From: Greg Kroah-Hartman Date: Fri, 26 Oct 2012 18:33:06 +0000 (-0700) Subject: 3.4-stable patches X-Git-Tag: v3.0.49~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=790a89730b67e84f19d6556d43040483375a802f;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: alsa-hda-add-dock-support-for-thinkpad-t430.patch arm-7559-1-smp-switch-away-from-the-idmap-before-updating-init_mm.mm_count.patch drivers-rtc-rtc-imxdi.c-add-missing-spin-lock-initialization.patch drm-radeon-add-error-output-if-vm-cs-fails-on-cayman.patch drm-radeon-add-some-new-si-pci-ids.patch fs-compat_ioctl.c-video_set_spu_palette-missing-error-check.patch genalloc-stop-crashing-the-system-when-destroying-a-pool.patch gen_init_cpio-avoid-stack-overflow-when-expanding.patch --- diff --git a/queue-3.4/alsa-hda-add-dock-support-for-thinkpad-t430.patch b/queue-3.4/alsa-hda-add-dock-support-for-thinkpad-t430.patch new file mode 100644 index 00000000000..d2f3b3b8720 --- /dev/null +++ b/queue-3.4/alsa-hda-add-dock-support-for-thinkpad-t430.patch @@ -0,0 +1,38 @@ +From 84f98fdf7865fbd35b312eb39ea91e5618c514c7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Stef=C3=A1n=20Freyr?= +Date: Fri, 19 Oct 2012 22:46:00 +0200 +Subject: ALSA: hda - add dock support for Thinkpad T430 + +From: =?UTF-8?q?Stef=C3=A1n=20Freyr?= + +commit 84f98fdf7865fbd35b312eb39ea91e5618c514c7 upstream. + +I have a Lenovo ThinkPad T430 and an UltraBase Series 3 docking +station. + +Without this patch, if I plug my headphones into the jack on the +computer, everything works fine. The computer speakers mute and the +audio is played in the headphones. However, if I plug into the docking +station headphone jack the computer speakers are muted but there is no +audio in the headphones. + +Addresses https://bugs.launchpad.net/bugs/1060372 + +Signed-off-by: Joseph Salisbury +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6184,6 +6184,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), diff --git a/queue-3.4/arm-7559-1-smp-switch-away-from-the-idmap-before-updating-init_mm.mm_count.patch b/queue-3.4/arm-7559-1-smp-switch-away-from-the-idmap-before-updating-init_mm.mm_count.patch new file mode 100644 index 00000000000..36bde851a96 --- /dev/null +++ b/queue-3.4/arm-7559-1-smp-switch-away-from-the-idmap-before-updating-init_mm.mm_count.patch @@ -0,0 +1,82 @@ +From 5f40b909728ad784eb43aa309d3c4e9bdf050781 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Fri, 19 Oct 2012 17:53:01 +0100 +Subject: ARM: 7559/1: smp: switch away from the idmap before updating init_mm.mm_count + +From: Will Deacon + +commit 5f40b909728ad784eb43aa309d3c4e9bdf050781 upstream. + +When booting a secondary CPU, the primary CPU hands two sets of page +tables via the secondary_data struct: + + (1) swapper_pg_dir: a normal, cacheable, shared (if SMP) mapping + of the kernel image (i.e. the tables used by init_mm). + + (2) idmap_pgd: an uncached mapping of the .idmap.text ELF + section. + +The idmap is generally used when enabling and disabling the MMU, which +includes early CPU boot. In this case, the secondary CPU switches to +swapper as soon as it enters C code: + + struct mm_struct *mm = &init_mm; + unsigned int cpu = smp_processor_id(); + + /* + * All kernel threads share the same mm context; grab a + * reference and switch to it. + */ + atomic_inc(&mm->mm_count); + current->active_mm = mm; + cpumask_set_cpu(cpu, mm_cpumask(mm)); + cpu_switch_mm(mm->pgd, mm); + +This causes a problem on ARMv7, where the identity mapping is treated as +strongly-ordered leading to architecturally UNPREDICTABLE behaviour of +exclusive accesses, such as those used by atomic_inc. + +This patch re-orders the secondary_start_kernel function so that we +switch to swapper before performing any exclusive accesses. + +Reported-by: Gilles Chanteperdrix +Cc: David McKay +Signed-off-by: Will Deacon +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/smp.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -249,18 +249,24 @@ static void percpu_timer_setup(void); + asmlinkage void __cpuinit secondary_start_kernel(void) + { + struct mm_struct *mm = &init_mm; +- unsigned int cpu = smp_processor_id(); ++ unsigned int cpu; ++ ++ /* ++ * The identity mapping is uncached (strongly ordered), so ++ * switch away from it before attempting any exclusive accesses. ++ */ ++ cpu_switch_mm(mm->pgd, mm); ++ enter_lazy_tlb(mm, current); ++ local_flush_tlb_all(); + + /* + * All kernel threads share the same mm context; grab a + * reference and switch to it. + */ ++ cpu = smp_processor_id(); + atomic_inc(&mm->mm_count); + current->active_mm = mm; + cpumask_set_cpu(cpu, mm_cpumask(mm)); +- cpu_switch_mm(mm->pgd, mm); +- enter_lazy_tlb(mm, current); +- local_flush_tlb_all(); + + printk("CPU%u: Booted secondary processor\n", cpu); + diff --git a/queue-3.4/drivers-rtc-rtc-imxdi.c-add-missing-spin-lock-initialization.patch b/queue-3.4/drivers-rtc-rtc-imxdi.c-add-missing-spin-lock-initialization.patch new file mode 100644 index 00000000000..238de868efe --- /dev/null +++ b/queue-3.4/drivers-rtc-rtc-imxdi.c-add-missing-spin-lock-initialization.patch @@ -0,0 +1,35 @@ +From fee0de7791f967c2c5f0d43eb7b7261761b45e64 Mon Sep 17 00:00:00 2001 +From: Jan Luebbe +Date: Thu, 25 Oct 2012 13:38:11 -0700 +Subject: drivers/rtc/rtc-imxdi.c: add missing spin lock initialization + +From: Jan Luebbe + +commit fee0de7791f967c2c5f0d43eb7b7261761b45e64 upstream. + +Signed-off-by: Jan Luebbe +Cc: Alessandro Zummo +Cc: Roland Stigge +Cc: Grant Likely +Tested-by: Roland Stigge +Cc: Sascha Hauer +Cc: Russell King +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-imxdi.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/rtc/rtc-imxdi.c ++++ b/drivers/rtc/rtc-imxdi.c +@@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platf + if (imxdi->ioaddr == NULL) + return -ENOMEM; + ++ spin_lock_init(&imxdi->irq_lock); ++ + imxdi->irq = platform_get_irq(pdev, 0); + if (imxdi->irq < 0) + return imxdi->irq; diff --git a/queue-3.4/drm-radeon-add-error-output-if-vm-cs-fails-on-cayman.patch b/queue-3.4/drm-radeon-add-error-output-if-vm-cs-fails-on-cayman.patch new file mode 100644 index 00000000000..5ad0b3fc0cb --- /dev/null +++ b/queue-3.4/drm-radeon-add-error-output-if-vm-cs-fails-on-cayman.patch @@ -0,0 +1,28 @@ +From c71721324c612f7f040657ce9917d87f530f9784 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Fri, 19 Oct 2012 13:27:04 -0400 +Subject: drm/radeon: add error output if VM CS fails on cayman + +From: Alex Deucher + +commit c71721324c612f7f040657ce9917d87f530f9784 upstream. + +So we know why the CS was rejected. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/evergreen_cs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/radeon/evergreen_cs.c ++++ b/drivers/gpu/drm/radeon/evergreen_cs.c +@@ -2775,6 +2775,7 @@ static bool evergreen_vm_reg_valid(u32 r + case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS: + return true; + default: ++ DRM_ERROR("Invalid register 0x%x in CS\n", reg); + return false; + } + } diff --git a/queue-3.4/drm-radeon-add-some-new-si-pci-ids.patch b/queue-3.4/drm-radeon-add-some-new-si-pci-ids.patch new file mode 100644 index 00000000000..3c62fd6d7e3 --- /dev/null +++ b/queue-3.4/drm-radeon-add-some-new-si-pci-ids.patch @@ -0,0 +1,35 @@ +From b6aa22db7857ab7ed042d6c56b800bfc727cfdff Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 16 Oct 2012 12:51:45 -0400 +Subject: drm/radeon: add some new SI PCI ids + +From: Alex Deucher + +commit b6aa22db7857ab7ed042d6c56b800bfc727cfdff upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -209,6 +209,8 @@ + {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x678A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6790, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6791, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6792, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ +@@ -221,6 +223,7 @@ + {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6811, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ diff --git a/queue-3.4/fs-compat_ioctl.c-video_set_spu_palette-missing-error-check.patch b/queue-3.4/fs-compat_ioctl.c-video_set_spu_palette-missing-error-check.patch new file mode 100644 index 00000000000..72d8665b7fd --- /dev/null +++ b/queue-3.4/fs-compat_ioctl.c-video_set_spu_palette-missing-error-check.patch @@ -0,0 +1,38 @@ +From 12176503366885edd542389eed3aaf94be163fdb Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Thu, 25 Oct 2012 13:38:16 -0700 +Subject: fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check + +From: Kees Cook + +commit 12176503366885edd542389eed3aaf94be163fdb upstream. + +The compat ioctl for VIDEO_SET_SPU_PALETTE was missing an error check +while converting ioctl arguments. This could lead to leaking kernel +stack contents into userspace. + +Patch extracted from existing fix in grsecurity. + +Signed-off-by: Kees Cook +Cc: David Miller +Cc: Brad Spengler +Cc: PaX Team +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/compat_ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsi + + err = get_user(palp, &up->palette); + err |= get_user(length, &up->length); ++ if (err) ++ return -EFAULT; + + up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); + err = put_user(compat_ptr(palp), &up_native->palette); diff --git a/queue-3.4/gen_init_cpio-avoid-stack-overflow-when-expanding.patch b/queue-3.4/gen_init_cpio-avoid-stack-overflow-when-expanding.patch new file mode 100644 index 00000000000..795b248df21 --- /dev/null +++ b/queue-3.4/gen_init_cpio-avoid-stack-overflow-when-expanding.patch @@ -0,0 +1,97 @@ +From 20f1de659b77364d55d4e7fad2ef657e7730323f Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Thu, 25 Oct 2012 13:38:14 -0700 +Subject: gen_init_cpio: avoid stack overflow when expanding + +From: Kees Cook + +commit 20f1de659b77364d55d4e7fad2ef657e7730323f upstream. + +Fix possible overflow of the buffer used for expanding environment +variables when building file list. + +In the extremely unlikely case of an attacker having control over the +environment variables visible to gen_init_cpio, control over the +contents of the file gen_init_cpio parses, and gen_init_cpio was built +without compiler hardening, the attacker can gain arbitrary execution +control via a stack buffer overflow. + + $ cat usr/crash.list + file foo ${BIG}${BIG}${BIG}${BIG}${BIG}${BIG} 0755 0 0 + $ BIG=$(perl -e 'print "A" x 4096;') ./usr/gen_init_cpio usr/crash.list + *** buffer overflow detected ***: ./usr/gen_init_cpio terminated + +This also replaces the space-indenting with tabs. + +Patch based on existing fix extracted from grsecurity. + +Signed-off-by: Kees Cook +Cc: Michal Marek +Cc: Brad Spengler +Cc: PaX Team +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + usr/gen_init_cpio.c | 41 ++++++++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 19 deletions(-) + +--- a/usr/gen_init_cpio.c ++++ b/usr/gen_init_cpio.c +@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, + int retval; + int rc = -1; + int namesize; +- int i; ++ unsigned int i; + + mode |= S_IFREG; + +@@ -381,25 +381,28 @@ error: + + static char *cpio_replace_env(char *new_location) + { +- char expanded[PATH_MAX + 1]; +- char env_var[PATH_MAX + 1]; +- char *start; +- char *end; +- +- for (start = NULL; (start = strstr(new_location, "${")); ) { +- end = strchr(start, '}'); +- if (start < end) { +- *env_var = *expanded = '\0'; +- strncat(env_var, start + 2, end - start - 2); +- strncat(expanded, new_location, start - new_location); +- strncat(expanded, getenv(env_var), PATH_MAX); +- strncat(expanded, end + 1, PATH_MAX); +- strncpy(new_location, expanded, PATH_MAX); +- } else +- break; +- } ++ char expanded[PATH_MAX + 1]; ++ char env_var[PATH_MAX + 1]; ++ char *start; ++ char *end; ++ ++ for (start = NULL; (start = strstr(new_location, "${")); ) { ++ end = strchr(start, '}'); ++ if (start < end) { ++ *env_var = *expanded = '\0'; ++ strncat(env_var, start + 2, end - start - 2); ++ strncat(expanded, new_location, start - new_location); ++ strncat(expanded, getenv(env_var), ++ PATH_MAX - strlen(expanded)); ++ strncat(expanded, end + 1, ++ PATH_MAX - strlen(expanded)); ++ strncpy(new_location, expanded, PATH_MAX); ++ new_location[PATH_MAX] = 0; ++ } else ++ break; ++ } + +- return new_location; ++ return new_location; + } + + diff --git a/queue-3.4/genalloc-stop-crashing-the-system-when-destroying-a-pool.patch b/queue-3.4/genalloc-stop-crashing-the-system-when-destroying-a-pool.patch new file mode 100644 index 00000000000..aaea9515dd0 --- /dev/null +++ b/queue-3.4/genalloc-stop-crashing-the-system-when-destroying-a-pool.patch @@ -0,0 +1,129 @@ +From eedce141cd2dad8d0cefc5468ef41898949a7031 Mon Sep 17 00:00:00 2001 +From: Thadeu Lima de Souza Cascardo +Date: Thu, 25 Oct 2012 13:37:51 -0700 +Subject: genalloc: stop crashing the system when destroying a pool + +From: Thadeu Lima de Souza Cascardo + +commit eedce141cd2dad8d0cefc5468ef41898949a7031 upstream. + +The genalloc code uses the bitmap API from include/linux/bitmap.h and +lib/bitmap.c, which is based on long values. Both bitmap_set from +lib/bitmap.c and bitmap_set_ll, which is the lockless version from +genalloc.c, use BITMAP_LAST_WORD_MASK to set the first bits in a long in +the bitmap. + +That one uses (1 << bits) - 1, 0b111, if you are setting the first three +bits. This means that the API counts from the least significant bits +(LSB from now on) to the MSB. The LSB in the first long is bit 0, then. +The same works for the lookup functions. + +The genalloc code uses longs for the bitmap, as it should. In +include/linux/genalloc.h, struct gen_pool_chunk has unsigned long +bits[0] as its last member. When allocating the struct, genalloc should +reserve enough space for the bitmap. This should be a proper number of +longs that can fit the amount of bits in the bitmap. + +However, genalloc allocates an integer number of bytes that fit the +amount of bits, but may not be an integer amount of longs. 9 bytes, for +example, could be allocated for 70 bits. + +This is a problem in itself if the Least Significat Bit in a long is in +the byte with the largest address, which happens in Big Endian machines. +This means genalloc is not allocating the byte in which it will try to +set or check for a bit. + +This may end up in memory corruption, where genalloc will try to set the +bits it has not allocated. In fact, genalloc may not set these bits +because it may find them already set, because they were not zeroed since +they were not allocated. And that's what causes a BUG when +gen_pool_destroy is called and check for any set bits. + +What really happens is that genalloc uses kmalloc_node with __GFP_ZERO +on gen_pool_add_virt. With SLAB and SLUB, this means the whole slab +will be cleared, not only the requested bytes. Since struct +gen_pool_chunk has a size that is a multiple of 8, and slab sizes are +multiples of 8, we get lucky and allocate and clear the right amount of +bytes. + +Hower, this is not the case with SLOB or with older code that did memset +after allocating instead of using __GFP_ZERO. + +So, a simple module as this (running 3.6.0), will cause a crash when +rmmod'ed. + + [root@phantom-lp2 foo]# cat foo.c + #include + #include + #include + #include + + MODULE_LICENSE("GPL"); + MODULE_VERSION("0.1"); + + static struct gen_pool *foo_pool; + + static __init int foo_init(void) + { + int ret; + foo_pool = gen_pool_create(10, -1); + if (!foo_pool) + return -ENOMEM; + ret = gen_pool_add(foo_pool, 0xa0000000, 32 << 10, -1); + if (ret) { + gen_pool_destroy(foo_pool); + return ret; + } + return 0; + } + + static __exit void foo_exit(void) + { + gen_pool_destroy(foo_pool); + } + + module_init(foo_init); + module_exit(foo_exit); + [root@phantom-lp2 foo]# zcat /proc/config.gz | grep SLOB + CONFIG_SLOB=y + [root@phantom-lp2 foo]# insmod ./foo.ko + [root@phantom-lp2 foo]# rmmod foo + ------------[ cut here ]------------ + kernel BUG at lib/genalloc.c:243! + cpu 0x4: Vector: 700 (Program Check) at [c0000000bb0e7960] + pc: c0000000003cb50c: .gen_pool_destroy+0xac/0x110 + lr: c0000000003cb4fc: .gen_pool_destroy+0x9c/0x110 + sp: c0000000bb0e7be0 + msr: 8000000000029032 + current = 0xc0000000bb0e0000 + paca = 0xc000000006d30e00 softe: 0 irq_happened: 0x01 + pid = 13044, comm = rmmod + kernel BUG at lib/genalloc.c:243! + [c0000000bb0e7ca0] d000000004b00020 .foo_exit+0x20/0x38 [foo] + [c0000000bb0e7d20] c0000000000dff98 .SyS_delete_module+0x1a8/0x290 + [c0000000bb0e7e30] c0000000000097d4 syscall_exit+0x0/0x94 + --- Exception: c00 (System Call) at 000000800753d1a0 + SP (fffd0b0e640) is in userspace + +Signed-off-by: Thadeu Lima de Souza Cascardo +Cc: Paul Gortmaker +Cc: Benjamin Gaignard +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/genalloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -176,7 +176,7 @@ int gen_pool_add_virt(struct gen_pool *p + struct gen_pool_chunk *chunk; + int nbits = size >> pool->min_alloc_order; + int nbytes = sizeof(struct gen_pool_chunk) + +- (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE; ++ BITS_TO_LONGS(nbits) * sizeof(long); + + chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid); + if (unlikely(chunk == NULL)) diff --git a/queue-3.4/series b/queue-3.4/series new file mode 100644 index 00000000000..c69d8f99dd4 --- /dev/null +++ b/queue-3.4/series @@ -0,0 +1,8 @@ +drm-radeon-add-some-new-si-pci-ids.patch +drm-radeon-add-error-output-if-vm-cs-fails-on-cayman.patch +alsa-hda-add-dock-support-for-thinkpad-t430.patch +gen_init_cpio-avoid-stack-overflow-when-expanding.patch +fs-compat_ioctl.c-video_set_spu_palette-missing-error-check.patch +drivers-rtc-rtc-imxdi.c-add-missing-spin-lock-initialization.patch +genalloc-stop-crashing-the-system-when-destroying-a-pool.patch +arm-7559-1-smp-switch-away-from-the-idmap-before-updating-init_mm.mm_count.patch