--- /dev/null
+From 9f3119b70cf189530f1b46a006a052e171a1622f Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Fri, 24 Aug 2007 16:18:16 +0800
+Subject: [PATCH] ACPI: Validate XSDT, use RSDT if XSDT fails
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit 9f3119b70cf189530f1b46a006a052e171a1622f in mainline.
+
+ACPI 1.0 used an RSDT with 32-bit physical addresses.
+ACPI 2.0 adds an XSDT with 32-bit physical addresses.
+An ACPI 2.0 aware OS is supposed to use the XSDT
+(when present) instead of the RSDT.
+
+However, several systems have failed because the XSDT
+contains NULL entries -- while it is missing pointers
+to needed tables, such as SSDTs.
+
+When we find an XSDT with NULL entries, discard it
+and use the ACPI 1.0 RSDT instead.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=8630
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Cc: Vincet Fortier <Vincent.Fortier1@EC.GC.CA>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/tables/tbutils.c | 71 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 71 insertions(+)
+
+--- a/drivers/acpi/tables/tbutils.c
++++ b/drivers/acpi/tables/tbutils.c
+@@ -51,6 +51,65 @@ ACPI_MODULE_NAME("tbutils")
+ static acpi_physical_address
+ acpi_tb_get_root_table_entry(u8 * table_entry,
+ acpi_native_uint table_entry_size);
++/*******************************************************************************
++ *
++ * FUNCTION: acpi_tb_check_xsdt
++ *
++ * PARAMETERS: address - Pointer to the XSDT
++ *
++ * RETURN: status
++ * AE_OK - XSDT is okay
++ * AE_NO_MEMORY - can't map XSDT
++ * AE_INVALID_TABLE_LENGTH - invalid table length
++ * AE_NULL_ENTRY - XSDT has NULL entry
++ *
++ * DESCRIPTION: validate XSDT
++******************************************************************************/
++
++static acpi_status
++acpi_tb_check_xsdt(acpi_physical_address address)
++{
++ struct acpi_table_header *table;
++ u32 length;
++ u64 xsdt_entry_address;
++ u8 *table_entry;
++ u32 table_count;
++ int i;
++
++ table = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
++ if (!table)
++ return AE_NO_MEMORY;
++
++ length = table->length;
++ acpi_os_unmap_memory(table, sizeof(struct acpi_table_header));
++ if (length < sizeof(struct acpi_table_header))
++ return AE_INVALID_TABLE_LENGTH;
++
++ table = acpi_os_map_memory(address, length);
++ if (!table)
++ return AE_NO_MEMORY;
++
++ /* Calculate the number of tables described in XSDT */
++ table_count =
++ (u32) ((table->length -
++ sizeof(struct acpi_table_header)) / sizeof(u64));
++ table_entry =
++ ACPI_CAST_PTR(u8, table) + sizeof(struct acpi_table_header);
++ for (i = 0; i < table_count; i++) {
++ ACPI_MOVE_64_TO_64(&xsdt_entry_address, table_entry);
++ if (!xsdt_entry_address) {
++ /* XSDT has NULL entry */
++ break;
++ }
++ table_entry += sizeof(u64);
++ }
++ acpi_os_unmap_memory(table, length);
++
++ if (i < table_count)
++ return AE_NULL_ENTRY;
++ else
++ return AE_OK;
++}
+
+ /*******************************************************************************
+ *
+@@ -341,6 +400,7 @@ acpi_tb_parse_root_table(acpi_physical_a
+ u32 table_count;
+ struct acpi_table_header *table;
+ acpi_physical_address address;
++ acpi_physical_address rsdt_address;
+ u32 length;
+ u8 *table_entry;
+ acpi_status status;
+@@ -369,6 +429,8 @@ acpi_tb_parse_root_table(acpi_physical_a
+ */
+ address = (acpi_physical_address) rsdp->xsdt_physical_address;
+ table_entry_size = sizeof(u64);
++ rsdt_address = (acpi_physical_address)
++ rsdp->rsdt_physical_address;
+ } else {
+ /* Root table is an RSDT (32-bit physical addresses) */
+
+@@ -382,6 +444,15 @@ acpi_tb_parse_root_table(acpi_physical_a
+ */
+ acpi_os_unmap_memory(rsdp, sizeof(struct acpi_table_rsdp));
+
++ if (table_entry_size == sizeof(u64)) {
++ if (acpi_tb_check_xsdt(address) == AE_NULL_ENTRY) {
++ /* XSDT has NULL entry, RSDT is used */
++ address = rsdt_address;
++ table_entry_size = sizeof(u32);
++ ACPI_WARNING((AE_INFO, "BIOS XSDT has NULL entry,"
++ "using RSDT"));
++ }
++ }
+ /* Map the RSDT/XSDT table header to get the full table length */
+
+ table = acpi_os_map_memory(address, sizeof(struct acpi_table_header));
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 24 04:52:14 2007
+From: Trent Piepho <xyzzy@speakeasy.org>
+Date: Fri, 24 Aug 2007 07:51:50 -0400
+Subject: DVB: b2c2-flexcop: fix Airstar HD5000 tuning regression
+To: stable@kernel.org
+Cc: Jarod Wilson <jwilson@redhat.com>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>, Trent Piepho <xyzzy@speakeasy.org>
+Message-ID: <46CEC656.2090304@linuxtv.org>
+
+
+From: Trent Piepho <xyzzy@speakeasy.org>
+
+cherry picked from commit 6175e487e314385e37f06448847e4c46c20edb44
+
+b2c2-flexcop: fix Airstar HD5000 tuning regression
+
+Git changeset 6bdcc6e6dbab8daffd05e5026486f34ba41a6c72 dropped the
+stand-alone lgh06xf module, whose functionality was absorbed into the
+dvb-pll module. However, there was a minor difference between the code
+in lgh06xf and dvb-pll, which caused a regression in b2c2-flexcop
+devices using the LG-H06xF NIM.
+
+dvb-pll will probe for the presence of an i2c pll chip by performing a
+single byte read, the lgh06xf driver did not do this. Unfortunately, the
+code in flexcop-i2c.c does not currently support 1 byte or 0 byte reads
+as a probe. Such probes with the current code will always fail.
+
+In order to work around this problem, and restore proper functionality
+of the Airstar HD5000 device, this hack was created to make the probe
+appear to succeed. The single byte read in dvb_pll_attach is the only
+place where such a probe would ever occur, so this change is safe, and
+will not affect any other devices.
+
+Of course, if one knew how to actually perform the read operation, it
+would be better to go that route. In the meantime, however, we must
+apply this workaround, in order to prevent the regression that causes
+tuning to fail on the Airstar HD5000 ATSC device.
+
+Thanks to Jarod Wilson, who had originally reported this regression, and
+to Geoffrey Hausheer, whose original workaround patch led us to find the
+actual cause of the problem.
+
+Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
+Cc: Geoffrey Hausheer <inli3epy93n@phracturedblue.com>
+Acked-by: Jarod Wilson <jwilson@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/b2c2/flexcop-i2c.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/dvb/b2c2/flexcop-i2c.c
++++ b/drivers/media/dvb/b2c2/flexcop-i2c.c
+@@ -135,6 +135,13 @@ static int flexcop_master_xfer(struct i2
+ struct flexcop_device *fc = i2c_get_adapdata(i2c_adap);
+ int i, ret = 0;
+
++ /* Some drivers use 1 byte or 0 byte reads as probes, which this
++ * driver doesn't support. These probes will always fail, so this
++ * hack makes them always succeed. If one knew how, it would of
++ * course be better to actually do the read. */
++ if (num == 1 && msgs[0].flags == I2C_M_RD && msgs[0].len <= 1)
++ return 1;
++
+ if (mutex_lock_interruptible(&fc->i2c_mutex))
+ return -ERESTARTSYS;
+
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 24 04:52:07 2007
+From: Michael Krufky <mkrufky@linuxtv.org>
+Date: Fri, 24 Aug 2007 07:51:47 -0400
+Subject: DVB: get_dvb_firmware: update script for new location of sp8870 firmware
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>
+Message-ID: <46CEC653.1040608@linuxtv.org>
+
+
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+cherry picked from commit 302170a4b47e869372974abd885dd11d5536b64a
+
+get_dvb_firmware: update script for new location of sp8870 firmware
+
+This url is no longer valid:
+http://www.technotrend.de/new/217g/tt_Premium_217g.zip
+
+Replace with:
+http://www.softwarepatch.pl/9999ccd06a4813cb827dbb0005071c71/tt_Premium_217g.zip
+
+Thanks-to: Tobias Stoeber <tobi@to-st.de>
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/dvb/get_dvb_firmware | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/dvb/get_dvb_firmware
++++ b/Documentation/dvb/get_dvb_firmware
+@@ -56,7 +56,7 @@ syntax();
+
+ sub sp8870 {
+ my $sourcefile = "tt_Premium_217g.zip";
+- my $url = "http://www.technotrend.de/new/217g/$sourcefile";
++ my $url = "http://www.softwarepatch.pl/9999ccd06a4813cb827dbb0005071c71/$sourcefile";
+ my $hash = "53970ec17a538945a6d8cb608a7b3899";
+ my $outfile = "dvb-fe-sp8870.fw";
+ my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 24 04:52:17 2007
+From: Andreas Arens <ari@goron.de>
+Date: Fri, 24 Aug 2007 07:51:49 -0400
+Subject: DVB: get_dvb_firmware: update script for new location of tda10046 firmware
+To: stable@kernel.org
+Cc: v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>
+Message-ID: <46CEC655.6040309@linuxtv.org>
+
+
+From: Andreas Arens <ari@goron.de>
+
+cherry picked from commit c545d6adbcacd296f7457bd992556feb055379de
+
+Update get_dvb_firmware script for the new location of the
+tda10046 firmware.
+
+The old location doesn't work anymore.
+
+Signed-off-by: Andreas Arens <ari@goron.de>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/dvb/get_dvb_firmware | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/Documentation/dvb/get_dvb_firmware
++++ b/Documentation/dvb/get_dvb_firmware
+@@ -110,21 +110,21 @@ sub tda10045 {
+ }
+
+ sub tda10046 {
+- my $sourcefile = "tt_budget_217g.zip";
+- my $url = "http://www.technotrend.de/new/217g/$sourcefile";
+- my $hash = "6a7e1e2f2644b162ff0502367553c72d";
+- my $outfile = "dvb-fe-tda10046.fw";
+- my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
++ my $sourcefile = "TT_PCI_2.19h_28_11_2006.zip";
++ my $url = "http://technotrend-online.com/download/software/219/$sourcefile";
++ my $hash = "6a7e1e2f2644b162ff0502367553c72d";
++ my $outfile = "dvb-fe-tda10046.fw";
++ my $tmpdir = tempdir(DIR => "/tmp", CLEANUP => 1);
+
+- checkstandard();
++ checkstandard();
+
+- wgetfile($sourcefile, $url);
+- unzip($sourcefile, $tmpdir);
+- extract("$tmpdir/software/OEM/PCI/App/ttlcdacc.dll", 0x3f731, 24478, "$tmpdir/fwtmp");
+- verify("$tmpdir/fwtmp", $hash);
+- copy("$tmpdir/fwtmp", $outfile);
++ wgetfile($sourcefile, $url);
++ unzip($sourcefile, $tmpdir);
++ extract("$tmpdir/TT_PCI_2.19h_28_11_2006/software/OEM/PCI/App/ttlcdacc.dll", 0x65389, 24478, "$tmpdir/fwtmp");
++ verify("$tmpdir/fwtmp", $hash);
++ copy("$tmpdir/fwtmp", $outfile);
+
+- $outfile;
++ $outfile;
+ }
+
+ sub tda10046lifeview {
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 31 23:28:28 2007
+From: Sam Ravnborg <sam@ravnborg.org>
+Date: Sat, 1 Sep 2007 08:29:40 +0200
+Subject: kconfig: oldconfig shall not set symbols if it does not need to
+To: Linus Torvalds <torvalds@linux-foundation.org>, stable@kernel.org
+Cc: Roman Zippel <zippel@linux-m68k.org>, Hugh Dickins <hugh@veritas.com>, LKML <linux-kernel@vger.kernel.org>
+Message-ID: <20070901062940.GA1520@uranus.ravnborg.org>
+Content-Disposition: inline
+
+
+From: Roman Zippel <zippel@linux-m68k.org>
+
+commit f82f3f9422d4da1eeec6f6cf3e64c6c34c4fe19b in mainline.
+
+Avoid setting the value if the symbol doesn't need to be changed or can't
+be changed. Later choices may change the dependencies and thus the
+possible input range.
+
+make oldconfig from a 2.6.22 .config with CONFIG_HOTPLUG_CPU not set
+was in some configurations setting CONFIG_HOTPLUG_CPU=y without asking,
+even when there was no actual requirement for CONFIG_HOTPLUG_CPU.
+This was triggered by SUSPEND_SMP that does a select HOTPLUG_CPU.
+
+Signed-off-by: Roman Zippel <zippel@linux-m68k.org>
+Tested-by: Hugh Dickins <hugh@veritas.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ scripts/kconfig/conf.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/scripts/kconfig/conf.c
++++ b/scripts/kconfig/conf.c
+@@ -64,7 +64,7 @@ static void check_stdin(void)
+ }
+ }
+
+-static void conf_askvalue(struct symbol *sym, const char *def)
++static int conf_askvalue(struct symbol *sym, const char *def)
+ {
+ enum symbol_type type = sym_get_type(sym);
+ tristate val;
+@@ -79,7 +79,7 @@ static void conf_askvalue(struct symbol
+ printf("%s\n", def);
+ line[0] = '\n';
+ line[1] = 0;
+- return;
++ return 0;
+ }
+
+ switch (input_mode) {
+@@ -89,23 +89,23 @@ static void conf_askvalue(struct symbol
+ case set_random:
+ if (sym_has_value(sym)) {
+ printf("%s\n", def);
+- return;
++ return 0;
+ }
+ break;
+ case ask_new:
+ case ask_silent:
+ if (sym_has_value(sym)) {
+ printf("%s\n", def);
+- return;
++ return 0;
+ }
+ check_stdin();
+ case ask_all:
+ fflush(stdout);
+ fgets(line, 128, stdin);
+- return;
++ return 1;
+ case set_default:
+ printf("%s\n", def);
+- return;
++ return 1;
+ default:
+ break;
+ }
+@@ -115,7 +115,7 @@ static void conf_askvalue(struct symbol
+ case S_HEX:
+ case S_STRING:
+ printf("%s\n", def);
+- return;
++ return 1;
+ default:
+ ;
+ }
+@@ -166,6 +166,7 @@ static void conf_askvalue(struct symbol
+ break;
+ }
+ printf("%s", line);
++ return 1;
+ }
+
+ int conf_string(struct menu *menu)
+@@ -179,7 +180,8 @@ int conf_string(struct menu *menu)
+ def = sym_get_string_value(sym);
+ if (sym_get_string_value(sym))
+ printf("[%s] ", def);
+- conf_askvalue(sym, def);
++ if (!conf_askvalue(sym, def))
++ return 0;
+ switch (line[0]) {
+ case '\n':
+ break;
+@@ -236,7 +238,8 @@ static int conf_sym(struct menu *menu)
+ if (sym->help)
+ printf("/?");
+ printf("] ");
+- conf_askvalue(sym, sym_get_string_value(sym));
++ if (!conf_askvalue(sym, sym_get_string_value(sym)))
++ return 0;
+ strip(line);
+
+ switch (line[0]) {
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Sep 4 15:57:55 2007
+From: Satyam Sharma <satyam@infradead.org>
+Date: Wed, 5 Sep 2007 04:40:52 +0530 (IST)
+Subject: MTD: Makefile fix for mtdsuper
+To: Jason Lunz <lunz@falooley.org>
+Cc: David Woodhouse <dwmw2@infradead.org>, lkml <linux-kernel@vger.kernel.org>, Stable Branch <stable@kernel.org>
+Message-ID: <alpine.LFD.0.999.0709050421330.20571@enigma.security.iitk.ac.in>
+
+From: Satyam Sharma <satyam@infradead.org>
+
+commit bec494775600b1cd7c144d31a09e1f46df9c6324 in mainline.
+
+We want drivers/mtd/{mtdcore, mtdsuper, mtdpart}.c to be built and linked
+into the same mtd.ko module. Fix the Makefile to ensure this, and remove
+duplicate MODULE_ declarations in mtdpart.c, as mtdcore.c already has them.
+
+Signed-off-by: Satyam Sharma <satyam@infradead.org>
+Signed-off-by: David Woodhouse <dwmw2@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/mtd/Makefile | 2 +-
+ drivers/mtd/mtdpart.c | 4 ----
+ 2 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/mtd/Makefile
++++ b/drivers/mtd/Makefile
+@@ -3,9 +3,9 @@
+ #
+
+ # Core functionality.
++obj-$(CONFIG_MTD) += mtd.o
+ mtd-y := mtdcore.o mtdsuper.o
+ mtd-$(CONFIG_MTD_PARTITIONS) += mtdpart.o
+-obj-$(CONFIG_MTD) += $(mtd-y)
+
+ obj-$(CONFIG_MTD_CONCAT) += mtdconcat.o
+ obj-$(CONFIG_MTD_REDBOOT_PARTS) += redboot.o
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -560,7 +560,3 @@ int parse_mtd_partitions(struct mtd_info
+ EXPORT_SYMBOL_GPL(parse_mtd_partitions);
+ EXPORT_SYMBOL_GPL(register_mtd_parser);
+ EXPORT_SYMBOL_GPL(deregister_mtd_parser);
+-
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Nicolas Pitre <nico@cam.org>");
+-MODULE_DESCRIPTION("Generic support for partitioning of MTD devices");
--- /dev/null
+v4l-ivtv-fix-vidioc_s_fbuf-new-osd-values-were-never-set.patch
+dvb-get_dvb_firmware-update-script-for-new-location-of-sp8870-firmware.patch
+dvb-get_dvb_firmware-update-script-for-new-location-of-tda10046-firmware.patch
+dvb-b2c2-flexcop-fix-airstar-hd5000-tuning-regression.patch
+setpgid-fails-if-the-child-was-forked-by-sub-thread.patch
+sigqueue_free-fix-the-race-with-collect_signal.patch
+kconfig-oldconfig-shall-not-set-symbols-if-it-does-not-need-to.patch
+mtd-makefile-fix-for-mtdsuper.patch
+usb-fix-linked-list-insertion-bugfix-for-usb-core.patch
+acpi-validate-xsdt-use-rsdt-if-xsdt-fails.patch
--- /dev/null
+From stable-bounces@linux.kernel.org Thu Aug 30 23:56:44 2007
+From: Oleg Nesterov <oleg@tv-sign.ru>
+Date: Thu, 30 Aug 2007 23:56:27 -0700
+Subject: setpgid(child) fails if the child was forked by sub-thread
+To: torvalds@linux-foundation.org
+Cc: qrczak@knm.org.pl, akpm@linux-foundation.org, oleg@tv-sign.ru, roland@redhat.com, stable@kernel.org
+Message-ID: <200708310656.l7V6uRT5028469@imap1.linux-foundation.org>
+
+
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+commit b07e35f94a7b6a059f889b904529ee907dc0634d in mainline tree
+
+Spotted by Marcin Kowalczyk <qrczak@knm.org.pl>.
+
+sys_setpgid(child) fails if the child was forked by sub-thread.
+
+Fix the "is it our child" check. The previous commit
+ee0acf90d320c29916ba8c5c1b2e908d81f5057d was not complete.
+
+(this patch asks for the new same_thread_group() helper, but mainline doesn't
+ have it yet).
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Acked-by: Roland McGrath <roland@redhat.com>
+Tested-by: "Marcin 'Qrczak' Kowalczyk" <qrczak@knm.org.pl>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ kernel/sys.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1428,7 +1428,6 @@ asmlinkage long sys_times(struct tms __u
+ * Auch. Had to add the 'did_exec' flag to conform completely to POSIX.
+ * LBT 04.03.94
+ */
+-
+ asmlinkage long sys_setpgid(pid_t pid, pid_t pgid)
+ {
+ struct task_struct *p;
+@@ -1456,7 +1455,7 @@ asmlinkage long sys_setpgid(pid_t pid, p
+ if (!thread_group_leader(p))
+ goto out;
+
+- if (p->real_parent == group_leader) {
++ if (p->real_parent->tgid == group_leader->tgid) {
+ err = -EPERM;
+ if (task_session(p) != task_session(group_leader))
+ goto out;
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 31 00:08:22 2007
+From: Oleg Nesterov <oleg@tv-sign.ru>
+Date: Thu, 30 Aug 2007 23:56:35 -0700
+Subject: sigqueue_free: fix the race with collect_signal()
+To: torvalds@linux-foundation.org
+Cc: stable@kernel.org, oleg@tv-sign.ru, sukadev@us.ibm.com, adobriyan@sw.ru, tglx@linutronix.de, jeremy.katz@windriver.com, yue.tao@windriver.com, akpm@linux-foundation.org, mingo@elte.hu, roland@redhat.com
+Message-ID: <200708310656.l7V6uZ1G028507@imap1.linux-foundation.org>
+
+
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+commit 60187d2708caa870f0825d753df1612ea688eb9e in mainline.
+
+Spotted by taoyue <yue.tao@windriver.com> and Jeremy Katz <jeremy.katz@windriver.com>.
+
+collect_signal: sigqueue_free:
+
+ list_del_init(&first->list);
+ if (!list_empty(&q->list)) {
+ // not taken
+ }
+ q->flags &= ~SIGQUEUE_PREALLOC;
+
+ __sigqueue_free(first); __sigqueue_free(q);
+
+Now, __sigqueue_free() is called twice on the same "struct sigqueue" with the
+obviously bad implications.
+
+In particular, this double free breaks the array_cache->avail logic, so the
+same sigqueue could be "allocated" twice, and the bug can manifest itself via
+the "impossible" BUG_ON(!SIGQUEUE_PREALLOC) in sigqueue_free/send_sigqueue.
+
+Hopefully this can explain these mysterious bug-reports, see
+
+ http://marc.info/?t=118766926500003
+ http://marc.info/?t=118466273000005
+
+Alexey Dobriyan reports this patch makes the difference for the testcase, but
+nobody has an access to the application which opened the problems originally.
+
+Also, this patch removes tasklist lock/unlock, ->siglock is enough.
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Cc: taoyue <yue.tao@windriver.com>
+Cc: Jeremy Katz <jeremy.katz@windriver.com>
+Cc: Sukadev Bhattiprolu <sukadev@us.ibm.com>
+Cc: Alexey Dobriyan <adobriyan@sw.ru>
+Cc: Ingo Molnar <mingo@elte.hu>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Roland McGrath <roland@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/signal.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1259,20 +1259,19 @@ struct sigqueue *sigqueue_alloc(void)
+ void sigqueue_free(struct sigqueue *q)
+ {
+ unsigned long flags;
++ spinlock_t *lock = ¤t->sighand->siglock;
++
+ BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
+ /*
+ * If the signal is still pending remove it from the
+- * pending queue.
++ * pending queue. We must hold ->siglock while testing
++ * q->list to serialize with collect_signal().
+ */
+- if (unlikely(!list_empty(&q->list))) {
+- spinlock_t *lock = ¤t->sighand->siglock;
+- read_lock(&tasklist_lock);
+- spin_lock_irqsave(lock, flags);
+- if (!list_empty(&q->list))
+- list_del_init(&q->list);
+- spin_unlock_irqrestore(lock, flags);
+- read_unlock(&tasklist_lock);
+- }
++ spin_lock_irqsave(lock, flags);
++ if (!list_empty(&q->list))
++ list_del_init(&q->list);
++ spin_unlock_irqrestore(lock, flags);
++
+ q->flags &= ~SIGQUEUE_PREALLOC;
+ __sigqueue_free(q);
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Sep 11 09:47:42 2007
+From: Nathael Pajani <nathael.pajani@cpe.fr>
+Date: Tue, 11 Sep 2007 09:46:48 -0700
+Subject: USB: fix linked list insertion bugfix for usb core
+To: linux-usb-devel@lists.sourceforge.net
+Cc: Greg Kroah-Hartman <gregkh@suse.de>, stable <stable@kernel.org>, Nathael Pajani <nathael.pajani@cpe.fr>
+Message-ID: <11895292331892-git-send-email-gregkh@suse.de>
+
+
+From: Nathael Pajani <nathael.pajani@cpe.fr>
+
+commit e5dd01154c1e9ca2400f4682602d1a4fa54c25dd in mainline.
+
+This patch fixes the order of list_add_tail() arguments in
+usb_store_new_id() so the list can have more than one single element.
+
+Signed-off-by: Nathael Pajani <nathael.pajani@cpe.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -58,7 +58,7 @@ ssize_t usb_store_new_id(struct usb_dyni
+ dynid->id.match_flags = USB_DEVICE_ID_MATCH_DEVICE;
+
+ spin_lock(&dynids->lock);
+- list_add_tail(&dynids->list, &dynid->node);
++ list_add_tail(&dynid->node, &dynids->list);
+ spin_unlock(&dynids->lock);
+
+ if (get_driver(driver)) {
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Aug 24 04:52:10 2007
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 24 Aug 2007 07:51:45 -0400
+Subject: V4L: ivtv: fix VIDIOC_S_FBUF: new OSD values were never set
+To: stable@kernel.org
+Cc: Hans Verkuil <hverkuil@xs4all.nl>, v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>
+Message-ID: <46CEC651.5090603@linuxtv.org>
+
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+cherry picked from commit c3624f99a8c06cfe75e0b06f23a7f7cea9d2d5ff
+
+ivtv: fix VIDIOC_S_FBUF support: new OSD values were never actually set.
+
+The values set with VIDIOC_S_FBUF were not actually used until the next
+VIDIOC_S_FMT. Fixed.
+
+
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+
+---
+ drivers/media/video/ivtv/ivtv-ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/video/ivtv/ivtv-ioctl.c
++++ b/drivers/media/video/ivtv/ivtv-ioctl.c
+@@ -1183,6 +1183,7 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s
+ itv->osd_global_alpha_state = (fb->flags & V4L2_FBUF_FLAG_GLOBAL_ALPHA) != 0;
+ itv->osd_local_alpha_state = (fb->flags & V4L2_FBUF_FLAG_LOCAL_ALPHA) != 0;
+ itv->osd_color_key_state = (fb->flags & V4L2_FBUF_FLAG_CHROMAKEY) != 0;
++ ivtv_set_osd_alpha(itv);
+ break;
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
