Please merge this patch.  I've had two success reports from it.
Putback comment can be:

  Fixes some long-standing cdc-acm bugs including:
  - Oopsing
  - Probe messages not so excessive
  - Makes /proc/bus/usb/devices show both interface claims
  - Now cdc_acm won't hotplug for Ethernet devices (or RNDIS)

* ax8817x_set_multicast - use address of dev->data, not contents
* ax8817x_write_async_cmd - free request and urb if submit fails

I'm doing an audit wrt copy_to_user leaking info to userspace, started
with drivers/usb, please apply.

into home.osdl.org:/home/torvalds/v2.5/linux

into samba.org:/home/anton/ppc64/for-linus-ppc64

into samba.org:/home/anton/ppc64/for-linus-ppc64

into samba.org:/stuff/paulus/kernel/for-linus-ppc64

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

Fix breakage in reiserfs/procfs.c iterator.

Nikita had ACKed the patch.

From ramon_garcia_f@yahoo.com:

 "I am experiencing lost interrupts when writting (but not when reading)
  to an IOMEGA Zip drive with the ATAPI floppy driver.

  The driver seems to be aware of the problem and has a workaround for
  it.  Unfortunately my drive is not detected as an IOMEGA drive.  The
  reason is that the model of my drive is "IOMEGA ZIP 100 ATAPI Floppy"
  instead of "IOMEGA ZIP 100 ATAPI", that is what the driver expects. "

From: William Lee Irwin III <wli@holomorphy.com>

So call it rather than testing its address...

It is using token pasting in ways which confuse gcc-2.9x.

From: "Alexey Dobriyan" <adobriyan@mail.ru>,
      Andreas Gruenbacher <agruen@suse.de>

Make local variable `count' an integer so the subsequent test for
negativeness makes sense.

From: "Randy.Dunlap" <rddunlap@osdl.org>

Fix a permanent resource leak and also some resource leaks on error paths.

From: Alex Tomas <alex@clusterfs.com>

The setting of i_disksize can race against concurrent invokations of
ext3_get_block().  Moving this inside i_truncate_sem fixes it up.

From: William Lee Irwin III <wli@holomorphy.com>

The forward static declaration in a header is a) weird and b) generates a
warning if the inline function which needs it is not expanded.

Move these things from .h into .c

From: Yury Umanets <umka@namesys.com>

Fix the reiserfs Kconfig URLs.

From: Zwane Mwaikambo <zwane@arm.linux.org.uk>

The swapon code uses read_cache_page() to access the swap header, so the
filesystem had better implement it.

From: Michael Still <mikal@stillhq.com>

The attached patch corrects case sensitivity in the mandocs make target.
XML is case insensitive, and a bunch of the kernel-doc assumes this.  The
makeman and splitman scripts incorrectly cared about case.  This patch also
updates the Docbook DTD version which the script generates.

From: James Morris <jmorris@redhat.com>

This patch adds a file to the root selinuxfs directory which returns the
security policy version associated with the currently running kernel.  Its
purpose is to allow scripts to determine which version of policy to load.

From: Roger Luethi <rl@hellgate.ch>

__might_sleep prints warnings only after jiffies wrap (typically after 5
minutes of uptime).

From: Felipe W Damasio <felipewd@terra.com.br>

Check the return of copy_from_user in a few places to not use buggy
structures if copy_from_user != 0.  Found by smatch.

From: viro@parcelfarce.linux.theplanet.co.uk

* drivers/block/initrd.c gone

* chunk of memory where the current tree would look for intird image is
  checked for being a valid initramfs image first; then, it is either
  unpacked (in addition to normal built-in image) or, if it wasn't a valid
  image, copied into a regular file on rootfs called /dev/initrd.  Then
  memory is freed.

Result:

a) we can put initramfs image in place of initrd one and kernel will DTRT.

b) initrd images still work as usual; code that shoves the thing to
   ramdisk, etc.  doesn't care whether it reads from a block device or
   regular file.

c) initrd.c is gone, so is fake block device and a lot of irregularities
   with it.

It has been in -mm for almost two weeks with no reported problems.

into nuts.ninka.net:/disk1/davem/BK/net-2.5

into nuts.ninka.net:/disk1/davem/BK/sparc-2.5

vm86 mode does a copy_to_user from the general protection fault handler
to update the process' vm86 state.

The problem is that the full GFP handler runs with interrupts off
currently and that trips the might_sleep() test in copy_to_user().

This happens very often in dosemu and once in a while while the X server
does its vm86 magic with the VGA bios. 

See

	http://bugzilla.kernel.org/show_bug.cgi?id=1339

for details

This patch fixes this by enabling interrupts when the original code ran
with interrupts on or ran in vm86 mode (vm86 can clear the IF flag)

Don't assume the APIC is at the power-on default address,
since the BIOS can have moved it somewhere else without
really ever telling us (ie we have an MP table or ACPI
that fixes it for us, but those are not always available)

hwif->ide_dma_on() was is in the wrong place in the mode tuning helper
and was also called for devices which do not support IORDY flow control
(such as CompactFlash cards).