Merge remote branch 'intel/drm-intel-next' of /ssd/git/drm-next into drm-core-next

* 'intel/drm-intel-next' of /ssd/git/drm-next: (771 commits)
  drm/i915: Undo "Uncouple render/power ctx before suspending"
  drm/i915: Allow the application to choose the constant addressing mode
  drm/i915: dynamic render p-state support for Sandy Bridge
  drm/i915: Enable EI mode for RCx decision making on Sandybridge
  drm/i915/sdvo: Border and stall select became test bits in gen5
  drm/i915: Add Guess-o-matic for pageflip timestamping.
  drm/i915: Add support for precise vblank timestamping (v2)
  drm/i915: Add frame buffer compression on Sandybridge
  drm/i915: Add self-refresh support on Sandybridge
  drm/i915: Wait for vblank before unpinning old fb
  Revert "drm/i915: Avoid using PIPE_CONTROL on Ironlake"
  drm/i915: Pass clock limits down to PLL matcher
  drm/i915: Poll for seqno completion if IRQ is disabled
  drm/i915/ringbuffer: Make IRQ refcnting atomic
  agp/intel: Fix missed cached memory flags setting in i965_write_entry()
  drm/i915/sdvo: Only use the SDVO pin if it is in the valid range
  drm/i915: Enable RC6 autodownclocking on Sandybridge
  drm/i915: Terminate the FORCE WAKE after we have finished reading
  drm/i915/gtt: Clear the cachelines upon resume
  drm/i915: Restore GTT mapping first upon resume
  ...

1 files changed, 9 insertions, 0 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 21aa7b3001fb..676149a4ac5f 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code)
         if (unlikely(!tsk->pid))
                 panic("Attempted to kill the idle task!");
 
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
+
         tracehook_report_exit(&code);
 
         validate_creds_for_do_exit(tsk);