From 84acc09604bc40736d33997656cf1dab62525e6e Mon Sep 17 00:00:00 2001 From: Tim Yamin Date: Sat, 27 Nov 2004 18:08:56 +0000 Subject: [PATCH] Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452 and #72317. --- sys-kernel/xbox-sources/ChangeLog | 13 ++- sys-kernel/xbox-sources/Manifest | 22 ++--- .../files/digest-xbox-sources-2.4.27-r5 | 4 - ...s-2.4.28 => digest-xbox-sources-2.4.28-r1} | 0 ....8.1-r4 => digest-xbox-sources-2.6.8.1-r5} | 0 .../xbox-sources-2.4.26.CAN-2004-0394.patch | 11 --- .../xbox-sources-2.4.27.XDRWrapFix.patch | 48 --------- .../xbox-sources-2.4.27.binfmt_elf.patch | 85 ---------------- .../xbox-sources-2.4.27.cmdlineLeak.patch | 11 --- .../files/xbox-sources-2.4.27.smbfs.patch | 97 ------------------- .../xbox-sources-2.4.28.binfmt_a.out.patch | 63 ++++++++++++ .../xbox-sources-2.6.8.1.binfmt_a.out.patch | 63 ++++++++++++ .../files/xbox-sources.AF_UNIX.patch | 24 +++++ .../xbox-sources-2.4.27-r5.ebuild | 28 ------ ...8.ebuild => xbox-sources-2.4.28-r1.ebuild} | 5 +- ....ebuild => xbox-sources-2.6.8.1-r5.ebuild} | 6 +- 16 files changed, 178 insertions(+), 302 deletions(-) delete mode 100644 sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 rename sys-kernel/xbox-sources/files/{digest-xbox-sources-2.4.28 => digest-xbox-sources-2.4.28-r1} (100%) rename sys-kernel/xbox-sources/files/{digest-xbox-sources-2.6.8.1-r4 => digest-xbox-sources-2.6.8.1-r5} (100%) delete mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch delete mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch delete mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch delete mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch delete mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch create mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch create mode 100644 sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch create mode 100644 sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch delete mode 100644 sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild rename sys-kernel/xbox-sources/{xbox-sources-2.4.28.ebuild => xbox-sources-2.4.28-r1.ebuild} (80%) rename sys-kernel/xbox-sources/{xbox-sources-2.6.8.1-r4.ebuild => xbox-sources-2.6.8.1-r5.ebuild} (84%) diff --git a/sys-kernel/xbox-sources/ChangeLog b/sys-kernel/xbox-sources/ChangeLog index 3b4489435914..e1d32cbbe0ca 100644 --- a/sys-kernel/xbox-sources/ChangeLog +++ b/sys-kernel/xbox-sources/ChangeLog @@ -1,6 +1,17 @@ # ChangeLog for sys-kernel/xbox-sources # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.19 2004/11/24 14:13:57 chrb Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.20 2004/11/27 18:08:56 plasmaroo Exp $ + +*xbox-sources-2.4.28-r1 (27 Nov 2004) + + 27 Nov 2004; -xbox-sources-2.4.27-r5.ebuild, + +xbox-sources-2.4.28-r1.ebuild, -xbox-sources-2.4.28.ebuild, + -xbox-sources-2.6.8.1-r4.ebuild, +xbox-sources-2.6.8.1-r5.ebuild, + +files/xbox-sources-2.4.28.binfmt_a.out.patch, + +files/xbox-sources-2.6.8.1.binfmt_a.out.patch, + +files/xbox-sources.AF_UNIX.patch: + Version bump for the AF_UNIX and a.out security vulnerabilities; bugs #72452 + and #72317. *xbox-sources-2.4.28 (24 Nov 2004) diff --git a/sys-kernel/xbox-sources/Manifest b/sys-kernel/xbox-sources/Manifest index 637b27a2d965..23e8b79b88f5 100644 --- a/sys-kernel/xbox-sources/Manifest +++ b/sys-kernel/xbox-sources/Manifest @@ -1,17 +1,13 @@ -MD5 9e9a4a71d22e9ff0abfc7cdcba3519ba ChangeLog 5498 +MD5 fb5e3ca9016ccc95c16beab574956ee1 ChangeLog 5973 +MD5 1745c9969e718a82d97dd130d7f5ef7b xbox-sources-2.6.8.1-r5.ebuild 1095 MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351 -MD5 c49f123b75ad53f6b50ebf38489c05f2 xbox-sources-2.4.27-r5.ebuild 1015 -MD5 90f4d74240992ee1dd8410bf8a326f02 xbox-sources-2.6.8.1-r4.ebuild 1025 -MD5 e61e335899fc80f9cf1ed23b652d4b74 xbox-sources-2.4.28.ebuild 675 -MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r5 302 -MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r4 227 -MD5 2b3ddb8b8b15f8da35ade38544b57857 files/xbox-sources-2.4.27.XDRWrapFix.patch 1499 -MD5 d4a740ae56c2049247083af387a22a85 files/xbox-sources-2.4.26.CAN-2004-0394.patch 350 -MD5 d1ccc2047be533c992f67270a150a210 files/xbox-sources-2.4.27.cmdlineLeak.patch 388 +MD5 04be120a1c8b3c3ad58858c1109791b0 xbox-sources-2.4.28-r1.ebuild 720 +MD5 025c80544aef14ce3a49024d791c5596 files/xbox-sources-2.6.8.1.binfmt_a.out.patch 1763 +MD5 b0a1f80aff51d6601e8924329023b241 files/xbox-sources.AF_UNIX.patch 515 MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348 -MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281 -MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28 226 -MD5 915e8d7a0618736caa44d96968015467 files/xbox-sources-2.4.27.binfmt_elf.patch 2346 -MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/xbox-sources-2.4.27.smbfs.patch 3434 MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572 +MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281 +MD5 b9a94233e1457787352e5f85e3e3582d files/xbox-sources-2.4.28.binfmt_a.out.patch 2009 MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309 +MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r5 227 +MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28-r1 226 diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 deleted file mode 100644 index aca272e6984e..000000000000 --- a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5 +++ /dev/null @@ -1,4 +0,0 @@ -MD5 59a2e6fde1d110e2ffa20351ac8b4d9e linux-2.4.27.tar.bz2 30898453 -MD5 6236760189c6c17affecb47768bf143c xbox-sources-2.4.27-r0.patch.bz2 133155 -MD5 a68b51962e4bd9349749d2ca167e97ab xbox-sources-2.4.27.squashfs.patch.bz2 13033 -MD5 4b99df79dcc18b17eb41489b96ff9689 linux-2.4.27-CAN-2004-0814.patch 81529 diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28-r1 similarity index 100% rename from sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28 rename to sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.28-r1 diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r4 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r5 similarity index 100% rename from sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r4 rename to sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r5 diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch deleted file mode 100644 index 273f1a52046f..000000000000 --- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.26.CAN-2004-0394.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- linux-2.4.22-oM3-orig/kernel/panic.c Tue Mar 30 15:37:18 2004 -+++ linux-2.4.22-oM3-mod/kernel/panic.c Mon May 17 18:44:01 2004 -@@ -51,7 +51,7 @@ - - bust_spinlocks(1); - va_start(args, fmt); -- vsprintf(buf, fmt, args); -+ vsnprintf(buf, sizeof(buf), fmt, args); - va_end(args); - printk(KERN_EMERG "Kernel panic: %s\n",buf); - if (in_interrupt()) diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch deleted file mode 100644 index 9a336ab7876a..000000000000 --- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.XDRWrapFix.patch +++ /dev/null @@ -1,48 +0,0 @@ -# This is a BitKeeper generated diff -Nru style patch. -# -# ChangeSet -# 2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au -# [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31 -# -# xdr_argsize_check needs to cope with the possibility that the -# pointer has wrapped and could be below buf->base. -# -# Signed-off-by: Neil Brown -# -# ### Diffstat output -# ./fs/nfsd/nfs3xdr.c | 2 +- -# ./include/linux/nfsd/xdr3.h | 2 +- -# 2 files changed, 2 insertions(+), 2 deletions(-) -# -# fs/nfsd/nfs3xdr.c -# 2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1 -# Fixed possibly xdr parsing error if write size exceed 2^31 -# -# include/linux/nfsd/xdr3.h -# 2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1 -# Fixed possibly xdr parsing error if write size exceed 2^31 -# -diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c ---- a/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00 -+++ b/fs/nfsd/nfs3xdr.c 2004-09-06 11:20:28 -07:00 -@@ -273,7 +273,7 @@ - { - struct svc_buf *buf = &rqstp->rq_argbuf; - -- return p - buf->base <= buf->buflen; -+ return p >= buf->base && p <= buf->base + buf->buflen ; - } - - static inline int -diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h ---- a/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00 -+++ b/include/linux/nfsd/xdr3.h 2004-09-06 11:20:28 -07:00 -@@ -41,7 +41,7 @@ - __u32 count; - int stable; - __u8 * data; -- int len; -+ __u32 len; - }; - - struct nfsd3_createargs { diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch deleted file mode 100644 index 9f4f44ee78f5..000000000000 --- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch +++ /dev/null @@ -1,85 +0,0 @@ -diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c ---- linux-2.4.27/fs/binfmt_elf.c 2004-04-14 14:05:40.000000000 +0100 -+++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c 2004-11-19 21:30:26.745410824 +0000 -@@ -299,9 +299,12 @@ - goto out; - - retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size); -- error = retval; -- if (retval < 0) -+ error = -EIO; -+ if (retval != size) { -+ if (retval < 0) -+ error = retval; - goto out_close; -+ } - - eppnt = elf_phdata; - for (i=0; ie_phnum; i++, eppnt++) { -@@ -475,8 +478,11 @@ - goto out; - - retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size); -- if (retval < 0) -+ if (retval != size) { -+ if (retval >= 0) -+ retval = -EIO; - goto out_free_ph; -+ } - - files = current->files; /* Refcounted so ok */ - retval = unshare_files(); -@@ -513,7 +519,8 @@ - */ - - retval = -ENOMEM; -- if (elf_ppnt->p_filesz > PATH_MAX) -+ if (elf_ppnt->p_filesz > PATH_MAX || -+ elf_ppnt->p_filesz == 0) - goto out_free_file; - elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz, - GFP_KERNEL); -@@ -523,8 +530,16 @@ - retval = kernel_read(bprm->file, elf_ppnt->p_offset, - elf_interpreter, - elf_ppnt->p_filesz); -- if (retval < 0) -+ if (retval != elf_ppnt->p_filesz) { -+ if (retval >= 0) -+ retval = -EIO; -+ goto out_free_interp; -+ } -+ /* make sure path is NULL terminated */ -+ retval = -EINVAL; -+ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') - goto out_free_interp; -+ - /* If the program interpreter is one of these two, - * then assume an iBCS2 image. Otherwise assume - * a native linux image. -@@ -543,8 +558,11 @@ - if (IS_ERR(interpreter)) - goto out_free_interp; - retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE); -- if (retval < 0) -+ if (retval != BINPRM_BUF_SIZE) { -+ if (retval >= 0) -+ retval = -EIO; - goto out_free_dentry; -+ } - - /* Get the exec headers */ - interp_ex = *((struct exec *) bprm->buf); -@@ -682,8 +700,10 @@ - } - - error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags); -- if (BAD_ADDR(error)) -- continue; -+ if (BAD_ADDR(error)) { -+ send_sig(SIGKILL, current, 0); -+ goto out_free_dentry; -+ } - - if (!load_addr_set) { - load_addr_set = 1; diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch deleted file mode 100644 index 5f26f7f388f6..000000000000 --- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.cmdlineLeak.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- linux-2.4/fs/proc/base.c 2004-04-15 07:09:32.000000000 +0100 -+++ linux-2.4/fs/proc/base.c.plasmaroo 2004-08-09 23:30:43.869195800 +0100 -@@ -187,7 +187,7 @@ static int proc_pid_cmdline(struct task_ - if (mm) - atomic_inc(&mm->mm_users); - task_unlock(task); -- if (mm) { -+ if (mm && mm->arg_end) { - int len = mm->arg_end - mm->arg_start; - if (len > PAGE_SIZE) - len = PAGE_SIZE; diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch deleted file mode 100644 index 63c5ba30403f..000000000000 --- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch +++ /dev/null @@ -1,97 +0,0 @@ -diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c ---- linux-2.4.27/fs/smbfs/proc.c 2004-11-12 19:32:24.000000000 +0000 -+++ linux-2.4.28/fs/smbfs/proc.c 2004-11-19 20:18:27.000000000 +0000 -@@ -1289,10 +1289,12 @@ - data_len = WVAL(buf, 1); - - /* we can NOT simply trust the data_len given by the server ... */ -- if (data_len > server->packet_size - (buf+3 - server->packet)) { -- printk(KERN_ERR "smb_proc_read: invalid data length!! " -- "%d > %d - (%p - %p)\n", -- data_len, server->packet_size, buf+3, server->packet); -+ if (data_len > count || -+ (buf+3 - server->packet) + data_len > server->packet_size) { -+ printk(KERN_ERR "smb_proc_read: invalid data length/offset!! " -+ "%d > %d || (%p - %p) + %d > %d\n", -+ data_len, count, -+ buf+3, server->packet, data_len, server->packet_size); - result = -EIO; - goto out; - } -@@ -1378,10 +1380,12 @@ - buf = smb_base(server->packet) + data_off; - - /* we can NOT simply trust the info given by the server ... */ -- if (data_len > server->packet_size - (buf - server->packet)) { -- printk(KERN_ERR "smb_proc_read: invalid data length!! " -- "%d > %d - (%p - %p)\n", -- data_len, server->packet_size, buf, server->packet); -+ if (data_len > count || -+ (buf - server->packet) + data_len > server->packet_size) { -+ printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! " -+ "%d > %d || (%p - %p) + %d > %d\n", -+ data_len, count, -+ buf, server->packet, data_len, server->packet_size); - result = -EIO; - goto out; - } -diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c ---- linux-2.4.27/fs/smbfs/sock.c 2004-11-12 19:32:24.000000000 +0000 -+++ linux-2.4.28/fs/smbfs/sock.c 2004-11-19 20:18:27.000000000 +0000 -@@ -571,7 +571,11 @@ - parm_disp, parm_offset, parm_count, - data_disp, data_offset, data_count); - *parm = base + parm_offset; -+ if (*parm - inbuf + parm_tot > server->packet_size) -+ goto out_bad_parm; - *data = base + data_offset; -+ if (*data - inbuf + data_tot > server->packet_size) -+ goto out_bad_data; - goto success; - } - -@@ -591,6 +595,8 @@ - rcv_buf = smb_vmalloc(buf_len); - if (!rcv_buf) - goto out_no_mem; -+ memset(rcv_buf, 0, buf_len); -+ - *parm = rcv_buf; - *data = rcv_buf + total_p; - } else if (data_tot > total_d || parm_tot > total_p) -@@ -598,8 +604,12 @@ - - if (parm_disp + parm_count > total_p) - goto out_bad_parm; -+ if (parm_offset + parm_count > server->packet_size) -+ goto out_bad_parm; - if (data_disp + data_count > total_d) - goto out_bad_data; -+ if (data_offset + data_count > server->packet_size) -+ goto out_bad_data; - memcpy(*parm + parm_disp, base + parm_offset, parm_count); - memcpy(*data + data_disp, base + data_offset, data_count); - -@@ -610,8 +620,11 @@ - * Check whether we've received all of the data. Note that - * we use the packet totals -- total lengths might shrink! - */ -- if (data_len >= data_tot && parm_len >= parm_tot) -+ if (data_len >= data_tot && parm_len >= parm_tot) { -+ data_len = data_tot; -+ parm_len = parm_tot; - break; -+ } - } - - /* -@@ -625,6 +638,9 @@ - server->packet = rcv_buf; - rcv_buf = inbuf; - } else { -+ if (parm_len + data_len > buf_len) -+ goto out_data_grew; -+ - PARANOIA("copying data, old size=%d, new size=%u\n", - server->packet_size, buf_len); - memcpy(inbuf, rcv_buf, parm_len + data_len); diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch new file mode 100644 index 000000000000..4644ae28bce4 --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources-2.4.28.binfmt_a.out.patch @@ -0,0 +1,63 @@ +diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c +--- linux-2.4.28/fs/exec.c 2004-04-15 10:44:45 -07:00 ++++ linux-2.4.28.plasmaroo/fs/exec.c 2004-11-12 12:02:40 -08:00 +@@ -342,6 +342,7 @@ int setup_arg_pages(struct linux_binprm + + down_write(¤t->mm->mmap_sem); + { ++ struct vm_area_struct *vma; + mpnt->vm_mm = current->mm; + mpnt->vm_start = PAGE_MASK & (unsigned long) bprm->p; + mpnt->vm_end = STACK_TOP; +@@ -351,6 +352,12 @@ int setup_arg_pages(struct linux_binprm + mpnt->vm_pgoff = 0; + mpnt->vm_file = NULL; + mpnt->vm_private_data = (void *) 0; ++ vma = find_vma(current->mm, mpnt->vm_start); ++ if (vma) { ++ up_write(¤t->mm->mmap_sem); ++ kmem_cache_free(vm_area_cachep, mpnt); ++ return -ENOMEM; ++ } + insert_vm_struct(current->mm, mpnt); + current->mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT; + } +diff -Nru linux-2.4.28/fs/exec.c linux-2.4.28.plasmaroo/fs/exec.c +--- linux-2.4.28/fs/binfmt_aout.c 2002-02-04 23:54:04 -08:00 ++++ linux-2.4.28.plasmaroo/fs/binfmt_aout.c 2004-11-12 11:55:14 -08:00 +@@ -39,13 +39,18 @@ static struct linux_binfmt aout_format = + NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE + }; + +-static void set_brk(unsigned long start, unsigned long end) ++#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) ++ ++static int set_brk(unsigned long start, unsigned long end) + { + start = PAGE_ALIGN(start); + end = PAGE_ALIGN(end); +- if (end <= start) +- return; +- do_brk(start, end - start); ++ if (end > start) { ++ unsigned long addr = do_brk(start, end - start); ++ if (BAD_ADDR(addr)) ++ return addr; ++ } ++ return 0; + } + + /* +@@ -405,7 +410,11 @@ static int load_aout_binary(struct linux + beyond_if: + set_binfmt(&aout_format); + +- set_brk(current->mm->start_brk, current->mm->brk); ++ retval = set_brk(current->mm->start_brk, current->mm->brk); ++ if (retval < 0) { ++ send_sig(SIGKILL, current, 0); ++ return retval; ++ } + + retval = setup_arg_pages(bprm); + if (retval < 0) { diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch new file mode 100644 index 000000000000..89665ce8db42 --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_a.out.patch @@ -0,0 +1,63 @@ +diff -Nru linux-2.6.9/fs/exec.c linux-2.6.9.plasmaroo/fs/exec.c +--- linux-2.6.9/fs/exec.c 2004-11-27 08:30:03 -08:00 ++++ linux-2.6.9.plasmaroo/fs/exec.c 2004-11-27 08:30:03 -08:00 +@@ -413,6 +413,7 @@ + + down_write(&mm->mmap_sem); + { ++ struct vm_area_struct *vma; + mpnt->vm_mm = mm; + #ifdef CONFIG_STACK_GROWSUP + mpnt->vm_start = stack_base; +@@ -433,6 +434,12 @@ + mpnt->vm_flags = VM_STACK_FLAGS; + mpnt->vm_flags |= mm->def_flags; + mpnt->vm_page_prot = protection_map[mpnt->vm_flags & 0x7]; ++ vma = find_vma(mm, mpnt->vm_start); ++ if (vma) { ++ up_write(&mm->mmap_sem); ++ kmem_cache_free(vm_area_cachep, mpnt); ++ return -ENOMEM; ++ } + insert_vm_struct(mm, mpnt); + mm->stack_vm = mm->total_vm = vma_pages(mpnt); + } +diff -Nru linux-2.6.9/fs/binfmt_aout.c linux-2.6.9.plasmaroo/fs/binfmt_aout.c +--- linux-2.6.9/fs/binfmt_aout.c 2004-11-27 08:31:43 -08:00 ++++ linux-2.6.9.plasmaroo/fs/binfmt_aout.c 2004-11-27 08:31:43 -08:00 +@@ -43,13 +43,18 @@ + .min_coredump = PAGE_SIZE + }; + +-static void set_brk(unsigned long start, unsigned long end) ++#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) ++ ++static int set_brk(unsigned long start, unsigned long end) + { + start = PAGE_ALIGN(start); + end = PAGE_ALIGN(end); +- if (end <= start) +- return; +- do_brk(start, end - start); ++ if (end > start) { ++ unsigned long addr = do_brk(start, end - start); ++ if (BAD_ADDR(addr)) ++ return addr; ++ } ++ return 0; + } + + /* +@@ -413,7 +418,11 @@ + beyond_if: + set_binfmt(&aout_format); + +- set_brk(current->mm->start_brk, current->mm->brk); ++ retval = set_brk(current->mm->start_brk, current->mm->brk); ++ if (retval < 0) { ++ send_sig(SIGKILL, current, 0); ++ return retval; ++ } + + retval = setup_arg_pages(bprm, EXSTACK_DEFAULT); + if (retval < 0) { diff --git a/sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch b/sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch new file mode 100644 index 000000000000..6ced78404a2d --- /dev/null +++ b/sys-kernel/xbox-sources/files/xbox-sources.AF_UNIX.patch @@ -0,0 +1,24 @@ +--- linux-2.4.27/net/unix/af_unix.c 2004-11-24 08:23:21 -08:00 ++++ linux-2.4.28/net/unix/af_unix.c 2004-11-24 08:23:21 -08:00 +@@ -1403,9 +1403,11 @@ + + msg->msg_namelen = 0; + ++ down(&sk->protinfo.af_unix.readsem); ++ + skb = skb_recv_datagram(sk, flags, noblock, &err); + if (!skb) +- goto out; ++ goto out_unlock; + + wake_up_interruptible(&sk->protinfo.af_unix.peer_wait); + +@@ -1449,6 +1451,8 @@ + + out_free: + skb_free_datagram(sk,skb); ++out_unlock: ++ up(&sk->protinfo.af_unix.readsem); + out: + return err; + } diff --git a/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild deleted file mode 100644 index 321fd72ff91e..000000000000 --- a/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild +++ /dev/null @@ -1,28 +0,0 @@ -# Copyright 1999-2004 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $ - -ETYPE="sources" -inherit kernel-2 -detect_version - -XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r5/r0}.patch.bz2" - -SRC_URI="${KERNEL_URI} - mirror://gentoo/${XBOX_PATCH} - mirror://gentoo/${P}.squashfs.patch.bz2 - http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0814.patch" -DESCRIPTION="Full sources for the Xbox Linux kernel" -HOMEPAGE="http://www.xbox-linux.org" -K_NOSETEXTRAVERSION="don't_set_it" -KEYWORDS="x86 -*" - -UNIPATCH_LIST=" - ${DISTDIR}/${XBOX_PATCH} - ${DISTDIR}/${P}.squashfs.patch.bz2 - ${FILESDIR}/${PN}-2.4.26.CAN-2004-0394.patch - ${FILESDIR}/${P}.cmdlineLeak.patch - ${FILESDIR}/${P}.XDRWrapFix.patch - ${FILESDIR}/${P}.binfmt_elf.patch - ${FILESDIR}/${P}.smbfs.patch - ${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch" diff --git a/sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild similarity index 80% rename from sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild rename to sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild index bddc8b2eab39..97cfc98e6e1e 100644 --- a/sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild +++ b/sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.28.ebuild,v 1.1 2004/11/24 14:13:57 chrb Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.28-r1.ebuild,v 1.1 2004/11/27 18:08:56 plasmaroo Exp $ ETYPE="sources" inherit kernel-2 @@ -18,4 +18,5 @@ KEYWORDS="x86 -*" UNIPATCH_LIST=" ${DISTDIR}/${XBOX_PATCH} - ${DISTDIR}/${P}.squashfs.patch.bz2" + ${DISTDIR}/${P}.squashfs.patch.bz2 + ${FILESDIR}/${P}.binfmt_a.out.patch" diff --git a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild similarity index 84% rename from sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild rename to sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild index 8a0fba2226aa..ad60c74215c1 100644 --- a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild +++ b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r5.ebuild,v 1.1 2004/11/27 18:08:56 plasmaroo Exp $ ETYPE='sources' inherit kernel-2 @@ -17,7 +17,9 @@ UNIPATCH_LIST=" ${FILESDIR}/${PN}-2.6.7.cmdlineLeak.patch ${FILESDIR}/${P}.devPtmx.patch ${FILESDIR}/${P}.smbfs.patch - ${FILESDIR}/${P}.binfmt_elf.patch" + ${FILESDIR}/${P}.binfmt_elf.patch + ${FILESDIR}/${P}.binfmt_a.out.patch + ${FILESDIR}/${PN}.AF_UNIX.patch" DESCRIPTION='Full sources for the Xbox Linux kernel' SRC_URI="${KERNEL_URI} mirror://gentoo/${XBOX_PATCHES} -- 2.26.2