rpms/kernel/devel lirc-staging-2.6.36-fixes.patch, NONE, 1.1 kernel.spec, 1.2082, 1.2083

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv30448

Modified Files:
	kernel.spec 
Added Files:
	lirc-staging-2.6.36-fixes.patch 
Log Message:
lirc-staging-2.6.36-fixes.patch: Fix up buffer size checking in
  lirc code, found by CONFIG_DEBUG_STRICT_USER_COPY_CHECKS

lirc-staging-2.6.36-fixes.patch:
 lirc_it87.c   |    2 +-
 lirc_serial.c |    3 ++-
 lirc_sir.c    |    2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

--- NEW FILE lirc-staging-2.6.36-fixes.patch ---
--- linux-2.6.34.noarch.orig/drivers/staging/lirc/lirc_it87.c
+++ linux-2.6.34.noarch/drivers/staging/lirc/lirc_it87.c
@@ -209,7 +209,7 @@ static ssize_t lirc_write(struct file *f
 	int i = 0;
 	unsigned char data_buf[WBUF_LEN];
 
-	if (n % sizeof(int) || (n > sizeof(int) * WBUF_LEN))
+	if (n % sizeof(int) || n > sizeof(data_buf))
 		return -EINVAL;
 	if (copy_from_user(data_buf, buf, n))
 		return -EFAULT;
--- linux-2.6.34.noarch.orig/drivers/staging/lirc/lirc_serial.c
+++ linux-2.6.34.noarch/drivers/staging/lirc/lirc_serial.c
@@ -968,7 +968,8 @@ static ssize_t lirc_write(struct file *f
 	if (n % sizeof(int))
 		return -EINVAL;
 	count = n / sizeof(int);
-	if (n > (WBUF_LEN * sizeof(int)) || count % 2 == 0)
+	/* FIXME: is this 'count % 2' check correct? */
+	if (n > sizeof(data_buf) || count % 2 == 0)
 		return -EINVAL;
 	if (copy_from_user(data_buf, buf, n))
 		return -EFAULT;
--- linux-2.6.34.noarch.orig/drivers/staging/lirc/lirc_sir.c
+++ linux-2.6.34.noarch/drivers/staging/lirc/lirc_sir.c
@@ -297,7 +297,7 @@ static ssize_t lirc_write(struct file *f
 	int i;
 	unsigned char data_buf[WBUF_LEN];
 
-	if (n % sizeof(int) || (n > WBUF_LEN * sizeof(int)))
+	if (n % sizeof(int) || n > sizeof(data_buf))
 		return -EINVAL;
 	if (copy_from_user(data_buf, buf, n))
 		return -EFAULT;


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.2082
retrieving revision 1.2083
diff -u -p -r1.2082 -r1.2083
--- kernel.spec	18 Jul 2010 13:44:15 -0000	1.2082
+++ kernel.spec	18 Jul 2010 13:50:54 -0000	1.2083
@@ -676,6 +676,7 @@ Patch2911: linux-2.6-v4l-dvb-add-kworld-
 Patch2912: linux-2.6-v4l-dvb-ir-core-update.patch
 
 Patch2915: lirc-staging-2.6.36.patch
+Patch2916: lirc-staging-2.6.36-fixes.patch
 Patch2917: hdpvr-ir-enable.patch
 
 # fs fixes
@@ -1254,6 +1255,7 @@ ApplyPatch linux-2.6-v4l-dvb-add-kworld-
 
 # http://www.lirc.org/
 ApplyPatch lirc-staging-2.6.36.patch
+ApplyOptionalPatch lirc-staging-2.6.36-fixes.patch
 # enable IR receiver on Hauppauge HD PVR (v4l-dvb merge pending)
 ApplyPatch hdpvr-ir-enable.patch
 
@@ -1861,6 +1863,10 @@ fi
 #                 ||     ||
 
 %changelog
+* Sun Jul 18 2010 Chuck Ebbert <cebbert at redhat.com>
+- lirc-staging-2.6.36-fixes.patch: Fix up buffer size checking in
+  lirc code, found by CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
+
 * Sun Jul 18 2010 Hans de Goede <hdegoede at redhat.com>
 - Add support for dynamic menu controls to the uvcvideo driver (#576023)