From: Greg Kroah-Hartman Date: Sat, 26 Apr 2008 02:16:56 +0000 (-0700) Subject: more .25 patches X-Git-Tag: v2.6.25.1~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7d3da018d88c0486e8106f849fb24ecc826a2abf;p=thirdparty%2Fkernel%2Fstable-queue.git more .25 patches --- diff --git a/queue-2.6.25/b43-add-more-btcoexist-workarounds.patch b/queue-2.6.25/b43-add-more-btcoexist-workarounds.patch new file mode 100644 index 00000000000..f97552a8a7b --- /dev/null +++ b/queue-2.6.25/b43-add-more-btcoexist-workarounds.patch @@ -0,0 +1,52 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:15:44 2008 +From: Michael Buesch +Date: Thu, 24 Apr 2008 20:04:38 +0200 +Subject: b43: Add more btcoexist workarounds +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200804242004.39249.mb@bu3sch.de> +Content-Disposition: inline + +From: Michael Buesch + +commit 9fc38458355525f801cd2ab403ac89850489a05e upstream + +This adds more workarounds for devices with broken BT bits. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/b43/main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -4009,6 +4009,12 @@ static int b43_one_core_attach(struct ss + return err; + } + ++#define IS_PDEV(pdev, _vendor, _device, _subvendor, _subdevice) ( \ ++ (pdev->vendor == PCI_VENDOR_ID_##_vendor) && \ ++ (pdev->device == _device) && \ ++ (pdev->subsystem_vendor == PCI_VENDOR_ID_##_subvendor) && \ ++ (pdev->subsystem_device == _subdevice) ) ++ + static void b43_sprom_fixup(struct ssb_bus *bus) + { + struct pci_dev *pdev; +@@ -4022,10 +4028,9 @@ static void b43_sprom_fixup(struct ssb_b + bus->sprom.boardflags_lo |= B43_BFL_PACTRL; + if (bus->bustype == SSB_BUSTYPE_PCI) { + pdev = bus->host_pci; +- if (pdev->vendor == PCI_VENDOR_ID_BROADCOM && +- pdev->device == 0x4318 && +- pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK && +- pdev->subsystem_device == 0x100F) ++ if (IS_PDEV(pdev, BROADCOM, 0x4318, ASUSTEK, 0x100F) || ++ IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0015) || ++ IS_PDEV(pdev, BROADCOM, 0x4320, LINKSYS, 0x0013)) + bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST; + } + } diff --git a/queue-2.6.25/b43-workaround-dma-quirks.patch b/queue-2.6.25/b43-workaround-dma-quirks.patch new file mode 100644 index 00000000000..428e8163398 --- /dev/null +++ b/queue-2.6.25/b43-workaround-dma-quirks.patch @@ -0,0 +1,123 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:58:01 2008 +From: Michael Buesch +Date: Thu, 24 Apr 2008 20:06:11 +0200 +Subject: b43: Workaround DMA quirks +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200804242006.12088.mb@bu3sch.de> +Content-Disposition: inline + +From: Michael Buesch + +commit 1033b3ea11820ea1fb1b877207bd6724e9aaedc3 upstream + +Some mainboards/CPUs don't allow DMA masks bigger than a certain limit. +Some VIA crap^h^h^h^hdevices have an upper limit of 0xFFFFFFFF. So in this +case a 64-bit b43 device would always fail to acquire the mask. +Implement a workaround to fallback to lower DMA mask, as we can always +also support a lower mask. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville + + +--- + drivers/net/wireless/b43/dma.c | 73 +++++++++++++++++++++++++++++------------ + 1 file changed, 52 insertions(+), 21 deletions(-) + +--- a/drivers/net/wireless/b43/dma.c ++++ b/drivers/net/wireless/b43/dma.c +@@ -822,6 +822,18 @@ static u64 supported_dma_mask(struct b43 + return DMA_30BIT_MASK; + } + ++static enum b43_dmatype dma_mask_to_engine_type(u64 dmamask) ++{ ++ if (dmamask == DMA_30BIT_MASK) ++ return B43_DMA_30BIT; ++ if (dmamask == DMA_32BIT_MASK) ++ return B43_DMA_32BIT; ++ if (dmamask == DMA_64BIT_MASK) ++ return B43_DMA_64BIT; ++ B43_WARN_ON(1); ++ return B43_DMA_30BIT; ++} ++ + /* Main initialization function. */ + static + struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, +@@ -982,6 +994,42 @@ void b43_dma_free(struct b43_wldev *dev) + dma->tx_ring0 = NULL; + } + ++static int b43_dma_set_mask(struct b43_wldev *dev, u64 mask) ++{ ++ u64 orig_mask = mask; ++ bool fallback = 0; ++ int err; ++ ++ /* Try to set the DMA mask. If it fails, try falling back to a ++ * lower mask, as we can always also support a lower one. */ ++ while (1) { ++ err = ssb_dma_set_mask(dev->dev, mask); ++ if (!err) ++ break; ++ if (mask == DMA_64BIT_MASK) { ++ mask = DMA_32BIT_MASK; ++ fallback = 1; ++ continue; ++ } ++ if (mask == DMA_32BIT_MASK) { ++ mask = DMA_30BIT_MASK; ++ fallback = 1; ++ continue; ++ } ++ b43err(dev->wl, "The machine/kernel does not support " ++ "the required %u-bit DMA mask\n", ++ (unsigned int)dma_mask_to_engine_type(orig_mask)); ++ return -EOPNOTSUPP; ++ } ++ if (fallback) { ++ b43info(dev->wl, "DMA mask fallback from %u-bit to %u-bit\n", ++ (unsigned int)dma_mask_to_engine_type(orig_mask), ++ (unsigned int)dma_mask_to_engine_type(mask)); ++ } ++ ++ return 0; ++} ++ + int b43_dma_init(struct b43_wldev *dev) + { + struct b43_dma *dma = &dev->dma; +@@ -991,27 +1039,10 @@ int b43_dma_init(struct b43_wldev *dev) + enum b43_dmatype type; + + dmamask = supported_dma_mask(dev); +- switch (dmamask) { +- default: +- B43_WARN_ON(1); +- case DMA_30BIT_MASK: +- type = B43_DMA_30BIT; +- break; +- case DMA_32BIT_MASK: +- type = B43_DMA_32BIT; +- break; +- case DMA_64BIT_MASK: +- type = B43_DMA_64BIT; +- break; +- } +- err = ssb_dma_set_mask(dev->dev, dmamask); +- if (err) { +- b43err(dev->wl, "The machine/kernel does not support " +- "the required DMA mask (0x%08X%08X)\n", +- (unsigned int)((dmamask & 0xFFFFFFFF00000000ULL) >> 32), +- (unsigned int)(dmamask & 0x00000000FFFFFFFFULL)); +- return -EOPNOTSUPP; +- } ++ type = dma_mask_to_engine_type(dmamask); ++ err = b43_dma_set_mask(dev, dmamask); ++ if (err) ++ return err; + + err = -ENOMEM; + /* setup TX DMA channels. */ diff --git a/queue-2.6.25/b43-workaround-invalid-bluetooth-settings.patch b/queue-2.6.25/b43-workaround-invalid-bluetooth-settings.patch new file mode 100644 index 00000000000..c62c33751be --- /dev/null +++ b/queue-2.6.25/b43-workaround-invalid-bluetooth-settings.patch @@ -0,0 +1,94 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 13:48:01 2008 +From: Michael Buesch +Date: Thu, 24 Apr 2008 20:02:41 +0200 +Subject: b43: Workaround invalid bluetooth settings +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200804242002.41684.mb@bu3sch.de> +Content-Disposition: inline + +From: Michael Buesch + +commit 1855ba7812dbd294fcfc083dc7d3b14d3b1f38db upstream. + +This adds a workaround for invalid bluetooth SPROM settings +on ASUS PCI cards. +This will stop the microcode from poking with the BT GPIO line. +This fixes data transmission on this device, as the BT GPIO line +is used for something TX related on this device +(probably the power amplifier or the radio). +This also adds a modparam knob to help debugging this in the future, +as more devices with this bug may show up. + +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/net/wireless/b43/main.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -78,6 +78,11 @@ static int modparam_nohwcrypt; + module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444); + MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption."); + ++static int modparam_btcoex = 1; ++module_param_named(btcoex, modparam_btcoex, int, 0444); ++MODULE_PARM_DESC(btcoex, "Enable Bluetooth coexistance (default on)"); ++ ++ + static const struct ssb_device_id b43_ssb_tbl[] = { + SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5), + SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6), +@@ -3339,6 +3344,8 @@ static void b43_bluetooth_coext_enable(s + struct ssb_sprom *sprom = &dev->dev->bus->sprom; + u32 hf; + ++ if (!modparam_btcoex) ++ return; + if (!(sprom->boardflags_lo & B43_BFL_BTCOEXIST)) + return; + if (dev->phy.type != B43_PHYTYPE_B && !dev->phy.gmode) +@@ -3350,11 +3357,13 @@ static void b43_bluetooth_coext_enable(s + else + hf |= B43_HF_BTCOEX; + b43_hf_write(dev, hf); +- //TODO + } + + static void b43_bluetooth_coext_disable(struct b43_wldev *dev) +-{ //TODO ++{ ++ if (!modparam_btcoex) ++ return; ++ //TODO + } + + static void b43_imcfglo_timeouts_workaround(struct b43_wldev *dev) +@@ -4002,6 +4011,8 @@ static int b43_one_core_attach(struct ss + + static void b43_sprom_fixup(struct ssb_bus *bus) + { ++ struct pci_dev *pdev; ++ + /* boardflags workarounds */ + if (bus->boardinfo.vendor == SSB_BOARDVENDOR_DELL && + bus->chip_id == 0x4301 && bus->boardinfo.rev == 0x74) +@@ -4009,6 +4020,14 @@ static void b43_sprom_fixup(struct ssb_b + if (bus->boardinfo.vendor == PCI_VENDOR_ID_APPLE && + bus->boardinfo.type == 0x4E && bus->boardinfo.rev > 0x40) + bus->sprom.boardflags_lo |= B43_BFL_PACTRL; ++ if (bus->bustype == SSB_BUSTYPE_PCI) { ++ pdev = bus->host_pci; ++ if (pdev->vendor == PCI_VENDOR_ID_BROADCOM && ++ pdev->device == 0x4318 && ++ pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK && ++ pdev->subsystem_device == 0x100F) ++ bus->sprom.boardflags_lo &= ~B43_BFL_BTCOEXIST; ++ } + } + + static void b43_wireless_exit(struct ssb_device *dev, struct b43_wl *wl) diff --git a/queue-2.6.25/s2io-fix-memory-leak-during-free_tx_buffers.patch b/queue-2.6.25/s2io-fix-memory-leak-during-free_tx_buffers.patch new file mode 100644 index 00000000000..67cdbb5095d --- /dev/null +++ b/queue-2.6.25/s2io-fix-memory-leak-during-free_tx_buffers.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Fri Apr 25 10:25:18 2008 +From: Sreenivasa Honnur +Date: Fri, 25 Apr 2008 13:21:40 -0400 (EDT) +Subject: S2io: Fix memory leak during free_tx_buffers +To: stable@kernel.org, jeff@garzik.org +Cc: support@neterion.com +Message-ID: + +From: Sreenivasa Honnur + +commit b35b3b49fc6750806964048b31799c8782980ef9 upstream + +- Fix the memory leak during free_tx_buffers. + +Signed-off-by: Santosh Rastapur +Signed-off-by: Ramkrishna Vepa +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/s2io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/s2io.c ++++ b/drivers/net/s2io.c +@@ -2339,7 +2339,7 @@ static void free_tx_buffers(struct s2io_ + for (i = 0; i < config->tx_fifo_num; i++) { + unsigned long flags; + spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags); +- for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) { ++ for (j = 0; j < config->tx_cfg[i].fifo_len; j++) { + txdp = (struct TxD *) \ + mac_control->fifos[i].list_info[j].list_virt_addr; + skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j); diff --git a/queue-2.6.25/s2io-version-update-for-memory-leak-fix-during-free_tx_buffers.patch b/queue-2.6.25/s2io-version-update-for-memory-leak-fix-during-free_tx_buffers.patch new file mode 100644 index 00000000000..f3cbd48537f --- /dev/null +++ b/queue-2.6.25/s2io-version-update-for-memory-leak-fix-during-free_tx_buffers.patch @@ -0,0 +1,34 @@ +From stable-bounces@linux.kernel.org Fri Apr 25 10:52:38 2008 +From: Sreenivasa Honnur +Date: Fri, 25 Apr 2008 13:22:41 -0400 (EDT) +Subject: S2io: Version update for memory leak fix during free_tx_buffers +To: stable@kernel.org, jeff@garzik.org +Cc: support@neterion.com +Message-ID: + +From: Sreenivasa Honnur + +commit 10371b5e6ba22173425877ea6a7040619b005fa1 upstream + +- Updated version number. + +Signed-off-by: Santosh Rastapur +Signed-off-by: Ramkrishna Vepa +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/s2io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/s2io.c ++++ b/drivers/net/s2io.c +@@ -84,7 +84,7 @@ + #include "s2io.h" + #include "s2io-regs.h" + +-#define DRV_VERSION "2.0.26.20" ++#define DRV_VERSION "2.0.26.22" + + /* S2io Driver name & version. */ + static char s2io_driver_name[] = "Neterion"; diff --git a/queue-2.6.25/selinux-no-bug_on-in-selinux_clone_mnt_opts.patch b/queue-2.6.25/selinux-no-bug_on-in-selinux_clone_mnt_opts.patch new file mode 100644 index 00000000000..994dbf7f3df --- /dev/null +++ b/queue-2.6.25/selinux-no-bug_on-in-selinux_clone_mnt_opts.patch @@ -0,0 +1,51 @@ +From stable-bounces@linux.kernel.org Mon Apr 21 16:51:14 2008 +From: Eric Paris +Date: Mon, 21 Apr 2008 16:24:11 -0400 +Subject: SELinux: no BUG_ON(!ss_initialized) in selinux_clone_mnt_opts +To: selinux@tycho.nsa.gov, stable@kernel.org +Cc: sds@tycho.nsa.gov, jmorris@namei.org +Message-ID: <1208809451.2985.82.camel@localhost.localdomain> + +From: Eric Paris + +commit 0f5e64200f20fc8f5b759c4010082f577ab0af3f upstream + +The Fedora installer actually makes multiple NFS mounts before it loads +selinux policy. The code in selinux_clone_mnt_opts() assumed that the +init process would always be loading policy before NFS was up and +running. It might be possible to hit this in a diskless environment as +well, I'm not sure. There is no need to BUG_ON() in this situation +since we can safely continue given the circumstances. + +Signed-off-by: Eric Paris +Signed-off-by: James Morris +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/hooks.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -756,9 +756,18 @@ static void selinux_sb_clone_mnt_opts(co + int set_context = (oldsbsec->flags & CONTEXT_MNT); + int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); + +- /* we can't error, we can't save the info, this shouldn't get called +- * this early in the boot process. */ +- BUG_ON(!ss_initialized); ++ /* ++ * if the parent was able to be mounted it clearly had no special lsm ++ * mount options. thus we can safely put this sb on the list and deal ++ * with it later ++ */ ++ if (!ss_initialized) { ++ spin_lock(&sb_security_lock); ++ if (list_empty(&newsbsec->list)) ++ list_add(&newsbsec->list, &superblock_security_head); ++ spin_unlock(&sb_security_lock); ++ return; ++ } + + /* how can we clone if the old one wasn't set up?? */ + BUG_ON(!oldsbsec->initialized); diff --git a/queue-2.6.25/series b/queue-2.6.25/series index 5d5ac005b00..5462d804fd9 100644 --- a/queue-2.6.25/series +++ b/queue-2.6.25/series @@ -12,3 +12,14 @@ usb-ohci-fix-bug-in-controller-resume.patch dm-snapshot-fix-chunksize-sector-conversion.patch cgroup-fix-a-race-condition-in-manipulating-tsk-cg_list.patch rdma-nes-free-irq-before-killing-tasklet.patch +v4l-fix-vidiocgap-corruption-in-ivtv.patch +v4l-tea5761-bugzilla-10462-tea5761-autodetection-code-were-broken.patch +v4l-cx88-enable-radio-gpio-correctly.patch +s2io-fix-memory-leak-during-free_tx_buffers.patch +s2io-version-update-for-memory-leak-fix-during-free_tx_buffers.patch +selinux-no-bug_on-in-selinux_clone_mnt_opts.patch +x86-pci-fix-off-by-one-errors-in-some-pirq-warnings.patch +ssb-fix-all-ones-boardflags.patch +b43-workaround-invalid-bluetooth-settings.patch +b43-add-more-btcoexist-workarounds.patch +b43-workaround-dma-quirks.patch diff --git a/queue-2.6.25/ssb-fix-all-ones-boardflags.patch b/queue-2.6.25/ssb-fix-all-ones-boardflags.patch new file mode 100644 index 00000000000..b46765da77b --- /dev/null +++ b/queue-2.6.25/ssb-fix-all-ones-boardflags.patch @@ -0,0 +1,45 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:06:25 2008 +From: Larry Finger +Date: Thu, 24 Apr 2008 20:00:45 +0200 +Subject: ssb: Fix all-ones boardflags +To: stable@kernel.org +Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de +Message-ID: <200804242000.45740.mb@bu3sch.de> +Content-Disposition: inline + + +From: Larry Finger + +commit 4503183aa32e6886400d82282292934fa64a81b0 upstream + +In the SSB SPROM a field set to all ones means the value +is not defined in the SPROM. +In case of the boardflags, we need to set them to zero +to avoid confusing drivers. Drivers will only check the +flags by ANDing. + + +Signed-off-by: Larry Finger +Signed-off-by: Gabor Stefanik +Signed-off-by: Michael Buesch +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ssb/pci.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/ssb/pci.c ++++ b/drivers/ssb/pci.c +@@ -482,6 +482,11 @@ static int sprom_extract(struct ssb_bus + goto unsupported; + } + ++ if (out->boardflags_lo == 0xFFFF) ++ out->boardflags_lo = 0; /* per specs */ ++ if (out->boardflags_hi == 0xFFFF) ++ out->boardflags_hi = 0; /* per specs */ ++ + return 0; + unsupported: + ssb_printk(KERN_WARNING PFX "Unsupported SPROM revision %d " diff --git a/queue-2.6.25/v4l-cx88-enable-radio-gpio-correctly.patch b/queue-2.6.25/v4l-cx88-enable-radio-gpio-correctly.patch new file mode 100644 index 00000000000..516ae69a3ab --- /dev/null +++ b/queue-2.6.25/v4l-cx88-enable-radio-gpio-correctly.patch @@ -0,0 +1,42 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:53:15 2008 +From: Steven Toth +Date: Thu, 24 Apr 2008 20:52:40 -0400 +Subject: V4L: cx88: enable radio GPIO correctly +To: stable@kernel.org +Cc: Steven Toth , v4l-dvb maintainer list , Mauro Carvalho Chehab +Message-ID: <48112B58.7010207@linuxtv.org> + + +From: Steven Toth + +(cherry picked from commit 6b92b3bd7ac91b7e255541f4be9bfd55b12dae41) + +This patch fixes an issue on the HVR1300, where GPIO is blown away due to +the radio input being undefined, breaking the functionality of the DVB +demodulator and MPEG2 encoder used on the cx8802 mpeg TS port. + +This is a minimal patch for 2.6.26 and the -stable series. This must be +fixed a better way for 2.6.27. + +Signed-off-by: Steven Toth +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/cx88/cx88-cards.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/video/cx88/cx88-cards.c ++++ b/drivers/media/video/cx88/cx88-cards.c +@@ -1354,6 +1354,10 @@ static const struct cx88_board cx88_boar + }}, + /* fixme: Add radio support */ + .mpeg = CX88_MPEG_DVB | CX88_MPEG_BLACKBIRD, ++ .radio = { ++ .type = CX88_RADIO, ++ .gpio0 = 0xe780, ++ }, + }, + [CX88_BOARD_ADSTECH_PTV_390] = { + .name = "ADS Tech Instant Video PCI", diff --git a/queue-2.6.25/v4l-fix-vidiocgap-corruption-in-ivtv.patch b/queue-2.6.25/v4l-fix-vidiocgap-corruption-in-ivtv.patch new file mode 100644 index 00000000000..ceb2035dd54 --- /dev/null +++ b/queue-2.6.25/v4l-fix-vidiocgap-corruption-in-ivtv.patch @@ -0,0 +1,44 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:52:53 2008 +From: Alan Cox +Date: Thu, 24 Apr 2008 20:52:24 -0400 +Subject: V4L: Fix VIDIOCGAP corruption in ivtv +To: stable@kernel.org +Cc: Alan Cox , Hans Verkuil , v4l-dvb maintainer list , Mauro Carvalho Chehab +Message-ID: <48112B48.7020506@linuxtv.org> + + +From: Alan Cox + +(cherry picked from commit d2b213f7b76f187c4391079c7581d3a08b940133) + +Frank Bennett reported that ivtv was causing skype to crash. With help +from one of their developers he showed it was a kernel problem. +VIDIOCGCAP copies a name into a fixed length buffer - ivtv uses names +that are too long and does not truncate them so corrupts a few bytes of +the app data area. + +Possibly the names also want trimming but for now this should fix the +corruption case. + +Signed-off-by: Alan Cox +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/ivtv/ivtv-ioctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/video/ivtv/ivtv-ioctl.c ++++ b/drivers/media/video/ivtv/ivtv-ioctl.c +@@ -741,7 +741,8 @@ int ivtv_v4l2_ioctls(struct ivtv *itv, s + + memset(vcap, 0, sizeof(*vcap)); + strcpy(vcap->driver, IVTV_DRIVER_NAME); /* driver name */ +- strcpy(vcap->card, itv->card_name); /* card type */ ++ strncpy(vcap->card, itv->card_name, ++ sizeof(vcap->card)-1); /* card type */ + strcpy(vcap->bus_info, pci_name(itv->dev)); /* bus info... */ + vcap->version = IVTV_DRIVER_VERSION; /* version */ + vcap->capabilities = itv->v4l2_cap; /* capabilities */ diff --git a/queue-2.6.25/v4l-tea5761-bugzilla-10462-tea5761-autodetection-code-were-broken.patch b/queue-2.6.25/v4l-tea5761-bugzilla-10462-tea5761-autodetection-code-were-broken.patch new file mode 100644 index 00000000000..9f4a35c4da6 --- /dev/null +++ b/queue-2.6.25/v4l-tea5761-bugzilla-10462-tea5761-autodetection-code-were-broken.patch @@ -0,0 +1,73 @@ +From stable-bounces@linux.kernel.org Thu Apr 24 17:53:15 2008 +From: Mauro Carvalho Chehab +Date: Thu, 24 Apr 2008 20:52:33 -0400 +Subject: V4L: tea5761: bugzilla #10462: tea5761 autodetection code were broken +To: stable@kernel.org +Cc: v4l-dvb maintainer list , Mauro Carvalho Chehab +Message-ID: <48112B51.3050104@linuxtv.org> + + +From: Mauro Carvalho Chehab + +(cherry picked from commit 867e835f4db4eba6d49072382cc05fc210c4ed1c) + +Fix bugzilla #10462: "tea5761 autodetection code were broken" + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/tea5761.c | 15 ++++++++++----- + drivers/media/video/tuner-core.c | 6 +++--- + 2 files changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/media/video/tea5761.c ++++ b/drivers/media/video/tea5761.c +@@ -249,14 +249,19 @@ int tea5761_autodetection(struct i2c_ada + + if (16 != (rc = tuner_i2c_xfer_recv(&i2c, buffer, 16))) { + printk(KERN_WARNING "it is not a TEA5761. Received %i chars.\n", rc); +- return EINVAL; ++ return -EINVAL; + } + +- if (!((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061))) { +- printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x. It is not a TEA5761\n",buffer[13],buffer[14],buffer[15]); +- return EINVAL; ++ if ((buffer[13] != 0x2b) || (buffer[14] != 0x57) || (buffer[15] != 0x061)) { ++ printk(KERN_WARNING "Manufacturer ID= 0x%02x, Chip ID = %02x%02x." ++ " It is not a TEA5761\n", ++ buffer[13], buffer[14], buffer[15]); ++ return -EINVAL; + } +- printk(KERN_WARNING "TEA5761 detected.\n"); ++ printk(KERN_WARNING "tea5761: TEA%02x%02x detected. " ++ "Manufacturer ID= 0x%02x\n", ++ buffer[14], buffer[15], buffer[13]); ++ + return 0; + } + +--- a/drivers/media/video/tuner-core.c ++++ b/drivers/media/video/tuner-core.c +@@ -1112,8 +1112,8 @@ static int tuner_probe(struct i2c_client + if (!no_autodetect) { + switch (client->addr) { + case 0x10: +- if (tea5761_autodetection(t->i2c->adapter, t->i2c->addr) +- != EINVAL) { ++ if (tea5761_autodetection(t->i2c->adapter, ++ t->i2c->addr) >= 0) { + t->type = TUNER_TEA5761; + t->mode_mask = T_RADIO; + t->mode = T_STANDBY; +@@ -1125,7 +1125,7 @@ static int tuner_probe(struct i2c_client + + goto register_client; + } +- break; ++ return -ENODEV; + case 0x42: + case 0x43: + case 0x4a: diff --git a/queue-2.6.25/x86-pci-fix-off-by-one-errors-in-some-pirq-warnings.patch b/queue-2.6.25/x86-pci-fix-off-by-one-errors-in-some-pirq-warnings.patch new file mode 100644 index 00000000000..f1efb48a659 --- /dev/null +++ b/queue-2.6.25/x86-pci-fix-off-by-one-errors-in-some-pirq-warnings.patch @@ -0,0 +1,80 @@ +From 223ac2f42d49dd0324ca02ea15897ead1a2f5133 Mon Sep 17 00:00:00 2001 +From: Björn Steinbrink +Date: Mon, 31 Mar 2008 04:22:53 +0200 +Subject: x86, pci: fix off-by-one errors in some pirq warnings +Message-Id: <200804181625.m3IGPGoF017447@hera.kernel.org> + +From: Björn Steinbrink + +commit 223ac2f42d49dd0324ca02ea15897ead1a2f5133 upstream. + +fix bogus pirq warnings reported in: + + http://bugzilla.kernel.org/show_bug.cgi?id=10366 + +safe to be backported to v2.6.25 and earlier. + +Signed-off-by: Björn Steinbrink +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/pci/irq.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/x86/pci/irq.c ++++ b/arch/x86/pci/irq.c +@@ -200,7 +200,7 @@ static int pirq_ali_get(struct pci_dev * + { + static const unsigned char irqmap[16] = { 0, 9, 3, 10, 4, 5, 7, 6, 1, 11, 0, 12, 0, 14, 0, 15 }; + +- WARN_ON_ONCE(pirq >= 16); ++ WARN_ON_ONCE(pirq > 16); + return irqmap[read_config_nybble(router, 0x48, pirq-1)]; + } + +@@ -209,7 +209,7 @@ static int pirq_ali_set(struct pci_dev * + static const unsigned char irqmap[16] = { 0, 8, 0, 2, 4, 5, 7, 6, 0, 1, 3, 9, 11, 0, 13, 15 }; + unsigned int val = irqmap[irq]; + +- WARN_ON_ONCE(pirq >= 16); ++ WARN_ON_ONCE(pirq > 16); + if (val) { + write_config_nybble(router, 0x48, pirq-1, val); + return 1; +@@ -260,7 +260,7 @@ static int pirq_via586_get(struct pci_de + { + static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; + +- WARN_ON_ONCE(pirq >= 5); ++ WARN_ON_ONCE(pirq > 5); + return read_config_nybble(router, 0x55, pirqmap[pirq-1]); + } + +@@ -268,7 +268,7 @@ static int pirq_via586_set(struct pci_de + { + static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 }; + +- WARN_ON_ONCE(pirq >= 5); ++ WARN_ON_ONCE(pirq > 5); + write_config_nybble(router, 0x55, pirqmap[pirq-1], irq); + return 1; + } +@@ -282,7 +282,7 @@ static int pirq_ite_get(struct pci_dev * + { + static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; + +- WARN_ON_ONCE(pirq >= 4); ++ WARN_ON_ONCE(pirq > 4); + return read_config_nybble(router,0x43, pirqmap[pirq-1]); + } + +@@ -290,7 +290,7 @@ static int pirq_ite_set(struct pci_dev * + { + static const unsigned char pirqmap[4] = { 1, 0, 2, 3 }; + +- WARN_ON_ONCE(pirq >= 4); ++ WARN_ON_ONCE(pirq > 4); + write_config_nybble(router, 0x43, pirqmap[pirq-1], irq); + return 1; + }