into smfhome.smfdom:/home/stevef/bk/linux-2.5cifs

into hostme.bitkeeper.com:/repos/c/cifs/linux-2.5cifs

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Brad Spengler <spender@grsecurity.net> found an exploitable bug in the proc handler
of cpufreq, where a user-supplied unsigned int is cast to a signed int and then
passed on to copy_[to|from]_user() allowing arbitary amounts of memory to be written
(root only thankfully), or read (as any user).

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2004-0228 to this issue.

From Dominik.

One big limitation of the ACPI specification is that it's impossible to
detect the current P-State by reading from ACPI-defined registers. And the
CPU isn't always at P0 when the system boots. So, try to "guess" the current
P-State by analyzing cpu_khz.

From Dominik.

If used as a bootparam, this would've become powernow-k7.powernow_acpi_force which looks silly.

Spotted by Charles Coffing <ccoffing@novell.com>

This updates the lkkbd driver to it's current version.

It also incorporates two patches suggested on LKML (fixing
some leading whitespace and an unneccessary check).

This  updates the vsxxx driver to it's current version.

Even DEC tablet support (VSXXX-AB) is now tested - it works:)
You can even hotplug between mouse and digitizer...

This patch is needed due to other patches that were applied in parallel
with the inclusion of the iSeries virtual ethernet driver.

From: Pavel Roskin <proski@gnu.org>

The "ide-cs" module cannot be unloaded because it uses obsolete
MOD_INC_USE_COUNT and MOD_DEC_USE_COUNT macros.  In fact, they are not
needed in ide-cs.c in 2.6 kernels.  The generic PCMCIA code already
increases use count for every device served by the driver, so it's
impossible to unload the ide-cs driver while it's in use.

I was told that the removal of IDE interfaces may be unsafe in 2.6
kernels.  However, MOD_INC_USE_COUNT only prevents removal of the module,
not the interface.  It's also the first obstacle, albeit a trivial one,
for anybody debugging those problems (i.e. loading a modified module
requires "rmmod -f" or reboot to unload the old version).

From: Arthur Othieno <a.othieno@bluewin.ch>

From: Pavel Roskin <proski@gnu.org>

If I eject IDE CompactFlash card, I get a stack dump from
devfs_remove() because ide/host2/bus0/target0/lun0 doesn't exist.

After del_gendisk() is called from idedisk_cleanup() drive->devfs_name refers
to a non-existent directory and should be erased, so that ide_unregister()
doesn't try to remove that directory again.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This cset adds minimal support for ARM Ltd's ARM926EJ-S "Versatile"
platform.

As Arjan points out, the patch does exactly the opposite
of what it was claimed to do.

Andrea: tssk tssk.

Cset exclude: akpm@osdl.org[torvalds]|ChangeSet|20040421144431|15930

From: Yury Umanets <torque@ukrpost.net>

I have found small inconsistency in loop_set_fd().  It checks if
->sendfile() is implemented for passed block device file.  But in fact,
loop back device driver never calls it.  It uses ->sendfile() from backing
store file.

From: William Lee Irwin III <wli@holomorphy.com>

i386 does hardware interpretation of pagetables, so pte_clear() can't be
used on present ptes, as it sets the upper half of the hugepte prior to
setting the lower half (which includes the valid bit).  i.e.  there is a
window where having a hugepage mapped at 56GB and doing pte_clear() in
unmap_hugepage_range() allows other threads of the process to see a
hugepage at 0 in place of the original hugepage at 56GB.

This patch corrects the situation by using ptep_get_and_clear(), which
clears the lower word of the pte prior to clearing the upper word.

There is another nasty where huge_page_release() needs to wait for TLB
flushes before returning the hugepages to the free pool, analogous to the
issue tlb_remove_page() and tlb_flush_mm() repair.

From: Andrea Arcangeli <andrea@suse.de>

Arrange for ioctl(FBIOPUTCMAP) to do copy_to_user() rather than memcpy.

From: Andrea Arcangeli <andrea@suse.de>

Correctly range-check an incoming-from-userspace argument.  Found by the
Stanford checker.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch removes a hardcoded policy assumption from the get_user_sids logic
in the SELinux module that was preventing it from returning contexts that had
the same type as the caller even if the policy allowed such a transition.  The
assumption is not valid for all policies, and can be handled via policy
configuration and userspace rather than hardcoding it in the module logic.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch adds a kernel configuration option that enables writing to a new
selinuxfs node 'disable' that allows SELinux to be disabled at runtime prior
to initial policy load.  SELinux will then remain disabled until next boot.
This option is similar to the selinux=0 boot parameter, but is to support
runtime disabling of SELinux, e.g.  from /sbin/init, for portability across
platforms where boot parameters are difficult to employ (based on feedback by
Jeremy Katz).

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes the behavior of security_context_to_sid in the no-policy
case so that it simply accepts all contexts and maps them to the kernel SID
rather than rejecting anything other than an initial SID.  The change avoids
error conditions when using SELinux in permissive/no-policy mode, so that any
file contexts left on disk from prior use of SELinux with a policy will not
cause an error when they are looked up and userspace attempts to set contexts
can succeed.

From: Marcel Holtmann <marcel@holtmann.org>

This patch adds the needed compat ioctl's for the CAPI on 64bit platforms.

From: Christoph Hellwig <hch@lst.de>

This patch makes the device mapper use the new freeze_bdev/thaw_bdev
interface.  Extracted from Chris Mason's patch.

From: Christoph Hellwig <hch@lst.de>

Remove all the code now in the VFS, make XFS's freeze ioctls use the new
infastructure and reorganize some code.

This code needs some work so the source files shared with 2.4 aren't
exposed to the new VFS interfaces directly.  You'll get an update once this
has been discussed with the other XFS developers and is implemented.  Note
that the current patch works fine and I wouldn't complain if it gets into
Linus' tree as-is.

From: Chris Mason <mason@suse.com>

reiserfs_write_super_lockfs() is supposed to wait for the transaction to
commit.

From: Christoph Hellwig <hch@lst.de>

These are the generic lockfs bits.  Basically it takes the XFS freezing
statemachine into the VFS.  It's all behind the kernel-doc documented
freeze_bdev and thaw_bdev interfaces.

Based on an older patch from Chris Mason.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

We've had trouble with this driver, it appears to work but the hardware
never does the final reboot.  I have yet to come across someone with a
board which works and don't have personal access to one.  So how about
scrapping the whole thing.

populate_rootfs() is called rather early - before we've called init_idle().

But populate_rootfs() does file I/O, which involves calls to cond_resched(),
and downing of semaphores, etc.  If it scheules, the scheduler emits
scheduling-while-atomic warnings and sometimes oopses.

So run populate_rootfs() later, after the scheduler is all set up.

From: Marc-Christian Petersen <m.c.p@kernel.linux-systeme.com>

Solar Designer discovered an information leak in the ext3 code of Linux.
In a worst case an attacker could read sensitive data such as cryptographic
keys which would otherwise never hit disk media.  Theodore Ts'o developed a
correction for this.