Signed-off-by: Steve French (sfrench@us.ibm.com)

Signed-off-by: Steve French (sfrench@us.ibm.com)

Signed-off-by: Steve French (sfrench@us.ibm.com)

Signed-off-by: Steve French (sfrench@us.ibm.com)

Signed-off-by: Steve French (sfrench@us.ibm.com>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

- Modify fs/ntfs/ntfs_readdir() to copy the index root attribute value
  to a buffer so that we can put the search context and unmap the mft
  record before calling the filldir() callback.  We need to do this
  because of NFSd which calls ->lookup() from its filldir callback()
  and this causes NTFS to deadlock as ntfs_lookup() maps the mft record
  of the directory and since ntfs_readdir() has got it mapped already
  ntfs_lookup() deadlocks.
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

into cantab.net:/home/src/ntfs-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into starflyer.(none):/home/airlied/drm/drm-2.6

and/or d->send_sizes.  When these functions are called from gamma_dma,
these pointers are user pointers and are thus not safe to deref.  This patch
copies over the pointers inside gamma_dma_priority and
gamma_dma_send_buffers.
Submitted-by: Robert T. Johnson <rtjohnso@eecs.berkeley.edu>
Signed-off-by: Dave Airlie <airlied@linux.ie>

This bug took forever to debug (just ask Ben :-).

When we move the completion event from the failed request to the sense
request, we risk either the initial complete and then later complete on
a long gone ->waiting.  I think this business of moving the completion
structure to the request sense is a bit bogus and always has been, and
the bug is fixed nicely by just rewriting this logic a bit.  So instead
we simply unconditionally dequeue the failed request (regardless of
whether it was REQ_PC or REQ_BLOCK_PC), and pass a reference to it in
the sense request.  When the sense completes, we call end io on the
originally failed request (which does the complete() etc).
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into cantab.net:/home/src/ntfs-2.6

With the old DRM interface, the devname was set in DRM(setunique),
but with the current DRM interface >=1.1 the devname is not being
set in DRM(set_busid).

From: Alan Swanson
Approved-by: Dave Airlie <airlied@linux.ie>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

into nuts.davemloft.net:/disk1/BK/sparc-2.6

dup_mmap() unnecessarily tries to account for memory of the vma's it has
created if it fails in the middle.

However, that's pointless (and wrong), since the exit_mmap() path called
through mmput() will do so anyway in the failure path.

Just remove the bogus un-accounting code.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Add __user annotations to kernel/sysctl.c to satisfy sparse
for !CONFIG_SYSCTL, !CONFIG_PROC_FS.
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It puts two 2kB temp areas on the stack, which is
guaranteed to overflow a 4kB stack if that path
is ever taken.

Both marked in the source, and both should be easy
to fix but need testing.

Found by Jörn Engel.

From: Herbert Xu <herbert@gondor.apana.org.au>

The recent change to vga16fb's memory mapping that you partially reverted
is still broken.  In particular, it's setting fix.mem_start to a virtual
address on i386.  The value of fix.mem_start is meant to be physical.

We could simply apply virt_to_phys to it, but somehow I doubt that is what
it's meant to do on arm.  So until we hear from someone who knows how it
works on arm, let's just revert this change.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Randy Dunlap <rddunlap@osdl.org> points out that sparse warns about the test
of an undefined preprocessor identifier.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andy Whitcroft <apw@shadowen.org>

The sysctl interfaces for updating the uts entries such as hostname and
domainname are using the wrong length for these buffers; they are hard
coded to 64.  Although safe, this artifically limits the size of these
fields to one less than the true maximum.  This generates an inconsistency
between the various methods of update for these fields.

# hostname 12345678901234567890123456789012345678901234567890123456789012345
hostname: name too long
# hostname 1234567890123456789012345678901234567890123456789012345678901234
# hostname
1234567890123456789012345678901234567890123456789012345678901234

# sysctl -w kernel.hostname=1234567890123456789012345678901234567890123456789012345678901234567890
kernel.hostname = 1234567890123456789012345678901234567890123456789012345678901234567890
# hostname
123456789012345678901234567890123456789012345678901234567890123
#

The error originates from the fact the handler for strings (proc_dostring)
already allows for the string terminator.  This patch corrects the limit,
taking the oppotunity to convert to use of sizeof().
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: john stultz <johnstul@us.ibm.com>

In testing for SLES9, we ran across a bug caused by userspace apps poking
the PIT which caused bad values to be read by the kernel.  This would then
trigger the lost tick detection code with insane values and would then
break the SCSI subsystem.

This patch includes the PIT sanity check from the TSC timesource into the
cyclone timesource code, which catches the bad case described above and
resolves the issue.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: "Anil" <anil.s.keshavamurthy@intel.com>

We don't need lock_cpu_hotplug()/unlock_cpu_hotplug for singlethreaded
workqueues.
Signed-off-by: Anil Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

This patch adds support for 6 system call arguments on s390.  The first
exploiter of this will be the sys_futex system call for the
FUTEX_CMP_REQUEUE operation.  The idea is simple: use register %r7 for the
6th argument.  This can be extended to 7/8/9/...  arguments if there ever
will be the need for it.  To call the system call function in the kernel
the additional arguments needs to get stored on the stack.  8 bytes are
added to the head of struct pt_regs.  %r7 is stored to the additional field
for all system calls.  The store is hidden in a
address-generation-interlock slot, it doesn't slow down the system call
path.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Jens Axboe <axboe@suse.de>

cdrom_has_defect_mgt() has the same ->data_len bug - the length field is
not total length, but the length following that field.  So it should be +
4, not + 8.  However, just kill the length check.  Comparison of
feature_code provides enough check.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: NeilBrown <neilb@cse.unsw.edu.au>

This condtion on this loop is primarily to avoid the loop if it doesn't
appear to be needed.  However it optimises a little too much and there is a
case where it skips the loop when it is really needed.  This patch fixes
it.

This is the raid6 version of the recent raid5 resync bugfix.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

Recent syscall stubs cleanup broke alpha, as it has its own version of
sys_rt_sigaction().  This defines __ARCH_WANT_SYS_RT_SIGACTION for all
architectures except alpha, sparc and sparc64.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andi Kleen <ak@suse.de>

UDF spews out lots of debugging information by default.  Disable that,
since it doesn't make too much sense for a production kernel.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andi Kleen <ak@suse.de>

This printk is printed by genericarch when your machine is no es7000.  Most
people don't care about that.  Remove it.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Francois Romieu <romieu@fr.zoreil.com>

- just say no to numbered labels;
- pci_enable_device can fail so setup_pci_dev() must return a value;
- propagate existing error codes when possible in do_pci_device()
- missing pci_disable_device here and there. 
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Peter Korsgaard <jacmet@sunsite.dk>

Vertical retrace is in lines, not pixels.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We need to take journal_lock_updates() while remounting r/o to prevent a new
transaction starting while journal_flush() is running.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Christoph Hellwig <hch@lst.de>

drivers/block/paride/epat.c support two slightly different protocol
variants.  Currently it's compile-time selected by CONFIG_PARIDE_EPATC8,
but this patch adds a epatc8 module option to allow runtime selection.
CONFIG_PARIDE_EPATC8 stays for now but I'd like to kill it int 2.7.

The basic patch is from the Debian kernel package (Author unknown) but I
reworked it a bit.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The ____cacheline_aligned in there is a leftover from before the existence of
the percpu infrastructure.  It bloats struct page_state and structures which
contain it enormously, and we use these things on the stack deep in page
reclaim.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Chris Mason <mason@suse.com>

There's a small window where the filesystem can be unmounted during
writeback_inodes.  The end result is the iput done by sync_sb_inodes could
be done after the FS put_super and and the super has been removed from all
lists.

The fix is to hold the s_umount sem during sync_sb_inodes to make sure
the FS doesn't get unmounted.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>