src/patches/suse-2.6.27.39/patches.kernel.org/patch-2.6.27.38-39

   1 From: Greg Kroah-Hartman <gregkh@suse.de>
   2 Subject: Linux 2.6.27.39
   3
   4 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
   5
   6 diff --git a/Makefile b/Makefile
   7 index 3be1470..2361e50 100644
   8 --- a/Makefile
   9 +++ b/Makefile
  10 @@ -1,7 +1,7 @@
  11  VERSION = 2
  12  PATCHLEVEL = 6
  13  SUBLEVEL = 27
  14 -EXTRAVERSION = .38
  15 +EXTRAVERSION = .39
  16  NAME = Trembling Tortoise
  17
  18  # *DOCUMENTATION*
  19 diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
  20 index 8c5e1de..5b1ccc2 100644
  21 --- a/arch/m68k/Kconfig
  22 +++ b/arch/m68k/Kconfig
  23 @@ -572,7 +572,7 @@ config HPAPCI
  24
  25  config MVME147_SCC
  26         bool "SCC support for MVME147 serial ports"
  27 -       depends on MVME147
  28 +       depends on MVME147 && BROKEN
  29         help
  30           This is the driver for the serial ports on the Motorola MVME147
  31           boards.  Everyone using one of these boards should say Y here.
  32 @@ -587,14 +587,14 @@ config SERIAL167
  33
  34  config MVME162_SCC
  35         bool "SCC support for MVME162 serial ports"
  36 -       depends on MVME16x
  37 +       depends on MVME16x && BROKEN
  38         help
  39           This is the driver for the serial ports on the Motorola MVME162 and
  40           172 boards.  Everyone using one of these boards should say Y here.
  41
  42  config BVME6000_SCC
  43         bool "SCC support for BVME6000 serial ports"
  44 -       depends on BVME6000
  45 +       depends on BVME6000 && BROKEN
  46         help
  47           This is the driver for the serial ports on the BVME4000 and BVME6000
  48           boards from BVM Ltd.  Everyone using one of these boards should say
  49 diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
  50 index 09b59b2..5d7f4af 100644
  51 --- a/arch/x86/ia32/ia32entry.S
  52 +++ b/arch/x86/ia32/ia32entry.S
  53 @@ -204,7 +204,7 @@ sysexit_from_sys_call:
  54         movl RDI-ARGOFFSET(%rsp),%r8d   /* reload 5th syscall arg */
  55         .endm
  56
  57 -       .macro auditsys_exit exit,ebpsave=RBP
  58 +       .macro auditsys_exit exit
  59         testl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),TI_flags(%r10)
  60         jnz ia32_ret_from_sys_call
  61         TRACE_IRQS_ON
  62 @@ -217,7 +217,6 @@ sysexit_from_sys_call:
  63         call audit_syscall_exit
  64         GET_THREAD_INFO(%r10)
  65         movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall return value */
  66 -       movl \ebpsave-ARGOFFSET(%rsp),%ebp /* reload user register value */
  67         movl $(_TIF_ALLWORK_MASK & ~_TIF_SYSCALL_AUDIT),%edi
  68         cli
  69         TRACE_IRQS_OFF
  70 @@ -351,7 +350,7 @@ cstar_auditsys:
  71         jmp cstar_dispatch
  72
  73  sysretl_audit:
  74 -       auditsys_exit sysretl_from_sys_call, RCX /* user %ebp in RCX slot */
  75 +       auditsys_exit sysretl_from_sys_call
  76  #endif
  77
  78  cstar_tracesys:
  79 diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
  80 index 923e682..7d58f32 100644
  81 --- a/arch/x86/kernel/amd_iommu_init.c
  82 +++ b/arch/x86/kernel/amd_iommu_init.c
  83 @@ -230,7 +230,7 @@ static void __init iommu_feature_enable(struct amd_iommu *iommu, u8 bit)
  84         writel(ctrl, iommu->mmio_base + MMIO_CONTROL_OFFSET);
  85  }
  86
  87 -static void __init iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
  88 +static void iommu_feature_disable(struct amd_iommu *iommu, u8 bit)
  89  {
  90         u32 ctrl;
  91
  92 @@ -430,6 +430,27 @@ static void set_dev_entry_bit(u16 devid, u8 bit)
  93         amd_iommu_dev_table[devid].data[i] |= (1 << _bit);
  94  }
  95
  96 +static int get_dev_entry_bit(u16 devid, u8 bit)
  97 +{
  98 +       int i = (bit >> 5) & 0x07;
  99 +       int _bit = bit & 0x1f;
 100 +
 101 +       return (amd_iommu_dev_table[devid].data[i] & (1 << _bit)) >> _bit;
 102 +}
 103 +
 104 +
 105 +void amd_iommu_apply_erratum_63(u16 devid)
 106 +{
 107 +       int sysmgt;
 108 +
 109 +       sysmgt = get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT1) |
 110 +               (get_dev_entry_bit(devid, DEV_ENTRY_SYSMGT2) << 1);
 111 +
 112 +       if (sysmgt == 0x01)
 113 +               set_dev_entry_bit(devid, DEV_ENTRY_IW);
 114 +}
 115 +
 116 +
 117  /* Writes the specific IOMMU for a device into the rlookup table */
 118  static void __init set_iommu_for_device(struct amd_iommu *iommu, u16 devid)
 119  {
 120 @@ -458,6 +479,8 @@ static void __init set_dev_entry_from_acpi(struct amd_iommu *iommu,
 121         if (flags & ACPI_DEVFLAG_LINT1)
 122                 set_dev_entry_bit(devid, DEV_ENTRY_LINT1_PASS);
 123
 124 +       amd_iommu_apply_erratum_63(devid);
 125 +
 126         set_iommu_for_device(iommu, devid);
 127  }
 128
 129 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
 130 index 60ebfd7..bf872f2 100644
 131 --- a/arch/x86/kvm/x86.c
 132 +++ b/arch/x86/kvm/x86.c
 133 @@ -1223,6 +1223,8 @@ static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
 134
 135         if (cpuid->nent < 1)
 136                 goto out;
 137 +       if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
 138 +               cpuid->nent = KVM_MAX_CPUID_ENTRIES;
 139         r = -ENOMEM;
 140         cpuid_entries = vmalloc(sizeof(struct kvm_cpuid_entry2) * cpuid->nent);
 141         if (!cpuid_entries)
 142 diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
 143 index afa66f4..0450761 100644
 144 --- a/drivers/acpi/scan.c
 145 +++ b/drivers/acpi/scan.c
 146 @@ -1262,16 +1262,6 @@ acpi_add_single_object(struct acpi_device **child,
 147         acpi_device_set_id(device, parent, handle, type);
 148
 149         /*
 150 -        * The ACPI device is attached to acpi handle before getting
 151 -        * the power/wakeup/peformance flags. Otherwise OS can't get
 152 -        * the corresponding ACPI device by the acpi handle in the course
 153 -        * of getting the power/wakeup/performance flags.
 154 -        */
 155 -       result = acpi_device_set_context(device, type);
 156 -       if (result)
 157 -               goto end;
 158 -
 159 -       /*
 160          * Power Management
 161          * ----------------
 162          */
 163 @@ -1301,6 +1291,8 @@ acpi_add_single_object(struct acpi_device **child,
 164                         goto end;
 165         }
 166
 167 +       if ((result = acpi_device_set_context(device, type)))
 168 +               goto end;
 169
 170         result = acpi_device_register(device, parent);
 171
 172 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
 173 index 5cdd821..8afc274 100644
 174 --- a/drivers/ata/libata-core.c
 175 +++ b/drivers/ata/libata-core.c
 176 @@ -4747,12 +4747,14 @@ void ata_qc_complete(struct ata_queued_cmd *qc)
 177                         qc->flags |= ATA_QCFLAG_FAILED;
 178
 179                 if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
 180 -                       if (!ata_tag_internal(qc->tag)) {
 181 -                               /* always fill result TF for failed qc */
 182 -                               fill_result_tf(qc);
 183 +                       /* always fill result TF for failed qc */
 184 +                       fill_result_tf(qc);
 185 +
 186 +                       if (!ata_tag_internal(qc->tag))
 187                                 ata_qc_schedule_eh(qc);
 188 -                               return;
 189 -                       }
 190 +                       else
 191 +                               __ata_qc_complete(qc);
 192 +                       return;
 193                 }
 194
 195                 /* read result TF if requested */
 196 diff --git a/drivers/base/driver.c b/drivers/base/driver.c
 197 index 1e2bda7..296d833 100644
 198 --- a/drivers/base/driver.c
 199 +++ b/drivers/base/driver.c
 200 @@ -227,7 +227,7 @@ int driver_register(struct device_driver *drv)
 201                 put_driver(other);
 202                 printk(KERN_ERR "Error: Driver '%s' is already registered, "
 203                         "aborting...\n", drv->name);
 204 -               return -EEXIST;
 205 +               return -EBUSY;
 206         }
 207
 208         ret = bus_add_driver(drv);
 209 diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
 210 index caff851..8b91700 100644
 211 --- a/drivers/char/Kconfig
 212 +++ b/drivers/char/Kconfig
 213 @@ -310,7 +310,7 @@ config SPECIALIX
 214
 215  config SX
 216         tristate "Specialix SX (and SI) card support"
 217 -       depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA)
 218 +       depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) && BROKEN
 219         help
 220           This is a driver for the SX and SI multiport serial cards.
 221           Please read the file <file:Documentation/sx.txt> for details.
 222 @@ -321,7 +321,7 @@ config SX
 223
 224  config RIO
 225         tristate "Specialix RIO system support"
 226 -       depends on SERIAL_NONSTANDARD
 227 +       depends on SERIAL_NONSTANDARD && BROKEN
 228         help
 229           This is a driver for the Specialix RIO, a smart serial card which
 230           drives an outboard box that can support up to 128 ports.  Product
 231 @@ -382,7 +382,7 @@ config NOZOMI
 232
 233  config A2232
 234         tristate "Commodore A2232 serial support (EXPERIMENTAL)"
 235 -       depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP
 236 +       depends on EXPERIMENTAL && ZORRO && BROKEN
 237         ---help---
 238           This option supports the 2232 7-port serial card shipped with the
 239           Amiga 2000 and other Zorro-bus machines, dating from 1989.  At
 240 diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
 241 index d349c4a..6bb5157 100644
 242 --- a/drivers/input/mouse/synaptics.c
 243 +++ b/drivers/input/mouse/synaptics.c
 244 @@ -623,6 +623,16 @@ static const struct dmi_system_id toshiba_dmi_table[] = {
 245                         DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 246                         DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
 247                 },
 248 +
 249 +       },
 250 +       {
 251 +               .ident = "Toshiba Portege M300",
 252 +               .matches = {
 253 +                       DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
 254 +                       DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
 255 +                       DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
 256 +               },
 257 +
 258         },
 259         { }
 260  };
 261 diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
 262 index 1071144..6d0107c 100644
 263 --- a/drivers/net/appletalk/ipddp.c
 264 +++ b/drivers/net/appletalk/ipddp.c
 265 @@ -173,8 +173,7 @@ static int ipddp_xmit(struct sk_buff *skb, struct net_device *dev)
 266         ((struct net_device_stats *) dev->priv)->tx_packets++;
 267          ((struct net_device_stats *) dev->priv)->tx_bytes+=skb->len;
 268
 269 -        if(aarp_send_ddp(rt->dev, skb, &rt->at, NULL) < 0)
 270 -                dev_kfree_skb(skb);
 271 +       aarp_send_ddp(rt->dev, skb, &rt->at, NULL);
 272
 273          return 0;
 274  }
 275 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
 276 index f9f29c9..5a07b50 100644
 277 --- a/drivers/net/bonding/bond_main.c
 278 +++ b/drivers/net/bonding/bond_main.c
 279 @@ -686,7 +686,7 @@ static int bond_update_speed_duplex(struct slave *slave)
 280   */
 281  static int bond_check_dev_link(struct bonding *bond, struct net_device *slave_dev, int reporting)
 282  {
 283 -       static int (* ioctl)(struct net_device *, struct ifreq *, int);
 284 +       int (* ioctl)(struct net_device *, struct ifreq *, int);
 285         struct ifreq ifr;
 286         struct mii_ioctl_data *mii;
 287
 288 diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
 289 index 34ae125..f9c355e 100644
 290 --- a/drivers/net/wireless/b43/rfkill.c
 291 +++ b/drivers/net/wireless/b43/rfkill.c
 292 @@ -36,7 +36,8 @@ static bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
 293                       & B43_MMIO_RADIO_HWENABLED_HI_MASK))
 294                         return 1;
 295         } else {
 296 -               if (b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
 297 +               if (b43_status(dev) >= B43_STAT_STARTED &&
 298 +                   b43_read16(dev, B43_MMIO_RADIO_HWENABLED_LO)
 299                     & B43_MMIO_RADIO_HWENABLED_LO_MASK)
 300                         return 1;
 301         }
 302 diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
 303 index 632c291..5e37c2f 100644
 304 --- a/drivers/net/wireless/libertas/if_usb.c
 305 +++ b/drivers/net/wireless/libertas/if_usb.c
 306 @@ -443,7 +443,7 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
 307         /* Fill the receive configuration URB and initialise the Rx call back */
 308         usb_fill_bulk_urb(cardp->rx_urb, cardp->udev,
 309                           usb_rcvbulkpipe(cardp->udev, cardp->ep_in),
 310 -                         (void *) (skb->tail + (size_t) IPFIELD_ALIGN_OFFSET),
 311 +                         skb->data + IPFIELD_ALIGN_OFFSET,
 312                           MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
 313                           cardp);
 314
 315 diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
 316 index 963960d..eef4e86 100644
 317 --- a/drivers/net/wireless/ray_cs.c
 318 +++ b/drivers/net/wireless/ray_cs.c
 319 @@ -2758,7 +2758,7 @@ static void raycs_write(const char *name, write_proc_t *w, void *data)
 320  static int write_essid(struct file *file, const char __user *buffer, unsigned long count, void *data)
 321  {
 322         static char proc_essid[33];
 323 -       int len = count;
 324 +       unsigned int len = count;
 325
 326         if (len > 32)
 327                 len = 32;
 328 diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
 329 index 7716145..b38fe67 100644
 330 --- a/drivers/scsi/dpt_i2o.c
 331 +++ b/drivers/scsi/dpt_i2o.c
 332 @@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 333                 }
 334                 size = size>>16;
 335                 size *= 4;
 336 +               if (size > MAX_MESSAGE_SIZE) {
 337 +                       rcode = -EINVAL;
 338 +                       goto cleanup;
 339 +               }
 340                 /* Copy in the user's I2O command */
 341                 if (copy_from_user (msg, user_msg, size)) {
 342                         rcode = -EFAULT;
 343 diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
 344 index 9f72ad7..3a56f92 100644
 345 --- a/drivers/serial/8250_pci.c
 346 +++ b/drivers/serial/8250_pci.c
 347 @@ -1218,6 +1218,7 @@ enum pci_board_num_t {
 348         pbn_exar_XR17C152,
 349         pbn_exar_XR17C154,
 350         pbn_exar_XR17C158,
 351 +       pbn_exar_ibm_saturn,
 352         pbn_pasemi_1682M,
 353  };
 354
 355 @@ -1746,6 +1747,13 @@ static struct pciserial_board pci_boards[] __devinitdata = {
 356                 .base_baud      = 921600,
 357                 .uart_offset    = 0x200,
 358         },
 359 +       [pbn_exar_ibm_saturn] = {
 360 +               .flags          = FL_BASE0,
 361 +               .num_ports      = 1,
 362 +               .base_baud      = 921600,
 363 +               .uart_offset    = 0x200,
 364 +       },
 365 +
 366         /*
 367          * PA Semi PWRficient PA6T-1682M on-chip UART
 368          */
 369 @@ -2217,6 +2225,9 @@ static struct pci_device_id serial_pci_tbl[] = {
 370                 PCI_SUBVENDOR_ID_CONNECT_TECH,
 371                 PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0,
 372                 pbn_b0_8_1843200_200 },
 373 +       {       PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152,
 374 +               PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT,
 375 +               0, 0, pbn_exar_ibm_saturn },
 376
 377         {       PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530,
 378                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
 379 diff --git a/fs/hfsplus/wrapper.c b/fs/hfsplus/wrapper.c
 380 index 175d08e..bed78ac 100644
 381 --- a/fs/hfsplus/wrapper.c
 382 +++ b/fs/hfsplus/wrapper.c
 383 @@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_block *sb)
 384
 385         if (hfsplus_get_last_session(sb, &part_start, &part_size))
 386                 return -EINVAL;
 387 +       if ((u64)part_start + part_size > 0x100000000ULL) {
 388 +               pr_err("hfs: volumes larger than 2TB are not supported yet\n");
 389 +               return -EINVAL;
 390 +       }
 391         while (1) {
 392                 bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
 393                 if (!bh)
 394 diff --git a/fs/nfs/client.c b/fs/nfs/client.c
 395 index 5ee23e7..9d6a0e4 100644
 396 --- a/fs/nfs/client.c
 397 +++ b/fs/nfs/client.c
 398 @@ -983,7 +983,7 @@ static int nfs4_init_client(struct nfs_client *clp,
 399                                         RPC_CLNT_CREATE_DISCRTRY);
 400         if (error < 0)
 401                 goto error;
 402 -       memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 403 +       strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 404
 405         error = nfs_idmap_new(clp);
 406         if (error < 0) {
 407 diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
 408 index c3fe156..e195f67 100644
 409 --- a/fs/nfs/dir.c
 410 +++ b/fs/nfs/dir.c
 411 @@ -1014,12 +1014,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
 412                                 res = NULL;
 413                                 goto out;
 414                         /* This turned out not to be a regular file */
 415 -                       case -EISDIR:
 416                         case -ENOTDIR:
 417                                 goto no_open;
 418                         case -ELOOP:
 419                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
 420                                         goto no_open;
 421 +                       /* case -EISDIR: */
 422                         /* case -EINVAL: */
 423                         default:
 424                                 goto out;
 425 @@ -1526,6 +1526,8 @@ nfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *dentry)
 426                 old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
 427                 dentry->d_parent->d_name.name, dentry->d_name.name);
 428
 429 +       nfs_inode_return_delegation(inode);
 430 +
 431         d_drop(dentry);
 432         error = NFS_PROTO(dir)->link(inode, dir, &dentry->d_name);
 433         if (error == 0) {
 434 diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
 435 index 630feb3..8a5c1d5 100644
 436 --- a/fs/nfs/direct.c
 437 +++ b/fs/nfs/direct.c
 438 @@ -454,6 +454,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)
 439         };
 440         struct rpc_task_setup task_setup_data = {
 441                 .rpc_client = NFS_CLIENT(inode),
 442 +               .rpc_message = &msg,
 443                 .callback_ops = &nfs_write_direct_ops,
 444                 .workqueue = nfsiod_workqueue,
 445                 .flags = RPC_TASK_ASYNC,
 446 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
 447 index c910413..ad4e800 100644
 448 --- a/fs/nfs/nfs4proc.c
 449 +++ b/fs/nfs/nfs4proc.c
 450 @@ -71,12 +71,17 @@ static int _nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle,
 451  /* Prevent leaks of NFSv4 errors into userland */
 452  int nfs4_map_errors(int err)
 453  {
 454 -       if (err < -1000) {
 455 +       if (err >= -1000)
 456 +               return err;
 457 +       switch (err) {
 458 +       case -NFS4ERR_RESOURCE:
 459 +               return -EREMOTEIO;
 460 +       default:
 461                 dprintk("%s could not handle NFSv4 error %d\n",
 462                                 __func__, -err);
 463 -               return -EIO;
 464 +               break;
 465         }
 466 -       return err;
 467 +       return -EIO;
 468  }
 469
 470  /*
 471 @@ -3550,15 +3555,23 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
 472         if (request->fl_start < 0 || request->fl_end < 0)
 473                 return -EINVAL;
 474
 475 -       if (IS_GETLK(cmd))
 476 -               return nfs4_proc_getlk(state, F_GETLK, request);
 477 +       if (IS_GETLK(cmd)) {
 478 +               if (state != NULL)
 479 +                       return nfs4_proc_getlk(state, F_GETLK, request);
 480 +               return 0;
 481 +       }
 482
 483         if (!(IS_SETLK(cmd) || IS_SETLKW(cmd)))
 484                 return -EINVAL;
 485
 486 -       if (request->fl_type == F_UNLCK)
 487 -               return nfs4_proc_unlck(state, cmd, request);
 488 +       if (request->fl_type == F_UNLCK) {
 489 +               if (state != NULL)
 490 +                       return nfs4_proc_unlck(state, cmd, request);
 491 +               return 0;
 492 +       }
 493
 494 +       if (state == NULL)
 495 +               return -ENOLCK;
 496         do {
 497                 status = nfs4_proc_setlk(state, cmd, request);
 498                 if ((status != -EAGAIN) || IS_SETLK(cmd))
 499 diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
 500 index 3305acb..6ede673 100644
 501 --- a/fs/nfs/nfs4renewd.c
 502 +++ b/fs/nfs/nfs4renewd.c
 503 @@ -125,12 +125,6 @@ nfs4_schedule_state_renewal(struct nfs_client *clp)
 504  }
 505
 506  void
 507 -nfs4_renewd_prepare_shutdown(struct nfs_server *server)
 508 -{
 509 -       cancel_delayed_work(&server->nfs_client->cl_renewd);
 510 -}
 511 -
 512 -void
 513  nfs4_kill_renewd(struct nfs_client *clp)
 514  {
 515         cancel_delayed_work_sync(&clp->cl_renewd);
 516 diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
 517 index b916297..5e26759 100644
 518 --- a/fs/nfs/nfs4xdr.c
 519 +++ b/fs/nfs/nfs4xdr.c
 520 @@ -4671,7 +4671,6 @@ static struct {
 521         { NFS4ERR_SERVERFAULT,  -ESERVERFAULT   },
 522         { NFS4ERR_BADTYPE,      -EBADTYPE       },
 523         { NFS4ERR_LOCKED,       -EAGAIN         },
 524 -       { NFS4ERR_RESOURCE,     -EREMOTEIO      },
 525         { NFS4ERR_SYMLINK,      -ELOOP          },
 526         { NFS4ERR_OP_ILLEGAL,   -EOPNOTSUPP     },
 527         { NFS4ERR_DEADLOCK,     -EDEADLK        },
 528 diff --git a/fs/nfs/super.c b/fs/nfs/super.c
 529 index e9b2017..3da0fa5 100644
 530 --- a/fs/nfs/super.c
 531 +++ b/fs/nfs/super.c
 532 @@ -2398,7 +2398,6 @@ static void nfs4_kill_super(struct super_block *sb)
 533         nfs_return_all_delegations(sb);
 534         kill_anon_super(sb);
 535
 536 -       nfs4_renewd_prepare_shutdown(server);
 537         nfs_free_server(server);
 538  }
 539
 540 diff --git a/fs/pipe.c b/fs/pipe.c
 541 index 35d2cbb..f91375f 100644
 542 --- a/fs/pipe.c
 543 +++ b/fs/pipe.c
 544 @@ -742,36 +742,55 @@ pipe_rdwr_release(struct inode *inode, struct file *filp)
 545  static int
 546  pipe_read_open(struct inode *inode, struct file *filp)
 547  {
 548 -       /* We could have perhaps used atomic_t, but this and friends
 549 -          below are the only places.  So it doesn't seem worthwhile.  */
 550 +       int ret = -ENOENT;
 551 +
 552         mutex_lock(&inode->i_mutex);
 553 -       inode->i_pipe->readers++;
 554 +
 555 +       if (inode->i_pipe) {
 556 +               ret = 0;
 557 +               inode->i_pipe->readers++;
 558 +       }
 559 +
 560         mutex_unlock(&inode->i_mutex);
 561
 562 -       return 0;
 563 +       return ret;
 564  }
 565
 566  static int
 567  pipe_write_open(struct inode *inode, struct file *filp)
 568  {
 569 +       int ret = -ENOENT;
 570 +
 571         mutex_lock(&inode->i_mutex);
 572 -       inode->i_pipe->writers++;
 573 +
 574 +       if (inode->i_pipe) {
 575 +               ret = 0;
 576 +               inode->i_pipe->writers++;
 577 +       }
 578 +
 579         mutex_unlock(&inode->i_mutex);
 580
 581 -       return 0;
 582 +       return ret;
 583  }
 584
 585  static int
 586  pipe_rdwr_open(struct inode *inode, struct file *filp)
 587  {
 588 +       int ret = -ENOENT;
 589 +
 590         mutex_lock(&inode->i_mutex);
 591 -       if (filp->f_mode & FMODE_READ)
 592 -               inode->i_pipe->readers++;
 593 -       if (filp->f_mode & FMODE_WRITE)
 594 -               inode->i_pipe->writers++;
 595 +
 596 +       if (inode->i_pipe) {
 597 +               ret = 0;
 598 +               if (filp->f_mode & FMODE_READ)
 599 +                       inode->i_pipe->readers++;
 600 +               if (filp->f_mode & FMODE_WRITE)
 601 +                       inode->i_pipe->writers++;
 602 +       }
 603 +
 604         mutex_unlock(&inode->i_mutex);
 605
 606 -       return 0;
 607 +       return ret;
 608  }
 609
 610  /*
 611 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
 612 index 2651f80..cd85f00 100644
 613 --- a/include/linux/kernel.h
 614 +++ b/include/linux/kernel.h
 615 @@ -200,6 +200,8 @@ extern struct ratelimit_state printk_ratelimit_state;
 616  extern int printk_ratelimit(void);
 617  extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
 618                                    unsigned int interval_msec);
 619 +extern void printk_tick(void);
 620 +extern int printk_needs_cpu(int);
 621  #else
 622  static inline int vprintk(const char *s, va_list args)
 623         __attribute__ ((format (printf, 1, 0)));
 624 @@ -211,6 +213,8 @@ static inline int printk_ratelimit(void) { return 0; }
 625  static inline bool printk_timed_ratelimit(unsigned long *caller_jiffies, \
 626                                           unsigned int interval_msec)   \
 627                 { return false; }
 628 +static inline void printk_tick(void) { }
 629 +static inline int printk_needs_cpu(int) { return 0; }
 630  #endif
 631
 632  extern void asmlinkage __attribute__((format(printf, 1, 2)))
 633 diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
 634 index ba91fe1..c869aee 100644
 635 --- a/include/linux/pci_ids.h
 636 +++ b/include/linux/pci_ids.h
 637 @@ -478,6 +478,9 @@
 638  #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361
 639  #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL 0x252
 640
 641 +#define PCI_SUBVENDOR_ID_IBM           0x1014
 642 +#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT    0x03d4
 643 +
 644  #define PCI_VENDOR_ID_UNISYS           0x1018
 645  #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C
 646
 647 diff --git a/include/net/irda/irda_device.h b/include/net/irda/irda_device.h
 648 index 3025ae1..94c852d 100644
 649 --- a/include/net/irda/irda_device.h
 650 +++ b/include/net/irda/irda_device.h
 651 @@ -135,9 +135,11 @@ struct dongle_reg {
 652
 653  /*
 654   * Per-packet information we need to hide inside sk_buff
 655 - * (must not exceed 48 bytes, check with struct sk_buff)
 656 + * (must not exceed 48 bytes, check with struct sk_buff)
 657 + * The default_qdisc_pad field is a temporary hack.
 658   */
 659  struct irda_skb_cb {
 660 +       unsigned int default_qdisc_pad;
 661         magic_t magic;       /* Be sure that we can trust the information */
 662         __u32   next_speed;  /* The Speed to be set *after* this frame */
 663         __u16   mtt;         /* Minimum turn around time */
 664 diff --git a/kernel/printk.c b/kernel/printk.c
 665 index 0084812..204660d 100644
 666 --- a/kernel/printk.c
 667 +++ b/kernel/printk.c
 668 @@ -977,10 +977,25 @@ int is_console_locked(void)
 669         return console_locked;
 670  }
 671
 672 -void wake_up_klogd(void)
 673 +static DEFINE_PER_CPU(int, printk_pending);
 674 +
 675 +void printk_tick(void)
 676  {
 677 -       if (!oops_in_progress && waitqueue_active(&log_wait))
 678 +       if (__get_cpu_var(printk_pending)) {
 679 +               __get_cpu_var(printk_pending) = 0;
 680                 wake_up_interruptible(&log_wait);
 681 +       }
 682 +}
 683 +
 684 +int printk_needs_cpu(int cpu)
 685 +{
 686 +       return per_cpu(printk_pending, cpu);
 687 +}
 688 +
 689 +void wake_up_klogd(void)
 690 +{
 691 +       if (waitqueue_active(&log_wait))
 692 +               __get_cpu_var(printk_pending) = 1;
 693  }
 694
 695  /**
 696 diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
 697 index cb02324..a7cb616 100644
 698 --- a/kernel/time/tick-sched.c
 699 +++ b/kernel/time/tick-sched.c
 700 @@ -261,7 +261,7 @@ void tick_nohz_stop_sched_tick(int inidle)
 701         next_jiffies = get_next_timer_interrupt(last_jiffies);
 702         delta_jiffies = next_jiffies - last_jiffies;
 703
 704 -       if (rcu_needs_cpu(cpu))
 705 +       if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu))
 706                 delta_jiffies = 1;
 707         /*
 708          * Do not stop the tick, if we are only one off
 709 diff --git a/kernel/timer.c b/kernel/timer.c
 710 index e9a0195..7acda56 100644
 711 --- a/kernel/timer.c
 712 +++ b/kernel/timer.c
 713 @@ -978,6 +978,7 @@ void update_process_times(int user_tick)
 714         run_local_timers();
 715         if (rcu_pending(cpu))
 716                 rcu_check_callbacks(cpu, user_tick);
 717 +       printk_tick();
 718         scheduler_tick();
 719         run_posix_cpu_timers(p);
 720  }
 721 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
 722 index 83bea4f..7acf81c 100644
 723 --- a/mm/mempolicy.c
 724 +++ b/mm/mempolicy.c
 725 @@ -985,7 +985,8 @@ static long do_mbind(unsigned long start, unsigned long len,
 726
 727                 if (!err && nr_failed && (flags & MPOL_MF_STRICT))
 728                         err = -EIO;
 729 -       }
 730 +       } else
 731 +               putback_lru_pages(&pagelist);
 732
 733         up_write(&mm->mmap_sem);
 734         mpol_put(new);
 735 diff --git a/net/appletalk/aarp.c b/net/appletalk/aarp.c
 736 index b25c1e9..dd076ea 100644
 737 --- a/net/appletalk/aarp.c
 738 +++ b/net/appletalk/aarp.c
 739 @@ -598,7 +598,7 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
 740
 741         /* Non ELAP we cannot do. */
 742         if (dev->type != ARPHRD_ETHER)
 743 -               return -1;
 744 +               goto free_it;
 745
 746         skb->dev = dev;
 747         skb->protocol = htons(ETH_P_ATALK);
 748 @@ -633,7 +633,7 @@ int aarp_send_ddp(struct net_device *dev, struct sk_buff *skb,
 749         if (!a) {
 750                 /* Whoops slipped... good job it's an unreliable protocol 8) */
 751                 write_unlock_bh(&aarp_lock);
 752 -               return -1;
 753 +               goto free_it;
 754         }
 755
 756         /* Set up the queue */
 757 @@ -662,15 +662,21 @@ out_unlock:
 758         write_unlock_bh(&aarp_lock);
 759
 760         /* Tell the ddp layer we have taken over for this frame. */
 761 -       return 0;
 762 +       goto sent;
 763
 764  sendit:
 765         if (skb->sk)
 766                 skb->priority = skb->sk->sk_priority;
 767 -       dev_queue_xmit(skb);
 768 +       if (dev_queue_xmit(skb))
 769 +               goto drop;
 770  sent:
 771 -       return 1;
 772 +       return NET_XMIT_SUCCESS;
 773 +free_it:
 774 +       kfree_skb(skb);
 775 +drop:
 776 +       return NET_XMIT_DROP;
 777  }
 778 +EXPORT_SYMBOL(aarp_send_ddp);
 779
 780  /*
 781   *     An entry in the aarp unresolved queue has become resolved. Send
 782 diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
 783 index 8067dc7..e99d337 100644
 784 --- a/net/appletalk/ddp.c
 785 +++ b/net/appletalk/ddp.c
 786 @@ -1277,8 +1277,10 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
 787         struct net_device_stats *stats;
 788
 789         /* This needs to be able to handle ipddp"N" devices */
 790 -       if (!dev)
 791 -               return -ENODEV;
 792 +       if (!dev) {
 793 +               kfree_skb(skb);
 794 +               return NET_RX_DROP;
 795 +       }
 796
 797         skb->protocol = htons(ETH_P_IP);
 798         skb_pull(skb, 13);
 799 @@ -1288,8 +1290,7 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
 800         stats = dev->priv;
 801         stats->rx_packets++;
 802         stats->rx_bytes += skb->len + 13;
 803 -       netif_rx(skb);  /* Send the SKB up to a higher place. */
 804 -       return 0;
 805 +       return netif_rx(skb);  /* Send the SKB up to a higher place. */
 806  }
 807  #else
 808  /* make it easy for gcc to optimize this test out, i.e. kill the code */
 809 @@ -1297,9 +1298,8 @@ static int handle_ip_over_ddp(struct sk_buff *skb)
 810  #define handle_ip_over_ddp(skb) 0
 811  #endif
 812
 813 -static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
 814 -                              struct ddpehdr *ddp, __u16 len_hops,
 815 -                              int origlen)
 816 +static int atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
 817 +                             struct ddpehdr *ddp, __u16 len_hops, int origlen)
 818  {
 819         struct atalk_route *rt;
 820         struct atalk_addr ta;
 821 @@ -1366,8 +1366,6 @@ static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
 822                 /* 22 bytes - 12 ether, 2 len, 3 802.2 5 snap */
 823                 struct sk_buff *nskb = skb_realloc_headroom(skb, 32);
 824                 kfree_skb(skb);
 825 -               if (!nskb)
 826 -                       goto out;
 827                 skb = nskb;
 828         } else
 829                 skb = skb_unshare(skb, GFP_ATOMIC);
 830 @@ -1376,12 +1374,16 @@ static void atalk_route_packet(struct sk_buff *skb, struct net_device *dev,
 831          * If the buffer didn't vanish into the lack of space bitbucket we can
 832          * send it.
 833          */
 834 -       if (skb && aarp_send_ddp(rt->dev, skb, &ta, NULL) == -1)
 835 -               goto free_it;
 836 -out:
 837 -       return;
 838 +       if (skb == NULL)
 839 +               goto drop;
 840 +
 841 +       if (aarp_send_ddp(rt->dev, skb, &ta, NULL) == NET_XMIT_DROP)
 842 +               return NET_RX_DROP;
 843 +       return NET_XMIT_SUCCESS;
 844  free_it:
 845         kfree_skb(skb);
 846 +drop:
 847 +       return NET_RX_DROP;
 848  }
 849
 850  /**
 851 @@ -1455,8 +1457,7 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
 852                 /* Not ours, so we route the packet via the correct
 853                  * AppleTalk iface
 854                  */
 855 -               atalk_route_packet(skb, dev, ddp, len_hops, origlen);
 856 -               goto out;
 857 +               return atalk_route_packet(skb, dev, ddp, len_hops, origlen);
 858         }
 859
 860         /* if IP over DDP is not selected this code will be optimized out */
 861 @@ -1663,10 +1664,10 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 862                 if (skb2) {
 863                         loopback = 1;
 864                         SOCK_DEBUG(sk, "SK %p: send out(copy).\n", sk);
 865 -                       if (aarp_send_ddp(dev, skb2,
 866 -                                         &usat->sat_addr, NULL) == -1)
 867 -                               kfree_skb(skb2);
 868 -                               /* else queued/sent above in the aarp queue */
 869 +                       /*
 870 +                        * If it fails it is queued/sent above in the aarp queue
 871 +                        */
 872 +                       aarp_send_ddp(dev, skb2, &usat->sat_addr, NULL);
 873                 }
 874         }
 875
 876 @@ -1696,9 +1697,10 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 877                     usat = &gsat;
 878                 }
 879
 880 -               if (aarp_send_ddp(dev, skb, &usat->sat_addr, NULL) == -1)
 881 -                       kfree_skb(skb);
 882 -               /* else queued/sent above in the aarp queue */
 883 +               /*
 884 +                * If it fails it is queued/sent above in the aarp queue
 885 +                */
 886 +               aarp_send_ddp(dev, skb, &usat->sat_addr, NULL);
 887         }
 888         SOCK_DEBUG(sk, "SK %p: Done write (%Zd).\n", sk, len);
 889
 890 @@ -1877,7 +1879,6 @@ static struct packet_type ppptalk_packet_type = {
 891  static unsigned char ddp_snap_id[] = { 0x08, 0x00, 0x07, 0x80, 0x9B };
 892
 893  /* Export symbols for use by drivers when AppleTalk is a module */
 894 -EXPORT_SYMBOL(aarp_send_ddp);
 895  EXPORT_SYMBOL(atrtr_get_dev);
 896  EXPORT_SYMBOL(atalk_find_dev_addr);
 897
 898 diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
 899 index 8eb79e9..5b66371 100644
 900 --- a/net/sched/cls_api.c
 901 +++ b/net/sched/cls_api.c
 902 @@ -337,7 +337,7 @@ static int tcf_fill_node(struct sk_buff *skb, struct tcf_proto *tp,
 903         tcm = NLMSG_DATA(nlh);
 904         tcm->tcm_family = AF_UNSPEC;
 905         tcm->tcm__pad1 = 0;
 906 -       tcm->tcm__pad1 = 0;
 907 +       tcm->tcm__pad2 = 0;
 908         tcm->tcm_ifindex = qdisc_dev(tp->q)->ifindex;
 909         tcm->tcm_parent = tp->classid;
 910         tcm->tcm_info = TC_H_MAKE(tp->prio, tp->protocol);
 911 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
 912 index 8e66fe0..facdaa9 100644
 913 --- a/net/unix/af_unix.c
 914 +++ b/net/unix/af_unix.c
 915 @@ -1061,6 +1061,8 @@ restart:
 916         err = -ECONNREFUSED;
 917         if (other->sk_state != TCP_LISTEN)
 918                 goto out_unlock;
 919 +       if (other->sk_shutdown & RCV_SHUTDOWN)
 920 +               goto out_unlock;
 921
 922         if (unix_recvq_full(other)) {
 923                 err = -EAGAIN;