into ppc970.osdl.org:/home/torvalds/v2.6/linux

- Modify fs/ntfs/ntfs_readdir() to copy the index root attribute value
  to a buffer so that we can put the search context and unmap the mft
  record before calling the filldir() callback.  We need to do this
  because of NFSd which calls ->lookup() from its filldir callback()
  and this causes NTFS to deadlock as ntfs_lookup() maps the mft record
  of the directory and since ntfs_readdir() has got it mapped already
  ntfs_lookup() deadlocks.
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>

into cantab.net:/home/src/ntfs-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into starflyer.(none):/home/airlied/drm/drm-2.6

and/or d->send_sizes.  When these functions are called from gamma_dma,
these pointers are user pointers and are thus not safe to deref.  This patch
copies over the pointers inside gamma_dma_priority and
gamma_dma_send_buffers.
Submitted-by: Robert T. Johnson <rtjohnso@eecs.berkeley.edu>
Signed-off-by: Dave Airlie <airlied@linux.ie>

This bug took forever to debug (just ask Ben :-).

When we move the completion event from the failed request to the sense
request, we risk either the initial complete and then later complete on
a long gone ->waiting.  I think this business of moving the completion
structure to the request sense is a bit bogus and always has been, and
the bug is fixed nicely by just rewriting this logic a bit.  So instead
we simply unconditionally dequeue the failed request (regardless of
whether it was REQ_PC or REQ_BLOCK_PC), and pass a reference to it in
the sense request.  When the sense completes, we call end io on the
originally failed request (which does the complete() etc).
Signed-off-by: Jens Axboe <axboe@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into cantab.net:/home/src/ntfs-2.6

With the old DRM interface, the devname was set in DRM(setunique),
but with the current DRM interface >=1.1 the devname is not being
set in DRM(set_busid).

From: Alan Swanson
Approved-by: Dave Airlie <airlied@linux.ie>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@redhat.com>

into nuts.davemloft.net:/disk1/BK/sparc-2.6

dup_mmap() unnecessarily tries to account for memory of the vma's it has
created if it fails in the middle.

However, that's pointless (and wrong), since the exit_mmap() path called
through mmput() will do so anyway in the failure path.

Just remove the bogus un-accounting code.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Add __user annotations to kernel/sysctl.c to satisfy sparse
for !CONFIG_SYSCTL, !CONFIG_PROC_FS.
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It puts two 2kB temp areas on the stack, which is
guaranteed to overflow a 4kB stack if that path
is ever taken.

Both marked in the source, and both should be easy
to fix but need testing.

Found by Jörn Engel.

From: Herbert Xu <herbert@gondor.apana.org.au>

The recent change to vga16fb's memory mapping that you partially reverted
is still broken.  In particular, it's setting fix.mem_start to a virtual
address on i386.  The value of fix.mem_start is meant to be physical.

We could simply apply virt_to_phys to it, but somehow I doubt that is what
it's meant to do on arm.  So until we hear from someone who knows how it
works on arm, let's just revert this change.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Randy Dunlap <rddunlap@osdl.org> points out that sparse warns about the test
of an undefined preprocessor identifier.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andy Whitcroft <apw@shadowen.org>

The sysctl interfaces for updating the uts entries such as hostname and
domainname are using the wrong length for these buffers; they are hard
coded to 64.  Although safe, this artifically limits the size of these
fields to one less than the true maximum.  This generates an inconsistency
between the various methods of update for these fields.

# hostname 12345678901234567890123456789012345678901234567890123456789012345
hostname: name too long
# hostname 1234567890123456789012345678901234567890123456789012345678901234
# hostname
1234567890123456789012345678901234567890123456789012345678901234

# sysctl -w kernel.hostname=1234567890123456789012345678901234567890123456789012345678901234567890
kernel.hostname = 1234567890123456789012345678901234567890123456789012345678901234567890
# hostname
123456789012345678901234567890123456789012345678901234567890123
#

The error originates from the fact the handler for strings (proc_dostring)
already allows for the string terminator.  This patch corrects the limit,
taking the oppotunity to convert to use of sizeof().
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: john stultz <johnstul@us.ibm.com>

In testing for SLES9, we ran across a bug caused by userspace apps poking
the PIT which caused bad values to be read by the kernel.  This would then
trigger the lost tick detection code with insane values and would then
break the SCSI subsystem.

This patch includes the PIT sanity check from the TSC timesource into the
cyclone timesource code, which catches the bad case described above and
resolves the issue.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: "Anil" <anil.s.keshavamurthy@intel.com>

We don't need lock_cpu_hotplug()/unlock_cpu_hotplug for singlethreaded
workqueues.
Signed-off-by: Anil Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

This patch adds support for 6 system call arguments on s390.  The first
exploiter of this will be the sys_futex system call for the
FUTEX_CMP_REQUEUE operation.  The idea is simple: use register %r7 for the
6th argument.  This can be extended to 7/8/9/...  arguments if there ever
will be the need for it.  To call the system call function in the kernel
the additional arguments needs to get stored on the stack.  8 bytes are
added to the head of struct pt_regs.  %r7 is stored to the additional field
for all system calls.  The store is hidden in a
address-generation-interlock slot, it doesn't slow down the system call
path.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Jens Axboe <axboe@suse.de>

cdrom_has_defect_mgt() has the same ->data_len bug - the length field is
not total length, but the length following that field.  So it should be +
4, not + 8.  However, just kill the length check.  Comparison of
feature_code provides enough check.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: NeilBrown <neilb@cse.unsw.edu.au>

This condtion on this loop is primarily to avoid the loop if it doesn't
appear to be needed.  However it optimises a little too much and there is a
case where it skips the loop when it is really needed.  This patch fixes
it.

This is the raid6 version of the recent raid5 resync bugfix.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

Recent syscall stubs cleanup broke alpha, as it has its own version of
sys_rt_sigaction().  This defines __ARCH_WANT_SYS_RT_SIGACTION for all
architectures except alpha, sparc and sparc64.
Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andi Kleen <ak@suse.de>

UDF spews out lots of debugging information by default.  Disable that,
since it doesn't make too much sense for a production kernel.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andi Kleen <ak@suse.de>

This printk is printed by genericarch when your machine is no es7000.  Most
people don't care about that.  Remove it.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Francois Romieu <romieu@fr.zoreil.com>

- just say no to numbered labels;
- pci_enable_device can fail so setup_pci_dev() must return a value;
- propagate existing error codes when possible in do_pci_device()
- missing pci_disable_device here and there. 
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Peter Korsgaard <jacmet@sunsite.dk>

Vertical retrace is in lines, not pixels.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We need to take journal_lock_updates() while remounting r/o to prevent a new
transaction starting while journal_flush() is running.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Christoph Hellwig <hch@lst.de>

drivers/block/paride/epat.c support two slightly different protocol
variants.  Currently it's compile-time selected by CONFIG_PARIDE_EPATC8,
but this patch adds a epatc8 module option to allow runtime selection.
CONFIG_PARIDE_EPATC8 stays for now but I'd like to kill it int 2.7.

The basic patch is from the Debian kernel package (Author unknown) but I
reworked it a bit.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The ____cacheline_aligned in there is a leftover from before the existence of
the percpu infrastructure.  It bloats struct page_state and structures which
contain it enormously, and we use these things on the stack deep in page
reclaim.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Chris Mason <mason@suse.com>

There's a small window where the filesystem can be unmounted during
writeback_inodes.  The end result is the iput done by sync_sb_inodes could
be done after the FS put_super and and the super has been removed from all
lists.

The fix is to hold the s_umount sem during sync_sb_inodes to make sure
the FS doesn't get unmounted.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Stephen Rothwell <sfr@canb.auug.org.au>

This patch removes the archdata and driver_data members of struct vio_dev
and uses the platform_data and driver_data members of the embedded struct
device instead.  I also declared a couple of routines static.

This is part of a work in progress.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Olaf Hering <olh@suse.de>

The binutils check is bogus, it doesnt work with the just released
binutils.  A space is needed in the error message.

pomegranate:~# echo dssall | /usr/bin/as -o /tmp/x
{standard input}: Assembler messages:
{standard input}:1: Error: Unrecognized opcode: `dssall'
pomegranate:~# /usr/bin/as -v
GNU assembler version 2.15.91.0.1 (powerpc-suse-linux) using BFD version 2.15.91.0.1 20040527 (SuSE Linux)

*** 2.6 kernels no longer buildcorrectly with old versions of binutils.
*** Please upgrade your binutils to 2.12.1 or newer
make: *** [checkbin] Error 1
make: Target `all' not remade because of errors.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: "Anil" <anil.s.keshavamurthy@intel.com>

In flush_workqueue() for a single_threaded_worqueue case the code flushes the
same cpu_workqueue_struct for each online_cpu.

Change things so that we only perform the flush once in this case.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix a problem discovered by Jeff Mahoney <jeffm@suse.com>, based on an initial
patch from Chris Mason <mason@suse.com>.

journal_get_descriptor_buffer() is used to obtain a regular old buffer_head
against the blockdev mapping.  The caller will populate that bh by hand and
will then submit it for writing.

But there are problems:

a) The function sets bh->b_state nonatomically.  But this buffer is
   accessible to other CPUs via pagecache lookup.

b) The function sets the buffer dirty and then the caller populates it and
   then it is submitted for I/O.  Wrong order: there's a window in which the
   VM could write the buffer before it is fully populated.

c) The function fails to set the buffer uptodate after zeroing it.  And one
   caller forgot to mark it uptodate as well.  So if the VM happens to decide
   to write the containing page back __block_write_full_page() encounters a
   dirty, not uptodate buffer, which is an illegal state.  This was generating
   buffer_error() warnings before we removed buffer_error().

   Leaving the buffer not uptodate also means that a concurrent reader of
   /dev/hda1 could cause physical I/O against the buffer, scribbling on what
   we just put in it.

   So journal_get_descriptor_buffer() is changed to mark the buffer
   uptodate, under the buffer lock.

I considered changing journal_get_descriptor_buffer() to return a locked
buffer but there doesn't seem to be a need for this, and both callers end up
using ll_rw_block() anyway, which requires that the buffer be unlocked again.

Note that the journal_get_descriptor_buffer() callers dirty these buffers with
set_buffer_dirty().  That's a bit naughty, because it could create dirty
buffers against a clean page - an illegal state.  They really should use
mark_buffer_dirty() to dirty the page and inode as well.  But all callers will
immediately write and clean the buffer anyway, so we can safely leave this
optimising cheat in place.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Spotted by Randy Dunlap - don't try to return something from a void-returning
function.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>