Grsec/PaX: 2.9-2.6.32.59-201203221943 + 2.9-3.2.12-20120322194420120322

4 files changed, 46 insertions, 183 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 078f367..9441d44 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9-2.6.32.59-201203212033.patch
+Patch:	4420_grsecurity-2.9-2.6.32.59-201203221943.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201203212033.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201203221943.patch
index 0b63ac0..0302b86 100644
--- a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201203212033.patch
+++ b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201203221943.patch
@@ -13536,7 +13536,7 @@ index 61c5874..8a046e9 100644
  # include "uaccess_32.h"
  #else
 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
-index 632fb44..bb15d3f 100644
+index 632fb44..12702d6 100644
 --- a/arch/x86/include/asm/uaccess_32.h
 +++ b/arch/x86/include/asm/uaccess_32.h
 @@ -12,15 +12,15 @@
@@ -13649,7 +13649,7 @@ index 632fb44..bb15d3f 100644
  	if (__builtin_constant_p(n)) {
  		unsigned long ret;
  
-@@ -180,20 +213,75 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
+@@ -180,16 +213,71 @@ static __always_inline unsigned long __copy_from_user_nocache(void *to,
  
  static __always_inline unsigned long
  __copy_from_user_inatomic_nocache(void *to, const void __user *from,
@@ -13725,28 +13725,20 @@ index 632fb44..bb15d3f 100644
 -					  const void __user *from,
 -					  unsigned long n);
  long __must_check strncpy_from_user(char *dst, const char __user *src,
--				    long count);
-+				    unsigned long count);
+ 				    long count);
  long __must_check __strncpy_from_user(char *dst,
--				      const char __user *src, long count);
-+				      const char __user *src, unsigned long count);
- 
- /**
-  * strlen_user: - Get the size of a string in user space.
-@@ -211,8 +299,8 @@ long __must_check __strncpy_from_user(char *dst,
-  */
+@@ -212,7 +300,7 @@ long __must_check __strncpy_from_user(char *dst,
  #define strlen_user(str) strnlen_user(str, LONG_MAX)
  
--long strnlen_user(const char __user *str, long n);
+ long strnlen_user(const char __user *str, long n);
 -unsigned long __must_check clear_user(void __user *mem, unsigned long len);
 -unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
-+long strnlen_user(const char __user *str, unsigned long n);
 +unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2);
 +unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
  
  #endif /* _ASM_X86_UACCESS_32_H */
 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index db24b21..7cd829e 100644
+index db24b21..618b613 100644
 --- a/arch/x86/include/asm/uaccess_64.h
 +++ b/arch/x86/include/asm/uaccess_64.h
 @@ -9,6 +9,9 @@
@@ -14040,7 +14032,7 @@ index db24b21..7cd829e 100644
  			       ret, "q", "", "=r", 8);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u64 __user *)dst,
-@@ -161,48 +263,105 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -161,8 +263,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
  		return ret;
  	}
  	default:
@@ -14059,16 +14051,9 @@ index db24b21..7cd829e 100644
  	}
  }
  
- __must_check long
--strncpy_from_user(char *dst, const char __user *src, long count);
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count);
- __must_check long
--__strncpy_from_user(char *dst, const char __user *src, long count);
--__must_check long strnlen_user(const char __user *str, long n);
--__must_check long __strnlen_user(const char __user *str, long n);
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count);
-+__must_check long strnlen_user(const char __user *str, unsigned long n);
-+__must_check long __strnlen_user(const char __user *str, unsigned long n);
+@@ -173,36 +283,85 @@ __strncpy_from_user(char *dst, const char __user *src, long count);
+ __must_check long strnlen_user(const char __user *str, long n);
+ __must_check long __strnlen_user(const char __user *str, long n);
  __must_check long strlen_user(const char __user *str);
 -__must_check unsigned long clear_user(void __user *mem, unsigned long len);
 -__must_check unsigned long __clear_user(void __user *mem, unsigned long len);
@@ -24519,7 +24504,7 @@ index bf9a7d5..fb06ab5 100644
  	ret
  	CFI_ENDPROC
 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
-index 1f118d4..8e0ead9 100644
+index 1f118d4..fc661b0 100644
 --- a/arch/x86/lib/usercopy_32.c
 +++ b/arch/x86/lib/usercopy_32.c
 @@ -43,7 +43,7 @@ do {									   \
@@ -24531,24 +24516,6 @@ index 1f118d4..8e0ead9 100644
  		"	stosb\n"					   \
  		"	testb %%al,%%al\n"				   \
  		"	jz 1f\n"					   \
-@@ -83,7 +83,7 @@ do {									   \
-  * and returns @count.
-  */
- long
--__strncpy_from_user(char *dst, const char __user *src, long count)
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res;
- 	__do_strncpy_from_user(dst, src, count, res);
-@@ -110,7 +110,7 @@ EXPORT_SYMBOL(__strncpy_from_user);
-  * and returns @count.
-  */
- long
--strncpy_from_user(char *dst, const char __user *src, long count)
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
 @@ -128,10 +128,12 @@ do {									\
  	int __d0;							\
  	might_fault();							\
@@ -24562,15 +24529,6 @@ index 1f118d4..8e0ead9 100644
  		".section .fixup,\"ax\"\n"				\
  		"3:	lea 0(%2,%0,4),%0\n"				\
  		"	jmp 2b\n"					\
-@@ -192,7 +194,7 @@ EXPORT_SYMBOL(__clear_user);
-  * On exception, returns 0.
-  * If the string is too long, returns a value greater than @n.
-  */
--long strnlen_user(const char __user *s, long n)
-+long strnlen_user(const char __user *s, unsigned long n)
- {
- 	unsigned long mask = -__addr_ok(s);
- 	unsigned long res, tmp;
 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
  	might_fault();
  
@@ -25178,15 +25136,11 @@ index 1f118d4..8e0ead9 100644
 +EXPORT_SYMBOL(set_fs);
 +#endif
 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index b7c2849..bab76d3 100644
+index b7c2849..8633ad8 100644
 --- a/arch/x86/lib/usercopy_64.c
 +++ b/arch/x86/lib/usercopy_64.c
-@@ -39,16 +39,22 @@ do {									   \
- } while (0)
- 
- long
--__strncpy_from_user(char *dst, const char __user *src, long count)
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count)
+@@ -42,6 +42,12 @@ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
  {
  	long res;
 +
@@ -25198,14 +25152,6 @@ index b7c2849..bab76d3 100644
  	__do_strncpy_from_user(dst, src, count, res);
  	return res;
  }
- EXPORT_SYMBOL(__strncpy_from_user);
- 
- long
--strncpy_from_user(char *dst, const char __user *src, long count)
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
  {
  	long __d0;
@@ -25219,24 +25165,6 @@ index b7c2849..bab76d3 100644
  	/* no memory constraint because it doesn't change any memory gcc knows
  	   about */
  	asm volatile(
-@@ -107,7 +119,7 @@ EXPORT_SYMBOL(clear_user);
-  * Return 0 on exception, a value greater than N if too long
-  */
- 
--long __strnlen_user(const char __user *s, long n)
-+long __strnlen_user(const char __user *s, unsigned long n)
- {
- 	long res = 0;
- 	char c;
-@@ -125,7 +137,7 @@ long __strnlen_user(const char __user *s, long n)
- }
- EXPORT_SYMBOL(__strnlen_user);
- 
--long strnlen_user(const char __user *s, long n)
-+long strnlen_user(const char __user *s, unsigned long n)
- {
- 	if (!access_ok(VERIFY_READ, s, 1))
- 		return 0;
 @@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
  }
  EXPORT_SYMBOL(strlen_user);
@@ -79284,7 +79212,7 @@ index 0000000..955ddfb
 +
 diff --git a/grsecurity/gracl_fs.c b/grsecurity/gracl_fs.c
 new file mode 100644
-index 0000000..523e7e8
+index 0000000..8c4595a
 --- /dev/null
 +++ b/grsecurity/gracl_fs.c
 @@ -0,0 +1,435 @@
@@ -79498,9 +79426,9 @@ index 0000000..523e7e8
 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
 +		     umode_t *modeptr)
 +{
-+	mode_t mode;
++	umode_t mode;
 +
-+	*modeptr &= ~(mode_t)gr_acl_umask();
++	*modeptr &= ~gr_acl_umask();
 +	mode = *modeptr;
 +
 +	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
@@ -85556,10 +85484,10 @@ index 297df45..b6a74ff 100644
  	struct blk_integrity *integrity;
 diff --git a/include/linux/gracl.h b/include/linux/gracl.h
 new file mode 100644
-index 0000000..af663cf
+index 0000000..6c51079
 --- /dev/null
 +++ b/include/linux/gracl.h
-@@ -0,0 +1,319 @@
+@@ -0,0 +1,320 @@
 +#ifndef GR_ACL_H
 +#define GR_ACL_H
 +
@@ -85735,7 +85663,8 @@ index 0000000..af663cf
 +	uid_t *domain_children;
 +	__u16 domain_child_num;
 +
-+	mode_t umask;
++	// __u16
++	umode_t umask;
 +
 +	struct acl_subject_label **subj_hash;
 +	__u32 subj_hash_size;
diff --git a/3.2.12/0000_README b/3.2.12/0000_README
index 4e91c4e..ff7242f 100644
--- a/3.2.12/0000_README
+++ b/3.2.12/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9-3.2.12-201203212033.patch
+Patch:	4420_grsecurity-2.9-3.2.12-201203221944.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.12/4420_grsecurity-2.9-3.2.12-201203212033.patch b/3.2.12/4420_grsecurity-2.9-3.2.12-201203221944.patch
index adc602d..94d7e91 100644
--- a/3.2.12/4420_grsecurity-2.9-3.2.12-201203212033.patch
+++ b/3.2.12/4420_grsecurity-2.9-3.2.12-201203221944.patch
@@ -12299,7 +12299,7 @@ index 36361bf..324f262 100644
  
  #ifdef CONFIG_X86_WP_WORKS_OK
 diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
-index 566e803..dfa5535 100644
+index 566e803..7183d0b 100644
 --- a/arch/x86/include/asm/uaccess_32.h
 +++ b/arch/x86/include/asm/uaccess_32.h
 @@ -11,15 +11,15 @@
@@ -12440,7 +12440,7 @@ index 566e803..dfa5535 100644
  
  extern void copy_from_user_overflow(void)
  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-@@ -199,24 +235,72 @@ extern void copy_from_user_overflow(void)
+@@ -199,17 +235,65 @@ extern void copy_from_user_overflow(void)
  #endif
  ;
  
@@ -12513,29 +12513,18 @@ index 566e803..dfa5535 100644
  	return n;
  }
  
- long __must_check strncpy_from_user(char *dst, const char __user *src,
--				    long count);
-+				    unsigned long count);
- long __must_check __strncpy_from_user(char *dst,
--				      const char __user *src, long count);
-+				      const char __user *src, unsigned long count);
- 
- /**
-  * strlen_user: - Get the size of a string in user space.
-@@ -234,8 +318,8 @@ long __must_check __strncpy_from_user(char *dst,
-  */
+@@ -235,7 +319,7 @@ long __must_check __strncpy_from_user(char *dst,
  #define strlen_user(str) strnlen_user(str, LONG_MAX)
  
--long strnlen_user(const char __user *str, long n);
+ long strnlen_user(const char __user *str, long n);
 -unsigned long __must_check clear_user(void __user *mem, unsigned long len);
 -unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
-+long strnlen_user(const char __user *str, unsigned long n);
 +unsigned long __must_check clear_user(void __user *mem, unsigned long len) __size_overflow(2);
 +unsigned long __must_check __clear_user(void __user *mem, unsigned long len) __size_overflow(2);
  
  #endif /* _ASM_X86_UACCESS_32_H */
 diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
-index 1c66d30..8a44920 100644
+index 1c66d30..e294b5f 100644
 --- a/arch/x86/include/asm/uaccess_64.h
 +++ b/arch/x86/include/asm/uaccess_64.h
 @@ -10,6 +10,9 @@
@@ -12879,7 +12868,7 @@ index 1c66d30..8a44920 100644
  			       ret, "q", "", "=r", 8);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u64 __user *)dst,
-@@ -203,51 +303,103 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+@@ -203,8 +303,16 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
  		return ret;
  	}
  	default:
@@ -12898,16 +12887,9 @@ index 1c66d30..8a44920 100644
  	}
  }
  
- __must_check long
--strncpy_from_user(char *dst, const char __user *src, long count);
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count);
- __must_check long
--__strncpy_from_user(char *dst, const char __user *src, long count);
--__must_check long strnlen_user(const char __user *str, long n);
--__must_check long __strnlen_user(const char __user *str, long n);
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count);
-+__must_check long strnlen_user(const char __user *str, unsigned long n);
-+__must_check long __strnlen_user(const char __user *str, unsigned long n);
+@@ -215,39 +323,83 @@ __strncpy_from_user(char *dst, const char __user *src, long count);
+ __must_check long strnlen_user(const char __user *str, long n);
+ __must_check long __strnlen_user(const char __user *str, long n);
  __must_check long strlen_user(const char __user *str);
 -__must_check unsigned long clear_user(void __user *mem, unsigned long len);
 -__must_check unsigned long __clear_user(void __user *mem, unsigned long len);
@@ -22633,7 +22615,7 @@ index a63efd6..ccecad8 100644
  	ret
  	CFI_ENDPROC
 diff --git a/arch/x86/lib/usercopy_32.c b/arch/x86/lib/usercopy_32.c
-index e218d5d..1e01930 100644
+index e218d5d..a99a1eb 100644
 --- a/arch/x86/lib/usercopy_32.c
 +++ b/arch/x86/lib/usercopy_32.c
 @@ -43,7 +43,7 @@ do {									   \
@@ -22645,24 +22627,6 @@ index e218d5d..1e01930 100644
  		"	stosb\n"					   \
  		"	testb %%al,%%al\n"				   \
  		"	jz 1f\n"					   \
-@@ -83,7 +83,7 @@ do {									   \
-  * and returns @count.
-  */
- long
--__strncpy_from_user(char *dst, const char __user *src, long count)
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res;
- 	__do_strncpy_from_user(dst, src, count, res);
-@@ -110,7 +110,7 @@ EXPORT_SYMBOL(__strncpy_from_user);
-  * and returns @count.
-  */
- long
--strncpy_from_user(char *dst, const char __user *src, long count)
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
 @@ -128,10 +128,12 @@ do {									\
  	int __d0;							\
  	might_fault();							\
@@ -22676,15 +22640,6 @@ index e218d5d..1e01930 100644
  		".section .fixup,\"ax\"\n"				\
  		"3:	lea 0(%2,%0,4),%0\n"				\
  		"	jmp 2b\n"					\
-@@ -192,7 +194,7 @@ EXPORT_SYMBOL(__clear_user);
-  * On exception, returns 0.
-  * If the string is too long, returns a value greater than @n.
-  */
--long strnlen_user(const char __user *s, long n)
-+long strnlen_user(const char __user *s, unsigned long n)
- {
- 	unsigned long mask = -__addr_ok(s);
- 	unsigned long res, tmp;
 @@ -200,6 +202,7 @@ long strnlen_user(const char __user *s, long n)
  	might_fault();
  
@@ -23310,15 +23265,11 @@ index e218d5d..1e01930 100644
 +EXPORT_SYMBOL(set_fs);
 +#endif
 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index b7c2849..bab76d3 100644
+index b7c2849..8633ad8 100644
 --- a/arch/x86/lib/usercopy_64.c
 +++ b/arch/x86/lib/usercopy_64.c
-@@ -39,16 +39,22 @@ do {									   \
- } while (0)
- 
- long
--__strncpy_from_user(char *dst, const char __user *src, long count)
-+__strncpy_from_user(char *dst, const char __user *src, unsigned long count)
+@@ -42,6 +42,12 @@ long
+ __strncpy_from_user(char *dst, const char __user *src, long count)
  {
  	long res;
 +
@@ -23330,14 +23281,6 @@ index b7c2849..bab76d3 100644
  	__do_strncpy_from_user(dst, src, count, res);
  	return res;
  }
- EXPORT_SYMBOL(__strncpy_from_user);
- 
- long
--strncpy_from_user(char *dst, const char __user *src, long count)
-+strncpy_from_user(char *dst, const char __user *src, unsigned long count)
- {
- 	long res = -EFAULT;
- 	if (access_ok(VERIFY_READ, src, 1))
 @@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *addr, unsigned long size)
  {
  	long __d0;
@@ -23351,24 +23294,6 @@ index b7c2849..bab76d3 100644
  	/* no memory constraint because it doesn't change any memory gcc knows
  	   about */
  	asm volatile(
-@@ -107,7 +119,7 @@ EXPORT_SYMBOL(clear_user);
-  * Return 0 on exception, a value greater than N if too long
-  */
- 
--long __strnlen_user(const char __user *s, long n)
-+long __strnlen_user(const char __user *s, unsigned long n)
- {
- 	long res = 0;
- 	char c;
-@@ -125,7 +137,7 @@ long __strnlen_user(const char __user *s, long n)
- }
- EXPORT_SYMBOL(__strnlen_user);
- 
--long strnlen_user(const char __user *s, long n)
-+long strnlen_user(const char __user *s, unsigned long n)
- {
- 	if (!access_ok(VERIFY_READ, s, 1))
- 		return 0;
 @@ -149,12 +161,20 @@ long strlen_user(const char __user *s)
  }
  EXPORT_SYMBOL(strlen_user);
@@ -43401,7 +43326,7 @@ index 0e3c092..818480e 100644
  			kunmap(page);
  			if (ret != len)
 diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
-index 9895400..fa40a7d 100644
+index 9895400..78a67e7 100644
 --- a/fs/ceph/dir.c
 +++ b/fs/ceph/dir.c
 @@ -244,7 +244,7 @@ static int ceph_readdir(struct file *filp, void *dirent, filldir_t filldir)
@@ -43413,6 +43338,15 @@ index 9895400..fa40a7d 100644
  	int err;
  	u32 ftype;
  	struct ceph_mds_reply_info_parsed *rinfo;
+@@ -598,7 +598,7 @@ static struct dentry *ceph_lookup(struct inode *dir, struct dentry *dentry,
+ 	if (nd &&
+ 	    (nd->flags & LOOKUP_OPEN) &&
+ 	    !(nd->intent.open.flags & O_CREAT)) {
+-		int mode = nd->intent.open.create_mode & ~current->fs->umask;
++		int mode = nd->intent.open.create_mode & ~current_umask();
+ 		return ceph_lookup_open(dir, dentry, nd, mode, 1);
+ 	}
+ 
 diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
 index cfd1ce3..6b13a74 100644
 --- a/fs/cifs/asn1.c