Merge branch 'clk/mxs' of git://git.linaro.org/people/shawnguo/linux-2.6 into next/clock

Shawn Guo <shawn.guo@linaro.org> writes:

  mxs common clk porting for v3.5.  It depends on the following two branches.

  [1] git://git.linaro.org/people/mturquette/linux.git clk-next
  [2] http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-arm.git clkdev

  As the mxs device tree conversion will constantly touch clock files,
  to save the conflicts, the updated mxs/dt branch coming later will
  based on this pull-request.

* 'clk/mxs' of git://git.linaro.org/people/shawnguo/linux-2.6:
  ARM: mxs: remove now unused timer_clk argument from mxs_timer_init
  ARM: mxs: remove old clock support
  ARM: mxs: switch to common clk framework
  ARM: mxs: change the lookup name for fec phy clock
  ARM: mxs: request clock for timer
  clk: mxs: add clock support for imx28
  clk: mxs: add clock support for imx23
  clk: mxs: add mxs specific clocks

Includes an update to Linux 3.4-rc6

Conflicts:
	drivers/clk/Makefile

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

1 files changed, 7 insertions, 1 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index f51a696486cb..de431942ded4 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 			return -EINVAL;
 		}
 
+		if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
+			DRM_DEBUG("execbuf with %u cliprects\n",
+				  args->num_cliprects);
+			return -EINVAL;
+		}
 		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
 				    GFP_KERNEL);
 		if (cliprects == NULL) {
@@ -1404,7 +1409,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
 	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
 	int ret;
 
-	if (args->buffer_count < 1) {
+	if (args->buffer_count < 1 ||
+	    args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
 		DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
 		return -EINVAL;
 	}