Fix for rhbz 735437

kernel.spec

@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # When changing real_sublevel below, reset this by hand to 1
 # (or to 0 and then use rpmdev-bumpspec).
 #
-%global baserelease 5
+%global baserelease 6
 %global fedora_build %{baserelease}
 
 # real_sublevel is the 3.x kernel version we're starting with
@@ -684,6 +684,9 @@ Patch21005: cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
 # from 3.0.5 patch queue
 Patch21006: sendmmsg-sendmsg-fix-unsafe-user-pointer-access.patch
 
+# rhbz #735437
+Patch21007: ucvideo-fix-crash-when-linking-entities.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1237,6 +1240,9 @@ ApplyPatch cifs-fix-ERR_PTR-dereference-in-cifs_get_root.patch
 # from 3.0.5 patch queue
 ApplyPatch sendmmsg-sendmsg-fix-unsafe-user-pointer-access.patch
 
+#rhbz 735437
+ApplyPatch ucvideo-fix-crash-when-linking-entities.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1857,6 +1863,9 @@ fi
 # and build.
 
 %changelog
+* Wed Sep 07 2011 Josh Boyer <jwboyer@redhat.com>
+- Add patch to fix oops when linking entities in ucvideo (rhbz 735437)
+
 * Wed Aug 31 2011 Dave Jones <davej@redhat.com>
 - Reinstate some conflicts: that disappeared during the rebase (rhbz 710646)
 

ucvideo-fix-crash-when-linking-entities.patch

@@ -0,0 +1,34 @@
+The uvc_mc_register_entity() function wrongfully selects the
+media_entity associated with a UVC entity when creating links. This
+results in access to uninitialized media_entity structures and can hit a
+BUG_ON statement in media_entity_create_link(). Fix it.
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+---
+ drivers/media/video/uvc/uvc_entity.c |    2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+This patch should fix a v3.0 regression that results in a kernel crash as
+reported in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=637740 and
+https://bugzilla.redhat.com/show_bug.cgi?id=735437.
+
+Test results will be welcome.
+
+diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
+index 48fea37..29e2399 100644
+--- a/drivers/media/video/uvc/uvc_entity.c
++++ b/drivers/media/video/uvc/uvc_entity.c
+@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
+ 		if (remote == NULL)
+ 			return -EINVAL;
+ 
+-		source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
++		source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
+ 		       ? (remote->vdev ? &remote->vdev->entity : NULL)
+ 		       : &remote->subdev.entity;
+ 		if (source == NULL)
+-- 
+Regards,
+
+Laurent Pinchart
+