From: "Milton D. Miller II" <miltonm@realtime.net>

The code at present has a small problem: when a fault is encountered we will
run commit_write() to cover the amount of data which was successfully copied
in from userspace.

But filemap_copy_from_user() may have zeroed out some more of the page.  So
pagecache now has zeroes and the buffer_head which represents those zeroes is
not dirtied.  So a subsequent eviction and re-read of the file in the window
beyond the faulting offset will return the file's old contents and not the
zeroes.

So we change filemap_copy_from_user_iovec() to have the same behaviour as the
non-iovec filemap_copy_from_user(), and ensure that the commit_write() covers
the parts of the page which copy_from_user() zeroed out.

From: Pavel Roskin <proski@gnu.org>, via Christoph Hellwig <hch@infradead.org>

It's already the second time that I encounter a kernel panic in the same
place.  When devfs_remove() is called on a non-existent file entry, the
kernel panics and I have to reboot the system.

First time it was unregistering of pseudoterminals.  This time it's
ide-floppy module that doesn't register devfs entries if the media is absent
but still tries to unregister them.  The bug in ide-floppy will be reported
separately.

The point of this message is that the failure in devfs_remove() is possible,
especially with rarely used drivers.  Secondly, is not fatal enough to
justify an immediate panic and reboot.  Thirdly, devfs misses a chance to
tell the user what's going wrong.

From: Hollis Blanchard <hollisb@us.ibm.com>

Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it shouldn't.
The user buffer is copied to/from kernel space by
drivers/media/video/videodev.c:video_usercopy().

From: Hollis Blanchard <hollisb@us.ibm.com>

Another simple case of a memcpy that should be copy_from_user...

Also fix some error-path memory leaks.

From: Hugh Dickins <hugh@veritas.com>

PageDirty BUG_ON in __remove_inode_page is, and always has been, unsafe for
SMP or preemption: truncation may be racing against unmapping's
set_page_dirty in zap_pte_range (amongst a few other possibilities).
!PageUptodate error in __set_page_dirty_buffers is unsafe then too.

From: Hollis Blanchard <hollisb@us.ibm.com>

Fix a direct userspace access, found by the Stanford checker.

From: Hollis Blanchard <hollisb@us.ibm.com>

Fix a direct userspace access, found by the Stanford checker.

From: Hollis Blanchard <hollisb@us.ibm.com>

As pointed out by the Stanford checker, 'v' is not tainted.  The driver
shouldn't be using copy_to_user() in cadet_do_ioctl() at all:

  cadet_do_ioctl() is being called by drivers/media/video/videodev.c:
  video_usercopy(), which has already copied the buffer 'arg' (aka 'v')
  into kernel space, and will copy it back after cadet_do_ioctl()
  returns.  So all the direct 'v' accesses are correct.

From: Christoph Hellwig <hch@lst.de>

- don't add one level of indentation when taking a lock

- remove useless ti_global struct

- comment fixes

- duplicated assignments

- Remove a prototype which is in aio.h already

- Some __user annotation

- use the existing symbolic names, not magic numbers.

Fix broken "cleanup"

into home.transmeta.com:/home/torvalds/v2.5/linux

into home.transmeta.com:/home/torvalds/v2.5/linux

This merges arch.c, irq.c and mm.c into one core file for this
platform; it's pointless keeping these separate.

Since struct platform_device now has the ability to pass resources,
defined by the platform to the device driver, we can now use this
to handle platform specific devices.  One such instance is the
StrongARM SA1111 companion chip, which can appear in various address
spaces, and connected to different IRQ lines depending on how many
cups of coffee the hardware designer had, the direction of the wind
outside the designers office that day.

We also convert some of the other StrongARM peripheral on-chip
devices to use struct platform_device.

ARM also provides a platform_add_devices() function which can be
used by platform code to bulk-register a tabular set of platform
devices.