Fix for the kNFSd security vulnerability, bug #62524 and the CAN-2004-0814 vulnerability, bug #68421.

3 files changed, 49 insertions, 115 deletions

diff --git a/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch b/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch
deleted file mode 100644
index 00937f83623f..000000000000
--- a/sys-kernel/alpha-sources/files/alpha-sources-2.4.19.rtc_fix.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-diff -ur linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c
---- linux-2.4.20-wolk4.9s/arch/cris/drivers/ds1302.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/cris/drivers/ds1302.c	2004-01-05 23:41:44.000000000 +0000
-@@ -315,6 +315,7 @@
- 		{
- 			struct rtc_time rtc_tm;
- 						
-+			memset(&rtc_tm, 0, sizeof (struct rtc_time));
- 			get_rtc_time(&rtc_tm);						
- 			if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
- 				return -EFAULT;	
-diff -ur linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c
---- linux-2.4.20-wolk4.9s/arch/m68k/bvme6000/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/bvme6000/rtc.c	2004-01-05 23:43:15.000000000 +0000
-@@ -54,6 +54,7 @@
- 		/* Ensure clock and real-time-mode-register are accessible */
- 		msr = rtc->msr & 0xc0;
- 		rtc->msr = 0x40;
-+		memset(&wtime, 0, sizeof (struct rtc_time));
- 		do {
- 			wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
- 			wtime.tm_min =  BCD2BIN(rtc->bcd_min);
-diff -ur linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c
---- linux-2.4.20-wolk4.9s/arch/m68k/mvme16x/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/m68k/mvme16x/rtc.c	2004-01-05 23:44:02.000000000 +0000
-@@ -52,6 +52,7 @@
- 		cli();
- 		/* Ensure clock and real-time-mode-register are accessible */
- 		rtc->ctrl = RTC_READ;
-+		memset(&wtime, 0, sizeof (struct rtc_time));
- 		wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
- 		wtime.tm_min =  BCD2BIN(rtc->bcd_min);
- 		wtime.tm_hour = BCD2BIN(rtc->bcd_hr);
-diff -ur linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c
---- linux-2.4.20-wolk4.9s/arch/ppc64/kernel/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/arch/ppc64/kernel/rtc.c	2004-01-05 23:44:34.000000000 +0000
-@@ -96,6 +96,7 @@
- 	switch (cmd) {
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ppc_md.get_rtc_time(&wtime);
- 		break;
- 	}
-diff -ur linux-2.4.20-wolk4.9s/drivers/char/efirtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c
---- linux-2.4.20-wolk4.9s/drivers/char/efirtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/efirtc.c	2004-01-05 23:47:53.000000000 +0000
-@@ -118,6 +118,7 @@
- static void
- convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
- {
-+	memset(wtime, 0, sizeof(struct rtc_time));
- 	wtime->tm_sec  = eft->second;
- 	wtime->tm_min  = eft->minute;
- 	wtime->tm_hour = eft->hour;
-diff -ur linux-2.4.20-wolk4.9s/drivers/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/char/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/char/rtc.c	2004-01-05 23:52:43.000000000 +0000
-@@ -370,6 +370,7 @@
- 		 * tm_min, and tm_sec values are filled in.
- 		 */
- 
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		get_rtc_alm_time(&wtime);
- 		break; 
- 	}
-@@ -417,6 +418,7 @@
- 	}
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&wtime);
- 		break;
- 	}
-diff -ur linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/macintosh/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/macintosh/rtc.c	2004-01-05 23:54:15.000000000 +0000
-@@ -64,6 +64,7 @@
- 	case RTC_RD_TIME:
- 		if (ppc_md.get_rtc_time)
- 		{
-+			memset(&rtc_tm, 0, sizeof(struct rtc_time));
- 			get_rtc_time(&rtc_tm);
- 
- 			if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -ur linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c
---- linux-2.4.20-wolk4.9s/drivers/sbus/char/rtc.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sbus/char/rtc.c	2004-01-05 23:54:43.000000000 +0000
-@@ -89,6 +89,7 @@
- 	switch (cmd)
- 	{
- 	case RTCGET:
-+		memset(&rtc_tm, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&rtc_tm);
- 
- 		if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -ur linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c
---- linux-2.4.20-wolk4.9s/drivers/sgi/char/ds1286.c	2004-01-05 23:33:45.000000000 +0000
-+++ linux-2.4.20-wolk4.9s.plasmaroo/drivers/sgi/char/ds1286.c	2004-01-05 23:47:25.000000000 +0000
-@@ -174,6 +174,7 @@
- 		 * tm_min, and tm_sec values are filled in.
- 		 */
- 
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ds1286_get_alm_time(&wtime);
- 		break;
- 	}
-@@ -216,6 +217,7 @@
- 	}
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ds1286_get_time(&wtime);
- 		break;
- 	}
diff --git a/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch b/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch
new file mode 100644
index 000000000000..9a336ab7876a
--- /dev/null
+++ b/sys-kernel/alpha-sources/files/alpha-sources.XDRWrapFix.patch
@@ -0,0 +1,48 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/08/16 14:50:04-03:00 neilb@cse.unsw.edu.au 
+#   [PATCH] Fixed possibly xdr parsing error if write size exceed 2^31
+#   
+#   xdr_argsize_check needs to cope with the possibility that the
+#   pointer has wrapped and could be below buf->base.
+#   
+#   Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
+#   
+#   ### Diffstat output
+#    ./fs/nfsd/nfs3xdr.c         |    2 +-
+#    ./include/linux/nfsd/xdr3.h |    2 +-
+#    2 files changed, 2 insertions(+), 2 deletions(-)
+# 
+# fs/nfsd/nfs3xdr.c
+#   2004/08/14 00:23:06-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+# include/linux/nfsd/xdr3.h
+#   2004/08/15 20:48:43-03:00 neilb@cse.unsw.edu.au +1 -1
+#   Fixed possibly xdr parsing error if write size exceed 2^31
+# 
+diff -Nru a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
+--- a/fs/nfsd/nfs3xdr.c	2004-09-06 11:20:28 -07:00
++++ b/fs/nfsd/nfs3xdr.c	2004-09-06 11:20:28 -07:00
+@@ -273,7 +273,7 @@
+ {
+ 	struct svc_buf	*buf = &rqstp->rq_argbuf;
+ 
+-	return p - buf->base <= buf->buflen;
++	return p >= buf->base && p <= buf->base + buf->buflen ;
+ }
+ 
+ static inline int
+diff -Nru a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
+--- a/include/linux/nfsd/xdr3.h	2004-09-06 11:20:28 -07:00
++++ b/include/linux/nfsd/xdr3.h	2004-09-06 11:20:28 -07:00
+@@ -41,7 +41,7 @@
+ 	__u32			count;
+ 	int			stable;
+ 	__u8 *			data;
+-	int			len;
++	__u32			len;
+ };
+ 
+ struct nfsd3_createargs {
diff --git a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12 b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13
index 363cacc1766b..73826cbb1001 100644
--- a/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r12
+++ b/sys-kernel/alpha-sources/files/digest-alpha-sources-2.4.21-r13
@@ -1,3 +1,4 @@
 MD5 f51e12efa18bb828cf57d9d4a81b2fb1 linux-2.4.21.tar.bz2 28533733
 MD5 28094d6a3d68f228bda98af459ad1310 patches-2.4.21-alpha-r3.tar.bz2 1696825
 MD5 b48375b2731b9a99bb3697e90f170ff2 linux-2.4.21-CAN-2004-0415.patch 84284
+MD5 791ba31912926858cdf02413d87fbd6b alpha-sources-2.4.21-CAN-2004-0814.patch 81981