[kernel] r11655 - in dists/sid/linux-2.6/debian: . patches/bugfix/all/stable patches/series
Maximilian Attems
maks at alioth.debian.org
Tue Jun 17 13:39:30 UTC 2008
Author: maks
Date: Tue Jun 17 13:39:29 2008
New Revision: 11655
Log:
add stable release 2.6.25.7
conflicts with vserver as usual
1 out of 6 hunks FAILED -- saving rejects to file
fs/ecryptfs/inode.c.rej
(+) FAIL features/all/vserver/vs2.3.0.34.11.patch
Added:
dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.7.patch
dists/sid/linux-2.6/debian/patches/series/6
Modified:
dists/sid/linux-2.6/debian/changelog
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Tue Jun 17 13:39:29 2008
@@ -1,3 +1,58 @@
+linux-2.6 (2.6.25-6) UNRELEASED; urgency=low
+
+ * Add stable release 2.6.25.7:
+ - double-free of inode on alloc_file() failure exit in create_write_pipe()
+ - m68k: Add ext2_find_{first,next}_bit() for ext4
+ - bluetooth: fix locking bug in the rfcomm socket cleanup handling
+ - serial: fix enable_irq_wake/disable_irq_wake imbalance in serial_core.c
+ - bttv: Fix a deadlock in the bttv driver
+ - forcedeth: msi interrupts
+ - CPUFREQ: Fix format string bug.
+ - mmc: wbsd: initialize tasklets before requesting interrupt
+ - ecryptfs: fix missed mutex_unlock
+ - mac80211: send association event on IBSS create
+ - bluetooth: rfcomm_dev_state_change deadlock fix
+ - sunhv: Fix locking in non-paged I/O case.
+ - cassini: Only use chip checksum for ipv4 packets.
+ - ipwireless: Fix blocked sending
+ - net: Fix call to ->change_rx_flags(dev, IFF_MULTICAST) in
+ dev_change_flags()
+ - fbdev: export symbol fb_mode_option
+ - ipsec: Use the correct ip_local_out function
+ - tcp: fix skb vs fack_count out-of-sync condition
+ - tcp FRTO: Fix fallback to conventional recovery
+ - tcp FRTO: SACK variant is errorneously used with NewReno
+ - tcp FRTO: work-around inorder receivers
+ - tcp: Fix inconsistency source (CA_Open only when !tcp_left_out(tp))
+ - l2tp: avoid skb truesize bug if headroom is increased
+ - l2tp: Fix possible WARN_ON from socket code when UDP socket is closed
+ - l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
+ - ax25: Fix NULL pointer dereference and lockup.
+ - sound: emu10k1 - fix system hang with Audigy2 ZS Notebook PCMCIA card
+ - tcp: Allow send-limited cwnd to grow up to max_burst when gso disabled
+ - tcp: Limit cwnd growth when deferring for GSO
+ - af_key: Fix selector family initialization.
+ - hgafb: resource management fix
+ - cifs: fix oops on mount when CONFIG_CIFS_DFS_UPCALL is enabled
+ - b43: Fix controller restart crash
+ - ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
+ - eCryptfs: protect crypt_stat->flags in ecryptfs_open()
+ - cciss: add new hardware support
+ - ecryptfs: add missing lock around notify_change
+ - ecryptfs: clean up (un)lock_parent
+ - Add 'rd' alias to new brd ramdisk driver
+ - net_sched: cls_api: fix return value for non-existant classifiers
+ - vlan: Correctly handle device notifications for layered VLAN devices
+ - IB/umem: Avoid sign problems when demoting npages to integer
+ - x86: fix recursive dependencies
+ - can: Fix copy_from_user() results interpretation
+ - Kconfig: introduce ARCH_DEFCONFIG to DEFCONFIG_LIST
+ - tcp: TCP connection times out if ICMP frag needed is delayed
+ - ALSA: hda - Fix resume of auto-config mode with Realtek codecs
+ - netlink: Fix nla_parse_nested_compat() to call nla_parse() directly
+
+ -- maximilian attems <maks at debian.org> Tue, 17 Jun 2008 15:32:16 +0200
+
linux-2.6 (2.6.25-5) unstable; urgency=low
[ Bastian Blank ]
Added: dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.7.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/all/stable/2.6.25.7.patch Tue Jun 17 13:39:29 2008
@@ -0,0 +1,1669 @@
+diff --git a/Documentation/cciss.txt b/Documentation/cciss.txt
+index e65736c..63e59b8 100644
+--- a/Documentation/cciss.txt
++++ b/Documentation/cciss.txt
+@@ -21,6 +21,11 @@ This driver is known to work with the following cards:
+ * SA E200
+ * SA E200i
+ * SA E500
++ * SA P212
++ * SA P410
++ * SA P410i
++ * SA P411
++ * SA P812
+
+ Detecting drive failures:
+ -------------------------
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 99a4ed3..6342a07 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -24,17 +24,10 @@ config X86
+ select HAVE_KRETPROBES
+ select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
+
+-config DEFCONFIG_LIST
++config ARCH_DEFCONFIG
+ string
+- depends on X86_32
+- option defconfig_list
+- default "arch/x86/configs/i386_defconfig"
+-
+-config DEFCONFIG_LIST
+- string
+- depends on X86_64
+- option defconfig_list
+- default "arch/x86/configs/x86_64_defconfig"
++ default "arch/x86/configs/i386_defconfig" if X86_32
++ default "arch/x86/configs/x86_64_defconfig" if X86_64
+
+
+ config GENERIC_LOCKBREAK
+@@ -253,8 +246,7 @@ config X86_ELAN
+
+ config X86_VOYAGER
+ bool "Voyager (NCR)"
+- depends on X86_32
+- select SMP if !BROKEN
++ depends on X86_32 && (SMP || BROKEN)
+ help
+ Voyager is an MCA-based 32-way capable SMP architecture proprietary
+ to NCR Corp. Machine classes 345x/35xx/4100/51xx are Voyager-based.
+@@ -266,9 +258,8 @@ config X86_VOYAGER
+
+ config X86_NUMAQ
+ bool "NUMAQ (IBM/Sequent)"
+- select SMP
++ depends on SMP && X86_32
+ select NUMA
+- depends on X86_32
+ help
+ This option is used for getting Linux to run on a (IBM/Sequent) NUMA
+ multiquad box. This changes the way that processors are bootstrapped,
+@@ -339,7 +330,7 @@ config X86_RDC321X
+
+ config X86_VSMP
+ bool "Support for ScaleMP vSMP"
+- depends on X86_64 && PCI
++ depends on X86_64
+ help
+ Support for ScaleMP vSMP systems. Say 'Y' here if this kernel is
+ supposed to run on these EM64T-based machines. Only choose this option
+@@ -1391,7 +1382,7 @@ endmenu
+ menu "Bus options (PCI etc.)"
+
+ config PCI
+- bool "PCI support" if !X86_VISWS
++ bool "PCI support" if !X86_VISWS && !X86_VSMP
+ depends on !X86_VOYAGER
+ default y
+ select ARCH_SUPPORTS_MSI if (X86_LOCAL_APIC && X86_IO_APIC)
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 8536480..37560a0 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -392,6 +392,7 @@ module_param(rd_size, int, 0);
+ MODULE_PARM_DESC(rd_size, "Size of each RAM disk in kbytes.");
+ MODULE_LICENSE("GPL");
+ MODULE_ALIAS_BLOCKDEV_MAJOR(RAMDISK_MAJOR);
++MODULE_ALIAS("rd");
+
+ #ifndef MODULE
+ /* Legacy boot options - nonmodular */
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 9c9627e..41636b8 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -53,15 +53,16 @@
+ #include <linux/scatterlist.h>
+
+ #define CCISS_DRIVER_VERSION(maj,min,submin) ((maj<<16)|(min<<8)|(submin))
+-#define DRIVER_NAME "HP CISS Driver (v 3.6.14)"
+-#define DRIVER_VERSION CCISS_DRIVER_VERSION(3,6,14)
++#define DRIVER_NAME "HP CISS Driver (v 3.6.20)"
++#define DRIVER_VERSION CCISS_DRIVER_VERSION(3, 6, 20)
+
+ /* Embedded module documentation macros - see modules.h */
+ MODULE_AUTHOR("Hewlett-Packard Company");
+-MODULE_DESCRIPTION("Driver for HP Controller SA5xxx SA6xxx version 3.6.14");
++MODULE_DESCRIPTION("Driver for HP Smart Array Controllers");
+ MODULE_SUPPORTED_DEVICE("HP SA5i SA5i+ SA532 SA5300 SA5312 SA641 SA642 SA6400"
+- " SA6i P600 P800 P400 P400i E200 E200i E500");
+-MODULE_VERSION("3.6.14");
++ " SA6i P600 P800 P400 P400i E200 E200i E500 P700m"
++ " Smart Array G2 Series SAS/SATA Controllers");
++MODULE_VERSION("3.6.20");
+ MODULE_LICENSE("GPL");
+
+ #include "cciss_cmd.h"
+@@ -90,6 +91,11 @@ static const struct pci_device_id cciss_pci_device_id[] = {
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSD, 0x103C, 0x3215},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x3237},
+ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSC, 0x103C, 0x323D},
++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3241},
++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3243},
++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3245},
++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3247},
++ {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_CISSE, 0x103C, 0x3249},
+ {PCI_VENDOR_ID_HP, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+ PCI_CLASS_STORAGE_RAID << 8, 0xffff << 8, 0},
+ {0,}
+@@ -123,6 +129,11 @@ static struct board_type products[] = {
+ {0x3215103C, "Smart Array E200i", &SA5_access, 120},
+ {0x3237103C, "Smart Array E500", &SA5_access, 512},
+ {0x323D103C, "Smart Array P700m", &SA5_access, 512},
++ {0x3241103C, "Smart Array P212", &SA5_access, 384},
++ {0x3243103C, "Smart Array P410", &SA5_access, 384},
++ {0x3245103C, "Smart Array P410i", &SA5_access, 384},
++ {0x3247103C, "Smart Array P411", &SA5_access, 384},
++ {0x3249103C, "Smart Array P812", &SA5_access, 384},
+ {0xFFFF103C, "Unknown Smart Array", &SA5_access, 120},
+ };
+
+diff --git a/drivers/char/pcmcia/ipwireless/hardware.c b/drivers/char/pcmcia/ipwireless/hardware.c
+index 1f978ff..d353866 100644
+--- a/drivers/char/pcmcia/ipwireless/hardware.c
++++ b/drivers/char/pcmcia/ipwireless/hardware.c
+@@ -251,10 +251,11 @@ struct ipw_hardware {
+ int init_loops;
+ struct timer_list setup_timer;
+
++ /* Flag if hw is ready to send next packet */
+ int tx_ready;
+- struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
+- /* True if any packets are queued for transmission */
++ /* Count of pending packets to be sent */
+ int tx_queued;
++ struct list_head tx_queue[NL_NUM_OF_PRIORITIES];
+
+ int rx_bytes_queued;
+ struct list_head rx_queue;
+@@ -430,6 +431,8 @@ static int do_send_fragment(struct ipw_hardware *hw, const unsigned char *data,
+
+ spin_lock_irqsave(&hw->spinlock, flags);
+
++ hw->tx_ready = 0;
++
+ if (hw->hw_version == HW_VERSION_1) {
+ outw((unsigned short) length, hw->base_port + IODWR);
+
+@@ -518,6 +521,7 @@ static int do_send_packet(struct ipw_hardware *hw, struct ipw_tx_packet *packet)
+
+ spin_lock_irqsave(&hw->spinlock, flags);
+ list_add(&packet->queue, &hw->tx_queue[0]);
++ hw->tx_queued++;
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+ } else {
+ if (packet->packet_callback)
+@@ -975,12 +979,10 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
+ unsigned long flags;
+
+ spin_lock_irqsave(&hw->spinlock, flags);
+- if (hw->tx_queued && hw->tx_ready != 0) {
++ if (hw->tx_queued && hw->tx_ready) {
+ int priority;
+ struct ipw_tx_packet *packet = NULL;
+
+- hw->tx_ready--;
+-
+ /* Pick a packet */
+ for (priority = 0; priority < priority_limit; priority++) {
+ if (!list_empty(&hw->tx_queue[priority])) {
+@@ -989,6 +991,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
+ struct ipw_tx_packet,
+ queue);
+
++ hw->tx_queued--;
+ list_del(&packet->queue);
+
+ break;
+@@ -999,6 +1002,7 @@ static int send_pending_packet(struct ipw_hardware *hw, int priority_limit)
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+ return 0;
+ }
++
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+
+ /* Send */
+@@ -1089,7 +1093,7 @@ static irqreturn_t ipwireless_handle_v1_interrupt(int irq,
+ if (irqn & IR_TXINTR) {
+ ack |= IR_TXINTR;
+ spin_lock_irqsave(&hw->spinlock, flags);
+- hw->tx_ready++;
++ hw->tx_ready = 1;
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+ }
+ /* Received data */
+@@ -1196,7 +1200,7 @@ static irqreturn_t ipwireless_handle_v2_v3_interrupt(int irq,
+ if (memrxdone & MEMRX_RX_DONE) {
+ writew(0, &hw->memory_info_regs->memreg_rx_done);
+ spin_lock_irqsave(&hw->spinlock, flags);
+- hw->tx_ready++;
++ hw->tx_ready = 1;
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+ tx = 1;
+ }
+@@ -1260,7 +1264,7 @@ static void send_packet(struct ipw_hardware *hw, int priority,
+
+ spin_lock_irqsave(&hw->spinlock, flags);
+ list_add_tail(&packet->queue, &hw->tx_queue[priority]);
+- hw->tx_queued = 1;
++ hw->tx_queued++;
+ spin_unlock_irqrestore(&hw->spinlock, flags);
+
+ flush_packets_to_hw(hw);
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 99aa5f5..ebd68c1 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -410,7 +410,7 @@ static int cpufreq_parse_governor (char *str_governor, unsigned int *policy,
+ int ret;
+
+ mutex_unlock(&cpufreq_governor_mutex);
+- ret = request_module(name);
++ ret = request_module("%s", name);
+ mutex_lock(&cpufreq_governor_mutex);
+
+ if (ret == 0)
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 4e3128f..9d5b86c 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -144,7 +144,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ ret = 0;
+ while (npages) {
+ ret = get_user_pages(current, current->mm, cur_base,
+- min_t(int, npages,
++ min_t(unsigned long, npages,
+ PAGE_SIZE / sizeof (struct page *)),
+ 1, !umem->writable, page_list, vma_list);
+
+diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
+index fcf8f2d..594522a 100644
+--- a/drivers/media/video/bt8xx/bttv-driver.c
++++ b/drivers/media/video/bt8xx/bttv-driver.c
+@@ -2613,7 +2613,7 @@ static int vidiocgmbuf(struct file *file, void *priv, struct video_mbuf *mbuf)
+ struct bttv_fh *fh = priv;
+
+ mutex_lock(&fh->cap.vb_lock);
+- retval = videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
++ retval = __videobuf_mmap_setup(&fh->cap, gbuffers, gbufsize,
+ V4L2_MEMORY_MMAP);
+ if (retval < 0) {
+ mutex_unlock(&fh->cap.vb_lock);
+diff --git a/drivers/media/video/videobuf-core.c b/drivers/media/video/videobuf-core.c
+index eab79ff..57a9de4 100644
+--- a/drivers/media/video/videobuf-core.c
++++ b/drivers/media/video/videobuf-core.c
+@@ -335,7 +335,7 @@ int videobuf_mmap_free(struct videobuf_queue *q)
+ }
+
+ /* Locking: Caller holds q->vb_lock */
+-static int __videobuf_mmap_setup(struct videobuf_queue *q,
++int __videobuf_mmap_setup(struct videobuf_queue *q,
+ unsigned int bcount, unsigned int bsize,
+ enum v4l2_memory memory)
+ {
+@@ -1093,6 +1093,7 @@ EXPORT_SYMBOL_GPL(videobuf_read_stream);
+ EXPORT_SYMBOL_GPL(videobuf_read_one);
+ EXPORT_SYMBOL_GPL(videobuf_poll_stream);
+
++EXPORT_SYMBOL_GPL(__videobuf_mmap_setup);
+ EXPORT_SYMBOL_GPL(videobuf_mmap_setup);
+ EXPORT_SYMBOL_GPL(videobuf_mmap_free);
+ EXPORT_SYMBOL_GPL(videobuf_mmap_mapper);
+diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c
+index be624a0..c303e7f 100644
+--- a/drivers/mmc/host/wbsd.c
++++ b/drivers/mmc/host/wbsd.c
+@@ -1457,17 +1457,7 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
+ int ret;
+
+ /*
+- * Allocate interrupt.
+- */
+-
+- ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
+- if (ret)
+- return ret;
+-
+- host->irq = irq;
+-
+- /*
+- * Set up tasklets.
++ * Set up tasklets. Must be done before requesting interrupt.
+ */
+ tasklet_init(&host->card_tasklet, wbsd_tasklet_card,
+ (unsigned long)host);
+@@ -1480,6 +1470,15 @@ static int __devinit wbsd_request_irq(struct wbsd_host *host, int irq)
+ tasklet_init(&host->finish_tasklet, wbsd_tasklet_finish,
+ (unsigned long)host);
+
++ /*
++ * Allocate interrupt.
++ */
++ ret = request_irq(irq, wbsd_irq, IRQF_SHARED, DRIVER_NAME, host);
++ if (ret)
++ return ret;
++
++ host->irq = irq;
++
+ return 0;
+ }
+
+diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
+index 14299f8..863d7f3 100644
+--- a/drivers/net/cassini.c
++++ b/drivers/net/cassini.c
+@@ -142,8 +142,8 @@
+
+ #define DRV_MODULE_NAME "cassini"
+ #define PFX DRV_MODULE_NAME ": "
+-#define DRV_MODULE_VERSION "1.5"
+-#define DRV_MODULE_RELDATE "4 Jan 2008"
++#define DRV_MODULE_VERSION "1.6"
++#define DRV_MODULE_RELDATE "21 May 2008"
+
+ #define CAS_DEF_MSG_ENABLE \
+ (NETIF_MSG_DRV | \
+@@ -2140,9 +2140,12 @@ end_copy_pkt:
+ if (addr)
+ cas_page_unmap(addr);
+ }
+- skb->csum = csum_unfold(~csum);
+- skb->ip_summed = CHECKSUM_COMPLETE;
+ skb->protocol = eth_type_trans(skb, cp->dev);
++ if (skb->protocol == htons(ETH_P_IP)) {
++ skb->csum = csum_unfold(~csum);
++ skb->ip_summed = CHECKSUM_COMPLETE;
++ } else
++ skb->ip_summed = CHECKSUM_NONE;
+ return len;
+ }
+
+diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
+index 9f088a4..8e877e7 100644
+--- a/drivers/net/forcedeth.c
++++ b/drivers/net/forcedeth.c
+@@ -3111,6 +3111,20 @@ static void nv_link_irq(struct net_device *dev)
+ dprintk(KERN_DEBUG "%s: link change notification done.\n", dev->name);
+ }
+
++static void nv_msi_workaround(struct fe_priv *np)
++{
++
++ /* Need to toggle the msi irq mask within the ethernet device,
++ * otherwise, future interrupts will not be detected.
++ */
++ if (np->msi_flags & NV_MSI_ENABLED) {
++ u8 __iomem *base = np->base;
++
++ writel(0, base + NvRegMSIIrqMask);
++ writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
++ }
++}
++
+ static irqreturn_t nv_nic_irq(int foo, void *data)
+ {
+ struct net_device *dev = (struct net_device *) data;
+@@ -3133,6 +3147,8 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
+ if (!(events & np->irqmask))
+ break;
+
++ nv_msi_workaround(np);
++
+ spin_lock(&np->lock);
+ nv_tx_done(dev);
+ spin_unlock(&np->lock);
+@@ -3248,6 +3264,8 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
+ if (!(events & np->irqmask))
+ break;
+
++ nv_msi_workaround(np);
++
+ spin_lock(&np->lock);
+ nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
+ spin_unlock(&np->lock);
+@@ -3588,6 +3606,8 @@ static irqreturn_t nv_nic_irq_test(int foo, void *data)
+ if (!(events & NVREG_IRQ_TIMER))
+ return IRQ_RETVAL(0);
+
++ nv_msi_workaround(np);
++
+ spin_lock(&np->lock);
+ np->intr_test = 1;
+ spin_unlock(&np->lock);
+diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
+index 3d10ca0..a629355 100644
+--- a/drivers/net/pppol2tp.c
++++ b/drivers/net/pppol2tp.c
+@@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
+ if (sk == NULL)
+ return NULL;
+
++ sock_hold(sk);
+ session = (struct pppol2tp_session *)(sk->sk_user_data);
+- if (session == NULL)
+- return NULL;
++ if (session == NULL) {
++ sock_put(sk);
++ goto out;
++ }
+
+ BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+-
++out:
+ return session;
+ }
+
+@@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
+ if (sk == NULL)
+ return NULL;
+
++ sock_hold(sk);
+ tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
+- if (tunnel == NULL)
+- return NULL;
++ if (tunnel == NULL) {
++ sock_put(sk);
++ goto out;
++ }
+
+ BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
+-
++out:
+ return tunnel;
+ }
+
+@@ -716,12 +722,14 @@ discard:
+ session->stats.rx_errors++;
+ kfree_skb(skb);
+ sock_put(session->sock);
++ sock_put(sock);
+
+ return 0;
+
+ error:
+ /* Put UDP header back */
+ __skb_push(skb, sizeof(struct udphdr));
++ sock_put(sock);
+
+ no_tunnel:
+ return 1;
+@@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ "%s: received %d bytes\n", tunnel->name, skb->len);
+
+ if (pppol2tp_recv_core(sk, skb))
+- goto pass_up;
++ goto pass_up_put;
+
++ sock_put(sk);
+ return 0;
+
++pass_up_put:
++ sock_put(sk);
+ pass_up:
+ return 1;
+ }
+@@ -858,7 +869,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+
+ tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+ if (tunnel == NULL)
+- goto error;
++ goto error_put_sess;
+
+ /* What header length is configured for this session? */
+ hdr_len = pppol2tp_l2tp_header_len(session);
+@@ -870,7 +881,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+ sizeof(ppph) + total_len,
+ 0, GFP_KERNEL);
+ if (!skb)
+- goto error;
++ goto error_put_sess_tun;
+
+ /* Reserve space for headers. */
+ skb_reserve(skb, NET_SKB_PAD);
+@@ -900,7 +911,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+ error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
+ if (error < 0) {
+ kfree_skb(skb);
+- goto error;
++ goto error_put_sess_tun;
+ }
+ skb_put(skb, total_len);
+
+@@ -947,10 +958,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
+ session->stats.tx_errors++;
+ }
+
++ return error;
++
++error_put_sess_tun:
++ sock_put(session->tunnel_sock);
++error_put_sess:
++ sock_put(sk);
+ error:
+ return error;
+ }
+
++/* Automatically called when the skb is freed.
++ */
++static void pppol2tp_sock_wfree(struct sk_buff *skb)
++{
++ sock_put(skb->sk);
++}
++
++/* For data skbs that we transmit, we associate with the tunnel socket
++ * but don't do accounting.
++ */
++static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
++{
++ sock_hold(sk);
++ skb->sk = sk;
++ skb->destructor = pppol2tp_sock_wfree;
++}
++
+ /* Transmit function called by generic PPP driver. Sends PPP frame
+ * over PPPoL2TP socket.
+ *
+@@ -980,6 +1014,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ __wsum csum = 0;
+ struct udphdr *uh;
+ unsigned int len;
++ int old_headroom;
++ int new_headroom;
+
+ if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
+ goto abort;
+@@ -991,25 +1027,27 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+
+ sk_tun = session->tunnel_sock;
+ if (sk_tun == NULL)
+- goto abort;
++ goto abort_put_sess;
+ tunnel = pppol2tp_sock_to_tunnel(sk_tun);
+ if (tunnel == NULL)
+- goto abort;
++ goto abort_put_sess;
+
+ /* What header length is configured for this session? */
+ hdr_len = pppol2tp_l2tp_header_len(session);
+
+ /* Check that there's enough headroom in the skb to insert IP,
+ * UDP and L2TP and PPP headers. If not enough, expand it to
+- * make room. Note that a new skb (or a clone) is
+- * allocated. If we return an error from this point on, make
+- * sure we free the new skb but do not free the original skb
+- * since that is done by the caller for the error case.
++ * make room. Adjust truesize.
+ */
+ headroom = NET_SKB_PAD + sizeof(struct iphdr) +
+ sizeof(struct udphdr) + hdr_len + sizeof(ppph);
++ old_headroom = skb_headroom(skb);
+ if (skb_cow_head(skb, headroom))
+- goto abort;
++ goto abort_put_sess_tun;
++
++ new_headroom = skb_headroom(skb);
++ skb_orphan(skb);
++ skb->truesize += new_headroom - old_headroom;
+
+ /* Setup PPP header */
+ __skb_push(skb, sizeof(ppph));
+@@ -1065,8 +1103,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ /* Get routing info from the tunnel socket */
+ dst_release(skb->dst);
+ skb->dst = dst_clone(__sk_dst_get(sk_tun));
+- skb_orphan(skb);
+- skb->sk = sk_tun;
++ pppol2tp_skb_set_owner_w(skb, sk_tun);
+
+ /* Queue the packet to IP for output */
+ len = skb->len;
+@@ -1083,8 +1120,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ session->stats.tx_errors++;
+ }
+
++ sock_put(sk_tun);
++ sock_put(sk);
+ return 1;
+
++abort_put_sess_tun:
++ sock_put(sk_tun);
++abort_put_sess:
++ sock_put(sk);
+ abort:
+ /* Free the original skb */
+ kfree_skb(skb);
+@@ -1188,7 +1231,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
+ {
+ struct pppol2tp_tunnel *tunnel;
+
+- tunnel = pppol2tp_sock_to_tunnel(sk);
++ tunnel = sk->sk_user_data;
+ if (tunnel == NULL)
+ goto end;
+
+@@ -1227,10 +1270,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
+ if (sk->sk_user_data != NULL) {
+ struct pppol2tp_tunnel *tunnel;
+
+- session = pppol2tp_sock_to_session(sk);
++ session = sk->sk_user_data;
+ if (session == NULL)
+ goto out;
+
++ BUG_ON(session->magic != L2TP_SESSION_MAGIC);
++
+ /* Don't use pppol2tp_sock_to_tunnel() here to
+ * get the tunnel context because the tunnel
+ * socket might have already been closed (its
+@@ -1276,6 +1321,7 @@ out:
+ static int pppol2tp_release(struct socket *sock)
+ {
+ struct sock *sk = sock->sk;
++ struct pppol2tp_session *session;
+ int error;
+
+ if (!sk)
+@@ -1293,9 +1339,18 @@ static int pppol2tp_release(struct socket *sock)
+ sock_orphan(sk);
+ sock->sk = NULL;
+
++ session = pppol2tp_sock_to_session(sk);
++
+ /* Purge any queued data */
+ skb_queue_purge(&sk->sk_receive_queue);
+ skb_queue_purge(&sk->sk_write_queue);
++ if (session != NULL) {
++ struct sk_buff *skb;
++ while ((skb = skb_dequeue(&session->reorder_q))) {
++ kfree_skb(skb);
++ sock_put(sk);
++ }
++ }
+
+ release_sock(sk);
+
+@@ -1598,7 +1653,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+
+ error = ppp_register_channel(&po->chan);
+ if (error)
+- goto end;
++ goto end_put_tun;
+
+ /* This is how we get the session context from the socket. */
+ sk->sk_user_data = session;
+@@ -1618,6 +1673,8 @@ out_no_ppp:
+ PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
+ "%s: created\n", session->name);
+
++end_put_tun:
++ sock_put(tunnel_sock);
+ end:
+ release_sock(sk);
+
+@@ -1658,6 +1715,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
+ *usockaddr_len = len;
+
+ error = 0;
++ sock_put(sock->sk);
+
+ end:
+ return error;
+@@ -1896,14 +1954,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
+ err = -EBADF;
+ tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+ if (tunnel == NULL)
+- goto end;
++ goto end_put_sess;
+
+ err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
+- goto end;
++ sock_put(session->tunnel_sock);
++ goto end_put_sess;
+ }
+
+ err = pppol2tp_session_ioctl(session, cmd, arg);
+
++end_put_sess:
++ sock_put(sk);
+ end:
+ return err;
+ }
+@@ -2049,14 +2110,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
+ err = -EBADF;
+ tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+ if (tunnel == NULL)
+- goto end;
++ goto end_put_sess;
+
+ err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
++ sock_put(session->tunnel_sock);
+ } else
+ err = pppol2tp_session_setsockopt(sk, session, optname, val);
+
+ err = 0;
+
++end_put_sess:
++ sock_put(sk);
+ end:
+ return err;
+ }
+@@ -2171,20 +2235,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
+ err = -EBADF;
+ tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
+ if (tunnel == NULL)
+- goto end;
++ goto end_put_sess;
+
+ err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
++ sock_put(session->tunnel_sock);
+ } else
+ err = pppol2tp_session_getsockopt(sk, session, optname, &val);
+
+ err = -EFAULT;
+ if (put_user(len, (int __user *) optlen))
+- goto end;
++ goto end_put_sess;
+
+ if (copy_to_user((void __user *) optval, &val, len))
+- goto end;
++ goto end_put_sess;
+
+ err = 0;
++
++end_put_sess:
++ sock_put(sk);
+ end:
+ return err;
+ }
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index e0055d0..6966eec 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -3818,7 +3818,9 @@ static void b43_chip_reset(struct work_struct *work)
+ goto out;
+ }
+ }
+- out:
++out:
++ if (err)
++ wl->current_dev = NULL; /* Failed to init the dev. */
+ mutex_unlock(&wl->mutex);
+ if (err)
+ b43err(wl, "Controller restart FAILED\n");
+@@ -3967,9 +3969,11 @@ static void b43_one_core_detach(struct ssb_device *dev)
+ struct b43_wldev *wldev;
+ struct b43_wl *wl;
+
++ /* Do not cancel ieee80211-workqueue based work here.
++ * See comment in b43_remove(). */
++
+ wldev = ssb_get_drvdata(dev);
+ wl = wldev->wl;
+- cancel_work_sync(&wldev->restart_work);
+ b43_debugfs_remove_device(wldev);
+ b43_wireless_core_detach(wldev);
+ list_del(&wldev->list);
+@@ -4152,6 +4156,10 @@ static void b43_remove(struct ssb_device *dev)
+ struct b43_wl *wl = ssb_get_devtypedata(dev);
+ struct b43_wldev *wldev = ssb_get_drvdata(dev);
+
++ /* We must cancel any work here before unregistering from ieee80211,
++ * as the ieee80211 unreg will destroy the workqueue. */
++ cancel_work_sync(&wldev->restart_work);
++
+ B43_WARN_ON(!wl);
+ if (wl->current_dev == wldev)
+ ieee80211_unregister_hw(wl->hw);
+diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
+index 3bf9294..db9920e 100644
+--- a/drivers/serial/serial_core.c
++++ b/drivers/serial/serial_core.c
+@@ -2022,6 +2022,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
+ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
+ {
+ struct uart_state *state = drv->state + port->line;
++ struct device *tty_dev;
++ struct uart_match match = {port, drv};
+
+ mutex_lock(&state->mutex);
+
+@@ -2031,7 +2033,8 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *port)
+ return 0;
+ }
+
+- if (!port->suspended) {
++ tty_dev = device_find_child(port->dev, &match, serial_match_port);
++ if (!port->suspended && device_may_wakeup(tty_dev)) {
+ disable_irq_wake(port->irq);
+ mutex_unlock(&state->mutex);
+ return 0;
+diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c
+index 145c028..2847336 100644
+--- a/drivers/serial/sunhv.c
++++ b/drivers/serial/sunhv.c
+@@ -499,7 +499,6 @@ static void sunhv_console_write_bychar(struct console *con, const char *s, unsig
+ } else
+ spin_lock(&port->lock);
+
+- spin_lock_irqsave(&port->lock, flags);
+ for (i = 0; i < n; i++) {
+ if (*s == '\n')
+ sunhv_console_putchar(port, '\r');
+diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
+index 5d777f2..3c8239a 100644
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -519,12 +519,12 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
+ int err = 0;
+ u32 tmp;
+
+- might_sleep();
+-
+ if (!pdev)
+ goto out;
+ bus = pdev->bus;
+
++ might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
++
+ /* Enable interrupts for this device. */
+ if (bus->host_pci &&
+ ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {
+diff --git a/drivers/video/hgafb.c b/drivers/video/hgafb.c
+index fb9e672..c18880d 100644
+--- a/drivers/video/hgafb.c
++++ b/drivers/video/hgafb.c
+@@ -279,7 +279,7 @@ static void hga_blank(int blank_mode)
+
+ static int __init hga_card_detect(void)
+ {
+- int count=0;
++ int count = 0;
+ void __iomem *p, *q;
+ unsigned short p_save, q_save;
+
+@@ -303,20 +303,18 @@ static int __init hga_card_detect(void)
+ writew(0x55aa, p); if (readw(p) == 0x55aa) count++;
+ writew(p_save, p);
+
+- if (count != 2) {
+- return 0;
+- }
++ if (count != 2)
++ goto error;
+
+ /* Ok, there is definitely a card registering at the correct
+ * memory location, so now we do an I/O port test.
+ */
+
+- if (!test_hga_b(0x66, 0x0f)) { /* cursor low register */
+- return 0;
+- }
+- if (!test_hga_b(0x99, 0x0f)) { /* cursor low register */
+- return 0;
+- }
++ if (!test_hga_b(0x66, 0x0f)) /* cursor low register */
++ goto error;
++
++ if (!test_hga_b(0x99, 0x0f)) /* cursor low register */
++ goto error;
+
+ /* See if the card is a Hercules, by checking whether the vsync
+ * bit of the status register is changing. This test lasts for
+@@ -331,7 +329,7 @@ static int __init hga_card_detect(void)
+ }
+
+ if (p_save == q_save)
+- return 0;
++ goto error;
+
+ switch (inb_p(HGA_STATUS_PORT) & 0x70) {
+ case 0x10:
+@@ -348,6 +346,12 @@ static int __init hga_card_detect(void)
+ break;
+ }
+ return 1;
++error:
++ if (release_io_ports)
++ release_region(0x3b0, 12);
++ if (release_io_port)
++ release_region(0x3bf, 1);
++ return 0;
+ }
+
+ /**
+diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
+index 08d0725..971b338 100644
+--- a/drivers/video/modedb.c
++++ b/drivers/video/modedb.c
+@@ -28,6 +28,7 @@
+ #endif
+
+ const char *fb_mode_option;
++EXPORT_SYMBOL_GPL(fb_mode_option);
+
+ /*
+ * Standard video mode definitions (taken from XFree86)
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index a04b17e..b94fb5c 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -97,9 +97,6 @@ cifs_read_super(struct super_block *sb, void *data,
+ {
+ struct inode *inode;
+ struct cifs_sb_info *cifs_sb;
+-#ifdef CONFIG_CIFS_DFS_UPCALL
+- int len;
+-#endif
+ int rc = 0;
+
+ /* BB should we make this contingent on mount parm? */
+@@ -117,15 +114,17 @@ cifs_read_super(struct super_block *sb, void *data,
+ * complex operation (mount), and in case of fail
+ * just exit instead of doing mount and attempting
+ * undo it if this copy fails?*/
+- len = strlen(data);
+- cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
+- if (cifs_sb->mountdata == NULL) {
+- kfree(sb->s_fs_info);
+- sb->s_fs_info = NULL;
+- return -ENOMEM;
++ if (data) {
++ int len = strlen(data);
++ cifs_sb->mountdata = kzalloc(len + 1, GFP_KERNEL);
++ if (cifs_sb->mountdata == NULL) {
++ kfree(sb->s_fs_info);
++ sb->s_fs_info = NULL;
++ return -ENOMEM;
++ }
++ strncpy(cifs_sb->mountdata, data, len + 1);
++ cifs_sb->mountdata[len] = '\0';
+ }
+- strncpy(cifs_sb->mountdata, data, len + 1);
+- cifs_sb->mountdata[len] = '\0';
+ #endif
+
+ rc = cifs_mount(sb, cifs_sb, data, devname);
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index a066e10..086b312 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -1907,9 +1907,9 @@ int ecryptfs_get_tfm_and_mutex_for_cipher_name(struct crypto_blkcipher **tfm,
+ goto out;
+ }
+ }
+- mutex_unlock(&key_tfm_list_mutex);
+ (*tfm) = key_tfm->key_tfm;
+ (*tfm_mutex) = &key_tfm->key_tfm_mutex;
+ out:
++ mutex_unlock(&key_tfm_list_mutex);
+ return rc;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index 2b8f5ed..2258b8f 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -195,7 +195,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
+ file, ecryptfs_inode_to_private(inode)->lower_file);
+ if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
+ ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
++ mutex_lock(&crypt_stat->cs_mutex);
+ crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
++ mutex_unlock(&crypt_stat->cs_mutex);
+ rc = 0;
+ goto out;
+ }
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index e238611..a2174c2 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -37,17 +37,11 @@ static struct dentry *lock_parent(struct dentry *dentry)
+ {
+ struct dentry *dir;
+
+- dir = dget(dentry->d_parent);
++ dir = dget_parent(dentry);
+ mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
+ return dir;
+ }
+
+-static void unlock_parent(struct dentry *dentry)
+-{
+- mutex_unlock(&(dentry->d_parent->d_inode->i_mutex));
+- dput(dentry->d_parent);
+-}
+-
+ static void unlock_dir(struct dentry *dir)
+ {
+ mutex_unlock(&dir->d_inode->i_mutex);
+@@ -426,8 +420,9 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
+ int rc = 0;
+ struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
+ struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
++ struct dentry *lower_dir_dentry;
+
+- lock_parent(lower_dentry);
++ lower_dir_dentry = lock_parent(lower_dentry);
+ rc = vfs_unlink(lower_dir_inode, lower_dentry);
+ if (rc) {
+ printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
+@@ -439,7 +434,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
+ dentry->d_inode->i_ctime = dir->i_ctime;
+ d_drop(dentry);
+ out_unlock:
+- unlock_parent(lower_dentry);
++ unlock_dir(lower_dir_dentry);
+ return rc;
+ }
+
+@@ -908,7 +903,9 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
+ if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
+ ia->ia_valid &= ~ATTR_MODE;
+
++ mutex_lock(&lower_dentry->d_inode->i_mutex);
+ rc = notify_change(lower_dentry, ia);
++ mutex_unlock(&lower_dentry->d_inode->i_mutex);
+ out:
+ fsstack_copy_attr_all(inode, lower_inode, NULL);
+ return rc;
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8be381b..f73492b 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -988,7 +988,10 @@ struct file *create_write_pipe(void)
+ return f;
+
+ err_dentry:
++ free_pipe_info(inode);
+ dput(dentry);
++ return ERR_PTR(err);
++
+ err_inode:
+ free_pipe_info(inode);
+ iput(inode);
+diff --git a/include/asm-m68k/bitops.h b/include/asm-m68k/bitops.h
+index 83d1f28..fbb7f06 100644
+--- a/include/asm-m68k/bitops.h
++++ b/include/asm-m68k/bitops.h
+@@ -410,8 +410,50 @@ static inline int ext2_find_next_zero_bit(const void *vaddr, unsigned size,
+ res = ext2_find_first_zero_bit (p, size - 32 * (p - addr));
+ return (p - addr) * 32 + res;
+ }
+-#define ext2_find_next_bit(addr, size, off) \
+- generic_find_next_le_bit((unsigned long *)(addr), (size), (off))
++
++static inline int ext2_find_first_bit(const void *vaddr, unsigned size)
++{
++ const unsigned long *p = vaddr, *addr = vaddr;
++ int res;
++
++ if (!size)
++ return 0;
++
++ size = (size >> 5) + ((size & 31) > 0);
++ while (*p++ == 0UL)
++ {
++ if (--size == 0)
++ return (p - addr) << 5;
++ }
++
++ --p;
++ for (res = 0; res < 32; res++)
++ if (ext2_test_bit(res, p))
++ break;
++ return (p - addr) * 32 + res;
++}
++
++static inline int ext2_find_next_bit(const void *vaddr, unsigned size,
++ unsigned offset)
++{
++ const unsigned long *addr = vaddr;
++ const unsigned long *p = addr + (offset >> 5);
++ int bit = offset & 31UL, res;
++
++ if (offset >= size)
++ return size;
++
++ if (bit) {
++ /* Look for one in first longword */
++ for (res = bit; res < 32; res++)
++ if (ext2_test_bit(res, p))
++ return (p - addr) * 32 + res;
++ p++;
++ }
++ /* No set bit yet, search remaining full bytes for a set bit */
++ res = ext2_find_first_bit(p, size - 32 * (p - addr));
++ return (p - addr) * 32 + res;
++}
+
+ #endif /* __KERNEL__ */
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 70eb3c8..f624e7c 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -716,6 +716,7 @@
+ #define PCI_DEVICE_ID_HP_CISSA 0x3220
+ #define PCI_DEVICE_ID_HP_CISSC 0x3230
+ #define PCI_DEVICE_ID_HP_CISSD 0x3238
++#define PCI_DEVICE_ID_HP_CISSE 0x323a
+ #define PCI_DEVICE_ID_HP_ZX2_IOC 0x4031
+
+ #define PCI_VENDOR_ID_PCTECH 0x1042
+diff --git a/include/media/videobuf-core.h b/include/media/videobuf-core.h
+index 9903394..7552731 100644
+--- a/include/media/videobuf-core.h
++++ b/include/media/videobuf-core.h
+@@ -227,6 +227,9 @@ unsigned int videobuf_poll_stream(struct file *file,
+ int videobuf_mmap_setup(struct videobuf_queue *q,
+ unsigned int bcount, unsigned int bsize,
+ enum v4l2_memory memory);
++int __videobuf_mmap_setup(struct videobuf_queue *q,
++ unsigned int bcount, unsigned int bsize,
++ enum v4l2_memory memory);
+ int videobuf_mmap_free(struct videobuf_queue *q);
+ int videobuf_mmap_mapper(struct videobuf_queue *q,
+ struct vm_area_struct *vma);
+diff --git a/include/net/netlink.h b/include/net/netlink.h
+index a5506c4..112dcdf 100644
+--- a/include/net/netlink.h
++++ b/include/net/netlink.h
+@@ -772,12 +772,13 @@ static inline int __nla_parse_nested_compat(struct nlattr *tb[], int maxtype,
+ const struct nla_policy *policy,
+ int len)
+ {
+- if (nla_len(nla) < len)
++ int nested_len = nla_len(nla) - NLA_ALIGN(len);
++
++ if (nested_len < 0)
+ return -1;
+- if (nla_len(nla) >= NLA_ALIGN(len) + sizeof(struct nlattr))
+- return nla_parse_nested(tb, maxtype,
+- nla_data(nla) + NLA_ALIGN(len),
+- policy);
++ if (nested_len >= nla_attr_size(0))
++ return nla_parse(tb, maxtype, nla_data(nla) + NLA_ALIGN(len),
++ nested_len, policy);
+ memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
+ return 0;
+ }
+diff --git a/init/Kconfig b/init/Kconfig
+index a97924b..021476f 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -13,6 +13,7 @@ config DEFCONFIG_LIST
+ default "/lib/modules/$UNAME_RELEASE/.config"
+ default "/etc/kernel-config"
+ default "/boot/config-$UNAME_RELEASE"
++ default "$ARCH_DEFCONFIG"
+ default "arch/$ARCH/defconfig"
+
+ menu "General setup"
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index b33410a..c0bac6d 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -397,10 +397,8 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
+ if (dev->nd_net != &init_net)
+ return NOTIFY_DONE;
+
+- if (is_vlan_dev(dev)) {
++ if (is_vlan_dev(dev))
+ __vlan_device_event(dev, event);
+- goto out;
+- }
+
+ grp = __vlan_find_group(dev->ifindex);
+ if (!grp)
+diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
+index d8f2157..034aa10 100644
+--- a/net/ax25/ax25_subr.c
++++ b/net/ax25/ax25_subr.c
+@@ -64,20 +64,15 @@ void ax25_frames_acked(ax25_cb *ax25, unsigned short nr)
+
+ void ax25_requeue_frames(ax25_cb *ax25)
+ {
+- struct sk_buff *skb, *skb_prev = NULL;
++ struct sk_buff *skb;
+
+ /*
+ * Requeue all the un-ack-ed frames on the output queue to be picked
+ * up by ax25_kick called from the timer. This arrangement handles the
+ * possibility of an empty output queue.
+ */
+- while ((skb = skb_dequeue(&ax25->ack_queue)) != NULL) {
+- if (skb_prev == NULL)
+- skb_queue_head(&ax25->write_queue, skb);
+- else
+- skb_append(skb_prev, skb, &ax25->write_queue);
+- skb_prev = skb;
+- }
++ while ((skb = skb_dequeue_tail(&ax25->ack_queue)) != NULL)
++ skb_queue_head(&ax25->write_queue, skb);
+ }
+
+ /*
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index eb62558..0c2c937 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -423,8 +423,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
+
+ rfcomm_dlc_lock(d);
+ d->state = BT_CLOSED;
+- rfcomm_dlc_unlock(d);
+ d->state_change(d, err);
++ rfcomm_dlc_unlock(d);
+
+ skb_queue_purge(&d->tx_queue);
+ rfcomm_dlc_unlink(d);
+diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
+index c3f749a..c919187 100644
+--- a/net/bluetooth/rfcomm/tty.c
++++ b/net/bluetooth/rfcomm/tty.c
+@@ -566,11 +566,22 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
+ if (dlc->state == BT_CLOSED) {
+ if (!dev->tty) {
+ if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+- if (rfcomm_dev_get(dev->id) == NULL)
++ /* Drop DLC lock here to avoid deadlock
++ * 1. rfcomm_dev_get will take rfcomm_dev_lock
++ * but in rfcomm_dev_add there's lock order:
++ * rfcomm_dev_lock -> dlc lock
++ * 2. rfcomm_dev_put will deadlock if it's
++ * the last reference
++ */
++ rfcomm_dlc_unlock(dlc);
++ if (rfcomm_dev_get(dev->id) == NULL) {
++ rfcomm_dlc_lock(dlc);
+ return;
++ }
+
+ rfcomm_dev_del(dev);
+ rfcomm_dev_put(dev);
++ rfcomm_dlc_lock(dlc);
+ }
+ } else
+ tty_hangup(dev->tty);
+diff --git a/net/can/raw.c b/net/can/raw.c
+index c92cb8e..da26bbb 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (!filter)
+ return -ENOMEM;
+
+- err = copy_from_user(filter, optval, optlen);
+- if (err) {
++ if (copy_from_user(filter, optval, optlen)) {
+ kfree(filter);
+- return err;
++ return -EFAULT;
+ }
+ } else if (count == 1) {
+- err = copy_from_user(&sfilter, optval, optlen);
+- if (err)
+- return err;
++ if (copy_from_user(&sfilter, optval, optlen))
++ return -EFAULT;
+ }
+
+ lock_sock(sk);
+@@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (optlen != sizeof(err_mask))
+ return -EINVAL;
+
+- err = copy_from_user(&err_mask, optval, optlen);
+- if (err)
+- return err;
++ if (copy_from_user(&err_mask, optval, optlen))
++ return -EFAULT;
+
+ err_mask &= CAN_ERR_MASK;
+
+@@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (optlen != sizeof(ro->loopback))
+ return -EINVAL;
+
+- err = copy_from_user(&ro->loopback, optval, optlen);
++ if (copy_from_user(&ro->loopback, optval, optlen))
++ return -EFAULT;
+
+ break;
+
+@@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
+ if (optlen != sizeof(ro->recv_own_msgs))
+ return -EINVAL;
+
+- err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
++ if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
++ return -EFAULT;
+
+ break;
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 460e7f9..37ffd7a 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3132,7 +3132,7 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
+ * Load in the correct multicast list now the flags have changed.
+ */
+
+- if (dev->change_rx_flags && (dev->flags ^ flags) & IFF_MULTICAST)
++ if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
+ dev->change_rx_flags(dev, IFF_MULTICAST);
+
+ dev_set_rx_mode(dev);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 7b5e8e1..d39cf9f 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -162,7 +162,7 @@ static struct dst_ops ipv4_dst_ops = {
+ .negative_advice = ipv4_negative_advice,
+ .link_failure = ipv4_link_failure,
+ .update_pmtu = ip_rt_update_pmtu,
+- .local_out = ip_local_out,
++ .local_out = __ip_local_out,
+ .entry_size = sizeof(struct rtable),
+ .entries = ATOMIC_INIT(0),
+ };
+diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
+index 3a6be23..fde7146 100644
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -285,14 +285,12 @@ int tcp_is_cwnd_limited(const struct sock *sk, u32 in_flight)
+ if (in_flight >= tp->snd_cwnd)
+ return 1;
+
+- if (!sk_can_gso(sk))
+- return 0;
+-
+ left = tp->snd_cwnd - in_flight;
+- if (sysctl_tcp_tso_win_divisor)
+- return left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd;
+- else
+- return left <= tcp_max_burst(tp);
++ if (sk_can_gso(sk) &&
++ left * sysctl_tcp_tso_win_divisor < tp->snd_cwnd &&
++ left * tp->mss_cache < 65536)
++ return 1;
++ return left <= tcp_max_burst(tp);
+ }
+ EXPORT_SYMBOL_GPL(tcp_is_cwnd_limited);
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index bbb7d88..3180963 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -113,8 +113,6 @@ int sysctl_tcp_abc __read_mostly;
+ #define FLAG_FORWARD_PROGRESS (FLAG_ACKED|FLAG_DATA_SACKED)
+ #define FLAG_ANY_PROGRESS (FLAG_FORWARD_PROGRESS|FLAG_SND_UNA_ADVANCED)
+
+-#define IsSackFrto() (sysctl_tcp_frto == 0x2)
+-
+ #define TCP_REMNANT (TCP_FLAG_FIN|TCP_FLAG_URG|TCP_FLAG_SYN|TCP_FLAG_PSH)
+ #define TCP_HP_BITS (~(TCP_RESERVED_BITS|TCP_FLAG_PSH))
+
+@@ -1393,9 +1391,9 @@ static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
+
+ if (before(next_dup->start_seq, skip_to_seq)) {
+ skb = tcp_sacktag_skip(skb, sk, next_dup->start_seq, fack_count);
+- tcp_sacktag_walk(skb, sk, NULL,
+- next_dup->start_seq, next_dup->end_seq,
+- 1, fack_count, reord, flag);
++ skb = tcp_sacktag_walk(skb, sk, NULL,
++ next_dup->start_seq, next_dup->end_seq,
++ 1, fack_count, reord, flag);
+ }
+
+ return skb;
+@@ -1685,6 +1683,11 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
+ tp->sacked_out = 0;
+ }
+
++static int tcp_is_sackfrto(const struct tcp_sock *tp)
++{
++ return (sysctl_tcp_frto == 0x2) && !tcp_is_reno(tp);
++}
++
+ /* F-RTO can only be used if TCP has never retransmitted anything other than
+ * head (SACK enhanced variant from Appendix B of RFC4138 is more robust here)
+ */
+@@ -1701,7 +1704,7 @@ int tcp_use_frto(struct sock *sk)
+ if (icsk->icsk_mtup.probe_size)
+ return 0;
+
+- if (IsSackFrto())
++ if (tcp_is_sackfrto(tp))
+ return 1;
+
+ /* Avoid expensive walking of rexmit queue if possible */
+@@ -1791,7 +1794,7 @@ void tcp_enter_frto(struct sock *sk)
+ /* Earlier loss recovery underway (see RFC4138; Appendix B).
+ * The last condition is necessary at least in tp->frto_counter case.
+ */
+- if (IsSackFrto() && (tp->frto_counter ||
++ if (tcp_is_sackfrto(tp) && (tp->frto_counter ||
+ ((1 << icsk->icsk_ca_state) & (TCPF_CA_Recovery|TCPF_CA_Loss))) &&
+ after(tp->high_seq, tp->snd_una)) {
+ tp->frto_highmark = tp->high_seq;
+@@ -1838,9 +1841,16 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
+ TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_RETRANS;
+ }
+
+- /* Don't lost mark skbs that were fwd transmitted after RTO */
+- if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) &&
+- !after(TCP_SKB_CB(skb)->end_seq, tp->frto_highmark)) {
++ /* Marking forward transmissions that were made after RTO lost
++ * can cause unnecessary retransmissions in some scenarios,
++ * SACK blocks will mitigate that in some but not in all cases.
++ * We used to not mark them but it was causing break-ups with
++ * receivers that do only in-order receival.
++ *
++ * TODO: we could detect presence of such receiver and select
++ * different behavior per flow.
++ */
++ if (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
+ TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
+ tp->lost_out += tcp_skb_pcount(skb);
+ }
+@@ -1856,7 +1866,7 @@ static void tcp_enter_frto_loss(struct sock *sk, int allowed_segments, int flag)
+ tp->reordering = min_t(unsigned int, tp->reordering,
+ sysctl_tcp_reordering);
+ tcp_set_ca_state(sk, TCP_CA_Loss);
+- tp->high_seq = tp->frto_highmark;
++ tp->high_seq = tp->snd_nxt;
+ TCP_ECN_queue_cwr(tp);
+
+ tcp_clear_retrans_hints_partial(tp);
+@@ -2459,28 +2469,34 @@ static inline void tcp_complete_cwr(struct sock *sk)
+ tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
+ }
+
++static void tcp_try_keep_open(struct sock *sk)
++{
++ struct tcp_sock *tp = tcp_sk(sk);
++ int state = TCP_CA_Open;
++
++ if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
++ state = TCP_CA_Disorder;
++
++ if (inet_csk(sk)->icsk_ca_state != state) {
++ tcp_set_ca_state(sk, state);
++ tp->high_seq = tp->snd_nxt;
++ }
++}
++
+ static void tcp_try_to_open(struct sock *sk, int flag)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+ tcp_verify_left_out(tp);
+
+- if (tp->retrans_out == 0)
++ if (!tp->frto_counter && tp->retrans_out == 0)
+ tp->retrans_stamp = 0;
+
+ if (flag & FLAG_ECE)
+ tcp_enter_cwr(sk, 1);
+
+ if (inet_csk(sk)->icsk_ca_state != TCP_CA_CWR) {
+- int state = TCP_CA_Open;
+-
+- if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+- state = TCP_CA_Disorder;
+-
+- if (inet_csk(sk)->icsk_ca_state != state) {
+- tcp_set_ca_state(sk, state);
+- tp->high_seq = tp->snd_nxt;
+- }
++ tcp_try_keep_open(sk);
+ tcp_moderate_cwnd(tp);
+ } else {
+ tcp_cwnd_down(sk, flag);
+@@ -3110,7 +3126,7 @@ static int tcp_process_frto(struct sock *sk, int flag)
+ return 1;
+ }
+
+- if (!IsSackFrto() || tcp_is_reno(tp)) {
++ if (!tcp_is_sackfrto(tp)) {
+ /* RFC4138 shortcoming in step 2; should also have case c):
+ * ACK isn't duplicate nor advances window, e.g., opposite dir
+ * data, winupdate
+@@ -3286,8 +3302,11 @@ no_queue:
+ return 1;
+
+ old_ack:
+- if (TCP_SKB_CB(skb)->sacked)
++ if (TCP_SKB_CB(skb)->sacked) {
+ tcp_sacktag_write_queue(sk, skb, prior_snd_una);
++ if (icsk->icsk_ca_state == TCP_CA_Open)
++ tcp_try_keep_open(sk);
++ }
+
+ uninteresting_ack:
+ SOCK_DEBUG(sk, "Ack %u out of %u:%u\n", ack, tp->snd_una, tp->snd_nxt);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index d29ef79..6c3d8a1 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1836,7 +1836,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ {
+ struct tcp_sock *tp = tcp_sk(sk);
+ struct inet_connection_sock *icsk = inet_csk(sk);
+- unsigned int cur_mss = tcp_current_mss(sk, 0);
++ unsigned int cur_mss;
+ int err;
+
+ /* Inconslusive MTU probe */
+@@ -1858,6 +1858,11 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ return -ENOMEM;
+ }
+
++ if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
++ return -EHOSTUNREACH; /* Routing failure or similar. */
++
++ cur_mss = tcp_current_mss(sk, 0);
++
+ /* If receiver has shrunk his window, and skb is out of
+ * new window, do not retransmit it. The exception is the
+ * case, when window is shrunk to zero. In this case
+@@ -1884,9 +1889,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ (sysctl_tcp_retrans_collapse != 0))
+ tcp_retrans_try_collapse(sk, skb, cur_mss);
+
+- if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk))
+- return -EHOSTUNREACH; /* Routing failure or similar. */
+-
+ /* Some Solaris stacks overoptimize and ignore the FIN on a
+ * retransmit when old data is attached. So strip it off
+ * since it is cheap to do so and saves bytes on the network.
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index e8b241c..f95745f 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -105,7 +105,7 @@ static struct dst_ops ip6_dst_ops = {
+ .negative_advice = ip6_negative_advice,
+ .link_failure = ip6_link_failure,
+ .update_pmtu = ip6_rt_update_pmtu,
+- .local_out = ip6_local_out,
++ .local_out = __ip6_local_out,
+ .entry_size = sizeof(struct rt6_info),
+ .entries = ATOMIC_INIT(0),
+ };
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 5ceab25..11c42e3 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1219,7 +1219,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
+ x->sel.prefixlen_s = addr->sadb_address_prefixlen;
+ }
+
+- if (x->props.mode == XFRM_MODE_TRANSPORT)
++ if (!x->sel.family)
+ x->sel.family = x->props.family;
+
+ if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
+diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
+index c170685..7d5c263 100644
+--- a/net/mac80211/ieee80211_sta.c
++++ b/net/mac80211/ieee80211_sta.c
+@@ -2723,6 +2723,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
+ struct rate_selection ratesel;
+ u8 *pos;
+ struct ieee80211_sub_if_data *sdata;
++ union iwreq_data wrqu;
+
+ /* Remove possible STA entries from other IBSS networks. */
+ sta_info_flush(local, NULL);
+@@ -2863,6 +2864,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
+
+ ieee80211_rx_bss_put(dev, bss);
+
++ memset(&wrqu, 0, sizeof(wrqu));
++ memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
++ wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
++
+ return res;
+ }
+
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 0fbedca..855c33c 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -220,7 +220,7 @@ replay:
+ tp = kzalloc(sizeof(*tp), GFP_KERNEL);
+ if (tp == NULL)
+ goto errout;
+- err = -EINVAL;
++ err = -ENOENT;
+ tp_ops = tcf_proto_lookup_ops(tca[TCA_KIND]);
+ if (tp_ops == NULL) {
+ #ifdef CONFIG_KMOD
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index 9a9b977..d0330d8 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -1817,13 +1817,6 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ }
+ emu->port = pci_resource_start(pci, 0);
+
+- if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
+- "EMU10K1", emu)) {
+- err = -EBUSY;
+- goto error;
+- }
+- emu->irq = pci->irq;
+-
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+ 32 * 1024, &emu->ptb_pages) < 0) {
+@@ -1886,6 +1879,14 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ emu->fx8010.etram_pages.area = NULL;
+ emu->fx8010.etram_pages.bytes = 0;
+
++ /* irq handler must be registered after I/O ports are activated */
++ if (request_irq(pci->irq, snd_emu10k1_interrupt, IRQF_SHARED,
++ "EMU10K1", emu)) {
++ err = -EBUSY;
++ goto error;
++ }
++ emu->irq = pci->irq;
++
+ /*
+ * Init to 0x02109204 :
+ * Clock accuracy = 0 (1000ppm)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 33282f9..52a7f0f 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -940,7 +940,6 @@ do_sku:
+ AC_VERB_SET_UNSOLICITED_ENABLE,
+ AC_USRSP_EN | ALC880_HP_EVENT);
+ spec->unsol_event = alc_sku_unsol_event;
+- spec->init_hook = alc_sku_automute;
+ }
+
+ /*
Added: dists/sid/linux-2.6/debian/patches/series/6
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/series/6 Tue Jun 17 13:39:29 2008
@@ -0,0 +1 @@
++ bugfix/all/stable/2.6.25.7.patch
More information about the Kernel-svn-changes
mailing list