From: Greg Kroah-Hartman Date: Sat, 18 Sep 2010 18:10:02 +0000 (-0700) Subject: .32 patches X-Git-Tag: v2.6.27.54~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=30c54973b726615fc3f344bfb79dd470643d19ed;p=thirdparty%2Fkernel%2Fstable-queue.git .32 patches --- diff --git a/queue-2.6.32/drm-i915-prevent-double-dpms-on.patch b/queue-2.6.32/drm-i915-prevent-double-dpms-on.patch new file mode 100644 index 00000000000..0ca82feb345 --- /dev/null +++ b/queue-2.6.32/drm-i915-prevent-double-dpms-on.patch @@ -0,0 +1,43 @@ +From 032d2a0d068b0368296a56469761394ef03207c3 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 6 Sep 2010 16:17:22 +0100 +Subject: drm/i915: Prevent double dpms on + +From: Chris Wilson + +commit 032d2a0d068b0368296a56469761394ef03207c3 upstream. + +Arguably this is a bug in drm-core in that we should not be called twice +in succession with DPMS_ON, however this is still occuring and we see +FDI link training failures on the second call leading to the occassional +blank display. For the time being ignore the repeated call. + +Original patch by Dave Airlie +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/intel_display.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -1954,6 +1954,9 @@ static void intel_crtc_dpms(struct drm_c + int pipe = intel_crtc->pipe; + bool enabled; + ++ if (intel_crtc->dpms_mode == mode) ++ return; ++ + dev_priv->display.dpms(crtc, mode); + + intel_crtc->dpms_mode = mode; +@@ -4000,7 +4003,7 @@ static void intel_crtc_init(struct drm_d + } + + intel_crtc->cursor_addr = 0; +- intel_crtc->dpms_mode = DRM_MODE_DPMS_OFF; ++ intel_crtc->dpms_mode = -1; + drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs); + + intel_crtc->busy = false; diff --git a/queue-2.6.32/i915-return-efault-if-copy_to_user-fails-2.patch b/queue-2.6.32/i915-return-efault-if-copy_to_user-fails-2.patch new file mode 100644 index 00000000000..51f4e734a1c --- /dev/null +++ b/queue-2.6.32/i915-return-efault-if-copy_to_user-fails-2.patch @@ -0,0 +1,30 @@ +From c877cdce93a44eea96f6cf7fc04be7d0372db2be Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 23 Jun 2010 19:03:01 +0200 +Subject: i915: return -EFAULT if copy_to_user fails + +From: Dan Carpenter + +commit c877cdce93a44eea96f6cf7fc04be7d0372db2be upstream. + +copy_to_user() returns the number of bytes remaining to be copied and +I'm pretty sure we want to return a negative error code here. + +Signed-off-by: Dan Carpenter +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_gem.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -3667,6 +3667,7 @@ i915_gem_execbuffer(struct drm_device *d + if (ret != 0) { + DRM_ERROR("copy %d cliprects failed: %d\n", + args->num_cliprects, ret); ++ ret = -EFAULT; + goto pre_mutex_err; + } + } diff --git a/queue-2.6.32/i915-return-efault-if-copy_to_user-fails.patch b/queue-2.6.32/i915-return-efault-if-copy_to_user-fails.patch new file mode 100644 index 00000000000..4e91952d463 --- /dev/null +++ b/queue-2.6.32/i915-return-efault-if-copy_to_user-fails.patch @@ -0,0 +1,59 @@ +From 9927a403ca8c97798129953fa9cbb5dc259c7cb9 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 19 Jun 2010 15:12:51 +0200 +Subject: i915: return -EFAULT if copy_to_user fails + +From: Dan Carpenter + +commit 9927a403ca8c97798129953fa9cbb5dc259c7cb9 upstream. + +copy_to_user returns the number of bytes remaining to be copied, but we +want to return a negative error code here. These are returned to +userspace. + +Signed-off-by: Dan Carpenter +Signed-off-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_dma.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_dma.c ++++ b/drivers/gpu/drm/i915/i915_dma.c +@@ -683,8 +683,10 @@ static int i915_batchbuffer(struct drm_d + ret = copy_from_user(cliprects, batch->cliprects, + batch->num_cliprects * + sizeof(struct drm_clip_rect)); +- if (ret != 0) ++ if (ret != 0) { ++ ret = -EFAULT; + goto fail_free; ++ } + } + + mutex_lock(&dev->struct_mutex); +@@ -725,8 +727,10 @@ static int i915_cmdbuffer(struct drm_dev + return -ENOMEM; + + ret = copy_from_user(batch_data, cmdbuf->buf, cmdbuf->sz); +- if (ret != 0) ++ if (ret != 0) { ++ ret = -EFAULT; + goto fail_batch_free; ++ } + + if (cmdbuf->num_cliprects) { + cliprects = kcalloc(cmdbuf->num_cliprects, +@@ -737,8 +741,10 @@ static int i915_cmdbuffer(struct drm_dev + ret = copy_from_user(cliprects, cmdbuf->cliprects, + cmdbuf->num_cliprects * + sizeof(struct drm_clip_rect)); +- if (ret != 0) ++ if (ret != 0) { ++ ret = -EFAULT; + goto fail_clip_free; ++ } + } + + mutex_lock(&dev->struct_mutex); diff --git a/queue-2.6.32/series b/queue-2.6.32/series index 55fe7dedce1..1c35fec3d8a 100644 --- a/queue-2.6.32/series +++ b/queue-2.6.32/series @@ -117,4 +117,6 @@ hwmon-f75375s-do-not-overwrite-values-read-from-registers.patch apm_power-add-missing-break-statement.patch nfs-fix-a-typo-in-nfs_sockaddr_match_ipaddr6.patch sunrpc-fix-race-corrupting-rpc-upcall.patch -sunrpc-fix-a-race-in-rpc_info_open.patch +i915-return-efault-if-copy_to_user-fails.patch +i915-return-efault-if-copy_to_user-fails-2.patch +drm-i915-prevent-double-dpms-on.patch diff --git a/queue-2.6.32/sunrpc-fix-a-race-in-rpc_info_open.patch b/queue-2.6.32/sunrpc-fix-a-race-in-rpc_info_open.patch deleted file mode 100644 index fdc1cb6db79..00000000000 --- a/queue-2.6.32/sunrpc-fix-a-race-in-rpc_info_open.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 006abe887c5e637d059c44310de6c92f36aded3b Mon Sep 17 00:00:00 2001 -From: Trond Myklebust -Date: Sun, 12 Sep 2010 19:55:25 -0400 -Subject: SUNRPC: Fix a race in rpc_info_open - -From: Trond Myklebust - -commit 006abe887c5e637d059c44310de6c92f36aded3b upstream. - -There is a race between rpc_info_open and rpc_release_client() -in that nothing stops a process from opening the file after -the clnt->cl_kref goes to zero. - -Fix this by using atomic_inc_unless_zero()... - -Reported-by: J. Bruce Fields -Signed-off-by: Trond Myklebust -Signed-off-by: Greg Kroah-Hartman - ---- a/include/linux/sunrpc/clnt.h -+++ b/include/linux/sunrpc/clnt.h -@@ -30,7 +30,7 @@ struct rpc_inode; - * The high-level client handle - */ - struct rpc_clnt { -- struct kref cl_kref; /* Number of references */ -+ atomic_t cl_count; /* Number of references */ - struct list_head cl_clients; /* Global list of clients */ - struct list_head cl_tasks; /* List of tasks */ - spinlock_t cl_lock; /* spinlock */ -diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c -index 657aac6..3a8f53e 100644 ---- a/net/sunrpc/clnt.c -+++ b/net/sunrpc/clnt.c -@@ -226,7 +226,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru - goto out_no_principal; - } - -- kref_init(&clnt->cl_kref); -+ atomic_set(&clnt->cl_count, 1); - - err = rpc_setup_pipedir(clnt, program->pipe_dir_name); - if (err < 0) -@@ -390,14 +390,14 @@ rpc_clone_client(struct rpc_clnt *clnt) - if (new->cl_principal == NULL) - goto out_no_principal; - } -- kref_init(&new->cl_kref); -+ atomic_set(&new->cl_count, 1); - err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name); - if (err != 0) - goto out_no_path; - if (new->cl_auth) - atomic_inc(&new->cl_auth->au_count); - xprt_get(clnt->cl_xprt); -- kref_get(&clnt->cl_kref); -+ atomic_inc(&clnt->cl_count); - rpc_register_client(new); - rpciod_up(); - return new; -@@ -465,10 +465,8 @@ EXPORT_SYMBOL_GPL(rpc_shutdown_client); - * Free an RPC client - */ - static void --rpc_free_client(struct kref *kref) -+rpc_free_client(struct rpc_clnt *clnt) - { -- struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref); -- - dprintk("RPC: destroying %s client for %s\n", - clnt->cl_protname, clnt->cl_server); - if (!IS_ERR(clnt->cl_path.dentry)) { -@@ -495,12 +493,10 @@ out_free: - * Free an RPC client - */ - static void --rpc_free_auth(struct kref *kref) -+rpc_free_auth(struct rpc_clnt *clnt) - { -- struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref); -- - if (clnt->cl_auth == NULL) { -- rpc_free_client(kref); -+ rpc_free_client(clnt); - return; - } - -@@ -509,10 +505,11 @@ rpc_free_auth(struct kref *kref) - * release remaining GSS contexts. This mechanism ensures - * that it can do so safely. - */ -- kref_init(kref); -+ atomic_inc(&clnt->cl_count); - rpcauth_release(clnt->cl_auth); - clnt->cl_auth = NULL; -- kref_put(kref, rpc_free_client); -+ if (atomic_dec_and_test(&clnt->cl_count)) -+ rpc_free_client(clnt); - } - - /* -@@ -525,7 +522,8 @@ rpc_release_client(struct rpc_clnt *clnt) - - if (list_empty(&clnt->cl_tasks)) - wake_up(&destroy_wait); -- kref_put(&clnt->cl_kref, rpc_free_auth); -+ if (atomic_dec_and_test(&clnt->cl_count)) -+ rpc_free_auth(clnt); - } - - /** -@@ -588,7 +586,7 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt) - if (clnt != NULL) { - rpc_task_release_client(task); - task->tk_client = clnt; -- kref_get(&clnt->cl_kref); -+ atomic_inc(&clnt->cl_count); - if (clnt->cl_softrtry) - task->tk_flags |= RPC_TASK_SOFT; - /* Add to the client's list of all tasks */ -diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c -index 41a762f..8c8eef2 100644 ---- a/net/sunrpc/rpc_pipe.c -+++ b/net/sunrpc/rpc_pipe.c -@@ -371,21 +371,23 @@ rpc_show_info(struct seq_file *m, void *v) - static int - rpc_info_open(struct inode *inode, struct file *file) - { -- struct rpc_clnt *clnt; -+ struct rpc_clnt *clnt = NULL; - int ret = single_open(file, rpc_show_info, NULL); - - if (!ret) { - struct seq_file *m = file->private_data; -- mutex_lock(&inode->i_mutex); -- clnt = RPC_I(inode)->private; -- if (clnt) { -- kref_get(&clnt->cl_kref); -+ -+ spin_lock(&file->f_path.dentry->d_lock); -+ if (!d_unhashed(file->f_path.dentry)) -+ clnt = RPC_I(inode)->private; -+ if (clnt != NULL && atomic_inc_not_zero(&clnt->cl_count)) { -+ spin_unlock(&file->f_path.dentry->d_lock); - m->private = clnt; - } else { -+ spin_unlock(&file->f_path.dentry->d_lock); - single_release(inode, file); - ret = -EINVAL; - } -- mutex_unlock(&inode->i_mutex); - } - return ret; - }