3.8-stable patches

added patches:
	drm-i915-restrict-kernel-address-leak-in-debugfs.patch
	revert-drm-i915-try-to-train-dp-even-harder.patch

diff --git a/queue-3.8/drm-i915-restrict-kernel-address-leak-in-debugfs.patch b/queue-3.8/drm-i915-restrict-kernel-address-leak-in-debugfs.patch
new file mode 100644 (file)
index 0000000..12e5cde
--- /dev/null
+++ b/queue-3.8/drm-i915-restrict-kernel-address-leak-in-debugfs.patch
@@ -0,0 +1,30 @@
+From 2563a4524febe8f4a98e717e02436d1aaf672aa2 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Mon, 11 Mar 2013 12:25:19 -0700
+Subject: drm/i915: restrict kernel address leak in debugfs
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 2563a4524febe8f4a98e717e02436d1aaf672aa2 upstream.
+
+Masks kernel address info-leak in object dumps with the %pK suffix,
+so they cannot be used to target kernel memory corruption attacks if
+the kptr_restrict sysctl is set.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
+index aae3148..7299ea4 100644
+--- a/drivers/gpu/drm/i915/i915_debugfs.c
++++ b/drivers/gpu/drm/i915/i915_debugfs.c
+@@ -103,7 +103,7 @@ static const char *cache_level_str(int type)
+ static void
+ describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
+ {
+-      seq_printf(m, "%p: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
++      seq_printf(m, "%pK: %s%s %8zdKiB %02x %02x %d %d %d%s%s%s",
+                  &obj->base,
+                  get_pin_flag(obj),
+                  get_tiling_flag(obj),

diff --git a/queue-3.8/revert-drm-i915-try-to-train-dp-even-harder.patch b/queue-3.8/revert-drm-i915-try-to-train-dp-even-harder.patch
new file mode 100644 (file)
index 0000000..01dc26c
--- /dev/null
+++ b/queue-3.8/revert-drm-i915-try-to-train-dp-even-harder.patch
@@ -0,0 +1,37 @@
+From 3b4f819d5eac94ba8fe5e8c061f6dabfe8d7b22c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 11 Mar 2013 18:40:16 +0100
+Subject: Revert "drm/i915: try to train DP even harder"
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3b4f819d5eac94ba8fe5e8c061f6dabfe8d7b22c upstream.
+
+This reverts commit 0d71068835e2610576d369d6d4cbf90e0f802a71.
+
+Not only that the commit introduces a bogus check (voltage_tries == 5
+will never meet at the inserted code path), it brings the i915 driver
+into an endless dp-train loop on HP Z1 desktop machine with IVY+eDP.
+
+At least reverting this commit recovers the framebuffer (but X is
+still broken by other reasons...)
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1850,7 +1850,7 @@ intel_dp_start_link_train(struct intel_d
+               for (i = 0; i < intel_dp->lane_count; i++)
+                       if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
+                               break;
+-              if (i == intel_dp->lane_count && voltage_tries == 5) {
++              if (i == intel_dp->lane_count) {
+                       ++loop_tries;
+                       if (loop_tries == 5) {
+                               DRM_DEBUG_KMS("too many full retries, give up\n");

diff --git a/queue-3.8/series b/queue-3.8/series
index d99a90b05f068cb690e5e4ae2af128e15ffac69d..46ecf5271e048f427c1ebab340b0c30808a36482 100644 (file)
--- a/queue-3.8/series
+++ b/queue-3.8/series
@@ -33,3 +33,5 @@ alsa-snd-usb-mixer-propagate-errors-up-the-call-chain.patch
 alsa-snd-usb-mixer-ignore-einval-in-snd_usb_mixer_controls.patch
 saner-proc_get_inode-calling-conventions.patch
 vfs-proc-guarantee-unique-inodes-in-proc.patch
+revert-drm-i915-try-to-train-dp-even-harder.patch
+drm-i915-restrict-kernel-address-leak-in-debugfs.patch