Grsec/PaX: 2.9.1-3.11.1-20130922183820130922

3 files changed, 2 insertions, 428 deletions

diff --git a/3.11.1/0000_README b/3.11.1/0000_README
index 4d5977a..da0f1cd 100644
--- a/3.11.1/0000_README
+++ b/3.11.1/0000_README
@@ -2,11 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1000_linux-3.11.1.patch
-From:	http://www.kernel.org
-Desc:	Linux 3.11.1
-
-Patch:	4420_grsecurity-2.9.1-3.11.1-201309181826.patch
+Patch:	4420_grsecurity-2.9.1-3.11.1-201309221838.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.11.1/1000_linux-3.11.1.patch b/3.11.1/1000_linux-3.11.1.patch
deleted file mode 100644
index 553a9f4..0000000
--- a/3.11.1/1000_linux-3.11.1.patch
+++ /dev/null
@@ -1,401 +0,0 @@
-diff --git a/Documentation/hwmon/k10temp b/Documentation/hwmon/k10temp
-index 90956b6..4dfdc8f 100644
---- a/Documentation/hwmon/k10temp
-+++ b/Documentation/hwmon/k10temp
-@@ -12,6 +12,7 @@ Supported chips:
- * AMD Family 12h processors: "Llano" (E2/A4/A6/A8-Series)
- * AMD Family 14h processors: "Brazos" (C/E/G/Z-Series)
- * AMD Family 15h processors: "Bulldozer" (FX-Series), "Trinity"
-+* AMD Family 16h processors: "Kabini"
- 
-   Prefix: 'k10temp'
-   Addresses scanned: PCI space
-diff --git a/Makefile b/Makefile
-index fe8204b..efd2396 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 11
--SUBLEVEL = 0
-+SUBLEVEL = 1
- EXTRAVERSION =
- NAME = Linux for Workgroups
- 
-diff --git a/arch/x86/include/asm/xor_avx.h b/arch/x86/include/asm/xor_avx.h
-index 7ea79c5..492b298 100644
---- a/arch/x86/include/asm/xor_avx.h
-+++ b/arch/x86/include/asm/xor_avx.h
-@@ -167,12 +167,12 @@ static struct xor_block_template xor_block_avx = {
- 
- #define AVX_XOR_SPEED \
- do { \
--	if (cpu_has_avx) \
-+	if (cpu_has_avx && cpu_has_osxsave) \
- 		xor_speed(&xor_block_avx); \
- } while (0)
- 
- #define AVX_SELECT(FASTEST) \
--	(cpu_has_avx ? &xor_block_avx : FASTEST)
-+	(cpu_has_avx && cpu_has_osxsave ? &xor_block_avx : FASTEST)
- 
- #else
- 
-diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
-index 80403c1..45af90a 100644
---- a/drivers/acpi/ec.c
-+++ b/drivers/acpi/ec.c
-@@ -987,6 +987,10 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
- 	ec_skip_dsdt_scan, "HP Folio 13", {
- 	DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
- 	DMI_MATCH(DMI_PRODUCT_NAME, "HP Folio 13"),}, NULL},
-+	{
-+	ec_validate_ecdt, "ASUS hardware", {
-+	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
-+	DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
- 	{},
- };
- 
-diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
-index 0df7590..461f47b 100644
---- a/drivers/hv/channel_mgmt.c
-+++ b/drivers/hv/channel_mgmt.c
-@@ -262,6 +262,13 @@ static void vmbus_process_offer(struct work_struct *work)
- 	}
- 
- 	/*
-+	 * This state is used to indicate a successful open
-+	 * so that when we do close the channel normally, we
-+	 * can cleanup properly
-+	 */
-+	newchannel->state = CHANNEL_OPEN_STATE;
-+
-+	/*
- 	 * Start the process of binding this offer to the driver
- 	 * We need to set the DeviceObject field before calling
- 	 * vmbus_child_dev_add()
-@@ -287,13 +294,6 @@ static void vmbus_process_offer(struct work_struct *work)
- 		kfree(newchannel->device_obj);
- 
- 		free_channel(newchannel);
--	} else {
--		/*
--		 * This state is used to indicate a successful open
--		 * so that when we do close the channel normally, we
--		 * can cleanup properly
--		 */
--		newchannel->state = CHANNEL_OPEN_STATE;
- 	}
- }
- 
-diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
-index e989f7f..1e27838 100644
---- a/drivers/hwmon/Kconfig
-+++ b/drivers/hwmon/Kconfig
-@@ -296,8 +296,8 @@ config SENSORS_K10TEMP
- 	  If you say yes here you get support for the temperature
- 	  sensor(s) inside your CPU. Supported are later revisions of
- 	  the AMD Family 10h and all revisions of the AMD Family 11h,
--	  12h (Llano), 14h (Brazos) and 15h (Bulldozer/Trinity)
--	  microarchitectures.
-+	  12h (Llano), 14h (Brazos), 15h (Bulldozer/Trinity) and
-+	  16h (Kabini) microarchitectures.
- 
- 	  This driver can also be built as a module.  If so, the module
- 	  will be called k10temp.
-diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
-index e3b037c..e633856 100644
---- a/drivers/hwmon/k10temp.c
-+++ b/drivers/hwmon/k10temp.c
-@@ -1,5 +1,5 @@
- /*
-- * k10temp.c - AMD Family 10h/11h/12h/14h/15h processor hardware monitoring
-+ * k10temp.c - AMD Family 10h/11h/12h/14h/15h/16h processor hardware monitoring
-  *
-  * Copyright (c) 2009 Clemens Ladisch <clemens@ladisch.de>
-  *
-@@ -211,6 +211,7 @@ static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
- 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
- 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
- 	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
-+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
- 	{}
- };
- MODULE_DEVICE_TABLE(pci, k10temp_id_table);
-diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
-index 621c7a3..b83e3ca 100644
---- a/drivers/misc/hpilo.c
-+++ b/drivers/misc/hpilo.c
-@@ -759,7 +759,7 @@ static int ilo_probe(struct pci_dev *pdev,
- 
- 	/* Ignore subsystem_device = 0x1979 (set by BIOS)  */
- 	if (pdev->subsystem_device == 0x1979)
--		goto out;
-+		return 0;
- 
- 	if (max_ccb > MAX_CCB)
- 		max_ccb = MAX_CCB;
-@@ -899,7 +899,7 @@ static void __exit ilo_exit(void)
- 	class_destroy(ilo_class);
- }
- 
--MODULE_VERSION("1.4");
-+MODULE_VERSION("1.4.1");
- MODULE_ALIAS(ILO_NAME);
- MODULE_DESCRIPTION(ILO_NAME);
- MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
-diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
-index b22c7e2..3412adc 100644
---- a/drivers/misc/mei/hw-me.c
-+++ b/drivers/misc/mei/hw-me.c
-@@ -176,21 +176,18 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
- 	struct mei_me_hw *hw = to_me_hw(dev);
- 	u32 hcsr = mei_hcsr_read(hw);
- 
--	dev_dbg(&dev->pdev->dev, "before reset HCSR = 0x%08x.\n", hcsr);
--
--	hcsr |= (H_RST | H_IG);
-+	hcsr |= H_RST | H_IG | H_IS;
- 
- 	if (intr_enable)
- 		hcsr |= H_IE;
- 	else
--		hcsr |= ~H_IE;
-+		hcsr &= ~H_IE;
- 
--	mei_hcsr_set(hw, hcsr);
-+	mei_me_reg_write(hw, H_CSR, hcsr);
- 
- 	if (dev->dev_state == MEI_DEV_POWER_DOWN)
- 		mei_me_hw_reset_release(dev);
- 
--	dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw));
- 	return 0;
- }
- 
-diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
-index 1753431..108267d 100644
---- a/drivers/net/wireless/mwifiex/main.c
-+++ b/drivers/net/wireless/mwifiex/main.c
-@@ -458,20 +458,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
- 		dev_err(adapter->dev, "cannot create default STA interface\n");
- 		goto err_add_intf;
- 	}
--
--	/* Create AP interface by default */
--	if (!mwifiex_add_virtual_intf(adapter->wiphy, "uap%d",
--				      NL80211_IFTYPE_AP, NULL, NULL)) {
--		dev_err(adapter->dev, "cannot create default AP interface\n");
--		goto err_add_intf;
--	}
--
--	/* Create P2P interface by default */
--	if (!mwifiex_add_virtual_intf(adapter->wiphy, "p2p%d",
--				      NL80211_IFTYPE_P2P_CLIENT, NULL, NULL)) {
--		dev_err(adapter->dev, "cannot create default P2P interface\n");
--		goto err_add_intf;
--	}
- 	rtnl_unlock();
- 
- 	mwifiex_drv_get_driver_version(adapter, fmt, sizeof(fmt) - 1);
-diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
-index 9915cb9..9efe118 100644
---- a/drivers/rtc/rtc-max77686.c
-+++ b/drivers/rtc/rtc-max77686.c
-@@ -240,9 +240,9 @@ static int max77686_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
- 	}
- 
- 	alrm->pending = 0;
--	ret = regmap_read(info->max77686->regmap, MAX77686_REG_STATUS1, &val);
-+	ret = regmap_read(info->max77686->regmap, MAX77686_REG_STATUS2, &val);
- 	if (ret < 0) {
--		dev_err(info->dev, "%s:%d fail to read status1 reg(%d)\n",
-+		dev_err(info->dev, "%s:%d fail to read status2 reg(%d)\n",
- 				__func__, __LINE__, ret);
- 		goto out;
- 	}
-diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
-index 9854a1d..6bc205b 100644
---- a/drivers/staging/imx-drm/imx-drm-core.c
-+++ b/drivers/staging/imx-drm/imx-drm-core.c
-@@ -678,6 +678,7 @@ found:
- 
- 	return i;
- }
-+EXPORT_SYMBOL_GPL(imx_drm_encoder_get_mux_id);
- 
- /*
-  * imx_drm_remove_encoder - remove an encoder
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index f73da43..3a17930 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -1086,7 +1086,6 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
- 		if (cmd->reject_reason)
- 			return 0;
- 
--		target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
- 		return 1;
- 	}
- 	/*
-@@ -1124,14 +1123,10 @@ after_immediate_data:
- 		 */
- 		cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
- 					(unsigned char *)hdr, hdr->cmdsn);
--		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
-+		if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
- 			return -1;
--		} else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
--			target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
--			return 0;
--		}
- 
--		if (cmd->sense_reason) {
-+		if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
- 			int rc;
- 
- 			rc = iscsit_dump_data_payload(cmd->conn,
-@@ -1527,6 +1522,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
- 	if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
- 		pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
- 			" not set, protocol error.\n");
-+		if (!cmd)
-+			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
-+						 (unsigned char *)hdr);
-+
- 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
- 					 (unsigned char *)hdr);
- 	}
-@@ -1536,6 +1535,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
- 			" greater than MaxXmitDataSegmentLength: %u, protocol"
- 			" error.\n", payload_length,
- 			conn->conn_ops->MaxXmitDataSegmentLength);
-+		if (!cmd)
-+			return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
-+						 (unsigned char *)hdr);
-+
- 		return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
- 					 (unsigned char *)hdr);
- 	}
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index 3402241..bc788c5 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -1163,12 +1163,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
- 		if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
- 			spin_unlock_bh(&np->np_thread_lock);
- 			complete(&np->np_restart_comp);
--			if (ret == -ENODEV) {
--				iscsit_put_transport(conn->conn_transport);
--				kfree(conn);
--				conn = NULL;
-+			iscsit_put_transport(conn->conn_transport);
-+			kfree(conn);
-+			conn = NULL;
-+			if (ret == -ENODEV)
- 				goto out;
--			}
- 			/* Get another socket */
- 			return 1;
- 		}
-diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
-index 4cb667d..9fabbf7 100644
---- a/drivers/target/target_core_spc.c
-+++ b/drivers/target/target_core_spc.c
-@@ -97,9 +97,12 @@ spc_emulate_inquiry_std(struct se_cmd *cmd, unsigned char *buf)
- 
- 	buf[7] = 0x2; /* CmdQue=1 */
- 
--	snprintf(&buf[8], 8, "LIO-ORG");
--	snprintf(&buf[16], 16, "%s", dev->t10_wwn.model);
--	snprintf(&buf[32], 4, "%s", dev->t10_wwn.revision);
-+	memcpy(&buf[8], "LIO-ORG ", 8);
-+	memset(&buf[16], 0x20, 16);
-+	memcpy(&buf[16], dev->t10_wwn.model,
-+	       min_t(size_t, strlen(dev->t10_wwn.model), 16));
-+	memcpy(&buf[32], dev->t10_wwn.revision,
-+	       min_t(size_t, strlen(dev->t10_wwn.revision), 4));
- 	buf[4] = 31; /* Set additional length to 31 */
- 
- 	return 0;
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 7172d00..d8e49d7 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2134,6 +2134,7 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
- 
- int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
- {
-+	unsigned long flags;
- 	int ret = 0;
- 
- 	if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
-@@ -2144,6 +2145,16 @@ int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
- 	} else {
- 		if (wait_for_tasks)
- 			transport_wait_for_tasks(cmd);
-+		/*
-+		 * Handle WRITE failure case where transport_generic_new_cmd()
-+		 * has already added se_cmd to state_list, but fabric has
-+		 * failed command before I/O submission.
-+		 */
-+		if (cmd->state_active) {
-+			spin_lock_irqsave(&cmd->t_state_lock, flags);
-+			target_remove_from_state_list(cmd);
-+			spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-+		}
- 
- 		if (cmd->se_lun)
- 			transport_lun_remove_cmd(cmd);
-diff --git a/drivers/usb/gadget/f_acm.c b/drivers/usb/gadget/f_acm.c
-index 4b7e33e..ab1065a 100644
---- a/drivers/usb/gadget/f_acm.c
-+++ b/drivers/usb/gadget/f_acm.c
-@@ -285,6 +285,7 @@ static struct usb_string acm_string_defs[] = {
- 	[ACM_CTRL_IDX].s = "CDC Abstract Control Model (ACM)",
- 	[ACM_DATA_IDX].s = "CDC ACM Data",
- 	[ACM_IAD_IDX ].s = "CDC Serial",
-+	{  } /* end of list */
- };
- 
- static struct usb_gadget_strings acm_string_table = {
-diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig
-index aa43854..805b83e 100644
---- a/sound/soc/fsl/Kconfig
-+++ b/sound/soc/fsl/Kconfig
-@@ -109,11 +109,11 @@ config SND_SOC_IMX_SSI
- 	tristate
- 
- config SND_SOC_IMX_PCM_FIQ
--	bool
-+	tristate
- 	select FIQ
- 
- config SND_SOC_IMX_PCM_DMA
--	bool
-+	tristate
- 	select SND_SOC_GENERIC_DMAENGINE_PCM
- 
- config SND_SOC_IMX_AUDMUX
-diff --git a/sound/soc/fsl/imx-pcm.h b/sound/soc/fsl/imx-pcm.h
-index 67f656c..0e3619e 100644
---- a/sound/soc/fsl/imx-pcm.h
-+++ b/sound/soc/fsl/imx-pcm.h
-@@ -32,7 +32,7 @@ imx_pcm_dma_params_init_data(struct imx_dma_data *dma_data,
- 		dma_data->peripheral_type = IMX_DMATYPE_SSI;
- }
- 
--#ifdef CONFIG_SND_SOC_IMX_PCM_DMA
-+#if IS_ENABLED(CONFIG_SND_SOC_IMX_PCM_DMA)
- int imx_pcm_dma_init(struct platform_device *pdev);
- void imx_pcm_dma_exit(struct platform_device *pdev);
- #else
-@@ -46,7 +46,7 @@ static inline void imx_pcm_dma_exit(struct platform_device *pdev)
- }
- #endif
- 
--#ifdef CONFIG_SND_SOC_IMX_PCM_FIQ
-+#if IS_ENABLED(CONFIG_SND_SOC_IMX_PCM_FIQ)
- int imx_pcm_fiq_init(struct platform_device *pdev);
- void imx_pcm_fiq_exit(struct platform_device *pdev);
- #else
diff --git a/3.11.1/4420_grsecurity-2.9.1-3.11.1-201309181826.patch b/3.11.1/4420_grsecurity-2.9.1-3.11.1-201309221838.patch
index 3faa7a9..f7acb39 100644
--- a/3.11.1/4420_grsecurity-2.9.1-3.11.1-201309181826.patch
+++ b/3.11.1/4420_grsecurity-2.9.1-3.11.1-201309221838.patch
@@ -94851,7 +94851,7 @@ index 0c61b59..941bddd 100644
  			);
  
 diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
-index 0c741ce..f63c3f5 100644
+index 0c741ce..f8c8ca7 100644
 --- a/net/netlink/genetlink.c
 +++ b/net/netlink/genetlink.c
 @@ -310,18 +310,20 @@ int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
@@ -94892,27 +94892,6 @@ index 0c741ce..f63c3f5 100644
  			return 0;
  		}
  	}
-@@ -832,6 +834,10 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
- 	struct net *net = sock_net(skb->sk);
- 	int chains_to_skip = cb->args[0];
- 	int fams_to_skip = cb->args[1];
-+	bool need_locking = chains_to_skip || fams_to_skip;
-+
-+	if (need_locking)
-+		genl_lock();
- 
- 	for (i = chains_to_skip; i < GENL_FAM_TAB_SIZE; i++) {
- 		n = 0;
-@@ -853,6 +859,9 @@ errout:
- 	cb->args[0] = i;
- 	cb->args[1] = n;
- 
-+	if (need_locking)
-+		genl_unlock();
-+
- 	return skb->len;
- }
- 
 diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
 index 698814b..7cfde4e 100644
 --- a/net/netrom/af_netrom.c