[meego-commits] 23578: Changes to MeeGo:1.2.0:oss:Update:Testing/kernel
godgenius
no_reply at build.meego.com
Thu Aug 4 09:53:48 UTC 2011
Hi,
I have made the following changes to kernel in project MeeGo:1.2.0:oss:Update:Testing. Please review and accept ASAP.
Thank You,
godgenius
[This message was auto-generated]
---
Request #23578:
submit: home:godgenius:branches:MeeGo:1.2.0:oss:Update:Testing/kernel(r6)(cleanup) -> MeeGo:1.2.0:oss:Update:Testing/kernel
Message:
add a patch to fix bmc#11857,13984,14060,14148,15519
State: new 2011-08-04T02:53:39 godgenius
Comment: None
changes files:
--------------
--- kernel.changes
+++ kernel.changes
@@ -0,0 +1,3 @@
+* Thu Aug 4 2011 - Gu Chaojie <chao.jie.gu at intel.com> - 2.6.37.6
+- add a patch to fix bmc#11857,13984,14060,14148,15519
+
new:
----
linux-2.6.37-security-bugs-fixed.patch
spec files:
-----------
--- kernel.spec
+++ kernel.spec
@@ -177,7 +177,7 @@
# Kernel CVE patches - these go last in the backport section
# no non-cve patches should go here!
-
+Patch102: linux-2.6.37-security-bugs-fixed.patch
#
# End of the Direct Backports section
@@ -355,7 +355,8 @@
# Kernel CVE patches - these go last in the backport section
# no non-cve patches should go here!
-
+# linux-2.6.37-security-bugs-fixed.patch
+%patch102 -p1
#
# End of the Direct Backports section
other changes:
--------------
++++++ linux-2.6.37-security-bugs-fixed.patch (new)
--- linux-2.6.37-security-bugs-fixed.patch
+++ linux-2.6.37-security-bugs-fixed.patch
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/r100.c new/drivers/gpu/drm/radeon/r100.c
+--- linux-2.6.37/drivers/gpu/drm/radeon/r100.c 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/r100.c 2011-08-04 16:21:20.000000000 +0800
+@@ -3297,6 +3297,26 @@
+ return -EINVAL;
+ }
+ }
++ if (track->aa_dirty && track->aaresolve) {
++ if (track->aa.robj == NULL) {
++ DRM_ERROR("[drm] No buffer for AA resolve buffer %d !\n", i);
++ return -EINVAL;
++ }
++ /* I believe the format comes from colorbuffer0. */
++ size = track->aa.pitch * track->cb[0].cpp * track->maxy;
++ size += track->aa.offset;
++ if (size > radeon_bo_size(track->aa.robj)) {
++ DRM_ERROR("[drm] Buffer too small for AA resolve buffer %d "
++ "(need %lu have %lu) !\n", i, size,
++ radeon_bo_size(track->aa.robj));
++ DRM_ERROR("[drm] AA resolve buffer %d (%u %u %u %u)\n",
++ i, track->aa.pitch, track->cb[0].cpp,
++ track->aa.offset, track->maxy);
++ return -EINVAL;
++ }
++ }
++ track->aa_dirty = false;
++
+ prim_walk = (track->vap_vf_cntl >> 4) & 0x3;
+ if (track->vap_vf_cntl & (1 << 14)) {
+ nverts = track->vap_alt_nverts;
+@@ -3362,6 +3382,7 @@
+ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track)
+ {
+ unsigned i, face;
++ track->aa_dirty = true;
+
+ if (rdev->family < CHIP_R300) {
+ track->num_cb = 1;
+@@ -3376,6 +3397,8 @@
+ track->num_texture = 16;
+ track->maxy = 4096;
+ track->separate_cube = 0;
++ track->aaresolve = true;
++ track->aa.robj = NULL;
+ }
+
+ for (i = 0; i < track->num_cb; i++) {
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/r100_track.h new/drivers/gpu/drm/radeon/r100_track.h
+--- linux-2.6.37/drivers/gpu/drm/radeon/r100_track.h 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/r100_track.h 2011-08-04 16:21:20.000000000 +0800
+@@ -73,11 +73,15 @@
+ struct r100_cs_track_array arrays[11];
+ struct r100_cs_track_cb cb[R300_MAX_CB];
+ struct r100_cs_track_cb zb;
++ struct r100_cs_track_cb aa;
+ struct r100_cs_track_texture textures[R300_TRACK_MAX_TEXTURE];
+ bool z_enabled;
+ bool separate_cube;
+ bool zb_cb_clear;
+ bool blend_read_enable;
++
++ bool aa_dirty;
++ bool aaresolve;
+ };
+
+ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track);
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/r300.c new/drivers/gpu/drm/radeon/r300.c
+--- linux-2.6.37/drivers/gpu/drm/radeon/r300.c 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/r300.c 2011-08-04 16:21:20.000000000 +0800
+@@ -1074,6 +1074,27 @@
+ break;
+ case 0x4f28: /* ZB_DEPTHCLEARVALUE */
+ break;
++ case R300_RB3D_AARESOLVE_OFFSET:
++ r = r100_cs_packet_next_reloc(p, &reloc);
++ if (r) {
++ DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
++ idx, reg);
++ r100_cs_dump_packet(p, pkt);
++ return r;
++ }
++ track->aa.robj = reloc->robj;
++ track->aa.offset = idx_value;
++ track->aa_dirty = true;
++ ib[idx] = idx_value + ((u32)reloc->lobj.gpu_offset);
++ break;
++ case R300_RB3D_AARESOLVE_PITCH:
++ track->aa.pitch = idx_value & 0x3FFE;
++ track->aa_dirty = true;
++ break;
++ case R300_RB3D_AARESOLVE_CTL:
++ track->aaresolve = idx_value & 0x1;
++ track->aa_dirty = true;
++ break;
+ case 0x4f30: /* ZB_MASK_OFFSET */
+ case 0x4f34: /* ZB_ZMASK_PITCH */
+ case 0x4f44: /* ZB_HIZ_OFFSET */
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/r300_reg.h new/drivers/gpu/drm/radeon/r300_reg.h
+--- linux-2.6.37/drivers/gpu/drm/radeon/r300_reg.h 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/r300_reg.h 2011-08-04 16:21:20.000000000 +0800
+@@ -1371,6 +1371,8 @@
+ #define R300_RB3D_COLORPITCH2 0x4E40 /* GUESS */
+ #define R300_RB3D_COLORPITCH3 0x4E44 /* GUESS */
+
++#define R300_RB3D_AARESOLVE_OFFSET 0x4E80
++#define R300_RB3D_AARESOLVE_PITCH 0x4E84
+ #define R300_RB3D_AARESOLVE_CTL 0x4E88
+ /* gap */
+
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/r300 new/drivers/gpu/drm/radeon/reg_srcs/r300
+--- linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/r300 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/reg_srcs/r300 2011-08-04 16:21:20.000000000 +0800
+@@ -706,9 +706,6 @@
+ 0x4E74 RB3D_CMASK_WRINDEX
+ 0x4E78 RB3D_CMASK_DWORD
+ 0x4E7C RB3D_CMASK_RDINDEX
+-0x4E80 RB3D_AARESOLVE_OFFSET
+-0x4E84 RB3D_AARESOLVE_PITCH
+-0x4E88 RB3D_AARESOLVE_CTL
+ 0x4EA0 RB3D_DISCARD_SRC_PIXEL_LTE_THRESHOLD
+ 0x4EA4 RB3D_DISCARD_SRC_PIXEL_GTE_THRESHOLD
+ 0x4F04 ZB_ZSTENCILCNTL
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/r420 new/drivers/gpu/drm/radeon/reg_srcs/r420
+--- linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/r420 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/reg_srcs/r420 2011-08-04 16:21:20.000000000 +0800
+@@ -773,9 +773,6 @@
+ 0x4E74 RB3D_CMASK_WRINDEX
+ 0x4E78 RB3D_CMASK_DWORD
+ 0x4E7C RB3D_CMASK_RDINDEX
+-0x4E80 RB3D_AARESOLVE_OFFSET
+-0x4E84 RB3D_AARESOLVE_PITCH
+-0x4E88 RB3D_AARESOLVE_CTL
+ 0x4EA0 RB3D_DISCARD_SRC_PIXEL_LTE_THRESHOLD
+ 0x4EA4 RB3D_DISCARD_SRC_PIXEL_GTE_THRESHOLD
+ 0x4F04 ZB_ZSTENCILCNTL
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/rs600 new/drivers/gpu/drm/radeon/reg_srcs/rs600
+--- linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/rs600 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/reg_srcs/rs600 2011-08-04 16:21:20.000000000 +0800
+@@ -772,9 +772,6 @@
+ 0x4E74 RB3D_CMASK_WRINDEX
+ 0x4E78 RB3D_CMASK_DWORD
+ 0x4E7C RB3D_CMASK_RDINDEX
+-0x4E80 RB3D_AARESOLVE_OFFSET
+-0x4E84 RB3D_AARESOLVE_PITCH
+-0x4E88 RB3D_AARESOLVE_CTL
+ 0x4EA0 RB3D_DISCARD_SRC_PIXEL_LTE_THRESHOLD
+ 0x4EA4 RB3D_DISCARD_SRC_PIXEL_GTE_THRESHOLD
+ 0x4F04 ZB_ZSTENCILCNTL
+diff -Nur linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/rv515 new/drivers/gpu/drm/radeon/reg_srcs/rv515
+--- linux-2.6.37/drivers/gpu/drm/radeon/reg_srcs/rv515 2011-01-05 08:50:19.000000000 +0800
++++ new/drivers/gpu/drm/radeon/reg_srcs/rv515 2011-08-04 16:21:20.000000000 +0800
+@@ -468,9 +468,6 @@
+ 0x4E74 RB3D_CMASK_WRINDEX
+ 0x4E78 RB3D_CMASK_DWORD
+ 0x4E7C RB3D_CMASK_RDINDEX
+-0x4E80 RB3D_AARESOLVE_OFFSET
+-0x4E84 RB3D_AARESOLVE_PITCH
+-0x4E88 RB3D_AARESOLVE_CTL
+ 0x4EA0 RB3D_DISCARD_SRC_PIXEL_LTE_THRESHOLD
+ 0x4EA4 RB3D_DISCARD_SRC_PIXEL_GTE_THRESHOLD
+ 0x4EF8 RB3D_CONSTANT_COLOR_AR
+diff -Nur linux-2.6.37/fs/eventpoll.c new/fs/eventpoll.c
+--- linux-2.6.37/fs/eventpoll.c 2011-08-04 16:15:17.000000000 +0800
++++ new/fs/eventpoll.c 2011-08-04 16:35:29.000000000 +0800
+@@ -94,6 +94,8 @@
+ struct file *file;
+ int fd;
+ };
++/* used to keep track of visited nodes, so they can be cleared */
++LIST_HEAD(visited_list);
+
+ /*
+ * Structure used to track possible nested calls, for too deep recursions
+@@ -188,6 +190,10 @@
+
+ /* The user that created the eventpoll descriptor */
+ struct user_struct *user;
++
++ /* used to optimize loop detection check */
++ int visited;
++ struct list_head visitedllink;
+ };
+
+ /* Wait structure used by the poll hooks */
+@@ -1225,16 +1231,22 @@
+ int error = 0;
+ struct file *file = priv;
+ struct eventpoll *ep = file->private_data;
++ struct eventpoll *ep_tovisit;
+ struct rb_node *rbp;
+ struct epitem *epi;
+
+ mutex_lock(&ep->mtx);
++ ep->visited = 1;
++ list_add(&ep->visitedllink, &visited_list);
+ for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ epi = rb_entry(rbp, struct epitem, rbn);
+ if (unlikely(is_file_epoll(epi->ffd.file))) {
(263 more lines skipped)
More information about the MeeGo-commits
mailing list