From: Tim Yamin Date: Mon, 20 Dec 2004 22:21:09 +0000 (+0000) Subject: Security fixes - bugs #74384, #74392, #74464. X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=f63ae50bc6992ddc7e15d6932fd294d680ecd342;p=gentoo.git Security fixes - bugs #74384, #74392, #74464. --- diff --git a/sys-kernel/xbox-sources/ChangeLog b/sys-kernel/xbox-sources/ChangeLog index 910593a1d456..29d31b0a7a78 100644 --- a/sys-kernel/xbox-sources/ChangeLog +++ b/sys-kernel/xbox-sources/ChangeLog @@ -1,6 +1,15 @@ # ChangeLog for sys-kernel/xbox-sources # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.23 2004/12/19 20:13:10 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.24 2004/12/20 22:21:09 plasmaroo Exp $ + +*xbox-sources-2.6.8.1-r8 (20 Dec 2004) + + 20 Dec 2004; -xbox-sources-2.6.8.1-r7.ebuild, + +xbox-sources-2.6.8.1-r8.ebuild, + +files/xbox-sources-2.6.8.1.CAN-2004-1016.patch, + +files/xbox-sources-2.6.8.1.CAN-2004-1056.patch, + +files/xbox-sources-2.6.8.1.CAN-2004-1137.patch: + Security fixes - bugs #74384, #74392, #74464. *xbox-sources-2.6.8.1-r7 (19 Dec 2004) diff --git a/sys-kernel/xbox-sources/Manifest b/sys-kernel/xbox-sources/Manifest index be40f55d5447..8e660dc30791 100644 --- a/sys-kernel/xbox-sources/Manifest +++ b/sys-kernel/xbox-sources/Manifest @@ -1,12 +1,13 @@ -MD5 de72cbc4cd3bf73124d06e5a6d8ab7c7 ChangeLog 6768 +MD5 f3788685d77e5947258b157b1492f5f8 xbox-sources-2.6.8.1-r8.ebuild 1317 +MD5 aa8164b69221d6a194f5a931d75ac47d ChangeLog 7116 MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351 -MD5 0ff58dbeb2c1fb18a05f0b1783df0cf1 xbox-sources-2.6.8.1-r7.ebuild 1203 MD5 04be120a1c8b3c3ad58858c1109791b0 xbox-sources-2.4.28-r1.ebuild 720 -MD5 40a6dbccda0c9bc455d86f03e1db7d62 files/digest-xbox-sources-2.6.8.1-r7 230 +MD5 09e9f1cad6f2f28fe81682cbad8e3011 files/xbox-sources-2.6.8.1.CAN-2004-1137.patch 2551 MD5 025c80544aef14ce3a49024d791c5596 files/xbox-sources-2.6.8.1.binfmt_a.out.patch 1763 MD5 b0a1f80aff51d6601e8924329023b241 files/xbox-sources.AF_UNIX.patch 515 MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348 MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572 +MD5 6aa8f7a7c2d55734389b53d3bcf78570 files/xbox-sources-2.6.8.1.CAN-2004-1016.patch 2835 MD5 4d656fa3f3a47df751c0d78b64ed8353 files/xbox-sources-2.6.8.1.AF_UNIX.SELinux.patch 1761 MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281 MD5 b9a94233e1457787352e5f85e3e3582d files/xbox-sources-2.4.28.binfmt_a.out.patch 2009 @@ -14,4 +15,6 @@ MD5 530630d25910e6bd9376b63ea099655f files/xbox-sources-2.6.8.1.AF_UNIX.patch 46 MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309 MD5 6bcdd0bb63e2db559a5c6465c73a7f89 files/xbox-sources-2.6.8.1.CAN-2004-1151.patch 1143 MD5 22192366443458dc8815827df35b63a7 files/xbox-sources-2.6.8.1.vma.patch 8034 +MD5 40a6dbccda0c9bc455d86f03e1db7d62 files/digest-xbox-sources-2.6.8.1-r8 230 +MD5 c942eca63f26d0e933a366491340e95b files/xbox-sources-2.6.8.1.CAN-2004-1056.patch 6187 MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28-r1 226 diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r7 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r8 similarity index 100% rename from sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r7 rename to sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r8 diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch new file mode 100644 index 000000000000..aa25ac95ed61 --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch @@ -0,0 +1,75 @@ +===== include/linux/socket.h 1.12 vs edited ===== +--- 1.12/include/linux/socket.h 2004-09-09 06:40:01 +10:00 ++++ edited/include/linux/socket.h 2004-11-27 11:53:40 +11:00 +@@ -90,6 +90,10 @@ + (struct cmsghdr *)(ctl) : \ + (struct cmsghdr *)NULL) + #define CMSG_FIRSTHDR(msg) __CMSG_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen) ++#define CMSG_OK(mhdr, cmsg) ((cmsg)->cmsg_len >= sizeof(struct cmsghdr) && \ ++ (cmsg)->cmsg_len <= (unsigned long) \ ++ ((mhdr)->msg_controllen - \ ++ ((char *)(cmsg) - (char *)(mhdr)->msg_control))) + + /* + * This mess will go away with glibc +===== net/core/scm.c 1.10 vs edited ===== +--- 1.10/net/core/scm.c 2004-05-31 05:08:14 +10:00 ++++ edited/net/core/scm.c 2004-11-27 11:48:55 +11:00 +@@ -127,9 +127,7 @@ + for too short ancillary data object at all! Oops. + OK, let's add it... + */ +- if (cmsg->cmsg_len < sizeof(struct cmsghdr) || +- (unsigned long)(((char*)cmsg - (char*)msg->msg_control) +- + cmsg->cmsg_len) > msg->msg_controllen) ++ if (!CMSG_OK(msg, cmsg)) + goto error; + + if (cmsg->cmsg_level != SOL_SOCKET) +===== net/ipv4/ip_sockglue.c 1.26 vs edited ===== +--- 1.26/net/ipv4/ip_sockglue.c 2004-07-01 06:10:53 +10:00 ++++ edited/net/ipv4/ip_sockglue.c 2004-11-27 11:49:45 +11:00 +@@ -146,11 +146,8 @@ + struct cmsghdr *cmsg; + + for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) { +- if (cmsg->cmsg_len < sizeof(struct cmsghdr) || +- (unsigned long)(((char*)cmsg - (char*)msg->msg_control) +- + cmsg->cmsg_len) > msg->msg_controllen) { ++ if (!CMSG_OK(msg, cmsg)) + return -EINVAL; +- } + if (cmsg->cmsg_level != SOL_IP) + continue; + switch (cmsg->cmsg_type) { +===== net/ipv6/datagram.c 1.20 vs edited ===== +--- 1.20/net/ipv6/datagram.c 2004-11-10 17:57:03 +11:00 ++++ edited/net/ipv6/datagram.c 2004-11-27 11:51:15 +11:00 +@@ -427,9 +427,7 @@ + int addr_type; + struct net_device *dev = NULL; + +- if (cmsg->cmsg_len < sizeof(struct cmsghdr) || +- (unsigned long)(((char*)cmsg - (char*)msg->msg_control) +- + cmsg->cmsg_len) > msg->msg_controllen) { ++ if (!CMSG_OK(msg, cmsg)) { + err = -EINVAL; + goto exit_f; + } +===== net/sctp/socket.c 1.129 vs edited ===== +--- 1.129/net/sctp/socket.c 2004-11-19 08:43:18 +11:00 ++++ edited/net/sctp/socket.c 2004-11-27 11:52:11 +11:00 +@@ -4098,12 +4098,8 @@ + for (cmsg = CMSG_FIRSTHDR(msg); + cmsg != NULL; + cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) { +- /* Check for minimum length. The SCM code has this check. */ +- if (cmsg->cmsg_len < sizeof(struct cmsghdr) || +- (unsigned long)(((char*)cmsg - (char*)msg->msg_control) +- + cmsg->cmsg_len) > msg->msg_controllen) { ++ if (!CMSG_OK(msg, cmsg)) + return -EINVAL; +- } + + /* Should we parse this header or ignore? */ + if (cmsg->cmsg_level != IPPROTO_SCTP) diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch new file mode 100644 index 000000000000..f55ca8372e38 --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch @@ -0,0 +1,202 @@ +diff -ur linux-2.6.7/drivers/char/drm/i810_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c +--- linux-2.6.7/drivers/char/drm/i810_dma.c 2004-06-16 06:19:12.000000000 +0100 ++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c 2004-12-19 22:52:54.885438960 +0000 +@@ -1034,10 +1034,7 @@ + drm_file_t *priv = filp->private_data; + drm_device_t *dev = priv->dev; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_flush_ioctl called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + i810_flush_queue(dev); + return 0; +@@ -1059,10 +1056,7 @@ + if (copy_from_user(&vertex, (drm_i810_vertex_t *)arg, sizeof(vertex))) + return -EFAULT; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_dma_vertex called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n", + vertex.idx, vertex.used, vertex.discard); +@@ -1094,10 +1088,7 @@ + if (copy_from_user(&clear, (drm_i810_clear_t *)arg, sizeof(clear))) + return -EFAULT; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_clear_bufs called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + /* GH: Someone's doing nasty things... */ + if (!dev->dev_private) { +@@ -1118,10 +1109,8 @@ + + DRM_DEBUG("i810_swap_bufs\n"); + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_swap_buf called without lock held\n"); +- return -EINVAL; +- } ++ ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + i810_dma_dispatch_swap( dev ); + return 0; +@@ -1156,10 +1145,7 @@ + if (copy_from_user(&d, (drm_i810_dma_t *)arg, sizeof(d))) + return -EFAULT; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_dma called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + d.granted = 0; + +@@ -1270,10 +1256,7 @@ + return -EFAULT; + + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_dma_mc called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + if (mc.idx >= dma->buf_count || mc.idx < 0) + return -EINVAL; +@@ -1321,10 +1304,7 @@ + drm_device_t *dev = priv->dev; + drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_fstatus called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + return I810_READ(0x30008); + } + +@@ -1335,10 +1315,7 @@ + drm_device_t *dev = priv->dev; + drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private; + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_ov0_flip called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + //Tell the overlay to update + I810_WRITE(0x30000,dev_priv->overlay_physical | 0x80000000); +@@ -1380,10 +1357,7 @@ + + DRM_DEBUG("%s\n", __FUNCTION__); + +- if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i810_flip_buf called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + if (!dev_priv->page_flipping) + i810_do_init_pageflip( dev ); +diff -ur linux-2.6.7/drivers/char/drm/i830_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c +--- linux-2.6.7/drivers/char/drm/i830_dma.c 2004-06-16 06:18:57.000000000 +0100 ++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c 2004-12-19 22:52:54.887438656 +0000 +@@ -1320,10 +1320,7 @@ + drm_file_t *priv = filp->private_data; + drm_device_t *dev = priv->dev; + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_flush_ioctl called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + i830_flush_queue(dev); + return 0; +@@ -1344,10 +1341,7 @@ + if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex))) + return -EFAULT; + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_dma_vertex called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + DRM_DEBUG("i830 dma vertex, idx %d used %d discard %d\n", + vertex.idx, vertex.used, vertex.discard); +@@ -1374,10 +1368,7 @@ + if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear))) + return -EFAULT; + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_clear_bufs called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + /* GH: Someone's doing nasty things... */ + if (!dev->dev_private) { +@@ -1399,10 +1390,7 @@ + + DRM_DEBUG("i830_swap_bufs\n"); + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_swap_buf called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + i830_dma_dispatch_swap( dev ); + return 0; +@@ -1443,10 +1431,7 @@ + + DRM_DEBUG("%s\n", __FUNCTION__); + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_flip_buf called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + if (!dev_priv->page_flipping) + i830_do_init_pageflip( dev ); +@@ -1485,10 +1470,7 @@ + if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d))) + return -EFAULT; + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_dma called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + d.granted = 0; + +diff -ur linux-2.6.7/drivers/char/drm/i830_irq.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c +--- linux-2.6.7/drivers/char/drm/i830_irq.c 2004-06-16 06:19:44.000000000 +0100 ++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c 2004-12-19 22:52:54.887438656 +0000 +@@ -129,10 +129,7 @@ + drm_i830_irq_emit_t emit; + int result; + +- if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) { +- DRM_ERROR("i830_irq_emit called without lock held\n"); +- return -EINVAL; +- } ++ LOCK_TEST_WITH_RETURN( dev, filp ); + + if ( !dev_priv ) { + DRM_ERROR( "%s called with no initialization\n", __FUNCTION__ ); diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch new file mode 100644 index 000000000000..0a54680f6f4b --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch @@ -0,0 +1,77 @@ +# ChangeSet +# 2004/12/14 11:06:25-08:00 chrisw@osdl.org +# [IPV4/IPV6]: IGMP source filter fixes +# +# When adding or deleting from the source list make sure to find matches +# by comparing against the new source address, not the group address. +# Also, check each addr in the list rather than just the first one. +# And, finally, only delete from list when there's a match rather than +# vice-versa. Drop the effort to keep list sorted, since it's not done +# on full-state api and can create an sl_addr entry that the delta api +# won't be able to delete. Without these fixes sl_count can be corrupted +# which can allow for kernel memory corruption. +# +# Signed-off-by: Chris Wright +# Signed-off-by: David S. Miller +# +diff -Nru a/net/ipv4/igmp.c b/net/ipv4/igmp.c +--- a/net/ipv4/igmp.c 2004-12-20 11:32:15 -08:00 ++++ b/net/ipv4/igmp.c 2004-12-20 11:32:15 -08:00 +@@ -1778,12 +1778,12 @@ + goto done; + rv = !0; + for (i=0; isl_count; i++) { +- rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr, ++ rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr, + sizeof(__u32)); +- if (rv >= 0) ++ if (rv == 0) + break; + } +- if (!rv) /* source not found */ ++ if (rv) /* source not found */ + goto done; + + /* update the interface filter */ +@@ -1825,9 +1825,9 @@ + } + rv = 1; /* > 0 for insert logic below if sl_count is 0 */ + for (i=0; isl_count; i++) { +- rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr, ++ rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr, + sizeof(__u32)); +- if (rv >= 0) ++ if (rv == 0) + break; + } + if (rv == 0) /* address already there is an error */ +diff -Nru a/net/ipv6/mcast.c b/net/ipv6/mcast.c +--- a/net/ipv6/mcast.c 2004-12-20 11:32:15 -08:00 ++++ b/net/ipv6/mcast.c 2004-12-20 11:32:15 -08:00 +@@ -391,12 +391,12 @@ + goto done; + rv = !0; + for (i=0; isl_count; i++) { +- rv = memcmp(&psl->sl_addr, group, ++ rv = memcmp(&psl->sl_addr[i], source, + sizeof(struct in6_addr)); +- if (rv >= 0) ++ if (rv == 0) + break; + } +- if (!rv) /* source not found */ ++ if (rv) /* source not found */ + goto done; + + /* update the interface filter */ +@@ -437,8 +437,8 @@ + } + rv = 1; /* > 0 for insert logic below if sl_count is 0 */ + for (i=0; isl_count; i++) { +- rv = memcmp(&psl->sl_addr, group, sizeof(struct in6_addr)); +- if (rv >= 0) ++ rv = memcmp(&psl->sl_addr[i], source, sizeof(struct in6_addr)); ++ if (rv == 0) + break; + } + if (rv == 0) /* address already there is an error */ diff --git a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild similarity index 86% rename from sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild rename to sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild index 695defd6214a..f993cd530b7c 100644 --- a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild +++ b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild,v 1.1 2004/12/19 20:13:10 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild,v 1.1 2004/12/20 22:21:09 plasmaroo Exp $ ETYPE='sources' inherit kernel-2 @@ -21,6 +21,9 @@ UNIPATCH_LIST=" ${FILESDIR}/${P}.binfmt_a.out.patch ${FILESDIR}/${P}.AF_UNIX.patch ${FILESDIR}/${P}.AF_UNIX.SELinux.patch + ${FILESDIR}/${P}.CAN-2004-1016.patch + ${FILESDIR}/${P}.CAN-2004-1056.patch + ${FILESDIR}/${P}.CAN-2004-1137.patch ${FILESDIR}/${P}.CAN-2004-1151.patch ${FILESDIR}/${P}.vma.patch" DESCRIPTION='Full sources for the Xbox Linux kernel'