--- /dev/null
+From 6ff2d39b91aec3dcae951afa982059e3dd9b49dc Mon Sep 17 00:00:00 2001
+From: Manfred Spraul <manfred@colorfullife.com>
+Date: Mon, 1 Dec 2008 13:14:02 -0800
+Subject: lib/idr.c: fix rcu related race with idr_find
+
+From: Manfred Spraul <manfred@colorfullife.com>
+
+commit 6ff2d39b91aec3dcae951afa982059e3dd9b49dc upstream.
+
+2nd part of the fixes needed for
+http://bugzilla.kernel.org/show_bug.cgi?id=11796.
+
+When the idr tree is either grown or shrunk, then the update to the number
+of layers and the top pointer were not atomic. This race caused crashes.
+
+The attached patch fixes that by replicating the layers counter in each
+layer, thus idr_find doesn't need idp->layers anymore.
+
+Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
+Cc: Clement Calmels <cboulte@gmail.com>
+Cc: Nadia Derbey <Nadia.Derbey@bull.net>
+Cc: Pierre Peiffer <peifferp@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/idr.h | 3 ++-
+ lib/idr.c | 14 ++++++++++++--
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -52,13 +52,14 @@ struct idr_layer {
+ unsigned long bitmap; /* A zero bit means "space here" */
+ struct idr_layer *ary[1<<IDR_BITS];
+ int count; /* When zero, we can release it */
++ int layer; /* distance from leaf */
+ struct rcu_head rcu_head;
+ };
+
+ struct idr {
+ struct idr_layer *top;
+ struct idr_layer *id_free;
+- int layers;
++ int layers; /* only valid without concurrent changes */
+ int id_free_cnt;
+ spinlock_t lock;
+ };
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -185,6 +185,7 @@ static int sub_alloc(struct idr *idp, in
+ new = get_from_free_list(idp);
+ if (!new)
+ return -1;
++ new->layer = l-1;
+ rcu_assign_pointer(p->ary[m], new);
+ p->count++;
+ }
+@@ -210,6 +211,7 @@ build_up:
+ if (unlikely(!p)) {
+ if (!(p = get_from_free_list(idp)))
+ return -1;
++ p->layer = 0;
+ layers = 1;
+ }
+ /*
+@@ -237,6 +239,7 @@ build_up:
+ }
+ new->ary[0] = p;
+ new->count = 1;
++ new->layer = layers-1;
+ if (p->bitmap == IDR_FULL)
+ __set_bit(0, &new->bitmap);
+ p = new;
+@@ -493,17 +496,21 @@ void *idr_find(struct idr *idp, int id)
+ int n;
+ struct idr_layer *p;
+
+- n = idp->layers * IDR_BITS;
+ p = rcu_dereference(idp->top);
++ if (!p)
++ return NULL;
++ n = (p->layer+1) * IDR_BITS;
+
+ /* Mask off upper bits we don't use for the search. */
+ id &= MAX_ID_MASK;
+
+ if (id >= (1 << n))
+ return NULL;
++ BUG_ON(n == 0);
+
+ while (n > 0 && p) {
+ n -= IDR_BITS;
++ BUG_ON(n != p->layer*IDR_BITS);
+ p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]);
+ }
+ return((void *)p);
+@@ -582,8 +589,11 @@ void *idr_replace(struct idr *idp, void
+ int n;
+ struct idr_layer *p, *old_p;
+
+- n = idp->layers * IDR_BITS;
+ p = idp->top;
++ if (!p)
++ return ERR_PTR(-EINVAL);
++
++ n = (p->layer+1) * IDR_BITS;
+
+ id &= MAX_ID_MASK;
+
--- /dev/null
+From 36be47d6d8d98f54b6c4f891e9f54fb2bf554584 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 1 Dec 2008 13:13:49 -0800
+Subject: parport_serial: fix array overflow
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 36be47d6d8d98f54b6c4f891e9f54fb2bf554584 upstream.
+
+The netmos_9xx5_combo type assumes that PCI SSID provides always the
+correct value for the number of parallel and serial ports, but there are
+indeed broken devices with wrong numbers, which may result in Oops.
+
+This patch simply adds the check of the array range.
+
+Reference: Novell bnc#447067
+ https://bugzilla.novell.com/show_bug.cgi?id=447067
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/parport/parport_serial.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/parport/parport_serial.c
++++ b/drivers/parport/parport_serial.c
+@@ -70,6 +70,8 @@ static int __devinit netmos_parallel_ini
+ * parallel ports and <S> is the number of serial ports.
+ */
+ card->numports = (dev->subsystem_device & 0xf0) >> 4;
++ if (card->numports > ARRAY_SIZE(card->addr))
++ card->numports = ARRAY_SIZE(card->addr);
+ return 0;
+ }
+
ia64-fix-boot-panic-caused-by-offline-cpus.patch
v4l-dvb-add-some-missing-compat32-ioctls.patch
input-atkbd-add-keymap-quirk-for-inventec-symphony-systems.patch
+lib-idr.c-fix-rcu-related-race-with-idr_find.patch
+parport_serial-fix-array-overflow.patch
+x86-more-general-identifier-for-phoenix-bios.patch
+x86-always-define-declare_pci_unmap-macros.patch
--- /dev/null
+From b627c8b17ccacba38c975bc0f69a49fc4e5261c9 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <joerg.roedel@amd.com>
+Date: Thu, 20 Nov 2008 20:49:56 +0100
+Subject: x86: always define DECLARE_PCI_UNMAP* macros
+
+From: Joerg Roedel <joerg.roedel@amd.com>
+
+commit b627c8b17ccacba38c975bc0f69a49fc4e5261c9 upstream.
+
+Impact: fix boot crash on AMD IOMMU if CONFIG_GART_IOMMU is off
+
+Currently these macros evaluate to a no-op except the kernel is compiled
+with GART or Calgary support. But we also need these macros when we have
+SWIOTLB, VT-d or AMD IOMMU in the kernel. Since we always compile at
+least with SWIOTLB we can define these macros always.
+
+This patch is also for stable backport for the same reason the SWIOTLB
+default selection patch is.
+
+Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/asm-x86/pci_64.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- a/include/asm-x86/pci_64.h
++++ b/include/asm-x86/pci_64.h
+@@ -34,8 +34,6 @@ extern void pci_iommu_alloc(void);
+ */
+ #define PCI_DMA_BUS_IS_PHYS (dma_ops->is_phys)
+
+-#if defined(CONFIG_GART_IOMMU) || defined(CONFIG_CALGARY_IOMMU)
+-
+ #define DECLARE_PCI_UNMAP_ADDR(ADDR_NAME) \
+ dma_addr_t ADDR_NAME;
+ #define DECLARE_PCI_UNMAP_LEN(LEN_NAME) \
+@@ -49,18 +47,6 @@ extern void pci_iommu_alloc(void);
+ #define pci_unmap_len_set(PTR, LEN_NAME, VAL) \
+ (((PTR)->LEN_NAME) = (VAL))
+
+-#else
+-/* No IOMMU */
+-
+-#define DECLARE_PCI_UNMAP_ADDR(ADDR_NAME)
+-#define DECLARE_PCI_UNMAP_LEN(LEN_NAME)
+-#define pci_unmap_addr(PTR, ADDR_NAME) (0)
+-#define pci_unmap_addr_set(PTR, ADDR_NAME, VAL) do { } while (0)
+-#define pci_unmap_len(PTR, LEN_NAME) (0)
+-#define pci_unmap_len_set(PTR, LEN_NAME, VAL) do { } while (0)
+-
+-#endif
+-
+ #endif /* __KERNEL__ */
+
+ #endif /* __x8664_PCI_H */
--- /dev/null
+From 0af40a4b1050c050e62eb1dc30b82d5ab22bf221 Mon Sep 17 00:00:00 2001
+From: Philipp Kohlbecher <xt28@gmx.de>
+Date: Sun, 16 Nov 2008 12:11:01 +0100
+Subject: x86: more general identifier for Phoenix BIOS
+
+From: Philipp Kohlbecher <xt28@gmx.de>
+
+commit 0af40a4b1050c050e62eb1dc30b82d5ab22bf221 upstream.
+
+Impact: widen the reach of the low-memory-protect DMI quirk
+
+Phoenix BIOSes variously identify their vendor as "Phoenix Technologies,
+LTD" or "Phoenix Technologies LTD" (without the comma.)
+
+This patch makes the identification string in the bad_bios_dmi_table
+more general (following a suggestion by Ingo Molnar), so that both
+versions are handled.
+
+Again, the patched file compiles cleanly and the patch has been tested
+successfully on my machine.
+
+Signed-off-by: Philipp Kohlbecher <xt28@gmx.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/setup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/setup.c
++++ b/arch/x86/kernel/setup.c
+@@ -604,7 +604,7 @@ static struct dmi_system_id __initdata b
+ .callback = dmi_low_memory_corruption,
+ .ident = "Phoenix BIOS",
+ .matches = {
+- DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"),
+ },
+ },
+ #endif
projects / thirdparty / kernel / stable-queue.git / commitdiff
