From 83e756cbc3fc1689d40567b71511adc1089f85e0 Mon Sep 17 00:00:00 2001
From: sakindia123 <sa6915@gmail.com>
Date: Fri, 14 Jun 2013 05:02:38 +0100
Subject: Samsung i9300 Update 10

Change-Id: I549efadb9464c7f0e4248c31f1f8bff55ffed458
---
 drivers/motor/tspdrv.c              | 12 +++++------
 fs/fat/namei_vfat.c                 |  3 ++-
 fs/nls/nls_base.c                   | 43 ++++++++++++++++++++++++++++---------
 include/linux/nls.h                 |  5 +++--
 sound/soc/samsung/srp_alp/srp_alp.c |  6 ++++++
 5 files changed, 50 insertions(+), 19 deletions(-)

diff --git a/drivers/motor/tspdrv.c b/drivers/motor/tspdrv.c
index 73cb2772edb..b22bb0534c2 100644
--- a/drivers/motor/tspdrv.c
+++ b/drivers/motor/tspdrv.c
@@ -380,6 +380,12 @@ static ssize_t write(struct file *file, const char *buf, size_t count,
 		return 0;
 	}
 
+	/* Check buffer size */
+	if ((count <= SPI_HEADER_SIZE) || (count > SPI_BUFFER_SIZE)) {
+		DbgOut((KERN_ERR "tspdrv: invalid write buffer size.\n"));
+		return 0;
+	}
+
 	/* Copy immediately the input buffer */
 	if (0 != copy_from_user(g_cWriteBuffer, buf, count)) {
 		/* Failed to copy all the data, exit */
@@ -387,12 +393,6 @@ static ssize_t write(struct file *file, const char *buf, size_t count,
 		return 0;
 	}
 
-	/* Check buffer size */
-	if ((count <= SPI_HEADER_SIZE) || (count > SPI_BUFFER_SIZE)) {
-		DbgOut((KERN_ERR "tspdrv: invalid write buffer size.\n"));
-		return 0;
-	}
-
 	while (i < count) {
 		int nIndexFreeBuffer;   /* initialized below */
 
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 20b4ea53fdc..6ee3c367be6 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -514,7 +514,8 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
 	int charlen;
 
 	if (utf8) {
-		*outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
+		*outlen = utf8s_to_utf16s(name, len, UTF16_HOST_ENDIAN,
+				(wchar_t *) outname, FAT_LFN_LEN + 2);
 		if (*outlen < 0)
 			return *outlen;
 		else if (*outlen > FAT_LFN_LEN)
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index 44a88a9fa2c..0eb059ec6f2 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -114,34 +114,57 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxlen)
 }
 EXPORT_SYMBOL(utf32_to_utf8);
 
-int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
+static inline void put_utf16(wchar_t *s, unsigned c, enum utf16_endian endian)
+{
+	switch (endian) {
+	default:
+		*s = (wchar_t) c;
+		break;
+	case UTF16_LITTLE_ENDIAN:
+		*s = __cpu_to_le16(c);
+		break;
+	case UTF16_BIG_ENDIAN:
+		*s = __cpu_to_be16(c);
+		break;
+	}
+}
+
+int utf8s_to_utf16s(const u8 *s, int len, enum utf16_endian endian,
+		wchar_t *pwcs, int maxlen)
 {
 	u16 *op;
 	int size;
 	unicode_t u;
 
 	op = pwcs;
-	while (*s && len > 0) {
+	while (len > 0 && maxlen > 0 && *s) {
 		if (*s & 0x80) {
 			size = utf8_to_utf32(s, len, &u);
 			if (size < 0)
 				return -EINVAL;
+			s += size;
+			len -= size;
 
 			if (u >= PLANE_SIZE) {
+				if (maxlen < 2)
+					break;
 				u -= PLANE_SIZE;
-				*op++ = (wchar_t) (SURROGATE_PAIR |
-						((u >> 10) & SURROGATE_BITS));
-				*op++ = (wchar_t) (SURROGATE_PAIR |
+				put_utf16(op++, SURROGATE_PAIR |
+						((u >> 10) & SURROGATE_BITS),
+						endian);
+				put_utf16(op++, SURROGATE_PAIR |
 						SURROGATE_LOW |
-						(u & SURROGATE_BITS));
+						(u & SURROGATE_BITS),
+						endian);
+				maxlen -= 2;
 			} else {
-				*op++ = (wchar_t) u;
+				put_utf16(op++, u, endian);
+				maxlen--;
 			}
-			s += size;
-			len -= size;
 		} else {
-			*op++ = *s++;
+			put_utf16(op++, *s++, endian);
 			len--;
+			maxlen--;
 		}
 	}
 	return op - pwcs;
diff --git a/include/linux/nls.h b/include/linux/nls.h
index d47beef08df..2ba14c4ab61 100644
--- a/include/linux/nls.h
+++ b/include/linux/nls.h
@@ -43,7 +43,7 @@ enum utf16_endian {
 	UTF16_BIG_ENDIAN
 };
 
-/* nls.c */
+/* nls_base.c */
 extern int register_nls(struct nls_table *);
 extern int unregister_nls(struct nls_table *);
 extern struct nls_table *load_nls(char *);
@@ -52,7 +52,8 @@ extern struct nls_table *load_nls_default(void);
 
 extern int utf8_to_utf32(const u8 *s, int len, unicode_t *pu);
 extern int utf32_to_utf8(unicode_t u, u8 *s, int maxlen);
-extern int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs);
+extern int utf8s_to_utf16s(const u8 *s, int len,
+    enum utf16_endian endian, wchar_t *pwcs, int maxlen);
 extern int utf16s_to_utf8s(const wchar_t *pwcs, int len,
 		enum utf16_endian endian, u8 *s, int maxlen);
 
diff --git a/sound/soc/samsung/srp_alp/srp_alp.c b/sound/soc/samsung/srp_alp/srp_alp.c
index 900dfff9c17..004b0cccb93 100644
--- a/sound/soc/samsung/srp_alp/srp_alp.c
+++ b/sound/soc/samsung/srp_alp/srp_alp.c
@@ -736,8 +736,14 @@ static int srp_release(struct inode *inode, struct file *file)
 static int srp_mmap(struct file *filep, struct vm_area_struct *vma)
 {
 	unsigned long size = vma->vm_end - vma->vm_start;
+	unsigned long size_max;
 	unsigned int pfn;
 
+	size_max = (srp.obuf_info.mmapped_size + PAGE_SIZE - 1) &
+			~(PAGE_SIZE - 1);
+	if (size > size_max)
+		return -EINVAL;
+
 	vma->vm_flags |= VM_IO;
 	vma->vm_flags |= VM_RESERVED;
 	vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
-- 
cgit v1.2.3