Dave Kleikamp <shaggy@austin.ibm.com> points out a race between
nobh_prepare_write() and end_buffer_read_sync().  end_buffer_read_sync()
calls unlock_buffer(), waking the nobh_prepare_write() thread, which
immediately frees the buffer_head.  end_buffer_read_sync() then calls
put_bh() which decrements b_count for the already freed structure.  The
SLAB_DEBUG code detects the slab corruption.

We fix this by giving nobh_prepare_write() a private buffer_head end_o
handler which doesn't touch the buffer's contents after unlocking it.

From: Eric Sandeen <sandeen@sgi.com>

Several functions in buffer.c are using unsigned long where they should be
using sector_t.

Also, use pgoff_t in several places so it is easier to tell what is beingused
as a pagecache index, what is being used as a disk index and what is being
used as an offset-into-page.

If a large pci_alloc_consistent() GFP_ATOMIC allocation fails this driver's
recovery code will call emu10k1_wavein_close() far earlier than it should: it
goes splat in emu10k1_timer_uninstall().

Fix it by simply removing that call: we haven't allocated any resources yet
anyway.

Note that one of the callers of emu10k1_wavein_open(), emu10k1_audio_read()
will sit there stupidly retrying the open.  But it has a sleep in there so
something might eventually give way.

From: Markus Lidel <Markus.Lidel@shadowconnect.com>

drivers/message/i2o/i2o_block.c:

 - corrected the initialization sequence of the request queues.

 - added initialization to queue spinlocks.

 - release device in i2o_scan because else the device could not be queried.

 - i2o_block event threads wait on signal KILL but signal TERM was sent.

drivers/message/i2o/i2o_core.c:

 - set the HRT length to 0 at initialization, to avoid calling free on
   unallocated memory.

 - i2o_core event threads wait on signal KILL but signal TERM was sent.

 - added a limit of 3 tries to get the HRT from the controller.

 - removed the dpt parameter, which was used to force DPT controllers get
   handled by the i2o driver.  Now all available i2o controllers will be
   handled by this driver.

drivers/message/i2o/i2o_scsi.c:

 - beautifying of printk calls.

 - added scsi_unregister to properly clean up on module unload.

drivers/message/i2o/Kconfig:

 - added help for i2o_block and i2o_scsi to describe the differences between
   the two drivers.

include/linux/i2o-dev.h:

 - cleaned typo "tate" into "state".

include/linux/i2o.h:

 - removed defines from i2o_block and insert it here.

(Acked by Alan)

From: Gerd Knorr <kraxel@bytesex.org>

This patch fixes a bug in the v4l1-compat module and makes it pass the
correct buffer type to the v4l2 driver on VIDIOC_STREAM(ON|OFF) ioctls.

From: Arjan van de Ven <arjanv@redhat.com>

From: Chris Mason <mason@suse.com>

find_group_other looks buggy for ext2 and ext3 in 2.6, it can cause -ENOSPC
errors when the fs has plenty of free room.

To hit the bug, you need a filesystem where:

parent_group has no free blocks (but might have free inodes) Every other
group with free inodes has no free blocks.

That gets you down to the final linear search in find_group_other.  The
linear search has two bugs:

group = parent_group + 1; means we start searching at parent_group + 2
because the loop increments group before using it.

for(i = 2 ; i < ngroups ; i++) means we don't search through all the
groups.

The end result is that parent_group and parent_group + 1 are not checked
for free inodes in the final linear search.  ext3 has the same problem.

From: Andreas Kies <andikies@t-online.de>

Fix improperly handled 16 bit sample size.  If you use an odd number of
bytes in 16 bit mode the driver fails to work.

In file included from drivers/misc/ibmasm/uart.c:27:
include/linux/serial_core.h: In function `uart_handle_dcd_change':
include/linux/serial_core.h:407: `TASK_INTERRUPTIBLE' undeclared (first use in this function)

From: Christoph Hellwig <hch@lst.de>

sleep_on hurts my eyes and this offender is compltely unused, so..

From: Arnd Bergmann <arnd@arndb.de>

This use of deprecated struct initializers was hidden behind macro magic
and has appearantly not been noticed before.

From: "Jim Gifford" <maillist@jg555.com>

Prevent initrd from being built if ram device is built as a module.

From: "Randy.Dunlap" <rddunlap@osdl.org>

From: Tony Breeds <tony@bakeyournoodle.com>

It fixes 3 places where the ioctl returns positives instead of negatives.
I've gotten feedback from the maintainer (Rogier Wolff (sp?) and he has no
objections.

From: Arnd Bergmann <arnd@arndb.de>

The wrong argument in put_compat_timespec is marked const, causing
unnecessary compiler warnings.

From: David Gibson <david@gibson.dropbear.id.au>

Converts the mm_context_t on ppc64 to be a struct.  This lets us separate
the low_hpages flag into a separate field rather than folding it into the
actual context id.  That makes things neater, since the flag is
conceptually separate and has, for example, should be propogate across a
fork whereas the context ID obviously isn't.  The mm_context_id is the only
place to put arch-specific information in the mm_struct.

This patch will also make some interesting extensions to the hugepage
support much easier, such as allowing dynamic resizing of the hugepage
address space, or using special pagetables for hugepages.

From: Stephen Rothwell <sfr@canb.auug.org.au>

This patch adds the virtual cdrom driver for PPC64 iSeries.

From: Stephen Rothwell <sfr@canb.auug.org.au>

This patch declares iSeries_vio_dev in an include file and includes it where
necessary.  It also fixes arch/ppc64/kernel/mf.c to use the generic dma API
with iSeries_vio_dev.

From: Olof Johansson <olof@austin.ibm.com>

Below patch makes xmon survive a softreset invokation (and quite likely
invocations because of other traps as well).

From: Gerd Knorr <kraxel@suse.de>

Current gcc's error out if a function's declaration and definition disagree
about the register passing convention.

The patch adds a new `fastcall' declatation primitive, and uses that in all
the FASTCALL functions which we could find.  A number of inconsistencies were
fixed up along the way.

From: Jakub Bogusz <qboosh@pld-linux.org>

drivers/sbus/char/vfc_dev.c: In function `vfc_mmap':
drivers/sbus/char/vfc_dev.c:623: error: dereferencing pointer to incomplete type

From: Joe Thornber <thornber@redhat.com>

Remove the version-1 ioctl interface.

From: "J. Bruce Fields" <bfields@fieldses.org>

I've done some testing with 2.6.4-rc1.  It looks fine, except that one
critical patch got dropped somewhere along the way, without which
rpcsec_gss will oops.

We've changed gss_get_mic to write mic in place instead of kmalloc'ing new
memory for it; change must also be reflected in server side code.

Here's a fix for an obvious typo in changeset
neilb@cse.unsw.edu.au|ChangeSet|20040305155724|31191
that was causing ESTALE errors galore on my NFS testrig.

This fixes a problem with creating symlinks, a few fields in the
inode/dentry were left uninitialized.

into ppc970.osdl.org:/home/torvalds/v2.5/linux

SGI Modid: xfs-linux:xfs-kern:167948a

SGI Modid: xfs-linux:xfs-kern:167980a

The code initializing the "high" BATs on CPUs like the 750FX got
broken when copied over from 2.4. This cause random problems with
machines using those CPUs (iBook 2s typically).

into ppc970.osdl.org:/home/torvalds/v2.5/linux

Sparse noticed a bunch of mismatched prototypes in the new syscalls.h file
when compiling net/socket.c  Whilst most of them are just missing __user
tags, the last argument of sys_socketpair was completely different.

into kernel.bkbits.net:/home/davem/net-2.6

into ppc970.osdl.org:/home/torvalds/v2.5/linux

into ppc970.osdl.org:/home/torvalds/v2.5/linux

WRT 2.4, Ed Vance put this fix into 2.4:

 According to the data sheet, the OX16PCI952 has port 0 in BAR0 and
 port 1 in BAR1. (unlike the OX16C954, BTW) The 921600 base baud value
 is your oscillator rate divided by the default oversample rate, 16.

Since 2.6 PCI IDs have been updated to use the real device ID for
this part, we really should include this fix as well.

If a serial port is hung up using vhangup() with HUPCL cleared (so
DTR isn't dropped), and then re-opened, we don't want to drop the
DTR line.  This occurs during the login process, and dropping DTR
would cause a modem to hang up.

I didn't yet use one of my AFAVLAB boards with 2.6.x until now.  The
upper 4 ports are not detected at all.  I suppose the bug was
introduced while porting the driver from 2.4.x.

Please consider applying the following patch.  It also adds support
for a new 8 port board called P030.