1. 26 9月, 2009 1 次提交
  2. 22 9月, 2009 2 次提交
  3. 07 9月, 2009 6 次提交
  4. 28 8月, 2009 1 次提交
  5. 15 8月, 2009 1 次提交
  6. 08 8月, 2009 4 次提交
    • G
      i.MX31: fix framebuffer locking regressions · 20de03da
      Guennadi Liakhovetski 提交于
      Recent framebuffer locking patches first made affected systems unbootable,
      then the dead-lock has been fixed but as of 2.6.31-rc4 the framebuffer on
      mx3 machines doesn't work. Fix this.
      Signed-off-by: NGuennadi Liakhovetski <g.liakhovetski@gmx.de>
      Cc: Sascha Hauer <s.hauer@pengutronix.de>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      20de03da
    • J
      fbcon: don't use vc_resize() on initialization · 0035fe00
      Johannes Weiner 提交于
      Catalin and kmemleak spotted a leak of a VC screen buffer in
      vc_allocate() due to the following chain of events:
      
      	vc_allocate()
      	  visual_init(init=1)
      	    vc->vc_sw->con_init(init=1)
                    fbcon_init()
      	        vc_resize()
      	          vc->screen_buf = kmalloc()
      	  vc->screen_buf = kmalloc()
      
      The common way for the VC drivers is to set the screen dimension
      parameters manually in the init case and only call vc_resize() for
      !init - which allocates a screen buffer according to the new
      dimensions.
      
      fbcon instead would do vc_resize() unconditionally and afterwards set
      the dimensions manually (again) for !init - i.e. completely upside
      down.  The vc_resize() allocated buffer would then get lost by
      vc_allocate() allocating a fresh one.
      
      Use vc_resize() only for actual resizing to close the leak.
      
      Set the dimensions manually only in initialization mode to remove the
      redundant setting in resize mode.
      
      The kmemleak trace from Catalin:
      
      unreferenced object 0xde158000 (size 12288):
        comm "Xorg", pid 1439, jiffies 4294961016
        hex dump (first 32 bytes):
          20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
          20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
        backtrace:
          [<c006f74b>] __save_stack_trace+0x17/0x1c
          [<c006f81d>] create_object+0xcd/0x188
          [<c01f5457>] kmemleak_alloc+0x1b/0x3c
          [<c006e303>] __kmalloc+0xdb/0xe8
          [<c012cc4b>] vc_do_resize+0x73/0x1e0
          [<c012cdf1>] vc_resize+0x15/0x18
          [<c011afc1>] fbcon_init+0x1f9/0x2b8
          [<c0129e87>] visual_init+0x9f/0xdc
          [<c012aff3>] vc_allocate+0x7f/0xfc
          [<c012b087>] con_open+0x17/0x80
          [<c0120e43>] tty_open+0x1f7/0x2e4
          [<c0072fa1>] chrdev_open+0x101/0x118
          [<c006ffad>] __dentry_open+0x105/0x1cc
          [<c00700fd>] nameidata_to_filp+0x2d/0x38
          [<c00788cd>] do_filp_open+0x2c1/0x54c
          [<c006fdff>] do_sys_open+0x3b/0xb4
      Reported-by: NCatalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: NJohannes Weiner <hannes@cmpxchg.org>
      Tested-by: NCatalin Marinas <catalin.marinas@arm.com>
      Cc: Pekka Enberg <penberg@cs.helsinki.fi>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Tested-by: NDave Young <hidave.darkstar@gmail.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      0035fe00
    • F
      viafb: fix rmmod bug · 52159444
      Florian Tobias Schandinat 提交于
      This fixes a bug caused by changing pointers (viafb_mode, viafb_mode1)
      assigned by module_param.  It reduces driver complexity by not needlessly
      changing these vars as they are only read once and removing now
      superfluous code.
      
      On unpatched kernels loading viafb with viafb_mode or viafb_mode1 option
      used and afterwards unloading it results in:
      
      kernel BUG at mm/slub.c:2926!
      invalid opcode: 0000 [#1] PREEMPT
      last sysfs file: /sys/devices/virtual/block/loop0/removable
      Modules linked in: snd_hda_codec_realtek snd_hda_intel snd_hda_codec
      snd_hwdep snd_pcm rtl8187 snd_timer eeprom_93cx6 mmc_block snd soundcore
      via_sdmmc fb snd_page_alloc i2c_algo_bit i2c_viapro ehci_hcd uhci_hcd
      cfbcopyarea mmc_core cfbimgblt cfbfillrect video output [last unloaded:
      viafb]
      
        Pid: 3355, comm: rmmod Not tainted (2.6.31-rc1 #0)
        EIP: 0060:[<c106a759>] EFLAGS: 00010246 CPU: 0
        EIP is at kfree+0x80/0xda
        EAX: c17c2da0 EBX: dc7edbdc ECX: 0000010f EDX: 00000000
        ESI: c102c700 EDI: dc7ed8fa EBP: d703ff2c ESP: d703ff20
         DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
        Process rmmod (pid: 3355, ti=d703e000 task=db1412c0 task.ti=d703e000)
        Stack:
         dc7edbdc 00000014 00000016 d703ff40 c102c700 dc7f45d4 dc7f45d4 00000880
         d703ff4c c103e571 00000000 d703ffac c103e751 66616976 da140062 db89ba80
         00000328 d702edf8 db89ba80 d703ff9c c105d0f0 00000200 da14f898 00000014
        Call Trace:
         [<c102c700>] ? destroy_params+0x1e/0x2b
         [<c103e571>] ? free_module+0xa2/0xd7
         [<c103e751>] ? sys_delete_module+0x1ab/0x1da
         [<c105d0f0>] ? do_munmap+0x20a/0x225
         [<c10029b4>] ? sysenter_do_call+0x12/0x26
        Code: 10 76 7a 8d 87 00 00 00 40 c1 e8 0c c1 e0 05 03 05 1c 87 41 c1 66 83 38 00 79 03 8b 40 0c 8b 10 84 d2 78 12 66 f7 c2 00 c0 75 04 <0f> 0b eb fe e8 6f 5a fe ff eb 47 8b 55 04 8b 58 0c 9c 5e fa 3b
        EIP: [<c106a759>] kfree+0x80/0xda SS:ESP 0068:d703ff20
      
      This is caused by the current code changing the pointers assigned by
      module_param.  During unload it tries to free the memory the pointers
      point at which is now part of an internal structure.
      
      The patch simply avoids changing the pointers.  This is okay as they are
      read only once during the initialization process.
      Signed-off-by: NFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>
      Cc: Scott Fang <ScottFang@viatech.com.cn>
      Cc: Joseph Chan <JosephChan@via.com.tw>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      52159444
    • S
      fbcon: fix rotate upside down crash · 93274e4d
      Stefani Seibold 提交于
      Fix the rotate_ud() function not to crash in case of a font which has not
      a width of multiple by 8: The inner loop of the font pixel copy should not
      access a bit outside the font memory area.  Subtract the shift offset from
      the font width will prevent this.
      Signed-off-by: NStefani Seibold <stefani@seibold.net>
      Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      93274e4d
  7. 02 8月, 2009 1 次提交
  8. 30 7月, 2009 2 次提交
  9. 22 7月, 2009 1 次提交
    • L
      fbmon: work around compiler bug in gcc-2.4.2 · 3730793d
      Linus Torvalds 提交于
      There's some odd bug in gcc-4.2 where it miscompiles a simple loop whent
      he loop counter is of type 'unsigned char' and it should count to 128.
      
      The compiler will incorrectly decide that a trivial loop like this:
      
      	unsigned char i, ...
      
      	for (i = 0; i < 128; i++) {
      		..
      
      is endless, and will compile it to a single instruction that just
      branches to itself.
      
      This was triggered by the addition of '-fno-strict-overflow', and we
      could play games with compiler versions and go back to '-fwrapv'
      instead, but the trivial way to avoid it is to just make the loop
      induction variable be an 'int' instead.
      
      Thanks to Krzysztof Oledzki for reporting and testing and to Troy Moure
      for digging through assembler differences and finding it.
      Reported-and-tested-by: NKrzysztof Oledzki <olel@ans.pl>
      Found-by: NTroy Moure <twmoure@szypr.net>
      Gcc-bug-acked-by: NIan Lance Taylor <iant@google.com>
      Cc: stable@kernel.org
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3730793d
  10. 15 7月, 2009 1 次提交
  11. 13 7月, 2009 2 次提交
  12. 10 7月, 2009 2 次提交
  13. 09 7月, 2009 9 次提交
  14. 07 7月, 2009 6 次提交
  15. 05 7月, 2009 1 次提交
    • P
      video: sm501fb: Early initialization of mm_lock mutex. · f50bf2b2
      Paul Mundt 提交于
      Commit 537a1bf0 (fbdev: add mutex for
      fb_mmap locking) introduces a ->mm_lock mutex for protecting smem
      assignments. Unfortunately in the case of sm501fb these happen quite
      early in the initialization code, well before the mutex_init() that takes
      place in register_framebuffer(), leading to:
      
         Badness at kernel/mutex.c:207
      
         Pid : 1, Comm:          swapper
         CPU : 0                 Not tainted  (2.6.31-rc1-00284-g529ba0d9-dirty #2273)
      
         PC is at __mutex_lock_slowpath+0x72/0x1bc
         PR is at __mutex_lock_slowpath+0x66/0x1bc
         ...
      
      matroxfb appears to have the same issue and has solved it with an early
      mutex_init(), so we do the same for sm501fb.
      Signed-off-by: NPaul Mundt <lethal@linux-sh.org>
      Cc: Krzysztof Helt <krzysztof.h1@wp.pl>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      f50bf2b2