3.4-stable patches

added patches:
	drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch

diff --git a/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch b/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch
new file mode 100644 (file)
index 0000000..d2289ec
--- /dev/null
+++ b/queue-3.4/drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch
@@ -0,0 +1,67 @@
+From a393c730ab69617c3291a3b0b2a228c9be2fc28c Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Tue, 12 Jun 2012 13:28:42 +0200
+Subject: drm/ttm: Fix buffer object metadata accounting regression v2
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit a393c730ab69617c3291a3b0b2a228c9be2fc28c upstream.
+
+A regression was introduced in the 3.3 rc series, commit
+"drm/ttm: simplify memory accounting for ttm user v2",
+causing the metadata of buffer objects created using the ttm_bo_create()
+function to be accounted twice.
+That causes massive leaks with the vmwgfx driver running for example
+SpecViewperf Catia-03 test 2, eventually killing the app.
+
+Furthermore, the same commit introduces a regression where
+metadata accounting is leaked if a buffer object is
+initialized with an illegal size. This is also fixed with this commit.
+
+v2: Fixed an error path and removed an unused variable.
+
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Jerome Glisse <jglisse@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_bo.c |   13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_bo.c
++++ b/drivers/gpu/drm/ttm/ttm_bo.c
+@@ -1193,6 +1193,7 @@ int ttm_bo_init(struct ttm_bo_device *bd
+                       (*destroy)(bo);
+               else
+                       kfree(bo);
++              ttm_mem_global_free(mem_glob, acc_size);
+               return -EINVAL;
+       }
+       bo->destroy = destroy;
+@@ -1294,22 +1295,14 @@ int ttm_bo_create(struct ttm_bo_device *
+                       struct ttm_buffer_object **p_bo)
+ {
+       struct ttm_buffer_object *bo;
+-      struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
+       size_t acc_size;
+       int ret;
+ 
+-      acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
+-      ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
+-      if (unlikely(ret != 0))
+-              return ret;
+-
+       bo = kzalloc(sizeof(*bo), GFP_KERNEL);
+-
+-      if (unlikely(bo == NULL)) {
+-              ttm_mem_global_free(mem_glob, acc_size);
++      if (unlikely(bo == NULL))
+               return -ENOMEM;
+-      }
+ 
++      acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
+       ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
+                               buffer_start, interruptible,
+                               persistent_swap_storage, acc_size, NULL);

diff --git a/queue-3.4/series b/queue-3.4/series
index 372d11cb57a8b51de452e753dd0c1bc1c96a4382..6540bdae67f8ed653559720045a2239e4bf3cd51 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -11,3 +11,4 @@ x86-uv-fix-uv2-bau-legacy-mode.patch
 x86-mce-amd-make-apic-lvt-thresholding-interrupt-optional.patch
 hwrng-atmel-rng-fix-race-condition-leading-to-repeated-bits.patch
 crypto-aesni-intel-fix-unaligned-cbc-decrypt-for-x86-32.patch
+drm-ttm-fix-buffer-object-metadata-accounting-regression-v2.patch