diff --git a/drm-i915-dp-stfu.patch b/drm-i915-dp-stfu.patch index 8948229..c005a06 100644 --- a/drm-i915-dp-stfu.patch +++ b/drm-i915-dp-stfu.patch @@ -1,21 +1,8 @@ -From 04a43e2598db35b3d0ec25925bb8475b5c0a3809 Mon Sep 17 00:00:00 2001 -From: Adam Jackson -Date: Fri, 16 Mar 2012 16:39:11 -0400 -Subject: [PATCH] drm/i915/dp: Use DRM_ERROR not WARN for sanity checks - -These are noisy as shit and creating a ton of abrt reports. I don't -need more, thanks. Proper fix upstream eventually. - -Signed-off-by: Adam Jackson ---- - drivers/gpu/drm/i915/intel_dp.c | 14 ++++++++------ - 1 files changed, 8 insertions(+), 6 deletions(-) - diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c -index 94f860c..6bf27c9 100644 +index 296cfc2..516e1e2 100644 --- a/drivers/gpu/drm/i915/intel_dp.c +++ b/drivers/gpu/drm/i915/intel_dp.c -@@ -331,7 +331,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp) +@@ -350,7 +350,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp) if (!is_edp(intel_dp)) return; if (!ironlake_edp_have_panel_power(intel_dp) && !ironlake_edp_have_panel_vdd(intel_dp)) { @@ -24,7 +11,7 @@ index 94f860c..6bf27c9 100644 DRM_DEBUG_KMS("Status 0x%08x Control 0x%08x\n", I915_READ(PCH_PP_STATUS), I915_READ(PCH_PP_CONTROL)); -@@ -386,7 +386,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, +@@ -400,7 +400,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp, } if (try == 3) { @@ -33,7 +20,7 @@ index 94f860c..6bf27c9 100644 I915_READ(ch_ctl)); return -EBUSY; } -@@ -992,8 +992,8 @@ static void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp) +@@ -1024,8 +1024,8 @@ static void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp) return; DRM_DEBUG_KMS("Turn eDP VDD on\n"); @@ -44,7 +31,7 @@ index 94f860c..6bf27c9 100644 intel_dp->want_panel_vdd = true; -@@ -1058,7 +1058,8 @@ static void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync) +@@ -1090,7 +1090,8 @@ static void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync) return; DRM_DEBUG_KMS("Turn eDP VDD off %d\n", intel_dp->want_panel_vdd); @@ -54,16 +41,13 @@ index 94f860c..6bf27c9 100644 intel_dp->want_panel_vdd = false; -@@ -1128,7 +1129,8 @@ static void ironlake_edp_panel_off(struct intel_dp *intel_dp) +@@ -1160,7 +1161,8 @@ static void ironlake_edp_panel_off(struct intel_dp *intel_dp) DRM_DEBUG_KMS("Turn eDP power off\n"); -- WARN(intel_dp->want_panel_vdd, "Cannot turn power off while VDD is on\n"); -+ if (intel_dp->want_panel_vdd) -+ DRM_ERROR("Cannot turn power off while VDD is on\n"); +- WARN(!intel_dp->want_panel_vdd, "Need VDD to turn off panel\n"); ++ if (!intel_dp->want_panel_vdd) ++ DRM_ERROR("Need VDD to turn off panel\n"); pp = ironlake_get_pp_control(dev_priv); - pp &= ~(POWER_TARGET_ON | EDP_FORCE_VDD | PANEL_POWER_RESET | EDP_BLC_ENABLE); --- -1.7.7.6 - + pp &= ~(POWER_TARGET_ON | PANEL_POWER_RESET | EDP_BLC_ENABLE); diff --git a/hugetlb-fix-resv_map-leak-in-error-path.patch b/hugetlb-fix-resv_map-leak-in-error-path.patch deleted file mode 100644 index 888d5ce..0000000 --- a/hugetlb-fix-resv_map-leak-in-error-path.patch +++ /dev/null @@ -1,176 +0,0 @@ -From c50ac050811d6485616a193eb0f37bfbd191cc89 Mon Sep 17 00:00:00 2001 -From: Dave Hansen -Date: Tue, 29 May 2012 15:06:46 -0700 -Subject: [PATCH] hugetlb: fix resv_map leak in error path - -When called for anonymous (non-shared) mappings, hugetlb_reserve_pages() -does a resv_map_alloc(). It depends on code in hugetlbfs's -vm_ops->close() to release that allocation. - -However, in the mmap() failure path, we do a plain unmap_region() without -the remove_vma() which actually calls vm_ops->close(). - -This is a decent fix. This leak could get reintroduced if new code (say, -after hugetlb_reserve_pages() in hugetlbfs_file_mmap()) decides to return -an error. But, I think it would have to unroll the reservation anyway. - -Christoph's test case: - - http://marc.info/?l=linux-mm&m=133728900729735 - -This patch applies to 3.4 and later. A version for earlier kernels is at -https://lkml.org/lkml/2012/5/22/418. - -Signed-off-by: Dave Hansen -Acked-by: Mel Gorman -Acked-by: KOSAKI Motohiro -Reported-by: Christoph Lameter -Tested-by: Christoph Lameter -Cc: Andrea Arcangeli -Cc: [2.6.32+] -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds ---- - mm/hugetlb.c | 28 ++++++++++++++++++++++------ - 1 files changed, 22 insertions(+), 6 deletions(-) - -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 41a647d..285a81e 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -2157,6 +2157,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma) - kref_get(&reservations->refs); - } - -+static void resv_map_put(struct vm_area_struct *vma) -+{ -+ struct resv_map *reservations = vma_resv_map(vma); -+ -+ if (!reservations) -+ return; -+ kref_put(&reservations->refs, resv_map_release); -+} -+ - static void hugetlb_vm_op_close(struct vm_area_struct *vma) - { - struct hstate *h = hstate_vma(vma); -@@ -2173,7 +2182,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma) - reserve = (end - start) - - region_count(&reservations->regions, start, end); - -- kref_put(&reservations->refs, resv_map_release); -+ resv_map_put(vma); - - if (reserve) { - hugetlb_acct_memory(h, -reserve); -@@ -2991,12 +3000,16 @@ int hugetlb_reserve_pages(struct inode *inode, - set_vma_resv_flags(vma, HPAGE_RESV_OWNER); - } - -- if (chg < 0) -- return chg; -+ if (chg < 0) { -+ ret = chg; -+ goto out_err; -+ } - - /* There must be enough pages in the subpool for the mapping */ -- if (hugepage_subpool_get_pages(spool, chg)) -- return -ENOSPC; -+ if (hugepage_subpool_get_pages(spool, chg)) { -+ ret = -ENOSPC; -+ goto out_err; -+ } - - /* - * Check enough hugepages are available for the reservation. -@@ -3005,7 +3018,7 @@ int hugetlb_reserve_pages(struct inode *inode, - ret = hugetlb_acct_memory(h, chg); - if (ret < 0) { - hugepage_subpool_put_pages(spool, chg); -- return ret; -+ goto out_err; - } - - /* -@@ -3022,6 +3035,9 @@ int hugetlb_reserve_pages(struct inode *inode, - if (!vma || vma->vm_flags & VM_MAYSHARE) - region_add(&inode->i_mapping->private_list, from, to); - return 0; -+out_err: -+ resv_map_put(vma); -+ return ret; - } - - void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed) --- -1.7.7.6 - -From 4523e1458566a0e8ecfaff90f380dd23acc44d27 Mon Sep 17 00:00:00 2001 -From: Dave Hansen -Date: Wed, 30 May 2012 07:51:07 -0700 -Subject: [PATCH] mm: fix vma_resv_map() NULL pointer - -hugetlb_reserve_pages() can be used for either normal file-backed -hugetlbfs mappings, or MAP_HUGETLB. In the MAP_HUGETLB, semi-anonymous -mode, there is not a VMA around. The new call to resv_map_put() assumed -that there was, and resulted in a NULL pointer dereference: - - BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 - IP: vma_resv_map+0x9/0x30 - PGD 141453067 PUD 1421e1067 PMD 0 - Oops: 0000 [#1] PREEMPT SMP - ... - Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36 - RIP: vma_resv_map+0x9/0x30 - ... - Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0) - Call Trace: - resv_map_put+0xe/0x40 - hugetlb_reserve_pages+0xa6/0x1d0 - hugetlb_file_setup+0x102/0x2c0 - newseg+0x115/0x360 - ipcget+0x1ce/0x310 - sys_shmget+0x5a/0x60 - system_call_fastpath+0x16/0x1b - -This was reported by Dave Jones, but was reproducible with the -libhugetlbfs test cases, so shame on me for not running them in the -first place. - -With this, the oops is gone, and the output of libhugetlbfs's -run_tests.py is identical to plain 3.4 again. - -[ Marked for stable, since this was introduced by commit c50ac050811d - ("hugetlb: fix resv_map leak in error path") which was also marked for - stable ] - -Reported-by: Dave Jones -Cc: Mel Gorman -Cc: KOSAKI Motohiro -Cc: Christoph Lameter -Cc: Andrea Arcangeli -Cc: Andrew Morton -Cc: [2.6.32+] -Signed-off-by: Linus Torvalds ---- - mm/hugetlb.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 285a81e..e198831 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3036,7 +3036,8 @@ int hugetlb_reserve_pages(struct inode *inode, - region_add(&inode->i_mapping->private_list, from, to); - return 0; - out_err: -- resv_map_put(vma); -+ if (vma) -+ resv_map_put(vma); - return ret; - } - --- -1.7.7.6 - diff --git a/kernel.spec b/kernel.spec index aaec35a..f132855 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 3 +%global baserelease 1 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -66,7 +66,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 1 +%define stable_update 2 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -769,9 +769,6 @@ Patch22019: rtl818x-fix-sleeping-function-called-from-invalid-context.patch #rhbz 822825 822821 CVE-2012-2372 Patch22021: mm-pmd_read_atomic-fix-32bit-PAE-pmd-walk-vs-pmd_populate-SMP-race-condition.patch -#rhbz 824352 824345 CVE-2012-2390 -Patch22022: hugetlb-fix-resv_map-leak-in-error-path.patch - # END OF PATCH DEFINITIONS %endif @@ -1481,9 +1478,6 @@ ApplyPatch rtl818x-fix-sleeping-function-called-from-invalid-context.patch #rhbz 822825 822821 CVE-2012-2372 ApplyPatch mm-pmd_read_atomic-fix-32bit-PAE-pmd-walk-vs-pmd_populate-SMP-race-condition.patch -#rhbz 824352 824345 CVE-2012-2390 -ApplyPatch hugetlb-fix-resv_map-leak-in-error-path.patch - # END OF PATCH APPLICATIONS %endif @@ -2338,6 +2332,9 @@ fi # '-' | | # '-' %changelog +* Sat Jun 09 2012 Josh Boyer 3.4.2-1 +- Linux v3.4.2 + * Fri Jun 08 2012 Josh Boyer - Enable HV assisted KVM on ppc64 diff --git a/sources b/sources index 425eaf4..cd36471 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ 967f72983655e2479f951195953e8480 linux-3.4.tar.xz -52adc59c547c4c7926686145b9ade5f1 patch-3.4.1.xz +ac52d3d82c20c7e80740fc5fb00b6ed4 patch-3.4.2.xz