add 1 and remove 1 patch from the .27 queue

diff --git a/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch b/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch
new file mode 100644 (file)
index 0000000..aadd855
--- /dev/null
+++ b/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch
@@ -0,0 +1,62 @@
+From 7d6feeb287c61aafa88f06345387b1188edf4b86 Mon Sep 17 00:00:00 2001
+From: Serge E. Hallyn <serue@us.ibm.com>
+Date: Tue, 15 Dec 2009 16:47:27 -0800
+Subject: ipc ns: fix memory leak (idr)
+
+From: Serge E. Hallyn <serue@us.ibm.com>
+
+commit 7d6feeb287c61aafa88f06345387b1188edf4b86 upstream.
+
+We have apparently had a memory leak since
+7ca7e564e049d8b350ec9d958ff25eaa24226352 "ipc: store ipcs into IDRs" in
+2007.  The idr of which 3 exist for each ipc namespace is never freed.
+
+This patch simply frees them when the ipcns is freed.  I don't believe any
+idr_remove() are done from rcu (and could therefore be delayed until after
+this idr_destroy()), so the patch should be safe.  Some quick testing
+showed no harm, and the memory leak fixed.
+
+Caught by kmemleak.
+
+Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Nick Piggin <npiggin@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ ipc/msg.c |    1 +
+ ipc/sem.c |    1 +
+ ipc/shm.c |    1 +
+ 3 files changed, 3 insertions(+)
+
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -125,6 +125,7 @@ void msg_init_ns(struct ipc_namespace *n
+ void msg_exit_ns(struct ipc_namespace *ns)
+ {
+       free_ipcs(ns, &msg_ids(ns), freeque);
++      idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr);
+ }
+ #endif
+ 
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -129,6 +129,7 @@ void sem_init_ns(struct ipc_namespace *n
+ void sem_exit_ns(struct ipc_namespace *ns)
+ {
+       free_ipcs(ns, &sem_ids(ns), freeary);
++      idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr);
+ }
+ #endif
+ 
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -100,6 +100,7 @@ static void do_shm_rmid(struct ipc_names
+ void shm_exit_ns(struct ipc_namespace *ns)
+ {
+       free_ipcs(ns, &shm_ids(ns), do_shm_rmid);
++      idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr);
+ }
+ #endif
+ 

diff --git a/queue-2.6.27/series b/queue-2.6.27/series
index b78891860cdc3565eef6ffdbf7760c72bf04b509..57ff925b37e3059f3f83907b650a287c795835f1 100644 (file)
--- a/queue-2.6.27/series
+++ b/queue-2.6.27/series
@@ -7,4 +7,4 @@ tty-fix-race-in-tty_fasync.patch
 usb-add-missing-delay-during-remote-wakeup.patch
 usb-ehci-fix-handling-of-unusual-interrupt-intervals.patch
 usb-ehci-uhci-fix-race-between-root-hub-suspend-and-port-resume.patch
-sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch
+ipc-ns-fix-memory-leak-idr.patch

diff --git a/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch b/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch
deleted file mode 100644 (file)
index 5a73f04..0000000
--- a/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From a7ebd27a13757248863cd61e541af7fa9e7727ee Mon Sep 17 00:00:00 2001
-From: Neil Turton <nturton@solarflare.com>
-Date: Wed, 23 Dec 2009 13:47:13 +0000
-Subject: sfc: Fix DMA mapping cleanup in case of an error in TSO
-
-From: Neil Turton <nturton@solarflare.com>
-
-commit a7ebd27a13757248863cd61e541af7fa9e7727ee upstream.
-
-We need buffer->len to remain valid to work out the correct address to
-be unmapped.  We therefore need to clear buffer->len after the unmap
-operation.
-
-Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- drivers/net/sfc/tx.c |    4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/sfc/tx.c
-+++ b/drivers/net/sfc/tx.c
-@@ -813,14 +813,14 @@ static void efx_enqueue_unwind(struct ef
-                                          tx_queue->efx->type->txd_ring_mask];
-               efx_tsoh_free(tx_queue, buffer);
-               EFX_BUG_ON_PARANOID(buffer->skb);
--              buffer->len = 0;
--              buffer->continuation = 1;
-               if (buffer->unmap_len) {
-                       pci_unmap_page(tx_queue->efx->pci_dev,
-                                      buffer->unmap_addr,
-                                      buffer->unmap_len, PCI_DMA_TODEVICE);
-                       buffer->unmap_len = 0;
-               }
-+              buffer->len = 0;
-+              buffer->continuation = 1;
-       }
- }
-