2.18-4.8: CVE-2010-3879

Signed-off-by: Karel Zak <kzak@redhat.com>

.gitignore

@@ -1,2 +1,5 @@
 floppy-0.16.tar.bz2
 util-linux-ng-2.18.tar.bz2
+*~
+*.rpm
+*.log

util-linux-ng-2.17-agetty-clocal.patch

@@ -1,30 +0,0 @@
-From 9fcaa8826c180273829cf03e5fe34e08daef721f Mon Sep 17 00:00:00 2001
-From: Karel Zak <kzak@redhat.com>
-Date: Mon, 12 Jul 2010 11:57:55 +0200
-Subject: [PATCH] aggety: don't wipe CLOCAL flag
-
-gettey should not clear the flag. It seems that the flag is
-automatically enabled for serial consoles tht don't use CD signal.
-
-Addresses: http://bugzilla.redhat.com/show_bug.cgi?id=598631
-Signed-off-by: Karel Zak <kzak@redhat.com>
----
- login-utils/agetty.c |    2 +-
- 1 files changed, 1 insertions(+), 1 deletions(-)
-
-diff --git a/login-utils/agetty.c b/login-utils/agetty.c
-index 39a1fd3..0cb00db 100644
---- a/login-utils/agetty.c
-+++ b/login-utils/agetty.c
-@@ -706,7 +706,7 @@ termio_init(tp, speed, op)
-     /* flush input and output queues, important for modems! */
-     (void) tcflush(0, TCIOFLUSH);
- 
--    tp->c_cflag = CS8 | HUPCL | CREAD;
-+    tp->c_cflag = CS8 | HUPCL | CREAD | (tp->c_cflag & CLOCAL);
-     cfsetispeed(tp, speed);
-     cfsetospeed(tp, speed);
-     if (op->flags & F_LOCAL) {
--- 
-1.6.6.1
-

util-linux-ng-2.18-agetty-baudrate.patch

@@ -0,0 +1,206 @@
+
+ based on upstream patch:
+
+	commit 848e5e6ce3978d921366b799d907a78a12299924
+	Author: Karel Zak <kzak@redhat.com>
+	Date:   Wed Aug 18 09:02:03 2010 +0200
+
+	agetty: add -s to reuse existing baud rate
+
+	For example:
+
+	/sbin/agetty -s /dev/ttyS0 9600
+
+	will reuse the speed the kernel configured on the port. If the setting
+	from kernel is useless (tty returns BREAK character) then the baud
+	rate from command line (9600) is used.
+
+	Addresses: http://bugzilla.redhat.com/show_bug.cgi?id=623685
+	Signed-off-by: Karel Zak <kzak@redhat.com>
+
+ and
+
+	commit e98f4af950a64db188e0a9f3eed20fefaa463a99
+	Author: Karel Zak <kzak@redhat.com>
+	Date:   Fri Oct 22 21:24:50 2010 +0200
+
+	agetty: fix -s option (baud rate setup)
+
+	The problem is pretty visible in strace output:
+
+	broken version:
+	ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B115200 opost isig icanon echo ...}) = 0
+	[...]
+	ioctl(0, SNDCTL_TMR_START or TCSETS, {B0 -opost -isig -icanon -echo ...}) = 0
+					   ^^^
+	fixed version:
+	ioctl(0, SNDCTL_TMR_TIMEBASE or TCGETS, {B115200 opost isig icanon echo ...}) = 0
+	[...]
+	ioctl(0, SNDCTL_TMR_START or TCSETS, {B115200 -opost -isig -icanon -echo ...}) = 0
+
+	Reported-by: Jon Masters <jcm@redhat.com>
+	Addresses: http://bugzilla.redhat.com/show_bug.cgi?id=645640
+	Signed-off-by: Karel Zak <kzak@redhat.com>
+
+diff -up util-linux-ng-2.18/login-utils/agetty.8.kzak util-linux-ng-2.18/login-utils/agetty.8
+--- util-linux-ng-2.18/login-utils/agetty.8.kzak	2010-02-04 12:53:56.000000000 +0100
++++ util-linux-ng-2.18/login-utils/agetty.8	2010-10-22 22:07:43.000000000 +0200
+@@ -3,7 +3,7 @@
+ agetty \- alternative Linux getty
+ 
+ .SH SYNOPSIS
+-.BR "agetty " [\-8ihLmnUw]
++.BR "agetty " [\-8ihLmnsUw]
+ .RI "[-f " issue_file ]
+ .RI "[-l " login_program ]
+ .RI "[-I " init ]
+@@ -12,16 +12,6 @@ agetty \- alternative Linux getty
+ .I port
+ .I baud_rate,...
+ .RI [ term ]
+-.br
+-.BR "agetty " [\-8ihLmnw]
+-.RI "[-f " issue_file ]
+-.RI "[-l " login_program ]
+-.RI "[-I " init ]
+-.RI "[-t " timeout ]
+-.RI "[-H " login_host ]
+-.I baud_rate,...
+-.I port
+-.RI [ term ]
+ 
+ .SH DESCRIPTION
+ .ad
+@@ -163,6 +153,10 @@ Force the line to be a local line with n
+ be useful when you have a locally attached terminal where the serial line
+ does not set the carrier detect signal.
+ .TP
++\-s
++Try to keep the existing baud rate. The baud rates from
++the command line are used when agetty receives a BREAK character.
++.TP
+ \-U
+ Turn on support for detecting an uppercase only terminal.  This setting will
+ detect a login name containing only capitals as indicating an uppercase
+diff -up util-linux-ng-2.18/login-utils/agetty.c.kzak util-linux-ng-2.18/login-utils/agetty.c
+--- util-linux-ng-2.18/login-utils/agetty.c.kzak	2010-04-01 16:11:56.000000000 +0200
++++ util-linux-ng-2.18/login-utils/agetty.c	2010-10-22 22:15:40.000000000 +0200
+@@ -133,6 +133,7 @@ struct options {
+ #define F_CUSTISSUE	(1<<6)		/* give alternative issue file */
+ #define F_NOPROMPT	(1<<7)		/* don't ask for login name! */
+ #define F_LCUC		(1<<8)		/* Support for *LCUC stty modes */
++#define F_KEEPSPEED	(1<<9)		/* Follow baud rate from kernel */
+ 
+ /* Storage for things detected while the login name was read. */
+ 
+@@ -203,7 +204,7 @@ void parse_args P_((int argc, char **arg
+ void parse_speeds P_((struct options *op, char *arg));
+ void update_utmp P_((char *line));
+ void open_tty P_((char *tty, struct termios *tp, int local));
+-void termio_init P_((struct termios *tp, int speed, struct options *op));
++void termio_init P_((struct termios *tp, struct options *op));
+ void auto_baud P_((struct termios *tp));
+ void do_prompt P_((struct options *op, struct termios *tp));
+ void next_speed P_((struct termios *tp, struct options *op));
+@@ -297,7 +298,7 @@ main(argc, argv)
+     tcsetpgrp(0, getpid());
+     /* Initialize the termios settings (raw mode, eight-bit, blocking i/o). */
+     debug("calling termio_init\n");
+-    termio_init(&termios, options.speeds[FIRST_SPEED], &options);
++    termio_init(&termios, &options);
+ 
+     /* write the modem init string and DON'T flush the buffers */
+     if (options.flags & F_INITSTRING) {
+@@ -373,7 +374,7 @@ parse_args(argc, argv, op)
+     extern int optind;			/* getopt */
+     int     c;
+ 
+-    while (isascii(c = getopt(argc, argv, "8I:LH:f:hil:mt:wUn"))) {
++    while (isascii(c = getopt(argc, argv, "8I:LH:f:hil:mst:wUn"))) {
+ 	switch (c) {
+ 	case '8':
+ 	    op->eightbits = 1;
+@@ -443,6 +444,9 @@ parse_args(argc, argv, op)
+ 	case 'n':
+ 	    op->flags |= F_NOPROMPT;
+ 	    break;
++	case 's':
++	    op->flags |= F_KEEPSPEED;		/* keep kernel defined speed */
++	    break;
+ 	case 't':				/* time out */
+ 	    if ((op->timeout = atoi(optarg)) <= 0)
+ 		error(_("bad timeout value: %s"), optarg);
+@@ -691,11 +695,17 @@ char gbuf[1024];
+ char area[1024];
+ 
+ void
+-termio_init(tp, speed, op)
++termio_init(tp, op)
+      struct termios *tp;
+-     int     speed;
+      struct options *op;
+ {
++    speed_t ispeed, ospeed;
++
++    if (op->flags & F_KEEPSPEED) {
++	ispeed = cfgetispeed(tp);		/* save the original setting */
++	ospeed = cfgetospeed(tp);
++    } else
++	ospeed = ispeed = op->speeds[FIRST_SPEED];
+ 
+     /*
+      * Initial termios settings: 8-bit characters, raw-mode, blocking i/o.
+@@ -706,14 +716,20 @@ termio_init(tp, speed, op)
+     /* flush input and output queues, important for modems! */
+     (void) tcflush(0, TCIOFLUSH);
+ 
++    tp->c_iflag = tp->c_lflag = tp->c_oflag = 0;
++
+     tp->c_cflag = CS8 | HUPCL | CREAD;
+-    cfsetispeed(tp, speed);
+-    cfsetospeed(tp, speed);
++
++    /* Note that the speed is stored in the c_cflag termios field, so we have
++     * set the speed always when the cflag se reseted.
++     */
++    cfsetispeed(tp, ispeed);
++    cfsetospeed(tp, ospeed);
++
+     if (op->flags & F_LOCAL) {
+ 	tp->c_cflag |= CLOCAL;
+     }
+ 
+-    tp->c_iflag = tp->c_lflag = tp->c_oflag = 0;
+ #ifdef HAVE_STRUCT_TERMIOS_C_LINE
+     tp->c_line = 0;
+ #endif
+@@ -973,9 +989,18 @@ next_speed(tp, op)
+      struct termios *tp;
+      struct options *op;
+ {
+-    static int baud_index = FIRST_SPEED;/* current speed index */
++    static int baud_index = -1;
++
++    if (baud_index == -1)
++	/*
++	 * if the F_KEEPSPEED flags is set then the FIRST_SPEED is not
++	 * tested yet (see termio_init()).
++	 */
++	baud_index = (op->flags & F_KEEPSPEED) ? FIRST_SPEED :
++		                                 1 % op->numspeed;
++    else
++	baud_index = (baud_index + 1) % op->numspeed;
+ 
+-    baud_index = (baud_index + 1) % op->numspeed;
+     cfsetispeed(tp, op->speeds[baud_index]);
+     cfsetospeed(tp, op->speeds[baud_index]);
+     (void) tcsetattr(0, TCSANOW, tp);
+@@ -1203,7 +1228,7 @@ bcode(s)
+ void
+ usage()
+ {
+-    fprintf(stderr, _("Usage: %s [-8hiLmUw] [-l login_program] [-t timeout] [-I initstring] [-H login_host] baud_rate,... line [termtype]\nor\t[-hiLmw] [-l login_program] [-t timeout] [-I initstring] [-H login_host] line baud_rate,... [termtype]\n"), progname);
++    fprintf(stderr, _("Usage: %s [-8hiLmsUw] [-l login_program] [-t timeout] [-I initstring] [-H login_host] baud_rate,... line [termtype]\nor\t[-hiLmw] [-l login_program] [-t timeout] [-I initstring] [-H login_host] line baud_rate,... [termtype]\n"), progname);
+     exit(1);
+ }
+ 

util-linux-ng-2.18-agetty-clocal.patch

@@ -0,0 +1,26 @@
+
+ backport of upstream patch:
+
+	Commit: e143d1f00497f0178a1febec8fb4aa7c842fa35a
+	From: Karel Zak <kzak@redhat.com>
+	Date: Mon, 12 Jul 2010 11:57:55 +0200
+	Subject: [PATCH] aggety: don't wipe CLOCAL flag
+
+	gettey should not clear the flag. It seems that the flag is
+	automatically enabled for serial consoles tht don't use CD signal.
+
+	Addresses: http://bugzilla.redhat.com/show_bug.cgi?id=598631
+	Signed-off-by: Karel Zak <kzak@redhat.com>
+
+diff -up util-linux-ng-2.18/login-utils/agetty.c.kzak util-linux-ng-2.18/login-utils/agetty.c
+--- util-linux-ng-2.18/login-utils/agetty.c.kzak	2010-10-22 21:51:31.000000000 +0200
++++ util-linux-ng-2.18/login-utils/agetty.c	2010-10-22 21:51:31.000000000 +0200
+@@ -715,7 +715,7 @@ termio_init(tp, speed, op)
+ 
+     tp->c_iflag = tp->c_lflag = tp->c_oflag = 0;
+ 
+-    tp->c_cflag = CS8 | HUPCL | CREAD;
++    tp->c_cflag = CS8 | HUPCL | CREAD | (tp->c_cflag & CLOCAL);
+ 
+     /* Note that the speed is stored in the c_cflag termios field, so we have
+      * set the speed always when the cflag se reseted.

util-linux-ng-2.18-blkid-offset.patch

@@ -0,0 +1,33 @@
+From 23489c26252f1c40407804e0cd4964835db18e8c Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 7 Sep 2010 11:30:50 +0200
+Subject: [PATCH] libblkid: don't ignore zero for SBMAGIC_OFFSET
+
+The side effect of this bug is that wipefs(8) does not report LUKS...
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ shlibs/blkid/src/superblocks/superblocks.c |    7 +++----
+ 1 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/shlibs/blkid/src/superblocks/superblocks.c b/shlibs/blkid/src/superblocks/superblocks.c
+index 3d66d98..95c10d6 100644
+--- a/shlibs/blkid/src/superblocks/superblocks.c
++++ b/shlibs/blkid/src/superblocks/superblocks.c
+@@ -487,10 +487,9 @@ int blkid_probe_set_magic(blkid_probe pr, blkid_loff_t offset,
+ 	int rc = 0;
+ 	struct blkid_chain *chn = blkid_probe_get_chain(pr);
+ 
+-	if (chn->flags & BLKID_SUBLKS_MAGIC) {
+-		if (magic && len)
+-			rc = blkid_probe_set_value(pr, "SBMAGIC", magic, len);
+-		if (!rc && offset)
++	if (magic && len && (chn->flags & BLKID_SUBLKS_MAGIC)) {
++		rc = blkid_probe_set_value(pr, "SBMAGIC", magic, len);
++		if (!rc)
+ 			rc = blkid_probe_sprintf_value(pr, "SBMAGIC_OFFSET",
+ 					"%llu",	offset);
+ 	}
+-- 
+1.7.3.1
+

util-linux-ng-2.18-blkid-raid.patch

@@ -0,0 +1,12 @@
+diff -up util-linux-ng-2.18/shlibs/blkid/src/partitions/partitions.c.kzak util-linux-ng-2.18/shlibs/blkid/src/partitions/partitions.c
+--- util-linux-ng-2.18/shlibs/blkid/src/partitions/partitions.c.kzak	2011-01-12 14:21:10.000000000 +0100
++++ util-linux-ng-2.18/shlibs/blkid/src/partitions/partitions.c	2011-01-12 14:20:54.000000000 +0100
+@@ -833,7 +833,7 @@ int blkid_probe_is_covered_by_pt(blkid_p
+ 	for (i = 0; i < nparts; i++) {
+ 		blkid_partition par = &ls->parts[i];
+ 
+-		if (par->start + par->size > pr->size) {
++		if (par->start + par->size > (pr->size >> 9)) {
+ 			DBG(DEBUG_LOWPROBE, printf("partition #%d overflows "
+ 					"device (off=%lu size=%lu)\n",
+ 					par->partno, par->start, par->size));

util-linux-ng-2.18-blkid-revalidate.patch

@@ -0,0 +1,63 @@
+From e8fc977aba09ddbd89b25276fd777c3f0eef9299 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Tue, 23 Nov 2010 19:49:58 +0100
+Subject: [PATCH] libblkid: cache is incorrectly revalidated
+
+for example:
+
+	# echo "password" | cryptsetup luksFormat /dev/loop7
+	# blkid /dev/loop7
+	/dev/loop7: UUID="09240a80-1cf1-456d-9a6e-a35b39dc1f2b" TYPE="crypto_LUKS"
+
+	# pvcreate -ff /dev/loop7
+	# blkid /dev/loop7
+	#
+
+the second blkid call has to return info about LVM.
+
+Reported-by: Milan Broz <mbroz@redhat.com>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ shlibs/blkid/src/blkidP.h |    2 +-
+ shlibs/blkid/src/probe.c  |    9 ++++-----
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/shlibs/blkid/src/blkidP.h b/shlibs/blkid/src/blkidP.h
+index 6ac8910..956a84e 100644
+--- a/shlibs/blkid/src/blkidP.h
++++ b/shlibs/blkid/src/blkidP.h
+@@ -437,7 +437,7 @@ extern size_t blkid_rtrim_whitespace(unsigned char *str);
+ 		((bmp)[ blkid_bmp_idx_byte(item) ] |= blkid_bmp_idx_bit(item))
+ 
+ #define blkid_bmp_unset_item(bmp, item)	\
+-		((bmp)[ bmp_idx_byte(item) ] &= ~bmp_idx_bit(item))
++		((bmp)[ blkid_bmp_idx_byte(item) ] &= ~blkid_bmp_idx_bit(item))
+ 
+ #define blkid_bmp_get_item(bmp, item)	\
+ 		((bmp)[ blkid_bmp_idx_byte(item) ] & blkid_bmp_idx_bit(item))
+diff --git a/shlibs/blkid/src/probe.c b/shlibs/blkid/src/probe.c
+index 3698b99..33e2fe1 100644
+--- a/shlibs/blkid/src/probe.c
++++ b/shlibs/blkid/src/probe.c
+@@ -431,14 +431,13 @@ int __blkid_probe_invert_filter(blkid_probe pr, int chain)
+ 	struct blkid_chain *chn;
+ 	unsigned long *fltr;
+ 
+-	fltr = blkid_probe_get_filter(pr, chain, FALSE);
+-	if (!fltr)
+-		return -1;
+-
+ 	chn = &pr->chains[chain];
+ 
++	if (!chn->driver->has_fltr || !chn->fltr)
++		return -1;
++
+ 	for (i = 0; i < blkid_bmp_nwords(chn->driver->nidinfos); i++)
+-		fltr[i] = ~fltr[i];
++		chn->fltr[i] = ~chn->fltr[i];
+ 
+ 	DBG(DEBUG_LOWPROBE, printf("probing filter inverted\n"));
+ 	/* blkid_probe_dump_filter(pr, chain); */
+-- 
+1.7.3.1
+

util-linux-ng-2.18-cfdisk-cyl.patch

@@ -0,0 +1,88 @@
+From 73356e0553bd9ac00f556891a4798064c0ee6849 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 6 Sep 2010 13:30:48 +0200
+Subject: [PATCH] cfdisk: don't use size of device based on cylinders
+
+This patch is enough to make cfdisk usable on non-DOS disks where
+partitioning is not based on CHS. cfdisk should not print error
+messages for such disks.
+
+Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=630340
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ fdisk/cfdisk.c |   17 +++++------------
+ 1 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/fdisk/cfdisk.c b/fdisk/cfdisk.c
+index 8801a85..149a616 100644
+--- a/fdisk/cfdisk.c
++++ b/fdisk/cfdisk.c
+@@ -197,7 +197,6 @@ int heads = 0;
+ int sectors = 0;
+ long long cylinders = 0;
+ int cylinder_size = 0;		/* heads * sectors */
+-long long total_size = 0;	/* actual_size rounded down */
+ long long actual_size = 0;	/* (in 512-byte sectors) - set using ioctl */
+ 				/* explicitly given user values */
+ int user_heads = 0, user_sectors = 0;
+@@ -779,7 +778,7 @@ del_part(int i) {
+     if (i < num_parts - 1)
+ 	p_info[i].last_sector = p_info[i+1].first_sector - 1;
+     else
+-	p_info[i].last_sector = total_size - 1;
++	p_info[i].last_sector = actual_size - 1;
+ 
+     p_info[i].offset = 0;
+     p_info[i].flags = 0;
+@@ -828,7 +827,7 @@ add_part(int num, int id, int flags, long long first, long long last,
+ 	return -1;
+     }
+ 
+-    if (first >= total_size) {
++    if (first >= actual_size) {
+ 	*errmsg = _("Partition begins after end-of-disk");
+ 	return -1;
+     }
+@@ -838,11 +837,6 @@ add_part(int num, int id, int flags, long long first, long long last,
+ 	return -1;
+     }
+ 
+-    if (last >= total_size) {
+-	*errmsg = _("Partition ends in the final partial cylinder");
+-	return -1;
+-    }
+-
+     for (i = 0; i < num_parts; i++) {
+ 	if (p_info[i].id > 0 && IS_PRIMARY(p_info[i].num))
+ 	    pri++;
+@@ -1535,8 +1529,7 @@ decide_on_geometry(void) {
+     if (user_cylinders > 0)
+ 	    cylinders = user_cylinders;
+ 
+-    total_size = cylinder_size*cylinders;
+-    if (total_size > actual_size)
++    if (cylinder_size * cylinders > actual_size)
+ 	    print_warning(_("You specified more cylinders than fit on disk"));
+ }
+ 
+@@ -1544,7 +1537,7 @@ static void
+ clear_p_info(void) {
+     num_parts = 1;
+     p_info[0].first_sector = 0;
+-    p_info[0].last_sector = total_size - 1;
++    p_info[0].last_sector = actual_size - 1;
+     p_info[0].offset = 0;
+     p_info[0].flags = 0;
+     p_info[0].id = FREE_SPACE;
+@@ -2327,7 +2320,7 @@ change_geometry(void) {
+     if (ret_val) {
+ 	long long disk_end;
+ 
+-	disk_end = total_size-1;
++	disk_end = actual_size-1;
+ 
+ 	if (p_info[num_parts-1].last_sector > disk_end) {
+ 	    while (p_info[num_parts-1].first_sector > disk_end) {
+-- 
+1.7.2.3
+

util-linux-ng-2.18-cfdisk-parttype.patch

@@ -0,0 +1,57 @@
+From 54a0fe298b4d6d948cffbd6fbbbe7dbabc9a6bb1 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Mon, 19 Jul 2010 22:52:58 +0200
+Subject: [PATCH] cfdisk: get_string not calculating correct limits
+
+Reported-by: James L. Hammons <jlhamm@acm.org>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ fdisk/cfdisk.c |   11 ++++++++---
+ 1 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fdisk/cfdisk.c b/fdisk/cfdisk.c
+index 7fa0b19..e7955fe 100644
+--- a/fdisk/cfdisk.c
++++ b/fdisk/cfdisk.c
+@@ -421,6 +421,11 @@ fdexit(int ret) {
+     exit(ret);
+ }
+ 
++/*
++ * Note that @len is size of @str buffer.
++ *
++ * Returns number of read bytes (without \0).
++ */
+ static int
+ get_string(char *str, int len, char *def) {
+     size_t cells = 0, i = 0;
+@@ -472,7 +477,7 @@ get_string(char *str, int len, char *def) {
+ 	    break;
+ 	default:
+ #if defined(HAVE_LIBNCURSESW) && defined(HAVE_WIDECHAR)
+-	    if (i < len && iswprint(c)) {
++	    if (i + 1 < len && iswprint(c)) {
+ 		wchar_t wc = (wchar_t) c;
+ 		char s[MB_CUR_MAX + 1];
+ 		int  sz = wctomb(s, wc);
+@@ -492,7 +497,7 @@ get_string(char *str, int len, char *def) {
+ 			putchar(BELL);
+ 	    }
+ #else
+-	    if (i < len && isprint(c)) {
++	    if (i + 1 < len && isprint(c)) {
+ 	        mvaddch(y, x + cells, c);
+ 		if (use_def) {
+ 		    clrtoeol();
+@@ -2405,7 +2410,7 @@ change_id(int i) {
+ 
+     sprintf(def, "%02X", new_id);
+     mvaddstr(COMMAND_LINE_Y, COMMAND_LINE_X, _("Enter filesystem type: "));
+-    if ((len = get_string(id, 2, def)) <= 0 && len != GS_DEFAULT)
++    if ((len = get_string(id, 3, def)) <= 0 && len != GS_DEFAULT)
+ 	return;
+ 
+     if (len != GS_DEFAULT) {
+-- 
+1.7.3.1
+

util-linux-ng-2.18-libmount-optsmerge.patch

@@ -0,0 +1,29 @@
+From a93e5691369b0d0878f4434f980c79e94216775d Mon Sep 17 00:00:00 2001
+From: Petr Uzel <petr.uzel@centrum.cz>
+Date: Sun, 4 Jul 2010 20:02:57 +0200
+Subject: [PATCH] libmount: fix merge_optstr (do not truncate 3 trailing characters)
+
+I believe this is the correct fix.
+
+Signed-off-by: Petr Uzel <petr.uzel@centrum.cz>
+---
+ shlibs/mount/src/tab_parse.c |    3 ++-
+ 1 files changed, 2 insertions(+), 1 deletions(-)
+
+diff --git a/shlibs/mount/src/tab_parse.c b/shlibs/mount/src/tab_parse.c
+index 5dbcfa6..680e1fc 100644
+--- a/shlibs/mount/src/tab_parse.c
++++ b/shlibs/mount/src/tab_parse.c
+@@ -254,7 +254,8 @@ static char *merge_optstr(const char *vfs, const char *fs)
+ 	if (!strcmp(vfs, fs))
+ 		return strdup(vfs);		/* e.g. "aaa" and "aaa" */
+ 
+-	sz = strlen(vfs) + strlen(fs) + 2;
++	/* leave space for leading "r[ow],", "," and trailing zero */
++	sz = strlen(vfs) + strlen(fs) + 5;
+ 	res = malloc(sz);
+ 	if (!res)
+ 		return NULL;
+-- 
+1.7.2.3
+

util-linux-ng-2.18-mount-context.patch

@@ -0,0 +1,120 @@
+From 81a12d11efc8d0db248f3bbdb21acd58a0651262 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Fri, 19 Nov 2010 13:37:25 +0100
+Subject: [PATCH] mount: ignore *context= options on remount
+
+Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=563267
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ mount/mount.c |   62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/mount/mount.c b/mount/mount.c
+index 1c8a55f..c0023f3 100644
+--- a/mount/mount.c
++++ b/mount/mount.c
+@@ -378,6 +378,56 @@ append_context(const char *optname, char *optdata, char **extra_opts)
+ 	freecon(raw);
+ 	return 0;
+ }
++
++/* returns newly allocated string without *context= options */
++static char *remove_context_options(char *opts)
++{
++	char *begin = NULL, *end = NULL, *p;
++	int open_quote = 0, changed = 0;
++
++	if (!opts)
++		return NULL;
++
++	opts = xstrdup(opts);
++
++	for (p = opts; p && *p; p++) {
++		if (!begin)
++			begin = p;		/* begin of the option item */
++		if (*p == '"')
++			open_quote ^= 1;	/* reverse the status */
++		if (open_quote)
++			continue;		/* still in quoted block */
++		if (*p == ',')
++			end = p;		/* terminate the option item */
++		else if (*(p + 1) == '\0')
++			end = p + 1;		/* end of optstr */
++		if (!begin || !end)
++			continue;
++
++		if (strncmp(begin, "context=", 8) == 0 ||
++		    strncmp(begin, "fscontext=", 10) == 0 ||
++		    strncmp(begin, "defcontext=", 11) == 0 ||
++	            strncmp(begin, "rootcontext=", 12) == 0) {
++			size_t sz;
++
++			if ((begin == opts || *(begin - 1) == ',') && *end == ',')
++				end++;
++			sz = strlen(end);
++
++			memmove(begin, end, sz + 1);
++			if (!*begin && *(begin - 1) == ',')
++				*(begin - 1) = '\0';
++
++			p = begin;
++			changed = 1;
++		}
++	}
++
++	if (changed && verbose)
++		printf (_("mount: SELinux *context= options are ignore on remount.\n"));
++
++	return opts;
++}
+ #endif
+ 
+ /*
+@@ -1382,6 +1432,7 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
+ 
+   parse_opts (opts, &flags, &extra_opts);
+   extra_opts1 = extra_opts;
++  mount_opts = extra_opts;
+ 
+   /* quietly succeed for fstab entries that don't get mounted automatically */
+   if (mount_all && (flags & MS_NOAUTO))
+@@ -1397,8 +1448,6 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
+                       "%s is already mounted on %s\n"),
+ 		      spec, node);
+ 
+-  mount_opts = extra_opts;
+-
+   if (opt_speed)
+       cdrom_setspeed(spec);
+ 
+@@ -1419,12 +1468,17 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
+   if (flags & (MS_BIND | MS_MOVE | MS_PROPAGATION))
+       types = "none";
+ 
++#ifdef HAVE_LIBSELINUX
++  if ((flags & MS_REMOUNT) && mount_opts)
++      mount_opts = remove_context_options(mount_opts);
++#endif
++
+   /*
+    * Call mount.TYPE for types that require a separate mount program.
+    * For the moment these types are ncpfs and smbfs. Maybe also vxfs.
+    * All such special things must occur isolated in the types string.
+    */
+-  if (check_special_mountprog(spec, node, types, flags, extra_opts, &status)) {
++  if (check_special_mountprog(spec, node, types, flags, mount_opts, &status)) {
+       res = status;
+       goto out;
+   }
+@@ -1718,6 +1772,8 @@ try_mount_one (const char *spec0, const char *node0, const char *types0,
+   }
+ #endif
+ 
++  if (extra_opts1 != mount_opts)
++	  my_free(mount_opts);
+   my_free(extra_opts1);
+   my_free(spec1);
+   my_free(node1);
+-- 
+1.7.3.1
+

util-linux-ng-2.18-mount-noncanon.patch

@@ -0,0 +1,29 @@
+From 1cf4c20b198c0c6566198fd00b983d9aaf8321bc Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Thu, 7 Oct 2010 16:05:12 +0200
+Subject: [PATCH] mount: don't canonicalize "spec" with --no-canonicalize option
+
+"Spec" was still canonicalized despite --no-canonicalize.  This
+resulted in a hang during login with pam_encfs (Debian Bug#593336).
+
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+---
+ mount/devname.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/mount/devname.c b/mount/devname.c
+index 585d259..05da092 100644
+--- a/mount/devname.c
++++ b/mount/devname.c
+@@ -8,7 +8,7 @@ spec_to_devname(const char *spec)
+ {
+ 	if (!spec)
+ 		return NULL;
+-	if (is_pseudo_fs(spec))
++	if (nocanonicalize || is_pseudo_fs(spec))
+ 		return xstrdup(spec);
+ 	return fsprobe_get_devname_by_spec(spec);
+ }
+-- 
+1.7.3.4
+

util-linux-ng-2.18-mount-subtype.patch

@@ -0,0 +1,115 @@
+From dc0a335554eafa643c7fd123d99e14df72c515c3 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <miklos@szeredi.hu>
+Date: Fri, 27 Aug 2010 16:58:44 +0200
+Subject: [PATCH] mount: handle filesystems with subtype
+
+Linux can handle filesystem types with "MAINTYPE.SUBTYPE" format,
+where the main type determines the actual filesystem driver while the
+subtype can be interpreted by the filesystem itself.
+
+When searching for mount helpers mount(8) and umount(8) should also
+interpret such types, falling back to (u)mount.MAINTYPE if
+(u)mount.MAINTYPE.SUBTYPE doesn't exist.
+
+This patch implements this, passing the type with "-t TYPE"
+to the mount program in this case.
+
+Reported-by: Josef Bacik <josef@redhat.com>
+Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=625064
+Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
+---
+ mount/mount.c  |   19 ++++++++++++++++---
+ mount/umount.c |   17 +++++++++++++++--
+ 2 files changed, 31 insertions(+), 5 deletions(-)
+
+diff --git a/mount/mount.c b/mount/mount.c
+index f2b6ee2..84986e3 100644
+--- a/mount/mount.c
++++ b/mount/mount.c
+@@ -664,13 +664,22 @@ check_special_mountprog(const char *spec, const char *node, const char *type, in
+ 
+ 	path = strtok(search_path, ":");
+ 	while (path) {
++		int type_opt = 0;
++
+ 		res = snprintf(mountprog, sizeof(mountprog), "%s/mount.%s",
+ 			       path, type);
+ 		path = strtok(NULL, ":");
+ 		if (res >= sizeof(mountprog) || res < 0)
+ 			continue;
+ 
+-		if (stat(mountprog, &statbuf))
++		res = stat(mountprog, &statbuf);
++		if (res == -1 && errno == ENOENT && strchr(type, '.')) {
++			/* If type ends with ".subtype" try without it */
++			*strrchr(mountprog, '.') = '\0';
++			type_opt = 1;
++			res = stat(mountprog, &statbuf);
++		}
++		if (res)
+ 			continue;
+ 
+ 		if (verbose)
+@@ -678,7 +687,7 @@ check_special_mountprog(const char *spec, const char *node, const char *type, in
+ 
+ 		switch (fork()) {
+ 		case 0: { /* child */
+-			char *oo, *mountargs[10];
++			char *oo, *mountargs[12];
+ 			int i = 0;
+ 
+ 			if (setgid(getgid()) < 0)
+@@ -703,7 +712,11 @@ check_special_mountprog(const char *spec, const char *node, const char *type, in
+ 				mountargs[i++] = "-o";			/* 8 */
+ 				mountargs[i++] = oo;			/* 9 */
+ 			}
+-			mountargs[i] = NULL;				/* 10 */
++			if (type_opt) {
++				mountargs[i++] = "-t";			/* 10 */
++				mountargs[i++] = (char *) type;		/* 11 */
++			}
++			mountargs[i] = NULL;				/* 12 */
+ 
+ 			if (verbose > 2) {
+ 				i = 0;
+diff --git a/mount/umount.c b/mount/umount.c
+index 5bd5360..0ad7c5f 100644
+--- a/mount/umount.c
++++ b/mount/umount.c
+@@ -103,11 +103,20 @@ check_special_umountprog(const char *spec, const char *node,
+ 		return 0;
+ 
+ 	if (strlen(type) < 100) {
++		int type_opt = 0;
++
+ 		sprintf(umountprog, "/sbin/umount.%s", type);
+-		if (stat(umountprog, &statbuf) == 0) {
++		res = stat(umountprog, &statbuf);
++		if (res == -1 && errno == ENOENT && strchr(type, '.')) {
++			/* If type ends with ".subtype" try without it */
++			*strrchr(umountprog, '.') = '\0';
++			type_opt = 1;
++			res = stat(umountprog, &statbuf);
++		}
++		if (res == 0) {
+ 			res = fork();
+ 			if (res == 0) {
+-				char *umountargs[8];
++				char *umountargs[10];
+ 				int i = 0;
+ 
+ 				if(setgid(getgid()) < 0)
+@@ -128,6 +137,10 @@ check_special_umountprog(const char *spec, const char *node,
+ 					umountargs[i++] = "-v";
+ 				if (remount)
+ 					umountargs[i++] = "-r";
++				if (type_opt) {
++					umountargs[i++] = "-t";
++					umountargs[i++] = (char *) type;
++				}
+ 				umountargs[i] = NULL;
+ 				execv(umountprog, umountargs);
+ 				exit(1);	/* exec failed */
+-- 
+1.7.2.3
+

util-linux-ng-blkid-HFS.patch

@@ -0,0 +1,28 @@
+From 791a2fd67c118c3f07141e4cc95532fe908015a9 Mon Sep 17 00:00:00 2001
+From: Alexandre Peixoto Ferreira <alexandref75@gmail.com>
+Date: Mon, 19 Jul 2010 18:04:33 -0500
+Subject: [PATCH] libblkid: set tolerant flag for HFS
+
+An CDROM can contain both HFS and ISO9660 views on the same filesystem.
+This confuses mount/KDE/Gnome.
+
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ shlibs/blkid/src/superblocks/hfs.c |    1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/shlibs/blkid/src/superblocks/hfs.c b/shlibs/blkid/src/superblocks/hfs.c
+index 8ebff68..033a65d 100644
+--- a/shlibs/blkid/src/superblocks/hfs.c
++++ b/shlibs/blkid/src/superblocks/hfs.c
+@@ -291,6 +291,7 @@ const struct blkid_idinfo hfs_idinfo =
+ 	.name		= "hfs",
+ 	.usage		= BLKID_USAGE_FILESYSTEM,
+ 	.probefunc	= probe_hfs,
++	.flags		= BLKID_IDINFO_TOLERANT,
+ 	.magics		=
+ 	{
+ 		{ .magic = "BD", .len = 2, .kboff = 1 },
+-- 
+1.7.2.3
+

util-linux-ng.spec

@@ -2,7 +2,7 @@
 Summary: A collection of basic system utilities
 Name: util-linux-ng
 Version: 2.18
-Release: 3%{?dist}
+Release: 4.8%{?dist}
 License: GPLv2 and GPLv2+ and GPLv3+ and LGPLv2+ and BSD with advertising and Public Domain
 Group: System Environment/Base
 URL: ftp://ftp.kernel.org/pub/linux/utils/util-linux-ng
@@ -109,10 +109,33 @@ Patch8: util-linux-ng-2.15-ipcs-32bit.patch
 
 ### Upstream Patches
 ###
+# 623685 - please extend agetty to not require a baud rate to be specified
+# 645640 - new "-s" parameter parsing in agetty does not work
+Patch9: util-linux-ng-2.18-agetty-baudrate.patch
 # 598631 - shutdown, reboot, halt and C-A-D don't work
-Patch9: util-linux-ng-2.17-agetty-clocal.patch
+Patch10: util-linux-ng-2.18-agetty-clocal.patch
 # 618957 - ISO images listed in fstab are mounted twice at boot
-Patch10: util-linux-ng-2.17-mount-loopdev.patch
+Patch11: util-linux-ng-2.17-mount-loopdev.patch
+# 630340 - cfdisk cannot read default installer partitioning
+Patch12: util-linux-ng-2.18-cfdisk-cyl.patch
+# don't truncate findmnt(1) output
+Patch13: util-linux-ng-2.18-libmount-optsmerge.patch
+# 538551 - Dual-filesystem (ISO9660/HFS) CD-ROMs not mounted automatically
+Patch14: util-linux-ng-blkid-HFS.patch
+# 625064 - fuse-sshfs mounts are not displayed in Nautilus
+Patch15: util-linux-ng-2.18-mount-subtype.patch
+# 641169 - cfdisk does not accept two-character partition type
+Patch16: util-linux-ng-2.18-cfdisk-parttype.patch
+# 563267 - Remount fails if current mount used the "context" option
+Patch17: util-linux-ng-2.18-mount-context.patch
+# fix wipefs(8) for LUKS
+Patch18: util-linux-ng-2.18-blkid-offset.patch
+# fix blkid cache usage
+Patch19: util-linux-ng-2.18-blkid-revalidate.patch
+# 543749 [+592958] - mdraid assembles incorrectly
+Patch20: util-linux-ng-2.18-blkid-raid.patch
+# 651183, CVE-2010-3879, fix --no-canonicalize, necessary for fuse
+Patch21: util-linux-ng-2.18-mount-noncanon.patch
 
 %description
 The util-linux-ng package contains a large variety of low-level system
@@ -229,6 +252,17 @@ cp %{SOURCE8} %{SOURCE9} .
 %patch8 -p1
 %patch9 -p1
 %patch10 -p1
+%patch11 -p1
+%patch12 -p1
+%patch13 -p1
+%patch14 -p1
+%patch15 -p1
+%patch16 -p1
+%patch17 -p1
+%patch18 -p1
+%patch19 -p1
+%patch20 -p1
+%patch21 -p1
 
 %build
 unset LINGUAS || :
@@ -765,6 +799,36 @@ fi
 
 
 %changelog
+* Thu Jan 27 2011 Karel Zak <kzak@redhat.com> 2.18-4.8
+- fix #651183, CVE-2010-3879, fix --no-canonicalize, necessary for fuse
+
+* Wed Jan 12 2011 Karel Zak <kzak@redhat.com> 2.18-4.7
+- improve raid member detection on patitioned raid devices (#543749)
+
+* Thu Nov 25 2010 Karel Zak <kzak@redhat.com> 2.18-4.6
+- backport upstream patch to fix wipefs(8) for LUKS
+- backport upstream patch to fix blkid cache usage
+
+* Fri Nov 19 2010 Karel Zak <kzak@redhat.com> 2.18-4.5
+- fix #563267 - Remount fails if current mount used the "context" option
+
+* Wed Oct 27 2010 Karel Zak <kzak@redhat.com> 2.18-4.4
+- fix #645640 - new "-s" parameter parsing in agetty does not work
+
+* Mon Oct 11 2010 Karel Zak <kzak@redhat.com> 2.18-4.3
+- fix #641169 - cfdisk does not accept two-character partition type
+
+* Thu Oct  7 2010 Karel Zak <kzak@redhat.com> 2.18-4.2
+- fix #538551 - Dual-filesystem (ISO9660/HFS) CD-ROMs not mounted automatically
+- fix #625064 - fuse-sshfs mounts are not displayed in Nautilus
+
+* Thu Oct  7 2010 Karel Zak <kzak@redhat.com> 2.18-4.1
+- fix 630340 - cfdisk cannot read default installer partitioning
+- don't truncate findmnt(1) output (usptream v2.18-6-ga93e569)
+
+* Wed Aug 18 2010 Karel Zak <kzak@redhat.com> 2.18-4
+- fix #623685 - please extend agetty to not require a baud rate to be specified
+
 * Thu Aug  5 2010 Karel Zak <kzak@redhat.com> 2.18-3
 - fix #620924 - /sbin/mount.tmpfs uses not available /usr/bin/id