From: Pali Rohár <pali.rohar@gmail.com>
Date: Fri, 9 May 2014 20:21:12 +0000 (+0200)
Subject: Add patch radio-bcm2048-security.patch
X-Git-Tag: v53~2
X-Git-Url: http://vcs.maemo.org/git/?a=commitdiff_plain;h=2ea4b05640e2cd06345416cc96ad16f48849dfce;hp=5dffdf52a2e9cf86a2be4344613d28106579102f;p=kernel-power

Add patch radio-bcm2048-security.patch

 * Backport security fixes from upstream kernel for radio driver in patch radio-bcm2048-security.patch
   * fix sign of value in bcm2048_##prop##_read()
   * fix missing unlock on error in bcm2048_rds_fifo_receive()
   * fix coccinelle warnings: Replace memcpy with struct assignment
   * fix unneeded semicolon in bcm2048_fops_read()
---

diff --git a/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch b/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch
new file mode 100644
index 0000000..3721638
--- /dev/null
+++ b/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch
@@ -0,0 +1,57 @@
+--- kernel-power-2.6.28.orig/drivers/media/radio/radio-bcm2048.c
++++ kernel-power-2.6.28/drivers/media/radio/radio-bcm2048.c
+@@ -739,8 +739,7 @@ static int bcm2048_set_region(struct bcm
+ 		return -EINVAL;
+ 
+ 	mutex_lock(&bdev->mutex);
+-	memcpy(&bdev->region_info, &region_configs[region],
+-		sizeof(struct region_info));
++	bdev->region_info = region_configs[region];
+ 	mutex_unlock(&bdev->mutex);
+ 
+ 	if (bdev->frequency < region_configs[region].bottom_frequency ||
+@@ -1764,6 +1763,7 @@ static void bcm2048_rds_fifo_receive(str
+ 				bdev->rds_info.radio_text, bdev->fifo_size);
+ 	if (err != 2) {
+ 		dev_err(&bdev->client->dev, "RDS Read problem\n");
++		mutex_unlock(&bdev->mutex);
+ 		return;
+ 	}
+ 
+@@ -1979,7 +1979,7 @@ static ssize_t bcm2048_##prop##_read(str
+ 					char *buf)			\
+ {									\
+ 	struct bcm2048_device *bdev = dev_get_drvdata(dev);		\
+-	size value;							\
++	int value;							\
+ 									\
+ 	if (!bdev)							\
+ 		return -ENODEV;						\
+@@ -2243,7 +2243,7 @@ static ssize_t bcm2048_fops_read(struct 
+ 		if (copy_to_user(buf+i, tmpbuf, 3)) {
+ 			retval = -EFAULT;
+ 			break;
+-		};
++		}
+ 		i += 3;
+ 	}
+ 
+@@ -2350,7 +2350,7 @@ static int bcm2048_vidioc_queryctrl(stru
+ 
+ 	for (i = 0; i < ARRAY_SIZE(bcm2048_v4l2_queryctrl); i++) {
+ 		if (qc->id && qc->id == bcm2048_v4l2_queryctrl[i].id) {
+-			memcpy(qc, &(bcm2048_v4l2_queryctrl[i]), sizeof(*qc));
++			*qc = bcm2048_v4l2_queryctrl[i];
+ 			return 0;
+ 		}
+ 	}
+@@ -2621,8 +2621,7 @@ static int bcm2048_i2c_driver_probe(stru
+ 		dev_dbg(&client->dev, "IRQ not configure. Using timeouts.\n");
+ 	}
+ 
+-	memcpy(bdev->videodev, &bcm2048_viddev_template,
+-			sizeof(bcm2048_viddev_template));
++	*bdev->videodev = bcm2048_viddev_template;
+ 	video_set_drvdata(bdev->videodev, bdev);
+ 	if (video_register_device(bdev->videodev, VFL_TYPE_RADIO, radio_nr)) {
+ 		dev_dbg(&client->dev, "Could not register video device.\n");
diff --git a/kernel-power-2.6.28/debian/patches/series b/kernel-power-2.6.28/debian/patches/series
index 44e1a72..b3a568b 100644
--- a/kernel-power-2.6.28/debian/patches/series
+++ b/kernel-power-2.6.28/debian/patches/series
@@ -34,6 +34,7 @@ armthumb.diff
 wl12xx_rohar.diff
 #fmtx.unlock.diff
 radio-bcm2048.diff
+radio-bcm2048-security.patch
 #i2c-battery.diff
 musb_core_revert_20103103+0m5.diff
 usbhostmode.diff