rpms/kernel/F-10 linux-2.6.27-fix-video_open.patch, NONE, 1.1.2.1 kernel.spec, 1.1206.2.35, 1.1206.2.36

[Jarod Wilson]

Author: jwilson

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18897

Modified Files:
      Tag: private-fedora-10-2_6_27
	kernel.spec 
Added Files:
      Tag: private-fedora-10-2_6_27
	linux-2.6.27-fix-video_open.patch 
Log Message:
* Tue Feb 24 2009 Jarod Wilson <jarod at redhat.com> 2.6.27.19-170.2.36
- Fix NULL ptr deref in cx23885 video_open function that triggered
  an oops on systems w/both an HVR-1800 and HVR-1250, which prevented
  the analog side of the 1800 from working
- Fix NULL ptr deref in v4l2 video_open function that triggers when
  running the uvcvideo stress-test


linux-2.6.27-fix-video_open.patch:

--- NEW FILE linux-2.6.27-fix-video_open.patch ---
See thread at http://lkml.org/lkml/2008/10/15/240 for gory details
of oops in uvcvideo stress-test.

Not upstream, because 2.6.28 reworked this code considerably. Might
be a good candidate for the 2.6.27.x stable tree though.

From: Laurent Pinchart

---

 drivers/media/video/v4l2-dev.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 155fdec..7a3c1ed 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -132,6 +132,11 @@ static int video_open(struct inode *inode, struct file *file)
 	}
 	old_fops = file->f_op;
 	file->f_op = fops_get(vfl->fops);
+	if (file->f_op == NULL) {
+		file->f_op = old_fops;
+		err = -ENODEV;
+		goto out;
+	}
 	if (file->f_op->open)
 		err = file->f_op->open(inode, file);
 	if (err) {
@@ -139,6 +144,7 @@ static int video_open(struct inode *inode, struct file *file)
 		file->f_op = fops_get(old_fops);
 	}
 	fops_put(old_fops);
+out:
 	mutex_unlock(&videodev_lock);
 	unlock_kernel();
 	return err;



From: Mark Jenks
https://www.redhat.com/mailman/private/video4linux-list/2009-January/msg00041.html

Some history:
http://article.gmane.org/gmane.linux.drivers.dvb/46630

Trigged on my own system at home w/both HVR-1250 and HVR-1800, and this
resolves it (makes the analog portion of the 1800 actually usable now).

Signed-off-by: Jarod Wilson <jarod at redhat.com>

---

 drivers/media/video/cx23885/cx23885-417.c   |    2 +-
 drivers/media/video/cx23885/cx23885-video.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 7b0e8c0..19154b6 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1585,7 +1585,7 @@ static int mpeg_open(struct inode *inode, struct file *file)
 
 	list_for_each(list, &cx23885_devlist) {
 		h = list_entry(list, struct cx23885_dev, devlist);
-		if (h->v4l_device->minor == minor) {
+		if (h->v4l_device && h->v4l_device->minor == minor) {
 			dev = h;
 			break;
 		}
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 6047c78..a2b5a0c 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -733,7 +733,7 @@ static int video_open(struct inode *inode, struct file *file)
 
 	list_for_each(list, &cx23885_devlist) {
 		h = list_entry(list, struct cx23885_dev, devlist);
-		if (h->video_dev->minor == minor) {
+		if (h->video_dev && h->video_dev->minor == minor) {
 			dev  = h;
 			type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
 		}


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1206.2.35
retrieving revision 1.1206.2.36
diff -u -r1.1206.2.35 -r1.1206.2.36
--- kernel.spec	23 Feb 2009 17:34:58 -0000	1.1206.2.35
+++ kernel.spec	24 Feb 2009 17:04:16 -0000	1.1206.2.36
@@ -768,6 +768,9 @@
 # ui
 Patch3130: disable-p4-cpufreq-ui.patch
 
+# Fix up the v4l2 video_open function
+Patch3140: linux-2.6.27-fix-video_open.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1388,6 +1391,8 @@
 
 ApplyPatch disable-p4-cpufreq-ui.patch
 
+ApplyPatch linux-2.6.27-fix-video_open.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1963,6 +1968,13 @@
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Tue Feb 24 2009 Jarod Wilson <jarod at redhat.com> 2.6.27.19-170.2.36
+- Fix NULL ptr deref in cx23885 video_open function that triggered
+  an oops on systems w/both an HVR-1800 and HVR-1250, which prevented
+  the analog side of the 1800 from working
+- Fix NULL ptr deref in v4l2 video_open function that triggers when
+  running the uvcvideo stress-test
+
 * Mon Feb 23 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.27.19-170.2.35
 - Fix bug in ext4 patch queue.