Signed-off-by: Michael Marineau <marineam@gentoo.org>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

With Suparna Bhattacharya <suparna@in.ibm.com>

I was running a random system call generator against mainline the other 
day and got this bug report about AIO in dmesg:

kernel BUG at fs/aio.c:1249!

Each ioctx structure has a "users" field that acts as a reference counter
for the ioctx, and a "dead" flag that seems to indicate that the ioctx
isn't associated with any particular list of IO requests.

The problem, then, lies in aio.c:1247.  The io_destroy function checks the
(old) value of the dead flag--if it's false (i.e.  the ioctx is alive),
then the function calls put_ioctx to decrease the reference count on the
assumption that the ioctx is no longer associated with any requests. 
Later, it calls put_ioctx again, on the assumption that someone called
lookup_ioctx to perform some operation at some point.

This BUG is caused by the reference counts being off.  The testcase that
I provided looks for a chunk of user memory that's read-only and passes
that to the sys_io_setup syscall.  sys_io_setup checks that the pointer
is readable, creates the ioctx and then tries to write the ioctx handle
back to userland.  This is where the problems start to surface.

Since the pointer points to a non-writable region of memory, the write
fails.  The syscall handler then destroys the ioctx.  The dead flag is
zero, so io_destroy calls put_ioctx...but wait!  Nobody ever put the ioctx
into a request list.  The ioctx is alive but not in a list, yet the
io_destroy code assumes that being alive implies being in a request list
somewhere.  Hence, calling put_ioctx is bogus; the reference count becomes
0, and the ioctx is freed.  Worse yet, put_ioctx is called again (on a
freed pointer!) to clear up the lookup_ioctx that never happened. 
put_ioctx sees that the reference count has become negative and BUGs.

Suparna's patch simply takes that additional ref so that io_destroy() will
dtrt.
Signed-off-by: Darrick Wong <djwong@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Here's an updated version of the pegasos support patch for ppc32, fixing a
typo in the previous one.  Driver patches to come soon.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Back out previous patch to ppc idle that handled CPU's that did not have
powersavings.  Ingo's fixes to cpu_rest, cause this fix to no longer be
needed.
Signed-off-by: Kumar Gala <kumar.gala@freescale.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It's not necessary to keep IRQs disabled after the BKL has been dropped.
In fact i think IRQ-disabling doesnt have to be done at all, the patch
below ought to solve this scenario equally well, and should solve the PPC
side-effects too.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix up signal_pending and timeout paths for wait_for_completion API
extensions.
Signed-off-by: Mike Waychison <michael.waychison@sun.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Some minor cleanups for audit_log_lost() messages.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When auditd is congested the kernel's audit system leaks skb's.  First, it
takes them off the audit_buffer sklist at which point they are lost,
second, it allocates a new skb with 0 length payload.  Then (likely still
congested), it repeats this losing the new skb.  Plug the leak by making
sure to requeue the skb, and avoid audit_log_move() on 0 len audit_buffer.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Need 'irq_affinity' array when CONFIG_PROC_FS=n.

With CONFIG_PROC_FS=n, the irq_affinity[NR_IRQS] array
is not available in arch/i386/kernel code:

arch/i386/kernel/built-in.o(.text+0x10037): In function `do_irq_balance':
: undefined reference to `irq_affinity'
arch/i386/kernel/built-in.o(.text+0x101a9): In function `do_irq_balance':
: undefined reference to `irq_affinity'
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix a subtle bug in error handling of ext2 xattrs.  When ext2_sync_inode()
fails because of ENOSPC (it could not write inode's dirty data) we want to
keep xattrs in a consistent state and release the old block properly.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Zwane reports an oops duie to add_entropy_words running off the top of the
stack reading its input.  The overrun is harmless until it causes a page
fault.

Looks like I introduced this bug in Aug 2003, but it was hard to trigger until
the recent changes.
Signed-off-by: Matt Mackall <mpm@selenic.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Looks like we fixed only part of the problem earlier.  When the child moves
away from ptrace notify and resets the last_siginfo, sighand lock helps.
But if the child goes further in exit and releases the sighand, we need to
test that case too.  See ptrace_check_attach() and exit_sighand().  They
also use the tasklist_lock.

Followed Roland's suggestions on lock primitive and struct assignment.
Signed-Off-by: Prasanna Meda <pmeda@akamai.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Looks like a cleanup broke the test vectors:
http://linux.bkbits.net:8080/linux-2.5/gnupatch@41ad5cd9EXGuUhmmotTFBIZdIkTm0ASigned-off-by: James Morris <jmorris@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

include/linux/kobject.h: In function `to_kset':
include/linux/kobject.h:116: warning: implicit declaration of function `container_of'
Signed-off-by: Manish Lachwani <mlachwani@mvista.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

2.6.11-rc2-bk5 introduces two syntax errors under drivers/char/ftape.  The
following patch replaces ");" at the end of two printks which were
accidentally removed.
Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

drivers/serial/8250_pnp.c: In function `serial_pnp_probe':
drivers/serial/8250_pnp.c:424: warning: cast to pointer from integer of different size
drivers/serial/8250_pnp.c: In function `serial_pnp_remove':
drivers/serial/8250_pnp.c:431: warning: cast from pointer to integer of different size

Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Adam Belay <ambx1@neo.rr.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

mm/memory.c: In function `clear_page_range':
mm/memory.c:185: warning: suggest parentheses around + or - inside shift
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

nodemask.h wants find_next_zero_bit() to take a const address.  Fix that up
and modify find_next_bit() to suit.

(These functions seem too big to be inlined...)

Cc: Richard Henderson <rth@twiddle.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

With Joe Perches <joe@perches.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into intel.com:/home/lenb/src/26-latest-dev

Signed-off-by: Len Brown <len.brown@intel.com>

into intel.com:/home/lenb/src/26-latest-dev

Signed-off-by: David Shaohua Li <shaohua.li@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

into intel.com:/home/lenb/src/26-latest-dev

Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

The function returns before recalculating the checksum in some cases.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Same fix as per ipv4 ip_copy_metadata().
Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Netfilter conntrack can defragment locally generated
packets before they hit ip_fragment().  In this case
the fragments have skb->dst set already, so we have to
release that existing reference before overwriting
skb->dst.
Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/net-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This is the third of 4 patches which factor out common code in
the ARM exception entry assembly code, aiming towards a reduction
in the size of the changes required here for SMP support.  These
patches are low impact, and will be merged over the coarse of the
next few days.

This patch addresses the code handling exception entry from user
modes.

Thanks to Russell King for some excellent debugging.

Conntrack defragments locally generated packets before they hit
ip_fragment.  In this case the fragments have skb->dst set, and
that needs to be released.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When selecting the best source device for outgoing connections the
devices in raw mode should be skipped.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This is the second of 4 patches which factor out common code in
the ARM exception entry assembly code, aiming towards a reduction
in the size of the changes required here for SMP support.  These
patches are low impact, and will be merged over the coarse of the
next 3 days.

This patch addresses the code handling exception entry from
invalid (irq, fiq, abort) modes.  However, in converting to a
macro, a minor bug has been fixed which would merely cause a
misleading register dump.

The CSR sniffer device looks like a normal H:2 Bluetooth device,
but it is not and so mark it as raw mode device.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>