From 7d4b578dc7d662cdbbfa7e79449f625000acbc3b Mon Sep 17 00:00:00 2001 From: Tony Vroon Date: Sun, 9 Jan 2005 00:55:21 +0000 Subject: [PATCH] Security bump for CAN-2004-1235, bug #77025. --- sys-kernel/development-sources/ChangeLog | 10 +- sys-kernel/development-sources/Manifest | 7 +- ...d => development-sources-2.6.10-r1.ebuild} | 4 +- ...lopment-sources-2.6.10-CAN-2004-1235.patch | 303 ++++++++++++++++++ ...0 => digest-development-sources-2.6.10-r1} | 0 5 files changed, 318 insertions(+), 6 deletions(-) rename sys-kernel/development-sources/{development-sources-2.6.10.ebuild => development-sources-2.6.10-r1.ebuild} (75%) create mode 100644 sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch rename sys-kernel/development-sources/files/{digest-development-sources-2.6.10 => digest-development-sources-2.6.10-r1} (100%) diff --git a/sys-kernel/development-sources/ChangeLog b/sys-kernel/development-sources/ChangeLog index c7e68c898f13..eca66b0dd402 100644 --- a/sys-kernel/development-sources/ChangeLog +++ b/sys-kernel/development-sources/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for sys-kernel/development-sources # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/ChangeLog,v 1.157 2005/01/08 14:08:28 chainsaw Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/ChangeLog,v 1.158 2005/01/09 00:55:21 chainsaw Exp $ + +*development-sources-2.6.10-r1 (09 Jan 2005) + + 09 Jan 2005; Tony Vroon + +files/development-sources-2.6.10-CAN-2004-1235.patch, + +development-sources-2.6.10-r1.ebuild, -development-sources-2.6.10.ebuild: + Security bump; patch for kernel uselib() privilege elevation + (CAN-2004-1235), see bug #77025. 08 Jan 2005; Tony Vroon development-sources-2.6.10.ebuild, -development-sources-2.6.10_rc1.ebuild, diff --git a/sys-kernel/development-sources/Manifest b/sys-kernel/development-sources/Manifest index 7c3efcc4aefd..dd20d392066b 100644 --- a/sys-kernel/development-sources/Manifest +++ b/sys-kernel/development-sources/Manifest @@ -1,14 +1,15 @@ MD5 dd80fcc2daf6c0f6f7ea378678f44494 development-sources-2.6.6.ebuild 997 MD5 81d5f69017302f45b0dc35e24ae28170 development-sources-2.6.8.1.ebuild 559 MD5 e1468b549b4d513ab0faad73af6bdb3c development-sources-2.6.5.ebuild 1394 +MD5 6a96b8d30d064a97d170d3147cc796e0 development-sources-2.6.10-r1.ebuild 602 MD5 bc7b1ae1fd08775d9252c7eb48a0453b development-sources-2.6.7.ebuild 1003 -MD5 f656f73e369ba4f003fa3649456377f2 development-sources-2.6.10.ebuild 562 MD5 b5aa40065c3d3094825824a4c2b964ff development-sources-2.6.9.ebuild 651 -MD5 3d5275d7252943bdfd11fd6711678b82 ChangeLog 28869 +MD5 037d5daa82c540f3d8bd497eb67766c4 ChangeLog 29196 MD5 5caccd9193acfe5a3a07ea88861cb11b metadata.xml 660 MD5 a09d4ddd7fe62bbf298879c6450cb6e7 files/digest-development-sources-2.6.5 208 MD5 214f14a8b49844fc44f74d8ab84019de files/digest-development-sources-2.6.6 137 MD5 23e1b75850b5a41b95c65e7771f39c48 files/digest-development-sources-2.6.7 137 MD5 414403f6046e06086e6d2fb0e2d5be60 files/digest-development-sources-2.6.9 135 -MD5 78b4470aebd0088d0560ca3f88387b83 files/digest-development-sources-2.6.10 67 +MD5 78b4470aebd0088d0560ca3f88387b83 files/digest-development-sources-2.6.10-r1 67 +MD5 cd0a7533c43364e377348613c6d76bb7 files/development-sources-2.6.10-CAN-2004-1235.patch 9736 MD5 18bed04a1b45de515096089cc10913ec files/digest-development-sources-2.6.8.1 68 diff --git a/sys-kernel/development-sources/development-sources-2.6.10.ebuild b/sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild similarity index 75% rename from sys-kernel/development-sources/development-sources-2.6.10.ebuild rename to sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild index 95bc6aab4195..ac8845d3cc8b 100644 --- a/sys-kernel/development-sources/development-sources-2.6.10.ebuild +++ b/sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2005 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/development-sources-2.6.10.ebuild,v 1.3 2005/01/08 14:08:28 chainsaw Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/development-sources/development-sources-2.6.10-r1.ebuild,v 1.1 2005/01/09 00:55:21 chainsaw Exp $ K_NOUSENAME="yes" K_NOSETEXTRAVERSION="yes" @@ -12,7 +12,7 @@ detect_version DESCRIPTION="Full sources for the vanilla 2.6 kernel tree" HOMEPAGE="http://www.kernel.org/" SRC_URI="${KERNEL_URI} ${ARCH_URI}" -UNIPATCH_LIST="${ARCH_PATCH}" +UNIPATCH_LIST="${ARCH_PATCH} ${FILESDIR}/${P}-CAN-2004-1235.patch" KEYWORDS="x86 ~ia64 ~ppc ~amd64 ~alpha" IUSE="" diff --git a/sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch b/sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch new file mode 100644 index 000000000000..6095e844d5f1 --- /dev/null +++ b/sys-kernel/development-sources/files/development-sources-2.6.10-CAN-2004-1235.patch @@ -0,0 +1,303 @@ +diff -ur linux-2.6.10/arch/mips/kernel/irixelf.c linux-2.6.10.plasmaroo/arch/mips/kernel/irixelf.c +--- linux-2.6.10/arch/mips/kernel/irixelf.c 2004-12-24 21:35:50.000000000 +0000 ++++ linux-2.6.10.plasmaroo/arch/mips/kernel/irixelf.c 2005-01-07 15:36:00.383356800 +0000 +@@ -127,7 +127,7 @@ + end = PAGE_ALIGN(end); + if (end <= start) + return; +- do_brk(start, end - start); ++ do_brk_locked(start, end - start); + } + + +@@ -375,7 +375,7 @@ + + /* Map the last of the bss segment */ + if (last_bss > len) { +- do_brk(len, (last_bss - len)); ++ do_brk_locked(len, (last_bss - len)); + } + kfree(elf_phdata); + +@@ -562,7 +562,7 @@ + unsigned long v; + struct prda *pp; + +- v = do_brk (PRDA_ADDRESS, PAGE_SIZE); ++ v = do_brk_locked (PRDA_ADDRESS, PAGE_SIZE); + + if (v < 0) + return; +@@ -853,7 +853,7 @@ + len = (elf_phdata->p_filesz + elf_phdata->p_vaddr+ 0xfff) & 0xfffff000; + bss = elf_phdata->p_memsz + elf_phdata->p_vaddr; + if (bss > len) +- do_brk(len, bss-len); ++ do_brk_locked(len, bss-len); + kfree(elf_phdata); + return 0; + } +diff -ur linux-2.6.10/arch/sparc64/kernel/binfmt_aout32.c linux-2.6.10.plasmaroo/arch/sparc64/kernel/binfmt_aout32.c +--- linux-2.6.10/arch/sparc64/kernel/binfmt_aout32.c 2004-12-24 21:34:45.000000000 +0000 ++++ linux-2.6.10.plasmaroo/arch/sparc64/kernel/binfmt_aout32.c 2005-01-07 15:36:00.432349352 +0000 +@@ -49,7 +49,7 @@ + end = PAGE_ALIGN(end); + if (end <= start) + return; +- do_brk(start, end - start); ++ do_brk_locked(start, end - start); + } + + /* +@@ -246,10 +246,10 @@ + if (N_MAGIC(ex) == NMAGIC) { + loff_t pos = fd_offset; + /* Fuck me plenty... */ +- error = do_brk(N_TXTADDR(ex), ex.a_text); ++ error = do_brk_locked(N_TXTADDR(ex), ex.a_text); + bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex), + ex.a_text, &pos); +- error = do_brk(N_DATADDR(ex), ex.a_data); ++ error = do_brk_locked(N_DATADDR(ex), ex.a_data); + bprm->file->f_op->read(bprm->file, (char __user *)N_DATADDR(ex), + ex.a_data, &pos); + goto beyond_if; +@@ -257,7 +257,7 @@ + + if (N_MAGIC(ex) == OMAGIC) { + loff_t pos = fd_offset; +- do_brk(N_TXTADDR(ex) & PAGE_MASK, ++ do_brk_locked(N_TXTADDR(ex) & PAGE_MASK, + ex.a_text+ex.a_data + PAGE_SIZE - 1); + bprm->file->f_op->read(bprm->file, (char __user *)N_TXTADDR(ex), + ex.a_text+ex.a_data, &pos); +@@ -272,7 +272,7 @@ + + if (!bprm->file->f_op->mmap) { + loff_t pos = fd_offset; +- do_brk(0, ex.a_text+ex.a_data); ++ do_brk_locked(0, ex.a_text+ex.a_data); + bprm->file->f_op->read(bprm->file, + (char __user *)N_TXTADDR(ex), + ex.a_text+ex.a_data, &pos); +@@ -389,7 +389,7 @@ + len = PAGE_ALIGN(ex.a_text + ex.a_data); + bss = ex.a_text + ex.a_data + ex.a_bss; + if (bss > len) { +- error = do_brk(start_addr + len, bss - len); ++ error = do_brk_locked(start_addr + len, bss - len); + retval = error; + if (error != start_addr + len) + goto out; +diff -Nur linux-2.6.10/arch/x86_64/ia32/ia32_aout.c linux-2.6.10.plasmaroo/arch/x86_64/ia32/ia32_aout.c +--- linux-2.6.10/arch/x86_64/ia32/ia32_aout.c 2005-01-03 16:17:04.000000000 -0200 ++++ linux-2.6.10.plasmaroo/arch/x86_64/ia32/ia32_aout.c 2005-01-03 16:46:53.846823360 -0200 +@@ -115,7 +115,7 @@ + end = PAGE_ALIGN(end); + if (end <= start) + return; +- do_brk(start, end - start); ++ do_brk_locked(start, end - start); + } + + #if CORE_DUMP +@@ -325,7 +325,7 @@ + pos = 32; + map_size = ex.a_text+ex.a_data; + +- error = do_brk(text_addr & PAGE_MASK, map_size); ++ error = do_brk_locked(text_addr & PAGE_MASK, map_size); + if (error != (text_addr & PAGE_MASK)) { + send_sig(SIGKILL, current, 0); + return error; +@@ -361,7 +361,7 @@ + + if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) { + loff_t pos = fd_offset; +- do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data); ++ do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data); + bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex), + ex.a_text+ex.a_data, &pos); + flush_icache_range((unsigned long) N_TXTADDR(ex), +@@ -470,7 +470,7 @@ + } + #endif + +- do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss); ++ do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss); + + file->f_op->read(file, (char *)start_addr, + ex.a_text + ex.a_data, &pos); +@@ -494,7 +494,7 @@ + len = PAGE_ALIGN(ex.a_text + ex.a_data); + bss = ex.a_text + ex.a_data + ex.a_bss; + if (bss > len) { +- error = do_brk(start_addr + len, bss - len); ++ error = do_brk_locked(start_addr + len, bss - len); + retval = error; + if (error != start_addr + len) + goto out; +diff -ur linux-2.6.10/fs/binfmt_aout.c linux-2.6.10.plasmaroo/fs/binfmt_aout.c +--- linux-2.6.10/fs/binfmt_aout.c 2004-12-24 21:35:50.000000000 +0000 ++++ linux-2.6.10.plasmaroo/fs/binfmt_aout.c 2005-01-07 15:36:00.000000000 +0000 +@@ -50,7 +50,7 @@ + start = PAGE_ALIGN(start); + end = PAGE_ALIGN(end); + if (end > start) { +- unsigned long addr = do_brk(start, end - start); ++ unsigned long addr = do_brk_locked(start, end - start); + if (BAD_ADDR(addr)) + return addr; + } +@@ -323,10 +323,10 @@ + loff_t pos = fd_offset; + /* Fuck me plenty... */ + /* */ +- error = do_brk(N_TXTADDR(ex), ex.a_text); ++ error = do_brk_locked(N_TXTADDR(ex), ex.a_text); + bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex), + ex.a_text, &pos); +- error = do_brk(N_DATADDR(ex), ex.a_data); ++ error = do_brk_locked(N_DATADDR(ex), ex.a_data); + bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex), + ex.a_data, &pos); + goto beyond_if; +@@ -347,7 +347,7 @@ + map_size = ex.a_text+ex.a_data; + #endif + +- error = do_brk(text_addr & PAGE_MASK, map_size); ++ error = do_brk_locked(text_addr & PAGE_MASK, map_size); + if (error != (text_addr & PAGE_MASK)) { + send_sig(SIGKILL, current, 0); + return error; +@@ -382,7 +382,7 @@ + + if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) { + loff_t pos = fd_offset; +- do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data); ++ do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data); + bprm->file->f_op->read(bprm->file, + (char __user *)N_TXTADDR(ex), + ex.a_text+ex.a_data, &pos); +@@ -488,7 +488,7 @@ + error_time = jiffies; + } + +- do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss); ++ do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss); + + file->f_op->read(file, (char __user *)start_addr, + ex.a_text + ex.a_data, &pos); +@@ -512,7 +512,7 @@ + len = PAGE_ALIGN(ex.a_text + ex.a_data); + bss = ex.a_text + ex.a_data + ex.a_bss; + if (bss > len) { +- error = do_brk(start_addr + len, bss - len); ++ error = do_brk_locked(start_addr + len, bss - len); + retval = error; + if (error != start_addr + len) + goto out; +diff -ur linux-2.6.10/fs/binfmt_elf.c linux-2.6.10.plasmaroo/fs/binfmt_elf.c +--- linux-2.6.10/fs/binfmt_elf.c 2004-12-24 21:34:33.000000000 +0000 ++++ linux-2.6.10.plasmaroo/fs/binfmt_elf.c 2005-01-07 15:36:00.000000000 +0000 +@@ -88,7 +88,7 @@ + start = ELF_PAGEALIGN(start); + end = ELF_PAGEALIGN(end); + if (end > start) { +- unsigned long addr = do_brk(start, end - start); ++ unsigned long addr = do_brk_locked(start, end - start); + if (BAD_ADDR(addr)) + return addr; + } +@@ -408,7 +408,7 @@ + + /* Map the last of the bss segment */ + if (last_bss > elf_bss) { +- error = do_brk(elf_bss, last_bss - elf_bss); ++ error = do_brk_locked(elf_bss, last_bss - elf_bss); + if (BAD_ADDR(error)) + goto out_close; + } +@@ -448,7 +448,7 @@ + goto out; + } + +- do_brk(0, text_data); ++ do_brk_locked(0, text_data); + if (!interpreter->f_op || !interpreter->f_op->read) + goto out; + if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0) +@@ -456,7 +456,7 @@ + flush_icache_range((unsigned long)addr, + (unsigned long)addr + text_data); + +- do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1), ++ do_brk_locked(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1), + interp_ex->a_bss); + elf_entry = interp_ex->a_entry; + +@@ -1025,7 +1025,7 @@ + len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1); + bss = elf_phdata->p_memsz + elf_phdata->p_vaddr; + if (bss > len) +- do_brk(len, bss - len); ++ do_brk_locked(len, bss - len); + error = 0; + + out_free_ph: +diff -ur linux-2.6.10/include/linux/mm.h linux-2.6.10.plasmaroo/include/linux/mm.h +--- linux-2.6.10/include/linux/mm.h 2004-12-24 21:33:50.000000000 +0000 ++++ linux-2.6.10.plasmaroo/include/linux/mm.h 2005-01-07 15:36:00.000000000 +0000 +@@ -704,6 +704,7 @@ + extern int do_munmap(struct mm_struct *, unsigned long, size_t); + + extern unsigned long do_brk(unsigned long, unsigned long); ++extern unsigned long do_brk_locked(unsigned long, unsigned long); + + /* filemap.c */ + extern unsigned long page_unuse(struct page *); +diff -ur linux-2.6.10/mm/mmap.c linux-2.6.10.plasmaroo/mm/mmap.c +--- linux-2.6.10/mm/mmap.c 2004-12-24 21:35:00.000000000 +0000 ++++ linux-2.6.10.plasmaroo/mm/mmap.c 2005-01-07 15:36:04.000000000 +0000 +@@ -1826,6 +1826,20 @@ + + EXPORT_SYMBOL(do_brk); + ++/* locking version of do_brk. */ ++unsigned long do_brk_locked(unsigned long addr, unsigned long len) ++{ ++ unsigned long ret; ++ ++ down_write(¤t->mm->mmap_sem); ++ ret = do_brk(addr, len); ++ up_write(¤t->mm->mmap_sem); ++ ++ return ret; ++} ++ ++EXPORT_SYMBOL(do_brk_locked); ++ + /* Release all mmaps. */ + void exit_mmap(struct mm_struct *mm) + { +@@ -1952,3 +1966,4 @@ + } + return new_vma; + } ++ +diff -ur linux-2.6.10/mm/nommu.c linux-2.6.10.plasmaroo/mm/nommu.c +--- linux-2.6.10/mm/nommu.c 2004-12-24 21:35:25.000000000 +0000 ++++ linux-2.6.10.plasmaroo/mm/nommu.c 2005-01-07 15:30:24.000000000 +0000 +@@ -557,6 +557,11 @@ + return -ENOMEM; + } + ++unsigned long do_brk_locked(unsigned long addr, unsigned long len) ++{ ++ return -ENOMEM; ++} ++ + struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr) + { + return NULL; diff --git a/sys-kernel/development-sources/files/digest-development-sources-2.6.10 b/sys-kernel/development-sources/files/digest-development-sources-2.6.10-r1 similarity index 100% rename from sys-kernel/development-sources/files/digest-development-sources-2.6.10 rename to sys-kernel/development-sources/files/digest-development-sources-2.6.10-r1 -- 2.26.2