Format string bug.  Not exploitable, as this is only writable by root,
but worth fixing all the same.
Spotted-by: Ilja van Sprundel <ilja@netric.org>
Signed-off-by: Dave Jones <davej@redhat.com>

In drivers/cpufreq/cpufreq.c the function cpufreq_add_dev() takes the
error exit 'err_out_unregister' from different places once with the
'cpu_policy_rwsem' lock held, once with the lock released:
|		if (ret)
|			goto err_out_unregister;
|	}
|
|	policy->governor = NULL; /* to assure that the starting sequence is
|				  * run in cpufreq_set_policy */
|
|	/* set default policy */
|	ret = __cpufreq_set_policy(policy, &new_policy);
|	policy->user_policy.policy = policy->policy;
|	policy->user_policy.governor = policy->governor;
|
|	unlock_policy_rwsem_write(cpu);
|
|	if (ret) {
|		dprintk("setting policy failed\n");
|		goto err_out_unregister;
|	}

This leads to the following error message in case of a failing
__cpufreq_set_policy() call:
=====================================
[ BUG: bad unlock balance detected! ]
-------------------------------------
swapper/1 is trying to release lock (&per_cpu(cpu_policy_rwsem, cpu)) at:
[<c01b4564>] unlock_policy_rwsem_write+0x30/0x40
but there are no more locks to release!

other info that might help us debug this:
1 lock held by swapper/1:
 #0:  (sysdev_drivers_lock){--..}, at: [<c018fd18>] sysdev_driver_register+0x74/0x130

stack backtrace:
[<c002f588>] (dump_stack+0x0/0x14) from [<c00692fc>] (print_unlock_inbalance_bug+0xc8/0x104)
[<c0069234>] (print_unlock_inbalance_bug+0x0/0x104) from [<c006b7ac>] (lock_release_non_nested+0xc4/0x19c)
 r6:00000028 r5:c3c1ab80 r4:c01b4564
[<c006b6e8>] (lock_release_non_nested+0x0/0x19c) from [<c006b9e0>] (lock_release+0x15c/0x18c)
 r8:60000013 r7:00000001 r6:c01b4564 r5:c0541bb4 r4:c3c1ab80
[<c006b884>] (lock_release+0x0/0x18c) from [<c0061ba0>] (up_write+0x24/0x30)
 r8:c0541b80 r7:00000000 r6:ffffffea r5:c3c34828 r4:c0541b8c
[<c0061b7c>] (up_write+0x0/0x30) from [<c01b4564>] (unlock_policy_rwsem_write+0x30/0x40)
 r4:c3c34884
[<c01b4534>] (unlock_policy_rwsem_write+0x0/0x40) from [<c01b4c40>] (cpufreq_add_dev+0x324/0x398)
[<c01b491c>] (cpufreq_add_dev+0x0/0x398) from [<c018fd64>] (sysdev_driver_register+0xc0/0x130)
[<c018fca4>] (sysdev_driver_register+0x0/0x130) from [<c01b3574>] (cpufreq_register_driver+0xbc/0x174)
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Signed-off-by: Dave Jones <davej@redhat.com>

Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
Signed-off-by: Dave Jones <davej@redhat.com>

sampling_down_factor was removed in ccb2fe20
back in June 2006.
Signed-off-by: Dave Jones <davej@redhat.com>

The longrun cpufreq module reports a false minimum frequency 3MHz on
300-600MHz Crusoe processor.  This may be due to a calculation bug
in the module.

Original patch from Kaz Sasayama <kazssym@hypercore.co.jp>
submitted as http://bugs.debian.org/468149 patch ported to x86

Cc: Kaz Sasayama <kazssym@hypercore.co.jp>
Signed-off-by: maximilian attems <max@stro.at>
Signed-off-by: Dave Jones <davej@redhat.com>

The most common error with powernow-k8 is an ACPI _PSS error
caused either by failure to load the ACPI processor module
or a bad parse of the _PSS object.  Make the error message
returned to the user in these situations more straightforward
and easier to understand.

-Mark Langsdorf
Operating System Research Center
AMD
Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>
Signed-off-by: Andreas Herrmann <andreas.herrmann3@amd.com>
Signed-off-by: Dave Jones <davej@redhat.com>

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
  drm/i915: save and restore dsparb and d_state registers.
  drm/i915: fix off by one in VGA save/restore of AR & CR regs.
  drm: disable tasklets not IRQs when taking the drm lock spinlock
  Revert "drm/vbl rework: rework how the drm deals with vblank."

* git://git.kernel.org/pub/scm/linux/kernel/git/sam/kbuild-fixes:
  Don't clean bounds.h and asm-offsets.h
  kconfig: incorrect 'len' field initialisation ?
  kernel-doc: allow unnamed bit-fields
  kbuild: filter away debug symbols from kernel symbols
  Remove *.rej pattern from .gitignore
  MAINTAINERS: document names of new kbuild trees
  kbuild: disable modpost warnings for linkonce sections
  kbuild: escape meta characters in regular expression in make TAGS

Since 97965478 ("mm: Get rid of __ZONE_COUNT")
mmzone.h includes bounds.h.
Calling make clean after make prepare removes bounds.h
again so when building external modules this fails.
Signed-off-by: Jan Blunck <jblunck@suse.de>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
--

1) The field 'len' of the 'gstr' structure seems to track the size of the memory
already allocated for the "growable string". So the value of this field should be
the same as the 'malloc()' just above, shouldn't it ?
Signed-off-by: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>

Allow for unnamed bit-fields and skip them instead of printing an
erroneous warning message for them, such as:

Warning(include/asm-s390/cio.h:103): No description found for parameter 'u32'

which contains:

struct tm_scsw {
	u32 :1;
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>

Andi Kleen <andi@firstfloor.org>
reported that he saw a lot of symbols like this:

0000000000000b24 N DW.aio.h.903a6d92.2
0000000000000bce N DW.task_io_accounting.h.8d8de327.0
0000000000000bec N DW.hrtimer.h.c23659c6.0

in his System.map / kallsyms output.

Simple solution is to skip all debugging
symbols (they are marked 'N').
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Paulo Marques <pmarques@grupopie.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  snd-pcsp: silent misleading warning
  snd-pcsp: depend on CONFIG_EXPERIMENTAL
  snd-pcsp: put back the compatibility code for the older alsa-libs
  snd-pcsp: adjust help texts to frighten users

It appears that alsa allows a sound buffer with size not
evenly devided by the period size. This triggers a warning in
snd-pcsp and floods the log. As a quick fix, the warning should
be disabled.
Signed-off-by: Stas Sergeev <stsp@aknet.ru>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Considering all the feedbacks I got, depending snd-pcsp on
CONFIG_EXPERIMENTAL looks like the only safe way to get out
of all the troubles at one go. :)
Signed-off-by: Stas Sergeev <stsp@aknet.ru>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

The attached patch adds back the compatibility code, allowing the
driver to work with older alsa-libs.
The removal was premature, it breaks the real-life configs.
Signed-off-by: Stas Sergeev <stsp@aknet.ru>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Added the warning text to the help of snd-pcsp about the possible problem
with this driver so that user can know of the problem in advance.

Also, removed the obsoleted text about ancient pc-speaker patch in
CONFIG_SOUND help.
Signed-off-by: Stas Sergeev <stsp@aknet.ru>
Signed-off-by: Takashi Iwai <tiwai@suse.de>

* 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
  SUNRPC: AUTH_SYS "machine creds" shouldn't use negative valued uid/gid
  nfs: make nfs4_drop_state_owner() static
  nfs: path_{get,put}() cleanups
  nfs: replace remaining __FUNCTION__ occurrences
  nfs/lsm: make NFSv4 set LSM mount options
  NFSv4: Check the return value of decode_compound_hdr_arg()
  nfs: fix race in nfs_dirty_request
  NFS: Ensure that 'noac' and/or 'actimeo=0' turn off attribute caching

* 'i2c-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  i2c/max6875: Really prevent 24RF08 corruption
  i2c-amd756: Fix functionality flags
  i2c: Kill the old driver matching scheme
  i2c: Convert remaining new-style drivers to use module aliasing
  i2c: Switch pasemi to the new device/driver matching scheme
  i2c: Clean up Blackfin BF527 I2C device declarations
  i2c-nforce2: Disable the second SMBus channel on the DFI Lanparty NF4 Expert
  i2c: New co-maintainer

Add multi_defconfig, to build a kernel for all supported m68k platforms,
excluding Sun 3 (Sun 3 kernels are incompatible with all other m68k platforms)
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Update the m68k defconfigs
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

m68k: Correctly handle multi-ISA at runtime in multi-platform kernels
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The *_ISA type defines are quite generic and cause namespace conflicts
(e.g. with `AMIGAHW_DECLARE(GG2_ISA)' in <asm/amigahw.h>) for some kernel
configurations. Use ISA_TYPE_* to avoid such conflicts.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

UIO needs m68k_mmutype:

ERROR: "m68k_mmutype" [drivers/uio/uio.ko] undefined!

(noticed by Christian T. Steigies)
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Mark Q40/Q60 floppy support broken:

    arch/m68k/q40/q40ints.c: In function 'q40_irq_handler':
    arch/m68k/q40/q40ints.c:214: error: implicit declaration of function 'floppy_hardint'

Including <asm/floppy.h> doesn't help, as it causes a lot of additional error
messages (cfr. Sun 3x).
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

According to the tests in do_initcalls(), the proper error code in case no
device is found is -ENODEV, not -ENXIO or -EIO.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Some input drivers do not check whether they're actually running on the
correct platform, causing multi-platform kernels to crash if they are not.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Some network drivers do not check whether they're actually running on the
correct platform, causing multi-platform kernels to crash if they are not.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The Apollo frame buffer device driver (dnfb) doesn't check whether it's
actually running on Apollo hardware, causing a crash if it isn't.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The Macintosh IDE driver (macide) doesn't check whether it's actually running
on Mac hardware, causing a crash if it isn't.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When running a HP300-enabled kernel on non-HP300 hardware, a test in the early
startup code jumps to the wrong label, causing a double bus fault.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use `__builtin_trap()' instead of `asm volatile("illegal")' in the m68k BUG()
macros (as suggested by Andrew Pinski), to kill warnings in code that assumes
BUG() does not return.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

m68k vme_scc:
  - make scc_ports[] static
  - kill unused global scc_initialized
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The Hisoft Whippet PCMCIA serial driver has been removed a long time ago, but
it's Kconfig symbol still existed.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Correct FB_HP300 dependencies:
  - FB_HP300 doesn't depend only on HP300, but also on DIO (which depends on
    HP300)
  - FB_HP300 does not need FB_CFB_FILLRECT
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

CONFIG_FB_DAFB is a leftover from pre-Kconfig
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Convert access_ok() from a macro to an inline function, so the compiler no
longer complains about unused variables:

    fs/read_write.c: In function 'rw_copy_check_uvector':
    fs/read_write.c:556: warning: unused variable 'buf'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

i2c-core takes care of the possible corruption of 24RF08 chips for
quite some times, so device devices no longer need to do it. And they
really should not, as applying the prevention twice voids it.

I thought that I had fixed all drivers long ago but apparently I had
missed that one.
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Ben Gardner <bgardner@wabtec.com>

The i2c-amd756 driver pretends to support SMBus process call
transactions but actually does not. Fix it.
Signed-off-by: Jean Delvare <khali@linux-fr.org>