initial check-in of kp49 work (up to commit date)

[kernel-bfs] / kernel-bfs-2.6.28 / debian / patches / dspbridge_ioctl_buffer_overrun.diff

diff --git a/kernel-bfs-2.6.28/debian/patches/dspbridge_ioctl_buffer_overrun.diff b/kernel-bfs-2.6.28/debian/patches/dspbridge_ioctl_buffer_overrun.diff
new file mode 100644 (file)
index 0000000..c67bfe5
--- /dev/null
+++ b/kernel-bfs-2.6.28/debian/patches/dspbridge_ioctl_buffer_overrun.diff
@@ -0,0 +1,40 @@
+---
+ drivers/dsp/bridge/pmgr/wcd.c |   12 ++++++++++--
+ 1 files changed, 10 insertions(+), 2 deletions(-)
+
+Index: kernel-power-2.6.28/drivers/dsp/bridge/pmgr/wcd.c
+===================================================================
+--- kernel-power-2.6.28.orig/drivers/dsp/bridge/pmgr/wcd.c
++++ kernel-power-2.6.28/drivers/dsp/bridge/pmgr/wcd.c
+@@ -242,21 +242,29 @@
+                                   u32 *result, void *pr_ctxt)
+ {
+       u32 (*ioctl_cmd)(union Trapped_Args *args, void *pr_ctxt) = NULL;
+-      int i;
++      u32 i;
+ 
+       if (_IOC_TYPE(cmd) != DB) {
+               pr_err("%s: Incompatible dspbridge ioctl number\n", __func__);
+               goto err;
+       }
+-
++#ifdef CONFIG_BRIDGE_NEW_API
+       if (DB_GET_IOC_TABLE(cmd) > ARRAY_SIZE(size_cmd)) {
++#else
++      if (DB_GET_IOC_TABLE(cmd) >= ARRAY_SIZE(size_cmd)) {
++#endif
+               pr_err("%s: undefined ioctl module\n", __func__);
+               goto err;
+       }
+ 
+       /* Check the size of the required cmd table */
+       i = DB_GET_IOC(cmd);
++#ifdef CONFIG_BRIDGE_NEW_API
+       if (i > size_cmd[DB_GET_IOC_TABLE(cmd)]) {
++#else
++      if (i >= size_cmd[DB_GET_IOC_TABLE(cmd)]) {
++#endif
++
+               pr_err("%s: requested ioctl %d out of bounds for table %d\n",
+                                       __func__, i, DB_GET_IOC_TABLE(cmd));
+               goto err;