Move error handling to capture all three possible error conditions on
sending to a full queue.  Without this fix any unprivileged user can
leak arbitrary amounts of kernel memory.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into austin.ibm.com:/shaggy/bk/jfs-2.5

txAbortCommit is broken and fixing it makes it equivalent to txAbort,
so get rid of it and use txAbort instead.

Get a reference count on the the sleeper, so that
it can't possibly go away before we've sent it the
wakeup event.

Noted by Nick Piggin <nickpiggin@yahoo.com.au>
         David Howells <dhowells@redhat.com>

Remove two layers of the fossil record from comments on add_to_page_cache:
2.6.6 moves swapcache handling away, and we long ago stopped masking flags.

Old bug noone seems to have hit, but mremap's pte_unmap dst might be
NULL: would get preempt count wrong even when not DEBUG_HIGHMEM.

This fixes booting on some PPC32 machines, notably CHRP and powermac
machines.  This is a modified version of Tom Rini's patch that addresses
the concerns I had with it.

The problem was that the linker script was getting included in the list
of things that got put together to make some of the sorts of bootable
images that we produce.  This removes ld.script in cases where it wasn't
appropriate and changes the rules in others so that although we have the
dependency on ld.script, it doesn't get included in the list of things
to link.

On PPC64, when we prepare segments below 4G for use with hugepages, we
need to flush their entries from the SLB, in case SLB entries
specifying normal pages were already present.

Previously we did that by flushing the entire SLB, the patch below
changes this to individually flush each necessary segment with slbie.
The new version may well be slightly faster, but the real reason for
it is so that this code path doesn't need to be changed to reinstate
any bolted SLB entries, if we add them.  The existing version has
already caused problems (read, crashes) when combined with some
patches that add bolted SLB entries.

cancel_delayed_work() forgets to clear the workqueue's pending flag.  This
makes the workqueue appear to be permanently busy, so any subsequent attempts
to use it will fail.

into nuts.davemloft.net:/disk1/BK/net-2.6

consistent with the SCTP sockets API draft.

multihomed association.

into kernel.bkbits.net:/home/davem/net-2.6

into nuts.davemloft.net:/disk1/BK/sparc-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The calculation ended up believing we had one less UART than we
really had.  Fix it.

Don't touch the wakee stack after marking it runnable.

"sparse" warns about implicit type conversions that may cause
surprising results. Did you know that large decimal types have
different type conversions from large hexadecimals?

From Christoph Hellwig <hch@lst.de>

If we're ever going to ressurect umsdos it should be a stackable
filesystem..

From: René Scharfe <l.s.r@web.de>

the following patch converts the error handling paths in VFAT fs to use
goto, making it more consistent with other filesystem code. Shrinks the
resulting binary by 144 bytes in my build.

The ->dentry_to_fh() can use the 20 bytes in the case of NFSv2, but
fat_dentry_to_fh() requires 24 bytes by my patch.

So nfsd reply the EOPNOTSUPP to nfs client, then nfs client convert
the unknown error to -EIO.

This patch fixes the problem by pushing the handle data into 20 bytes.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The mcdx.c author had pulled off something absolutely amazing - he had
declared several unsigned variables (ISA port numbers) as void *, using
explicit cast to unsigned in almost all places that used them. 
Exception: printk.  There he proudly used them as pointers - with %3p in
format.  That cute trick allowed him to avoid using %03x, which
apparently scared him for some reason. 

Switched to use of unsigned, killed casts, replaced %3p with %03x in
formats.  BTW, the code had been that way since the initial merge back
in 1.3.7...

This fixes a bug in the ppc64 signal delivery code where the signal
number argument to a signal handler can get corrupted before the handler
is called.  The specific scenario is that a process is in a blocking
system call when two signals get generated for it, both of which have
handlers.

The signal code will stack up two signal frames on the process stack
(assuming the mask for the first signal delivered doesn't block the
second signal) and return to userspace to run the handler for the second
signal.  On return from that handler the first handler gets run with an
incorrect signal number argument because we end up with regs->result
still having a negative value (left over from when the system call was
interrupted) when it should be zero.  This patch sets it to zero when we
set up the signal frame (in three places; for 64-bit processes, and for
32-bit processes for RT and non-RT signals). 

The way we handle signal delivery and signal handler return using the
regs->result field in ppc64 is more complicated than it needs to be.  In
ppc32 I have already simplified it and eliminated use of the
regs->result field.  I am going to do the same in the ppc64 code, but I
think this patch should go in for now to fix the bug. 

The patch also fixes a couple of places where we were unnecessarily and
incorrectly truncating the regs->result value to 32 bits
(sys32_sigreturn and sys32_rt_sigreturn return a long value, as all
syscalls do, and if regs->result is negative we need those syscalls to
return a negative value).

Thanks to Maneesh Soni for identifying the specific circumstances
under which this bug shows up.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kernel.bkbits.net:/home/davem/net-2.6

There is a bug in listening_get_first() which used by /proc/net/tcp*
where it wasn't looping through all the sockets in each hash chain.
This problem doesn't show up unless the first socket in a chain doesn't
match the family that is being looked up.

The following patch fixes this by getting rid of listening_get_first()
altogether.

There's a subtle problem with "inline" usage in <linux/string.h>:

 <linux/string.h>:
        this pulls in __constant_c_and_count_memset()

 <linux/mm.h>:
        this pulls <compiler.h>, re-defining
        inline == __inline__ __attribute__((always_inline)).

 But by now it is too late! The compiler has already seen the bare
 "inline" in string.h, and hasn't inlined it.

Result:

	# grep __constant System.map
	c0144670 t __constant_c_and_count_memset
	c0145c60 t __constant_c_and_count_memset
	... many more copies of this function ...

Fixed by including <compiler.h> early enough.

into hostme.bitkeeper.com:/repos/c/cifs/linux-2.5cifs

into ppc970.osdl.org:/home/torvalds/v2.6/linux