From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 14 Dec 2018 08:34:01 +0000 (+0100)
Subject: 3.18-stable patches
X-Git-Tag: v4.19.10~12
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c55446ae50c21bacaad83bbe5a05a3399335c4b2;p=thirdparty%2Fkernel%2Fstable-queue.git

3.18-stable patches

added patches:
	matroxfb-fix-size-of-memcpy.patch
	staging-speakup-replace-strncpy-with-memcpy.patch
---

diff --git a/queue-3.18/matroxfb-fix-size-of-memcpy.patch b/queue-3.18/matroxfb-fix-size-of-memcpy.patch
new file mode 100644
index 00000000000..a0b4018cec8
--- /dev/null
+++ b/queue-3.18/matroxfb-fix-size-of-memcpy.patch
@@ -0,0 +1,32 @@
+From 59921b239056fb6389a865083284e00ce0518db6 Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Thu, 25 Aug 2016 23:14:12 +0530
+Subject: matroxfb: fix size of memcpy
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit 59921b239056fb6389a865083284e00ce0518db6 upstream.
+
+hw->DACreg has a size of 80 bytes and MGADACbpp32 has 21. So when
+memcpy copies MGADACbpp32 to hw->DACreg it copies 80 bytes but
+only 21 bytes are valid.
+
+Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/matrox/matroxfb_Ti3026.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
++++ b/drivers/video/fbdev/matrox/matroxfb_Ti3026.c
+@@ -372,7 +372,7 @@ static int Ti3026_init(struct matrox_fb_
+ 
+ 	DBG(__func__)
+ 
+-	memcpy(hw->DACreg, MGADACbpp32, sizeof(hw->DACreg));
++	memcpy(hw->DACreg, MGADACbpp32, sizeof(MGADACbpp32));
+ 	switch (minfo->fbcon.var.bits_per_pixel) {
+ 		case 4:	hw->DACreg[POS3026_XLATCHCTRL] = TVP3026_XLATCHCTRL_16_1;	/* or _8_1, they are same */
+ 			hw->DACreg[POS3026_XTRUECOLORCTRL] = TVP3026_XTRUECOLORCTRL_PSEUDOCOLOR;
diff --git a/queue-3.18/series b/queue-3.18/series
index c384ff81496..b5f0d24e91e 100644
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -28,3 +28,5 @@ hfsplus-do-not-free-node-before-using.patch
 debugobjects-avoid-recursive-calls-with-kmemleak.patch
 ocfs2-fix-potential-use-after-free.patch
 pstore-convert-console-write-to-use-write_buf.patch
+matroxfb-fix-size-of-memcpy.patch
+staging-speakup-replace-strncpy-with-memcpy.patch
diff --git a/queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch b/queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch
new file mode 100644
index 00000000000..462b8742a5c
--- /dev/null
+++ b/queue-3.18/staging-speakup-replace-strncpy-with-memcpy.patch
@@ -0,0 +1,56 @@
+From fd29edc7232bc19f969e8f463138afc5472b3d5f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 1 Jul 2018 13:57:24 -0700
+Subject: staging: speakup: Replace strncpy with memcpy
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit fd29edc7232bc19f969e8f463138afc5472b3d5f upstream.
+
+gcc 8.1.0 generates the following warnings.
+
+drivers/staging/speakup/kobjects.c: In function 'punc_store':
+drivers/staging/speakup/kobjects.c:522:2: warning:
+	'strncpy' output truncated before terminating nul
+	copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:504:6: note: length computed here
+
+drivers/staging/speakup/kobjects.c: In function 'synth_store':
+drivers/staging/speakup/kobjects.c:391:2: warning:
+	'strncpy' output truncated before terminating nul
+	copying as many bytes from a string as its length
+drivers/staging/speakup/kobjects.c:388:8: note: length computed here
+
+Using strncpy() is indeed less than perfect since the length of data to
+be copied has already been determined with strlen(). Replace strncpy()
+with memcpy() to address the warning and optimize the code a little.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/kobjects.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/speakup/kobjects.c
++++ b/drivers/staging/speakup/kobjects.c
+@@ -386,7 +386,7 @@ static ssize_t synth_store(struct kobjec
+ 	len = strlen(buf);
+ 	if (len < 2 || len > 9)
+ 		return -EINVAL;
+-	strncpy(new_synth_name, buf, len);
++	memcpy(new_synth_name, buf, len);
+ 	if (new_synth_name[len - 1] == '\n')
+ 		len--;
+ 	new_synth_name[len] = '\0';
+@@ -513,7 +513,7 @@ static ssize_t punc_store(struct kobject
+ 		return -EINVAL;
+ 	}
+ 
+-	strncpy(punc_buf, buf, x);
++	memcpy(punc_buf, buf, x);
+ 
+ 	while (x && punc_buf[x - 1] == '\n')
+ 		x--;