Security bump - fix #77666, #78362, #78363, #81106.

(Portage version: 2.0.51.19)

12 files changed, 468 insertions, 5 deletions

diff --git a/sys-kernel/wolk-sources/ChangeLog b/sys-kernel/wolk-sources/ChangeLog
index d2b8f65fcd3e..b8627732b183 100644
--- a/sys-kernel/wolk-sources/ChangeLog
+++ b/sys-kernel/wolk-sources/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for sys-kernel/wolk-sources
 # Copyright 2002-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/ChangeLog,v 1.64 2005/01/09 16:21:03 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/ChangeLog,v 1.65 2005/03/26 18:41:50 plasmaroo Exp $
+
+*wolk-sources-4.14-r14 (26 Mar 2005)
+
+  26 Mar 2005; <plasmaroo@gentoo.org> -wolk-sources-4.11-r16.ebuild,
+  +wolk-sources-4.11-r17.ebuild, -wolk-sources-4.14-r13.ebuild,
+  +wolk-sources-4.14-r14.ebuild, -wolk-sources-4.9-r20.ebuild,
+  +wolk-sources-4.9-r21.ebuild, +files/wolk-sources-4.9s.77666.patch,
+  +files/wolk-sources.77666.patch, +files/wolk-sources.78362.patch,
+  +files/wolk-sources.78363.patch, +files/wolk-sources.81106.patch:
+  Security bump - fix #77666, #78362, #78363, #81106.
 
 *wolk-sources-4.14-r13 (09 Jan 2005)
 
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r16 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r17
index 87807a9d0fb6..87807a9d0fb6 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r16
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.11-r17
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r13 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r14
index e3d89ad5aa4d..e3d89ad5aa4d 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r13
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.14-r14
diff --git a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r20 b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r21
index 61d3cc28c6fe..61d3cc28c6fe 100644
--- a/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r20
+++ b/sys-kernel/wolk-sources/files/digest-wolk-sources-4.9-r21
diff --git a/sys-kernel/wolk-sources/files/wolk-sources-4.9s.77666.patch b/sys-kernel/wolk-sources/files/wolk-sources-4.9s.77666.patch
new file mode 100644
index 000000000000..3e7725165d9d
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources-4.9s.77666.patch
@@ -0,0 +1,44 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2005/01/12 09:14:50-02:00 marcelo.tosatti@cyclades.com 
+#   [PATCH] Fix expand_stack() SMP race
+#   
+#   Description: Fix expand_stack() SMP race
+#   
+#   Two threads sharing the same VMA can race in expand_stack, resulting in incorrect VMA
+#   size accounting and possibly a "uncovered-by-VMA" pte leak.
+#   
+#   Fix is to check if the stack has already been expanded after acquiring a lock which
+#   guarantees exclusivity (page_table_lock in v2.4 and vma_anon lock in v2.6).
+# 
+# include/linux/mm.h
+#   2005/01/07 14:51:21-02:00 marcelo.tosatti@cyclades.com +10 -3
+#   Fix expand_stack() SMP race
+# 
+diff -Nru linux-wolk/include/linux/mm.h linux-plasmaroo/include/linux/mm.h
+--- linux-wolk/include/linux/mm.h	2005-01-13 04:59:30 -08:00
++++ linux-plasmaroo/include/linux/mm.h	2005-01-13 04:59:30 -08:00
+@@ -876,14 +876,19 @@
+ 	int err = -ENOMEM;
+ 
+ 	/*
+-	 * vma->vm_start/vm_end cannot change under us because the caller is required
+-	 * to hold the mmap_sem in write mode. We need to get the spinlock only
+-	 * before relocating the vma range ourself.
++	 * vma->vm_start/vm_end cannot change under us because the caller
++	 * is required to hold the mmap_sem in read mode.  We need the
++	 * page_table_lock lock to serialize against concurrent expand_stacks.
+ 	 */
+ 	address &= PAGE_MASK;
+ 	if (prev_vma && prev_vma->vm_end + (heap_stack_gap << PAGE_SHIFT) > address)
+ 		goto out;
+ 	spin_lock(&vma->vm_mm->page_table_lock);
++	/* already expanded while we were spinning? */
++	if (vma->vm_start <= address) {
++		spin_unlock(&vma->vm_mm->page_table_lock);
++		return 0;
++	}
+ 	grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 	gr_learn_resource(current, RLIMIT_STACK, vma->vm_end - address);
+ 	gr_learn_resource(current, RLIMIT_AS, (vma->vm_mm->total_vm + grow) << PAGE_SHIFT);
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.77666.patch b/sys-kernel/wolk-sources/files/wolk-sources.77666.patch
new file mode 100644
index 000000000000..6b687788f912
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources.77666.patch
@@ -0,0 +1,44 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2005/01/12 09:14:50-02:00 marcelo.tosatti@cyclades.com 
+#   [PATCH] Fix expand_stack() SMP race
+#   
+#   Description: Fix expand_stack() SMP race
+#   
+#   Two threads sharing the same VMA can race in expand_stack, resulting in incorrect VMA
+#   size accounting and possibly a "uncovered-by-VMA" pte leak.
+#   
+#   Fix is to check if the stack has already been expanded after acquiring a lock which
+#   guarantees exclusivity (page_table_lock in v2.4 and vma_anon lock in v2.6).
+# 
+# include/linux/mm.h
+#   2005/01/07 14:51:21-02:00 marcelo.tosatti@cyclades.com +10 -3
+#   Fix expand_stack() SMP race
+# 
+diff -Nru a/include/linux/mm.h b/include/linux/mm.h
+--- a/include/linux/mm.h	2005-01-13 04:59:30 -08:00
++++ b/include/linux/mm.h	2005-01-13 04:59:30 -08:00
+@@ -648,12 +648,19 @@
+ 	unsigned long grow;
+ 
+ 	/*
+-	 * vma->vm_start/vm_end cannot change under us because the caller is required
+-	 * to hold the mmap_sem in write mode. We need to get the spinlock only
+-	 * before relocating the vma range ourself.
++	 * vma->vm_start/vm_end cannot change under us because the caller
++	 * is required to hold the mmap_sem in read mode.  We need the
++	 * page_table_lock lock to serialize against concurrent expand_stacks.
+ 	 */
+ 	address &= PAGE_MASK;
+  	spin_lock(&vma->vm_mm->page_table_lock);
++
++	/* already expanded while we were spinning? */
++	if (vma->vm_start <= address) {
++		spin_unlock(&vma->vm_mm->page_table_lock);
++		return 0;
++	}
++
+ 	grow = (vma->vm_start - address) >> PAGE_SHIFT;
+ 	if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur ||
+ 	    ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur) {
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.78362.patch b/sys-kernel/wolk-sources/files/wolk-sources.78362.patch
new file mode 100644
index 000000000000..3925a0b31ba0
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources.78362.patch
@@ -0,0 +1,241 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/12/08 13:33:08-08:00 davem@nuts.davemloft.net 
+#   [NET]: CMSG compat code needs signedness fixes too.
+#   
+#   Signed-off-by: David S. Miller <davem@davemloft.net>
+# 
+# arch/ia64/ia32/sys_ia32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +6 -4
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# arch/parisc/kernel/sys_parisc32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +6 -5
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# arch/ppc64/kernel/sys_ppc32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +6 -5
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# arch/s390x/kernel/linux32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +6 -5
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# arch/sparc64/kernel/sys_sparc32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +6 -5
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# arch/x86_64/ia32/socket32.c
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +2 -5
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# include/asm-x86_64/socket32.h
+#   2004/12/08 13:32:46-08:00 davem@nuts.davemloft.net +5 -0
+#   [NET]: CMSG compat code needs signedness fixes too.
+# 
+# ChangeSet
+#   2004/12/15 09:25:31-02:00 marcelo@logos.cnet 
+#   [PATCH] Make sure VC resizing fits in s16
+#   
+#   Noted by George Guninski
+# 
+# drivers/char/console.c
+#   2004/12/15 10:58:17-02:00 marcelo@logos.cnet +6 -0
+#   Import patch vc-patch
+# 
+diff -Nru a/arch/ia64/ia32/sys_ia32.c b/arch/ia64/ia32/sys_ia32.c
+--- a/arch/ia64/ia32/sys_ia32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/ia64/ia32/sys_ia32.c	2005-02-15 11:50:28 -08:00
+@@ -1369,6 +1369,11 @@
+ #define __CMSG32_FIRSTHDR(ctl,len) \
+ 	((len) >= sizeof(struct cmsghdr32) ? (struct cmsghdr32 *)(ctl) : (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ static inline struct cmsghdr32 *
+ __cmsg32_nxthdr (void *ctl, __kernel_size_t size, struct cmsghdr32 *cmsg, int cmsg_len)
+@@ -1429,10 +1434,7 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
+-		if (CMSG32_ALIGN(ucmlen) < CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+-			return -EINVAL;
+-		if ((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control) + ucmlen)
+-		    > kmsg->msg_controllen)
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/arch/parisc/kernel/sys_parisc32.c b/arch/parisc/kernel/sys_parisc32.c
+--- a/arch/parisc/kernel/sys_parisc32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/parisc/kernel/sys_parisc32.c	2005-02-15 11:50:28 -08:00
+@@ -1814,6 +1814,11 @@
+ 				    (struct cmsghdr32 *)(ctl) : \
+ 				    (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ __inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
+ 					      struct cmsghdr32 *__cmsg, int __cmsg_len)
+@@ -1940,11 +1945,7 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
+-		if(CMSG32_ALIGN(ucmlen) <
+-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+-			return -EINVAL;
+-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+-				   + ucmlen) > kmsg->msg_controllen)
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/arch/ppc64/kernel/sys_ppc32.c b/arch/ppc64/kernel/sys_ppc32.c
+--- a/arch/ppc64/kernel/sys_ppc32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/ppc64/kernel/sys_ppc32.c	2005-02-15 11:50:28 -08:00
+@@ -3273,6 +3273,11 @@
+ 				    (struct cmsghdr32 *)(ctl) : \
+ 				    (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ struct msghdr32
+ {
+@@ -3448,11 +3453,7 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
+-		if(CMSG32_ALIGN(ucmlen) <
+-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+-			return -EINVAL;
+-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+-				   + ucmlen) > kmsg->msg_controllen)
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/arch/s390x/kernel/linux32.c b/arch/s390x/kernel/linux32.c
+--- a/arch/s390x/kernel/linux32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/s390x/kernel/linux32.c	2005-02-15 11:50:28 -08:00
+@@ -2306,6 +2306,11 @@
+ 				    (struct cmsghdr32 *)(ctl) : \
+ 				    (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ __inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
+ 					      struct cmsghdr32 *__cmsg, int __cmsg_len)
+@@ -2432,11 +2437,7 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
+-		if(CMSG32_ALIGN(ucmlen) <
+-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+-			return -EINVAL;
+-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+-				   + ucmlen) > kmsg->msg_controllen)
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
+--- a/arch/sparc64/kernel/sys_sparc32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/sparc64/kernel/sys_sparc32.c	2005-02-15 11:50:28 -08:00
+@@ -2354,6 +2354,11 @@
+ 				    (struct cmsghdr32 *)(ctl) : \
+ 				    (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ __inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
+ 					      struct cmsghdr32 *__cmsg, int __cmsg_len)
+@@ -2480,11 +2485,7 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
+-		if(CMSG32_ALIGN(ucmlen) <
+-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+-			return -EINVAL;
+-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+-				   + ucmlen) > kmsg->msg_controllen)
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/arch/x86_64/ia32/socket32.c b/arch/x86_64/ia32/socket32.c
+--- a/arch/x86_64/ia32/socket32.c	2005-02-15 11:50:28 -08:00
++++ b/arch/x86_64/ia32/socket32.c	2005-02-15 11:50:28 -08:00
+@@ -134,11 +134,10 @@
+ 			return -EFAULT;
+ 
+ 		/* Catch bogons. */
++		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
+-		if(CMSG32_ALIGN(ucmlen) <
+-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
+ 			return -EINVAL;
++
++		if (kmsg->msg_controllen > 65536)
+-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
+-				   + ucmlen) > kmsg->msg_controllen)
+ 			return -EINVAL;
+ 
+ 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
+diff -Nru a/include/asm-x86_64/socket32.h b/include/asm-x86_64/socket32.h
+--- a/include/asm-x86_64/socket32.h	2005-02-15 11:50:28 -08:00
++++ b/include/asm-x86_64/socket32.h	2005-02-15 11:50:28 -08:00
+@@ -45,6 +45,11 @@
+ 				    (struct cmsghdr32 *)(ctl) : \
+ 				    (struct cmsghdr32 *)NULL)
+ #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
++	((ucmlen) >= sizeof(struct cmsghdr) && \
++	 (ucmlen) <= (unsigned long) \
++	 ((mhdr)->msg_controllen - \
++	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
+ 
+ __inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
+ 					      struct cmsghdr32 *__cmsg, int __cmsg_len)
+diff -Nru a/drivers/char/console.c b/drivers/char/console.c
+--- a/drivers/char/console.c	2005-02-15 11:52:04 -08:00
++++ b/drivers/char/console.c	2005-02-15 11:52:04 -08:00
+@@ -705,6 +705,9 @@
+ 	return 0;
+ }
+ 
++#define VC_RESIZE_MAXCOL (32767)
++#define VC_RESIZE_MAXROW (32767)
++
+ /*
+  * Change # of rows and columns (0 means unchanged/the size of fg_console)
+  * [this is to be used together with some user program
+@@ -716,6 +719,9 @@
+ 	unsigned int cc, ll, ss, sr, todo = 0;
+ 	unsigned int currcons = fg_console, i;
+ 	unsigned short *newscreens[MAX_NR_CONSOLES];
++
++	if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW)
++		return -EINVAL;
+ 
+ 	cc = (cols ? cols : video_num_columns);
+ 	ll = (lines ? lines : video_num_lines);
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.78363.patch b/sys-kernel/wolk-sources/files/wolk-sources.78363.patch
new file mode 100644
index 000000000000..852807ddc96f
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources.78363.patch
@@ -0,0 +1,29 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/12/08 12:39:15-08:00 davem@nuts.davemloft.net 
+#   [IPV4]: Do not leak IP options.
+#   
+#   If the user makes ip_cmsg_send call ip_options_get
+#   multiple times, we leak kmalloced IP options data.
+#   
+#   Noticed by Georgi Guninski.
+#   
+#   Signed-off-by: David S. Miller <davem@davemloft.net>
+# 
+# net/ipv4/ip_options.c
+#   2004/12/08 12:38:09-08:00 davem@nuts.davemloft.net +2 -0
+#   [IPV4]: Do not leak IP options.
+# 
+diff -Nru a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+--- a/net/ipv4/ip_options.c	2005-02-15 11:47:16 -08:00
++++ b/net/ipv4/ip_options.c	2005-02-15 11:47:16 -08:00
+@@ -515,6 +515,8 @@
+ 		kfree(opt);
+ 		return -EINVAL;
+ 	}
++	if (*optp)
++		kfree(*optp);
+ 	*optp = opt;
+ 	return 0;
+ }
diff --git a/sys-kernel/wolk-sources/files/wolk-sources.81106.patch b/sys-kernel/wolk-sources/files/wolk-sources.81106.patch
new file mode 100644
index 000000000000..2cc0ab84ebb8
--- /dev/null
+++ b/sys-kernel/wolk-sources/files/wolk-sources.81106.patch
@@ -0,0 +1,83 @@
+# ChangeSet
+#   2005/01/25 10:10:51+00:00 aia21@cantab.net 
+#   NTFS: Add printk rate limiting for ntfs_warning() and ntfs_error() when
+#         compiled without debug.  This avoids a possible denial of service
+#         attack.  Thanks to Carl-Daniel Hailfinger from SuSE for pointing this
+#         out.
+# 
+# <plasmaroo>: printk_ratelimit() backported from 2.6.
+#
+diff -Nru a/fs/ntfs/debug.c b/fs/ntfs/debug.c
+--- a/fs/ntfs/debug.c	2005-02-15 12:38:26 -08:00
++++ b/fs/ntfs/debug.c	2005-02-15 12:38:26 -08:00
+@@ -25,6 +25,48 @@
+ #endif
+ 
+ #include "debug.h"
++#include <linux/sched.h>
++
++/* minimum time in jiffies between messages */
++int printk_ratelimit_jiffies = 5*HZ;
++
++/* number of messages we send before ratelimiting */
++int printk_ratelimit_burst = 10;
++
++/*
++ * printk rate limiting, lifted from the networking subsystem.
++ *
++ * This enforces a rate limit: not more than one kernel message
++ * every printk_ratelimit_jiffies to make a denial-of-service
++ * attack impossible.
++ */
++int printk_ratelimit(void)
++{
++	static spinlock_t ratelimit_lock = SPIN_LOCK_UNLOCKED;
++	static unsigned long toks = 10*5*HZ;
++	static unsigned long last_msg;
++	static int missed;
++	unsigned long flags;
++	unsigned long now = jiffies;
++
++	spin_lock_irqsave(&ratelimit_lock, flags);
++	toks += now - last_msg;
++	last_msg = now;
++	if (toks > (printk_ratelimit_burst * printk_ratelimit_jiffies))
++		toks = printk_ratelimit_burst * printk_ratelimit_jiffies;
++	if (toks >= printk_ratelimit_jiffies) {
++		int lost = missed;
++		missed = 0;
++		toks -= printk_ratelimit_jiffies;
++		spin_unlock_irqrestore(&ratelimit_lock, flags);
++		if (lost)
++			printk(KERN_WARNING "printk: %d messages suppressed.\n", lost);
++		return 1;
++	}
++	missed++;
++	spin_unlock_irqrestore(&ratelimit_lock, flags);
++	return 0;
++}
+ 
+ /*
+  * A static buffer to hold the error string being displayed and a spinlock
+@@ -53,6 +53,10 @@
+ 	va_list args;
+ 	int flen = 0;
+ 
++#ifndef DEBUG
++	if (!printk_ratelimit())
++		return;
++#endif
+ 	if (function)
+ 		flen = strlen(function);
+ 	spin_lock(&err_buf_lock);
+@@ -93,6 +97,10 @@
+ 	va_list args;
+ 	int flen = 0;
+ 
++#ifndef DEBUG
++	if (!printk_ratelimit())
++		return;
++#endif
+ 	if (function)
+ 		flen = strlen(function);
+ 	spin_lock(&err_buf_lock);
diff --git a/sys-kernel/wolk-sources/wolk-sources-4.11-r16.ebuild b/sys-kernel/wolk-sources/wolk-sources-4.11-r17.ebuild
index cedb1c5227db..ea27f5bf9604 100644
--- a/sys-kernel/wolk-sources/wolk-sources-4.11-r16.ebuild
+++ b/sys-kernel/wolk-sources/wolk-sources-4.11-r17.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.11-r16.ebuild,v 1.1 2005/01/09 16:21:03 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.11-r17.ebuild,v 1.1 2005/03/26 18:41:50 plasmaroo Exp $
 
 # OKV=original kernel version, KV=patched kernel version.  They can be the same.
 
@@ -60,6 +60,10 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}.CAN-2004-1056.patch || die "Failed to apply the CAN-2004-1056 patch!"
 	epatch ${FILESDIR}/${PN}.brk-locked.patch || die "Failed to apply the do_brk() locking patch!"
 	epatch ${FILESDIR}/${PN}.77094.patch || die "Failed to apply bug #77094 patch!"
+	epatch ${FILESDIR}/${PN}.77666.patch || die "Failed to apply bug #77666 patch!"
+	epatch ${FILESDIR}/${PN}.78362.patch || die "Failed to apply bug #78362 patch!"
+	epatch ${FILESDIR}/${PN}.78363.patch || die "Failed to apply bug #78363 patch!"
+	epatch ${FILESDIR}/${PN}.81106.patch || die "Failed to apply bug #81106 patch!"
 
 	kernel_universal_unpack
 }
diff --git a/sys-kernel/wolk-sources/wolk-sources-4.14-r13.ebuild b/sys-kernel/wolk-sources/wolk-sources-4.14-r14.ebuild
index e25c66e3154b..23428309d877 100644
--- a/sys-kernel/wolk-sources/wolk-sources-4.14-r13.ebuild
+++ b/sys-kernel/wolk-sources/wolk-sources-4.14-r14.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.14-r13.ebuild,v 1.1 2005/01/09 16:21:03 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.14-r14.ebuild,v 1.1 2005/03/26 18:41:50 plasmaroo Exp $
 
 OKV="2.4.20"
 OKB="2.4"
@@ -48,7 +48,11 @@ UNIPATCH_LIST="
 	${FILESDIR}/${PN}.CAN-2004-1016.patch
 	${FILESDIR}/${PN}.CAN-2004-1056.patch
 	${FILESDIR}/${PN}.brk-locked.patch
-	${FILESDIR}/${PN}.77094.patch"
+	${FILESDIR}/${PN}.77094.patch
+	${FILESDIR}/${PN}.77666.patch
+	${FILESDIR}/${PN}.78362.patch
+	${FILESDIR}/${PN}.78363.patch
+	${FILESDIR}/${PN}.81106.patch"
 
 #============================================================================
 # We'll override the src_unpack() function from the eclass. This is necessary
diff --git a/sys-kernel/wolk-sources/wolk-sources-4.9-r20.ebuild b/sys-kernel/wolk-sources/wolk-sources-4.9-r21.ebuild
index 25067e886f40..f15e7d9d6ce2 100644
--- a/sys-kernel/wolk-sources/wolk-sources-4.9-r20.ebuild
+++ b/sys-kernel/wolk-sources/wolk-sources-4.9-r21.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.9-r20.ebuild,v 1.1 2005/01/09 16:21:03 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/wolk-sources/wolk-sources-4.9-r21.ebuild,v 1.1 2005/03/26 18:41:50 plasmaroo Exp $
 
 # OKV=original kernel version, KV=patched kernel version.  They can be the same.
 
@@ -105,6 +105,10 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}-4.9s.CAN-2004-1056.patch || die "Failed to apply the CAN-2004-1056 patch!"
 	epatch ${FILESDIR}/${PN}-4.9s.brk-locked.patch || die "Failed to apply the do_brk() locking patch!"
 	epatch ${FILESDIR}/${PN}.77094.patch || die "Failed to apply bug #77094 patch!"
+	epatch ${FILESDIR}/${PN}-4.9s.77666.patch || die "Failed to apply bug #77666 patch!"
+	epatch ${FILESDIR}/${PN}.78362.patch || die "Failed to apply bug #78362 patch!"
+	epatch ${FILESDIR}/${PN}.78363.patch || die "Failed to apply bug #78363 patch!"
+	epatch ${FILESDIR}/${PN}.81106.patch || die "Failed to apply bug #81106 patch!"
 
 	kernel_universal_unpack
 }