--- /dev/null
+From 44fef22416886a04d432043f741a6faf2c6ffefd Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Thu, 18 Feb 2010 09:12:09 +1000
+Subject: drm/edid: allow certain bogus edids to hit a fixup path rather than fail
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit 44fef22416886a04d432043f741a6faf2c6ffefd upstream.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_edid.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -707,15 +707,6 @@ static struct drm_display_mode *drm_mode
+ mode->vsync_end = mode->vsync_start + vsync_pulse_width;
+ mode->vtotal = mode->vdisplay + vblank;
+
+- /* perform the basic check for the detailed timing */
+- if (mode->hsync_end > mode->htotal ||
+- mode->vsync_end > mode->vtotal) {
+- drm_mode_destroy(dev, mode);
+- DRM_DEBUG_KMS("Incorrect detailed timing. "
+- "Sync is beyond the blank.\n");
+- return NULL;
+- }
+-
+ /* Some EDIDs have bogus h/vtotal values */
+ if (mode->hsync_end > mode->htotal)
+ mode->htotal = mode->hsync_end + 1;
--- /dev/null
+From 338e2b1d571e4873908b199c90d6a31f65137fe3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Wed, 3 Mar 2010 13:39:13 -0500
+Subject: drm/radeon: add new RS880 pci id
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 338e2b1d571e4873908b199c90d6a31f65137fe3 upstream.
+
+This should go to 2.6.33 stable as well.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/drm/drm_pciids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -375,6 +375,7 @@
+ {0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
++ {0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+ {0, 0, 0}
+
+ #define r128_PCI_IDS \
--- /dev/null
+From b792210e7d1f9fb102061e2016da96cf2ad5cdbd Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Sat, 6 Mar 2010 10:57:30 -0500
+Subject: drm/radeon/kms/atom: spread spectrum fix
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit b792210e7d1f9fb102061e2016da96cf2ad5cdbd upstream.
+
+The atom spread spectrum table does not always
+disable ss. Explicitly disable it and then use
+the atom table to enable later if needed (currently
+only used for LVDS).
+
+Fixes display issues on some systems.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -353,12 +353,55 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+ }
+
++static void atombios_disable_ss(struct drm_crtc *crtc)
++{
++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
++ struct drm_device *dev = crtc->dev;
++ struct radeon_device *rdev = dev->dev_private;
++ u32 ss_cntl;
++
++ if (ASIC_IS_DCE4(rdev)) {
++ switch (radeon_crtc->pll_id) {
++ case ATOM_PPLL1:
++ ss_cntl = RREG32(EVERGREEN_P1PLL_SS_CNTL);
++ ss_cntl &= ~EVERGREEN_PxPLL_SS_EN;
++ WREG32(EVERGREEN_P1PLL_SS_CNTL, ss_cntl);
++ break;
++ case ATOM_PPLL2:
++ ss_cntl = RREG32(EVERGREEN_P2PLL_SS_CNTL);
++ ss_cntl &= ~EVERGREEN_PxPLL_SS_EN;
++ WREG32(EVERGREEN_P2PLL_SS_CNTL, ss_cntl);
++ break;
++ case ATOM_DCPLL:
++ case ATOM_PPLL_INVALID:
++ return;
++ }
++ } else if (ASIC_IS_AVIVO(rdev)) {
++ switch (radeon_crtc->pll_id) {
++ case ATOM_PPLL1:
++ ss_cntl = RREG32(AVIVO_P1PLL_INT_SS_CNTL);
++ ss_cntl &= ~1;
++ WREG32(AVIVO_P1PLL_INT_SS_CNTL, ss_cntl);
++ break;
++ case ATOM_PPLL2:
++ ss_cntl = RREG32(AVIVO_P2PLL_INT_SS_CNTL);
++ ss_cntl &= ~1;
++ WREG32(AVIVO_P2PLL_INT_SS_CNTL, ss_cntl);
++ break;
++ case ATOM_DCPLL:
++ case ATOM_PPLL_INVALID:
++ return;
++ }
++ }
++}
++
++
+ union atom_enable_ss {
+ ENABLE_LVDS_SS_PARAMETERS legacy;
+ ENABLE_SPREAD_SPECTRUM_ON_PPLL_PS_ALLOCATION v1;
+ };
+
+-static void atombios_set_ss(struct drm_crtc *crtc, int enable)
++static void atombios_enable_ss(struct drm_crtc *crtc)
+ {
+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
+ struct drm_device *dev = crtc->dev;
+@@ -387,9 +430,9 @@ static void atombios_set_ss(struct drm_crtc *crtc, int enable)
+ step = dig->ss->step;
+ delay = dig->ss->delay;
+ range = dig->ss->range;
+- } else if (enable)
++ } else
+ return;
+- } else if (enable)
++ } else
+ return;
+ break;
+ }
+@@ -406,13 +449,13 @@ static void atombios_set_ss(struct drm_crtc *crtc, int enable)
+ args.v1.ucSpreadSpectrumDelay = delay;
+ args.v1.ucSpreadSpectrumRange = range;
+ args.v1.ucPpll = radeon_crtc->crtc_id ? ATOM_PPLL2 : ATOM_PPLL1;
+- args.v1.ucEnable = enable;
++ args.v1.ucEnable = ATOM_ENABLE;
+ } else {
+ args.legacy.usSpreadSpectrumPercentage = cpu_to_le16(percentage);
+ args.legacy.ucSpreadSpectrumType = type;
+ args.legacy.ucSpreadSpectrumStepSize_Delay = (step & 3) << 2;
+ args.legacy.ucSpreadSpectrumStepSize_Delay |= (delay & 7) << 4;
+- args.legacy.ucEnable = enable;
++ args.legacy.ucEnable = ATOM_ENABLE;
+ }
+ atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+ }
+@@ -1086,12 +1129,12 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
+ /* pick pll */
+ radeon_crtc->pll_id = radeon_atom_pick_pll(crtc);
+
+- atombios_set_ss(crtc, 0);
++ atombios_disable_ss(crtc);
+ /* always set DCPLL */
+ if (ASIC_IS_DCE4(rdev))
+ atombios_crtc_set_dcpll(crtc);
+ atombios_crtc_set_pll(crtc, adjusted_mode);
+- atombios_set_ss(crtc, 1);
++ atombios_enable_ss(crtc);
+
+ if (ASIC_IS_DCE4(rdev))
+ atombios_set_crtc_dtd_timing(crtc, adjusted_mode);
--- /dev/null
+From 97f23b3d85a4d734a8584dade3a34579931c8f8d Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 19 Mar 2010 10:33:44 +1000
+Subject: drm/radeon/kms: don't print error on -ERESTARTSYS.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 97f23b3d85a4d734a8584dade3a34579931c8f8d upstream.
+
+We can get this if the user moves the mouse when we are waiting to move
+some stuff around in the validate. Don't fail.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_cs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -248,7 +248,8 @@ int radeon_cs_ioctl(struct drm_device *d
+ }
+ r = radeon_cs_parser_relocs(&parser);
+ if (r) {
+- DRM_ERROR("Failed to parse relocation !\n");
++ if (r != -ERESTARTSYS)
++ DRM_ERROR("Failed to parse relocation %d!\n", r);
+ radeon_cs_parser_fini(&parser, r);
+ mutex_unlock(&rdev->cs_mutex);
+ return r;
--- /dev/null
+From fcbc451ba1948fba967198bd150ecbd10bbb7075 Mon Sep 17 00:00:00 2001
+From: Pauli Nieminen <suokkos@gmail.com>
+Date: Fri, 19 Mar 2010 07:44:33 +0000
+Subject: drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed.
+
+From: Pauli Nieminen <suokkos@gmail.com>
+
+commit fcbc451ba1948fba967198bd150ecbd10bbb7075 upstream.
+
+When there is allocation failure in radeon_cs_parser_relocs parser->nrelocs
+is not cleaned. This causes NULL pointer defeference in radeon_cs_parser_fini
+when clean up code is trying to loop over the relocation array and free the
+objects.
+
+Fix adds a check for a possible NULL pointer in clean up code.
+
+Signed-off-by: Pauli Nieminen <suokkos@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_cs.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -193,11 +193,13 @@ static void radeon_cs_parser_fini(struct
+ radeon_bo_list_fence(&parser->validated, parser->ib->fence);
+ }
+ radeon_bo_list_unreserve(&parser->validated);
+- for (i = 0; i < parser->nrelocs; i++) {
+- if (parser->relocs[i].gobj) {
+- mutex_lock(&parser->rdev->ddev->struct_mutex);
+- drm_gem_object_unreference(parser->relocs[i].gobj);
+- mutex_unlock(&parser->rdev->ddev->struct_mutex);
++ if (parser->relocs != NULL) {
++ for (i = 0; i < parser->nrelocs; i++) {
++ if (parser->relocs[i].gobj) {
++ mutex_lock(&parser->rdev->ddev->struct_mutex);
++ drm_gem_object_unreference_unlocked(parser->relocs[i].gobj);
++ mutex_unlock(&parser->rdev->ddev->struct_mutex);
++ }
+ }
+ }
+ kfree(parser->track);
--- /dev/null
+From 15f7207761cfcf8f53fb6e5cacffe060478782c3 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Wed, 10 Mar 2010 18:33:03 -0500
+Subject: drm/radeon/kms: fix pal tv-out support on legacy IGP chips
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit 15f7207761cfcf8f53fb6e5cacffe060478782c3 upstream.
+
+Based on ddx patch by Andrzej Hajda.
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_legacy_tv.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
++++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+@@ -57,6 +57,10 @@
+ #define NTSC_TV_PLL_N_14 693
+ #define NTSC_TV_PLL_P_14 7
+
++#define PAL_TV_PLL_M_14 19
++#define PAL_TV_PLL_N_14 353
++#define PAL_TV_PLL_P_14 5
++
+ #define VERT_LEAD_IN_LINES 2
+ #define FRAC_BITS 0xe
+ #define FRAC_MASK 0x3fff
+@@ -205,9 +209,24 @@ static const struct radeon_tv_mode_const
+ 630627, /* defRestart */
+ 347, /* crtcPLL_N */
+ 14, /* crtcPLL_M */
+- 8, /* crtcPLL_postDiv */
++ 8, /* crtcPLL_postDiv */
+ 1022, /* pixToTV */
+ },
++ { /* PAL timing for 14 Mhz ref clk */
++ 800, /* horResolution */
++ 600, /* verResolution */
++ TV_STD_PAL, /* standard */
++ 1131, /* horTotal */
++ 742, /* verTotal */
++ 813, /* horStart */
++ 840, /* horSyncStart */
++ 633, /* verSyncStart */
++ 708369, /* defRestart */
++ 211, /* crtcPLL_N */
++ 9, /* crtcPLL_M */
++ 8, /* crtcPLL_postDiv */
++ 759, /* pixToTV */
++ },
+ };
+
+ #define N_AVAILABLE_MODES ARRAY_SIZE(available_tv_modes)
+@@ -242,7 +261,7 @@ static const struct radeon_tv_mode_const
+ if (pll->reference_freq == 2700)
+ const_ptr = &available_tv_modes[1];
+ else
+- const_ptr = &available_tv_modes[1]; /* FIX ME */
++ const_ptr = &available_tv_modes[3];
+ }
+ return const_ptr;
+ }
+@@ -685,9 +704,9 @@ void radeon_legacy_tv_mode_set(struct dr
+ n = PAL_TV_PLL_N_27;
+ p = PAL_TV_PLL_P_27;
+ } else {
+- m = PAL_TV_PLL_M_27;
+- n = PAL_TV_PLL_N_27;
+- p = PAL_TV_PLL_P_27;
++ m = PAL_TV_PLL_M_14;
++ n = PAL_TV_PLL_N_14;
++ p = PAL_TV_PLL_P_14;
+ }
+ }
+
--- /dev/null
+From f95df9ca6896978108201a77422a1ae2cdc595ec Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexdeucher@gmail.com>
+Date: Sun, 21 Mar 2010 14:02:25 -0400
+Subject: drm/radeon/kms: never treat rs4xx as AGP
+
+From: Alex Deucher <alexdeucher@gmail.com>
+
+commit f95df9ca6896978108201a77422a1ae2cdc595ec upstream.
+
+RS4xx+ IGP chips use an internal gart, however,
+some of them have the agp cap bits set in their pci
+configs. Make sure to clear the AGP flag as AGP will
+not work with them.
+
+Should fix fdo bug 27225
+
+Signed-off-by: Alex Deucher <alexdeucher@gmail.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -655,6 +655,14 @@ int radeon_device_init(struct radeon_dev
+ return r;
+ radeon_check_arguments(rdev);
+
++ /* all of the newer IGP chips have an internal gart
++ * However some rs4xx report as AGP, so remove that here.
++ */
++ if ((rdev->family >= CHIP_RS400) &&
++ (rdev->flags & RADEON_IS_IGP)) {
++ rdev->flags &= ~RADEON_IS_AGP;
++ }
++
+ if (rdev->flags & RADEON_IS_AGP && radeon_agpmode == -1) {
+ radeon_agp_disable(rdev);
+ }
--- /dev/null
+From 725398322d05486109375fbb85c3404108881e17 Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Thu, 4 Mar 2010 08:25:55 +0000
+Subject: drm: remove the EDID blob stored in the EDID property when it is disconnected
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 725398322d05486109375fbb85c3404108881e17 upstream.
+
+Now the EDID property will be updated when the corresponding EDID can be
+obtained from the external display device. But after the external device
+is plugged-out, the EDID property is not updated. In such case we still
+get the corresponding EDID property although it is already detected as
+disconnected.
+
+https://bugs.freedesktop.org/show_bug.cgi?id=26743
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_crtc_helper.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_crtc_helper.c
++++ b/drivers/gpu/drm/drm_crtc_helper.c
+@@ -104,6 +104,7 @@ int drm_helper_probe_single_connector_mo
+ if (connector->status == connector_status_disconnected) {
+ DRM_DEBUG_KMS("%s is disconnected\n",
+ drm_get_connector_name(connector));
++ drm_mode_connector_update_edid_property(connector, NULL);
+ goto prune;
+ }
+
--- /dev/null
+From da58405860b992d2bb21ebae5d685fe3204dd3f0 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 18 Mar 2010 11:56:54 +0000
+Subject: drm: Return ENODEV if the inode mapping changes
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit da58405860b992d2bb21ebae5d685fe3204dd3f0 upstream.
+
+Replace a BUG_ON with an error code in the event that the inode mapping
+changes between calls to drm_open. This may happen for instance if udev
+is loaded subsequent to the original opening of the device:
+
+[ 644.291870] kernel BUG at drivers/gpu/drm/drm_fops.c:146!
+[ 644.291876] invalid opcode: 0000 [#1] SMP
+[ 644.291882] last sysfs file: /sys/kernel/uevent_seqnum
+[ 644.291888]
+[ 644.291895] Pid: 7276, comm: lt-cairo-test-s Not tainted 2.6.34-rc1 #2 N150/N210/N220 /N150/N210/N220
+[ 644.291903] EIP: 0060:[<c11c70e3>] EFLAGS: 00210283 CPU: 0
+[ 644.291912] EIP is at drm_open+0x4b1/0x4e2
+[ 644.291918] EAX: f72d8d18 EBX: f790a400 ECX: f73176b8 EDX: 00000000
+[ 644.291923] ESI: f790a414 EDI: f790a414 EBP: f647ae20 ESP: f647adfc
+[ 644.291929] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
+[ 644.291937] Process lt-cairo-test-s (pid: 7276, ti=f647a000 task=f73f5c80 task.ti=f647a000)
+[ 644.291941] Stack:
+[ 644.291945] 00000000 f7bb7400 00000080 f6451100 f73176b8 f6479214 f6451100 f73176b8
+[ 644.291957] <0> c1297ce0 f647ae34 c11c6c04 f73176b8 f7949800 00000000 f647ae54 c1080ac5
+[ 644.291969] <0> f7949800 f6451100 00000000 f6451100 f73176b8 f6452780 f647ae70 c107d1e6
+[ 644.291982] Call Trace:
+[ 644.291991] [<c11c6c04>] ? drm_stub_open+0x8a/0xb8
+[ 644.292000] [<c1080ac5>] ? chrdev_open+0xef/0x106
+[ 644.292008] [<c107d1e6>] ? __dentry_open+0xd4/0x1a6
+[ 644.292015] [<c107d35b>] ? nameidata_to_filp+0x31/0x45
+[ 644.292022] [<c10809d6>] ? chrdev_open+0x0/0x106
+[ 644.292030] [<c10864e2>] ? do_last+0x346/0x423
+[ 644.292037] [<c108789f>] ? do_filp_open+0x190/0x415
+[ 644.292046] [<c1071eb5>] ? handle_mm_fault+0x214/0x710
+[ 644.292053] [<c107d008>] ? do_sys_open+0x4d/0xe9
+[ 644.292061] [<c1016462>] ? do_page_fault+0x211/0x23f
+[ 644.292068] [<c107d0f0>] ? sys_open+0x23/0x2b
+[ 644.292075] [<c1002650>] ? sysenter_do_call+0x12/0x26
+[ 644.292079] Code: 89 f0 89 55 dc e8 8d 96 0a 00 8b 45 e0 8b 55 dc 83 78 04 01 75 28 8b 83 18 02 00 00 85 c0 74 0f 8b 4d ec 3b 81 ac 00 00 00 74 13 <0f> 0b eb fe 8b 4d ec 8b 81 ac 00 00 00 89 83 18 02 00 00 89 f0
+[ 644.292143] EIP: [<c11c70e3>] drm_open+0x4b1/0x4e2 SS:ESP 0068:f647adfc
+[ 644.292175] ---[ end trace 2ddd476af89a60fa ]---
+
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/drm_fops.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fops.c
++++ b/drivers/gpu/drm/drm_fops.c
+@@ -140,14 +140,16 @@ int drm_open(struct inode *inode, struct
+ spin_unlock(&dev->count_lock);
+ }
+ out:
+- mutex_lock(&dev->struct_mutex);
+- if (minor->type == DRM_MINOR_LEGACY) {
+- BUG_ON((dev->dev_mapping != NULL) &&
+- (dev->dev_mapping != inode->i_mapping));
+- if (dev->dev_mapping == NULL)
+- dev->dev_mapping = inode->i_mapping;
++ if (!retcode) {
++ mutex_lock(&dev->struct_mutex);
++ if (minor->type == DRM_MINOR_LEGACY) {
++ if (dev->dev_mapping == NULL)
++ dev->dev_mapping = inode->i_mapping;
++ else if (dev->dev_mapping != inode->i_mapping)
++ retcode = -ENODEV;
++ }
++ mutex_unlock(&dev->struct_mutex);
+ }
+- mutex_unlock(&dev->struct_mutex);
+
+ return retcode;
+ }
--- /dev/null
+From 30d1872d9eb3663b4cf7bdebcbf5cd465674cced Mon Sep 17 00:00:00 2001
+From: Nikolaus Schulz <microschulz@web.de>
+Date: Thu, 1 Apr 2010 02:21:10 +0900
+Subject: fat: fix buffer overflow in vfat_create_shortname()
+
+From: Nikolaus Schulz <microschulz@web.de>
+
+commit 30d1872d9eb3663b4cf7bdebcbf5cd465674cced upstream.
+
+When using the string representation of a random counter as part of the base
+name, ensure that it is no longer than 4 bytes.
+
+Since we are repeatedly decrementing the counter in a loop until we have found a
+unique base name, the counter may wrap around zero; therefore, it is not enough
+to mask its higher bits before entering the loop, this must be done inside the
+loop.
+
+[hirofumi@mail.parknet.co.jp: use snprintf()]
+Signed-off-by: Nikolaus Schulz <microschulz@web.de>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/fat/namei_vfat.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/fat/namei_vfat.c
++++ b/fs/fat/namei_vfat.c
+@@ -309,7 +309,7 @@ static int vfat_create_shortname(struct
+ {
+ struct fat_mount_options *opts = &MSDOS_SB(dir->i_sb)->options;
+ wchar_t *ip, *ext_start, *end, *name_start;
+- unsigned char base[9], ext[4], buf[8], *p;
++ unsigned char base[9], ext[4], buf[5], *p;
+ unsigned char charbuf[NLS_MAX_CHARSET_SIZE];
+ int chl, chi;
+ int sz = 0, extlen, baselen, i, numtail_baselen, numtail2_baselen;
+@@ -467,7 +467,7 @@ static int vfat_create_shortname(struct
+ return 0;
+ }
+
+- i = jiffies & 0xffff;
++ i = jiffies;
+ sz = (jiffies >> 16) & 0x7;
+ if (baselen > 2) {
+ baselen = numtail2_baselen;
+@@ -476,7 +476,7 @@ static int vfat_create_shortname(struct
+ name_res[baselen + 4] = '~';
+ name_res[baselen + 5] = '1' + sz;
+ while (1) {
+- sprintf(buf, "%04X", i);
++ snprintf(buf, sizeof(buf), "%04X", i & 0xffff);
+ memcpy(&name_res[baselen], buf, 4);
+ if (vfat_find_form(dir, name_res) < 0)
+ break;
--- /dev/null
+From b95c35e76b29ba812e5dabdd91592e25ec640e93 Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 1 Apr 2010 15:13:57 +0200
+Subject: oom: fix the unsafe usage of badness() in proc_oom_score()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit b95c35e76b29ba812e5dabdd91592e25ec640e93 upstream.
+
+proc_oom_score(task) has a reference to task_struct, but that is all.
+If this task was already released before we take tasklist_lock
+
+ - we can't use task->group_leader, it points to nowhere
+
+ - it is not safe to call badness() even if this task is
+ ->group_leader, has_intersects_mems_allowed() assumes
+ it is safe to iterate over ->thread_group list.
+
+ - even worse, badness() can hit ->signal == NULL
+
+Add the pid_alive() check to ensure __unhash_process() was not called.
+
+Also, use "task" instead of task->group_leader. badness() should return
+the same result for any sub-thread. Currently this is not true, but
+this should be changed anyway.
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/proc/base.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -442,12 +442,13 @@ static const struct file_operations proc
+ unsigned long badness(struct task_struct *p, unsigned long uptime);
+ static int proc_oom_score(struct task_struct *task, char *buffer)
+ {
+- unsigned long points;
++ unsigned long points = 0;
+ struct timespec uptime;
+
+ do_posix_clock_monotonic_gettime(&uptime);
+ read_lock(&tasklist_lock);
+- points = badness(task->group_leader, uptime.tv_sec);
++ if (pid_alive(task))
++ points = badness(task, uptime.tv_sec);
+ read_unlock(&tasklist_lock);
+ return sprintf(buffer, "%lu\n", points);
+ }
--- /dev/null
+drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch
+drm-radeon-add-new-rs880-pci-id.patch
+drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch
+fat-fix-buffer-overflow-in-vfat_create_shortname.patch
+oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch
+drm-radeon-kms-never-treat-rs4xx-as-agp.patch
+drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch
+drm-radeon-kms-don-t-print-error-on-erestartsys.patch
+drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch
+drm-return-enodev-if-the-inode-mapping-changes.patch
+drm-radeon-kms-atom-spread-spectrum-fix.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
