From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch reworks the SELinux module code that handles inodes initialized
before the policy is initially loaded to also cover the case where a pseudo
filesystem such as selinuxfs or nfsd directly populate themselves.

The list of inode security structures is split into per-superblock lists
associated with each superblock security structure, and the initialization
is performed by superblock_doinit.

From: Shawn Starr <spstarr@sh0n.net>

opl3 use-after-free fix

From: Michael Still <mikal@stillhq.com>

This patch takes into account requests from various LKML members for the
mandocs output to be more terse.  Information about the copyright, and
formatting of the man page is moved into a comment at the start of the
groff output.

Sample output can be found at:
  http://www.stillhq.com/linux/mandocs/2.6.0-test3-bk1/

From: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>

verify maximum number of bits before using set_bit

Touching a page via follow_page() counts as a reference so we should be
either setting the referenced bit in the pte or running mark_page_accessed().

Altering the pte is tricky because we haven't implemented an atomic
pte_mkyoung().  And mark_page_accessed() is better anyway because it has more
aging state: it can move the page onto the active list.

If POKETEXT modifies the page it needs to tell the VM about it.

From: Stephen Rothwell <sfr@canb.auug.org.au>

Fix the dnotify documentation and code example to reflect reality.

From: Rusty Lynch <rusty@linux.co.intel.com>

While initializing the adm1021 device, the driver is performing a conversion
from fixed point to Celcius on values that were declaired as Celcius.  On my
Dell Precision 220 this results in a shutdown after a couple of minutes
running.

The latch simply removes the conversion.

From: Matthew Wilcox <willy@debian.org>

Introduce a new variable "arg_size" and set it appropriately in each arm of
the CONFIG_STACK_GROWSUP.  This patch fixes a bug for PA-RISC and makes the
code cleaner for everyone.

From: Dave Olien <dmo@osdl.org>

The dynamic queue allocation appears to have exposed a long-standing bug.

From: Todor Todorov <ttodorov@web.de>

A missig line fs/nls/Makefile prevents codepage 1250 from compiling and
installing whatever the .config value.

From: Yoshinori Sato <ysato@users.sourceforge.jp>

It writes one too many zeroes when nulling out the destination.

From: Matthew Dobson <colpatch@us.ibm.com>

16 proc x440 boxen aren't booting mainline kernels right now for many valid
configs.  This patch makes sure NUMA codepaths aren't executed for SMP
configs.  It also adds some sane error messages to the code, and cleans up
some #ifdefs.

From: Josh Boyer <jwboyer@charter.net>

jffs was missed in the statfs64 conversions.

From: Manuel Estrada Sainz <ranty@debian.org>

Add Manuel to MAINTAINERS for request_firmware().

From: Manuel Estrada Sainz <ranty@debian.org>

Add some higher level docs to Documentation/firmware_class/README.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The code appears to be able to add too many blocks back to
sbinfo->free_blocks in the failure path. We first do;

len = vma->vm_end - vma->vm_start;
sbinfo->free_blocks -= len;

but then later do;
len = (vma->vm_end - vma->vma_start) + (vma->vm_pgoff << HPAGE_SHIFT)

error:
sbinfo->free_blocks += len;

From: Zwane Mwaikambo <zwane@linuxpower.ca>

drivers/char/ipmi/ipmi_kcs_intf.c: In function `acpi_find_bmc':
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)

From: Albert Cahalan <albert@users.sourceforge.net>

1. allows likely() and unlikely() to work for pointers

2. fixes likely() (in C, any non-zero value is true)

drivers/char/keyboard.c: In function `k_fn':
drivers/char/keyboard.c:665: warning: comparison is always true due
to limited range of data type

I didn't want to just delete the code because one day the size of func_table
may get smaller, or the type of `value' may get larger.  When that happens,
the test becomes valid again.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

If you need a long long format, then cast to long long, not u64.  u64 is
long on 64-bit architectures.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

Attached patch kills a warning when compiling on a 64-bit architecture
(ssize_t is long, not int)

From: Manuel Estrada Sainz <ranty@debian.org>

- undo recent change, made in the believe that "buffer" was the size of
  the whole file, it is just PAGE_SIZE in size.  This was causing kernel
  memory corruption.

  - Since files are allowed to have unknown sizes, by setting their
    size to 0, we can't preallocate a buffer of their size on open.

- Adapt request_firmware() to the sysfs change.

- Adapt drivers/pci/pci-sysfs.c to the sysfs change.

loop-on-file oopses during unmount.  This is because lo_queue is now freed
during lo_ioctl(LOOP_CLR_FD).  I think the scenario is:

1: umount(8) opens /dev/loop0

2: umount(8) runs lo_ioctl(LOOP_CLR_FD) (this frees the queue)

3: umount(8) closes the /dev/loop0 handle.  The blockdev layer syncs the
   blockdev, but its mapping->backing_dev_info now points into la-la-land.

We shouldn't be freeing the queue until all refs to it have gone away.  This
patch gives the queue the same lifetime as the controlling loop_device
itself.  It also makes the loop driver's queue appear in sysfs again.

It would be better to free the queue when the device is not in use, but I'm
not sure how we can hook into the blockdev layer to do that.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

On 64-bit architectures, ino_t is int, not long, so the attached patch
is needed to prevent a warning.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

hugetlbfs was accessing super_block->s_fs_info after free'ing it.  This was
because it was being free'd prematurely.  I have deferred free until
->put_super().  I have also removed hugetlbfs_kill_super since it now is
simply a kill_litter_super.

From: Adrian Bunk <bunk@fs.tum.de>

hd.c contains a typo

From: Zwane Mwaikambo <zwane@linuxpower.ca>

This is a patch to make the MTRR initialisation more conformant with what
is stated in volume 3 of (10-36 Memory Cache Control).  The most notable
change is entering the no-fill cache mode before clearing the PGE bit in
cr4.  Intel also states that we should do the cache flush via the cr3
register shuffle.  If there is a problem with the patch please don't
hesitate to beat me vigorously with a clue-by-four.

It has been tested on a 3x Pentium 133, 8x PIII Xeon 700, 1x Celeron 550 and 32x
PIII 500 NUMAQ (hardware courtesy of OSDL)

From: Andrey Borzenkov <arvidjaar@mail.ru>

The floppy driver doesn't remove /dev/floppy when floppy_init fails.

From: Andrey Borzenkov <arvidjaar@mail.ru>

_devfs_walk_path does not check if de it is about to scan is a directory.
Next step is spinlock on non-spinlock memory.  It requires either artificial
setup or really broken driver but fairly easy to reproduce once you know how.

It is likely to exist in 2.4 as well.

From: Andrey Borzenkov <arvidjaar@mail.ru>

devfs_mk_dir freed wrong de and incorrectly passed to devfsd already freed
de.  Besides it did not even check if entry found was actually directory.

From: Ramn Rey Vicente <ramon.rey@hispalinux.es>

Fix the config issue with the hotplug firmware loader.  The firmware loader
use hotplug, so this must be included as a dependency.

When we changed try_name() to handle new-style printable dev_t formatting we
broke lots of people's setups.  Lilo, grub, etc.

Fix that by trying new-style formatting first, then fall back to old-style.

People should generally use new-style %u:%u major:minor formatting in the
future.

From: Vinay K Nallamothu <vinay-rc@naturesoft.net>

The patch below fixes two pointer reference bugs (shows up as compile
time warnings given below) which wrongly take the address of "struct
usb_interface*".

	drivers/bluetooth/hci_usb.c: In function `hci_usb_probe':
	drivers/bluetooth/hci_usb.c:786: warning: assignment from incompatible pointer type
	drivers/bluetooth/hci_usb.c:810: warning: assignment from incompatible pointer type

From: Mikael Pettersson <mikpe@csd.uu.se>

This patch fixes ide-scsi.c for the ide_drive_t->queue type change
in 2.6.0-test3.

Without the patch you'll get these new warnings in -test3:

drivers/scsi/ide-scsi.c: In function `idescsi_abort':
drivers/scsi/ide-scsi.c:875: warning: passing arg 1 of `elv_queue_empty' from incompatible pointer type
drivers/scsi/ide-scsi.c: In function `idescsi_reset':
drivers/scsi/ide-scsi.c:902: warning: passing arg 1 of `elv_next_request' from incompatible pointer type

Bug 1065 (http://bugme.osdl.org/show_bug.cgi?id=1065) points out that there
is a risk that UDF will accidentally mount a reiserfs partition, which would
prevent a successful boot.

Andries points out that probing is unreliable and that users/admins should
always specify the root filesystem type on the kernel boot command line with
"rootfstype=resierfs".

But nobody does that, so we should be trying reiserfs before UDF.

From: Manfred Spraul <manfred@colorfullife.com>

(We think this might be the mystery bug which has been hanging about for
months)


We found a [the?] task struct refcount error: A task that dies sets
tsk->state to TASK_ZOMBIE.  The next scheduled task checks prev->state, and
if it's ZOMBIE, then it decrements the reference count of prev.  The
prev->state & _ZOMBIE test is not atomic with schedule, thus if prev is
scheduled again and dies between dropping the runqueue lock and checking
prev->state, then the reference it dropped twice.

This is possible with either preemption [schedule_tail is called by
ret_from_fork with preemption count 1, finish_arch_switch drops it to 0] or
profiling [profile_exit_mmap can sleep on profile_rwsem, called by
mmdrop()] enabled.

Several comparisons which can never be true because they're comparing u8's
with numbers which are greater than 255.

ic_servaddr is accessible after boot via /proc/net/pnp.  So it cannot be
__initdata.

davej says that other varibles there are treated the same way, so move them
all into the regular data section.

From: Paul Clements <Paul.Clements@SteelEye.com>

Here's the updated patch to fix several race conditions in nbd. It
requires reverting the already included (but incomplete)
nbd-race-fix.patch that's in -mm5.

This patch fixes the following race conditions:

1) adds an increment of req->ref_count to eliminate races between
do_nbd_request and nbd_end_request, which resulted in the freeing of
in-use requests -- there were races between send/receive, send/shutdown
(killall -9 nbd-client), and send/disconnect (nbd-client -d), which are
now all fixed

2) adds locking and properly orders the code in NBD_CLEAR_SOCK to
eliminate races with other code

3) adds an lo->sock check to nbd_clear_que to eliminate races between
do_nbd_request and nbd_clear_que, which resulted in the dequeuing of
active requests

4) adds an lo->sock check to NBD_DO_IT to eliminate races with
NBD_CLEAR_SOCK, which caused an Oops when "nbd-client -d" was called