+++ /dev/null
-# ChangeLog for sys-kernel/aa-sources
-# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/ChangeLog,v 1.53 2004/11/06 20:54:20 plasmaroo Exp $
-
-*aa-sources-2.4.23-r3 (06 Nov 2004)
-
- 06 Nov 2004; <plasmaroo@gentoo.org> -aa-sources-2.4.23-r2.ebuild,
- +aa-sources-2.4.23-r3.ebuild, aa-sources-2.6.5-r5.ebuild,
- -files/aa-sources-2.4.23.CAN-2004-0001.patch,
- -files/aa-sources-2.4.23.CAN-2004-0109.patch,
- -files/aa-sources-2.4.23.CAN-2004-0133.patch,
- -files/aa-sources-2.4.23.CAN-2004-0177.patch,
- -files/aa-sources-2.4.23.CAN-2004-0178.patch,
- -files/aa-sources-2.4.23.CAN-2004-0181.patch,
- -files/aa-sources-2.4.23.CAN-2004-0394.patch,
- -files/aa-sources-2.4.23.CAN-2004-0427.patch,
- -files/aa-sources-2.4.23.CAN-2004-0495.patch,
- -files/aa-sources-2.4.23.CAN-2004-0535.patch,
- -files/aa-sources-2.4.23.FPULockup-53804.patch,
- +files/aa-sources-2.4.23.XDRWrapFix.patch,
- -files/aa-sources-2.4.23.munmap.patch,
- -files/aa-sources-2.4.23.rtc_fix.patch,
- +files/aa-sources-2.6.5.devPtmx.patch, -files/do_brk_fix.patch:
- Bump 2.4 branch to -aa3 which contains some of the security fixes in files/,
- removing them from there. Fixed 2.4 kNFSd security vulnerability and the 2.6
- /dev/ptmx DoS, bug #62524. Also fixed CAN-2004-0814 for 2.4 and 2.6, bug
- #68421.
-
- 21 Oct 2004; <plasmaroo@gentoo.org> aa-sources-2.6.5-r5.ebuild,
- +files/aa-sources-2.6.5.CAN-2004-0816.patch:
- Added a patch to address CAN-2004-0816; bug #68375.
-
- 02 Oct 2004; <plasmaroo@gentoo.org>:
- Push an updated CAN-2004-0415 patch to the mirrors, bug #65482.
-
- 09 Aug 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- aa-sources-2.6.5-r5.ebuild, +files/aa-sources-2.4.23.cmdlineLeak.patch,
- +files/aa-sources-2.6.5.cmdlineLeak.patch:
- Added a patch for the /proc/cmdline leak vulnerability; bug #59905.
-
- 08 Aug 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- +files/aa-sources-2.4.23.CAN-2004-0685.patch:
- Patched for CAN-2004-0685, bug #59769.
-
- 05 Aug 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- aa-sources-2.6.5-r5.ebuild:
- Added a patch for the CAN-2004-0415 vulnerability, bug #59378.
-
- 21 Jul 2004; <plasmaroo@gentoo.org> aa-sources-2.6.5-r5.ebuild,
- +files/aa-sources-2.6.5.CAN-2004-0495-0496.patch:
- Fixes for CAN-2004-049[56].
-
- 21 Jul 2004; <plasmaroo@gentoo.org> aa-sources-2.6.5-r5.ebuild,
- +files/aa-sources-2.6.5.CAN-2004-0596.patch:
- Added a patch for the CAN-2004-0596 issue; bug #57826.
-
- 09 Jul 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- aa-sources-2.6.5-r5.ebuild, +files/aa-sources-2.6.5.ProcPerms.patch,
- +files/aa-sources.CAN-2004-0497.patch:
- Patched for attribute vulnerabilities, bug #56479.
-
- 30 Jun 2004; <plasmaroo@gentoo.org> aa-sources-2.6.5-r5.ebuild,
- +files/aa-sources-2.6.5.IPTables-RDoS.patch:
- Added a patch for the IPTables RDoS vulnerability; bug #55694.
-
- 29 Jun 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- +files/aa-sources-2.4.23.CAN-2004-0495.patch,
- +files/aa-sources-2.4.23.CAN-2004-0535.patch:
- Added patches for the CAN-2004-0495 and CAN-2004-0535 vulnerabilities.
-
- 13 Jun 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- aa-sources-2.6.5-r5.ebuild, +files/aa-sources-2.4.23.FPULockup-53804.patch,
- +files/aa-sources-2.6.5.FPULockup-53804.patch:
- Added patches for the FPU-lockup issues; please see bug #58304 for details.
-
- 04 Jun 2004; <plasmaroo@gentoo.org> -aa-sources-2.4.22-r1.ebuild,
- -aa-sources-2.4.23-r1.ebuild:
- Pruning old versions.
-
- 31 May 2004; Pieter Van den Abeele <pvdabeel@gentoo.org>
- aa-sources-2.4.22-r1.ebuild, aa-sources-2.4.23-r1.ebuild,
- aa-sources-2.4.23-r2.ebuild, aa-sources-2.6.5-r5.ebuild:
- Masked aa-sources-2.6.5-r5.ebuild testing for ppc
-
- 31 May 2004; Pieter Van den Abeele <pvdabeel@gentoo.org>
- aa-sources-2.4.22-r1.ebuild, aa-sources-2.4.23-r1.ebuild,
- aa-sources-2.4.23-r2.ebuild:
- Masked aa-sources-2.4.23-r2.ebuild broken for ppc
-
- 31 May 2004; Pieter Van den Abeele <pvdabeel@gentoo.org>
- aa-sources-2.4.22-r1.ebuild, aa-sources-2.4.23-r1.ebuild:
- Masked aa-sources-2.4.23-r1.ebuild broken for ppc
-
- 31 May 2004; Pieter Van den Abeele <pvdabeel@gentoo.org>
- aa-sources-2.4.22-r1.ebuild:
- Masked aa-sources-2.4.22-r1.ebuild broken for ppc
-
- 28 May 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- aa-sources-2.6.5-r5.ebuild, files/aa-sources-...patch:
- Added patches for the CAN-2004-0075, CAN-2004-0133, CAN-2004-0181,
- CAN-2004-0228, CAN-2004-0229, CAN-2004-0394, and CAN-2004-0427
- vulnerabilities. Bug #47881.
-
- 27 Apr 2004; Aron Griffis <agriffis@gentoo.org> aa-sources-2.4.22-r1.ebuild,
- aa-sources-2.4.23-r1.ebuild:
- Add inherit eutils.
-
- 17 Apr 2004; Daniel Ahlberg <aliz@gentoo.org> aa-sources-2.4.23-r2.ebuild:
- Fixed IUSE flags.
-
- 17 Apr 2004; <plasmaroo@gentoo.org>
- +files/aa-sources-2.4.23.CAN-2004-0010.patch,
- +files/aa-sources-2.4.23.CAN-2004-0177.patch,
- +files/aa-sources-2.4.23.CAN-2004-0178.patch, aa-sources-2.4.23-r2.ebuild:
- Added patches for the CAN-2004-0010, CAN-2004-0177 and CAN-2004-0178
- vulnerabilities.
-
-*aa-sources-2.6.5-r5 (16 Apr 2004)
-
- 16 Apr 2004; <coxj@gentoo.org> aa-sources-2.6.5-r5.ebuild:
- Version Bump.
-
- 15 Apr 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild,
- files/aa-sources-2.4.23.CAN-2004-0109.patch:
- Added a patch for the CAN-2004-0109 issue; bug #47881.
-
- 12 Apr 2004; Daniel Ahlberg <aliz@gentoo.org> aa-sources-2.4.23-r2.ebuild:
- Add eutils to inherit.
-
-*aa-sources-2.4.23-r2 (29 Feb 2004)
-
- 29 Feb 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r2.ebuild:
- Version bump; closes bug #43241.
-
- 18 Feb 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r1.ebuild,
- files/aa-sources-2.4.23.munmap.patch:
- Added the patch for the mremap/munmap vulnerability.
-
- 16 Feb 2004; <plasmaroo@gentoo.org> aa-sources-2.4.23-r1.ebuild,
- files/aa-sources-2.4.23.CAN-2004-0001.patch:
- Added the fix for the ptrace vulnerability for AMD64 platforms.
-
- 08 Jan 2004; Brian Jackson <iggy@gentoo.org> aa-sources-2.4.23-r1.ebuild:
- Somebody accidentally commented ${OKV}, bug 37588 resolved.
-
- 06 Jan 2004; <plasmaroo@gentoo.org> aa-sources-2.4.22-r1.ebuild,
- aa-sources-2.4.23-r1.ebuild, files/aa-sources-2.4.23.CAN-2003-0985.patch
- files/aa-sources-2.4.23.rtc_fix.patch:
- Removed the old pre-release and added the 2.4.24 security patches.
- Please see bug #37292 and #37317 for more details.
-
- 09 Dec 2003; <plasmaroo@gentoo.org> aa-sources-2.4.23-r1.ebuild:
- Added a fix for the XFS support in aa-sources as a bug from upstream seems to
- have slipped in. Thanks for filing bug #35472, which is now closed.
-
-*aa-sources-2.4.23-r1 (05 Dec 2003)
-
- 05 Dec 2003; Andrea Luzzardi <scox@gentoo.org> aa-sources-2.4.23-r1.ebuild:
- Bump to -aa1.
-
- 02 Dec 2003; Brian Jackson <iggy@gentoo.org>
- aa-sources-2.4.23_pre6-r3.ebuild:
- Version bump for the 'do_brk' vulnerability.
-
- 01 Dec 2003; Brian Jackson <iggy@gentoo.org> aa-sources-2.4.22-r1.ebuild,
- files/do_brk_fix.patch:
- Fix 'do_brk' vulnerability.
-
- 06 Oct 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_rc2-r1.ebuild, aa-sources-2.4.21_rc4-r1.ebuild,
- aa-sources-2.4.21_rc8-r1.ebuild:
- Clean up...
-
-*aa-sources-2.4.23_pre6-r3 (05 Oct 2003)
-
- 05 Oct 2003; <iggy@gentoo.org> aa-sources-2.4.23_pre6-r3.ebuild:
- Bump to "_pre6-aa3"...
-
- 11 Sep 2003; <plasmaroo@gentoo.org> aa-sources-2.4.22-r1.ebuild,
- aa-sources-2.4.22_pre6-r2.ebuild, aa-sources-2.4.22_pre7-r1.ebuild,
- files/aa-sources-2.4.22-ide-scsi-missing-sym-fix.patch:
- Added ide-scsi patch [bug #28452] and removed 2.4.22 pre-release
- builds.
-
- 08 Sep 2003; Martin Holzer <mholzer@gentoo.org>
- aa-sources-2.4.21_rc2-r1.ebuild, aa-sources-2.4.21_rc4-r1.ebuild,
- aa-sources-2.4.21_rc8-r1.ebuild, aa-sources-2.4.22_pre6-r2.ebuild,
- aa-sources-2.4.22_pre7-r1.ebuild:
- SRC now uses mirror://kernel
-
-*aa-sources-2.4.22 (02 Sep 2003)
-
- 02 Sep 2003; Daniel Ahlberg <aliz@gentoo.org> aa-sources-2.4.22-r1.ebuild :
- Version bump and borrow the magic from ac-sources.
-
-*aa-sources-2.4.22_pre7-r1 (21 Jul 2003)
-
- 21 Jul 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.22_pre7-r1.ebuild:
- Bump.
-
-*aa-sources-2.4.22_pre6-r2 (18 Jul 2003)
-
- 18 Jul 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.22_pre6-r2.ebuild:
- Bump.
-
-*aa-sources-2.4.21_rc8-r1 (12 Jun 2003)
-
- 12 Jun 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_pre5-r1.ebuild, aa-sources-2.4.21_pre5-r2.ebuild,
- aa-sources-2.4.21_rc8-r1.ebuild:
- Bump.
-
-*aa-sources-2.4.21_rc4-r1 (28 May 2003)
-
- 28 May 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_rc4-r1.ebuild:
- Bump.
-
-*aa-sources-2.4.21_rc2-r1 (25 May 2003)
-
- 25 May 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_rc2-r1.ebuild:
- Bump.
-
-*aa-sources-2.4.21_pre5-r2 (14 Mar 2003)
-
- 14 Mar 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_pre5-r2.ebuild:
- Bump.
-
-*aa-sources-2.4.21_pre5-r1 (14 Mar 2003)
-
- 14 Mar 2003; Brandon Low <lostlogic@gentoo.org>
- aa-sources-2.4.21_pre5-r1.ebuild:
- Bump.
-
- 17 Dec 2002; Brandon Low <lostlogic@gentoo.org>:
- Make all kernel-sources SLOT="${KV}".
-
-*aa-sources-2.4.20_pre101 (27 Oct 2002)
-
- 27 Oct 2002; Brandon Low <lostlogic@gentoo.org> aa-sources-2.4.20_pre111.ebuild:
- Version bump.
-
-*aa-sources-2.4.20_pre101 (15 Oct 2002)
-
- 15 Oct 2002; Brandon Low <lostlogic@gentoo.org> aa-sources-2.4.20_pre101.ebuild:
- New package for -aa sources, the versioning is silly
- because we really have 2 parts to the -pre number the
- marcelo kernel pre version and the -ac subversion so
- _pre83 means -pre8-aa3. This doesn't hold up if
- there are more than 10 -ac versions for a -pre I hope
- that -aa never sinks to that level ;-).
+++ /dev/null
-MD5 e2e3238b844c68dee59d28dbbd11d075 ChangeLog 9768
-MD5 399eb7607b8f1f3f597e93566b1bda7c metadata.xml 453
-MD5 b18648665fbc1d70e4a847b5f6b2d99c aa-sources-2.6.5-r5.ebuild 1428
-MD5 463f19aae235c71e1d492e9a173f203e aa-sources-2.4.23-r3.ebuild 3232
-MD5 60d25ff310fc6abfdce39ec9e47345af files/aa-sources-2.4.23.CAN-2004-0685.patch 2809
-MD5 39361f8d16b1fe5891aab62e92f8cd30 files/aa-sources-2.6.5.IPTables-RDoS.patch 390
-MD5 d1ccc2047be533c992f67270a150a210 files/aa-sources-2.4.23.cmdlineLeak.patch 388
-MD5 6f4bba5dda7a99d77b1564f5489fef6e files/aa-sources-2.6.5.CAN-2004-0075.patch 1129
-MD5 e77a93fdf26f06cf3ea5080b27211725 files/aa-sources-2.4.23.CAN-2003-0985.patch 414
-MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/aa-sources-2.4.23.CAN-2004-0075.patch 634
-MD5 30eb813139e04aba3c8b84f5a7d4ec1f files/digest-aa-sources-2.6.5-r5 281
-MD5 02c062ec3a11a6a1498cdf0b1716c90a files/aa-sources-2.6.5.FPULockup-53804.patch 895
-MD5 147fec50180ad91b6260fc7201dcb90f files/aa-sources-2.4.23.CAN-2004-0010.patch 6050
-MD5 a92712e41465c49670ef7a54c2d16040 files/aa-sources-2.6.5.CAN-2004-0229.patch 471
-MD5 452e04a312368605e145428c35bd0e05 files/aa-sources-2.6.5.devPtmx.patch 572
-MD5 95708646470a95668e8789cd415844ed files/aa-sources.CAN-2004-0497.patch 846
-MD5 222e890035f4ad3152f0c2a625a9ea67 files/aa-sources-2.6.5.cmdlineLeak.patch 693
-MD5 b738cb0120a32aa92cfcfdbd564dd21f files/aa-sources-2.6.5.ProcPerms.patch 1368
-MD5 1dd59d14a720c0c23e47e28d0b4fd6f9 files/aa-sources-2.6.5.CAN-2004-0228.patch 437
-MD5 4ccd121645a534f0581df9b26d98c2c4 files/digest-aa-sources-2.4.23-r3 288
-MD5 5674421c7e2c7e50e2509bed7d96c4d4 files/aa-sources-2.6.5.CAN-2004-0427.patch 332
-MD5 8204afea1d572b49a4a80d8da4eef0c9 files/aa-sources-2.6.5.CAN-2004-0596.patch 1033
-MD5 eb70acb35ba13daa4b1fda53cb61fc01 files/aa-sources-2.6.5.CAN-2004-0495-0496.patch 23861
-MD5 2b3ddb8b8b15f8da35ade38544b57857 files/aa-sources-2.4.23.XDRWrapFix.patch 1499
-MD5 aa595005721b58929ee55e2e8f4b6ba0 files/aa-sources-2.6.5.CAN-2004-0816.patch 1693
+++ /dev/null
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.4.23-r3.ebuild,v 1.1 2004/11/06 20:54:20 plasmaroo Exp $
-
-IUSE=""
-
-# OKV=original kernel version, KV=patched kernel version.
-
-ETYPE="sources"
-
-inherit kernel eutils
-
-# AAV=andrea arcangeli release version
-AAV=aa${PR/r/}
-# KV=patched kernel version
-KV="${PV/_/-}-${AAV}"
-# OKV=original kernel version as provided by ebuild
-OKV="`echo ${KV} | cut -d- -f1`"
-# OKVLAST=(working) last digit of OKV
-OKVLAST="`echo ${OKV} | cut -d. -f3`"
-# OKVLASTPR=the previous kernel version (for a marcelo pre/rc release)
-OKVLASTPR="`expr ${OKVLAST} - 1`"
-# If _ isn't there, then it's a stable+ac, otherwise last-stable+pre/rc+ac
-PRERC="`echo ${PV}|grep \_`"
-
-# Other working variables
-S=${WORKDIR}/linux-${KV}
-EXTRAVERSION="`echo ${KV}|sed -e 's:[^-]*\(-.*$\):\1:'`"
-BASE="`echo ${KV}|sed -e s:${EXTRAVERSION}::`"
-
-# If it's a last-stable+pre/rc+aa (marcelo), we need to handle it differently
-# ourkernel is the stable kernel we'll be working with (previous or current)
-if [ ${PRERC} ]; then
- OURKERNEL="2.4.${OKVLASTPR}"
- SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OURKERNEL}.tar.bz2
- mirror://kernel/linux/kernel/people/andrea/kernels/v2.4/${KV/-}.bz2
- mirror://kernel/linux/kernel/v2.4/testing/patch-${PV/_/-}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
-else
- OURKERNEL="2.4.${OKVLAST}"
- SRC_URI="mirror://kernel//linux/kernel/v2.4/linux-${OURKERNEL}.tar.bz2
- mirror://kernel/linux/kernel/people/andrea/kernels/v2.4/${KV/-}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
-fi
-
-DESCRIPTION="Full sources for Andrea Arcangeli's Linux kernel"
-KEYWORDS="x86 -ppc"
-SLOT="${KV}"
-
-src_unpack() {
- unpack linux-${OURKERNEL}.tar.bz2
- mv linux-${OURKERNEL} linux-${KV} || die
- cd linux-${KV}
-
- # if we need a pre/rc patch, then use it
- if [ ${PRERC} ]; then
- bzcat ${DISTDIR}/patch-${PV/_/-}.bz2|patch -p1 || die "-marcelo patch failed"
- fi
-
- bzcat ${DISTDIR}/${KV/-}.bz2|patch -p1 || die "-aa patch failed"
- sed -e '51i \ qsort.o \\' -i fs/xfs/support/Makefile || die "XFS patch failed!"
-
- epatch ${FILESDIR}/${P}.CAN-2003-0985.patch || die "Failed to apply mremap() patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0075.patch || die "Failed to add the CAN-2004-0075 patch!"
- epatch ${DISTDIR}/${P}-CAN-2004-0415.patch || die "Failed to add the CAN-2004-0415 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!"
- epatch ${DISTDIR}/${P}-CAN-2004-0814.patch || die "Failed to add the CAN-2004-0814 patch!"
- epatch ${FILESDIR}/${P}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
- epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR fix!"
- # The munmap() patch is already in aa2...
-
- kernel_universal_unpack
-}
+++ /dev/null
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.6.5-r5.ebuild,v 1.14 2004/11/06 20:54:20 plasmaroo Exp $
-
-ETYPE="sources"
-K_NOUSENAME="yes"
-
-inherit kernel-2
-detect_version
-KV="${KV/-r/-aa}"
-
-UNIPATCH_LIST="
- ${DISTDIR}/${KV}.bz2
- ${FILESDIR}/${P}.CAN-2004-0075.patch
- ${FILESDIR}/${P}.CAN-2004-0228.patch
- ${FILESDIR}/${P}.CAN-2004-0229.patch
- ${DISTDIR}/linux-${OKV}-CAN-2004-0415.patch
- ${FILESDIR}/${P}.CAN-2004-0427.patch
- ${FILESDIR}/${PN}.CAN-2004-0497.patch
- ${FILESDIR}/${P}.FPULockup-53804.patch
- ${FILESDIR}/${P}.IPTables-RDoS.patch
- ${FILESDIR}/${P}.ProcPerms.patch
- ${FILESDIR}/${P}.CAN-2004-0596.patch
- ${FILESDIR}/${P}.CAN-2004-0495-0496.patch
- ${FILESDIR}/${P}.cmdlineLeak.patch
- ${FILESDIR}/${P}.CAN-2004-0816.patch
- ${FILESDIR}/${P}.devPtmx.patch
- ${DISTDIR}/${P}-CAN-2004-0814.patch"
-
-K_PREPATCHED="yes"
-UNIPATCH_STRICTORDER="yes"
-
-DESCRIPTION="Full sources for Andrea Arcangeli's Linux kernel"
-HOMEPAGE="http://www.kernel.org/pub/linux/kernel/people/andrea/"
-SRC_URI="${KERNEL_URI} mirror://kernel/linux/kernel/people/andrea/kernels/v2.6/${KV}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
-
-KEYWORDS="~x86 ~amd64 ~sparc ~ppc"
-IUSE=""
+++ /dev/null
---- linux/mm/mremap.c.orig 2004-01-05 17:01:21.382104120 +0000
-+++ linux/mm/mremap.c 2004-01-05 17:15:25.689749848 +0000
-@@ -315,6 +315,10 @@
- old_len = PAGE_ALIGN(old_len);
- new_len = PAGE_ALIGN(new_len);
-
-+ /* Don't allow the degenerate cases */
-+ if (!old_len || !new_len)
-+ goto out;
-+
- /* new_addr is only valid if MREMAP_FIXED is specified */
- if (flags & MREMAP_FIXED) {
- if (new_addr & ~PAGE_MASK)
+++ /dev/null
-diff -urN linux-2.4.25-pre6/fs/ncpfs/dir.c linux-2.4.25-pre7/fs/ncpfs/dir.c
---- linux-2.4.25-pre6/fs/ncpfs/dir.c 2002-11-28 15:53:15.000000000 -0800
-+++ linux-2.4.25-pre7/fs/ncpfs/dir.c 2004-01-23 10:53:26.000000000 -0800
-@@ -266,8 +266,8 @@
- struct ncp_server *server;
- struct inode *dir = dentry->d_parent->d_inode;
- struct ncp_entry_info finfo;
-- int res, val = 0, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int res, val = 0, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- if (!dentry->d_inode || !dir)
- goto finished;
-@@ -291,14 +291,15 @@
- dentry->d_parent->d_name.name, dentry->d_name.name,
- NCP_GET_AGE(dentry));
-
-+ len = sizeof(__name);
- if (ncp_is_server_root(dir)) {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, 1);
-+ dentry->d_name.len, 1);
- if (!res)
- res = ncp_lookup_volume(server, __name, &(finfo.i));
- } else {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (!res)
- res = ncp_obtain_info(server, dir, __name, &(finfo.i));
- }
-@@ -548,9 +549,9 @@
- int valid = 0;
- int hashed = 0;
- ino_t ino = 0;
-- __u8 __name[256];
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
-- qname.len = 256;
-+ qname.len = sizeof(__name);
- if (ncp_vol2io(NCP_SERVER(inode), __name, &qname.len,
- entry->i.entryName, entry->i.nameLen,
- !ncp_preserve_entry_case(inode, entry->i.NSCreator)))
-@@ -705,16 +706,19 @@
- {
- struct ncp_server* server = NCP_SBP(sb);
- struct nw_info_struct i;
-- int result, len = strlen(server->m.mounted_vol) + 1;
-- __u8 __name[len];
-+ int result;
-
- if (ncp_single_volume(server)) {
-+ int len;
- struct dentry* dent;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
-- result = -ENOENT;
-- if (ncp_io2vol(server, __name, &len, server->m.mounted_vol,
-- len-1, 1))
-+ len = sizeof(__name);
-+ result = ncp_io2vol(server, __name, &len, server->m.mounted_vol,
-+ strlen(server->m.mounted_vol), 1);
-+ if (result)
- goto out;
-+ result = -ENOENT;
- if (ncp_lookup_volume(server, __name, &i)) {
- PPRINTK("ncp_conn_logged_in: %s not found\n",
- server->m.mounted_vol);
-@@ -745,8 +749,8 @@
- struct ncp_server *server = NCP_SERVER(dir);
- struct inode *inode = NULL;
- struct ncp_entry_info finfo;
-- int error, res, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, res, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- error = -EIO;
- if (!ncp_conn_valid(server))
-@@ -755,14 +759,15 @@
- PPRINTK("ncp_lookup: server lookup for %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-
-+ len = sizeof(__name);
- if (ncp_is_server_root(dir)) {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, 1);
-+ dentry->d_name.len, 1);
- if (!res)
- res = ncp_lookup_volume(server, __name, &(finfo.i));
- } else {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (!res)
- res = ncp_obtain_info(server, dir, __name, &(finfo.i));
- }
-@@ -825,9 +830,9 @@
- {
- struct ncp_server *server = NCP_SERVER(dir);
- struct ncp_entry_info finfo;
-- int error, result, len = dentry->d_name.len + 1;
-+ int error, result, len;
- int opmode;
-- __u8 __name[len];
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
- dentry->d_parent->d_name.name, dentry->d_name.name, mode);
-@@ -836,8 +841,9 @@
- goto out;
-
- ncp_age_dentry(server, dentry);
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -880,8 +886,8 @@
- {
- struct ncp_entry_info finfo;
- struct ncp_server *server = NCP_SERVER(dir);
-- int error, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_mkdir: making %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-@@ -890,8 +896,9 @@
- goto out;
-
- ncp_age_dentry(server, dentry);
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -909,8 +916,8 @@
- static int ncp_rmdir(struct inode *dir, struct dentry *dentry)
- {
- struct ncp_server *server = NCP_SERVER(dir);
-- int error, result, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, result, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_rmdir: removing %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-@@ -923,8 +930,9 @@
- if (!d_unhashed(dentry))
- goto out;
-
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -1022,9 +1030,8 @@
- {
- struct ncp_server *server = NCP_SERVER(old_dir);
- int error;
-- int old_len = old_dentry->d_name.len + 1;
-- int new_len = new_dentry->d_name.len + 1;
-- __u8 __old_name[old_len], __new_name[new_len];
-+ int old_len, new_len;
-+ __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_rename: %s/%s to %s/%s\n",
- old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
-@@ -1037,15 +1044,17 @@
- ncp_age_dentry(server, old_dentry);
- ncp_age_dentry(server, new_dentry);
-
-+ old_len = sizeof(__old_name);
- error = ncp_io2vol(server, __old_name, &old_len,
-- old_dentry->d_name.name, old_len-1,
-- !ncp_preserve_case(old_dir));
-+ old_dentry->d_name.name, old_dentry->d_name.len,
-+ !ncp_preserve_case(old_dir));
- if (error)
- goto out;
-
-+ new_len = sizeof(__new_name);
- error = ncp_io2vol(server, __new_name, &new_len,
-- new_dentry->d_name.name, new_len-1,
-- !ncp_preserve_case(new_dir));
-+ new_dentry->d_name.name, new_dentry->d_name.len,
-+ !ncp_preserve_case(new_dir));
- if (error)
- goto out;
-
-
+++ /dev/null
---- linux-2.4.23/drivers/usb/vicam.c 2004-01-26 16:56:32.000000000 +0000
-+++ linux-2.4.25/drivers/usb/vicam.c 2004-04-20 18:15:53.000000000 +0100
-@@ -601,12 +601,19 @@
- case VIDIOCSWIN:
- {
-
-- struct video_window *vw = (struct video_window *) arg;
-- DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
-+ struct video_window vw;
-
-- if ( vw->width != 320 || vw->height != 240 )
-+ if (copy_from_user(&vw, arg, sizeof(vw)))
-+ {
- retval = -EFAULT;
-+ break;
-+ }
-+
-+ DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
-
-+ if ( vw.width != 320 || vw.height != 240 )
-+ retval = -EFAULT;
-+
- break;
- }
-
+++ /dev/null
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2004/07/26 19:14:16-03:00 mjc@redhat.com
-# [PATCH] USB: more sparse fixes
-#
-# Back in October 2003 Arnaldo commited some fixes prior to 2.6 for some leaking info to userspace in the
-# usb drivers:
-# http://linux.bkbits.net:8080/linux-2.6/cset@3f986b35LyBKc-OxB8G6k22oOjgYTQ
-#
-# The corresponding changes have not been commited to 2.4, or included in
-# the previous sparse fixes.
-#
-# drivers/usb/audio.c
-# 2004/07/15 08:46:52-03:00 mjc@redhat.com +4 -0
-# USB: more sparse fixes
-#
-# drivers/usb/brlvger.c
-# 2004/07/15 08:47:27-03:00 mjc@redhat.com +1 -0
-# USB: more sparse fixes
-#
-# drivers/usb/serial/io_edgeport.c
-# 2004/07/15 08:48:06-03:00 mjc@redhat.com +1 -0
-# USB: more sparse fixes
-#
-# drivers/usb/vicam.c
-# 2004/07/15 08:47:13-03:00 mjc@redhat.com +1 -0
-# USB: more sparse fixes
-#
-diff -Nru a/drivers/usb/audio.c b/drivers/usb/audio.c
---- a/drivers/usb/audio.c 2004-08-08 07:41:30 -07:00
-+++ b/drivers/usb/audio.c 2004-08-08 07:41:30 -07:00
-@@ -2141,6 +2141,8 @@
-
- if (cmd == SOUND_MIXER_INFO) {
- mixer_info info;
-+
-+ memset(&info, 0, sizeof(info));
- strncpy(info.id, "USB_AUDIO", sizeof(info.id));
- strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
- info.modify_counter = ms->modcnt;
-@@ -2150,6 +2152,8 @@
- }
- if (cmd == SOUND_OLD_MIXER_INFO) {
- _old_mixer_info info;
-+
-+ memset(&info, 0, sizeof(info));
- strncpy(info.id, "USB_AUDIO", sizeof(info.id));
- strncpy(info.name, "USB Audio Class Driver", sizeof(info.name));
- if (copy_to_user((void *)arg, &info, sizeof(info)))
-diff -Nru a/drivers/usb/brlvger.c b/drivers/usb/brlvger.c
---- a/drivers/usb/brlvger.c 2004-08-08 07:41:30 -07:00
-+++ b/drivers/usb/brlvger.c 2004-08-08 07:41:30 -07:00
-@@ -743,6 +743,7 @@
- case BRLVGER_GET_INFO: {
- struct brlvger_info vi;
-
-+ memset(&vi, 0, sizeof(vi));
- strncpy(vi.driver_version, DRIVER_VERSION,
- sizeof(vi.driver_version));
- vi.driver_version[sizeof(vi.driver_version)-1] = 0;
-diff -Nru a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
---- a/drivers/usb/serial/io_edgeport.c 2004-08-08 07:41:30 -07:00
-+++ b/drivers/usb/serial/io_edgeport.c 2004-08-08 07:41:30 -07:00
-@@ -1913,6 +1913,7 @@
-
- case TIOCGICOUNT:
- cnow = edge_port->icount;
-+ memset(&icount, 0, sizeof(icount));
- icount.cts = cnow.cts;
- icount.dsr = cnow.dsr;
- icount.rng = cnow.rng;
-diff -Nru a/drivers/usb/vicam.c b/drivers/usb/vicam.c
---- a/drivers/usb/vicam.c 2004-08-08 07:41:30 -07:00
-+++ b/drivers/usb/vicam.c 2004-08-08 07:41:30 -07:00
-@@ -481,6 +481,7 @@
- struct video_capability b;
-
- DBG("VIDIOCGCAP\n");
-+ memset(&b, 0, sizeof(b));
- strcpy(b.name, "ViCam-based Camera");
- b.type = VID_TYPE_CAPTURE;
- b.channels = 1;
+++ /dev/null
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au
-# [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
-#
-# xdr_argsize_check needs to cope with the possibility that the
-# pointer has wrapped and could be below buf->base.
-#
-# Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
-#
-# ### Diffstat output
-# ./fs/nfsd/nfs3xdr.c | 2 +-
-# ./include/linux/nfsd/xdr3.h | 2 +-
-# 2 files changed, 2 insertions(+), 2 deletions(-)
-#
-# fs/nfsd/nfs3xdr.c
-# 2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
-# Fixed possibly xdr parsing error if write size exceed 2^31
-#
-# include/linux/nfsd/xdr3.h
-# 2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
-# Fixed possibly xdr parsing error if write size exceed 2^31
-#
-diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
---- a/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00
-+++ b/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00
-@@ -273,7 +273,7 @@
- {
- struct svc_buf *buf = &rqstp->rq_argbuf;
-
-- return p - buf->base <= buf->buflen;
-+ return p >= buf->base && p <= buf->base + buf->buflen ;
- }
-
- static inline int
-diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
---- a/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00
-+++ b/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00
-@@ -41,7 +41,7 @@
- __u32 count;
- int stable;
- __u8 * data;
-- int len;
-+ __u32 len;
- };
-
- struct nfsd3_createargs {
+++ /dev/null
---- linux-2.4/fs/proc/base.c 2004-04-15 07:09:32.000000000 +0100
-+++ linux-2.4/fs/proc/base.c.plasmaroo 2004-08-09 23:30:43.869195800 +0100
-@@ -187,7 +187,7 @@ static int proc_pid_cmdline(struct task_
- if (mm)
- atomic_inc(&mm->mm_users);
- task_unlock(task);
-- if (mm) {
-+ if (mm && mm->arg_end) {
- int len = mm->arg_end - mm->arg_start;
- if (len > PAGE_SIZE)
- len = PAGE_SIZE;
+++ /dev/null
---- linux-2.6.6-rc1/drivers/usb/media/vicam.c 2004-04-15 11:18:18.000000000 +0200
-+++ linux-2.6.6-rc1-mich/drivers/usb/media/vicam.c 2004-04-15 11:50:02.791604312 +0200
-@@ -612,15 +612,20 @@ vicam_ioctl(struct inode *inode, struct
-
- case VIDIOCSPICT:
- {
-- struct video_picture *vp = (struct video_picture *) arg;
--
-- DBG("VIDIOCSPICT depth = %d, pal = %d\n", vp->depth,
-- vp->palette);
-+ struct video_picture vp;
-+
-+ if (copy_from_user(&vp, arg, sizeof(vp))) {
-+ retval = -EFAULT;
-+ break;
-+ }
-+
-+ DBG("VIDIOCSPICT depth = %d, pal = %d\n", vp.depth,
-+ vp.palette);
-
-- cam->gain = vp->brightness >> 8;
-+ cam->gain = vp.brightness >> 8;
-
-- if (vp->depth != 24
-- || vp->palette != VIDEO_PALETTE_RGB24)
-+ if (vp.depth != 24
-+ || vp.palette != VIDEO_PALETTE_RGB24)
- retval = -EINVAL;
-
- break;
-@@ -659,7 +659,7 @@
- {
-
- struct video_window *vw = (struct video_window *) arg;
-- DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
-+ DBG("VIDIOCSWIN %d x %d\n", vw.width, vw.height);
-
- if ( vw->width != 320 || vw->height != 240 )
- retval = -EFAULT;
+++ /dev/null
---- linux-2.6.3/drivers/cpufreq/cpufreq_userspace.c.overflow 2004-02-18 04:57:16.000000000 +0100
-+++ linux-2.6.3/drivers/cpufreq/cpufreq_userspace.c 2004-05-14 11:40:37.000000000 +0200
-@@ -168,7 +168,7 @@ cpufreq_procctl(ctl_table *ctl, int writ
- {
- char buf[16], *p;
- int cpu = (int) ctl->extra1;
-- int len, left = *lenp;
-+ unsigned int len, left = *lenp;
-
- if (!left || (filp->f_pos && !write) || !cpu_online(cpu)) {
- *lenp = 0;
+++ /dev/null
---- linux-2.6.3/drivers/video/fbmem.c.zy67 2004-04-23 07:32:22.000000000 -0400
-+++ linux-2.6.3/drivers/video/fbmem.c 2004-04-23 07:33:09.000000000 -0400
-@@ -1042,7 +1042,7 @@
- case FBIOGETCMAP:
- if (copy_from_user(&cmap, (void *) arg, sizeof(cmap)))
- return -EFAULT;
-- return (fb_copy_cmap(&info->cmap, &cmap, 0));
-+ return (fb_copy_cmap(&info->cmap, &cmap, 2));
- case FBIOPAN_DISPLAY:
- if (copy_from_user(&var, (void *) arg, sizeof(var)))
- return -EFAULT;
+++ /dev/null
---- linux-2.6.3/kernel/fork.c.zy64 2004-04-21 12:26:51.000000000 -0400
-+++ linux-2.6.3/kernel/fork.c 2004-04-21 12:29:34.000000000 -0400
-@@ -1073,6 +1073,8 @@
- exit_namespace(p);
- bad_fork_cleanup_mm:
- exit_mm(p);
-+ if (p->active_mm)
-+ mmdrop(p->active_mm);
- bad_fork_cleanup_signal:
- exit_signal(p);
- bad_fork_cleanup_sighand:
+++ /dev/null
-# <plasmaroo@gentoo.org>
-# This is a patch which should fix both CAN-2004-0495 and CAN-2004-0496 on 2.6...
-
-# * -0495 applies to 2.4 as well; use a separate patch for that.
-# * -0496 is a 2.6 only issue which this patch addresses.
-
---- 1.20/net/decnet/dn_dev.c 2004-07-21 14:50:27 -07:00
-+++ 1.21/net/decnet/dn_dev.c 2004-07-21 14:50:27 -07:00
-@@ -1294,35 +1294,43 @@
- * it as a compile time option. Probably you should use the
- * rtnetlink interface instead.
- */
--int dnet_gifconf(struct net_device *dev, char *buf, int len)
-+int dnet_gifconf(struct net_device *dev, char __user *buf, int len)
- {
- struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
- struct dn_ifaddr *ifa;
-- struct ifreq *ifr = (struct ifreq *)buf;
-+ char buffer[DN_IFREQ_SIZE];
-+ struct ifreq *ifr = (struct ifreq *)buffer;
-+ struct sockaddr_dn *addr = (struct sockaddr_dn *)&ifr->ifr_addr;
- int done = 0;
-
- if ((dn_db == NULL) || ((ifa = dn_db->ifa_list) == NULL))
- return 0;
-
- for(; ifa; ifa = ifa->ifa_next) {
-- if (!ifr) {
-+ if (!buf) {
- done += sizeof(DN_IFREQ_SIZE);
- continue;
- }
- if (len < DN_IFREQ_SIZE)
- return done;
-- memset(ifr, 0, DN_IFREQ_SIZE);
-+ memset(buffer, 0, DN_IFREQ_SIZE);
-
- if (ifa->ifa_label)
- strcpy(ifr->ifr_name, ifa->ifa_label);
- else
- strcpy(ifr->ifr_name, dev->name);
-
-- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_family = AF_DECnet;
-- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_len = 2;
-- (*(dn_address *)(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_addr) = ifa->ifa_local;
-+ addr->sdn_family = AF_DECnet;
-+ addr->sdn_add.a_len = 2;
-+ memcpy(addr->sdn_add.a_addr, &ifa->ifa_local,
-+ sizeof(dn_address));
-
-- ifr = (struct ifreq *)((char *)ifr + DN_IFREQ_SIZE);
-+ if (copy_to_user(buf, buffer, DN_IFREQ_SIZE)) {
-+ done = -EFAULT;
-+ break;
-+ }
-+
-+ buf += DN_IFREQ_SIZE;
- len -= DN_IFREQ_SIZE;
- done += DN_IFREQ_SIZE;
- }
---- 1.90/drivers/net/wireless/airo.c 2004-07-21 14:48:16 -07:00
-+++ 1.91/drivers/net/wireless/airo.c 2004-07-21 14:48:16 -07:00
-@@ -4272,12 +4272,12 @@
- */
-
- static ssize_t proc_read( struct file *file,
-- char *buffer,
-+ char __user *buffer,
- size_t len,
- loff_t *offset);
-
- static ssize_t proc_write( struct file *file,
-- const char *buffer,
-+ const char __user *buffer,
- size_t len,
- loff_t *offset );
- static int proc_close( struct inode *inode, struct file *file );
-@@ -4482,23 +4482,26 @@
- * to supply the data.
- */
- static ssize_t proc_read( struct file *file,
-- char *buffer,
-+ char __user *buffer,
- size_t len,
- loff_t *offset )
- {
-- int i;
-- int pos;
-+ loff_t pos = *offset;
- struct proc_data *priv = (struct proc_data*)file->private_data;
-
-- if( !priv->rbuffer ) return -EINVAL;
-+ if (!priv->rbuffer)
-+ return -EINVAL;
-
-- pos = *offset;
-- for( i = 0; i+pos < priv->readlen && i < len; i++ ) {
-- if (put_user( priv->rbuffer[i+pos], buffer+i ))
-- return -EFAULT;
-- }
-- *offset += i;
-- return i;
-+ if (pos < 0)
-+ return -EINVAL;
-+ if (pos >= priv->readlen)
-+ return 0;
-+ if (len > priv->readlen - pos)
-+ len = priv->readlen - pos;
-+ if (copy_to_user(buffer, priv->rbuffer + pos, len))
-+ return -EFAULT;
-+ *offset = pos + len;
-+ return len;
- }
-
- /*
-@@ -4506,28 +4509,26 @@
- * to supply the data.
- */
- static ssize_t proc_write( struct file *file,
-- const char *buffer,
-+ const char __user *buffer,
- size_t len,
- loff_t *offset )
- {
-- int i;
-- int pos;
-+ loff_t pos = *offset;
- struct proc_data *priv = (struct proc_data*)file->private_data;
-
-- if ( !priv->wbuffer ) {
-+ if (!priv->wbuffer)
- return -EINVAL;
-- }
--
-- pos = *offset;
-
-- for( i = 0; i + pos < priv->maxwritelen &&
-- i < len; i++ ) {
-- if (get_user( priv->wbuffer[i+pos], buffer + i ))
-- return -EFAULT;
-- }
-- if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos;
-- *offset += i;
-- return i;
-+ if (pos < 0)
-+ return -EINVAL;
-+ if (pos >= priv->maxwritelen)
-+ return 0;
-+ if (len > priv->maxwritelen - pos)
-+ len = priv->maxwritelen - pos;
-+ if (copy_from_user(priv->wbuffer + pos, buffer, len))
-+ return -EFAULT;
-+ *offset = pos + len;
-+ return len;
- }
-
- static int proc_status_open( struct inode *inode, struct file *file ) {
---- 1.14/sound/oss/mpu401.c 2004-07-21 14:44:27 -07:00
-+++ 1.15/sound/oss/mpu401.c 2004-07-21 14:44:27 -07:00
-@@ -728,7 +728,7 @@
- return 0;
- }
-
--static int mpu401_ioctl(int dev, unsigned cmd, caddr_t arg)
-+static int mpu401_ioctl(int dev, unsigned cmd, void __user *arg)
- {
- struct mpu_config *devc;
- mpu_command_rec rec;
-@@ -742,7 +742,7 @@
- printk(KERN_WARNING "mpu401: Intelligent mode not supported by the HW\n");
- return -EINVAL;
- }
-- if (get_user(val, (int *)arg))
-+ if (get_user(val, (int __user *)arg))
- return -EFAULT;
- set_uart_mode(dev, devc, !val);
- return 0;
-@@ -772,8 +772,7 @@
- */
- }
-
--static int mpu_synth_ioctl(int dev,
-- unsigned int cmd, caddr_t arg)
-+static int mpu_synth_ioctl(int dev, unsigned int cmd, void __user *arg)
- {
- int midi_dev;
- struct mpu_config *devc;
-@@ -789,8 +788,7 @@
- {
-
- case SNDCTL_SYNTH_INFO:
-- if (copy_to_user((&((char *) arg)[0]),
-- (char *) &mpu_synth_info[midi_dev],
-+ if (copy_to_user(arg, &mpu_synth_info[midi_dev],
- sizeof(struct synth_info)))
- return -EFAULT;
- return 0;
-@@ -1508,17 +1506,19 @@
- return curr_ticks;
- }
-
--static int mpu_timer_ioctl(int dev, unsigned int command, caddr_t arg)
-+static int mpu_timer_ioctl(int dev, unsigned int command, void __user *arg)
- {
- int midi_dev = sound_timer_devs[dev]->devlink;
-+ int __user *p = (int __user *)arg;
-
- switch (command)
- {
- case SNDCTL_TMR_SOURCE:
- {
- int parm;
--
-- parm = *(int *) arg;
-+
-+ if (get_user(parm, p))
-+ return -EFAULT;
- parm &= timer_caps;
-
- if (parm != 0)
-@@ -1530,7 +1530,9 @@
- else if (timer_mode & TMR_MODE_SMPTE)
- mpu_cmd(midi_dev, 0x3d, 0); /* Use SMPTE sync */
- }
-- return (*(int *) arg = timer_mode);
-+ if (put_user(timer_mode, p))
-+ return -EFAULT;
-+ return timer_mode;
- }
- break;
-
-@@ -1554,11 +1556,13 @@
- case SNDCTL_TMR_TIMEBASE:
- {
- int val;
--
-- val = *(int *) arg;
-+ if (get_user(val, p))
-+ return -EFAULT;
- if (val)
- set_timebase(midi_dev, val);
-- return (*(int *) arg = curr_timebase);
-+ if (put_user(curr_timebase, p))
-+ return -EFAULT;
-+ return curr_timebase;
- }
- break;
-
-@@ -1567,7 +1571,8 @@
- int val;
- int ret;
-
-- val = *(int *) arg;
-+ if (get_user(val, p))
-+ return -EFAULT;
-
- if (val)
- {
-@@ -1582,26 +1587,35 @@
- }
- curr_tempo = val;
- }
-- return (*(int *) arg = curr_tempo);
-+ if (put_user(curr_tempo, p))
-+ return -EFAULT;
-+ return curr_tempo;
- }
- break;
-
- case SNDCTL_SEQ_CTRLRATE:
- {
- int val;
-+ if (get_user(val, p))
-+ return -EFAULT;
-
-- val = *(int *) arg;
- if (val != 0) /* Can't change */
- return -EINVAL;
-- return (*(int *) arg = ((curr_tempo * curr_timebase) + 30) / 60);
-+ val = ((curr_tempo * curr_timebase) + 30)/60;
-+ if (put_user(val, p))
-+ return -EFAULT;
-+ return val;
- }
- break;
-
- case SNDCTL_SEQ_GETTIME:
-- return (*(int *) arg = curr_ticks);
-+ if (put_user(curr_ticks, p))
-+ return -EFAULT;
-+ return curr_ticks;
-
- case SNDCTL_TMR_METRONOME:
-- metronome_mode = *(int *) arg;
-+ if (get_user(metronome_mode, p))
-+ return -EFAULT;
- setup_metronome(midi_dev);
- return 0;
-
---- 1.11/drivers/acpi/asus_acpi.c 2004-07-21 14:16:19 -07:00
-+++ 1.12/drivers/acpi/asus_acpi.c 2004-07-21 14:16:19 -07:00
-@@ -40,6 +40,7 @@
- #include <linux/proc_fs.h>
- #include <acpi/acpi_drivers.h>
- #include <acpi/acpi_bus.h>
-+#include <asm/uaccess.h>
-
- #define ASUS_ACPI_VERSION "0.28"
-
-@@ -480,16 +481,31 @@
- return (hotk->status & ledmask) ? 1 : 0;
- }
-
-+static int parse_arg(const char __user *buf, unsigned long count, int *val)
-+{
-+ char s[32];
-+ if (!count)
-+ return 0;
-+ if (count > 31)
-+ return -EINVAL;
-+ if (copy_from_user(s, buf, count))
-+ return -EFAULT;
-+ s[count] = 0;
-+ if (sscanf(s, "%i", val) != 1)
-+ return -EINVAL;
-+ return count;
-+}
-
- /* FIXME: kill extraneous args so it can be called independently */
- static int
--write_led(const char *buffer, unsigned long count, struct asus_hotk *hotk,
-+write_led(const char __user *buffer, unsigned long count, struct asus_hotk *hotk,
- char *ledname, int ledmask, int invert)
- {
- int value;
- int led_out = 0;
-
-- if (sscanf(buffer, "%i", &value) == 1)
-+ count = parse_arg(buffer, count, &value);
-+ if (count > 0)
- led_out = value ? 1 : 0;
-
- hotk->status =
-@@ -518,7 +534,7 @@
-
-
- static int
--proc_write_mled(struct file *file, const char *buffer,
-+proc_write_mled(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-@@ -537,7 +553,7 @@
- }
-
- static int
--proc_write_wled(struct file *file, const char *buffer,
-+proc_write_wled(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-@@ -556,7 +572,7 @@
- }
-
- static int
--proc_write_tled(struct file *file, const char *buffer,
-+proc_write_tled(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-@@ -640,13 +656,14 @@
-
-
- static int
--proc_write_lcd(struct file *file, const char *buffer,
-+proc_write_lcd(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- int value;
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-
-- if (sscanf(buffer, "%i", &value) == 1)
-+ count = parse_arg(buffer, count, &value);
-+ if (count > 0)
- set_lcd_state(hotk, value);
- return count;
- }
-@@ -707,17 +724,18 @@
- }
-
- static int
--proc_write_brn(struct file *file, const char *buffer,
-+proc_write_brn(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- int value;
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-
-- if (sscanf(buffer, "%d", &value) == 1) {
-+ count = parse_arg(buffer, count, &value);
-+ if (count > 0) {
- value = (0 < value) ? ((15 < value) ? 15 : value) : 0;
- /* 0 <= value <= 15 */
- set_brightness(value, hotk);
-- } else {
-+ } else if (count < 0) {
- printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
- }
-
-@@ -756,17 +774,17 @@
- * simultaneously, so be warned. See the acpi4asus README for more info.
- */
- static int
--proc_write_disp(struct file *file, const char *buffer,
-+proc_write_disp(struct file *file, const char __user *buffer,
- unsigned long count, void *data)
- {
- int value;
- struct asus_hotk *hotk = (struct asus_hotk *) data;
-
-- if (sscanf(buffer, "%d", &value) == 1)
-+ count = parse_arg(buffer, count, &value);
-+ if (count > 0)
- set_display(value, hotk);
-- else {
-+ else if (count < 0)
- printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
-- }
-
- return count;
- }
-@@ -774,7 +792,7 @@
-
- typedef int (proc_readfunc)(char *page, char **start, off_t off, int count,
- int *eof, void *data);
--typedef int (proc_writefunc)(struct file *file, const char *buffer,
-+typedef int (proc_writefunc)(struct file *file, const char __user *buffer,
- unsigned long count, void *data);
-
- static int
---- 1.30/sound/core/timer.c 2004-07-21 14:22:06 -07:00
-+++ 1.31/sound/core/timer.c 2004-07-21 14:22:06 -07:00
-@@ -1437,7 +1437,7 @@
- err = -ENODEV;
- }
- up(®ister_mutex);
-- if (err >= 0 && copy_from_user(_gstatus, &gstatus, sizeof(gstatus)))
-+ if (err >= 0 && copy_to_user(_gstatus, &gstatus, sizeof(gstatus)))
- err = -EFAULT;
- return err;
- }
---- 1.11/sound/oss/pss.c 2004-07-21 14:25:23 -07:00
-+++ 1.12/sound/oss/pss.c 2004-07-21 14:25:23 -07:00
-@@ -453,20 +453,36 @@
- }
- }
-
--static void arg_to_volume_mono(unsigned int volume, int *aleft)
-+static int set_volume_mono(unsigned __user *p, int *aleft)
- {
- int left;
-+ unsigned volume;
-+ if (get_user(volume, p))
-+ return -EFAULT;
-
-- left = volume & 0x00ff;
-+ left = volume & 0xff;
- if (left > 100)
- left = 100;
- *aleft = left;
-+ return 0;
- }
-
--static void arg_to_volume_stereo(unsigned int volume, int *aleft, int *aright)
-+static int set_volume_stereo(unsigned __user *p, int *aleft, int *aright)
- {
-- arg_to_volume_mono(volume, aleft);
-- arg_to_volume_mono(volume >> 8, aright);
-+ int left, right;
-+ unsigned volume;
-+ if (get_user(volume, p))
-+ return -EFAULT;
-+
-+ left = volume & 0xff;
-+ if (left > 100)
-+ left = 100;
-+ right = (volume >> 8) & 0xff;
-+ if (right > 100)
-+ right = 100;
-+ *aleft = left;
-+ *aright = right;
-+ return 0;
- }
-
- static int ret_vol_mono(int left)
-@@ -479,7 +495,7 @@
- return ((right << 8) | left);
- }
-
--static int call_ad_mixer(pss_confdata *devc,unsigned int cmd, caddr_t arg)
-+static int call_ad_mixer(pss_confdata *devc,unsigned int cmd, void __user *arg)
- {
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return mixer_devs[devc->ad_mixer_dev]->ioctl(devc->ad_mixer_dev, cmd, arg);
-@@ -487,7 +503,7 @@
- return -EINVAL;
- }
-
--static int pss_mixer_ioctl (int dev, unsigned int cmd, caddr_t arg)
-+static int pss_mixer_ioctl (int dev, unsigned int cmd, void __user *arg)
- {
- pss_confdata *devc = mixer_devs[dev]->devc;
- int cmdf = cmd & 0xff;
-@@ -513,33 +529,38 @@
- return call_ad_mixer(devc, cmd, arg);
- else
- {
-- if (*(int *)arg != 0)
-+ int v;
-+ if (get_user(v, (int __user *)arg))
-+ return -EFAULT;
-+ if (v != 0)
- return -EINVAL;
- return 0;
- }
- case SOUND_MIXER_VOLUME:
-- arg_to_volume_stereo(*(unsigned int *)arg, &devc->mixer.volume_l,
-- &devc->mixer.volume_r);
-+ if (set_volume_stereo(arg,
-+ &devc->mixer.volume_l,
-+ &devc->mixer.volume_r))
-+ return -EFAULT;
- set_master_volume(devc, devc->mixer.volume_l,
- devc->mixer.volume_r);
- return ret_vol_stereo(devc->mixer.volume_l,
- devc->mixer.volume_r);
-
- case SOUND_MIXER_BASS:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.bass);
-+ if (set_volume_mono(arg, &devc->mixer.bass))
-+ return -EFAULT;
- set_bass(devc, devc->mixer.bass);
- return ret_vol_mono(devc->mixer.bass);
-
- case SOUND_MIXER_TREBLE:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.treble);
-+ if (set_volume_mono(arg, &devc->mixer.treble))
-+ return -EFAULT;
- set_treble(devc, devc->mixer.treble);
- return ret_vol_mono(devc->mixer.treble);
-
- case SOUND_MIXER_SYNTH:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.synth);
-+ if (set_volume_mono(arg, &devc->mixer.synth))
-+ return -EFAULT;
- set_synth_volume(devc, devc->mixer.synth);
- return ret_vol_mono(devc->mixer.synth);
-
-@@ -549,54 +570,67 @@
- }
- else
- {
-+ int val, and_mask = 0, or_mask = 0;
- /*
- * Return parameters
- */
- switch (cmdf)
- {
--
- case SOUND_MIXER_DEVMASK:
- if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
-- *(int *)arg = 0; /* no mixer devices */
-- return (*(int *)arg |= SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH);
-+ break;
-+ and_mask = ~0;
-+ or_mask = SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH;
-+ break;
-
- case SOUND_MIXER_STEREODEVS:
- if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
-- *(int *)arg = 0; /* no stereo devices */
-- return (*(int *)arg |= SOUND_MASK_VOLUME);
-+ break;
-+ and_mask = ~0;
-+ or_mask = SOUND_MASK_VOLUME;
-+ break;
-
- case SOUND_MIXER_RECMASK:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = 0); /* no record devices */
-+ break;
-
- case SOUND_MIXER_CAPS:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = SOUND_CAP_EXCL_INPUT);
-+ or_mask = SOUND_CAP_EXCL_INPUT;
-+ break;
-
- case SOUND_MIXER_RECSRC:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = 0); /* no record source */
-+ break;
-
- case SOUND_MIXER_VOLUME:
-- return (*(int *)arg = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r));
-+ or_mask = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r);
-+ break;
-
- case SOUND_MIXER_BASS:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.bass));
-+ or_mask = ret_vol_mono(devc->mixer.bass);
-+ break;
-
- case SOUND_MIXER_TREBLE:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.treble));
-+ or_mask = ret_vol_mono(devc->mixer.treble);
-+ break;
-
- case SOUND_MIXER_SYNTH:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.synth));
-+ or_mask = ret_vol_mono(devc->mixer.synth);
-+ break;
- default:
- return -EINVAL;
- }
-+ if (get_user(val, (int __user *)arg))
-+ return -EFAULT;
-+ val &= and_mask;
-+ val |= or_mask;
-+ if (put_user(val, (int __user *)arg))
-+ return -EFAULT;
-+ return val;
- }
- }
-
-@@ -803,7 +837,7 @@
- return 0;
- }
-
--static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, caddr_t arg, int local)
-+static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, void __user *arg, int local)
- {
- copr_buffer *buf;
- copr_msg *mbuf;
---- 1.15/sound/oss/msnd_pinnacle.c 2004-07-21 14:51:56 -07:00
-+++ 1.16/sound/oss/msnd_pinnacle.c 2004-07-21 14:51:56 -07:00
-@@ -809,7 +809,7 @@
-
- static __inline__ int pack_DARQ_to_DARF(register int bank)
- {
-- register int size, n, timeout = 3;
-+ register int size, timeout = 3;
- register WORD wTmp;
- LPDAQD DAQD;
-
-@@ -830,13 +830,10 @@
- /* Read data from the head (unprotected bank 1 access okay
- since this is only called inside an interrupt) */
- outb(HPBLKSEL_1, dev.io + HP_BLKS);
-- if ((n = msnd_fifo_write(
-+ msnd_fifo_write(
- &dev.DARF,
- (char *)(dev.base + bank * DAR_BUFF_SIZE),
-- size, 0)) <= 0) {
-- outb(HPBLKSEL_0, dev.io + HP_BLKS);
-- return n;
-- }
-+ size);
- outb(HPBLKSEL_0, dev.io + HP_BLKS);
-
- return 1;
-@@ -858,21 +855,16 @@
- if (protect) {
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_read(
-+ n = msnd_fifo_read(
- &dev.DAPF,
- (char *)(dev.base + bank_num * DAP_BUFF_SIZE),
-- DAP_BUFF_SIZE, 0)) < 0) {
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ DAP_BUFF_SIZE);
- spin_unlock_irqrestore(&dev.lock, flags);
- } else {
-- if ((n = msnd_fifo_read(
-+ n = msnd_fifo_read(
- &dev.DAPF,
- (char *)(dev.base + bank_num * DAP_BUFF_SIZE),
-- DAP_BUFF_SIZE, 0)) < 0) {
-- return n;
-- }
-+ DAP_BUFF_SIZE);
- }
- if (!n)
- break;
-@@ -899,30 +891,43 @@
- static int dsp_read(char *buf, size_t len)
- {
- int count = len;
-+ char *page = (char *)__get_free_page(PAGE_SIZE);
-+
-+ if (!page)
-+ return -ENOMEM;
-
- while (count > 0) {
-- int n;
-+ int n, k;
- unsigned long flags;
-
-+ k = PAGE_SIZE;
-+ if (k > count)
-+ k = count;
-+
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_read(&dev.DARF, buf, count, 1)) < 0) {
-- printk(KERN_WARNING LOGNAME ": FIFO read error\n");
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ n = msnd_fifo_read(&dev.DARF, page, k);
- spin_unlock_irqrestore(&dev.lock, flags);
-+ if (copy_to_user(buf, page, n)) {
-+ free_page((unsigned long)page);
-+ return -EFAULT;
-+ }
- buf += n;
- count -= n;
-
-+ if (n == k && count)
-+ continue;
-+
- if (!test_bit(F_READING, &dev.flags) && dev.mode & FMODE_READ) {
- dev.last_recbank = -1;
- if (chk_send_dsp_cmd(&dev, HDEX_RECORD_START) == 0)
- set_bit(F_READING, &dev.flags);
- }
-
-- if (dev.rec_ndelay)
-+ if (dev.rec_ndelay) {
-+ free_page((unsigned long)page);
- return count == len ? -EAGAIN : len - count;
-+ }
-
- if (count > 0) {
- set_bit(F_READBLOCK, &dev.flags);
-@@ -931,41 +936,57 @@
- get_rec_delay_jiffies(DAR_BUFF_SIZE)))
- clear_bit(F_READING, &dev.flags);
- clear_bit(F_READBLOCK, &dev.flags);
-- if (signal_pending(current))
-+ if (signal_pending(current)) {
-+ free_page((unsigned long)page);
- return -EINTR;
-+ }
- }
- }
--
-+ free_page((unsigned long)page);
- return len - count;
- }
-
- static int dsp_write(const char *buf, size_t len)
- {
- int count = len;
-+ char *page = (char *)__get_free_page(GFP_KERNEL);
-+
-+ if (!page)
-+ return -ENOMEM;
-
- while (count > 0) {
-- int n;
-+ int n, k;
- unsigned long flags;
-
-+ k = PAGE_SIZE;
-+ if (k > count)
-+ k = count;
-+
-+ if (copy_from_user(page, buf, k)) {
-+ free_page((unsigned long)page);
-+ return -EFAULT;
-+ }
-+
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_write(&dev.DAPF, buf, count, 1)) < 0) {
-- printk(KERN_WARNING LOGNAME ": FIFO write error\n");
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ n = msnd_fifo_write(&dev.DAPF, page, k);
- spin_unlock_irqrestore(&dev.lock, flags);
- buf += n;
- count -= n;
-
-+ if (count && n == k)
-+ continue;
-+
- if (!test_bit(F_WRITING, &dev.flags) && (dev.mode & FMODE_WRITE)) {
- dev.last_playbank = -1;
- if (pack_DAPF_to_DAPQ(1) > 0)
- set_bit(F_WRITING, &dev.flags);
- }
-
-- if (dev.play_ndelay)
-+ if (dev.play_ndelay) {
-+ free_page((unsigned long)page);
- return count == len ? -EAGAIN : len - count;
-+ }
-
- if (count > 0) {
- set_bit(F_WRITEBLOCK, &dev.flags);
-@@ -973,11 +994,14 @@
- &dev.writeblock,
- get_play_delay_jiffies(DAP_BUFF_SIZE));
- clear_bit(F_WRITEBLOCK, &dev.flags);
-- if (signal_pending(current))
-+ if (signal_pending(current)) {
-+ free_page((unsigned long)page);
- return -EINTR;
-+ }
- }
- }
-
-+ free_page((unsigned long)page);
- return len - count;
- }
-
---- 1.2/sound/oss/msnd.h 2004-07-21 14:52:24 -07:00
-+++ 1.3/sound/oss/msnd.h 2004-07-21 14:52:24 -07:00
-@@ -266,8 +266,8 @@
- void msnd_fifo_free(msnd_fifo *f);
- int msnd_fifo_alloc(msnd_fifo *f, size_t n);
- void msnd_fifo_make_empty(msnd_fifo *f);
--int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user);
--int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user);
-+int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len);
-+int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len);
-
- int msnd_wait_TXDE(multisound_dev_t *dev);
- int msnd_wait_HC0(multisound_dev_t *dev);
---- 1.8/sound/oss/msnd.c 2004-07-21 14:52:37 -07:00
-+++ 1.9/sound/oss/msnd.c 2004-07-21 14:52:37 -07:00
-@@ -139,13 +139,10 @@
- f->len = f->tail = f->head = 0;
- }
-
--int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user)
-+int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len)
- {
- int count = 0;
-
-- if (f->len == f->n)
-- return 0;
--
- while ((count < len) && (f->len != f->n)) {
-
- int nwritten;
-@@ -161,11 +158,7 @@
- nwritten = len - count;
- }
-
-- if (user) {
-- if (copy_from_user(f->data + f->tail, buf, nwritten))
-- return -EFAULT;
-- } else
-- isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
-+ isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
-
- count += nwritten;
- buf += nwritten;
-@@ -177,13 +170,10 @@
- return count;
- }
-
--int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user)
-+int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len)
- {
- int count = 0;
-
-- if (f->len == 0)
-- return f->len;
--
- while ((count < len) && (f->len > 0)) {
-
- int nread;
-@@ -199,11 +189,7 @@
- nread = len - count;
- }
-
-- if (user) {
-- if (copy_to_user(buf, f->data + f->head, nread))
-- return -EFAULT;
-- } else
-- isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
-+ isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
-
- count += nread;
- buf += nread;
+++ /dev/null
---- 1.13/drivers/net/eql.c 2004-07-21 03:13:40 -07:00
-+++ 1.14/drivers/net/eql.c 2004-07-21 03:13:40 -07:00
-@@ -495,6 +495,8 @@
- return -EFAULT;
-
- slave_dev = dev_get_by_name(sc.slave_name);
-+ if (!slave_dev)
-+ return -ENODEV;
-
- ret = -EINVAL;
-
-@@ -527,11 +529,13 @@
- if (copy_from_user(&sc, scp, sizeof (slave_config_t)))
- return -EFAULT;
-
-- eql = dev->priv;
- slave_dev = dev_get_by_name(sc.slave_name);
-+ if (!slave_dev)
-+ return -ENODEV;
-
- ret = -EINVAL;
-
-+ eql = dev->priv;
- spin_lock_bh(&eql->queue.lock);
- if (eql_is_slave(slave_dev)) {
- slave = __eql_find_slave_dev(&eql->queue, slave_dev);
---- 1.14/drivers/net/eql.c 2004-07-21 03:13:33 -07:00
-+++ 1.15/drivers/net/eql.c 2004-07-21 03:13:33 -07:00
-@@ -499,6 +499,8 @@
- return -ENODEV;
-
- ret = -EINVAL;
-+ if (!slave_dev)
-+ return ret;
-
- spin_lock_bh(&eql->queue.lock);
- if (eql_is_slave(slave_dev)) {
-@@ -534,6 +536,8 @@
- return -ENODEV;
-
- ret = -EINVAL;
-+ if (!slave_dev)
-+ return ret;
-
- eql = dev->priv;
- spin_lock_bh(&eql->queue.lock);
+++ /dev/null
-Subject: Prevent ICMP crash in netfilter logging
-From: Olaf Kirch <okir@suse.de>
-References: 46016
-
-This patch fixes a remotely triggerable crash in the netfilter code
-when looking at ICMP unreachables. It dies when trying to copy
-BIGNUM bytes...
-
-Index: linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c
-===================================================================
---- linux-2.6.5.orig/net/ipv4/netfilter/ipt_LOG.c 2004-02-19 11:36:37.000000000 +0100
-+++ linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c 2004-09-24 15:48:54.000000000 +0200
-@@ -71,7 +71,7 @@
- printk("FRAG:%u ", ntohs(iph.frag_off) & IP_OFFSET);
-
- if ((info->logflags & IPT_LOG_IPOPT)
-- && iph.ihl * 4 != sizeof(struct iphdr)) {
-+ && iph.ihl * 4 > sizeof(struct iphdr)) {
- unsigned char opt[4 * 15 - sizeof(struct iphdr)];
- unsigned int i, optsize;
-
-@@ -138,7 +138,7 @@
- printk("URGP=%u ", ntohs(tcph.urg_ptr));
-
- if ((info->logflags & IPT_LOG_TCPOPT)
-- && tcph.doff * 4 != sizeof(struct tcphdr)) {
-+ && tcph.doff * 4 > sizeof(struct tcphdr)) {
- unsigned char opt[4 * 15 - sizeof(struct tcphdr)];
- unsigned int i, optsize;
-
-Index: linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c
-===================================================================
---- linux-2.6.5.orig/net/ipv6/netfilter/ip6t_LOG.c 2004-09-24 15:47:00.000000000 +0200
-+++ linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c 2004-09-24 15:48:35.000000000 +0200
-@@ -188,7 +188,7 @@
- printk("URGP=%u ", ntohs(tcph->urg_ptr));
-
- if ((info->logflags & IP6T_LOG_TCPOPT)
-- && tcph->doff * 4 != sizeof(struct tcphdr)) {
-+ && tcph->doff * 4 > sizeof(struct tcphdr)) {
- unsigned int i;
-
- /* Max length: 127 "OPT (" 15*4*2chars ") " */
+++ /dev/null
-diff -Nru a/include/asm-i386/i387.h b/include/asm-i386/i387.h
---- a/include/asm-i386/i387.h 2004-05-06 12:26:10 -07:00
-+++ b/include/asm-i386/i387.h 2004-06-12 19:12:23 -07:00
-@@ -51,7 +51,7 @@
- #define __clear_fpu( tsk ) \
- do { \
- if ((tsk)->thread_info->status & TS_USEDFPU) { \
-- asm volatile("fwait"); \
-+ asm volatile("fnclex ; fwait"); \
- (tsk)->thread_info->status &= ~TS_USEDFPU; \
- stts(); \
- } \
-diff -Nru a/include/asm-x86_64/i387.h b/include/asm-x86_64/i387.h
---- a/include/asm-x86_64/i387.h 2004-06-13 20:43:56.742530792 +0100
-+++ a/include/asm-x86_64/i387.h 2004-06-13 20:42:59.200278544 +0100
-@@ -46,7 +46,7 @@
-
- #define clear_fpu(tsk) do { \
- if ((tsk)->thread_info->status & TS_USEDFPU) { \
-- asm volatile("fwait"); \
-+ asm volatile("fnclex; fwait"); \
- (tsk)->thread_info->status &= ~TS_USEDFPU; \
- stts(); \
- } \
+++ /dev/null
---- net/ipv4/netfilter/ip_tables.c.orig 2004-04-04 05:36:47.000000000 +0200
-+++ net/ipv4/netfilter/ip_tables.c 2004-06-24 21:24:26.000000000 +0200
-@@ -1461,7 +1461,7 @@
- int *hotdrop)
- {
- /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
-- char opt[60 - sizeof(struct tcphdr)];
-+ u_int8_t opt[60 - sizeof(struct tcphdr)];
- unsigned int i;
-
- duprintf("tcp_match: finding option\n");
+++ /dev/null
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2004/07/02 18:48:26-07:00 chrisw@osdl.org
-# [PATCH] check attr updates in /proc
-#
-# Any proc entry with default proc_file_inode_operations allow unauthorized
-# attribute updates. This is very dangerous for proc entries that rely
-# solely on file permissions for open/read/write.
-#
-# Signed-off-by: Chris Wright <chrisw@osdl.org>
-# Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-#
-# fs/proc/generic.c
-# 2004/07/02 15:47:55-07:00 chrisw@osdl.org +14 -7
-# check attr updates in /proc
-#
-diff -Nru a/fs/proc/generic.c b/fs/proc/generic.c
---- a/fs/proc/generic.c 2004-07-08 17:03:20 -07:00
-+++ b/fs/proc/generic.c 2004-07-08 17:03:20 -07:00
-@@ -231,14 +231,21 @@
- static int proc_notify_change(struct dentry *dentry, struct iattr *iattr)
- {
- struct inode *inode = dentry->d_inode;
-- int error = inode_setattr(inode, iattr);
-- if (!error) {
-- struct proc_dir_entry *de = PDE(inode);
-- de->uid = inode->i_uid;
-- de->gid = inode->i_gid;
-- de->mode = inode->i_mode;
-- }
-+ struct proc_dir_entry *de = PDE(inode);
-+ int error;
-
-+ error = inode_change_ok(inode, iattr);
-+ if (error)
-+ goto out;
-+
-+ error = inode_setattr(inode, iattr);
-+ if (error)
-+ goto out;
-+
-+ de->uid = inode->i_uid;
-+ de->gid = inode->i_gid;
-+ de->mode = inode->i_mode;
-+out:
- return error;
- }
-
+++ /dev/null
-
-From: Roger Luethi <rl@hellgate.ch>
-
-If you win the race with a starting process, you can read its environment.
-
-Signed-off-by: Andrew Morton <akpm@osdl.org>
----
-
- 25-akpm/fs/proc/base.c | 2 ++
- 1 files changed, 2 insertions(+)
-
-diff -puN fs/proc/base.c~proc_pid_cmdline-race-fix fs/proc/base.c
---- 25/fs/proc/base.c~proc_pid_cmdline-race-fix 2004-08-05 11:28:21.915442360 -0700
-+++ 25-akpm/fs/proc/base.c 2004-08-05 11:28:21.919441752 -0700
-@@ -340,6 +340,8 @@ static int proc_pid_cmdline(struct task_
- struct mm_struct *mm = get_task_mm(task);
- if (!mm)
- goto out;
-+ if (!mm->arg_end)
-+ goto out; /* Shh! No looking before we're done */
-
- len = mm->arg_end - mm->arg_start;
-
-_
+++ /dev/null
-Index: linux-2.6.5/fs/devpts/inode.c
-===================================================================
---- linux-2.6.5.orig/fs/devpts/inode.c
-+++ linux-2.6.5/fs/devpts/inode.c
-@@ -178,9 +178,13 @@ struct tty_struct *devpts_get_tty(int nu
- {
- struct dentry *dentry = get_node(number);
- struct tty_struct *tty;
--
-- tty = (IS_ERR(dentry) || !dentry->d_inode) ? NULL :
-- dentry->d_inode->u.generic_ip;
-+
-+ tty = NULL;
-+ if (!IS_ERR(dentry)) {
-+ if (dentry->d_inode)
-+ tty = dentry->d_inode->u.generic_ip;
-+ dput(dentry);
-+ }
-
- up(&devpts_root->d_inode->i_sem);
-
+++ /dev/null
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-# 2004/07/02 20:55:04-07:00 chrisw@osdl.org
-# [PATCH] chown permission check fix for ATTR_GID
-#
-# SuSE discovered this problem with chown and ATTR_GID. Make sure user
-# is authorized to change the group, CAN-2004-0497.
-#
-# fs/attr.c
-# 2004/07/02 09:07:32-07:00 chrisw@osdl.org +2 -1
-# chown permission check fix for ATTR_GID
-#
-diff -Nru a/fs/attr.c b/fs/attr.c
---- a/fs/attr.c 2004-07-08 16:35:57 -07:00
-+++ b/fs/attr.c 2004-07-08 16:35:57 -07:00
-@@ -35,7 +35,8 @@
-
- /* Make sure caller can chgrp. */
- if ((ia_valid & ATTR_GID) &&
-- (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid) &&
-+ (current->fsuid != inode->i_uid ||
-+ (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid)) &&
- !capable(CAP_CHOWN))
- goto error;
-
+++ /dev/null
-MD5 642af5ab5e1fc63685fde85e9ae601e4 linux-2.4.23.tar.bz2 29832609
-MD5 138a6731c7d866129dc94088c3017f7d 2.4.23aa3.bz2 2057323
-MD5 6fd4de1646ab0d47cf74a1553f5f7f6f aa-sources-2.4.23-CAN-2004-0415.patch 89286
-MD5 be015fe9cd8ce4a650edb75071d50db4 aa-sources-2.4.23-CAN-2004-0814.patch 82027
+++ /dev/null
-MD5 9a76bf64c1151369b250f967d83077aa linux-2.6.5.tar.bz2 34684611
-MD5 8cad9f09ad64a739ec62644cba23dbe5 2.6.5-aa5.bz2 128123
-MD5 af825f9160815682615dd8848c1eb573 linux-2.6.5-CAN-2004-0415.patch 136298
-MD5 49a754f5246ea4ecfa74c685dc52f7ee aa-sources-2.6.5-CAN-2004-0814.patch 130825
+++ /dev/null
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-
-<pkgmetadata>
- <herd>x86-kernel</herd>
- <maintainer>
- <email>x86-kernel@gentoo.org</email>
- <name>x86 kernel team</name>
- <description>Actively maintained</description>
- </maintainer>
- <longdescription>
- Andrea Arcangeli's kernel patchset. Good for servers. Has excellent hardware support.
- </longdescription>
-</pkgmetadata>
projects / gentoo.git / commitdiff