diff --git a/[refs] b/[refs]
index 636c7ea771a6..1a8b120d3cd2 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a0d97d6c7ceddc176b5eed171aa2a52e32cf3eda
+refs/heads/master: eb1cf0f8f7a9e5a6d573d5bd72c015686a042db0
diff --git a/trunk/drivers/atm/he.c b/trunk/drivers/atm/he.c
index 29e66d603d3c..70667033a568 100644
--- a/trunk/drivers/atm/he.c
+++ b/trunk/drivers/atm/he.c
@@ -921,9 +921,9 @@ he_init_group(struct he_dev *he_dev, int group)
 			he_dev->rbrq_phys);
 	i = CONFIG_RBPL_SIZE;
 out_free_rbpl_virt:
-	while (--i)
-		pci_pool_free(he_dev->rbps_pool, he_dev->rbpl_virt[i].virt,
-				he_dev->rbps_base[i].phys);
+	while (i--)
+		pci_pool_free(he_dev->rbpl_pool, he_dev->rbpl_virt[i].virt,
+				he_dev->rbpl_base[i].phys);
 	kfree(he_dev->rbpl_virt);
 
 out_free_rbpl_base:
@@ -933,11 +933,11 @@ he_init_group(struct he_dev *he_dev, int group)
 out_destroy_rbpl_pool:
 	pci_pool_destroy(he_dev->rbpl_pool);
 
-	i = CONFIG_RBPL_SIZE;
+	i = CONFIG_RBPS_SIZE;
 out_free_rbps_virt:
-	while (--i)
-		pci_pool_free(he_dev->rbpl_pool, he_dev->rbps_virt[i].virt,
-				he_dev->rbpl_base[i].phys);
+	while (i--)
+		pci_pool_free(he_dev->rbps_pool, he_dev->rbps_virt[i].virt,
+				he_dev->rbps_base[i].phys);
 	kfree(he_dev->rbps_virt);
 
 out_free_rbps_base:
diff --git a/trunk/drivers/isdn/hardware/mISDN/Kconfig b/trunk/drivers/isdn/hardware/mISDN/Kconfig
index bde55d7287fa..eadc1cd34a20 100644
--- a/trunk/drivers/isdn/hardware/mISDN/Kconfig
+++ b/trunk/drivers/isdn/hardware/mISDN/Kconfig
@@ -78,6 +78,7 @@ config MISDN_NETJET
 	depends on PCI
 	select MISDN_IPAC
 	select ISDN_HDLC
+	select ISDN_I4L
 	help
 	  Enable support for Traverse Technologies NETJet PCI cards.
 
diff --git a/trunk/drivers/isdn/i4l/Kconfig b/trunk/drivers/isdn/i4l/Kconfig
index dd744ffd240b..07c4e49f9e77 100644
--- a/trunk/drivers/isdn/i4l/Kconfig
+++ b/trunk/drivers/isdn/i4l/Kconfig
@@ -141,8 +141,7 @@ endmenu
 endif
 
 config ISDN_HDLC
-	tristate 
-	depends on HISAX_ST5481
+	tristate
 	select CRC_CCITT
 	select BITREVERSE
 
diff --git a/trunk/net/ax25/af_ax25.c b/trunk/net/ax25/af_ax25.c
index fbcac76fdc0d..4102de1022ee 100644
--- a/trunk/net/ax25/af_ax25.c
+++ b/trunk/net/ax25/af_ax25.c
@@ -641,15 +641,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 
 	case SO_BINDTODEVICE:
 		if (optlen > IFNAMSIZ)
-			optlen=IFNAMSIZ;
-		if (copy_from_user(devname, optval, optlen)) {
-		res = -EFAULT;
-			break;
-		}
+			optlen = IFNAMSIZ;
 
-		dev = dev_get_by_name(&init_net, devname);
-		if (dev == NULL) {
-			res = -ENODEV;
+		if (copy_from_user(devname, optval, optlen)) {
+			res = -EFAULT;
 			break;
 		}
 
@@ -657,12 +652,18 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 		   (sock->state != SS_UNCONNECTED ||
 		    sk->sk_state == TCP_LISTEN)) {
 			res = -EADDRNOTAVAIL;
-			dev_put(dev);
+			break;
+		}
+
+		dev = dev_get_by_name(&init_net, devname);
+		if (!dev) {
+			res = -ENODEV;
 			break;
 		}
 
 		ax25->ax25_dev = ax25_dev_ax25dev(dev);
 		ax25_fillin_cb(ax25, ax25->ax25_dev);
+		dev_put(dev);
 		break;
 
 	default:
diff --git a/trunk/net/bridge/br_if.c b/trunk/net/bridge/br_if.c
index 142ebac14176..b1b3b0fbf41c 100644
--- a/trunk/net/bridge/br_if.c
+++ b/trunk/net/bridge/br_if.c
@@ -432,6 +432,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 	br_fdb_delete_by_port(br, p, 1);
 err1:
 	kobject_put(&p->kobj);
+	p = NULL; /* kobject_put frees */
 err0:
 	dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/trunk/net/socket.c b/trunk/net/socket.c
index 49917a1cac7d..41e8847508aa 100644
--- a/trunk/net/socket.c
+++ b/trunk/net/socket.c
@@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
 	unsigned long a[6];
 	unsigned long a0, a1;
 	int err;
+	unsigned int len;
 
 	if (call < 1 || call > SYS_ACCEPT4)
 		return -EINVAL;
 
+	len = nargs[call];
+	if (len > sizeof(a))
+		return -EINVAL;
+
 	/* copy_from_user should be SMP safe. */
-	if (copy_from_user(a, args, nargs[call]))
+	if (copy_from_user(a, args, len))
 		return -EFAULT;
 
 	audit_socketcall(nargs[call] / sizeof(unsigned long), a);