73 files changed, 459 insertions, 537 deletions
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index 6e253407b3dc..accfe2f5247d 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -298,3 +298,15 @@ over a rather long period of time, but improvements are always welcome!
        Note that, rcu_assign_pointer() and rcu_dereference() relate to
        SRCU just as they do to other forms of RCU.
+15.     The whole point of call_rcu(), synchronize_rcu(), and friends
+        is to wait until all pre-existing readers have finished before
+        carrying out some otherwise-destructive operation.  It is
+        therefore critically important to -first- remove any path
+        that readers can follow that could be affected by the
+        destructive operation, and -only- -then- invoke call_rcu(),
+        synchronize_rcu(), or friends.
+        Because these primitives only wait for pre-existing readers,
+        it is the caller's responsibility to guarantee safety to
+        any subsequent readers.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 5ddbe350487a..20d3b94703a4 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -335,3 +335,12 @@ Why:	In 2.6.18 the Secmark concept was introduced to replace the "compat_net"
        Secmark, it is time to deprecate the older mechanism and start the
        process of removing the old code.
 Who:    Paul Moore <paul.moore@hp.com>
+---------------------------
+What:   sysfs ui for changing p4-clockmod parameters
+When:   September 2009
+Why:    See commits 129f8ae9b1b5be94517da76009ea956e89104ce8 and
+        e088e4c9cdb618675874becb91b2fd581ee707e6.
+        Removal is subject to fixing any remaining bugs in ACPI which may
+        cause the thermal throttling not to happen at the right time.
+Who:    Dave Jones <davej@redhat.com>, Matthew Garrett <mjg@redhat.com>
diff --git a/Documentation/networking/ipv6.txt b/Documentation/networking/ipv6.txt
new file mode 100644
index 000000000000..268e5c103dd8
--- /dev/null
+++ b/Documentation/networking/ipv6.txt
@@ -0,0 +1,35 @@
+Options for the ipv6 module are supplied as parameters at load time.
+Module options may be given as command line arguments to the insmod
+or modprobe command, but are usually specified in either the
+/etc/modules.conf or /etc/modprobe.conf configuration file, or in a
+distro-specific configuration file.
+The available ipv6 module parameters are listed below.  If a parameter
+is not specified the default value is used.
+The parameters are as follows:
+disable
+        Specifies whether to load the IPv6 module, but disable all
+        its functionality.  This might be used when another module
+        has a dependency on the IPv6 module being loaded, but no
+        IPv6 addresses or operations are desired.
+        The possible values and their effects are:
+        0
+                IPv6 is enabled.
+                This is the default value.
+        1
+                IPv6 is disabled.
+                No IPv6 addresses will be added to interfaces, and
+                it will not be possible to open an IPv6 socket.
+                A reboot is required to enable IPv6.
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index f6a13451d1fd..6031e179926b 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -81,7 +81,7 @@ static inline void __init ldp_init_smc911x(void)
        }
        ldp_smc911x_resources[0].start = cs_mem_base + 0x0;
-        ldp_smc911x_resources[0].end   = cs_mem_base + 0xf;
+        ldp_smc911x_resources[0].end   = cs_mem_base + 0xff;
        udelay(100);
        eth_gpio = LDP_SMC911X_GPIO;
diff --git a/arch/m68knommu/platform/5206e/config.c b/arch/m68knommu/platform/5206e/config.c
index d01a5d2b7557..db902540bf2c 100644
--- a/arch/m68knommu/platform/5206e/config.c
+++ b/arch/m68knommu/platform/5206e/config.c
@@ -17,6 +17,7 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfdma.h>
+#include <asm/mcfuart.h>
 /***************************************************************************/
diff --git a/arch/m68knommu/platform/528x/config.c b/arch/m68knommu/platform/528x/config.c
index dfdb5c2ed8e6..44baeb225dc7 100644
--- a/arch/m68knommu/platform/528x/config.c
+++ b/arch/m68knommu/platform/528x/config.c
@@ -24,7 +24,6 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfuart.h>
-#include <asm/mcfqspi.h>
 #ifdef CONFIG_MTD_PARTITIONS
 #include <linux/mtd/partitions.h>
@@ -33,233 +32,6 @@
 /***************************************************************************/
 void coldfire_reset(void);
-static void coldfire_qspi_cs_control(u8 cs, u8 command);
-/***************************************************************************/
-#if defined(CONFIG_SPI)
-#if defined(CONFIG_WILDFIRE)
-#define SPI_NUM_CHIPSELECTS     0x02
-#define SPI_PAR_VAL             0x07  /* Enable DIN, DOUT, CLK */
-#define SPI_CS_MASK             0x18
-#define FLASH_BLOCKSIZE         (1024*64)
-#define FLASH_NUMBLOCKS         16
-#define FLASH_TYPE              "m25p80"
-#define M25P80_CS               0
-#define MMC_CS                  1
-#ifdef CONFIG_MTD_PARTITIONS
-static struct mtd_partition stm25p_partitions[] = {
-        /* sflash */
-        [0] = {
-                .name = "stm25p80",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
-                .mask_flags = 0
-        }
-};
-#endif
-#elif defined(CONFIG_WILDFIREMOD)
-#define SPI_NUM_CHIPSELECTS     0x08
-#define SPI_PAR_VAL             0x07  /* Enable DIN, DOUT, CLK */
-#define SPI_CS_MASK             0x78
-#define FLASH_BLOCKSIZE         (1024*64)
-#define FLASH_NUMBLOCKS         64
-#define FLASH_TYPE              "m25p32"
-/* Reserve 1M for the kernel parition */
-#define FLASH_KERNEL_SIZE   (1024 * 1024)
-#define M25P80_CS               5
-#define MMC_CS                  6
-#ifdef CONFIG_MTD_PARTITIONS
-static struct mtd_partition stm25p_partitions[] = {
-        /* sflash */
-        [0] = {
-                .name = "kernel",
-                .offset = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
-                .size = FLASH_KERNEL_SIZE,
-                .mask_flags = 0
-        },
-        [1] = {
-                .name = "image",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
-                .mask_flags = 0
-        },
-        [2] = {
-                .name = "all",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
-                .mask_flags = 0
-        }
-};
-#endif
-#else
-#define SPI_NUM_CHIPSELECTS     0x04
-#define SPI_PAR_VAL             0x7F  /* Enable DIN, DOUT, CLK, CS0 - CS4 */
-#endif
-#ifdef MMC_CS
-static struct coldfire_spi_chip flash_chip_info = {
-        .mode = SPI_MODE_0,
-        .bits_per_word = 16,
-        .del_cs_to_clk = 17,
-        .del_after_trans = 1,
-        .void_write_data = 0
-};
-static struct coldfire_spi_chip mmc_chip_info = {
-        .mode = SPI_MODE_0,
-        .bits_per_word = 16,
-        .del_cs_to_clk = 17,
-        .del_after_trans = 1,
-        .void_write_data = 0xFFFF
-};
-#endif
-#ifdef M25P80_CS
-static struct flash_platform_data stm25p80_platform_data = {
-        .name = "ST M25P80 SPI Flash chip",
-#ifdef CONFIG_MTD_PARTITIONS
-        .parts = stm25p_partitions,
-        .nr_parts = sizeof(stm25p_partitions) / sizeof(*stm25p_partitions),
-#endif
-        .type = FLASH_TYPE
-};
-#endif
-static struct spi_board_info spi_board_info[] __initdata = {
-#ifdef M25P80_CS
-        {
-                .modalias = "m25p80",
-                .max_speed_hz = 16000000,
-                .bus_num = 1,
-                .chip_select = M25P80_CS,
-                .platform_data = &stm25p80_platform_data,
-                .controller_data = &flash_chip_info
-        },
-#endif
-#ifdef MMC_CS
-        {
-                .modalias = "mmc_spi",
-                .max_speed_hz = 16000000,
-                .bus_num = 1,
-                .chip_select = MMC_CS,
-                .controller_data = &mmc_chip_info
-        }
-#endif
-};
-static struct coldfire_spi_master coldfire_master_info = {
-        .bus_num = 1,
-        .num_chipselect = SPI_NUM_CHIPSELECTS,
-        .irq_source = MCF5282_QSPI_IRQ_SOURCE,
-        .irq_vector = MCF5282_QSPI_IRQ_VECTOR,
-        .irq_mask = ((0x01 << MCF5282_QSPI_IRQ_SOURCE) | 0x01),
-        .irq_lp = 0x2B,  /* Level 5 and Priority 3 */
-        .par_val = SPI_PAR_VAL,
-        .cs_control = coldfire_qspi_cs_control,
-};
-static struct resource coldfire_spi_resources[] = {
-        [0] = {
-                .name = "qspi-par",
-                .start = MCF5282_QSPI_PAR,
-                .end = MCF5282_QSPI_PAR,
-                .flags = IORESOURCE_MEM
-        },
-        [1] = {
-                .name = "qspi-module",
-                .start = MCF5282_QSPI_QMR,
-                .end = MCF5282_QSPI_QMR + 0x18,
-                .flags = IORESOURCE_MEM
-        },
-        [2] = {
-                .name = "qspi-int-level",
-                .start = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
-                .end = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
-                .flags = IORESOURCE_MEM
-        },
-        [3] = {
-                .name = "qspi-int-mask",
-                .start = MCF5282_INTC0 + MCFINTC_IMRL,
-                .end = MCF5282_INTC0 + MCFINTC_IMRL,
-                .flags = IORESOURCE_MEM
-        }
-};
-static struct platform_device coldfire_spi = {
-        .name = "spi_coldfire",
-        .id = -1,
-        .resource = coldfire_spi_resources,
-        .num_resources = ARRAY_SIZE(coldfire_spi_resources),
-        .dev = {
-                .platform_data = &coldfire_master_info,
-        }
-};
-static void coldfire_qspi_cs_control(u8 cs, u8 command)
-{
-        u8 cs_bit = ((0x01 << cs) << 3) & SPI_CS_MASK;
-#if defined(CONFIG_WILDFIRE)
-        u8 cs_mask = ~(((0x01 << cs) << 3) & SPI_CS_MASK);
-#endif
-#if defined(CONFIG_WILDFIREMOD)
-        u8 cs_mask = (cs << 3) & SPI_CS_MASK;
-#endif
-        /*
-         * Don't do anything if the chip select is not
-         * one of the port qs pins.
-         */
-        if (command & QSPI_CS_INIT) {
-#if defined(CONFIG_WILDFIRE)
-                MCF5282_GPIO_DDRQS  |= cs_bit;
-                MCF5282_GPIO_PQSPAR &= ~cs_bit;
-#endif
-#if defined(CONFIG_WILDFIREMOD)
-                MCF5282_GPIO_DDRQS  |= SPI_CS_MASK;
-                MCF5282_GPIO_PQSPAR &= ~SPI_CS_MASK;
-#endif
-        }
-        if (command & QSPI_CS_ASSERT) {
-                MCF5282_GPIO_PORTQS &= ~SPI_CS_MASK;
-                MCF5282_GPIO_PORTQS |= cs_mask;
-        } else if (command & QSPI_CS_DROP) {
-                MCF5282_GPIO_PORTQS |= SPI_CS_MASK;
-        }
-}
-static int __init spi_dev_init(void)
-{
-        int retval;
-        retval = platform_device_register(&coldfire_spi);
-        if (retval < 0)
-                return retval;
-        if (ARRAY_SIZE(spi_board_info))
-                retval = spi_register_board_info(spi_board_info, ARRAY_SIZE(spi_board_info));
-        return retval;
-}
-#endif /* CONFIG_SPI */
 /***************************************************************************/
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index 72da416f6162..15b6d450fbf0 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -22,6 +22,7 @@
 #include <linux/gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_gpio.h>
+#include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
 #include <media/sh_mobile_ceu.h>
 #include <video/sh_mobile_lcdc.h>
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index b585e04cbc9e..3178c3acd97e 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -277,7 +277,6 @@ static struct cpufreq_driver p4clockmod_driver = {
        .name           = "p4-clockmod",
        .owner          = THIS_MODULE,
        .attr           = p4clockmod_attr,
-        .hide_interface = 1,
 };
diff --git a/arch/x86/kernel/cpu/mcheck/mce_64.c b/arch/x86/kernel/cpu/mcheck/mce_64.c
index bfbd5323a635..ca14604611ec 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_64.c
@@ -639,7 +639,7 @@ static void mce_init_timer(void)
        if (!next_interval)
                return;
        setup_timer(t, mcheck_timer, smp_processor_id());
-        t->expires = round_jiffies_relative(jiffies + next_interval);
+        t->expires = round_jiffies(jiffies + next_interval);
        add_timer(t);
 }
@@ -1110,7 +1110,7 @@ static int __cpuinit mce_cpu_callback(struct notifier_block *nfb,
                break;
        case CPU_DOWN_FAILED:
        case CPU_DOWN_FAILED_FROZEN:
-                t->expires = round_jiffies_relative(jiffies + next_interval);
+                t->expires = round_jiffies(jiffies + next_interval);
                add_timer_on(t, cpu);
                smp_call_function_single(cpu, mce_reenable_cpu, &action, 1);
                break;
diff --git a/arch/x86/kernel/visws_quirks.c b/arch/x86/kernel/visws_quirks.c
index 191a876e9e87..31ffc24eec4d 100644
--- a/arch/x86/kernel/visws_quirks.c
+++ b/arch/x86/kernel/visws_quirks.c
@@ -578,7 +578,7 @@ static struct irq_chip piix4_virtual_irq_type = {
 static irqreturn_t piix4_master_intr(int irq, void *dev_id)
 {
        int realirq;
-        irq_desc_t *desc;
+        struct irq_desc *desc;
        unsigned long flags;
        spin_lock_irqsave(&i8259A_lock, flags);
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index f3a5305b8adf..9fe4ddaa8f6f 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -348,6 +348,11 @@ static void lguest_cpuid(unsigned int *ax, unsigned int *bx,
                 * flush_tlb_user() for both user and kernel mappings unless
                 * the Page Global Enable (PGE) feature bit is set. */
                *dx |= 0x00002000;
+                /* We also lie, and say we're family id 5.  6 or greater
+                 * leads to a rdmsr in early_init_intel which we can't handle.
+                 * Family ID is returned as bits 8-12 in ax. */
+                *ax &= 0xFFFFF0FF;
+                *ax |= 0x00000500;
                break;
        case 0x80000000:
                /* Futureproof this a little: if they ask how much extended
@@ -594,19 +599,21 @@ static void __init lguest_init_IRQ(void)
                /* Some systems map "vectors" to interrupts weirdly.  Lguest has
                 * a straightforward 1 to 1 mapping, so force that here. */
                __get_cpu_var(vector_irq)[vector] = i;
-                if (vector != SYSCALL_VECTOR) {
+                if (vector != SYSCALL_VECTOR)
-                        set_intr_gate(vector,
+                        set_intr_gate(vector, interrupt[i]);
-                                      interrupt[vector-FIRST_EXTERNAL_VECTOR]);
-                        set_irq_chip_and_handler_name(i, &lguest_irq_controller,
-                                                      handle_level_irq,
-                                                      "level");
-                }
        }
        /* This call is required to set up for 4k stacks, where we have
         * separate stacks for hard and soft interrupts. */
        irq_ctx_init(smp_processor_id());
 }
+void lguest_setup_irq(unsigned int irq)
+{
+        irq_to_desc_alloc_cpu(irq, 0);
+        set_irq_chip_and_handler_name(irq, &lguest_irq_controller,
+                                      handle_level_irq, "level");
+}
 /*
 * Time.
 *
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 6c873dceb177..981200830432 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -103,9 +103,6 @@ config MATH_EMULATION
        help
        Can we use information of configuration file?
-config HIGHMEM
-        bool "High memory support"
 endmenu
 menu "Platform options"
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 9606d2bd1dd9..4ec1633c2941 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -44,6 +44,8 @@
 #include <asm/setup.h>
 #include <asm/param.h>
+#include <platform/hardware.h>
 #if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_DUMMY_CONSOLE)
 struct screen_info screen_info = { 0, 24, 0, 0, 0, 80, 0, 0, 0, 24, 1, 16};
 #endif
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index c7a021d9f696..c44f830b6c7a 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -30,6 +30,7 @@
 #include <linux/stringify.h>
 #include <linux/kallsyms.h>
 #include <linux/delay.h>
+#include <linux/hardirq.h>
 #include <asm/ptrace.h>
 #include <asm/timex.h>
diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
index 33f366be323f..bdd860d93f72 100644
--- a/arch/xtensa/mm/fault.c
+++ b/arch/xtensa/mm/fault.c
@@ -14,6 +14,7 @@
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/hardirq.h>
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
 #include <asm/hardirq.h>
diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
index efed8897bef3..25d46c84eb08 100644
--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -140,16 +140,14 @@ static void rs_poll(unsigned long priv)
 }
-static void rs_put_char(struct tty_struct *tty, unsigned char ch)
+static int rs_put_char(struct tty_struct *tty, unsigned char ch)
 {
        char buf[2];
-        if (!tty)
-                return;
        buf[0] = ch;
        buf[1] = '\0';          /* Is this NULL necessary? */
        __simc (SYS_write, 1, (unsigned long) buf, 1, 0, 0);
+        return 1;
 }
 static void rs_flush_chars(struct tty_struct *tty)
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 43fa90b837ee..f8f578a71b25 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -303,7 +303,7 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
        sect_start_pfn = section_nr_to_pfn(mem_blk->phys_index);
        sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
        for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
-                unsigned int nid;
+                int nid;
                nid = get_nid_for_pfn(pfn);
                if (nid < 0)
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index cc250577d405..eeea477d9601 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -173,7 +173,7 @@ skbfree(struct sk_buff *skb)
                return;
        while (atomic_read(&skb_shinfo(skb)->dataref) != 1 && i-- > 0)
                msleep(Sms);
-        if (i <= 0) {
+        if (i < 0) {
                printk(KERN_ERR
                        "aoe: %s holds ref: %s\n",
                        skb->dev ? skb->dev->name : "netif",
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 52f4361eb6e4..d765afda9c2a 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -271,15 +271,15 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
        nb_order = (nb_order >> 1) & 7;
        pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
        nb_aper = nb_base << 25;
-        if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order)) {
-                return 0;
-        }
        /* Northbridge seems to contain crap. Try the AGP bridge. */
        pci_read_config_word(agp, cap+0x14, &apsize);
-        if (apsize == 0xffff)
+        if (apsize == 0xffff) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
                return -1;
+        }
        apsize &= 0xfff;
        /* Some BIOS use weird encodings not in the AGPv3 table. */
@@ -301,6 +301,11 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
                order = nb_order;
        }
+        if (nb_order >= order) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
+        }
        dev_info(&agp->dev, "aperture from AGP @ %Lx size %u MB\n",
                 aper, 32 << order);
        if (order < 0 || !agp_aperture_valid(aper, (32*1024*1024)<<order))
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index c7714185f831..4373adb2119a 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -633,13 +633,15 @@ static void intel_i830_init_gtt_entries(void)
                        break;
                }
        }
-        if (gtt_entries > 0)
+        if (gtt_entries > 0) {
                dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
                       gtt_entries / KB(1), local ? "local" : "stolen");
-        else
+                gtt_entries /= KB(4);
+        } else {
                dev_info(&agp_bridge->dev->dev,
                       "no pre-allocated video memory detected\n");
-        gtt_entries /= KB(4);
+                gtt_entries = 0;
+        }
        intel_private.gtt_entries = gtt_entries;
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b55cb67435bd..d6daf3c507d3 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -754,11 +754,6 @@ static struct kobj_type ktype_cpufreq = {
        .release        = cpufreq_sysfs_release,
 };
-static struct kobj_type ktype_empty_cpufreq = {
-        .sysfs_ops      = &sysfs_ops,
-        .release        = cpufreq_sysfs_release,
-};
 /**
 * cpufreq_add_dev - add a CPU device
@@ -892,36 +887,26 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
        memcpy(&new_policy, policy, sizeof(struct cpufreq_policy));
        /* prepare interface data */
-        if (!cpufreq_driver->hide_interface) {
+        ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &sys_dev->kobj,
-                ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
+                                   "cpufreq");
-                                           &sys_dev->kobj, "cpufreq");
+        if (ret)
+                goto err_out_driver_exit;
+        /* set up files for this cpu device */
+        drv_attr = cpufreq_driver->attr;
+        while ((drv_attr) && (*drv_attr)) {
+                ret = sysfs_create_file(&policy->kobj, &((*drv_attr)->attr));
                if (ret)
                        goto err_out_driver_exit;
+                drv_attr++;
-                /* set up files for this cpu device */
+        }
-                drv_attr = cpufreq_driver->attr;
+        if (cpufreq_driver->get) {
-                while ((drv_attr) && (*drv_attr)) {
+                ret = sysfs_create_file(&policy->kobj, &cpuinfo_cur_freq.attr);
-                        ret = sysfs_create_file(&policy->kobj,
+                if (ret)
-                                                &((*drv_attr)->attr));
+                        goto err_out_driver_exit;
-                        if (ret)
+        }
-                                goto err_out_driver_exit;
+        if (cpufreq_driver->target) {
-                        drv_attr++;
+                ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
-                }
-                if (cpufreq_driver->get) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &cpuinfo_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-                if (cpufreq_driver->target) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &scaling_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-        } else {
-                ret = kobject_init_and_add(&policy->kobj, &ktype_empty_cpufreq,
-                                           &sys_dev->kobj, "cpufreq");
                if (ret)
                        goto err_out_driver_exit;
        }
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index cfc1ee90f5a3..b251d8674b41 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -72,6 +72,7 @@ I2C_CLIENT_INSMOD_7(lm85b, lm85c, adm1027, adt7463, adt7468, emc6d100,
 #define LM85_COMPANY_SMSC               0x5c
 #define LM85_VERSTEP_VMASK              0xf0
 #define LM85_VERSTEP_GENERIC            0x60
+#define LM85_VERSTEP_GENERIC2           0x70
 #define LM85_VERSTEP_LM85C              0x60
 #define LM85_VERSTEP_LM85B              0x62
 #define LM85_VERSTEP_ADM1027            0x60
@@ -334,6 +335,7 @@ static struct lm85_data *lm85_update_device(struct device *dev);
 static const struct i2c_device_id lm85_id[] = {
        { "adm1027", adm1027 },
        { "adt7463", adt7463 },
+        { "adt7468", adt7468 },
        { "lm85", any_chip },
        { "lm85b", lm85b },
        { "lm85c", lm85c },
@@ -408,7 +410,8 @@ static ssize_t show_vid_reg(struct device *dev, struct device_attribute *attr,
        struct lm85_data *data = lm85_update_device(dev);
        int vid;
-        if (data->type == adt7463 && (data->vid & 0x80)) {
+        if ((data->type == adt7463 || data->type == adt7468) &&
+            (data->vid & 0x80)) {
                /* 6-pin VID (VRM 10) */
                vid = vid_from_reg(data->vid & 0x3f, data->vrm);
        } else {
@@ -1153,7 +1156,8 @@ static int lm85_detect(struct i2c_client *client, int kind,
                        address, company, verstep);
                /* All supported chips have the version in common */
-                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC) {
+                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
+                    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
                        dev_dbg(&adapter->dev, "Autodetection failed: "
                                "unsupported version\n");
                        return -ENODEV;
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index b4d44e571d76..8132533d71f9 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -212,6 +212,9 @@ static void lg_notify(struct virtqueue *vq)
        hcall(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT, 0, 0);
 }
+/* An extern declaration inside a C file is bad form.  Don't do it. */
+extern void lguest_setup_irq(unsigned int irq);
 /* This routine finds the first virtqueue described in the configuration of
 * this device and sets it up.
 *
@@ -266,6 +269,9 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
                goto unmap;
        }
+        /* Make sure the interrupt is allocated. */
+        lguest_setup_irq(lvq->config.irq);
        /* Tell the interrupt for this virtqueue to go to the virtio_ring
         * interrupt handler. */
        /* FIXME: We used to have a flag for the Host to tell us we could use
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 03b4cd0a6344..a307f87eb90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -214,12 +214,7 @@ static inline mddev_t *mddev_get(mddev_t *mddev)
        return mddev;
 }
-static void mddev_delayed_delete(struct work_struct *ws)
+static void mddev_delayed_delete(struct work_struct *ws);
-{
-        mddev_t *mddev = container_of(ws, mddev_t, del_work);
-        kobject_del(&mddev->kobj);
-        kobject_put(&mddev->kobj);
-}
 static void mddev_put(mddev_t *mddev)
 {
@@ -3542,6 +3537,21 @@ static struct kobj_type md_ktype = {
 int mdp_major = 0;
+static void mddev_delayed_delete(struct work_struct *ws)
+{
+        mddev_t *mddev = container_of(ws, mddev_t, del_work);
+        if (mddev->private == &md_redundancy_group) {
+                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->sysfs_action)
+                        sysfs_put(mddev->sysfs_action);
+                mddev->sysfs_action = NULL;
+                mddev->private = NULL;
+        }
+        kobject_del(&mddev->kobj);
+        kobject_put(&mddev->kobj);
+}
 static int md_alloc(dev_t dev, char *name)
 {
        static DEFINE_MUTEX(disks_mutex);
@@ -4033,13 +4043,9 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                        mddev->queue->merge_bvec_fn = NULL;
                        mddev->queue->unplug_fn = NULL;
                        mddev->queue->backing_dev_info.congested_fn = NULL;
-                        if (mddev->pers->sync_request) {
-                                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
-                                if (mddev->sysfs_action)
-                                        sysfs_put(mddev->sysfs_action);
-                                mddev->sysfs_action = NULL;
-                        }
                        module_put(mddev->pers->owner);
+                        if (mddev->pers->sync_request)
+                                mddev->private = &md_redundancy_group;
                        mddev->pers = NULL;
                        /* tell userspace to handle 'inactive' */
                        sysfs_notify_dirent(mddev->sysfs_state);
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index d44f741ae229..6d9f810565c8 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -821,7 +821,8 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
                                        if (!(info->flags & IS_POW2PS))
                                                return info;
                                }
-                        }
+                        } else
+                                return info;
                }
        }
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 4b122e7ab4b3..229718222db7 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -46,16 +46,19 @@ static int physmap_flash_remove(struct platform_device *dev)
        physmap_data = dev->dev.platform_data;
+        if (info->cmtd) {
 #ifdef CONFIG_MTD_PARTITIONS
-        if (info->nr_parts) {
+                if (info->nr_parts || physmap_data->nr_parts)
-                del_mtd_partitions(info->cmtd);
+                        del_mtd_partitions(info->cmtd);
-                kfree(info->parts);
+                else
-        } else if (physmap_data->nr_parts)
+                        del_mtd_device(info->cmtd);
-                del_mtd_partitions(info->cmtd);
-        else
-                del_mtd_device(info->cmtd);
 #else
-        del_mtd_device(info->cmtd);
+                del_mtd_device(info->cmtd);
+#endif
+        }
+#ifdef CONFIG_MTD_PARTITIONS
+        if (info->nr_parts)
+                kfree(info->parts);
 #endif
 #ifdef CONFIG_MTD_CONCAT
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 1cf2f949c0b4..f3a127434897 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -560,7 +560,7 @@ ks8695_reset(struct ks8695_priv *ksp)
                msleep(1);
        }
-        if (reset_timeout == 0) {
+        if (reset_timeout < 0) {
                dev_crit(ksp->dev,
                         "Timeout waiting for DMA engines to reset\n");
                /* And blithely carry on */
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9fb388388fb7..e0578fe8c0db 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4113,7 +4113,7 @@ static int bond_neigh_setup(struct net_device *dev, struct neigh_parms *parms)
                const struct net_device_ops *slave_ops
                        = slave->dev->netdev_ops;
                if (slave_ops->ndo_neigh_setup)
-                        return slave_ops->ndo_neigh_setup(dev, parms);
+                        return slave_ops->ndo_neigh_setup(slave->dev, parms);
        }
        return 0;
 }
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 08b34051c646..a6e1a35a13cb 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -957,13 +957,14 @@ jme_process_receive(struct jme_adapter *jme, int limit)
                goto out_inc;
        i = atomic_read(&rxring->next_to_clean);
-        while (limit-- > 0) {
+        while (limit > 0) {
                rxdesc = rxring->desc;
                rxdesc += i;
                if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_OWN)) ||
                !(rxdesc->descwb.desccnt & RXWBDCNT_WBCPL))
                        goto out;
+                --limit;
                desccnt = rxdesc->descwb.desccnt & RXWBDCNT_DCNT;
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index e5cb6b1f0ebd..2404a838b1fe 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -1035,7 +1035,8 @@ static int el3_rx(struct net_device *dev, int worklimit)
        DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
                  dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RxStatus));
        while (!((rx_status = inw(ioaddr + RxStatus)) & 0x8000) &&
-                   (--worklimit >= 0)) {
+                        worklimit > 0) {
+                worklimit--;
                if (rx_status & 0x4000) { /* Error, update stats. */
                        short error = rx_status & 0x3800;
                        dev->stats.rx_errors++;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 73ecc657999d..1e01b8a6dbf3 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -857,7 +857,8 @@ static int el3_rx(struct net_device *dev)
    DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
          dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RX_STATUS));
    while (!((rx_status = inw(ioaddr + RX_STATUS)) & 0x8000) &&
-           (--worklimit >= 0)) {
+                    worklimit > 0) {
+        worklimit--;
        if (rx_status & 0x4000) { /* Error, update stats. */
            short error = rx_status & 0x3800;
            dev->stats.rx_errors++;
diff --git a/drivers/net/smc911x.h b/drivers/net/smc911x.h
index 870b4c33f108..a45952e72018 100644
--- a/drivers/net/smc911x.h
+++ b/drivers/net/smc911x.h
@@ -42,6 +42,16 @@
  #define SMC_USE_16BIT         0
  #define SMC_USE_32BIT         1
  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+#elif defined(CONFIG_ARCH_OMAP34XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
+#elif defined(CONFIG_ARCH_OMAP24XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
 #else
 /*
 * Default configuration
@@ -675,6 +685,7 @@ smc_pxa_dma_outsl(struct smc911x_local *lp, u_long physaddr,
 #define CHIP_9116       0x0116
 #define CHIP_9117       0x0117
 #define CHIP_9118       0x0118
+#define CHIP_9211       0x9211
 #define CHIP_9215       0x115A
 #define CHIP_9217       0x117A
 #define CHIP_9218       0x118A
@@ -689,6 +700,7 @@ static const struct chip_id chip_ids[] =  {
        { CHIP_9116, "LAN9116" },
        { CHIP_9117, "LAN9117" },
        { CHIP_9118, "LAN9118" },
+        { CHIP_9211, "LAN9211" },
        { CHIP_9215, "LAN9215" },
        { CHIP_9217, "LAN9217" },
        { CHIP_9218, "LAN9218" },
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 8d64b1da0465..0fcb7503363d 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -1229,7 +1229,7 @@ static void gem_reset(struct gem *gp)
                        break;
        } while (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST));
-        if (limit <= 0)
+        if (limit < 0)
                printk(KERN_ERR "%s: SW reset is ghetto.\n", gp->dev->name);
        if (gp->phy_type == phy_serialink || gp->phy_type == phy_serdes)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b080f9493d83..dabdf59f8016 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -1473,7 +1473,8 @@ static void tg3_phy_toggle_apd(struct tg3 *tp, bool enable)
 {
        u32 reg;
-        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                return;
        reg = MII_TG3_MISC_SHDW_WREN |
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index 5f601773c260..e2150b3c83d9 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -121,11 +121,6 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
                goto err_out_trdev;
        }
-        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
-                          dev->name, dev);
-        if (ret)
-                goto err_out_region;
        dev->base_addr  = pci_ioaddr;
        dev->irq        = pci_irq_line;
        dev->dma        = 0;
@@ -142,7 +137,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
        ret = tmsdev_init(dev, &pdev->dev);
        if (ret) {
                printk("%s: unable to get memory for dev->priv.\n", dev->name);
-                goto err_out_irq;
+                goto err_out_region;
        }
        tp = netdev_priv(dev);
@@ -157,6 +152,11 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
        tp->tmspriv = cardinfo;
+        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
+                          dev->name, dev);
+        if (ret)
+                goto err_out_tmsdev;
        dev->open = tms380tr_open;
        dev->stop = tms380tr_close;
        pci_set_drvdata(pdev, dev);
@@ -164,15 +164,15 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
        ret = register_netdev(dev);
        if (ret)
-                goto err_out_tmsdev;
+                goto err_out_irq;
        
        return 0;
+err_out_irq:
+        free_irq(pdev->irq, dev);
 err_out_tmsdev:
        pci_set_drvdata(pdev, NULL);
        tmsdev_term(dev);
-err_out_irq:
-        free_irq(pdev->irq, dev);
 err_out_region:
        release_region(pci_ioaddr, TMS_PCI_IO_EXTENT);
 err_out_trdev:
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index 54635911305c..0ada4edd56eb 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -107,7 +107,7 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 static int uec_mdio_reset(struct mii_bus *bus)
 {
        struct ucc_mii_mng __iomem *regs = (void __iomem *)bus->priv;
-        unsigned int timeout = PHY_INIT_TIMEOUT;
+        int timeout = PHY_INIT_TIMEOUT;
        mutex_lock(&bus->mdio_lock);
@@ -123,7 +123,7 @@ static int uec_mdio_reset(struct mii_bus *bus)
        mutex_unlock(&bus->mdio_lock);
-        if (timeout <= 0) {
+        if (timeout < 0) {
                printk(KERN_ERR "%s: The MII Bus is stuck!\n", bus->name);
                return -EBUSY;
        }
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 5b67bbf1987e..81682c6defa0 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -635,6 +635,10 @@ static const struct usb_device_id products[] = {
        USB_DEVICE(0x0a47, 0x9601),     /* Hirose USB-100 */
        .driver_info = (unsigned long)&dm9601_info,
         },
+        {
+        USB_DEVICE(0x0fe6, 0x8101),     /* DM9601 USB to Fast Ethernet Adapter */
+        .driver_info = (unsigned long)&dm9601_info,
+         },
        {},                     // END
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36bafeb353ce..129e2d330abb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3868,7 +3868,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        }
        err = iwl_eeprom_check_version(priv);
        if (err)
-                goto out_iounmap;
+                goto out_free_eeprom;
        /* extract MAC Address */
        iwl_eeprom_get_mac(priv, priv->mac_addr);
@@ -3945,6 +3945,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        return 0;
 out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
        sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
 out_uninit_drv:
        iwl_uninit_drv(priv);
@@ -3953,8 +3955,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 out_iounmap:
        pci_iounmap(pdev, priv->hw_base);
 out_pci_release_regions:
-        pci_release_regions(pdev);
        pci_set_drvdata(pdev, NULL);
+        pci_release_regions(pdev);
 out_pci_disable_device:
        pci_disable_device(pdev);
 out_ieee80211_free_hw:
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 93be74a1f139..57dd34e256d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -7911,7 +7911,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                                CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
        if (err < 0) {
                IWL_DEBUG_INFO("Failed to init the card\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
        }
        /***********************
@@ -7921,7 +7921,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        err = iwl3945_eeprom_init(priv);
        if (err) {
                IWL_ERROR("Unable to init EEPROM\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
        }
        /* MAC Address location in EEPROM same for 3945/4965 */
        get_eeprom_mac(priv, priv->mac_addr);
@@ -7975,7 +7975,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        err = iwl3945_init_channel_map(priv);
        if (err) {
                IWL_ERROR("initializing regulatory failed: %d\n", err);
-                goto out_release_irq;
+                goto out_unset_hw_setting;
        }
        err = iwl3945_init_geos(priv);
@@ -8045,25 +8045,22 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
        return 0;
 out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
        sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
 out_free_geos:
        iwl3945_free_geos(priv);
 out_free_channel_map:
        iwl3945_free_channel_map(priv);
+ out_unset_hw_setting:
- out_release_irq:
-        destroy_workqueue(priv->workqueue);
-        priv->workqueue = NULL;
        iwl3945_unset_hw_setting(priv);
 out_iounmap:
        pci_iounmap(pdev, priv->hw_base);
 out_pci_release_regions:
        pci_release_regions(pdev);
 out_pci_disable_device:
-        pci_disable_device(pdev);
        pci_set_drvdata(pdev, NULL);
+        pci_disable_device(pdev);
 out_ieee80211_free_hw:
        ieee80211_free_hw(priv->hw);
 out:
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 34561e6e816b..f170106bf0ae 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -710,10 +710,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
                                           __le32 req_id)
 {
        struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
        unsigned long flags;
        spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = priv->tx_queue.next;
        while (entry != (struct sk_buff *)&priv->tx_queue) {
                struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
@@ -732,7 +733,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
        struct p54_common *priv = dev->priv;
        struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
        struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
-        struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next;
+        struct sk_buff *entry;
        u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
        struct memrecord *range = NULL;
        u32 freed = 0;
@@ -741,6 +742,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
        int count, idx;
        spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = (struct sk_buff *) priv->tx_queue.next;
        while (entry != (struct sk_buff *)&priv->tx_queue) {
                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                struct p54_hdr *entry_hdr;
@@ -976,7 +978,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                               struct p54_hdr *data, u32 len)
 {
        struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
        struct sk_buff *target_skb = NULL;
        struct ieee80211_tx_info *info;
        struct memrecord *range;
@@ -1014,6 +1016,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                }
        }
+        entry = priv->tx_queue.next;
        while (left--) {
                u32 hole_size;
                info = IEEE80211_SKB_CB(entry);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index af6b5847be5c..3e2ac2bbb12f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1952,6 +1952,8 @@ static struct usb_device_id rt2500usb_device_table[] = {
        { USB_DEVICE(0x13b1, 0x000d), USB_DEVICE_DATA(&rt2500usb_ops) },
        { USB_DEVICE(0x13b1, 0x0011), USB_DEVICE_DATA(&rt2500usb_ops) },
        { USB_DEVICE(0x13b1, 0x001a), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* CNet */
+        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* Conceptronic */
        { USB_DEVICE(0x14b2, 0x3c02), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* D-LINK */
@@ -1976,14 +1978,20 @@ static struct usb_device_id rt2500usb_device_table[] = {
        { USB_DEVICE(0x148f, 0x2570), USB_DEVICE_DATA(&rt2500usb_ops) },
        { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt2500usb_ops) },
        { USB_DEVICE(0x148f, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* Sagem */
+        { USB_DEVICE(0x079b, 0x004b), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* Siemens */
        { USB_DEVICE(0x0681, 0x3c06), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* SMC */
        { USB_DEVICE(0x0707, 0xee13), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* Spairon */
        { USB_DEVICE(0x114b, 0x0110), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* SURECOM */
+        { USB_DEVICE(0x0769, 0x11f3), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* Trust */
        { USB_DEVICE(0x0eb0, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* VTech */
+        { USB_DEVICE(0x0f88, 0x3012), USB_DEVICE_DATA(&rt2500usb_ops) },
        /* Zinwell */
        { USB_DEVICE(0x5a57, 0x0260), USB_DEVICE_DATA(&rt2500usb_ops) },
        { 0, }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 96a8d69f8790..cefee1b26cd8 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2281,7 +2281,18 @@ static const struct rt2x00_ops rt73usb_ops = {
 */
 static struct usb_device_id rt73usb_device_table[] = {
        /* AboCom */
+        { USB_DEVICE(0x07b8, 0xb21b), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21c), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x07b8, 0xb21d), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21e), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21f), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AL */
+        { USB_DEVICE(0x14b2, 0x3c10), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x148f, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0eb0, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AMIT  */
+        { USB_DEVICE(0x18c5, 0x0002), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Askey */
        { USB_DEVICE(0x1690, 0x0722), USB_DEVICE_DATA(&rt73usb_ops) },
        /* ASUS */
@@ -2294,7 +2305,9 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x050d, 0x905c), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Billionton */
        { USB_DEVICE(0x1631, 0xc019), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Buffalo */
+        { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
        /* CNet */
        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2308,6 +2321,11 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x07d1, 0x3c06), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Edimax */
+        { USB_DEVICE(0x7392, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x7392, 0x7618), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x3701), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Gemtek */
        { USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Gigabyte */
@@ -2328,22 +2346,34 @@ static struct usb_device_id rt73usb_device_table[] = {
        { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Ralink */
+        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Qcom */
        { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x18e8, 0x6238), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Samsung */
+        { USB_DEVICE(0x04e8, 0x4471), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Senao */
        { USB_DEVICE(0x1740, 0x7100), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Sitecom */
-        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0024), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0027), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002f), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x0df6, 0x90ac), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Surecom */
        { USB_DEVICE(0x0769, 0x31f3), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Philips */
+        { USB_DEVICE(0x0471, 0x200a), USB_DEVICE_DATA(&rt73usb_ops) },
        /* Planex */
        { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
        { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Zcom */
+        { USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* ZyXEL */
+        { USB_DEVICE(0x0586, 0x3415), USB_DEVICE_DATA(&rt73usb_ops) },
        { 0, }
 };
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index a24e680d2b9c..2e940199fc89 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -993,6 +993,7 @@ static int i810_check_params(struct fb_var_screeninfo *var,
        struct i810fb_par *par = info->par;
        int line_length, vidmem, mode_valid = 0, retval = 0;
        u32 vyres = var->yres_virtual, vxres = var->xres_virtual;
        /*
         *  Memory limit
         */
@@ -1002,12 +1003,12 @@ static int i810_check_params(struct fb_var_screeninfo *var,
        if (vidmem > par->fb.size) {
                vyres = par->fb.size/line_length;
                if (vyres < var->yres) {
-                        vyres = yres;
+                        vyres = info->var.yres;
                        vxres = par->fb.size/vyres;
                        vxres /= var->bits_per_pixel >> 3;
                        line_length = get_line_length(par, vxres, 
                                                      var->bits_per_pixel);
-                        vidmem = line_length * yres;
+                        vidmem = line_length * info->var.yres;
                        if (vxres < var->xres) {
                                printk("i810fb: required video memory, "
                                       "%d bytes, for %dx%d-%d (virtual) "
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 0e2b8fd24df1..2c5d069e5f06 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -446,7 +446,6 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
 {
        struct sh_mobile_lcdc_chan *ch;
        struct sh_mobile_lcdc_board_cfg *board_cfg;
-        unsigned long tmp;
        int k;
        /* tell the board code to disable the panel */
@@ -456,9 +455,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
                if (board_cfg->display_off)
                        board_cfg->display_off(board_cfg->board_data);
-                /* cleanup deferred io if SYS bus */
+                /* cleanup deferred io if enabled */
-                tmp = ch->cfg.sys_bus_cfg.deferred_io_msec;
+                if (ch->info.fbdefio) {
-                if (ch->ldmt1r_value & (1 << 12) && tmp) {
                        fb_deferred_io_cleanup(&ch->info);
                        ch->info.fbdefio = NULL;
                }
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 42491d728e99..37f31b5529aa 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -277,7 +277,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
        if (*cow_ret == buf)
                unlock_orig = 1;
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
        if (parent)
                parent_start = parent->start;
@@ -2365,7 +2365,7 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
        if (slot >= btrfs_header_nritems(upper) - 1)
                return 1;
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
        right = read_node_slot(root, upper, slot + 1);
        btrfs_tree_lock(right);
@@ -2562,7 +2562,7 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
        if (right_nritems == 0)
                return 1;
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
        left = read_node_slot(root, path->nodes[1], slot - 1);
        btrfs_tree_lock(left);
@@ -4101,7 +4101,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                next = read_node_slot(root, c, slot);
                if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(c));
+                        btrfs_assert_tree_locked(c);
                        btrfs_tree_lock(next);
                        btrfs_set_lock_blocking(next);
                }
@@ -4126,7 +4126,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                        reada_for_search(root, path, level, slot, 0);
                next = read_node_slot(root, next, 0);
                if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(path->nodes[level]));
+                        btrfs_assert_tree_locked(path->nodes[level]);
                        btrfs_tree_lock(next);
                        btrfs_set_lock_blocking(next);
                }
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index adda739a0215..3e18175248e0 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -857,7 +857,7 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
        struct inode *btree_inode = root->fs_info->btree_inode;
        if (btrfs_header_generation(buf) ==
            root->fs_info->running_transaction->transid) {
-                WARN_ON(!btrfs_tree_locked(buf));
+                btrfs_assert_tree_locked(buf);
                /* ugh, clear_extent_buffer_dirty can be expensive */
                btrfs_set_lock_blocking(buf);
@@ -2361,7 +2361,7 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
        btrfs_set_lock_blocking(buf);
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
        if (transid != root->fs_info->generation) {
                printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
                       "found %llu running %llu\n",
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6b5966aacf44..9abf81f71c46 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -4418,13 +4418,13 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
        path = btrfs_alloc_path();
        BUG_ON(!path);
-        BUG_ON(!btrfs_tree_locked(parent));
+        btrfs_assert_tree_locked(parent);
        parent_level = btrfs_header_level(parent);
        extent_buffer_get(parent);
        path->nodes[parent_level] = parent;
        path->slots[parent_level] = btrfs_header_nritems(parent);
-        BUG_ON(!btrfs_tree_locked(node));
+        btrfs_assert_tree_locked(node);
        level = btrfs_header_level(node);
        extent_buffer_get(node);
        path->nodes[level] = node;
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 85506c4a3af7..47b0a88c12a2 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -220,8 +220,8 @@ int btrfs_tree_unlock(struct extent_buffer *eb)
        return 0;
 }
-int btrfs_tree_locked(struct extent_buffer *eb)
+void btrfs_assert_tree_locked(struct extent_buffer *eb)
 {
-        return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
-                        spin_is_locked(&eb->lock);
+                assert_spin_locked(&eb->lock);
 }
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index 6bb0afbff928..6c4ce457168c 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -21,11 +21,11 @@
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
-int btrfs_tree_locked(struct extent_buffer *eb);
 int btrfs_try_tree_lock(struct extent_buffer *eb);
 int btrfs_try_spin_lock(struct extent_buffer *eb);
 void btrfs_set_lock_blocking(struct extent_buffer *eb);
 void btrfs_clear_lock_blocking(struct extent_buffer *eb);
+void btrfs_assert_tree_locked(struct extent_buffer *eb);
 #endif
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 5f3231b9633f..bff4052b05e7 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -198,9 +198,6 @@ static int mknod_ptmx(struct super_block *sb)
        fsi->ptmx_dentry = dentry;
        rc = 0;
-        printk(KERN_DEBUG "Created ptmx node in devpts ino %lu\n",
-                        inode->i_ino);
 out:
        mutex_unlock(&root->d_inode->i_mutex);
        return rc;
@@ -369,8 +366,6 @@ static int new_pts_mount(struct file_system_type *fs_type, int flags,
        struct pts_fs_info *fsi;
        struct pts_mount_opts *opts;
-        printk(KERN_NOTICE "devpts: newinstance mount\n");
        err = get_sb_nodev(fs_type, flags, data, devpts_fill_super, mnt);
        if (err)
                return err;
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 384b38d3e8e2..161042746afc 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -234,7 +234,6 @@ struct cpufreq_driver {
        int     (*suspend)      (struct cpufreq_policy *policy, pm_message_t pmsg);
        int     (*resume)       (struct cpufreq_policy *policy);
        struct freq_attr        **attr;
-        bool                    hide_interface;
 };
 /* flags */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index ec54785d34f9..659366734f3f 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1079,6 +1079,7 @@ extern void		synchronize_net(void);
 extern int              register_netdevice_notifier(struct notifier_block *nb);
 extern int              unregister_netdevice_notifier(struct notifier_block *nb);
 extern int              init_dummy_netdev(struct net_device *dev);
+extern void             netdev_resync_ops(struct net_device *dev);
 extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 extern struct net_device        *dev_get_by_index(struct net *net, int ifindex);
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 6fc13d905c5f..ded434b032a4 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -109,11 +109,6 @@ extern struct list_head net_namespace_list;
 #ifdef CONFIG_NET_NS
 extern void __put_net(struct net *net);
-static inline int net_alive(struct net *net)
-{
-        return net && atomic_read(&net->count);
-}
 static inline struct net *get_net(struct net *net)
 {
        atomic_inc(&net->count);
@@ -145,11 +140,6 @@ int net_eq(const struct net *net1, const struct net *net2)
 }
 #else
-static inline int net_alive(struct net *net)
-{
-        return 1;
-}
 static inline struct net *get_net(struct net *net)
 {
        return net;
@@ -234,6 +224,23 @@ struct pernet_operations {
        void (*exit)(struct net *net);
 };
+/*
+ * Use these carefully.  If you implement a network device and it
+ * needs per network namespace operations use device pernet operations,
+ * otherwise use pernet subsys operations.
+ *
+ * This is critically important.  Most of the network code cleanup
+ * runs with the assumption that dev_remove_pack has been called so no
+ * new packets will arrive during and after the cleanup functions have
+ * been called.  dev_remove_pack is not per namespace so instead the
+ * guarantee of no more packets arriving in a network namespace is
+ * provided by ensuring that all network devices and all sockets have
+ * left the network namespace before the cleanup methods are called.
+ *
+ * For the longest time the ipv4 icmp code was registered as a pernet
+ * device which caused kernel oops, and panics during network
+ * namespace cleanup.   So please don't get this wrong.
+ */
 extern int register_pernet_subsys(struct pernet_operations *);
 extern void unregister_pernet_subsys(struct pernet_operations *);
 extern int register_pernet_gen_subsys(int *id, struct pernet_operations *);
diff --git a/init/Kconfig b/init/Kconfig
index 95a66131403a..38396ec7ee36 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -735,6 +735,9 @@ config CC_OPTIMIZE_FOR_SIZE
 config SYSCTL
        bool
+config ANON_INODES
+        bool
 menuconfig EMBEDDED
        bool "Configure standard kernel features (for small systems)"
        help
@@ -840,18 +843,6 @@ config PCSPKR_PLATFORM
          This option allows to disable the internal PC-Speaker
          support, saving some memory.
-config COMPAT_BRK
-        bool "Disable heap randomization"
-        default y
-        help
-          Randomizing heap placement makes heap exploits harder, but it
-          also breaks ancient binaries (including anything libc5 based).
-          This option changes the bootup default to heap randomization
-          disabled, and can be overriden runtime by setting
-          /proc/sys/kernel/randomize_va_space to 2.
-          On non-ancient distros (post-2000 ones) N is usually a safe choice.
 config BASE_FULL
        default y
        bool "Enable full-sized data structures for core" if EMBEDDED
@@ -869,9 +860,6 @@ config FUTEX
          support for "fast userspace mutexes".  The resulting kernel may not
          run glibc-based applications correctly.
-config ANON_INODES
-        bool
 config EPOLL
        bool "Enable eventpoll support" if EMBEDDED
        default y
@@ -957,6 +945,18 @@ config SLUB_DEBUG
          SLUB sysfs support. /sys/slab will not exist and there will be
          no support for cache validation etc.
+config COMPAT_BRK
+        bool "Disable heap randomization"
+        default y
+        help
+          Randomizing heap placement makes heap exploits harder, but it
+          also breaks ancient binaries (including anything libc5 based).
+          This option changes the bootup default to heap randomization
+          disabled, and can be overriden runtime by setting
+          /proc/sys/kernel/randomize_va_space to 2.
+          On non-ancient distros (post-2000 ones) N is usually a safe choice.
 choice
        prompt "Choose SLAB allocator"
        default SLUB
diff --git a/kernel/fork.c b/kernel/fork.c
index 8de303bdd4e5..6715ebc3761d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1184,10 +1184,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
        clear_all_latency_tracing(p);
-        /* Our parent execution domain becomes current domain
-           These must match for thread signalling to apply */
-        p->parent_exec_id = p->self_exec_id;
        /* ok, now we should be set up.. */
        p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
        p->pdeath_signal = 0;
@@ -1225,10 +1221,13 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                set_task_cpu(p, smp_processor_id());
        /* CLONE_PARENT re-uses the old parent */
-        if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+        if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
                p->real_parent = current->real_parent;
-        else
+                p->parent_exec_id = current->parent_exec_id;
+        } else {
                p->real_parent = current;
+                p->parent_exec_id = current->self_exec_id;
+        }
        spin_lock(&current->sighand->siglock);
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index 43f891b05a4b..00d59d048edf 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -122,8 +122,10 @@ void acct_update_integrals(struct task_struct *tsk)
        if (likely(tsk->mm)) {
                cputime_t time, dtime;
                struct timeval value;
+                unsigned long flags;
                u64 delta;
+                local_irq_save(flags);
                time = tsk->stime + tsk->utime;
                dtime = cputime_sub(time, tsk->acct_timexpd);
                jiffies_to_timeval(cputime_to_jiffies(dtime), &value);
@@ -131,10 +133,12 @@ void acct_update_integrals(struct task_struct *tsk)
                delta = delta * USEC_PER_SEC + value.tv_usec;
                if (delta == 0)
-                        return;
+                        goto out;
                tsk->acct_timexpd = time;
                tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm);
                tsk->acct_vm_mem1 += delta * tsk->mm->total_vm;
+        out:
+                local_irq_restore(flags);
        }
 }
diff --git a/kernel/user.c b/kernel/user.c
index 6a9b696128c8..fbb300e6191f 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -286,14 +286,12 @@ int __init uids_sysfs_init(void)
 /* work function to remove sysfs directory for a user and free up
 * corresponding structures.
 */
-static void remove_user_sysfs_dir(struct work_struct *w)
+static void cleanup_user_struct(struct work_struct *w)
 {
        struct user_struct *up = container_of(w, struct user_struct, work);
        unsigned long flags;
        int remove_user = 0;
-        if (up->user_ns != &init_user_ns)
-                return;
        /* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
         * atomic.
         */
@@ -312,9 +310,11 @@ static void remove_user_sysfs_dir(struct work_struct *w)
        if (!remove_user)
                goto done;
-        kobject_uevent(&up->kobj, KOBJ_REMOVE);
+        if (up->user_ns == &init_user_ns) {
-        kobject_del(&up->kobj);
+                kobject_uevent(&up->kobj, KOBJ_REMOVE);
-        kobject_put(&up->kobj);
+                kobject_del(&up->kobj);
+                kobject_put(&up->kobj);
+        }
        sched_destroy_user(up);
        key_put(up->uid_keyring);
@@ -335,7 +335,7 @@ static void free_user(struct user_struct *up, unsigned long flags)
        atomic_inc(&up->__count);
        spin_unlock_irqrestore(&uidhash_lock, flags);
-        INIT_WORK(&up->work, remove_user_sysfs_dir);
+        INIT_WORK(&up->work, cleanup_user_struct);
        schedule_work(&up->work);
 }
diff --git a/lib/idr.c b/lib/idr.c
index c11c5765cdef..dab4bca86f5d 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -449,6 +449,7 @@ void idr_remove_all(struct idr *idp)
        n = idp->layers * IDR_BITS;
        p = idp->top;
+        rcu_assign_pointer(idp->top, NULL);
        max = 1 << n;
        id = 0;
@@ -467,7 +468,6 @@ void idr_remove_all(struct idr *idp)
                        p = *--paa;
                }
        }
-        rcu_assign_pointer(idp->top, NULL);
        idp->layers = 0;
 }
 EXPORT_SYMBOL(idr_remove_all);
diff --git a/net/802/tr.c b/net/802/tr.c
index 158150fee462..f47ae289d83b 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -668,3 +668,5 @@ module_init(rif_init);
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
+MODULE_LICENSE("GPL");
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4a19acd3a32b..1b34135cf990 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -553,7 +553,7 @@ static int vlan_dev_neigh_setup(struct net_device *dev, struct neigh_parms *pa)
        int err = 0;
        if (netif_device_present(real_dev) && ops->ndo_neigh_setup)
-                err = ops->ndo_neigh_setup(dev, pa);
+                err = ops->ndo_neigh_setup(real_dev, pa);
        return err;
 }
@@ -639,6 +639,7 @@ static int vlan_dev_init(struct net_device *dev)
                dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
                dev->netdev_ops         = &vlan_netdev_ops;
        }
+        netdev_resync_ops(dev);
        if (is_vlan_dev(real_dev))
                subclass = 1;
diff --git a/net/core/dev.c b/net/core/dev.c
index 72b0d26fd46d..f1129706ce7b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2267,12 +2267,6 @@ int netif_receive_skb(struct sk_buff *skb)
        rcu_read_lock();
-        /* Don't receive packets in an exiting network namespace */
-        if (!net_alive(dev_net(skb->dev))) {
-                kfree_skb(skb);
-                goto out;
-        }
 #ifdef CONFIG_NET_CLS_ACT
        if (skb->tc_verd & TC_NCLS) {
                skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -4288,6 +4282,39 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 }
 EXPORT_SYMBOL(netdev_fix_features);
+/* Some devices need to (re-)set their netdev_ops inside
+ * ->init() or similar.  If that happens, we have to setup
+ * the compat pointers again.
+ */
+void netdev_resync_ops(struct net_device *dev)
+{
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
+        const struct net_device_ops *ops = dev->netdev_ops;
+        dev->init = ops->ndo_init;
+        dev->uninit = ops->ndo_uninit;
+        dev->open = ops->ndo_open;
+        dev->change_rx_flags = ops->ndo_change_rx_flags;
+        dev->set_rx_mode = ops->ndo_set_rx_mode;
+        dev->set_multicast_list = ops->ndo_set_multicast_list;
+        dev->set_mac_address = ops->ndo_set_mac_address;
+        dev->validate_addr = ops->ndo_validate_addr;
+        dev->do_ioctl = ops->ndo_do_ioctl;
+        dev->set_config = ops->ndo_set_config;
+        dev->change_mtu = ops->ndo_change_mtu;
+        dev->neigh_setup = ops->ndo_neigh_setup;
+        dev->tx_timeout = ops->ndo_tx_timeout;
+        dev->get_stats = ops->ndo_get_stats;
+        dev->vlan_rx_register = ops->ndo_vlan_rx_register;
+        dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
+        dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = ops->ndo_poll_controller;
+#endif
+#endif
+}
+EXPORT_SYMBOL(netdev_resync_ops);
 /**
 *      register_netdevice      - register a network device
 *      @dev: device to register
@@ -4332,27 +4359,7 @@ int register_netdevice(struct net_device *dev)
         * This is temporary until all network devices are converted.
         */
        if (dev->netdev_ops) {
-                const struct net_device_ops *ops = dev->netdev_ops;
+                netdev_resync_ops(dev);
-                dev->init = ops->ndo_init;
-                dev->uninit = ops->ndo_uninit;
-                dev->open = ops->ndo_open;
-                dev->change_rx_flags = ops->ndo_change_rx_flags;
-                dev->set_rx_mode = ops->ndo_set_rx_mode;
-                dev->set_multicast_list = ops->ndo_set_multicast_list;
-                dev->set_mac_address = ops->ndo_set_mac_address;
-                dev->validate_addr = ops->ndo_validate_addr;
-                dev->do_ioctl = ops->ndo_do_ioctl;
-                dev->set_config = ops->ndo_set_config;
-                dev->change_mtu = ops->ndo_change_mtu;
-                dev->tx_timeout = ops->ndo_tx_timeout;
-                dev->get_stats = ops->ndo_get_stats;
-                dev->vlan_rx_register = ops->ndo_vlan_rx_register;
-                dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-                dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                dev->poll_controller = ops->ndo_poll_controller;
-#endif
        } else {
                char drivername[64];
                pr_info("%s (%s): not using net_device_ops yet\n",
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 6ac29a46e23e..484f58750eba 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -77,7 +77,9 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
        if (endp == buf)
                goto err;
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
        if (dev_isalive(net)) {
                if ((ret = (*set)(net, new)) == 0)
                        ret = len;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 2adb1a7d361f..e3bebd36f053 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -157,9 +157,6 @@ static void cleanup_net(struct work_struct *work)
        struct pernet_operations *ops;
        struct net *net;
-        /* Be very certain incoming network packets will not find us */
-        rcu_barrier();
        net = container_of(work, struct net, work);
        mutex_lock(&net_mutex);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 705b33b184a3..fc562d29cc46 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1205,7 +1205,7 @@ static struct pernet_operations __net_initdata icmp_sk_ops = {
 int __init icmp_init(void)
 {
-        return register_pernet_device(&icmp_sk_ops);
+        return register_pernet_subsys(&icmp_sk_ops);
 }
 EXPORT_SYMBOL(icmp_err_convert);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 19d7b429a262..cf74c416831a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2443,7 +2443,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
 void __init tcp_v4_init(void)
 {
        inet_hashinfo_init(&tcp_hashinfo);
-        if (register_pernet_device(&tcp_sk_ops))
+        if (register_pernet_subsys(&tcp_sk_ops))
                panic("Failed to create the TCP control socket.\n");
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f9afb452249c..1220e2c7831e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -493,15 +493,17 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        read_unlock(&dev_base_lock);
 }
-static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 {
        struct net *net;
        net = (struct net *)table->extra2;
        if (p == &net->ipv6.devconf_dflt->forwarding)
-                return;
+                return 0;
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
-        rtnl_lock();
        if (p == &net->ipv6.devconf_all->forwarding) {
                __s32 newf = net->ipv6.devconf_all->forwarding;
                net->ipv6.devconf_dflt->forwarding = newf;
@@ -512,6 +514,7 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
        if (*p)
                rt6_purge_dflt_routers(net);
+        return 1;
 }
 #endif
@@ -2608,9 +2611,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        ASSERT_RTNL();
-        if ((dev->flags & IFF_LOOPBACK) && how == 1)
-                how = 0;
        rt6_ifdown(net, dev);
        neigh_ifdown(&nd_tbl, dev);
@@ -3983,7 +3983,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
        if (write)
-                addrconf_fixup_forwarding(ctl, valp, val);
+                ret = addrconf_fixup_forwarding(ctl, valp, val);
        return ret;
 }
@@ -4019,8 +4019,7 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
        }
        *valp = new;
-        addrconf_fixup_forwarding(table, valp, val);
+        return addrconf_fixup_forwarding(table, valp, val);
-        return 1;
 }
 static struct addrconf_sysctl_table
@@ -4446,25 +4445,6 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
-static void addrconf_net_exit(struct net *net)
-{
-        struct net_device *dev;
-        rtnl_lock();
-        /* clean dev list */
-        for_each_netdev(net, dev) {
-                if (__in6_dev_get(dev) == NULL)
-                        continue;
-                addrconf_ifdown(dev, 1);
-        }
-        addrconf_ifdown(net->loopback_dev, 2);
-        rtnl_unlock();
-}
-static struct pernet_operations addrconf_net_ops = {
-        .exit = addrconf_net_exit,
-};
 /*
 *      Init / cleanup code
 */
@@ -4506,10 +4486,6 @@ int __init addrconf_init(void)
        if (err)
                goto errlo;
-        err = register_pernet_device(&addrconf_net_ops);
-        if (err)
-                return err;
        register_netdevice_notifier(&ipv6_dev_notf);
        addrconf_verify(0);
@@ -4539,15 +4515,22 @@ errlo:
 void addrconf_cleanup(void)
 {
        struct inet6_ifaddr *ifa;
+        struct net_device *dev;
        int i;
        unregister_netdevice_notifier(&ipv6_dev_notf);
-        unregister_pernet_device(&addrconf_net_ops);
        unregister_pernet_subsys(&addrconf_ops);
        rtnl_lock();
+        /* clean dev list */
+        for_each_netdev(&init_net, dev) {
+                if (__in6_dev_get(dev) == NULL)
+                        continue;
+                addrconf_ifdown(dev, 1);
+        }
+        addrconf_ifdown(init_net.loopback_dev, 2);
        /*
         *      Check hash table.
         */
@@ -4568,6 +4551,4 @@ void addrconf_cleanup(void)
        del_timer(&addr_chk_timer);
        rtnl_unlock();
-        unregister_pernet_subsys(&addrconf_net_ops);
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c802bc1658a8..da944eca2ca6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -72,6 +72,10 @@ MODULE_LICENSE("GPL");
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
+static int disable_ipv6 = 0;
+module_param_named(disable, disable_ipv6, int, 0);
+MODULE_PARM_DESC(disable, "Disable IPv6 such that it is non-functional");
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
        const int offset = sk->sk_prot->obj_size - sizeof(struct ipv6_pinfo);
@@ -991,10 +995,21 @@ static int __init inet6_init(void)
 {
        struct sk_buff *dummy_skb;
        struct list_head *r;
-        int err;
+        int err = 0;
        BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
+        /* Register the socket-side information for inet6_create.  */
+        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+                INIT_LIST_HEAD(r);
+        if (disable_ipv6) {
+                printk(KERN_INFO
+                       "IPv6: Loaded, but administratively disabled, "
+                       "reboot required to enable\n");
+                goto out;
+        }
        err = proto_register(&tcpv6_prot, 1);
        if (err)
                goto out;
@@ -1012,10 +1027,6 @@ static int __init inet6_init(void)
                goto out_unregister_udplite_proto;
-        /* Register the socket-side information for inet6_create.  */
-        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
-                INIT_LIST_HEAD(r);
        /* We MUST register RAW sockets before we create the ICMP6,
         * IGMP6, or NDISC control sockets.
         */
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9eb895c7a2a9..3ae3cb816563 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1084,6 +1084,13 @@ out:
        return 0;
 }
+/**
+ * netlink_set_err - report error to broadcast listeners
+ * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
+ * @pid: the PID of a process that we want to skip (if any)
+ * @groups: the broadcast group that will notice the error
+ * @code: error code, must be negative (as usual in kernelspace)
+ */
 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
        struct netlink_set_err_data info;
@@ -1093,7 +1100,8 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
        info.exclude_sk = ssk;
        info.pid = pid;
        info.group = group;
-        info.code = code;
+        /* sk->sk_err wants a positive error value */
+        info.code = -code;
        read_lock(&nl_table_lock);
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 5c72a116b1a4..f8f047b61245 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -183,13 +183,6 @@ override:
                if (R_tab == NULL)
                        goto failure;
-                if (!est && (ret == ACT_P_CREATED ||
-                             !gen_estimator_active(&police->tcf_bstats,
-                                                   &police->tcf_rate_est))) {
-                        err = -EINVAL;
-                        goto failure;
-                }
                if (parm->peakrate.rate) {
                        P_tab = qdisc_get_rtab(&parm->peakrate,
                                               tb[TCA_POLICE_PEAKRATE]);
@@ -205,6 +198,12 @@ override:
                                            &police->tcf_lock, est);
                if (err)
                        goto failure_unlock;
+        } else if (tb[TCA_POLICE_AVRATE] &&
+                   (ret == ACT_P_CREATED ||
+                    !gen_estimator_active(&police->tcf_bstats,
+                                          &police->tcf_rate_est))) {
+                err = -EINVAL;
+                goto failure_unlock;
        }
        /* No failure allowed after this point */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b78e3be69013..c4986d0f7419 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -717,15 +717,20 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
 static int sctp_ctl_sock_init(void)
 {
        int err;
-        sa_family_t family;
+        sa_family_t family = PF_INET;
        if (sctp_get_pf_specific(PF_INET6))
                family = PF_INET6;
-        else
-                family = PF_INET;
        err = inet_ctl_sock_create(&sctp_ctl_sock, family,
                                   SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
+        /* If IPv6 socket could not be created, try the IPv4 socket */
+        if (err < 0 && family == PF_INET6)
+                err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
+                                           SOCK_SEQPACKET, IPPROTO_SCTP,
+                                           &init_net);
        if (err < 0) {
                printk(KERN_ERR
                       "SCTP: Failed to create the SCTP control socket.\n");
@@ -1322,9 +1327,8 @@ SCTP_STATIC __init int sctp_init(void)
 out:
        return status;
 err_v6_add_protocol:
-        sctp_v6_del_protocol();
-err_add_protocol:
        sctp_v4_del_protocol();
+err_add_protocol:
        inet_ctl_sock_destroy(sctp_ctl_sock);
 err_ctl_sock_init:
        sctp_v6_protosw_exit();
@@ -1335,7 +1339,6 @@ err_protosw_init:
        sctp_v4_pf_exit();
        sctp_v6_pf_exit();
        sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
        free_pages((unsigned long)sctp_port_hashtable,
                   get_order(sctp_port_hashsize *
                             sizeof(struct sctp_bind_hashbucket)));
@@ -1383,7 +1386,6 @@ SCTP_STATIC __exit void sctp_exit(void)
        sctp_v4_pf_exit();
        sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
        free_pages((unsigned long)sctp_assoc_hashtable,
                   get_order(sctp_assoc_hashsize *
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index e1d6076b4f59..b5495aecab60 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -787,36 +787,48 @@ static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds,
                                   struct sctp_association *asoc,
                                   struct sctp_chunk *chunk)
 {
-        struct sctp_operr_chunk *operr_chunk;
        struct sctp_errhdr *err_hdr;
+        struct sctp_ulpevent *ev;
-        operr_chunk = (struct sctp_operr_chunk *)chunk->chunk_hdr;
+        while (chunk->chunk_end > chunk->skb->data) {
-        err_hdr = &operr_chunk->err_hdr;
+                err_hdr = (struct sctp_errhdr *)(chunk->skb->data);
-        switch (err_hdr->cause) {
+                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
-        case SCTP_ERROR_UNKNOWN_CHUNK:
+                                                     GFP_ATOMIC);
-        {
+                if (!ev)
-                struct sctp_chunkhdr *unk_chunk_hdr;
+                        return;
-                unk_chunk_hdr = (struct sctp_chunkhdr *)err_hdr->variable;
+                sctp_ulpq_tail_event(&asoc->ulpq, ev);
-                switch (unk_chunk_hdr->type) {
-                /* ADDIP 4.1 A9) If the peer responds to an ASCONF with an
+                switch (err_hdr->cause) {
-                 * ERROR chunk reporting that it did not recognized the ASCONF
+                case SCTP_ERROR_UNKNOWN_CHUNK:
-                 * chunk type, the sender of the ASCONF MUST NOT send any
+                {
-                 * further ASCONF chunks and MUST stop its T-4 timer.
+                        sctp_chunkhdr_t *unk_chunk_hdr;
-                 */
-                case SCTP_CID_ASCONF:
+                        unk_chunk_hdr = (sctp_chunkhdr_t *)err_hdr->variable;
-                        asoc->peer.asconf_capable = 0;
+                        switch (unk_chunk_hdr->type) {
-                        sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
+                        /* ADDIP 4.1 A9) If the peer responds to an ASCONF with
+                         * an ERROR chunk reporting that it did not recognized
+                         * the ASCONF chunk type, the sender of the ASCONF MUST
+                         * NOT send any further ASCONF chunks and MUST stop its
+                         * T-4 timer.
+                         */
+                        case SCTP_CID_ASCONF:
+                                if (asoc->peer.asconf_capable == 0)
+                                        break;
+                                asoc->peer.asconf_capable = 0;
+                                sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
                                        SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+                                break;
+                        default:
+                                break;
+                        }
                        break;
+                }
                default:
                        break;
                }
-                break;
-        }
-        default:
-                break;
        }
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 3a0cd075914f..f88dfded0e3a 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3163,7 +3163,6 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                                        sctp_cmd_seq_t *commands)
 {
        struct sctp_chunk *chunk = arg;
-        struct sctp_ulpevent *ev;
        if (!sctp_vtag_verify(chunk, asoc))
                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3173,21 +3172,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                  commands);
-        while (chunk->chunk_end > chunk->skb->data) {
+        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
+                        SCTP_CHUNK(chunk));
-                                                     GFP_ATOMIC);
-                if (!ev)
-                        goto nomem;
-                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
-                                SCTP_ULPEVENT(ev));
-                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-                                SCTP_CHUNK(chunk));
-        }
        return SCTP_DISPOSITION_CONSUME;
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 /*
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 85c9034c59b2..bd0a16c3de5e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -380,7 +380,8 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
        freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
-        if (freq_diff <= 0 || freq_range->max_bandwidth_khz > freq_diff)
+        if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
+                        freq_range->max_bandwidth_khz > freq_diff)
                return false;
        return true;