From: Philippe Elie <phil.el@wanadoo.fr>

If drain_array_locked() is passed the `force' command, it must go in and
empty the head array.

This driver has a global list of devices which has no locking.

If the driver fails partway through probing, the recovery code will call
ac97_release_codec(NULL), which oopses.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch fixes a bug in the SELinux module by adding a check of the
filesystem labeling behavior value obtained from the policy.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch fixes a bug in the SELinux access vector cache code, which was
incorrectly using spin_lock_irq rather than spin_lock_irqsave for the
avc_log_lock.  As this code can be called from hardirq (e.g.  from the
file_send_sigiotask hook), we need irqsave/restore here.

From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>

ioctx_alloc() leaks an mm->mm_count ref on an error path.

From: Sean Estabrooks <seanlkml@rogers.com>

- fix space at end of line in config files;

- add error check on put_user(); (Daniele Bellucci <bellucda@tiscali.it>)

- add missing Kconfig piece for ikconfig;

From: Oliver Xymoron <oxymoron@waste.org>

Currently, a writepage() which detects that it is writing outside i_size (due
to concurrent truncate) will abandon the write, returning -EIO.

The return value will bogusly cause an error to be recorded in the
address_space.  So convert all those writepage() instances to return zero in
this case.

From: Oliver Xymoron <oxymoron@waste.org>

This patch just saves a few bytes in the inode by turning mapping->gfp_mask
into an unsigned long mapping->flags.

The mapping's gfp mask is placed in the 16 high bits of mapping->flags and
two of the remaining 16 bits are used for tracking EIO and ENOSPC errors.

This leaves 14 bits in the mapping for future use.  They should be accessed
with the atomic bitops.

From: Oliver Xymoron <oxymoron@waste.org>

These patches add the infrastructure for reporting asynchronous write errors
to block devices to userspace.  Error which are detected due to pdflush or VM
writeout are reported at the next fsync, fdatasync, or msync on the given
file, and on close if the error occurs in time.

We do this by propagating any errors into page->mapping->error when they are
detected.  In fsync(), msync(), fdatasync() and close() we return that error
and zero it out.


The Open Group say close() _may_ fail if an I/O error occurred while reading
from or writing to the file system.  Well, in this implementation close() can
return -EIO or -ENOSPC.  And in that case it will succeed, not fail - perhaps
that is what they meant.


There are three patches in this series and testing has only been performed
with all three applied.

From: mikep@csd.uu.se

There has been a number of problem reports about local APIC
interacting badly with ACPI on P4s due to the P4 local APIC
force-enable change in 2.5.74,

This patch reverts the 2.5.74 patch, so if the BIOS disables
the local APIC on a P4, we don't enable it by default any more.

The rescue the situation for those P4 systems where the local
APIC _can_ be enabled safely, I've added two kernel parameters
that can be used to override broken BIOSen:
- "nolapic" prevents the kernel from enabling or using the local
  APIC. This is stronger than listing a machine in the DMI scan
  blacklist, since it also works for machines that boot with the
  local APIC already enabled.
- "lapic" tells the kernel to force-enable the P4 local APIC if
  the BIOS disabled it. I haven't changed the logic for P6/K7
  family processors, so we still force-enable those unless
  "nolapic" was passed to the kernel.

The patch also includes a cleanup: the dont_use_local_apic_timer
flag variable is not set any more since 2.5.74, so it's removed.

From: Eric Valette <eric.valette@free.fr>

The following patch integrated in 2.5.74,

<http://lists.insecure.org/lists/linux-kernel/2003/Jun/5840.html>

really enables the APIC even if BIOS disabled it. Unfortunately,
enabling APIC really does not seem to work on this ASUS laptop and ACPI
(which is mandatory) crash the kernel in ACPI code at boot time while
"Executing all Devices _STA and_INIT methods"

Unless someones find a bug in ACPI code related to APIC management, It
is safer to add this machine in the DMI black list (along with DELL,
IBM, ...).

So, as suggested by the author of the problematic change, I added and
entry in the DMI black list. But my guess is that most laptop will soon
be present in this list....

From: Ernie Petrides <petrides@redhat.com>

(I can't get anyone to review this, but I'm sure there's a bug in there, and
Ernie's patch has been in -mm for some time).


There is a long-standing locking hole in the kernel's handling of the
signals related to stopping and resuming processes.  When a process
handles SIGSTOP, SIGTSTP, SIGTTIN, or SIGTTOU, the "sighand" lock is
held while the signal is dequeued and appropriate masks are updated.
But the "sighand" lock is dropped in several cases before the task's
state is changed to TASK_STOPPED (or before a group-stop is initiated).

If a process running on another cpu posts a SIGCONT or SIGKILL just after
the "victim" process releases the lock but before its state is set to
TASK_STOPPED, the corresponding wakeup will be lost and the victim will
remain stopped despite the successive SIGCONT or SIGKILL.  In this case,
a repeated posting of SIGCONT or SIGKILL will have no effect, since the
original one is already pending (and so causes a repeated posting to be
discarded).  The occurrence of a SIGSTOP/SIGKILL race where the victim
has blocked all other signals will result in an unkillable process.

Although a fabricated test program can reproduce a SIGSTOP/SIGCONT race
hang in less than a minute (on a 2-cpu Dell Precision 450), the scenario
that has been most frequently encountered is a hang during reboot or
shutdown.  This occurs because /sbin/killall5 brackets the scanning of
/proc/* and associated signal posting to (most) of the processes still
running with kill(-1, SIGSTOP) and kill(-1, SIGCONT) calls to temporarily
freeze every process except for "init".  Occasionally, its parent (running
the /etc/rc6.d/S01reboot shell script) gets stuck in TASK_STOPPED state
with pending SIGCONT and SIGCLD signals, but with no other process left
to wake it up.

In order to fix the race condition, the locking in do_signal_stop()
and get_signal_to_deliver() needed reworking to close the hole.  Due
to lock ordering issues between the "sighand" lock and tasklist_lock,
there are two cases where the former lock needs to be released and
then reacquired, thus allowing a tiny hole for a SIGCONT/SIGKILL to
be posted.  These two cases are resolved by rechecking for a pending
SIGCONT/SIGKILL after the locks are (re)acquired in the proper order.

Anyone wanting a copy of the test program may e-mail me off-list.

From: Andi Kleen <ak@suse.de>

POSIX says si_band in siginfo_t must be long. glibc uses this, except
for Alpha.

This type must be correct on little endian machines, otherwise
Konqueror does not get any events from dnotity for created/deleted files.

Currenly asm-generic/siginfo.h uses int, which is wrong.

This patch adds a new macro __ARCH_SI_BAND_T which is int for alpha
and long for everybody else. This makes the type on x86-64 come out
correctly

into home.osdl.org:/home/torvalds/v2.5/linux

1) Add another card to the PCMCIA card database.
2) Fix a bug in wireless extensions.
3) Remove extra code for compilation without the firmware loader
4) force-enable CRC32 and FW_LOADER in Kconfig.

It wants big endian vlan tags.  IEEE, or just weird?

into home.osdl.org:/home/torvalds/v2.5/linux

on NCAPINTS value found in include/asm-i386/cpufeature.h.

into redhat.com:/garz/repo/misc-2.6

From: William Lee Irwin III <wli@holomorphy.com>

Contributions from:
	Jan Dittmer <jdittmer@sfhq.hn.org>
	Arnd Bergmann <arnd@arndb.de>
	"Bryan O'Sullivan" <bos@serpentine.com>
	"David S. Miller" <davem@redhat.com>
	Badari Pulavarty <pbadari@us.ibm.com>
	"Martin J. Bligh" <mbligh@aracnet.com>
	Zwane Mwaikambo <zwane@linuxpower.ca>

It has ben tested on x86, sparc64, x86_64, ia64 (I think), ppc and ppc64.

cpumask_t enables systems with NR_CPUS > BITS_PER_LONG to utilize all their
cpus by creating an abstract data type dedicated to representing cpu
bitmasks, similar to fd sets from userspace, and sweeping the appropriate
code to update callers to the access API.  The fd set-like structure is
according to Linus' own suggestion; the macro calling convention to ambiguate
representations with minimal code impact is my own invention.

Specifically, a new set of inline functions for manipulating arbitrary-width
bitmaps is introduced with a relatively simple implementation, in tandem with
a new data type representing bitmaps of width NR_CPUS, cpumask_t, whose
accessor functions are defined in terms of the bitmap manipulation inlines.
This bitmap ADT found an additional use in i386 arch code handling sparse
physical APIC ID's, which was convenient to use in this case as the
accounting structure was required to be wider to accommodate the physids
consumed by larger numbers of cpus.

For the sake of simplicity and low code impact, these cpu bitmasks are passed
primarily by value; however, an additional set of accessors along with an
auxiliary data type with const call-by-reference semantics is provided to
address performance concerns raised in connection with very large systems,
such as SGI's larger models, where copying and call-by-value overhead would
be prohibitive.  Few (if any) users of the call-by-reference API are
immediately introduced.

Also, in order to avoid calling convention overhead on architectures where
structures are required to be passed by value, NR_CPUS <= BITS_PER_LONG is
special-cased so that cpumask_t falls back to an unsigned long and the
accessors perform the usual bit twiddling on unsigned longs as opposed to
arrays thereof.  Audits were done with the structure overhead in-place,
restoring this special-casing only afterward so as to ensure a more complete
API conversion while undergoing the majority of its end-user exposure in -mm.
 More -mm's were shipped after its restoration to be sure that was tested,
too.

The immediate users of this functionality are Sun sparc64 systems, SGI mips64
and ia64 systems, and IBM ia32, ppc64, and s390 systems.  Of these, only the
ppc64 machines needing the functionality have yet to be released; all others
have had systems requiring it for full functionality for at least 6 months,
and in some cases, since the initial Linux port to the affected architecture.

Kernul proggrammers cant spel.

This cleans up ioport.c to use BITS_PER_LONG, sizeof, and so on.  This
makes it easier to spot the differences that matter, and thus easier to
find bugs.

will stand up and un-break them.

It's still broken, but now the silly warnings no longer hide
the _real_ problems in this file.

into home.osdl.org:/home/torvalds/v2.5/linux

Here is a batch of C99 initialisers for sound/oss.