Grsec/PaX 2.2.2-2.6.39.4-20110807143820110813

2 files changed, 86 insertions, 4 deletions

diff --git a/2.6.39/0000_README b/2.6.39/0000_README
index d29da40..3d8bf57 100644
--- a/2.6.39/0000_README
+++ b/2.6.39/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.2-2.6.39.4-201108071438.patch
+Patch:	4420_grsecurity-2.2.2-2.6.39.4-201108132040.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.39/4420_grsecurity-2.2.2-2.6.39.4-201108071438.patch b/2.6.39/4420_grsecurity-2.2.2-2.6.39.4-201108132040.patch
index 5900fc9..85fe52d 100644
--- a/2.6.39/4420_grsecurity-2.2.2-2.6.39.4-201108071438.patch
+++ b/2.6.39/4420_grsecurity-2.2.2-2.6.39.4-201108132040.patch
@@ -32100,6 +32100,22 @@ diff -urNp linux-2.6.39.4/drivers/staging/hv/hv.c linux-2.6.39.4/drivers/staging
  
  	DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
  		   control, input, output);
+diff -urNp linux-2.6.39.4/drivers/staging/hv/hv_mouse.c linux-2.6.39.4/drivers/staging/hv/hv_mouse.c
+--- linux-2.6.39.4/drivers/staging/hv/hv_mouse.c	2011-05-19 00:06:34.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/hv/hv_mouse.c	2011-08-13 20:26:10.000000000 -0400
+@@ -898,8 +898,10 @@ static void reportdesc_callback(struct h
+ 	if (hid_dev) {
+ 		DPRINT_INFO(INPUTVSC_DRV, "hid_device created");
+ 
+-		hid_dev->ll_driver->open  = mousevsc_hid_open;
+-		hid_dev->ll_driver->close = mousevsc_hid_close;
++		pax_open_kernel();
++		*(void **)&hid_dev->ll_driver->open  = mousevsc_hid_open;
++		*(void **)&hid_dev->ll_driver->close = mousevsc_hid_close;
++		pax_close_kernel();
+ 
+ 		hid_dev->bus = BUS_VIRTUAL;
+ 		hid_dev->vendor = input_device_ctx->device_info.vendor;
 diff -urNp linux-2.6.39.4/drivers/staging/hv/rndis_filter.c linux-2.6.39.4/drivers/staging/hv/rndis_filter.c
 --- linux-2.6.39.4/drivers/staging/hv/rndis_filter.c	2011-05-19 00:06:34.000000000 -0400
 +++ linux-2.6.39.4/drivers/staging/hv/rndis_filter.c	2011-08-05 19:44:37.000000000 -0400
@@ -32164,7 +32180,16 @@ diff -urNp linux-2.6.39.4/drivers/staging/hv/vmbus_private.h linux-2.6.39.4/driv
  	 * Represents channel interrupts. Each bit position represents a
 diff -urNp linux-2.6.39.4/drivers/staging/iio/ring_generic.h linux-2.6.39.4/drivers/staging/iio/ring_generic.h
 --- linux-2.6.39.4/drivers/staging/iio/ring_generic.h	2011-05-19 00:06:34.000000000 -0400
-+++ linux-2.6.39.4/drivers/staging/iio/ring_generic.h	2011-08-05 19:44:37.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/iio/ring_generic.h	2011-08-13 20:14:25.000000000 -0400
+@@ -86,7 +86,7 @@ struct iio_ring_access_funcs {
+ 
+ 	int (*is_enabled)(struct iio_ring_buffer *ring);
+ 	int (*enable)(struct iio_ring_buffer *ring);
+-};
++} __no_const;
+ 
+ /**
+  * struct iio_ring_buffer - general ring buffer structure
 @@ -134,7 +134,7 @@ struct iio_ring_buffer {
  	struct iio_handler		access_handler;
  	struct iio_event_interface	ev_int;
@@ -32289,6 +32314,18 @@ diff -urNp linux-2.6.39.4/drivers/staging/pohmelfs/trans.c linux-2.6.39.4/driver
  
  	cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
  		t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
+diff -urNp linux-2.6.39.4/drivers/staging/rtl8712/rtl871x_io.h linux-2.6.39.4/drivers/staging/rtl8712/rtl871x_io.h
+--- linux-2.6.39.4/drivers/staging/rtl8712/rtl871x_io.h	2011-05-19 00:06:34.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/rtl8712/rtl871x_io.h	2011-08-13 20:31:57.000000000 -0400
+@@ -83,7 +83,7 @@ struct	_io_ops {
+ 			  u8 *pmem);
+ 	u32 (*_write_port)(struct intf_hdl *pintfhdl, u32 addr, u32 cnt,
+ 			   u8 *pmem);
+-};
++} __no_const;
+ 
+ struct io_req {
+ 	struct list_head list;
 diff -urNp linux-2.6.39.4/drivers/staging/tty/istallion.c linux-2.6.39.4/drivers/staging/tty/istallion.c
 --- linux-2.6.39.4/drivers/staging/tty/istallion.c	2011-05-19 00:06:34.000000000 -0400
 +++ linux-2.6.39.4/drivers/staging/tty/istallion.c	2011-08-05 19:44:37.000000000 -0400
@@ -32338,6 +32375,24 @@ diff -urNp linux-2.6.39.4/drivers/staging/tty/stallion.c linux-2.6.39.4/drivers/
  	if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
  		return -EFAULT;
  	portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
+diff -urNp linux-2.6.39.4/drivers/staging/usbip/stub_dev.c linux-2.6.39.4/drivers/staging/usbip/stub_dev.c
+--- linux-2.6.39.4/drivers/staging/usbip/stub_dev.c	2011-05-19 00:06:34.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/usbip/stub_dev.c	2011-08-13 20:32:52.000000000 -0400
+@@ -357,9 +357,11 @@ static struct stub_device *stub_device_a
+ 
+ 	init_waitqueue_head(&sdev->tx_waitq);
+ 
+-	sdev->ud.eh_ops.shutdown = stub_shutdown_connection;
+-	sdev->ud.eh_ops.reset    = stub_device_reset;
+-	sdev->ud.eh_ops.unusable = stub_device_unusable;
++	pax_open_kernel();
++	*(void **)&sdev->ud.eh_ops.shutdown = stub_shutdown_connection;
++	*(void **)&sdev->ud.eh_ops.reset    = stub_device_reset;
++	*(void **)&sdev->ud.eh_ops.unusable = stub_device_unusable;
++	pax_close_kernel();
+ 
+ 	usbip_start_eh(&sdev->ud);
+ 
 diff -urNp linux-2.6.39.4/drivers/staging/usbip/vhci.h linux-2.6.39.4/drivers/staging/usbip/vhci.h
 --- linux-2.6.39.4/drivers/staging/usbip/vhci.h	2011-05-19 00:06:34.000000000 -0400
 +++ linux-2.6.39.4/drivers/staging/usbip/vhci.h	2011-08-05 19:44:37.000000000 -0400
@@ -32352,7 +32407,7 @@ diff -urNp linux-2.6.39.4/drivers/staging/usbip/vhci.h linux-2.6.39.4/drivers/st
  	 * NOTE:
 diff -urNp linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c
 --- linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c	2011-05-19 00:06:34.000000000 -0400
-+++ linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c	2011-08-05 19:44:37.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c	2011-08-13 20:33:49.000000000 -0400
 @@ -536,7 +536,7 @@ static void vhci_tx_urb(struct urb *urb)
  		return;
  	}
@@ -32371,7 +32426,22 @@ diff -urNp linux-2.6.39.4/drivers/staging/usbip/vhci_hcd.c linux-2.6.39.4/driver
  		if (unlink->seqnum == 0xffff)
  			usbip_uinfo("seqnum max\n");
  
-@@ -992,7 +992,7 @@ static int vhci_start(struct usb_hcd *hc
+@@ -965,9 +965,11 @@ static void vhci_device_init(struct vhci
+ 
+ 	init_waitqueue_head(&vdev->waitq_tx);
+ 
+-	vdev->ud.eh_ops.shutdown = vhci_shutdown_connection;
+-	vdev->ud.eh_ops.reset = vhci_device_reset;
+-	vdev->ud.eh_ops.unusable = vhci_device_unusable;
++	pax_open_kernel();
++	*(void **)&vdev->ud.eh_ops.shutdown = vhci_shutdown_connection;
++	*(void **)&vdev->ud.eh_ops.reset = vhci_device_reset;
++	*(void **)&vdev->ud.eh_ops.unusable = vhci_device_unusable;
++	pax_close_kernel();
+ 
+ 	usbip_start_eh(&vdev->ud);
+ }
+@@ -992,7 +994,7 @@ static int vhci_start(struct usb_hcd *hc
  		vdev->rhport = rhport;
  	}
  
@@ -32392,6 +32462,18 @@ diff -urNp linux-2.6.39.4/drivers/staging/usbip/vhci_rx.c linux-2.6.39.4/drivers
  		usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
  		return;
  	}
+diff -urNp linux-2.6.39.4/drivers/staging/wlan-ng/hfa384x_usb.c linux-2.6.39.4/drivers/staging/wlan-ng/hfa384x_usb.c
+--- linux-2.6.39.4/drivers/staging/wlan-ng/hfa384x_usb.c	2011-05-19 00:06:34.000000000 -0400
++++ linux-2.6.39.4/drivers/staging/wlan-ng/hfa384x_usb.c	2011-08-13 20:36:25.000000000 -0400
+@@ -204,7 +204,7 @@ static void unlocked_usbctlx_complete(hf
+ 
+ struct usbctlx_completor {
+ 	int (*complete) (struct usbctlx_completor *);
+-};
++} __no_const;
+ 
+ static int
+ hfa384x_usbctlx_complete_sync(hfa384x_t *hw,
 diff -urNp linux-2.6.39.4/drivers/target/target_core_alua.c linux-2.6.39.4/drivers/target/target_core_alua.c
 --- linux-2.6.39.4/drivers/target/target_core_alua.c	2011-05-19 00:06:34.000000000 -0400
 +++ linux-2.6.39.4/drivers/target/target_core_alua.c	2011-08-05 19:44:37.000000000 -0400