Add patch radio-bcm2048-security.patch

 * Backport security fixes from upstream kernel for radio driver in patch radio-bcm2048-security.patch
   * fix sign of value in bcm2048_##prop##_read()
   * fix missing unlock on error in bcm2048_rds_fifo_receive()
   * fix coccinelle warnings: Replace memcpy with struct assignment
   * fix unneeded semicolon in bcm2048_fops_read()

diff --git a/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch b/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch
new file mode 100644 (file)
index 0000000..3721638
--- /dev/null
+++ b/kernel-power-2.6.28/debian/patches/radio-bcm2048-security.patch
@@ -0,0 +1,57 @@
+--- kernel-power-2.6.28.orig/drivers/media/radio/radio-bcm2048.c
++++ kernel-power-2.6.28/drivers/media/radio/radio-bcm2048.c
+@@ -739,8 +739,7 @@ static int bcm2048_set_region(struct bcm
+               return -EINVAL;
+ 
+       mutex_lock(&bdev->mutex);
+-      memcpy(&bdev->region_info, &region_configs[region],
+-              sizeof(struct region_info));
++      bdev->region_info = region_configs[region];
+       mutex_unlock(&bdev->mutex);
+ 
+       if (bdev->frequency < region_configs[region].bottom_frequency ||
+@@ -1764,6 +1763,7 @@ static void bcm2048_rds_fifo_receive(str
+                               bdev->rds_info.radio_text, bdev->fifo_size);
+       if (err != 2) {
+               dev_err(&bdev->client->dev, "RDS Read problem\n");
++              mutex_unlock(&bdev->mutex);
+               return;
+       }
+ 
+@@ -1979,7 +1979,7 @@ static ssize_t bcm2048_##prop##_read(str
+                                       char *buf)                      \
+ {                                                                     \
+       struct bcm2048_device *bdev = dev_get_drvdata(dev);             \
+-      size value;                                                     \
++      int value;                                                      \
+                                                                       \
+       if (!bdev)                                                      \
+               return -ENODEV;                                         \
+@@ -2243,7 +2243,7 @@ static ssize_t bcm2048_fops_read(struct 
+               if (copy_to_user(buf+i, tmpbuf, 3)) {
+                       retval = -EFAULT;
+                       break;
+-              };
++              }
+               i += 3;
+       }
+ 
+@@ -2350,7 +2350,7 @@ static int bcm2048_vidioc_queryctrl(stru
+ 
+       for (i = 0; i < ARRAY_SIZE(bcm2048_v4l2_queryctrl); i++) {
+               if (qc->id && qc->id == bcm2048_v4l2_queryctrl[i].id) {
+-                      memcpy(qc, &(bcm2048_v4l2_queryctrl[i]), sizeof(*qc));
++                      *qc = bcm2048_v4l2_queryctrl[i];
+                       return 0;
+               }
+       }
+@@ -2621,8 +2621,7 @@ static int bcm2048_i2c_driver_probe(stru
+               dev_dbg(&client->dev, "IRQ not configure. Using timeouts.\n");
+       }
+ 
+-      memcpy(bdev->videodev, &bcm2048_viddev_template,
+-                      sizeof(bcm2048_viddev_template));
++      *bdev->videodev = bcm2048_viddev_template;
+       video_set_drvdata(bdev->videodev, bdev);
+       if (video_register_device(bdev->videodev, VFL_TYPE_RADIO, radio_nr)) {
+               dev_dbg(&client->dev, "Could not register video device.\n");

diff --git a/kernel-power-2.6.28/debian/patches/series b/kernel-power-2.6.28/debian/patches/series
index 44e1a72..b3a568b 100644 (file)
--- a/kernel-power-2.6.28/debian/patches/series
+++ b/kernel-power-2.6.28/debian/patches/series
@@ -34,6 +34,7 @@ armthumb.diff
 wl12xx_rohar.diff
 #fmtx.unlock.diff
 radio-bcm2048.diff
+radio-bcm2048-security.patch
 #i2c-battery.diff
 musb_core_revert_20103103+0m5.diff
 usbhostmode.diff