Security fixes - bugs #74384, #74392, #74464.

7 files changed, 374 insertions, 5 deletions

diff --git a/sys-kernel/xbox-sources/ChangeLog b/sys-kernel/xbox-sources/ChangeLog
index 910593a1d456..29d31b0a7a78 100644
--- a/sys-kernel/xbox-sources/ChangeLog
+++ b/sys-kernel/xbox-sources/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for sys-kernel/xbox-sources
 # Copyright 1999-2004 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.23 2004/12/19 20:13:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/ChangeLog,v 1.24 2004/12/20 22:21:09 plasmaroo Exp $
+
+*xbox-sources-2.6.8.1-r8 (20 Dec 2004)
+
+  20 Dec 2004; <plasmaroo@gentoo.org> -xbox-sources-2.6.8.1-r7.ebuild,
+  +xbox-sources-2.6.8.1-r8.ebuild,
+  +files/xbox-sources-2.6.8.1.CAN-2004-1016.patch,
+  +files/xbox-sources-2.6.8.1.CAN-2004-1056.patch,
+  +files/xbox-sources-2.6.8.1.CAN-2004-1137.patch:
+  Security fixes - bugs #74384, #74392, #74464.
 
 *xbox-sources-2.6.8.1-r7 (19 Dec 2004)
 
diff --git a/sys-kernel/xbox-sources/Manifest b/sys-kernel/xbox-sources/Manifest
index be40f55d5447..8e660dc30791 100644
--- a/sys-kernel/xbox-sources/Manifest
+++ b/sys-kernel/xbox-sources/Manifest
@@ -1,12 +1,13 @@
-MD5 de72cbc4cd3bf73124d06e5a6d8ab7c7 ChangeLog 6768
+MD5 f3788685d77e5947258b157b1492f5f8 xbox-sources-2.6.8.1-r8.ebuild 1317
+MD5 aa8164b69221d6a194f5a931d75ac47d ChangeLog 7116
 MD5 c2a56d354398d9255422286f7af425ee metadata.xml 351
-MD5 0ff58dbeb2c1fb18a05f0b1783df0cf1 xbox-sources-2.6.8.1-r7.ebuild 1203
 MD5 04be120a1c8b3c3ad58858c1109791b0 xbox-sources-2.4.28-r1.ebuild 720
-MD5 40a6dbccda0c9bc455d86f03e1db7d62 files/digest-xbox-sources-2.6.8.1-r7 230
+MD5 09e9f1cad6f2f28fe81682cbad8e3011 files/xbox-sources-2.6.8.1.CAN-2004-1137.patch 2551
 MD5 025c80544aef14ce3a49024d791c5596 files/xbox-sources-2.6.8.1.binfmt_a.out.patch 1763
 MD5 b0a1f80aff51d6601e8924329023b241 files/xbox-sources.AF_UNIX.patch 515
 MD5 a9991d6324d7404ed99e79be6e44e9de files/xbox-sources-2.6.8.1.binfmt_elf.patch 2348
 MD5 452e04a312368605e145428c35bd0e05 files/xbox-sources-2.6.8.1.devPtmx.patch 572
+MD5 6aa8f7a7c2d55734389b53d3bcf78570 files/xbox-sources-2.6.8.1.CAN-2004-1016.patch 2835
 MD5 4d656fa3f3a47df751c0d78b64ed8353 files/xbox-sources-2.6.8.1.AF_UNIX.SELinux.patch 1761
 MD5 c2510fe1891f5a9effb12c2196922206 files/xbox-sources-2.6.7.cmdlineLeak.patch 281
 MD5 b9a94233e1457787352e5f85e3e3582d files/xbox-sources-2.4.28.binfmt_a.out.patch 2009
@@ -14,4 +15,6 @@ MD5 530630d25910e6bd9376b63ea099655f files/xbox-sources-2.6.8.1.AF_UNIX.patch 46
 MD5 8165de5e2ab6e0d3263ea35ce856fd1b files/xbox-sources-2.6.8.1.smbfs.patch 3309
 MD5 6bcdd0bb63e2db559a5c6465c73a7f89 files/xbox-sources-2.6.8.1.CAN-2004-1151.patch 1143
 MD5 22192366443458dc8815827df35b63a7 files/xbox-sources-2.6.8.1.vma.patch 8034
+MD5 40a6dbccda0c9bc455d86f03e1db7d62 files/digest-xbox-sources-2.6.8.1-r8 230
+MD5 c942eca63f26d0e933a366491340e95b files/xbox-sources-2.6.8.1.CAN-2004-1056.patch 6187
 MD5 e0d5b095eef177dd9cb377c1ba881066 files/digest-xbox-sources-2.4.28-r1 226
diff --git a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r7 b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r8
index 088326d79b41..088326d79b41 100644
--- a/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r7
+++ b/sys-kernel/xbox-sources/files/digest-xbox-sources-2.6.8.1-r8
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch
new file mode 100644
index 000000000000..aa25ac95ed61
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1016.patch
@@ -0,0 +1,75 @@
+===== include/linux/socket.h 1.12 vs edited =====
+--- 1.12/include/linux/socket.h	2004-09-09 06:40:01 +10:00
++++ edited/include/linux/socket.h	2004-11-27 11:53:40 +11:00
+@@ -90,6 +90,10 @@
+ 				  (struct cmsghdr *)(ctl) : \
+ 				  (struct cmsghdr *)NULL)
+ #define CMSG_FIRSTHDR(msg)	__CMSG_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
++#define CMSG_OK(mhdr, cmsg) ((cmsg)->cmsg_len >= sizeof(struct cmsghdr) && \
++			     (cmsg)->cmsg_len <= (unsigned long) \
++			     ((mhdr)->msg_controllen - \
++			      ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
+ 
+ /*
+  *	This mess will go away with glibc
+===== net/core/scm.c 1.10 vs edited =====
+--- 1.10/net/core/scm.c	2004-05-31 05:08:14 +10:00
++++ edited/net/core/scm.c	2004-11-27 11:48:55 +11:00
+@@ -127,9 +127,7 @@
+ 		   for too short ancillary data object at all! Oops.
+ 		   OK, let's add it...
+ 		 */
+-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+-				    + cmsg->cmsg_len) > msg->msg_controllen)
++		if (!CMSG_OK(msg, cmsg))
+ 			goto error;
+ 
+ 		if (cmsg->cmsg_level != SOL_SOCKET)
+===== net/ipv4/ip_sockglue.c 1.26 vs edited =====
+--- 1.26/net/ipv4/ip_sockglue.c	2004-07-01 06:10:53 +10:00
++++ edited/net/ipv4/ip_sockglue.c	2004-11-27 11:49:45 +11:00
+@@ -146,11 +146,8 @@
+ 	struct cmsghdr *cmsg;
+ 
+ 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
+-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+-				    + cmsg->cmsg_len) > msg->msg_controllen) {
++		if (!CMSG_OK(msg, cmsg))
+ 			return -EINVAL;
+-		}
+ 		if (cmsg->cmsg_level != SOL_IP)
+ 			continue;
+ 		switch (cmsg->cmsg_type) {
+===== net/ipv6/datagram.c 1.20 vs edited =====
+--- 1.20/net/ipv6/datagram.c	2004-11-10 17:57:03 +11:00
++++ edited/net/ipv6/datagram.c	2004-11-27 11:51:15 +11:00
+@@ -427,9 +427,7 @@
+ 		int addr_type;
+ 		struct net_device *dev = NULL;
+ 
+-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+-				    + cmsg->cmsg_len) > msg->msg_controllen) {
++		if (!CMSG_OK(msg, cmsg)) {
+ 			err = -EINVAL;
+ 			goto exit_f;
+ 		}
+===== net/sctp/socket.c 1.129 vs edited =====
+--- 1.129/net/sctp/socket.c	2004-11-19 08:43:18 +11:00
++++ edited/net/sctp/socket.c	2004-11-27 11:52:11 +11:00
+@@ -4098,12 +4098,8 @@
+ 	for (cmsg = CMSG_FIRSTHDR(msg);
+ 	     cmsg != NULL;
+ 	     cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) {
+-		/* Check for minimum length.  The SCM code has this check.  */
+-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
+-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
+-				    + cmsg->cmsg_len) > msg->msg_controllen) {
++		if (!CMSG_OK(msg, cmsg))
+ 			return -EINVAL;
+-		}
+ 
+ 		/* Should we parse this header or ignore?  */
+ 		if (cmsg->cmsg_level != IPPROTO_SCTP)
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch
new file mode 100644
index 000000000000..f55ca8372e38
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1056.patch
@@ -0,0 +1,202 @@
+diff -ur linux-2.6.7/drivers/char/drm/i810_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c
+--- linux-2.6.7/drivers/char/drm/i810_dma.c	2004-06-16 06:19:12.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i810_dma.c	2004-12-19 22:52:54.885438960 +0000
+@@ -1034,10 +1034,7 @@
+    	drm_file_t	  *priv	  = filp->private_data;
+    	drm_device_t	  *dev	  = priv->dev;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_flush_ioctl called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp );
+ 
+    	i810_flush_queue(dev);
+    	return 0;
+@@ -1059,10 +1056,7 @@
+ 	if (copy_from_user(&vertex, (drm_i810_vertex_t *)arg, sizeof(vertex)))
+ 		return -EFAULT;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_dma_vertex called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp );
+ 
+ 	DRM_DEBUG("i810 dma vertex, idx %d used %d discard %d\n",
+ 		  vertex.idx, vertex.used, vertex.discard);
+@@ -1094,10 +1088,7 @@
+    	if (copy_from_user(&clear, (drm_i810_clear_t *)arg, sizeof(clear)))
+ 		return -EFAULT;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_clear_bufs called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp );
+ 
+  	/* GH: Someone's doing nasty things... */
+  	if (!dev->dev_private) {
+@@ -1118,10 +1109,8 @@
+ 
+ 	DRM_DEBUG("i810_swap_bufs\n");
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_swap_buf called without lock held\n");
+-		return -EINVAL;
+-	}
++
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	i810_dma_dispatch_swap( dev );
+    	return 0;
+@@ -1156,10 +1145,7 @@
+    	if (copy_from_user(&d, (drm_i810_dma_t *)arg, sizeof(d)))
+ 		return -EFAULT;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_dma called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	d.granted = 0;
+ 
+@@ -1270,10 +1256,7 @@
+ 		return -EFAULT;
+ 
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_dma_mc called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	if (mc.idx >= dma->buf_count || mc.idx < 0)
+ 		return -EINVAL;
+@@ -1321,10 +1304,7 @@
+ 	drm_device_t *dev = priv->dev;
+ 	drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_fstatus called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 	return I810_READ(0x30008);
+ }
+ 
+@@ -1335,10 +1315,7 @@
+ 	drm_device_t *dev = priv->dev;
+ 	drm_i810_private_t *dev_priv = (drm_i810_private_t *)dev->dev_private;
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_ov0_flip called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	//Tell the overlay to update
+ 	I810_WRITE(0x30000,dev_priv->overlay_physical | 0x80000000);
+@@ -1380,10 +1357,7 @@
+ 
+ 	DRM_DEBUG("%s\n", __FUNCTION__);
+ 
+-	if (!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i810_flip_buf called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp );
+ 
+ 	if (!dev_priv->page_flipping) 
+ 		i810_do_init_pageflip( dev );
+diff -ur linux-2.6.7/drivers/char/drm/i830_dma.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c
+--- linux-2.6.7/drivers/char/drm/i830_dma.c	2004-06-16 06:18:57.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_dma.c	2004-12-19 22:52:54.887438656 +0000
+@@ -1320,10 +1320,7 @@
+    	drm_file_t	  *priv	  = filp->private_data;
+    	drm_device_t	  *dev	  = priv->dev;
+ 
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_flush_ioctl called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+    	i830_flush_queue(dev);
+    	return 0;
+@@ -1344,10 +1341,7 @@
+ 	if (copy_from_user(&vertex, (drm_i830_vertex_t __user *)arg, sizeof(vertex)))
+ 		return -EFAULT;
+ 
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_dma_vertex called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	DRM_DEBUG("i830 dma vertex, idx %d used %d discard %d\n",
+ 		  vertex.idx, vertex.used, vertex.discard);
+@@ -1374,10 +1368,7 @@
+    	if (copy_from_user(&clear, (drm_i830_clear_t __user *)arg, sizeof(clear)))
+ 		return -EFAULT;
+    
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_clear_bufs called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	/* GH: Someone's doing nasty things... */
+ 	if (!dev->dev_private) {
+@@ -1399,10 +1390,7 @@
+    
+ 	DRM_DEBUG("i830_swap_bufs\n");
+ 
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_swap_buf called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	i830_dma_dispatch_swap( dev );
+    	return 0;
+@@ -1443,10 +1431,7 @@
+ 
+ 	DRM_DEBUG("%s\n", __FUNCTION__);
+ 
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_flip_buf called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	if (!dev_priv->page_flipping) 
+ 		i830_do_init_pageflip( dev );
+@@ -1485,10 +1470,7 @@
+    	if (copy_from_user(&d, (drm_i830_dma_t __user *)arg, sizeof(d)))
+ 		return -EFAULT;
+    
+-	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_dma called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 	
+ 	d.granted = 0;
+ 
+diff -ur linux-2.6.7/drivers/char/drm/i830_irq.c linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c
+--- linux-2.6.7/drivers/char/drm/i830_irq.c	2004-06-16 06:19:44.000000000 +0100
++++ linux-2.6.7.drm.plasmaroo/drivers/char/drm/i830_irq.c	2004-12-19 22:52:54.887438656 +0000
+@@ -129,10 +129,7 @@
+ 	drm_i830_irq_emit_t emit;
+ 	int result;
+ 
+-   	if(!_DRM_LOCK_IS_HELD(dev->lock.hw_lock->lock)) {
+-		DRM_ERROR("i830_irq_emit called without lock held\n");
+-		return -EINVAL;
+-	}
++	LOCK_TEST_WITH_RETURN( dev, filp ); 
+ 
+ 	if ( !dev_priv ) {
+ 		DRM_ERROR( "%s called with no initialization\n", __FUNCTION__ );
diff --git a/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch
new file mode 100644
index 000000000000..0a54680f6f4b
--- /dev/null
+++ b/sys-kernel/xbox-sources/files/xbox-sources-2.6.8.1.CAN-2004-1137.patch
@@ -0,0 +1,77 @@
+# ChangeSet
+#   2004/12/14 11:06:25-08:00 chrisw@osdl.org 
+#   [IPV4/IPV6]: IGMP source filter fixes
+#   
+#   When adding or deleting from the source list make sure to find matches
+#   by comparing against the new source address, not the group address.
+#   Also, check each addr in the list rather than just the first one.
+#   And, finally, only delete from list when there's a match rather than
+#   vice-versa.  Drop the effort to keep list sorted, since it's not done
+#   on full-state api and can create an sl_addr entry that the delta api
+#   won't be able to delete. Without these fixes sl_count can be corrupted
+#   which can allow for kernel memory corruption.
+#   
+#   Signed-off-by: Chris Wright <chrisw@osdl.org>
+#   Signed-off-by: David S. Miller <davem@davemloft.net>
+# 
+diff -Nru a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+--- a/net/ipv4/igmp.c	2004-12-20 11:32:15 -08:00
++++ b/net/ipv4/igmp.c	2004-12-20 11:32:15 -08:00
+@@ -1778,12 +1778,12 @@
+ 			goto done;
+ 		rv = !0;
+ 		for (i=0; i<psl->sl_count; i++) {
+-			rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
++			rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
+ 				sizeof(__u32));
+-			if (rv >= 0)
++			if (rv == 0)
+ 				break;
+ 		}
+-		if (!rv)	/* source not found */
++		if (rv)		/* source not found */
+ 			goto done;
+ 
+ 		/* update the interface filter */
+@@ -1825,9 +1825,9 @@
+ 	}
+ 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
+ 	for (i=0; i<psl->sl_count; i++) {
+-		rv = memcmp(&psl->sl_addr, &mreqs->imr_multiaddr,
++		rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
+ 			sizeof(__u32));
+-		if (rv >= 0)
++		if (rv == 0)
+ 			break;
+ 	}
+ 	if (rv == 0)		/* address already there is an error */
+diff -Nru a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+--- a/net/ipv6/mcast.c	2004-12-20 11:32:15 -08:00
++++ b/net/ipv6/mcast.c	2004-12-20 11:32:15 -08:00
+@@ -391,12 +391,12 @@
+ 			goto done;
+ 		rv = !0;
+ 		for (i=0; i<psl->sl_count; i++) {
+-			rv = memcmp(&psl->sl_addr, group,
++			rv = memcmp(&psl->sl_addr[i], source,
+ 				sizeof(struct in6_addr));
+-			if (rv >= 0)
++			if (rv == 0)
+ 				break;
+ 		}
+-		if (!rv)	/* source not found */
++		if (rv)		/* source not found */
+ 			goto done;
+ 
+ 		/* update the interface filter */
+@@ -437,8 +437,8 @@
+ 	}
+ 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
+ 	for (i=0; i<psl->sl_count; i++) {
+-		rv = memcmp(&psl->sl_addr, group, sizeof(struct in6_addr));
+-		if (rv >= 0)
++		rv = memcmp(&psl->sl_addr[i], source, sizeof(struct in6_addr));
++		if (rv == 0)
+ 			break;
+ 	}
+ 	if (rv == 0)		/* address already there is an error */
diff --git a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild
index 695defd6214a..f993cd530b7c 100644
--- a/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild
+++ b/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2004 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r7.ebuild,v 1.1 2004/12/19 20:13:10 plasmaroo Exp $
+# $Header: /var/cvsroot/gentoo-x86/sys-kernel/xbox-sources/xbox-sources-2.6.8.1-r8.ebuild,v 1.1 2004/12/20 22:21:09 plasmaroo Exp $
 
 ETYPE='sources'
 inherit kernel-2
@@ -21,6 +21,9 @@ UNIPATCH_LIST="
 	${FILESDIR}/${P}.binfmt_a.out.patch
 	${FILESDIR}/${P}.AF_UNIX.patch
 	${FILESDIR}/${P}.AF_UNIX.SELinux.patch
+	${FILESDIR}/${P}.CAN-2004-1016.patch
+	${FILESDIR}/${P}.CAN-2004-1056.patch
+	${FILESDIR}/${P}.CAN-2004-1137.patch
 	${FILESDIR}/${P}.CAN-2004-1151.patch
 	${FILESDIR}/${P}.vma.patch"
 DESCRIPTION='Full sources for the Xbox Linux kernel'