59 files changed, 301 insertions, 206 deletions

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index b0c7ab93dcb9..7345c338080a 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -211,9 +211,8 @@ Controls the kernel's behaviour when an oops or BUG is encountered.
 
 0: try to continue operation
 
-1: delay a few seconds (to give klogd time to record the oops output) and
-   then panic.  If the `panic' sysctl is also non-zero then the machine will
-   be rebooted.
+1: panic immediatly.  If the `panic' sysctl is also non-zero then the
+   machine will be rebooted.
 
 ==============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index bac3f706f75e..e3e1515ba5a9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -298,6 +298,13 @@ L:	info-linux@geode.amd.com
 W:      http://www.amd.com/us-en/ConnectivitySolutions/TechnicalResources/0,,50_2334_2452_11363,00.html
 S:      Supported
 
+AOA (Apple Onboard Audio) ALSA DRIVER
+P:      Johannes Berg
+M:      johannes@sipsolutions.net
+L:      linuxppc-dev@ozlabs.org
+L:      alsa-devel@alsa-project.org
+S:      Maintained
+
 APM DRIVER
 P:      Stephen Rothwell
 M:      sfr@canb.auug.org.au
@@ -2641,6 +2648,14 @@ M:	dbrownell@users.sourceforge.net
 L:      spi-devel-general@lists.sourceforge.net
 S:      Maintained
 
+STABLE BRANCH:
+P:      Greg Kroah-Hartman
+M:      greg@kroah.com
+P:      Chris Wright
+M:      chrisw@sous-sol.org
+L:      stable@kernel.org
+S:      Maintained
+
 TPM DEVICE DRIVER
 P:      Kylene Hall
 M:      kjhall@us.ibm.com
diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
index 781dbb11c038..b09805f3ee23 100644
--- a/arch/sh/kernel/cpu/sh4/sq.c
+++ b/arch/sh/kernel/cpu/sh4/sq.c
@@ -421,18 +421,22 @@ static struct miscdevice sq_dev = {
 
 static int __init sq_api_init(void)
 {
+        int ret;
         printk(KERN_NOTICE "sq: Registering store queue API.\n");
 
-#ifdef CONFIG_PROC_FS
         create_proc_read_entry("sq_mapping", 0, 0, sq_mapping_read_proc, 0);
-#endif
 
-        return misc_register(&sq_dev);
+        ret = misc_register(&sq_dev);
+        if (ret)
+                remove_proc_entry("sq_mapping", NULL);
+
+        return ret;
 }
 
 static void __exit sq_api_exit(void)
 {
         misc_deregister(&sq_dev);
+        remove_proc_entry("sq_mapping", NULL);
 }
 
 module_init(sq_api_init);
diff --git a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
index 5a1c0a3bf872..06af6ca60129 100644
--- a/arch/x86_64/kernel/smp.c
+++ b/arch/x86_64/kernel/smp.c
@@ -203,7 +203,7 @@ int __cpuinit init_smp_flush(void)
 {
         int i;
         for_each_cpu_mask(i, cpu_possible_map) {
-                spin_lock_init(&per_cpu(flush_state.tlbstate_lock, i));
+                spin_lock_init(&per_cpu(flush_state, i).tlbstate_lock);
         }
         return 0;
 }
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index 81e970adeab3..b0d4b147b19e 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -129,11 +129,15 @@ acpi_memory_get_device_resources(struct acpi_memory_device *mem_device)
         struct acpi_memory_info *info, *n;
 
 
+        if (!list_empty(&mem_device->res_list))
+                return 0;
+
         status = acpi_walk_resources(mem_device->device->handle, METHOD_NAME__CRS,
                                      acpi_memory_get_resource, mem_device);
         if (ACPI_FAILURE(status)) {
                 list_for_each_entry_safe(info, n, &mem_device->res_list, list)
                         kfree(info);
+                INIT_LIST_HEAD(&mem_device->res_list);
                 return -EINVAL;
         }
 
@@ -230,17 +234,10 @@ static int acpi_memory_enable_device(struct acpi_memory_device *mem_device)
          * (i.e. memory-hot-remove function)
          */
         list_for_each_entry(info, &mem_device->res_list, list) {
-                u64 start_pfn, end_pfn;
-
-                start_pfn = info->start_addr >> PAGE_SHIFT;
-                end_pfn = (info->start_addr + info->length - 1) >> PAGE_SHIFT;
-
-                if (pfn_valid(start_pfn) || pfn_valid(end_pfn)) {
-                        /* already enabled. try next area */
+                if (info->enabled) { /* just sanity check...*/
                         num_enabled++;
                         continue;
                 }
-
                 result = add_memory(node, info->start_addr, info->length);
                 if (result)
                         continue;
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 41db8060e8f7..017f755632a3 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -311,7 +311,8 @@ static void hvsi_recv_control(struct hvsi_struct *hp, uint8_t *packet,
                                 /* CD went away; no more connection */
                                 pr_debug("hvsi%i: CD dropped\n", hp->index);
                                 hp->mctrl &= TIOCM_CD;
-                                if (!(hp->tty->flags & CLOCAL))
+                                /* If userland hasn't done an open(2) yet, hp->tty is NULL. */
+                                if (hp->tty && !(hp->tty->flags & CLOCAL))
                                         *to_hangup = hp->tty;
                         }
                         break;
@@ -986,10 +987,7 @@ static void hvsi_write_worker(void *arg)
                 start_j = 0;
 #endif /* DEBUG */
                 wake_up_all(&hp->emptyq);
-                if (test_bit(TTY_DO_WRITE_WAKEUP, &hp->tty->flags)
-                                && hp->tty->ldisc.write_wakeup)
-                        hp->tty->ldisc.write_wakeup(hp->tty);
-                wake_up_interruptible(&hp->tty->write_wait);
+                tty_wakeup(hp->tty);
         }
 
 out:
diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
index 819516b35a79..a01d796d1eeb 100644
--- a/drivers/char/hw_random/omap-rng.c
+++ b/drivers/char/hw_random/omap-rng.c
@@ -25,12 +25,12 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/random.h>
+#include <linux/clk.h>
 #include <linux/err.h>
-#include <linux/device.h>
+#include <linux/platform_device.h>
 #include <linux/hw_random.h>
 
 #include <asm/io.h>
-#include <asm/hardware/clock.h>
 
 #define RNG_OUT_REG             0x00            /* Output register */
 #define RNG_STAT_REG            0x04            /* Status register
@@ -52,7 +52,7 @@
 
 static void __iomem *rng_base;
 static struct clk *rng_ick;
-static struct device *rng_dev;
+static struct platform_device *rng_dev;
 
 static u32 omap_rng_read_reg(int reg)
 {
@@ -83,9 +83,8 @@ static struct hwrng omap_rng_ops = {
         .data_read      = omap_rng_data_read,
 };
 
-static int __init omap_rng_probe(struct device *dev)
+static int __init omap_rng_probe(struct platform_device *pdev)
 {
-        struct platform_device *pdev = to_platform_device(dev);
         struct resource *res, *mem;
         int ret;
 
@@ -95,16 +94,14 @@ static int __init omap_rng_probe(struct device *dev)
          */
         BUG_ON(rng_dev);
 
-        if (cpu_is_omap24xx()) {
+        if (cpu_is_omap24xx()) {
                 rng_ick = clk_get(NULL, "rng_ick");
                 if (IS_ERR(rng_ick)) {
-                        dev_err(dev, "Could not get rng_ick\n");
+                        dev_err(&pdev->dev, "Could not get rng_ick\n");
                         ret = PTR_ERR(rng_ick);
                         return ret;
-                }
-                else {
-                        clk_use(rng_ick);
-                }
+                } else
+                        clk_enable(rng_ick);
         }
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -117,7 +114,7 @@ static int __init omap_rng_probe(struct device *dev)
         if (mem == NULL)
                 return -EBUSY;
 
-        dev_set_drvdata(dev, mem);
+        dev_set_drvdata(&pdev->dev, mem);
         rng_base = (u32 __iomem *)io_p2v(res->start);
 
         ret = hwrng_register(&omap_rng_ops);
@@ -127,25 +124,25 @@ static int __init omap_rng_probe(struct device *dev)
                 return ret;
         }
 
-        dev_info(dev, "OMAP Random Number Generator ver. %02x\n",
+        dev_info(&pdev->dev, "OMAP Random Number Generator ver. %02x\n",
                 omap_rng_read_reg(RNG_REV_REG));
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
 
-        rng_dev = dev;
+        rng_dev = pdev;
 
         return 0;
 }
 
-static int __exit omap_rng_remove(struct device *dev)
+static int __exit omap_rng_remove(struct platform_device *pdev)
 {
-        struct resource *mem = dev_get_drvdata(dev);
+        struct resource *mem = dev_get_drvdata(&pdev->dev);
 
         hwrng_unregister(&omap_rng_ops);
 
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
 
         if (cpu_is_omap24xx()) {
-                clk_unuse(rng_ick);
+                clk_disable(rng_ick);
                 clk_put(rng_ick);
         }
 
@@ -157,18 +154,16 @@ static int __exit omap_rng_remove(struct device *dev)
 
 #ifdef CONFIG_PM
 
-static int omap_rng_suspend(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_suspend(struct platform_device *pdev, pm_message_t message)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x0);
-
         return 0;
 }
 
-static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
+static int omap_rng_resume(struct platform_device *pdev)
 {
         omap_rng_write_reg(RNG_MASK_REG, 0x1);
-
-        return 1;
+        return 0;
 }
 
 #else
@@ -179,9 +174,11 @@ static int omap_rng_resume(struct device *dev, pm_message_t message, u32 level)
 #endif
 
 
-static struct device_driver omap_rng_driver = {
-        .name           = "omap_rng",
-        .bus            = &platform_bus_type,
+static struct platform_driver omap_rng_driver = {
+        .driver = {
+                .name           = "omap_rng",
+                .owner          = THIS_MODULE,
+        },
         .probe          = omap_rng_probe,
         .remove         = __exit_p(omap_rng_remove),
         .suspend        = omap_rng_suspend,
@@ -193,12 +190,12 @@ static int __init omap_rng_init(void)
         if (!cpu_is_omap16xx() && !cpu_is_omap24xx())
                 return -ENODEV;
 
-        return driver_register(&omap_rng_driver);
+        return platform_driver_register(&omap_rng_driver);
 }
 
 static void __exit omap_rng_exit(void)
 {
-        driver_unregister(&omap_rng_driver);
+        platform_driver_unregister(&omap_rng_driver);
 }
 
 module_init(omap_rng_init);
diff --git a/drivers/edac/edac_mc.h b/drivers/edac/edac_mc.h
index bf6ab8a8d5ed..a1cfd4e3c97d 100644
--- a/drivers/edac/edac_mc.h
+++ b/drivers/edac/edac_mc.h
@@ -29,6 +29,7 @@
 #include <linux/rcupdate.h>
 #include <linux/completion.h>
 #include <linux/kobject.h>
+#include <linux/platform_device.h>
 
 #define EDAC_MC_LABEL_LEN       31
 #define MC_PROC_NAME_MAX_LEN 7
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ced309ff056f..eae9e81be375 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -232,7 +232,7 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
         unsigned long timeout;
 
         timeout = jiffies + POLL_TIMEOUT;
-        while (time_before(jiffies, timeout)) {
+        while (1) {
                 status = inb(ACBST);
 
                 /* Reset the status register to avoid the hang */
@@ -242,7 +242,10 @@ static void scx200_acb_poll(struct scx200_acb_iface *iface)
                         scx200_acb_machine(iface, status);
                         return;
                 }
-                yield();
+                if (time_after(jiffies, timeout))
+                        break;
+                cpu_relax();
+                cond_resched();
         }
 
         dev_err(&iface->adapter.dev, "timeout in state %s\n",
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index aaa74f293aaf..b08755e2e68f 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -2515,6 +2515,9 @@ static int sbp2scsi_slave_configure(struct scsi_device *sdev)
                 sdev->skip_ms_page_8 = 1;
         if (scsi_id->workarounds & SBP2_WORKAROUND_FIX_CAPACITY)
                 sdev->fix_capacity = 1;
+        if (scsi_id->ne->guid_vendor_id == 0x0010b9 && /* Maxtor's OUI */
+            (sdev->type == TYPE_DISK || sdev->type == TYPE_RBC))
+                sdev->allow_restart = 1;
         return 0;
 }
 
diff --git a/drivers/isdn/hardware/eicon/divasync.h b/drivers/isdn/hardware/eicon/divasync.h
index 0a5be7f969f2..af3eb9e795b5 100644
--- a/drivers/isdn/hardware/eicon/divasync.h
+++ b/drivers/isdn/hardware/eicon/divasync.h
@@ -256,7 +256,6 @@ typedef struct
 #define NO_ORDER_CHECK_MASK 0x00000010
 #define LOW_CHANNEL_MASK 0x00000020
 #define NO_HSCX30_MASK  0x00000040
-#define MODE_MASK   0x00000080
 #define SET_BOARD   0x00001000
 #define SET_CRC4   0x00030000
 #define SET_L1_TRISTATE  0x00040000
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index ff83c9b5979e..b99c19c7eb22 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -162,7 +162,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                 goto out;
         }
 
-        min_spacing = mddev->array_size;
+        min_spacing = conf->array_size;
         sector_div(min_spacing, PAGE_SIZE/sizeof(struct dev_info *));
 
         /* min_spacing is the minimum spacing that will fit the hash
@@ -171,7 +171,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
          * that is larger than min_spacing as use the size of that as
          * the actual spacing
          */
-        conf->hash_spacing = mddev->array_size;
+        conf->hash_spacing = conf->array_size;
         for (i=0; i < cnt-1 ; i++) {
                 sector_t sz = 0;
                 int j;
@@ -228,7 +228,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
         curr_offset = 0;
         i = 0;
         for (curr_offset = 0;
-             curr_offset < mddev->array_size;
+             curr_offset < conf->array_size;
              curr_offset += conf->hash_spacing) {
 
                 while (i < mddev->raid_disks-1 &&
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index 212268881857..dc79b0a0059f 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -173,6 +173,9 @@ pnpacpi_parse_allocated_address_space(struct pnp_resource_table *res_table,
                 return;
         }
 
+        if (p->producer_consumer == ACPI_PRODUCER)
+                return;
+
         if (p->resource_type == ACPI_MEMORY_RANGE)
                 pnpacpi_parse_allocated_memresource(res_table,
                                 p->minimum, p->address_length);
@@ -252,9 +255,14 @@ static acpi_status pnpacpi_allocated_resource(struct acpi_resource *res,
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_ADDRESS64:
+                if (res->data.ext_address64.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
                 break;
 
         case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
+                if (res->data.extended_irq.producer_consumer == ACPI_PRODUCER)
+                        return AE_OK;
+
                 for (i = 0; i < res->data.extended_irq.interrupt_count; i++) {
                         pnpacpi_parse_allocated_irqresource(res_table,
                                 res->data.extended_irq.interrupts[i],
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 8b08121b390b..3e827e04a2aa 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1913,9 +1913,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         u8 chip_rev;
         u32 dac;
 
-        if (!par->vram_size)    /* may have already been probed */
-                par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
-
         /* Get the chip revision */
         chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
 
@@ -2028,9 +2025,6 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
 
         aty128_init_engine(par);
 
-        if (register_framebuffer(info) < 0)
-                return 0;
-
         par->pm_reg = pci_find_capability(pdev, PCI_CAP_ID_PM);
         par->pdev = pdev;
         par->asleep = 0;
@@ -2040,6 +2034,9 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         aty128_bl_init(par);
 #endif
 
+        if (register_framebuffer(info) < 0)
+                return 0;
+
         printk(KERN_INFO "fb%d: %s frame buffer device on %s\n",
                info->node, info->fix.id, video_card);
 
@@ -2089,7 +2086,6 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
         par = info->par;
 
         info->pseudo_palette = par->pseudo_palette;
-        info->fix = aty128fb_fix;
 
         /* Virtualize mmio region */
         info->fix.mmio_start = reg_addr;
diff --git a/drivers/video/au1100fb.c b/drivers/video/au1100fb.c
index a92a91fef16f..f25d5d648333 100644
--- a/drivers/video/au1100fb.c
+++ b/drivers/video/au1100fb.c
@@ -156,7 +156,7 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
                         info->fix.visual = FB_VISUAL_TRUECOLOR;
                         info->fix.line_length = info->var.xres_virtual << 1; /* depth=16 */
-        }
+                }
         } else {
                 /* mono */
                 info->fix.visual = FB_VISUAL_MONO10;
@@ -164,20 +164,16 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
         }
 
         info->screen_size = info->fix.line_length * info->var.yres_virtual;
+        info->var.rotate = ((fbdev->panel->control_base&LCD_CONTROL_SM_MASK) \
+                                >> LCD_CONTROL_SM_BIT) * 90;
 
         /* Determine BPP mode and format */
-        fbdev->regs->lcd_control = fbdev->panel->control_base |
-                            ((info->var.rotate/90) << LCD_CONTROL_SM_BIT);
-
-        fbdev->regs->lcd_intenable = 0;
-        fbdev->regs->lcd_intstatus = 0;
-
+        fbdev->regs->lcd_control = fbdev->panel->control_base;
         fbdev->regs->lcd_horztiming = fbdev->panel->horztiming;
-
         fbdev->regs->lcd_verttiming = fbdev->panel->verttiming;
-
         fbdev->regs->lcd_clkcontrol = fbdev->panel->clkcontrol_base;
-
+        fbdev->regs->lcd_intenable = 0;
+        fbdev->regs->lcd_intstatus = 0;
         fbdev->regs->lcd_dmaaddr0 = LCD_DMA_SA_N(fbdev->fb_phys);
 
         if (panel_is_dual(fbdev->panel)) {
@@ -206,6 +202,8 @@ int au1100fb_setmode(struct au1100fb_device *fbdev)
 
         /* Resume controller */
         fbdev->regs->lcd_control |= LCD_CONTROL_GO;
+        mdelay(10);
+        au1100fb_fb_blank(VESA_NO_BLANKING, info);
 
         return 0;
 }
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index fcaeead9696b..50cfca5c7efd 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -512,7 +512,11 @@ befs_utf2nls(struct super_block *sb, const char *in,
         wchar_t uni;
         int unilen, utflen;
         char *result;
-        int maxlen = in_len; /* The utf8->nls conversion can't make more chars */
+        /* The utf8->nls conversion won't make the final nls string bigger
+         * than the utf one, but if the string is pure ascii they'll have the
+         * same width and an extra char is needed to save the additional \0
+         */
+        int maxlen = in_len + 1;
 
         befs_debug(sb, "---> utf2nls()");
 
@@ -588,7 +592,10 @@ befs_nls2utf(struct super_block *sb, const char *in,
         wchar_t uni;
         int unilen, utflen;
         char *result;
-        int maxlen = 3 * in_len;
+        /* There're nls characters that will translate to 3-chars-wide UTF-8
+         * characters, a additional byte is needed to save the final \0
+         * in special cases */
+        int maxlen = (3 * in_len) + 1;
 
         befs_debug(sb, "---> nls2utf()\n");
 
diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c
index f318b58510fd..1627edd50810 100644
--- a/fs/reiserfs/file.c
+++ b/fs/reiserfs/file.c
@@ -48,8 +48,8 @@ static int reiserfs_file_release(struct inode *inode, struct file *filp)
                 return 0;
         }
 
-        reiserfs_write_lock(inode->i_sb);
         mutex_lock(&inode->i_mutex);
+        reiserfs_write_lock(inode->i_sb);
         /* freeing preallocation only involves relogging blocks that
          * are already in the current transaction.  preallocation gets
          * freed at the end of each transaction, so it is impossible for
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 12dfdcfbee3d..52f1e2136546 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -39,14 +39,10 @@ void reiserfs_delete_inode(struct inode *inode)
 
         /* The = 0 happens when we abort creating a new inode for some reason like lack of space.. */
         if (!(inode->i_state & I_NEW) && INODE_PKEY(inode)->k_objectid != 0) {  /* also handles bad_inode case */
-                mutex_lock(&inode->i_mutex);
-
                 reiserfs_delete_xattrs(inode);
 
-                if (journal_begin(&th, inode->i_sb, jbegin_count)) {
-                        mutex_unlock(&inode->i_mutex);
+                if (journal_begin(&th, inode->i_sb, jbegin_count))
                         goto out;
-                }
                 reiserfs_update_inode_transaction(inode);
 
                 err = reiserfs_delete_object(&th, inode);
@@ -57,12 +53,8 @@ void reiserfs_delete_inode(struct inode *inode)
                 if (!err) 
                         DQUOT_FREE_INODE(inode);
 
-                if (journal_end(&th, inode->i_sb, jbegin_count)) {
-                        mutex_unlock(&inode->i_mutex);
+                if (journal_end(&th, inode->i_sb, jbegin_count))
                         goto out;
-                }
-
-                mutex_unlock(&inode->i_mutex);
 
                 /* check return value from reiserfs_delete_object after
                  * ending the transaction
@@ -2348,6 +2340,7 @@ static int reiserfs_write_full_page(struct page *page,
         unsigned long end_index = inode->i_size >> PAGE_CACHE_SHIFT;
         int error = 0;
         unsigned long block;
+        sector_t last_block;
         struct buffer_head *head, *bh;
         int partial = 0;
         int nr = 0;
@@ -2395,10 +2388,19 @@ static int reiserfs_write_full_page(struct page *page,
         }
         bh = head;
         block = page->index << (PAGE_CACHE_SHIFT - s->s_blocksize_bits);
+        last_block = (i_size_read(inode) - 1) >> inode->i_blkbits;
         /* first map all the buffers, logging any direct items we find */
         do {
-                if ((checked || buffer_dirty(bh)) && (!buffer_mapped(bh) ||
-                                                      (buffer_mapped(bh)
+                if (block > last_block) {
+                        /*
+                         * This can happen when the block size is less than
+                         * the page size.  The corresponding bytes in the page
+                         * were zero filled above
+                         */
+                        clear_buffer_dirty(bh);
+                        set_buffer_uptodate(bh);
+                } else if ((checked || buffer_dirty(bh)) &&
+                           (!buffer_mapped(bh) || (buffer_mapped(bh)
                                                        && bh->b_blocknr ==
                                                        0))) {
                         /* not mapped yet, or it points to a direct item, search
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index 745c88100895..a986b5e1e288 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -116,12 +116,12 @@ static int reiserfs_unpack(struct inode *inode, struct file *filp)
         if (REISERFS_I(inode)->i_flags & i_nopack_mask) {
                 return 0;
         }
-        reiserfs_write_lock(inode->i_sb);
 
         /* we need to make sure nobody is changing the file size beneath
          ** us
          */
         mutex_lock(&inode->i_mutex);
+        reiserfs_write_lock(inode->i_sb);
 
         write_from = inode->i_size & (blocksize - 1);
         /* if we are on a block boundary, we are already unpacked.  */
diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c
index 3873c672cb4c..33323473e3c4 100644
--- a/fs/udf/ialloc.c
+++ b/fs/udf/ialloc.c
@@ -75,6 +75,12 @@ struct inode * udf_new_inode (struct inode *dir, int mode, int * err)
         }
         *err = -ENOSPC;
 
+        UDF_I_UNIQUE(inode) = 0;
+        UDF_I_LENEXTENTS(inode) = 0;
+        UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
+        UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
+        UDF_I_STRAT4096(inode) = 0;
+
         block = udf_new_block(dir->i_sb, NULL, UDF_I_LOCATION(dir).partitionReferenceNum,
                 start, err);
         if (*err)
@@ -84,11 +90,6 @@ struct inode * udf_new_inode (struct inode *dir, int mode, int * err)
         }
 
         mutex_lock(&sbi->s_alloc_mutex);
-        UDF_I_UNIQUE(inode) = 0;
-        UDF_I_LENEXTENTS(inode) = 0;
-        UDF_I_NEXT_ALLOC_BLOCK(inode) = 0;
-        UDF_I_NEXT_ALLOC_GOAL(inode) = 0;
-        UDF_I_STRAT4096(inode) = 0;
         if (UDF_SB_LVIDBH(sb))
         {
                 struct logicalVolHeaderDesc *lvhd;
diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c
index b01804baa120..b82381475779 100644
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -248,7 +248,7 @@ static void ufs_change_blocknr(struct inode *inode, unsigned int baseblk,
 
                 if (likely(cur_index != index)) {
                         page = ufs_get_locked_page(mapping, index);
-                        if (IS_ERR(page))
+                        if (!page || IS_ERR(page)) /* it was truncated or EIO */
                                 continue;
                 } else
                         page = locked_page;
diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index 337cf2c46d10..22f820a9b15c 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -251,12 +251,12 @@ struct page *ufs_get_locked_page(struct address_space *mapping,
 {
         struct page *page;
 
-try_again:
         page = find_lock_page(mapping, index);
         if (!page) {
                 page = read_cache_page(mapping, index,
                                        (filler_t*)mapping->a_ops->readpage,
                                        NULL);
+
                 if (IS_ERR(page)) {
                         printk(KERN_ERR "ufs_change_blocknr: "
                                "read_cache_page error: ino %lu, index: %lu\n",
@@ -266,6 +266,14 @@ try_again:
 
                 lock_page(page);
 
+                if (unlikely(page->mapping == NULL)) {
+                        /* Truncate got there first */
+                        unlock_page(page);
+                        page_cache_release(page);
+                        page = NULL;
+                        goto out;
+                }
+
                 if (!PageUptodate(page) || PageError(page)) {
                         unlock_page(page);
                         page_cache_release(page);
@@ -275,15 +283,8 @@ try_again:
                                mapping->host->i_ino, index);
 
                         page = ERR_PTR(-EIO);
-                        goto out;
                 }
         }
-
-        if (unlikely(!page->mapping || !page_has_buffers(page))) {
-                unlock_page(page);
-                page_cache_release(page);
-                goto try_again;/*we really need these buffers*/
-        }
 out:
         return page;
 }
diff --git a/include/linux/debug_locks.h b/include/linux/debug_locks.h
index 6a7047851e48..88dafa246d87 100644
--- a/include/linux/debug_locks.h
+++ b/include/linux/debug_locks.h
@@ -1,6 +1,8 @@
 #ifndef __LINUX_DEBUG_LOCKING_H
 #define __LINUX_DEBUG_LOCKING_H
 
+struct task_struct;
+
 extern int debug_locks;
 extern int debug_locks_silent;
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6afa72e080cb..6674fc1e51bf 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1558,6 +1558,14 @@ static inline void freeze(struct task_struct *p)
 }
 
 /*
+ * Sometimes we may need to cancel the previous 'freeze' request
+ */
+static inline void do_not_freeze(struct task_struct *p)
+{
+        p->flags &= ~PF_FREEZE;
+}
+
+/*
  * Wake up a frozen process
  */
 static inline int thaw_process(struct task_struct *p)
diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h
index 1ab806c47514..2d9b1b60798a 100644
--- a/include/linux/vmstat.h
+++ b/include/linux/vmstat.h
@@ -41,23 +41,23 @@ DECLARE_PER_CPU(struct vm_event_state, vm_event_states);
 
 static inline void __count_vm_event(enum vm_event_item item)
 {
-        __get_cpu_var(vm_event_states.event[item])++;
+        __get_cpu_var(vm_event_states).event[item]++;
 }
 
 static inline void count_vm_event(enum vm_event_item item)
 {
-        get_cpu_var(vm_event_states.event[item])++;
+        get_cpu_var(vm_event_states).event[item]++;
         put_cpu();
 }
 
 static inline void __count_vm_events(enum vm_event_item item, long delta)
 {
-        __get_cpu_var(vm_event_states.event[item]) += delta;
+        __get_cpu_var(vm_event_states).event[item] += delta;
 }
 
 static inline void count_vm_events(enum vm_event_item item, long delta)
 {
-        get_cpu_var(vm_event_states.event[item]) += delta;
+        get_cpu_var(vm_event_states).event[item] += delta;
         put_cpu();
 }
 
diff --git a/include/net/red.h b/include/net/red.h
index 5ccdbb3d4722..a4eb37946f2c 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -212,7 +212,7 @@ static inline unsigned long red_calc_qavg_from_idle_time(struct red_parms *p)
                  * Seems, it is the best solution to
                  * problem of too coarse exponent tabulation.
                  */
-                us_idle = (p->qavg * us_idle) >> p->Scell_log;
+                us_idle = (p->qavg * (u64)us_idle) >> p->Scell_log;
 
                 if (us_idle < (p->qavg >> 1))
                         return p->qavg - us_idle;
diff --git a/kernel/fork.c b/kernel/fork.c
index 1b0f7b1e0881..aa36c43783cc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1387,8 +1387,10 @@ long do_fork(unsigned long clone_flags,
 
                 if (clone_flags & CLONE_VFORK) {
                         wait_for_completion(&vfork);
-                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE))
+                        if (unlikely (current->ptrace & PT_TRACE_VFORK_DONE)) {
+                                current->ptrace_message = nr;
                                 ptrace_notify ((PTRACE_EVENT_VFORK_DONE << 8) | SIGTRAP);
+                        }
                 }
         } else {
                 free_pid(pid);
diff --git a/kernel/futex.c b/kernel/futex.c
index dda2049692a2..c2b2e0b83abf 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -948,6 +948,7 @@ static int unqueue_me(struct futex_q *q)
         /* In the common case we don't take the spinlock, which is nice. */
  retry:
         lock_ptr = q->lock_ptr;
+        barrier();
         if (lock_ptr != 0) {
                 spin_lock(lock_ptr);
                 /*
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index d1aab1a452cc..c5cca3f65cb7 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -39,7 +39,7 @@ void compat_exit_robust_list(struct task_struct *curr)
 {
         struct compat_robust_list_head __user *head = curr->compat_robust_list;
         struct robust_list __user *entry, *pending;
-        unsigned int limit = ROBUST_LIST_LIMIT, pi;
+        unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
         compat_uptr_t uentry, upending;
         compat_long_t futex_offset;
 
@@ -59,10 +59,10 @@ void compat_exit_robust_list(struct task_struct *curr)
          * if it exists:
          */
         if (fetch_robust_entry(&upending, &pending,
-                               &head->list_op_pending, &pi))
+                               &head->list_op_pending, &pip))
                 return;
         if (upending)
-                handle_futex_death((void *)pending + futex_offset, curr, pi);
+                handle_futex_death((void *)pending + futex_offset, curr, pip);
 
         while (compat_ptr(uentry) != &head->list) {
                 /*
diff --git a/kernel/power/process.c b/kernel/power/process.c
index b2a5f671d6cd..72e72d2c61e6 100644
--- a/kernel/power/process.c
+++ b/kernel/power/process.c
@@ -66,13 +66,25 @@ static inline void freeze_process(struct task_struct *p)
         }
 }
 
+static void cancel_freezing(struct task_struct *p)
+{
+        unsigned long flags;
+
+        if (freezing(p)) {
+                pr_debug("  clean up: %s\n", p->comm);
+                do_not_freeze(p);
+                spin_lock_irqsave(&p->sighand->siglock, flags);
+                recalc_sigpending_tsk(p);
+                spin_unlock_irqrestore(&p->sighand->siglock, flags);
+        }
+}
+
 /* 0 = success, else # of processes that we failed to stop */
 int freeze_processes(void)
 {
         int todo, nr_user, user_frozen;
         unsigned long start_time;
         struct task_struct *g, *p;
-        unsigned long flags;
 
         printk( "Stopping tasks: " );
         start_time = jiffies;
@@ -85,6 +97,10 @@ int freeze_processes(void)
                                 continue;
                         if (frozen(p))
                                 continue;
+                        if (p->state == TASK_TRACED && frozen(p->parent)) {
+                                cancel_freezing(p);
+                                continue;
+                        }
                         if (p->mm && !(p->flags & PF_BORROWED_MM)) {
                                 /* The task is a user-space one.
                                  * Freeze it unless there's a vfork completion
@@ -126,13 +142,7 @@ int freeze_processes(void)
                 do_each_thread(g, p) {
                         if (freezeable(p) && !frozen(p))
                                 printk(KERN_ERR "  %s\n", p->comm);
-                        if (freezing(p)) {
-                                pr_debug("  clean up: %s\n", p->comm);
-                                p->flags &= ~PF_FREEZE;
-                                spin_lock_irqsave(&p->sighand->siglock, flags);
-                                recalc_sigpending_tsk(p);
-                                spin_unlock_irqrestore(&p->sighand->siglock, flags);
-                        }
+                        cancel_freezing(p);
                 } while_each_thread(g, p);
                 read_unlock(&tasklist_lock);
                 return todo;
diff --git a/kernel/printk.c b/kernel/printk.c
index 65ca0688f86f..1149365e989e 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -799,6 +799,9 @@ void release_console_sem(void)
                 up(&secondary_console_sem);
                 return;
         }
+
+        console_may_schedule = 0;
+
         for ( ; ; ) {
                 spin_lock_irqsave(&logbuf_lock, flags);
                 wake_klogd |= log_start - log_end;
@@ -812,7 +815,6 @@ void release_console_sem(void)
                 local_irq_restore(flags);
         }
         console_locked = 0;
-        console_may_schedule = 0;
         up(&console_sem);
         spin_unlock_irqrestore(&logbuf_lock, flags);
         if (wake_klogd && !oops_in_progress && waitqueue_active(&log_wait)) {
diff --git a/kernel/resource.c b/kernel/resource.c
index 0dd3a857579e..46286434af80 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -244,6 +244,7 @@ int find_next_system_ram(struct resource *res)
 
         start = res->start;
         end = res->end;
+        BUG_ON(start >= end);
 
         read_lock(&resource_lock);
         for (p = iomem_resource.child; p ; p = p->sibling) {
@@ -254,15 +255,17 @@ int find_next_system_ram(struct resource *res)
                         p = NULL;
                         break;
                 }
-                if (p->start >= start)
+                if ((p->end >= start) && (p->start < end))
                         break;
         }
         read_unlock(&resource_lock);
         if (!p)
                 return -1;
         /* copy data */
-        res->start = p->start;
-        res->end = p->end;
+        if (res->start < p->start)
+                res->start = p->start;
+        if (res->end > p->end)
+                res->end = p->end;
         return 0;
 }
 #endif
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index 3d9c4dc965ed..58c577dd82e5 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -162,6 +162,7 @@ static void rwlock_bug(rwlock_t *lock, const char *msg)
 
 #define RWLOCK_BUG_ON(cond, lock, msg) if (unlikely(cond)) rwlock_bug(lock, msg)
 
+#if 0           /* __write_lock_debug() can lock up - maybe this can too? */
 static void __read_lock_debug(rwlock_t *lock)
 {
         int print_once = 1;
@@ -184,12 +185,12 @@ static void __read_lock_debug(rwlock_t *lock)
                 }
         }
 }
+#endif
 
 void _raw_read_lock(rwlock_t *lock)
 {
         RWLOCK_BUG_ON(lock->magic != RWLOCK_MAGIC, lock, "bad magic");
-        if (unlikely(!__raw_read_trylock(&lock->raw_lock)))
-                __read_lock_debug(lock);
+        __raw_read_lock(&lock->raw_lock);
 }
 
 int _raw_read_trylock(rwlock_t *lock)
@@ -235,6 +236,7 @@ static inline void debug_write_unlock(rwlock_t *lock)
         lock->owner_cpu = -1;
 }
 
+#if 0           /* This can cause lockups */
 static void __write_lock_debug(rwlock_t *lock)
 {
         int print_once = 1;
@@ -257,12 +259,12 @@ static void __write_lock_debug(rwlock_t *lock)
                 }
         }
 }
+#endif
 
 void _raw_write_lock(rwlock_t *lock)
 {
         debug_write_lock_before(lock);
-        if (unlikely(!__raw_write_trylock(&lock->raw_lock)))
-                __write_lock_debug(lock);
+        __raw_write_lock(&lock->raw_lock);
         debug_write_lock_after(lock);
 }
 
diff --git a/mm/fadvise.c b/mm/fadvise.c
index 60a5d55e51d9..168c78a121bb 100644
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -73,7 +73,6 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
                 file->f_ra.ra_pages = bdi->ra_pages * 2;
                 break;
         case POSIX_FADV_WILLNEED:
-        case POSIX_FADV_NOREUSE:
                 if (!mapping->a_ops->readpage) {
                         ret = -EINVAL;
                         break;
@@ -94,6 +93,8 @@ asmlinkage long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
                 if (ret > 0)
                         ret = 0;
                 break;
+        case POSIX_FADV_NOREUSE:
+                break;
         case POSIX_FADV_DONTNEED:
                 if (!bdi_write_congested(mapping->backing_dev_info))
                         filemap_flush(mapping);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 01c9fb97c619..c37319542b70 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -52,6 +52,9 @@ static int __add_section(struct zone *zone, unsigned long phys_start_pfn)
         int nr_pages = PAGES_PER_SECTION;
         int ret;
 
+        if (pfn_valid(phys_start_pfn))
+                return -EEXIST;
+
         ret = sparse_add_one_section(zone, phys_start_pfn, nr_pages);
 
         if (ret < 0)
@@ -76,15 +79,22 @@ int __add_pages(struct zone *zone, unsigned long phys_start_pfn,
 {
         unsigned long i;
         int err = 0;
+        int start_sec, end_sec;
+        /* during initialize mem_map, align hot-added range to section */
+        start_sec = pfn_to_section_nr(phys_start_pfn);
+        end_sec = pfn_to_section_nr(phys_start_pfn + nr_pages - 1);
 
-        for (i = 0; i < nr_pages; i += PAGES_PER_SECTION) {
-                err = __add_section(zone, phys_start_pfn + i);
+        for (i = start_sec; i <= end_sec; i++) {
+                err = __add_section(zone, i << PFN_SECTION_SHIFT);
 
-                /* We want to keep adding the rest of the
-                 * sections if the first ones already exist
+                /*
+                 * EEXIST is finally dealed with by ioresource collision
+                 * check. see add_memory() => register_memory_resource()
+                 * Warning will be printed if there is collision.
                  */
                 if (err && (err != -EEXIST))
                         break;
+                err = 0;
         }
 
         return err;
@@ -156,7 +166,7 @@ int online_pages(unsigned long pfn, unsigned long nr_pages)
         res.flags = IORESOURCE_MEM; /* we just need system ram */
         section_end = res.end;
 
-        while (find_next_system_ram(&res) >= 0) {
+        while ((res.start < res.end) && (find_next_system_ram(&res) >= 0)) {
                 start_pfn = (unsigned long)(res.start >> PAGE_SHIFT);
                 nr_pages = (unsigned long)
                            ((res.end + 1 - res.start) >> PAGE_SHIFT);
@@ -213,10 +223,9 @@ static void rollback_node_hotadd(int nid, pg_data_t *pgdat)
 }
 
 /* add this memory to iomem resource */
-static void register_memory_resource(u64 start, u64 size)
+static struct resource *register_memory_resource(u64 start, u64 size)
 {
         struct resource *res;
-
         res = kzalloc(sizeof(struct resource), GFP_KERNEL);
         BUG_ON(!res);
 
@@ -228,7 +237,18 @@ static void register_memory_resource(u64 start, u64 size)
                 printk("System RAM resource %llx - %llx cannot be added\n",
                 (unsigned long long)res->start, (unsigned long long)res->end);
                 kfree(res);
+                res = NULL;
         }
+        return res;
+}
+
+static void release_memory_resource(struct resource *res)
+{
+        if (!res)
+                return;
+        release_resource(res);
+        kfree(res);
+        return;
 }
 
 
@@ -237,8 +257,13 @@ int add_memory(int nid, u64 start, u64 size)
 {
         pg_data_t *pgdat = NULL;
         int new_pgdat = 0;
+        struct resource *res;
         int ret;
 
+        res = register_memory_resource(start, size);
+        if (!res)
+                return -EEXIST;
+
         if (!node_online(nid)) {
                 pgdat = hotadd_new_pgdat(nid, start);
                 if (!pgdat)
@@ -268,14 +293,13 @@ int add_memory(int nid, u64 start, u64 size)
                 BUG_ON(ret);
         }
 
-        /* register this memory as resource */
-        register_memory_resource(start, size);
-
         return ret;
 error:
         /* rollback pgdat allocation and others */
         if (new_pgdat)
                 rollback_node_hotadd(nid, pgdat);
+        if (res)
+                release_memory_resource(res);
 
         return ret;
 }
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 06abb6634f5b..53086fb75089 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -85,7 +85,7 @@ void br_ifinfo_notify(int event, struct net_bridge_port *port)
                 goto err_out;
 
         err = br_fill_ifinfo(skb, port, current->pid, 0, event, 0);
-        if (err)
+        if (err < 0)
                 goto err_kfree;
 
         NETLINK_CB(skb).dst_group = RTNLGRP_LINK;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 738dad9f7d49..104af5d5bcbc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3541,7 +3541,8 @@ void tcp_cwnd_application_limited(struct sock *sk)
         if (inet_csk(sk)->icsk_ca_state == TCP_CA_Open &&
             sk->sk_socket && !test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
                 /* Limited by application or receiver window. */
-                u32 win_used = max(tp->snd_cwnd_used, 2U);
+                u32 init_win = tcp_init_cwnd(tp, __sk_dst_get(sk));
+                u32 win_used = max(tp->snd_cwnd_used, init_win);
                 if (win_used < tp->snd_cwnd) {
                         tp->snd_ssthresh = tcp_current_ssthresh(sk);
                         tp->snd_cwnd = (tp->snd_cwnd + win_used) >> 1;
diff --git a/net/lapb/lapb_iface.c b/net/lapb/lapb_iface.c
index d504eed416f6..7e6bc41eeb21 100644
--- a/net/lapb/lapb_iface.c
+++ b/net/lapb/lapb_iface.c
@@ -238,11 +238,13 @@ int lapb_setparms(struct net_device *dev, struct lapb_parms_struct *parms)
                 goto out_put;
 
         if (lapb->state == LAPB_STATE_0) {
-                if (((parms->mode & LAPB_EXTENDED) &&
-                     (parms->window < 1 || parms->window > 127)) ||
-                    (parms->window < 1 || parms->window > 7))
-                        goto out_put;
-
+                if (parms->mode & LAPB_EXTENDED) {
+                        if (parms->window < 1 || parms->window > 127)
+                                goto out_put;
+                } else {
+                        if (parms->window < 1 || parms->window > 7)
+                                goto out_put;
+                }
                 lapb->mode    = parms->mode;
                 lapb->window  = parms->window;
         }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index d6cfe84d521b..2652ead96c64 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -784,24 +784,20 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                 copied += used;
                 len -= used;
 
-                if (used + offset < skb->len)
-                        continue;
-
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, 0);
                         *seq = 0;
                 }
+
+                /* For non stream protcols we get one packet per recvmsg call */
+                if (sk->sk_type != SOCK_STREAM)
+                        goto copy_uaddr;
+
+                /* Partial read */
+                if (used + offset < skb->len)
+                        continue;
         } while (len > 0);
 
-        /* 
-         * According to UNIX98, msg_name/msg_namelen are ignored
-         * on connected socket. -ANK
-         * But... af_llc still doesn't have separate sets of methods for
-         * SOCK_DGRAM and SOCK_STREAM :-( So we have to do this test, will
-         * eventually fix this tho :-) -acme
-         */
-        if (sk->sk_type == SOCK_DGRAM)
-                goto copy_uaddr;
 out:
         release_sock(sk);
         return copied;
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 20c4eb5c1ac6..42eb0c3a9780 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -51,10 +51,10 @@ void llc_save_primitive(struct sock *sk, struct sk_buff* skb, u8 prim)
 {
         struct sockaddr_llc *addr;
 
-        if (skb->sk->sk_type == SOCK_STREAM) /* See UNIX98 */
-                return;
        /* save primitive for use by the user. */
         addr              = llc_ui_skb_cb(skb);
+
+        memset(addr, 0, sizeof(*addr));
         addr->sllc_family = sk->sk_family;
         addr->sllc_arphrd = skb->dev->type;
         addr->sllc_test   = prim == LLC_TEST_PRIM;
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c7844bacbbcb..a19eff12cf78 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -430,7 +430,7 @@ qdisc_create(struct net_device *dev, u32 handle, struct rtattr **tca, int *errp)
         }
 #endif
 
-        err = -EINVAL;
+        err = -ENOENT;
         if (ops == NULL)
                 goto err_out;
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 7026b0866b7b..00cb388ece03 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -71,7 +71,12 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
         new = detail->alloc();
         if (!new)
                 return NULL;
+        /* must fully initialise 'new', else
+         * we might get lose if we need to
+         * cache_put it soon.
+         */
         cache_init(new);
+        detail->init(new, key);
 
         write_lock(&detail->hash_lock);
 
@@ -85,7 +90,6 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
                         return tmp;
                 }
         }
-        detail->init(new, key);
         new->next = *head;
         *head = new;
         detail->entries++;
diff --git a/sound/aoa/codecs/snd-aoa-codec-toonie.c b/sound/aoa/codecs/snd-aoa-codec-toonie.c
index bcc555647e79..3c7d1d8a9a6f 100644
--- a/sound/aoa/codecs/snd-aoa-codec-toonie.c
+++ b/sound/aoa/codecs/snd-aoa-codec-toonie.c
@@ -51,6 +51,13 @@ static struct transfer_info toonie_transfers[] = {
         {}
 };
 
+static int toonie_usable(struct codec_info_item *cii,
+                         struct transfer_info *ti,
+                         struct transfer_info *out)
+{
+        return 1;
+}
+
 #ifdef CONFIG_PM
 static int toonie_suspend(struct codec_info_item *cii, pm_message_t state)
 {
@@ -69,6 +76,7 @@ static struct codec_info toonie_codec_info = {
         .sysclock_factor = 256,
         .bus_factor = 64,
         .owner = THIS_MODULE,
+        .usable = toonie_usable,
 #ifdef CONFIG_PM
         .suspend = toonie_suspend,
         .resume = toonie_resume,
@@ -79,19 +87,20 @@ static int toonie_init_codec(struct aoa_codec *codec)
 {
         struct toonie *toonie = codec_to_toonie(codec);
 
+        /* nothing connected? what a joke! */
+        if (toonie->codec.connected != 1)
+                return -ENOTCONN;
+
         if (aoa_snd_device_new(SNDRV_DEV_LOWLEVEL, toonie, &ops)) {
                 printk(KERN_ERR PFX "failed to create toonie snd device!\n");
                 return -ENODEV;
         }
 
-        /* nothing connected? what a joke! */
-        if (toonie->codec.connected != 1)
-                return -ENOTCONN;
-
         if (toonie->codec.soundbus_dev->attach_codec(toonie->codec.soundbus_dev,
                                                      aoa_get_card(),
                                                      &toonie_codec_info, toonie)) {
                 printk(KERN_ERR PFX "error creating toonie pcm\n");
+                snd_device_free(aoa_get_card(), toonie);
                 return -ENODEV;
         }
 
diff --git a/sound/aoa/core/snd-aoa-gpio-feature.c b/sound/aoa/core/snd-aoa-gpio-feature.c
index 7ae0c0bdfad8..f69d33357a28 100644
--- a/sound/aoa/core/snd-aoa-gpio-feature.c
+++ b/sound/aoa/core/snd-aoa-gpio-feature.c
@@ -112,7 +112,10 @@ static struct device_node *get_gpio(char *name,
 
 static void get_irq(struct device_node * np, int *irqptr)
 {
-        *irqptr = irq_of_parse_and_map(np, 0);
+        if (np)
+                *irqptr = irq_of_parse_and_map(np, 0);
+        else
+                *irqptr = NO_IRQ;
 }
 
 /* 0x4 is outenable, 0x1 is out, thus 4 or 5 */
@@ -322,7 +325,7 @@ static int ftr_set_notify(struct gpio_runtime *rt,
                 return -EINVAL;
         }
 
-        if (irq == -1)
+        if (irq == NO_IRQ)
                 return -ENODEV;
 
         mutex_lock(&notif->mutex);
diff --git a/sound/aoa/core/snd-aoa-gpio-pmf.c b/sound/aoa/core/snd-aoa-gpio-pmf.c
index 3d57fd1aec4b..2836c3218391 100644
--- a/sound/aoa/core/snd-aoa-gpio-pmf.c
+++ b/sound/aoa/core/snd-aoa-gpio-pmf.c
@@ -18,7 +18,7 @@ static void pmf_gpio_set_##name(struct gpio_runtime *rt, int on)\
                                                         \
         if (unlikely(!rt)) return;                              \
         rc = pmf_call_function(rt->node, #name "-mute", &args); \
-        if (rc)                                                 \
+        if (rc && rc != -ENODEV)                                \
                 printk(KERN_WARNING "pmf_gpio_set_" #name       \
                 " failed, rc: %d\n", rc);                       \
         rt->implementation_private &= ~(1<<bit);                \
diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
index 71b5080fa66d..75a9505c7445 100644
--- a/sound/core/oss/mixer_oss.c
+++ b/sound/core/oss/mixer_oss.c
@@ -988,13 +988,12 @@ static int snd_mixer_oss_build_input(struct snd_mixer_oss *mixer, struct snd_mix
         if (ptr->index == 0 && (kctl = snd_mixer_oss_test_id(mixer, "Capture Source", 0)) != NULL) {
                 struct snd_ctl_elem_info *uinfo;
 
-                uinfo = kmalloc(sizeof(*uinfo), GFP_KERNEL);
+                uinfo = kzalloc(sizeof(*uinfo), GFP_KERNEL);
                 if (! uinfo) {
                         up_read(&mixer->card->controls_rwsem);
                         return -ENOMEM;
                 }
                         
-                memset(uinfo, 0, sizeof(*uinfo));
                 if (kctl->info(kctl, uinfo)) {
                         up_read(&mixer->card->controls_rwsem);
                         return 0;
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f5ff4f4a16ee..472fce0ee0e8 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2228,6 +2228,8 @@ static int snd_pcm_oss_open_file(struct file *file,
         for (idx = 0; idx < 2; idx++) {
                 if (setup[idx].disable)
                         continue;
+                if (! pcm->streams[idx].substream_count)
+                        continue; /* no matching substream */
                 if (idx == SNDRV_PCM_STREAM_PLAYBACK) {
                         if (! (f_mode & FMODE_WRITE))
                                 continue;
diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c
index 4260de90f36f..102ff548ce69 100644
--- a/sound/core/seq/seq_device.c
+++ b/sound/core/seq/seq_device.c
@@ -372,10 +372,9 @@ static struct ops_list * create_driver(char *id)
 {
         struct ops_list *ops;
 
-        ops = kmalloc(sizeof(*ops), GFP_KERNEL);
+        ops = kzalloc(sizeof(*ops), GFP_KERNEL);
         if (ops == NULL)
                 return ops;
-        memset(ops, 0, sizeof(*ops));
 
         /* set up driver entry */
         strlcpy(ops->id, id, sizeof(ops->id));
diff --git a/sound/core/sgbuf.c b/sound/core/sgbuf.c
index 6e4d4ab34632..c30669f14ac0 100644
--- a/sound/core/sgbuf.c
+++ b/sound/core/sgbuf.c
@@ -68,21 +68,18 @@ void *snd_malloc_sgbuf_pages(struct device *device,
 
         dmab->area = NULL;
         dmab->addr = 0;
-        dmab->private_data = sgbuf = kmalloc(sizeof(*sgbuf), GFP_KERNEL);
+        dmab->private_data = sgbuf = kzalloc(sizeof(*sgbuf), GFP_KERNEL);
         if (! sgbuf)
                 return NULL;
-        memset(sgbuf, 0, sizeof(*sgbuf));
         sgbuf->dev = device;
         pages = snd_sgbuf_aligned_pages(size);
         sgbuf->tblsize = sgbuf_align_table(pages);
-        sgbuf->table = kmalloc(sizeof(*sgbuf->table) * sgbuf->tblsize, GFP_KERNEL);
+        sgbuf->table = kcalloc(sgbuf->tblsize, sizeof(*sgbuf->table), GFP_KERNEL);
         if (! sgbuf->table)
                 goto _failed;
-        memset(sgbuf->table, 0, sizeof(*sgbuf->table) * sgbuf->tblsize);
-        sgbuf->page_table = kmalloc(sizeof(*sgbuf->page_table) * sgbuf->tblsize, GFP_KERNEL);
+        sgbuf->page_table = kcalloc(sgbuf->tblsize, sizeof(*sgbuf->page_table), GFP_KERNEL);
         if (! sgbuf->page_table)
                 goto _failed;
-        memset(sgbuf->page_table, 0, sizeof(*sgbuf->page_table) * sgbuf->tblsize);
 
         /* allocate each page */
         for (i = 0; i < pages; i++) {
diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c
index c4af84995d05..7e65a103fbb2 100644
--- a/sound/drivers/vx/vx_pcm.c
+++ b/sound/drivers/vx/vx_pcm.c
@@ -1252,18 +1252,15 @@ static int vx_init_audio_io(struct vx_core *chip)
         chip->audio_info = rmh.Stat[1];
 
         /* allocate pipes */
-        chip->playback_pipes = kmalloc(sizeof(struct vx_pipe *) * chip->audio_outs, GFP_KERNEL);
+        chip->playback_pipes = kcalloc(chip->audio_outs, sizeof(struct vx_pipe *), GFP_KERNEL);
         if (!chip->playback_pipes)
                 return -ENOMEM;
-        chip->capture_pipes = kmalloc(sizeof(struct vx_pipe *) * chip->audio_ins, GFP_KERNEL);
+        chip->capture_pipes = kcalloc(chip->audio_ins, sizeof(struct vx_pipe *), GFP_KERNEL);
         if (!chip->capture_pipes) {
                 kfree(chip->playback_pipes);
                 return -ENOMEM;
         }
 
-        memset(chip->playback_pipes, 0, sizeof(struct vx_pipe *) * chip->audio_outs);
-        memset(chip->capture_pipes, 0, sizeof(struct vx_pipe *) * chip->audio_ins);
-
         preferred = chip->ibl.size;
         chip->ibl.size = 0;
         vx_set_ibl(chip, &chip->ibl); /* query the info */
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 27a8dbe6f6a8..c3dafa29054f 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -236,9 +236,9 @@ static int pcm_open(struct snd_pcm_substream *substream,
         chip = snd_pcm_substream_chip(substream);
         runtime = substream->runtime;
 
-        if (!(pipe = kmalloc(sizeof(struct audiopipe), GFP_KERNEL)))
+        pipe = kzalloc(sizeof(struct audiopipe), GFP_KERNEL);
+        if (!pipe)
                 return -ENOMEM;
-        memset(pipe, 0, sizeof(struct audiopipe));
         pipe->index = -1;               /* Not configured yet */
 
         /* Set up hw capabilities and contraints */
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index f9b5c3dc3b34..79f24cdf5fbf 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -936,6 +936,17 @@ static struct snd_emu_chip_details emu_chip_details[] = {
          .ca0151_chip = 1,
          .spk71 = 1,
          .spdif_bug = 1} ,
+        /* Dell OEM/Creative Labs Audigy 2 ZS */
+        /* See ALSA bug#1365 */
+        {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10031102,
+         .driver = "Audigy2", .name = "Audigy 2 ZS [SB0353]",
+         .id = "Audigy2",
+         .emu10k2_chip = 1,
+         .ca0102_chip = 1,
+         .ca0151_chip = 1,
+         .spk71 = 1,
+         .spdif_bug = 1,
+         .ac97_chip = 1} ,
         {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10021102,
          .driver = "Audigy2", .name = "Audigy 2 Platinum [SB0240P]", 
          .id = "Audigy2",
diff --git a/sound/pci/emu10k1/irq.c b/sound/pci/emu10k1/irq.c
index a8b31286b6db..1076af4c3669 100644
--- a/sound/pci/emu10k1/irq.c
+++ b/sound/pci/emu10k1/irq.c
@@ -37,9 +37,13 @@ irqreturn_t snd_emu10k1_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         int handled = 0;
 
         while ((status = inl(emu->port + IPR)) != 0) {
-                //printk("emu10k1 irq - status = 0x%x\n", status);
+                //snd_printk(KERN_INFO "emu10k1 irq - status = 0x%x\n", status);
                 orig_status = status;
                 handled = 1;
+                if ((status & 0xffffffff) == 0xffffffff) {
+                        snd_printk(KERN_INFO "snd-emu10k1: Suspected sound card removal\n");
+                        break;
+                }
                 if (status & IPR_PCIERROR) {
                         snd_printk(KERN_ERR "interrupt: PCI error\n");
                         snd_emu10k1_intr_disable(emu, INTE_PCIERRORENABLE);
diff --git a/sound/ppc/awacs.c b/sound/ppc/awacs.c
index 82d791be7499..05dabe454658 100644
--- a/sound/ppc/awacs.c
+++ b/sound/ppc/awacs.c
@@ -801,11 +801,10 @@ snd_pmac_awacs_init(struct snd_pmac *chip)
         chip->revision = (in_le32(&chip->awacs->codec_stat) >> 12) & 0xf;
 #ifdef PMAC_AMP_AVAIL
         if (chip->revision == 3 && chip->has_iic && CHECK_CUDA_AMP()) {
-                struct awacs_amp *amp = kmalloc(sizeof(*amp), GFP_KERNEL);
+                struct awacs_amp *amp = kzalloc(sizeof(*amp), GFP_KERNEL);
                 if (! amp)
                         return -ENOMEM;
                 chip->mixer_data = amp;
-                memset(amp, 0, sizeof(*amp));
                 chip->mixer_free = awacs_amp_free;
                 awacs_amp_set_vol(amp, 0, 63, 63, 0); /* mute and zero vol */
                 awacs_amp_set_vol(amp, 1, 63, 63, 0);
diff --git a/sound/ppc/daca.c b/sound/ppc/daca.c
index 46eebf5610e3..57202b0f033e 100644
--- a/sound/ppc/daca.c
+++ b/sound/ppc/daca.c
@@ -258,10 +258,9 @@ int __init snd_pmac_daca_init(struct snd_pmac *chip)
                 request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
-        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+        mix = kzalloc(sizeof(*mix), GFP_KERNEL);
         if (! mix)
                 return -ENOMEM;
-        memset(mix, 0, sizeof(*mix));
         chip->mixer_data = mix;
         chip->mixer_free = daca_cleanup;
         mix->amp_on = 1; /* default on */
diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c
index fb05938dcbd9..59482a4cd446 100644
--- a/sound/ppc/keywest.c
+++ b/sound/ppc/keywest.c
@@ -64,11 +64,10 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter)
         if (strncmp(i2c_device_name(adapter), "mac-io", 6))
                 return 0; /* ignored */
 
-        new_client = kmalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        new_client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
         if (! new_client)
                 return -ENOMEM;
 
-        memset(new_client, 0, sizeof(*new_client));
         new_client->addr = keywest_ctx->addr;
         i2c_set_clientdata(new_client, keywest_ctx);
         new_client->adapter = adapter;
diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c
index fa9a44ab487e..2264574fa06b 100644
--- a/sound/ppc/powermac.c
+++ b/sound/ppc/powermac.c
@@ -181,21 +181,14 @@ static int __init alsa_card_pmac_init(void)
         if ((err = platform_driver_register(&snd_pmac_driver)) < 0)
                 return err;
         device = platform_device_register_simple(SND_PMAC_DRIVER, -1, NULL, 0);
-        if (!IS_ERR(device)) {
-                if (platform_get_drvdata(device))
-                        return 0;
-                platform_device_unregister(device);
-                err = -ENODEV;
-        } else
-                err = PTR_ERR(device);
-        platform_driver_unregister(&snd_pmac_driver);
-        return err;
+        return 0;
 
 }
 
 static void __exit alsa_card_pmac_exit(void)
 {
-        platform_device_unregister(device);
+        if (!IS_ERR(device))
+                platform_device_unregister(device);
         platform_driver_unregister(&snd_pmac_driver);
 }
 
diff --git a/sound/ppc/tumbler.c b/sound/ppc/tumbler.c
index 692c61177678..84f6b19c07ca 100644
--- a/sound/ppc/tumbler.c
+++ b/sound/ppc/tumbler.c
@@ -1316,10 +1316,9 @@ int __init snd_pmac_tumbler_init(struct snd_pmac *chip)
                 request_module("i2c-powermac");
 #endif /* CONFIG_KMOD */        
 
-        mix = kmalloc(sizeof(*mix), GFP_KERNEL);
+        mix = kzalloc(sizeof(*mix), GFP_KERNEL);
         if (! mix)
                 return -ENOMEM;
-        memset(mix, 0, sizeof(*mix));
         mix->headphone_irq = -1;
 
         chip->mixer_data = mix;
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index d32d83d970cc..1b7f499c549d 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2260,10 +2260,9 @@ static int add_audio_endpoint(struct snd_usb_audio *chip, int stream, struct aud
         }
 
         /* create a new pcm */
-        as = kmalloc(sizeof(*as), GFP_KERNEL);
+        as = kzalloc(sizeof(*as), GFP_KERNEL);
         if (! as)
                 return -ENOMEM;
-        memset(as, 0, sizeof(*as));
         as->pcm_index = chip->pcm_devs;
         as->chip = chip;
         as->fmt_type = fp->fmt_type;
@@ -2633,13 +2632,12 @@ static int parse_audio_endpoints(struct snd_usb_audio *chip, int iface_no)
                         csep = NULL;
                 }
 
-                fp = kmalloc(sizeof(*fp), GFP_KERNEL);
+                fp = kzalloc(sizeof(*fp), GFP_KERNEL);
                 if (! fp) {
                         snd_printk(KERN_ERR "cannot malloc\n");
                         return -ENOMEM;
                 }
 
-                memset(fp, 0, sizeof(*fp));
                 fp->iface = iface_no;
                 fp->altsetting = altno;
                 fp->altset_idx = i;