Here is the updated patch (against 2.6.7-rc1) for the shpchp and pciehp
drivers that fixes the following issues:
- proper LED status when latch is open or card is not present while the
  user tries to power up the slot; (reported by D. Keck)
- check if kmalloc() return NULL before proceeding in acpi_get__hpp();
  (provided by L. Capitulino)
- add up(&ctrl->crit_sect) before return in error cases in several
  places;
- proper handling of resources when there are other onboard devices
  behind the p2p bridge that has the hot-plug capabaility;
- need to check negotiated link width in check_lnk_status();
- cleanup board_added() in pciehp
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

assorted minor bits in drivers/* - all independent, but there's
some limit to splitting stuff...

several pointers in ioctl structures marked as userland ones.

And that's it with this patchset.  A couple more of those and we'll
be done with the noise warnings ;-)

s2io.c: bogus initializer ({{"a"},{"b"}} has too many braces for
two-dimensional array of char - strings are arrays themselves).

de4x5.h: missing __user on a pointer in ioctl structure. 

airo.c: cleaned up and fixed procfs ->read() and ->write()

osst.c, st.c, scsi_debug.c annotated.

selinuxfs.c annotated

	b44.c: ->ioctl() is broken, since it uses &ifr->ifr_data instead of
ifr->ifr_data itself.  Surprise, surprise, copy_from_user() on that address
doesn't do any good...

	baycom_epp.c: does get_user() of the first word of structure, then
immediately does copy_from_user() on the entire thing and completely ignores
the value read by get_user() (it uses the same value in copied structure
instead).  Bogus get_user() call removed.

->ifr_data users annotated.

Some code that is used on iSeries (do_hash_page_DSI in head.S) was
clearing the RI (recoverable interrupt) bit in the MSR when it
shouldn't.  We were getting SLB miss interrupts following that which
were panicking because they appeared to have occurred at a bad place.
This patch fixes the problem.  In fact it isn't necessary for
do_hash_page_DSI to do anything to RI, so the patch changes the code
to not set or clear it.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

net/bridge partially annotated.

There are nasty problems with net/bridge/netfilter/* and they'll need to
be dealt with at some point - it mixes kernel and userland pointers a
lot and while it seems to avoid obvious breakage, it's not a nice code.

econet partially annotated.

It's still badly broken - it mixes userland and kernel chunks in the
same iovec, then does set_fs(KERNEL_FS) and sends that to
sock_sendmsg().  Do we still want to support that protocol family,
anyway?