Added security patches for 2.6.x kernels for the following vulns: CAN-2004-0495, CAN-2004-0496, CAN-2004-0497, & CAN-2004-0596.

13 files changed, 1043 insertions, 36 deletions

diff --git a/sys-kernel/mips-sources/ChangeLog b/sys-kernel/mips-sources/ChangeLog
index 5a71632a2d72..a4361d289b58 100644
--- a/sys-kernel/mips-sources/ChangeLog
+++ b/sys-kernel/mips-sources/ChangeLog
@@ -1,6 +1,18 @@
 # ChangeLog for sys-kernel/mips-sources
 # Copyright 2002-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/ChangeLog,v 1.48 2004/07/13 09:28:43 kumba Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/ChangeLog,v 1.49 2004/07/23 01:54:38 kumba Exp $
+
+*mips-sources-2.6.5-r4 (22 Jul 2004)
+
+  22 Jul 2004; Joshua Kinard <kumba@gentoo.org>
+  +files/CAN-2004-0495_0496-2.6-sparse.patch,
+  +files/CAN-2004-0497-2.6-attr_gid.patch, +files/CAN-2004-0596-2.6-eql.patch,
+  -mips-sources-2.6.4-r4.ebuild, +mips-sources-2.6.4-r5.ebuild,
+  -mips-sources-2.6.5-r3.ebuild, +mips-sources-2.6.5-r4.ebuild,
+  -mips-sources-2.6.6-r2.ebuild, +mips-sources-2.6.6-r3.ebuild,
+  -mips-sources-2.6.7-r1.ebuild, +mips-sources-2.6.7-r2.ebuild:
+  Added security patches for 2.6.x kernels for the following vulns:
+  CAN-2004-0495, CAN-2004-0496, CAN-2004-0497, & CAN-2004-0596.
 
 *mips-sources-2.4.26-r4 (13 Jul 2004)
 
diff --git a/sys-kernel/mips-sources/Manifest b/sys-kernel/mips-sources/Manifest
index 2f7c833cc149..31ac62f5c693 100644
--- a/sys-kernel/mips-sources/Manifest
+++ b/sys-kernel/mips-sources/Manifest
@@ -1,41 +1,44 @@
-MD5 1bc51ca8a4d4fe12de6aa60718c52bf2 mips-sources-2.6.5-r3.ebuild 3442
-MD5 5d26b3d99696abdc1254f059070a01b1 mips-sources-2.6.6-r2.ebuild 2929
-MD5 e586436895900cdc5f9affe6a2a49659 mips-sources-2.4.26-r4.ebuild 2159
-MD5 51be9f07387cd67fc1e0930ca22bfc68 mips-sources-2.6.7-r1.ebuild 2970
+MD5 1ecb6f1a34c40c2b40c85baa51d8c94d ChangeLog 17529
+MD5 ad25a2a0b6ade60c13ad8040f3c319c6 metadata.xml 378
 MD5 45a85264645dca2b1b96dd9cea7214a4 mips-sources-2.4.25-r4.ebuild 2802
 MD5 9cc9e13952d9f6cb99ab8cc83bf7ca1a mips-sources-2.4.26-r3.ebuild 2159
-MD5 8844236c0385231b34d54630f74377f1 mips-sources-2.6.4-r4.ebuild 3306
-MD5 f11f0b3f73f212f0c776e2423a418bc3 ChangeLog 16929
-MD5 ad25a2a0b6ade60c13ad8040f3c319c6 metadata.xml 378
-MD5 5674421c7e2c7e50e2509bed7d96c4d4 files/CAN-2004-0427-2.6-do_fork.patch 332
+MD5 7f9f0b9a1286a82e3dfd6ba8bde1984c mips-sources-2.6.4-r5.ebuild 3463
+MD5 32ec4576d091948ffbc7486be647fe33 mips-sources-2.6.5-r4.ebuild 3531
+MD5 872553ec0758055e9c8cffd1e1fa4b99 mips-sources-2.6.6-r3.ebuild 3086
+MD5 40e0ddafb10021b4b65b7a24ab65fa09 mips-sources-2.6.7-r2.ebuild 3070
+MD5 e586436895900cdc5f9affe6a2a49659 mips-sources-2.4.26-r4.ebuild 2159
+MD5 6f4bba5dda7a99d77b1564f5489fef6e files/CAN-2004-0075-2.6-vicam_usb.patch 1129
+MD5 21f3a4f186017d925067335e24db36a1 files/CAN-2004-0109-2.4-iso9660.patch 1877
 MD5 31ec7b4310dd7be3e34aab0204f9b1e8 files/CAN-2004-0109-2.6-iso9660.patch 2072
-MD5 c65ca9f967d25e79aadfe387f7ce6fa3 files/mipscvs-2.6.x-no-page-align.patch 483
-MD5 1dd59d14a720c0c23e47e28d0b4fd6f9 files/CAN-2004-0228-cpufreq.patch 437
-MD5 de75cfa969ed092578d9ddda6c5be334 files/CAN-2004-0181-2.4-jfs_ext3.patch 1233
 MD5 5bf9836a632a861728d33f9736bb7431 files/CAN-2004-0133-xfs_ext3.patch 427
+MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/CAN-2004-0177-ext3_jbd.patch 384
+MD5 ac42024b6e6ee1e2165914db4b22a61c files/CAN-2004-0178-sbblaster.patch 424
+MD5 de75cfa969ed092578d9ddda6c5be334 files/CAN-2004-0181-2.4-jfs_ext3.patch 1233
+MD5 c8b7be9ee0da1415fa0274da5859aa62 files/CAN-2004-0181-2.6-jfs_ext3.patch 1366
+MD5 1dd59d14a720c0c23e47e28d0b4fd6f9 files/CAN-2004-0228-cpufreq.patch 437
+MD5 a92712e41465c49670ef7a54c2d16040 files/CAN-2004-0229-fb_copy_cmap.patch 471
 MD5 d4a740ae56c2049247083af387a22a85 files/CAN-2004-0394-panic.patch 350
-MD5 95ba3093147f4188db0ea4949e4317cf files/mipscvs-2.4.25-makefile-inlinelimit.patch 1588
+MD5 c460ea130cb4ae84a5063ba044e3ce72 files/CAN-2004-0427-2.4-do_fork.patch 460
+MD5 5674421c7e2c7e50e2509bed7d96c4d4 files/CAN-2004-0427-2.6-do_fork.patch 332
 MD5 5c6bf5770bf59976861382f45bdeb7ff files/digest-mips-sources-2.4.25-r4 217
 MD5 098807e58d4f8bc7efcaea114ba28fcd files/digest-mips-sources-2.4.26-r3 218
-MD5 1e86c5a6d88da0ee787ddda716a86502 files/digest-mips-sources-2.4.26-r4 218
-MD5 db1aaa77e691906f3857e54e363c4ff4 files/mipscvs-2.6.5-unistd-linkage.patch 515
-MD5 a92712e41465c49670ef7a54c2d16040 files/CAN-2004-0229-fb_copy_cmap.patch 471
-MD5 eaeda68a619caaddd5b8fdc5e7c39932 files/CAN-2004-0177-ext3_jbd.patch 384
-MD5 497365345d8a39da49a8bd2495a17d8c files/digest-mips-sources-2.6.4-r4 299
-MD5 eb9f26d678449f22ce5b7c00762eeb91 files/digest-mips-sources-2.6.5-r3 299
-MD5 ff47ec7e8b4282773743aa192d3a73b6 files/digest-mips-sources-2.6.6-r2 299
-MD5 5b7a4b7f8c4baea56b4cd1332cb0948b files/digest-mips-sources-2.6.7-r1 299
+MD5 eb70acb35ba13daa4b1fda53cb61fc01 files/CAN-2004-0495_0496-2.6-sparse.patch 23861
+MD5 95708646470a95668e8789cd415844ed files/CAN-2004-0497-2.6-attr_gid.patch 846
+MD5 8204afea1d572b49a4a80d8da4eef0c9 files/CAN-2004-0596-2.6-eql.patch 1033
+MD5 497365345d8a39da49a8bd2495a17d8c files/digest-mips-sources-2.6.4-r5 299
 MD5 fbb6766828584e454bf053286aad6207 files/mipscvs-2.4.25-makefile-fix.patch 428
-MD5 6f4bba5dda7a99d77b1564f5489fef6e files/CAN-2004-0075-2.6-vicam_usb.patch 1129
-MD5 008eff91c704bd23097666a1cd94ada3 files/mipscvs-2.6.5-swapbug-fix.patch 1329
-MD5 c8b7be9ee0da1415fa0274da5859aa62 files/CAN-2004-0181-2.6-jfs_ext3.patch 1366
-MD5 0f66013f643c79c97fda489618a4e2fd files/CAN-2004-0535-2.4-e1000.patch 476
+MD5 95ba3093147f4188db0ea4949e4317cf files/mipscvs-2.4.25-makefile-inlinelimit.patch 1588
+MD5 764740b749fd1f81313aa941c55000ac files/mipscvs-2.4.25-no-page-align.patch 1013
 MD5 fbb6766828584e454bf053286aad6207 files/mipscvs-2.4.26-makefile-fix.patch 428
-MD5 c460ea130cb4ae84a5063ba044e3ce72 files/CAN-2004-0427-2.4-do_fork.patch 460
-MD5 dc18e982f8149588a291956481885a8c files/CAN-2004-0495-2.4-sparse.patch 17549
-MD5 21f3a4f186017d925067335e24db36a1 files/CAN-2004-0109-2.4-iso9660.patch 1877
+MD5 008eff91c704bd23097666a1cd94ada3 files/mipscvs-2.6.5-swapbug-fix.patch 1329
+MD5 db1aaa77e691906f3857e54e363c4ff4 files/mipscvs-2.6.5-unistd-linkage.patch 515
 MD5 2802496e6b2dcc4e5ff19fac6826c7f7 files/mipscvs-2.6.7-maceisa_rtc_irq-fix.patch 339
-MD5 ac42024b6e6ee1e2165914db4b22a61c files/CAN-2004-0178-sbblaster.patch 424
+MD5 c65ca9f967d25e79aadfe387f7ce6fa3 files/mipscvs-2.6.x-no-page-align.patch 483
 MD5 fd5b99bc2a9e4c7f9825c9aab6a76b52 files/misc-2.6-iptables_headers.patch 1786
-MD5 764740b749fd1f81313aa941c55000ac files/mipscvs-2.4.25-no-page-align.patch 1013
+MD5 dc18e982f8149588a291956481885a8c files/CAN-2004-0495-2.4-sparse.patch 17549
+MD5 0f66013f643c79c97fda489618a4e2fd files/CAN-2004-0535-2.4-e1000.patch 476
 MD5 c91330cc5b4044b6f59696095c2dc0fb files/CAN-2004-0626-death_packet.patch 423
+MD5 1e86c5a6d88da0ee787ddda716a86502 files/digest-mips-sources-2.4.26-r4 218
+MD5 eb9f26d678449f22ce5b7c00762eeb91 files/digest-mips-sources-2.6.5-r4 299
+MD5 ff47ec7e8b4282773743aa192d3a73b6 files/digest-mips-sources-2.6.6-r3 299
+MD5 5b7a4b7f8c4baea56b4cd1332cb0948b files/digest-mips-sources-2.6.7-r2 299
diff --git a/sys-kernel/mips-sources/files/CAN-2004-0495_0496-2.6-sparse.patch b/sys-kernel/mips-sources/files/CAN-2004-0495_0496-2.6-sparse.patch
new file mode 100644
index 000000000000..6f67f9fdc912
--- /dev/null
+++ b/sys-kernel/mips-sources/files/CAN-2004-0495_0496-2.6-sparse.patch
@@ -0,0 +1,911 @@
+# <plasmaroo@gentoo.org>
+# This is a patch which should fix both CAN-2004-0495 and CAN-2004-0496 on 2.6...
+
+# * -0495 applies to 2.4 as well; use a separate patch for that.
+# * -0496 is a 2.6 only issue which this patch addresses.
+
+--- 1.20/net/decnet/dn_dev.c	2004-07-21 14:50:27 -07:00
++++ 1.21/net/decnet/dn_dev.c	2004-07-21 14:50:27 -07:00
+@@ -1294,35 +1294,43 @@
+  * it as a compile time option. Probably you should use the
+  * rtnetlink interface instead.
+  */
+-int dnet_gifconf(struct net_device *dev, char *buf, int len)
++int dnet_gifconf(struct net_device *dev, char __user *buf, int len)
+ {
+ 	struct dn_dev *dn_db = (struct dn_dev *)dev->dn_ptr;
+ 	struct dn_ifaddr *ifa;
+-	struct ifreq *ifr = (struct ifreq *)buf;
++	char buffer[DN_IFREQ_SIZE];
++	struct ifreq *ifr = (struct ifreq *)buffer;
++	struct sockaddr_dn *addr = (struct sockaddr_dn *)&ifr->ifr_addr;
+ 	int done = 0;
+ 
+ 	if ((dn_db == NULL) || ((ifa = dn_db->ifa_list) == NULL))
+ 		return 0;
+ 
+ 	for(; ifa; ifa = ifa->ifa_next) {
+-		if (!ifr) {
++		if (!buf) {
+ 			done += sizeof(DN_IFREQ_SIZE);
+ 			continue;
+ 		}
+ 		if (len < DN_IFREQ_SIZE)
+ 			return done;
+-		memset(ifr, 0, DN_IFREQ_SIZE);
++		memset(buffer, 0, DN_IFREQ_SIZE);
+ 
+ 		if (ifa->ifa_label)
+ 			strcpy(ifr->ifr_name, ifa->ifa_label);
+ 		else
+ 			strcpy(ifr->ifr_name, dev->name);
+ 
+-		(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_family = AF_DECnet;
+-		(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_len = 2;
+-		(*(dn_address *)(*(struct sockaddr_dn *) &ifr->ifr_addr).sdn_add.a_addr) = ifa->ifa_local;
++		addr->sdn_family = AF_DECnet;
++		addr->sdn_add.a_len = 2;
++		memcpy(addr->sdn_add.a_addr, &ifa->ifa_local,
++			sizeof(dn_address));
+ 
+-		ifr = (struct ifreq *)((char *)ifr + DN_IFREQ_SIZE);
++		if (copy_to_user(buf, buffer, DN_IFREQ_SIZE)) {
++			done = -EFAULT;
++			break;
++		}
++
++		buf  += DN_IFREQ_SIZE;
+ 		len  -= DN_IFREQ_SIZE;
+ 		done += DN_IFREQ_SIZE;
+ 	}
+--- 1.90/drivers/net/wireless/airo.c	2004-07-21 14:48:16 -07:00
++++ 1.91/drivers/net/wireless/airo.c	2004-07-21 14:48:16 -07:00
+@@ -4272,12 +4272,12 @@
+  */
+ 
+ static ssize_t proc_read( struct file *file,
+-			  char *buffer,
++			  char __user *buffer,
+ 			  size_t len,
+ 			  loff_t *offset);
+ 
+ static ssize_t proc_write( struct file *file,
+-			   const char *buffer,
++			   const char __user *buffer,
+ 			   size_t len,
+ 			   loff_t *offset );
+ static int proc_close( struct inode *inode, struct file *file );
+@@ -4482,23 +4482,26 @@
+  *  to supply the data.
+  */
+ static ssize_t proc_read( struct file *file,
+-			  char *buffer,
++			  char __user *buffer,
+ 			  size_t len,
+ 			  loff_t *offset )
+ {
+-	int i;
+-	int pos;
++	loff_t pos = *offset;
+ 	struct proc_data *priv = (struct proc_data*)file->private_data;
+ 
+-	if( !priv->rbuffer ) return -EINVAL;
++	if (!priv->rbuffer)
++		return -EINVAL;
+ 
+-	pos = *offset;
+-	for( i = 0; i+pos < priv->readlen && i < len; i++ ) {
+-		if (put_user( priv->rbuffer[i+pos], buffer+i ))
+-			return -EFAULT;
+-	}
+-	*offset += i;
+-	return i;
++	if (pos < 0)
++		return -EINVAL;
++	if (pos >= priv->readlen)
++		return 0;
++	if (len > priv->readlen - pos)
++		len = priv->readlen - pos;
++	if (copy_to_user(buffer, priv->rbuffer + pos, len))
++		return -EFAULT;
++	*offset = pos + len;
++	return len;
+ }
+ 
+ /*
+@@ -4506,28 +4509,26 @@
+  *  to supply the data.
+  */
+ static ssize_t proc_write( struct file *file,
+-			   const char *buffer,
++			   const char __user *buffer,
+ 			   size_t len,
+ 			   loff_t *offset )
+ {
+-	int i;
+-	int pos;
++	loff_t pos = *offset;
+ 	struct proc_data *priv = (struct proc_data*)file->private_data;
+ 
+-	if ( !priv->wbuffer ) {
++	if (!priv->wbuffer)
+ 		return -EINVAL;
+-	}
+-
+-	pos = *offset;
+ 
+-	for( i = 0; i + pos <  priv->maxwritelen &&
+-		     i < len; i++ ) {
+-		if (get_user( priv->wbuffer[i+pos], buffer + i ))
+-			return -EFAULT;
+-	}
+-	if ( i+pos > priv->writelen ) priv->writelen = i+file->f_pos;
+-	*offset += i;
+-	return i;
++	if (pos < 0)
++		return -EINVAL;
++	if (pos >= priv->maxwritelen)
++		return 0;
++	if (len > priv->maxwritelen - pos)
++		len = priv->maxwritelen - pos;
++	if (copy_from_user(priv->wbuffer + pos, buffer, len))
++		return -EFAULT;
++	*offset = pos + len;
++	return len;
+ }
+ 
+ static int proc_status_open( struct inode *inode, struct file *file ) {
+--- 1.14/sound/oss/mpu401.c	2004-07-21 14:44:27 -07:00
++++ 1.15/sound/oss/mpu401.c	2004-07-21 14:44:27 -07:00
+@@ -728,7 +728,7 @@
+ 	return 0;
+ }
+ 
+-static int mpu401_ioctl(int dev, unsigned cmd, caddr_t arg)
++static int mpu401_ioctl(int dev, unsigned cmd, void __user *arg)
+ {
+ 	struct mpu_config *devc;
+ 	mpu_command_rec rec;
+@@ -742,7 +742,7 @@
+ 				printk(KERN_WARNING "mpu401: Intelligent mode not supported by the HW\n");
+ 				return -EINVAL;
+ 			}
+-			if (get_user(val, (int *)arg))
++			if (get_user(val, (int __user *)arg))
+ 				return -EFAULT;
+ 			set_uart_mode(dev, devc, !val);
+ 			return 0;
+@@ -772,8 +772,7 @@
+ 				 */
+ }
+ 
+-static int mpu_synth_ioctl(int dev,
+-		unsigned int cmd, caddr_t arg)
++static int mpu_synth_ioctl(int dev, unsigned int cmd, void __user *arg)
+ {
+ 	int midi_dev;
+ 	struct mpu_config *devc;
+@@ -789,8 +788,7 @@
+ 	{
+ 
+ 		case SNDCTL_SYNTH_INFO:
+-			if (copy_to_user((&((char *) arg)[0]),
+-					(char *) &mpu_synth_info[midi_dev],
++			if (copy_to_user(arg, &mpu_synth_info[midi_dev],
+ 					sizeof(struct synth_info)))
+ 				return -EFAULT;
+ 			return 0;
+@@ -1508,17 +1506,19 @@
+ 	return curr_ticks;
+ }
+ 
+-static int mpu_timer_ioctl(int dev, unsigned int command, caddr_t arg)
++static int mpu_timer_ioctl(int dev, unsigned int command, void __user *arg)
+ {
+ 	int midi_dev = sound_timer_devs[dev]->devlink;
++	int __user *p = (int __user *)arg;
+ 
+ 	switch (command)
+ 	{
+ 		case SNDCTL_TMR_SOURCE:
+ 			{
+ 				int parm;
+-	
+-				parm = *(int *) arg;
++
++				if (get_user(parm, p))
++					return -EFAULT;
+ 				parm &= timer_caps;
+ 
+ 				if (parm != 0)
+@@ -1530,7 +1530,9 @@
+ 					else if (timer_mode & TMR_MODE_SMPTE)
+ 						mpu_cmd(midi_dev, 0x3d, 0);		/* Use SMPTE sync */
+ 				}
+-				return (*(int *) arg = timer_mode);
++				if (put_user(timer_mode, p))
++					return -EFAULT;
++				return timer_mode;
+ 			}
+ 			break;
+ 
+@@ -1554,11 +1556,13 @@
+ 		case SNDCTL_TMR_TIMEBASE:
+ 			{
+ 				int val;
+-
+-				val = *(int *) arg;
++				if (get_user(val, p))
++					return -EFAULT;
+ 				if (val)
+ 					set_timebase(midi_dev, val);
+-				return (*(int *) arg = curr_timebase);
++				if (put_user(curr_timebase, p))
++					return -EFAULT;
++				return curr_timebase;
+ 			}
+ 			break;
+ 
+@@ -1567,7 +1571,8 @@
+ 				int val;
+ 				int ret;
+ 
+-				val = *(int *) arg;
++				if (get_user(val, p))
++					return -EFAULT;
+ 
+ 				if (val)
+ 				{
+@@ -1582,26 +1587,35 @@
+ 					}
+ 					curr_tempo = val;
+ 				}
+-				return (*(int *) arg = curr_tempo);
++				if (put_user(curr_tempo, p))
++					return -EFAULT;
++				return curr_tempo;
+ 			}
+ 			break;
+ 
+ 		case SNDCTL_SEQ_CTRLRATE:
+ 			{
+ 				int val;
++				if (get_user(val, p))
++					return -EFAULT;
+ 
+-				val = *(int *) arg;
+ 				if (val != 0)		/* Can't change */
+ 					return -EINVAL;
+-				return (*(int *) arg = ((curr_tempo * curr_timebase) + 30) / 60);
++				val = ((curr_tempo * curr_timebase) + 30)/60;
++				if (put_user(val, p))
++					return -EFAULT;
++				return val;
+ 			}
+ 			break;
+ 
+ 		case SNDCTL_SEQ_GETTIME:
+-			return (*(int *) arg = curr_ticks);
++			if (put_user(curr_ticks, p))
++				return -EFAULT;
++			return curr_ticks;
+ 
+ 		case SNDCTL_TMR_METRONOME:
+-			metronome_mode = *(int *) arg;
++			if (get_user(metronome_mode, p))
++				return -EFAULT;
+ 			setup_metronome(midi_dev);
+ 			return 0;
+ 
+--- 1.11/drivers/acpi/asus_acpi.c	2004-07-21 14:16:19 -07:00
++++ 1.12/drivers/acpi/asus_acpi.c	2004-07-21 14:16:19 -07:00
+@@ -40,6 +40,7 @@
+ #include <linux/proc_fs.h>
+ #include <acpi/acpi_drivers.h>
+ #include <acpi/acpi_bus.h>
++#include <asm/uaccess.h>
+ 
+ #define ASUS_ACPI_VERSION "0.28"
+ 
+@@ -480,16 +481,31 @@
+ 	return (hotk->status & ledmask) ? 1 : 0;
+ }
+ 
++static int parse_arg(const char __user *buf, unsigned long count, int *val)
++{
++	char s[32];
++	if (!count)
++		return 0;
++	if (count > 31)
++		return -EINVAL;
++	if (copy_from_user(s, buf, count))
++		return -EFAULT;
++	s[count] = 0;
++	if (sscanf(s, "%i", val) != 1)
++		return -EINVAL;
++	return count;
++}
+ 
+ /* FIXME: kill extraneous args so it can be called independently */
+ static int
+-write_led(const char *buffer, unsigned long count, struct asus_hotk *hotk, 
++write_led(const char __user *buffer, unsigned long count, struct asus_hotk *hotk, 
+           char *ledname, int ledmask, int invert)
+ {
+ 	int value;
+ 	int led_out = 0;
+ 
+-	if (sscanf(buffer, "%i", &value) == 1)
++	count = parse_arg(buffer, count, &value);
++	if (count > 0)
+ 		led_out = value ? 1 : 0;
+ 
+ 	hotk->status =
+@@ -518,7 +534,7 @@
+ 
+ 
+ static int
+-proc_write_mled(struct file *file, const char *buffer,
++proc_write_mled(struct file *file, const char __user *buffer,
+ 		unsigned long count, void *data)
+ {
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+@@ -537,7 +553,7 @@
+ }
+ 
+ static int
+-proc_write_wled(struct file *file, const char *buffer,
++proc_write_wled(struct file *file, const char __user *buffer,
+ 		unsigned long count, void *data)
+ {
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+@@ -556,7 +572,7 @@
+ }
+ 
+ static int
+-proc_write_tled(struct file *file, const char *buffer,
++proc_write_tled(struct file *file, const char __user *buffer,
+ 		unsigned long count, void *data)
+ {
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+@@ -640,13 +656,14 @@
+ 
+ 
+ static int
+-proc_write_lcd(struct file *file, const char *buffer,
++proc_write_lcd(struct file *file, const char __user *buffer,
+ 	       unsigned long count, void *data)
+ {
+ 	int value;
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+ 	
+-	if (sscanf(buffer, "%i", &value) == 1)
++	count = parse_arg(buffer, count, &value);
++	if (count > 0)
+ 		set_lcd_state(hotk, value);
+ 	return count;
+ }
+@@ -707,17 +724,18 @@
+ }
+ 
+ static int
+-proc_write_brn(struct file *file, const char *buffer,
++proc_write_brn(struct file *file, const char __user *buffer,
+ 	       unsigned long count, void *data)
+ {
+ 	int value;
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+ 
+-	if (sscanf(buffer, "%d", &value) == 1) {
++	count = parse_arg(buffer, count, &value);
++	if (count > 0) {
+ 		value = (0 < value) ? ((15 < value) ? 15 : value) : 0;
+ 			/* 0 <= value <= 15 */
+ 		set_brightness(value, hotk);
+-	} else {
++	} else if (count < 0) {
+ 		printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
+ 	}
+ 
+@@ -756,17 +774,17 @@
+  * simultaneously, so be warned. See the acpi4asus README for more info.
+  */
+ static int
+-proc_write_disp(struct file *file, const char *buffer,
++proc_write_disp(struct file *file, const char __user *buffer,
+ 	       unsigned long count, void *data)
+ {
+ 	int value;
+ 	struct asus_hotk *hotk = (struct asus_hotk *) data;
+ 
+-	if (sscanf(buffer, "%d", &value) == 1)
++	count = parse_arg(buffer, count, &value);
++	if (count > 0)
+ 		set_display(value, hotk);
+-	else {
++	else if (count < 0)
+ 		printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
+-	}
+ 
+ 	return count;
+ }
+@@ -774,7 +792,7 @@
+ 
+ typedef int (proc_readfunc)(char *page, char **start, off_t off, int count,
+ 	                     int *eof, void *data);
+-typedef int (proc_writefunc)(struct file *file, const char *buffer,
++typedef int (proc_writefunc)(struct file *file, const char __user *buffer,
+ 	                      unsigned long count, void *data);
+ 
+ static int
+--- 1.30/sound/core/timer.c	2004-07-21 14:22:06 -07:00
++++ 1.31/sound/core/timer.c	2004-07-21 14:22:06 -07:00
+@@ -1437,7 +1437,7 @@
+ 		err = -ENODEV;
+ 	}
+ 	up(&register_mutex);
+-	if (err >= 0 && copy_from_user(_gstatus, &gstatus, sizeof(gstatus)))
++	if (err >= 0 && copy_to_user(_gstatus, &gstatus, sizeof(gstatus)))
+ 		err = -EFAULT;
+ 	return err;
+ }
+--- 1.11/sound/oss/pss.c	2004-07-21 14:25:23 -07:00
++++ 1.12/sound/oss/pss.c	2004-07-21 14:25:23 -07:00
+@@ -453,20 +453,36 @@
+ 	}
+ }
+ 
+-static void arg_to_volume_mono(unsigned int volume, int *aleft)
++static int set_volume_mono(unsigned __user *p, int *aleft)
+ {
+ 	int left;
++	unsigned volume;
++	if (get_user(volume, p))
++		return -EFAULT;
+ 	
+-	left = volume & 0x00ff;
++	left = volume & 0xff;
+ 	if (left > 100)
+ 		left = 100;
+ 	*aleft = left;
++	return 0;
+ }
+ 
+-static void arg_to_volume_stereo(unsigned int volume, int *aleft, int *aright)
++static int set_volume_stereo(unsigned __user *p, int *aleft, int *aright)
+ {
+-	arg_to_volume_mono(volume, aleft);
+-	arg_to_volume_mono(volume >> 8, aright);
++	int left, right;
++	unsigned volume;
++	if (get_user(volume, p))
++		return -EFAULT;
++
++	left = volume & 0xff;
++	if (left > 100)
++		left = 100;
++	right = (volume >> 8) & 0xff;
++	if (right > 100)
++		right = 100;
++	*aleft = left;
++	*aright = right;
++	return 0;
+ }
+ 
+ static int ret_vol_mono(int left)
+@@ -479,7 +495,7 @@
+ 	return ((right << 8) | left);
+ }
+ 
+-static int call_ad_mixer(pss_confdata *devc,unsigned int cmd, caddr_t arg)
++static int call_ad_mixer(pss_confdata *devc,unsigned int cmd, void __user *arg)
+ {
+ 	if (devc->ad_mixer_dev != NO_WSS_MIXER) 
+ 		return mixer_devs[devc->ad_mixer_dev]->ioctl(devc->ad_mixer_dev, cmd, arg);
+@@ -487,7 +503,7 @@
+ 		return -EINVAL;
+ }
+ 
+-static int pss_mixer_ioctl (int dev, unsigned int cmd, caddr_t arg)
++static int pss_mixer_ioctl (int dev, unsigned int cmd, void __user *arg)
+ {
+ 	pss_confdata *devc = mixer_devs[dev]->devc;
+ 	int cmdf = cmd & 0xff;
+@@ -513,33 +529,38 @@
+ 					return call_ad_mixer(devc, cmd, arg);
+ 				else
+ 				{
+-					if (*(int *)arg != 0)
++					int v;
++					if (get_user(v, (int __user *)arg))
++						return -EFAULT;
++					if (v != 0)
+ 						return -EINVAL;
+ 					return 0;
+ 				}
+ 			case SOUND_MIXER_VOLUME:
+-				arg_to_volume_stereo(*(unsigned int *)arg, &devc->mixer.volume_l,
+-					&devc->mixer.volume_r); 
++				if (set_volume_stereo(arg,
++					&devc->mixer.volume_l,
++					&devc->mixer.volume_r))
++					return -EFAULT;
+ 				set_master_volume(devc, devc->mixer.volume_l,
+ 					devc->mixer.volume_r);
+ 				return ret_vol_stereo(devc->mixer.volume_l,
+ 					devc->mixer.volume_r);
+ 		  
+ 			case SOUND_MIXER_BASS:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.bass);
++				if (set_volume_mono(arg, &devc->mixer.bass))
++					return -EFAULT;
+ 				set_bass(devc, devc->mixer.bass);
+ 				return ret_vol_mono(devc->mixer.bass);
+ 		  
+ 			case SOUND_MIXER_TREBLE:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.treble);
++				if (set_volume_mono(arg, &devc->mixer.treble))
++					return -EFAULT;
+ 				set_treble(devc, devc->mixer.treble);
+ 				return ret_vol_mono(devc->mixer.treble);
+ 		  
+ 			case SOUND_MIXER_SYNTH:
+-				arg_to_volume_mono(*(unsigned int *)arg,
+-					&devc->mixer.synth);
++				if (set_volume_mono(arg, &devc->mixer.synth))
++					return -EFAULT;
+ 				set_synth_volume(devc, devc->mixer.synth);
+ 				return ret_vol_mono(devc->mixer.synth);
+ 		  
+@@ -549,54 +570,67 @@
+ 	}
+ 	else			
+ 	{
++		int val, and_mask = 0, or_mask = 0;
+ 		/*
+ 		 * Return parameters
+ 		 */
+ 		switch (cmdf)
+ 		{
+-
+ 			case SOUND_MIXER_DEVMASK:
+ 				if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
+-					*(int *)arg = 0; /* no mixer devices */
+-				return (*(int *)arg |= SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH);
++					break;
++				and_mask = ~0;
++				or_mask = SOUND_MASK_VOLUME | SOUND_MASK_BASS | SOUND_MASK_TREBLE | SOUND_MASK_SYNTH;
++				break;
+ 		  
+ 			case SOUND_MIXER_STEREODEVS:
+ 				if (call_ad_mixer(devc, cmd, arg) == -EINVAL)
+-					*(int *)arg = 0; /* no stereo devices */
+-				return (*(int *)arg |= SOUND_MASK_VOLUME);
++					break;
++				and_mask = ~0;
++				or_mask = SOUND_MASK_VOLUME;
++				break;
+ 		  
+ 			case SOUND_MIXER_RECMASK:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = 0); /* no record devices */
++				break;
+ 
+ 			case SOUND_MIXER_CAPS:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = SOUND_CAP_EXCL_INPUT);
++				or_mask = SOUND_CAP_EXCL_INPUT;
++				break;
+ 
+ 			case SOUND_MIXER_RECSRC:
+ 				if (devc->ad_mixer_dev != NO_WSS_MIXER)
+ 					return call_ad_mixer(devc, cmd, arg);
+-				else
+-					return (*(int *)arg = 0); /* no record source */
++				break;
+ 
+ 			case SOUND_MIXER_VOLUME:
+-				return (*(int *)arg = ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r));
++				or_mask =  ret_vol_stereo(devc->mixer.volume_l, devc->mixer.volume_r);
++				break;
+ 			  
+ 			case SOUND_MIXER_BASS:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.bass));
++				or_mask =  ret_vol_mono(devc->mixer.bass);
++				break;
+ 			  
+ 			case SOUND_MIXER_TREBLE:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.treble));
++				or_mask = ret_vol_mono(devc->mixer.treble);
++				break;
+ 			  
+ 			case SOUND_MIXER_SYNTH:
+-				return (*(int *)arg = ret_vol_mono(devc->mixer.synth));
++				or_mask = ret_vol_mono(devc->mixer.synth);
++				break;
+ 			default:
+ 				return -EINVAL;
+ 		}
++		if (get_user(val, (int __user *)arg))
++			return -EFAULT;
++		val &= and_mask;
++		val |= or_mask;
++		if (put_user(val, (int __user *)arg))
++			return -EFAULT;
++		return val;
+ 	}
+ }
+ 
+@@ -803,7 +837,7 @@
+ 	return 0;
+ }
+ 
+-static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, caddr_t arg, int local)
++static int pss_coproc_ioctl(void *dev_info, unsigned int cmd, void __user *arg, int local)
+ {
+ 	copr_buffer *buf;
+ 	copr_msg *mbuf;
+--- 1.15/sound/oss/msnd_pinnacle.c	2004-07-21 14:51:56 -07:00
++++ 1.16/sound/oss/msnd_pinnacle.c	2004-07-21 14:51:56 -07:00
+@@ -809,7 +809,7 @@
+ 
+ static __inline__ int pack_DARQ_to_DARF(register int bank)
+ {
+-	register int size, n, timeout = 3;
++	register int size, timeout = 3;
+ 	register WORD wTmp;
+ 	LPDAQD DAQD;
+ 
+@@ -830,13 +830,10 @@
+ 	/* Read data from the head (unprotected bank 1 access okay
+            since this is only called inside an interrupt) */
+ 	outb(HPBLKSEL_1, dev.io + HP_BLKS);
+-	if ((n = msnd_fifo_write(
++	msnd_fifo_write(
+ 		&dev.DARF,
+ 		(char *)(dev.base + bank * DAR_BUFF_SIZE),
+-		size, 0)) <= 0) {
+-		outb(HPBLKSEL_0, dev.io + HP_BLKS);
+-		return n;
+-	}
++		size);
+ 	outb(HPBLKSEL_0, dev.io + HP_BLKS);
+ 
+ 	return 1;
+@@ -858,21 +855,16 @@
+ 		if (protect) {
+ 			/* Critical section: protect fifo in non-interrupt */
+ 			spin_lock_irqsave(&dev.lock, flags);
+-			if ((n = msnd_fifo_read(
++			n = msnd_fifo_read(
+ 				&dev.DAPF,
+ 				(char *)(dev.base + bank_num * DAP_BUFF_SIZE),
+-				DAP_BUFF_SIZE, 0)) < 0) {
+-				spin_unlock_irqrestore(&dev.lock, flags);
+-				return n;
+-			}
++				DAP_BUFF_SIZE);
+ 			spin_unlock_irqrestore(&dev.lock, flags);
+ 		} else {
+-			if ((n = msnd_fifo_read(
++			n = msnd_fifo_read(
+ 				&dev.DAPF,
+ 				(char *)(dev.base + bank_num * DAP_BUFF_SIZE),
+-				DAP_BUFF_SIZE, 0)) < 0) {
+-				return n;
+-			}
++				DAP_BUFF_SIZE);
+ 		}
+ 		if (!n)
+ 			break;
+@@ -899,30 +891,43 @@
+ static int dsp_read(char *buf, size_t len)
+ {
+ 	int count = len;
++	char *page = (char *)__get_free_page(PAGE_SIZE);
++
++	if (!page)
++		return -ENOMEM;
+ 
+ 	while (count > 0) {
+-		int n;
++		int n, k;
+ 		unsigned long flags;
+ 
++		k = PAGE_SIZE;
++		if (k > count)
++			k = count;
++
+ 		/* Critical section: protect fifo in non-interrupt */
+ 		spin_lock_irqsave(&dev.lock, flags);
+-		if ((n = msnd_fifo_read(&dev.DARF, buf, count, 1)) < 0) {
+-			printk(KERN_WARNING LOGNAME ": FIFO read error\n");
+-			spin_unlock_irqrestore(&dev.lock, flags);
+-			return n;
+-		}
++		n = msnd_fifo_read(&dev.DARF, page, k);
+ 		spin_unlock_irqrestore(&dev.lock, flags);
++		if (copy_to_user(buf, page, n)) {
++			free_page((unsigned long)page);
++			return -EFAULT;
++		}
+ 		buf += n;
+ 		count -= n;
+ 
++		if (n == k && count)
++			continue;
++
+ 		if (!test_bit(F_READING, &dev.flags) && dev.mode & FMODE_READ) {
+ 			dev.last_recbank = -1;
+ 			if (chk_send_dsp_cmd(&dev, HDEX_RECORD_START) == 0)
+ 				set_bit(F_READING, &dev.flags);
+ 		}
+ 
+-		if (dev.rec_ndelay)
++		if (dev.rec_ndelay) {
++			free_page((unsigned long)page);
+ 			return count == len ? -EAGAIN : len - count;
++		}
+ 
+ 		if (count > 0) {
+ 			set_bit(F_READBLOCK, &dev.flags);
+@@ -931,41 +936,57 @@
+ 				get_rec_delay_jiffies(DAR_BUFF_SIZE)))
+ 				clear_bit(F_READING, &dev.flags);
+ 			clear_bit(F_READBLOCK, &dev.flags);
+-			if (signal_pending(current))
++			if (signal_pending(current)) {
++				free_page((unsigned long)page);
+ 				return -EINTR;
++			}
+ 		}
+ 	}
+-
++	free_page((unsigned long)page);
+ 	return len - count;
+ }
+ 
+ static int dsp_write(const char *buf, size_t len)
+ {
+ 	int count = len;
++	char *page = (char *)__get_free_page(GFP_KERNEL);
++
++	if (!page)
++		return -ENOMEM;
+ 
+ 	while (count > 0) {
+-		int n;
++		int n, k;
+ 		unsigned long flags;
+ 
++		k = PAGE_SIZE;
++		if (k > count)
++			k = count;
++
++		if (copy_from_user(page, buf, k)) {
++			free_page((unsigned long)page);
++			return -EFAULT;
++		}
++
+ 		/* Critical section: protect fifo in non-interrupt */
+ 		spin_lock_irqsave(&dev.lock, flags);
+-		if ((n = msnd_fifo_write(&dev.DAPF, buf, count, 1)) < 0) {
+-			printk(KERN_WARNING LOGNAME ": FIFO write error\n");
+-			spin_unlock_irqrestore(&dev.lock, flags);
+-			return n;
+-		}
++		n = msnd_fifo_write(&dev.DAPF, page, k);
+ 		spin_unlock_irqrestore(&dev.lock, flags);
+ 		buf += n;
+ 		count -= n;
+ 
++		if (count && n == k)
++			continue;
++
+ 		if (!test_bit(F_WRITING, &dev.flags) && (dev.mode & FMODE_WRITE)) {
+ 			dev.last_playbank = -1;
+ 			if (pack_DAPF_to_DAPQ(1) > 0)
+ 				set_bit(F_WRITING, &dev.flags);
+ 		}
+ 
+-		if (dev.play_ndelay)
++		if (dev.play_ndelay) {
++			free_page((unsigned long)page);
+ 			return count == len ? -EAGAIN : len - count;
++		}
+ 
+ 		if (count > 0) {
+ 			set_bit(F_WRITEBLOCK, &dev.flags);
+@@ -973,11 +994,14 @@
+ 				&dev.writeblock,
+ 				get_play_delay_jiffies(DAP_BUFF_SIZE));
+ 			clear_bit(F_WRITEBLOCK, &dev.flags);
+-			if (signal_pending(current))
++			if (signal_pending(current)) {
++				free_page((unsigned long)page);
+ 				return -EINTR;
++			}
+ 		}
+ 	}
+ 
++	free_page((unsigned long)page);
+ 	return len - count;
+ }
+ 
+--- 1.2/sound/oss/msnd.h	2004-07-21 14:52:24 -07:00
++++ 1.3/sound/oss/msnd.h	2004-07-21 14:52:24 -07:00
+@@ -266,8 +266,8 @@
+ void				msnd_fifo_free(msnd_fifo *f);
+ int				msnd_fifo_alloc(msnd_fifo *f, size_t n);
+ void				msnd_fifo_make_empty(msnd_fifo *f);
+-int				msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user);
+-int				msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user);
++int				msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len);
++int				msnd_fifo_read(msnd_fifo *f, char *buf, size_t len);
+ 
+ int				msnd_wait_TXDE(multisound_dev_t *dev);
+ int				msnd_wait_HC0(multisound_dev_t *dev);
+--- 1.8/sound/oss/msnd.c	2004-07-21 14:52:37 -07:00
++++ 1.9/sound/oss/msnd.c	2004-07-21 14:52:37 -07:00
+@@ -139,13 +139,10 @@
+ 	f->len = f->tail = f->head = 0;
+ }
+ 
+-int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len, int user)
++int msnd_fifo_write(msnd_fifo *f, const char *buf, size_t len)
+ {
+ 	int count = 0;
+ 
+-	if (f->len == f->n)
+-		return 0;
+-
+ 	while ((count < len) && (f->len != f->n)) {
+ 
+ 		int nwritten;
+@@ -161,11 +158,7 @@
+ 				nwritten = len - count;
+ 		}
+ 
+-		if (user) {
+-			if (copy_from_user(f->data + f->tail, buf, nwritten))
+-				return -EFAULT;
+-		} else
+-			isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
++		isa_memcpy_fromio(f->data + f->tail, (unsigned long) buf, nwritten);
+ 
+ 		count += nwritten;
+ 		buf += nwritten;
+@@ -177,13 +170,10 @@
+ 	return count;
+ }
+ 
+-int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len, int user)
++int msnd_fifo_read(msnd_fifo *f, char *buf, size_t len)
+ {
+ 	int count = 0;
+ 
+-	if (f->len == 0)
+-		return f->len;
+-
+ 	while ((count < len) && (f->len > 0)) {
+ 
+ 		int nread;
+@@ -199,11 +189,7 @@
+ 				nread = len - count;
+ 		}
+ 
+-		if (user) {
+-			if (copy_to_user(buf, f->data + f->head, nread))
+-				return -EFAULT;
+-		} else
+-			isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
++		isa_memcpy_toio((unsigned long) buf, f->data + f->head, nread);
+ 
+ 		count += nread;
+ 		buf += nread;
diff --git a/sys-kernel/mips-sources/files/CAN-2004-0497-2.6-attr_gid.patch b/sys-kernel/mips-sources/files/CAN-2004-0497-2.6-attr_gid.patch
new file mode 100644
index 000000000000..41b3196f84ea
--- /dev/null
+++ b/sys-kernel/mips-sources/files/CAN-2004-0497-2.6-attr_gid.patch
@@ -0,0 +1,26 @@
+# This is a BitKeeper generated diff -Nru style patch.
+#
+# ChangeSet
+#   2004/07/02 20:55:04-07:00 chrisw@osdl.org 
+#   [PATCH] chown permission check fix for ATTR_GID
+#   
+#   SuSE discovered this problem with chown and ATTR_GID.  Make sure user
+#   is authorized to change the group, CAN-2004-0497.
+# 
+# fs/attr.c
+#   2004/07/02 09:07:32-07:00 chrisw@osdl.org +2 -1
+#   chown permission check fix for ATTR_GID
+# 
+diff -Nru a/fs/attr.c b/fs/attr.c
+--- a/fs/attr.c	2004-07-08 16:35:57 -07:00
++++ b/fs/attr.c	2004-07-08 16:35:57 -07:00
+@@ -35,7 +35,8 @@
+ 
+ 	/* Make sure caller can chgrp. */
+ 	if ((ia_valid & ATTR_GID) &&
+-	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid) &&
++	    (current->fsuid != inode->i_uid ||
++	    (!in_group_p(attr->ia_gid) && attr->ia_gid != inode->i_gid)) &&
+ 	    !capable(CAP_CHOWN))
+ 		goto error;
+ 
diff --git a/sys-kernel/mips-sources/files/CAN-2004-0596-2.6-eql.patch b/sys-kernel/mips-sources/files/CAN-2004-0596-2.6-eql.patch
new file mode 100644
index 000000000000..3e20a2e41372
--- /dev/null
+++ b/sys-kernel/mips-sources/files/CAN-2004-0596-2.6-eql.patch
@@ -0,0 +1,46 @@
+--- 1.13/drivers/net/eql.c	2004-07-21 03:13:40 -07:00
++++ 1.14/drivers/net/eql.c	2004-07-21 03:13:40 -07:00
+@@ -495,6 +495,8 @@
+ 		return -EFAULT;
+ 
+ 	slave_dev = dev_get_by_name(sc.slave_name);
++	if (!slave_dev)
++		return -ENODEV;
+ 
+ 	ret = -EINVAL;
+ 
+@@ -527,11 +529,13 @@
+ 	if (copy_from_user(&sc, scp, sizeof (slave_config_t)))
+ 		return -EFAULT;
+ 
+-	eql = dev->priv;
+ 	slave_dev = dev_get_by_name(sc.slave_name);
++	if (!slave_dev)
++		return -ENODEV;
+ 
+ 	ret = -EINVAL;
+ 
++	eql = dev->priv;
+ 	spin_lock_bh(&eql->queue.lock);
+ 	if (eql_is_slave(slave_dev)) {
+ 		slave = __eql_find_slave_dev(&eql->queue, slave_dev);
+--- 1.14/drivers/net/eql.c	2004-07-21 03:13:33 -07:00
++++ 1.15/drivers/net/eql.c	2004-07-21 03:13:33 -07:00
+@@ -499,6 +499,8 @@
+ 		return -ENODEV;
+ 
+ 	ret = -EINVAL;
++	if (!slave_dev)
++		return ret;
+ 
+ 	spin_lock_bh(&eql->queue.lock);
+ 	if (eql_is_slave(slave_dev)) {
+@@ -534,6 +536,8 @@
+ 		return -ENODEV;
+ 
+ 	ret = -EINVAL;
++	if (!slave_dev)
++		return ret;
+ 
+ 	eql = dev->priv;
+ 	spin_lock_bh(&eql->queue.lock);
diff --git a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.4-r4 b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.4-r5
index 1a5fc819e2ad..1a5fc819e2ad 100644
--- a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.4-r4
+++ b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.4-r5
diff --git a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.5-r3 b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.5-r4
index c1a0ce95b671..c1a0ce95b671 100644
--- a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.5-r3
+++ b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.5-r4
diff --git a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.6-r2 b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.6-r3
index bc73ffb0e7fa..bc73ffb0e7fa 100644
--- a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.6-r2
+++ b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.6-r3
diff --git a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.7-r1 b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.7-r2
index 0b0e6e5494a9..0b0e6e5494a9 100644
--- a/sys-kernel/mips-sources/files/digest-mips-sources-2.6.7-r1
+++ b/sys-kernel/mips-sources/files/digest-mips-sources-2.6.7-r2
diff --git a/sys-kernel/mips-sources/mips-sources-2.6.4-r4.ebuild b/sys-kernel/mips-sources/mips-sources-2.6.4-r5.ebuild
index 351bee5b3167..f2e7ded37be0 100644
--- a/sys-kernel/mips-sources/mips-sources-2.6.4-r4.ebuild
+++ b/sys-kernel/mips-sources/mips-sources-2.6.4-r5.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.4-r4.ebuild,v 1.2 2004/07/15 03:53:30 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.4-r5.ebuild,v 1.1 2004/07/23 01:54:38 kumba Exp $
 
 
 # Version Data
@@ -82,6 +82,9 @@ src_unpack() {
 		epatch ${FILESDIR}/CAN-2004-0228-cpufreq.patch
 		epatch ${FILESDIR}/CAN-2004-0229-fb_copy_cmap.patch
 		epatch ${FILESDIR}/CAN-2004-0427-2.6-do_fork.patch
+		epatch ${FILESDIR}/CAN-2004-0495_0496-2.6-sparse.patch
+		epatch ${FILESDIR}/CAN-2004-0497-2.6-attr_gid.patch
+		epatch ${FILESDIR}/CAN-2004-0596-2.6-eql.patch
 		epatch ${FILESDIR}/CAN-2004-0626-death_packet.patch
 	eend
 
diff --git a/sys-kernel/mips-sources/mips-sources-2.6.5-r3.ebuild b/sys-kernel/mips-sources/mips-sources-2.6.5-r4.ebuild
index 4b7e94eb4be4..45f3b695cfba 100644
--- a/sys-kernel/mips-sources/mips-sources-2.6.5-r3.ebuild
+++ b/sys-kernel/mips-sources/mips-sources-2.6.5-r4.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.5-r3.ebuild,v 1.2 2004/07/15 03:53:30 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.5-r4.ebuild,v 1.1 2004/07/23 01:54:38 kumba Exp $
 
 
 # Version Data
@@ -84,11 +84,12 @@ src_unpack() {
 		epatch ${FILESDIR}/CAN-2004-0228-cpufreq.patch
 		epatch ${FILESDIR}/CAN-2004-0229-fb_copy_cmap.patch
 		epatch ${FILESDIR}/CAN-2004-0427-2.6-do_fork.patch
+		epatch ${FILESDIR}/CAN-2004-0495_0496-2.6-sparse.patch
+		epatch ${FILESDIR}/CAN-2004-0497-2.6-attr_gid.patch
+		epatch ${FILESDIR}/CAN-2004-0596-2.6-eql.patch
 		epatch ${FILESDIR}/CAN-2004-0626-death_packet.patch
 	eend
 
-#	# Misc Fixes
-#	epatch ${FILESDIR}/misc-2.6-iptables_headers.patch
 
 	# Cobalt Patches
 	if [ "${PROFILE_ARCH}" = "cobalt" ]; then
diff --git a/sys-kernel/mips-sources/mips-sources-2.6.6-r2.ebuild b/sys-kernel/mips-sources/mips-sources-2.6.6-r3.ebuild
index 0f0e10c2f723..b499cb204c18 100644
--- a/sys-kernel/mips-sources/mips-sources-2.6.6-r2.ebuild
+++ b/sys-kernel/mips-sources/mips-sources-2.6.6-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.6-r2.ebuild,v 1.2 2004/07/15 03:53:30 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.6-r3.ebuild,v 1.1 2004/07/23 01:54:38 kumba Exp $
 
 
 # Version Data
@@ -75,6 +75,9 @@ src_unpack() {
 	# Security Fixes
 	echo -e ""
 	ebegin "Applying Security Fixes"
+		epatch ${FILESDIR}/CAN-2004-0495_0496-2.6-sparse.patch
+		epatch ${FILESDIR}/CAN-2004-0497-2.6-attr_gid.patch
+		epatch ${FILESDIR}/CAN-2004-0596-2.6-eql.patch
 		epatch ${FILESDIR}/CAN-2004-0626-death_packet.patch
 	eend
 
diff --git a/sys-kernel/mips-sources/mips-sources-2.6.7-r1.ebuild b/sys-kernel/mips-sources/mips-sources-2.6.7-r2.ebuild
index c0df4caad5e5..830598846e59 100644
--- a/sys-kernel/mips-sources/mips-sources-2.6.7-r1.ebuild
+++ b/sys-kernel/mips-sources/mips-sources-2.6.7-r2.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.7-r1.ebuild,v 1.2 2004/07/15 03:53:30 agriffis Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/mips-sources/mips-sources-2.6.7-r2.ebuild,v 1.1 2004/07/23 01:54:38 kumba Exp $
 
 
 # Version Data
@@ -76,6 +76,8 @@ src_unpack() {
 	# Security Fixes
 	echo -e ""
 	ebegin "Applying Security Fixes"
+		epatch ${FILESDIR}/CAN-2004-0497-2.6-attr_gid.patch
+		epatch ${FILESDIR}/CAN-2004-0596-2.6-eql.patch
 		epatch ${FILESDIR}/CAN-2004-0626-death_packet.patch
 	eend