3.0-stable patches

added patches:
	acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch
	asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch

diff --git a/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch b/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch
new file mode 100644 (file)
index 0000000..d8eb0a4
--- /dev/null
+++ b/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch
@@ -0,0 +1,47 @@
+From 61388f9e5d93053cf399a356414f31f9b4814c6d Mon Sep 17 00:00:00 2001
+From: Bob Moore <robert.moore@intel.com>
+Date: Wed, 8 May 2013 04:01:15 +0000
+Subject: ACPICA: Fix possible buffer overflow during a field unit read operation
+
+From: Bob Moore <robert.moore@intel.com>
+
+commit 61388f9e5d93053cf399a356414f31f9b4814c6d upstream.
+
+Can only happen under these conditions: 1) The DSDT version is 1,
+meaning integers are 32-bits.  2) The field is between 33 and 64
+bits long.
+
+It applies cleanly back to ACPICA 20100806+ (Linux v2.6.37+).
+
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Lv Zheng <lv.zheng@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/acpica/exfldio.c |   14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -702,7 +702,19 @@ acpi_ex_extract_from_field(union acpi_op
+ 
+       if ((obj_desc->common_field.start_field_bit_offset == 0) &&
+           (obj_desc->common_field.bit_length == access_bit_width)) {
+-              status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
++              if (buffer_length >= sizeof(u64)) {
++                      status =
++                          acpi_ex_field_datum_io(obj_desc, 0, buffer,
++                                                 ACPI_READ);
++              } else {
++                      /* Use raw_datum (u64) to handle buffers < 64 bits */
++
++                      status =
++                          acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
++                                                 ACPI_READ);
++                      ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
++              }
++
+               return_ACPI_STATUS(status);
+       }
+ 

diff --git a/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch b/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch
new file mode 100644 (file)
index 0000000..8750e6c
--- /dev/null
+++ b/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch
@@ -0,0 +1,30 @@
+From 4495e46fe18f198366961bb2b324a694ef8a9b44 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 30 Apr 2013 10:24:41 +0300
+Subject: ASoC: wm8994: missing break in wm8994_aif3_hw_params()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 4495e46fe18f198366961bb2b324a694ef8a9b44 upstream.
+
+The missing break here means that we always return early and the
+function is a no-op.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2249,6 +2249,7 @@ static int wm8994_aif3_hw_params(struct
+               default:
+                       return 0;
+               }
++              break;
+       default:
+               return 0;
+       }

diff --git a/queue-3.0/series b/queue-3.0/series
index 71d53758f26fbc56ca59be7e1213ed70708e95e5..e2038b63e60bf929391a5c600f7ab9f5dc0ae2e4 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -1,2 +1,4 @@
 kvm-vmx-fix-halt-emulation-while-emulating-invalid-guest-sate.patch
 arm-omap-rx-51-change-probe-order-of-touchscreen-and-panel-spi-devices.patch
+asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch
+acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch