Added patches for the CAN-2004-0075, CAN-2004-0133, CAN-2004-0181, CAN-2004-0394, and CAN-2004-0427 vulnerabilities. Bug #47881.

9 files changed, 131 insertions, 13 deletions

diff --git a/sys-kernel/pac-sources/ChangeLog b/sys-kernel/pac-sources/ChangeLog
index 1ab33d8a48ce..67acd56e280d 100644
--- a/sys-kernel/pac-sources/ChangeLog
+++ b/sys-kernel/pac-sources/ChangeLog
@@ -1,6 +1,18 @@
 # ChangeLog for sys-kernel/pac-sources
 # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/pac-sources/ChangeLog,v 1.7 2004/05/30 23:53:42 pvdabeel Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/pac-sources/ChangeLog,v 1.8 2004/06/02 13:26:00 plasmaroo Exp $
+
+*pac-sources-2.4.23-r6 (02 Jun 2004)
+
+  02 Jun 2004; <plasmaroo@gentoo.org> -pac-sources-2.4.23-r5.ebuild,
+  +pac-sources-2.4.23-r6.ebuild, +files/pac-sources.CAN-2004-0075.patch,
+  +files/pac-sources.CAN-2004-0133.patch,
+  +files/pac-sources.CAN-2004-0181.patch,
+  +files/pac-sources.CAN-2004-0394.patch,
+  +files/pac-sources.CAN-2004-0427.patch:
+  Added patches for the CAN-2004-0075, CAN-2004-0133, CAN-2004-0181,
+  CAN-2004-0394, and CAN-2004-0427 vulnerabilities. Bug #47881. Old
+  revision removed.
 
   31 May 2004; Pieter Van den Abeele <pvdabeel@gentoo.org>
   pac-sources-2.4.23-r5.ebuild:
diff --git a/sys-kernel/pac-sources/Manifest b/sys-kernel/pac-sources/Manifest
index f193a34b284c..0b9b66eb95c2 100644
--- a/sys-kernel/pac-sources/Manifest
+++ b/sys-kernel/pac-sources/Manifest
@@ -1,11 +1,16 @@
-MD5 f980df657a57f21b6a5744336ee356d6 ChangeLog 1762
+MD5 d858dbfeade1d2148838847680b8e63d ChangeLog 2268
 MD5 daa14c3311aff54352fca02cadfd84a4 metadata.xml 409
-MD5 6906d4046f42b0b16a4cb8c53e8c2138 pac-sources-2.4.23-r5.ebuild 2656
-MD5 6229e77dde1f21dc58f51f1dbb668c0d files/digest-pac-sources-2.4.23-r5 134
+MD5 0ac27cbb89d5a7525f0a2a5d89c79da6 pac-sources-2.4.23-r6.ebuild 3039
+MD5 21f3a4f186017d925067335e24db36a1 files/pac-sources.CAN-2004-0109.patch 1877
+MD5 6229e77dde1f21dc58f51f1dbb668c0d files/digest-pac-sources-2.4.23-r6 134
 MD5 e77a93fdf26f06cf3ea5080b27211725 files/pac-sources.CAN-2003-0985.patch 414
 MD5 147fec50180ad91b6260fc7201dcb90f files/pac-sources.CAN-2004-0010.patch 6050
-MD5 21f3a4f186017d925067335e24db36a1 files/pac-sources.CAN-2004-0109.patch 1877
-MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/pac-sources.CAN-2004-0177.patch 384
+MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/pac-sources.CAN-2004-0075.patch 634
+MD5 d4a740ae56c2049247083af387a22a85 files/pac-sources.CAN-2004-0394.patch 350
+MD5 c460ea130cb4ae84a5063ba044e3ce72 files/pac-sources.CAN-2004-0427.patch 460
 MD5 ac42024b6e6ee1e2165914db4b22a61c files/pac-sources.CAN-2004-0178.patch 424
 MD5 032ff70c5895cc1a2dfbe2a58ebde1f7 files/pac-sources.munmap.patch 819
+MD5 5bf9836a632a861728d33f9736bb7431 files/pac-sources.CAN-2004-0133.patch 427
+MD5 de75cfa969ed092578d9ddda6c5be334 files/pac-sources.CAN-2004-0181.patch 1233
 MD5 e2e2b545b6fcdcecf49e33798efa5b84 files/pac-sources.rtc_fix.patch 7073
+MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/pac-sources.CAN-2004-0177.patch 384
diff --git a/sys-kernel/pac-sources/files/digest-pac-sources-2.4.23-r5 b/sys-kernel/pac-sources/files/digest-pac-sources-2.4.23-r6
index 75e05aae1086..75e05aae1086 100644
--- a/sys-kernel/pac-sources/files/digest-pac-sources-2.4.23-r5
+++ b/sys-kernel/pac-sources/files/digest-pac-sources-2.4.23-r6
diff --git a/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0075.patch b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0075.patch
new file mode 100644
index 000000000000..5c397deb9c46
--- /dev/null
+++ b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0075.patch
@@ -0,0 +1,25 @@
+--- linux-2.4.23/drivers/usb/vicam.c	2004-01-26 16:56:32.000000000 +0000
++++ linux-2.4.25/drivers/usb/vicam.c	2004-04-20 18:15:53.000000000 +0100
+@@ -601,12 +601,19 @@
+ 	case VIDIOCSWIN:
+ 		{
+ 
+-			struct video_window *vw = (struct video_window *) arg;
+-			DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
++			struct video_window vw;
+ 
+-			if ( vw->width != 320 || vw->height != 240 )
++			if (copy_from_user(&vw, arg, sizeof(vw)))
++			{
+ 				retval = -EFAULT;
++				break;
++			}
++
++			DBG("VIDIOCSWIN %d x %d\n", vw->width, vw->height);
+ 			
++			if ( vw.width != 320 || vw.height != 240 )
++				retval = -EFAULT;
++
+ 			break;
+ 		}
+ 
diff --git a/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0133.patch b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0133.patch
new file mode 100644
index 000000000000..c756bc328bf2
--- /dev/null
+++ b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0133.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.22/fs/xfs/xfs_log.c.can-2004-0133	2004-03-23 12:28:11.000000000 -0700
++++ linux-2.4.22/fs/xfs/xfs_log.c	2004-03-23 12:58:59.000000000 -0700
+@@ -1251,7 +1251,7 @@
+ 			  kmem_zalloc(sizeof(xlog_in_core_t), KM_SLEEP);
+ 		iclog = *iclogp;
+ 		iclog->hic_data = (xlog_in_core_2_t *)
+-			  kmem_alloc(iclogsize, KM_SLEEP);
++			  kmem_zalloc(iclogsize, KM_SLEEP);
+ 
+ 		iclog->ic_prev = prev_iclog;
+ 		prev_iclog = iclog;
diff --git a/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0181.patch b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0181.patch
new file mode 100644
index 000000000000..5f7f1441b268
--- /dev/null
+++ b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0181.patch
@@ -0,0 +1,38 @@
+--- linux-2.4.22/fs/jfs/jfs_logmgr.c.jfs-sec	2004-03-23 12:30:35.000000000 -0700
++++ linux-2.4.22/fs/jfs/jfs_logmgr.c	2004-03-23 13:01:51.000000000 -0700
+@@ -1693,7 +1693,7 @@
+ 		if (lbuf == 0)
+ 			goto error;
+ 		lbuf->l_bh.b_data = lbuf->l_ldata =
+-		    (char *) __get_free_page(GFP_KERNEL);
++		    (char *) get_zeroed_page(GFP_KERNEL);
+ 		if (lbuf->l_ldata == 0) {
+ 			kfree(lbuf);
+ 			goto error;
+--- linux-2.4.22/fs/jfs/jfs_metapage.c.jfs-sec	2004-03-23 12:30:48.000000000 -0700
++++ linux-2.4.22/fs/jfs/jfs_metapage.c	2004-03-23 13:01:51.000000000 -0700
+@@ -375,6 +375,10 @@
+ 		}
+ 		mp->data = kmap(mp->page) + page_offset;
+ 	}
++
++	if (new)
++		memset(mp->data, 0, PSIZE);
++
+ 	jfs_info("__get_metapage: returning = 0x%p", mp);
+ 	return mp;
+ 
+--- linux-2.4.22/fs/jfs/super.c.jfs-sec	2004-03-23 12:31:10.000000000 -0700
++++ linux-2.4.22/fs/jfs/super.c	2004-03-23 13:01:51.000000000 -0700
+@@ -423,10 +423,10 @@
+ 
+ 	if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) ==
+ 	    SLAB_CTOR_CONSTRUCTOR) {
++		memset(jfs_ip, 0, sizeof(struct jfs_inode_info));
+ 		INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
+ 		init_rwsem(&jfs_ip->rdwrlock);
+ 		init_MUTEX(&jfs_ip->commit_sem);
+-		jfs_ip->atlhead = 0;
+ 		jfs_ip->active_ag = -1;
+ 	}
+ }
diff --git a/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0394.patch b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0394.patch
new file mode 100644
index 000000000000..273f1a52046f
--- /dev/null
+++ b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0394.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.22-oM3-orig/kernel/panic.c	Tue Mar 30 15:37:18 2004
++++ linux-2.4.22-oM3-mod/kernel/panic.c	Mon May 17 18:44:01 2004
+@@ -51,7 +51,7 @@
+ 
+ 	bust_spinlocks(1);
+ 	va_start(args, fmt);
+-	vsprintf(buf, fmt, args);
++	vsnprintf(buf, sizeof(buf), fmt, args);
+ 	va_end(args);
+ 	printk(KERN_EMERG "Kernel panic: %s\n",buf);
+ 	if (in_interrupt())
diff --git a/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0427.patch b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0427.patch
new file mode 100644
index 000000000000..ddc9610f67f8
--- /dev/null
+++ b/sys-kernel/pac-sources/files/pac-sources.CAN-2004-0427.patch
@@ -0,0 +1,14 @@
+diff -Nar -U 4 linux-2.4.25/kernel/fork.c linux-2.4.25-new/kernel/fork.c
+--- linux-2.4.25/kernel/fork.c	2004-02-18 05:36:32.000000000 -0800
++++ linux-2.4.25-new/kernel/fork.c	2004-04-07 17:43:29.000000000 -0700
+@@ -825,8 +825,10 @@
+ bad_fork_cleanup_namespace:
+ 	exit_namespace(p);
+ bad_fork_cleanup_mm:
+ 	exit_mm(p);
++	if (p->active_mm)
++		mmdrop(p->active_mm);
+ bad_fork_cleanup_sighand:
+ 	exit_sighand(p);
+ bad_fork_cleanup_fs:
+ 	exit_fs(p); /* blocking */
diff --git a/sys-kernel/pac-sources/pac-sources-2.4.23-r5.ebuild b/sys-kernel/pac-sources/pac-sources-2.4.23-r6.ebuild
index 2f783d57c8d7..d97ea97a3182 100644
--- a/sys-kernel/pac-sources/pac-sources-2.4.23-r5.ebuild
+++ b/sys-kernel/pac-sources/pac-sources-2.4.23-r6.ebuild
@@ -1,21 +1,18 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/pac-sources/pac-sources-2.4.23-r5.ebuild,v 1.2 2004/05/30 23:53:42 pvdabeel Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/pac-sources/pac-sources-2.4.23-r6.ebuild,v 1.1 2004/06/02 13:26:00 plasmaroo Exp $
 
 IUSE="build"
-
-# OKV=original kernel version, KV=patched kernel version.  
-
 ETYPE="sources"
 
 inherit kernel eutils
 
 # PACV=Bernhard Rosenkraenzer's release version
 PACV=pac1
-# KV=patched kernel version
+
+# OKV=original kernel version, KV=patched kernel version.  
 KV="${PV/_/-}-${PACV}"
 NKV="${PV/_/-}-pac${PR/r/}"
-# OKV=original kernel version as provided by ebuild
 OKV="`echo ${KV} | cut -d- -f1`"
 # OKVLAST=(working) last digit of OKV
 OKVLAST="`echo ${OKV} | cut -d. -f3`"
@@ -61,8 +58,13 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}.rtc_fix.patch || die "Failed to patch RTC vulnerabilities!"
 	epatch ${FILESDIR}/${PN}.CAN-2003-0985.patch || die "Failed to patch mremap() vulnerability!"
 	epatch ${FILESDIR}/${PN}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!"
-	epatch ${FILESDIR}/${PN}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0075.patch || die "Failed to add the CAN-2004-0075 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0109.patch || die "Failed to add the CAN-2004-0109 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0133.patch || die "Failed to add the CAN-2004-0133 patch!"
 	epatch ${FILESDIR}/${PN}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!"
 	epatch ${FILESDIR}/${PN}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!"
+	epatch ${FILESDIR}/${PN}.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!"
 	kernel_universal_unpack
 }