rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix brown paper bag hardlock bug in imon driver 

Signed-off-by: Jarod Wilson <jarod@redhat.com>
This commit is contained in:
Jarod Wilson 2010-10-23 16:03:57 -04:00
parent 643d353feb
commit 030d3b3b4b
2 changed files with 82 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
kernel.spec
View File

@ -48,7 +48,7 @@ Summary: The Linux kernel
# reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec).
# scripts/rebase.sh should be made to do that for you, actually.
#
%global baserelease 48
%global baserelease 49
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
@ -705,6 +705,7 @@ Patch2917: hdpvr-ir-enable.patch
Patch2918: linux-2.6-v4l-dvb-ir-core-update-2.patch
Patch2919: linux-2.6-v4l-dvb-ir-core-update-3.patch
Patch2920: linux-2.6-lirc-ioctl-compat-fixups.patch
Patch2923: linux-2.6-v4l-dvb-ir-core-fix-imon.patch
Patch2950: linux-2.6-via-velocity-dma-fix.patch
@ -1370,6 +1371,7 @@ ApplyPatch hdpvr-ir-enable.patch
ApplyPatch linux-2.6-v4l-dvb-ir-core-update-2.patch
ApplyPatch linux-2.6-v4l-dvb-ir-core-update-3.patch
ApplyPatch linux-2.6-lirc-ioctl-compat-fixups.patch
ApplyPatch linux-2.6-v4l-dvb-ir-core-fix-imon.patch
# Fix DMA bug on via-velocity
ApplyPatch linux-2.6-via-velocity-dma-fix.patch
@ -2039,6 +2041,9 @@ fi
# and build.
%changelog
* Sat Oct 23 2010 Jarod Wilson <jarod@redhat.com> 2.6.35.6-49
- Fix brown paper bag bug in imon driver
* Fri Oct 22 2010 Chuck Ebbert <cebbert@redhat.com> 2.6.35.6-48
- drm-i915-sanity-check-pread-pwrite.patch;
fix CVE-2010-2962, arbitrary kernel memory write via i915 GEM ioctl

76
linux-2.6-v4l-dvb-ir-core-fix-imon.patch Normal file
View File

@ -0,0 +1,76 @@
From: Jarod Wilson <jarod@redhat.com>
Date: Sat, 23 Oct 2010 19:42:20 +0000 (-0300)
Subject: [media] imon: fix my egregious brown paper bag w/rdev/idev split
X-Git-Url: http://git.linuxtv.org/media_tree.git?a=commitdiff_plain;h=428cc7633dedbab05aab80b805d8585572dc6dbf
[media] imon: fix my egregious brown paper bag w/rdev/idev split
Somehow, I managed to screw things up when reworking the rdev/idev split
patch from David, and started trying to get ir_input_dev from idev
instead of rdev, thus resulting in button presses hanging the system.
This fixes it.
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---
diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c
index 0391c3b..bcb2826 100644
--- a/drivers/media/IR/imon.c
+++ b/drivers/media/IR/imon.c
@@ -1477,7 +1477,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
bool norelease = false;
int i;
u64 scancode;
- struct input_dev *idev = NULL;
+ struct input_dev *rdev = NULL;
struct ir_input_dev *irdev = NULL;
int press_type = 0;
int msec;
@@ -1485,8 +1485,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
static struct timeval prev_time = { 0, 0 };
u8 ktype;
- idev = ictx->idev;
- irdev = input_get_drvdata(idev);
+ rdev = ictx->rdev;
+ irdev = input_get_drvdata(rdev);
/* filter out junk data on the older 0xffdc imon devices */
if ((buf[0] == 0xff) && (buf[1] == 0xff) && (buf[2] == 0xff))
@@ -1570,8 +1570,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
if (press_type == 0)
ir_keyup(irdev);
else {
- ir_keydown(ictx->rdev, ictx->rc_scancode,
- ictx->rc_toggle);
+ ir_keydown(rdev, ictx->rc_scancode, ictx->rc_toggle);
spin_lock_irqsave(&ictx->kc_lock, flags);
ictx->last_keycode = ictx->kc;
spin_unlock_irqrestore(&ictx->kc_lock, flags);
@@ -1587,7 +1586,7 @@ static void imon_incoming_packet(struct imon_context *ictx,
do_gettimeofday(&t);
msec = tv2int(&t, &prev_time);
prev_time = t;
- if (msec < idev->rep[REP_DELAY]) {
+ if (msec < ictx->idev->rep[REP_DELAY]) {
spin_unlock_irqrestore(&ictx->kc_lock, flags);
return;
}
@@ -1596,12 +1595,12 @@ static void imon_incoming_packet(struct imon_context *ictx,
spin_unlock_irqrestore(&ictx->kc_lock, flags);
- input_report_key(idev, kc, press_type);
- input_sync(idev);
+ input_report_key(ictx->idev, kc, press_type);
+ input_sync(ictx->idev);
/* panel keys don't generate a release */
- input_report_key(idev, kc, 0);
- input_sync(idev);
+ input_report_key(ictx->idev, kc, 0);
+ input_sync(ictx->idev);
ictx->last_keycode = kc;