4.4-stable patches

added patches:
	matroxfb-fix-size-of-memcpy.patch
	staging-speakup-replace-strncpy-with-memcpy.patch

diff --git a/queue-4.4/matroxfb-fix-size-of-memcpy.patch b/queue-4.4/matroxfb-fix-size-of-memcpy.patch
new file mode 100644 (file)
index 0000000..a0b4018
--- /dev/null
+++ b/queue-4.4/matroxfb-fix-size-of-memcpy.patch
@@ -0,0 +1,32 @@
+From 59921b239056fb6389a865083284e00ce0518db6 Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Thu, 25 Aug 2016 23:14:12 +0530
+Subject: matroxfb: fix size of memcpy
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit 59921b239056fb6389a865083284e00ce0518db6 upstream.
+
+hw->DACreg has a size of 80 bytes and MGADACbpp32 has 21. So when
+memcpy copies MGADACbpp32 to hw->DACreg it copies 80 bytes but
+only 21 bytes are valid.
+
+Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/matrox/matroxfb_Ti3026.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
++++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
+@@ -372,7 +372,7 @@ static int Ti3026_init(struct matrox_fb_
+ 
+       DBG(__func__)
+ 
+-      memcpy(hw->DACreg, MGADACbpp32, sizeof(hw->DACreg));
++      memcpy(hw->DACreg, MGADACbpp32, sizeof(MGADACbpp32));
+       switch (minfo->fbcon.var.bits_per_pixel) {
+               case 4: hw->DACreg[POS3026_XLATCHCTRL] = TVP3026_XLATCHCTRL_16_1;       /* or _8_1, they are same */
+                       hw->DACreg[POS3026_XTRUECOLORCTRL] = TVP3026_XTRUECOLORCTRL_PSEUDOCOLOR;

diff --git a/queue-4.4/series b/queue-4.4/series
index 8f4b1dfaf482be0c4b203540cfc7c2ef371b7671..d0beb496b8af73c43d4b3d2720ad7315df0720df 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -82,3 +82,5 @@ mm-replace-access_remote_vm-write-parameter-with-gup_flags.patch
 proc-don-t-use-foll_force-for-reading-cmdline-and-environment.patch
 proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch
 media-dvb-frontends-fix-i2c-access-helpers-for-kasan.patch
+matroxfb-fix-size-of-memcpy.patch
+staging-speakup-replace-strncpy-with-memcpy.patch

diff --git a/queue-4.4/staging-speakup-replace-strncpy-with-memcpy.patch b/queue-4.4/staging-speakup-replace-strncpy-with-memcpy.patch
new file mode 100644 (file)
index 0000000..ab851fe
--- /dev/null
+++ b/queue-4.4/staging-speakup-replace-strncpy-with-memcpy.patch
@@ -0,0 +1,56 @@
+From fd29edc7232bc19f969e8f463138afc5472b3d5f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 1 Jul 2018 13:57:24 -0700
+Subject: staging: speakup: Replace strncpy with memcpy
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit fd29edc7232bc19f969e8f463138afc5472b3d5f upstream.
+
+gcc 8.1.0 generates the following warnings.
+
+drivers/staging/speakup/kobjects.c: In function 'punc_store':
+drivers/staging/speakup/kobjects.c:522:2: warning:
+       'strncpy' output truncated before terminating nul
+       copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:504:6: note: length computed here
+
+drivers/staging/speakup/kobjects.c: In function 'synth_store':
+drivers/staging/speakup/kobjects.c:391:2: warning:
+       'strncpy' output truncated before terminating nul
+       copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:388:8: note: length computed here
+
+Using strncpy() is indeed less than perfect since the length of data to
+be copied has already been determined with strlen(). Replace strncpy()
+with memcpy() to address the warning and optimize the code a little.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/kobjects.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/speakup/kobjects.c
++++ b/drivers/staging/speakup/kobjects.c
+@@ -387,7 +387,7 @@ static ssize_t synth_store(struct kobjec
+       len = strlen(buf);
+       if (len < 2 || len > 9)
+               return -EINVAL;
+-      strncpy(new_synth_name, buf, len);
++      memcpy(new_synth_name, buf, len);
+       if (new_synth_name[len - 1] == '\n')
+               len--;
+       new_synth_name[len] = '\0';
+@@ -514,7 +514,7 @@ static ssize_t punc_store(struct kobject
+               return -EINVAL;
+       }
+ 
+-      strncpy(punc_buf, buf, x);
++      memcpy(punc_buf, buf, x);
+ 
+       while (x && punc_buf[x - 1] == '\n')
+               x--;