diff options
author | Tim Yamin <plasmaroo@gentoo.org> | 2004-11-20 11:26:08 +0000 |
---|---|---|
committer | Tim Yamin <plasmaroo@gentoo.org> | 2004-11-20 11:26:08 +0000 |
commit | 2f5d7a9e0c8d4395f1cabf607ab3ddf19a861dc2 (patch) | |
tree | c0d0502439a7c61f073b2f19c3e7ea07564ed5b1 /sys-kernel/uclinux-sources | |
parent | Bail out if kernel is 2.4.x. (Manifest recommit) (diff) | |
download | gentoo-2-2f5d7a9e0c8d4395f1cabf607ab3ddf19a861dc2.tar.gz gentoo-2-2f5d7a9e0c8d4395f1cabf607ab3ddf19a861dc2.tar.bz2 gentoo-2-2f5d7a9e0c8d4395f1cabf607ab3ddf19a861dc2.zip |
Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs security patch (bug #65877).
Diffstat (limited to 'sys-kernel/uclinux-sources')
9 files changed, 252 insertions, 22 deletions
diff --git a/sys-kernel/uclinux-sources/ChangeLog b/sys-kernel/uclinux-sources/ChangeLog index e42fae30e5d8..579860452982 100644 --- a/sys-kernel/uclinux-sources/ChangeLog +++ b/sys-kernel/uclinux-sources/ChangeLog @@ -1,6 +1,18 @@ # ChangeLog for sys-kernel/uclinux-sources # Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.21 2004/11/12 19:57:20 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.22 2004/11/20 11:26:08 plasmaroo Exp $ + +*uclinux-sources-2.4.26_p0-r9 (20 Nov 2004) + + 20 Nov 2004; <plasmaroo@gentoo.org> -uclinux-sources-2.4.26_p0-r8.ebuild, + +uclinux-sources-2.4.26_p0-r9.ebuild, -uclinux-sources-2.6.7_p0-r8.ebuild, + +uclinux-sources-2.6.7_p0-r9.ebuild, + files/uclinux-sources-2.4.26_p0.binfmt_elf.patch, + +files/uclinux-sources-2.4.26_p0.smbfs.patch, + files/uclinux-sources-2.6.binfmt_elf.patch, + +files/uclinux-sources-2.6.smbfs.patch: + Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs + security patch (bug #65877). *uclinux-sources-2.6.7_p0-r8 (12 Nov 2004) diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r8 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r9 index 8629e7c2dfd9..8629e7c2dfd9 100644 --- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r8 +++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r9 diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r8 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r9 index 23b9296ce2d4..23b9296ce2d4 100644 --- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r8 +++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r9 diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_elf.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_elf.patch index 534e4c064a52..9f4f44ee78f5 100644 --- a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_elf.patch +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.binfmt_elf.patch @@ -1,6 +1,7 @@ ---- linux-2.4.27/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00 -+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c 2004-11-10 12:25:16 -08:00 -@@ -335,9 +335,12 @@ +diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c +--- linux-2.4.27/fs/binfmt_elf.c 2004-04-14 14:05:40.000000000 +0100 ++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c 2004-11-19 21:30:26.745410824 +0000 +@@ -299,9 +299,12 @@ goto out; retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size); @@ -15,7 +16,7 @@ eppnt = elf_phdata; for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) { -@@ -532,8 +535,11 @@ +@@ -475,8 +478,11 @@ goto out; retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size); @@ -28,7 +29,17 @@ files = current->files; /* Refcounted so ok */ retval = unshare_files(); -@@ -580,8 +586,14 @@ +@@ -513,7 +519,8 @@ + */ + + retval = -ENOMEM; +- if (elf_ppnt->p_filesz > PATH_MAX) ++ if (elf_ppnt->p_filesz > PATH_MAX || ++ elf_ppnt->p_filesz == 0) + goto out_free_file; + elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz, + GFP_KERNEL); +@@ -523,8 +530,16 @@ retval = kernel_read(bprm->file, elf_ppnt->p_offset, elf_interpreter, elf_ppnt->p_filesz); @@ -36,15 +47,17 @@ + if (retval != elf_ppnt->p_filesz) { + if (retval >= 0) + retval = -EIO; - goto out_free_interp; ++ goto out_free_interp; + } + /* make sure path is NULL terminated */ -+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0'; ++ retval = -EINVAL; ++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') + goto out_free_interp; + /* If the program interpreter is one of these two, * then assume an iBCS2 image. Otherwise assume * a native linux image. -@@ -616,8 +628,11 @@ +@@ -543,8 +558,11 @@ if (IS_ERR(interpreter)) goto out_free_interp; retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE); @@ -56,8 +69,8 @@ + } /* Get the exec headers */ - loc->interp_ex = *((struct exec *) bprm->buf); -@@ -776,8 +791,10 @@ + interp_ex = *((struct exec *) bprm->buf); +@@ -682,8 +700,10 @@ } error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags); diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.smbfs.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.smbfs.patch new file mode 100644 index 000000000000..63c5ba30403f --- /dev/null +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.smbfs.patch @@ -0,0 +1,97 @@ +diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c +--- linux-2.4.27/fs/smbfs/proc.c 2004-11-12 19:32:24.000000000 +0000 ++++ linux-2.4.28/fs/smbfs/proc.c 2004-11-19 20:18:27.000000000 +0000 +@@ -1289,10 +1289,12 @@ + data_len = WVAL(buf, 1); + + /* we can NOT simply trust the data_len given by the server ... */ +- if (data_len > server->packet_size - (buf+3 - server->packet)) { +- printk(KERN_ERR "smb_proc_read: invalid data length!! " +- "%d > %d - (%p - %p)\n", +- data_len, server->packet_size, buf+3, server->packet); ++ if (data_len > count || ++ (buf+3 - server->packet) + data_len > server->packet_size) { ++ printk(KERN_ERR "smb_proc_read: invalid data length/offset!! " ++ "%d > %d || (%p - %p) + %d > %d\n", ++ data_len, count, ++ buf+3, server->packet, data_len, server->packet_size); + result = -EIO; + goto out; + } +@@ -1378,10 +1380,12 @@ + buf = smb_base(server->packet) + data_off; + + /* we can NOT simply trust the info given by the server ... */ +- if (data_len > server->packet_size - (buf - server->packet)) { +- printk(KERN_ERR "smb_proc_read: invalid data length!! " +- "%d > %d - (%p - %p)\n", +- data_len, server->packet_size, buf, server->packet); ++ if (data_len > count || ++ (buf - server->packet) + data_len > server->packet_size) { ++ printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! " ++ "%d > %d || (%p - %p) + %d > %d\n", ++ data_len, count, ++ buf, server->packet, data_len, server->packet_size); + result = -EIO; + goto out; + } +diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c +--- linux-2.4.27/fs/smbfs/sock.c 2004-11-12 19:32:24.000000000 +0000 ++++ linux-2.4.28/fs/smbfs/sock.c 2004-11-19 20:18:27.000000000 +0000 +@@ -571,7 +571,11 @@ + parm_disp, parm_offset, parm_count, + data_disp, data_offset, data_count); + *parm = base + parm_offset; ++ if (*parm - inbuf + parm_tot > server->packet_size) ++ goto out_bad_parm; + *data = base + data_offset; ++ if (*data - inbuf + data_tot > server->packet_size) ++ goto out_bad_data; + goto success; + } + +@@ -591,6 +595,8 @@ + rcv_buf = smb_vmalloc(buf_len); + if (!rcv_buf) + goto out_no_mem; ++ memset(rcv_buf, 0, buf_len); ++ + *parm = rcv_buf; + *data = rcv_buf + total_p; + } else if (data_tot > total_d || parm_tot > total_p) +@@ -598,8 +604,12 @@ + + if (parm_disp + parm_count > total_p) + goto out_bad_parm; ++ if (parm_offset + parm_count > server->packet_size) ++ goto out_bad_parm; + if (data_disp + data_count > total_d) + goto out_bad_data; ++ if (data_offset + data_count > server->packet_size) ++ goto out_bad_data; + memcpy(*parm + parm_disp, base + parm_offset, parm_count); + memcpy(*data + data_disp, base + data_offset, data_count); + +@@ -610,8 +620,11 @@ + * Check whether we've received all of the data. Note that + * we use the packet totals -- total lengths might shrink! + */ +- if (data_len >= data_tot && parm_len >= parm_tot) ++ if (data_len >= data_tot && parm_len >= parm_tot) { ++ data_len = data_tot; ++ parm_len = parm_tot; + break; ++ } + } + + /* +@@ -625,6 +638,9 @@ + server->packet = rcv_buf; + rcv_buf = inbuf; + } else { ++ if (parm_len + data_len > buf_len) ++ goto out_data_grew; ++ + PARANOIA("copying data, old size=%d, new size=%u\n", + server->packet_size, buf_len); + memcpy(inbuf, rcv_buf, parm_len + data_len); diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_elf.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_elf.patch index 9ca23675f25d..87d05e7b5fa4 100644 --- a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_elf.patch +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.binfmt_elf.patch @@ -1,6 +1,7 @@ ---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00 -+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c 2004-11-12 11:50:08 -08:00 -@@ -335,9 +335,12 @@ +diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c +--- linux-2.6.8.1/fs/binfmt_elf.c 2004-08-14 11:55:23.000000000 +0100 ++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c 2004-11-19 23:07:08.375429000 +0000 +@@ -334,9 +334,12 @@ goto out; retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size); @@ -15,7 +16,7 @@ eppnt = elf_phdata; for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) { -@@ -532,8 +535,11 @@ +@@ -523,8 +526,11 @@ goto out; retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size); @@ -28,7 +29,17 @@ files = current->files; /* Refcounted so ok */ retval = unshare_files(); -@@ -580,8 +586,14 @@ +@@ -561,7 +567,8 @@ + */ + + retval = -ENOMEM; +- if (elf_ppnt->p_filesz > PATH_MAX) ++ if (elf_ppnt->p_filesz > PATH_MAX || ++ elf_ppnt->p_filesz == 0) + goto out_free_file; + elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz, + GFP_KERNEL); +@@ -571,8 +578,16 @@ retval = kernel_read(bprm->file, elf_ppnt->p_offset, elf_interpreter, elf_ppnt->p_filesz); @@ -39,12 +50,14 @@ goto out_free_interp; + } + /* make sure path is NULL terminated */ -+ elf_interpreter[elf_ppnt->p_filesz - 1] = '\0'; ++ retval = -EINVAL; ++ if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0') ++ goto out_free_interp; + /* If the program interpreter is one of these two, * then assume an iBCS2 image. Otherwise assume * a native linux image. -@@ -616,8 +628,11 @@ +@@ -607,8 +622,11 @@ if (IS_ERR(interpreter)) goto out_free_interp; retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE); @@ -56,8 +69,8 @@ + } /* Get the exec headers */ - loc->interp_ex = *((struct exec *) bprm->buf); -@@ -776,8 +791,10 @@ + interp_ex = *((struct exec *) bprm->buf); +@@ -765,8 +783,10 @@ } error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags); diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.smbfs.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.smbfs.patch new file mode 100644 index 000000000000..99401cf93a0e --- /dev/null +++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.smbfs.patch @@ -0,0 +1,93 @@ +diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c +--- linux-2.6.8.1/fs/smbfs/proc.c 2004-08-24 17:15:57.000000000 +1000 ++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c 2004-11-06 11:27:20.000000000 +1100 +@@ -1427,9 +1427,9 @@ + * So we must first calculate the amount of padding used by the server. + */ + data_off -= hdrlen; +- if (data_off > SMB_READX_MAX_PAD) { +- PARANOIA("offset is larger than max pad!\n"); +- PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD); ++ if (data_off > SMB_READX_MAX_PAD || data_off < 0) { ++ PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n"); ++ PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off); + req->rq_rlen = req->rq_bufsize + 1; + return; + } +diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c +--- linux-2.6.8.1/fs/smbfs/request.c 2004-11-06 11:27:51.000000000 +1100 ++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c 2004-11-06 11:27:20.000000000 +1100 +@@ -588,6 +588,10 @@ + data_count = WVAL(inbuf, smb_drcnt); + + /* Modify offset for the split header/buffer we use */ ++ if (data_offset < hdrlen) ++ goto out_bad_data; ++ if (parm_offset < hdrlen) ++ goto out_bad_parm; + data_offset -= hdrlen; + parm_offset -= hdrlen; + +@@ -607,6 +611,10 @@ + req->rq_lparm = parm_count; + req->rq_data = req->rq_buffer + data_offset; + req->rq_parm = req->rq_buffer + parm_offset; ++ if (parm_offset + parm_count > req->rq_rlen) ++ goto out_bad_parm; ++ if (data_offset + data_count > req->rq_rlen) ++ goto out_bad_data; + return 0; + } + +@@ -634,6 +642,7 @@ + req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS); + if (!req->rq_trans2buffer) + goto out_no_mem; ++ memset(req->rq_trans2buffer, 0, buf_len); + + req->rq_parm = req->rq_trans2buffer; + req->rq_data = req->rq_trans2buffer + parm_tot; +@@ -643,8 +652,12 @@ + + if (parm_disp + parm_count > req->rq_total_parm) + goto out_bad_parm; ++ if (parm_offset + parm_count > req->rq_rlen) ++ goto out_bad_parm; + if (data_disp + data_count > req->rq_total_data) + goto out_bad_data; ++ if (data_offset + data_count > req->rq_rlen) ++ goto out_bad_data; + + inbuf = req->rq_buffer; + memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count); +@@ -657,8 +670,11 @@ + * Check whether we've received all of the data. Note that + * we use the packet totals -- total lengths might shrink! + */ +- if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) ++ if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) { ++ req->rq_ldata = data_tot; ++ req->rq_lparm = parm_tot; + return 0; ++ } + return 1; + + out_too_long: +@@ -676,13 +692,13 @@ + req->rq_errno = -EIO; + goto out; + out_bad_parm: +- printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n", +- parm_disp, parm_count, parm_tot); ++ printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n", ++ parm_disp, parm_count, parm_tot, parm_offset); + req->rq_errno = -EIO; + goto out; + out_bad_data: +- printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n", +- data_disp, data_count, data_tot); ++ printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n", ++ data_disp, data_count, data_tot, data_offset); + req->rq_errno = -EIO; + out: + return req->rq_errno; diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r8.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild index 25aff5630860..edbe57424db4 100644 --- a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r8.ebuild +++ b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r8.ebuild,v 1.1 2004/11/12 19:57:20 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $ IUSE="" @@ -58,6 +58,7 @@ src_unpack() { epatch ${FILESDIR}/${P}.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!" epatch ${FILESDIR}/${P}.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!" epatch ${FILESDIR}/${P}.binfmt_elf.patch || die "Failed to apply the binfmt_elf patch!" + epatch ${FILESDIR}/${P}.smbfs.patch || die "Failed to apply the SMBFS patch!" kernel_universal_unpack set ARCH=${MY_ARCH} diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r8.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild index df3c58e05365..786f0ed11fd0 100644 --- a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r8.ebuild +++ b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild @@ -1,6 +1,6 @@ # Copyright 1999-2004 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r8.ebuild,v 1.1 2004/11/12 19:57:20 plasmaroo Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r9.ebuild,v 1.1 2004/11/20 11:26:08 plasmaroo Exp $ IUSE="" @@ -51,6 +51,7 @@ src_unpack() { epatch ${FILESDIR}/${PN}-2.6.CAN-2004-0816.patch || die "Failed to apply the CAN-2004-0816 patch!" epatch ${FILESDIR}/${PN}-2.6.devPtmx.patch || die "Failed to apply /dev/ptmx patch!" epatch ${FILESDIR}/${PN}-2.6.binfmt_elf.patch || die "Failed to apply binfmt_elf patch!" + epatch ${FILESDIR}/${PN}-2.6.smbfs.patch || die "Failed to apply SMBFS patch!" set MY_ARCH=${ARCH} unset ARCH |