[linux] 02/04: Update to 3.2.80
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun May 1 23:14:24 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch wheezy-security
in repository linux.
commit 0026319d358b1fac32763bea8f20a22fa71431f1
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Sun May 1 15:27:55 2016 +0200
Update to 3.2.80
drm, agp: Update to 3.4.112
---
debian/changelog | 107 +++++++++++++--
...B-usbip-fix-potential-out-of-bounds-write.patch | 41 ------
.../all/usbnet-cleanup-after-bind-in-probe.patch | 35 -----
...64-properly-context-switch-iopl-on-xen-pv.patch | 97 --------------
...ble-full-randomization-on-i386-and-x86_32.patch | 79 ------------
.../x86/x86-standardize-mmap_rnd-usage.patch | 101 ---------------
debian/patches/features/all/drm/drm-3.4.patch | 143 +++++++++------------
debian/patches/series | 5 -
8 files changed, 156 insertions(+), 452 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index 1b237b4..87d7404 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,4 @@
-linux (3.2.79-1) UNRELEASED; urgency=medium
+linux (3.2.80-1) UNRELEASED; urgency=medium
* New upstream stable update:
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.79
@@ -61,11 +61,103 @@ linux (3.2.79-1) UNRELEASED; urgency=medium
- Input: aiptek - fix crash on detecting device without endpoints
- include/linux/poison.h: fix LIST_POISON{1,2} offset (CVE-2016-0821)
- HID: usbhid: fix recursive deadlock
-
- [ Ben Hutchings ]
- * drm, agp: Update to 3.4.111:
+ http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.80
+ - [x86] EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()
+ - 8250: use callbacks to access UART_DLL/UART_DLM
+ - net: irda: Fix use-after-free in irtty_open()
+ - usb: retry reset if a device times out
+ - mac80211: avoid excessive stack usage in sta_info
+ - nfsd4: fix bad bounds checking
+ - xfs: fix two memory leaks in xfs_attr_list.c error paths
+ - drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors
+ - usb: hub: fix a typo in hub_port_init() leading to wrong logic
+ - [x86] KVM: i8254: change PIT discard tick policy
+ - ipvs: correct initial offset of Call-ID header search in SIP
+ persistence engine
+ - [x86] PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs
+ - be2iscsi: set the boot_kset pointer to NULL in case of failure
+ - sg: fix dxferp in from_to case
+ - jbd2: fix FS corruption possibility in jbd2_journal_destroy() on
+ umount path
+ - dm snapshot: disallow the COW and origin devices from being identical
+ - [x86] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM
+ ThinkPad X41.
+ - Input: powermate - fix oops with malicious USB descriptors (CVE-2016-2186)
+ - net: Fix use after free in the recvmmsg exit path
+ - ath9k: fix buffer overrun for ar9287
+ - ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()
+ (CVE-2016-2184)
+ - ALSA: usb-audio: Add sanity checks for endpoint accesses
+ - nfsd: fix deadlock secinfo+readdir compound
+ - ppp: ensure file->private_data can't be overridden
+ - [amd64] iopl: Properly context-switch IOPL on Xen PV (CVE-2016-3157)
+ - raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang
+ - raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang
+ - Input: synaptics - handle spurious release of trackstick buttons, again
+ - USB: iowarrior: fix oops with malicious USB descriptors
+ - USB: usb_driver_claim_interface: add sanity checking
+ - USB: cdc-acm: more sanity checking (CVE-2016-3138)
+ - tracing: Fix crash from reading trace_pipe with sendfile
+ - splice: handle zero nr_pages in splice_to_pipe()
+ - ethernet: micrel: fix some error codes
+ - fs/coredump: prevent fsuid=0 dumps into user-controlled directories
+ - ppp: take reference on channels netns
+ - Input: ati_remote2 - fix crashes on detecting device with invalid
+ descriptor (CVE-2016-2185)
+ - ocfs2/dlm: fix race between convert and recovery
+ - ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list
+ - hwmon: (max1111) Return -ENODEV from max1111_read_channel if not
+ instantiated
+ - ALSA: usb-audio: Fix double-free in error paths after
+ snd_usb_add_audio_stream() call
+ - USB: mct_u232: add sanity checking in probe (CVE-2016-3136)
+ - USB: cypress_m8: add endpoint sanity check (CVE-2016-3137)
+ - USB: digi_acceleport: do sanity checking for the number of ports
+ (CVE-2016-3140)
+ - sd: Fix excessive capacity printing on devices with blocks bigger than
+ 512 bytes
+ - [x86] KVM: Inject pending interrupt even if pending nmi exist
+ - ALSA: timer: Use mod_timer() for rearming the system timer
+ - xen/events: Mask a moving irq
+ - netfilter: x_tables: Fix parsing of IPT_SO_SET_REPLACE blobs
+ (CVE-2016-3134)
+ + validate e->target_offset early
+ + make sure e->next_offset covers remaining blob size
+ - [x86] mm/32: Enable full randomization on i386 and X86_32 (CVE-2016-3672)
+ - usbnet: cleanup after bind() in probe() (CVE-2016-3951)
+ - USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
+ - ipv4: Don't do expensive useless work during inetdev destroy.
+ (CVE-2016-3156)
+ - ext4: fix NULL pointer dereference in ext4_mark_inode_dirty()
+ - sctp: sctp should release assoc when sctp_make_abort_user return NULL
+ in sctp_close
+ - connector: bump skb->users before callback invocation
+ - phonet: properly unshare skbs in phonet_rcv()
+ - net: dp83640: Fix tx timestamp overflow handling.
+ - ipv6/udp: use sticky pktinfo egress ifindex on connect()
+ - net/ipv6: add sysctl option accept_ra_min_hop_limit
+ - ipv4: fix memory leaks in ip_cmsg_send() callers
+ - pppoe: fix reference counting in PPPoE proxy
+ - sctp: Fix port hash table size computation
+ - bio: return EINTR if copying to user space got interrupted
+ - sctp: lack the check for ports in sctp_v6_cmp_addr
+ - net: validate variable length ll headers
+ - ax25: add link layer header validation function
+ - macvtap: always pass ethernet header in linear
+ - farsync: fix off-by-one bug in fst_add_one
+ - xfrm: Fix crash observed during device unregistration and decryption
+ - ipv4: l2tp: fix a potential issue in l2tp_ip_recv
+ - ipv6: Count in extension headers in skb->network_header
+ - netfilter: x_tables: fix unconditional helper
+
+ [ Ben Hutchings ]
+ * drm, agp: Update to 3.4.112:
- drm: add a check for x/y in drm_mode_setcrtc
- drm/radeon/combios: add some validation of lvds values
+ - DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd
+ - Add radeon suspend/resume quirk for HP Compaq dc5750.
+ - drm: crtc: integer overflow in drm_property_create_blob()
+ - drm/nouveau/gem: return only valid domain when there's only one
* Revert "libata: Align ata_device's id on a cacheline" to avoid ABI change
* [rt] Update to 3.2.78-rt113:
- latencyhist: disable jump-labels
@@ -73,13 +165,6 @@ linux (3.2.79-1) UNRELEASED; urgency=medium
- kernel: softirq: unlock with irqs on
- rcu/torture: Comment out rcu_bh ops on PREEMPT_RT_FULL
- kernel: sched: Fix preempt_disable_ip recodring for preempt_disable()
- * [amd64] iopl: Properly context-switch IOPL on Xen PV (CVE-2016-3157)
- * [x86] standardize mmap_rnd() usage
- * [x86] mm/32: Enable full randomization on i386 and X86_32 (CVE-2016-3672)
- * usbnet: cleanup after bind() in probe() (CVE-2016-3951)
-
- [ Salvatore Bonaccorso ]
- * [x86] USB: usbip: fix potential out-of-bounds write (CVE-2016-3955)
-- Ben Hutchings <ben at decadent.org.uk> Fri, 01 Apr 2016 02:11:16 +0100
diff --git a/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch b/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
deleted file mode 100644
index f539310..0000000
--- a/debian/patches/bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Ignat Korchagin <ignat.korchagin at gmail.com>
-Date: Thu, 17 Mar 2016 18:00:29 +0000
-Subject: USB: usbip: fix potential out-of-bounds write
-Origin: https://git.kernel.org/linus/b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb
-
-Fix potential out-of-bounds write to urb->transfer_buffer
-usbip handles network communication directly in the kernel. When receiving a
-packet from its peer, usbip code parses headers according to protocol. As
-part of this parsing urb->actual_length is filled. Since the input for
-urb->actual_length comes from the network, it should be treated as untrusted.
-Any entity controlling the network may put any value in the input and the
-preallocated urb->transfer_buffer may not be large enough to hold the data.
-Thus, the malicious entity is able to write arbitrary data to kernel memory.
-
-Signed-off-by: Ignat Korchagin <ignat.korchagin at gmail.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
-[carnil: backport for 3.2: context; and driver still in staging area]
----
- drivers/staging/usbip/usbip_common.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
---- a/drivers/staging/usbip/usbip_common.c
-+++ b/drivers/staging/usbip/usbip_common.c
-@@ -820,6 +820,17 @@ int usbip_recv_xbuff(struct usbip_device
- if (!(size > 0))
- return 0;
-
-+ if (size > urb->transfer_buffer_length) {
-+ /* should not happen, probably malicious packet */
-+ if (ud->side == USBIP_STUB) {
-+ usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
-+ return 0;
-+ } else {
-+ usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
-+ return -EPIPE;
-+ }
-+ }
-+
- ret = usbip_xmit(0, ud->tcp_socket, (char *)urb->transfer_buffer,
- size, 0);
- if (ret != size) {
diff --git a/debian/patches/bugfix/all/usbnet-cleanup-after-bind-in-probe.patch b/debian/patches/bugfix/all/usbnet-cleanup-after-bind-in-probe.patch
deleted file mode 100644
index d6c69f1..0000000
--- a/debian/patches/bugfix/all/usbnet-cleanup-after-bind-in-probe.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From: Oliver Neukum <oneukum at suse.com>
-Date: Mon, 7 Mar 2016 11:31:10 +0100
-Subject: usbnet: cleanup after bind() in probe()
-Origin: https://git.kernel.org/linus/1666984c8625b3db19a9abc298931d35ab7bc64b
-
-In case bind() works, but a later error forces bailing
-in probe() in error cases work and a timer may be scheduled.
-They must be killed. This fixes an error case related to
-the double free reported in
-http://www.spinics.net/lists/netdev/msg367669.html
-and needs to go on top of Linus' fix to cdc-ncm.
-
-Signed-off-by: Oliver Neukum <ONeukum at suse.com>
-Signed-off-by: David S. Miller <davem at davemloft.net>
-Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
----
- drivers/net/usb/usbnet.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -1486,6 +1486,13 @@ out3:
- if (info->unbind)
- info->unbind (dev, udev);
- out1:
-+ /* subdrivers must undo all they did in bind() if they
-+ * fail it, but we may fail later and a deferred kevent
-+ * may trigger an error resubmitting itself and, worse,
-+ * schedule a timer. So we kill it all just in case.
-+ */
-+ cancel_work_sync(&dev->kevent);
-+ del_timer_sync(&dev->delay);
- free_netdev(net);
- out:
- usb_put_dev(xdev);
diff --git a/debian/patches/bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch b/debian/patches/bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
deleted file mode 100644
index 23bbf12..0000000
--- a/debian/patches/bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From: Andy Lutomirski <luto at kernel.org>
-Date: Wed, 16 Mar 2016 14:14:21 -0700
-Subject: x86/iopl/64: Properly context-switch IOPL on Xen PV
-Origin: https://git.kernel.org/linus/b7a584598aea7ca73140cb87b40319944dd3393f
-
-On Xen PV, regs->flags doesn't reliably reflect IOPL and the
-exit-to-userspace code doesn't change IOPL. We need to context
-switch it manually.
-
-I'm doing this without going through paravirt because this is
-specific to Xen PV. After the dust settles, we can merge this with
-the 32-bit code, tidy up the iopl syscall implementation, and remove
-the set_iopl pvop entirely.
-
-Fixes XSA-171.
-
-Reviewewd-by: Jan Beulich <JBeulich at suse.com>
-Signed-off-by: Andy Lutomirski <luto at kernel.org>
-Cc: Andrew Cooper <andrew.cooper3 at citrix.com>
-Cc: Andy Lutomirski <luto at amacapital.net>
-Cc: Boris Ostrovsky <boris.ostrovsky at oracle.com>
-Cc: Borislav Petkov <bp at alien8.de>
-Cc: Brian Gerst <brgerst at gmail.com>
-Cc: David Vrabel <david.vrabel at citrix.com>
-Cc: Denys Vlasenko <dvlasenk at redhat.com>
-Cc: H. Peter Anvin <hpa at zytor.com>
-Cc: Jan Beulich <JBeulich at suse.com>
-Cc: Linus Torvalds <torvalds at linux-foundation.org>
-Cc: Peter Zijlstra <peterz at infradead.org>
-Cc: Thomas Gleixner <tglx at linutronix.de>
-Cc: stable at vger.kernel.org
-Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org
-Signed-off-by: Ingo Molnar <mingo at kernel.org>
-[bwh: Backported to 3.2:
- - Use xen_pv_domain() directly as X86_FEATURE_XENPV is not defined
- - Adjust context]
----
- arch/x86/include/asm/xen/hypervisor.h | 2 ++
- arch/x86/kernel/process_64.c | 12 ++++++++++++
- arch/x86/xen/enlighten.c | 2 +-
- 3 files changed, 15 insertions(+), 1 deletion(-)
-
---- a/arch/x86/include/asm/xen/hypervisor.h
-+++ b/arch/x86/include/asm/xen/hypervisor.h
-@@ -72,4 +72,6 @@ static inline bool xen_x2apic_para_avail
- }
- #endif
-
-+extern void xen_set_iopl_mask(unsigned mask);
-+
- #endif /* _ASM_X86_XEN_HYPERVISOR_H */
---- a/arch/x86/kernel/process_64.c
-+++ b/arch/x86/kernel/process_64.c
-@@ -38,6 +38,7 @@
- #include <linux/io.h>
- #include <linux/ftrace.h>
- #include <linux/cpuidle.h>
-+#include <xen/xen.h>
-
- #include <asm/pgtable.h>
- #include <asm/system.h>
-@@ -52,6 +53,7 @@
- #include <asm/syscalls.h>
- #include <asm/debugreg.h>
- #include <asm/nmi.h>
-+#include <asm/xen/hypervisor.h>
-
- asmlinkage extern void ret_from_fork(void);
-
-@@ -518,6 +520,16 @@ __switch_to(struct task_struct *prev_p,
- task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
- __switch_to_xtra(prev_p, next_p, tss);
-
-+#ifdef CONFIG_XEN
-+ /*
-+ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
-+ * current_pt_regs()->flags may not match the current task's
-+ * intended IOPL. We need to switch it manually.
-+ */
-+ if (unlikely(xen_pv_domain() && prev->iopl != next->iopl))
-+ xen_set_iopl_mask(next->iopl);
-+#endif
-+
- return prev_p;
- }
-
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -768,7 +768,7 @@ static void xen_load_sp0(struct tss_stru
- xen_mc_issue(PARAVIRT_LAZY_CPU);
- }
-
--static void xen_set_iopl_mask(unsigned mask)
-+void xen_set_iopl_mask(unsigned mask)
- {
- struct physdev_set_iopl set_iopl;
-
diff --git a/debian/patches/bugfix/x86/x86-mm-32-enable-full-randomization-on-i386-and-x86_32.patch b/debian/patches/bugfix/x86/x86-mm-32-enable-full-randomization-on-i386-and-x86_32.patch
deleted file mode 100644
index 142ca5d..0000000
--- a/debian/patches/bugfix/x86/x86-mm-32-enable-full-randomization-on-i386-and-x86_32.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Hector Marco-Gisbert <hecmargi at upv.es>
-Date: Thu, 10 Mar 2016 20:51:00 +0100
-Subject: x86/mm/32: Enable full randomization on i386 and X86_32
-Origin: https://git.kernel.org/linus/8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
-
-Currently on i386 and on X86_64 when emulating X86_32 in legacy mode, only
-the stack and the executable are randomized but not other mmapped files
-(libraries, vDSO, etc.). This patch enables randomization for the
-libraries, vDSO and mmap requests on i386 and in X86_32 in legacy mode.
-
-By default on i386 there are 8 bits for the randomization of the libraries,
-vDSO and mmaps which only uses 1MB of VA.
-
-This patch preserves the original randomness, using 1MB of VA out of 3GB or
-4GB. We think that 1MB out of 3GB is not a big cost for having the ASLR.
-
-The first obvious security benefit is that all objects are randomized (not
-only the stack and the executable) in legacy mode which highly increases
-the ASLR effectiveness, otherwise the attackers may use these
-non-randomized areas. But also sensitive setuid/setgid applications are
-more secure because currently, attackers can disable the randomization of
-these applications by setting the ulimit stack to "unlimited". This is a
-very old and widely known trick to disable the ASLR in i386 which has been
-allowed for too long.
-
-Another trick used to disable the ASLR was to set the ADDR_NO_RANDOMIZE
-personality flag, but fortunately this doesn't work on setuid/setgid
-applications because there is security checks which clear Security-relevant
-flags.
-
-This patch always randomizes the mmap_legacy_base address, removing the
-possibility to disable the ASLR by setting the stack to "unlimited".
-
-Signed-off-by: Hector Marco-Gisbert <hecmargi at upv.es>
-Acked-by: Ismael Ripoll Ripoll <iripoll at upv.es>
-Acked-by: Kees Cook <keescook at chromium.org>
-Acked-by: Arjan van de Ven <arjan at linux.intel.com>
-Cc: Linus Torvalds <torvalds at linux-foundation.org>
-Cc: Peter Zijlstra <peterz at infradead.org>
-Cc: Thomas Gleixner <tglx at linutronix.de>
-Cc: akpm at linux-foundation.org
-Cc: kees Cook <keescook at chromium.org>
-Link: http://lkml.kernel.org/r/1457639460-5242-1-git-send-email-hecmargi@upv.es
-Signed-off-by: Ingo Molnar <mingo at kernel.org>
-Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
----
- arch/x86/mm/mmap.c | 14 +-------------
- 1 file changed, 1 insertion(+), 13 deletions(-)
-
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -94,18 +94,6 @@ static unsigned long mmap_base(unsigned
- }
-
- /*
-- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
-- * does, but not when emulating X86_32
-- */
--static unsigned long mmap_legacy_base(unsigned long rnd)
--{
-- if (mmap_is_ia32())
-- return TASK_UNMAPPED_BASE;
-- else
-- return TASK_UNMAPPED_BASE + rnd;
--}
--
--/*
- * This function, called very early during the creation of a new
- * process VM image, sets up which VM layout function to use:
- */
-@@ -116,7 +104,7 @@ void arch_pick_mmap_layout(struct mm_str
- if (current->flags & PF_RANDOMIZE)
- random_factor = mmap_rnd();
-
-- mm->mmap_legacy_base = mmap_legacy_base(random_factor);
-+ mm->mmap_legacy_base = TASK_UNMAPPED_BASE + random_factor;
-
- if (mmap_is_legacy()) {
- mm->mmap_base = mm->mmap_legacy_base;
diff --git a/debian/patches/bugfix/x86/x86-standardize-mmap_rnd-usage.patch b/debian/patches/bugfix/x86/x86-standardize-mmap_rnd-usage.patch
deleted file mode 100644
index 8b9653a..0000000
--- a/debian/patches/bugfix/x86/x86-standardize-mmap_rnd-usage.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From: Kees Cook <keescook at chromium.org>
-Date: Tue, 14 Apr 2015 15:47:45 -0700
-Subject: x86: standardize mmap_rnd() usage
-Origin: https://git.kernel.org/linus/82168140bc4cec7ec9bad39705518541149ff8b7
-
-In preparation for splitting out ET_DYN ASLR, this refactors the use of
-mmap_rnd() to be used similarly to arm, and extracts the checking of
-PF_RANDOMIZE.
-
-Signed-off-by: Kees Cook <keescook at chromium.org>
-Reviewed-by: Ingo Molnar <mingo at kernel.org>
-Cc: Oleg Nesterov <oleg at redhat.com>
-Cc: Andy Lutomirski <luto at amacapital.net>
-Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
-[bwh: Backported to 3.2: adjust context]
-Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
----
- arch/x86/mm/mmap.c | 36 ++++++++++++++++++++----------------
- 1 file changed, 20 insertions(+), 16 deletions(-)
-
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -67,22 +67,21 @@ static int mmap_is_legacy(void)
-
- static unsigned long mmap_rnd(void)
- {
-- unsigned long rnd = 0;
-+ unsigned long rnd;
-
- /*
-- * 8 bits of randomness in 32bit mmaps, 20 address space bits
-- * 28 bits of randomness in 64bit mmaps, 40 address space bits
-- */
-- if (current->flags & PF_RANDOMIZE) {
-- if (mmap_is_ia32())
-- rnd = get_random_int() % (1<<8);
-- else
-- rnd = get_random_int() % (1<<28);
-- }
-+ * 8 bits of randomness in 32bit mmaps, 20 address space bits
-+ * 28 bits of randomness in 64bit mmaps, 40 address space bits
-+ */
-+ if (mmap_is_ia32())
-+ rnd = (unsigned long)get_random_int() % (1<<8);
-+ else
-+ rnd = (unsigned long)get_random_int() % (1<<28);
-+
- return rnd << PAGE_SHIFT;
- }
-
--static unsigned long mmap_base(void)
-+static unsigned long mmap_base(unsigned long rnd)
- {
- unsigned long gap = rlimit(RLIMIT_STACK);
-
-@@ -91,19 +90,19 @@ static unsigned long mmap_base(void)
- else if (gap > MAX_GAP)
- gap = MAX_GAP;
-
-- return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
-+ return PAGE_ALIGN(TASK_SIZE - gap - rnd);
- }
-
- /*
- * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
- * does, but not when emulating X86_32
- */
--static unsigned long mmap_legacy_base(void)
-+static unsigned long mmap_legacy_base(unsigned long rnd)
- {
- if (mmap_is_ia32())
- return TASK_UNMAPPED_BASE;
- else
-- return TASK_UNMAPPED_BASE + mmap_rnd();
-+ return TASK_UNMAPPED_BASE + rnd;
- }
-
- /*
-@@ -112,14 +111,19 @@ static unsigned long mmap_legacy_base(vo
- */
- void arch_pick_mmap_layout(struct mm_struct *mm)
- {
-- mm->mmap_legacy_base = mmap_legacy_base();
-- mm->mmap_base = mmap_base();
-+ unsigned long random_factor = 0UL;
-+
-+ if (current->flags & PF_RANDOMIZE)
-+ random_factor = mmap_rnd();
-+
-+ mm->mmap_legacy_base = mmap_legacy_base(random_factor);
-
- if (mmap_is_legacy()) {
- mm->mmap_base = mm->mmap_legacy_base;
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-+ mm->mmap_base = mmap_base(random_factor);
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
diff --git a/debian/patches/features/all/drm/drm-3.4.patch b/debian/patches/features/all/drm/drm-3.4.patch
index 592c3d0..65c22a2 100644
--- a/debian/patches/features/all/drm/drm-3.4.patch
+++ b/debian/patches/features/all/drm/drm-3.4.patch
@@ -351,7 +351,7 @@ index 6d440fb894cf..325365f6d355 100644
return -EINVAL;
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 20110b4ad791..ed4b7481a865 100644
+index 20110b4ad791..93c5b2fdf9b4 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -36,11 +36,7 @@
@@ -1820,15 +1820,17 @@ index 20110b4ad791..ed4b7481a865 100644
list_for_each_entry(prop_blob, &property->enum_blob_list, head) {
if (put_user(prop_blob->base.id, blob_id_ptr + copied)) {
-@@ -2352,6 +2943,7 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev
+@@ -2352,21 +2943,25 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev
void *data)
{
struct drm_property_blob *blob;
+ int ret;
- if (!length || !data)
+- if (!length || !data)
++ if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob) || !data)
return NULL;
-@@ -2360,13 +2952,16 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev
+
+ blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
if (!blob)
return NULL;
@@ -56851,25 +56853,10 @@ index 2f6daae68b9d..c1dc20f6cb85 100644
FIRE_RING (chan);
}
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
-index fc64ad0e7ca9..2f46bbfbb1f8 100644
+index fc64ad0e7ca9..b242534f57c5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
-@@ -172,12 +172,11 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
- struct nouveau_bo *nvbo = nouveau_gem_object(gem);
- struct nouveau_vma *vma;
-
-- if (is_power_of_2(nvbo->valid_domains))
-- rep->domain = nvbo->valid_domains;
-- else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
-+ if (nvbo->bo.mem.mem_type == TTM_PL_TT)
- rep->domain = NOUVEAU_GEM_DOMAIN_GART;
- else
- rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
-+
- rep->offset = nvbo->bo.offset;
- if (fpriv->vm) {
- vma = nouveau_bo_vma_find(nvbo, fpriv->vm);
-@@ -428,9 +427,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
+@@ -428,9 +428,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
return ret;
}
@@ -56879,7 +56866,7 @@ index fc64ad0e7ca9..2f46bbfbb1f8 100644
if (unlikely(ret)) {
if (ret != -ERESTARTSYS)
NV_ERROR(dev, "fail ttm_validate\n");
-@@ -680,19 +677,13 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
+@@ -680,19 +678,13 @@ nouveau_gem_ioctl_pushbuf(struct drm_device *dev, void *data,
return PTR_ERR(bo);
}
@@ -72476,7 +72463,7 @@ index 3e34f1ee340a..5325c20fd706 100644
radeon_write_dpcd_reg(dp_info->radeon_connector, DP_LANE_COUNT_SET, tmp);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 286f1fa640bc..dd5c14e917e0 100644
+index a1a7d071eb17..dd5c14e917e0 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -57,22 +57,6 @@ static inline bool radeon_encoder_is_digital(struct drm_encoder *encoder)
@@ -72636,7 +72623,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
}
/* no dig encoder assigned */
-@@ -602,7 +584,7 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+@@ -602,11 +584,13 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode))
args.v1.ucLaneNum = dp_lane_count;
@@ -72645,7 +72632,24 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v1.ucLaneNum = 8;
else
args.v1.ucLaneNum = 4;
-@@ -637,7 +619,7 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+
++ if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
++ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
+ switch (radeon_encoder->encoder_id) {
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+ args.v1.ucConfig = ATOM_ENCODER_CONFIG_V2_TRANSMITTER1;
+@@ -623,10 +607,6 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKB;
+ else
+ args.v1.ucConfig |= ATOM_ENCODER_CONFIG_LINKA;
+-
+- if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode) && (dp_clock == 270000))
+- args.v1.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
+-
+ break;
+ case 2:
+ case 3:
+@@ -639,7 +619,7 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode))
args.v3.ucLaneNum = dp_lane_count;
@@ -72654,7 +72658,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v3.ucLaneNum = 8;
else
args.v3.ucLaneNum = 4;
-@@ -677,7 +659,7 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
+@@ -679,7 +659,7 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mo
if (ENCODER_MODE_IS_DP(args.v1.ucEncoderMode))
args.v4.ucLaneNum = dp_lane_count;
@@ -72663,7 +72667,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v4.ucLaneNum = 8;
else
args.v4.ucLaneNum = 4;
-@@ -734,6 +716,7 @@ union dig_transmitter_control {
+@@ -736,6 +716,7 @@ union dig_transmitter_control {
DIG_TRANSMITTER_CONTROL_PARAMETERS_V2 v2;
DIG_TRANSMITTER_CONTROL_PARAMETERS_V3 v3;
DIG_TRANSMITTER_CONTROL_PARAMETERS_V4 v4;
@@ -72671,7 +72675,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
};
void
-@@ -754,6 +737,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -756,6 +737,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
int connector_object_id = 0;
int igp_lane_info = 0;
int dig_encoder = dig->dig_encoder;
@@ -72679,7 +72683,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
if (action == ATOM_TRANSMITTER_ACTION_INIT) {
connector = radeon_get_connector_for_encoder_init(encoder);
-@@ -769,6 +753,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -771,6 +753,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
struct radeon_connector_atom_dig *dig_connector =
radeon_connector->con_priv;
@@ -72687,7 +72691,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
dp_clock = dig_connector->dp_clock;
dp_lane_count = dig_connector->dp_lane_count;
connector_object_id =
-@@ -821,7 +806,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -823,7 +806,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v1.usPixelClock =
cpu_to_le16(dp_clock / 10);
@@ -72696,7 +72700,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v1.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
else
args.v1.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
-@@ -836,7 +821,8 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -838,7 +821,8 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if ((rdev->flags & RADEON_IS_IGP) &&
(radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_UNIPHY)) {
@@ -72706,7 +72710,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
if (igp_lane_info & 0x1)
args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_LANE_0_3;
else if (igp_lane_info & 0x2)
-@@ -863,7 +849,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -865,7 +849,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
if (dig->coherent_mode)
args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_COHERENT;
@@ -72715,7 +72719,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_8LANE_LINK;
}
break;
-@@ -878,7 +864,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -880,7 +864,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v2.usPixelClock =
cpu_to_le16(dp_clock / 10);
@@ -72724,7 +72728,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v2.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
else
args.v2.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
-@@ -906,7 +892,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -908,7 +892,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
} else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
if (dig->coherent_mode)
args.v2.acConfig.fCoherentMode = 1;
@@ -72733,7 +72737,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v2.acConfig.fDualLinkConnector = 1;
}
break;
-@@ -921,7 +907,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -923,7 +907,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v3.usPixelClock =
cpu_to_le16(dp_clock / 10);
@@ -72742,7 +72746,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v3.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
else
args.v3.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
-@@ -929,7 +915,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -931,7 +915,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v3.ucLaneNum = dp_lane_count;
@@ -72751,7 +72755,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v3.ucLaneNum = 8;
else
args.v3.ucLaneNum = 4;
-@@ -966,7 +952,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -968,7 +952,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
if (dig->coherent_mode)
args.v3.acConfig.fCoherentMode = 1;
@@ -72760,7 +72764,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v3.acConfig.fDualLinkConnector = 1;
}
break;
-@@ -981,7 +967,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -983,7 +967,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v4.usPixelClock =
cpu_to_le16(dp_clock / 10);
@@ -72769,7 +72773,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v4.usPixelClock = cpu_to_le16((radeon_encoder->pixel_clock / 2) / 10);
else
args.v4.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
-@@ -989,7 +975,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -991,7 +975,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
if (is_dp)
args.v4.ucLaneNum = dp_lane_count;
@@ -72778,7 +72782,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v4.ucLaneNum = 8;
else
args.v4.ucLaneNum = 4;
-@@ -1029,10 +1015,64 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
+@@ -1031,10 +1015,64 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
if (dig->coherent_mode)
args.v4.acConfig.fCoherentMode = 1;
@@ -72844,7 +72848,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
default:
DRM_ERROR("Unknown table version %d, %d\n", frev, crev);
break;
-@@ -1128,7 +1168,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
+@@ -1130,7 +1168,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
dp_lane_count = dig_connector->dp_lane_count;
connector_object_id =
(radeon_connector->connector_object_id & OBJECT_ID_MASK) >> OBJECT_ID_SHIFT;
@@ -72853,7 +72857,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
}
memset(&args, 0, sizeof(args));
-@@ -1152,7 +1192,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
+@@ -1154,7 +1192,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
if (dp_clock == 270000)
args.v1.sDigEncoder.ucConfig |= ATOM_ENCODER_CONFIG_DPLINKRATE_2_70GHZ;
args.v1.sDigEncoder.ucLaneNum = dp_lane_count;
@@ -72862,7 +72866,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v1.sDigEncoder.ucLaneNum = 8;
else
args.v1.sDigEncoder.ucLaneNum = 4;
-@@ -1171,7 +1211,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
+@@ -1173,7 +1211,7 @@ atombios_external_encoder_setup(struct drm_encoder *encoder,
else if (dp_clock == 540000)
args.v3.sExtEncoder.ucConfig |= EXTERNAL_ENCODER_CONFIG_V3_DPLINKRATE_5_40GHZ;
args.v3.sExtEncoder.ucLaneNum = dp_lane_count;
@@ -72871,7 +72875,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
args.v3.sExtEncoder.ucLaneNum = 8;
else
args.v3.sExtEncoder.ucLaneNum = 4;
-@@ -1369,7 +1409,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
+@@ -1371,7 +1409,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
dig->panel_mode);
if (ext_encoder) {
@@ -72880,7 +72884,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
atombios_external_encoder_setup(encoder, ext_encoder,
EXTERNAL_ENCODER_ACTION_V3_ENCODER_SETUP);
}
-@@ -1448,7 +1488,7 @@ radeon_atom_encoder_dpms_ext(struct drm_encoder *encoder,
+@@ -1450,7 +1488,7 @@ radeon_atom_encoder_dpms_ext(struct drm_encoder *encoder,
switch (mode) {
case DRM_MODE_DPMS_ON:
default:
@@ -72889,7 +72893,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
atombios_external_encoder_setup(encoder, ext_encoder,
EXTERNAL_ENCODER_ACTION_V3_ENABLE_OUTPUT);
atombios_external_encoder_setup(encoder, ext_encoder,
-@@ -1459,7 +1499,7 @@ radeon_atom_encoder_dpms_ext(struct drm_encoder *encoder,
+@@ -1461,7 +1499,7 @@ radeon_atom_encoder_dpms_ext(struct drm_encoder *encoder,
case DRM_MODE_DPMS_STANDBY:
case DRM_MODE_DPMS_SUSPEND:
case DRM_MODE_DPMS_OFF:
@@ -72898,7 +72902,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
atombios_external_encoder_setup(encoder, ext_encoder,
EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING);
atombios_external_encoder_setup(encoder, ext_encoder,
-@@ -1741,13 +1781,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
+@@ -1743,13 +1781,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
struct drm_encoder *test_encoder;
@@ -72938,7 +72942,7 @@ index 286f1fa640bc..dd5c14e917e0 100644
/* ontario follows DCE4 */
if (rdev->family == CHIP_PALM) {
if (dig->linkb)
-@@ -1835,7 +1896,7 @@ radeon_atom_encoder_init(struct radeon_device *rdev)
+@@ -1837,7 +1896,7 @@ radeon_atom_encoder_init(struct radeon_device *rdev)
break;
}
@@ -86109,7 +86113,7 @@ index b6e18c8db9f5..9c6b29a41927 100644
tmp = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
tmp &= ~(RADEON_PIXCLK_ALWAYS_ONb |
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
-index 87a677e91927..b72eb507df64 100644
+index 87a677e91927..69c2dd085722 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2927,7 +2927,7 @@ bool radeon_combios_external_tmds_setup(struct drm_encoder *encoder)
@@ -86146,38 +86150,11 @@ index 87a677e91927..b72eb507df64 100644
}
break;
default:
-@@ -3399,14 +3399,6 @@ void radeon_combios_asic_init(struct drm_device *dev)
- rdev->pdev->subsystem_device == 0x30ae)
- return;
-
-- /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume
-- * - it hangs on resume inside the dynclk 1 table.
-- */
-- if (rdev->family == CHIP_RS480 &&
-- rdev->pdev->subsystem_vendor == 0x103c &&
-- rdev->pdev->subsystem_device == 0x280a)
-- return;
--
- /* DYN CLK 1 */
- table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
- if (table)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index 6303fc8fcb8e..9184bbe7c602 100644
+index 6303fc8fcb8e..9c5d96cb6e14 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
-@@ -82,11 +82,6 @@ void radeon_connector_hotplug(struct drm_connector *connector)
- if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
- } else if (radeon_dp_needs_link_train(radeon_connector)) {
-- /* Don't try to start link training before we
-- * have the dpcd */
-- if (!radeon_dp_getdpcd(radeon_connector))
-- return;
--
- /* set it to OFF so that drm_helper_connector_dpms()
- * won't return immediately since the current state
- * is ON at this point.
-@@ -851,6 +846,27 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
+@@ -851,6 +851,27 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
return ret;
}
@@ -86205,7 +86182,7 @@ index 6303fc8fcb8e..9184bbe7c602 100644
/*
* DVI is complicated
* Do a DDC probe, if DDC probe passes, get the full EDID so
-@@ -875,6 +891,9 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
+@@ -875,6 +896,9 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
enum drm_connector_status ret = connector_status_disconnected;
bool dret = false;
@@ -86215,7 +86192,7 @@ index 6303fc8fcb8e..9184bbe7c602 100644
if (radeon_connector->ddc_bus)
dret = radeon_ddc_probe(radeon_connector, false);
if (dret) {
-@@ -1085,7 +1104,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
+@@ -1085,7 +1109,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
(radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
return MODE_OK;
else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
@@ -86224,7 +86201,7 @@ index 6303fc8fcb8e..9184bbe7c602 100644
/* HDMI 1.3+ supports max clock of 340 Mhz */
if (mode->clock > 340000)
return MODE_CLOCK_HIGH;
-@@ -1145,13 +1164,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
+@@ -1145,13 +1169,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
(connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
struct drm_display_mode *mode;
@@ -86255,7 +86232,7 @@ index 6303fc8fcb8e..9184bbe7c602 100644
if (ret > 0) {
if (encoder) {
-@@ -1162,7 +1191,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
+@@ -1162,7 +1196,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
return ret;
}
@@ -86263,7 +86240,7 @@ index 6303fc8fcb8e..9184bbe7c602 100644
if (!encoder)
return 0;
-@@ -1269,6 +1297,9 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
+@@ -1269,6 +1302,9 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
struct drm_encoder *encoder = radeon_best_single_encoder(connector);
diff --git a/debian/patches/series b/debian/patches/series
index 431d289..cf467af 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1169,8 +1169,3 @@ debian/hrtimer-fix-abi-change-in-3.2.78.patch
debian/crypto-fix-abi-change-in-3.2.77.patch
debian/revert-libata-align-ata_device-s-id-on-a-cacheline.patch
debian/tracing-avoid-abi-change-in-3.2.79.patch
-bugfix/x86/x86-iopl-64-properly-context-switch-iopl-on-xen-pv.patch
-bugfix/all/USB-usbip-fix-potential-out-of-bounds-write.patch
-bugfix/x86/x86-standardize-mmap_rnd-usage.patch
-bugfix/x86/x86-mm-32-enable-full-randomization-on-i386-and-x86_32.patch
-bugfix/all/usbnet-cleanup-after-bind-in-probe.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list