--- /dev/null
+From gregkh@mini.kroah.org Sat Oct 18 11:40:21 2008
+Message-Id: <20081018184021.309694769@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:54 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Stefan Bader <stefan.bader@canonical.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 01/26] x86: Reserve FIRST_DEVICE_VECTOR in used_vectors bitmap.
+Content-Disposition: inline; filename=x86-reserve-first_device_vector-in-used_vectors-bitmap.patch
+Content-Length: 1500
+Lines: 45
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+Not in upstream above 2.6.27 due to change in the way this code works
+(has been fixed differently there.)
+
+Someone from the community found out, that after repeatedly unloading
+and loading a device driver that uses MSI IRQs, the system eventually
+assigned the vector initially reserved for IRQ0 to the device driver.
+
+The reason for this is, that although IRQ0 is tied to the
+FIRST_DEVICE_VECTOR when declaring the irq_vector table, the
+corresponding bit in the used_vectors map is not set. So, if vectors are
+released and assigned often enough, the vector will get assigned to
+another interrupt. This happens more often with MSI interrupts as those
+are exclusively using a vector.
+
+Fix this by setting the bit for the FIRST_DEVICE_VECTOR in the bitmap.
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Acked-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/io_apic_32.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kernel/io_apic_32.c
++++ b/arch/x86/kernel/io_apic_32.c
+@@ -2264,6 +2264,9 @@ void __init setup_IO_APIC(void)
+ for (i = FIRST_SYSTEM_VECTOR; i < NR_VECTORS; i++)
+ set_bit(i, used_vectors);
+
++ /* Mark FIRST_DEVICE_VECTOR which is assigned to IRQ0 as used. */
++ set_bit(FIRST_DEVICE_VECTOR, used_vectors);
++
+ enable_IO_APIC();
+
+ if (acpi_ioapic)
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:21 2008
+Message-Id: <20081018184021.710542851@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:55 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Thomas Gleixner <tglx@linutronix.de>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 02/26] x86: improve UP kernel when CPU-hotplug and SMP is enabled
+Content-Disposition: inline; filename=x86-improve-up-kernel-when-cpu-hotplug-and-smp-is-enabled.patch
+Content-Length: 1080
+Lines: 35
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 649c6653fa94ec8f3ea32b19c97b790ec4e8e4ac upstream
+
+num_possible_cpus() can be > 1 when disabled CPUs have been accounted.
+
+Disabled CPUs are not in the cpu_present_map, so we can use
+num_present_cpus() as a safe indicator to switch to UP alternatives.
+
+Reported-by: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/alternative.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/alternative.c
++++ b/arch/x86/kernel/alternative.c
+@@ -454,7 +454,7 @@ void __init alternative_instructions(voi
+ _text, _etext);
+
+ /* Only switch to UP mode if we don't immediately boot others */
+- if (num_possible_cpus() == 1 || setup_max_cpus <= 1)
++ if (num_present_cpus() == 1 || setup_max_cpus <= 1)
+ alternatives_smp_switch(0);
+ }
+ #endif
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
+Message-Id: <20081018184021.865738624@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:56 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@rehat.com>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 03/26] x86, early_ioremap: fix fencepost error
+Content-Disposition: inline; filename=x86-early_ioremap-fix-fencepost-error.patch
+Content-Length: 1224
+Lines: 45
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Alan Cox <alan@redhat.com>
+
+commit c613ec1a7ff3714da11c7c48a13bab03beb5c376 upstream
+
+The x86 implementation of early_ioremap has an off by one error. If we get
+an object which ends on the first byte of a page we undermap by one page and
+this causes a crash on boot with the ASUS P5QL whose DMI table happens to fit
+this alignment.
+
+The size computation is currently
+
+ last_addr = phys_addr + size - 1;
+ npages = (PAGE_ALIGN(last_addr) - phys_addr)
+
+(Consider a request for 1 byte at alignment 0...)
+
+Closes #11693
+
+Debugging work by Ian Campbell/Felix Geyer
+
+Signed-off-by: Alan Cox <alan@rehat.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/mm/ioremap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -582,7 +582,7 @@ void __init *early_ioremap(unsigned long
+ */
+ offset = phys_addr & ~PAGE_MASK;
+ phys_addr &= PAGE_MASK;
+- size = PAGE_ALIGN(last_addr) - phys_addr;
++ size = PAGE_ALIGN(last_addr + 1) - phys_addr;
+
+ /*
+ * Mappings have to fit in the FIX_BTMAP area.
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
+Message-Id: <20081018184022.088167034@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:57 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alan Cox <alan@redhat.com>
+Subject: [patch 04/26] tty: Termios locking - sort out real_tty confusions and lock reads
+Content-Disposition: inline; filename=tty-termios-locking-sort-out-real_tty-confusions-and-lock-reads.patch
+Content-Length: 905
+Lines: 34
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Alan Cox <alan@redhat.com>
+
+commit 8f520021837d45c47d0ab57e7271f8d88bf7f3a4 upstream
+
+(only the tty_io.c portion of this commit)
+
+This moves us towards sanity and should mean our termios locking is now
+complete and comprehensive.
+
+Signed-off-by: Alan Cox <alan@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tty_io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tty_io.c
++++ b/drivers/char/tty_io.c
+@@ -3474,7 +3474,7 @@ long tty_ioctl(struct file *file, unsign
+ case TIOCSTI:
+ return tiocsti(tty, p);
+ case TIOCGWINSZ:
+- return tiocgwinsz(tty, p);
++ return tiocgwinsz(real_tty, p);
+ case TIOCSWINSZ:
+ return tiocswinsz(tty, real_tty, p);
+ case TIOCCONS:
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
+Message-Id: <20081018184022.288635320@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:58 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dario Faggioli <raistlin@linux.it>,
+ Michael Trimarchi <trimarchimichael@yahoo.it>,
+ Peter Zijlstra <a.p.zijlstra@chello.nl>,
+ Ingo Molnar <mingo@elte.hu>
+Subject: [patch 05/26] sched_rt.c: resch needed in rt_rq_enqueue() for the root rt_rq
+Content-Disposition: inline; filename=sched_rt.c-resch-needed-in-rt_rq_enqueue-for-the-root-rt_rq.patch
+Content-Length: 2359
+Lines: 65
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Dario Faggioli <raistlin@linux.it>
+
+commit f6121f4f8708195e88cbdf8dd8d171b226b3f858 upstream
+
+While working on the new version of the code for SCHED_SPORADIC I
+noticed something strange in the present throttling mechanism. More
+specifically in the throttling timer handler in sched_rt.c
+(do_sched_rt_period_timer()) and in rt_rq_enqueue().
+
+The problem is that, when unthrottling a runqueue, rt_rq_enqueue() only
+asks for rescheduling if the runqueue has a sched_entity associated to
+it (i.e., rt_rq->rt_se != NULL).
+Now, if the runqueue is the root rq (which has a rt_se = NULL)
+rescheduling does not take place, and it is delayed to some undefined
+instant in the future.
+
+This imply some random bandwidth usage by the RT tasks under throttling.
+For instance, setting rt_runtime_us/rt_period_us = 950ms/1000ms an RT
+task will get less than 95%. In our tests we got something varying
+between 70% to 95%.
+Using smaller time values, e.g., 95ms/100ms, things are even worse, and
+I can see values also going down to 20-25%!!
+
+The tests we performed are simply running 'yes' as a SCHED_FIFO task,
+and checking the CPU usage with top, but we can investigate thoroughly
+if you think it is needed.
+
+Things go much better, for us, with the attached patch... Don't know if
+it is the best approach, but it solved the issue for us.
+
+Signed-off-by: Dario Faggioli <raistlin@linux.it>
+Signed-off-by: Michael Trimarchi <trimarchimichael@yahoo.it>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/sched_rt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/sched_rt.c
++++ b/kernel/sched_rt.c
+@@ -96,12 +96,12 @@ static void dequeue_rt_entity(struct sch
+
+ static void sched_rt_rq_enqueue(struct rt_rq *rt_rq)
+ {
++ struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
+ struct sched_rt_entity *rt_se = rt_rq->rt_se;
+
+- if (rt_se && !on_rt_rq(rt_se) && rt_rq->rt_nr_running) {
+- struct task_struct *curr = rq_of_rt_rq(rt_rq)->curr;
+-
+- enqueue_rt_entity(rt_se);
++ if (rt_rq->rt_nr_running) {
++ if (rt_se && !on_rt_rq(rt_se))
++ enqueue_rt_entity(rt_se);
+ if (rt_rq->highest_prio < curr->prio)
+ resched_task(curr);
+ }
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:22 2008
+Message-Id: <20081018184022.566972441@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:59 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jeff Layton <jlayton@redhat.com>,
+ Steve French <sfrench@us.ibm.com>
+Subject: [patch 06/26] CIFS: make sure we have the right resume info before calling CIFSFindNext
+Content-Disposition: inline; filename=cifs-make-sure-we-have-the-right-resume-info-before-calling-cifsfindnext.patch
+Content-Length: 7818
+Lines: 214
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Steve French <sfrench@us.ibm.com>
+
+commit 0752f1522a9120f731232919f7ad904e9e22b8ce upstream
+
+When we do a seekdir() or equivalent, we usually end up doing a
+FindFirst call and then call FindNext until we get to the offset that we
+want. The problem is that when we call FindNext, the code usually
+doesn't have the proper info (mostly, the filename of the entry from the
+last search) to resume the search.
+
+Add a "last_entry" field to the cifs_search_info that points to the last
+entry in the search. We calculate this pointer by using the
+LastNameOffset field from the search parms that are returned. We then
+use that info to do a cifs_save_resume_key before we call CIFSFindNext.
+
+This patch allows CIFS to reliably pass the "telldir" connectathon test.
+
+Signed-off-by: Jeff Layton <jlayton@redhat.com>
+Signed-off-by: Steve French <sfrench@us.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/cifs/cifsglob.h | 1
+ fs/cifs/cifssmb.c | 4 +
+ fs/cifs/readdir.c | 128 ++++++++++++++++++++++++++---------------------------
+ 3 files changed, 70 insertions(+), 63 deletions(-)
+
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -308,6 +308,7 @@ struct cifs_search_info {
+ __u32 resume_key;
+ char *ntwrk_buf_start;
+ char *srch_entries_start;
++ char *last_entry;
+ char *presume_name;
+ unsigned int resume_name_len;
+ bool endOfSearch:1;
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -3638,6 +3638,8 @@ findFirstRetry:
+ le16_to_cpu(parms->SearchCount);
+ psrch_inf->index_of_last_entry = 2 /* skip . and .. */ +
+ psrch_inf->entries_in_buffer;
++ psrch_inf->last_entry = psrch_inf->srch_entries_start +
++ le16_to_cpu(parms->LastNameOffset);
+ *pnetfid = parms->SearchHandle;
+ } else {
+ cifs_buf_release(pSMB);
+@@ -3753,6 +3755,8 @@ int CIFSFindNext(const int xid, struct c
+ le16_to_cpu(parms->SearchCount);
+ psrch_inf->index_of_last_entry +=
+ psrch_inf->entries_in_buffer;
++ psrch_inf->last_entry = psrch_inf->srch_entries_start +
++ le16_to_cpu(parms->LastNameOffset);
+ /* cFYI(1,("fnxt2 entries in buf %d index_of_last %d",
+ psrch_inf->entries_in_buffer, psrch_inf->index_of_last_entry)); */
+
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -640,6 +640,70 @@ static int is_dir_changed(struct file *f
+
+ }
+
++static int cifs_save_resume_key(const char *current_entry,
++ struct cifsFileInfo *cifsFile)
++{
++ int rc = 0;
++ unsigned int len = 0;
++ __u16 level;
++ char *filename;
++
++ if ((cifsFile == NULL) || (current_entry == NULL))
++ return -EINVAL;
++
++ level = cifsFile->srch_inf.info_level;
++
++ if (level == SMB_FIND_FILE_UNIX) {
++ FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
++
++ filename = &pFindData->FileName[0];
++ if (cifsFile->srch_inf.unicode) {
++ len = cifs_unicode_bytelen(filename);
++ } else {
++ /* BB should we make this strnlen of PATH_MAX? */
++ len = strnlen(filename, PATH_MAX);
++ }
++ cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
++ } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
++ FILE_DIRECTORY_INFO *pFindData =
++ (FILE_DIRECTORY_INFO *)current_entry;
++ filename = &pFindData->FileName[0];
++ len = le32_to_cpu(pFindData->FileNameLength);
++ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++ } else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
++ FILE_FULL_DIRECTORY_INFO *pFindData =
++ (FILE_FULL_DIRECTORY_INFO *)current_entry;
++ filename = &pFindData->FileName[0];
++ len = le32_to_cpu(pFindData->FileNameLength);
++ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++ } else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
++ SEARCH_ID_FULL_DIR_INFO *pFindData =
++ (SEARCH_ID_FULL_DIR_INFO *)current_entry;
++ filename = &pFindData->FileName[0];
++ len = le32_to_cpu(pFindData->FileNameLength);
++ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++ } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
++ FILE_BOTH_DIRECTORY_INFO *pFindData =
++ (FILE_BOTH_DIRECTORY_INFO *)current_entry;
++ filename = &pFindData->FileName[0];
++ len = le32_to_cpu(pFindData->FileNameLength);
++ cifsFile->srch_inf.resume_key = pFindData->FileIndex;
++ } else if (level == SMB_FIND_FILE_INFO_STANDARD) {
++ FIND_FILE_STANDARD_INFO *pFindData =
++ (FIND_FILE_STANDARD_INFO *)current_entry;
++ filename = &pFindData->FileName[0];
++ /* one byte length, no name conversion */
++ len = (unsigned int)pFindData->FileNameLength;
++ cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
++ } else {
++ cFYI(1, ("Unknown findfirst level %d", level));
++ return -EINVAL;
++ }
++ cifsFile->srch_inf.resume_name_len = len;
++ cifsFile->srch_inf.presume_name = filename;
++ return rc;
++}
++
+ /* find the corresponding entry in the search */
+ /* Note that the SMB server returns search entries for . and .. which
+ complicates logic here if we choose to parse for them and we do not
+@@ -702,6 +766,7 @@ static int find_cifs_entry(const int xid
+ while ((index_to_find >= cifsFile->srch_inf.index_of_last_entry) &&
+ (rc == 0) && !cifsFile->srch_inf.endOfSearch) {
+ cFYI(1, ("calling findnext2"));
++ cifs_save_resume_key(cifsFile->srch_inf.last_entry, cifsFile);
+ rc = CIFSFindNext(xid, pTcon, cifsFile->netfid,
+ &cifsFile->srch_inf);
+ if (rc)
+@@ -918,69 +983,6 @@ static int cifs_filldir(char *pfindEntry
+ return rc;
+ }
+
+-static int cifs_save_resume_key(const char *current_entry,
+- struct cifsFileInfo *cifsFile)
+-{
+- int rc = 0;
+- unsigned int len = 0;
+- __u16 level;
+- char *filename;
+-
+- if ((cifsFile == NULL) || (current_entry == NULL))
+- return -EINVAL;
+-
+- level = cifsFile->srch_inf.info_level;
+-
+- if (level == SMB_FIND_FILE_UNIX) {
+- FILE_UNIX_INFO *pFindData = (FILE_UNIX_INFO *)current_entry;
+-
+- filename = &pFindData->FileName[0];
+- if (cifsFile->srch_inf.unicode) {
+- len = cifs_unicode_bytelen(filename);
+- } else {
+- /* BB should we make this strnlen of PATH_MAX? */
+- len = strnlen(filename, PATH_MAX);
+- }
+- cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+- } else if (level == SMB_FIND_FILE_DIRECTORY_INFO) {
+- FILE_DIRECTORY_INFO *pFindData =
+- (FILE_DIRECTORY_INFO *)current_entry;
+- filename = &pFindData->FileName[0];
+- len = le32_to_cpu(pFindData->FileNameLength);
+- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+- } else if (level == SMB_FIND_FILE_FULL_DIRECTORY_INFO) {
+- FILE_FULL_DIRECTORY_INFO *pFindData =
+- (FILE_FULL_DIRECTORY_INFO *)current_entry;
+- filename = &pFindData->FileName[0];
+- len = le32_to_cpu(pFindData->FileNameLength);
+- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+- } else if (level == SMB_FIND_FILE_ID_FULL_DIR_INFO) {
+- SEARCH_ID_FULL_DIR_INFO *pFindData =
+- (SEARCH_ID_FULL_DIR_INFO *)current_entry;
+- filename = &pFindData->FileName[0];
+- len = le32_to_cpu(pFindData->FileNameLength);
+- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+- } else if (level == SMB_FIND_FILE_BOTH_DIRECTORY_INFO) {
+- FILE_BOTH_DIRECTORY_INFO *pFindData =
+- (FILE_BOTH_DIRECTORY_INFO *)current_entry;
+- filename = &pFindData->FileName[0];
+- len = le32_to_cpu(pFindData->FileNameLength);
+- cifsFile->srch_inf.resume_key = pFindData->FileIndex;
+- } else if (level == SMB_FIND_FILE_INFO_STANDARD) {
+- FIND_FILE_STANDARD_INFO *pFindData =
+- (FIND_FILE_STANDARD_INFO *)current_entry;
+- filename = &pFindData->FileName[0];
+- /* one byte length, no name conversion */
+- len = (unsigned int)pFindData->FileNameLength;
+- cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
+- } else {
+- cFYI(1, ("Unknown findfirst level %d", level));
+- return -EINVAL;
+- }
+- cifsFile->srch_inf.resume_name_len = len;
+- cifsFile->srch_inf.presume_name = filename;
+- return rc;
+-}
+
+ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
+ {
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
+Message-Id: <20081018184022.798493974@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:00 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Larry Finger <Larry.Finger@lwfinger.net>,
+ "John W. Linville" <linville@tuxdriver.com>
+Subject: [patch 07/26] b43legacy: Fix failure in rate-adjustment mechanism
+Content-Disposition: inline; filename=b43legacy-fix-failure-in-rate-adjustment-mechanism.patch
+Content-Length: 1198
+Lines: 35
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit c6a2afdacccd56cc0be8e9a7977f0ed1509069f6 upstream
+Date: Sat, 6 Sep 2008 16:51:22 -0500
+Subject: [patch 07/26] b43legacy: Fix failure in rate-adjustment mechanism
+
+A coding error present since b43legacy was incorporated into the
+kernel has prevented the driver from using the rate-setting mechanism
+of mac80211. The driver has been forced to remain at a 1 Mb/s rate.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/b43legacy/xmit.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/b43legacy/xmit.c
++++ b/drivers/net/wireless/b43legacy/xmit.c
+@@ -626,7 +626,7 @@ void b43legacy_handle_hwtxstatus(struct
+ tmp = hw->count;
+ status.frame_count = (tmp >> 4);
+ status.rts_count = (tmp & 0x0F);
+- tmp = hw->flags;
++ tmp = hw->flags << 1;
+ status.supp_reason = ((tmp & 0x1C) >> 2);
+ status.pm_indicated = !!(tmp & 0x80);
+ status.intermediate = !!(tmp & 0x40);
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
+Message-Id: <20081018184023.144650609@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:01 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Alexey Dobriyan <adobriyan@gmail.com>
+Subject: [patch 08/26] modules: fix module "notes" kobject leak
+Content-Disposition: inline; filename=modules-fix-module-notes-kobject-leak.patch
+Content-Length: 1909
+Lines: 58
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+commit e94320939f44e0cbaccc3f259a5778abced4949c upstream
+
+Fix "notes" kobject leak
+
+It happens every rmmod if KALLSYMS=y and SYSFS=y.
+
+ # modprobe foo
+
+kobject: 'foo' (ffffffffa00743d0): kobject_add_internal: parent: 'module', set: 'module'
+kobject: 'holders' (ffff88017e7c5770): kobject_add_internal: parent: 'foo', set: '<NULL>'
+kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
+kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
+kobject: 'notes' (ffff88017fa9b668): kobject_add_internal: parent: 'foo', set: '<NULL>'
+ ^^^^^
+
+ # rmmod foo
+
+kobject: 'holders' (ffff88017e7c5770): kobject_cleanup
+kobject: 'holders' (ffff88017e7c5770): auto cleanup kobject_del
+kobject: 'holders' (ffff88017e7c5770): calling ktype release
+kobject: (ffff88017e7c5770): dynamic_kobj_release
+kobject: 'holders': free name
+kobject: 'foo' (ffffffffa00743d0): kobject_cleanup
+kobject: 'foo' (ffffffffa00743d0): does not have a release() function, it is broken and must be fixed.
+kobject: 'foo' (ffffffffa00743d0): auto cleanup 'remove' event
+kobject: 'foo' (ffffffffa00743d0): kobject_uevent_env
+kobject: 'foo' (ffffffffa00743d0): fill_kobj_path: path = '/module/foo'
+kobject: 'foo' (ffffffffa00743d0): auto cleanup kobject_del
+kobject: 'foo': free name
+
+ [whooops]
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/module.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1143,7 +1143,7 @@ static void free_notes_attrs(struct modu
+ while (i-- > 0)
+ sysfs_remove_bin_file(notes_attrs->dir,
+ ¬es_attrs->attrs[i]);
+- kobject_del(notes_attrs->dir);
++ kobject_put(notes_attrs->dir);
+ }
+ kfree(notes_attrs);
+ }
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:23 2008
+Message-Id: <20081018184023.529535839@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:02 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org,
+ jejb@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Oleg Nesterov <oleg@tv-sign.ru>,
+ Krzysztof Helt <krzysztof.h1@poczta.fm>
+Subject: [patch 09/26] fbcon_set_all_vcs: fix kernel crash when switching the rotated consoles
+Content-Disposition: inline; filename=fbcon_set_all_vcs-fix-kernel-crash-when-switching-the-rotated-consoles.patch
+Content-Length: 4014
+Lines: 89
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Oleg Nesterov <oleg@tv-sign.ru>
+
+commit 232fb69a53a5ec3f22a8104d447abe4806848a8f upstream
+
+echo 3 >> /sys/class/graphics/fbcon/rotate_all, then switch to another
+console. Result:
+
+ BUG: unable to handle kernel paging request at ffffc20005d00000
+ IP: [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
+ PGD 7e228067 PUD 7e229067 PMD 7bc1f067 PTE 0
+ Oops: 0002 [1] SMP
+ CPU 1
+ Modules linked in: [...a lot...]
+ Pid: 10, comm: events/1 Not tainted 2.6.26.5-45.fc9.x86_64 #1
+ RIP: 0010:[bitfill_aligned+149/265] [bitfill_aligned+149/265] bitfill_aligned+0x95/0x109
+ RSP: 0018:ffff81007d811bc8 EFLAGS: 00010216
+ RAX: ffffc20005d00000 RBX: 0000000000000000 RCX: 0000000000000400
+ RDX: 0000000000000000 RSI: ffffc20005d00000 RDI: ffffffffffffffff
+ RBP: ffff81007d811be0 R08: 0000000000000400 R09: 0000000000000040
+ R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000010000
+ R13: ffffffff811632f0 R14: 0000000000000006 R15: ffff81007cb85400
+ FS: 0000000000000000(0000) GS:ffff81007e004780(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+ CR2: ffffc20005d00000 CR3: 0000000000201000 CR4: 00000000000006e0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ Process events/1 (pid: 10, threadinfo ffff81007d810000, task ffff81007d808000)
+ Stack: ffff81007c9d75a0 0000000000000000 0000000000000000 ffff81007d811c80
+ ffffffff81163a61 ffff810000000000 ffffffff8115f9c8 0000001000000000
+ 0000000100aaaaaa 000000007cd0d4a0 fffffd8a00000800 0001000000000000
+ Call Trace:
+ [cfb_fillrect+523/798] cfb_fillrect+0x20b/0x31e
+ [soft_cursor+416/436] ? soft_cursor+0x1a0/0x1b4
+ [ccw_clear_margins+205/263] ccw_clear_margins+0xcd/0x107
+ [fbcon_clear_margins+59/61] fbcon_clear_margins+0x3b/0x3d
+ [fbcon_switch+1291/1466] fbcon_switch+0x50b/0x5ba
+ [redraw_screen+261/481] redraw_screen+0x105/0x1e1
+ [ccw_cursor+0/1869] ? ccw_cursor+0x0/0x74d
+ [complete_change_console+48/190] complete_change_console+0x30/0xbe
+ [change_console+115/120] change_console+0x73/0x78
+ [console_callback+0/292] ? console_callback+0x0/0x124
+ [console_callback+97/292] console_callback+0x61/0x124
+ [schedule_delayed_work+25/30] ? schedule_delayed_work+0x19/0x1e
+ [run_workqueue+139/282] run_workqueue+0x8b/0x11a
+ [worker_thread+221/238] worker_thread+0xdd/0xee
+ [autoremove_wake_function+0/56] ? autoremove_wake_function+0x0/0x38
+ [worker_thread+0/238] ? worker_thread+0x0/0xee
+ [kthread+73/118] kthread+0x49/0x76
+ [child_rip+10/18] child_rip+0xa/0x12
+ [kthread+0/118] ? kthread+0x0/0x76
+ [child_rip+0/18] ? child_rip+0x0/0x12
+
+Because fbcon_set_all_vcs()->FBCON_SWAP() uses display->rotate == 0 instead
+of fbcon_ops->rotate, and vc_resize() has no effect because it is called with
+new_cols/rows == ->vc_cols/rows.
+
+Tested on 2.6.26.5-45.fc9.x86_64, but
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git seems to
+have the same problem.
+
+Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
+Cc: Krzysztof Helt <krzysztof.h1@poczta.fm>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/console/fbcon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -2990,8 +2990,8 @@ static void fbcon_set_all_vcs(struct fb_
+ p = &fb_display[vc->vc_num];
+ set_blitting_type(vc, info);
+ var_to_display(p, &info->var, info);
+- cols = FBCON_SWAP(p->rotate, info->var.xres, info->var.yres);
+- rows = FBCON_SWAP(p->rotate, info->var.yres, info->var.xres);
++ cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
++ rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols /= vc->vc_font.width;
+ rows /= vc->vc_font.height;
+ vc_resize(vc, cols, rows);
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:24 2008
+Message-Id: <20081018184023.988098869@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:03 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 10/26] libata: always do follow-up SRST if hardreset returned -EAGAIN
+Content-Disposition: inline; filename=libata-always-do-follow-up-srst-if-hardreset-returned-eagain.patch
+Content-Length: 2483
+Lines: 79
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+commit 5dbfc9cb59d4ad75199949d7dd8a8c6d7bc518df upstream
+
+As an optimization, follow-up SRST used to be skipped if
+classification wasn't requested even when hardreset requested it via
+-EAGAIN. However, some hardresets can't wait for device readiness and
+skipping SRST can cause timeout or other failures during revalidation.
+Always perform follow-up SRST if hardreset returns -EAGAIN. This
+makes reset paths more predictable and thus less error-prone.
+
+While at it, move hardreset error checking such that it's done right
+after hardreset is finished. This simplifies followup SRST condition
+check a bit and makes the reset path easier to modify.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2050,18 +2050,12 @@ static int ata_do_reset(struct ata_link
+ }
+
+ static int ata_eh_followup_srst_needed(struct ata_link *link,
+- int rc, int classify,
+- const unsigned int *classes)
++ int rc, const unsigned int *classes)
+ {
+ if ((link->flags & ATA_LFLAG_NO_SRST) || ata_link_offline(link))
+ return 0;
+- if (rc == -EAGAIN) {
+- if (classify)
+- return 1;
+- rc = 0;
+- }
+- if (rc != 0)
+- return 0;
++ if (rc == -EAGAIN)
++ return 1;
+ if (sata_pmp_supported(link->ap) && ata_is_host_link(link))
+ return 1;
+ return 0;
+@@ -2174,9 +2168,11 @@ int ata_eh_reset(struct ata_link *link,
+ ehc->i.flags |= ATA_EHI_DID_SOFTRESET;
+
+ rc = ata_do_reset(link, reset, classes, deadline);
++ if (rc && rc != -EAGAIN)
++ goto fail;
+
+ if (reset == hardreset &&
+- ata_eh_followup_srst_needed(link, rc, classify, classes)) {
++ ata_eh_followup_srst_needed(link, rc, classes)) {
+ /* okay, let's do follow-up softreset */
+ reset = softreset;
+
+@@ -2191,10 +2187,6 @@ int ata_eh_reset(struct ata_link *link,
+ ata_eh_about_to_do(link, NULL, ATA_EH_RESET);
+ rc = ata_do_reset(link, reset, classes, deadline);
+ }
+-
+- /* -EAGAIN can happen if we skipped followup SRST */
+- if (rc && rc != -EAGAIN)
+- goto fail;
+ } else {
+ if (verbose)
+ ata_link_printk(link, KERN_INFO, "no reset method "
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:24 2008
+Message-Id: <20081018184024.464602796@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:04 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 11/26] libata: fix EH action overwriting in ata_eh_reset()
+Content-Disposition: inline; filename=libata-fix-eh-action-overwriting-in-ata_eh_reset.patch
+Content-Length: 1151
+Lines: 39
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Tejun Heo <tj@kernel.org>
+
+Commit a674050e068a2919908730279f0b731ae6d2e005 upstream
+
+ehc->i.action got accidentally overwritten to ATA_EH_HARD/SOFTRESET in
+ata_eh_reset(). The original intention was to clear reset action
+which wasn't selected. This can cause unexpected behavior when other
+EH actions are scheduled together with reset. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2112,10 +2112,10 @@ int ata_eh_reset(struct ata_link *link,
+ ehc->i.action &= ~ATA_EH_RESET;
+ if (hardreset) {
+ reset = hardreset;
+- ehc->i.action = ATA_EH_HARDRESET;
++ ehc->i.action |= ATA_EH_HARDRESET;
+ } else if (softreset) {
+ reset = softreset;
+- ehc->i.action = ATA_EH_SOFTRESET;
++ ehc->i.action |= ATA_EH_SOFTRESET;
+ }
+
+ if (prereset) {
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
+Message-Id: <20081018184024.791340622@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:05 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Tejun Heo <tj@kernel.org>,
+ Taisuke Yamada <tai@rakugaki.org>,
+ Jeff Garzik <jgarzik@redhat.com>
+Subject: [patch 12/26] libata: LBA28/LBA48 off-by-one bug in ata.h
+Content-Disposition: inline; filename=libata-lba28-lba48-off-by-one-bug-in-ata.h.patch
+Content-Length: 3373
+Lines: 91
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Taisuke Yamada <tai@rakugaki.org>
+
+commit 97b697a11b07e2ebfa69c488132596cc5eb24119 upstream
+
+I recently bought 3 HGST P7K500-series 500GB SATA drives and
+had trouble accessing the block right on the LBA28-LBA48 border.
+Here's how it fails (same for all 3 drives):
+
+ # dd if=/dev/sdc bs=512 count=1 skip=268435455 > /dev/null
+ dd: reading `/dev/sdc': Input/output error
+ 0+0 records in
+ 0+0 records out
+ 0 bytes (0 B) copied, 0.288033 seconds, 0.0 kB/s
+ # dmesg
+ ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
+ ata1.00: BMDMA stat 0x25
+ ata1.00: cmd c8/00:08:f8:ff:ff/00:00:00:00:00/ef tag 0 dma 4096 in
+ res 51/04:08:f8:ff:ff/00:00:00:00:00/ef Emask 0x1 (device error)
+ ata1.00: status: { DRDY ERR }
+ ata1.00: error: { ABRT }
+ ata1.00: configured for UDMA/33
+ ata1: EH complete
+ ...
+
+After some investigations, it turned out this seems to be caused
+by misinterpretation of the ATA specification on LBA28 access.
+Following part is the code in question:
+
+ === include/linux/ata.h ===
+ static inline int lba_28_ok(u64 block, u32 n_block)
+ {
+ /* check the ending block number */
+ return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
+ }
+
+HGST drive (sometimes) fails with LBA28 access of {block = 0xfffffff,
+n_block = 1}, and this behavior seems to be comformant. Other drives,
+including other HGST drives are not that strict, through.
+
+>From the ATA specification:
+(http://www.t13.org/Documents/UploadedDocuments/project/d1410r3b-ATA-ATAPI-6.pdf)
+
+ 8.15.29 Word (61:60): Total number of user addressable sectors
+ This field contains a value that is one greater than the total number
+ of user addressable sectors (see 6.2). The maximum value that shall
+ be placed in this field is 0FFFFFFFh.
+
+So the driver shouldn't use the value of 0xfffffff for LBA28 request
+as this exceeds maximum user addressable sector. The logical maximum
+value for LBA28 is 0xffffffe.
+
+The obvious fix is to cut "- 1" part, and the patch attached just do
+that. I've been using the patched kernel for about a month now, and
+the same fix is also floating on the net for some time. So I believe
+this fix works reliably.
+
+Just FYI, many Windows/Intel platform users also seems to be struck
+by this, and HGST has issued a note pointing to Intel ICH8/9 driver.
+
+ "28-bit LBA command is being used to access LBAs 29-bits in length"
+http://www.hitachigst.com/hddt/knowtree.nsf/cffe836ed7c12018862565b000530c74/b531b8bce8745fb78825740f00580e23
+
+Also, *BSDs seems to have similar fix included sometime around ~2004,
+through I have not checked out exact portion of the code.
+
+Signed-off-by: Taisuke Yamada <tai@rakugaki.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/linux/ata.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -682,7 +682,7 @@ static inline int ata_ok(u8 status)
+ static inline int lba_28_ok(u64 block, u32 n_block)
+ {
+ /* check the ending block number */
+- return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
++ return ((block + n_block) < ((u64)1 << 28)) && (n_block <= 256);
+ }
+
+ static inline int lba_48_ok(u64 block, u32 n_block)
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
+Message-Id: <20081018184025.100824159@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:06 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 13/26] V4L: bttv: Prevent NULL pointer dereference in radio_open
+Content-Disposition: inline; filename=v4l-bttv-prevent-null-pointer-dereference-in-radio_open.patch
+Content-Length: 1504
+Lines: 43
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+(cherry picked from commit c37396c19403e249f12626187d51e92c915f2bc9)
+
+Fix the following crash in the bttv driver:
+
+BUG: unable to handle kernel NULL pointer dereference at 000000000000036c
+IP: [<ffffffffa037860a>] radio_open+0x3a/0x170 [bttv]
+
+This happens because radio_open assumes that all present bttv devices
+have a radio function. If a bttv device without radio and one with
+radio are installed on the same system, and the one without radio is
+registered first, then radio_open checks for the radio device number
+of a bttv device that has no radio function, and this breaks. All we
+have to do to fix it is to skip bttv devices without a radio function.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/bt8xx/bttv-driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -3428,7 +3428,7 @@ static int radio_open(struct inode *inod
+ dprintk("bttv: open minor=%d\n",minor);
+
+ for (i = 0; i < bttv_num; i++) {
+- if (bttvs[i].radio_dev->minor == minor) {
++ if (bttvs[i].radio_dev && bttvs[i].radio_dev->minor == minor) {
+ btv = &bttvs[i];
+ break;
+ }
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
+Message-Id: <20081018184025.355844350@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:07 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>,
+ v4l-dvb maintainer list <v4l-dvb-maintainer@linuxtv.org>,
+ Trent Piepho <xyzzy@speakeasy.org>,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 14/26] V4L: zr36067: Fix RGBR pixel format
+Content-Disposition: inline; filename=v4l-zr36067-fix-rgbr-pixel-format.patch
+Content-Length: 1142
+Lines: 36
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+cherry picked from commit a30ee3c747728f9151664118ffcbdeefd202c332
+
+The zr36067 driver is improperly declaring pixel format RGBP twice,
+once as "16-bit RGB LE" and once as "16-bit RGB BE". The latter is
+actually RGBR. Fix the code to properly map both pixel formats.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Trent Piepho <xyzzy@speakeasy.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/zoran_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/zoran_driver.c
++++ b/drivers/media/video/zoran_driver.c
+@@ -134,7 +134,7 @@ const struct zoran_format zoran_formats[
+ }, {
+ .name = "16-bit RGB BE",
+ ZFMT(-1,
+- V4L2_PIX_FMT_RGB565, V4L2_COLORSPACE_SRGB),
++ V4L2_PIX_FMT_RGB565X, V4L2_COLORSPACE_SRGB),
+ .depth = 16,
+ .flags = ZORAN_FORMAT_CAPTURE |
+ ZORAN_FORMAT_OVERLAY,
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:25 2008
+Message-Id: <20081018184025.549691753@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:08 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jens Axboe <ens.axboe@oracle.com>
+Subject: [patch 15/26] Dont allow splice() to files opened with O_APPEND
+Content-Disposition: inline; filename=don-t-allow-splice-to-files-opened-with-o_append.patch
+Content-Length: 1536
+Lines: 46
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit efc968d450e013049a662d22727cf132618dcb2f upstream
+
+This is debatable, but while we're debating it, let's disallow the
+combination of splice and an O_APPEND destination.
+
+It's not entirely clear what the semantics of O_APPEND should be, and
+POSIX apparently expects pwrite() to ignore O_APPEND, for example. So
+we could make up any semantics we want, including the old ones.
+
+But Miklos convinced me that we should at least give it some thought,
+and that accepting writes at arbitrary offsets is wrong at least for
+IS_APPEND() files (which always have O_APPEND set, even if the reverse
+isn't true: you can obviously have O_APPEND set on a regular file).
+
+So disallow O_APPEND entirely for now. I doubt anybody cares, and this
+way we have one less gray area to worry about.
+
+Reported-and-argued-for-by: Miklos Szeredi <miklos@szeredi.hu>
+Acked-by: Jens Axboe <ens.axboe@oracle.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/splice.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -889,6 +889,9 @@ static long do_splice_from(struct pipe_i
+ if (unlikely(!(out->f_mode & FMODE_WRITE)))
+ return -EBADF;
+
++ if (unlikely(out->f_flags & O_APPEND))
++ return -EINVAL;
++
+ ret = rw_verify_area(WRITE, out, ppos, len);
+ if (unlikely(ret < 0))
+ return ret;
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
+Message-Id: <20081018184025.810507862@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:09 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Laurent Pinchart <laurent.pinchart@skynet.be>
+Subject: [patch 16/26] V4L/DVB (8498): uvcvideo: Return sensible min and max values when querying a boolean control.
+Content-Disposition: inline; filename=v4l-dvb-uvcvideo-return-sensible-min-and-max-values-when-querying-a-boolean-control.patch
+Content-Length: 1828
+Lines: 62
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Laurent Pinchart <laurent.pinchart@skynet.be>
+
+commit 54812c77bc830e2dbcb62b4c6d8a9c7f97cfdd1b upstream
+
+[required to get the following two patches to apply]
+
+Although the V4L2 spec states that the minimum and maximum fields may not be
+valid for control types other than V4L2_CTRL_TYPE_INTEGER, it makes sense
+to set the bounds to 0 and 1 for boolean controls instead of returning
+uninitialized values.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_ctrl.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/video/uvc/uvc_ctrl.c
++++ b/drivers/media/video/uvc/uvc_ctrl.c
+@@ -592,6 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ if (ctrl == NULL)
+ return -EINVAL;
+
++ memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
+ v4l2_ctrl->id = mapping->id;
+ v4l2_ctrl->type = mapping->v4l2_type;
+ strncpy(v4l2_ctrl->name, mapping->name, sizeof v4l2_ctrl->name);
+@@ -608,7 +609,8 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ v4l2_ctrl->default_value = uvc_get_le_value(data, mapping);
+ }
+
+- if (mapping->v4l2_type == V4L2_CTRL_TYPE_MENU) {
++ switch (mapping->v4l2_type) {
++ case V4L2_CTRL_TYPE_MENU:
+ v4l2_ctrl->minimum = 0;
+ v4l2_ctrl->maximum = mapping->menu_count - 1;
+ v4l2_ctrl->step = 1;
+@@ -622,6 +624,15 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ }
+
+ return 0;
++
++ case V4L2_CTRL_TYPE_BOOLEAN:
++ v4l2_ctrl->minimum = 0;
++ v4l2_ctrl->maximum = 1;
++ v4l2_ctrl->step = 1;
++ return 0;
++
++ default:
++ break;
+ }
+
+ if (ctrl->info->flags & UVC_CONTROL_GET_MIN) {
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
+Message-Id: <20081018184026.113844878@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:10 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Bruce Schmid <duck@freescale.com>,
+ Laurent Pinchart <laurent.pinchart@skynet.be>
+Subject: [patch 17/26] V4L/DVB (8617): uvcvideo: dont use stack-based buffers for USB transfers.
+Content-Disposition: inline; filename=v4l-dvb-uvcvideo-don-t-use-stack-based-buffers-for-usb-transfers.patch
+Content-Length: 5036
+Lines: 182
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Laurent Pinchart <laurent.pinchart@skynet.be>
+
+commit 04793dd041bbb88a39b768b714c725de2c339b51 upstream
+
+Data buffers on the stack are not allowed for USB I/O. Use dynamically
+allocated buffers instead.
+
+Signed-off-by: Bruce Schmid <duck@freescale.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@skynet.be>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_ctrl.c | 33 +++++++++++++++++++++------------
+ drivers/media/video/uvc/uvc_video.c | 33 ++++++++++++++++++++++-----------
+ 2 files changed, 43 insertions(+), 23 deletions(-)
+
+--- a/drivers/media/video/uvc/uvc_ctrl.c
++++ b/drivers/media/video/uvc/uvc_ctrl.c
+@@ -585,13 +585,17 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ struct uvc_control_mapping *mapping;
+ struct uvc_menu_info *menu;
+ unsigned int i;
+- __u8 data[8];
++ __u8 *data;
+ int ret;
+
+ ctrl = uvc_find_control(video, v4l2_ctrl->id, &mapping);
+ if (ctrl == NULL)
+ return -EINVAL;
+
++ data = kmalloc(8, GFP_KERNEL);
++ if (data == NULL)
++ return -ENOMEM;
++
+ memset(v4l2_ctrl, 0, sizeof *v4l2_ctrl);
+ v4l2_ctrl->id = mapping->id;
+ v4l2_ctrl->type = mapping->v4l2_type;
+@@ -604,8 +608,8 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ if (ctrl->info->flags & UVC_CONTROL_GET_DEF) {
+ if ((ret = uvc_query_ctrl(video->dev, GET_DEF, ctrl->entity->id,
+ video->dev->intfnum, ctrl->info->selector,
+- &data, ctrl->info->size)) < 0)
+- return ret;
++ data, ctrl->info->size)) < 0)
++ goto out;
+ v4l2_ctrl->default_value = uvc_get_le_value(data, mapping);
+ }
+
+@@ -623,13 +627,15 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ }
+ }
+
+- return 0;
++ ret = 0;
++ goto out;
+
+ case V4L2_CTRL_TYPE_BOOLEAN:
+ v4l2_ctrl->minimum = 0;
+ v4l2_ctrl->maximum = 1;
+ v4l2_ctrl->step = 1;
+- return 0;
++ ret = 0;
++ goto out;
+
+ default:
+ break;
+@@ -638,26 +644,29 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ if (ctrl->info->flags & UVC_CONTROL_GET_MIN) {
+ if ((ret = uvc_query_ctrl(video->dev, GET_MIN, ctrl->entity->id,
+ video->dev->intfnum, ctrl->info->selector,
+- &data, ctrl->info->size)) < 0)
+- return ret;
++ data, ctrl->info->size)) < 0)
++ goto out;
+ v4l2_ctrl->minimum = uvc_get_le_value(data, mapping);
+ }
+ if (ctrl->info->flags & UVC_CONTROL_GET_MAX) {
+ if ((ret = uvc_query_ctrl(video->dev, GET_MAX, ctrl->entity->id,
+ video->dev->intfnum, ctrl->info->selector,
+- &data, ctrl->info->size)) < 0)
+- return ret;
++ data, ctrl->info->size)) < 0)
++ goto out;
+ v4l2_ctrl->maximum = uvc_get_le_value(data, mapping);
+ }
+ if (ctrl->info->flags & UVC_CONTROL_GET_RES) {
+ if ((ret = uvc_query_ctrl(video->dev, GET_RES, ctrl->entity->id,
+ video->dev->intfnum, ctrl->info->selector,
+- &data, ctrl->info->size)) < 0)
+- return ret;
++ data, ctrl->info->size)) < 0)
++ goto out;
+ v4l2_ctrl->step = uvc_get_le_value(data, mapping);
+ }
+
+- return 0;
++ ret = 0;
++out:
++ kfree(data);
++ return ret;
+ }
+
+
+--- a/drivers/media/video/uvc/uvc_video.c
++++ b/drivers/media/video/uvc/uvc_video.c
+@@ -90,17 +90,20 @@ static void uvc_fixup_buffer_size(struct
+ static int uvc_get_video_ctrl(struct uvc_video_device *video,
+ struct uvc_streaming_control *ctrl, int probe, __u8 query)
+ {
+- __u8 data[34];
+- __u8 size;
++ __u8 *data;
++ __u16 size;
+ int ret;
+
+ size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
++ data = kmalloc(size, GFP_KERNEL);
++ if (data == NULL)
++ return -ENOMEM;
++
+ ret = __uvc_query_ctrl(video->dev, query, 0, video->streaming->intfnum,
+- probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
++ probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
+ UVC_CTRL_STREAMING_TIMEOUT);
+-
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ ctrl->bmHint = le16_to_cpup((__le16 *)&data[0]);
+ ctrl->bFormatIndex = data[2];
+@@ -136,17 +139,22 @@ static int uvc_get_video_ctrl(struct uvc
+ */
+ uvc_fixup_buffer_size(video, ctrl);
+
+- return 0;
++out:
++ kfree(data);
++ return ret;
+ }
+
+ int uvc_set_video_ctrl(struct uvc_video_device *video,
+ struct uvc_streaming_control *ctrl, int probe)
+ {
+- __u8 data[34];
+- __u8 size;
++ __u8 *data;
++ __u16 size;
++ int ret;
+
+ size = video->dev->uvc_version >= 0x0110 ? 34 : 26;
+- memset(data, 0, sizeof data);
++ data = kzalloc(size, GFP_KERNEL);
++ if (data == NULL)
++ return -ENOMEM;
+
+ *(__le16 *)&data[0] = cpu_to_le16(ctrl->bmHint);
+ data[2] = ctrl->bFormatIndex;
+@@ -174,10 +182,13 @@ int uvc_set_video_ctrl(struct uvc_video_
+ data[33] = ctrl->bMaxVersion;
+ }
+
+- return __uvc_query_ctrl(video->dev, SET_CUR, 0,
++ ret = __uvc_query_ctrl(video->dev, SET_CUR, 0,
+ video->streaming->intfnum,
+- probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, &data, size,
++ probe ? VS_PROBE_CONTROL : VS_COMMIT_CONTROL, data, size,
+ UVC_CTRL_STREAMING_TIMEOUT);
++
++ kfree(data);
++ return ret;
+ }
+
+ int uvc_probe_video(struct uvc_video_device *video,
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
+Message-Id: <20081018184026.628878074@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:12 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Shaohua Li <shaohua.li@intel.com>
+Subject: [patch 19/26] PCI: disable ASPM per ACPI FADT setting
+Content-Disposition: inline; filename=pci-disable-aspm-per-acpi-fadt-setting.patch
+Content-Length: 2874
+Lines: 95
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Shaohua Li <shaohua.li@intel.com>
+commit 5fde244d39b88625ac578d83e6625138714de031 upstream
+
+The ACPI FADT table includes an ASPM control bit. If the bit is set, do
+not enable ASPM since it may indicate that the platform doesn't actually
+support the feature.
+
+Tested-by: Jack Howarth <howarth@bromo.msbb.uc.edu>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-acpi.c | 7 +++++++
+ drivers/pci/pcie/aspm.c | 5 +++++
+ include/acpi/actbl.h | 1 +
+ include/linux/pci-aspm.h | 5 +++++
+ 4 files changed, 18 insertions(+)
+
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -11,6 +11,7 @@
+ #include <linux/init.h>
+ #include <linux/pci.h>
+ #include <linux/module.h>
++#include <linux/pci-aspm.h>
+ #include <acpi/acpi.h>
+ #include <acpi/acnamesp.h>
+ #include <acpi/acresrc.h>
+@@ -394,6 +395,12 @@ static int __init acpi_pci_init(void)
+ printk(KERN_INFO"ACPI FADT declares the system doesn't support MSI, so disable it\n");
+ pci_no_msi();
+ }
++
++ if (acpi_gbl_FADT.boot_flags & BAF_PCIE_ASPM_CONTROL) {
++ printk(KERN_INFO"ACPI FADT declares the system doesn't support PCIe ASPM, so disable it\n");
++ pcie_no_aspm();
++ }
++
+ ret = register_acpi_bus_type(&acpi_pci_bus);
+ if (ret)
+ return 0;
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -808,6 +808,11 @@ static int __init pcie_aspm_disable(char
+
+ __setup("pcie_noaspm", pcie_aspm_disable);
+
++void pcie_no_aspm(void)
++{
++ aspm_disabled = 1;
++}
++
+ #ifdef CONFIG_ACPI
+ #include <acpi/acpi_bus.h>
+ #include <linux/pci-acpi.h>
+--- a/include/acpi/actbl.h
++++ b/include/acpi/actbl.h
+@@ -277,6 +277,7 @@ enum acpi_prefered_pm_profiles {
+ #define BAF_LEGACY_DEVICES 0x0001
+ #define BAF_8042_KEYBOARD_CONTROLLER 0x0002
+ #define BAF_MSI_NOT_SUPPORTED 0x0008
++#define BAF_PCIE_ASPM_CONTROL 0x0010
+
+ #define FADT2_REVISION_ID 3
+ #define FADT2_MINUS_REVISION_ID 2
+--- a/include/linux/pci-aspm.h
++++ b/include/linux/pci-aspm.h
+@@ -27,6 +27,7 @@ extern void pcie_aspm_init_link_state(st
+ extern void pcie_aspm_exit_link_state(struct pci_dev *pdev);
+ extern void pcie_aspm_pm_state_change(struct pci_dev *pdev);
+ extern void pci_disable_link_state(struct pci_dev *pdev, int state);
++extern void pcie_no_aspm(void);
+ #else
+ static inline void pcie_aspm_init_link_state(struct pci_dev *pdev)
+ {
+@@ -40,6 +41,10 @@ static inline void pcie_aspm_pm_state_ch
+ static inline void pci_disable_link_state(struct pci_dev *pdev, int state)
+ {
+ }
++
++static inline void pcie_no_aspm(void)
++{
++}
+ #endif
+
+ #ifdef CONFIG_PCIEASPM_DEBUG /* this depends on CONFIG_PCIEASPM */
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
+Message-Id: <20081018184026.840852710@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:13 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>,
+ Shaohua Li <shaohua.li@intel.com>
+Subject: [patch 20/26] PCI: disable ASPM on pre-1.1 PCIe devices
+Content-Disposition: inline; filename=pci-disable-aspm-on-pre-1.1-pcie-devices.patch
+Content-Length: 2346
+Lines: 76
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Shaohua Li <shaohua.li@intel.com>
+
+commit 149e16372a2066c5474d8a8db9b252afd57eb427 upstream
+
+Disable ASPM on pre-1.1 PCIe devices, as many of them don't implement it
+correctly.
+
+Tested-by: Jack Howarth <howarth@bromo.msbb.uc.edu>
+Signed-off-by: Shaohua Li <shaohua.li@intel.com>
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pcie/aspm.c | 13 +++++++++++++
+ drivers/pci/probe.c | 3 ++-
+ include/linux/pci_regs.h | 1 +
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -510,6 +510,7 @@ static int pcie_aspm_sanity_check(struct
+ {
+ struct pci_dev *child_dev;
+ int child_pos;
++ u32 reg32;
+
+ /*
+ * Some functions in a slot might not all be PCIE functions, very
+@@ -519,6 +520,18 @@ static int pcie_aspm_sanity_check(struct
+ child_pos = pci_find_capability(child_dev, PCI_CAP_ID_EXP);
+ if (!child_pos)
+ return -EINVAL;
++
++ /*
++ * Disable ASPM for pre-1.1 PCIe device, we follow MS to use
++ * RBER bit to determine if a function is 1.1 version device
++ */
++ pci_read_config_dword(child_dev, child_pos + PCI_EXP_DEVCAP,
++ ®32);
++ if (!(reg32 & PCI_EXP_DEVCAP_RBER)) {
++ printk("Pre-1.1 PCIe device detected, "
++ "disable ASPM for %s\n", pci_name(pdev));
++ return -EINVAL;
++ }
+ }
+ return 0;
+ }
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -1047,7 +1047,8 @@ int pci_scan_slot(struct pci_bus *bus, i
+ }
+ }
+
+- if (bus->self)
++ /* only one slot has pcie device */
++ if (bus->self && nr)
+ pcie_aspm_init_link_state(bus->self);
+
+ return nr;
+--- a/include/linux/pci_regs.h
++++ b/include/linux/pci_regs.h
+@@ -373,6 +373,7 @@
+ #define PCI_EXP_DEVCAP_ATN_BUT 0x1000 /* Attention Button Present */
+ #define PCI_EXP_DEVCAP_ATN_IND 0x2000 /* Attention Indicator Present */
+ #define PCI_EXP_DEVCAP_PWR_IND 0x4000 /* Power Indicator Present */
++#define PCI_EXP_DEVCAP_RBER 0x8000 /* Role-Based Error Reporting */
+ #define PCI_EXP_DEVCAP_PWR_VAL 0x3fc0000 /* Slot Power Limit Value */
+ #define PCI_EXP_DEVCAP_PWR_SCL 0xc000000 /* Slot Power Limit Scale */
+ #define PCI_EXP_DEVCTL 8 /* Device Control */
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
+Message-Id: <20081018184027.044705714@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:14 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Ingo Molnar <mingo@elte.hu>,
+ David Rientjes <rientjes@google.com>
+Subject: [patch 21/26] x86: avoid dereferencing beyond stack + THREAD_SIZE
+Content-Disposition: inline; filename=x86-avoid-dereferencing-beyond-stack-thread_size.patch
+Content-Length: 1293
+Lines: 41
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: David Rientjes <rientjes@google.com>
+
+commit 60e6258cd43f9b06884f04f0f7cefb9c40f17a32 upstream
+
+It's possible for get_wchan() to dereference past task->stack + THREAD_SIZE
+while iterating through instruction pointers if fp equals the upper boundary,
+causing a kernel panic.
+
+Signed-off-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/process_64.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -740,12 +740,12 @@ unsigned long get_wchan(struct task_stru
+ if (!p || p == current || p->state==TASK_RUNNING)
+ return 0;
+ stack = (unsigned long)task_stack_page(p);
+- if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
++ if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+ return 0;
+ fp = *(u64 *)(p->thread.sp);
+ do {
+ if (fp < (unsigned long)stack ||
+- fp > (unsigned long)stack+THREAD_SIZE)
++ fp >= (unsigned long)stack+THREAD_SIZE)
+ return 0;
+ ip = *(u64 *)(fp+8);
+ if (!in_sched_functions(ip))
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
+Message-Id: <20081018184027.296348381@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:15 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jesse Barnes <jbarnes@virtuousgeek.org>
+Subject: [patch 22/26] Check mapped ranges on sysfs resource files
+Content-Disposition: inline; filename=check-mapped-ranges-on-sysfs-resource-files.patch
+Content-Length: 2994
+Lines: 86
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit b5ff7df3df9efab511244d5a299fce706c71af48 upstream
+
+Check mapped ranges on sysfs resource files
+
+This is loosely based on a patch by Jesse Barnes to check the user-space
+PCI mappings though the sysfs interfaces. Quoting Jesse's original
+explanation:
+
+ It's fairly common for applications to map PCI resources through sysfs.
+ However, with the current implementation, it's possible for an application
+ to map far more than the range corresponding to the resourceN file it
+ opened. This patch plugs that hole by checking the range at mmap time,
+ similar to what is done on platforms like sparc64 in their lower level
+ PCI remapping routines.
+
+ It was initially put together to help debug the e1000e NVRAM corruption
+ problem, since we initially thought an X driver might be walking past the
+ end of one of its mappings and clobbering the NVRAM. It now looks like
+ that's not the case, but doing the check is still important for obvious
+ reasons.
+
+and this version of the patch differs in that it uses a helper function
+to clarify the code, and does all the checks in pages (instead of bytes)
+in order to avoid overflows when doing "<< PAGE_SHIFT" etc.
+
+[cebbert@redhat.com: backport, changing WARN() to printk()]
+
+Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pci/pci-sysfs.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -16,6 +16,7 @@
+
+
+ #include <linux/kernel.h>
++#include <linux/sched.h>
+ #include <linux/pci.h>
+ #include <linux/stat.h>
+ #include <linux/topology.h>
+@@ -484,6 +485,21 @@ pci_mmap_legacy_mem(struct kobject *kobj
+ #endif /* HAVE_PCI_LEGACY */
+
+ #ifdef HAVE_PCI_MMAP
++
++static int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma)
++{
++ unsigned long nr, start, size;
++
++ nr = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
++ start = vma->vm_pgoff;
++ size = pci_resource_len(pdev, resno) >> PAGE_SHIFT;
++ if (start < size && size - start >= nr)
++ return 1;
++ printk(KERN_WARNING "WARNING: process \"%s\" tried to map 0x%08lx-0x%08lx on %s BAR %d (size 0x%08lx)\n",
++ current->comm, start, start+nr, pci_name(pdev), resno, size);
++ return 0;
++}
++
+ /**
+ * pci_mmap_resource - map a PCI resource into user memory space
+ * @kobj: kobject for mapping
+@@ -510,6 +526,9 @@ pci_mmap_resource(struct kobject *kobj,
+ if (i >= PCI_ROM_RESOURCE)
+ return -ENODEV;
+
++ if (!pci_mmap_fits(pdev, i, vma))
++ return -EINVAL;
++
+ /* pci_mmap_page_range() expects the same kind of entry as coming
+ * from /proc/bus/pci/ which is a "user visible" value. If this is
+ * different from the resource itself, arch will do necessary fixup.
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:27 2008
+Message-Id: <20081018184027.524994899@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:16 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Jean Delvare <khali@linux-fr.org>
+Subject: [patch 23/26] hwmon: (it87) Prevent power-off on Shuttle SN68PT
+Content-Disposition: inline; filename=hwmon-prevent-power-off-on-shuttle-sn68pt.patch
+Content-Length: 3632
+Lines: 114
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Jean Delvare <khali@linux-fr.org>
+
+based on commit 98dd22c3e086d76058083432d4d8fb85f04bab90 upstream
+
+On the Shuttle SN68PT, FAN_CTL2 is apparently not connected to a fan,
+but to something else. One user has reported instant system power-off
+when changing the PWM2 duty cycle, so we disable it.
+
+I use the board name string as the trigger in case the same board is
+ever used in other systems.
+
+This closes lm-sensors ticket #2349:
+pwmconfig causes a hard poweroff
+http://www.lm-sensors.org/ticket/2349
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hwmon/it87.c | 39 +++++++++++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 6 deletions(-)
+
+--- a/drivers/hwmon/it87.c
++++ b/drivers/hwmon/it87.c
+@@ -46,6 +46,8 @@
+ #include <linux/err.h>
+ #include <linux/mutex.h>
+ #include <linux/sysfs.h>
++#include <linux/string.h>
++#include <linux/dmi.h>
+ #include <asm/io.h>
+
+ #define DRVNAME "it87"
+@@ -235,6 +237,8 @@ struct it87_sio_data {
+ enum chips type;
+ /* Values read from Super-I/O config space */
+ u8 vid_value;
++ /* Values set based on DMI strings */
++ u8 skip_pwm;
+ };
+
+ /* For each registered chip, we need to keep some data in memory.
+@@ -952,6 +956,7 @@ static int __init it87_find(unsigned sho
+ {
+ int err = -ENODEV;
+ u16 chip_type;
++ const char *board_vendor, *board_name;
+
+ superio_enter();
+ chip_type = force_id ? force_id : superio_inw(DEVID);
+@@ -1009,6 +1014,25 @@ static int __init it87_find(unsigned sho
+ pr_info("it87: in7 is VCCH (+5V Stand-By)\n");
+ }
+
++ sio_data->skip_pwm = 0;
++ /* Disable specific features based on DMI strings */
++ board_vendor = dmi_get_system_info(DMI_BOARD_VENDOR);
++ board_name = dmi_get_system_info(DMI_BOARD_NAME);
++ if (board_vendor && board_name) {
++ if (strcmp(board_vendor, "nVIDIA") == 0
++ && strcmp(board_name, "FN68PT") == 0) {
++ /* On the Shuttle SN68PT, FAN_CTL2 is apparently not
++ connected to a fan, but to something else. One user
++ has reported instant system power-off when changing
++ the PWM2 duty cycle, so we disable it.
++ I use the board name string as the trigger in case
++ the same board is ever used in other systems. */
++ pr_info("it87: Disabling pwm2 due to "
++ "hardware constraints\n");
++ sio_data->skip_pwm = (1 << 1);
++ }
++ }
++
+ exit:
+ superio_exit();
+ return err;
+@@ -1157,22 +1181,25 @@ static int __devinit it87_probe(struct p
+ if ((err = device_create_file(dev,
+ &sensor_dev_attr_pwm1_enable.dev_attr))
+ || (err = device_create_file(dev,
+- &sensor_dev_attr_pwm2_enable.dev_attr))
+- || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm3_enable.dev_attr))
+ || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm1.dev_attr))
+ || (err = device_create_file(dev,
+- &sensor_dev_attr_pwm2.dev_attr))
+- || (err = device_create_file(dev,
+ &sensor_dev_attr_pwm3.dev_attr))
+ || (err = device_create_file(dev,
+ &dev_attr_pwm1_freq))
+ || (err = device_create_file(dev,
+- &dev_attr_pwm2_freq))
+- || (err = device_create_file(dev,
+ &dev_attr_pwm3_freq)))
+ goto ERROR4;
++ if (!(sio_data->skip_pwm & (1 << 1))) {
++ if ((err = device_create_file(dev,
++ &sensor_dev_attr_pwm2_enable.dev_attr))
++ || (err = device_create_file(dev,
++ &sensor_dev_attr_pwm2.dev_attr))
++ || (err = device_create_file(dev,
++ &dev_attr_pwm2_freq)))
++ goto ERROR4;
++ }
+ }
+
+ if (data->type == it8712 || data->type == it8716
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
+Message-Id: <20081018184027.948938724@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:17 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Zhao Yakui <yakui.zhao@intel.com>,
+ linux-acpi@vger.kernel.org,
+ Zhang Rui <rui.zhang@intel.com>,
+ Andi Kleen <ak@linux.intel.com>,
+ Len Brown <lenb@kernel.org>
+Subject: [patch 24/26] ACPI: Ignore _BQC object when registering backlight device
+Content-Disposition: inline; filename=acpi-ignore-_bqc-object-when-registering-backlight-device.patch
+Content-Length: 2043
+Lines: 60
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+upstream commmit: c2c789057f075022658b38b498755c29c1ba8055
+
+According to acpi spec , the objectes of _BCL and _BCM are required if
+integrated LCD is present and supports brightness level and the _BQC is
+the optional object. So the _BQC object will be ignored when the backlight
+device is registered.
+At the same time when there is no _BQC object, the current brightness will be
+set to the maximum.
+
+http://bugzilla.kernel.org/show_bug.cgi?id=10206
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Cc: Len Brown <lenb@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/acpi/video.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -720,7 +720,7 @@ static void acpi_video_device_find_cap(s
+
+ kfree(obj);
+
+- if (device->cap._BCL && device->cap._BCM && device->cap._BQC && max_level > 0){
++ if (device->cap._BCL && device->cap._BCM && max_level > 0) {
+ int result;
+ static int count = 0;
+ char *name;
+@@ -732,7 +732,17 @@ static void acpi_video_device_find_cap(s
+ device->backlight = backlight_device_register(name,
+ NULL, device, &acpi_backlight_ops);
+ device->backlight->props.max_brightness = device->brightness->count-3;
+- device->backlight->props.brightness = acpi_video_get_brightness(device->backlight);
++ /*
++ * If there exists the _BQC object, the _BQC object will be
++ * called to get the current backlight brightness. Otherwise
++ * the brightness will be set to the maximum.
++ */
++ if (device->cap._BQC)
++ device->backlight->props.brightness =
++ acpi_video_get_brightness(device->backlight);
++ else
++ device->backlight->props.brightness =
++ device->backlight->props.max_brightness;
+ backlight_update_status(device->backlight);
+ kfree(name);
+
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
+Message-Id: <20081018184028.154266356@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:18 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Dave Airlie <airlied@redhat.com>
+Subject: [patch 25/26] drm/i915: fix ioremap of a user address for non-root (CVE-2008-3831)
+Content-Disposition: inline; filename=drm-i915-fix-ioremap-of-a-user-address-for-non-root.patch
+Content-Length: 1461
+Lines: 37
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Matthias Hopf <mhopf@suse.de>
+
+commit 4b40893918203ee1a1f6a114316c2a19c072e9bd upstream
+
+Olaf Kirch noticed that the i915_set_status_page() function of the i915
+kernel driver calls ioremap with an address offset that is supplied by
+userspace via ioctl. The function zeroes the mapped memory via memset
+and tells the hardware about the address. Turns out that access to that
+ioctl is not restricted to root so users could probably exploit that to
+do nasty things. We haven't tried to write actual exploit code though.
+
+It only affects the Intel G33 series and newer.
+
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/drm/i915_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/drm/i915_dma.c
++++ b/drivers/char/drm/i915_dma.c
+@@ -836,7 +836,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
+ DRM_IOCTL_DEF(DRM_I915_SET_VBLANK_PIPE, i915_vblank_pipe_set, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY ),
+ DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE, i915_vblank_pipe_get, DRM_AUTH ),
+ DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH),
+- DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH),
++ DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
+ };
+
+ int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:28 2008
+Message-Id: <20081018184028.591624247@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:19 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 26/26] DVB: au0828: add support for another USB id for Hauppauge HVR950Q
+Content-Disposition: inline; filename=dvb-au0828-add-support-for-another-usb-id-for-hauppauge-hvr950q.patch
+Content-Length: 2303
+Lines: 51
+
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Michael Krufky <mkrufky@linuxtv.org>
+
+(cherry picked from commit a636da6bab3307fc8c6e6a22a63b0b25ba0687be)
+
+DVB: au0828: add support for another USB id for Hauppauge HVR950Q
+
+Add autodetection support for a new revision of the Hauppauge HVR950Q (2040:721e)
+
+Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/video4linux/CARDLIST.au0828 | 2 +-
+ drivers/media/video/au0828/au0828-cards.c | 3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/Documentation/video4linux/CARDLIST.au0828
++++ b/Documentation/video4linux/CARDLIST.au0828
+@@ -1,4 +1,4 @@
+ 0 -> Unknown board (au0828)
+- 1 -> Hauppauge HVR950Q (au0828) [2040:7200,2040:7210,2040:7217,2040:721b,2040:721f,2040:7280,0fd9:0008]
++ 1 -> Hauppauge HVR950Q (au0828) [2040:7200,2040:7210,2040:7217,2040:721b,2040:721e,2040:721f,2040:7280,0fd9:0008]
+ 2 -> Hauppauge HVR850 (au0828) [2040:7240]
+ 3 -> DViCO FusionHDTV USB (au0828) [0fe9:d620]
+--- a/drivers/media/video/au0828/au0828-cards.c
++++ b/drivers/media/video/au0828/au0828-cards.c
+@@ -83,6 +83,7 @@ static void hauppauge_eeprom(struct au08
+ case 72221: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
+ case 72231: /* WinTV-HVR950q (OEM, IR, ATSC/QAM and basic analog video */
+ case 72241: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM and basic analog video */
++ case 72251: /* WinTV-HVR950q (Retail, IR, ATSC/QAM and basic analog video */
+ case 72301: /* WinTV-HVR850 (Retail, IR, ATSC and basic analog video */
+ case 72500: /* WinTV-HVR950q (OEM, No IR, ATSC/QAM */
+ break;
+@@ -187,6 +188,8 @@ struct usb_device_id au0828_usb_id_table
+ .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+ { USB_DEVICE(0x2040, 0x721b),
+ .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
++ { USB_DEVICE(0x2040, 0x721e),
++ .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+ { USB_DEVICE(0x2040, 0x721f),
+ .driver_info = AU0828_BOARD_HAUPPAUGE_HVR950Q },
+ { USB_DEVICE(0x2040, 0x7280),
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:26 2008
+Message-Id: <20081018184026.426497114@mini.kroah.org>
+References: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:39:11 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk,
+ Mauro Carvalho Chehab <mchehab@infradead.org>,
+ Laurent Pinchart <laurent.pinchart@skynet.be>,
+ Mauro Carvalho Chehab <mchehab@redhat.com>
+Subject: [patch 18/26] V4L/DVB (9053): fix buffer overflow in uvc-video
+Content-Disposition: inline; filename=v4l-dvb-fix-buffer-overflow-in-uvc-video.patch
+Content-Length: 1439
+Lines: 46
+
+2.6.26-stable review patch. If anyone has any objections, please let us
+know.
+
+------------------
+From: Ralph Loader <suckfish@ihug.co.nz>
+
+Commit fe6c700ff34e68e1eb7991e9c5d18986d0005ac1 upstream
+
+V4L/DVB (9053): fix buffer overflow in uvc-video
+
+There is a buffer overflow in drivers/media/video/uvc/uvc_ctrl.c:
+
+INFO: 0xf2c5ce08-0xf2c5ce0b. First byte 0xa1 instead of 0xcc
+INFO: Allocated in uvc_query_v4l2_ctrl+0x3c/0x239 [uvcvideo] age=13 cpu=1 pid=4975
+...
+
+A fixed size 8-byte buffer is allocated, and a variable size field is read
+into it; there is no particular bound on the size of the field (it is
+dependent on hardware and configuration) and it can overflow [also
+verified by inserting printk's.]
+
+The patch attempts to size the buffer to the correctly.
+
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Laurent Pinchart <laurent.pinchart@skynet.be>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Cc: Chuck Ebbert <cebbert@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/video/uvc/uvc_ctrl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/video/uvc/uvc_ctrl.c
++++ b/drivers/media/video/uvc/uvc_ctrl.c
+@@ -592,7 +592,7 @@ int uvc_query_v4l2_ctrl(struct uvc_video
+ if (ctrl == NULL)
+ return -EINVAL;
+
+- data = kmalloc(8, GFP_KERNEL);
++ data = kmalloc(ctrl->info->size, GFP_KERNEL);
+ if (data == NULL)
+ return -ENOMEM;
+
+
+--
+
+From gregkh@mini.kroah.org Sat Oct 18 11:40:20 2008
+Message-Id: <20081018183853.004667035@mini.kroah.org>
+User-Agent: quilt/0.46-1
+Date: Sat, 18 Oct 2008 11:38:53 -0700
+From: Greg KH <gregkh@suse.de>
+To: linux-kernel@vger.kernel.org,
+ stable@kernel.org
+Cc: Justin Forbes <jmforbes@linuxtx.org>,
+ Zwane Mwaikambo <zwane@arm.linux.org.uk>,
+ Theodore Ts'o <tytso@mit.edu>,
+ Randy Dunlap <rdunlap@xenotime.net>,
+ Dave Jones <davej@redhat.com>,
+ Chuck Wolber <chuckw@quantumlinux.com>,
+ Chris Wedgwood <reviews@ml.cw.f00f.org>,
+ Michael Krufky <mkrufky@linuxtv.org>,
+ Chuck Ebbert <cebbert@redhat.com>,
+ Domenico Andreoli <cavokz@gmail.com>,
+ Willy Tarreau <w@1wt.eu>,
+ Rodrigo Rubira Branco <rbranco@la.checkpoint.com>,
+ Jake Edge <jake@lwn.net>,
+ Eugene Teo <eteo@redhat.com>,
+ torvalds@linux-foundation.org,
+ akpm@linux-foundation.org,
+ alan@lxorguk.ukuu.org.uk
+Subject: [patch 00/26] 2.6.26-stable review
+Content-Length: 2646
+Lines: 57
+
+This is the start of the stable review cycle for the 2.6.26.7 release.
+There are 26 patches in this series, all will be posted as a response
+to this one. If anyone has any issues with these being applied, please
+let us know. If anyone is a maintainer of the proper subsystem, and
+wants to add a Signed-off-by: line to the patch, please respond with it.
+
+These patches are sent out with a number of different people on the
+Cc: line. If you wish to be a reviewer, please email stable@kernel.org
+to add your name to the list. If you want to be off the reviewer list,
+also email us.
+
+Responses should be made by Wed, October 22, 2008 19:00:00 UTC.
+Anything received after that time might be too late.
+
+The whole patch series can be found in one patch at:
+ kernel.org/pub/linux/kernel/v2.6/stable-review/patch-2.6.26.7-rc1.gz
+and the diffstat can be found below.
+
+
+thanks,
+
+greg k-h
+
+
+ Documentation/video4linux/CARDLIST.au0828 | 2
+ Makefile | 2
+ arch/x86/kernel/alternative.c | 2
+ arch/x86/kernel/io_apic_32.c | 3
+ arch/x86/kernel/process_64.c | 4
+ arch/x86/mm/ioremap.c | 2
+ drivers/acpi/video.c | 14 ++-
+ drivers/ata/libata-eh.c | 24 +----
+ drivers/char/drm/i915_dma.c | 2
+ drivers/char/tty_io.c | 2
+ drivers/hwmon/it87.c | 39 +++++++--
+ drivers/media/video/au0828/au0828-cards.c | 3
+ drivers/media/video/bt8xx/bttv-driver.c | 2
+ drivers/media/video/uvc/uvc_ctrl.c | 44 +++++++---
+ drivers/media/video/uvc/uvc_video.c | 33 +++++--
+ drivers/media/video/zoran_driver.c | 2
+ drivers/net/wireless/b43legacy/xmit.c | 2
+ drivers/pci/pci-acpi.c | 7 +
+ drivers/pci/pci-sysfs.c | 19 ++++
+ drivers/pci/pcie/aspm.c | 18 ++++
+ drivers/pci/probe.c | 3
+ drivers/video/console/fbcon.c | 4
+ fs/cifs/cifsglob.h | 1
+ fs/cifs/cifssmb.c | 4
+ fs/cifs/readdir.c | 128 +++++++++++++++---------------
+ fs/splice.c | 3
+ include/acpi/actbl.h | 1
+ include/linux/ata.h | 2
+ include/linux/pci-aspm.h | 5 +
+ include/linux/pci_regs.h | 1
+ kernel/module.c | 2
+ kernel/sched_rt.c | 8 -
+ 32 files changed, 258 insertions(+), 130 deletions(-)
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
