From: Hugh Dickins <hugh@veritas.com>

Fixes bugzilla #2219

fork's dup_mmap leaves child mm_rb as copied from parent mm while doing all
the copy_page_ranges, and then calls build_mmap_rb without holding
page_table_lock.

try_to_unmap_one's find_vma (holding page_table_lock not mmap_sem) coming
on another cpu may cause mm mayhem.  It may leave the child's mmap_cache
pointing to a vma of the parent mm.

When the parent exits and the child faults, quite what happens rather
depends on what junk then inhabits vm_page_prot, which gets set in the page
table, with page_add_rmap adding the ptep, but junk pte likely to fail the
tests for page_remove_rmap.

Eventually the child exits, the page table is freed and try_to_unmap_one
oopses on null ptep_to_mm (but in a kernel with rss limiting, usually
page_referenced hits the null ptep_to_mm first).

This took me days and days to unravel!  Big thanks to Matthieu for
reporting it with a good test case.

It provides a best-effort, minimum-latency "get all the writeout
underway" function.

blk_start_queue() fix.

From: Jakub Bogusz <qboosh@pld-linux.org>

into ppc970.osdl.org:/home/torvalds/v2.5/linux

Noted by Stephen Smalley: sys_acct does not properly clean up the open
file when the security_acct hook returns an error.

Fixed thus.

Here's the second attempt at fixing blk_start_queue().  The only change
since last version is using proper atomic bitops.  If we moved the
read/write full to a different variable, we could rely on the queue lock
for plugging and stop/start of queue (by far the most used bit
operations there) and skip the atomic bitops.

into nuts.davemloft.net:/disk1/BK/tg3-2.6

blk_insert_request() unconditionally calls q->request_fn(q) regardless
of the plug state of the queue. This means that we could invoke
request_fn with a plugged queue, which is an invalid state.

Also fix a Jamesism style in there.

filemap_flush() needs exporting for modular XFS builds.

This got missed in my cleanup if iSeries_vio_dev.

The attached patch updates wanXL card driver. Please apply to Linux 2.6.
Thanks.

Changes:
* fixed initialization kernel panic, introduced with recent alloc_netdev()
  wan patch,
* wanxl_rx_intr() port# now checked before accessing port structure,
* cleanups etc.
--
Krzysztof Halasa, B*FH

* Add National DP83840 PHY rev b/c setup.  Only rev a was being setup.

From: Joe Perches <joe@perches.com>

Use %08llx for a dma_addr_t, not the recently-added %llx.

The carmel driver will want to use this rather
than muck around in queue internals directly.

Declarations come before statements, please.

Current gcc warns about this too, bless them:

crypto/arc4.c: In function `arc4_crypt':
crypto/arc4.c:65: warning: ISO C90 forbids mixed declarations and code

From: Zwane Mwaikambo <zwane@linuxpower.ca>

It looks like a block request snuck through before we had initialised the
motor_off_timer timers.  So I pushed the timer init earlier.

From: Marc-Christian Petersen <m.c.p@wolk-project.de>

OSS Sound Driver Forte needs ac97_codec.

drivers/i2c/busses/i2c-elv.c: In function `i2c_bitelv_init':

drivers/i2c/busses/i2c-elv.c:155: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-elv.c:155: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-velleman.c: In function `i2c_bitvelle_init':
drivers/i2c/busses/i2c-velleman.c:141: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-velleman.c:141: warning: unsigned int format, long int arg (arg 2)

From: David Joerg <davidjoerg@web.de>

Fix the description of the IO ports for the IDE primary and secondary
interfaces.

From: Aneesh Kumar KV <aneesh.kumar@digital.com>

We need to set the tasks's exit code prior to waking it, not afterwards.

Acked by rth.

Dave Kleikamp <shaggy@austin.ibm.com> points out a race between
nobh_prepare_write() and end_buffer_read_sync().  end_buffer_read_sync()
calls unlock_buffer(), waking the nobh_prepare_write() thread, which
immediately frees the buffer_head.  end_buffer_read_sync() then calls
put_bh() which decrements b_count for the already freed structure.  The
SLAB_DEBUG code detects the slab corruption.

We fix this by giving nobh_prepare_write() a private buffer_head end_o
handler which doesn't touch the buffer's contents after unlocking it.

From: Eric Sandeen <sandeen@sgi.com>

Several functions in buffer.c are using unsigned long where they should be
using sector_t.

Also, use pgoff_t in several places so it is easier to tell what is beingused
as a pagecache index, what is being used as a disk index and what is being
used as an offset-into-page.

If a large pci_alloc_consistent() GFP_ATOMIC allocation fails this driver's
recovery code will call emu10k1_wavein_close() far earlier than it should: it
goes splat in emu10k1_timer_uninstall().

Fix it by simply removing that call: we haven't allocated any resources yet
anyway.

Note that one of the callers of emu10k1_wavein_open(), emu10k1_audio_read()
will sit there stupidly retrying the open.  But it has a sleep in there so
something might eventually give way.

From: Markus Lidel <Markus.Lidel@shadowconnect.com>

drivers/message/i2o/i2o_block.c:

 - corrected the initialization sequence of the request queues.

 - added initialization to queue spinlocks.

 - release device in i2o_scan because else the device could not be queried.

 - i2o_block event threads wait on signal KILL but signal TERM was sent.

drivers/message/i2o/i2o_core.c:

 - set the HRT length to 0 at initialization, to avoid calling free on
   unallocated memory.

 - i2o_core event threads wait on signal KILL but signal TERM was sent.

 - added a limit of 3 tries to get the HRT from the controller.

 - removed the dpt parameter, which was used to force DPT controllers get
   handled by the i2o driver.  Now all available i2o controllers will be
   handled by this driver.

drivers/message/i2o/i2o_scsi.c:

 - beautifying of printk calls.

 - added scsi_unregister to properly clean up on module unload.

drivers/message/i2o/Kconfig:

 - added help for i2o_block and i2o_scsi to describe the differences between
   the two drivers.

include/linux/i2o-dev.h:

 - cleaned typo "tate" into "state".

include/linux/i2o.h:

 - removed defines from i2o_block and insert it here.

(Acked by Alan)

From: Gerd Knorr <kraxel@bytesex.org>

This patch fixes a bug in the v4l1-compat module and makes it pass the
correct buffer type to the v4l2 driver on VIDIOC_STREAM(ON|OFF) ioctls.

From: Arjan van de Ven <arjanv@redhat.com>

From: Chris Mason <mason@suse.com>

find_group_other looks buggy for ext2 and ext3 in 2.6, it can cause -ENOSPC
errors when the fs has plenty of free room.

To hit the bug, you need a filesystem where:

parent_group has no free blocks (but might have free inodes) Every other
group with free inodes has no free blocks.

That gets you down to the final linear search in find_group_other.  The
linear search has two bugs:

group = parent_group + 1; means we start searching at parent_group + 2
because the loop increments group before using it.

for(i = 2 ; i < ngroups ; i++) means we don't search through all the
groups.

The end result is that parent_group and parent_group + 1 are not checked
for free inodes in the final linear search.  ext3 has the same problem.

From: Andreas Kies <andikies@t-online.de>

Fix improperly handled 16 bit sample size.  If you use an odd number of
bytes in 16 bit mode the driver fails to work.

In file included from drivers/misc/ibmasm/uart.c:27:
include/linux/serial_core.h: In function `uart_handle_dcd_change':
include/linux/serial_core.h:407: `TASK_INTERRUPTIBLE' undeclared (first use in this function)

From: Christoph Hellwig <hch@lst.de>

sleep_on hurts my eyes and this offender is compltely unused, so..

From: Arnd Bergmann <arnd@arndb.de>

This use of deprecated struct initializers was hidden behind macro magic
and has appearantly not been noticed before.

From: "Jim Gifford" <maillist@jg555.com>

Prevent initrd from being built if ram device is built as a module.

From: "Randy.Dunlap" <rddunlap@osdl.org>

From: Tony Breeds <tony@bakeyournoodle.com>

It fixes 3 places where the ioctl returns positives instead of negatives.
I've gotten feedback from the maintainer (Rogier Wolff (sp?) and he has no
objections.

From: Arnd Bergmann <arnd@arndb.de>

The wrong argument in put_compat_timespec is marked const, causing
unnecessary compiler warnings.

From: David Gibson <david@gibson.dropbear.id.au>

Converts the mm_context_t on ppc64 to be a struct.  This lets us separate
the low_hpages flag into a separate field rather than folding it into the
actual context id.  That makes things neater, since the flag is
conceptually separate and has, for example, should be propogate across a
fork whereas the context ID obviously isn't.  The mm_context_id is the only
place to put arch-specific information in the mm_struct.

This patch will also make some interesting extensions to the hugepage
support much easier, such as allowing dynamic resizing of the hugepage
address space, or using special pagetables for hugepages.

From: Stephen Rothwell <sfr@canb.auug.org.au>

This patch adds the virtual cdrom driver for PPC64 iSeries.