--- /dev/null
+From fb139dfeef9558a12ffdbf9e26951fd1a9304f3b Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+Date: Wed, 15 Jun 2011 15:08:55 -0700
+Subject: drivers/tty/serial/pch_uart.c: don't oops if
+ dmi_get_system_info returns NULL
+
+From: Alexander Stein <alexander.stein@systec-electronic.com>
+
+commit fb139dfeef9558a12ffdbf9e26951fd1a9304f3b upstream.
+
+If dmi_get_system_info() returns NULL, pch_uart_init_port() will
+dereferencea a zero pointer.
+
+This oops was observed on an Atom based board which has no BIOS, but
+a bootloder which doesn't provide DMI data.
+
+Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/tty/serial/pch_uart.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -1392,6 +1392,7 @@ static struct eg20t_port *pch_uart_init_
+ int fifosize, base_baud;
+ int port_type;
+ struct pch_uart_driver_data *board;
++ const char *board_name;
+
+ board = &drv_dat[id->driver_data];
+ port_type = board->port_type;
+@@ -1407,7 +1408,8 @@ static struct eg20t_port *pch_uart_init_
+ base_baud = 1843200; /* 1.8432MHz */
+
+ /* quirk for CM-iTC board */
+- if (strstr(dmi_get_system_info(DMI_BOARD_NAME), "CM-iTC"))
++ board_name = dmi_get_system_info(DMI_BOARD_NAME);
++ if (board_name && strstr(board_name, "CM-iTC"))
+ base_baud = 192000000; /* 192.0MHz */
+
+ switch (port_type) {
--- /dev/null
+From 3cdb2052a6e365ad56202874e6a8a05a2bb336fc Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:33:26 -0700
+Subject: hwmon: (ibmaem) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit 3cdb2052a6e365ad56202874e6a8a05a2bb336fc upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmaem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/ibmaem.c
++++ b/drivers/hwmon/ibmaem.c
+@@ -947,6 +947,7 @@ static int aem_register_sensors(struct a
+
+ /* Set up read-only sensors */
+ while (ro->label) {
++ sysfs_attr_init(&sensors->dev_attr.attr);
+ sensors->dev_attr.attr.name = ro->label;
+ sensors->dev_attr.attr.mode = S_IRUGO;
+ sensors->dev_attr.show = ro->show;
+@@ -963,6 +964,7 @@ static int aem_register_sensors(struct a
+
+ /* Set up read-write sensors */
+ while (rw->label) {
++ sysfs_attr_init(&sensors->dev_attr.attr);
+ sensors->dev_attr.attr.name = rw->label;
+ sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
+ sensors->dev_attr.show = rw->show;
--- /dev/null
+From fb794e0f7153918c33f2300986d995524ab711cf Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:34:12 -0700
+Subject: hwmon: (ibmpex) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit fb794e0f7153918c33f2300986d995524ab711cf upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/ibmpex.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/ibmpex.c
++++ b/drivers/hwmon/ibmpex.c
+@@ -358,6 +358,7 @@ static int create_sensor(struct ibmpex_b
+ else if (type == POWER_SENSOR)
+ sprintf(n, power_sensor_name_templates[func], "power", counter);
+
++ sysfs_attr_init(&data->sensors[sensor].attr[func].dev_attr.attr);
+ data->sensors[sensor].attr[func].dev_attr.attr.name = n;
+ data->sensors[sensor].attr[func].dev_attr.attr.mode = S_IRUGO;
+ data->sensors[sensor].attr[func].dev_attr.show = ibmpex_show_sensor;
--- /dev/null
+From b1e698db0939b04602ded2a2196ff69c92b49378 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+Date: Tue, 24 May 2011 12:34:55 -0700
+Subject: hwmon: (s3c) Initialize sysfs attributes
+
+From: Guenter Roeck <guenter.roeck@ericsson.com>
+
+commit b1e698db0939b04602ded2a2196ff69c92b49378 upstream.
+
+Initialize dynamically allocated sysfs attributes before device_create_file()
+call to suppress lockdep_init_map() warning if lockdep debugging is enabled.
+
+Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>
+Acked-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/s3c-hwmon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/hwmon/s3c-hwmon.c
++++ b/drivers/hwmon/s3c-hwmon.c
+@@ -232,6 +232,7 @@ static int s3c_hwmon_create_attr(struct
+
+ attr = &attrs->in;
+ attr->index = channel;
++ sysfs_attr_init(&attr->dev_attr.attr);
+ attr->dev_attr.attr.name = attrs->in_name;
+ attr->dev_attr.attr.mode = S_IRUGO;
+ attr->dev_attr.show = s3c_hwmon_ch_show;
+@@ -249,6 +250,7 @@ static int s3c_hwmon_create_attr(struct
+
+ attr = &attrs->label;
+ attr->index = channel;
++ sysfs_attr_init(&attr->dev_attr.attr);
+ attr->dev_attr.attr.name = attrs->label_name;
+ attr->dev_attr.attr.mode = S_IRUGO;
+ attr->dev_attr.show = s3c_hwmon_label_show;
--- /dev/null
+From 2b472611a32a72f4a118c069c2d62a1a3f087afd Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Wed, 15 Jun 2011 15:08:58 -0700
+Subject: ksm: fix NULL pointer dereference in
+ scan_get_next_rmap_item()
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2b472611a32a72f4a118c069c2d62a1a3f087afd upstream.
+
+Andrea Righi reported a case where an exiting task can race against
+ksmd::scan_get_next_rmap_item (http://lkml.org/lkml/2011/6/1/742) easily
+triggering a NULL pointer dereference in ksmd.
+
+ksm_scan.mm_slot == &ksm_mm_head with only one registered mm
+
+CPU 1 (__ksm_exit) CPU 2 (scan_get_next_rmap_item)
+ list_empty() is false
+lock slot == &ksm_mm_head
+list_del(slot->mm_list)
+(list now empty)
+unlock
+ lock
+ slot = list_entry(slot->mm_list.next)
+ (list is empty, so slot is still ksm_mm_head)
+ unlock
+ slot->mm == NULL ... Oops
+
+Close this race by revalidating that the new slot is not simply the list
+head again.
+
+Andrea's test case:
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+#define BUFSIZE getpagesize()
+
+int main(int argc, char **argv)
+{
+ void *ptr;
+
+ if (posix_memalign(&ptr, getpagesize(), BUFSIZE) < 0) {
+ perror("posix_memalign");
+ exit(1);
+ }
+ if (madvise(ptr, BUFSIZE, MADV_MERGEABLE) < 0) {
+ perror("madvise");
+ exit(1);
+ }
+ *(char *)NULL = 0;
+
+ return 0;
+}
+
+Reported-by: Andrea Righi <andrea@betterlinux.com>
+Tested-by: Andrea Righi <andrea@betterlinux.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/ksm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -1301,6 +1301,12 @@ static struct rmap_item *scan_get_next_r
+ slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
+ ksm_scan.mm_slot = slot;
+ spin_unlock(&ksm_mmlist_lock);
++ /*
++ * Although we tested list_empty() above, a racing __ksm_exit
++ * of the last mm on the list may have removed it since then.
++ */
++ if (slot == &ksm_mm_head)
++ return NULL;
+ next_mm:
+ ksm_scan.address = 0;
+ ksm_scan.rmap_list = &slot->rmap_list;
--- /dev/null
+From 99a15e21d96f6857dafab1e5167e5e8183215c9c Mon Sep 17 00:00:00 2001
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Thu, 16 Jun 2011 12:56:19 -0700
+Subject: migrate: don't account swapcache as shmem
+
+From: Andrea Arcangeli <aarcange@redhat.com>
+
+commit 99a15e21d96f6857dafab1e5167e5e8183215c9c upstream.
+
+swapcache will reach the below code path in migrate_page_move_mapping,
+and swapcache is accounted as NR_FILE_PAGES but it's not accounted as
+NR_SHMEM.
+
+Hugh pointed out we must use PageSwapCache instead of comparing
+mapping to &swapper_space, to avoid build failure with CONFIG_SWAP=n.
+
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/migrate.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -288,7 +288,7 @@ static int migrate_page_move_mapping(str
+ */
+ __dec_zone_page_state(page, NR_FILE_PAGES);
+ __inc_zone_page_state(newpage, NR_FILE_PAGES);
+- if (PageSwapBacked(page)) {
++ if (!PageSwapCache(page) && PageSwapBacked(page)) {
+ __dec_zone_page_state(page, NR_SHMEM);
+ __inc_zone_page_state(newpage, NR_SHMEM);
+ }
net-ipv4-check-for-mistakenly-passed-in-non-ipv4-address.patch
ipv6-udp-use-the-correct-variable-to-determine-non-blocking-condition.patch
udp-recvmsg-clear-msg_trunc-flag-when-starting-over-for-a-new-packet.patch
+ksm-fix-null-pointer-dereference-in.patch
+drivers-tty-serial-pch_uart.c-don-t-oops-if.patch
+migrate-don-t-account-swapcache-as-shmem.patch
+hwmon-ibmaem-initialize-sysfs-attributes.patch
+hwmon-s3c-initialize-sysfs-attributes.patch
+hwmon-ibmpex-initialize-sysfs-attributes.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
