# ChangeLog for sys-kernel/uclinux-sources
# Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.25 2004/12/19 19:16:12 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.26 2004/12/20 21:23:13 plasmaroo Exp $
+
+*uclinux-sources-2.6.7_p0-r12 (20 Dec 2004)
+
+ 20 Dec 2004; <plasmaroo@gentoo.org> -uclinux-sources-2.6.7_p0-r11.ebuild,
+ +uclinux-sources-2.6.7_p0-r12.ebuild,
+ +files/uclinux-sources-2.6.CAN-2004-1016.patch,
+ +files/uclinux-sources-2.6.CAN-2004-1056.patch,
+ +files/uclinux-sources-2.6.CAN-2004-1137.patch:
+ Security fixes - bugs #74384, #74392, #74464.
*uclinux-sources-2.6.7_p0-r11 (19 Dec 2004)
-MD5 0b085e6fc0e779f5b0ccf80806dacc44 ChangeLog 7906
-MD5 827f5f2371b581ed07275526b7ea5983 uclinux-sources-2.6.7_p0-r11.ebuild 2993
+MD5 3bb082683c2d311f91c33b068125e8a6 ChangeLog 8266
+MD5 085679c751cfb0f9743ed9418ff36ab1 uclinux-sources-2.6.7_p0-r12.ebuild 3293
MD5 f3fa6c474b8727f8215534b7fc9c93ba metadata.xml 304
MD5 e208a10aedd87d6614072a2e60d04ddb uclinux-sources-2.4.26_p0-r10.ebuild 2737
MD5 4d656fa3f3a47df751c0d78b64ed8353 files/uclinux-sources-2.6.AF_UNIX.SELinux.patch 1761
MD5 530630d25910e6bd9376b63ea099655f files/uclinux-sources-2.6.AF_UNIX.patch 469
MD5 60d25ff310fc6abfdce39ec9e47345af files/uclinux-sources-2.4.26_p0.CAN-2004-0685.patch 2809
MD5 d4a740ae56c2049247083af387a22a85 files/uclinux-sources-2.4.26_p0.CAN-2004-0394.patch 350
+MD5 c942eca63f26d0e933a366491340e95b files/uclinux-sources-2.6.CAN-2004-1056.patch 6187
MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/uclinux-sources-2.4.26_p0.smbfs.patch 3434
MD5 a9991d6324d7404ed99e79be6e44e9de files/uclinux-sources-2.6.binfmt_elf.patch 2348
MD5 6bcdd0bb63e2db559a5c6465c73a7f89 files/uclinux-sources-2.6.CAN-2004-1151.patch 1143
+MD5 09e9f1cad6f2f28fe81682cbad8e3011 files/uclinux-sources-2.6.CAN-2004-1137.patch 2551
MD5 915e8d7a0618736caa44d96968015467 files/uclinux-sources-2.4.26_p0.binfmt_elf.patch 2346
MD5 0f66013f643c79c97fda489618a4e2fd files/uclinux-sources-2.4.26_p0.CAN-2004-0535.patch 476
MD5 95708646470a95668e8789cd415844ed files/uclinux-sources.CAN-2004-0497.patch 846
+MD5 3f6f370e8be93508e492315860e508ac files/digest-uclinux-sources-2.6.7_p0-r12 287
MD5 c9da1bc82b906f6abc648c056e7bf662 files/uclinux-sources-2.4.26_p0.FPULockup-53804.patch 354
MD5 4c0855099b2f8bd4b6e06b4903d5ba74 files/uclinux-sources-2.6.vma.patch 7578
MD5 39361f8d16b1fe5891aab62e92f8cd30 files/uclinux-sources-2.6.IPTables-RDoS.patch 390
MD5 d306514f5f3dc06853daf8c3e60d01c9 files/digest-uclinux-sources-2.4.26_p0-r10 301
MD5 8204afea1d572b49a4a80d8da4eef0c9 files/uclinux-sources-2.6.CAN-2004-0596.patch 1033
MD5 b0a1f80aff51d6601e8924329023b241 files/uclinux-sources.AF_UNIX.patch 515
-MD5 3f6f370e8be93508e492315860e508ac files/digest-uclinux-sources-2.6.7_p0-r11 287
+MD5 6aa8f7a7c2d55734389b53d3bcf78570 files/uclinux-sources-2.6.CAN-2004-1016.patch 2835
MD5 d1ccc2047be533c992f67270a150a210 files/uclinux-sources-2.4.26_p0.cmdlineLeak.patch 388
--- /dev/null
+===== include/linux/socket.h 1.12 vs edited =====
+--- 1.12/include/linux/socket.h 2004-09-09 06:40:01 +10:00
++++ edited/include/linux/socket.h 2004-11-27 11:53:40 +11:00
+@@ -90,6 +90,10 @@
+ (struct cmsghdr *)(ctl) : \
+ (struct cmsghdr *)NULL)
+ #define CMSG_FIRSTHDR(msg) __CMSG_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG_OK(mhdr, cmsg) ((cmsg)->cmsg_len >= sizeof(struct cmsghdr) && \
++ (cmsg)->cmsg_len <= (unsigned long) \
++ ((mhdr)->msg_controllen - \
++ ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
+
+ /*
+ * This mess will go away with glibc
+===== net/core/scm.c 1.10 vs edited =====
+--- 1.10/net/core/scm.c 2004-05-31 05:08:14 +10:00
++++ edited/net/core/scm.c 2004-11-27 11:48:55 +11:00
+@@ -127,9 +127,7 @@
+ for too short ancillary data object at all! Oops.
+ OK, let's add it...
+ */
+- if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+- (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+- + cmsg->cmsg_len) > msg->msg_controllen)
++ if (!CMSG_OK(msg, cmsg))
+ goto error;
+
+ if (cmsg->cmsg_level != SOL_SOCKET)
+===== net/ipv4/ip_sockglue.c 1.26 vs edited =====
+--- 1.26/net/ipv4/ip_sockglue.c 2004-07-01 06:10:53 +10:00
++++ edited/net/ipv4/ip_sockglue.c 2004-11-27 11:49:45 +11:00
+@@ -146,11 +146,8 @@
+ struct cmsghdr *cmsg;
+
+ for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+- if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+- (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+- + cmsg->cmsg_len) > msg->msg_controllen) {
++ if (!CMSG_OK(msg, cmsg))
+ return -EINVAL;
+- }
+ if (cmsg->cmsg_level != SOL_IP)
+ continue;
+ switch (cmsg->cmsg_type) {
+===== net/ipv6/datagram.c 1.20 vs edited =====
+--- 1.20/net/ipv6/datagram.c 2004-11-10 17:57:03 +11:00
++++ edited/net/ipv6/datagram.c 2004-11-27 11:51:15 +11:00
+@@ -427,9 +427,7 @@
+ int addr_type;
+ struct net_device *dev = NULL;
+
+- if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+- (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+- + cmsg->cmsg_len) > msg->msg_controllen) {
++ if (!CMSG_OK(msg, cmsg)) {
+ err = -EINVAL;
+ goto exit_f;
+ }
+===== net/sctp/socket.c 1.129 vs edited =====
+--- 1.129/net/sctp/socket.c 2004-11-19 08:43:18 +11:00
++++ edited/net/sctp/socket.c 2004-11-27 11:52:11 +11:00
+@@ -4098,12 +4098,8 @@
+ for (cmsg = CMSG_FIRSTHDR(msg);
+ cmsg != NULL;
+ cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) {
+- /* Check for minimum length. The SCM code has this check. */
+- if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+- (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+- + cmsg->cmsg_len) > msg->msg_controllen) {
++ if (!CMSG_OK(msg, cmsg))
+ return -EINVAL;
+- }
+
+ /* Should we parse this header or ignore? */
+ if (cmsg->cmsg_level != IPPROTO_SCTP)
--- /dev/null
+diff -ur linux-2.6.7/drivers/char/drm/i810_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c
+--- linux-2.6.7/drivers/char/drm/i810_dma.c 2004-06-16 06:19:12.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c 2004-12-19 22:52:54.885438960 +0000
+@@ -1034,10 +1034,7 @@
+ drm_file_t *priv = filp->private_data;
+ drm_device_t *dev = priv->dev;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_flush_ioctl called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ i810_flush_queue(dev);
+ return 0;
+@@ -1059,10 +1056,7 @@
+ if (copy_from_user(&vertex, (drm_i810_vertex_t *)arg, sizeof(vertex)))
+ return -EFAULT;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_dma_vertex called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n",
+ vertex.idx, vertex.used, vertex.discard);
+@@ -1094,10 +1088,7 @@
+ if (copy_from_user(&clear, (drm_i810_clear_t *)arg, sizeof(clear)))
+ return -EFAULT;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_clear_bufs called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ /* GH: Someone's doing nasty things... */
+ if (!dev->dev_private) {
+@@ -1118,10 +1109,8 @@
+
+ DRM_DEBUG("i810_swap_bufs\n");
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_swap_buf called without lock held\n");
+- return -EINVAL;
+- }
++
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ i810_dma_dispatch_swap( dev );
+ return 0;
+@@ -1156,10 +1145,7 @@
+ if (copy_from_user(&d, (drm_i810_dma_t *)arg, sizeof(d)))
+ return -EFAULT;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_dma called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ d.granted = 0;
+
+@@ -1270,10 +1256,7 @@
+ return -EFAULT;
+
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_dma_mc called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ if (mc.idx >= dma->buf_count || mc.idx < 0)
+ return -EINVAL;
+@@ -1321,10 +1304,7 @@
+ drm_device_t *dev = priv->dev;
+ drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_fstatus called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+ return I810_READ(0x30008);
+ }
+
+@@ -1335,10 +1315,7 @@
+ drm_device_t *dev = priv->dev;
+ drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_ov0_flip called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ //Tell the overlay to update
+ I810_WRITE(0x30000,dev_priv->overlay_physical | 0x80000000);
+@@ -1380,10 +1357,7 @@
+
+ DRM_DEBUG("%s\n", __FUNCTION__);
+
+- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i810_flip_buf called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ if (!dev_priv->page_flipping)
+ i810_do_init_pageflip( dev );
+diff -ur linux-2.6.7/drivers/char/drm/i830_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c
+--- linux-2.6.7/drivers/char/drm/i830_dma.c 2004-06-16 06:18:57.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c 2004-12-19 22:52:54.887438656 +0000
+@@ -1320,10 +1320,7 @@
+ drm_file_t *priv = filp->private_data;
+ drm_device_t *dev = priv->dev;
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_flush_ioctl called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ i830_flush_queue(dev);
+ return 0;
+@@ -1344,10 +1341,7 @@
+ if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex)))
+ return -EFAULT;
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_dma_vertex called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ DRM_DEBUG("i830 dma vertex, idx %d used %d discard %d\n",
+ vertex.idx, vertex.used, vertex.discard);
+@@ -1374,10 +1368,7 @@
+ if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear)))
+ return -EFAULT;
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_clear_bufs called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ /* GH: Someone's doing nasty things... */
+ if (!dev->dev_private) {
+@@ -1399,10 +1390,7 @@
+
+ DRM_DEBUG("i830_swap_bufs\n");
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_swap_buf called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ i830_dma_dispatch_swap( dev );
+ return 0;
+@@ -1443,10 +1431,7 @@
+
+ DRM_DEBUG("%s\n", __FUNCTION__);
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_flip_buf called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ if (!dev_priv->page_flipping)
+ i830_do_init_pageflip( dev );
+@@ -1485,10 +1470,7 @@
+ if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d)))
+ return -EFAULT;
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_dma called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ d.granted = 0;
+
+diff -ur linux-2.6.7/drivers/char/drm/i830_irq.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c
+--- linux-2.6.7/drivers/char/drm/i830_irq.c 2004-06-16 06:19:44.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c 2004-12-19 22:52:54.887438656 +0000
+@@ -129,10 +129,7 @@
+ drm_i830_irq_emit_t emit;
+ int result;
+
+- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+- DRM_ERROR("i830_irq_emit called without lock held\n");
+- return -EINVAL;
+- }
++ LOCK_TEST_WITH_RETURN( dev, filp );
+
+ if ( !dev_priv ) {
+ DRM_ERROR( "%s called with no initialization\n", __FUNCTION__ );
--- /dev/null
+# ChangeSet
+# 2004/12/14 11:06:25-08:00 chrisw@osdl.org
+# [IPV4/IPV6]: IGMP source filter fixes
+#
+# When adding or deleting from the source list make sure to find matches
+# by comparing against the new source address, not the group address.
+# Also, check each addr in the list rather than just the first one.
+# And, finally, only delete from list when there's a match rather than
+# vice-versa. Drop the effort to keep list sorted, since it's not done
+# on full-state api and can create an sl_addr entry that the delta api
+# won't be able to delete. Without these fixes sl_count can be corrupted
+# which can allow for kernel memory corruption.
+#
+# Signed-off-by: Chris Wright <chrisw@osdl.org>
+# Signed-off-by: David S. Miller <davem@davemloft.net>
+#
+diff -Nru a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+--- a/net/ipv4/igmp.c 2004-12-20 11:32:15 -08:00
++++ b/net/ipv4/igmp.c 2004-12-20 11:32:15 -08:00
+@@ -1778,12 +1778,12 @@
+ goto done;
+ rv = !0;
+ for (i=0; i<psl->sl_count; i++) {
+- rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
++ rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
+ sizeof(__u32));
+- if (rv >= 0)
++ if (rv == 0)
+ break;
+ }
+- if (!rv) /* source not found */
++ if (rv) /* source not found */
+ goto done;
+
+ /* update the interface filter */
+@@ -1825,9 +1825,9 @@
+ }
+ rv = 1; /* > 0 for insert logic below if sl_count is 0 */
+ for (i=0; i<psl->sl_count; i++) {
+- rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
++ rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
+ sizeof(__u32));
+- if (rv >= 0)
++ if (rv == 0)
+ break;
+ }
+ if (rv == 0) /* address already there is an error */
+diff -Nru a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+--- a/net/ipv6/mcast.c 2004-12-20 11:32:15 -08:00
++++ b/net/ipv6/mcast.c 2004-12-20 11:32:15 -08:00
+@@ -391,12 +391,12 @@
+ goto done;
+ rv = !0;
+ for (i=0; i<psl->sl_count; i++) {
+- rv = memcmp(&psl->sl_addr, group,
++ rv = memcmp(&psl->sl_addr[i], source,
+ sizeof(struct in6_addr));
+- if (rv >= 0)
++ if (rv == 0)
+ break;
+ }
+- if (!rv) /* source not found */
++ if (rv) /* source not found */
+ goto done;
+
+ /* update the interface filter */
+@@ -437,8 +437,8 @@
+ }
+ rv = 1; /* > 0 for insert logic below if sl_count is 0 */
+ for (i=0; i<psl->sl_count; i++) {
+- rv = memcmp(&psl->sl_addr, group, sizeof(struct in6_addr));
+- if (rv >= 0)
++ rv = memcmp(&psl->sl_addr[i], source, sizeof(struct in6_addr));
++ if (rv == 0)
+ break;
+ }
+ if (rv == 0) /* address already there is an error */
# Copyright 1999-2004 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r11.ebuild,v 1.1 2004/12/19 19:16:12 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r12.ebuild,v 1.1 2004/12/20 21:23:13 plasmaroo Exp $
IUSE=""
epatch ${FILESDIR}/${PN}-2.6.AF_UNIX.patch || die "Failed to apply the AF_UNIX patch!"
epatch ${FILESDIR}/${PN}-2.6.AF_UNIX.SELinux.patch || die "Failed to apply the AF_UNIX SELinux-fix patch!"
epatch ${FILESDIR}/${PN}-2.6.binfmt_a.out.patch || die "Failed to apply the a.out patch!"
- epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1151.patch || die "Failed to apply the CAN-2004-1151 patch!"
epatch ${FILESDIR}/${PN}-2.6.vma.patch || die "Failed to apply the VMA patch!"
+ epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1016.patch || die "Failed to apply the CAN-2004-1016 patch!"
+ epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1056.patch || die "Failed to apply the CAN-2004-1056 patch!"
+ epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1137.patch || die "Failed to apply the CAN-2004-1137 patch!"
+ epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1151.patch || die "Failed to apply the CAN-2004-1151 patch!"
set MY_ARCH=${ARCH}
unset ARCH
projects / gentoo.git / commitdiff