diff --git a/[refs] b/[refs]
index 859b4c412ac4..ac5466077ebd 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8774b7f63be0d1b237bc30d49b6486f7691e2ed4
+refs/heads/master: 00d61e3e8c12d5f395b167856d2b3c430816afb0
diff --git a/trunk/block/blk-settings.c b/trunk/block/blk-settings.c
index 1344a0ea5cc6..5713f7e5cbd2 100644
--- a/trunk/block/blk-settings.c
+++ b/trunk/block/blk-settings.c
@@ -140,7 +140,7 @@ void blk_queue_bounce_limit(struct request_queue *q, u64 dma_addr)
 	/* Assume anything <= 4GB can be handled by IOMMU.
 	   Actually some IOMMUs can handle everything, but I don't
 	   know of a way to test this here. */
-	if (b_pfn <= (min_t(u64, 0xffffffff, BLK_BOUNCE_HIGH) >> PAGE_SHIFT))
+	if (b_pfn < (min_t(u64, 0x100000000UL, BLK_BOUNCE_HIGH) >> PAGE_SHIFT))
 		dma = 1;
 	q->bounce_pfn = max_low_pfn;
 #else
diff --git a/trunk/crypto/xcbc.c b/trunk/crypto/xcbc.c
index b63b633e549c..2feb0f239c38 100644
--- a/trunk/crypto/xcbc.c
+++ b/trunk/crypto/xcbc.c
@@ -116,11 +116,13 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
 	struct crypto_xcbc_ctx *ctx = crypto_hash_ctx_aligned(parent);
 	struct crypto_cipher *tfm = ctx->child;
 	int bs = crypto_hash_blocksize(parent);
+	unsigned int i = 0;
 
-	for (;;) {
-		struct page *pg = sg_page(sg);
-		unsigned int offset = sg->offset;
-		unsigned int slen = sg->length;
+	do {
+
+		struct page *pg = sg_page(&sg[i]);
+		unsigned int offset = sg[i].offset;
+		unsigned int slen = sg[i].length;
 
 		if (unlikely(slen > nbytes))
 			slen = nbytes;
@@ -180,11 +182,8 @@ static int crypto_xcbc_digest_update2(struct hash_desc *pdesc,
 			offset = 0;
 			pg++;
 		}
-
-		if (!nbytes)
-			break;
-		sg = scatterwalk_sg_next(sg);
-	}
+		i++;
+	} while (nbytes>0);
 
 	return 0;
 }
diff --git a/trunk/fs/afs/cell.c b/trunk/fs/afs/cell.c
index 584bb0f9c36a..788865df1bc9 100644
--- a/trunk/fs/afs/cell.c
+++ b/trunk/fs/afs/cell.c
@@ -138,7 +138,6 @@ struct afs_cell *afs_cell_create(const char *name, char *vllist)
 	cell = afs_cell_alloc(name, vllist);
 	if (IS_ERR(cell)) {
 		_leave(" = %ld", PTR_ERR(cell));
-		up_write(&afs_cells_sem);
 		return cell;
 	}