From 763201715b226f84e4a753db18bee40c0f349d15 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Fri, 11 May 2012 22:47:31 +0000 Subject: [PATCH] Update to 3.2.17 svn path=/dists/sid/linux-2.6/; revision=18989 --- debian/changelog | 5 +- .../Don-t-limit-non-nested-epoll-paths.patch | 42 ---- ...t-the-LOCK-code-sets-exception-inode.patch | 52 ----- ...t-we-check-lock-exclusive-shared-typ.patch | 44 ----- .../all/net-fix-proc-net-dev-regression.patch | 183 ------------------ ...rk-around-unhappy-compat-problem-on-.patch | 132 ------------- ...r-overflow-in-i915_gem_do_execbuffer.patch | 38 ---- ...ger-overflow-in-i915_gem_execbuffer2.patch | 37 ---- .../rt2x00-Identify-rt2800usb-chipsets.patch | 146 -------------- ...-boottime-locate_handle-search-types.patch | 12 +- debian/patches/series/base | 9 - 11 files changed, 9 insertions(+), 691 deletions(-) delete mode 100644 debian/patches/bugfix/all/Don-t-limit-non-nested-epoll-paths.patch delete mode 100644 debian/patches/bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch delete mode 100644 debian/patches/bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch delete mode 100644 debian/patches/bugfix/all/net-fix-proc-net-dev-regression.patch delete mode 100644 debian/patches/bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch delete mode 100644 debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch delete mode 100644 debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch delete mode 100644 debian/patches/features/all/rt2x00-Identify-rt2800usb-chipsets.patch diff --git a/debian/changelog b/debian/changelog index f8c7fdaa8..8ac0894a6 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,7 @@ -linux-2.6 (3.2.16-2) UNRELEASED; urgency=low +linux-2.6 (3.2.17-1) UNRELEASED; urgency=low + + * New upstream stable update: + http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.17 [ Ben Hutchings ] * aufs: Enable AUFS_EXPORT diff --git a/debian/patches/bugfix/all/Don-t-limit-non-nested-epoll-paths.patch b/debian/patches/bugfix/all/Don-t-limit-non-nested-epoll-paths.patch deleted file mode 100644 index a30836e00..000000000 --- a/debian/patches/bugfix/all/Don-t-limit-non-nested-epoll-paths.patch +++ /dev/null @@ -1,42 +0,0 @@ -From: Jason Baron -Date: Fri, 16 Mar 2012 16:34:03 -0400 -Subject: [PATCH] Don't limit non-nested epoll paths - -commit 93dc6107a76daed81c07f50215fa6ae77691634f upstream. - -Commit 28d82dc1c4ed ("epoll: limit paths") that I did to limit the -number of possible wakeup paths in epoll is causing a few applications -to longer work (dovecot for one). - -The original patch is really about limiting the amount of epoll nesting -(since epoll fds can be attached to other fds). Thus, we probably can -allow an unlimited number of paths of depth 1. My current patch limits -it at 1000. And enforce the limits on paths that have a greater depth. - -This is captured in: https://bugzilla.redhat.com/show_bug.cgi?id=681578 - -Signed-off-by: Jason Baron -Cc: Andrew Morton -Signed-off-by: Linus Torvalds ---- - fs/eventpoll.c | 4 ++++ - 1 files changed, 4 insertions(+), 0 deletions(-) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index ea54cde..4d9d3a4 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE]; - - static int path_count_inc(int nests) - { -+ /* Allow an arbitrary number of depth 1 paths */ -+ if (nests == 0) -+ return 0; -+ - if (++path_count[nests] > path_limits[nests]) - return -1; - return 0; --- -1.7.9.1 - diff --git a/debian/patches/bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch b/debian/patches/bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch deleted file mode 100644 index 6a9e5b9d5..000000000 --- a/debian/patches/bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch +++ /dev/null @@ -1,52 +0,0 @@ -From: Trond Myklebust -Date: Wed, 18 Apr 2012 12:20:10 -0400 -Subject: [PATCH 1/2] NFSv4: Ensure that the LOCK code sets exception->inode - -commit 05ffe24f5290dc095f98fbaf84afe51ef404ccc5 upstream. - -All callers of nfs4_handle_exception() that need to handle -NFS4ERR_OPENMODE correctly should set exception->inode - -Signed-off-by: Trond Myklebust -Cc: stable@vger.kernel.org ---- - fs/nfs/nfs4proc.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index f82bde0..3c787d0 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -4558,7 +4558,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f - static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request) - { - struct nfs_server *server = NFS_SERVER(state->inode); -- struct nfs4_exception exception = { }; -+ struct nfs4_exception exception = { -+ .inode = state->inode, -+ }; - int err; - - do { -@@ -4576,7 +4578,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request - static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request) - { - struct nfs_server *server = NFS_SERVER(state->inode); -- struct nfs4_exception exception = { }; -+ struct nfs4_exception exception = { -+ .inode = state->inode, -+ }; - int err; - - err = nfs4_set_lock_state(state, request); -@@ -4676,6 +4680,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock * - { - struct nfs4_exception exception = { - .state = state, -+ .inode = state->inode, - }; - int err; - --- -1.7.10 - diff --git a/debian/patches/bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch b/debian/patches/bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch deleted file mode 100644 index 8eda0d139..000000000 --- a/debian/patches/bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch +++ /dev/null @@ -1,44 +0,0 @@ -From: Trond Myklebust -Date: Wed, 18 Apr 2012 12:48:35 -0400 -Subject: [PATCH 2/2] NFSv4: Ensure that we check lock exclusive/shared type - against open modes - -commit 55725513b5ef9d462aa3e18527658a0362aaae83 upstream. - -Since we may be simulating flock() locks using NFS byte range locks, -we can't rely on the VFS having checked the file open mode for us. - -Signed-off-by: Trond Myklebust -Cc: stable@vger.kernel.org ---- - fs/nfs/nfs4proc.c | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 3c787d0..ba837d9 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -4726,6 +4726,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request) - - if (state == NULL) - return -ENOLCK; -+ /* -+ * Don't rely on the VFS having checked the file open mode, -+ * since it won't do this for flock() locks. -+ */ -+ switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) { -+ case F_RDLCK: -+ if (!(filp->f_mode & FMODE_READ)) -+ return -EBADF; -+ break; -+ case F_WRLCK: -+ if (!(filp->f_mode & FMODE_WRITE)) -+ return -EBADF; -+ } -+ - do { - status = nfs4_proc_setlk(state, cmd, request); - if ((status != -EAGAIN) || IS_SETLK(cmd)) --- -1.7.10 - diff --git a/debian/patches/bugfix/all/net-fix-proc-net-dev-regression.patch b/debian/patches/bugfix/all/net-fix-proc-net-dev-regression.patch deleted file mode 100644 index 2bc8b2ead..000000000 --- a/debian/patches/bugfix/all/net-fix-proc-net-dev-regression.patch +++ /dev/null @@ -1,183 +0,0 @@ -From: Eric Dumazet -Date: Mon, 2 Apr 2012 22:33:02 +0000 -Subject: [PATCH] net: fix /proc/net/dev regression - -commit 2def16ae6b0c77571200f18ba4be049b03d75579 upstream. - -Commit f04565ddf52 (dev: use name hash for dev_seq_ops) added a second -regression, as some devices are missing from /proc/net/dev if many -devices are defined. - -When seq_file buffer is filled, the last ->next/show() method is -canceled (pos value is reverted to value prior ->next() call) - -Problem is after above commit, we dont restart the lookup at right -position in ->start() method. - -Fix this by removing the internal 'pos' pointer added in commit, since -we need to use the 'loff_t *pos' provided by seq_file layer. - -This also reverts commit 5cac98dd0 (net: Fix corruption -in /proc/*/net/dev_mcast), since its not needed anymore. - -Reported-by: Ben Greear -Signed-off-by: Eric Dumazet -Cc: Mihai Maruseac -Tested-by: Ben Greear -Signed-off-by: David S. Miller ---- - include/linux/netdevice.h | 2 -- - net/core/dev.c | 58 ++++++++++----------------------------------- - net/core/dev_addr_lists.c | 3 ++- - 3 files changed, 15 insertions(+), 48 deletions(-) - -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 1f77540..5cbaa20 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -2604,8 +2604,6 @@ extern void net_disable_timestamp(void); - extern void *dev_seq_start(struct seq_file *seq, loff_t *pos); - extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos); - extern void dev_seq_stop(struct seq_file *seq, void *v); --extern int dev_seq_open_ops(struct inode *inode, struct file *file, -- const struct seq_operations *ops); - #endif - - extern int netdev_class_create_file(struct class_attribute *class_attr); -diff --git a/net/core/dev.c b/net/core/dev.c -index 6c7dc9d..c25d453 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4028,54 +4028,41 @@ static int dev_ifconf(struct net *net, char __user *arg) - - #ifdef CONFIG_PROC_FS - --#define BUCKET_SPACE (32 - NETDEV_HASHBITS) -- --struct dev_iter_state { -- struct seq_net_private p; -- unsigned int pos; /* bucket << BUCKET_SPACE + offset */ --}; -+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1) - - #define get_bucket(x) ((x) >> BUCKET_SPACE) - #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1)) - #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o)) - --static inline struct net_device *dev_from_same_bucket(struct seq_file *seq) -+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos) - { -- struct dev_iter_state *state = seq->private; - struct net *net = seq_file_net(seq); - struct net_device *dev; - struct hlist_node *p; - struct hlist_head *h; -- unsigned int count, bucket, offset; -+ unsigned int count = 0, offset = get_offset(*pos); - -- bucket = get_bucket(state->pos); -- offset = get_offset(state->pos); -- h = &net->dev_name_head[bucket]; -- count = 0; -+ h = &net->dev_name_head[get_bucket(*pos)]; - hlist_for_each_entry_rcu(dev, p, h, name_hlist) { -- if (count++ == offset) { -- state->pos = set_bucket_offset(bucket, count); -+ if (++count == offset) - return dev; -- } - } - - return NULL; - } - --static inline struct net_device *dev_from_new_bucket(struct seq_file *seq) -+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos) - { -- struct dev_iter_state *state = seq->private; - struct net_device *dev; - unsigned int bucket; - -- bucket = get_bucket(state->pos); - do { -- dev = dev_from_same_bucket(seq); -+ dev = dev_from_same_bucket(seq, pos); - if (dev) - return dev; - -- bucket++; -- state->pos = set_bucket_offset(bucket, 0); -+ bucket = get_bucket(*pos) + 1; -+ *pos = set_bucket_offset(bucket, 1); - } while (bucket < NETDEV_HASHENTRIES); - - return NULL; -@@ -4088,33 +4075,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq) - void *dev_seq_start(struct seq_file *seq, loff_t *pos) - __acquires(RCU) - { -- struct dev_iter_state *state = seq->private; -- - rcu_read_lock(); - if (!*pos) - return SEQ_START_TOKEN; - -- /* check for end of the hash */ -- if (state->pos == 0 && *pos > 1) -+ if (get_bucket(*pos) >= NETDEV_HASHENTRIES) - return NULL; - -- return dev_from_new_bucket(seq); -+ return dev_from_bucket(seq, pos); - } - - void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos) - { -- struct net_device *dev; -- - ++*pos; -- -- if (v == SEQ_START_TOKEN) -- return dev_from_new_bucket(seq); -- -- dev = dev_from_same_bucket(seq); -- if (dev) -- return dev; -- -- return dev_from_new_bucket(seq); -+ return dev_from_bucket(seq, pos); - } - - void dev_seq_stop(struct seq_file *seq, void *v) -@@ -4213,13 +4187,7 @@ static const struct seq_operations dev_seq_ops = { - static int dev_seq_open(struct inode *inode, struct file *file) - { - return seq_open_net(inode, file, &dev_seq_ops, -- sizeof(struct dev_iter_state)); --} -- --int dev_seq_open_ops(struct inode *inode, struct file *file, -- const struct seq_operations *ops) --{ -- return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state)); -+ sizeof(struct seq_net_private)); - } - - static const struct file_operations dev_seq_fops = { -diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c -index 29c07fe..626698f 100644 ---- a/net/core/dev_addr_lists.c -+++ b/net/core/dev_addr_lists.c -@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = { - - static int dev_mc_seq_open(struct inode *inode, struct file *file) - { -- return dev_seq_open_ops(inode, file, &dev_mc_seq_ops); -+ return seq_open_net(inode, file, &dev_mc_seq_ops, -+ sizeof(struct seq_net_private)); - } - - static const struct file_operations dev_mc_seq_fops = { --- -1.7.9.5 - diff --git a/debian/patches/bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch b/debian/patches/bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch deleted file mode 100644 index 7e752733f..000000000 --- a/debian/patches/bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch +++ /dev/null @@ -1,132 +0,0 @@ -From: Linus Torvalds -Date: Sat, 28 Apr 2012 08:29:56 -0700 -Subject: [PATCH] Revert "autofs: work around unhappy compat problem on - x86-64" - -commit fcbf94b9dedd2ce08e798a99aafc94fec8668161 upstream. - -This reverts commit a32744d4abae24572eff7269bc17895c41bd0085. - -While that commit was technically the right thing to do, and made the -x86-64 compat mode work identically to native 32-bit mode (and thus -fixing the problem with a 32-bit systemd install on a 64-bit kernel), it -turns out that the automount binaries had workarounds for this compat -problem. - -Now, the workarounds are disgusting: doing an "uname()" to find out the -architecture of the kernel, and then comparing it for the 64-bit cases -and fixing up the size of the read() in automount for those. And they -were confused: it's not actually a generic 64-bit issue at all, it's -very much tied to just x86-64, which has different alignment for an -'u64' in 64-bit mode than in 32-bit mode. - -But the end result is that fixing the compat layer actually breaks the -case of a 32-bit automount on a x86-64 kernel. - -There are various approaches to fix this (including just doing a -"strcmp()" on current->comm and comparing it to "automount"), but I -think that I will do the one that teaches pipes about a special "packet -mode", which will allow user space to not have to care too deeply about -the padding at the end of the autofs packet. - -That change will make the compat workaround unnecessary, so let's revert -it first, and get automount working again in compat mode. The -packetized pipes will then fix autofs for systemd. - -Reported-and-requested-by: Michael Tokarev -Cc: Ian Kent -Cc: stable@kernel.org # for 3.3 -Signed-off-by: Linus Torvalds -[bwh: Backported to 3.2: adjust context] ---- - fs/autofs4/autofs_i.h | 1 - - fs/autofs4/dev-ioctl.c | 1 - - fs/autofs4/inode.c | 2 -- - fs/autofs4/waitq.c | 22 +++------------------- - 4 files changed, 3 insertions(+), 23 deletions(-) - -diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h -index eb1cc92..d8d8e7b 100644 ---- a/fs/autofs4/autofs_i.h -+++ b/fs/autofs4/autofs_i.h -@@ -110,7 +110,6 @@ struct autofs_sb_info { - int sub_version; - int min_proto; - int max_proto; -- int compat_daemon; - unsigned long exp_timeout; - unsigned int type; - int reghost_enabled; -diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c -index 9dacb85..3dfd615 100644 ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp, - sbi->pipefd = pipefd; - sbi->pipe = pipe; - sbi->catatonic = 0; -- sbi->compat_daemon = is_compat_task(); - } - out: - mutex_unlock(&sbi->wq_mutex); ---- a/fs/autofs4/inode.c -+++ b/fs/autofs4/inode.c -@@ -19,7 +19,6 @@ - #include - #include - #include --#include - #include "autofs_i.h" - #include - -@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) - set_autofs_type_indirect(&sbi->type); - sbi->min_proto = 0; - sbi->max_proto = 0; -- sbi->compat_daemon = is_compat_task(); - mutex_init(&sbi->wq_mutex); - spin_lock_init(&sbi->fs_lock); - sbi->queues = NULL; -diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c -index 9c098db..da8876d 100644 ---- a/fs/autofs4/waitq.c -+++ b/fs/autofs4/waitq.c -@@ -91,24 +91,7 @@ static int autofs4_write(struct autofs_sb_info *sbi, - - return (bytes > 0); - } -- --/* -- * The autofs_v5 packet was misdesigned. -- * -- * The packets are identical on x86-32 and x86-64, but have different -- * alignment. Which means that 'sizeof()' will give different results. -- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel. -- */ --static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi) --{ -- size_t pktsz = sizeof(struct autofs_v5_packet); --#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT) -- if (sbi->compat_daemon > 0) -- pktsz -= 4; --#endif -- return pktsz; --} -- -+ - static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - struct autofs_wait_queue *wq, - int type) -@@ -172,7 +155,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - { - struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet; - -- pktsz = autofs_v5_packet_size(sbi); -+ pktsz = sizeof(*packet); -+ - packet->wait_queue_token = wq->wait_queue_token; - packet->len = wq->name.len; - memcpy(packet->name, wq->name.name, wq->name.len); --- -1.7.10 - diff --git a/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch b/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch deleted file mode 100644 index 032ac89ac..000000000 --- a/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch +++ /dev/null @@ -1,38 +0,0 @@ -From: Xi Wang -Date: Mon, 23 Apr 2012 04:06:42 -0400 -Message-Id: <1335168402-25174-2-git-send-email-xi.wang@gmail.com> -Subject: [PATCH v2 2/2] drm/i915: fix integer overflow in - i915_gem_do_execbuffer() - -On 32-bit systems, a large args->num_cliprects from userspace via ioctl -may overflow the allocation size, leading to out-of-bounds access. - -This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid -allocation for execbuffer object list"). - -Signed-off-by: Xi Wang -Cc: Chris Wilson -Cc: stable@vger.kernel.org ---- - drivers/gpu/drm/i915/i915_gem_execbuffer.c | 5 +++++ - 1 files changed, 5 insertions(+), 0 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index 7c50e58..de43194 100644 ---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -@@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data, - return -EINVAL; - } - -+ if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) { -+ DRM_DEBUG("execbuf with %u cliprects\n", -+ args->num_cliprects); -+ return -EINVAL; -+ } - cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), - GFP_KERNEL); - if (cliprects == NULL) { --- -1.7.5.4 - diff --git a/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch b/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch deleted file mode 100644 index bb39a6254..000000000 --- a/debian/patches/bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Xi Wang -Date: Mon, 23 Apr 2012 04:06:41 -0400 -Message-Id: <1335168402-25174-1-git-send-email-xi.wang@gmail.com> -Subject: [PATCH v2 1/2] drm/i915: fix integer overflow in - i915_gem_execbuffer2() - -On 32-bit systems, a large args->buffer_count from userspace via ioctl -may overflow the allocation size, leading to out-of-bounds access. - -This vulnerability was introduced in commit 8408c282 ("drm/i915: -First try a normal large kmalloc for the temporary exec buffers"). - -Signed-off-by: Xi Wang -Cc: Chris Wilson -Cc: stable@vger.kernel.org -[bwh: Backported to 3.2: adjust context] ---- - drivers/gpu/drm/i915/i915_gem_execbuffer.c | 3 ++- - 1 files changed, 2 insertions(+), 1 deletions(-) - -diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -index f51a696..7c50e58 100644 ---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c -+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c -@@ -1404,7 +1404,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data, - struct drm_i915_gem_exec_object2 *exec2_list = NULL; - int ret; - -- if (args->buffer_count < 1) { -+ if (args->buffer_count < 1 || -+ args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { - DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count); - return -EINVAL; - } --- -1.7.5.4 - diff --git a/debian/patches/features/all/rt2x00-Identify-rt2800usb-chipsets.patch b/debian/patches/features/all/rt2x00-Identify-rt2800usb-chipsets.patch deleted file mode 100644 index f4522129d..000000000 --- a/debian/patches/features/all/rt2x00-Identify-rt2800usb-chipsets.patch +++ /dev/null @@ -1,146 +0,0 @@ -From: Gertjan van Wingerde -Date: Wed, 28 Dec 2011 01:53:18 +0100 -Subject: [PATCH] rt2x00: Identify rt2800usb chipsets. - -commit bc93eda7e903ff75cefcb6e247ed9b8e9f8e9783 upstream. - -According to the latest USB ID database these are all RT2770 / RT2870 / RT307x -devices. - -Signed-off-by: Gertjan van Wingerde -Acked-by: Ivo van Doorn -Signed-off-by: John W. Linville -[bwh: Backported to 3.2: adjust context for previously cherry-picked - commit d42a179b941a9e4cc6cf41d0f3cbadd75fc48a89 'rt2x00: Add support - for D-Link DWA-127 to rt2800usb'] ---- - drivers/net/wireless/rt2x00/rt2800usb.c | 26 ++++++++++++-------------- - 1 file changed, 12 insertions(+), 14 deletions(-) - -diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c -index 486fd49..5bff495 100644 ---- a/drivers/net/wireless/rt2x00/rt2800usb.c -+++ b/drivers/net/wireless/rt2x00/rt2800usb.c -@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x050d, 0x8053) }, - { USB_DEVICE(0x050d, 0x805c) }, - { USB_DEVICE(0x050d, 0x815c) }, -+ { USB_DEVICE(0x050d, 0x825a) }, - { USB_DEVICE(0x050d, 0x825b) }, - { USB_DEVICE(0x050d, 0x935a) }, - { USB_DEVICE(0x050d, 0x935b) }, - /* Buffalo */ - { USB_DEVICE(0x0411, 0x00e8) }, - { USB_DEVICE(0x0411, 0x0158) }, -+ { USB_DEVICE(0x0411, 0x015d) }, - { USB_DEVICE(0x0411, 0x016f) }, - { USB_DEVICE(0x0411, 0x01a2) }, - /* Corega */ -@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x07d1, 0x3c0e) }, - { USB_DEVICE(0x07d1, 0x3c0f) }, - { USB_DEVICE(0x07d1, 0x3c11) }, -+ { USB_DEVICE(0x07d1, 0x3c13) }, -+ { USB_DEVICE(0x07d1, 0x3c15) }, - { USB_DEVICE(0x07d1, 0x3c16) }, - { USB_DEVICE(0x2001, 0x3c1b) }, - /* Draytek */ -@@ -943,6 +947,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x7392, 0x7711) }, - { USB_DEVICE(0x7392, 0x7717) }, - { USB_DEVICE(0x7392, 0x7718) }, -+ { USB_DEVICE(0x7392, 0x7722) }, - /* Encore */ - { USB_DEVICE(0x203d, 0x1480) }, - { USB_DEVICE(0x203d, 0x14a9) }, -@@ -977,6 +982,7 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x1737, 0x0070) }, - { USB_DEVICE(0x1737, 0x0071) }, - { USB_DEVICE(0x1737, 0x0077) }, -+ { USB_DEVICE(0x1737, 0x0078) }, - /* Logitec */ - { USB_DEVICE(0x0789, 0x0162) }, - { USB_DEVICE(0x0789, 0x0163) }, -@@ -1000,9 +1006,13 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x0db0, 0x871b) }, - { USB_DEVICE(0x0db0, 0x871c) }, - { USB_DEVICE(0x0db0, 0x899a) }, -+ /* Ovislink */ -+ { USB_DEVICE(0x1b75, 0x3071) }, -+ { USB_DEVICE(0x1b75, 0x3072) }, - /* Para */ - { USB_DEVICE(0x20b8, 0x8888) }, - /* Pegatron */ -+ { USB_DEVICE(0x1d4d, 0x0002) }, - { USB_DEVICE(0x1d4d, 0x000c) }, - { USB_DEVICE(0x1d4d, 0x000e) }, - { USB_DEVICE(0x1d4d, 0x0011) }, -@@ -1055,7 +1065,9 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* Sparklan */ - { USB_DEVICE(0x15a9, 0x0006) }, - /* Sweex */ -+ { USB_DEVICE(0x177f, 0x0153) }, - { USB_DEVICE(0x177f, 0x0302) }, -+ { USB_DEVICE(0x177f, 0x0313) }, - /* U-Media */ - { USB_DEVICE(0x157e, 0x300e) }, - { USB_DEVICE(0x157e, 0x3013) }, -@@ -1139,25 +1151,20 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x13d3, 0x3322) }, - /* Belkin */ - { USB_DEVICE(0x050d, 0x1003) }, -- { USB_DEVICE(0x050d, 0x825a) }, - /* Buffalo */ - { USB_DEVICE(0x0411, 0x012e) }, - { USB_DEVICE(0x0411, 0x0148) }, - { USB_DEVICE(0x0411, 0x0150) }, -- { USB_DEVICE(0x0411, 0x015d) }, - /* Corega */ - { USB_DEVICE(0x07aa, 0x0041) }, - { USB_DEVICE(0x07aa, 0x0042) }, - { USB_DEVICE(0x18c5, 0x0008) }, - /* D-Link */ - { USB_DEVICE(0x07d1, 0x3c0b) }, -- { USB_DEVICE(0x07d1, 0x3c13) }, -- { USB_DEVICE(0x07d1, 0x3c15) }, - { USB_DEVICE(0x07d1, 0x3c17) }, - { USB_DEVICE(0x2001, 0x3c17) }, - /* Edimax */ - { USB_DEVICE(0x7392, 0x4085) }, -- { USB_DEVICE(0x7392, 0x7722) }, - /* Encore */ - { USB_DEVICE(0x203d, 0x14a1) }, - /* Fujitsu Stylistic 550 */ -@@ -1173,19 +1180,13 @@ static struct usb_device_id rt2800usb_device_table[] = { - /* LevelOne */ - { USB_DEVICE(0x1740, 0x0605) }, - { USB_DEVICE(0x1740, 0x0615) }, -- /* Linksys */ -- { USB_DEVICE(0x1737, 0x0078) }, - /* Logitec */ - { USB_DEVICE(0x0789, 0x0168) }, - { USB_DEVICE(0x0789, 0x0169) }, - /* Motorola */ - { USB_DEVICE(0x100d, 0x9032) }, -- /* Ovislink */ -- { USB_DEVICE(0x1b75, 0x3071) }, -- { USB_DEVICE(0x1b75, 0x3072) }, - /* Pegatron */ - { USB_DEVICE(0x05a6, 0x0101) }, -- { USB_DEVICE(0x1d4d, 0x0002) }, - { USB_DEVICE(0x1d4d, 0x0010) }, - /* Planex */ - { USB_DEVICE(0x2019, 0x5201) }, -@@ -1204,9 +1205,6 @@ static struct usb_device_id rt2800usb_device_table[] = { - { USB_DEVICE(0x083a, 0xc522) }, - { USB_DEVICE(0x083a, 0xd522) }, - { USB_DEVICE(0x083a, 0xf511) }, -- /* Sweex */ -- { USB_DEVICE(0x177f, 0x0153) }, -- { USB_DEVICE(0x177f, 0x0313) }, - /* Zyxel */ - { USB_DEVICE(0x0586, 0x341a) }, - #endif --- -1.7.10 - diff --git a/debian/patches/features/x86/efi-stub/0007-efi.h-Add-boottime-locate_handle-search-types.patch b/debian/patches/features/x86/efi-stub/0007-efi.h-Add-boottime-locate_handle-search-types.patch index 81dfa2a5e..1b9d038d0 100644 --- a/debian/patches/features/x86/efi-stub/0007-efi.h-Add-boottime-locate_handle-search-types.patch +++ b/debian/patches/features/x86/efi-stub/0007-efi.h-Add-boottime-locate_handle-search-types.patch @@ -10,17 +10,18 @@ Cc: Matthew Garrett Signed-off-by: Matt Fleming Link: http://lkml.kernel.org/r/1318848017-12301-1-git-send-email-matt@console-pimps.org Signed-off-by: H. Peter Anvin +[bwh: Adjust context to apply after commit + 3a91135a4b1720f83810399e596937598b38b158 'efi: Add new variable attributes' + in 3.2.17] --- include/linux/efi.h | 7 +++++++ 1 file changed, 7 insertions(+) -diff --git a/include/linux/efi.h b/include/linux/efi.h -index e46d771..d407c88 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -472,6 +472,13 @@ extern int __init efi_setup_pcdp_console(char *); - #define EFI_VARIABLE_RUNTIME_ACCESS 0x0000000000000004 - + EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \ + EFI_VARIABLE_APPEND_WRITE) /* + * The type of search to perform when calling boottime->locate_handle + */ @@ -32,6 +33,3 @@ index e46d771..d407c88 100644 * EFI Device Path information */ #define EFI_DEV_HW 0x01 --- -1.7.10 - diff --git a/debian/patches/series/base b/debian/patches/series/base index 1e747a3e9..33e435c53 100644 --- a/debian/patches/series/base +++ b/debian/patches/series/base @@ -78,13 +78,11 @@ + features/all/fs-hardlink-creation-restrictions.patch + features/all/fs-hardlink-creation-restrictions-fix.patch + features/all/fs-hardlink-creation-restriction-cleanup.patch -+ bugfix/all/Don-t-limit-non-nested-epoll-paths.patch + bugfix/all/kbuild-do-not-check-for-ancient-modutils-tools.patch # Temporary, until the original change has been tested some more + debian/revert-CIFS-Respect-negotiated-MaxMpxCount.patch -+ bugfix/all/net-fix-proc-net-dev-regression.patch + bugfix/arm/ARM-orion5x-Fix-GPIO-enable-bits-for-MPP9.patch # Update all Hyper-V drivers to 3.4-rc1 (no longer staging) @@ -166,8 +164,6 @@ + features/x86/hyperv/0076-net-hyperv-Fix-the-code-handling-tx-busy.patch + features/x86/hyperv/0077-hv-remove-the-second-argument-of-k-un-map_atomic.patch -+ features/all/rt2x00-Identify-rt2800usb-chipsets.patch - + features/x86/efi-stub/0001-x86-Add-missing-bzImage-fields-to-struct-setup_heade.patch + features/x86/efi-stub/0002-x86-Don-t-use-magic-strings-for-EFI-loader-signature.patch + features/x86/efi-stub/0003-efi.h-Add-struct-definition-for-boot-time-services.patch @@ -188,11 +184,6 @@ + bugfix/all/brcmsmac-INTERMEDIATE-but-not-AMPDU-only-when-tracin.patch + bugfix/all/NFSv4-Rate-limit-the-state-manager-for-lock-reclaim-.patch -+ bugfix/all/NFSv4-Ensure-that-the-LOCK-code-sets-exception-inode.patch -+ bugfix/all/NFSv4-Ensure-that-we-check-lock-exclusive-shared-typ.patch -+ bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_execbuffer2.patch -+ bugfix/x86/drm-i915-fix-integer-overflow-in-i915_gem_do_execbuffer.patch -+ bugfix/all/revert-autofs-work-around-unhappy-compat-problem-on-.patch # Temporary, until the next ABI bump + debian/revert-rtc-Provide-flag-for-rtc-devices-that-don-t-s.patch