From 57c98f0d2017ad759a2e50f3e5553f31bc562f93 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Oct 2008 16:20:51 -0700 Subject: [PATCH] .25 patches added --- ...splice-to-files-opened-with-o_append.patch | 45 +++++++ ...-prevent-power-off-on-shuttle-sn68pt.patch | 115 ++++++++++++++++++ queue-2.6.25/series | 4 + ...ll-pointer-dereference-in-radio_open.patch | 44 +++++++ .../v4l-zr36067-fix-rgbr-pixel-format.patch | 38 ++++++ 5 files changed, 246 insertions(+) create mode 100644 queue-2.6.25/don-t-allow-splice-to-files-opened-with-o_append.patch create mode 100644 queue-2.6.25/hwmon-prevent-power-off-on-shuttle-sn68pt.patch create mode 100644 queue-2.6.25/v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch create mode 100644 queue-2.6.25/v4l-zr36067-fix-rgbr-pixel-format.patch diff --git a/queue-2.6.25/don-t-allow-splice-to-files-opened-with-o_append.patch b/queue-2.6.25/don-t-allow-splice-to-files-opened-with-o_append.patch new file mode 100644 index 00000000000..3bd1d5dfd67 --- /dev/null +++ b/queue-2.6.25/don-t-allow-splice-to-files-opened-with-o_append.patch @@ -0,0 +1,45 @@ +From efc968d450e013049a662d22727cf132618dcb2f Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 9 Oct 2008 14:04:54 -0700 +Subject: Don't allow splice() to files opened with O_APPEND + +From: Linus Torvalds + +commit efc968d450e013049a662d22727cf132618dcb2f upstream + +This is debatable, but while we're debating it, let's disallow the +combination of splice and an O_APPEND destination. + +It's not entirely clear what the semantics of O_APPEND should be, and +POSIX apparently expects pwrite() to ignore O_APPEND, for example. So +we could make up any semantics we want, including the old ones. + +But Miklos convinced me that we should at least give it some thought, +and that accepting writes at arbitrary offsets is wrong at least for +IS_APPEND() files (which always have O_APPEND set, even if the reverse +isn't true: you can obviously have O_APPEND set on a regular file). + +So disallow O_APPEND entirely for now. I doubt anybody cares, and this +way we have one less gray area to worry about. + +Reported-and-argued-for-by: Miklos Szeredi +Acked-by: Jens Axboe +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/splice.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -891,6 +891,9 @@ static long do_splice_from(struct pipe_i + if (unlikely(!(out->f_mode & FMODE_WRITE))) + return -EBADF; + ++ if (unlikely(out->f_flags & O_APPEND)) ++ return -EINVAL; ++ + ret = rw_verify_area(WRITE, out, ppos, len); + if (unlikely(ret < 0)) + return ret; diff --git a/queue-2.6.25/hwmon-prevent-power-off-on-shuttle-sn68pt.patch b/queue-2.6.25/hwmon-prevent-power-off-on-shuttle-sn68pt.patch new file mode 100644 index 00000000000..650b3881ea8 --- /dev/null +++ b/queue-2.6.25/hwmon-prevent-power-off-on-shuttle-sn68pt.patch @@ -0,0 +1,115 @@ +From khali@linux-fr.org Thu Oct 16 16:11:40 2008 +From: Jean Delvare +Date: Fri, 10 Oct 2008 11:04:39 +0200 +Subject: hwmon: (it87) Prevent power-off on Shuttle SN68PT +To: stable@kernel.org +Message-ID: <20081010110439.0c508954@hyperion.delvare> + +From: Jean Delvare + +based on commit 98dd22c3e086d76058083432d4d8fb85f04bab90 upstream + +On the Shuttle SN68PT, FAN_CTL2 is apparently not connected to a fan, +but to something else. One user has reported instant system power-off +when changing the PWM2 duty cycle, so we disable it. + +I use the board name string as the trigger in case the same board is +ever used in other systems. + +This closes lm-sensors ticket #2349: +pwmconfig causes a hard poweroff +http://www.lm-sensors.org/ticket/2349 + +Signed-off-by: Jean Delvare +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/it87.c | 39 +++++++++++++++++++++++++++++++++------ + 1 file changed, 33 insertions(+), 6 deletions(-) + +--- a/drivers/hwmon/it87.c ++++ b/drivers/hwmon/it87.c +@@ -46,6 +46,8 @@ + #include + #include + #include ++#include ++#include + #include + + #define DRVNAME "it87" +@@ -235,6 +237,8 @@ struct it87_sio_data { + enum chips type; + /* Values read from Super-I/O config space */ + u8 vid_value; ++ /* Values set based on DMI strings */ ++ u8 skip_pwm; + }; + + /* For each registered chip, we need to keep some data in memory. +@@ -952,6 +956,7 @@ static int __init it87_find(unsigned sho + { + int err = -ENODEV; + u16 chip_type; ++ const char *board_vendor, *board_name; + + superio_enter(); + chip_type = force_id ? force_id : superio_inw(DEVID); +@@ -1009,6 +1014,25 @@ static int __init it87_find(unsigned sho + pr_info("it87: in7 is VCCH (+5V Stand-By)\n"); + } + ++ sio_data->skip_pwm = 0; ++ /* Disable specific features based on DMI strings */ ++ board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR); ++ board_name = dmi_get_system_info(DMI_BOARD_NAME); ++ if (board_vendor && board_name) { ++ if (strcmp(board_vendor, "nVIDIA") == 0 ++ && strcmp(board_name, "FN68PT") == 0) { ++ /* On the Shuttle SN68PT, FAN_CTL2 is apparently not ++ connected to a fan, but to something else. One user ++ has reported instant system power-off when changing ++ the PWM2 duty cycle, so we disable it. ++ I use the board name string as the trigger in case ++ the same board is ever used in other systems. */ ++ pr_info("it87: Disabling pwm2 due to " ++ "hardware constraints\n"); ++ sio_data->skip_pwm = (1 << 1); ++ } ++ } ++ + exit: + superio_exit(); + return err; +@@ -1157,22 +1181,25 @@ static int __devinit it87_probe(struct p + if ((err = device_create_file(dev, + &sensor_dev_attr_pwm1_enable.dev_attr)) + || (err = device_create_file(dev, +- &sensor_dev_attr_pwm2_enable.dev_attr)) +- || (err = device_create_file(dev, + &sensor_dev_attr_pwm3_enable.dev_attr)) + || (err = device_create_file(dev, + &sensor_dev_attr_pwm1.dev_attr)) + || (err = device_create_file(dev, +- &sensor_dev_attr_pwm2.dev_attr)) +- || (err = device_create_file(dev, + &sensor_dev_attr_pwm3.dev_attr)) + || (err = device_create_file(dev, + &dev_attr_pwm1_freq)) + || (err = device_create_file(dev, +- &dev_attr_pwm2_freq)) +- || (err = device_create_file(dev, + &dev_attr_pwm3_freq))) + goto ERROR4; ++ if (!(sio_data->skip_pwm & (1 << 1))) { ++ if ((err = device_create_file(dev, ++ &sensor_dev_attr_pwm2_enable.dev_attr)) ++ || (err = device_create_file(dev, ++ &sensor_dev_attr_pwm2.dev_attr)) ++ || (err = device_create_file(dev, ++ &dev_attr_pwm2_freq))) ++ goto ERROR4; ++ } + } + + if (data->type == it8712 || data->type == it8716 diff --git a/queue-2.6.25/series b/queue-2.6.25/series index e77edab6ba6..8c3462949d6 100644 --- a/queue-2.6.25/series +++ b/queue-2.6.25/series @@ -6,3 +6,7 @@ sched_rt.c-resch-needed-in-rt_rq_enqueue-for-the-root-rt_rq.patch cifs-make-sure-we-have-the-right-resume-info-before-calling-cifsfindnext.patch b43legacy-fix-failure-in-rate-adjustment-mechanism.patch fbcon_set_all_vcs-fix-kernel-crash-when-switching-the-rotated-consoles.patch +hwmon-prevent-power-off-on-shuttle-sn68pt.patch +don-t-allow-splice-to-files-opened-with-o_append.patch +v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch +v4l-zr36067-fix-rgbr-pixel-format.patch diff --git a/queue-2.6.25/v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch b/queue-2.6.25/v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch new file mode 100644 index 00000000000..9730c7cb833 --- /dev/null +++ b/queue-2.6.25/v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch @@ -0,0 +1,44 @@ +From mkrufky@linuxtv.org Thu Oct 16 16:19:11 2008 +From: Jean Delvare +Date: Fri, 10 Oct 2008 08:42:01 -0400 +Subject: V4L: bttv: Prevent NULL pointer dereference in radio_open +To: stable@kernel.org +Cc: Jean Delvare , v4l-dvb maintainer list , Mauro Carvalho Chehab +Message-ID: <48EF4D99.2080007@linuxtv.org> + +From: Jean Delvare + +cherry picked from commit c37396c19403e249f12626187d51e92c915f2bc9 + +Fix the following crash in the bttv driver: + +BUG: unable to handle kernel NULL pointer dereference at 000000000000036c +IP: [] radio_open+0x3a/0x170 [bttv] + +This happens because radio_open assumes that all present bttv devices +have a radio function. If a bttv device without radio and one with +radio are installed on the same system, and the one without radio is +registered first, then radio_open checks for the radio device number +of a bttv device that has no radio function, and this breaks. All we +have to do to fix it is to skip bttv devices without a radio function. + +Signed-off-by: Jean Delvare +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/bt8xx/bttv-driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/bt8xx/bttv-driver.c ++++ b/drivers/media/video/bt8xx/bttv-driver.c +@@ -3422,7 +3422,7 @@ static int radio_open(struct inode *inod + dprintk("bttv: open minor=%d\n",minor); + + for (i = 0; i < bttv_num; i++) { +- if (bttvs[i].radio_dev->minor == minor) { ++ if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) { + btv = &bttvs[i]; + break; + } diff --git a/queue-2.6.25/v4l-zr36067-fix-rgbr-pixel-format.patch b/queue-2.6.25/v4l-zr36067-fix-rgbr-pixel-format.patch new file mode 100644 index 00000000000..3a613c8b072 --- /dev/null +++ b/queue-2.6.25/v4l-zr36067-fix-rgbr-pixel-format.patch @@ -0,0 +1,38 @@ +From mkrufky@linuxtv.org Thu Oct 16 16:19:48 2008 +From: Jean Delvare +Date: Fri, 10 Oct 2008 08:41:33 -0400 +Subject: V4L: zr36067: Fix RGBR pixel format +To: stable@kernel.org +Cc: Jean Delvare , v4l-dvb maintainer list , Trent Piepho , Mauro Carvalho Chehab +Message-ID: <48EF4D7D.50800@linuxtv.org> + + +From: Jean Delvare + +(cherry picked from commit a30ee3c747728f9151664118ffcbdeefd202c332) + +The zr36067 driver is improperly declaring pixel format RGBP twice, +once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is +actually RGBR. Fix the code to properly map both pixel formats. + +Signed-off-by: Jean Delvare +Acked-by: Trent Piepho +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Michael Krufky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/video/zoran_driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/video/zoran_driver.c ++++ b/drivers/media/video/zoran_driver.c +@@ -139,7 +139,7 @@ const struct zoran_format zoran_formats[ + }, { + .name = "16-bit RGB BE", + ZFMT(-1, +- V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB), ++ V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB), + .depth = 16, + .flags = ZORAN_FORMAT_CAPTURE | + ZORAN_FORMAT_OVERLAY, -- 2.47.3