25 files changed, 158 insertions, 65 deletions

diff --git a/.gitignore b/.gitignore
index e1d5c17c12c2..9eb4b7711499 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@
 # Top-level generic files
 #
 tags
+TAGS
 vmlinux*
 System.map
 Module.symvers
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 14682396f7f7..683b12c6f76c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -484,6 +484,15 @@ source "net/Kconfig"
 
 source "drivers/Kconfig"
 
+config MSPEC
+        tristate "Memory special operations driver"
+        depends on IA64
+        select IA64_UNCACHED_ALLOCATOR
+        help
+          If you have an ia64 and you want to enable memory special
+          operations support (formerly known as fetchop), say Y here,
+          otherwise say N.
+
 source "fs/Kconfig"
 
 source "lib/Kconfig"
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 39a9f8cc6412..2af12fc45115 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -409,14 +409,6 @@ config SGI_MBCS
          If you have an SGI Altix with an attached SABrick
          say Y or M here, otherwise say N.
 
-config MSPEC
-        tristate "Memory special operations driver"
-        depends on IA64
-        help
-          If you have an ia64 and you want to enable memory special
-          operations support (formerly known as fetchop), say Y here,
-          otherwise say N.
-
 source "drivers/serial/Kconfig"
 
 config UNIX98_PTYS
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0b07ca1b71fa..a41b8df24073 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1854,7 +1854,7 @@ static ssize_t provides_dev_sdrs_show(struct device *dev,
         struct bmc_device *bmc = dev_get_drvdata(dev);
 
         return snprintf(buf, 10, "%u\n",
-                        bmc->id.device_revision && 0x80 >> 7);
+                        (bmc->id.device_revision & 0x80) >> 7);
 }
 
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
@@ -1863,7 +1863,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
         struct bmc_device *bmc = dev_get_drvdata(dev);
 
         return snprintf(buf, 20, "%u\n",
-                        bmc->id.device_revision && 0x0F);
+                        bmc->id.device_revision & 0x0F);
 }
 
 static ssize_t firmware_rev_show(struct device *dev,
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index 5c0dec39cf6c..235e89226112 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -72,7 +72,11 @@ enum {
         MSPEC_UNCACHED
 };
 
+#ifdef CONFIG_SGI_SN
 static int is_sn2;
+#else
+#define is_sn2          0
+#endif
 
 /*
  * One of these structures is allocated when an mspec region is mmaped. The
@@ -211,7 +215,7 @@ mspec_nopfn(struct vm_area_struct *vma, unsigned long address)
         if (vdata->type == MSPEC_FETCHOP)
                 paddr = TO_AMO(maddr);
         else
-                paddr = __pa(TO_CAC(maddr));
+                paddr = maddr & ~__IA64_UNCACHED_OFFSET;
 
         pfn = paddr >> PAGE_SHIFT;
 
@@ -335,6 +339,7 @@ mspec_init(void)
          * The fetchop device only works on SN2 hardware, uncached and cached
          * memory drivers should both be valid on all ia64 hardware
          */
+#ifdef CONFIG_SGI_SN
         if (ia64_platform_is("sn2")) {
                 is_sn2 = 1;
                 if (is_shub2()) {
@@ -363,6 +368,7 @@ mspec_init(void)
                         goto free_scratch_pages;
                 }
         }
+#endif
         ret = misc_register(&cached_miscdev);
         if (ret) {
                 printk(KERN_ERR "%s: failed to register device %i\n",
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 0dc70c7b7940..aa9dd8f11269 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -337,13 +337,16 @@ static void com20020_set_mc_list(struct net_device *dev)
         }
 }
 
-#ifdef MODULE
-
+#if defined(CONFIG_ARCNET_COM20020_PCI_MODULE) || \
+    defined(CONFIG_ARCNET_COM20020_ISA_MODULE)
 EXPORT_SYMBOL(com20020_check);
 EXPORT_SYMBOL(com20020_found);
+#endif
 
 MODULE_LICENSE("GPL");
 
+#ifdef MODULE
+
 int init_module(void)
 {
         BUGLVL(D_NORMAL) printk(VERSION);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c0bbddae4ec4..17a461152d39 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4692,6 +4692,8 @@ static int bond_check_params(struct bond_params *params)
         return 0;
 }
 
+static struct lock_class_key bonding_netdev_xmit_lock_key;
+
 /* Create a new bond based on the specified name and bonding parameters.
  * Caller must NOT hold rtnl_lock; we need to release it here before we
  * set up our sysfs entries.
@@ -4727,6 +4729,9 @@ int bond_create(char *name, struct bond_params *params, struct bonding **newbond
         if (res < 0) {
                 goto out_bond;
         }
+
+        lockdep_set_class(&bond_dev->_xmit_lock, &bonding_netdev_xmit_lock_key);
+
         if (newbond)
                 *newbond = bond_dev->priv;
 
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 966b563e42bb..a03d781f6d0a 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -509,6 +509,8 @@ etrax_ethernet_init(void)
                  * does not share cacheline with any other data (to avoid cache bug)
                  */
                 RxDescList[i].skb = dev_alloc_skb(MAX_MEDIA_DATA_SIZE + 2 * L1_CACHE_BYTES);
+                if (!RxDescList[i].skb)
+                        return -ENOMEM;
                 RxDescList[i].descr.ctrl   = 0;
                 RxDescList[i].descr.sw_len = MAX_MEDIA_DATA_SIZE;
                 RxDescList[i].descr.next   = virt_to_phys(&RxDescList[i + 1]);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index 65edb56107fd..a1b783813d8e 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -746,7 +746,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
         if (err)
                 goto err_ctlreg;
         spromctl |= 0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
         /* We must burn lots of CPU cycles here, but that does not
@@ -768,7 +768,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
                 mdelay(20);
         }
         spromctl &= ~0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
         mdelay(500);
@@ -1463,6 +1463,23 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
         }
 }
 
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+        u32 dummy;
+
+        if (bcm->current_core->rev < 5)
+                return;
+        /* Read all entries from the microcode TXstatus FIFO
+         * and throw them away.
+         */
+        while (1) {
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+                if (!dummy)
+                        break;
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+        }
+}
+
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -3532,6 +3549,7 @@ int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
         bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
         bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
         bcm43xx_security_init(bcm);
+        drain_txstatus_queue(bcm);
         ieee80211softmac_start(bcm->net_dev);
 
         /* Let's go! Be careful after enabling the IRQs.
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index a1d2e979b17f..f952bfea48a6 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -642,6 +642,9 @@ err:
  */
 void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
+        if (!sysfs_initialized)
+                return;
+
         if (pdev->cfg_size < 4096)
                 sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
         else
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index fd9e281c3bfe..94a274645f6f 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -631,12 +631,22 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
          * scanning run at their own risk, or supply a user level program
          * that can correctly scan.
          */
-        sdev->inquiry = kmalloc(sdev->inquiry_len, GFP_ATOMIC);
-        if (sdev->inquiry == NULL) {
+
+        /*
+         * Copy at least 36 bytes of INQUIRY data, so that we don't
+         * dereference unallocated memory when accessing the Vendor,
+         * Product, and Revision strings.  Badly behaved devices may set
+         * the INQUIRY Additional Length byte to a small value, indicating
+         * these strings are invalid, but often they contain plausible data
+         * nonetheless.  It doesn't matter if the device sent < 36 bytes
+         * total, since scsi_probe_lun() initializes inq_result with 0s.
+         */
+        sdev->inquiry = kmemdup(inq_result,
+                                max_t(size_t, sdev->inquiry_len, 36),
+                                GFP_ATOMIC);
+        if (sdev->inquiry == NULL)
                 return SCSI_SCAN_NO_RESPONSE;
-        }
 
-        memcpy(sdev->inquiry, inq_result, sdev->inquiry_len);
         sdev->vendor = (char *) (sdev->inquiry + 8);
         sdev->model = (char *) (sdev->inquiry + 16);
         sdev->rev = (char *) (sdev->inquiry + 32);
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/nvidia/nv_hw.c
index 9ed640d35728..ea426115c6f9 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_par *par, unsigned int *MClk,
 
         if (par->Architecture >= NV_ARCH_40) {
                 pll = NV_RD32(par->PMC, 0x4020);
-                P = (pll >> 16) & 0x03;
+                P = (pll >> 16) & 0x07;
                 pll = NV_RD32(par->PMC, 0x4024);
                 M = pll & 0xFF;
                 N = (pll >> 8) & 0xFF;
-                MB = (pll >> 16) & 0xFF;
-                NB = (pll >> 24) & 0xFF;
+                if (((par->Chipset & 0xfff0) == 0x0290) ||
+                                ((par->Chipset & 0xfff0) == 0x0390)) {
+                        MB = 1;
+                        NB = 1;
+                } else {
+                        MB = (pll >> 16) & 0xFF;
+                        NB = (pll >> 24) & 0xFF;
+                }
                 *MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
 
                 pll = NV_RD32(par->PMC, 0x4000);
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/nvidia/nv_setup.c
index a18a9aebf05f..61dc46fecf2b 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/nvidia/nv_setup.c
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
         case 0x0186:
         case 0x0187:
         case 0x018D:
+        case 0x0228:
         case 0x0286:
         case 0x028C:
         case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
         case 0x034C:
         case 0x0160:
         case 0x0166:
+        case 0x0169:
+        case 0x016B:
+        case 0x016C:
+        case 0x016D:
         case 0x00C8:
         case 0x00CC:
         case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
                 par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
                 par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
 
-                printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+                printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
         }
 
         if (monA)
                 info->monspecs = *monA;
 
+        if (!par->FlatPanel || !par->twoHeads)
+                par->FPDither = 0;
+
+        par->LVDS = 0;
+        if (par->FlatPanel && par->twoHeads) {
+                NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+                if (par->PRAMDAC0[0x08b4] & 1)
+                        par->LVDS = 1;
+                printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+        }
+
         kfree(edidA);
         kfree(edidB);
 done:
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/nvidia/nv_type.h
index acdc26693402..86e65dea60d3 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
         int fpHeight;
         int PanelTweak;
         int paneltweak;
+        int LVDS;
         int pm_state;
         u32 crtcSync_read;
         u32 fpSyncs;
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index eb24107bcc81..538e947610e1 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1160,20 +1160,20 @@ static u32 __devinit nvidia_get_arch(struct fb_info *info)
         case 0x0340:            /* GeForceFX 5700 */
                 arch = NV_ARCH_30;
                 break;
-        case 0x0040:
-        case 0x00C0:
-        case 0x0120:
+        case 0x0040:            /* GeForce 6800 */
+        case 0x00C0:            /* GeForce 6800 */
+        case 0x0120:            /* GeForce 6800 */
         case 0x0130:
-        case 0x0140:
-        case 0x0160:
-        case 0x01D0:
-        case 0x0090:
-        case 0x0210:
-        case 0x0220:
+        case 0x0140:            /* GeForce 6600 */
+        case 0x0160:            /* GeForce 6200 */
+        case 0x01D0:            /* GeForce 7200, 7300, 7400 */
+        case 0x0090:            /* GeForce 7800 */
+        case 0x0210:            /* GeForce 6800 */
+        case 0x0220:            /* GeForce 6200 */
         case 0x0230:
-        case 0x0240:
-        case 0x0290:
-        case 0x0390:
+        case 0x0240:            /* GeForce 6100 */
+        case 0x0290:            /* GeForce 7900 */
+        case 0x0390:            /* GeForce 7600 */
                 arch = NV_ARCH_40;
                 break;
         case 0x0020:            /* TNT, TNT2 */
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 7e056b9b49e8..2436ed8fc840 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -492,10 +492,14 @@ int cifs_close(struct inode *inode, struct file *file)
                                         the struct would be in each open file,
                                         but this should give enough time to 
                                         clear the socket */
-                                        cERROR(1,("close with pending writes"));
+#ifdef CONFIG_CIFS_DEBUG2
+                                        cFYI(1,("close delay, write pending"));
+#endif /* DEBUG2 */
                                         msleep(timeout);
                                         timeout *= 4;
-                                } 
+                                }
+                                if(atomic_read(&pSMBFile->wrtPending))
+                                        cERROR(1,("close with pending writes"));
                                 rc = CIFSSMBClose(xid, pTcon,
                                                   pSMBFile->netfid);
                         }
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index dffe295825f4..1ad8c9fcc742 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1089,8 +1089,10 @@ int cifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         struct kstat *stat)
 {
         int err = cifs_revalidate(dentry);
-        if (!err)
+        if (!err) {
                 generic_fillattr(dentry->d_inode, stat);
+                stat->blksize = CIFS_MAX_MSGSIZE;
+        }
         return err;
 }
 
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index a8a083543ba0..bbdda99dce61 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -90,7 +90,9 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
         } */
         /* copy user */
         if(ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
+                /* null user mount */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
         } else { /* 300 should be long enough for any conceivable user name */
                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
                                           300, nls_cp);
@@ -98,10 +100,13 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
         /* copy domain */
-        if(ses->domainName == NULL)
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
-                                          "CIFS_LINUX_DOM", 32, nls_cp);
-        else
+        if(ses->domainName == NULL) {
+                /* Sending null domain better than using a bogus domain name (as
+                we did briefly in 2.6.18) since server will use its default */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
+                bytes_ret = 0;
+        } else
                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, 
                                           256, nls_cp);
         bcc_ptr += 2 * bytes_ret;
@@ -144,13 +149,11 @@ static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
 
         /* copy domain */
         
-        if(ses->domainName == NULL) {
-                strcpy(bcc_ptr, "CIFS_LINUX_DOM");
-                bcc_ptr += 14;  /* strlen(CIFS_LINUX_DOM) */
-        } else {
+        if(ses->domainName != NULL) {
                 strncpy(bcc_ptr, ses->domainName, 256); 
                 bcc_ptr += strnlen(ses->domainName, 256);
-        }
+        } /* else we will send a null domain name 
+             so the server will default to its own domain */
         *bcc_ptr = 0;
         bcc_ptr++;
 
diff --git a/include/asm-ia64/sn/addrs.h b/include/asm-ia64/sn/addrs.h
index 1d9efe541662..e715c794b186 100644
--- a/include/asm-ia64/sn/addrs.h
+++ b/include/asm-ia64/sn/addrs.h
@@ -136,9 +136,13 @@
  */
 #define TO_PHYS(x)              (TO_PHYS_MASK & (x))
 #define TO_CAC(x)               (CAC_BASE     | TO_PHYS(x))
+#ifdef CONFIG_SGI_SN
 #define TO_AMO(x)               (AMO_BASE     | TO_PHYS(x))
 #define TO_GET(x)               (GET_BASE     | TO_PHYS(x))
-
+#else
+#define TO_AMO(x)               ({ BUG(); x; })
+#define TO_GET(x)               ({ BUG(); x; })
+#endif
 
 /*
  * Covert from processor physical address to II/TIO physical address:
diff --git a/include/linux/personality.h b/include/linux/personality.h
index bf4cf2080e5c..012cd558189b 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -114,7 +114,7 @@ struct exec_domain {
  * Change personality of the currently running process.
  */
 #define set_personality(pers) \
-        ((current->personality == pers) ? 0 : __set_personality(pers))
+        ((current->personality == (pers)) ? 0 : __set_personality(pers))
 
 #endif /* __KERNEL__ */
 
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index dc9a29d84abc..924e502905d4 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -23,13 +23,14 @@ struct vm_area_struct;
 #endif
 
 struct vm_struct {
+        /* keep next,addr,size together to speedup lookups */
+        struct vm_struct        *next;
         void                    *addr;
         unsigned long           size;
         unsigned long           flags;
         struct page             **pages;
         unsigned int            nr_pages;
         unsigned long           phys_addr;
-        struct vm_struct        *next;
 };
 
 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 3da978eec791..4b4eab2a3161 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -687,6 +687,7 @@ static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
                  * the latest pointer.
                  */
                 spin_lock(&oldf->file_lock);
+                open_files = count_open_files(old_fdt);
                 old_fdt = files_fdtable(oldf);
         }
 
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 543ea2e5ad93..9c7e2e4c1fe7 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -147,7 +147,11 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
         if (unlikely(irqfixup)) {
                 /* Don't punish working computers */
                 if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-                        int ok = misrouted_irq(irq);
+                        int ok;
+
+                        spin_unlock(&desc->lock);
+                        ok = misrouted_irq(irq);
+                        spin_lock(&desc->lock);
                         if (action_ret == IRQ_NONE)
                                 desc->irqs_unhandled -= ok;
                 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 46606c133e82..7dc6aa745166 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -186,10 +186,8 @@ static struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long fl
         if (unlikely(!area))
                 return NULL;
 
-        if (unlikely(!size)) {
-                kfree (area);
+        if (unlikely(!size))
                 return NULL;
-        }
 
         /*
          * We always allocate a guard page.
@@ -532,11 +530,12 @@ void *vmalloc_user(unsigned long size)
         void *ret;
 
         ret = __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
-        area = __find_vm_area(ret);
-        area->flags |= VM_USERMAP;
-        write_unlock(&vmlist_lock);
-
+        if (ret) {
+                write_lock(&vmlist_lock);
+                area = __find_vm_area(ret);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
         return ret;
 }
 EXPORT_SYMBOL(vmalloc_user);
@@ -605,11 +604,12 @@ void *vmalloc_32_user(unsigned long size)
         void *ret;
 
         ret = __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
-        area = __find_vm_area(ret);
-        area->flags |= VM_USERMAP;
-        write_unlock(&vmlist_lock);
-
+        if (ret) {
+                write_lock(&vmlist_lock);
+                area = __find_vm_area(ret);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
         return ret;
 }
 EXPORT_SYMBOL(vmalloc_32_user);
diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index e8ad1f6b3da4..b49584c932cc 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -6,6 +6,8 @@ lex.*.c
 *.tab.c
 *.tab.h
 zconf.hash.c
+*.moc
+lkc_defs.h
 
 #
 # configuration programs