--- /dev/null
+From stable-bounces@linux.kernel.org Wed May 2 12:49:39 2007
+Date: Wed, 2 May 2007 21:48:37 +0200
+From: Sam Ravnborg <sam@ravnborg.org>
+To: stable@kernel.org
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Message-ID: <465F0E83.3090003@redhat.com>
+Subject: kbuild: fixdep segfault on pathological string-o-death
+
+From: Andy Green <andy@warmcat.com>
+
+build scripts: fixdep blows segfault on string CONFIG_MODULE seen
+
+The string "CONFIG_MODULE" appearing anywhere in a source file causes
+fixdep to segfault. This string appeared in the wild in the current
+mISDN sources (I think they meant CONFIG_MODULES). But it shouldn't
+segfault (esp as CONFIG_MODULE appeared in a quoted string).
+
+Signed-off-by: Andy Green <andy@warmcat.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+Fixes https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=241915
+
+ scripts/basic/fixdep.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.20.12.orig/scripts/basic/fixdep.c
++++ linux-2.6.20.12/scripts/basic/fixdep.c
+@@ -249,6 +249,8 @@ void parse_config_file(char *map, size_t
+ found:
+ if (!memcmp(q - 7, "_MODULE", 7))
+ q -= 7;
++ if( (q-p-7) < 0 )
++ continue;
+ use_config(p+7, q-p-7);
+ }
+ }
--- /dev/null
+From 1fc799e1b4efdbc405d87d9f154d64d9bc299e5c Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 31 May 2007 00:40:49 -0700
+Subject: ntfs_init_locked_inode(): fix array indexing
+
+Local variable `i' is a byte-counter. Don't use it as an index into an array
+of le32's.
+
+Reported-by: "young dave" <hidave.darkstar@gmail.com>
+Cc: "Christoph Lameter" <clameter@sgi.com>
+Acked-by: Anton Altaparmakov <aia21@cantab.net>
+Cc: <stable@kernel.org>
+Cc: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ fs/ntfs/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.20.12.orig/fs/ntfs/inode.c
++++ linux-2.6.20.12/fs/ntfs/inode.c
+@@ -141,7 +141,7 @@ static int ntfs_init_locked_inode(struct
+ if (!ni->name)
+ return -ENOMEM;
+ memcpy(ni->name, na->name, i);
+- ni->name[i] = 0;
++ ni->name[na->name_len] = 0;
+ }
+ return 0;
+ }
fuse-fix-mknod-of-regular-file.patch
acpi-thermal-fix-mod_timer-interval.patch
alsa-usb-audio-explicitly-match-logitech-quickcam.patch
+v4l-dvb-budget-ci-fix-tuning-for-tdm-1316.patch
+kbuild-fixdep-segfault-on-pathological-string-o-death.patch
+ntfs_init_locked_inode-fix-array-indexing.patch
--- /dev/null
+From 910a7b68350516e114294064fbec4a9e58f59efc Mon Sep 17 00:00:00 2001
+Message-ID: <465F1151.4010700@redhat.com>
+From: Oliver Endriss <o.endriss@gmx.de>
+Cc: Chuck Ebbert <cebbert@redhat.com>, Dave Jones <davej@redhat.com>
+Date: Thu, 3 May 2007 13:16:12 -0300
+Subject: V4L/DVB (5593): Budget-ci: Fix tuning for TDM 1316 (160..200 MHz)
+
+Revert changeset
+ http://linuxtv.org/hg/v4l-dvb?cmd=changeset;node=e7c424bbf9aa;style=gitweb
+
+Petri Helin found that this changeset broke tuning:
+
+'Well, after going through the changes that might have had effect on
+tuning, I found out the one which had caused this problem. I do not know
+the actual reason behind the change, but the changelog says that it
+was meant to "Fix TD1316 tuner for DVBC". But at least in my case it
+seams to have broken the tuner instead.'
+
+Signed-off-by: Oliver Endriss <o.endriss@gmx.de>
+Thanks-to: Petri Helin <phelin@googlemail.com>
+Acked-by: e9hack <e9hack@googlemail.com>
+Acked-by: Thomas Kaiser <linux-dvb@kaiser-linux.li>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Acked-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+---
+ drivers/media/dvb/ttpci/budget-ci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.20.12.orig/drivers/media/dvb/ttpci/budget-ci.c
++++ linux-2.6.20.12/drivers/media/dvb/ttpci/budget-ci.c
+@@ -892,7 +892,7 @@ static int dvbc_philips_tdm1316l_tuner_s
+ band = 1;
+ } else if (tuner_frequency < 200000000) {
+ cp = 6;
+- band = 2;
++ band = 1;
+ } else if (tuner_frequency < 290000000) {
+ cp = 3;
+ band = 2;