* If vsnprintf returns -1, it will mess up the sk buffer space accounting. 
This is fixed by not calling skb_put with bogus len values.

* audit_log_hex was a loop that called audit_log_vformat with %02X for each 
character. This is very inefficient since conversion from unsigned character 
to Ascii representation is essentially masking, shifting, and byte lookups. 
Also, the length of the converted string is well known - it's twice the 
original. Fixed by rewriting the function.

* audit_log_untrustedstring had no comments. This makes it hard for 
someone to understand what the string format will be.

* audit_log_d_path was never fixed to use untrustedstring. This could mess
up user space parsers. This was fixed to make a temp buffer, call d_path, 
and log temp buffer using untrustedstring. 

From: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

It's silly to have to add explicit entries for new userspace messages
as we invent them. Just treat all messages in the user range the same.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

ioctl_by_bdev may only be used INSIDE the kernel.  If the "arg" argument
refers to memory that is accessed by put_user/get_user in the ioctl
function, the memory needs to be in the kernel address space (that's the
set_fs(KERNEL_DS) doing in the ioctl_by_bdev).  This works on i386 because
even with set_fs(KERNEL_DS) the user space memory is still accessible with
put_user/get_user.  That is not true for s390.  In short the ioctl
implementation of the pktcdvd device driver is horribly broken.
Signed-off-by: Peter Osterlund <petero2@telia.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

[Patch] Fix raw device ioctl pass-through

Raw character devices are supposed to pass ioctls through to the block
devices they are bound to.  Unfortunately, they are using the wrong
function for this: ioctl_by_bdev(), instead of blkdev_ioctl().

ioctl_by_bdev() performs a set_fs(KERNEL_DS) before calling the ioctl,
redirecting the user-space buffer access to the kernel address space.
This is, needless to say, a bad thing.

This was noticed first on s390, where raw IO was non-functioning.  The
s390 driver config does not actually allow raw IO to be enabled, which
was the first part of the problem.  Secondly, the s390 kernel address
space is distinct from user, causing legal raw ioctls to fail.  I've
reproduced this on a kernel built with 4G:4G split on x86, which fails
in the same way (-EFAULT if the address does not exist kernel-side;
returns success without actually populating the user buffer if it does.)

The patch below fixes both the config and address-space problems.  It's
based closely on a patch by Jan Glauber <jang@de.ibm.com>, which has
been tested on s390 at IBM.  I've tested it on x86 4G:4G (split address
space) and x86_64 (common address space).

Kernel-address-space access has been assigned CAN-2005-1264.
Signed-off-by: Stephen Tweedie <sct@redhat.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

As reported by Paul Starzetz <ihaquer@isec.pl>

Reference: CAN-2005-1263
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Mainline kernels don't have VECTORS_HIGH nor COPYPAGE_MINICACHE yet.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Version 2 of the 3com OfficeConnect 11g Cardbus Card aka 3CRWE154G72 is not
supported by the prism54 project.  To stop confusion, the kernel
documentation should state so as 3com made a good job hiding the version.
Signed-off-by: Andrew Morton <akpm@osdl.org>

diff -puN drivers/net/wireless/Kconfig~wireless-3crwe154g72-kconfig-help-fix drivers/net/wireless/Kconfig

This patch fixes a typo in tulip driver in 2.6.12-rc3.

Fix IBM EMAC driver ioctl bug.

I found IBM EMAC driver bug.
So mii-tool command print wrong status.

  # mii-tool
  eth0: 10 Mbit, half duplex, no link
  eth1: 10 Mbit, half duplex, no link

I can get correct status on fixed kernel.

  # mii-tool
  eth0: negotiated 100baseTx-FD, link okZZ
  eth1: negotiated 100baseTx-FD, link ok

Hiroaki Fuse

Signed-off-by: Geoff Levand <geoffrey.levand@am.sony.com> for CELF

	NET_WIRELESS is only a subset of the stuff in drivers/net/wireless;
NET_RADIO is what covers all of them.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>

Der... if you use max_t it helps if you give it a type. 

Note to self: Always just apply the tested patches, don't try to port 
them by hand. You're not clever enough.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

I'm going through the kernel code and have a patch that corrects 
several spelling errors in comments.

From: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

This patch adds more messages types to the audit subsystem so that audit 
analysis is quicker, intuitive, and more useful.
Signed-off-by: Steve Grubb <sgrubb@redhat.com>
---
I forgot one type in the big patch. I need to add one for user space 
originating SE Linux avc messages. This is used by dbus and nscd.

-Steve
---
Updated to 2.6.12-rc4-mm1.
-dwmw2
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Otherwise, we will be repeatedly reallocating, even if we're only
adding a few bytes at a time. Pointed out by Steve Grubb.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Patch from Ben Dooks

Fix the setting of hdiv when set to divide-by-2. Thanks to
Jeonghoon Yoon for pointing this out.
Change name of the NAND device to "s3c2440-nand" as it
is not similar enough to the "s3c2410-nand" device.

Signed-off-by: Ben Dooks
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Ben Dooks

S3C2440 UPLL is the same as the S3C2410 UPLL, it is only the
MPLL which has an extra multiplication factor of 2 in the
multiplier.

Signed-off-by: Ben Dooks
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Ben Dooks

Add the register definitions for the s3c2440 NAND controller
to the s3c2410 NAND register definitions

Signed-off-by: Ben Dooks
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Nicolas Pitre

Not all ARMv6 processors implement the TLS register.

Signed-off-by: Nicolas Pitre
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Add audit_log_type to allow callers to specify type and pid when logging.
Convert audit_log to wrapper around audit_log_type.  Could have
converted all audit_log callers directly, but common case is default
of type AUDIT_KERNEL and pid 0.  Update audit_log_start to take type
and pid values when creating a new audit_buffer.  Move sequences that
did audit_log_start, audit_log_format, audit_set_type, audit_log_end,
to simply call audit_log_type directly.  This obsoletes audit_set_type
and audit_set_pid, so remove them.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Remove code conditionally dependent on CONFIG_AUDITSYSCALL from audit.c.
Move these dependencies to audit.h with the rest.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Audit now actually requires netlink.  So make it depend on CONFIG_NET, 
and remove the inline dependencies on CONFIG_NET.
Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Signed-off-by: Chris Wright <chrisw@osdl.org>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Patch from Sascha Hauer

This patch adds the defines for the i.MX PWM controller

Signed-off-by: Steven Scholz
Signed-off-by: Sascha Hauer
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

We're not allowed to use args twice; we need to use va_copy.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Let audit_expand() know how much it's expected to grow the buffer, in 
the case that we have that information to hand.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

We were setting nlmsg_len to skb->len, but we should be subtracting
the size of the header.

From: Steve Grubb <sgrubb@redhat.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>

Patch from Nicolas Pitre

Signed-off-by: Nicolas Pitre
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Add cache flushing support for aliased V6 caches to
flush_dcache_page.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Remove needless page table walking for v6 page operations.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Move the locking for copy_user_page() and clear_user_page() into
the implementations which require locking.  For simple memcpy/
memset based implementations, the locking is extra overhead which
is not necessary, and prevents preemption occuring.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Add uart_insert_char(), which handles inserting characters into the
flip buffer.  This helper function handles the correct semantics
for handling overrun in addition to inserting normal characters.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Add pmd_off() and pmd_off_k() to obtain the pmd pointer for a
virtual address, and use them throughout the mm initialisation.
Signed-off-by: Russell King <rmk@arm.linux.org.uk>

Updates to the wbsd driver.
                                                                                
* Fix to handle DAT3 card detection.
* Fixed bug which could cause large writes to stall in FIFO mode.
* Plug 'n Play support. In most cases you need ACPI PNP for this to work.
* Uses generic DMA API (ISA dependency removed).