From: Mingming Cao <cmm@us.ibm.com>

Basically, freeary() is called with the spinlock for that semaphore set
hold.  But after the semaphore set is removed from the ID array by
calling sem_rmid(), there is no lock to protect the waiting queue for
that semaphore set.  So, if a waiter is woken up by a signal (not by the
wakeup from freeary()), it will check the q->status and q->prev fields.
At that moment, freeary() may not have a chance to update those fields
yet.

static void freeary (int id)
{
	.......
        sma = sem_rmid(id);

	......
        /* Wake up all pending processes and let them fail with EIDRM.*/
        for (q = sma->sem_pending; q; q = q->next) {
                q->status = -EIDRM;
                q->prev = NULL;
                wake_up_process(q->sleeper); /* doesn't sleep */
        }
        sem_unlock(sma);
	......
}

So I propose move sem_rmid() after the loop of waking up every waiters.
That could gurantee that when the waiters are woke up, the updates for
q->status and q->prev have already done.  Similar thing in message queue
case.  The patch is attached below. Comments are very welcomed.

I have tested this patch on 2.5.68 kernel with LTP tests, seems fine to
me. Paul, could you test this on DOTS test again? Thanks!

exit_mmap() currently assumes that the exitting task used virtual address
span TASK_SIZE.

But on some platforms, TASK_SIZE is variable, based on current->mm.

But exit_mmap() can be called from (say) procfs's call to mmput.  In which
case current->mm has nothing to do with the mm which is being put in
mmput().

So rather than assuming that the mm which is being put is current->mm, we
need to calculate the virtual span of the mm.  Add a new per-arch macro
MM_VM_SIZE() for that.

Some platforms can currently go BUG over this (where?).  sparc64 is safe
because our TASK_SIZE is constant.

Platforms such as ia64 should stick the VM extent inside of mm_struct, I'd
suggest adding it to mm_context_t.

1) TASK_SIZE means what is valid for mmap()'s in the processes
   address space

2) MM_VM_SIZE means where things might be mapped for a MM, including
   private implementation-specific areas created by the kernel
   which the user cannot access

From: Rusty Russell <rusty@rustcorp.com.au>

__module_get is theoretically allowed on module inside init, since we
already hold an implicit reference.  Currently this BUG()s: make the
reference count explicit, which also simplifies delete path.  Also cleans
up unload path, such that it only drops semaphore when it's actually
sleeping for rmmod --wait.

From: Jan Kara <jack@suse.cz>

I'm sending a fix which fixes potential problems (dropping references which
were not acquired) when dquot_transfer() fails.

From: Jan Kara <jack@suse.cz>

I'm sending a patch which changes numbers of blocks reserved for quota writes
to more appropriate values (with current values ext3 asserts can be
triggered).

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The proc interface has no way of telling wether there is an active cpufreq
driver or not. This means that if you don't have a cpufreq supported
processor, this will oops in various possible places.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

Removes an extra initialisation and general nitpicking.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

Commented out printk causes change in program flow in cpufreq/p4-clockmod.c

From: "Stephen C. Tweedie" <sct@redhat.com>

When a new vma can be merged simultaneously with its two immediate
neighbours in both directions, vma_merge() extends the predecessor vma and
deletes the successor.  However, if the vma maps a file, it fails to fput()
when doing the delete, leaving the file's refcount inconsistent.

From: Bjorn Stenberg <bjorn@haxx.se>
      OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

This simple patch makes the linux fat filesystem driver use the
next_cluster field in the fat_boot_fsinfo structure.  This field is a hint
where to start looking for free clusters.

Using this field makes a big difference for disks connected over slow links
such as USB 1.1.  Finding the first free cluster on a 40gig fat-formatted
usb disk can today take several minutes.  This patch cuts it down to a
fraction of a second.

Also, commit the next_cluster search hint toand from the superblock in
write_super/fill_super.

It looks like I guessed wrong on this one.

From: Christoph Hellwig <hch@lst.de>

Whee! devfs_register isn't used anymore in the whole tree and with
it some other devfs crap.  Kill it for good.

From: Rusty Russell <rusty@rustcorp.com.au>, David Mosberger

The patch below updates the other platforms with module_arch_cleanup().
Also, I added more debug output to kernel/module.c since I found it useful
to be able to see the final section layout.

From: george anzinger <george@mvista.com>

- Fix the sig_notify filtering code for the timer_create system call to
  properly check for the signal number being small enought, but only if
  SIG_NONE is not specified.

- Eliminate useless test of sig_notify.

From: Taral <taral@taral.net>

Looks like the recent access_ok fixes broke building of i386.
__verify_write is still referenced in a couple places.

Some of the fancier slab debugging options are disabled for caches whose
objects are larger than PAGE_SIZE/8, for speed/fragmentation reasons.

But this patch turns up bugs in the size-2048 slab, so it was a bad idea.
Enable the debugging for slabs up to 4096 bytes.

into home.transmeta.com:/home/torvalds/v2.5/linux

C preprocessor expressions work, guys!)

Here are three more fixes which I missed in the previous patch.

into nuts.ninka.net:/home/davem/src/BK/net-2.5

Don't depend on undefined preprocessor symbols evaluating to zero.

into home.transmeta.com:/home/torvalds/v2.5/linux

into home.transmeta.com:/home/torvalds/v2.5/linux

into nuts.ninka.net:/home/davem/src/BK/net-2.5

into kernel.bkbits.net:/home/davem/sparc-2.5

- Export ip_generic_getfrag
- In udp6 increment v6 udp statistics not v4 one

There is a _lot_ of stuff in linux/elf.h that shouldn't be there.

This moves the arch-specific stuff in linux/elf.h into the corresponding
asm header files.