Security bump; bugs #77025 and #77094.

8 files changed, 595 insertions, 8 deletions

diff --git a/sys-kernel/uclinux-sources/ChangeLog b/sys-kernel/uclinux-sources/ChangeLog
index 58412d7e9409..53b9981420c2 100644
--- a/sys-kernel/uclinux-sources/ChangeLog
+++ b/sys-kernel/uclinux-sources/ChangeLog
@@ -1,6 +1,16 @@
 # ChangeLog for sys-kernel/uclinux-sources
-# Copyright 2000-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.27 2004/12/24 18:36:03 plasmaroo Exp $
+# Copyright 2000-2005 Gentoo Foundation; Distributed under the GPL v2
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/ChangeLog,v 1.28 2005/01/09 10:59:22 plasmaroo Exp $
+
+*uclinux-sources-2.4.26_p0-r12 (09 Jan 2005)
+
+  09 Jan 2005; <plasmaroo@gentoo.org> -uclinux-sources-2.4.26_p0-r11.ebuild,
+  +uclinux-sources-2.4.26_p0-r12.ebuild, -uclinux-sources-2.6.7_p0-r12.ebuild,
+  +uclinux-sources-2.6.7_p0-r13.ebuild,
+  +files/uclinux-sources-2.4.26_p0.brk-locked.patch,
+  +files/uclinux-sources-2.6.brk-locked.patch,
+  +files/uclinux-sources.77094.patch:
+  Security bump; bugs #77025 and #77094.
 
 *uclinux-sources-2.4.26_p0-r11 (24 Dec 2004)
 
diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r11 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r12
index 8629e7c2dfd9..210bd0aad388 100644
--- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r11
+++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.4.26_p0-r12
@@ -1,4 +1,4 @@
 MD5 88d7aefa03c92739cb70298a0b486e2c linux-2.4.26.tar.bz2 30772389
 MD5 8c2a75543abe268ff71d59c85b7607ac uClinux-2.4.26-uc0.diff.gz 4062854
 MD5 dd070e146fc1938fef307386976eb87e uclinux-sources-2.4.26-CAN-2004-0415.patch 90160
-MD5 d4c051e7c6062704be85192e25e2f5b2 linux-2.4.26-CAN-2004-0814.patch 81508
+MD5 74b2f3921c7baa0ad83e51562a6432e4 linux-2.4.26-CAN-2004-0814.2.patch 147687
diff --git a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r12 b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r13
index 5e42e7666435..5e42e7666435 100644
--- a/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r12
+++ b/sys-kernel/uclinux-sources/files/digest-uclinux-sources-2.6.7_p0-r13
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.brk-locked.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.brk-locked.patch
new file mode 100644
index 000000000000..210f3662389e
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.4.26_p0.brk-locked.patch
@@ -0,0 +1,258 @@
+diff -urp linux-2.4.26-uc0-r11/arch/mips/kernel/irixelf.c linux-2.4.26-uc0-r12/arch/mips/kernel/irixelf.c
+--- linux-2.4.26-uc0-r11/arch/mips/kernel/irixelf.c	2003-08-25 12:44:40.000000000 +0100
++++ linux-2.4.26-uc0-r12/arch/mips/kernel/irixelf.c	2005-01-09 10:13:45.047954792 +0000
+@@ -130,7 +130,7 @@ static void set_brk(unsigned long start,
+ 	end = PAGE_ALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ 
+@@ -379,7 +379,7 @@ static unsigned int load_irix_interp(str
+ 
+ 	/* Map the last of the bss segment */
+ 	if (last_bss > len) {
+-		do_brk(len, (last_bss - len));
++		do_brk_locked(len, (last_bss - len));
+ 	}
+ 	kfree(elf_phdata);
+ 
+@@ -567,7 +567,7 @@ void irix_map_prda_page (void)
+ 	unsigned long v;
+ 	struct prda *pp;
+ 
+-	v =  do_brk (PRDA_ADDRESS, PAGE_SIZE);
++	v =  do_brk_locked (PRDA_ADDRESS, PAGE_SIZE);
+ 
+ 	if (v < 0)
+ 		return;
+@@ -859,7 +859,7 @@ static int load_irix_library(struct file
+ 	len = (elf_phdata->p_filesz + elf_phdata->p_vaddr+ 0xfff) & 0xfffff000;
+ 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+ 	if (bss > len)
+-	  do_brk(len, bss-len);
++	  do_brk_locked(len, bss-len);
+ 	kfree(elf_phdata);
+ 	return 0;
+ }
+diff -urp linux-2.4.26-uc0-r11/arch/sparc64/kernel/binfmt_aout32.c linux-2.4.26-uc0-r12/arch/sparc64/kernel/binfmt_aout32.c
+--- linux-2.4.26-uc0-r11/arch/sparc64/kernel/binfmt_aout32.c	2002-08-03 01:39:43.000000000 +0100
++++ linux-2.4.26-uc0-r12/arch/sparc64/kernel/binfmt_aout32.c	2005-01-09 10:13:45.054953728 +0000
+@@ -49,7 +49,7 @@ static void set_brk(unsigned long start,
+ 	end = PAGE_ALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ /*
+@@ -246,10 +246,10 @@ static int load_aout32_binary(struct lin
+ 	if (N_MAGIC(ex) == NMAGIC) {
+ 		loff_t pos = fd_offset;
+ 		/* Fuck me plenty... */
+-		error = do_brk(N_TXTADDR(ex), ex.a_text);
++		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text, &pos);
+-		error = do_brk(N_DATADDR(ex), ex.a_data);
++		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+ 			  ex.a_data, &pos);
+ 		goto beyond_if;
+@@ -257,7 +257,7 @@ static int load_aout32_binary(struct lin
+ 
+ 	if (N_MAGIC(ex) == OMAGIC) {
+ 		loff_t pos = fd_offset;
+-		do_brk(N_TXTADDR(ex) & PAGE_MASK,
++		do_brk_locked(N_TXTADDR(ex) & PAGE_MASK,
+ 			ex.a_text+ex.a_data + PAGE_SIZE - 1);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text+ex.a_data, &pos);
+@@ -272,7 +272,7 @@ static int load_aout32_binary(struct lin
+ 
+ 		if (!bprm->file->f_op->mmap) {
+ 			loff_t pos = fd_offset;
+-			do_brk(0, ex.a_text+ex.a_data);
++			do_brk_locked(0, ex.a_text+ex.a_data);
+ 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+ 				  ex.a_text+ex.a_data, &pos);
+ 			goto beyond_if;
+@@ -388,7 +388,7 @@ static int load_aout32_library(struct fi
+ 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
+ 	bss = ex.a_text + ex.a_data + ex.a_bss;
+ 	if (bss > len) {
+-		error = do_brk(start_addr + len, bss - len);
++		error = do_brk_locked(start_addr + len, bss - len);
+ 		retval = error;
+ 		if (error != start_addr + len)
+ 			goto out;
+diff -urp linux-2.4.26-uc0-r11/fs/binfmt_aout.c linux-2.4.26-uc0-r12/fs/binfmt_aout.c
+--- linux-2.4.26-uc0-r11/fs/binfmt_aout.c	2005-01-09 10:09:44.000000000 +0000
++++ linux-2.4.26-uc0-r12/fs/binfmt_aout.c	2005-01-09 10:13:45.000000000 +0000
+@@ -46,7 +46,7 @@ static int set_brk(unsigned long start, 
+ 	start = PAGE_ALIGN(start);
+ 	end = PAGE_ALIGN(end);
+ 	if (end > start) {
+-		unsigned long addr = do_brk(start, end - start);
++		unsigned long addr = do_brk_locked(start, end - start);
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+@@ -317,10 +317,10 @@ static int load_aout_binary(struct linux
+ 		loff_t pos = fd_offset;
+ 		/* Fuck me plenty... */
+ 		/* <AOL></AOL> */
+-		error = do_brk(N_TXTADDR(ex), ex.a_text);
++		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text, &pos);
+-		error = do_brk(N_DATADDR(ex), ex.a_data);
++		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+ 			  ex.a_data, &pos);
+ 		goto beyond_if;
+@@ -341,7 +341,7 @@ static int load_aout_binary(struct linux
+ 		map_size = ex.a_text+ex.a_data;
+ #endif
+ 
+-		error = do_brk(text_addr & PAGE_MASK, map_size);
++		error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+ 		if (error != (text_addr & PAGE_MASK)) {
+ 			send_sig(SIGKILL, current, 0);
+ 			return error;
+@@ -375,7 +375,7 @@ static int load_aout_binary(struct linux
+ 
+ 		if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
+ 			loff_t pos = fd_offset;
+-			do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
++			do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+ 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+ 					ex.a_text+ex.a_data, &pos);
+ 			flush_icache_range((unsigned long) N_TXTADDR(ex),
+@@ -483,7 +483,7 @@ static int load_aout_library(struct file
+ 			error_time = jiffies;
+ 		}
+ 
+-		do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
++		do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+ 		
+ 		file->f_op->read(file, (char *)start_addr,
+ 			ex.a_text + ex.a_data, &pos);
+@@ -507,7 +507,7 @@ static int load_aout_library(struct file
+ 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
+ 	bss = ex.a_text + ex.a_data + ex.a_bss;
+ 	if (bss > len) {
+-		error = do_brk(start_addr + len, bss - len);
++		error = do_brk_locked(start_addr + len, bss - len);
+ 		retval = error;
+ 		if (error != start_addr + len)
+ 			goto out;
+diff -urp linux-2.4.26-uc0-r11/fs/binfmt_elf.c linux-2.4.26-uc0-r12/fs/binfmt_elf.c
+--- linux-2.4.26-uc0-r11/fs/binfmt_elf.c	2005-01-09 10:09:44.000000000 +0000
++++ linux-2.4.26-uc0-r12/fs/binfmt_elf.c	2005-01-09 10:13:45.000000000 +0000
+@@ -85,7 +85,7 @@ static void set_brk(unsigned long start,
+ 	end = ELF_PAGEALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ 
+@@ -286,7 +286,9 @@ static unsigned long load_elf_interp(str
+ 	 */
+ 	if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
+ 		goto out;
+-	if (interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
++
++	if (interp_elf_ex->e_phnum < 1 ||
++	    interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
+ 		goto out;
+ 
+ 	/* Now read in all of the header information */
+@@ -361,7 +363,7 @@ static unsigned long load_elf_interp(str
+ 
+ 	/* Map the last of the bss segment */
+ 	if (last_bss > elf_bss)
+-		do_brk(elf_bss, last_bss - elf_bss);
++		do_brk_locked(elf_bss, last_bss - elf_bss);
+ 
+ 	*interp_load_addr = load_addr;
+ 	error = ((unsigned long) interp_elf_ex->e_entry) + load_addr;
+@@ -399,7 +401,7 @@ static unsigned long load_aout_interp(st
+ 		goto out;
+ 	}
+ 
+-	do_brk(0, text_data);
++	do_brk_locked(0, text_data);
+ 	retval = -ENOEXEC;
+ 	if (!interpreter->f_op || !interpreter->f_op->read)
+ 		goto out;
+@@ -409,7 +411,7 @@ static unsigned long load_aout_interp(st
+ 	flush_icache_range((unsigned long)addr,
+ 	                   (unsigned long)addr + text_data);
+ 
+-	do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
++	do_brk_locked(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
+ 		interp_ex->a_bss);
+ 	elf_entry = interp_ex->a_entry;
+ 
+@@ -923,7 +925,7 @@ static int load_elf_library(struct file 
+ 	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
+ 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+ 	if (bss > len)
+-		do_brk(len, bss - len);
++		do_brk_locked(len, bss - len);
+ 	error = 0;
+ 
+ out_free_ph:
+diff -urp linux-2.4.26-uc0-r11/include/linux/mm.h linux-2.4.26-uc0-r12/include/linux/mm.h
+--- linux-2.4.26-uc0-r11/include/linux/mm.h	2005-01-09 10:09:44.000000000 +0000
++++ linux-2.4.26-uc0-r12/include/linux/mm.h	2005-01-09 10:13:45.000000000 +0000
+@@ -616,6 +616,7 @@ out:
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
++extern unsigned long do_brk_locked(unsigned long, unsigned long);
+ 
+ static inline void __vma_unlink(struct mm_struct * mm, struct vm_area_struct * vma, struct vm_area_struct * prev)
+ {
+diff -urp linux-2.4.26-uc0-r11/kernel/ksyms.c linux-2.4.26-uc0-r12/kernel/ksyms.c
+--- linux-2.4.26-uc0-r11/kernel/ksyms.c	2005-01-09 10:09:39.000000000 +0000
++++ linux-2.4.26-uc0-r12/kernel/ksyms.c	2005-01-09 10:14:13.000000000 +0000
+@@ -89,6 +89,7 @@ EXPORT_SYMBOL(do_mmap_pgoff);
+ EXPORT_SYMBOL(do_munmap);
+ #ifndef NO_MM
+ EXPORT_SYMBOL(do_brk);
++EXPORT_SYMBOL(do_brk_locked);
+ #endif
+ EXPORT_SYMBOL(exit_mm);
+ EXPORT_SYMBOL(exit_files);
+diff -urp linux-2.4.26-uc0-r11/mm/mmap.c linux-2.4.26-uc0-r12/mm/mmap.c
+--- linux-2.4.26-uc0-r11/mm/mmap.c	2005-01-09 10:09:44.000000000 +0000
++++ linux-2.4.26-uc0-r12/mm/mmap.c	2005-01-09 10:13:45.000000000 +0000
+@@ -1116,6 +1116,21 @@ out:
+ 	return addr;
+ }
+ 
++/* locking version of do_brk. */
++unsigned long do_brk_locked(unsigned long addr, unsigned long len)
++{
++	unsigned long ret;
++
++	down_write(&current->mm->mmap_sem);
++	ret = do_brk(addr, len);
++	up_write(&current->mm->mmap_sem);
++
++	return ret;
++}
++
++
++
++
+ /* Build the RB tree corresponding to the VMA list. */
+ void build_mmap_rb(struct mm_struct * mm)
+ {
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.brk-locked.patch b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.brk-locked.patch
new file mode 100644
index 000000000000..0cd5033dab70
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources-2.6.brk-locked.patch
@@ -0,0 +1,303 @@
+diff -urp linux-2.6.7-uc0-r12/arch/mips/kernel/irixelf.c linux-2.6.7-uc0-r13/arch/mips/kernel/irixelf.c
+--- linux-2.6.7-uc0-r12/arch/mips/kernel/irixelf.c	2004-06-16 06:20:26.000000000 +0100
++++ linux-2.6.7-uc0-r13/arch/mips/kernel/irixelf.c	2005-01-09 10:26:47.144058112 +0000
+@@ -127,7 +127,7 @@ static void set_brk(unsigned long start,
+ 	end = PAGE_ALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ 
+@@ -376,7 +376,7 @@ static unsigned int load_irix_interp(str
+ 
+ 	/* Map the last of the bss segment */
+ 	if (last_bss > len) {
+-		do_brk(len, (last_bss - len));
++		do_brk_locked(len, (last_bss - len));
+ 	}
+ 	kfree(elf_phdata);
+ 
+@@ -564,7 +564,7 @@ void irix_map_prda_page (void)
+ 	unsigned long v;
+ 	struct prda *pp;
+ 
+-	v =  do_brk (PRDA_ADDRESS, PAGE_SIZE);
++	v =  do_brk_locked (PRDA_ADDRESS, PAGE_SIZE);
+ 
+ 	if (v < 0)
+ 		return;
+@@ -856,7 +856,7 @@ static int load_irix_library(struct file
+ 	len = (elf_phdata->p_filesz + elf_phdata->p_vaddr+ 0xfff) & 0xfffff000;
+ 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+ 	if (bss > len)
+-	  do_brk(len, bss-len);
++	  do_brk_locked(len, bss-len);
+ 	kfree(elf_phdata);
+ 	return 0;
+ }
+diff -urp linux-2.6.7-uc0-r12/arch/sparc64/kernel/binfmt_aout32.c linux-2.6.7-uc0-r13/arch/sparc64/kernel/binfmt_aout32.c
+--- linux-2.6.7-uc0-r12/arch/sparc64/kernel/binfmt_aout32.c	2004-06-16 06:19:23.000000000 +0100
++++ linux-2.6.7-uc0-r13/arch/sparc64/kernel/binfmt_aout32.c	2005-01-09 10:30:53.078670368 +0000
+@@ -49,7 +49,7 @@ static void set_brk(unsigned long start,
+ 	end = PAGE_ALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ /*
+@@ -245,10 +245,10 @@ static int load_aout32_binary(struct lin
+ 	if (N_MAGIC(ex) == NMAGIC) {
+ 		loff_t pos = fd_offset;
+ 		/* Fuck me plenty... */
+-		error = do_brk(N_TXTADDR(ex), ex.a_text);
++		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text, &pos);
+-		error = do_brk(N_DATADDR(ex), ex.a_data);
++		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+ 			  ex.a_data, &pos);
+ 		goto beyond_if;
+@@ -256,7 +256,7 @@ static int load_aout32_binary(struct lin
+ 
+ 	if (N_MAGIC(ex) == OMAGIC) {
+ 		loff_t pos = fd_offset;
+-		do_brk(N_TXTADDR(ex) & PAGE_MASK,
++		do_brk_locked(N_TXTADDR(ex) & PAGE_MASK,
+ 			ex.a_text+ex.a_data + PAGE_SIZE - 1);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text+ex.a_data, &pos);
+@@ -271,7 +271,7 @@ static int load_aout32_binary(struct lin
+ 
+ 		if (!bprm->file->f_op->mmap) {
+ 			loff_t pos = fd_offset;
+-			do_brk(0, ex.a_text+ex.a_data);
++			do_brk_locked(0, ex.a_text+ex.a_data);
+ 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+ 				  ex.a_text+ex.a_data, &pos);
+ 			goto beyond_if;
+@@ -387,7 +387,7 @@ static int load_aout32_library(struct fi
+ 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
+ 	bss = ex.a_text + ex.a_data + ex.a_bss;
+ 	if (bss > len) {
+-		error = do_brk(start_addr + len, bss - len);
++		error = do_brk_locked(start_addr + len, bss - len);
+ 		retval = error;
+ 		if (error != start_addr + len)
+ 			goto out;
+diff -urp linux-2.6.7-uc0-r12/arch/x86_64/ia32/ia32_aout.c linux-2.6.7-uc0-r13/arch/x86_64/ia32/ia32_aout.c
+--- linux-2.6.7-uc0-r12/arch/x86_64/ia32/ia32_aout.c	2004-06-16 06:20:26.000000000 +0100
++++ linux-2.6.7-uc0-r13/arch/x86_64/ia32/ia32_aout.c	2005-01-09 10:26:47.189051272 +0000
+@@ -113,7 +113,7 @@ static void set_brk(unsigned long start,
+ 	end = PAGE_ALIGN(end);
+ 	if (end <= start)
+ 		return;
+-	do_brk(start, end - start);
++	do_brk_locked(start, end - start);
+ }
+ 
+ #if CORE_DUMP
+@@ -322,7 +322,7 @@ static int load_aout_binary(struct linux
+ 		pos = 32;
+ 		map_size = ex.a_text+ex.a_data;
+ 
+-		error = do_brk(text_addr & PAGE_MASK, map_size);
++		error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+ 		if (error != (text_addr & PAGE_MASK)) {
+ 			send_sig(SIGKILL, current, 0);
+ 			return error;
+@@ -358,7 +358,7 @@ static int load_aout_binary(struct linux
+ 
+ 		if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
+ 			loff_t pos = fd_offset;
+-			do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
++			do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+ 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+ 					ex.a_text+ex.a_data, &pos);
+ 			flush_icache_range((unsigned long) N_TXTADDR(ex),
+@@ -467,7 +467,7 @@ static int load_aout_library(struct file
+ 		}
+ #endif
+ 
+-		do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
++		do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+ 		
+ 		file->f_op->read(file, (char *)start_addr,
+ 			ex.a_text + ex.a_data, &pos);
+@@ -491,7 +491,7 @@ static int load_aout_library(struct file
+ 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
+ 	bss = ex.a_text + ex.a_data + ex.a_bss;
+ 	if (bss > len) {
+-		error = do_brk(start_addr + len, bss - len);
++		error = do_brk_locked(start_addr + len, bss - len);
+ 		retval = error;
+ 		if (error != start_addr + len)
+ 			goto out;
+diff -urp linux-2.6.7-uc0-r12/fs/binfmt_aout.c linux-2.6.7-uc0-r13/fs/binfmt_aout.c
+--- linux-2.6.7-uc0-r12/fs/binfmt_aout.c	2005-01-09 10:22:05.000000000 +0000
++++ linux-2.6.7-uc0-r13/fs/binfmt_aout.c	2005-01-09 10:33:36.000000000 +0000
+@@ -51,7 +51,7 @@ static int set_brk(unsigned long start, 
+ 	start = PAGE_ALIGN(start);
+ 	end = PAGE_ALIGN(end);
+ 	if (end > start) {
+-		unsigned long addr = do_brk(start, end - start);
++		unsigned long addr = do_brk_locked(start, end - start);
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+@@ -323,10 +323,10 @@ static int load_aout_binary(struct linux
+ 		loff_t pos = fd_offset;
+ 		/* Fuck me plenty... */
+ 		/* <AOL></AOL> */
+-		error = do_brk(N_TXTADDR(ex), ex.a_text);
++		error = do_brk_locked(N_TXTADDR(ex), ex.a_text);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_TXTADDR(ex),
+ 			  ex.a_text, &pos);
+-		error = do_brk(N_DATADDR(ex), ex.a_data);
++		error = do_brk_locked(N_DATADDR(ex), ex.a_data);
+ 		bprm->file->f_op->read(bprm->file, (char *) N_DATADDR(ex),
+ 			  ex.a_data, &pos);
+ 		goto beyond_if;
+@@ -347,7 +347,7 @@ static int load_aout_binary(struct linux
+ 		map_size = ex.a_text+ex.a_data;
+ #endif
+ 
+-		error = do_brk(text_addr & PAGE_MASK, map_size);
++		error = do_brk_locked(text_addr & PAGE_MASK, map_size);
+ 		if (error != (text_addr & PAGE_MASK)) {
+ 			send_sig(SIGKILL, current, 0);
+ 			return error;
+@@ -381,7 +381,7 @@ static int load_aout_binary(struct linux
+ 
+ 		if (!bprm->file->f_op->mmap||((fd_offset & ~PAGE_MASK) != 0)) {
+ 			loff_t pos = fd_offset;
+-			do_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
++			do_brk_locked(N_TXTADDR(ex), ex.a_text+ex.a_data);
+ 			bprm->file->f_op->read(bprm->file,(char *)N_TXTADDR(ex),
+ 					ex.a_text+ex.a_data, &pos);
+ 			flush_icache_range((unsigned long) N_TXTADDR(ex),
+@@ -486,7 +486,7 @@ static int load_aout_library(struct file
+ 			error_time = jiffies;
+ 		}
+ 
+-		do_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
++		do_brk_locked(start_addr, ex.a_text + ex.a_data + ex.a_bss);
+ 		
+ 		file->f_op->read(file, (char *)start_addr,
+ 			ex.a_text + ex.a_data, &pos);
+@@ -510,7 +510,7 @@ static int load_aout_library(struct file
+ 	len = PAGE_ALIGN(ex.a_text + ex.a_data);
+ 	bss = ex.a_text + ex.a_data + ex.a_bss;
+ 	if (bss > len) {
+-		error = do_brk(start_addr + len, bss - len);
++		error = do_brk_locked(start_addr + len, bss - len);
+ 		retval = error;
+ 		if (error != start_addr + len)
+ 			goto out;
+diff -urp linux-2.6.7-uc0-r12/fs/binfmt_elf.c linux-2.6.7-uc0-r13/fs/binfmt_elf.c
+--- linux-2.6.7-uc0-r12/fs/binfmt_elf.c	2005-01-09 10:22:04.000000000 +0000
++++ linux-2.6.7-uc0-r13/fs/binfmt_elf.c	2005-01-09 10:26:47.000000000 +0000
+@@ -88,7 +88,7 @@ static int set_brk(unsigned long start, 
+ 	start = ELF_PAGEALIGN(start);
+ 	end = ELF_PAGEALIGN(end);
+ 	if (end > start) {
+-		unsigned long addr = do_brk(start, end - start);
++		unsigned long addr = do_brk_locked(start, end - start);
+ 		if (BAD_ADDR(addr))
+ 			return addr;
+ 	}
+@@ -405,7 +405,7 @@ static unsigned long load_elf_interp(str
+ 
+ 	/* Map the last of the bss segment */
+ 	if (last_bss > elf_bss) {
+-		error = do_brk(elf_bss, last_bss - elf_bss);
++		error = do_brk_locked(elf_bss, last_bss - elf_bss);
+ 		if (BAD_ADDR(error))
+ 			goto out_close;
+ 	}
+@@ -445,7 +445,7 @@ static unsigned long load_aout_interp(st
+ 		goto out;
+ 	}
+ 
+-	do_brk(0, text_data);
++	do_brk_locked(0, text_data);
+ 	if (!interpreter->f_op || !interpreter->f_op->read)
+ 		goto out;
+ 	if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
+@@ -453,7 +453,7 @@ static unsigned long load_aout_interp(st
+ 	flush_icache_range((unsigned long)addr,
+ 	                   (unsigned long)addr + text_data);
+ 
+-	do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
++	do_brk_locked(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
+ 		interp_ex->a_bss);
+ 	elf_entry = interp_ex->a_entry;
+ 
+@@ -1004,7 +1004,7 @@ static int load_elf_library(struct file 
+ 	len = ELF_PAGESTART(elf_phdata->p_filesz + elf_phdata->p_vaddr + ELF_MIN_ALIGN - 1);
+ 	bss = elf_phdata->p_memsz + elf_phdata->p_vaddr;
+ 	if (bss > len)
+-		do_brk(len, bss - len);
++		do_brk_locked(len, bss - len);
+ 	error = 0;
+ 
+ out_free_ph:
+diff -urp linux-2.6.7-uc0-r12/include/linux/mm.h linux-2.6.7-uc0-r13/include/linux/mm.h
+--- linux-2.6.7-uc0-r12/include/linux/mm.h	2005-01-09 10:22:06.000000000 +0000
++++ linux-2.6.7-uc0-r13/include/linux/mm.h	2005-01-09 10:26:47.000000000 +0000
+@@ -652,6 +652,7 @@ out:
+ extern int do_munmap(struct mm_struct *, unsigned long, size_t);
+ 
+ extern unsigned long do_brk(unsigned long, unsigned long);
++extern unsigned long do_brk_locked(unsigned long, unsigned long);
+ 
+ /* filemap.c */
+ extern unsigned long page_unuse(struct page *);
+diff -urp linux-2.6.7-uc0-r12/mm/mmap.c linux-2.6.7-uc0-r13/mm/mmap.c
+--- linux-2.6.7-uc0-r12/mm/mmap.c	2005-01-09 10:22:06.000000000 +0000
++++ linux-2.6.7-uc0-r13/mm/mmap.c	2005-01-09 10:26:47.000000000 +0000
+@@ -1675,6 +1675,20 @@ out:
+ 
+ EXPORT_SYMBOL(do_brk);
+ 
++/* locking version of do_brk. */
++unsigned long do_brk_locked(unsigned long addr, unsigned long len)
++{
++	unsigned long ret;
++
++	down_write(&current->mm->mmap_sem);
++	ret = do_brk(addr, len);
++	up_write(&current->mm->mmap_sem);
++
++	return ret;
++}
++
++EXPORT_SYMBOL(do_brk_locked);
++
+ /* Release all mmaps. */
+ void exit_mmap(struct mm_struct *mm)
+ {
+@@ -1804,3 +1818,4 @@ struct vm_area_struct *copy_vma(struct v
+ 	}
+ 	return new_vma;
+ }
++
+diff -urp linux-2.6.7-uc0-r12/mm/nommu.c linux-2.6.7-uc0-r13/mm/nommu.c
+--- linux-2.6.7-uc0-r12/mm/nommu.c	2005-01-09 10:22:01.000000000 +0000
++++ linux-2.6.7-uc0-r13/mm/nommu.c	2005-01-09 10:26:47.000000000 +0000
+@@ -548,6 +548,11 @@ unsigned long do_brk(unsigned long addr,
+ 	return -ENOMEM;
+ }
+ 
++unsigned long do_brk_locked(unsigned long addr, unsigned long len)
++{
++	return -ENOMEM;
++}
++
+ struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr)
+ {
+ 	return NULL;
diff --git a/sys-kernel/uclinux-sources/files/uclinux-sources.77094.patch b/sys-kernel/uclinux-sources/files/uclinux-sources.77094.patch
new file mode 100644
index 000000000000..cc3a1552c83d
--- /dev/null
+++ b/sys-kernel/uclinux-sources/files/uclinux-sources.77094.patch
@@ -0,0 +1,12 @@
+diff -ur linux-2.4.28/drivers/char/random.c linux-2.4.28.plasmaroo/drivers/char/random.c
+--- linux-2.4.28/drivers/char/random.c	2004-11-17 11:54:21.000000000 +0000
++++ linux-2.4.28.plasmaroo/drivers/char/random.c	2005-01-08 02:54:49.198635736 +0000
+@@ -1787,7 +1787,7 @@
+ 			     void *oldval, size_t *oldlenp,
+ 			     void *newval, size_t newlen, void **context)
+ {
+-	int	len;
++	size_t	len;
+ 	
+ 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
+ 
diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r11.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r12.ebuild
index b4b0b31d1102..f436328f962b 100644
--- a/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r11.ebuild
+++ b/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r12.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2004 Gentoo Foundation
+# Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r11.ebuild,v 1.1 2004/12/24 18:36:03 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.4.26_p0-r12.ebuild,v 1.1 2005/01/09 10:59:22 plasmaroo Exp $
 
 IUSE=""
 
@@ -30,7 +30,7 @@ DESCRIPTION="uCLinux kernel patches for CPUs without MMUs"
 SRC_URI="mirror://kernel/v${MMV}/linux-${OKV}.tar.bz2
 	http://www.uclinux.org/pub/uClinux/uClinux-${MMV}.x/${MY_P/linux/${base}}.${patch}.gz
 	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/${POV}-CAN-2004-0415.patch
-	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0814.patch"
+	http://dev.gentoo.org/~plasmaroo/patches/kernel/misc/security/linux-${OKV}-CAN-2004-0814.2.patch"
 
 HOMEPAGE="http://www.uclinux.org/"
 KEYWORDS="~x86 -ppc"
@@ -65,6 +65,8 @@ src_unpack() {
 	epatch ${FILESDIR}/${P}.CAN-2004-1016.patch || die "Failed to apply the CAN-2004-1016 patch!"
 	epatch ${FILESDIR}/${P}.CAN-2004-1056.patch || die "Failed to apply the CAN-2004-1056 patch!"
 	epatch ${FILESDIR}/${P}.CAN-2004-1137.patch || die "Failed to apply the CAN-2004-1137 patch!"
+	epatch ${FILESDIR}/${PN}.77094.patch || die "Failed to apply bug #77094 patch!"
+	epatch ${FILESDIR}/${P}.brk-locked.patch || die "Failed to apply do_brk_locked() patch!"
 
 	kernel_universal_unpack
 	set ARCH=${MY_ARCH}
diff --git a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r12.ebuild b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r13.ebuild
index 17cd5ba1524e..cf16545b22d7 100644
--- a/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r12.ebuild
+++ b/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r13.ebuild
@@ -1,6 +1,6 @@
-# Copyright 1999-2004 Gentoo Foundation
+# Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r12.ebuild,v 1.1 2004/12/20 21:23:13 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/uclinux-sources/uclinux-sources-2.6.7_p0-r13.ebuild,v 1.1 2005/01/09 10:59:22 plasmaroo Exp $
 
 IUSE=""
 
@@ -60,6 +60,8 @@ src_unpack() {
 	epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1056.patch || die "Failed to apply the CAN-2004-1056 patch!"
 	epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1137.patch || die "Failed to apply the CAN-2004-1137 patch!"
 	epatch ${FILESDIR}/${PN}-2.6.CAN-2004-1151.patch || die "Failed to apply the CAN-2004-1151 patch!"
+	epatch ${FILESDIR}/${PN}.77094.patch || die "Failed to apply bug #77094 patch!"
+	epatch ${FILESDIR}/${PN}-2.6.brk-locked.patch || die "Failed to apply do_brk_locked() patch!"
 
 	set MY_ARCH=${ARCH}
 	unset ARCH