Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452 and...
authorTim Yamin <plasmaroo@gentoo.org>
Sat, 27 Nov 2004 18:08:56 +0000 (18:08 +0000)
committerTim Yamin <plasmaroo@gentoo.org>
Sat, 27 Nov 2004 18:08:56 +0000 (18:08 +0000)
16 files changed:
sys-kernel/xbox-sources/ChangeLog
sys-kernel/xbox-sources/Manifest
sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 [deleted file]
sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28-r1 [moved from sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28 with 100% similarity]
sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r5 [moved from sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r4 with 100% similarity]
sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch [deleted file]
sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch [deleted file]
sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch [deleted file]
sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch [deleted file]
sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch [deleted file]
sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch [new file with mode: 0644]
sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch [new file with mode: 0644]
sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch [new file with mode: 0644]
sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild [deleted file]
sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild [moved from sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild with 80% similarity]
sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild [moved from sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild with 84% similarity]

index 3b448943591429e730147274b553b788dd845f33..e1d32cbbe0ca9ec7a23e92c75ad22e186a856f86 100644 (file)
@@ -1,6 +1,17 @@
 # ChangeLog for sys-kernel/xbox-sources
 # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.19 2004/11/24 14:13:57 chrb Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.20 2004/11/27 18:08:56 plasmaroo Exp $
+
+*xbox-sources-2.4.28-r1 (27 Nov 2004)
+
+  27 Nov 2004; <plasmaroo@gentoo.org> -xbox-sources-2.4.27-r5.ebuild,
+  +xbox-sources-2.4.28-r1.ebuild, -xbox-sources-2.4.28.ebuild,
+  -xbox-sources-2.6.8.1-r4.ebuild, +xbox-sources-2.6.8.1-r5.ebuild,
+  +files/xbox-sources-2.4.28.binfmt_a.out.patch,
+  +files/xbox-sources-2.6.8.1.binfmt_a.out.patch,
+  +files/xbox-sources.AF_UNIX.patch:
+  Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452
+  and #72317.
 
 *xbox-sources-2.4.28 (24 Nov 2004)
 
index 637b27a2d965516adad8b2fc9ba3683247f41698..23e8b79b88f5298ba90c73bc7ed23238b95550a5 100644 (file)
@@ -1,17 +1,13 @@
-MD5 9e9a4a71d22e9ff0abfc7cdcba3519ba ChangeLog 5498
+MD5 fb5e3ca9016ccc95c16beab574956ee1 ChangeLog 5973
+MD5 1745c9969e718a82d97dd130d7f5ef7b xbox-sources-2.6.8.1-r5.ebuild 1095
 MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351
-MD5 c49f123b75ad53f6b50ebf38489c05f2 xbox-sources-2.4.27-r5.ebuild 1015
-MD5 90f4d74240992ee1dd8410bf8a326f02 xbox-sources-2.6.8.1-r4.ebuild 1025
-MD5 e61e335899fc80f9cf1ed23b652d4b74 xbox-sources-2.4.28.ebuild 675
-MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r5 302
-MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r4 227
-MD5 2b3ddb8b8b15f8da35ade38544b57857 files/xbox-sources-2.4.27.XDRWrapFix.patch 1499
-MD5 d4a740ae56c2049247083af387a22a85 files/xbox-sources-2.4.26.CAN-2004-0394.patch 350
-MD5 d1ccc2047be533c992f67270a150a210 files/xbox-sources-2.4.27.cmdlineLeak.patch 388
+MD5 04be120a1c8b3c3ad58858c1109791b0 xbox-sources-2.4.28-r1.ebuild 720
+MD5 025c80544aef14ce3a49024d791c5596 files/xbox-sources-2.6.8.1.binfmt_a.out.patch 1763
+MD5 b0a1f80aff51d6601e8924329023b241 files/xbox-sources.AF_UNIX.patch 515
 MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348
-MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281
-MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28 226
-MD5 915e8d7a0618736caa44d96968015467 files/xbox-sources-2.4.27.binfmt_elf.patch 2346
-MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/xbox-sources-2.4.27.smbfs.patch 3434
 MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572
+MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281
+MD5 b9a94233e1457787352e5f85e3e3582d files/xbox-sources-2.4.28.binfmt_a.out.patch 2009
 MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309
+MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r5 227
+MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28-r1 226
diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5
deleted file mode 100644 (file)
index aca272e..0000000
+++ /dev/null
@@ -1,4 +0,0 @@
-MD5 59a2e6fde1d110e2ffa20351ac8b4d9e linux-2.4.27.tar.bz2 30898453
-MD5 6236760189c6c17affecb47768bf143c xbox-sources-2.4.27-r0.patch.bz2 133155
-MD5 a68b51962e4bd9349749d2ca167e97ab xbox-sources-2.4.27.squashfs.patch.bz2 13033
-MD5 4b99df79dcc18b17eb41489b96ff9689 linux-2.4.27-CAN-2004-0814.patch 81529
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch
deleted file mode 100644 (file)
index 273f1a5..0000000
+++ /dev/null
@@ -1,11 +0,0 @@
---- linux-2.4.22-oM3-orig/kernel/panic.c       Tue Mar 30 15:37:18 2004
-+++ linux-2.4.22-oM3-mod/kernel/panic.c        Mon May 17 18:44:01 2004
-@@ -51,7 +51,7 @@
- 
-       bust_spinlocks(1);
-       va_start(args, fmt);
--      vsprintf(buf, fmt, args);
-+      vsnprintf(buf, sizeof(buf), fmt, args);
-       va_end(args);
-       printk(KERN_EMERG "Kernel panic: %s\n",buf);
-       if (in_interrupt())
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch
deleted file mode 100644 (file)
index 9a336ab..0000000
+++ /dev/null
@@ -1,48 +0,0 @@
-# This is a BitKeeper generated diff -Nru style patch.
-#
-# ChangeSet
-#   2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au 
-#   [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
-#   
-#   xdr_argsize_check needs to cope with the possibility that the
-#   pointer has wrapped and could be below buf->base.
-#   
-#   Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
-#   
-#   ### Diffstat output
-#    ./fs/nfsd/nfs3xdr.c         |    2 +-
-#    ./include/linux/nfsd/xdr3.h |    2 +-
-#    2 files changed, 2 insertions(+), 2 deletions(-)
-# 
-# fs/nfsd/nfs3xdr.c
-#   2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
-#   Fixed possibly xdr parsing error if write size exceed 2^31
-# 
-# include/linux/nfsd/xdr3.h
-#   2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
-#   Fixed possibly xdr parsing error if write size exceed 2^31
-# 
-diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
---- a/fs/nfsd/nfs3xdr.c        2004-09-06 11:20:28 -07:00
-+++ b/fs/nfsd/nfs3xdr.c        2004-09-06 11:20:28 -07:00
-@@ -273,7 +273,7 @@
- {
-       struct svc_buf  *buf = &rqstp->rq_argbuf;
- 
--      return p - buf->base <= buf->buflen;
-+      return p >= buf->base && p <= buf->base + buf->buflen ;
- }
- 
- static inline int
-diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
---- a/include/linux/nfsd/xdr3.h        2004-09-06 11:20:28 -07:00
-+++ b/include/linux/nfsd/xdr3.h        2004-09-06 11:20:28 -07:00
-@@ -41,7 +41,7 @@
-       __u32                   count;
-       int                     stable;
-       __u8 *                  data;
--      int                     len;
-+      __u32                   len;
- };
- 
- struct nfsd3_createargs {
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch
deleted file mode 100644 (file)
index 9f4f44e..0000000
+++ /dev/null
@@ -1,85 +0,0 @@
-diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
---- linux-2.4.27/fs/binfmt_elf.c       2004-04-14 14:05:40.000000000 +0100
-+++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c     2004-11-19 21:30:26.745410824 +0000
-@@ -299,9 +299,12 @@
-               goto out;
- 
-       retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
--      error = retval;
--      if (retval < 0)
-+      error = -EIO;
-+      if (retval != size) {
-+              if (retval < 0)
-+                      error = retval; 
-               goto out_close;
-+      }
- 
-       eppnt = elf_phdata;
-       for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -475,8 +478,11 @@
-               goto out;
- 
-       retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
--      if (retval < 0)
-+      if (retval != size) {
-+              if (retval >= 0)
-+                      retval = -EIO;
-               goto out_free_ph;
-+      }
-               
-       files = current->files;         /* Refcounted so ok */
-       retval = unshare_files();
-@@ -513,7 +519,8 @@
-                        */
- 
-                       retval = -ENOMEM;
--                      if (elf_ppnt->p_filesz > PATH_MAX)
-+                      if (elf_ppnt->p_filesz > PATH_MAX || 
-+                          elf_ppnt->p_filesz == 0)
-                               goto out_free_file;
-                       elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
-                                                          GFP_KERNEL);
-@@ -523,8 +530,16 @@
-                       retval = kernel_read(bprm->file, elf_ppnt->p_offset,
-                                          elf_interpreter,
-                                          elf_ppnt->p_filesz);
--                      if (retval < 0)
-+                      if (retval != elf_ppnt->p_filesz) {
-+                              if (retval >= 0)
-+                                      retval = -EIO;
-+                              goto out_free_interp;
-+                      }
-+                      /* make sure path is NULL terminated */
-+                      retval = -EINVAL;
-+                      if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
-                               goto out_free_interp;
-+
-                       /* If the program interpreter is one of these two,
-                        * then assume an iBCS2 image. Otherwise assume
-                        * a native linux image.
-@@ -543,8 +558,11 @@
-                       if (IS_ERR(interpreter))
-                               goto out_free_interp;
-                       retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
--                      if (retval < 0)
-+                      if (retval != BINPRM_BUF_SIZE) {
-+                              if (retval >= 0)
-+                                      retval = -EIO;
-                               goto out_free_dentry;
-+                      }
- 
-                       /* Get the exec headers */
-                       interp_ex = *((struct exec *) bprm->buf);
-@@ -682,8 +700,10 @@
-               }
- 
-               error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--              if (BAD_ADDR(error))
--                      continue;
-+              if (BAD_ADDR(error)) {
-+                      send_sig(SIGKILL, current, 0);
-+                      goto out_free_dentry;
-+              }
- 
-               if (!load_addr_set) {
-                       load_addr_set = 1;
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch
deleted file mode 100644 (file)
index 5f26f7f..0000000
+++ /dev/null
@@ -1,11 +0,0 @@
---- linux-2.4/fs/proc/base.c   2004-04-15 07:09:32.000000000 +0100
-+++ linux-2.4/fs/proc/base.c.plasmaroo 2004-08-09 23:30:43.869195800 +0100
-@@ -187,7 +187,7 @@ static int proc_pid_cmdline(struct task_
-       if (mm)
-               atomic_inc(&mm->mm_users);
-       task_unlock(task);
--      if (mm) {
-+      if (mm && mm->arg_end) {
-               int len = mm->arg_end - mm->arg_start;
-               if (len > PAGE_SIZE)
-                       len = PAGE_SIZE;
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch
deleted file mode 100644 (file)
index 63c5ba3..0000000
+++ /dev/null
@@ -1,97 +0,0 @@
-diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
---- linux-2.4.27/fs/smbfs/proc.c       2004-11-12 19:32:24.000000000 +0000
-+++ linux-2.4.28/fs/smbfs/proc.c       2004-11-19 20:18:27.000000000 +0000
-@@ -1289,10 +1289,12 @@
-       data_len = WVAL(buf, 1);
- 
-       /* we can NOT simply trust the data_len given by the server ... */
--      if (data_len > server->packet_size - (buf+3 - server->packet)) {
--              printk(KERN_ERR "smb_proc_read: invalid data length!! "
--                     "%d > %d - (%p - %p)\n",
--                     data_len, server->packet_size, buf+3, server->packet);
-+      if (data_len > count ||
-+              (buf+3 - server->packet) + data_len > server->packet_size) {
-+              printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
-+                     "%d > %d || (%p - %p) + %d > %d\n",
-+                     data_len, count,
-+                     buf+3, server->packet, data_len, server->packet_size);
-               result = -EIO;
-               goto out;
-       }
-@@ -1378,10 +1380,12 @@
-       buf = smb_base(server->packet) + data_off;
- 
-       /* we can NOT simply trust the info given by the server ... */
--      if (data_len > server->packet_size - (buf - server->packet)) {
--              printk(KERN_ERR "smb_proc_read: invalid data length!! "
--                     "%d > %d - (%p - %p)\n",
--                     data_len, server->packet_size, buf, server->packet);
-+      if (data_len > count ||
-+              (buf - server->packet) + data_len > server->packet_size) {
-+              printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
-+                     "%d > %d || (%p - %p) + %d > %d\n",
-+                     data_len, count,
-+                     buf, server->packet, data_len, server->packet_size);
-               result = -EIO;
-               goto out;
-       }
-diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
---- linux-2.4.27/fs/smbfs/sock.c       2004-11-12 19:32:24.000000000 +0000
-+++ linux-2.4.28/fs/smbfs/sock.c       2004-11-19 20:18:27.000000000 +0000
-@@ -571,7 +571,11 @@
-                                       parm_disp, parm_offset, parm_count,
-                                       data_disp, data_offset, data_count);
-                               *parm  = base + parm_offset;
-+                              if (*parm - inbuf + parm_tot > server->packet_size)
-+                                      goto out_bad_parm;
-                               *data  = base + data_offset;
-+                              if (*data - inbuf + data_tot > server->packet_size)
-+                                      goto out_bad_data;
-                               goto success;
-                       }
- 
-@@ -591,6 +595,8 @@
-                       rcv_buf = smb_vmalloc(buf_len);
-                       if (!rcv_buf)
-                               goto out_no_mem;
-+                      memset(rcv_buf, 0, buf_len);
-+                      
-                       *parm = rcv_buf;
-                       *data = rcv_buf + total_p;
-               } else if (data_tot > total_d || parm_tot > total_p)
-@@ -598,8 +604,12 @@
- 
-               if (parm_disp + parm_count > total_p)
-                       goto out_bad_parm;
-+              if (parm_offset + parm_count > server->packet_size)     
-+                      goto out_bad_parm;
-               if (data_disp + data_count > total_d)
-                       goto out_bad_data;
-+              if (data_offset + data_count > server->packet_size)     
-+                      goto out_bad_data;
-               memcpy(*parm + parm_disp, base + parm_offset, parm_count);
-               memcpy(*data + data_disp, base + data_offset, data_count);
- 
-@@ -610,8 +620,11 @@
-                * Check whether we've received all of the data. Note that
-                * we use the packet totals -- total lengths might shrink!
-                */
--              if (data_len >= data_tot && parm_len >= parm_tot)
-+              if (data_len >= data_tot && parm_len >= parm_tot) {
-+                      data_len = data_tot;
-+                      parm_len = parm_tot;
-                       break;
-+              }
-       }
- 
-       /*
-@@ -625,6 +638,9 @@
-               server->packet = rcv_buf;
-               rcv_buf = inbuf;
-       } else {
-+              if (parm_len + data_len > buf_len)
-+                      goto out_data_grew;
-+
-               PARANOIA("copying data, old size=%d, new size=%u\n",
-                        server->packet_size, buf_len);
-               memcpy(inbuf, rcv_buf, parm_len + data_len);
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch
new file mode 100644 (file)
index 0000000..4644ae2
--- /dev/null
@@ -0,0 +1,63 @@
+diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c
+--- linux-2.4.28/fs/exec.c     2004-04-15 10:44:45 -07:00
++++ linux-2.4.28.plasmaroo/fs/exec.c   2004-11-12 12:02:40 -08:00
+@@ -342,6 +342,7 @@ int setup_arg_pages(struct linux_binprm 
+       
+       down_write(&current->mm->mmap_sem);
+       {
++              struct vm_area_struct *vma;
+               mpnt->vm_mm = current->mm;
+               mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p;
+               mpnt->vm_end = STACK_TOP;
+@@ -351,6 +352,12 @@ int setup_arg_pages(struct linux_binprm 
+               mpnt->vm_pgoff = 0;
+               mpnt->vm_file = NULL;
+               mpnt->vm_private_data = (void *) 0;
++              vma = find_vma(current->mm, mpnt->vm_start);
++              if (vma) {
++                      up_write(&current->mm->mmap_sem);
++                      kmem_cache_free(vm_area_cachep, mpnt);
++                      return -ENOMEM;
++              }
+               insert_vm_struct(current->mm, mpnt);
+               current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+       } 
+diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c
+--- linux-2.4.28/fs/binfmt_aout.c      2002-02-04 23:54:04 -08:00
++++ linux-2.4.28.plasmaroo/fs/binfmt_aout.c    2004-11-12 11:55:14 -08:00
+@@ -39,13 +39,18 @@ static struct linux_binfmt aout_format =
+       NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)   ((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+       start = PAGE_ALIGN(start);
+       end = PAGE_ALIGN(end);
+-      if (end <= start)
+-              return;
+-      do_brk(start, end - start);
++      if (end > start) {
++              unsigned long addr = do_brk(start, end - start);
++              if (BAD_ADDR(addr))
++                      return addr;
++      }
++      return 0;
+ }
+ 
+ /*
+@@ -405,7 +410,11 @@ static int load_aout_binary(struct linux
+ beyond_if:
+       set_binfmt(&aout_format);
+ 
+-      set_brk(current->mm->start_brk, current->mm->brk);
++      retval = set_brk(current->mm->start_brk, current->mm->brk);
++      if (retval < 0) {
++              send_sig(SIGKILL, current, 0);
++              return retval;
++      }
+ 
+       retval = setup_arg_pages(bprm); 
+       if (retval < 0) { 
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch
new file mode 100644 (file)
index 0000000..89665ce
--- /dev/null
@@ -0,0 +1,63 @@
+diff -Nru linux-2.6.9/fs/exec.c linux-2.6.9.plasmaroo/fs/exec.c
+--- linux-2.6.9/fs/exec.c      2004-11-27 08:30:03 -08:00
++++ linux-2.6.9.plasmaroo/fs/exec.c    2004-11-27 08:30:03 -08:00
+@@ -413,6 +413,7 @@
+ 
+       down_write(&mm->mmap_sem);
+       {
++              struct vm_area_struct *vma;
+               mpnt->vm_mm = mm;
+ #ifdef CONFIG_STACK_GROWSUP
+               mpnt->vm_start = stack_base;
+@@ -433,6 +434,12 @@
+                       mpnt->vm_flags = VM_STACK_FLAGS;
+               mpnt->vm_flags |= mm->def_flags;
+               mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7];
++              vma = find_vma(mm, mpnt->vm_start);
++              if (vma) {
++                      up_write(&mm->mmap_sem);
++                      kmem_cache_free(vm_area_cachep, mpnt);
++                      return -ENOMEM;
++              }
+               insert_vm_struct(mm, mpnt);
+               mm->stack_vm = mm->total_vm = vma_pages(mpnt);
+       }
+diff -Nru linux-2.6.9/fs/binfmt_aout.c linux-2.6.9.plasmaroo/fs/binfmt_aout.c
+--- linux-2.6.9/fs/binfmt_aout.c       2004-11-27 08:31:43 -08:00
++++ linux-2.6.9.plasmaroo/fs/binfmt_aout.c     2004-11-27 08:31:43 -08:00
+@@ -43,13 +43,18 @@
+       .min_coredump   = PAGE_SIZE
+ };
+ 
+-static void set_brk(unsigned long start, unsigned long end)
++#define BAD_ADDR(x)   ((unsigned long)(x) >= TASK_SIZE)
++
++static int set_brk(unsigned long start, unsigned long end)
+ {
+       start = PAGE_ALIGN(start);
+       end = PAGE_ALIGN(end);
+-      if (end <= start)
+-              return;
+-      do_brk(start, end - start);
++      if (end > start) {
++              unsigned long addr = do_brk(start, end - start);
++              if (BAD_ADDR(addr))
++                      return addr;
++      }
++      return 0;
+ }
+ 
+ /*
+@@ -413,7 +418,11 @@
+ beyond_if:
+       set_binfmt(&aout_format);
+ 
+-      set_brk(current->mm->start_brk, current->mm->brk);
++      retval = set_brk(current->mm->start_brk, current->mm->brk);
++      if (retval < 0) {
++              send_sig(SIGKILL, current, 0);
++              return retval;
++      }
+ 
+       retval = setup_arg_pages(bprm, EXSTACK_DEFAULT);
+       if (retval < 0) { 
diff --git a/sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch b/sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch
new file mode 100644 (file)
index 0000000..6ced784
--- /dev/null
@@ -0,0 +1,24 @@
+--- linux-2.4.27/net/unix/af_unix.c    2004-11-24 08:23:21 -08:00
++++ linux-2.4.28/net/unix/af_unix.c    2004-11-24 08:23:21 -08:00
+@@ -1403,9 +1403,11 @@
+ 
+       msg->msg_namelen = 0;
+ 
++      down(&sk->protinfo.af_unix.readsem);
++
+       skb = skb_recv_datagram(sk, flags, noblock, &err);
+       if (!skb)
+-              goto out;
++              goto out_unlock;
+ 
+       wake_up_interruptible(&sk->protinfo.af_unix.peer_wait);
+ 
+@@ -1449,6 +1451,8 @@
+ 
+ out_free:
+       skb_free_datagram(sk,skb);
++out_unlock:
++      up(&sk->protinfo.af_unix.readsem);
+ out:
+       return err;
+ }
diff --git a/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild
deleted file mode 100644 (file)
index 321fd72..0000000
+++ /dev/null
@@ -1,28 +0,0 @@
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
-
-ETYPE="sources"
-inherit kernel-2
-detect_version
-
-XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r5/r0}.patch.bz2"
-
-SRC_URI="${KERNEL_URI}
-       mirror://gentoo/${XBOX_PATCH}
-       mirror://gentoo/${P}.squashfs.patch.bz2
-       http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0814.patch"
-DESCRIPTION="Full sources for the Xbox Linux kernel"
-HOMEPAGE="http://www.xbox-linux.org"
-K_NOSETEXTRAVERSION="don't_set_it"
-KEYWORDS="x86 -*"
-
-UNIPATCH_LIST="
-       ${DISTDIR}/${XBOX_PATCH}
-       ${DISTDIR}/${P}.squashfs.patch.bz2
-       ${FILESDIR}/${PN}-2.4.26.CAN-2004-0394.patch
-       ${FILESDIR}/${P}.cmdlineLeak.patch
-       ${FILESDIR}/${P}.XDRWrapFix.patch
-       ${FILESDIR}/${P}.binfmt_elf.patch
-       ${FILESDIR}/${P}.smbfs.patch
-       ${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch"
similarity index 80%
rename from sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild
rename to sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild
index bddc8b2eab394b7a3706a8965c0d5a2303786789..97cfc98e6e1e1406b23f89aaa0e324d1c00f2613 100644 (file)
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild,v 1.1 2004/11/24 14:13:57 chrb Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild,v 1.1 2004/11/27 18:08:56 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
@@ -18,4 +18,5 @@ KEYWORDS="x86 -*"
 
 UNIPATCH_LIST="
        ${DISTDIR}/${XBOX_PATCH}
-       ${DISTDIR}/${P}.squashfs.patch.bz2"
+       ${DISTDIR}/${P}.squashfs.patch.bz2
+       ${FILESDIR}/${P}.binfmt_a.out.patch"
similarity index 84%
rename from sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild
rename to sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild
index 8a0fba2226aabf999e8c9e3375fdf9b8247c2797..ad60c74215c1abb05589f90f8ac9408596356659 100644 (file)
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild,v 1.1 2004/11/27 18:08:56 plasmaroo Exp $
 
 ETYPE='sources'
 inherit kernel-2
@@ -17,7 +17,9 @@ UNIPATCH_LIST="
        ${FILESDIR}/${PN}-2.6.7.cmdlineLeak.patch
        ${FILESDIR}/${P}.devPtmx.patch
        ${FILESDIR}/${P}.smbfs.patch
-       ${FILESDIR}/${P}.binfmt_elf.patch"
+       ${FILESDIR}/${P}.binfmt_elf.patch
+       ${FILESDIR}/${P}.binfmt_a.out.patch
+       ${FILESDIR}/${PN}.AF_UNIX.patch"
 DESCRIPTION='Full sources for the Xbox Linux kernel'
 SRC_URI="${KERNEL_URI}
        mirror://gentoo/${XBOX_PATCHES}