From d855e5ccffbf9a3e9ace02207951b587221dcc23 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 11 Dec 2012 13:36:23 -0800 Subject: [PATCH] 3.4-stable patches added patches: mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch telephony-ijx-buffer-overflow-in-ixj_write_cid.patch x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch --- ...ags-for-all-dma_alloc_coherent-calls.patch | 124 ++++++++++++++++++ queue-3.4/series | 3 + ...ijx-buffer-overflow-in-ixj_write_cid.patch | 60 +++++++++ ...port-for-amd-s-family-16h-processors.patch | 40 ++++++ 4 files changed, 227 insertions(+) create mode 100644 queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch create mode 100644 queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch create mode 100644 queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch diff --git a/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch b/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch new file mode 100644 index 00000000000..5867b9a84b1 --- /dev/null +++ b/queue-3.4/mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch @@ -0,0 +1,124 @@ +From 387870f2d6d679746020fa8e25ef786ff338dc98 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 7 Nov 2012 15:37:07 +0100 +Subject: mm: dmapool: use provided gfp flags for all dma_alloc_coherent() calls + +From: Marek Szyprowski + +commit 387870f2d6d679746020fa8e25ef786ff338dc98 upstream. + +dmapool always calls dma_alloc_coherent() with GFP_ATOMIC flag, +regardless the flags provided by the caller. This causes excessive +pruning of emergency memory pools without any good reason. Additionaly, +on ARM architecture any driver which is using dmapools will sooner or +later trigger the following error: +"ERROR: 256 KiB atomic DMA coherent pool is too small! +Please increase it with coherent_pool= kernel parameter!". +Increasing the coherent pool size usually doesn't help much and only +delays such error, because all GFP_ATOMIC DMA allocations are always +served from the special, very limited memory pool. + +This patch changes the dmapool code to correctly use gfp flags provided +by the dmapool caller. + +Reported-by: Soeren Moch +Reported-by: Thomas Petazzoni +Signed-off-by: Marek Szyprowski +Tested-by: Andrew Lunn +Tested-by: Soeren Moch +Signed-off-by: Greg Kroah-Hartman + +--- + mm/dmapool.c | 31 +++++++------------------------ + 1 file changed, 7 insertions(+), 24 deletions(-) + +--- a/mm/dmapool.c ++++ b/mm/dmapool.c +@@ -50,7 +50,6 @@ struct dma_pool { /* the pool */ + size_t allocation; + size_t boundary; + char name[32]; +- wait_queue_head_t waitq; + struct list_head pools; + }; + +@@ -62,8 +61,6 @@ struct dma_page { /* cacheable header f + unsigned int offset; + }; + +-#define POOL_TIMEOUT_JIFFIES ((100 /* msec */ * HZ) / 1000) +- + static DEFINE_MUTEX(pools_lock); + + static ssize_t +@@ -172,7 +169,6 @@ struct dma_pool *dma_pool_create(const c + retval->size = size; + retval->boundary = boundary; + retval->allocation = allocation; +- init_waitqueue_head(&retval->waitq); + + if (dev) { + int ret; +@@ -227,7 +223,6 @@ static struct dma_page *pool_alloc_page( + memset(page->vaddr, POOL_POISON_FREED, pool->allocation); + #endif + pool_initialise_page(pool, page); +- list_add(&page->page_list, &pool->page_list); + page->in_use = 0; + page->offset = 0; + } else { +@@ -315,30 +310,21 @@ void *dma_pool_alloc(struct dma_pool *po + might_sleep_if(mem_flags & __GFP_WAIT); + + spin_lock_irqsave(&pool->lock, flags); +- restart: + list_for_each_entry(page, &pool->page_list, page_list) { + if (page->offset < pool->allocation) + goto ready; + } +- page = pool_alloc_page(pool, GFP_ATOMIC); +- if (!page) { +- if (mem_flags & __GFP_WAIT) { +- DECLARE_WAITQUEUE(wait, current); + +- __set_current_state(TASK_UNINTERRUPTIBLE); +- __add_wait_queue(&pool->waitq, &wait); +- spin_unlock_irqrestore(&pool->lock, flags); ++ /* pool_alloc_page() might sleep, so temporarily drop &pool->lock */ ++ spin_unlock_irqrestore(&pool->lock, flags); + +- schedule_timeout(POOL_TIMEOUT_JIFFIES); ++ page = pool_alloc_page(pool, mem_flags); ++ if (!page) ++ return NULL; + +- spin_lock_irqsave(&pool->lock, flags); +- __remove_wait_queue(&pool->waitq, &wait); +- goto restart; +- } +- retval = NULL; +- goto done; +- } ++ spin_lock_irqsave(&pool->lock, flags); + ++ list_add(&page->page_list, &pool->page_list); + ready: + page->in_use++; + offset = page->offset; +@@ -348,7 +334,6 @@ void *dma_pool_alloc(struct dma_pool *po + #ifdef DMAPOOL_DEBUG + memset(retval, POOL_POISON_ALLOCATED, pool->size); + #endif +- done: + spin_unlock_irqrestore(&pool->lock, flags); + return retval; + } +@@ -435,8 +420,6 @@ void dma_pool_free(struct dma_pool *pool + page->in_use--; + *(int *)vaddr = page->offset; + page->offset = offset; +- if (waitqueue_active(&pool->waitq)) +- wake_up_locked(&pool->waitq); + /* + * Resist a temptation to do + * if (!is_page_busy(page)) pool_free_page(pool, page); diff --git a/queue-3.4/series b/queue-3.4/series index 149c3460feb..6fe6325aea2 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -6,3 +6,6 @@ asoc-dmaengine-correct-makefile-when-sound-is-built-as-module.patch workqueue-convert-bug_on-s-in-__queue_delayed_work-to-warn_on_once-s.patch drm-i915-do-not-ignore-edp-bpc-settings-from-vbt.patch drm-i915-do-not-default-to-18-bpp-for-edp-if-missing-from-vbt.patch +mm-dmapool-use-provided-gfp-flags-for-all-dma_alloc_coherent-calls.patch +x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch +telephony-ijx-buffer-overflow-in-ixj_write_cid.patch diff --git a/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch b/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch new file mode 100644 index 00000000000..13ad3f5a041 --- /dev/null +++ b/queue-3.4/telephony-ijx-buffer-overflow-in-ixj_write_cid.patch @@ -0,0 +1,60 @@ +From dan.carpenter@oracle.com Tue Dec 11 13:26:39 2012 +From: Dan Carpenter +Date: Mon, 3 Dec 2012 22:05:12 +0300 +Subject: telephony: ijx: buffer overflow in ixj_write_cid() +To: Greg Kroah-Hartman +Message-ID: <20121203190512.GA9273@elgon.mountain> + +[Not needed in 3.8 or newer as this driver is removed there. - gregkh] + +We get this from user space and nothing has been done to ensure that +these strings are NUL terminated. + +Reported-by: Chen Gang +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/telephony/ixj.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/staging/telephony/ixj.c ++++ b/drivers/staging/telephony/ixj.c +@@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j) + + ixj_fsk_alloc(j); + +- strcpy(sdmf1, j->cid_send.month); +- strcat(sdmf1, j->cid_send.day); +- strcat(sdmf1, j->cid_send.hour); +- strcat(sdmf1, j->cid_send.min); +- strcpy(sdmf2, j->cid_send.number); +- strcpy(sdmf3, j->cid_send.name); ++ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1)); ++ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2)); ++ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3)); + + len1 = strlen(sdmf1); + len2 = strlen(sdmf2); +@@ -3340,12 +3340,12 @@ static void ixj_write_cidcw(IXJ *j) + ixj_pre_cid(j); + } + j->flags.cidcw_ack = 0; +- strcpy(sdmf1, j->cid_send.month); +- strcat(sdmf1, j->cid_send.day); +- strcat(sdmf1, j->cid_send.hour); +- strcat(sdmf1, j->cid_send.min); +- strcpy(sdmf2, j->cid_send.number); +- strcpy(sdmf3, j->cid_send.name); ++ strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1)); ++ strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1)); ++ strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2)); ++ strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3)); + + len1 = strlen(sdmf1); + len2 = strlen(sdmf2); diff --git a/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch b/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch new file mode 100644 index 00000000000..b69bdb77972 --- /dev/null +++ b/queue-3.4/x86-amd-power-driver-support-for-amd-s-family-16h-processors.patch @@ -0,0 +1,40 @@ +From 22e32f4f57778ebc6e17812fa3008361c05d64f9 Mon Sep 17 00:00:00 2001 +From: Boris Ostrovsky +Date: Wed, 5 Dec 2012 06:12:42 -0500 +Subject: x86,AMD: Power driver support for AMD's family 16h processors + +From: Boris Ostrovsky + +commit 22e32f4f57778ebc6e17812fa3008361c05d64f9 upstream. + +Add family 16h PCI ID to AMD's power driver to allow it report +power consumption on these processors. + +Signed-off-by: Boris Ostrovsky +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/fam15h_power.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwmon/fam15h_power.c ++++ b/drivers/hwmon/fam15h_power.c +@@ -31,6 +31,9 @@ MODULE_DESCRIPTION("AMD Family 15h CPU p + MODULE_AUTHOR("Andreas Herrmann "); + MODULE_LICENSE("GPL"); + ++/* Family 16h Northbridge's function 4 PCI ID */ ++#define PCI_DEVICE_ID_AMD_16H_NB_F4 0x1534 ++ + /* D18F3 */ + #define REG_NORTHBRIDGE_CAP 0xe8 + +@@ -256,6 +259,7 @@ static void __devexit fam15h_power_remov + + static DEFINE_PCI_DEVICE_TABLE(fam15h_power_id_table) = { + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) }, + {} + }; + MODULE_DEVICE_TABLE(pci, fam15h_power_id_table); -- 2.47.3