From: Greg Kroah-Hartman Date: Wed, 21 Feb 2007 01:56:06 +0000 (-0800) Subject: start of 2.6.18.8 release cycle X-Git-Tag: v2.6.18.8~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=efcb61bbd7a5a9620426c96f46c50b37c281061b;p=thirdparty%2Fkernel%2Fstable-queue.git start of 2.6.18.8 release cycle --- diff --git a/queue-2.6.18/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch b/review-2.6.18/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch similarity index 100% rename from queue-2.6.18/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch rename to review-2.6.18/V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch diff --git a/queue-2.6.18/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch b/review-2.6.18/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch similarity index 100% rename from queue-2.6.18/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch rename to review-2.6.18/V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch diff --git a/queue-2.6.18/V4L-cx88-Fix-lockup-on-suspend.patch b/review-2.6.18/V4L-cx88-Fix-lockup-on-suspend.patch similarity index 100% rename from queue-2.6.18/V4L-cx88-Fix-lockup-on-suspend.patch rename to review-2.6.18/V4L-cx88-Fix-lockup-on-suspend.patch diff --git a/queue-2.6.18/V4L-fix-ks0127-status-flags.patch b/review-2.6.18/V4L-fix-ks0127-status-flags.patch similarity index 100% rename from queue-2.6.18/V4L-fix-ks0127-status-flags.patch rename to review-2.6.18/V4L-fix-ks0127-status-flags.patch diff --git a/queue-2.6.18/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch b/review-2.6.18/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch similarity index 100% rename from queue-2.6.18/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch rename to review-2.6.18/V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch diff --git a/queue-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch b/review-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch similarity index 100% rename from queue-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch rename to review-2.6.18/bcm43xx-fix-for-oops-on-ampdu-status.patch diff --git a/queue-2.6.18/bcm43xx-fix-for-oops-on-resume.patch b/review-2.6.18/bcm43xx-fix-for-oops-on-resume.patch similarity index 100% rename from queue-2.6.18/bcm43xx-fix-for-oops-on-resume.patch rename to review-2.6.18/bcm43xx-fix-for-oops-on-resume.patch diff --git a/queue-2.6.18/don-t-leak-nt-bit-into-next-task.patch b/review-2.6.18/don-t-leak-nt-bit-into-next-task.patch similarity index 100% rename from queue-2.6.18/don-t-leak-nt-bit-into-next-task.patch rename to review-2.6.18/don-t-leak-nt-bit-into-next-task.patch diff --git a/queue-2.6.18/dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch b/review-2.6.18/dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch similarity index 100% rename from queue-2.6.18/dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch rename to review-2.6.18/dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch diff --git a/queue-2.6.18/grow_buffers-infinite-loop-fix.patch b/review-2.6.18/grow_buffers-infinite-loop-fix.patch similarity index 100% rename from queue-2.6.18/grow_buffers-infinite-loop-fix.patch rename to review-2.6.18/grow_buffers-infinite-loop-fix.patch diff --git a/queue-2.6.18/hfs_fill_super-returns-success-even-if-no-root-inode.patch b/review-2.6.18/hfs_fill_super-returns-success-even-if-no-root-inode.patch similarity index 100% rename from queue-2.6.18/hfs_fill_super-returns-success-even-if-no-root-inode.patch rename to review-2.6.18/hfs_fill_super-returns-success-even-if-no-root-inode.patch diff --git a/queue-2.6.18/i2c-fix-broken-ds1337-initialization.patch b/review-2.6.18/i2c-fix-broken-ds1337-initialization.patch similarity index 100% rename from queue-2.6.18/i2c-fix-broken-ds1337-initialization.patch rename to review-2.6.18/i2c-fix-broken-ds1337-initialization.patch diff --git a/queue-2.6.18/ib-mad-fix-race-between-cancel-and-receive-completion.patch b/review-2.6.18/ib-mad-fix-race-between-cancel-and-receive-completion.patch similarity index 100% rename from queue-2.6.18/ib-mad-fix-race-between-cancel-and-receive-completion.patch rename to review-2.6.18/ib-mad-fix-race-between-cancel-and-receive-completion.patch diff --git a/queue-2.6.18/ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch b/review-2.6.18/ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch similarity index 100% rename from queue-2.6.18/ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch rename to review-2.6.18/ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch diff --git a/review-2.6.18/mbox b/review-2.6.18/mbox new file mode 100644 index 00000000000..08b2958d941 --- /dev/null +++ b/review-2.6.18/mbox @@ -0,0 +1,1385 @@ +From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007 +Message-Id: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:13 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk +Subject: [patch 00/18] 2.6.18-stable review +Status: RO +Content-Length: 996 +Lines: 25 + +This is the start of the stable review cycle for the 2.6.18.8 release. + +This will be the last release of the 2.6.18-stable series, so if there +are patches that you feel should be applied to that tree, please let me +know. + +There are 18 patches in this series, all will be posted as a response to +this one. If anyone has any issues with these being applied, please let +us know. If anyone is a maintainer of the proper subsystem, and wants +to add a Signed-off-by: line to the patch, please respond with it. + +These patches are sent out with a number of different people on the Cc: +line. If you wish to be a reviewer, please email stable@kernel.org to +add your name to the list. If you want to be off the reviewer list, +also email us. + +Responses should be made by Friday February 23 00:00 UTC. Anything +received after that time might be too late. + +The whole patch set can be downloaded at: + kernel.org/pub/linux/kernel/v2.6/testing/patch-2.6.18.8-rc1.gz + +thanks, + +the -stable release team + +From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007 +Message-Id: <20070221014544.779031962@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:14 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Larry Finger +Subject: [patch 01/18] bcm43xx: Fix for oops on resume +Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-resume.patch +Content-Length: 779 +Lines: 27 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Larry Finger + +There is a kernel oops on bcm43xx when resuming due to an overly tight timeout loop. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx.h ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx.h +@@ -21,7 +21,7 @@ + #define PFX KBUILD_MODNAME ": " + + #define BCM43xx_SWITCH_CORE_MAX_RETRIES 50 +-#define BCM43xx_IRQWAIT_MAX_RETRIES 50 ++#define BCM43xx_IRQWAIT_MAX_RETRIES 100 + + #define BCM43xx_IO_SIZE 8192 + + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:44 2007 +Message-Id: <20070221014544.877269560@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:15 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Michael Buesch , + Larry Finger +Subject: [patch 02/18] bcm43xx: Fix for oops on ampdu status +Content-Disposition: inline; filename=bcm43xx-fix-for-oops-on-ampdu-status.patch +Content-Length: 2022 +Lines: 56 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Buesch + +If bcm43xx were to process an afterburner (ampdu) status response, Linux would oops. The +ampdu and intermediate status bits are properly named. + +Signed-off-by: Michael Buesch +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/bcm43xx/bcm43xx_main.c | 8 +++----- + drivers/net/wireless/bcm43xx/bcm43xx_xmit.h | 10 ++-------- + 2 files changed, 5 insertions(+), 13 deletions(-) + +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_main.c ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_main.c +@@ -1449,12 +1449,10 @@ static void handle_irq_transmit_status(s + + bcm43xx_debugfs_log_txstat(bcm, &stat); + +- if (stat.flags & BCM43xx_TXSTAT_FLAG_IGNORE) ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_AMPDU) ++ continue; ++ if (stat.flags & BCM43xx_TXSTAT_FLAG_INTER) + continue; +- if (!(stat.flags & BCM43xx_TXSTAT_FLAG_ACK)) { +- //TODO: packet was not acked (was lost) +- } +- //TODO: There are more (unknown) flags to test. see bcm43xx_main.h + + if (bcm43xx_using_pio(bcm)) + bcm43xx_pio_handle_xmitstatus(bcm, &stat); +--- linux-2.6.18.7.orig/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h ++++ linux-2.6.18.7/drivers/net/wireless/bcm43xx/bcm43xx_xmit.h +@@ -137,14 +137,8 @@ struct bcm43xx_xmitstatus { + u16 unknown; //FIXME + }; + +-#define BCM43xx_TXSTAT_FLAG_ACK 0x01 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x02 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x04 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x08 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x10 +-#define BCM43xx_TXSTAT_FLAG_IGNORE 0x20 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x40 +-//TODO #define BCM43xx_TXSTAT_FLAG_??? 0x80 ++#define BCM43xx_TXSTAT_FLAG_AMPDU 0x10 ++#define BCM43xx_TXSTAT_FLAG_INTER 0x20 + + u8 bcm43xx_plcp_get_ratecode_cck(const u8 bitrate); + u8 bcm43xx_plcp_get_ratecode_ofdm(const u8 bitrate); + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.001925033@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:16 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Andi Kleen , + Chuck Ebbert <76306.1226@compuserve.com>, + Chris Wright +Subject: [patch 03/18] Dont leak NT bit into next task +Content-Disposition: inline; filename=don-t-leak-nt-bit-into-next-task.patch +Content-Length: 2367 +Lines: 72 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andi Kleen + +SYSENTER can cause a NT to be set which might cause crashes on the IRET +in the next task. + +Following similar i386 patch from Linus. + +Signed-off-by: Andi Kleen +[backport from Chuck Ebbert] +Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86_64/kernel/entry.S | 4 ++++ + arch/x86_64/kernel/setup64.c | 4 ++++ + include/asm-x86_64/system.h | 5 +++-- + 3 files changed, 11 insertions(+), 2 deletions(-) + +--- linux-2.6.18.7.orig/arch/x86_64/kernel/entry.S ++++ linux-2.6.18.7/arch/x86_64/kernel/entry.S +@@ -146,6 +146,10 @@ + /* rdi: prev */ + ENTRY(ret_from_fork) + CFI_DEFAULT_STACK ++ push kernel_eflags(%rip) ++ CFI_ADJUST_CFA_OFFSET 4 ++ popf # reset kernel eflags ++ CFI_ADJUST_CFA_OFFSET -4 + call schedule_tail + GET_THREAD_INFO(%rcx) + testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),threadinfo_flags(%rcx) +--- linux-2.6.18.7.orig/arch/x86_64/kernel/setup64.c ++++ linux-2.6.18.7/arch/x86_64/kernel/setup64.c +@@ -178,6 +178,8 @@ void __cpuinit check_efer(void) + } + } + ++unsigned long kernel_eflags; ++ + /* + * cpu_init() initializes state that is per-CPU. Some data is already + * initialized (naturally) in the bootstrap process, such as the GDT +@@ -290,4 +292,6 @@ void __cpuinit cpu_init (void) + set_debugreg(0UL, 7); + + fpu_init(); ++ ++ raw_local_save_flags(kernel_eflags); + } +--- linux-2.6.18.7.orig/include/asm-x86_64/system.h ++++ linux-2.6.18.7/include/asm-x86_64/system.h +@@ -14,12 +14,13 @@ + #define __RESTORE(reg,offset) "movq (14-" #offset ")*8(%%rsp),%%" #reg "\n\t" + + /* frame pointer must be last for get_wchan */ +-#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t" +-#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\n\t" ++#define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t" ++#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t" + + #define __EXTRA_CLOBBER \ + ,"rcx","rbx","rdx","r8","r9","r10","r11","r12","r13","r14","r15" + ++/* Save restore flags to clear handle leaking NT */ + #define switch_to(prev,next,last) \ + asm volatile(SAVE_CONTEXT \ + "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \ + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.128265078@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:17 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + jens.axboe@oracle.com, + dougg@torque.net, + linux-ide@vger.kernel.org, + linux-scsi@vger.kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Tejun Heo , + Chris Wright +Subject: [patch 04/18] SCSI: add missing cdb clearing in scsi_execute() +Content-Disposition: inline; filename=scsi-add-missing-cdb-clearing-in-scsi_execute.patch +Content-Length: 1098 +Lines: 34 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Tejun Heo + +Clear-garbage-after-CDB patch missed scsi_execute() and it causes some +ODDs (HL-DT-ST DVD-RAM GSA-H30N) choke during SCSI scan. Note that +this patch is only for -stable. There is another more reliable fix +for this problem proposed for devel tree. + +http://thread.gmane.org/gmane.linux.ide/14605/focus=14605 + +Signed-off-by: Tejun Heo +Cc: Jens Axboe +Cc: Douglas Gilbert +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_lib.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.7.orig/drivers/scsi/scsi_lib.c ++++ linux-2.6.18.7/drivers/scsi/scsi_lib.c +@@ -191,6 +191,7 @@ int scsi_execute(struct scsi_device *sde + goto out; + + req->cmd_len = COMMAND_SIZE(cmd[0]); ++ memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */ + memcpy(req->cmd, cmd, req->cmd_len); + req->sense = sense; + req->sense_len = 0; + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.254816321@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:18 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Roland Dreier , + Chris Wright +Subject: [patch 05/18] IB/srp: Fix FMR mapping for 32-bit kernels and addresses above 4G +Content-Disposition: inline; filename=ib-srp-fix-fmr-mapping-for-32-bit-kernels-and-addresses-above-4g.patch +Content-Length: 1723 +Lines: 50 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roland Dreier + +struct srp_device.fmr_page_mask was unsigned long, which means that +the top part of addresses above 4G was being chopped off on 32-bit +architectures. Of course nothing good happens when data from SRP +targets is DMAed to the wrong place. + +Fix this by changing fmr_page_mask to u64, to match the addresses +actually used by IB devices. + +Thanks to Brian Cain and David McMillen + for help diagnosing the bug and testing +the fix. + +Signed-off-by: Roland Dreier +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/ulp/srp/ib_srp.c | 2 +- + drivers/infiniband/ulp/srp/ib_srp.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.7.orig/drivers/infiniband/ulp/srp/ib_srp.c ++++ linux-2.6.18.7/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1851,7 +1851,7 @@ static void srp_add_one(struct ib_device + */ + srp_dev->fmr_page_shift = max(9, ffs(dev_attr->page_size_cap) - 1); + srp_dev->fmr_page_size = 1 << srp_dev->fmr_page_shift; +- srp_dev->fmr_page_mask = ~((unsigned long) srp_dev->fmr_page_size - 1); ++ srp_dev->fmr_page_mask = ~((u64) srp_dev->fmr_page_size - 1); + + INIT_LIST_HEAD(&srp_dev->dev_list); + +--- linux-2.6.18.7.orig/drivers/infiniband/ulp/srp/ib_srp.h ++++ linux-2.6.18.7/drivers/infiniband/ulp/srp/ib_srp.h +@@ -87,7 +87,7 @@ struct srp_device { + struct ib_fmr_pool *fmr_pool; + int fmr_page_shift; + int fmr_page_size; +- unsigned long fmr_page_mask; ++ u64 fmr_page_mask; + }; + + struct srp_host { + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.383062473@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:19 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Dirk Eibach , + Adrian Bunk , + Dirk Stieler , + Jean Delvare , + Chris Wright +Subject: [patch 06/18] i2c: fix broken ds1337 initialization +Content-Disposition: inline; filename=i2c-fix-broken-ds1337-initialization.patch +Content-Length: 2187 +Lines: 58 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Dirk Eibach + +On a custom board with ds1337 RTC I found that upgrade from 2.6.15 to +2.6.18 broke RTC support. + +The main problem are changes to ds1337_init_client(). +When a ds1337 recognizes a problem (e.g. power or clock failure) bit 7 +in status register is set. This has to be reset by writing 0 to status +register. But since there are only 16 byte written to the chip and the +first byte is interpreted as an address, the status register (which is +the 16th) is never written. +The other problem is, that initializing all registers to zero is not +valid for day, date and month register. Funny enough this is checked by +ds1337_detect(), which depends on this values not being zero. So then +treated by ds1337_init_client() the ds1337 is not detected anymore, +whereas the failure bit in the status register is still set. + +Broken by commit f9e8957937ebf60d22732a5ca9130f48a7603f60 (2.6.16-rc1, +2006-01-06). This fix is in Linus' tree since 2.6.20-rc1 (commit +763d9c046a2e511ec090a8986d3f85edf7448e7e). + +Signed-off-by: Dirk Stieler +Signed-off-by: Dirk Eibach +Signed-off-by: Jean Delvare +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/chips/ds1337.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/i2c/chips/ds1337.c ++++ linux-2.6.18.7/drivers/i2c/chips/ds1337.c +@@ -347,13 +347,19 @@ static void ds1337_init_client(struct i2 + + if ((status & 0x80) || (control & 0x80)) { + /* RTC not running */ +- u8 buf[16]; ++ u8 buf[1+16]; /* First byte is interpreted as address */ + struct i2c_msg msg[1]; + + dev_dbg(&client->dev, "%s: RTC not running!\n", __FUNCTION__); + + /* Initialize all, including STATUS and CONTROL to zero */ + memset(buf, 0, sizeof(buf)); ++ ++ /* Write valid values in the date/time registers */ ++ buf[1+DS1337_REG_DAY] = 1; ++ buf[1+DS1337_REG_DATE] = 1; ++ buf[1+DS1337_REG_MONTH] = 1; ++ + msg[0].addr = client->addr; + msg[0].flags = 0; + msg[0].len = sizeof(buf); + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.507122899@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:20 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + sandeen@redhat.com, + Andrew Morton , + Linus Torvalds , + Chris Wright +Subject: [patch 07/18] grow_buffers() infinite loop fix (CVE-2006-5757, CVE-2006-6060) +Content-Disposition: inline; filename=grow_buffers-infinite-loop-fix.patch +Content-Length: 1986 +Lines: 69 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Andrew Morton + +If grow_buffers() is for some reason passed a block number which wants to lie +outside the maximum-addressable pagecache range (PAGE_SIZE * 4G bytes) then it +will accidentally truncate `index' and will then instnatiate a page at the +wrong pagecache offset. This causes __getblk_slow() to go into an infinite +loop. + +This can happen with corrupted disks, or with software errors elsewhere. + +Detect that, and handle it. + +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman + +--- + fs/buffer.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +--- linux-2.6.18.7.orig/fs/buffer.c ++++ linux-2.6.18.7/fs/buffer.c +@@ -1179,8 +1179,21 @@ grow_buffers(struct block_device *bdev, + } while ((size << sizebits) < PAGE_SIZE); + + index = block >> sizebits; +- block = index << sizebits; + ++ /* ++ * Check for a block which wants to lie outside our maximum possible ++ * pagecache index. (this comparison is done using sector_t types). ++ */ ++ if (unlikely(index != block >> sizebits)) { ++ char b[BDEVNAME_SIZE]; ++ ++ printk(KERN_ERR "%s: requested out-of-range block %llu for " ++ "device %s\n", ++ __FUNCTION__, (unsigned long long)block, ++ bdevname(bdev, b)); ++ return -EIO; ++ } ++ block = index << sizebits; + /* Create a page with the proper size buffers.. */ + page = grow_dev_page(bdev, block, index, size); + if (!page) +@@ -1207,12 +1220,16 @@ __getblk_slow(struct block_device *bdev, + + for (;;) { + struct buffer_head * bh; ++ int ret; + + bh = __find_get_block(bdev, block, size); + if (bh) + return bh; + +- if (!grow_buffers(bdev, block, size)) ++ ret = grow_buffers(bdev, block, size); ++ if (ret < 0) ++ return NULL; ++ if (ret == 0) + free_more_memory(); + } + } + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.630920163@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:21 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + sandeen@redhat.com, + Roman Zippel , + Andrew Morton , + Linus Torvalds , + Chris Wright +Subject: [patch 08/18] hfs_fill_super returns success even if no root inode (CVE-2006-6056) +Content-Disposition: inline; filename=hfs_fill_super-returns-success-even-if-no-root-inode.patch +Content-Length: 2186 +Lines: 69 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Eric Sandeen + +http://kernelfun.blogspot.com/2006/11/mokb-14-11-2006-linux-26x-selinux.html + +mount that image... +fs: filesystem was not cleanly unmounted, running fsck.hfs is recommended. mounting read-only. +hfs: get root inode failed. +BUG: unable to handle kernel NULL pointer dereference at virtual address 00000018 + printing eip +... +EIP is at superblock_doinit+0x21/0x767 +... + [] selinux_sb_kern_mount+0xc/0x4b + [] vfs_kern_mount+0x99/0xf6 + [] do_kern_mount+0x2d/0x3e + [] do_mount+0x5fa/0x66d + [] sys_mount+0x77/0xae + [] syscall_call+0x7/0xb +DWARF2 unwinder stuck at syscall_call+0x7/0xb + +hfs_fill_super() returns success even if + root_inode = hfs_iget(sb, &fd.search_key->cat, &rec); +or + sb->s_root = d_alloc_root(root_inode); + +fails. This superblock finds its way to superblock_doinit() which does: + + struct dentry *root = sb->s_root; + struct inode *inode = root->d_inode; + +and boom. Need to make sure the error cases return an error, I think. + +[akpm@osdl.org: return -ENOMEM on oom] +Signed-off-by: Eric Sandeen +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- +Date: Thu, 16 Nov 2006 09:19:22 +0000 (-0800) +Subject: [patch 08/18] [PATCH] hfs_fill_super returns success even if no root inode +X-Git-Tag: v2.6.19 +X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d6ddf55440833fd9404138026af246c51ebeef22 + + fs/hfs/super.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.18.7.orig/fs/hfs/super.c ++++ linux-2.6.18.7/fs/hfs/super.c +@@ -391,11 +391,13 @@ static int hfs_fill_super(struct super_b + hfs_find_exit(&fd); + goto bail_no_root; + } ++ res = -EINVAL; + root_inode = hfs_iget(sb, &fd.search_key->cat, &rec); + hfs_find_exit(&fd); + if (!root_inode) + goto bail_no_root; + ++ res = -ENOMEM; + sb->s_root = d_alloc_root(root_inode); + if (!sb->s_root) + goto bail_iput; + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.758381577@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:22 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + mst@mellanox.co.il, + openib-general@openib.org, + Roland Dreier , + Chris Wright +Subject: [patch 09/18] IB/mad: Fix race between cancel and receive completion +Content-Disposition: inline; filename=ib-mad-fix-race-between-cancel-and-receive-completion.patch +Content-Length: 1609 +Lines: 44 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Roland Dreier + +When ib_cancel_mad() is called, it puts the canceled send on a list +and schedules a "flushed" callback from process context. However, +this leaves a window where a receive completion could be processed +before the send is fully flushed. + +This is fine, except that ib_find_send_mad() will find the MAD and +return it to the receive processing, which results in the sender +getting both a successful receive and a "flushed" send completion for +the same request. Understandably, this confuses the sender, which is +expecting only one of these two callbacks, and leads to grief such as +a use-after-free in IPoIB. + +Fix this by changing ib_find_send_mad() to return a send struct only +if the status is still successful (and not "flushed"). The search of +the send_list already had this check, so this patch just adds the same +check to the search of the wait_list. + +Signed-off-by: Roland Dreier +Signed-off-by: Chris Wright +Signed-off-by: Greg Kroah-Hartman +--- + +--- + drivers/infiniband/core/mad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/infiniband/core/mad.c ++++ linux-2.6.18.7/drivers/infiniband/core/mad.c +@@ -1750,7 +1750,7 @@ ib_find_send_mad(struct ib_mad_agent_pri + */ + (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) || + rcv_has_same_gid(mad_agent_priv, wr, wc))) +- return wr; ++ return (wr->status == IB_WC_SUCCESS) ? wr : NULL; + } + + /* + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:45 2007 +Message-Id: <20070221014545.881042384@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:23 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Ang Way Chuang , + Mauro Carvalho Chehab +Subject: [patch 10/18] dvb-core: fix bug in CRC-32 checking on 64-bit systems +Content-Disposition: inline; filename=dvb-core-fix-bug-in-CRC-32-checking-on-64-bit-systems.patch +Content-Length: 1894 +Lines: 43 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Ang Way Chuang + +CRC-32 checking during ULE decapsulation always failed on x86_64 systems due +to the size of a variable used to store CRC. This bug was discovered on +Fedora Core 6 with kernel-2.6.18-1.2849. The i386 counterpart has no such +problem. This patch has been tested on 64-bit system as well as 32-bit system. + +(cherry picked from commit dedcefb085fe98a1feaf63590fe2fc7e0ecb1987) + +Signed-off-by: Ang Way Chuang +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/dvb/dvb-core/dvb_net.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- linux-2.6.18.7.orig/drivers/media/dvb/dvb-core/dvb_net.c ++++ linux-2.6.18.7/drivers/media/dvb/dvb-core/dvb_net.c +@@ -604,7 +604,7 @@ static void dvb_net_ule( struct net_devi + { &utype, sizeof utype }, + { priv->ule_skb->data, priv->ule_skb->len - 4 } + }; +- unsigned long ule_crc = ~0L, expected_crc; ++ u32 ule_crc = ~0L, expected_crc; + if (priv->ule_dbit) { + /* Set D-bit for CRC32 verification, + * if it was set originally. */ +@@ -617,7 +617,7 @@ static void dvb_net_ule( struct net_devi + *((u8 *)priv->ule_skb->tail - 2) << 8 | + *((u8 *)priv->ule_skb->tail - 1); + if (ule_crc != expected_crc) { +- printk(KERN_WARNING "%lu: CRC32 check FAILED: %#lx / %#lx, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n", ++ printk(KERN_WARNING "%lu: CRC32 check FAILED: %08x / %08x, SNDU len %d type %#x, ts_remain %d, next 2: %x.\n", + priv->ts_count, ule_crc, expected_crc, priv->ule_sndu_len, priv->ule_sndu_type, ts_remain, ts_remain > 2 ? *(unsigned short *)from_where : 0); + + #ifdef ULE_DEBUG + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.005839775@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:24 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Hans Verkuil , + Mauro Carvalho Chehab +Subject: [patch 11/18] v4l: cx2341x audio_properties is an u16, not u8 +Content-Disposition: inline; filename=v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch +Content-Length: 950 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Hans Verkuil + +This bug broke the MPEG audio mode controls. + +(cherry picked from commit cb2c7b4927c8f376b7ba9557978d8c59ed472664) + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + include/media/cx2341x.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/include/media/cx2341x.h ++++ linux-2.6.18.7/include/media/cx2341x.h +@@ -49,7 +49,7 @@ struct cx2341x_mpeg_params { + enum v4l2_mpeg_audio_mode_extension audio_mode_extension; + enum v4l2_mpeg_audio_emphasis audio_emphasis; + enum v4l2_mpeg_audio_crc audio_crc; +- u8 audio_properties; ++ u16 audio_properties; + + /* video */ + enum v4l2_mpeg_video_encoding video_encoding; + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.130315058@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:25 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jean Delvare , + Mauro Carvalho Chehab +Subject: [patch 12/18] v4l: cx88: Fix leadtek_eeprom tagging +Content-Disposition: inline; filename=v4l-cx88-Fix-leadtek_eeprom-tagging.patch +Content-Length: 1309 +Lines: 34 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Jean Delvare + +reference to .init.text: from .text between 'cx88_card_setup' +(at offset 0x68c) and 'cx88_risc_field' +Caused by leadtek_eeprom() being declared __devinit and called from +a non-devinit context. + +(cherry picked from commit 69f7e75a9d45e5eaca16917a8d0dedf76149f13f) + +Signed-off-by: Jean Delvare +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx88/cx88-cards.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/media/video/cx88/cx88-cards.c ++++ linux-2.6.18.7/drivers/media/video/cx88/cx88-cards.c +@@ -1465,7 +1465,7 @@ const unsigned int cx88_idcount = ARRAY_ + /* ----------------------------------------------------------------------- */ + /* some leadtek specific stuff */ + +-static void __devinit leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data) ++static void leadtek_eeprom(struct cx88_core *core, u8 *eeprom_data) + { + /* This is just for the "Winfast 2000XP Expert" board ATM; I don't have data on + * any others. + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.308448541@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:26 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Robert Hancock , + Mauro Carvalho Chehab +Subject: [patch 13/18] V4L: cx88: Fix lockup on suspend +Content-Disposition: inline; filename=V4L-cx88-Fix-lockup-on-suspend.patch +Content-Length: 1305 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Robert Hancock + +Suspending with the cx88xx module loaded causes the system to lock up +because the cx88_audio_thread kthread was missing a try_to_freeze() +call, which caused it to go into a tight loop and result in softlockup +when suspending. Fix that. + +(cherry picked from commit a96afb3e9428f2e7463344f12dbc85faf08e2e09) + +Signed-off-by: Robert Hancock +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx88/cx88-tvaudio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- linux-2.6.18.7.orig/drivers/media/video/cx88/cx88-tvaudio.c ++++ linux-2.6.18.7/drivers/media/video/cx88/cx88-tvaudio.c +@@ -38,6 +38,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -979,6 +980,7 @@ int cx88_audio_thread(void *data) + msleep_interruptible(1000); + if (kthread_should_stop()) + break; ++ try_to_freeze(); + + /* just monitor the audio status for now ... */ + memset(&t, 0, sizeof(t)); + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.381507527@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:27 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Grant Likely , + Mauro Carvalho Chehab +Subject: [patch 14/18] V4L: Fix quickcam communicator driver for big endian architectures +Content-Disposition: inline; filename=V4L-Fix-quickcam-communicator-driver-for-big-endian-architectures.patch +Content-Length: 1357 +Lines: 54 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Grant Likely + +Host endianess does not affect the order that pixel rgb data comes +in from the quickcam (the values are bytes, not words or longs). The +driver is erroniously swapping the order of rgb values for big endian +machines. This patch is needed get the Quickcam communicator working +on big endian machines (tested on powerpc) + +(cherry picked from commit c6d704c8c4453f05717ba88792f70f8babf95268) + +Signed-off-by: Grant Likely +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/usbvideo/quickcam_messenger.h | 14 -------------- + 1 file changed, 14 deletions(-) + +--- linux-2.6.18.7.orig/drivers/media/video/usbvideo/quickcam_messenger.h ++++ linux-2.6.18.7/drivers/media/video/usbvideo/quickcam_messenger.h +@@ -35,27 +35,13 @@ struct rgb { + }; + + struct bayL0 { +-#ifdef __BIG_ENDIAN +- u8 r; +- u8 g; +-#elif __LITTLE_ENDIAN + u8 g; + u8 r; +-#else +-#error not byte order defined +-#endif + }; + + struct bayL1 { +-#ifdef __BIG_ENDIAN +- u8 g; +- u8 b; +-#elif __LITTLE_ENDIAN + u8 b; + u8 g; +-#else +-#error not byte order defined +-#endif + }; + + struct cam_size { + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.508284777@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:28 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Martin Samuelsson , + Andrew Morton , + Mauro Carvalho Chehab +Subject: [patch 15/18] V4L: fix ks0127 status flags +Content-Disposition: inline; filename=V4L-fix-ks0127-status-flags.patch +Content-Length: 1389 +Lines: 41 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Martin Samuelsson + +Or status flags together in DECODER_GET_STATUS instead of and-zapping them. + +(cherry picked from commit 55d5440d4587454628a850ce26703639885af678) + +Signed-off-by: Martin Samuelsson +Signed-off-by: Andrew Morton +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ks0127.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- linux-2.6.18.7.orig/drivers/media/video/ks0127.c ++++ linux-2.6.18.7/drivers/media/video/ks0127.c +@@ -712,13 +712,13 @@ static int ks0127_command(struct i2c_cli + *iarg = 0; + status = ks0127_read(ks, KS_STAT); + if (!(status & 0x20)) /* NOVID not set */ +- *iarg = (*iarg & DECODER_STATUS_GOOD); ++ *iarg = (*iarg | DECODER_STATUS_GOOD); + if ((status & 0x01)) /* CLOCK set */ +- *iarg = (*iarg & DECODER_STATUS_COLOR); ++ *iarg = (*iarg | DECODER_STATUS_COLOR); + if ((status & 0x08)) /* PALDET set */ +- *iarg = (*iarg & DECODER_STATUS_PAL); ++ *iarg = (*iarg | DECODER_STATUS_PAL); + else +- *iarg = (*iarg & DECODER_STATUS_NTSC); ++ *iarg = (*iarg | DECODER_STATUS_NTSC); + break; + + //Catch any unknown command + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.634183146@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:29 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Mauro Carvalho Chehab +Subject: [patch 16/18] V4L: tveeprom: autodetect LG TAPC G701D as tuner type 37 +Content-Disposition: inline; filename=V4L-tveeprom-autodetect-LG-TAPC-G701D-as-tuner-type-37.patch +Content-Length: 1100 +Lines: 33 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Michael Krufky + +Autodetect LG TAPC G701D as tuner type 37, fixing +mis-detected tuners in some Hauppauge tv tuner cards. + +Thanks to Adonis Papas, for pointing this out. + +(cherry picked from commit 1323fbda1343f50f198bc8bd6d1d59c8b7fc45bf) + +Signed-off-by: Michael Krufky +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/tveeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- linux-2.6.18.7.orig/drivers/media/video/tveeprom.c ++++ linux-2.6.18.7/drivers/media/video/tveeprom.c +@@ -184,7 +184,7 @@ hauppauge_tuner[] = + { TUNER_ABSENT, "Thompson DTT757"}, + /* 80-89 */ + { TUNER_ABSENT, "Philips FQ1216LME MK3"}, +- { TUNER_ABSENT, "LG TAPC G701D"}, ++ { TUNER_LG_PAL_NEW_TAPC, "LG TAPC G701D"}, + { TUNER_LG_NTSC_NEW_TAPC, "LG TAPC H791F"}, + { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MB 3"}, + { TUNER_LG_PAL_NEW_TAPC, "TCL 2002MI 3"}, + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.760518719@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:30 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Oleg Nesterov , + Mauro Carvalho Chehab +Subject: [patch 17/18] V4L: buf_qbuf: fix videobuf_queue->stream corruption and lockup +Content-Disposition: inline; filename=V4L-buf_qbuf-fix-videobuf_queue-stream-corruption-and-lockup.patch +Content-Length: 1019 +Lines: 31 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: Oleg Nesterov + +We are doing ->buf_prepare(buf) before adding buf to q->stream list. This +means that videobuf_qbuf() should not try to re-add a STATE_PREPARED buffer. + +(cherry picked from commit 419dd8378dfa32985672ab7927b4bc827f33b332) + +Signed-off-by: Oleg Nesterov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/video-buf.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.7.orig/drivers/media/video/video-buf.c ++++ linux-2.6.18.7/drivers/media/video/video-buf.c +@@ -695,6 +695,7 @@ videobuf_qbuf(struct videobuf_queue *q, + goto done; + } + if (buf->state == STATE_QUEUED || ++ buf->state == STATE_PREPARED || + buf->state == STATE_ACTIVE) { + dprintk(1,"qbuf: buffer is already queued or active.\n"); + goto done; + +-- + +From gregkh@mini.kroah.org Tue Feb 20 17:45:46 2007 +Message-Id: <20070221014546.882980060@mini.kroah.org> +References: <20070221014413.282048309@mini.kroah.org> +User-Agent: quilt/0.45-1 +Date: Tue, 20 Feb 2007 17:44:31 -0800 +From: Greg KH +To: linux-kernel@vger.kernel.org, + stable@kernel.org, + Andrew Morton +Cc: Justin Forbes , + Zwane Mwaikambo , + Theodore Ts'o , + Randy Dunlap , + Dave Jones , + Chuck Wolber , + Chris Wedgwood , + Michael Krufky , + torvalds@linux-foundation.org, + akpm@linux-foundation.org, + alan@lxorguk.ukuu.org.uk, + Jeff Dike , + Andi Kleen , + user-mode-linux-devel@lists.sourceforge.net, + Paolo Blaisorblade Giarrusso +Subject: [patch 18/18] x86_64: fix 2.6.18 regression - PTRACE_OLDSETOPTIONS should be accepted +Content-Disposition: inline; filename=x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch +Content-Length: 1437 +Lines: 46 + +-stable review patch. If anyone has any objections, please let us know. + +------------------ +From: "Paolo 'Blaisorblade' Giarrusso" + +Also PTRACE_OLDSETOPTIONS should be accepted, as done by kernel/ptrace.c and +forced by binary compatibility. UML/32bit breaks because of this - since it is wise +enough to use PTRACE_OLDSETOPTIONS to be binary compatible with 2.4 host +kernels. + +Until 2.6.17 (commit f0f2d6536e3515b5b1b7ae97dc8f176860c8c2ce) we had: + + default: + return sys_ptrace(request, pid, addr, data); + +Instead here we have: + case PTRACE_GET_THREAD_AREA: + case ...: + return sys_ptrace(request, pid, addr, data); + + default: + return -EINVAL; + +This change was a style change - when a case is added, it must be explicitly +tested this way. In this case, not enough testing was done. + +Cc: Andi Kleen +Signed-off-by: Paolo 'Blaisorblade' Giarrusso +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86_64/ia32/ptrace32.c | 1 + + 1 file changed, 1 insertion(+) + +--- linux-2.6.18.7.orig/arch/x86_64/ia32/ptrace32.c ++++ linux-2.6.18.7/arch/x86_64/ia32/ptrace32.c +@@ -239,6 +239,7 @@ asmlinkage long sys32_ptrace(long reques + case PTRACE_SINGLESTEP: + case PTRACE_DETACH: + case PTRACE_SYSCALL: ++ case PTRACE_OLDSETOPTIONS: + case PTRACE_SETOPTIONS: + return sys_ptrace(request, pid, addr, data); + + +-- + diff --git a/queue-2.6.18/scsi-add-missing-cdb-clearing-in-scsi_execute.patch b/review-2.6.18/scsi-add-missing-cdb-clearing-in-scsi_execute.patch similarity index 100% rename from queue-2.6.18/scsi-add-missing-cdb-clearing-in-scsi_execute.patch rename to review-2.6.18/scsi-add-missing-cdb-clearing-in-scsi_execute.patch diff --git a/queue-2.6.18/series b/review-2.6.18/series similarity index 100% rename from queue-2.6.18/series rename to review-2.6.18/series diff --git a/queue-2.6.18/v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch b/review-2.6.18/v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch similarity index 100% rename from queue-2.6.18/v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch rename to review-2.6.18/v4l-cx2341x-audio_properties-is-an-u16-not-u8.patch diff --git a/queue-2.6.18/v4l-cx88-Fix-leadtek_eeprom-tagging.patch b/review-2.6.18/v4l-cx88-Fix-leadtek_eeprom-tagging.patch similarity index 100% rename from queue-2.6.18/v4l-cx88-Fix-leadtek_eeprom-tagging.patch rename to review-2.6.18/v4l-cx88-Fix-leadtek_eeprom-tagging.patch diff --git a/queue-2.6.18/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch b/review-2.6.18/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch similarity index 100% rename from queue-2.6.18/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch rename to review-2.6.18/x86_64-fix-2.6.18-regression-ptrace_oldsetoptions-should-be-accepted.patch