50 files changed, 250 insertions, 207 deletions
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index cd9cec9e39e9..6bfbbed0897e 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -6,7 +6,7 @@ extra-y		:= head.o init_task.o vmlinux.lds
 obj-y           += cpu-probe.o branch.o entry.o genex.o irq.o process.o \
                   ptrace.o reset.o semaphore.o setup.o signal.o syscall.o \
-                   time.o traps.o unaligned.o
+                   time.o topology.o traps.o unaligned.o
 binfmt_irix-objs        := irixelf.o irixinv.o irixioctl.o irixsig.o    \
                           irix5sys.o sysirix.o
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index db80957ada89..49db516789e0 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -463,28 +463,5 @@ void flush_tlb_one(unsigned long vaddr)
        smp_on_each_tlb(flush_tlb_one_ipi, (void *) vaddr);
 }
-static DEFINE_PER_CPU(struct cpu, cpu_devices);
-static int __init topology_init(void)
-{
-        int i, ret;
-#ifdef CONFIG_NUMA
-        for_each_online_node(i)
-                register_one_node(i);
-#endif /* CONFIG_NUMA */
-        for_each_present_cpu(i) {
-                ret = register_cpu(&per_cpu(cpu_devices, i), i);
-                if (ret)
-                        printk(KERN_WARNING "topology_init: register_cpu %d "
-                               "failed (%d)\n", i, ret);
-        }
-        return 0;
-}
-subsys_initcall(topology_init);
 EXPORT_SYMBOL(flush_tlb_page);
 EXPORT_SYMBOL(flush_tlb_one);
diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c
new file mode 100644
index 000000000000..660e44ed44d7
--- /dev/null
+++ b/arch/mips/kernel/topology.c
@@ -0,0 +1,29 @@
+#include <linux/cpu.h>
+#include <linux/cpumask.h>
+#include <linux/init.h>
+#include <linux/node.h>
+#include <linux/nodemask.h>
+#include <linux/percpu.h>
+static DEFINE_PER_CPU(struct cpu, cpu_devices);
+static int __init topology_init(void)
+{
+        int i, ret;
+#ifdef CONFIG_NUMA
+        for_each_online_node(i)
+                register_one_node(i);
+#endif /* CONFIG_NUMA */
+        for_each_present_cpu(i) {
+                ret = register_cpu(&per_cpu(cpu_devices, i), i);
+                if (ret)
+                        printk(KERN_WARNING "topology_init: register_cpu %d "
+                               "failed (%d)\n", i, ret);
+        }
+        return 0;
+}
+subsys_initcall(topology_init);
diff --git a/arch/mips/mips-boards/malta/malta_setup.c b/arch/mips/mips-boards/malta/malta_setup.c
index ab460f805bef..282f3e52eea3 100644
--- a/arch/mips/mips-boards/malta/malta_setup.c
+++ b/arch/mips/mips-boards/malta/malta_setup.c
@@ -159,7 +159,7 @@ void __init plat_mem_setup(void)
                                BONITO_PCIMEMBASECFG |=
                                        (BONITO_PCIMEMBASECFG_MEMBASE0_CACHED |
                                         BONITO_PCIMEMBASECFG_MEMBASE1_CACHED);
-                                printk("Disabled Bonito IOBC coherency\n");
+                                printk("Enabled Bonito IOBC coherency\n");
                        }
                }
                else
diff --git a/arch/x86_64/kernel/early_printk.c b/arch/x86_64/kernel/early_printk.c
index e22ecd54870d..47b6d90349da 100644
--- a/arch/x86_64/kernel/early_printk.c
+++ b/arch/x86_64/kernel/early_printk.c
@@ -224,7 +224,7 @@ static int __init setup_early_printk(char *buf)
                return 0;
        early_console_initialized = 1;
-        if (!strcmp(buf,"keep"))
+        if (strstr(buf, "keep"))
                keep_early = 1;
        if (!strncmp(buf, "serial", 6)) {
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 14654e682411..c80081a6ba41 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -754,10 +754,8 @@ void __setup_vector_irq(int cpu)
 {
        /* Initialize vector_irq on a new cpu */
        /* This function must be called with vector_lock held */
-        unsigned long flags;
        int irq, vector;
        /* Mark the inuse vectors */
        for (irq = 0; irq < NR_IRQ_VECTORS; ++irq) {
                if (!cpu_isset(cpu, irq_domain[irq]))
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index a153d0a01b72..0d65b22f229c 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -242,12 +242,19 @@ static int dump_trace_unwind(struct unwind_frame_info *info, void *context)
 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
 */
+static inline int valid_stack_ptr(struct thread_info *tinfo, void *p)
+{
+        void *t = (void *)tinfo;
+        return p > t && p < t + THREAD_SIZE - 3;
+}
 void dump_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * stack,
                struct stacktrace_ops *ops, void *data)
 {
        const unsigned cpu = smp_processor_id();
        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
        unsigned used = 0;
+        struct thread_info *tinfo;
        if (!tsk)
                tsk = current;
@@ -370,7 +377,8 @@ void dump_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * s
        /*
         * This handles the process stack:
         */
-        HANDLE_STACK (((long) stack & (THREAD_SIZE-1)) != 0);
+        tinfo = current_thread_info();
+        HANDLE_STACK (valid_stack_ptr(tinfo, stack));
 #undef HANDLE_STACK
 }
 EXPORT_SYMBOL(dump_trace);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 234197e57e9e..f510e1196dc6 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -314,6 +314,17 @@ static const struct pci_device_id ahci_pci_tbl[] = {
        { PCI_VDEVICE(INTEL, 0x2824), board_ahci }, /* ICH8 */
        { PCI_VDEVICE(INTEL, 0x2829), board_ahci }, /* ICH8M */
        { PCI_VDEVICE(INTEL, 0x282a), board_ahci }, /* ICH8M */
+        { PCI_VDEVICE(INTEL, 0x2922), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x2923), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x2924), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x2925), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x2927), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x2929), board_ahci }, /* ICH9M */
+        { PCI_VDEVICE(INTEL, 0x292a), board_ahci }, /* ICH9M */
+        { PCI_VDEVICE(INTEL, 0x292b), board_ahci }, /* ICH9M */
+        { PCI_VDEVICE(INTEL, 0x292f), board_ahci }, /* ICH9M */
+        { PCI_VDEVICE(INTEL, 0x294d), board_ahci }, /* ICH9 */
+        { PCI_VDEVICE(INTEL, 0x294e), board_ahci }, /* ICH9M */
        /* JMicron */
        { PCI_VDEVICE(JMICRON, 0x2360), board_ahci }, /* JMicron JMB360 */
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 5c1fc467fc7f..47ea111d5ace 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1451,6 +1451,7 @@ nothing_to_do:
 static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
 {
+        struct ata_port *ap = qc->ap;
        struct scsi_cmnd *cmd = qc->scsicmd;
        u8 *cdb = cmd->cmnd;
        int need_sense = (qc->err_mask != 0);
@@ -1459,11 +1460,12 @@ static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
         * schedule EH_REVALIDATE operation to update the IDENTIFY DEVICE
         * cache
         */
-        if (!need_sense && (qc->tf.command == ATA_CMD_SET_FEATURES) &&
+        if (ap->ops->error_handler &&
+            !need_sense && (qc->tf.command == ATA_CMD_SET_FEATURES) &&
            ((qc->tf.feature == SETFEATURES_WC_ON) ||
             (qc->tf.feature == SETFEATURES_WC_OFF))) {
-                qc->ap->eh_info.action |= ATA_EH_REVALIDATE;
+                ap->eh_info.action |= ATA_EH_REVALIDATE;
-                ata_port_schedule_eh(qc->ap);
+                ata_port_schedule_eh(ap);
        }
        /* For ATA pass thru (SAT) commands, generate a sense block if
@@ -1490,8 +1492,8 @@ static void ata_scsi_qc_complete(struct ata_queued_cmd *qc)
                }
        }
-        if (need_sense && !qc->ap->ops->error_handler)
+        if (need_sense && !ap->ops->error_handler)
-                ata_dump_status(qc->ap->id, &qc->result_tf);
+                ata_dump_status(ap->id, &qc->result_tf);
        qc->scsidone(cmd);
@@ -3345,20 +3347,23 @@ EXPORT_SYMBOL_GPL(ata_sas_slave_configure);
 *      @ap:    ATA port to which the command is being sent
 *
 *      RETURNS:
- *      Zero.
+ *      Return value from __ata_scsi_queuecmd() if @cmd can be queued,
+ *      0 otherwise.
 */
 int ata_sas_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *),
                     struct ata_port *ap)
 {
+        int rc = 0;
        ata_scsi_dump_cdb(ap, cmd);
        if (likely(ata_scsi_dev_enabled(ap->device)))
-                __ata_scsi_queuecmd(cmd, done, ap->device);
+                rc = __ata_scsi_queuecmd(cmd, done, ap->device);
        else {
                cmd->result = (DID_BAD_TARGET << 16);
                done(cmd);
        }
-        return 0;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(ata_sas_queuecmd);
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 53304e6991ac..a2ab2eebfc68 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -348,7 +348,7 @@ static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wra
 static void dvb_frontend_swzigzag(struct dvb_frontend *fe)
 {
-        fe_status_t s;
+        fe_status_t s = 0;
        struct dvb_frontend_private *fepriv = fe->frontend_priv;
        /* if we've got no parameters, just keep idling */
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index 7456b0b9976b..4c27a2d90a38 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -441,6 +441,10 @@ static int tda10086_get_frontend(struct dvb_frontend* fe, struct dvb_frontend_pa
        dprintk ("%s\n", __FUNCTION__);
+        // check for invalid symbol rate
+        if (fe_params->u.qpsk.symbol_rate < 500000)
+                return -EINVAL;
        // calculate the updated frequency (note: we convert from Hz->kHz)
        tmp64 = tda10086_read_byte(state, 0x52);
        tmp64 |= (tda10086_read_byte(state, 0x51) << 8);
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index e58f0391e9d1..56f1c80defc6 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -46,6 +46,10 @@
 #include "lnbp21.h"
 #include "bsru6.h"
+static int diseqc_method;
+module_param(diseqc_method, int, 0444);
+MODULE_PARM_DESC(diseqc_method, "Select DiSEqC method for subsystem id 13c2:1003, 0: default, 1: more reliable (for newer revisions only)");
 static void Set22K (struct budget *budget, int state)
 {
        struct saa7146_dev *dev=budget->dev;
@@ -382,6 +386,11 @@ static void frontend_init(struct budget *budget)
                if (budget->dvb_frontend) {
                        budget->dvb_frontend->ops.tuner_ops.set_params = alps_bsru6_tuner_set_params;
                        budget->dvb_frontend->tuner_priv = &budget->i2c_adap;
+                        if (budget->dev->pci->subsystem_device == 0x1003 && diseqc_method == 0) {
+                                budget->dvb_frontend->ops.diseqc_send_master_cmd = budget_diseqc_send_master_cmd;
+                                budget->dvb_frontend->ops.diseqc_send_burst = budget_diseqc_send_burst;
+                                budget->dvb_frontend->ops.set_tone = budget_set_tone;
+                        }
                        break;
                }
                break;
diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c
index f786ab11d2cd..86e353b26b53 100644
--- a/drivers/media/video/et61x251/et61x251_core.c
+++ b/drivers/media/video/et61x251/et61x251_core.c
@@ -1182,8 +1182,6 @@ static void et61x251_release_resources(struct et61x251_device* cam)
        video_set_drvdata(cam->v4ldev, NULL);
        video_unregister_device(cam->v4ldev);
-        usb_put_dev(cam->usbdev);
        mutex_unlock(&et61x251_sysfs_lock);
        kfree(cam->control_buffer);
@@ -1275,6 +1273,7 @@ static int et61x251_release(struct inode* inode, struct file* filp)
        if (cam->state & DEV_DISCONNECTED) {
                et61x251_release_resources(cam);
+                usb_put_dev(cam->usbdev);
                mutex_unlock(&cam->dev_mutex);
                kfree(cam);
                return 0;
diff --git a/drivers/media/video/saa6588.c b/drivers/media/video/saa6588.c
index a81285ca7d5b..7b9859c33018 100644
--- a/drivers/media/video/saa6588.c
+++ b/drivers/media/video/saa6588.c
@@ -212,8 +212,10 @@ static void read_from_buf(struct saa6588 *s, struct rds_command *a)
        if (rd_blocks > s->block_count)
                rd_blocks = s->block_count;
-        if (!rd_blocks)
+        if (!rd_blocks) {
+                spin_unlock_irqrestore(&s->lock, flags);
                return;
+        }
        for (i = 0; i < rd_blocks; i++) {
                if (block_to_user_buf(s, buf_ptr)) {
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index c5719f7bd1ac..f28398dd9d93 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -1464,8 +1464,6 @@ static int saa711x_attach(struct i2c_adapter *adapter, int address, int kind)
        client->driver = &i2c_driver_saa711x;
        snprintf(client->name, sizeof(client->name) - 1, "saa7115");
-        v4l_dbg(1, debug, client, "detecting saa7115 client on address 0x%x\n", address << 1);
        for (i=0;i<0x0f;i++) {
                saa711x_write(client, 0, i);
                name[i] = (saa711x_read(client, 0) &0x0f) +'0';
@@ -1477,6 +1475,13 @@ static int saa711x_attach(struct i2c_adapter *adapter, int address, int kind)
        saa711x_write(client, 0, 5);
        chip_id = saa711x_read(client, 0) & 0x0f;
+        /* Check whether this chip is part of the saa711x series */
+        if (memcmp(name, "1f711", 5)) {
+                v4l_dbg(1, debug, client, "chip found @ 0x%x (ID %s) does not match a known saa711x chip.\n",
+                        address << 1, name);
+                return 0;
+        }
        snprintf(client->name, sizeof(client->name) - 1, "saa711%d",chip_id);
        v4l_info(client, "saa711%d found (%s) @ 0x%x (%s)\n", chip_id, name, address << 1, adapter->name);
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index a4702d3c2aca..42fb60d985b9 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1462,8 +1462,6 @@ static void sn9c102_release_resources(struct sn9c102_device* cam)
        video_set_drvdata(cam->v4ldev, NULL);
        video_unregister_device(cam->v4ldev);
-        usb_put_dev(cam->usbdev);
        mutex_unlock(&sn9c102_sysfs_lock);
        kfree(cam->control_buffer);
@@ -1555,6 +1553,7 @@ static int sn9c102_release(struct inode* inode, struct file* filp)
        if (cam->state & DEV_DISCONNECTED) {
                sn9c102_release_resources(cam);
+                usb_put_dev(cam->usbdev);
                mutex_unlock(&cam->dev_mutex);
                kfree(cam);
                return 0;
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 7ea49a0d5ec3..296159ec5189 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -1087,7 +1087,7 @@ static int inval_cache_and_wait_for_operation(
                }
                spin_lock(chip->mutex);
-                if (chip->state != chip_state) {
+                while (chip->state != chip_state) {
                        /* Someone's suspended the operation: sleep */
                        DECLARE_WAITQUEUE(wait, current);
                        set_current_state(TASK_UNINTERRUPTIBLE);
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 86b3bb9bec2d..92420f007b97 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -914,7 +914,7 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
                                        printk(KERN_DEBUG "6pack: protocol violation\n");
                                else
                                        sp->status = 0;
-                                cmd &= !SIXP_RX_DCD_MASK;
+                                cmd &= ~SIXP_RX_DCD_MASK;
                }
                sp->status = cmd & SIXP_PRIO_DATA_MASK;
        } else { /* output watchdog char if idle */
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index 136175a69332..f63a7755fe86 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -820,7 +820,8 @@ int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
        crypt_stat->tfm = crypto_alloc_blkcipher(full_alg_name, 0,
                                                 CRYPTO_ALG_ASYNC);
        kfree(full_alg_name);
-        if (!crypt_stat->tfm) {
+        if (IS_ERR(crypt_stat->tfm)) {
+                rc = PTR_ERR(crypt_stat->tfm);
                ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
                                "Error initializing cipher [%s]\n",
                                crypt_stat->cipher);
diff --git a/include/asm-i386/mach-summit/mach_apic.h b/include/asm-i386/mach-summit/mach_apic.h
index ef0671e5d5c5..43e5bd8f4a19 100644
--- a/include/asm-i386/mach-summit/mach_apic.h
+++ b/include/asm-i386/mach-summit/mach_apic.h
@@ -88,7 +88,11 @@ static inline void clustered_apic_check(void)
 static inline int apicid_to_node(int logical_apicid)
 {
+#ifdef CONFIG_SMP
        return apicid_2_node[hard_smp_processor_id()];
+#else
+        return 0;
+#endif
 }
 /* Mapping from cpu number to logical apicid */
diff --git a/include/asm-parisc/semaphore.h b/include/asm-parisc/semaphore.h
index c9ee41cd0707..d45827a21f94 100644
--- a/include/asm-parisc/semaphore.h
+++ b/include/asm-parisc/semaphore.h
@@ -115,7 +115,8 @@ extern __inline__ int down_interruptible(struct semaphore * sem)
 */
 extern __inline__ int down_trylock(struct semaphore * sem)
 {
-        int flags, count;
+        unsigned long flags;
+        int count;
        spin_lock_irqsave(&sem->sentry, flags);
        count = sem->count - 1;
@@ -131,7 +132,8 @@ extern __inline__ int down_trylock(struct semaphore * sem)
 */
 extern __inline__ void up(struct semaphore * sem)
 {
-        int flags;
+        unsigned long flags;
        spin_lock_irqsave(&sem->sentry, flags);
        if (sem->count < 0) {
                __up(sem);
diff --git a/include/linux/irqflags.h b/include/linux/irqflags.h
index 4fe740bf4eae..412e025bc5c7 100644
--- a/include/linux/irqflags.h
+++ b/include/linux/irqflags.h
@@ -11,12 +11,6 @@
 #ifndef _LINUX_TRACE_IRQFLAGS_H
 #define _LINUX_TRACE_IRQFLAGS_H
-#define BUILD_CHECK_IRQ_FLAGS(flags)                                    \
-        do {                                                            \
-                BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));   \
-                typecheck(unsigned long, flags);                        \
-        } while (0)
 #ifdef CONFIG_TRACE_IRQFLAGS
  extern void trace_hardirqs_on(void);
  extern void trace_hardirqs_off(void);
@@ -56,15 +50,10 @@
 #define local_irq_disable() \
        do { raw_local_irq_disable(); trace_hardirqs_off(); } while (0)
 #define local_irq_save(flags) \
-        do {                                    \
+        do { raw_local_irq_save(flags); trace_hardirqs_off(); } while (0)
-                BUILD_CHECK_IRQ_FLAGS(flags);   \
-                raw_local_irq_save(flags);      \
-                trace_hardirqs_off();           \
-        } while (0)
 #define local_irq_restore(flags)                                \
        do {                                                    \
-                BUILD_CHECK_IRQ_FLAGS(flags);                   \
                if (raw_irqs_disabled_flags(flags)) {           \
                        raw_local_irq_restore(flags);           \
                        trace_hardirqs_off();                   \
@@ -80,16 +69,8 @@
 */
 # define raw_local_irq_disable()        local_irq_disable()
 # define raw_local_irq_enable()         local_irq_enable()
-# define raw_local_irq_save(flags)              \
+# define raw_local_irq_save(flags)      local_irq_save(flags)
-        do {                                    \
+# define raw_local_irq_restore(flags)   local_irq_restore(flags)
-                BUILD_CHECK_IRQ_FLAGS(flags);   \
-                local_irq_save(flags);          \
-        } while (0)
-# define raw_local_irq_restore(flags)           \
-        do {                                    \
-                BUILD_CHECK_IRQ_FLAGS(flags);   \
-                local_irq_restore(flags);       \
-        } while (0)
 #endif /* CONFIG_TRACE_IRQFLAGS_SUPPORT */
 #ifdef CONFIG_TRACE_IRQFLAGS_SUPPORT
@@ -99,11 +80,7 @@
                raw_safe_halt();                                \
        } while (0)
-#define local_save_flags(flags)                 \
+#define local_save_flags(flags)         raw_local_save_flags(flags)
-        do {                                    \
-                BUILD_CHECK_IRQ_FLAGS(flags);   \
-                raw_local_save_flags(flags);    \
-        } while (0)
 #define irqs_disabled()                                         \
 ({                                                              \
@@ -113,11 +90,7 @@
        raw_irqs_disabled_flags(flags);                         \
 })
-#define irqs_disabled_flags(flags)      \
+#define irqs_disabled_flags(flags)      raw_irqs_disabled_flags(flags)
-({                                      \
-        BUILD_CHECK_IRQ_FLAGS(flags);   \
-        raw_irqs_disabled_flags(flags); \
-})
 #endif          /* CONFIG_X86 */
 #endif
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 24b611147adb..b9b5e4ba166a 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -30,8 +30,10 @@ extern const char linux_banner[];
 #define STACK_MAGIC     0xdeadbeef
+#define ALIGN(x,a)              __ALIGN_MASK(x,(typeof(x))(a)-1)
+#define __ALIGN_MASK(x,mask)    (((x)+(mask))&~(mask))
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
-#define ALIGN(x,a) (((x)+(a)-1UL)&~((a)-1UL))
 #define FIELD_SIZEOF(t, f) (sizeof(((t*)0)->f))
 #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
 #define roundup(x, y) ((((x) + ((y) - 1)) / (y)) * (y))
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9264139bd8df..83b8c4f1d69d 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -93,8 +93,10 @@ struct netpoll_info;
 #endif
 #endif
-#if !defined(CONFIG_NET_IPIP) && \
+#if !defined(CONFIG_NET_IPIP) && !defined(CONFIG_NET_IPIP_MODULE) && \
-    !defined(CONFIG_IPV6) && !defined(CONFIG_IPV6_MODULE)
+    !defined(CONFIG_NET_IPGRE) &&  !defined(CONFIG_NET_IPGRE_MODULE) && \
+    !defined(CONFIG_IPV6_SIT) && !defined(CONFIG_IPV6_SIT_MODULE) && \
+    !defined(CONFIG_IPV6_TUNNEL) && !defined(CONFIG_IPV6_TUNNEL_MODULE)
 #define MAX_HEADER LL_MAX_HEADER
 #else
 #define MAX_HEADER (LL_MAX_HEADER + 48)
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 57f670d78f7c..8451052ca66f 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -52,7 +52,6 @@
 #include <linux/thread_info.h>
 #include <linux/kernel.h>
 #include <linux/stringify.h>
-#include <linux/irqflags.h>
 #include <asm/system.h>
@@ -184,52 +183,24 @@ do {								\
 #define read_lock(lock)                 _read_lock(lock)
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
-#define spin_lock_irqsave(lock, flags)                  \
-        do {                                            \
+#define spin_lock_irqsave(lock, flags)  flags = _spin_lock_irqsave(lock)
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
+#define read_lock_irqsave(lock, flags)  flags = _read_lock_irqsave(lock)
-                flags = _spin_lock_irqsave(lock);       \
+#define write_lock_irqsave(lock, flags) flags = _write_lock_irqsave(lock)
-        } while (0)
-#define read_lock_irqsave(lock, flags)                  \
-        do {                                            \
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                flags = _read_lock_irqsave(lock);       \
-        } while (0)
-#define write_lock_irqsave(lock, flags)                 \
-        do {                                            \
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                flags = _write_lock_irqsave(lock);      \
-        } while (0)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
-#define spin_lock_irqsave_nested(lock, flags, subclass)                 \
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
-        do {                                                            \
+        flags = _spin_lock_irqsave_nested(lock, subclass)
-                BUILD_CHECK_IRQ_FLAGS(flags);                           \
-                flags = _spin_lock_irqsave_nested(lock, subclass);      \
-        } while (0)
 #else
-#define spin_lock_irqsave_nested(lock, flags, subclass)                 \
+#define spin_lock_irqsave_nested(lock, flags, subclass) \
-        do {                                                            \
+        flags = _spin_lock_irqsave(lock)
-                BUILD_CHECK_IRQ_FLAGS(flags);                           \
-                flags = _spin_lock_irqsave(lock);                       \
-        } while (0)
 #endif
 #else
-#define spin_lock_irqsave(lock, flags)                  \
-        do {                                            \
+#define spin_lock_irqsave(lock, flags)  _spin_lock_irqsave(lock, flags)
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
+#define read_lock_irqsave(lock, flags)  _read_lock_irqsave(lock, flags)
-                _spin_lock_irqsave(lock, flags);        \
+#define write_lock_irqsave(lock, flags) _write_lock_irqsave(lock, flags)
-        } while (0)
-#define read_lock_irqsave(lock, flags)                  \
-        do {                                            \
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                _read_lock_irqsave(lock, flags);        \
-        } while (0)
-#define write_lock_irqsave(lock, flags)                 \
-        do {                                            \
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                _write_lock_irqsave(lock, flags);       \
-        } while (0)
 #define spin_lock_irqsave_nested(lock, flags, subclass) \
        spin_lock_irqsave(lock, flags)
@@ -268,24 +239,15 @@ do {								\
 #endif
 #define spin_unlock_irqrestore(lock, flags) \
-        do {                                            \
+                                        _spin_unlock_irqrestore(lock, flags)
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                _spin_unlock_irqrestore(lock, flags);   \
-        } while (0)
 #define spin_unlock_bh(lock)            _spin_unlock_bh(lock)
 #define read_unlock_irqrestore(lock, flags) \
-        do {                                            \
+                                        _read_unlock_irqrestore(lock, flags)
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                _read_unlock_irqrestore(lock, flags);   \
-        } while (0)
 #define read_unlock_bh(lock)            _read_unlock_bh(lock)
 #define write_unlock_irqrestore(lock, flags) \
-        do {                                            \
+                                        _write_unlock_irqrestore(lock, flags)
-                BUILD_CHECK_IRQ_FLAGS(flags);           \
-                _write_unlock_irqrestore(lock, flags);  \
-        } while (0)
 #define write_unlock_bh(lock)           _write_unlock_bh(lock)
 #define spin_trylock_bh(lock)   __cond_lock(lock, _spin_trylock_bh(lock))
@@ -299,7 +261,6 @@ do {								\
 #define spin_trylock_irqsave(lock, flags) \
 ({ \
-        BUILD_CHECK_IRQ_FLAGS(flags); \
        local_irq_save(flags); \
        spin_trylock(lock) ? \
        1 : ({ local_irq_restore(flags); 0; }); \
diff --git a/include/net/sock.h b/include/net/sock.h
index ac286a353032..9cdbae2a53a3 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -883,18 +883,23 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 }
 /**
- *      sk_filter_release: Release a socket filter
+ *      sk_filter_rcu_free: Free a socket filter
- *      @rcu: rcu_head that contains the sk_filter info to remove
+ *      @rcu: rcu_head that contains the sk_filter to free
- *
- *      Remove a filter from a socket and release its resources.
 */
- 
 static inline void sk_filter_rcu_free(struct rcu_head *rcu)
 {
        struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
        kfree(fp);
 }
+/**
+ *      sk_filter_release: Release a socket filter
+ *      @sk: socket
+ *      @fp: filter to remove
+ *
+ *      Remove a filter from a socket and release its resources.
+ */
 static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
 {
        unsigned int size = sk_filter_len(fp);
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index 9582e8401669..1d77b63c5ea4 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -35,6 +35,7 @@
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_cmnd.h>
 #include <scsi/scsi_transport_sas.h>
+#include <asm/scatterlist.h>
 struct block_device;
diff --git a/include/sound/version.h b/include/sound/version.h
index 52fd6879b86e..17137f3a3b6f 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.13"
-#define CONFIG_SND_DATE " (Sun Oct 22 08:56:16 2006 UTC)"
+#define CONFIG_SND_DATE " (Tue Nov 28 14:07:24 2006 UTC)"
diff --git a/kernel/kmod.c b/kernel/kmod.c
index bb4e29d924e4..2b76dee28496 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -307,14 +307,14 @@ int call_usermodehelper_pipe(char *path, char **argv, char **envp,
                return 0;
        f = create_write_pipe();
-        if (!f)
+        if (IS_ERR(f))
-                return -ENOMEM;
+                return PTR_ERR(f);
        *filp = f;
        f = create_read_pipe(f);
-        if (!f) {
+        if (IS_ERR(f)) {
                free_write_pipe(*filp);
-                return -ENOMEM;
+                return PTR_ERR(f);
        }
        sub_info.stdin = f;
diff --git a/kernel/unwind.c b/kernel/unwind.c
index f7e50d16dbf6..ed0a21d4a902 100644
--- a/kernel/unwind.c
+++ b/kernel/unwind.c
@@ -938,8 +938,11 @@ int unwind(struct unwind_frame_info *frame)
                else {
                        retAddrReg = state.version <= 1 ? *ptr++ : get_uleb128(&ptr, end);
                        /* skip augmentation */
-                        if (((const char *)(cie + 2))[1] == 'z')
+                        if (((const char *)(cie + 2))[1] == 'z') {
-                                ptr += get_uleb128(&ptr, end);
+                                uleb128_t augSize = get_uleb128(&ptr, end);
+                                ptr += augSize;
+                        }
                        if (ptr > end
                           || retAddrReg >= ARRAY_SIZE(reg_info)
                           || REG_INVALID(retAddrReg)
@@ -963,9 +966,7 @@ int unwind(struct unwind_frame_info *frame)
        if (cie == NULL || fde == NULL) {
 #ifdef CONFIG_FRAME_POINTER
                unsigned long top, bottom;
-#endif
-#ifdef CONFIG_FRAME_POINTER
                top = STACK_TOP(frame->task);
                bottom = STACK_BOTTOM(frame->task);
 # if FRAME_RETADDR_OFFSET < 0
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 4e4119a12139..4c61a7e0a86e 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -58,12 +58,13 @@ static int get_fdb_entries(struct net_bridge *br, void __user *userbuf,
 {
        int num;
        void *buf;
-        size_t size = maxnum * sizeof(struct __fdb_entry);
+        size_t size;
-        if (size > PAGE_SIZE) {
+        /* Clamp size to PAGE_SIZE, test maxnum to avoid overflow */
-                size = PAGE_SIZE;
+        if (maxnum > PAGE_SIZE/sizeof(struct __fdb_entry))
                maxnum = PAGE_SIZE/sizeof(struct __fdb_entry);
-        }
+        size = maxnum * sizeof(struct __fdb_entry);
        buf = kmalloc(size, GFP_USER);
        if (!buf)
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 146496fce2e2..fded1493c1dc 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -160,6 +160,8 @@ static __init int dccpprobe_init(void)
        init_waitqueue_head(&dccpw.wait);
        spin_lock_init(&dccpw.lock);
        dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
+        if (IS_ERR(dccpw.fifo))
+                return PTR_ERR(dccpw.fifo);
        if (!proc_net_fops_create(procname, S_IRUSR, &dccpprobe_fops))
                goto err0;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 143c4668538b..8b848aa77bfc 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -225,10 +225,8 @@ __ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
        struct ip_conntrack_expect *i;
        
        list_for_each_entry(i, &ip_conntrack_expect_list, list) {
-                if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
+                if (ip_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
-                        atomic_inc(&i->use);
                        return i;
-                }
        }
        return NULL;
 }
@@ -241,6 +239,8 @@ ip_conntrack_expect_find(const struct ip_conntrack_tuple *tuple)
        
        read_lock_bh(&ip_conntrack_lock);
        i = __ip_conntrack_expect_find(tuple);
+        if (i)
+                atomic_inc(&i->use);
        read_unlock_bh(&ip_conntrack_lock);
        return i;
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 7b7441202bfd..6cb9070cd0bc 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1417,7 +1417,7 @@ static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
                DEBUGP
                    ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
                     info->timeout);
-                ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
+                ip_ct_refresh(ct, *pskb, info->timeout * HZ);
                /* Set expect timeout */
                read_lock_bh(&ip_conntrack_lock);
@@ -1465,7 +1465,7 @@ static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
        info->sig_port[!dir] = 0;
        /* Give it 30 seconds for UCF or URJ */
-        ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
+        ip_ct_refresh(ct, *pskb, 30 * HZ);
        return 0;
 }
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 262d0d44ec1b..55f0ae641081 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -153,6 +153,7 @@ ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct ip_conntrack *ct)
        return ret;
 nfattr_failure:
+        ip_conntrack_proto_put(proto);
        return -1;
 }
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index ad0312d0e4fd..264763adc39b 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -114,6 +114,14 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        tcph->window = 0;
        tcph->urg_ptr = 0;
+        /* Adjust TCP checksum */
+        tcph->check = 0;
+        tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
+                                   nskb->nh.iph->saddr,
+                                   nskb->nh.iph->daddr,
+                                   csum_partial((char *)tcph,
+                                                sizeof(struct tcphdr), 0));
        /* Set DF, id = 0 */
        nskb->nh.iph->frag_off = htons(IP_DF);
        nskb->nh.iph->id = 0;
@@ -129,14 +137,8 @@ static void send_reset(struct sk_buff *oldskb, int hook)
        if (ip_route_me_harder(&nskb, addr_type))
                goto free_nskb;
-        /* Adjust TCP checksum */
        nskb->ip_summed = CHECKSUM_NONE;
-        tcph->check = 0;
-        tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
-                                   nskb->nh.iph->saddr,
-                                   nskb->nh.iph->daddr,
-                                   csum_partial((char *)tcph,
-                                                sizeof(struct tcphdr), 0));
        /* Adjust IP TTL */
        nskb->nh.iph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 4be336f17883..f230eeecf092 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -156,6 +156,8 @@ static __init int tcpprobe_init(void)
        init_waitqueue_head(&tcpw.wait);
        spin_lock_init(&tcpw.lock);
        tcpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &tcpw.lock);
+        if (IS_ERR(tcpw.fifo))
+                return PTR_ERR(tcpw.fifo);
        if (!proc_net_fops_create(procname, S_IRUSR, &tcpprobe_fops))
                goto err0;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 865d75214a9a..9e1bd374875e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -928,23 +928,32 @@ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
        return 1; 
 #else
        struct udp_sock *up = udp_sk(sk);
-        struct udphdr *uh = skb->h.uh;
+        struct udphdr *uh;
        struct iphdr *iph;
        int iphlen, len;
  
-        __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
+        __u8 *udpdata;
-        __be32 *udpdata32 = (__be32 *)udpdata;
+        __be32 *udpdata32;
        __u16 encap_type = up->encap_type;
        /* if we're overly short, let UDP handle it */
-        if (udpdata > skb->tail)
+        len = skb->len - sizeof(struct udphdr);
+        if (len <= 0)
                return 1;
        /* if this is not encapsulated socket, then just return now */
        if (!encap_type)
                return 1;
-        len = skb->tail - udpdata;
+        /* If this is a paged skb, make sure we pull up
+         * whatever data we need to look at. */
+        if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
+                return 1;
+        /* Now we can get the pointers */
+        uh = skb->h.uh;
+        udpdata = (__u8 *)uh + sizeof(struct udphdr);
+        udpdata32 = (__be32 *)udpdata;
        switch (encap_type) {
        default:
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 836541e509fe..de0567b1f422 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -469,10 +469,8 @@ __nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple)
        struct nf_conntrack_expect *i;
        
        list_for_each_entry(i, &nf_conntrack_expect_list, list) {
-                if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask)) {
+                if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
-                        atomic_inc(&i->use);
                        return i;
-                }
        }
        return NULL;
 }
@@ -485,6 +483,8 @@ nf_conntrack_expect_find(const struct nf_conntrack_tuple *tuple)
        
        read_lock_bh(&nf_conntrack_lock);
        i = __nf_conntrack_expect_find(tuple);
+        if (i)
+                atomic_inc(&i->use);
        read_unlock_bh(&nf_conntrack_lock);
        return i;
@@ -893,12 +893,6 @@ __nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
        memset(conntrack, 0, nf_ct_cache[features].size);
        conntrack->features = features;
-        if (helper) {
-                struct nf_conn_help *help = nfct_help(conntrack);
-                NF_CT_ASSERT(help);
-                help->helper = helper;
-        }
        atomic_set(&conntrack->ct_general.use, 1);
        conntrack->ct_general.destroy = destroy_conntrack;
        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
@@ -982,8 +976,13 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
 #endif
                nf_conntrack_get(&conntrack->master->ct_general);
                NF_CT_STAT_INC(expect_new);
-        } else
+        } else {
+                struct nf_conn_help *help = nfct_help(conntrack);
+                if (help)
+                        help->helper = __nf_ct_helper_find(&repl_tuple);
                NF_CT_STAT_INC(new);
+        }
        /* Overload tuple linked list to put us in unconfirmed list. */
        list_add(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].list, &unconfirmed);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index bd0156a28ecd..ab67c2be2b5d 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -161,6 +161,7 @@ ctnetlink_dump_protoinfo(struct sk_buff *skb, const struct nf_conn *ct)
        return ret;
 nfattr_failure:
+        nf_ct_proto_put(proto);
        return -1;
 }
@@ -949,6 +950,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
 {
        struct nf_conn *ct;
        int err = -EINVAL;
+        struct nf_conn_help *help;
        ct = nf_conntrack_alloc(otuple, rtuple);
        if (ct == NULL || IS_ERR(ct))
@@ -976,9 +978,16 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
                ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
+        help = nfct_help(ct);
+        if (help)
+                help->helper = nf_ct_helper_find_get(rtuple);
        add_timer(&ct->timeout);
        nf_conntrack_hash_insert(ct);
+        if (help && help->helper)
+                nf_ct_helper_put(help->helper);
        return 0;
 err:    
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c4cde57d9216..2ee14f8a1908 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -495,6 +495,7 @@ static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
                        goto out;
                }
+                err = -ESRCH;
                x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
                                             p->family);
        }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 8ab5679a37a3..28ee187ed224 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1754,7 +1754,8 @@ static inline void flush_unauthorized_files(struct files_struct * files)
                                                get_file(devnull);
                                        } else {
                                                devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
-                                                if (!devnull) {
+                                                if (IS_ERR(devnull)) {
+                                                        devnull = NULL;
                                                        put_unused_fd(fd);
                                                        fput(file);
                                                        continue;
diff --git a/sound/aoa/codecs/snd-aoa-codec-tas.c b/sound/aoa/codecs/snd-aoa-codec-tas.c
index 2ef55a17917c..9de8485ba3f5 100644
--- a/sound/aoa/codecs/snd-aoa-codec-tas.c
+++ b/sound/aoa/codecs/snd-aoa-codec-tas.c
@@ -514,9 +514,15 @@ static int tas_snd_capture_source_put(struct snd_kcontrol *kcontrol,
        mutex_lock(&tas->mtx);
        oldacr = tas->acr;
-        tas->acr &= ~TAS_ACR_INPUT_B;
+        /*
+         * Despite what the data sheet says in one place, the
+         * TAS_ACR_B_MONAUREAL bit forces mono output even when
+         * input A (line in) is selected.
+         */
+        tas->acr &= ~(TAS_ACR_INPUT_B | TAS_ACR_B_MONAUREAL);
        if (ucontrol->value.enumerated.item[0])
-                tas->acr |= TAS_ACR_INPUT_B;
+                tas->acr |= TAS_ACR_INPUT_B | TAS_ACR_B_MONAUREAL |
+                      TAS_ACR_B_MON_SEL_RIGHT;
        if (oldacr == tas->acr) {
                mutex_unlock(&tas->mtx);
                return 0;
@@ -686,8 +692,7 @@ static int tas_reset_init(struct tas *tas)
        if (tas_write_reg(tas, TAS_REG_MCS, 1, &tmp))
                goto outerr;
-        tas->acr |= TAS_ACR_ANALOG_PDOWN | TAS_ACR_B_MONAUREAL |
+        tas->acr |= TAS_ACR_ANALOG_PDOWN;
-                TAS_ACR_B_MON_SEL_RIGHT;
        if (tas_write_reg(tas, TAS_REG_ACR, 1, &tas->acr))
                goto outerr;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 505b23ec4058..e0821eb3d851 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2359,7 +2359,8 @@ static int snd_pcm_oss_release(struct inode *inode, struct file *file)
                substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
        snd_assert(substream != NULL, return -ENXIO);
        pcm = substream->pcm;
-        snd_pcm_oss_sync(pcm_oss_file);
+        if (!pcm->card->shutdown)
+                snd_pcm_oss_sync(pcm_oss_file);
        mutex_lock(&pcm->open_mutex);
        snd_pcm_oss_release_file(pcm_oss_file);
        mutex_unlock(&pcm->open_mutex);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 37b4b10850ae..66e24b5da469 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1310,7 +1310,8 @@ static int snd_pcm_pre_prepare(struct snd_pcm_substream *substream,
                               int f_flags)
 {
        struct snd_pcm_runtime *runtime = substream->runtime;
-        if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+        if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
                return -EBADFD;
        if (snd_pcm_running(substream))
                return -EBUSY;
@@ -1568,7 +1569,8 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
        runtime = substream->runtime;
        card = substream->pcm->card;
-        if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+        if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+            runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
                return -EBADFD;
        snd_power_lock(card);
diff --git a/sound/core/rtctimer.c b/sound/core/rtctimer.c
index 412dd62b654e..9f7b32e1ccde 100644
--- a/sound/core/rtctimer.c
+++ b/sound/core/rtctimer.c
@@ -22,13 +22,10 @@
 #include <sound/driver.h>
 #include <linux/init.h>
-#include <linux/time.h>
-#include <linux/threads.h>
 #include <linux/interrupt.h>
 #include <linux/moduleparam.h>
 #include <sound/core.h>
 #include <sound/timer.h>
-#include <sound/info.h>
 #if defined(CONFIG_RTC) || defined(CONFIG_RTC_MODULE)
@@ -50,7 +47,9 @@ static int rtctimer_stop(struct snd_timer *t);
 * The hardware dependent description for this timer.
 */
 static struct snd_timer_hardware rtc_hw = {
-        .flags =        SNDRV_TIMER_HW_FIRST|SNDRV_TIMER_HW_AUTO,
+        .flags =        SNDRV_TIMER_HW_AUTO |
+                        SNDRV_TIMER_HW_FIRST |
+                        SNDRV_TIMER_HW_TASKLET,
        .ticks =        100000000L,             /* FIXME: XXX */
        .open =         rtctimer_open,
        .close =        rtctimer_close,
@@ -60,6 +59,7 @@ static struct snd_timer_hardware rtc_hw = {
 static int rtctimer_freq = RTC_FREQ;            /* frequency */
 static struct snd_timer *rtctimer;
+static struct tasklet_struct rtc_tasklet;
 static rtc_task_t rtc_task;
@@ -81,6 +81,7 @@ rtctimer_close(struct snd_timer *t)
        rtc_task_t *rtc = t->private_data;
        if (rtc) {
                rtc_unregister(rtc);
+                tasklet_kill(&rtc_tasklet);
                t->private_data = NULL;
        }
        return 0;
@@ -105,12 +106,17 @@ rtctimer_stop(struct snd_timer *timer)
        return 0;
 }
+static void rtctimer_tasklet(unsigned long data)
+{
+        snd_timer_interrupt((struct snd_timer *)data, 1);
+}
 /*
 * interrupt
 */
 static void rtctimer_interrupt(void *private_data)
 {
-        snd_timer_interrupt(private_data, 1);
+        tasklet_hi_schedule(private_data);
 }
@@ -139,9 +145,11 @@ static int __init rtctimer_init(void)
        timer->hw = rtc_hw;
        timer->hw.resolution = NANO_SEC / rtctimer_freq;
+        tasklet_init(&rtc_tasklet, rtctimer_tasklet, (unsigned long)timer);
        /* set up RTC callback */
        rtc_task.func = rtctimer_interrupt;
-        rtc_task.private_data = timer;
+        rtc_task.private_data = &rtc_tasklet;
        err = snd_timer_global_register(timer);
        if (err < 0) {
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index 8058059c56e9..8bc4ffa6220d 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -956,6 +956,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
         .ca0151_chip = 1,
         .spk71 = 1,
         .spdif_bug = 1,
+         .adc_1361t = 1,  /* 24 bit capture instead of 16bit. Fixes ALSA bug#324 */
         .ac97_chip = 1} ,
        {.vendor = 0x1102, .device = 0x0004, .revision = 0x04,
         .driver = "Audigy2", .name = "Audigy 2 [Unknown]",
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0d728c6f697c..fb961448db19 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5870,7 +5870,7 @@ static struct hda_board_config alc262_cfg_tbl[] = {
        { .pci_subvendor = 0x10cf, .pci_subdevice = 0x1397,
          .config = ALC262_FUJITSU },
        { .modelname = "hp-bpc", .config = ALC262_HP_BPC },
-        { .pci_subvendor = 0x103c, .pci_subdevice = 0x208c,
+        { .pci_subvendor = 0x103c, .pci_subdevice = 0x280c,
          .config = ALC262_HP_BPC }, /* xw4400 */
        { .pci_subvendor = 0x103c, .pci_subdevice = 0x3014,
          .config = ALC262_HP_BPC }, /* xw6400 */
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 731b7b97ee71..fe51ef3e49d2 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -336,6 +336,13 @@ static struct hda_board_config stac9200_cfg_tbl[] = {
          .pci_subvendor = PCI_VENDOR_ID_INTEL,
          .pci_subdevice = 0x2668,      /* DFI LanParty */
          .config = STAC_REF },
+        /* Dell laptops have BIOS problem */
+        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01b5,
+          .config = STAC_REF }, /* Dell Inspiron 630m */
+        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01c2,
+          .config = STAC_REF }, /* Dell Latitude D620 */
+        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01cb,
+          .config = STAC_REF }, /* Dell Latitude 120L */
        {} /* terminator */
 };
@@ -591,13 +598,6 @@ static struct hda_board_config stac9205_cfg_tbl[] = {
          .pci_subvendor = PCI_VENDOR_ID_INTEL,
          .pci_subdevice = 0x2668,      /* DFI LanParty */
          .config = STAC_REF },         /* SigmaTel reference board */
-        /* Dell laptops have BIOS problem */
-        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01b5,
-          .config = STAC_REF }, /* Dell Inspiron 630m */
-        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01c2,
-          .config = STAC_REF }, /* Dell Latitude D620 */
-        { .pci_subvendor = PCI_VENDOR_ID_DELL, .pci_subdevice = 0x01cb,
-          .config = STAC_REF }, /* Dell Latitude 120L */
        {} /* terminator */
 };
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index c82b01c7ad3a..67202b9eeb77 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -1469,7 +1469,8 @@ static int snd_usb_hw_free(struct snd_pcm_substream *substream)
        subs->cur_audiofmt = NULL;
        subs->cur_rate = 0;
        subs->period_bytes = 0;
-        release_substream_urbs(subs, 0);
+        if (!subs->stream->chip->shutdown)
+                release_substream_urbs(subs, 0);
        return snd_pcm_free_vmalloc_buffer(substream);
 }