Security bump for CAN-2004-1235, bug #77025.
authorTony Vroon <chainsaw@gentoo.org>
Sun, 9 Jan 2005 00:55:21 +0000 (00:55 +0000)
committerTony Vroon <chainsaw@gentoo.org>
Sun, 9 Jan 2005 00:55:21 +0000 (00:55 +0000)
sys-kernel/development-sources/ChangeLog
sys-kernel/development-sources/Manifest
sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild [moved from sys-kernel/development-sources/development-sources-2.6.10.ebuild with 75% similarity]
sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch [new file with mode: 0644]
sys-kernel/development-sources/files/digest-development-sources-2.6.10-r1 [moved from sys-kernel/development-sources/files/digest-development-sources-2.6.10 with 100% similarity]

index c7e68c898f13251d063238195ffc5b0dd9600e3f..eca66b0dd40260f4d9f1144680f7e823a66ec8eb 100644 (file)
@@ -1,6 +1,14 @@
 # ChangeLog for sys-kernel/development-sources
 # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/ChangeLog,v 1.157 2005/01/08 14:08:28 chainsaw Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/ChangeLog,v 1.158 2005/01/09 00:55:21 chainsaw Exp $
+
+*development-sources-2.6.10-r1 (09 Jan 2005)
+
+  09 Jan 2005; Tony Vroon <chainsaw@gentoo.org>
+  +files/development-sources-2.6.10-CAN-2004-1235.patch,
+  +development-sources-2.6.10-r1.ebuild, -development-sources-2.6.10.ebuild:
+  Security bump; patch for kernel uselib() privilege elevation
+  (CAN-2004-1235), see bug #77025.
 
   08 Jan 2005; Tony Vroon <chainsaw@gentoo.org>
   development-sources-2.6.10.ebuild, -development-sources-2.6.10_rc1.ebuild,
index 7c3efcc4aefd842ae010478e5ee1b0e9b4802db0..dd20d392066bd823a74e8d675ed8c420c207a0c4 100644 (file)
@@ -1,14 +1,15 @@
 MD5 dd80fcc2daf6c0f6f7ea378678f44494 development-sources-2.6.6.ebuild 997
 MD5 81d5f69017302f45b0dc35e24ae28170 development-sources-2.6.8.1.ebuild 559
 MD5 e1468b549b4d513ab0faad73af6bdb3c development-sources-2.6.5.ebuild 1394
+MD5 6a96b8d30d064a97d170d3147cc796e0 development-sources-2.6.10-r1.ebuild 602
 MD5 bc7b1ae1fd08775d9252c7eb48a0453b development-sources-2.6.7.ebuild 1003
-MD5 f656f73e369ba4f003fa3649456377f2 development-sources-2.6.10.ebuild 562
 MD5 b5aa40065c3d3094825824a4c2b964ff development-sources-2.6.9.ebuild 651
-MD5 3d5275d7252943bdfd11fd6711678b82 ChangeLog 28869
+MD5 037d5daa82c540f3d8bd497eb67766c4 ChangeLog 29196
 MD5 5caccd9193acfe5a3a07ea88861cb11b metadata.xml 660
 MD5 a09d4ddd7fe62bbf298879c6450cb6e7 files/digest-development-sources-2.6.5 208
 MD5 214f14a8b49844fc44f74d8ab84019de files/digest-development-sources-2.6.6 137
 MD5 23e1b75850b5a41b95c65e7771f39c48 files/digest-development-sources-2.6.7 137
 MD5 414403f6046e06086e6d2fb0e2d5be60 files/digest-development-sources-2.6.9 135
-MD5 78b4470aebd0088d0560ca3f88387b83 files/digest-development-sources-2.6.10 67
+MD5 78b4470aebd0088d0560ca3f88387b83 files/digest-development-sources-2.6.10-r1 67
+MD5 cd0a7533c43364e377348613c6d76bb7 files/development-sources-2.6.10-CAN-2004-1235.patch 9736
 MD5 18bed04a1b45de515096089cc10913ec files/digest-development-sources-2.6.8.1 68
similarity index 75%
rename from sys-kernel/development-sources/development-sources-2.6.10.ebuild
rename to sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild
index 95bc6aab4195014a1848ad35b91768ae14e132f2..ac8845d3cc8ba2802bd95605c31f82e31e4000de 100644 (file)
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/development-sources-2.6.10.ebuild,v 1.3 2005/01/08 14:08:28 chainsaw Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild,v 1.1 2005/01/09 00:55:21 chainsaw Exp $
 
 K_NOUSENAME="yes"
 K_NOSETEXTRAVERSION="yes"
@@ -12,7 +12,7 @@ detect_version
 DESCRIPTION="Full sources for the vanilla 2.6 kernel tree"
 HOMEPAGE="http://www.kernel.org/"
 SRC_URI="${KERNEL_URI} ${ARCH_URI}"
-UNIPATCH_LIST="${ARCH_PATCH}"
+UNIPATCH_LIST="${ARCH_PATCH} ${FILESDIR}/${P}-CAN-2004-1235.patch"
 
 KEYWORDS="x86 ~ia64 ~ppc ~amd64 ~alpha"
 IUSE=""
diff --git a/sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch b/sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch
new file mode 100644 (file)
index 0000000..6095e84
--- /dev/null
@@ -0,0 +1,303 @@
+diff -ur linux-2.6.10/arch/mips/kernel/irixelf.c linux-2.6.10.plasmaroo/arch/mips/kernel/irixelf.c
+--- linux-2.6.10/arch/mips/kernel/irixelf.c    2004-12-24 21:35:50.000000000 +0000
++++ linux-2.6.10.plasmaroo/arch/mips/kernel/irixelf.c  2005-01-07 15:36:00.383356800 +0000
+@@ -127,7 +127,7 @@
+       end = PAGE_ALIGN(end);
+       if (end <= start)
+               return;
+-      do_brk(start, end - start);
++      do_brk_locked(start, end - start);
+ }
+ 
+ 
+@@ -375,7 +375,7 @@
+ 
+       /* Map the last of the bss segment */
+       if (last_bss > len) {
+-              do_brk(len, (last_bss - len));
++              do_brk_locked(len, (last_bss - len));
+       }
+       kfree(elf_phdata);
+ 
+@@ -562,7 +562,7 @@
+       unsigned long v;
+       struct prda *pp;
+ 
+-      v =  do_brk (PRDA_ADDRESS, PAGE_SIZE);
++      v =  do_brk_locked (PRDA_ADDRESS, PAGE_SIZE);
+ 
+       if (v < 0)
+               return;
+@@ -853,7 +853,7 @@
+       len = (elf_phdata->p_filesz + elf_phdata->p_vaddr+ 0xfff) & 0xfffff000;
+       bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+       if (bss > len)
+-        do_brk(len, bss-len);
++        do_brk_locked(len, bss-len);
+       kfree(elf_phdata);
+       return 0;
+ }
+diff -ur linux-2.6.10/arch/sparc64/kernel/binfmt_aout32.c linux-2.6.10.plasmaroo/arch/sparc64/kernel/binfmt_aout32.c
+--- linux-2.6.10/arch/sparc64/kernel/binfmt_aout32.c   2004-12-24 21:34:45.000000000 +0000
++++ linux-2.6.10.plasmaroo/arch/sparc64/kernel/binfmt_aout32.c 2005-01-07 15:36:00.432349352 +0000
+@@ -49,7 +49,7 @@
+       end = PAGE_ALIGN(end);
+       if (end <= start)
+               return;
+-      do_brk(start, end - start);
++      do_brk_locked(start, end - start);
+ }
+ 
+ /*
+@@ -246,10 +246,10 @@
+       if (N_MAGIC(ex) == NMAGIC) {
+               loff_t pos = fd_offset;
+               /* Fuck me plenty... */
+-              error = do_brk(N_TXTADDR(ex), ex.a_text);
++              error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+               bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex),
+                         ex.a_text, &pos);
+-              error = do_brk(N_DATADDR(ex), ex.a_data);
++              error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+               bprm->file->f_op->read(bprm->file, (char __user *)N_DATADDR(ex),
+                         ex.a_data, &pos);
+               goto beyond_if;
+@@ -257,7 +257,7 @@
+ 
+       if (N_MAGIC(ex) == OMAGIC) {
+               loff_t pos = fd_offset;
+-              do_brk(N_TXTADDR(ex) & PAGE_MASK,
++              do_brk_locked(N_TXTADDR(ex) & PAGE_MASK,
+                       ex.a_text+ex.a_data + PAGE_SIZE - 1);
+               bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex),
+                         ex.a_text+ex.a_data, &pos);
+@@ -272,7 +272,7 @@
+ 
+               if (!bprm->file->f_op->mmap) {
+                       loff_t pos = fd_offset;
+-                      do_brk(0, ex.a_text+ex.a_data);
++                      do_brk_locked(0, ex.a_text+ex.a_data);
+                       bprm->file->f_op->read(bprm->file,
+                                 (char __user *)N_TXTADDR(ex),
+                                 ex.a_text+ex.a_data, &pos);
+@@ -389,7 +389,7 @@
+       len = PAGE_ALIGN(ex.a_text + ex.a_data);
+       bss = ex.a_text + ex.a_data + ex.a_bss;
+       if (bss > len) {
+-              error = do_brk(start_addr + len, bss - len);
++              error = do_brk_locked(start_addr + len, bss - len);
+               retval = error;
+               if (error != start_addr + len)
+                       goto out;
+diff -Nur linux-2.6.10/arch/x86_64/ia32/ia32_aout.c linux-2.6.10.plasmaroo/arch/x86_64/ia32/ia32_aout.c
+--- linux-2.6.10/arch/x86_64/ia32/ia32_aout.c  2005-01-03 16:17:04.000000000 -0200
++++ linux-2.6.10.plasmaroo/arch/x86_64/ia32/ia32_aout.c        2005-01-03 16:46:53.846823360 -0200
+@@ -115,7 +115,7 @@
+       end = PAGE_ALIGN(end);
+       if (end <= start)
+               return;
+-      do_brk(start, end - start);
++      do_brk_locked(start, end - start);
+ }
+ 
+ #if CORE_DUMP
+@@ -325,7 +325,7 @@
+               pos = 32;
+               map_size = ex.a_text+ex.a_data;
+ 
+-              error = do_brk(text_addr & PAGE_MASK, map_size);
++              error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+               if (error != (text_addr & PAGE_MASK)) {
+                       send_sig(SIGKILL, current, 0);
+                       return error;
+@@ -361,7 +361,7 @@
+ 
+               if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
+                       loff_t pos = fd_offset;
+-                      do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
++                      do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+                       bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+                                       ex.a_text+ex.a_data, &pos);
+                       flush_icache_range((unsigned long) N_TXTADDR(ex),
+@@ -470,7 +470,7 @@
+               }
+ #endif
+ 
+-              do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
++              do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+               
+               file->f_op->read(file, (char *)start_addr,
+                       ex.a_text + ex.a_data, &pos);
+@@ -494,7 +494,7 @@
+       len = PAGE_ALIGN(ex.a_text + ex.a_data);
+       bss = ex.a_text + ex.a_data + ex.a_bss;
+       if (bss > len) {
+-              error = do_brk(start_addr + len, bss - len);
++              error = do_brk_locked(start_addr + len, bss - len);
+               retval = error;
+               if (error != start_addr + len)
+                       goto out;
+diff -ur linux-2.6.10/fs/binfmt_aout.c linux-2.6.10.plasmaroo/fs/binfmt_aout.c
+--- linux-2.6.10/fs/binfmt_aout.c      2004-12-24 21:35:50.000000000 +0000
++++ linux-2.6.10.plasmaroo/fs/binfmt_aout.c    2005-01-07 15:36:00.000000000 +0000
+@@ -50,7 +50,7 @@
+       start = PAGE_ALIGN(start);
+       end = PAGE_ALIGN(end);
+       if (end > start) {
+-              unsigned long addr = do_brk(start, end - start);
++              unsigned long addr = do_brk_locked(start, end - start);
+               if (BAD_ADDR(addr))
+                       return addr;
+       }
+@@ -323,10 +323,10 @@
+               loff_t pos = fd_offset;
+               /* Fuck me plenty... */
+               /* <AOL></AOL> */
+-              error = do_brk(N_TXTADDR(ex), ex.a_text);
++              error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+               bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+                         ex.a_text, &pos);
+-              error = do_brk(N_DATADDR(ex), ex.a_data);
++              error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+               bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+                         ex.a_data, &pos);
+               goto beyond_if;
+@@ -347,7 +347,7 @@
+               map_size = ex.a_text+ex.a_data;
+ #endif
+ 
+-              error = do_brk(text_addr & PAGE_MASK, map_size);
++              error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+               if (error != (text_addr & PAGE_MASK)) {
+                       send_sig(SIGKILL, current, 0);
+                       return error;
+@@ -382,7 +382,7 @@
+ 
+               if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
+                       loff_t pos = fd_offset;
+-                      do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
++                      do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+                       bprm->file->f_op->read(bprm->file,
+                                       (char __user *)N_TXTADDR(ex),
+                                       ex.a_text+ex.a_data, &pos);
+@@ -488,7 +488,7 @@
+                       error_time = jiffies;
+               }
+ 
+-              do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
++              do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+               
+               file->f_op->read(file, (char __user *)start_addr,
+                       ex.a_text + ex.a_data, &pos);
+@@ -512,7 +512,7 @@
+       len = PAGE_ALIGN(ex.a_text + ex.a_data);
+       bss = ex.a_text + ex.a_data + ex.a_bss;
+       if (bss > len) {
+-              error = do_brk(start_addr + len, bss - len);
++              error = do_brk_locked(start_addr + len, bss - len);
+               retval = error;
+               if (error != start_addr + len)
+                       goto out;
+diff -ur linux-2.6.10/fs/binfmt_elf.c linux-2.6.10.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.10/fs/binfmt_elf.c       2004-12-24 21:34:33.000000000 +0000
++++ linux-2.6.10.plasmaroo/fs/binfmt_elf.c     2005-01-07 15:36:00.000000000 +0000
+@@ -88,7 +88,7 @@
+       start = ELF_PAGEALIGN(start);
+       end = ELF_PAGEALIGN(end);
+       if (end > start) {
+-              unsigned long addr = do_brk(start, end - start);
++              unsigned long addr = do_brk_locked(start, end - start);
+               if (BAD_ADDR(addr))
+                       return addr;
+       }
+@@ -408,7 +408,7 @@
+ 
+       /* Map the last of the bss segment */
+       if (last_bss > elf_bss) {
+-              error = do_brk(elf_bss, last_bss - elf_bss);
++              error = do_brk_locked(elf_bss, last_bss - elf_bss);
+               if (BAD_ADDR(error))
+                       goto out_close;
+       }
+@@ -448,7 +448,7 @@
+               goto out;
+       }
+ 
+-      do_brk(0, text_data);
++      do_brk_locked(0, text_data);
+       if (!interpreter->f_op || !interpreter->f_op->read)
+               goto out;
+       if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
+@@ -456,7 +456,7 @@
+       flush_icache_range((unsigned long)addr,
+                          (unsigned long)addr + text_data);
+ 
+-      do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
++      do_brk_locked(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
+               interp_ex->a_bss);
+       elf_entry = interp_ex->a_entry;
+ 
+@@ -1025,7 +1025,7 @@
+       len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
+       bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+       if (bss > len)
+-              do_brk(len, bss - len);
++              do_brk_locked(len, bss - len);
+       error = 0;
+ 
+ out_free_ph:
+diff -ur linux-2.6.10/include/linux/mm.h linux-2.6.10.plasmaroo/include/linux/mm.h
+--- linux-2.6.10/include/linux/mm.h    2004-12-24 21:33:50.000000000 +0000
++++ linux-2.6.10.plasmaroo/include/linux/mm.h  2005-01-07 15:36:00.000000000 +0000
+@@ -704,6 +704,7 @@
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
++extern unsigned long do_brk_locked(unsigned long, unsigned long);
+ 
+ /* filemap.c */
+ extern unsigned long page_unuse(struct page *);
+diff -ur linux-2.6.10/mm/mmap.c linux-2.6.10.plasmaroo/mm/mmap.c
+--- linux-2.6.10/mm/mmap.c     2004-12-24 21:35:00.000000000 +0000
++++ linux-2.6.10.plasmaroo/mm/mmap.c   2005-01-07 15:36:04.000000000 +0000
+@@ -1826,6 +1826,20 @@
+ 
+ EXPORT_SYMBOL(do_brk);
+ 
++/* locking version of do_brk. */
++unsigned long do_brk_locked(unsigned long addr, unsigned long len)
++{
++      unsigned long ret;
++
++      down_write(&current->mm->mmap_sem);
++      ret = do_brk(addr, len);
++      up_write(&current->mm->mmap_sem);
++
++      return ret;
++}
++
++EXPORT_SYMBOL(do_brk_locked);
++
+ /* Release all mmaps. */
+ void exit_mmap(struct mm_struct *mm)
+ {
+@@ -1952,3 +1966,4 @@
+       }
+       return new_vma;
+ }
++
+diff -ur linux-2.6.10/mm/nommu.c linux-2.6.10.plasmaroo/mm/nommu.c
+--- linux-2.6.10/mm/nommu.c    2004-12-24 21:35:25.000000000 +0000
++++ linux-2.6.10.plasmaroo/mm/nommu.c  2005-01-07 15:30:24.000000000 +0000
+@@ -557,6 +557,11 @@
+       return -ENOMEM;
+ }
+ 
++unsigned long do_brk_locked(unsigned long addr, unsigned long len)
++{
++      return -ENOMEM;
++}
++
+ struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr)
+ {
+       return NULL;