35 files changed, 223 insertions, 187 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 870d190fe617..0a46833c1b76 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -493,3 +493,52 @@ Why:	These two features use non-standard interfaces. There are the
 Who:    Corentin Chary <corentin.chary@gmail.com>
 
 ----------------------------
+
+What:   usbvideo quickcam_messenger driver
+When:   2.6.35
+Files:  drivers/media/video/usbvideo/quickcam_messenger.[ch]
+Why:    obsolete v4l1 driver replaced by gspca_stv06xx
+Who:    Hans de Goede <hdegoede@redhat.com>
+
+----------------------------
+
+What:   ov511 v4l1 driver
+When:   2.6.35
+Files:  drivers/media/video/ov511.[ch]
+Why:    obsolete v4l1 driver replaced by gspca_ov519
+Who:    Hans de Goede <hdegoede@redhat.com>
+
+----------------------------
+
+What:   w9968cf v4l1 driver
+When:   2.6.35
+Files:  drivers/media/video/w9968cf*.[ch]
+Why:    obsolete v4l1 driver replaced by gspca_ov519
+Who:    Hans de Goede <hdegoede@redhat.com>
+
+----------------------------
+
+What:   ovcamchip sensor framework
+When:   2.6.35
+Files:  drivers/media/video/ovcamchip/*
+Why:    Only used by obsoleted v4l1 drivers
+Who:    Hans de Goede <hdegoede@redhat.com>
+
+----------------------------
+
+What:   stv680 v4l1 driver
+When:   2.6.35
+Files:  drivers/media/video/stv680.[ch]
+Why:    obsolete v4l1 driver replaced by gspca_stv0680
+Who:    Hans de Goede <hdegoede@redhat.com>
+
+----------------------------
+
+What:   zc0301 v4l driver
+When:   2.6.35
+Files:  drivers/media/video/zc0301/*
+Why:    Duplicate functionality with the gspca_zc3xx driver, zc0301 only
+        supports 2 USB-ID's (because it only supports a limited set of
+        sensors) wich are also supported by the gspca_zc3xx driver
+        (which supports 53 USB-ID's in total)
+Who:    Hans de Goede <hdegoede@redhat.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index 3f591629e953..1858646b52e3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1637,9 +1637,8 @@ S:	Maintained
 F:      sound/pci/cs5535audio/
 
 CX18 VIDEO4LINUX DRIVER
-M:      Hans Verkuil <hverkuil@xs4all.nl>
 M:      Andy Walls <awalls@radix.net>
-L:      ivtv-devel@ivtvdriver.org
+L:      ivtv-devel@ivtvdriver.org (moderated for non-subscribers)
 L:      linux-media@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 W:      http://linuxtv.org
@@ -3011,8 +3010,8 @@ S:	Maintained
 F:      drivers/isdn/hardware/eicon/
 
 IVTV VIDEO4LINUX DRIVER
-M:      Hans Verkuil <hverkuil@xs4all.nl>
-L:      ivtv-devel@ivtvdriver.org
+M:      Andy Walls <awalls@radix.net>
+L:      ivtv-devel@ivtvdriver.org (moderated for non-subscribers)
 L:      linux-media@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6.git
 W:      http://www.ivtvdriver.org
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 51069245b79a..3b3c36601a7b 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -125,50 +125,36 @@ void mconsole_log(struct mc_request *req)
 void mconsole_proc(struct mc_request *req)
 {
         struct nameidata nd;
-        struct file_system_type *proc;
-        struct super_block *super;
+        struct vfsmount *mnt = current->nsproxy->pid_ns->proc_mnt;
         struct file *file;
         int n, err;
         char *ptr = req->request.data, *buf;
+        mm_segment_t old_fs = get_fs();
 
         ptr += strlen("proc");
         ptr = skip_spaces(ptr);
 
-        proc = get_fs_type("proc");
-        if (proc == NULL) {
-                mconsole_reply(req, "procfs not registered", 1, 0);
+        err = vfs_path_lookup(mnt->mnt_root, mnt, ptr, LOOKUP_FOLLOW, &nd);
+        if (err) {
+                mconsole_reply(req, "Failed to look up file", 1, 0);
                 goto out;
         }
 
-        super = (*proc->get_sb)(proc, 0, NULL, NULL);
-        put_filesystem(proc);
-        if (super == NULL) {
-                mconsole_reply(req, "Failed to get procfs superblock", 1, 0);
+        err = may_open(&nd.path, MAY_READ, FMODE_READ);
+        if (result) {
+                mconsole_reply(req, "Failed to open file", 1, 0);
+                path_put(&nd.path);
                 goto out;
         }
-        up_write(&super->s_umount);
-
-        nd.path.dentry = super->s_root;
-        nd.path.mnt = NULL;
-        nd.flags = O_RDONLY + 1;
-        nd.last_type = LAST_ROOT;
-
-        /* START: it was experienced that the stability problems are closed
-         * if commenting out these two calls + the below read cycle. To
-         * make UML crash again, it was enough to readd either one.*/
-        err = link_path_walk(ptr, &nd);
-        if (err) {
-                mconsole_reply(req, "Failed to look up file", 1, 0);
-                goto out_kill;
-        }
 
         file = dentry_open(nd.path.dentry, nd.path.mnt, O_RDONLY,
                            current_cred());
+        err = PTR_ERR(file);
         if (IS_ERR(file)) {
                 mconsole_reply(req, "Failed to open file", 1, 0);
-                goto out_kill;
+                path_put(&nd.path);
+                goto out;
         }
-        /*END*/
 
         buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
         if (buf == NULL) {
@@ -176,10 +162,13 @@ void mconsole_proc(struct mc_request *req)
                 goto out_fput;
         }
 
-        if ((file->f_op != NULL) && (file->f_op->read != NULL)) {
+        if (file->f_op->read) {
                 do {
-                        n = (*file->f_op->read)(file, buf, PAGE_SIZE - 1,
-                                                &file->f_pos);
+                        loff_t pos;
+                        set_fs(KERNEL_DS);
+                        n = vfs_read(file, buf, PAGE_SIZE - 1, &pos);
+                        file_pos_write(file, pos);
+                        set_fs(old_fs);
                         if (n >= 0) {
                                 buf[n] = '\0';
                                 mconsole_reply(req, buf, 0, (n > 0));
@@ -197,8 +186,6 @@ void mconsole_proc(struct mc_request *req)
         kfree(buf);
  out_fput:
         fput(file);
- out_kill:
-        deactivate_super(super);
  out: ;
 }
 #endif
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index bff7a5356037..b521ed9d6e2e 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -13,7 +13,7 @@
  */
 
 
-#include <linux/usb/input.h>
+#include <linux/input.h>
 #include <media/ir-common.h>
 
 #define IR_TAB_MIN_SIZE 32
diff --git a/drivers/media/common/tuners/tda8290.c b/drivers/media/common/tuners/tda8290.c
index c190b0dedee4..2833137fa819 100644
--- a/drivers/media/common/tuners/tda8290.c
+++ b/drivers/media/common/tuners/tda8290.c
@@ -144,7 +144,8 @@ static void set_audio(struct dvb_frontend *fe,
         }
 
         if (params->mode == V4L2_TUNER_RADIO) {
-                priv->tda8290_easy_mode = 0x01;         /* Start with MN values */
+                /* Set TDA8295 to FM radio; Start TDA8290 with MN values */
+                priv->tda8290_easy_mode = (priv->ver & TDA8295) ? 0x80 : 0x01;
                 tuner_dbg("setting to radio FM\n");
         } else {
                 tuner_dbg("setting tda829x to system %s\n", mode);
@@ -672,16 +673,19 @@ static int tda8290_probe(struct tuner_i2c_props *i2c_props)
 static int tda8295_probe(struct tuner_i2c_props *i2c_props)
 {
 #define TDA8295_ID 0x8a
+#define TDA8295C2_ID 0x8b
         unsigned char tda8295_id[] = { 0x2f, 0x00 };
 
         /* detect tda8295 */
         tuner_i2c_xfer_send(i2c_props, &tda8295_id[0], 1);
         tuner_i2c_xfer_recv(i2c_props, &tda8295_id[1], 1);
 
-        if (tda8295_id[1] == TDA8295_ID) {
+        if ((tda8295_id[1] & 0xfe) == TDA8295_ID) {
                 if (debug)
-                        printk(KERN_DEBUG "%s: tda8295 detected @ %d-%04x\n",
-                               __func__, i2c_adapter_id(i2c_props->adap),
+                        printk(KERN_DEBUG "%s: %s detected @ %d-%04x\n",
+                               __func__, (tda8295_id[1] == TDA8295_ID) ?
+                               "tda8295c1" : "tda8295c2",
+                               i2c_adapter_id(i2c_props->adap),
                                i2c_props->addr);
                 return 0;
         }
diff --git a/drivers/media/dvb/frontends/dib8000.h b/drivers/media/dvb/frontends/dib8000.h
index d99619ae983c..b1ee20799639 100644
--- a/drivers/media/dvb/frontends/dib8000.h
+++ b/drivers/media/dvb/frontends/dib8000.h
@@ -100,7 +100,7 @@ static inline int dib8000_set_tune_state(struct dvb_frontend *fe, enum frontend_
 static inline enum frontend_tune_state dib8000_get_tune_state(struct dvb_frontend *fe)
 {
         printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
-    return CT_SHUTDOWN,
+        return CT_SHUTDOWN;
 }
 static inline void dib8000_pwm_agc_reset(struct dvb_frontend *fe)
 {
diff --git a/drivers/media/dvb/frontends/lgdt3305.h b/drivers/media/dvb/frontends/lgdt3305.h
index 4fa6e52d1fe8..9cb11c9cae53 100644
--- a/drivers/media/dvb/frontends/lgdt3305.h
+++ b/drivers/media/dvb/frontends/lgdt3305.h
@@ -54,13 +54,13 @@ struct lgdt3305_config {
         u16 usref_qam256; /* default: 0x2a80 */
 
         /* disable i2c repeater - 0:repeater enabled 1:repeater disabled */
-        int deny_i2c_rptr:1;
+        unsigned int deny_i2c_rptr:1;
 
         /* spectral inversion - 0:disabled 1:enabled */
-        int spectral_inversion:1;
+        unsigned int spectral_inversion:1;
 
         /* use RF AGC loop - 0:disabled 1:enabled */
-        int rf_agc_loop:1;
+        unsigned int rf_agc_loop:1;
 
         enum lgdt3305_mpeg_mode mpeg_mode;
         enum lgdt3305_tp_clock_edge tpclk_edge;
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index e930a67d526b..bd6214d4ab3b 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -1815,6 +1815,8 @@ static int vidioc_qbuf(struct file *file, void *priv,
         /* put the buffer in the 'queued' queue */
         i = gspca_dev->fr_q;
         gspca_dev->fr_queue[i] = index;
+        if (gspca_dev->fr_i == i)
+                gspca_dev->cur_frame = frame;
         gspca_dev->fr_q = (i + 1) % gspca_dev->nframes;
         PDEBUG(D_FRAM, "qbuf q:%d i:%d o:%d",
                 gspca_dev->fr_q,
diff --git a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
index aa2f3c7e2cb5..1b536f7d30cf 100644
--- a/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
+++ b/drivers/media/video/gspca/m5602/m5602_s5k4aa.c
@@ -48,6 +48,12 @@ static
                         DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xa 2528")
                 }
         }, {
+                .ident = "Fujitsu-Siemens Amilo Xi 2428",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 2428")
+                }
+        }, {
                 .ident = "Fujitsu-Siemens Amilo Xi 2528",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
diff --git a/drivers/media/video/gspca/ov534.c b/drivers/media/video/gspca/ov534.c
index 4dbb882c83dc..0a6b8f07a69d 100644
--- a/drivers/media/video/gspca/ov534.c
+++ b/drivers/media/video/gspca/ov534.c
@@ -1533,7 +1533,7 @@ static void setexposure_96(struct gspca_dev *gspca_dev)
 static void setsharpness_96(struct gspca_dev *gspca_dev)
 {
         struct sd *sd = (struct sd *) gspca_dev;
-        u8 val;
+        s8 val;
 
         val = sd->sharpness;
         if (val < 0) {                          /* auto */
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 4cff8035614f..0ca1c06652b1 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2319,7 +2319,7 @@ static void do_autogain(struct gspca_dev *gspca_dev, u16 avg_lum)
                 }
         }
         if (avg_lum > MAX_AVG_LUM) {
-                if (sd->gain - 1 >= 0) {
+                if (sd->gain >= 1) {
                         sd->gain--;
                         set_gain(gspca_dev);
                 }
diff --git a/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h b/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
index 487d40555343..96c61926d372 100644
--- a/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
+++ b/drivers/media/video/gspca/stv06xx/stv06xx_vv6410.h
@@ -228,6 +228,7 @@ static const struct stv_init stv_bridge_init[] = {
         /* This reg is written twice. Some kind of reset? */
         {NULL,  0x1620, 0x80},
         {NULL,  0x1620, 0x00},
+        {NULL,  0x1443, 0x00},
         {NULL,  0x1423, 0x04},
         {x1500, 0x1500, ARRAY_SIZE(x1500)},
         {x1536, 0x1536, ARRAY_SIZE(x1536)},
diff --git a/drivers/media/video/gspca/sunplus.c b/drivers/media/video/gspca/sunplus.c
index 716df6b15fc5..306b7d75b4aa 100644
--- a/drivers/media/video/gspca/sunplus.c
+++ b/drivers/media/video/gspca/sunplus.c
@@ -709,7 +709,7 @@ static void spca504B_SetSizeType(struct gspca_dev *gspca_dev)
                 spca504B_PollingDataReady(gspca_dev);
 
                 /* Init the cam width height with some values get on init ? */
-                reg_w_riv(gspca_dev, 0x31, 0, 0x04);
+                reg_w_riv(gspca_dev, 0x31, 0x0004, 0x00);
                 spca504B_WaitCmdStatus(gspca_dev);
                 spca504B_PollingDataReady(gspca_dev);
                 break;
@@ -807,14 +807,14 @@ static void init_ctl_reg(struct gspca_dev *gspca_dev)
         default:
 /*      case BRIDGE_SPCA533: */
 /*      case BRIDGE_SPCA504B: */
-                reg_w_riv(gspca_dev, 0, 0x00, 0x21ad);  /* hue */
-                reg_w_riv(gspca_dev, 0, 0x01, 0x21ac);  /* sat/hue */
-                reg_w_riv(gspca_dev, 0, 0x00, 0x21a3);  /* gamma */
+                reg_w_riv(gspca_dev, 0, 0x21ad, 0x00);  /* hue */
+                reg_w_riv(gspca_dev, 0, 0x21ac, 0x01);  /* sat/hue */
+                reg_w_riv(gspca_dev, 0, 0x21a3, 0x00);  /* gamma */
                 break;
         case BRIDGE_SPCA536:
-                reg_w_riv(gspca_dev, 0, 0x40, 0x20f5);
-                reg_w_riv(gspca_dev, 0, 0x01, 0x20f4);
-                reg_w_riv(gspca_dev, 0, 0x00, 0x2089);
+                reg_w_riv(gspca_dev, 0, 0x20f5, 0x40);
+                reg_w_riv(gspca_dev, 0, 0x20f4, 0x01);
+                reg_w_riv(gspca_dev, 0, 0x2089, 0x00);
                 break;
         }
         if (pollreg)
@@ -887,11 +887,11 @@ static int sd_init(struct gspca_dev *gspca_dev)
         switch (sd->bridge) {
         case BRIDGE_SPCA504B:
                 reg_w_riv(gspca_dev, 0x1d, 0x00, 0);
-                reg_w_riv(gspca_dev, 0, 0x01, 0x2306);
-                reg_w_riv(gspca_dev, 0, 0x00, 0x0d04);
-                reg_w_riv(gspca_dev, 0, 0x00, 0x2000);
-                reg_w_riv(gspca_dev, 0, 0x13, 0x2301);
-                reg_w_riv(gspca_dev, 0, 0x00, 0x2306);
+                reg_w_riv(gspca_dev, 0x00, 0x2306, 0x01);
+                reg_w_riv(gspca_dev, 0x00, 0x0d04, 0x00);
+                reg_w_riv(gspca_dev, 0x00, 0x2000, 0x00);
+                reg_w_riv(gspca_dev, 0x00, 0x2301, 0x13);
+                reg_w_riv(gspca_dev, 0x00, 0x2306, 0x00);
                 /* fall thru */
         case BRIDGE_SPCA533:
                 spca504B_PollingDataReady(gspca_dev);
@@ -1000,7 +1000,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
                         spca504B_WaitCmdStatus(gspca_dev);
                         break;
                 default:
-                        reg_w_riv(gspca_dev, 0x31, 0, 0x04);
+                        reg_w_riv(gspca_dev, 0x31, 0x0004, 0x00);
                         spca504B_WaitCmdStatus(gspca_dev);
                         spca504B_PollingDataReady(gspca_dev);
                         break;
diff --git a/drivers/media/video/gspca/vc032x.c b/drivers/media/video/gspca/vc032x.c
index c090efcd8045..71921c878424 100644
--- a/drivers/media/video/gspca/vc032x.c
+++ b/drivers/media/video/gspca/vc032x.c
@@ -3009,6 +3009,10 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                 int l;
 
                 frame = gspca_get_i_frame(gspca_dev);
+                if (frame == NULL) {
+                        gspca_dev->last_packet_type = DISCARD_PACKET;
+                        return;
+                }
                 l = frame->data_end - frame->data;
                 if (len > frame->v4l2_buf.length - l)
                         len = frame->v4l2_buf.length - l;
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 2ba14fb5b031..c167cc3de492 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -718,7 +718,7 @@ static int __init mx1_camera_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         irq = platform_get_irq(pdev, 0);
-        if (!res || !irq) {
+        if (!res || (int)irq <= 0) {
                 err = -ENODEV;
                 goto exit;
         }
diff --git a/drivers/media/video/rj54n1cb0c.c b/drivers/media/video/rj54n1cb0c.c
index 7e42989ce0e4..805226e0d9c1 100644
--- a/drivers/media/video/rj54n1cb0c.c
+++ b/drivers/media/video/rj54n1cb0c.c
@@ -563,7 +563,7 @@ static int rj54n1_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
         struct i2c_client *client = sd->priv;
         struct rj54n1 *rj54n1 = to_rj54n1(client);
         struct v4l2_rect *rect = &a->c;
-        unsigned int dummy, output_w, output_h,
+        unsigned int dummy = 0, output_w, output_h,
                 input_w = rect->width, input_h = rect->height;
         int ret;
 
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index 9f85e917f9f3..a7ad7810fddc 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -420,19 +420,6 @@ int saa7134_set_dmabits(struct saa7134_dev *dev)
                 ctrl |= SAA7134_MAIN_CTRL_TE5;
                 irq  |= SAA7134_IRQ1_INTE_RA2_1 |
                         SAA7134_IRQ1_INTE_RA2_0;
-
-                /* dma: setup channel 5 (= TS) */
-
-                saa_writeb(SAA7134_TS_DMA0, (dev->ts.nr_packets - 1) & 0xff);
-                saa_writeb(SAA7134_TS_DMA1,
-                        ((dev->ts.nr_packets - 1) >> 8) & 0xff);
-                /* TSNOPIT=0, TSCOLAP=0 */
-                saa_writeb(SAA7134_TS_DMA2,
-                        (((dev->ts.nr_packets - 1) >> 16) & 0x3f) | 0x00);
-                saa_writel(SAA7134_RS_PITCH(5), TS_PACKET_SIZE);
-                saa_writel(SAA7134_RS_CONTROL(5), SAA7134_RS_CONTROL_BURST_16 |
-                                                  SAA7134_RS_CONTROL_ME |
-                                                  (dev->ts.pt_ts.dma >> 12));
         }
 
         /* set task conditions + field handling */
diff --git a/drivers/media/video/saa7134/saa7134-ts.c b/drivers/media/video/saa7134/saa7134-ts.c
index 03488ba4c99c..b9817d74943f 100644
--- a/drivers/media/video/saa7134/saa7134-ts.c
+++ b/drivers/media/video/saa7134/saa7134-ts.c
@@ -250,6 +250,19 @@ int saa7134_ts_start(struct saa7134_dev *dev)
 
         BUG_ON(dev->ts_started);
 
+        /* dma: setup channel 5 (= TS) */
+        saa_writeb(SAA7134_TS_DMA0, (dev->ts.nr_packets - 1) & 0xff);
+        saa_writeb(SAA7134_TS_DMA1,
+                ((dev->ts.nr_packets - 1) >> 8) & 0xff);
+        /* TSNOPIT=0, TSCOLAP=0 */
+        saa_writeb(SAA7134_TS_DMA2,
+                (((dev->ts.nr_packets - 1) >> 16) & 0x3f) | 0x00);
+        saa_writel(SAA7134_RS_PITCH(5), TS_PACKET_SIZE);
+        saa_writel(SAA7134_RS_CONTROL(5), SAA7134_RS_CONTROL_BURST_16 |
+                                          SAA7134_RS_CONTROL_ME |
+                                          (dev->ts.pt_ts.dma >> 12));
+
+        /* reset hardware TS buffers */
         saa_writeb(SAA7134_TS_SERIAL1, 0x00);
         saa_writeb(SAA7134_TS_SERIAL1, 0x03);
         saa_writeb(SAA7134_TS_SERIAL1, 0x00);
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index d69363f0d8c9..f09c7140d6b2 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -1827,7 +1827,7 @@ static int __devinit sh_mobile_ceu_probe(struct platform_device *pdev)
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         irq = platform_get_irq(pdev, 0);
-        if (!res || !irq) {
+        if (!res || (int)irq <= 0) {
                 dev_err(&pdev->dev, "Not enough CEU platform resources.\n");
                 err = -ENODEV;
                 goto exit;
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 0469d7a876a8..ec8ef8c5560a 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -1393,7 +1393,7 @@ uvc_ctrl_prune_entity(struct uvc_device *dev, struct uvc_entity *entity)
         size = entity->processing.bControlSize;
 
         for (i = 0; i < ARRAY_SIZE(blacklist); ++i) {
-                if (!usb_match_id(dev->intf, &blacklist[i].id))
+                if (!usb_match_one_id(dev->intf, &blacklist[i].id))
                         continue;
 
                 if (blacklist[i].index >= 8 * size ||
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index f854698c4061..ea11839cba4a 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -59,9 +59,9 @@
  *    returns immediately.
  *
  *    When the buffer is full, the completion handler removes it from the irq
- *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wakes its wait queue.
+ *    queue, marks it as done (UVC_BUF_STATE_DONE) and wakes its wait queue.
  *    At that point, any process waiting on the buffer will be woken up. If a
- *    process tries to dequeue a buffer after it has been marked ready, the
+ *    process tries to dequeue a buffer after it has been marked done, the
  *    dequeing will succeed immediately.
  *
  * 2. Buffers are queued, user is waiting on a buffer and the device gets
@@ -201,6 +201,7 @@ static void __uvc_query_buffer(struct uvc_buffer *buf,
                 break;
         case UVC_BUF_STATE_QUEUED:
         case UVC_BUF_STATE_ACTIVE:
+        case UVC_BUF_STATE_READY:
                 v4l2_buf->flags |= V4L2_BUF_FLAG_QUEUED;
                 break;
         case UVC_BUF_STATE_IDLE:
@@ -295,13 +296,15 @@ static int uvc_queue_waiton(struct uvc_buffer *buf, int nonblocking)
 {
         if (nonblocking) {
                 return (buf->state != UVC_BUF_STATE_QUEUED &&
-                        buf->state != UVC_BUF_STATE_ACTIVE)
+                        buf->state != UVC_BUF_STATE_ACTIVE &&
+                        buf->state != UVC_BUF_STATE_READY)
                         ? 0 : -EAGAIN;
         }
 
         return wait_event_interruptible(buf->wait,
                 buf->state != UVC_BUF_STATE_QUEUED &&
-                buf->state != UVC_BUF_STATE_ACTIVE);
+                buf->state != UVC_BUF_STATE_ACTIVE &&
+                buf->state != UVC_BUF_STATE_READY);
 }
 
 /*
@@ -348,6 +351,7 @@ int uvc_dequeue_buffer(struct uvc_video_queue *queue,
         case UVC_BUF_STATE_IDLE:
         case UVC_BUF_STATE_QUEUED:
         case UVC_BUF_STATE_ACTIVE:
+        case UVC_BUF_STATE_READY:
         default:
                 uvc_trace(UVC_TRACE_CAPTURE, "[E] Invalid buffer state %u "
                         "(driver bug?).\n", buf->state);
@@ -489,6 +493,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue,
 
         spin_lock_irqsave(&queue->irqlock, flags);
         list_del(&buf->queue);
+        buf->state = UVC_BUF_STATE_DONE;
         if (!list_empty(&queue->irqqueue))
                 nextbuf = list_first_entry(&queue->irqqueue, struct uvc_buffer,
                                            queue);
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 9a9802830d41..7dcf534a0cf3 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -441,7 +441,7 @@ static int uvc_video_decode_start(struct uvc_streaming *stream,
         if (fid != stream->last_fid && buf->buf.bytesused != 0) {
                 uvc_trace(UVC_TRACE_FRAME, "Frame complete (FID bit "
                                 "toggled).\n");
-                buf->state = UVC_BUF_STATE_DONE;
+                buf->state = UVC_BUF_STATE_READY;
                 return -EAGAIN;
         }
 
@@ -470,7 +470,7 @@ static void uvc_video_decode_data(struct uvc_streaming *stream,
         /* Complete the current frame if the buffer size was exceeded. */
         if (len > maxlen) {
                 uvc_trace(UVC_TRACE_FRAME, "Frame complete (overflow).\n");
-                buf->state = UVC_BUF_STATE_DONE;
+                buf->state = UVC_BUF_STATE_READY;
         }
 }
 
@@ -482,7 +482,7 @@ static void uvc_video_decode_end(struct uvc_streaming *stream,
                 uvc_trace(UVC_TRACE_FRAME, "Frame complete (EOF found).\n");
                 if (data[0] == len)
                         uvc_trace(UVC_TRACE_FRAME, "EOF in empty payload.\n");
-                buf->state = UVC_BUF_STATE_DONE;
+                buf->state = UVC_BUF_STATE_READY;
                 if (stream->dev->quirks & UVC_QUIRK_STREAM_NO_FID)
                         stream->last_fid ^= UVC_STREAM_FID;
         }
@@ -568,8 +568,7 @@ static void uvc_video_decode_isoc(struct urb *urb, struct uvc_streaming *stream,
                 uvc_video_decode_end(stream, buf, mem,
                         urb->iso_frame_desc[i].actual_length);
 
-                if (buf->state == UVC_BUF_STATE_DONE ||
-                    buf->state == UVC_BUF_STATE_ERROR)
+                if (buf->state == UVC_BUF_STATE_READY)
                         buf = uvc_queue_next_buffer(&stream->queue, buf);
         }
 }
@@ -627,8 +626,7 @@ static void uvc_video_decode_bulk(struct urb *urb, struct uvc_streaming *stream,
                 if (!stream->bulk.skip_payload && buf != NULL) {
                         uvc_video_decode_end(stream, buf, stream->bulk.header,
                                 stream->bulk.payload_size);
-                        if (buf->state == UVC_BUF_STATE_DONE ||
-                            buf->state == UVC_BUF_STATE_ERROR)
+                        if (buf->state == UVC_BUF_STATE_READY)
                                 buf = uvc_queue_next_buffer(&stream->queue,
                                                             buf);
                 }
@@ -669,7 +667,7 @@ static void uvc_video_encode_bulk(struct urb *urb, struct uvc_streaming *stream,
             stream->bulk.payload_size == stream->bulk.max_payload_size) {
                 if (buf->buf.bytesused == stream->queue.buf_used) {
                         stream->queue.buf_used = 0;
-                        buf->state = UVC_BUF_STATE_DONE;
+                        buf->state = UVC_BUF_STATE_READY;
                         uvc_queue_next_buffer(&stream->queue, buf);
                         stream->last_fid ^= UVC_STREAM_FID;
                 }
@@ -924,10 +922,8 @@ static int uvc_init_video_bulk(struct uvc_streaming *stream,
 static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
 {
         struct usb_interface *intf = stream->intf;
-        struct usb_host_interface *alts;
-        struct usb_host_endpoint *ep = NULL;
-        int intfnum = stream->intfnum;
-        unsigned int bandwidth, psize, i;
+        struct usb_host_endpoint *ep;
+        unsigned int i;
         int ret;
 
         stream->last_fid = -1;
@@ -936,6 +932,12 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
         stream->bulk.payload_size = 0;
 
         if (intf->num_altsetting > 1) {
+                struct usb_host_endpoint *best_ep = NULL;
+                unsigned int best_psize = 3 * 1024;
+                unsigned int bandwidth;
+                unsigned int uninitialized_var(altsetting);
+                int intfnum = stream->intfnum;
+
                 /* Isochronous endpoint, select the alternate setting. */
                 bandwidth = stream->ctrl.dwMaxPayloadTransferSize;
 
@@ -949,6 +951,9 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
                 }
 
                 for (i = 0; i < intf->num_altsetting; ++i) {
+                        struct usb_host_interface *alts;
+                        unsigned int psize;
+
                         alts = &intf->altsetting[i];
                         ep = uvc_find_endpoint(alts,
                                 stream->header.bEndpointAddress);
@@ -958,21 +963,27 @@ static int uvc_init_video(struct uvc_streaming *stream, gfp_t gfp_flags)
                         /* Check if the bandwidth is high enough. */
                         psize = le16_to_cpu(ep->desc.wMaxPacketSize);
                         psize = (psize & 0x07ff) * (1 + ((psize >> 11) & 3));
-                        if (psize >= bandwidth)
-                                break;
+                        if (psize >= bandwidth && psize <= best_psize) {
+                                altsetting = i;
+                                best_psize = psize;
+                                best_ep = ep;
+                        }
                 }
 
-                if (i >= intf->num_altsetting) {
+                if (best_ep == NULL) {
                         uvc_trace(UVC_TRACE_VIDEO, "No fast enough alt setting "
                                 "for requested bandwidth.\n");
                         return -EIO;
                 }
 
-                ret = usb_set_interface(stream->dev->udev, intfnum, i);
+                uvc_trace(UVC_TRACE_VIDEO, "Selecting alternate setting %u "
+                        "(%u B/frame bandwidth).\n", altsetting, best_psize);
+
+                ret = usb_set_interface(stream->dev->udev, intfnum, altsetting);
                 if (ret < 0)
                         return ret;
 
-                ret = uvc_init_video_isoc(stream, ep, gfp_flags);
+                ret = uvc_init_video_isoc(stream, best_ep, gfp_flags);
         } else {
                 /* Bulk endpoint, proceed to URB initialization. */
                 ep = uvc_find_endpoint(&intf->altsetting[0],
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index 7ec9a04ced50..2337585001ea 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -365,8 +365,9 @@ enum uvc_buffer_state {
         UVC_BUF_STATE_IDLE      = 0,
         UVC_BUF_STATE_QUEUED    = 1,
         UVC_BUF_STATE_ACTIVE    = 2,
-        UVC_BUF_STATE_DONE      = 3,
-        UVC_BUF_STATE_ERROR     = 4,
+        UVC_BUF_STATE_READY     = 3,
+        UVC_BUF_STATE_DONE      = 4,
+        UVC_BUF_STATE_ERROR     = 5,
 };
 
 struct uvc_buffer {
diff --git a/drivers/staging/cx25821/cx25821-medusa-video.c b/drivers/staging/cx25821/cx25821-medusa-video.c
index e4df8134f059..1eb079b3d429 100644
--- a/drivers/staging/cx25821/cx25821-medusa-video.c
+++ b/drivers/staging/cx25821/cx25821-medusa-video.c
@@ -860,10 +860,8 @@ int medusa_video_init(struct cx25821_dev *dev)
 
         ret_val = medusa_set_videostandard(dev);
 
-        if (ret_val < 0) {
-                mutex_unlock(&dev->lock);
+        if (ret_val < 0)
                 return -EINVAL;
-        }
 
         return 1;
 }
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 18f74ec4dce9..9d03d1ebca6f 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -1001,44 +1001,6 @@ done:
 }
 
 /**
- * v9fs_vfs_readlink - read a symlink's location
- * @dentry: dentry for symlink
- * @buffer: buffer to load symlink location into
- * @buflen: length of buffer
- *
- */
-
-static int v9fs_vfs_readlink(struct dentry *dentry, char __user * buffer,
-                             int buflen)
-{
-        int retval;
-        int ret;
-        char *link = __getname();
-
-        if (unlikely(!link))
-                return -ENOMEM;
-
-        if (buflen > PATH_MAX)
-                buflen = PATH_MAX;
-
-        P9_DPRINTK(P9_DEBUG_VFS, " dentry: %s (%p)\n", dentry->d_name.name,
-                                                                        dentry);
-
-        retval = v9fs_readlink(dentry, link, buflen);
-
-        if (retval > 0) {
-                if ((ret = copy_to_user(buffer, link, retval)) != 0) {
-                        P9_DPRINTK(P9_DEBUG_ERROR,
-                                        "problem copying to user: %d\n", ret);
-                        retval = ret;
-                }
-        }
-
-        __putname(link);
-        return retval;
-}
-
-/**
  * v9fs_vfs_follow_link - follow a symlink path
  * @dentry: dentry for symlink
  * @nd: nameidata
@@ -1230,7 +1192,6 @@ static const struct inode_operations v9fs_dir_inode_operations_ext = {
         .rmdir = v9fs_vfs_rmdir,
         .mknod = v9fs_vfs_mknod,
         .rename = v9fs_vfs_rename,
-        .readlink = v9fs_vfs_readlink,
         .getattr = v9fs_vfs_getattr,
         .setattr = v9fs_vfs_setattr,
 };
@@ -1253,7 +1214,7 @@ static const struct inode_operations v9fs_file_inode_operations = {
 };
 
 static const struct inode_operations v9fs_symlink_inode_operations = {
-        .readlink = v9fs_vfs_readlink,
+        .readlink = generic_readlink,
         .follow_link = v9fs_vfs_follow_link,
         .put_link = v9fs_vfs_put_link,
         .getattr = v9fs_vfs_getattr,
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index fea9e898c4ba..b44ce0a0711c 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -269,7 +269,7 @@ static int add_mount_helper(struct vfsmount *newmnt, struct nameidata *nd,
         int err;
 
         mntget(newmnt);
-        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags, mntlist);
+        err = do_add_mount(newmnt, &nd->path, nd->path.mnt->mnt_flags | MNT_SHRINKABLE, mntlist);
         switch (err) {
         case 0:
                 path_put(&nd->path);
@@ -371,7 +371,6 @@ cifs_dfs_follow_mountpoint(struct dentry *dentry, struct nameidata *nd)
         if (IS_ERR(mnt))
                 goto out_err;
 
-        nd->path.mnt->mnt_flags |= MNT_SHRINKABLE;
         rc = add_mount_helper(mnt, nd, &cifs_dfs_automount_list);
 
 out:
diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
index c8afa6b1d91d..32a5f46b1157 100644
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -121,8 +121,10 @@ static int get_target(const char *symname, struct path *path,
                                 ret = -ENOENT;
                                 path_put(path);
                         }
-                } else
+                } else {
                         ret = -EPERM;
+                        path_put(path);
+                }
         }
 
         return ret;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 429ca0b3ba08..7f8545032930 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -715,31 +715,31 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
         /* Released in ecryptfs_put_link(); only release here on error */
         buf = kmalloc(len, GFP_KERNEL);
         if (!buf) {
-                rc = -ENOMEM;
+                buf = ERR_PTR(-ENOMEM);
                 goto out;
         }
         old_fs = get_fs();
         set_fs(get_ds());
         rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
         set_fs(old_fs);
-        if (rc < 0)
-                goto out_free;
-        else
+        if (rc < 0) {
+                kfree(buf);
+                buf = ERR_PTR(rc);
+        } else
                 buf[rc] = '\0';
-        rc = 0;
-        nd_set_link(nd, buf);
-        goto out;
-out_free:
-        kfree(buf);
 out:
-        return ERR_PTR(rc);
+        nd_set_link(nd, buf);
+        return NULL;
 }
 
 static void
 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
 {
-        /* Free the char* */
-        kfree(nd_get_link(nd));
+        char *buf = nd_get_link(nd);
+        if (!IS_ERR(buf)) {
+                /* Free the char* */
+                kfree(buf);
+        }
 }
 
 /**
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index a5089a6dd67a..7239efc690d8 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -646,22 +646,27 @@ static const struct super_operations hppfs_sbops = {
 static int hppfs_readlink(struct dentry *dentry, char __user *buffer,
                           int buflen)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
         return proc_dentry->d_inode->i_op->readlink(proc_dentry, buffer,
                                                     buflen);
 }
 
 static void *hppfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
-        struct dentry *proc_dentry;
-
-        proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
 
         return proc_dentry->d_inode->i_op->follow_link(proc_dentry, nd);
 }
 
+static void hppfs_put_link(struct dentry *dentry, struct nameidata *nd,
+                           void *cookie)
+{
+        struct dentry *proc_dentry = HPPFS_I(dentry->d_inode)->proc_dentry;
+
+        if (proc_dentry->d_inode->i_op->put_link)
+                proc_dentry->d_inode->i_op->put_link(proc_dentry, nd, cookie);
+}
+
 static const struct inode_operations hppfs_dir_iops = {
         .lookup         = hppfs_lookup,
 };
@@ -669,6 +674,7 @@ static const struct inode_operations hppfs_dir_iops = {
 static const struct inode_operations hppfs_link_iops = {
         .readlink       = hppfs_readlink,
         .follow_link    = hppfs_follow_link,
+        .put_link       = hppfs_put_link,
 };
 
 static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
diff --git a/fs/namei.c b/fs/namei.c
index b55440baf7ab..94a5e60779f9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -561,6 +561,7 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
                 dget(dentry);
         }
         mntget(path->mnt);
+        nd->last_type = LAST_BIND;
         cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
         error = PTR_ERR(cookie);
         if (!IS_ERR(cookie)) {
@@ -1603,11 +1604,12 @@ struct file *do_filp_open(int dfd, const char *pathname,
         struct file *filp;
         struct nameidata nd;
         int error;
-        struct path path, save;
+        struct path path;
         struct dentry *dir;
         int count = 0;
         int will_truncate;
         int flag = open_to_namei_flags(open_flag);
+        int force_reval = 0;
 
         /*
          * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
@@ -1619,7 +1621,7 @@ struct file *do_filp_open(int dfd, const char *pathname,
                 open_flag |= O_DSYNC;
 
         if (!acc_mode)
-                acc_mode = MAY_OPEN | ACC_MODE(flag);
+                acc_mode = MAY_OPEN | ACC_MODE(open_flag);
 
         /* O_TRUNC implies we need access checks for write permissions */
         if (flag & O_TRUNC)
@@ -1659,9 +1661,12 @@ struct file *do_filp_open(int dfd, const char *pathname,
         /*
          * Create - we need to know the parent.
          */
+reval:
         error = path_init(dfd, pathname, LOOKUP_PARENT, &nd);
         if (error)
                 return ERR_PTR(error);
+        if (force_reval)
+                nd.flags |= LOOKUP_REVAL;
         error = path_walk(pathname, &nd);
         if (error) {
                 if (nd.root.mnt)
@@ -1853,17 +1858,7 @@ do_link:
         error = security_inode_follow_link(path.dentry, &nd);
         if (error)
                 goto exit_dput;
-        save = nd.path;
-        path_get(&save);
         error = __do_follow_link(&path, &nd);
-        if (error == -ESTALE) {
-                /* nd.path had been dropped */
-                nd.path = save;
-                path_get(&nd.path);
-                nd.flags |= LOOKUP_REVAL;
-                error = __do_follow_link(&path, &nd);
-        }
-        path_put(&save);
         path_put(&path);
         if (error) {
                 /* Does someone understand code flow here? Or it is only
@@ -1873,6 +1868,10 @@ do_link:
                 release_open_intent(&nd);
                 if (nd.root.mnt)
                         path_put(&nd.root);
+                if (error == -ESTALE && !force_reval) {
+                        force_reval = 1;
+                        goto reval;
+                }
                 return ERR_PTR(error);
         }
         nd.flags &= ~LOOKUP_PARENT;
diff --git a/fs/namespace.c b/fs/namespace.c
index 7d70d63ceb29..c768f733c8d6 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -965,10 +965,12 @@ EXPORT_SYMBOL(may_umount_tree);
 int may_umount(struct vfsmount *mnt)
 {
         int ret = 1;
+        down_read(&namespace_sem);
         spin_lock(&vfsmount_lock);
         if (propagate_mount_busy(mnt, 2))
                 ret = 0;
         spin_unlock(&vfsmount_lock);
+        up_read(&namespace_sem);
         return ret;
 }
 
@@ -1352,12 +1354,12 @@ static int attach_recursive_mnt(struct vfsmount *source_mnt,
         if (err)
                 goto out_cleanup_ids;
 
+        spin_lock(&vfsmount_lock);
+
         if (IS_MNT_SHARED(dest_mnt)) {
                 for (p = source_mnt; p; p = next_mnt(p, source_mnt))
                         set_mnt_shared(p);
         }
-
-        spin_lock(&vfsmount_lock);
         if (parent_path) {
                 detach_mnt(source_mnt, parent_path);
                 attach_mnt(source_mnt, path);
@@ -1534,8 +1536,12 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
                 err = change_mount_flags(path->mnt, flags);
         else
                 err = do_remount_sb(sb, flags, data, 0);
-        if (!err)
+        if (!err) {
+                spin_lock(&vfsmount_lock);
+                mnt_flags |= path->mnt->mnt_flags & MNT_PNODE_MASK;
                 path->mnt->mnt_flags = mnt_flags;
+                spin_unlock(&vfsmount_lock);
+        }
         up_write(&sb->s_umount);
         if (!err) {
                 security_sb_post_remount(path->mnt, flags, data);
@@ -1665,6 +1671,8 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path,
 {
         int err;
 
+        mnt_flags &= ~(MNT_SHARED | MNT_WRITE_HOLD);
+
         down_write(&namespace_sem);
         /* Something was mounted here while we slept */
         while (d_mountpoint(path->dentry) &&
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 18d5cc62d8ed..e42bbd843ed1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1419,7 +1419,6 @@ static void *proc_pid_follow_link(struct dentry *dentry, struct nameidata *nd)
                 goto out;
 
         error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
-        nd->last_type = LAST_BIND;
 out:
         return ERR_PTR(error);
 }
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 9147ca88f253..b1bcb275b596 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2463,7 +2463,7 @@ int proc_nr_files(struct ctl_table *table, int write,
 
 int __init get_filesystem_list(char *buf);
 
-#define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
+#define ACC_MODE(x) ("\004\002\006\006"[(x)&O_ACCMODE])
 #define OPEN_FMODE(flag) ((__force fmode_t)((flag + 1) & O_ACCMODE))
 
 #endif /* __KERNEL__ */
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 6f426afbc522..220213e603db 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -804,7 +804,7 @@ static inline int sym_is(const char *symbol, const char *name)
         match = strstr(symbol, name);
         if (!match)
                 return 0;
-        return match[strlen(symbol)] == '\0';
+        return match[strlen(name)] == '\0';
 }
 
 static void do_table(void *symval, unsigned long size,
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index 8a00ade85166..2aceebf5f354 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -80,9 +80,8 @@ static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
                 return tomoyo_find_next_domain(bprm);
         /*
          * Read permission is checked against interpreters using next domain.
-         * '1' is the result of open_to_namei_flags(O_RDONLY).
          */
-        return tomoyo_check_open_permission(domain, &bprm->file->f_path, 1);
+        return tomoyo_check_open_permission(domain, &bprm->file->f_path, O_RDONLY);
 }
 
 static int tomoyo_path_truncate(struct path *path, loff_t length,
@@ -184,10 +183,6 @@ static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
 static int tomoyo_dentry_open(struct file *f, const struct cred *cred)
 {
         int flags = f->f_flags;
-
-        if ((flags + 1) & O_ACCMODE)
-                flags++;
-        flags |= f->f_flags & (O_APPEND | O_TRUNC);
         /* Don't check read permission here if called from do_execve(). */
         if (current->in_execve)
                 return 0;