Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0128-2.6.27.29-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-2.6.27-r3/0128-2.6.27.29-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (hide annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 8 months ago) by niro
    File size: 52647 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 niro 1176 diff --git a/arch/x86/mm/gup.c b/arch/x86/mm/gup.c
    2     index 007bb06..73e6ce1 100644
    3     --- a/arch/x86/mm/gup.c
    4     +++ b/arch/x86/mm/gup.c
    5     @@ -231,10 +231,15 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
    6     start &= PAGE_MASK;
    7     addr = start;
    8     len = (unsigned long) nr_pages << PAGE_SHIFT;
    9     +
    10     end = start + len;
    11     - if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
    12     - start, len)))
    13     + if (end < start)
    14     + goto slow_irqon;
    15     +
    16     +#ifdef CONFIG_X86_64
    17     + if (end >> 47)
    18     goto slow_irqon;
    19     +#endif
    20    
    21     /*
    22     * XXX: batch / limit 'nr', to avoid large irq off latency
    23     diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
    24     index 1b4763e..e353618 100644
    25     --- a/arch/x86/mm/srat_64.c
    26     +++ b/arch/x86/mm/srat_64.c
    27     @@ -87,8 +87,10 @@ static __init void bad_srat(void)
    28     found_add_area = 0;
    29     for (i = 0; i < MAX_LOCAL_APIC; i++)
    30     apicid_to_node[i] = NUMA_NO_NODE;
    31     - for (i = 0; i < MAX_NUMNODES; i++)
    32     - nodes_add[i].start = nodes[i].end = 0;
    33     + for (i = 0; i < MAX_NUMNODES; i++) {
    34     + nodes[i].start = nodes[i].end = 0;
    35     + nodes_add[i].start = nodes_add[i].end = 0;
    36     + }
    37     remove_all_active_ranges();
    38     }
    39    
    40     diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    41     index e618cbe..e6b3c7e 100644
    42     --- a/drivers/acpi/ec.c
    43     +++ b/drivers/acpi/ec.c
    44     @@ -1013,7 +1013,8 @@ int __init acpi_ec_ecdt_probe(void)
    45     * which needs it, has fake EC._INI method, so use it as flag.
    46     * Keep boot_ec struct as it will be needed soon.
    47     */
    48     - if (ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy)))
    49     + if (!dmi_name_in_vendors("ASUS") ||
    50     + ACPI_FAILURE(acpi_get_handle(boot_ec->handle, "_INI", &dummy)))
    51     return -ENODEV;
    52     install:
    53     if (!ec_install_handlers(boot_ec)) {
    54     diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
    55     index 842e9ed..993772c 100644
    56     --- a/drivers/hid/usbhid/hiddev.c
    57     +++ b/drivers/hid/usbhid/hiddev.c
    58     @@ -484,8 +484,10 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
    59     goto goodreturn;
    60    
    61     case HIDIOCGCOLLECTIONINDEX:
    62     + i = field->usage[uref->usage_index].collection_index;
    63     + unlock_kernel();
    64     kfree(uref_multi);
    65     - return field->usage[uref->usage_index].collection_index;
    66     + return i;
    67     case HIDIOCGUSAGES:
    68     for (i = 0; i < uref_multi->num_values; i++)
    69     uref_multi->values[i] =
    70     diff --git a/drivers/hwmon/max6650.c b/drivers/hwmon/max6650.c
    71     index f27af6a..65cf25f 100644
    72     --- a/drivers/hwmon/max6650.c
    73     +++ b/drivers/hwmon/max6650.c
    74     @@ -407,6 +407,7 @@ static ssize_t set_div(struct device *dev, struct device_attribute *devattr,
    75     data->count = 3;
    76     break;
    77     default:
    78     + mutex_unlock(&data->update_lock);
    79     dev_err(&client->dev,
    80     "illegal value for fan divider (%d)\n", div);
    81     return -EINVAL;
    82     diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
    83     index fe268be..2dacc3e 100644
    84     --- a/drivers/input/misc/wistron_btns.c
    85     +++ b/drivers/input/misc/wistron_btns.c
    86     @@ -627,6 +627,15 @@ static struct dmi_system_id dmi_ids[] __initdata = {
    87     },
    88     {
    89     .callback = dmi_matched,
    90     + .ident = "Maxdata Pro 7000 DX",
    91     + .matches = {
    92     + DMI_MATCH(DMI_SYS_VENDOR, "MAXDATA"),
    93     + DMI_MATCH(DMI_PRODUCT_NAME, "Pro 7000"),
    94     + },
    95     + .driver_data = keymap_fs_amilo_pro_v2000
    96     + },
    97     + {
    98     + .callback = dmi_matched,
    99     .ident = "Fujitsu N3510",
    100     .matches = {
    101     DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
    102     diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
    103     index 5cbf64d..c712bcc 100644
    104     --- a/drivers/isdn/gigaset/ev-layer.c
    105     +++ b/drivers/isdn/gigaset/ev-layer.c
    106     @@ -307,32 +307,33 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
    107     {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}},
    108     {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
    109     {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
    110     - {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */
    111     + {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"},
    112     {RSP_OK, 607,607, -1, 608,-1},
    113     - //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE
    114     {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}},
    115     {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}},
    116    
    117     - {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}},
    118     - {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}},
    119     - {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}},
    120     {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
    121     {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
    122    
    123     - /* dialing */
    124     - {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}},
    125     - {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}},
    126     - {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */
    127     -
    128     - /* connection established */
    129     - {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
    130     - {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
    131     -
    132     - {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout
    133     + /* optional dialing responses */
    134     + {EV_BC_OPEN, 650,650, -1, 651,-1},
    135     + {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}},
    136     + {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}},
    137     + {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}},
    138     + {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}},
    139     +
    140     + /* connect */
    141     + {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
    142     + {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
    143     + ACT_NOTIFY_BC_UP}},
    144     + {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
    145     + {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
    146     + ACT_NOTIFY_BC_UP}},
    147     + {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}},
    148    
    149     /* remote hangup */
    150     - {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
    151     - {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
    152     + {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
    153     + {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
    154     {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
    155    
    156     /* hangup */
    157     @@ -371,7 +372,8 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
    158     {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}},
    159     {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}},
    160    
    161     - {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}},
    162     + {EV_BC_OPEN, 750,750, -1, 751,-1},
    163     + {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}},
    164    
    165     /* B channel closed (general case) */
    166     {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
    167     @@ -914,12 +916,6 @@ static void bchannel_down(struct bc_state *bcs)
    168    
    169     static void bchannel_up(struct bc_state *bcs)
    170     {
    171     - if (!(bcs->chstate & CHS_D_UP)) {
    172     - dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__);
    173     - bcs->chstate |= CHS_D_UP;
    174     - gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN);
    175     - }
    176     -
    177     if (bcs->chstate & CHS_B_UP) {
    178     dev_notice(bcs->cs->dev, "%s: B channel already up\n",
    179     __func__);
    180     diff --git a/drivers/md/md.c b/drivers/md/md.c
    181     index ebbc3bb..b60d328 100644
    182     --- a/drivers/md/md.c
    183     +++ b/drivers/md/md.c
    184     @@ -3281,7 +3281,8 @@ suspend_lo_store(mddev_t *mddev, const char *buf, size_t len)
    185     char *e;
    186     unsigned long long new = simple_strtoull(buf, &e, 10);
    187    
    188     - if (mddev->pers->quiesce == NULL)
    189     + if (mddev->pers == NULL ||
    190     + mddev->pers->quiesce == NULL)
    191     return -EINVAL;
    192     if (buf == e || (*e && *e != '\n'))
    193     return -EINVAL;
    194     @@ -3309,7 +3310,8 @@ suspend_hi_store(mddev_t *mddev, const char *buf, size_t len)
    195     char *e;
    196     unsigned long long new = simple_strtoull(buf, &e, 10);
    197    
    198     - if (mddev->pers->quiesce == NULL)
    199     + if (mddev->pers == NULL ||
    200     + mddev->pers->quiesce == NULL)
    201     return -EINVAL;
    202     if (buf == e || (*e && *e != '\n'))
    203     return -EINVAL;
    204     diff --git a/drivers/net/e100.c b/drivers/net/e100.c
    205     index 5cf78d6..d991167 100644
    206     --- a/drivers/net/e100.c
    207     +++ b/drivers/net/e100.c
    208     @@ -1840,6 +1840,9 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
    209    
    210     if (ioread8(&nic->csr->scb.status) & rus_no_res)
    211     nic->ru_running = RU_SUSPENDED;
    212     + pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
    213     + sizeof(struct rfd),
    214     + PCI_DMA_BIDIRECTIONAL);
    215     return -ENODATA;
    216     }
    217    
    218     diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
    219     index 0f501d2..91e4232 100644
    220     --- a/drivers/net/hamradio/6pack.c
    221     +++ b/drivers/net/hamradio/6pack.c
    222     @@ -397,13 +397,14 @@ static DEFINE_RWLOCK(disc_data_lock);
    223    
    224     static struct sixpack *sp_get(struct tty_struct *tty)
    225     {
    226     + unsigned long flags;
    227     struct sixpack *sp;
    228    
    229     - read_lock(&disc_data_lock);
    230     + read_lock_irqsave(&disc_data_lock, flags);
    231     sp = tty->disc_data;
    232     if (sp)
    233     atomic_inc(&sp->refcnt);
    234     - read_unlock(&disc_data_lock);
    235     + read_unlock_irqrestore(&disc_data_lock, flags);
    236    
    237     return sp;
    238     }
    239     @@ -687,12 +688,13 @@ out:
    240     */
    241     static void sixpack_close(struct tty_struct *tty)
    242     {
    243     + unsigned long flags;
    244     struct sixpack *sp;
    245    
    246     - write_lock(&disc_data_lock);
    247     + write_lock_irqsave(&disc_data_lock, flags);
    248     sp = tty->disc_data;
    249     tty->disc_data = NULL;
    250     - write_unlock(&disc_data_lock);
    251     + write_unlock_irqrestore(&disc_data_lock, flags);
    252     if (!sp)
    253     return;
    254    
    255     diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    256     index b8e25c4..2a9adcc 100644
    257     --- a/drivers/net/hamradio/mkiss.c
    258     +++ b/drivers/net/hamradio/mkiss.c
    259     @@ -246,15 +246,16 @@ static int kiss_esc_crc(unsigned char *s, unsigned char *d, unsigned short crc,
    260     /* Send one completely decapsulated AX.25 packet to the AX.25 layer. */
    261     static void ax_bump(struct mkiss *ax)
    262     {
    263     + unsigned long flags;
    264     struct sk_buff *skb;
    265     int count;
    266    
    267     - spin_lock_bh(&ax->buflock);
    268     + spin_lock_irqsave(&ax->buflock, flags);
    269     if (ax->rbuff[0] > 0x0f) {
    270     if (ax->rbuff[0] & 0x80) {
    271     if (check_crc_16(ax->rbuff, ax->rcount) < 0) {
    272     ax->stats.rx_errors++;
    273     - spin_unlock_bh(&ax->buflock);
    274     + spin_unlock_irqrestore(&ax->buflock, flags);
    275    
    276     return;
    277     }
    278     @@ -269,7 +270,7 @@ static void ax_bump(struct mkiss *ax)
    279     } else if (ax->rbuff[0] & 0x20) {
    280     if (check_crc_flex(ax->rbuff, ax->rcount) < 0) {
    281     ax->stats.rx_errors++;
    282     - spin_unlock_bh(&ax->buflock);
    283     + spin_unlock_irqrestore(&ax->buflock, flags);
    284     return;
    285     }
    286     if (ax->crcmode != CRC_MODE_FLEX && ax->crcauto) {
    287     @@ -296,7 +297,7 @@ static void ax_bump(struct mkiss *ax)
    288     printk(KERN_ERR "mkiss: %s: memory squeeze, dropping packet.\n",
    289     ax->dev->name);
    290     ax->stats.rx_dropped++;
    291     - spin_unlock_bh(&ax->buflock);
    292     + spin_unlock_irqrestore(&ax->buflock, flags);
    293     return;
    294     }
    295    
    296     @@ -306,11 +307,13 @@ static void ax_bump(struct mkiss *ax)
    297     ax->dev->last_rx = jiffies;
    298     ax->stats.rx_packets++;
    299     ax->stats.rx_bytes += count;
    300     - spin_unlock_bh(&ax->buflock);
    301     + spin_unlock_irqrestore(&ax->buflock, flags);
    302     }
    303    
    304     static void kiss_unesc(struct mkiss *ax, unsigned char s)
    305     {
    306     + unsigned long flags;
    307     +
    308     switch (s) {
    309     case END:
    310     /* drop keeptest bit = VSV */
    311     @@ -337,18 +340,18 @@ static void kiss_unesc(struct mkiss *ax, unsigned char s)
    312     break;
    313     }
    314    
    315     - spin_lock_bh(&ax->buflock);
    316     + spin_lock_irqsave(&ax->buflock, flags);
    317     if (!test_bit(AXF_ERROR, &ax->flags)) {
    318     if (ax->rcount < ax->buffsize) {
    319     ax->rbuff[ax->rcount++] = s;
    320     - spin_unlock_bh(&ax->buflock);
    321     + spin_unlock_irqrestore(&ax->buflock, flags);
    322     return;
    323     }
    324    
    325     ax->stats.rx_over_errors++;
    326     set_bit(AXF_ERROR, &ax->flags);
    327     }
    328     - spin_unlock_bh(&ax->buflock);
    329     + spin_unlock_irqrestore(&ax->buflock, flags);
    330     }
    331    
    332     static int ax_set_mac_address(struct net_device *dev, void *addr)
    333     @@ -370,6 +373,7 @@ static void ax_changedmtu(struct mkiss *ax)
    334     {
    335     struct net_device *dev = ax->dev;
    336     unsigned char *xbuff, *rbuff, *oxbuff, *orbuff;
    337     + unsigned long flags;
    338     int len;
    339    
    340     len = dev->mtu * 2;
    341     @@ -395,7 +399,7 @@ static void ax_changedmtu(struct mkiss *ax)
    342     return;
    343     }
    344    
    345     - spin_lock_bh(&ax->buflock);
    346     + spin_lock_irqsave(&ax->buflock, flags);
    347    
    348     oxbuff = ax->xbuff;
    349     ax->xbuff = xbuff;
    350     @@ -426,7 +430,7 @@ static void ax_changedmtu(struct mkiss *ax)
    351     ax->mtu = dev->mtu + 73;
    352     ax->buffsize = len;
    353    
    354     - spin_unlock_bh(&ax->buflock);
    355     + spin_unlock_irqrestore(&ax->buflock, flags);
    356    
    357     kfree(oxbuff);
    358     kfree(orbuff);
    359     @@ -436,6 +440,7 @@ static void ax_changedmtu(struct mkiss *ax)
    360     static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
    361     {
    362     struct mkiss *ax = netdev_priv(dev);
    363     + unsigned long flags;
    364     unsigned char *p;
    365     int actual, count;
    366    
    367     @@ -452,7 +457,7 @@ static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
    368    
    369     p = icp;
    370    
    371     - spin_lock_bh(&ax->buflock);
    372     + spin_lock_irqsave(&ax->buflock, flags);
    373     if ((*p & 0x0f) != 0) {
    374     /* Configuration Command (kissparms(1).
    375     * Protocol spec says: never append CRC.
    376     @@ -482,7 +487,7 @@ static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
    377     ax->crcauto = (cmd ? 0 : 1);
    378     printk(KERN_INFO "mkiss: %s: crc mode %s %d\n", ax->dev->name, (len) ? "set to" : "is", cmd);
    379     }
    380     - spin_unlock_bh(&ax->buflock);
    381     + spin_unlock_irqrestore(&ax->buflock, flags);
    382     netif_start_queue(dev);
    383    
    384     return;
    385     @@ -515,7 +520,7 @@ static void ax_encaps(struct net_device *dev, unsigned char *icp, int len)
    386     count = kiss_esc(p, (unsigned char *)ax->xbuff, len);
    387     }
    388     }
    389     - spin_unlock_bh(&ax->buflock);
    390     + spin_unlock_irqrestore(&ax->buflock, flags);
    391    
    392     set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags);
    393     actual = ax->tty->ops->write(ax->tty, ax->xbuff, count);
    394     @@ -711,13 +716,14 @@ static DEFINE_RWLOCK(disc_data_lock);
    395    
    396     static struct mkiss *mkiss_get(struct tty_struct *tty)
    397     {
    398     + unsigned long flags;
    399     struct mkiss *ax;
    400    
    401     - read_lock(&disc_data_lock);
    402     + read_lock_irqsave(&disc_data_lock, flags);
    403     ax = tty->disc_data;
    404     if (ax)
    405     atomic_inc(&ax->refcnt);
    406     - read_unlock(&disc_data_lock);
    407     + read_unlock_irqrestore(&disc_data_lock, flags);
    408    
    409     return ax;
    410     }
    411     @@ -816,12 +822,13 @@ out:
    412    
    413     static void mkiss_close(struct tty_struct *tty)
    414     {
    415     + unsigned long flags;
    416     struct mkiss *ax;
    417    
    418     - write_lock(&disc_data_lock);
    419     + write_lock_irqsave(&disc_data_lock, flags);
    420     ax = tty->disc_data;
    421     tty->disc_data = NULL;
    422     - write_unlock(&disc_data_lock);
    423     + write_unlock_irqrestore(&disc_data_lock, flags);
    424    
    425     if (!ax)
    426     return;
    427     diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
    428     index 451bdb5..7dac631 100644
    429     --- a/drivers/net/ppp_async.c
    430     +++ b/drivers/net/ppp_async.c
    431     @@ -132,13 +132,15 @@ static DEFINE_RWLOCK(disc_data_lock);
    432    
    433     static struct asyncppp *ap_get(struct tty_struct *tty)
    434     {
    435     + unsigned long flags;
    436     struct asyncppp *ap;
    437    
    438     - read_lock(&disc_data_lock);
    439     + read_lock_irqsave(&disc_data_lock, flags);
    440     ap = tty->disc_data;
    441     if (ap != NULL)
    442     atomic_inc(&ap->refcnt);
    443     - read_unlock(&disc_data_lock);
    444     + read_unlock_irqrestore(&disc_data_lock, flags);
    445     +
    446     return ap;
    447     }
    448    
    449     @@ -212,12 +214,13 @@ ppp_asynctty_open(struct tty_struct *tty)
    450     static void
    451     ppp_asynctty_close(struct tty_struct *tty)
    452     {
    453     + unsigned long flags;
    454     struct asyncppp *ap;
    455    
    456     - write_lock_irq(&disc_data_lock);
    457     + write_lock_irqsave(&disc_data_lock, flags);
    458     ap = tty->disc_data;
    459     tty->disc_data = NULL;
    460     - write_unlock_irq(&disc_data_lock);
    461     + write_unlock_irqrestore(&disc_data_lock, flags);
    462     if (!ap)
    463     return;
    464    
    465     diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
    466     index 801d8f9..13cc986 100644
    467     --- a/drivers/net/ppp_synctty.c
    468     +++ b/drivers/net/ppp_synctty.c
    469     @@ -182,13 +182,15 @@ static DEFINE_RWLOCK(disc_data_lock);
    470    
    471     static struct syncppp *sp_get(struct tty_struct *tty)
    472     {
    473     + unsigned long flags;
    474     struct syncppp *ap;
    475    
    476     - read_lock(&disc_data_lock);
    477     + read_lock_irqsave(&disc_data_lock, flags);
    478     ap = tty->disc_data;
    479     if (ap != NULL)
    480     atomic_inc(&ap->refcnt);
    481     - read_unlock(&disc_data_lock);
    482     + read_unlock_irqrestore(&disc_data_lock, flags);
    483     +
    484     return ap;
    485     }
    486    
    487     @@ -259,12 +261,13 @@ ppp_sync_open(struct tty_struct *tty)
    488     static void
    489     ppp_sync_close(struct tty_struct *tty)
    490     {
    491     + unsigned long flags;
    492     struct syncppp *ap;
    493    
    494     - write_lock_irq(&disc_data_lock);
    495     + write_lock_irqsave(&disc_data_lock, flags);
    496     ap = tty->disc_data;
    497     tty->disc_data = NULL;
    498     - write_unlock_irq(&disc_data_lock);
    499     + write_unlock_irqrestore(&disc_data_lock, flags);
    500     if (!ap)
    501     return;
    502    
    503     diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
    504     index 5952522..f718215 100644
    505     --- a/drivers/net/r8169.c
    506     +++ b/drivers/net/r8169.c
    507     @@ -2850,54 +2850,64 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
    508     int handled = 0;
    509     int status;
    510    
    511     + /* loop handling interrupts until we have no new ones or
    512     + * we hit a invalid/hotplug case.
    513     + */
    514     status = RTL_R16(IntrStatus);
    515     + while (status && status != 0xffff) {
    516     + handled = 1;
    517    
    518     - /* hotplug/major error/no more work/shared irq */
    519     - if ((status == 0xffff) || !status)
    520     - goto out;
    521     -
    522     - handled = 1;
    523     + /* Handle all of the error cases first. These will reset
    524     + * the chip, so just exit the loop.
    525     + */
    526     + if (unlikely(!netif_running(dev))) {
    527     + rtl8169_asic_down(ioaddr);
    528     + break;
    529     + }
    530    
    531     - if (unlikely(!netif_running(dev))) {
    532     - rtl8169_asic_down(ioaddr);
    533     - goto out;
    534     - }
    535     + /* Work around for rx fifo overflow */
    536     + if (unlikely(status & RxFIFOOver) &&
    537     + (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
    538     + netif_stop_queue(dev);
    539     + rtl8169_tx_timeout(dev);
    540     + break;
    541     + }
    542    
    543     - status &= tp->intr_mask;
    544     - RTL_W16(IntrStatus,
    545     - (status & RxFIFOOver) ? (status | RxOverflow) : status);
    546     + if (unlikely(status & SYSErr)) {
    547     + rtl8169_pcierr_interrupt(dev);
    548     + break;
    549     + }
    550    
    551     - if (!(status & tp->intr_event))
    552     - goto out;
    553     + if (status & LinkChg)
    554     + rtl8169_check_link_status(dev, tp, ioaddr);
    555    
    556     - /* Work around for rx fifo overflow */
    557     - if (unlikely(status & RxFIFOOver) &&
    558     - (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
    559     - netif_stop_queue(dev);
    560     - rtl8169_tx_timeout(dev);
    561     - goto out;
    562     - }
    563     + /* We need to see the lastest version of tp->intr_mask to
    564     + * avoid ignoring an MSI interrupt and having to wait for
    565     + * another event which may never come.
    566     + */
    567     + smp_rmb();
    568     + if (status & tp->intr_mask & tp->napi_event) {
    569     + RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
    570     + tp->intr_mask = ~tp->napi_event;
    571     +
    572     + if (likely(napi_schedule_prep(&tp->napi)))
    573     + __napi_schedule(&tp->napi);
    574     + else if (netif_msg_intr(tp)) {
    575     + printk(KERN_INFO "%s: interrupt %04x in poll\n",
    576     + dev->name, status);
    577     + }
    578     + }
    579    
    580     - if (unlikely(status & SYSErr)) {
    581     - rtl8169_pcierr_interrupt(dev);
    582     - goto out;
    583     + /* We only get a new MSI interrupt when all active irq
    584     + * sources on the chip have been acknowledged. So, ack
    585     + * everything we've seen and check if new sources have become
    586     + * active to avoid blocking all interrupts from the chip.
    587     + */
    588     + RTL_W16(IntrStatus,
    589     + (status & RxFIFOOver) ? (status | RxOverflow) : status);
    590     + status = RTL_R16(IntrStatus);
    591     }
    592    
    593     - if (status & LinkChg)
    594     - rtl8169_check_link_status(dev, tp, ioaddr);
    595     -
    596     - if (status & tp->napi_event) {
    597     - RTL_W16(IntrMask, tp->intr_event & ~tp->napi_event);
    598     - tp->intr_mask = ~tp->napi_event;
    599     -
    600     - if (likely(netif_rx_schedule_prep(dev, &tp->napi)))
    601     - __netif_rx_schedule(dev, &tp->napi);
    602     - else if (netif_msg_intr(tp)) {
    603     - printk(KERN_INFO "%s: interrupt %04x in poll\n",
    604     - dev->name, status);
    605     - }
    606     - }
    607     -out:
    608     return IRQ_RETVAL(handled);
    609     }
    610    
    611     @@ -2913,13 +2923,15 @@ static int rtl8169_poll(struct napi_struct *napi, int budget)
    612    
    613     if (work_done < budget) {
    614     netif_rx_complete(dev, napi);
    615     - tp->intr_mask = 0xffff;
    616     - /*
    617     - * 20040426: the barrier is not strictly required but the
    618     - * behavior of the irq handler could be less predictable
    619     - * without it. Btw, the lack of flush for the posted pci
    620     - * write is safe - FR
    621     +
    622     + /* We need for force the visibility of tp->intr_mask
    623     + * for other CPUs, as we can loose an MSI interrupt
    624     + * and potentially wait for a retransmit timeout if we don't.
    625     + * The posted write to IntrMask is safe, as it will
    626     + * eventually make it to the chip and we won't loose anything
    627     + * until it does.
    628     */
    629     + tp->intr_mask = 0xffff;
    630     smp_wmb();
    631     RTL_W16(IntrMask, tp->intr_event);
    632     }
    633     diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    634     index b68bc39..42963a9 100644
    635     --- a/drivers/net/sky2.c
    636     +++ b/drivers/net/sky2.c
    637     @@ -2393,7 +2393,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
    638     if (likely(status >> 16 == (status & 0xffff))) {
    639     skb = sky2->rx_ring[sky2->rx_next].skb;
    640     skb->ip_summed = CHECKSUM_COMPLETE;
    641     - skb->csum = status & 0xffff;
    642     + skb->csum = le16_to_cpu(status);
    643     } else {
    644     printk(KERN_NOTICE PFX "%s: hardware receive "
    645     "checksum problem (status = %#x)\n",
    646     diff --git a/drivers/net/usb/cdc_subset.c b/drivers/net/usb/cdc_subset.c
    647     index c66b9c3..ca39ace 100644
    648     --- a/drivers/net/usb/cdc_subset.c
    649     +++ b/drivers/net/usb/cdc_subset.c
    650     @@ -307,9 +307,10 @@ static const struct usb_device_id products [] = {
    651     USB_DEVICE (0x1286, 0x8001), // "blob" bootloader
    652     .driver_info = (unsigned long) &blob_info,
    653     }, {
    654     - // Linux Ethernet/RNDIS gadget on pxa210/25x/26x, second config
    655     - // e.g. Gumstix, current OpenZaurus, ...
    656     - USB_DEVICE_VER (0x0525, 0xa4a2, 0x0203, 0x0203),
    657     + // Linux Ethernet/RNDIS gadget, mostly on PXA, second config
    658     + // e.g. Gumstix, current OpenZaurus, ... or anything else
    659     + // that just enables this gadget option.
    660     + USB_DEVICE (0x0525, 0xa4a2),
    661     .driver_info = (unsigned long) &linuxdev_info,
    662     },
    663     #endif
    664     diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c
    665     index 8c19307..a04a8b0 100644
    666     --- a/drivers/net/usb/pegasus.c
    667     +++ b/drivers/net/usb/pegasus.c
    668     @@ -295,7 +295,7 @@ static int update_eth_regs_async(pegasus_t * pegasus)
    669    
    670     pegasus->dr.bRequestType = PEGASUS_REQT_WRITE;
    671     pegasus->dr.bRequest = PEGASUS_REQ_SET_REGS;
    672     - pegasus->dr.wValue = 0;
    673     + pegasus->dr.wValue = cpu_to_le16(0);
    674     pegasus->dr.wIndex = cpu_to_le16(EthCtrl0);
    675     pegasus->dr.wLength = cpu_to_le16(3);
    676     pegasus->ctrl_urb->transfer_buffer_length = 3;
    677     @@ -444,11 +444,12 @@ static int write_eprom_word(pegasus_t * pegasus, __u8 index, __u16 data)
    678     int i;
    679     __u8 tmp, d[4] = { 0x3f, 0, 0, EPROM_WRITE };
    680     int ret;
    681     + __le16 le_data = cpu_to_le16(data);
    682    
    683     set_registers(pegasus, EpromOffset, 4, d);
    684     enable_eprom_write(pegasus);
    685     set_register(pegasus, EpromOffset, index);
    686     - set_registers(pegasus, EpromData, 2, &data);
    687     + set_registers(pegasus, EpromData, 2, &le_data);
    688     set_register(pegasus, EpromCtrl, EPROM_WRITE);
    689    
    690     for (i = 0; i < REG_TIMEOUT; i++) {
    691     @@ -918,29 +919,32 @@ static struct net_device_stats *pegasus_netdev_stats(struct net_device *dev)
    692    
    693     static inline void disable_net_traffic(pegasus_t * pegasus)
    694     {
    695     - int tmp = 0;
    696     + __le16 tmp = cpu_to_le16(0);
    697    
    698     - set_registers(pegasus, EthCtrl0, 2, &tmp);
    699     + set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp);
    700     }
    701    
    702     static inline void get_interrupt_interval(pegasus_t * pegasus)
    703     {
    704     - __u8 data[2];
    705     + u16 data;
    706     + u8 interval;
    707    
    708     - read_eprom_word(pegasus, 4, (__u16 *) data);
    709     + read_eprom_word(pegasus, 4, &data);
    710     + interval = data >> 8;
    711     if (pegasus->usb->speed != USB_SPEED_HIGH) {
    712     - if (data[1] < 0x80) {
    713     + if (interval < 0x80) {
    714     if (netif_msg_timer(pegasus))
    715     dev_info(&pegasus->intf->dev, "intr interval "
    716     "changed from %ums to %ums\n",
    717     - data[1], 0x80);
    718     - data[1] = 0x80;
    719     + interval, 0x80);
    720     + interval = 0x80;
    721     + data = (data & 0x00FF) | ((u16)interval << 8);
    722     #ifdef PEGASUS_WRITE_EEPROM
    723     - write_eprom_word(pegasus, 4, *(__u16 *) data);
    724     + write_eprom_word(pegasus, 4, data);
    725     #endif
    726     }
    727     }
    728     - pegasus->intr_interval = data[1];
    729     + pegasus->intr_interval = interval;
    730     }
    731    
    732     static void set_carrier(struct net_device *net)
    733     @@ -1293,7 +1297,8 @@ static int pegasus_blacklisted(struct usb_device *udev)
    734     /* Special quirk to keep the driver from handling the Belkin Bluetooth
    735     * dongle which happens to have the same ID.
    736     */
    737     - if ((udd->idVendor == VENDOR_BELKIN && udd->idProduct == 0x0121) &&
    738     + if ((udd->idVendor == cpu_to_le16(VENDOR_BELKIN)) &&
    739     + (udd->idProduct == cpu_to_le16(0x0121)) &&
    740     (udd->bDeviceClass == USB_CLASS_WIRELESS_CONTROLLER) &&
    741     (udd->bDeviceProtocol == 1))
    742     return 1;
    743     diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
    744     index 417e9e6..1e26ddc 100644
    745     --- a/drivers/net/wireless/strip.c
    746     +++ b/drivers/net/wireless/strip.c
    747     @@ -856,6 +856,7 @@ static int strip_change_mtu(struct net_device *dev, int new_mtu)
    748     unsigned char *orbuff = strip_info->rx_buff;
    749     unsigned char *osbuff = strip_info->sx_buff;
    750     unsigned char *otbuff = strip_info->tx_buff;
    751     + unsigned long flags;
    752    
    753     if (new_mtu > MAX_SEND_MTU) {
    754     printk(KERN_ERR
    755     @@ -864,11 +865,11 @@ static int strip_change_mtu(struct net_device *dev, int new_mtu)
    756     return -EINVAL;
    757     }
    758    
    759     - spin_lock_bh(&strip_lock);
    760     + spin_lock_irqsave(&strip_lock, flags);
    761     if (!allocate_buffers(strip_info, new_mtu)) {
    762     printk(KERN_ERR "%s: unable to grow strip buffers, MTU change cancelled.\n",
    763     strip_info->dev->name);
    764     - spin_unlock_bh(&strip_lock);
    765     + spin_unlock_irqrestore(&strip_lock, flags);
    766     return -ENOMEM;
    767     }
    768    
    769     @@ -892,7 +893,7 @@ static int strip_change_mtu(struct net_device *dev, int new_mtu)
    770     }
    771     }
    772     strip_info->tx_head = strip_info->tx_buff;
    773     - spin_unlock_bh(&strip_lock);
    774     + spin_unlock_irqrestore(&strip_lock, flags);
    775    
    776     printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n",
    777     strip_info->dev->name, old_mtu, strip_info->mtu);
    778     @@ -981,10 +982,13 @@ static void strip_seq_neighbours(struct seq_file *seq,
    779     const MetricomNodeTable * table,
    780     const char *title)
    781     {
    782     - /* We wrap this in a do/while loop, so if the table changes */
    783     - /* while we're reading it, we just go around and try again. */
    784     + unsigned long flags;
    785     struct timeval t;
    786    
    787     + /*
    788     + * We wrap this in a do/while loop, so if the table changes
    789     + * while we're reading it, we just go around and try again.
    790     + */
    791     do {
    792     int i;
    793     t = table->timestamp;
    794     @@ -993,9 +997,9 @@ static void strip_seq_neighbours(struct seq_file *seq,
    795     for (i = 0; i < table->num_nodes; i++) {
    796     MetricomNode node;
    797    
    798     - spin_lock_bh(&strip_lock);
    799     + spin_lock_irqsave(&strip_lock, flags);
    800     node = table->node[i];
    801     - spin_unlock_bh(&strip_lock);
    802     + spin_unlock_irqrestore(&strip_lock, flags);
    803     seq_printf(seq, " %s\n", node.c);
    804     }
    805     } while (table->timestamp.tv_sec != t.tv_sec
    806     @@ -1535,6 +1539,7 @@ static void strip_send(struct strip *strip_info, struct sk_buff *skb)
    807     static int strip_xmit(struct sk_buff *skb, struct net_device *dev)
    808     {
    809     struct strip *strip_info = netdev_priv(dev);
    810     + unsigned long flags;
    811    
    812     if (!netif_running(dev)) {
    813     printk(KERN_ERR "%s: xmit call when iface is down\n",
    814     @@ -1573,11 +1578,11 @@ static int strip_xmit(struct sk_buff *skb, struct net_device *dev)
    815     strip_info->dev->name, sx_pps_count / 8);
    816     }
    817    
    818     - spin_lock_bh(&strip_lock);
    819     + spin_lock_irqsave(&strip_lock, flags);
    820    
    821     strip_send(strip_info, skb);
    822    
    823     - spin_unlock_bh(&strip_lock);
    824     + spin_unlock_irqrestore(&strip_lock, flags);
    825    
    826     if (skb)
    827     dev_kfree_skb(skb);
    828     @@ -2263,12 +2268,13 @@ static void strip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
    829     {
    830     struct strip *strip_info = (struct strip *) tty->disc_data;
    831     const unsigned char *end = cp + count;
    832     + unsigned long flags;
    833    
    834     if (!strip_info || strip_info->magic != STRIP_MAGIC
    835     || !netif_running(strip_info->dev))
    836     return;
    837    
    838     - spin_lock_bh(&strip_lock);
    839     + spin_lock_irqsave(&strip_lock, flags);
    840     #if 0
    841     {
    842     struct timeval tv;
    843     @@ -2335,7 +2341,7 @@ static void strip_receive_buf(struct tty_struct *tty, const unsigned char *cp,
    844     }
    845     cp++;
    846     }
    847     - spin_unlock_bh(&strip_lock);
    848     + spin_unlock_irqrestore(&strip_lock, flags);
    849     }
    850    
    851    
    852     @@ -2525,9 +2531,11 @@ static void strip_dev_setup(struct net_device *dev)
    853    
    854     static void strip_free(struct strip *strip_info)
    855     {
    856     - spin_lock_bh(&strip_lock);
    857     + unsigned long flags;
    858     +
    859     + spin_lock_irqsave(&strip_lock, flags);
    860     list_del_rcu(&strip_info->list);
    861     - spin_unlock_bh(&strip_lock);
    862     + spin_unlock_irqrestore(&strip_lock, flags);
    863    
    864     strip_info->magic = 0;
    865    
    866     @@ -2541,6 +2549,7 @@ static void strip_free(struct strip *strip_info)
    867     static struct strip *strip_alloc(void)
    868     {
    869     struct list_head *n;
    870     + unsigned long flags;
    871     struct net_device *dev;
    872     struct strip *strip_info;
    873    
    874     @@ -2564,7 +2573,7 @@ static struct strip *strip_alloc(void)
    875     strip_info->idle_timer.function = strip_IdleTask;
    876    
    877    
    878     - spin_lock_bh(&strip_lock);
    879     + spin_lock_irqsave(&strip_lock, flags);
    880     rescan:
    881     /*
    882     * Search the list to find where to put our new entry
    883     @@ -2583,7 +2592,7 @@ static struct strip *strip_alloc(void)
    884     sprintf(dev->name, "st%ld", dev->base_addr);
    885    
    886     list_add_tail_rcu(&strip_info->list, &strip_list);
    887     - spin_unlock_bh(&strip_lock);
    888     + spin_unlock_irqrestore(&strip_lock, flags);
    889    
    890     return strip_info;
    891     }
    892     diff --git a/drivers/pnp/pnpacpi/core.c b/drivers/pnp/pnpacpi/core.c
    893     index 98b9df7..c193540 100644
    894     --- a/drivers/pnp/pnpacpi/core.c
    895     +++ b/drivers/pnp/pnpacpi/core.c
    896     @@ -84,7 +84,6 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
    897     acpi_handle handle = dev->data;
    898     struct acpi_buffer buffer;
    899     int ret;
    900     - acpi_status status;
    901    
    902     dev_dbg(&dev->dev, "set resources\n");
    903     ret = pnpacpi_build_resource_template(dev, &buffer);
    904     @@ -95,21 +94,29 @@ static int pnpacpi_set_resources(struct pnp_dev *dev)
    905     kfree(buffer.pointer);
    906     return ret;
    907     }
    908     - status = acpi_set_current_resources(handle, &buffer);
    909     - if (ACPI_FAILURE(status))
    910     + if (ACPI_FAILURE(acpi_set_current_resources(handle, &buffer)))
    911     ret = -EINVAL;
    912     + else if (acpi_bus_power_manageable(handle))
    913     + ret = acpi_bus_set_power(handle, ACPI_STATE_D0);
    914     kfree(buffer.pointer);
    915     return ret;
    916     }
    917    
    918     static int pnpacpi_disable_resources(struct pnp_dev *dev)
    919     {
    920     - acpi_status status;
    921     + acpi_handle handle = dev->data;
    922     + int ret;
    923     +
    924     + dev_dbg(&dev->dev, "disable resources\n");
    925    
    926     /* acpi_unregister_gsi(pnp_irq(dev, 0)); */
    927     - status = acpi_evaluate_object((acpi_handle) dev->data,
    928     - "_DIS", NULL, NULL);
    929     - return ACPI_FAILURE(status) ? -ENODEV : 0;
    930     + ret = 0;
    931     + if (acpi_bus_power_manageable(handle))
    932     + acpi_bus_set_power(handle, ACPI_STATE_D3);
    933     + /* continue even if acpi_bus_set_power() fails */
    934     + if (ACPI_FAILURE(acpi_evaluate_object(handle, "_DIS", NULL, NULL)))
    935     + ret = -ENODEV;
    936     + return ret;
    937     }
    938    
    939     #ifdef CONFIG_ACPI_SLEEP
    940     diff --git a/drivers/scsi/zalon.c b/drivers/scsi/zalon.c
    941     index 3c4a300..b8171de 100644
    942     --- a/drivers/scsi/zalon.c
    943     +++ b/drivers/scsi/zalon.c
    944     @@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev)
    945    
    946     host = ncr_attach(&zalon7xx_template, unit, &device);
    947     if (!host)
    948     - goto fail;
    949     + return -ENODEV;
    950    
    951     if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) {
    952     printk(KERN_ERR "%s: irq problem with %d, detaching\n ",
    953     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    954     index 8d2d79e..1ff88af 100644
    955     --- a/drivers/usb/core/devio.c
    956     +++ b/drivers/usb/core/devio.c
    957     @@ -976,7 +976,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    958     USBDEVFS_URB_ZERO_PACKET |
    959     USBDEVFS_URB_NO_INTERRUPT))
    960     return -EINVAL;
    961     - if (!uurb->buffer)
    962     + if (uurb->buffer_length > 0 && !uurb->buffer)
    963     return -EINVAL;
    964     if (uurb->signr != 0 && (uurb->signr < SIGRTMIN ||
    965     uurb->signr > SIGRTMAX))
    966     @@ -1035,11 +1035,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    967     is_in = 0;
    968     uurb->endpoint &= ~USB_DIR_IN;
    969     }
    970     - if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
    971     - uurb->buffer, uurb->buffer_length)) {
    972     - kfree(dr);
    973     - return -EFAULT;
    974     - }
    975     snoop(&ps->dev->dev, "control urb: bRequest=%02x "
    976     "bRrequestType=%02x wValue=%04x "
    977     "wIndex=%04x wLength=%04x\n",
    978     @@ -1059,9 +1054,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    979     uurb->number_of_packets = 0;
    980     if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
    981     return -EINVAL;
    982     - if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
    983     - uurb->buffer, uurb->buffer_length))
    984     - return -EFAULT;
    985     snoop(&ps->dev->dev, "bulk urb\n");
    986     break;
    987    
    988     @@ -1103,28 +1095,35 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    989     return -EINVAL;
    990     if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
    991     return -EINVAL;
    992     - if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
    993     - uurb->buffer, uurb->buffer_length))
    994     - return -EFAULT;
    995     snoop(&ps->dev->dev, "interrupt urb\n");
    996     break;
    997    
    998     default:
    999     return -EINVAL;
    1000     }
    1001     - as = alloc_async(uurb->number_of_packets);
    1002     - if (!as) {
    1003     + if (uurb->buffer_length > 0 &&
    1004     + !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
    1005     + uurb->buffer, uurb->buffer_length)) {
    1006     kfree(isopkt);
    1007     kfree(dr);
    1008     - return -ENOMEM;
    1009     + return -EFAULT;
    1010     }
    1011     - as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
    1012     - if (!as->urb->transfer_buffer) {
    1013     + as = alloc_async(uurb->number_of_packets);
    1014     + if (!as) {
    1015     kfree(isopkt);
    1016     kfree(dr);
    1017     - free_async(as);
    1018     return -ENOMEM;
    1019     }
    1020     + if (uurb->buffer_length > 0) {
    1021     + as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
    1022     + GFP_KERNEL);
    1023     + if (!as->urb->transfer_buffer) {
    1024     + kfree(isopkt);
    1025     + kfree(dr);
    1026     + free_async(as);
    1027     + return -ENOMEM;
    1028     + }
    1029     + }
    1030     as->urb->dev = ps->dev;
    1031     as->urb->pipe = (uurb->type << 30) |
    1032     __create_pipe(ps->dev, uurb->endpoint & 0xf) |
    1033     @@ -1166,7 +1165,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    1034     kfree(isopkt);
    1035     as->ps = ps;
    1036     as->userurb = arg;
    1037     - if (uurb->endpoint & USB_DIR_IN)
    1038     + if (is_in && uurb->buffer_length > 0)
    1039     as->userbuffer = uurb->buffer;
    1040     else
    1041     as->userbuffer = NULL;
    1042     @@ -1176,9 +1175,9 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
    1043     as->uid = current->uid;
    1044     as->euid = current->euid;
    1045     security_task_getsecid(current, &as->secid);
    1046     - if (!is_in) {
    1047     + if (!is_in && uurb->buffer_length > 0) {
    1048     if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
    1049     - as->urb->transfer_buffer_length)) {
    1050     + uurb->buffer_length)) {
    1051     free_async(as);
    1052     return -EFAULT;
    1053     }
    1054     @@ -1228,22 +1227,22 @@ static int processcompl(struct async *as, void __user * __user *arg)
    1055     if (as->userbuffer)
    1056     if (copy_to_user(as->userbuffer, urb->transfer_buffer,
    1057     urb->transfer_buffer_length))
    1058     - return -EFAULT;
    1059     + goto err_out;
    1060     if (put_user(as->status, &userurb->status))
    1061     - return -EFAULT;
    1062     + goto err_out;
    1063     if (put_user(urb->actual_length, &userurb->actual_length))
    1064     - return -EFAULT;
    1065     + goto err_out;
    1066     if (put_user(urb->error_count, &userurb->error_count))
    1067     - return -EFAULT;
    1068     + goto err_out;
    1069    
    1070     if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
    1071     for (i = 0; i < urb->number_of_packets; i++) {
    1072     if (put_user(urb->iso_frame_desc[i].actual_length,
    1073     &userurb->iso_frame_desc[i].actual_length))
    1074     - return -EFAULT;
    1075     + goto err_out;
    1076     if (put_user(urb->iso_frame_desc[i].status,
    1077     &userurb->iso_frame_desc[i].status))
    1078     - return -EFAULT;
    1079     + goto err_out;
    1080     }
    1081     }
    1082    
    1083     @@ -1252,6 +1251,10 @@ static int processcompl(struct async *as, void __user * __user *arg)
    1084     if (put_user(addr, (void __user * __user *)arg))
    1085     return -EFAULT;
    1086     return 0;
    1087     +
    1088     +err_out:
    1089     + free_async(as);
    1090     + return -EFAULT;
    1091     }
    1092    
    1093     static struct async *reap_as(struct dev_state *ps)
    1094     diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
    1095     index bcac2e6..c5d6765 100644
    1096     --- a/drivers/usb/gadget/ether.c
    1097     +++ b/drivers/usb/gadget/ether.c
    1098     @@ -273,15 +273,16 @@ static int __init eth_bind(struct usb_composite_dev *cdev)
    1099     /* CDC Subset */
    1100     eth_config_driver.label = "CDC Subset/SAFE";
    1101    
    1102     - device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
    1103     - device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
    1104     - device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
    1105     + device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM);
    1106     + device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM);
    1107     + if (!has_rndis())
    1108     + device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
    1109     }
    1110    
    1111     if (has_rndis()) {
    1112     /* RNDIS plus ECM-or-Subset */
    1113     - device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
    1114     - device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
    1115     + device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
    1116     + device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
    1117     device_desc.bNumConfigurations = 2;
    1118     }
    1119    
    1120     diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
    1121     index 1d0b49e..18e8741 100644
    1122     --- a/drivers/usb/host/ehci-sched.c
    1123     +++ b/drivers/usb/host/ehci-sched.c
    1124     @@ -1617,11 +1617,14 @@ itd_complete (
    1125     desc->status = -EPROTO;
    1126    
    1127     /* HC need not update length with this error */
    1128     - if (!(t & EHCI_ISOC_BABBLE))
    1129     - desc->actual_length = EHCI_ITD_LENGTH (t);
    1130     + if (!(t & EHCI_ISOC_BABBLE)) {
    1131     + desc->actual_length = EHCI_ITD_LENGTH(t);
    1132     + urb->actual_length += desc->actual_length;
    1133     + }
    1134     } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
    1135     desc->status = 0;
    1136     - desc->actual_length = EHCI_ITD_LENGTH (t);
    1137     + desc->actual_length = EHCI_ITD_LENGTH(t);
    1138     + urb->actual_length += desc->actual_length;
    1139     } else {
    1140     /* URB was too late */
    1141     desc->status = -EXDEV;
    1142     @@ -2012,7 +2015,8 @@ sitd_complete (
    1143     desc->status = -EPROTO;
    1144     } else {
    1145     desc->status = 0;
    1146     - desc->actual_length = desc->length - SITD_LENGTH (t);
    1147     + desc->actual_length = desc->length - SITD_LENGTH(t);
    1148     + urb->actual_length += desc->actual_length;
    1149     }
    1150     stream->depth -= stream->interval << 3;
    1151    
    1152     diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    1153     index d8c41ae..bc5e905 100644
    1154     --- a/drivers/usb/serial/ti_usb_3410_5052.c
    1155     +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    1156     @@ -240,7 +240,6 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
    1157     { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
    1158     { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
    1159     { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
    1160     - { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
    1161     };
    1162    
    1163     static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
    1164     @@ -1703,7 +1702,7 @@ static int ti_do_download(struct usb_device *dev, int pipe,
    1165     u8 cs = 0;
    1166     int done;
    1167     struct ti_firmware_header *header;
    1168     - int status;
    1169     + int status = 0;
    1170     int len;
    1171    
    1172     for (pos = sizeof(struct ti_firmware_header); pos < size; pos++)
    1173     diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    1174     index e57df48..a6f8b8f 100644
    1175     --- a/fs/binfmt_elf.c
    1176     +++ b/fs/binfmt_elf.c
    1177     @@ -1517,11 +1517,11 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
    1178     info->thread = NULL;
    1179    
    1180     psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
    1181     - fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
    1182     -
    1183     if (psinfo == NULL)
    1184     return 0;
    1185    
    1186     + fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
    1187     +
    1188     /*
    1189     * Figure out how many notes we're going to need for each thread.
    1190     */
    1191     diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
    1192     index 59b9833..247c0d4 100644
    1193     --- a/fs/ecryptfs/keystore.c
    1194     +++ b/fs/ecryptfs/keystore.c
    1195     @@ -730,6 +730,13 @@ parse_tag_3_packet(struct ecryptfs_crypt_stat *crypt_stat,
    1196     }
    1197     (*new_auth_tok)->session_key.encrypted_key_size =
    1198     (body_size - (ECRYPTFS_SALT_SIZE + 5));
    1199     + if ((*new_auth_tok)->session_key.encrypted_key_size
    1200     + > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
    1201     + printk(KERN_WARNING "Tag 3 packet contains key larger "
    1202     + "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
    1203     + rc = -EINVAL;
    1204     + goto out_free;
    1205     + }
    1206     if (unlikely(data[(*packet_size)++] != 0x04)) {
    1207     printk(KERN_WARNING "Unknown version number [%d]\n",
    1208     data[(*packet_size) - 1]);
    1209     @@ -876,6 +883,12 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents,
    1210     rc = -EINVAL;
    1211     goto out;
    1212     }
    1213     + if (unlikely((*tag_11_contents_size) > max_contents_bytes)) {
    1214     + printk(KERN_ERR "Literal data section in tag 11 packet exceeds "
    1215     + "expected size\n");
    1216     + rc = -EINVAL;
    1217     + goto out;
    1218     + }
    1219     if (data[(*packet_size)++] != 0x62) {
    1220     printk(KERN_WARNING "Unrecognizable packet\n");
    1221     rc = -EINVAL;
    1222     diff --git a/include/net/x25.h b/include/net/x25.h
    1223     index fc3f03d..2cda040 100644
    1224     --- a/include/net/x25.h
    1225     +++ b/include/net/x25.h
    1226     @@ -187,7 +187,7 @@ extern int x25_addr_ntoa(unsigned char *, struct x25_address *,
    1227     extern int x25_addr_aton(unsigned char *, struct x25_address *,
    1228     struct x25_address *);
    1229     extern struct sock *x25_find_socket(unsigned int, struct x25_neigh *);
    1230     -extern void x25_destroy_socket(struct sock *);
    1231     +extern void x25_destroy_socket_from_timer(struct sock *);
    1232     extern int x25_rx_call_request(struct sk_buff *, struct x25_neigh *, unsigned int);
    1233     extern void x25_kill_by_neigh(struct x25_neigh *);
    1234    
    1235     diff --git a/mm/filemap.c b/mm/filemap.c
    1236     index 8a477d3..bff0b00 100644
    1237     --- a/mm/filemap.c
    1238     +++ b/mm/filemap.c
    1239     @@ -2441,6 +2441,7 @@ again:
    1240     pagefault_enable();
    1241     flush_dcache_page(page);
    1242    
    1243     + mark_page_accessed(page);
    1244     status = a_ops->write_end(file, mapping, pos, bytes, copied,
    1245     page, fsdata);
    1246     if (unlikely(status < 0))
    1247     diff --git a/mm/slab.c b/mm/slab.c
    1248     index e76eee4..600e864 100644
    1249     --- a/mm/slab.c
    1250     +++ b/mm/slab.c
    1251     @@ -2580,7 +2580,7 @@ void kmem_cache_destroy(struct kmem_cache *cachep)
    1252     }
    1253    
    1254     if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU))
    1255     - synchronize_rcu();
    1256     + rcu_barrier();
    1257    
    1258     __kmem_cache_destroy(cachep);
    1259     mutex_unlock(&cache_chain_mutex);
    1260     diff --git a/mm/slob.c b/mm/slob.c
    1261     index cb675d1..ed04252 100644
    1262     --- a/mm/slob.c
    1263     +++ b/mm/slob.c
    1264     @@ -561,6 +561,8 @@ EXPORT_SYMBOL(kmem_cache_create);
    1265    
    1266     void kmem_cache_destroy(struct kmem_cache *c)
    1267     {
    1268     + if (c->flags & SLAB_DESTROY_BY_RCU)
    1269     + rcu_barrier();
    1270     slob_free(c, sizeof(struct kmem_cache));
    1271     }
    1272     EXPORT_SYMBOL(kmem_cache_destroy);
    1273     diff --git a/mm/slub.c b/mm/slub.c
    1274     index 0c83e6a..f0175b4 100644
    1275     --- a/mm/slub.c
    1276     +++ b/mm/slub.c
    1277     @@ -2447,6 +2447,8 @@ static inline int kmem_cache_close(struct kmem_cache *s)
    1278     */
    1279     void kmem_cache_destroy(struct kmem_cache *s)
    1280     {
    1281     + if (s->flags & SLAB_DESTROY_BY_RCU)
    1282     + rcu_barrier();
    1283     down_write(&slub_lock);
    1284     s->refcount--;
    1285     if (!s->refcount) {
    1286     diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
    1287     index 76739e9..66cfe88 100644
    1288     --- a/net/sunrpc/clnt.c
    1289     +++ b/net/sunrpc/clnt.c
    1290     @@ -1089,14 +1089,24 @@ static void
    1291     call_transmit_status(struct rpc_task *task)
    1292     {
    1293     task->tk_action = call_status;
    1294     - /*
    1295     - * Special case: if we've been waiting on the socket's write_space()
    1296     - * callback, then don't call xprt_end_transmit().
    1297     - */
    1298     - if (task->tk_status == -EAGAIN)
    1299     - return;
    1300     - xprt_end_transmit(task);
    1301     - rpc_task_force_reencode(task);
    1302     + switch (task->tk_status) {
    1303     + case -EAGAIN:
    1304     + break;
    1305     + default:
    1306     + xprt_end_transmit(task);
    1307     + /*
    1308     + * Special cases: if we've been waiting on the
    1309     + * socket's write_space() callback, or if the
    1310     + * socket just returned a connection error,
    1311     + * then hold onto the transport lock.
    1312     + */
    1313     + case -ECONNREFUSED:
    1314     + case -ENOTCONN:
    1315     + case -EHOSTDOWN:
    1316     + case -EHOSTUNREACH:
    1317     + case -ENETUNREACH:
    1318     + rpc_task_force_reencode(task);
    1319     + }
    1320     }
    1321    
    1322     /*
    1323     diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
    1324     index 4486c59..8f9295d 100644
    1325     --- a/net/sunrpc/xprtsock.c
    1326     +++ b/net/sunrpc/xprtsock.c
    1327     @@ -1150,7 +1150,6 @@ static void xs_tcp_state_change(struct sock *sk)
    1328     break;
    1329     case TCP_CLOSE_WAIT:
    1330     /* The server initiated a shutdown of the socket */
    1331     - set_bit(XPRT_CLOSING, &xprt->state);
    1332     xprt_force_disconnect(xprt);
    1333     case TCP_SYN_SENT:
    1334     xprt->connect_cookie++;
    1335     @@ -1163,6 +1162,7 @@ static void xs_tcp_state_change(struct sock *sk)
    1336     xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
    1337     break;
    1338     case TCP_LAST_ACK:
    1339     + set_bit(XPRT_CLOSING, &xprt->state);
    1340     smp_mb__before_clear_bit();
    1341     clear_bit(XPRT_CONNECTED, &xprt->state);
    1342     smp_mb__after_clear_bit();
    1343     @@ -1560,10 +1560,9 @@ out:
    1344     * We need to preserve the port number so the reply cache on the server can
    1345     * find our cached RPC replies when we get around to reconnecting.
    1346     */
    1347     -static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
    1348     +static void xs_abort_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
    1349     {
    1350     int result;
    1351     - struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
    1352     struct sockaddr any;
    1353    
    1354     dprintk("RPC: disconnecting xprt %p to reuse port\n", xprt);
    1355     @@ -1580,6 +1579,17 @@ static void xs_tcp_reuse_connection(struct rpc_xprt *xprt)
    1356     result);
    1357     }
    1358    
    1359     +static void xs_tcp_reuse_connection(struct rpc_xprt *xprt, struct sock_xprt *transport)
    1360     +{
    1361     + unsigned int state = transport->inet->sk_state;
    1362     +
    1363     + if (state == TCP_CLOSE && transport->sock->state == SS_UNCONNECTED)
    1364     + return;
    1365     + if ((1 << state) & (TCPF_ESTABLISHED|TCPF_SYN_SENT))
    1366     + return;
    1367     + xs_abort_connection(xprt, transport);
    1368     +}
    1369     +
    1370     static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
    1371     {
    1372     struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
    1373     @@ -1650,7 +1660,7 @@ static void xs_tcp_connect_worker4(struct work_struct *work)
    1374     }
    1375     } else
    1376     /* "close" the socket, preserving the local port */
    1377     - xs_tcp_reuse_connection(xprt);
    1378     + xs_tcp_reuse_connection(xprt, transport);
    1379    
    1380     dprintk("RPC: worker connecting xprt %p to address: %s\n",
    1381     xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
    1382     @@ -1710,7 +1720,7 @@ static void xs_tcp_connect_worker6(struct work_struct *work)
    1383     }
    1384     } else
    1385     /* "close" the socket, preserving the local port */
    1386     - xs_tcp_reuse_connection(xprt);
    1387     + xs_tcp_reuse_connection(xprt, transport);
    1388    
    1389     dprintk("RPC: worker connecting xprt %p to address: %s\n",
    1390     xprt, xprt->address_strings[RPC_DISPLAY_ALL]);
    1391     @@ -1780,9 +1790,6 @@ static void xs_tcp_connect(struct rpc_task *task)
    1392     {
    1393     struct rpc_xprt *xprt = task->tk_xprt;
    1394    
    1395     - /* Initiate graceful shutdown of the socket if not already done */
    1396     - if (test_bit(XPRT_CONNECTED, &xprt->state))
    1397     - xs_tcp_shutdown(xprt);
    1398     /* Exit if we need to wait for socket shutdown to complete */
    1399     if (test_bit(XPRT_CLOSING, &xprt->state))
    1400     return;
    1401     diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
    1402     index 88d80f5..220a5e3 100644
    1403     --- a/net/x25/af_x25.c
    1404     +++ b/net/x25/af_x25.c
    1405     @@ -332,14 +332,14 @@ static unsigned int x25_new_lci(struct x25_neigh *nb)
    1406     /*
    1407     * Deferred destroy.
    1408     */
    1409     -void x25_destroy_socket(struct sock *);
    1410     +static void __x25_destroy_socket(struct sock *);
    1411    
    1412     /*
    1413     * handler for deferred kills.
    1414     */
    1415     static void x25_destroy_timer(unsigned long data)
    1416     {
    1417     - x25_destroy_socket((struct sock *)data);
    1418     + x25_destroy_socket_from_timer((struct sock *)data);
    1419     }
    1420    
    1421     /*
    1422     @@ -349,12 +349,10 @@ static void x25_destroy_timer(unsigned long data)
    1423     * will touch it and we are (fairly 8-) ) safe.
    1424     * Not static as it's used by the timer
    1425     */
    1426     -void x25_destroy_socket(struct sock *sk)
    1427     +static void __x25_destroy_socket(struct sock *sk)
    1428     {
    1429     struct sk_buff *skb;
    1430    
    1431     - sock_hold(sk);
    1432     - lock_sock(sk);
    1433     x25_stop_heartbeat(sk);
    1434     x25_stop_timer(sk);
    1435    
    1436     @@ -385,7 +383,22 @@ void x25_destroy_socket(struct sock *sk)
    1437     /* drop last reference so sock_put will free */
    1438     __sock_put(sk);
    1439     }
    1440     +}
    1441    
    1442     +void x25_destroy_socket_from_timer(struct sock *sk)
    1443     +{
    1444     + sock_hold(sk);
    1445     + bh_lock_sock(sk);
    1446     + __x25_destroy_socket(sk);
    1447     + bh_unlock_sock(sk);
    1448     + sock_put(sk);
    1449     +}
    1450     +
    1451     +static void x25_destroy_socket(struct sock *sk)
    1452     +{
    1453     + sock_hold(sk);
    1454     + lock_sock(sk);
    1455     + __x25_destroy_socket(sk);
    1456     release_sock(sk);
    1457     sock_put(sk);
    1458     }
    1459     diff --git a/net/x25/x25_timer.c b/net/x25/x25_timer.c
    1460     index d3e3e54..5c5db1a 100644
    1461     --- a/net/x25/x25_timer.c
    1462     +++ b/net/x25/x25_timer.c
    1463     @@ -113,7 +113,7 @@ static void x25_heartbeat_expiry(unsigned long param)
    1464     (sk->sk_state == TCP_LISTEN &&
    1465     sock_flag(sk, SOCK_DEAD))) {
    1466     bh_unlock_sock(sk);
    1467     - x25_destroy_socket(sk);
    1468     + x25_destroy_socket_from_timer(sk);
    1469     return;
    1470     }
    1471     break;
    1472     diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
    1473     index 96036cf..79d78f4 100644
    1474     --- a/net/xfrm/xfrm_algo.c
    1475     +++ b/net/xfrm/xfrm_algo.c
    1476     @@ -292,8 +292,8 @@ static struct xfrm_algo_desc ealg_list[] = {
    1477     }
    1478     },
    1479     {
    1480     - .name = "cbc(cast128)",
    1481     - .compat = "cast128",
    1482     + .name = "cbc(cast5)",
    1483     + .compat = "cast5",
    1484    
    1485     .uinfo = {
    1486     .encr = {
    1487     diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c
    1488     index 6abe8a3..2b8b1ed 100644
    1489     --- a/sound/pci/ca0106/ca0106_main.c
    1490     +++ b/sound/pci/ca0106/ca0106_main.c
    1491     @@ -311,9 +311,9 @@ static struct snd_pcm_hardware snd_ca0106_capture_hw = {
    1492     .rate_max = 192000,
    1493     .channels_min = 2,
    1494     .channels_max = 2,
    1495     - .buffer_bytes_max = ((65536 - 64) * 8),
    1496     + .buffer_bytes_max = 65536 - 128,
    1497     .period_bytes_min = 64,
    1498     - .period_bytes_max = (65536 - 64),
    1499     + .period_bytes_max = 32768 - 64,
    1500     .periods_min = 2,
    1501     .periods_max = 2,
    1502     .fifo_size = 0,
    1503     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1504     index 3b5c6c2..07f8dcc 100644
    1505     --- a/sound/pci/hda/patch_realtek.c
    1506     +++ b/sound/pci/hda/patch_realtek.c
    1507     @@ -9214,6 +9214,18 @@ static void alc262_lenovo_3000_unsol_event(struct hda_codec *codec,
    1508     alc262_lenovo_3000_automute(codec, 1);
    1509     }
    1510    
    1511     +static int amp_stereo_mute_update(struct hda_codec *codec, hda_nid_t nid,
    1512     + int dir, int idx, long *valp)
    1513     +{
    1514     + int i, change = 0;
    1515     +
    1516     + for (i = 0; i < 2; i++, valp++)
    1517     + change |= snd_hda_codec_amp_update(codec, nid, i, dir, idx,
    1518     + HDA_AMP_MUTE,
    1519     + *valp ? 0 : HDA_AMP_MUTE);
    1520     + return change;
    1521     +}
    1522     +
    1523     /* bind hp and internal speaker mute (with plug check) */
    1524     static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
    1525     struct snd_ctl_elem_value *ucontrol)
    1526     @@ -9222,13 +9234,8 @@ static int alc262_fujitsu_master_sw_put(struct snd_kcontrol *kcontrol,
    1527     long *valp = ucontrol->value.integer.value;
    1528     int change;
    1529    
    1530     - change = snd_hda_codec_amp_stereo(codec, 0x14, HDA_OUTPUT, 0,
    1531     - HDA_AMP_MUTE,
    1532     - valp ? 0 : HDA_AMP_MUTE);
    1533     - change |= snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
    1534     - HDA_AMP_MUTE,
    1535     - valp ? 0 : HDA_AMP_MUTE);
    1536     -
    1537     + change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
    1538     + change |= amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
    1539     if (change)
    1540     alc262_fujitsu_automute(codec, 0);
    1541     return change;
    1542     @@ -9265,10 +9272,7 @@ static int alc262_lenovo_3000_master_sw_put(struct snd_kcontrol *kcontrol,
    1543     long *valp = ucontrol->value.integer.value;
    1544     int change;
    1545    
    1546     - change = snd_hda_codec_amp_stereo(codec, 0x1b, HDA_OUTPUT, 0,
    1547     - HDA_AMP_MUTE,
    1548     - valp ? 0 : HDA_AMP_MUTE);
    1549     -
    1550     + change = amp_stereo_mute_update(codec, 0x1b, HDA_OUTPUT, 0, valp);
    1551     if (change)
    1552     alc262_lenovo_3000_automute(codec, 0);
    1553     return change;
    1554     @@ -10280,12 +10284,7 @@ static int alc268_acer_master_sw_put(struct snd_kcontrol *kcontrol,
    1555     long *valp = ucontrol->value.integer.value;
    1556     int change;
    1557    
    1558     - change = snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
    1559     - HDA_AMP_MUTE,
    1560     - valp[0] ? 0 : HDA_AMP_MUTE);
    1561     - change |= snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
    1562     - HDA_AMP_MUTE,
    1563     - valp[1] ? 0 : HDA_AMP_MUTE);
    1564     + change = amp_stereo_mute_update(codec, 0x14, HDA_OUTPUT, 0, valp);
    1565     if (change)
    1566     alc268_acer_automute(codec, 0);
    1567     return change;
    1568     diff --git a/sound/pci/oxygen/virtuoso.c b/sound/pci/oxygen/virtuoso.c
    1569     index 01d7b75..d1773f6 100644
    1570     --- a/sound/pci/oxygen/virtuoso.c
    1571     +++ b/sound/pci/oxygen/virtuoso.c
    1572     @@ -376,6 +376,8 @@ static void xonar_d2_resume(struct oxygen *chip)
    1573    
    1574     static void xonar_d1_resume(struct oxygen *chip)
    1575     {
    1576     + oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC);
    1577     + msleep(1);
    1578     cs43xx_init(chip);
    1579     xonar_enable_output(chip);
    1580     }
    1581     diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
    1582     index c10e476..915a131 100644
    1583     --- a/sound/usb/usbaudio.c
    1584     +++ b/sound/usb/usbaudio.c
    1585     @@ -2674,7 +2674,7 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
    1586     struct usb_interface_descriptor *altsd;
    1587     int i, altno, err, stream;
    1588     int format;
    1589     - struct audioformat *fp;
    1590     + struct audioformat *fp = NULL;
    1591     unsigned char *fmt, *csep;
    1592     int num;
    1593    
    1594     @@ -2747,6 +2747,18 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
    1595     continue;
    1596     }
    1597    
    1598     + /*
    1599     + * Blue Microphones workaround: The last altsetting is identical
    1600     + * with the previous one, except for a larger packet size, but
    1601     + * is actually a mislabeled two-channel setting; ignore it.
    1602     + */
    1603     + if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 &&
    1604     + fp && fp->altsetting == 1 && fp->channels == 1 &&
    1605     + fp->format == SNDRV_PCM_FORMAT_S16_LE &&
    1606     + le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) ==
    1607     + fp->maxpacksize * 2)
    1608     + continue;
    1609     +
    1610     csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT);
    1611     /* Creamware Noah has this descriptor after the 2nd endpoint */
    1612     if (!csep && altsd->bNumEndpoints >= 2)