rpms/kernel/devel kernel.spec, 1.2084, 1.2085 linux-2.6-v4l-dvb-ir-core-update.patch, 1.1, 1.2 lirc-staging-2.6.36.patch, 1.3, 1.4

Jarod Wilson jwilson at fedoraproject.org
Mon Jul 19 17:47:37 UTC 2010


Author: jwilson

Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv11001

Modified Files:
	kernel.spec linux-2.6-v4l-dvb-ir-core-update.patch 
	lirc-staging-2.6.36.patch 
Log Message:
* Mon Jul 19 2010 Jarod Wilson <jarod at redhat.com> 2.6.35-0.48.rc5.git2
- Fix from Kyle for input_set_key oops introduced by ir-core patches (#615707)
- Update lirc-staging patches to match what's about to be submitted upstream,
  complete with updated copy_from_user overflow check fixages



Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.2084
retrieving revision 1.2085
diff -u -p -r1.2084 -r1.2085
--- kernel.spec	18 Jul 2010 13:56:31 -0000	1.2084
+++ kernel.spec	19 Jul 2010 17:47:36 -0000	1.2085
@@ -676,7 +676,7 @@ Patch2911: linux-2.6-v4l-dvb-add-kworld-
 Patch2912: linux-2.6-v4l-dvb-ir-core-update.patch
 
 Patch2915: lirc-staging-2.6.36.patch
-Patch2916: lirc-staging-2.6.36-fixes.patch
+#Patch2916: lirc-staging-2.6.36-fixes.patch
 Patch2917: hdpvr-ir-enable.patch
 
 # fs fixes
@@ -1255,7 +1255,7 @@ ApplyPatch linux-2.6-v4l-dvb-add-kworld-
 
 # http://www.lirc.org/
 ApplyPatch lirc-staging-2.6.36.patch
-ApplyOptionalPatch lirc-staging-2.6.36-fixes.patch
+#ApplyOptionalPatch lirc-staging-2.6.36-fixes.patch
 # enable IR receiver on Hauppauge HD PVR (v4l-dvb merge pending)
 ApplyPatch hdpvr-ir-enable.patch
 
@@ -1863,6 +1863,11 @@ fi
 #                 ||     ||
 
 %changelog
+* Mon Jul 19 2010 Jarod Wilson <jarod at redhat.com> 2.6.35-0.48.rc5.git2
+- Fix from Kyle for input_set_key oops introduced by ir-core patches (#615707)
+- Update lirc-staging patches to match what's about to be submitted upstream,
+  complete with updated copy_from_user overflow check fixages
+
 * Sun Jul 18 2010 Chuck Ebbert <cebbert at redhat.com> 2.6.35-0.47.rc5.git2
 - Linux 2.6.35-rc5-git2
 

linux-2.6-v4l-dvb-ir-core-update.patch:
 Documentation/DocBook/media-entities.tmpl           |    1 
 Documentation/DocBook/media.tmpl                    |    8 
 Documentation/DocBook/v4l/lirc_device_interface.xml |  235 ++++
 Documentation/DocBook/v4l/remote_controllers.xml    |    2 
 Documentation/dvb/get_dvb_firmware                  |   19 
 Documentation/video4linux/CARDLIST.cx23885          |    6 
 drivers/input/evdev.c                               |   39 
 drivers/input/input.c                               |  268 ++++
 drivers/media/IR/Kconfig                            |   34 
 drivers/media/IR/Makefile                           |    3 
 drivers/media/IR/imon.c                             |    5 
 drivers/media/IR/ir-core-priv.h                     |   54 
 drivers/media/IR/ir-jvc-decoder.c                   |  152 --
 drivers/media/IR/ir-lirc-codec.c                    |  283 ++++
 drivers/media/IR/ir-nec-decoder.c                   |  151 --
 drivers/media/IR/ir-raw-event.c                     |  167 +-
 drivers/media/IR/ir-rc5-decoder.c                   |  167 --
 drivers/media/IR/ir-rc6-decoder.c                   |  153 --
 drivers/media/IR/ir-sony-decoder.c                  |  155 --
 drivers/media/IR/ir-sysfs.c                         |  261 ++--
 drivers/media/IR/keymaps/Makefile                   |    2 
 drivers/media/IR/keymaps/rc-lirc.c                  |   41 
 drivers/media/IR/keymaps/rc-rc6-mce.c               |  105 +
 drivers/media/IR/lirc_dev.c                         |  764 +++++++++++++
 drivers/media/IR/mceusb.c                           | 1143 ++++++++++++++++++++
 drivers/media/common/tuners/tda18271-fe.c           |    8 
 drivers/media/dvb/mantis/Kconfig                    |   14 
 drivers/media/dvb/mantis/mantis_input.c             |    5 
 drivers/media/video/cx23885/cx23885-cards.c         |   40 
 drivers/media/video/cx23885/cx23885-core.c          |   11 
 drivers/media/video/cx23885/cx23885-dvb.c           |    2 
 drivers/media/video/cx23885/cx23885-input.c         |  317 +----
 drivers/media/video/cx23885/cx23885-ir.c            |    2 
 drivers/media/video/cx23885/cx23885.h               |   12 
 drivers/media/video/cx88/cx88-cards.c               |    9 
 drivers/media/video/cx88/cx88-i2c.c                 |    6 
 drivers/media/video/cx88/cx88-input.c               |   46 
 drivers/media/video/cx88/cx88.h                     |    1 
 drivers/media/video/em28xx/em28xx-input.c           |   80 -
 drivers/media/video/em28xx/em28xx-video.c           |    4 
 drivers/media/video/em28xx/em28xx.h                 |    1 
 drivers/media/video/hdpvr/hdpvr-core.c              |    5 
 drivers/media/video/ir-kbd-i2c.c                    |   14 
 drivers/media/video/pvrusb2/pvrusb2-ioread.c        |    5 
 include/linux/input.h                               |   39 
 include/media/ir-core.h                             |    8 
 include/media/ir-kbd-i2c.h                          |    2 
 include/media/lirc.h                                |  165 ++
 include/media/lirc_dev.h                            |  225 +++
 include/media/rc-map.h                              |    7 
 50 files changed, 3971 insertions(+), 1275 deletions(-)

Index: linux-2.6-v4l-dvb-ir-core-update.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/linux-2.6-v4l-dvb-ir-core-update.patch,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -p -r1.1 -r1.2
--- linux-2.6-v4l-dvb-ir-core-update.patch	16 Jul 2010 21:21:56 -0000	1.1
+++ linux-2.6-v4l-dvb-ir-core-update.patch	19 Jul 2010 17:47:37 -0000	1.2
@@ -14,7 +14,7 @@ Signed-off-by: Jarod Wilson <jarod at redha
  Documentation/dvb/get_dvb_firmware                  |   19 
  Documentation/video4linux/CARDLIST.cx23885          |    6 
  drivers/input/evdev.c                               |   39 
- drivers/input/input.c                               |  267 ++++
+ drivers/input/input.c                               |  268 ++++
  drivers/media/IR/Kconfig                            |   34 
  drivers/media/IR/Makefile                           |    3 
  drivers/media/IR/imon.c                             |    5 
@@ -57,7 +57,7 @@ Signed-off-by: Jarod Wilson <jarod at redha
  include/media/lirc.h                                |  165 ++
  include/media/lirc_dev.h                            |  225 +++
  include/media/rc-map.h                              |    7 
- 50 files changed, 3970 insertions(+), 1275 deletions(-)
+ 50 files changed, 3971 insertions(+), 1275 deletions(-)
 
 diff --git a/Documentation/DocBook/media-entities.tmpl b/Documentation/DocBook/media-entities.tmpl
 index 5d4d40f..6ae9715 100644
@@ -765,7 +765,7 @@ index 9c79bd5..43aeb71 100644
  }
  EXPORT_SYMBOL(input_get_keycode);
  
-@@ -692,13 +871,41 @@ int input_set_keycode(struct input_dev *dev,
+@@ -692,13 +871,42 @@ int input_set_keycode(struct input_dev *dev,
  
  	spin_lock_irqsave(&dev->event_lock, flags);
  
@@ -804,6 +804,7 @@ index 9c79bd5..43aeb71 100644
 +		if (retval)
 +			goto out;
 +
++		old_keycode = kt_entry->keycode;
 +		kt_entry.keycode = keycode;
 +
 +		retval = dev->setkeycodebig(dev, &kt_entry);

lirc-staging-2.6.36.patch:
 Kconfig                 |    2 
 Makefile                |    1 
 lirc/Kconfig            |  110 +++
 lirc/Makefile           |   19 
 lirc/TODO               |    8 
 lirc/lirc_bt829.c       |  383 +++++++++++++
 lirc/lirc_ene0100.c     |  646 ++++++++++++++++++++++
 lirc/lirc_ene0100.h     |  169 +++++
 lirc/lirc_i2c.c         |  536 ++++++++++++++++++
 lirc/lirc_igorplugusb.c |  555 +++++++++++++++++++
 lirc/lirc_imon.c        | 1058 ++++++++++++++++++++++++++++++++++++
 lirc/lirc_it87.c        | 1019 +++++++++++++++++++++++++++++++++++
 lirc/lirc_it87.h        |  116 ++++
 lirc/lirc_ite8709.c     |  542 ++++++++++++++++++
 lirc/lirc_parallel.c    |  705 ++++++++++++++++++++++++
 lirc/lirc_parallel.h    |   26 
 lirc/lirc_sasem.c       |  933 ++++++++++++++++++++++++++++++++
 lirc/lirc_serial.c      | 1313 +++++++++++++++++++++++++++++++++++++++++++++
 lirc/lirc_sir.c         | 1282 ++++++++++++++++++++++++++++++++++++++++++++
 lirc/lirc_streamzap.c   |  821 ++++++++++++++++++++++++++++
 lirc/lirc_ttusbir.c     |  397 +++++++++++++
 lirc/lirc_zilog.c       | 1387 ++++++++++++++++++++++++++++++++++++++++++++++++
 22 files changed, 12028 insertions(+)

Index: lirc-staging-2.6.36.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/lirc-staging-2.6.36.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -p -r1.3 -r1.4
--- lirc-staging-2.6.36.patch	18 Jul 2010 05:42:18 -0000	1.3
+++ lirc-staging-2.6.36.patch	19 Jul 2010 17:47:37 -0000	1.4
@@ -8,19 +8,19 @@
  drivers/staging/lirc/lirc_ene0100.h     |  169 ++++
  drivers/staging/lirc/lirc_i2c.c         |  536 ++++++++++++
  drivers/staging/lirc/lirc_igorplugusb.c |  555 ++++++++++++
- drivers/staging/lirc/lirc_imon.c        | 1057 +++++++++++++++++++++++
- drivers/staging/lirc/lirc_it87.c        | 1021 +++++++++++++++++++++++
+ drivers/staging/lirc/lirc_imon.c        | 1058 +++++++++++++++++++++++
+ drivers/staging/lirc/lirc_it87.c        | 1019 +++++++++++++++++++++++
  drivers/staging/lirc/lirc_it87.h        |  116 +++
  drivers/staging/lirc/lirc_ite8709.c     |  542 ++++++++++++
- drivers/staging/lirc/lirc_parallel.c    |  708 ++++++++++++++++
+ drivers/staging/lirc/lirc_parallel.c    |  705 ++++++++++++++++
  drivers/staging/lirc/lirc_parallel.h    |   26 +
  drivers/staging/lirc/lirc_sasem.c       |  933 +++++++++++++++++++++
- drivers/staging/lirc/lirc_serial.c      | 1318 +++++++++++++++++++++++++++++
- drivers/staging/lirc/lirc_sir.c         | 1283 ++++++++++++++++++++++++++++
+ drivers/staging/lirc/lirc_serial.c      | 1313 +++++++++++++++++++++++++++++
+ drivers/staging/lirc/lirc_sir.c         | 1282 ++++++++++++++++++++++++++++
  drivers/staging/lirc/lirc_streamzap.c   |  821 ++++++++++++++++++
  drivers/staging/lirc/lirc_ttusbir.c     |  397 +++++++++
  drivers/staging/lirc/lirc_zilog.c       | 1387 +++++++++++++++++++++++++++++++
- 22 files changed, 12038 insertions(+), 0 deletions(-)
+ 22 files changed, 12028 insertions(+), 0 deletions(-)
 
 diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
 index 984a754..9296517 100644
@@ -2519,10 +2519,10 @@ index 0000000..bce600e
 +
 diff --git a/drivers/staging/lirc/lirc_imon.c b/drivers/staging/lirc/lirc_imon.c
 new file mode 100644
-index 0000000..5393ae4
+index 0000000..43856d6
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_imon.c
-@@ -0,0 +1,1057 @@
+@@ -0,0 +1,1058 @@
 +/*
 + *   lirc_imon.c:  LIRC/VFD/LCD driver for SoundGraph iMON IR/VFD/LCD
 + *		   including the iMON PAD model
@@ -2906,7 +2906,7 @@ index 0000000..5393ae4
 +	struct imon_context *context;
 +	const unsigned char vfd_packet6[] = {
 +		0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF };
-+	unsigned char data_buf[IMON_DATA_BUF_SZ];
++	int *data_buf;
 +
 +	context = (struct imon_context *)file->private_data;
 +	if (!context) {
@@ -2922,24 +2922,25 @@ index 0000000..5393ae4
 +		goto exit;
 +	}
 +
-+	if (n_bytes <= 0 || n_bytes > 32) {
++	if (n_bytes <= 0 || n_bytes > IMON_DATA_BUF_SZ - 3) {
 +		err("%s: invalid payload size", __func__);
 +		retval = -EINVAL;
 +		goto exit;
 +	}
 +
-+	if (copy_from_user(data_buf, buf, n_bytes)) {
-+		retval = -EFAULT;
++	data_buf = memdup_user(buf, n_bytes);
++	if (IS_ERR(data_buf)) {
++		retval = PTR_ERR(data_buf);
 +		goto exit;
 +	}
 +
 +	memcpy(context->tx.data_buf, data_buf, n_bytes);
 +
 +	/* Pad with spaces */
-+	for (i = n_bytes; i < 32; ++i)
++	for (i = n_bytes; i < IMON_DATA_BUF_SZ - 3; ++i)
 +		context->tx.data_buf[i] = ' ';
 +
-+	for (i = 32; i < 35; ++i)
++	for (i = IMON_DATA_BUF_SZ - 3; i < IMON_DATA_BUF_SZ; ++i)
 +		context->tx.data_buf[i] = 0xFF;
 +
 +	offset = 0;
@@ -2959,7 +2960,7 @@ index 0000000..5393ae4
 +			offset += 7;
 +		}
 +
-+	} while (offset < 35);
++	} while (offset < IMON_DATA_BUF_SZ);
 +
 +	if (context->vfd_proto_6p) {
 +		/* Send packet #6 */
@@ -3582,10 +3583,10 @@ index 0000000..5393ae4
 +module_exit(imon_exit);
 diff --git a/drivers/staging/lirc/lirc_it87.c b/drivers/staging/lirc/lirc_it87.c
 new file mode 100644
-index 0000000..785714c
+index 0000000..781abc3
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_it87.c
-@@ -0,0 +1,1021 @@
+@@ -0,0 +1,1019 @@
 +/*
 + * LIRC driver for ITE IT8712/IT8705 CIR port
 + *
@@ -3664,7 +3665,6 @@ index 0000000..785714c
 +static unsigned char it87_RXEN_mask = IT87_CIR_RCR_RXEN;
 +
 +#define RBUF_LEN 1024
-+#define WBUF_LEN 1024
 +
 +#define LIRC_DRIVER_NAME "lirc_it87"
 +
@@ -3701,7 +3701,6 @@ index 0000000..785714c
 +
 +static int rx_buf[RBUF_LEN];
 +unsigned int rx_tail, rx_head;
-+static int tx_buf[WBUF_LEN];
 +
 +static struct pnp_driver it87_pnp_driver;
 +
@@ -3795,13 +3794,13 @@ index 0000000..785714c
 +			  size_t n, loff_t *pos)
 +{
 +	int i = 0;
-+	unsigned char data_buf[WBUF_LEN];
++	int *tx_buf;
 +
-+	if (n % sizeof(int) || (n > sizeof(int) * WBUF_LEN))
++	if (n % sizeof(int))
 +		return -EINVAL;
-+	if (copy_from_user(data_buf, buf, n))
-+		return -EFAULT;
-+	memcpy(tx_buf, data_buf, n);
++	tx_buf = memdup_user(buf, n);
++	if (IS_ERR(tx_buf))
++		return PTR_ERR(tx_buf);
 +	n /= sizeof(int);
 +	init_send();
 +	while (1) {
@@ -5279,10 +5278,10 @@ index 0000000..9352f45
 +MODULE_PARM_DESC(debug, "Enable debugging messages");
 diff --git a/drivers/staging/lirc/lirc_parallel.c b/drivers/staging/lirc/lirc_parallel.c
 new file mode 100644
-index 0000000..9e86646
+index 0000000..df12e7b
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_parallel.c
-@@ -0,0 +1,708 @@
+@@ -0,0 +1,705 @@
 +/*
 + * lirc_parallel.c
 + *
@@ -5362,10 +5361,8 @@ index 0000000..9e86646
 +unsigned int default_timer = LIRC_TIMER;
 +#endif
 +
-+#define WBUF_SIZE (256)
 +#define RBUF_SIZE (256) /* this must be a power of 2 larger than 1 */
 +
-+static int wbuf[WBUF_SIZE];
 +static int rbuf[RBUF_SIZE];
 +
 +DECLARE_WAIT_QUEUE_HEAD(lirc_wait);
@@ -5667,20 +5664,19 @@ index 0000000..9e86646
 +	unsigned int level, newlevel;
 +	unsigned long flags;
 +	int counttimer;
++	int *wbuf;
 +
 +	if (!is_claimed)
 +		return -EBUSY;
 +
-+	if (n % sizeof(int))
-+		return -EINVAL;
-+
 +	count = n / sizeof(int);
 +
-+	if (count > WBUF_SIZE || count % 2 == 0)
++	if (n % sizeof(int) || count % 2 == 0)
 +		return -EINVAL;
 +
-+	if (copy_from_user(wbuf, buf, n))
-+		return -EFAULT;
++	wbuf = memdup_user(buf, n);
++	if (IS_ERR(wbuf))
++		return PTR_ERR(wbuf);
 +
 +#ifdef LIRC_TIMER
 +	if (timer == 0) {
@@ -6025,7 +6021,7 @@ index 0000000..4bed6af
 +#endif
 diff --git a/drivers/staging/lirc/lirc_sasem.c b/drivers/staging/lirc/lirc_sasem.c
 new file mode 100644
-index 0000000..c67b06e
+index 0000000..9e516a1
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_sasem.c
 @@ -0,0 +1,933 @@
@@ -6394,7 +6390,7 @@ index 0000000..c67b06e
 +	int i;
 +	int retval = 0;
 +	struct sasem_context *context;
-+	unsigned char data_buf[SASEM_DATA_BUF_SZ];
++	int *data_buf;
 +
 +	context = (struct sasem_context *) file->private_data;
 +	if (!context) {
@@ -6410,20 +6406,20 @@ index 0000000..c67b06e
 +		goto exit;
 +	}
 +
-+	if (n_bytes <= 0 || n_bytes > 32) {
++	if (n_bytes <= 0 || n_bytes > SASEM_DATA_BUF_SZ) {
 +		err("%s: invalid payload size", __func__);
 +		retval = -EINVAL;
 +		goto exit;
 +	}
 +
-+	retval = copy_from_user(data_buf, buf, n_bytes);
-+	if (retval < 0)
-+		goto exit;
++	data_buf = memdup_user(buf, n_bytes);
++	if (PTR_ERR(data_buf))
++		return PTR_ERR(data_buf);
 +
 +	memcpy(context->tx.data_buf, data_buf, n_bytes);
 +
 +	/* Pad with spaces */
-+	for (i = n_bytes; i < 32; ++i)
++	for (i = n_bytes; i < SASEM_DATA_BUF_SZ; ++i)
 +		context->tx.data_buf[i] = ' ';
 +
 +	/* Nine 8 byte packets to be sent */
@@ -6964,10 +6960,10 @@ index 0000000..c67b06e
 +module_exit(sasem_exit);
 diff --git a/drivers/staging/lirc/lirc_serial.c b/drivers/staging/lirc/lirc_serial.c
 new file mode 100644
-index 0000000..60ce1d1
+index 0000000..d2ea3f0
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_serial.c
-@@ -0,0 +1,1318 @@
+@@ -0,0 +1,1313 @@
 +/*
 + * lirc_serial.c
 + *
@@ -7204,14 +7200,11 @@ index 0000000..60ce1d1
 +/* This MUST be a power of two!  It has to be larger than 1 as well. */
 +
 +#define RBUF_LEN 256
-+#define WBUF_LEN 256
 +
 +static struct timeval lasttv = {0, 0};
 +
 +static struct lirc_buffer rbuf;
 +
-+static int wbuf[WBUF_LEN];
-+
 +static unsigned int freq = 38000;
 +static unsigned int duty_cycle = 50;
 +
@@ -7930,19 +7923,17 @@ index 0000000..60ce1d1
 +	int i, count;
 +	unsigned long flags;
 +	long delta = 0;
-+	unsigned char data_buf[WBUF_LEN];
++	int *wbuf;
 +
-+	if (!(hardware[type].features&LIRC_CAN_SEND_PULSE))
++	if (!(hardware[type].features & LIRC_CAN_SEND_PULSE))
 +		return -EBADF;
 +
-+	if (n % sizeof(int))
-+		return -EINVAL;
 +	count = n / sizeof(int);
-+	if (n > (WBUF_LEN * sizeof(int)) || count % 2 == 0)
++	if (n % sizeof(int) || count % 2 == 0)
 +		return -EINVAL;
-+	if (copy_from_user(data_buf, buf, n))
-+		return -EFAULT;
-+	memcpy(wbuf, data_buf, n);
++	wbuf = memdup_user(buf, n);
++	if (PTR_ERR(wbuf))
++		return PTR_ERR(wbuf);
 +	spin_lock_irqsave(&hardware[type].lock, flags);
 +	if (type == LIRC_IRDEO) {
 +		/* DTR, RTS down */
@@ -7950,7 +7941,7 @@ index 0000000..60ce1d1
 +	}
 +	for (i = 0; i < count; i++) {
 +		if (i%2)
-+			hardware[type].send_space(wbuf[i]-delta);
++			hardware[type].send_space(wbuf[i] - delta);
 +		else
 +			delta = hardware[type].send_pulse(wbuf[i]);
 +	}
@@ -8288,10 +8279,10 @@ index 0000000..60ce1d1
 +MODULE_PARM_DESC(debug, "Enable debugging messages");
 diff --git a/drivers/staging/lirc/lirc_sir.c b/drivers/staging/lirc/lirc_sir.c
 new file mode 100644
-index 0000000..8cef4bc
+index 0000000..97146d1
 --- /dev/null
 +++ b/drivers/staging/lirc/lirc_sir.c
-@@ -0,0 +1,1283 @@
+@@ -0,0 +1,1282 @@
 +/*
 + * LIRC SIR driver, (C) 2000 Milan Pikula <www at fornax.sk>
 + *
@@ -8466,7 +8457,6 @@ index 0000000..8cef4bc
 +
 +static int rx_buf[RBUF_LEN];
 +static unsigned int rx_tail, rx_head;
-+static int tx_buf[WBUF_LEN];
 +
 +static int debug;
 +#define dprintk(fmt, args...)						\
@@ -8588,28 +8578,28 @@ index 0000000..8cef4bc
 +				loff_t *pos)
 +{
 +	unsigned long flags;
-+	int i;
-+	unsigned char data_buf[WBUF_LEN];
++	int i, count;
++	int *tx_buf;
 +
-+	if (n % sizeof(int) || (n > WBUF_LEN * sizeof(int)))
++	count = n / sizeof(int);
++	if (n % sizeof(int) || count % 2 == 0)
 +		return -EINVAL;
-+	if (copy_from_user(data_buf, buf, n))
-+		return -EFAULT;
-+	memcpy(tx_buf, data_buf, n);
++	tx_buf = memdup_user(buf, n);
++	if (IS_ERR(tx_buf))
++		return PTR_ERR(tx_buf);
 +	i = 0;
-+	n /= sizeof(int);
 +#ifdef LIRC_ON_SA1100
 +	/* disable receiver */
 +	Ser2UTCR3 = 0;
 +#endif
 +	local_irq_save(flags);
 +	while (1) {
-+		if (i >= n)
++		if (i >= count)
 +			break;
 +		if (tx_buf[i])
 +			send_pulse(tx_buf[i]);
 +		i++;
-+		if (i >= n)
++		if (i >= count)
 +			break;
 +		if (tx_buf[i])
 +			send_space(tx_buf[i]);
@@ -8625,7 +8615,7 @@ index 0000000..8cef4bc
 +	/* enable receiver */
 +	Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
 +#endif
-+	return n;
++	return count;
 +}
 +
 +static long lirc_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)



More information about the scm-commits mailing list