The line that IMHO triggers the bug is this:

"writecount += usblp->writeurb->transfer_buffer_length;"

It uses "usblp->writeurb->transfer_buffer_length" before initializing it,
assuming that it will be zero on the first run. If it is not zero, but instead
random *negative* garbage from memory, the loop will start printing endless data
from user-space data.

[USB] EHCI updates

Update periodic schedule scanning
	- fix shutdown sometimes-hangs (Bernd Porr)
	- resolve the "whole frame at once" FIXME
	- try harder to avoid rescanning
	- don't delegate interrupt qh handling to a buggy helper routine
	- describe more of the relevant iso tuning parameters

One-liners:
	- URB_NO_INTERRUPT hint affects ISO
	- show correct data toggle in sysfs debug files
	- FIXME is resolved by Linus' 20msec delay

Move ide-dma.c:__ide_dma_off() outside of #ifdef CONFIG_BLK_DEV_IDEDMA_PCI,
so it can be used for all DMA capable hosts.  Remove ide_hwif_t->ide_dma_off.

->ide_dma_count() was introduced in kernel 2.5.35 and was meant to add support
for host FIFO counters (for VDMA), but is only a wrapper for ->ide_dma_begin()
(even for siimage.c b/c SIIMAGE_VIRTUAL_DMAPIO is undefined).

Moreover it should be possible to add VDMA code directly to ->ide_dma_begin().

Use __ide_dma_{good,bad}_drive() directly and remove these wrappers.

I see only pros of removing OnStream support:
 - SCSI osst.c driver is actively maintained by Willem Riede <wrlk@riede.org>
 - there is no functionality loss (OnStream IDE drives don't support DSC)
 - ide-tape.c driver is too ugly & complicated even without OnStream support
 - long term benefits (2.7.x plans on unifying storage drivers)

From: Willem Riede <wrlk@riede.org>

From: Glenn Wurster <gwurster@scs.carleton.ca>

This fixes a small merge error in aty128fb resulting in a compile
failure. 

From: James Morris <jmorris@redhat.com>

The patch below fixes an error handling flaw, where we need to return a
Netfilter verdict from the function rather than a standard error code.

From: James Morris <jmorris@redhat.com>

The avc_init function is only called during kernel init, so it can be
marked with __init.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch changes the mode bits on the selinuxfs enforce node so that
non-root processes can read it.  This is necessary to allow non-root
userspace policy enforcers to check the enforcing flag upon a permission
failure as well.  A process must still have the appropriate SELinux
permission in order to read the node.

From: James Morris <jmorris@redhat.com>

devfs is passing an empty string to do_mount when it expects a page.

From: James Morris <jmorris@redhat.com>

This patch implements context mount support within SELinux.

Three new mount options are provided:

context=%s
  Label the entire filesystem with the specified security context during
  mount and change the labeling behavior to 'mountpoint labeling'.  The
  /proc/self/attr/fscreate attribute will be ignored for file creation on
  the filesystem, although policy-specified transitions will still work
  normally.  This also sets the aggregate filesystem security context.

fscontext=%s
  Set the label of the aggregate filesystem to the specified security
  context, so that SELinux policy controls over the filesystem itself may
  be reinstated.  Only works for filesystems without EA labeling support,
  and is not valid if 'context' has been specified.

defcontext=%s
  Set the default security context for files created in this filesystem to
  the specified security context (as opposed to the current global default).
  Only works for filesystems without EA labeling support, and is not
  valid if 'context' has been specified.

To set the context or fscontext options, the security policy must specify
appropriate permissions for the filesystem relabelfrom and filesystem
relabelto controls.  For the defcontext option, the filesystem relablefrom
and filesystem assoicate controls are invoked.

The security mount options are parsed out and stripped from the normal
mount option data so that no normal filesystems need to be aware of them.

Filesystems with binary mount option data (e.g. NFS, SMBFS, AFS, Coda)
need to be handled as special cases: only NFS is supprted at this stage
per the previous patch.

From: James Morris <jmorris@redhat.com>

This patch modifies the kernel's NFS mount data structure to include SELinux
context mount data.  It allows NFS fileystems to be labeled on a
per-mountpoint basis, and should not affect existing versions of userspace
mount.

(A patch to the userspace mount code is available at
http://people.redhat.com/jmorris/selinux/context_mounts/)

From: James Morris <jmorris@redhat.com>

This series of patches adds support for SELinux 'context mounts', which
allows filesystems to be assigned security context information at mount time.
 For example, some filesystems do not support extended attributes (e.g.  NFS,
vfat), and this feature allows security contexts to be assigned to them on a
per-mountpoint basis.  It is also useful when the existing labeling on a
filesystem is untrusted or unwanted for some reason (e.g.  removable media),
and needs to be overridden with a safe default.

The first patch below consists of infrastructure changes to the kernel:

- A new LSM hook has been added, sb_copy_data, which allows the security
  module to copy security-specific mount data once the superblock has been
  setup by the filesystem.

- The sb_kern_mount hook has been modified to take this security data as a
  parameter, and would typically be used at that point to configure the
  security parameters of the filesystem being mounted.

- Allocation and freeing of the security data has been implemented in the
  core fs code as it is cleaner than trying to do it purely via LSM hooks,
  and should make maintenance easier.  This code will be compiled away if LSM
  is not enabled.

This fixes pSeries LPAR (logical partitioned) machines.  We weren't
initialising the pci_dma_ops stuff.

This updates the PowerMac-only platinumfb driver to use the new mac-io
device infrastructure.  It also switch allocation to the new
framebuffer_alloc/release and fix a couple of bugs.

This adds a limit on how much of the framebuffer is ioremap'ed by
radeonfb, thus enabling it to work with 128Mb VRAM or more on an x86
with 900Mb of lowmem in the linear mapping.

It also adds a significant amount of debug messages and adds a CONFIG
option to enable the debugging output, that should help with diagnosing
new problems. Among others, it dumps the connector info as I understand
them (so far, they give "strange" informations on laptops, I need more
data on more various laptops to see if there's a pattern I can really use
to figure out on which connector the LVDS is)

Regarding the "lid closed at boot", ultimately, we may want to default
to the VGA output in those cases, though I'm not sure what logic to use
here. Maybe we could standardize some way for the platform to provide
this "environment" information to the driver, but i wouldn't rely on it.

More reliably, if we can find out that there is an LVDS output, and
LVDS is disabled, just ignore the flat panel...

We could assume any mobility chip has LVDS, which is true, but that would
still cause a problem for laptops with an additional DVI output (only
Macs so far afaik).

This should merge up the final piece of the ppc32/64 saga: the mac
PowerMac MACE and Airport network drivers.

Both of them are ported to the mac-io infrastructure, all probe code
rewritting & cleaned up, better error handling & resource management.

flat-panel displays.

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Fix proper detection of the "noaccel" command line argument for
new radeonfb so we can boot without acceleration. Useful when
diagnosing an accel-related problem.

Somebody has been watching lord of the rings a bit too
much.. "My precioussssss.."

From Peter Osterlund <petero2@telia.com>

This code only ends up being used when all else fails,
so probably very few people actually ever saw this.

into home.osdl.org:/home/torvalds/v2.5/linux

The RFCOMM TTY code don't leak reference counting, because the TTY layer
will call the ->close() method even if open fails and the reference count
is decreased there.

Patch from David Woodhouse <dwmw2@infradead.org>

You can still build the old driver, but it doesn't work unless you also
enable it like this..

This makes fbcon ask for notification of events from fbdev to deal with
suspend/resume (stop cursor on suspend, refresh screen on resume).
Could probably do more (like dealing better with the cursor timer), but
this simple implementation works fine enough for now.

This adds some "state" information for power management to fbdev's,
along with a notifier mecanism to inform clients of state changes.  It
also "uses" this mecanism in the function fb_set_suspend() which was an
empty placeholder previously, and "shields" various places that access
the HW when state isn't running.  (It's best to not call them in the
first place, but the current state of fbcon makes that _very_ difficult)

This updates the aty128fb driver.  It adds more PCI IDs, uses the new
framebuffer alloc/release functions, make BIOS PLL data access more
reliable (using ROM whenever possible, with a fallback to RAM BIOS
image), cleanup the Power Management stuff (get rid of PowerMac specific
stuffs, use real PCI ones instead), along with some style cleanups

This removes the broken locking code in the pixmaps, and rewrite the
buffer access function to properly call fb_sync when needed.  The old
broken loocking is useless as we are covered by the console semaphore in
all cases hopefully (except if I missed one :)

This fixes the fbdev ioctl's and fbcon cursor management with the
console semaphore, which is the best we can do at this point in 2.6,
thus fixing a bunch of races where we could have, for example, tried to
blit while changing mode, etc..

Independently from the other fbdev updates I'm cooking (some of them
will be in your mailbox rsn), this fixes an error in parameter passing
to a function in rivafb (only used on ppc) that could cause an oops and
definitely causes a warning at compile time.

From: Keith M Wesolowski <wesolows@foobazco.org>

As of 2.6.3, restore_flags will no longer modify cwp on sparc.
Therefore you can apply this patch to the locking guide.

[ Indeed.  I'll also remove the atomic comments from Hacking
  Guide as part of my revision there when I get back to it.  --RR ]

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux