From: Neil Brown <neilb@cse.unsw.edu.au>

1/ If a setuid process swaps it's real and effective uids and then forks,
 the fork fails if the new realuid has more processes
 than the original process was limited to.
 This is particularly a problem if a user with a process limit
 (e.g. 256) runs a setuid-root program which does setuid() + fork()
 (e.g. lprng) while root already has more than 256 process (which
 is quite possible).

 The root problem here is that a limit which should be a per-user
 limit is being implemented as a per-process limit with
 per-process (e.g. CAP_SYS_RESOURCE) controls.
 Being a per-user limit, it should be that the root-user can over-ride
 it, not just some process with CAP_SYS_RESOURCE.

 This patch adds a test to ignore process limits if the real user is root.

2/ When a root-owned process (e.g. cgiwrap) sets up process limits and then
  calls setuid, the setuid should fail if the user would then be running
  more than rlim_cur[RLIMIT_NPROC] processes, but it doesn't.  This patch
  adds an appropriate test.  With this patch, and per-user process limit
  imposed in cgiwrap really works.

From: Anton Blanchard <anton@samba.org>

On success getaffinity should return the size of mask.  It looks like
Randy's patch (which fixed a bogus return) missed this bit.

In reality I'm not sure if we care, and with cpu bitmasks this stuff is
going to break.

From: Andrey Borzenkov <arvidjaar@mail.ru>

Current 2.5 does not register any device node in devfs for empty media
(capacity == 0) case.  This makes removables unusable with devfs.
Partition rescan is done only on bdev open, but without any device node for
device it is impossible to open it.

In 2.4 it was finally solved by always registering .../disc node as
representation for "whole" disk and using devfsd action to force partition
rescan on access to (non-existing) partition name.  For primary names it
was handled internally by devfs - it kept track of removable devices in
directory and initiated partition rescan when name was not found.

Both are obviously broken now.  You can't do partition rescan because no
node is registered at all and internal handling was removed.  Very nice.

The attached patch makes resgister_disk always register at least disc node.
 This now works for old and new compat names as per devfsd configuration;
canonical names are still broken:

  {pts/3}% ll /dev/scsi/host1/bus0/target4/lun0/part4
  ls: /dev/scsi/host1/bus0/target4/lun0/part4: No such file or directory

but it can be fixed using the same technique as above so I won't push it.

From: William Lee Irwin III <wli@holomorphy.com>

I've been slab allocating the stack on i386 for some time, and it has gone
without incident in pgcl, -wli, -mjb (?), and so on.  kmalloc() is fine;
there isn't any particularly compelling reason for a dedicated slab as
there's no preconstruction to do, though it can be arranged.

Basically, it works, there's no obvious reason not to, and (even better)
it's not totally invisible to the VM and even makes overhead reportable.

From: Manfred Spraul <manfred@colorfullife.com>

kernel/fork.c contains a disabled cache for task stuctures.  task
structures are placed into the task cache only if "tsk==current", and
"tsk==current" is impossible.  There is even a WARN_ON against that in
__put_task_struct().

So remove it entirely - it's dead code.

One problem is that order-1 allocations are not cached per-cpu - we can
use kmalloc for the stack.

From: Andrey Borzenkov <arvidjaar@mail.ru>

The code that did proper check existed in 2.4 and was removed in 2.5 for
whatever reason. The patch restores it slightly modified as below.

2.4 code looks somewhat unclean in that

- it traverses task list without lock.

- it starts from current->real_parent but nothing prevents current be
  init_task itself.  This hung for me on 2.5 during boot.  May be 2.4 does
  something differently.

From: Pete Zaitcev <zaitcev@redhat.com>

sparc32 needs the registers passed into dump_fpu().

From: Lou Langholtz <ldl@aros.net>

- set_blocksize() already does those size checks.

- test the set_blocksize() return value: it can fail if the requested
  blocksize is less that the hard sector size.

From: Andreas Gruenbacher <agruen@suse.de>

The xattr and acl code are not properly reserving credits for quotas.
EXT3_DATA_TRANS_BLOCKS is an overestimate of the credits required including
quotas.  Make it a little more tight, and use it in the xattr and acl code
to be quota safe.

From: Andreas Gruenbacher <agruen@suse.de>

- Fix transaction credit exhaustion BUG.

- ext3_journal_get_write_access_credits failures break out of the loop in
  1058, so <ce> is not released properly.

- <credits> must be reset after journal_release_buffer() in line 1072.

From: Shane Shrybman <shrybman@sympatico.ca>

This fixes the following warning:

drivers/parport/parport_pc.c:98: warning: `verbose_probing' defined but
not used

- i460-agp linkage fix ("Luck, Tony" <tony.luck@intel.com>)

- Don't reimplement offsetof() in hfs

- NBD warning fix

- Remove unneeded null-pointer test in journal_stop (Andreas Gruenbacher)

- remove debug stuff in journal_dirty_metadata()

- slab.c typo fixes (Lev Makhlis <mlev@despammed.com>)

- In devfs_mk_cdev() error path, don't print `buf' until we've written
  something into it.  (Reported by Gergely Nagy <algernon@gandalph.mad.hu>)

- Two ISA sound drivers had their kmalloc() args reversed (Spotted by Steve
  French)

From: Milton Miller <miltonm@bga.com>

Enable the CONFIG_LBD option for the architectures which appear to support
it.

It is not actually tested for those architectures, but it's not likely to
be unless we do this...

into kroah.com:/home/greg/linux/BK/gregkh-2.5

You'll recall there was a change to the locking in that code after
it was submitted.  This is a better fix to that issue.

"Obviously correct", though I've not run with this in ages.

the driver is registering the device too early, so that open may
see a partially initialised device.

Clean up irq urb when not enough memory is available.

This patch for the UHCI driver changes the test for over current inputs,
which can cause false Resume indications with some of Intel's USB
controllers.  Previously the code only checked for one specific controller
chip, but now another one has turned up that exhibits the same flaw.  It
seems best just to check for Intel being the manufacturer, especially
since it doesn't hurt to check for the condition when it isn't present or
is only temporary.

The patch from Frank was missing the auth flavor argument to
nfs_sb_init().  Trivial fix follows.

[ Side note: the code mixes the spellings 'flavor' and 'flavour', which
  is somewhat confusing.  That should probably be fixed to avoid confusion. ]

into home.osdl.org:/home/torvalds/v2.5/linux

This fixes various problems with the AD1816 sound driver:

 - Compilation errors with CONFIG_PNP enabled fixed.
 - PNP specific code rewritten.
 - SMP fixes.
 - DMA resource handling fixes.
 - Other minor code cleanup.

This causes blk.h to print a warning and removes all uses of blk.h.
I've tested the compilation in 2.6.0-test1 with a .config that tries to
compile as many drivers as possible.

Correct size of siginfo_t for s390x (from 136 to 128).

 - Reset netdevice to defaults in offline processing.
 - Fix checksumming.
 - Fix routing status display.
 - Get rid of _ccw_device_get_device_number in qeth.
 - Inline some functions to save stack space.

 - Fix two memory leaks.
 - Clear pending status in cio_enable_subchannel.
 - Don't call device_unregister from interrupt context.
 - Fix refcounting problems on static device structures for the ccw console.
 - Delete timeouts for qdio after successful startup.

Remove put_disk from dasd_destroy_partitions. This is done in dasd_free_device.

Enable irq statistics for s390*. We defined NR_IRQS to 2, one for all i/o
interrupts and one for all external interrupts.

 - New default configuration.
 - Fix get_tv32/put_tv32.
 - Replace generic dma-mapping file with empty one.
 - Remove wrong comment from dma.h.

The comment in nfs_get_root() basically describes the patch:

    Some authentication types (gss/krb5, most notably)
    are such that root won't be able to present a
    credential for GETATTR (ie, getroot()).

An easy way (ie, without this patch) to have unattended mounts is to
have a root/host@REALM (or similar) principal stashed in a keytab, which
root (rather, gssd) can use.  However, this might not be desirable for
many sites.  In any case, RFC2623 specifically describes the problem
addressed here.

Notes:

- Root inode gets inum of 1.  This doesn't seem to matter, but may be
  aesthetically unpleasing.  I wanted to choose an inum unlikely to
  conflict with an existing inum (although NFS has specific support
  for that).  It looks like more work than it's worth to change the
  inum after the info is available.  AFAICT it's not critical info.

- Solaris has this "wierd" (but understandable)  behavior that after
  mounting without a credential, the mount point is not visible at all
  until an access is attempted with a credential.  This now-you-see-it-
  now-you-don't behavior doesn't seem worthwhile to reproduce here.

- Unfortunately, MOUNT_VERSION must go to 5.  Some kernels with ver 4
  do not understand pseudoflavor.  Keeping it at 4 means that the
  userland mount can't know for sure whether the kernel accepted the
  option or not.  (Unless I'm missing some hack that could be done.)

It works in my environment, against a netapp server (with the rpcsec_gss
patch I provided earlier).

 - fix null dereference on xprt->inet if (!connected), which happens if
   a rpc cred wasn't available (root+auth_gss case)
 - set bufsize on reconnect

start gss seq no at 1; netapp doesn't accept seq no 0.

Just as a data point, Solaris 9 client uses initial seq. no. 2.

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

This is a follow-up patch to my latest patch series.  It fixes the
problems and flaws Greg KH pointed out.

There was a typo in the Makefile, so the driver was never compiled.  But
I assumed that it built without errors.  Doh!

 - update the Technisat Skystar2 driver:
         - follow kernel coding rules, change comments
         - change function return values from u32 to int where possible
         - make all functions static
         - comment out unused functions
         - fix return values of functions to follow kernel rules
         - removed bogus delay, read and write functions

 - add two new usb dvb drivers:
   o dvb-ttusb-budget.c for Technotrend/Hauppauge Nova-USB devices
     (Thanks to Holger Waechtler <holger@convergence.de> and elix Domke
     <tmbinc@gmx.net>)
   o dvb-ttusb-dec.c for Technotrend/Hauppauge USB DEC2000-T devices
     (Thanks to Alex Woods <linux-dvb@giblets.org>)

 - fix DMX_GET_STC to get the msb right
 - follow changes in saa7146 driver core, separate some data for DVB-C
   and DVB-S cards