# ChangeLog for sys-kernel/aa-sources
# Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/ChangeLog,v 1.52 2004/10/21 18:10:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/ChangeLog,v 1.53 2004/11/06 20:54:20 plasmaroo Exp $
+
+*aa-sources-2.4.23-r3 (06 Nov 2004)
+
+ 06 Nov 2004; <plasmaroo@gentoo.org> -aa-sources-2.4.23-r2.ebuild,
+ +aa-sources-2.4.23-r3.ebuild, aa-sources-2.6.5-r5.ebuild,
+ -files/aa-sources-2.4.23.CAN-2004-0001.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0109.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0133.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0177.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0178.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0181.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0394.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0427.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0495.patch,
+ -files/aa-sources-2.4.23.CAN-2004-0535.patch,
+ -files/aa-sources-2.4.23.FPULockup-53804.patch,
+ +files/aa-sources-2.4.23.XDRWrapFix.patch,
+ -files/aa-sources-2.4.23.munmap.patch,
+ -files/aa-sources-2.4.23.rtc_fix.patch,
+ +files/aa-sources-2.6.5.devPtmx.patch, -files/do_brk_fix.patch:
+ Bump 2.4 branch to -aa3 which contains some of the security fixes in files/,
+ removing them from there. Fixed 2.4 kNFSd security vulnerability and the 2.6
+ /dev/ptmx DoS, bug #62524. Also fixed CAN-2004-0814 for 2.4 and 2.6, bug
+ #68421.
21 Oct 2004; <plasmaroo@gentoo.org> aa-sources-2.6.5-r5.ebuild,
+files/aa-sources-2.6.5.CAN-2004-0816.patch:
-MD5 b2ece2c731fadb0884cf77357b008030 ChangeLog 8635
+MD5 e2e3238b844c68dee59d28dbbd11d075 ChangeLog 9768
MD5 399eb7607b8f1f3f597e93566b1bda7c metadata.xml 453
-MD5 f12484a011b847811a4043f950691aba aa-sources-2.6.5-r5.ebuild 1270
-MD5 bc631b940195181e5d3217d8874edd49 aa-sources-2.4.23-r2.ebuild 4063
+MD5 b18648665fbc1d70e4a847b5f6b2d99c aa-sources-2.6.5-r5.ebuild 1428
+MD5 463f19aae235c71e1d492e9a173f203e aa-sources-2.4.23-r3.ebuild 3232
MD5 60d25ff310fc6abfdce39ec9e47345af files/aa-sources-2.4.23.CAN-2004-0685.patch 2809
-MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/aa-sources-2.4.23.CAN-2004-0177.patch 384
-MD5 c9da1bc82b906f6abc648c056e7bf662 files/aa-sources-2.4.23.FPULockup-53804.patch 354
-MD5 de75cfa969ed092578d9ddda6c5be334 files/aa-sources-2.4.23.CAN-2004-0181.patch 1233
-MD5 f73a63eb74340aedfd3d818f22aed72c files/digest-aa-sources-2.4.23-r2 207
MD5 39361f8d16b1fe5891aab62e92f8cd30 files/aa-sources-2.6.5.IPTables-RDoS.patch 390
MD5 d1ccc2047be533c992f67270a150a210 files/aa-sources-2.4.23.cmdlineLeak.patch 388
MD5 6f4bba5dda7a99d77b1564f5489fef6e files/aa-sources-2.6.5.CAN-2004-0075.patch 1129
-MD5 e2e2b545b6fcdcecf49e33798efa5b84 files/aa-sources-2.4.23.rtc_fix.patch 7073
MD5 e77a93fdf26f06cf3ea5080b27211725 files/aa-sources-2.4.23.CAN-2003-0985.patch 414
MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/aa-sources-2.4.23.CAN-2004-0075.patch 634
MD5 b42dd9cd725c9a1da79ac42dd42eb207 files/digest-aa-sources-2.6.5-r5 200
MD5 02c062ec3a11a6a1498cdf0b1716c90a files/aa-sources-2.6.5.FPULockup-53804.patch 895
-MD5 bf2b609e8cab6460d220b1267db09826 files/aa-sources-2.4.23.CAN-2004-0001.patch 982
MD5 147fec50180ad91b6260fc7201dcb90f files/aa-sources-2.4.23.CAN-2004-0010.patch 6050
-MD5 0f66013f643c79c97fda489618a4e2fd files/aa-sources-2.4.23.CAN-2004-0535.patch 476
MD5 a92712e41465c49670ef7a54c2d16040 files/aa-sources-2.6.5.CAN-2004-0229.patch 471
+MD5 452e04a312368605e145428c35bd0e05 files/aa-sources-2.6.5.devPtmx.patch 572
MD5 95708646470a95668e8789cd415844ed files/aa-sources.CAN-2004-0497.patch 846
MD5 222e890035f4ad3152f0c2a625a9ea67 files/aa-sources-2.6.5.cmdlineLeak.patch 693
MD5 b738cb0120a32aa92cfcfdbd564dd21f files/aa-sources-2.6.5.ProcPerms.patch 1368
-MD5 174438d215b70cad5ffb00ca8123c062 files/aa-sources-2.4.23.munmap.patch 837
-MD5 d4a740ae56c2049247083af387a22a85 files/aa-sources-2.4.23.CAN-2004-0394.patch 350
MD5 1dd59d14a720c0c23e47e28d0b4fd6f9 files/aa-sources-2.6.5.CAN-2004-0228.patch 437
-MD5 dc18e982f8149588a291956481885a8c files/aa-sources-2.4.23.CAN-2004-0495.patch 17549
+MD5 8e5ab2f1eca981768eaa03775d7c9938 files/digest-aa-sources-2.4.23-r3 288
MD5 5674421c7e2c7e50e2509bed7d96c4d4 files/aa-sources-2.6.5.CAN-2004-0427.patch 332
-MD5 5bf9836a632a861728d33f9736bb7431 files/aa-sources-2.4.23.CAN-2004-0133.patch 427
MD5 8204afea1d572b49a4a80d8da4eef0c9 files/aa-sources-2.6.5.CAN-2004-0596.patch 1033
-MD5 21f3a4f186017d925067335e24db36a1 files/aa-sources-2.4.23.CAN-2004-0109.patch 1877
MD5 eb70acb35ba13daa4b1fda53cb61fc01 files/aa-sources-2.6.5.CAN-2004-0495-0496.patch 23861
-MD5 ac42024b6e6ee1e2165914db4b22a61c files/aa-sources-2.4.23.CAN-2004-0178.patch 424
+MD5 2b3ddb8b8b15f8da35ade38544b57857 files/aa-sources-2.4.23.XDRWrapFix.patch 1499
MD5 fcfb3fc100621b77d191f86b66dd810a files/aa-sources-2.4.22-ide-scsi-missing-sym-fix.patch 465
MD5 aa595005721b58929ee55e2e8f4b6ba0 files/aa-sources-2.6.5.CAN-2004-0816.patch 1693
-MD5 c460ea130cb4ae84a5063ba044e3ce72 files/aa-sources-2.4.23.CAN-2004-0427.patch 460
-MD5 e637c6fa41097ea2c4693d0766f2e1c5 files/do_brk_fix.patch 242
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.4.23-r2.ebuild,v 1.15 2004/08/09 22:45:11 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.4.23-r3.ebuild,v 1.1 2004/11/06 20:54:20 plasmaroo Exp $
IUSE=""
SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OURKERNEL}.tar.bz2
mirror://kernel/linux/kernel/people/andrea/kernels/v2.4/${KV/-}.bz2
mirror://kernel/linux/kernel/v2.4/testing/patch-${PV/_/-}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch"
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
else
OURKERNEL="2.4.${OKVLAST}"
SRC_URI="mirror://kernel//linux/kernel/v2.4/linux-${OURKERNEL}.tar.bz2
mirror://kernel/linux/kernel/people/andrea/kernels/v2.4/${KV/-}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch"
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0415.patch
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
fi
DESCRIPTION="Full sources for Andrea Arcangeli's Linux kernel"
sed -e '51i \ qsort.o \\' -i fs/xfs/support/Makefile || die "XFS patch failed!"
epatch ${FILESDIR}/${P}.CAN-2003-0985.patch || die "Failed to apply mremap() patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0001.patch || die "Failed to apply AMD64 ptrace patch!"
epatch ${FILESDIR}/${P}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!"
epatch ${FILESDIR}/${P}.CAN-2004-0075.patch || die "Failed to add the CAN-2004-0075 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0109.patch || die "Failed to add the CAN-2004-0109 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0133.patch || die "Failed to add the CAN-2004-0133 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!"
epatch ${DISTDIR}/${P}-CAN-2004-0415.patch || die "Failed to add the CAN-2004-0415 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0495.patch || die "Failed to add the CAN-2004-0495 patch!"
- epatch ${FILESDIR}/${PN}.CAN-2004-0497.patch || die "Failed to add the CAN-2004-0497 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!"
- epatch ${FILESDIR}/${P}.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0535 patch!"
- epatch ${FILESDIR}/${P}.rtc_fix.patch || die "Failed to apply RTC patch!"
- epatch ${FILESDIR}/${P}.FPULockup-53804.patch || die "Failed to apply FPU-lockup patch!"
+ epatch ${FILESDIR}/${P}.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!"
+ epatch ${DISTDIR}/${P}-CAN-2004-0814.patch || die "Failed to add the CAN-2004-0814 patch!"
epatch ${FILESDIR}/${P}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
+ epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR fix!"
# The munmap() patch is already in aa2...
kernel_universal_unpack
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.6.5-r5.ebuild,v 1.13 2004/10/21 18:10:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/aa-sources/aa-sources-2.6.5-r5.ebuild,v 1.14 2004/11/06 20:54:20 plasmaroo Exp $
ETYPE="sources"
K_NOUSENAME="yes"
${FILESDIR}/${P}.CAN-2004-0596.patch
${FILESDIR}/${P}.CAN-2004-0495-0496.patch
${FILESDIR}/${P}.cmdlineLeak.patch
- ${FILESDIR}/${P}.CAN-2004-0816.patch"
+ ${FILESDIR}/${P}.CAN-2004-0816.patch
+ ${FILESDIR}/${P}.devPtmx.patch
+ ${DISTDIR}/${P}-CAN-2004-0814.patch"
K_PREPATCHED="yes"
UNIPATCH_STRICTORDER="yes"
DESCRIPTION="Full sources for Andrea Arcangeli's Linux kernel"
HOMEPAGE="http://www.kernel.org/pub/linux/kernel/people/andrea/"
SRC_URI="${KERNEL_URI} mirror://kernel/linux/kernel/people/andrea/kernels/v2.6/${KV}.bz2
- http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch"
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch
+ http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
KEYWORDS="~x86 ~amd64 ~sparc ~ppc"
IUSE=""
+++ /dev/null
-diff -u linux/arch/x86_64/ia32/ptrace32.c-PTRACE linux/arch/x86_64/ia32/ptrace32.c
---- linux/arch/x86_64/ia32/ptrace32.c-PTRACE 2003-06-16 13:03:58.000000000 +0200
-+++ linux/arch/x86_64/ia32/ptrace32.c 2004-01-07 18:04:43.000000000 +0100
-@@ -25,6 +25,10 @@
- #include <asm/fpu32.h>
- #include <linux/mm.h>
-
-+/* determines which flags the user has access to. */
-+/* 1 = access 0 = no access */
-+#define FLAG_MASK 0x44dd5UL
-+
- #define R32(l,q) \
- case offsetof(struct user32, regs.l): stack[offsetof(struct pt_regs, q)/8] = val; break
-
-@@ -69,9 +73,12 @@
- R32(eip, rip);
- R32(esp, rsp);
-
-- case offsetof(struct user32, regs.eflags):
-- stack[offsetof(struct pt_regs, eflags)/8] = val & 0x44dd5;
-+ case offsetof(struct user32, regs.eflags): {
-+ __u64 *flags = &stack[offsetof(struct pt_regs, eflags)/8];
-+ val &= FLAG_MASK;
-+ *flags = val | (*flags & ~FLAG_MASK);
- break;
-+ }
-
- case offsetof(struct user32, u_debugreg[4]):
- case offsetof(struct user32, u_debugreg[5]):
+++ /dev/null
---- linux/fs/isofs/rock.c.orig
-+++ linux/fs/isofs/rock.c
-@@ -14,6 +14,7 @@
- #include <linux/slab.h>
- #include <linux/pagemap.h>
- #include <linux/smp_lock.h>
-+#include <asm/page.h>
-
- #include "rock.h"
-
-@@ -419,7 +420,7 @@
- return 0;
- }
-
--static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr)
-+static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
- {
- int slen;
- int rootflag;
-@@ -431,16 +432,25 @@
- rootflag = 0;
- switch (slp->flags & ~1) {
- case 0:
-+ if (slp->len > plimit - rpnt)
-+ return NULL;
- memcpy(rpnt, slp->text, slp->len);
- rpnt+=slp->len;
- break;
-+ case 2:
-+ if (rpnt >= plimit)
-+ return NULL;
-+ *rpnt++='.';
-+ break;
- case 4:
-+ if (2 > plimit - rpnt)
-+ return NULL;
- *rpnt++='.';
-- /* fallthru */
-- case 2:
- *rpnt++='.';
- break;
- case 8:
-+ if (rpnt >= plimit)
-+ return NULL;
- rootflag = 1;
- *rpnt++='/';
- break;
-@@ -457,17 +467,23 @@
- * If there is another SL record, and this component
- * record isn't continued, then add a slash.
- */
-- if ((!rootflag) && (rr->u.SL.flags & 1) && !(oldslp->flags & 1))
-+ if ((!rootflag) && (rr->u.SL.flags & 1) &&
-+ !(oldslp->flags & 1)) {
-+ if (rpnt >= plimit)
-+ return NULL;
- *rpnt++='/';
-+ }
- break;
- }
-
- /*
- * If this component record isn't continued, then append a '/'.
- */
-- if (!rootflag && !(oldslp->flags & 1))
-+ if (!rootflag && !(oldslp->flags & 1)) {
-+ if (rpnt >= plimit)
-+ return NULL;
- *rpnt++='/';
--
-+ }
- }
- return rpnt;
- }
-@@ -548,7 +564,10 @@
- CHECK_SP(goto out);
- break;
- case SIG('S', 'L'):
-- rpnt = get_symlink_chunk(rpnt, rr);
-+ rpnt = get_symlink_chunk(rpnt, rr,
-+ link + (PAGE_SIZE - 1));
-+ if (rpnt == NULL)
-+ goto out;
- break;
- case SIG('C', 'E'):
- /* This tells is if there is a continuation record */
-
+++ /dev/null
---- linux-2.4.22/fs/xfs/xfs_log.c.can-2004-0133 2004-03-23 12:28:11.000000000 -0700
-+++ linux-2.4.22/fs/xfs/xfs_log.c 2004-03-23 12:58:59.000000000 -0700
-@@ -1251,7 +1251,7 @@
- kmem_zalloc(sizeof(xlog_in_core_t), KM_SLEEP);
- iclog = *iclogp;
- iclog->hic_data = (xlog_in_core_2_t *)
-- kmem_alloc(iclogsize, KM_SLEEP);
-+ kmem_zalloc(iclogsize, KM_SLEEP);
-
- iclog->ic_prev = prev_iclog;
- prev_iclog = iclog;
+++ /dev/null
---- linux-2.4.26-pre3/fs/jbd/journal.c 2004-02-18 05:36:31.000000000 -0800
-+++ linux-2.4.26-pre4/fs/jbd/journal.c 2004-03-16 09:59:36.000000000 -0800
-@@ -671,6 +671,7 @@
-
- bh = getblk(journal->j_dev, blocknr, journal->j_blocksize);
- lock_buffer(bh);
-+ memset(bh->b_data, 0, journal->j_blocksize);
- BUFFER_TRACE(bh, "return this buffer");
- return journal_add_journal_head(bh);
- }
+++ /dev/null
---- linux-2.4.26-pre2/drivers/sound/sb_audio.c 2002-02-25 11:38:06.000000000 -0800
-+++ linux-2.4.26-pre3/drivers/sound/sb_audio.c 2004-03-13 07:43:23.000000000 -0800
-@@ -879,7 +879,7 @@
- c -= locallen; p += locallen;
- }
- /* used = ( samples * 16 bits size ) */
-- *used = len << 1;
-+ *used = max_in > ( max_out << 1) ? (max_out << 1) : max_in;
- /* returned = ( samples * 8 bits size ) */
- *returned = len;
- }
+++ /dev/null
---- linux-2.4.22/fs/jfs/jfs_logmgr.c.jfs-sec 2004-03-23 12:30:35.000000000 -0700
-+++ linux-2.4.22/fs/jfs/jfs_logmgr.c 2004-03-23 13:01:51.000000000 -0700
-@@ -1693,7 +1693,7 @@
- if (lbuf == 0)
- goto error;
- lbuf->l_bh.b_data = lbuf->l_ldata =
-- (char *) __get_free_page(GFP_KERNEL);
-+ (char *) get_zeroed_page(GFP_KERNEL);
- if (lbuf->l_ldata == 0) {
- kfree(lbuf);
- goto error;
---- linux-2.4.22/fs/jfs/jfs_metapage.c.jfs-sec 2004-03-23 12:30:48.000000000 -0700
-+++ linux-2.4.22/fs/jfs/jfs_metapage.c 2004-03-23 13:01:51.000000000 -0700
-@@ -375,6 +375,10 @@
- }
- mp->data = kmap(mp->page) + page_offset;
- }
-+
-+ if (new)
-+ memset(mp->data, 0, PSIZE);
-+
- jfs_info("__get_metapage: returning = 0x%p", mp);
- return mp;
-
---- linux-2.4.22/fs/jfs/super.c.jfs-sec 2004-03-23 12:31:10.000000000 -0700
-+++ linux-2.4.22/fs/jfs/super.c 2004-03-23 13:01:51.000000000 -0700
-@@ -423,10 +423,10 @@
-
- if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) ==
- SLAB_CTOR_CONSTRUCTOR) {
-+ memset(jfs_ip, 0, sizeof(struct jfs_inode_info));
- INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
- init_rwsem(&jfs_ip->rdwrlock);
- init_MUTEX(&jfs_ip->commit_sem);
-- jfs_ip->atlhead = 0;
- jfs_ip->active_ag = -1;
- }
- }
+++ /dev/null
---- linux-2.4.22-oM3-orig/kernel/panic.c Tue Mar 30 15:37:18 2004
-+++ linux-2.4.22-oM3-mod/kernel/panic.c Mon May 17 18:44:01 2004
-@@ -51,7 +51,7 @@
-
- bust_spinlocks(1);
- va_start(args, fmt);
-- vsprintf(buf, fmt, args);
-+ vsnprintf(buf, sizeof(buf), fmt, args);
- va_end(args);
- printk(KERN_EMERG "Kernel panic: %s\n",buf);
- if (in_interrupt())
+++ /dev/null
-diff -Nar -U 4 linux-2.4.25/kernel/fork.c linux-2.4.25-new/kernel/fork.c
---- linux-2.4.25/kernel/fork.c 2004-02-18 05:36:32.000000000 -0800
-+++ linux-2.4.25-new/kernel/fork.c 2004-04-07 17:43:29.000000000 -0700
-@@ -825,8 +825,10 @@
- bad_fork_cleanup_namespace:
- exit_namespace(p);
- bad_fork_cleanup_mm:
- exit_mm(p);
-+ if (p->active_mm)
-+ mmdrop(p->active_mm);
- bad_fork_cleanup_sighand:
- exit_sighand(p);
- bad_fork_cleanup_fs:
- exit_fs(p); /* blocking */
+++ /dev/null
---- linux/net/decnet/dn_dev.c.bak Wed Jun 16 14:42:24 2004
-+++ linux/net/decnet/dn_dev.c Wed Jun 16 14:42:34 2004
-@@ -1070,31 +1070,39 @@ int dnet_gifconf(struct net_device *dev,
- {
- struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
- struct dn_ifaddr *ifa;
-- struct ifreq *ifr = (struct ifreq *)buf;
-+ char buffer[DN_IFREQ_SIZE];
-+ struct ifreq *ifr = (struct ifreq *)buffer;
-+ struct sockaddr_dn *addr = (struct sockaddr_dn *)&ifr->ifr_addr;
- int done = 0;
-
- if ((dn_db == NULL) || ((ifa = dn_db->ifa_list) == NULL))
- return 0;
-
- for(; ifa; ifa = ifa->ifa_next) {
-- if (!ifr) {
-+ if (!buf) {
- done += sizeof(DN_IFREQ_SIZE);
- continue;
- }
- if (len < DN_IFREQ_SIZE)
- return done;
-- memset(ifr, 0, DN_IFREQ_SIZE);
-+ memset(buffer, 0, DN_IFREQ_SIZE);
-
- if (ifa->ifa_label)
- strcpy(ifr->ifr_name, ifa->ifa_label);
- else
- strcpy(ifr->ifr_name, dev->name);
-
-- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_family = AF_DECnet;
-- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_len = 2;
-- (*(dn_address *)(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_addr) = ifa->ifa_local;
-+ addr->sdn_family = AF_DECnet;
-+ addr->sdn_add.a_len = 2;
-+ memcpy(addr->sdn_add.a_addr, &ifa->ifa_local,
-+ sizeof(dn_address));
-
-- ifr = (struct ifreq *)((char *)ifr + DN_IFREQ_SIZE);
-+ if (copy_to_user(buf, buffer, DN_IFREQ_SIZE)) {
-+ done = -EFAULT;
-+ break;
-+ }
-+
-+ buf += DN_IFREQ_SIZE;
- len -= DN_IFREQ_SIZE;
- done += DN_IFREQ_SIZE;
- }
---- linux-2.4.21/drivers/net/wireless/airo.c 2003-06-13 15:51:35.000000000 +0100
-+++ linux-2.4.21/drivers/net/wireless/airo.c.plasmaroo 2004-06-24 11:09:08.260352168 +0100
-@@ -3012,19 +3012,22 @@
- size_t len,
- loff_t *offset )
- {
-- int i;
-- int pos;
-+ loff_t pos = *offset;
- struct proc_data *priv = (struct proc_data*)file->private_data;
-
-- if( !priv->rbuffer ) return -EINVAL;
-+ if (!priv->rbuffer)
-+ return -EINVAL;
-
-- pos = *offset;
-- for( i = 0; i+pos < priv->readlen && i < len; i++ ) {
-- if (put_user( priv->rbuffer[i+pos], buffer+i ))
-- return -EFAULT;
-- }
-- *offset += i;
-- return i;
-+ if (pos < 0)
-+ return -EINVAL;
-+ if (pos >= priv->readlen)
-+ return 0;
-+ if (len > priv->readlen - pos)
-+ len = priv->readlen - pos;
-+ if (copy_to_user(buffer, priv->rbuffer + pos, len))
-+ return -EFAULT;
-+ *offset = pos + len;
-+ return len;
- }
-
- /*
-@@ -3036,24 +3039,24 @@
- size_t len,
- loff_t *offset )
- {
-- int i;
-- int pos;
-+ loff_t pos = *offset;
- struct proc_data *priv = (struct proc_data*)file->private_data;
-
-- if ( !priv->wbuffer ) {
-+ if (!priv->wbuffer)
- return -EINVAL;
-- }
--
-- pos = *offset;
-
-- for( i = 0; i + pos < priv->maxwritelen &&
-- i < len; i++ ) {
-- if (get_user( priv->wbuffer[i+pos], buffer + i ))
-- return -EFAULT;
-- }
-- if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos;
-- *offset += i;
-- return i;
-+ if (pos < 0)
-+ return -EINVAL;
-+ if (pos >= priv->maxwritelen)
-+ return 0;
-+ if (len > priv->maxwritelen - pos)
-+ len = priv->maxwritelen - pos;
-+ if (copy_from_user(priv->wbuffer + pos, buffer, len))
-+ return -EFAULT;
-+ if (pos + len > priv->writelen)
-+ priv->writelen = pos + len;
-+ *offset = pos + len;
-+ return len;
- }
-
- static int proc_status_open( struct inode *inode, struct file *file ) {
---- linux/drivers/sound/mpu401.c.bak Wed Jun 16 14:42:24 2004
-+++ linux/drivers/sound/mpu401.c Wed Jun 16 14:42:34 2004
-@@ -1493,14 +1493,16 @@ static unsigned long mpu_timer_get_time(
- static int mpu_timer_ioctl(int dev, unsigned int command, caddr_t arg)
- {
- int midi_dev = sound_timer_devs[dev]->devlink;
-+ int *p = (int *)arg;
-
- switch (command)
- {
- case SNDCTL_TMR_SOURCE:
- {
- int parm;
--
-- parm = *(int *) arg;
-+
-+ if (get_user(parm, p))
-+ return -EFAULT;
- parm &= timer_caps;
-
- if (parm != 0)
-@@ -1512,7 +1514,9 @@ static int mpu_timer_ioctl(int dev, unsi
- else if (timer_mode & TMR_MODE_SMPTE)
- mpu_cmd(midi_dev, 0x3d, 0); /* Use SMPTE sync */
- }
-- return (*(int *) arg = timer_mode);
-+ if (put_user(timer_mode, p))
-+ return -EFAULT;
-+ return timer_mode;
- }
- break;
-
-@@ -1537,10 +1541,13 @@ static int mpu_timer_ioctl(int dev, unsi
- {
- int val;
-
-- val = *(int *) arg;
-+ if (get_user(val, p))
-+ return -EFAULT;
- if (val)
- set_timebase(midi_dev, val);
-- return (*(int *) arg = curr_timebase);
-+ if (put_user(curr_timebase, p))
-+ return -EFAULT;
-+ return curr_timebase;
- }
- break;
-
-@@ -1549,7 +1556,8 @@ static int mpu_timer_ioctl(int dev, unsi
- int val;
- int ret;
-
-- val = *(int *) arg;
-+ if (get_user(val, p))
-+ return -EFAULT;
-
- if (val)
- {
-@@ -1564,7 +1572,9 @@ static int mpu_timer_ioctl(int dev, unsi
- }
- curr_tempo = val;
- }
-- return (*(int *) arg = curr_tempo);
-+ if (put_user(curr_tempo, p))
-+ return -EFAULT;
-+ return curr_tempo;
- }
- break;
-
-@@ -1572,18 +1582,25 @@ static int mpu_timer_ioctl(int dev, unsi
- {
- int val;
-
-- val = *(int *) arg;
-+ if (get_user(val, p))
-+ return -EFAULT;
- if (val != 0) /* Can't change */
- return -EINVAL;
-- return (*(int *) arg = ((curr_tempo * curr_timebase) + 30) / 60);
-+ val = (curr_tempo * curr_timebase + 30) / 60;
-+ if (put_user(val, p))
-+ return -EFAULT;
-+ return val;
- }
- break;
-
- case SNDCTL_SEQ_GETTIME:
-- return (*(int *) arg = curr_ticks);
-+ if (put_user(curr_ticks, p))
-+ return -EFAULT;
-+ return curr_ticks;
-
- case SNDCTL_TMR_METRONOME:
-- metronome_mode = *(int *) arg;
-+ if (get_user(metronome_mode, p))
-+ return -EFAULT;
- setup_metronome(midi_dev);
- return 0;
-
---- linux/drivers/sound/msnd.c.bak Wed Jun 16 14:42:24 2004
-+++ linux/drivers/sound/msnd.c Wed Jun 16 14:42:34 2004
-@@ -155,13 +155,10 @@ void msnd_fifo_make_empty(msnd_fifo *f)
- f->len = f->tail = f->head = 0;
- }
-
--int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user)
-+int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len)
- {
- int count = 0;
-
-- if (f->len == f->n)
-- return 0;
--
- while ((count < len) && (f->len != f->n)) {
-
- int nwritten;
-@@ -177,11 +174,7 @@ int msnd_fifo_write(msnd_fifo *f, const
- nwritten = len - count;
- }
-
-- if (user) {
-- if (copy_from_user(f->data + f->tail, buf, nwritten))
-- return -EFAULT;
-- } else
-- isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
-+ isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
-
- count += nwritten;
- buf += nwritten;
-@@ -193,13 +186,10 @@ int msnd_fifo_write(msnd_fifo *f, const
- return count;
- }
-
--int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user)
-+int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len)
- {
- int count = 0;
-
-- if (f->len == 0)
-- return f->len;
--
- while ((count < len) && (f->len > 0)) {
-
- int nread;
-@@ -215,11 +205,7 @@ int msnd_fifo_read(msnd_fifo *f, char *b
- nread = len - count;
- }
-
-- if (user) {
-- if (copy_to_user(buf, f->data + f->head, nread))
-- return -EFAULT;
-- } else
-- isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
-+ isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
-
- count += nread;
- buf += nread;
---- linux/drivers/sound/msnd.h.bak Wed Jun 16 14:42:24 2004
-+++ linux/drivers/sound/msnd.h Wed Jun 16 14:42:34 2004
-@@ -266,8 +266,8 @@ void msnd_fifo_init(msnd_fifo *f);
- void msnd_fifo_free(msnd_fifo *f);
- int msnd_fifo_alloc(msnd_fifo *f, size_t n);
- void msnd_fifo_make_empty(msnd_fifo *f);
--int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user);
--int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user);
-+int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len);
-+int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len);
-
- int msnd_wait_TXDE(multisound_dev_t *dev);
- int msnd_wait_HC0(multisound_dev_t *dev);
---- linux/drivers/sound/msnd_pinnacle.c.bak Wed Jun 16 14:42:24 2004
-+++ linux/drivers/sound/msnd_pinnacle.c Wed Jun 16 14:42:34 2004
-@@ -804,7 +804,7 @@ static int dev_release(struct inode *ino
-
- static __inline__ int pack_DARQ_to_DARF(register int bank)
- {
-- register int size, n, timeout = 3;
-+ register int size, timeout = 3;
- register WORD wTmp;
- LPDAQD DAQD;
-
-@@ -825,13 +825,10 @@ static __inline__ int pack_DARQ_to_DARF(
- /* Read data from the head (unprotected bank 1 access okay
- since this is only called inside an interrupt) */
- outb(HPBLKSEL_1, dev.io + HP_BLKS);
-- if ((n = msnd_fifo_write(
-+ msnd_fifo_write(
- &dev.DARF,
- (char *)(dev.base + bank * DAR_BUFF_SIZE),
-- size, 0)) <= 0) {
-- outb(HPBLKSEL_0, dev.io + HP_BLKS);
-- return n;
-- }
-+ size);
- outb(HPBLKSEL_0, dev.io + HP_BLKS);
-
- return 1;
-@@ -853,21 +850,16 @@ static __inline__ int pack_DAPF_to_DAPQ(
- if (protect) {
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_read(
-+ n = msnd_fifo_read(
- &dev.DAPF,
- (char *)(dev.base + bank_num * DAP_BUFF_SIZE),
-- DAP_BUFF_SIZE, 0)) < 0) {
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ DAP_BUFF_SIZE);
- spin_unlock_irqrestore(&dev.lock, flags);
- } else {
-- if ((n = msnd_fifo_read(
-+ n = msnd_fifo_read(
- &dev.DAPF,
- (char *)(dev.base + bank_num * DAP_BUFF_SIZE),
-- DAP_BUFF_SIZE, 0)) < 0) {
-- return n;
-- }
-+ DAP_BUFF_SIZE);
- }
- if (!n)
- break;
-@@ -894,30 +886,43 @@ static __inline__ int pack_DAPF_to_DAPQ(
- static int dsp_read(char *buf, size_t len)
- {
- int count = len;
-+ char *page = (char *)__get_free_page(PAGE_SIZE);
-+
-+ if (!page)
-+ return -ENOMEM;
-
- while (count > 0) {
-- int n;
-+ int n, k;
- unsigned long flags;
-
-+ k = PAGE_SIZE;
-+ if (k > count)
-+ k = count;
-+
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_read(&dev.DARF, buf, count, 1)) < 0) {
-- printk(KERN_WARNING LOGNAME ": FIFO read error\n");
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ n = msnd_fifo_read(&dev.DARF, page, k);
- spin_unlock_irqrestore(&dev.lock, flags);
-+ if (copy_to_user(buf, page, n)) {
-+ free_page((unsigned long)page);
-+ return -EFAULT;
-+ }
- buf += n;
- count -= n;
-
-+ if (n == k && count)
-+ continue;
-+
- if (!test_bit(F_READING, &dev.flags) && dev.mode & FMODE_READ) {
- dev.last_recbank = -1;
- if (chk_send_dsp_cmd(&dev, HDEX_RECORD_START) == 0)
- set_bit(F_READING, &dev.flags);
- }
-
-- if (dev.rec_ndelay)
-+ if (dev.rec_ndelay) {
-+ free_page((unsigned long)page);
- return count == len ? -EAGAIN : len - count;
-+ }
-
- if (count > 0) {
- set_bit(F_READBLOCK, &dev.flags);
-@@ -926,41 +931,57 @@ static int dsp_read(char *buf, size_t le
- get_rec_delay_jiffies(DAR_BUFF_SIZE)))
- clear_bit(F_READING, &dev.flags);
- clear_bit(F_READBLOCK, &dev.flags);
-- if (signal_pending(current))
-+ if (signal_pending(current)) {
-+ free_page((unsigned long)page);
- return -EINTR;
-+ }
- }
- }
--
-+ free_page((unsigned long)page);
- return len - count;
- }
-
- static int dsp_write(const char *buf, size_t len)
- {
- int count = len;
-+ char *page = (char *)__get_free_page(GFP_KERNEL);
-+
-+ if (!page)
-+ return -ENOMEM;
-
- while (count > 0) {
-- int n;
-+ int n, k;
- unsigned long flags;
-
-+ k = PAGE_SIZE;
-+ if (k > count)
-+ k = count;
-+
-+ if (copy_from_user(page, buf, k)) {
-+ free_page((unsigned long)page);
-+ return -EFAULT;
-+ }
-+
- /* Critical section: protect fifo in non-interrupt */
- spin_lock_irqsave(&dev.lock, flags);
-- if ((n = msnd_fifo_write(&dev.DAPF, buf, count, 1)) < 0) {
-- printk(KERN_WARNING LOGNAME ": FIFO write error\n");
-- spin_unlock_irqrestore(&dev.lock, flags);
-- return n;
-- }
-+ n = msnd_fifo_write(&dev.DAPF, page, k);
- spin_unlock_irqrestore(&dev.lock, flags);
- buf += n;
- count -= n;
-
-+ if (count && n == k)
-+ continue;
-+
- if (!test_bit(F_WRITING, &dev.flags) && (dev.mode & FMODE_WRITE)) {
- dev.last_playbank = -1;
- if (pack_DAPF_to_DAPQ(1) > 0)
- set_bit(F_WRITING, &dev.flags);
- }
-
-- if (dev.play_ndelay)
-+ if (dev.play_ndelay) {
-+ free_page((unsigned long)page);
- return count == len ? -EAGAIN : len - count;
-+ }
-
- if (count > 0) {
- set_bit(F_WRITEBLOCK, &dev.flags);
-@@ -968,11 +989,14 @@ static int dsp_write(const char *buf, si
- &dev.writeblock,
- get_play_delay_jiffies(DAP_BUFF_SIZE));
- clear_bit(F_WRITEBLOCK, &dev.flags);
-- if (signal_pending(current))
-+ if (signal_pending(current)) {
-+ free_page((unsigned long)page);
- return -EINTR;
-+ }
- }
- }
-
-+ free_page((unsigned long)page);
- return len - count;
- }
-
---- linux/drivers/sound/pss.c.bak Wed Jun 16 14:42:24 2004
-+++ linux/drivers/sound/pss.c Wed Jun 16 14:42:34 2004
-@@ -450,20 +450,36 @@ static void pss_mixer_reset(pss_confdata
- }
- }
-
--static void arg_to_volume_mono(unsigned int volume, int *aleft)
-+static int set_volume_mono(caddr_t p, int *aleft)
- {
- int left;
-+ unsigned volume;
-+ if (get_user(volume, (unsigned *)p))
-+ return -EFAULT;
-
-- left = volume & 0x00ff;
-+ left = volume & 0xff;
- if (left > 100)
- left = 100;
- *aleft = left;
-+ return 0;
- }
-
--static void arg_to_volume_stereo(unsigned int volume, int *aleft, int *aright)
-+static int set_volume_stereo(caddr_t p, int *aleft, int *aright)
- {
-- arg_to_volume_mono(volume, aleft);
-- arg_to_volume_mono(volume >> 8, aright);
-+ int left, right;
-+ unsigned volume;
-+ if (get_user(volume, (unsigned *)p))
-+ return -EFAULT;
-+
-+ left = volume & 0xff;
-+ if (left > 100)
-+ left = 100;
-+ right = (volume >> 8) & 0xff;
-+ if (right > 100)
-+ right = 100;
-+ *aleft = left;
-+ *aright = right;
-+ return 0;
- }
-
- static int ret_vol_mono(int left)
-@@ -510,33 +526,38 @@ static int pss_mixer_ioctl (int dev, uns
- return call_ad_mixer(devc, cmd, arg);
- else
- {
-- if (*(int *)arg != 0)
-+ int v;
-+ if (get_user(v, (int *)arg))
-+ return -EFAULT;
-+ if (v != 0)
- return -EINVAL;
- return 0;
- }
- case SOUND_MIXER_VOLUME:
-- arg_to_volume_stereo(*(unsigned int *)arg, &devc->mixer.volume_l,
-- &devc->mixer.volume_r);
-+ if (set_volume_stereo(arg,
-+ &devc->mixer.volume_l,
-+ &devc->mixer.volume_r))
-+ return -EFAULT;
- set_master_volume(devc, devc->mixer.volume_l,
- devc->mixer.volume_r);
- return ret_vol_stereo(devc->mixer.volume_l,
- devc->mixer.volume_r);
-
- case SOUND_MIXER_BASS:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.bass);
-+ if (set_volume_mono(arg, &devc->mixer.bass))
-+ return -EFAULT;
- set_bass(devc, devc->mixer.bass);
- return ret_vol_mono(devc->mixer.bass);
-
- case SOUND_MIXER_TREBLE:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.treble);
-+ if (set_volume_mono(arg, &devc->mixer.treble))
-+ return -EFAULT;
- set_treble(devc, devc->mixer.treble);
- return ret_vol_mono(devc->mixer.treble);
-
- case SOUND_MIXER_SYNTH:
-- arg_to_volume_mono(*(unsigned int *)arg,
-- &devc->mixer.synth);
-+ if (set_volume_mono(arg, &devc->mixer.synth))
-+ return -EFAULT;
- set_synth_volume(devc, devc->mixer.synth);
- return ret_vol_mono(devc->mixer.synth);
-
-@@ -546,54 +567,67 @@ static int pss_mixer_ioctl (int dev, uns
- }
- else
- {
-+ int val, and_mask = 0, or_mask = 0;
- /*
- * Return parameters
- */
- switch (cmdf)
- {
--
- case SOUND_MIXER_DEVMASK:
- if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
-- *(int *)arg = 0; /* no mixer devices */
-- return (*(int *)arg |= SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH);
-+ break;
-+ and_mask = ~0;
-+ or_mask = SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH;
-+ break;
-
- case SOUND_MIXER_STEREODEVS:
- if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
-- *(int *)arg = 0; /* no stereo devices */
-- return (*(int *)arg |= SOUND_MASK_VOLUME);
-+ break;
-+ and_mask = ~0;
-+ or_mask = SOUND_MASK_VOLUME;
-+ break;
-
- case SOUND_MIXER_RECMASK:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = 0); /* no record devices */
-+ break;
-
- case SOUND_MIXER_CAPS:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = SOUND_CAP_EXCL_INPUT);
-+ or_mask = SOUND_CAP_EXCL_INPUT;
-+ break;
-
- case SOUND_MIXER_RECSRC:
- if (devc->ad_mixer_dev != NO_WSS_MIXER)
- return call_ad_mixer(devc, cmd, arg);
-- else
-- return (*(int *)arg = 0); /* no record source */
-+ break;
-
- case SOUND_MIXER_VOLUME:
-- return (*(int *)arg = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r));
-+ or_mask = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r);
-+ break;
-
- case SOUND_MIXER_BASS:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.bass));
-+ or_mask = ret_vol_mono(devc->mixer.bass);
-+ break;
-
- case SOUND_MIXER_TREBLE:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.treble));
-+ or_mask = ret_vol_mono(devc->mixer.treble);
-+ break;
-
- case SOUND_MIXER_SYNTH:
-- return (*(int *)arg = ret_vol_mono(devc->mixer.synth));
-+ or_mask = ret_vol_mono(devc->mixer.synth);
-+ break;
- default:
- return -EINVAL;
- }
-+ if (get_user(val, (int *)arg))
-+ return -EFAULT;
-+ val &= and_mask;
-+ val |= or_mask;
-+ if (put_user(val, (int *)arg))
-+ return -EFAULT;
-+ return val;
- }
- }
-
+++ /dev/null
---- drivers/net/e1000/e1000_ethtool.c 2003-06-13 15:51:34.000000000 +0100
-+++ drivers/net/e1000/e1000_ethtool.c.plasmaroo 2004-06-24 11:23:32.524963976 +0100
-@@ -468,6 +468,9 @@
-
- if(copy_from_user(®s, addr, sizeof(regs)))
- return -EFAULT;
-+ memset(regs_buff, 0, sizeof(regs_buff));
-+ if (regs.len > E1000_REGS_LEN)
-+ regs.len = E1000_REGS_LEN;
- e1000_ethtool_gregs(adapter, ®s, regs_buff);
- if(copy_to_user(addr, ®s, sizeof(regs)))
- return -EFAULT;
+++ /dev/null
---- linux-2.4/include/asm-i386/i387.h 2004-06-13 20:06:05.044881328 +0100
-+++ linux-2.4/include/asm-i386/i387.h 2004-06-13 20:25:42.836829736 +0100
-@@ -34,7 +34,7 @@
-
- #define clear_fpu( tsk ) do { \
- if ( tsk->flags & PF_USEDFPU ) { \
-- asm volatile("fwait"); \
-+ asm volatile("fnclex ; fwait"); \
- tsk->flags &= ~PF_USEDFPU; \
- stts(); \
- } \
--- /dev/null
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+# 2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au
+# [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
+#
+# xdr_argsize_check needs to cope with the possibility that the
+# pointer has wrapped and could be below buf->base.
+#
+# Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
+#
+# ### Diffstat output
+# ./fs/nfsd/nfs3xdr.c | 2 +-
+# ./include/linux/nfsd/xdr3.h | 2 +-
+# 2 files changed, 2 insertions(+), 2 deletions(-)
+#
+# fs/nfsd/nfs3xdr.c
+# 2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
+# Fixed possibly xdr parsing error if write size exceed 2^31
+#
+# include/linux/nfsd/xdr3.h
+# 2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
+# Fixed possibly xdr parsing error if write size exceed 2^31
+#
+diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+--- a/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00
++++ b/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00
+@@ -273,7 +273,7 @@
+ {
+ struct svc_buf *buf = &rqstp->rq_argbuf;
+
+- return p - buf->base <= buf->buflen;
++ return p >= buf->base && p <= buf->base + buf->buflen ;
+ }
+
+ static inline int
+diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
+--- a/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00
++++ b/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00
+@@ -41,7 +41,7 @@
+ __u32 count;
+ int stable;
+ __u8 * data;
+- int len;
++ __u32 len;
+ };
+
+ struct nfsd3_createargs {
+++ /dev/null
-diff -ur linux-2.4.25-rc3/mm/mremap.c linux-2.4.25-rc4/mm/mremap.c
---- linux-2.4.25-rc3/mm/mremap.c 2004-02-18 13:56:01.000000000 +0000
-+++ linux-2.4.25-rc4/mm/mremap.c 2004-02-18 13:49:08.000000000 +0000
-@@ -258,16 +258,20 @@
- if ((addr <= new_addr) && (addr+old_len) > new_addr)
- goto out;
-
-- do_munmap(current->mm, new_addr, new_len);
-+ ret = do_munmap(current->mm, new_addr, new_len);
-+ if (ret && new_len)
-+ goto out;
- }
-
- /*
- * Always allow a shrinking remap: that just unmaps
- * the unnecessary pages..
- */
-- ret = addr;
- if (old_len >= new_len) {
-- do_munmap(current->mm, addr+new_len, old_len - new_len);
-+ ret = do_munmap(current->mm, addr+new_len, old_len - new_len);
-+ if (ret && old_len != new_len)
-+ goto out;
-+ ret = addr;
- if (!(flags & MREMAP_FIXED) || (new_addr == addr))
- goto out;
- }
+++ /dev/null
-diff -urN linux-2.4.23/arch/cris/drivers/ds1302.c linux-2.4.24/arch/cris/drivers/ds1302.c
---- linux-2.4.23/arch/cris/drivers/ds1302.c 2003-08-25 04:44:39.000000000 -0700
-+++ linux-2.4.24/arch/cris/drivers/ds1302.c 2004-01-05 05:53:56.000000000 -0800
-@@ -346,6 +346,7 @@
- {
- struct rtc_time rtc_tm;
-
-+ memset(&rtc_tm, 0, sizeof (struct rtc_time));
- get_rtc_time(&rtc_tm);
- if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
- return -EFAULT;
-diff -urN linux-2.4.23/arch/cris/drivers/pcf8563.c linux-2.4.24/arch/cris/drivers/pcf8563.c
---- linux-2.4.23/arch/cris/drivers/pcf8563.c 2003-08-25 04:44:39.000000000 -0700
-+++ linux-2.4.24/arch/cris/drivers/pcf8563.c 2004-01-05 05:53:56.000000000 -0800
-@@ -220,6 +220,7 @@
- {
- struct rtc_time tm;
-
-+ memset(&tm, 0, sizeof (struct rtc_time));
- get_rtc_time(&tm);
-
- if (copy_to_user((struct rtc_time *) arg, &tm, sizeof tm)) {
-diff -urN linux-2.4.23/arch/m68k/bvme6000/rtc.c linux-2.4.24/arch/m68k/bvme6000/rtc.c
---- linux-2.4.23/arch/m68k/bvme6000/rtc.c 2003-06-13 07:51:31.000000000 -0700
-+++ linux-2.4.24/arch/m68k/bvme6000/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -54,6 +54,7 @@
- /* Ensure clock and real-time-mode-register are accessible */
- msr = rtc->msr & 0xc0;
- rtc->msr = 0x40;
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- do {
- wtime.tm_sec = BCD2BIN(rtc->bcd_sec);
- wtime.tm_min = BCD2BIN(rtc->bcd_min);
-diff -urN linux-2.4.23/arch/m68k/mvme16x/rtc.c linux-2.4.24/arch/m68k/mvme16x/rtc.c
---- linux-2.4.23/arch/m68k/mvme16x/rtc.c 2003-06-13 07:51:31.000000000 -0700
-+++ linux-2.4.24/arch/m68k/mvme16x/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -52,6 +52,7 @@
- cli();
- /* Ensure clock and real-time-mode-register are accessible */
- rtc->ctrl = RTC_READ;
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- wtime.tm_sec = BCD2BIN(rtc->bcd_sec);
- wtime.tm_min = BCD2BIN(rtc->bcd_min);
- wtime.tm_hour = BCD2BIN(rtc->bcd_hr);
-diff -urN linux-2.4.23/arch/ppc64/kernel/rtc.c linux-2.4.24/arch/ppc64/kernel/rtc.c
---- linux-2.4.23/arch/ppc64/kernel/rtc.c 2003-06-13 07:51:32.000000000 -0700
-+++ linux-2.4.24/arch/ppc64/kernel/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -96,6 +96,7 @@
- switch (cmd) {
- case RTC_RD_TIME: /* Read the time/date from RTC */
- {
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- ppc_md.get_rtc_time(&wtime);
- break;
- }
-diff -urN linux-2.4.23/drivers/acorn/char/i2c.c linux-2.4.24/drivers/acorn/char/i2c.c
---- linux-2.4.23/drivers/acorn/char/i2c.c 2003-08-25 04:44:40.000000000 -0700
-+++ linux-2.4.24/drivers/acorn/char/i2c.c 2004-01-05 05:53:56.000000000 -0800
-@@ -166,6 +166,7 @@
- break;
-
- case RTC_RD_TIME:
-+ memset(&rtctm, 0, sizeof(struct rtc_time));
- get_rtc_time(&rtc_raw, &year);
- rtctm.tm_sec = rtc_raw.secs;
- rtctm.tm_min = rtc_raw.mins;
-diff -urN linux-2.4.23/drivers/char/ds1286.c linux-2.4.24/drivers/char/ds1286.c
---- linux-2.4.23/drivers/char/ds1286.c 2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/ds1286.c 2004-01-05 05:53:56.000000000 -0800
-@@ -173,7 +173,7 @@
- * means "don't care" or "match all". Only the tm_hour,
- * tm_min, and tm_sec values are filled in.
- */
--
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- ds1286_get_alm_time(&wtime);
- break;
- }
-@@ -216,6 +216,7 @@
- }
- case RTC_RD_TIME: /* Read the time/date from RTC */
- {
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- ds1286_get_time(&wtime);
- break;
- }
-diff -urN linux-2.4.23/drivers/char/efirtc.c linux-2.4.24/drivers/char/efirtc.c
---- linux-2.4.23/drivers/char/efirtc.c 2003-06-13 07:51:32.000000000 -0700
-+++ linux-2.4.24/drivers/char/efirtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -118,6 +118,7 @@
- static void
- convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
- {
-+ memset(wtime, 0, sizeof(struct rtc_time));
- wtime->tm_sec = eft->second;
- wtime->tm_min = eft->minute;
- wtime->tm_hour = eft->hour;
-diff -urN linux-2.4.23/drivers/char/ip27-rtc.c linux-2.4.24/drivers/char/ip27-rtc.c
---- linux-2.4.23/drivers/char/ip27-rtc.c 2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/ip27-rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -83,6 +83,7 @@
- switch (cmd) {
- case RTC_RD_TIME: /* Read the time/date from RTC */
- {
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- get_rtc_time(&wtime);
- break;
- }
-diff -urN linux-2.4.23/drivers/char/mips_rtc.c linux-2.4.24/drivers/char/mips_rtc.c
---- linux-2.4.23/drivers/char/mips_rtc.c 2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/mips_rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -82,6 +82,7 @@
-
- switch (cmd) {
- case RTC_RD_TIME: /* Read the time/date from RTC */
-+ memset(&rtc_tm, 0, sizeof(struct rtc_time));
- curr_time = rtc_get_time();
- to_tm(curr_time, &rtc_tm);
- rtc_tm.tm_year -= 1900;
-diff -urN linux-2.4.23/drivers/char/rtc.c linux-2.4.24/drivers/char/rtc.c
---- linux-2.4.23/drivers/char/rtc.c 2003-11-28 10:26:20.000000000 -0800
-+++ linux-2.4.24/drivers/char/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -362,7 +362,7 @@
- * means "don't care" or "match all". Only the tm_hour,
- * tm_min, and tm_sec values are filled in.
- */
--
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- get_rtc_alm_time(&wtime);
- break;
- }
-@@ -406,6 +406,7 @@
- }
- case RTC_RD_TIME: /* Read the time/date from RTC */
- {
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- get_rtc_time(&wtime);
- break;
- }
-diff -urN linux-2.4.23/drivers/hil/hp_sdc_rtc.c linux-2.4.24/drivers/hil/hp_sdc_rtc.c
---- linux-2.4.23/drivers/hil/hp_sdc_rtc.c 2003-06-13 07:51:33.000000000 -0700
-+++ linux-2.4.24/drivers/hil/hp_sdc_rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -561,6 +561,7 @@
- }
- case RTC_ALM_READ: /* Read the present alarm time */
- {
-+ memset(&ttime, 0, sizeof(struct timeval));
- if (hp_sdc_rtc_read_mt(&ttime)) return -EFAULT;
- break;
- }
-@@ -609,6 +610,7 @@
- }
- case RTC_RD_TIME: /* Read the time/date from RTC */
- {
-+ memset(&wtime, 0, sizeof(struct rtc_time));
- if (hp_sdc_rtc_read_bbrtc(&wtime)) return -EFAULT;
- break;
- }
-diff -urN linux-2.4.23/drivers/macintosh/rtc.c linux-2.4.24/drivers/macintosh/rtc.c
---- linux-2.4.23/drivers/macintosh/rtc.c 2002-02-25 11:37:58.000000000 -0800
-+++ linux-2.4.24/drivers/macintosh/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -64,6 +64,7 @@
- case RTC_RD_TIME:
- if (ppc_md.get_rtc_time)
- {
-+ memset(&rtc_tm, 0, sizeof(struct rtc_time));
- get_rtc_time(&rtc_tm);
-
- if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -urN linux-2.4.23/drivers/sbus/char/rtc.c linux-2.4.24/drivers/sbus/char/rtc.c
---- linux-2.4.23/drivers/sbus/char/rtc.c 2001-10-10 23:42:47.000000000 -0700
-+++ linux-2.4.24/drivers/sbus/char/rtc.c 2004-01-05 05:53:56.000000000 -0800
-@@ -89,6 +89,7 @@
- switch (cmd)
- {
- case RTCGET:
-+ memset(&rtc_tm, 0, sizeof(struct rtc_time));
- get_rtc_time(&rtc_tm);
-
- if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
--- /dev/null
+Index: linux-2.6.5/fs/devpts/inode.c
+===================================================================
+--- linux-2.6.5.orig/fs/devpts/inode.c
++++ linux-2.6.5/fs/devpts/inode.c
+@@ -178,9 +178,13 @@ struct tty_struct *devpts_get_tty(int nu
+ {
+ struct dentry *dentry = get_node(number);
+ struct tty_struct *tty;
+-
+- tty = (IS_ERR(dentry) || !dentry->d_inode) ? NULL :
+- dentry->d_inode->u.generic_ip;
++
++ tty = NULL;
++ if (!IS_ERR(dentry)) {
++ if (dentry->d_inode)
++ tty = dentry->d_inode->u.generic_ip;
++ dput(dentry);
++ }
+
+ up(&devpts_root->d_inode->i_sem);
+
MD5 642af5ab5e1fc63685fde85e9ae601e4 linux-2.4.23.tar.bz2 29832609
-MD5 4d3cdc11578f59ecc163815dc7cd867d 2.4.23aa2.bz2 2036817
+MD5 138a6731c7d866129dc94088c3017f7d 2.4.23aa3.bz2 2057323
MD5 6fd4de1646ab0d47cf74a1553f5f7f6f aa-sources-2.4.23-CAN-2004-0415.patch 89286
+MD5 d6d1315c6d1bf14d639b40d6fbdbaf8b aa-sources-2.4.23-CAN-2004-0814.patch 81962
+++ /dev/null
---- a/mm/mmap.c Fri Sep 12 06:44:06 2003
-+++ b/mm/mmap.c Thu Oct 2 01:18:19 2003
-@@ -1041,6 +1041,9 @@
- if (!len)
- return addr;
-
-+ if ((addr + len) > TASK_SIZE || (addr + len) < addr)
-+ return -EINVAL;
-+
- /*
- * mlock MCL_FUTURE?
- */
projects / gentoo.git / commitdiff