## Automatically generated incremental diff
## From:   linux-2.2.27-rc1
## To:     linux-2.2.27-rc2
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.2.27-rc1/ChangeLog-2.2.27 linux-2.2.27-rc2/ChangeLog-2.2.27
--- linux-2.2.27-rc1/ChangeLog-2.2.27	2005-01-12 16:02:14.883432461 -0800
+++ linux-2.2.27-rc2/ChangeLog-2.2.27	2005-01-12 16:02:16.585505613 -0800
@@ -21,28 +21,44 @@
 
 
 
+2.2.27-rc2
+----------
+o	CAN-2005-0001: fixed expand_stack() SMP race		(Redhat)
+o	CAN-2004-0883, CAN-2004-0949: smbfs: fixed client	(Stefan Esser)
+	  overflow. There are two bugs in the handling of SMB
+	  responses that result in remote kernel overflows. Due
+	  to the nature of the bugs both seem to be very hard
+	  to exploit (in the sense of remote code execution or
+	  local privilege escalation) but are trivial remote
+	  kernel crashes.
+o	rose_rt_ioctl: lack of bounds checking			(Coverity)
+o	sdla_xfer: lack of bounds checking			(Coverity)
+o	coda: bounds checking for tainted scalars		(Coverity)
+o	sendmsg compat wrapper fixes for 64bit compat mode	(Olaf Kirch)
+
+
+
 2.2.27-rc1
 ----------
 o	CAN-2004-0497: fixed missing DAC check on sys_chown	(Thomas Biege)
-o       CAN-2004-1016: fixed a buffer overflow vulnerability	(Paul Starzetz)
-          in the "__scm_send" function which handles the sending
-          of UDP network packets. A wrong validity check of the
-          cmsghdr structure allowed a local attacker to modify
-          kernel memory, thus causing an endless loop (DoS) or
-          possibly even root privilege escalation.
-o       CAN-2004-1333: fixed integer overflow in the vc_resize	(Georgi Guninski)
-          function allows local users to cause a denial of
-          service (kernel crash) via a short new screen value,
-          which leads to a buffer overflow. Make sure VC
-          resizing fits in s16.
-o       If the user makes ip_cmsg_send call ip_options_get	(Georgi Guninski)
-          multiple times, we leak kmalloced IP options data.
-o       fixed moxa serial bound checking issue			(Alan Cox)
+o	CAN-2004-1016: fixed a buffer overflow vulnerability	(Paul Starzetz)
+	  in the "__scm_send" function which handles the sending
+	  of UDP network packets. A wrong validity check of the
+	  cmsghdr structure allowed a local attacker to modify
+	  kernel memory, thus causing an endless loop (DoS) or
+	  possibly even root privilege escalation.
+o	CAN-2004-1333: fixed integer overflow in the vc_resize	(Georgi Guninski)
+	  function allows local users to cause a denial of
+	  service (kernel crash) via a short new screen value,
+	  which leads to a buffer overflow. Make sure VC
+	  resizing fits in s16.
+o	If the user makes ip_cmsg_send call ip_options_get	(Georgi Guninski)
+	  multiple times, we leak kmalloced IP options data.
+o	fixed moxa serial bound checking issue			(Alan Cox)
 o	menu cleanups						(me)
 
 
 
-
 2.2.27-pre2
 -----------
 o	A more correct fix to last mremap (2) bug		(Dan Yefimov/Solar Designer)
diff -urN linux-2.2.27-rc1/MAINTAINERS linux-2.2.27-rc2/MAINTAINERS
--- linux-2.2.27-rc1/MAINTAINERS	2005-01-12 16:02:14.899433149 -0800
+++ linux-2.2.27-rc2/MAINTAINERS	2005-01-12 16:02:16.600506258 -0800
@@ -880,10 +880,8 @@
 
 SMB FILESYSTEM
 P:	Urban Widmark
-M:	urban@svenskatest.se
-W:	http://samba.org/
-L:	samba@samba.org
-S:	Maintained
+M:	Urban.Widmark@enlight.net
+S:	Odd Fixes
 
 SMP: (except SPARC)
 P:	Linus Torvalds
diff -urN linux-2.2.27-rc1/Makefile linux-2.2.27-rc2/Makefile
--- linux-2.2.27-rc1/Makefile	2005-01-12 16:02:14.899433149 -0800
+++ linux-2.2.27-rc2/Makefile	2005-01-12 16:02:16.601506301 -0800
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 2
 SUBLEVEL = 27
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 
 ARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ -e s/arm.*/arm/ -e s/sa110/arm/)
 
diff -urN linux-2.2.27-rc1/arch/sparc64/kernel/sys_sparc32.c linux-2.2.27-rc2/arch/sparc64/kernel/sys_sparc32.c
--- linux-2.2.27-rc1/arch/sparc64/kernel/sys_sparc32.c	2001-11-02 08:39:06.000000000 -0800
+++ linux-2.2.27-rc2/arch/sparc64/kernel/sys_sparc32.c	2005-01-12 16:02:16.617506989 -0800
@@ -2183,6 +2183,11 @@
 				    (struct cmsghdr32 *)(ctl) : \
 				    (struct cmsghdr32 *)NULL)
 #define CMSG32_FIRSTHDR(msg)	__CMSG32_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
+#define CMSG32_OK(ucmlen, ucmsg, mhdr) \
+	((ucmlen) >= sizeof(struct cmsghdr32) && \
+	 (ucmlen) <= (unsigned long) \
+	 ((mhdr)->msg_controllen - \
+	  ((char *)(ucmsg) - (char *)(mhdr)->msg_control)))
 
 __inline__ struct cmsghdr32 *__cmsg32_nxthdr(void *__ctl, __kernel_size_t __size,
 					      struct cmsghdr32 *__cmsg, int __cmsg_len)
@@ -2309,11 +2314,7 @@
 			return -EFAULT;
 
 		/* Catch bogons. */
-		if(CMSG32_ALIGN(ucmlen) <
-		   CMSG32_ALIGN(sizeof(struct cmsghdr32)))
-			return -EINVAL;
-		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
-				   + ucmlen) > kmsg->msg_controllen)
+		if (!CMSG32_OK(ucmlen, ucmsg, kmsg))
 			return -EINVAL;
 
 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
diff -urN linux-2.2.27-rc1/fs/coda/upcall.c linux-2.2.27-rc2/fs/coda/upcall.c
--- linux-2.2.27-rc1/fs/coda/upcall.c	2001-03-25 08:31:02.000000000 -0800
+++ linux-2.2.27-rc2/fs/coda/upcall.c	2005-01-12 16:02:16.640507977 -0800
@@ -517,6 +517,11 @@
 		goto exit;
         }
 
+	if (data->vi.out_size > VC_MAXDATASIZE) {
+		error = EINVAL;
+		goto exit;
+	}
+
         inp->coda_ioctl.VFid = *fid;
     
         /* the cmd field was mutated by increasing its size field to
@@ -544,26 +549,30 @@
 		       error, coda_f2s(fid));
 		goto exit; 
 	}
-        
-	/* Copy out the OUT buffer. */
+
+	if (outsize < (int)outp->coda_ioctl.data + outp->coda_ioctl.len) {
+                CDEBUG(D_FILE, "reply size %d < reply len %ld\n", outsize,
+		       (int)outp->coda_ioctl.data + outp->coda_ioctl.len);
+		error = EINVAL;
+		goto exit;
+	}
+
         if (outp->coda_ioctl.len > data->vi.out_size) {
-                CDEBUG(D_FILE, "return len %d <= request len %d\n",
-                      outp->coda_ioctl.len, 
-                      data->vi.out_size);
+                CDEBUG(D_FILE, "return len %d > request len %d\n",
+		       outp->coda_ioctl.len, data->vi.out_size);
                 error = EINVAL;
-        } else {
-		error = verify_area(VERIFY_WRITE, data->vi.out, 
-                                    data->vi.out_size);
-		if ( error ) goto exit;
-
-		if (copy_to_user(data->vi.out, 
-				 (char *)outp + (int)outp->coda_ioctl.data, 
-				 data->vi.out_size)) {
-		        error = EINVAL;
-			goto exit;
-		}
+		goto exit;
         }
 
+	/* Copy out the OUT buffer. */
+	error = verify_area(VERIFY_WRITE, data->vi.out, outp->coda_ioctl.len);
+	if ( error ) goto exit;
+
+	if (copy_to_user(data->vi.out, 
+			 (char *)outp + (int)outp->coda_ioctl.data, 
+			 outp->coda_ioctl.len)) {
+	    error = EINVAL;
+	}
  exit:
 	CODA_FREE(inp, insize);
 	return error;
diff -urN linux-2.2.27-rc1/fs/smbfs/proc.c linux-2.2.27-rc2/fs/smbfs/proc.c
--- linux-2.2.27-rc1/fs/smbfs/proc.c	2001-11-02 08:39:08.000000000 -0800
+++ linux-2.2.27-rc2/fs/smbfs/proc.c	2005-01-12 16:02:16.644508149 -0800
@@ -1108,10 +1108,12 @@
 	data_len = WVAL(buf, 1);
 
 	/* we can NOT simply trust the data_len given by the server ... */
-	if (data_len > server->packet_size - (buf+3 - server->packet)) {
-		printk(KERN_ERR "smb_proc_read: invalid data length!! "
-		       "%d > %d - (%p - %p)\n",
-		       data_len, server->packet_size, buf+3, server->packet);
+	if (data_len > count ||
+		(buf+3 - server->packet) + data_len > server->packet_size) {
+		printk(KERN_ERR "smb_proc_read: invalid data length/offset!! "
+		       "%d > %d || (%p - %p) + %d > %d\n",
+		       data_len, count,
+		       buf+3, server->packet, data_len, server->packet_size);
 		result = -EIO;
 		goto out;
 	}
diff -urN linux-2.2.27-rc1/fs/smbfs/sock.c linux-2.2.27-rc2/fs/smbfs/sock.c
--- linux-2.2.27-rc1/fs/smbfs/sock.c	2001-03-25 08:30:59.000000000 -0800
+++ linux-2.2.27-rc2/fs/smbfs/sock.c	2005-01-12 16:02:16.644508149 -0800
@@ -510,9 +510,12 @@
 				VERBOSE("fast track, parm=%u %u %u, data=%u %u %u\n",
 					parm_disp, parm_offset, parm_count, 
 					data_disp, data_offset, data_count);
-
 				*parm  = base + parm_offset;
+				if (*parm - inbuf + parm_tot > server->packet_size)
+					goto out_bad_parm;
 				*data  = base + data_offset;
+				if (*data - inbuf + data_tot > server->packet_size)
+					goto out_bad_data;
 				goto success;
 			}
 
@@ -534,6 +537,8 @@
 			rcv_buf = smb_vmalloc(buf_len);
 			if (!rcv_buf)
 				goto out_no_mem;
+			memset(rcv_buf, 0, buf_len);
+			
 			*parm = rcv_buf;
 			*data = rcv_buf + total_p;
 		} else if (data_tot > total_d || parm_tot > total_p)
@@ -541,8 +546,12 @@
 
 		if (parm_disp + parm_count > total_p)
 			goto out_bad_parm;
+		if (parm_offset + parm_count > server->packet_size)	
+			goto out_bad_parm;
 		if (data_disp + data_count > total_d)
 			goto out_bad_data;
+		if (data_offset + data_count > server->packet_size)	
+			goto out_bad_data;
 		memcpy(*parm + parm_disp, base + parm_offset, parm_count);
 		memcpy(*data + data_disp, base + data_offset, data_count);
 
@@ -553,8 +562,11 @@
 		 * Check whether we've received all of the data. Note that
 		 * we use the packet totals -- total lengths might shrink!
 		 */
-		if (data_len >= data_tot && parm_len >= parm_tot)
+		if (data_len >= data_tot && parm_len >= parm_tot) {
+			data_len = data_tot;
+			parm_len = parm_tot;
 			break;
+		}
 	}
 
 	/*
@@ -568,6 +580,9 @@
 		server->packet = rcv_buf;
 		rcv_buf = inbuf;
 	} else {
+		if (parm_len + data_len > buf_len)
+			goto out_data_grew;
+
 		PARANOIA("copying data, old size=%d, new size=%u\n",
 			 server->packet_size, buf_len);
 		memcpy(inbuf, rcv_buf, parm_len + data_len);
diff -urN linux-2.2.27-rc1/include/linux/coda.h linux-2.2.27-rc2/include/linux/coda.h
--- linux-2.2.27-rc1/include/linux/coda.h	2001-03-25 08:31:04.000000000 -0800
+++ linux-2.2.27-rc2/include/linux/coda.h	2005-01-12 16:02:16.645508192 -0800
@@ -774,8 +774,8 @@
 #define PIOCPARM_MASK 0x0000ffff
 struct ViceIoctl {
         caddr_t in, out;        /* Data to be transferred in, or out */
-        short in_size;          /* Size of input buffer <= 2K */
-        short out_size;         /* Maximum size of output buffer, <= 2K */
+        u_short in_size;        /* Size of input buffer <= 2K */
+        u_short out_size;       /* Maximum size of output buffer, <= 2K */
 };
 
 struct PioctlData {
diff -urN linux-2.2.27-rc1/include/linux/mm.h linux-2.2.27-rc2/include/linux/mm.h
--- linux-2.2.27-rc1/include/linux/mm.h	2004-02-24 09:33:32.000000000 -0800
+++ linux-2.2.27-rc2/include/linux/mm.h	2005-01-12 16:02:16.646508235 -0800
@@ -354,6 +354,10 @@
 	unsigned long grow;
 
 	address &= PAGE_MASK;
+
+	if (vma->vm_start <= address)
+		return 0;
+
 	grow = vma->vm_start - address;
 	if ((vma->vm_end - address
 	    > current->rlim[RLIMIT_STACK].rlim_cur) ||
diff -urN linux-2.2.27-rc1/net/rose/rose_route.c linux-2.2.27-rc2/net/rose/rose_route.c
--- linux-2.2.27-rc1/net/rose/rose_route.c	2001-03-25 08:31:13.000000000 -0800
+++ linux-2.2.27-rc2/net/rose/rose_route.c	2005-01-12 16:02:16.664509009 -0800
@@ -629,6 +629,9 @@
 			if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
 				return -EINVAL;
 
+			if (rose_route.ndigis > 8) /* No more than 8 digipeats */
+				return -EINVAL;
+
 			return rose_add_node(&rose_route, dev);
 
 		case SIOCDELRT:
