From: "Chen, Kenneth W" <kenneth.w.chen@intel.com>

We hit a memory ordering race condition on AIO ring buffer tail pointer
between function aio_complete() and aio_read_evt().

What happens is that on an architecture that has a relaxed memory ordering
model like IPF(ia64), explicit memory barrier is required in a SMP
execution environment.  Considering the following case:

1 CPU is executing a tight loop of aio_read_evt.  It is pulling event off
the ring buffer.  During that loop, another CPU is executing aio_complete()
where it is putting event into the ring buffer and then update the tail
pointer.  However, due to relaxed memory ordering model, the tail pointer
can be visible before the actual event is being updated.  So the other CPU
sees the updated tail pointer but picks up a staled event data.

A memory barrier is required in this case between the event data and tail
pointer update.  Same is true for the head pointer but the window of the
race condition is nil.  For function correctness, it is fixed here as well.

By the way, this bug is fixed in the major distributor's kernel on 2.4.x
kernel series for a while, but somehow hasn't been propagated to 2.5 kernel
yet.

From: "Chen, Kenneth W" <kenneth.w.chen@intel.com>

We hit this bug when we have the following scenario:

One process initializes an AIO context and then forks out many child
processes.  When those child processes exit, many BUG checks
(effectively kernel oops) were triggered from put_ioctx(ctx) in function
exit_aio().

The issue was that the AIO context was incorrectly copied upon forking
and mislead all child processes to think they have an IO context and
trying to free it where they really don't own.  The following patch fix
the issue.

From: Andreas Gruenbacher <agruen@suse.de>

Without acls, when creating files the umask is applied directly in the vfs.
ACLs require that the umask is applied at the file system level, depending on
whether or not the containing directory has a default acl.  The daemonize()
function makes kernel threads share their fs_struct structure with the init
process.  Among other things, fs_struct contains the umask, so all kernel
threads share their umask with init.

The kernel nfsd needs to create files with a umask of 0.  Init's umask cannot
simply be changed to 0 --- this would have side effects on init, and init
would have side effects on nfsd.  So this patch recreates a fs_struct
structure for nfsd kernel threads, and sets its umask to 0.

This fixes bug #721, <http://www.osdl.net/show_bug.cgi?id=721>.

- remove accidental debug code from ext3 commit.

- /proc/profile documentation fix (Randy Dunlap)

- use sb_breadahead() in ext2_preread_inode()

- unused var in mpage_writepages()

From: Diego Calleja Garcia <diegocg@teleline.es>

Move CONFIG_KALLSYMS out of the arch directory and into init/.

It defaults to "on" unless the user explicitly turns it off in the
"embedded systems" menu.

replace a kmap() with kmap_atomic()

From: Daniel McNeil <daniel@osdl.org>

This adds i_seqcount to the inode structure and then uses i_size_read() and
i_size_write() to provide atomic access to i_size.  This is a port of
Andrea Arcangeli's i_size atomic access patch from 2.4.  This only uses the
generic reader/writer consistent mechanism.

Before:
mnm:/usr/src/25> size vmlinux
   text    data     bss     dec     hex filename
2229582 1027683  162436 3419701  342e35 vmlinux

After:
mnm:/usr/src/25> size vmlinux
   text    data     bss     dec     hex filename
2225642 1027655  162436 3415733  341eb5 vmlinux

3.9k more text, a lot of it fastpath :(

It's a very minor bug, and the fix has a fairly non-minor cost.  The most
compelling reason for fixing this is that writepage() checks i_size.  If it
sees a transient value it may decide that page is outside i_size and will
refuse to write it.  Lost user data.

From: Daniel McNeil <daniel@osdl.org>

This adds a sequence counter only version of the reader/writer consistent
mechanism to seqlock.h This is used in the second part of this patch give
atomic access to i_size.

From: Tim Schmielau <tim@physik3.uni-rostock.de>

This patch adds (or fixes) initialization of wall_to_monotonic for a few
more architectures.

This should get rid of the strange uptime>14600 days reports, except on arm
whose arch file layout is too unfamiliar to me.

The patch is blessed by George Anzinger, but untested due to lack of
hardware.

From: Oleg Drokin <green@namesys.com>

From the time of reiserfs_file_write inclusion all 64bit arches were not
able to work with reiserfs for pretty stupid reason (incorrect "unsigned
long" definition of blocknumber type).

This fixes the problem.

The ClearPageDirty() in there is wrong - it doesn't adjust the VM's dirty
memory accounting.  The system thinks it's full of dirty memory and stops.

From: Christoph Hellwig <hch@lst.de>

It's not used anymore since ALSA switched to traditional devices and device
nodes in procfs are a bad idea in general..

Also update the docs.

From: rwhron@earthlink.net

It returns sizeof(compat_ulong_t) even if put_user() faulted.

(version 1.8.0 -> 1.9.0)

(version 2.3.0 -> 2.4.0)

(version 1.2.1 to 1.3.0)

into home.osdl.org:/home/torvalds/v2.5/linux

Update gsc_ps2 for recent changes.

Add two PA-RISC sysctls.

PA-RISC doesn't have PCI<->EISA bridges (they're all GSC<->EISA).

parisc64 machines should build parisc kernels.

arch/parisc, drivers/parisc and include/asm-parisc updates:

 - Fixups for struct timespec changes (James Bottomley)
 - Add CONFIG_FRAME_POINTER (Thibaut Varene)
 - Fix hpux ustat emulation (Helge Deller)
 - Add a ->remove operation to struct parisc_device (James Bottomley)
 - More work on modules (James Bottomley)
 - More unaligned instructions handled (LaMont Jones)
 - Fix byteswap assembly (Grant Grundler)
 - Allow ISA support to be selected (Matthew Wilcox)
 - Fix swapping (James Bottomley)

util-linux is waiting for this: it needs to update "struct loop_info64"
to add the encryption policy name.

via-agp.c has the agp_try_unsupported test reverted

full range of an "unsigned long" (sparc64).

into home.osdl.org:/home/torvalds/v2.5/linux

tokenring drivers.

i think we want fast_poll to behave the same with HZ=100 and HZ=1000

following patch fixes some bogus additions to jiffies (w/o HZ beeing involved)
- appletalk/cops.c
- appletalk/ltpc.c
- declance.c
- sb1250-mac.c
- sk_mca.c
- via-rhine.c
against 2.5.73-bk

Below patch cleans the mkiss driver.  After the previous cleanup in
2.4.0-prerelease various code had become unreachable because nothing
was ever setting MKISS_DRIVER_MAGIC.  This fixes fixes an oops - the
mkiss pointer was potencially NULL.  And it also removes the
MOD_{INC,DEC}_USE_COUNT calls.

Alan, lemme know if you want me to cook a 2.4 patch also.

Patch from Jeroen Vreeken PE1RXQ.

Ralf

This converts the parallel network driver to use alloc_netdev instead
of doing it's own allocation.

Tested (load/unload) on 2.5.74

* Allow changing Wake On LAN when EEPROM disabled
* Change Log updated
* Version changed

* Bug fix: 82557 (with National PHY) timeout during init
  [Adam Kropelin] akropel1@rochester.rr.com