From: Jan Kara <jack@ucw.cz>

I've attached a fix for a problem in ext3 journalled quota patch - the problem
is that detecting whether dqput() sleeps was wrong and so we could possibly
schedule when holding a spinlock.

From: Chris Wright <chrisw@osdl.org>

Contributions from:
Stephen Smalley <sds@epoch.ncsc.mil>
Andy Lutomirski <luto@stanford.edu>

During exec the LSM bprm_apply_creds() hooks may tranisition the program to a
new security context (like setuid binaries).  The security context of the new
task is dependent on state such as if the task is being ptraced.  

ptrace_detach() doesn't take the task_lock() when clearing task->ptrace.  So
there is a race possible where a process starts off being ptraced, the
malicious ptracer detaches and if any checks agains task->ptrace are done more
than once, the results are indeterminate.

This patch ensures task_lock() is held while bprm_apply_creds() hooks are
called, keeping it safe against ptrace_attach() races.  Additionally, tests
against task->ptrace (and ->fs->count, ->files->count and ->sighand->count all
of which signify potential unsafe resource sharing during a security context
transition) are done only once the results are passed down to hooks, making it
safe against ptrace_detach() races.

Additionally:

- s/must_must_not_trace_exec/unsafe_exec/
- move unsafe_exec() call above security_bprm_apply_creds() call rather than
  in call for readability.
- fix dummy hook to honor the case where root is ptracing
- couple minor formatting/spelling fixes

From: Chris Mason <mason@suse.com>

block_write_full_page might see and lock clean metadata buffers, which leads
to bogus vs-12339 messages.  Change the message to ignore bh locked.

From: Rusty Russell <rusty@rustcorp.com.au>

call_usermodehelper uses keventd to create a thread, guaranteeing a nice,
clean kernel thread.  Unfortunately, there is a case where
call_usermodehelper is called with &bus->subsys.rwsem held (via
bus_add_driver()), but keventd could be running bus_add_device(), which is
blocked on the same lock.  The result is deadlock, and it comes from using
keventd for both.

In this case, it can be fixed by using a completely independent thread for
call_usermodehelper, or an independent workqueue.  Workqueues have the
infrastructure we need, so we use one.

Move EXPORT_SYMBOL while we're there, too.

akpm fixes: Make it compile with !CONFIG_KMOD

From: Rusty Russell <rusty@rustcorp.com.au>

Workqueues are a great primitive for running things from user context from
a completely clean environment.  Unfortunately, they currently insist on
creating one thread per CPU, which is overkill for many situations, so the
more generic keventd workqueue is used for these.  Recently deadlocks using
keventd were demonstrated, showing that it is not suitable for all uses.

1) Clean up CPU iterators.  Always a nice touch.

2) Add __create_workqueue() and create_singlethread_workqueue(),
   keeping source compatibility.

3) Put workqueues in workqueue list even if !CONFIG_HOTPLUG_CPU (means
   we need a lock to protect that list).  Now we can tell if a wq is
   single-threaded using list_empty(&wq->list).

4) For single-threaded workqueues, override CPU in queue_work,
   delayed_work_timer_fn and flush_workqueue to be 0.  flush_workqueue
   now does redundant passes for single-threaded workqueues, but the
   code remains simple.

5) Make create_workqueue_thread return the thread, so we can easily
   kthread_bind for multi-threaded workqueues.


akpm fixes:

- Fix up is_single_threaded() handling

- single-threaded wq thread does not have "/0" appended.

Here's another fix it'd be good to merge ...

No changes to the Linux code at all, but it'll makes the Windows
configuration of a Linux device running the Ethernet/RNDIS gadget behave
correctly on more versions of Windows.  (It might prevent some
Bluescreening too.)

into ppc970.osdl.org:/home/torvalds/v2.6/linux

There's an obsolete check in sn_init_pdas() left over from the 2.4
days that panics if the cpu PDA and cpu_data area span more than a page.
With 2.6, we're not limited to a page, so remove the check entirely.

I just ran into a bug introduced by the most recent iosapic.c patch.
The scenario is a builtin driver is up and running happily.  A module
loads for a devices that happens to share the same interrupt vector,
in this case a network driver.  The module calls pci_enable_device()
as it should, which eventually lands in iosapic_enable_intr().  We
then proceed to mask the interrupt and kill the device that's already
running.  As a bonus, request_interrupt() doesn't fix the problem
because we only call the startup for the interrupt handler on the
first action attached to the interrupt.

I think the best way out of this is simply to detect when an action is
already attached to a vector and leave it alone.  This also prevents
interrupts from moving to other cpus (on boxes w/o irq redirection)
for no good reason.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The logic got a little foo-bar'ed in the last patch, we should have keep
the old logic.  Ie LoEj bit (2nd) must always be set, just clear it for
known non-capable of loading drives.

This fixes a oops in the current kernel tree.

This is an old bug that often confuses people, rightfully.

For some laptop and server type cdroms, the drives advertise themselves
as tray loading even if they are caddy-like or slot-in loaders.  This
means they cannot insert the media on their own, and this generates a
5/24/00 error to START_STOP_UNIT.

This prevents the logging of such a failure, and also fixes the
generation of such a bad command in case the mech type was correctly set
by the drive.

Fix race conditions of ISDN CAPI's internal ncci list handling by using
a per capidev semaphore.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

 - [V4L] follow changes in saa7146 driver: mxb, dpc7146, hexium_orion,
   hexium_gemini

 - [DVB] ttusb-dec:
   - Add a parameter to dvb_filter_pes2ts function to specify whether
     the packet is a payload unit start or not
   - Use the hotplug firmware loader for 2.6 kernels instead of
     compiling the firmware into the module. 
   - Correct the USB id of the DEC3000-s, add basic support

 - [DVB] ttusb-budget:
    - Remove spurious discontinuity message when starting streaming

 - [DVB] follow changes in dvb-core for frontend drivers (ves1x93,
   ves1820, nxt6000, sp887x, tda1004x, stv0299, mt312, alps_tdlb7,
   alps_tdmb7, at76c651, cx24110, dst, dvb_dummy_fe, grundig_29504-401,
   grundig_29504-491)
 - [DVB] tda1004x: updated timeout to 800ms, implemented FE_SLEEP
 - [DVB] cx24110: add FE_CAN_RECOVER to reduce kdvb-fe CPU load
 - [DVB] grundig_29504-401: added 200ms delay after first FE_INIT,
   Implemented FE_GET_FRONTEND
 - [DVB] alps_tdlb7, alps_tdmb7: upped tuning delays to fix tuning

 - [DVB] av7110 update:
   - speed up firmware loading
   - follow internal API changes in saa7146 driver
   - introduced some symbolic constants for a/v dec cmds
   - change default for hw_sections to 0 to enable crc checks

 - [DVB] remove superflous memset() which caused section data to be
   overwritten when a) there are two sections in one TS packet, and b)
   the first section was smaller than 18 bytes; thanks to Jean-Claude
   Repetto for tracking this down
 - [DVB] starting a ts filter on a running section filter's pid did
   break the section filter; fixed. 
 - [DVB] integrate ULE Decapsulation code, thanks to gcs - Global
   Communication & Services GmbH.  and Institute for Computer Sciences
   Salzburg University.  Hilmar Linder <hlinder@cosy.sbg.ac.at> and
   Wolfram Stering <wstering@cosy.sbg.ac.at>
 - [DVB] fix the module use count bugs, thanks to Hernan A.Perez Masci
   for his initial work on this problem
 - [DVB] if dvb_frontend_internal_ioctl() returns an error code, be sure
   to deliver it to the calling application, don't ignore it (fixes the
   bug that the frontend0 doesn't respond properly to unknown ioctls...)
 - [DVB] major frontend code clean up, rewritten core tuning loop.
   Thanks to Andrew de Quincey.
 - [DVB] follow changes in dvb-core in skystar2, dvb-bt8xx

 - [DVB] add generic functions for EN50221 CAM interfaces

 - [DVB] budget-av: patch by Kenneth Aafløy to add support for Typhoon
   DVB-S budget card
 - [DVB] budget.c: support for Fujitsu-Siemens Activy Card
 - [DVB] budget-ci: add preliminary CI support

 - [DVB] misc. documentation updates, KConfig help file updates
 - [DVB] make Twinhan driver depend on bt8xx

 - [DVB] saa7146 driver updates:
   - remove bogus v_calc and h_calc parameters, which can be easily
     retrieved from other values
   - add class parameter to i2c initialization
   - let resource handling provide more useful informations
   - sanitize overlay/capture locking

into redhat.com:/spare/repo/net-drivers-2.6

into redhat.com:/spare/repo/net-drivers-2.6

into redhat.com:/spare/repo/net-drivers-2.6

The attached patch fixes an "oops" in tulip driver when a live interface
is deactivated (i.e. PC Card ejected or module unloaded) without being
brought down first.

into kernel.bkbits.net:/home/davem/net-2.6

into nuts.davemloft.net:/disk1/BK/sparc-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

It is unsafe thing to do (no locking, no reference counting etc).
Just remove module_exit() as it was done for IDE PCI drivers.

From: Randy Dunlap <rddunlap@osdl.org>
From: Michael Veeck <michael.veeck@gmx.net>

Removes unnecessary IDE_MIN()/IDE_MAX() macros
and changes calls to use kernel.h macros instead.