3.0-stable patches

added patches:
	drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch

diff --git a/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch b/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch
new file mode 100644 (file)
index 0000000..4320c42
--- /dev/null
+++ b/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch
@@ -0,0 +1,44 @@
+From 082918471139b07964967cfe5f70230909c82ae1 Mon Sep 17 00:00:00 2001
+From: Egbert Eich <eich@suse.de>
+Date: Mon, 15 Oct 2012 08:21:39 +0200
+Subject: drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
+
+From: Egbert Eich <eich@suse.de>
+
+commit 082918471139b07964967cfe5f70230909c82ae1 upstream.
+
+radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
+to destroy each of them.
+radeon_ext_tmds_enc_destroy() however also has code to destroy it's
+associated I2C bus rec which has been obtained by radeon_i2c_lookup()
+and is therefore also in the i2c_bus[] list.
+This causes a double free resulting in a kernel panic when unloading
+the radeon driver.
+Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
+problem.
+
+agd5f: fix compiler warning
+
+Signed-off-by: Egbert Eich <eich@suse.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_encoders.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+@@ -973,11 +973,7 @@ static void radeon_legacy_tmds_ext_mode_
+ static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder)
+ {
+       struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+-      struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv;
+-      if (tmds) {
+-              if (tmds->i2c_bus)
+-                      radeon_i2c_destroy(tmds->i2c_bus);
+-      }
++      /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */
+       kfree(radeon_encoder->enc_priv);
+       drm_encoder_cleanup(encoder);
+       kfree(radeon_encoder);

diff --git a/queue-3.0/series b/queue-3.0/series
index a45cd844f881c79d7fcfec7fb9068eb531a98071..e172094fefd7e7a837f93af525fb78c50d748ee5 100644 (file)
--- a/queue-3.0/series
+++ b/queue-3.0/series
@@ -27,3 +27,4 @@ netfilter-nf_ct_expect-fix-possible-access-to-uninitialized-timer.patch
 netfilter-limit-hashlimit-avoid-duplicated-inline.patch
 netfilter-xt_limit-have-r-cost-0-case-work.patch
 add-cdc-acm-support-for-the-cx93010-2x-ucmxx-usb-modem.patch
+drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch