Adding a fix for the 2.4 kNFSd security vulnerability and the 2.6 /dev/ptmx DoS, bug #62524. Also fixed CAN-2004-0814 for 2.4 and 2.6, bug #68421.

11 files changed, 105 insertions, 93 deletions

diff --git a/sys-kernel/usermode-sources/ChangeLog b/sys-kernel/usermode-sources/ChangeLog
index 8817de59647f..467c0893f461 100644
--- a/sys-kernel/usermode-sources/ChangeLog
+++ b/sys-kernel/usermode-sources/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for sys-kernel/usermode-sources
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/ChangeLog,v 1.48 2004/10/21 18:15:54 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/ChangeLog,v 1.49 2004/11/09 20:14:23 plasmaroo Exp $
+
+*usermode-sources-2.6.8.1-r2 (09 Nov 2004)
+
+  09 Nov 2004; <plasmaroo@gentoo.org> -usermode-sources-2.4.24-r9.ebuild,
+  -usermode-sources-2.4.26-r6.ebuild, +usermode-sources-2.4.26-r7.ebuild,
+  -usermode-sources-2.6.8.1-r1.ebuild, +usermode-sources-2.6.8.1-r2.ebuild,
+  +files/usermode-sources-2.4.XDRWrapFix.patch,
+  +files/usermode-sources-2.6.devPtmx.patch:
+  Adding a fix for the 2.4 kNFSd security vulnerability and the 2.6 /dev/ptmx
+  DoS, bug #62524. Also fixed CAN-2004-0814 for 2.4 and 2.6, bug #68421.
 
 *usermode-sources-2.6.8.1-r1 (21 Oct 2004)
 
diff --git a/sys-kernel/usermode-sources/Manifest b/sys-kernel/usermode-sources/Manifest
index b40603cbdddf..bcb77c3bf07c 100644
--- a/sys-kernel/usermode-sources/Manifest
+++ b/sys-kernel/usermode-sources/Manifest
@@ -1,24 +1,24 @@
-MD5 5edfc8df170621d2706c29d3d3f9f354 ChangeLog 12509
+MD5 e0567ce81e48c3b62f4c14c9a1f8827f ChangeLog 13022
 MD5 a76f13cb946fc2720c04b189616da2de metadata.xml 159
-MD5 819957c1ddd86152e539b91dc7ad438a usermode-sources-2.6.8.1-r1.ebuild 843
-MD5 7a710225b7d53d08c4dca7162362b938 usermode-sources-2.4.26-r6.ebuild 2364
-MD5 b4107555322557e7b03f23f2ed852bf5 usermode-sources-2.4.24-r9.ebuild 3092
+MD5 603cfcd7cd36e605261c46533cbee4b5 usermode-sources-2.6.8.1-r2.ebuild 1021
+MD5 50d34e508fda7242cbc6a92356a4f59e usermode-sources-2.4.26-r7.ebuild 2636
 MD5 d1ccc2047be533c992f67270a150a210 files/usermode-sources-2.4.cmdlineLeak.patch 388
 MD5 9c816c892d6e3d3f0b7b77d3d503ab10 files/usermode-sources-2.4.24.CAN-2004-0075.patch 634
 MD5 174438d215b70cad5ffb00ca8123c062 files/usermode-sources-2.4.24.munmap.patch 837
+MD5 5748125eb42554148c90a042a7454065 files/digest-usermode-sources-2.6.8.1-r2 214
 MD5 c460ea130cb4ae84a5063ba044e3ce72 files/usermode-sources-2.4.24.CAN-2004-0427.patch 460
 MD5 147fec50180ad91b6260fc7201dcb90f files/usermode-sources-2.4.24.CAN-2004-0010.patch 6050
 MD5 dc18e982f8149588a291956481885a8c files/usermode-sources-2.4.CAN-2004-0495.patch 17549
-MD5 9a62b569225a94c0fdfa491097a1da4f files/digest-usermode-sources-2.6.8.1-r1 136
+MD5 054d55975dd07c5a434e0ccfcf26f682 files/digest-usermode-sources-2.4.26-r7 297
 MD5 de75cfa969ed092578d9ddda6c5be334 files/usermode-sources-2.4.24.CAN-2004-0181.patch 1233
 MD5 ac42024b6e6ee1e2165914db4b22a61c files/usermode-sources-2.4.24.CAN-2004-0178.patch 424
 MD5 d4a740ae56c2049247083af387a22a85 files/usermode-sources-2.4.26.CAN-2004-0394.patch 350
 MD5 60d25ff310fc6abfdce39ec9e47345af files/usermode-sources-2.4.CAN-2004-0685.patch 2809
 MD5 0f66013f643c79c97fda489618a4e2fd files/usermode-sources-2.4.CAN-2004-0535.patch 476
-MD5 2cb392a6f9f8724f6a40b85afac9d47f files/digest-usermode-sources-2.4.24-r9 210
 MD5 c2510fe1891f5a9effb12c2196922206 files/usermode-sources-2.6.cmdlineLeak.patch 281
 MD5 95708646470a95668e8789cd415844ed files/usermode-sources.CAN-2004-0497.patch 846
-MD5 23a31ff55169c3f9a2c391af8cb91cd9 files/digest-usermode-sources-2.4.26-r6 210
+MD5 452e04a312368605e145428c35bd0e05 files/usermode-sources-2.6.devPtmx.patch 572
+MD5 2b3ddb8b8b15f8da35ade38544b57857 files/usermode-sources-2.4.XDRWrapFix.patch 1499
 MD5 c9da1bc82b906f6abc648c056e7bf662 files/usermode-sources-2.4.FPULockup-53804.patch 354
 MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/usermode-sources-2.4.24.CAN-2004-0177.patch 384
 MD5 21f3a4f186017d925067335e24db36a1 files/usermode-sources-2.4.24.CAN-2004-0109.patch 1877
diff --git a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.24-r9 b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.24-r9
deleted file mode 100644
index ed8d13ee3405..000000000000
--- a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.24-r9
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 1e055c42921b2396a559d84df4c3d9aa linux-2.4.24.tar.bz2 29837818
-MD5 fd184531d88bea49f2ece7d68b4a997a uml-patch-2.4.24-1.bz2 189230
-MD5 7e0e9f3d57bcc1b1bb7900ada383c129 linux-2.4.23-CAN-2004-0415.patch 89319
diff --git a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r6 b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r6
deleted file mode 100644
index d4d898ba4b14..000000000000
--- a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r6
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 88d7aefa03c92739cb70298a0b486e2c linux-2.4.26.tar.bz2 30772389
-MD5 e4fbac714d28cd9bcc877dfcfd5bfe57 uml-patch-2.4.26-1.bz2 204818
-MD5 8f8f2412aacf9a01b5549bf2a9a3bff8 linux-2.4.26-CAN-2004-0415.patch 90145
diff --git a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r7 b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r7
new file mode 100644
index 000000000000..9e29fc732ec2
--- /dev/null
+++ b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.4.26-r7
@@ -0,0 +1,4 @@
+MD5 88d7aefa03c92739cb70298a0b486e2c linux-2.4.26.tar.bz2 30772389
+MD5 3fb146ded9e33819b815f5d233b891c2 uml-patch-2.4.26-3.bz2 206477
+MD5 8f8f2412aacf9a01b5549bf2a9a3bff8 linux-2.4.26-CAN-2004-0415.patch 90145
+MD5 ad331c801d0a51a55f6f16046f2b15f8 usermode-sources-2.4.26-CAN-2004-0814.patch 81511
diff --git a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.6.8.1-r1 b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.6.8.1-r2
index 0f69749aa81f..39318607e58d 100644
--- a/sys-kernel/usermode-sources/files/digest-usermode-sources-2.6.8.1-r1
+++ b/sys-kernel/usermode-sources/files/digest-usermode-sources-2.6.8.1-r2
@@ -1,2 +1,3 @@
 MD5 9517ca999e822b898fbdc7e72796b1aa linux-2.6.8.1.tar.bz2 35628066
 MD5 71cbf81acbd2a4229024a5cf2f9a7119 uml-patch-2.6.8.1-1.bz2 142306
+MD5 154a348c46bdd0a33b20d3bbfb5e2a3b linux-2.6.8.1-CAN-2004-0814.patch 131240
diff --git a/sys-kernel/usermode-sources/files/usermode-sources-2.4.XDRWrapFix.patch b/sys-kernel/usermode-sources/files/usermode-sources-2.4.XDRWrapFix.patch
new file mode 100644
index 000000000000..9a336ab7876a
--- /dev/null
+++ b/sys-kernel/usermode-sources/files/usermode-sources-2.4.XDRWrapFix.patch
@@ -0,0 +1,48 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au 
+#   [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
+#   
+#   xdr_argsize_check needs to cope with the possibility that the
+#   pointer has wrapped and could be below buf->base.
+#   
+#   Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
+#   
+#   ### Diffstat output
+#    ./fs/nfsd/nfs3xdr.c         |    2 +-
+#    ./include/linux/nfsd/xdr3.h |    2 +-
+#    2 files changed, 2 insertions(+), 2 deletions(-)
+# 
+# fs/nfsd/nfs3xdr.c
+#   2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+# include/linux/nfsd/xdr3.h
+#   2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+--- a/fs/nfsd/nfs3xdr.c	2004-09-06 11:20:28 -07:00
++++ b/fs/nfsd/nfs3xdr.c	2004-09-06 11:20:28 -07:00
+@@ -273,7 +273,7 @@
+ {
+ 	struct svc_buf	*buf = &rqstp->rq_argbuf;
+ 
+-	return p - buf->base <= buf->buflen;
++	return p >= buf->base && p <= buf->base + buf->buflen ;
+ }
+ 
+ static inline int
+diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
+--- a/include/linux/nfsd/xdr3.h	2004-09-06 11:20:28 -07:00
++++ b/include/linux/nfsd/xdr3.h	2004-09-06 11:20:28 -07:00
+@@ -41,7 +41,7 @@
+ 	__u32			count;
+ 	int			stable;
+ 	__u8 *			data;
+-	int			len;
++	__u32			len;
+ };
+ 
+ struct nfsd3_createargs {
diff --git a/sys-kernel/usermode-sources/files/usermode-sources-2.6.devPtmx.patch b/sys-kernel/usermode-sources/files/usermode-sources-2.6.devPtmx.patch
new file mode 100644
index 000000000000..2312a2bf5e3b
--- /dev/null
+++ b/sys-kernel/usermode-sources/files/usermode-sources-2.6.devPtmx.patch
@@ -0,0 +1,21 @@
+Index: linux-2.6.5/fs/devpts/inode.c
+===================================================================
+--- linux-2.6.5.orig/fs/devpts/inode.c
++++ linux-2.6.5/fs/devpts/inode.c
+@@ -178,9 +178,13 @@ struct tty_struct *devpts_get_tty(int nu
+ {
+ 	struct dentry *dentry = get_node(number);
+ 	struct tty_struct *tty;
+-
+-	tty = (IS_ERR(dentry) || !dentry->d_inode) ? NULL :
+-			dentry->d_inode->u.generic_ip;
++	
++	tty = NULL;
++	if (!IS_ERR(dentry)) {
++		if (dentry->d_inode)
++			tty = dentry->d_inode->u.generic_ip;
++		dput(dentry);
++	}
+ 
+ 	up(&devpts_root->d_inode->i_sem);
+ 
diff --git a/sys-kernel/usermode-sources/usermode-sources-2.4.24-r9.ebuild b/sys-kernel/usermode-sources/usermode-sources-2.4.24-r9.ebuild
deleted file mode 100644
index f7b60ebaecef..000000000000
--- a/sys-kernel/usermode-sources/usermode-sources-2.4.24-r9.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2004 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.4.24-r9.ebuild,v 1.1 2004/08/10 00:38:11 plasmaroo Exp $
-
-ETYPE="sources"
-inherit kernel eutils
-
-UML_PATCH="uml-patch-2.4.24-1"
-
-DESCRIPTION="Full (vanilla) sources for the User Mode Linux kernel"
-SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${PV}.tar.bz2
-	mirror://sourceforge/user-mode-linux/${UML_PATCH}.bz2
-	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-2.4.23-CAN-2004-0415.patch"
-HOMEPAGE="http://www.kernel.org/ http://user-mode-linux.sourceforge.net"
-LICENSE="GPL-2"
-SLOT="${PV}-${PR}"
-KEYWORDS="x86 -ppc"
-IUSE=""
-EXTRAVERSION="-uml1-${PR}"
-RESTRICT="nomirror"
-
-# console-tools is needed to solve the loadkeys fiasco.
-# binutils version needed to avoid Athlon/PIII/SSE assembler bugs.
-DEPEND=">=sys-devel/binutils-2.11.90.0.31 dev-lang/perl"
-RDEPEND=">=sys-libs/ncurses-5.2"
-
-S=${WORKDIR}/linux-${PV}${EXTRAVERSION}
-
-src_unpack() {
-	cd ${WORKDIR}
-	unpack linux-${PV}.tar.bz2
-
-	mv linux-${PV} ${S} && cd ${S}
-	epatch ${DISTDIR}/${UML_PATCH}.bz2
-	epatch ${FILESDIR}/${P}.munmap.patch || die "Failed to apply munmap patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0010.patch || die "Failed to add the CAN-2004-0010 patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0075.patch || die "Failed to add the CAN-2004-0075 patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0109.patch || die "Failed to patch CAN-2004-0109 vulnerability!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0177.patch || die "Failed to add the CAN-2004-0177 patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0178.patch || die "Failed to add the CAN-2004-0178 patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!"
-	epatch ${FILESDIR}/${PN}-2.4.26.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!"
-	epatch ${DISTDIR}/linux-2.4.23-CAN-2004-0415.patch || die "Failed to add the CAN-2004-0415 patch!"
-	epatch ${FILESDIR}/${P}.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!"
-	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch || die "Failed to add the CAN-2004-0495 patch!"
-	epatch ${FILESDIR}/${PN}.CAN-2004-0497.patch || die "Failed to add the CAN-2004-0497 patch!"
-	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!"
-	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!"
-	epatch ${FILESDIR}/${PN}-2.4.FPULockup-53804.patch || die "Failed to apply FPU-lockup patch!"
-	epatch ${FILESDIR}/${PN}-2.4.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
-	kernel_universal_unpack
-}
-
-src_install() {
-	mkdir -p ${D}/usr/src/uml
-
-	# Fix permissions
-	cd ${WORKDIR}
-	chown -R root:root *
-	chmod -R a+r-w+X,u+w *
-
-	mv linux-${PV}${EXTRAVERSION} ${D}/usr/src/uml/
-}
-
-pkg_postinst() {
-	# Create linux symlink
-	if [ ! -e ${ROOT}usr/src/uml/linux ]
-	then
-		rm -f ${ROOT}usr/src/uml/linux
-		ln -sf ${ROOT}usr/src/uml/linux-${PV}${EXTRAVERSION} ${ROOT}usr/src/uml/linux
-	fi
-}
diff --git a/sys-kernel/usermode-sources/usermode-sources-2.4.26-r6.ebuild b/sys-kernel/usermode-sources/usermode-sources-2.4.26-r7.ebuild
index eb491dd36ddb..379247e9874a 100644
--- a/sys-kernel/usermode-sources/usermode-sources-2.4.26-r6.ebuild
+++ b/sys-kernel/usermode-sources/usermode-sources-2.4.26-r7.ebuild
@@ -1,21 +1,22 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.4.26-r6.ebuild,v 1.1 2004/08/10 00:38:11 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.4.26-r7.ebuild,v 1.1 2004/11/09 20:14:23 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel eutils
 
 OKV='2.4.26'
-UML_PATCH='uml-patch-2.4.26-1'
+UML_PATCH='uml-patch-2.4.26-3'
 
 DESCRIPTION="Full (vanilla) sources for the User Mode Linux kernel"
 SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${PV}.tar.bz2
 	mirror://sourceforge/user-mode-linux/${UML_PATCH}.bz2
-	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch"
+	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0415.patch
+	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${P}-CAN-2004-0814.patch"
 HOMEPAGE="http://www.kernel.org/ http://user-mode-linux.sourceforge.net"
 LICENSE="GPL-2"
 SLOT="${PV}-${PR}"
-KEYWORDS="~x86 -ppc"
+KEYWORDS="x86 -ppc"
 IUSE=""
 EXTRAVERSION="-uml1-${PR}"
 RESTRICT="nomirror"
@@ -39,8 +40,10 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}.CAN-2004-0497.patch || die "Failed to add the CAN-2004-0497 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0685.patch || die "Failed to add the CAN-2004-0685 patch!"
+	epatch ${DISTDIR}/${P}-CAN-2004-0814.patch || die "Failed to add the CAN-2004-0814 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.FPULockup-53804.patch || die "Failed to apply FPU-lockup patch!"
 	epatch ${FILESDIR}/${PN}-2.4.cmdlineLeak.patch || die "Failed to apply the /proc/cmdline patch!"
+	epatch ${FILESDIR}/${PN}-2.4.XDRWrapFix.patch || die "Failed to apply the kNFSd XDR patch!"
 	kernel_universal_unpack
 }
 
diff --git a/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r1.ebuild b/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r2.ebuild
index 4fe404a1db1e..0468a3b015f5 100644
--- a/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r1.ebuild
+++ b/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r1.ebuild,v 1.1 2004/10/21 18:15:54 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/usermode-sources/usermode-sources-2.6.8.1-r2.ebuild,v 1.1 2004/11/09 20:14:23 plasmaroo Exp $
 
 K_NOUSENAME="yes"
 ETYPE="sources"
@@ -14,11 +14,14 @@ S="${WORKDIR}/linux-${KV}"
 IUSE=""
 
 UNIPATCH_LIST="${DISTDIR}/${UML_PATCH}.bz2
-	${FILESDIR}/${PN}-2.6.cmdlineLeak.patch"
+	${DISTDIR}/linux-${OKV}-CAN-2004-0814.patch
+	${FILESDIR}/${PN}-2.6.cmdlineLeak.patch
+	${FILESDIR}/${PN}-2.6.devPtmx.patch"
 
 DESCRIPTION="Full (vanilla) sources for the User Mode Linux kernel"
 SRC_URI="mirror://kernel/linux/kernel/v2.6/linux-${PV}.tar.bz2
-	mirror://sourceforge/user-mode-linux/${UML_PATCH}.bz2"
+	mirror://sourceforge/user-mode-linux/${UML_PATCH}.bz2
+	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0814.patch"
 HOMEPAGE="http://www.kernel.org/ http://user-mode-linux.sourceforge.net"
 SLOT="${KV}"
 KEYWORDS="~x86"