From 3b2e432203e0f8fe6f2da16a40929da6667ad700 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 2 Dec 2008 16:02:35 -0800 Subject: [PATCH] 4 more .27 patches --- ...c-fix-rcu-related-race-with-idr_find.patch | 111 ++++++++++++++++++ .../parport_serial-fix-array-overflow.patch | 38 ++++++ queue-2.6.27/series | 4 + ...ways-define-declare_pci_unmap-macros.patch | 57 +++++++++ ...-general-identifier-for-phoenix-bios.patch | 40 +++++++ 5 files changed, 250 insertions(+) create mode 100644 queue-2.6.27/lib-idr.c-fix-rcu-related-race-with-idr_find.patch create mode 100644 queue-2.6.27/parport_serial-fix-array-overflow.patch create mode 100644 queue-2.6.27/x86-always-define-declare_pci_unmap-macros.patch create mode 100644 queue-2.6.27/x86-more-general-identifier-for-phoenix-bios.patch diff --git a/queue-2.6.27/lib-idr.c-fix-rcu-related-race-with-idr_find.patch b/queue-2.6.27/lib-idr.c-fix-rcu-related-race-with-idr_find.patch new file mode 100644 index 00000000000..b1145766fb9 --- /dev/null +++ b/queue-2.6.27/lib-idr.c-fix-rcu-related-race-with-idr_find.patch @@ -0,0 +1,111 @@ +From 6ff2d39b91aec3dcae951afa982059e3dd9b49dc Mon Sep 17 00:00:00 2001 +From: Manfred Spraul +Date: Mon, 1 Dec 2008 13:14:02 -0800 +Subject: lib/idr.c: fix rcu related race with idr_find + +From: Manfred Spraul + +commit 6ff2d39b91aec3dcae951afa982059e3dd9b49dc upstream. + +2nd part of the fixes needed for +http://bugzilla.kernel.org/show_bug.cgi?id=11796. + +When the idr tree is either grown or shrunk, then the update to the number +of layers and the top pointer were not atomic. This race caused crashes. + +The attached patch fixes that by replicating the layers counter in each +layer, thus idr_find doesn't need idp->layers anymore. + +Signed-off-by: Manfred Spraul +Cc: Clement Calmels +Cc: Nadia Derbey +Cc: Pierre Peiffer +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/idr.h | 3 ++- + lib/idr.c | 14 ++++++++++++-- + 2 files changed, 14 insertions(+), 3 deletions(-) + +--- a/include/linux/idr.h ++++ b/include/linux/idr.h +@@ -52,13 +52,14 @@ struct idr_layer { + unsigned long bitmap; /* A zero bit means "space here" */ + struct idr_layer *ary[1<layer = l-1; + rcu_assign_pointer(p->ary[m], new); + p->count++; + } +@@ -210,6 +211,7 @@ build_up: + if (unlikely(!p)) { + if (!(p = get_from_free_list(idp))) + return -1; ++ p->layer = 0; + layers = 1; + } + /* +@@ -237,6 +239,7 @@ build_up: + } + new->ary[0] = p; + new->count = 1; ++ new->layer = layers-1; + if (p->bitmap == IDR_FULL) + __set_bit(0, &new->bitmap); + p = new; +@@ -493,17 +496,21 @@ void *idr_find(struct idr *idp, int id) + int n; + struct idr_layer *p; + +- n = idp->layers * IDR_BITS; + p = rcu_dereference(idp->top); ++ if (!p) ++ return NULL; ++ n = (p->layer+1) * IDR_BITS; + + /* Mask off upper bits we don't use for the search. */ + id &= MAX_ID_MASK; + + if (id >= (1 << n)) + return NULL; ++ BUG_ON(n == 0); + + while (n > 0 && p) { + n -= IDR_BITS; ++ BUG_ON(n != p->layer*IDR_BITS); + p = rcu_dereference(p->ary[(id >> n) & IDR_MASK]); + } + return((void *)p); +@@ -582,8 +589,11 @@ void *idr_replace(struct idr *idp, void + int n; + struct idr_layer *p, *old_p; + +- n = idp->layers * IDR_BITS; + p = idp->top; ++ if (!p) ++ return ERR_PTR(-EINVAL); ++ ++ n = (p->layer+1) * IDR_BITS; + + id &= MAX_ID_MASK; + diff --git a/queue-2.6.27/parport_serial-fix-array-overflow.patch b/queue-2.6.27/parport_serial-fix-array-overflow.patch new file mode 100644 index 00000000000..eb7469be24e --- /dev/null +++ b/queue-2.6.27/parport_serial-fix-array-overflow.patch @@ -0,0 +1,38 @@ +From 36be47d6d8d98f54b6c4f891e9f54fb2bf554584 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 1 Dec 2008 13:13:49 -0800 +Subject: parport_serial: fix array overflow + +From: Takashi Iwai + +commit 36be47d6d8d98f54b6c4f891e9f54fb2bf554584 upstream. + +The netmos_9xx5_combo type assumes that PCI SSID provides always the +correct value for the number of parallel and serial ports, but there are +indeed broken devices with wrong numbers, which may result in Oops. + +This patch simply adds the check of the array range. + +Reference: Novell bnc#447067 + https://bugzilla.novell.com/show_bug.cgi?id=447067 + +Signed-off-by: Takashi Iwai +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/parport_serial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/parport/parport_serial.c ++++ b/drivers/parport/parport_serial.c +@@ -70,6 +70,8 @@ static int __devinit netmos_parallel_ini + * parallel ports and is the number of serial ports. + */ + card->numports = (dev->subsystem_device & 0xf0) >> 4; ++ if (card->numports > ARRAY_SIZE(card->addr)) ++ card->numports = ARRAY_SIZE(card->addr); + return 0; + } + diff --git a/queue-2.6.27/series b/queue-2.6.27/series index bd0bd528bba..c59b5c62bba 100644 --- a/queue-2.6.27/series +++ b/queue-2.6.27/series @@ -18,3 +18,7 @@ fix-inotify-watch-removal-umount-races.patch ia64-fix-boot-panic-caused-by-offline-cpus.patch v4l-dvb-add-some-missing-compat32-ioctls.patch input-atkbd-add-keymap-quirk-for-inventec-symphony-systems.patch +lib-idr.c-fix-rcu-related-race-with-idr_find.patch +parport_serial-fix-array-overflow.patch +x86-more-general-identifier-for-phoenix-bios.patch +x86-always-define-declare_pci_unmap-macros.patch diff --git a/queue-2.6.27/x86-always-define-declare_pci_unmap-macros.patch b/queue-2.6.27/x86-always-define-declare_pci_unmap-macros.patch new file mode 100644 index 00000000000..8987efe0c52 --- /dev/null +++ b/queue-2.6.27/x86-always-define-declare_pci_unmap-macros.patch @@ -0,0 +1,57 @@ +From b627c8b17ccacba38c975bc0f69a49fc4e5261c9 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Thu, 20 Nov 2008 20:49:56 +0100 +Subject: x86: always define DECLARE_PCI_UNMAP* macros + +From: Joerg Roedel + +commit b627c8b17ccacba38c975bc0f69a49fc4e5261c9 upstream. + +Impact: fix boot crash on AMD IOMMU if CONFIG_GART_IOMMU is off + +Currently these macros evaluate to a no-op except the kernel is compiled +with GART or Calgary support. But we also need these macros when we have +SWIOTLB, VT-d or AMD IOMMU in the kernel. Since we always compile at +least with SWIOTLB we can define these macros always. + +This patch is also for stable backport for the same reason the SWIOTLB +default selection patch is. + +Signed-off-by: Joerg Roedel +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + include/asm-x86/pci_64.h | 14 -------------- + 1 file changed, 14 deletions(-) + +--- a/include/asm-x86/pci_64.h ++++ b/include/asm-x86/pci_64.h +@@ -34,8 +34,6 @@ extern void pci_iommu_alloc(void); + */ + #define PCI_DMA_BUS_IS_PHYS (dma_ops->is_phys) + +-#if defined(CONFIG_GART_IOMMU) || defined(CONFIG_CALGARY_IOMMU) +- + #define DECLARE_PCI_UNMAP_ADDR(ADDR_NAME) \ + dma_addr_t ADDR_NAME; + #define DECLARE_PCI_UNMAP_LEN(LEN_NAME) \ +@@ -49,18 +47,6 @@ extern void pci_iommu_alloc(void); + #define pci_unmap_len_set(PTR, LEN_NAME, VAL) \ + (((PTR)->LEN_NAME) = (VAL)) + +-#else +-/* No IOMMU */ +- +-#define DECLARE_PCI_UNMAP_ADDR(ADDR_NAME) +-#define DECLARE_PCI_UNMAP_LEN(LEN_NAME) +-#define pci_unmap_addr(PTR, ADDR_NAME) (0) +-#define pci_unmap_addr_set(PTR, ADDR_NAME, VAL) do { } while (0) +-#define pci_unmap_len(PTR, LEN_NAME) (0) +-#define pci_unmap_len_set(PTR, LEN_NAME, VAL) do { } while (0) +- +-#endif +- + #endif /* __KERNEL__ */ + + #endif /* __x8664_PCI_H */ diff --git a/queue-2.6.27/x86-more-general-identifier-for-phoenix-bios.patch b/queue-2.6.27/x86-more-general-identifier-for-phoenix-bios.patch new file mode 100644 index 00000000000..53e7dd0a545 --- /dev/null +++ b/queue-2.6.27/x86-more-general-identifier-for-phoenix-bios.patch @@ -0,0 +1,40 @@ +From 0af40a4b1050c050e62eb1dc30b82d5ab22bf221 Mon Sep 17 00:00:00 2001 +From: Philipp Kohlbecher +Date: Sun, 16 Nov 2008 12:11:01 +0100 +Subject: x86: more general identifier for Phoenix BIOS + +From: Philipp Kohlbecher + +commit 0af40a4b1050c050e62eb1dc30b82d5ab22bf221 upstream. + +Impact: widen the reach of the low-memory-protect DMI quirk + +Phoenix BIOSes variously identify their vendor as "Phoenix Technologies, +LTD" or "Phoenix Technologies LTD" (without the comma.) + +This patch makes the identification string in the bad_bios_dmi_table +more general (following a suggestion by Ingo Molnar), so that both +versions are handled. + +Again, the patched file compiles cleanly and the patch has been tested +successfully on my machine. + +Signed-off-by: Philipp Kohlbecher +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -604,7 +604,7 @@ static struct dmi_system_id __initdata b + .callback = dmi_low_memory_corruption, + .ident = "Phoenix BIOS", + .matches = { +- DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"), ++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies"), + }, + }, + #endif -- 2.47.3