diff --git a/Documentation/hwmon/w83627ehf b/Documentation/hwmon/w83627ehf
index 3f44dbd..75f3155 100644
--- a/Documentation/hwmon/w83627ehf
+++ b/Documentation/hwmon/w83627ehf
@@ -50,7 +50,7 @@ W83627DHG, W83627DHG-P, W83627UHG, W83667HG, W83667HG-B, 
W83667HG-I
 (NCT6775F), and NCT6776F super I/O chips. We will refer to them collectively
 as Winbond chips.
 
-The chips implement 2 to 4 temperature sensors (9 for NCT6775F and NCT6776F),
+The chips implement 3 to 4 temperature sensors (9 for NCT6775F and NCT6776F),
 2 to 5 fan rotation speed sensors, 8 to 10 analog voltage sensors, one VID
 (except for 627UHG), alarms with beep warnings (control unimplemented),
 and some automatic fan regulation strategies (plus manual fan control mode).
diff --git a/Documentation/hwmon/zl6100 b/Documentation/hwmon/zl6100
index 7617798..c5e1a5b 100644
--- a/Documentation/hwmon/zl6100
+++ b/Documentation/hwmon/zl6100
@@ -73,14 +73,12 @@ Module parameters
 delay
 -----
 
-Some Intersil/Zilker Labs DC-DC controllers require a minimum interval between
-I2C bus accesses. According to Intersil, the minimum interval is 2 ms, though
-1 ms appears to be sufficient and has not caused any problems in testing.
-The problem is known to affect ZL6100, ZL2105, and ZL2008. It is known not to
-affect ZL2004 and ZL6105. The driver automatically sets the interval to 1 ms
-except for ZL2004 and ZL6105. To enable manual override, the driver provides a
-writeable module parameter, 'delay', which can be used to set the interval to
-a value between 0 and 65,535 microseconds.
+Intersil/Zilker Labs DC-DC controllers require a minimum interval between I2C
+bus accesses. According to Intersil, the minimum interval is 2 ms, though 1 ms
+appears to be sufficient and has not caused any problems in testing. The 
problem
+is known to affect all currently supported chips. For manual override, the
+driver provides a writeable module parameter, 'delay', which can be used to set
+the interval to a value between 0 and 65,535 microseconds.
 
 
 Sysfs entries
diff --git a/Makefile b/Makefile
index 4b76371..15e80f1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 2
-SUBLEVEL = 11
+SUBLEVEL = 12
 EXTRAVERSION =
 NAME = Saber-toothed Squirrel
 
diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
index ad1fb5d..eddcfb3 100644
--- a/arch/sparc/Makefile
+++ b/arch/sparc/Makefile
@@ -31,7 +31,7 @@ UTS_MACHINE    := sparc
 
 #KBUILD_CFLAGS += -g -pipe -fcall-used-g5 -fcall-used-g7
 KBUILD_CFLAGS += -m32 -pipe -mno-fpu -fcall-used-g5 -fcall-used-g7
-KBUILD_AFLAGS += -m32
+KBUILD_AFLAGS += -m32 -Wa,-Av8
 
 #LDFLAGS_vmlinux = -N -Ttext 0xf0004000
 #  Since 2.5.40, the first stage is left not btfix-ed.
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c 
b/arch/x86/kernel/cpu/perf_event_intel.c
index 121f1be..957c216 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -389,14 +389,15 @@ static __initconst const u64 westmere_hw_cache_event_ids
 #define NHM_LOCAL_DRAM         (1 << 14)
 #define NHM_NON_DRAM           (1 << 15)
 
-#define NHM_ALL_DRAM           (NHM_REMOTE_DRAM|NHM_LOCAL_DRAM)
+#define NHM_LOCAL              (NHM_LOCAL_DRAM|NHM_REMOTE_CACHE_FWD)
+#define NHM_REMOTE             (NHM_REMOTE_DRAM)
 
 #define NHM_DMND_READ          (NHM_DMND_DATA_RD)
 #define NHM_DMND_WRITE         (NHM_DMND_RFO|NHM_DMND_WB)
 #define NHM_DMND_PREFETCH      (NHM_PF_DATA_RD|NHM_PF_DATA_RFO)
 
 #define NHM_L3_HIT     
(NHM_UNCORE_HIT|NHM_OTHER_CORE_HIT_SNP|NHM_OTHER_CORE_HITM)
-#define NHM_L3_MISS    (NHM_NON_DRAM|NHM_ALL_DRAM|NHM_REMOTE_CACHE_FWD)
+#define NHM_L3_MISS    
(NHM_NON_DRAM|NHM_LOCAL_DRAM|NHM_REMOTE_DRAM|NHM_REMOTE_CACHE_FWD)
 #define NHM_L3_ACCESS  (NHM_L3_HIT|NHM_L3_MISS)
 
 static __initconst const u64 nehalem_hw_cache_extra_regs
@@ -420,16 +421,16 @@ static __initconst const u64 nehalem_hw_cache_extra_regs
  },
  [ C(NODE) ] = {
        [ C(OP_READ) ] = {
-               [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_ALL_DRAM,
-               [ C(RESULT_MISS)   ] = NHM_DMND_READ|NHM_REMOTE_DRAM,
+               [ C(RESULT_ACCESS) ] = NHM_DMND_READ|NHM_LOCAL|NHM_REMOTE,
+               [ C(RESULT_MISS)   ] = NHM_DMND_READ|NHM_REMOTE,
        },
        [ C(OP_WRITE) ] = {
-               [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_ALL_DRAM,
-               [ C(RESULT_MISS)   ] = NHM_DMND_WRITE|NHM_REMOTE_DRAM,
+               [ C(RESULT_ACCESS) ] = NHM_DMND_WRITE|NHM_LOCAL|NHM_REMOTE,
+               [ C(RESULT_MISS)   ] = NHM_DMND_WRITE|NHM_REMOTE,
        },
        [ C(OP_PREFETCH) ] = {
-               [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_ALL_DRAM,
-               [ C(RESULT_MISS)   ] = NHM_DMND_PREFETCH|NHM_REMOTE_DRAM,
+               [ C(RESULT_ACCESS) ] = NHM_DMND_PREFETCH|NHM_LOCAL|NHM_REMOTE,
+               [ C(RESULT_MISS)   ] = NHM_DMND_PREFETCH|NHM_REMOTE,
        },
  },
 };
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index fc45ba8..e395693 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
 }
 
 /* TSC based delay: */
-static void delay_tsc(unsigned long loops)
+static void delay_tsc(unsigned long __loops)
 {
-       unsigned long bclock, now;
+       u32 bclock, now, loops = __loops;
        int cpu;
 
        preempt_disable();
diff --git a/block/genhd.c b/block/genhd.c
index 02e9fca..997afd6 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -36,6 +36,7 @@ static DEFINE_IDR(ext_devt_idr);
 
 static struct device_type disk_type;
 
+static void disk_alloc_events(struct gendisk *disk);
 static void disk_add_events(struct gendisk *disk);
 static void disk_del_events(struct gendisk *disk);
 static void disk_release_events(struct gendisk *disk);
@@ -602,6 +603,8 @@ void add_disk(struct gendisk *disk)
        disk->major = MAJOR(devt);
        disk->first_minor = MINOR(devt);
 
+       disk_alloc_events(disk);
+
        /* Register BDI before referencing it from bdev */
        bdi = &disk->queue->backing_dev_info;
        bdi_register_dev(bdi, disk_devt(disk));
@@ -1476,9 +1479,9 @@ static void __disk_unblock_events(struct gendisk *disk, 
bool check_now)
        intv = disk_events_poll_jiffies(disk);
        set_timer_slack(&ev->dwork.timer, intv / 4);
        if (check_now)
-               queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
+               queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
        else if (intv)
-               queue_delayed_work(system_nrt_wq, &ev->dwork, intv);
+               queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv);
 out_unlock:
        spin_unlock_irqrestore(&ev->lock, flags);
 }
@@ -1522,7 +1525,7 @@ void disk_flush_events(struct gendisk *disk, unsigned int 
mask)
        ev->clearing |= mask;
        if (!ev->block) {
                cancel_delayed_work(&ev->dwork);
-               queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
+               queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
        }
        spin_unlock_irq(&ev->lock);
 }
@@ -1559,7 +1562,7 @@ unsigned int disk_clear_events(struct gendisk *disk, 
unsigned int mask)
 
        /* uncondtionally schedule event check and wait for it to finish */
        disk_block_events(disk);
-       queue_delayed_work(system_nrt_wq, &ev->dwork, 0);
+       queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, 0);
        flush_delayed_work(&ev->dwork);
        __disk_unblock_events(disk, false);
 
@@ -1596,7 +1599,7 @@ static void disk_events_workfn(struct work_struct *work)
 
        intv = disk_events_poll_jiffies(disk);
        if (!ev->block && intv)
-               queue_delayed_work(system_nrt_wq, &ev->dwork, intv);
+               queue_delayed_work(system_nrt_freezable_wq, &ev->dwork, intv);
 
        spin_unlock_irq(&ev->lock);
 
@@ -1734,9 +1737,9 @@ module_param_cb(events_dfl_poll_msecs, 
&disk_events_dfl_poll_msecs_param_ops,
                &disk_events_dfl_poll_msecs, 0644);
 
 /*
- * disk_{add|del|release}_events - initialize and destroy disk_events.
+ * disk_{alloc|add|del|release}_events - initialize and destroy disk_events.
  */
-static void disk_add_events(struct gendisk *disk)
+static void disk_alloc_events(struct gendisk *disk)
 {
        struct disk_events *ev;
 
@@ -1749,16 +1752,6 @@ static void disk_add_events(struct gendisk *disk)
                return;
        }
 
-       if (sysfs_create_files(&disk_to_dev(disk)->kobj,
-                              disk_events_attrs) < 0) {
-               pr_warn("%s: failed to create sysfs files for events\n",
-                       disk->disk_name);
-               kfree(ev);
-               return;
-       }
-
-       disk->ev = ev;
-
        INIT_LIST_HEAD(&ev->node);
        ev->disk = disk;
        spin_lock_init(&ev->lock);
@@ -1767,8 +1760,21 @@ static void disk_add_events(struct gendisk *disk)
        ev->poll_msecs = -1;
        INIT_DELAYED_WORK(&ev->dwork, disk_events_workfn);
 
+       disk->ev = ev;
+}
+
+static void disk_add_events(struct gendisk *disk)
+{
+       if (!disk->ev)
+               return;
+
+       /* FIXME: error handling */
+       if (sysfs_create_files(&disk_to_dev(disk)->kobj, disk_events_attrs) < 0)
+               pr_warn("%s: failed to create sysfs files for events\n",
+                       disk->disk_name);
+
        mutex_lock(&disk_events_mutex);
-       list_add_tail(&ev->node, &disk_events);
+       list_add_tail(&disk->ev->node, &disk_events);
        mutex_unlock(&disk_events_mutex);
 
        /*
diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
index b70f0fc..eec7b7a 100644
--- a/drivers/block/sx8.c
+++ b/drivers/block/sx8.c
@@ -1116,7 +1116,7 @@ static inline void carm_handle_resp(struct carm_host 
*host,
                        break;
                case MISC_GET_FW_VER: {
                        struct carm_fw_ver *ver = (struct carm_fw_ver *)
-                               mem + sizeof(struct carm_msg_get_fw_ver);
+                               (mem + sizeof(struct carm_msg_get_fw_ver));
                        if (!error) {
                                host->fw_ver = le32_to_cpu(ver->version);
                                host->flags |= (ver->features & FL_FW_VER_MASK);
diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index ba296fd..5c5cdd2 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -178,16 +178,11 @@ static int zl6100_probe(struct i2c_client *client,
        data->id = mid->driver_data;
 
        /*
-        * ZL2008, ZL2105, and ZL6100 are known to require a wait time
-        * between I2C accesses. ZL2004 and ZL6105 are known to be safe.
-        *
-        * Only clear the wait time for chips known to be safe. The wait time
-        * can be cleared later for additional chips if tests show that it
-        * is not needed (in other words, better be safe than sorry).
+        * According to information from the chip vendor, all currently
+        * supported chips are known to require a wait time between I2C
+        * accesses.
         */
        data->delay = delay;
-       if (data->id == zl2004 || data->id == zl6105)
-               data->delay = 0;
 
        /*
         * Since there was a direct I2C device access above, wait before
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index c25387d..ceaec92 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -39,7 +39,7 @@
                                               0x8860 0xa1
     w83627dhg    9      5       4       3      0xa020 0xc1    0x5ca3
     w83627dhg-p  9      5       4       3      0xb070 0xc1    0x5ca3
-    w83627uhg    8      2       2       2      0xa230 0xc1    0x5ca3
+    w83627uhg    8      2       2       3      0xa230 0xc1    0x5ca3
     w83667hg     9      5       3       3      0xa510 0xc1    0x5ca3
     w83667hg-b   9      5       3       4      0xb350 0xc1    0x5ca3
     nct6775f     9      4       3       9      0xb470 0xc1    0x5ca3
@@ -1607,7 +1607,7 @@ store_##reg(struct device *dev, struct device_attribute 
*attr, \
        val = step_time_to_reg(val, data->pwm_mode[nr]); \
        mutex_lock(&data->update_lock); \
        data->reg[nr] = val; \
-       w83627ehf_write_value(data, W83627EHF_REG_##REG[nr], val); \
+       w83627ehf_write_value(data, data->REG_##REG[nr], val); \
        mutex_unlock(&data->update_lock); \
        return count; \
 } \
@@ -2004,7 +2004,8 @@ static int __devinit w83627ehf_probe(struct 
platform_device *pdev)
                goto exit;
        }
 
-       data = kzalloc(sizeof(struct w83627ehf_data), GFP_KERNEL);
+       data = devm_kzalloc(&pdev->dev, sizeof(struct w83627ehf_data),
+                           GFP_KERNEL);
        if (!data) {
                err = -ENOMEM;
                goto exit_release;
@@ -2157,16 +2158,16 @@ static int __devinit w83627ehf_probe(struct 
platform_device *pdev)
                w83627ehf_set_temp_reg_ehf(data, 3);
 
                /*
-                * Temperature sources for temp1 and temp2 are selected with
+                * Temperature sources for temp2 and temp3 are selected with
                 * bank 0, registers 0x49 and 0x4a.
                 */
                data->temp_src[0] = 0;  /* SYSTIN */
                reg = w83627ehf_read_value(data, 0x49) & 0x07;
                /* Adjust to have the same mapping as other source registers */
                if (reg == 0)
-                       data->temp_src[1]++;
+                       data->temp_src[1] = 1;
                else if (reg >= 2 && reg <= 5)
-                       data->temp_src[1] += 2;
+                       data->temp_src[1] = reg + 2;
                else    /* should never happen */
                        data->have_temp &= ~(1 << 1);
                reg = w83627ehf_read_value(data, 0x4a);
@@ -2498,9 +2499,8 @@ static int __devinit w83627ehf_probe(struct 
platform_device *pdev)
 
 exit_remove:
        w83627ehf_device_remove_files(dev);
-       kfree(data);
-       platform_set_drvdata(pdev, NULL);
 exit_release:
+       platform_set_drvdata(pdev, NULL);
        release_region(res->start, IOREGION_LENGTH);
 exit:
        return err;
@@ -2514,7 +2514,6 @@ static int __devexit w83627ehf_remove(struct 
platform_device *pdev)
        w83627ehf_device_remove_files(&pdev->dev);
        release_region(data->addr, IOREGION_LENGTH);
        platform_set_drvdata(pdev, NULL);
-       kfree(data);
 
        return 0;
 }
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 525c734..24f94f4 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -103,8 +103,14 @@ static int sclhi(struct i2c_algo_bit_data *adap)
                 * chips may hold it low ("clock stretching") while they
                 * are processing data internally.
                 */
-               if (time_after(jiffies, start + adap->timeout))
+               if (time_after(jiffies, start + adap->timeout)) {
+                       /* Test one last time, as we may have been preempted
+                        * between last check and timeout test.
+                        */
+                       if (getscl(adap))
+                               break;
                        return -ETIMEDOUT;
+               }
                cond_resched();
        }
 #ifdef DEBUG
diff --git a/drivers/media/video/omap3isp/ispccdc.c 
b/drivers/media/video/omap3isp/ispccdc.c
index 54a4a3f..a319281 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1406,8 +1406,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device 
*ccdc, u32 event)
 
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
-       struct isp_pipeline *pipe =
-               to_isp_pipeline(&ccdc->video_out.video.entity);
+       struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
        struct video_device *vdev = ccdc->subdev.devnode;
        struct v4l2_event event;
 
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c 
b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 02c7ed8..eccdcff 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -2241,10 +2241,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                        dev_info(&adapter->pdev->dev, "tx locked\n");
                return NETDEV_TX_LOCKED;
        }
-       if (skb->mark == 0x01)
-               type = atl1c_trans_high;
-       else
-               type = atl1c_trans_normal;
 
        if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/packetengines/Kconfig 
b/drivers/net/ethernet/packetengines/Kconfig
index b97132d..8f29feb 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 
 config NET_PACKET_ENGINE
        bool "Packet Engine devices"
+       default y
        depends on PCI
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/realtek/r8169.c 
b/drivers/net/ethernet/realtek/r8169.c
index c8f47f1..0cf2351 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct 
rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+       void __iomem *ioaddr = tp->mmio_addr;
+
+       RTL_W8(Cfg9346, Cfg9346_Unlock);
        rtl_generic_op(tp, tp->jumbo_ops.enable);
+       RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+       void __iomem *ioaddr = tp->mmio_addr;
+
+       RTL_W8(Cfg9346, Cfg9346_Unlock);
        rtl_generic_op(tp, tp->jumbo_ops.disable);
+       RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 752d521..5ef4cc0 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue 
*rx_queue)
                if (unlikely(!skb))
                        return -ENOMEM;
 
-               /* Adjust the SKB for padding and checksum */
+               /* Adjust the SKB for padding */
                skb_reserve(skb, NET_IP_ALIGN);
                rx_buf->len = skb_len - NET_IP_ALIGN;
                rx_buf->is_page = false;
-               skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                  skb->data, rx_buf->len,
@@ -499,6 +498,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
 
                EFX_BUG_ON_PARANOID(!checksummed);
                rx_buf->u.skb = NULL;
+               skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                gro_result = napi_gro_receive(napi, skb);
        }
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index edfa15d..486b404 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                        continue;
                }
                if (PPP_MP_CB(p)->sequence != seq) {
+                       u32 oldseq;
                        /* Fragment `seq' is missing.  If it is after
                           minseq, it might arrive later, so stop here. */
                        if (seq_after(seq, minseq))
                                break;
                        /* Fragment `seq' is lost, keep going. */
                        lost = 1;
+                       oldseq = seq;
                        seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                minseq + 1: PPP_MP_CB(p)->sequence;
+
+                       if (ppp->debug & 1)
+                               netdev_printk(KERN_DEBUG, ppp->dev,
+                                             "lost frag %u..%u\n",
+                                             oldseq, seq-1);
+
                        goto again;
                }
 
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                        struct sk_buff *tmp2;
 
                        skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                               if (ppp->debug & 1)
+                                       netdev_printk(KERN_DEBUG, ppp->dev,
+                                                     "discarding frag %u\n",
+                                                     PPP_MP_CB(p)->sequence);
                                __skb_unlink(p, list);
                                kfree_skb(p);
                        }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                /* If we have discarded any fragments,
                   signal a receive error. */
                if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                       skb_queue_walk_safe(list, p, tmp) {
+                               if (p == head)
+                                       break;
+                               if (ppp->debug & 1)
+                                       netdev_printk(KERN_DEBUG, ppp->dev,
+                                                     "discarding frag %u\n",
+                                                     PPP_MP_CB(p)->sequence);
+                               __skb_unlink(p, list);
+                               kfree_skb(p);
+                       }
+
                        if (ppp->debug & 1)
                                netdev_printk(KERN_DEBUG, ppp->dev,
                                              "  missed pkts %u..%u\n",
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index f5e063a..fda4be2 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1595,6 +1595,10 @@ static const struct usb_device_id        products [] = {
        USB_DEVICE (0x6189, 0x182d),
        .driver_info =  (unsigned long) &ax8817x_info,
 }, {
+       // Sitecom LN-031 "USB 2.0 10/100/1000 Ethernet adapter"
+       USB_DEVICE (0x0df6, 0x0056),
+       .driver_info =  (unsigned long) &ax88178_info,
+}, {
        // corega FEther USB2-TX
        USB_DEVICE (0x07aa, 0x0017),
        .driver_info =  (unsigned long) &ax8817x_info,
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c 
b/drivers/net/vmxnet3/vmxnet3_drv.c
index d96bfb1..d426261 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct 
vmxnet3_tx_queue *tq,
                                        ctx->l4_hdr_size = ((struct tcphdr *)
                                           skb_transport_header(skb))->doff * 4;
                                else if (iph->protocol == IPPROTO_UDP)
-                                       /*
-                                        * Use tcp header size so that bytes to
-                                        * be copied are more than required by
-                                        * the device.
-                                        */
                                        ctx->l4_hdr_size =
-                                                       sizeof(struct tcphdr);
+                                                       sizeof(struct udphdr);
                                else
                                        ctx->l4_hdr_size = 0;
                        } else {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h 
b/drivers/net/vmxnet3/vmxnet3_int.h
index b18eac1..8df921b 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c 
b/drivers/net/wireless/rt2x00/rt2x00dev.c
index edd317f..21b529b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry,
        /*
         * If the data queue was below the threshold before the txdone
         * handler we must make sure the packet queue in the mac80211 stack
-        * is reenabled when the txdone handler has finished.
+        * is reenabled when the txdone handler has finished. This has to be
+        * serialized with rt2x00mac_tx(), otherwise we can wake up queue
+        * before it was stopped.
         */
+       spin_lock_bh(&entry->queue->tx_lock);
        if (!rt2x00queue_threshold(entry->queue))
                rt2x00queue_unpause_queue(entry->queue);
+       spin_unlock_bh(&entry->queue->tx_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c 
b/drivers/net/wireless/rt2x00/rt2x00mac.c
index bf0acff..373dae1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff 
*skb)
        if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
                goto exit_fail;
 
+       /*
+        * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
+        * we should not use spin_lock_bh variant as bottom halve was already
+        * disabled before ieee80211_xmit() call.
+        */
+       spin_lock(&queue->tx_lock);
        if (rt2x00queue_threshold(queue))
                rt2x00queue_pause_queue(queue);
+       spin_unlock(&queue->tx_lock);
 
        return;
 
  exit_fail:
+       spin_lock(&queue->tx_lock);
        rt2x00queue_pause_queue(queue);
+       spin_unlock(&queue->tx_lock);
  exit_free_skb:
        dev_kfree_skb_any(skb);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c 
b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 5adfb3e..9b1b2b7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, 
struct sk_buff *skb,
        else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
                rt2x00queue_align_frame(skb);
 
+       /*
+        * That function must be called with bh disabled.
+        */
        spin_lock(&queue->tx_lock);
 
        if (unlikely(rt2x00queue_full(queue))) {
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 1cfbf22..24f049e 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -500,6 +500,9 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
        int pos;
        u32 reg32;
 
+       if (aspm_disabled)
+               return 0;
+
        /*
         * Some functions in a slot might not all be PCIe functions,
         * very strange. Disable ASPM for the whole slot
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index b848277..1e5290b 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -679,6 +679,32 @@ static acpi_status AMW0_find_mailled(void)
        return AE_OK;
 }
 
+static int AMW0_set_cap_acpi_check_device_found;
+
+static acpi_status AMW0_set_cap_acpi_check_device_cb(acpi_handle handle,
+       u32 level, void *context, void **retval)
+{
+       AMW0_set_cap_acpi_check_device_found = 1;
+       return AE_OK;
+}
+
+static const struct acpi_device_id norfkill_ids[] = {
+       { "VPC2004", 0},
+       { "IBM0068", 0},
+       { "LEN0068", 0},
+       { "", 0},
+};
+
+static int AMW0_set_cap_acpi_check_device(void)
+{
+       const struct acpi_device_id *id;
+
+       for (id = norfkill_ids; id->id[0]; id++)
+               acpi_get_devices(id->id, AMW0_set_cap_acpi_check_device_cb,
+                               NULL, NULL);
+       return AMW0_set_cap_acpi_check_device_found;
+}
+
 static acpi_status AMW0_set_capabilities(void)
 {
        struct wmab_args args;
@@ -692,7 +718,9 @@ static acpi_status AMW0_set_capabilities(void)
         * work.
         */
        if (wmi_has_guid(AMW0_GUID2)) {
-               interface->capability |= ACER_CAP_WIRELESS;
+               if ((quirks != &quirk_unknown) ||
+                   !AMW0_set_cap_acpi_check_device())
+                       interface->capability |= ACER_CAP_WIRELESS;
                return AE_OK;
        }
 
diff --git a/drivers/rapidio/devices/tsi721.h b/drivers/rapidio/devices/tsi721.h
index 822e54c..1c226b3 100644
--- a/drivers/rapidio/devices/tsi721.h
+++ b/drivers/rapidio/devices/tsi721.h
@@ -118,34 +118,34 @@
 
 #define TSI721_IDB_ENTRY_SIZE  64
 
-#define TSI721_IDQ_CTL(x)      (0x20000 + (x) * 1000)
+#define TSI721_IDQ_CTL(x)      (0x20000 + (x) * 0x1000)
 #define TSI721_IDQ_SUSPEND     0x00000002
 #define TSI721_IDQ_INIT                0x00000001
 
-#define TSI721_IDQ_STS(x)      (0x20004 + (x) * 1000)
+#define TSI721_IDQ_STS(x)      (0x20004 + (x) * 0x1000)
 #define TSI721_IDQ_RUN         0x00200000
 
-#define TSI721_IDQ_MASK(x)     (0x20008 + (x) * 1000)
+#define TSI721_IDQ_MASK(x)     (0x20008 + (x) * 0x1000)
 #define TSI721_IDQ_MASK_MASK   0xffff0000
 #define TSI721_IDQ_MASK_PATT   0x0000ffff
 
-#define TSI721_IDQ_RP(x)       (0x2000c + (x) * 1000)
+#define TSI721_IDQ_RP(x)       (0x2000c + (x) * 0x1000)
 #define TSI721_IDQ_RP_PTR      0x0007ffff
 
-#define TSI721_IDQ_WP(x)       (0x20010 + (x) * 1000)
+#define TSI721_IDQ_WP(x)       (0x20010 + (x) * 0x1000)
 #define TSI721_IDQ_WP_PTR      0x0007ffff
 
-#define TSI721_IDQ_BASEL(x)    (0x20014 + (x) * 1000)
+#define TSI721_IDQ_BASEL(x)    (0x20014 + (x) * 0x1000)
 #define TSI721_IDQ_BASEL_ADDR  0xffffffc0
-#define TSI721_IDQ_BASEU(x)    (0x20018 + (x) * 1000)
-#define TSI721_IDQ_SIZE(x)     (0x2001c + (x) * 1000)
+#define TSI721_IDQ_BASEU(x)    (0x20018 + (x) * 0x1000)
+#define TSI721_IDQ_SIZE(x)     (0x2001c + (x) * 0x1000)
 #define TSI721_IDQ_SIZE_VAL(size)      (__fls(size) - 4)
 #define TSI721_IDQ_SIZE_MIN    512
 #define TSI721_IDQ_SIZE_MAX    (512 * 1024)
 
-#define TSI721_SR_CHINT(x)     (0x20040 + (x) * 1000)
-#define TSI721_SR_CHINTE(x)    (0x20044 + (x) * 1000)
-#define TSI721_SR_CHINTSET(x)  (0x20048 + (x) * 1000)
+#define TSI721_SR_CHINT(x)     (0x20040 + (x) * 0x1000)
+#define TSI721_SR_CHINTE(x)    (0x20044 + (x) * 0x1000)
+#define TSI721_SR_CHINTSET(x)  (0x20048 + (x) * 0x1000)
 #define TSI721_SR_CHINT_ODBOK  0x00000020
 #define TSI721_SR_CHINT_IDBQRCV        0x00000010
 #define TSI721_SR_CHINT_SUSP   0x00000008
@@ -156,7 +156,7 @@
 
 #define TSI721_IBWIN_NUM       8
 
-#define TSI721_IBWINLB(x)      (0x29000 + (x) * 20)
+#define TSI721_IBWINLB(x)      (0x29000 + (x) * 0x20)
 #define TSI721_IBWINLB_BA      0xfffff000
 #define TSI721_IBWINLB_WEN     0x00000001
 
@@ -187,13 +187,13 @@
  */
 #define TSI721_OBWIN_NUM       TSI721_PC2SR_WINS
 
-#define TSI721_OBWINLB(x)      (0x40000 + (x) * 20)
+#define TSI721_OBWINLB(x)      (0x40000 + (x) * 0x20)
 #define TSI721_OBWINLB_BA      0xffff8000
 #define TSI721_OBWINLB_WEN     0x00000001
 
-#define TSI721_OBWINUB(x)      (0x40004 + (x) * 20)
+#define TSI721_OBWINUB(x)      (0x40004 + (x) * 0x20)
 
-#define TSI721_OBWINSZ(x)      (0x40008 + (x) * 20)
+#define TSI721_OBWINSZ(x)      (0x40008 + (x) * 0x20)
 #define TSI721_OBWINSZ_SIZE    0x00001f00
 #define TSI721_OBWIN_SIZE(size)        (__fls(size) - 15)
 
diff --git a/drivers/regulator/tps6524x-regulator.c 
b/drivers/regulator/tps6524x-regulator.c
index 9166aa0..229b6f4 100644
--- a/drivers/regulator/tps6524x-regulator.c
+++ b/drivers/regulator/tps6524x-regulator.c
@@ -481,7 +481,7 @@ static int set_voltage(struct regulator_dev *rdev, int 
min_uV, int max_uV,
        if (i >= info->n_voltages)
                i = info->n_voltages - 1;
 
-       *selector = info->voltages[i];
+       *selector = i;
 
        return write_field(hw, &info->voltage, i);
 }
diff --git a/drivers/target/iscsi/iscsi_target.c 
b/drivers/target/iscsi/iscsi_target.c
index 0c1d5c73..03d3528 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1029,7 +1029,7 @@ done:
                return iscsit_add_reject_from_cmd(
                                ISCSI_REASON_BOOKMARK_NO_RESOURCES,
                                1, 1, buf, cmd);
-       } else if (transport_ret == -EINVAL) {
+       } else if (transport_ret < 0) {
                /*
                 * Unsupported SAM Opcode.  CHECK_CONDITION will be sent
                 * in iscsit_execute_cmd() during the CmdSN OOO Execution
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 778c1a6..6cf6ff4 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -120,7 +120,7 @@ static struct t10_pr_registration 
*core_scsi3_locate_pr_reg(struct se_device *,
                                        struct se_node_acl *, struct se_session 
*);
 static void core_scsi3_put_pr_reg(struct t10_pr_registration *);
 
-static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd, int 
*ret)
+static int target_check_scsi2_reservation_conflict(struct se_cmd *cmd)
 {
        struct se_session *se_sess = cmd->se_sess;
        struct se_subsystem_dev *su_dev = cmd->se_dev->se_sub_dev;
@@ -130,7 +130,7 @@ static int target_check_scsi2_reservation_conflict(struct 
se_cmd *cmd, int *ret)
        int conflict = 0;
 
        if (!crh)
-               return false;
+               return -EINVAL;
 
        pr_reg = core_scsi3_locate_pr_reg(cmd->se_dev, se_sess->se_node_acl,
                        se_sess);
@@ -158,16 +158,14 @@ static int target_check_scsi2_reservation_conflict(struct 
se_cmd *cmd, int *ret)
                 */
                if (pr_reg->pr_res_holder) {
                        core_scsi3_put_pr_reg(pr_reg);
-                       *ret = 0;
-                       return false;
+                       return 1;
                }
                if ((pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_REGONLY) ||
                    (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_REGONLY) ||
                    (pr_reg->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
                    (pr_reg->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
                        core_scsi3_put_pr_reg(pr_reg);
-                       *ret = 0;
-                       return true;
+                       return 1;
                }
                core_scsi3_put_pr_reg(pr_reg);
                conflict = 1;
@@ -192,10 +190,10 @@ static int target_check_scsi2_reservation_conflict(struct 
se_cmd *cmd, int *ret)
                        " while active SPC-3 registrations exist,"
                        " returning RESERVATION_CONFLICT\n");
                cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
-               return true;
+               return -EBUSY;
        }
 
-       return false;
+       return 0;
 }
 
 int target_scsi2_reservation_release(struct se_task *task)
@@ -204,12 +202,18 @@ int target_scsi2_reservation_release(struct se_task *task)
        struct se_device *dev = cmd->se_dev;
        struct se_session *sess = cmd->se_sess;
        struct se_portal_group *tpg = sess->se_tpg;
-       int ret = 0;
+       int ret = 0, rc;
 
        if (!sess || !tpg)
                goto out;
-       if (target_check_scsi2_reservation_conflict(cmd, &ret))
+       rc = target_check_scsi2_reservation_conflict(cmd);
+       if (rc == 1)
+               goto out;
+       else if (rc < 0) {
+               cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+               ret = -EINVAL;
                goto out;
+       }
 
        ret = 0;
        spin_lock(&dev->dev_reservation_lock);
@@ -246,7 +250,7 @@ int target_scsi2_reservation_reserve(struct se_task *task)
        struct se_device *dev = cmd->se_dev;
        struct se_session *sess = cmd->se_sess;
        struct se_portal_group *tpg = sess->se_tpg;
-       int ret = 0;
+       int ret = 0, rc;
 
        if ((cmd->t_task_cdb[1] & 0x01) &&
            (cmd->t_task_cdb[1] & 0x02)) {
@@ -262,8 +266,14 @@ int target_scsi2_reservation_reserve(struct se_task *task)
         */
        if (!sess || !tpg)
                goto out;
-       if (target_check_scsi2_reservation_conflict(cmd, &ret))
+       rc = target_check_scsi2_reservation_conflict(cmd);
+       if (rc == 1)
                goto out;
+       else if (rc < 0) {
+               cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
+               ret = -EINVAL;
+               goto out;
+       }
 
        ret = 0;
        spin_lock(&dev->dev_reservation_lock);
diff --git a/drivers/target/target_core_transport.c 
b/drivers/target/target_core_transport.c
index e4ddb93..cdb774b 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2507,6 +2507,7 @@ static int transport_generic_cmd_sequencer(
                                        cmd, cdb, pr_reg_type) != 0) {
                        cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                        cmd->se_cmd_flags |= SCF_SCSI_RESERVATION_CONFLICT;
+                       cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
                        cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT;
                        return -EBUSY;
                }
diff --git a/fs/aio.c b/fs/aio.c
index 67e4b90..b9d64d8 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
        call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-       BUG_ON(atomic_read(&kioctx->users) <= 0);
-       atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
        return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
        mm = ctx->mm = current->mm;
        atomic_inc(&mm->mm_count);
 
-       atomic_set(&ctx->users, 1);
+       atomic_set(&ctx->users, 2);
        spin_lock_init(&ctx->ctx_lock);
        spin_lock_init(&ctx->ring_info.ring_lock);
        init_waitqueue_head(&ctx->wait);
@@ -609,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
                        fput(req->ki_filp);
 
                /* Link the iocb into the context's free list */
+               rcu_read_lock();
                spin_lock_irq(&ctx->ctx_lock);
                really_put_req(ctx, req);
+               /*
+                * at that point ctx might've been killed, but actual
+                * freeing is RCU'd
+                */
                spin_unlock_irq(&ctx->ctx_lock);
+               rcu_read_unlock();
 
-               put_ioctx(ctx);
                spin_lock_irq(&fput_lock);
        }
        spin_unlock_irq(&fput_lock);
@@ -644,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb 
*req)
         * this function will be executed w/out any aio kthread wakeup.
         */
        if (unlikely(!fput_atomic(req->ki_filp))) {
-               get_ioctx(ctx);
                spin_lock(&fput_lock);
                list_add(&req->ki_list, &fput_head);
                spin_unlock(&fput_lock);
@@ -1338,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, 
aio_context_t __user *, ctxp)
        ret = PTR_ERR(ioctx);
        if (!IS_ERR(ioctx)) {
                ret = put_user(ioctx->user_id, ctxp);
-               if (!ret)
+               if (!ret) {
+                       put_ioctx(ioctx);
                        return 0;
-
-               get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+               }
                io_destroy(ioctx);
        }
 
diff --git a/fs/block_dev.c b/fs/block_dev.c
index b07f1da..abe9b48 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1159,8 +1159,12 @@ static int __blkdev_get(struct block_device *bdev, 
fmode_t mode, int for_part)
                         * The latter is necessary to prevent ghost
                         * partitions on a removed medium.
                         */
-                       if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                               rescan_partitions(disk, bdev);
+                       if (bdev->bd_invalidated) {
+                               if (!ret)
+                                       rescan_partitions(disk, bdev);
+                               else if (ret == -ENOMEDIUM)
+                                       invalidate_partitions(disk, bdev);
+                       }
                        if (ret)
                                goto out_clear;
                } else {
@@ -1190,8 +1194,12 @@ static int __blkdev_get(struct block_device *bdev, 
fmode_t mode, int for_part)
                        if (bdev->bd_disk->fops->open)
                                ret = bdev->bd_disk->fops->open(bdev, mode);
                        /* the same as first opener case, read comment there */
-                       if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                               rescan_partitions(bdev->bd_disk, bdev);
+                       if (bdev->bd_invalidated) {
+                               if (!ret)
+                                       rescan_partitions(bdev->bd_disk, bdev);
+                               else if (ret == -ENOMEDIUM)
+                                       invalidate_partitions(bdev->bd_disk, 
bdev);
+                       }
                        if (ret)
                                goto out_unlock_bdev;
                }
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 4dd9283..5e64748 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -920,16 +920,26 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)
        for (lockp = &inode->i_flock; *lockp != NULL; \
             lockp = &(*lockp)->fl_next)
 
+struct lock_to_push {
+       struct list_head llist;
+       __u64 offset;
+       __u64 length;
+       __u32 pid;
+       __u16 netfid;
+       __u8 type;
+};
+
 static int
 cifs_push_posix_locks(struct cifsFileInfo *cfile)
 {
        struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode);
        struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
        struct file_lock *flock, **before;
-       struct cifsLockInfo *lck, *tmp;
+       unsigned int count = 0, i = 0;
        int rc = 0, xid, type;
+       struct list_head locks_to_send, *el;
+       struct lock_to_push *lck, *tmp;
        __u64 length;
-       struct list_head locks_to_send;
 
        xid = GetXid();
 
@@ -940,29 +950,55 @@ cifs_push_posix_locks(struct cifsFileInfo *cfile)
                return rc;
        }
 
+       lock_flocks();
+       cifs_for_each_lock(cfile->dentry->d_inode, before) {
+               if ((*before)->fl_flags & FL_POSIX)
+                       count++;
+       }
+       unlock_flocks();
+
        INIT_LIST_HEAD(&locks_to_send);
 
+       /*
+        * Allocating count locks is enough because no locks can be added to
+        * the list while we are holding cinode->lock_mutex that protects
+        * locking operations of this inode.
+        */
+       for (; i < count; i++) {
+               lck = kmalloc(sizeof(struct lock_to_push), GFP_KERNEL);
+               if (!lck) {
+                       rc = -ENOMEM;
+                       goto err_out;
+               }
+               list_add_tail(&lck->llist, &locks_to_send);
+       }
+
+       i = 0;
+       el = locks_to_send.next;
        lock_flocks();
        cifs_for_each_lock(cfile->dentry->d_inode, before) {
+               if (el == &locks_to_send) {
+                       /* something is really wrong */
+                       cERROR(1, "Can't push all brlocks!");
+                       break;
+               }
                flock = *before;
+               if ((flock->fl_flags & FL_POSIX) == 0)
+                       continue;
                length = 1 + flock->fl_end - flock->fl_start;
                if (flock->fl_type == F_RDLCK || flock->fl_type == F_SHLCK)
                        type = CIFS_RDLCK;
                else
                        type = CIFS_WRLCK;
-
-               lck = cifs_lock_init(flock->fl_start, length, type,
-                                    cfile->netfid);
-               if (!lck) {
-                       rc = -ENOMEM;
-                       goto send_locks;
-               }
+               lck = list_entry(el, struct lock_to_push, llist);
                lck->pid = flock->fl_pid;
-
-               list_add_tail(&lck->llist, &locks_to_send);
+               lck->netfid = cfile->netfid;
+               lck->length = length;
+               lck->type = type;
+               lck->offset = flock->fl_start;
+               i++;
+               el = el->next;
        }
-
-send_locks:
        unlock_flocks();
 
        list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
@@ -979,11 +1015,18 @@ send_locks:
                kfree(lck);
        }
 
+out:
        cinode->can_cache_brlcks = false;
        mutex_unlock(&cinode->lock_mutex);
 
        FreeXid(xid);
        return rc;
+err_out:
+       list_for_each_entry_safe(lck, tmp, &locks_to_send, llist) {
+               list_del(&lck->llist);
+               kfree(lck);
+       }
+       goto out;
 }
 
 static int
diff --git a/fs/namei.c b/fs/namei.c
index 744e942..9680cef 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2139,7 +2139,7 @@ static struct file *do_last(struct nameidata *nd, struct 
path *path,
                /* sayonara */
                error = complete_walk(nd);
                if (error)
-                       return ERR_PTR(-ECHILD);
+                       return ERR_PTR(error);
 
                error = -ENOTDIR;
                if (nd->flags & LOOKUP_DIRECTORY) {
@@ -2238,7 +2238,7 @@ static struct file *do_last(struct nameidata *nd, struct 
path *path,
        /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
        error = complete_walk(nd);
        if (error)
-               goto exit;
+               return ERR_PTR(error);
        error = -EISDIR;
        if (S_ISDIR(nd->inode->i_mode))
                goto exit;
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index e3c63d1..6b5fcc5 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -539,17 +539,11 @@ static bool disk_unlock_native_capacity(struct gendisk 
*disk)
        }
 }
 
-int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
+static int drop_partitions(struct gendisk *disk, struct block_device *bdev)
 {
-       struct parsed_partitions *state = NULL;
        struct disk_part_iter piter;
        struct hd_struct *part;
-       int p, highest, res;
-rescan:
-       if (state && !IS_ERR(state)) {
-               kfree(state);
-               state = NULL;
-       }
+       int res;
 
        if (bdev->bd_part_count)
                return -EBUSY;
@@ -562,6 +556,24 @@ rescan:
                delete_partition(disk, part->partno);
        disk_part_iter_exit(&piter);
 
+       return 0;
+}
+
+int rescan_partitions(struct gendisk *disk, struct block_device *bdev)
+{
+       struct parsed_partitions *state = NULL;
+       struct hd_struct *part;
+       int p, highest, res;
+rescan:
+       if (state && !IS_ERR(state)) {
+               kfree(state);
+               state = NULL;
+       }
+
+       res = drop_partitions(disk, bdev);
+       if (res)
+               return res;
+
        if (disk->fops->revalidate_disk)
                disk->fops->revalidate_disk(disk);
        check_disk_size_change(disk, bdev);
@@ -665,6 +677,26 @@ rescan:
        return 0;
 }
 
+int invalidate_partitions(struct gendisk *disk, struct block_device *bdev)
+{
+       int res;
+
+       if (!bdev->bd_invalidated)
+               return 0;
+
+       res = drop_partitions(disk, bdev);
+       if (res)
+               return res;
+
+       set_capacity(disk, 0);
+       check_disk_size_change(disk, bdev);
+       bdev->bd_invalidated = 0;
+       /* tell userspace that the media / partition table may have changed */
+       kobject_uevent(&disk_to_dev(disk)->kobj, KOBJ_CHANGE);
+
+       return 0;
+}
+
 unsigned char *read_dev_sector(struct block_device *bdev, sector_t n, Sector 
*p)
 {
        struct address_space *mapping = bdev->bd_inode->i_mapping;
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index 6d18f35..c6f7f6a 100644
--- a/include/linux/genhd.h
+++ b/include/linux/genhd.h
@@ -596,6 +596,7 @@ extern char *disk_name (struct gendisk *hd, int partno, 
char *buf);
 
 extern int disk_expand_part_tbl(struct gendisk *disk, int target);
 extern int rescan_partitions(struct gendisk *disk, struct block_device *bdev);
+extern int invalidate_partitions(struct gendisk *disk, struct block_device 
*bdev);
 extern struct hd_struct * __must_check add_partition(struct gendisk *disk,
                                                     int partno, sector_t start,
                                                     sector_t len, int flags,
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index fe86488..6cf8b53 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1453,6 +1453,16 @@ static inline void skb_set_mac_header(struct sk_buff 
*skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
 
+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
+{
+       if (skb_mac_header_was_set(skb)) {
+               const unsigned char *old_mac = skb_mac_header(skb);
+
+               skb_set_mac_header(skb, -skb->mac_len);
+               memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+       }
+}
+
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
        return skb->csum_start - skb_headroom(skb);
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index 0d556de..e228ca9 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -289,12 +289,16 @@ enum {
  *
  * system_freezable_wq is equivalent to system_wq except that it's
  * freezable.
+ *
+ * system_nrt_freezable_wq is equivalent to system_nrt_wq except that
+ * it's freezable.
  */
 extern struct workqueue_struct *system_wq;
 extern struct workqueue_struct *system_long_wq;
 extern struct workqueue_struct *system_nrt_wq;
 extern struct workqueue_struct *system_unbound_wq;
 extern struct workqueue_struct *system_freezable_wq;
+extern struct workqueue_struct *system_nrt_freezable_wq;
 
 extern struct workqueue_struct *
 __alloc_workqueue_key(const char *name, unsigned int flags, int max_active,
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 42fa9ad..bb425b1 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -253,11 +253,13 @@ struct workqueue_struct *system_long_wq __read_mostly;
 struct workqueue_struct *system_nrt_wq __read_mostly;
 struct workqueue_struct *system_unbound_wq __read_mostly;
 struct workqueue_struct *system_freezable_wq __read_mostly;
+struct workqueue_struct *system_nrt_freezable_wq __read_mostly;
 EXPORT_SYMBOL_GPL(system_wq);
 EXPORT_SYMBOL_GPL(system_long_wq);
 EXPORT_SYMBOL_GPL(system_nrt_wq);
 EXPORT_SYMBOL_GPL(system_unbound_wq);
 EXPORT_SYMBOL_GPL(system_freezable_wq);
+EXPORT_SYMBOL_GPL(system_nrt_freezable_wq);
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/workqueue.h>
@@ -3821,8 +3823,11 @@ static int __init init_workqueues(void)
                                            WQ_UNBOUND_MAX_ACTIVE);
        system_freezable_wq = alloc_workqueue("events_freezable",
                                              WQ_FREEZABLE, 0);
+       system_nrt_freezable_wq = alloc_workqueue("events_nrt_freezable",
+                       WQ_NON_REENTRANT | WQ_FREEZABLE, 0);
        BUG_ON(!system_wq || !system_long_wq || !system_nrt_wq ||
-              !system_unbound_wq || !system_freezable_wq);
+              !system_unbound_wq || !system_freezable_wq ||
+               !system_nrt_freezable_wq);
        return 0;
 }
 early_initcall(init_workqueues);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a5f4e57..8eb6b15 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct 
net_bridge *br,
        ip6h->nexthdr = IPPROTO_HOPOPTS;
        ip6h->hop_limit = 1;
        ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-       ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                          &ip6h->saddr);
+       if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                              &ip6h->saddr)) {
+               kfree_skb(skb);
+               return NULL;
+       }
        ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
        hopopt = (u8 *)(ip6h + 1);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5ac07d3..7aafaed 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -802,6 +802,8 @@ next_elt:
                write_unlock_bh(&tbl->lock);
                cond_resched();
                write_lock_bh(&tbl->lock);
+               nht = rcu_dereference_protected(tbl->nht,
+                                               lockdep_is_held(&tbl->lock));
        }
        /* Cycle through all hash buckets every base_reachable_time/2 ticks.
         * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53113b9..e4d1e4a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1406,8 +1406,16 @@ static int tcp_shifted_skb(struct sock *sk, struct 
sk_buff *skb,
 
        BUG_ON(!pcount);
 
-       /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
-       if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
+       /* Adjust counters and hints for the newly sacked sequence
+        * range but discard the return value since prev is already
+        * marked. We must tag the range first because the seq
+        * advancement below implicitly advances
+        * tcp_highest_sack_seq() when skb is highest_sack.
+        */
+       tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                       start_seq, end_seq, dup_sack, pcount);
+
+       if (skb == tp->lost_skb_hint)
                tp->lost_cnt_hint += pcount;
 
        TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1433,12 +1441,6 @@ static int tcp_shifted_skb(struct sock *sk, struct 
sk_buff *skb,
                skb_shinfo(skb)->gso_type = 0;
        }
 
-       /* Adjust counters and hints for the newly sacked sequence range but
-        * discard the return value since prev is already marked.
-        */
-       tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                       start_seq, end_seq, dup_sack, pcount);
-
        /* Difference in this won't matter, both ACKed by the same cumul. ACK */
        TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & 
TCPCB_EVER_RETRANS);
 
@@ -1586,6 +1588,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock 
*sk, struct sk_buff *skb,
                }
        }
 
+       /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
+       if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+               goto fallback;
+
        if (!skb_shift(prev, skb, len))
                goto fallback;
        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
@@ -2569,6 +2575,7 @@ static void tcp_mark_head_lost(struct sock *sk, int 
packets, int mark_head)
 
                if (cnt > packets) {
                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                           (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                            (oldcnt >= packets))
                                break;
 
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 6341818..e3db3f9 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct 
sk_buff *skb)
 
        skb_push(skb, sizeof(*iph));
        skb_reset_network_header(skb);
-
-       memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-               skb->mac_len);
-       skb_set_mac_header(skb, -skb->mac_len);
+       skb_mac_header_rebuild(skb);
 
        xfrm4_beet_make_header(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e..ed4bf11 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, 
struct sk_buff *skb)
 
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-       const unsigned char *old_mac;
        int err = -EINVAL;
 
        if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, 
struct sk_buff *skb)
        if (!(x->props.flags & XFRM_STATE_NOECN))
                ipip_ecn_decapsulate(skb);
 
-       old_mac = skb_mac_header(skb);
-       skb_set_mac_header(skb, -skb->mac_len);
-       memmove(skb_mac_header(skb), old_mac, skb->mac_len);
        skb_reset_network_header(skb);
+       skb_mac_header_rebuild(skb);
+
        err = 0;
 
 out:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 836c4ea..a5521c5 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device 
*dev)
        /* Join all-node multicast group */
        ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
+       /* Join all-router multicast group if forwarding is set */
+       if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+               ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
+
        return ndev;
 }
 
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index 3437d7d..f37cba9 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct 
sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        struct ipv6hdr *ip6h;
-       const unsigned char *old_mac;
        int size = sizeof(struct ipv6hdr);
        int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct 
sk_buff *skb)
 
        __skb_push(skb, size);
        skb_reset_network_header(skb);
-
-       old_mac = skb_mac_header(skb);
-       skb_set_mac_header(skb, -skb->mac_len);
-       memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+       skb_mac_header_rebuild(skb);
 
        xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 4d6edff..23ecd68 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, 
struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        int err = -EINVAL;
-       const unsigned char *old_mac;
 
        if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, 
struct sk_buff *skb)
        if (!(x->props.flags & XFRM_STATE_NOECN))
                ipip6_ecn_decapsulate(skb);
 
-       old_mac = skb_mac_header(skb);
-       skb_set_mac_header(skb, -skb->mac_len);
-       memmove(skb_mac_header(skb), old_mac, skb->mac_len);
        skb_reset_network_header(skb);
+       skb_mac_header_rebuild(skb);
+
        err = 0;
 
 out:
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3d8fbf4..dc8a6fc 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2063,12 +2063,16 @@ static int alc_build_controls(struct hda_codec *codec)
  */
 
 static void alc_init_special_input_src(struct hda_codec *codec);
+static int alc269_fill_coef(struct hda_codec *codec);
 
 static int alc_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
        unsigned int i;
 
+       if (codec->vendor_id == 0x10ec0269)
+               alc269_fill_coef(codec);
+
        alc_fix_pll(codec);
        alc_auto_init_amp(codec, spec->init_amp);
 
@@ -5110,8 +5114,12 @@ static const struct alc_model_fixup 
alc269_fixup_models[] = {
 
 static int alc269_fill_coef(struct hda_codec *codec)
 {
+       struct alc_spec *spec = codec->spec;
        int val;
 
+       if (spec->codec_variant != ALC269_TYPE_ALC269VB)
+               return 0;
+
        if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
                alc_write_coef_idx(codec, 0xf, 0x960b);
                alc_write_coef_idx(codec, 0xe, 0x8817);
diff --git a/sound/soc/samsung/neo1973_wm8753.c 
b/sound/soc/samsung/neo1973_wm8753.c
index 7207189..2fba3f7 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -421,7 +421,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
        .platform_name = "samsung-audio",
        .cpu_dai_name = "s3c24xx-iis",
        .codec_dai_name = "wm8753-hifi",
-       .codec_name = "wm8753-codec.0-001a",
+       .codec_name = "wm8753.0-001a",
        .init = neo1973_wm8753_init,
        .ops = &neo1973_hifi_ops,
 },
@@ -430,7 +430,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
        .stream_name = "Voice",
        .cpu_dai_name = "dfbmcs320-pcm",
        .codec_dai_name = "wm8753-voice",
-       .codec_name = "wm8753-codec.0-001a",
+       .codec_name = "wm8753.0-001a",
        .ops = &neo1973_voice_ops,
 },
 };
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to