* 'audit.b54' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
  [PATCH] Fix the bug of using AUDIT_STATUS_RATE_LIMIT when set fail, no error output.
  [PATCH] Fix the kernel panic of audit_filter_task when key field is set
  Re: [PATCH] the loginuid field should be output in all AUDIT_CONFIG_CHANGE audit messages
  kernel/audit.c control character detection is off-by-one
  [PATCH] Audit: Collect signal info when SIGUSR2 is sent to auditd

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  au1xmmc: raise segment size limit.
  mmc_block: use proper sg iterators
  mmc: properly iterate over sg list in debug check
  mmc_test: Revert "mmc_test: test oversized sg lists"
  sdhci: check correct return value
  sdhci: disable DMA for req, not completely
  sdhci: handle bug in JMB38x for sizes < 4 bytes

* 'reg-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lrg/voltage-2.6:
  regulator: TI bq24022 Li-Ion Charger driver
  regulator: maintainers - add maintainers for regulator framework.
  regulator: documentation - ABI
  regulator: documentation - machine
  regulator: documentation - regulator driver
  regulator: documentation - consumer interface
  regulator: documentation - overview
  regulator: core kbuild files
  regulator: regulator test harness
  regulator: add support for fixed regulators.
  regulator: regulator framework core
  regulator: fixed regulator interface
  regulator: machine driver interface
  regulator: regulator driver interface
  regulator: consumer device interface

Merge branch 'hotfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'hotfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  SELinux: /proc/mounts should show what it can

* git://git.infradead.org/battery-2.6:
  power_supply: Sharp SL-6000 (tosa) batteries support
  power_supply: fix up CHARGE_COUNTER output to be more precise
  power_supply: add CHARGE_COUNTER property and olpc_battery support for it
  power_supply: bump EC version check that we refuse to run with in olpc_battery
  power_supply: cleanup of the OLPC battery driver
  power_supply: add eeprom dump file to olpc_battery's sysfs
  power_supply: Support serial number in olpc_battery

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (28 commits)
  mm/hugetlb.c must #include <asm/io.h>
  video: Fix up hp6xx driver build regressions.
  sh: defconfig updates.
  sh: Kill off stray mach-rsk7203 reference.
  serial: sh-sci: Fix up SH7760/SH7780/SH7785 early printk regression.
  sh: Move out individual boards without mach groups.
  sh: Make sure AT_SYSINFO_EHDR is exposed to userspace in asm/auxvec.h.
  sh: Allow SH-3 and SH-5 to use common headers.
  sh: Provide common CPU headers, prune the SH-2 and SH-2A directories.
  sh/maple: clean maple bus code
  sh: More header path fixups for mach dir refactoring.
  sh: Move out the solution engine headers to arch/sh/include/mach-se/
  sh: I2C fix for AP325RXA and Migo-R
  sh: Shuffle the board directories in to mach groups.
  sh: dma-sh: Fix up dreamcast dma.h mach path.
  sh: Switch KBUILD_DEFCONFIG to shx3_defconfig.
  sh: Add ARCH_DEFCONFIG entries for sh and sh64.
  sh: Fix compile error of Solution Engine
  sh: Proper __put_user_asm() size mismatch fix.
  sh: Stub in a dummy ENTRY_OFFSET for uImage offset calculation.
  ...

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  generic, x86: fix add iommu_num_pages helper function
  x86: remove stray <6> in BogoMIPS printk
  x86: move dma32_reserve_bootmem() after reserve_crashkernel()

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] qeth: avoid use of include/asm-s390
  [S390] dont use kthread for smp_rescan_cpus().
  [S390] virtio console: fix section mismatch warning.
  [S390] cio: Include linux/string.h in schid.h.
  [S390] qdio: fix section mismatch bug.
  [S390] stp: fix section mismatch warning.
  [S390] Remove diag 0x260 call from memory detection.
  [S390] qdio: make sure qdr is aligned to page size
  [S390] Add support for memory hot-remove.
  [S390] Wire up new syscalls.
  [S390] cio: Memory allocation for idset changed.
  [S390] qeth: preallocated qeth header for hiper socket
  [S390] Optimize storage key operations for anon pages
  [S390] nohz/sclp: disable timer on synchronous waits.
  [S390] ipl: Reboot from alternate device does not work when booting from file
  [S390] dasd: Add support for enhanced VM UID
  [S390] Remove last P390 trace.

Raise the DMA block size limit from 2048 bytes to the maximum supported
by the DMA controllers on the chip (64KB on Au1100, 4MB on Au1200).

This gives a very small performance boost and apparently fixes an oops
when MMC-DMA and network traffic are active at the same time.
Signed-off-by: Manuel Lauss <mano@roarinelk.homelinux.net>
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

This reverts commit 48b5352e. Oversized
sg lists are not allowed anymore, and the core even checks for them in
debug mode, so this test is entirely incorrect.
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Fix a copy-and-paste error.
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

The wrong flag was manipulated when an invalid sg list was given, turning
off DMA on the next (and all subsequent) request instead of the current
one.
Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

Signed-off-by: Pierre Ossman <drzeus@drzeus.cx>

When the "status_get->mask" is "AUDIT_STATUS_RATE_LIMIT || AUDIT_STATUS_BACKLOG_LIMIT".
If "audit_set_rate_limit" fails and "audit_set_backlog_limit" succeeds, the "err" value
will be greater than or equal to 0. It will miss the failure of rate set.
Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

When calling audit_filter_task(), it calls audit_filter_rules() with audit_context is NULL.
If the key field is set, the result in audit_filter_rules() will be set to 1 and
ctx->filterkey will be set to key.
But the ctx is NULL in this condition, so kernel will panic.
Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

> shouldn't these be using the "audit_get_loginuid(current)"  and if we
> are going to output loginuid we also should be outputting sessionid

Thanks for your detailed explanation.
I have made a new patch for outputing "loginuid" and "sessionid" by audit_get_loginuid(current) and audit_get_sessionid(current).
If there are some deficiencies, please give me your indication.
Signed-off-by: Zhang Xiliang <zhangxiliang@cn.fujitsu.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Hello,

According to my understanding there is an off-by-one bug in the
function:

   audit_string_contains_control()

in:

  kernel/audit.c

Patch is included.

I do not know from how many places the function is called from, but for
example, SELinux Access Vector Cache tries to log untrusted filenames via
call path:

avc_audit()
     audit_log_untrustedstring()
         audit_log_n_untrustedstring()
             audit_string_contains_control()

If audit_string_contains_control() detects control characters, then the
string is hex-encoded. But the hex=0x7f dec=127, DEL-character, is not
detected.

I guess this could have at least some minor security implications, since a
user can create a filename with 0x7f in it, causing logged filename to
possibly look different when someone reads it on the terminal.
Signed-off-by: Vesa-Matti Kari <vmkari@cc.helsinki.fi>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Makes the kernel audit subsystem collect information about the sending
process when that process sends SIGUSR2 to the userspace audit daemon.
SIGUSR2 is a new interesting signal to auditd telling auditd that it
should try to start logging to disk again and the error condition which
caused it to stop logging to disk (usually out of space) has been
rectified.
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

The planned move of include/asm-s390 to arch/s390/include/asm
requires that all includes for asm headers use include/asm and
not include/asm-s390.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Since git commit 3da1c84c
"workqueues: make get_online_cpus() useable for work->func()"
it is safe to call get_online_cpus() from workqueue context.
So remove the kthread workaround again.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Fix these two false positive warnings:

WARNING: vmlinux.o(.text+0x2e1cc4): Section mismatch in reference from the function s390_virtio_console_init() to the function .init.text:early_put_chars()
The function s390_virtio_console_init() references
the function __init early_put_chars().
This is often because s390_virtio_console_init lacks a __init
annotation or the annotation of early_put_chars is wrong.

WARNING: vmlinux.o(.text+0x2e1cd0): Section mismatch in reference from the function s390_virtio_console_init() to the function .init.text:virtio_cons_early_init()
The function s390_virtio_console_init() references
the function __init virtio_cons_early_init().
This is often because s390_virtio_console_init lacks a __init
annotation or the annotation of virtio_cons_early_init is wrong.

Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

schid.h needs string.h for memset and memcmp.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Fix the two section mismatch warnings below.
This fixes two real bugs since the code which has __exit annotations
may already be gone when it is called.

WARNING: vmlinux.o(.init.text+0x1cc4a): Section mismatch in reference from the function init_QDIO() to the function .exit.text:qdio_setup_exit()
The function __init init_QDIO() references
a function __exit qdio_setup_exit().
This is often seen when error handling in the init function
uses functionality in the exit path.
The fix is often to remove the __exit annotation of
qdio_setup_exit() so it may be used outside an exit section.

WARNING: vmlinux.o(.init.text+0x1cc7a): Section mismatch in reference from the function init_QDIO() to the function .exit.text:qdio_remove_perf_stats()
The function __init init_QDIO() references
a function __exit qdio_remove_perf_stats().
This is often seen when error handling in the init function
uses functionality in the exit path.
The fix is often to remove the __exit annotation of
qdio_remove_perf_stats() so it may be used outside an exit section.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Fix these two (false positive) warnings by adding an __init annoation:

WARNING: vmlinux.o(.text+0x7e6a): Section mismatch in reference from the function stp_reset() to the function .init.text:__alloc_bootmem()
The function stp_reset() references
the function __init __alloc_bootmem().
This is often because stp_reset lacks a __init
annotation or the annotation of __alloc_bootmem is wrong.

WARNING: vmlinux.o(.text+0x7ece): Section mismatch in reference from the function stp_reset() to the function .init.text:free_bootmem()
The function stp_reset() references
the function __init free_bootmem().
This is often because stp_reset lacks a __init
annotation or the annotation of free_bootmem is wrong.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

The result of the diag 0x260 call is not always what one would expect.
So just remove it.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

kzalloc does not guarantee the required alignment of qdr to page size,
use get_zeroed_page instead.
Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>

This patch enables memory hot-remove on s390.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Memory allocation for the quite huge idset changed from
kzalloc to vmalloc.
Signed-off-by: Michael Ernst <mernst@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

For hiper socket devices this patch will economize the reallocation
of the tx skb data segment by allocating separate memory for the qdio
transport information (qeth header).
Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

For anonymous pages without a swap cache backing the check in
page_remove_rmap for the physical dirty bit in page_remove_rmap is
unnecessary. The instructions that are used to check and reset the dirty
bit are expensive. Removing the check noticably speeds up process exit.
In addition the clearing of the dirty bit in __SetPageUptodate is
pointless as well. With these two changes there is no storage key
operation for an anonymous page anymore if it does not hit the swap
space.

The micro benchmark which repeatedly executes an empty shell script
gets about 5% faster.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

sclp_sync_wait wait synchronously for an sclp interrupt and disables
timer interrupts. However on the irq enter paths there is an extra
check if a timer interrupt would be due and calls the timer callback.
This would schedule softirqs in the wrong context.
So introduce local_tick_enable/disable which prevents this.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

During startup we check if diag308 works using diag 308 subcode 6,
which stores the actual ipl information. This fails with rc = 0x102, if
the system has been ipled from the HMC using load from CD or load from file.
In the case of rc = 0x102 we have to assume that diag 308 is working,
since it still can be used to ipl from an alternative device.
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

When z/VM provides two virtual devices (minidisks) that reside on the
same real device, both will receive the configuration data from the
real device and thus get the same uid. To fix this problem, z/VM
provides an additional configuration data record that allows to
distinguish between minidisks.
z/VM APAR VM64273 needs be installed so this fix has an effect.
Signed-off-by: Stefan Weinhuber <wein@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Seems like I forgot this hunk...
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Cobalt: update defconfig
  [MIPS] kgdb: add arch support for the kernel's kgdb core
  [MIPS] kgdb: Remove existing implementation
  [MIPS] TXx9: Kconfig cleanup
  [MIPS] TXx9: Kill unused txx927.h
  [MIPS] TXx9: Support early_printk
  [MIPS] TXx9: Unify serial_txx9 setup
  [MIPS] TXx9: Random cleanup
  [MIPS] TXx9: Make tx4938-specific code more independent
  [MIPS] TXx9: Make tx3927-specific code more independent
  [MIPS] TXx9: Cleanup watchdog
  [MIPS] TXx9: Cleanup restart/halt/power_off
  [MIPS] TXx9: PCI error handling
  [MIPS] TXx9: Add some pci options
  [MIPS] Introduce pcibios_plat_setup
  [MIPS] TXx9: PCI fixes for tx3927/tx4927
  [MIPS] TXx9: Fix JMR3927 irq numbers
  [MIPS] RB532: Flags are unsigned long
  [MIPS] Initialization of Alchemy boards
  [MIPS] tlb-r4k: Nuke broken paranoia error test.

The iov_iter_advance() function would look at the iov->iov_len entry
even though it might have iterated over the whole array, and iov was
pointing past the end.  This would cause DEBUG_PAGEALLOC to trigger a
kernel page fault if the allocation was at the end of a page, and the
next page was unallocated.

The quick fix is to just change the order of the tests: check that there
is any iovec data left before we check the iov entry itself.

Thanks to Alexey Dobriyan for finding this case, and testing the fix.
Reported-and-tested-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

We zero-fill them like we are supposed to, and that's all fine.  It's
only an error if the 'romfs_copyfrom()' routine isn't able to fill the
data that is supposed to be there.

Most of the patch is really just re-organizing the code a bit, and using
separate variables for the error value and for how much of the page we
actually filled from the filesystem.
Reported-and-tested-by: Chris Fester <cfester@wms.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Matt Waddel <matt.waddel@freescale.com>
Cc: Greg Ungerer <gerg@snapgear.com>
Signed-of-by: Linus Torvalds <torvalds@linux-foundation.org>