--- /dev/null
+From efc968d450e013049a662d22727cf132618dcb2f Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 9 Oct 2008 14:04:54 -0700
+Subject: Don't allow splice() to files opened with O_APPEND
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit efc968d450e013049a662d22727cf132618dcb2f upstream
+
+This is debatable, but while we're debating it, let's disallow the
+combination of splice and an O_APPEND destination.
+
+It's not entirely clear what the semantics of O_APPEND should be, and
+POSIX apparently expects pwrite() to ignore O_APPEND, for example. So
+we could make up any semantics we want, including the old ones.
+
+But Miklos convinced me that we should at least give it some thought,
+and that accepting writes at arbitrary offsets is wrong at least for
+IS_APPEND() files (which always have O_APPEND set, even if the reverse
+isn't true: you can obviously have O_APPEND set on a regular file).
+
+So disallow O_APPEND entirely for now. I doubt anybody cares, and this
+way we have one less gray area to worry about.
+
+Reported-and-argued-for-by: Miklos Szeredi <miklos@szeredi.hu>
+Acked-by: Jens Axboe <ens.axboe@oracle.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -891,6 +891,9 @@ static long do_splice_from(struct pipe_i
+ if (unlikely(!(out->f_mode & FMODE_WRITE)))
+ return -EBADF;
+
++ if (unlikely(out->f_flags & O_APPEND))
++ return -EINVAL;
++
+ ret = rw_verify_area(WRITE, out, ppos, len);
+ if (unlikely(ret < 0))
+ return ret;
--- /dev/null
+From khali@linux-fr.org Thu Oct 16 16:11:40 2008
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 10 Oct 2008 11:04:39 +0200
+Subject: hwmon: (it87) Prevent power-off on Shuttle SN68PT
+To: stable@kernel.org
+Message-ID: <20081010110439.0c508954@hyperion.delvare>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+based on commit 98dd22c3e086d76058083432d4d8fb85f04bab90 upstream
+
+On the Shuttle SN68PT, FAN_CTL2 is apparently not connected to a fan,
+but to something else. One user has reported instant system power-off
+when changing the PWM2 duty cycle, so we disable it.
+
+I use the board name string as the trigger in case the same board is
+ever used in other systems.
+
+This closes lm-sensors ticket #2349:
+pwmconfig causes a hard poweroff
+http://www.lm-sensors.org/ticket/2349
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/it87.c | 39 +++++++++++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -46,6 +46,8 @@
+ #include <linux/err.h>
+ #include <linux/mutex.h>
+ #include <linux/sysfs.h>
++#include <linux/string.h>
++#include <linux/dmi.h>
+ #include <asm/io.h>
+
+ #define DRVNAME "it87"
+@@ -235,6 +237,8 @@ struct it87_sio_data {
+ enum chips type;
+ /* Values read from Super-I/O config space */
+ u8 vid_value;
++ /* Values set based on DMI strings */
++ u8 skip_pwm;
+ };
+
+ /* For each registered chip, we need to keep some data in memory.
+@@ -952,6 +956,7 @@ static int __init it87_find(unsigned sho
+ {
+ int err = -ENODEV;
+ u16 chip_type;
++ const char *board_vendor, *board_name;
+
+ superio_enter();
+ chip_type = force_id ? force_id : superio_inw(DEVID);
+@@ -1009,6 +1014,25 @@ static int __init it87_find(unsigned sho
+ pr_info("it87: in7 is VCCH (+5V Stand-By)\n");
+ }
+
++ sio_data->skip_pwm = 0;
++ /* Disable specific features based on DMI strings */
++ board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
++ board_name = dmi_get_system_info(DMI_BOARD_NAME);
++ if (board_vendor && board_name) {
++ if (strcmp(board_vendor, "nVIDIA") == 0
++ && strcmp(board_name, "FN68PT") == 0) {
++ /* On the Shuttle SN68PT, FAN_CTL2 is apparently not
++ connected to a fan, but to something else. One user
++ has reported instant system power-off when changing
++ the PWM2 duty cycle, so we disable it.
++ I use the board name string as the trigger in case
++ the same board is ever used in other systems. */
++ pr_info("it87: Disabling pwm2 due to "
++ "hardware constraints\n");
++ sio_data->skip_pwm = (1 << 1);
++ }
++ }
++
+ exit:
+ superio_exit();
+ return err;
+@@ -1157,22 +1181,25 @@ static int __devinit it87_probe(struct p
+ if ((err = device_create_file(dev,
+ &sensor_dev_attr_pwm1_enable.dev_attr))
+ || (err = device_create_file(dev,
+- &sensor_dev_attr_pwm2_enable.dev_attr))
+- || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm3_enable.dev_attr))
+ || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm1.dev_attr))
+ || (err = device_create_file(dev,
+- &sensor_dev_attr_pwm2.dev_attr))
+- || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm3.dev_attr))
+ || (err = device_create_file(dev,
+ &dev_attr_pwm1_freq))
+ || (err = device_create_file(dev,
+- &dev_attr_pwm2_freq))
+- || (err = device_create_file(dev,
+ &dev_attr_pwm3_freq)))
+ goto ERROR4;
++ if (!(sio_data->skip_pwm & (1 << 1))) {
++ if ((err = device_create_file(dev,
++ &sensor_dev_attr_pwm2_enable.dev_attr))
++ || (err = device_create_file(dev,
++ &sensor_dev_attr_pwm2.dev_attr))
++ || (err = device_create_file(dev,
++ &dev_attr_pwm2_freq)))
++ goto ERROR4;
++ }
+ }
+
+ if (data->type == it8712 || data->type == it8716
cifs-make-sure-we-have-the-right-resume-info-before-calling-cifsfindnext.patch
b43legacy-fix-failure-in-rate-adjustment-mechanism.patch
fbcon_set_all_vcs-fix-kernel-crash-when-switching-the-rotated-consoles.patch
+hwmon-prevent-power-off-on-shuttle-sn68pt.patch
+don-t-allow-splice-to-files-opened-with-o_append.patch
+v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch
+v4l-zr36067-fix-rgbr-pixel-format.patch
--- /dev/null
+From mkrufky@linuxtv.org Thu Oct 16 16:19:11 2008
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 10 Oct 2008 08:42:01 -0400
+Subject: V4L: bttv: Prevent NULL pointer dereference in radio_open
+To: stable@kernel.org
+Cc: Jean Delvare <khali@linux-fr.org>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Mauro Carvalho Chehab <mchehab@infradead.org>
+Message-ID: <48EF4D99.2080007@linuxtv.org>
+
+From: Jean Delvare <khali@linux-fr.org>
+
+cherry picked from commit c37396c19403e249f12626187d51e92c915f2bc9
+
+Fix the following crash in the bttv driver:
+
+BUG: unable to handle kernel NULL pointer dereference at 000000000000036c
+IP: [<ffffffffa037860a>] radio_open+0x3a/0x170 [bttv]
+
+This happens because radio_open assumes that all present bttv devices
+have a radio function. If a bttv device without radio and one with
+radio are installed on the same system, and the one without radio is
+registered first, then radio_open checks for the radio device number
+of a bttv device that has no radio function, and this breaks. All we
+have to do to fix it is to skip bttv devices without a radio function.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/bt8xx/bttv-driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -3422,7 +3422,7 @@ static int radio_open(struct inode *inod
+ dprintk("bttv: open minor=%d\n",minor);
+
+ for (i = 0; i < bttv_num; i++) {
+- if (bttvs[i].radio_dev->minor == minor) {
++ if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
+ btv = &bttvs[i];
+ break;
+ }
--- /dev/null
+From mkrufky@linuxtv.org Thu Oct 16 16:19:48 2008
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 10 Oct 2008 08:41:33 -0400
+Subject: V4L: zr36067: Fix RGBR pixel format
+To: stable@kernel.org
+Cc: Jean Delvare <khali@linux-fr.org>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Trent Piepho <xyzzy@speakeasy.org>, Mauro Carvalho Chehab <mchehab@infradead.org>
+Message-ID: <48EF4D7D.50800@linuxtv.org>
+
+
+From: Jean Delvare <khali@linux-fr.org>
+
+(cherry picked from commit a30ee3c747728f9151664118ffcbdeefd202c332)
+
+The zr36067 driver is improperly declaring pixel format RGBP twice,
+once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is
+actually RGBR. Fix the code to properly map both pixel formats.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Trent Piepho <xyzzy@speakeasy.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/zoran_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/zoran_driver.c
++++ b/drivers/media/video/zoran_driver.c
+@@ -139,7 +139,7 @@ const struct zoran_format zoran_formats[
+ }, {
+ .name = "16-bit RGB BE",
+ ZFMT(-1,
+- V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
++ V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
+ .depth = 16,
+ .flags = ZORAN_FORMAT_CAPTURE |
+ ZORAN_FORMAT_OVERLAY,
projects / thirdparty / kernel / stable-queue.git / commitdiff
