Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan-server/patches-2.6.25-r4/0106-2.6.25.7-all-fixes.patch

    Contents of /trunk/kernel26-magellan-server/patches-2.6.25-r4/0106-2.6.25.7-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 665 - (show annotations) (download)
    Wed Jul 30 14:06:06 2008 UTC (15 years, 9 months ago) by niro
    File size: 51120 byte(s) 
    -2.6.25-magellan-r4; updated to linux-2.6.25.10
    1 diff --git a/Documentation/cciss.txt b/Documentation/cciss.txt
    2 index e65736c..63e59b8 100644
    3 --- a/Documentation/cciss.txt
    4 +++ b/Documentation/cciss.txt
    5 @@ -21,6 +21,11 @@ This driver is known to work with the following cards:
    6 * SA E200
    7 * SA E200i
    8 * SA E500
    9 + * SA P212
    10 + * SA P410
    11 + * SA P410i
    12 + * SA P411
    13 + * SA P812
    14
    15 Detecting drive failures:
    16 -------------------------
    17 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
    18 index 99a4ed3..6342a07 100644
    19 --- a/arch/x86/Kconfig
    20 +++ b/arch/x86/Kconfig
    21 @@ -24,17 +24,10 @@ config X86
    22 select HAVE_KRETPROBES
    23 select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
    24
    25 -config DEFCONFIG_LIST
    26 +config ARCH_DEFCONFIG
    27 string
    28 - depends on X86_32
    29 - option defconfig_list
    30 - default "arch/x86/configs/i386_defconfig"
    31 -
    32 -config DEFCONFIG_LIST
    33 - string
    34 - depends on X86_64
    35 - option defconfig_list
    36 - default "arch/x86/configs/x86_64_defconfig"
    37 + default "arch/x86/configs/i386_defconfig" if X86_32
    38 + default "arch/x86/configs/x86_64_defconfig" if X86_64
    39
    40
    41 config GENERIC_LOCKBREAK
    42 @@ -253,8 +246,7 @@ config X86_ELAN
    43
    44 config X86_VOYAGER
    45 bool "Voyager (NCR)"
    46 - depends on X86_32
    47 - select SMP if !BROKEN
    48 + depends on X86_32 && (SMP || BROKEN)
    49 help
    50 Voyager is an MCA-based 32-way capable SMP architecture proprietary
    51 to NCR Corp. Machine classes 345x/35xx/4100/51xx are Voyager-based.
    52 @@ -266,9 +258,8 @@ config X86_VOYAGER
    53
    54 config X86_NUMAQ
    55 bool "NUMAQ (IBM/Sequent)"
    56 - select SMP
    57 + depends on SMP && X86_32
    58 select NUMA
    59 - depends on X86_32
    60 help
    61 This option is used for getting Linux to run on a (IBM/Sequent) NUMA
    62 multiquad box. This changes the way that processors are bootstrapped,
    63 @@ -339,7 +330,7 @@ config X86_RDC321X
    64
    65 config X86_VSMP
    66 bool "Support for ScaleMP vSMP"
    67 - depends on X86_64 && PCI
    68 + depends on X86_64
    69 help
    70 Support for ScaleMP vSMP systems. Say 'Y' here if this kernel is
    71 supposed to run on these EM64T-based machines. Only choose this option
    72 @@ -1391,7 +1382,7 @@ endmenu
    73 menu "Bus options (PCI etc.)"
    74
    75 config PCI
    76 - bool "PCI support" if !X86_VISWS
    77 + bool "PCI support" if !X86_VISWS && !X86_VSMP
    78 depends on !X86_VOYAGER
    79 default y
    80 select ARCH_SUPPORTS_MSI if (X86_LOCAL_APIC && X86_IO_APIC)
    81 diff --git a/drivers/block/brd.c b/drivers/block/brd.c
    82 index 8536480..37560a0 100644
    83 --- a/drivers/block/brd.c
    84 +++ b/drivers/block/brd.c
    85 @@ -392,6 +392,7 @@ module_param(rd_size, int, 0);
    86 MODULE_PARM_DESC(rd_size, "Size of each RAM disk in kbytes.");
    87 MODULE_LICENSE("GPL");
    88 MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
    89 +MODULE_ALIAS("rd");
    90
    91 #ifndef MODULE
    92 /* Legacy boot options - nonmodular */
    93 diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
    94 index 9c9627e..41636b8 100644
    95 --- a/drivers/block/cciss.c
    96 +++ b/drivers/block/cciss.c
    97 @@ -53,15 +53,16 @@
    98 #include <linux/scatterlist.h>
    99
    100 #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
    101 -#define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
    102 -#define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
    103 +#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
    104 +#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
    105
    106 /* Embedded module documentation macros - see modules.h */
    107 MODULE_AUTHOR("Hewlett-Packard Company");
    108 -MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
    109 +MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
    110 MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
    111 - " SA6i P600 P800 P400 P400i E200 E200i E500");
    112 -MODULE_VERSION("3.6.14");
    113 + " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
    114 + " Smart Array G2 Series SAS/SATA Controllers");
    115 +MODULE_VERSION("3.6.20");
    116 MODULE_LICENSE("GPL");
    117
    118 #include "cciss_cmd.h"
    119 @@ -90,6 +91,11 @@ static const struct pci_device_id cciss_pci_device_id[] = {
    120 {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD, 0x103C, 0x3215},
    121 {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x3237},
    122 {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x323D},
    123 + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
    124 + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3243},
    125 + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3245},
    126 + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3247},
    127 + {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3249},
    128 {PCI_VENDOR_ID_HP, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
    129 PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
    130 {0,}
    131 @@ -123,6 +129,11 @@ static struct board_type products[] = {
    132 {0x3215103C, "Smart Array E200i", &SA5_access, 120},
    133 {0x3237103C, "Smart Array E500", &SA5_access, 512},
    134 {0x323D103C, "Smart Array P700m", &SA5_access, 512},
    135 + {0x3241103C, "Smart Array P212", &SA5_access, 384},
    136 + {0x3243103C, "Smart Array P410", &SA5_access, 384},
    137 + {0x3245103C, "Smart Array P410i", &SA5_access, 384},
    138 + {0x3247103C, "Smart Array P411", &SA5_access, 384},
    139 + {0x3249103C, "Smart Array P812", &SA5_access, 384},
    140 {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
    141 };
    142
    143 diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c
    144 index 1f978ff..d353866 100644
    145 --- a/drivers/char/pcmcia/ipwireless/hardware.c
    146 +++ b/drivers/char/pcmcia/ipwireless/hardware.c
    147 @@ -251,10 +251,11 @@ struct ipw_hardware {
    148 int init_loops;
    149 struct timer_list setup_timer;
    150
    151 + /* Flag if hw is ready to send next packet */
    152 int tx_ready;
    153 - struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
    154 - /* True if any packets are queued for transmission */
    155 + /* Count of pending packets to be sent */
    156 int tx_queued;
    157 + struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
    158
    159 int rx_bytes_queued;
    160 struct list_head rx_queue;
    161 @@ -430,6 +431,8 @@ static int do_send_fragment(struct ipw_hardware *hw, const unsigned char *data,
    162
    163 spin_lock_irqsave(&hw->spinlock, flags);
    164
    165 + hw->tx_ready = 0;
    166 +
    167 if (hw->hw_version == HW_VERSION_1) {
    168 outw((unsigned short) length, hw->base_port + IODWR);
    169
    170 @@ -518,6 +521,7 @@ static int do_send_packet(struct ipw_hardware *hw, struct ipw_tx_packet *packet)
    171
    172 spin_lock_irqsave(&hw->spinlock, flags);
    173 list_add(&packet->queue, &hw->tx_queue[0]);
    174 + hw->tx_queued++;
    175 spin_unlock_irqrestore(&hw->spinlock, flags);
    176 } else {
    177 if (packet->packet_callback)
    178 @@ -975,12 +979,10 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
    179 unsigned long flags;
    180
    181 spin_lock_irqsave(&hw->spinlock, flags);
    182 - if (hw->tx_queued && hw->tx_ready != 0) {
    183 + if (hw->tx_queued && hw->tx_ready) {
    184 int priority;
    185 struct ipw_tx_packet *packet = NULL;
    186
    187 - hw->tx_ready--;
    188 -
    189 /* Pick a packet */
    190 for (priority = 0; priority < priority_limit; priority++) {
    191 if (!list_empty(&hw->tx_queue[priority])) {
    192 @@ -989,6 +991,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
    193 struct ipw_tx_packet,
    194 queue);
    195
    196 + hw->tx_queued--;
    197 list_del(&packet->queue);
    198
    199 break;
    200 @@ -999,6 +1002,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
    201 spin_unlock_irqrestore(&hw->spinlock, flags);
    202 return 0;
    203 }
    204 +
    205 spin_unlock_irqrestore(&hw->spinlock, flags);
    206
    207 /* Send */
    208 @@ -1089,7 +1093,7 @@ static irqreturn_t ipwireless_handle_v1_interrupt(int irq,
    209 if (irqn & IR_TXINTR) {
    210 ack |= IR_TXINTR;
    211 spin_lock_irqsave(&hw->spinlock, flags);
    212 - hw->tx_ready++;
    213 + hw->tx_ready = 1;
    214 spin_unlock_irqrestore(&hw->spinlock, flags);
    215 }
    216 /* Received data */
    217 @@ -1196,7 +1200,7 @@ static irqreturn_t ipwireless_handle_v2_v3_interrupt(int irq,
    218 if (memrxdone & MEMRX_RX_DONE) {
    219 writew(0, &hw->memory_info_regs->memreg_rx_done);
    220 spin_lock_irqsave(&hw->spinlock, flags);
    221 - hw->tx_ready++;
    222 + hw->tx_ready = 1;
    223 spin_unlock_irqrestore(&hw->spinlock, flags);
    224 tx = 1;
    225 }
    226 @@ -1260,7 +1264,7 @@ static void send_packet(struct ipw_hardware *hw, int priority,
    227
    228 spin_lock_irqsave(&hw->spinlock, flags);
    229 list_add_tail(&packet->queue, &hw->tx_queue[priority]);
    230 - hw->tx_queued = 1;
    231 + hw->tx_queued++;
    232 spin_unlock_irqrestore(&hw->spinlock, flags);
    233
    234 flush_packets_to_hw(hw);
    235 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
    236 index 99aa5f5..ebd68c1 100644
    237 --- a/drivers/cpufreq/cpufreq.c
    238 +++ b/drivers/cpufreq/cpufreq.c
    239 @@ -410,7 +410,7 @@ static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
    240 int ret;
    241
    242 mutex_unlock(&cpufreq_governor_mutex);
    243 - ret = request_module(name);
    244 + ret = request_module("%s", name);
    245 mutex_lock(&cpufreq_governor_mutex);
    246
    247 if (ret == 0)
    248 diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    249 index 4e3128f..9d5b86c 100644
    250 --- a/drivers/infiniband/core/umem.c
    251 +++ b/drivers/infiniband/core/umem.c
    252 @@ -144,7 +144,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    253 ret = 0;
    254 while (npages) {
    255 ret = get_user_pages(current, current->mm, cur_base,
    256 - min_t(int, npages,
    257 + min_t(unsigned long, npages,
    258 PAGE_SIZE / sizeof (struct page *)),
    259 1, !umem->writable, page_list, vma_list);
    260
    261 diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
    262 index fcf8f2d..594522a 100644
    263 --- a/drivers/media/video/bt8xx/bttv-driver.c
    264 +++ b/drivers/media/video/bt8xx/bttv-driver.c
    265 @@ -2613,7 +2613,7 @@ static int vidiocgmbuf(struct file *file, void *priv, struct video_mbuf *mbuf)
    266 struct bttv_fh *fh = priv;
    267
    268 mutex_lock(&fh->cap.vb_lock);
    269 - retval = videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
    270 + retval = __videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
    271 V4L2_MEMORY_MMAP);
    272 if (retval < 0) {
    273 mutex_unlock(&fh->cap.vb_lock);
    274 diff --git a/drivers/media/video/videobuf-core.c b/drivers/media/video/videobuf-core.c
    275 index eab79ff..57a9de4 100644
    276 --- a/drivers/media/video/videobuf-core.c
    277 +++ b/drivers/media/video/videobuf-core.c
    278 @@ -335,7 +335,7 @@ int videobuf_mmap_free(struct videobuf_queue *q)
    279 }
    280
    281 /* Locking: Caller holds q->vb_lock */
    282 -static int __videobuf_mmap_setup(struct videobuf_queue *q,
    283 +int __videobuf_mmap_setup(struct videobuf_queue *q,
    284 unsigned int bcount, unsigned int bsize,
    285 enum v4l2_memory memory)
    286 {
    287 @@ -1093,6 +1093,7 @@ EXPORT_SYMBOL_GPL(videobuf_read_stream);
    288 EXPORT_SYMBOL_GPL(videobuf_read_one);
    289 EXPORT_SYMBOL_GPL(videobuf_poll_stream);
    290
    291 +EXPORT_SYMBOL_GPL(__videobuf_mmap_setup);
    292 EXPORT_SYMBOL_GPL(videobuf_mmap_setup);
    293 EXPORT_SYMBOL_GPL(videobuf_mmap_free);
    294 EXPORT_SYMBOL_GPL(videobuf_mmap_mapper);
    295 diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
    296 index be624a0..c303e7f 100644
    297 --- a/drivers/mmc/host/wbsd.c
    298 +++ b/drivers/mmc/host/wbsd.c
    299 @@ -1457,17 +1457,7 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
    300 int ret;
    301
    302 /*
    303 - * Allocate interrupt.
    304 - */
    305 -
    306 - ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
    307 - if (ret)
    308 - return ret;
    309 -
    310 - host->irq = irq;
    311 -
    312 - /*
    313 - * Set up tasklets.
    314 + * Set up tasklets. Must be done before requesting interrupt.
    315 */
    316 tasklet_init(&host->card_tasklet, wbsd_tasklet_card,
    317 (unsigned long)host);
    318 @@ -1480,6 +1470,15 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
    319 tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish,
    320 (unsigned long)host);
    321
    322 + /*
    323 + * Allocate interrupt.
    324 + */
    325 + ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
    326 + if (ret)
    327 + return ret;
    328 +
    329 + host->irq = irq;
    330 +
    331 return 0;
    332 }
    333
    334 diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
    335 index 14299f8..863d7f3 100644
    336 --- a/drivers/net/cassini.c
    337 +++ b/drivers/net/cassini.c
    338 @@ -142,8 +142,8 @@
    339
    340 #define DRV_MODULE_NAME "cassini"
    341 #define PFX DRV_MODULE_NAME ": "
    342 -#define DRV_MODULE_VERSION "1.5"
    343 -#define DRV_MODULE_RELDATE "4 Jan 2008"
    344 +#define DRV_MODULE_VERSION "1.6"
    345 +#define DRV_MODULE_RELDATE "21 May 2008"
    346
    347 #define CAS_DEF_MSG_ENABLE \
    348 (NETIF_MSG_DRV | \
    349 @@ -2140,9 +2140,12 @@ end_copy_pkt:
    350 if (addr)
    351 cas_page_unmap(addr);
    352 }
    353 - skb->csum = csum_unfold(~csum);
    354 - skb->ip_summed = CHECKSUM_COMPLETE;
    355 skb->protocol = eth_type_trans(skb, cp->dev);
    356 + if (skb->protocol == htons(ETH_P_IP)) {
    357 + skb->csum = csum_unfold(~csum);
    358 + skb->ip_summed = CHECKSUM_COMPLETE;
    359 + } else
    360 + skb->ip_summed = CHECKSUM_NONE;
    361 return len;
    362 }
    363
    364 diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
    365 index 9f088a4..8e877e7 100644
    366 --- a/drivers/net/forcedeth.c
    367 +++ b/drivers/net/forcedeth.c
    368 @@ -3111,6 +3111,20 @@ static void nv_link_irq(struct net_device *dev)
    369 dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
    370 }
    371
    372 +static void nv_msi_workaround(struct fe_priv *np)
    373 +{
    374 +
    375 + /* Need to toggle the msi irq mask within the ethernet device,
    376 + * otherwise, future interrupts will not be detected.
    377 + */
    378 + if (np->msi_flags & NV_MSI_ENABLED) {
    379 + u8 __iomem *base = np->base;
    380 +
    381 + writel(0, base + NvRegMSIIrqMask);
    382 + writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
    383 + }
    384 +}
    385 +
    386 static irqreturn_t nv_nic_irq(int foo, void *data)
    387 {
    388 struct net_device *dev = (struct net_device *) data;
    389 @@ -3133,6 +3147,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
    390 if (!(events & np->irqmask))
    391 break;
    392
    393 + nv_msi_workaround(np);
    394 +
    395 spin_lock(&np->lock);
    396 nv_tx_done(dev);
    397 spin_unlock(&np->lock);
    398 @@ -3248,6 +3264,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
    399 if (!(events & np->irqmask))
    400 break;
    401
    402 + nv_msi_workaround(np);
    403 +
    404 spin_lock(&np->lock);
    405 nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
    406 spin_unlock(&np->lock);
    407 @@ -3588,6 +3606,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
    408 if (!(events & NVREG_IRQ_TIMER))
    409 return IRQ_RETVAL(0);
    410
    411 + nv_msi_workaround(np);
    412 +
    413 spin_lock(&np->lock);
    414 np->intr_test = 1;
    415 spin_unlock(&np->lock);
    416 diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
    417 index 3d10ca0..a629355 100644
    418 --- a/drivers/net/pppol2tp.c
    419 +++ b/drivers/net/pppol2tp.c
    420 @@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
    421 if (sk == NULL)
    422 return NULL;
    423
    424 + sock_hold(sk);
    425 session = (struct pppol2tp_session *)(sk->sk_user_data);
    426 - if (session == NULL)
    427 - return NULL;
    428 + if (session == NULL) {
    429 + sock_put(sk);
    430 + goto out;
    431 + }
    432
    433 BUG_ON(session->magic != L2TP_SESSION_MAGIC);
    434 -
    435 +out:
    436 return session;
    437 }
    438
    439 @@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
    440 if (sk == NULL)
    441 return NULL;
    442
    443 + sock_hold(sk);
    444 tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
    445 - if (tunnel == NULL)
    446 - return NULL;
    447 + if (tunnel == NULL) {
    448 + sock_put(sk);
    449 + goto out;
    450 + }
    451
    452 BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
    453 -
    454 +out:
    455 return tunnel;
    456 }
    457
    458 @@ -716,12 +722,14 @@ discard:
    459 session->stats.rx_errors++;
    460 kfree_skb(skb);
    461 sock_put(session->sock);
    462 + sock_put(sock);
    463
    464 return 0;
    465
    466 error:
    467 /* Put UDP header back */
    468 __skb_push(skb, sizeof(struct udphdr));
    469 + sock_put(sock);
    470
    471 no_tunnel:
    472 return 1;
    473 @@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
    474 "%s: received %d bytes\n", tunnel->name, skb->len);
    475
    476 if (pppol2tp_recv_core(sk, skb))
    477 - goto pass_up;
    478 + goto pass_up_put;
    479
    480 + sock_put(sk);
    481 return 0;
    482
    483 +pass_up_put:
    484 + sock_put(sk);
    485 pass_up:
    486 return 1;
    487 }
    488 @@ -858,7 +869,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    489
    490 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
    491 if (tunnel == NULL)
    492 - goto error;
    493 + goto error_put_sess;
    494
    495 /* What header length is configured for this session? */
    496 hdr_len = pppol2tp_l2tp_header_len(session);
    497 @@ -870,7 +881,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    498 sizeof(ppph) + total_len,
    499 0, GFP_KERNEL);
    500 if (!skb)
    501 - goto error;
    502 + goto error_put_sess_tun;
    503
    504 /* Reserve space for headers. */
    505 skb_reserve(skb, NET_SKB_PAD);
    506 @@ -900,7 +911,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    507 error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
    508 if (error < 0) {
    509 kfree_skb(skb);
    510 - goto error;
    511 + goto error_put_sess_tun;
    512 }
    513 skb_put(skb, total_len);
    514
    515 @@ -947,10 +958,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    516 session->stats.tx_errors++;
    517 }
    518
    519 + return error;
    520 +
    521 +error_put_sess_tun:
    522 + sock_put(session->tunnel_sock);
    523 +error_put_sess:
    524 + sock_put(sk);
    525 error:
    526 return error;
    527 }
    528
    529 +/* Automatically called when the skb is freed.
    530 + */
    531 +static void pppol2tp_sock_wfree(struct sk_buff *skb)
    532 +{
    533 + sock_put(skb->sk);
    534 +}
    535 +
    536 +/* For data skbs that we transmit, we associate with the tunnel socket
    537 + * but don't do accounting.
    538 + */
    539 +static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
    540 +{
    541 + sock_hold(sk);
    542 + skb->sk = sk;
    543 + skb->destructor = pppol2tp_sock_wfree;
    544 +}
    545 +
    546 /* Transmit function called by generic PPP driver. Sends PPP frame
    547 * over PPPoL2TP socket.
    548 *
    549 @@ -980,6 +1014,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    550 __wsum csum = 0;
    551 struct udphdr *uh;
    552 unsigned int len;
    553 + int old_headroom;
    554 + int new_headroom;
    555
    556 if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
    557 goto abort;
    558 @@ -991,25 +1027,27 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    559
    560 sk_tun = session->tunnel_sock;
    561 if (sk_tun == NULL)
    562 - goto abort;
    563 + goto abort_put_sess;
    564 tunnel = pppol2tp_sock_to_tunnel(sk_tun);
    565 if (tunnel == NULL)
    566 - goto abort;
    567 + goto abort_put_sess;
    568
    569 /* What header length is configured for this session? */
    570 hdr_len = pppol2tp_l2tp_header_len(session);
    571
    572 /* Check that there's enough headroom in the skb to insert IP,
    573 * UDP and L2TP and PPP headers. If not enough, expand it to
    574 - * make room. Note that a new skb (or a clone) is
    575 - * allocated. If we return an error from this point on, make
    576 - * sure we free the new skb but do not free the original skb
    577 - * since that is done by the caller for the error case.
    578 + * make room. Adjust truesize.
    579 */
    580 headroom = NET_SKB_PAD + sizeof(struct iphdr) +
    581 sizeof(struct udphdr) + hdr_len + sizeof(ppph);
    582 + old_headroom = skb_headroom(skb);
    583 if (skb_cow_head(skb, headroom))
    584 - goto abort;
    585 + goto abort_put_sess_tun;
    586 +
    587 + new_headroom = skb_headroom(skb);
    588 + skb_orphan(skb);
    589 + skb->truesize += new_headroom - old_headroom;
    590
    591 /* Setup PPP header */
    592 __skb_push(skb, sizeof(ppph));
    593 @@ -1065,8 +1103,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    594 /* Get routing info from the tunnel socket */
    595 dst_release(skb->dst);
    596 skb->dst = dst_clone(__sk_dst_get(sk_tun));
    597 - skb_orphan(skb);
    598 - skb->sk = sk_tun;
    599 + pppol2tp_skb_set_owner_w(skb, sk_tun);
    600
    601 /* Queue the packet to IP for output */
    602 len = skb->len;
    603 @@ -1083,8 +1120,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    604 session->stats.tx_errors++;
    605 }
    606
    607 + sock_put(sk_tun);
    608 + sock_put(sk);
    609 return 1;
    610
    611 +abort_put_sess_tun:
    612 + sock_put(sk_tun);
    613 +abort_put_sess:
    614 + sock_put(sk);
    615 abort:
    616 /* Free the original skb */
    617 kfree_skb(skb);
    618 @@ -1188,7 +1231,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
    619 {
    620 struct pppol2tp_tunnel *tunnel;
    621
    622 - tunnel = pppol2tp_sock_to_tunnel(sk);
    623 + tunnel = sk->sk_user_data;
    624 if (tunnel == NULL)
    625 goto end;
    626
    627 @@ -1227,10 +1270,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
    628 if (sk->sk_user_data != NULL) {
    629 struct pppol2tp_tunnel *tunnel;
    630
    631 - session = pppol2tp_sock_to_session(sk);
    632 + session = sk->sk_user_data;
    633 if (session == NULL)
    634 goto out;
    635
    636 + BUG_ON(session->magic != L2TP_SESSION_MAGIC);
    637 +
    638 /* Don't use pppol2tp_sock_to_tunnel() here to
    639 * get the tunnel context because the tunnel
    640 * socket might have already been closed (its
    641 @@ -1276,6 +1321,7 @@ out:
    642 static int pppol2tp_release(struct socket *sock)
    643 {
    644 struct sock *sk = sock->sk;
    645 + struct pppol2tp_session *session;
    646 int error;
    647
    648 if (!sk)
    649 @@ -1293,9 +1339,18 @@ static int pppol2tp_release(struct socket *sock)
    650 sock_orphan(sk);
    651 sock->sk = NULL;
    652
    653 + session = pppol2tp_sock_to_session(sk);
    654 +
    655 /* Purge any queued data */
    656 skb_queue_purge(&sk->sk_receive_queue);
    657 skb_queue_purge(&sk->sk_write_queue);
    658 + if (session != NULL) {
    659 + struct sk_buff *skb;
    660 + while ((skb = skb_dequeue(&session->reorder_q))) {
    661 + kfree_skb(skb);
    662 + sock_put(sk);
    663 + }
    664 + }
    665
    666 release_sock(sk);
    667
    668 @@ -1598,7 +1653,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
    669
    670 error = ppp_register_channel(&po->chan);
    671 if (error)
    672 - goto end;
    673 + goto end_put_tun;
    674
    675 /* This is how we get the session context from the socket. */
    676 sk->sk_user_data = session;
    677 @@ -1618,6 +1673,8 @@ out_no_ppp:
    678 PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
    679 "%s: created\n", session->name);
    680
    681 +end_put_tun:
    682 + sock_put(tunnel_sock);
    683 end:
    684 release_sock(sk);
    685
    686 @@ -1658,6 +1715,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
    687 *usockaddr_len = len;
    688
    689 error = 0;
    690 + sock_put(sock->sk);
    691
    692 end:
    693 return error;
    694 @@ -1896,14 +1954,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
    695 err = -EBADF;
    696 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
    697 if (tunnel == NULL)
    698 - goto end;
    699 + goto end_put_sess;
    700
    701 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
    702 - goto end;
    703 + sock_put(session->tunnel_sock);
    704 + goto end_put_sess;
    705 }
    706
    707 err = pppol2tp_session_ioctl(session, cmd, arg);
    708
    709 +end_put_sess:
    710 + sock_put(sk);
    711 end:
    712 return err;
    713 }
    714 @@ -2049,14 +2110,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
    715 err = -EBADF;
    716 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
    717 if (tunnel == NULL)
    718 - goto end;
    719 + goto end_put_sess;
    720
    721 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
    722 + sock_put(session->tunnel_sock);
    723 } else
    724 err = pppol2tp_session_setsockopt(sk, session, optname, val);
    725
    726 err = 0;
    727
    728 +end_put_sess:
    729 + sock_put(sk);
    730 end:
    731 return err;
    732 }
    733 @@ -2171,20 +2235,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
    734 err = -EBADF;
    735 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
    736 if (tunnel == NULL)
    737 - goto end;
    738 + goto end_put_sess;
    739
    740 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
    741 + sock_put(session->tunnel_sock);
    742 } else
    743 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
    744
    745 err = -EFAULT;
    746 if (put_user(len, (int __user *) optlen))
    747 - goto end;
    748 + goto end_put_sess;
    749
    750 if (copy_to_user((void __user *) optval, &val, len))
    751 - goto end;
    752 + goto end_put_sess;
    753
    754 err = 0;
    755 +
    756 +end_put_sess:
    757 + sock_put(sk);
    758 end:
    759 return err;
    760 }
    761 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    762 index e0055d0..6966eec 100644
    763 --- a/drivers/net/wireless/b43/main.c
    764 +++ b/drivers/net/wireless/b43/main.c
    765 @@ -3818,7 +3818,9 @@ static void b43_chip_reset(struct work_struct *work)
    766 goto out;
    767 }
    768 }
    769 - out:
    770 +out:
    771 + if (err)
    772 + wl->current_dev = NULL; /* Failed to init the dev. */
    773 mutex_unlock(&wl->mutex);
    774 if (err)
    775 b43err(wl, "Controller restart FAILED\n");
    776 @@ -3967,9 +3969,11 @@ static void b43_one_core_detach(struct ssb_device *dev)
    777 struct b43_wldev *wldev;
    778 struct b43_wl *wl;
    779
    780 + /* Do not cancel ieee80211-workqueue based work here.
    781 + * See comment in b43_remove(). */
    782 +
    783 wldev = ssb_get_drvdata(dev);
    784 wl = wldev->wl;
    785 - cancel_work_sync(&wldev->restart_work);
    786 b43_debugfs_remove_device(wldev);
    787 b43_wireless_core_detach(wldev);
    788 list_del(&wldev->list);
    789 @@ -4152,6 +4156,10 @@ static void b43_remove(struct ssb_device *dev)
    790 struct b43_wl *wl = ssb_get_devtypedata(dev);
    791 struct b43_wldev *wldev = ssb_get_drvdata(dev);
    792
    793 + /* We must cancel any work here before unregistering from ieee80211,
    794 + * as the ieee80211 unreg will destroy the workqueue. */
    795 + cancel_work_sync(&wldev->restart_work);
    796 +
    797 B43_WARN_ON(!wl);
    798 if (wl->current_dev == wldev)
    799 ieee80211_unregister_hw(wl->hw);
    800 diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
    801 index 3bf9294..db9920e 100644
    802 --- a/drivers/serial/serial_core.c
    803 +++ b/drivers/serial/serial_core.c
    804 @@ -2022,6 +2022,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
    805 int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
    806 {
    807 struct uart_state *state = drv->state + port->line;
    808 + struct device *tty_dev;
    809 + struct uart_match match = {port, drv};
    810
    811 mutex_lock(&state->mutex);
    812
    813 @@ -2031,7 +2033,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
    814 return 0;
    815 }
    816
    817 - if (!port->suspended) {
    818 + tty_dev = device_find_child(port->dev, &match, serial_match_port);
    819 + if (!port->suspended && device_may_wakeup(tty_dev)) {
    820 disable_irq_wake(port->irq);
    821 mutex_unlock(&state->mutex);
    822 return 0;
    823 diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
    824 index 145c028..2847336 100644
    825 --- a/drivers/serial/sunhv.c
    826 +++ b/drivers/serial/sunhv.c
    827 @@ -499,7 +499,6 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
    828 } else
    829 spin_lock(&port->lock);
    830
    831 - spin_lock_irqsave(&port->lock, flags);
    832 for (i = 0; i < n; i++) {
    833 if (*s == '\n')
    834 sunhv_console_putchar(port, '\r');
    835 diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
    836 index 5d777f2..3c8239a 100644
    837 --- a/drivers/ssb/driver_pcicore.c
    838 +++ b/drivers/ssb/driver_pcicore.c
    839 @@ -519,12 +519,12 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
    840 int err = 0;
    841 u32 tmp;
    842
    843 - might_sleep();
    844 -
    845 if (!pdev)
    846 goto out;
    847 bus = pdev->bus;
    848
    849 + might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
    850 +
    851 /* Enable interrupts for this device. */
    852 if (bus->host_pci &&
    853 ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {
    854 diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c
    855 index fb9e672..c18880d 100644
    856 --- a/drivers/video/hgafb.c
    857 +++ b/drivers/video/hgafb.c
    858 @@ -279,7 +279,7 @@ static void hga_blank(int blank_mode)
    859
    860 static int __init hga_card_detect(void)
    861 {
    862 - int count=0;
    863 + int count = 0;
    864 void __iomem *p, *q;
    865 unsigned short p_save, q_save;
    866
    867 @@ -303,20 +303,18 @@ static int __init hga_card_detect(void)
    868 writew(0x55aa, p); if (readw(p) == 0x55aa) count++;
    869 writew(p_save, p);
    870
    871 - if (count != 2) {
    872 - return 0;
    873 - }
    874 + if (count != 2)
    875 + goto error;
    876
    877 /* Ok, there is definitely a card registering at the correct
    878 * memory location, so now we do an I/O port test.
    879 */
    880
    881 - if (!test_hga_b(0x66, 0x0f)) { /* cursor low register */
    882 - return 0;
    883 - }
    884 - if (!test_hga_b(0x99, 0x0f)) { /* cursor low register */
    885 - return 0;
    886 - }
    887 + if (!test_hga_b(0x66, 0x0f)) /* cursor low register */
    888 + goto error;
    889 +
    890 + if (!test_hga_b(0x99, 0x0f)) /* cursor low register */
    891 + goto error;
    892
    893 /* See if the card is a Hercules, by checking whether the vsync
    894 * bit of the status register is changing. This test lasts for
    895 @@ -331,7 +329,7 @@ static int __init hga_card_detect(void)
    896 }
    897
    898 if (p_save == q_save)
    899 - return 0;
    900 + goto error;
    901
    902 switch (inb_p(HGA_STATUS_PORT) & 0x70) {
    903 case 0x10:
    904 @@ -348,6 +346,12 @@ static int __init hga_card_detect(void)
    905 break;
    906 }
    907 return 1;
    908 +error:
    909 + if (release_io_ports)
    910 + release_region(0x3b0, 12);
    911 + if (release_io_port)
    912 + release_region(0x3bf, 1);
    913 + return 0;
    914 }
    915
    916 /**
    917 diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
    918 index 08d0725..971b338 100644
    919 --- a/drivers/video/modedb.c
    920 +++ b/drivers/video/modedb.c
    921 @@ -28,6 +28,7 @@
    922 #endif
    923
    924 const char *fb_mode_option;
    925 +EXPORT_SYMBOL_GPL(fb_mode_option);
    926
    927 /*
    928 * Standard video mode definitions (taken from XFree86)
    929 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
    930 index a04b17e..b94fb5c 100644
    931 --- a/fs/cifs/cifsfs.c
    932 +++ b/fs/cifs/cifsfs.c
    933 @@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
    934 {
    935 struct inode *inode;
    936 struct cifs_sb_info *cifs_sb;
    937 -#ifdef CONFIG_CIFS_DFS_UPCALL
    938 - int len;
    939 -#endif
    940 int rc = 0;
    941
    942 /* BB should we make this contingent on mount parm? */
    943 @@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
    944 * complex operation (mount), and in case of fail
    945 * just exit instead of doing mount and attempting
    946 * undo it if this copy fails?*/
    947 - len = strlen(data);
    948 - cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
    949 - if (cifs_sb->mountdata == NULL) {
    950 - kfree(sb->s_fs_info);
    951 - sb->s_fs_info = NULL;
    952 - return -ENOMEM;
    953 + if (data) {
    954 + int len = strlen(data);
    955 + cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
    956 + if (cifs_sb->mountdata == NULL) {
    957 + kfree(sb->s_fs_info);
    958 + sb->s_fs_info = NULL;
    959 + return -ENOMEM;
    960 + }
    961 + strncpy(cifs_sb->mountdata, data, len + 1);
    962 + cifs_sb->mountdata[len] = '\0';
    963 }
    964 - strncpy(cifs_sb->mountdata, data, len + 1);
    965 - cifs_sb->mountdata[len] = '\0';
    966 #endif
    967
    968 rc = cifs_mount(sb, cifs_sb, data, devname);
    969 diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
    970 index a066e10..086b312 100644
    971 --- a/fs/ecryptfs/crypto.c
    972 +++ b/fs/ecryptfs/crypto.c
    973 @@ -1907,9 +1907,9 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
    974 goto out;
    975 }
    976 }
    977 - mutex_unlock(&key_tfm_list_mutex);
    978 (*tfm) = key_tfm->key_tfm;
    979 (*tfm_mutex) = &key_tfm->key_tfm_mutex;
    980 out:
    981 + mutex_unlock(&key_tfm_list_mutex);
    982 return rc;
    983 }
    984 diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
    985 index 2b8f5ed..2258b8f 100644
    986 --- a/fs/ecryptfs/file.c
    987 +++ b/fs/ecryptfs/file.c
    988 @@ -195,7 +195,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
    989 file, ecryptfs_inode_to_private(inode)->lower_file);
    990 if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
    991 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
    992 + mutex_lock(&crypt_stat->cs_mutex);
    993 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
    994 + mutex_unlock(&crypt_stat->cs_mutex);
    995 rc = 0;
    996 goto out;
    997 }
    998 diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
    999 index e238611..a2174c2 100644
    1000 --- a/fs/ecryptfs/inode.c
    1001 +++ b/fs/ecryptfs/inode.c
    1002 @@ -37,17 +37,11 @@ static struct dentry *lock_parent(struct dentry *dentry)
    1003 {
    1004 struct dentry *dir;
    1005
    1006 - dir = dget(dentry->d_parent);
    1007 + dir = dget_parent(dentry);
    1008 mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
    1009 return dir;
    1010 }
    1011
    1012 -static void unlock_parent(struct dentry *dentry)
    1013 -{
    1014 - mutex_unlock(&(dentry->d_parent->d_inode->i_mutex));
    1015 - dput(dentry->d_parent);
    1016 -}
    1017 -
    1018 static void unlock_dir(struct dentry *dir)
    1019 {
    1020 mutex_unlock(&dir->d_inode->i_mutex);
    1021 @@ -426,8 +420,9 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
    1022 int rc = 0;
    1023 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
    1024 struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
    1025 + struct dentry *lower_dir_dentry;
    1026
    1027 - lock_parent(lower_dentry);
    1028 + lower_dir_dentry = lock_parent(lower_dentry);
    1029 rc = vfs_unlink(lower_dir_inode, lower_dentry);
    1030 if (rc) {
    1031 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
    1032 @@ -439,7 +434,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
    1033 dentry->d_inode->i_ctime = dir->i_ctime;
    1034 d_drop(dentry);
    1035 out_unlock:
    1036 - unlock_parent(lower_dentry);
    1037 + unlock_dir(lower_dir_dentry);
    1038 return rc;
    1039 }
    1040
    1041 @@ -908,7 +903,9 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
    1042 if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
    1043 ia->ia_valid &= ~ATTR_MODE;
    1044
    1045 + mutex_lock(&lower_dentry->d_inode->i_mutex);
    1046 rc = notify_change(lower_dentry, ia);
    1047 + mutex_unlock(&lower_dentry->d_inode->i_mutex);
    1048 out:
    1049 fsstack_copy_attr_all(inode, lower_inode, NULL);
    1050 return rc;
    1051 diff --git a/fs/pipe.c b/fs/pipe.c
    1052 index 8be381b..f73492b 100644
    1053 --- a/fs/pipe.c
    1054 +++ b/fs/pipe.c
    1055 @@ -988,7 +988,10 @@ struct file *create_write_pipe(void)
    1056 return f;
    1057
    1058 err_dentry:
    1059 + free_pipe_info(inode);
    1060 dput(dentry);
    1061 + return ERR_PTR(err);
    1062 +
    1063 err_inode:
    1064 free_pipe_info(inode);
    1065 iput(inode);
    1066 diff --git a/include/asm-m68k/bitops.h b/include/asm-m68k/bitops.h
    1067 index 83d1f28..fbb7f06 100644
    1068 --- a/include/asm-m68k/bitops.h
    1069 +++ b/include/asm-m68k/bitops.h
    1070 @@ -410,8 +410,50 @@ static inline int ext2_find_next_zero_bit(const void *vaddr, unsigned size,
    1071 res = ext2_find_first_zero_bit (p, size - 32 * (p - addr));
    1072 return (p - addr) * 32 + res;
    1073 }
    1074 -#define ext2_find_next_bit(addr, size, off) \
    1075 - generic_find_next_le_bit((unsigned long *)(addr), (size), (off))
    1076 +
    1077 +static inline int ext2_find_first_bit(const void *vaddr, unsigned size)
    1078 +{
    1079 + const unsigned long *p = vaddr, *addr = vaddr;
    1080 + int res;
    1081 +
    1082 + if (!size)
    1083 + return 0;
    1084 +
    1085 + size = (size >> 5) + ((size & 31) > 0);
    1086 + while (*p++ == 0UL)
    1087 + {
    1088 + if (--size == 0)
    1089 + return (p - addr) << 5;
    1090 + }
    1091 +
    1092 + --p;
    1093 + for (res = 0; res < 32; res++)
    1094 + if (ext2_test_bit(res, p))
    1095 + break;
    1096 + return (p - addr) * 32 + res;
    1097 +}
    1098 +
    1099 +static inline int ext2_find_next_bit(const void *vaddr, unsigned size,
    1100 + unsigned offset)
    1101 +{
    1102 + const unsigned long *addr = vaddr;
    1103 + const unsigned long *p = addr + (offset >> 5);
    1104 + int bit = offset & 31UL, res;
    1105 +
    1106 + if (offset >= size)
    1107 + return size;
    1108 +
    1109 + if (bit) {
    1110 + /* Look for one in first longword */
    1111 + for (res = bit; res < 32; res++)
    1112 + if (ext2_test_bit(res, p))
    1113 + return (p - addr) * 32 + res;
    1114 + p++;
    1115 + }
    1116 + /* No set bit yet, search remaining full bytes for a set bit */
    1117 + res = ext2_find_first_bit(p, size - 32 * (p - addr));
    1118 + return (p - addr) * 32 + res;
    1119 +}
    1120
    1121 #endif /* __KERNEL__ */
    1122
    1123 diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
    1124 index 70eb3c8..f624e7c 100644
    1125 --- a/include/linux/pci_ids.h
    1126 +++ b/include/linux/pci_ids.h
    1127 @@ -716,6 +716,7 @@
    1128 #define PCI_DEVICE_ID_HP_CISSA 0x3220
    1129 #define PCI_DEVICE_ID_HP_CISSC 0x3230
    1130 #define PCI_DEVICE_ID_HP_CISSD 0x3238
    1131 +#define PCI_DEVICE_ID_HP_CISSE 0x323a
    1132 #define PCI_DEVICE_ID_HP_ZX2_IOC 0x4031
    1133
    1134 #define PCI_VENDOR_ID_PCTECH 0x1042
    1135 diff --git a/include/media/videobuf-core.h b/include/media/videobuf-core.h
    1136 index 9903394..7552731 100644
    1137 --- a/include/media/videobuf-core.h
    1138 +++ b/include/media/videobuf-core.h
    1139 @@ -227,6 +227,9 @@ unsigned int videobuf_poll_stream(struct file *file,
    1140 int videobuf_mmap_setup(struct videobuf_queue *q,
    1141 unsigned int bcount, unsigned int bsize,
    1142 enum v4l2_memory memory);
    1143 +int __videobuf_mmap_setup(struct videobuf_queue *q,
    1144 + unsigned int bcount, unsigned int bsize,
    1145 + enum v4l2_memory memory);
    1146 int videobuf_mmap_free(struct videobuf_queue *q);
    1147 int videobuf_mmap_mapper(struct videobuf_queue *q,
    1148 struct vm_area_struct *vma);
    1149 diff --git a/include/net/netlink.h b/include/net/netlink.h
    1150 index a5506c4..112dcdf 100644
    1151 --- a/include/net/netlink.h
    1152 +++ b/include/net/netlink.h
    1153 @@ -772,12 +772,13 @@ static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
    1154 const struct nla_policy *policy,
    1155 int len)
    1156 {
    1157 - if (nla_len(nla) < len)
    1158 + int nested_len = nla_len(nla) - NLA_ALIGN(len);
    1159 +
    1160 + if (nested_len < 0)
    1161 return -1;
    1162 - if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
    1163 - return nla_parse_nested(tb, maxtype,
    1164 - nla_data(nla) + NLA_ALIGN(len),
    1165 - policy);
    1166 + if (nested_len >= nla_attr_size(0))
    1167 + return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
    1168 + nested_len, policy);
    1169 memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
    1170 return 0;
    1171 }
    1172 diff --git a/init/Kconfig b/init/Kconfig
    1173 index a97924b..021476f 100644
    1174 --- a/init/Kconfig
    1175 +++ b/init/Kconfig
    1176 @@ -13,6 +13,7 @@ config DEFCONFIG_LIST
    1177 default "/lib/modules/$UNAME_RELEASE/.config"
    1178 default "/etc/kernel-config"
    1179 default "/boot/config-$UNAME_RELEASE"
    1180 + default "$ARCH_DEFCONFIG"
    1181 default "arch/$ARCH/defconfig"
    1182
    1183 menu "General setup"
    1184 diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
    1185 index b33410a..c0bac6d 100644
    1186 --- a/net/8021q/vlan.c
    1187 +++ b/net/8021q/vlan.c
    1188 @@ -397,10 +397,8 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
    1189 if (dev->nd_net != &init_net)
    1190 return NOTIFY_DONE;
    1191
    1192 - if (is_vlan_dev(dev)) {
    1193 + if (is_vlan_dev(dev))
    1194 __vlan_device_event(dev, event);
    1195 - goto out;
    1196 - }
    1197
    1198 grp = __vlan_find_group(dev->ifindex);
    1199 if (!grp)
    1200 diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
    1201 index d8f2157..034aa10 100644
    1202 --- a/net/ax25/ax25_subr.c
    1203 +++ b/net/ax25/ax25_subr.c
    1204 @@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
    1205
    1206 void ax25_requeue_frames(ax25_cb *ax25)
    1207 {
    1208 - struct sk_buff *skb, *skb_prev = NULL;
    1209 + struct sk_buff *skb;
    1210
    1211 /*
    1212 * Requeue all the un-ack-ed frames on the output queue to be picked
    1213 * up by ax25_kick called from the timer. This arrangement handles the
    1214 * possibility of an empty output queue.
    1215 */
    1216 - while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
    1217 - if (skb_prev == NULL)
    1218 - skb_queue_head(&ax25->write_queue, skb);
    1219 - else
    1220 - skb_append(skb_prev, skb, &ax25->write_queue);
    1221 - skb_prev = skb;
    1222 - }
    1223 + while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
    1224 + skb_queue_head(&ax25->write_queue, skb);
    1225 }
    1226
    1227 /*
    1228 diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
    1229 index eb62558..0c2c937 100644
    1230 --- a/net/bluetooth/rfcomm/core.c
    1231 +++ b/net/bluetooth/rfcomm/core.c
    1232 @@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
    1233
    1234 rfcomm_dlc_lock(d);
    1235 d->state = BT_CLOSED;
    1236 - rfcomm_dlc_unlock(d);
    1237 d->state_change(d, err);
    1238 + rfcomm_dlc_unlock(d);
    1239
    1240 skb_queue_purge(&d->tx_queue);
    1241 rfcomm_dlc_unlink(d);
    1242 diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
    1243 index c3f749a..c919187 100644
    1244 --- a/net/bluetooth/rfcomm/tty.c
    1245 +++ b/net/bluetooth/rfcomm/tty.c
    1246 @@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
    1247 if (dlc->state == BT_CLOSED) {
    1248 if (!dev->tty) {
    1249 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
    1250 - if (rfcomm_dev_get(dev->id) == NULL)
    1251 + /* Drop DLC lock here to avoid deadlock
    1252 + * 1. rfcomm_dev_get will take rfcomm_dev_lock
    1253 + * but in rfcomm_dev_add there's lock order:
    1254 + * rfcomm_dev_lock -> dlc lock
    1255 + * 2. rfcomm_dev_put will deadlock if it's
    1256 + * the last reference
    1257 + */
    1258 + rfcomm_dlc_unlock(dlc);
    1259 + if (rfcomm_dev_get(dev->id) == NULL) {
    1260 + rfcomm_dlc_lock(dlc);
    1261 return;
    1262 + }
    1263
    1264 rfcomm_dev_del(dev);
    1265 rfcomm_dev_put(dev);
    1266 + rfcomm_dlc_lock(dlc);
    1267 }
    1268 } else
    1269 tty_hangup(dev->tty);
    1270 diff --git a/net/can/raw.c b/net/can/raw.c
    1271 index c92cb8e..da26bbb 100644
    1272 --- a/net/can/raw.c
    1273 +++ b/net/can/raw.c
    1274 @@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    1275 if (!filter)
    1276 return -ENOMEM;
    1277
    1278 - err = copy_from_user(filter, optval, optlen);
    1279 - if (err) {
    1280 + if (copy_from_user(filter, optval, optlen)) {
    1281 kfree(filter);
    1282 - return err;
    1283 + return -EFAULT;
    1284 }
    1285 } else if (count == 1) {
    1286 - err = copy_from_user(&sfilter, optval, optlen);
    1287 - if (err)
    1288 - return err;
    1289 + if (copy_from_user(&sfilter, optval, optlen))
    1290 + return -EFAULT;
    1291 }
    1292
    1293 lock_sock(sk);
    1294 @@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    1295 if (optlen != sizeof(err_mask))
    1296 return -EINVAL;
    1297
    1298 - err = copy_from_user(&err_mask, optval, optlen);
    1299 - if (err)
    1300 - return err;
    1301 + if (copy_from_user(&err_mask, optval, optlen))
    1302 + return -EFAULT;
    1303
    1304 err_mask &= CAN_ERR_MASK;
    1305
    1306 @@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    1307 if (optlen != sizeof(ro->loopback))
    1308 return -EINVAL;
    1309
    1310 - err = copy_from_user(&ro->loopback, optval, optlen);
    1311 + if (copy_from_user(&ro->loopback, optval, optlen))
    1312 + return -EFAULT;
    1313
    1314 break;
    1315
    1316 @@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    1317 if (optlen != sizeof(ro->recv_own_msgs))
    1318 return -EINVAL;
    1319
    1320 - err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
    1321 + if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
    1322 + return -EFAULT;
    1323
    1324 break;
    1325
    1326 diff --git a/net/core/dev.c b/net/core/dev.c
    1327 index 460e7f9..37ffd7a 100644
    1328 --- a/net/core/dev.c
    1329 +++ b/net/core/dev.c
    1330 @@ -3132,7 +3132,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
    1331 * Load in the correct multicast list now the flags have changed.
    1332 */
    1333
    1334 - if (dev->change_rx_flags && (dev->flags ^ flags) & IFF_MULTICAST)
    1335 + if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
    1336 dev->change_rx_flags(dev, IFF_MULTICAST);
    1337
    1338 dev_set_rx_mode(dev);
    1339 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    1340 index 7b5e8e1..d39cf9f 100644
    1341 --- a/net/ipv4/route.c
    1342 +++ b/net/ipv4/route.c
    1343 @@ -162,7 +162,7 @@ static struct dst_ops ipv4_dst_ops = {
    1344 .negative_advice = ipv4_negative_advice,
    1345 .link_failure = ipv4_link_failure,
    1346 .update_pmtu = ip_rt_update_pmtu,
    1347 - .local_out = ip_local_out,
    1348 + .local_out = __ip_local_out,
    1349 .entry_size = sizeof(struct rtable),
    1350 .entries = ATOMIC_INIT(0),
    1351 };
    1352 diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
    1353 index 3a6be23..fde7146 100644
    1354 --- a/net/ipv4/tcp_cong.c
    1355 +++ b/net/ipv4/tcp_cong.c
    1356 @@ -285,14 +285,12 @@ int tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
    1357 if (in_flight >= tp->snd_cwnd)
    1358 return 1;
    1359
    1360 - if (!sk_can_gso(sk))
    1361 - return 0;
    1362 -
    1363 left = tp->snd_cwnd - in_flight;
    1364 - if (sysctl_tcp_tso_win_divisor)
    1365 - return left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd;
    1366 - else
    1367 - return left <= tcp_max_burst(tp);
    1368 + if (sk_can_gso(sk) &&
    1369 + left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
    1370 + left * tp->mss_cache < 65536)
    1371 + return 1;
    1372 + return left <= tcp_max_burst(tp);
    1373 }
    1374 EXPORT_SYMBOL_GPL(tcp_is_cwnd_limited);
    1375
    1376 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    1377 index bbb7d88..3180963 100644
    1378 --- a/net/ipv4/tcp_input.c
    1379 +++ b/net/ipv4/tcp_input.c
    1380 @@ -113,8 +113,6 @@ int sysctl_tcp_abc __read_mostly;
    1381 #define FLAG_FORWARD_PROGRESS (FLAG_ACKED|FLAG_DATA_SACKED)
    1382 #define FLAG_ANY_PROGRESS (FLAG_FORWARD_PROGRESS|FLAG_SND_UNA_ADVANCED)
    1383
    1384 -#define IsSackFrto() (sysctl_tcp_frto == 0x2)
    1385 -
    1386 #define TCP_REMNANT (TCP_FLAG_FIN|TCP_FLAG_URG|TCP_FLAG_SYN|TCP_FLAG_PSH)
    1387 #define TCP_HP_BITS (~(TCP_RESERVED_BITS|TCP_FLAG_PSH))
    1388
    1389 @@ -1393,9 +1391,9 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
    1390
    1391 if (before(next_dup->start_seq, skip_to_seq)) {
    1392 skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
    1393 - tcp_sacktag_walk(skb, sk, NULL,
    1394 - next_dup->start_seq, next_dup->end_seq,
    1395 - 1, fack_count, reord, flag);
    1396 + skb = tcp_sacktag_walk(skb, sk, NULL,
    1397 + next_dup->start_seq, next_dup->end_seq,
    1398 + 1, fack_count, reord, flag);
    1399 }
    1400
    1401 return skb;
    1402 @@ -1685,6 +1683,11 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
    1403 tp->sacked_out = 0;
    1404 }
    1405
    1406 +static int tcp_is_sackfrto(const struct tcp_sock *tp)
    1407 +{
    1408 + return (sysctl_tcp_frto == 0x2) && !tcp_is_reno(tp);
    1409 +}
    1410 +
    1411 /* F-RTO can only be used if TCP has never retransmitted anything other than
    1412 * head (SACK enhanced variant from Appendix B of RFC4138 is more robust here)
    1413 */
    1414 @@ -1701,7 +1704,7 @@ int tcp_use_frto(struct sock *sk)
    1415 if (icsk->icsk_mtup.probe_size)
    1416 return 0;
    1417
    1418 - if (IsSackFrto())
    1419 + if (tcp_is_sackfrto(tp))
    1420 return 1;
    1421
    1422 /* Avoid expensive walking of rexmit queue if possible */
    1423 @@ -1791,7 +1794,7 @@ void tcp_enter_frto(struct sock *sk)
    1424 /* Earlier loss recovery underway (see RFC4138; Appendix B).
    1425 * The last condition is necessary at least in tp->frto_counter case.
    1426 */
    1427 - if (IsSackFrto() && (tp->frto_counter ||
    1428 + if (tcp_is_sackfrto(tp) && (tp->frto_counter ||
    1429 ((1 << icsk->icsk_ca_state) & (TCPF_CA_Recovery|TCPF_CA_Loss))) &&
    1430 after(tp->high_seq, tp->snd_una)) {
    1431 tp->frto_highmark = tp->high_seq;
    1432 @@ -1838,9 +1841,16 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
    1433 TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
    1434 }
    1435
    1436 - /* Don't lost mark skbs that were fwd transmitted after RTO */
    1437 - if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) &&
    1438 - !after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark)) {
    1439 + /* Marking forward transmissions that were made after RTO lost
    1440 + * can cause unnecessary retransmissions in some scenarios,
    1441 + * SACK blocks will mitigate that in some but not in all cases.
    1442 + * We used to not mark them but it was causing break-ups with
    1443 + * receivers that do only in-order receival.
    1444 + *
    1445 + * TODO: we could detect presence of such receiver and select
    1446 + * different behavior per flow.
    1447 + */
    1448 + if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
    1449 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
    1450 tp->lost_out += tcp_skb_pcount(skb);
    1451 }
    1452 @@ -1856,7 +1866,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
    1453 tp->reordering = min_t(unsigned int, tp->reordering,
    1454 sysctl_tcp_reordering);
    1455 tcp_set_ca_state(sk, TCP_CA_Loss);
    1456 - tp->high_seq = tp->frto_highmark;
    1457 + tp->high_seq = tp->snd_nxt;
    1458 TCP_ECN_queue_cwr(tp);
    1459
    1460 tcp_clear_retrans_hints_partial(tp);
    1461 @@ -2459,28 +2469,34 @@ static inline void tcp_complete_cwr(struct sock *sk)
    1462 tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
    1463 }
    1464
    1465 +static void tcp_try_keep_open(struct sock *sk)
    1466 +{
    1467 + struct tcp_sock *tp = tcp_sk(sk);
    1468 + int state = TCP_CA_Open;
    1469 +
    1470 + if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
    1471 + state = TCP_CA_Disorder;
    1472 +
    1473 + if (inet_csk(sk)->icsk_ca_state != state) {
    1474 + tcp_set_ca_state(sk, state);
    1475 + tp->high_seq = tp->snd_nxt;
    1476 + }
    1477 +}
    1478 +
    1479 static void tcp_try_to_open(struct sock *sk, int flag)
    1480 {
    1481 struct tcp_sock *tp = tcp_sk(sk);
    1482
    1483 tcp_verify_left_out(tp);
    1484
    1485 - if (tp->retrans_out == 0)
    1486 + if (!tp->frto_counter && tp->retrans_out == 0)
    1487 tp->retrans_stamp = 0;
    1488
    1489 if (flag & FLAG_ECE)
    1490 tcp_enter_cwr(sk, 1);
    1491
    1492 if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
    1493 - int state = TCP_CA_Open;
    1494 -
    1495 - if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
    1496 - state = TCP_CA_Disorder;
    1497 -
    1498 - if (inet_csk(sk)->icsk_ca_state != state) {
    1499 - tcp_set_ca_state(sk, state);
    1500 - tp->high_seq = tp->snd_nxt;
    1501 - }
    1502 + tcp_try_keep_open(sk);
    1503 tcp_moderate_cwnd(tp);
    1504 } else {
    1505 tcp_cwnd_down(sk, flag);
    1506 @@ -3110,7 +3126,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
    1507 return 1;
    1508 }
    1509
    1510 - if (!IsSackFrto() || tcp_is_reno(tp)) {
    1511 + if (!tcp_is_sackfrto(tp)) {
    1512 /* RFC4138 shortcoming in step 2; should also have case c):
    1513 * ACK isn't duplicate nor advances window, e.g., opposite dir
    1514 * data, winupdate
    1515 @@ -3286,8 +3302,11 @@ no_queue:
    1516 return 1;
    1517
    1518 old_ack:
    1519 - if (TCP_SKB_CB(skb)->sacked)
    1520 + if (TCP_SKB_CB(skb)->sacked) {
    1521 tcp_sacktag_write_queue(sk, skb, prior_snd_una);
    1522 + if (icsk->icsk_ca_state == TCP_CA_Open)
    1523 + tcp_try_keep_open(sk);
    1524 + }
    1525
    1526 uninteresting_ack:
    1527 SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
    1528 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1529 index d29ef79..6c3d8a1 100644
    1530 --- a/net/ipv4/tcp_output.c
    1531 +++ b/net/ipv4/tcp_output.c
    1532 @@ -1836,7 +1836,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
    1533 {
    1534 struct tcp_sock *tp = tcp_sk(sk);
    1535 struct inet_connection_sock *icsk = inet_csk(sk);
    1536 - unsigned int cur_mss = tcp_current_mss(sk, 0);
    1537 + unsigned int cur_mss;
    1538 int err;
    1539
    1540 /* Inconslusive MTU probe */
    1541 @@ -1858,6 +1858,11 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
    1542 return -ENOMEM;
    1543 }
    1544
    1545 + if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
    1546 + return -EHOSTUNREACH; /* Routing failure or similar. */
    1547 +
    1548 + cur_mss = tcp_current_mss(sk, 0);
    1549 +
    1550 /* If receiver has shrunk his window, and skb is out of
    1551 * new window, do not retransmit it. The exception is the
    1552 * case, when window is shrunk to zero. In this case
    1553 @@ -1884,9 +1889,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
    1554 (sysctl_tcp_retrans_collapse != 0))
    1555 tcp_retrans_try_collapse(sk, skb, cur_mss);
    1556
    1557 - if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
    1558 - return -EHOSTUNREACH; /* Routing failure or similar. */
    1559 -
    1560 /* Some Solaris stacks overoptimize and ignore the FIN on a
    1561 * retransmit when old data is attached. So strip it off
    1562 * since it is cheap to do so and saves bytes on the network.
    1563 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1564 index e8b241c..f95745f 100644
    1565 --- a/net/ipv6/route.c
    1566 +++ b/net/ipv6/route.c
    1567 @@ -105,7 +105,7 @@ static struct dst_ops ip6_dst_ops = {
    1568 .negative_advice = ip6_negative_advice,
    1569 .link_failure = ip6_link_failure,
    1570 .update_pmtu = ip6_rt_update_pmtu,
    1571 - .local_out = ip6_local_out,
    1572 + .local_out = __ip6_local_out,
    1573 .entry_size = sizeof(struct rt6_info),
    1574 .entries = ATOMIC_INIT(0),
    1575 };
    1576 diff --git a/net/key/af_key.c b/net/key/af_key.c
    1577 index 5ceab25..11c42e3 100644
    1578 --- a/net/key/af_key.c
    1579 +++ b/net/key/af_key.c
    1580 @@ -1219,7 +1219,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
    1581 x->sel.prefixlen_s = addr->sadb_address_prefixlen;
    1582 }
    1583
    1584 - if (x->props.mode == XFRM_MODE_TRANSPORT)
    1585 + if (!x->sel.family)
    1586 x->sel.family = x->props.family;
    1587
    1588 if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
    1589 diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
    1590 index c170685..7d5c263 100644
    1591 --- a/net/mac80211/ieee80211_sta.c
    1592 +++ b/net/mac80211/ieee80211_sta.c
    1593 @@ -2723,6 +2723,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
    1594 struct rate_selection ratesel;
    1595 u8 *pos;
    1596 struct ieee80211_sub_if_data *sdata;
    1597 + union iwreq_data wrqu;
    1598
    1599 /* Remove possible STA entries from other IBSS networks. */
    1600 sta_info_flush(local, NULL);
    1601 @@ -2863,6 +2864,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
    1602
    1603 ieee80211_rx_bss_put(dev, bss);
    1604
    1605 + memset(&wrqu, 0, sizeof(wrqu));
    1606 + memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
    1607 + wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
    1608 +
    1609 return res;
    1610 }
    1611
    1612 diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
    1613 index 0fbedca..855c33c 100644
    1614 --- a/net/sched/cls_api.c
    1615 +++ b/net/sched/cls_api.c
    1616 @@ -220,7 +220,7 @@ replay:
    1617 tp = kzalloc(sizeof(*tp), GFP_KERNEL);
    1618 if (tp == NULL)
    1619 goto errout;
    1620 - err = -EINVAL;
    1621 + err = -ENOENT;
    1622 tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
    1623 if (tp_ops == NULL) {
    1624 #ifdef CONFIG_KMOD
    1625 diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
    1626 index 9a9b977..d0330d8 100644
    1627 --- a/sound/pci/emu10k1/emu10k1_main.c
    1628 +++ b/sound/pci/emu10k1/emu10k1_main.c
    1629 @@ -1817,13 +1817,6 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
    1630 }
    1631 emu->port = pci_resource_start(pci, 0);
    1632
    1633 - if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
    1634 - "EMU10K1", emu)) {
    1635 - err = -EBUSY;
    1636 - goto error;
    1637 - }
    1638 - emu->irq = pci->irq;
    1639 -
    1640 emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
    1641 if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
    1642 32 * 1024, &emu->ptb_pages) < 0) {
    1643 @@ -1886,6 +1879,14 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
    1644 emu->fx8010.etram_pages.area = NULL;
    1645 emu->fx8010.etram_pages.bytes = 0;
    1646
    1647 + /* irq handler must be registered after I/O ports are activated */
    1648 + if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
    1649 + "EMU10K1", emu)) {
    1650 + err = -EBUSY;
    1651 + goto error;
    1652 + }
    1653 + emu->irq = pci->irq;
    1654 +
    1655 /*
    1656 * Init to 0x02109204 :
    1657 * Clock accuracy = 0 (1000ppm)
    1658 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1659 index 33282f9..52a7f0f 100644
    1660 --- a/sound/pci/hda/patch_realtek.c
    1661 +++ b/sound/pci/hda/patch_realtek.c
    1662 @@ -940,7 +940,6 @@ do_sku:
    1663 AC_VERB_SET_UNSOLICITED_ENABLE,
    1664 AC_USRSP_EN | ALC880_HP_EVENT);
    1665 spec->unsol_event = alc_sku_unsol_event;
    1666 - spec->init_hook = alc_sku_automute;
    1667 }
    1668
    1669 /*