1. 19 Apr, 2012 4 commits
    • Mauro Carvalho Chehab's avatar
      Merge tag 'v3.4-rc3' into staging/for_v3.5 · d5aeee8c
      Mauro Carvalho Chehab authored
      * tag 'v3.4-rc3': (3755 commits)
        Linux 3.4-rc3
        x86-32: fix up strncpy_from_user() sign error
        ARM: 7386/1: jump_label: fixup for rename to static_key
        ARM: 7384/1: ThumbEE: Disable userspace TEEHBR access for !CONFIG_ARM_THUMBEE
        ARM: 7382/1: mm: truncate memory banks to fit in 4GB space for classic MMU
        ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus
        PCI: Fix regression in pci_restore_state(), v3
        SCSI: Fix error handling when no ULD is attached
        ARM: OMAP: clock: cleanup CPUfreq leftovers, fix build errors
        ARM: dts: remove blank interrupt-parent properties
        ARM: EXYNOS: Fix Kconfig dependencies for device tree enabled machine files
        do not export kernel's NULL #define to userspace
        ARM: EXYNOS: Remove broken config values for touchscren for NURI board
        ARM: EXYNOS: set fix xusbxti clock for NURI and Universal210 boards
        ARM: EXYNOS: fix regulator name for NURI board
        ARM: SAMSUNG: make SAMSUNG_PM_DEBUG select DEBUG_LL
        cpufreq: OMAP: fix build errors: depends on ARCH_OMAP2PLUS
        sparc64: Eliminate obsolete __handle_softirq() function
        sparc64: Fix bootup crash on sun4v.
        ARM: msm: Fix section mismatches in proc_comm.c
        ...
      d5aeee8c
    • Xi Wang's avatar
      [media] zoran: fix integer overflow in setup_window() · 32898a14
      Xi Wang authored
      `clipcount' is from userspace and thus needs validation.  Otherwise,
      a large `clipcount' could overflow the vmalloc() size, leading to
      out-of-bounds access.
      
      | setup_window()
      | zoran_s_fmt_vid_overlay()
      | __video_do_ioctl()
      | video_ioctl2()
      
      Use 2048 as the maximum `clipcount'.  Also change the corresponding
      parameter type to `unsigned int'.
      Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      32898a14
    • Jesper Juhl's avatar
      [media] s2255drv: Remove redundant NULL test before release_firmware() · 3fc82fa0
      Jesper Juhl authored
      release_firmware() tests for NULL pointers on its own - there's no
      reason to do an explicit check before calling the function.
      Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      3fc82fa0
    • Jesper Juhl's avatar
      [media] staging: as102: Remove redundant NULL check before release_firmware()... · b803cc58
      Jesper Juhl authored
      [media] staging: as102: Remove redundant NULL check before release_firmware() and pointless comments
      
      release_firmware() deals gracefullt with NULL pointers - it's
      redundant to check for them before calling the function.
      
      Also remove a few pointless comments - it's rather obvious from the
      code that kfree() free's a buffer and that release_firmware() releases
      firmware - comments just stating that add no value.
      Signed-off-by: default avatarJesper Juhl <jj@chaosbits.net>
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
      b803cc58
  2. 18 Apr, 2012 2 commits
  3. 16 Apr, 2012 3 commits
    • Linus Torvalds's avatar
      Linux 3.4-rc3 · e816b57a
      Linus Torvalds authored
      e816b57a
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 9a8e5d41
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Nothing too disasterous, the biggest thing being the removal of the
        regulator support for vcore in the AMBA driver; only one SoC was using
        this and it got broken during the last merge window, which then
        started causing problems for other people.  Mutual agreement was
        reached for it to be removed."
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7386/1: jump_label: fixup for rename to static_key
        ARM: 7384/1: ThumbEE: Disable userspace TEEHBR access for !CONFIG_ARM_THUMBEE
        ARM: 7382/1: mm: truncate memory banks to fit in 4GB space for classic MMU
        ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus
        ARM: 7383/1: nommu: populate vectors page from paging_init
        ARM: 7381/1: nommu: fix typo in mm/Kconfig
        ARM: 7380/1: DT: do not add a zero-sized memory property
        ARM: 7379/1: DT: fix atags_to_fdt() second call site
        ARM: 7366/3: amba: Remove AMBA level regulator support
        ARM: 7377/1: vic: re-read status register before dispatching each IRQ handler
        ARM: 7368/1: fault.c: correct how the tsk->[maj|min]_flt gets incremented
      9a8e5d41
    • Linus Torvalds's avatar
      x86-32: fix up strncpy_from_user() sign error · 12e993b8
      Linus Torvalds authored
      The 'max' range needs to be unsigned, since the size of the user address
      space is bigger than 2GB.
      
      We know that 'count' is positive in 'long' (that is checked in the
      caller), so we will truncate 'max' down to something that fits in a
      signed long, but before we actually do that, that comparison needs to be
      done in unsigned.
      
      Bug introduced in commit 92ae03f2 ("x86: merge 32/64-bit versions of
      'strncpy_from_user()' and speed it up").  On x86-64 you can't trigger
      this, since the user address space is much smaller than 63 bits, and on
      x86-32 it works in practice, since you would seldom hit the strncpy
      limits anyway.
      
      I had actually tested the corner-cases, I had only tested them on
      x86-64.  Besides, I had only worried about the case of a pointer *close*
      to the end of the address space, rather than really far away from it ;)
      
      This also changes the "we hit the user-specified maximum" to return
      'res', for the trivial reason that gcc seems to generate better code
      that way.  'res' and 'count' are the same in that case, so it really
      doesn't matter which one we return.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      12e993b8
  4. 15 Apr, 2012 12 commits
  5. 14 Apr, 2012 13 commits
  6. 13 Apr, 2012 6 commits