into nuts.ninka.net:/disk1/davem/BK/net-2.5

bad_flp_intr() in floppy.c can cause an Oops if the I/O request is freed
but <errors> still points into the I/O request block.  Get the error
count out of the request block before ending the IO.

bad_flp_intr() oopsen reports:

  Andrey: http://marc.theaimsgroup.com/?l=linux-kernel&m=105837886921297&w=2
  John:   http://marc.theaimsgroup.com/?l=linux-kernel&m=106303650007125&w=2
  Barry:  http://bugme.osdl.org/show_bug.cgi?id=1033

From: Felipe W Damasio <felipewd@terra.com.br>

Fix a few error-path leaks in the cciss block driver.  Bug found by smatch
checker.

make_pages_present() can fail: propagate that failure back.

Spotted by Bill Irwin.

From: Adrian Bunk <bunk@fs.tum.de>

Three drivers under drivers/char/ in 2.5.72 use TWO_ZERO for compatibility
code with ancient 2.0 kernels.  The patch below removes this #ifdef'd code.

From: Christoph Hellwig <hch@lst.de>

keeping init order the same..

From: Christoph Hellwig <hch@lst.de>

now that kdev_t is gone very few places needs this still, the only header
of those beeing fs.h

From: Nick Piggin <piggin@cyberone.com.au>

If a request is merged with another, it sometimes has to be repositioned on
the rbtree - you just do a delete then an add.  This is a quite uncommon
case though.

I changed the way adding works, so collisions must be handled by the caller
instead of being dumbly fixed by the add routine.  Unfortunately the
uncommon callers weren't handling it properly.

From: Ronald Bultje <rbultje@ronald.bitfreak.net>

the zoran kernel driver is called 'zoran.o' in its CVS (historical thing, I
don't know why), and it's called zr36067.o in the kernel tree.  The
documentation in the kernel tree refers to zoran.o, though, which is (in
the kernel tree) the driver for zr36120-based cards, rather than the driver
for zr360x7-based cards.

The attached patch fixes the documentation and makes it refer to
zr36067.o instead.

From: Anton Blanchard <anton@samba.org>

I saw a lockup where 2 cpus were stuck in sem_lock().  It seems like we can
loop back to retry_undos with the lock held.  That path takes the lock so
we will deadlock.

From: Anton Blanchard <anton@samba.org>

If init_new_context fails we definitely do not want to call mmput, because
that will call destroy_context against an uninitialised context.  Instead
we should back out what we did in init_mm.  Fixes some weird failures on
ppc64 when running a fork bomb.

This patch short-circuits all the direct-io page dirtying logic for
higher-order pages.  Without this, we pointlessly bounce BIOs up to keventd
all the time.

bio_dirty_fn() needs to drop its ref against each remaining page in the BIO
before releasing the BIO.

From: Nick Piggin <piggin@cyberone.com.au>

Fix fallout from Jens' insert_here removal.  Without it its possible that a
request on the dispatch list is on the merge hash as well which is bad.  I
don't _think_ this would happen in any code paths, but I haven't looked too
closely.  It makes the API a bit less fragile anyway.

From: James Cleverdon <jamesclv@us.ibm.com>

32-way IBM x445s will have I/O xAPICs with IDs greater than 0xF (0x8 to 0xE
isn't enough).  This breaks the code in setup_ioapic_ids_from_mpc.
However, the entire unique ID check is unnecessary.  Only I/O APICs using
the serial APIC bus need the unique numbers.  Those sending messages
through the system bus simply don't use them.

From: Corey Minyard <minyard@acm.org>

I was having a problem with signals with POSIX timers, and it turns out 
that the value of SIGRTMAX is incorrect.  Remember that there is no
signal 0, so the signals should go from 1-_NSIG.  However, SIGRTMAX is
defined as (_NSIG-1) in all architectures.  The following patch fixes this.

This define is only used in drivers/usb/core/devio.c and 
kernel/posix-timers.c, and both are incorrect without this fix.  There's
also no check for zero in posix-timers.c, that fix is part of the diff.

Also, shouldn't do_sigaction() use this value instead of _NSIG?  It's
not a big deal, but some architectures have different values for _NSIG
and SIGRTMAX.

From: Wagner_Volanin <fadinha.mail@terra.com.br>

I have an old Genius Colorpage-SP2 SCSI scanner.  It is shipped with a
MS-PNR 8bit ISA non-pnp proprietary SCSI card from Microtek.

Although its chipset is a NCR53c400a, it wouldn't work with the appropriate
driver, always accusing timeout, whatever settings I passed to it.

Today I messed a little with the NCR5380.c file in drivers/scsi which is
included by the g_NCR5380 driver and I couldn't understand one thing:

Why the function NCR5380_poll_politely() returned the value 'r' on success
if this value should be '0' case everything went ok...

So I changed "return r;" to "return 0;" and after that my scanner worked
fine, and was easily detected by SANE, without a single error message.  :)

I have not the time to delve into the problem further, but I wanted to
report this.  I couldn't find any counter-effects caused by changing these
return values.

(Acked by Alan)

From: john stultz <johnstul@us.ibm.com>

Since monotonic_clock() is not defined on every arch yet, this patch
insures the hangcheck-timer module (currently the only user of
monotonic-clock) is not built where it will not compile.

I know, I know. Ideally monotonic_clock() would be implemented on all
arches, but I've just not had the time.  If any of the non x86/x86-64
folks feel bored, drop me a line.  It'd be a fairly easy project.

From: Jonathan Corbet <corbet@lwn.net>

Nobody told me that the failure to export these (like their block
counterparts) was anything but an oversight; modules will not be able to
use larger device numbers without them.  So...this patch exports the new
char device functions.

From: Kristian Hogsberg <krh@bitplanet.net>

There's a small typo in scripts/postmod.c

From: Nick Piggin <piggin@cyberone.com.au>

This brings biodoc.txt a bit more up to date with recent elevator changes.

From Manfred

While trying to figure out why sysv msg is around 30% slower than pipes for
data transfers I noticed that gcc's autodetection (3.2.2) guesses the
"if(access_ok())" tests in uaccess.h wrong and puts the error memset into the
direct path and the copy out of line.

So tell the compiler that access_ok() is likely to be true.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The same info is already available in /proc/version.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The floppy driver currently can leave pending timers after unloading
itself.

This bug has a corresponding bugzilla entry at;

http://bugme.osdl.org/show_bug.cgi?id=1061

From: Krzysztof Halasa <khc@pm.waw.pl>

This is a driver for SBE Inc.  wanXL 4-port sync serial card, second
version.

From: James Cleverdon <jamesclv@us.ibm.com>

In forthcoming IBM x445 systems, the physical APIC ID will not follow the
simple rule laid out by Intel and encoded into xapic_phys_to_log_apicid.
(The BIOS code that sets IDs doesn't work right above 16 CPUs if HT is turned 
on, so for > 16-way the BIOS will disable HT and repack the physical CPUs
into APIC clusters.)

Anyway, it's a good idea to make the APIC code more independent of any
particular BIOS numbering scheme.  This patch allocates logical IDs based on
how many CPUs have already been onlined in a particular APIC cluster.

From: Patrick Mochel <mochel@osdl.org>

Two drivers are #including the same .c file.  Use them both and we get a
sysfs naming clash.

From: Erik Andersen <andersen@codepoet.org>

When someone specifies "init=" to select an alternative binary to run
instead of /sbin/init, argv[0] is not set correctly.  This is a problem for
programs such as busybox that multiplex applications based on the value of
argv[0].  For example, even if you specify init=/bin/sh" on the kernel
command line, busybox will still receive "/sbin/init" as argv[0] and will
therefore run init rather than /bin/sh...

From: Matthew Wilcox <willy@debian.org>

This patch fixes a memory leak in the file locking code.  Each attempt to
unlock a file would result in the leak of a file lock.  Many thanks to
Martin Josefsson for providing the testcase which enabled me to figure out
the problem.

From: "Krishnakumar. R" <krishnakumar@naturesoft.net>

A missing schedule_task -> schedule_work conversion.

From: Adrian Bunk <bunk@fs.tum.de>

sound/oss/Kconfig in 2.6.0-test5 includes two SOUND_RME96XX entries.

From: Oleg Drokin <green@namesys.com>

This patch adds more consistency checks to reiserfs (check that transaction
is not bigger than journal, check that we reply blocks not beyond fs and
check that fs fits the block device).  Similar patch was included into 2.4
some time ago.

- Remove dead declaration from elevator.h (Nick Piggin)

- Fix the scheduler selection boot-time message.  "Using anticipatory
  scheduling io scheduler" is not grammatical.

- Remove last use of __SMP__ (Randy Dunlap)

From: Dave Hansen <haveblue@us.ibm.com>

As described in this bug: http://bugme.osdl.org/show_bug.cgi?id=653 , if
you enable Summit support and NUMA Discontigmem support but boot on a
non-Summit box, the kernel will fail to boot.  The problem is that the
Summit code can not correctly get the NUMA memory configuration of a
flat box.  The code to do that is in get_memcfg_numa_flat(), but it
never gets called.

This patch implements a fallback to the generic NUMA code in
get_memcfg_numa_flat() if the Summit detection fails.  The patch also
adds the necessary bits to the Summit code so that it *knows* when it
fails.

From: William Lee Irwin III <wli@holomorphy.com>

any_online_cpu() is required to and with cpu_online_map before
attempting to find an online cpu somewhere in the map; this patch adds
that logic to the implementation(s) of any_online_cpu().

From: Angus Sawyer <angus.sawyer@dsl.pipex.com>

The mwave driver requires [un]register_char from 8250.c
Make sure 8250.c gets compilied.

agp_setup() is unreferenced if it's a module.

Hopelessly out of date

From: Manfred Spraul <manfred@colorfullife.com>

The real memory allocation is usually larger than the actual object size:
either due to L1 cache line padding, or due to page padding with
CONFIG_DEBUG_PAGEALLOC.  Right now objects are placed to the beginning of
the real allocation, but to trigger bugs it's better to move objects to the
end of the real allocation: that way accesses behind the end of the
allocation have a larger chance of hitting the (unmapped) next page.  The
attached patch moves the objects to align them with the end of the real
allocation.

Actually it contains 4 seperate changes:

- Do not page-pad allocations that are <= SMP_CACHE_LINE_SIZE.  This
  crashes.  Right now the limit is hardcoded to 128 bytes, but sooner or
  later an arch will appear with 256 byte cache lines.

- cleanup: redzone bytes are not accessed with inline helper functions,
  instead of magic offsets scattered throughout slab.c

- main change: move objects to the end of the allocation - trivial after
  the cleanup.

- Print old redzone value if a redzone mismatch happens: This makes it
  simpler to figure out what happened [single bit error, wrong redzone
  code, overwritten]

might_sleep() can be triggered by either local interrupts being disabled or
by elevated preempt count.  Disambiguate them.