Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs security patch (bug #65877).

10 files changed, 261 insertions, 30 deletions

diff --git a/sys-kernel/xbox-sources/ChangeLog b/sys-kernel/xbox-sources/ChangeLog
index 484d8ceccb5a..87e38f7340c5 100644
--- a/sys-kernel/xbox-sources/ChangeLog
+++ b/sys-kernel/xbox-sources/ChangeLog
@@ -1,6 +1,17 @@
 # ChangeLog for sys-kernel/xbox-sources
 # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.17 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.18 2004/11/19 23:17:23 plasmaroo Exp $
+
+*xbox-sources-2.4.27-r5 (19 Nov 2004)
+
+  19 Nov 2004; <plasmaroo@gentoo.org> -xbox-sources-2.4.27-r4.ebuild,
+  +xbox-sources-2.4.27-r5.ebuild, -xbox-sources-2.6.8.1-r3.ebuild,
+  +xbox-sources-2.6.8.1-r4.ebuild, files/xbox-sources-2.4.27.binfmt_elf.patch,
+  +files/xbox-sources-2.4.27.smbfs.patch,
+  files/xbox-sources-2.6.8.1.binfmt_elf.patch,
+  +files/xbox-sources-2.6.8.1.smbfs.patch:
+  Version bump; updates binfmt_elf patch (bug #70681) and adds the smbfs
+  security patch (bug #65877).
 
 *xbox-sources-2.4.27-r4 (12 Nov 2004)
 
diff --git a/sys-kernel/xbox-sources/Manifest b/sys-kernel/xbox-sources/Manifest
index 2e07feeac2a4..3dec7bd49281 100644
--- a/sys-kernel/xbox-sources/Manifest
+++ b/sys-kernel/xbox-sources/Manifest
@@ -1,13 +1,15 @@
-MD5 2f20c9cec504081b0b428f8b303ff918 ChangeLog 4838
-MD5 a8677416a55c663479cee926788b39ca xbox-sources-2.6.8.1-r3.ebuild 995
+MD5 926e4b40ace131037b5fb6723611a468 ChangeLog 5330
 MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351
-MD5 c587a3a00425c8fa590841fdfc13a846 xbox-sources-2.4.27-r4.ebuild 985
+MD5 c49f123b75ad53f6b50ebf38489c05f2 xbox-sources-2.4.27-r5.ebuild 1015
+MD5 90f4d74240992ee1dd8410bf8a326f02 xbox-sources-2.6.8.1-r4.ebuild 1025
 MD5 d1ccc2047be533c992f67270a150a210 files/xbox-sources-2.4.27.cmdlineLeak.patch 388
-MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r4 302
-MD5 1ee8ba8362089c31fdd7d88b32eaf63e files/xbox-sources-2.6.8.1.binfmt_elf.patch 1938
+MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348
 MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572
-MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r3 227
-MD5 24c53f49954dab29cfc172d4a3ba1a31 files/xbox-sources-2.4.27.binfmt_elf.patch 1928
+MD5 6d088117dab6d996f52ff52daaa4be52 files/digest-xbox-sources-2.4.27-r5 302
+MD5 915e8d7a0618736caa44d96968015467 files/xbox-sources-2.4.27.binfmt_elf.patch 2346
 MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281
+MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309
+MD5 1e1fe7bb98c80db4644f4b7fd7dd5d32 files/xbox-sources-2.4.27.smbfs.patch 3434
 MD5 d4a740ae56c2049247083af387a22a85 files/xbox-sources-2.4.26.CAN-2004-0394.patch 350
 MD5 2b3ddb8b8b15f8da35ade38544b57857 files/xbox-sources-2.4.27.XDRWrapFix.patch 1499
+MD5 eebe0bc2ed2d04b8e8aa901ae9dad418 files/digest-xbox-sources-2.6.8.1-r4 227
diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r4 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5
index aca272e6984e..aca272e6984e 100644
--- a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r4
+++ b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.4.27-r5
diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r3 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r4
index a02852fd891b..a02852fd891b 100644
--- a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r3
+++ b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r4
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch
index 534e4c064a52..9f4f44ee78f5 100644
--- a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.binfmt_elf.patch
@@ -1,6 +1,7 @@
---- linux-2.4.27/fs/binfmt_elf.c	2004-11-10 12:25:16 -08:00
-+++ linux-2.4.27-plasmaroo/fs/binfmt_elf.c	2004-11-10 12:25:16 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.4.27/fs/binfmt_elf.c linux-2.4.27.plasmaroo/fs/binfmt_elf.c
+--- linux-2.4.27/fs/binfmt_elf.c	2004-04-14 14:05:40.000000000 +0100
++++ linux-2.4.27.plasmaroo/fs/binfmt_elf.c	2004-11-19 21:30:26.745410824 +0000
+@@ -299,9 +299,12 @@
  		goto out;
  
  	retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
@@ -15,7 +16,7 @@
  
  	eppnt = elf_phdata;
  	for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -475,8 +478,11 @@
  		goto out;
  
  	retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
@@ -28,7 +29,17 @@
  		
  	files = current->files;		/* Refcounted so ok */
  	retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -513,7 +519,8 @@
+ 			 */
+ 
+ 			retval = -ENOMEM;
+-			if (elf_ppnt->p_filesz > PATH_MAX)
++			if (elf_ppnt->p_filesz > PATH_MAX || 
++			    elf_ppnt->p_filesz == 0)
+ 				goto out_free_file;
+ 			elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ 							   GFP_KERNEL);
+@@ -523,8 +530,16 @@
  			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
  					   elf_interpreter,
  					   elf_ppnt->p_filesz);
@@ -36,15 +47,17 @@
 +			if (retval != elf_ppnt->p_filesz) {
 +				if (retval >= 0)
 +					retval = -EIO;
- 				goto out_free_interp;
++				goto out_free_interp;
 +			}
 +			/* make sure path is NULL terminated */
-+			elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++			retval = -EINVAL;
++			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
+ 				goto out_free_interp;
 +
  			/* If the program interpreter is one of these two,
  			 * then assume an iBCS2 image. Otherwise assume
  			 * a native linux image.
-@@ -616,8 +628,11 @@
+@@ -543,8 +558,11 @@
  			if (IS_ERR(interpreter))
  				goto out_free_interp;
  			retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -56,8 +69,8 @@
 +			}
  
  			/* Get the exec headers */
- 			loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ 			interp_ex = *((struct exec *) bprm->buf);
+@@ -682,8 +700,10 @@
  		}
  
  		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch
new file mode 100644
index 000000000000..63c5ba30403f
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.4.27.smbfs.patch
@@ -0,0 +1,97 @@
+diff -ur linux-2.4.27/fs/smbfs/proc.c linux-2.4.28/fs/smbfs/proc.c
+--- linux-2.4.27/fs/smbfs/proc.c	2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/proc.c	2004-11-19 20:18:27.000000000 +0000
+@@ -1289,10 +1289,12 @@
+ 	data_len = WVAL(buf, 1);
+ 
+ 	/* we can NOT simply trust the data_len given by the server ... */
+-	if (data_len > server->packet_size - (buf+3 - server->packet)) {
+-		printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-		       "%d > %d - (%p - %p)\n",
+-		       data_len, server->packet_size, buf+3, server->packet);
++	if (data_len > count ||
++		(buf+3 - server->packet) + data_len > server->packet_size) {
++		printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
++		       "%d > %d || (%p - %p) + %d > %d\n",
++		       data_len, count,
++		       buf+3, server->packet, data_len, server->packet_size);
+ 		result = -EIO;
+ 		goto out;
+ 	}
+@@ -1378,10 +1380,12 @@
+ 	buf = smb_base(server->packet) + data_off;
+ 
+ 	/* we can NOT simply trust the info given by the server ... */
+-	if (data_len > server->packet_size - (buf - server->packet)) {
+-		printk(KERN_ERR "smb_proc_read: invalid data length!! "
+-		       "%d > %d - (%p - %p)\n",
+-		       data_len, server->packet_size, buf, server->packet);
++	if (data_len > count ||
++		(buf - server->packet) + data_len > server->packet_size) {
++		printk(KERN_ERR "smb_proc_readX: invalid data length/offset!! "
++		       "%d > %d || (%p - %p) + %d > %d\n",
++		       data_len, count,
++		       buf, server->packet, data_len, server->packet_size);
+ 		result = -EIO;
+ 		goto out;
+ 	}
+diff -ur linux-2.4.27/fs/smbfs/sock.c linux-2.4.28/fs/smbfs/sock.c
+--- linux-2.4.27/fs/smbfs/sock.c	2004-11-12 19:32:24.000000000 +0000
++++ linux-2.4.28/fs/smbfs/sock.c	2004-11-19 20:18:27.000000000 +0000
+@@ -571,7 +571,11 @@
+ 					parm_disp, parm_offset, parm_count,
+ 					data_disp, data_offset, data_count);
+ 				*parm  = base + parm_offset;
++				if (*parm - inbuf + parm_tot > server->packet_size)
++					goto out_bad_parm;
+ 				*data  = base + data_offset;
++				if (*data - inbuf + data_tot > server->packet_size)
++					goto out_bad_data;
+ 				goto success;
+ 			}
+ 
+@@ -591,6 +595,8 @@
+ 			rcv_buf = smb_vmalloc(buf_len);
+ 			if (!rcv_buf)
+ 				goto out_no_mem;
++			memset(rcv_buf, 0, buf_len);
++			
+ 			*parm = rcv_buf;
+ 			*data = rcv_buf + total_p;
+ 		} else if (data_tot > total_d || parm_tot > total_p)
+@@ -598,8 +604,12 @@
+ 
+ 		if (parm_disp + parm_count > total_p)
+ 			goto out_bad_parm;
++		if (parm_offset + parm_count > server->packet_size)	
++			goto out_bad_parm;
+ 		if (data_disp + data_count > total_d)
+ 			goto out_bad_data;
++		if (data_offset + data_count > server->packet_size)	
++			goto out_bad_data;
+ 		memcpy(*parm + parm_disp, base + parm_offset, parm_count);
+ 		memcpy(*data + data_disp, base + data_offset, data_count);
+ 
+@@ -610,8 +620,11 @@
+ 		 * Check whether we've received all of the data. Note that
+ 		 * we use the packet totals -- total lengths might shrink!
+ 		 */
+-		if (data_len >= data_tot && parm_len >= parm_tot)
++		if (data_len >= data_tot && parm_len >= parm_tot) {
++			data_len = data_tot;
++			parm_len = parm_tot;
+ 			break;
++		}
+ 	}
+ 
+ 	/*
+@@ -625,6 +638,9 @@
+ 		server->packet = rcv_buf;
+ 		rcv_buf = inbuf;
+ 	} else {
++		if (parm_len + data_len > buf_len)
++			goto out_data_grew;
++
+ 		PARANOIA("copying data, old size=%d, new size=%u\n",
+ 			 server->packet_size, buf_len);
+ 		memcpy(inbuf, rcv_buf, parm_len + data_len);
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_elf.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_elf.patch
index 9ca23675f25d..87d05e7b5fa4 100644
--- a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_elf.patch
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.binfmt_elf.patch
@@ -1,6 +1,7 @@
---- linux-2.6.7-uc0-r8/fs/binfmt_elf.c	2004-11-12 11:50:08 -08:00
-+++ linux-2.6.7-uc0-r8-plasmaroo/fs/binfmt_elf.c	2004-11-12 11:50:08 -08:00
-@@ -335,9 +335,12 @@
+diff -ur linux-2.6.8.1/fs/binfmt_elf.c linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c
+--- linux-2.6.8.1/fs/binfmt_elf.c	2004-08-14 11:55:23.000000000 +0100
++++ linux-2.6.8.1.plasmaroo/fs/binfmt_elf.c	2004-11-19 23:07:08.375429000 +0000
+@@ -334,9 +334,12 @@
  		goto out;
  
  	retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
@@ -15,7 +16,7 @@
  
  	eppnt = elf_phdata;
  	for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
-@@ -532,8 +535,11 @@
+@@ -523,8 +526,11 @@
  		goto out;
  
  	retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *) elf_phdata, size);
@@ -28,7 +29,17 @@
  
  	files = current->files;		/* Refcounted so ok */
  	retval = unshare_files();
-@@ -580,8 +586,14 @@
+@@ -561,7 +567,8 @@
+ 			 */
+ 
+ 			retval = -ENOMEM;
+-			if (elf_ppnt->p_filesz > PATH_MAX)
++			if (elf_ppnt->p_filesz > PATH_MAX || 
++			    elf_ppnt->p_filesz == 0)
+ 				goto out_free_file;
+ 			elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
+ 							   GFP_KERNEL);
+@@ -571,8 +578,16 @@
  			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
  					   elf_interpreter,
  					   elf_ppnt->p_filesz);
@@ -39,12 +50,14 @@
  				goto out_free_interp;
 +			}
 +			/* make sure path is NULL terminated */
-+			elf_interpreter[elf_ppnt->p_filesz - 1] = '\0';
++			retval = -EINVAL;
++			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
++				goto out_free_interp;
 +
  			/* If the program interpreter is one of these two,
  			 * then assume an iBCS2 image. Otherwise assume
  			 * a native linux image.
-@@ -616,8 +628,11 @@
+@@ -607,8 +622,11 @@
  			if (IS_ERR(interpreter))
  				goto out_free_interp;
  			retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
@@ -56,8 +69,8 @@
 +			}
  
  			/* Get the exec headers */
- 			loc->interp_ex = *((struct exec *) bprm->buf);
-@@ -776,8 +791,10 @@
+ 			interp_ex = *((struct exec *) bprm->buf);
+@@ -765,8 +783,10 @@
  		}
  
  		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.smbfs.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.smbfs.patch
new file mode 100644
index 000000000000..99401cf93a0e
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.smbfs.patch
@@ -0,0 +1,93 @@
+diff -urN linux-2.6.8.1/fs/smbfs/proc.c linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c
+--- linux-2.6.8.1/fs/smbfs/proc.c	2004-08-24 17:15:57.000000000 +1000
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/proc.c	2004-11-06 11:27:20.000000000 +1100
+@@ -1427,9 +1427,9 @@
+ 	 * So we must first calculate the amount of padding used by the server.
+ 	 */
+ 	data_off -= hdrlen;
+-	if (data_off > SMB_READX_MAX_PAD) {
+-		PARANOIA("offset is larger than max pad!\n");
+-		PARANOIA("%d > %d\n", data_off, SMB_READX_MAX_PAD);
++	if (data_off > SMB_READX_MAX_PAD || data_off < 0) {
++		PARANOIA("offset is larger than SMB_READX_MAX_PAD or negative!\n");
++		PARANOIA("%d > %d || %d < 0\n", data_off, SMB_READX_MAX_PAD, data_off);
+ 		req->rq_rlen = req->rq_bufsize + 1;
+ 		return;
+ 	}
+diff -urN linux-2.6.8.1/fs/smbfs/request.c linux-2.6.8.1.plasmaroo/fs/smbfs/request.c
+--- linux-2.6.8.1/fs/smbfs/request.c	2004-11-06 11:27:51.000000000 +1100
++++ linux-2.6.8.1.plasmaroo/fs/smbfs/request.c	2004-11-06 11:27:20.000000000 +1100
+@@ -588,6 +588,10 @@
+ 	data_count  = WVAL(inbuf, smb_drcnt);
+ 
+ 	/* Modify offset for the split header/buffer we use */
++	if (data_offset < hdrlen)
++		goto out_bad_data;
++	if (parm_offset < hdrlen)
++		goto out_bad_parm;
+ 	data_offset -= hdrlen;
+ 	parm_offset -= hdrlen;
+ 
+@@ -607,6 +611,10 @@
+ 		req->rq_lparm = parm_count;
+ 		req->rq_data = req->rq_buffer + data_offset;
+ 		req->rq_parm = req->rq_buffer + parm_offset;
++		if (parm_offset + parm_count > req->rq_rlen)
++			goto out_bad_parm;
++		if (data_offset + data_count > req->rq_rlen)
++			goto out_bad_data;
+ 		return 0;
+ 	}
+ 
+@@ -634,6 +642,7 @@
+ 		req->rq_trans2buffer = smb_kmalloc(buf_len, GFP_NOFS);
+ 		if (!req->rq_trans2buffer)
+ 			goto out_no_mem;
++		memset(req->rq_trans2buffer, 0, buf_len);
+ 
+ 		req->rq_parm = req->rq_trans2buffer;
+ 		req->rq_data = req->rq_trans2buffer + parm_tot;
+@@ -643,8 +652,12 @@
+ 
+ 	if (parm_disp + parm_count > req->rq_total_parm)
+ 		goto out_bad_parm;
++	if (parm_offset + parm_count > req->rq_rlen)
++		goto out_bad_parm;
+ 	if (data_disp + data_count > req->rq_total_data)
+ 		goto out_bad_data;
++	if (data_offset + data_count > req->rq_rlen)
++		goto out_bad_data;
+ 
+ 	inbuf = req->rq_buffer;
+ 	memcpy(req->rq_parm + parm_disp, inbuf + parm_offset, parm_count);
+@@ -657,8 +670,11 @@
+ 	 * Check whether we've received all of the data. Note that
+ 	 * we use the packet totals -- total lengths might shrink!
+ 	 */
+-	if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot)
++	if (req->rq_ldata >= data_tot && req->rq_lparm >= parm_tot) {
++		req->rq_ldata = data_tot;
++		req->rq_lparm = parm_tot;
+ 		return 0;
++	}
+ 	return 1;
+ 
+ out_too_long:
+@@ -676,13 +692,13 @@
+ 	req->rq_errno = -EIO;
+ 	goto out;
+ out_bad_parm:
+-	printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d\n",
+-	       parm_disp, parm_count, parm_tot);
++	printk(KERN_ERR "smb_trans2: invalid parms, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++	       parm_disp, parm_count, parm_tot, parm_offset);
+ 	req->rq_errno = -EIO;
+ 	goto out;
+ out_bad_data:
+-	printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d\n",
+-	       data_disp, data_count, data_tot);
++	printk(KERN_ERR "smb_trans2: invalid data, disp=%d, cnt=%d, tot=%d, ofs=%d\n",
++	       data_disp, data_count, data_tot, data_offset);
+ 	req->rq_errno = -EIO;
+ out:
+ 	return req->rq_errno;
diff --git a/sys-kernel/xbox-sources/xbox-sources-2.4.27-r4.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild
index 67d2b9dd6438..321fd72ff91e 100644
--- a/sys-kernel/xbox-sources/xbox-sources-2.4.27-r4.ebuild
+++ b/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild
@@ -1,12 +1,12 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r4.ebuild,v 1.1 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.4.27-r5.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
 detect_version
 
-XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r4/r0}.patch.bz2"
+XBOX_PATCH="xbox-sources-${KV_MAJOR}.${KV_MINOR}.${KV_PATCH}-${PR/r5/r0}.patch.bz2"
 
 SRC_URI="${KERNEL_URI}
 	mirror://gentoo/${XBOX_PATCH}
@@ -24,4 +24,5 @@ UNIPATCH_LIST="
 	${FILESDIR}/${P}.cmdlineLeak.patch
 	${FILESDIR}/${P}.XDRWrapFix.patch
 	${FILESDIR}/${P}.binfmt_elf.patch
+	${FILESDIR}/${P}.smbfs.patch
 	${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch"
diff --git a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r3.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild
index 9c60a1a159bc..8a0fba2226aa 100644
--- a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r3.ebuild
+++ b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r3.ebuild,v 1.1 2004/11/12 20:38:36 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r4.ebuild,v 1.1 2004/11/19 23:17:23 plasmaroo Exp $
 
 ETYPE='sources'
 inherit kernel-2
@@ -16,6 +16,7 @@ UNIPATCH_LIST="
 	${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch
 	${FILESDIR}/${PN}-2.6.7.cmdlineLeak.patch
 	${FILESDIR}/${P}.devPtmx.patch
+	${FILESDIR}/${P}.smbfs.patch
 	${FILESDIR}/${P}.binfmt_elf.patch"
 DESCRIPTION='Full sources for the Xbox Linux kernel'
 SRC_URI="${KERNEL_URI}