mtd: nand: don't walk past end of oobfree[]

[safe/jmp/linux-2.6] / drivers / video / cirrusfb.c

diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index a364e1b..4c2bf92 100644 (file)
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -567,9 +567,7 @@ static int cirrusfb_check_var(struct fb_var_screeninfo *var,
        default:
                dev_dbg(info->device,
                        "Unsupported bpp size: %d\n", var->bits_per_pixel);
-               assert(false);
-               /* should never occur */
-               break;
+               return -EINVAL;
        }
 
        if (var->xres_virtual < var->xres)
@@ -701,45 +699,52 @@ static int cirrusfb_set_par_foo(struct fb_info *info)
 
        hsyncstart = var->xres + var->right_margin;
        hsyncend = hsyncstart + var->hsync_len;
-       htotal = (hsyncend + var->left_margin) / 8 - 5;
-       hdispend = var->xres / 8 - 1;
-       hsyncstart = hsyncstart / 8 + 1;
-       hsyncend = hsyncend / 8 + 1;
+       htotal = (hsyncend + var->left_margin) / 8;
+       hdispend = var->xres / 8;
+       hsyncstart = hsyncstart / 8;
+       hsyncend = hsyncend / 8;
 
-       yres = var->yres;
-       vsyncstart = yres + var->lower_margin;
+       vdispend = var->yres;
+       vsyncstart = vdispend + var->lower_margin;
        vsyncend = vsyncstart + var->vsync_len;
        vtotal = vsyncend + var->upper_margin;
-       vdispend = yres - 1;
 
        if (var->vmode & FB_VMODE_DOUBLE) {
-               yres *= 2;
+               vdispend *= 2;
                vsyncstart *= 2;
                vsyncend *= 2;
                vtotal *= 2;
        } else if (var->vmode & FB_VMODE_INTERLACED) {
-               yres = (yres + 1) / 2;
+               vdispend = (vdispend + 1) / 2;
                vsyncstart = (vsyncstart + 1) / 2;
                vsyncend = (vsyncend + 1) / 2;
                vtotal = (vtotal + 1) / 2;
        }
-
-       vtotal -= 2;
-       vsyncstart -= 1;
-       vsyncend -= 1;
-
+       yres = vdispend;
        if (yres >= 1024) {
                vtotal /= 2;
                vsyncstart /= 2;
                vsyncend /= 2;
                vdispend /= 2;
        }
+
+       vdispend -= 1;
+       vsyncstart -= 1;
+       vsyncend -= 1;
+       vtotal -= 2;
+
        if (cinfo->multiplexing) {
                htotal /= 2;
                hsyncstart /= 2;
                hsyncend /= 2;
                hdispend /= 2;
        }
+
+       htotal -= 5;
+       hdispend -= 1;
+       hsyncstart += 1;
+       hsyncend += 1;
+
        /* unlock register VGA_CRTC_H_TOTAL..CRT7 */
        vga_wcrt(regbase, VGA_CRTC_V_SYNC_END, 0x20);   /* previously: 0x00) */
 
@@ -875,7 +880,7 @@ static int cirrusfb_set_par_foo(struct fb_info *info)
                threshold = fb_readw(cinfo->laguna_mmio + 0xea);
                control &= ~0x6800;
                format = 0;
-               threshold &= 0xffe0 & 0x3fbf;
+               threshold &= 0xffc0 & 0x3fbf;
        }
        if (nom) {
                tmp = den << 1;