From 82833fcc4aacbfd8db712ade22c01f256e18b5ec Mon Sep 17 00:00:00 2001 From: =?utf8?q?Arkadiusz=20Mi=C5=9Bkiewicz?= Date: Fri, 16 Sep 2011 17:38:54 +0000 Subject: [PATCH] - fix install; grsec up to grsecurity-2.2.2-3.0.4-201109150655.patch (parallel build fixed) Changed files: kernel-grsec-caps.patch -> 1.4 kernel-grsec_full.patch -> 1.80 kernel.spec -> 1.978 --- kernel-grsec-caps.patch | 9 +- kernel-grsec_full.patch | 757 ++++++++++++++++++++++++++++------------ kernel.spec | 6 +- 3 files changed, 546 insertions(+), 226 deletions(-) diff --git a/kernel-grsec-caps.patch b/kernel-grsec-caps.patch index e2d01af8..63d1fcfe 100644 --- a/kernel-grsec-caps.patch +++ b/kernel-grsec-caps.patch @@ -1,6 +1,6 @@ ---- e/grsecurity/gracl_cap.c~ 2008-05-18 23:53:55.000000000 +0200 -+++ e/grsecurity/gracl_cap.c 2008-05-18 23:55:05.591733291 +0200 -@@ -39,7 +39,8 @@ static const char *captab_log[] = { +--- linux-3.0/grsecurity/grsec_exec.c~ 2011-09-16 15:24:46.000000000 +0200 ++++ linux-3.0/grsecurity/grsec_exec.c 2011-09-16 15:26:29.350213716 +0200 +@@ -114,7 +114,8 @@ "CAP_SETFCAP", "CAP_MAC_OVERRIDE", "CAP_MAC_ADMIN", @@ -9,4 +9,5 @@ + "CAP_CONTEXT" }; - EXPORT_SYMBOL(gr_task_is_capable); + int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]); + diff --git a/kernel-grsec_full.patch b/kernel-grsec_full.patch index 4b7ae359..00832c24 100644 --- a/kernel-grsec_full.patch +++ b/kernel-grsec_full.patch @@ -3055,7 +3055,7 @@ diff -urNp linux-3.0.4/arch/sparc/include/asm/elf_32.h linux-3.0.4/arch/sparc/in instruction set this cpu supports. This can NOT be done in userspace on Sparc. */ diff -urNp linux-3.0.4/arch/sparc/include/asm/elf_64.h linux-3.0.4/arch/sparc/include/asm/elf_64.h ---- linux-3.0.4/arch/sparc/include/asm/elf_64.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/arch/sparc/include/asm/elf_64.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/arch/sparc/include/asm/elf_64.h 2011-08-23 21:47:55.000000000 -0400 @@ -180,6 +180,13 @@ typedef struct { #define ELF_ET_DYN_BASE 0x0000010000000000UL @@ -3794,7 +3794,7 @@ diff -urNp linux-3.0.4/arch/sparc/kernel/traps_64.c linux-3.0.4/arch/sparc/kerne } EXPORT_SYMBOL(die_if_kernel); diff -urNp linux-3.0.4/arch/sparc/kernel/unaligned_64.c linux-3.0.4/arch/sparc/kernel/unaligned_64.c ---- linux-3.0.4/arch/sparc/kernel/unaligned_64.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/arch/sparc/kernel/unaligned_64.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/arch/sparc/kernel/unaligned_64.c 2011-08-23 21:48:14.000000000 -0400 @@ -279,7 +279,7 @@ static void log_unaligned(struct pt_regs static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); @@ -4065,7 +4065,7 @@ diff -urNp linux-3.0.4/arch/sparc/lib/ksyms.c linux-3.0.4/arch/sparc/lib/ksyms.c /* Atomic bit operations. */ diff -urNp linux-3.0.4/arch/sparc/lib/Makefile linux-3.0.4/arch/sparc/lib/Makefile ---- linux-3.0.4/arch/sparc/lib/Makefile 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/arch/sparc/lib/Makefile 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/arch/sparc/lib/Makefile 2011-08-23 21:47:55.000000000 -0400 @@ -2,7 +2,7 @@ # @@ -10706,7 +10706,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/cpu/common.c linux-3.0.4/arch/x86/kernel/ if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) { diff -urNp linux-3.0.4/arch/x86/kernel/cpu/intel.c linux-3.0.4/arch/x86/kernel/cpu/intel.c ---- linux-3.0.4/arch/x86/kernel/cpu/intel.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/arch/x86/kernel/cpu/intel.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/arch/x86/kernel/cpu/intel.c 2011-08-29 23:30:14.000000000 -0400 @@ -172,7 +172,7 @@ static void __cpuinit trap_init_f00f_bug * Update the IDT descriptor and reload the IDT so that @@ -10850,7 +10850,7 @@ diff -urNp linux-3.0.4/arch/x86/kernel/cpu/mcheck/mce-inject.c linux-3.0.4/arch/ return 0; } diff -urNp linux-3.0.4/arch/x86/kernel/cpu/mtrr/main.c linux-3.0.4/arch/x86/kernel/cpu/mtrr/main.c ---- linux-3.0.4/arch/x86/kernel/cpu/mtrr/main.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/arch/x86/kernel/cpu/mtrr/main.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/arch/x86/kernel/cpu/mtrr/main.c 2011-08-29 23:26:21.000000000 -0400 @@ -62,7 +62,7 @@ static DEFINE_MUTEX(mtrr_mutex); u64 size_or_mask, size_and_mask; @@ -20538,7 +20538,7 @@ diff -urNp linux-3.0.4/arch/x86/net/bpf_jit_comp.c linux-3.0.4/arch/x86/net/bpf_ sizeof(struct work_struct))); if (!image) diff -urNp linux-3.0.4/arch/x86/oprofile/backtrace.c linux-3.0.4/arch/x86/oprofile/backtrace.c ---- linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/arch/x86/oprofile/backtrace.c 2011-08-23 21:47:55.000000000 -0400 @@ -148,7 +148,7 @@ x86_backtrace(struct pt_regs * const reg { @@ -21313,7 +21313,7 @@ diff -urNp linux-3.0.4/arch/x86/vdso/vma.c linux-3.0.4/arch/x86/vdso/vma.c -} -__setup("vdso=", vdso_setup); diff -urNp linux-3.0.4/arch/x86/xen/enlighten.c linux-3.0.4/arch/x86/xen/enlighten.c ---- linux-3.0.4/arch/x86/xen/enlighten.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/arch/x86/xen/enlighten.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/arch/x86/xen/enlighten.c 2011-08-29 23:26:21.000000000 -0400 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -21388,7 +21388,7 @@ diff -urNp linux-3.0.4/arch/x86/xen/enlighten.c linux-3.0.4/arch/x86/xen/enlight #ifdef CONFIG_ACPI_NUMA diff -urNp linux-3.0.4/arch/x86/xen/mmu.c linux-3.0.4/arch/x86/xen/mmu.c ---- linux-3.0.4/arch/x86/xen/mmu.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/arch/x86/xen/mmu.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/arch/x86/xen/mmu.c 2011-08-29 23:26:21.000000000 -0400 @@ -1683,6 +1683,8 @@ pgd_t * __init xen_setup_kernel_pagetabl convert_pfn_mfn(init_level4_pgt); @@ -21427,7 +21427,7 @@ diff -urNp linux-3.0.4/arch/x86/xen/mmu.c linux-3.0.4/arch/x86/xen/mmu.c .alloc_pud = xen_alloc_pmd_init, .release_pud = xen_release_pmd_init, diff -urNp linux-3.0.4/arch/x86/xen/smp.c linux-3.0.4/arch/x86/xen/smp.c ---- linux-3.0.4/arch/x86/xen/smp.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/arch/x86/xen/smp.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/arch/x86/xen/smp.c 2011-08-29 23:26:21.000000000 -0400 @@ -193,11 +193,6 @@ static void __init xen_smp_prepare_boot_ { @@ -21519,7 +21519,7 @@ diff -urNp linux-3.0.4/arch/x86/xen/xen-head.S linux-3.0.4/arch/x86/xen/xen-head mov %rsi,xen_start_info mov $init_thread_union+THREAD_SIZE,%rsp diff -urNp linux-3.0.4/arch/x86/xen/xen-ops.h linux-3.0.4/arch/x86/xen/xen-ops.h ---- linux-3.0.4/arch/x86/xen/xen-ops.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/arch/x86/xen/xen-ops.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/arch/x86/xen/xen-ops.h 2011-08-23 21:47:55.000000000 -0400 @@ -10,8 +10,6 @@ extern const char xen_hypervisor_callback[]; @@ -23175,7 +23175,7 @@ diff -urNp linux-3.0.4/drivers/block/cciss.c linux-3.0.4/drivers/block/cciss.c } diff -urNp linux-3.0.4/drivers/block/cciss.h linux-3.0.4/drivers/block/cciss.h ---- linux-3.0.4/drivers/block/cciss.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/block/cciss.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/block/cciss.h 2011-08-23 21:47:55.000000000 -0400 @@ -100,7 +100,7 @@ struct ctlr_info /* information about each logical volume */ @@ -23880,7 +23880,7 @@ diff -urNp linux-3.0.4/drivers/char/nvram.c linux-3.0.4/drivers/char/nvram.c *ppos = i; diff -urNp linux-3.0.4/drivers/char/random.c linux-3.0.4/drivers/char/random.c ---- linux-3.0.4/drivers/char/random.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/char/random.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/char/random.c 2011-08-23 21:48:14.000000000 -0400 @@ -261,8 +261,13 @@ /* @@ -24172,7 +24172,7 @@ diff -urNp linux-3.0.4/drivers/firewire/core-card.c linux-3.0.4/drivers/firewire card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); diff -urNp linux-3.0.4/drivers/firewire/core-cdev.c linux-3.0.4/drivers/firewire/core-cdev.c ---- linux-3.0.4/drivers/firewire/core-cdev.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/firewire/core-cdev.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/firewire/core-cdev.c 2011-08-23 21:47:55.000000000 -0400 @@ -1313,8 +1313,7 @@ static int init_iso_resource(struct clie int ret; @@ -24515,7 +24515,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_debugfs.c linux-3.0.4/drivers/g if (IS_GEN6(dev)) { seq_printf(m, "Graphics Interrupt mask (%s): %08x\n", diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c ---- linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/i915/i915_dma.c 2011-08-23 21:47:55.000000000 -0400 @@ -1169,7 +1169,7 @@ static bool i915_switcheroo_can_switch(s bool can_switch; @@ -24578,7 +24578,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-3.0.4/dr /* The actual obj->write_domain will be updated with * pending_write_domain after we emit the accumulated flush for all diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c ---- linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c 2011-08-23 21:47:55.000000000 -0400 @@ -473,7 +473,7 @@ static irqreturn_t ivybridge_irq_handler u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir; @@ -24626,7 +24626,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/i915/i915_irq.c linux-3.0.4/drivers/gpu/d INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func); INIT_WORK(&dev_priv->error_work, i915_error_work_func); diff -urNp linux-3.0.4/drivers/gpu/drm/i915/intel_display.c linux-3.0.4/drivers/gpu/drm/i915/intel_display.c ---- linux-3.0.4/drivers/gpu/drm/i915/intel_display.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/gpu/drm/i915/intel_display.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/i915/intel_display.c 2011-08-23 21:47:55.000000000 -0400 @@ -1961,7 +1961,7 @@ intel_pipe_set_base(struct drm_crtc *crt @@ -24974,7 +24974,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/radeon/radeon_atombios.c linux-3.0.4/driv return false; diff -urNp linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c ---- linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c 2011-08-23 21:47:55.000000000 -0400 @@ -678,7 +678,7 @@ static bool radeon_switcheroo_can_switch bool can_switch; @@ -24986,7 +24986,7 @@ diff -urNp linux-3.0.4/drivers/gpu/drm/radeon/radeon_device.c linux-3.0.4/driver return can_switch; } diff -urNp linux-3.0.4/drivers/gpu/drm/radeon/radeon_display.c linux-3.0.4/drivers/gpu/drm/radeon/radeon_display.c ---- linux-3.0.4/drivers/gpu/drm/radeon/radeon_display.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/gpu/drm/radeon/radeon_display.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/gpu/drm/radeon/radeon_display.c 2011-08-23 21:48:14.000000000 -0400 @@ -946,6 +946,8 @@ void radeon_compute_pll_legacy(struct ra uint32_t post_div; @@ -26766,7 +26766,7 @@ diff -urNp linux-3.0.4/drivers/lguest/x86/switcher_32.S linux-3.0.4/drivers/lgue // Every interrupt can come to us here // But we must truly tell each apart. diff -urNp linux-3.0.4/drivers/md/dm.c linux-3.0.4/drivers/md/dm.c ---- linux-3.0.4/drivers/md/dm.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/md/dm.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/md/dm.c 2011-08-23 21:47:55.000000000 -0400 @@ -164,9 +164,9 @@ struct mapped_device { /* @@ -28836,7 +28836,7 @@ diff -urNp linux-3.0.4/drivers/net/mlx4/main.c linux-3.0.4/drivers/net/mlx4/main if (err) { if (err == -EACCES) diff -urNp linux-3.0.4/drivers/net/niu.c linux-3.0.4/drivers/net/niu.c ---- linux-3.0.4/drivers/net/niu.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/net/niu.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/net/niu.c 2011-08-23 21:48:14.000000000 -0400 @@ -9056,6 +9056,8 @@ static void __devinit niu_try_msix(struc int i, num_irqs, err; @@ -29494,7 +29494,7 @@ diff -urNp linux-3.0.4/drivers/net/ppp_generic.c linux-3.0.4/drivers/net/ppp_gen err = 0; break; diff -urNp linux-3.0.4/drivers/net/r8169.c linux-3.0.4/drivers/net/r8169.c ---- linux-3.0.4/drivers/net/r8169.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/net/r8169.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/net/r8169.c 2011-08-23 21:47:55.000000000 -0400 @@ -645,12 +645,12 @@ struct rtl8169_private { struct mdio_ops { @@ -29838,7 +29838,7 @@ diff -urNp linux-3.0.4/drivers/net/wimax/i2400m/usb-fw.c linux-3.0.4/drivers/net i2400m, ack, ack_size); BUG_ON(_ack == i2400m->bm_ack_buf); diff -urNp linux-3.0.4/drivers/net/wireless/airo.c linux-3.0.4/drivers/net/wireless/airo.c ---- linux-3.0.4/drivers/net/wireless/airo.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/net/wireless/airo.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/net/wireless/airo.c 2011-08-23 21:48:14.000000000 -0400 @@ -3003,6 +3003,8 @@ static void airo_process_scan_results (s BSSListElement * loop_net; @@ -30063,7 +30063,7 @@ diff -urNp linux-3.0.4/drivers/net/wireless/ath/ath9k/htc_drv_debug.c linux-3.0. "Mgmt endpoint", skb_queue_len(&priv->tx.mgmt_ep_queue)); diff -urNp linux-3.0.4/drivers/net/wireless/ath/ath9k/hw.h linux-3.0.4/drivers/net/wireless/ath/ath9k/hw.h ---- linux-3.0.4/drivers/net/wireless/ath/ath9k/hw.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/net/wireless/ath/ath9k/hw.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/net/wireless/ath/ath9k/hw.h 2011-08-23 21:47:55.000000000 -0400 @@ -585,7 +585,7 @@ struct ath_hw_private_ops { @@ -31061,7 +31061,7 @@ diff -urNp linux-3.0.4/drivers/scsi/hpsa.c linux-3.0.4/drivers/scsi/hpsa.c } diff -urNp linux-3.0.4/drivers/scsi/hpsa.h linux-3.0.4/drivers/scsi/hpsa.h ---- linux-3.0.4/drivers/scsi/hpsa.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/scsi/hpsa.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/scsi/hpsa.h 2011-08-23 21:47:55.000000000 -0400 @@ -73,7 +73,7 @@ struct ctlr_info { unsigned int msix_vector; @@ -31438,7 +31438,7 @@ diff -urNp linux-3.0.4/drivers/scsi/osd/osd_initiator.c linux-3.0.4/drivers/scsi if (!or) return -ENOMEM; diff -urNp linux-3.0.4/drivers/scsi/pmcraid.c linux-3.0.4/drivers/scsi/pmcraid.c ---- linux-3.0.4/drivers/scsi/pmcraid.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/scsi/pmcraid.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/scsi/pmcraid.c 2011-08-23 21:47:56.000000000 -0400 @@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc res->scsi_dev = scsi_dev; @@ -31640,7 +31640,7 @@ diff -urNp linux-3.0.4/drivers/scsi/scsi_debug.c linux-3.0.4/drivers/scsi/scsi_d return errsts; memset(arr, 0, sizeof(arr)); diff -urNp linux-3.0.4/drivers/scsi/scsi_lib.c linux-3.0.4/drivers/scsi/scsi_lib.c ---- linux-3.0.4/drivers/scsi/scsi_lib.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/scsi/scsi_lib.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/scsi/scsi_lib.c 2011-08-23 21:47:56.000000000 -0400 @@ -1412,7 +1412,7 @@ static void scsi_kill_request(struct req shost = sdev->host; @@ -31832,7 +31832,7 @@ diff -urNp linux-3.0.4/drivers/spi/spi.c linux-3.0.4/drivers/spi/spi.c static u8 *buf; diff -urNp linux-3.0.4/drivers/staging/ath6kl/os/linux/ar6000_drv.c linux-3.0.4/drivers/staging/ath6kl/os/linux/ar6000_drv.c ---- linux-3.0.4/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/staging/ath6kl/os/linux/ar6000_drv.c 2011-08-23 21:48:14.000000000 -0400 @@ -362,7 +362,7 @@ static struct ar_cookie s_ar_cookie_mem[ (((ar)->arTargetType == TARGET_TYPE_AR6003) ? AR6003_HOST_INTEREST_ITEM_ADDRESS(item) : 0)) @@ -31963,7 +31963,7 @@ diff -urNp linux-3.0.4/drivers/staging/et131x/et131x_adapter.h linux-3.0.4/drive u32 noxmtbuf; /* # Tx packets discarded */ diff -urNp linux-3.0.4/drivers/staging/hv/channel.c linux-3.0.4/drivers/staging/hv/channel.c ---- linux-3.0.4/drivers/staging/hv/channel.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/staging/hv/channel.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/staging/hv/channel.c 2011-08-23 21:47:56.000000000 -0400 @@ -433,8 +433,8 @@ int vmbus_establish_gpadl(struct vmbus_c int ret = 0; @@ -32017,7 +32017,7 @@ diff -urNp linux-3.0.4/drivers/staging/hv/hyperv_vmbus.h linux-3.0.4/drivers/sta /* * Represents channel interrupts. Each bit position represents a diff -urNp linux-3.0.4/drivers/staging/hv/rndis_filter.c linux-3.0.4/drivers/staging/hv/rndis_filter.c ---- linux-3.0.4/drivers/staging/hv/rndis_filter.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/staging/hv/rndis_filter.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/staging/hv/rndis_filter.c 2011-08-23 21:47:56.000000000 -0400 @@ -43,7 +43,7 @@ struct rndis_device { @@ -32251,7 +32251,7 @@ diff -urNp linux-3.0.4/drivers/staging/usbip/vhci.h linux-3.0.4/drivers/staging/ /* * NOTE: diff -urNp linux-3.0.4/drivers/staging/usbip/vhci_hcd.c linux-3.0.4/drivers/staging/usbip/vhci_hcd.c ---- linux-3.0.4/drivers/staging/usbip/vhci_hcd.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/staging/usbip/vhci_hcd.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/staging/usbip/vhci_hcd.c 2011-08-23 21:47:56.000000000 -0400 @@ -511,7 +511,7 @@ static void vhci_tx_urb(struct urb *urb) return; @@ -32828,7 +32828,7 @@ diff -urNp linux-3.0.4/drivers/tty/ipwireless/tty.c linux-3.0.4/drivers/tty/ipwi ipwireless_disassociate_network_ttys(network, ttyj->channel_idx); diff -urNp linux-3.0.4/drivers/tty/n_gsm.c linux-3.0.4/drivers/tty/n_gsm.c ---- linux-3.0.4/drivers/tty/n_gsm.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/drivers/tty/n_gsm.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/drivers/tty/n_gsm.c 2011-08-23 21:47:56.000000000 -0400 @@ -1589,7 +1589,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s return NULL; @@ -36623,7 +36623,7 @@ diff -urNp linux-3.0.4/fs/attr.c linux-3.0.4/fs/attr.c goto out_sig; if (offset > inode->i_sb->s_maxbytes) diff -urNp linux-3.0.4/fs/befs/linuxvfs.c linux-3.0.4/fs/befs/linuxvfs.c ---- linux-3.0.4/fs/befs/linuxvfs.c 2011-08-29 23:26:13.000000000 -0400 +--- linux-3.0.4/fs/befs/linuxvfs.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/fs/befs/linuxvfs.c 2011-08-29 23:26:27.000000000 -0400 @@ -503,7 +503,7 @@ static void befs_put_link(struct dentry { @@ -37856,7 +37856,7 @@ diff -urNp linux-3.0.4/fs/cifs/cifs_debug.c linux-3.0.4/fs/cifs/cifs_debug.c } } diff -urNp linux-3.0.4/fs/cifs/cifsfs.c linux-3.0.4/fs/cifs/cifsfs.c ---- linux-3.0.4/fs/cifs/cifsfs.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/fs/cifs/cifsfs.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/cifs/cifsfs.c 2011-08-25 17:18:05.000000000 -0400 @@ -994,7 +994,7 @@ cifs_init_request_bufs(void) cifs_req_cachep = kmem_cache_create("cifs_request", @@ -38223,7 +38223,7 @@ diff -urNp linux-3.0.4/fs/dcache.c linux-3.0.4/fs/dcache.c dcache_init(); inode_init(); diff -urNp linux-3.0.4/fs/ecryptfs/inode.c linux-3.0.4/fs/ecryptfs/inode.c ---- linux-3.0.4/fs/ecryptfs/inode.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/fs/ecryptfs/inode.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/ecryptfs/inode.c 2011-08-23 21:47:56.000000000 -0400 @@ -704,7 +704,7 @@ static int ecryptfs_readlink_lower(struc old_fs = get_fs(); @@ -38945,7 +38945,7 @@ diff -urNp linux-3.0.4/fs/ext4/balloc.c linux-3.0.4/fs/ext4/balloc.c if (free_blocks >= (nblocks + dirty_blocks)) return 1; diff -urNp linux-3.0.4/fs/ext4/ext4.h linux-3.0.4/fs/ext4/ext4.h ---- linux-3.0.4/fs/ext4/ext4.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/fs/ext4/ext4.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/ext4/ext4.h 2011-08-23 21:47:56.000000000 -0400 @@ -1177,19 +1177,19 @@ struct ext4_sb_info { unsigned long s_mb_last_start; @@ -38978,7 +38978,7 @@ diff -urNp linux-3.0.4/fs/ext4/ext4.h linux-3.0.4/fs/ext4/ext4.h /* locality groups */ diff -urNp linux-3.0.4/fs/ext4/mballoc.c linux-3.0.4/fs/ext4/mballoc.c ---- linux-3.0.4/fs/ext4/mballoc.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/fs/ext4/mballoc.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/ext4/mballoc.c 2011-08-23 21:48:14.000000000 -0400 @@ -1793,7 +1793,7 @@ void ext4_mb_simple_scan_group(struct ex BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len); @@ -40686,7 +40686,7 @@ diff -urNp linux-3.0.4/fs/fuse/cuse.c linux-3.0.4/fs/fuse/cuse.c cuse_class = class_create(THIS_MODULE, "cuse"); if (IS_ERR(cuse_class)) diff -urNp linux-3.0.4/fs/fuse/dev.c linux-3.0.4/fs/fuse/dev.c ---- linux-3.0.4/fs/fuse/dev.c 2011-08-29 23:26:14.000000000 -0400 +--- linux-3.0.4/fs/fuse/dev.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/fs/fuse/dev.c 2011-08-29 23:26:27.000000000 -0400 @@ -1238,7 +1238,7 @@ static ssize_t fuse_dev_splice_read(stru ret = 0; @@ -41664,7 +41664,7 @@ diff -urNp linux-3.0.4/fs/nfs/inode.c linux-3.0.4/fs/nfs/inode.c void nfs_fattr_init(struct nfs_fattr *fattr) diff -urNp linux-3.0.4/fs/nfsd/nfs4state.c linux-3.0.4/fs/nfsd/nfs4state.c ---- linux-3.0.4/fs/nfsd/nfs4state.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/fs/nfsd/nfs4state.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/fs/nfsd/nfs4state.c 2011-08-23 21:48:14.000000000 -0400 @@ -3794,6 +3794,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc unsigned int strhashval; @@ -41927,7 +41927,7 @@ diff -urNp linux-3.0.4/fs/ocfs2/symlink.c linux-3.0.4/fs/ocfs2/symlink.c } diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c --- linux-3.0.4/fs/open.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/fs/open.c 2011-08-23 21:48:14.000000000 -0400 ++++ linux-3.0.4/fs/open.c 2011-09-14 09:16:46.000000000 -0400 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _ error = locks_verify_truncate(inode, NULL, length); if (!error) @@ -41972,17 +41972,12 @@ diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c if (!error) set_fs_pwd(current->fs, &file->f_path); out_putf: -@@ -438,7 +454,18 @@ SYSCALL_DEFINE1(chroot, const char __use +@@ -438,7 +454,13 @@ SYSCALL_DEFINE1(chroot, const char __use if (error) goto dput_and_out; + if (gr_handle_chroot_chroot(path.dentry, path.mnt)) + goto dput_and_out; -+ -+ if (gr_handle_chroot_caps(&path)) { -+ error = -ENOMEM; -+ goto dput_and_out; -+ } + set_fs_root(current->fs, &path); + @@ -41991,7 +41986,7 @@ diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c error = 0; dput_and_out: path_put(&path); -@@ -466,12 +493,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd +@@ -466,12 +488,25 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd err = mnt_want_write_file(file); if (err) goto out_putf; @@ -42017,7 +42012,7 @@ diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; err = notify_change(dentry, &newattrs); -@@ -499,12 +539,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons +@@ -499,12 +534,25 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons error = mnt_want_write(path.mnt); if (error) goto dput_and_out; @@ -42043,7 +42038,7 @@ diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; error = notify_change(path.dentry, &newattrs); -@@ -528,6 +581,9 @@ static int chown_common(struct path *pat +@@ -528,6 +576,9 @@ static int chown_common(struct path *pat int error; struct iattr newattrs; @@ -42053,7 +42048,7 @@ diff -urNp linux-3.0.4/fs/open.c linux-3.0.4/fs/open.c newattrs.ia_valid = ATTR_CTIME; if (user != (uid_t) -1) { newattrs.ia_valid |= ATTR_UID; -@@ -998,7 +1054,10 @@ long do_sys_open(int dfd, const char __u +@@ -998,7 +1049,10 @@ long do_sys_open(int dfd, const char __u if (!IS_ERR(tmp)) { fd = get_unused_fd_flags(flags); if (fd >= 0) { @@ -42338,8 +42333,8 @@ diff -urNp linux-3.0.4/fs/proc/array.c linux-3.0.4/fs/proc/array.c +} +#endif diff -urNp linux-3.0.4/fs/proc/base.c linux-3.0.4/fs/proc/base.c ---- linux-3.0.4/fs/proc/base.c 2011-08-23 21:44:40.000000000 -0400 -+++ linux-3.0.4/fs/proc/base.c 2011-08-23 21:48:14.000000000 -0400 +--- linux-3.0.4/fs/proc/base.c 2011-09-02 18:11:21.000000000 -0400 ++++ linux-3.0.4/fs/proc/base.c 2011-09-13 14:50:28.000000000 -0400 @@ -107,6 +107,22 @@ struct pid_entry { union proc_op op; }; @@ -42405,7 +42400,7 @@ diff -urNp linux-3.0.4/fs/proc/base.c linux-3.0.4/fs/proc/base.c + if (PAX_RAND_FLAGS(mm) && + (!(task->ptrace & PT_PTRACED) || (task->parent != current))) { + mmput(mm); -+ return res; ++ return 0; + } +#endif + @@ -48198,8 +48193,8 @@ diff -urNp linux-3.0.4/grsecurity/gracl.c linux-3.0.4/grsecurity/gracl.c + diff -urNp linux-3.0.4/grsecurity/gracl_cap.c linux-3.0.4/grsecurity/gracl_cap.c --- linux-3.0.4/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/gracl_cap.c 2011-08-23 21:48:14.000000000 -0400 -@@ -0,0 +1,139 @@ ++++ linux-3.0.4/grsecurity/gracl_cap.c 2011-09-14 09:21:24.000000000 -0400 +@@ -0,0 +1,101 @@ +#include +#include +#include @@ -48207,49 +48202,11 @@ diff -urNp linux-3.0.4/grsecurity/gracl_cap.c linux-3.0.4/grsecurity/gracl_cap.c +#include +#include + -+static const char *captab_log[] = { -+ "CAP_CHOWN", -+ "CAP_DAC_OVERRIDE", -+ "CAP_DAC_READ_SEARCH", -+ "CAP_FOWNER", -+ "CAP_FSETID", -+ "CAP_KILL", -+ "CAP_SETGID", -+ "CAP_SETUID", -+ "CAP_SETPCAP", -+ "CAP_LINUX_IMMUTABLE", -+ "CAP_NET_BIND_SERVICE", -+ "CAP_NET_BROADCAST", -+ "CAP_NET_ADMIN", -+ "CAP_NET_RAW", -+ "CAP_IPC_LOCK", -+ "CAP_IPC_OWNER", -+ "CAP_SYS_MODULE", -+ "CAP_SYS_RAWIO", -+ "CAP_SYS_CHROOT", -+ "CAP_SYS_PTRACE", -+ "CAP_SYS_PACCT", -+ "CAP_SYS_ADMIN", -+ "CAP_SYS_BOOT", -+ "CAP_SYS_NICE", -+ "CAP_SYS_RESOURCE", -+ "CAP_SYS_TIME", -+ "CAP_SYS_TTY_CONFIG", -+ "CAP_MKNOD", -+ "CAP_LEASE", -+ "CAP_AUDIT_WRITE", -+ "CAP_AUDIT_CONTROL", -+ "CAP_SETFCAP", -+ "CAP_MAC_OVERRIDE", -+ "CAP_MAC_ADMIN", -+ "CAP_SYSLOG" -+}; -+ -+EXPORT_SYMBOL(gr_is_capable); -+EXPORT_SYMBOL(gr_is_capable_nolog); ++extern const char *captab_log[]; ++extern int captab_log_entries; + +int -+gr_is_capable(const int cap) ++gr_acl_is_capable(const int cap) +{ + struct task_struct *task = current; + const struct cred *cred = current_cred(); @@ -48301,13 +48258,13 @@ diff -urNp linux-3.0.4/grsecurity/gracl_cap.c linux-3.0.4/grsecurity/gracl_cap.c + return 1; + } + -+ if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap)) ++ if ((cap >= 0) && (cap < captab_log_entries) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap)) + gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]); + return 0; +} + +int -+gr_is_capable_nolog(const int cap) ++gr_acl_is_capable_nolog(const int cap) +{ + struct acl_subject_label *curracl; + kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set; @@ -49814,8 +49771,8 @@ diff -urNp linux-3.0.4/grsecurity/grsec_chdir.c linux-3.0.4/grsecurity/grsec_chd +} diff -urNp linux-3.0.4/grsecurity/grsec_chroot.c linux-3.0.4/grsecurity/grsec_chroot.c --- linux-3.0.4/grsecurity/grsec_chroot.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/grsec_chroot.c 2011-08-23 21:48:14.000000000 -0400 -@@ -0,0 +1,349 @@ ++++ linux-3.0.4/grsecurity/grsec_chroot.c 2011-09-15 06:47:48.000000000 -0400 +@@ -0,0 +1,351 @@ +#include +#include +#include @@ -50096,33 +50053,39 @@ diff -urNp linux-3.0.4/grsecurity/grsec_chroot.c linux-3.0.4/grsecurity/grsec_ch + return 0; +} + ++extern const char *captab_log[]; ++extern int captab_log_entries; ++ +int -+gr_handle_chroot_caps(struct path *path) ++gr_chroot_is_capable(const int cap) +{ +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS -+ if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL && -+ (init_task.fs->root.dentry != path->dentry) && -+ (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) { -+ ++ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) { + kernel_cap_t chroot_caps = GR_CHROOT_CAPS; -+ const struct cred *old = current_cred(); -+ struct cred *new = prepare_creds(); -+ if (new == NULL) -+ return 1; -+ -+ new->cap_permitted = cap_drop(old->cap_permitted, -+ chroot_caps); -+ new->cap_inheritable = cap_drop(old->cap_inheritable, -+ chroot_caps); -+ new->cap_effective = cap_drop(old->cap_effective, -+ chroot_caps); -+ -+ commit_creds(new); ++ if (cap_raised(chroot_caps, cap)) { ++ const struct cred *creds = current_cred(); ++ if (cap_raised(creds->cap_effective, cap) && cap < captab_log_entries) { ++ gr_log_cap(GR_DONT_AUDIT, GR_CAP_CHROOT_MSG, current, captab_log[cap]); ++ } ++ return 0; ++ } ++ } ++#endif ++ return 1; ++} + -+ return 0; ++int ++gr_chroot_is_capable_nolog(const int cap) ++{ ++#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS ++ if (grsec_enable_chroot_caps && proc_is_chrooted(current)) { ++ kernel_cap_t chroot_caps = GR_CHROOT_CAPS; ++ if (cap_raised(chroot_caps, cap)) { ++ return 0; ++ } + } +#endif -+ return 0; ++ return 1; +} + +int @@ -50161,10 +50124,6 @@ diff -urNp linux-3.0.4/grsecurity/grsec_chroot.c linux-3.0.4/grsecurity/grsec_ch +#endif + return 0; +} -+ -+#ifdef CONFIG_SECURITY -+EXPORT_SYMBOL(gr_handle_chroot_caps); -+#endif diff -urNp linux-3.0.4/grsecurity/grsec_disabled.c linux-3.0.4/grsecurity/grsec_disabled.c --- linux-3.0.4/grsecurity/grsec_disabled.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-3.0.4/grsecurity/grsec_disabled.c 2011-08-23 21:48:14.000000000 -0400 @@ -50618,8 +50577,8 @@ diff -urNp linux-3.0.4/grsecurity/grsec_disabled.c linux-3.0.4/grsecurity/grsec_ +#endif diff -urNp linux-3.0.4/grsecurity/grsec_exec.c linux-3.0.4/grsecurity/grsec_exec.c --- linux-3.0.4/grsecurity/grsec_exec.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/grsec_exec.c 2011-08-25 17:25:59.000000000 -0400 -@@ -0,0 +1,72 @@ ++++ linux-3.0.4/grsecurity/grsec_exec.c 2011-09-14 09:20:28.000000000 -0400 +@@ -0,0 +1,145 @@ +#include +#include +#include @@ -50630,6 +50589,7 @@ diff -urNp linux-3.0.4/grsecurity/grsec_exec.c linux-3.0.4/grsecurity/grsec_exec +#include +#include +#include ++#include + +#include + @@ -50692,6 +50652,78 @@ diff -urNp linux-3.0.4/grsecurity/grsec_exec.c linux-3.0.4/grsecurity/grsec_exec +#endif + return; +} ++ ++#ifdef CONFIG_GRKERNSEC ++extern int gr_acl_is_capable(const int cap); ++extern int gr_acl_is_capable_nolog(const int cap); ++extern int gr_chroot_is_capable(const int cap); ++extern int gr_chroot_is_capable_nolog(const int cap); ++#endif ++ ++const char *captab_log[] = { ++ "CAP_CHOWN", ++ "CAP_DAC_OVERRIDE", ++ "CAP_DAC_READ_SEARCH", ++ "CAP_FOWNER", ++ "CAP_FSETID", ++ "CAP_KILL", ++ "CAP_SETGID", ++ "CAP_SETUID", ++ "CAP_SETPCAP", ++ "CAP_LINUX_IMMUTABLE", ++ "CAP_NET_BIND_SERVICE", ++ "CAP_NET_BROADCAST", ++ "CAP_NET_ADMIN", ++ "CAP_NET_RAW", ++ "CAP_IPC_LOCK", ++ "CAP_IPC_OWNER", ++ "CAP_SYS_MODULE", ++ "CAP_SYS_RAWIO", ++ "CAP_SYS_CHROOT", ++ "CAP_SYS_PTRACE", ++ "CAP_SYS_PACCT", ++ "CAP_SYS_ADMIN", ++ "CAP_SYS_BOOT", ++ "CAP_SYS_NICE", ++ "CAP_SYS_RESOURCE", ++ "CAP_SYS_TIME", ++ "CAP_SYS_TTY_CONFIG", ++ "CAP_MKNOD", ++ "CAP_LEASE", ++ "CAP_AUDIT_WRITE", ++ "CAP_AUDIT_CONTROL", ++ "CAP_SETFCAP", ++ "CAP_MAC_OVERRIDE", ++ "CAP_MAC_ADMIN", ++ "CAP_SYSLOG" ++}; ++ ++int captab_log_entries = sizeof(captab_log)/sizeof(captab_log[0]); ++ ++int gr_is_capable(const int cap) ++{ ++#ifdef CONFIG_GRKERNSEC ++ if (gr_acl_is_capable(cap) && gr_chroot_is_capable(cap)) ++ return 1; ++ return 0; ++#else ++ return 1; ++#endif ++} ++ ++int gr_is_capable_nolog(const int cap) ++{ ++#ifdef CONFIG_GRKERNSEC ++ if (gr_acl_is_capable_nolog(cap) && gr_chroot_is_capable_nolog(cap)) ++ return 1; ++ return 0; ++#else ++ return 1; ++#endif ++} ++ ++EXPORT_SYMBOL(gr_is_capable); ++EXPORT_SYMBOL(gr_is_capable_nolog); diff -urNp linux-3.0.4/grsecurity/grsec_fifo.c linux-3.0.4/grsecurity/grsec_fifo.c --- linux-3.0.4/grsecurity/grsec_fifo.c 1969-12-31 19:00:00.000000000 -0500 +++ linux-3.0.4/grsecurity/grsec_fifo.c 2011-08-23 21:48:14.000000000 -0400 @@ -51069,8 +51101,8 @@ diff -urNp linux-3.0.4/grsecurity/grsec_link.c linux-3.0.4/grsecurity/grsec_link +} diff -urNp linux-3.0.4/grsecurity/grsec_log.c linux-3.0.4/grsecurity/grsec_log.c --- linux-3.0.4/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/grsec_log.c 2011-08-23 21:48:14.000000000 -0400 -@@ -0,0 +1,310 @@ ++++ linux-3.0.4/grsecurity/grsec_log.c 2011-09-14 23:17:55.000000000 -0400 +@@ -0,0 +1,313 @@ +#include +#include +#include @@ -51123,20 +51155,23 @@ diff -urNp linux-3.0.4/grsecurity/grsec_log.c linux-3.0.4/grsecurity/grsec_log.c + char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT; + char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt; + char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf; ++ unsigned long curr_secs = get_seconds(); + + if (audit == GR_DO_AUDIT) + goto set_fmt; + -+ if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) { -+ grsec_alert_wtime = jiffies; ++ if (!grsec_alert_wtime || time_after(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) { ++ grsec_alert_wtime = curr_secs; + grsec_alert_fyet = 0; -+ } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) { -+ grsec_alert_fyet++; -+ } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) { -+ grsec_alert_wtime = jiffies; -+ grsec_alert_fyet++; -+ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME); -+ return FLOODING; ++ } else if (time_before(curr_secs, grsec_alert_wtime + CONFIG_GRKERNSEC_FLOODTIME)) { ++ if (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST) { ++ grsec_alert_fyet++; ++ } else if (grsec_alert_fyet && grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) { ++ grsec_alert_wtime = curr_secs; ++ grsec_alert_fyet++; ++ printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME); ++ return FLOODING; ++ } + } else return FLOODING; + +set_fmt: @@ -52567,7 +52602,7 @@ diff -urNp linux-3.0.4/grsecurity/grsum.c linux-3.0.4/grsecurity/grsum.c +} diff -urNp linux-3.0.4/grsecurity/Kconfig linux-3.0.4/grsecurity/Kconfig --- linux-3.0.4/grsecurity/Kconfig 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/Kconfig 2011-08-25 17:25:34.000000000 -0400 ++++ linux-3.0.4/grsecurity/Kconfig 2011-09-15 00:00:57.000000000 -0400 @@ -0,0 +1,1038 @@ +# +# grecurity configuration @@ -53203,7 +53238,7 @@ diff -urNp linux-3.0.4/grsecurity/Kconfig linux-3.0.4/grsecurity/Kconfig + bool "Capability restrictions" + depends on GRKERNSEC_CHROOT + help -+ If you say Y here, the capabilities on all root processes within a ++ If you say Y here, the capabilities on all processes within a + chroot jail will be lowered to stop module insertion, raw i/o, + system and net admin tasks, rebooting the system, modifying immutable + files, modifying IPC owned by another, and changing the system time. @@ -53596,7 +53631,7 @@ diff -urNp linux-3.0.4/grsecurity/Kconfig linux-3.0.4/grsecurity/Kconfig + +config GRKERNSEC_FLOODBURST + int "Number of messages in a burst (maximum)" -+ default 4 ++ default 6 + help + This option allows you to choose the maximum number of messages allowed + within the flood time interval you chose in a separate option. The @@ -53609,8 +53644,8 @@ diff -urNp linux-3.0.4/grsecurity/Kconfig linux-3.0.4/grsecurity/Kconfig +endmenu diff -urNp linux-3.0.4/grsecurity/Makefile linux-3.0.4/grsecurity/Makefile --- linux-3.0.4/grsecurity/Makefile 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/grsecurity/Makefile 2011-08-23 21:48:14.000000000 -0400 -@@ -0,0 +1,34 @@ ++++ linux-3.0.4/grsecurity/Makefile 2011-09-14 23:29:56.000000000 -0400 +@@ -0,0 +1,35 @@ +# grsecurity's ACL system was originally written in 2001 by Michael Dalton +# during 2001-2009 it has been completely redesigned by Brad Spengler +# into an RBAC system @@ -53642,6 +53677,7 @@ diff -urNp linux-3.0.4/grsecurity/Makefile linux-3.0.4/grsecurity/Makefile +$(obj)/grsec_hidesym.o: + @-chmod -f 500 /boot + @-chmod -f 500 /lib/modules ++ @-chmod -f 500 /lib64/modules + @-chmod -f 700 . + @echo ' grsec: protected kernel image paths' +endif @@ -55417,8 +55453,8 @@ diff -urNp linux-3.0.4/include/linux/grinternal.h linux-3.0.4/include/linux/grin +#endif diff -urNp linux-3.0.4/include/linux/grmsg.h linux-3.0.4/include/linux/grmsg.h --- linux-3.0.4/include/linux/grmsg.h 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/include/linux/grmsg.h 2011-08-25 17:27:26.000000000 -0400 -@@ -0,0 +1,107 @@ ++++ linux-3.0.4/include/linux/grmsg.h 2011-09-14 09:16:54.000000000 -0400 +@@ -0,0 +1,108 @@ +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u" +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u" +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by " @@ -55511,6 +55547,7 @@ diff -urNp linux-3.0.4/include/linux/grmsg.h linux-3.0.4/include/linux/grmsg.h +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4" +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process " +#define GR_CAP_ACL_MSG "use of %s denied for " ++#define GR_CAP_CHROOT_MSG "use of %s in chroot denied for " +#define GR_CAP_ACL_MSG2 "use of %s permitted for " +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for " +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for " @@ -55528,8 +55565,8 @@ diff -urNp linux-3.0.4/include/linux/grmsg.h linux-3.0.4/include/linux/grmsg.h +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by " diff -urNp linux-3.0.4/include/linux/grsecurity.h linux-3.0.4/include/linux/grsecurity.h --- linux-3.0.4/include/linux/grsecurity.h 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/include/linux/grsecurity.h 2011-08-25 17:27:36.000000000 -0400 -@@ -0,0 +1,227 @@ ++++ linux-3.0.4/include/linux/grsecurity.h 2011-09-14 09:16:54.000000000 -0400 +@@ -0,0 +1,226 @@ +#ifndef GR_SECURITY_H +#define GR_SECURITY_H +#include @@ -55594,7 +55631,6 @@ diff -urNp linux-3.0.4/include/linux/grsecurity.h linux-3.0.4/include/linux/grse +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt); +int gr_handle_chroot_chroot(const struct dentry *dentry, + const struct vfsmount *mnt); -+int gr_handle_chroot_caps(struct path *path); +void gr_handle_chroot_chdir(struct path *path); +int gr_handle_chroot_chmod(const struct dentry *dentry, + const struct vfsmount *mnt, const int mode); @@ -56060,7 +56096,7 @@ diff -urNp linux-3.0.4/include/linux/mfd/abx500.h linux-3.0.4/include/linux/mfd/ int abx500_register_ops(struct device *core_dev, struct abx500_ops *ops); void abx500_remove_ops(struct device *dev); diff -urNp linux-3.0.4/include/linux/mm.h linux-3.0.4/include/linux/mm.h ---- linux-3.0.4/include/linux/mm.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/include/linux/mm.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/include/linux/mm.h 2011-08-23 21:47:56.000000000 -0400 @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void @@ -56444,7 +56480,7 @@ diff -urNp linux-3.0.4/include/linux/namei.h linux-3.0.4/include/linux/namei.h return nd->saved_names[nd->depth]; } diff -urNp linux-3.0.4/include/linux/netdevice.h linux-3.0.4/include/linux/netdevice.h ---- linux-3.0.4/include/linux/netdevice.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/include/linux/netdevice.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/include/linux/netdevice.h 2011-08-23 21:47:56.000000000 -0400 @@ -979,6 +979,7 @@ struct net_device_ops { int (*ndo_set_features)(struct net_device *dev, @@ -56634,7 +56670,7 @@ diff -urNp linux-3.0.4/include/linux/ptrace.h linux-3.0.4/include/linux/ptrace.h static inline int ptrace_reparented(struct task_struct *child) { diff -urNp linux-3.0.4/include/linux/random.h linux-3.0.4/include/linux/random.h ---- linux-3.0.4/include/linux/random.h 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/include/linux/random.h 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/include/linux/random.h 2011-08-23 21:47:56.000000000 -0400 @@ -69,12 +69,17 @@ void srandom32(u32 seed); @@ -58580,7 +58616,7 @@ diff -urNp linux-3.0.4/ipc/msg.c linux-3.0.4/ipc/msg.c msg_params.flg = msgflg; diff -urNp linux-3.0.4/ipc/sem.c linux-3.0.4/ipc/sem.c ---- linux-3.0.4/ipc/sem.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/ipc/sem.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/ipc/sem.c 2011-08-23 21:48:14.000000000 -0400 @@ -318,10 +318,15 @@ static inline int sem_more_checks(struct return 0; @@ -59134,8 +59170,8 @@ diff -urNp linux-3.0.4/kernel/debug/kdb/kdb_main.c linux-3.0.4/kernel/debug/kdb/ #ifdef CONFIG_MODULE_UNLOAD { diff -urNp linux-3.0.4/kernel/events/core.c linux-3.0.4/kernel/events/core.c ---- linux-3.0.4/kernel/events/core.c 2011-08-23 21:44:40.000000000 -0400 -+++ linux-3.0.4/kernel/events/core.c 2011-08-23 21:47:56.000000000 -0400 +--- linux-3.0.4/kernel/events/core.c 2011-09-02 18:11:21.000000000 -0400 ++++ linux-3.0.4/kernel/events/core.c 2011-09-14 09:08:05.000000000 -0400 @@ -170,7 +170,7 @@ int perf_proc_update_handler(struct ctl_ return 0; } @@ -59193,6 +59229,21 @@ diff -urNp linux-3.0.4/kernel/events/core.c linux-3.0.4/kernel/events/core.c } if (read_format & PERF_FORMAT_ID) values[n++] = primary_event_id(event); +@@ -4833,12 +4833,12 @@ static void perf_event_mmap_event(struct + * need to add enough zero bytes after the string to handle + * the 64bit alignment we do later. + */ +- buf = kzalloc(PATH_MAX + sizeof(u64), GFP_KERNEL); ++ buf = kzalloc(PATH_MAX, GFP_KERNEL); + if (!buf) { + name = strncpy(tmp, "//enomem", sizeof(tmp)); + goto got_name; + } +- name = d_path(&file->f_path, buf, PATH_MAX); ++ name = d_path(&file->f_path, buf, PATH_MAX - sizeof(u64)); + if (IS_ERR(name)) { + name = strncpy(tmp, "//toolong", sizeof(tmp)); + goto got_name; @@ -6190,7 +6190,7 @@ perf_event_alloc(struct perf_event_attr event->parent = parent_event; @@ -59635,7 +59686,7 @@ diff -urNp linux-3.0.4/kernel/fork.c linux-3.0.4/kernel/fork.c else new_fs = fs; diff -urNp linux-3.0.4/kernel/futex.c linux-3.0.4/kernel/futex.c ---- linux-3.0.4/kernel/futex.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/kernel/futex.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/kernel/futex.c 2011-08-23 21:48:14.000000000 -0400 @@ -54,6 +54,7 @@ #include @@ -61632,7 +61683,80 @@ diff -urNp linux-3.0.4/kernel/rcutorture.c linux-3.0.4/kernel/rcutorture.c per_cpu(rcu_torture_count, cpu)[i] = 0; diff -urNp linux-3.0.4/kernel/rcutree.c linux-3.0.4/kernel/rcutree.c --- linux-3.0.4/kernel/rcutree.c 2011-07-21 22:17:23.000000000 -0400 -+++ linux-3.0.4/kernel/rcutree.c 2011-08-23 21:47:56.000000000 -0400 ++++ linux-3.0.4/kernel/rcutree.c 2011-09-14 09:08:05.000000000 -0400 +@@ -356,9 +356,9 @@ void rcu_enter_nohz(void) + } + /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */ + smp_mb__before_atomic_inc(); /* See above. */ +- atomic_inc(&rdtp->dynticks); ++ atomic_inc_unchecked(&rdtp->dynticks); + smp_mb__after_atomic_inc(); /* Force ordering with next sojourn. */ +- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1); ++ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1); + local_irq_restore(flags); + + /* If the interrupt queued a callback, get out of dyntick mode. */ +@@ -387,10 +387,10 @@ void rcu_exit_nohz(void) + return; + } + smp_mb__before_atomic_inc(); /* Force ordering w/previous sojourn. */ +- atomic_inc(&rdtp->dynticks); ++ atomic_inc_unchecked(&rdtp->dynticks); + /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */ + smp_mb__after_atomic_inc(); /* See above. */ +- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1)); ++ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1)); + local_irq_restore(flags); + } + +@@ -406,14 +406,14 @@ void rcu_nmi_enter(void) + struct rcu_dynticks *rdtp = &__get_cpu_var(rcu_dynticks); + + if (rdtp->dynticks_nmi_nesting == 0 && +- (atomic_read(&rdtp->dynticks) & 0x1)) ++ (atomic_read_unchecked(&rdtp->dynticks) & 0x1)) + return; + rdtp->dynticks_nmi_nesting++; + smp_mb__before_atomic_inc(); /* Force delay from prior write. */ +- atomic_inc(&rdtp->dynticks); ++ atomic_inc_unchecked(&rdtp->dynticks); + /* CPUs seeing atomic_inc() must see later RCU read-side crit sects */ + smp_mb__after_atomic_inc(); /* See above. */ +- WARN_ON_ONCE(!(atomic_read(&rdtp->dynticks) & 0x1)); ++ WARN_ON_ONCE(!(atomic_read_unchecked(&rdtp->dynticks) & 0x1)); + } + + /** +@@ -432,9 +432,9 @@ void rcu_nmi_exit(void) + return; + /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */ + smp_mb__before_atomic_inc(); /* See above. */ +- atomic_inc(&rdtp->dynticks); ++ atomic_inc_unchecked(&rdtp->dynticks); + smp_mb__after_atomic_inc(); /* Force delay to next write. */ +- WARN_ON_ONCE(atomic_read(&rdtp->dynticks) & 0x1); ++ WARN_ON_ONCE(atomic_read_unchecked(&rdtp->dynticks) & 0x1); + } + + /** +@@ -469,7 +469,7 @@ void rcu_irq_exit(void) + */ + static int dyntick_save_progress_counter(struct rcu_data *rdp) + { +- rdp->dynticks_snap = atomic_add_return(0, &rdp->dynticks->dynticks); ++ rdp->dynticks_snap = atomic_add_return_unchecked(0, &rdp->dynticks->dynticks); + return 0; + } + +@@ -484,7 +484,7 @@ static int rcu_implicit_dynticks_qs(stru + unsigned long curr; + unsigned long snap; + +- curr = (unsigned long)atomic_add_return(0, &rdp->dynticks->dynticks); ++ curr = (unsigned long)atomic_add_return_unchecked(0, &rdp->dynticks->dynticks); + snap = (unsigned long)rdp->dynticks_snap; + + /* @@ -1470,7 +1470,7 @@ __rcu_process_callbacks(struct rcu_state /* * Do softirq processing for the current CPU. @@ -61642,6 +61766,18 @@ diff -urNp linux-3.0.4/kernel/rcutree.c linux-3.0.4/kernel/rcutree.c { __rcu_process_callbacks(&rcu_sched_state, &__get_cpu_var(rcu_sched_data)); +diff -urNp linux-3.0.4/kernel/rcutree.h linux-3.0.4/kernel/rcutree.h +--- linux-3.0.4/kernel/rcutree.h 2011-07-21 22:17:23.000000000 -0400 ++++ linux-3.0.4/kernel/rcutree.h 2011-09-14 09:08:05.000000000 -0400 +@@ -86,7 +86,7 @@ + struct rcu_dynticks { + int dynticks_nesting; /* Track irq/process nesting level. */ + int dynticks_nmi_nesting; /* Track NMI nesting level. */ +- atomic_t dynticks; /* Even value for dynticks-idle, else odd. */ ++ atomic_unchecked_t dynticks; /* Even value for dynticks-idle, else odd. */ + }; + + /* RCU's kthread states for tracing. */ diff -urNp linux-3.0.4/kernel/rcutree_plugin.h linux-3.0.4/kernel/rcutree_plugin.h --- linux-3.0.4/kernel/rcutree_plugin.h 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/kernel/rcutree_plugin.h 2011-08-23 21:47:56.000000000 -0400 @@ -62126,7 +62262,7 @@ diff -urNp linux-3.0.4/kernel/softirq.c linux-3.0.4/kernel/softirq.c struct tasklet_struct *list; diff -urNp linux-3.0.4/kernel/sys.c linux-3.0.4/kernel/sys.c ---- linux-3.0.4/kernel/sys.c 2011-08-29 23:26:14.000000000 -0400 +--- linux-3.0.4/kernel/sys.c 2011-09-02 18:11:26.000000000 -0400 +++ linux-3.0.4/kernel/sys.c 2011-08-29 23:26:27.000000000 -0400 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_stru error = -EACCES; @@ -62795,7 +62931,7 @@ diff -urNp linux-3.0.4/kernel/trace/trace.c linux-3.0.4/kernel/trace/trace.c struct dentry *d_tracer; diff -urNp linux-3.0.4/kernel/trace/trace_events.c linux-3.0.4/kernel/trace/trace_events.c ---- linux-3.0.4/kernel/trace/trace_events.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/kernel/trace/trace_events.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/kernel/trace/trace_events.c 2011-08-23 21:47:56.000000000 -0400 @@ -1318,10 +1318,6 @@ static LIST_HEAD(ftrace_module_file_list struct ftrace_module_file_ops { @@ -63143,8 +63279,8 @@ diff -urNp linux-3.0.4/localversion-grsec linux-3.0.4/localversion-grsec @@ -0,0 +1 @@ +-grsec diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile ---- linux-3.0.4/Makefile 2011-08-29 23:26:13.000000000 -0400 -+++ linux-3.0.4/Makefile 2011-09-01 17:26:49.000000000 -0400 +--- linux-3.0.4/Makefile 2011-09-02 18:11:26.000000000 -0400 ++++ linux-3.0.4/Makefile 2011-09-14 11:16:43.000000000 -0400 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" HOSTCC = gcc @@ -63170,23 +63306,30 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile KBUILD_AFLAGS_KERNEL := KBUILD_CFLAGS_KERNEL := KBUILD_AFLAGS := -D__ASSEMBLY__ -@@ -408,6 +411,7 @@ export RCS_TAR_IGNORE := --exclude SCCS +@@ -407,8 +410,8 @@ export RCS_TAR_IGNORE := --exclude SCCS + # Rules shared between *config targets and build targets # Basic helpers built in scripts/ - PHONY += scripts_basic -+scripts_basic: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS)) - scripts_basic: +-PHONY += scripts_basic +-scripts_basic: ++PHONY += scripts_basic gcc-plugins ++scripts_basic: gcc-plugins $(Q)$(MAKE) $(build)=scripts/basic $(Q)rm -f .tmp_quiet_recordmcount -@@ -564,6 +568,24 @@ else + +@@ -564,6 +567,28 @@ else KBUILD_CFLAGS += -O2 endif -+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC)), y) ++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-plugin.sh $(HOSTCC) $(CC)), y) +CONSTIFY_PLUGIN := -fplugin=$(objtree)/tools/gcc/constify_plugin.so -DCONSTIFY_PLUGIN ++ifdef CONFIG_KALLOCSTAT_PLUGIN ++KALLOCSTAT_PLUGIN := -fplugin=$(objtree)/tools/gcc/kallocstat_plugin.so ++endif +ifdef CONFIG_PAX_MEMORY_STACKLEAK +STACKLEAK_PLUGIN := -fplugin=$(objtree)/tools/gcc/stackleak_plugin.so -fplugin-arg-stackleak_plugin-track-lowest-sp=100 +endif ++GCC_PLUGINS := $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) $(KALLOCSTAT_PLUGIN) +export CONSTIFY_PLUGIN STACKLEAK_PLUGIN +gcc-plugins: + $(Q)$(MAKE) $(build)=tools/gcc @@ -63203,7 +63346,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile include $(srctree)/arch/$(SRCARCH)/Makefile ifneq ($(CONFIG_FRAME_WARN),0) -@@ -708,7 +730,7 @@ export mod_strip_cmd +@@ -708,7 +733,7 @@ export mod_strip_cmd ifeq ($(KBUILD_EXTMOD),) @@ -63212,34 +63355,34 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \ $(core-y) $(core-m) $(drivers-y) $(drivers-m) \ -@@ -907,6 +929,8 @@ define rule_vmlinux-modpost +@@ -907,6 +932,8 @@ define rule_vmlinux-modpost endef # vmlinux image - including updated kernel symbols -+$(vmlinux-all): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++$(vmlinux-all): KBUILD_CFLAGS += $(GCC_PLUGINS) +$(vmlinux-all): gcc-plugins vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) vmlinux.o $(kallsyms.o) FORCE ifdef CONFIG_HEADERS_CHECK $(Q)$(MAKE) -f $(srctree)/Makefile headers_check -@@ -941,7 +965,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) +@@ -941,7 +968,8 @@ $(sort $(vmlinux-init) $(vmlinux-main)) # Error messages still appears in the original language PHONY += $(vmlinux-dirs) -$(vmlinux-dirs): prepare scripts -+$(vmlinux-dirs): KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++$(vmlinux-dirs): KBUILD_CFLAGS += $(GCC_PLUGINS) +$(vmlinux-dirs): gcc-plugins prepare scripts $(Q)$(MAKE) $(build)=$@ # Store (new) KERNELRELASE string in include/config/kernel.release -@@ -986,6 +1011,7 @@ prepare0: archprepare FORCE +@@ -986,6 +1014,7 @@ prepare0: archprepare FORCE $(Q)$(MAKE) $(build)=. missing-syscalls # All the preparing.. -+prepare: KBUILD_CFLAGS := $(filter-out $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN),$(KBUILD_CFLAGS)) ++prepare: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS),$(KBUILD_CFLAGS)) prepare: prepare0 # Generate some files -@@ -1102,7 +1128,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu +@@ -1102,7 +1131,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modu # Target to prepare building external modules PHONY += modules_prepare @@ -63248,7 +63391,7 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile # Target to install modules PHONY += modules_install -@@ -1198,7 +1224,7 @@ distclean: mrproper +@@ -1198,7 +1227,7 @@ distclean: mrproper @find $(srctree) $(RCS_FIND_IGNORE) \ \( -name '*.orig' -o -name '*.rej' -o -name '*~' \ -o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \ @@ -63257,26 +63400,26 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile -o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \ -type f -print | xargs rm -f -@@ -1359,6 +1385,7 @@ PHONY += $(module-dirs) modules +@@ -1359,6 +1388,7 @@ PHONY += $(module-dirs) modules $(module-dirs): crmodverdir $(objtree)/Module.symvers $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) -+modules: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++modules: KBUILD_CFLAGS += $(GCC_PLUGINS) modules: $(module-dirs) @$(kecho) ' Building modules, stage 2.'; $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost -@@ -1485,17 +1512,19 @@ else +@@ -1485,17 +1515,19 @@ else target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@)) endif -%.s: %.c prepare scripts FORCE -+%.s: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.s: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.s: %.c gcc-plugins prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.i: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -%.o: %.c prepare scripts FORCE -+%.o: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.o: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.o: %.c gcc-plugins prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.lst: %.c prepare scripts FORCE @@ -63289,18 +63432,18 @@ diff -urNp linux-3.0.4/Makefile linux-3.0.4/Makefile $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) %.symtypes: %.c prepare scripts FORCE $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@) -@@ -1505,11 +1534,13 @@ endif +@@ -1505,11 +1537,13 @@ endif $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) -%/: prepare scripts FORCE -+%/: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%/: KBUILD_CFLAGS += $(GCC_PLUGINS) +%/: gcc-plugins prepare scripts FORCE $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ $(build)=$(build-dir) -%.ko: prepare scripts FORCE -+%.ko: KBUILD_CFLAGS += $(CONSTIFY_PLUGIN) $(STACKLEAK_PLUGIN) ++%.ko: KBUILD_CFLAGS += $(GCC_PLUGINS) +%.ko: gcc-plugins prepare scripts FORCE $(cmd_crmodverdir) $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ @@ -63587,7 +63730,7 @@ diff -urNp linux-3.0.4/mm/madvise.c linux-3.0.4/mm/madvise.c if (end == start) goto out; diff -urNp linux-3.0.4/mm/memory.c linux-3.0.4/mm/memory.c ---- linux-3.0.4/mm/memory.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/mm/memory.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/mm/memory.c 2011-08-23 21:47:56.000000000 -0400 @@ -457,8 +457,12 @@ static inline void free_pmd_range(struct return; @@ -67087,7 +67230,7 @@ diff -urNp linux-3.0.4/mm/util.c linux-3.0.4/mm/util.c mm->unmap_area = arch_unmap_area; } diff -urNp linux-3.0.4/mm/vmalloc.c linux-3.0.4/mm/vmalloc.c ---- linux-3.0.4/mm/vmalloc.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/mm/vmalloc.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/mm/vmalloc.c 2011-08-23 21:47:56.000000000 -0400 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd, @@ -68160,7 +68303,7 @@ diff -urNp linux-3.0.4/net/ipv4/inet_diag.c linux-3.0.4/net/ipv4/inet_diag.c tmo = req->expires - jiffies; if (tmo < 0) diff -urNp linux-3.0.4/net/ipv4/inet_hashtables.c linux-3.0.4/net/ipv4/inet_hashtables.c ---- linux-3.0.4/net/ipv4/inet_hashtables.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv4/inet_hashtables.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv4/inet_hashtables.c 2011-08-23 21:55:24.000000000 -0400 @@ -18,12 +18,15 @@ #include @@ -68188,7 +68331,7 @@ diff -urNp linux-3.0.4/net/ipv4/inet_hashtables.c linux-3.0.4/net/ipv4/inet_hash inet_twsk_deschedule(tw, death_row); while (twrefcnt) { diff -urNp linux-3.0.4/net/ipv4/inetpeer.c linux-3.0.4/net/ipv4/inetpeer.c ---- linux-3.0.4/net/ipv4/inetpeer.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv4/inetpeer.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv4/inetpeer.c 2011-08-23 21:48:14.000000000 -0400 @@ -481,6 +481,8 @@ struct inet_peer *inet_getpeer(struct in unsigned int sequence; @@ -68330,7 +68473,7 @@ diff -urNp linux-3.0.4/net/ipv4/raw.c linux-3.0.4/net/ipv4/raw.c static int raw_seq_show(struct seq_file *seq, void *v) diff -urNp linux-3.0.4/net/ipv4/route.c linux-3.0.4/net/ipv4/route.c ---- linux-3.0.4/net/ipv4/route.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv4/route.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv4/route.c 2011-08-23 21:47:56.000000000 -0400 @@ -304,7 +304,7 @@ static inline unsigned int rt_hash(__be3 @@ -68381,7 +68524,7 @@ diff -urNp linux-3.0.4/net/ipv4/tcp.c linux-3.0.4/net/ipv4/tcp.c return -EFAULT; diff -urNp linux-3.0.4/net/ipv4/tcp_ipv4.c linux-3.0.4/net/ipv4/tcp_ipv4.c ---- linux-3.0.4/net/ipv4/tcp_ipv4.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv4/tcp_ipv4.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv4/tcp_ipv4.c 2011-08-23 21:48:14.000000000 -0400 @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly; int sysctl_tcp_low_latency __read_mostly; @@ -68811,7 +68954,7 @@ diff -urNp linux-3.0.4/net/ipv6/raw.c linux-3.0.4/net/ipv6/raw.c static int raw6_seq_show(struct seq_file *seq, void *v) diff -urNp linux-3.0.4/net/ipv6/tcp_ipv6.c linux-3.0.4/net/ipv6/tcp_ipv6.c ---- linux-3.0.4/net/ipv6/tcp_ipv6.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv6/tcp_ipv6.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv6/tcp_ipv6.c 2011-08-23 21:48:14.000000000 -0400 @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5 } @@ -68913,7 +69056,7 @@ diff -urNp linux-3.0.4/net/ipv6/tcp_ipv6.c linux-3.0.4/net/ipv6/tcp_ipv6.c static int tcp6_seq_show(struct seq_file *seq, void *v) diff -urNp linux-3.0.4/net/ipv6/udp.c linux-3.0.4/net/ipv6/udp.c ---- linux-3.0.4/net/ipv6/udp.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/ipv6/udp.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/ipv6/udp.c 2011-08-23 21:48:14.000000000 -0400 @@ -50,6 +50,10 @@ #include @@ -69253,7 +69396,7 @@ diff -urNp linux-3.0.4/net/mac80211/ieee80211_i.h linux-3.0.4/net/mac80211/ieee8 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff -urNp linux-3.0.4/net/mac80211/iface.c linux-3.0.4/net/mac80211/iface.c ---- linux-3.0.4/net/mac80211/iface.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/mac80211/iface.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/mac80211/iface.c 2011-08-23 21:47:56.000000000 -0400 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_ break; @@ -69322,7 +69465,7 @@ diff -urNp linux-3.0.4/net/mac80211/main.c linux-3.0.4/net/mac80211/main.c /* * Goal: diff -urNp linux-3.0.4/net/mac80211/mlme.c linux-3.0.4/net/mac80211/mlme.c ---- linux-3.0.4/net/mac80211/mlme.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/mac80211/mlme.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/mac80211/mlme.c 2011-08-23 21:48:14.000000000 -0400 @@ -1444,6 +1444,8 @@ static bool ieee80211_assoc_success(stru bool have_higher_than_11mbit = false; @@ -69442,7 +69585,7 @@ diff -urNp linux-3.0.4/net/netfilter/ipvs/ip_vs_core.c linux-3.0.4/net/netfilter if ((ipvs->sync_state & IP_VS_STATE_MASTER) && cp->protocol == IPPROTO_SCTP) { diff -urNp linux-3.0.4/net/netfilter/ipvs/ip_vs_ctl.c linux-3.0.4/net/netfilter/ipvs/ip_vs_ctl.c ---- linux-3.0.4/net/netfilter/ipvs/ip_vs_ctl.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/netfilter/ipvs/ip_vs_ctl.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/netfilter/ipvs/ip_vs_ctl.c 2011-08-23 21:48:14.000000000 -0400 @@ -782,7 +782,7 @@ __ip_vs_update_dest(struct ip_vs_service ip_vs_rs_hash(ipvs, dest); @@ -70290,7 +70433,7 @@ diff -urNp linux-3.0.4/net/sctp/socket.c linux-3.0.4/net/sctp/socket.c to += addrlen; cnt++; diff -urNp linux-3.0.4/net/socket.c linux-3.0.4/net/socket.c ---- linux-3.0.4/net/socket.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/net/socket.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/net/socket.c 2011-08-23 21:48:14.000000000 -0400 @@ -88,6 +88,7 @@ #include @@ -70897,10 +71040,10 @@ diff -urNp linux-3.0.4/scripts/basic/fixdep.c linux-3.0.4/scripts/basic/fixdep.c fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n", diff -urNp linux-3.0.4/scripts/gcc-plugin.sh linux-3.0.4/scripts/gcc-plugin.sh --- linux-3.0.4/scripts/gcc-plugin.sh 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/scripts/gcc-plugin.sh 2011-08-31 18:39:25.000000000 -0400 ++++ linux-3.0.4/scripts/gcc-plugin.sh 2011-09-14 09:08:05.000000000 -0400 @@ -0,0 +1,2 @@ +#!/bin/sh -+echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $* -x c -shared - -o /dev/null -I`$* -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y" ++echo "#include \"gcc-plugin.h\"\n#include \"rtl.h\"" | $1 -x c -shared - -o /dev/null -I`$2 -print-file-name=plugin`/include >/dev/null 2>&1 && echo "y" diff -urNp linux-3.0.4/scripts/Makefile.build linux-3.0.4/scripts/Makefile.build --- linux-3.0.4/scripts/Makefile.build 2011-07-21 22:17:23.000000000 -0400 +++ linux-3.0.4/scripts/Makefile.build 2011-08-23 21:47:56.000000000 -0400 @@ -71145,7 +71288,7 @@ diff -urNp linux-3.0.4/scripts/pnmtologo.c linux-3.0.4/scripts/pnmtologo.c write_hex_cnt = 0; for (i = 0; i < logo_clutsize; i++) { diff -urNp linux-3.0.4/security/apparmor/lsm.c linux-3.0.4/security/apparmor/lsm.c ---- linux-3.0.4/security/apparmor/lsm.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/security/apparmor/lsm.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/security/apparmor/lsm.c 2011-08-23 21:48:14.000000000 -0400 @@ -621,7 +621,7 @@ static int apparmor_task_setrlimit(struc return error; @@ -72354,7 +72497,7 @@ diff -urNp linux-3.0.4/sound/pci/ymfpci/ymfpci_main.c linux-3.0.4/sound/pci/ymfp chip->pci = pci; chip->irq = -1; diff -urNp linux-3.0.4/sound/soc/soc-core.c linux-3.0.4/sound/soc/soc-core.c ---- linux-3.0.4/sound/soc/soc-core.c 2011-08-23 21:44:40.000000000 -0400 +--- linux-3.0.4/sound/soc/soc-core.c 2011-09-02 18:11:21.000000000 -0400 +++ linux-3.0.4/sound/soc/soc-core.c 2011-08-23 21:47:56.000000000 -0400 @@ -1021,7 +1021,7 @@ static snd_pcm_uframes_t soc_pcm_pointer } @@ -72690,10 +72833,177 @@ diff -urNp linux-3.0.4/tools/gcc/constify_plugin.c linux-3.0.4/tools/gcc/constif + + return 0; +} +diff -urNp linux-3.0.4/tools/gcc/kallocstat_plugin.c linux-3.0.4/tools/gcc/kallocstat_plugin.c +--- linux-3.0.4/tools/gcc/kallocstat_plugin.c 1969-12-31 19:00:00.000000000 -0500 ++++ linux-3.0.4/tools/gcc/kallocstat_plugin.c 2011-09-14 09:08:05.000000000 -0400 +@@ -0,0 +1,163 @@ ++/* ++ * Copyright 2011 by the PaX Team ++ * Licensed under the GPL v2 ++ * ++ * Note: the choice of the license means that the compilation process is ++ * NOT 'eligible' as defined by gcc's library exception to the GPL v3, ++ * but for the kernel it doesn't matter since it doesn't link against ++ * any of the gcc libraries ++ * ++ * gcc plugin to find the distribution of k*alloc sizes ++ * ++ * TODO: ++ * ++ * BUGS: ++ * - none known ++ */ ++#include "gcc-plugin.h" ++#include "config.h" ++#include "system.h" ++#include "coretypes.h" ++#include "tree.h" ++#include "tree-pass.h" ++#include "intl.h" ++#include "plugin-version.h" ++#include "tm.h" ++#include "toplev.h" ++#include "basic-block.h" ++#include "gimple.h" ++//#include "expr.h" where are you... ++#include "diagnostic.h" ++#include "rtl.h" ++#include "emit-rtl.h" ++#include "function.h" ++ ++int plugin_is_GPL_compatible; ++ ++static const char * const kalloc_functions[] = { ++ "__kmalloc", ++ "kmalloc", ++ "kmalloc_large", ++ "kmalloc_node", ++ "kmalloc_order", ++ "kmalloc_order_trace", ++ "kmalloc_slab", ++ "kzalloc", ++ "kzalloc_node", ++}; ++ ++static struct plugin_info kallocstat_plugin_info = { ++ .version = "201109121100", ++}; ++ ++static unsigned int execute_kallocstat(void); ++ ++static struct gimple_opt_pass kallocstat_pass = { ++ .pass = { ++ .type = GIMPLE_PASS, ++ .name = "kallocstat", ++ .gate = NULL, ++ .execute = execute_kallocstat, ++ .sub = NULL, ++ .next = NULL, ++ .static_pass_number = 0, ++ .tv_id = TV_NONE, ++ .properties_required = 0, ++ .properties_provided = 0, ++ .properties_destroyed = 0, ++ .todo_flags_start = 0, ++ .todo_flags_finish = 0 ++ } ++}; ++ ++static bool is_kalloc(const char *fnname) ++{ ++ size_t i; ++ ++ for (i = 0; i < ARRAY_SIZE(kalloc_functions); i++) ++ if (!strcmp(fnname, kalloc_functions[i])) ++ return true; ++ return false; ++} ++ ++static unsigned int execute_kallocstat(void) ++{ ++ basic_block bb; ++ gimple_stmt_iterator gsi; ++ ++ // 1. loop through BBs and GIMPLE statements ++ FOR_EACH_BB(bb) { ++ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { ++ // gimple match: ++ tree fndecl, size; ++ gimple call_stmt; ++ const char *fnname; ++ ++ // is it a call ++ call_stmt = gsi_stmt(gsi); ++ if (!is_gimple_call(call_stmt)) ++ continue; ++ fndecl = gimple_call_fndecl(call_stmt); ++ if (fndecl == NULL_TREE) ++ continue; ++ if (TREE_CODE(fndecl) != FUNCTION_DECL) ++ continue; ++ ++ // is it a call to k*alloc ++ fnname = IDENTIFIER_POINTER(DECL_NAME(fndecl)); ++ if (!is_kalloc(fnname)) ++ continue; ++ ++ // is the size arg the result of a simple const assignment ++ size = gimple_call_arg(call_stmt, 0); ++ while (true) { ++ gimple def_stmt; ++ expanded_location xloc; ++ size_t size_val; ++ ++ if (TREE_CODE(size) != SSA_NAME) ++ break; ++ def_stmt = SSA_NAME_DEF_STMT(size); ++ if (!def_stmt || !is_gimple_assign(def_stmt)) ++ break; ++ if (gimple_num_ops(def_stmt) != 2) ++ break; ++ size = gimple_assign_rhs1(def_stmt); ++ if (!TREE_CONSTANT(size)) ++ continue; ++ xloc = expand_location(gimple_location(def_stmt)); ++ if (!xloc.file) ++ xloc = expand_location(DECL_SOURCE_LOCATION(current_function_decl)); ++ size_val = TREE_INT_CST_LOW(size); ++ fprintf(stderr, "kallocsize: %8zu %8zx %s %s:%u\n", size_val, size_val, fnname, xloc.file, xloc.line); ++ break; ++ } ++//print_gimple_stmt(stderr, call_stmt, 0, TDF_LINENO); ++//debug_tree(gimple_call_fn(call_stmt)); ++//print_node(stderr, "pax", fndecl, 4); ++ } ++ } ++ ++ return 0; ++} ++ ++int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) ++{ ++ const char * const plugin_name = plugin_info->base_name; ++ struct register_pass_info kallocstat_pass_info = { ++ .pass = &kallocstat_pass.pass, ++ .reference_pass_name = "ssa", ++ .ref_pass_instance_number = 0, ++ .pos_op = PASS_POS_INSERT_AFTER ++ }; ++ ++ if (!plugin_default_version_check(version, &gcc_version)) { ++ error(G_("incompatible gcc/plugin versions")); ++ return 1; ++ } ++ ++ register_callback(plugin_name, PLUGIN_INFO, NULL, &kallocstat_plugin_info); ++ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &kallocstat_pass_info); ++ ++ return 0; ++} diff -urNp linux-3.0.4/tools/gcc/Makefile linux-3.0.4/tools/gcc/Makefile --- linux-3.0.4/tools/gcc/Makefile 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/tools/gcc/Makefile 2011-08-23 21:47:56.000000000 -0400 -@@ -0,0 +1,12 @@ ++++ linux-3.0.4/tools/gcc/Makefile 2011-09-14 09:08:05.000000000 -0400 +@@ -0,0 +1,13 @@ +#CC := gcc +#PLUGIN_SOURCE_FILES := pax_plugin.c +#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES)) @@ -72702,14 +73012,15 @@ diff -urNp linux-3.0.4/tools/gcc/Makefile linux-3.0.4/tools/gcc/Makefile + +HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include + -+hostlibs-y := stackleak_plugin.so constify_plugin.so ++hostlibs-y := stackleak_plugin.so constify_plugin.so kallocstat_plugin.so +always := $(hostlibs-y) +stackleak_plugin-objs := stackleak_plugin.o +constify_plugin-objs := constify_plugin.o ++kallocstat_plugin-objs := kallocstat_plugin.o diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackleak_plugin.c --- linux-3.0.4/tools/gcc/stackleak_plugin.c 1969-12-31 19:00:00.000000000 -0500 -+++ linux-3.0.4/tools/gcc/stackleak_plugin.c 2011-08-23 21:47:56.000000000 -0400 -@@ -0,0 +1,243 @@ ++++ linux-3.0.4/tools/gcc/stackleak_plugin.c 2011-09-14 09:08:05.000000000 -0400 +@@ -0,0 +1,249 @@ +/* + * Copyright 2011 by the PaX Team + * Licensed under the GPL v2 @@ -72727,7 +73038,7 @@ diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackl + * - initialize all local variables + * + * BUGS: -+ * - cloned functions are instrumented twice ++ * - none known + */ +#include "gcc-plugin.h" +#include "config.h" @@ -72754,7 +73065,7 @@ diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackl +static bool init_locals; + +static struct plugin_info stackleak_plugin_info = { -+ .version = "201106030000", ++ .version = "201109112100", + .help = "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n" +// "initialize-locals\t\tforcibly initialize all stack frames\n" +}; @@ -72807,13 +73118,13 @@ diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackl +static void stackleak_add_instrumentation(gimple_stmt_iterator *gsi, bool before) +{ + gimple call; -+ tree decl, type; ++ tree fndecl, type; + + // insert call to void pax_track_stack(void) + type = build_function_type_list(void_type_node, NULL_TREE); -+ decl = build_fn_decl(track_function, type); -+ DECL_ASSEMBLER_NAME(decl); // for LTO -+ call = gimple_build_call(decl, 0); ++ fndecl = build_fn_decl(track_function, type); ++ DECL_ASSEMBLER_NAME(fndecl); // for LTO ++ call = gimple_build_call(fndecl, 0); + if (before) + gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING); + else @@ -72822,40 +73133,46 @@ diff -urNp linux-3.0.4/tools/gcc/stackleak_plugin.c linux-3.0.4/tools/gcc/stackl + +static unsigned int execute_stackleak_tree_instrument(void) +{ -+ basic_block bb; ++ basic_block bb, entry_bb; + gimple_stmt_iterator gsi; ++ bool prologue_instrumented = false; ++ ++ entry_bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb; + + // 1. loop through BBs and GIMPLE statements + FOR_EACH_BB(bb) { + for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) { + // gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes -+ tree decl; ++ tree fndecl; + gimple stmt = gsi_stmt(gsi); + + if (!is_gimple_call(stmt)) + continue; -+ decl = gimple_call_fndecl(stmt); -+ if (!decl) ++ fndecl = gimple_call_fndecl(stmt); ++ if (!fndecl) + continue; -+ if (TREE_CODE(decl) != FUNCTION_DECL) ++ if (TREE_CODE(fndecl) != FUNCTION_DECL) + continue; -+ if (!DECL_BUILT_IN(decl)) ++ if (!DECL_BUILT_IN(fndecl)) + continue; -+ if (DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL) ++ if (DECL_BUILT_IN_CLASS(fndecl) != BUILT_IN_NORMAL) + continue; -+ if (DECL_FUNCTION_CODE(decl) != BUILT_IN_ALLOCA) ++ if (DECL_FUNCTION_CODE(fndecl) != BUILT_IN_ALLOCA) + continue; + + // 2. insert track call after each __builtin_alloca call + stackleak_add_instrumentation(&gsi, false); -+// print_node(stderr, "pax", decl, 4); ++ if (bb == entry_bb) ++ prologue_instrumented = true; ++// print_node(stderr, "pax", fndecl, 4); + } + } + + // 3. insert track call at the beginning -+ bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb; -+ gsi = gsi_start_bb(bb); -+ stackleak_add_instrumentation(&gsi, true); ++ if (!prologue_instrumented) { ++ gsi = gsi_start_bb(entry_bb); ++ stackleak_add_instrumentation(&gsi, true); ++ } + + return 0; +} diff --git a/kernel.spec b/kernel.spec index f21d3f04..d931e6a3 100644 --- a/kernel.spec +++ b/kernel.spec @@ -94,7 +94,7 @@ %define basever 3.0 %define postver .4 -%define rel 3 +%define rel 3.1 %define _enable_debug_packages 0 @@ -285,7 +285,7 @@ Patch5000: kernel-apparmor.patch # based on ftp://ftp.leg.uct.ac.za/pub/linux/rip/tmpfs_root-2.6.30.diff.gz Patch7000: kernel-inittmpfs.patch -# based on http://grsecurity.net/~spender/grsecurity-2.2.2-3.0.4-201109011725.patch +# based on http://grsecurity.net/~spender/grsecurity-2.2.2-3.0.4-201109150655.patch # NOTE: put raw upstream patches on kernel-grsec_full.patch:GRSECURITY_RAW for reference # (since upstream deletes older patches) Patch9999: kernel-grsec_full.patch @@ -1107,6 +1107,8 @@ touch $RPM_BUILD_ROOT/lib/modules/%{kernel_release}/modules.dep install -d $RPM_BUILD_ROOT%{_sysconfdir}/modprobe.d/%{kernel_release} # /usr/src/linux +install -d $RPM_BUILD_ROOT%{_kernelsrcdir} + # test if we can hardlink -- %{_builddir} and $RPM_BUILD_ROOT on same partition if cp -al %{srcdir}/COPYING $RPM_BUILD_ROOT/COPYING 2>/dev/null; then l=l -- 2.44.0