--- /dev/null
+From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007
+Message-Id: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:13 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/18] 2.6.18-stable review
+Status: RO
+Content-Length: 996
+Lines: 25
+
+This is the start of the stable review cycle for the 2.6.18.8 release.
+
+This will be the last release of the 2.6.18-stable series, so if there
+are patches that you feel should be applied to that tree, please let me
+know.
+
+There are 18 patches in this series, all will be posted as a response to
+this one. If anyone has any issues with these being applied, please let
+us know. If anyone is a maintainer of the proper subsystem, and wants
+to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the Cc:
+line. If you wish to be a reviewer, please email stable@kernel.org to
+add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Friday February 23 00:00 UTC. Anything
+received after that time might be too late.
+
+The whole patch set can be downloaded at:
+ kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.18.8-rc1.gz
+
+thanks,
+
+the -stable release team
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007
+Message-Id: <20070221014544.779031962@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:14 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>
+Subject: [patch 01/18] bcm43xx: Fix for oops on resume
+Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-resume.patch
+Content-Length: 779
+Lines: 27
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx.h
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx.h
+@@ -21,7 +21,7 @@
+ #define PFX KBUILD_MODNAME ": "
+
+ #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50
+-#define BCM43xx_IRQWAIT_MAX_RETRIES 50
++#define BCM43xx_IRQWAIT_MAX_RETRIES 100
+
+ #define BCM43xx_IO_SIZE 8192
+
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007
+Message-Id: <20070221014544.877269560@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:15 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Michael Buesch <mb@bu3sch.de>,
+ Larry Finger <Larry.Finger@lwfinger.net>
+Subject: [patch 02/18] bcm43xx: Fix for oops on ampdu status
+Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-ampdu-status.patch
+Content-Length: 2022
+Lines: 56
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Buesch <mb@bu3sch.de>
+
+If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The
+ampdu and intermediate status bits are properly named.
+
+Signed-off-by: Michael Buesch <mb@bu3sch.de>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++-----
+ drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++--------
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s
+
+ bcm43xx_debugfs_log_txstat(bcm, &stat);
+
+- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE)
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU)
++ continue;
++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER)
+ continue;
+- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) {
+- //TODO: packet was not acked (was lost)
+- }
+- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h
+
+ if (bcm43xx_using_pio(bcm))
+ bcm43xx_pio_handle_xmitstatus(bcm, &stat);
+--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h
+@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus {
+ u16 unknown; //FIXME
+ };
+
+-#define BCM43xx_TXSTAT_FLAG_ACK 0x01
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10
+-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40
+-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80
++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10
++#define BCM43xx_TXSTAT_FLAG_INTER 0x20
+
+ u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate);
+ u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate);
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.001925033@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:16 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Andi Kleen <ak@suse.de>,
+ Chuck Ebbert <76306.1226@compuserve.com>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 03/18] Dont leak NT bit into next task
+Content-Disposition: inline; filename=don-t-leak-nt-bit-into-next-task.patch
+Content-Length: 2367
+Lines: 72
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andi Kleen <ak@suse.de>
+
+SYSENTER can cause a NT to be set which might cause crashes on the IRET
+in the next task.
+
+Following similar i386 patch from Linus.
+
+Signed-off-by: Andi Kleen <ak@suse.de>
+[backport from Chuck Ebbert]
+Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ arch/x86_64/kernel/entry.S | 4 ++++
+ arch/x86_64/kernel/setup64.c | 4 ++++
+ include/asm-x86_64/system.h | 5 +++--
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.7.orig/arch/x86_64/kernel/entry.S
++++ linux-2.6.18.7/arch/x86_64/kernel/entry.S
+@@ -146,6 +146,10 @@
+ /* rdi: prev */
+ ENTRY(ret_from_fork)
+ CFI_DEFAULT_STACK
++ push kernel_eflags(%rip)
++ CFI_ADJUST_CFA_OFFSET 4
++ popf # reset kernel eflags
++ CFI_ADJUST_CFA_OFFSET -4
+ call schedule_tail
+ GET_THREAD_INFO(%rcx)
+ testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx)
+--- linux-2.6.18.7.orig/arch/x86_64/kernel/setup64.c
++++ linux-2.6.18.7/arch/x86_64/kernel/setup64.c
+@@ -178,6 +178,8 @@ void __cpuinit check_efer(void)
+ }
+ }
+
++unsigned long kernel_eflags;
++
+ /*
+ * cpu_init() initializes state that is per-CPU. Some data is already
+ * initialized (naturally) in the bootstrap process, such as the GDT
+@@ -290,4 +292,6 @@ void __cpuinit cpu_init (void)
+ set_debugreg(0UL, 7);
+
+ fpu_init();
++
++ raw_local_save_flags(kernel_eflags);
+ }
+--- linux-2.6.18.7.orig/include/asm-x86_64/system.h
++++ linux-2.6.18.7/include/asm-x86_64/system.h
+@@ -14,12 +14,13 @@
+ #define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t"
+
+ /* frame pointer must be last for get_wchan */
+-#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t"
+-#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t"
++#define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t"
++#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t"
+
+ #define __EXTRA_CLOBBER \
+ ,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15"
+
++/* Save restore flags to clear handle leaking NT */
+ #define switch_to(prev,next,last) \
+ asm volatile(SAVE_CONTEXT \
+ "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.128265078@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:17 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jens.axboe@oracle.com,
+ dougg@torque.net,
+ linux-ide@vger.kernel.org,
+ linux-scsi@vger.kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <htejun@gmail.com>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 04/18] SCSI: add missing cdb clearing in scsi_execute()
+Content-Disposition: inline; filename=scsi-add-missing-cdb-clearing-in-scsi_execute.patch
+Content-Length: 1098
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Tejun Heo <htejun@gmail.com>
+
+Clear-garbage-after-CDB patch missed scsi_execute() and it causes some
+ODDs (HL-DT-ST DVD-RAM GSA-H30N) choke during SCSI scan. Note that
+this patch is only for -stable. There is another more reliable fix
+for this problem proposed for devel tree.
+
+http://thread.gmane.org/gmane.linux.ide/14605/focus=14605
+
+Signed-off-by: Tejun Heo <htejun@gmail.com>
+Cc: Jens Axboe <jens.axboe@oracle.com>
+Cc: Douglas Gilbert <dougg@torque.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_lib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.7.orig/drivers/scsi/scsi_lib.c
++++ linux-2.6.18.7/drivers/scsi/scsi_lib.c
+@@ -191,6 +191,7 @@ int scsi_execute(struct scsi_device *sde
+ goto out;
+
+ req->cmd_len = COMMAND_SIZE(cmd[0]);
++ memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
+ memcpy(req->cmd, cmd, req->cmd_len);
+ req->sense = sense;
+ req->sense_len = 0;
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.254816321@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:18 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Roland Dreier <rolandd@cisco.com>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 05/18] IB/srp: Fix FMR mapping for 32-bit kernels and addresses above 4G
+Content-Disposition: inline; filename=ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch
+Content-Length: 1723
+Lines: 50
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <rdreier@cisco.com>
+
+struct srp_device.fmr_page_mask was unsigned long, which means that
+the top part of addresses above 4G was being chopped off on 32-bit
+architectures. Of course nothing good happens when data from SRP
+targets is DMAed to the wrong place.
+
+Fix this by changing fmr_page_mask to u64, to match the addresses
+actually used by IB devices.
+
+Thanks to Brian Cain <Brian.Cain@ge.com> and David McMillen
+<davem@systemfabricworks.com> for help diagnosing the bug and testing
+the fix.
+
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
+ drivers/infiniband/ulp/srp/ib_srp.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/infiniband/ulp/srp/ib_srp.c
++++ linux-2.6.18.7/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1851,7 +1851,7 @@ static void srp_add_one(struct ib_device
+ */
+ srp_dev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1);
+ srp_dev->fmr_page_size = 1 << srp_dev->fmr_page_shift;
+- srp_dev->fmr_page_mask = ~((unsigned long) srp_dev->fmr_page_size - 1);
++ srp_dev->fmr_page_mask = ~((u64) srp_dev->fmr_page_size - 1);
+
+ INIT_LIST_HEAD(&srp_dev->dev_list);
+
+--- linux-2.6.18.7.orig/drivers/infiniband/ulp/srp/ib_srp.h
++++ linux-2.6.18.7/drivers/infiniband/ulp/srp/ib_srp.h
+@@ -87,7 +87,7 @@ struct srp_device {
+ struct ib_fmr_pool *fmr_pool;
+ int fmr_page_shift;
+ int fmr_page_size;
+- unsigned long fmr_page_mask;
++ u64 fmr_page_mask;
+ };
+
+ struct srp_host {
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.383062473@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:19 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dirk Eibach <eibach@gdsys.de>,
+ Adrian Bunk <bunk@stusta.de>,
+ Dirk Stieler <stieler@gdsys.de>,
+ Jean Delvare <khali@linux-fr.org>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 06/18] i2c: fix broken ds1337 initialization
+Content-Disposition: inline; filename=i2c-fix-broken-ds1337-initialization.patch
+Content-Length: 2187
+Lines: 58
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Dirk Eibach <eibach@gdsys.de>
+
+On a custom board with ds1337 RTC I found that upgrade from 2.6.15 to
+2.6.18 broke RTC support.
+
+The main problem are changes to ds1337_init_client().
+When a ds1337 recognizes a problem (e.g. power or clock failure) bit 7
+in status register is set. This has to be reset by writing 0 to status
+register. But since there are only 16 byte written to the chip and the
+first byte is interpreted as an address, the status register (which is
+the 16th) is never written.
+The other problem is, that initializing all registers to zero is not
+valid for day, date and month register. Funny enough this is checked by
+ds1337_detect(), which depends on this values not being zero. So then
+treated by ds1337_init_client() the ds1337 is not detected anymore,
+whereas the failure bit in the status register is still set.
+
+Broken by commit f9e8957937ebf60d22732a5ca9130f48a7603f60 (2.6.16-rc1,
+2006-01-06). This fix is in Linus' tree since 2.6.20-rc1 (commit
+763d9c046a2e511ec090a8986d3f85edf7448e7e).
+
+Signed-off-by: Dirk Stieler <stieler@gdsys.de>
+Signed-off-by: Dirk Eibach <eibach@gdsys.de>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/i2c/chips/ds1337.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/i2c/chips/ds1337.c
++++ linux-2.6.18.7/drivers/i2c/chips/ds1337.c
+@@ -347,13 +347,19 @@ static void ds1337_init_client(struct i2
+
+ if ((status & 0x80) || (control & 0x80)) {
+ /* RTC not running */
+- u8 buf[16];
++ u8 buf[1+16]; /* First byte is interpreted as address */
+ struct i2c_msg msg[1];
+
+ dev_dbg(&client->dev, "%s: RTC not running!\n", __FUNCTION__);
+
+ /* Initialize all, including STATUS and CONTROL to zero */
+ memset(buf, 0, sizeof(buf));
++
++ /* Write valid values in the date/time registers */
++ buf[1+DS1337_REG_DAY] = 1;
++ buf[1+DS1337_REG_DATE] = 1;
++ buf[1+DS1337_REG_MONTH] = 1;
++
+ msg[0].addr = client->addr;
+ msg[0].flags = 0;
+ msg[0].len = sizeof(buf);
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.507122899@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:20 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ sandeen@redhat.com,
+ Andrew Morton <akpm@osdl.org>,
+ Linus Torvalds <torvalds@osdl.org>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 07/18] grow_buffers() infinite loop fix (CVE-2006-5757, CVE-2006-6060)
+Content-Disposition: inline; filename=grow_buffers-infinite-loop-fix.patch
+Content-Length: 1986
+Lines: 69
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Andrew Morton <akpm@osdl.org>
+
+If grow_buffers() is for some reason passed a block number which wants to lie
+outside the maximum-addressable pagecache range (PAGE_SIZE * 4G bytes) then it
+will accidentally truncate `index' and will then instnatiate a page at the
+wrong pagecache offset. This causes __getblk_slow() to go into an infinite
+loop.
+
+This can happen with corrupted disks, or with software errors elsewhere.
+
+Detect that, and handle it.
+
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/buffer.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.7.orig/fs/buffer.c
++++ linux-2.6.18.7/fs/buffer.c
+@@ -1179,8 +1179,21 @@ grow_buffers(struct block_device *bdev,
+ } while ((size << sizebits) < PAGE_SIZE);
+
+ index = block >> sizebits;
+- block = index << sizebits;
+
++ /*
++ * Check for a block which wants to lie outside our maximum possible
++ * pagecache index. (this comparison is done using sector_t types).
++ */
++ if (unlikely(index != block >> sizebits)) {
++ char b[BDEVNAME_SIZE];
++
++ printk(KERN_ERR "%s: requested out-of-range block %llu for "
++ "device %s\n",
++ __FUNCTION__, (unsigned long long)block,
++ bdevname(bdev, b));
++ return -EIO;
++ }
++ block = index << sizebits;
+ /* Create a page with the proper size buffers.. */
+ page = grow_dev_page(bdev, block, index, size);
+ if (!page)
+@@ -1207,12 +1220,16 @@ __getblk_slow(struct block_device *bdev,
+
+ for (;;) {
+ struct buffer_head * bh;
++ int ret;
+
+ bh = __find_get_block(bdev, block, size);
+ if (bh)
+ return bh;
+
+- if (!grow_buffers(bdev, block, size))
++ ret = grow_buffers(bdev, block, size);
++ if (ret < 0)
++ return NULL;
++ if (ret == 0)
+ free_more_memory();
+ }
+ }
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.630920163@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:21 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ sandeen@redhat.com,
+ Roman Zippel <zippel@linux-m68k.org>,
+ Andrew Morton <akpm@osdl.org>,
+ Linus Torvalds <torvalds@osdl.org>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 08/18] hfs_fill_super returns success even if no root inode (CVE-2006-6056)
+Content-Disposition: inline; filename=hfs_fill_super-returns-success-even-if-no-root-inode.patch
+Content-Length: 2186
+Lines: 69
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Eric Sandeen <sandeen@redhat.com>
+
+http://kernelfun.blogspot.com/2006/11/mokb-14-11-2006-linux-26x-selinux.html
+
+mount that image...
+fs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only.
+hfs: get root inode failed.
+BUG: unable to handle kernel NULL pointer dereference at virtual address 00000018
+ printing eip
+...
+EIP is at superblock_doinit+0x21/0x767
+...
+ [] selinux_sb_kern_mount+0xc/0x4b
+ [] vfs_kern_mount+0x99/0xf6
+ [] do_kern_mount+0x2d/0x3e
+ [] do_mount+0x5fa/0x66d
+ [] sys_mount+0x77/0xae
+ [] syscall_call+0x7/0xb
+DWARF2 unwinder stuck at syscall_call+0x7/0xb
+
+hfs_fill_super() returns success even if
+ root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
+or
+ sb->s_root = d_alloc_root(root_inode);
+
+fails. This superblock finds its way to superblock_doinit() which does:
+
+ struct dentry *root = sb->s_root;
+ struct inode *inode = root->d_inode;
+
+and boom. Need to make sure the error cases return an error, I think.
+
+[akpm@osdl.org: return -ENOMEM on oom]
+Signed-off-by: Eric Sandeen <sandeen@redhat.com>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+Date: Thu, 16 Nov 2006 09:19:22 +0000 (-0800)
+Subject: [patch 08/18] [PATCH] hfs_fill_super returns success even if no root inode
+X-Git-Tag: v2.6.19
+X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d6ddf55440833fd9404138026af246c51ebeef22
+
+ fs/hfs/super.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.18.7.orig/fs/hfs/super.c
++++ linux-2.6.18.7/fs/hfs/super.c
+@@ -391,11 +391,13 @@ static int hfs_fill_super(struct super_b
+ hfs_find_exit(&fd);
+ goto bail_no_root;
+ }
++ res = -EINVAL;
+ root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
+ hfs_find_exit(&fd);
+ if (!root_inode)
+ goto bail_no_root;
+
++ res = -ENOMEM;
+ sb->s_root = d_alloc_root(root_inode);
+ if (!sb->s_root)
+ goto bail_iput;
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.758381577@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:22 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ mst@mellanox.co.il,
+ openib-general@openib.org,
+ Roland Dreier <rolandd@cisco.com>,
+ Chris Wright <chrisw@sous-sol.org>
+Subject: [patch 09/18] IB/mad: Fix race between cancel and receive completion
+Content-Disposition: inline; filename=ib-mad-fix-race-between-cancel-and-receive-completion.patch
+Content-Length: 1609
+Lines: 44
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Roland Dreier <rdreier@cisco.com>
+
+When ib_cancel_mad() is called, it puts the canceled send on a list
+and schedules a "flushed" callback from process context. However,
+this leaves a window where a receive completion could be processed
+before the send is fully flushed.
+
+This is fine, except that ib_find_send_mad() will find the MAD and
+return it to the receive processing, which results in the sender
+getting both a successful receive and a "flushed" send completion for
+the same request. Understandably, this confuses the sender, which is
+expecting only one of these two callbacks, and leads to grief such as
+a use-after-free in IPoIB.
+
+Fix this by changing ib_find_send_mad() to return a send struct only
+if the status is still successful (and not "flushed"). The search of
+the send_list already had this check, so this patch just adds the same
+check to the search of the wait_list.
+
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+
+---
+ drivers/infiniband/core/mad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/infiniband/core/mad.c
++++ linux-2.6.18.7/drivers/infiniband/core/mad.c
+@@ -1750,7 +1750,7 @@ ib_find_send_mad(struct ib_mad_agent_pri
+ */
+ (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
+ rcv_has_same_gid(mad_agent_priv, wr, wc)))
+- return wr;
++ return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
+ }
+
+ /*
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007
+Message-Id: <20070221014545.881042384@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:23 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ang Way Chuang <wcang@nrg.cs.usm.my>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 10/18] dvb-core: fix bug in CRC-32 checking on 64-bit systems
+Content-Disposition: inline; filename=dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch
+Content-Length: 1894
+Lines: 43
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Ang Way Chuang <wcang@nrg.cs.usm.my>
+
+CRC-32 checking during ULE decapsulation always failed on x86_64 systems due
+to the size of a variable used to store CRC. This bug was discovered on
+Fedora Core 6 with kernel-2.6.18-1.2849. The i386 counterpart has no such
+problem. This patch has been tested on 64-bit system as well as 32-bit system.
+
+(cherry picked from commit dedcefb085fe98a1feaf63590fe2fc7e0ecb1987)
+
+Signed-off-by: Ang Way Chuang <wcang@nrg.cs.usm.my>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/dvb-core/dvb_net.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/media/dvb/dvb-core/dvb_net.c
++++ linux-2.6.18.7/drivers/media/dvb/dvb-core/dvb_net.c
+@@ -604,7 +604,7 @@ static void dvb_net_ule( struct net_devi
+ { &utype, sizeof utype },
+ { priv->ule_skb->data, priv->ule_skb->len - 4 }
+ };
+- unsigned long ule_crc = ~0L, expected_crc;
++ u32 ule_crc = ~0L, expected_crc;
+ if (priv->ule_dbit) {
+ /* Set D-bit for CRC32 verification,
+ * if it was set originally. */
+@@ -617,7 +617,7 @@ static void dvb_net_ule( struct net_devi
+ *((u8 *)priv->ule_skb->tail - 2) << 8 |
+ *((u8 *)priv->ule_skb->tail - 1);
+ if (ule_crc != expected_crc) {
+- printk(KERN_WARNING "%lu: CRC32 check FAILED: %#lx / %#lx, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
++ printk(KERN_WARNING "%lu: CRC32 check FAILED: %08x / %08x, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n",
+ priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0);
+
+ #ifdef ULE_DEBUG
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.005839775@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:24 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Hans Verkuil <hverkuil@xs4all.nl>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 11/18] v4l: cx2341x audio_properties is an u16, not u8
+Content-Disposition: inline; filename=v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch
+Content-Length: 950
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+This bug broke the MPEG audio mode controls.
+
+(cherry picked from commit cb2c7b4927c8f376b7ba9557978d8c59ed472664)
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/media/cx2341x.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/include/media/cx2341x.h
++++ linux-2.6.18.7/include/media/cx2341x.h
+@@ -49,7 +49,7 @@ struct cx2341x_mpeg_params {
+ enum v4l2_mpeg_audio_mode_extension audio_mode_extension;
+ enum v4l2_mpeg_audio_emphasis audio_emphasis;
+ enum v4l2_mpeg_audio_crc audio_crc;
+- u8 audio_properties;
++ u16 audio_properties;
+
+ /* video */
+ enum v4l2_mpeg_video_encoding video_encoding;
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.130315058@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:25 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 12/18] v4l: cx88: Fix leadtek_eeprom tagging
+Content-Disposition: inline; filename=v4l-cx88-Fix-leadtek_eeprom-tagging.patch
+Content-Length: 1309
+Lines: 34
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+reference to .init.text: from .text between 'cx88_card_setup'
+(at offset 0x68c) and 'cx88_risc_field'
+Caused by leadtek_eeprom() being declared __devinit and called from
+a non-devinit context.
+
+(cherry picked from commit 69f7e75a9d45e5eaca16917a8d0dedf76149f13f)
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-cards.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/media/video/cx88/cx88-cards.c
++++ linux-2.6.18.7/drivers/media/video/cx88/cx88-cards.c
+@@ -1465,7 +1465,7 @@ const unsigned int cx88_idcount = ARRAY_
+ /* ----------------------------------------------------------------------- */
+ /* some leadtek specific stuff */
+
+-static void __devinit leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
++static void leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data)
+ {
+ /* This is just for the "Winfast 2000XP Expert" board ATM; I don't have data on
+ * any others.
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.308448541@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:26 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Robert Hancock <hancockr@shaw.ca>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 13/18] V4L: cx88: Fix lockup on suspend
+Content-Disposition: inline; filename=V4L-cx88-Fix-lockup-on-suspend.patch
+Content-Length: 1305
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Robert Hancock <hancockr@shaw.ca>
+
+Suspending with the cx88xx module loaded causes the system to lock up
+because the cx88_audio_thread kthread was missing a try_to_freeze()
+call, which caused it to go into a tight loop and result in softlockup
+when suspending. Fix that.
+
+(cherry picked from commit a96afb3e9428f2e7463344f12dbc85faf08e2e09)
+
+Signed-off-by: Robert Hancock <hancockr@shaw.ca>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/cx88/cx88-tvaudio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.18.7.orig/drivers/media/video/cx88/cx88-tvaudio.c
++++ linux-2.6.18.7/drivers/media/video/cx88/cx88-tvaudio.c
+@@ -38,6 +38,7 @@
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
+ #include <linux/errno.h>
++#include <linux/freezer.h>
+ #include <linux/kernel.h>
+ #include <linux/slab.h>
+ #include <linux/mm.h>
+@@ -979,6 +980,7 @@ int cx88_audio_thread(void *data)
+ msleep_interruptible(1000);
+ if (kthread_should_stop())
+ break;
++ try_to_freeze();
+
+ /* just monitor the audio status for now ... */
+ memset(&t, 0, sizeof(t));
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.381507527@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:27 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Grant Likely <grant.likely@secretlab.ca>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 14/18] V4L: Fix quickcam communicator driver for big endian architectures
+Content-Disposition: inline; filename=V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch
+Content-Length: 1357
+Lines: 54
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Grant Likely <grant.likely@secretlab.ca>
+
+Host endianess does not affect the order that pixel rgb data comes
+in from the quickcam (the values are bytes, not words or longs). The
+driver is erroniously swapping the order of rgb values for big endian
+machines. This patch is needed get the Quickcam communicator working
+on big endian machines (tested on powerpc)
+
+(cherry picked from commit c6d704c8c4453f05717ba88792f70f8babf95268)
+
+Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/usbvideo/quickcam_messenger.h | 14 --------------
+ 1 file changed, 14 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/media/video/usbvideo/quickcam_messenger.h
++++ linux-2.6.18.7/drivers/media/video/usbvideo/quickcam_messenger.h
+@@ -35,27 +35,13 @@ struct rgb {
+ };
+
+ struct bayL0 {
+-#ifdef __BIG_ENDIAN
+- u8 r;
+- u8 g;
+-#elif __LITTLE_ENDIAN
+ u8 g;
+ u8 r;
+-#else
+-#error not byte order defined
+-#endif
+ };
+
+ struct bayL1 {
+-#ifdef __BIG_ENDIAN
+- u8 g;
+- u8 b;
+-#elif __LITTLE_ENDIAN
+ u8 b;
+ u8 g;
+-#else
+-#error not byte order defined
+-#endif
+ };
+
+ struct cam_size {
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.508284777@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:28 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Martin Samuelsson <sam@home.se>,
+ Andrew Morton <akpm@osdl.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 15/18] V4L: fix ks0127 status flags
+Content-Disposition: inline; filename=V4L-fix-ks0127-status-flags.patch
+Content-Length: 1389
+Lines: 41
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Martin Samuelsson <sam@home.se>
+
+Or status flags together in DECODER_GET_STATUS instead of and-zapping them.
+
+(cherry picked from commit 55d5440d4587454628a850ce26703639885af678)
+
+Signed-off-by: Martin Samuelsson <sam@home.se>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/ks0127.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- linux-2.6.18.7.orig/drivers/media/video/ks0127.c
++++ linux-2.6.18.7/drivers/media/video/ks0127.c
+@@ -712,13 +712,13 @@ static int ks0127_command(struct i2c_cli
+ *iarg = 0;
+ status = ks0127_read(ks, KS_STAT);
+ if (!(status & 0x20)) /* NOVID not set */
+- *iarg = (*iarg & DECODER_STATUS_GOOD);
++ *iarg = (*iarg | DECODER_STATUS_GOOD);
+ if ((status & 0x01)) /* CLOCK set */
+- *iarg = (*iarg & DECODER_STATUS_COLOR);
++ *iarg = (*iarg | DECODER_STATUS_COLOR);
+ if ((status & 0x08)) /* PALDET set */
+- *iarg = (*iarg & DECODER_STATUS_PAL);
++ *iarg = (*iarg | DECODER_STATUS_PAL);
+ else
+- *iarg = (*iarg & DECODER_STATUS_NTSC);
++ *iarg = (*iarg | DECODER_STATUS_NTSC);
+ break;
+
+ //Catch any unknown command
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.634183146@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:29 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 16/18] V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37
+Content-Disposition: inline; filename=V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch
+Content-Length: 1100
+Lines: 33
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+Autodetect LG TAPC G701D as tuner type 37, fixing
+mis-detected tuners in some Hauppauge tv tuner cards.
+
+Thanks to Adonis Papas, for pointing this out.
+
+(cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf)
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/tveeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.18.7.orig/drivers/media/video/tveeprom.c
++++ linux-2.6.18.7/drivers/media/video/tveeprom.c
+@@ -184,7 +184,7 @@ hauppauge_tuner[] =
+ { TUNER_ABSENT, "Thompson DTT757"},
+ /* 80-89 */
+ { TUNER_ABSENT, "Philips FQ1216LME MK3"},
+- { TUNER_ABSENT, "LG TAPC G701D"},
++ { TUNER_LG_PAL_NEW_TAPC, "LG TAPC G701D"},
+ { TUNER_LG_NTSC_NEW_TAPC, "LG TAPC H791F"},
+ { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MB 3"},
+ { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MI 3"},
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.760518719@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:30 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@tv-sign.ru>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>
+Subject: [patch 17/18] V4L: buf_qbuf: fix videobuf_queue->stream corruption and lockup
+Content-Disposition: inline; filename=V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch
+Content-Length: 1019
+Lines: 31
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+We are doing ->buf_prepare(buf) before adding buf to q->stream list. This
+means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer.
+
+(cherry picked from commit 419dd8378dfa32985672ab7927b4bc827f33b332)
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/video-buf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.7.orig/drivers/media/video/video-buf.c
++++ linux-2.6.18.7/drivers/media/video/video-buf.c
+@@ -695,6 +695,7 @@ videobuf_qbuf(struct videobuf_queue *q,
+ goto done;
+ }
+ if (buf->state == STATE_QUEUED ||
++ buf->state == STATE_PREPARED ||
+ buf->state == STATE_ACTIVE) {
+ dprintk(1,"qbuf: buffer is already queued or active.\n");
+ goto done;
+
+--
+
+From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007
+Message-Id: <20070221014546.882980060@mini.kroah.org>
+References: <20070221014413.282048309@mini.kroah.org>
+User-Agent: quilt/0.45-1
+Date: Tue, 20 Feb 2007 17:44:31 -0800
+From: Greg KH <greg@kroah.com>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ Andrew Morton <akpm@osdl.org>
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Dike <jdike@addtoit.com>,
+ Andi Kleen <ak@suse.de>,
+ user-mode-linux-devel@lists.sourceforge.net,
+ Paolo Blaisorblade Giarrusso <blaisorblade@yahoo.it>
+Subject: [patch 18/18] x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted
+Content-Disposition: inline; filename=x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch
+Content-Length: 1437
+Lines: 46
+
+-stable review patch. If anyone has any objections, please let us know.
+
+------------------
+From: "Paolo 'Blaisorblade' Giarrusso" <blaisorblade@yahoo.it>
+
+Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and
+forced by binary compatibility. UML/32bit breaks because of this - since it is wise
+enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host
+kernels.
+
+Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had:
+
+ default:
+ return sys_ptrace(request, pid, addr, data);
+
+Instead here we have:
+ case PTRACE_GET_THREAD_AREA:
+ case ...:
+ return sys_ptrace(request, pid, addr, data);
+
+ default:
+ return -EINVAL;
+
+This change was a style change - when a case is added, it must be explicitly
+tested this way. In this case, not enough testing was done.
+
+Cc: Andi Kleen <ak@suse.de>
+Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86_64/ia32/ptrace32.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.18.7.orig/arch/x86_64/ia32/ptrace32.c
++++ linux-2.6.18.7/arch/x86_64/ia32/ptrace32.c
+@@ -239,6 +239,7 @@ asmlinkage long sys32_ptrace(long reques
+ case PTRACE_SINGLESTEP:
+ case PTRACE_DETACH:
+ case PTRACE_SYSCALL:
++ case PTRACE_OLDSETOPTIONS:
+ case PTRACE_SETOPTIONS:
+ return sys_ptrace(request, pid, addr, data);
+
+
+--
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
