From: Greg Kroah-Hartman Date: Wed, 17 Oct 2012 21:29:09 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.47~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=af62dfc84f366345748f7f70d8c2d207583b009b;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch --- diff --git a/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch b/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch new file mode 100644 index 00000000000..4320c422768 --- /dev/null +++ b/queue-3.0/drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch @@ -0,0 +1,44 @@ +From 082918471139b07964967cfe5f70230909c82ae1 Mon Sep 17 00:00:00 2001 +From: Egbert Eich +Date: Mon, 15 Oct 2012 08:21:39 +0200 +Subject: drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy(). + +From: Egbert Eich + +commit 082918471139b07964967cfe5f70230909c82ae1 upstream. + +radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[] +to destroy each of them. +radeon_ext_tmds_enc_destroy() however also has code to destroy it's +associated I2C bus rec which has been obtained by radeon_i2c_lookup() +and is therefore also in the i2c_bus[] list. +This causes a double free resulting in a kernel panic when unloading +the radeon driver. +Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this +problem. + +agd5f: fix compiler warning + +Signed-off-by: Egbert Eich +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_legacy_encoders.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c +@@ -973,11 +973,7 @@ static void radeon_legacy_tmds_ext_mode_ + static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder) + { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +- struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv; +- if (tmds) { +- if (tmds->i2c_bus) +- radeon_i2c_destroy(tmds->i2c_bus); +- } ++ /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */ + kfree(radeon_encoder->enc_priv); + drm_encoder_cleanup(encoder); + kfree(radeon_encoder); diff --git a/queue-3.0/series b/queue-3.0/series index a45cd844f88..e172094fefd 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -27,3 +27,4 @@ netfilter-nf_ct_expect-fix-possible-access-to-uninitialized-timer.patch netfilter-limit-hashlimit-avoid-duplicated-inline.patch netfilter-xt_limit-have-r-cost-0-case-work.patch add-cdc-acm-support-for-the-cx93010-2x-ucmxx-usb-modem.patch +drm-radeon-don-t-destroy-i2c-bus-rec-in-radeon_ext_tmds_enc_destroy.patch