Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.20-r6/0117-2.6.20.17-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.20-r6/0117-2.6.20.17-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1175 - (show annotations) (download)
    Thu Oct 14 12:15:46 2010 UTC (13 years, 6 months ago) by niro
    File size: 53880 byte(s) 
    -2.6.20-alx-r6 new magellan 0.5.2 kernel
    1 diff --git a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
    2 index 10baa35..18c8b67 100644
    3 --- a/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
    4 +++ b/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
    5 @@ -167,11 +167,13 @@ static void do_drv_read(struct drv_cmd *cmd)
    6
    7 static void do_drv_write(struct drv_cmd *cmd)
    8 {
    9 - u32 h = 0;
    10 + u32 lo, hi;
    11
    12 switch (cmd->type) {
    13 case SYSTEM_INTEL_MSR_CAPABLE:
    14 - wrmsr(cmd->addr.msr.reg, cmd->val, h);
    15 + rdmsr(cmd->addr.msr.reg, lo, hi);
    16 + lo = (lo & ~INTEL_MSR_RANGE) | (cmd->val & INTEL_MSR_RANGE);
    17 + wrmsr(cmd->addr.msr.reg, lo, hi);
    18 break;
    19 case SYSTEM_IO_CAPABLE:
    20 acpi_os_write_port((acpi_io_address)cmd->addr.io.port,
    21 @@ -372,7 +374,6 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy,
    22 struct cpufreq_freqs freqs;
    23 cpumask_t online_policy_cpus;
    24 struct drv_cmd cmd;
    25 - unsigned int msr;
    26 unsigned int next_state = 0; /* Index into freq_table */
    27 unsigned int next_perf_state = 0; /* Index into perf table */
    28 unsigned int i;
    29 @@ -417,11 +418,7 @@ static int acpi_cpufreq_target(struct cpufreq_policy *policy,
    30 case SYSTEM_INTEL_MSR_CAPABLE:
    31 cmd.type = SYSTEM_INTEL_MSR_CAPABLE;
    32 cmd.addr.msr.reg = MSR_IA32_PERF_CTL;
    33 - msr =
    34 - (u32) perf->states[next_perf_state].
    35 - control & INTEL_MSR_RANGE;
    36 - cmd.val = get_cur_val(online_policy_cpus);
    37 - cmd.val = (cmd.val & ~INTEL_MSR_RANGE) | msr;
    38 + cmd.val = (u32) perf->states[next_perf_state].control;
    39 break;
    40 case SYSTEM_IO_CAPABLE:
    41 cmd.type = SYSTEM_IO_CAPABLE;
    42 diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
    43 index 831f540..eac3838 100644
    44 --- a/arch/sparc/kernel/entry.S
    45 +++ b/arch/sparc/kernel/entry.S
    46 @@ -1749,8 +1749,8 @@ fpload:
    47 __ndelay:
    48 save %sp, -STACKFRAME_SZ, %sp
    49 mov %i0, %o0
    50 - call .umul
    51 - mov 0x1ad, %o1 ! 2**32 / (1 000 000 000 / HZ)
    52 + call .umul ! round multiplier up so large ns ok
    53 + mov 0x1ae, %o1 ! 2**32 / (1 000 000 000 / HZ)
    54 call .umul
    55 mov %i1, %o1 ! udelay_val
    56 ba delay_continue
    57 @@ -1760,11 +1760,17 @@ __ndelay:
    58 __udelay:
    59 save %sp, -STACKFRAME_SZ, %sp
    60 mov %i0, %o0
    61 - sethi %hi(0x10c6), %o1
    62 + sethi %hi(0x10c7), %o1 ! round multiplier up so large us ok
    63 call .umul
    64 - or %o1, %lo(0x10c6), %o1 ! 2**32 / 1 000 000
    65 + or %o1, %lo(0x10c7), %o1 ! 2**32 / 1 000 000
    66 call .umul
    67 mov %i1, %o1 ! udelay_val
    68 + sethi %hi(0x028f4b62), %l0 ! Add in rounding constant * 2**32,
    69 + or %g0, %lo(0x028f4b62), %l0
    70 + addcc %o0, %l0, %o0 ! 2**32 * 0.009 999
    71 + bcs,a 3f
    72 + add %o1, 0x01, %o1
    73 +3:
    74 call .umul
    75 mov HZ, %o0 ! >>32 earlier for wider range
    76
    77 diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S
    78 index a65eba4..1c37ea8 100644
    79 --- a/arch/sparc/lib/memset.S
    80 +++ b/arch/sparc/lib/memset.S
    81 @@ -162,7 +162,7 @@ __bzero:
    82 8:
    83 add %o0, 1, %o0
    84 subcc %o1, 1, %o1
    85 - bne,a 8b
    86 + bne 8b
    87 EX(stb %g3, [%o0 - 1], add %o1, 1)
    88 0:
    89 retl
    90 diff --git a/arch/sparc64/kernel/head.S b/arch/sparc64/kernel/head.S
    91 index 06459ae..0e19369 100644
    92 --- a/arch/sparc64/kernel/head.S
    93 +++ b/arch/sparc64/kernel/head.S
    94 @@ -458,7 +458,6 @@ tlb_fixup_done:
    95 or %g6, %lo(init_thread_union), %g6
    96 ldx [%g6 + TI_TASK], %g4
    97 mov %sp, %l6
    98 - mov %o4, %l7
    99
    100 wr %g0, ASI_P, %asi
    101 mov 1, %g1
    102 diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c
    103 index 3f33165..419b2d5 100644
    104 --- a/arch/um/os-Linux/user_syms.c
    105 +++ b/arch/um/os-Linux/user_syms.c
    106 @@ -5,7 +5,8 @@
    107 * so I *must* declare good prototypes for them and then EXPORT them.
    108 * The kernel code uses the macro defined by include/linux/string.h,
    109 * so I undef macros; the userspace code does not include that and I
    110 - * add an EXPORT for the glibc one.*/
    111 + * add an EXPORT for the glibc one.
    112 + */
    113
    114 #undef strlen
    115 #undef strstr
    116 @@ -61,12 +62,18 @@ EXPORT_SYMBOL_PROTO(dup2);
    117 EXPORT_SYMBOL_PROTO(__xstat);
    118 EXPORT_SYMBOL_PROTO(__lxstat);
    119 EXPORT_SYMBOL_PROTO(__lxstat64);
    120 +EXPORT_SYMBOL_PROTO(__fxstat64);
    121 EXPORT_SYMBOL_PROTO(lseek);
    122 EXPORT_SYMBOL_PROTO(lseek64);
    123 EXPORT_SYMBOL_PROTO(chown);
    124 +EXPORT_SYMBOL_PROTO(fchown);
    125 EXPORT_SYMBOL_PROTO(truncate);
    126 +EXPORT_SYMBOL_PROTO(ftruncate64);
    127 EXPORT_SYMBOL_PROTO(utime);
    128 +EXPORT_SYMBOL_PROTO(utimes);
    129 +EXPORT_SYMBOL_PROTO(futimes);
    130 EXPORT_SYMBOL_PROTO(chmod);
    131 +EXPORT_SYMBOL_PROTO(fchmod);
    132 EXPORT_SYMBOL_PROTO(rename);
    133 EXPORT_SYMBOL_PROTO(__xmknod);
    134
    135 @@ -102,14 +109,3 @@ EXPORT_SYMBOL(__stack_smash_handler);
    136
    137 extern long __guard __attribute__((weak));
    138 EXPORT_SYMBOL(__guard);
    139 -
    140 -/*
    141 - * Overrides for Emacs so that we follow Linus's tabbing style.
    142 - * Emacs will notice this stuff at the end of the file and automatically
    143 - * adjust the settings for this buffer only. This must remain at the end
    144 - * of the file.
    145 - * ---------------------------------------------------------------------------
    146 - * Local variables:
    147 - * c-file-style: "linux"
    148 - * End:
    149 - */
    150 diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
    151 index 57c0db3..0c646dc 100644
    152 --- a/drivers/ata/ata_piix.c
    153 +++ b/drivers/ata/ata_piix.c
    154 @@ -431,7 +431,7 @@ static const struct piix_map_db ich8_map_db = {
    155 /* PM PS SM SS MAP */
    156 { P0, P2, P1, P3 }, /* 00b (hardwired when in AHCI) */
    157 { RV, RV, RV, RV },
    158 - { IDE, IDE, NA, NA }, /* 10b (IDE mode) */
    159 + { P0, P2, IDE, IDE }, /* 10b (IDE mode) */
    160 { RV, RV, RV, RV },
    161 },
    162 };
    163 diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
    164 index b50ebb6..17d75ec 100644
    165 --- a/drivers/ata/pata_atiixp.c
    166 +++ b/drivers/ata/pata_atiixp.c
    167 @@ -283,6 +283,7 @@ static const struct pci_device_id atiixp[] = {
    168 { PCI_VDEVICE(ATI, PCI_DEVICE_ID_ATI_IXP300_IDE), },
    169 { PCI_VDEVICE(ATI, PCI_DEVICE_ID_ATI_IXP400_IDE), },
    170 { PCI_VDEVICE(ATI, PCI_DEVICE_ID_ATI_IXP600_IDE), },
    171 + { PCI_VDEVICE(ATI, PCI_DEVICE_ID_ATI_IXP700_IDE), },
    172
    173 { },
    174 };
    175 diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
    176 index 7fd095e..be31b43 100644
    177 --- a/drivers/base/cpu.c
    178 +++ b/drivers/base/cpu.c
    179 @@ -53,7 +53,7 @@ static ssize_t store_online(struct sys_device *dev, const char *buf,
    180 ret = count;
    181 return ret;
    182 }
    183 -static SYSDEV_ATTR(online, 0600, show_online, store_online);
    184 +static SYSDEV_ATTR(online, 0644, show_online, store_online);
    185
    186 static void __devinit register_cpu_control(struct cpu *cpu)
    187 {
    188 diff --git a/drivers/char/drm/i915_dma.c b/drivers/char/drm/i915_dma.c
    189 index 9354ce3..ab1a1d0 100644
    190 --- a/drivers/char/drm/i915_dma.c
    191 +++ b/drivers/char/drm/i915_dma.c
    192 @@ -172,6 +172,8 @@ static int i915_initialize(drm_device_t * dev,
    193 * private backbuffer/depthbuffer usage.
    194 */
    195 dev_priv->use_mi_batchbuffer_start = 0;
    196 + if (IS_I965G(dev)) /* 965 doesn't support older method */
    197 + dev_priv->use_mi_batchbuffer_start = 1;
    198
    199 /* Allow hardware batchbuffers unless told otherwise.
    200 */
    201 @@ -504,8 +506,13 @@ static int i915_dispatch_batchbuffer(drm_device_t * dev,
    202
    203 if (dev_priv->use_mi_batchbuffer_start) {
    204 BEGIN_LP_RING(2);
    205 - OUT_RING(MI_BATCH_BUFFER_START | (2 << 6));
    206 - OUT_RING(batch->start | MI_BATCH_NON_SECURE);
    207 + if (IS_I965G(dev)) {
    208 + OUT_RING(MI_BATCH_BUFFER_START | (2 << 6) | MI_BATCH_NON_SECURE_I965);
    209 + OUT_RING(batch->start);
    210 + } else {
    211 + OUT_RING(MI_BATCH_BUFFER_START | (2 << 6));
    212 + OUT_RING(batch->start | MI_BATCH_NON_SECURE);
    213 + }
    214 ADVANCE_LP_RING();
    215 } else {
    216 BEGIN_LP_RING(4);
    217 @@ -722,7 +729,8 @@ static int i915_setparam(DRM_IOCTL_ARGS)
    218
    219 switch (param.param) {
    220 case I915_SETPARAM_USE_MI_BATCHBUFFER_START:
    221 - dev_priv->use_mi_batchbuffer_start = param.value;
    222 + if (!IS_I965G(dev))
    223 + dev_priv->use_mi_batchbuffer_start = param.value;
    224 break;
    225 case I915_SETPARAM_TEX_LRU_LOG_GRANULARITY:
    226 dev_priv->tex_lru_log_granularity = param.value;
    227 diff --git a/drivers/char/drm/i915_drv.h b/drivers/char/drm/i915_drv.h
    228 index 93cdcfe..30022c8 100644
    229 --- a/drivers/char/drm/i915_drv.h
    230 +++ b/drivers/char/drm/i915_drv.h
    231 @@ -280,6 +280,7 @@ extern int i915_wait_ring(drm_device_t * dev, int n, const char *caller);
    232 #define MI_BATCH_BUFFER_START (0x31<<23)
    233 #define MI_BATCH_BUFFER_END (0xA<<23)
    234 #define MI_BATCH_NON_SECURE (1)
    235 +#define MI_BATCH_NON_SECURE_I965 (1<<8)
    236
    237 #define MI_WAIT_FOR_EVENT ((0x3<<23))
    238 #define MI_WAIT_FOR_PLANE_A_FLIP (1<<2)
    239 diff --git a/drivers/char/random.c b/drivers/char/random.c
    240 index 263e5e5..96561c8 100644
    241 --- a/drivers/char/random.c
    242 +++ b/drivers/char/random.c
    243 @@ -693,9 +693,14 @@ static void xfer_secondary_pool(struct entropy_store *r, size_t nbytes)
    244
    245 if (r->pull && r->entropy_count < nbytes * 8 &&
    246 r->entropy_count < r->poolinfo->POOLBITS) {
    247 - int bytes = max_t(int, random_read_wakeup_thresh / 8,
    248 - min_t(int, nbytes, sizeof(tmp)));
    249 + /* If we're limited, always leave two wakeup worth's BITS */
    250 int rsvd = r->limit ? 0 : random_read_wakeup_thresh/4;
    251 + int bytes = nbytes;
    252 +
    253 + /* pull at least as many as BYTES as wakeup BITS */
    254 + bytes = max_t(int, bytes, random_read_wakeup_thresh / 8);
    255 + /* but never more than the buffer size */
    256 + bytes = min_t(int, bytes, sizeof(tmp));
    257
    258 DEBUG_ENT("going to reseed %s with %d bits "
    259 "(%d of %d requested)\n",
    260 diff --git a/drivers/char/sx.c b/drivers/char/sx.c
    261 index 1da92a6..85a2328 100644
    262 --- a/drivers/char/sx.c
    263 +++ b/drivers/char/sx.c
    264 @@ -2721,9 +2721,9 @@ static void __devexit sx_pci_remove(struct pci_dev *pdev)
    265 its because the standard requires it. So check for SUBVENDOR_ID. */
    266 static struct pci_device_id sx_pci_tbl[] = {
    267 { PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8,
    268 - .subvendor = 0x0200,.subdevice = PCI_ANY_ID },
    269 + .subvendor = PCI_ANY_ID, .subdevice = 0x0200 },
    270 { PCI_VENDOR_ID_SPECIALIX, PCI_DEVICE_ID_SPECIALIX_SX_XIO_IO8,
    271 - .subvendor = 0x0300,.subdevice = PCI_ANY_ID },
    272 + .subvendor = PCI_ANY_ID, .subdevice = 0x0300 },
    273 { 0 }
    274 };
    275
    276 diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
    277 index f697449..1d11d13 100644
    278 --- a/drivers/cpufreq/cpufreq_ondemand.c
    279 +++ b/drivers/cpufreq/cpufreq_ondemand.c
    280 @@ -95,15 +95,25 @@ static struct dbs_tuners {
    281
    282 static inline cputime64_t get_cpu_idle_time(unsigned int cpu)
    283 {
    284 - cputime64_t retval;
    285 + cputime64_t idle_time;
    286 + cputime64_t cur_jiffies;
    287 + cputime64_t busy_time;
    288
    289 - retval = cputime64_add(kstat_cpu(cpu).cpustat.idle,
    290 - kstat_cpu(cpu).cpustat.iowait);
    291 + cur_jiffies = jiffies64_to_cputime64(get_jiffies_64());
    292 + busy_time = cputime64_add(kstat_cpu(cpu).cpustat.user,
    293 + kstat_cpu(cpu).cpustat.system);
    294
    295 - if (dbs_tuners_ins.ignore_nice)
    296 - retval = cputime64_add(retval, kstat_cpu(cpu).cpustat.nice);
    297 + busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.irq);
    298 + busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.softirq);
    299 + busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.steal);
    300
    301 - return retval;
    302 + if (!dbs_tuners_ins.ignore_nice) {
    303 + busy_time = cputime64_add(busy_time,
    304 + kstat_cpu(cpu).cpustat.nice);
    305 + }
    306 +
    307 + idle_time = cputime64_sub(cur_jiffies, busy_time);
    308 + return idle_time;
    309 }
    310
    311 /*
    312 @@ -324,7 +334,7 @@ static struct attribute_group dbs_attr_group = {
    313 static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
    314 {
    315 unsigned int idle_ticks, total_ticks;
    316 - unsigned int load;
    317 + unsigned int load = 0;
    318 cputime64_t cur_jiffies;
    319
    320 struct cpufreq_policy *policy;
    321 @@ -338,7 +348,8 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
    322 cur_jiffies = jiffies64_to_cputime64(get_jiffies_64());
    323 total_ticks = (unsigned int) cputime64_sub(cur_jiffies,
    324 this_dbs_info->prev_cpu_wall);
    325 - this_dbs_info->prev_cpu_wall = cur_jiffies;
    326 + this_dbs_info->prev_cpu_wall = get_jiffies_64();
    327 +
    328 if (!total_ticks)
    329 return;
    330 /*
    331 @@ -369,7 +380,8 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
    332 if (tmp_idle_ticks < idle_ticks)
    333 idle_ticks = tmp_idle_ticks;
    334 }
    335 - load = (100 * (total_ticks - idle_ticks)) / total_ticks;
    336 + if (likely(total_ticks > idle_ticks))
    337 + load = (100 * (total_ticks - idle_ticks)) / total_ticks;
    338
    339 /* Check for frequency increase */
    340 if (load > dbs_tuners_ins.up_threshold) {
    341 diff --git a/drivers/kvm/svm.c b/drivers/kvm/svm.c
    342 index c79df79..1e90401 100644
    343 --- a/drivers/kvm/svm.c
    344 +++ b/drivers/kvm/svm.c
    345 @@ -1655,6 +1655,12 @@ static void svm_inject_page_fault(struct kvm_vcpu *vcpu,
    346
    347 static int is_disabled(void)
    348 {
    349 + u64 vm_cr;
    350 +
    351 + rdmsrl(MSR_VM_CR, vm_cr);
    352 + if (vm_cr & (1 << SVM_VM_CR_SVM_DISABLE))
    353 + return 1;
    354 +
    355 return 0;
    356 }
    357
    358 diff --git a/drivers/kvm/svm.h b/drivers/kvm/svm.h
    359 index df731c3..e8f0349 100644
    360 --- a/drivers/kvm/svm.h
    361 +++ b/drivers/kvm/svm.h
    362 @@ -172,8 +172,11 @@ struct __attribute__ ((__packed__)) vmcb {
    363 #define SVM_CPUID_FUNC 0x8000000a
    364
    365 #define MSR_EFER_SVME_MASK (1ULL << 12)
    366 +#define MSR_VM_CR 0xc0010114
    367 #define MSR_VM_HSAVE_PA 0xc0010117ULL
    368
    369 +#define SVM_VM_CR_SVM_DISABLE 4
    370 +
    371 #define SVM_SELECTOR_S_SHIFT 4
    372 #define SVM_SELECTOR_DPL_SHIFT 5
    373 #define SVM_SELECTOR_P_SHIFT 7
    374 diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
    375 index b9ff4e3..7989dac 100644
    376 --- a/drivers/md/dm-crypt.c
    377 +++ b/drivers/md/dm-crypt.c
    378 @@ -917,6 +917,8 @@ static void crypt_dtr(struct dm_target *ti)
    379 {
    380 struct crypt_config *cc = (struct crypt_config *) ti->private;
    381
    382 + flush_workqueue(_kcryptd_workqueue);
    383 +
    384 bioset_free(cc->bs);
    385 mempool_destroy(cc->page_pool);
    386 mempool_destroy(cc->io_pool);
    387 @@ -938,9 +940,6 @@ static int crypt_map(struct dm_target *ti, struct bio *bio,
    388 struct crypt_config *cc = ti->private;
    389 struct crypt_io *io;
    390
    391 - if (bio_barrier(bio))
    392 - return -EOPNOTSUPP;
    393 -
    394 io = mempool_alloc(cc->io_pool, GFP_NOIO);
    395 io->target = ti;
    396 io->base_bio = bio;
    397 diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
    398 index 99cdffa..fc496fc 100644
    399 --- a/drivers/md/dm-exception-store.c
    400 +++ b/drivers/md/dm-exception-store.c
    401 @@ -453,11 +453,6 @@ static int persistent_read_metadata(struct exception_store *store)
    402 /*
    403 * Sanity checks.
    404 */
    405 - if (!ps->valid) {
    406 - DMWARN("snapshot is marked invalid");
    407 - return -EINVAL;
    408 - }
    409 -
    410 if (ps->version != SNAPSHOT_DISK_VERSION) {
    411 DMWARN("unable to handle snapshot disk version %d",
    412 ps->version);
    413 @@ -465,6 +460,12 @@ static int persistent_read_metadata(struct exception_store *store)
    414 }
    415
    416 /*
    417 + * Metadata are valid, but snapshot is invalidated
    418 + */
    419 + if (!ps->valid)
    420 + return 1;
    421 +
    422 + /*
    423 * Read the metadata.
    424 */
    425 r = read_exceptions(ps);
    426 diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
    427 index 3aa0135..af27464 100644
    428 --- a/drivers/md/dm-mpath.c
    429 +++ b/drivers/md/dm-mpath.c
    430 @@ -795,9 +795,6 @@ static int multipath_map(struct dm_target *ti, struct bio *bio,
    431 struct mpath_io *mpio;
    432 struct multipath *m = (struct multipath *) ti->private;
    433
    434 - if (bio_barrier(bio))
    435 - return -EOPNOTSUPP;
    436 -
    437 mpio = mempool_alloc(m->mpio_pool, GFP_NOIO);
    438 dm_bio_record(&mpio->details, bio);
    439
    440 diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
    441 index 0821a2b..3955621 100644
    442 --- a/drivers/md/dm-snap.c
    443 +++ b/drivers/md/dm-snap.c
    444 @@ -522,9 +522,12 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
    445
    446 /* Metadata must only be loaded into one table at once */
    447 r = s->store.read_metadata(&s->store);
    448 - if (r) {
    449 + if (r < 0) {
    450 ti->error = "Failed to read snapshot metadata";
    451 goto bad6;
    452 + } else if (r > 0) {
    453 + s->valid = 0;
    454 + DMWARN("Snapshot is marked invalid.");
    455 }
    456
    457 bio_list_init(&s->queued_bios);
    458 @@ -884,9 +887,6 @@ static int snapshot_map(struct dm_target *ti, struct bio *bio,
    459 if (!s->valid)
    460 return -EIO;
    461
    462 - if (unlikely(bio_barrier(bio)))
    463 - return -EOPNOTSUPP;
    464 -
    465 /* FIXME: should only take write lock if we need
    466 * to copy an exception */
    467 down_write(&s->lock);
    468 @@ -1157,9 +1157,6 @@ static int origin_map(struct dm_target *ti, struct bio *bio,
    469 struct dm_dev *dev = (struct dm_dev *) ti->private;
    470 bio->bi_bdev = dev->bdev;
    471
    472 - if (unlikely(bio_barrier(bio)))
    473 - return -EOPNOTSUPP;
    474 -
    475 /* Only tell snapshots if this is a write */
    476 return (bio_rw(bio) == WRITE) ? do_origin(dev, bio) : DM_MAPIO_REMAPPED;
    477 }
    478 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
    479 index 3668b17..d531f0c 100644
    480 --- a/drivers/md/dm.c
    481 +++ b/drivers/md/dm.c
    482 @@ -802,6 +802,15 @@ static int dm_request(request_queue_t *q, struct bio *bio)
    483 int rw = bio_data_dir(bio);
    484 struct mapped_device *md = q->queuedata;
    485
    486 + /*
    487 + * There is no use in forwarding any barrier request since we can't
    488 + * guarantee it is (or can be) handled by the targets correctly.
    489 + */
    490 + if (unlikely(bio_barrier(bio))) {
    491 + bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
    492 + return 0;
    493 + }
    494 +
    495 down_read(&md->io_lock);
    496
    497 disk_stat_inc(dm_disk(md), ios[rw]);
    498 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
    499 index 9eb66c1..e0029ea 100644
    500 --- a/drivers/md/raid10.c
    501 +++ b/drivers/md/raid10.c
    502 @@ -917,6 +917,13 @@ static int make_request(request_queue_t *q, struct bio * bio)
    503 bio_list_add(&bl, mbio);
    504 }
    505
    506 + if (unlikely(!atomic_read(&r10_bio->remaining))) {
    507 + /* the array is dead */
    508 + md_write_end(mddev);
    509 + raid_end_bio_io(r10_bio);
    510 + return 0;
    511 + }
    512 +
    513 bitmap_startwrite(mddev->bitmap, bio->bi_sector, r10_bio->sectors, 0);
    514 spin_lock_irqsave(&conf->device_lock, flags);
    515 bio_list_merge(&conf->pending_bio_list, &bl);
    516 @@ -1558,7 +1565,6 @@ static void raid10d(mddev_t *mddev)
    517 bio = r10_bio->devs[r10_bio->read_slot].bio;
    518 r10_bio->devs[r10_bio->read_slot].bio =
    519 mddev->ro ? IO_BLOCKED : NULL;
    520 - bio_put(bio);
    521 mirror = read_balance(conf, r10_bio);
    522 if (mirror == -1) {
    523 printk(KERN_ALERT "raid10: %s: unrecoverable I/O"
    524 @@ -1566,8 +1572,10 @@ static void raid10d(mddev_t *mddev)
    525 bdevname(bio->bi_bdev,b),
    526 (unsigned long long)r10_bio->sector);
    527 raid_end_bio_io(r10_bio);
    528 + bio_put(bio);
    529 } else {
    530 const int do_sync = bio_sync(r10_bio->master_bio);
    531 + bio_put(bio);
    532 rdev = conf->mirrors[mirror].rdev;
    533 if (printk_ratelimit())
    534 printk(KERN_ERR "raid10: %s: redirecting sector %llu to"
    535 diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
    536 index b87d571..31807ba 100644
    537 --- a/drivers/media/video/v4l2-common.c
    538 +++ b/drivers/media/video/v4l2-common.c
    539 @@ -1499,16 +1499,25 @@ int v4l2_ctrl_query_menu(struct v4l2_querymenu *qmenu, struct v4l2_queryctrl *qc
    540 When no more controls are available 0 is returned. */
    541 u32 v4l2_ctrl_next(const u32 * const * ctrl_classes, u32 id)
    542 {
    543 - u32 ctrl_class;
    544 + u32 ctrl_class = V4L2_CTRL_ID2CLASS(id);
    545 const u32 *pctrl;
    546
    547 - /* if no query is desired, then just return the control ID */
    548 - if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0)
    549 - return id;
    550 if (ctrl_classes == NULL)
    551 return 0;
    552 +
    553 + /* if no query is desired, then check if the ID is part of ctrl_classes */
    554 + if ((id & V4L2_CTRL_FLAG_NEXT_CTRL) == 0) {
    555 + /* find class */
    556 + while (*ctrl_classes && V4L2_CTRL_ID2CLASS(**ctrl_classes) != ctrl_class)
    557 + ctrl_classes++;
    558 + if (*ctrl_classes == NULL)
    559 + return 0;
    560 + pctrl = *ctrl_classes;
    561 + /* find control ID */
    562 + while (*pctrl && *pctrl != id) pctrl++;
    563 + return *pctrl ? id : 0;
    564 + }
    565 id &= V4L2_CTRL_ID_MASK;
    566 - ctrl_class = V4L2_CTRL_ID2CLASS(id);
    567 id++; /* select next control */
    568 /* find first class that matches (or is greater than) the class of
    569 the ID */
    570 diff --git a/drivers/media/video/wm8739.c b/drivers/media/video/wm8739.c
    571 index a9b59c3..009941b 100644
    572 --- a/drivers/media/video/wm8739.c
    573 +++ b/drivers/media/video/wm8739.c
    574 @@ -317,12 +317,14 @@ static int wm8739_probe(struct i2c_adapter *adapter)
    575
    576 static int wm8739_detach(struct i2c_client *client)
    577 {
    578 + struct wm8739_state *state = i2c_get_clientdata(client);
    579 int err;
    580
    581 err = i2c_detach_client(client);
    582 if (err)
    583 return err;
    584
    585 + kfree(state);
    586 kfree(client);
    587 return 0;
    588 }
    589 diff --git a/drivers/media/video/wm8775.c b/drivers/media/video/wm8775.c
    590 index d81a88b..e555b3a 100644
    591 --- a/drivers/media/video/wm8775.c
    592 +++ b/drivers/media/video/wm8775.c
    593 @@ -218,12 +218,14 @@ static int wm8775_probe(struct i2c_adapter *adapter)
    594
    595 static int wm8775_detach(struct i2c_client *client)
    596 {
    597 + struct wm8775_state *state = i2c_get_clientdata(client);
    598 int err;
    599
    600 err = i2c_detach_client(client);
    601 if (err) {
    602 return err;
    603 }
    604 + kfree(state);
    605 kfree(client);
    606
    607 return 0;
    608 diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    609 index 952a6bd..c383dc3 100644
    610 --- a/drivers/net/forcedeth.c
    611 +++ b/drivers/net/forcedeth.c
    612 @@ -553,6 +553,7 @@ union ring_type {
    613 /* PHY defines */
    614 #define PHY_OUI_MARVELL 0x5043
    615 #define PHY_OUI_CICADA 0x03f1
    616 +#define PHY_OUI_VITESSE 0x01c1
    617 #define PHYID1_OUI_MASK 0x03ff
    618 #define PHYID1_OUI_SHFT 6
    619 #define PHYID2_OUI_MASK 0xfc00
    620 @@ -560,12 +561,29 @@ union ring_type {
    621 #define PHYID2_MODEL_MASK 0x03f0
    622 #define PHY_MODEL_MARVELL_E3016 0x220
    623 #define PHY_MARVELL_E3016_INITMASK 0x0300
    624 -#define PHY_INIT1 0x0f000
    625 -#define PHY_INIT2 0x0e00
    626 -#define PHY_INIT3 0x01000
    627 -#define PHY_INIT4 0x0200
    628 -#define PHY_INIT5 0x0004
    629 -#define PHY_INIT6 0x02000
    630 +#define PHY_CICADA_INIT1 0x0f000
    631 +#define PHY_CICADA_INIT2 0x0e00
    632 +#define PHY_CICADA_INIT3 0x01000
    633 +#define PHY_CICADA_INIT4 0x0200
    634 +#define PHY_CICADA_INIT5 0x0004
    635 +#define PHY_CICADA_INIT6 0x02000
    636 +#define PHY_VITESSE_INIT_REG1 0x1f
    637 +#define PHY_VITESSE_INIT_REG2 0x10
    638 +#define PHY_VITESSE_INIT_REG3 0x11
    639 +#define PHY_VITESSE_INIT_REG4 0x12
    640 +#define PHY_VITESSE_INIT_MSK1 0xc
    641 +#define PHY_VITESSE_INIT_MSK2 0x0180
    642 +#define PHY_VITESSE_INIT1 0x52b5
    643 +#define PHY_VITESSE_INIT2 0xaf8a
    644 +#define PHY_VITESSE_INIT3 0x8
    645 +#define PHY_VITESSE_INIT4 0x8f8a
    646 +#define PHY_VITESSE_INIT5 0xaf86
    647 +#define PHY_VITESSE_INIT6 0x8f86
    648 +#define PHY_VITESSE_INIT7 0xaf82
    649 +#define PHY_VITESSE_INIT8 0x0100
    650 +#define PHY_VITESSE_INIT9 0x8f82
    651 +#define PHY_VITESSE_INIT10 0x0
    652 +
    653 #define PHY_GIGABIT 0x0100
    654
    655 #define PHY_TIMEOUT 0x1
    656 @@ -1133,14 +1151,14 @@ static int phy_init(struct net_device *dev)
    657 /* phy vendor specific configuration */
    658 if ((np->phy_oui == PHY_OUI_CICADA) && (phyinterface & PHY_RGMII) ) {
    659 phy_reserved = mii_rw(dev, np->phyaddr, MII_RESV1, MII_READ);
    660 - phy_reserved &= ~(PHY_INIT1 | PHY_INIT2);
    661 - phy_reserved |= (PHY_INIT3 | PHY_INIT4);
    662 + phy_reserved &= ~(PHY_CICADA_INIT1 | PHY_CICADA_INIT2);
    663 + phy_reserved |= (PHY_CICADA_INIT3 | PHY_CICADA_INIT4);
    664 if (mii_rw(dev, np->phyaddr, MII_RESV1, phy_reserved)) {
    665 printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    666 return PHY_ERROR;
    667 }
    668 phy_reserved = mii_rw(dev, np->phyaddr, MII_NCONFIG, MII_READ);
    669 - phy_reserved |= PHY_INIT5;
    670 + phy_reserved |= PHY_CICADA_INIT5;
    671 if (mii_rw(dev, np->phyaddr, MII_NCONFIG, phy_reserved)) {
    672 printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    673 return PHY_ERROR;
    674 @@ -1148,12 +1166,82 @@ static int phy_init(struct net_device *dev)
    675 }
    676 if (np->phy_oui == PHY_OUI_CICADA) {
    677 phy_reserved = mii_rw(dev, np->phyaddr, MII_SREVISION, MII_READ);
    678 - phy_reserved |= PHY_INIT6;
    679 + phy_reserved |= PHY_CICADA_INIT6;
    680 if (mii_rw(dev, np->phyaddr, MII_SREVISION, phy_reserved)) {
    681 printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    682 return PHY_ERROR;
    683 }
    684 }
    685 + if (np->phy_oui == PHY_OUI_VITESSE) {
    686 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT1)) {
    687 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    688 + return PHY_ERROR;
    689 + }
    690 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT2)) {
    691 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    692 + return PHY_ERROR;
    693 + }
    694 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
    695 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
    696 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    697 + return PHY_ERROR;
    698 + }
    699 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
    700 + phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
    701 + phy_reserved |= PHY_VITESSE_INIT3;
    702 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
    703 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    704 + return PHY_ERROR;
    705 + }
    706 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT4)) {
    707 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    708 + return PHY_ERROR;
    709 + }
    710 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT5)) {
    711 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    712 + return PHY_ERROR;
    713 + }
    714 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
    715 + phy_reserved &= ~PHY_VITESSE_INIT_MSK1;
    716 + phy_reserved |= PHY_VITESSE_INIT3;
    717 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
    718 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    719 + return PHY_ERROR;
    720 + }
    721 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
    722 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
    723 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    724 + return PHY_ERROR;
    725 + }
    726 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT6)) {
    727 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    728 + return PHY_ERROR;
    729 + }
    730 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT7)) {
    731 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    732 + return PHY_ERROR;
    733 + }
    734 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, MII_READ);
    735 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG4, phy_reserved)) {
    736 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    737 + return PHY_ERROR;
    738 + }
    739 + phy_reserved = mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, MII_READ);
    740 + phy_reserved &= ~PHY_VITESSE_INIT_MSK2;
    741 + phy_reserved |= PHY_VITESSE_INIT8;
    742 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG3, phy_reserved)) {
    743 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    744 + return PHY_ERROR;
    745 + }
    746 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG2, PHY_VITESSE_INIT9)) {
    747 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    748 + return PHY_ERROR;
    749 + }
    750 + if (mii_rw(dev, np->phyaddr, PHY_VITESSE_INIT_REG1, PHY_VITESSE_INIT10)) {
    751 + printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
    752 + return PHY_ERROR;
    753 + }
    754 + }
    755 /* some phys clear out pause advertisment on reset, set it back */
    756 mii_rw(dev, np->phyaddr, MII_ADVERTISE, reg);
    757
    758 diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
    759 index 606a467..2785d83 100644
    760 --- a/drivers/pcmcia/cs.c
    761 +++ b/drivers/pcmcia/cs.c
    762 @@ -410,6 +410,9 @@ static void socket_shutdown(struct pcmcia_socket *s)
    763 #endif
    764 s->functions = 0;
    765
    766 + /* give socket some time to power down */
    767 + msleep(100);
    768 +
    769 s->ops->get_status(s, &status);
    770 if (status & SS_POWERON) {
    771 printk(KERN_ERR "PCMCIA: socket %p: *** DANGER *** unable to remove socket power\n", s);
    772 diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c
    773 index d2cf875..3d5cff7 100644
    774 --- a/drivers/scsi/aacraid/linit.c
    775 +++ b/drivers/scsi/aacraid/linit.c
    776 @@ -539,6 +539,8 @@ static int aac_cfg_open(struct inode *inode, struct file *file)
    777 static int aac_cfg_ioctl(struct inode *inode, struct file *file,
    778 unsigned int cmd, unsigned long arg)
    779 {
    780 + if (!capable(CAP_SYS_ADMIN))
    781 + return -EPERM;
    782 return aac_do_ioctl(file->private_data, cmd, (void __user *)arg);
    783 }
    784
    785 @@ -592,6 +594,8 @@ static int aac_compat_ioctl(struct scsi_device *sdev, int cmd, void __user *arg)
    786
    787 static long aac_compat_cfg_ioctl(struct file *file, unsigned cmd, unsigned long arg)
    788 {
    789 + if (!capable(CAP_SYS_ADMIN))
    790 + return -EPERM;
    791 return aac_compat_do_ioctl((struct aac_dev *)file->private_data, cmd, arg);
    792 }
    793 #endif
    794 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    795 index 8ddeed3..d5890d5 100644
    796 --- a/drivers/usb/core/hub.c
    797 +++ b/drivers/usb/core/hub.c
    798 @@ -1356,6 +1356,10 @@ static int __usb_new_device(void *void_data)
    799 }
    800 #endif
    801
    802 + /* Increment the parent's count of unsuspended children */
    803 + if (udev->parent)
    804 + usb_autoresume_device(udev->parent);
    805 +
    806 /* Register the device. The device driver is responsible
    807 * for adding the device files to usbfs and sysfs and for
    808 * configuring the device.
    809 @@ -1363,13 +1367,11 @@ static int __usb_new_device(void *void_data)
    810 err = device_add (&udev->dev);
    811 if (err) {
    812 dev_err(&udev->dev, "can't device_add, error %d\n", err);
    813 + if (udev->parent)
    814 + usb_autosuspend_device(udev->parent);
    815 goto fail;
    816 }
    817
    818 - /* Increment the parent's count of unsuspended children */
    819 - if (udev->parent)
    820 - usb_autoresume_device(udev->parent);
    821 -
    822 exit:
    823 module_put(THIS_MODULE);
    824 return err;
    825 diff --git a/drivers/video/macmodes.c b/drivers/video/macmodes.c
    826 index ab21495..083f603 100644
    827 --- a/drivers/video/macmodes.c
    828 +++ b/drivers/video/macmodes.c
    829 @@ -369,9 +369,8 @@ EXPORT_SYMBOL(mac_map_monitor_sense);
    830 *
    831 */
    832
    833 -int __devinit mac_find_mode(struct fb_var_screeninfo *var,
    834 - struct fb_info *info, const char *mode_option,
    835 - unsigned int default_bpp)
    836 +int mac_find_mode(struct fb_var_screeninfo *var, struct fb_info *info,
    837 + const char *mode_option, unsigned int default_bpp)
    838 {
    839 const struct fb_videomode *db = NULL;
    840 unsigned int dbsize = 0;
    841 diff --git a/drivers/video/macmodes.h b/drivers/video/macmodes.h
    842 index babeb81..b86ba08 100644
    843 --- a/drivers/video/macmodes.h
    844 +++ b/drivers/video/macmodes.h
    845 @@ -55,10 +55,10 @@ extern int mac_vmode_to_var(int vmode, int cmode,
    846 extern int mac_var_to_vmode(const struct fb_var_screeninfo *var, int *vmode,
    847 int *cmode);
    848 extern int mac_map_monitor_sense(int sense);
    849 -extern int __devinit mac_find_mode(struct fb_var_screeninfo *var,
    850 - struct fb_info *info,
    851 - const char *mode_option,
    852 - unsigned int default_bpp);
    853 +extern int mac_find_mode(struct fb_var_screeninfo *var,
    854 + struct fb_info *info,
    855 + const char *mode_option,
    856 + unsigned int default_bpp);
    857
    858
    859 /*
    860 diff --git a/drivers/video/stifb.c b/drivers/video/stifb.c
    861 index 69f3b26..6074ae9 100644
    862 --- a/drivers/video/stifb.c
    863 +++ b/drivers/video/stifb.c
    864 @@ -1101,13 +1101,18 @@ stifb_init_fb(struct sti_struct *sti, int bpp_pref)
    865 /* only supported cards are allowed */
    866 switch (fb->id) {
    867 case CRT_ID_VISUALIZE_EG:
    868 - /* look for a double buffering device like e.g. the
    869 - "INTERNAL_EG_DX1024" in the RDI precisionbook laptop
    870 - which won't work. The same device in non-double
    871 - buffering mode returns "INTERNAL_EG_X1024". */
    872 - if (strstr(sti->outptr.dev_name, "EG_DX")) {
    873 - printk(KERN_WARNING
    874 - "stifb: ignoring '%s'. Disable double buffering in IPL menu.\n",
    875 + /* Visualize cards can run either in "double buffer" or
    876 + "standard" mode. Depending on the mode, the card reports
    877 + a different device name, e.g. "INTERNAL_EG_DX1024" in double
    878 + buffer mode and "INTERNAL_EG_X1024" in standard mode.
    879 + Since this driver only supports standard mode, we check
    880 + if the device name contains the string "DX" and tell the
    881 + user how to reconfigure the card. */
    882 + if (strstr(sti->outptr.dev_name, "DX")) {
    883 + printk(KERN_WARNING "WARNING: stifb framebuffer driver does not "
    884 + "support '%s' in double-buffer mode.\n"
    885 + KERN_WARNING "WARNING: Please disable the double-buffer mode "
    886 + "in IPL menu (the PARISC-BIOS).\n",
    887 sti->outptr.dev_name);
    888 goto out_err0;
    889 }
    890 diff --git a/fs/9p/conv.c b/fs/9p/conv.c
    891 index a3ed571..923d75c 100644
    892 --- a/fs/9p/conv.c
    893 +++ b/fs/9p/conv.c
    894 @@ -742,6 +742,7 @@ struct v9fs_fcall *v9fs_create_twrite(u32 fid, u64 offset, u32 count,
    895 if (err) {
    896 kfree(fc);
    897 fc = ERR_PTR(err);
    898 + goto error;
    899 }
    900
    901 if (buf_check_overflow(bufp)) {
    902 diff --git a/fs/direct-io.c b/fs/direct-io.c
    903 index d9d0833..0286993 100644
    904 --- a/fs/direct-io.c
    905 +++ b/fs/direct-io.c
    906 @@ -978,6 +978,7 @@ direct_io_worker(int rw, struct kiocb *iocb, struct inode *inode,
    907 dio->get_block = get_block;
    908 dio->end_io = end_io;
    909 dio->map_bh.b_private = NULL;
    910 + dio->map_bh.b_state = 0;
    911 dio->final_block_in_bio = -1;
    912 dio->next_block_for_io = -1;
    913
    914 diff --git a/fs/exec.c b/fs/exec.c
    915 index 0f8573a..bd1ab3f 100644
    916 --- a/fs/exec.c
    917 +++ b/fs/exec.c
    918 @@ -881,9 +881,12 @@ int flush_old_exec(struct linux_binprm * bprm)
    919 */
    920 current->mm->task_size = TASK_SIZE;
    921
    922 - if (bprm->e_uid != current->euid || bprm->e_gid != current->egid ||
    923 - file_permission(bprm->file, MAY_READ) ||
    924 - (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
    925 + if (bprm->e_uid != current->euid || bprm->e_gid != current->egid) {
    926 + suid_keys(current);
    927 + current->mm->dumpable = suid_dumpable;
    928 + current->pdeath_signal = 0;
    929 + } else if (file_permission(bprm->file, MAY_READ) ||
    930 + (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)) {
    931 suid_keys(current);
    932 current->mm->dumpable = suid_dumpable;
    933 }
    934 @@ -974,8 +977,10 @@ void compute_creds(struct linux_binprm *bprm)
    935 {
    936 int unsafe;
    937
    938 - if (bprm->e_uid != current->uid)
    939 + if (bprm->e_uid != current->uid) {
    940 suid_keys(current);
    941 + current->pdeath_signal = 0;
    942 + }
    943 exec_keys(current);
    944
    945 task_lock(current);
    946 diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    947 index dc2724f..14b0b49 100644
    948 --- a/fs/ext4/extents.c
    949 +++ b/fs/ext4/extents.c
    950 @@ -1397,7 +1397,7 @@ int ext4_ext_walk_space(struct inode *inode, unsigned long block,
    951
    952 static void
    953 ext4_ext_put_in_cache(struct inode *inode, __u32 block,
    954 - __u32 len, __u32 start, int type)
    955 + __u32 len, ext4_fsblk_t start, int type)
    956 {
    957 struct ext4_ext_cache *cex;
    958 BUG_ON(len == 0);
    959 diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
    960 index be4648b..84436cb 100644
    961 --- a/fs/jbd/commit.c
    962 +++ b/fs/jbd/commit.c
    963 @@ -888,7 +888,8 @@ restart_loop:
    964 journal->j_committing_transaction = NULL;
    965 spin_unlock(&journal->j_state_lock);
    966
    967 - if (commit_transaction->t_checkpoint_list == NULL) {
    968 + if (commit_transaction->t_checkpoint_list == NULL &&
    969 + commit_transaction->t_checkpoint_io_list == NULL) {
    970 __journal_drop_transaction(journal, commit_transaction);
    971 } else {
    972 if (journal->j_checkpoint_transactions == NULL) {
    973 diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
    974 index 6bd8005..7d29549 100644
    975 --- a/fs/jbd2/commit.c
    976 +++ b/fs/jbd2/commit.c
    977 @@ -897,7 +897,8 @@ restart_loop:
    978 journal->j_committing_transaction = NULL;
    979 spin_unlock(&journal->j_state_lock);
    980
    981 - if (commit_transaction->t_checkpoint_list == NULL) {
    982 + if (commit_transaction->t_checkpoint_list == NULL &&
    983 + commit_transaction->t_checkpoint_io_list == NULL) {
    984 __jbd2_journal_drop_transaction(journal, commit_transaction);
    985 } else {
    986 if (journal->j_checkpoint_transactions == NULL) {
    987 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
    988 index 8283236..d8b773a 100644
    989 --- a/fs/nfsd/vfs.c
    990 +++ b/fs/nfsd/vfs.c
    991 @@ -1887,7 +1887,7 @@ nfsd_racache_init(int cache_size)
    992 raparm_hash[i].pb_head = NULL;
    993 spin_lock_init(&raparm_hash[i].pb_lock);
    994 }
    995 - nperbucket = cache_size >> RAPARM_HASH_BITS;
    996 + nperbucket = DIV_ROUND_UP(cache_size, RAPARM_HASH_SIZE);
    997 for (i = 0; i < cache_size - 1; i++) {
    998 if (i % nperbucket == 0)
    999 raparm_hash[j++].pb_head = raparml + i;
    1000 diff --git a/fs/splice.c b/fs/splice.c
    1001 index 2fca6eb..b657217 100644
    1002 --- a/fs/splice.c
    1003 +++ b/fs/splice.c
    1004 @@ -614,7 +614,7 @@ find_page:
    1005 ret = add_to_page_cache_lru(page, mapping, index,
    1006 GFP_KERNEL);
    1007 if (unlikely(ret))
    1008 - goto out;
    1009 + goto out_release;
    1010 }
    1011
    1012 /*
    1013 @@ -695,8 +695,9 @@ find_page:
    1014 goto find_page;
    1015 }
    1016 out:
    1017 - page_cache_release(page);
    1018 unlock_page(page);
    1019 +out_release:
    1020 + page_cache_release(page);
    1021 out_ret:
    1022 return ret;
    1023 }
    1024 diff --git a/include/linux/Kbuild b/include/linux/Kbuild
    1025 index 157db77..199fd71 100644
    1026 --- a/include/linux/Kbuild
    1027 +++ b/include/linux/Kbuild
    1028 @@ -134,6 +134,7 @@ header-y += radeonfb.h
    1029 header-y += raw.h
    1030 header-y += resource.h
    1031 header-y += rose.h
    1032 +header-y += serial_reg.h
    1033 header-y += smbno.h
    1034 header-y += snmp.h
    1035 header-y += sockios.h
    1036 diff --git a/include/linux/netfilter_ipv4/ipt_iprange.h b/include/linux/netfilter_ipv4/ipt_iprange.h
    1037 index 34ab0fb..a92fefc 100644
    1038 --- a/include/linux/netfilter_ipv4/ipt_iprange.h
    1039 +++ b/include/linux/netfilter_ipv4/ipt_iprange.h
    1040 @@ -1,6 +1,8 @@
    1041 #ifndef _IPT_IPRANGE_H
    1042 #define _IPT_IPRANGE_H
    1043
    1044 +#include <linux/types.h>
    1045 +
    1046 #define IPRANGE_SRC 0x01 /* Match source IP address */
    1047 #define IPRANGE_DST 0x02 /* Match destination IP address */
    1048 #define IPRANGE_SRC_INV 0x10 /* Negate the condition */
    1049 diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
    1050 index 3c563f0..25aa575 100644
    1051 --- a/include/net/bluetooth/rfcomm.h
    1052 +++ b/include/net/bluetooth/rfcomm.h
    1053 @@ -323,6 +323,7 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc
    1054 #define RFCOMM_RELEASE_ONHUP 1
    1055 #define RFCOMM_HANGUP_NOW 2
    1056 #define RFCOMM_TTY_ATTACHED 3
    1057 +#define RFCOMM_TTY_RELEASED 4
    1058
    1059 struct rfcomm_dev_req {
    1060 s16 dev_id;
    1061 diff --git a/include/net/xfrm.h b/include/net/xfrm.h
    1062 index e476541..4fc943b 100644
    1063 --- a/include/net/xfrm.h
    1064 +++ b/include/net/xfrm.h
    1065 @@ -561,7 +561,6 @@ static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ct
    1066 struct xfrm_dst
    1067 {
    1068 union {
    1069 - struct xfrm_dst *next;
    1070 struct dst_entry dst;
    1071 struct rtable rt;
    1072 struct rt6_info rt6;
    1073 diff --git a/ipc/shm.c b/ipc/shm.c
    1074 index f8e10a2..10b7a2c 100644
    1075 --- a/ipc/shm.c
    1076 +++ b/ipc/shm.c
    1077 @@ -652,7 +652,7 @@ asmlinkage long sys_shmctl (int shmid, int cmd, struct shmid_ds __user *buf)
    1078 struct user_struct * user = current->user;
    1079 if (!is_file_hugepages(shp->shm_file)) {
    1080 err = shmem_lock(shp->shm_file, 1, user);
    1081 - if (!err) {
    1082 + if (!err && !(shp->shm_perm.mode & SHM_LOCKED)){
    1083 shp->shm_perm.mode |= SHM_LOCKED;
    1084 shp->mlock_user = user;
    1085 }
    1086 diff --git a/kernel/lockdep_proc.c b/kernel/lockdep_proc.c
    1087 index b554b40..d787db5 100644
    1088 --- a/kernel/lockdep_proc.c
    1089 +++ b/kernel/lockdep_proc.c
    1090 @@ -323,7 +323,7 @@ static const struct file_operations proc_lockdep_stats_operations = {
    1091 .open = lockdep_stats_open,
    1092 .read = seq_read,
    1093 .llseek = seq_lseek,
    1094 - .release = seq_release,
    1095 + .release = single_release,
    1096 };
    1097
    1098 static int __init lockdep_proc_init(void)
    1099 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    1100 index 36db012..7c07eb2 100644
    1101 --- a/mm/hugetlb.c
    1102 +++ b/mm/hugetlb.c
    1103 @@ -101,13 +101,20 @@ static void free_huge_page(struct page *page)
    1104
    1105 static int alloc_fresh_huge_page(void)
    1106 {
    1107 - static int nid = 0;
    1108 + static int prev_nid;
    1109 struct page *page;
    1110 - page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN,
    1111 - HUGETLB_PAGE_ORDER);
    1112 - nid = next_node(nid, node_online_map);
    1113 + static DEFINE_SPINLOCK(nid_lock);
    1114 + int nid;
    1115 +
    1116 + spin_lock(&nid_lock);
    1117 + nid = next_node(prev_nid, node_online_map);
    1118 if (nid == MAX_NUMNODES)
    1119 nid = first_node(node_online_map);
    1120 + prev_nid = nid;
    1121 + spin_unlock(&nid_lock);
    1122 +
    1123 + page = alloc_pages_node(nid, GFP_HIGHUSER|__GFP_COMP|__GFP_NOWARN,
    1124 + HUGETLB_PAGE_ORDER);
    1125 if (page) {
    1126 set_compound_page_dtor(page, free_huge_page);
    1127 spin_lock(&hugetlb_lock);
    1128 diff --git a/mm/mlock.c b/mm/mlock.c
    1129 index 3446b7e..ef8fc94 100644
    1130 --- a/mm/mlock.c
    1131 +++ b/mm/mlock.c
    1132 @@ -233,9 +233,12 @@ int user_shm_lock(size_t size, struct user_struct *user)
    1133
    1134 locked = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
    1135 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
    1136 + if (lock_limit == RLIM_INFINITY)
    1137 + allowed = 1;
    1138 lock_limit >>= PAGE_SHIFT;
    1139 spin_lock(&shmlock_user_lock);
    1140 - if (locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK))
    1141 + if (!allowed &&
    1142 + locked + user->locked_shm > lock_limit && !capable(CAP_IPC_LOCK))
    1143 goto out;
    1144 get_uid(user);
    1145 user->locked_shm += locked;
    1146 diff --git a/mm/readahead.c b/mm/readahead.c
    1147 index 0f539e8..f26cdea 100644
    1148 --- a/mm/readahead.c
    1149 +++ b/mm/readahead.c
    1150 @@ -21,8 +21,16 @@ void default_unplug_io_fn(struct backing_dev_info *bdi, struct page *page)
    1151 }
    1152 EXPORT_SYMBOL(default_unplug_io_fn);
    1153
    1154 +/*
    1155 + * Convienent macros for min/max read-ahead pages.
    1156 + * Note that MAX_RA_PAGES is rounded down, while MIN_RA_PAGES is rounded up.
    1157 + * The latter is necessary for systems with large page size(i.e. 64k).
    1158 + */
    1159 +#define MAX_RA_PAGES (VM_MAX_READAHEAD*1024 / PAGE_CACHE_SIZE)
    1160 +#define MIN_RA_PAGES DIV_ROUND_UP(VM_MIN_READAHEAD*1024, PAGE_CACHE_SIZE)
    1161 +
    1162 struct backing_dev_info default_backing_dev_info = {
    1163 - .ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE,
    1164 + .ra_pages = MAX_RA_PAGES,
    1165 .state = 0,
    1166 .capabilities = BDI_CAP_MAP_COPY,
    1167 .unplug_io_fn = default_unplug_io_fn,
    1168 @@ -51,7 +59,7 @@ static inline unsigned long get_max_readahead(struct file_ra_state *ra)
    1169
    1170 static inline unsigned long get_min_readahead(struct file_ra_state *ra)
    1171 {
    1172 - return (VM_MIN_READAHEAD * 1024) / PAGE_CACHE_SIZE;
    1173 + return MIN_RA_PAGES;
    1174 }
    1175
    1176 static inline void reset_ahead_window(struct file_ra_state *ra)
    1177 diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
    1178 index eb2b524..26e8c02 100644
    1179 --- a/net/bluetooth/rfcomm/tty.c
    1180 +++ b/net/bluetooth/rfcomm/tty.c
    1181 @@ -93,6 +93,10 @@ static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
    1182
    1183 BT_DBG("dev %p dlc %p", dev, dlc);
    1184
    1185 + write_lock_bh(&rfcomm_dev_lock);
    1186 + list_del_init(&dev->list);
    1187 + write_unlock_bh(&rfcomm_dev_lock);
    1188 +
    1189 rfcomm_dlc_lock(dlc);
    1190 /* Detach DLC if it's owned by this dev */
    1191 if (dlc->owner == dev)
    1192 @@ -154,8 +158,13 @@ static inline struct rfcomm_dev *rfcomm_dev_get(int id)
    1193 read_lock(&rfcomm_dev_lock);
    1194
    1195 dev = __rfcomm_dev_get(id);
    1196 - if (dev)
    1197 - rfcomm_dev_hold(dev);
    1198 +
    1199 + if (dev) {
    1200 + if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
    1201 + dev = NULL;
    1202 + else
    1203 + rfcomm_dev_hold(dev);
    1204 + }
    1205
    1206 read_unlock(&rfcomm_dev_lock);
    1207
    1208 @@ -263,6 +272,12 @@ out:
    1209
    1210 tty_register_device(rfcomm_tty_driver, dev->id, rfcomm_get_device(dev));
    1211
    1212 + if (IS_ERR(dev->tty_dev)) {
    1213 + list_del(&dev->list);
    1214 + kfree(dev);
    1215 + return PTR_ERR(dev->tty_dev);
    1216 + }
    1217 +
    1218 return dev->id;
    1219 }
    1220
    1221 @@ -270,10 +285,7 @@ static void rfcomm_dev_del(struct rfcomm_dev *dev)
    1222 {
    1223 BT_DBG("dev %p", dev);
    1224
    1225 - write_lock_bh(&rfcomm_dev_lock);
    1226 - list_del_init(&dev->list);
    1227 - write_unlock_bh(&rfcomm_dev_lock);
    1228 -
    1229 + set_bit(RFCOMM_TTY_RELEASED, &dev->flags);
    1230 rfcomm_dev_put(dev);
    1231 }
    1232
    1233 @@ -327,7 +339,7 @@ static int rfcomm_create_dev(struct sock *sk, void __user *arg)
    1234 if (copy_from_user(&req, arg, sizeof(req)))
    1235 return -EFAULT;
    1236
    1237 - BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
    1238 + BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
    1239
    1240 if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
    1241 return -EPERM;
    1242 @@ -368,7 +380,7 @@ static int rfcomm_release_dev(void __user *arg)
    1243 if (copy_from_user(&req, arg, sizeof(req)))
    1244 return -EFAULT;
    1245
    1246 - BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
    1247 + BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
    1248
    1249 if (!(dev = rfcomm_dev_get(req.dev_id)))
    1250 return -ENODEV;
    1251 @@ -381,6 +393,10 @@ static int rfcomm_release_dev(void __user *arg)
    1252 if (req.flags & (1 << RFCOMM_HANGUP_NOW))
    1253 rfcomm_dlc_close(dev->dlc, 0);
    1254
    1255 + /* Shut down TTY synchronously before freeing rfcomm_dev */
    1256 + if (dev->tty)
    1257 + tty_vhangup(dev->tty);
    1258 +
    1259 rfcomm_dev_del(dev);
    1260 rfcomm_dev_put(dev);
    1261 return 0;
    1262 @@ -413,6 +429,8 @@ static int rfcomm_get_dev_list(void __user *arg)
    1263
    1264 list_for_each(p, &rfcomm_dev_list) {
    1265 struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
    1266 + if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
    1267 + continue;
    1268 (di + n)->id = dev->id;
    1269 (di + n)->flags = dev->flags;
    1270 (di + n)->state = dev->dlc->state;
    1271 diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
    1272 index 3cad026..acc1ee0 100644
    1273 --- a/net/core/gen_estimator.c
    1274 +++ b/net/core/gen_estimator.c
    1275 @@ -79,27 +79,27 @@
    1276
    1277 struct gen_estimator
    1278 {
    1279 - struct gen_estimator *next;
    1280 + struct list_head list;
    1281 struct gnet_stats_basic *bstats;
    1282 struct gnet_stats_rate_est *rate_est;
    1283 spinlock_t *stats_lock;
    1284 - unsigned interval;
    1285 int ewma_log;
    1286 u64 last_bytes;
    1287 u32 last_packets;
    1288 u32 avpps;
    1289 u32 avbps;
    1290 + struct rcu_head e_rcu;
    1291 };
    1292
    1293 struct gen_estimator_head
    1294 {
    1295 struct timer_list timer;
    1296 - struct gen_estimator *list;
    1297 + struct list_head list;
    1298 };
    1299
    1300 static struct gen_estimator_head elist[EST_MAX_INTERVAL+1];
    1301
    1302 -/* Estimator array lock */
    1303 +/* Protects against NULL dereference */
    1304 static DEFINE_RWLOCK(est_lock);
    1305
    1306 static void est_timer(unsigned long arg)
    1307 @@ -107,13 +107,17 @@ static void est_timer(unsigned long arg)
    1308 int idx = (int)arg;
    1309 struct gen_estimator *e;
    1310
    1311 - read_lock(&est_lock);
    1312 - for (e = elist[idx].list; e; e = e->next) {
    1313 + rcu_read_lock();
    1314 + list_for_each_entry_rcu(e, &elist[idx].list, list) {
    1315 u64 nbytes;
    1316 u32 npackets;
    1317 u32 rate;
    1318
    1319 spin_lock(e->stats_lock);
    1320 + read_lock(&est_lock);
    1321 + if (e->bstats == NULL)
    1322 + goto skip;
    1323 +
    1324 nbytes = e->bstats->bytes;
    1325 npackets = e->bstats->packets;
    1326 rate = (nbytes - e->last_bytes)<<(7 - idx);
    1327 @@ -125,11 +129,14 @@ static void est_timer(unsigned long arg)
    1328 e->last_packets = npackets;
    1329 e->avpps += ((long)rate - (long)e->avpps) >> e->ewma_log;
    1330 e->rate_est->pps = (e->avpps+0x1FF)>>10;
    1331 +skip:
    1332 + read_unlock(&est_lock);
    1333 spin_unlock(e->stats_lock);
    1334 }
    1335
    1336 - mod_timer(&elist[idx].timer, jiffies + ((HZ<<idx)/4));
    1337 - read_unlock(&est_lock);
    1338 + if (!list_empty(&elist[idx].list))
    1339 + mod_timer(&elist[idx].timer, jiffies + ((HZ<<idx)/4));
    1340 + rcu_read_unlock();
    1341 }
    1342
    1343 /**
    1344 @@ -146,12 +153,17 @@ static void est_timer(unsigned long arg)
    1345 * &rate_est with the statistics lock grabed during this period.
    1346 *
    1347 * Returns 0 on success or a negative error code.
    1348 + *
    1349 + * NOTE: Called under rtnl_mutex
    1350 */
    1351 int gen_new_estimator(struct gnet_stats_basic *bstats,
    1352 - struct gnet_stats_rate_est *rate_est, spinlock_t *stats_lock, struct rtattr *opt)
    1353 + struct gnet_stats_rate_est *rate_est,
    1354 + spinlock_t *stats_lock,
    1355 + struct rtattr *opt)
    1356 {
    1357 struct gen_estimator *est;
    1358 struct gnet_estimator *parm = RTA_DATA(opt);
    1359 + int idx;
    1360
    1361 if (RTA_PAYLOAD(opt) < sizeof(*parm))
    1362 return -EINVAL;
    1363 @@ -163,7 +175,7 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
    1364 if (est == NULL)
    1365 return -ENOBUFS;
    1366
    1367 - est->interval = parm->interval + 2;
    1368 + idx = parm->interval + 2;
    1369 est->bstats = bstats;
    1370 est->rate_est = rate_est;
    1371 est->stats_lock = stats_lock;
    1372 @@ -173,20 +185,25 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
    1373 est->last_packets = bstats->packets;
    1374 est->avpps = rate_est->pps<<10;
    1375
    1376 - est->next = elist[est->interval].list;
    1377 - if (est->next == NULL) {
    1378 - init_timer(&elist[est->interval].timer);
    1379 - elist[est->interval].timer.data = est->interval;
    1380 - elist[est->interval].timer.expires = jiffies + ((HZ<<est->interval)/4);
    1381 - elist[est->interval].timer.function = est_timer;
    1382 - add_timer(&elist[est->interval].timer);
    1383 + if (!elist[idx].timer.function) {
    1384 + INIT_LIST_HEAD(&elist[idx].list);
    1385 + setup_timer(&elist[idx].timer, est_timer, idx);
    1386 }
    1387 - write_lock_bh(&est_lock);
    1388 - elist[est->interval].list = est;
    1389 - write_unlock_bh(&est_lock);
    1390 +
    1391 + if (list_empty(&elist[idx].list))
    1392 + mod_timer(&elist[idx].timer, jiffies + ((HZ<<idx)/4));
    1393 +
    1394 + list_add_rcu(&est->list, &elist[idx].list);
    1395 return 0;
    1396 }
    1397
    1398 +static void __gen_kill_estimator(struct rcu_head *head)
    1399 +{
    1400 + struct gen_estimator *e = container_of(head,
    1401 + struct gen_estimator, e_rcu);
    1402 + kfree(e);
    1403 +}
    1404 +
    1405 /**
    1406 * gen_kill_estimator - remove a rate estimator
    1407 * @bstats: basic statistics
    1408 @@ -194,31 +211,32 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
    1409 *
    1410 * Removes the rate estimator specified by &bstats and &rate_est
    1411 * and deletes the timer.
    1412 + *
    1413 + * NOTE: Called under rtnl_mutex
    1414 */
    1415 void gen_kill_estimator(struct gnet_stats_basic *bstats,
    1416 struct gnet_stats_rate_est *rate_est)
    1417 {
    1418 int idx;
    1419 - struct gen_estimator *est, **pest;
    1420 + struct gen_estimator *e, *n;
    1421
    1422 for (idx=0; idx <= EST_MAX_INTERVAL; idx++) {
    1423 - int killed = 0;
    1424 - pest = &elist[idx].list;
    1425 - while ((est=*pest) != NULL) {
    1426 - if (est->rate_est != rate_est || est->bstats != bstats) {
    1427 - pest = &est->next;
    1428 +
    1429 + /* Skip non initialized indexes */
    1430 + if (!elist[idx].timer.function)
    1431 + continue;
    1432 +
    1433 + list_for_each_entry_safe(e, n, &elist[idx].list, list) {
    1434 + if (e->rate_est != rate_est || e->bstats != bstats)
    1435 continue;
    1436 - }
    1437
    1438 write_lock_bh(&est_lock);
    1439 - *pest = est->next;
    1440 + e->bstats = NULL;
    1441 write_unlock_bh(&est_lock);
    1442
    1443 - kfree(est);
    1444 - killed++;
    1445 + list_del_rcu(&e->list);
    1446 + call_rcu(&e->e_rcu, __gen_kill_estimator);
    1447 }
    1448 - if (killed && elist[idx].list == NULL)
    1449 - del_timer(&elist[idx].timer);
    1450 }
    1451 }
    1452
    1453 diff --git a/net/core/netpoll.c b/net/core/netpoll.c
    1454 index 522e441..3431d48 100644
    1455 --- a/net/core/netpoll.c
    1456 +++ b/net/core/netpoll.c
    1457 @@ -776,7 +776,6 @@ void netpoll_cleanup(struct netpoll *np)
    1458 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
    1459 }
    1460
    1461 - np->dev->npinfo = NULL;
    1462 if (atomic_dec_and_test(&npinfo->refcnt)) {
    1463 skb_queue_purge(&npinfo->arp_tx);
    1464 skb_queue_purge(&npinfo->txq);
    1465 @@ -784,6 +783,7 @@ void netpoll_cleanup(struct netpoll *np)
    1466 flush_scheduled_work();
    1467
    1468 kfree(npinfo);
    1469 + np->dev->npinfo = NULL;
    1470 }
    1471 }
    1472
    1473 diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
    1474 index a824852..dadb65c 100644
    1475 --- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
    1476 +++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
    1477 @@ -271,8 +271,11 @@ ieee80211softmac_assoc_work(struct work_struct *work)
    1478 */
    1479 dprintk(KERN_INFO PFX "Associate: Scanning for networks first.\n");
    1480 ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL);
    1481 - if (ieee80211softmac_start_scan(mac))
    1482 + if (ieee80211softmac_start_scan(mac)) {
    1483 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
    1484 + mac->associnfo.associating = 0;
    1485 + mac->associnfo.associated = 0;
    1486 + }
    1487 goto out;
    1488 } else {
    1489 mac->associnfo.associating = 0;
    1490 diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
    1491 index fb58e03..c3c39ed 100644
    1492 --- a/net/ieee80211/softmac/ieee80211softmac_wx.c
    1493 +++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
    1494 @@ -74,8 +74,8 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
    1495 struct ieee80211softmac_auth_queue_item *authptr;
    1496 int length = 0;
    1497
    1498 +check_assoc_again:
    1499 mutex_lock(&sm->associnfo.mutex);
    1500 -
    1501 /* Check if we're already associating to this or another network
    1502 * If it's another network, cancel and start over with our new network
    1503 * If it's our network, ignore the change, we're already doing it!
    1504 @@ -98,13 +98,18 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
    1505 cancel_delayed_work(&authptr->work);
    1506 sm->associnfo.bssvalid = 0;
    1507 sm->associnfo.bssfixed = 0;
    1508 - flush_scheduled_work();
    1509 sm->associnfo.associating = 0;
    1510 sm->associnfo.associated = 0;
    1511 + /* We must unlock to avoid deadlocks with the assoc workqueue
    1512 + * on the associnfo.mutex */
    1513 + mutex_unlock(&sm->associnfo.mutex);
    1514 + flush_scheduled_work();
    1515 + /* Avoid race! Check assoc status again. Maybe someone started an
    1516 + * association while we flushed. */
    1517 + goto check_assoc_again;
    1518 }
    1519 }
    1520
    1521 -
    1522 sm->associnfo.static_essid = 0;
    1523 sm->associnfo.assoc_wait = 0;
    1524
    1525 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1526 index e383ac8..0d21d96 100644
    1527 --- a/net/ipv6/addrconf.c
    1528 +++ b/net/ipv6/addrconf.c
    1529 @@ -2451,6 +2451,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
    1530 write_unlock_bh(&idev->lock);
    1531
    1532 __ipv6_ifa_notify(RTM_DELADDR, ifa);
    1533 + atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
    1534 in6_ifa_put(ifa);
    1535
    1536 write_lock_bh(&idev->lock);
    1537 diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
    1538 index fe0c895..7cf5248 100644
    1539 --- a/net/ipv6/anycast.c
    1540 +++ b/net/ipv6/anycast.c
    1541 @@ -67,6 +67,7 @@ ip6_onlink(struct in6_addr *addr, struct net_device *dev)
    1542 break;
    1543 }
    1544 read_unlock_bh(&idev->lock);
    1545 + in6_dev_put(idev);
    1546 }
    1547 rcu_read_unlock();
    1548 return onlink;
    1549 diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
    1550 index 3dcc4b7..4437a70 100644
    1551 --- a/net/ipv6/icmp.c
    1552 +++ b/net/ipv6/icmp.c
    1553 @@ -600,7 +600,7 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
    1554
    1555 read_lock(&raw_v6_lock);
    1556 if ((sk = sk_head(&raw_v6_htable[hash])) != NULL) {
    1557 - while((sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr,
    1558 + while ((sk = __raw_v6_lookup(sk, nexthdr, saddr, daddr,
    1559 IP6CB(skb)->iif))) {
    1560 rawv6_err(sk, skb, NULL, type, code, inner_offset, info);
    1561 sk = sk_next(sk);
    1562 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1563 index a2d41ba..03f53f5 100644
    1564 --- a/net/ipv6/tcp_ipv6.c
    1565 +++ b/net/ipv6/tcp_ipv6.c
    1566 @@ -637,6 +637,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
    1567 if (tp->md5sig_info->entries6 == 0) {
    1568 kfree(tp->md5sig_info->keys6);
    1569 tp->md5sig_info->keys6 = NULL;
    1570 + tp->md5sig_info->alloced6 = 0;
    1571
    1572 tcp_free_md5sig_pool();
    1573
    1574 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
    1575 index ef36be0..c00c73c 100644
    1576 --- a/net/sctp/ipv6.c
    1577 +++ b/net/sctp/ipv6.c
    1578 @@ -874,6 +874,10 @@ static int sctp_inet6_send_verify(struct sctp_sock *opt, union sctp_addr *addr)
    1579 dev = dev_get_by_index(addr->v6.sin6_scope_id);
    1580 if (!dev)
    1581 return 0;
    1582 + if (!ipv6_chk_addr(&addr->v6.sin6_addr, dev, 0)) {
    1583 + dev_put(dev);
    1584 + return 0;
    1585 + }
    1586 dev_put(dev);
    1587 }
    1588 af = opt->pf->af;
    1589 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
    1590 index 066c64a..6179767 100644
    1591 --- a/net/sunrpc/auth_gss/svcauth_gss.c
    1592 +++ b/net/sunrpc/auth_gss/svcauth_gss.c
    1593 @@ -760,11 +760,12 @@ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
    1594 new->h.flavour = &svcauthops_gss;
    1595 new->pseudoflavor = pseudoflavor;
    1596
    1597 + stat = 0;
    1598 test = auth_domain_lookup(name, &new->h);
    1599 - if (test != &new->h) { /* XXX Duplicate registration? */
    1600 - auth_domain_put(&new->h);
    1601 - /* dangling ref-count... */
    1602 - goto out;
    1603 + if (test != &new->h) { /* Duplicate registration */
    1604 + auth_domain_put(test);
    1605 + kfree(new->h.name);
    1606 + goto out_free_dom;
    1607 }
    1608 return 0;
    1609
    1610 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    1611 index 9704e05..c208a8a 100644
    1612 --- a/net/xfrm/xfrm_policy.c
    1613 +++ b/net/xfrm/xfrm_policy.c
    1614 @@ -1971,7 +1971,7 @@ int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
    1615 if (last == first)
    1616 break;
    1617
    1618 - last = last->u.next;
    1619 + last = (struct xfrm_dst *)last->u.dst.next;
    1620 last->child_mtu_cached = mtu;
    1621 }
    1622