Fix for the kNFSd security vulnerability, bug #62524 and the CAN-2004-0814 vulnerabil...
authorTim Yamin <plasmaroo@gentoo.org>
Sat, 6 Nov 2004 21:36:45 +0000 (21:36 +0000)
committerTim Yamin <plasmaroo@gentoo.org>
Sat, 6 Nov 2004 21:36:45 +0000 (21:36 +0000)
sys-kernel/alpha-sources/ChangeLog
sys-kernel/alpha-sources/Manifest
sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild [moved from sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild with 90% similarity]
sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch [deleted file]
sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch [new file with mode: 0644]
sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13 [moved from sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12 with 72% similarity]

index 58bd6002c5dc19bb8d519c76667e7e5ef16bb52b..a4c249e76ca7122d20cd66e6b527be5618b87eff 100644 (file)
@@ -1,6 +1,13 @@
 # ChangeLog for sys-kernel/alpha-sources
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.34 2004/08/09 22:56:41 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.35 2004/11/06 21:36:45 plasmaroo Exp $
+
+*alpha-sources-2.4.21-r13 (06 Nov 2004)
+
+  06 Nov 2004; <plasmaroo@gentoo.org> -alpha-sources-2.4.21-r12.ebuild,
+  +alpha-sources-2.4.21-r13.ebuild, +files/alpha-sources.XDRWrapFix.patch:
+  Fix for the kNFSd security vulnerability, bug #62524 and the CAN-2004-0814
+  vulnerability, bug #68421.
 
 *alpha-sources-2.4.21-r12 (09 Aug 2004)
 
index 1d3807a2799bc4d7e9758366aecdd4e2984bd8e1..576c77177c9e43b4c3d5277f55ef506321593994 100644 (file)
@@ -1,6 +1,6 @@
-MD5 9f9fe5a3022b34e41aae18535b87aa22 ChangeLog 6059
-MD5 db10c1c7534752a247be1523be268ee2 alpha-sources-2.4.21-r12.ebuild 4175
-MD5 323e19d6d35ebd2e9300669e0a7bad6b files/digest-alpha-sources-2.4.21-r12 220
+MD5 f14a1dfd35689011c91fa6f936139947 ChangeLog 6354
+MD5 17504aeaa8c0fca573e78ce8067f3cb8 alpha-sources-2.4.21-r13.ebuild 4442
+MD5 2b3ddb8b8b15f8da35ade38544b57857 files/alpha-sources.XDRWrapFix.patch 1499
 MD5 5bf9836a632a861728d33f9736bb7431 files/alpha-sources.CAN-2004-0133.patch 427
 MD5 d1ccc2047be533c992f67270a150a210 files/alpha-sources.cmdlineLeak.patch 388
 MD5 c460ea130cb4ae84a5063ba044e3ce72 files/alpha-sources.CAN-2004-0427.patch 460
@@ -8,7 +8,6 @@ MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/alpha-sources.CAN-2004-0075.patch 634
 MD5 d4a740ae56c2049247083af387a22a85 files/alpha-sources.CAN-2004-0394.patch 350
 MD5 147fec50180ad91b6260fc7201dcb90f files/alpha-sources.CAN-2004-0010.patch 6050
 MD5 dc18e982f8149588a291956481885a8c files/alpha-sources.CAN-2004-0495.patch 17549
-MD5 df40eece807d039cba79f477e80ebda2 files/alpha-sources-2.4.19.rtc_fix.patch 4974
 MD5 a61e57d5483a06f20da339d91f98fbb8 files/alpha-sources.rtc_fix.patch 6769
 MD5 174438d215b70cad5ffb00ca8123c062 files/alpha-sources.munmap.patch 837
 MD5 60d25ff310fc6abfdce39ec9e47345af files/alpha-sources.CAN-2004-0685.patch 2809
@@ -16,6 +15,7 @@ MD5 3bdf00d5f80fe9dfbfe8220e076cd04c files/alpha-sources.CAN-2004-0497.patch 707
 MD5 e77a93fdf26f06cf3ea5080b27211725 files/alpha-sources.CAN-2003-0985.patch 414
 MD5 de75cfa969ed092578d9ddda6c5be334 files/alpha-sources.CAN-2004-0181.patch 1233
 MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/alpha-sources.CAN-2004-0177.patch 384
+MD5 0f33eb1251b93d3709667faf90edad04 files/digest-alpha-sources-2.4.21-r13 304
 MD5 21f3a4f186017d925067335e24db36a1 files/alpha-sources.CAN-2004-0109.patch 1877
 MD5 ac42024b6e6ee1e2165914db4b22a61c files/alpha-sources.CAN-2004-0178.patch 424
 MD5 082e410301c2522521b0d3843db19c9e files/alpha-sources.CAN-2004-0535.patch 502
similarity index 90%
rename from sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild
rename to sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild
index acbaac22cc479c1cca4a34d7fd9803bbe9853d2b..708335bd9446a97c839c6c5b47f7e13fd5aa9e8b 100644 (file)
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r12.ebuild,v 1.1 2004/08/09 22:56:41 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r13.ebuild,v 1.1 2004/11/06 21:36:45 plasmaroo Exp $
 
 # OKV=original kernel version, KV=patched kernel version.  They can be the same.
 
@@ -16,15 +16,16 @@ S=${WORKDIR}/linux-${KV}
 
 DESCRIPTION="Full sources for the Gentoo Linux Alpha kernel"
 SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2
-       mirror://gentoo/patches-${KV/12/3}.tar.bz2
-       http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch"
+       mirror://gentoo/patches-${KV/13/3}.tar.bz2
+       http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch
+       http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
 SLOT="${KV}"
 KEYWORDS="alpha -sparc -x86 -ppc -hppa -mips"
 
 src_unpack() {
        unpack ${A}
        mv linux-${OKV} linux-${KV} || die
-       cd ${WORKDIR}/${KV/12/1}
+       cd ${WORKDIR}/${KV/13/1}
 
        # This is the crypt USE flag, keeps {USAGI/superfreeswan/patch-int/loop-jari}
        if ! use crypt; then
@@ -74,9 +75,11 @@ src_unpack() {
        epatch ${FILESDIR}/${PN}.CAN-2004-0497.patch || die "Failed to add the CAN-2004-0497 patch!"
        epatch ${FILESDIR}/${PN}.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!"
        epatch ${FILESDIR}/${PN}.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!"
+       epatch ${DISTDIR}/${P}-CAN-2004-0814.patch || die "Failed to add the CAN-2004-0814 patch!"
        epatch ${FILESDIR}/${PN}.rtc_fix.patch || die "Failed to patch RTC vulnerabilities!"
        epatch ${FILESDIR}/${PN}.munmap.patch || die "Failed to apply munmap patch!"
        epatch ${FILESDIR}/${PN}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
+       epatch ${FILESDIR}/${PN}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR fix!"
 
        # Fix multi-line literal in include/asm-alpha/xor.h -- see bug 38354
        # If this script "dies" then that means it's no longer applicable.
diff --git a/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch b/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch
deleted file mode 100644 (file)
index 00937f8..0000000
+++ /dev/null
@@ -1,115 +0,0 @@
-diff -ur linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c
---- linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c   2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c 2004-01-05 23:41:44.000000000 +0000
-@@ -315,6 +315,7 @@
-               {
-                       struct rtc_time rtc_tm;
-                                               
-+                      memset(&rtc_tm, 0, sizeof (struct rtc_time));
-                       get_rtc_time(&rtc_tm);                                          
-                       if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-                               return -EFAULT; 
-diff -ur linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c
---- linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c     2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c   2004-01-05 23:43:15.000000000 +0000
-@@ -54,6 +54,7 @@
-               /* Ensure clock and real-time-mode-register are accessible */
-               msr = rtc->msr & 0xc0;
-               rtc->msr = 0x40;
-+              memset(&wtime, 0, sizeof (struct rtc_time));
-               do {
-                       wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
-                       wtime.tm_min =  BCD2BIN(rtc->bcd_min);
-diff -ur linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c
---- linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c      2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c    2004-01-05 23:44:02.000000000 +0000
-@@ -52,6 +52,7 @@
-               cli();
-               /* Ensure clock and real-time-mode-register are accessible */
-               rtc->ctrl = RTC_READ;
-+              memset(&wtime, 0, sizeof (struct rtc_time));
-               wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
-               wtime.tm_min =  BCD2BIN(rtc->bcd_min);
-               wtime.tm_hour = BCD2BIN(rtc->bcd_hr);
-diff -ur linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c
---- linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c      2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c    2004-01-05 23:44:34.000000000 +0000
-@@ -96,6 +96,7 @@
-       switch (cmd) {
-       case RTC_RD_TIME:       /* Read the time/date from RTC  */
-       {
-+              memset(&wtime, 0, sizeof(struct rtc_time));
-               ppc_md.get_rtc_time(&wtime);
-               break;
-       }
-diff -ur linux-2.4.20-wolk4.9s/drivers/char/efirtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c
---- linux-2.4.20-wolk4.9s/drivers/char/efirtc.c        2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c      2004-01-05 23:47:53.000000000 +0000
-@@ -118,6 +118,7 @@
- static void
- convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
- {
-+      memset(wtime, 0, sizeof(struct rtc_time));
-       wtime->tm_sec  = eft->second;
-       wtime->tm_min  = eft->minute;
-       wtime->tm_hour = eft->hour;
-diff -ur linux-2.4.20-wolk4.9s/drivers/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/char/rtc.c   2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c 2004-01-05 23:52:43.000000000 +0000
-@@ -370,6 +370,7 @@
-                * tm_min, and tm_sec values are filled in.
-                */
- 
-+              memset(&wtime, 0, sizeof(struct rtc_time));
-               get_rtc_alm_time(&wtime);
-               break; 
-       }
-@@ -417,6 +418,7 @@
-       }
-       case RTC_RD_TIME:       /* Read the time/date from RTC  */
-       {
-+              memset(&wtime, 0, sizeof(struct rtc_time));
-               get_rtc_time(&wtime);
-               break;
-       }
-diff -ur linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c      2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c    2004-01-05 23:54:15.000000000 +0000
-@@ -64,6 +64,7 @@
-       case RTC_RD_TIME:
-               if (ppc_md.get_rtc_time)
-               {
-+                      memset(&rtc_tm, 0, sizeof(struct rtc_time));
-                       get_rtc_time(&rtc_tm);
- 
-                       if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -ur linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c      2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c    2004-01-05 23:54:43.000000000 +0000
-@@ -89,6 +89,7 @@
-       switch (cmd)
-       {
-       case RTCGET:
-+              memset(&rtc_tm, 0, sizeof(struct rtc_time));
-               get_rtc_time(&rtc_tm);
- 
-               if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -ur linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c
---- linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c    2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c  2004-01-05 23:47:25.000000000 +0000
-@@ -174,6 +174,7 @@
-                * tm_min, and tm_sec values are filled in.
-                */
- 
-+              memset(&wtime, 0, sizeof(struct rtc_time));
-               ds1286_get_alm_time(&wtime);
-               break;
-       }
-@@ -216,6 +217,7 @@
-       }
-       case RTC_RD_TIME:       /* Read the time/date from RTC  */
-       {
-+              memset(&wtime, 0, sizeof(struct rtc_time));
-               ds1286_get_time(&wtime);
-               break;
-       }
diff --git a/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch b/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch
new file mode 100644 (file)
index 0000000..9a336ab
--- /dev/null
@@ -0,0 +1,48 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au 
+#   [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
+#   
+#   xdr_argsize_check needs to cope with the possibility that the
+#   pointer has wrapped and could be below buf->base.
+#   
+#   Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
+#   
+#   ### Diffstat output
+#    ./fs/nfsd/nfs3xdr.c         |    2 +-
+#    ./include/linux/nfsd/xdr3.h |    2 +-
+#    2 files changed, 2 insertions(+), 2 deletions(-)
+# 
+# fs/nfsd/nfs3xdr.c
+#   2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+# include/linux/nfsd/xdr3.h
+#   2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+--- a/fs/nfsd/nfs3xdr.c        2004-09-06 11:20:28 -07:00
++++ b/fs/nfsd/nfs3xdr.c        2004-09-06 11:20:28 -07:00
+@@ -273,7 +273,7 @@
+ {
+       struct svc_buf  *buf = &rqstp->rq_argbuf;
+ 
+-      return p - buf->base <= buf->buflen;
++      return p >= buf->base && p <= buf->base + buf->buflen ;
+ }
+ 
+ static inline int
+diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
+--- a/include/linux/nfsd/xdr3.h        2004-09-06 11:20:28 -07:00
++++ b/include/linux/nfsd/xdr3.h        2004-09-06 11:20:28 -07:00
+@@ -41,7 +41,7 @@
+       __u32                   count;
+       int                     stable;
+       __u8 *                  data;
+-      int                     len;
++      __u32                   len;
+ };
+ 
+ struct nfsd3_createargs {
similarity index 72%
rename from sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12
rename to sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13
index 363cacc1766bef5afea57fabae5a183fed945e67..73826cbb1001bc73fa35f710debcc8056ddafdb3 100644 (file)
@@ -1,3 +1,4 @@
 MD5 f51e12efa18bb828cf57d9d4a81b2fb1 linux-2.4.21.tar.bz2 28533733
 MD5 28094d6a3d68f228bda98af459ad1310 patches-2.4.21-alpha-r3.tar.bz2 1696825
 MD5 b48375b2731b9a99bb3697e90f170ff2 linux-2.4.21-CAN-2004-0415.patch 84284
+MD5 791ba31912926858cdf02413d87fbd6b alpha-sources-2.4.21-CAN-2004-0814.patch 81981