[linux] 01/05: Replace "[media] dvb-usb: Don't use stack for reset either" with upstream fix

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch sid
in repository linux.

commit 8701ef58ba5d2466a681f4843e02c51112a43b84
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Apr 18 01:16:26 2017 +0100

    Replace "[media] dvb-usb: Don't use stack for reset either" with upstream fix
---
 debian/changelog                                   |  2 +
 ...-dvb-usb-don-t-use-stack-for-reset-either.patch | 63 +++++++++++++++-------
 2 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index 5709b3b..f4a26de 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -250,6 +250,8 @@ linux (4.9.22-1) UNRELEASED; urgency=medium
     - rtmutex: Provide locked slowpath
     - rwsem/rt: Lift single reader restriction
   * crypto: ahash - Fix EINPROGRESS notification callback (CVE-2017-7618)
+  * Replace "[media] dvb-usb: Don't use stack for reset either" with upstream
+    fix
 
   [ Salvatore Bonaccorso ]
   * ping: implement proper locking (CVE-2017-2671)
diff --git a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch b/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch
index e4fe2b6..2b307cc 100644
--- a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch
+++ b/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch
@@ -1,48 +1,71 @@
-From: Ben Hutchings <ben at decadent.org.uk>
-Subject: [media] dvb-usb: Don't use stack for reset either
-Date: Wed, 01 Mar 2017 15:39:17 +0000
+From: Stefan Brüns <stefan.bruens at rwth-aachen.de>
+Date: Sun, 12 Feb 2017 13:02:13 -0200
+Subject: [media] dvb-usb-firmware: don't do DMA on stack
+Origin: https://git.kernel.org/linus/67b0503db9c29b04eadfeede6bebbfe5ddad94ef
 Bug-Debian: https://bugs.debian.org/853894
 
-Commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware
-load") introduced a heap buffer for the firmware writes, but we need
-to do the same for the register writes to reset the DVB device's
-processor.
+The buffer allocation for the firmware data was changed in
+commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
+but the same applies for the reset value.
 
-Cc: stable at vger.kernel.org # 4.9+
 Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
-Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+Cc: stable at vger.kernel.org
+Signed-off-by: Stefan Brüns <stefan.bruens at rwth-aachen.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab at s-opensource.com>
 ---
+ drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
 --- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
 +++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
-@@ -36,16 +36,17 @@ static int usb_cypress_writemem(struct u
+@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct u
  int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
  {
  	struct hexline *hx;
 -	u8 reset;
-+	u8 *reset;
- 	int ret,pos=0;
+-	int ret,pos=0;
++	u8 *buf;
++	int ret, pos = 0;
++	u16 cpu_cs_register = cypress[type].cpu_cs_register;
  
- 	hx = kmalloc(sizeof(*hx), GFP_KERNEL);
- 	if (!hx)
+-	hx = kmalloc(sizeof(*hx), GFP_KERNEL);
+-	if (!hx)
++	buf = kmalloc(sizeof(*hx), GFP_KERNEL);
++	if (!buf)
  		return -ENOMEM;
-+	reset = (u8 *)hx;
++	hx = (struct hexline *)buf;
  
  	/* stop the CPU */
 -	reset = 1;
 -	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
-+	*reset = 1;
-+	if ((ret = usb_cypress_writemem(udev, cypress[type].cpu_cs_register, reset, 1)) != 1)
++	buf[0] = 1;
++	if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
  		err("could not stop the USB controller CPU.");
  
  	while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
-@@ -68,8 +69,8 @@ int usb_cypress_load_firmware(struct usb
+@@ -62,21 +64,21 @@ int usb_cypress_load_firmware(struct usb
+ 	}
+ 	if (ret < 0) {
+ 		err("firmware download failed at %d with %d",pos,ret);
+-		kfree(hx);
++		kfree(buf);
+ 		return ret;
+ 	}
  
  	if (ret == 0) {
  		/* restart the CPU */
 -		reset = 0;
 -		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
-+		*reset = 0;
-+		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register, reset, 1) != 1) {
++		buf[0] = 0;
++		if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
  			err("could not restart the USB controller CPU.");
  			ret = -EINVAL;
  		}
+ 	} else
+ 		ret = -EIO;
+ 
+-	kfree(hx);
++	kfree(buf);
+ 
+ 	return ret;
+ }

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git