Add fix for possible oops in pktcdvd.c from Peter Osterlund, fwd from akpm

diff --git a/queue/packet-writing-oops-fix.patch b/queue/packet-writing-oops-fix.patch
new file mode 100644 (file)
index 0000000..550c9d0
--- /dev/null
+++ b/queue/packet-writing-oops-fix.patch
@@ -0,0 +1,35 @@
+From stable-bounces@linux.kernel.org  Sun Nov 13 16:07:01 2005
+Date: Sun, 13 Nov 2005 16:06:36 -0800
+From: akpm@osdl.org
+To: torvalds@osdl.org
+Cc: petero2@telia.com, stable@kernel.org
+Subject: [PATCH] packet writing oops fix
+
+From: Peter Osterlund <petero2@telia.com>
+
+There is an old bug in the pkt_count_states() function that causes stack
+corruption.  When compiling with gcc 3.x or 2.x it is harmless, but gcc 4
+allocates local variables differently, which makes the bug visible.
+
+Signed-off-by: Peter Osterlund <petero2@telia.com>
+Cc: <stable@kernel.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Chris Wright <chrisw@osdl.org>
+---
+
+ drivers/block/pktcdvd.c |    2 +-
+ 1 files changed, 1 insertion(+), 1 deletion(-)
+
+Index: linux-2.6.14.y/drivers/block/pktcdvd.c
+===================================================================
+--- linux-2.6.14.y.orig/drivers/block/pktcdvd.c
++++ linux-2.6.14.y/drivers/block/pktcdvd.c
+@@ -1191,7 +1191,7 @@ static void pkt_count_states(struct pktc
+       struct packet_data *pkt;
+       int i;
+ 
+-      for (i = 0; i <= PACKET_NUM_STATES; i++)
++      for (i = 0; i < PACKET_NUM_STATES; i++)
+               states[i] = 0;
+ 
+       spin_lock(&pd->cdrw.active_list_lock);

diff --git a/queue/series b/queue/series
index ab925fe47e594d703c08391d1a9c55d7a0df3f9f..3d21def76e2bb02a2fed94d743bad9eaa01cbc60 100644 (file)
--- a/queue/series
+++ b/queue/series
@@ -1,3 +1,4 @@
 ppc64-memory-model-depends-on-NUMA.patch
 ptrace-auto-reap-fix.patch
 fix-soft-lockup-with-ALSA-rtc-timer.patch
+packet-writing-oops-fix.patch