diff --git a/[refs] b/[refs]
index c465e2f3a982..7fca85602711 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: f290fc3669d659a915e29b6bdb82d454b437cf93
+refs/heads/master: 45c950e0f839fded922ebc0bfd59b1081cc71b70
diff --git a/trunk/arch/arm/Kconfig b/trunk/arch/arm/Kconfig
index a04f507e7f2c..3a75a0b2bebb 100644
--- a/trunk/arch/arm/Kconfig
+++ b/trunk/arch/arm/Kconfig
@@ -1072,8 +1072,6 @@ source "drivers/rtc/Kconfig"
 
 source "drivers/dma/Kconfig"
 
-source "drivers/dca/Kconfig"
-
 endmenu
 
 source "fs/Kconfig"
diff --git a/trunk/arch/arm/mach-omap1/board-fsample.c b/trunk/arch/arm/mach-omap1/board-fsample.c
index d5f6ea14fc7b..f65baa95986e 100644
--- a/trunk/arch/arm/mach-omap1/board-fsample.c
+++ b/trunk/arch/arm/mach-omap1/board-fsample.c
@@ -40,29 +40,31 @@ static int fsample_keymap[] = {
 	KEY(0,1,KEY_RIGHT),
 	KEY(0,2,KEY_LEFT),
 	KEY(0,3,KEY_DOWN),
-	KEY(0,4,KEY_ENTER),
-	KEY(1,0,KEY_F10),
+	KEY(0,4,KEY_CENTER),
+	KEY(0,5,KEY_0_5),
+	KEY(1,0,KEY_SOFT2),
 	KEY(1,1,KEY_SEND),
 	KEY(1,2,KEY_END),
 	KEY(1,3,KEY_VOLUMEDOWN),
 	KEY(1,4,KEY_VOLUMEUP),
 	KEY(1,5,KEY_RECORD),
-	KEY(2,0,KEY_F9),
+	KEY(2,0,KEY_SOFT1),
 	KEY(2,1,KEY_3),
 	KEY(2,2,KEY_6),
 	KEY(2,3,KEY_9),
-	KEY(2,4,KEY_KPDOT),
+	KEY(2,4,KEY_SHARP),
+	KEY(2,5,KEY_2_5),
 	KEY(3,0,KEY_BACK),
 	KEY(3,1,KEY_2),
 	KEY(3,2,KEY_5),
 	KEY(3,3,KEY_8),
 	KEY(3,4,KEY_0),
-	KEY(3,5,KEY_KPSLASH),
+	KEY(3,5,KEY_HEADSETHOOK),
 	KEY(4,0,KEY_HOME),
 	KEY(4,1,KEY_1),
 	KEY(4,2,KEY_4),
 	KEY(4,3,KEY_7),
-	KEY(4,4,KEY_KPASTERISK),
+	KEY(4,4,KEY_STAR),
 	KEY(4,5,KEY_POWER),
 	0
 };
diff --git a/trunk/arch/arm/mach-omap1/board-nokia770.c b/trunk/arch/arm/mach-omap1/board-nokia770.c
index 182a98a9df4c..22db19a53647 100644
--- a/trunk/arch/arm/mach-omap1/board-nokia770.c
+++ b/trunk/arch/arm/mach-omap1/board-nokia770.c
@@ -36,6 +36,8 @@
 #include <asm/arch/omapfb.h>
 #include <asm/arch/lcd_mipid.h>
 
+#include "../plat-omap/dsp/dsp_common.h"
+
 #define ADS7846_PENDOWN_GPIO	15
 
 static void __init omap_nokia770_init_irq(void)
@@ -316,8 +318,6 @@ static __init int omap_dsp_init(void)
  out:
 	return ret;
 }
-#else
-#define omap_dsp_init()		do {} while (0)
 #endif	/* CONFIG_OMAP_DSP */
 
 static void __init omap_nokia770_init(void)
diff --git a/trunk/arch/arm/mach-omap1/board-perseus2.c b/trunk/arch/arm/mach-omap1/board-perseus2.c
index e44437e10eef..1d5c8d509722 100644
--- a/trunk/arch/arm/mach-omap1/board-perseus2.c
+++ b/trunk/arch/arm/mach-omap1/board-perseus2.c
@@ -39,29 +39,31 @@ static int p2_keymap[] = {
 	KEY(0,1,KEY_RIGHT),
 	KEY(0,2,KEY_LEFT),
 	KEY(0,3,KEY_DOWN),
-	KEY(0,4,KEY_ENTER),
-	KEY(1,0,KEY_F10),
+	KEY(0,4,KEY_CENTER),
+	KEY(0,5,KEY_0_5),
+	KEY(1,0,KEY_SOFT2),
 	KEY(1,1,KEY_SEND),
 	KEY(1,2,KEY_END),
 	KEY(1,3,KEY_VOLUMEDOWN),
 	KEY(1,4,KEY_VOLUMEUP),
 	KEY(1,5,KEY_RECORD),
-	KEY(2,0,KEY_F9),
+	KEY(2,0,KEY_SOFT1),
 	KEY(2,1,KEY_3),
 	KEY(2,2,KEY_6),
 	KEY(2,3,KEY_9),
-	KEY(2,4,KEY_KPDOT),
+	KEY(2,4,KEY_SHARP),
+	KEY(2,5,KEY_2_5),
 	KEY(3,0,KEY_BACK),
 	KEY(3,1,KEY_2),
 	KEY(3,2,KEY_5),
 	KEY(3,3,KEY_8),
 	KEY(3,4,KEY_0),
-	KEY(3,5,KEY_KPSLASH),
+	KEY(3,5,KEY_HEADSETHOOK),
 	KEY(4,0,KEY_HOME),
 	KEY(4,1,KEY_1),
 	KEY(4,2,KEY_4),
 	KEY(4,3,KEY_7),
-	KEY(4,4,KEY_KPASTERISK),
+	KEY(4,4,KEY_STAR),
 	KEY(4,5,KEY_POWER),
 	0
 };
diff --git a/trunk/arch/arm/mach-pxa/sleep.S b/trunk/arch/arm/mach-pxa/sleep.S
index d0447723b73a..aff71fec618a 100644
--- a/trunk/arch/arm/mach-pxa/sleep.S
+++ b/trunk/arch/arm/mach-pxa/sleep.S
@@ -43,11 +43,11 @@ pxa_cpu_save_cp:
 pxa_cpu_save_sp:
 	@ preserve phys address of stack
 	mov	r0, sp
-	str	lr, [sp, #-4]!
+	mov	r2, lr
 	bl	sleep_phys_sp
 	ldr	r1, =sleep_save_sp
 	str	r0, [r1]
-	ldr	pc, [sp], #4
+	mov	pc, r2
 
 /*
  * pxa27x_cpu_suspend()
@@ -270,3 +270,5 @@ resume_after_mmu:
 	mar	acc0, r2, r3
 #endif
 	ldmfd	sp!, {r4 - r12, pc}		@ return to caller
+
+
diff --git a/trunk/arch/cris/arch-v10/kernel/io_interface_mux.c b/trunk/arch/cris/arch-v10/kernel/io_interface_mux.c
index f3b327d4ed9c..3a9114e89edf 100644
--- a/trunk/arch/cris/arch-v10/kernel/io_interface_mux.c
+++ b/trunk/arch/cris/arch-v10/kernel/io_interface_mux.c
@@ -392,7 +392,6 @@ int cris_request_io_interface(enum cris_io_interface ioif, const char *device_id
 	if (((interfaces[ioif].gpio_g_in & gpio_in_pins) != interfaces[ioif].gpio_g_in) ||
 	    ((interfaces[ioif].gpio_g_out & gpio_out_pins) != interfaces[ioif].gpio_g_out) ||
 	    ((interfaces[ioif].gpio_b & gpio_pb_pins) != interfaces[ioif].gpio_b)) {
-		local_irq_restore(flags);
 		printk(KERN_CRIT "cris_request_io_interface: Could not get required pins for interface %u\n",
 		       ioif);
 		return -EBUSY;
diff --git a/trunk/arch/mips/mips-boards/malta/malta_setup.c b/trunk/arch/mips/mips-boards/malta/malta_setup.c
index bc43a5c2224d..9a2636e56243 100644
--- a/trunk/arch/mips/mips-boards/malta/malta_setup.c
+++ b/trunk/arch/mips/mips-boards/malta/malta_setup.c
@@ -149,7 +149,7 @@ void __init plat_mem_setup(void)
 	/* Check PCI clock */
 	{
 		unsigned int __iomem *jmpr_p = (unsigned int *) ioremap(MALTA_JMPRS_REG, sizeof(unsigned int));
-		int jmpr = (__raw_readl(jmpr_p) >> 2) & 0x07;
+		int jmpr = (readw(jmpr_p) >> 2) & 0x07;
 		static const int pciclocks[] __initdata = {
 			33, 20, 25, 30, 12, 16, 37, 10
 		};
diff --git a/trunk/arch/mips/tx4938/toshiba_rbtx4938/setup.c b/trunk/arch/mips/tx4938/toshiba_rbtx4938/setup.c
index 632e5d201353..4a8152375efe 100644
--- a/trunk/arch/mips/tx4938/toshiba_rbtx4938/setup.c
+++ b/trunk/arch/mips/tx4938/toshiba_rbtx4938/setup.c
@@ -598,8 +598,8 @@ static int __init rbtx4938_ethaddr_init(void)
 			printk(KERN_WARNING "seeprom: bad checksum.\n");
 	}
 	for (i = 0; i < 2; i++) {
-		unsigned int id =
-			TXX9_IRQ_BASE + (i ? TX4938_IR_ETH1 : TX4938_IR_ETH0);
+		unsigned int slot = TX4938_PCIC_IDSEL_AD_TO_SLOT(31 - i);
+		unsigned int id = (1 << 8) | PCI_DEVFN(slot, 0); /* bus 1 */
 		struct platform_device *pdev;
 		if (!(tx4938_ccfgptr->pcfg &
 		      (i ? TX4938_PCFG_ETH1_SEL : TX4938_PCFG_ETH0_SEL)))
diff --git a/trunk/drivers/atm/idt77105.c b/trunk/drivers/atm/idt77105.c
index 84672dc57f7a..0bd657f5dd2a 100644
--- a/trunk/drivers/atm/idt77105.c
+++ b/trunk/drivers/atm/idt77105.c
@@ -357,7 +357,7 @@ static const struct atmphy_ops idt77105_ops = {
 };
 
 
-int idt77105_init(struct atm_dev *dev)
+int __devinit idt77105_init(struct atm_dev *dev)
 {
 	dev->phy = &idt77105_ops;
 	return 0;
diff --git a/trunk/drivers/atm/suni.c b/trunk/drivers/atm/suni.c
index b1d063cc4fbe..f04f39c00833 100644
--- a/trunk/drivers/atm/suni.c
+++ b/trunk/drivers/atm/suni.c
@@ -289,7 +289,7 @@ static const struct atmphy_ops suni_ops = {
 };
 
 
-int suni_init(struct atm_dev *dev)
+int __devinit suni_init(struct atm_dev *dev)
 {
 	unsigned char mri;
 
diff --git a/trunk/drivers/net/e1000/e1000_main.c b/trunk/drivers/net/e1000/e1000_main.c
index 76c0fa690cc6..0c9a6f7104d2 100644
--- a/trunk/drivers/net/e1000/e1000_main.c
+++ b/trunk/drivers/net/e1000/e1000_main.c
@@ -632,7 +632,6 @@ e1000_down(struct e1000_adapter *adapter)
 
 #ifdef CONFIG_E1000_NAPI
 	napi_disable(&adapter->napi);
-	atomic_set(&adapter->irq_sem, 0);
 #endif
 	e1000_irq_disable(adapter);
 
diff --git a/trunk/drivers/net/e1000e/netdev.c b/trunk/drivers/net/e1000e/netdev.c
index 9cc5a6b01bc1..2ab3bfbb8a63 100644
--- a/trunk/drivers/net/e1000e/netdev.c
+++ b/trunk/drivers/net/e1000e/netdev.c
@@ -2183,7 +2183,6 @@ void e1000e_down(struct e1000_adapter *adapter)
 	msleep(10);
 
 	napi_disable(&adapter->napi);
-	atomic_set(&adapter->irq_sem, 0);
 	e1000_irq_disable(adapter);
 
 	del_timer_sync(&adapter->watchdog_timer);
diff --git a/trunk/drivers/net/ixgb/ixgb_main.c b/trunk/drivers/net/ixgb/ixgb_main.c
index 4f63839051b0..d2fb88d5cda2 100644
--- a/trunk/drivers/net/ixgb/ixgb_main.c
+++ b/trunk/drivers/net/ixgb/ixgb_main.c
@@ -296,11 +296,6 @@ ixgb_down(struct ixgb_adapter *adapter, boolean_t kill_watchdog)
 {
 	struct net_device *netdev = adapter->netdev;
 
-#ifdef CONFIG_IXGB_NAPI
-	napi_disable(&adapter->napi);
-	atomic_set(&adapter->irq_sem, 0);
-#endif
-
 	ixgb_irq_disable(adapter);
 	free_irq(adapter->pdev->irq, netdev);
 
@@ -309,7 +304,9 @@ ixgb_down(struct ixgb_adapter *adapter, boolean_t kill_watchdog)
 
 	if(kill_watchdog)
 		del_timer_sync(&adapter->watchdog_timer);
-
+#ifdef CONFIG_IXGB_NAPI
+	napi_disable(&adapter->napi);
+#endif
 	adapter->link_speed = 0;
 	adapter->link_duplex = 0;
 	netif_carrier_off(netdev);
diff --git a/trunk/drivers/net/ixgbe/ixgbe_main.c b/trunk/drivers/net/ixgbe/ixgbe_main.c
index a4265bc1cebb..de3f45e4c5ae 100644
--- a/trunk/drivers/net/ixgbe/ixgbe_main.c
+++ b/trunk/drivers/net/ixgbe/ixgbe_main.c
@@ -1409,11 +1409,9 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
 	IXGBE_WRITE_FLUSH(&adapter->hw);
 	msleep(10);
 
-	napi_disable(&adapter->napi);
-	atomic_set(&adapter->irq_sem, 0);
-
 	ixgbe_irq_disable(adapter);
 
+	napi_disable(&adapter->napi);
 	del_timer_sync(&adapter->watchdog_timer);
 
 	netif_carrier_off(netdev);
diff --git a/trunk/drivers/net/tc35815.c b/trunk/drivers/net/tc35815.c
index 370d329d15d9..d887c05588d5 100644
--- a/trunk/drivers/net/tc35815.c
+++ b/trunk/drivers/net/tc35815.c
@@ -611,7 +611,7 @@ static int __devinit tc35815_mac_match(struct device *dev, void *data)
 {
 	struct platform_device *plat_dev = to_platform_device(dev);
 	struct pci_dev *pci_dev = data;
-	unsigned int id = pci_dev->irq;
+	unsigned int id = (pci_dev->bus->number << 8) | pci_dev->devfn;
 	return !strcmp(plat_dev->name, "tc35815-mac") && plat_dev->id == id;
 }
 
diff --git a/trunk/drivers/net/veth.c b/trunk/drivers/net/veth.c
index 3f67a29593bc..43af9e9b2652 100644
--- a/trunk/drivers/net/veth.c
+++ b/trunk/drivers/net/veth.c
@@ -459,7 +459,19 @@ static __init int veth_init(void)
 
 static __exit void veth_exit(void)
 {
-	rtnl_link_unregister(&veth_link_ops);
+	struct veth_priv *priv, *next;
+
+	rtnl_lock();
+	/*
+	 * cannot trust __rtnl_link_unregister() to unregister all
+	 * devices, as each ->dellink call will remove two devices
+	 * from the list at once.
+	 */
+	list_for_each_entry_safe(priv, next, &veth_list, list)
+		veth_dellink(priv->dev);
+
+	__rtnl_link_unregister(&veth_link_ops);
+	rtnl_unlock();
 }
 
 module_init(veth_init);
diff --git a/trunk/drivers/usb/serial/keyspan.c b/trunk/drivers/usb/serial/keyspan.c
index 7c069a02c1dd..feba9679ace8 100644
--- a/trunk/drivers/usb/serial/keyspan.c
+++ b/trunk/drivers/usb/serial/keyspan.c
@@ -447,7 +447,7 @@ static void	usa26_indat_callback(struct urb *urb)
 
 	port = (struct usb_serial_port *) urb->context;
 	tty = port->tty;
-	if (tty && urb->actual_length) {
+	if (urb->actual_length) {
 		/* 0x80 bit is error flag */
 		if ((data[0] & 0x80) == 0) {
 			/* no errors on individual bytes, only possible overrun err*/
diff --git a/trunk/drivers/video/s3c2410fb.c b/trunk/drivers/video/s3c2410fb.c
index b3c31d9dc591..ad35033f1a48 100644
--- a/trunk/drivers/video/s3c2410fb.c
+++ b/trunk/drivers/video/s3c2410fb.c
@@ -488,7 +488,7 @@ static int s3c2410fb_set_par(struct fb_info *info)
 		break;
 	}
 
-	info->fix.line_length = (var->xres_virtual * var->bits_per_pixel) / 8;
+	info->fix.line_length = (var->width * var->bits_per_pixel) / 8;
 
 	/* activate this new configuration */
 
diff --git a/trunk/include/asm-mips/smtc_ipi.h b/trunk/include/asm-mips/smtc_ipi.h
index 8ce517574340..e09131a6127d 100644
--- a/trunk/include/asm-mips/smtc_ipi.h
+++ b/trunk/include/asm-mips/smtc_ipi.h
@@ -49,7 +49,7 @@ struct smtc_ipi_q {
 
 static inline void smtc_ipi_nq(struct smtc_ipi_q *q, struct smtc_ipi *p)
 {
-	unsigned long flags;
+	long flags;
 
 	spin_lock_irqsave(&q->lock, flags);
 	if (q->head == NULL)
@@ -98,7 +98,7 @@ static inline struct smtc_ipi *smtc_ipi_dq(struct smtc_ipi_q *q)
 
 static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p)
 {
-	unsigned long flags;
+	long flags;
 
 	spin_lock_irqsave(&q->lock, flags);
 	if (q->head == NULL) {
@@ -114,7 +114,7 @@ static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p)
 
 static inline int smtc_ipi_qdepth(struct smtc_ipi_q *q)
 {
-	unsigned long flags;
+	long flags;
 	int retval;
 
 	spin_lock_irqsave(&q->lock, flags);
diff --git a/trunk/kernel/hrtimer.c b/trunk/kernel/hrtimer.c
index f994bb8065e6..e65dd0b47cdc 100644
--- a/trunk/kernel/hrtimer.c
+++ b/trunk/kernel/hrtimer.c
@@ -1378,7 +1378,7 @@ sys_nanosleep(struct timespec __user *rqtp, struct timespec __user *rmtp)
 /*
  * Functions related to boot-time initialization:
  */
-static void __cpuinit init_hrtimers_cpu(int cpu)
+static void __devinit init_hrtimers_cpu(int cpu)
 {
 	struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
 	int i;
diff --git a/trunk/kernel/timer.c b/trunk/kernel/timer.c
index 2a00c22203f3..26671f4db07f 100644
--- a/trunk/kernel/timer.c
+++ b/trunk/kernel/timer.c
@@ -1289,7 +1289,7 @@ static void migrate_timer_list(tvec_base_t *new_base, struct list_head *head)
 	}
 }
 
-static void __cpuinit migrate_timers(int cpu)
+static void __devinit migrate_timers(int cpu)
 {
 	tvec_base_t *old_base;
 	tvec_base_t *new_base;
diff --git a/trunk/net/bridge/br_netfilter.c b/trunk/net/bridge/br_netfilter.c
index 9f78a69d6b8b..5d8b939eded1 100644
--- a/trunk/net/bridge/br_netfilter.c
+++ b/trunk/net/bridge/br_netfilter.c
@@ -142,23 +142,6 @@ static inline struct nf_bridge_info *nf_bridge_alloc(struct sk_buff *skb)
 	return skb->nf_bridge;
 }
 
-static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
-{
-	struct nf_bridge_info *nf_bridge = skb->nf_bridge;
-
-	if (atomic_read(&nf_bridge->use) > 1) {
-		struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
-
-		if (tmp) {
-			memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
-			atomic_set(&tmp->use, 1);
-			nf_bridge_put(nf_bridge);
-		}
-		nf_bridge = tmp;
-	}
-	return nf_bridge;
-}
-
 static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
 {
 	unsigned int len = nf_bridge_encap_header_len(skb);
@@ -654,11 +637,6 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
 	if (!skb->nf_bridge)
 		return NF_ACCEPT;
 
-	/* Need exclusive nf_bridge_info since we might have multiple
-	 * different physoutdevs. */
-	if (!nf_bridge_unshare(skb))
-		return NF_DROP;
-
 	parent = bridge_parent(out);
 	if (!parent)
 		return NF_DROP;
@@ -740,11 +718,6 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
 	if (!skb->nf_bridge)
 		return NF_ACCEPT;
 
-	/* Need exclusive nf_bridge_info since we might have multiple
-	 * different physoutdevs. */
-	if (!nf_bridge_unshare(skb))
-		return NF_DROP;
-
 	nf_bridge = skb->nf_bridge;
 	if (!(nf_bridge->mask & BRNF_BRIDGED_DNAT))
 		return NF_ACCEPT;
diff --git a/trunk/net/core/neighbour.c b/trunk/net/core/neighbour.c
index 29b8ee4e35d6..cc8a2f190acf 100644
--- a/trunk/net/core/neighbour.c
+++ b/trunk/net/core/neighbour.c
@@ -1316,8 +1316,6 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
 			*p = parms->next;
 			parms->dead = 1;
 			write_unlock_bh(&tbl->lock);
-			if (parms->dev)
-				dev_put(parms->dev);
 			call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
 			return;
 		}
@@ -1328,6 +1326,8 @@ void neigh_parms_release(struct neigh_table *tbl, struct neigh_parms *parms)
 
 void neigh_parms_destroy(struct neigh_parms *parms)
 {
+	if (parms->dev)
+		dev_put(parms->dev);
 	kfree(parms);
 }
 
diff --git a/trunk/net/core/rtnetlink.c b/trunk/net/core/rtnetlink.c
index fed95a323b28..e1ba26fb4bf2 100644
--- a/trunk/net/core/rtnetlink.c
+++ b/trunk/net/core/rtnetlink.c
@@ -308,12 +308,9 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops)
 	struct net *net;
 
 	for_each_net(net) {
-restart:
 		for_each_netdev_safe(net, dev, n) {
-			if (dev->rtnl_link_ops == ops) {
+			if (dev->rtnl_link_ops == ops)
 				ops->dellink(dev);
-				goto restart;
-			}
 		}
 	}
 	list_del(&ops->list);
diff --git a/trunk/net/ipv4/fib_hash.c b/trunk/net/ipv4/fib_hash.c
index 0dfee27cfbcd..527a6e0af5b6 100644
--- a/trunk/net/ipv4/fib_hash.c
+++ b/trunk/net/ipv4/fib_hash.c
@@ -444,9 +444,6 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
 			struct fib_info *fi_drop;
 			u8 state;
 
-			if (fi->fib_treeref > 1)
-				goto out;
-
 			write_lock_bh(&fib_hash_lock);
 			fi_drop = fa->fa_info;
 			fa->fa_info = fi;
@@ -721,18 +718,19 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
 {
 	int h, s_h;
 
-	if (fz->fz_hash == NULL)
-		return skb->len;
 	s_h = cb->args[3];
-	for (h = s_h; h < fz->fz_divisor; h++) {
-		if (hlist_empty(&fz->fz_hash[h]))
+	for (h=0; h < fz->fz_divisor; h++) {
+		if (h < s_h) continue;
+		if (h > s_h)
+			memset(&cb->args[4], 0,
+			       sizeof(cb->args) - 4*sizeof(cb->args[0]));
+		if (fz->fz_hash == NULL ||
+		    hlist_empty(&fz->fz_hash[h]))
 			continue;
-		if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h]) < 0) {
+		if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h])<0) {
 			cb->args[3] = h;
 			return -1;
 		}
-		memset(&cb->args[4], 0,
-		       sizeof(cb->args) - 4*sizeof(cb->args[0]));
 	}
 	cb->args[3] = h;
 	return skb->len;
@@ -748,13 +746,14 @@ static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlin
 	read_lock(&fib_hash_lock);
 	for (fz = table->fn_zone_list, m=0; fz; fz = fz->fz_next, m++) {
 		if (m < s_m) continue;
+		if (m > s_m)
+			memset(&cb->args[3], 0,
+			       sizeof(cb->args) - 3*sizeof(cb->args[0]));
 		if (fn_hash_dump_zone(skb, cb, tb, fz) < 0) {
 			cb->args[2] = m;
 			read_unlock(&fib_hash_lock);
 			return -1;
 		}
-		memset(&cb->args[3], 0,
-		       sizeof(cb->args) - 3*sizeof(cb->args[0]));
 	}
 	read_unlock(&fib_hash_lock);
 	cb->args[2] = m;
diff --git a/trunk/net/ipv4/fib_trie.c b/trunk/net/ipv4/fib_trie.c
index 1010b469d7d3..8d8c2915e064 100644
--- a/trunk/net/ipv4/fib_trie.c
+++ b/trunk/net/ipv4/fib_trie.c
@@ -1214,9 +1214,6 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
 			struct fib_info *fi_drop;
 			u8 state;
 
-			if (fi->fib_treeref > 1)
-				goto out;
-
 			err = -ENOBUFS;
 			new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
 			if (new_fa == NULL)
diff --git a/trunk/net/ipv4/icmp.c b/trunk/net/ipv4/icmp.c
index 82baea026484..233de0634298 100644
--- a/trunk/net/ipv4/icmp.c
+++ b/trunk/net/ipv4/icmp.c
@@ -540,6 +540,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 	icmp_param.data.icmph.checksum	 = 0;
 	icmp_param.skb	  = skb_in;
 	icmp_param.offset = skb_network_offset(skb_in);
+	icmp_out_count(icmp_param.data.icmph.type);
 	inet_sk(icmp_socket->sk)->tos = tos;
 	ipc.addr = iph->saddr;
 	ipc.opt = &icmp_param.replyopts;
diff --git a/trunk/net/ipv6/icmp.c b/trunk/net/ipv6/icmp.c
index f1240688dc58..9bb031fa1c2f 100644
--- a/trunk/net/ipv6/icmp.c
+++ b/trunk/net/ipv6/icmp.c
@@ -458,6 +458,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 	}
 	err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, len + sizeof(struct icmp6hdr));
 
+	ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
+
 out_put:
 	if (likely(idev != NULL))
 		in6_dev_put(idev);
diff --git a/trunk/net/ipv6/inet6_hashtables.c b/trunk/net/ipv6/inet6_hashtables.c
index 0765d8bd380f..adc73adadfae 100644
--- a/trunk/net/ipv6/inet6_hashtables.c
+++ b/trunk/net/ipv6/inet6_hashtables.c
@@ -193,7 +193,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 		   sk2->sk_family	       == PF_INET6	 &&
 		   ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)	 &&
 		   ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) &&
-		   (!sk2->sk_bound_dev_if || sk2->sk_bound_dev_if == dif)) {
+		   sk2->sk_bound_dev_if == sk->sk_bound_dev_if) {
 			if (twsk_unique(sk, sk2, twp))
 				goto unique;
 			else
diff --git a/trunk/net/ipv6/proc.c b/trunk/net/ipv6/proc.c
index 44937616057e..8631ed7fe8a9 100644
--- a/trunk/net/ipv6/proc.c
+++ b/trunk/net/ipv6/proc.c
@@ -88,7 +88,7 @@ static char *icmp6type2name[256] = {
 	[ICMPV6_PKT_TOOBIG] = "PktTooBigs",
 	[ICMPV6_TIME_EXCEED] = "TimeExcds",
 	[ICMPV6_PARAMPROB] = "ParmProblems",
-	[ICMPV6_ECHO_REQUEST] = "Echos",
+	[ICMPV6_ECHO_REQUEST] = "EchoRequest",
 	[ICMPV6_ECHO_REPLY] = "EchoReplies",
 	[ICMPV6_MGM_QUERY] = "GroupMembQueries",
 	[ICMPV6_MGM_REPORT] = "GroupMembResponses",
@@ -98,7 +98,7 @@ static char *icmp6type2name[256] = {
 	[NDISC_ROUTER_SOLICITATION] = "RouterSolicits",
 	[NDISC_NEIGHBOUR_ADVERTISEMENT] = "NeighborAdvertisements",
 	[NDISC_NEIGHBOUR_SOLICITATION] = "NeighborSolicits",
-	[NDISC_REDIRECT] = "Redirects",
+	[NDISC_REDIRECT] = "NeighborRedirects",
 };
 
 
diff --git a/trunk/net/ipv6/route.c b/trunk/net/ipv6/route.c
index 20083e0d3995..6ecb5e6fae2e 100644
--- a/trunk/net/ipv6/route.c
+++ b/trunk/net/ipv6/route.c
@@ -329,7 +329,7 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 static inline int rt6_check_neigh(struct rt6_info *rt)
 {
 	struct neighbour *neigh = rt->rt6i_nexthop;
-	int m;
+	int m = 0;
 	if (rt->rt6i_flags & RTF_NONEXTHOP ||
 	    !(rt->rt6i_flags & RTF_GATEWAY))
 		m = 1;
@@ -337,15 +337,10 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
 		read_lock_bh(&neigh->lock);
 		if (neigh->nud_state & NUD_VALID)
 			m = 2;
-#ifdef CONFIG_IPV6_ROUTER_PREF
-		else if (neigh->nud_state & NUD_FAILED)
-			m = 0;
-#endif
-		else
+		else if (!(neigh->nud_state & NUD_FAILED))
 			m = 1;
 		read_unlock_bh(&neigh->lock);
-	} else
-		m = 0;
+	}
 	return m;
 }
 
diff --git a/trunk/net/irda/af_irda.c b/trunk/net/irda/af_irda.c
index 07dfa7fdd2a0..d5e4dd75200b 100644
--- a/trunk/net/irda/af_irda.c
+++ b/trunk/net/irda/af_irda.c
@@ -802,18 +802,12 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 	}
 #endif /* CONFIG_IRDA_ULTRA */
 
-	self->ias_obj = irias_new_object(addr->sir_name, jiffies);
-	if (self->ias_obj == NULL)
-		return -ENOMEM;
-
 	err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
-	if (err < 0) {
-		kfree(self->ias_obj->name);
-		kfree(self->ias_obj);
+	if (err < 0)
 		return err;
-	}
 
 	/*  Register with LM-IAS */
+	self->ias_obj = irias_new_object(addr->sir_name, jiffies);
 	irias_add_integer_attrib(self->ias_obj, "IrDA:TinyTP:LsapSel",
 				 self->stsap_sel, IAS_KERNEL_ATTR);
 	irias_insert_object(self->ias_obj);
@@ -1831,7 +1825,7 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 	struct irda_ias_set    *ias_opt;
 	struct ias_object      *ias_obj;
 	struct ias_attrib *	ias_attr;	/* Attribute in IAS object */
-	int opt, free_ias = 0;
+	int opt;
 
 	IRDA_DEBUG(2, "%s(%p)\n", __FUNCTION__, self);
 
@@ -1887,20 +1881,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			/* Create a new object */
 			ias_obj = irias_new_object(ias_opt->irda_class_name,
 						   jiffies);
-			if (ias_obj == NULL) {
-				kfree(ias_opt);
-				return -ENOMEM;
-			}
-			free_ias = 1;
 		}
 
 		/* Do we have the attribute already ? */
 		if(irias_find_attrib(ias_obj, ias_opt->irda_attrib_name)) {
 			kfree(ias_opt);
-			if (free_ias) {
-				kfree(ias_obj->name);
-				kfree(ias_obj);
-			}
 			return -EINVAL;
 		}
 
@@ -1919,11 +1904,6 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			if(ias_opt->attribute.irda_attrib_octet_seq.len >
 			   IAS_MAX_OCTET_STRING) {
 				kfree(ias_opt);
-				if (free_ias) {
-					kfree(ias_obj->name);
-					kfree(ias_obj);
-				}
-
 				return -EINVAL;
 			}
 			/* Add an octet sequence attribute */
@@ -1952,10 +1932,6 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
 			break;
 		default :
 			kfree(ias_opt);
-			if (free_ias) {
-				kfree(ias_obj->name);
-				kfree(ias_obj);
-			}
 			return -EINVAL;
 		}
 		irias_insert_object(ias_obj);
diff --git a/trunk/net/key/af_key.c b/trunk/net/key/af_key.c
index 76dcd882f87b..26d5e63c4cc5 100644
--- a/trunk/net/key/af_key.c
+++ b/trunk/net/key/af_key.c
@@ -3593,29 +3593,27 @@ static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
 		/* old ipsecrequest */
 		int mode = pfkey_mode_from_xfrm(mp->mode);
 		if (mode < 0)
-			goto err;
+			return -EINVAL;
 		if (set_ipsecrequest(skb, mp->proto, mode,
 				     (mp->reqid ?  IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
 				     mp->reqid, mp->old_family,
-				     &mp->old_saddr, &mp->old_daddr) < 0)
-			goto err;
+				     &mp->old_saddr, &mp->old_daddr) < 0) {
+			return -EINVAL;
+		}
 
 		/* new ipsecrequest */
 		if (set_ipsecrequest(skb, mp->proto, mode,
 				     (mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
 				     mp->reqid, mp->new_family,
-				     &mp->new_saddr, &mp->new_daddr) < 0)
-			goto err;
+				     &mp->new_saddr, &mp->new_daddr) < 0) {
+			return -EINVAL;
+		}
 	}
 
 	/* broadcast migrate message to sockets */
 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
 
 	return 0;
-
-err:
-	kfree_skb(skb);
-	return -EINVAL;
 }
 #else
 static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
diff --git a/trunk/net/rfkill/rfkill.c b/trunk/net/rfkill/rfkill.c
index d06d338812e9..4469a7be006c 100644
--- a/trunk/net/rfkill/rfkill.c
+++ b/trunk/net/rfkill/rfkill.c
@@ -392,14 +392,11 @@ int rfkill_register(struct rfkill *rfkill)
 	rfkill_led_trigger_register(rfkill);
 
 	error = rfkill_add_switch(rfkill);
-	if (error) {
-		rfkill_led_trigger_unregister(rfkill);
+	if (error)
 		return error;
-	}
 
 	error = device_add(dev);
 	if (error) {
-		rfkill_led_trigger_unregister(rfkill);
 		rfkill_remove_switch(rfkill);
 		return error;
 	}
diff --git a/trunk/security/commoncap.c b/trunk/security/commoncap.c
index ea61bc73f6d3..5bc1895f3f9c 100644
--- a/trunk/security/commoncap.c
+++ b/trunk/security/commoncap.c
@@ -59,12 +59,6 @@ int cap_netlink_recv(struct sk_buff *skb, int cap)
 
 EXPORT_SYMBOL(cap_netlink_recv);
 
-/*
- * NOTE WELL: cap_capable() cannot be used like the kernel's capable()
- * function.  That is, it has the reverse semantics: cap_capable()
- * returns 0 when a task has a capability, but the kernel's capable()
- * returns 1 for this case.
- */
 int cap_capable (struct task_struct *tsk, int cap)
 {
 	/* Derived from include/linux/sched.h:capable. */
@@ -113,11 +107,10 @@ static inline int cap_block_setpcap(struct task_struct *target)
 static inline int cap_inh_is_capped(void)
 {
 	/*
-	 * Return 1 if changes to the inheritable set are limited
-	 * to the old permitted set. That is, if the current task
-	 * does *not* possess the CAP_SETPCAP capability.
+	 * return 1 if changes to the inheritable set are limited
+	 * to the old permitted set.
 	 */
-	return (cap_capable(current, CAP_SETPCAP) != 0);
+	return !cap_capable(current, CAP_SETPCAP);
 }
 
 #else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */
diff --git a/trunk/security/selinux/netlabel.c b/trunk/security/selinux/netlabel.c
index d243ddc723a5..66e013d6f6f6 100644
--- a/trunk/security/selinux/netlabel.c
+++ b/trunk/security/selinux/netlabel.c
@@ -53,10 +53,11 @@ static int selinux_netlbl_sock_setsid(struct sock *sk, u32 sid)
 	struct sk_security_struct *sksec = sk->sk_security;
 	struct netlbl_lsm_secattr secattr;
 
+	netlbl_secattr_init(&secattr);
+
 	rc = security_netlbl_sid_to_secattr(sid, &secattr);
 	if (rc != 0)
-		return rc;
-
+		goto sock_setsid_return;
 	rc = netlbl_sock_setattr(sk, &secattr);
 	if (rc == 0) {
 		spin_lock_bh(&sksec->nlbl_lock);
@@ -64,6 +65,8 @@ static int selinux_netlbl_sock_setsid(struct sock *sk, u32 sid)
 		spin_unlock_bh(&sksec->nlbl_lock);
 	}
 
+sock_setsid_return:
+	netlbl_secattr_destroy(&secattr);
 	return rc;
 }
 
diff --git a/trunk/security/selinux/ss/services.c b/trunk/security/selinux/ss/services.c
index d572dc908f31..f83b19daed16 100644
--- a/trunk/security/selinux/ss/services.c
+++ b/trunk/security/selinux/ss/services.c
@@ -2606,8 +2606,6 @@ int security_netlbl_sid_to_secattr(u32 sid, struct netlbl_lsm_secattr *secattr)
 	int rc = -ENOENT;
 	struct context *ctx;
 
-	netlbl_secattr_init(secattr);
-
 	if (!ss_initialized)
 		return 0;