# ChangeLog for sys-kernel/usermode-sources
# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/ChangeLog,v 1.50 2004/11/12 20:23:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/ChangeLog,v 1.51 2004/11/20 15:54:02 plasmaroo Exp $
+
+*usermode-sources-2.4.26-r9 (20 Nov 2004)
+
+ 20 Nov 2004; <plasmaroo@gentoo.org> -usermode-sources-2.4.26-r8.ebuild,
+ +usermode-sources-2.4.26-r9.ebuild, -usermode-sources-2.6.8.1-r3.ebuild,
+ +usermode-sources-2.6.8.1-r4.ebuild,
+ files/usermode-sources-2.4.binfmt_elf.patch,
+ +files/usermode-sources-2.4.smbfs.patch,
+ files/usermode-sources-2.6.binfmt_elf.patch,
+ +files/usermode-sources-2.6.smbfs.patch:
+ Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs
+ security patch (bug #65877).
*usermode-sources-2.6.8.1-r3 (12 Nov 2004)
-MD5 1563924f53c4f73b988b857d308eab9d ChangeLog 13421
+MD5 a553728acc1c3d0a13c6a3f633ec7a27 ChangeLog 13937
MD5 a76f13cb946fc2720c04b189616da2de metadata.xml 159
-MD5 cf3830767faf26ed8ac8fc2f7f1c8d46 usermode-sources-2.4.26-r8.ebuild 2730
-MD5 324d50c01ed451b3cf4eed2f79050516 usermode-sources-2.6.8.1-r3.ebuild 1061
+MD5 11f5175866d37cc8cc3fb83d1d239566 usermode-sources-2.4.26-r9.ebuild 2815
+MD5 808c5e768ef8340d3cf18a833f0b8e8f usermode-sources-2.6.8.1-r4.ebuild 1096
MD5 d1ccc2047be533c992f67270a150a210 files/usermode-sources-2.4.cmdlineLeak.patch 388
-MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/usermode-sources-2.4.24.CAN-2004-0075.patch 634
-MD5 174438d215b70cad5ffb00ca8123c062 files/usermode-sources-2.4.24.munmap.patch 837
-MD5 c460ea130cb4ae84a5063ba044e3ce72 files/usermode-sources-2.4.24.CAN-2004-0427.patch 460
-MD5 147fec50180ad91b6260fc7201dcb90f files/usermode-sources-2.4.24.CAN-2004-0010.patch 6050
MD5 dc18e982f8149588a291956481885a8c files/usermode-sources-2.4.CAN-2004-0495.patch 17549
-MD5 5748125eb42554148c90a042a7454065 files/digest-usermode-sources-2.6.8.1-r3 214
-MD5 de75cfa969ed092578d9ddda6c5be334 files/usermode-sources-2.4.24.CAN-2004-0181.patch 1233
-MD5 054d55975dd07c5a434e0ccfcf26f682 files/digest-usermode-sources-2.4.26-r8 297
-MD5 ac42024b6e6ee1e2165914db4b22a61c files/usermode-sources-2.4.24.CAN-2004-0178.patch 424
+MD5 5748125eb42554148c90a042a7454065 files/digest-usermode-sources-2.6.8.1-r4 214
MD5 d4a740ae56c2049247083af387a22a85 files/usermode-sources-2.4.26.CAN-2004-0394.patch 350
-MD5 24c53f49954dab29cfc172d4a3ba1a31 files/usermode-sources-2.4.binfmt_elf.patch 1928
-MD5 1ee8ba8362089c31fdd7d88b32eaf63e files/usermode-sources-2.6.binfmt_elf.patch 1938
+MD5 915e8d7a0618736caa44d96968015467 files/usermode-sources-2.4.binfmt_elf.patch 2346
+MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/usermode-sources-2.4.smbfs.patch 3434
+MD5 a9991d6324d7404ed99e79be6e44e9de files/usermode-sources-2.6.binfmt_elf.patch 2348
MD5 60d25ff310fc6abfdce39ec9e47345af files/usermode-sources-2.4.CAN-2004-0685.patch 2809
MD5 0f66013f643c79c97fda489618a4e2fd files/usermode-sources-2.4.CAN-2004-0535.patch 476
+MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/usermode-sources-2.6.smbfs.patch 3309
+MD5 054d55975dd07c5a434e0ccfcf26f682 files/digest-usermode-sources-2.4.26-r9 297
MD5 c2510fe1891f5a9effb12c2196922206 files/usermode-sources-2.6.cmdlineLeak.patch 281
MD5 95708646470a95668e8789cd415844ed files/usermode-sources.CAN-2004-0497.patch 846
MD5 452e04a312368605e145428c35bd0e05 files/usermode-sources-2.6.devPtmx.patch 572
MD5 2b3ddb8b8b15f8da35ade38544b57857 files/usermode-sources-2.4.XDRWrapFix.patch 1499
MD5 c9da1bc82b906f6abc648c056e7bf662 files/usermode-sources-2.4.FPULockup-53804.patch 354
-MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/usermode-sources-2.4.24.CAN-2004-0177.patch 384
-MD5 21f3a4f186017d925067335e24db36a1 files/usermode-sources-2.4.24.CAN-2004-0109.patch 1877
+++ /dev/null
-diff -urN linux-2.4.25-pre6/fs/ncpfs/dir.c linux-2.4.25-pre7/fs/ncpfs/dir.c
---- linux-2.4.25-pre6/fs/ncpfs/dir.c 2002-11-28 15:53:15.000000000 -0800
-+++ linux-2.4.25-pre7/fs/ncpfs/dir.c 2004-01-23 10:53:26.000000000 -0800
-@@ -266,8 +266,8 @@
- struct ncp_server *server;
- struct inode *dir = dentry->d_parent->d_inode;
- struct ncp_entry_info finfo;
-- int res, val = 0, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int res, val = 0, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- if (!dentry->d_inode || !dir)
- goto finished;
-@@ -291,14 +291,15 @@
- dentry->d_parent->d_name.name, dentry->d_name.name,
- NCP_GET_AGE(dentry));
-
-+ len = sizeof(__name);
- if (ncp_is_server_root(dir)) {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, 1);
-+ dentry->d_name.len, 1);
- if (!res)
- res = ncp_lookup_volume(server, __name, &(finfo.i));
- } else {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (!res)
- res = ncp_obtain_info(server, dir, __name, &(finfo.i));
- }
-@@ -548,9 +549,9 @@
- int valid = 0;
- int hashed = 0;
- ino_t ino = 0;
-- __u8 __name[256];
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
-- qname.len = 256;
-+ qname.len = sizeof(__name);
- if (ncp_vol2io(NCP_SERVER(inode), __name, &qname.len,
- entry->i.entryName, entry->i.nameLen,
- !ncp_preserve_entry_case(inode, entry->i.NSCreator)))
-@@ -705,16 +706,19 @@
- {
- struct ncp_server* server = NCP_SBP(sb);
- struct nw_info_struct i;
-- int result, len = strlen(server->m.mounted_vol) + 1;
-- __u8 __name[len];
-+ int result;
-
- if (ncp_single_volume(server)) {
-+ int len;
- struct dentry* dent;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
-- result = -ENOENT;
-- if (ncp_io2vol(server, __name, &len, server->m.mounted_vol,
-- len-1, 1))
-+ len = sizeof(__name);
-+ result = ncp_io2vol(server, __name, &len, server->m.mounted_vol,
-+ strlen(server->m.mounted_vol), 1);
-+ if (result)
- goto out;
-+ result = -ENOENT;
- if (ncp_lookup_volume(server, __name, &i)) {
- PPRINTK("ncp_conn_logged_in: %s not found\n",
- server->m.mounted_vol);
-@@ -745,8 +749,8 @@
- struct ncp_server *server = NCP_SERVER(dir);
- struct inode *inode = NULL;
- struct ncp_entry_info finfo;
-- int error, res, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, res, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- error = -EIO;
- if (!ncp_conn_valid(server))
-@@ -755,14 +759,15 @@
- PPRINTK("ncp_lookup: server lookup for %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-
-+ len = sizeof(__name);
- if (ncp_is_server_root(dir)) {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, 1);
-+ dentry->d_name.len, 1);
- if (!res)
- res = ncp_lookup_volume(server, __name, &(finfo.i));
- } else {
- res = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (!res)
- res = ncp_obtain_info(server, dir, __name, &(finfo.i));
- }
-@@ -825,9 +830,9 @@
- {
- struct ncp_server *server = NCP_SERVER(dir);
- struct ncp_entry_info finfo;
-- int error, result, len = dentry->d_name.len + 1;
-+ int error, result, len;
- int opmode;
-- __u8 __name[len];
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
- dentry->d_parent->d_name.name, dentry->d_name.name, mode);
-@@ -836,8 +841,9 @@
- goto out;
-
- ncp_age_dentry(server, dentry);
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -880,8 +886,8 @@
- {
- struct ncp_entry_info finfo;
- struct ncp_server *server = NCP_SERVER(dir);
-- int error, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_mkdir: making %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-@@ -890,8 +896,9 @@
- goto out;
-
- ncp_age_dentry(server, dentry);
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -909,8 +916,8 @@
- static int ncp_rmdir(struct inode *dir, struct dentry *dentry)
- {
- struct ncp_server *server = NCP_SERVER(dir);
-- int error, result, len = dentry->d_name.len + 1;
-- __u8 __name[len];
-+ int error, result, len;
-+ __u8 __name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_rmdir: removing %s/%s\n",
- dentry->d_parent->d_name.name, dentry->d_name.name);
-@@ -923,8 +930,9 @@
- if (!d_unhashed(dentry))
- goto out;
-
-+ len = sizeof(__name);
- error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
-- len-1, !ncp_preserve_case(dir));
-+ dentry->d_name.len, !ncp_preserve_case(dir));
- if (error)
- goto out;
-
-@@ -1022,9 +1030,8 @@
- {
- struct ncp_server *server = NCP_SERVER(old_dir);
- int error;
-- int old_len = old_dentry->d_name.len + 1;
-- int new_len = new_dentry->d_name.len + 1;
-- __u8 __old_name[old_len], __new_name[new_len];
-+ int old_len, new_len;
-+ __u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
-
- DPRINTK("ncp_rename: %s/%s to %s/%s\n",
- old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
-@@ -1037,15 +1044,17 @@
- ncp_age_dentry(server, old_dentry);
- ncp_age_dentry(server, new_dentry);
-
-+ old_len = sizeof(__old_name);
- error = ncp_io2vol(server, __old_name, &old_len,
-- old_dentry->d_name.name, old_len-1,
-- !ncp_preserve_case(old_dir));
-+ old_dentry->d_name.name, old_dentry->d_name.len,
-+ !ncp_preserve_case(old_dir));
- if (error)
- goto out;
-
-+ new_len = sizeof(__new_name);
- error = ncp_io2vol(server, __new_name, &new_len,
-- new_dentry->d_name.name, new_len-1,
-- !ncp_preserve_case(new_dir));
-+ new_dentry->d_name.name, new_dentry->d_name.len,
-+ !ncp_preserve_case(new_dir));
- if (error)
- goto out;
-
-
+++ /dev/null
---- linux-2.4.23/drivers/usb/vicam.c 2004-01-26 16:56:32.000000000 +0000
-+++ linux-2.4.25/drivers/usb/vicam.c 2004-04-20 18:15:53.000000000 +0100
-@@ -601,12 +601,19 @@
- case VIDIOCSWIN:
- {
-
-- struct video_window *vw = (struct video_window *) arg;
-- DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
-+ struct video_window vw;
-
-- if ( vw->width != 320 || vw->height != 240 )
-+ if (copy_from_user(&vw, arg, sizeof(vw)))
-+ {
- retval = -EFAULT;
-+ break;
-+ }
-+
-+ DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
-
-+ if ( vw.width != 320 || vw.height != 240 )
-+ retval = -EFAULT;
-+
- break;
- }
-
+++ /dev/null
---- linux/fs/isofs/rock.c.orig
-+++ linux/fs/isofs/rock.c
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/pagemap.h>
- #include <linux/smp_lock.h>
-+#include <asm/page.h>
-
- #include "rock.h"
-
-@@ -419,7 +420,7 @@
- return 0;
- }
-
--static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr)
-+static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
- {
- int slen;
- int rootflag;
-@@ -431,16 +432,25 @@
- rootflag = 0;
- switch (slp->flags & ~1) {
- case 0:
-+ if (slp->len > plimit - rpnt)
-+ return NULL;
- memcpy(rpnt, slp->text, slp->len);
- rpnt+=slp->len;
- break;
-+ case 2:
-+ if (rpnt >= plimit)
-+ return NULL;
-+ *rpnt++='.';
-+ break;
- case 4:
-+ if (2 > plimit - rpnt)
-+ return NULL;
- *rpnt++='.';
-- /* fallthru */
-- case 2:
- *rpnt++='.';
- break;
- case 8:
-+ if (rpnt >= plimit)
-+ return NULL;
- rootflag = 1;
- *rpnt++='/';
- break;
-@@ -457,17 +467,23 @@
- * If there is another SL record, and this component
- * record isn't continued, then add a slash.
- */
-- if ((!rootflag) && (rr->u.SL.flags & 1) && !(oldslp->flags & 1))
-+ if ((!rootflag) && (rr->u.SL.flags & 1) &&
-+ !(oldslp->flags & 1)) {
-+ if (rpnt >= plimit)
-+ return NULL;
- *rpnt++='/';
-+ }
- break;
- }
-
- /*
- * If this component record isn't continued, then append a '/'.
- */
-- if (!rootflag && !(oldslp->flags & 1))
-+ if (!rootflag && !(oldslp->flags & 1)) {
-+ if (rpnt >= plimit)
-+ return NULL;
- *rpnt++='/';
--
-+ }
- }
- return rpnt;
- }
-@@ -548,7 +564,10 @@
- CHECK_SP(goto out);
- break;
- case SIG('S', 'L'):
-- rpnt = get_symlink_chunk(rpnt, rr);
-+ rpnt = get_symlink_chunk(rpnt, rr,
-+ link + (PAGE_SIZE - 1));
-+ if (rpnt == NULL)
-+ goto out;
- break;
- case SIG('C', 'E'):
- /* This tells is if there is a continuation record */
-
+++ /dev/null
---- linux-2.4.26-pre3/fs/jbd/journal.c 2004-02-18 05:36:31.000000000 -0800
-+++ linux-2.4.26-pre4/fs/jbd/journal.c 2004-03-16 09:59:36.000000000 -0800
-@@ -671,6 +671,7 @@
-
- bh = getblk(journal->j_dev, blocknr, journal->j_blocksize);
- lock_buffer(bh);
-+ memset(bh->b_data, 0, journal->j_blocksize);
- BUFFER_TRACE(bh, "return this buffer");
- return journal_add_journal_head(bh);
- }
+++ /dev/null
---- linux-2.4.26-pre2/drivers/sound/sb_audio.c 2002-02-25 11:38:06.000000000 -0800
-+++ linux-2.4.26-pre3/drivers/sound/sb_audio.c 2004-03-13 07:43:23.000000000 -0800
-@@ -879,7 +879,7 @@
- c -= locallen; p += locallen;
- }
- /* used = ( samples * 16 bits size ) */
-- *used = len << 1;
-+ *used = max_in > ( max_out << 1) ? (max_out << 1) : max_in;
- /* returned = ( samples * 8 bits size ) */
- *returned = len;
- }
+++ /dev/null
---- linux-2.4.22/fs/jfs/jfs_logmgr.c.jfs-sec 2004-03-23 12:30:35.000000000 -0700
-+++ linux-2.4.22/fs/jfs/jfs_logmgr.c 2004-03-23 13:01:51.000000000 -0700
-@@ -1693,7 +1693,7 @@
- if (lbuf == 0)
- goto error;
- lbuf->l_bh.b_data = lbuf->l_ldata =
-- (char *) __get_free_page(GFP_KERNEL);
-+ (char *) get_zeroed_page(GFP_KERNEL);
- if (lbuf->l_ldata == 0) {
- kfree(lbuf);
- goto error;
---- linux-2.4.22/fs/jfs/jfs_metapage.c.jfs-sec 2004-03-23 12:30:48.000000000 -0700
-+++ linux-2.4.22/fs/jfs/jfs_metapage.c 2004-03-23 13:01:51.000000000 -0700
-@@ -375,6 +375,10 @@
- }
- mp->data = kmap(mp->page) + page_offset;
- }
-+
-+ if (new)
-+ memset(mp->data, 0, PSIZE);
-+
- jfs_info("__get_metapage: returning = 0x%p", mp);
- return mp;
-
---- linux-2.4.22/fs/jfs/super.c.jfs-sec 2004-03-23 12:31:10.000000000 -0700
-+++ linux-2.4.22/fs/jfs/super.c 2004-03-23 13:01:51.000000000 -0700
-@@ -423,10 +423,10 @@
-
- if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) ==
- SLAB_CTOR_CONSTRUCTOR) {
-+ memset(jfs_ip, 0, sizeof(struct jfs_inode_info));
- INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
- init_rwsem(&jfs_ip->rdwrlock);
- init_MUTEX(&jfs_ip->commit_sem);
-- jfs_ip->atlhead = 0;
- jfs_ip->active_ag = -1;
- }
- }
+++ /dev/null
-diff -Nar -U 4 linux-2.4.25/kernel/fork.c linux-2.4.25-new/kernel/fork.c
---- linux-2.4.25/kernel/fork.c 2004-02-18 05:36:32.000000000 -0800
-+++ linux-2.4.25-new/kernel/fork.c 2004-04-07 17:43:29.000000000 -0700
-@@ -825,8 +825,10 @@
- bad_fork_cleanup_namespace:
- exit_namespace(p);
- bad_fork_cleanup_mm:
- exit_mm(p);
-+ if (p->active_mm)
-+ mmdrop(p->active_mm);
- bad_fork_cleanup_sighand:
- exit_sighand(p);
- bad_fork_cleanup_fs:
- exit_fs(p); /* blocking */
+++ /dev/null
-diff -ur linux-2.4.25-rc3/mm/mremap.c linux-2.4.25-rc4/mm/mremap.c
---- linux-2.4.25-rc3/mm/mremap.c 2004-02-18 13:56:01.000000000 +0000
-+++ linux-2.4.25-rc4/mm/mremap.c 2004-02-18 13:49:08.000000000 +0000
-@@ -258,16 +258,20 @@
- if ((addr <= new_addr) && (addr+old_len) > new_addr)
- goto out;
-
-- do_munmap(current->mm, new_addr, new_len);
-+ ret = do_munmap(current->mm, new_addr, new_len);
-+ if (ret && new_len)
-+ goto out;
- }
-
- /*
- * Always allow a shrinking remap: that just unmaps
- * the unnecessary pages..
- */
-- ret = addr;
- if (old_len >= new_len) {
-- do_munmap(current->mm, addr+new_len, old_len - new_len);
-+ ret = do_munmap(current->mm, addr+new_len, old_len - new_len);
-+ if (ret && old_len != new_len)
-+ goto out;
-+ ret = addr;
- if (!(flags & MREMAP_FIXED) || (new_addr == addr))
- goto out;
- }
---- linux-2.4.27/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
+--- linux-2.4.27/fs/binfmt_elf.c 2004-04-14 14:05:40.000000000 +0100
++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c 2004-11-19 21:30:26.745410824 +0000
+@@ -299,9 +299,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -475,8 +478,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -513,7 +519,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -523,8 +530,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
+ if (retval != elf_ppnt->p_filesz) {
+ if (retval >= 0)
+ retval = -EIO;
- goto out_free_interp;
++ goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -543,8 +558,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -682,8 +700,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c 2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+ data_len = WVAL(buf, 1);
+
+ /* we can NOT simply trust the data_len given by the server ... */
+- if (data_len > server->packet_size - (buf+3 - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf+3, server->packet);
++ if (data_len > count ||
++ (buf+3 - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf+3, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+@@ -1378,10 +1380,12 @@
+ buf = smb_base(server->packet) + data_off;
+
+ /* we can NOT simply trust the info given by the server ... */
+- if (data_len > server->packet_size - (buf - server->packet)) {
+- printk(KERN_ERR "smb_proc_read: invalid data length!! "
+- "%d > %d - (%p - %p)\n",
+- data_len, server->packet_size, buf, server->packet);
++ if (data_len > count ||
++ (buf - server->packet) + data_len > server->packet_size) {
++ printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++ "%d > %d || (%p - %p) + %d > %d\n",
++ data_len, count,
++ buf, server->packet, data_len, server->packet_size);
+ result = -EIO;
+ goto out;
+ }
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c 2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c 2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+ parm_disp, parm_offset, parm_count,
+ data_disp, data_offset, data_count);
+ *parm = base + parm_offset;
++ if (*parm - inbuf + parm_tot > server->packet_size)
++ goto out_bad_parm;
+ *data = base + data_offset;
++ if (*data - inbuf + data_tot > server->packet_size)
++ goto out_bad_data;
+ goto success;
+ }
+
+@@ -591,6 +595,8 @@
+ rcv_buf = smb_vmalloc(buf_len);
+ if (!rcv_buf)
+ goto out_no_mem;
++ memset(rcv_buf, 0, buf_len);
++
+ *parm = rcv_buf;
+ *data = rcv_buf + total_p;
+ } else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+
+ if (parm_disp + parm_count > total_p)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > server->packet_size)
++ goto out_bad_parm;
+ if (data_disp + data_count > total_d)
+ goto out_bad_data;
++ if (data_offset + data_count > server->packet_size)
++ goto out_bad_data;
+ memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+ memcpy(*data + data_disp, base + data_offset, data_count);
+
+@@ -610,8 +620,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (data_len >= data_tot && parm_len >= parm_tot)
++ if (data_len >= data_tot && parm_len >= parm_tot) {
++ data_len = data_tot;
++ parm_len = parm_tot;
+ break;
++ }
+ }
+
+ /*
+@@ -625,6 +638,9 @@
+ server->packet = rcv_buf;
+ rcv_buf = inbuf;
+ } else {
++ if (parm_len + data_len > buf_len)
++ goto out_data_grew;
++
+ PARANOIA("copying data, old size=%d, new size=%u\n",
+ server->packet_size, buf_len);
+ memcpy(inbuf, rcv_buf, parm_len + data_len);
---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.8.1/fs/binfmt_elf.c 2004-08-14 11:55:23.000000000 +0100
++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c 2004-11-19 23:07:08.375429000 +0000
+@@ -334,9 +334,12 @@
goto out;
retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
eppnt = elf_phdata;
for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -523,8 +526,11 @@
goto out;
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
files = current->files; /* Refcounted so ok */
retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -561,7 +567,8 @@
+ */
+
+ retval = -ENOMEM;
+- if (elf_ppnt->p_filesz > PATH_MAX)
++ if (elf_ppnt->p_filesz > PATH_MAX ||
++ elf_ppnt->p_filesz == 0)
+ goto out_free_file;
+ elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ GFP_KERNEL);
+@@ -571,8 +578,16 @@
retval = kernel_read(bprm->file, elf_ppnt->p_offset,
elf_interpreter,
elf_ppnt->p_filesz);
goto out_free_interp;
+ }
+ /* make sure path is NULL terminated */
-+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++ retval = -EINVAL;
++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++ goto out_free_interp;
+
/* If the program interpreter is one of these two,
* then assume an iBCS2 image. Otherwise assume
* a native linux image.
-@@ -616,8 +628,11 @@
+@@ -607,8 +622,11 @@
if (IS_ERR(interpreter))
goto out_free_interp;
retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
+ }
/* Get the exec headers */
- loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ interp_ex = *((struct exec *) bprm->buf);
+@@ -765,8 +783,10 @@
}
error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
--- /dev/null
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c 2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c 2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+ * So we must first calculate the amount of padding used by the server.
+ */
+ data_off -= hdrlen;
+- if (data_off > SMB_READX_MAX_PAD) {
+- PARANOIA("offset is larger than max pad!\n");
+- PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++ if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++ PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++ PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+ req->rq_rlen = req->rq_bufsize + 1;
+ return;
+ }
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c 2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+ data_count = WVAL(inbuf, smb_drcnt);
+
+ /* Modify offset for the split header/buffer we use */
++ if (data_offset < hdrlen)
++ goto out_bad_data;
++ if (parm_offset < hdrlen)
++ goto out_bad_parm;
+ data_offset -= hdrlen;
+ parm_offset -= hdrlen;
+
+@@ -607,6 +611,10 @@
+ req->rq_lparm = parm_count;
+ req->rq_data = req->rq_buffer + data_offset;
+ req->rq_parm = req->rq_buffer + parm_offset;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+ return 0;
+ }
+
+@@ -634,6 +642,7 @@
+ req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
+ if (!req->rq_trans2buffer)
+ goto out_no_mem;
++ memset(req->rq_trans2buffer, 0, buf_len);
+
+ req->rq_parm = req->rq_trans2buffer;
+ req->rq_data = req->rq_trans2buffer + parm_tot;
+@@ -643,8 +652,12 @@
+
+ if (parm_disp + parm_count > req->rq_total_parm)
+ goto out_bad_parm;
++ if (parm_offset + parm_count > req->rq_rlen)
++ goto out_bad_parm;
+ if (data_disp + data_count > req->rq_total_data)
+ goto out_bad_data;
++ if (data_offset + data_count > req->rq_rlen)
++ goto out_bad_data;
+
+ inbuf = req->rq_buffer;
+ memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -657,8 +670,11 @@
+ * Check whether we've received all of the data. Note that
+ * we use the packet totals -- total lengths might shrink!
+ */
+- if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
++ if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
++ req->rq_ldata = data_tot;
++ req->rq_lparm = parm_tot;
+ return 0;
++ }
+ return 1;
+
+ out_too_long:
+@@ -676,13 +692,13 @@
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_parm:
+- printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+- parm_disp, parm_count, parm_tot);
++ printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ parm_disp, parm_count, parm_tot, parm_offset);
+ req->rq_errno = -EIO;
+ goto out;
+ out_bad_data:
+- printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+- data_disp, data_count, data_tot);
++ printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++ data_disp, data_count, data_tot, data_offset);
+ req->rq_errno = -EIO;
+ out:
+ return req->rq_errno;
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.4.26-r8.ebuild,v 1.1 2004/11/12 20:23:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.4.26-r9.ebuild,v 1.1 2004/11/20 15:54:02 plasmaroo Exp $
ETYPE="sources"
inherit kernel eutils
epatch ${FILESDIR}/${PN}-2.4.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
epatch ${FILESDIR}/${PN}-2.4.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!"
epatch ${FILESDIR}/${PN}-2.4.binfmt_elf.patch || die "Failed to apply the binfmt_elf patch!"
+ epatch ${FILESDIR}/${PN}-2.4.smbfs.patch || die "Failed to apply the SMBFS patch!"
+
kernel_universal_unpack
}
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r3.ebuild,v 1.1 2004/11/12 20:23:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r4.ebuild,v 1.1 2004/11/20 15:54:02 plasmaroo Exp $
K_NOUSENAME="yes"
ETYPE="sources"
${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch
${FILESDIR}/${PN}-2.6.cmdlineLeak.patch
${FILESDIR}/${PN}-2.6.devPtmx.patch
- ${FILESDIR}/${PN}-2.6.binfmt_elf.patch"
+ ${FILESDIR}/${PN}-2.6.binfmt_elf.patch
+ ${FILESDIR}/${PN}-2.6.smbfs.patch"
DESCRIPTION="Full (vanilla) sources for the User Mode Linux kernel"
SRC_URI="mirror://kernel/linux/kernel/v2.6/linux-${PV}.tar.bz2
projects / gentoo.git / commitdiff