From 9defeb65fee31709c9afcc2c8338d68e551eba6f Mon Sep 17 00:00:00 2001
From: Alexey Dobriyan <adobriyan@gmail.com>
Date: Tue, 23 Jan 2007 21:30:14 +0300
Subject: [PATCH] --- yaml --- r: 45803 b: refs/heads/master c:
 48c35b2d245fffedadce62769aafea8ecf493d19 h: refs/heads/master i:   45801:
 342b11eefe91ac11aa623efd15e29820104f3680   45799:
 e657cc470a2f43588675e1053596efe4ee1800dd v: v3

---
 [refs]                                        |  2 +-
 trunk/arch/mips/Makefile                      |  2 +-
 trunk/drivers/ata/ahci.c                      | 39 +++++---
 trunk/drivers/ata/libata-scsi.c               |  2 +-
 trunk/drivers/ata/sata_nv.c                   | 14 +--
 trunk/drivers/net/irda/irda-usb.c             | 45 +++++----
 trunk/drivers/net/irda/irda-usb.h             |  1 -
 trunk/drivers/net/irda/vlsi_ir.c              | 16 +--
 trunk/drivers/net/irda/vlsi_ir.h              | 33 +++++++
 trunk/drivers/net/mv643xx_eth.c               | 11 +--
 trunk/fs/cifs/CHANGES                         |  4 -
 trunk/fs/cifs/cifs_debug.c                    |  4 +-
 trunk/fs/cifs/cifsfs.h                        |  2 +-
 trunk/fs/cifs/misc.c                          |  8 +-
 trunk/fs/cifs/sess.c                          | 13 +--
 trunk/fs/nfs/dir.c                            |  2 +-
 trunk/fs/nfs/inode.c                          | 97 ++++++-------------
 trunk/fs/nfs/symlink.c                        |  4 +-
 trunk/include/linux/Kbuild                    |  4 +-
 trunk/include/linux/if_tunnel.h               |  2 -
 trunk/include/linux/libata.h                  |  2 -
 .../include/linux/netfilter_ipv4/ip_tables.h  |  2 +-
 trunk/include/linux/nfs_fs.h                  |  1 -
 trunk/include/linux/sunrpc/sched.h            |  1 +
 .../net/netfilter/nf_conntrack_compat.h       |  1 -
 trunk/include/net/sctp/sm.h                   |  1 -
 trunk/net/bluetooth/l2cap.c                   | 10 +-
 trunk/net/core/flow.c                         | 26 +++--
 .../net/ipv4/netfilter/ip_conntrack_netlink.c |  2 +-
 trunk/net/ipv4/tcp_input.c                    |  6 +-
 trunk/net/ipv4/tcp_output.c                   |  3 +-
 trunk/net/ipv6/addrconf.c                     |  6 --
 trunk/net/ipv6/mcast.c                        |  6 ++
 trunk/net/ipv6/route.c                        |  1 -
 trunk/net/netfilter/nf_conntrack_netlink.c    |  2 +-
 trunk/net/sctp/sm_make_chunk.c                |  6 +-
 trunk/net/sctp/sm_sideeffect.c                |  2 +-
 trunk/net/sctp/sm_statefuns.c                 | 44 ++++-----
 trunk/net/sctp/sm_statetable.c                |  2 +-
 trunk/net/sunrpc/clnt.c                       |  8 +-
 trunk/net/sunrpc/sched.c                      |  3 +-
 trunk/net/x25/x25_dev.c                       |  1 -
 trunk/net/xfrm/xfrm_policy.c                  | 16 ++-
 trunk/security/selinux/ss/services.c          |  3 -
 44 files changed, 229 insertions(+), 231 deletions(-)

diff --git a/[refs] b/[refs]
index c83f3ab0ced1..7278de4cec91 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 717d44e849219781ced028a40fcc59d3e1f49e4c
+refs/heads/master: 48c35b2d245fffedadce62769aafea8ecf493d19
diff --git a/trunk/arch/mips/Makefile b/trunk/arch/mips/Makefile
index d1b026a0337d..c68b5d3e5d18 100644
--- a/trunk/arch/mips/Makefile
+++ b/trunk/arch/mips/Makefile
@@ -623,7 +623,7 @@ LDFLAGS			+= -m $(ld-emul)
 
 ifdef CONFIG_MIPS
 CHECKFLAGS += $(shell $(CC) $(CFLAGS) -dM -E -xc /dev/null | \
-	egrep -vw '__GNUC_(MAJOR|MINOR|PATCHLEVEL)__' | \
+	egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
 	sed -e 's/^\#define /-D/' -e "s/ /='/" -e "s/$$/'/")
 ifdef CONFIG_64BIT
 CHECKFLAGS		+= -m64
diff --git a/trunk/drivers/ata/ahci.c b/trunk/drivers/ata/ahci.c
index e3c7b312287a..b517d2493551 100644
--- a/trunk/drivers/ata/ahci.c
+++ b/trunk/drivers/ata/ahci.c
@@ -361,7 +361,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
 	{ PCI_VDEVICE(INTEL, 0x27c1), board_ahci }, /* ICH7 */
 	{ PCI_VDEVICE(INTEL, 0x27c5), board_ahci }, /* ICH7M */
 	{ PCI_VDEVICE(INTEL, 0x27c3), board_ahci }, /* ICH7R */
-	{ PCI_VDEVICE(AL, 0x5288), board_ahci_ign_iferr }, /* ULi M5288 */
+	{ PCI_VDEVICE(AL, 0x5288), board_ahci }, /* ULi M5288 */
 	{ PCI_VDEVICE(INTEL, 0x2681), board_ahci }, /* ESB2 */
 	{ PCI_VDEVICE(INTEL, 0x2682), board_ahci }, /* ESB2 */
 	{ PCI_VDEVICE(INTEL, 0x2683), board_ahci }, /* ESB2 */
@@ -586,18 +586,35 @@ static void ahci_power_down(void __iomem *port_mmio, u32 cap)
 {
 	u32 cmd, scontrol;
 
-	if (!(cap & HOST_CAP_SSS))
-		return;
+	cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
+
+	if (cap & HOST_CAP_SSC) {
+		/* enable transitions to slumber mode */
+		scontrol = readl(port_mmio + PORT_SCR_CTL);
+		if ((scontrol & 0x0f00) > 0x100) {
+			scontrol &= ~0xf00;
+			writel(scontrol, port_mmio + PORT_SCR_CTL);
+		}
 
-	/* put device into listen mode, first set PxSCTL.DET to 0 */
-	scontrol = readl(port_mmio + PORT_SCR_CTL);
-	scontrol &= ~0xf;
-	writel(scontrol, port_mmio + PORT_SCR_CTL);
+		/* put device into slumber mode */
+		writel(cmd | PORT_CMD_ICC_SLUMBER, port_mmio + PORT_CMD);
 
-	/* then set PxCMD.SUD to 0 */
-	cmd = readl(port_mmio + PORT_CMD) & ~PORT_CMD_ICC_MASK;
-	cmd &= ~PORT_CMD_SPIN_UP;
-	writel(cmd, port_mmio + PORT_CMD);
+		/* wait for the transition to complete */
+		ata_wait_register(port_mmio + PORT_CMD, PORT_CMD_ICC_SLUMBER,
+				  PORT_CMD_ICC_SLUMBER, 1, 50);
+	}
+
+	/* put device into listen mode */
+	if (cap & HOST_CAP_SSS) {
+		/* first set PxSCTL.DET to 0 */
+		scontrol = readl(port_mmio + PORT_SCR_CTL);
+		scontrol &= ~0xf;
+		writel(scontrol, port_mmio + PORT_SCR_CTL);
+
+		/* then set PxCMD.SUD to 0 */
+		cmd &= ~PORT_CMD_SPIN_UP;
+		writel(cmd, port_mmio + PORT_CMD);
+	}
 }
 
 static void ahci_init_port(void __iomem *port_mmio, u32 cap,
diff --git a/trunk/drivers/ata/libata-scsi.c b/trunk/drivers/ata/libata-scsi.c
index 7cc5a4a910a4..836947da5b14 100644
--- a/trunk/drivers/ata/libata-scsi.c
+++ b/trunk/drivers/ata/libata-scsi.c
@@ -372,7 +372,7 @@ struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
 		if (cmd->use_sg) {
 			qc->__sg = (struct scatterlist *) cmd->request_buffer;
 			qc->n_elem = cmd->use_sg;
-		} else if (cmd->request_bufflen) {
+		} else {
 			qc->__sg = &qc->sgent;
 			qc->n_elem = 1;
 		}
diff --git a/trunk/drivers/ata/sata_nv.c b/trunk/drivers/ata/sata_nv.c
index f7a963eb1f02..f6d498e1cf80 100644
--- a/trunk/drivers/ata/sata_nv.c
+++ b/trunk/drivers/ata/sata_nv.c
@@ -700,6 +700,7 @@ static void nv_adma_check_cpb(struct ata_port *ap, int cpb_num, int force_err)
 static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
 {
 	struct ata_queued_cmd *qc = ata_qc_from_tag(ap, ap->active_tag);
+	int handled;
 
 	/* freeze if hotplugged */
 	if (unlikely(irq_stat & (NV_INT_ADDED | NV_INT_REMOVED))) {
@@ -718,7 +719,13 @@ static int nv_host_intr(struct ata_port *ap, u8 irq_stat)
 	}
 
 	/* handle interrupt */
-	return ata_host_intr(ap, qc);
+	handled = ata_host_intr(ap, qc);
+	if (unlikely(!handled)) {
+		/* spurious, clear it */
+		ata_check_status(ap);
+	}
+
+	return 1;
 }
 
 static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
@@ -745,11 +752,6 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
 			if (pp->flags & NV_ADMA_PORT_REGISTER_MODE) {
 				u8 irq_stat = readb(host->mmio_base + NV_INT_STATUS_CK804)
 					>> (NV_INT_PORT_SHIFT * i);
-				if(ata_tag_valid(ap->active_tag))
-					/** NV_INT_DEV indication seems unreliable at times
-					    at least in ADMA mode. Force it on always when a
-					    command is active, to prevent losing interrupts. */
-					irq_stat |= NV_INT_DEV;
 				handled += nv_host_intr(ap, irq_stat);
 				continue;
 			}
diff --git a/trunk/drivers/net/irda/irda-usb.c b/trunk/drivers/net/irda/irda-usb.c
index 340ee99652eb..3ca1082ec776 100644
--- a/trunk/drivers/net/irda/irda-usb.c
+++ b/trunk/drivers/net/irda/irda-usb.c
@@ -441,13 +441,25 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
 		goto drop;
 	}
 
-	memcpy(self->tx_buff + self->header_length, skb->data, skb->len);
+	/* Make sure there is room for IrDA-USB header. The actual
+	 * allocation will be done lower in skb_push().
+	 * Also, we don't use directly skb_cow(), because it require
+	 * headroom >= 16, which force unnecessary copies - Jean II */
+	if (skb_headroom(skb) < self->header_length) {
+		IRDA_DEBUG(0, "%s(), Insuficient skb headroom.\n", __FUNCTION__);
+		if (skb_cow(skb, self->header_length)) {
+			IRDA_WARNING("%s(), failed skb_cow() !!!\n", __FUNCTION__);
+			goto drop;
+		}
+	}
 
 	/* Change setting for next frame */
+
 	if (self->capability & IUC_STIR421X) {
 		__u8 turnaround_time;
-		__u8* frame = self->tx_buff;
+		__u8* frame;
 		turnaround_time = get_turnaround_time( skb );
+		frame= skb_push(skb, self->header_length);
 		irda_usb_build_header(self, frame, 0);
 		frame[2] = turnaround_time;
 		if ((skb->len != 0) &&
@@ -460,17 +472,17 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
 			frame[1] = 0;
 		}
 	} else {
-		irda_usb_build_header(self, self->tx_buff, 0);
+		irda_usb_build_header(self, skb_push(skb, self->header_length), 0);
 	}
 
 	/* FIXME: Make macro out of this one */
 	((struct irda_skb_cb *)skb->cb)->context = self;
 
-	usb_fill_bulk_urb(urb, self->usbdev,
+        usb_fill_bulk_urb(urb, self->usbdev, 
 		      usb_sndbulkpipe(self->usbdev, self->bulk_out_ep),
-                      self->tx_buff, skb->len + self->header_length,
+                      skb->data, IRDA_SKB_MAX_MTU,
                       write_bulk_callback, skb);
-
+	urb->transfer_buffer_length = skb->len;
 	/* This flag (URB_ZERO_PACKET) indicates that what we send is not
 	 * a continuous stream of data but separate packets.
 	 * In this case, the USB layer will insert an empty USB frame (TD)
@@ -1443,9 +1455,6 @@ static inline void irda_usb_close(struct irda_usb_cb *self)
 	/* Remove the speed buffer */
 	kfree(self->speed_buff);
 	self->speed_buff = NULL;
-
-	kfree(self->tx_buff);
-	self->tx_buff = NULL;
 }
 
 /********************** USB CONFIG SUBROUTINES **********************/
@@ -1515,6 +1524,8 @@ static inline int irda_usb_parse_endpoints(struct irda_usb_cb *self, struct usb_
 
 	IRDA_DEBUG(0, "%s(), And our endpoints are : in=%02X, out=%02X (%d), int=%02X\n",
 		__FUNCTION__, self->bulk_in_ep, self->bulk_out_ep, self->bulk_out_mtu, self->bulk_int_ep);
+	/* Should be 8, 16, 32 or 64 bytes */
+	IRDA_ASSERT(self->bulk_out_mtu == 64, ;);
 
 	return((self->bulk_in_ep != 0) && (self->bulk_out_ep != 0));
 }
@@ -1742,14 +1753,9 @@ static int irda_usb_probe(struct usb_interface *intf,
 
 	memset(self->speed_buff, 0, IRDA_USB_SPEED_MTU);
 
-	self->tx_buff = kzalloc(IRDA_SKB_MAX_MTU + self->header_length,
-				GFP_KERNEL);
-	if (self->tx_buff == NULL)
-		goto err_out_4;
-
 	ret = irda_usb_open(self);
 	if (ret) 
-		goto err_out_5;
+		goto err_out_4;
 
 	IRDA_MESSAGE("IrDA: Registered device %s\n", net->name);
 	usb_set_intfdata(intf, self);
@@ -1760,14 +1766,14 @@ static int irda_usb_probe(struct usb_interface *intf,
 		self->needspatch = (ret < 0);
 		if (self->needspatch) {
 			IRDA_ERROR("STIR421X: Couldn't upload patch\n");
-			goto err_out_6;
+			goto err_out_5;
 		}
 
 		/* replace IrDA class descriptor with what patched device is now reporting */
 		irda_desc = irda_usb_find_class_desc (self->usbintf);
 		if (irda_desc == NULL) {
 			ret = -ENODEV;
-			goto err_out_6;
+			goto err_out_5;
 		}
 		if (self->irda_desc)
 			kfree (self->irda_desc);
@@ -1776,10 +1782,9 @@ static int irda_usb_probe(struct usb_interface *intf,
 	}
 
 	return 0;
-err_out_6:
-	unregister_netdev(self->netdev);
+
 err_out_5:
-	kfree(self->tx_buff);
+	unregister_netdev(self->netdev);
 err_out_4:
 	kfree(self->speed_buff);
 err_out_3:
diff --git a/trunk/drivers/net/irda/irda-usb.h b/trunk/drivers/net/irda/irda-usb.h
index e846c38224a3..6b2271f18e77 100644
--- a/trunk/drivers/net/irda/irda-usb.h
+++ b/trunk/drivers/net/irda/irda-usb.h
@@ -156,7 +156,6 @@ struct irda_usb_cb {
 	struct irlap_cb   *irlap;	/* The link layer we are binded to */
 	struct qos_info qos;
 	char *speed_buff;		/* Buffer for speed changes */
-	char *tx_buff;
 
 	struct timeval stamp;
 	struct timeval now;
diff --git a/trunk/drivers/net/irda/vlsi_ir.c b/trunk/drivers/net/irda/vlsi_ir.c
index e2b1af618450..18c68193bf14 100644
--- a/trunk/drivers/net/irda/vlsi_ir.c
+++ b/trunk/drivers/net/irda/vlsi_ir.c
@@ -166,7 +166,7 @@ static void vlsi_proc_pdev(struct seq_file *seq, struct pci_dev *pdev)
 	unsigned i;
 
 	seq_printf(seq, "\n%s (vid/did: %04x/%04x)\n",
-		   pci_name(pdev), (int)pdev->vendor, (int)pdev->device);
+		   PCIDEV_NAME(pdev), (int)pdev->vendor, (int)pdev->device);
 	seq_printf(seq, "pci-power-state: %u\n", (unsigned) pdev->current_state);
 	seq_printf(seq, "resources: irq=%u / io=0x%04x / dma_mask=0x%016Lx\n",
 		   pdev->irq, (unsigned)pci_resource_start(pdev, 0), (unsigned long long)pdev->dma_mask);
@@ -1401,7 +1401,7 @@ static void vlsi_tx_timeout(struct net_device *ndev)
 
 	if (vlsi_start_hw(idev))
 		IRDA_ERROR("%s: failed to restart hw - %s(%s) unusable!\n",
-			   __FUNCTION__, pci_name(idev->pdev), ndev->name);
+			   __FUNCTION__, PCIDEV_NAME(idev->pdev), ndev->name);
 	else
 		netif_start_queue(ndev);
 }
@@ -1643,7 +1643,7 @@ vlsi_irda_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		pdev->current_state = 0; /* hw must be running now */
 
 	IRDA_MESSAGE("%s: IrDA PCI controller %s detected\n",
-		     drivername, pci_name(pdev));
+		     drivername, PCIDEV_NAME(pdev));
 
 	if ( !pci_resource_start(pdev,0)
 	     || !(pci_resource_flags(pdev,0) & IORESOURCE_IO) ) {
@@ -1728,7 +1728,7 @@ static void __devexit vlsi_irda_remove(struct pci_dev *pdev)
 
 	pci_set_drvdata(pdev, NULL);
 
-	IRDA_MESSAGE("%s: %s removed\n", drivername, pci_name(pdev));
+	IRDA_MESSAGE("%s: %s removed\n", drivername, PCIDEV_NAME(pdev));
 }
 
 #ifdef CONFIG_PM
@@ -1748,7 +1748,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
 
 	if (!ndev) {
 		IRDA_ERROR("%s - %s: no netdevice \n",
-			   __FUNCTION__, pci_name(pdev));
+			   __FUNCTION__, PCIDEV_NAME(pdev));
 		return 0;
 	}
 	idev = ndev->priv;	
@@ -1759,7 +1759,7 @@ static int vlsi_irda_suspend(struct pci_dev *pdev, pm_message_t state)
 			pdev->current_state = state.event;
 		}
 		else
-			IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, pci_name(pdev), pdev->current_state, state.event);
+			IRDA_ERROR("%s - %s: invalid suspend request %u -> %u\n", __FUNCTION__, PCIDEV_NAME(pdev), pdev->current_state, state.event);
 		up(&idev->sem);
 		return 0;
 	}
@@ -1787,7 +1787,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
 
 	if (!ndev) {
 		IRDA_ERROR("%s - %s: no netdevice \n",
-			   __FUNCTION__, pci_name(pdev));
+			   __FUNCTION__, PCIDEV_NAME(pdev));
 		return 0;
 	}
 	idev = ndev->priv;	
@@ -1795,7 +1795,7 @@ static int vlsi_irda_resume(struct pci_dev *pdev)
 	if (pdev->current_state == 0) {
 		up(&idev->sem);
 		IRDA_WARNING("%s - %s: already resumed\n",
-			     __FUNCTION__, pci_name(pdev));
+			     __FUNCTION__, PCIDEV_NAME(pdev));
 		return 0;
 	}
 	
diff --git a/trunk/drivers/net/irda/vlsi_ir.h b/trunk/drivers/net/irda/vlsi_ir.h
index 2d3b773d8e35..c37f0bc4c7f9 100644
--- a/trunk/drivers/net/irda/vlsi_ir.h
+++ b/trunk/drivers/net/irda/vlsi_ir.h
@@ -41,6 +41,39 @@
 #define PCI_CLASS_SUBCLASS_MASK		0xffff
 #endif
 
+/* in recent 2.5 interrupt handlers have non-void return value */
+#ifndef IRQ_RETVAL
+typedef void irqreturn_t;
+#define IRQ_NONE
+#define IRQ_HANDLED
+#define IRQ_RETVAL(x)
+#endif
+
+/* some stuff need to check kernelversion. Not all 2.5 stuff was present
+ * in early 2.5.x - the test is merely to separate 2.4 from 2.5
+ */
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
+
+/* PDE() introduced in 2.5.4 */
+#ifdef CONFIG_PROC_FS
+#define PDE(inode) ((inode)->i_private)
+#endif
+
+/* irda crc16 calculation exported in 2.5.42 */
+#define irda_calc_crc16(fcs,buf,len)	(GOOD_FCS)
+
+/* we use this for unified pci device name access */
+#define PCIDEV_NAME(pdev)	((pdev)->name)
+
+#else /* 2.5 or later */
+
+/* whatever we get from the associated struct device - bus:slot:dev.fn id */
+#define PCIDEV_NAME(pdev)	(pci_name(pdev))
+
+#endif
+
 /* ================================================================ */
 
 /* non-standard PCI registers */
diff --git a/trunk/drivers/net/mv643xx_eth.c b/trunk/drivers/net/mv643xx_eth.c
index b3bf86422734..c41ae4286eea 100644
--- a/trunk/drivers/net/mv643xx_eth.c
+++ b/trunk/drivers/net/mv643xx_eth.c
@@ -314,13 +314,6 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
 
 	while (mp->tx_desc_count > 0) {
 		spin_lock_irqsave(&mp->lock, flags);
-
-		/* tx_desc_count might have changed before acquiring the lock */
-		if (mp->tx_desc_count <= 0) {
-			spin_unlock_irqrestore(&mp->lock, flags);
-			return released;
-		}
-
 		tx_index = mp->tx_used_desc_q;
 		desc = &mp->p_tx_desc_area[tx_index];
 		cmd_sts = desc->cmd_sts;
@@ -339,13 +332,13 @@ int mv643xx_eth_free_tx_descs(struct net_device *dev, int force)
 		if (skb)
 			mp->tx_skb[tx_index] = NULL;
 
+		spin_unlock_irqrestore(&mp->lock, flags);
+
 		if (cmd_sts & ETH_ERROR_SUMMARY) {
 			printk("%s: Error in TX\n", dev->name);
 			mp->stats.tx_errors++;
 		}
 
-		spin_unlock_irqrestore(&mp->lock, flags);
-
 		if (cmd_sts & ETH_TX_FIRST_DESC)
 			dma_unmap_single(NULL, addr, count, DMA_TO_DEVICE);
 		else
diff --git a/trunk/fs/cifs/CHANGES b/trunk/fs/cifs/CHANGES
index d04d2f7448d9..3539d6ef9611 100644
--- a/trunk/fs/cifs/CHANGES
+++ b/trunk/fs/cifs/CHANGES
@@ -1,7 +1,3 @@
-Version 1.47
-------------
-Fix oops in list_del during mount caused by unaligned string.
-
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
diff --git a/trunk/fs/cifs/cifs_debug.c b/trunk/fs/cifs/cifs_debug.c
index 6017c465440e..96abeb738978 100644
--- a/trunk/fs/cifs/cifs_debug.c
+++ b/trunk/fs/cifs/cifs_debug.c
@@ -143,8 +143,8 @@ cifs_debug_data_read(char *buf, char **beginBuffer, off_t offset,
 		ses = list_entry(tmp, struct cifsSesInfo, cifsSessionList);
 		if((ses->serverDomain == NULL) || (ses->serverOS == NULL) ||
 		   (ses->serverNOS == NULL)) {
-			buf += sprintf(buf, "\nentry for %s not fully "
-					"displayed\n\t", ses->serverName);
+			buf += sprintf("\nentry for %s not fully displayed\n\t",
+					ses->serverName);
 			
 		} else {
 			length =
diff --git a/trunk/fs/cifs/cifsfs.h b/trunk/fs/cifs/cifsfs.h
index 8aa66dcf13bd..a243f779b363 100644
--- a/trunk/fs/cifs/cifsfs.h
+++ b/trunk/fs/cifs/cifsfs.h
@@ -100,5 +100,5 @@ extern ssize_t	cifs_getxattr(struct dentry *, const char *, void *, size_t);
 extern ssize_t	cifs_listxattr(struct dentry *, char *, size_t);
 extern int cifs_ioctl (struct inode * inode, struct file * filep,
 		       unsigned int command, unsigned long arg);
-#define CIFS_VERSION   "1.47"
+#define CIFS_VERSION   "1.46"
 #endif				/* _CIFSFS_H */
diff --git a/trunk/fs/cifs/misc.c b/trunk/fs/cifs/misc.c
index 19cc294c7c70..aedf683f011f 100644
--- a/trunk/fs/cifs/misc.c
+++ b/trunk/fs/cifs/misc.c
@@ -71,7 +71,9 @@ sesInfoAlloc(void)
 {
 	struct cifsSesInfo *ret_buf;
 
-	ret_buf = kzalloc(sizeof (struct cifsSesInfo), GFP_KERNEL);
+	ret_buf =
+	    (struct cifsSesInfo *) kzalloc(sizeof (struct cifsSesInfo),
+					   GFP_KERNEL);
 	if (ret_buf) {
 		write_lock(&GlobalSMBSeslock);
 		atomic_inc(&sesInfoAllocCount);
@@ -107,7 +109,9 @@ struct cifsTconInfo *
 tconInfoAlloc(void)
 {
 	struct cifsTconInfo *ret_buf;
-	ret_buf = kzalloc(sizeof (struct cifsTconInfo), GFP_KERNEL);
+	ret_buf =
+	    (struct cifsTconInfo *) kzalloc(sizeof (struct cifsTconInfo),
+					    GFP_KERNEL);
 	if (ret_buf) {
 		write_lock(&GlobalSMBSeslock);
 		atomic_inc(&tconInfoAllocCount);
diff --git a/trunk/fs/cifs/sess.c b/trunk/fs/cifs/sess.c
index 758464630893..bbdda99dce61 100644
--- a/trunk/fs/cifs/sess.c
+++ b/trunk/fs/cifs/sess.c
@@ -182,14 +182,11 @@ static int decode_unicode_ssetup(char ** pbcc_area, int bleft, struct cifsSesInf
 	cFYI(1,("bleft %d",bleft));
 
 
-	/* SMB header is unaligned, so cifs servers word align start of
-	   Unicode strings */
-	data++;
-	bleft--; /* Windows servers do not always double null terminate
-		    their final Unicode string - in which case we
-		    now will not attempt to decode the byte of junk
-		    which follows it */
-		    
+	/* word align, if bytes remaining is not even */
+	if(bleft % 2) {
+		bleft--;
+		data++;
+	}
 	words_left = bleft / 2;
 
 	/* save off server operating system */
diff --git a/trunk/fs/nfs/dir.c b/trunk/fs/nfs/dir.c
index d9ba8cb0ee75..dee3d6c0f194 100644
--- a/trunk/fs/nfs/dir.c
+++ b/trunk/fs/nfs/dir.c
@@ -532,7 +532,7 @@ static int nfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 
 	lock_kernel();
 
-	res = nfs_revalidate_mapping_nolock(inode, filp->f_mapping);
+	res = nfs_revalidate_mapping(inode, filp->f_mapping);
 	if (res < 0) {
 		unlock_kernel();
 		return res;
diff --git a/trunk/fs/nfs/inode.c b/trunk/fs/nfs/inode.c
index d83498282837..63e470279309 100644
--- a/trunk/fs/nfs/inode.c
+++ b/trunk/fs/nfs/inode.c
@@ -665,86 +665,49 @@ int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
 	return __nfs_revalidate_inode(server, inode);
 }
 
-static int nfs_invalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
-{
-	struct nfs_inode *nfsi = NFS_I(inode);
-	
-	if (mapping->nrpages != 0) {
-		int ret = invalidate_inode_pages2(mapping);
-		if (ret < 0)
-			return ret;
-	}
-	spin_lock(&inode->i_lock);
-	nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
-	if (S_ISDIR(inode->i_mode)) {
-		memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
-		/* This ensures we revalidate child dentries */
-		nfsi->cache_change_attribute = jiffies;
-	}
-	spin_unlock(&inode->i_lock);
-	nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
-	dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
-			inode->i_sb->s_id, (long long)NFS_FILEID(inode));
-	return 0;
-}
-
-static int nfs_invalidate_mapping(struct inode *inode, struct address_space *mapping)
-{
-	int ret = 0;
-
-	mutex_lock(&inode->i_mutex);
-	if (NFS_I(inode)->cache_validity & NFS_INO_INVALID_DATA) {
-		ret = nfs_sync_mapping(mapping);
-		if (ret == 0)
-			ret = nfs_invalidate_mapping_nolock(inode, mapping);
-	}
-	mutex_unlock(&inode->i_mutex);
-	return ret;
-}
-
-/**
- * nfs_revalidate_mapping_nolock - Revalidate the pagecache
- * @inode - pointer to host inode
- * @mapping - pointer to mapping
- */
-int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping)
-{
-	struct nfs_inode *nfsi = NFS_I(inode);
-	int ret = 0;
-
-	if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-			|| nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
-		ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-		if (ret < 0)
-			goto out;
-	}
-	if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-		ret = nfs_invalidate_mapping_nolock(inode, mapping);
-out:
-	return ret;
-}
-
 /**
  * nfs_revalidate_mapping - Revalidate the pagecache
  * @inode - pointer to host inode
  * @mapping - pointer to mapping
- *
- * This version of the function will take the inode->i_mutex and attempt to
- * flush out all dirty data if it needs to invalidate the page cache.
  */
 int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
 {
 	struct nfs_inode *nfsi = NFS_I(inode);
 	int ret = 0;
 
+	if (NFS_STALE(inode))
+		ret = -ESTALE;
 	if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
-			|| nfs_attribute_timeout(inode) || NFS_STALE(inode)) {
+			|| nfs_attribute_timeout(inode))
 		ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
-		if (ret < 0)
-			goto out;
+	if (ret < 0)
+		goto out;
+
+	if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
+		if (mapping->nrpages != 0) {
+			if (S_ISREG(inode->i_mode)) {
+				ret = nfs_sync_mapping(mapping);
+				if (ret < 0)
+					goto out;
+			}
+			ret = invalidate_inode_pages2(mapping);
+			if (ret < 0)
+				goto out;
+		}
+		spin_lock(&inode->i_lock);
+		nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
+		if (S_ISDIR(inode->i_mode)) {
+			memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
+			/* This ensures we revalidate child dentries */
+			nfsi->cache_change_attribute = jiffies;
+		}
+		spin_unlock(&inode->i_lock);
+
+		nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
+		dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
+				inode->i_sb->s_id,
+				(long long)NFS_FILEID(inode));
 	}
-	if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
-		ret = nfs_invalidate_mapping(inode, mapping);
 out:
 	return ret;
 }
diff --git a/trunk/fs/nfs/symlink.c b/trunk/fs/nfs/symlink.c
index 525c136c7d8c..6c686112cc03 100644
--- a/trunk/fs/nfs/symlink.c
+++ b/trunk/fs/nfs/symlink.c
@@ -50,9 +50,7 @@ static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
 	struct inode *inode = dentry->d_inode;
 	struct page *page;
-	void *err;
-
-	err = ERR_PTR(nfs_revalidate_mapping_nolock(inode, inode->i_mapping));
+	void *err = ERR_PTR(nfs_revalidate_mapping(inode, inode->i_mapping));
 	if (err)
 		goto read_failed;
 	page = read_cache_page(&inode->i_data, 0,
diff --git a/trunk/include/linux/Kbuild b/trunk/include/linux/Kbuild
index 157db77a7170..8c634f9df39f 100644
--- a/trunk/include/linux/Kbuild
+++ b/trunk/include/linux/Kbuild
@@ -69,6 +69,7 @@ header-y += hysdn_if.h
 header-y += i2c-dev.h
 header-y += i8k.h
 header-y += icmp.h
+header-y += if_addr.h
 header-y += if_arcnet.h
 header-y += if_arp.h
 header-y += if_bonding.h
@@ -78,6 +79,7 @@ header-y += if_fddi.h
 header-y += if.h
 header-y += if_hippi.h
 header-y += if_infiniband.h
+header-y += if_link.h
 header-y += if_packet.h
 header-y += if_plip.h
 header-y += if_ppp.h
@@ -211,7 +213,6 @@ unifdef-y += hpet.h
 unifdef-y += i2c.h
 unifdef-y += i2o-dev.h
 unifdef-y += icmpv6.h
-unifdef-y += if_addr.h
 unifdef-y += if_bridge.h
 unifdef-y += if_ec.h
 unifdef-y += if_eql.h
@@ -219,7 +220,6 @@ unifdef-y += if_ether.h
 unifdef-y += if_fddi.h
 unifdef-y += if_frad.h
 unifdef-y += if_ltalk.h
-unifdef-y += if_link.h
 unifdef-y += if_pppox.h
 unifdef-y += if_shaper.h
 unifdef-y += if_tr.h
diff --git a/trunk/include/linux/if_tunnel.h b/trunk/include/linux/if_tunnel.h
index 660b5010c2d9..8de079ba1107 100644
--- a/trunk/include/linux/if_tunnel.h
+++ b/trunk/include/linux/if_tunnel.h
@@ -1,8 +1,6 @@
 #ifndef _IF_TUNNEL_H_
 #define _IF_TUNNEL_H_
 
-#include <linux/types.h>
-
 #define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
 #define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
 #define SIOCDELTUNNEL   (SIOCDEVPRIVATE + 2)
diff --git a/trunk/include/linux/libata.h b/trunk/include/linux/libata.h
index f7f268e38749..e53a13ba7f78 100644
--- a/trunk/include/linux/libata.h
+++ b/trunk/include/linux/libata.h
@@ -1149,9 +1149,7 @@ static inline void ata_qc_reinit(struct ata_queued_cmd *qc)
 	qc->cursect = qc->cursg = qc->cursg_ofs = 0;
 	qc->nsect = 0;
 	qc->nbytes = qc->curbytes = 0;
-	qc->n_elem = 0;
 	qc->err_mask = 0;
-	qc->pad_len = 0;
 
 	ata_tf_init(qc->dev, &qc->tf);
 
diff --git a/trunk/include/linux/netfilter_ipv4/ip_tables.h b/trunk/include/linux/netfilter_ipv4/ip_tables.h
index 98d566c5e32a..4f06dad0bde9 100644
--- a/trunk/include/linux/netfilter_ipv4/ip_tables.h
+++ b/trunk/include/linux/netfilter_ipv4/ip_tables.h
@@ -28,7 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 
 #define IPT_FUNCTION_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
-#define IPT_TABLE_MAXNAMELEN XT_TABLE_MAXNAMELEN
+#define IPT_TABLE_MAXNAMELEN XT_FUNCTION_MAXNAMELEN
 #define ipt_match xt_match
 #define ipt_target xt_target
 #define ipt_table xt_table
diff --git a/trunk/include/linux/nfs_fs.h b/trunk/include/linux/nfs_fs.h
index c5d4084773e8..04963063e620 100644
--- a/trunk/include/linux/nfs_fs.h
+++ b/trunk/include/linux/nfs_fs.h
@@ -308,7 +308,6 @@ extern int nfs_attribute_timeout(struct inode *inode);
 extern int nfs_revalidate_inode(struct nfs_server *server, struct inode *inode);
 extern int __nfs_revalidate_inode(struct nfs_server *, struct inode *);
 extern int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping);
-extern int nfs_revalidate_mapping_nolock(struct inode *inode, struct address_space *mapping);
 extern int nfs_setattr(struct dentry *, struct iattr *);
 extern void nfs_setattr_update_inode(struct inode *inode, struct iattr *attr);
 extern void nfs_begin_attr_update(struct inode *);
diff --git a/trunk/include/linux/sunrpc/sched.h b/trunk/include/linux/sunrpc/sched.h
index 8b6ce60ea057..97c761652581 100644
--- a/trunk/include/linux/sunrpc/sched.h
+++ b/trunk/include/linux/sunrpc/sched.h
@@ -250,6 +250,7 @@ void		rpc_init_task(struct rpc_task *task, struct rpc_clnt *clnt,
 				int flags, const struct rpc_call_ops *ops,
 				void *data);
 void		rpc_put_task(struct rpc_task *);
+void		rpc_release_task(struct rpc_task *);
 void		rpc_exit_task(struct rpc_task *);
 void		rpc_release_calldata(const struct rpc_call_ops *, void *);
 void		rpc_killall_tasks(struct rpc_clnt *);
diff --git a/trunk/include/net/netfilter/nf_conntrack_compat.h b/trunk/include/net/netfilter/nf_conntrack_compat.h
index 6f84c1f7fcd4..b9ce5c80d9d5 100644
--- a/trunk/include/net/netfilter/nf_conntrack_compat.h
+++ b/trunk/include/net/netfilter/nf_conntrack_compat.h
@@ -6,7 +6,6 @@
 #if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
 
 #include <linux/netfilter_ipv4/ip_conntrack.h>
-#include <linux/socket.h>
 
 #ifdef CONFIG_IP_NF_CONNTRACK_MARK
 static inline u_int32_t *nf_ct_get_mark(const struct sk_buff *skb,
diff --git a/trunk/include/net/sctp/sm.h b/trunk/include/net/sctp/sm.h
index 73cb9943c8a8..3269ed1cc222 100644
--- a/trunk/include/net/sctp/sm.h
+++ b/trunk/include/net/sctp/sm.h
@@ -134,7 +134,6 @@ sctp_state_fn_t sctp_sf_violation;
 sctp_state_fn_t sctp_sf_discard_chunk;
 sctp_state_fn_t sctp_sf_do_5_2_1_siminit;
 sctp_state_fn_t sctp_sf_do_5_2_2_dupinit;
-sctp_state_fn_t sctp_sf_do_5_2_3_initack;
 sctp_state_fn_t sctp_sf_do_5_2_4_dupcook;
 sctp_state_fn_t sctp_sf_unk_chunk;
 sctp_state_fn_t sctp_sf_do_8_5_1_E_sa;
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
index f8c25d500155..29a8fa4d3728 100644
--- a/trunk/net/bluetooth/l2cap.c
+++ b/trunk/net/bluetooth/l2cap.c
@@ -585,12 +585,6 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_
 		goto done;
 	}
 
-	if (la->l2_psm > 0 && btohs(la->l2_psm) < 0x1001 &&
-				!capable(CAP_NET_BIND_SERVICE)) {
-		err = -EACCES;
-		goto done;
-	}
-		
 	write_lock_bh(&l2cap_sk_list.lock);
 
 	if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
@@ -2156,8 +2150,8 @@ static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
 
 		str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
 				batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-				sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
-				pi->imtu, pi->omtu, pi->link_mode);
+				sk->sk_state, pi->psm, pi->scid, pi->dcid, pi->imtu,
+				pi->omtu, pi->link_mode);
 	}
 
 	read_unlock_bh(&l2cap_sk_list.lock);
diff --git a/trunk/net/core/flow.c b/trunk/net/core/flow.c
index 5d25697920b1..d137f971f97d 100644
--- a/trunk/net/core/flow.c
+++ b/trunk/net/core/flow.c
@@ -231,16 +231,22 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
 
 		err = resolver(key, family, dir, &obj, &obj_ref);
 
-		if (fle && !err) {
-			fle->genid = atomic_read(&flow_cache_genid);
-
-			if (fle->object)
-				atomic_dec(fle->object_ref);
-
-			fle->object = obj;
-			fle->object_ref = obj_ref;
-			if (obj)
-				atomic_inc(fle->object_ref);
+		if (fle) {
+			if (err) {
+				/* Force security policy check on next lookup */
+				*head = fle->next;
+				flow_entry_kill(cpu, fle);
+			} else {
+				fle->genid = atomic_read(&flow_cache_genid);
+
+				if (fle->object)
+					atomic_dec(fle->object_ref);
+
+				fle->object = obj;
+				fle->object_ref = obj_ref;
+				if (obj)
+					atomic_inc(fle->object_ref);
+			}
 		}
 		local_bh_enable();
 
diff --git a/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c b/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c
index 6f31fad9be13..5fcf91d617cd 100644
--- a/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/trunk/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -959,7 +959,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
 	if (cda[CTA_PROTOINFO-1]) {
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
-			goto err;
+			return err;
 	}
 
 #if defined(CONFIG_IP_NF_CONNTRACK_MARK)
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index 5c16e24a6061..c701f6abbfc1 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -4420,11 +4420,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 			 * But, this leaves one open to an easy denial of
 		 	 * service attack, and SYN cookies can't defend
 			 * against this problem. So, we drop the data
-			 * in the interest of security over speed unless
-			 * it's still in use.
+			 * in the interest of security over speed.
 			 */
-			kfree_skb(skb);
-			return 0;
+			goto discard;
 		}
 		goto discard;
 
diff --git a/trunk/net/ipv4/tcp_output.c b/trunk/net/ipv4/tcp_output.c
index 23e32c806916..32c1a972fa31 100644
--- a/trunk/net/ipv4/tcp_output.c
+++ b/trunk/net/ipv4/tcp_output.c
@@ -1650,8 +1650,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *skb, int m
 
 		memcpy(skb_put(skb, next_skb_size), next_skb->data, next_skb_size);
 
-		if (next_skb->ip_summed == CHECKSUM_PARTIAL)
-			skb->ip_summed = CHECKSUM_PARTIAL;
+		skb->ip_summed = next_skb->ip_summed;
 
 		if (skb->ip_summed != CHECKSUM_PARTIAL)
 			skb->csum = csum_block_add(skb->csum, next_skb->csum, skb_size);
diff --git a/trunk/net/ipv6/addrconf.c b/trunk/net/ipv6/addrconf.c
index 2a7e4618f526..171e5b55d7d6 100644
--- a/trunk/net/ipv6/addrconf.c
+++ b/trunk/net/ipv6/addrconf.c
@@ -341,7 +341,6 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
 static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 {
 	struct inet6_dev *ndev;
-	struct in6_addr maddr;
 
 	ASSERT_RTNL();
 
@@ -426,11 +425,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 #endif
 	/* protected by rtnl_lock */
 	rcu_assign_pointer(dev->ip6_ptr, ndev);
-
-	/* Join all-node multicast group */
-	ipv6_addr_all_nodes(&maddr);
-	ipv6_dev_mc_inc(dev, &maddr);
-
 	return ndev;
 }
 
diff --git a/trunk/net/ipv6/mcast.c b/trunk/net/ipv6/mcast.c
index 882cde4b4047..a1c231a04ac2 100644
--- a/trunk/net/ipv6/mcast.c
+++ b/trunk/net/ipv6/mcast.c
@@ -2258,6 +2258,8 @@ void ipv6_mc_up(struct inet6_dev *idev)
 
 void ipv6_mc_init_dev(struct inet6_dev *idev)
 {
+	struct in6_addr maddr;
+
 	write_lock_bh(&idev->lock);
 	rwlock_init(&idev->mc_lock);
 	idev->mc_gq_running = 0;
@@ -2273,6 +2275,10 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
 	idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
 	idev->mc_v1_seen = 0;
 	write_unlock_bh(&idev->lock);
+
+	/* Add all-nodes address. */
+	ipv6_addr_all_nodes(&maddr);
+	ipv6_dev_mc_inc(idev->dev, &maddr);
 }
 
 /*
diff --git a/trunk/net/ipv6/route.c b/trunk/net/ipv6/route.c
index 5f0043c30b70..8c3d56871b50 100644
--- a/trunk/net/ipv6/route.c
+++ b/trunk/net/ipv6/route.c
@@ -2017,7 +2017,6 @@ static inline size_t rt6_nlmsg_size(void)
 	       + nla_total_size(4) /* RTA_IIF */
 	       + nla_total_size(4) /* RTA_OIF */
 	       + nla_total_size(4) /* RTA_PRIORITY */
-	       + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
 	       + nla_total_size(sizeof(struct rta_cacheinfo));
 }
 
diff --git a/trunk/net/netfilter/nf_conntrack_netlink.c b/trunk/net/netfilter/nf_conntrack_netlink.c
index 811e3e782f0f..bd1d2de75e45 100644
--- a/trunk/net/netfilter/nf_conntrack_netlink.c
+++ b/trunk/net/netfilter/nf_conntrack_netlink.c
@@ -981,7 +981,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
 	if (cda[CTA_PROTOINFO-1]) {
 		err = ctnetlink_change_protoinfo(ct, cda);
 		if (err < 0)
-			goto err;
+			return err;
 	}
 
 #if defined(CONFIG_NF_CONNTRACK_MARK)
diff --git a/trunk/net/sctp/sm_make_chunk.c b/trunk/net/sctp/sm_make_chunk.c
index 0b1ddb1005ac..167d888d1df2 100644
--- a/trunk/net/sctp/sm_make_chunk.c
+++ b/trunk/net/sctp/sm_make_chunk.c
@@ -1562,7 +1562,7 @@ static int sctp_process_missing_param(const struct sctp_association *asoc,
 	if (*errp) {
 		report.num_missing = htonl(1);
 		report.type = paramtype;
-		sctp_init_cause(*errp, SCTP_ERROR_MISS_PARAM,
+		sctp_init_cause(*errp, SCTP_ERROR_INV_PARAM,
 				&report, sizeof(report));
 	}
 
@@ -1775,9 +1775,7 @@ int sctp_verify_init(const struct sctp_association *asoc,
 
 	/* Verify stream values are non-zero. */
 	if ((0 == peer_init->init_hdr.num_outbound_streams) ||
-	    (0 == peer_init->init_hdr.num_inbound_streams) ||
-	    (0 == peer_init->init_hdr.init_tag) ||
-	    (SCTP_DEFAULT_MINWINDOW > ntohl(peer_init->init_hdr.a_rwnd))) {
+	    (0 == peer_init->init_hdr.num_inbound_streams)) {
 
 		sctp_process_inv_mandatory(asoc, chunk, errp);
 		return 0;
diff --git a/trunk/net/sctp/sm_sideeffect.c b/trunk/net/sctp/sm_sideeffect.c
index 8bd30976cdee..7bbc6156e455 100644
--- a/trunk/net/sctp/sm_sideeffect.c
+++ b/trunk/net/sctp/sm_sideeffect.c
@@ -217,7 +217,7 @@ static int sctp_gen_sack(struct sctp_association *asoc, int force,
 
 		asoc->peer.sack_needed = 0;
 
-		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(sack));
+		error = sctp_outq_tail(&asoc->outqueue, sack);
 
 		/* Stop the SACK timer.  */
 		sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
diff --git a/trunk/net/sctp/sm_statefuns.c b/trunk/net/sctp/sm_statefuns.c
index fbbc9e6a3b78..aa51d190bfb2 100644
--- a/trunk/net/sctp/sm_statefuns.c
+++ b/trunk/net/sctp/sm_statefuns.c
@@ -440,6 +440,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 {
 	struct sctp_chunk *chunk = arg;
 	sctp_init_chunk_t *initchunk;
+	__u32 init_tag;
 	struct sctp_chunk *err_chunk;
 	struct sctp_packet *packet;
 	sctp_error_t error;
@@ -461,6 +462,24 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 	/* Grab the INIT header.  */
 	chunk->subh.init_hdr = (sctp_inithdr_t *) chunk->skb->data;
 
+	init_tag = ntohl(chunk->subh.init_hdr->init_tag);
+
+	/* Verification Tag: 3.3.3
+	 *   If the value of the Initiate Tag in a received INIT ACK
+	 *   chunk is found to be 0, the receiver MUST treat it as an
+	 *   error and close the association by transmitting an ABORT.
+	 */
+	if (!init_tag) {
+		struct sctp_chunk *reply = sctp_make_abort(asoc, chunk, 0);
+		if (!reply)
+			goto nomem;
+
+		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
+		return sctp_stop_t1_and_abort(commands, SCTP_ERROR_INV_PARAM,
+					      ECONNREFUSED, asoc,
+					      chunk->transport);
+	}
+
 	/* Verify the INIT chunk before processing it. */
 	err_chunk = NULL;
 	if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
@@ -531,6 +550,9 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(const struct sctp_endpoint *ep,
 			SCTP_CHUNK(err_chunk));
 
 	return SCTP_DISPOSITION_CONSUME;
+
+nomem:
+	return SCTP_DISPOSITION_NOMEM;
 }
 
 /*
@@ -1531,28 +1553,6 @@ sctp_disposition_t sctp_sf_do_5_2_2_dupinit(const struct sctp_endpoint *ep,
 }
 
 
-/*
- * Unexpected INIT-ACK handler.
- *
- * Section 5.2.3
- * If an INIT ACK received by an endpoint in any state other than the
- * COOKIE-WAIT state, the endpoint should discard the INIT ACK chunk.
- * An unexpected INIT ACK usually indicates the processing of an old or
- * duplicated INIT chunk.
-*/
-sctp_disposition_t sctp_sf_do_5_2_3_initack(const struct sctp_endpoint *ep,
-					    const struct sctp_association *asoc,
-					    const sctp_subtype_t type,
-					    void *arg, sctp_cmd_seq_t *commands)
-{
-	/* Per the above section, we'll discard the chunk if we have an
-	 * endpoint.  If this is an OOTB INIT-ACK, treat it as such.
-	 */
-        if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
-		return sctp_sf_ootb(ep, asoc, type, arg, commands);
-	else
-		return sctp_sf_discard_chunk(ep, asoc, type, arg, commands);
-}
 
 /* Unexpected COOKIE-ECHO handler for peer restart (Table 2, action 'A')
  *
diff --git a/trunk/net/sctp/sm_statetable.c b/trunk/net/sctp/sm_statetable.c
index 5f6cc7aa661b..733dd87b3a7d 100644
--- a/trunk/net/sctp/sm_statetable.c
+++ b/trunk/net/sctp/sm_statetable.c
@@ -152,7 +152,7 @@ const sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 	/* SCTP_STATE_EMPTY */ \
 	TYPE_SCTP_FUNC(sctp_sf_ootb), \
 	/* SCTP_STATE_CLOSED */ \
-	TYPE_SCTP_FUNC(sctp_sf_do_5_2_3_initack), \
+	TYPE_SCTP_FUNC(sctp_sf_discard_chunk), \
 	/* SCTP_STATE_COOKIE_WAIT */ \
 	TYPE_SCTP_FUNC(sctp_sf_do_5_1C_ack), \
 	/* SCTP_STATE_COOKIE_ECHOED */ \
diff --git a/trunk/net/sunrpc/clnt.c b/trunk/net/sunrpc/clnt.c
index 16c9fbc1db69..aba528b9ae76 100644
--- a/trunk/net/sunrpc/clnt.c
+++ b/trunk/net/sunrpc/clnt.c
@@ -490,14 +490,16 @@ int rpc_call_sync(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 
 	/* Set up the call info struct and execute the task */
 	status = task->tk_status;
-	if (status != 0)
+	if (status != 0) {
+		rpc_release_task(task);
 		goto out;
+	}
 	atomic_inc(&task->tk_count);
 	status = rpc_execute(task);
 	if (status == 0)
 		status = task->tk_status;
-out:
 	rpc_put_task(task);
+out:
 	rpc_restore_sigmask(&oldset);
 	return status;
 }
@@ -535,7 +537,7 @@ rpc_call_async(struct rpc_clnt *clnt, struct rpc_message *msg, int flags,
 	if (status == 0)
 		rpc_execute(task);
 	else
-		rpc_put_task(task);
+		rpc_release_task(task);
 
 	rpc_restore_sigmask(&oldset);		
 	return status;
diff --git a/trunk/net/sunrpc/sched.c b/trunk/net/sunrpc/sched.c
index fc083f0b3544..79bc4cdf5d48 100644
--- a/trunk/net/sunrpc/sched.c
+++ b/trunk/net/sunrpc/sched.c
@@ -42,7 +42,6 @@ static mempool_t	*rpc_buffer_mempool __read_mostly;
 static void			__rpc_default_timer(struct rpc_task *task);
 static void			rpciod_killall(void);
 static void			rpc_async_schedule(struct work_struct *);
-static void			 rpc_release_task(struct rpc_task *task);
 
 /*
  * RPC tasks sit here while waiting for conditions to improve.
@@ -897,7 +896,7 @@ void rpc_put_task(struct rpc_task *task)
 }
 EXPORT_SYMBOL(rpc_put_task);
 
-static void rpc_release_task(struct rpc_task *task)
+void rpc_release_task(struct rpc_task *task)
 {
 #ifdef RPC_DEBUG
 	BUG_ON(task->tk_magic != RPC_TASK_MAGIC_ID);
diff --git a/trunk/net/x25/x25_dev.c b/trunk/net/x25/x25_dev.c
index 328d80f000ad..47b68a301677 100644
--- a/trunk/net/x25/x25_dev.c
+++ b/trunk/net/x25/x25_dev.c
@@ -56,7 +56,6 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
 			sk_add_backlog(sk, skb);
 		}
 		bh_unlock_sock(sk);
-		sock_put(sk);
 		return queued;
 	}
 
diff --git a/trunk/net/xfrm/xfrm_policy.c b/trunk/net/xfrm/xfrm_policy.c
index b7e537fe2d75..bebd40e5a62e 100644
--- a/trunk/net/xfrm/xfrm_policy.c
+++ b/trunk/net/xfrm/xfrm_policy.c
@@ -650,18 +650,19 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 	struct xfrm_policy *pol;
 	struct xfrm_policy *delpol;
 	struct hlist_head *chain;
-	struct hlist_node *entry, *newpos;
+	struct hlist_node *entry, *newpos, *last;
 	struct dst_entry *gc_list;
 
 	write_lock_bh(&xfrm_policy_lock);
 	chain = policy_hash_bysel(&policy->selector, policy->family, dir);
 	delpol = NULL;
 	newpos = NULL;
+	last = NULL;
 	hlist_for_each_entry(pol, entry, chain, bydst) {
-		if (pol->type == policy->type &&
+		if (!delpol &&
+		    pol->type == policy->type &&
 		    !selector_cmp(&pol->selector, &policy->selector) &&
-		    xfrm_sec_ctx_match(pol->security, policy->security) &&
-		    !WARN_ON(delpol)) {
+		    xfrm_sec_ctx_match(pol->security, policy->security)) {
 			if (excl) {
 				write_unlock_bh(&xfrm_policy_lock);
 				return -EEXIST;
@@ -670,12 +671,17 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 			if (policy->priority > pol->priority)
 				continue;
 		} else if (policy->priority >= pol->priority) {
-			newpos = &pol->bydst;
+			last = &pol->bydst;
 			continue;
 		}
+		if (!newpos)
+			newpos = &pol->bydst;
 		if (delpol)
 			break;
+		last = &pol->bydst;
 	}
+	if (!newpos)
+		newpos = last;
 	if (newpos)
 		hlist_add_after(newpos, &policy->bydst);
 	else
diff --git a/trunk/security/selinux/ss/services.c b/trunk/security/selinux/ss/services.c
index ff0393317f39..3eb1fa9f0de1 100644
--- a/trunk/security/selinux/ss/services.c
+++ b/trunk/security/selinux/ss/services.c
@@ -1299,7 +1299,6 @@ int security_load_policy(void *data, size_t len)
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
 		selinux_netlbl_cache_invalidate();
-		atomic_inc(&flow_cache_genid);
 		return 0;
 	}
 
@@ -1355,7 +1354,6 @@ int security_load_policy(void *data, size_t len)
 	avc_ss_reset(seqno);
 	selnl_notify_policyload(seqno);
 	selinux_netlbl_cache_invalidate();
-	atomic_inc(&flow_cache_genid);
 
 	return 0;
 
@@ -1855,7 +1853,6 @@ int security_set_bools(int len, int *values)
 	if (!rc) {
 		avc_ss_reset(seqno);
 		selnl_notify_policyload(seqno);
-		atomic_inc(&flow_cache_genid);
 	}
 	return rc;
 }