From: Maneesh Soni <maneesh@in.ibm.com>

The patch fixes locking in proc_check_root().  It brings is_subdir() call
under vfsmount_lock.  Holding vfsmount_lock will ensure mnt_mountpoint
dentry is intact and the dentry does not go away while it is being checked
in is_subdir().

From: Maneesh Soni <maneesh@in.ibm.com>

o The following patch fixes is_subdir() races with d_move. Due to concurrent
  d_move, in is_subdir() we can end up accessing freed d_parent pointer in
  case of pre-emptible kernel. To avoid this we can use rcu_read_lock() and
  rcu_read_unlock().

o This also fixes the seqlock uses in is_subdir() as we need to restart the
  the inner loop with the origianl new_dentry passed to the routine in case
  of any rename occured while we are traversing d_parent links.

From: Andrew Zabolotny <zap@homelink.ru>

ac97_unregister_driver() is nulling out the ->driver field for all codecs.
It should only null the codecs which are using this driver.

From: Pratik Solanki <pratik.solanki@timesys.com>

I came across this C standards issue while cross-compiling the Linux kernel
with gcc on Solaris.  The file gen_crc32table.c uses the non-standard type
u_int32_t.  It's possible that the host machine's sys/types.h does not
define u_int32_t.  The attached patch replaces u_int32_t with the POSIX
standard uint32_t and includes POSIX inttypes.h instead of sys/types.h.

From: Bjorn Helgaas <bjorn.helgaas@hp.com>
      Anders Gustafsson <andersg@0x63.nu>
      Roman Zippel <zippel@linux-m68k.org>

This patch fixes menuconfig so it can display help text for individual
choice group config entries.

Previously it would only display the help text attached to the "choice"
item.  There was no way to display the help attached to individual config
entries inside the choice group.  Typically, the "choice" item has no help
text, and all the useful help is attached to the individual entries, so
this was a bit of a problem.

From: George Anzinger <george@mvista.com>,
      Petri Kaukasoina <kaukasoi@elektroni.ee.tut.fi>

btime in /proc/stat does not stay constant but decreases at a rate of 15
secs/day, because we're assuming that HZ is exactly 100.  Use the correct
adjustments to fix that up.

From: George Anzinger <george@mvista.com>

The time conversion code is erroring on the side of a bit too small.  The
attached patch forces any error to be on the high side.  The current code will
convert 1 nanosecond to zero jiffies (standard says that should be 1).  It also
is around 1 nanosecond late on each roll to the next jiffie.

I have done some error checks with this patch applied and get the following
errors in PPB ( Parts Per Billion):

HZ     nano sec conversion     microsecond conversion
1000    315                      45
1024    227                      40
100     28                       317

In all cases the error is on the high side, which means that the final shift
will, most likely, eliminate the error bits.

From: GOTO Masanori <gotom@debian.or.jp>

Teach ufs_fill_super() to honour the `silent' parameter.

reiserfs places its superblock in weird places which can result in false
positives and various printks when other filesystems probe a resierfs
filesystem.

From: Mike Waychison <Michael.Waychison@Sun.COM>

The attached patch ensures that we grab vfsmount_lock when grabbing a
reference to mnt_parent in follow_up and follow_dotdot.

We also don't need to access ->mnt_parent in follow_mount and
__follow_down to mntput because we already the parent pointer on the stack.

From: Mike Waychison <Michael.Waychison@Sun.COM>

- protect vfsmount->mnt_parent by taking vfsmount_lock in __d_path

From: "Randy.Dunlap" <rddunlap@osdl.org>
      Leann Ogasawara <ogasawara@osdl.org>

Patch inserts missing iounmap() on error.

From: "Randy.Dunlap" <rddunlap@osdl.org>

From: Leann Ogasawara <ogasawara@osdl.org>

Patch inserts missing iounmap's on error and also removes unnecessary
iounmap's.

From: Marcus Alanen <maalanen@ra.abo.fi>

The copy_tree() function can return NULL, so this checks for it.

From: Philippe Elie <phil.el@wanadoo.fr>

Unless I miss something this look like a typo, one user reported to get
error from the daemon: 'Unknown event for counter 1' (alpha ev6) and the
behavior was better but not completly sane after trying this patch: he get
spurious event for counter 1 when enabling only counter 0 but rarely now.
No alpha box to test this.

From: Philippe Elie <phil.el@wanadoo.fr>

In a ring buffer controlled by a read and write positions we can't use
buffer_size but only buffer_size - 1 entry, the last free entry act as a
guard to avoid write pos overrun.  This bug was hidden because the writer,
oprofile_add_sample(), request one more entry than really needed.

From: Sam Ravnborg <sam@ravnborg.org>,
      Ben Collins <bcollins@debian.org>

Fix up the console makefiles and logo generation.

1) To make output look like the rest of the kernel build.

2) To avoid make utilising chained rules, and therefore issuing a 'rm
   drivers/video/logo/linux_logo.c ...' during the build.

I have previously submitted a few patches for logo/Makefile, but this is the
first one that actually address the problems I have seen in a proper way.

And no, I did not like such a simple thing to look that complicated, the
other option was to list too many files or to use other types of kbuild/make
magic.

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      "Maciej Soltysiak" <solt@dns.toxicfilms.tv>

C99 initializers for linux/sound.

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      Domen Puncer <domen@coderock.org>

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      Domen Puncer <domen@coderock.org>

Noone tested that code to see if it really works?

From: Jamie Lokier <jamie@shareable.org>

One of the tests in unqueue_me() is redundant.  If we acquire the spinlock,
the futex must be queued.

From: James Morris <jmorris@redhat.com>

Here's a patch which zeroes the last byte of the mount option data copied
from userspace during mount(2).

For filesystems which parse mount options as strings (the majority), lack
of a zero terminator could cause the page to be overrun.  The source code
comments specify that the maximum size of the mount data is PAGE_SIZE-1, so
this patch will not affect any valid binary-formatted mount data.

From: George Anzinger <george@mvista.com>

- Removes C++ comment in favor of C style.

- Removes the special treatment for MIPS SIGEV values.  We only require
  (and error if this fails) that the SIGEV_THREAD_ID value not share bits
  with the other SIGEV values.  Note that mips has yet to define this value
  so when they do...

- Corrects the check for the signal range to be from 1 to SIGRTMAX
  inclusive.

- Adds a check to verify that kmem_cache_alloc() actually returned a timer,
  error if not.

- Fixes a bug in timer_gettime() where the incorrect value was returned if
  a signal was pending on the timer OR the timer was a SIGEV_NONE timer.

From: timothy parkinson <t@timothyparkinson.com>

Seems like a lot of people see the below error message, but aren't quite
sure why it happens or how to fix it.  I sure didn't.  Here's my attempt at
remedying that.

From: Sam Ravnborg <sam@ravnborg.org>

During raid6 compilation with KBUILD_VERBOSE unset we see invokations of
perl commands which should not have been displayed.

From: "Martin J. Bligh" <mbligh@aracnet.com>

This patch removes memblks from the kernel ...  we don't use them, and the
NUMA API that was planning to use them when they were originally designed
isn't going to use them anymore.  They're just unnecessary added complexity
now ...  time for them to go.

There's a slight complication in that ia64 uses something with a similar
name for part of its memory layout, but Jes Sorensen kindly untangled them
from each other for us.  The patch with his modifications is below.  Jes
tested it on ia64, and I testbuilt it with every config in my arsenal.

From: Andrey Panin <pazke@donpac.ru>

support for SIIG made serial/parallel conbo cards was moved to
parport_serial driver some months ago, but their PCI ids still remain in
parport_pc PCI device table.  Attached patch removes them.

From: Neil Brown <neilb@cse.unsw.edu.au>

If programs like mount use /proc/partitions to find filesystems based on
labels, then surely we want md devices in there as they often contain
filesystems.

If the problem is that mount-by-label takes forever with removable media
then surely the "right" approch is the following patch, and then actually
set this flag on the "floppy.c" device.  (It is already set for ide-floppy
and sd devices).

From: NeilBrown <neilb@cse.unsw.edu.au>

Instead of using ("md%d", mdidx(mddev)), we now use ("%s", mdname(mddev))
where mdname is the disk_name field in the associated gendisk structure.
This allows future flexability in naming.

From: NeilBrown <neilb@cse.unsw.edu.au>

Update {read,write}{s,_sectors} on each request to an MD array.

From: NeilBrown <neilb@cse.unsw.edu.au>

This patch thanks to Paul Clements <Paul.Clements@SteelEye.com> and only has
effect if md is compiled with #define DEBUG 1

From: NeilBrown <neilb@cse.unsw.edu.au>

A RAID superblock can indicate which minor number the array should be
assembled under.  As this is only meaningful when doing auto-start, we move
the test for it being in the valid range to the place where auto-start
happens.  When an array is started any other way, it doesn't matter what
value is here.

From: viro@parcelfarce.linux.theplanet.co.uk

bernhard_heibler@gmx.de has discovered that NFS is very slow when writing to
a file which has execute permissions.  See

	http://bugme.osdl.org/show_bug.cgi?id=1936

This patch fixes remove_suid() to not try to modify the inode mode on every
write to such a file.

From: Petr Vandrovec <vandrove@vc.cvut.cz>


Arjan van de Ven pointed out to me there are no checks on name component
lengths in ncpfs, so potentially 4KB regions could be allocated on stack,
leading to the user controlled stack overflow.

It was using variable-sized arrays, so this snuck past the static
stack-usage checking tools.

As NCP is limited to 255 bytes on components, we can simple limit these
local variables to 256 bytes, and after this stack usage looks more
acceptable.  Length checking occurs inside ncp_vol2io, during
iocharset->codepage conversion.

As a side effect support for multibyte codepages now works as it should,
instead of returning -EINVAL whenever filename in 'codepage' encoding was
longer than in 'iocharset'.

Other part fixes typo where atime change updated ctime and not atime field.

Fat chance, but we should try.

From: Anton Blanchard <anton@samba.org>

Some architectures use cpu_vm_mask to optimise TLB flushes.  On ppc64 we
are now using a common flush infrastructure that handles both userspace and
kernelspace (vmalloc) pages.  In order to avoid triggering this
optimisation we need to mark the init mm as having scheduled on all cpus.

Things currently work by luck (we check for the cpu only having run on the
local cpu, and the field is initialised to 0), but it would be safer to
initialise it CPU_MASK_ALL.

This driver is trying an order-9 allocation and if that fails, order 8, etc.
Crufty, but we do expect failures, so suppress the warnings.

From: William Lee Irwin III <wli@holomorphy.com>

->valid_addr_bitmap is initialized nowhere.  Any kern_addr_valid() testing
it returns 0 unconditionally.

This patch converts kern_addr_valid() implementations using it to return 0
as per the above and removes it from structures and zone initialization.
Untested (not even compiletested), though a similar patch also nuking
d_validate() was in use in -wli for several months.

From: Nigel Cunningham <ncunningham@users.sourceforge.net>

Change the console code to support up to 256 (maybe 255?) columns.

From: John McKell <mckellj@iomega.com>

This 2.6.1 patch works by setting gendisk->policy to the correct value
during initialization as the various drivers decide whether or not the disk
is writeable.  This patch persuades "blockdev --getro ..." to correctly
report the read-only state of a newly inserted disk.  This patch applies to
sr.c, sd.c and ide-floppy.c.  ide-cd.c already has this functionality built
into it.

Using an Iomega Zip drive as the test case...

Without the patch, I always see:

$ sudo blockdev --getro /dev/sda
0
$

That's only correct for writeable disks though.  Only when the patch
is applied do I see a write-protected disk described correctly:

$ sudo blockdev --getro /dev/sda
1
$