--- /dev/null
+From 387870f2d6d679746020fa8e25ef786ff338dc98 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 7 Nov 2012 15:37:07 +0100
+Subject: mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream.
+
+dmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag,
+regardless the flags provided by the caller. This causes excessive
+pruning of emergency memory pools without any good reason. Additionaly,
+on ARM architecture any driver which is using dmapools will sooner or
+later trigger the following error:
+"ERROR: 256 KiB atomic DMA coherent pool is too small!
+Please increase it with coherent_pool= kernel parameter!".
+Increasing the coherent pool size usually doesn't help much and only
+delays such error, because all GFP_ATOMIC DMA allocations are always
+served from the special, very limited memory pool.
+
+This patch changes the dmapool code to correctly use gfp flags provided
+by the dmapool caller.
+
+Reported-by: Soeren Moch <smoch@web.de>
+Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Soeren Moch <smoch@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/dmapool.c | 31 +++++++------------------------
+ 1 file changed, 7 insertions(+), 24 deletions(-)
+
+--- a/mm/dmapool.c
++++ b/mm/dmapool.c
+@@ -49,7 +49,6 @@ struct dma_pool { /* the pool */
+ size_t allocation;
+ size_t boundary;
+ char name[32];
+- wait_queue_head_t waitq;
+ struct list_head pools;
+ };
+
+@@ -61,8 +60,6 @@ struct dma_page { /* cacheable header f
+ unsigned int offset;
+ };
+
+-#define POOL_TIMEOUT_JIFFIES ((100 /* msec */ * HZ) / 1000)
+-
+ static DEFINE_MUTEX(pools_lock);
+
+ static ssize_t
+@@ -171,7 +168,6 @@ struct dma_pool *dma_pool_create(const c
+ retval->size = size;
+ retval->boundary = boundary;
+ retval->allocation = allocation;
+- init_waitqueue_head(&retval->waitq);
+
+ if (dev) {
+ int ret;
+@@ -226,7 +222,6 @@ static struct dma_page *pool_alloc_page(
+ memset(page->vaddr, POOL_POISON_FREED, pool->allocation);
+ #endif
+ pool_initialise_page(pool, page);
+- list_add(&page->page_list, &pool->page_list);
+ page->in_use = 0;
+ page->offset = 0;
+ } else {
+@@ -314,30 +309,21 @@ void *dma_pool_alloc(struct dma_pool *po
+ might_sleep_if(mem_flags & __GFP_WAIT);
+
+ spin_lock_irqsave(&pool->lock, flags);
+- restart:
+ list_for_each_entry(page, &pool->page_list, page_list) {
+ if (page->offset < pool->allocation)
+ goto ready;
+ }
+- page = pool_alloc_page(pool, GFP_ATOMIC);
+- if (!page) {
+- if (mem_flags & __GFP_WAIT) {
+- DECLARE_WAITQUEUE(wait, current);
+
+- __set_current_state(TASK_UNINTERRUPTIBLE);
+- __add_wait_queue(&pool->waitq, &wait);
+- spin_unlock_irqrestore(&pool->lock, flags);
++ /* pool_alloc_page() might sleep, so temporarily drop &pool->lock */
++ spin_unlock_irqrestore(&pool->lock, flags);
+
+- schedule_timeout(POOL_TIMEOUT_JIFFIES);
++ page = pool_alloc_page(pool, mem_flags);
++ if (!page)
++ return NULL;
+
+- spin_lock_irqsave(&pool->lock, flags);
+- __remove_wait_queue(&pool->waitq, &wait);
+- goto restart;
+- }
+- retval = NULL;
+- goto done;
+- }
++ spin_lock_irqsave(&pool->lock, flags);
+
++ list_add(&page->page_list, &pool->page_list);
+ ready:
+ page->in_use++;
+ offset = page->offset;
+@@ -347,7 +333,6 @@ void *dma_pool_alloc(struct dma_pool *po
+ #ifdef DMAPOOL_DEBUG
+ memset(retval, POOL_POISON_ALLOCATED, pool->size);
+ #endif
+- done:
+ spin_unlock_irqrestore(&pool->lock, flags);
+ return retval;
+ }
+@@ -434,8 +419,6 @@ void dma_pool_free(struct dma_pool *pool
+ page->in_use--;
+ *(int *)vaddr = page->offset;
+ page->offset = offset;
+- if (waitqueue_active(&pool->waitq))
+- wake_up_locked(&pool->waitq);
+ /*
+ * Resist a temptation to do
+ * if (!is_page_busy(page)) pool_free_page(pool, page);
arm-7566-1-vfp-fix-save-and-restore-when-running-on-pre-vfpv3-and-config_vfpv3-set.patch
powerpc-ptrace-fix-build-with-gcc-4.6.patch
workqueue-convert-bug_on-s-in-__queue_delayed_work-to-warn_on_once-s.patch
+mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
+x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
+telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
+tmpfs-fix-shared-mempolicy-leak.patch
--- /dev/null
+From dan.carpenter@oracle.com Tue Dec 11 13:26:39 2012
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2012 22:05:12 +0300
+Subject: telephony: ijx: buffer overflow in ixj_write_cid()
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-ID: <20121203190512.GA9273@elgon.mountain>
+
+[Not needed in 3.8 or newer as this driver is removed there. - gregkh]
+
+We get this from user space and nothing has been done to ensure that
+these strings are NUL terminated.
+
+Reported-by: Chen Gang <gang.chen@asianux.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/telephony/ixj.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/telephony/ixj.c
++++ b/drivers/telephony/ixj.c
+@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
+
+ ixj_fsk_alloc(j);
+
+- strcpy(sdmf1, j->cid_send.month);
+- strcat(sdmf1, j->cid_send.day);
+- strcat(sdmf1, j->cid_send.hour);
+- strcat(sdmf1, j->cid_send.min);
+- strcpy(sdmf2, j->cid_send.number);
+- strcpy(sdmf3, j->cid_send.name);
++ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+
+ len1 = strlen(sdmf1);
+ len2 = strlen(sdmf2);
+@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
+ ixj_pre_cid(j);
+ }
+ j->flags.cidcw_ack = 0;
+- strcpy(sdmf1, j->cid_send.month);
+- strcat(sdmf1, j->cid_send.day);
+- strcat(sdmf1, j->cid_send.hour);
+- strcat(sdmf1, j->cid_send.min);
+- strcpy(sdmf2, j->cid_send.number);
+- strcpy(sdmf3, j->cid_send.name);
++ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+
+ len1 = strlen(sdmf1);
+ len2 = strlen(sdmf2);
--- /dev/null
+From 18a2f371f5edf41810f6469cb9be39931ef9deb9 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Wed, 5 Dec 2012 14:01:41 -0800
+Subject: tmpfs: fix shared mempolicy leak
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit 18a2f371f5edf41810f6469cb9be39931ef9deb9 upstream.
+
+This fixes a regression in 3.7-rc, which has since gone into stable.
+
+Commit 00442ad04a5e ("mempolicy: fix a memory corruption by refcount
+imbalance in alloc_pages_vma()") changed get_vma_policy() to raise the
+refcount on a shmem shared mempolicy; whereas shmem_alloc_page() went
+on expecting alloc_page_vma() to drop the refcount it had acquired.
+This deserves a rework: but for now fix the leak in shmem_alloc_page().
+
+Hugh: shmem_swapin() did not need a fix, but surely it's clearer to use
+the same refcounting there as in shmem_alloc_page(), delete its onstack
+mempolicy, and the strange mpol_cond_copy() and __mpol_cond_copy() -
+those were invented to let swapin_readahead() make an unknown number of
+calls to alloc_pages_vma() with one mempolicy; but since 00442ad04a5e,
+alloc_pages_vma() has kept refcount in balance, so now no problem.
+
+Reported-and-tested-by: Tommi Rantala <tt.rantala@gmail.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ include/linux/mempolicy.h | 16 ----------------
+ mm/mempolicy.c | 22 ----------------------
+ mm/shmem.c | 22 +++++++++++++---------
+ 3 files changed, 13 insertions(+), 47 deletions(-)
+
+--- a/include/linux/mempolicy.h
++++ b/include/linux/mempolicy.h
+@@ -137,16 +137,6 @@ static inline void mpol_cond_put(struct
+ __mpol_put(pol);
+ }
+
+-extern struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol);
+-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol)
+-{
+- if (!frompol)
+- return frompol;
+- return __mpol_cond_copy(tompol, frompol);
+-}
+-
+ extern struct mempolicy *__mpol_dup(struct mempolicy *pol);
+ static inline struct mempolicy *mpol_dup(struct mempolicy *pol)
+ {
+@@ -270,12 +260,6 @@ static inline void mpol_cond_put(struct
+ {
+ }
+
+-static inline struct mempolicy *mpol_cond_copy(struct mempolicy *to,
+- struct mempolicy *from)
+-{
+- return from;
+-}
+-
+ static inline void mpol_get(struct mempolicy *pol)
+ {
+ }
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1973,28 +1973,6 @@ struct mempolicy *__mpol_dup(struct memp
+ return new;
+ }
+
+-/*
+- * If *frompol needs [has] an extra ref, copy *frompol to *tompol ,
+- * eliminate the * MPOL_F_* flags that require conditional ref and
+- * [NOTE!!!] drop the extra ref. Not safe to reference *frompol directly
+- * after return. Use the returned value.
+- *
+- * Allows use of a mempolicy for, e.g., multiple allocations with a single
+- * policy lookup, even if the policy needs/has extra ref on lookup.
+- * shmem_readahead needs this.
+- */
+-struct mempolicy *__mpol_cond_copy(struct mempolicy *tompol,
+- struct mempolicy *frompol)
+-{
+- if (!mpol_needs_cond_ref(frompol))
+- return frompol;
+-
+- *tompol = *frompol;
+- tompol->flags &= ~MPOL_F_SHARED; /* copy doesn't need unref */
+- __mpol_put(frompol);
+- return tompol;
+-}
+-
+ /* Slow path of a mempolicy comparison */
+ int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
+ {
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1168,19 +1168,20 @@ static struct mempolicy *shmem_get_sbmpo
+ static struct page *shmem_swapin(swp_entry_t entry, gfp_t gfp,
+ struct shmem_inode_info *info, unsigned long idx)
+ {
+- struct mempolicy mpol, *spol;
+ struct vm_area_struct pvma;
+ struct page *page;
+
+- spol = mpol_cond_copy(&mpol,
+- mpol_shared_policy_lookup(&info->policy, idx));
+-
+ /* Create a pseudo vma that just contains the policy */
+ pvma.vm_start = 0;
+ pvma.vm_pgoff = idx;
+ pvma.vm_ops = NULL;
+- pvma.vm_policy = spol;
++ pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, idx);
++
+ page = swapin_readahead(entry, gfp, &pvma, 0);
++
++ /* Drop reference taken by mpol_shared_policy_lookup() */
++ mpol_cond_put(pvma.vm_policy);
++
+ return page;
+ }
+
+@@ -1188,6 +1189,7 @@ static struct page *shmem_alloc_page(gfp
+ struct shmem_inode_info *info, unsigned long idx)
+ {
+ struct vm_area_struct pvma;
++ struct page *page;
+
+ /* Create a pseudo vma that just contains the policy */
+ pvma.vm_start = 0;
+@@ -1195,10 +1197,12 @@ static struct page *shmem_alloc_page(gfp
+ pvma.vm_ops = NULL;
+ pvma.vm_policy = mpol_shared_policy_lookup(&info->policy, idx);
+
+- /*
+- * alloc_page_vma() will drop the shared policy reference
+- */
+- return alloc_page_vma(gfp, &pvma, 0);
++ page = alloc_page_vma(gfp, &pvma, 0);
++
++ /* Drop reference taken by mpol_shared_policy_lookup() */
++ mpol_cond_put(pvma.vm_policy);
++
++ return page;
+ }
+ #else /* !CONFIG_NUMA */
+ #ifdef CONFIG_TMPFS
--- /dev/null
+From 22e32f4f57778ebc6e17812fa3008361c05d64f9 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Date: Wed, 5 Dec 2012 06:12:42 -0500
+Subject: x86,AMD: Power driver support for AMD's family 16h processors
+
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+
+commit 22e32f4f57778ebc6e17812fa3008361c05d64f9 upstream.
+
+Add family 16h PCI ID to AMD's power driver to allow it report
+power consumption on these processors.
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/fam15h_power.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -31,6 +31,9 @@ MODULE_DESCRIPTION("AMD Family 15h CPU p
+ MODULE_AUTHOR("Andreas Herrmann <andreas.herrmann3@amd.com>");
+ MODULE_LICENSE("GPL");
+
++/* Family 16h Northbridge's function 4 PCI ID */
++#define PCI_DEVICE_ID_AMD_16H_NB_F4 0x1534
++
+ /* D18F3 */
+ #define REG_NORTHBRIDGE_CAP 0xe8
+
+@@ -256,6 +259,7 @@ static void __devexit fam15h_power_remov
+
+ static DEFINE_PCI_DEVICE_TABLE(fam15h_power_id_table) = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);
projects / thirdparty / kernel / stable-queue.git / commitdiff
