From: Leann Ogasawara <ogasawara@osdl.org>

From: Daniele Bellucci <bellucda@tiscali.it>

Patch from Julie DeWandel.

This patch has solved the crashes observed during TPC-C runs on the
16-way box.  (I'm confident it will fix the other reported cases as
well.)

The race is the setting of timer->base to NULL, by del_timer() or
__run_timers().  If new_base == old_base in __mod_timer() then we do not
re-check timer->base after getting the lock.  (the only case where we do
not have to re-check the base is in the !old_base case, but the else
branch also includes the old_base==new_base case.)

The __run_timers() case made the lock_timer() patch not work fully - we
cannot use lock_timer() in __run_timers() due to lock ordering.

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch adds a SELINUX entry to the MAINTAINERS file.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch reworks the SELinux module code that handles inodes initialized
before the policy is initially loaded to also cover the case where a pseudo
filesystem such as selinuxfs or nfsd directly populate themselves.

The list of inode security structures is split into per-superblock lists
associated with each superblock security structure, and the initialization
is performed by superblock_doinit.

From: Shawn Starr <spstarr@sh0n.net>

opl3 use-after-free fix

From: Michael Still <mikal@stillhq.com>

This patch takes into account requests from various LKML members for the
mandocs output to be more terse.  Information about the copyright, and
formatting of the man page is moved into a comment at the start of the
groff output.

Sample output can be found at:
  http://www.stillhq.com/linux/mandocs/2.6.0-test3-bk1/

From: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>

verify maximum number of bits before using set_bit

Touching a page via follow_page() counts as a reference so we should be
either setting the referenced bit in the pte or running mark_page_accessed().

Altering the pte is tricky because we haven't implemented an atomic
pte_mkyoung().  And mark_page_accessed() is better anyway because it has more
aging state: it can move the page onto the active list.

If POKETEXT modifies the page it needs to tell the VM about it.

From: Stephen Rothwell <sfr@canb.auug.org.au>

Fix the dnotify documentation and code example to reflect reality.

From: Rusty Lynch <rusty@linux.co.intel.com>

While initializing the adm1021 device, the driver is performing a conversion
from fixed point to Celcius on values that were declaired as Celcius.  On my
Dell Precision 220 this results in a shutdown after a couple of minutes
running.

The latch simply removes the conversion.

From: Matthew Wilcox <willy@debian.org>

Introduce a new variable "arg_size" and set it appropriately in each arm of
the CONFIG_STACK_GROWSUP.  This patch fixes a bug for PA-RISC and makes the
code cleaner for everyone.

From: Dave Olien <dmo@osdl.org>

The dynamic queue allocation appears to have exposed a long-standing bug.

From: Todor Todorov <ttodorov@web.de>

A missig line fs/nls/Makefile prevents codepage 1250 from compiling and
installing whatever the .config value.

From: Yoshinori Sato <ysato@users.sourceforge.jp>

It writes one too many zeroes when nulling out the destination.

From: Matthew Dobson <colpatch@us.ibm.com>

16 proc x440 boxen aren't booting mainline kernels right now for many valid
configs.  This patch makes sure NUMA codepaths aren't executed for SMP
configs.  It also adds some sane error messages to the code, and cleans up
some #ifdefs.

From: Josh Boyer <jwboyer@charter.net>

jffs was missed in the statfs64 conversions.

From: Manuel Estrada Sainz <ranty@debian.org>

Add Manuel to MAINTAINERS for request_firmware().

From: Manuel Estrada Sainz <ranty@debian.org>

Add some higher level docs to Documentation/firmware_class/README.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The code appears to be able to add too many blocks back to
sbinfo->free_blocks in the failure path. We first do;

len = vma->vm_end - vma->vm_start;
sbinfo->free_blocks -= len;

but then later do;
len = (vma->vm_end - vma->vma_start) + (vma->vm_pgoff << HPAGE_SHIFT)

error:
sbinfo->free_blocks += len;

From: Zwane Mwaikambo <zwane@linuxpower.ca>

drivers/char/ipmi/ipmi_kcs_intf.c: In function `acpi_find_bmc':
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)

From: Albert Cahalan <albert@users.sourceforge.net>

1. allows likely() and unlikely() to work for pointers

2. fixes likely() (in C, any non-zero value is true)

drivers/char/keyboard.c: In function `k_fn':
drivers/char/keyboard.c:665: warning: comparison is always true due
to limited range of data type

I didn't want to just delete the code because one day the size of func_table
may get smaller, or the type of `value' may get larger.  When that happens,
the test becomes valid again.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

If you need a long long format, then cast to long long, not u64.  u64 is
long on 64-bit architectures.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

Attached patch kills a warning when compiling on a 64-bit architecture
(ssize_t is long, not int)

From: Manuel Estrada Sainz <ranty@debian.org>

- undo recent change, made in the believe that "buffer" was the size of
  the whole file, it is just PAGE_SIZE in size.  This was causing kernel
  memory corruption.

  - Since files are allowed to have unknown sizes, by setting their
    size to 0, we can't preallocate a buffer of their size on open.

- Adapt request_firmware() to the sysfs change.

- Adapt drivers/pci/pci-sysfs.c to the sysfs change.

loop-on-file oopses during unmount.  This is because lo_queue is now freed
during lo_ioctl(LOOP_CLR_FD).  I think the scenario is:

1: umount(8) opens /dev/loop0

2: umount(8) runs lo_ioctl(LOOP_CLR_FD) (this frees the queue)

3: umount(8) closes the /dev/loop0 handle.  The blockdev layer syncs the
   blockdev, but its mapping->backing_dev_info now points into la-la-land.

We shouldn't be freeing the queue until all refs to it have gone away.  This
patch gives the queue the same lifetime as the controlling loop_device
itself.  It also makes the loop driver's queue appear in sysfs again.

It would be better to free the queue when the device is not in use, but I'm
not sure how we can hook into the blockdev layer to do that.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

On 64-bit architectures, ino_t is int, not long, so the attached patch
is needed to prevent a warning.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

hugetlbfs was accessing super_block->s_fs_info after free'ing it.  This was
because it was being free'd prematurely.  I have deferred free until
->put_super().  I have also removed hugetlbfs_kill_super since it now is
simply a kill_litter_super.

From: Adrian Bunk <bunk@fs.tum.de>

hd.c contains a typo

From: Zwane Mwaikambo <zwane@linuxpower.ca>

This is a patch to make the MTRR initialisation more conformant with what
is stated in volume 3 of (10-36 Memory Cache Control).  The most notable
change is entering the no-fill cache mode before clearing the PGE bit in
cr4.  Intel also states that we should do the cache flush via the cr3
register shuffle.  If there is a problem with the patch please don't
hesitate to beat me vigorously with a clue-by-four.

It has been tested on a 3x Pentium 133, 8x PIII Xeon 700, 1x Celeron 550 and 32x
PIII 500 NUMAQ (hardware courtesy of OSDL)

From: Andrey Borzenkov <arvidjaar@mail.ru>

The floppy driver doesn't remove /dev/floppy when floppy_init fails.

From: Andrey Borzenkov <arvidjaar@mail.ru>

_devfs_walk_path does not check if de it is about to scan is a directory.
Next step is spinlock on non-spinlock memory.  It requires either artificial
setup or really broken driver but fairly easy to reproduce once you know how.

It is likely to exist in 2.4 as well.

From: Andrey Borzenkov <arvidjaar@mail.ru>

devfs_mk_dir freed wrong de and incorrectly passed to devfsd already freed
de.  Besides it did not even check if entry found was actually directory.