Security bumps for the CAN-2004-0495 and CAN-2004-0535 vulnerabilities. Also closes bug #53983.

15 files changed, 900 insertions, 14 deletions

diff --git a/sys-kernel/gentoo-sources/ChangeLog b/sys-kernel/gentoo-sources/ChangeLog
index 7ed5ff0af032..38bce463e8f4 100644
--- a/sys-kernel/gentoo-sources/ChangeLog
+++ b/sys-kernel/gentoo-sources/ChangeLog
@@ -1,6 +1,17 @@
 # ChangeLog for sys-kernel/gentoo-sources
 # Copyright 2002-2004 Gentoo Technologies, Inc.; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/ChangeLog,v 1.73 2004/06/23 23:14:25 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/ChangeLog,v 1.74 2004/06/24 15:29:37 plasmaroo Exp $
+
+*gentoo-sources-2.4.26-r3 (24 Jun 2004)
+
+  24 Jun 2004; <plasmaroo@gentoo.org> +gentoo-sources-2.4.19-r17.ebuild,
+  +gentoo-sources-2.4.20-r20.ebuild, +gentoo-sources-2.4.22-r12.ebuild,
+  +gentoo-sources-2.4.25-r5.ebuild, +gentoo-sources-2.4.26-r3.ebuild,
+  +files/gentoo-sources-2.4.19-gcc33.patch,
+  +files/gentoo-sources-2.4.CAN-2004-0495.patch,
+  +files/gentoo-sources-2.4.CAN-2004-0535.patch:
+  Security bumps for the CAN-2004-0495 and CAN-2004-0535 vulnerabilities. Also
+  closes bug #53983. Old versions removed.
 
   23 Jun 2004; Aron Griffis <agriffis@gentoo.org>
   gentoo-sources-2.4.19-r16.ebuild, gentoo-sources-2.4.20-r19.ebuild:
diff --git a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.19-r16 b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.19-r17
index 19d991259834..19d991259834 100644
--- a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.19-r16
+++ b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.19-r17
diff --git a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.20-r19 b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.20-r20
index 0d9abd01d13b..0d9abd01d13b 100644
--- a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.20-r19
+++ b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.20-r20
diff --git a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.22-r11 b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.22-r12
index a564b8210a40..a564b8210a40 100644
--- a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.22-r11
+++ b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.22-r12
diff --git a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.25-r4 b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.25-r5
index b1beb984fb40..b1beb984fb40 100644
--- a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.25-r4
+++ b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.25-r5
diff --git a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.26-r2 b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.26-r3
index 7e8d028df131..7e8d028df131 100644
--- a/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.26-r2
+++ b/sys-kernel/gentoo-sources/files/digest-gentoo-sources-2.4.26-r3
diff --git a/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.19-gcc33.patch b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.19-gcc33.patch
new file mode 100644
index 000000000000..56c5f504af23
--- /dev/null
+++ b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.19-gcc33.patch
@@ -0,0 +1,191 @@
+diff -u -r linux-2.4.20-gentoo-r6/arch/arm/mach-integrator/pci_v3.c linux-2.4.20-gentoo-r7/arch/arm/mach-integrator/pci_v3.c
+--- linux-2.4.20-gentoo-r6/arch/arm/mach-integrator/pci_v3.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/arch/arm/mach-integrator/pci_v3.c	2003-09-11 17:32:50.000000000 +0100
+@@ -629,7 +629,6 @@
+ #if 0
+ 	ret = request_irq(IRQ_LBUSTIMEOUT, lb_timeout, 0, "bus timeout", NULL);
+ 	if (ret)
+-		printk(KERN_ERR "PCI: unable to grab local bus timeout ".
+-		       "interrupt: %d\n", ret);
++		printk(KERN_ERR "PCI: unable to grab local bus timeout interrupt: %d\n", ret);
+ #endif
+ }
+diff -u -r linux-2.4.20-gentoo-r6/drivers/atm/zatm.c linux-2.4.20-gentoo-r7/drivers/atm/zatm.c
+--- linux-2.4.20-gentoo-r6/drivers/atm/zatm.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/drivers/atm/zatm.c	2003-09-11 17:32:50.000000000 +0100
+@@ -1430,8 +1430,7 @@
+ 	zout(uPD98401_GMR_ONE | uPD98401_BURST8 | uPD98401_BURST4 |
+ 	    uPD98401_BURST2 | uPD98401_GMR_PM | uPD98401_GMR_DR,GMR);
+ 	/* TODO: should shrink allocation now */
+-	printk("mem=%dkB,%s (",zatm_dev->mem >> 10,zatm_dev->copper ? "UTP" :
+-	    "MMF");
++	printk("mem=%dkB,%s (",zatm_dev->mem >> 10,zatm_dev->copper ? "UTP" : "MMF");
+ 	for (i = 0; i < ESI_LEN; i++)
+ 		printk("%02X%s",dev->esi[i],i == ESI_LEN-1 ? ")\n" : "-");
+ 	do {
+diff -u -r linux-2.4.20-gentoo-r6/drivers/char/h8.c linux-2.4.20-gentoo-r7/drivers/char/h8.c
+--- linux-2.4.20-gentoo-r6/drivers/char/h8.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/drivers/char/h8.c	2003-09-11 17:32:50.000000000 +0100
+@@ -574,8 +574,7 @@
+         }
+ 
+         if (intrbuf.word & H8_POWER_BUTTON) {
+-                printk(KERN_CRIT "Power switch pressed - please wait - preparing to power 
+-off\n");
++                printk(KERN_CRIT "Power switch pressed - please wait - preparing to power off\n");
+                 h8_set_event_mask(H8_POWER_BUTTON);
+                 wake_up(&h8_monitor_wait);
+         }
+diff -u -r linux-2.4.20-gentoo-r6/drivers/ide/ide-cd.h linux-2.4.20-gentoo-r7/drivers/ide/ide-cd.h
+--- linux-2.4.20-gentoo-r6/drivers/ide/ide-cd.h	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/drivers/ide/ide-cd.h	2003-09-11 17:32:50.000000000 +0100
+@@ -437,7 +437,7 @@
+ 
+ 	byte     curlba[3];
+ 	byte     nslots;
+-	__u8 short slot_tablelen;
++	__u16 slot_tablelen;
+ };
+  
+  
+diff -u -r linux-2.4.20-gentoo-r6/drivers/scsi/sun3_NCR5380.c linux-2.4.20-gentoo-r7/drivers/scsi/sun3_NCR5380.c
+--- linux-2.4.20-gentoo-r6/drivers/scsi/sun3_NCR5380.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/drivers/scsi/sun3_NCR5380.c	2003-09-11 17:32:50.000000000 +0100
+@@ -1226,8 +1226,7 @@
+ 					    BASR_ACK)) ==
+        (BASR_PHASE_MATCH | BASR_ACK)) {
+ 	    printk("scsi%d: BASR %02x\n", HOSTNO, NCR5380_read(BUS_AND_STATUS_REG));
+-	    printk("scsi%d: bus stuck in data phase -- probably a
+- single byte overrun!\n", HOSTNO); 
++	    printk("scsi%d: bus stuck in data phase -- probably a single byte overrun!\n", HOSTNO); 
+ 	    printk("not prepared for this error!\n");
+ 	    printk("please e-mail sammy@sammy.net with a description of how this\n");
+ 	    printk("error was produced.\n");
+diff -u -r linux-2.4.20-gentoo-r6/fs/imon/imon.c linux-2.4.20-gentoo-r7/fs/imon/imon.c
+--- linux-2.4.20-gentoo-r6/fs/imon/imon.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/fs/imon/imon.c	2003-09-11 17:32:50.000000000 +0100
+@@ -1310,8 +1310,7 @@
+        wr += sprintf(bf + wr, "\tdprobes:\t%lu\n",   m.im_dprobes);
+        wr += sprintf(bf + wr, "\tdmoves:\t\t%lu\n",  m.im_dmoves);
+ #else
+-       wr += sprintf(bf + wr, "no metering data; rebuild imon.o with METER_ON s
+-et.\n");
++       wr += sprintf(bf + wr, "no metering data; rebuild imon.o with METER_ON set.\n");
+ #endif /* METER_ON */
+ 
+        return wr;
+diff -u -r linux-2.4.20-gentoo-r6/net/core/rtnetlink.c linux-2.4.20-gentoo-r7/net/core/rtnetlink.c
+--- linux-2.4.20-gentoo-r6/net/core/rtnetlink.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/net/core/rtnetlink.c	2003-09-11 17:32:50.000000000 +0100
+@@ -394,7 +394,7 @@
+  * Malformed skbs with wrong lengths of messages are discarded silently.
+  */
+ 
+-extern __inline__ int rtnetlink_rcv_skb(struct sk_buff *skb)
++__inline__ int rtnetlink_rcv_skb(struct sk_buff *skb)
+ {
+ 	int err;
+ 	struct nlmsghdr * nlh;
+diff -u -r linux-2.4.20-gentoo-r6/net/decnet/dn_table.c linux-2.4.20-gentoo-r7/net/decnet/dn_table.c
+--- linux-2.4.20-gentoo-r6/net/decnet/dn_table.c	2003-09-10 23:36:03.000000000 +0100
++++ linux-2.4.20-gentoo-r7/net/decnet/dn_table.c	2003-09-11 17:32:50.000000000 +0100
+@@ -836,8 +836,7 @@
+                 return NULL;
+ 
+         if (in_interrupt() && net_ratelimit()) {
+-                printk(KERN_DEBUG "DECnet: BUG! Attempt to create routing table 
+-from interrupt\n"); 
++                printk(KERN_DEBUG "DECnet: BUG! Attempt to create routing table from interrupt\n"); 
+                 return NULL;
+         }
+         if ((t = kmalloc(sizeof(struct dn_fib_table), GFP_KERNEL)) == NULL)
+
+diff -u -r linux-2.4.20-gentoo-r6/drivers/net/fealnx.c linux-2.4.20-gentoo-r7/drivers/net/fealnx.c
+--- linux-2.4.20-gentoo-r6/drivers/net/fealnx.c	2003-09-08 19:50:27.000000000 -0700
++++ linux-2.4.20-gentoo-r7/drivers/net/fealnx.c	2003-06-13 07:51:34.000000000 -0700
+@@ -937,7 +937,7 @@
+ // 89/9/1 modify,
+ //   np->bcrvalue=0x38;
+ 	np->bcrvalue = 0x10;
+-	np->cralue = 0xe00;	/* rx 128 burst length */
++	np->crvalue = 0xe00;	/* rx 128 burst length */
+ #warning Processor architecture undefined!
+ #endif
+ // 89/12/29 add,
+@@ -1198,7 +1198,6 @@
+ 		printk("\n");
+ 	}
+ 
+-	   + dev->if_port = np->default_port;
+ 	/* Reinit. Gross */
+ 
+ 	/* Reset the chip's Tx and Rx processes. */
+diff -u -r linux-2.4.20-gentoo-r6/arch/i386/math-emu/poly.h linux-2.4.20-gentoo-r7/arch/i386/math-emu/poly.h
+--- linux-2.4.20-gentoo-r6/arch/i386/math-emu/poly.h	2003-09-08 19:52:14.000000000 -0700
++++ linux-2.4.20-gentoo-r7/arch/i386/math-emu/poly.h	2003-09-08 19:45:38.000000000 -0700
+@@ -75,11 +75,11 @@
+ /* Add the 12 byte Xsig x2 to Xsig dest, with no checks for overflow. */
+ static inline void add_Xsig_Xsig(Xsig *dest, const Xsig *x2)
+ {
+-  asm volatile ("movl %1,%%edi; movl %2,%%esi;
+-                 movl (%%esi),%%eax; addl %%eax,(%%edi);
+-                 movl 4(%%esi),%%eax; adcl %%eax,4(%%edi);
+-                 movl 8(%%esi),%%eax; adcl %%eax,8(%%edi);"
+-                 :"=g" (*dest):"g" (dest), "g" (x2)
++  asm volatile ("movl %1,%%edi; movl %2,%%esi; " \
++                  "movl (%%esi),%%eax; addl %%eax,(%%edi); " \
++                  "movl 4(%%esi),%%eax; adcl %%eax,4(%%edi); " \
++                  "movl 8(%%esi),%%eax; adcl %%eax,8(%%edi); " \ 
++                 :"=g" (*dest):"g" (dest), "g" (x2) \
+                  :"ax","si","di");
+ }
+ 
+@@ -90,18 +90,18 @@
+    problem, but keep fingers crossed! */
+ static inline void add_two_Xsig(Xsig *dest, const Xsig *x2, long int *exp)
+ {
+-  asm volatile ("movl %2,%%ecx; movl %3,%%esi;
+-                 movl (%%esi),%%eax; addl %%eax,(%%ecx);
+-                 movl 4(%%esi),%%eax; adcl %%eax,4(%%ecx);
+-                 movl 8(%%esi),%%eax; adcl %%eax,8(%%ecx);
+-                 jnc 0f;
+-		 rcrl 8(%%ecx); rcrl 4(%%ecx); rcrl (%%ecx)
+-                 movl %4,%%ecx; incl (%%ecx)
+-                 movl $1,%%eax; jmp 1f;
+-                 0: xorl %%eax,%%eax;
+-                 1:"
+-		:"=g" (*exp), "=g" (*dest)
+-		:"g" (dest), "g" (x2), "g" (exp)
++  asm volatile ("movl %2,%%ecx; movl %3,%%esi; " \
++                  "movl (%%esi),%%eax; addl %%eax,(%%ecx); " \
++                  "movl 4(%%esi),%%eax; adcl %%eax,4(%%ecx); " \
++                  "movl 8(%%esi),%%eax; adcl %%eax,8(%%ecx); " \
++                  "jnc 0f; " \
++		  "rcrl 8(%%ecx); rcrl 4(%%ecx); rcrl (%%ecx); " \
++                  "movl %4,%%ecx; incl (%%ecx); " \
++                  "movl $1,%%eax; jmp 1f; " \
++                  "0: xorl %%eax,%%eax; " \
++                  "1: " \
++		:"=g" (*exp), "=g" (*dest) \
++		:"g" (dest), "g" (x2), "g" (exp) \
+ 		:"cx","si","ax");
+ }
+
+diff -u -r linux-2.4.19/arch/i386/kernel/semaphore.c linux-2.4.19-gentoo-r19/i386/kernel/semaphore.c
+--- linux-2.4.19/arch/i386/kernel/semaphore.c	2004-06-24 14:53:47.874139392 +0100
++++ linux-2.4.19-gentoo-r19/i386/kernel/semaphore.c	2004-06-24 14:52:36.694960272 +0100
+@@ -262,7 +262,6 @@
+  */
+ #if defined(CONFIG_SMP)
+ asm(
+-"
+ .align	4
+ .globl	__write_lock_failed
+ __write_lock_failed:
+@@ -287,6 +286,5 @@
+ 	lock ; decl	(%eax)
+ 	js	__read_lock_failed
+ 	ret
+-"
+ );
+ #endif
diff --git a/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0495.patch b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0495.patch
new file mode 100644
index 000000000000..bea80eac69a9
--- /dev/null
+++ b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0495.patch
@@ -0,0 +1,655 @@
+--- linux/net/decnet/dn_dev.c.bak	Wed Jun 16 14:42:24 2004
++++ linux/net/decnet/dn_dev.c	Wed Jun 16 14:42:34 2004
+@@ -1070,31 +1070,39 @@ int dnet_gifconf(struct net_device *dev,
+ {
+ 	struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+ 	struct dn_ifaddr *ifa;
+-	struct ifreq *ifr = (struct ifreq *)buf;
++	char buffer[DN_IFREQ_SIZE];
++	struct ifreq *ifr = (struct ifreq *)buffer;
++	struct sockaddr_dn *addr = (struct sockaddr_dn *)&ifr->ifr_addr;
+ 	int done = 0;
+ 
+ 	if ((dn_db == NULL) || ((ifa = dn_db->ifa_list) == NULL))
+ 		return 0;
+ 
+ 	for(; ifa; ifa = ifa->ifa_next) {
+-		if (!ifr) {
++		if (!buf) {
+ 			done += sizeof(DN_IFREQ_SIZE);
+ 			continue;
+ 		}
+ 		if (len < DN_IFREQ_SIZE)
+ 			return done;
+-		memset(ifr, 0, DN_IFREQ_SIZE);
++		memset(buffer, 0, DN_IFREQ_SIZE);
+ 
+ 		if (ifa->ifa_label)
+ 			strcpy(ifr->ifr_name, ifa->ifa_label);
+ 		else
+ 			strcpy(ifr->ifr_name, dev->name);
+ 
+-		(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_family = AF_DECnet;
+-		(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_len = 2;
+-		(*(dn_address *)(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_addr) = ifa->ifa_local;
++		addr->sdn_family = AF_DECnet;
++		addr->sdn_add.a_len = 2;
++		memcpy(addr->sdn_add.a_addr, &ifa->ifa_local,
++			sizeof(dn_address));
+ 
+-		ifr = (struct ifreq *)((char *)ifr + DN_IFREQ_SIZE);
++		if (copy_to_user(buf, buffer, DN_IFREQ_SIZE)) {
++			done = -EFAULT;
++			break;
++		}
++
++		buf  += DN_IFREQ_SIZE;
+ 		len  -= DN_IFREQ_SIZE;
+ 		done += DN_IFREQ_SIZE;
+ 	}
+--- linux-2.4.21/drivers/net/wireless/airo.c	2003-06-13 15:51:35.000000000 +0100
++++ linux-2.4.21/drivers/net/wireless/airo.c.plasmaroo	2004-06-24 11:09:08.260352168 +0100
+@@ -3012,19 +3012,22 @@
+ 			  size_t len,
+ 			  loff_t *offset )
+ {
+-	int i;
+-	int pos;
++	loff_t pos = *offset;
+ 	struct proc_data *priv = (struct proc_data*)file->private_data;
+ 
+-	if( !priv->rbuffer ) return -EINVAL;
++	if (!priv->rbuffer)
++		return -EINVAL;
+ 
+-	pos = *offset;
+-	for( i = 0; i+pos < priv->readlen && i < len; i++ ) {
+-		if (put_user( priv->rbuffer[i+pos], buffer+i ))
+-			return -EFAULT;
+-	}
+-	*offset += i;
+-	return i;
++	if (pos < 0)
++		return -EINVAL;
++	if (pos >= priv->readlen)
++		return 0;
++	if (len > priv->readlen - pos)
++		len = priv->readlen - pos;
++	if (copy_to_user(buffer, priv->rbuffer + pos, len))
++		return -EFAULT;
++	*offset = pos + len;
++	return len;
+ }
+ 
+ /*
+@@ -3036,24 +3039,24 @@
+ 			   size_t len,
+ 			   loff_t *offset )
+ {
+-	int i;
+-	int pos;
++	loff_t pos = *offset;
+ 	struct proc_data *priv = (struct proc_data*)file->private_data;
+ 
+-	if ( !priv->wbuffer ) {
++	if (!priv->wbuffer)
+ 		return -EINVAL;
+-	}
+-
+-	pos = *offset;
+ 
+-	for( i = 0; i + pos <  priv->maxwritelen &&
+-		     i < len; i++ ) {
+-		if (get_user( priv->wbuffer[i+pos], buffer + i ))
+-			return -EFAULT;
+-	}
+-	if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos;
+-	*offset += i;
+-	return i;
++	if (pos < 0)
++		return -EINVAL;
++	if (pos >= priv->maxwritelen)
++		return 0;
++	if (len > priv->maxwritelen - pos)
++		len = priv->maxwritelen - pos;
++	if (copy_from_user(priv->wbuffer + pos, buffer, len))
++		return -EFAULT;
++	if (pos + len > priv->writelen)
++		priv->writelen = pos + len;
++	*offset = pos + len;
++	return len;
+ }
+ 
+ static int proc_status_open( struct inode *inode, struct file *file ) {
+--- linux/drivers/sound/mpu401.c.bak	Wed Jun 16 14:42:24 2004
++++ linux/drivers/sound/mpu401.c	Wed Jun 16 14:42:34 2004
+@@ -1493,14 +1493,16 @@ static unsigned long mpu_timer_get_time(
+ static int mpu_timer_ioctl(int dev, unsigned int command, caddr_t arg)
+ {
+ 	int midi_dev = sound_timer_devs[dev]->devlink;
++	int *p = (int *)arg;
+ 
+ 	switch (command)
+ 	{
+ 		case SNDCTL_TMR_SOURCE:
+ 			{
+ 				int parm;
+-	
+-				parm = *(int *) arg;
++
++				if (get_user(parm, p))
++					return -EFAULT;
+ 				parm &= timer_caps;
+ 
+ 				if (parm != 0)
+@@ -1512,7 +1514,9 @@ static int mpu_timer_ioctl(int dev, unsi
+ 					else if (timer_mode & TMR_MODE_SMPTE)
+ 						mpu_cmd(midi_dev, 0x3d, 0);		/* Use SMPTE sync */
+ 				}
+-				return (*(int *) arg = timer_mode);
++				if (put_user(timer_mode, p))
++					return -EFAULT;
++				return timer_mode;
+ 			}
+ 			break;
+ 
+@@ -1537,10 +1541,13 @@ static int mpu_timer_ioctl(int dev, unsi
+ 			{
+ 				int val;
+ 
+-				val = *(int *) arg;
++				if (get_user(val, p))
++					return -EFAULT;
+ 				if (val)
+ 					set_timebase(midi_dev, val);
+-				return (*(int *) arg = curr_timebase);
++				if (put_user(curr_timebase, p))
++					return -EFAULT;
++				return curr_timebase;
+ 			}
+ 			break;
+ 
+@@ -1549,7 +1556,8 @@ static int mpu_timer_ioctl(int dev, unsi
+ 				int val;
+ 				int ret;
+ 
+-				val = *(int *) arg;
++				if (get_user(val, p))
++					return -EFAULT;
+ 
+ 				if (val)
+ 				{
+@@ -1564,7 +1572,9 @@ static int mpu_timer_ioctl(int dev, unsi
+ 					}
+ 					curr_tempo = val;
+ 				}
+-				return (*(int *) arg = curr_tempo);
++				if (put_user(curr_tempo, p))
++					return -EFAULT;
++				return curr_tempo;
+ 			}
+ 			break;
+ 
+@@ -1572,18 +1582,25 @@ static int mpu_timer_ioctl(int dev, unsi
+ 			{
+ 				int val;
+ 
+-				val = *(int *) arg;
++				if (get_user(val, p))
++					return -EFAULT;
+ 				if (val != 0)		/* Can't change */
+ 					return -EINVAL;
+-				return (*(int *) arg = ((curr_tempo * curr_timebase) + 30) / 60);
++				val = (curr_tempo * curr_timebase + 30) / 60;
++				if (put_user(val, p))
++					return -EFAULT;
++				return val;
+ 			}
+ 			break;
+ 
+ 		case SNDCTL_SEQ_GETTIME:
+-			return (*(int *) arg = curr_ticks);
++			if (put_user(curr_ticks, p))
++				return -EFAULT;
++			return curr_ticks;
+ 
+ 		case SNDCTL_TMR_METRONOME:
+-			metronome_mode = *(int *) arg;
++			if (get_user(metronome_mode, p))
++				return -EFAULT;
+ 			setup_metronome(midi_dev);
+ 			return 0;
+ 
+--- linux/drivers/sound/msnd.c.bak	Wed Jun 16 14:42:24 2004
++++ linux/drivers/sound/msnd.c	Wed Jun 16 14:42:34 2004
+@@ -155,13 +155,10 @@ void msnd_fifo_make_empty(msnd_fifo *f)
+ 	f->len = f->tail = f->head = 0;
+ }
+ 
+-int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user)
++int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len)
+ {
+ 	int count = 0;
+ 
+-	if (f->len == f->n)
+-		return 0;
+-
+ 	while ((count < len) && (f->len != f->n)) {
+ 
+ 		int nwritten;
+@@ -177,11 +174,7 @@ int msnd_fifo_write(msnd_fifo *f, const 
+ 				nwritten = len - count;
+ 		}
+ 
+-		if (user) {
+-			if (copy_from_user(f->data + f->tail, buf, nwritten))
+-				return -EFAULT;
+-		} else
+-			isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
++		isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
+ 
+ 		count += nwritten;
+ 		buf += nwritten;
+@@ -193,13 +186,10 @@ int msnd_fifo_write(msnd_fifo *f, const 
+ 	return count;
+ }
+ 
+-int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user)
++int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len)
+ {
+ 	int count = 0;
+ 
+-	if (f->len == 0)
+-		return f->len;
+-
+ 	while ((count < len) && (f->len > 0)) {
+ 
+ 		int nread;
+@@ -215,11 +205,7 @@ int msnd_fifo_read(msnd_fifo *f, char *b
+ 				nread = len - count;
+ 		}
+ 
+-		if (user) {
+-			if (copy_to_user(buf, f->data + f->head, nread))
+-				return -EFAULT;
+-		} else
+-			isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
++		isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
+ 
+ 		count += nread;
+ 		buf += nread;
+--- linux/drivers/sound/msnd.h.bak	Wed Jun 16 14:42:24 2004
++++ linux/drivers/sound/msnd.h	Wed Jun 16 14:42:34 2004
+@@ -266,8 +266,8 @@ void				msnd_fifo_init(msnd_fifo *f);
+ void				msnd_fifo_free(msnd_fifo *f);
+ int				msnd_fifo_alloc(msnd_fifo *f, size_t n);
+ void				msnd_fifo_make_empty(msnd_fifo *f);
+-int				msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user);
+-int				msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user);
++int				msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len);
++int				msnd_fifo_read(msnd_fifo *f, char *buf, size_t len);
+ 
+ int				msnd_wait_TXDE(multisound_dev_t *dev);
+ int				msnd_wait_HC0(multisound_dev_t *dev);
+--- linux/drivers/sound/msnd_pinnacle.c.bak	Wed Jun 16 14:42:24 2004
++++ linux/drivers/sound/msnd_pinnacle.c	Wed Jun 16 14:42:34 2004
+@@ -804,7 +804,7 @@ static int dev_release(struct inode *ino
+ 
+ static __inline__ int pack_DARQ_to_DARF(register int bank)
+ {
+-	register int size, n, timeout = 3;
++	register int size, timeout = 3;
+ 	register WORD wTmp;
+ 	LPDAQD DAQD;
+ 
+@@ -825,13 +825,10 @@ static __inline__ int pack_DARQ_to_DARF(
+ 	/* Read data from the head (unprotected bank 1 access okay
+            since this is only called inside an interrupt) */
+ 	outb(HPBLKSEL_1, dev.io + HP_BLKS);
+-	if ((n = msnd_fifo_write(
++	msnd_fifo_write(
+ 		&dev.DARF,
+ 		(char *)(dev.base + bank * DAR_BUFF_SIZE),
+-		size, 0)) <= 0) {
+-		outb(HPBLKSEL_0, dev.io + HP_BLKS);
+-		return n;
+-	}
++		size);
+ 	outb(HPBLKSEL_0, dev.io + HP_BLKS);
+ 
+ 	return 1;
+@@ -853,21 +850,16 @@ static __inline__ int pack_DAPF_to_DAPQ(
+ 		if (protect) {
+ 			/* Critical section: protect fifo in non-interrupt */
+ 			spin_lock_irqsave(&dev.lock, flags);
+-			if ((n = msnd_fifo_read(
++			n = msnd_fifo_read(
+ 				&dev.DAPF,
+ 				(char *)(dev.base + bank_num * DAP_BUFF_SIZE),
+-				DAP_BUFF_SIZE, 0)) < 0) {
+-				spin_unlock_irqrestore(&dev.lock, flags);
+-				return n;
+-			}
++				DAP_BUFF_SIZE);
+ 			spin_unlock_irqrestore(&dev.lock, flags);
+ 		} else {
+-			if ((n = msnd_fifo_read(
++			n = msnd_fifo_read(
+ 				&dev.DAPF,
+ 				(char *)(dev.base + bank_num * DAP_BUFF_SIZE),
+-				DAP_BUFF_SIZE, 0)) < 0) {
+-				return n;
+-			}
++				DAP_BUFF_SIZE);
+ 		}
+ 		if (!n)
+ 			break;
+@@ -894,30 +886,43 @@ static __inline__ int pack_DAPF_to_DAPQ(
+ static int dsp_read(char *buf, size_t len)
+ {
+ 	int count = len;
++	char *page = (char *)__get_free_page(PAGE_SIZE);
++
++	if (!page)
++		return -ENOMEM;
+ 
+ 	while (count > 0) {
+-		int n;
++		int n, k;
+ 		unsigned long flags;
+ 
++		k = PAGE_SIZE;
++		if (k > count)
++			k = count;
++
+ 		/* Critical section: protect fifo in non-interrupt */
+ 		spin_lock_irqsave(&dev.lock, flags);
+-		if ((n = msnd_fifo_read(&dev.DARF, buf, count, 1)) < 0) {
+-			printk(KERN_WARNING LOGNAME ": FIFO read error\n");
+-			spin_unlock_irqrestore(&dev.lock, flags);
+-			return n;
+-		}
++		n = msnd_fifo_read(&dev.DARF, page, k);
+ 		spin_unlock_irqrestore(&dev.lock, flags);
++		if (copy_to_user(buf, page, n)) {
++			free_page((unsigned long)page);
++			return -EFAULT;
++		}
+ 		buf += n;
+ 		count -= n;
+ 
++		if (n == k && count)
++			continue;
++
+ 		if (!test_bit(F_READING, &dev.flags) && dev.mode & FMODE_READ) {
+ 			dev.last_recbank = -1;
+ 			if (chk_send_dsp_cmd(&dev, HDEX_RECORD_START) == 0)
+ 				set_bit(F_READING, &dev.flags);
+ 		}
+ 
+-		if (dev.rec_ndelay)
++		if (dev.rec_ndelay) {
++			free_page((unsigned long)page);
+ 			return count == len ? -EAGAIN : len - count;
++		}
+ 
+ 		if (count > 0) {
+ 			set_bit(F_READBLOCK, &dev.flags);
+@@ -926,41 +931,57 @@ static int dsp_read(char *buf, size_t le
+ 				get_rec_delay_jiffies(DAR_BUFF_SIZE)))
+ 				clear_bit(F_READING, &dev.flags);
+ 			clear_bit(F_READBLOCK, &dev.flags);
+-			if (signal_pending(current))
++			if (signal_pending(current)) {
++				free_page((unsigned long)page);
+ 				return -EINTR;
++			}
+ 		}
+ 	}
+-
++	free_page((unsigned long)page);
+ 	return len - count;
+ }
+ 
+ static int dsp_write(const char *buf, size_t len)
+ {
+ 	int count = len;
++	char *page = (char *)__get_free_page(GFP_KERNEL);
++
++	if (!page)
++		return -ENOMEM;
+ 
+ 	while (count > 0) {
+-		int n;
++		int n, k;
+ 		unsigned long flags;
+ 
++		k = PAGE_SIZE;
++		if (k > count)
++			k = count;
++
++		if (copy_from_user(page, buf, k)) {
++			free_page((unsigned long)page);
++			return -EFAULT;
++		}
++
+ 		/* Critical section: protect fifo in non-interrupt */
+ 		spin_lock_irqsave(&dev.lock, flags);
+-		if ((n = msnd_fifo_write(&dev.DAPF, buf, count, 1)) < 0) {
+-			printk(KERN_WARNING LOGNAME ": FIFO write error\n");
+-			spin_unlock_irqrestore(&dev.lock, flags);
+-			return n;
+-		}
++		n = msnd_fifo_write(&dev.DAPF, page, k);
+ 		spin_unlock_irqrestore(&dev.lock, flags);
+ 		buf += n;
+ 		count -= n;
+ 
++		if (count && n == k)
++			continue;
++
+ 		if (!test_bit(F_WRITING, &dev.flags) && (dev.mode & FMODE_WRITE)) {
+ 			dev.last_playbank = -1;
+ 			if (pack_DAPF_to_DAPQ(1) > 0)
+ 				set_bit(F_WRITING, &dev.flags);
+ 		}
+ 
+-		if (dev.play_ndelay)
++		if (dev.play_ndelay) {
++			free_page((unsigned long)page);
+ 			return count == len ? -EAGAIN : len - count;
++		}
+ 
+ 		if (count > 0) {
+ 			set_bit(F_WRITEBLOCK, &dev.flags);
+@@ -968,11 +989,14 @@ static int dsp_write(const char *buf, si
+ 				&dev.writeblock,
+ 				get_play_delay_jiffies(DAP_BUFF_SIZE));
+ 			clear_bit(F_WRITEBLOCK, &dev.flags);
+-			if (signal_pending(current))
++			if (signal_pending(current)) {
++				free_page((unsigned long)page);
+ 				return -EINTR;
++			}
+ 		}
+ 	}
+ 
++	free_page((unsigned long)page);
+ 	return len - count;
+ }
+ 
+--- linux/drivers/sound/pss.c.bak	Wed Jun 16 14:42:24 2004
++++ linux/drivers/sound/pss.c	Wed Jun 16 14:42:34 2004
+@@ -450,20 +450,36 @@ static void pss_mixer_reset(pss_confdata
+ 	}
+ }
+ 
+-static void arg_to_volume_mono(unsigned int volume, int *aleft)
++static int set_volume_mono(caddr_t p, int *aleft)
+ {
+ 	int left;
++	unsigned volume;
++	if (get_user(volume, (unsigned *)p))
++		return -EFAULT;
+ 	
+-	left = volume & 0x00ff;
++	left = volume & 0xff;
+ 	if (left > 100)
+ 		left = 100;
+ 	*aleft = left;
++	return 0;
+ }
+ 
+-static void arg_to_volume_stereo(unsigned int volume, int *aleft, int *aright)
++static int set_volume_stereo(caddr_t p, int *aleft, int *aright)
+ {
+-	arg_to_volume_mono(volume, aleft);
+-	arg_to_volume_mono(volume >> 8, aright);
++	int left, right;
++	unsigned volume;
++	if (get_user(volume, (unsigned *)p))
++		return -EFAULT;
++
++	left = volume & 0xff;
++	if (left > 100)
++		left = 100;
++	right = (volume >> 8) & 0xff;
++	if (right > 100)
++		right = 100;
++	*aleft = left;
++	*aright = right;
++	return 0;
+ }
+ 
+ static int ret_vol_mono(int left)
+@@ -510,33 +526,38 @@ static int pss_mixer_ioctl (int dev, uns
+ 					return call_ad_mixer(devc, cmd, arg);
+ 				else
+ 				{
+-					if (*(int *)arg != 0)
++					int v;
++					if (get_user(v, (int *)arg))
++						return -EFAULT;
++					if (v != 0)
+ 						return -EINVAL;
+ 					return 0;
+ 				}
+ 			case SOUND_MIXER_VOLUME:
+-				arg_to_volume_stereo(*(unsigned int *)arg, &devc->mixer.volume_l,
+-					&devc->mixer.volume_r); 
++				if (set_volume_stereo(arg,
++					&devc->mixer.volume_l,
++					&devc->mixer.volume_r))
++					return -EFAULT;
+ 				set_master_volume(devc, devc->mixer.volume_l,
+ 					devc->mixer.volume_r);
+ 				return ret_vol_stereo(devc->mixer.volume_l,
+ 					devc->mixer.volume_r);
+ 		  
+ 			case SOUND_MIXER_BASS:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.bass);
++				if (set_volume_mono(arg, &devc->mixer.bass))
++					return -EFAULT;
+ 				set_bass(devc, devc->mixer.bass);
+ 				return ret_vol_mono(devc->mixer.bass);
+ 		  
+ 			case SOUND_MIXER_TREBLE:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.treble);
++				if (set_volume_mono(arg, &devc->mixer.treble))
++					return -EFAULT;
+ 				set_treble(devc, devc->mixer.treble);
+ 				return ret_vol_mono(devc->mixer.treble);
+ 		  
+ 			case SOUND_MIXER_SYNTH:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.synth);
++				if (set_volume_mono(arg, &devc->mixer.synth))
++					return -EFAULT;
+ 				set_synth_volume(devc, devc->mixer.synth);
+ 				return ret_vol_mono(devc->mixer.synth);
+ 		  
+@@ -546,54 +567,67 @@ static int pss_mixer_ioctl (int dev, uns
+ 	}
+ 	else			
+ 	{
++		int val, and_mask = 0, or_mask = 0;
+ 		/*
+ 		 * Return parameters
+ 		 */
+ 		switch (cmdf)
+ 		{
+-
+ 			case SOUND_MIXER_DEVMASK:
+ 				if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
+-					*(int *)arg = 0; /* no mixer devices */
+-				return (*(int *)arg |= SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH);
++					break;
++				and_mask = ~0;
++				or_mask = SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH;
++				break;
+ 		  
+ 			case SOUND_MIXER_STEREODEVS:
+ 				if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
+-					*(int *)arg = 0; /* no stereo devices */
+-				return (*(int *)arg |= SOUND_MASK_VOLUME);
++					break;
++				and_mask = ~0;
++				or_mask = SOUND_MASK_VOLUME;
++				break;
+ 		  
+ 			case SOUND_MIXER_RECMASK:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = 0); /* no record devices */
++				break;
+ 
+ 			case SOUND_MIXER_CAPS:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = SOUND_CAP_EXCL_INPUT);
++				or_mask = SOUND_CAP_EXCL_INPUT;
++				break;
+ 
+ 			case SOUND_MIXER_RECSRC:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = 0); /* no record source */
++				break;
+ 
+ 			case SOUND_MIXER_VOLUME:
+-				return (*(int *)arg = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r));
++				or_mask =  ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r);
++				break;
+ 			  
+ 			case SOUND_MIXER_BASS:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.bass));
++				or_mask =  ret_vol_mono(devc->mixer.bass);
++				break;
+ 			  
+ 			case SOUND_MIXER_TREBLE:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.treble));
++				or_mask = ret_vol_mono(devc->mixer.treble);
++				break;
+ 			  
+ 			case SOUND_MIXER_SYNTH:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.synth));
++				or_mask = ret_vol_mono(devc->mixer.synth);
++				break;
+ 			default:
+ 				return -EINVAL;
+ 		}
++		if (get_user(val, (int *)arg))
++			return -EFAULT;
++		val &= and_mask;
++		val |= or_mask;
++		if (put_user(val, (int *)arg))
++			return -EFAULT;
++		return val;
+ 	}
+ }
+ 
diff --git a/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0535.patch b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0535.patch
new file mode 100644
index 000000000000..669fc5fd32fb
--- /dev/null
+++ b/sys-kernel/gentoo-sources/files/gentoo-sources-2.4.CAN-2004-0535.patch
@@ -0,0 +1,12 @@
+--- drivers/net/e1000/e1000_ethtool.c	2003-06-13 15:51:34.000000000 +0100
++++ drivers/net/e1000/e1000_ethtool.c.plasmaroo	2004-06-24 11:23:32.524963976 +0100
+@@ -468,6 +468,9 @@
+ 
+ 		if(copy_from_user(&regs, addr, sizeof(regs)))
+ 			return -EFAULT;
++		memset(regs_buff, 0, sizeof(regs_buff));
++		if (regs.len > E1000_REGS_LEN)
++			regs.len = E1000_REGS_LEN;
+ 		e1000_ethtool_gregs(adapter, &regs, regs_buff);
+ 		if(copy_to_user(addr, &regs, sizeof(regs)))
+ 			return -EFAULT;
diff --git a/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r16.ebuild b/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r17.ebuild
index 6588766ad4c1..23088f5e5b62 100644
--- a/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r16.ebuild
+++ b/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r17.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r16.ebuild,v 1.2 2004/06/23 23:14:25 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.19-r17.ebuild,v 1.1 2004/06/24 15:29:37 plasmaroo Exp $
 
 IUSE="build crypt xfs acpi4linux"
 
@@ -35,7 +35,7 @@ S=${WORKDIR}/linux-${KV}
 
 DESCRIPTION="Full sources for the Gentoo Linux kernel"
 SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2
-	 http://gentoo.lostlogicx.com/patches-${KV/16/10}.tar.bz2"
+	 http://gentoo.lostlogicx.com/patches-${KV/17/10}.tar.bz2"
 KEYWORDS="x86 -ppc -sparc -amd64 -ia64"
 SLOT="${KV}"
 
@@ -43,7 +43,7 @@ src_unpack() {
 	unpack ${A}
 	mv linux-${OKV} linux-${KV} || die
 
-	cd ${KV/16/10}
+	cd ${KV/17/10}
 	# Kill patches we aren't suppposed to use, don't worry about 
 	# failures, if they aren't there that is a good thing!
 
@@ -60,6 +60,9 @@ src_unpack() {
 	kernel_src_unpack
 
 	cd ${S}
+	epatch ${FILESDIR}/${P}-gcc33.patch || die "GCC 3.3 patch failed!"
+	epatch ${FILESDIR}/${PN}-2.4.20-cs46xx-gcc33.patch || die "GCC 3.3 patch failed!"
+
 	epatch ${FILESDIR}/lcall-DoS.patch || die "lcall-DoS patch failed"
 	epatch ${FILESDIR}/i810_drm.patch || die "i810_drm patch failed"
 	epatch ${FILESDIR}/do_brk_fix.patch || die "Failed to apply do_brk() patch!"
@@ -74,5 +77,6 @@ src_unpack() {
 	epatch ${FILESDIR}/${P}-CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!"
+	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch || die "Failed to add the CAN-2004-0495 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.FPULockup-53804.patch || die "Failed to apply FPU-lockup patch!"
 }
diff --git a/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r19.ebuild b/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r20.ebuild
index 2f5e643e7ca5..38f15ab581d7 100644
--- a/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r19.ebuild
+++ b/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r20.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r19.ebuild,v 1.2 2004/06/23 23:14:25 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.20-r20.ebuild,v 1.1 2004/06/24 15:29:37 plasmaroo Exp $
 
 IUSE="build crypt evms2 aavm usagi"
 
@@ -30,7 +30,7 @@ S=${WORKDIR}/linux-${KV}
 
 DESCRIPTION="Full sources for the Gentoo Kernel."
 SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2
-	 http://dev.gentoo.org/~plasmaroo/patches/kernel/gentoo-sources/patches-${KV/19/14}.tar.bz2"
+	 http://dev.gentoo.org/~plasmaroo/patches/kernel/gentoo-sources/patches-${KV/r20/r14}.tar.bz2"
 HOMEPAGE="http://www.gentoo.org/ http://www.kernel.org/"
 LICENSE="GPL-2"
 KEYWORDS="x86 -ppc -sparc -alpha -hppa -mips"
@@ -40,7 +40,7 @@ src_unpack() {
 	unpack ${A}
 	mv linux-${OKV} linux-${KV} || die "Error moving kernel source tree to linux-${KV}"
 
-	cd ${WORKDIR}/${KV/19/14}
+	cd ${WORKDIR}/${KV/r20/r14}
 
 	# This is the *ratified* aavm USE flag, enables aavm support in this kernel
 	if ! use aavm; then
@@ -94,6 +94,7 @@ src_unpack() {
 			einfo "Dropping ${file}..."
 			rm -f ${file}
 		done
+		rm 991_fix_cryptoOrder
 	else
 		einfo "Cryptographic patches will be applied."
 	fi
@@ -135,6 +136,8 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0181.patch || die "Failed to add the CAN-2004-0181 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0394.patch || die "Failed to add the CAN-2004-0394 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0427.patch || die "Failed to add the CAN-2004-0427 patch!"
+	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch || die "Failed to add the CAN-2004-0495 patch!"
+	epatch ${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch || die "Failed to add the CAN-2004-0535 patch!"
 	epatch ${FILESDIR}/${PN}-2.4.I2C_Limits.patch || die "Failed to patch the I2C i2cdev_ioctl() kmalloc() bug!"
 	epatch ${FILESDIR}/${PN}-2.4.FPULockup-53804.patch || die "Failed to apply FPU-lockup patch!"
 }
diff --git a/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r11.ebuild b/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r12.ebuild
index 7b1ac0d8fd10..c31c930ec5c6 100644
--- a/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r11.ebuild
+++ b/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r12.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r11.ebuild,v 1.1 2004/06/14 20:37:48 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.22-r12.ebuild,v 1.1 2004/06/24 15:29:37 plasmaroo Exp $
 
 ETYPE="sources"
 UNIPATCH_LIST="
@@ -15,8 +15,10 @@ UNIPATCH_LIST="
 	${FILESDIR}/${PN}-2.4.CAN-2004-0181.patch
 	${FILESDIR}/${PN}-2.4.CAN-2004-0394.patch
 	${FILESDIR}/${PN}-2.4.CAN-2004-0427.patch
+	${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch
+	${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch
 	${FILESDIR}/${PN}-2.4.FPULockup-53804.patch
-	${DISTDIR}/gentoo-sources-${PVR/11/5}.patch.bz2"
+	${DISTDIR}/gentoo-sources-${PVR/12/5}.patch.bz2"
 
 inherit kernel-2
 detect_version
@@ -25,7 +27,7 @@ S=${WORKDIR}/linux-${KV}
 
 DESCRIPTION="Full sources for the Gentoo Kernel."
 SRC_URI="mirror://kernel/linux/kernel/v2.4/linux-${OKV}.tar.bz2
-	http://dev.gentoo.org/~iggy/gentoo-sources-${PVR/11/5}.patch.bz2"
+	http://dev.gentoo.org/~iggy/gentoo-sources-${PVR/12/5}.patch.bz2"
 KEYWORDS="x86 -*"
 SLOT="${KV}"
 
diff --git a/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r4.ebuild b/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r5.ebuild
index 2d3c67eea977..84340bff13c9 100644
--- a/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r4.ebuild
+++ b/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r5.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r4.ebuild,v 1.1 2004/06/14 20:37:48 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.25-r5.ebuild,v 1.1 2004/06/24 15:29:37 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
@@ -15,6 +15,8 @@ UNIPATCH_LIST="
 	${FILESDIR}/${PN}-2.4.CAN-2004-0181.patch
 	${FILESDIR}/${PN}-2.4.CAN-2004-0394.patch
 	${FILESDIR}/${PN}-2.4.CAN-2004-0427.patch
+	${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch
+	${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch
 	${FILESDIR}/${PN}-2.4.FPULockup-53804.patch
 	${DISTDIR}/${P}.patch.bz2"
 
diff --git a/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r2.ebuild b/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r3.ebuild
index 7e7e6975e04d..bb2919ec343c 100644
--- a/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r2.ebuild
+++ b/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r3.ebuild
@@ -1,13 +1,16 @@
 # Copyright 1999-2004 Gentoo Technologies, Inc.
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r2.ebuild,v 1.1 2004/06/14 20:37:48 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/gentoo-sources/gentoo-sources-2.4.26-r3.ebuild,v 1.1 2004/06/24 15:29:37 plasmaroo Exp $
 
 ETYPE="sources"
 inherit kernel-2
 detect_version
 
 KEYWORDS="~x86"
-UNIPATCH_LIST="${FILESDIR}/${PN}-2.4.FPULockup-53804.patch ${DISTDIR}/${P}-${PR/r2/r1}.tar.bz2"
+UNIPATCH_LIST="${FILESDIR}/${PN}-2.4.CAN-2004-0495.patch
+	${FILESDIR}/${PN}-2.4.CAN-2004-0535.patch
+	${FILESDIR}/${PN}-2.4.FPULockup-53804.patch
+	${DISTDIR}/${P}-${PR/r3/r1}.tar.bz2"
 
 DESCRIPTION="Full sources including the Gentoo patchset for the ${KV_MAJOR}.${KV_MINOR} kernel tree"
-SRC_URI="${KERNEL_URI} http://dev.gentoo.org/~plasmaroo/patches/kernel/gentoo-sources/${P}-${PR/r2/r1}.tar.bz2"
+SRC_URI="${KERNEL_URI} http://dev.gentoo.org/~plasmaroo/patches/kernel/gentoo-sources/${P}-${PR/r3/r1}.tar.bz2"
diff --git a/sys-kernel/gentoo-sources/metadata.xml b/sys-kernel/gentoo-sources/metadata.xml
index 9c16e2ec5cea..d629c4802881 100644
--- a/sys-kernel/gentoo-sources/metadata.xml
+++ b/sys-kernel/gentoo-sources/metadata.xml
@@ -6,6 +6,9 @@
   <email>livewire@gentoo.org</email>
 </maintainer>
 <maintainer>
+  <email>plasmaroo@gentoo.org</email>
+</maintainer>
+<maintainer>
   <email>x86-kernel@gentoo.org</email>
 </maintainer>
 </pkgmetadata>