Fix issues with ivtv driver on PVR350 devices (rhbz 1278942)

3 files changed, 76 insertions, 0 deletions

diff --git a/kernel.spec b/kernel.spec
index f45f7f07c..00a3c801a 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -698,6 +698,10 @@ Patch639: netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch
 #rhbz 1300955
 Patch640: PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch
 
+#rhbz 1278942
+Patch642: media-Revert-media-ivtv-avoid-going-past-input-audio.patch
+Patch643: media-ivtv-avoid-going-past-input-audio-array.patch
+
 #rhbz 1302037
 Patch644: wext-fix-message-delay-ordering.patch
 Patch645: cfg80211-wext-fix-message-ordering.patch
@@ -1464,6 +1468,10 @@ ApplyPatch netfilter-nf_nat_redirect-add-missing-NULL-pointer-c.patch
 #rhbz 1300955
 ApplyPatch PNP-Add-Haswell-ULT-to-Intel-MCH-size-workaround.patch
 
+#rhbz 1278942
+ApplyPatch media-Revert-media-ivtv-avoid-going-past-input-audio.patch
+ApplyPatch media-ivtv-avoid-going-past-input-audio-array.patch
+
 #rhbz 1302037
 ApplyPatch wext-fix-message-delay-ordering.patch
 ApplyPatch cfg80211-wext-fix-message-ordering.patch
@@ -2318,6 +2326,7 @@ fi
 # 
 %changelog
 * Thu Jan 28 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Fix issues with ivtv driver on PVR350 devices (rhbz 1278942)
 - Add patches to fix suprious NEWLINK netlink messages (rhbz 1302037)
 
 * Mon Jan 25 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.3.4-200
diff --git a/media-Revert-media-ivtv-avoid-going-past-input-audio.patch b/media-Revert-media-ivtv-avoid-going-past-input-audio.patch
new file mode 100644
index 000000000..7c00071c6
--- /dev/null
+++ b/media-Revert-media-ivtv-avoid-going-past-input-audio.patch
@@ -0,0 +1,38 @@
+From 823873481b2a17ce5900899f8ef85118f8407b67 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Wed, 11 Nov 2015 09:22:36 -0200
+Subject: [PATCH] [media] Revert "[media] ivtv: avoid going past input/audio
+ array"
+
+This patch broke ivtv logic, as reported at
+ https://bugzilla.redhat.com/show_bug.cgi?id=1278942
+
+This reverts commit 09290cc885937cab3b2d60a6d48fe3d2d3e04061.
+
+Cc: stable@vger.kernel.org # for v4.1 and upper
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+---
+ drivers/media/pci/ivtv/ivtv-driver.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
+index 8616fa8193bc..c2e60b4f292d 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.c
++++ b/drivers/media/pci/ivtv/ivtv-driver.c
+@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
+ {
+ 	int i;
+ 
+-	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
++	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
+ 		if (itv->card->video_inputs[i].video_type == 0)
+ 			break;
+ 	itv->nof_inputs = i;
+-	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
++	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
+ 		if (itv->card->audio_inputs[i].audio_type == 0)
+ 			break;
+ 	itv->nof_audio_inputs = i;
+-- 
+2.5.0
+
diff --git a/media-ivtv-avoid-going-past-input-audio-array.patch b/media-ivtv-avoid-going-past-input-audio-array.patch
new file mode 100644
index 000000000..42009eb71
--- /dev/null
+++ b/media-ivtv-avoid-going-past-input-audio-array.patch
@@ -0,0 +1,29 @@
+From d55ebd07b6c21a1c7e3e74f1b73b3b033cece2b5 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Wed, 11 Nov 2015 09:27:42 -0200
+Subject: [PATCH] [media] ivtv: avoid going past input/audio array
+
+As reported by smatch:
+	drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+---
+ drivers/media/pci/ivtv/ivtv-driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
+index c2e60b4f292d..2bb10cd9ecfd 100644
+--- a/drivers/media/pci/ivtv/ivtv-driver.c
++++ b/drivers/media/pci/ivtv/ivtv-driver.c
+@@ -826,7 +826,7 @@ static void ivtv_init_struct2(struct ivtv *itv)
+ 				IVTV_CARD_INPUT_VID_TUNER)
+ 			break;
+ 	}
+-	if (i == itv->nof_inputs)
++	if (i >= itv->nof_inputs)
+ 		i = 0;
+ 	itv->active_input = i;
+ 	itv->audio_input = itv->card->video_inputs[i].audio_index;
+-- 
+2.5.0
+