diff --git a/Makefile b/Makefile
index 03aa17e..2b40b0a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 0
-SUBLEVEL = 87
+SUBLEVEL = 88
 EXTRAVERSION =
 NAME = Sneaky Weasel
 
diff --git a/arch/sparc/kernel/asm-offsets.c b/arch/sparc/kernel/asm-offsets.c
index 68f7e11..ce48203 100644
--- a/arch/sparc/kernel/asm-offsets.c
+++ b/arch/sparc/kernel/asm-offsets.c
@@ -34,6 +34,8 @@ int foo(void)
        DEFINE(AOFF_task_thread, offsetof(struct task_struct, thread));
        BLANK();
        DEFINE(AOFF_mm_context, offsetof(struct mm_struct, context));
+       BLANK();
+       DEFINE(VMA_VM_MM,    offsetof(struct vm_area_struct, vm_mm));
 
        /* DEFINE(NUM_USER_SEGMENTS, TASK_SIZE>>28); */
        return 0;
diff --git a/arch/sparc/mm/hypersparc.S b/arch/sparc/mm/hypersparc.S
index 44aad32..969f964 100644
--- a/arch/sparc/mm/hypersparc.S
+++ b/arch/sparc/mm/hypersparc.S
@@ -74,7 +74,7 @@ hypersparc_flush_cache_mm_out:
 
        /* The things we do for performance... */
 hypersparc_flush_cache_range:
-       ld      [%o0 + 0x0], %o0                /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 #ifndef CONFIG_SMP
        ld      [%o0 + AOFF_mm_context], %g1
        cmp     %g1, -1
@@ -163,7 +163,7 @@ hypersparc_flush_cache_range_out:
         */
        /* Verified, my ass... */
 hypersparc_flush_cache_page:
-       ld      [%o0 + 0x0], %o0                /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        ld      [%o0 + AOFF_mm_context], %g2
 #ifndef CONFIG_SMP
        cmp     %g2, -1
@@ -284,7 +284,7 @@ hypersparc_flush_tlb_mm_out:
         sta    %g5, [%g1] ASI_M_MMUREGS
 
 hypersparc_flush_tlb_range:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        lda     [%g1] ASI_M_MMUREGS, %g5
@@ -307,7 +307,7 @@ hypersparc_flush_tlb_range_out:
         sta    %g5, [%g1] ASI_M_MMUREGS
 
 hypersparc_flush_tlb_page:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        andn    %o1, (PAGE_SIZE - 1), %o1
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 6ff4d78..b4989f9 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -1071,7 +1071,14 @@ static int __init grab_mblocks(struct mdesc_handle *md)
                m->size = *val;
                val = mdesc_get_property(md, node,
                                         "address-congruence-offset", NULL);
-               m->offset = *val;
+
+               /* The address-congruence-offset property is optional.
+                * Explicity zero it be identifty this.
+                */
+               if (val)
+                       m->offset = *val;
+               else
+                       m->offset = 0UL;
 
                numadbg("MBLOCK[%d]: base[%llx] size[%llx] offset[%llx]\n",
                        count - 1, m->base, m->size, m->offset);
diff --git a/arch/sparc/mm/swift.S b/arch/sparc/mm/swift.S
index c801c39..5d2b88d 100644
--- a/arch/sparc/mm/swift.S
+++ b/arch/sparc/mm/swift.S
@@ -105,7 +105,7 @@ swift_flush_cache_mm_out:
 
        .globl  swift_flush_cache_range
 swift_flush_cache_range:
-       ld      [%o0 + 0x0], %o0                /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        sub     %o2, %o1, %o2
        sethi   %hi(4096), %o3
        cmp     %o2, %o3
@@ -116,7 +116,7 @@ swift_flush_cache_range:
 
        .globl  swift_flush_cache_page
 swift_flush_cache_page:
-       ld      [%o0 + 0x0], %o0                /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 70:
        ld      [%o0 + AOFF_mm_context], %g2
        cmp     %g2, -1
@@ -219,7 +219,7 @@ swift_flush_sig_insns:
        .globl  swift_flush_tlb_range
        .globl  swift_flush_tlb_all
 swift_flush_tlb_range:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 swift_flush_tlb_mm:
        ld      [%o0 + AOFF_mm_context], %g2
        cmp     %g2, -1
@@ -233,7 +233,7 @@ swift_flush_tlb_all_out:
 
        .globl  swift_flush_tlb_page
 swift_flush_tlb_page:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        andn    %o1, (PAGE_SIZE - 1), %o1
diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
index afd021e..072f553 100644
--- a/arch/sparc/mm/tlb.c
+++ b/arch/sparc/mm/tlb.c
@@ -115,8 +115,8 @@ no_cache_flush:
        }
 
        if (!tb->active) {
-               global_flush_tlb_page(mm, vaddr);
                flush_tsb_user_page(mm, vaddr);
+               global_flush_tlb_page(mm, vaddr);
                goto out;
        }
 
diff --git a/arch/sparc/mm/tsunami.S b/arch/sparc/mm/tsunami.S
index 4e55e8f..bf10a34 100644
--- a/arch/sparc/mm/tsunami.S
+++ b/arch/sparc/mm/tsunami.S
@@ -24,7 +24,7 @@
        /* Sliiick... */
 tsunami_flush_cache_page:
 tsunami_flush_cache_range:
-       ld      [%o0 + 0x0], %o0        /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 tsunami_flush_cache_mm:
        ld      [%o0 + AOFF_mm_context], %g2
        cmp     %g2, -1
@@ -46,7 +46,7 @@ tsunami_flush_sig_insns:
 
        /* More slick stuff... */
 tsunami_flush_tlb_range:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 tsunami_flush_tlb_mm:
        ld      [%o0 + AOFF_mm_context], %g2
        cmp     %g2, -1
@@ -65,7 +65,7 @@ tsunami_flush_tlb_out:
 
        /* This one can be done in a fine grained manner... */
 tsunami_flush_tlb_page:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        andn    %o1, (PAGE_SIZE - 1), %o1
diff --git a/arch/sparc/mm/viking.S b/arch/sparc/mm/viking.S
index 6dfcc13..a516372 100644
--- a/arch/sparc/mm/viking.S
+++ b/arch/sparc/mm/viking.S
@@ -109,7 +109,7 @@ viking_mxcc_flush_page:
 viking_flush_cache_page:
 viking_flush_cache_range:
 #ifndef CONFIG_SMP
-       ld      [%o0 + 0x0], %o0                /* XXX vma->vm_mm, GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
 #endif
 viking_flush_cache_mm:
 #ifndef CONFIG_SMP
@@ -149,7 +149,7 @@ viking_flush_tlb_mm:
 #endif
 
 viking_flush_tlb_range:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        lda     [%g1] ASI_M_MMUREGS, %g5
@@ -174,7 +174,7 @@ viking_flush_tlb_range:
 #endif
 
 viking_flush_tlb_page:
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        mov     SRMMU_CTX_REG, %g1
        ld      [%o0 + AOFF_mm_context], %o3
        lda     [%g1] ASI_M_MMUREGS, %g5
@@ -240,7 +240,7 @@ sun4dsmp_flush_tlb_range:
        tst     %g5
        bne     3f
         mov    SRMMU_CTX_REG, %g1
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        ld      [%o0 + AOFF_mm_context], %o3
        lda     [%g1] ASI_M_MMUREGS, %g5
        sethi   %hi(~((1 << SRMMU_PGDIR_SHIFT) - 1)), %o4
@@ -266,7 +266,7 @@ sun4dsmp_flush_tlb_page:
        tst     %g5
        bne     2f
         mov    SRMMU_CTX_REG, %g1
-       ld      [%o0 + 0x00], %o0       /* XXX vma->vm_mm GROSS XXX */
+       ld      [%o0 + VMA_VM_MM], %o0
        ld      [%o0 + AOFF_mm_context], %o3
        lda     [%g1] ASI_M_MMUREGS, %g5
        and     %o1, PAGE_MASK, %o1
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 098ff31..d74c431 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -186,6 +186,8 @@ static int __init dummy_init_module(void)
 
        rtnl_lock();
        err = __rtnl_link_register(&dummy_link_ops);
+       if (err < 0)
+               goto out;
 
        for (i = 0; i < numdummies && !err; i++) {
                err = dummy_init_one();
@@ -193,6 +195,8 @@ static int __init dummy_init_module(void)
        }
        if (err < 0)
                __rtnl_link_unregister(&dummy_link_ops);
+
+out:
        rtnl_unlock();
 
        return err;
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 2b98461..902ba2f 100644
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -33,6 +33,7 @@
 #include <linux/etherdevice.h>
 #include <linux/init.h>
 #include <linux/moduleparam.h>
+#include <linux/sched.h>
 #include <net/pkt_sched.h>
 #include <net/net_namespace.h>
 
@@ -251,11 +252,17 @@ static int __init ifb_init_module(void)
 
        rtnl_lock();
        err = __rtnl_link_register(&ifb_link_ops);
+       if (err < 0)
+               goto out;
 
-       for (i = 0; i < numifbs && !err; i++)
+       for (i = 0; i < numifbs && !err; i++) {
                err = ifb_init_one(i);
+               cond_resched();
+       }
        if (err)
                __rtnl_link_unregister(&ifb_link_ops);
+
+out:
        rtnl_unlock();
 
        return err;
diff --git a/drivers/net/sunvnet.c b/drivers/net/sunvnet.c
index bf3c762..cc77f70 100644
--- a/drivers/net/sunvnet.c
+++ b/drivers/net/sunvnet.c
@@ -1248,6 +1248,8 @@ static int vnet_port_remove(struct vio_dev *vdev)
                dev_set_drvdata(&vdev->dev, NULL);
 
                kfree(port);
+
+               unregister_netdev(vp->dev);
        }
        return 0;
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c 
b/drivers/net/wireless/rt2x00/rt2800lib.c
index d44ce30..9457987 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -4075,8 +4075,8 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                default_power2 = rt2x00_eeprom_addr(rt2x00dev, 
EEPROM_TXPOWER_A2);
 
                for (i = 14; i < spec->num_channels; i++) {
-                       info[i].default_power1 = default_power1[i];
-                       info[i].default_power2 = default_power2[i];
+                       info[i].default_power1 = default_power1[i - 14];
+                       info[i].default_power2 = default_power2[i - 14];
                }
        }
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c 
b/drivers/net/wireless/rt2x00/rt61pci.c
index 17de24e..dd31588 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2830,7 +2830,8 @@ static int rt61pci_probe_hw_mode(struct rt2x00_dev 
*rt2x00dev)
                tx_power = rt2x00_eeprom_addr(rt2x00dev, 
EEPROM_TXPOWER_A_START);
                for (i = 14; i < spec->num_channels; i++) {
                        info[i].max_power = MAX_TXPOWER;
-                       info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                       info[i].default_power1 =
+                                       TXPOWER_FROM_DEV(tx_power[i - 14]);
                }
        }
 
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c 
b/drivers/net/wireless/rt2x00/rt73usb.c
index 1a06231..3b68155 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2167,7 +2167,8 @@ static int rt73usb_probe_hw_mode(struct rt2x00_dev 
*rt2x00dev)
                tx_power = rt2x00_eeprom_addr(rt2x00dev, 
EEPROM_TXPOWER_A_START);
                for (i = 14; i < spec->num_channels; i++) {
                        info[i].max_power = MAX_TXPOWER;
-                       info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
+                       info[i].default_power1 =
+                                       TXPOWER_FROM_DEV(tx_power[i - 14]);
                }
        }
 
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 61da2cd..fc669c0 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -3,7 +3,7 @@
  *
  * Module interface and handling of zfcp data structures.
  *
- * Copyright IBM Corporation 2002, 2010
+ * Copyright IBM Corp. 2002, 2013
  */
 
 /*
@@ -23,6 +23,7 @@
  *            Christof Schmitt
  *            Martin Petermann
  *            Sven Schuetz
+ *            Steffen Maier
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -414,6 +415,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device 
*ccw_device)
        adapter->dma_parms.max_segment_size = ZFCP_QDIO_SBALE_LEN;
        adapter->ccw_device->dev.dma_parms = &adapter->dma_parms;
 
+       adapter->stat_read_buf_num = FSF_STATUS_READS_RECOM;
+
        if (!zfcp_scsi_adapter_register(adapter))
                return adapter;
 
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 6e73bfe..ceb7f7c 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -3,7 +3,7 @@
  *
  * Implementation of FSF commands.
  *
- * Copyright IBM Corporation 2002, 2010
+ * Copyright IBM Corp. 2002, 2013
  */
 
 #define KMSG_COMPONENT "zfcp"
@@ -455,11 +455,8 @@ static int zfcp_fsf_exchange_config_evaluate(struct 
zfcp_fsf_req *req)
 
        fc_host_port_name(shost) = nsp->fl_wwpn;
        fc_host_node_name(shost) = nsp->fl_wwnn;
-       fc_host_port_id(shost) = ntoh24(bottom->s_id);
-       fc_host_speed(shost) = bottom->fc_link_speed;
        fc_host_supported_classes(shost) = FC_COS_CLASS2 | FC_COS_CLASS3;
 
-       adapter->hydra_version = bottom->adapter_type;
        adapter->timer_ticks = bottom->timer_interval & ZFCP_FSF_TIMER_INT_MASK;
        adapter->stat_read_buf_num = max(bottom->status_read_buf_num,
                                         (u16)FSF_STATUS_READS_RECOM);
@@ -467,6 +464,18 @@ static int zfcp_fsf_exchange_config_evaluate(struct 
zfcp_fsf_req *req)
        if (fc_host_permanent_port_name(shost) == -1)
                fc_host_permanent_port_name(shost) = fc_host_port_name(shost);
 
+       zfcp_scsi_set_prot(adapter);
+
+       /* no error return above here, otherwise must fix call chains */
+       /* do not evaluate invalid fields */
+       if (req->qtcb->header.fsf_status == FSF_EXCHANGE_CONFIG_DATA_INCOMPLETE)
+               return 0;
+
+       fc_host_port_id(shost) = ntoh24(bottom->s_id);
+       fc_host_speed(shost) = bottom->fc_link_speed;
+
+       adapter->hydra_version = bottom->adapter_type;
+
        switch (bottom->fc_topology) {
        case FSF_TOPO_P2P:
                adapter->peer_d_id = ntoh24(bottom->peer_d_id);
@@ -488,8 +497,6 @@ static int zfcp_fsf_exchange_config_evaluate(struct 
zfcp_fsf_req *req)
                return -EIO;
        }
 
-       zfcp_scsi_set_prot(adapter);
-
        return 0;
 }
 
@@ -534,8 +541,14 @@ static void zfcp_fsf_exchange_config_data_handler(struct 
zfcp_fsf_req *req)
                fc_host_port_type(shost) = FC_PORTTYPE_UNKNOWN;
                adapter->hydra_version = 0;
 
+               /* avoids adapter shutdown to be able to recognize
+                * events such as LINK UP */
+               atomic_set_mask(ZFCP_STATUS_ADAPTER_XCONFIG_OK,
+                               &adapter->status);
                zfcp_fsf_link_down_info_eval(req,
                        &qtcb->header.fsf_status_qual.link_down_info);
+               if (zfcp_fsf_exchange_config_evaluate(req))
+                       return;
                break;
        default:
                zfcp_erp_adapter_shutdown(adapter, 0, "fsecdh3");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 454c72c..ca4be24 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1618,7 +1618,7 @@ static void bnx2fc_parse_fcp_rsp(struct bnx2fc_cmd 
*io_req,
                        fcp_sns_len = SCSI_SENSE_BUFFERSIZE;
                }
 
-               memset(sc_cmd->sense_buffer, 0, sizeof(sc_cmd->sense_buffer));
+               memset(sc_cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE);
                if (fcp_sns_len)
                        memcpy(sc_cmd->sense_buffer, rq_data, fcp_sns_len);
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index 931cb11..5eac650 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4746,10 +4746,12 @@ megasas_mgmt_fw_ioctl(struct megasas_instance *instance,
                                    sense, sense_handle);
        }
 
-       for (i = 0; i < ioc->sge_count && kbuff_arr[i]; i++) {
-               dma_free_coherent(&instance->pdev->dev,
-                                   kern_sge32[i].length,
-                                   kbuff_arr[i], kern_sge32[i].phys_addr);
+       for (i = 0; i < ioc->sge_count; i++) {
+               if (kbuff_arr[i])
+                       dma_free_coherent(&instance->pdev->dev,
+                                         kern_sge32[i].length,
+                                         kbuff_arr[i],
+                                         kern_sge32[i].phys_addr);
        }
 
        megasas_return_cmd(instance, cmd);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c 
b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index aa51195..d6e8353 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -3740,11 +3740,7 @@ _scsih_qcmd_lck(struct scsi_cmnd *scmd, void 
(*done)(struct scsi_cmnd *))
                        else
                                mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
                } else
-/* MPI Revision I (UNIT = 0xA) - removed MPI2_SCSIIO_CONTROL_UNTAGGED */
-/*                     mpi_control |= MPI2_SCSIIO_CONTROL_UNTAGGED;
- */
-                       mpi_control |= (0x500);
-
+                       mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
        } else
                mpi_control |= MPI2_SCSIIO_CONTROL_SIMPLEQ;
        /* Make sure Device is not raid volume.
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 913a178..c408ff7 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x0489, 0xE000) }, /* Pirelli Broadband S.p.A, DP-L10 
SIP/GSM Mobile */
        { USB_DEVICE(0x0489, 0xE003) }, /* Pirelli Broadband S.p.A, DP-L10 
SIP/GSM Mobile */
        { USB_DEVICE(0x0745, 0x1000) }, /* CipherLab USB CCD Barcode Scanner 
1000 */
+       { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, 
M5300 series, M7100 series */
        { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless 
smartcard reader */
        { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC 
Device */
        { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher 
Acceptor */
@@ -124,6 +125,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
        { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
        { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+       { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+       { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB 
Device */
        { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
        { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
@@ -154,6 +157,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
        { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+       { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
        { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
        { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
        { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index b8365a7..c2103f4 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -347,17 +347,12 @@ static void option_instat_callback(struct urb *urb);
 #define OLIVETTI_VENDOR_ID                     0x0b3c
 #define OLIVETTI_PRODUCT_OLICARD100            0xc000
 #define OLIVETTI_PRODUCT_OLICARD145            0xc003
+#define OLIVETTI_PRODUCT_OLICARD200            0xc005
 
 /* Celot products */
 #define CELOT_VENDOR_ID                                0x211f
 #define CELOT_PRODUCT_CT680M                   0x6801
 
-/* ONDA Communication vendor id */
-#define ONDA_VENDOR_ID       0x1ee8
-
-/* ONDA MT825UP HSDPA 14.2 modem */
-#define ONDA_MT825UP         0x000b
-
 /* Samsung products */
 #define SAMSUNG_VENDOR_ID                       0x04e8
 #define SAMSUNG_PRODUCT_GT_B3730                0x6889
@@ -450,7 +445,8 @@ static void option_instat_callback(struct urb *urb);
 
 /* Hyundai Petatel Inc. products */
 #define PETATEL_VENDOR_ID                      0x1ff4
-#define PETATEL_PRODUCT_NP10T                  0x600e
+#define PETATEL_PRODUCT_NP10T_600A             0x600a
+#define PETATEL_PRODUCT_NP10T_600E             0x600e
 
 /* TP-LINK Incorporated products */
 #define TPLINK_VENDOR_ID                       0x2357
@@ -797,6 +793,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+       { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
        { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & 
BP3-EXT HSDPA */
        { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
@@ -832,7 +829,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 
0xff),
                .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 
0xff) },
-       { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 
0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 
0xff),
+               .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 
0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 
0xff),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
@@ -1278,8 +1276,8 @@ static const struct usb_device_id option_ids[] = {
 
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
        { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+       { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
        { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 
450 1xEVDO modem */
-       { USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
        { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, 
SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung 
GT-B3730 LTE USB modem.*/
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM610) },
@@ -1351,9 +1349,12 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 
MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, 
MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
        { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
-       { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
+       { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
+       { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
        { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+       { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),                                 
/* TP-Link MA260 */
+         .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },    
/* D-Link DWM-156 (variant) */
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },    
/* D-Link DWM-156 (variant) */
@@ -1361,6 +1362,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
        { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* 
D-Link DWM-152/C1 */
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* 
D-Link DWM-156/C1 */
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 97e4cb5..b5eb8c1 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -55,13 +55,21 @@ EXPORT_SYMBOL(I_BDEV);
 static void bdev_inode_switch_bdi(struct inode *inode,
                        struct backing_dev_info *dst)
 {
+       bool wakeup_bdi = false;
+
        spin_lock(&inode_wb_list_lock);
        spin_lock(&inode->i_lock);
        inode->i_data.backing_dev_info = dst;
-       if (inode->i_state & I_DIRTY)
+       if (inode->i_state & I_DIRTY) {
+               if (bdi_cap_writeback_dirty(dst) && !wb_has_dirty_io(&dst->wb))
+                       wakeup_bdi = true;
                list_move(&inode->i_wb_list, &dst->wb.b_dirty);
+       }
        spin_unlock(&inode->i_lock);
        spin_unlock(&inode_wb_list_lock);
+
+       if (wakeup_bdi)
+               bdi_wakeup_thread_delayed(dst);
 }
 
 sector_t blkdev_max_block(struct block_device *bdev)
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 6e31695..db7be3a 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -913,6 +913,7 @@ nlmsvc_retry_blocked(void)
        unsigned long   timeout = MAX_SCHEDULE_TIMEOUT;
        struct nlm_block *block;
 
+       spin_lock(&nlm_blocked_lock);
        while (!list_empty(&nlm_blocked) && !kthread_should_stop()) {
                block = list_entry(nlm_blocked.next, struct nlm_block, b_list);
 
@@ -922,6 +923,7 @@ nlmsvc_retry_blocked(void)
                        timeout = block->b_when - jiffies;
                        break;
                }
+               spin_unlock(&nlm_blocked_lock);
 
                dprintk("nlmsvc_retry_blocked(%p, when=%ld)\n",
                        block, block->b_when);
@@ -931,7 +933,9 @@ nlmsvc_retry_blocked(void)
                        retry_deferred_block(block);
                } else
                        nlmsvc_grant_blocked(block);
+               spin_lock(&nlm_blocked_lock);
        }
+       spin_unlock(&nlm_blocked_lock);
 
        return timeout;
 }
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 397921b..3c7d8ba 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -127,11 +127,11 @@ struct pppoe_tag {
 
 struct pppoe_hdr {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
-       __u8 ver : 4;
        __u8 type : 4;
+       __u8 ver : 4;
 #elif defined(__BIG_ENDIAN_BITFIELD)
-       __u8 type : 4;
        __u8 ver : 4;
+       __u8 type : 4;
 #else
 #error "Please fix <asm/byteorder.h>"
 #endif
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 582e4ae..561fd2a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -81,6 +81,9 @@ extern int                    ipv6_dev_get_saddr(struct net 
*net,
                                               const struct in6_addr *daddr,
                                               unsigned int srcprefs,
                                               struct in6_addr *saddr);
+extern int                     __ipv6_get_lladdr(struct inet6_dev *idev,
+                                                 struct in6_addr *addr,
+                                                 unsigned char banned_flags);
 extern int                     ipv6_get_lladdr(struct net_device *dev,
                                                struct in6_addr *addr,
                                                unsigned char banned_flags);
diff --git a/include/net/udp.h b/include/net/udp.h
index 67ea6fc..e723c9d 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -180,6 +180,7 @@ extern int udp_get_port(struct sock *sk, unsigned short 
snum,
 extern void udp_err(struct sk_buff *, u32);
 extern int udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                            struct msghdr *msg, size_t len);
+extern int udp_push_pending_frames(struct sock *sk);
 extern void udp_flush_pending_frames(struct sock *sk);
 extern int udp_rcv(struct sk_buff *skb);
 extern int udp_ioctl(struct sock *sk, int cmd, unsigned long arg);
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b582650..da60cfa 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -651,8 +651,18 @@ perf_lock_task_context(struct task_struct *task, int ctxn, 
unsigned long *flags)
 {
        struct perf_event_context *ctx;
 
-       rcu_read_lock();
 retry:
+       /*
+        * One of the few rules of preemptible RCU is that one cannot do
+        * rcu_read_unlock() while holding a scheduler (or nested) lock when
+        * part of the read side critical section was preemptible -- see
+        * rcu_read_unlock_special().
+        *
+        * Since ctx->lock nests under rq->lock we must ensure the entire read
+        * side critical section is non-preemptible.
+        */
+       preempt_disable();
+       rcu_read_lock();
        ctx = rcu_dereference(task->perf_event_ctxp[ctxn]);
        if (ctx) {
                /*
@@ -668,6 +678,8 @@ retry:
                raw_spin_lock_irqsave(&ctx->lock, *flags);
                if (ctx != rcu_dereference(task->perf_event_ctxp[ctxn])) {
                        raw_spin_unlock_irqrestore(&ctx->lock, *flags);
+                       rcu_read_unlock();
+                       preempt_enable();
                        goto retry;
                }
 
@@ -677,6 +689,7 @@ retry:
                }
        }
        rcu_read_unlock();
+       preempt_enable();
        return ctx;
 }
 
@@ -1616,7 +1629,16 @@ static int __perf_event_enable(void *info)
        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
        int err;
 
-       if (WARN_ON_ONCE(!ctx->is_active))
+       /*
+        * There's a time window between 'ctx->is_active' check
+        * in perf_event_enable function and this place having:
+        *   - IRQs on
+        *   - ctx->lock unlocked
+        *
+        * where the task could be killed and 'ctx' deactivated
+        * by perf_event_exit_task.
+        */
+       if (!ctx->is_active)
                return -EINVAL;
 
        raw_spin_lock(&ctx->lock);
@@ -7064,7 +7086,7 @@ inherit_task_group(struct perf_event *event, struct 
task_struct *parent,
                 * child.
                 */
 
-               child_ctx = alloc_perf_context(event->pmu, child);
+               child_ctx = alloc_perf_context(parent_ctx->pmu, child);
                if (!child_ctx)
                        return -ENOMEM;
 
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index ca3bd3c..80ec91d 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -707,17 +707,20 @@ static int hrtimer_switch_to_hres(void)
        return 1;
 }
 
+static void clock_was_set_work(struct work_struct *work)
+{
+       clock_was_set();
+}
+
+static DECLARE_WORK(hrtimer_work, clock_was_set_work);
+
 /*
- * Called from timekeeping code to reprogramm the hrtimer interrupt
- * device. If called from the timer interrupt context we defer it to
- * softirq context.
+ * Called from timekeeping and resume code to reprogramm the hrtimer
+ * interrupt device on all cpus.
  */
 void clock_was_set_delayed(void)
 {
-       struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-
-       cpu_base->clock_was_set = 1;
-       __raise_softirq_irqoff(HRTIMER_SOFTIRQ);
+       schedule_work(&hrtimer_work);
 }
 
 #else
@@ -766,8 +769,10 @@ void hrtimers_resume(void)
        WARN_ONCE(!irqs_disabled(),
                  KERN_INFO "hrtimers_resume() called with IRQs enabled!");
 
+       /* Retrigger on the local CPU */
        retrigger_next_event(NULL);
-       timerfd_clock_was_set();
+       /* And schedule a retrigger for all others */
+       clock_was_set_delayed();
 }
 
 static inline void timer_stats_hrtimer_set_start_info(struct hrtimer *timer)
@@ -1416,13 +1421,6 @@ void hrtimer_peek_ahead_timers(void)
 
 static void run_hrtimer_softirq(struct softirq_action *h)
 {
-       struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-
-       if (cpu_base->clock_was_set) {
-               cpu_base->clock_was_set = 0;
-               clock_was_set();
-       }
-
        hrtimer_peek_ahead_timers();
 }
 
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index e9df75d..20ba7b4 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -396,7 +396,15 @@ void tick_check_oneshot_broadcast(int cpu)
        if (cpumask_test_cpu(cpu, to_cpumask(tick_broadcast_oneshot_mask))) {
                struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
 
-               clockevents_set_mode(td->evtdev, CLOCK_EVT_MODE_ONESHOT);
+               /*
+                * We might be in the middle of switching over from
+                * periodic to oneshot. If the CPU has not yet
+                * switched over, leave the device alone.
+                */
+               if (td->mode == TICKDEV_MODE_ONESHOT) {
+                       clockevents_set_mode(td->evtdev,
+                                            CLOCK_EVT_MODE_ONESHOT);
+               }
        }
 }
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c62ae75..91b8e9a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -628,7 +628,15 @@ __update_max_tr(struct trace_array *tr, struct task_struct 
*tsk, int cpu)
 
        memcpy(max_data->comm, tsk->comm, TASK_COMM_LEN);
        max_data->pid = tsk->pid;
-       max_data->uid = task_uid(tsk);
+       /*
+        * If tsk == current, then use current_uid(), as that does not use
+        * RCU. The irq tracer can be called out of RCU scope.
+        */
+       if (tsk == current)
+               max_data->uid = current_uid();
+       else
+               max_data->uid = task_uid(tsk);
+
        max_data->nice = tsk->static_prio - 20 - MAX_RT_PRIO;
        max_data->policy = tsk->policy;
        max_data->rt_priority = tsk->rt_priority;
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index ee7b5a0..9b7dad8 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -304,6 +304,8 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs 
*regs, long id)
        struct ring_buffer *buffer;
        int size;
        int syscall_nr;
+       unsigned long irq_flags;
+       int pc;
 
        syscall_nr = syscall_get_nr(current, regs);
        if (syscall_nr < 0)
@@ -317,8 +319,11 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs 
*regs, long id)
 
        size = sizeof(*entry) + sizeof(unsigned long) * sys_data->nb_args;
 
+       local_save_flags(irq_flags);
+       pc = preempt_count();
+
        event = trace_current_buffer_lock_reserve(&buffer,
-                       sys_data->enter_event->event.type, size, 0, 0);
+                       sys_data->enter_event->event.type, size, irq_flags, pc);
        if (!event)
                return;
 
@@ -328,7 +333,8 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs 
*regs, long id)
 
        if (!filter_current_check_discard(buffer, sys_data->enter_event,
                                          entry, event))
-               trace_current_buffer_unlock_commit(buffer, event, 0, 0);
+               trace_current_buffer_unlock_commit(buffer, event,
+                                                  irq_flags, pc);
 }
 
 void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
@@ -338,6 +344,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs 
*regs, long ret)
        struct ring_buffer_event *event;
        struct ring_buffer *buffer;
        int syscall_nr;
+       unsigned long irq_flags;
+       int pc;
 
        syscall_nr = syscall_get_nr(current, regs);
        if (syscall_nr < 0)
@@ -350,7 +358,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs 
*regs, long ret)
                return;
 
        event = trace_current_buffer_lock_reserve(&buffer,
-                       sys_data->exit_event->event.type, sizeof(*entry), 0, 0);
+                       sys_data->exit_event->event.type, sizeof(*entry),
+                       irq_flags, pc);
        if (!event)
                return;
 
@@ -360,7 +369,8 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs 
*regs, long ret)
 
        if (!filter_current_check_discard(buffer, sys_data->exit_event,
                                          entry, event))
-               trace_current_buffer_unlock_commit(buffer, event, 0, 0);
+               trace_current_buffer_unlock_commit(buffer, event,
+                                                  irq_flags, pc);
 }
 
 int reg_event_syscall_enter(struct ftrace_event_call *call)
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index d548456..b172407 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -70,6 +70,8 @@ vlan_dev_get_egress_qos_mask(struct net_device *dev, struct 
sk_buff *skb)
 {
        struct vlan_priority_tci_mapping *mp;
 
+       smp_rmb(); /* coupled with smp_wmb() in vlan_dev_set_egress_priority() 
*/
+
        mp = vlan_dev_info(dev)->egress_priority_map[(skb->priority & 0xF)];
        while (mp) {
                if (mp->priority == skb->priority) {
@@ -230,6 +232,11 @@ int vlan_dev_set_egress_priority(const struct net_device 
*dev,
        np->next = mp;
        np->priority = skb_prio;
        np->vlan_qos = vlan_qos;
+       /* Before inserting this element in hash table, make sure all its fields
+        * are committed to memory.
+        * coupled with smp_rmb() in vlan_dev_get_egress_qos_mask()
+        */
+       smp_wmb();
        vlan->egress_priority_map[skb_prio & 0xF] = np;
        if (vlan_qos)
                vlan->nr_egress_mappings++;
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index e78269d..940c001 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -467,8 +467,9 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct 
net_bridge *br,
        skb_set_transport_header(skb, skb->len);
        mldq = (struct mld_msg *) icmp6_hdr(skb);
 
-       interval = ipv6_addr_any(group) ? br->multicast_last_member_interval :
-                                         br->multicast_query_response_interval;
+       interval = ipv6_addr_any(group) ?
+                       br->multicast_query_response_interval :
+                       br->multicast_last_member_interval;
 
        mldq->mld_type = ICMPV6_MGM_QUERY;
        mldq->mld_code = 0;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 34032f2..f268c34 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -237,7 +237,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct 
net_device *dev)
                                   we must kill timers etc. and move
                                   it to safe state.
                                 */
-                               skb_queue_purge(&n->arp_queue);
+                               __skb_queue_purge(&n->arp_queue);
                                n->output = neigh_blackhole;
                                if (n->nud_state & NUD_VALID)
                                        n->nud_state = NUD_NOARP;
@@ -291,7 +291,7 @@ static struct neighbour *neigh_alloc(struct neigh_table 
*tbl)
        if (!n)
                goto out_entries;
 
-       skb_queue_head_init(&n->arp_queue);
+       __skb_queue_head_init(&n->arp_queue);
        rwlock_init(&n->lock);
        seqlock_init(&n->ha_lock);
        n->updated        = n->used = now;
@@ -712,7 +712,9 @@ void neigh_destroy(struct neighbour *neigh)
                hh_cache_put(hh);
        }
 
-       skb_queue_purge(&neigh->arp_queue);
+       write_lock_bh(&neigh->lock);
+       __skb_queue_purge(&neigh->arp_queue);
+       write_unlock_bh(&neigh->lock);
 
        dev_put(neigh->dev);
        neigh_parms_put(neigh->parms);
@@ -864,7 +866,7 @@ static void neigh_invalidate(struct neighbour *neigh)
                neigh->ops->error_report(neigh, skb);
                write_lock(&neigh->lock);
        }
-       skb_queue_purge(&neigh->arp_queue);
+       __skb_queue_purge(&neigh->arp_queue);
 }
 
 /* Called when a timer expires for a neighbour entry. */
@@ -1188,7 +1190,7 @@ int neigh_update(struct neighbour *neigh, const u8 
*lladdr, u8 new,
 
                        write_lock_bh(&neigh->lock);
                }
-               skb_queue_purge(&neigh->arp_queue);
+               __skb_queue_purge(&neigh->arp_queue);
        }
 out:
        if (update_isrouter) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 198f75b..ce46ab2 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -765,7 +765,7 @@ send:
 /*
  * Push out all pending data as one UDP datagram. Socket is locked.
  */
-static int udp_push_pending_frames(struct sock *sk)
+int udp_push_pending_frames(struct sock *sk)
 {
        struct udp_sock  *up = udp_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
@@ -784,6 +784,7 @@ out:
        up->pending = 0;
        return err;
 }
+EXPORT_SYMBOL(udp_push_pending_frames);
 
 int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                size_t len)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3a07320..9c6099d 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1235,6 +1235,23 @@ try_nextdev:
 }
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
 
+int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+                     unsigned char banned_flags)
+{
+       struct inet6_ifaddr *ifp;
+       int err = -EADDRNOTAVAIL;
+
+       list_for_each_entry(ifp, &idev->addr_list, if_list) {
+               if (ifp->scope == IFA_LINK &&
+                   !(ifp->flags & banned_flags)) {
+                       ipv6_addr_copy(addr, &ifp->addr);
+                       err = 0;
+                       break;
+               }
+       }
+       return err;
+}
+
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
                    unsigned char banned_flags)
 {
@@ -1244,17 +1261,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct 
in6_addr *addr,
        rcu_read_lock();
        idev = __in6_dev_get(dev);
        if (idev) {
-               struct inet6_ifaddr *ifp;
-
                read_lock_bh(&idev->lock);
-               list_for_each_entry(ifp, &idev->addr_list, if_list) {
-                       if (ifp->scope == IFA_LINK &&
-                           !(ifp->flags & banned_flags)) {
-                               ipv6_addr_copy(addr, &ifp->addr);
-                               err = 0;
-                               break;
-                       }
-               }
+               err = __ipv6_get_lladdr(idev, addr, banned_flags);
                read_unlock_bh(&idev->lock);
        }
        rcu_read_unlock();
@@ -2357,6 +2365,9 @@ static void init_loopback(struct net_device *dev)
                        if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
                                continue;
 
+                       if (sp_ifa->rt)
+                               continue;
+
                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
 
                        /* Failure cases are ignored */
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4e49ab0..1fea459 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -925,11 +925,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                          const struct flowi6 *fl6)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
-       struct rt6_info *rt = (struct rt6_info *)dst;
+       struct rt6_info *rt;
 
        if (!dst)
                goto out;
 
+       if (dst->ops->family != AF_INET6) {
+               dst_release(dst);
+               return NULL;
+       }
+
+       rt = (struct rt6_info *)dst;
        /* Yes, checking route validity in not connected
         * case is not very simple. Take into account,
         * that we do not support routing by source, TOS,
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f2d74ea..c7ec4bb 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1334,8 +1334,9 @@ mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, 
int sdeleted)
        return scount;
 }
 
-static struct sk_buff *mld_newpack(struct net_device *dev, int size)
+static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
 {
+       struct net_device *dev = idev->dev;
        struct net *net = dev_net(dev);
        struct sock *sk = net->ipv6.igmp_sk;
        struct sk_buff *skb;
@@ -1358,7 +1359,7 @@ static struct sk_buff *mld_newpack(struct net_device 
*dev, int size)
 
        skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
-       if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
+       if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
                /* <draft-ietf-magma-mld-source-05.txt>:
                 * use unspecified address as the source address
                 * when a valid link-local address is not available.
@@ -1461,7 +1462,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, 
struct ifmcaddr6 *pmc,
        struct mld2_grec *pgr;
 
        if (!skb)
-               skb = mld_newpack(dev, dev->mtu);
+               skb = mld_newpack(pmc->idev, dev->mtu);
        if (!skb)
                return NULL;
        pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
@@ -1481,7 +1482,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, 
struct ifmcaddr6 *pmc,
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
        int type, int gdeleted, int sdeleted)
 {
-       struct net_device *dev = pmc->idev->dev;
+       struct inet6_dev *idev = pmc->idev;
+       struct net_device *dev = idev->dev;
        struct mld2_report *pmr;
        struct mld2_grec *pgr = NULL;
        struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
@@ -1510,7 +1512,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, 
struct ifmcaddr6 *pmc,
                    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                        if (skb)
                                mld_sendpack(skb);
-                       skb = mld_newpack(dev, dev->mtu);
+                       skb = mld_newpack(idev, dev->mtu);
                }
        }
        first = 1;
@@ -1537,7 +1539,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, 
struct ifmcaddr6 *pmc,
                                pgr->grec_nsrcs = htons(scount);
                        if (skb)
                                mld_sendpack(skb);
-                       skb = mld_newpack(dev, dev->mtu);
+                       skb = mld_newpack(idev, dev->mtu);
                        first = 1;
                        scount = 0;
                }
@@ -1592,8 +1594,8 @@ static void mld_send_report(struct inet6_dev *idev, 
struct ifmcaddr6 *pmc)
        struct sk_buff *skb = NULL;
        int type;
 
+       read_lock_bh(&idev->lock);
        if (!pmc) {
-               read_lock_bh(&idev->lock);
                for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
                        if (pmc->mca_flags & MAF_NOREPORT)
                                continue;
@@ -1605,7 +1607,6 @@ static void mld_send_report(struct inet6_dev *idev, 
struct ifmcaddr6 *pmc)
                        skb = add_grec(skb, pmc, type, 0, 0);
                        spin_unlock_bh(&pmc->mca_lock);
                }
-               read_unlock_bh(&idev->lock);
        } else {
                spin_lock_bh(&pmc->mca_lock);
                if (pmc->mca_sfcount[MCAST_EXCLUDE])
@@ -1615,6 +1616,7 @@ static void mld_send_report(struct inet6_dev *idev, 
struct ifmcaddr6 *pmc)
                skb = add_grec(skb, pmc, type, 0, 0);
                spin_unlock_bh(&pmc->mca_lock);
        }
+       read_unlock_bh(&idev->lock);
        if (skb)
                mld_sendpack(skb);
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index cd89d6c..214405b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -892,11 +892,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
        struct udphdr *uh;
        struct udp_sock  *up = udp_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
-       struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
+       struct flowi6 *fl6;
        int err = 0;
        int is_udplite = IS_UDPLITE(sk);
        __wsum csum = 0;
 
+       if (up->pending == AF_INET)
+               return udp_push_pending_frames(sk);
+
+       fl6 = &inet->cork.fl.u.ip6;
+
        /* Grab the skbuff where UDP header space exists. */
        if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
                goto out;
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8f92cf8..01eb92c 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1705,6 +1705,7 @@ static int key_notify_sa_flush(const struct km_event *c)
        hdr->sadb_msg_version = PF_KEY_V2;
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+       hdr->sadb_msg_reserved = 0;
 
        pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
@@ -2686,6 +2687,7 @@ static int key_notify_policy_flush(const struct km_event 
*c)
        hdr->sadb_msg_version = PF_KEY_V2;
        hdr->sadb_msg_errno = (uint8_t) 0;
        hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+       hdr->sadb_msg_reserved = 0;
        pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
        return 0;
 
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 4613225..2366914 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -1771,7 +1771,8 @@ static const struct proto_ops pppol2tp_ops = {
 
 static const struct pppox_proto pppol2tp_proto = {
        .create         = pppol2tp_create,
-       .ioctl          = pppol2tp_ioctl
+       .ioctl          = pppol2tp_ioctl,
+       .owner          = THIS_MODULE,
 };
 
 #ifdef CONFIG_L2TP_V3
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index fb37356..5867429 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1584,11 +1584,11 @@ out_cud_release:
                case SIOCX25CALLACCPTAPPRV: {
                        rc = -EINVAL;
                        lock_sock(sk);
-                       if (sk->sk_state != TCP_CLOSE)
-                               break;
-                       clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                       if (sk->sk_state == TCP_CLOSE) {
+                               clear_bit(X25_ACCPT_APPRV_FLAG, &x25->flags);
+                               rc = 0;
+                       }
                        release_sock(sk);
-                       rc = 0;
                        break;
                }
 
@@ -1596,14 +1596,15 @@ out_cud_release:
                        rc = -EINVAL;
                        lock_sock(sk);
                        if (sk->sk_state != TCP_ESTABLISHED)
-                               break;
+                               goto out_sendcallaccpt_release;
                        /* must call accptapprv above */
                        if (test_bit(X25_ACCPT_APPRV_FLAG, &x25->flags))
-                               break;
+                               goto out_sendcallaccpt_release;
                        x25_write_internal(sk, X25_CALL_ACCEPTED);
                        x25->state = X25_STATE_3;
-                       release_sock(sk);
                        rc = 0;
+out_sendcallaccpt_release:
+                       release_sock(sk);
                        break;
                }
 
diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
index eec3ab3..b79eb80 100644
--- a/sound/soc/codecs/sgtl5000.h
+++ b/sound/soc/codecs/sgtl5000.h
@@ -347,7 +347,7 @@
 #define SGTL5000_PLL_INT_DIV_MASK              0xf800
 #define SGTL5000_PLL_INT_DIV_SHIFT             11
 #define SGTL5000_PLL_INT_DIV_WIDTH             5
-#define SGTL5000_PLL_FRAC_DIV_MASK             0x0700
+#define SGTL5000_PLL_FRAC_DIV_MASK             0x07ff
 #define SGTL5000_PLL_FRAC_DIV_SHIFT            0
 #define SGTL5000_PLL_FRAC_DIV_WIDTH            11
 
diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
index d144cdb..d2fb012 100644
--- a/sound/usb/6fire/pcm.c
+++ b/sound/usb/6fire/pcm.c
@@ -541,7 +541,7 @@ static snd_pcm_uframes_t usb6fire_pcm_pointer(
        snd_pcm_uframes_t ret;
 
        if (rt->panic || !sub)
-               return SNDRV_PCM_STATE_XRUN;
+               return SNDRV_PCM_POS_XRUN;
 
        spin_lock_irqsave(&sub->lock, flags);
        ret = sub->dma_off;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Reply via email to