2.4.24 and exec-shield-2.4.23-G4

PATCH Philip Dodd 1 participant 1 message Jan 5, 2004

Subsystems (10)

Memory management VFS Kbuild MM core +6 more subsystems

lore

Share & tools

lore

Philip Dodd

author

2004-01-05 20:41 UTC #0 lore raw

Hi all,

Just a quick query - I rebuilt the kernel on one of the machines here and I was running the previous 2.4.23 with Ingo's exec-shield patch. I got the same patch (2.4.23-G4) to apply pretty easily (the mmremap hunk applied with an offset, only the makefile failed, patched by hand) and was just wondering if it is reasonable to assume the mmremap patch in 2.4.24 won't impact the exec-shield patch. The patch in question is attached here.

I'm a bit of a neopyhte, but a quick look through the code didn't suggest that it would have any leathal effect. Am I wrong and will my PC catch fire overnight because of this? :-D

Thanks in advance,

Phil

Signature · 2 lines

()  ascii ribbon campaign - against html mail
/\                        - against microsoft attachments

fs/proc/array.c renamed from fs/proc/array.c.orig +6 -1

@@ -202,6 +202,7 @@ static inline char * task_mem(struct mm_
 		}
 	}
 	buffer += sprintf(buffer,
+		"ExecLim:\t%08lx kB\n"
 		"VmSize:\t%8lu kB\n"
 		"VmLck:\t%8lu kB\n"
 		"VmRSS:\t%8lu kB\n"

@@ -209,6 +210,7 @@ static inline char * task_mem(struct mm_
 		"VmStk:\t%8lu kB\n"
 		"VmExe:\t%8lu kB\n"
 		"VmLib:\t%8lu kB\n",
+		mm->context.exec_limit,
 		mm->total_vm << (PAGE_SHIFT-10),
 		mm->locked_vm << (PAGE_SHIFT-10),
 		mm->rss << (PAGE_SHIFT-10),

@@ -333,7 +335,10 @@ int proc_pid_stat(struct task_struct *ta
 		up_read(&mm->mmap_sem);
 	}
 
-	wchan = get_wchan(task);
+	wchan = 0;
+	if (current->uid == task->uid || current->euid == task->uid ||
+							capable(CAP_SYS_NICE))
+		wchan = get_wchan(task);
 
 	collect_sigign_sigcatch(task, &sigign, &sigcatch);

fs/proc/base.c renamed from fs/proc/base.c.orig +1 -1

@@ -613,7 +613,7 @@ static struct pid_entry base_stuff[] = {
 #ifdef CONFIG_SMP
   E(PROC_PID_CPU,	"cpu",		S_IFREG|S_IRUGO),
 #endif
-  E(PROC_PID_MAPS,	"maps",		S_IFREG|S_IRUGO),
+  E(PROC_PID_MAPS,	"maps",		S_IFREG|S_IRUSR),
   E(PROC_PID_MEM,	"mem",		S_IFREG|S_IRUSR|S_IWUSR),
   E(PROC_PID_CWD,	"cwd",		S_IFLNK|S_IRWXUGO),
   E(PROC_PID_ROOT,	"root",		S_IFLNK|S_IRWXUGO),

fs/binfmt_aout.c renamed from fs/binfmt_aout.c.orig +1 -1

@@ -407,7 +407,7 @@ beyond_if:
 
 	set_brk(current->mm->start_brk, current->mm->brk);
 
-	retval = setup_arg_pages(bprm); 
+	retval = setup_arg_pages(bprm, 1); 
 	if (retval < 0) { 
 		/* Someone check-me: is this error path enough? */ 
 		send_sig(SIGKILL, current, 0);

fs/binfmt_elf.c renamed from fs/binfmt_elf.c.orig +105 ~~-36~~

259 lines not on this page · raw message

fs/binfmt_som.c renamed from fs/binfmt_som.c.orig +1 -1

@@ -250,7 +250,7 @@ do_load_som_binary(struct linux_binprm *
 
 	set_binfmt(&som_format);
 	compute_creds(bprm);
-	setup_arg_pages(bprm);
+	setup_arg_pages(bprm, 1);
 
 	create_som_tables(bprm);

fs/exec.c renamed from fs/exec.c.orig +23 -5

@@ -323,14 +323,18 @@ out:
 	return;
 }
 
-int setup_arg_pages(struct linux_binprm *bprm)
+int setup_arg_pages(struct linux_binprm *bprm, int executable_stack)
 {
 	unsigned long stack_base;
 	struct vm_area_struct *mpnt;
 	int i;
 
+#ifdef __HAVE_ARCH_ALIGN_STACK
+	stack_base = arch_align_stack(STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE);
+	stack_base = PAGE_ALIGN(stack_base);
+#else
 	stack_base = STACK_TOP - MAX_ARG_PAGES*PAGE_SIZE;
-
+#endif
 	bprm->p += stack_base;
 	if (bprm->loader)
 		bprm->loader += stack_base;

@@ -345,8 +349,11 @@ int setup_arg_pages(struct linux_binprm 
 		mpnt->vm_mm = current->mm;
 		mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
 		mpnt->vm_end = STACK_TOP;
-		mpnt->vm_flags = VM_STACK_FLAGS;
 		mpnt->vm_page_prot = protection_map[VM_STACK_FLAGS & 0x7];
+		if (executable_stack)
+			mpnt->vm_flags = VM_STACK_FLAGS | VM_MAYEXEC | VM_EXEC;
+		else
+			mpnt->vm_flags = (VM_STACK_FLAGS | VM_MAYEXEC) & ~VM_EXEC;
 		mpnt->vm_ops = NULL;
 		mpnt->vm_pgoff = 0;
 		mpnt->vm_file = NULL;

@@ -606,6 +613,7 @@ int flush_old_exec(struct linux_binprm *
 	}
 	current->comm[i] = '\0';
 
+	current->flags &= ~PF_RELOCEXEC;
 	flush_thread();
 
 	de_thread(current);

@@ -670,8 +678,13 @@ int prepare_binprm(struct linux_binprm *
 
 	if(!(bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)) {
 		/* Set-uid? */
-		if (mode & S_ISUID)
+		if (mode & S_ISUID) {
 			bprm->e_uid = inode->i_uid;
+#ifdef __i386__
+			/* reset personality */
+			current->personality = PER_LINUX;
+#endif
+		}
 
 		/* Set-gid? */
 		/*

@@ -679,8 +692,13 @@ int prepare_binprm(struct linux_binprm *
 		 * is a candidate for mandatory locking, not a setgid
 		 * executable.
 		 */
-		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
+		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 			bprm->e_gid = inode->i_gid;
+#ifdef __i386__
+			/* reset personality */
+			current->personality = PER_LINUX;
+#endif
+		}
 	}
 
 	/* We don't have VFS support for capabilities yet */

kernel/signal.c renamed from kernel/signal.c.orig +26 -0

@@ -843,6 +843,32 @@ EXPORT_SYMBOL(send_sig_info);
 EXPORT_SYMBOL(block_all_signals);
 EXPORT_SYMBOL(unblock_all_signals);
 
+int print_fatal_signals = 0;
+
+void print_fatal_signal(struct pt_regs *regs, int signr)
+{
+	int i;
+	unsigned char insn;
+
+	printk("%s/%d: potentially unexpected fatal signal %d.\n",
+		current->comm, current->pid, signr);
+	printk("code at %08lx: ", regs->eip);
+	for (i = 0; i < 16; i++) {
+		__get_user(insn, (unsigned char *)(regs->eip + i));
+		printk("%02x ", insn);
+	}
+	printk("\n");
+	show_regs(regs);
+}
+
+static int __init setup_print_fatal_signals(char *str)
+{
+	get_option (&str, &print_fatal_signals);
+
+	return 1;
+}
+
+__setup("print-fatal-signals=", setup_print_fatal_signals);
 
 /*
  * System call entry points.

kernel/sysctl.c renamed from kernel/sysctl.c.orig +10 -0

@@ -42,6 +42,7 @@
 
 /* External variables not in a header file. */
 extern int panic_timeout;
+extern int print_fatal_signals;
 extern int C_A_D;
 extern int bdf_prm[], bdflush_min[], bdflush_max[];
 extern int sysctl_overcommit_memory;

@@ -56,6 +57,9 @@ extern int cad_pid;
 extern int laptop_mode;
 extern int block_dump;
 
+int exec_shield = 2;
+int exec_shield_randomize = 1;
+
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
 static int maxolduid = 65535;
 static int minolduid;

@@ -178,6 +182,12 @@ static ctl_table kern_table[] = {
 	 0644, NULL, &proc_doutsstring, &sysctl_string},
 	{KERN_PANIC, "panic", &panic_timeout, sizeof(int),
 	 0644, NULL, &proc_dointvec},
+	{KERN_PANIC, "print_fatal_signals", &print_fatal_signals, sizeof(int),
+	 0644, NULL, &proc_dointvec},
+	{KERN_PANIC, "exec-shield", &exec_shield, sizeof(int),
+	 0644, NULL, &proc_dointvec},
+	{KERN_PANIC, "exec-shield-randomize", &exec_shield_randomize, sizeof(int),
+	 0644, NULL, &proc_dointvec},
 	{KERN_CORE_USES_PID, "core_uses_pid", &core_uses_pid, sizeof(int),
 	 0644, NULL, &proc_dointvec},
 	{KERN_CORE_SETUID, "core_setuid_ok", &core_setuid_ok, sizeof(int),

kernel/fork.c renamed from kernel/fork.c.orig +3 -0

@@ -233,6 +233,9 @@ static struct mm_struct * mm_init(struct
 	atomic_set(&mm->mm_count, 1);
 	init_rwsem(&mm->mmap_sem);
 	mm->page_table_lock = SPIN_LOCK_UNLOCKED;
+#ifdef __HAVE_ARCH_MMAP_TOP
+	mm->mmap_top = mmap_top();
+#endif
 	mm->pgd = pgd_alloc(mm);
 	mm->def_flags = 0;
 	if (mm->pgd)

mm/mmap.c renamed from mm/mmap.c.orig +18 -5

@@ -17,6 +17,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/pgalloc.h>
+#include <asm/desc.h>
 
 /*
  * WARNING: the debugging will use recursive algorithms so never enable this

@@ -329,6 +330,8 @@ static inline void __vma_link_file(struc
 static void __vma_link(struct mm_struct * mm, struct vm_area_struct * vma,  struct vm_area_struct * prev,
 		       rb_node_t ** rb_link, rb_node_t * rb_parent)
 {
+	if (vma->vm_flags & VM_EXEC)
+		arch_add_exec_range(mm, vma->vm_end);
 	__vma_link_list(mm, vma, prev, rb_parent);
 	__vma_link_rb(mm, vma, rb_link, rb_parent);
 	__vma_link_file(vma);

@@ -371,6 +374,11 @@ static int vma_merge(struct mm_struct * 
 			return 1;
 		}
 		spin_unlock(lock);
+		/*
+		 * Just extended 'prev':
+		 */
+		if (prev->vm_flags & VM_EXEC)
+			arch_add_exec_range(mm, prev->vm_end);
 		return 1;
 	}

@@ -422,7 +430,7 @@ unsigned long do_mmap_pgoff(struct file 
 	/* Obtain the address to map to. we verify (or select) it and ensure
 	 * that it represents a valid section of the address space.
 	 */
-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
+	addr = get_unmapped_area(file, addr, len, pgoff, flags, prot & PROT_EXEC);
 	if (addr & ~PAGE_MASK)
 		return addr;

@@ -612,7 +620,7 @@ free_vma:
  * This function "knows" that -ENOMEM has the bits set.
  */
 #ifndef HAVE_ARCH_UNMAPPED_AREA
-static inline unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
+static inline unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags, unsigned long exec)
 {
 	struct vm_area_struct *vma;

@@ -638,10 +646,10 @@ static inline unsigned long arch_get_unm
 	}
 }
 #else
-extern unsigned long arch_get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+extern unsigned long arch_get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 #endif	
 
-unsigned long get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags)
+unsigned long get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags, unsigned long exec)
 {
 	if (flags & MAP_FIXED) {
 		if (addr > TASK_SIZE - len)

@@ -654,7 +662,7 @@ unsigned long get_unmapped_area(struct f
 	if (file && file->f_op && file->f_op->get_unmapped_area)
 		return file->f_op->get_unmapped_area(file, addr, len, pgoff, flags);
 
-	return arch_get_unmapped_area(file, addr, len, pgoff, flags);
+	return arch_get_unmapped_area(file, addr, len, pgoff, flags, exec);
 }
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */

@@ -801,17 +809,21 @@ static struct vm_area_struct * unmap_fix
 			area->vm_ops->close(area);
 		if (area->vm_file)
 			fput(area->vm_file);
+		if (area->vm_flags & VM_EXEC)
+			arch_remove_exec_range(mm, area->vm_end);
 		kmem_cache_free(vm_area_cachep, area);
 		return extra;
 	}
 
 	/* Work out to one of the ends. */
 	if (end == area->vm_end) {
+		unsigned long old_end = area->vm_end;
 		/*
 		 * here area isn't visible to the semaphore-less readers
 		 * so we don't need to update it under the spinlock.
 		 */
 		area->vm_end = addr;
+		arch_remove_exec_range(mm, old_end);
 		lock_vma_mappings(area);
 		spin_lock(&mm->page_table_lock);
 	} else if (addr == area->vm_start) {

@@ -1168,6 +1180,7 @@ void exit_mmap(struct mm_struct * mm)
 	clear_page_tables(mm, FIRST_USER_PGD_NR, USER_PTRS_PER_PGD);
 
 	flush_tlb_mm(mm);
+	arch_flush_exec_range(mm);
 }
 
 /* Insert vm structure into process list sorted by address

mm/mprotect.c renamed from mm/mprotect.c.orig +33 -1

@@ -96,6 +96,7 @@ static inline int mprotect_fixup_all(str
 {
 	struct vm_area_struct * prev = *pprev;
 	struct mm_struct * mm = vma->vm_mm;
+	int oldflags;
 
 	if (prev && prev->vm_end == vma->vm_start && can_vma_merge(prev, newflags) &&
 	    !vma->vm_file && !(vma->vm_flags & VM_SHARED)) {

@@ -103,6 +104,8 @@ static inline int mprotect_fixup_all(str
 		prev->vm_end = vma->vm_end;
 		__vma_unlink(mm, vma, prev);
 		spin_unlock(&mm->page_table_lock);
+		if (vma->vm_flags & VM_EXEC)
+			arch_add_exec_range(current->mm, vma->vm_end);
 
 		kmem_cache_free(vm_area_cachep, vma);
 		mm->map_count--;

@@ -111,8 +114,13 @@ static inline int mprotect_fixup_all(str
 	}
 
 	spin_lock(&mm->page_table_lock);
+	oldflags = vma->vm_flags;
 	vma->vm_flags = newflags;
 	vma->vm_page_prot = prot;
+	if (oldflags & VM_EXEC)
+		arch_remove_exec_range(current->mm, vma->vm_end);
+	if (newflags & VM_EXEC)
+		arch_add_exec_range(current->mm, vma->vm_end);
 	spin_unlock(&mm->page_table_lock);
 
 	*pprev = vma;

@@ -125,15 +133,21 @@ static inline int mprotect_fixup_start(s
 	int newflags, pgprot_t prot)
 {
 	struct vm_area_struct * n, * prev = *pprev;
+	unsigned long prev_end;
 
 	*pprev = vma;
 
 	if (prev && prev->vm_end == vma->vm_start && can_vma_merge(prev, newflags) &&
 	    !vma->vm_file && !(vma->vm_flags & VM_SHARED)) {
 		spin_lock(&vma->vm_mm->page_table_lock);
+		prev_end = prev->vm_end;
 		prev->vm_end = end;
+		if (prev->vm_flags & VM_EXEC)
+			arch_remove_exec_range(current->mm, prev_end);
 		vma->vm_start = end;
 		spin_unlock(&vma->vm_mm->page_table_lock);
+		if (prev->vm_flags & VM_EXEC)
+			arch_add_exec_range(current->mm, prev->vm_end);
 
 		return 0;
 	}

@@ -156,6 +170,8 @@ static inline int mprotect_fixup_start(s
 	__insert_vm_struct(current->mm, n);
 	spin_unlock(&vma->vm_mm->page_table_lock);
 	unlock_vma_mappings(vma);
+	if (vma->vm_flags & VM_EXEC)
+		arch_add_exec_range(current->mm, vma->vm_end);
 
 	return 0;
 }

@@ -185,6 +201,10 @@ static inline int mprotect_fixup_end(str
 	__insert_vm_struct(current->mm, n);
 	spin_unlock(&vma->vm_mm->page_table_lock);
 	unlock_vma_mappings(vma);
+	if (n->vm_flags & VM_EXEC)
+		arch_add_exec_range(current->mm, n->vm_end);
+	if (vma->vm_flags & VM_EXEC)
+		arch_add_exec_range(current->mm, vma->vm_end);
 
 	*pprev = n;

@@ -196,6 +216,8 @@ static inline int mprotect_fixup_middle(
 	int newflags, pgprot_t prot)
 {
 	struct vm_area_struct * left, * right;
+	unsigned long prev_end;
+	int oldflags;
 
 	left = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 	if (!left)

@@ -223,13 +245,21 @@ static inline int mprotect_fixup_middle(
 	vma->vm_page_prot = prot;
 	lock_vma_mappings(vma);
 	spin_lock(&vma->vm_mm->page_table_lock);
+	oldflags = vma->vm_flags;
+	vma->vm_flags = newflags;
 	vma->vm_start = start;
+	prev_end = vma->vm_end;
 	vma->vm_end = end;
-	vma->vm_flags = newflags;
+	if (!(newflags & VM_EXEC))
+		arch_remove_exec_range(current->mm, prev_end);
+	if (newflags & VM_EXEC)
+		arch_add_exec_range(current->mm, end);
 	__insert_vm_struct(current->mm, left);
 	__insert_vm_struct(current->mm, right);
 	spin_unlock(&vma->vm_mm->page_table_lock);
 	unlock_vma_mappings(vma);
+	if (vma->vm_flags & VM_EXEC)
+		arch_add_exec_range(current->mm, vma->vm_end);
 
 	*pprev = right;

@@ -330,6 +360,8 @@ asmlinkage long sys_mprotect(unsigned lo
 
 		kmem_cache_free(vm_area_cachep, next);
 		prev->vm_mm->map_count--;
+		if (prev->vm_flags & VM_EXEC)
+			arch_add_exec_range(current->mm, prev->vm_end);
 	}
 out:
 	up_write(&current->mm->mmap_sem);

mm/mremap.c renamed from mm/mremap.c.orig +1 -1

@@ -333,7 +333,7 @@ unsigned long do_mremap(unsigned long ad
 			if (vma->vm_flags & VM_SHARED)
 				map_flags |= MAP_SHARED;
 
-			new_addr = get_unmapped_area(vma->vm_file, 0, new_len, vma->vm_pgoff, map_flags);
+			new_addr = get_unmapped_area(vma->vm_file, 0, new_len, vma->vm_pgoff, map_flags, vma->vm_flags & VM_EXEC);
 			ret = new_addr;
 			if (new_addr & ~PAGE_MASK)
 				goto out;

include/linux/apm_bios.h renamed from include/linux/apm_bios.h.orig +1 -2

@@ -21,8 +21,7 @@ typedef unsigned short	apm_eventinfo_t;
 
 #ifdef __KERNEL__
 
-#define APM_40		0x40
-#define APM_CS		(APM_40 + 8)
+#define APM_CS		(GDT_ENTRY_APMBIOS_BASE * 8)
 #define APM_CS_16	(APM_CS + 8)
 #define APM_DS		(APM_CS_16 + 8)

include/linux/binfmts.h renamed from include/linux/binfmts.h.orig +1 -1

@@ -52,7 +52,7 @@ extern int prepare_binprm(struct linux_b
 extern void remove_arg_zero(struct linux_binprm *);
 extern int search_binary_handler(struct linux_binprm *,struct pt_regs *);
 extern int flush_old_exec(struct linux_binprm * bprm);
-extern int setup_arg_pages(struct linux_binprm * bprm);
+extern int setup_arg_pages(struct linux_binprm * bprm, int exec_stack);
 extern int copy_strings(int argc,char ** argv,struct linux_binprm *bprm); 
 extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
 extern void compute_creds(struct linux_binprm *binprm);

include/linux/elf.h renamed from include/linux/elf.h.orig +3 -0

@@ -33,6 +33,9 @@ typedef __s64	Elf64_Sxword;
 #define PT_HIPROC  0x7fffffff
 #define PT_MIPS_REGINFO		0x70000000
 
+#define PT_LOOS		0x60000000
+#define PT_GNU_STACK	(PT_LOOS + 0x474e551)
+
 /* Flags in the e_flags field of the header */
 #define EF_MIPS_NOREORDER 0x00000001
 #define EF_MIPS_PIC       0x00000002

include/linux/mm.h renamed from include/linux/mm.h.orig +5 -1

@@ -550,7 +550,7 @@ extern void __insert_vm_struct(struct mm
 extern void build_mmap_rb(struct mm_struct *);
 extern void exit_mmap(struct mm_struct *);
 
-extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long, unsigned long);
 
 extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
 	unsigned long len, unsigned long prot,

@@ -573,12 +573,16 @@ extern int do_munmap(struct mm_struct *,
 
 extern unsigned long do_brk(unsigned long, unsigned long);
 
+
+extern void arch_remove_exec_range(struct mm_struct *mm, unsigned long limit);
+
 static inline void __vma_unlink(struct mm_struct * mm, struct vm_area_struct * vma, struct vm_area_struct * prev)
 {
 	prev->vm_next = vma->vm_next;
 	rb_erase(&vma->vm_rb, &mm->mm_rb);
 	if (mm->mmap_cache == vma)
 		mm->mmap_cache = prev;
+	arch_remove_exec_range(mm, vma->vm_end);
 }
 
 static inline int can_vma_merge(struct vm_area_struct * vma, unsigned long vm_flags)

include/linux/sched.h renamed from include/linux/sched.h.orig +8 -2

@@ -28,6 +28,10 @@ extern unsigned long event;
 #include <linux/fs_struct.h>
 
 struct exec_domain;
+extern int exec_shield;
+extern int exec_shield_randomize;
+extern int print_fatal_signals;
+extern void print_fatal_signal(struct pt_regs *regs, int signr);
 
 /*
  * cloning flags:

@@ -207,6 +211,7 @@ struct mm_struct {
 	struct vm_area_struct * mmap;		/* list of VMAs */
 	rb_root_t mm_rb;
 	struct vm_area_struct * mmap_cache;	/* last find_vma result */
+	unsigned long mmap_top;			/* top of mmap area */
 	pgd_t * pgd;
 	atomic_t mm_users;			/* How many users with user space? */
 	atomic_t mm_count;			/* How many references to "struct mm_struct" (users count as 1) */

@@ -433,6 +438,7 @@ struct task_struct {
 #define PF_NOIO		0x00004000	/* avoid generating further I/O */
 
 #define PF_USEDFPU	0x00100000	/* task used FPU this quantum (SMP) */
+#define PF_RELOCEXEC	0x00400000	/* relocate shared libraries */
 
 /*
  * Ptrace flags

@@ -448,9 +454,9 @@ struct task_struct {
 
 /*
  * Limit the stack by to some sane default: root can always
- * increase this limit if needed..  8MB seems reasonable.
+ * increase this limit if needed..  10MB seems reasonable.
  */
-#define _STK_LIM	(8*1024*1024)
+#define _STK_LIM	(10*1024*1024)
 
 #define DEF_COUNTER	(10*HZ/100)	/* 100 ms time slice */
 #define MAX_COUNTER	(20*HZ/100)

include/asm-i386/desc.h renamed from include/asm-i386/desc.h.orig +58 ~~-56~~

150 lines not on this page · raw message

include/asm-i386/elf.h renamed from include/asm-i386/elf.h.orig +5 -1

@@ -98,7 +98,11 @@ typedef struct user_fxsr_struct elf_fpxr
 #define ELF_PLATFORM  (system_utsname.machine)
 
 #ifdef __KERNEL__
-#define SET_PERSONALITY(ex, ibcs2) set_personality((ibcs2)?PER_SVR4:PER_LINUX)
+/* child inherits the personality of the parent */
+#define SET_PERSONALITY(ex, ibcs2) do { } while (0)
 #endif
 
+#define __HAVE_ARCH_RANDOMIZE_BRK
+extern void randomize_brk(unsigned long old_brk);
+
 #endif

include/asm-i386/mmu.h renamed from include/asm-i386/mmu.h.orig +5 -0

@@ -4,10 +4,15 @@
 /*
  * The i386 doesn't have a mmu context, but
  * we put the segment information here.
+ *
+ * exec_limit is used to track the range PROT_EXEC
+ * mappings span.
  */
 typedef struct { 
 	void *segments;
 	unsigned long cpuvalid;
+	struct desc_struct user_cs;
+	unsigned long exec_limit;
 } mm_context_t;
 
 #endif

include/asm-i386/page.h renamed from include/asm-i386/page.h.orig +10 -2

@@ -131,10 +131,18 @@ static __inline__ int get_order(unsigned
 #define MAXMEM			((unsigned long)(-PAGE_OFFSET-VMALLOC_RESERVE))
 #define __pa(x)			((unsigned long)(x)-PAGE_OFFSET)
 #define __va(x)			((void *)((unsigned long)(x)+PAGE_OFFSET))
-#define virt_to_page(kaddr)	(mem_map + (__pa(kaddr) >> PAGE_SHIFT))
+#define pfn_to_kaddr(pfn)	__va((pfn) << PAGE_SHIFT)
+#ifndef CONFIG_DISCONTIGMEM
+#define pfn_to_page(pfn)	(mem_map + (pfn))
+#define page_to_pfn(page)	((unsigned long)((page) - mem_map))
+#define pfn_valid(pfn)		((pfn) < max_mapnr)
+#endif /* !CONFIG_DISCONTIGMEM */
+#define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
 #define VALID_PAGE(page)	((page - mem_map) < max_mapnr)
 
-#define VM_DATA_DEFAULT_FLAGS	(VM_READ | VM_WRITE | VM_EXEC | \
+#define VM_DATA_DEFAULT_FLAGS	\
+		(VM_READ | VM_WRITE | \
+			((current->flags & PF_RELOCEXEC) ? 0 : VM_EXEC) | \
 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
 #endif /* __KERNEL__ */

include/asm-i386/pgalloc.h renamed from include/asm-i386/pgalloc.h.orig +17 -0

@@ -4,6 +4,7 @@
 #include <linux/config.h>
 #include <asm/processor.h>
 #include <asm/fixmap.h>
+#include <asm/desc.h>
 #include <linux/threads.h>
 
 #define pgd_quicklist (current_cpu_data.pgd_quick)

@@ -235,4 +236,20 @@ static inline void flush_tlb_pgtables(st
 	flush_tlb_mm(mm);
 }
 
+static inline void set_user_cs(struct desc_struct *desc, unsigned long limit)
+{
+	limit = (limit - 1) / PAGE_SIZE;
+	desc->a = limit & 0xffff;
+	desc->b = (limit & 0xf0000) | 0x00c0fb00;
+}
+
+#define load_user_cs_desc(cpu, mm) \
+    	cpu_gdt_table[(cpu)][GDT_ENTRY_DEFAULT_USER_CS] = (mm)->context.user_cs
+
+extern void arch_add_exec_range(struct mm_struct *mm, unsigned long limit);
+extern void arch_remove_exec_range(struct mm_struct *mm, unsigned long limit);
+extern void arch_flush_exec_range(struct mm_struct *mm);
+
+#define HAVE_ARCH_UNMAPPED_AREA 1
+
 #endif /* _I386_PGALLOC_H */

include/asm-i386/pgtable-2level.h renamed from include/asm-i386/pgtable-2level.h.orig +5 -1

@@ -60,6 +60,10 @@ static inline pmd_t * pmd_offset(pgd_t *
 #define pte_same(a, b)		((a).pte_low == (b).pte_low)
 #define pte_page(x)		(mem_map+((unsigned long)(((x).pte_low >> PAGE_SHIFT))))
 #define pte_none(x)		(!(x).pte_low)
-#define __mk_pte(page_nr,pgprot) __pte(((page_nr) << PAGE_SHIFT) | pgprot_val(pgprot))
+#define pte_pfn(x)		((unsigned long)(((x).pte_low >> PAGE_SHIFT)))
+#define pfn_pte(pfn, prot)	__pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+#define pfn_pmd(pfn, prot)	__pmd(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+
+#define __mk_pte(nr,prot)	pfn_pte(nr,prot)
 
 #endif /* _I386_PGTABLE_2LEVEL_H */

include/asm-i386/pgtable-3level.h renamed from include/asm-i386/pgtable-3level.h.orig +11 -2

@@ -89,10 +89,12 @@ static inline int pte_same(pte_t a, pte_
 	return a.pte_low == b.pte_low && a.pte_high == b.pte_high;
 }
 
-#define pte_page(x)	(mem_map+(((x).pte_low >> PAGE_SHIFT) | ((x).pte_high << (32 - PAGE_SHIFT))))
+#define pte_page(x)	pfn_to_page(pte_pfn(x))
 #define pte_none(x)	(!(x).pte_low && !(x).pte_high)
+#define pte_pfn(x)	(((x).pte_low >> PAGE_SHIFT) | ((x).pte_high << (32 - PAGE_SHIFT)))
 
-static inline pte_t __mk_pte(unsigned long page_nr, pgprot_t pgprot)
+#define __mk_pte(nr,prot)	pfn_pte(nr,prot)
+static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
 {
 	pte_t pte;

@@ -101,4 +103,11 @@ static inline pte_t __mk_pte(unsigned lo
 	return pte;
 }
 
+static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
+{
+	return __pmd(((unsigned long long)page_nr << PAGE_SHIFT) | pgprot_val(pgprot));
+}
+
+extern struct kmem_cache_s *pae_pgd_cachep;
+
 #endif /* _I386_PGTABLE_3LEVEL_H */

include/asm-i386/processor.h renamed from include/asm-i386/processor.h.orig +20 -2

@@ -18,6 +18,15 @@
 #include <linux/config.h>
 #include <linux/threads.h>
 
+struct desc_struct {
+	unsigned long a,b;
+};
+
+#define desc_empty(desc) \
+		(!((desc)->a + (desc)->b))
+
+#define desc_equal(desc1, desc2) \
+		(((desc1)->a == (desc2)->a) && ((desc1)->b == (desc2)->b))
 /*
  * Default implementation of macro that returns current
  * instruction pointer ("program counter").

@@ -264,7 +273,15 @@ extern unsigned int mca_pentium_flag;
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE	(TASK_SIZE / 3)
+#define TASK_UNMAPPED_BASE    PAGE_ALIGN(TASK_SIZE/3)
+
+#define SHLIB_BASE            0x00111000
+
+#define __HAVE_ARCH_ALIGN_STACK
+extern unsigned long arch_align_stack(unsigned long sp);
+
+#define __HAVE_ARCH_MMAP_TOP
+extern unsigned long mmap_top(void);
 
 /*
  * Size of io_bitmap in longwords: 32 is ports 0-0x3ff.

@@ -399,7 +416,7 @@ struct thread_struct {
 	0,0,0,0, /* esp,ebp,esi,edi */				\
 	0,0,0,0,0,0, /* es,cs,ss */				\
 	0,0,0,0,0,0, /* ds,fs,gs */				\
-	__LDT(0),0, /* ldt */					\
+	GDT_ENTRY_LDT,0, /* ldt */					\
 	0, INVALID_IO_BITMAP_OFFSET, /* tace, bitmap */		\
 	{~0, } /* ioperm */					\
 }

@@ -413,6 +430,7 @@ struct thread_struct {
 	regs->xcs = __USER_CS;					\
 	regs->eip = new_eip;					\
 	regs->esp = new_esp;					\
+	load_user_cs_desc(smp_processor_id(), current->mm);	\
 } while (0)
 
 /* Forward declaration, a strange C thing */

include/asm-i386/segment.h renamed from include/asm-i386/segment.h.orig +73 -4

83 lines not on this page · raw message

include/asm-i386/system.h renamed from include/asm-i386/system.h.orig +4 -0

@@ -58,6 +58,10 @@ __asm__ __volatile__ ("movw %%dx,%1\n\t"
 	 "0" (limit) \
         ); } while(0)
 
+struct desc_struct;
+
+extern void set_desc_limit(struct desc_struct *desc, unsigned long limit);
+
 #define set_base(ldt,base) _set_base( ((char *)&(ldt)) , (base) )
 #define set_limit(ldt,limit) _set_limit( ((char *)&(ldt)) , ((limit)-1)>>12 )

include/asm-i386/save_state.h renamed from include/asm-i386/save_state.h.orig +3 -3

@@ -112,10 +112,10 @@ static void fix_processor_context(void)
 	struct tss_struct * t = &init_tss[nr];
 
 	set_tss_desc(nr,t);	/* This just modifies memory; should not be neccessary. But... This is neccessary, because 386 hardware has concept of busy tsc or some similar stupidity. */
-        gdt_table[__TSS(nr)].b &= 0xfffffdff;
+	cpu_gdt_table[nr][GDT_ENTRY_TSS].b &= 0xfffffdff;
 
-	load_TR(nr);		/* This does ltr */
-	__load_LDT(nr);		/* This does lldt */
+	load_TR_desc();			/* This does ltr */
+	load_LDT(&init_mm.context);	/* This does lldt */
 
 	/*
 	 * Now maybe reload the debug registers

arch/i386/boot/setup.S renamed from arch/i386/boot/setup.S.orig +7 -2

@@ -1074,9 +1074,14 @@ delay:
 	ret
 
 # Descriptor tables
+#
+# NOTE: if you think the GDT is large, you can make it smaller by just
+# defining the KERNEL_CS and KERNEL_DS entries and shifting the gdt
+# address down by GDT_ENTRY_KERNEL_CS*8. This puts bogus entries into
+# the GDT, but those wont be used so it's not a problem.
+#
 gdt:
-	.word	0, 0, 0, 0			# dummy
-	.word	0, 0, 0, 0			# unused
+	.fill GDT_ENTRY_KERNEL_CS,8,0
 
 	.word	0xFFFF				# 4Gb - (0x100000*0x1000 = 4Gb)
 	.word	0				# base address = 0

arch/i386/mm/fault.c renamed from arch/i386/mm/fault.c.orig +2 -2

@@ -24,6 +24,7 @@
 #include <asm/uaccess.h>
 #include <asm/pgalloc.h>
 #include <asm/hardirq.h>
+#include <asm/desc.h>
 
 extern void die(const char *,struct pt_regs *,long);

@@ -125,7 +126,6 @@ void bust_spinlocks(int yes)
 }
 
 asmlinkage void do_invalid_op(struct pt_regs *, unsigned long);
-extern unsigned long idt;
 
 /*
  * This routine handles page faults.  It determines the address,

@@ -286,7 +286,7 @@ bad_area:
 	if (boot_cpu_data.f00f_bug) {
 		unsigned long nr;
 		
-		nr = (address - idt) >> 3;
+		nr = (address - idt_descr.address) >> 3;
 
 		if (nr == 6) {
 			do_invalid_op(regs, 0);

arch/i386/kernel/apm.c renamed from arch/i386/kernel/apm.c.orig +46 ~~-26~~

134 lines not on this page · raw message

arch/i386/kernel/head.S renamed from arch/i386/kernel/head.S.orig +50 ~~-39~~

125 lines not on this page · raw message

arch/i386/kernel/i386_ksyms.c renamed from arch/i386/kernel/i386_ksyms.c.orig +1 -1

@@ -73,7 +73,7 @@ EXPORT_SYMBOL(pm_idle);
 EXPORT_SYMBOL(pm_power_off);
 EXPORT_SYMBOL(get_cmos_time);
 EXPORT_SYMBOL(apm_info);
-EXPORT_SYMBOL(gdt);
+EXPORT_SYMBOL_GPL(cpu_gdt_table);
 EXPORT_SYMBOL(empty_zero_page);
 
 #ifdef CONFIG_DEBUG_IOVIRT

arch/i386/kernel/process.c renamed from arch/i386/kernel/process.c.orig +271 -4

292 lines not on this page · raw message

arch/i386/kernel/setup.c renamed from arch/i386/kernel/setup.c.orig +34 ~~-11~~

73 lines not on this page · raw message

arch/i386/kernel/signal.c renamed from arch/i386/kernel/signal.c.orig +2 -0

@@ -680,6 +680,8 @@ int do_signal(struct pt_regs *regs, sigs
 			case SIGQUIT: case SIGILL: case SIGTRAP:
 			case SIGABRT: case SIGFPE: case SIGSEGV:
 			case SIGBUS: case SIGSYS: case SIGXCPU: case SIGXFSZ:
+				if (print_fatal_signals)
+					print_fatal_signal(regs, signr);
 				if (do_coredump(signr, regs))
 					exit_code |= 0x80;
 				/* FALLTHRU */

arch/i386/kernel/trampoline.S renamed from arch/i386/kernel/trampoline.S.orig +6 -1

@@ -61,9 +61,14 @@ idt_48:
 	.word	0			# idt limit = 0
 	.word	0, 0			# idt base = 0L
 
+#
+# NOTE: here we actually use CPU#0's GDT - but that is OK, we reload
+# the proper GDT shortly after booting up the secondary CPUs.
+#
+
 gdt_48:
 	.word	0x0800			# gdt limit = 2048, 256 GDT entries
-	.long	gdt_table-__PAGE_OFFSET	# gdt base = gdt (first SMP CPU)
+	.long	cpu_gdt_table-__PAGE_OFFSET	# gdt base = gdt (first SMP CPU)
 
 .globl SYMBOL_NAME(trampoline_end)
 SYMBOL_NAME_LABEL(trampoline_end)

arch/i386/kernel/traps.c renamed from arch/i386/kernel/traps.c.orig +30 ~~-32~~

86 lines not on this page · raw message

Makefile renamed from Makefile.orig +1 -1

@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 23
-EXTRAVERSION =
+EXTRAVERSION = -exec-shield
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)