+++ /dev/null
-From 803bf5ec259941936262d10ecc84511b76a20921 Mon Sep 17 00:00:00 2001
-From: Michael Neuling <mikey@neuling.org>
-Date: Wed, 10 Feb 2010 13:56:42 -0800
-Subject: fs/exec.c: restrict initial stack space expansion to rlimit
-
-From: Michael Neuling <mikey@neuling.org>
-
-commit 803bf5ec259941936262d10ecc84511b76a20921 upstream.
-
-When reserving stack space for a new process, make sure we're not
-attempting to expand the stack by more than rlimit allows.
-
-This fixes a bug caused by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba ("mm:
-variable length argument support") and unmasked by
-fc63cf237078c86214abcb2ee9926d8ad289da9b ("exec: setup_arg_pages() fails
-to return errors").
-
-This bug means that when limiting the stack to less the 20*PAGE_SIZE (eg.
-80K on 4K pages or 'ulimit -s 79') all processes will be killed before
-they start. This is particularly bad with 64K pages, where a ulimit below
-1280K will kill every process.
-
-To test, do:
-
- 'ulimit -s 15; ls'
-
-before and after the patch is applied. Before it's applied, 'ls' should
-be killed. After the patch is applied, 'ls' should no longer be killed.
-
-A stack limit of 15KB since it's small enough to trigger 20*PAGE_SIZE.
-Also 15KB not a multiple of PAGE_SIZE, which is a trickier case to handle
-correctly with this code.
-
-4K pages should be fine to test with.
-
-[kosaki.motohiro@jp.fujitsu.com: cleanup]
-[akpm@linux-foundation.org: cleanup cleanup]
-Signed-off-by: Michael Neuling <mikey@neuling.org>
-Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
-Cc: Americo Wang <xiyou.wangcong@gmail.com>
-Cc: Anton Blanchard <anton@samba.org>
-Cc: Oleg Nesterov <oleg@redhat.com>
-Cc: James Morris <jmorris@namei.org>
-Cc: Ingo Molnar <mingo@elte.hu>
-Cc: Serge Hallyn <serue@us.ibm.com>
-Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- fs/exec.c | 21 +++++++++++++++++++--
- 1 file changed, 19 insertions(+), 2 deletions(-)
-
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -589,6 +589,9 @@ int setup_arg_pages(struct linux_binprm
- struct vm_area_struct *prev = NULL;
- unsigned long vm_flags;
- unsigned long stack_base;
-+ unsigned long stack_size;
-+ unsigned long stack_expand;
-+ unsigned long rlim_stack;
-
- #ifdef CONFIG_STACK_GROWSUP
- /* Limit stack size to 1GB */
-@@ -647,10 +650,24 @@ int setup_arg_pages(struct linux_binprm
- }
- }
-
-+ stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ stack_size = vma->vm_end - vma->vm_start;
-+ /*
-+ * Align this down to a page boundary as expand_stack
-+ * will align it up.
-+ */
-+ rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
-+ rlim_stack = min(rlim_stack, stack_size);
- #ifdef CONFIG_STACK_GROWSUP
-- stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ if (stack_size + stack_expand > rlim_stack)
-+ stack_base = vma->vm_start + rlim_stack;
-+ else
-+ stack_base = vma->vm_end + stack_expand;
- #else
-- stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ if (stack_size + stack_expand > rlim_stack)
-+ stack_base = vma->vm_end - rlim_stack;
-+ else
-+ stack_base = vma->vm_start - stack_expand;
- #endif
- ret = expand_stack(vma, stack_base);
- if (ret)
futex-handle-futex-value-corruption-gracefully.patch
futex-handle-user-space-corruption-gracefully.patch
resource-add-helpers-for-fetching-rlimits.patch
-fs-exec.c-restrict-initial-stack-space-expansion-to-rlimit.patch
printk-robustify-printk-fix-2.patch
hwmon-lm78-fix-i-o-resource-conflict-with-pnp.patch
r8169-fix-receive-buffer-length-when-mtu-is-between-1515-and-1536.patch
+++ /dev/null
-From 803bf5ec259941936262d10ecc84511b76a20921 Mon Sep 17 00:00:00 2001
-From: Michael Neuling <mikey@neuling.org>
-Date: Wed, 10 Feb 2010 13:56:42 -0800
-Subject: fs/exec.c: restrict initial stack space expansion to rlimit
-
-From: Michael Neuling <mikey@neuling.org>
-
-commit 803bf5ec259941936262d10ecc84511b76a20921 upstream.
-
-When reserving stack space for a new process, make sure we're not
-attempting to expand the stack by more than rlimit allows.
-
-This fixes a bug caused by b6a2fea39318e43fee84fa7b0b90d68bed92d2ba ("mm:
-variable length argument support") and unmasked by
-fc63cf237078c86214abcb2ee9926d8ad289da9b ("exec: setup_arg_pages() fails
-to return errors").
-
-This bug means that when limiting the stack to less the 20*PAGE_SIZE (eg.
-80K on 4K pages or 'ulimit -s 79') all processes will be killed before
-they start. This is particularly bad with 64K pages, where a ulimit below
-1280K will kill every process.
-
-To test, do:
-
- 'ulimit -s 15; ls'
-
-before and after the patch is applied. Before it's applied, 'ls' should
-be killed. After the patch is applied, 'ls' should no longer be killed.
-
-A stack limit of 15KB since it's small enough to trigger 20*PAGE_SIZE.
-Also 15KB not a multiple of PAGE_SIZE, which is a trickier case to handle
-correctly with this code.
-
-4K pages should be fine to test with.
-
-[kosaki.motohiro@jp.fujitsu.com: cleanup]
-[akpm@linux-foundation.org: cleanup cleanup]
-Signed-off-by: Michael Neuling <mikey@neuling.org>
-Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
-Cc: Americo Wang <xiyou.wangcong@gmail.com>
-Cc: Anton Blanchard <anton@samba.org>
-Cc: Oleg Nesterov <oleg@redhat.com>
-Cc: James Morris <jmorris@namei.org>
-Cc: Ingo Molnar <mingo@elte.hu>
-Cc: Serge Hallyn <serue@us.ibm.com>
-Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- fs/exec.c | 21 +++++++++++++++++++--
- 1 file changed, 19 insertions(+), 2 deletions(-)
-
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -570,6 +570,9 @@ int setup_arg_pages(struct linux_binprm
- struct vm_area_struct *prev = NULL;
- unsigned long vm_flags;
- unsigned long stack_base;
-+ unsigned long stack_size;
-+ unsigned long stack_expand;
-+ unsigned long rlim_stack;
-
- #ifdef CONFIG_STACK_GROWSUP
- /* Limit stack size to 1GB */
-@@ -628,10 +631,24 @@ int setup_arg_pages(struct linux_binprm
- }
- }
-
-+ stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ stack_size = vma->vm_end - vma->vm_start;
-+ /*
-+ * Align this down to a page boundary as expand_stack
-+ * will align it up.
-+ */
-+ rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
-+ rlim_stack = min(rlim_stack, stack_size);
- #ifdef CONFIG_STACK_GROWSUP
-- stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ if (stack_size + stack_expand > rlim_stack)
-+ stack_base = vma->vm_start + rlim_stack;
-+ else
-+ stack_base = vma->vm_end + stack_expand;
- #else
-- stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
-+ if (stack_size + stack_expand > rlim_stack)
-+ stack_base = vma->vm_end - rlim_stack;
-+ else
-+ stack_base = vma->vm_start - stack_expand;
- #endif
- ret = expand_stack(vma, stack_base);
- if (ret)
cciss-make-cciss_seq_show-handle-holes-in-the-h-drv-array.patch
cpufreq-fix-use-after-free-of-struct-powernow_k8_data.patch
resource-add-helpers-for-fetching-rlimits.patch
-fs-exec.c-restrict-initial-stack-space-expansion-to-rlimit.patch
rtc-fm3130-add-missing-braces.patch
ath5k-fix-eeprom-checksum-check-for-custom-sized-eeproms.patch
clockevent-don-t-remove-broadcast-device-when-cpu-is-dead.patch
x86-amd-iommu-fix-iommu-api-initialization-for-iommu-pt.patch
x86-amd-iommu-fix-deassignment-of-a-device-from-the-pt_domain.patch
x86-re-get-cfg_new-in-case-reuse-move-irq_desc.patch
-tg3-fix-5906-transmit-hangs.patch
staging-fix-rtl8187se-compilation-errors-with-mac80211.patch
alsa-usb-audio-avoid-oops-after-disconnect.patch
serial-8250-add-serial-transmitter-fully-empty-test.patch
+++ /dev/null
-From mike@mpagano.com Fri Feb 12 15:17:42 2010
-From: Mike Pagano <mike@mpagano.com>
-Date: Tue, 2 Feb 2010 19:49:21 -0500
-Subject: tg3: Fix 5906 transmit hangs
-To: stable@kernel.org, mcarlson@broadcom.com
-Message-ID: <201002021949.21183.mike@mpagano.com>
-
-From: Mike Pagano <mike@mpagano.com>
-
-This is a backport of commit 92c6b8d16a36df3f28b2537bed2a56491fb08f11 to
-kernel version 2.6.32. The gentoo bug report can be found at
-https://bugs.gentoo.org/show_bug.cgi?id=301091. Thanks to Matt Carlson
-for his assistance. The original description is as follows:
-
-The 5906 has trouble with fragments that are less than 8 bytes in size.
-This patch works around the problem by pivoting the 5906's transmit
-routine to tg3_start_xmit_dma_bug() and introducing a new SHORT_DMA_BUG
-flag that enables code to detect and react to the problematic condition.
-
-Signed-off-by: Mike Pagano <mpagano@gentoo.org>
-Cc: Matt Carlson <mcarlson@broadcom.com>
-Cc: Michael Chan <mchan@broadcom.com>
-Cc: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
-
----
- drivers/net/tg3.c | 35 +++++++++++++++++++----------------
- drivers/net/tg3.h | 3 +++
- 2 files changed, 22 insertions(+), 16 deletions(-)
-
---- a/drivers/net/tg3.c
-+++ b/drivers/net/tg3.c
-@@ -5392,7 +5392,7 @@ static netdev_tx_t tg3_start_xmit_dma_bu
- mss = 0;
- if ((mss = skb_shinfo(skb)->gso_size) != 0) {
- struct iphdr *iph;
-- int tcp_opt_len, ip_tcp_len, hdr_len;
-+ u32 tcp_opt_len, ip_tcp_len, hdr_len;
-
- if (skb_header_cloned(skb) &&
- pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
-@@ -5423,8 +5423,10 @@ static netdev_tx_t tg3_start_xmit_dma_bu
- IPPROTO_TCP,
- 0);
-
-- if ((tp->tg3_flags2 & TG3_FLG2_HW_TSO) ||
-- (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705)) {
-+ if (tp->tg3_flags2 & TG3_FLG2_HW_TSO_2)
-+ mss |= hdr_len << 9;
-+ else if ((tp->tg3_flags2 & TG3_FLG2_HW_TSO_1) ||
-+ GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705) {
- if (tcp_opt_len || iph->ihl > 5) {
- int tsflags;
-
-@@ -5459,6 +5461,9 @@ static netdev_tx_t tg3_start_xmit_dma_bu
-
- would_hit_hwbug = 0;
-
-+ if ((tp->tg3_flags3 & TG3_FLG3_SHORT_DMA_BUG) && len <= 8)
-+ would_hit_hwbug = 1;
-+
- if (tp->tg3_flags3 & TG3_FLG3_5701_DMA_BUG)
- would_hit_hwbug = 1;
- else if (tg3_4g_overflow_test(mapping, len))
-@@ -5482,6 +5487,10 @@ static netdev_tx_t tg3_start_xmit_dma_bu
-
- tnapi->tx_buffers[entry].skb = NULL;
-
-+ if ((tp->tg3_flags3 & TG3_FLG3_SHORT_DMA_BUG) &&
-+ len <= 8)
-+ would_hit_hwbug = 1;
-+
- if (tg3_4g_overflow_test(mapping, len))
- would_hit_hwbug = 1;
-
-@@ -12594,18 +12603,13 @@ static int __devinit tg3_get_invariants(
- tp->pci_chip_rev_id <= CHIPREV_ID_5714_A2 &&
- tp->pdev_peer == tp->pdev))
- tp->tg3_flags &= ~TG3_FLAG_SUPPORT_MSI;
-+ }
-
-- if ((tp->tg3_flags3 & TG3_FLG3_5755_PLUS) ||
-- GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-- tp->tg3_flags2 |= TG3_FLG2_HW_TSO_2;
-- tp->tg3_flags2 |= TG3_FLG2_1SHOT_MSI;
-- } else {
-- tp->tg3_flags2 |= TG3_FLG2_HW_TSO_1 | TG3_FLG2_TSO_BUG;
-- if (GET_ASIC_REV(tp->pci_chip_rev_id) ==
-- ASIC_REV_5750 &&
-- tp->pci_chip_rev_id >= CHIPREV_ID_5750_C2)
-- tp->tg3_flags2 &= ~TG3_FLG2_TSO_BUG;
-- }
-+ if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
-+ tp->tg3_flags3 |= TG3_FLG3_SHORT_DMA_BUG;
-+ else if (!(tp->tg3_flags3 & TG3_FLG3_5755_PLUS)) {
-+ tp->tg3_flags3 |= TG3_FLG3_4G_DMA_BNDRY_BUG;
-+ tp->tg3_flags3 |= TG3_FLG3_40BIT_DMA_LIMIT_BUG;
- }
-
- tp->irq_max = 1;
-@@ -13975,8 +13979,7 @@ static int __devinit tg3_init_one(struct
- goto err_out_iounmap;
- }
-
-- if ((tp->tg3_flags3 & TG3_FLG3_5755_PLUS) ||
-- GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
-+ if (tp->tg3_flags3 & TG3_FLG3_5755_PLUS)
- dev->netdev_ops = &tg3_netdev_ops;
- else
- dev->netdev_ops = &tg3_netdev_ops_dma_bug;
---- a/drivers/net/tg3.h
-+++ b/drivers/net/tg3.h
-@@ -2759,6 +2759,9 @@ struct tg3 {
- #define TG3_FLG3_TOGGLE_10_100_L1PLLPD 0x00008000
- #define TG3_FLG3_PHY_IS_FET 0x00010000
- #define TG3_FLG3_ENABLE_RSS 0x00020000
-+#define TG3_FLG3_4G_DMA_BNDRY_BUG 0x00080000
-+#define TG3_FLG3_40BIT_DMA_LIMIT_BUG 0x00100000
-+#define TG3_FLG3_SHORT_DMA_BUG 0x00200000
-
- struct timer_list timer;
- u16 timer_counter;
projects / thirdparty / kernel / stable-queue.git / commitdiff
