]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.18-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 Dec 2018 08:34:01 +0000 (09:34 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 Dec 2018 08:34:01 +0000 (09:34 +0100)
added patches:
matroxfb-fix-size-of-memcpy.patch
staging-speakup-replace-strncpy-with-memcpy.patch

queue-3.18/matroxfb-fix-size-of-memcpy.patch [new file with mode: 0644]
queue-3.18/series
queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch [new file with mode: 0644]

diff --git a/queue-3.18/matroxfb-fix-size-of-memcpy.patch b/queue-3.18/matroxfb-fix-size-of-memcpy.patch
new file mode 100644 (file)
index 0000000..a0b4018
--- /dev/null
@@ -0,0 +1,32 @@
+From 59921b239056fb6389a865083284e00ce0518db6 Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Thu, 25 Aug 2016 23:14:12 +0530
+Subject: matroxfb: fix size of memcpy
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit 59921b239056fb6389a865083284e00ce0518db6 upstream.
+
+hw->DACreg has a size of 80 bytes and MGADACbpp32 has 21. So when
+memcpy copies MGADACbpp32 to hw->DACreg it copies 80 bytes but
+only 21 bytes are valid.
+
+Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/matrox/matroxfb_Ti3026.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
++++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
+@@ -372,7 +372,7 @@ static int Ti3026_init(struct matrox_fb_
+       DBG(__func__)
+-      memcpy(hw->DACreg, MGADACbpp32, sizeof(hw->DACreg));
++      memcpy(hw->DACreg, MGADACbpp32, sizeof(MGADACbpp32));
+       switch (minfo->fbcon.var.bits_per_pixel) {
+               case 4: hw->DACreg[POS3026_XLATCHCTRL] = TVP3026_XLATCHCTRL_16_1;       /* or _8_1, they are same */
+                       hw->DACreg[POS3026_XTRUECOLORCTRL] = TVP3026_XTRUECOLORCTRL_PSEUDOCOLOR;
index c384ff814963f6c9c0dd2a3378e5ddf16a974161..b5f0d24e91e2ac33524712f44566dc486a5a68e6 100644 (file)
@@ -28,3 +28,5 @@ hfsplus-do-not-free-node-before-using.patch
 debugobjects-avoid-recursive-calls-with-kmemleak.patch
 ocfs2-fix-potential-use-after-free.patch
 pstore-convert-console-write-to-use-write_buf.patch
+matroxfb-fix-size-of-memcpy.patch
+staging-speakup-replace-strncpy-with-memcpy.patch
diff --git a/queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch b/queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch
new file mode 100644 (file)
index 0000000..462b874
--- /dev/null
@@ -0,0 +1,56 @@
+From fd29edc7232bc19f969e8f463138afc5472b3d5f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 1 Jul 2018 13:57:24 -0700
+Subject: staging: speakup: Replace strncpy with memcpy
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit fd29edc7232bc19f969e8f463138afc5472b3d5f upstream.
+
+gcc 8.1.0 generates the following warnings.
+
+drivers/staging/speakup/kobjects.c: In function 'punc_store':
+drivers/staging/speakup/kobjects.c:522:2: warning:
+       'strncpy' output truncated before terminating nul
+       copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:504:6: note: length computed here
+
+drivers/staging/speakup/kobjects.c: In function 'synth_store':
+drivers/staging/speakup/kobjects.c:391:2: warning:
+       'strncpy' output truncated before terminating nul
+       copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:388:8: note: length computed here
+
+Using strncpy() is indeed less than perfect since the length of data to
+be copied has already been determined with strlen(). Replace strncpy()
+with memcpy() to address the warning and optimize the code a little.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/kobjects.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/speakup/kobjects.c
++++ b/drivers/staging/speakup/kobjects.c
+@@ -386,7 +386,7 @@ static ssize_t synth_store(struct kobjec
+       len = strlen(buf);
+       if (len < 2 || len > 9)
+               return -EINVAL;
+-      strncpy(new_synth_name, buf, len);
++      memcpy(new_synth_name, buf, len);
+       if (new_synth_name[len - 1] == '\n')
+               len--;
+       new_synth_name[len] = '\0';
+@@ -513,7 +513,7 @@ static ssize_t punc_store(struct kobject
+               return -EINVAL;
+       }
+-      strncpy(punc_buf, buf, x);
++      memcpy(punc_buf, buf, x);
+       while (x && punc_buf[x - 1] == '\n')
+               x--;