into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The generic and IA-64 versions of alloc_zeroed_user_highpage() don't
check the return value from alloc_page_vma().  This can lead to an oops
if we're OOM.

This fixes my oops on PPC64, but I haven't got an IA-64 machine/compiler
handy.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Noticed by Denis V. Lunev <den@asplinux.ru> and based upon
original patch by Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

Description: Use msleep() instead of schedule_timeout() to guarantee the task
delays as expected. Change the units of the two constants to be msecs and secs
respectively.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Description: Use ssleep() instead of schedule_timeout() to guarantee the task
delays as expected. The first two replacements use TASK_INTERRUPTIBLE but do not
check for signals, so ssleep() should be appropriate.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Description: Use msleep() instead of schedule_timeout() to guarantee the task
delays as expected. The current code uses TASK_INTERRUPTIBLE, but does not
respond to signals, so msleep() should be ok.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch removes xfrm_export.c and moves the EXPORT_SYMBOL{,_GPL}'s to 
the files where the actual functions are.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Make the code more readable by only flipping the specific
bits that need to change each register write.

Signed-off-by: Grant Grundler (grundler@parisc-linux.org)
Signed-off-by: David S. Miller <davem@davemloft.net>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Lennert Buytenhek

Fix two typos in arch/arm/mm/tlb*.S

Signed-off-by: Lennert Buytenhek
Signed-off-by: Russell King

arch/ia64/kernel/mca_asm.S is treating per_cpu__ia64_mca_data as the
start of the mca data, instead of as a pointer to the mca data.  It
ends up overwriting the rest of the per cpu area with the MCA stack and
bspstore.  Since we dereference ia64_mca_data several times, make it a
macro.
Signed-off-by: Keith Owens <kaos@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into starflyer.(none):/foo/airlied/bitkeeper/drm-latest

Close a race which could allow for privilege escalation by users with DRI
privileges on Radeon hardware.  Essentially, a malicious program could submit
a packet containing an offset (possibly in main memory) to be rendered from/to,
while a separate thread switched that offset in userspace rapidly between a
valid value and an invalid one.  radeon_check_and_fixup_offset() would pull the
offset in from user space, check it, and spit it back out to user space to be
copied in later by the emit code.  It would sometimes catch the bad value, but
sometimes the malicious program could modify it after the check and get an
invalid offset rendered from/to.

Fix this by allocating a temporary buffer and copying the data in at once.
While here, make the cliprects stuff not do the VERIFYAREA_READ and
COPY_FROM_USER_UNCHECKED gymnastics, avoiding a lock order reversal on FreeBSD.
Performance impact is negligible  -- no difference on r200 to ~1% improvement on
rv200 in quake3 tests (P4 1Ghz, demofour at 1024x768, n=4 or 5)

From: Eric Anholt <anholt@freebsd.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

Bug fd.o 2489
Reporter: Aapo Tahkola <aet@rasterburn.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

The attached patch adds documentation for the behaviour of the no-MMU mmap.
Signed-Off-By: David Howells <dhowells@redhat.com>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>

The attached patch does two things:

 (1) We no longer check the return value of file->f_op->get_unmapped_area()
     unless we actually called it. We know addr is zero otherwise because
     we'd've given an error earlier if it wasn't.

 (2) If -ENOSYS was returned by that operation, then we assume we actually
     called a driver (such as the framebuffer driver) that might want to
     invoke the operation in a lower level driver (such as matroxfb) if one
     exists, and that it found that one didn't.

     We translate the -ENOSYS error into -ENODEV - the error we would have
     given if the operation was not supplied in the file ops.

     Doing this permits us an opportunity for arch_get_unmapped_area() or
     something else to be called if we want that to happen, particularly in
     the MMU case.
Signed-Off-By: David Howells <dhowells@redhat.com>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>

More of the Guninski "copy_to_user() takes a size_t" series.

Write access cannot safely be allowed as NFS doesn't support append, but read
access should be ok.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

As readdir returns the reply in a separate page, the cache code cannot find
the reply (and it would probably be too big anyway) so flag readdir for NOCACHE
Signed-off-by: Olaf Kirch <okir@suse.de>
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

If we detect an overlap, we set a flag and wait for a wakeup.  When requests
are handled, if the flag was set, we perform the wakeup.

Note that the code currently in -mm is badly broken.  With this patch applied,
it passes tests the use O_DIRECT to cause lots of overlapping requests.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

copy_data currently loops over bio's in a list, but the caller also does the
same looping, sometimes with extra work.  So remove the loop from copy_data.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

If the resync checkpoint for an array is at the end of the array, It doesn't
get set to MAX_SECTOR, so resyncing will be retried.  By updating curr_resync
early, this problem is fixed.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- set ->devfs_name
- create initial devfs names slightly differently so
  as not to conflict
- re-read partition table when an array is assembled at boot
  time - not sure why this is needed, but it is.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

hot_add_disk and hot_remove_disk check mddev->pers before proceeding.
set_disk_faulty should too.
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- off-by-one error
- missing recalc of checksum
Signed-off-by: Neil Brown <neilb@cse.unsw.edu.au>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kernel.bkbits.net:/home/davem/sparc-2.6

The qlogic driver complains about the use of smp_processor_id() in
preemptible code.  And it's right.

But it's just for an affinity optimisation and we can validly quash the
warning.
Signed-off-by: Andrew Vasquez <andrew.vasquez@qlogic.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch had fixed the following warning.

arch/mips/lib-32/dump_tlb.c: In function 'dump_tlb':
arch/mips/lib-32/dump_tlb.c:69: warning: control may reach end of non-void function 'msk2str' being inlined

This patch adds return value, when page size is not match.
Signed-off-by: Yoichi Yuasa <yuasa@hh.iij4u.or.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We presently deadlock in low-latency mode because the receive code holds
port.lock while calling into the tty code to perform echoing.  The tty code
calls back into the driver, which then takes port.lock.

Fix that by dropping the lock around the echo call.
Acked-by: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Add the missing "lock" prefix in switch_to macro.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Frank Fricke reported that hostfs does not verify that a chmod +s, for
instance, is done by a sufficiently privileged user, as long as the UML
kernel itself can complete the operation on the host.

So, for instance, if UML is run as root and under /mnt/host we have a hostfs
mount, this works successfully:

paolo@zion:~ (0)$ chmod 4755 /mnt/host/bin/bash
paolo@zion:~ (0)$ ll /mnt/host/bin/bash

 -rwsr-xr-x  1 root root 662724 2004-10-20 02:15 /mnt/host/bin/bash*

(bash refuses running as setuid, but you could have another shell on the
host, as dash or whatever).

In general, if UML is run as uid 500 on the host, a hostfs mount is done
and under the hostfs mount there is a file with uid 500 on the host, I can
freely make it setuid (if it's executable).

This is especially bad when UML is run as root (which you should not do),
but is a problem in general, since it allows any user to create setuid 500
(in this example) executables on the host filesystem.

Finally, while I was looking at the chmod() implementation, I spotted a
kludge in the code and explained it with a comment.
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Frank 'xraz' Fricke <xraz@rwxr-xr-x.de>
Cc: Alexander Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Descend into arch/um/kernel/skas/util during make clean.
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When a task is put to sleep, it is dequeued from the runqueue while it is
still running.  The problem is that one some arches that have non-atomic
scheduling, the runqueue lock can be dropped and retaken in schedule() before
the task actually schedules off, and wait_task_inactive did not account for
this.
Signed-off-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix for resume on i850. Maybe for i855GM.

Signed-off by: Nigel Cunningham <ncunningham@linuxmail.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>