From: Dave Olien <dmo@osdl.org>

acked by npiggin.

From: Nikita Danilov <Nikita@Namesys.COM>

shrink_list() checks PageSwapCache() before calling add_to_swap(), this
means that anonymous page that is going to be added to the swap right
now these checks return false and:

 (*) it will be unaccounted for in nr_mapped, and

 (*) it won't be written to the swap if gfp_flags include __GFP_IO but
     not __GFP_FS.

(Both will happen only on the next round of scanning.)

Patch below just moves may_enter_fs initialization down. I am not sure
about (*nr_mapped) increase though.

From: Andi Kleen <ak@suse.de>

When the user gave an address hint in mmap use it as starting point for the
search for !MAP_FIXED.

Currently it is only checked directly and when already used the free area
cache is used as starting point.  With this change you can use mmap(4096,
....) to e.g.  get the lowest free address in your address space, which is
sometimes useful.  For example on x86-64 glibc wants to preferably allocate
thread local data in the first 4GB but use higher addresses when this is
not possible.

This can be a bit more costly in CPU time because it may have to skip over
more VMAs, but gives better semantics for most cases.  Most programs pass
NULL as hint anyways so it won't make any difference for them.

I did it for the generic mmap and for x86-64 for now.  Also minor white
space fixes for x86-64.

From: Jes Sorensen <jes@trained-monkey.org>

nr_free_pages() is expensive, especially on large SMP machines.  The patch
changes the memory overcommit code so that it only calls nr_free_pages() is
we're about to fail the allocation attempt.

From: Jens Axboe <axboe@suse.de>

It's from Pascal Schmidt and adds write protect handling to ide-cd along
with support for non-2kb block sizes.

From: Maneesh Soni <maneesh@in.ibm.com>

The patch fixes locking in proc_check_root().  It brings is_subdir() call
under vfsmount_lock.  Holding vfsmount_lock will ensure mnt_mountpoint
dentry is intact and the dentry does not go away while it is being checked
in is_subdir().

From: Maneesh Soni <maneesh@in.ibm.com>

o The following patch fixes is_subdir() races with d_move. Due to concurrent
  d_move, in is_subdir() we can end up accessing freed d_parent pointer in
  case of pre-emptible kernel. To avoid this we can use rcu_read_lock() and
  rcu_read_unlock().

o This also fixes the seqlock uses in is_subdir() as we need to restart the
  the inner loop with the origianl new_dentry passed to the routine in case
  of any rename occured while we are traversing d_parent links.

From: Andrew Zabolotny <zap@homelink.ru>

ac97_unregister_driver() is nulling out the ->driver field for all codecs.
It should only null the codecs which are using this driver.

From: Pratik Solanki <pratik.solanki@timesys.com>

I came across this C standards issue while cross-compiling the Linux kernel
with gcc on Solaris.  The file gen_crc32table.c uses the non-standard type
u_int32_t.  It's possible that the host machine's sys/types.h does not
define u_int32_t.  The attached patch replaces u_int32_t with the POSIX
standard uint32_t and includes POSIX inttypes.h instead of sys/types.h.

From: Bjorn Helgaas <bjorn.helgaas@hp.com>
      Anders Gustafsson <andersg@0x63.nu>
      Roman Zippel <zippel@linux-m68k.org>

This patch fixes menuconfig so it can display help text for individual
choice group config entries.

Previously it would only display the help text attached to the "choice"
item.  There was no way to display the help attached to individual config
entries inside the choice group.  Typically, the "choice" item has no help
text, and all the useful help is attached to the individual entries, so
this was a bit of a problem.

From: George Anzinger <george@mvista.com>,
      Petri Kaukasoina <kaukasoi@elektroni.ee.tut.fi>

btime in /proc/stat does not stay constant but decreases at a rate of 15
secs/day, because we're assuming that HZ is exactly 100.  Use the correct
adjustments to fix that up.

From: George Anzinger <george@mvista.com>

The time conversion code is erroring on the side of a bit too small.  The
attached patch forces any error to be on the high side.  The current code will
convert 1 nanosecond to zero jiffies (standard says that should be 1).  It also
is around 1 nanosecond late on each roll to the next jiffie.

I have done some error checks with this patch applied and get the following
errors in PPB ( Parts Per Billion):

HZ     nano sec conversion     microsecond conversion
1000    315                      45
1024    227                      40
100     28                       317

In all cases the error is on the high side, which means that the final shift
will, most likely, eliminate the error bits.

From: GOTO Masanori <gotom@debian.or.jp>

Teach ufs_fill_super() to honour the `silent' parameter.

reiserfs places its superblock in weird places which can result in false
positives and various printks when other filesystems probe a resierfs
filesystem.

From: Mike Waychison <Michael.Waychison@Sun.COM>

The attached patch ensures that we grab vfsmount_lock when grabbing a
reference to mnt_parent in follow_up and follow_dotdot.

We also don't need to access ->mnt_parent in follow_mount and
__follow_down to mntput because we already the parent pointer on the stack.

From: Mike Waychison <Michael.Waychison@Sun.COM>

- protect vfsmount->mnt_parent by taking vfsmount_lock in __d_path

From: "Randy.Dunlap" <rddunlap@osdl.org>
      Leann Ogasawara <ogasawara@osdl.org>

Patch inserts missing iounmap() on error.

From: "Randy.Dunlap" <rddunlap@osdl.org>

From: Leann Ogasawara <ogasawara@osdl.org>

Patch inserts missing iounmap's on error and also removes unnecessary
iounmap's.

From: Marcus Alanen <maalanen@ra.abo.fi>

The copy_tree() function can return NULL, so this checks for it.

From: Philippe Elie <phil.el@wanadoo.fr>

Unless I miss something this look like a typo, one user reported to get
error from the daemon: 'Unknown event for counter 1' (alpha ev6) and the
behavior was better but not completly sane after trying this patch: he get
spurious event for counter 1 when enabling only counter 0 but rarely now.
No alpha box to test this.

From: Philippe Elie <phil.el@wanadoo.fr>

In a ring buffer controlled by a read and write positions we can't use
buffer_size but only buffer_size - 1 entry, the last free entry act as a
guard to avoid write pos overrun.  This bug was hidden because the writer,
oprofile_add_sample(), request one more entry than really needed.

From: Sam Ravnborg <sam@ravnborg.org>,
      Ben Collins <bcollins@debian.org>

Fix up the console makefiles and logo generation.

1) To make output look like the rest of the kernel build.

2) To avoid make utilising chained rules, and therefore issuing a 'rm
   drivers/video/logo/linux_logo.c ...' during the build.

I have previously submitted a few patches for logo/Makefile, but this is the
first one that actually address the problems I have seen in a proper way.

And no, I did not like such a simple thing to look that complicated, the
other option was to list too many files or to use other types of kbuild/make
magic.

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      "Maciej Soltysiak" <solt@dns.toxicfilms.tv>

C99 initializers for linux/sound.

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      Domen Puncer <domen@coderock.org>

From: "Randy.Dunlap" <rddunlap@osdl.org>,
      Domen Puncer <domen@coderock.org>

Noone tested that code to see if it really works?

From: Jamie Lokier <jamie@shareable.org>

One of the tests in unqueue_me() is redundant.  If we acquire the spinlock,
the futex must be queued.

From: James Morris <jmorris@redhat.com>

Here's a patch which zeroes the last byte of the mount option data copied
from userspace during mount(2).

For filesystems which parse mount options as strings (the majority), lack
of a zero terminator could cause the page to be overrun.  The source code
comments specify that the maximum size of the mount data is PAGE_SIZE-1, so
this patch will not affect any valid binary-formatted mount data.

From: George Anzinger <george@mvista.com>

- Removes C++ comment in favor of C style.

- Removes the special treatment for MIPS SIGEV values.  We only require
  (and error if this fails) that the SIGEV_THREAD_ID value not share bits
  with the other SIGEV values.  Note that mips has yet to define this value
  so when they do...

- Corrects the check for the signal range to be from 1 to SIGRTMAX
  inclusive.

- Adds a check to verify that kmem_cache_alloc() actually returned a timer,
  error if not.

- Fixes a bug in timer_gettime() where the incorrect value was returned if
  a signal was pending on the timer OR the timer was a SIGEV_NONE timer.

From: timothy parkinson <t@timothyparkinson.com>

Seems like a lot of people see the below error message, but aren't quite
sure why it happens or how to fix it.  I sure didn't.  Here's my attempt at
remedying that.

From: Sam Ravnborg <sam@ravnborg.org>

During raid6 compilation with KBUILD_VERBOSE unset we see invokations of
perl commands which should not have been displayed.

From: "Martin J. Bligh" <mbligh@aracnet.com>

This patch removes memblks from the kernel ...  we don't use them, and the
NUMA API that was planning to use them when they were originally designed
isn't going to use them anymore.  They're just unnecessary added complexity
now ...  time for them to go.

There's a slight complication in that ia64 uses something with a similar
name for part of its memory layout, but Jes Sorensen kindly untangled them
from each other for us.  The patch with his modifications is below.  Jes
tested it on ia64, and I testbuilt it with every config in my arsenal.

From: Andrey Panin <pazke@donpac.ru>

support for SIIG made serial/parallel conbo cards was moved to
parport_serial driver some months ago, but their PCI ids still remain in
parport_pc PCI device table.  Attached patch removes them.

From: Neil Brown <neilb@cse.unsw.edu.au>

If programs like mount use /proc/partitions to find filesystems based on
labels, then surely we want md devices in there as they often contain
filesystems.

If the problem is that mount-by-label takes forever with removable media
then surely the "right" approch is the following patch, and then actually
set this flag on the "floppy.c" device.  (It is already set for ide-floppy
and sd devices).

From: NeilBrown <neilb@cse.unsw.edu.au>

Instead of using ("md%d", mdidx(mddev)), we now use ("%s", mdname(mddev))
where mdname is the disk_name field in the associated gendisk structure.
This allows future flexability in naming.

From: NeilBrown <neilb@cse.unsw.edu.au>

Update {read,write}{s,_sectors} on each request to an MD array.

From: NeilBrown <neilb@cse.unsw.edu.au>

This patch thanks to Paul Clements <Paul.Clements@SteelEye.com> and only has
effect if md is compiled with #define DEBUG 1

From: NeilBrown <neilb@cse.unsw.edu.au>

A RAID superblock can indicate which minor number the array should be
assembled under.  As this is only meaningful when doing auto-start, we move
the test for it being in the valid range to the place where auto-start
happens.  When an array is started any other way, it doesn't matter what
value is here.

From: viro@parcelfarce.linux.theplanet.co.uk

bernhard_heibler@gmx.de has discovered that NFS is very slow when writing to
a file which has execute permissions.  See

	http://bugme.osdl.org/show_bug.cgi?id=1936

This patch fixes remove_suid() to not try to modify the inode mode on every
write to such a file.

From: Petr Vandrovec <vandrove@vc.cvut.cz>


Arjan van de Ven pointed out to me there are no checks on name component
lengths in ncpfs, so potentially 4KB regions could be allocated on stack,
leading to the user controlled stack overflow.

It was using variable-sized arrays, so this snuck past the static
stack-usage checking tools.

As NCP is limited to 255 bytes on components, we can simple limit these
local variables to 256 bytes, and after this stack usage looks more
acceptable.  Length checking occurs inside ncp_vol2io, during
iocharset->codepage conversion.

As a side effect support for multibyte codepages now works as it should,
instead of returning -EINVAL whenever filename in 'codepage' encoding was
longer than in 'iocharset'.

Other part fixes typo where atime change updated ctime and not atime field.

Fat chance, but we should try.