This bug was fixed in the package linux - 2.6.27-3.4

---------------
linux (2.6.27-3.4) intrepid; urgency=low

  [ Colin Ian King ]

  * SAUCE: fix kernel oops in VirtualBox during paravirt patching
    - LP: #246067
  * SAUCE: qc-usb: Enable Logitech QuickCam Messenger
    - LP: #209901
  * SAUCE: appleir: Enable driver for new MacBook Pro
    - LP: #157919

  [ Tim Gardner ]

  * Enabled CONFIG_DEBUG_RODATA=y

  [ Upstream Kernel Changes ]

  * Revert "ALSA: hda - Added model selection for iMac 24""
  * Revert "x86: fix HPET regression in 2.6.26 versus 2.6.25, check hpet
    against BAR, v3"
  * Revert "[ARM] use the new byteorder headers"
  * Revert "mac80211: Use IWEVASSOCREQIE instead of IWEVCUSTOM"
  * Revert "crypto: camellia - Use kernel-provided bitops, unaligned access
    helpers"
  * svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet
  * sched, cpuset: rework sched domains and CPU hotplug handling (v4)
  * ACPI: Fix now signed module parameter.
  * ACPI: Change package length error to warning
  * ACPI: Fix now signed module parameter.
  * ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board"
  * acpi: add checking for NULL early param
  * UBIFS: fix zero-length truncations
  * Input: bcm5974 - add maintainer entry
  * sh64: re-add the __strnlen_user() prototype
  * sh: fix ptrace_64.c:user_disable_single_step()
  * PNPACPI: ignore the producer/consumer bit for extended IRQ descriptors
  * UBIFS: always read hashed-key nodes under TNC mutex
  * UBIFS: allow for racing between GC and TNC
  * [CIFS] Fix plaintext authentication
  * sparc32: Implement smp_call_function_single().
  * sh: crash kernel resource fix
  * sh: fix kexec entry point for crash kernels
  * sh: fix platform_resource_setup_memory() section mismatch
  * sh: update Migo-R defconfig
  * sh: update AP325RXA defconfig
  * sh: fix semtimedop syscall
  * cifs: fix O_APPEND on directio mounts
  * [CIFS] update cifs change log
  * [CIFS] Turn off Unicode during session establishment for plaintext
    authentication
  * ACPI: thinkpad-acpi: wan radio control is not experimental
  * sparc: Fix resource flags for PCI children in OF device tree.
  * remove blk_register_filter and blk_unregister_filter in gendisk
  * ALSA: oxygen: fix distorted output on AK4396-based cards
  * ipv6: When we droped a packet, we should return NET_RX_DROP instead of
    0
  * pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock()
  * net: Unbreak userspace usage of linux/mroute.h
  * Don't trigger softlockup detector on network fs blocked tasks
  * Resource handling: add 'insert_resource_expand_to_fit()' function
  * sparc64: setup_valid_addr_bitmap_from_pavail() should be __init
  * UBIFS: do not update min_idx_lebs in stafs
  * UBIFS: push empty flash hack down
  * UBIFS: remove incorrect index space check
  * UBIFS: improve statfs reporting
  * UBIFS: fix assertion
  * UBIFS: add forgotten gc_idx_lebs component
  * UBIFS: introduce LEB overhead
  * UBIFS: improve statfs reporting even more
  * UBIFS: fill f_fsid
  * drm/radeon: downgrade debug message from info to debug.
  * Remove invalidate_partition call from do_md_stop.
  * Fix problem with waiting while holding rcu read lock in md/bitmap.c
  * ALSA: hda: Distortion fix for dell_m6_core_init
  * ALSA: ASoC: fix pxa2xx-i2s clk_get call
  * block: restore original behavior of /proc/partition when there's no
    partition
  * debugobjects: fix lockdep warning
  * avr32: Fix lockup after Java stack underflow in user mode
  * avr32: pm_standby low-power ram bug fix
  * nfsd: fix compound state allocation error handling
  * sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports
  * nfsd: fix buffer overrun decoding NFSv4 acl
  * audit: Moved variable declaration to beginning of function
  * Fix modules_install on RO nfs-exported trees.
  * Remove '#include <stddef.h>' from mm/page_isolation.c
  * dabusb_fpga_download(): fix a memory leak
  * [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()
  * ALSA: hda - Fix ALC663 auto-probe
  * ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration
  * Un-break printk strings in x86 PCI probing code
  * kernel/resource.c: fix new kernel-doc warning
  * softlockup: minor cleanup, don't check task->state twice
  * fix typo in arch/parisc/hpux/fs.c
  * m68k: atari_keyb_init operator precedence fix
  * ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board"
  * don't diff generated firmware files
  * IDE: compile fix for sff_dma_ops
  * IDE: palm_bk3710: fix compile warning for unused variable
  * ide: fix hwif_to_node()
  * palm_bk3710: improve IDE registration
  * ide-disk: remove stale init_idedisk_capacity() documentation
  * ide/Kconfig: mark ide-scsi as deprecated
  * net/wireless/Kconfig: clarify the description for
    CONFIG_WIRELESS_EXT_SYSFS
  * iwlwifi: do not use GFP_DMA in iwl_tx_queue_init
  * iwlwifi: workaround interrupt handling no some platforms
  * iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE)
  * iwlwifi: fix 64bit platform firmware loading
  * orinoco: Multicast to the specified addresses
  * wireless/libertas/if_cs.c: fix memory leaks
  * mac80211: Fix debugfs union misuse and pointer corruption
  * rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON
  * ath9k: Incorrect key used when group and pairwise ciphers are
    different.
  * ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message.
  * net/xfrm: Use an IS_ERR test rather than a NULL test
  * ipv: Re-enable IP when MTU > 68
  * NTFS: update homepage
  * mm: make setup_zone_migrate_reserve() aware of overlapping nodes
  * VFS: fix dio write returning EIO when try_to_release_page fails
  * acer-wmi: remove debugfs entries upon unloading
  * mm/bootmem: silence section mismatch warning -
    contig_page_data/bootmem_node_data
  * MAINTAINERS: add a maintainer for the BCM5974 multitouch driver
  * 8250: improve workaround for UARTs that don't re-assert THRE correctly
  * mmc: at91_mci: don't use coherent dma buffers
  * pid_ns: zap_pid_ns_processes: fix the ->child_reaper changing
  * pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits
  * cirrusfb: check_par fixes
  * devcgroup: fix race against rmdir()
  * mm: show quicklist usage in /proc/meminfo
  * mm: size of quicklists shouldn't be proportional to the number of CPUs
  * ipc: document the new auto_msgmni proc file
  * hp-wmi: update to match current rfkill semantics
  * hp-wmi: add proper hotkey support
  * tdfxfb: fix SDRAM memory size detection
  * tdfxfb: fix frame buffer name overrun
  * rtc_time_to_tm: fix signed/unsigned arithmetic
  * ibft: fix target info parsing in ibft module
  * sysfs: document files in /sys/firmware/sgi_uv/
  * rtc-cmos: wake again from S5
  * pm_qos_requirement might sleep
  * drivers/char/random.c: fix a race which can lead to a bogus BUG()
  * ipsec: Fix deadlock in xfrm_state management.
  * [x86] Fix TSC calibration issues
  * tipc: Don't use structure names which easily globally conflict.
  * sparc64: Fix IPI call locking.
  * [ARM] omap: fix gpio.c build error
  * sparc64: Prevent sparc64 from invoking irq handlers on offline CPUs
  * powerpc: Fix uninitialised variable in VSX alignment code
  * powerpc: Only make kernel text pages of linear mapping executable
  * powerpc: Make sure _etext is after all kernel text
  * powerpc: Work around gcc's -fno-omit-frame-pointer bug
  * powerpc: Fix build error with 64K pages and !hugetlbfs
  * powerpc: Fix for getting CPU number in power_save_ppc32_restore()
  * UBIFS: amend f_fsid
  * net/usb/pegasus: avoid hundreds of diagnostics
  * ixgbe: initialize interrupt throttle rate
  * pcnet-cs, axnet_cs: add new IDs, remove dup ID with less info
  * netxen: Remove workaround for chipset quirk
  * Split up PIT part of TSC calibration from native_calibrate_tsc
  * iwlwifi: W/A for the TSF correction in IBSS
  * iwlwifi: fix hidden ssid discovery in passive channels
  * iwlwifi: remove false rxon if rx chain changes
  * iwlwifi: fix station mimo power save values
  * iwlwifi: fix rx_chain computation
  * iwlwifi: fix Tx cmd memory allocation failure handling
  * iwlwifi: call apm stop on exit
  * iwlwifi: fix STATUS_EXIT_PENDING is not set on pci_remove
  * ath9k: Fix TX status reporting
  * ath9k: Fix TX control flag use for no ACK and RTS/CTS
  * V4L/DVB (8555): au8522: add mechanism to configure IF frequency for vsb
    and qam
  * V4L/DVB (8556): au0828: add support for Hauppauge Woodbury
  * V4L/DVB (8598): au8522: clean up function au8522_set_if
  * V4L/DVB (8599): au8522: remove if frequency settings from vsb/qam
    modulation tables
  * V4L/DVB (8600): au0828: explicitly set 6 MHz IF frequency in
    hauppauge_hvr950q_config
  * V4L/DVB (8629): v4l2-ioctl: do not try to handle private V4L1 ioctls
  * V4L/DVB (8633): ivtv: update ivtv version number
  * V4L/DVB (8648): ivtv: improve CC support
  * V4L/DVB (8660): gspca: Simplify the scan of URB packets in pac7311.
  * V4L/DVB (8661): gspca: Bug in the previous changeset about pac7311.
  * V4L/DVB (8663): gspca: Webcam 0c45:6128 added in sonixj.
  * V4L/DVB (8664): gspca: The bridge/sensor of the webcam 093a:2621 is a
    PAC 7302.
  * V4L/DVB (8665): gspca: Fix the 640x480 resolution of the webcam
    093a:2621.
  * V4L/DVB (8666): gspca: Bad scanning of frames in pac7311.
  * V4L/DVB (8667): gspca: Bad probe of Z-Star/Vimicro webcams with pas106
    sensor.
  * V4L/DVB (8668): gspca: Conflict GSPCA / ET61X251 for the webcam
    102c:6251.
  * V4L/DVB (8669): gspca: Add white balance control for spca561 rev 012A.
  * V4L/DVB (8671): gspca: Remove the unused field 'dev_name' of the device
    structure.
  * V4L/DVB (8672): gspca: Big rewrite of spca561.
  * V4L/DVB (8673): gspca: Bad frame scanning again and bad init in
    pac7311.
  * V4L/DVB (8674): gspca: Webcam 0c45:612e added in sonixj.
  * V4L/DVB (8675): gspca: Pixmap PJPG (Pixart 73xx JPEG) added, generated
    by pac7311.
  * V4L/DVB (8678): Remove the dead CONFIG_RADIO_MIROPCM20{,_RDS} code
  * V4L/DVB (8681): v4l2-ioctl.c: fix warning
  * V4L/DVB (8682): V4L: fix return value of register video func
  * V4L/DVB (8701): cx18: Add missing lock for when the irq handler
    manipulates the queues
  * V4L/DVB (8703): gspca: Do controls work for spca561 revision 12a.
  * V4L/DVB (8705): gspca: Adjust some control limits in spca561.
  * V4L/DVB (8706): Make contrast and brightness work for pac7302.
  * V4L/DVB (8707): gspca: Colors, hflip and vflip controls added for
    pac7302.
  * V4L/DVB (8709): gspca: Fix initialization and controls of sn9x110 -
    ov7630.
  * V4L/DVB (8710): gspca: Bad color control in sonixj.
  * V4L/DVB (8711): gspca: Bad controls and quantization table of pac7311.
  * V4L/DVB (8712): gspca: Bad start of sonixj webcams since changeset
    a8779025e7e8.
  * V4L/DVB (8713): gspca: Bad color control again in sonixj.
  * V4L/DVB (8714): gspca: Bad start of sn9c110 and sensor om6802.
  * V4L/DVB (8715): gspca: Change the name of some webcam in the gspca doc.
  * V4L/DVB (8716): gspca: Bad start of sn9c110 and sensor ov7630.
  * V4L/DVB (8717): gspca: Frame buffer too small for small resolutions
    (sonixj and t613).
  * V4L/DVB (8718): gspca: suspend/resume added.
  * V4L/DVB (8719): gspca: Have VIDIOC_QUERYCTRL more compliant to the
    spec.
  * V4L/DVB (8720): gspca: V4L2_CAP_SENSOR_UPSIDE_DOWN added as a cap for
    some webcams.
  * V4L/DVB (8722): sms1xxx: fix typo in license header
  * V4L/DVB (8726): link tuner before saa7134
  * V4L/DVB (8727): V4L1: make PMS not autoprobe when builtin.
  * V4L/DVB (8728): 1-make-pms-not-autoprobe-when-builtin update
  * V4L/DVB (8749): Fix error code, when camera is not turned on by sonypi
  * V4L/DVB (8750): V4L: check inval in video_register_device_index()
  * V4L/DVB (8751): vivi: Fix some issues at vivi register routine
  * V4L/DVB (8757): v4l-dvb: fix a bunch of sparse warnings
  * V4L/DVB (8769): cx18: Simplify queue flush logic to prevent oops in
    cx18_flush_queues()
  * V4L/DVB (8778): radio: fix incorrect video_register_device result check
  * V4L/DVB (8779): v4l: fix more incorrect video_register_device result
    checks
  * V4L/DVB (8790): saa7115: call i2c_set_clientdata only when state !=
    NULL
  * V4L/DVB (8803): s5h1409: Enable QAM_AUTO mode
  * V4L/DVB (8804): s5h1411: Enable QAM_AUTO mode
  * V4L/DVB (8805): Steven Toth email address change
  * V4L/DVB (8809): gspca: Revert commit
    9a9335776548d01525141c6e8f0c12e86bbde982
  * V4L/DVB (8810): gspca: Compile error when CONFIG_PM not defined.
  * V4L/DVB (8812): gspca: Do pac73xx webcams work.
  * V4L/DVB (8813): gspca: Adjust SOF detection for pac73xx.
  * V4L/DVB (8814): gspca: Set DISABLED the disabled controls at query
    control time.
  * V4L/DVB (8815): gspca: Fix problems with disabled controls.
  * V4L/DVB (8816): gspca: Set disabled ctrls and fix a register pb with
    ovxxxx in sonixb.
  * V4L/DVB (8817): gspca: LED and proble changes in sonixb.
  * V4L/DVB (8818): gspca: Reinitialize the device on resume.
  * V4L/DVB (8819): gspca: Initialize the ov519 at open time and source
    cleanup.
  * V4L/DVB (8820): gspca: Change initialization and gamma of zc3xx -
    pas106.
  * V4L/DVB (8822): gspca: Change some subdriver functions for
    suspend/resume.
  * V4L/DVB (8823): gspca: H and V flips work for ov7670 only in ov519.
  * V4L/DVB (8824): gspca: Too much code removed in the suspend/resume
    changeset.
  * V4L/DVB (8825): gspca: More controls for pac73xx and new webcam
    093a:2624.
  * V4L/DVB (8826): gspca: Webcam Labtec 2200 (093a:2626) added in pac7311.
  * V4L/DVB (8827): gspca: Stop pac7302 autogain oscillation.
  * V4L/DVB (8828): gspca: Set the clock at the end of initialization in
    sonixj.
  * V4L/DVB (8829): gspca: Have a clean kmalloc-ated buffer for USB
    exchanges.
  * V4L/DVB (8830): gspca: Move some probe code to the new init function.
  * V4L/DVB (8831): gspca: Resolve webcam conflicts between some drivers.
  * V4L/DVB (8832): gspca: Bad pixelformat of vc0321 webcams.
  * V4L/DVB (8833): gspca: Cleanup the sonixb code.
  * V4L/DVB (8834): gspca: Have a bigger buffer for sn9c10x compressed
    images.
  * V4L/DVB (8835): gspca: Same pixfmt as the sn9c102 driver and raw Bayer
    added in sonixb.
  * V4L/DVB (8837): dvb: fix I2C adapters name size
  * V4L/DVB (8839): dib0700: add comment to identify 35th USB id pair
  * V4L/DVB (8840): dib0700: add basic support for Hauppauge Nova-TD-500
    (84xxx)
  * V4L/DVB (8842): vivi_release(): fix use-after-free
  * V4L/DVB (8843): tda10048_firmware_upload(): fix a memory leak
  * V4L/DVB (8844): dabusb_fpga_download(): fix a memory leak
  * bnx2x: Accessing un-mapped page
  * SELinux: memory leak in security_context_to_sid_core
  * x86: add io delay quirk for Presario F700
  * mmap: fix petty bug in anonymous shared mmap offset handling
  * x86: Change warning message in TSC calibration.
  * PCI: fix pbus_size_mem() resource alignment for CardBus controllers
  * [ARM] omap: fix build error in ohci-omap.c
  * [ARM] remove unused #include <version.h>
  * ACPI: Make Len Brown the ACPI maintainer again
  * fujitsu-laptop: fix regression for P8010 in 2.6.27-rc
  * ACPI: Avoid bogus timeout about SMbus check
  * acer-wmi: remove debugfs entries upon unloading
  * forgotten refcount on sysctl root table
  * V4L/DVB (8868): gspca: Support for vga modes with sif sensors in
    sonixb.
  * V4L/DVB (8869): gspca: Move the Sonix webcams with TAS5110C1B from
    sn9c102 to gspca.
  * V4L/DVB (8870): gspca: Fix dark room problem with sonixb.
  * V4L/DVB (8872): gspca: Bad image format and offset with rev072a of
    spca561.
  * V4L/DVB (8873): gspca: Bad image offset with rev012a of spca561 and
    adjust exposure.
  * V4L/DVB (8874): gspca: Adjust hstart for sn9c103/ov7630 and update
    usb-id's.
  * [ARM] omap: fix virtual vs physical address space confusions
  * V4L/DVB (8876): budget: udelay changed to mdelay
  * V4L/DVB (8877): b2c2 and bt8xx: udelay to mdelay
  * V4L/DVB (8880): PATCH: Fix parents on some webcam drivers
  * V4L/DVB (8881): gspca: After 'while (retry--) {...}', retry will be -1
    but not 0.
  * powerpc/spufs: Fix multiple get_spu_context()
  * powerpc/spufs: Fix race for a free SPU
  * Input: bcm5974 - small formatting cleanup
  * Input: bcm5974 - improve finger tracking and counting
  * Input: bcm5974 - add BTN_TOUCH event for mousedev benefit
  * Input: i8042 - make Lenovo 3000 N100 blacklist entry more specific
  * sh: resume_kernel fix for kernel oops built with CONFIG_BKL_PREEMPT=y.
  * sh64: resume_kernel fix for kernel oops built with
    CONFIG_BKL_PREEMPT=y.
  * i2c: fix i2c-sh_mobile timing issues
  * clockevents: prevent clockevent event_handler ending up handler_noop
  * clockevents: prevent endless loop in periodic broadcast handler
  * clockevents: enforce reprogram in oneshot setup
  * clockevents: prevent multiple init/shutdown
  * clockevents: prevent endless loop lockup
  * HPET: make minimum reprogramming delta useful
  * [MTD] [NAND] tmio_nand: fix base address programming
  * Fix conditional export of kvh.h and a.out.h to userspace.
  * async_tx: fix the bug in async_tx_run_dependencies
  * sched_clock: fix NOHZ interaction
  * sched: fix process time monotonicity
  * UBIFS: fix division by zero
  * UBIFS: make minimum fanout 3
  * [MIPS] Fix data bus error recovery
  * [MIPS] Fix WARNING: at kernel/smp.c:290
  * [MIPS] TXx9: Fix txx9_pcode initialization
  * [MIPS] TX39xx: Add missing local_flush_icache_range initialization
  * [MIPS] Probe initrd header only if explicitly specified
  * res_counter: fix off-by-one bug in setting limit
  * forcedeth: fix kexec regression
  * atmel_lcdfb: fix oops in rmmod when framebuffer fails to register
  * tracehook: comment pasto fixes
  * drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
  * x86: boot: stub out unimplemented CPU feature words
  * x86: add NOPL as a synthetic CPU feature bit
  * x86: use X86_FEATURE_NOPL in alternatives
  * clockevents: broadcast fixup possible waiters
  * x86: HPET fix moronic 32/64bit thinko
  * x86: HPET: read back compare register before reading counter
  * Fix CONFIG_AC97_BUS dependency
  * [ARM] 5241/1: provide ioremap_wc()
  * ntp: fix calculation of the next jiffie to trigger RTC sync
  * clocksource, acpi_pm.c: use proper read function also in errata mode
  * clocksource, acpi_pm.c: check for monotonicity
  * x86: delay early cpu initialization until cpuid is done
  * x86: move mtrr cpu cap setting early in early_init_xxxx
  * sched: arch_reinit_sched_domains() must destroy domains to force
    rebuild
  * x86, xen: Use native_pte_flags instead of native_pte_val for .pte_flags
  * x86: pda_init(): fix memory leak when using CPU hotplug
  * x86: cpu_init(): fix memory leak when using CPU hotplug
  * powerpc/spufs: Fix possible scheduling of a context to multiple SPEs
  * netfilter: nf_conntrack_sip: de-static helper pointers
  * netfilter: nf_conntrack_gre: more locking around keymap list
  * netfilter: nf_conntrack_gre: nf_ct_gre_keymap_flush() fixlet
  * netfilter: nf_conntrack_irc: make sure string is terminated before
    calling simple_strtoul
  * pkt_sched: Fix qdisc state in net_tx_action()
  * powerpc: Fix rare boot build breakage
  * ahci, pata_marvell: play nicely together
  * sata_mv: add RocketRaid 1720 PCI ID to driver
  * ahci: disable PMP for marvell ahcis
  * sata_nv: disable hardreset for generic
  * libata-sff: kill spurious WARN_ON() in ata_hsm_move()
  * pata_sil680: remove duplicate pcim_enable_device
  * ahci: RAID mode SATA patch for Intel Ibex Peak DeviceIDs
  * [MIPS] IP22: Fix detection of second HPC3 on Challenge S
  * xen: fix 2.6.27-rc5 xen balloon driver warnings
  * x86: disable static NOPLs on 32 bits
  * netns : fix kernel panic in timewait socket destruction
  * bridge: don't allow setting hello time to zero
  * NFS: Restore missing hunk in NFS mount option parser
  * usb: fix null deferences in low level usb serial
  * Fix format of MAINTAINERS
  * sparc64: Disable timer interrupts in fixup_irqs().
  * [Bluetooth] Fix reference counting during ACL config stage
  * [Bluetooth] Enforce correct authentication requirements
  * [Bluetooth] Reject L2CAP connections on an insecure ACL link
  * [S390] CVE-2008-1514: prevent ptrace padding area read/write in 31-bit
    mode
  * [S390] cio: Correct cleanup on error.
  * [S390] cio: handle ssch() return codes correctly.
  * [S390] cio: allow offline processing for disconnected devices
  * ipsec: Restore larval states and socket policies in dump
  * update Documentation/filesystems/Locking for 2.6.27 changes
  * MAINTAINERS: add Atheros maintainer for atlx
  * lib: Correct printk %pF to work on all architectures
  * x86: fix memmap=exactmap boot argument
  * clockevents: remove WARN_ON which was used to gather information
  * ipv6: Fix OOPS in ip6_dst_lookup_tail().
  * Linux 2.6.27-rc6

 -- Ben Collins <email address hidden>   Tue, 02 Sep 2008 12:45:56 -0400