From 10028143f876b5c1efdce063e528f043098194d9 Mon Sep 17 00:00:00 2001 From: Tim Yamin Date: Thu, 24 Jun 2004 10:51:50 +0000 Subject: Security bumps for the CAN-2004-0495 and CAN-2004-0535 vulnerabilities. --- sys-kernel/alpha-sources/ChangeLog | 9 +- sys-kernel/alpha-sources/Manifest | 26 +- .../alpha-sources/alpha-sources-2.4.21-r6.ebuild | 81 --- .../alpha-sources/alpha-sources-2.4.21-r8.ebuild | 88 +++ .../files/alpha-sources.CAN-2004-0495.patch | 655 +++++++++++++++++++++ .../files/alpha-sources.CAN-2004-0535.patch | 12 + .../files/digest-alpha-sources-2.4.21-r6 | 2 - .../files/digest-alpha-sources-2.4.21-r8 | 2 + 8 files changed, 779 insertions(+), 96 deletions(-) delete mode 100644 sys-kernel/alpha-sources/alpha-sources-2.4.21-r6.ebuild create mode 100644 sys-kernel/alpha-sources/alpha-sources-2.4.21-r8.ebuild create mode 100644 sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0495.patch create mode 100644 sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0535.patch delete mode 100644 sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r6 create mode 100644 sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r8 (limited to 'sys-kernel') diff --git a/sys-kernel/alpha-sources/ChangeLog b/sys-kernel/alpha-sources/ChangeLog index fa8fd997d62d..a2962aada30f 100644 --- a/sys-kernel/alpha-sources/ChangeLog +++ b/sys-kernel/alpha-sources/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sys-kernel/alpha-sources # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.27 2004/06/23 23:11:29 agriffis Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/ChangeLog,v 1.28 2004/06/24 10:51:50 plasmaroo Exp $ + +*alpha-sources-2.4.21-r8 (24 Jun 2004) + + 24 Jun 2004; -alpha-sources-2.4.21-r6.ebuild, + +alpha-sources-2.4.21-r8.ebuild, +files/alpha-sources.CAN-2004-0495.patch, + +files/alpha-sources.CAN-2004-0535.patch: + Security bumps for the CAN-2004-0495 and CAN-2004-0535 vulnerabilities. 23 Jun 2004; Aron Griffis alpha-sources-2.4.21-r6.ebuild, alpha-sources-2.4.21-r7.ebuild: diff --git a/sys-kernel/alpha-sources/Manifest b/sys-kernel/alpha-sources/Manifest index 19ca6a82fb61..70c985293d54 100644 --- a/sys-kernel/alpha-sources/Manifest +++ b/sys-kernel/alpha-sources/Manifest @@ -1,19 +1,21 @@ +MD5 5111f2840d39a16aa5e85189ccaf5c84 ChangeLog 5079 +MD5 00aa8caf57bc7bc71b7ba19cdb05cce0 alpha-sources-2.4.21-r8.ebuild 3709 MD5 70682d610df84020d67a2d3e516d6c16 alpha-sources-2.4.21-r7.ebuild 3520 -MD5 74ada9cf5ebc26319cfaf47491848fd8 ChangeLog 4771 -MD5 115ed7754b1c6be860ce46736112950f alpha-sources-2.4.21-r6.ebuild 3050 -MD5 d4a740ae56c2049247083af387a22a85 files/alpha-sources.CAN-2004-0394.patch 350 -MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/alpha-sources.CAN-2004-0177.patch 384 MD5 5bf9836a632a861728d33f9736bb7431 files/alpha-sources.CAN-2004-0133.patch 427 -MD5 21f3a4f186017d925067335e24db36a1 files/alpha-sources.CAN-2004-0109.patch 1877 +MD5 e52b0635fe18547f2278f6c4237a6e98 files/digest-alpha-sources-2.4.21-r7 144 +MD5 c460ea130cb4ae84a5063ba044e3ce72 files/alpha-sources.CAN-2004-0427.patch 460 MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/alpha-sources.CAN-2004-0075.patch 634 -MD5 ac42024b6e6ee1e2165914db4b22a61c files/alpha-sources.CAN-2004-0178.patch 424 +MD5 d4a740ae56c2049247083af387a22a85 files/alpha-sources.CAN-2004-0394.patch 350 +MD5 147fec50180ad91b6260fc7201dcb90f files/alpha-sources.CAN-2004-0010.patch 6050 +MD5 e52b0635fe18547f2278f6c4237a6e98 files/digest-alpha-sources-2.4.21-r8 144 +MD5 dc18e982f8149588a291956481885a8c files/alpha-sources.CAN-2004-0495.patch 17549 MD5 df40eece807d039cba79f477e80ebda2 files/alpha-sources-2.4.19.rtc_fix.patch 4974 -MD5 e52b0635fe18547f2278f6c4237a6e98 files/digest-alpha-sources-2.4.21-r6 144 -MD5 e52b0635fe18547f2278f6c4237a6e98 files/digest-alpha-sources-2.4.21-r7 144 -MD5 e637c6fa41097ea2c4693d0766f2e1c5 files/do_brk_fix.patch 242 MD5 a61e57d5483a06f20da339d91f98fbb8 files/alpha-sources.rtc_fix.patch 6769 MD5 174438d215b70cad5ffb00ca8123c062 files/alpha-sources.munmap.patch 837 -MD5 c460ea130cb4ae84a5063ba044e3ce72 files/alpha-sources.CAN-2004-0427.patch 460 -MD5 de75cfa969ed092578d9ddda6c5be334 files/alpha-sources.CAN-2004-0181.patch 1233 MD5 e77a93fdf26f06cf3ea5080b27211725 files/alpha-sources.CAN-2003-0985.patch 414 -MD5 147fec50180ad91b6260fc7201dcb90f files/alpha-sources.CAN-2004-0010.patch 6050 +MD5 de75cfa969ed092578d9ddda6c5be334 files/alpha-sources.CAN-2004-0181.patch 1233 +MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/alpha-sources.CAN-2004-0177.patch 384 +MD5 21f3a4f186017d925067335e24db36a1 files/alpha-sources.CAN-2004-0109.patch 1877 +MD5 ac42024b6e6ee1e2165914db4b22a61c files/alpha-sources.CAN-2004-0178.patch 424 +MD5 082e410301c2522521b0d3843db19c9e files/alpha-sources.CAN-2004-0535.patch 502 +MD5 e637c6fa41097ea2c4693d0766f2e1c5 files/do_brk_fix.patch 242 diff --git a/sys-kernel/alpha-sources/alpha-sources-2.4.21-r6.ebuild b/sys-kernel/alpha-sources/alpha-sources-2.4.21-r6.ebuild deleted file mode 100644 index bf87afccb62f..000000000000 --- a/sys-kernel/alpha-sources/alpha-sources-2.4.21-r6.ebuild +++ /dev/null @@ -1,81 +0,0 @@ -# Copyright 1999-2004 Gentoo Technologies, Inc. -# Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r6.ebuild,v 1.2 2004/06/23 23:11:29 agriffis Exp $ - -# OKV=original kernel version, KV=patched kernel version. They can be the same. - -IUSE="build crypt usagi" -ETYPE="sources" -inherit kernel eutils -OKV="`echo ${PV}|sed -e 's:^\([0-9]\+\.[0-9]\+\.[0-9]\+\).*:\1:'`" -EXTRAVERSION="-${PN/-*/}" -[ ! "${PR}" == "r0" ] && EXTRAVERSION="${EXTRAVERSION}-${PR}" -KV="${OKV}${EXTRAVERSION}" - -S=${WORKDIR}/linux-${KV} - -DESCRIPTION="Full sources for the Gentoo Linux Alpha kernel" -SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2 - mirror://gentoo/patches-${KV/6/3}.tar.bz2" -SLOT="${KV}" -KEYWORDS="alpha -sparc -x86 -ppc -hppa -mips" - -src_unpack() { - unpack ${A} - mv linux-${OKV} linux-${KV} || die - cd ${WORKDIR}/${KV/3/1} - - # This is the crypt USE flag, keeps {USAGI/superfreeswan/patch-int/loop-jari} - if ! use crypt; then - einfo "No Cryptographic support, dropping patches..." - for file in 6* 8* ;do - einfo "Dropping ${file}..." - rm -f ${file} - done - else - einfo "Cryptographic patches will be applied" - fi - - # This is the usagi USE flag, keeps USAGI, drops - # {superfreeswan/patch-int/loop-jari} - # Using USAGI will also cause you to drop all iptables ipv6 - # patches. - if ! use usagi; then - einfo "Keeping {superfreeswan/patch-int/loop-jari} patches, dropping USAGI" - for file in 6* ;do - einfo "Dropping ${file}..." - rm -f ${file} - done - else - einfo "Keeping USAGI patch, dropping {superfreeswan/patch-int/loop-jari}" - for file in *.ipv6 8* ;do - einfo "Dropping ${file}..." - rm -f ${file} - done - fi - - kernel_src_unpack - - cd ${S} - epatch ${FILESDIR}/do_brk_fix.patch || die "Failed to patch the do_brk() vulnerability!" - epatch ${FILESDIR}/${PN}.CAN-2003-0985.patch || die "Failed to patch mremap() vulnerability!" - epatch ${FILESDIR}/${PN}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!" - epatch ${FILESDIR}/${PN}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!" - epatch ${FILESDIR}/${PN}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!" - epatch ${FILESDIR}/${PN}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!" - epatch ${FILESDIR}/${PN}.rtc_fix.patch || die "Failed to patch RTC vulnerabilities!" - epatch ${FILESDIR}/${PN}.munmap.patch || die "Failed to apply munmap patch!" - - # Fix multi-line literal in include/asm-alpha/xor.h -- see bug 38354 - # If this script "dies" then that means it's no longer applicable. - mv include/asm-alpha/xor.h{,.multiline} - awk 'BEGIN { addnl=0; exitstatus=1 } - /^asm\("/ { addnl=1 } - /^"\)/ { addnl=0 } - addnl && !/\\n\\$/ { sub("$", " \\n\\", $0); exitstatus=0 } - { print } - END { exit exitstatus }' \ - include/asm-alpha/xor.h - assert "awk script failed, probably doesn't apply to ${KV}" - rm -f include/asm-alpha/xor.h.multiline -} diff --git a/sys-kernel/alpha-sources/alpha-sources-2.4.21-r8.ebuild b/sys-kernel/alpha-sources/alpha-sources-2.4.21-r8.ebuild new file mode 100644 index 000000000000..01234c522d7c --- /dev/null +++ b/sys-kernel/alpha-sources/alpha-sources-2.4.21-r8.ebuild @@ -0,0 +1,88 @@ +# Copyright 1999-2004 Gentoo Technologies, Inc. +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-kernel/alpha-sources/alpha-sources-2.4.21-r8.ebuild,v 1.1 2004/06/24 10:51:50 plasmaroo Exp $ + +# OKV=original kernel version, KV=patched kernel version. They can be the same. + +IUSE="build crypt usagi" +ETYPE="sources" +inherit kernel eutils +OKV="`echo ${PV}|sed -e 's:^\([0-9]\+\.[0-9]\+\.[0-9]\+\).*:\1:'`" +EXTRAVERSION="-${PN/-*/}" +[ ! "${PR}" == "r0" ] && EXTRAVERSION="${EXTRAVERSION}-${PR}" +KV="${OKV}${EXTRAVERSION}" + +S=${WORKDIR}/linux-${KV} + +DESCRIPTION="Full sources for the Gentoo Linux Alpha kernel" +SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2 + mirror://gentoo/patches-${KV/8/3}.tar.bz2" +SLOT="${KV}" +KEYWORDS="alpha -sparc -x86 -ppc -hppa -mips" + +src_unpack() { + unpack ${A} + mv linux-${OKV} linux-${KV} || die + cd ${WORKDIR}/${KV/8/1} + + # This is the crypt USE flag, keeps {USAGI/superfreeswan/patch-int/loop-jari} + if ! use crypt; then + einfo "No Cryptographic support, dropping patches..." + for file in 6* 8* ;do + einfo "Dropping ${file}..." + rm -f ${file} + done + else + einfo "Cryptographic patches will be applied" + fi + + # This is the usagi USE flag, keeps USAGI, drops + # {superfreeswan/patch-int/loop-jari} + # Using USAGI will also cause you to drop all iptables ipv6 + # patches. + if ! use usagi; then + einfo "Keeping {superfreeswan/patch-int/loop-jari} patches, dropping USAGI" + for file in 6* ;do + einfo "Dropping ${file}..." + rm -f ${file} + done + else + einfo "Keeping USAGI patch, dropping {superfreeswan/patch-int/loop-jari}" + for file in *.ipv6 8* ;do + einfo "Dropping ${file}..." + rm -f ${file} + done + fi + + kernel_src_unpack + + cd ${S} + epatch ${FILESDIR}/do_brk_fix.patch || die "Failed to patch the do_brk() vulnerability!" + epatch ${FILESDIR}/${PN}.CAN-2003-0985.patch || die "Failed to patch mremap() vulnerability!" + epatch ${FILESDIR}/${PN}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0075.patch || die "Failed to add the CAN-2004-0075 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!" + epatch ${FILESDIR}/${PN}.CAN-2004-0133.patch || die "Failed to add the CAN-2004-0133 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0495.patch || die "Failed to add the CAN-2004-0495 patch!" + epatch ${FILESDIR}/${PN}.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!" + epatch ${FILESDIR}/${PN}.rtc_fix.patch || die "Failed to patch RTC vulnerabilities!" + epatch ${FILESDIR}/${PN}.munmap.patch || die "Failed to apply munmap patch!" + + # Fix multi-line literal in include/asm-alpha/xor.h -- see bug 38354 + # If this script "dies" then that means it's no longer applicable. + mv include/asm-alpha/xor.h{,.multiline} + awk 'BEGIN { addnl=0; exitstatus=1 } + /^asm\("/ { addnl=1 } + /^"\)/ { addnl=0 } + addnl && !/\\n\\$/ { sub("$", " \\n\\", $0); exitstatus=0 } + { print } + END { exit exitstatus }' \ + include/asm-alpha/xor.h + assert "awk script failed, probably doesn't apply to ${KV}" + rm -f include/asm-alpha/xor.h.multiline +} diff --git a/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0495.patch b/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0495.patch new file mode 100644 index 000000000000..bea80eac69a9 --- /dev/null +++ b/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0495.patch @@ -0,0 +1,655 @@ +--- linux/net/decnet/dn_dev.c.bak Wed Jun 16 14:42:24 2004 ++++ linux/net/decnet/dn_dev.c Wed Jun 16 14:42:34 2004 +@@ -1070,31 +1070,39 @@ int dnet_gifconf(struct net_device *dev, + { + struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr; + struct dn_ifaddr *ifa; +- struct ifreq *ifr = (struct ifreq *)buf; ++ char buffer[DN_IFREQ_SIZE]; ++ struct ifreq *ifr = (struct ifreq *)buffer; ++ struct sockaddr_dn *addr = (struct sockaddr_dn *)&ifr->ifr_addr; + int done = 0; + + if ((dn_db == NULL) || ((ifa = dn_db->ifa_list) == NULL)) + return 0; + + for(; ifa; ifa = ifa->ifa_next) { +- if (!ifr) { ++ if (!buf) { + done += sizeof(DN_IFREQ_SIZE); + continue; + } + if (len < DN_IFREQ_SIZE) + return done; +- memset(ifr, 0, DN_IFREQ_SIZE); ++ memset(buffer, 0, DN_IFREQ_SIZE); + + if (ifa->ifa_label) + strcpy(ifr->ifr_name, ifa->ifa_label); + else + strcpy(ifr->ifr_name, dev->name); + +- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_family = AF_DECnet; +- (*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_len = 2; +- (*(dn_address *)(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_addr) = ifa->ifa_local; ++ addr->sdn_family = AF_DECnet; ++ addr->sdn_add.a_len = 2; ++ memcpy(addr->sdn_add.a_addr, &ifa->ifa_local, ++ sizeof(dn_address)); + +- ifr = (struct ifreq *)((char *)ifr + DN_IFREQ_SIZE); ++ if (copy_to_user(buf, buffer, DN_IFREQ_SIZE)) { ++ done = -EFAULT; ++ break; ++ } ++ ++ buf += DN_IFREQ_SIZE; + len -= DN_IFREQ_SIZE; + done += DN_IFREQ_SIZE; + } +--- linux-2.4.21/drivers/net/wireless/airo.c 2003-06-13 15:51:35.000000000 +0100 ++++ linux-2.4.21/drivers/net/wireless/airo.c.plasmaroo 2004-06-24 11:09:08.260352168 +0100 +@@ -3012,19 +3012,22 @@ + size_t len, + loff_t *offset ) + { +- int i; +- int pos; ++ loff_t pos = *offset; + struct proc_data *priv = (struct proc_data*)file->private_data; + +- if( !priv->rbuffer ) return -EINVAL; ++ if (!priv->rbuffer) ++ return -EINVAL; + +- pos = *offset; +- for( i = 0; i+pos < priv->readlen && i < len; i++ ) { +- if (put_user( priv->rbuffer[i+pos], buffer+i )) +- return -EFAULT; +- } +- *offset += i; +- return i; ++ if (pos < 0) ++ return -EINVAL; ++ if (pos >= priv->readlen) ++ return 0; ++ if (len > priv->readlen - pos) ++ len = priv->readlen - pos; ++ if (copy_to_user(buffer, priv->rbuffer + pos, len)) ++ return -EFAULT; ++ *offset = pos + len; ++ return len; + } + + /* +@@ -3036,24 +3039,24 @@ + size_t len, + loff_t *offset ) + { +- int i; +- int pos; ++ loff_t pos = *offset; + struct proc_data *priv = (struct proc_data*)file->private_data; + +- if ( !priv->wbuffer ) { ++ if (!priv->wbuffer) + return -EINVAL; +- } +- +- pos = *offset; + +- for( i = 0; i + pos < priv->maxwritelen && +- i < len; i++ ) { +- if (get_user( priv->wbuffer[i+pos], buffer + i )) +- return -EFAULT; +- } +- if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos; +- *offset += i; +- return i; ++ if (pos < 0) ++ return -EINVAL; ++ if (pos >= priv->maxwritelen) ++ return 0; ++ if (len > priv->maxwritelen - pos) ++ len = priv->maxwritelen - pos; ++ if (copy_from_user(priv->wbuffer + pos, buffer, len)) ++ return -EFAULT; ++ if (pos + len > priv->writelen) ++ priv->writelen = pos + len; ++ *offset = pos + len; ++ return len; + } + + static int proc_status_open( struct inode *inode, struct file *file ) { +--- linux/drivers/sound/mpu401.c.bak Wed Jun 16 14:42:24 2004 ++++ linux/drivers/sound/mpu401.c Wed Jun 16 14:42:34 2004 +@@ -1493,14 +1493,16 @@ static unsigned long mpu_timer_get_time( + static int mpu_timer_ioctl(int dev, unsigned int command, caddr_t arg) + { + int midi_dev = sound_timer_devs[dev]->devlink; ++ int *p = (int *)arg; + + switch (command) + { + case SNDCTL_TMR_SOURCE: + { + int parm; +- +- parm = *(int *) arg; ++ ++ if (get_user(parm, p)) ++ return -EFAULT; + parm &= timer_caps; + + if (parm != 0) +@@ -1512,7 +1514,9 @@ static int mpu_timer_ioctl(int dev, unsi + else if (timer_mode & TMR_MODE_SMPTE) + mpu_cmd(midi_dev, 0x3d, 0); /* Use SMPTE sync */ + } +- return (*(int *) arg = timer_mode); ++ if (put_user(timer_mode, p)) ++ return -EFAULT; ++ return timer_mode; + } + break; + +@@ -1537,10 +1541,13 @@ static int mpu_timer_ioctl(int dev, unsi + { + int val; + +- val = *(int *) arg; ++ if (get_user(val, p)) ++ return -EFAULT; + if (val) + set_timebase(midi_dev, val); +- return (*(int *) arg = curr_timebase); ++ if (put_user(curr_timebase, p)) ++ return -EFAULT; ++ return curr_timebase; + } + break; + +@@ -1549,7 +1556,8 @@ static int mpu_timer_ioctl(int dev, unsi + int val; + int ret; + +- val = *(int *) arg; ++ if (get_user(val, p)) ++ return -EFAULT; + + if (val) + { +@@ -1564,7 +1572,9 @@ static int mpu_timer_ioctl(int dev, unsi + } + curr_tempo = val; + } +- return (*(int *) arg = curr_tempo); ++ if (put_user(curr_tempo, p)) ++ return -EFAULT; ++ return curr_tempo; + } + break; + +@@ -1572,18 +1582,25 @@ static int mpu_timer_ioctl(int dev, unsi + { + int val; + +- val = *(int *) arg; ++ if (get_user(val, p)) ++ return -EFAULT; + if (val != 0) /* Can't change */ + return -EINVAL; +- return (*(int *) arg = ((curr_tempo * curr_timebase) + 30) / 60); ++ val = (curr_tempo * curr_timebase + 30) / 60; ++ if (put_user(val, p)) ++ return -EFAULT; ++ return val; + } + break; + + case SNDCTL_SEQ_GETTIME: +- return (*(int *) arg = curr_ticks); ++ if (put_user(curr_ticks, p)) ++ return -EFAULT; ++ return curr_ticks; + + case SNDCTL_TMR_METRONOME: +- metronome_mode = *(int *) arg; ++ if (get_user(metronome_mode, p)) ++ return -EFAULT; + setup_metronome(midi_dev); + return 0; + +--- linux/drivers/sound/msnd.c.bak Wed Jun 16 14:42:24 2004 ++++ linux/drivers/sound/msnd.c Wed Jun 16 14:42:34 2004 +@@ -155,13 +155,10 @@ void msnd_fifo_make_empty(msnd_fifo *f) + f->len = f->tail = f->head = 0; + } + +-int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user) ++int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len) + { + int count = 0; + +- if (f->len == f->n) +- return 0; +- + while ((count < len) && (f->len != f->n)) { + + int nwritten; +@@ -177,11 +174,7 @@ int msnd_fifo_write(msnd_fifo *f, const + nwritten = len - count; + } + +- if (user) { +- if (copy_from_user(f->data + f->tail, buf, nwritten)) +- return -EFAULT; +- } else +- isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten); ++ isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten); + + count += nwritten; + buf += nwritten; +@@ -193,13 +186,10 @@ int msnd_fifo_write(msnd_fifo *f, const + return count; + } + +-int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user) ++int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len) + { + int count = 0; + +- if (f->len == 0) +- return f->len; +- + while ((count < len) && (f->len > 0)) { + + int nread; +@@ -215,11 +205,7 @@ int msnd_fifo_read(msnd_fifo *f, char *b + nread = len - count; + } + +- if (user) { +- if (copy_to_user(buf, f->data + f->head, nread)) +- return -EFAULT; +- } else +- isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread); ++ isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread); + + count += nread; + buf += nread; +--- linux/drivers/sound/msnd.h.bak Wed Jun 16 14:42:24 2004 ++++ linux/drivers/sound/msnd.h Wed Jun 16 14:42:34 2004 +@@ -266,8 +266,8 @@ void msnd_fifo_init(msnd_fifo *f); + void msnd_fifo_free(msnd_fifo *f); + int msnd_fifo_alloc(msnd_fifo *f, size_t n); + void msnd_fifo_make_empty(msnd_fifo *f); +-int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user); +-int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user); ++int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len); ++int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len); + + int msnd_wait_TXDE(multisound_dev_t *dev); + int msnd_wait_HC0(multisound_dev_t *dev); +--- linux/drivers/sound/msnd_pinnacle.c.bak Wed Jun 16 14:42:24 2004 ++++ linux/drivers/sound/msnd_pinnacle.c Wed Jun 16 14:42:34 2004 +@@ -804,7 +804,7 @@ static int dev_release(struct inode *ino + + static __inline__ int pack_DARQ_to_DARF(register int bank) + { +- register int size, n, timeout = 3; ++ register int size, timeout = 3; + register WORD wTmp; + LPDAQD DAQD; + +@@ -825,13 +825,10 @@ static __inline__ int pack_DARQ_to_DARF( + /* Read data from the head (unprotected bank 1 access okay + since this is only called inside an interrupt) */ + outb(HPBLKSEL_1, dev.io + HP_BLKS); +- if ((n = msnd_fifo_write( ++ msnd_fifo_write( + &dev.DARF, + (char *)(dev.base + bank * DAR_BUFF_SIZE), +- size, 0)) <= 0) { +- outb(HPBLKSEL_0, dev.io + HP_BLKS); +- return n; +- } ++ size); + outb(HPBLKSEL_0, dev.io + HP_BLKS); + + return 1; +@@ -853,21 +850,16 @@ static __inline__ int pack_DAPF_to_DAPQ( + if (protect) { + /* Critical section: protect fifo in non-interrupt */ + spin_lock_irqsave(&dev.lock, flags); +- if ((n = msnd_fifo_read( ++ n = msnd_fifo_read( + &dev.DAPF, + (char *)(dev.base + bank_num * DAP_BUFF_SIZE), +- DAP_BUFF_SIZE, 0)) < 0) { +- spin_unlock_irqrestore(&dev.lock, flags); +- return n; +- } ++ DAP_BUFF_SIZE); + spin_unlock_irqrestore(&dev.lock, flags); + } else { +- if ((n = msnd_fifo_read( ++ n = msnd_fifo_read( + &dev.DAPF, + (char *)(dev.base + bank_num * DAP_BUFF_SIZE), +- DAP_BUFF_SIZE, 0)) < 0) { +- return n; +- } ++ DAP_BUFF_SIZE); + } + if (!n) + break; +@@ -894,30 +886,43 @@ static __inline__ int pack_DAPF_to_DAPQ( + static int dsp_read(char *buf, size_t len) + { + int count = len; ++ char *page = (char *)__get_free_page(PAGE_SIZE); ++ ++ if (!page) ++ return -ENOMEM; + + while (count > 0) { +- int n; ++ int n, k; + unsigned long flags; + ++ k = PAGE_SIZE; ++ if (k > count) ++ k = count; ++ + /* Critical section: protect fifo in non-interrupt */ + spin_lock_irqsave(&dev.lock, flags); +- if ((n = msnd_fifo_read(&dev.DARF, buf, count, 1)) < 0) { +- printk(KERN_WARNING LOGNAME ": FIFO read error\n"); +- spin_unlock_irqrestore(&dev.lock, flags); +- return n; +- } ++ n = msnd_fifo_read(&dev.DARF, page, k); + spin_unlock_irqrestore(&dev.lock, flags); ++ if (copy_to_user(buf, page, n)) { ++ free_page((unsigned long)page); ++ return -EFAULT; ++ } + buf += n; + count -= n; + ++ if (n == k && count) ++ continue; ++ + if (!test_bit(F_READING, &dev.flags) && dev.mode & FMODE_READ) { + dev.last_recbank = -1; + if (chk_send_dsp_cmd(&dev, HDEX_RECORD_START) == 0) + set_bit(F_READING, &dev.flags); + } + +- if (dev.rec_ndelay) ++ if (dev.rec_ndelay) { ++ free_page((unsigned long)page); + return count == len ? -EAGAIN : len - count; ++ } + + if (count > 0) { + set_bit(F_READBLOCK, &dev.flags); +@@ -926,41 +931,57 @@ static int dsp_read(char *buf, size_t le + get_rec_delay_jiffies(DAR_BUFF_SIZE))) + clear_bit(F_READING, &dev.flags); + clear_bit(F_READBLOCK, &dev.flags); +- if (signal_pending(current)) ++ if (signal_pending(current)) { ++ free_page((unsigned long)page); + return -EINTR; ++ } + } + } +- ++ free_page((unsigned long)page); + return len - count; + } + + static int dsp_write(const char *buf, size_t len) + { + int count = len; ++ char *page = (char *)__get_free_page(GFP_KERNEL); ++ ++ if (!page) ++ return -ENOMEM; + + while (count > 0) { +- int n; ++ int n, k; + unsigned long flags; + ++ k = PAGE_SIZE; ++ if (k > count) ++ k = count; ++ ++ if (copy_from_user(page, buf, k)) { ++ free_page((unsigned long)page); ++ return -EFAULT; ++ } ++ + /* Critical section: protect fifo in non-interrupt */ + spin_lock_irqsave(&dev.lock, flags); +- if ((n = msnd_fifo_write(&dev.DAPF, buf, count, 1)) < 0) { +- printk(KERN_WARNING LOGNAME ": FIFO write error\n"); +- spin_unlock_irqrestore(&dev.lock, flags); +- return n; +- } ++ n = msnd_fifo_write(&dev.DAPF, page, k); + spin_unlock_irqrestore(&dev.lock, flags); + buf += n; + count -= n; + ++ if (count && n == k) ++ continue; ++ + if (!test_bit(F_WRITING, &dev.flags) && (dev.mode & FMODE_WRITE)) { + dev.last_playbank = -1; + if (pack_DAPF_to_DAPQ(1) > 0) + set_bit(F_WRITING, &dev.flags); + } + +- if (dev.play_ndelay) ++ if (dev.play_ndelay) { ++ free_page((unsigned long)page); + return count == len ? -EAGAIN : len - count; ++ } + + if (count > 0) { + set_bit(F_WRITEBLOCK, &dev.flags); +@@ -968,11 +989,14 @@ static int dsp_write(const char *buf, si + &dev.writeblock, + get_play_delay_jiffies(DAP_BUFF_SIZE)); + clear_bit(F_WRITEBLOCK, &dev.flags); +- if (signal_pending(current)) ++ if (signal_pending(current)) { ++ free_page((unsigned long)page); + return -EINTR; ++ } + } + } + ++ free_page((unsigned long)page); + return len - count; + } + +--- linux/drivers/sound/pss.c.bak Wed Jun 16 14:42:24 2004 ++++ linux/drivers/sound/pss.c Wed Jun 16 14:42:34 2004 +@@ -450,20 +450,36 @@ static void pss_mixer_reset(pss_confdata + } + } + +-static void arg_to_volume_mono(unsigned int volume, int *aleft) ++static int set_volume_mono(caddr_t p, int *aleft) + { + int left; ++ unsigned volume; ++ if (get_user(volume, (unsigned *)p)) ++ return -EFAULT; + +- left = volume & 0x00ff; ++ left = volume & 0xff; + if (left > 100) + left = 100; + *aleft = left; ++ return 0; + } + +-static void arg_to_volume_stereo(unsigned int volume, int *aleft, int *aright) ++static int set_volume_stereo(caddr_t p, int *aleft, int *aright) + { +- arg_to_volume_mono(volume, aleft); +- arg_to_volume_mono(volume >> 8, aright); ++ int left, right; ++ unsigned volume; ++ if (get_user(volume, (unsigned *)p)) ++ return -EFAULT; ++ ++ left = volume & 0xff; ++ if (left > 100) ++ left = 100; ++ right = (volume >> 8) & 0xff; ++ if (right > 100) ++ right = 100; ++ *aleft = left; ++ *aright = right; ++ return 0; + } + + static int ret_vol_mono(int left) +@@ -510,33 +526,38 @@ static int pss_mixer_ioctl (int dev, uns + return call_ad_mixer(devc, cmd, arg); + else + { +- if (*(int *)arg != 0) ++ int v; ++ if (get_user(v, (int *)arg)) ++ return -EFAULT; ++ if (v != 0) + return -EINVAL; + return 0; + } + case SOUND_MIXER_VOLUME: +- arg_to_volume_stereo(*(unsigned int *)arg, &devc->mixer.volume_l, +- &devc->mixer.volume_r); ++ if (set_volume_stereo(arg, ++ &devc->mixer.volume_l, ++ &devc->mixer.volume_r)) ++ return -EFAULT; + set_master_volume(devc, devc->mixer.volume_l, + devc->mixer.volume_r); + return ret_vol_stereo(devc->mixer.volume_l, + devc->mixer.volume_r); + + case SOUND_MIXER_BASS: +- arg_to_volume_mono(*(unsigned int *)arg, +- &devc->mixer.bass); ++ if (set_volume_mono(arg, &devc->mixer.bass)) ++ return -EFAULT; + set_bass(devc, devc->mixer.bass); + return ret_vol_mono(devc->mixer.bass); + + case SOUND_MIXER_TREBLE: +- arg_to_volume_mono(*(unsigned int *)arg, +- &devc->mixer.treble); ++ if (set_volume_mono(arg, &devc->mixer.treble)) ++ return -EFAULT; + set_treble(devc, devc->mixer.treble); + return ret_vol_mono(devc->mixer.treble); + + case SOUND_MIXER_SYNTH: +- arg_to_volume_mono(*(unsigned int *)arg, +- &devc->mixer.synth); ++ if (set_volume_mono(arg, &devc->mixer.synth)) ++ return -EFAULT; + set_synth_volume(devc, devc->mixer.synth); + return ret_vol_mono(devc->mixer.synth); + +@@ -546,54 +567,67 @@ static int pss_mixer_ioctl (int dev, uns + } + else + { ++ int val, and_mask = 0, or_mask = 0; + /* + * Return parameters + */ + switch (cmdf) + { +- + case SOUND_MIXER_DEVMASK: + if (call_ad_mixer(devc, cmd, arg) == -EINVAL) +- *(int *)arg = 0; /* no mixer devices */ +- return (*(int *)arg |= SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH); ++ break; ++ and_mask = ~0; ++ or_mask = SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH; ++ break; + + case SOUND_MIXER_STEREODEVS: + if (call_ad_mixer(devc, cmd, arg) == -EINVAL) +- *(int *)arg = 0; /* no stereo devices */ +- return (*(int *)arg |= SOUND_MASK_VOLUME); ++ break; ++ and_mask = ~0; ++ or_mask = SOUND_MASK_VOLUME; ++ break; + + case SOUND_MIXER_RECMASK: + if (devc->ad_mixer_dev != NO_WSS_MIXER) + return call_ad_mixer(devc, cmd, arg); +- else +- return (*(int *)arg = 0); /* no record devices */ ++ break; + + case SOUND_MIXER_CAPS: + if (devc->ad_mixer_dev != NO_WSS_MIXER) + return call_ad_mixer(devc, cmd, arg); +- else +- return (*(int *)arg = SOUND_CAP_EXCL_INPUT); ++ or_mask = SOUND_CAP_EXCL_INPUT; ++ break; + + case SOUND_MIXER_RECSRC: + if (devc->ad_mixer_dev != NO_WSS_MIXER) + return call_ad_mixer(devc, cmd, arg); +- else +- return (*(int *)arg = 0); /* no record source */ ++ break; + + case SOUND_MIXER_VOLUME: +- return (*(int *)arg = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r)); ++ or_mask = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r); ++ break; + + case SOUND_MIXER_BASS: +- return (*(int *)arg = ret_vol_mono(devc->mixer.bass)); ++ or_mask = ret_vol_mono(devc->mixer.bass); ++ break; + + case SOUND_MIXER_TREBLE: +- return (*(int *)arg = ret_vol_mono(devc->mixer.treble)); ++ or_mask = ret_vol_mono(devc->mixer.treble); ++ break; + + case SOUND_MIXER_SYNTH: +- return (*(int *)arg = ret_vol_mono(devc->mixer.synth)); ++ or_mask = ret_vol_mono(devc->mixer.synth); ++ break; + default: + return -EINVAL; + } ++ if (get_user(val, (int *)arg)) ++ return -EFAULT; ++ val &= and_mask; ++ val |= or_mask; ++ if (put_user(val, (int *)arg)) ++ return -EFAULT; ++ return val; + } + } + diff --git a/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0535.patch b/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0535.patch new file mode 100644 index 000000000000..8d264416ff72 --- /dev/null +++ b/sys-kernel/alpha-sources/files/alpha-sources.CAN-2004-0535.patch @@ -0,0 +1,12 @@ +--- linux-2.4.21/drivers/net/e1000/e1000_ethtool.c 2003-06-13 15:51:34.000000000 +0100 ++++ linux-2.4.21/drivers/net/e1000/e1000_ethtool.c.plasmaroo 2004-06-24 11:23:32.524963976 +0100 +@@ -468,6 +468,9 @@ + + if(copy_from_user(®s, addr, sizeof(regs))) + return -EFAULT; ++ memset(regs_buff, 0, sizeof(regs_buff)); ++ if (regs.len > E1000_REGS_LEN) ++ regs.len = E1000_REGS_LEN; + e1000_ethtool_gregs(adapter, ®s, regs_buff); + if(copy_to_user(addr, ®s, sizeof(regs))) + return -EFAULT; diff --git a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r6 b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r6 deleted file mode 100644 index a17dcc489c19..000000000000 --- a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r6 +++ /dev/null @@ -1,2 +0,0 @@ -MD5 f51e12efa18bb828cf57d9d4a81b2fb1 linux-2.4.21.tar.bz2 28533733 -MD5 28094d6a3d68f228bda98af459ad1310 patches-2.4.21-alpha-r3.tar.bz2 1696825 diff --git a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r8 b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r8 new file mode 100644 index 000000000000..a17dcc489c19 --- /dev/null +++ b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r8 @@ -0,0 +1,2 @@ +MD5 f51e12efa18bb828cf57d9d4a81b2fb1 linux-2.4.21.tar.bz2 28533733 +MD5 28094d6a3d68f228bda98af459ad1310 patches-2.4.21-alpha-r3.tar.bz2 1696825 -- cgit v1.2.3-65-gdbad