Merge branch 'akpm' (fixes from Andrew)

Merge misc fixes from Andrew Morton.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  alpha: boot: fix build breakage introduced by system.h disintegration
  memcg: initialize kmem-cache destroying work earlier
  Randy has moved
  ksm: fix m68k build: only NUMA needs pfn_to_nid
  dmi_scan: fix missing check for _DMI_ signature in smbios_present()
  Revert parts of "hlist: drop the node parameter from iterators"
  idr: remove WARN_ON_ONCE() on negative IDs
  mm/mempolicy.c: fix sp_node_init() argument ordering
  mm/mempolicy.c: fix wrong sp_node insertion
  ipc: don't allocate a copy larger than max
  ipc: fix potential oops when src msg > 4k w/ MSG_COPY

13 files changed, 26 insertions, 34 deletions

diff --git a/CREDITS b/CREDITS
index 948e0fb9a70e..78163cb3eb6a 100644
--- a/CREDITS
+++ b/CREDITS
@@ -953,11 +953,11 @@ S: Blacksburg, Virginia 24061
 S: USA
 
 N: Randy Dunlap
-E: rdunlap@xenotime.net
-W: http://www.xenotime.net/linux/linux.html
-W: http://www.linux-usb.org
+E: rdunlap@infradead.org
+W: http://www.infradead.org/~rdunlap/
 D: Linux-USB subsystem, USB core/UHCI/printer/storage drivers
 D: x86 SMP, ACPI, bootflag hacking
+D: documentation, builds
 S: (ask for current address)
 S: USA
 
diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
index c379a2a6949f..aa0c1e63f050 100644
--- a/Documentation/SubmittingPatches
+++ b/Documentation/SubmittingPatches
@@ -60,8 +60,7 @@ own source tree.  For example:
 "dontdiff" is a list of files which are generated by the kernel during
 the build process, and should be ignored in any diff(1)-generated
 patch.  The "dontdiff" file is included in the kernel tree in
-2.6.12 and later.  For earlier kernel versions, you can get it
-from <http://www.xenotime.net/linux/doc/dontdiff>.
+2.6.12 and later.
 
 Make sure your patch does not include any extra files which do not
 belong in a patch submission.  Make sure to review your patch -after-
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index e8a6aa473bab..6e953564de03 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -170,5 +170,5 @@ Reminder: sizeof() result is of type size_t.
 Thank you for your cooperation and attention.
 
 
-By Randy Dunlap <rdunlap@xenotime.net> and
+By Randy Dunlap <rdunlap@infradead.org> and
 Andrew Murray <amurray@mpc-data.co.uk>
diff --git a/arch/alpha/boot/head.S b/arch/alpha/boot/head.S
index b06812bcac83..8efb26686d47 100644
--- a/arch/alpha/boot/head.S
+++ b/arch/alpha/boot/head.S
@@ -4,6 +4,7 @@
  * initial bootloader stuff..
  */
 
+#include <asm/pal.h>
 
         .set noreorder
         .globl  __start
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 982f1f5f5742..4cd392dbf115 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -442,7 +442,6 @@ static int __init dmi_present(const char __iomem *p)
 static int __init smbios_present(const char __iomem *p)
 {
         u8 buf[32];
-        int offset = 0;
 
         memcpy_fromio(buf, p, 32);
         if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
@@ -461,9 +460,9 @@ static int __init smbios_present(const char __iomem *p)
                         dmi_ver = 0x0206;
                         break;
                 }
-                offset = 16;
+                return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
         }
-        return dmi_present(buf + offset);
+        return 1;
 }
 
 void __init dmi_scan_machine(void)
diff --git a/ipc/msg.c b/ipc/msg.c
index 950572f9d796..31cd1bf6af27 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -820,15 +820,17 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
         struct msg_msg *copy = NULL;
         unsigned long copy_number = 0;
 
+        ns = current->nsproxy->ipc_ns;
+
         if (msqid < 0 || (long) bufsz < 0)
                 return -EINVAL;
         if (msgflg & MSG_COPY) {
-                copy = prepare_copy(buf, bufsz, msgflg, &msgtyp, &copy_number);
+                copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax),
+                                    msgflg, &msgtyp, &copy_number);
                 if (IS_ERR(copy))
                         return PTR_ERR(copy);
         }
         mode = convert_mode(&msgtyp, msgflg);
-        ns = current->nsproxy->ipc_ns;
 
         msq = msg_lock_check(ns, msqid);
         if (IS_ERR(msq)) {
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index ebfcbfa8b7f2..5df8e4bf1db0 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -117,9 +117,6 @@ struct msg_msg *copy_msg(struct msg_msg *src, struct msg_msg *dst)
         if (alen > DATALEN_MSG)
                 alen = DATALEN_MSG;
 
-        dst->next = NULL;
-        dst->security = NULL;
-
         memcpy(dst + 1, src + 1, alen);
 
         len -= alen;
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index 25d3d8b6e4e1..8eaed9aa9cf0 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -131,7 +131,7 @@ static int smpboot_thread_fn(void *data)
                         continue;
                 }
 
-                //BUG_ON(td->cpu != smp_processor_id());
+                BUG_ON(td->cpu != smp_processor_id());
 
                 /* Check for state change setup */
                 switch (td->status) {
diff --git a/lib/idr.c b/lib/idr.c
index 73f4d53c02f3..00739aaf95a2 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -569,8 +569,7 @@ void idr_remove(struct idr *idp, int id)
         struct idr_layer *p;
         struct idr_layer *to_free;
 
-        /* see comment in idr_find_slowpath() */
-        if (WARN_ON_ONCE(id < 0))
+        if (id < 0)
                 return;
 
         sub_remove(idp, (idp->layers - 1) * IDR_BITS, id);
@@ -667,15 +666,7 @@ void *idr_find_slowpath(struct idr *idp, int id)
         int n;
         struct idr_layer *p;
 
-        /*
-         * If @id is negative, idr_find() used to ignore the sign bit and
-         * performed lookup with the rest of bits, which is weird and can
-         * lead to very obscure bugs.  We're now returning NULL for all
-         * negative IDs but just in case somebody was depending on the sign
-         * bit being ignored, let's trigger WARN_ON_ONCE() so that they can
-         * be detected and fixed.  WARN_ON_ONCE() can later be removed.
-         */
-        if (WARN_ON_ONCE(id < 0))
+        if (id < 0)
                 return NULL;
 
         p = rcu_dereference_raw(idp->top);
@@ -824,8 +815,7 @@ void *idr_replace(struct idr *idp, void *ptr, int id)
         int n;
         struct idr_layer *p, *old_p;
 
-        /* see comment in idr_find_slowpath() */
-        if (WARN_ON_ONCE(id < 0))
+        if (id < 0)
                 return ERR_PTR(-EINVAL);
 
         p = idp->top;
diff --git a/mm/ksm.c b/mm/ksm.c
index 85bfd4c16346..b6afe0c440d8 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -489,7 +489,7 @@ out:		page = NULL;
  */
 static inline int get_kpfn_nid(unsigned long kpfn)
 {
-        return ksm_merge_across_nodes ? 0 : pfn_to_nid(kpfn);
+        return ksm_merge_across_nodes ? 0 : NUMA(pfn_to_nid(kpfn));
 }
 
 static void remove_node_from_stable_tree(struct stable_node *stable_node)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 53b8201b31eb..2b552224f5cf 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3012,6 +3012,8 @@ void memcg_update_array_size(int num)
                 memcg_limited_groups_array_size = memcg_caches_array_size(num);
 }
 
+static void kmem_cache_destroy_work_func(struct work_struct *w);
+
 int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
 {
         struct memcg_cache_params *cur_params = s->memcg_params;
@@ -3031,6 +3033,8 @@ int memcg_update_cache_size(struct kmem_cache *s, int num_groups)
                         return -ENOMEM;
                 }
 
+                INIT_WORK(&s->memcg_params->destroy,
+                                kmem_cache_destroy_work_func);
                 s->memcg_params->is_root_cache = true;
 
                 /*
@@ -3078,6 +3082,8 @@ int memcg_register_cache(struct mem_cgroup *memcg, struct kmem_cache *s,
         if (!s->memcg_params)
                 return -ENOMEM;
 
+        INIT_WORK(&s->memcg_params->destroy,
+                        kmem_cache_destroy_work_func);
         if (memcg) {
                 s->memcg_params->memcg = memcg;
                 s->memcg_params->root_cache = root_cache;
@@ -3358,8 +3364,6 @@ static void mem_cgroup_destroy_all_caches(struct mem_cgroup *memcg)
         list_for_each_entry(params, &memcg->memcg_slab_caches, list) {
                 cachep = memcg_params_to_cache(params);
                 cachep->memcg_params->dead = true;
-                INIT_WORK(&cachep->memcg_params->destroy,
-                                  kmem_cache_destroy_work_func);
                 schedule_work(&cachep->memcg_params->destroy);
         }
         mutex_unlock(&memcg->slab_caches_mutex);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 31d26637b658..74310017296e 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2390,9 +2390,9 @@ restart:
 
                                 *mpol_new = *n->policy;
                                 atomic_set(&mpol_new->refcnt, 1);
-                                sp_node_init(n_new, n->end, end, mpol_new);
-                                sp_insert(sp, n_new);
+                                sp_node_init(n_new, end, n->end, mpol_new);
                                 n->end = start;
+                                sp_insert(sp, n_new);
                                 n_new = NULL;
                                 mpol_new = NULL;
                                 break;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 74dea377fe5b..de2e950a0a7a 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -655,7 +655,7 @@ static struct p9_trans_module p9_virtio_trans = {
         .create = p9_virtio_create,
         .close = p9_virtio_close,
         .request = p9_virtio_request,
-        //.zc_request = p9_virtio_zc_request,
+        .zc_request = p9_virtio_zc_request,
         .cancel = p9_virtio_cancel,
         /*
          * We leave one entry for input and one entry for response