grsec: Apply grsecurity-3.0-3.2.63-201410250023.patch

commit aa0ebeb5f62bea5736cbc2ad48383398ad2edbe8
Author: Cesar Eduardo Barros <cesarb@cesarb.eti.br>
Date:   Mon Nov 25 22:00:41 2013 -0200

    Backport OPTIMIZER_HIDE_VAR from cesarb@cesarb.eti.br

    Conflicts:

    	crypto/memneq.c
    	include/linux/compiler.h

 include/linux/compiler-gcc.h   |    3 +++
 include/linux/compiler-intel.h |    7 +++++++
 include/linux/compiler.h       |    4 ++++
 3 files changed, 14 insertions(+), 0 deletions(-)

commit 33ae23dc594e91d4a7456e5c4921b49391d93f97
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 22:14:37 2014 -0400

    compile fix

 net/ipv4/ipmr.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

commit 52630e6e12591ebb415b3921b285eeabcae752f2
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:53:05 2014 -0400

    compile fix

 fs/xfs/xfs_iget.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

commit 95b3935d5b5e01119d49aba3c2043907d505ac20
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:39:40 2014 -0400

    add missing rcu_read_unlock() to upstream code

 fs/xfs/xfs_iget.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit 2263a7d02fa8569eb4ec15d8f5440be3157e4dc1
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:38:14 2014 -0400

    add missing rcu_read_unlock() to upstream code

 net/ipv4/ipmr.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

commit 4dbd1dfaac8b2935eb0232076dbcdee22bc2c2b0
Author: Hugh Dickins <hughd@google.com>
Date:   Mon Mar 3 15:38:23 2014 -0800

    lib/radix-tree.c: swapoff tmpfs radix_tree: remember to rcu_read_unlock

    Running fsx on tmpfs with concurrent memhog-swapoff-swapon, lots of

      BUG: sleeping function called from invalid context at kernel/fork.c:606
      in_atomic(): 0, irqs_disabled(): 0, pid: 1394, name: swapoff
      1 lock held by swapoff/1394:
       #0:  (rcu_read_lock){.+.+.+}, at: [<ffffffff812520a1>] radix_tree_locate_item+0x1f/0x2b6

    followed by

      ================================================
      [ BUG: lock held when returning to user space! ]
      3.14.0-rc1 #3 Not tainted
      ------------------------------------------------
      swapoff/1394 is leaving the kernel with locks still held!
      1 lock held by swapoff/1394:
       #0:  (rcu_read_lock){.+.+.+}, at: [<ffffffff812520a1>] radix_tree_locate_item+0x1f/0x2b6

    after which the system recovered nicely.

    Whoops, I long ago forgot the rcu_read_unlock() on one unlikely branch.

    Fixes e504f3fdd63d ("tmpfs radix_tree: locate_item to speed up swapoff")

    Signed-off-by: Hugh Dickins <hughd@google.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 lib/radix-tree.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

commit e98b77860805307f14a4a2dd28d0c2be1a6a1fa8
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:04:47 2014 -0400

    add missing rcu_read_unlock() to upstream code

 block/blk-throttle.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit 9b86430ca1bb41a884684c6973dd855d5cb9a9ab
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:02:44 2014 -0400

    add missing rcu_read_unlock() to upstream code

 drivers/acpi/atomicio.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit e5f58ab0435a2de85281a5f0381ae8fc42f4cb53
Author: Brad Spengler <spender@grsecurity.net>
Date:   Fri Oct 24 21:02:07 2014 -0400

    add missing rcu_read_unlock() to upstream code

 drivers/acpi/atomicio.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

commit fc16ca66e9b6650d822767836eb118169400987c
Author: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Date:   Fri Oct 17 22:55:59 2014 +0200

    kvm: fix excessive pages un-pinning in kvm_iommu_map error path.

    The third parameter of kvm_unpin_pages() when called from
    kvm_iommu_map_pages() is wrong, it should be the number of pages to un-pin
    and not the page size.

    This error was facilitated with an inconsistent API: kvm_pin_pages() takes
    a size, but kvn_unpin_pages() takes a number of pages, so fix the problem
    by matching the two.

    This was introduced by commit 350b8bd ("kvm: iommu: fix the third parameter
    of kvm_iommu_put_pages (CVE-2014-3601)"), which fixes the lack of
    un-pinning for pages intended to be un-pinned (i.e. memory leak) but
    unfortunately potentially aggravated the number of pages we un-pin that
    should have stayed pinned. As far as I understand though, the same
    practical mitigations apply.

    This issue was found during review of Red Hat 6.6 patches to prepare
    Ksplice rebootless updates.

    Thanks to Vegard for his time on a late Friday evening to help me in
    understanding this code.

    Fixes: 350b8bd ("kvm: iommu: fix the third parameter of... (CVE-2014-3601)")
    Cc: stable@vger.kernel.org
    Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
    Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
    Signed-off-by: Jamie Iles <jamie.iles@oracle.com>
    Reviewed-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

    Conflicts:

    	virt/kvm/iommu.c

 virt/kvm/iommu.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

commit 27cf85cd00dbaf29559b9a497fefbd49e888b031
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Oct 23 12:58:13 2014 -0700

    sparc64: Fix register corruption in top-most kernel stack frame during boot.

    Meelis Roos reported that kernels built with gcc-4.9 do not boot, we
    eventually narrowed this down to only impacting machines using
    UltraSPARC-III and derivitive cpus.

    The crash happens right when the first user process is spawned:

    [   54.451346] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
    [   54.451346]
    [   54.571516] CPU: 1 PID: 1 Comm: init Not tainted 3.16.0-rc2-00211-gd7933ab #96
    [   54.666431] Call Trace:
    [   54.698453]  [0000000000762f8c] panic+0xb0/0x224
    [   54.759071]  [000000000045cf68] do_exit+0x948/0x960
    [   54.823123]  [000000000042cbc0] fault_in_user_windows+0xe0/0x100
    [   54.902036]  [0000000000404ad0] __handle_user_windows+0x0/0x10
    [   54.978662] Press Stop-A (L1-A) to return to the boot prom
    [   55.050713] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004

    Further investigation showed that compiling only per_cpu_patch() with
    an older compiler fixes the boot.

    Detailed analysis showed that the function is not being miscompiled by
    gcc-4.9, but it is using a different register allocation ordering.

    With the gcc-4.9 compiled function, something during the code patching
    causes some of the %i* input registers to get corrupted.  Perhaps
    we have a TLB miss path into the firmware that is deep enough to
    cause a register window spill and subsequent restore when we get
    back from the TLB miss trap.

    Let's plug this up by doing two things:

    1) Stop using the firmware stack for client interface calls into
       the firmware.  Just use the kernel's stack.

    2) As soon as we can, call into a new function "start_early_boot()"
       to put a one-register-window buffer between the firmware's
       deepest stack frame and the top-most initial kernel one.

    Reported-by: Meelis Roos <mroos@linux.ee>
    Tested-by: Meelis Roos <mroos@linux.ee>
    Signed-off-by: David S. Miller <davem@davemloft.net>

    Conflicts:

    	arch/sparc/include/asm/oplib_64.h
    	arch/sparc/include/asm/setup.h
    	arch/sparc/kernel/entry.h

    Conflicts:

    	arch/sparc/include/asm/setup.h
    	arch/sparc/kernel/entry.h
    	arch/sparc/kernel/setup_64.c

 arch/sparc/include/asm/oplib_64.h |    3 +-
 arch/sparc/include/asm/setup.h    |    4 +++
 arch/sparc/kernel/entry.h         |   11 +++------
 arch/sparc/kernel/head_64.S       |   40 +++---------------------------------
 arch/sparc/kernel/hvtramp.S       |    1 -
 arch/sparc/kernel/setup_64.c      |   28 ++++++++++++++++++-------
 arch/sparc/kernel/trampoline_64.S |   12 ++++++----
 arch/sparc/prom/cif.S             |    5 +--
 arch/sparc/prom/init_64.c         |    6 ++--
 arch/sparc/prom/p1275.c           |    2 -
 10 files changed, 46 insertions(+), 66 deletions(-)

commit ae29f67b96cc0744b9860cf92f14f75c651d123b
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Oct 24 09:59:02 2014 -0700

    sparc64: Implement __get_user_pages_fast().

    It is not sufficient to only implement get_user_pages_fast(), you
    must also implement the atomic version __get_user_pages_fast()
    otherwise you end up using the weak symbol fallback implementation
    which simply returns zero.

    This is dangerous, because it causes the futex code to loop forever
    if transparent hugepages are supported (see get_futex_key()).

    Signed-off-by: David S. Miller <davem@davemloft.net>

 arch/sparc/mm/gup.c |   30 ++++++++++++++++++++++++++++++
 1 files changed, 30 insertions(+), 0 deletions(-)

commit 15bd5778f6b3afd30e34de674ec90f0137e9fefb
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Mon Oct 13 18:59:09 2014 -0600

    clocksource: Remove "weak" from clocksource_default_clock() declaration

    kernel/time/jiffies.c provides a default clocksource_default_clock()
    definition explicitly marked "weak".  arch/s390 provides its own definition
    intended to override the default, but the "weak" attribute on the
    declaration applied to the s390 definition as well, so the linker chose one
    based on link order (see 10629d711ed7 ("PCI: Remove __weak annotation from
    pcibios_get_phb_of_node decl")).

    Remove the "weak" attribute from the clocksource_default_clock()
    declaration so we always prefer a non-weak definition over the weak one,
    independent of link order.

    Fixes: f1b82746c1e9 ("clocksource: Cleanup clocksource selection")
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Acked-by: John Stultz <john.stultz@linaro.org>
    Acked-by: Ingo Molnar <mingo@kernel.org>
    CC: Daniel Lezcano <daniel.lezcano@linaro.org>
    CC: Martin Schwidefsky <schwidefsky@de.ibm.com>

 include/linux/clocksource.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 424b26633455d26d7239285884ea38185f7c0bea
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Mon Oct 13 19:00:25 2014 -0600

    kgdb: Remove "weak" from kgdb_arch_pc() declaration

    kernel/debug/debug_core.c provides a default kgdb_arch_pc() definition
    explicitly marked "weak".  Several architectures provide their own
    definitions intended to override the default, but the "weak" attribute on
    the declaration applied to the arch definitions as well, so the linker
    chose one based on link order (see 10629d711ed7 ("PCI: Remove __weak
    annotation from pcibios_get_phb_of_node decl")).

    Remove the "weak" attribute from the declaration so we always prefer a
    non-weak definition over the weak one, independent of link order.

    Fixes: 688b744d8bc8 ("kgdb: fix signedness mixmatches, add statics, add declaration to header")
    Tested-by: Vineet Gupta <vgupta@synopsys.com>	# for ARC build
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Harvey Harrison <harvey.harrison@gmail.com>

 include/linux/kgdb.h |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit cd6d89dd9f50d38c331519ae5b5727f744679480
Author: Daniel Borkmann <dborkman@redhat.com>
Date:   Tue Aug 26 23:16:35 2014 -0400

    random: add and use memzero_explicit() for clearing data

    zatimend has reported that in his environment (3.16/gcc4.8.3/corei7)
    memset() calls which clear out sensitive data in extract_{buf,entropy,
    entropy_user}() in random driver are being optimized away by gcc.

    Add a helper memzero_explicit() (similarly as explicit_bzero() variants)
    that can be used in such cases where a variable with sensitive data is
    being cleared out in the end. Other use cases might also be in crypto
    code. [ I have put this into lib/string.c though, as it's always built-in
    and doesn't need any dependencies then. ]

    Fixes kernel bugzilla: 82041

    Reported-by: zatimend@hotmail.co.uk
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Signed-off-by: Theodore Ts'o <tytso@mit.edu>
    Cc: stable@vger.kernel.org

    Conflicts:

    	drivers/char/random.c
    	include/linux/string.h

 drivers/char/random.c  |   10 +++++-----
 include/linux/string.h |    6 +++++-
 lib/string.c           |   16 ++++++++++++++++
 3 files changed, 26 insertions(+), 6 deletions(-)

commit 1eca6943de770d5ac058934e455cec897306ea41
Author: Li RongQing <roy.qing.li@gmail.com>
Date:   Wed Oct 22 17:09:53 2014 +0800

    xfrm6: fix a potential use after free in xfrm6_policy.c

    pskb_may_pull() maybe change skb->data and make nh and exthdr pointer
    oboslete, so recompute the nd and exthdr

    Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

 net/ipv6/xfrm6_policy.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

commit 956456e7076fcfd07485e0f2684d0e5a190a3c73
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Oct 22 20:20:21 2014 -0400

    compile fix

 net/ipv4/inet_hashtables.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

commit 120ea2af6c8332faf60d13774ec9c3794d70e425
Author: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
Date:   Thu Jun 28 02:57:49 2012 +0000

    netfilter: nfnetlink: fix missing rcu_read_unlock in nfnetlink_rcv_msg

    Bug added in commit 6b75e3e8d664a9a (netfilter: nfnetlink: add RCU in
    nfnetlink_rcv_msg())

    Signed-off-by: Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

 net/netfilter/nfnetlink.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

commit 056a85cc432d465ef8a51bb69a6b01366466e717
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Oct 22 18:36:16 2014 -0400

    Remove argument from gr_update_task_in_ip_table, as it's always called with 'current'

 grsecurity/grsec_sock.c    |    4 ++--
 net/ipv4/inet_hashtables.c |    2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

commit b27761767932b4052399e4722dc3fb412e2eed24
Author: Brad Spengler <spender@grsecurity.net>
Date:   Wed Oct 22 18:19:01 2014 -0400

    hold sighand lock while accessing ->signal

 fs/proc/array.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

Signature-tree: 20bd38a36b79ae68584dd0e8d4b4102c79d629bc