the size to "vsnprintf()".

That's a pretty clear case of overflow.

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

into kernel.bkbits.net:/home/davem/tg3-2.6

  http://bugzilla.kernel.org/show_bug.cgi?id=1766

into kernel.bkbits.net:/home/davem/tg3-2.6

sparc_do_fault assumes that pmd_val(*pmd) = pmd_val(*pmd_k) will
duplicate a PMD entry.  With large soft-PMDs this doesn't work.

Align the pkmap area on a 4MB region so that a single
large pagetable can be used.  Fixes random killing of
processes which used high memory.

This has been in -mm since 2.6.1-mm5

 - IDE can be used as module again (compiles and works),
   this fixes bugzilla bugs #576 and #1700
 - separate module for probing is no longer required
 - generic/default host driver is available as ide_generic module

This contains the build fixes by Adrian Bunk and Andrew Morton.

Thanks to Eric Brower for spotting this.

into nuts.davemloft.net:/disk1/davem/BK/sparc-2.6

From: Davin McCall <davmac@ozonline.com.au>

Set hwif->chipset to ide_forced if it was forced by kernel parameters.

Set hwif->chipset to ide_generic for hwifs controlled by generic IDE
code, so they wont be taken by setup_pci.c:ide_match_hwif().

Patch also fixes /proc/ide/ideX/model to report "generic" instead of
"(none)" for default hwifs.

This has been in -mm since 2.6.1-mm1.

You can't just cast cpumasks.  It doesn't compile if NR_CPUS is greater than
4 * BITS_PER_LONG.

into home.osdl.org:/home/torvalds/v2.5/linux

into nuts.davemloft.net:/disk1/davem/BK/sparc-2.6

This should fix some picky USB devices.

From Tom Rini <trini@kernel.crashing.org>

On the MBX the kernel made an assumption about where the MAC address would
be in the VPD (Vital Product Data).  However, the documentation for the
firmware (EPPC-Bug) describes the format of the VPD and makes no
guarrantees about the location of any VPD record.  It does however describe
the format of each record type and the MAC address record will be of type
'08' and of size 6.  This changes the code so that instead of assuming a
position, it searches for the record, which I assume is also what EPPC-Bug
does.

From: "H. Peter Anvin" <hpa@zytor.com>

Apparently, on x86-64, the stack isn't always aligned properly (16 bytes)
in the kernel at the moment.  This causes the RAID-6 code to crash the
system.  This patch is a workaround for that; the right thing is to muck
with the assembly entrypoints to enforce proper stack alignment.  However,
that's not anything I feel comfortable doing in an evening, especially
since I don't have a machine on which I can test the resulting kernels.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

SCLP console/tty fixes:

- Fix incorrect state change of SCLP_RUNNING flag in interrupt handler

- Suppress emission of empty buffers to prevent stack overflow

- Fix off by one error in sclp_write (used to return # of chars written + 1)

- Prevent sclp_tty_write_string from waiting in interrupt (during flush)

- Fix deadlock after TIOCSCLPSNL ioctl

- Fix sclp_tty_chars_in_buffer calculation

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 inline assembly bug-fixes:

- Add memory barriers to spinlocks, atomic variable functions and to
  test_and_{set,clear,change}_bit.

- Add "=m" and "m" contraints to tell gcc that the content of a variable
  is in fact used.

- Replace "+m" constraints by "=m" on the output and "m" on the input list.

- Use c-implemtation for ffz and __ffs.

- Use generic c-implemtation for ffs and fls.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 general update:

- Add archhelp for "make image".

- 32-bit execve fix.

- Export some symbols: sys_ioctl, put_files_struct & ccw_device_work.

- Minor cleanups in arch/s390/mm/init.c & drivers/s390/net/ctctty.c.

From: David Gibson <david@gibson.dropbear.id.au>

These are some trivial cleanups to the hugepage ppc64 support

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

The current SLB handling code has a number of problems:

- We loop trying to find an empty SLB entry before deciding to cast one
  out.  On large working sets this really hurts since the SLB is always full
  and we end up looping through all 64 entries unnecessarily.

- During castout we currently invalidate the entry we are replacing.  This
  is to avoid a nasty race where the entry is in the ERAT but not the SLB and
  another cpu does a tlbie that removes the ERAT at a critical point.  If
  this race is fixed the SLB can be removed.

- The SLB prefault code doesnt work properly

The following patch addresses all the above concerns and adds some more
optimisations:

- feature nop out some segment table only code

- slb invalidate the kernel segment on context switch (avoids us having to
  slb invalidate at each cast out)

- optimise flush on context switch, the lazy tlb stuff avoids it being
  called when going from userspace to kernel thread, but it gets called when
  going to kernel thread to userspace.  In many cases we are returning to the
  same userspace task, we now check for this and avoid the flush

- use the optimised POWER4 mtcrf where possible

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

Lets make a decent attempt to find out where your console is.  The new
preferred_console stuff is pretty nice.

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

Small obvious fix to ppc32_timer_create.  Since sys_timer_create access
structures we pass on the stack, we need set_fs(KERNEL_DS).

From: Anton Blanchard <anton@samba.org>

- nop out proc_device_tree_add_node if CONFIG_PROC_DEVICETREE=n

- stubs for procfs-related functions when CONFIG_PROC_DEVICETREE=n

From: Anton Blanchard <anton@samba.org>

Add lparcfg_write() for changing SPLPAR system parameters

From: Anton Blanchard <anton@samba.org>

add missing include guards, from Nathan Lynch