From: Greg Kroah-Hartman Date: Fri, 10 May 2013 17:14:53 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.9.2~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6ea5f80f5c62902419124107e27a64f522e7fa62;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch --- diff --git a/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch b/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch new file mode 100644 index 00000000000..d8eb0a4c8ac --- /dev/null +++ b/queue-3.0/acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch @@ -0,0 +1,47 @@ +From 61388f9e5d93053cf399a356414f31f9b4814c6d Mon Sep 17 00:00:00 2001 +From: Bob Moore +Date: Wed, 8 May 2013 04:01:15 +0000 +Subject: ACPICA: Fix possible buffer overflow during a field unit read operation + +From: Bob Moore + +commit 61388f9e5d93053cf399a356414f31f9b4814c6d upstream. + +Can only happen under these conditions: 1) The DSDT version is 1, +meaning integers are 32-bits. 2) The field is between 33 and 64 +bits long. + +It applies cleanly back to ACPICA 20100806+ (Linux v2.6.37+). + +Signed-off-by: Bob Moore +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpica/exfldio.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpica/exfldio.c ++++ b/drivers/acpi/acpica/exfldio.c +@@ -702,7 +702,19 @@ acpi_ex_extract_from_field(union acpi_op + + if ((obj_desc->common_field.start_field_bit_offset == 0) && + (obj_desc->common_field.bit_length == access_bit_width)) { +- status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ); ++ if (buffer_length >= sizeof(u64)) { ++ status = ++ acpi_ex_field_datum_io(obj_desc, 0, buffer, ++ ACPI_READ); ++ } else { ++ /* Use raw_datum (u64) to handle buffers < 64 bits */ ++ ++ status = ++ acpi_ex_field_datum_io(obj_desc, 0, &raw_datum, ++ ACPI_READ); ++ ACPI_MEMCPY(buffer, &raw_datum, buffer_length); ++ } ++ + return_ACPI_STATUS(status); + } + diff --git a/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch b/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch new file mode 100644 index 00000000000..8750e6c122a --- /dev/null +++ b/queue-3.0/asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch @@ -0,0 +1,30 @@ +From 4495e46fe18f198366961bb2b324a694ef8a9b44 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 30 Apr 2013 10:24:41 +0300 +Subject: ASoC: wm8994: missing break in wm8994_aif3_hw_params() + +From: Dan Carpenter + +commit 4495e46fe18f198366961bb2b324a694ef8a9b44 upstream. + +The missing break here means that we always return early and the +function is a no-op. + +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm8994.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2249,6 +2249,7 @@ static int wm8994_aif3_hw_params(struct + default: + return 0; + } ++ break; + default: + return 0; + } diff --git a/queue-3.0/series b/queue-3.0/series index 71d53758f26..e2038b63e60 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -1,2 +1,4 @@ kvm-vmx-fix-halt-emulation-while-emulating-invalid-guest-sate.patch arm-omap-rx-51-change-probe-order-of-touchscreen-and-panel-spi-devices.patch +asoc-wm8994-missing-break-in-wm8994_aif3_hw_params.patch +acpica-fix-possible-buffer-overflow-during-a-field-unit-read-operation.patch