From: Greg Kroah-Hartman Date: Wed, 16 Nov 2011 16:46:14 +0000 (-0800) Subject: 3.1 patches X-Git-Tag: v3.0.10~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5f3e11c5550628e3663ca1060a1cbc3ea5d06f1a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.1 patches added patches: drm-radeon-add-some-missing-firemv-pci-ids.patch drm-radeon-kms-fix-up-gpio-i2c-mask-bits-for-r4xx.patch hfs-add-sanity-check-for-file-name-length.patch keys-fix-a-null-pointer-deref-in-the-user-defined-key-type.patch revert-leds-save-the-delay-values-after-a-successful-call-to-blink_set.patch --- diff --git a/queue-3.1/drm-radeon-add-some-missing-firemv-pci-ids.patch b/queue-3.1/drm-radeon-add-some-missing-firemv-pci-ids.patch new file mode 100644 index 00000000000..541ee01e738 --- /dev/null +++ b/queue-3.1/drm-radeon-add-some-missing-firemv-pci-ids.patch @@ -0,0 +1,38 @@ +From b872a37437e93df9d112ce674752b3b3a0a17020 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 14 Nov 2011 09:33:56 -0500 +Subject: drm/radeon: add some missing FireMV pci ids + +From: Alex Deucher + +commit b872a37437e93df9d112ce674752b3b3a0a17020 upstream. + +Noticed by Egbert. + +Signed-off-by: Alex Deucher +Cc: Egbert Eich +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -4,6 +4,7 @@ + */ + #define radeon_PCI_IDS \ + {0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \ ++ {0x1002, 0x3151, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x3152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x3154, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x3155, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ +@@ -55,6 +56,7 @@ + {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \ ++ {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \ + {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ + {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ + {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \ diff --git a/queue-3.1/drm-radeon-kms-fix-up-gpio-i2c-mask-bits-for-r4xx.patch b/queue-3.1/drm-radeon-kms-fix-up-gpio-i2c-mask-bits-for-r4xx.patch new file mode 100644 index 00000000000..fd0cd2b4375 --- /dev/null +++ b/queue-3.1/drm-radeon-kms-fix-up-gpio-i2c-mask-bits-for-r4xx.patch @@ -0,0 +1,44 @@ +From 6c47e5c23aa2a7c54ad7ac13af4bd56cd9e703bf Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 14 Nov 2011 14:32:01 -0500 +Subject: drm/radeon/kms: fix up gpio i2c mask bits for r4xx + +From: Alex Deucher + +commit 6c47e5c23aa2a7c54ad7ac13af4bd56cd9e703bf upstream. + +Fixes i2c test failures when i2c_algo_bit.bit_test=1. + +The hw doesn't actually require a mask, so just set it +to the default mask bits for r1xx-r4xx radeon ddc. + +Signed-off-by: Alex Deucher +Cc: Jean Delvare +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_atombios.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_atombios.c ++++ b/drivers/gpu/drm/radeon/radeon_atombios.c +@@ -85,6 +85,18 @@ static inline struct radeon_i2c_bus_rec + for (i = 0; i < num_indices; i++) { + gpio = &i2c_info->asGPIO_Info[i]; + ++ /* r4xx mask is technically not used by the hw, so patch in the legacy mask bits */ ++ if ((rdev->family == CHIP_R420) || ++ (rdev->family == CHIP_R423) || ++ (rdev->family == CHIP_RV410)) { ++ if ((le16_to_cpu(gpio->usClkMaskRegisterIndex) == 0x0018) || ++ (le16_to_cpu(gpio->usClkMaskRegisterIndex) == 0x0019) || ++ (le16_to_cpu(gpio->usClkMaskRegisterIndex) == 0x001a)) { ++ gpio->ucClkMaskShift = 0x19; ++ gpio->ucDataMaskShift = 0x18; ++ } ++ } ++ + /* some evergreen boards have bad data for this entry */ + if (ASIC_IS_DCE4(rdev)) { + if ((i == 7) && diff --git a/queue-3.1/hfs-add-sanity-check-for-file-name-length.patch b/queue-3.1/hfs-add-sanity-check-for-file-name-length.patch new file mode 100644 index 00000000000..ac81a1019c3 --- /dev/null +++ b/queue-3.1/hfs-add-sanity-check-for-file-name-length.patch @@ -0,0 +1,32 @@ +From bc5b8a9003132ae44559edd63a1623b7b99dfb68 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 14 Nov 2011 17:52:08 +0300 +Subject: hfs: add sanity check for file name length + +From: Dan Carpenter + +commit bc5b8a9003132ae44559edd63a1623b7b99dfb68 upstream. + +On a corrupted file system the ->len field could be wrong leading to +a buffer overflow. + +Reported-and-acked-by: Clement LECIGNE +Signed-off-by: Dan Carpenter +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfs/trans.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/hfs/trans.c ++++ b/fs/hfs/trans.c +@@ -40,6 +40,8 @@ int hfs_mac2asc(struct super_block *sb, + + src = in->name; + srclen = in->len; ++ if (srclen > HFS_NAMELEN) ++ srclen = HFS_NAMELEN; + dst = out; + dstlen = HFS_MAX_NAMELEN; + if (nls_io) { diff --git a/queue-3.1/keys-fix-a-null-pointer-deref-in-the-user-defined-key-type.patch b/queue-3.1/keys-fix-a-null-pointer-deref-in-the-user-defined-key-type.patch new file mode 100644 index 00000000000..f340ea26074 --- /dev/null +++ b/queue-3.1/keys-fix-a-null-pointer-deref-in-the-user-defined-key-type.patch @@ -0,0 +1,69 @@ +From 9f35a33b8d06263a165efe3541d9aa0cdbd70b3b Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 15 Nov 2011 22:09:45 +0000 +Subject: KEYS: Fix a NULL pointer deref in the user-defined key type + +From: David Howells + +commit 9f35a33b8d06263a165efe3541d9aa0cdbd70b3b upstream. + +Fix a NULL pointer deref in the user-defined key type whereby updating a +negative key into a fully instantiated key will cause an oops to occur +when the code attempts to free the non-existent old payload. + +This results in an oops that looks something like the following: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 + IP: [] __call_rcu+0x11/0x13e + PGD 3391d067 PUD 3894a067 PMD 0 + Oops: 0002 [#1] SMP + CPU 1 + Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140 /DG965RY + RIP: 0010:[] [] __call_rcu+0x11/0x13e + RSP: 0018:ffff88003d591df8 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e + RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000 + RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c + R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538 + R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908 + FS: 00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040) + Stack: + ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50 + ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea + ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0 + Call Trace: + [] call_rcu_sched+0x10/0x12 + [] user_update+0x8d/0xa2 + [] key_create_or_update+0x236/0x270 + [] sys_add_key+0x123/0x17e + [] system_call_fastpath+0x16/0x1b + +Signed-off-by: David Howells +Acked-by: Jeff Layton +Acked-by: Neil Horman +Acked-by: Steve Dickson +Acked-by: James Morris +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/user_defined.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/security/keys/user_defined.c ++++ b/security/keys/user_defined.c +@@ -102,7 +102,8 @@ int user_update(struct key *key, const v + key->expiry = 0; + } + +- kfree_rcu(zap, rcu); ++ if (zap) ++ kfree_rcu(zap, rcu); + + error: + return ret; diff --git a/queue-3.1/revert-leds-save-the-delay-values-after-a-successful-call-to-blink_set.patch b/queue-3.1/revert-leds-save-the-delay-values-after-a-successful-call-to-blink_set.patch new file mode 100644 index 00000000000..9ac6091d89c --- /dev/null +++ b/queue-3.1/revert-leds-save-the-delay-values-after-a-successful-call-to-blink_set.patch @@ -0,0 +1,42 @@ +From cb871513f656bdfc48b185b55f37857b5c750c40 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 15 Nov 2011 14:35:52 -0800 +Subject: Revert "leds: save the delay values after a successful call to blink_set()" + +From: Johan Hovold + +commit cb871513f656bdfc48b185b55f37857b5c750c40 upstream. + +Revert commit 6123b0e274503a0d3588e84fbe07c9aa01bfaf5d. + +The problem this patch intends to solve has alreadqy been fixed by +commit 7a5caabd090b ("drivers/leds/ledtrig-timer.c: fix broken sysfs +delay handling"). + +Signed-off-by: Johan Hovold +Cc: Antonio Ospite +Cc: Johannes Berg +Cc: Richard Purdie +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/leds/led-class.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -270,11 +270,8 @@ void led_blink_set(struct led_classdev * + del_timer_sync(&led_cdev->blink_timer); + + if (led_cdev->blink_set && +- !led_cdev->blink_set(led_cdev, delay_on, delay_off)) { +- led_cdev->blink_delay_on = *delay_on; +- led_cdev->blink_delay_off = *delay_off; ++ !led_cdev->blink_set(led_cdev, delay_on, delay_off)) + return; +- } + + /* blink with 1 Hz as default if nothing specified */ + if (!*delay_on && !*delay_off) diff --git a/queue-3.1/series b/queue-3.1/series index dc44227ce67..72421e0d9b6 100644 --- a/queue-3.1/series +++ b/queue-3.1/series @@ -9,3 +9,8 @@ drm-nouveau-initialize-chan-fence.lock-before-use.patch drm-radeon-kms-make-an-aux-failure-debug-only.patch alsa-usb-audio-check-the-db-range-validity-in-the-later-read-too.patch alsa-usb-audio-fix-the-missing-volume-quirks-at-delayed-init.patch +keys-fix-a-null-pointer-deref-in-the-user-defined-key-type.patch +hfs-add-sanity-check-for-file-name-length.patch +revert-leds-save-the-delay-values-after-a-successful-call-to-blink_set.patch +drm-radeon-add-some-missing-firemv-pci-ids.patch +drm-radeon-kms-fix-up-gpio-i2c-mask-bits-for-r4xx.patch