grsecurity forums

With 2.6.36.2 and grsecurity-2.2.1-2.6.36.2-201012092111.patch I'm getting:

linux-2.6.36/fs/proc/base.c:77:0:
linux-2.6.36/include/linux/cpuset.h: In function 'put_mems_allowed':
linux-2.6.36/include/linux/cpuset.h:121:2: error: decrement of read-only location '*(const volatile int *)&get_current()->mems_allowed_change_disable'

120 smp_mb();
121 --ACCESS_ONCE(current->mems_allowed_change_disable);
122 }
123
124 static inline void set_mems_allowed(nodemask_t nodemask)

Reverting const change for ACCESS_ONCE fixes the problem.

Yep, confirmed this. A quick diff between include/linux/compiler.h and the previous version shows that ACCESS_ONCE was changed to

#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))

from

#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))

Patch grsecurity-2.2.1-2.6.32.27-201012101715 against 2.6.32.27 is not affected, even though the change was made there too.

As far as I can tell, only include/linux/cpuset.h at line 121 is the problem. If we apply the following patch to cpuset.h, then the kernel compiles fine. (No runtime test yet.)

--- cpuset.h.orig 2010-12-12 06:42:20.000000000 -0500
+++ cpuset.h 2010-12-12 06:43:25.000000000 -0500
@@ -107,6 +107,8 @@
smp_mb();
}

+#define ACCESS_ONCE_NON_CONST(x) (*(volatile typeof(x) *)&(x))
+
static inline void put_mems_allowed(void)
{
/*
@@ -118,7 +120,7 @@
* nodemask.
*/
smp_mb();
- --ACCESS_ONCE(current->mems_allowed_change_disable);
+ --ACCESS_ONCE_NON_CONST(current->mems_allowed_change_disable);
}

static inline void set_mems_allowed(nodemask_t nodemask)


Maybe the solution is to add ACCESS_ONCE_NON_CONST to compiler.h and using it in cpuset.h rather than reverting?