grsec: Apply grsecurity-3.0-3.17.2-201411062034.patch

commit e9ca0c1885fd4077482a6869a746c74b3c3dde79
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Nov 6 19:33:59 2014 -0500

    add additional unnecessary checks

 kernel/trace/trace_syscalls.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

commit 4d5a3d072f116deb24ef73c8c1f84aa820c6dd87
Author: Brad Spengler <spender@grsecurity.net>
Date:   Thu Nov 6 19:30:26 2014 -0500

    add extra unnecessary checks

 kernel/trace/trace_syscalls.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

commit 486b25fe596744403ac9d8d470af63788cb09f99
Author: Rabin Vincent <rabin@rab.in>
Date:   Wed Oct 29 23:06:58 2014 +0100

    tracing/syscalls: Ignore numbers outside NR_syscalls' range

    ARM has some private syscalls (for example, set_tls(2)) which lie
    outside the range of NR_syscalls.  If any of these are called while
    syscall tracing is being performed, out-of-bounds array access will
    occur in the ftrace and perf sys_{enter,exit} handlers.

     # trace-cmd record -e raw_syscalls:* true && trace-cmd report
     ...
     true-653   [000]   384.675777: sys_enter:            NR 192 (0, 1000, 3, 4000022, ffffffff, 0)
     true-653   [000]   384.675812: sys_exit:             NR 192 = 1995915264
     true-653   [000]   384.675971: sys_enter:            NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1)
     true-653   [000]   384.675988: sys_exit:             NR 983045 = 0
     ...

     # trace-cmd record -e syscalls:* true
     [   17.289329] Unable to handle kernel paging request at virtual address aaaaaace
     [   17.289590] pgd = 9e71c000
     [   17.289696] [aaaaaace] *pgd=00000000
     [   17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
     [   17.290169] Modules linked in:
     [   17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21
     [   17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000
     [   17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8
     [   17.290866] LR is at syscall_trace_enter+0x124/0x184

    Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.

    Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
    added the check for less than zero, but it should have also checked
    for greater than NR_syscalls.

    Link: http://lkml.kernel.org/p/1414620418-29472-1-git-send-email-rabin@rab.in

    Fixes: cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
    Cc: stable@vger.kernel.org # 2.6.33+
    Signed-off-by: Rabin Vincent <rabin@rab.in>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

 kernel/trace/trace_syscalls.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

commit 4db899af94da174c50db8154fc2f4bb7de6b8778
Author: Ilya Dryomov <idryomov@redhat.com>
Date:   Fri Oct 10 16:39:05 2014 +0400

    libceph: ceph-msgr workqueue needs a resque worker

    commit f9865f06f7f18c6661c88d0511f05c48612319cc upstream.

    Commit f363e45fd118 ("net/ceph: make ceph_msgr_wq non-reentrant")
    effectively removed WQ_MEM_RECLAIM flag from ceph_msgr_wq.  This is
    wrong - libceph is very much a memory reclaim path, so restore it.

    Cc: stable@vger.kernel.org # needs backporting for < 3.12
    Signed-off-by: Ilya Dryomov <idryomov@redhat.com>
    Tested-by: Micha Krause <micha@krausam.de>
    Reviewed-by: Sage Weil <sage@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

 net/ceph/messenger.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

commit 4492a75f30935e0d39bab589145a7ce988162694
Author: Nadav Amit <namit@cs.technion.ac.il>
Date:   Tue Oct 28 00:03:43 2014 +0200

    KVM: x86: Fix far-jump to non-canonical check

    Commit d1442d85cc30 ("KVM: x86: Handle errors when RIP is set during far
    jumps") introduced a bug that caused the fix to be incomplete.  Due to
    incorrect evaluation, far jump to segment with L bit cleared (i.e., 32-bit
    segment) and RIP with any of the high bits set (i.e, RIP[63:32] != 0) set may
    not trigger #GP.  As we know, this imposes a security problem.

    In addition, the condition for two warnings was incorrect.

    Fixes: d1442d85cc30ea75f7d399474ca738e0bc96f715
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
    [Add #ifdef CONFIG_X86_64 to avoid complaints of undefined behavior. - Paolo]
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

 arch/x86/kvm/emulate.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

Signature-tree: fbfc6549053cf6c3c764c58aa89541f1e9111327