rpms/kernel/F-10 kernel.spec, 1.1181, 1.1182 linux-2.6-firewire-git-pending.patch, 1.31, 1.32

[Jarod Wilson]

Author: jwilson

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv20255

Modified Files:
	kernel.spec linux-2.6-firewire-git-pending.patch 
Log Message:
* Wed Dec 10 2008 Jarod Wilson <jarod at redhat.com> 2.6.27.8-146
- Plug DMA memory leak in firewire drivers (#475156)



Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1181
retrieving revision 1.1182
diff -u -r1.1181 -r1.1182
--- kernel.spec	10 Dec 2008 18:37:58 -0000	1.1181
+++ kernel.spec	10 Dec 2008 20:13:47 -0000	1.1182
@@ -1918,6 +1918,9 @@
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Wed Dec 10 2008 Jarod Wilson <jarod at redhat.com> 2.6.27.8-146
+- Plug DMA memory leak in firewire drivers (#475156)
+
 * Wed Dec 10 2008 Hans de Goede <hdegoede at redhat.com> 2.6.27.8-145
 - Fix vc0321 based webcams (rh 474990)
 

linux-2.6-firewire-git-pending.patch:

Index: linux-2.6-firewire-git-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/linux-2.6-firewire-git-pending.patch,v
retrieving revision 1.31
retrieving revision 1.32
diff -u -r1.31 -r1.32
--- linux-2.6-firewire-git-pending.patch	29 Oct 2008 15:32:05 -0000	1.31
+++ linux-2.6-firewire-git-pending.patch	10 Dec 2008 20:13:47 -0000	1.32
@@ -128,3 +128,106 @@
  	 * the version stored in the OHCI registers.
  	 */
  
+----------------------
+Date: Wed, 10 Dec 2008 00:20:38 +0100 (CET)
+From: Stefan Richter <stefanr at s5r6.in-berlin.de>
+Subject: firewire: fw-ohci: fix possible IOMMU resource exhaustion
+
+There is a DMA map/ unmap imbalance whenever a block write request
+packet is sent and then dequeued with ohci_cancel_packet.  The latter
+may happen frequently if the AR resp tasklet is executed before the AT
+req tasklet for the same transaction.
+
+Add the missing dma_unmap_single.
+
+Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>
+---
+ drivers/firewire/fw-ohci.c        |   11 +++++++----
+ drivers/firewire/fw-transaction.c |    3 +++
+ drivers/firewire/fw-transaction.h |    2 ++
+ 3 files changed, 12 insertions(+), 4 deletions(-)
+
+Index: linux/drivers/firewire/fw-ohci.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-ohci.c
++++ linux/drivers/firewire/fw-ohci.c
+@@ -974,6 +974,7 @@ at_context_queue_packet(struct context *
+ 			packet->ack = RCODE_SEND_ERROR;
+ 			return -1;
+ 		}
++		packet->payload_bus = payload_bus;
+ 
+ 		d[2].req_count    = cpu_to_le16(packet->payload_length);
+ 		d[2].data_address = cpu_to_le32(payload_bus);
+@@ -1025,7 +1026,6 @@ static int handle_at_packet(struct conte
+ 	struct driver_data *driver_data;
+ 	struct fw_packet *packet;
+ 	struct fw_ohci *ohci = context->ohci;
+-	dma_addr_t payload_bus;
+ 	int evt;
+ 
+ 	if (last->transfer_status == 0)
+@@ -1038,9 +1038,8 @@ static int handle_at_packet(struct conte
+ 		/* This packet was cancelled, just continue. */
+ 		return 1;
+ 
+-	payload_bus = le32_to_cpu(last->data_address);
+-	if (payload_bus != 0)
+-		dma_unmap_single(ohci->card.device, payload_bus,
++	if (packet->payload_bus)
++		dma_unmap_single(ohci->card.device, packet->payload_bus,
+ 				 packet->payload_length, DMA_TO_DEVICE);
+ 
+ 	evt = le16_to_cpu(last->transfer_status) & 0x1f;
+@@ -1697,6 +1696,10 @@ static int ohci_cancel_packet(struct fw_
+ 	if (packet->ack != 0)
+ 		goto out;
+ 
++	if (packet->payload_bus)
++		dma_unmap_single(ohci->card.device, packet->payload_bus,
++				 packet->payload_length, DMA_TO_DEVICE);
++
+ 	log_ar_at_event('T', packet->speed, packet->header, 0x20);
+ 	driver_data->packet = NULL;
+ 	packet->ack = RCODE_CANCELLED;
+Index: linux/drivers/firewire/fw-transaction.c
+===================================================================
+--- linux.orig/drivers/firewire/fw-transaction.c
++++ linux/drivers/firewire/fw-transaction.c
+@@ -208,6 +208,7 @@ fw_fill_request(struct fw_packet *packet
+ 	packet->speed = speed;
+ 	packet->generation = generation;
+ 	packet->ack = 0;
++	packet->payload_bus = 0;
+ }
+ 
+ /**
+@@ -582,6 +583,8 @@ fw_fill_response(struct fw_packet *respo
+ 		BUG();
+ 		return;
+ 	}
++
++	response->payload_bus = 0;
+ }
+ EXPORT_SYMBOL(fw_fill_response);
+ 
+Index: linux/drivers/firewire/fw-transaction.h
+===================================================================
+--- linux.orig/drivers/firewire/fw-transaction.h
++++ linux/drivers/firewire/fw-transaction.h
+@@ -27,6 +27,7 @@
+ #include <linux/list.h>
+ #include <linux/spinlock_types.h>
+ #include <linux/timer.h>
++#include <linux/types.h>
+ #include <linux/workqueue.h>
+ 
+ #define TCODE_IS_READ_REQUEST(tcode)	(((tcode) & ~1) == 4)
+@@ -153,6 +154,7 @@ struct fw_packet {
+ 	size_t header_length;
+ 	void *payload;
+ 	size_t payload_length;
++	dma_addr_t payload_bus;
+ 	u32 timestamp;
+ 
+ 	/*