Added patches for the CAN-2004-0133, CAN-2004-0181, CAN-2004-0394, and CAN-2004-0427 vulnerabilities. Bug #47881. Old versions of sources removed.

10 files changed, 74 insertions, 216 deletions

diff --git a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r1 b/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r1
deleted file mode 100644
index aad81484b58e..000000000000
--- a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r1
+++ /dev/null
@@ -1,2 +0,0 @@
-MD5 75dc85149b06ac9432106b8941eb9f7b linux-2.4.22.tar.bz2 29528612
-MD5 64aff10db764dc7bdbfb105466db45ec patches-2.4.23_pre8-gss.tar.bz2 3663061
diff --git a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r2 b/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r2
deleted file mode 100644
index aad81484b58e..000000000000
--- a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.23_pre8-r2
+++ /dev/null
@@ -1,2 +0,0 @@
-MD5 75dc85149b06ac9432106b8941eb9f7b linux-2.4.22.tar.bz2 29528612
-MD5 64aff10db764dc7bdbfb105466db45ec patches-2.4.23_pre8-gss.tar.bz2 3663061
diff --git a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.25_pre7-r4 b/sys-kernel/gs-sources/files/digest-gs-sources-2.4.25_pre7-r5
index f55b28665921..f55b28665921 100644
--- a/sys-kernel/gs-sources/files/digest-gs-sources-2.4.25_pre7-r4
+++ b/sys-kernel/gs-sources/files/digest-gs-sources-2.4.25_pre7-r5
diff --git a/sys-kernel/gs-sources/files/do_brk_fix.patch b/sys-kernel/gs-sources/files/do_brk_fix.patch
deleted file mode 100644
index fef1f1e981e2..000000000000
--- a/sys-kernel/gs-sources/files/do_brk_fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/mm/mmap.c Fri Sep 12 06:44:06 2003
-+++ b/mm/mmap.c Thu Oct  2 01:18:19 2003
-@@ -1041,6 +1041,9 @@
-	if (!len)
-		return addr;
- 
-+ 	if ((addr + len) > TASK_SIZE || (addr + len) < addr)
-+ 		return -EINVAL;
-+ 
-	/*
-	 * mlock MCL_FUTURE?
-	 */
diff --git a/sys-kernel/gs-sources/files/gs-sources-2.4.23_pre8-af_irda.patch b/sys-kernel/gs-sources/files/gs-sources-2.4.23_pre8-af_irda.patch
deleted file mode 100644
index 465657d1129d..000000000000
--- a/sys-kernel/gs-sources/files/gs-sources-2.4.23_pre8-af_irda.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- net/irda/af_irda.c.orig	2003-12-12 03:00:22.000000000 -0600
-+++ net/irda/af_irda.c	2003-12-12 03:00:12.000000000 -0600
-@@ -285,7 +285,7 @@
- 		self->max_data_size = irttp_get_max_seg_size(self->tsap);
- 	};
- 
--	IRDA_DEBUG(2, "%s(), max_data_size=%d\n", __FUNCTION__
-+	IRDA_DEBUG(2, "%s(), max_data_size=%d\n", __FUNCTION__,
- 		   self->max_data_size);
- 
- 	memcpy(&self->qos_tx, qos, sizeof(struct qos_info));
-@@ -384,7 +384,7 @@
- 
- 	/* Check if request succeeded */
- 	if (result != IAS_SUCCESS) {
--		IRDA_DEBUG(1, "%s(), IAS query failed! (%d)\n", __FUNCTION__
-+		IRDA_DEBUG(1, "%s(), IAS query failed! (%d)\n", __FUNCTION__,
- 			   result);
- 
- 		self->errno = result;	/* We really need it later */
diff --git a/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0133.patch b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0133.patch
new file mode 100644
index 000000000000..c756bc328bf2
--- /dev/null
+++ b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0133.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.22/fs/xfs/xfs_log.c.can-2004-0133	2004-03-23 12:28:11.000000000 -0700
++++ linux-2.4.22/fs/xfs/xfs_log.c	2004-03-23 12:58:59.000000000 -0700
+@@ -1251,7 +1251,7 @@
+ 			  kmem_zalloc(sizeof(xlog_in_core_t), KM_SLEEP);
+ 		iclog = *iclogp;
+ 		iclog->hic_data = (xlog_in_core_2_t *)
+-			  kmem_alloc(iclogsize, KM_SLEEP);
++			  kmem_zalloc(iclogsize, KM_SLEEP);
+ 
+ 		iclog->ic_prev = prev_iclog;
+ 		prev_iclog = iclog;
diff --git a/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0181.patch b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0181.patch
new file mode 100644
index 000000000000..5f7f1441b268
--- /dev/null
+++ b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0181.patch
@@ -0,0 +1,38 @@
+--- linux-2.4.22/fs/jfs/jfs_logmgr.c.jfs-sec	2004-03-23 12:30:35.000000000 -0700
++++ linux-2.4.22/fs/jfs/jfs_logmgr.c	2004-03-23 13:01:51.000000000 -0700
+@@ -1693,7 +1693,7 @@
+ 		if (lbuf == 0)
+ 			goto error;
+ 		lbuf->l_bh.b_data = lbuf->l_ldata =
+-		    (char *) __get_free_page(GFP_KERNEL);
++		    (char *) get_zeroed_page(GFP_KERNEL);
+ 		if (lbuf->l_ldata == 0) {
+ 			kfree(lbuf);
+ 			goto error;
+--- linux-2.4.22/fs/jfs/jfs_metapage.c.jfs-sec	2004-03-23 12:30:48.000000000 -0700
++++ linux-2.4.22/fs/jfs/jfs_metapage.c	2004-03-23 13:01:51.000000000 -0700
+@@ -375,6 +375,10 @@
+ 		}
+ 		mp->data = kmap(mp->page) + page_offset;
+ 	}
++
++	if (new)
++		memset(mp->data, 0, PSIZE);
++
+ 	jfs_info("__get_metapage: returning = 0x%p", mp);
+ 	return mp;
+ 
+--- linux-2.4.22/fs/jfs/super.c.jfs-sec	2004-03-23 12:31:10.000000000 -0700
++++ linux-2.4.22/fs/jfs/super.c	2004-03-23 13:01:51.000000000 -0700
+@@ -423,10 +423,10 @@
+ 
+ 	if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) ==
+ 	    SLAB_CTOR_CONSTRUCTOR) {
++		memset(jfs_ip, 0, sizeof(struct jfs_inode_info));
+ 		INIT_LIST_HEAD(&jfs_ip->anon_inode_list);
+ 		init_rwsem(&jfs_ip->rdwrlock);
+ 		init_MUTEX(&jfs_ip->commit_sem);
+-		jfs_ip->atlhead = 0;
+ 		jfs_ip->active_ag = -1;
+ 	}
+ }
diff --git a/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0394.patch b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0394.patch
new file mode 100644
index 000000000000..273f1a52046f
--- /dev/null
+++ b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0394.patch
@@ -0,0 +1,11 @@
+--- linux-2.4.22-oM3-orig/kernel/panic.c	Tue Mar 30 15:37:18 2004
++++ linux-2.4.22-oM3-mod/kernel/panic.c	Mon May 17 18:44:01 2004
+@@ -51,7 +51,7 @@
+ 
+ 	bust_spinlocks(1);
+ 	va_start(args, fmt);
+-	vsprintf(buf, fmt, args);
++	vsnprintf(buf, sizeof(buf), fmt, args);
+ 	va_end(args);
+ 	printk(KERN_EMERG "Kernel panic: %s\n",buf);
+ 	if (in_interrupt())
diff --git a/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0427.patch b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0427.patch
new file mode 100644
index 000000000000..ddc9610f67f8
--- /dev/null
+++ b/sys-kernel/gs-sources/files/gs-sources.CAN-2004-0427.patch
@@ -0,0 +1,14 @@
+diff -Nar -U 4 linux-2.4.25/kernel/fork.c linux-2.4.25-new/kernel/fork.c
+--- linux-2.4.25/kernel/fork.c	2004-02-18 05:36:32.000000000 -0800
++++ linux-2.4.25-new/kernel/fork.c	2004-04-07 17:43:29.000000000 -0700
+@@ -825,8 +825,10 @@
+ bad_fork_cleanup_namespace:
+ 	exit_namespace(p);
+ bad_fork_cleanup_mm:
+ 	exit_mm(p);
++	if (p->active_mm)
++		mmdrop(p->active_mm);
+ bad_fork_cleanup_sighand:
+ 	exit_sighand(p);
+ bad_fork_cleanup_fs:
+ 	exit_fs(p); /* blocking */
diff --git a/sys-kernel/gs-sources/files/gs-sources.rtc_fix.patch b/sys-kernel/gs-sources/files/gs-sources.rtc_fix.patch
deleted file mode 100644
index 76a663c6e89d..000000000000
--- a/sys-kernel/gs-sources/files/gs-sources.rtc_fix.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-diff -urN linux-2.4.23/arch/cris/drivers/ds1302.c linux-2.4.24/arch/cris/drivers/ds1302.c
---- linux-2.4.23/arch/cris/drivers/ds1302.c	2003-08-25 04:44:39.000000000 -0700
-+++ linux-2.4.24/arch/cris/drivers/ds1302.c	2004-01-05 05:53:56.000000000 -0800
-@@ -346,6 +346,7 @@
- 		{
- 			struct rtc_time rtc_tm;
- 						
-+			memset(&rtc_tm, 0, sizeof (struct rtc_time));
- 			get_rtc_time(&rtc_tm);						
- 			if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
- 				return -EFAULT;	
-diff -urN linux-2.4.23/arch/cris/drivers/pcf8563.c linux-2.4.24/arch/cris/drivers/pcf8563.c
---- linux-2.4.23/arch/cris/drivers/pcf8563.c	2003-08-25 04:44:39.000000000 -0700
-+++ linux-2.4.24/arch/cris/drivers/pcf8563.c	2004-01-05 05:53:56.000000000 -0800
-@@ -220,6 +220,7 @@
- 		{
- 			struct rtc_time tm;
- 
-+			memset(&tm, 0, sizeof (struct rtc_time));
- 			get_rtc_time(&tm);
- 
- 			if (copy_to_user((struct rtc_time *) arg, &tm, sizeof tm)) {
-diff -urN linux-2.4.23/arch/m68k/bvme6000/rtc.c linux-2.4.24/arch/m68k/bvme6000/rtc.c
---- linux-2.4.23/arch/m68k/bvme6000/rtc.c	2003-06-13 07:51:31.000000000 -0700
-+++ linux-2.4.24/arch/m68k/bvme6000/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -54,6 +54,7 @@
- 		/* Ensure clock and real-time-mode-register are accessible */
- 		msr = rtc->msr & 0xc0;
- 		rtc->msr = 0x40;
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		do {
- 			wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
- 			wtime.tm_min =  BCD2BIN(rtc->bcd_min);
-diff -urN linux-2.4.23/arch/m68k/mvme16x/rtc.c linux-2.4.24/arch/m68k/mvme16x/rtc.c
---- linux-2.4.23/arch/m68k/mvme16x/rtc.c	2003-06-13 07:51:31.000000000 -0700
-+++ linux-2.4.24/arch/m68k/mvme16x/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -52,6 +52,7 @@
- 		cli();
- 		/* Ensure clock and real-time-mode-register are accessible */
- 		rtc->ctrl = RTC_READ;
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
- 		wtime.tm_min =  BCD2BIN(rtc->bcd_min);
- 		wtime.tm_hour = BCD2BIN(rtc->bcd_hr);
-diff -urN linux-2.4.23/arch/ppc64/kernel/rtc.c linux-2.4.24/arch/ppc64/kernel/rtc.c
---- linux-2.4.23/arch/ppc64/kernel/rtc.c	2003-06-13 07:51:32.000000000 -0700
-+++ linux-2.4.24/arch/ppc64/kernel/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -96,6 +96,7 @@
- 	switch (cmd) {
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ppc_md.get_rtc_time(&wtime);
- 		break;
- 	}
-diff -urN linux-2.4.23/drivers/acorn/char/i2c.c linux-2.4.24/drivers/acorn/char/i2c.c
---- linux-2.4.23/drivers/acorn/char/i2c.c	2003-08-25 04:44:40.000000000 -0700
-+++ linux-2.4.24/drivers/acorn/char/i2c.c	2004-01-05 05:53:56.000000000 -0800
-@@ -166,6 +166,7 @@
- 		break;
- 
- 	case RTC_RD_TIME:
-+		memset(&rtctm, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&rtc_raw, &year);
- 		rtctm.tm_sec  = rtc_raw.secs;
- 		rtctm.tm_min  = rtc_raw.mins;
-diff -urN linux-2.4.23/drivers/char/ds1286.c linux-2.4.24/drivers/char/ds1286.c
---- linux-2.4.23/drivers/char/ds1286.c	2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/ds1286.c	2004-01-05 05:53:56.000000000 -0800
-@@ -173,7 +173,7 @@
- 		 * means "don't care" or "match all". Only the tm_hour,
- 		 * tm_min, and tm_sec values are filled in.
- 		 */
--
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ds1286_get_alm_time(&wtime);
- 		break;
- 	}
-@@ -216,6 +216,7 @@
- 	}
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		ds1286_get_time(&wtime);
- 		break;
- 	}
-diff -urN linux-2.4.23/drivers/char/efirtc.c linux-2.4.24/drivers/char/efirtc.c
---- linux-2.4.23/drivers/char/efirtc.c	2003-06-13 07:51:32.000000000 -0700
-+++ linux-2.4.24/drivers/char/efirtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -118,6 +118,7 @@
- static void
- convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
- {
-+	memset(wtime, 0, sizeof(struct rtc_time));
- 	wtime->tm_sec  = eft->second;
- 	wtime->tm_min  = eft->minute;
- 	wtime->tm_hour = eft->hour;
-diff -urN linux-2.4.23/drivers/char/ip27-rtc.c linux-2.4.24/drivers/char/ip27-rtc.c
---- linux-2.4.23/drivers/char/ip27-rtc.c	2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/ip27-rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -83,6 +83,7 @@
- 	switch (cmd) {
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&wtime);
- 		break;
- 	}
-diff -urN linux-2.4.23/drivers/char/mips_rtc.c linux-2.4.24/drivers/char/mips_rtc.c
---- linux-2.4.23/drivers/char/mips_rtc.c	2003-08-25 04:44:41.000000000 -0700
-+++ linux-2.4.24/drivers/char/mips_rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -82,6 +82,7 @@
- 
- 	switch (cmd) {
- 	case RTC_RD_TIME:	/* Read the time/date from RTC  */
-+		memset(&rtc_tm, 0, sizeof(struct rtc_time));
- 		curr_time = rtc_get_time();
- 		to_tm(curr_time, &rtc_tm);
- 		rtc_tm.tm_year -= 1900;
-diff -urN linux-2.4.23/drivers/char/rtc.c linux-2.4.24/drivers/char/rtc.c
---- linux-2.4.23/drivers/char/rtc.c	2003-11-28 10:26:20.000000000 -0800
-+++ linux-2.4.24/drivers/char/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -362,7 +362,7 @@
- 		 * means "don't care" or "match all". Only the tm_hour,
- 		 * tm_min, and tm_sec values are filled in.
- 		 */
--
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		get_rtc_alm_time(&wtime);
- 		break; 
- 	}
-@@ -406,6 +406,7 @@
- 	}
- 	case RTC_RD_TIME:	/* Read the time/date from RTC	*/
- 	{
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&wtime);
- 		break;
- 	}
-diff -urN linux-2.4.23/drivers/hil/hp_sdc_rtc.c linux-2.4.24/drivers/hil/hp_sdc_rtc.c
---- linux-2.4.23/drivers/hil/hp_sdc_rtc.c	2003-06-13 07:51:33.000000000 -0700
-+++ linux-2.4.24/drivers/hil/hp_sdc_rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -561,6 +561,7 @@
-         }
-         case RTC_ALM_READ:      /* Read the present alarm time */
-         {
-+		memset(&ttime, 0, sizeof(struct timeval));
- 		if (hp_sdc_rtc_read_mt(&ttime)) return -EFAULT;
-                 break;
-         }
-@@ -609,6 +610,7 @@
-         }
-         case RTC_RD_TIME:       /* Read the time/date from RTC  */
-         {
-+		memset(&wtime, 0, sizeof(struct rtc_time));
- 		if (hp_sdc_rtc_read_bbrtc(&wtime)) return -EFAULT;
-                 break;
-         }
-diff -urN linux-2.4.23/drivers/macintosh/rtc.c linux-2.4.24/drivers/macintosh/rtc.c
---- linux-2.4.23/drivers/macintosh/rtc.c	2002-02-25 11:37:58.000000000 -0800
-+++ linux-2.4.24/drivers/macintosh/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -64,6 +64,7 @@
- 	case RTC_RD_TIME:
- 		if (ppc_md.get_rtc_time)
- 		{
-+			memset(&rtc_tm, 0, sizeof(struct rtc_time));
- 			get_rtc_time(&rtc_tm);
- 
- 			if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
-diff -urN linux-2.4.23/drivers/sbus/char/rtc.c linux-2.4.24/drivers/sbus/char/rtc.c
---- linux-2.4.23/drivers/sbus/char/rtc.c	2001-10-10 23:42:47.000000000 -0700
-+++ linux-2.4.24/drivers/sbus/char/rtc.c	2004-01-05 05:53:56.000000000 -0800
-@@ -89,6 +89,7 @@
- 	switch (cmd)
- 	{
- 	case RTCGET:
-+		memset(&rtc_tm, 0, sizeof(struct rtc_time));
- 		get_rtc_time(&rtc_tm);
- 
- 		if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))