Hi Linus,
Please pull the 'agp-fixes' branch from
ssh://master.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6.git agp-fixes
One fix for a real oops on IA64 AGP system + 2 minor fixes.
Dave.
drivers/char/agp/backend.c | 13 +++++++++----
drivers/char/agp/hp-agp.c | 6 ++++--
2 files changed, 13 insertions(+), 6 deletions(-)
commit 3d4a7882b11299104a0e74425dece2e26ac98024
Author: Bjorn Helgaas <[email protected]>
Date: Thu Jan 7 12:58:56 2010 -0700
agp/hp: fail gracefully if we don't find an IOC
Bail out if we don't find an enclosing IOC. Previously, if we didn't
find one, we tried to set things up using garbage for the SBA/IOC register
address, which causes a crash.
This crash only happens if firmware supplies a defective ACPI namespace, so
it doesn't fix any problems in the field.
Signed-off-by: Bjorn Helgaas <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
commit 67fe63b0715ccfaefa0af8a6e705c5470ee5cada
Author: Bjorn Helgaas <[email protected]>
Date: Thu Jan 7 12:58:51 2010 -0700
agp/hp: fixup hp agp after ACPI changes
Commit 15b8dd53f5ffa changed the string in info->hardware_id from a static
array to a pointer and added a length field. But instead of changing
"sizeof(array)" to "length", we changed it to "sizeof(length)" (== 4),
which corrupts the string we're trying to null-terminate.
We no longer even need to null-terminate the string, but we *do* need to
check whether we found a HID. If there's no HID, we used to have an empty
array, but now we have a null pointer.
The combination of these defects causes this oops:
Unable to handle kernel NULL pointer dereference (address 0000000000000003)
modprobe[895]: Oops 8804682956800 [1]
ip is at zx1_gart_probe+0xd0/0xcc0 [hp_agp]
http://marc.info/?l=linux-ia64&m=126264484923647&w=2
Signed-off-by: Bjorn Helgaas <[email protected]>
Reported-by: ?meric Maschino <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
commit 3f50b0222e4c6ac59a5c4819f8be0fa500970381
Author: Kevin Winchester <[email protected]>
Date: Tue Nov 17 14:38:45 2009 -0800
agp: correct missing cleanup on error in agp_add_bridge
While investigating a kmemleak detected leak, I encountered the
agp_add_bridge function. It appears to be responsible for freeing
the agp_bridge_data in the case of a failure, but it is only doing
so for some errors.
Fix it to always free the bridge data if a failure condition is
encountered.
Signed-off-by: Kevin Winchester <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>