripts/mod/file2ali unsigned char range_lo, unsigned char range_hi, unsigned char max, struct module *mod) { +@@ -203,7 +203,7 @@ static void do_usb_entry_multi(struct us + { + unsigned int devlo, devhi; + unsigned char chi, clo, max; +- int ndigits; ++ unsigned int ndigits; + + id->match_flags = TO_NATIVE(id->match_flags); + id->idVendor = TO_NATIVE(id->idVendor); @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *sy for (i = 0; i < count; i++) { const char *id = (char *)devs[i].id; @@ -72008,7 +73774,7 @@ diff -urNp linux-3.0.4/security/integrity/ima/ima_queue.c linux-3.0.4/security/i return 0; diff -urNp linux-3.0.4/security/Kconfig linux-3.0.4/security/Kconfig --- linux-3.0.4/security/Kconfig 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/security/Kconfig 2011-09-17 00:58:04.000000000 -0400 ++++ linux-3.0.4/security/Kconfig 2011-10-06 04:19:25.000000000 -0400 @@ -4,6 +4,558 @@ menu "Security options" @@ -72331,7 +74097,7 @@ diff -urNp linux-3.0.4/security/Kconfig linux-3.0.4/security/Kconfig + +config PAX_KERNEXEC + bool "Enforce non-executable kernel pages" -+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN ++ depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN + select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE) + select PAX_KERNEXEC_PLUGIN if X86_64 + help @@ -72399,7 +74165,7 @@ diff -urNp linux-3.0.4/security/Kconfig linux-3.0.4/security/Kconfig + +config PAX_RANDKSTACK + bool "Randomize kernel stack base" -+ depends on PAX_ASLR && X86_TSC && X86 ++ depends on X86_TSC && X86 + help + By saying Y here the kernel will randomize every task's kernel + stack on every system call. This will not only force an attacker @@ -72577,6 +74343,57 @@ diff -urNp linux-3.0.4/security/Kconfig linux-3.0.4/security/Kconfig default 65536 help This is the portion of low virtual memory which should be protected +diff -urNp linux-3.0.4/security/keys/compat.c linux-3.0.4/security/keys/compat.c +--- linux-3.0.4/security/keys/compat.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/security/keys/compat.c 2011-10-06 04:17:55.000000000 -0400 +@@ -44,7 +44,7 @@ long compat_keyctl_instantiate_key_iov( + if (ret == 0) + goto no_payload_free; + +- ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid); ++ ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid); + + if (iov != iovstack) + kfree(iov); +diff -urNp linux-3.0.4/security/keys/keyctl.c linux-3.0.4/security/keys/keyctl.c +--- linux-3.0.4/security/keys/keyctl.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/security/keys/keyctl.c 2011-10-06 04:17:55.000000000 -0400 +@@ -921,7 +921,7 @@ static int keyctl_change_reqkey_auth(str + /* + * Copy the iovec data from userspace + */ +-static long copy_from_user_iovec(void *buffer, const struct iovec *iov, ++static long copy_from_user_iovec(void *buffer, const struct iovec __user *iov, + unsigned ioc) + { + for (; ioc > 0; ioc--) { +@@ -943,7 +943,7 @@ static long copy_from_user_iovec(void *b + * If successful, 0 will be returned. + */ + long keyctl_instantiate_key_common(key_serial_t id, +- const struct iovec *payload_iov, ++ const struct iovec __user *payload_iov, + unsigned ioc, + size_t plen, + key_serial_t ringid) +@@ -1038,7 +1038,7 @@ long keyctl_instantiate_key(key_serial_t + [0].iov_len = plen + }; + +- return keyctl_instantiate_key_common(id, iov, 1, plen, ringid); ++ return keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, 1, plen, ringid); + } + + return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid); +@@ -1071,7 +1071,7 @@ long keyctl_instantiate_key_iov(key_seri + if (ret == 0) + goto no_payload_free; + +- ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid); ++ ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid); + + if (iov != iovstack) + kfree(iov); diff -urNp linux-3.0.4/security/keys/keyring.c linux-3.0.4/security/keys/keyring.c --- linux-3.0.4/security/keys/keyring.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/security/keys/keyring.c 2011-08-23 21:47:56.000000000 -0400 @@ -72752,6 +74569,109 @@ diff -urNp linux-3.0.4/sound/aoa/codecs/onyx.h linux-3.0.4/sound/aoa/codecs/onyx /* PCM3052 register definitions */ +diff -urNp linux-3.0.4/sound/core/oss/pcm_oss.c linux-3.0.4/sound/core/oss/pcm_oss.c +--- linux-3.0.4/sound/core/oss/pcm_oss.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/sound/core/oss/pcm_oss.c 2011-10-06 04:17:55.000000000 -0400 +@@ -1189,10 +1189,10 @@ snd_pcm_sframes_t snd_pcm_oss_write3(str + if (in_kernel) { + mm_segment_t fs; + fs = snd_enter_user(); +- ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames); ++ ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames); + snd_leave_user(fs); + } else { +- ret = snd_pcm_lib_write(substream, (void __force __user *)ptr, frames); ++ ret = snd_pcm_lib_write(substream, (void __force_user *)ptr, frames); + } + if (ret != -EPIPE && ret != -ESTRPIPE) + break; +@@ -1234,10 +1234,10 @@ snd_pcm_sframes_t snd_pcm_oss_read3(stru + if (in_kernel) { + mm_segment_t fs; + fs = snd_enter_user(); +- ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames); ++ ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames); + snd_leave_user(fs); + } else { +- ret = snd_pcm_lib_read(substream, (void __force __user *)ptr, frames); ++ ret = snd_pcm_lib_read(substream, (void __force_user *)ptr, frames); + } + if (ret == -EPIPE) { + if (runtime->status->state == SNDRV_PCM_STATE_DRAINING) { +@@ -1337,7 +1337,7 @@ static ssize_t snd_pcm_oss_write2(struct + struct snd_pcm_plugin_channel *channels; + size_t oss_frame_bytes = (runtime->oss.plugin_first->src_width * runtime->oss.plugin_first->src_format.channels) / 8; + if (!in_kernel) { +- if (copy_from_user(runtime->oss.buffer, (const char __force __user *)buf, bytes)) ++ if (copy_from_user(runtime->oss.buffer, (const char __force_user *)buf, bytes)) + return -EFAULT; + buf = runtime->oss.buffer; + } +@@ -1407,7 +1407,7 @@ static ssize_t snd_pcm_oss_write1(struct + } + } else { + tmp = snd_pcm_oss_write2(substream, +- (const char __force *)buf, ++ (const char __force_kernel *)buf, + runtime->oss.period_bytes, 0); + if (tmp <= 0) + goto err; +@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct + struct snd_pcm_runtime *runtime = substream->runtime; + snd_pcm_sframes_t frames, frames1; + #ifdef CONFIG_SND_PCM_OSS_PLUGINS +- char __user *final_dst = (char __force __user *)buf; ++ char __user *final_dst = (char __force_user *)buf; + if (runtime->oss.plugin_first) { + struct snd_pcm_plugin_channel *channels; + size_t oss_frame_bytes = (runtime->oss.plugin_last->dst_width * runtime->oss.plugin_last->dst_format.channels) / 8; +@@ -1495,7 +1495,7 @@ static ssize_t snd_pcm_oss_read1(struct + xfer += tmp; + runtime->oss.buffer_used -= tmp; + } else { +- tmp = snd_pcm_oss_read2(substream, (char __force *)buf, ++ tmp = snd_pcm_oss_read2(substream, (char __force_kernel *)buf, + runtime->oss.period_bytes, 0); + if (tmp <= 0) + goto err; +@@ -1663,7 +1663,7 @@ static int snd_pcm_oss_sync(struct snd_p + size1); + size1 /= runtime->channels; /* frames */ + fs = snd_enter_user(); +- snd_pcm_lib_write(substream, (void __force __user *)runtime->oss.buffer, size1); ++ snd_pcm_lib_write(substream, (void __force_user *)runtime->oss.buffer, size1); + snd_leave_user(fs); + } + } else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) { +diff -urNp linux-3.0.4/sound/core/pcm_compat.c linux-3.0.4/sound/core/pcm_compat.c +--- linux-3.0.4/sound/core/pcm_compat.c 2011-09-02 18:11:21.000000000 -0400 ++++ linux-3.0.4/sound/core/pcm_compat.c 2011-10-06 04:17:55.000000000 -0400 +@@ -31,7 +31,7 @@ static int snd_pcm_ioctl_delay_compat(st + int err; + + fs = snd_enter_user(); +- err = snd_pcm_delay(substream, &delay); ++ err = snd_pcm_delay(substream, (snd_pcm_sframes_t __force_user *)&delay); + snd_leave_user(fs); + if (err < 0) + return err; +diff -urNp linux-3.0.4/sound/core/pcm_native.c linux-3.0.4/sound/core/pcm_native.c +--- linux-3.0.4/sound/core/pcm_native.c 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/sound/core/pcm_native.c 2011-10-06 04:17:55.000000000 -0400 +@@ -2770,11 +2770,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_ + switch (substream->stream) { + case SNDRV_PCM_STREAM_PLAYBACK: + result = snd_pcm_playback_ioctl1(NULL, substream, cmd, +- (void __user *)arg); ++ (void __force_user *)arg); + break; + case SNDRV_PCM_STREAM_CAPTURE: + result = snd_pcm_capture_ioctl1(NULL, substream, cmd, +- (void __user *)arg); ++ (void __force_user *)arg); + break; + default: + result = -EINVAL; diff -urNp linux-3.0.4/sound/core/seq/seq_device.c linux-3.0.4/sound/core/seq/seq_device.c --- linux-3.0.4/sound/core/seq/seq_device.c 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/sound/core/seq/seq_device.c 2011-08-23 21:47:56.000000000 -0400 @@ -73161,6 +75081,179 @@ diff -urNp linux-3.0.4/sound/usb/card.h linux-3.0.4/sound/usb/card.h }; struct snd_usb_stream { +diff -urNp linux-3.0.4/tools/gcc/checker_plugin.c linux-3.0.4/tools/gcc/checker_plugin.c +--- linux-3.0.4/tools/gcc/checker_plugin.c 1969-12-31 19:00:00.000000000 -0500 ++++ linux-3.0.4/tools/gcc/checker_plugin.c 2011-10-06 04:17:55.000000000 -0400 +@@ -0,0 +1,169 @@ ++/* ++ * Copyright 2011 by the PaX Team <pageexec@freemail.hu> ++ * Licensed under the GPL v2 ++ * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * ++ * gcc plugin to implement various sparse (source code checker) features ++ * ++ * TODO: ++ * - define separate __iomem, __percpu and __rcu address spaces (lots of code to patch) ++ * ++ * BUGS: ++ * - none known ++ */ ++#include "gcc-plugin.h" ++#include "config.h" ++#include "system.h" ++#include "coretypes.h" ++#include "tree.h" ++#include "tree-pass.h" ++#include "intl.h" ++#include "plugin-version.h" ++#include "tm.h" ++#include "toplev.h" ++#include "basic-block.h" ++#include "gimple.h" ++//#include "expr.h" where are you... ++#include "diagnostic.h" ++#include "rtl.h" ++#include "emit-rtl.h" ++#include "function.h" ++#include "tree-flow.h" ++#include "target.h" ++ ++extern void c_register_addr_space (const char *str, addr_space_t as); ++extern enum machine_mode default_addr_space_pointer_mode (addr_space_t); ++extern enum machine_mode default_addr_space_address_mode (addr_space_t); ++extern bool default_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as); ++extern bool default_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as); ++extern rtx default_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as); ++ ++extern void print_gimple_stmt(FILE *, gimple, int, int); ++extern rtx emit_move_insn(rtx x, rtx y); ++ ++int plugin_is_GPL_compatible; ++ ++static struct plugin_info checker_plugin_info = { ++ .version = "201110031940", ++}; ++ ++#define ADDR_SPACE_KERNEL 0 ++#define ADDR_SPACE_FORCE_KERNEL 1 ++#define ADDR_SPACE_USER 2 ++#define ADDR_SPACE_FORCE_USER 3 ++#define ADDR_SPACE_IOMEM 0 ++#define ADDR_SPACE_FORCE_IOMEM 0 ++#define ADDR_SPACE_PERCPU 0 ++#define ADDR_SPACE_FORCE_PERCPU 0 ++#define ADDR_SPACE_RCU 0 ++#define ADDR_SPACE_FORCE_RCU 0 ++ ++static enum machine_mode checker_addr_space_pointer_mode(addr_space_t addrspace) ++{ ++ return default_addr_space_pointer_mode(ADDR_SPACE_GENERIC); ++} ++ ++static enum machine_mode checker_addr_space_address_mode(addr_space_t addrspace) ++{ ++ return default_addr_space_address_mode(ADDR_SPACE_GENERIC); ++} ++ ++static bool checker_addr_space_valid_pointer_mode(enum machine_mode mode, addr_space_t as) ++{ ++ return default_addr_space_valid_pointer_mode(mode, as); ++} ++ ++static bool checker_addr_space_legitimate_address_p(enum machine_mode mode, rtx mem, bool strict, addr_space_t as) ++{ ++ return default_addr_space_legitimate_address_p(mode, mem, strict, ADDR_SPACE_GENERIC); ++} ++ ++static rtx checker_addr_space_legitimize_address(rtx x, rtx oldx, enum machine_mode mode, addr_space_t as) ++{ ++ return default_addr_space_legitimize_address(x, oldx, mode, as); ++} ++ ++static bool checker_addr_space_subset_p(addr_space_t subset, addr_space_t superset) ++{ ++ if (subset == ADDR_SPACE_FORCE_KERNEL && superset == ADDR_SPACE_KERNEL) ++ return true; ++ ++ if (subset == ADDR_SPACE_FORCE_USER && superset == ADDR_SPACE_USER) ++ return true; ++ ++ if (subset == ADDR_SPACE_FORCE_IOMEM && superset == ADDR_SPACE_IOMEM) ++ return true; ++ ++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_USER) ++ return true; ++ ++ if (subset == ADDR_SPACE_KERNEL && superset == ADDR_SPACE_FORCE_IOMEM) ++ return true; ++ ++ if (subset == ADDR_SPACE_USER && superset == ADDR_SPACE_FORCE_KERNEL) ++ return true; ++ ++ if (subset == ADDR_SPACE_IOMEM && superset == ADDR_SPACE_FORCE_KERNEL) ++ return true; ++ ++ return subset == superset; ++} ++ ++static rtx checker_addr_space_convert(rtx op, tree from_type, tree to_type) ++{ ++// addr_space_t from_as = TYPE_ADDR_SPACE(TREE_TYPE(from_type)); ++// addr_space_t to_as = TYPE_ADDR_SPACE(TREE_TYPE(to_type)); ++ ++ return op; ++} ++ ++static void register_checker_address_spaces(void *event_data, void *data) ++{ ++ c_register_addr_space("__kernel", ADDR_SPACE_KERNEL); ++ c_register_addr_space("__force_kernel", ADDR_SPACE_FORCE_KERNEL); ++ c_register_addr_space("__user", ADDR_SPACE_USER); ++ c_register_addr_space("__force_user", ADDR_SPACE_FORCE_USER); ++// c_register_addr_space("__iomem", ADDR_SPACE_IOMEM); ++// c_register_addr_space("__force_iomem", ADDR_SPACE_FORCE_IOMEM); ++// c_register_addr_space("__percpu", ADDR_SPACE_PERCPU); ++// c_register_addr_space("__force_percpu", ADDR_SPACE_FORCE_PERCPU); ++// c_register_addr_space("__rcu", ADDR_SPACE_RCU); ++// c_register_addr_space("__force_rcu", ADDR_SPACE_FORCE_RCU); ++ ++ targetm.addr_space.pointer_mode = checker_addr_space_pointer_mode; ++ targetm.addr_space.address_mode = checker_addr_space_address_mode; ++ targetm.addr_space.valid_pointer_mode = checker_addr_space_valid_pointer_mode; ++ targetm.addr_space.legitimate_address_p = checker_addr_space_legitimate_address_p; ++// targetm.addr_space.legitimize_address = checker_addr_space_legitimize_address; ++ targetm.addr_space.subset_p = checker_addr_space_subset_p; ++ targetm.addr_space.convert = checker_addr_space_convert; ++} ++ ++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) ++{ ++ const char * const plugin_name = plugin_info->base_name; ++ const int argc = plugin_info->argc; ++ const struct plugin_argument * const argv = plugin_info->argv; ++ int i; ++ ++ if (!plugin_default_version_check(version, &gcc_version)) { ++ error(G_("incompatible gcc/plugin versions")); ++ return 1; ++ } ++ ++ register_callback(plugin_name, PLUGIN_INFO, NULL, &checker_plugin_info); ++ ++ for (i = 0; i < argc; ++i) ++ error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); ++ ++ if (TARGET_64BIT == 0) ++ return 0; ++ ++ register_callback (plugin_name, PLUGIN_PRAGMAS, register_checker_address_spaces, NULL); ++ ++ return 0; ++} diff -urNp linux-3.0.4/tools/gcc/constify_plugin.c linux-3.0.4/tools/gcc/constify_plugin.c --- linux-3.0.4/tools/gcc/constify_plugin.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-3.0.4/tools/gcc/constify_plugin.c 2011-08-30 18:23:52.000000000 -0400 @@ -73460,7 +75553,7 @@ diff -urNp linux-3.0.4/tools/gcc/constify_plugin.c linux-3.0.4/tools/gcc/constif +} diff -urNp linux-3.0.4/tools/gcc/kallocstat_plugin.c linux-3.0.4/tools/gcc/kallocstat_plugin.c --- linux-3.0.4/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/tools/gcc/kallocstat_plugin.c 2011-09-17 00:53:44.000000000 -0400 ++++ linux-3.0.4/tools/gcc/kallocstat_plugin.c 2011-10-06 04:17:55.000000000 -0400 @@ -0,0 +1,165 @@ +/* + * Copyright 2011 by the PaX Team <pageexec@freemail.hu> @@ -73549,10 +75642,10 @@ diff -urNp linux-3.0.4/tools/gcc/kallocstat_plugin.c linux-3.0.4/tools/gcc/kallo +static unsigned int execute_kallocstat(void) +{ + basic_block bb; -+ gimple_stmt_iterator gsi; + + // 1. loop through BBs and GIMPLE statements + FOR_EACH_BB(bb) { ++ gimple_stmt_iterator gsi; + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { + // gimple match: + tree fndecl, size; @@ -73629,8 +75722,8 @@ diff -urNp linux-3.0.4/tools/gcc/kallocstat_plugin.c linux-3.0.4/tools/gcc/kallo +} diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexec_plugin.c --- linux-3.0.4/tools/gcc/kernexec_plugin.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/tools/gcc/kernexec_plugin.c 2011-09-19 09:16:58.000000000 -0400 -@@ -0,0 +1,265 @@ ++++ linux-3.0.4/tools/gcc/kernexec_plugin.c 2011-10-06 04:17:55.000000000 -0400 +@@ -0,0 +1,273 @@ +/* + * Copyright 2011 by the PaX Team <pageexec@freemail.hu> + * Licensed under the GPL v2 @@ -73667,21 +75760,23 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe +#include "tree-flow.h" + +extern void print_gimple_stmt(FILE *, gimple, int, int); ++extern rtx emit_move_insn(rtx x, rtx y); + +int plugin_is_GPL_compatible; + +static struct plugin_info kernexec_plugin_info = { -+ .version = "201109191200", ++ .version = "201110032145", +}; + +static unsigned int execute_kernexec_fptr(void); +static unsigned int execute_kernexec_retaddr(void); ++static bool kernexec_cmodel_check(void); + +static struct gimple_opt_pass kernexec_fptr_pass = { + .pass = { + .type = GIMPLE_PASS, + .name = "kernexec_fptr", -+ .gate = NULL, ++ .gate = kernexec_cmodel_check, + .execute = execute_kernexec_fptr, + .sub = NULL, + .next = NULL, @@ -73699,7 +75794,7 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + .pass = { + .type = RTL_PASS, + .name = "kernexec_retaddr", -+ .gate = NULL, ++ .gate = kernexec_cmodel_check, + .execute = execute_kernexec_retaddr, + .sub = NULL, + .next = NULL, @@ -73709,10 +75804,28 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + .properties_provided = 0, + .properties_destroyed = 0, + .todo_flags_start = 0, -+ .todo_flags_finish = TODO_dump_func ++ .todo_flags_finish = TODO_dump_func | TODO_ggc_collect + } +}; + ++static bool kernexec_cmodel_check(void) ++{ ++ tree section; ++ ++ if (ix86_cmodel != CM_KERNEL) ++ return false; ++ ++ section = lookup_attribute("__section__", DECL_ATTRIBUTES(current_function_decl)); ++ if (!section || !TREE_VALUE(section)) ++ return true; ++ ++ section = TREE_VALUE(TREE_VALUE(section)); ++ if (strncmp(TREE_STRING_POINTER(section), ".vsyscall_", 10)) ++ return true; ++ ++ return false; ++} ++ +/* + * add special KERNEXEC instrumentation: force MSB of fptr to 1, which will produce + * a non-canonical address from a userland ptr and will just trigger a GPF on dereference @@ -73731,18 +75844,14 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + mark_sym_for_renaming(intptr); + assign_intptr = gimple_build_assign(intptr, fold_convert(long_unsigned_type_node, old_fptr)); + update_stmt(assign_intptr); -+ gsi_insert_before(&gsi, assign_intptr, GSI_NEW_STMT); -+ -+ gsi_next(&gsi); ++ gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT); + + // apply logical or to temporary unsigned long and bitmask + kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0x8000000000000000LL); +// kernexec_mask = build_int_cstu(long_long_unsigned_type_node, 0xffffffff80000000LL); + assign_intptr = gimple_build_assign(intptr, fold_build2(BIT_IOR_EXPR, long_long_unsigned_type_node, intptr, kernexec_mask)); + update_stmt(assign_intptr); -+ gsi_insert_before(&gsi, assign_intptr, GSI_NEW_STMT); -+ -+ gsi_next(&gsi); ++ gsi_insert_before(&gsi, assign_intptr, GSI_SAME_STMT); + + // cast temporary unsigned long back to a temporary fptr variable + new_fptr = create_tmp_var(TREE_TYPE(old_fptr), NULL); @@ -73750,9 +75859,7 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + mark_sym_for_renaming(new_fptr); + assign_new_fptr = gimple_build_assign(new_fptr, fold_convert(TREE_TYPE(old_fptr), intptr)); + update_stmt(assign_new_fptr); -+ gsi_insert_before(&gsi, assign_new_fptr, GSI_NEW_STMT); -+ -+ gsi_next(&gsi); ++ gsi_insert_before(&gsi, assign_new_fptr, GSI_SAME_STMT); + + // replace call stmt fn with the new fptr + gimple_call_set_fn(call_stmt, new_fptr); @@ -73805,28 +75912,22 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + return 0; +} + -+// add special KERNEXEC instrumentation: orb $0x80,7(%rsp) just before retn ++// add special KERNEXEC instrumentation: btsq $63,(%rsp) just before retn +static void kernexec_instrument_retaddr(rtx insn) +{ -+ rtx ret_addr, clob, or; -+ -+ start_sequence(); -+ -+ // compute 7(%rsp) -+ ret_addr = gen_rtx_MEM(QImode, gen_rtx_PLUS(Pmode, stack_pointer_rtx, GEN_INT(7))); -+ MEM_VOLATILE_P(ret_addr) = 1; ++ rtx btsq; ++ rtvec argvec, constraintvec, labelvec; ++ int line; + -+ // create orb $0x80,7(%rsp) -+ or = gen_rtx_SET(VOIDmode, ret_addr, gen_rtx_IOR(QImode, ret_addr, GEN_INT(0xffffffffffffff80))); -+ clob = gen_rtx_CLOBBER(VOIDmode, gen_rtx_REG(CCmode, FLAGS_REG)); -+ -+ // put everything together -+ or = emit_insn(gen_rtx_PARALLEL(VOIDmode, gen_rtvec(2, or, clob))); -+ RTX_FRAME_RELATED_P(or) = 1; -+ -+ end_sequence(); -+ -+ emit_insn_before(or, insn); ++ // create asm volatile("btsq $63,(%%rsp)":::) ++ argvec = rtvec_alloc(0); ++ constraintvec = rtvec_alloc(0); ++ labelvec = rtvec_alloc(0); ++ line = expand_location(RTL_LOCATION(insn)).line; ++ btsq = gen_rtx_ASM_OPERANDS(VOIDmode, "btsq $63,(%%rsp)", empty_string, 0, argvec, constraintvec, labelvec, line); ++ MEM_VOLATILE_P(btsq) = 1; ++ RTX_FRAME_RELATED_P(btsq) = 1; ++ emit_insn_before(btsq, insn); +} + +/* @@ -73888,7 +75989,7 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe + for (i = 0; i < argc; ++i) + error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); + -+ if (TARGET_64BIT == 0 || ix86_cmodel != CM_KERNEL) ++ if (TARGET_64BIT == 0) + return 0; + + register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kernexec_fptr_pass_info); @@ -73898,8 +75999,8 @@ diff -urNp linux-3.0.4/tools/gcc/kernexec_plugin.c linux-3.0.4/tools/gcc/kernexe +} diff -urNp linux-3.0.4/tools/gcc/Makefile linux-3.0.4/tools/gcc/Makefile --- linux-3.0.4/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/tools/gcc/Makefile 2011-09-17 00:53:44.000000000 -0400 -@@ -0,0 +1,14 @@ ++++ linux-3.0.4/tools/gcc/Makefile 2011-10-06 04:17:55.000000000 -0400 +@@ -0,0 +1,21 @@ +#CC := gcc +#PLUGIN_SOURCE_FILES := pax_plugin.c +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES)) @@ -73908,12 +76009,19 @@ diff -urNp linux-3.0.4/tools/gcc/Makefile linux-3.0.4/tools/gcc/Makefile + +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include + -+hostlibs-y := stackleak_plugin.so constify_plugin.so kallocstat_plugin.so kernexec_plugin.so ++hostlibs-y := constify_plugin.so ++hostlibs-$(CONFIG_PAX_MEMORY_STACKLEAK) += stackleak_plugin.so ++hostlibs-$(CONFIG_KALLOCSTAT_PLUGIN) += kallocstat_plugin.so ++hostlibs-$(CONFIG_PAX_KERNEXEC_PLUGIN) += kernexec_plugin.so ++hostlibs-$(CONFIG_CHECKER_PLUGIN) += checker_plugin.so ++ +always := $(hostlibs-y) ++ +stackleak_plugin-objs := stackleak_plugin.o +constify_plugin-objs := constify_plugin.o +kallocstat_plugin-objs := kallocstat_plugin.o +kernexec_plugin-objs := kernexec_plugin.o ++checker_plugin-objs := checker_plugin.o diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackleak_plugin.c --- linux-3.0.4/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-3.0.4/tools/gcc/stackleak_plugin.c 2011-09-17 00:53:44.000000000 -0400 diff --git a/3.0.4/4435_grsec-kconfig-gentoo.patch b/3.0.4/4435_grsec-kconfig-gentoo.patch index 82d188e..1bc9742 100644 --- a/3.0.4/4435_grsec-kconfig-gentoo.patch +++ b/3.0.4/4435_grsec-kconfig-gentoo.patch @@ -293,8 +293,8 @@ diff -Naur a/security/Kconfig b/security/Kconfig config PAX_KERNEXEC bool "Enforce non-executable kernel pages" -- depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN -+ depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION +- depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN ++ depends on (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN && !GRKERNSEC_HARDENED_VIRTUALIZATION select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE) select PAX_KERNEXEC_PLUGIN if X86_64 + default y if GRKERNSEC_HARDENED_WORKSTATION |