3.4-stable patches

added patches:
	mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
	telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
	x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch

diff --git a/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch b/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
new file mode 100644 (file)
index 0000000..5867b9a
--- /dev/null
+++ b/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
@@ -0,0 +1,124 @@
+From 387870f2d6d679746020fa8e25ef786ff338dc98 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Wed, 7 Nov 2012 15:37:07 +0100
+Subject: mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream.
+
+dmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag,
+regardless the flags provided by the caller. This causes excessive
+pruning of emergency memory pools without any good reason. Additionaly,
+on ARM architecture any driver which is using dmapools will sooner or
+later  trigger the following error:
+"ERROR: 256 KiB atomic DMA coherent pool is too small!
+Please increase it with coherent_pool= kernel parameter!".
+Increasing the coherent pool size usually doesn't help much and only
+delays such error, because all GFP_ATOMIC DMA allocations are always
+served from the special, very limited memory pool.
+
+This patch changes the dmapool code to correctly use gfp flags provided
+by the dmapool caller.
+
+Reported-by: Soeren Moch <smoch@web.de>
+Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Soeren Moch <smoch@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/dmapool.c |   31 +++++++------------------------
+ 1 file changed, 7 insertions(+), 24 deletions(-)
+
+--- a/mm/dmapool.c
++++ b/mm/dmapool.c
+@@ -50,7 +50,6 @@ struct dma_pool {            /* the pool */
+       size_t allocation;
+       size_t boundary;
+       char name[32];
+-      wait_queue_head_t waitq;
+       struct list_head pools;
+ };
+ 
+@@ -62,8 +61,6 @@ struct dma_page {            /* cacheable header f
+       unsigned int offset;
+ };
+ 
+-#define       POOL_TIMEOUT_JIFFIES    ((100 /* msec */ * HZ) / 1000)
+-
+ static DEFINE_MUTEX(pools_lock);
+ 
+ static ssize_t
+@@ -172,7 +169,6 @@ struct dma_pool *dma_pool_create(const c
+       retval->size = size;
+       retval->boundary = boundary;
+       retval->allocation = allocation;
+-      init_waitqueue_head(&retval->waitq);
+ 
+       if (dev) {
+               int ret;
+@@ -227,7 +223,6 @@ static struct dma_page *pool_alloc_page(
+               memset(page->vaddr, POOL_POISON_FREED, pool->allocation);
+ #endif
+               pool_initialise_page(pool, page);
+-              list_add(&page->page_list, &pool->page_list);
+               page->in_use = 0;
+               page->offset = 0;
+       } else {
+@@ -315,30 +310,21 @@ void *dma_pool_alloc(struct dma_pool *po
+       might_sleep_if(mem_flags & __GFP_WAIT);
+ 
+       spin_lock_irqsave(&pool->lock, flags);
+- restart:
+       list_for_each_entry(page, &pool->page_list, page_list) {
+               if (page->offset < pool->allocation)
+                       goto ready;
+       }
+-      page = pool_alloc_page(pool, GFP_ATOMIC);
+-      if (!page) {
+-              if (mem_flags & __GFP_WAIT) {
+-                      DECLARE_WAITQUEUE(wait, current);
+ 
+-                      __set_current_state(TASK_UNINTERRUPTIBLE);
+-                      __add_wait_queue(&pool->waitq, &wait);
+-                      spin_unlock_irqrestore(&pool->lock, flags);
++      /* pool_alloc_page() might sleep, so temporarily drop &pool->lock */
++      spin_unlock_irqrestore(&pool->lock, flags);
+ 
+-                      schedule_timeout(POOL_TIMEOUT_JIFFIES);
++      page = pool_alloc_page(pool, mem_flags);
++      if (!page)
++              return NULL;
+ 
+-                      spin_lock_irqsave(&pool->lock, flags);
+-                      __remove_wait_queue(&pool->waitq, &wait);
+-                      goto restart;
+-              }
+-              retval = NULL;
+-              goto done;
+-      }
++      spin_lock_irqsave(&pool->lock, flags);
+ 
++      list_add(&page->page_list, &pool->page_list);
+  ready:
+       page->in_use++;
+       offset = page->offset;
+@@ -348,7 +334,6 @@ void *dma_pool_alloc(struct dma_pool *po
+ #ifdef        DMAPOOL_DEBUG
+       memset(retval, POOL_POISON_ALLOCATED, pool->size);
+ #endif
+- done:
+       spin_unlock_irqrestore(&pool->lock, flags);
+       return retval;
+ }
+@@ -435,8 +420,6 @@ void dma_pool_free(struct dma_pool *pool
+       page->in_use--;
+       *(int *)vaddr = page->offset;
+       page->offset = offset;
+-      if (waitqueue_active(&pool->waitq))
+-              wake_up_locked(&pool->waitq);
+       /*
+        * Resist a temptation to do
+        *    if (!is_page_busy(page)) pool_free_page(pool, page);

diff --git a/queue-3.4/series b/queue-3.4/series
index 149c3460febc0da6c242348b7497668a559a85e2..6fe6325aea2b112d74cd9c174089096a1678e883 100644 (file)
--- a/queue-3.4/series
+++ b/queue-3.4/series
@@ -6,3 +6,6 @@ asoc-dmaengine-correct-makefile-when-sound-is-built-as-module.patch
 workqueue-convert-bug_on-s-in-__queue_delayed_work-to-warn_on_once-s.patch
 drm-i915-do-not-ignore-edp-bpc-settings-from-vbt.patch
 drm-i915-do-not-default-to-18-bpp-for-edp-if-missing-from-vbt.patch
+mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch
+x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
+telephony-ijx-buffer-overflow-in-ixj_write_cid.patch

diff --git a/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch b/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
new file mode 100644 (file)
index 0000000..13ad3f5
--- /dev/null
+++ b/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch
@@ -0,0 +1,60 @@
+From dan.carpenter@oracle.com  Tue Dec 11 13:26:39 2012
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 3 Dec 2012 22:05:12 +0300
+Subject: telephony: ijx: buffer overflow in ixj_write_cid()
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Message-ID: <20121203190512.GA9273@elgon.mountain>
+
+[Not needed in 3.8 or newer as this driver is removed there. - gregkh]
+
+We get this from user space and nothing has been done to ensure that
+these strings are NUL terminated.
+
+Reported-by: Chen Gang <gang.chen@asianux.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/telephony/ixj.c |   24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/staging/telephony/ixj.c
++++ b/drivers/staging/telephony/ixj.c
+@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
+ 
+       ixj_fsk_alloc(j);
+ 
+-      strcpy(sdmf1, j->cid_send.month);
+-      strcat(sdmf1, j->cid_send.day);
+-      strcat(sdmf1, j->cid_send.hour);
+-      strcat(sdmf1, j->cid_send.min);
+-      strcpy(sdmf2, j->cid_send.number);
+-      strcpy(sdmf3, j->cid_send.name);
++      strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++      strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++      strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+ 
+       len1 = strlen(sdmf1);
+       len2 = strlen(sdmf2);
+@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j)
+               ixj_pre_cid(j);
+       }
+       j->flags.cidcw_ack = 0;
+-      strcpy(sdmf1, j->cid_send.month);
+-      strcat(sdmf1, j->cid_send.day);
+-      strcat(sdmf1, j->cid_send.hour);
+-      strcat(sdmf1, j->cid_send.min);
+-      strcpy(sdmf2, j->cid_send.number);
+-      strcpy(sdmf3, j->cid_send.name);
++      strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++      strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++      strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++      strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
+ 
+       len1 = strlen(sdmf1);
+       len2 = strlen(sdmf2);

diff --git a/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch b/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
new file mode 100644 (file)
index 0000000..b69bdb7
--- /dev/null
+++ b/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch
@@ -0,0 +1,40 @@
+From 22e32f4f57778ebc6e17812fa3008361c05d64f9 Mon Sep 17 00:00:00 2001
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Date: Wed, 5 Dec 2012 06:12:42 -0500
+Subject: x86,AMD: Power driver support for AMD's family 16h processors
+
+From: Boris Ostrovsky <boris.ostrovsky@amd.com>
+
+commit 22e32f4f57778ebc6e17812fa3008361c05d64f9 upstream.
+
+Add family 16h PCI ID to AMD's power driver to allow it report
+power consumption on these processors.
+
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@amd.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/fam15h_power.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/hwmon/fam15h_power.c
++++ b/drivers/hwmon/fam15h_power.c
+@@ -31,6 +31,9 @@ MODULE_DESCRIPTION("AMD Family 15h CPU p
+ MODULE_AUTHOR("Andreas Herrmann <andreas.herrmann3@amd.com>");
+ MODULE_LICENSE("GPL");
+ 
++/* Family 16h Northbridge's function 4 PCI ID */
++#define PCI_DEVICE_ID_AMD_16H_NB_F4   0x1534
++
+ /* D18F3 */
+ #define REG_NORTHBRIDGE_CAP           0xe8
+ 
+@@ -256,6 +259,7 @@ static void __devexit fam15h_power_remov
+ 
+ static DEFINE_PCI_DEVICE_TABLE(fam15h_power_id_table) = {
+       { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
++      { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
+       {}
+ };
+ MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);