# ChangeLog for sys-kernel/xbox-sources
# Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.17 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.18 2004/11/19 23:17:23 plasmaroo Exp $
+
+*xbox-sources-2.4.27-r5 (19 Nov 2004)
+
+ 19 Nov 2004; <plasmaroo@gentoo.org> -xbox-sources-2.4.27-r4.ebuild,
+ +xbox-sources-2.4.27-r5.ebuild, -xbox-sources-2.6.8.1-r3.ebuild,
+ +xbox-sources-2.6.8.1-r4.ebuild, files/xbox-sources-2.4.27.binfmt_elf.patch,
+ +files/xbox-sources-2.4.27.smbfs.patch,
+ files/xbox-sources-2.6.8.1.binfmt_elf.patch,
+ +files/xbox-sources-2.6.8.1.smbfs.patch:
+ Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs
+ security patch (bug #65877).
*xbox-sources-2.4.27-r4 (12 Nov 2004)
-MD5 2f20c9cec504081b0b428f8b303ff918 ChangeLog 4838
-MD5 a8677416a55c663479cee926788b39ca xbox-sources-2.6.8.1-r3.ebuild 995
+MD5 926e4b40ace131037b5fb6723611a468 ChangeLog 5330
MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351
-MD5 c587a3a00425c8fa590841fdfc13a846 xbox-sources-2.4.27-r4.ebuild 985
+MD5 c49f123b75ad53f6b50ebf38489c05f2 xbox-sources-2.4.27-r5.ebuild 1015
+MD5 90f4d74240992ee1dd8410bf8a326f02 xbox-sources-2.6.8.1-r4.ebuild 1025
MD5 d1ccc2047be533c992f67270a150a210 files/xbox-sources-2.4.27.cmdlineLeak.patch 388
-MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r4 302
-MD5 1ee8ba8362089c31fdd7d88b32eaf63e files/xbox-sources-2.6.8.1.binfmt_elf.patch 1938
+MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348
MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572
-MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r3 227
-MD5 24c53f49954dab29cfc172d4a3ba1a31 files/xbox-sources-2.4.27.binfmt_elf.patch 1928
+MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r5 302
+MD5 915e8d7a0618736caa44d96968015467 files/xbox-sources-2.4.27.binfmt_elf.patch 2346
MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281
+MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309
+MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/xbox-sources-2.4.27.smbfs.patch 3434
MD5 d4a740ae56c2049247083af387a22a85 files/xbox-sources-2.4.26.CAN-2004-0394.patch 350
MD5 2b3ddb8b8b15f8da35ade38544b57857 files/xbox-sources-2.4.27.XDRWrapFix.patch 1499
+MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r4 227
---- linux-2.4.27/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
+--- linux-2.4.27/fs/binfmt_elf.c 2004-04-14 14:05:40.000000000 +0100
++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c 2004-11-19 21:30:26.745410824 +0000
+@@ -299,9 +299,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -475,8 +478,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -513,7 +519,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -523,8 +530,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
+ if (retval != elf_ppnt->p_filesz) {
+ if (retval >= 0)
+ retval = -EIO;
- goto out_free_interp;
++ goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -543,8 +558,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -682,8 +700,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c 2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+ data_len = WVAL(buf, 1);
+
+ /* we can NOT simply trust the data_len given by the server ... */
+- if (data_len > server->packet_size - (buf+3 - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf+3, server->packet);
++ if (data_len > count ||
++ (buf+3 - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf+3, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+@@ -1378,10 +1380,12 @@
+ buf = smb_base(server->packet) + data_off;
+
+ /* we can NOT simply trust the info given by the server ... */
+- if (data_len > server->packet_size - (buf - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf, server->packet);
++ if (data_len > count ||
++ (buf - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c 2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+ parm_disp, parm_offset, parm_count,
+ data_disp, data_offset, data_count);
+ *parm = base + parm_offset;
++ if (*parm - inbuf + parm_tot > server->packet_size)
++ goto out_bad_parm;
+ *data = base + data_offset;
++ if (*data - inbuf + data_tot > server->packet_size)
++ goto out_bad_data;
+ goto success;
+ }
+
+@@ -591,6 +595,8 @@
+ rcv_buf = smb_vmalloc(buf_len);
+ if (!rcv_buf)
+ goto out_no_mem;
++ memset(rcv_buf, 0, buf_len);
++
+ *parm = rcv_buf;
+ *data = rcv_buf + total_p;
+ } else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+
+ if (parm_disp + parm_count > total_p)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > server->packet_size)
++ goto out_bad_parm;
+ if (data_disp + data_count > total_d)
+ goto out_bad_data;
++ if (data_offset + data_count > server->packet_size)
++ goto out_bad_data;
+ memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+ memcpy(*data + data_disp, base + data_offset, data_count);
+
+@@ -610,8 +620,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (data_len >= data_tot && parm_len >= parm_tot)
++ if (data_len >= data_tot && parm_len >= parm_tot) {
++ data_len = data_tot;
++ parm_len = parm_tot;
+ break;
++ }
+ }
+
+ /*
+@@ -625,6 +638,9 @@
+ server->packet = rcv_buf;
+ rcv_buf = inbuf;
+ } else {
++ if (parm_len + data_len > buf_len)
++ goto out_data_grew;
++
+ PARANOIA("copying data, old size=%d, new size=%u\n",
+ server->packet_size, buf_len);
+ memcpy(inbuf, rcv_buf, parm_len + data_len);
---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.8.1/fs/binfmt_elf.c 2004-08-14 11:55:23.000000000 +0100
++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c 2004-11-19 23:07:08.375429000 +0000
+@@ -334,9 +334,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -523,8 +526,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -561,7 +567,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -571,8 +578,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -607,8 +622,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -765,8 +783,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c 2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c 2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+ * So we must first calculate the amount of padding used by the server.
+ */
+ data_off -= hdrlen;
+- if (data_off > SMB_READX_MAX_PAD) {
+- PARANOIA("offset is larger than max pad!\n");
+- PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++ if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++ PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++ PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+ req->rq_rlen = req->rq_bufsize + 1;
+ return;
+ }
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c 2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+ data_count = WVAL(inbuf, smb_drcnt);
+
+ /* Modify offset for the split header/buffer we use */
++ if (data_offset < hdrlen)
++ goto out_bad_data;
++ if (parm_offset < hdrlen)
++ goto out_bad_parm;
+ data_offset -= hdrlen;
+ parm_offset -= hdrlen;
+
+@@ -607,6 +611,10 @@
+ req->rq_lparm = parm_count;
+ req->rq_data = req->rq_buffer + data_offset;
+ req->rq_parm = req->rq_buffer + parm_offset;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+ return 0;
+ }
+
+@@ -634,6 +642,7 @@
+ req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
+ if (!req->rq_trans2buffer)
+ goto out_no_mem;
++ memset(req->rq_trans2buffer, 0, buf_len);
+
+ req->rq_parm = req->rq_trans2buffer;
+ req->rq_data = req->rq_trans2buffer + parm_tot;
+@@ -643,8 +652,12 @@
+
+ if (parm_disp + parm_count > req->rq_total_parm)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
+ if (data_disp + data_count > req->rq_total_data)
+ goto out_bad_data;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+
+ inbuf = req->rq_buffer;
+ memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -657,8 +670,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
++ if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
++ req->rq_ldata = data_tot;
++ req->rq_lparm = parm_tot;
+ return 0;
++ }
+ return 1;
+
+ out_too_long:
+@@ -676,13 +692,13 @@
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_parm:
+- printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+- parm_disp, parm_count, parm_tot);
++ printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ parm_disp, parm_count, parm_tot, parm_offset);
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_data:
+- printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+- data_disp, data_count, data_tot);
++ printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ data_disp, data_count, data_tot, data_offset);
+ req->rq_errno = -EIO;
+ out:
+ return req->rq_errno;
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r4.ebuild,v 1.1 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
ETYPE="sources"
inherit kernel-2
detect_version
-XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r4/r0}.patch.bz2"
+XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r5/r0}.patch.bz2"
SRC_URI="${KERNEL_URI}
mirror://gentoo/${XBOX_PATCH}
${FILESDIR}/${P}.cmdlineLeak.patch
${FILESDIR}/${P}.XDRWrapFix.patch
${FILESDIR}/${P}.binfmt_elf.patch
+ ${FILESDIR}/${P}.smbfs.patch
${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch"
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r3.ebuild,v 1.1 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
ETYPE='sources'
inherit kernel-2
${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch
${FILESDIR}/${PN}-2.6.7.cmdlineLeak.patch
${FILESDIR}/${P}.devPtmx.patch
+ ${FILESDIR}/${P}.smbfs.patch
${FILESDIR}/${P}.binfmt_elf.patch"
DESCRIPTION='Full sources for the Xbox Linux kernel'
SRC_URI="${KERNEL_URI}
projects / gentoo.git / commitdiff