diff --git a/Makefile b/Makefile
index 5d2a660..3067f6a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 22
-EXTRAVERSION = .5
+EXTRAVERSION = .6
 NAME = Holy Dancing Manatees, Batman!
 
 # *DOCUMENTATION*
diff --git a/arch/i386/mm/fault.c b/arch/i386/mm/fault.c
index 1ecb3e4..27ba2fd 100644
--- a/arch/i386/mm/fault.c
+++ b/arch/i386/mm/fault.c
@@ -249,9 +249,10 @@ static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned 
long address)
        pmd_k = pmd_offset(pud_k, address);
        if (!pmd_present(*pmd_k))
                return NULL;
-       if (!pmd_present(*pmd))
+       if (!pmd_present(*pmd)) {
                set_pmd(pmd, *pmd_k);
-       else
+               arch_flush_lazy_mmu_mode();
+       } else
                BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
        return pmd_k;
 }
diff --git a/arch/sparc64/kernel/pci.c b/arch/sparc64/kernel/pci.c
index 81f4a5e..3bc136a 100644
--- a/arch/sparc64/kernel/pci.c
+++ b/arch/sparc64/kernel/pci.c
@@ -422,10 +422,15 @@ struct pci_dev *of_create_pci_dev(struct pci_pbm_info 
*pbm,
        dev->multifunction = 0;         /* maybe a lie? */
 
        if (host_controller) {
-               dev->vendor = 0x108e;
-               dev->device = 0x8000;
-               dev->subsystem_vendor = 0x0000;
-               dev->subsystem_device = 0x0000;
+               if (tlb_type != hypervisor) {
+                       pci_read_config_word(dev, PCI_VENDOR_ID,
+                                            &dev->vendor);
+                       pci_read_config_word(dev, PCI_DEVICE_ID,
+                                            &dev->device);
+               } else {
+                       dev->vendor = PCI_VENDOR_ID_SUN;
+                       dev->device = 0x80f0;
+               }
                dev->cfg_size = 256;
                dev->class = PCI_CLASS_BRIDGE_HOST << 8;
                sprintf(pci_name(dev), "%04x:%02x:%02x.%d", pci_domain_nr(bus),
@@ -817,7 +822,7 @@ int pci_host_bridge_read_pci_cfg(struct pci_bus *bus_dev,
 {
        static u8 fake_pci_config[] = {
                0x8e, 0x10, /* Vendor: 0x108e (Sun) */
-               0x00, 0x80, /* Device: 0x8000 (PBM) */
+               0xf0, 0x80, /* Device: 0x80f0 (Fire) */
                0x46, 0x01, /* Command: 0x0146 (SERR, PARITY, MASTER, MEM) */
                0xa0, 0x22, /* Status: 0x02a0 (DEVSEL_MED, FB2B, 66MHZ) */
                0x00, 0x00, 0x00, 0x06, /* Class: 0x06000000 host bridge */
diff --git a/arch/sparc64/kernel/pci_common.c b/arch/sparc64/kernel/pci_common.c
index 4249214..2f61c4b 100644
--- a/arch/sparc64/kernel/pci_common.c
+++ b/arch/sparc64/kernel/pci_common.c
@@ -44,6 +44,67 @@ static void *sun4u_config_mkaddr(struct pci_pbm_info *pbm,
        return (void *) (pbm->config_space | bus | devfn | reg);
 }
 
+/* At least on Sabre, it is necessary to access all PCI host controller
+ * registers at their natural size, otherwise zeros are returned.
+ * Strange but true, and I see no language in the UltraSPARC-IIi
+ * programmer's manual that mentions this even indirectly.
+ */
+static int sun4u_read_pci_cfg_host(struct pci_pbm_info *pbm,
+                                  unsigned char bus, unsigned int devfn,
+                                  int where, int size, u32 *value)
+{
+       u32 tmp32, *addr;
+       u16 tmp16;
+       u8 tmp8;
+
+       addr = sun4u_config_mkaddr(pbm, bus, devfn, where);
+       if (!addr)
+               return PCIBIOS_SUCCESSFUL;
+
+       switch (size) {
+       case 1:
+               if (where < 8) {
+                       unsigned long align = (unsigned long) addr;
+
+                       align &= ~1;
+                       pci_config_read16((u16 *)align, &tmp16);
+                       if (where & 1)
+                               *value = tmp16 >> 8;
+                       else
+                               *value = tmp16 & 0xff;
+               } else {
+                       pci_config_read8((u8 *)addr, &tmp8);
+                       *value = (u32) tmp8;
+               }
+               break;
+
+       case 2:
+               if (where < 8) {
+                       pci_config_read16((u16 *)addr, &tmp16);
+                       *value = (u32) tmp16;
+               } else {
+                       pci_config_read8((u8 *)addr, &tmp8);
+                       *value = (u32) tmp8;
+                       pci_config_read8(((u8 *)addr) + 1, &tmp8);
+                       *value |= ((u32) tmp8) << 8;
+               }
+               break;
+
+       case 4:
+               tmp32 = 0xffffffff;
+               sun4u_read_pci_cfg_host(pbm, bus, devfn,
+                                       where, 2, &tmp32);
+               *value = tmp32;
+
+               tmp32 = 0xffffffff;
+               sun4u_read_pci_cfg_host(pbm, bus, devfn,
+                                       where + 2, 2, &tmp32);
+               *value |= tmp32 << 16;
+               break;
+       }
+       return PCIBIOS_SUCCESSFUL;
+}
+
 static int sun4u_read_pci_cfg(struct pci_bus *bus_dev, unsigned int devfn,
                              int where, int size, u32 *value)
 {
@@ -53,10 +114,6 @@ static int sun4u_read_pci_cfg(struct pci_bus *bus_dev, 
unsigned int devfn,
        u16 tmp16;
        u8 tmp8;
 
-       if (bus_dev == pbm->pci_bus && devfn == 0x00)
-               return pci_host_bridge_read_pci_cfg(bus_dev, devfn, where,
-                                                   size, value);
-
        switch (size) {
        case 1:
                *value = 0xff;
@@ -69,6 +126,10 @@ static int sun4u_read_pci_cfg(struct pci_bus *bus_dev, 
unsigned int devfn,
                break;
        }
 
+       if (!bus_dev->number && !PCI_SLOT(devfn))
+               return sun4u_read_pci_cfg_host(pbm, bus, devfn, where,
+                                              size, value);
+
        addr = sun4u_config_mkaddr(pbm, bus, devfn, where);
        if (!addr)
                return PCIBIOS_SUCCESSFUL;
@@ -101,6 +162,53 @@ static int sun4u_read_pci_cfg(struct pci_bus *bus_dev, 
unsigned int devfn,
        return PCIBIOS_SUCCESSFUL;
 }
 
+static int sun4u_write_pci_cfg_host(struct pci_pbm_info *pbm,
+                                   unsigned char bus, unsigned int devfn,
+                                   int where, int size, u32 value)
+{
+       u32 *addr;
+
+       addr = sun4u_config_mkaddr(pbm, bus, devfn, where);
+       if (!addr)
+               return PCIBIOS_SUCCESSFUL;
+
+       switch (size) {
+       case 1:
+               if (where < 8) {
+                       unsigned long align = (unsigned long) addr;
+                       u16 tmp16;
+
+                       align &= ~1;
+                       pci_config_read16((u16 *)align, &tmp16);
+                       if (where & 1) {
+                               tmp16 &= 0x00ff;
+                               tmp16 |= value << 8;
+                       } else {
+                               tmp16 &= 0xff00;
+                               tmp16 |= value;
+                       }
+                       pci_config_write16((u16 *)align, tmp16);
+               } else
+                       pci_config_write8((u8 *)addr, value);
+               break;
+       case 2:
+               if (where < 8) {
+                       pci_config_write16((u16 *)addr, value);
+               } else {
+                       pci_config_write8((u8 *)addr, value & 0xff);
+                       pci_config_write8(((u8 *)addr) + 1, value >> 8);
+               }
+               break;
+       case 4:
+               sun4u_write_pci_cfg_host(pbm, bus, devfn,
+                                        where, 2, value & 0xffff);
+               sun4u_write_pci_cfg_host(pbm, bus, devfn,
+                                        where + 2, 2, value >> 16);
+               break;
+       }
+       return PCIBIOS_SUCCESSFUL;
+}
+
 static int sun4u_write_pci_cfg(struct pci_bus *bus_dev, unsigned int devfn,
                               int where, int size, u32 value)
 {
@@ -108,9 +216,10 @@ static int sun4u_write_pci_cfg(struct pci_bus *bus_dev, 
unsigned int devfn,
        unsigned char bus = bus_dev->number;
        u32 *addr;
 
-       if (bus_dev == pbm->pci_bus && devfn == 0x00)
-               return pci_host_bridge_write_pci_cfg(bus_dev, devfn, where,
-                                                    size, value);
+       if (!bus_dev->number && !PCI_SLOT(devfn))
+               return sun4u_write_pci_cfg_host(pbm, bus, devfn, where,
+                                               size, value);
+
        addr = sun4u_config_mkaddr(pbm, bus, devfn, where);
        if (!addr)
                return PCIBIOS_SUCCESSFUL;
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index 00a9e32..a05b37f 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -2134,12 +2134,20 @@ static void user_instruction_dump (unsigned int __user 
*pc)
 void show_stack(struct task_struct *tsk, unsigned long *_ksp)
 {
        unsigned long pc, fp, thread_base, ksp;
-       void *tp = task_stack_page(tsk);
+       struct thread_info *tp;
        struct reg_window *rw;
        int count = 0;
 
        ksp = (unsigned long) _ksp;
-
+       if (!tsk)
+               tsk = current;
+       tp = task_thread_info(tsk);
+       if (ksp == 0UL) {
+               if (tsk == current)
+                       asm("mov %%fp, %0" : "=r" (ksp));
+               else
+                       ksp = tp->ksp;
+       }
        if (tp == current_thread_info())
                flushw_all();
 
@@ -2168,11 +2176,7 @@ void show_stack(struct task_struct *tsk, unsigned long 
*_ksp)
 
 void dump_stack(void)
 {
-       unsigned long *ksp;
-
-       __asm__ __volatile__("mov       %%fp, %0"
-                            : "=r" (ksp));
-       show_stack(current, ksp);
+       show_stack(current, NULL);
 }
 
 EXPORT_SYMBOL(dump_stack);
diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
index b582024..e2cb991 100644
--- a/arch/sparc64/mm/fault.c
+++ b/arch/sparc64/mm/fault.c
@@ -112,15 +112,12 @@ static void __kprobes unhandled_fault(unsigned long 
address,
 
 static void bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr)
 {
-       unsigned long *ksp;
-
        printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
               regs->tpc);
        printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
        print_symbol("RPC: <%s>\n", regs->u_regs[15]);
        printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
-       __asm__("mov %%sp, %0" : "=r" (ksp));
-       show_stack(current, ksp);
+       dump_stack();
        unhandled_fault(regs->tpc, current, regs);
 }
 
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index c6acc1a..2c491a5 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -612,6 +612,8 @@ static int ubd_open_dev(struct ubd *ubd_dev)
        ubd_dev->fd = fd;
 
        if(ubd_dev->cow.file != NULL){
+               blk_queue_max_sectors(ubd_dev->queue, 8 * sizeof(long));
+
                err = -ENOMEM;
                ubd_dev->cow.bitmap = (void *) vmalloc(ubd_dev->cow.bitmap_len);
                if(ubd_dev->cow.bitmap == NULL){
@@ -712,8 +714,6 @@ static int ubd_add(int n, char **error_out)
        ubd_dev->queue->queuedata = ubd_dev;
 
        blk_queue_max_hw_segments(ubd_dev->queue, MAX_SG);
-       if(ubd_dev->cow.file != NULL)
-               blk_queue_max_sectors(ubd_dev->queue, 8 * sizeof(long));
        err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]);
        if(err){
                *error_out = "Failed to register device";
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 085332a..cd3d001 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -1196,12 +1196,19 @@ static int pwc_video_open(struct inode *inode, struct 
file *file)
        return 0;
 }
 
+
+static void pwc_cleanup(struct pwc_device *pdev)
+{
+       pwc_remove_sysfs_files(pdev->vdev);
+       video_unregister_device(pdev->vdev);
+}
+
 /* Note that all cleanup is done in the reverse order as in _open */
 static int pwc_video_close(struct inode *inode, struct file *file)
 {
        struct video_device *vdev = file->private_data;
        struct pwc_device *pdev;
-       int i;
+       int i, hint;
 
        PWC_DEBUG_OPEN(">> video_close called(vdev = 0x%p).\n", vdev);
 
@@ -1224,8 +1231,9 @@ static int pwc_video_close(struct inode *inode, struct 
file *file)
        pwc_isoc_cleanup(pdev);
        pwc_free_buffers(pdev);
 
+       lock_kernel();
        /* Turn off LEDS and power down camera, but only when not unplugged */
-       if (pdev->error_status != EPIPE) {
+       if (!pdev->unplugged) {
                /* Turn LEDs off */
                if (pwc_set_leds(pdev, 0, 0) < 0)
                        PWC_DEBUG_MODULE("Failed to set LED on/off time.\n");
@@ -1234,9 +1242,19 @@ static int pwc_video_close(struct inode *inode, struct 
file *file)
                        if (i < 0)
                                PWC_ERROR("Failed to power down camera (%d)\n", 
i);
                }
+               pdev->vopen--;
+               PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", i);
+       } else {
+               pwc_cleanup(pdev);
+               /* Free memory (don't set pdev to 0 just yet) */
+               kfree(pdev);
+               /* search device_hint[] table if we occupy a slot, by any 
chance */
+               for (hint = 0; hint < MAX_DEV_HINTS; hint++)
+                       if (device_hint[hint].pdev == pdev)
+                               device_hint[hint].pdev = NULL;
        }
-       pdev->vopen--;
-       PWC_DEBUG_OPEN("<< video_close() vopen=%d\n", pdev->vopen);
+       unlock_kernel();
+
        return 0;
 }
 
@@ -1791,21 +1809,21 @@ static void usb_pwc_disconnect(struct usb_interface 
*intf)
        /* Alert waiting processes */
        wake_up_interruptible(&pdev->frameq);
        /* Wait until device is closed */
-       while (pdev->vopen)
-               schedule();
-       /* Device is now closed, so we can safely unregister it */
-       PWC_DEBUG_PROBE("Unregistering video device in disconnect().\n");
-       pwc_remove_sysfs_files(pdev->vdev);
-       video_unregister_device(pdev->vdev);
-
-       /* Free memory (don't set pdev to 0 just yet) */
-       kfree(pdev);
+       if(pdev->vopen) {
+               pdev->unplugged = 1;
+       } else {
+               /* Device is closed, so we can safely unregister it */
+               PWC_DEBUG_PROBE("Unregistering video device in 
disconnect().\n");
+               pwc_cleanup(pdev);
+               /* Free memory (don't set pdev to 0 just yet) */
+               kfree(pdev);
 
 disconnect_out:
-       /* search device_hint[] table if we occupy a slot, by any chance */
-       for (hint = 0; hint < MAX_DEV_HINTS; hint++)
-               if (device_hint[hint].pdev == pdev)
-                       device_hint[hint].pdev = NULL;
+               /* search device_hint[] table if we occupy a slot, by any 
chance */
+               for (hint = 0; hint < MAX_DEV_HINTS; hint++)
+                       if (device_hint[hint].pdev == pdev)
+                               device_hint[hint].pdev = NULL;
+       }
 
        unlock_kernel();
 }
diff --git a/drivers/media/video/pwc/pwc.h b/drivers/media/video/pwc/pwc.h
index acbb931..40d3447 100644
--- a/drivers/media/video/pwc/pwc.h
+++ b/drivers/media/video/pwc/pwc.h
@@ -193,6 +193,7 @@ struct pwc_device
    char vsnapshot;             /* snapshot mode */
    char vsync;                 /* used by isoc handler */
    char vmirror;               /* for ToUCaM series */
+       char unplugged;
 
    int cmd_len;
    unsigned char cmd_buf[13];
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6287ffb..0af7bc8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1233,43 +1233,31 @@ int bond_sethwaddr(struct net_device *bond_dev, struct 
net_device *slave_dev)
        return 0;
 }
 
-#define BOND_INTERSECT_FEATURES \
-       (NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_TSO | NETIF_F_UFO)
+#define BOND_VLAN_FEATURES \
+       (NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_TX | \
+        NETIF_F_HW_VLAN_FILTER)
 
 /* 
  * Compute the common dev->feature set available to all slaves.  Some
- * feature bits are managed elsewhere, so preserve feature bits set on
- * master device that are not part of the examined set.
+ * feature bits are managed elsewhere, so preserve those feature bits
+ * on the master device.
  */
 static int bond_compute_features(struct bonding *bond)
 {
-       unsigned long features = BOND_INTERSECT_FEATURES;
        struct slave *slave;
        struct net_device *bond_dev = bond->dev;
+       unsigned long features = bond_dev->features & ~BOND_VLAN_FEATURES;
        unsigned short max_hard_header_len = ETH_HLEN;
        int i;
 
        bond_for_each_slave(bond, slave, i) {
-               features &= (slave->dev->features & BOND_INTERSECT_FEATURES);
+               features = netdev_compute_features(features,
+                                                  slave->dev->features);
                if (slave->dev->hard_header_len > max_hard_header_len)
                        max_hard_header_len = slave->dev->hard_header_len;
        }
 
-       if ((features & NETIF_F_SG) && 
-           !(features & NETIF_F_ALL_CSUM))
-               features &= ~NETIF_F_SG;
-
-       /* 
-        * features will include NETIF_F_TSO (NETIF_F_UFO) iff all 
-        * slave devices support NETIF_F_TSO (NETIF_F_UFO), which 
-        * implies that all slaves also support scatter-gather 
-        * (NETIF_F_SG), which implies that features also includes 
-        * NETIF_F_SG. So no need to check whether we have an  
-        * illegal combination of NETIF_F_{TSO,UFO} and 
-        * !NETIF_F_SG 
-        */
-
-       features |= (bond_dev->features & ~BOND_INTERSECT_FEATURES);
+       features |= (bond_dev->features & BOND_VLAN_FEATURES);
        bond_dev->features = features;
        bond_dev->hard_header_len = max_hard_header_len;
 
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 3ef0092..9a81fed 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1726,7 +1726,7 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                }
                /* the decompressor still expects the A/C bytes in the hdr */
                len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,
-                               skb->len + 2, ns->data, ppp->mru + PPP_HDRLEN);
+                               skb->len + 2, ns->data, obuff_size);
                if (len < 0) {
                        /* Pass the compressed frame to pppd as an
                           error indication. */
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d2646a8..2e76c4a 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -657,8 +657,8 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
        int i;
        const u8 *addr = hw->dev[port]->dev_addr;
 
-       sky2_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
-       sky2_write32(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
+       sky2_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_SET);
+       sky2_write8(hw, SK_REG(port, GPHY_CTRL), GPC_RST_CLR);
 
        sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_RST_CLR);
 
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index e48fcf0..247135f 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -643,20 +643,20 @@ int pci_scan_bridge(struct pci_bus *bus, struct pci_dev * 
dev, int max, int pass
 
        sprintf(child->name, (is_cardbus ? "PCI CardBus #%02x" : "PCI Bus 
#%02x"), child->number);
 
+       /* Has only triggered on CardBus, fixup is in yenta_socket */
        while (bus->parent) {
                if ((child->subordinate > bus->subordinate) ||
                    (child->number > bus->subordinate) ||
                    (child->number < bus->number) ||
                    (child->subordinate < bus->number)) {
-                       printk(KERN_WARNING "PCI: Bus #%02x (-#%02x) is "
-                              "hidden behind%s bridge #%02x (-#%02x)%s\n",
-                              child->number, child->subordinate,
-                              bus->self->transparent ? " transparent" : " ",
-                              bus->number, bus->subordinate,
-                              pcibios_assign_all_busses() ? " " :
-                              " (try 'pci=assign-busses')");
-                       printk(KERN_WARNING "Please report the result to "
-                              "linux-kernel to fix this permanently\n");
+                       pr_debug("PCI: Bus #%02x (-#%02x) is %s"
+                               "hidden behind%s bridge #%02x (-#%02x)\n",
+                               child->number, child->subordinate,
+                               (bus->number > child->subordinate &&
+                                bus->subordinate < child->number) ?
+                                       "wholly " : " partially",
+                               bus->self->transparent ? " transparent" : " ",
+                               bus->number, bus->subordinate);
                }
                bus = bus->parent;
        }
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 01d8f8a..749e7d8 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -1640,6 +1640,9 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, 
PCI_DEVICE_ID_SERVERWORKS_GCN
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, 
PCI_DEVICE_ID_SERVERWORKS_HT1000_PCIX, quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, 
quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, 
quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RD580, 
quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RX790, 
quirk_disable_all_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS690, 
quirk_disable_all_msi);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_VT3351, 
quirk_disable_all_msi);
 
 /* Disable MSI on chipsets that are known to not support it */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index f9fed34..68ce2de 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -623,12 +623,12 @@ int usb_get_descriptor(struct usb_device *dev, unsigned 
char type, unsigned char
        memset(buf,0,size);     // Make sure we parse really received data
 
        for (i = 0; i < 3; ++i) {
-               /* retry on length 0 or stall; some devices are flakey */
+               /* retry on length 0 or error; some devices are flakey */
                result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
                                USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
                                (type << 8) + index, 0, buf, size,
                                USB_CTRL_GET_TIMEOUT);
-               if (result == 0 || result == -EPIPE)
+               if (result <= 0 && result != -ETIMEDOUT)
                        continue;
                if (result > 1 && ((u8 *)buf)[1] != type) {
                        result = -EPROTO;
@@ -1344,6 +1344,30 @@ static int usb_if_uevent(struct device *dev, char 
**envp, int num_envp,
        usb_dev = interface_to_usbdev(intf);
        alt = intf->cur_altsetting;
 
+#ifdef CONFIG_USB_DEVICEFS
+       if (add_uevent_var(envp, num_envp, &i,
+                          buffer, buffer_size, &length,
+                          "DEVICE=/proc/bus/usb/%03d/%03d",
+                          usb_dev->bus->busnum, usb_dev->devnum))
+               return -ENOMEM;
+#endif
+
+       if (add_uevent_var(envp, num_envp, &i,
+                          buffer, buffer_size, &length,
+                          "PRODUCT=%x/%x/%x",
+                          le16_to_cpu(usb_dev->descriptor.idVendor),
+                          le16_to_cpu(usb_dev->descriptor.idProduct),
+                          le16_to_cpu(usb_dev->descriptor.bcdDevice)))
+               return -ENOMEM;
+
+       if (add_uevent_var(envp, num_envp, &i,
+                          buffer, buffer_size, &length,
+                          "TYPE=%d/%d/%d",
+                          usb_dev->descriptor.bDeviceClass,
+                          usb_dev->descriptor.bDeviceSubClass,
+                          usb_dev->descriptor.bDeviceProtocol))
+               return -ENOMEM;
+
        if (add_uevent_var(envp, num_envp, &i,
                   buffer, buffer_size, &length,
                   "INTERFACE=%d/%d/%d",
diff --git a/fs/exec.c b/fs/exec.c
index 9a93770..3da429d 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -586,18 +586,12 @@ static int de_thread(struct task_struct *tsk)
        int count;
 
        /*
-        * Tell all the sighand listeners that this sighand has
-        * been detached. The signalfd_detach() function grabs the
-        * sighand lock, if signal listeners are present on the sighand.
-        */
-       signalfd_detach(tsk);
-
-       /*
         * If we don't share sighandlers, then we aren't sharing anything
         * and we can just re-use it all.
         */
        if (atomic_read(&oldsighand->count) <= 1) {
                BUG_ON(atomic_read(&sig->count) != 1);
+               signalfd_detach(tsk);
                exit_itimers(sig);
                return 0;
        }
@@ -736,6 +730,7 @@ static int de_thread(struct task_struct *tsk)
        sig->flags = 0;
 
 no_thread_group:
+       signalfd_detach(tsk);
        exit_itimers(sig);
        if (leader)
                release_task(leader);
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index ac6c964..e0cd750 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1353,7 +1353,7 @@ static struct page * ocfs2_get_write_source(struct 
ocfs2_buffered_write_priv *bp
                else
                        src_page = ERR_PTR(-EFAULT);
        } else {
-               bp->b_src_buf = buf;
+               bp->b_src_buf = (char *)((unsigned long)buf & PAGE_CACHE_MASK);
        }
 
        return src_page;
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 3b07f26..afbe171 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -56,12 +56,18 @@ static int signalfd_lock(struct signalfd_ctx *ctx, struct 
signalfd_lockctx *lk)
                sighand = lock_task_sighand(lk->tsk, &lk->flags);
        rcu_read_unlock();
 
-       if (sighand && !ctx->tsk) {
+       if (!sighand)
+               return 0;
+
+       if (!ctx->tsk) {
                unlock_task_sighand(lk->tsk, &lk->flags);
-               sighand = NULL;
+               return 0;
        }
 
-       return sighand != NULL;
+       if (lk->tsk->tgid == current->tgid)
+               lk->tsk = current;
+
+       return 1;
 }
 
 static void signalfd_unlock(struct signalfd_lockctx *lk)
@@ -331,7 +337,7 @@ asmlinkage long sys_signalfd(int ufd, sigset_t __user 
*user_mask, size_t sizemas
 
                init_waitqueue_head(&ctx->wqh);
                ctx->sigmask = sigmask;
-               ctx->tsk = current;
+               ctx->tsk = current->group_leader;
 
                sighand = current->sighand;
                /*
diff --git a/include/asm-sparc/sfp-machine.h b/include/asm-sparc/sfp-machine.h
index ecfc86a..266a42b 100644
--- a/include/asm-sparc/sfp-machine.h
+++ b/include/asm-sparc/sfp-machine.h
@@ -203,4 +203,10 @@ extern struct task_struct *last_task_used_math;
 #define FP_INHIBIT_RESULTS ((last_task_used_math->thread.fsr >> 23) & _fex)
 #endif
 
+#ifdef CONFIG_SMP
+#define FP_TRAPPING_EXCEPTIONS ((current->thread.fsr >> 23) & 0x1f)
+#else
+#define FP_TRAPPING_EXCEPTIONS ((last_task_used_math->thread.fsr >> 23) & 0x1f)
+#endif
+
 #endif
diff --git a/include/asm-sparc64/sfp-machine.h 
b/include/asm-sparc64/sfp-machine.h
index 89d4243..c9331b0 100644
--- a/include/asm-sparc64/sfp-machine.h
+++ b/include/asm-sparc64/sfp-machine.h
@@ -88,4 +88,6 @@
 
 #define FP_INHIBIT_RESULTS ((current_thread_info()->xfsr[0] >> 23) & _fex)
 
+#define FP_TRAPPING_EXCEPTIONS ((current_thread_info()->xfsr[0] >> 23) & 0x1f)
+
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3a70f55..ab210be 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1032,6 +1032,8 @@ extern void dev_seq_stop(struct seq_file *seq, void *v);
 
 extern void linkwatch_run_queue(void);
 
+extern int netdev_compute_features(unsigned long all, unsigned long one);
+
 static inline int net_gso_ok(int features, int gso_type)
 {
        int feature = gso_type << NETIF_F_GSO_SHIFT;
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index 43397a4..ab57cb7 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -28,6 +28,7 @@ header-y += xt_policy.h
 header-y += xt_realm.h
 header-y += xt_sctp.h
 header-y += xt_state.h
+header-y += xt_statistic.h
 header-y += xt_string.h
 header-y += xt_tcpmss.h
 header-y += xt_tcpudp.h
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 5b1c999..c1ffa1b 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -357,6 +357,9 @@
 #define PCI_DEVICE_ID_ATI_RS400_166     0x5a32
 #define PCI_DEVICE_ID_ATI_RS400_200     0x5a33
 #define PCI_DEVICE_ID_ATI_RS480         0x5950
+#define PCI_DEVICE_ID_ATI_RD580                0x5952
+#define PCI_DEVICE_ID_ATI_RX790                0x5957
+#define PCI_DEVICE_ID_ATI_RS690                0x7910
 /* ATI IXP Chipset */
 #define PCI_DEVICE_ID_ATI_IXP200_IDE   0x4349
 #define PCI_DEVICE_ID_ATI_IXP200_SMBUS 0x4353
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index 93780ab..bb46e76 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -145,13 +145,16 @@ do {                                                      
        \
              {                                                 \
                X##_e = 1;                                      \
                _FP_FRAC_SET_##wc(X, _FP_ZEROFRAC_##wc);        \
+               FP_SET_EXCEPTION(FP_EX_INEXACT);                \
              }                                                 \
            else                                                \
              {                                                 \
                X##_e = 0;                                      \
                _FP_FRAC_SRL_##wc(X, _FP_WORKBITS);             \
-               FP_SET_EXCEPTION(FP_EX_UNDERFLOW);              \
              }                                                 \
+           if ((FP_CUR_EXCEPTIONS & FP_EX_INEXACT) ||          \
+               (FP_TRAPPING_EXCEPTIONS & FP_EX_UNDERFLOW))     \
+               FP_SET_EXCEPTION(FP_EX_UNDERFLOW);              \
          }                                                     \
        else                                                    \
          {                                                     \
diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
index d02eb64..a6f873b 100644
--- a/include/math-emu/soft-fp.h
+++ b/include/math-emu/soft-fp.h
@@ -97,12 +97,19 @@
 #define FP_INHIBIT_RESULTS 0
 #endif
 
+#ifndef FP_TRAPPING_EXCEPTIONS
+#define FP_TRAPPING_EXCEPTIONS 0
+#endif
+
 #define FP_SET_EXCEPTION(ex)                           \
   _fex |= (ex)
   
 #define FP_UNSET_EXCEPTION(ex)                         \
   _fex &= ~(ex)
 
+#define FP_CUR_EXCEPTIONS                              \
+  (_fex)
+
 #define FP_CLEAR_EXCEPTIONS                            \
   _fex = 0
 
diff --git a/include/net/tcp.h b/include/net/tcp.h
index a8af9ae..06827e3 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -281,7 +281,7 @@ extern int                  tcp_v4_remember_stamp(struct 
sock *sk);
 
 extern int                     tcp_v4_tw_remember_stamp(struct 
inet_timewait_sock *tw);
 
-extern int                     tcp_sendmsg(struct kiocb *iocb, struct sock *sk,
+extern int                     tcp_sendmsg(struct kiocb *iocb, struct socket 
*sock,
                                            struct msghdr *msg, size_t size);
 extern ssize_t                 tcp_sendpage(struct socket *sock, struct page 
*page, int offset, size_t size, int flags);
 
diff --git a/kernel/signal.c b/kernel/signal.c
index f940560..d625195 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -368,7 +368,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, 
siginfo_t *info)
        /* We only dequeue private signals from ourselves, we don't let
         * signalfd steal them
         */
-       if (tsk == current)
+       if (likely(tsk == current))
                signr = __dequeue_signal(&tsk->pending, mask, info);
        if (!signr) {
                signr = __dequeue_signal(&tsk->signal->shared_pending,
@@ -415,7 +415,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, 
siginfo_t *info)
                if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT))
                        tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
        }
-       if ( signr &&
+       if (signr && likely(tsk == current) &&
             ((info->si_code & __SI_MASK) == __SI_TIMER) &&
             info->si_sys_private){
                /*
diff --git a/net/802/psnap.c b/net/802/psnap.c
index 04ee43e..31128cb 100644
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device 
*dev,
                .type = __constant_htons(ETH_P_SNAP),
        };
 
+       if (unlikely(!pskb_may_pull(skb, 5)))
+               goto drop;
+
        rcu_read_lock();
        proto = find_snap_client(skb_transport_header(skb));
        if (proto) {
@@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device 
*dev,
                skb->transport_header += 5;
                skb_pull_rcsum(skb, 5);
                rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev);
-       } else {
-               skb->sk = NULL;
-               kfree_skb(skb);
-               rc = 1;
        }
-
        rcu_read_unlock();
+
+       if (unlikely(!proto))
+               goto drop;
+
+out:
        return rc;
+
+drop:
+       kfree_skb(skb);
+       goto out;
 }
 
 /*
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 5e1892d..c326602 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -179,5 +179,6 @@ void br_dev_setup(struct net_device *dev)
        dev->priv_flags = IFF_EBRIDGE;
 
        dev->features = NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA |
-                       NETIF_F_TSO | NETIF_F_NO_CSUM | NETIF_F_GSO_ROBUST;
+                       NETIF_F_GSO_SOFTWARE | NETIF_F_NO_CSUM |
+                       NETIF_F_GSO_ROBUST | NETIF_F_LLTX;
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 849deaf..fefd7c1 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -360,35 +360,15 @@ int br_min_mtu(const struct net_bridge *br)
 void br_features_recompute(struct net_bridge *br)
 {
        struct net_bridge_port *p;
-       unsigned long features, checksum;
+       unsigned long features;
 
-       checksum = br->feature_mask & NETIF_F_ALL_CSUM ? NETIF_F_NO_CSUM : 0;
-       features = br->feature_mask & ~NETIF_F_ALL_CSUM;
+       features = br->feature_mask;
 
        list_for_each_entry(p, &br->port_list, list) {
-               unsigned long feature = p->dev->features;
-
-               if (checksum & NETIF_F_NO_CSUM && !(feature & NETIF_F_NO_CSUM))
-                       checksum ^= NETIF_F_NO_CSUM | NETIF_F_HW_CSUM;
-               if (checksum & NETIF_F_HW_CSUM && !(feature & NETIF_F_HW_CSUM))
-                       checksum ^= NETIF_F_HW_CSUM | NETIF_F_IP_CSUM;
-               if (!(feature & NETIF_F_IP_CSUM))
-                       checksum = 0;
-
-               if (feature & NETIF_F_GSO)
-                       feature |= NETIF_F_GSO_SOFTWARE;
-               feature |= NETIF_F_GSO;
-
-               features &= feature;
+               features = netdev_compute_features(features, p->dev->features);
        }
 
-       if (!(checksum & NETIF_F_ALL_CSUM))
-               features &= ~NETIF_F_SG;
-       if (!(features & NETIF_F_SG))
-               features &= ~NETIF_F_GSO_MASK;
-
-       br->dev->features = features | checksum | NETIF_F_LLTX |
-                           NETIF_F_GSO_ROBUST;
+       br->dev->features = features;
 }
 
 /* called with RTNL */
diff --git a/net/core/dev.c b/net/core/dev.c
index ee051bb..1561f61 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3635,6 +3635,44 @@ static int __init netdev_dma_register(void)
 static int __init netdev_dma_register(void) { return -ENODEV; }
 #endif /* CONFIG_NET_DMA */
 
+/**
+ *     netdev_compute_feature - compute conjunction of two feature sets
+ *     @all: first feature set
+ *     @one: second feature set
+ *
+ *     Computes a new feature set after adding a device with feature set
+ *     @one to the master device with current feature set @all.  Returns
+ *     the new feature set.
+ */
+int netdev_compute_features(unsigned long all, unsigned long one)
+{
+       /* if device needs checksumming, downgrade to hw checksumming */
+       if (all & NETIF_F_NO_CSUM && !(one & NETIF_F_NO_CSUM))
+               all ^= NETIF_F_NO_CSUM | NETIF_F_HW_CSUM;
+
+       /* if device can't do all checksum, downgrade to ipv4 */
+       if (all & NETIF_F_HW_CSUM && !(one & NETIF_F_HW_CSUM))
+               all ^= NETIF_F_HW_CSUM | NETIF_F_IP_CSUM;
+
+       if (one & NETIF_F_GSO)
+               one |= NETIF_F_GSO_SOFTWARE;
+       one |= NETIF_F_GSO;
+
+       /* If even one device supports robust GSO, enable it for all. */
+       if (one & NETIF_F_GSO_ROBUST)
+               all |= NETIF_F_GSO_ROBUST;
+
+       all &= one | NETIF_F_LLTX;
+
+       if (!(all & NETIF_F_ALL_CSUM))
+               all &= ~NETIF_F_SG;
+       if (!(all & NETIF_F_SG))
+               all &= ~NETIF_F_GSO_MASK;
+
+       return all;
+}
+EXPORT_SYMBOL(netdev_compute_features);
+
 /*
  *     Initialize the DEV module. At boot time this walks the device list and
  *     unhooks any devices that fail to initialise (normally hardware not
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 248d20f..d29b88f 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -298,7 +298,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int 
more, unsigned int len)
                int rc;
 
                ccid2_pr_debug("allocating more space in history\n");
-               rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, GFP_KERNEL);
+               rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, gfp_any());
                BUG_ON(rc); /* XXX what do we do? */
 
                next = hctx->ccid2hctx_seqh->ccid2s_next;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 041fba3..90b241c 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -831,7 +831,7 @@ const struct proto_ops inet_stream_ops = {
        .shutdown          = inet_shutdown,
        .setsockopt        = sock_common_setsockopt,
        .getsockopt        = sock_common_getsockopt,
-       .sendmsg           = inet_sendmsg,
+       .sendmsg           = tcp_sendmsg,
        .recvmsg           = sock_common_recvmsg,
        .mmap              = sock_no_mmap,
        .sendpage          = tcp_sendpage,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 450f44b..11ff182 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -658,9 +658,10 @@ static inline int select_size(struct sock *sk)
        return tmp;
 }
 
-int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                size_t size)
 {
+       struct sock *sk = sock->sk;
        struct iovec *iov;
        struct tcp_sock *tp = tcp_sk(sk);
        struct sk_buff *skb;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4e5884a..13abf4e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1851,19 +1851,22 @@ static inline u32 tcp_cwnd_min(const struct sock *sk)
 }
 
 /* Decrease cwnd each second ack. */
-static void tcp_cwnd_down(struct sock *sk)
+static void tcp_cwnd_down(struct sock *sk, int flag)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        int decr = tp->snd_cwnd_cnt + 1;
 
-       tp->snd_cwnd_cnt = decr&1;
-       decr >>= 1;
+       if ((flag&FLAG_FORWARD_PROGRESS) ||
+           (IsReno(tp) && !(flag&FLAG_NOT_DUP))) {
+               tp->snd_cwnd_cnt = decr&1;
+               decr >>= 1;
 
-       if (decr && tp->snd_cwnd > tcp_cwnd_min(sk))
-               tp->snd_cwnd -= decr;
+               if (decr && tp->snd_cwnd > tcp_cwnd_min(sk))
+                       tp->snd_cwnd -= decr;
 
-       tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp)+1);
-       tp->snd_cwnd_stamp = tcp_time_stamp;
+               tp->snd_cwnd = min(tp->snd_cwnd, tcp_packets_in_flight(tp)+1);
+               tp->snd_cwnd_stamp = tcp_time_stamp;
+       }
 }
 
 /* Nothing was retransmitted or returned timestamp is less
@@ -2060,7 +2063,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
                }
                tcp_moderate_cwnd(tp);
        } else {
-               tcp_cwnd_down(sk);
+               tcp_cwnd_down(sk, flag);
        }
 }
 
@@ -2109,7 +2112,10 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
-       int is_dupack = (tp->snd_una == prior_snd_una && !(flag&FLAG_NOT_DUP));
+       int is_dupack = (tp->snd_una == prior_snd_una &&
+                        (!(flag&FLAG_NOT_DUP) ||
+                         ((flag&FLAG_DATA_SACKED) &&
+                          (tp->fackets_out > tp->reordering))));
 
        /* Some technical things:
         * 1. Reno does not count dupacks (sacked_out) automatically. */
@@ -2260,7 +2266,7 @@ tcp_fastretrans_alert(struct sock *sk, u32 prior_snd_una,
 
        if (is_dupack || tcp_head_timedout(sk))
                tcp_update_scoreboard(sk);
-       tcp_cwnd_down(sk);
+       tcp_cwnd_down(sk, flag);
        tcp_xmit_retransmit_queue(sk);
 }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 354721d..fa36e1a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2434,7 +2434,6 @@ struct proto tcp_prot = {
        .shutdown               = tcp_shutdown,
        .setsockopt             = tcp_setsockopt,
        .getsockopt             = tcp_getsockopt,
-       .sendmsg                = tcp_sendmsg,
        .recvmsg                = tcp_recvmsg,
        .backlog_rcv            = tcp_v4_do_rcv,
        .hash                   = tcp_v4_hash,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 6dd3772..b1a7755 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -487,7 +487,7 @@ const struct proto_ops inet6_stream_ops = {
        .shutdown          = inet_shutdown,             /* ok           */
        .setsockopt        = sock_common_setsockopt,    /* ok           */
        .getsockopt        = sock_common_getsockopt,    /* ok           */
-       .sendmsg           = inet_sendmsg,              /* ok           */
+       .sendmsg           = tcp_sendmsg,               /* ok           */
        .recvmsg           = sock_common_recvmsg,       /* ok           */
        .mmap              = sock_no_mmap,
        .sendpage          = tcp_sendpage,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4704b5f..b9f9e93 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -790,7 +790,7 @@ slow_path:
                /*
                 *      Copy a block of the IP datagram.
                 */
-               if (skb_copy_bits(skb, ptr, skb_transport_header(skb), len))
+               if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
                        BUG();
                left -= len;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index aa3d07c..f329029 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -825,7 +825,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct 
ipv6_txoptions *opt,
                return 0;
 
        len = min_t(unsigned int, len, ipv6_optlen(hdr));
-       if (copy_to_user(optval, hdr, len));
+       if (copy_to_user(optval, hdr, len))
                return -EFAULT;
        return ipv6_optlen(hdr);
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 17bbdc3..9b81cbc 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -2135,7 +2135,6 @@ struct proto tcpv6_prot = {
        .shutdown               = tcp_shutdown,
        .setsockopt             = tcp_setsockopt,
        .getsockopt             = tcp_getsockopt,
-       .sendmsg                = tcp_sendmsg,
        .recvmsg                = tcp_recvmsg,
        .backlog_rcv            = tcp_v6_do_rcv,
        .hash                   = tcp_v6_hash,
diff --git a/net/socket.c b/net/socket.c
index f453019..0010da0 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1169,7 +1169,7 @@ static int __sock_create(int family, int type, int 
protocol,
        module_put(pf->owner);
        err = security_socket_post_create(sock, family, type, protocol, kern);
        if (err)
-               goto out_release;
+               goto out_sock_release;
        *res = sock;
 
        return 0;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
  • Linux 2.6.22.6 Greg Kroah-Hartman
    • Re: Linux 2.6.22.6 Greg Kroah-Hartman

Reply via email to