From aade23ad69937c9f8c52af7118b7d2fc19e71be4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 25 Jan 2010 16:06:15 -0800 Subject: [PATCH] add 1 and remove 1 patch from the .27 queue --- queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch | 62 +++++++++++++++++++ queue-2.6.27/series | 2 +- ...g-cleanup-in-case-of-an-error-in-tso.patch | 40 ------------ 3 files changed, 63 insertions(+), 41 deletions(-) create mode 100644 queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch delete mode 100644 queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch diff --git a/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch b/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch new file mode 100644 index 00000000000..aadd855f84c --- /dev/null +++ b/queue-2.6.27/ipc-ns-fix-memory-leak-idr.patch @@ -0,0 +1,62 @@ +From 7d6feeb287c61aafa88f06345387b1188edf4b86 Mon Sep 17 00:00:00 2001 +From: Serge E. Hallyn +Date: Tue, 15 Dec 2009 16:47:27 -0800 +Subject: ipc ns: fix memory leak (idr) + +From: Serge E. Hallyn + +commit 7d6feeb287c61aafa88f06345387b1188edf4b86 upstream. + +We have apparently had a memory leak since +7ca7e564e049d8b350ec9d958ff25eaa24226352 "ipc: store ipcs into IDRs" in +2007. The idr of which 3 exist for each ipc namespace is never freed. + +This patch simply frees them when the ipcns is freed. I don't believe any +idr_remove() are done from rcu (and could therefore be delayed until after +this idr_destroy()), so the patch should be safe. Some quick testing +showed no harm, and the memory leak fixed. + +Caught by kmemleak. + +Signed-off-by: Serge E. Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Acked-by: Nick Piggin +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/msg.c | 1 + + ipc/sem.c | 1 + + ipc/shm.c | 1 + + 3 files changed, 3 insertions(+) + +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -125,6 +125,7 @@ void msg_init_ns(struct ipc_namespace *n + void msg_exit_ns(struct ipc_namespace *ns) + { + free_ipcs(ns, &msg_ids(ns), freeque); ++ idr_destroy(&ns->ids[IPC_MSG_IDS].ipcs_idr); + } + #endif + +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -129,6 +129,7 @@ void sem_init_ns(struct ipc_namespace *n + void sem_exit_ns(struct ipc_namespace *ns) + { + free_ipcs(ns, &sem_ids(ns), freeary); ++ idr_destroy(&ns->ids[IPC_SEM_IDS].ipcs_idr); + } + #endif + +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -100,6 +100,7 @@ static void do_shm_rmid(struct ipc_names + void shm_exit_ns(struct ipc_namespace *ns) + { + free_ipcs(ns, &shm_ids(ns), do_shm_rmid); ++ idr_destroy(&ns->ids[IPC_SHM_IDS].ipcs_idr); + } + #endif + diff --git a/queue-2.6.27/series b/queue-2.6.27/series index b78891860cd..57ff925b37e 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -7,4 +7,4 @@ tty-fix-race-in-tty_fasync.patch usb-add-missing-delay-during-remote-wakeup.patch usb-ehci-fix-handling-of-unusual-interrupt-intervals.patch usb-ehci-uhci-fix-race-between-root-hub-suspend-and-port-resume.patch -sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch +ipc-ns-fix-memory-leak-idr.patch diff --git a/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch b/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch deleted file mode 100644 index 5a73f041a71..00000000000 --- a/queue-2.6.27/sfc-fix-dma-mapping-cleanup-in-case-of-an-error-in-tso.patch +++ /dev/null @@ -1,40 +0,0 @@ -From a7ebd27a13757248863cd61e541af7fa9e7727ee Mon Sep 17 00:00:00 2001 -From: Neil Turton -Date: Wed, 23 Dec 2009 13:47:13 +0000 -Subject: sfc: Fix DMA mapping cleanup in case of an error in TSO - -From: Neil Turton - -commit a7ebd27a13757248863cd61e541af7fa9e7727ee upstream. - -We need buffer->len to remain valid to work out the correct address to -be unmapped. We therefore need to clear buffer->len after the unmap -operation. - -Signed-off-by: Ben Hutchings -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/net/sfc/tx.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/net/sfc/tx.c -+++ b/drivers/net/sfc/tx.c -@@ -813,14 +813,14 @@ static void efx_enqueue_unwind(struct ef - tx_queue->efx->type->txd_ring_mask]; - efx_tsoh_free(tx_queue, buffer); - EFX_BUG_ON_PARANOID(buffer->skb); -- buffer->len = 0; -- buffer->continuation = 1; - if (buffer->unmap_len) { - pci_unmap_page(tx_queue->efx->pci_dev, - buffer->unmap_addr, - buffer->unmap_len, PCI_DMA_TODEVICE); - buffer->unmap_len = 0; - } -+ buffer->len = 0; -+ buffer->continuation = 1; - } - } - -- 2.47.3