From e83c3914ecc1e09c5d2f550d503c424c01a96ef7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 2 Apr 2010 11:00:03 -0700 Subject: [PATCH] .33 patches --- ...to-hit-a-fixup-path-rather-than-fail.patch | 35 +++++ .../drm-radeon-add-new-rs880-pci-id.patch | 29 +++++ ...-radeon-kms-atom-spread-spectrum-fix.patch | 122 ++++++++++++++++++ ...kms-don-t-print-error-on-erestartsys.patch | 31 +++++ ...eference-if-memory-allocation-failed.patch | 45 +++++++ ...l-tv-out-support-on-legacy-igp-chips.patch | 80 ++++++++++++ ...-radeon-kms-never-treat-rs4xx-as-agp.patch | 41 ++++++ ...did-property-when-it-is-disconnected.patch | 36 ++++++ ...-enodev-if-the-inode-mapping-changes.patch | 79 ++++++++++++ ...er-overflow-in-vfat_create_shortname.patch | 56 ++++++++ ...e-usage-of-badness-in-proc_oom_score.patch | 52 ++++++++ queue-2.6.33/series | 11 ++ 12 files changed, 617 insertions(+) create mode 100644 queue-2.6.33/drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch create mode 100644 queue-2.6.33/drm-radeon-add-new-rs880-pci-id.patch create mode 100644 queue-2.6.33/drm-radeon-kms-atom-spread-spectrum-fix.patch create mode 100644 queue-2.6.33/drm-radeon-kms-don-t-print-error-on-erestartsys.patch create mode 100644 queue-2.6.33/drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch create mode 100644 queue-2.6.33/drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch create mode 100644 queue-2.6.33/drm-radeon-kms-never-treat-rs4xx-as-agp.patch create mode 100644 queue-2.6.33/drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch create mode 100644 queue-2.6.33/drm-return-enodev-if-the-inode-mapping-changes.patch create mode 100644 queue-2.6.33/fat-fix-buffer-overflow-in-vfat_create_shortname.patch create mode 100644 queue-2.6.33/oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch create mode 100644 queue-2.6.33/series diff --git a/queue-2.6.33/drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch b/queue-2.6.33/drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch new file mode 100644 index 00000000000..52902947dad --- /dev/null +++ b/queue-2.6.33/drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch @@ -0,0 +1,35 @@ +From 44fef22416886a04d432043f741a6faf2c6ffefd Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Thu, 18 Feb 2010 09:12:09 +1000 +Subject: drm/edid: allow certain bogus edids to hit a fixup path rather than fail + +From: Ben Skeggs + +commit 44fef22416886a04d432043f741a6faf2c6ffefd upstream. + +Signed-off-by: Ben Skeggs +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_edid.c | 9 --------- + 1 file changed, 9 deletions(-) + +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -707,15 +707,6 @@ static struct drm_display_mode *drm_mode + mode->vsync_end = mode->vsync_start + vsync_pulse_width; + mode->vtotal = mode->vdisplay + vblank; + +- /* perform the basic check for the detailed timing */ +- if (mode->hsync_end > mode->htotal || +- mode->vsync_end > mode->vtotal) { +- drm_mode_destroy(dev, mode); +- DRM_DEBUG_KMS("Incorrect detailed timing. " +- "Sync is beyond the blank.\n"); +- return NULL; +- } +- + /* Some EDIDs have bogus h/vtotal values */ + if (mode->hsync_end > mode->htotal) + mode->htotal = mode->hsync_end + 1; diff --git a/queue-2.6.33/drm-radeon-add-new-rs880-pci-id.patch b/queue-2.6.33/drm-radeon-add-new-rs880-pci-id.patch new file mode 100644 index 00000000000..453f139bc3d --- /dev/null +++ b/queue-2.6.33/drm-radeon-add-new-rs880-pci-id.patch @@ -0,0 +1,29 @@ +From 338e2b1d571e4873908b199c90d6a31f65137fe3 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 3 Mar 2010 13:39:13 -0500 +Subject: drm/radeon: add new RS880 pci id + +From: Alex Deucher + +commit 338e2b1d571e4873908b199c90d6a31f65137fe3 upstream. + +This should go to 2.6.33 stable as well. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -375,6 +375,7 @@ + {0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ ++ {0x1002, 0x9715, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \ + {0, 0, 0} + + #define r128_PCI_IDS \ diff --git a/queue-2.6.33/drm-radeon-kms-atom-spread-spectrum-fix.patch b/queue-2.6.33/drm-radeon-kms-atom-spread-spectrum-fix.patch new file mode 100644 index 00000000000..8d97e716ee5 --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-atom-spread-spectrum-fix.patch @@ -0,0 +1,122 @@ +From b792210e7d1f9fb102061e2016da96cf2ad5cdbd Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Sat, 6 Mar 2010 10:57:30 -0500 +Subject: drm/radeon/kms/atom: spread spectrum fix + +From: Alex Deucher + +commit b792210e7d1f9fb102061e2016da96cf2ad5cdbd upstream. + +The atom spread spectrum table does not always +disable ss. Explicitly disable it and then use +the atom table to enable later if needed (currently +only used for LVDS). + +Fixes display issues on some systems. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/gpu/drm/radeon/atombios_crtc.c ++++ b/drivers/gpu/drm/radeon/atombios_crtc.c +@@ -353,12 +353,55 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc, + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); + } + ++static void atombios_disable_ss(struct drm_crtc *crtc) ++{ ++ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); ++ struct drm_device *dev = crtc->dev; ++ struct radeon_device *rdev = dev->dev_private; ++ u32 ss_cntl; ++ ++ if (ASIC_IS_DCE4(rdev)) { ++ switch (radeon_crtc->pll_id) { ++ case ATOM_PPLL1: ++ ss_cntl = RREG32(EVERGREEN_P1PLL_SS_CNTL); ++ ss_cntl &= ~EVERGREEN_PxPLL_SS_EN; ++ WREG32(EVERGREEN_P1PLL_SS_CNTL, ss_cntl); ++ break; ++ case ATOM_PPLL2: ++ ss_cntl = RREG32(EVERGREEN_P2PLL_SS_CNTL); ++ ss_cntl &= ~EVERGREEN_PxPLL_SS_EN; ++ WREG32(EVERGREEN_P2PLL_SS_CNTL, ss_cntl); ++ break; ++ case ATOM_DCPLL: ++ case ATOM_PPLL_INVALID: ++ return; ++ } ++ } else if (ASIC_IS_AVIVO(rdev)) { ++ switch (radeon_crtc->pll_id) { ++ case ATOM_PPLL1: ++ ss_cntl = RREG32(AVIVO_P1PLL_INT_SS_CNTL); ++ ss_cntl &= ~1; ++ WREG32(AVIVO_P1PLL_INT_SS_CNTL, ss_cntl); ++ break; ++ case ATOM_PPLL2: ++ ss_cntl = RREG32(AVIVO_P2PLL_INT_SS_CNTL); ++ ss_cntl &= ~1; ++ WREG32(AVIVO_P2PLL_INT_SS_CNTL, ss_cntl); ++ break; ++ case ATOM_DCPLL: ++ case ATOM_PPLL_INVALID: ++ return; ++ } ++ } ++} ++ ++ + union atom_enable_ss { + ENABLE_LVDS_SS_PARAMETERS legacy; + ENABLE_SPREAD_SPECTRUM_ON_PPLL_PS_ALLOCATION v1; + }; + +-static void atombios_set_ss(struct drm_crtc *crtc, int enable) ++static void atombios_enable_ss(struct drm_crtc *crtc) + { + struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc); + struct drm_device *dev = crtc->dev; +@@ -387,9 +430,9 @@ static void atombios_set_ss(struct drm_crtc *crtc, int enable) + step = dig->ss->step; + delay = dig->ss->delay; + range = dig->ss->range; +- } else if (enable) ++ } else + return; +- } else if (enable) ++ } else + return; + break; + } +@@ -406,13 +449,13 @@ static void atombios_set_ss(struct drm_crtc *crtc, int enable) + args.v1.ucSpreadSpectrumDelay = delay; + args.v1.ucSpreadSpectrumRange = range; + args.v1.ucPpll = radeon_crtc->crtc_id ? ATOM_PPLL2 : ATOM_PPLL1; +- args.v1.ucEnable = enable; ++ args.v1.ucEnable = ATOM_ENABLE; + } else { + args.legacy.usSpreadSpectrumPercentage = cpu_to_le16(percentage); + args.legacy.ucSpreadSpectrumType = type; + args.legacy.ucSpreadSpectrumStepSize_Delay = (step & 3) << 2; + args.legacy.ucSpreadSpectrumStepSize_Delay |= (delay & 7) << 4; +- args.legacy.ucEnable = enable; ++ args.legacy.ucEnable = ATOM_ENABLE; + } + atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args); + } +@@ -1086,12 +1129,12 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc, + /* pick pll */ + radeon_crtc->pll_id = radeon_atom_pick_pll(crtc); + +- atombios_set_ss(crtc, 0); ++ atombios_disable_ss(crtc); + /* always set DCPLL */ + if (ASIC_IS_DCE4(rdev)) + atombios_crtc_set_dcpll(crtc); + atombios_crtc_set_pll(crtc, adjusted_mode); +- atombios_set_ss(crtc, 1); ++ atombios_enable_ss(crtc); + + if (ASIC_IS_DCE4(rdev)) + atombios_set_crtc_dtd_timing(crtc, adjusted_mode); diff --git a/queue-2.6.33/drm-radeon-kms-don-t-print-error-on-erestartsys.patch b/queue-2.6.33/drm-radeon-kms-don-t-print-error-on-erestartsys.patch new file mode 100644 index 00000000000..d020facb96c --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-don-t-print-error-on-erestartsys.patch @@ -0,0 +1,31 @@ +From 97f23b3d85a4d734a8584dade3a34579931c8f8d Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Fri, 19 Mar 2010 10:33:44 +1000 +Subject: drm/radeon/kms: don't print error on -ERESTARTSYS. + +From: Dave Airlie + +commit 97f23b3d85a4d734a8584dade3a34579931c8f8d upstream. + +We can get this if the user moves the mouse when we are waiting to move +some stuff around in the validate. Don't fail. + +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -248,7 +248,8 @@ int radeon_cs_ioctl(struct drm_device *d + } + r = radeon_cs_parser_relocs(&parser); + if (r) { +- DRM_ERROR("Failed to parse relocation !\n"); ++ if (r != -ERESTARTSYS) ++ DRM_ERROR("Failed to parse relocation %d!\n", r); + radeon_cs_parser_fini(&parser, r); + mutex_unlock(&rdev->cs_mutex); + return r; diff --git a/queue-2.6.33/drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch b/queue-2.6.33/drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch new file mode 100644 index 00000000000..7828a679dd0 --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch @@ -0,0 +1,45 @@ +From fcbc451ba1948fba967198bd150ecbd10bbb7075 Mon Sep 17 00:00:00 2001 +From: Pauli Nieminen +Date: Fri, 19 Mar 2010 07:44:33 +0000 +Subject: drm/radeon/kms: Fix NULL pointer dereference if memory allocation failed. + +From: Pauli Nieminen + +commit fcbc451ba1948fba967198bd150ecbd10bbb7075 upstream. + +When there is allocation failure in radeon_cs_parser_relocs parser->nrelocs +is not cleaned. This causes NULL pointer defeference in radeon_cs_parser_fini +when clean up code is trying to loop over the relocation array and free the +objects. + +Fix adds a check for a possible NULL pointer in clean up code. + +Signed-off-by: Pauli Nieminen +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_cs.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_cs.c ++++ b/drivers/gpu/drm/radeon/radeon_cs.c +@@ -193,11 +193,13 @@ static void radeon_cs_parser_fini(struct + radeon_bo_list_fence(&parser->validated, parser->ib->fence); + } + radeon_bo_list_unreserve(&parser->validated); +- for (i = 0; i < parser->nrelocs; i++) { +- if (parser->relocs[i].gobj) { +- mutex_lock(&parser->rdev->ddev->struct_mutex); +- drm_gem_object_unreference(parser->relocs[i].gobj); +- mutex_unlock(&parser->rdev->ddev->struct_mutex); ++ if (parser->relocs != NULL) { ++ for (i = 0; i < parser->nrelocs; i++) { ++ if (parser->relocs[i].gobj) { ++ mutex_lock(&parser->rdev->ddev->struct_mutex); ++ drm_gem_object_unreference_unlocked(parser->relocs[i].gobj); ++ mutex_unlock(&parser->rdev->ddev->struct_mutex); ++ } + } + } + kfree(parser->track); diff --git a/queue-2.6.33/drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch b/queue-2.6.33/drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch new file mode 100644 index 00000000000..200bfb8a51b --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch @@ -0,0 +1,80 @@ +From 15f7207761cfcf8f53fb6e5cacffe060478782c3 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 10 Mar 2010 18:33:03 -0500 +Subject: drm/radeon/kms: fix pal tv-out support on legacy IGP chips + +From: Alex Deucher + +commit 15f7207761cfcf8f53fb6e5cacffe060478782c3 upstream. + +Based on ddx patch by Andrzej Hajda. + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_legacy_tv.c | 29 ++++++++++++++++++++++++----- + 1 file changed, 24 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c +@@ -57,6 +57,10 @@ + #define NTSC_TV_PLL_N_14 693 + #define NTSC_TV_PLL_P_14 7 + ++#define PAL_TV_PLL_M_14 19 ++#define PAL_TV_PLL_N_14 353 ++#define PAL_TV_PLL_P_14 5 ++ + #define VERT_LEAD_IN_LINES 2 + #define FRAC_BITS 0xe + #define FRAC_MASK 0x3fff +@@ -205,9 +209,24 @@ static const struct radeon_tv_mode_const + 630627, /* defRestart */ + 347, /* crtcPLL_N */ + 14, /* crtcPLL_M */ +- 8, /* crtcPLL_postDiv */ ++ 8, /* crtcPLL_postDiv */ + 1022, /* pixToTV */ + }, ++ { /* PAL timing for 14 Mhz ref clk */ ++ 800, /* horResolution */ ++ 600, /* verResolution */ ++ TV_STD_PAL, /* standard */ ++ 1131, /* horTotal */ ++ 742, /* verTotal */ ++ 813, /* horStart */ ++ 840, /* horSyncStart */ ++ 633, /* verSyncStart */ ++ 708369, /* defRestart */ ++ 211, /* crtcPLL_N */ ++ 9, /* crtcPLL_M */ ++ 8, /* crtcPLL_postDiv */ ++ 759, /* pixToTV */ ++ }, + }; + + #define N_AVAILABLE_MODES ARRAY_SIZE(available_tv_modes) +@@ -242,7 +261,7 @@ static const struct radeon_tv_mode_const + if (pll->reference_freq == 2700) + const_ptr = &available_tv_modes[1]; + else +- const_ptr = &available_tv_modes[1]; /* FIX ME */ ++ const_ptr = &available_tv_modes[3]; + } + return const_ptr; + } +@@ -685,9 +704,9 @@ void radeon_legacy_tv_mode_set(struct dr + n = PAL_TV_PLL_N_27; + p = PAL_TV_PLL_P_27; + } else { +- m = PAL_TV_PLL_M_27; +- n = PAL_TV_PLL_N_27; +- p = PAL_TV_PLL_P_27; ++ m = PAL_TV_PLL_M_14; ++ n = PAL_TV_PLL_N_14; ++ p = PAL_TV_PLL_P_14; + } + } + diff --git a/queue-2.6.33/drm-radeon-kms-never-treat-rs4xx-as-agp.patch b/queue-2.6.33/drm-radeon-kms-never-treat-rs4xx-as-agp.patch new file mode 100644 index 00000000000..59a07ad7a66 --- /dev/null +++ b/queue-2.6.33/drm-radeon-kms-never-treat-rs4xx-as-agp.patch @@ -0,0 +1,41 @@ +From f95df9ca6896978108201a77422a1ae2cdc595ec Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Sun, 21 Mar 2010 14:02:25 -0400 +Subject: drm/radeon/kms: never treat rs4xx as AGP + +From: Alex Deucher + +commit f95df9ca6896978108201a77422a1ae2cdc595ec upstream. + +RS4xx+ IGP chips use an internal gart, however, +some of them have the agp cap bits set in their pci +configs. Make sure to clear the AGP flag as AGP will +not work with them. + +Should fix fdo bug 27225 + +Signed-off-by: Alex Deucher +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_device.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -655,6 +655,14 @@ int radeon_device_init(struct radeon_dev + return r; + radeon_check_arguments(rdev); + ++ /* all of the newer IGP chips have an internal gart ++ * However some rs4xx report as AGP, so remove that here. ++ */ ++ if ((rdev->family >= CHIP_RS400) && ++ (rdev->flags & RADEON_IS_IGP)) { ++ rdev->flags &= ~RADEON_IS_AGP; ++ } ++ + if (rdev->flags & RADEON_IS_AGP && radeon_agpmode == -1) { + radeon_agp_disable(rdev); + } diff --git a/queue-2.6.33/drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch b/queue-2.6.33/drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch new file mode 100644 index 00000000000..b70af67d914 --- /dev/null +++ b/queue-2.6.33/drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch @@ -0,0 +1,36 @@ +From 725398322d05486109375fbb85c3404108881e17 Mon Sep 17 00:00:00 2001 +From: Zhao Yakui +Date: Thu, 4 Mar 2010 08:25:55 +0000 +Subject: drm: remove the EDID blob stored in the EDID property when it is disconnected + +From: Zhao Yakui + +commit 725398322d05486109375fbb85c3404108881e17 upstream. + +Now the EDID property will be updated when the corresponding EDID can be +obtained from the external display device. But after the external device +is plugged-out, the EDID property is not updated. In such case we still +get the corresponding EDID property although it is already detected as +disconnected. + +https://bugs.freedesktop.org/show_bug.cgi?id=26743 + +Signed-off-by: Zhao Yakui +Signed-off-by: Zhenyu Wang +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_crtc_helper.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/drm_crtc_helper.c ++++ b/drivers/gpu/drm/drm_crtc_helper.c +@@ -104,6 +104,7 @@ int drm_helper_probe_single_connector_mo + if (connector->status == connector_status_disconnected) { + DRM_DEBUG_KMS("%s is disconnected\n", + drm_get_connector_name(connector)); ++ drm_mode_connector_update_edid_property(connector, NULL); + goto prune; + } + diff --git a/queue-2.6.33/drm-return-enodev-if-the-inode-mapping-changes.patch b/queue-2.6.33/drm-return-enodev-if-the-inode-mapping-changes.patch new file mode 100644 index 00000000000..a87195630f1 --- /dev/null +++ b/queue-2.6.33/drm-return-enodev-if-the-inode-mapping-changes.patch @@ -0,0 +1,79 @@ +From da58405860b992d2bb21ebae5d685fe3204dd3f0 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 18 Mar 2010 11:56:54 +0000 +Subject: drm: Return ENODEV if the inode mapping changes + +From: Chris Wilson + +commit da58405860b992d2bb21ebae5d685fe3204dd3f0 upstream. + +Replace a BUG_ON with an error code in the event that the inode mapping +changes between calls to drm_open. This may happen for instance if udev +is loaded subsequent to the original opening of the device: + +[ 644.291870] kernel BUG at drivers/gpu/drm/drm_fops.c:146! +[ 644.291876] invalid opcode: 0000 [#1] SMP +[ 644.291882] last sysfs file: /sys/kernel/uevent_seqnum +[ 644.291888] +[ 644.291895] Pid: 7276, comm: lt-cairo-test-s Not tainted 2.6.34-rc1 #2 N150/N210/N220 /N150/N210/N220 +[ 644.291903] EIP: 0060:[] EFLAGS: 00210283 CPU: 0 +[ 644.291912] EIP is at drm_open+0x4b1/0x4e2 +[ 644.291918] EAX: f72d8d18 EBX: f790a400 ECX: f73176b8 EDX: 00000000 +[ 644.291923] ESI: f790a414 EDI: f790a414 EBP: f647ae20 ESP: f647adfc +[ 644.291929] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 +[ 644.291937] Process lt-cairo-test-s (pid: 7276, ti=f647a000 task=f73f5c80 task.ti=f647a000) +[ 644.291941] Stack: +[ 644.291945] 00000000 f7bb7400 00000080 f6451100 f73176b8 f6479214 f6451100 f73176b8 +[ 644.291957] <0> c1297ce0 f647ae34 c11c6c04 f73176b8 f7949800 00000000 f647ae54 c1080ac5 +[ 644.291969] <0> f7949800 f6451100 00000000 f6451100 f73176b8 f6452780 f647ae70 c107d1e6 +[ 644.291982] Call Trace: +[ 644.291991] [] ? drm_stub_open+0x8a/0xb8 +[ 644.292000] [] ? chrdev_open+0xef/0x106 +[ 644.292008] [] ? __dentry_open+0xd4/0x1a6 +[ 644.292015] [] ? nameidata_to_filp+0x31/0x45 +[ 644.292022] [] ? chrdev_open+0x0/0x106 +[ 644.292030] [] ? do_last+0x346/0x423 +[ 644.292037] [] ? do_filp_open+0x190/0x415 +[ 644.292046] [] ? handle_mm_fault+0x214/0x710 +[ 644.292053] [] ? do_sys_open+0x4d/0xe9 +[ 644.292061] [] ? do_page_fault+0x211/0x23f +[ 644.292068] [] ? sys_open+0x23/0x2b +[ 644.292075] [] ? sysenter_do_call+0x12/0x26 +[ 644.292079] Code: 89 f0 89 55 dc e8 8d 96 0a 00 8b 45 e0 8b 55 dc 83 78 04 01 75 28 8b 83 18 02 00 00 85 c0 74 0f 8b 4d ec 3b 81 ac 00 00 00 74 13 <0f> 0b eb fe 8b 4d ec 8b 81 ac 00 00 00 89 83 18 02 00 00 89 f0 +[ 644.292143] EIP: [] drm_open+0x4b1/0x4e2 SS:ESP 0068:f647adfc +[ 644.292175] ---[ end trace 2ddd476af89a60fa ]--- + +Signed-off-by: Chris Wilson +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_fops.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/drm_fops.c ++++ b/drivers/gpu/drm/drm_fops.c +@@ -140,14 +140,16 @@ int drm_open(struct inode *inode, struct + spin_unlock(&dev->count_lock); + } + out: +- mutex_lock(&dev->struct_mutex); +- if (minor->type == DRM_MINOR_LEGACY) { +- BUG_ON((dev->dev_mapping != NULL) && +- (dev->dev_mapping != inode->i_mapping)); +- if (dev->dev_mapping == NULL) +- dev->dev_mapping = inode->i_mapping; ++ if (!retcode) { ++ mutex_lock(&dev->struct_mutex); ++ if (minor->type == DRM_MINOR_LEGACY) { ++ if (dev->dev_mapping == NULL) ++ dev->dev_mapping = inode->i_mapping; ++ else if (dev->dev_mapping != inode->i_mapping) ++ retcode = -ENODEV; ++ } ++ mutex_unlock(&dev->struct_mutex); + } +- mutex_unlock(&dev->struct_mutex); + + return retcode; + } diff --git a/queue-2.6.33/fat-fix-buffer-overflow-in-vfat_create_shortname.patch b/queue-2.6.33/fat-fix-buffer-overflow-in-vfat_create_shortname.patch new file mode 100644 index 00000000000..bbf63dcb405 --- /dev/null +++ b/queue-2.6.33/fat-fix-buffer-overflow-in-vfat_create_shortname.patch @@ -0,0 +1,56 @@ +From 30d1872d9eb3663b4cf7bdebcbf5cd465674cced Mon Sep 17 00:00:00 2001 +From: Nikolaus Schulz +Date: Thu, 1 Apr 2010 02:21:10 +0900 +Subject: fat: fix buffer overflow in vfat_create_shortname() + +From: Nikolaus Schulz + +commit 30d1872d9eb3663b4cf7bdebcbf5cd465674cced upstream. + +When using the string representation of a random counter as part of the base +name, ensure that it is no longer than 4 bytes. + +Since we are repeatedly decrementing the counter in a loop until we have found a +unique base name, the counter may wrap around zero; therefore, it is not enough +to mask its higher bits before entering the loop, this must be done inside the +loop. + +[hirofumi@mail.parknet.co.jp: use snprintf()] +Signed-off-by: Nikolaus Schulz +Signed-off-by: OGAWA Hirofumi +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fat/namei_vfat.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/fat/namei_vfat.c ++++ b/fs/fat/namei_vfat.c +@@ -309,7 +309,7 @@ static int vfat_create_shortname(struct + { + struct fat_mount_options *opts = &MSDOS_SB(dir->i_sb)->options; + wchar_t *ip, *ext_start, *end, *name_start; +- unsigned char base[9], ext[4], buf[8], *p; ++ unsigned char base[9], ext[4], buf[5], *p; + unsigned char charbuf[NLS_MAX_CHARSET_SIZE]; + int chl, chi; + int sz = 0, extlen, baselen, i, numtail_baselen, numtail2_baselen; +@@ -467,7 +467,7 @@ static int vfat_create_shortname(struct + return 0; + } + +- i = jiffies & 0xffff; ++ i = jiffies; + sz = (jiffies >> 16) & 0x7; + if (baselen > 2) { + baselen = numtail2_baselen; +@@ -476,7 +476,7 @@ static int vfat_create_shortname(struct + name_res[baselen + 4] = '~'; + name_res[baselen + 5] = '1' + sz; + while (1) { +- sprintf(buf, "%04X", i); ++ snprintf(buf, sizeof(buf), "%04X", i & 0xffff); + memcpy(&name_res[baselen], buf, 4); + if (vfat_find_form(dir, name_res) < 0) + break; diff --git a/queue-2.6.33/oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch b/queue-2.6.33/oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch new file mode 100644 index 00000000000..8d4f247fed2 --- /dev/null +++ b/queue-2.6.33/oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch @@ -0,0 +1,52 @@ +From b95c35e76b29ba812e5dabdd91592e25ec640e93 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 1 Apr 2010 15:13:57 +0200 +Subject: oom: fix the unsafe usage of badness() in proc_oom_score() + +From: Oleg Nesterov + +commit b95c35e76b29ba812e5dabdd91592e25ec640e93 upstream. + +proc_oom_score(task) has a reference to task_struct, but that is all. +If this task was already released before we take tasklist_lock + + - we can't use task->group_leader, it points to nowhere + + - it is not safe to call badness() even if this task is + ->group_leader, has_intersects_mems_allowed() assumes + it is safe to iterate over ->thread_group list. + + - even worse, badness() can hit ->signal == NULL + +Add the pid_alive() check to ensure __unhash_process() was not called. + +Also, use "task" instead of task->group_leader. badness() should return +the same result for any sub-thread. Currently this is not true, but +this should be changed anyway. + +Signed-off-by: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -442,12 +442,13 @@ static const struct file_operations proc + unsigned long badness(struct task_struct *p, unsigned long uptime); + static int proc_oom_score(struct task_struct *task, char *buffer) + { +- unsigned long points; ++ unsigned long points = 0; + struct timespec uptime; + + do_posix_clock_monotonic_gettime(&uptime); + read_lock(&tasklist_lock); +- points = badness(task->group_leader, uptime.tv_sec); ++ if (pid_alive(task)) ++ points = badness(task, uptime.tv_sec); + read_unlock(&tasklist_lock); + return sprintf(buffer, "%lu\n", points); + } diff --git a/queue-2.6.33/series b/queue-2.6.33/series new file mode 100644 index 00000000000..c059936fec3 --- /dev/null +++ b/queue-2.6.33/series @@ -0,0 +1,11 @@ +drm-edid-allow-certain-bogus-edids-to-hit-a-fixup-path-rather-than-fail.patch +drm-radeon-add-new-rs880-pci-id.patch +drm-remove-the-edid-blob-stored-in-the-edid-property-when-it-is-disconnected.patch +fat-fix-buffer-overflow-in-vfat_create_shortname.patch +oom-fix-the-unsafe-usage-of-badness-in-proc_oom_score.patch +drm-radeon-kms-never-treat-rs4xx-as-agp.patch +drm-radeon-kms-fix-null-pointer-dereference-if-memory-allocation-failed.patch +drm-radeon-kms-don-t-print-error-on-erestartsys.patch +drm-radeon-kms-fix-pal-tv-out-support-on-legacy-igp-chips.patch +drm-return-enodev-if-the-inode-mapping-changes.patch +drm-radeon-kms-atom-spread-spectrum-fix.patch -- 2.47.3