Add 4427_force_XATTR_PAX_tmpfs patch20130611

9 files changed, 3300 insertions, 3234 deletions

diff --git a/2.6.32/1060_linux-2.6.32.61.patch b/2.6.32/1060_linux-2.6.32.61.patch
index aa8db39..4c65031 100644
--- a/2.6.32/1060_linux-2.6.32.61.patch
+++ b/2.6.32/1060_linux-2.6.32.61.patch
@@ -1,485 +1,472 @@
-diff --git a/Makefile b/Makefile
-index e5a279c..b0e245e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,7 @@
- VERSION = 2
- PATCHLEVEL = 6
- SUBLEVEL = 32
--EXTRAVERSION = .61
-+EXTRAVERSION = .60
- NAME = Man-Eating Seals of Antiquity
- 
- # *DOCUMENTATION*
 diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
-index dc616b3..99c0f46 100644
+index 99c0f46..dc616b3 100644
 --- a/arch/alpha/kernel/sys_nautilus.c
 +++ b/arch/alpha/kernel/sys_nautilus.c
-@@ -189,10 +189,6 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
+@@ -189,6 +189,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
  extern void free_reserved_mem(void *, void *);
  extern void pcibios_claim_one_bus(struct pci_bus *);
  
--static struct resource irongate_io = {
--	.name	= "Irongate PCI IO",
--	.flags	= IORESOURCE_IO,
--};
++static struct resource irongate_io = {
++	.name	= "Irongate PCI IO",
++	.flags	= IORESOURCE_IO,
++};
  static struct resource irongate_mem = {
  	.name	= "Irongate PCI MEM",
  	.flags	= IORESOURCE_MEM,
-@@ -214,7 +210,6 @@ nautilus_init_pci(void)
+@@ -210,6 +214,7 @@ nautilus_init_pci(void)
  
  	irongate = pci_get_bus_and_slot(0, 0);
  	bus->self = irongate;
--	bus->resource[0] = &irongate_io;
++	bus->resource[0] = &irongate_io;
  	bus->resource[1] = &irongate_mem;
  
  	pci_bus_size_bridges(bus);
 diff --git a/arch/arm/include/asm/signal.h b/arch/arm/include/asm/signal.h
-index 559ee24..43ba0fb 100644
+index 43ba0fb..559ee24 100644
 --- a/arch/arm/include/asm/signal.h
 +++ b/arch/arm/include/asm/signal.h
-@@ -127,7 +127,6 @@ struct sigaction {
+@@ -127,6 +127,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/avr32/include/asm/signal.h b/arch/avr32/include/asm/signal.h
-index e6952a0..8790dfc 100644
+index 8790dfc..e6952a0 100644
 --- a/arch/avr32/include/asm/signal.h
 +++ b/arch/avr32/include/asm/signal.h
-@@ -128,7 +128,6 @@ struct sigaction {
+@@ -128,6 +128,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/cris/include/asm/signal.h b/arch/cris/include/asm/signal.h
-index 057fea2..ea6af9a 100644
+index ea6af9a..057fea2 100644
 --- a/arch/cris/include/asm/signal.h
 +++ b/arch/cris/include/asm/signal.h
-@@ -122,7 +122,6 @@ struct sigaction {
+@@ -122,6 +122,7 @@ struct sigaction {
  	void (*sa_restorer)(void);
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/h8300/include/asm/signal.h b/arch/h8300/include/asm/signal.h
-index 8695707..fd8b66e 100644
+index fd8b66e..8695707 100644
 --- a/arch/h8300/include/asm/signal.h
 +++ b/arch/h8300/include/asm/signal.h
-@@ -121,7 +121,6 @@ struct sigaction {
+@@ -121,6 +121,7 @@ struct sigaction {
  	void (*sa_restorer)(void);
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h
-index a96a9f4..9c1acb2 100644
+index 9c1acb2..a96a9f4 100644
 --- a/arch/m32r/include/asm/signal.h
 +++ b/arch/m32r/include/asm/signal.h
-@@ -123,7 +123,6 @@ struct sigaction {
+@@ -123,6 +123,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
-index 01a492a..5bc09c7 100644
+index 5bc09c7..01a492a 100644
 --- a/arch/m68k/include/asm/signal.h
 +++ b/arch/m68k/include/asm/signal.h
-@@ -119,7 +119,6 @@ struct sigaction {
+@@ -119,6 +119,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/mips/Makefile b/arch/mips/Makefile
-index 57ff855..77f5021 100644
+index 77f5021..57ff855 100644
 --- a/arch/mips/Makefile
 +++ b/arch/mips/Makefile
 @@ -657,7 +657,7 @@ KBUILD_CPPFLAGS += -D"DATAOFFSET=$(if $(dataoffset-y),$(dataoffset-y),0)"
  LDFLAGS			+= -m $(ld-emul)
  
  ifdef CONFIG_MIPS
--CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
-+CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -xc /dev/null | \
+-CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -xc /dev/null | \
++CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
  	egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
  	sed -e 's/^\#define /-D/' -e "s/ /='/" -e "s/$$/'/")
  ifdef CONFIG_64BIT
 diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
-index 700dc14..eecd2a9 100644
+index eecd2a9..700dc14 100644
 --- a/arch/mips/kernel/Makefile
 +++ b/arch/mips/kernel/Makefile
 @@ -88,7 +88,7 @@ obj-$(CONFIG_GPIO_TXX9)		+= gpio_txx9.o
  obj-$(CONFIG_KEXEC)		+= machine_kexec.o relocate_kernel.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
--CFLAGS_cpu-bugs64.o	= $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -x c /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
-+CFLAGS_cpu-bugs64.o	= $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -xc /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
+-CFLAGS_cpu-bugs64.o	= $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -xc /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
++CFLAGS_cpu-bugs64.o	= $(shell if $(CC) $(KBUILD_CFLAGS) -Wa,-mdaddi -c -o /dev/null -x c /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
  
  obj-$(CONFIG_HAVE_STD_PC_SERIAL_PORT)	+= 8250-platform.o
  
 diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h
-index 045d6a2..7e891fc 100644
+index 7e891fc..045d6a2 100644
 --- a/arch/mn10300/include/asm/signal.h
 +++ b/arch/mn10300/include/asm/signal.h
-@@ -131,7 +131,6 @@ struct sigaction {
+@@ -131,6 +131,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
-index 32d43e7..fb59852 100644
+index fb59852..32d43e7 100644
 --- a/arch/parisc/kernel/signal32.c
 +++ b/arch/parisc/kernel/signal32.c
-@@ -68,8 +68,7 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
+@@ -68,7 +68,8 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
  {
  	compat_sigset_t s;
  
--	if (sz != sizeof *set)
--		return -EINVAL;
-+	if (sz != sizeof *set) panic("put_sigset32()");
+-	if (sz != sizeof *set) panic("put_sigset32()");
++	if (sz != sizeof *set)
++		return -EINVAL;
  	sigset_64to32(&s, set);
  
  	return copy_to_user(up, &s, sizeof s);
-@@ -81,8 +80,7 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
+@@ -80,7 +81,8 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
  	compat_sigset_t s;
  	int r;
  
--	if (sz != sizeof *set)
--		return -EINVAL;
-+	if (sz != sizeof *set) panic("put_sigset32()");
+-	if (sz != sizeof *set) panic("put_sigset32()");
++	if (sz != sizeof *set)
++		return -EINVAL;
  
  	if ((r = copy_from_user(&s, up, sz)) == 0) {
  		sigset_32to64(set, &s);
 diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h
-index ec63a0a..3eb13be 100644
+index 3eb13be..ec63a0a 100644
 --- a/arch/powerpc/include/asm/signal.h
 +++ b/arch/powerpc/include/asm/signal.h
-@@ -109,7 +109,6 @@ struct sigaction {
+@@ -109,6 +109,7 @@ struct sigaction {
  	__sigrestore_t sa_restorer;
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/arch/s390/include/asm/signal.h b/arch/s390/include/asm/signal.h
-index c872626..cdf5cb2 100644
+index cdf5cb2..c872626 100644
 --- a/arch/s390/include/asm/signal.h
 +++ b/arch/s390/include/asm/signal.h
-@@ -131,7 +131,6 @@ struct sigaction {
+@@ -131,6 +131,7 @@ struct sigaction {
          void (*sa_restorer)(void);
          sigset_t sa_mask;               /* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
          struct sigaction sa;
 diff --git a/arch/sparc/include/asm/signal.h b/arch/sparc/include/asm/signal.h
-index 4929431..e49b828 100644
+index e49b828..4929431 100644
 --- a/arch/sparc/include/asm/signal.h
 +++ b/arch/sparc/include/asm/signal.h
-@@ -191,7 +191,6 @@ struct __old_sigaction {
+@@ -191,6 +191,7 @@ struct __old_sigaction {
  	unsigned long		sa_flags;
  	void			(*sa_restorer)(void);  /* not used by Linux/SPARC yet */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  typedef struct sigaltstack {
  	void			__user *ss_sp;
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index ee0168d..aa889d6 100644
+index aa889d6..ee0168d 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -1430,7 +1430,7 @@ config ARCH_USES_PG_UNCACHED
  
  config ARCH_RANDOM
  	def_bool y
--	prompt "x86 architectural random number generator" if EMBEDDED
-+	prompt "x86 architectural random number generator" if EXPERT
+-	prompt "x86 architectural random number generator" if EXPERT
++	prompt "x86 architectural random number generator" if EMBEDDED
  	---help---
  	  Enable the x86 architectural RDRAND instruction
  	  (Intel Bull Mountain technology) to generate random numbers.
 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
-index 1cce9d2..af6fd36 100644
+index af6fd36..1cce9d2 100644
 --- a/arch/x86/include/asm/pgtable.h
 +++ b/arch/x86/include/asm/pgtable.h
-@@ -130,11 +130,6 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
+@@ -130,6 +130,11 @@ static inline unsigned long pmd_pfn(pmd_t pmd)
  	return (pmd_val(pmd) & PTE_PFN_MASK) >> PAGE_SHIFT;
  }
  
--static inline unsigned long pud_pfn(pud_t pud)
--{
--	return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
--}
--
++static inline unsigned long pud_pfn(pud_t pud)
++{
++	return (pud_val(pud) & PTE_PFN_MASK) >> PAGE_SHIFT;
++}
++
  #define pte_page(pte)	pfn_to_page(pte_pfn(pte))
  
  static inline int pmd_large(pmd_t pte)
 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
-index e668d72..0f0d908 100644
+index 0f0d908..e668d72 100644
 --- a/arch/x86/include/asm/ptrace.h
 +++ b/arch/x86/include/asm/ptrace.h
-@@ -2,7 +2,6 @@
+@@ -2,6 +2,7 @@
  #define _ASM_X86_PTRACE_H
  
  #include <linux/compiler.h>	/* For __user */
--#include <linux/linkage.h>	/* For asmregparm */
++#include <linux/linkage.h>	/* For asmregparm */
  #include <asm/ptrace-abi.h>
  #include <asm/processor-flags.h>
  
-@@ -143,8 +142,8 @@ extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
+@@ -142,8 +143,8 @@ extern void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
  			 int error_code, int si_code);
  void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
  
--extern asmregparm long syscall_trace_enter(struct pt_regs *);
--extern asmregparm void syscall_trace_leave(struct pt_regs *);
-+extern long syscall_trace_enter(struct pt_regs *);
-+extern void syscall_trace_leave(struct pt_regs *);
+-extern long syscall_trace_enter(struct pt_regs *);
+-extern void syscall_trace_leave(struct pt_regs *);
++extern asmregparm long syscall_trace_enter(struct pt_regs *);
++extern asmregparm void syscall_trace_leave(struct pt_regs *);
  
  static inline unsigned long regs_return_value(struct pt_regs *regs)
  {
 diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h
-index 6cbc795..598457c 100644
+index 598457c..6cbc795 100644
 --- a/arch/x86/include/asm/signal.h
 +++ b/arch/x86/include/asm/signal.h
-@@ -125,8 +125,6 @@ typedef unsigned long sigset_t;
+@@ -125,6 +125,8 @@ typedef unsigned long sigset_t;
  extern void do_notify_resume(struct pt_regs *, void *, __u32);
  # endif /* __KERNEL__ */
  
--#define __ARCH_HAS_SA_RESTORER
--
++#define __ARCH_HAS_SA_RESTORER
++
  #ifdef __i386__
  # ifdef __KERNEL__
  struct old_sigaction {
 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
-index d256bc3..8928d97 100644
+index 8928d97..d256bc3 100644
 --- a/arch/x86/kernel/apic/io_apic.c
 +++ b/arch/x86/kernel/apic/io_apic.c
-@@ -4262,7 +4262,6 @@ static int bad_ioapic(unsigned long address)
+@@ -4262,6 +4262,7 @@ static int bad_ioapic(unsigned long address)
  void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
  {
  	int idx = 0;
--	int entries;
++	int entries;
  
  	if (bad_ioapic(address))
  		return;
-@@ -4281,14 +4280,10 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
+@@ -4280,10 +4281,14 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
  	 * Build basic GSI lookup table to facilitate gsi->io_apic lookups
  	 * and to prevent reprogramming of IOAPIC pins (PCI GSIs).
  	 */
--	entries = io_apic_get_redir_entries(idx);
++	entries = io_apic_get_redir_entries(idx);
  	mp_gsi_routing[idx].gsi_base = gsi_base;
--	mp_gsi_routing[idx].gsi_end = gsi_base + entries;
-+	mp_gsi_routing[idx].gsi_end = gsi_base +
-+	    io_apic_get_redir_entries(idx);
+-	mp_gsi_routing[idx].gsi_end = gsi_base +
+-	    io_apic_get_redir_entries(idx);
++	mp_gsi_routing[idx].gsi_end = gsi_base + entries;
  
--	/*
--	 * The number of IO-APIC IRQ registers (== #pins):
--	 */
--	nr_ioapic_registers[idx] = entries + 1;
++	/*
++	 * The number of IO-APIC IRQ registers (== #pins):
++	 */
++	nr_ioapic_registers[idx] = entries + 1;
  	printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
  	       "GSI %d-%d\n", idx, mp_ioapics[idx].apicid,
  	       mp_ioapics[idx].apicver, mp_ioapics[idx].apicaddr,
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 28a7e4c8..0f16a2b 100644
+index 0f16a2b..28a7e4c8 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
-@@ -431,13 +431,6 @@ static inline void mce_get_rip(struct mce *m, struct pt_regs *regs)
+@@ -431,6 +431,13 @@ static inline void mce_get_rip(struct mce *m, struct pt_regs *regs)
  	if (regs && (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV))) {
  		m->ip = regs->ip;
  		m->cs = regs->cs;
--		/*
--		 * When in VM86 mode make the cs look like ring 3
--		 * always. This is a lie, but it's better than passing
--		 * the additional vm86 bit around everywhere.
--		 */
--		if (v8086_mode(regs))
--			m->cs |= 3;
++		/*
++		 * When in VM86 mode make the cs look like ring 3
++		 * always. This is a lie, but it's better than passing
++		 * the additional vm86 bit around everywhere.
++		 */
++		if (v8086_mode(regs))
++			m->cs |= 3;
  	} else {
  		m->ip = 0;
  		m->cs = 0;
-@@ -975,7 +968,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
+@@ -968,6 +975,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
  		 */
  		add_taint(TAINT_MACHINE_CHECK);
  
--		mce_get_rip(&m, regs);
++		mce_get_rip(&m, regs);
  		severity = mce_severity(&m, tolerant, NULL);
  
  		/*
-@@ -1014,6 +1006,7 @@ void do_machine_check(struct pt_regs *regs, long error_code)
+@@ -1006,7 +1014,6 @@ void do_machine_check(struct pt_regs *regs, long error_code)
  		if (severity == MCE_AO_SEVERITY && mce_usable_address(&m))
  			mce_ring_add(m.addr >> PAGE_SHIFT);
  
-+		mce_get_rip(&m, regs);
+-		mce_get_rip(&m, regs);
  		mce_log(&m);
  
  		if (severity > worst) {
 diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
-index a3e77af..cdcfb12 100644
+index cdcfb12..a3e77af 100644
 --- a/arch/x86/kernel/efi.c
 +++ b/arch/x86/kernel/efi.c
-@@ -459,6 +459,9 @@ void __init efi_init(void)
+@@ -459,9 +459,6 @@ void __init efi_init(void)
  	x86_platform.set_wallclock = efi_set_rtc_mmss;
  #endif
  
-+	/* Setup for EFI runtime service */
-+	reboot_type = BOOT_EFI;
-+
+-	/* Setup for EFI runtime service */
+-	reboot_type = BOOT_EFI;
+-
  #if EFI_DEBUG
  	print_efi_memmap();
  #endif
 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
-index 63a053b..5eaeb5e 100644
+index 5eaeb5e..63a053b 100644
 --- a/arch/x86/kernel/msr.c
 +++ b/arch/x86/kernel/msr.c
-@@ -176,9 +176,6 @@ static int msr_open(struct inode *inode, struct file *file)
+@@ -176,6 +176,9 @@ static int msr_open(struct inode *inode, struct file *file)
  	struct cpuinfo_x86 *c = &cpu_data(cpu);
  	int ret = 0;
  
--	if (!capable(CAP_SYS_RAWIO))
--		return -EPERM;
--
++	if (!capable(CAP_SYS_RAWIO))
++		return -EPERM;
++
  	lock_kernel();
  	cpu = iminor(file->f_path.dentry->d_inode);
  
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index cdee77e..271fddf 100644
+index 271fddf..cdee77e 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
-@@ -925,12 +925,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+@@ -925,6 +925,12 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
  		/* ...but clean it before doing the actual write */
  		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
  
--		/* Check that address+len does not cross page boundary */
--		if ((vcpu->arch.time_offset +
--			sizeof(struct pvclock_vcpu_time_info) - 1)
--			& PAGE_MASK)
--			break;
--
++		/* Check that address+len does not cross page boundary */
++		if ((vcpu->arch.time_offset +
++			sizeof(struct pvclock_vcpu_time_info) - 1)
++			& PAGE_MASK)
++			break;
++
  		vcpu->arch.time_page =
  				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
  
-@@ -4719,9 +4713,6 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+@@ -4713,6 +4719,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
  	int pending_vec, max_bits;
  	struct descriptor_table dt;
  
--	if (sregs->cr4 & X86_CR4_OSXSAVE)
--		return -EINVAL;
--
++	if (sregs->cr4 & X86_CR4_OSXSAVE)
++		return -EINVAL;
++
  	vcpu_load(vcpu);
  
  	dt.limit = sregs->idt.limit;
 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index df87450..249ad57 100644
+index 249ad57..df87450 100644
 --- a/arch/x86/mm/fault.c
 +++ b/arch/x86/mm/fault.c
-@@ -376,12 +376,10 @@ static noinline int vmalloc_fault(unsigned long address)
+@@ -376,10 +376,12 @@ static noinline int vmalloc_fault(unsigned long address)
  	if (pgd_none(*pgd_ref))
  		return -1;
  
--	if (pgd_none(*pgd)) {
-+	if (pgd_none(*pgd))
+-	if (pgd_none(*pgd))
++	if (pgd_none(*pgd)) {
  		set_pgd(pgd, *pgd_ref);
--		arch_flush_lazy_mmu_mode();
--	} else {
-+	else
+-	else
++		arch_flush_lazy_mmu_mode();
++	} else {
  		BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
--	}
++	}
  
  	/*
  	 * Below here mismatches are bugs because these lower tables
 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index ccbc61b..7d095ad 100644
+index 7d095ad..ccbc61b 100644
 --- a/arch/x86/mm/init_64.c
 +++ b/arch/x86/mm/init_64.c
-@@ -839,9 +839,6 @@ int kern_addr_valid(unsigned long addr)
+@@ -839,6 +839,9 @@ int kern_addr_valid(unsigned long addr)
  	if (pud_none(*pud))
  		return 0;
  
--	if (pud_large(*pud))
--		return pfn_valid(pud_pfn(*pud));
--
++	if (pud_large(*pud))
++		return pfn_valid(pud_pfn(*pud));
++
  	pmd = pmd_offset(pud, addr);
  	if (pmd_none(*pmd))
  		return 0;
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 126a093..d52f895 100644
+index d52f895..126a093 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
-@@ -776,16 +776,7 @@ static void xen_write_cr4(unsigned long cr4)
+@@ -776,7 +776,16 @@ static void xen_write_cr4(unsigned long cr4)
  
  	native_write_cr4(cr4);
  }
--#ifdef CONFIG_X86_64
--static inline unsigned long xen_read_cr8(void)
--{
--	return 0;
--}
--static inline void xen_write_cr8(unsigned long val)
--{
--	BUG_ON(val);
--}
--#endif
-+
+-
++#ifdef CONFIG_X86_64
++static inline unsigned long xen_read_cr8(void)
++{
++	return 0;
++}
++static inline void xen_write_cr8(unsigned long val)
++{
++	BUG_ON(val);
++}
++#endif
  static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
  {
  	int ret;
-@@ -951,11 +942,6 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
+@@ -942,6 +951,11 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
  	.read_cr4_safe = native_read_cr4_safe,
  	.write_cr4 = xen_write_cr4,
  
--#ifdef CONFIG_X86_64
--	.read_cr8 = xen_read_cr8,
--	.write_cr8 = xen_write_cr8,
--#endif
--
++#ifdef CONFIG_X86_64
++	.read_cr8 = xen_read_cr8,
++	.write_cr8 = xen_write_cr8,
++#endif
++
  	.wbinvd = native_wbinvd,
  
  	.read_msr = native_read_msr_safe,
-@@ -966,8 +952,6 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
+@@ -952,6 +966,8 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
  	.read_tsc = native_read_tsc,
  	.read_pmc = native_read_pmc,
  
--	.read_tscp = native_read_tscp,
--
++	.read_tscp = native_read_tscp,
++
  	.iret = xen_iret,
  	.irq_enable_sysexit = xen_sysexit,
  #ifdef CONFIG_X86_64
 diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
-index d05bd11..9a95a9c 100644
+index 9a95a9c..d05bd11 100644
 --- a/arch/x86/xen/xen-asm_32.S
 +++ b/arch/x86/xen/xen-asm_32.S
 @@ -88,11 +88,11 @@ ENTRY(xen_iret)
  	 */
  #ifdef CONFIG_SMP
  	GET_THREAD_INFO(%eax)
--	movl %ss:TI_cpu(%eax), %eax
--	movl %ss:__per_cpu_offset(,%eax,4), %eax
--	mov %ss:per_cpu__xen_vcpu(%eax), %eax
-+	movl TI_cpu(%eax), %eax
-+	movl __per_cpu_offset(,%eax,4), %eax
-+	mov per_cpu__xen_vcpu(%eax), %eax
+-	movl TI_cpu(%eax), %eax
+-	movl __per_cpu_offset(,%eax,4), %eax
+-	mov per_cpu__xen_vcpu(%eax), %eax
++	movl %ss:TI_cpu(%eax), %eax
++	movl %ss:__per_cpu_offset(,%eax,4), %eax
++	mov %ss:per_cpu__xen_vcpu(%eax), %eax
  #else
--	movl %ss:per_cpu__xen_vcpu, %eax
-+	movl per_cpu__xen_vcpu, %eax
+-	movl per_cpu__xen_vcpu, %eax
++	movl %ss:per_cpu__xen_vcpu, %eax
  #endif
  
  	/* check IF state we're restoring */
@@ -487,13 +474,13 @@ index d05bd11..9a95a9c 100644
  	 * resuming the code, so we don't have to be worried about
  	 * being preempted to another CPU.
  	 */
--	setz %ss:XEN_vcpu_info_mask(%eax)
-+	setz XEN_vcpu_info_mask(%eax)
+-	setz XEN_vcpu_info_mask(%eax)
++	setz %ss:XEN_vcpu_info_mask(%eax)
  xen_iret_start_crit:
  
  	/* check for unmasked and pending */
--	cmpw $0x0001, %ss:XEN_vcpu_info_pending(%eax)
-+	cmpw $0x0001, XEN_vcpu_info_pending(%eax)
+-	cmpw $0x0001, XEN_vcpu_info_pending(%eax)
++	cmpw $0x0001, %ss:XEN_vcpu_info_pending(%eax)
  
  	/*
  	 * If there's something pending, mask events again so we can
@@ -501,175 +488,175 @@ index d05bd11..9a95a9c 100644
  	 * touch XEN_vcpu_info_mask.
  	 */
  	jne 1f
--	movb $1, %ss:XEN_vcpu_info_mask(%eax)
-+	movb $1, XEN_vcpu_info_mask(%eax)
+-	movb $1, XEN_vcpu_info_mask(%eax)
++	movb $1, %ss:XEN_vcpu_info_mask(%eax)
  
  1:	popl %eax
  
 diff --git a/arch/xtensa/include/asm/signal.h b/arch/xtensa/include/asm/signal.h
-index 75edf8a..633ba73 100644
+index 633ba73..75edf8a 100644
 --- a/arch/xtensa/include/asm/signal.h
 +++ b/arch/xtensa/include/asm/signal.h
-@@ -133,7 +133,6 @@ struct sigaction {
+@@ -133,6 +133,7 @@ struct sigaction {
  	void (*sa_restorer)(void);
  	sigset_t sa_mask;		/* mask last for extensibility */
  };
--#define __ARCH_HAS_SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
  
  struct k_sigaction {
  	struct sigaction sa;
 diff --git a/block/blk-core.c b/block/blk-core.c
-index 4058f46..cffd737 100644
+index cffd737..4058f46 100644
 --- a/block/blk-core.c
 +++ b/block/blk-core.c
-@@ -865,9 +865,6 @@ struct request *blk_get_request(struct request_queue *q, int rw, gfp_t gfp_mask)
+@@ -865,6 +865,9 @@ struct request *blk_get_request(struct request_queue *q, int rw, gfp_t gfp_mask)
  {
  	struct request *rq;
  
--	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
--		return NULL;
--
++	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags)))
++		return NULL;
++
  	BUG_ON(rw != READ && rw != WRITE);
  
  	spin_lock_irq(q->queue_lock);
-@@ -1152,7 +1149,7 @@ void init_request_from_bio(struct request *req, struct bio *bio)
+@@ -1149,7 +1152,7 @@ void init_request_from_bio(struct request *req, struct bio *bio)
   */
  static inline bool queue_should_plug(struct request_queue *q)
  {
--	return !(blk_queue_nonrot(q) && blk_queue_tagged(q));
-+	return !(blk_queue_nonrot(q) && blk_queue_queuing(q));
+-	return !(blk_queue_nonrot(q) && blk_queue_queuing(q));
++	return !(blk_queue_nonrot(q) && blk_queue_tagged(q));
  }
  
  static int __make_request(struct request_queue *q, struct bio *bio)
-@@ -1864,8 +1861,15 @@ void blk_dequeue_request(struct request *rq)
+@@ -1861,15 +1864,8 @@ void blk_dequeue_request(struct request *rq)
  	 * and to it is freed is accounted as io that is in progress at
  	 * the driver side.
  	 */
--	if (blk_account_rq(rq))
-+	if (blk_account_rq(rq)) {
+-	if (blk_account_rq(rq)) {
++	if (blk_account_rq(rq))
  		q->in_flight[rq_is_sync(rq)]++;
-+		/*
-+		 * Mark this device as supporting hardware queuing, if
-+		 * we have more IOs in flight than 4.
-+		 */
-+		if (!blk_queue_queuing(q) && queue_in_flight(q) > 4)
-+			set_bit(QUEUE_FLAG_CQ, &q->queue_flags);
-+	}
+-		/*
+-		 * Mark this device as supporting hardware queuing, if
+-		 * we have more IOs in flight than 4.
+-		 */
+-		if (!blk_queue_queuing(q) && queue_in_flight(q) > 4)
+-			set_bit(QUEUE_FLAG_CQ, &q->queue_flags);
+-	}
  }
  
  /**
 diff --git a/block/blk-exec.c b/block/blk-exec.c
-index 85bd7b4..49557e9 100644
+index 49557e9..85bd7b4 100644
 --- a/block/blk-exec.c
 +++ b/block/blk-exec.c
-@@ -50,13 +50,6 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
+@@ -50,6 +50,13 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
  {
  	int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
  
--	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) {
--		rq->errors = -ENXIO;
--		if (rq->end_io)
--			rq->end_io(rq, rq->errors);
--		return;
--	}
--
++	if (unlikely(test_bit(QUEUE_FLAG_DEAD, &q->queue_flags))) {
++		rq->errors = -ENXIO;
++		if (rq->end_io)
++			rq->end_io(rq, rq->errors);
++		return;
++	}
++
  	rq->rq_disk = bd_disk;
  	rq->end_io = done;
  	WARN_ON(irqs_disabled());
 diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
-index 123eb17..2be0a97 100644
+index 2be0a97..123eb17 100644
 --- a/block/scsi_ioctl.c
 +++ b/block/scsi_ioctl.c
-@@ -720,14 +720,11 @@ int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
+@@ -720,11 +720,14 @@ int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd)
  		break;
  	}
  
--	if (capable(CAP_SYS_RAWIO))
--		return 0;
--
++	if (capable(CAP_SYS_RAWIO))
++		return 0;
++
  	/* In particular, rule out all resets and host-specific ioctls.  */
  	printk_ratelimited(KERN_WARNING
  			   "%s: sending ioctl %x to a partition!\n", current->comm, cmd);
  
--	return -ENOTTY;
-+	return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
+-	return capable(CAP_SYS_RAWIO) ? 0 : -ENOTTY;
++	return -ENOTTY;
  }
  EXPORT_SYMBOL(scsi_verify_blk_ioctl);
  
 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
-index 9e1bf69..3533582 100644
+index 3533582..9e1bf69 100644
 --- a/crypto/cryptd.c
 +++ b/crypto/cryptd.c
-@@ -116,18 +116,13 @@ static void cryptd_queue_worker(struct work_struct *work)
+@@ -116,13 +116,18 @@ static void cryptd_queue_worker(struct work_struct *work)
  	struct crypto_async_request *req, *backlog;
  
  	cpu_queue = container_of(work, struct cryptd_cpu_queue, work);
--	/*
--	 * Only handle one request at a time to avoid hogging crypto workqueue.
--	 * preempt_disable/enable is used to prevent being preempted by
--	 * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
--	 * cryptd_enqueue_request() being accessed from software interrupts.
--	 */
--	local_bh_disable();
-+	/* Only handle one request at a time to avoid hogging crypto
-+	 * workqueue. preempt_disable/enable is used to prevent
-+	 * being preempted by cryptd_enqueue_request() */
+-	/* Only handle one request at a time to avoid hogging crypto
+-	 * workqueue. preempt_disable/enable is used to prevent
+-	 * being preempted by cryptd_enqueue_request() */
++	/*
++	 * Only handle one request at a time to avoid hogging crypto workqueue.
++	 * preempt_disable/enable is used to prevent being preempted by
++	 * cryptd_enqueue_request(). local_bh_disable/enable is used to prevent
++	 * cryptd_enqueue_request() being accessed from software interrupts.
++	 */
++	local_bh_disable();
  	preempt_disable();
  	backlog = crypto_get_backlog(&cpu_queue->queue);
  	req = crypto_dequeue_request(&cpu_queue->queue);
  	preempt_enable();
--	local_bh_enable();
++	local_bh_enable();
  
  	if (!req)
  		return;
 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index 70e9ed1..a6ad608 100644
+index a6ad608..70e9ed1 100644
 --- a/drivers/acpi/processor_idle.c
 +++ b/drivers/acpi/processor_idle.c
-@@ -1071,9 +1071,6 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
+@@ -1071,6 +1071,9 @@ static int acpi_processor_setup_cpuidle(struct acpi_processor *pr)
  		return -EINVAL;
  	}
  
--	if (!dev)
--		return -EINVAL;
--
++	if (!dev)
++		return -EINVAL;
++
  	dev->cpu = pr->id;
  	for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
  		dev->states[i].name[0] = '\0';
 diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index 57e895a1..553edcc 100644
+index 553edcc..57e895a1 100644
 --- a/drivers/ata/libata-scsi.c
 +++ b/drivers/ata/libata-scsi.c
-@@ -338,8 +338,7 @@ ata_scsi_activity_show(struct device *dev, struct device_attribute *attr,
+@@ -338,7 +338,8 @@ ata_scsi_activity_show(struct device *dev, struct device_attribute *attr,
  	struct ata_port *ap = ata_shost_to_port(sdev->host);
  	struct ata_device *atadev = ata_scsi_find_dev(ap, sdev);
  
--	if (atadev && ap->ops->sw_activity_show &&
--	    (ap->flags & ATA_FLAG_SW_ACTIVITY))
-+	if (ap->ops->sw_activity_show && (ap->flags & ATA_FLAG_SW_ACTIVITY))
+-	if (ap->ops->sw_activity_show && (ap->flags & ATA_FLAG_SW_ACTIVITY))
++	if (atadev && ap->ops->sw_activity_show &&
++	    (ap->flags & ATA_FLAG_SW_ACTIVITY))
  		return ap->ops->sw_activity_show(atadev, buf);
  	return -EINVAL;
  }
-@@ -354,8 +353,7 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
+@@ -353,7 +354,8 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
  	enum sw_activity val;
  	int rc;
  
--	if (atadev && ap->ops->sw_activity_store &&
--	    (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
-+	if (ap->ops->sw_activity_store && (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
+-	if (ap->ops->sw_activity_store && (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
++	if (atadev && ap->ops->sw_activity_store &&
++	    (ap->flags & ATA_FLAG_SW_ACTIVITY)) {
  		val = simple_strtoul(buf, NULL, 0);
  		switch (val) {
  		case OFF: case BLINK_ON: case BLINK_OFF:
 diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 6f1ba10..63c143e 100644
+index 63c143e..6f1ba10 100644
 --- a/drivers/base/bus.c
 +++ b/drivers/base/bus.c
 @@ -289,7 +289,7 @@ int bus_for_each_dev(struct bus_type *bus, struct device *start,
  	struct device *dev;
  	int error = 0;
  
--	if (!bus || !bus->p)
-+	if (!bus)
+-	if (!bus)
++	if (!bus || !bus->p)
  		return -EINVAL;
  
  	klist_iter_init_node(&bus->p->klist_devices, &i,
@@ -677,37 +664,37 @@ index 6f1ba10..63c143e 100644
  	struct klist_iter i;
  	struct device *dev;
  
--	if (!bus || !bus->p)
-+	if (!bus)
+-	if (!bus)
++	if (!bus || !bus->p)
  		return NULL;
  
  	klist_iter_init_node(&bus->p->klist_devices, &i,
 diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
-index a65a574..7b98c06 100644
+index 7b98c06..a65a574 100644
 --- a/drivers/char/ipmi/ipmi_bt_sm.c
 +++ b/drivers/char/ipmi/ipmi_bt_sm.c
 @@ -95,9 +95,9 @@ struct si_sm_data {
  	enum bt_states	state;
  	unsigned char	seq;		/* BT sequence number */
  	struct si_sm_io	*io;
--	unsigned char	write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
-+	unsigned char	write_data[IPMI_MAX_MSG_LENGTH];
+-	unsigned char	write_data[IPMI_MAX_MSG_LENGTH];
++	unsigned char	write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
  	int		write_count;
--	unsigned char	read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
-+	unsigned char	read_data[IPMI_MAX_MSG_LENGTH];
+-	unsigned char	read_data[IPMI_MAX_MSG_LENGTH];
++	unsigned char	read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
  	int		read_count;
  	int		truncated;
  	long		timeout;	/* microseconds countdown */
 diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
-index 51e0e2d..a330492 100644
+index a330492..51e0e2d 100644
 --- a/drivers/firmware/pcdp.c
 +++ b/drivers/firmware/pcdp.c
 @@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
  	if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
  		return -ENODEV;
  
--	pcdp = ioremap(efi.hcdp, 4096);
-+	pcdp = early_ioremap(efi.hcdp, 4096);
+-	pcdp = early_ioremap(efi.hcdp, 4096);
++	pcdp = ioremap(efi.hcdp, 4096);
  	printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
  
  	if (strstr(cmdline, "console=hcdp")) {
@@ -715,471 +702,449 @@ index 51e0e2d..a330492 100644
  	}
  
  out:
--	iounmap(pcdp);
-+	early_iounmap(pcdp, 4096);
+-	early_iounmap(pcdp, 4096);
++	iounmap(pcdp);
  	return rc;
  }
 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
-index f6a23ec..b4b2257 100644
+index b4b2257..f6a23ec 100644
 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
 +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
 @@ -157,7 +157,7 @@ static int ipoib_stop(struct net_device *dev)
  
  	netif_stop_queue(dev);
  
--	ipoib_ib_dev_down(dev, 1);
-+	ipoib_ib_dev_down(dev, 0);
+-	ipoib_ib_dev_down(dev, 0);
++	ipoib_ib_dev_down(dev, 1);
  	ipoib_ib_dev_stop(dev, 0);
  
  	if (!test_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags)) {
 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-index bd656a7..8763c1e 100644
+index 8763c1e..bd656a7 100644
 --- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
 +++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
-@@ -188,9 +188,7 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
+@@ -188,7 +188,9 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
  
  	mcast->mcmember = *mcmember;
  
--	/* Set the multicast MTU and cached Q_Key before we attach if it's
--	 * the broadcast group.
--	 */
-+	/* Set the cached Q_Key before we attach if it's the broadcast group */
+-	/* Set the cached Q_Key before we attach if it's the broadcast group */
++	/* Set the multicast MTU and cached Q_Key before we attach if it's
++	 * the broadcast group.
++	 */
  	if (!memcmp(mcast->mcmember.mgid.raw, priv->dev->broadcast + 4,
  		    sizeof (union ib_gid))) {
  		spin_lock_irq(&priv->lock);
-@@ -198,17 +196,10 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
+@@ -196,10 +198,17 @@ static int ipoib_mcast_join_finish(struct ipoib_mcast *mcast,
  			spin_unlock_irq(&priv->lock);
  			return -EAGAIN;
  		}
--		priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
++		priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
  		priv->qkey = be32_to_cpu(priv->broadcast->mcmember.qkey);
  		spin_unlock_irq(&priv->lock);
  		priv->tx_wr.wr.ud.remote_qkey = priv->qkey;
  		set_qkey = 1;
--
--		if (!ipoib_cm_admin_enabled(dev)) {
--			rtnl_lock();
--			dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
--			rtnl_unlock();
--		}
++
++		if (!ipoib_cm_admin_enabled(dev)) {
++			rtnl_lock();
++			dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
++			rtnl_unlock();
++		}
  	}
  
  	if (!test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
-@@ -597,6 +588,14 @@ void ipoib_mcast_join_task(struct work_struct *work)
+@@ -588,14 +597,6 @@ void ipoib_mcast_join_task(struct work_struct *work)
  		return;
  	}
  
-+	priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
-+
-+	if (!ipoib_cm_admin_enabled(dev)) {
-+		rtnl_lock();
-+		dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
-+		rtnl_unlock();
-+	}
-+
+-	priv->mcast_mtu = IPOIB_UD_MTU(ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu));
+-
+-	if (!ipoib_cm_admin_enabled(dev)) {
+-		rtnl_lock();
+-		dev_set_mtu(dev, min(priv->mcast_mtu, priv->admin_mtu));
+-		rtnl_unlock();
+-	}
+-
  	ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
  
  	clear_bit(IPOIB_MCAST_RUN, &priv->flags);
 diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
-index 22446f7..a335c85 100644
+index a335c85..22446f7 100644
 --- a/drivers/isdn/isdnloop/isdnloop.c
 +++ b/drivers/isdn/isdnloop/isdnloop.c
-@@ -15,6 +15,7 @@
+@@ -15,7 +15,6 @@
  #include <linux/sched.h>
  #include "isdnloop.h"
  
-+static char *revision = "$Revision: 1.11.6.7 $";
+-static char *revision = "$Revision: 1.11.6.7 $";
  static char *isdnloop_id = "loop0";
  
  MODULE_DESCRIPTION("ISDN4Linux: Pseudo Driver that simulates an ISDN card");
-@@ -1492,6 +1493,17 @@ isdnloop_addcard(char *id1)
+@@ -1493,17 +1492,6 @@ isdnloop_addcard(char *id1)
  static int __init
  isdnloop_init(void)
  {
-+	char *p;
-+	char rev[10];
-+
-+	if ((p = strchr(revision, ':'))) {
-+		strcpy(rev, p + 1);
-+		p = strchr(rev, '$');
-+		*p = 0;
-+	} else
-+		strcpy(rev, " ??? ");
-+	printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
-+
+-	char *p;
+-	char rev[10];
+-
+-	if ((p = strchr(revision, ':'))) {
+-		strcpy(rev, p + 1);
+-		p = strchr(rev, '$');
+-		*p = 0;
+-	} else
+-		strcpy(rev, " ??? ");
+-	printk(KERN_NOTICE "isdnloop-ISDN-driver Rev%s\n", rev);
+-
  	if (isdnloop_id)
  		return (isdnloop_addcard(isdnloop_id));
  
 diff --git a/drivers/net/bonding/bonding.h b/drivers/net/bonding/bonding.h
-index 5d127fc..6824771 100644
+index 6824771..5d127fc 100644
 --- a/drivers/net/bonding/bonding.h
 +++ b/drivers/net/bonding/bonding.h
 @@ -236,11 +236,11 @@ static inline struct slave *bond_get_slave_by_dev(struct bonding *bond, struct n
  
  	bond_for_each_slave(bond, slave, i) {
  		if (slave->dev == slave_dev) {
--			return slave;
-+			break;
+-			break;
++			return slave;
  		}
  	}
  
--	return 0;
-+	return slave;
+-	return slave;
++	return 0;
  }
  
  static inline struct bonding *bond_get_bond_by_slave(struct slave *slave)
 diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
-index 7ddbb8e..3ebe50c 100644
+index 3ebe50c..7ddbb8e 100644
 --- a/drivers/net/r8169.c
 +++ b/drivers/net/r8169.c
-@@ -176,7 +176,6 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
+@@ -176,6 +176,7 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
  	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8168), 0, 0, RTL_CFG_1 },
  	{ PCI_DEVICE(PCI_VENDOR_ID_REALTEK,	0x8169), 0, 0, RTL_CFG_0 },
  	{ PCI_DEVICE(PCI_VENDOR_ID_DLINK,	0x4300), 0, 0, RTL_CFG_0 },
--	{ PCI_DEVICE(PCI_VENDOR_ID_DLINK,	0x4302), 0, 0, RTL_CFG_0 },
++	{ PCI_DEVICE(PCI_VENDOR_ID_DLINK,	0x4302), 0, 0, RTL_CFG_0 },
  	{ PCI_DEVICE(PCI_VENDOR_ID_AT,		0xc107), 0, 0, RTL_CFG_0 },
  	{ PCI_DEVICE(0x16ec,			0x0116), 0, 0, RTL_CFG_0 },
  	{ PCI_VENDOR_ID_LINKSYS,		0x1032,
-@@ -1307,7 +1306,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
+@@ -1306,7 +1307,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
  		{ 0x7c800000, 0x28000000,	RTL_GIGA_MAC_VER_26 },
  
  		/* 8168C family. */
--		{ 0x7cf00000, 0x3cb00000,	RTL_GIGA_MAC_VER_24 },
-+		{ 0x7cf00000, 0x3ca00000,	RTL_GIGA_MAC_VER_24 },
+-		{ 0x7cf00000, 0x3ca00000,	RTL_GIGA_MAC_VER_24 },
++		{ 0x7cf00000, 0x3cb00000,	RTL_GIGA_MAC_VER_24 },
  		{ 0x7cf00000, 0x3c900000,	RTL_GIGA_MAC_VER_23 },
  		{ 0x7cf00000, 0x3c800000,	RTL_GIGA_MAC_VER_18 },
  		{ 0x7c800000, 0x3c800000,	RTL_GIGA_MAC_VER_24 },
-@@ -3077,7 +3076,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+@@ -3076,7 +3077,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
  		goto err_out_mwi_3;
  	}
  
--	tp->cp_cmd = RxChkSum;
-+	tp->cp_cmd = PCIMulRW | RxChkSum;
+-	tp->cp_cmd = PCIMulRW | RxChkSum;
++	tp->cp_cmd = RxChkSum;
  
  	if ((sizeof(dma_addr_t) > 4) &&
  	    !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && use_dac) {
-@@ -3825,7 +3824,8 @@ static void rtl_hw_start_8168(struct net_device *dev)
+@@ -3824,8 +3825,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
  	Cxpl_dbg_sel | \
  	ASF | \
  	PktCntrDisable | \
--	Mac_dbgo_sel)
-+	PCIDAC | \
-+	PCIMulRW)
+-	PCIDAC | \
+-	PCIMulRW)
++	Mac_dbgo_sel)
  
  static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
  {
-@@ -3855,6 +3855,8 @@ static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
+@@ -3855,8 +3855,6 @@ static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
  	if ((cfg1 & LEDS0) && (cfg1 & LEDS1))
  		RTL_W8(Config1, cfg1 & ~LEDS0);
  
-+	RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
-+
+-	RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
+-
  	rtl_ephy_init(ioaddr, e_info_8102e_1, ARRAY_SIZE(e_info_8102e_1));
  }
  
-@@ -3866,6 +3868,8 @@ static void rtl_hw_start_8102e_2(void __iomem *ioaddr, struct pci_dev *pdev)
+@@ -3868,8 +3866,6 @@ static void rtl_hw_start_8102e_2(void __iomem *ioaddr, struct pci_dev *pdev)
  
  	RTL_W8(Config1, MEMMAP | IOMAP | VPD | PMEnable);
  	RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
-+
-+	RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
+-
+-	RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
  }
  
  static void rtl_hw_start_8102e_3(void __iomem *ioaddr, struct pci_dev *pdev)
-@@ -3891,8 +3895,6 @@ static void rtl_hw_start_8101(struct net_device *dev)
+@@ -3895,6 +3891,8 @@ static void rtl_hw_start_8101(struct net_device *dev)
  		}
  	}
  
--	RTL_W8(Cfg9346, Cfg9346_Unlock);
--
++	RTL_W8(Cfg9346, Cfg9346_Unlock);
++
  	switch (tp->mac_version) {
  	case RTL_GIGA_MAC_VER_07:
  		rtl_hw_start_8102e_1(ioaddr, pdev);
-@@ -3907,13 +3909,14 @@ static void rtl_hw_start_8101(struct net_device *dev)
+@@ -3909,14 +3907,13 @@ static void rtl_hw_start_8101(struct net_device *dev)
  		break;
  	}
  
--	RTL_W8(Cfg9346, Cfg9346_Lock);
-+	RTL_W8(Cfg9346, Cfg9346_Unlock);
+-	RTL_W8(Cfg9346, Cfg9346_Unlock);
++	RTL_W8(Cfg9346, Cfg9346_Lock);
  
  	RTL_W8(EarlyTxThres, EarlyTxThld);
  
  	rtl_set_rx_max_size(ioaddr, tp->rx_buf_sz);
  
--	tp->cp_cmd &= ~R810X_CPCMD_QUIRK_MASK;
-+	tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
-+
+-	tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
+-
++	tp->cp_cmd &= ~R810X_CPCMD_QUIRK_MASK;
  	RTL_W16(CPlusCmd, tp->cp_cmd);
  
  	RTL_W16(IntrMitigate, 0x0000);
-@@ -3923,10 +3926,14 @@ static void rtl_hw_start_8101(struct net_device *dev)
+@@ -3926,14 +3923,10 @@ static void rtl_hw_start_8101(struct net_device *dev)
  	RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
  	rtl_set_rx_tx_config_registers(tp);
  
-+	RTL_W8(Cfg9346, Cfg9346_Lock);
-+
+-	RTL_W8(Cfg9346, Cfg9346_Lock);
+-
  	RTL_R8(IntrMask);
  
  	rtl_set_rx_mode(dev);
  
-+	RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
-+
+-	RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
+-
  	RTL_W16(MultiIntr, RTL_R16(MultiIntr) & 0xf000);
  
  	RTL_W16(IntrMask, tp->intr_event);
-@@ -4572,6 +4579,13 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
+@@ -4579,13 +4572,6 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
  			dev->stats.rx_bytes += pkt_size;
  			dev->stats.rx_packets++;
  		}
-+
-+		/* Work around for AMD plateform. */
-+		if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
-+		    (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
-+			desc->opts2 = 0;
-+			cur_rx++;
-+		}
+-
+-		/* Work around for AMD plateform. */
+-		if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
+-		    (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
+-			desc->opts2 = 0;
+-			cur_rx++;
+-		}
  	}
  
  	count = cur_rx - tp->cur_rx;
 diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
-index 89aa69c..fd6622c 100644
+index fd6622c..89aa69c 100644
 --- a/drivers/net/tg3.c
 +++ b/drivers/net/tg3.c
-@@ -4994,9 +4994,6 @@ static void tg3_poll_controller(struct net_device *dev)
+@@ -4994,6 +4994,9 @@ static void tg3_poll_controller(struct net_device *dev)
  	int i;
  	struct tg3 *tp = netdev_priv(dev);
  
--	if (tg3_irq_sync(tp))
--		return;
--
++	if (tg3_irq_sync(tp))
++		return;
++
  	for (i = 0; i < tp->irq_cnt; i++)
  		tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
  }
-@@ -13891,7 +13888,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
+@@ -13888,6 +13891,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
  	tp->pm_cap = pm_cap;
  	tp->rx_mode = TG3_DEF_RX_MODE;
  	tp->tx_mode = TG3_DEF_TX_MODE;
--	tp->irq_sync = 1;
++	tp->irq_sync = 1;
  
  	if (tg3_debug > 0)
  		tp->msg_enable = tg3_debug;
 diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
-index fc0fc85..c3968fad 100644
+index c3968fad..fc0fc85 100644
 --- a/drivers/net/wireless/b43legacy/main.c
 +++ b/drivers/net/wireless/b43legacy/main.c
-@@ -3870,8 +3870,6 @@ static void b43legacy_remove(struct ssb_device *dev)
+@@ -3870,6 +3870,8 @@ static void b43legacy_remove(struct ssb_device *dev)
  	cancel_work_sync(&wldev->restart_work);
  
  	B43legacy_WARN_ON(!wl);
--	if (!wldev->fw.ucode)
--		return;			/* NULL if fw never loaded */
++	if (!wldev->fw.ucode)
++		return;			/* NULL if fw never loaded */
  	if (wl->current_dev == wldev)
  		ieee80211_unregister_hw(wl->hw);
  
 diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
-index 1ab55d6..5c8d763 100644
+index 5c8d763..1ab55d6 100644
 --- a/drivers/scsi/bnx2i/bnx2i_hwi.c
 +++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
-@@ -1156,9 +1156,6 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
+@@ -1156,6 +1156,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
  	int rc = 0;
  	u64 mask64;
  
--	memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
--	memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
--
++	memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
++	memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
++
  	bnx2i_adjust_qp_size(hba);
  
  	iscsi_init.flags =
 diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
-index 48ae81b..7767b8f 100644
+index 7767b8f..48ae81b 100644
 --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
 +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
-@@ -750,11 +750,8 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
+@@ -750,8 +750,11 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
  		    (u32)mpt2sas_base_get_sense_buffer_dma(ioc, smid);
  		priv_sense = mpt2sas_base_get_sense_buffer(ioc, smid);
  		memset(priv_sense, 0, SCSI_SENSE_BUFFERSIZE);
--		if (mpi_request->Function == MPI2_FUNCTION_SCSI_IO_REQUEST)
--			mpt2sas_base_put_smid_scsi_io(ioc, smid,
--			    le16_to_cpu(mpi_request->FunctionDependent1));
--		else
--			mpt2sas_base_put_smid_default(ioc, smid);
-+		mpt2sas_base_put_smid_scsi_io(ioc, smid,
-+		    le16_to_cpu(mpi_request->FunctionDependent1));
+-		mpt2sas_base_put_smid_scsi_io(ioc, smid,
+-		    le16_to_cpu(mpi_request->FunctionDependent1));
++		if (mpi_request->Function == MPI2_FUNCTION_SCSI_IO_REQUEST)
++			mpt2sas_base_put_smid_scsi_io(ioc, smid,
++			    le16_to_cpu(mpi_request->FunctionDependent1));
++		else
++			mpt2sas_base_put_smid_default(ioc, smid);
  		break;
  	}
  	case MPI2_FUNCTION_SCSI_TASK_MGMT:
 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index 933f1c5..e28f9b0 100644
+index e28f9b0..933f1c5 100644
 --- a/drivers/scsi/scsi_lib.c
 +++ b/drivers/scsi/scsi_lib.c
-@@ -215,8 +215,6 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
+@@ -215,6 +215,8 @@ int scsi_execute(struct scsi_device *sdev, const unsigned char *cmd,
  	int ret = DRIVER_ERROR << 24;
  
  	req = blk_get_request(sdev->request_queue, write, __GFP_WAIT);
--	if (!req)
--		return ret;
++	if (!req)
++		return ret;
  
  	if (bufflen &&	blk_rq_map_kern(sdev->request_queue, req,
  					buffer, bufflen, __GFP_WAIT))
 diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
-index 12e1e9e..6a451e8 100644
+index 6a451e8..12e1e9e 100644
 --- a/drivers/serial/8250.c
 +++ b/drivers/serial/8250.c
 @@ -81,7 +81,7 @@ static unsigned int skip_txen_test; /* force skip of txen test at init time */
  #define DEBUG_INTR(fmt...)	do { } while (0)
  #endif
  
--#define PASS_LIMIT	512
-+#define PASS_LIMIT	256
+-#define PASS_LIMIT	256
++#define PASS_LIMIT	512
  
  #define BOTH_EMPTY 	(UART_LSR_TEMT | UART_LSR_THRE)
  
 diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
-index 90810e8..908f25a 100644
+index 908f25a..90810e8 100644
 --- a/drivers/staging/comedi/comedi_fops.c
 +++ b/drivers/staging/comedi/comedi_fops.c
 @@ -809,7 +809,7 @@ static int parse_insn(struct comedi_device *dev, struct comedi_insn *insn,
  				ret = -EAGAIN;
  				break;
  			}
--			ret = s->async->inttrig(dev, s, data[0]);
-+			ret = s->async->inttrig(dev, s, insn->data[0]);
+-			ret = s->async->inttrig(dev, s, insn->data[0]);
++			ret = s->async->inttrig(dev, s, data[0]);
  			if (ret >= 0)
  				ret = 1;
  			break;
-@@ -1035,6 +1035,7 @@ static int do_cmd_ioctl(struct comedi_device *dev, void *arg, void *file)
+@@ -1035,7 +1035,6 @@ static int do_cmd_ioctl(struct comedi_device *dev, void *arg, void *file)
  		goto cleanup;
  	}
  
-+	kfree(async->cmd.chanlist);
+-	kfree(async->cmd.chanlist);
  	async->cmd = user_cmd;
  	async->cmd.data = NULL;
  	/* load channel/gain list */
-@@ -1498,7 +1499,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
+@@ -1499,7 +1498,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
  
  	mask = 0;
  	read_subdev = comedi_get_read_subdevice(dev_file_info);
--	if (read_subdev && read_subdev->async) {
-+	if (read_subdev) {
+-	if (read_subdev) {
++	if (read_subdev && read_subdev->async) {
  		poll_wait(file, &read_subdev->async->wait_head, wait);
  		if (!read_subdev->busy
  		    || comedi_buf_read_n_available(read_subdev->async) > 0
-@@ -1508,7 +1509,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
+@@ -1509,7 +1508,7 @@ static unsigned int comedi_poll(struct file *file, poll_table * wait)
  		}
  	}
  	write_subdev = comedi_get_write_subdevice(dev_file_info);
--	if (write_subdev && write_subdev->async) {
-+	if (write_subdev) {
+-	if (write_subdev) {
++	if (write_subdev && write_subdev->async) {
  		poll_wait(file, &write_subdev->async->wait_head, wait);
  		comedi_buf_write_alloc(write_subdev->async,
  				       write_subdev->async->prealloc_bufsz);
-@@ -1550,7 +1551,7 @@ static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
+@@ -1551,7 +1550,7 @@ static ssize_t comedi_write(struct file *file, const char *buf, size_t nbytes,
  	}
  
  	s = comedi_get_write_subdevice(dev_file_info);
--	if (s == NULL || s->async == NULL) {
-+	if (s == NULL) {
+-	if (s == NULL) {
++	if (s == NULL || s->async == NULL) {
  		retval = -EIO;
  		goto done;
  	}
-@@ -1658,7 +1659,7 @@ static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
+@@ -1659,7 +1658,7 @@ static ssize_t comedi_read(struct file *file, char *buf, size_t nbytes,
  	}
  
  	s = comedi_get_read_subdevice(dev_file_info);
--	if (s == NULL || s->async == NULL) {
-+	if (s == NULL) {
+-	if (s == NULL) {
++	if (s == NULL || s->async == NULL) {
  		retval = -EIO;
  		goto done;
  	}
-@@ -1758,8 +1759,6 @@ void do_become_nonbusy(struct comedi_device *dev, struct comedi_subdevice *s)
+@@ -1759,6 +1758,8 @@ void do_become_nonbusy(struct comedi_device *dev, struct comedi_subdevice *s)
  	if (async) {
  		comedi_reset_async_buf(async);
  		async->inttrig = NULL;
--		kfree(async->cmd.chanlist);
--		async->cmd.chanlist = NULL;
++		kfree(async->cmd.chanlist);
++		async->cmd.chanlist = NULL;
  	} else {
  		printk(KERN_ERR
  		       "BUG: (?) do_become_nonbusy called with async=0\n");
 diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
-index 7a1e2e8..ef83a1a 100644
+index ef83a1a..7a1e2e8 100644
 --- a/drivers/staging/comedi/drivers/comedi_test.c
 +++ b/drivers/staging/comedi/drivers/comedi_test.c
 @@ -450,7 +450,7 @@ static int waveform_ai_cancel(struct comedi_device *dev,
  			      struct comedi_subdevice *s)
  {
  	devpriv->timer_running = 0;
--	del_timer_sync(&devpriv->timer);
-+	del_timer(&devpriv->timer);
+-	del_timer(&devpriv->timer);
++	del_timer_sync(&devpriv->timer);
  	return 0;
  }
  
 diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
-index c05cb4b..f425833 100644
+index f425833..c05cb4b 100644
 --- a/drivers/staging/comedi/drivers/das08.c
 +++ b/drivers/staging/comedi/drivers/das08.c
 @@ -652,7 +652,7 @@ static int das08jr_ao_winsn(struct comedi_device *dev,
  	int chan;
  
  	lsb = data[0] & 0xff;
--	msb = (data[0] >> 8) & 0xff;
-+	msb = (data[0] >> 8) & 0xf;
+-	msb = (data[0] >> 8) & 0xf;
++	msb = (data[0] >> 8) & 0xff;
  
  	chan = CR_CHAN(insn->chanspec);
  
 diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
-index ae6f40c..1d6385a 100644
+index 1d6385a..ae6f40c 100644
 --- a/drivers/staging/comedi/drivers/jr3_pci.c
 +++ b/drivers/staging/comedi/drivers/jr3_pci.c
 @@ -917,7 +917,7 @@ static int jr3_pci_attach(struct comedi_device *dev,
  	}
  
  	/*  Reset DSP card */
--	writel(0, &devpriv->iobase->channel[0].reset);
-+	devpriv->iobase->channel[0].reset = 0;
+-	devpriv->iobase->channel[0].reset = 0;
++	writel(0, &devpriv->iobase->channel[0].reset);
  
  	result = comedi_load_firmware(dev, "jr3pci.idm", jr3_download_firmware);
  	printk("Firmare load %d\n", result);
 diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c
-index 76ca73a..4ac745a 100644
+index 4ac745a..76ca73a 100644
 --- a/drivers/staging/comedi/drivers/ni_labpc.c
 +++ b/drivers/staging/comedi/drivers/ni_labpc.c
-@@ -1178,9 +1178,7 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
+@@ -1178,7 +1178,9 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
  	else
  		channel = CR_CHAN(cmd->chanlist[0]);
  	/*  munge channel bits for differential / scan disabled mode */
--	if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN ||
--	     labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) &&
--	    aref == AREF_DIFF)
-+	if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF)
+-	if (labpc_ai_scan_mode(cmd) != MODE_SINGLE_CHAN && aref == AREF_DIFF)
++	if ((labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN ||
++	     labpc_ai_scan_mode(cmd) == MODE_SINGLE_CHAN_INTERVAL) &&
++	    aref == AREF_DIFF)
  		channel *= 2;
  	devpriv->command1_bits |= ADC_CHAN_BITS(channel);
  	devpriv->command1_bits |= thisboard->ai_range_code[range];
-@@ -1195,6 +1193,21 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
+@@ -1193,21 +1195,6 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
  		devpriv->write_byte(devpriv->command1_bits,
  				    dev->iobase + COMMAND1_REG);
  	}
-+	/*  setup any external triggering/pacing (command4 register) */
-+	devpriv->command4_bits = 0;
-+	if (cmd->convert_src != TRIG_EXT)
-+		devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
-+	/* XXX should discard first scan when using interval scanning
-+	 * since manual says it is not synced with scan clock */
-+	if (labpc_use_continuous_mode(cmd) == 0) {
-+		devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
-+		if (cmd->scan_begin_src == TRIG_EXT)
-+			devpriv->command4_bits |= EXT_SCAN_EN_BIT;
-+	}
-+	/*  single-ended/differential */
-+	if (aref == AREF_DIFF)
-+		devpriv->command4_bits |= ADC_DIFF_BIT;
-+	devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
- 
- 	devpriv->write_byte(cmd->chanlist_len,
- 			    dev->iobase + INTERVAL_COUNT_REG);
-@@ -1272,22 +1285,6 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
- 		devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT;
- 	devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG);
- 
 -	/*  setup any external triggering/pacing (command4 register) */
 -	devpriv->command4_bits = 0;
 -	if (cmd->convert_src != TRIG_EXT)
@@ -1195,57 +1160,79 @@ index 76ca73a..4ac745a 100644
 -	if (aref == AREF_DIFF)
 -		devpriv->command4_bits |= ADC_DIFF_BIT;
 -	devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
--
+ 
+ 	devpriv->write_byte(cmd->chanlist_len,
+ 			    dev->iobase + INTERVAL_COUNT_REG);
+@@ -1285,6 +1272,22 @@ static int labpc_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
+ 		devpriv->command3_bits &= ~ADC_FNE_INTR_EN_BIT;
+ 	devpriv->write_byte(devpriv->command3_bits, dev->iobase + COMMAND3_REG);
+ 
++	/*  setup any external triggering/pacing (command4 register) */
++	devpriv->command4_bits = 0;
++	if (cmd->convert_src != TRIG_EXT)
++		devpriv->command4_bits |= EXT_CONVERT_DISABLE_BIT;
++	/* XXX should discard first scan when using interval scanning
++	 * since manual says it is not synced with scan clock */
++	if (labpc_use_continuous_mode(cmd) == 0) {
++		devpriv->command4_bits |= INTERVAL_SCAN_EN_BIT;
++		if (cmd->scan_begin_src == TRIG_EXT)
++			devpriv->command4_bits |= EXT_SCAN_EN_BIT;
++	}
++	/*  single-ended/differential */
++	if (aref == AREF_DIFF)
++		devpriv->command4_bits |= ADC_DIFF_BIT;
++	devpriv->write_byte(devpriv->command4_bits, dev->iobase + COMMAND4_REG);
++
  	/*  startup aquisition */
  
  	/*  command2 reg */
 diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
-index 7a7c29f..80d2787 100644
+index 80d2787..7a7c29f 100644
 --- a/drivers/staging/comedi/drivers/s626.c
 +++ b/drivers/staging/comedi/drivers/s626.c
 @@ -2330,7 +2330,7 @@ static int s626_enc_insn_config(struct comedi_device *dev,
  	/*   (data==NULL) ? (Preloadvalue=0) : (Preloadvalue=data[0]); */
  
  	k->SetMode(dev, k, Setup, TRUE);
--	Preload(dev, k, data[0]);
-+	Preload(dev, k, *(insn->data));
+-	Preload(dev, k, *(insn->data));
++	Preload(dev, k, data[0]);
  	k->PulseIndex(dev, k);
  	SetLatchSource(dev, k, valueSrclatch);
  	k->SetEnable(dev, k, (uint16_t) (enab != 0));
 diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
-index 9d059de..405c4f7 100644
+index 405c4f7..9d059de 100644
 --- a/drivers/staging/vt6656/rf.c
 +++ b/drivers/staging/vt6656/rf.c
-@@ -769,9 +769,6 @@ BYTE    byPwr = pDevice->byCCKPwr;
+@@ -769,6 +769,9 @@ BYTE    byPwr = pDevice->byCCKPwr;
          return TRUE;
      }
  
--	if (uCH == 0)
--		return -EINVAL;
--
++	if (uCH == 0)
++		return -EINVAL;
++
      switch (uRATE) {
      case RATE_1M:
      case RATE_2M:
 diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
-index 56eb6cc..40de151 100644
+index 40de151..56eb6cc 100644
 --- a/drivers/telephony/ixj.c
 +++ b/drivers/telephony/ixj.c
 @@ -3190,12 +3190,12 @@ static void ixj_write_cid(IXJ *j)
  
  	ixj_fsk_alloc(j);
  
--	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
--	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
--	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
-+	strcpy(sdmf1, j->cid_send.month);
-+	strcat(sdmf1, j->cid_send.day);
-+	strcat(sdmf1, j->cid_send.hour);
-+	strcat(sdmf1, j->cid_send.min);
-+	strcpy(sdmf2, j->cid_send.number);
-+	strcpy(sdmf3, j->cid_send.name);
+-	strcpy(sdmf1, j->cid_send.month);
+-	strcat(sdmf1, j->cid_send.day);
+-	strcat(sdmf1, j->cid_send.hour);
+-	strcat(sdmf1, j->cid_send.min);
+-	strcpy(sdmf2, j->cid_send.number);
+-	strcpy(sdmf3, j->cid_send.name);
++	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
  
  	len1 = strlen(sdmf1);
  	len2 = strlen(sdmf2);
@@ -1253,1981 +1240,1981 @@ index 56eb6cc..40de151 100644
  		ixj_pre_cid(j);
  	}
  	j->flags.cidcw_ack = 0;
--	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
--	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
--	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
--	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
-+	strcpy(sdmf1, j->cid_send.month);
-+	strcat(sdmf1, j->cid_send.day);
-+	strcat(sdmf1, j->cid_send.hour);
-+	strcat(sdmf1, j->cid_send.min);
-+	strcpy(sdmf2, j->cid_send.number);
-+	strcpy(sdmf3, j->cid_send.name);
+-	strcpy(sdmf1, j->cid_send.month);
+-	strcat(sdmf1, j->cid_send.day);
+-	strcat(sdmf1, j->cid_send.hour);
+-	strcat(sdmf1, j->cid_send.min);
+-	strcpy(sdmf2, j->cid_send.number);
+-	strcpy(sdmf3, j->cid_send.name);
++	strlcpy(sdmf1, j->cid_send.month, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.day, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.hour, sizeof(sdmf1));
++	strlcat(sdmf1, j->cid_send.min, sizeof(sdmf1));
++	strlcpy(sdmf2, j->cid_send.number, sizeof(sdmf2));
++	strlcpy(sdmf3, j->cid_send.name, sizeof(sdmf3));
  
  	len1 = strlen(sdmf1);
  	len2 = strlen(sdmf2);
 diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 01ae519..37f2899 100644
+index 37f2899..01ae519 100644
 --- a/drivers/usb/class/cdc-wdm.c
 +++ b/drivers/usb/class/cdc-wdm.c
-@@ -52,7 +52,6 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
+@@ -52,6 +52,7 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
  #define WDM_READ		4
  #define WDM_INT_STALL		5
  #define WDM_POLL_RUNNING	6
--#define WDM_OVERFLOW		10
++#define WDM_OVERFLOW		10
  
  
  #define WDM_MAX			16
-@@ -116,7 +115,6 @@ static void wdm_in_callback(struct urb *urb)
+@@ -115,6 +116,7 @@ static void wdm_in_callback(struct urb *urb)
  {
  	struct wdm_device *desc = urb->context;
  	int status = urb->status;
--	int length = urb->actual_length;
++	int length = urb->actual_length;
  
  	spin_lock(&desc->iuspin);
  
-@@ -146,17 +144,9 @@ static void wdm_in_callback(struct urb *urb)
+@@ -144,9 +146,17 @@ static void wdm_in_callback(struct urb *urb)
  	}
  
  	desc->rerr = status;
--	if (length + desc->length > desc->wMaxCommand) {
--		/* The buffer would overflow */
--		set_bit(WDM_OVERFLOW, &desc->flags);
--	} else {
--		/* we may already be in overflow */
--		if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
--			memmove(desc->ubuf + desc->length, desc->inbuf, length);
--			desc->length += length;
--			desc->reslength = length;
--		}
--	}
-+	desc->reslength = urb->actual_length;
-+	memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
-+	desc->length += desc->reslength;
+-	desc->reslength = urb->actual_length;
+-	memmove(desc->ubuf + desc->length, desc->inbuf, desc->reslength);
+-	desc->length += desc->reslength;
++	if (length + desc->length > desc->wMaxCommand) {
++		/* The buffer would overflow */
++		set_bit(WDM_OVERFLOW, &desc->flags);
++	} else {
++		/* we may already be in overflow */
++		if (!test_bit(WDM_OVERFLOW, &desc->flags)) {
++			memmove(desc->ubuf + desc->length, desc->inbuf, length);
++			desc->length += length;
++			desc->reslength = length;
++		}
++	}
  	wake_up(&desc->wait);
  
  	set_bit(WDM_READ, &desc->flags);
-@@ -408,11 +398,6 @@ retry:
+@@ -398,6 +408,11 @@ retry:
  			rv = -ENODEV;
  			goto err;
  		}
--		if (test_bit(WDM_OVERFLOW, &desc->flags)) {
--			clear_bit(WDM_OVERFLOW, &desc->flags);
--			rv = -ENOBUFS;
--			goto err;
--		}
++		if (test_bit(WDM_OVERFLOW, &desc->flags)) {
++			clear_bit(WDM_OVERFLOW, &desc->flags);
++			rv = -ENOBUFS;
++			goto err;
++		}
  		i++;
  		if (file->f_flags & O_NONBLOCK) {
  			if (!test_bit(WDM_READ, &desc->flags)) {
-@@ -455,7 +440,6 @@ retry:
+@@ -440,6 +455,7 @@ retry:
  			spin_unlock_irq(&desc->iuspin);
  			goto retry;
  		}
--
++
  		if (!desc->reslength) { /* zero length read */
  			dev_dbg(&desc->intf->dev, "%s: zero length - clearing WDM_READ\n", __func__);
  			clear_bit(WDM_READ, &desc->flags);
-@@ -860,7 +844,6 @@ static int wdm_post_reset(struct usb_interface *intf)
+@@ -844,6 +860,7 @@ static int wdm_post_reset(struct usb_interface *intf)
  	struct wdm_device *desc = usb_get_intfdata(intf);
  	int rv;
  
--	clear_bit(WDM_OVERFLOW, &desc->flags);
++	clear_bit(WDM_OVERFLOW, &desc->flags);
  	rv = recover_from_urb_loss(desc);
  	mutex_unlock(&desc->plock);
  	return 0;
 diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index 8d17f780..7b2e99c 100644
+index 7b2e99c..8d17f780 100644
 --- a/drivers/usb/host/ehci-hcd.c
 +++ b/drivers/usb/host/ehci-hcd.c
-@@ -84,8 +84,7 @@ static const char	hcd_name [] = "ehci_hcd";
+@@ -84,7 +84,8 @@ static const char	hcd_name [] = "ehci_hcd";
  #define EHCI_IAA_MSECS		10		/* arbitrary */
  #define EHCI_IO_JIFFIES		(HZ/10)		/* io watchdog > irq_thresh */
  #define EHCI_ASYNC_JIFFIES	(HZ/20)		/* async idle timeout */
--#define EHCI_SHRINK_JIFFIES	(DIV_ROUND_UP(HZ, 200) + 1)
--						/* 200-ms async qh unlink delay */
-+#define EHCI_SHRINK_FRAMES	5		/* async qh unlink delay */
+-#define EHCI_SHRINK_FRAMES	5		/* async qh unlink delay */
++#define EHCI_SHRINK_JIFFIES	(DIV_ROUND_UP(HZ, 200) + 1)
++						/* 200-ms async qh unlink delay */
  
  /* Initial IRQ latency:  faster than hw default */
  static int log2_irq_thresh = 0;		// 0 to 6
-@@ -140,7 +139,10 @@ timer_action(struct ehci_hcd *ehci, enum ehci_timer_action action)
+@@ -139,10 +140,7 @@ timer_action(struct ehci_hcd *ehci, enum ehci_timer_action action)
  			break;
  		/* case TIMER_ASYNC_SHRINK: */
  		default:
--			t = EHCI_SHRINK_JIFFIES;
-+			/* add a jiffie since we synch against the
-+			 * 8 KHz uframe counter.
-+			 */
-+			t = DIV_ROUND_UP(EHCI_SHRINK_FRAMES * HZ, 1000) + 1;
+-			/* add a jiffie since we synch against the
+-			 * 8 KHz uframe counter.
+-			 */
+-			t = DIV_ROUND_UP(EHCI_SHRINK_FRAMES * HZ, 1000) + 1;
++			t = EHCI_SHRINK_JIFFIES;
  			break;
  		}
  		mod_timer(&ehci->watchdog, t + jiffies);
 diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index 3b8fa18..0ee5b4b 100644
+index 0ee5b4b..3b8fa18 100644
 --- a/drivers/usb/host/ehci-q.c
 +++ b/drivers/usb/host/ehci-q.c
-@@ -1204,8 +1204,6 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
+@@ -1204,6 +1204,8 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
  
  	prev->hw->hw_next = qh->hw->hw_next;
  	prev->qh_next = qh->qh_next;
--	if (ehci->qh_scan_next == qh)
--		ehci->qh_scan_next = qh->qh_next.qh;
++	if (ehci->qh_scan_next == qh)
++		ehci->qh_scan_next = qh->qh_next.qh;
  	wmb ();
  
  	/* If the controller isn't running, we don't have to wait for it */
-@@ -1231,49 +1229,53 @@ static void scan_async (struct ehci_hcd *ehci)
+@@ -1229,53 +1231,49 @@ static void scan_async (struct ehci_hcd *ehci)
  	struct ehci_qh		*qh;
  	enum ehci_timer_action	action = TIMER_IO_WATCHDOG;
  
-+	ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
+-	ehci->stamp = ehci_readl(ehci, &ehci->regs->frame_index);
  	timer_action_done (ehci, TIMER_ASYNC_SHRINK);
-+rescan:
+-rescan:
  	stopped = !HC_IS_RUNNING(ehci_to_hcd(ehci)->state);
-+	qh = ehci->async->qh_next.qh;
-+	if (likely (qh != NULL)) {
-+		do {
-+			/* clean any finished work for this qh */
-+			if (!list_empty(&qh->qtd_list) && (stopped ||
-+					qh->stamp != ehci->stamp)) {
-+				int temp;
-+
-+				/* unlinks could happen here; completion
-+				 * reporting drops the lock.  rescan using
-+				 * the latest schedule, but don't rescan
-+				 * qhs we already finished (no looping)
-+				 * unless the controller is stopped.
-+				 */
-+				qh = qh_get (qh);
-+				qh->stamp = ehci->stamp;
-+				temp = qh_completions (ehci, qh);
-+				if (qh->needs_rescan)
-+					unlink_async(ehci, qh);
-+				qh_put (qh);
-+				if (temp != 0) {
-+					goto rescan;
-+				}
-+			}
+-	qh = ehci->async->qh_next.qh;
+-	if (likely (qh != NULL)) {
+-		do {
+-			/* clean any finished work for this qh */
+-			if (!list_empty(&qh->qtd_list) && (stopped ||
+-					qh->stamp != ehci->stamp)) {
+-				int temp;
+-
+-				/* unlinks could happen here; completion
+-				 * reporting drops the lock.  rescan using
+-				 * the latest schedule, but don't rescan
+-				 * qhs we already finished (no looping)
+-				 * unless the controller is stopped.
+-				 */
+-				qh = qh_get (qh);
+-				qh->stamp = ehci->stamp;
+-				temp = qh_completions (ehci, qh);
+-				if (qh->needs_rescan)
+-					unlink_async(ehci, qh);
+-				qh_put (qh);
+-				if (temp != 0) {
+-					goto rescan;
+-				}
+-			}
  
--	ehci->qh_scan_next = ehci->async->qh_next.qh;
--	while (ehci->qh_scan_next) {
--		qh = ehci->qh_scan_next;
--		ehci->qh_scan_next = qh->qh_next.qh;
-- rescan:
--		/* clean any finished work for this qh */
--		if (!list_empty(&qh->qtd_list)) {
--			int temp;
--
--			/*
--			 * Unlinks could happen here; completion reporting
--			 * drops the lock.  That's why ehci->qh_scan_next
--			 * always holds the next qh to scan; if the next qh
--			 * gets unlinked then ehci->qh_scan_next is adjusted
--			 * in start_unlink_async().
-+			/* unlink idle entries, reducing DMA usage as well
-+			 * as HCD schedule-scanning costs.  delay for any qh
-+			 * we just scanned, there's a not-unusual case that it
-+			 * doesn't stay idle for long.
-+			 * (plus, avoids some kind of re-activation race.)
+-			/* unlink idle entries, reducing DMA usage as well
+-			 * as HCD schedule-scanning costs.  delay for any qh
+-			 * we just scanned, there's a not-unusual case that it
+-			 * doesn't stay idle for long.
+-			 * (plus, avoids some kind of re-activation race.)
++	ehci->qh_scan_next = ehci->async->qh_next.qh;
++	while (ehci->qh_scan_next) {
++		qh = ehci->qh_scan_next;
++		ehci->qh_scan_next = qh->qh_next.qh;
++ rescan:
++		/* clean any finished work for this qh */
++		if (!list_empty(&qh->qtd_list)) {
++			int temp;
++
++			/*
++			 * Unlinks could happen here; completion reporting
++			 * drops the lock.  That's why ehci->qh_scan_next
++			 * always holds the next qh to scan; if the next qh
++			 * gets unlinked then ehci->qh_scan_next is adjusted
++			 * in start_unlink_async().
  			 */
--			qh = qh_get(qh);
--			temp = qh_completions(ehci, qh);
--			if (qh->needs_rescan)
--				unlink_async(ehci, qh);
--			qh->unlink_time = jiffies + EHCI_SHRINK_JIFFIES;
--			qh_put(qh);
--			if (temp != 0)
--				goto rescan;
--		}
-+			if (list_empty(&qh->qtd_list)
-+					&& qh->qh_state == QH_STATE_LINKED) {
-+				if (!ehci->reclaim && (stopped ||
-+					((ehci->stamp - qh->stamp) & 0x1fff)
-+						>= EHCI_SHRINK_FRAMES * 8))
-+					start_unlink_async(ehci, qh);
-+				else
-+					action = TIMER_ASYNC_SHRINK;
-+			}
+-			if (list_empty(&qh->qtd_list)
+-					&& qh->qh_state == QH_STATE_LINKED) {
+-				if (!ehci->reclaim && (stopped ||
+-					((ehci->stamp - qh->stamp) & 0x1fff)
+-						>= EHCI_SHRINK_FRAMES * 8))
+-					start_unlink_async(ehci, qh);
+-				else
+-					action = TIMER_ASYNC_SHRINK;
+-			}
++			qh = qh_get(qh);
++			temp = qh_completions(ehci, qh);
++			if (qh->needs_rescan)
++				unlink_async(ehci, qh);
++			qh->unlink_time = jiffies + EHCI_SHRINK_JIFFIES;
++			qh_put(qh);
++			if (temp != 0)
++				goto rescan;
++		}
  
--		/* unlink idle entries, reducing DMA usage as well
--		 * as HCD schedule-scanning costs.  delay for any qh
--		 * we just scanned, there's a not-unusual case that it
--		 * doesn't stay idle for long.
--		 * (plus, avoids some kind of re-activation race.)
--		 */
--		if (list_empty(&qh->qtd_list)
--				&& qh->qh_state == QH_STATE_LINKED) {
--			if (!ehci->reclaim && (stopped ||
--					time_after_eq(jiffies, qh->unlink_time)))
--				start_unlink_async(ehci, qh);
--			else
--				action = TIMER_ASYNC_SHRINK;
--		}
-+			qh = qh->qh_next.qh;
-+		} while (qh);
+-			qh = qh->qh_next.qh;
+-		} while (qh);
++		/* unlink idle entries, reducing DMA usage as well
++		 * as HCD schedule-scanning costs.  delay for any qh
++		 * we just scanned, there's a not-unusual case that it
++		 * doesn't stay idle for long.
++		 * (plus, avoids some kind of re-activation race.)
++		 */
++		if (list_empty(&qh->qtd_list)
++				&& qh->qh_state == QH_STATE_LINKED) {
++			if (!ehci->reclaim && (stopped ||
++					time_after_eq(jiffies, qh->unlink_time)))
++				start_unlink_async(ehci, qh);
++			else
++				action = TIMER_ASYNC_SHRINK;
++		}
  	}
  	if (action == TIMER_ASYNC_SHRINK)
  		timer_action (ehci, TIMER_ASYNC_SHRINK);
 diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
-index b2b3416..5b3ca74 100644
+index 5b3ca74..b2b3416 100644
 --- a/drivers/usb/host/ehci.h
 +++ b/drivers/usb/host/ehci.h
-@@ -74,7 +74,6 @@ struct ehci_hcd {			/* one per controller */
+@@ -74,6 +74,7 @@ struct ehci_hcd {			/* one per controller */
  	/* async schedule support */
  	struct ehci_qh		*async;
  	struct ehci_qh		*reclaim;
--	struct ehci_qh		*qh_scan_next;
++	struct ehci_qh		*qh_scan_next;
  	unsigned		scanning : 1;
  
  	/* periodic schedule support */
-@@ -117,6 +116,7 @@ struct ehci_hcd {			/* one per controller */
+@@ -116,7 +117,6 @@ struct ehci_hcd {			/* one per controller */
  	struct timer_list	iaa_watchdog;
  	struct timer_list	watchdog;
  	unsigned long		actions;
-+	unsigned		stamp;
+-	unsigned		stamp;
  	unsigned		random_frame;
  	unsigned long		next_statechange;
  	ktime_t			last_periodic_enable;
-@@ -335,7 +335,6 @@ struct ehci_qh {
+@@ -335,6 +335,7 @@ struct ehci_qh {
  	struct ehci_qh		*reclaim;	/* next to reclaim */
  
  	struct ehci_hcd		*ehci;
--	unsigned long		unlink_time;
++	unsigned long		unlink_time;
  
  	/*
  	 * Do NOT use atomic operations for QH refcounting. On some CPUs
 diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
-index 01e7fae..981b604 100644
+index 981b604..01e7fae 100644
 --- a/drivers/usb/host/pci-quirks.c
 +++ b/drivers/usb/host/pci-quirks.c
 @@ -418,12 +418,12 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
  	void __iomem *op_reg_base;
  	u32 val;
  	int timeout;
--	int len = pci_resource_len(pdev, 0);
++	int len = pci_resource_len(pdev, 0);
  
  	if (!mmio_resource_enabled(pdev, 0))
  		return;
  
--	base = ioremap_nocache(pci_resource_start(pdev, 0), len);
-+	base = ioremap_nocache(pci_resource_start(pdev, 0),
-+				pci_resource_len(pdev, 0));
+-	base = ioremap_nocache(pci_resource_start(pdev, 0),
+-				pci_resource_len(pdev, 0));
++	base = ioremap_nocache(pci_resource_start(pdev, 0), len);
  	if (base == NULL)
  		return;
  
-@@ -433,17 +433,9 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
+@@ -433,9 +433,17 @@ static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
  	 */
  	ext_cap_offset = xhci_find_next_cap_offset(base, XHCI_HCC_PARAMS_OFFSET);
  	do {
--		if ((ext_cap_offset + sizeof(val)) > len) {
--			/* We're reading garbage from the controller */
--			dev_warn(&pdev->dev,
--				 "xHCI controller failing to respond");
--			return;
--		}
--
++		if ((ext_cap_offset + sizeof(val)) > len) {
++			/* We're reading garbage from the controller */
++			dev_warn(&pdev->dev,
++				 "xHCI controller failing to respond");
++			return;
++		}
++
  		if (!ext_cap_offset)
  			/* We've reached the end of the extended capabilities */
  			goto hc_init;
--
++
  		val = readl(base + ext_cap_offset);
  		if (XHCI_EXT_CAPS_ID(val) == XHCI_EXT_CAPS_LEGACY)
  			break;
 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index dd958e9..c374beb 100644
+index c374beb..dd958e9 100644
 --- a/drivers/usb/serial/ftdi_sio.c
 +++ b/drivers/usb/serial/ftdi_sio.c
-@@ -2364,9 +2364,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
+@@ -2364,6 +2364,9 @@ static void ftdi_set_termios(struct tty_struct *tty,
  
  	cflag = termios->c_cflag;
  
--	if (!old_termios)
--		goto no_skip;
--
++	if (!old_termios)
++		goto no_skip;
++
  	if (old_termios->c_cflag == termios->c_cflag
  	    && old_termios->c_ispeed == termios->c_ispeed
  	    && old_termios->c_ospeed == termios->c_ospeed)
-@@ -2380,7 +2377,6 @@ static void ftdi_set_termios(struct tty_struct *tty,
+@@ -2377,6 +2380,7 @@ static void ftdi_set_termios(struct tty_struct *tty,
  	    (termios->c_cflag & (CSIZE|PARODD|PARENB|CMSPAR|CSTOPB)))
  		goto no_data_parity_stop_changes;
  
--no_skip:
++no_skip:
  	/* Set number of data bits, parity, stop bits */
  
  	termios->c_cflag &= ~CMSPAR;
 diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
-index 7c3ac7b..867d97b 100644
+index 867d97b..7c3ac7b 100644
 --- a/drivers/usb/serial/garmin_gps.c
 +++ b/drivers/usb/serial/garmin_gps.c
-@@ -974,7 +974,10 @@ static void garmin_close(struct usb_serial_port *port)
+@@ -974,10 +974,7 @@ static void garmin_close(struct usb_serial_port *port)
  	if (!serial)
  		return;
  
--	garmin_clear(garmin_data_p);
-+	mutex_lock(&port->serial->disc_mutex);
-+
-+	if (!port->serial->disconnected)
-+		garmin_clear(garmin_data_p);
+-	mutex_lock(&port->serial->disc_mutex);
+-
+-	if (!port->serial->disconnected)
+-		garmin_clear(garmin_data_p);
++	garmin_clear(garmin_data_p);
  
  	/* shutdown our urbs */
  	usb_kill_urb(port->read_urb);
-@@ -983,6 +986,8 @@ static void garmin_close(struct usb_serial_port *port)
+@@ -986,8 +983,6 @@ static void garmin_close(struct usb_serial_port *port)
  	/* keep reset state so we know that we must start a new session */
  	if (garmin_data_p->state != STATE_RESET)
  		garmin_data_p->state = STATE_DISCONNECTED;
-+
-+	mutex_unlock(&port->serial->disc_mutex);
+-
+-	mutex_unlock(&port->serial->disc_mutex);
  }
  
  
 diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index cf515f0..14d51e6 100644
+index 14d51e6..cf515f0 100644
 --- a/drivers/usb/serial/io_ti.c
 +++ b/drivers/usb/serial/io_ti.c
-@@ -574,9 +574,6 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
+@@ -574,6 +574,9 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
  	wait_queue_t wait;
  	unsigned long flags;
  
--	if (!tty)
--		return;
--
++	if (!tty)
++		return;
++
  	if (!timeout)
  		timeout = (HZ * EDGE_CLOSING_WAIT)/100;
  
 diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index c802c77..61829b8 100644
+index 61829b8..c802c77 100644
 --- a/drivers/usb/serial/mos7840.c
 +++ b/drivers/usb/serial/mos7840.c
-@@ -2569,6 +2569,7 @@ error:
+@@ -2569,7 +2569,6 @@ error:
  		kfree(mos7840_port->ctrl_buf);
  		usb_free_urb(mos7840_port->control_urb);
  		kfree(mos7840_port);
-+		serial->port[i] = NULL;
+-		serial->port[i] = NULL;
  	}
  	return status;
  }
-@@ -2635,7 +2636,6 @@ static void mos7840_release(struct usb_serial *serial)
+@@ -2636,6 +2635,7 @@ static void mos7840_release(struct usb_serial *serial)
  		mos7840_port = mos7840_get_port_private(serial->port[i]);
  		dbg("mos7840_port %d = %p", i, mos7840_port);
  		if (mos7840_port) {
--			usb_free_urb(mos7840_port->control_urb);
++			usb_free_urb(mos7840_port->control_urb);
  			kfree(mos7840_port->ctrl_buf);
  			kfree(mos7840_port->dr);
  			kfree(mos7840_port);
 diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
-index 0cbf847..1b5c9f8 100644
+index 1b5c9f8..0cbf847 100644
 --- a/drivers/usb/serial/sierra.c
 +++ b/drivers/usb/serial/sierra.c
-@@ -925,7 +925,6 @@ static void sierra_release(struct usb_serial *serial)
+@@ -925,6 +925,7 @@ static void sierra_release(struct usb_serial *serial)
  			continue;
  		kfree(portdata);
  	}
--	kfree(serial->private);
++	kfree(serial->private);
  }
  
  #ifdef CONFIG_PM
 diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
-index 1247be1..1093d2e 100644
+index 1093d2e..1247be1 100644
 --- a/drivers/usb/serial/whiteheat.c
 +++ b/drivers/usb/serial/whiteheat.c
-@@ -576,7 +576,6 @@ no_firmware:
+@@ -576,6 +576,7 @@ no_firmware:
  		"%s: please contact support@connecttech.com\n",
  		serial->type->description);
  	kfree(result);
--	kfree(command);
++	kfree(command);
  	return -ENODEV;
  
  no_command_private:
 diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
-index 74284bd..acc7e3b 100644
+index acc7e3b..74284bd 100644
 --- a/drivers/w1/w1.c
 +++ b/drivers/w1/w1.c
-@@ -918,8 +918,7 @@ void w1_search(struct w1_master *dev, u8 search_type, w1_slave_found_callback cb
+@@ -918,7 +918,8 @@ void w1_search(struct w1_master *dev, u8 search_type, w1_slave_found_callback cb
  			tmp64 = (triplet_ret >> 2);
  			rn |= (tmp64 << i);
  
--			/* ensure we're called from kthread and not by netlink callback */
--			if (!dev->priv && kthread_should_stop()) {
-+			if (kthread_should_stop()) {
+-			if (kthread_should_stop()) {
++			/* ensure we're called from kthread and not by netlink callback */
++			if (!dev->priv && kthread_should_stop()) {
  				dev_dbg(&dev->dev, "Abort w1_search\n");
  				return;
  			}
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index c564293..a64fde6 100644
+index a64fde6..c564293 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
-@@ -1699,19 +1699,30 @@ static int elf_note_info_init(struct elf_note_info *info)
+@@ -1699,30 +1699,19 @@ static int elf_note_info_init(struct elf_note_info *info)
  		return 0;
  	info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
  	if (!info->psinfo)
--		return 0;
-+		goto notes_free;
+-		goto notes_free;
++		return 0;
  	info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
  	if (!info->prstatus)
--		return 0;
-+		goto psinfo_free;
+-		goto psinfo_free;
++		return 0;
  	info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
  	if (!info->fpu)
--		return 0;
-+		goto prstatus_free;
+-		goto prstatus_free;
++		return 0;
  #ifdef ELF_CORE_COPY_XFPREGS
  	info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
  	if (!info->xfpu)
--		return 0;
-+		goto fpu_free;
+-		goto fpu_free;
++		return 0;
  #endif
  	return 1;
-+#ifdef ELF_CORE_COPY_XFPREGS
-+ fpu_free:
-+	kfree(info->fpu);
-+#endif
-+ prstatus_free:
-+	kfree(info->prstatus);
-+ psinfo_free:
-+	kfree(info->psinfo);
-+ notes_free:
-+	kfree(info->notes);
-+	return 0;
+-#ifdef ELF_CORE_COPY_XFPREGS
+- fpu_free:
+-	kfree(info->fpu);
+-#endif
+- prstatus_free:
+-	kfree(info->prstatus);
+- psinfo_free:
+-	kfree(info->psinfo);
+- notes_free:
+-	kfree(info->notes);
+-	return 0;
  }
  
  static int fill_note_info(struct elfhdr *elf, int phdrs,
 diff --git a/fs/binfmt_em86.c b/fs/binfmt_em86.c
-index 416dcae..32fb00b 100644
+index 32fb00b..416dcae 100644
 --- a/fs/binfmt_em86.c
 +++ b/fs/binfmt_em86.c
-@@ -43,6 +43,7 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -43,7 +43,6 @@ static int load_em86(struct linux_binprm *bprm,struct pt_regs *regs)
  			return -ENOEXEC;
  	}
  
-+	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
+-	bprm->recursion_depth++; /* Well, the bang-shell is implicit... */
  	allow_write_access(bprm->file);
  	fput(bprm->file);
  	bprm->file = NULL;
 diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
-index 258c5ca..42b60b0 100644
+index 42b60b0..258c5ca 100644
 --- a/fs/binfmt_misc.c
 +++ b/fs/binfmt_misc.c
-@@ -116,6 +116,10 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -116,10 +116,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  	if (!enabled)
  		goto _ret;
  
-+	retval = -ENOEXEC;
-+	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
-+		goto _ret;
-+
+-	retval = -ENOEXEC;
+-	if (bprm->recursion_depth > BINPRM_MAX_RECURSION)
+-		goto _ret;
+-
  	/* to keep locking time low, we copy the interpreter string */
  	read_lock(&entries_lock);
  	fmt = check_file(bprm);
-@@ -172,10 +176,7 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -176,7 +172,10 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		goto _error;
  	bprm->argc ++;
  
--	/* Update interp in case binfmt_script needs it. */
--	retval = bprm_change_interp(iname, bprm);
--	if (retval < 0)
--		goto _error;
-+	bprm->interp = iname;	/* for binfmt_script */
+-	bprm->interp = iname;	/* for binfmt_script */
++	/* Update interp in case binfmt_script needs it. */
++	retval = bprm_change_interp(iname, bprm);
++	if (retval < 0)
++		goto _error;
  
  	interp_file = open_exec (iname);
  	retval = PTR_ERR (interp_file);
-@@ -196,6 +197,8 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -197,8 +196,6 @@ static int load_misc_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  	if (retval < 0)
  		goto _error;
  
-+	bprm->recursion_depth++;
-+
+-	bprm->recursion_depth++;
+-
  	retval = search_binary_handler (bprm, regs);
  	if (retval < 0)
  		goto _error;
 diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
-index 4fe6b8a..0834350 100644
+index 0834350..4fe6b8a 100644
 --- a/fs/binfmt_script.c
 +++ b/fs/binfmt_script.c
-@@ -22,13 +22,15 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -22,15 +22,13 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
  	char interp[BINPRM_BUF_SIZE];
  	int retval;
  
--	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
-+	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
-+	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
+-	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!') ||
+-	    (bprm->recursion_depth > BINPRM_MAX_RECURSION))
++	if ((bprm->buf[0] != '#') || (bprm->buf[1] != '!'))
  		return -ENOEXEC;
  	/*
  	 * This section does the #! interpretation.
  	 * Sorta complicated, but hopefully it will work.  -TYT
  	 */
  
-+	bprm->recursion_depth++;
+-	bprm->recursion_depth++;
  	allow_write_access(bprm->file);
  	fput(bprm->file);
  	bprm->file = NULL;
-@@ -80,9 +82,7 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -82,7 +80,9 @@ static int load_script(struct linux_binprm *bprm,struct pt_regs *regs)
  	retval = copy_strings_kernel(1, &i_name, bprm);
  	if (retval) return retval; 
  	bprm->argc++;
--	retval = bprm_change_interp(interp, bprm);
--	if (retval < 0)
--		return retval;
-+	bprm->interp = interp;
+-	bprm->interp = interp;
++	retval = bprm_change_interp(interp, bprm);
++	if (retval < 0)
++		return retval;
  
  	/*
  	 * OK, now restart the process with the interpreter's dentry.
 diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
-index 6190a10..5d56a8d 100644
+index 5d56a8d..6190a10 100644
 --- a/fs/btrfs/volumes.c
 +++ b/fs/btrfs/volumes.c
-@@ -557,12 +557,6 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
+@@ -557,6 +557,12 @@ int btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
  		__btrfs_close_devices(fs_devices);
  		free_fs_devices(fs_devices);
  	}
--	/*
--	 * Wait for rcu kworkers under __btrfs_close_devices
--	 * to finish all blkdev_puts so device is really
--	 * free when umount is done.
--	 */
--	rcu_barrier();
++	/*
++	 * Wait for rcu kworkers under __btrfs_close_devices
++	 * to finish all blkdev_puts so device is really
++	 * free when umount is done.
++	 */
++	rcu_barrier();
  	return ret;
  }
  
 diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
-index b36a8aa..fea9e89 100644
+index fea9e89..b36a8aa 100644
 --- a/fs/cifs/cifs_dfs_ref.c
 +++ b/fs/cifs/cifs_dfs_ref.c
-@@ -226,8 +226,6 @@ compose_mount_options_out:
+@@ -226,6 +226,8 @@ compose_mount_options_out:
  compose_mount_options_err:
  	kfree(mountdata);
  	mountdata = ERR_PTR(rc);
--	kfree(*devname);
--	*devname = NULL;
++	kfree(*devname);
++	*devname = NULL;
  	goto compose_mount_options_out;
  }
  
 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
-index 98d3c58..d84e705 100644
+index d84e705..98d3c58 100644
 --- a/fs/compat_ioctl.c
 +++ b/fs/compat_ioctl.c
-@@ -234,8 +234,6 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
+@@ -234,6 +234,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, unsigned
  	up = (struct compat_video_spu_palette __user *) arg;
  	err  = get_user(palp, &up->palette);
  	err |= get_user(length, &up->length);
--	if (err)
--		return -EFAULT;
++	if (err)
++		return -EFAULT;
  
  	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
  	err  = put_user(compat_ptr(palp), &up_native->palette);
-@@ -352,7 +350,6 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
+@@ -350,6 +352,7 @@ static int dev_ifconf(unsigned int fd, unsigned int cmd, unsigned long arg)
  	if (copy_from_user(&ifc32, compat_ptr(arg), sizeof(struct ifconf32)))
  		return -EFAULT;
  
--	memset(&ifc, 0, sizeof(ifc));
++	memset(&ifc, 0, sizeof(ifc));
  	if (ifc32.ifcbuf == 0) {
  		ifc32.ifc_len = 0;
  		ifc.ifc_len = 0;
 diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index 83fbd64..ff57421 100644
+index ff57421..83fbd64 100644
 --- a/fs/eventpoll.c
 +++ b/fs/eventpoll.c
-@@ -1183,30 +1183,10 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
+@@ -1183,10 +1183,30 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
  	 * otherwise we might miss an event that happens between the
  	 * f_op->poll() call and the new event set registering.
  	 */
--	epi->event.events = event->events; /* need barrier below */
-+	epi->event.events = event->events;
+-	epi->event.events = event->events;
++	epi->event.events = event->events; /* need barrier below */
  	epi->event.data = event->data; /* protected by mtx */
  
  	/*
--	 * The following barrier has two effects:
--	 *
--	 * 1) Flush epi changes above to other CPUs.  This ensures
--	 *    we do not miss events from ep_poll_callback if an
--	 *    event occurs immediately after we call f_op->poll().
--	 *    We need this because we did not take ep->lock while
--	 *    changing epi above (but ep_poll_callback does take
--	 *    ep->lock).
--	 *
--	 * 2) We also need to ensure we do not miss _past_ events
--	 *    when calling f_op->poll().  This barrier also
--	 *    pairs with the barrier in wq_has_sleeper (see
--	 *    comments for wq_has_sleeper).
--	 *
--	 * This barrier will now guarantee ep_poll_callback or f_op->poll
--	 * (or both) will notice the readiness of an item.
--	 */
--	smp_mb();
--
--	/*
++	 * The following barrier has two effects:
++	 *
++	 * 1) Flush epi changes above to other CPUs.  This ensures
++	 *    we do not miss events from ep_poll_callback if an
++	 *    event occurs immediately after we call f_op->poll().
++	 *    We need this because we did not take ep->lock while
++	 *    changing epi above (but ep_poll_callback does take
++	 *    ep->lock).
++	 *
++	 * 2) We also need to ensure we do not miss _past_ events
++	 *    when calling f_op->poll().  This barrier also
++	 *    pairs with the barrier in wq_has_sleeper (see
++	 *    comments for wq_has_sleeper).
++	 *
++	 * This barrier will now guarantee ep_poll_callback or f_op->poll
++	 * (or both) will notice the readiness of an item.
++	 */
++	smp_mb();
++
++	/*
  	 * Get current event bits. We can safely use the file* here because
  	 * its usage count has been increased by the caller of this function.
  	 */
 diff --git a/fs/exec.c b/fs/exec.c
-index feb2435..86fafc6 100644
+index 86fafc6..feb2435 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
-@@ -1108,24 +1108,9 @@ void free_bprm(struct linux_binprm *bprm)
+@@ -1108,9 +1108,24 @@ void free_bprm(struct linux_binprm *bprm)
  		mutex_unlock(&current->cred_guard_mutex);
  		abort_creds(bprm->cred);
  	}
--	/* If a binfmt changed the interp, free it. */
--	if (bprm->interp != bprm->filename)
--		kfree(bprm->interp);
++	/* If a binfmt changed the interp, free it. */
++	if (bprm->interp != bprm->filename)
++		kfree(bprm->interp);
  	kfree(bprm);
  }
  
--int bprm_change_interp(char *interp, struct linux_binprm *bprm)
--{
--	/* If a binfmt changed the interp, free it first. */
--	if (bprm->interp != bprm->filename)
--		kfree(bprm->interp);
--	bprm->interp = kstrdup(interp, GFP_KERNEL);
--	if (!bprm->interp)
--		return -ENOMEM;
--	return 0;
--}
--EXPORT_SYMBOL(bprm_change_interp);
--
++int bprm_change_interp(char *interp, struct linux_binprm *bprm)
++{
++	/* If a binfmt changed the interp, free it first. */
++	if (bprm->interp != bprm->filename)
++		kfree(bprm->interp);
++	bprm->interp = kstrdup(interp, GFP_KERNEL);
++	if (!bprm->interp)
++		return -ENOMEM;
++	return 0;
++}
++EXPORT_SYMBOL(bprm_change_interp);
++
  /*
   * install the new credentials for this executable
   */
-@@ -1285,10 +1270,6 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1270,6 +1285,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  	int try,retval;
  	struct linux_binfmt *fmt;
  
--	/* This allows 4 levels of binfmt rewrites before failing hard. */
--	if (depth > 5)
--		return -ELOOP;
--
++	/* This allows 4 levels of binfmt rewrites before failing hard. */
++	if (depth > 5)
++		return -ELOOP;
++
  	retval = security_bprm_check(bprm);
  	if (retval)
  		return retval;
-@@ -1310,8 +1291,12 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
+@@ -1291,12 +1310,8 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
  			if (!try_module_get(fmt->module))
  				continue;
  			read_unlock(&binfmt_lock);
--			bprm->recursion_depth = depth + 1;
++			bprm->recursion_depth = depth + 1;
  			retval = fn(bprm, regs);
-+			/*
-+			 * Restore the depth counter to its starting value
-+			 * in this call, so we don't have to rely on every
-+			 * load_binary function to restore it on return.
-+			 */
+-			/*
+-			 * Restore the depth counter to its starting value
+-			 * in this call, so we don't have to rely on every
+-			 * load_binary function to restore it on return.
+-			 */
  			bprm->recursion_depth = depth;
  			if (retval >= 0) {
  				if (depth == 0)
 diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
-index d29a06b..0df88b2 100644
+index 0df88b2..d29a06b 100644
 --- a/fs/ext4/acl.c
 +++ b/fs/ext4/acl.c
-@@ -454,10 +454,8 @@ ext4_xattr_set_acl(struct inode *inode, int type, const void *value,
+@@ -454,8 +454,10 @@ ext4_xattr_set_acl(struct inode *inode, int type, const void *value,
  
  retry:
  	handle = ext4_journal_start(inode, EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
--	if (IS_ERR(handle)) {
--		error = PTR_ERR(handle);
--		goto release_and_out;
--	}
-+	if (IS_ERR(handle))
-+		return PTR_ERR(handle);
+-	if (IS_ERR(handle))
+-		return PTR_ERR(handle);
++	if (IS_ERR(handle)) {
++		error = PTR_ERR(handle);
++		goto release_and_out;
++	}
  	error = ext4_set_acl(handle, inode, type, acl);
  	ext4_journal_stop(handle);
  	if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
 diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h
-index 24fa647..bdb6ce7 100644
+index bdb6ce7..24fa647 100644
 --- a/fs/ext4/ext4_extents.h
 +++ b/fs/ext4/ext4_extents.h
-@@ -137,11 +137,8 @@ typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
+@@ -137,8 +137,11 @@ typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
  #define EXT_BREAK      1
  #define EXT_REPEAT     2
  
--/*
-- * Maximum number of logical blocks in a file; ext4_extent's ee_block is
-- * __le32.
-- */
--#define EXT_MAX_BLOCKS	0xffffffff
-+/* Maximum logical block in a file; ext4_extent's ee_block is __le32 */
-+#define EXT_MAX_BLOCK	0xffffffff
+-/* Maximum logical block in a file; ext4_extent's ee_block is __le32 */
+-#define EXT_MAX_BLOCK	0xffffffff
++/*
++ * Maximum number of logical blocks in a file; ext4_extent's ee_block is
++ * __le32.
++ */
++#define EXT_MAX_BLOCKS	0xffffffff
  
  /*
   * EXT_INIT_MAX_LEN is the maximum number of blocks we can have in an
 diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index 3f022ea..b4402c8 100644
+index b4402c8..3f022ea 100644
 --- a/fs/ext4/extents.c
 +++ b/fs/ext4/extents.c
-@@ -62,7 +62,6 @@ ext4_fsblk_t ext_pblock(struct ext4_extent *ex)
+@@ -62,6 +62,7 @@ ext4_fsblk_t ext_pblock(struct ext4_extent *ex)
   * idx_pblock:
   * combine low and high parts of a leaf physical block number into ext4_fsblk_t
   */
--#define EXT4_EXT_DATA_VALID	0x8  /* extent contains valid data */
++#define EXT4_EXT_DATA_VALID	0x8  /* extent contains valid data */
  ext4_fsblk_t idx_pblock(struct ext4_extent_idx *ix)
  {
  	ext4_fsblk_t block;
-@@ -1332,7 +1331,7 @@ got_index:
+@@ -1331,7 +1332,7 @@ got_index:
  
  /*
   * ext4_ext_next_allocated_block:
-- * returns allocated block in subsequent extent or EXT_MAX_BLOCKS.
-+ * returns allocated block in subsequent extent or EXT_MAX_BLOCK.
+- * returns allocated block in subsequent extent or EXT_MAX_BLOCK.
++ * returns allocated block in subsequent extent or EXT_MAX_BLOCKS.
   * NOTE: it considers block number from index entry as
   * allocated block. Thus, index entries have to be consistent
   * with leaves.
-@@ -1346,7 +1345,7 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
+@@ -1345,7 +1346,7 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
  	depth = path->p_depth;
  
  	if (depth == 0 && path->p_ext == NULL)
--		return EXT_MAX_BLOCKS;
-+		return EXT_MAX_BLOCK;
+-		return EXT_MAX_BLOCK;
++		return EXT_MAX_BLOCKS;
  
  	while (depth >= 0) {
  		if (depth == path->p_depth) {
-@@ -1363,12 +1362,12 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
+@@ -1362,12 +1363,12 @@ ext4_ext_next_allocated_block(struct ext4_ext_path *path)
  		depth--;
  	}
  
--	return EXT_MAX_BLOCKS;
-+	return EXT_MAX_BLOCK;
+-	return EXT_MAX_BLOCK;
++	return EXT_MAX_BLOCKS;
  }
  
  /*
   * ext4_ext_next_leaf_block:
-- * returns first allocated block from next leaf or EXT_MAX_BLOCKS
-+ * returns first allocated block from next leaf or EXT_MAX_BLOCK
+- * returns first allocated block from next leaf or EXT_MAX_BLOCK
++ * returns first allocated block from next leaf or EXT_MAX_BLOCKS
   */
  static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
  					struct ext4_ext_path *path)
-@@ -1380,7 +1379,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
+@@ -1379,7 +1380,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
  
  	/* zero-tree has no leaf blocks at all */
  	if (depth == 0)
--		return EXT_MAX_BLOCKS;
-+		return EXT_MAX_BLOCK;
+-		return EXT_MAX_BLOCK;
++		return EXT_MAX_BLOCKS;
  
  	/* go to index block */
  	depth--;
-@@ -1393,7 +1392,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
+@@ -1392,7 +1393,7 @@ static ext4_lblk_t ext4_ext_next_leaf_block(struct inode *inode,
  		depth--;
  	}
  
--	return EXT_MAX_BLOCKS;
-+	return EXT_MAX_BLOCK;
+-	return EXT_MAX_BLOCK;
++	return EXT_MAX_BLOCKS;
  }
  
  /*
-@@ -1573,13 +1572,13 @@ unsigned int ext4_ext_check_overlap(struct inode *inode,
+@@ -1572,13 +1573,13 @@ unsigned int ext4_ext_check_overlap(struct inode *inode,
  	 */
  	if (b2 < b1) {
  		b2 = ext4_ext_next_allocated_block(path);
--		if (b2 == EXT_MAX_BLOCKS)
-+		if (b2 == EXT_MAX_BLOCK)
+-		if (b2 == EXT_MAX_BLOCK)
++		if (b2 == EXT_MAX_BLOCKS)
  			goto out;
  	}
  
  	/* check for wrap through zero on extent logical start block*/
  	if (b1 + len1 < b1) {
--		len1 = EXT_MAX_BLOCKS - b1;
-+		len1 = EXT_MAX_BLOCK - b1;
+-		len1 = EXT_MAX_BLOCK - b1;
++		len1 = EXT_MAX_BLOCKS - b1;
  		newext->ee_len = cpu_to_le16(len1);
  		ret = 1;
  	}
-@@ -1655,7 +1654,7 @@ repeat:
+@@ -1654,7 +1655,7 @@ repeat:
  	fex = EXT_LAST_EXTENT(eh);
  	next = ext4_ext_next_leaf_block(inode, path);
  	if (le32_to_cpu(newext->ee_block) > le32_to_cpu(fex->ee_block)
--	    && next != EXT_MAX_BLOCKS) {
-+	    && next != EXT_MAX_BLOCK) {
+-	    && next != EXT_MAX_BLOCK) {
++	    && next != EXT_MAX_BLOCKS) {
  		ext_debug("next leaf block - %d\n", next);
  		BUG_ON(npath != NULL);
  		npath = ext4_ext_find_extent(inode, next, NULL);
-@@ -1773,7 +1772,7 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
+@@ -1772,7 +1773,7 @@ int ext4_ext_walk_space(struct inode *inode, ext4_lblk_t block,
  	BUG_ON(func == NULL);
  	BUG_ON(inode == NULL);
  
--	while (block < last && block != EXT_MAX_BLOCKS) {
-+	while (block < last && block != EXT_MAX_BLOCK) {
+-	while (block < last && block != EXT_MAX_BLOCK) {
++	while (block < last && block != EXT_MAX_BLOCKS) {
  		num = last - block;
  		/* find extent for this block */
  		down_read(&EXT4_I(inode)->i_data_sem);
-@@ -1901,7 +1900,7 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
+@@ -1900,7 +1901,7 @@ ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
  	if (ex == NULL) {
  		/* there is no extent yet, so gap is [0;-] */
  		lblock = 0;
--		len = EXT_MAX_BLOCKS;
-+		len = EXT_MAX_BLOCK;
+-		len = EXT_MAX_BLOCK;
++		len = EXT_MAX_BLOCKS;
  		ext_debug("cache gap(whole file):");
  	} else if (block < le32_to_cpu(ex->ee_block)) {
  		lblock = block;
-@@ -2146,8 +2145,8 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
+@@ -2145,8 +2146,8 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
  		path[depth].p_ext = ex;
  
  		a = ex_ee_block > start ? ex_ee_block : start;
--		b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCKS ?
--			ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCKS;
-+		b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCK ?
-+			ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCK;
+-		b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCK ?
+-			ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCK;
++		b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCKS ?
++			ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCKS;
  
  		ext_debug("  border %u:%u\n", a, b);
  
-@@ -2934,30 +2933,6 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+@@ -2933,6 +2934,30 @@ static int ext4_split_unwritten_extents(handle_t *handle,
  		ext4_ext_mark_uninitialized(ex3);
  		err = ext4_ext_insert_extent(handle, inode, path, ex3, flags);
  		if (err == -ENOSPC && may_zeroout) {
--			/*
--			 * This is different from the upstream, because we
--			 * need only a flag to say that the extent contains
--			 * the actual data.
--			 *
--			 * If the extent contains valid data, which can only
--			 * happen if AIO races with fallocate, then we got
--			 * here from ext4_convert_unwritten_extents_dio().
--			 * So we have to be careful not to zeroout valid data
--			 * in the extent.
--			 *
--			 * To avoid it, we only zeroout the ex3 and extend the
--			 * extent which is going to become initialized to cover
--			 * ex3 as well. and continue as we would if only
--			 * split in two was required.
--			 */
--			if (flags & EXT4_EXT_DATA_VALID) {
--				err =  ext4_ext_zeroout(inode, ex3);
--				if (err)
--					goto fix_extent_len;
--				max_blocks = allocated;
--				ex2->ee_len = cpu_to_le16(max_blocks);
--				goto skip;
--			}
++			/*
++			 * This is different from the upstream, because we
++			 * need only a flag to say that the extent contains
++			 * the actual data.
++			 *
++			 * If the extent contains valid data, which can only
++			 * happen if AIO races with fallocate, then we got
++			 * here from ext4_convert_unwritten_extents_dio().
++			 * So we have to be careful not to zeroout valid data
++			 * in the extent.
++			 *
++			 * To avoid it, we only zeroout the ex3 and extend the
++			 * extent which is going to become initialized to cover
++			 * ex3 as well. and continue as we would if only
++			 * split in two was required.
++			 */
++			if (flags & EXT4_EXT_DATA_VALID) {
++				err =  ext4_ext_zeroout(inode, ex3);
++				if (err)
++					goto fix_extent_len;
++				max_blocks = allocated;
++				ex2->ee_len = cpu_to_le16(max_blocks);
++				goto skip;
++			}
  			err =  ext4_ext_zeroout(inode, &orig_ex);
  			if (err)
  				goto fix_extent_len;
-@@ -3003,7 +2978,6 @@ static int ext4_split_unwritten_extents(handle_t *handle,
+@@ -2978,6 +3003,7 @@ static int ext4_split_unwritten_extents(handle_t *handle,
  
  		allocated = max_blocks;
  	}
--skip:
++skip:
  	/*
  	 * If there was a change of depth as part of the
  	 * insertion of ex3 above, we need to update the length
-@@ -3056,16 +3030,11 @@ fix_extent_len:
+@@ -3030,11 +3056,16 @@ fix_extent_len:
  	ext4_ext_dirty(handle, inode, path + depth);
  	return err;
  }
--
++
  static int ext4_convert_unwritten_extents_dio(handle_t *handle,
  					      struct inode *inode,
--					      ext4_lblk_t iblock,
--					      unsigned int max_blocks,
++					      ext4_lblk_t iblock,
++					      unsigned int max_blocks,
  					      struct ext4_ext_path *path)
  {
  	struct ext4_extent *ex;
--	ext4_lblk_t ee_block;
--	unsigned int ee_len;
++	ext4_lblk_t ee_block;
++	unsigned int ee_len;
  	struct ext4_extent_header *eh;
  	int depth;
  	int err = 0;
-@@ -3074,30 +3043,6 @@ static int ext4_convert_unwritten_extents_dio(handle_t *handle,
+@@ -3043,6 +3074,30 @@ static int ext4_convert_unwritten_extents_dio(handle_t *handle,
  	depth = ext_depth(inode);
  	eh = path[depth].p_hdr;
  	ex = path[depth].p_ext;
--	ee_block = le32_to_cpu(ex->ee_block);
--	ee_len = ext4_ext_get_actual_len(ex);
--
--	ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
--		  "block %llu, max_blocks %u\n", inode->i_ino,
--		  (unsigned long long)ee_block, ee_len);
--
--	/* If extent is larger than requested then split is required */
--
--	if (ee_block != iblock || ee_len > max_blocks) {
--		err = ext4_split_unwritten_extents(handle, inode, path,
--					iblock, max_blocks,
--					EXT4_EXT_DATA_VALID);
--		if (err < 0)
--			goto out;
--		ext4_ext_drop_refs(path);
--		path = ext4_ext_find_extent(inode, iblock, path);
--		if (IS_ERR(path)) {
--			err = PTR_ERR(path);
--			goto out;
--		}
--		depth = ext_depth(inode);
--		ex = path[depth].p_ext;
--	}
++	ee_block = le32_to_cpu(ex->ee_block);
++	ee_len = ext4_ext_get_actual_len(ex);
++
++	ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical"
++		  "block %llu, max_blocks %u\n", inode->i_ino,
++		  (unsigned long long)ee_block, ee_len);
++
++	/* If extent is larger than requested then split is required */
++
++	if (ee_block != iblock || ee_len > max_blocks) {
++		err = ext4_split_unwritten_extents(handle, inode, path,
++					iblock, max_blocks,
++					EXT4_EXT_DATA_VALID);
++		if (err < 0)
++			goto out;
++		ext4_ext_drop_refs(path);
++		path = ext4_ext_find_extent(inode, iblock, path);
++		if (IS_ERR(path)) {
++			err = PTR_ERR(path);
++			goto out;
++		}
++		depth = ext_depth(inode);
++		ex = path[depth].p_ext;
++	}
  
  	err = ext4_ext_get_access(handle, inode, path + depth);
  	if (err)
-@@ -3184,8 +3129,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
+@@ -3129,7 +3184,8 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode,
  	/* async DIO end_io complete, convert the filled extent to written */
  	if (flags == EXT4_GET_BLOCKS_DIO_CONVERT_EXT) {
  		ret = ext4_convert_unwritten_extents_dio(handle, inode,
--							 iblock, max_blocks,
--							 path);
-+							path);
+-							path);
++							 iblock, max_blocks,
++							 path);
  		if (ret >= 0)
  			ext4_update_inode_fsync_trans(handle, inode, 1);
  		goto out2;
-@@ -3554,12 +3498,6 @@ void ext4_ext_truncate(struct inode *inode)
+@@ -3498,6 +3554,12 @@ void ext4_ext_truncate(struct inode *inode)
  	int err = 0;
  
  	/*
--	 * finish any pending end_io work so we won't run the risk of
--	 * converting any truncated blocks to initialized later
--	 */
--	flush_aio_dio_completed_IO(inode);
--
--	/*
++	 * finish any pending end_io work so we won't run the risk of
++	 * converting any truncated blocks to initialized later
++	 */
++	flush_aio_dio_completed_IO(inode);
++
++	/*
  	 * probably first extent we're gonna free will be last in block
  	 */
  	err = ext4_writepage_trans_blocks(inode);
-@@ -3692,9 +3630,6 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
+@@ -3630,6 +3692,9 @@ long ext4_fallocate(struct inode *inode, int mode, loff_t offset, loff_t len)
  		mutex_unlock(&inode->i_mutex);
  		return ret;
  	}
--
--	/* Prevent race condition between unwritten */
--	flush_aio_dio_completed_IO(inode);
++
++	/* Prevent race condition between unwritten */
++	flush_aio_dio_completed_IO(inode);
  retry:
  	while (ret >= 0 && ret < max_blocks) {
  		block = block + ret;
-@@ -3848,14 +3783,15 @@ static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
+@@ -3783,15 +3848,14 @@ static int ext4_ext_fiemap_cb(struct inode *inode, struct ext4_ext_path *path,
  		flags |= FIEMAP_EXTENT_UNWRITTEN;
  
  	/*
--	 * If this extent reaches EXT_MAX_BLOCKS, it must be last.
-+	 * If this extent reaches EXT_MAX_BLOCK, it must be last.
+-	 * If this extent reaches EXT_MAX_BLOCK, it must be last.
++	 * If this extent reaches EXT_MAX_BLOCKS, it must be last.
  	 *
--	 * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCKS,
-+	 * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCK,
+-	 * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCK,
++	 * Or if ext4_ext_next_allocated_block is EXT_MAX_BLOCKS,
  	 * this also indicates no more allocated blocks.
  	 *
-+	 * XXX this might miss a single-block extent at EXT_MAX_BLOCK
+-	 * XXX this might miss a single-block extent at EXT_MAX_BLOCK
  	 */
--	if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCKS ||
--	    newex->ec_block + newex->ec_len == EXT_MAX_BLOCKS) {
-+	if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCK ||
-+	    newex->ec_block + newex->ec_len - 1 == EXT_MAX_BLOCK) {
+-	if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCK ||
+-	    newex->ec_block + newex->ec_len - 1 == EXT_MAX_BLOCK) {
++	if (ext4_ext_next_allocated_block(path) == EXT_MAX_BLOCKS ||
++	    newex->ec_block + newex->ec_len == EXT_MAX_BLOCKS) {
  		loff_t size = i_size_read(inode);
  		loff_t bs = EXT4_BLOCK_SIZE(inode->i_sb);
  
-@@ -3935,8 +3871,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+@@ -3871,8 +3935,8 @@ int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
  
  		start_blk = start >> inode->i_sb->s_blocksize_bits;
  		last_blk = (start + len - 1) >> inode->i_sb->s_blocksize_bits;
--		if (last_blk >= EXT_MAX_BLOCKS)
--			last_blk = EXT_MAX_BLOCKS-1;
-+		if (last_blk >= EXT_MAX_BLOCK)
-+			last_blk = EXT_MAX_BLOCK-1;
+-		if (last_blk >= EXT_MAX_BLOCK)
+-			last_blk = EXT_MAX_BLOCK-1;
++		if (last_blk >= EXT_MAX_BLOCKS)
++			last_blk = EXT_MAX_BLOCKS-1;
  		len_blks = ((ext4_lblk_t) last_blk) - start_blk + 1;
  
  		/*
 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index babf448..efe6363 100644
+index efe6363..babf448 100644
 --- a/fs/ext4/inode.c
 +++ b/fs/ext4/inode.c
-@@ -5121,7 +5121,6 @@ static int ext4_do_update_inode(handle_t *handle,
+@@ -5121,6 +5121,7 @@ static int ext4_do_update_inode(handle_t *handle,
  	struct ext4_inode_info *ei = EXT4_I(inode);
  	struct buffer_head *bh = iloc->bh;
  	int err = 0, rc, block;
--	int need_datasync = 0;
++	int need_datasync = 0;
  
  	/* For fields not not tracking in the in-memory inode,
  	 * initialise them to zero for new inodes. */
-@@ -5170,10 +5169,7 @@ static int ext4_do_update_inode(handle_t *handle,
+@@ -5169,7 +5170,10 @@ static int ext4_do_update_inode(handle_t *handle,
  		raw_inode->i_file_acl_high =
  			cpu_to_le16(ei->i_file_acl >> 32);
  	raw_inode->i_file_acl_lo = cpu_to_le32(ei->i_file_acl);
--	if (ei->i_disksize != ext4_isize(raw_inode)) {
--		ext4_isize_set(raw_inode, ei->i_disksize);
--		need_datasync = 1;
--	}
-+	ext4_isize_set(raw_inode, ei->i_disksize);
+-	ext4_isize_set(raw_inode, ei->i_disksize);
++	if (ei->i_disksize != ext4_isize(raw_inode)) {
++		ext4_isize_set(raw_inode, ei->i_disksize);
++		need_datasync = 1;
++	}
  	if (ei->i_disksize > 0x7fffffffULL) {
  		struct super_block *sb = inode->i_sb;
  		if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
-@@ -5226,7 +5222,7 @@ static int ext4_do_update_inode(handle_t *handle,
+@@ -5222,7 +5226,7 @@ static int ext4_do_update_inode(handle_t *handle,
  		err = rc;
  	ext4_clear_inode_state(inode, EXT4_STATE_NEW);
  
--	ext4_update_inode_fsync_trans(handle, inode, need_datasync);
-+	ext4_update_inode_fsync_trans(handle, inode, 0);
+-	ext4_update_inode_fsync_trans(handle, inode, 0);
++	ext4_update_inode_fsync_trans(handle, inode, need_datasync);
  out_brelse:
  	brelse(bh);
  	ext4_std_error(inode->i_sb, err);
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index cecf2a5..42bac1b 100644
+index 42bac1b..cecf2a5 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
-@@ -2070,11 +2070,7 @@ repeat:
+@@ -2070,7 +2070,11 @@ repeat:
  		group = ac->ac_g_ex.fe_group;
  
  		for (i = 0; i < ngroups; group++, i++) {
--			/*
--			 * Artificially restricted ngroups for non-extent
--			 * files makes group > ngroups possible on first loop.
--			 */
--			if (group >= ngroups)
-+			if (group == ngroups)
+-			if (group == ngroups)
++			/*
++			 * Artificially restricted ngroups for non-extent
++			 * files makes group > ngroups possible on first loop.
++			 */
++			if (group >= ngroups)
  				group = 0;
  
  			/* This now checks without needing the buddy page */
-@@ -4167,7 +4163,7 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
+@@ -4163,7 +4167,7 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
  		/* The max size of hash table is PREALLOC_TB_SIZE */
  		order = PREALLOC_TB_SIZE - 1;
  	/* Add the prealloc space to lg */
--	spin_lock(&lg->lg_prealloc_lock);
-+	rcu_read_lock();
+-	rcu_read_lock();
++	spin_lock(&lg->lg_prealloc_lock);
  	list_for_each_entry_rcu(tmp_pa, &lg->lg_prealloc_list[order],
  						pa_inode_list) {
  		spin_lock(&tmp_pa->pa_lock);
-@@ -4191,12 +4187,12 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
+@@ -4187,12 +4191,12 @@ static void ext4_mb_add_n_trim(struct ext4_allocation_context *ac)
  	if (!added)
  		list_add_tail_rcu(&pa->pa_inode_list,
  					&lg->lg_prealloc_list[order]);
--	spin_unlock(&lg->lg_prealloc_lock);
-+	rcu_read_unlock();
+-	rcu_read_unlock();
++	spin_unlock(&lg->lg_prealloc_lock);
  
  	/* Now trim the list to be not more than 8 elements */
  	if (lg_prealloc_count > 8) {
  		ext4_mb_discard_lg_preallocations(sb, lg,
--						  order, lg_prealloc_count);
-+						order, lg_prealloc_count);
+-						order, lg_prealloc_count);
++						  order, lg_prealloc_count);
  		return;
  	}
  	return ;
 diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
-index da25617..a73ed78 100644
+index a73ed78..da25617 100644
 --- a/fs/ext4/move_extent.c
 +++ b/fs/ext4/move_extent.c
 @@ -1001,12 +1001,12 @@ mext_check_arguments(struct inode *orig_inode,
  		return -EINVAL;
  	}
  
--	if ((orig_start >= EXT_MAX_BLOCKS) ||
--	    (donor_start >= EXT_MAX_BLOCKS) ||
--	    (*len > EXT_MAX_BLOCKS) ||
--	    (orig_start + *len >= EXT_MAX_BLOCKS))  {
-+	if ((orig_start > EXT_MAX_BLOCK) ||
-+	    (donor_start > EXT_MAX_BLOCK) ||
-+	    (*len > EXT_MAX_BLOCK) ||
-+	    (orig_start + *len > EXT_MAX_BLOCK))  {
+-	if ((orig_start > EXT_MAX_BLOCK) ||
+-	    (donor_start > EXT_MAX_BLOCK) ||
+-	    (*len > EXT_MAX_BLOCK) ||
+-	    (orig_start + *len > EXT_MAX_BLOCK))  {
++	if ((orig_start >= EXT_MAX_BLOCKS) ||
++	    (donor_start >= EXT_MAX_BLOCKS) ||
++	    (*len > EXT_MAX_BLOCKS) ||
++	    (orig_start + *len >= EXT_MAX_BLOCKS))  {
  		ext4_debug("ext4 move extent: Can't handle over [%u] blocks "
--			"[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCKS,
-+			"[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCK,
+-			"[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCK,
++			"[ino:orig %lu, donor %lu]\n", EXT_MAX_BLOCKS,
  			orig_inode->i_ino, donor_inode->i_ino);
  		return -EINVAL;
  	}
-@@ -1208,12 +1208,7 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
+@@ -1208,7 +1208,12 @@ ext4_move_extents(struct file *o_filp, struct file *d_filp,
  			orig_inode->i_ino, donor_inode->i_ino);
  		return -EINVAL;
  	}
--	/* TODO: This is non obvious task to swap blocks for inodes with full
--	   jornaling enabled */
--	if (ext4_should_journal_data(orig_inode) ||
--	    ext4_should_journal_data(donor_inode)) {
--		return -EINVAL;
--	}
-+
+-
++	/* TODO: This is non obvious task to swap blocks for inodes with full
++	   jornaling enabled */
++	if (ext4_should_journal_data(orig_inode) ||
++	    ext4_should_journal_data(donor_inode)) {
++		return -EINVAL;
++	}
  	/* Protect orig and donor inodes against a truncate */
  	ret1 = mext_inode_double_lock(orig_inode, donor_inode);
  	if (ret1 < 0)
 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
-index 3a1af19..c3b6ad0 100644
+index c3b6ad0..3a1af19 100644
 --- a/fs/ext4/namei.c
 +++ b/fs/ext4/namei.c
-@@ -1457,22 +1457,10 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
+@@ -1457,10 +1457,22 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
  	frame->at = entries;
  	frame->bh = bh;
  	bh = bh2;
--
--	ext4_handle_dirty_metadata(handle, dir, frame->bh);
--	ext4_handle_dirty_metadata(handle, dir, bh);
--
++
++	ext4_handle_dirty_metadata(handle, dir, frame->bh);
++	ext4_handle_dirty_metadata(handle, dir, bh);
++
  	de = do_split(handle,dir, &bh, frame, &hinfo, &retval);
--	if (!de) {
--		/*
--		 * Even if the block split failed, we have to properly write
--		 * out all the changes we did so far. Otherwise we can end up
--		 * with corrupted filesystem.
--		 */
--		ext4_mark_inode_dirty(handle, dir);
--		dx_release(frames);
-+	dx_release (frames);
-+	if (!(de))
+-	dx_release (frames);
+-	if (!(de))
++	if (!de) {
++		/*
++		 * Even if the block split failed, we have to properly write
++		 * out all the changes we did so far. Otherwise we can end up
++		 * with corrupted filesystem.
++		 */
++		ext4_mark_inode_dirty(handle, dir);
++		dx_release(frames);
  		return retval;
--	}
--	dx_release(frames);
++	}
++	dx_release(frames);
  
  	retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
  	brelse(bh);
-@@ -1828,7 +1816,9 @@ retry:
+@@ -1816,9 +1828,7 @@ retry:
  	err = PTR_ERR(inode);
  	if (!IS_ERR(inode)) {
  		init_special_inode(inode, inode->i_mode, rdev);
-+#ifdef CONFIG_EXT4_FS_XATTR
+-#ifdef CONFIG_EXT4_FS_XATTR
  		inode->i_op = &ext4_special_inode_operations;
-+#endif
+-#endif
  		err = ext4_add_nondir(handle, dentry, inode);
  	}
  	ext4_journal_stop(handle);
-@@ -2001,7 +1991,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+@@ -1991,7 +2001,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
  	struct ext4_iloc iloc;
  	int err = 0, rc;
  
--	if (!EXT4_SB(sb)->s_journal)
-+	if (!ext4_handle_valid(handle))
+-	if (!ext4_handle_valid(handle))
++	if (!EXT4_SB(sb)->s_journal)
  		return 0;
  
  	mutex_lock(&EXT4_SB(sb)->s_orphan_lock);
-@@ -2082,8 +2072,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
+@@ -2072,8 +2082,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
  	struct ext4_iloc iloc;
  	int err = 0;
  
--	if ((!EXT4_SB(inode->i_sb)->s_journal) &&
--	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
-+	/* ext4_handle_valid() assumes a valid handle_t pointer */
-+	if (handle && !ext4_handle_valid(handle))
+-	/* ext4_handle_valid() assumes a valid handle_t pointer */
+-	if (handle && !ext4_handle_valid(handle))
++	if ((!EXT4_SB(inode->i_sb)->s_journal) &&
++	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
  		return 0;
  
  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
-@@ -2102,7 +2092,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
+@@ -2092,7 +2102,7 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
  	 * transaction handle with which to update the orphan list on
  	 * disk, but we still need to remove the inode from the linked
  	 * list in memory. */
--	if (!handle)
-+	if (sbi->s_journal && !handle)
+-	if (sbi->s_journal && !handle)
++	if (!handle)
  		goto out;
  
  	err = ext4_reserve_inode_write(handle, inode, &iloc);
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 108515f..f1e7077 100644
+index f1e7077..108515f 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
-@@ -1937,9 +1937,7 @@ static void ext4_orphan_cleanup(struct super_block *sb,
+@@ -1937,7 +1937,9 @@ static void ext4_orphan_cleanup(struct super_block *sb,
  				__func__, inode->i_ino, inode->i_size);
  			jbd_debug(2, "truncating inode %lu to %lld bytes\n",
  				  inode->i_ino, inode->i_size);
--			mutex_lock(&inode->i_mutex);
++			mutex_lock(&inode->i_mutex);
  			ext4_truncate(inode);
--			mutex_unlock(&inode->i_mutex);
++			mutex_unlock(&inode->i_mutex);
  			nr_truncates++;
  		} else {
  			ext4_msg(sb, KERN_DEBUG,
-@@ -1977,12 +1975,6 @@ static void ext4_orphan_cleanup(struct super_block *sb,
+@@ -1975,6 +1977,12 @@ static void ext4_orphan_cleanup(struct super_block *sb,
   * in the vfs.  ext4 inode has 48 bits of i_block in fsblock units,
   * so that won't be a limiting factor.
   *
-- * However there is other limiting factor. We do store extents in the form
-- * of starting block and length, hence the resulting length of the extent
-- * covering maximum file size must fit into on-disk format containers as
-- * well. Given that length is always by 1 unit bigger than max unit (because
-- * we count 0 as well) we have to lower the s_maxbytes by one fs block.
-- *
++ * However there is other limiting factor. We do store extents in the form
++ * of starting block and length, hence the resulting length of the extent
++ * covering maximum file size must fit into on-disk format containers as
++ * well. Given that length is always by 1 unit bigger than max unit (because
++ * we count 0 as well) we have to lower the s_maxbytes by one fs block.
++ *
   * Note, this does *not* consider any metadata overhead for vfs i_blocks.
   */
  static loff_t ext4_max_size(int blkbits, int has_huge_files)
-@@ -2004,13 +1996,10 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
+@@ -1996,10 +2004,13 @@ static loff_t ext4_max_size(int blkbits, int has_huge_files)
  		upper_limit <<= blkbits;
  	}
  
--	/*
--	 * 32-bit extent-start container, ee_block. We lower the maxbytes
--	 * by one fs block, so ee_len can cover the extent of maximum file
--	 * size
--	 */
--	res = (1LL << 32) - 1;
-+	/* 32-bit extent-start container, ee_block */
-+	res = 1LL << 32;
+-	/* 32-bit extent-start container, ee_block */
+-	res = 1LL << 32;
++	/*
++	 * 32-bit extent-start container, ee_block. We lower the maxbytes
++	 * by one fs block, so ee_len can cover the extent of maximum file
++	 * size
++	 */
++	res = (1LL << 32) - 1;
  	res <<= blkbits;
-+	res -= 1;
+-	res -= 1;
  
  	/* Sanity check against vm- & vfs- imposed limits */
  	if (res > upper_limit)
 diff --git a/fs/fat/inode.c b/fs/fat/inode.c
-index c187e92..76b7961 100644
+index 76b7961..c187e92 100644
 --- a/fs/fat/inode.c
 +++ b/fs/fat/inode.c
 @@ -558,7 +558,7 @@ static int fat_statfs(struct dentry *dentry, struct kstatfs *buf)
  	buf->f_bavail = sbi->free_clusters;
  	buf->f_fsid.val[0] = (u32)id;
  	buf->f_fsid.val[1] = (u32)(id >> 32);
--	buf->f_namelen = sbi->options.isvfat ? FAT_LFN_LEN : 12;
-+	buf->f_namelen = sbi->options.isvfat ? 260 : 12;
+-	buf->f_namelen = sbi->options.isvfat ? 260 : 12;
++	buf->f_namelen = sbi->options.isvfat ? FAT_LFN_LEN : 12;
  
  	return 0;
  }
 diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
-index 4251f35..72646e2 100644
+index 72646e2..4251f35 100644
 --- a/fs/fat/namei_vfat.c
 +++ b/fs/fat/namei_vfat.c
-@@ -499,18 +499,17 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
+@@ -499,17 +499,18 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
  	int charlen;
  
  	if (utf8) {
--		*outlen = utf8s_to_utf16s(name, len, UTF16_HOST_ENDIAN,
--				(wchar_t *) outname, FAT_LFN_LEN + 2);
-+		*outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
+-		*outlen = utf8s_to_utf16s(name, len, (wchar_t *)outname);
++		*outlen = utf8s_to_utf16s(name, len, UTF16_HOST_ENDIAN,
++				(wchar_t *) outname, FAT_LFN_LEN + 2);
  		if (*outlen < 0)
  			return *outlen;
--		else if (*outlen > FAT_LFN_LEN)
-+		else if (*outlen > 255)
+-		else if (*outlen > 255)
++		else if (*outlen > FAT_LFN_LEN)
  			return -ENAMETOOLONG;
  
  		op = &outname[*outlen * sizeof(wchar_t)];
  	} else {
  		if (nls) {
  			for (i = 0, ip = name, op = outname, *outlen = 0;
--			     i < len && *outlen <= FAT_LFN_LEN;
-+			     i < len && *outlen <= 255;
+-			     i < len && *outlen <= 255;
++			     i < len && *outlen <= FAT_LFN_LEN;
  			     *outlen += 1)
  			{
  				if (escape && (*ip == ':')) {
-@@ -550,7 +549,7 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
+@@ -549,7 +550,7 @@ xlate_to_uni(const unsigned char *name, int len, unsigned char *outname,
  				return -ENAMETOOLONG;
  		} else {
  			for (i = 0, ip = name, op = outname, *outlen = 0;
--			     i < len && *outlen <= FAT_LFN_LEN;
-+			     i < len && *outlen <= 255;
+-			     i < len && *outlen <= 255;
++			     i < len && *outlen <= FAT_LFN_LEN;
  			     i++, *outlen += 1)
  			{
  				*op++ = *ip++;
 diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 4fd7e1c..46435f3a 100644
+index 46435f3a..4fd7e1c 100644
 --- a/fs/fscache/stats.c
 +++ b/fs/fscache/stats.c
 @@ -276,5 +276,5 @@ const struct file_operations fscache_stats_fops = {
  	.open		= fscache_stats_open,
  	.read		= seq_read,
  	.llseek		= seq_lseek,
--	.release        = single_release,
-+	.release	= seq_release,
+-	.release	= seq_release,
++	.release        = single_release,
  };
 diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index b3d234e..0022eec 100644
+index 0022eec..b3d234e 100644
 --- a/fs/hfsplus/extents.c
 +++ b/fs/hfsplus/extents.c
 @@ -447,7 +447,7 @@ void hfsplus_file_truncate(struct inode *inode)
  		struct address_space *mapping = inode->i_mapping;
  		struct page *page;
  		void *fsdata;
--		loff_t size = inode->i_size;
-+		u32 size = inode->i_size;
+-		u32 size = inode->i_size;
++		loff_t size = inode->i_size;
  		int res;
  
  		res = pagecache_write_begin(NULL, mapping, size, 0,
 diff --git a/fs/isofs/export.c b/fs/isofs/export.c
-index caec670..e81a305 100644
+index e81a305..caec670 100644
 --- a/fs/isofs/export.c
 +++ b/fs/isofs/export.c
-@@ -131,7 +131,6 @@ isofs_export_encode_fh(struct dentry *dentry,
+@@ -131,6 +131,7 @@ isofs_export_encode_fh(struct dentry *dentry,
  	len = 3;
  	fh32[0] = ei->i_iget5_block;
   	fh16[2] = (__u16)ei->i_iget5_offset;  /* fh16 [sic] */
--	fh16[3] = 0;  /* avoid leaking uninitialized data */
++	fh16[3] = 0;  /* avoid leaking uninitialized data */
  	fh32[2] = inode->i_generation;
  	if (connectable && !S_ISDIR(inode->i_mode)) {
  		struct inode *parent;
 diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c
-index 1060d48..17d29a8 100644
+index 17d29a8..1060d48 100644
 --- a/fs/jbd/commit.c
 +++ b/fs/jbd/commit.c
-@@ -85,12 +85,7 @@ nope:
+@@ -85,7 +85,12 @@ nope:
  static void release_data_buffer(struct buffer_head *bh)
  {
  	if (buffer_freed(bh)) {
--		WARN_ON_ONCE(buffer_dirty(bh));
++		WARN_ON_ONCE(buffer_dirty(bh));
  		clear_buffer_freed(bh);
--		clear_buffer_mapped(bh);
--		clear_buffer_new(bh);
--		clear_buffer_req(bh);
--		bh->b_bdev = NULL;
++		clear_buffer_mapped(bh);
++		clear_buffer_new(bh);
++		clear_buffer_req(bh);
++		bh->b_bdev = NULL;
  		release_buffer_page(bh);
  	} else
  		put_bh(bh);
-@@ -869,35 +864,17 @@ restart_loop:
+@@ -864,17 +869,35 @@ restart_loop:
  		 * there's no point in keeping a checkpoint record for
  		 * it. */
  
--		/*
--		 * A buffer which has been freed while still being journaled by
--		 * a previous transaction.
--		 */
-+		/* A buffer which has been freed while still being
-+		 * journaled by a previous transaction may end up still
-+		 * being dirty here, but we want to avoid writing back
-+		 * that buffer in the future now that the last use has
-+		 * been committed.  That's not only a performance gain,
-+		 * it also stops aliasing problems if the buffer is left
-+		 * behind for writeback and gets reallocated for another
-+		 * use in a different page. */
+-		/* A buffer which has been freed while still being
+-		 * journaled by a previous transaction may end up still
+-		 * being dirty here, but we want to avoid writing back
+-		 * that buffer in the future now that the last use has
+-		 * been committed.  That's not only a performance gain,
+-		 * it also stops aliasing problems if the buffer is left
+-		 * behind for writeback and gets reallocated for another
+-		 * use in a different page. */
++		/*
++		 * A buffer which has been freed while still being journaled by
++		 * a previous transaction.
++		 */
  		if (buffer_freed(bh)) {
--			/*
--			 * If the running transaction is the one containing
--			 * "add to orphan" operation (b_next_transaction !=
--			 * NULL), we have to wait for that transaction to
--			 * commit before we can really get rid of the buffer.
--			 * So just clear b_modified to not confuse transaction
--			 * credit accounting and refile the buffer to
--			 * BJ_Forget of the running transaction. If the just
--			 * committed transaction contains "add to orphan"
--			 * operation, we can completely invalidate the buffer
--			 * now. We are rather throughout in that since the
--			 * buffer may be still accessible when blocksize <
--			 * pagesize and it is attached to the last partial
--			 * page.
--			 */
--			jh->b_modified = 0;
--			if (!jh->b_next_transaction) {
--				clear_buffer_freed(bh);
--				clear_buffer_jbddirty(bh);
--				clear_buffer_mapped(bh);
--				clear_buffer_new(bh);
--				clear_buffer_req(bh);
--				bh->b_bdev = NULL;
--			}
-+			clear_buffer_freed(bh);
-+			clear_buffer_jbddirty(bh);
+-			clear_buffer_freed(bh);
+-			clear_buffer_jbddirty(bh);
++			/*
++			 * If the running transaction is the one containing
++			 * "add to orphan" operation (b_next_transaction !=
++			 * NULL), we have to wait for that transaction to
++			 * commit before we can really get rid of the buffer.
++			 * So just clear b_modified to not confuse transaction
++			 * credit accounting and refile the buffer to
++			 * BJ_Forget of the running transaction. If the just
++			 * committed transaction contains "add to orphan"
++			 * operation, we can completely invalidate the buffer
++			 * now. We are rather throughout in that since the
++			 * buffer may be still accessible when blocksize <
++			 * pagesize and it is attached to the last partial
++			 * page.
++			 */
++			jh->b_modified = 0;
++			if (!jh->b_next_transaction) {
++				clear_buffer_freed(bh);
++				clear_buffer_jbddirty(bh);
++				clear_buffer_mapped(bh);
++				clear_buffer_new(bh);
++				clear_buffer_req(bh);
++				bh->b_bdev = NULL;
++			}
  		}
  
  		if (buffer_jbddirty(bh)) {
 diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
-index 1352e60..006f9ad 100644
+index 006f9ad..1352e60 100644
 --- a/fs/jbd/transaction.c
 +++ b/fs/jbd/transaction.c
-@@ -1838,16 +1838,15 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
+@@ -1838,15 +1838,16 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
   * We're outside-transaction here.  Either or both of j_running_transaction
   * and j_committing_transaction may be NULL.
   */
--static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
--				int partial_page)
-+static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
+-static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
++static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh,
++				int partial_page)
  {
  	transaction_t *transaction;
  	struct journal_head *jh;
  	int may_free = 1;
-+	int ret;
+-	int ret;
  
  	BUFFER_TRACE(bh, "entry");
  
--retry:
++retry:
  	/*
  	 * It is safe to proceed here without the j_list_lock because the
  	 * buffers cannot be stolen by try_to_free_buffers as long as we are
-@@ -1865,29 +1864,6 @@ retry:
+@@ -1864,6 +1865,29 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
  	if (!jh)
  		goto zap_buffer_no_jh;
  
--	/*
--	 * We cannot remove the buffer from checkpoint lists until the
--	 * transaction adding inode to orphan list (let's call it T)
--	 * is committed.  Otherwise if the transaction changing the
--	 * buffer would be cleaned from the journal before T is
--	 * committed, a crash will cause that the correct contents of
--	 * the buffer will be lost.  On the other hand we have to
--	 * clear the buffer dirty bit at latest at the moment when the
--	 * transaction marking the buffer as freed in the filesystem
--	 * structures is committed because from that moment on the
--	 * block can be reallocated and used by a different page.
--	 * Since the block hasn't been freed yet but the inode has
--	 * already been added to orphan list, it is safe for us to add
--	 * the buffer to BJ_Forget list of the newest transaction.
--	 *
--	 * Also we have to clear buffer_mapped flag of a truncated buffer
--	 * because the buffer_head may be attached to the page straddling
--	 * i_size (can happen only when blocksize < pagesize) and thus the
--	 * buffer_head can be reused when the file is extended again. So we end
--	 * up keeping around invalidated buffers attached to transactions'
--	 * BJ_Forget list just to stop checkpointing code from cleaning up
--	 * the transaction this buffer was modified in.
--	 */
++	/*
++	 * We cannot remove the buffer from checkpoint lists until the
++	 * transaction adding inode to orphan list (let's call it T)
++	 * is committed.  Otherwise if the transaction changing the
++	 * buffer would be cleaned from the journal before T is
++	 * committed, a crash will cause that the correct contents of
++	 * the buffer will be lost.  On the other hand we have to
++	 * clear the buffer dirty bit at latest at the moment when the
++	 * transaction marking the buffer as freed in the filesystem
++	 * structures is committed because from that moment on the
++	 * block can be reallocated and used by a different page.
++	 * Since the block hasn't been freed yet but the inode has
++	 * already been added to orphan list, it is safe for us to add
++	 * the buffer to BJ_Forget list of the newest transaction.
++	 *
++	 * Also we have to clear buffer_mapped flag of a truncated buffer
++	 * because the buffer_head may be attached to the page straddling
++	 * i_size (can happen only when blocksize < pagesize) and thus the
++	 * buffer_head can be reused when the file is extended again. So we end
++	 * up keeping around invalidated buffers attached to transactions'
++	 * BJ_Forget list just to stop checkpointing code from cleaning up
++	 * the transaction this buffer was modified in.
++	 */
  	transaction = jh->b_transaction;
  	if (transaction == NULL) {
  		/* First case: not on any transaction.  If it
-@@ -1913,9 +1889,13 @@ retry:
+@@ -1889,13 +1913,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
  			 * committed, the buffer won't be needed any
  			 * longer. */
  			JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
--			may_free = __dispose_buffer(jh,
-+			ret = __dispose_buffer(jh,
+-			ret = __dispose_buffer(jh,
++			may_free = __dispose_buffer(jh,
  					journal->j_running_transaction);
--			goto zap_buffer;
-+			journal_put_journal_head(jh);
-+			spin_unlock(&journal->j_list_lock);
-+			jbd_unlock_bh_state(bh);
-+			spin_unlock(&journal->j_state_lock);
-+			return ret;
+-			journal_put_journal_head(jh);
+-			spin_unlock(&journal->j_list_lock);
+-			jbd_unlock_bh_state(bh);
+-			spin_unlock(&journal->j_state_lock);
+-			return ret;
++			goto zap_buffer;
  		} else {
  			/* There is no currently-running transaction. So the
  			 * orphan record which we wrote for this file must have
-@@ -1923,9 +1903,13 @@ retry:
+@@ -1903,13 +1923,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
  			 * the committing transaction, if it exists. */
  			if (journal->j_committing_transaction) {
  				JBUFFER_TRACE(jh, "give to committing trans");
--				may_free = __dispose_buffer(jh,
-+				ret = __dispose_buffer(jh,
+-				ret = __dispose_buffer(jh,
++				may_free = __dispose_buffer(jh,
  					journal->j_committing_transaction);
--				goto zap_buffer;
-+				journal_put_journal_head(jh);
-+				spin_unlock(&journal->j_list_lock);
-+				jbd_unlock_bh_state(bh);
-+				spin_unlock(&journal->j_state_lock);
-+				return ret;
+-				journal_put_journal_head(jh);
+-				spin_unlock(&journal->j_list_lock);
+-				jbd_unlock_bh_state(bh);
+-				spin_unlock(&journal->j_state_lock);
+-				return ret;
++				goto zap_buffer;
  			} else {
  				/* The orphan record's transaction has
  				 * committed.  We can cleanse this buffer */
-@@ -1945,31 +1929,16 @@ retry:
+@@ -1929,16 +1945,31 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
  			goto zap_buffer;
  		}
  		/*
--		 * The buffer is committing, we simply cannot touch
--		 * it. If the page is straddling i_size we have to wait
--		 * for commit and try again.
--		 */
--		if (partial_page) {
--			tid_t tid = journal->j_committing_transaction->t_tid;
--
--			journal_put_journal_head(jh);
--			spin_unlock(&journal->j_list_lock);
--			jbd_unlock_bh_state(bh);
--			spin_unlock(&journal->j_state_lock);
--			unlock_buffer(bh);
--			log_wait_commit(journal, tid);
--			lock_buffer(bh);
--			goto retry;
--		}
--		/*
--		 * OK, buffer won't be reachable after truncate. We just set
--		 * j_next_transaction to the running transaction (if there is
--		 * one) and mark buffer as freed so that commit code knows it
--		 * should clear dirty bits when it is done with the buffer.
--		 */
-+		 * If it is committing, we simply cannot touch it.  We
-+		 * can remove it's next_transaction pointer from the
-+		 * running transaction if that is set, but nothing
-+		 * else. */
- 		set_buffer_freed(bh);
--		if (journal->j_running_transaction && buffer_jbddirty(bh))
--			jh->b_next_transaction = journal->j_running_transaction;
-+		if (jh->b_next_transaction) {
-+			J_ASSERT(jh->b_next_transaction ==
-+					journal->j_running_transaction);
-+			jh->b_next_transaction = NULL;
-+		}
+-		 * If it is committing, we simply cannot touch it.  We
+-		 * can remove it's next_transaction pointer from the
+-		 * running transaction if that is set, but nothing
+-		 * else. */
+-		set_buffer_freed(bh);
+-		if (jh->b_next_transaction) {
+-			J_ASSERT(jh->b_next_transaction ==
+-					journal->j_running_transaction);
+-			jh->b_next_transaction = NULL;
++		 * The buffer is committing, we simply cannot touch
++		 * it. If the page is straddling i_size we have to wait
++		 * for commit and try again.
++		 */
++		if (partial_page) {
++			tid_t tid = journal->j_committing_transaction->t_tid;
++
++			journal_put_journal_head(jh);
++			spin_unlock(&journal->j_list_lock);
++			jbd_unlock_bh_state(bh);
++			spin_unlock(&journal->j_state_lock);
++			unlock_buffer(bh);
++			log_wait_commit(journal, tid);
++			lock_buffer(bh);
++			goto retry;
+ 		}
++		/*
++		 * OK, buffer won't be reachable after truncate. We just set
++		 * j_next_transaction to the running transaction (if there is
++		 * one) and mark buffer as freed so that commit code knows it
++		 * should clear dirty bits when it is done with the buffer.
++		 */
++		set_buffer_freed(bh);
++		if (journal->j_running_transaction && buffer_jbddirty(bh))
++			jh->b_next_transaction = journal->j_running_transaction;
  		journal_put_journal_head(jh);
  		spin_unlock(&journal->j_list_lock);
  		jbd_unlock_bh_state(bh);
-@@ -1988,14 +1957,6 @@ retry:
+@@ -1957,6 +1988,14 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
  	}
  
  zap_buffer:
--	/*
--	 * This is tricky. Although the buffer is truncated, it may be reused
--	 * if blocksize < pagesize and it is attached to the page straddling
--	 * EOF. Since the buffer might have been added to BJ_Forget list of the
--	 * running transaction, journal_get_write_access() won't clear
--	 * b_modified and credit accounting gets confused. So clear b_modified
--	 * here. */
--	jh->b_modified = 0;
++	/*
++	 * This is tricky. Although the buffer is truncated, it may be reused
++	 * if blocksize < pagesize and it is attached to the page straddling
++	 * EOF. Since the buffer might have been added to BJ_Forget list of the
++	 * running transaction, journal_get_write_access() won't clear
++	 * b_modified and credit accounting gets confused. So clear b_modified
++	 * here. */
++	jh->b_modified = 0;
  	journal_put_journal_head(jh);
  zap_buffer_no_jh:
  	spin_unlock(&journal->j_list_lock);
-@@ -2044,8 +2005,7 @@ void journal_invalidatepage(journal_t *journal,
+@@ -2005,7 +2044,8 @@ void journal_invalidatepage(journal_t *journal,
  		if (offset <= curr_off) {
  			/* This block is wholly outside the truncation point */
  			lock_buffer(bh);
--			may_free &= journal_unmap_buffer(journal, bh,
--							 offset > 0);
-+			may_free &= journal_unmap_buffer(journal, bh);
+-			may_free &= journal_unmap_buffer(journal, bh);
++			may_free &= journal_unmap_buffer(journal, bh,
++							 offset > 0);
  			unlock_buffer(bh);
  		}
  		curr_off = next_off;
-@@ -2160,7 +2120,7 @@ void journal_file_buffer(struct journal_head *jh,
+@@ -2120,7 +2160,7 @@ void journal_file_buffer(struct journal_head *jh,
   */
  void __journal_refile_buffer(struct journal_head *jh)
  {
--	int was_dirty, jlist;
-+	int was_dirty;
+-	int was_dirty;
++	int was_dirty, jlist;
  	struct buffer_head *bh = jh2bh(jh);
  
  	J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
-@@ -2182,13 +2142,8 @@ void __journal_refile_buffer(struct journal_head *jh)
+@@ -2142,8 +2182,13 @@ void __journal_refile_buffer(struct journal_head *jh)
  	__journal_temp_unlink_buffer(jh);
  	jh->b_transaction = jh->b_next_transaction;
  	jh->b_next_transaction = NULL;
--	if (buffer_freed(bh))
--		jlist = BJ_Forget;
--	else if (jh->b_modified)
--		jlist = BJ_Metadata;
--	else
--		jlist = BJ_Reserved;
--	__journal_file_buffer(jh, jh->b_transaction, jlist);
-+	__journal_file_buffer(jh, jh->b_transaction,
-+				jh->b_modified ? BJ_Metadata : BJ_Reserved);
+-	__journal_file_buffer(jh, jh->b_transaction,
+-				jh->b_modified ? BJ_Metadata : BJ_Reserved);
++	if (buffer_freed(bh))
++		jlist = BJ_Forget;
++	else if (jh->b_modified)
++		jlist = BJ_Metadata;
++	else
++		jlist = BJ_Reserved;
++	__journal_file_buffer(jh, jh->b_transaction, jlist);
  	J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
  
  	if (was_dirty)
 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index ab87b05..6d27757 100644
+index 6d27757..ab87b05 100644
 --- a/fs/nfsd/nfs4xdr.c
 +++ b/fs/nfsd/nfs4xdr.c
-@@ -2610,16 +2610,11 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
+@@ -2610,11 +2610,16 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
  	len = maxcount;
  	v = 0;
  	while (len > 0) {
--		pn = resp->rqstp->rq_resused;
--		if (!resp->rqstp->rq_respages[pn]) { /* ran out of pages */
--			maxcount -= len;
--			break;
--		}
-+		pn = resp->rqstp->rq_resused++;
+-		pn = resp->rqstp->rq_resused++;
++		pn = resp->rqstp->rq_resused;
++		if (!resp->rqstp->rq_respages[pn]) { /* ran out of pages */
++			maxcount -= len;
++			break;
++		}
  		resp->rqstp->rq_vec[v].iov_base =
  			page_address(resp->rqstp->rq_respages[pn]);
  		resp->rqstp->rq_vec[v].iov_len =
  			len < PAGE_SIZE ? len : PAGE_SIZE;
--		resp->rqstp->rq_resused++;
++		resp->rqstp->rq_resused++;
  		v++;
  		len -= PAGE_SIZE;
  	}
-@@ -2667,8 +2662,6 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd
+@@ -2662,6 +2667,8 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd
  		return nfserr;
  	if (resp->xbuf->page_len)
  		return nfserr_resource;
--	if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
--		return nfserr_resource;
++	if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
++		return nfserr_resource;
  
  	page = page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused++]);
  
-@@ -2718,8 +2711,6 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
+@@ -2711,6 +2718,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
  		return nfserr;
  	if (resp->xbuf->page_len)
  		return nfserr_resource;
--	if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
--		return nfserr_resource;
++	if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
++		return nfserr_resource;
  
  	RESERVE_SPACE(8);  /* verifier */
  	savep = p;
 diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
-index 0eb059e..44a88a9 100644
+index 44a88a9..0eb059e 100644
 --- a/fs/nls/nls_base.c
 +++ b/fs/nls/nls_base.c
-@@ -114,57 +114,34 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxlen)
+@@ -114,34 +114,57 @@ int utf32_to_utf8(unicode_t u, u8 *s, int maxlen)
  }
  EXPORT_SYMBOL(utf32_to_utf8);
  
--static inline void put_utf16(wchar_t *s, unsigned c, enum utf16_endian endian)
--{
--	switch (endian) {
--	default:
--		*s = (wchar_t) c;
--		break;
--	case UTF16_LITTLE_ENDIAN:
--		*s = __cpu_to_le16(c);
--		break;
--	case UTF16_BIG_ENDIAN:
--		*s = __cpu_to_be16(c);
--		break;
--	}
--}
--
--int utf8s_to_utf16s(const u8 *s, int len, enum utf16_endian endian,
--		wchar_t *pwcs, int maxlen)
-+int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
+-int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs)
++static inline void put_utf16(wchar_t *s, unsigned c, enum utf16_endian endian)
++{
++	switch (endian) {
++	default:
++		*s = (wchar_t) c;
++		break;
++	case UTF16_LITTLE_ENDIAN:
++		*s = __cpu_to_le16(c);
++		break;
++	case UTF16_BIG_ENDIAN:
++		*s = __cpu_to_be16(c);
++		break;
++	}
++}
++
++int utf8s_to_utf16s(const u8 *s, int len, enum utf16_endian endian,
++		wchar_t *pwcs, int maxlen)
  {
  	u16 *op;
  	int size;
  	unicode_t u;
  
  	op = pwcs;
--	while (len > 0 && maxlen > 0 && *s) {
-+	while (*s && len > 0) {
+-	while (*s && len > 0) {
++	while (len > 0 && maxlen > 0 && *s) {
  		if (*s & 0x80) {
  			size = utf8_to_utf32(s, len, &u);
  			if (size < 0)
  				return -EINVAL;
--			s += size;
--			len -= size;
++			s += size;
++			len -= size;
  
  			if (u >= PLANE_SIZE) {
--				if (maxlen < 2)
--					break;
++				if (maxlen < 2)
++					break;
  				u -= PLANE_SIZE;
--				put_utf16(op++, SURROGATE_PAIR |
--						((u >> 10) & SURROGATE_BITS),
--						endian);
--				put_utf16(op++, SURROGATE_PAIR |
-+				*op++ = (wchar_t) (SURROGATE_PAIR |
-+						((u >> 10) & SURROGATE_BITS));
-+				*op++ = (wchar_t) (SURROGATE_PAIR |
+-				*op++ = (wchar_t) (SURROGATE_PAIR |
+-						((u >> 10) & SURROGATE_BITS));
+-				*op++ = (wchar_t) (SURROGATE_PAIR |
++				put_utf16(op++, SURROGATE_PAIR |
++						((u >> 10) & SURROGATE_BITS),
++						endian);
++				put_utf16(op++, SURROGATE_PAIR |
  						SURROGATE_LOW |
--						(u & SURROGATE_BITS),
--						endian);
--				maxlen -= 2;
-+						(u & SURROGATE_BITS));
+-						(u & SURROGATE_BITS));
++						(u & SURROGATE_BITS),
++						endian);
++				maxlen -= 2;
  			} else {
--				put_utf16(op++, u, endian);
--				maxlen--;
-+				*op++ = (wchar_t) u;
+-				*op++ = (wchar_t) u;
++				put_utf16(op++, u, endian);
++				maxlen--;
  			}
-+			s += size;
-+			len -= size;
+-			s += size;
+-			len -= size;
  		} else {
--			put_utf16(op++, *s++, endian);
-+			*op++ = *s++;
+-			*op++ = *s++;
++			put_utf16(op++, *s++, endian);
  			len--;
--			maxlen--;
++			maxlen--;
  		}
  	}
  	return op - pwcs;
 diff --git a/fs/splice.c b/fs/splice.c
-index cdad986..bb92b7c5 100644
+index bb92b7c5..cdad986 100644
 --- a/fs/splice.c
 +++ b/fs/splice.c
-@@ -30,7 +30,6 @@
+@@ -30,6 +30,7 @@
  #include <linux/syscalls.h>
  #include <linux/uio.h>
  #include <linux/security.h>
--#include <linux/socket.h>
++#include <linux/socket.h>
  
  /*
   * Attempt to steal a page from a pipe buffer. This should perhaps go into
-@@ -638,11 +637,7 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
+@@ -637,7 +638,11 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
  
  	ret = buf->ops->confirm(pipe, buf);
  	if (!ret) {
--		more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
--
--		if (sd->len < sd->total_len && pipe->nrbufs > 1)
--			more |= MSG_SENDPAGE_NOTLAST;
--
-+		more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
+-		more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
++		more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
++
++		if (sd->len < sd->total_len && pipe->nrbufs > 1)
++			more |= MSG_SENDPAGE_NOTLAST;
++
  		if (file->f_op && file->f_op->sendpage)
  			ret = file->f_op->sendpage(file, buf->page, buf->offset,
  						   sd->len, &pos, more);
 diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 5e7279a..e020183 100644
+index e020183..5e7279a 100644
 --- a/fs/sysfs/dir.c
 +++ b/fs/sysfs/dir.c
-@@ -440,18 +440,20 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
+@@ -440,20 +440,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
  /**
   *	sysfs_pathname - return full path to sysfs dirent
   *	@sd: sysfs_dirent whose path we want
-- *	@path: caller allocated buffer of size PATH_MAX
-+ *	@path: caller allocated buffer
+- *	@path: caller allocated buffer
++ *	@path: caller allocated buffer of size PATH_MAX
   *
   *	Gives the name "/" to the sysfs_root entry; any path returned
   *	is relative to wherever sysfs is mounted.
-+ *
-+ *	XXX: does no error checking on @path size
+- *
+- *	XXX: does no error checking on @path size
   */
  static char *sysfs_pathname(struct sysfs_dirent *sd, char *path)
  {
  	if (sd->s_parent) {
  		sysfs_pathname(sd->s_parent, path);
--		strlcat(path, "/", PATH_MAX);
-+		strcat(path, "/");
+-		strcat(path, "/");
++		strlcat(path, "/", PATH_MAX);
  	}
--	strlcat(path, sd->s_name, PATH_MAX);
-+	strcat(path, sd->s_name);
+-	strcat(path, sd->s_name);
++	strlcat(path, sd->s_name, PATH_MAX);
  	return path;
  }
  
-@@ -484,11 +486,9 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
+@@ -486,9 +484,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd)
  		char *path = kzalloc(PATH_MAX, GFP_KERNEL);
  		WARN(1, KERN_WARNING
  		     "sysfs: cannot create duplicate filename '%s'\n",
--		     (path == NULL) ? sd->s_name
--				    : (sysfs_pathname(acxt->parent_sd, path),
--				       strlcat(path, "/", PATH_MAX),
--				       strlcat(path, sd->s_name, PATH_MAX),
--				       path));
-+		     (path == NULL) ? sd->s_name :
-+		     strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
-+		            sd->s_name));
+-		     (path == NULL) ? sd->s_name :
+-		     strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"),
+-		            sd->s_name));
++		     (path == NULL) ? sd->s_name
++				    : (sysfs_pathname(acxt->parent_sd, path),
++				       strlcat(path, "/", PATH_MAX),
++				       strlcat(path, sd->s_name, PATH_MAX),
++				       path));
  		kfree(path);
  	}
  
 diff --git a/fs/udf/inode.c b/fs/udf/inode.c
-index 3c4ffb2..6d24c2c 100644
+index 6d24c2c..3c4ffb2 100644
 --- a/fs/udf/inode.c
 +++ b/fs/udf/inode.c
-@@ -648,8 +648,6 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+@@ -648,6 +648,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
  				goal, err);
  		if (!newblocknum) {
  			brelse(prev_epos.bh);
--			brelse(cur_epos.bh);
--			brelse(next_epos.bh);
++			brelse(cur_epos.bh);
++			brelse(next_epos.bh);
  			*err = -ENOSPC;
  			return NULL;
  		}
-@@ -680,8 +678,6 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
+@@ -678,6 +680,8 @@ static struct buffer_head *inode_getblk(struct inode *inode, sector_t block,
  	udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
  
  	brelse(prev_epos.bh);
--	brelse(cur_epos.bh);
--	brelse(next_epos.bh);
++	brelse(cur_epos.bh);
++	brelse(next_epos.bh);
  
  	newblock = udf_get_pblock(inode->i_sb, newblocknum,
  				iinfo->i_location.partitionReferenceNum, 0);
 diff --git a/fs/udf/namei.c b/fs/udf/namei.c
-index b754151..21dad8c 100644
+index 21dad8c..b754151 100644
 --- a/fs/udf/namei.c
 +++ b/fs/udf/namei.c
-@@ -1331,7 +1331,6 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
+@@ -1331,6 +1331,7 @@ static int udf_encode_fh(struct dentry *de, __u32 *fh, int *lenp,
  	*lenp = 3;
  	fid->udf.block = location.logicalBlockNum;
  	fid->udf.partref = location.partitionReferenceNum;
--	fid->udf.parent_partref = 0;
++	fid->udf.parent_partref = 0;
  	fid->udf.generation = inode->i_generation;
  
  	if (connectable && !S_ISDIR(inode->i_mode)) {
 diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
-index efa82c9..d113b72 100644
+index d113b72..efa82c9 100644
 --- a/fs/udf/udf_sb.h
 +++ b/fs/udf/udf_sb.h
 @@ -78,7 +78,7 @@ struct udf_virtual_data {
  struct udf_bitmap {
  	__u32			s_extLength;
  	__u32			s_extPosition;
--	int			s_nr_groups;
-+	__u16			s_nr_groups;
+-	__u16			s_nr_groups;
++	int			s_nr_groups;
  	struct buffer_head 	**s_block_bitmap;
  };
  
 diff --git a/include/asm-generic/signal.h b/include/asm-generic/signal.h
-index 743f7a5..555c0ae 100644
+index 555c0ae..743f7a5 100644
 --- a/include/asm-generic/signal.h
 +++ b/include/asm-generic/signal.h
-@@ -99,10 +99,6 @@ typedef unsigned long old_sigset_t;
+@@ -99,6 +99,10 @@ typedef unsigned long old_sigset_t;
  
  #include <asm-generic/signal-defs.h>
  
--#ifdef SA_RESTORER
--#define __ARCH_HAS_SA_RESTORER
--#endif
--
++#ifdef SA_RESTORER
++#define __ARCH_HAS_SA_RESTORER
++#endif
++
  struct sigaction {
  	__sighandler_t sa_handler;
  	unsigned long sa_flags;
 diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
-index 9ffffec..a3d802e 100644
+index a3d802e..9ffffec 100644
 --- a/include/linux/binfmts.h
 +++ b/include/linux/binfmts.h
-@@ -71,6 +71,8 @@ extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
+@@ -71,8 +71,6 @@ extern struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
  #define BINPRM_FLAGS_EXECFD_BIT 1
  #define BINPRM_FLAGS_EXECFD (1 << BINPRM_FLAGS_EXECFD_BIT)
  
-+#define BINPRM_MAX_RECURSION 4
-+
+-#define BINPRM_MAX_RECURSION 4
+-
  /*
   * This structure defines the functions that are used to load the binary formats that
   * linux accepts.
-@@ -120,7 +122,6 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
+@@ -122,6 +120,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
  			   unsigned long stack_top,
  			   int executable_stack);
  extern int bprm_mm_init(struct linux_binprm *bprm);
--extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
++extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
  extern int copy_strings_kernel(int argc,char ** argv,struct linux_binprm *bprm);
  extern int prepare_bprm_creds(struct linux_binprm *bprm);
  extern void install_exec_creds(struct linux_binprm *bprm);
 diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
-index ec9c10b..5eb6cb0 100644
+index 5eb6cb0..ec9c10b 100644
 --- a/include/linux/blkdev.h
 +++ b/include/linux/blkdev.h
-@@ -456,7 +456,8 @@ struct request_queue
+@@ -456,8 +456,7 @@ struct request_queue
  #define QUEUE_FLAG_NONROT      14	/* non-rotational device (SSD) */
  #define QUEUE_FLAG_VIRT        QUEUE_FLAG_NONROT /* paravirt device */
  #define QUEUE_FLAG_IO_STAT     15	/* do IO stats */
--#define QUEUE_FLAG_DISCARD     16	/* supports DISCARD */
-+#define QUEUE_FLAG_CQ	       16	/* hardware does queuing */
-+#define QUEUE_FLAG_DISCARD     17	/* supports DISCARD */
+-#define QUEUE_FLAG_CQ	       16	/* hardware does queuing */
+-#define QUEUE_FLAG_DISCARD     17	/* supports DISCARD */
++#define QUEUE_FLAG_DISCARD     16	/* supports DISCARD */
  
  #define QUEUE_FLAG_DEFAULT	((1 << QUEUE_FLAG_IO_STAT) |		\
  				 (1 << QUEUE_FLAG_STACKABLE)	|	\
-@@ -579,6 +580,7 @@ enum {
+@@ -580,7 +579,6 @@ enum {
  
  #define blk_queue_plugged(q)	test_bit(QUEUE_FLAG_PLUGGED, &(q)->queue_flags)
  #define blk_queue_tagged(q)	test_bit(QUEUE_FLAG_QUEUED, &(q)->queue_flags)
-+#define blk_queue_queuing(q)	test_bit(QUEUE_FLAG_CQ, &(q)->queue_flags)
+-#define blk_queue_queuing(q)	test_bit(QUEUE_FLAG_CQ, &(q)->queue_flags)
  #define blk_queue_stopped(q)	test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags)
  #define blk_queue_nomerges(q)	test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags)
  #define blk_queue_nonrot(q)	test_bit(QUEUE_FLAG_NONROT, &(q)->queue_flags)
 diff --git a/include/linux/kmod.h b/include/linux/kmod.h
-index 93e732e..0546fe7 100644
+index 0546fe7..93e732e 100644
 --- a/include/linux/kmod.h
 +++ b/include/linux/kmod.h
-@@ -64,8 +64,6 @@ enum umh_wait {
+@@ -64,6 +64,8 @@ enum umh_wait {
  	UMH_WAIT_PROC = 1,	/* wait for the process to complete */
  };
  
--#define UMH_KILLABLE	4	/* wait for EXEC/PROC killable */
--
++#define UMH_KILLABLE	4	/* wait for EXEC/PROC killable */
++
  /* Actually execute the sub-process */
  int call_usermodehelper_exec(struct subprocess_info *info, enum umh_wait wait);
  
 diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
-index e68b592..085c903 100644
+index 085c903..e68b592 100644
 --- a/include/linux/mempolicy.h
 +++ b/include/linux/mempolicy.h
 @@ -180,7 +180,7 @@ struct sp_node {
  
  struct shared_policy {
  	struct rb_root root;
--	struct mutex mutex;
-+	spinlock_t lock;
+-	spinlock_t lock;
++	struct mutex mutex;
  };
  
  void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol);
 diff --git a/include/linux/msdos_fs.h b/include/linux/msdos_fs.h
-index 34066e6..ce38f1c 100644
+index ce38f1c..34066e6 100644
 --- a/include/linux/msdos_fs.h
 +++ b/include/linux/msdos_fs.h
-@@ -15,7 +15,6 @@
+@@ -15,6 +15,7 @@
  #define MSDOS_DPB_BITS	4		/* log2(MSDOS_DPB) */
  #define MSDOS_DPS	(SECTOR_SIZE / sizeof(struct msdos_dir_entry))
  #define MSDOS_DPS_BITS	4		/* log2(MSDOS_DPS) */
--#define MSDOS_LONGNAME	256		/* maximum name length */
++#define MSDOS_LONGNAME	256		/* maximum name length */
  #define CF_LE_W(v)	le16_to_cpu(v)
  #define CF_LE_L(v)	le32_to_cpu(v)
  #define CT_LE_W(v)	cpu_to_le16(v)
-@@ -48,8 +47,8 @@
+@@ -47,8 +48,8 @@
  #define DELETED_FLAG	0xe5	/* marks file as deleted when in name[0] */
  #define IS_FREE(n)	(!*(n) || *(n) == DELETED_FLAG)
  
--#define FAT_LFN_LEN	255	/* maximum long name length */
++#define FAT_LFN_LEN	255	/* maximum long name length */
  #define MSDOS_NAME	11	/* maximum name length */
-+#define MSDOS_LONGNAME	256	/* maximum name length */
+-#define MSDOS_LONGNAME	256	/* maximum name length */
  #define MSDOS_SLOTS	21	/* max # of slots for short and long names */
  #define MSDOS_DOT	".          "	/* ".", padded to MSDOS_NAME chars */
  #define MSDOS_DOTDOT	"..         "	/* "..", padded to MSDOS_NAME chars */
 diff --git a/include/linux/nls.h b/include/linux/nls.h
-index 5dc635f..d47beef 100644
+index d47beef..5dc635f 100644
 --- a/include/linux/nls.h
 +++ b/include/linux/nls.h
 @@ -43,7 +43,7 @@ enum utf16_endian {
  	UTF16_BIG_ENDIAN
  };
  
--/* nls_base.c */
-+/* nls.c */
+-/* nls.c */
++/* nls_base.c */
  extern int register_nls(struct nls_table *);
  extern int unregister_nls(struct nls_table *);
  extern struct nls_table *load_nls(char *);
-@@ -52,8 +52,7 @@ extern struct nls_table *load_nls_default(void);
+@@ -52,7 +52,8 @@ extern struct nls_table *load_nls_default(void);
  
  extern int utf8_to_utf32(const u8 *s, int len, unicode_t *pu);
  extern int utf32_to_utf8(unicode_t u, u8 *s, int maxlen);
--extern int utf8s_to_utf16s(const u8 *s, int len,
--		enum utf16_endian endian, wchar_t *pwcs, int maxlen);
-+extern int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs);
+-extern int utf8s_to_utf16s(const u8 *s, int len, wchar_t *pwcs);
++extern int utf8s_to_utf16s(const u8 *s, int len,
++		enum utf16_endian endian, wchar_t *pwcs, int maxlen);
  extern int utf16s_to_utf8s(const wchar_t *pwcs, int len,
  		enum utf16_endian endian, u8 *s, int maxlen);
  
 diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
-index f451772..6b202b1 100644
+index 6b202b1..f451772 100644
 --- a/include/linux/page-flags.h
 +++ b/include/linux/page-flags.h
 @@ -362,7 +362,7 @@ static inline int PageCompound(struct page *page)
   * pages on the LRU and/or pagecache.
   */
  TESTPAGEFLAG(Compound, compound)
--__SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
-+__PAGEFLAG(Head, compound)
+-__PAGEFLAG(Head, compound)
++__SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
  
  /*
   * PG_reclaim is used in combination with PG_compound to mark the
-@@ -374,14 +374,8 @@ __SETPAGEFLAG(Head, compound)  __CLEARPAGEFLAG(Head, compound)
+@@ -374,8 +374,14 @@ __PAGEFLAG(Head, compound)
   * PG_compound & PG_reclaim	=> Tail page
   * PG_compound & ~PG_reclaim	=> Head page
   */
--#define PG_head_mask ((1L << PG_compound))
++#define PG_head_mask ((1L << PG_compound))
  #define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
  
--static inline int PageHead(struct page *page)
--{
--	return ((page->flags & PG_head_tail_mask) == PG_head_mask);
--}
--
++static inline int PageHead(struct page *page)
++{
++	return ((page->flags & PG_head_tail_mask) == PG_head_mask);
++}
++
  static inline int PageTail(struct page *page)
  {
  	return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 73c3b9b..71849bf 100644
+index 71849bf..73c3b9b 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
-@@ -2459,16 +2459,7 @@ static inline void thread_group_cputime_free(struct signal_struct *sig)
+@@ -2459,7 +2459,16 @@ static inline void thread_group_cputime_free(struct signal_struct *sig)
  extern void recalc_sigpending_and_wake(struct task_struct *t);
  extern void recalc_sigpending(void);
  
--extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
--
--static inline void signal_wake_up(struct task_struct *t, bool resume)
--{
--	signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
--}
--static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
--{
--	signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
--}
-+extern void signal_wake_up(struct task_struct *t, int resume_stopped);
+-extern void signal_wake_up(struct task_struct *t, int resume_stopped);
++extern void signal_wake_up_state(struct task_struct *t, unsigned int state);
++
++static inline void signal_wake_up(struct task_struct *t, bool resume)
++{
++	signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0);
++}
++static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume)
++{
++	signal_wake_up_state(t, resume ? __TASK_TRACED : 0);
++}
  
  /*
   * Wrappers for p->thread_info->cpu access. No-op on UP.
 diff --git a/include/linux/socket.h b/include/linux/socket.h
-index 3124c51..3273a0c 100644
+index 3273a0c..3124c51 100644
 --- a/include/linux/socket.h
 +++ b/include/linux/socket.h
 @@ -246,7 +246,7 @@ struct ucred {
  #define MSG_ERRQUEUE	0x2000	/* Fetch message from error queue */
  #define MSG_NOSIGNAL	0x4000	/* Do not generate SIGPIPE */
  #define MSG_MORE	0x8000	/* Sender will send more */
--#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
-+
+-
++#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
  #define MSG_EOF         MSG_FIN
  
  #define MSG_CMSG_CLOEXEC 0x40000000	/* Set close_on_exit for file
 diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
-index cf65e77..47004f3 100644
+index 47004f3..cf65e77 100644
 --- a/include/net/inet_sock.h
 +++ b/include/net/inet_sock.h
-@@ -56,15 +56,7 @@ struct ip_options {
+@@ -56,7 +56,15 @@ struct ip_options {
  	unsigned char	__data[0];
  };
  
--struct ip_options_rcu {
--	struct rcu_head rcu;
--	struct ip_options opt;
--};
--
--struct ip_options_data {
--	struct ip_options_rcu	opt;
--	char			data[40];
--};
-+#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
+-#define optlength(opt) (sizeof(struct ip_options) + opt->optlen)
++struct ip_options_rcu {
++	struct rcu_head rcu;
++	struct ip_options opt;
++};
++
++struct ip_options_data {
++	struct ip_options_rcu	opt;
++	char			data[40];
++};
  
  struct inet_request_sock {
  	struct request_sock	req;
-@@ -85,7 +77,7 @@ struct inet_request_sock {
+@@ -77,7 +85,7 @@ struct inet_request_sock {
  				acked	   : 1,
  				no_srccheck: 1;
  	kmemcheck_bitfield_end(flags);
--	struct ip_options_rcu	*opt;
-+	struct ip_options	*opt;
+-	struct ip_options	*opt;
++	struct ip_options_rcu	*opt;
  };
  
  static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)
-@@ -130,7 +122,7 @@ struct inet_sock {
+@@ -122,7 +130,7 @@ struct inet_sock {
  	__be32			saddr;
  	__s16			uc_ttl;
  	__u16			cmsg_flags;
--	struct ip_options_rcu	*inet_opt;
-+	struct ip_options	*opt;
+-	struct ip_options	*opt;
++	struct ip_options_rcu	*inet_opt;
  	__be16			sport;
  	__u16			id;
  	__u8			tos;
 diff --git a/include/net/ip.h b/include/net/ip.h
-index a7d4675..69db943 100644
+index 69db943..a7d4675 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
 @@ -54,7 +54,7 @@ struct ipcm_cookie
  {
  	__be32			addr;
  	int			oif;
--	struct ip_options_rcu	*opt;
-+	struct ip_options	*opt;
+-	struct ip_options	*opt;
++	struct ip_options_rcu	*opt;
  	union skb_shared_tx	shtx;
  };
  
@@ -3235,110 +3222,110 @@ index a7d4675..69db943 100644
  
  extern int		ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
  					      __be32 saddr, __be32 daddr,
--					      struct ip_options_rcu *opt);
-+					      struct ip_options *opt);
+-					      struct ip_options *opt);
++					      struct ip_options_rcu *opt);
  extern int		ip_rcv(struct sk_buff *skb, struct net_device *dev,
  			       struct packet_type *pt, struct net_device *orig_dev);
  extern int		ip_local_deliver(struct sk_buff *skb);
-@@ -362,15 +362,14 @@ extern int ip_forward(struct sk_buff *skb);
+@@ -362,14 +362,15 @@ extern int ip_forward(struct sk_buff *skb);
   *	Functions provided by ip_options.c
   */
   
--extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
--			     __be32 daddr, struct rtable *rt, int is_frag);
-+extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, __be32 daddr, struct rtable *rt, int is_frag);
+-extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt, __be32 daddr, struct rtable *rt, int is_frag);
++extern void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
++			     __be32 daddr, struct rtable *rt, int is_frag);
  extern int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb);
  extern void ip_options_fragment(struct sk_buff *skb);
  extern int ip_options_compile(struct net *net,
  			      struct ip_options *opt, struct sk_buff *skb);
--extern int ip_options_get(struct net *net, struct ip_options_rcu **optp,
-+extern int ip_options_get(struct net *net, struct ip_options **optp,
+-extern int ip_options_get(struct net *net, struct ip_options **optp,
++extern int ip_options_get(struct net *net, struct ip_options_rcu **optp,
  			  unsigned char *data, int optlen);
--extern int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
-+extern int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+-extern int ip_options_get_from_user(struct net *net, struct ip_options **optp,
++extern int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
  				    unsigned char __user *data, int optlen);
  extern void ip_options_undo(struct ip_options * opt);
  extern void ip_forward_options(struct sk_buff *skb);
 diff --git a/include/net/ipv6.h b/include/net/ipv6.h
-index 52d86da..639bbf0 100644
+index 639bbf0..52d86da 100644
 --- a/include/net/ipv6.h
 +++ b/include/net/ipv6.h
-@@ -449,7 +449,17 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
+@@ -449,17 +449,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
  	return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
  }
  
--extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
-+static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
-+{
-+	static u32 ipv6_fragmentation_id = 1;
-+	static DEFINE_SPINLOCK(ip6_id_lock);
-+
-+	spin_lock_bh(&ip6_id_lock);
-+	fhdr->identification = htonl(ipv6_fragmentation_id);
-+	if (++ipv6_fragmentation_id == 0)
-+		ipv6_fragmentation_id = 1;
-+	spin_unlock_bh(&ip6_id_lock);
-+}
+-static __inline__ void ipv6_select_ident(struct frag_hdr *fhdr)
+-{
+-	static u32 ipv6_fragmentation_id = 1;
+-	static DEFINE_SPINLOCK(ip6_id_lock);
+-
+-	spin_lock_bh(&ip6_id_lock);
+-	fhdr->identification = htonl(ipv6_fragmentation_id);
+-	if (++ipv6_fragmentation_id == 0)
+-		ipv6_fragmentation_id = 1;
+-	spin_unlock_bh(&ip6_id_lock);
+-}
++extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
  
  /*
   *	Prototypes exported by ipv6
 diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
-index 8beefe1..d65381c 100644
+index d65381c..8beefe1 100644
 --- a/include/net/transp_v6.h
 +++ b/include/net/transp_v6.h
-@@ -16,8 +16,6 @@ extern struct proto tcpv6_prot;
+@@ -16,6 +16,8 @@ extern struct proto tcpv6_prot;
  
  struct flowi;
  
--extern void initialize_hashidentrnd(void);
--
++extern void initialize_hashidentrnd(void);
++
  /* extention headers */
  extern int				ipv6_exthdrs_init(void);
  extern void				ipv6_exthdrs_exit(void);
 diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
-index b3cffec..34c46ab 100644
+index 34c46ab..b3cffec 100644
 --- a/include/scsi/scsi.h
 +++ b/include/scsi/scsi.h
 @@ -145,10 +145,10 @@ struct scsi_cmnd;
  
  /* defined in T10 SCSI Primary Commands-2 (SPC2) */
  struct scsi_varlen_cdb_hdr {
--	__u8 opcode;        /* opcode always == VARIABLE_LENGTH_CMD */
--	__u8 control;
--	__u8 misc[5];
--	__u8 additional_cdb_length;         /* total cdb length - 8 */
-+	u8 opcode;        /* opcode always == VARIABLE_LENGTH_CMD */
-+	u8 control;
-+	u8 misc[5];
-+	u8 additional_cdb_length;         /* total cdb length - 8 */
+-	u8 opcode;        /* opcode always == VARIABLE_LENGTH_CMD */
+-	u8 control;
+-	u8 misc[5];
+-	u8 additional_cdb_length;         /* total cdb length - 8 */
++	__u8 opcode;        /* opcode always == VARIABLE_LENGTH_CMD */
++	__u8 control;
++	__u8 misc[5];
++	__u8 additional_cdb_length;         /* total cdb length - 8 */
  	__be16 service_action;
  	/* service specific data follows */
  };
 diff --git a/include/scsi/scsi_netlink.h b/include/scsi/scsi_netlink.h
-index 58ce8fe..536752c 100644
+index 536752c..58ce8fe 100644
 --- a/include/scsi/scsi_netlink.h
 +++ b/include/scsi/scsi_netlink.h
 @@ -105,8 +105,8 @@ struct scsi_nl_host_vendor_msg {
   *    PCI :  ID data is the 16 bit PCI Registered Vendor ID
   */
  #define SCSI_NL_VID_TYPE_SHIFT		56
--#define SCSI_NL_VID_TYPE_MASK		((__u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
--#define SCSI_NL_VID_TYPE_PCI		((__u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
-+#define SCSI_NL_VID_TYPE_MASK		((u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
-+#define SCSI_NL_VID_TYPE_PCI		((u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
+-#define SCSI_NL_VID_TYPE_MASK		((u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
+-#define SCSI_NL_VID_TYPE_PCI		((u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
++#define SCSI_NL_VID_TYPE_MASK		((__u64)0xFF << SCSI_NL_VID_TYPE_SHIFT)
++#define SCSI_NL_VID_TYPE_PCI		((__u64)0x01 << SCSI_NL_VID_TYPE_SHIFT)
  #define SCSI_NL_VID_ID_MASK		(~ SCSI_NL_VID_TYPE_MASK)
  
  
 diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
-index a8dc32a..eaf46bd 100644
+index eaf46bd..a8dc32a 100644
 --- a/include/trace/events/kmem.h
 +++ b/include/trace/events/kmem.h
 @@ -293,7 +293,7 @@ TRACE_EVENT(mm_page_alloc,
  
  	TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
  		__entry->page,
--		__entry->page ? page_to_pfn(__entry->page) : 0,
-+		page_to_pfn(__entry->page),
+-		page_to_pfn(__entry->page),
++		__entry->page ? page_to_pfn(__entry->page) : 0,
  		__entry->order,
  		__entry->migratetype,
  		show_gfp_flags(__entry->gfp_flags))
@@ -3346,780 +3333,780 @@ index a8dc32a..eaf46bd 100644
  
  	TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
  		__entry->page,
--		__entry->page ? page_to_pfn(__entry->page) : 0,
-+		page_to_pfn(__entry->page),
+-		page_to_pfn(__entry->page),
++		__entry->page ? page_to_pfn(__entry->page) : 0,
  		__entry->order,
  		__entry->migratetype,
  		__entry->order == 0)
 diff --git a/kernel/async.c b/kernel/async.c
-index 397a7c7..27235f5 100644
+index 27235f5..397a7c7 100644
 --- a/kernel/async.c
 +++ b/kernel/async.c
-@@ -93,13 +93,6 @@ static async_cookie_t  __lowest_in_progress(struct list_head *running)
+@@ -93,6 +93,13 @@ static async_cookie_t  __lowest_in_progress(struct list_head *running)
  {
  	struct async_entry *entry;
  
--	if (!running) { /* just check the entry count */
--		if (atomic_read(&entry_count))
--			return 0; /* smaller than any cookie */
--		else
--			return next_cookie;
--	}
--
++	if (!running) { /* just check the entry count */
++		if (atomic_read(&entry_count))
++			return 0; /* smaller than any cookie */
++		else
++			return next_cookie;
++	}
++
  	if (!list_empty(running)) {
  		entry = list_first_entry(running,
  			struct async_entry, list);
-@@ -255,7 +248,9 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);
+@@ -248,9 +255,7 @@ EXPORT_SYMBOL_GPL(async_schedule_domain);
   */
  void async_synchronize_full(void)
  {
--	async_synchronize_cookie_domain(next_cookie, NULL);
-+	do {
-+		async_synchronize_cookie(next_cookie);
-+	} while (!list_empty(&async_running) || !list_empty(&async_pending));
+-	do {
+-		async_synchronize_cookie(next_cookie);
+-	} while (!list_empty(&async_running) || !list_empty(&async_pending));
++	async_synchronize_cookie_domain(next_cookie, NULL);
  }
  EXPORT_SYMBOL_GPL(async_synchronize_full);
  
-@@ -275,7 +270,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
+@@ -270,7 +275,7 @@ EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
  /**
   * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
   * @cookie: async_cookie_t to use as checkpoint
-- * @running: running list to synchronize on, NULL indicates all lists
-+ * @running: running list to synchronize on
+- * @running: running list to synchronize on
++ * @running: running list to synchronize on, NULL indicates all lists
   *
   * This function waits until all asynchronous function calls for the
   * synchronization domain specified by the running list @list submitted
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 04a9704..1fbcc74 100644
+index 1fbcc74..04a9704 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -1992,7 +1992,9 @@ static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry,
+@@ -1992,9 +1992,7 @@ static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry,
  		dentry->d_fsdata = cgrp;
  		inc_nlink(parent->d_inode);
  		rcu_assign_pointer(cgrp->dentry, dentry);
-+		dget(dentry);
+-		dget(dentry);
  	}
-+	dput(dentry);
+-	dput(dentry);
  
  	return error;
  }
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 8ecc509..a061472 100644
+index a061472..8ecc509 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
-@@ -53,50 +53,6 @@ static DECLARE_RWSEM(umhelper_sem);
+@@ -53,6 +53,50 @@ static DECLARE_RWSEM(umhelper_sem);
  */
  char modprobe_path[KMOD_PATH_LEN] = "/sbin/modprobe";
  
--static void free_modprobe_argv(char **argv, char **envp)
--{
--	kfree(argv[3]); /* check call_modprobe() */
--	kfree(argv);
--}
--
--static int call_modprobe(char *module_name, int wait)
--{
--	static char *envp[] = { "HOME=/",
--				"TERM=linux",
--				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
--				NULL };
--	struct subprocess_info *info;
--
--	char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
--	if (!argv)
--		goto out;
--
--	module_name = kstrdup(module_name, GFP_KERNEL);
--	if (!module_name)
--		goto free_argv;
--
--	argv[0] = modprobe_path;
--	argv[1] = "-q";
--	argv[2] = "--";
--	argv[3] = module_name;	/* check free_modprobe_argv() */
--	argv[4] = NULL;
--
--	info = call_usermodehelper_setup(argv[0], argv, envp, GFP_ATOMIC);
--	if (!info)
--		goto free_module_name;
--
--	call_usermodehelper_setcleanup(info, free_modprobe_argv);
--
--	return call_usermodehelper_exec(info, wait | UMH_KILLABLE);
--
--free_module_name:
--	kfree(module_name);
--free_argv:
--	kfree(argv);
--out:
--	return -ENOMEM;
--}
--
++static void free_modprobe_argv(char **argv, char **envp)
++{
++	kfree(argv[3]); /* check call_modprobe() */
++	kfree(argv);
++}
++
++static int call_modprobe(char *module_name, int wait)
++{
++	static char *envp[] = { "HOME=/",
++				"TERM=linux",
++				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
++				NULL };
++	struct subprocess_info *info;
++
++	char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
++	if (!argv)
++		goto out;
++
++	module_name = kstrdup(module_name, GFP_KERNEL);
++	if (!module_name)
++		goto free_argv;
++
++	argv[0] = modprobe_path;
++	argv[1] = "-q";
++	argv[2] = "--";
++	argv[3] = module_name;	/* check free_modprobe_argv() */
++	argv[4] = NULL;
++
++	info = call_usermodehelper_setup(argv[0], argv, envp, GFP_ATOMIC);
++	if (!info)
++		goto free_module_name;
++
++	call_usermodehelper_setcleanup(info, free_modprobe_argv);
++
++	return call_usermodehelper_exec(info, wait | UMH_KILLABLE);
++
++free_module_name:
++	kfree(module_name);
++free_argv:
++	kfree(argv);
++out:
++	return -ENOMEM;
++}
++
  /**
   * __request_module - try to load a kernel module
   * @wait: wait (or not) for the operation to complete
-@@ -118,6 +74,11 @@ int __request_module(bool wait, const char *fmt, ...)
+@@ -74,11 +118,6 @@ int __request_module(bool wait, const char *fmt, ...)
  	char module_name[MODULE_NAME_LEN];
  	unsigned int max_modprobes;
  	int ret;
-+	char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
-+	static char *envp[] = { "HOME=/",
-+				"TERM=linux",
-+				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
-+				NULL };
+-	char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
+-	static char *envp[] = { "HOME=/",
+-				"TERM=linux",
+-				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
+-				NULL };
  	static atomic_t kmod_concurrent = ATOMIC_INIT(0);
  #define MAX_KMOD_CONCURRENT 50	/* Completely arbitrary value - KAO */
  	static int kmod_loop_msg;
-@@ -160,8 +121,8 @@ int __request_module(bool wait, const char *fmt, ...)
+@@ -121,8 +160,8 @@ int __request_module(bool wait, const char *fmt, ...)
  
  	trace_module_request(module_name, wait, _RET_IP_);
  
--	ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
--
-+	ret = call_usermodehelper(modprobe_path, argv, envp,
-+			wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
+-	ret = call_usermodehelper(modprobe_path, argv, envp,
+-			wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
++	ret = call_modprobe(module_name, wait ? UMH_WAIT_PROC : UMH_WAIT_EXEC);
++
  	atomic_dec(&kmod_concurrent);
  	return ret;
  }
-@@ -232,7 +193,7 @@ static int ____call_usermodehelper(void *data)
+@@ -193,7 +232,7 @@ static int ____call_usermodehelper(void *data)
  
  	/* Exec failed? */
  	sub_info->retval = retval;
--	return 0;
-+	do_exit(0);
+-	do_exit(0);
++	return 0;
  }
  
  void call_usermodehelper_freeinfo(struct subprocess_info *info)
-@@ -245,19 +206,6 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info)
+@@ -206,6 +245,19 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info)
  }
  EXPORT_SYMBOL(call_usermodehelper_freeinfo);
  
--static void umh_complete(struct subprocess_info *sub_info)
--{
--	struct completion *comp = xchg(&sub_info->complete, NULL);
--	/*
--	 * See call_usermodehelper_exec(). If xchg() returns NULL
--	 * we own sub_info, the UMH_KILLABLE caller has gone away.
--	 */
--	if (comp)
--		complete(comp);
--	else
--		call_usermodehelper_freeinfo(sub_info);
--}
--
++static void umh_complete(struct subprocess_info *sub_info)
++{
++	struct completion *comp = xchg(&sub_info->complete, NULL);
++	/*
++	 * See call_usermodehelper_exec(). If xchg() returns NULL
++	 * we own sub_info, the UMH_KILLABLE caller has gone away.
++	 */
++	if (comp)
++		complete(comp);
++	else
++		call_usermodehelper_freeinfo(sub_info);
++}
++
  /* Keventd can't block, but this (a child) can. */
  static int wait_for_helper(void *data)
  {
-@@ -297,7 +245,7 @@ static int wait_for_helper(void *data)
+@@ -245,7 +297,7 @@ static int wait_for_helper(void *data)
  	if (sub_info->wait == UMH_NO_WAIT)
  		call_usermodehelper_freeinfo(sub_info);
  	else
--		umh_complete(sub_info);
-+		complete(sub_info->complete);
+-		complete(sub_info->complete);
++		umh_complete(sub_info);
  	return 0;
  }
  
-@@ -311,9 +259,6 @@ static void __call_usermodehelper(struct work_struct *work)
+@@ -259,6 +311,9 @@ static void __call_usermodehelper(struct work_struct *work)
  
  	BUG_ON(atomic_read(&sub_info->cred->usage) != 1);
  
--	if (wait != UMH_NO_WAIT)
--		wait &= ~UMH_KILLABLE;
--
++	if (wait != UMH_NO_WAIT)
++		wait &= ~UMH_KILLABLE;
++
  	/* CLONE_VFORK: wait until the usermode helper has execve'd
  	 * successfully We need the data structures to stay around
  	 * until that is done.  */
-@@ -335,7 +280,7 @@ static void __call_usermodehelper(struct work_struct *work)
+@@ -280,7 +335,7 @@ static void __call_usermodehelper(struct work_struct *work)
  		/* FALLTHROUGH */
  
  	case UMH_WAIT_EXEC:
--		umh_complete(sub_info);
-+		complete(sub_info->complete);
+-		complete(sub_info->complete);
++		umh_complete(sub_info);
  	}
  }
  
-@@ -575,21 +520,9 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
+@@ -520,9 +575,21 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info,
  	queue_work(khelper_wq, &sub_info->work);
  	if (wait == UMH_NO_WAIT)	/* task has freed sub_info */
  		goto unlock;
--
--	if (wait & UMH_KILLABLE) {
--		retval = wait_for_completion_killable(&done);
--		if (!retval)
--			goto wait_done;
--
--		/* umh_complete() will see NULL and free sub_info */
--		if (xchg(&sub_info->complete, NULL))
--			goto unlock;
--		/* fallthrough, umh_complete() was already called */
--	}
--
++
++	if (wait & UMH_KILLABLE) {
++		retval = wait_for_completion_killable(&done);
++		if (!retval)
++			goto wait_done;
++
++		/* umh_complete() will see NULL and free sub_info */
++		if (xchg(&sub_info->complete, NULL))
++			goto unlock;
++		/* fallthrough, umh_complete() was already called */
++	}
++
  	wait_for_completion(&done);
--wait_done:
++wait_done:
  	retval = sub_info->retval;
-+
+-
  out:
  	call_usermodehelper_freeinfo(sub_info);
  unlock:
 diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
-index ea83f5d..5c9dc22 100644
+index 5c9dc22..ea83f5d 100644
 --- a/kernel/posix-cpu-timers.c
 +++ b/kernel/posix-cpu-timers.c
-@@ -1537,10 +1537,8 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
+@@ -1537,8 +1537,10 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
  		while (!signal_pending(current)) {
  			if (timer.it.cpu.expires.sched == 0) {
  				/*
--				 * Our timer fired and was reset, below
--				 * deletion can not fail.
-+				 * Our timer fired and was reset.
+-				 * Our timer fired and was reset.
++				 * Our timer fired and was reset, below
++				 * deletion can not fail.
  				 */
--				posix_cpu_timer_del(&timer);
++				posix_cpu_timer_del(&timer);
  				spin_unlock_irq(&timer.it_lock);
  				return 0;
  			}
-@@ -1558,26 +1556,9 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
+@@ -1556,9 +1558,26 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,
  		 * We were interrupted by a signal.
  		 */
  		sample_to_timespec(which_clock, timer.it.cpu.expires, rqtp);
--		error = posix_cpu_timer_set(&timer, 0, &zero_it, it);
--		if (!error) {
--			/*
--			 * Timer is now unarmed, deletion can not fail.
--			 */
--			posix_cpu_timer_del(&timer);
--		}
-+		posix_cpu_timer_set(&timer, 0, &zero_it, it);
+-		posix_cpu_timer_set(&timer, 0, &zero_it, it);
++		error = posix_cpu_timer_set(&timer, 0, &zero_it, it);
++		if (!error) {
++			/*
++			 * Timer is now unarmed, deletion can not fail.
++			 */
++			posix_cpu_timer_del(&timer);
++		}
  		spin_unlock_irq(&timer.it_lock);
  
--		while (error == TIMER_RETRY) {
--			/*
--			 * We need to handle case when timer was or is in the
--			 * middle of firing. In other cases we already freed
--			 * resources.
--			 */
--			spin_lock_irq(&timer.it_lock);
--			error = posix_cpu_timer_del(&timer);
--			spin_unlock_irq(&timer.it_lock);
--		}
--
++		while (error == TIMER_RETRY) {
++			/*
++			 * We need to handle case when timer was or is in the
++			 * middle of firing. In other cases we already freed
++			 * resources.
++			 */
++			spin_lock_irq(&timer.it_lock);
++			error = posix_cpu_timer_del(&timer);
++			spin_unlock_irq(&timer.it_lock);
++		}
++
  		if ((it->it_value.tv_sec | it->it_value.tv_nsec) == 0) {
  			/*
  			 * It actually did fire already.
 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index d9c8c47..05625f6 100644
+index 05625f6..d9c8c47 100644
 --- a/kernel/ptrace.c
 +++ b/kernel/ptrace.c
 @@ -56,7 +56,7 @@ static void ptrace_untrace(struct task_struct *child)
  		    child->signal->group_stop_count)
  			__set_task_state(child, TASK_STOPPED);
  		else
--			ptrace_signal_wake_up(child, true);
-+			signal_wake_up(child, 1);
+-			signal_wake_up(child, 1);
++			ptrace_signal_wake_up(child, true);
  	}
  	spin_unlock(&child->sighand->siglock);
  }
-@@ -80,40 +80,6 @@ void __ptrace_unlink(struct task_struct *child)
+@@ -80,6 +80,40 @@ void __ptrace_unlink(struct task_struct *child)
  		ptrace_untrace(child);
  }
  
--/* Ensure that nothing can wake it up, even SIGKILL */
--static bool ptrace_freeze_traced(struct task_struct *task, int kill)
--{
--	bool ret = true;
--
--	spin_lock_irq(&task->sighand->siglock);
--	if (task_is_stopped(task) && !__fatal_signal_pending(task))
--		task->state = __TASK_TRACED;
--	else if (!kill) {
--		if (task_is_traced(task) && !__fatal_signal_pending(task))
--			task->state = __TASK_TRACED;
--		else
--			ret = false;
--	}
--	spin_unlock_irq(&task->sighand->siglock);
--
--	return ret;
--}
--
--static void ptrace_unfreeze_traced(struct task_struct *task)
--{
--	if (task->state != __TASK_TRACED)
--		return;
--
--	WARN_ON(!task->ptrace || task->parent != current);
--
--	spin_lock_irq(&task->sighand->siglock);
--	if (__fatal_signal_pending(task))
--		wake_up_state(task, __TASK_TRACED);
--	else
--		task->state = TASK_TRACED;
--	spin_unlock_irq(&task->sighand->siglock);
--}
--
++/* Ensure that nothing can wake it up, even SIGKILL */
++static bool ptrace_freeze_traced(struct task_struct *task, int kill)
++{
++	bool ret = true;
++
++	spin_lock_irq(&task->sighand->siglock);
++	if (task_is_stopped(task) && !__fatal_signal_pending(task))
++		task->state = __TASK_TRACED;
++	else if (!kill) {
++		if (task_is_traced(task) && !__fatal_signal_pending(task))
++			task->state = __TASK_TRACED;
++		else
++			ret = false;
++	}
++	spin_unlock_irq(&task->sighand->siglock);
++
++	return ret;
++}
++
++static void ptrace_unfreeze_traced(struct task_struct *task)
++{
++	if (task->state != __TASK_TRACED)
++		return;
++
++	WARN_ON(!task->ptrace || task->parent != current);
++
++	spin_lock_irq(&task->sighand->siglock);
++	if (__fatal_signal_pending(task))
++		wake_up_state(task, __TASK_TRACED);
++	else
++		task->state = TASK_TRACED;
++	spin_unlock_irq(&task->sighand->siglock);
++}
++
  /*
   * Check that we have indeed attached to the thing..
   */
-@@ -129,29 +95,25 @@ int ptrace_check_attach(struct task_struct *child, int kill)
+@@ -95,25 +129,29 @@ int ptrace_check_attach(struct task_struct *child, int kill)
  	 * be changed by us so it's not changing right after this.
  	 */
  	read_lock(&tasklist_lock);
--	if (child->ptrace && child->parent == current) {
--		WARN_ON(child->state == __TASK_TRACED);
-+	if ((child->ptrace & PT_PTRACED) && child->parent == current) {
-+		ret = 0;
+-	if ((child->ptrace & PT_PTRACED) && child->parent == current) {
+-		ret = 0;
++	if (child->ptrace && child->parent == current) {
++		WARN_ON(child->state == __TASK_TRACED);
  		/*
  		 * child->sighand can't be NULL, release_task()
  		 * does ptrace_unlink() before __exit_signal().
  		 */
--		if (ptrace_freeze_traced(child, kill))
--			ret = 0;
-+		spin_lock_irq(&child->sighand->siglock);
-+		if (task_is_stopped(child))
-+			child->state = TASK_TRACED;
-+		else if (!task_is_traced(child) && !kill)
-+			ret = -ESRCH;
-+		spin_unlock_irq(&child->sighand->siglock);
+-		spin_lock_irq(&child->sighand->siglock);
+-		if (task_is_stopped(child))
+-			child->state = TASK_TRACED;
+-		else if (!task_is_traced(child) && !kill)
+-			ret = -ESRCH;
+-		spin_unlock_irq(&child->sighand->siglock);
++		if (ptrace_freeze_traced(child, kill))
++			ret = 0;
  	}
  	read_unlock(&tasklist_lock);
  
--	if (!ret && !kill) {
--		if (!wait_task_inactive(child, __TASK_TRACED)) {
--			/*
--			 * This can only happen if may_ptrace_stop() fails and
--			 * ptrace_stop() changes ->state back to TASK_RUNNING,
--			 * so we should not worry about leaking __TASK_TRACED.
--			 */
--			WARN_ON(child->state == __TASK_TRACED);
--			ret = -ESRCH;
--		}
--	}
-+	if (!ret && !kill)
-+		ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
+-	if (!ret && !kill)
+-		ret = wait_task_inactive(child, TASK_TRACED) ? 0 : -ESRCH;
++	if (!ret && !kill) {
++		if (!wait_task_inactive(child, __TASK_TRACED)) {
++			/*
++			 * This can only happen if may_ptrace_stop() fails and
++			 * ptrace_stop() changes ->state back to TASK_RUNNING,
++			 * so we should not worry about leaking __TASK_TRACED.
++			 */
++			WARN_ON(child->state == __TASK_TRACED);
++			ret = -ESRCH;
++		}
++	}
  
-+	/* All systems go.. */
+-	/* All systems go.. */
  	return ret;
  }
  
-@@ -544,7 +506,7 @@ static int ptrace_resume(struct task_struct *child, long request, long data)
+@@ -506,7 +544,7 @@ static int ptrace_resume(struct task_struct *child, long request, long data)
  	}
  
  	child->exit_code = data;
--	wake_up_state(child, __TASK_TRACED);
-+	wake_up_process(child);
+-	wake_up_process(child);
++	wake_up_state(child, __TASK_TRACED);
  
  	return 0;
  }
-@@ -675,8 +637,6 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
+@@ -637,6 +675,8 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, long, addr, long, data)
  		goto out_put_task_struct;
  
  	ret = arch_ptrace(child, request, addr, data);
--	if (ret || request != PTRACE_DETACH)
--		ptrace_unfreeze_traced(child);
++	if (ret || request != PTRACE_DETACH)
++		ptrace_unfreeze_traced(child);
  
   out_put_task_struct:
  	put_task_struct(child);
-@@ -792,11 +752,8 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+@@ -752,8 +792,11 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
  	}
  
  	ret = ptrace_check_attach(child, request == PTRACE_KILL);
--	if (!ret) {
-+	if (!ret)
+-	if (!ret)
++	if (!ret) {
  		ret = compat_arch_ptrace(child, request, addr, data);
--		if (ret || request != PTRACE_DETACH)
--			ptrace_unfreeze_traced(child);
--	}
++		if (ret || request != PTRACE_DETACH)
++			ptrace_unfreeze_traced(child);
++	}
  
   out_put_task_struct:
  	put_task_struct(child);
 diff --git a/kernel/resource.c b/kernel/resource.c
-index 207915a..fb11a58 100644
+index fb11a58..207915a 100644
 --- a/kernel/resource.c
 +++ b/kernel/resource.c
-@@ -533,7 +533,6 @@ static void __init __reserve_region_with_split(struct resource *root,
+@@ -533,6 +533,7 @@ static void __init __reserve_region_with_split(struct resource *root,
  	struct resource *parent = root;
  	struct resource *conflict;
  	struct resource *res = kzalloc(sizeof(*res), GFP_ATOMIC);
--	struct resource *next_res = NULL;
++	struct resource *next_res = NULL;
  
  	if (!res)
  		return;
-@@ -543,46 +542,21 @@ static void __init __reserve_region_with_split(struct resource *root,
+@@ -542,21 +543,46 @@ static void __init __reserve_region_with_split(struct resource *root,
  	res->end = end;
  	res->flags = IORESOURCE_BUSY;
  
--	while (1) {
--
--		conflict = __request_resource(parent, res);
--		if (!conflict) {
--			if (!next_res)
--				break;
--			res = next_res;
--			next_res = NULL;
--			continue;
--		}
-+	conflict = __request_resource(parent, res);
-+	if (!conflict)
-+		return;
+-	conflict = __request_resource(parent, res);
+-	if (!conflict)
+-		return;
++	while (1) {
+ 
+-	/* failed, split and try again */
+-	kfree(res);
++		conflict = __request_resource(parent, res);
++		if (!conflict) {
++			if (!next_res)
++				break;
++			res = next_res;
++			next_res = NULL;
++			continue;
++		}
  
--		/* conflict covered whole area */
--		if (conflict->start <= res->start &&
--				conflict->end >= res->end) {
--			kfree(res);
--			WARN_ON(next_res);
--			break;
--		}
-+	/* failed, split and try again */
-+	kfree(res);
- 
--		/* failed, split and try again */
--		if (conflict->start > res->start) {
--			end = res->end;
--			res->end = conflict->start - 1;
--			if (conflict->end < end) {
--				next_res = kzalloc(sizeof(*next_res),
--						GFP_ATOMIC);
--				if (!next_res) {
--					kfree(res);
--					break;
--				}
--				next_res->name = name;
--				next_res->start = conflict->end + 1;
--				next_res->end = end;
--				next_res->flags = IORESOURCE_BUSY;
--			}
--		} else {
--			res->start = conflict->end + 1;
--		}
--	}
-+	/* conflict covered whole area */
-+	if (conflict->start <= start && conflict->end >= end)
-+		return;
+-	/* conflict covered whole area */
+-	if (conflict->start <= start && conflict->end >= end)
+-		return;
++		/* conflict covered whole area */
++		if (conflict->start <= res->start &&
++				conflict->end >= res->end) {
++			kfree(res);
++			WARN_ON(next_res);
++			break;
++		}
++
++		/* failed, split and try again */
++		if (conflict->start > res->start) {
++			end = res->end;
++			res->end = conflict->start - 1;
++			if (conflict->end < end) {
++				next_res = kzalloc(sizeof(*next_res),
++						GFP_ATOMIC);
++				if (!next_res) {
++					kfree(res);
++					break;
++				}
++				next_res->name = name;
++				next_res->start = conflict->end + 1;
++				next_res->end = end;
++				next_res->flags = IORESOURCE_BUSY;
++			}
++		} else {
++			res->start = conflict->end + 1;
++		}
++	}
  
-+	if (conflict->start > start)
-+		__reserve_region_with_split(root, start, conflict->start-1, name);
-+	if (conflict->end < end)
-+		__reserve_region_with_split(root, conflict->end+1, end, name);
+-	if (conflict->start > start)
+-		__reserve_region_with_split(root, start, conflict->start-1, name);
+-	if (conflict->end < end)
+-		__reserve_region_with_split(root, conflict->end+1, end, name);
  }
  
  void __init reserve_region_with_split(struct resource *root,
 diff --git a/kernel/sched.c b/kernel/sched.c
-index 42bf6a6..0591df8 100644
+index 0591df8..42bf6a6 100644
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
-@@ -2618,8 +2618,7 @@ out:
+@@ -2618,7 +2618,8 @@ out:
   */
  int wake_up_process(struct task_struct *p)
  {
--	WARN_ON(task_is_stopped_or_traced(p));
--	return try_to_wake_up(p, TASK_NORMAL, 0);
-+	return try_to_wake_up(p, TASK_ALL, 0);
+-	return try_to_wake_up(p, TASK_ALL, 0);
++	WARN_ON(task_is_stopped_or_traced(p));
++	return try_to_wake_up(p, TASK_NORMAL, 0);
  }
  EXPORT_SYMBOL(wake_up_process);
  
 diff --git a/kernel/signal.c b/kernel/signal.c
-index fb7e242..2494827 100644
+index 2494827..fb7e242 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
-@@ -320,9 +320,6 @@ flush_signal_handlers(struct task_struct *t, int force_default)
+@@ -320,6 +320,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
  		if (force_default || ka->sa.sa_handler != SIG_IGN)
  			ka->sa.sa_handler = SIG_DFL;
  		ka->sa.sa_flags = 0;
--#ifdef __ARCH_HAS_SA_RESTORER
--		ka->sa.sa_restorer = NULL;
--#endif
++#ifdef __ARCH_HAS_SA_RESTORER
++		ka->sa.sa_restorer = NULL;
++#endif
  		sigemptyset(&ka->sa.sa_mask);
  		ka++;
  	}
-@@ -516,17 +513,23 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
+@@ -513,23 +516,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
   * No need to set need_resched since signal event passing
   * goes through ->blocked
   */
--void signal_wake_up_state(struct task_struct *t, unsigned int state)
-+void signal_wake_up(struct task_struct *t, int resume)
+-void signal_wake_up(struct task_struct *t, int resume)
++void signal_wake_up_state(struct task_struct *t, unsigned int state)
  {
-+	unsigned int mask;
-+
+-	unsigned int mask;
+-
  	set_tsk_thread_flag(t, TIF_SIGPENDING);
-+
+-
  	/*
--	 * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
-+	 * For SIGKILL, we want to wake it up in the stopped/traced/killable
+-	 * For SIGKILL, we want to wake it up in the stopped/traced/killable
++	 * TASK_WAKEKILL also means wake it up in the stopped/traced/killable
  	 * case. We don't check t->state here because there is a race with it
  	 * executing another processor and just now entering stopped state.
  	 * By using wake_up_state, we ensure the process will wake up and
  	 * handle its death signal.
  	 */
--	if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
-+	mask = TASK_INTERRUPTIBLE;
-+	if (resume)
-+		mask |= TASK_WAKEKILL;
-+	if (!wake_up_state(t, mask))
+-	mask = TASK_INTERRUPTIBLE;
+-	if (resume)
+-		mask |= TASK_WAKEKILL;
+-	if (!wake_up_state(t, mask))
++	if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
  		kick_process(t);
  }
  
-@@ -1527,10 +1530,6 @@ static inline int may_ptrace_stop(void)
+@@ -1530,6 +1527,10 @@ static inline int may_ptrace_stop(void)
  	 * If SIGKILL was already sent before the caller unlocked
  	 * ->siglock we must see ->core_state != NULL. Otherwise it
  	 * is safe to enter schedule().
--	 *
--	 * This is almost outdated, a task with the pending SIGKILL can't
--	 * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
--	 * after SIGKILL was already dequeued.
++	 *
++	 * This is almost outdated, a task with the pending SIGKILL can't
++	 * block in TASK_TRACED. But PTRACE_EVENT_EXIT can be reported
++	 * after SIGKILL was already dequeued.
  	 */
  	if (unlikely(current->mm->core_state) &&
  	    unlikely(current->mm == current->parent->mm))
-@@ -2301,7 +2300,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+@@ -2300,7 +2301,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
  
  static int do_tkill(pid_t tgid, pid_t pid, int sig)
  {
--	struct siginfo info = {};
-+	struct siginfo info;
+-	struct siginfo info;
++	struct siginfo info = {};
  
  	info.si_signo = sig;
  	info.si_errno = 0;
 diff --git a/kernel/softirq.c b/kernel/softirq.c
-index d75c136..04a0252 100644
+index 04a0252..d75c136 100644
 --- a/kernel/softirq.c
 +++ b/kernel/softirq.c
 @@ -194,21 +194,21 @@ void local_bh_enable_ip(unsigned long ip)
  EXPORT_SYMBOL(local_bh_enable_ip);
  
  /*
-- * We restart softirq processing for at most 2 ms,
-- * and if need_resched() is not set.
-+ * We restart softirq processing MAX_SOFTIRQ_RESTART times,
-+ * and we fall back to softirqd after that.
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most 2 ms,
++ * and if need_resched() is not set.
   *
-- * These limits have been established via experimentation.
-+ * This number has been established via experimentation.
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
   * The two things to balance is latency against fairness -
   * we want to handle softirqs as soon as possible, but they
   * should not be able to lock up the box.
   */
--#define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
-+#define MAX_SOFTIRQ_RESTART 10
+-#define MAX_SOFTIRQ_RESTART 10
++#define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
  
  asmlinkage void __do_softirq(void)
  {
  	struct softirq_action *h;
  	__u32 pending;
--	unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
-+	int max_restart = MAX_SOFTIRQ_RESTART;
+-	int max_restart = MAX_SOFTIRQ_RESTART;
++	unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
  	int cpu;
  
  	pending = local_softirq_pending();
-@@ -253,12 +253,11 @@ restart:
+@@ -253,11 +253,12 @@ restart:
  	local_irq_disable();
  
  	pending = local_softirq_pending();
--	if (pending) {
--		if (time_before(jiffies, end) && !need_resched())
--			goto restart;
-+	if (pending && --max_restart)
-+		goto restart;
+-	if (pending && --max_restart)
+-		goto restart;
++	if (pending) {
++		if (time_before(jiffies, end) && !need_resched())
++			goto restart;
  
-+	if (pending)
+-	if (pending)
  		wakeup_softirqd();
--	}
++	}
  
  	lockdep_softirq_exit();
  
 diff --git a/kernel/sys.c b/kernel/sys.c
-index 5a381e6..e9512b1 100644
+index e9512b1..5a381e6 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
-@@ -303,7 +303,6 @@ void kernel_restart_prepare(char *cmd)
+@@ -303,6 +303,7 @@ void kernel_restart_prepare(char *cmd)
  void kernel_restart(char *cmd)
  {
  	kernel_restart_prepare(cmd);
--	disable_nonboot_cpus();
++	disable_nonboot_cpus();
  	if (!cmd)
  		printk(KERN_EMERG "Restarting system.\n");
  	else
 diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index 67fe3d9..57b953f 100644
+index 57b953f..67fe3d9 100644
 --- a/kernel/time/tick-broadcast.c
 +++ b/kernel/time/tick-broadcast.c
-@@ -67,8 +67,7 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
+@@ -67,7 +67,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
   */
  int tick_check_broadcast_device(struct clock_event_device *dev)
  {
--	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
--	    (tick_broadcast_device.evtdev &&
-+	if ((tick_broadcast_device.evtdev &&
+-	if ((tick_broadcast_device.evtdev &&
++	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
++	    (tick_broadcast_device.evtdev &&
  	     tick_broadcast_device.evtdev->rating >= dev->rating) ||
  	     (dev->features & CLOCK_EVT_FEAT_C3STOP))
  		return 0;
 diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
-index 9f0fd18..b63cfeb 100644
+index b63cfeb..9f0fd18 100644
 --- a/kernel/time/tick-sched.c
 +++ b/kernel/time/tick-sched.c
 @@ -765,7 +765,7 @@ void tick_cancel_sched_timer(int cpu)
  		hrtimer_cancel(&ts->sched_timer);
  # endif
  
--	memset(ts, 0, sizeof(*ts));
-+	ts->nohz_mode = NOHZ_MODE_INACTIVE;
+-	ts->nohz_mode = NOHZ_MODE_INACTIVE;
++	memset(ts, 0, sizeof(*ts));
  }
  #endif
  
 diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
-index f65a0fb..3d35af3 100644
+index 3d35af3..f65a0fb 100644
 --- a/kernel/time/timekeeping.c
 +++ b/kernel/time/timekeeping.c
 @@ -809,7 +809,7 @@ void update_wall_time(void)
  #endif
  	/* Check if there's really nothing to do */
  	if (offset < timekeeper.cycle_interval)
--		goto out;
-+		return;
+-		return;
++		goto out;
  
  	timekeeper.xtime_nsec = (s64)xtime.tv_nsec << timekeeper.shift;
  
-@@ -881,7 +881,6 @@ void update_wall_time(void)
+@@ -881,6 +881,7 @@ void update_wall_time(void)
  	timekeeper.ntp_error +=	timekeeper.xtime_nsec <<
  				timekeeper.ntp_error_shift;
  
--out:
++out:
  	nsecs = clocksource_cyc2ns(offset, timekeeper.mult, timekeeper.shift);
  	update_xtime_cache(nsecs);
  
 diff --git a/kernel/timer.c b/kernel/timer.c
-index 8123679..cb3c1f1 100644
+index cb3c1f1..8123679 100644
 --- a/kernel/timer.c
 +++ b/kernel/timer.c
 @@ -1553,12 +1553,12 @@ static int __cpuinit init_timers_cpu(int cpu)
  			boot_done = 1;
  			base = &boot_tvec_bases;
  		}
--		spin_lock_init(&base->lock);
++		spin_lock_init(&base->lock);
  		tvec_base_done[cpu] = 1;
  	} else {
  		base = per_cpu(tvec_bases, cpu);
  	}
  
-+	spin_lock_init(&base->lock);
+-	spin_lock_init(&base->lock);
  
  	for (j = 0; j < TVN_SIZE; j++) {
  		INIT_LIST_HEAD(base->tv5.vec + j);
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index c5f8ab9..4872937 100644
+index 4872937..c5f8ab9 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
-@@ -469,6 +469,7 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
+@@ -469,7 +469,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
  		free_page(tmp);
  	}
  
-+	free_page((unsigned long)stat->pages);
+-	free_page((unsigned long)stat->pages);
  	stat->pages = NULL;
  	stat->start = NULL;
  
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 6024960..e749a05 100644
+index e749a05..6024960 100644
 --- a/kernel/trace/ring_buffer.c
 +++ b/kernel/trace/ring_buffer.c
-@@ -2876,8 +2876,6 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -2876,6 +2876,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
  	 * Splice the empty reader page into the list around the head.
  	 */
  	reader = rb_set_head_page(cpu_buffer);
--	if (!reader)
--		goto out;
++	if (!reader)
++		goto out;
  	cpu_buffer->reader_page->list.next = reader->list.next;
  	cpu_buffer->reader_page->list.prev = reader->list.prev;
  
 diff --git a/lib/genalloc.c b/lib/genalloc.c
-index c1fb257..eed2bdb 100644
+index eed2bdb..c1fb257 100644
 --- a/lib/genalloc.c
 +++ b/lib/genalloc.c
 @@ -52,7 +52,7 @@ int gen_pool_add(struct gen_pool *pool, unsigned long addr, size_t size,
  	struct gen_pool_chunk *chunk;
  	int nbits = size >> pool->min_alloc_order;
  	int nbytes = sizeof(struct gen_pool_chunk) +
--				BITS_TO_LONGS(nbits) * sizeof(long);
-+				(nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
+-				(nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE;
++				BITS_TO_LONGS(nbits) * sizeof(long);
  
  	chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid);
  	if (unlikely(chunk == NULL))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index b435d1f..20f9240 100644
+index 20f9240..b435d1f 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
-@@ -1772,15 +1772,6 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
+@@ -1772,6 +1772,15 @@ static void hugetlb_vm_op_open(struct vm_area_struct *vma)
  		kref_get(&reservations->refs);
  }
  
--static void resv_map_put(struct vm_area_struct *vma)
--{
--	struct resv_map *reservations = vma_resv_map(vma);
--
--	if (!reservations)
--		return;
--	kref_put(&reservations->refs, resv_map_release);
--}
--
++static void resv_map_put(struct vm_area_struct *vma)
++{
++	struct resv_map *reservations = vma_resv_map(vma);
++
++	if (!reservations)
++		return;
++	kref_put(&reservations->refs, resv_map_release);
++}
++
  static void hugetlb_vm_op_close(struct vm_area_struct *vma)
  {
  	struct hstate *h = hstate_vma(vma);
-@@ -1797,7 +1788,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
+@@ -1788,7 +1797,7 @@ static void hugetlb_vm_op_close(struct vm_area_struct *vma)
  		reserve = (end - start) -
  			region_count(&reservations->regions, start, end);
  
--		resv_map_put(vma);
-+		kref_put(&reservations->refs, resv_map_release);
+-		kref_put(&reservations->refs, resv_map_release);
++		resv_map_put(vma);
  
  		if (reserve) {
  			hugetlb_acct_memory(h, -reserve);
-@@ -2481,16 +2472,12 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2472,12 +2481,16 @@ int hugetlb_reserve_pages(struct inode *inode,
  		set_vma_resv_flags(vma, HPAGE_RESV_OWNER);
  	}
  
--	if (chg < 0) {
--		ret = chg;
--		goto out_err;
--	}
-+	if (chg < 0)
-+		return chg;
+-	if (chg < 0)
+-		return chg;
++	if (chg < 0) {
++		ret = chg;
++		goto out_err;
++	}
  
  	/* There must be enough pages in the subpool for the mapping */
--	if (hugepage_subpool_get_pages(spool, chg)) {
--		ret = -ENOSPC;
--		goto out_err;
--	}
-+	if (hugepage_subpool_get_pages(spool, chg))
-+		return -ENOSPC;
+-	if (hugepage_subpool_get_pages(spool, chg))
+-		return -ENOSPC;
++	if (hugepage_subpool_get_pages(spool, chg)) {
++		ret = -ENOSPC;
++		goto out_err;
++	}
  
  	/*
  	 * Check enough hugepages are available for the reservation.
-@@ -2499,7 +2486,7 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2486,7 +2499,7 @@ int hugetlb_reserve_pages(struct inode *inode,
  	ret = hugetlb_acct_memory(h, chg);
  	if (ret < 0) {
  		hugepage_subpool_put_pages(spool, chg);
--		goto out_err;
-+		return ret;
+-		return ret;
++		goto out_err;
  	}
  
  	/*
-@@ -2516,10 +2503,6 @@ int hugetlb_reserve_pages(struct inode *inode,
+@@ -2503,6 +2516,10 @@ int hugetlb_reserve_pages(struct inode *inode,
  	if (!vma || vma->vm_flags & VM_MAYSHARE)
  		region_add(&inode->i_mapping->private_list, from, to);
  	return 0;
--out_err:
--	if (vma)
--		resv_map_put(vma);
--	return ret;
++out_err:
++	if (vma)
++		resv_map_put(vma);
++	return ret;
  }
  
  void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index df6602f..a6563fb 100644
+index a6563fb..df6602f 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -1759,7 +1759,7 @@ int __mpol_equal(struct mempolicy *a, struct mempolicy *b)
   */
  
  /* lookup first element intersecting start-end */
--/* Caller holds sp->mutex */
-+/* Caller holds sp->lock */
+-/* Caller holds sp->lock */
++/* Caller holds sp->mutex */
  static struct sp_node *
  sp_lookup(struct shared_policy *sp, unsigned long start, unsigned long end)
  {
@@ -4127,15 +4114,15 @@ index df6602f..a6563fb 100644
  
  	if (!sp->root.rb_node)
  		return NULL;
--	mutex_lock(&sp->mutex);
-+	spin_lock(&sp->lock);
+-	spin_lock(&sp->lock);
++	mutex_lock(&sp->mutex);
  	sn = sp_lookup(sp, idx, idx+1);
  	if (sn) {
  		mpol_get(sn->policy);
  		pol = sn->policy;
  	}
--	mutex_unlock(&sp->mutex);
-+	spin_unlock(&sp->lock);
+-	spin_unlock(&sp->lock);
++	mutex_unlock(&sp->mutex);
  	return pol;
  }
  
@@ -4143,783 +4130,783 @@ index df6602f..a6563fb 100644
  static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
  				 unsigned long end, struct sp_node *new)
  {
--	struct sp_node *n;
--	int ret = 0;
-+	struct sp_node *n, *new2 = NULL;
+-	struct sp_node *n, *new2 = NULL;
++	struct sp_node *n;
++	int ret = 0;
  
--	mutex_lock(&sp->mutex);
-+restart:
-+	spin_lock(&sp->lock);
+-restart:
+-	spin_lock(&sp->lock);
++	mutex_lock(&sp->mutex);
  	n = sp_lookup(sp, start, end);
  	/* Take care of old policies in the same range. */
  	while (n && n->start < end) {
-@@ -1876,14 +1876,16 @@ static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
+@@ -1876,16 +1876,14 @@ restart:
  		} else {
  			/* Old policy spanning whole new range. */
  			if (n->end > end) {
--				struct sp_node *new2;
--				new2 = sp_alloc(end, n->end, n->policy);
++				struct sp_node *new2;
++				new2 = sp_alloc(end, n->end, n->policy);
  				if (!new2) {
--					ret = -ENOMEM;
--					goto out;
-+					spin_unlock(&sp->lock);
-+					new2 = sp_alloc(end, n->end, n->policy);
-+					if (!new2)
-+						return -ENOMEM;
-+					goto restart;
+-					spin_unlock(&sp->lock);
+-					new2 = sp_alloc(end, n->end, n->policy);
+-					if (!new2)
+-						return -ENOMEM;
+-					goto restart;
++					ret = -ENOMEM;
++					goto out;
  				}
  				n->end = start;
  				sp_insert(sp, new2);
-+				new2 = NULL;
+-				new2 = NULL;
  				break;
  			} else
  				n->end = start;
-@@ -1894,9 +1896,12 @@ static int shared_policy_replace(struct shared_policy *sp, unsigned long start,
+@@ -1896,12 +1894,9 @@ restart:
  	}
  	if (new)
  		sp_insert(sp, new);
--out:
--	mutex_unlock(&sp->mutex);
--	return ret;
-+	spin_unlock(&sp->lock);
-+	if (new2) {
-+		mpol_put(new2->policy);
-+		kmem_cache_free(sn_cache, new2);
-+	}
-+	return 0;
+-	spin_unlock(&sp->lock);
+-	if (new2) {
+-		mpol_put(new2->policy);
+-		kmem_cache_free(sn_cache, new2);
+-	}
+-	return 0;
++out:
++	mutex_unlock(&sp->mutex);
++	return ret;
  }
  
  /**
-@@ -1914,7 +1919,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
+@@ -1919,7 +1914,7 @@ void mpol_shared_policy_init(struct shared_policy *sp, struct mempolicy *mpol)
  	int ret;
  
  	sp->root = RB_ROOT;		/* empty tree == default mempolicy */
--	mutex_init(&sp->mutex);
-+	spin_lock_init(&sp->lock);
+-	spin_lock_init(&sp->lock);
++	mutex_init(&sp->mutex);
  
  	if (mpol) {
  		struct vm_area_struct pvma;
-@@ -1982,7 +1987,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
+@@ -1987,7 +1982,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
  
  	if (!p->root.rb_node)
  		return;
--	mutex_lock(&p->mutex);
-+	spin_lock(&p->lock);
+-	spin_lock(&p->lock);
++	mutex_lock(&p->mutex);
  	next = rb_first(&p->root);
  	while (next) {
  		n = rb_entry(next, struct sp_node, nd);
-@@ -1991,7 +1996,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
+@@ -1996,7 +1991,7 @@ void mpol_free_shared_policy(struct shared_policy *p)
  		mpol_put(n->policy);
  		kmem_cache_free(sn_cache, n);
  	}
--	mutex_unlock(&p->mutex);
-+	spin_unlock(&p->lock);
+-	spin_unlock(&p->lock);
++	mutex_unlock(&p->mutex);
  }
  
  /* assumes fs == KERNEL_DS */
 diff --git a/mm/shmem.c b/mm/shmem.c
-index e6a0c72..3e0005b 100644
+index 3e0005b..e6a0c72 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
-@@ -2242,7 +2242,6 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
+@@ -2242,6 +2242,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
  	unsigned long inodes;
  	int error = -EINVAL;
  
--	config.mpol = NULL;
++	config.mpol = NULL;
  	if (shmem_parse_options(data, &config, true))
  		return error;
  
-@@ -2270,13 +2269,8 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
+@@ -2269,8 +2270,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
  	sbinfo->max_inodes  = config.max_inodes;
  	sbinfo->free_inodes = config.max_inodes - inodes;
  
--	/*
--	 * Preserve previous mempolicy unless mpol remount option was specified.
--	 */
--	if (config.mpol) {
--		mpol_put(sbinfo->mpol);
--		sbinfo->mpol = config.mpol;	/* transfers initial ref */
--	}
-+	mpol_put(sbinfo->mpol);
-+	sbinfo->mpol        = config.mpol;	/* transfers initial ref */
+-	mpol_put(sbinfo->mpol);
+-	sbinfo->mpol        = config.mpol;	/* transfers initial ref */
++	/*
++	 * Preserve previous mempolicy unless mpol remount option was specified.
++	 */
++	if (config.mpol) {
++		mpol_put(sbinfo->mpol);
++		sbinfo->mpol = config.mpol;	/* transfers initial ref */
++	}
  out:
  	spin_unlock(&sbinfo->stat_lock);
  	return error;
 diff --git a/mm/truncate.c b/mm/truncate.c
-index b41d26d..258bda7 100644
+index 258bda7..b41d26d 100644
 --- a/mm/truncate.c
 +++ b/mm/truncate.c
-@@ -376,12 +376,11 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
+@@ -376,11 +376,12 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
  	if (page_has_private(page) && !try_to_release_page(page, GFP_KERNEL))
  		return 0;
  
--	clear_page_mlock(page);
--
++	clear_page_mlock(page);
++
  	spin_lock_irq(&mapping->tree_lock);
  	if (PageDirty(page))
  		goto failed;
  
-+	clear_page_mlock(page);
+-	clear_page_mlock(page);
  	BUG_ON(page_has_private(page));
  	__remove_from_page_cache(page);
  	spin_unlock_irq(&mapping->tree_lock);
 diff --git a/mm/vmscan.c b/mm/vmscan.c
-index 738db2b..4649929 100644
+index 4649929..738db2b 100644
 --- a/mm/vmscan.c
 +++ b/mm/vmscan.c
-@@ -2241,8 +2241,6 @@ static int kswapd(void *p)
+@@ -2241,6 +2241,8 @@ static int kswapd(void *p)
  			balance_pgdat(pgdat, order);
  		}
  	}
--
--	current->reclaim_state = NULL;
++
++	current->reclaim_state = NULL;
  	return 0;
  }
  
 diff --git a/net/atm/common.c b/net/atm/common.c
-index 65737b8..950bd16 100644
+index 950bd16..65737b8 100644
 --- a/net/atm/common.c
 +++ b/net/atm/common.c
-@@ -473,8 +473,6 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+@@ -473,6 +473,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
  	struct sk_buff *skb;
  	int copied, error = -EINVAL;
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	if (sock->state != SS_CONNECTED)
  		return -ENOTCONN;
  	if (flags & ~MSG_DONTWAIT)		/* only handle MSG_DONTWAIT */
-@@ -751,7 +749,6 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
+@@ -749,6 +751,7 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
  				if (!vcc->dev ||
  				    !test_bit(ATM_VF_ADDR,&vcc->flags))
  					return -ENOTCONN;
--				memset(&pvc, 0, sizeof(pvc));
++				memset(&pvc, 0, sizeof(pvc));
  				pvc.sap_family = AF_ATMPVC;
  				pvc.sap_addr.itf = vcc->dev->number;
  				pvc.sap_addr.vpi = vcc->vpi;
 diff --git a/net/atm/pvc.c b/net/atm/pvc.c
-index 523c21a..d4c0245 100644
+index d4c0245..523c21a 100644
 --- a/net/atm/pvc.c
 +++ b/net/atm/pvc.c
-@@ -93,7 +93,6 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
+@@ -93,6 +93,7 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
  	if (!vcc->dev || !test_bit(ATM_VF_ADDR,&vcc->flags)) return -ENOTCONN;
  	*sockaddr_len = sizeof(struct sockaddr_atmpvc);
  	addr = (struct sockaddr_atmpvc *) sockaddr;
--	memset(addr, 0, sizeof(*addr));
++	memset(addr, 0, sizeof(*addr));
  	addr->sap_family = AF_ATMPVC;
  	addr->sap_addr.itf = vcc->dev->number;
  	addr->sap_addr.vpi = vcc->vpi;
 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
-index 8613bd1..1e9f3e42 100644
+index 1e9f3e42..8613bd1 100644
 --- a/net/ax25/af_ax25.c
 +++ b/net/ax25/af_ax25.c
-@@ -1654,7 +1654,6 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1654,6 +1654,7 @@ static int ax25_recvmsg(struct kiocb *iocb, struct socket *sock,
  		ax25_address src;
  		const unsigned char *mac = skb_mac_header(skb);
  
--		memset(sax, 0, sizeof(struct full_sockaddr_ax25));
++		memset(sax, 0, sizeof(struct full_sockaddr_ax25));
  		ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
  				&digi, NULL, NULL);
  		sax->sax25_family = AF_AX25;
 diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
-index d7239dd..8cfb5a8 100644
+index 8cfb5a8..d7239dd 100644
 --- a/net/bluetooth/af_bluetooth.c
 +++ b/net/bluetooth/af_bluetooth.c
 @@ -240,14 +240,14 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
  	if (flags & (MSG_OOB))
  		return -EOPNOTSUPP;
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) {
  		if (sk->sk_shutdown & RCV_SHUTDOWN)
  			return 0;
  		return err;
  	}
  
-+	msg->msg_namelen = 0;
-+
+-	msg->msg_namelen = 0;
+-
  	copied = skb->len;
  	if (len < copied) {
  		msg->msg_flags |= MSG_TRUNC;
 diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 45caaaa..75302a9 100644
+index 75302a9..45caaaa 100644
 --- a/net/bluetooth/hci_sock.c
 +++ b/net/bluetooth/hci_sock.c
-@@ -576,7 +576,6 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
+@@ -576,6 +576,7 @@ static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char
  		{
  			struct hci_filter *f = &hci_pi(sk)->filter;
  
--			memset(&uf, 0, sizeof(uf));
++			memset(&uf, 0, sizeof(uf));
  			uf.type_mask = f->type_mask;
  			uf.opcode    = f->opcode;
  			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
 diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
-index 0c2c59d..49d8495 100644
+index 49d8495..0c2c59d 100644
 --- a/net/bluetooth/hidp/core.c
 +++ b/net/bluetooth/hidp/core.c
 @@ -778,7 +778,7 @@ static int hidp_setup_hid(struct hidp_session *session,
  	hid->version = req->version;
  	hid->country = req->country;
  
--	strncpy(hid->name, req->name, sizeof(req->name) - 1);
-+	strncpy(hid->name, req->name, 128);
+-	strncpy(hid->name, req->name, 128);
++	strncpy(hid->name, req->name, sizeof(req->name) - 1);
  	strncpy(hid->phys, batostr(&src), 64);
  	strncpy(hid->uniq, batostr(&dst), 64);
  
 diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
-index 1c20bd9..71120ee 100644
+index 71120ee..1c20bd9 100644
 --- a/net/bluetooth/l2cap.c
 +++ b/net/bluetooth/l2cap.c
-@@ -1184,7 +1184,6 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
+@@ -1184,6 +1184,7 @@ static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *l
  
  	BT_DBG("sock %p, sk %p", sock, sk);
  
--	memset(la, 0, sizeof(struct sockaddr_l2));
++	memset(la, 0, sizeof(struct sockaddr_l2));
  	addr->sa_family = AF_BLUETOOTH;
  	*len = sizeof(struct sockaddr_l2);
  
 diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index 1db0132..1ae3f80 100644
+index 1ae3f80..1db0132 100644
 --- a/net/bluetooth/rfcomm/sock.c
 +++ b/net/bluetooth/rfcomm/sock.c
-@@ -543,7 +543,6 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
+@@ -543,6 +543,7 @@ static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *
  
  	BT_DBG("sock %p, sk %p", sock, sk);
  
--	memset(sa, 0, sizeof(*sa));
++	memset(sa, 0, sizeof(*sa));
  	sa->rc_family  = AF_BLUETOOTH;
  	sa->rc_channel = rfcomm_pi(sk)->channel;
  	if (peer)
-@@ -652,7 +651,6 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -651,6 +652,7 @@ static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
  
  	if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
  		rfcomm_dlc_accept(d);
--		msg->msg_namelen = 0;
++		msg->msg_namelen = 0;
  		return 0;
  	}
  
 diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
-index 108215b..81ae40b 100644
+index 81ae40b..108215b 100644
 --- a/net/bridge/br_stp_bpdu.c
 +++ b/net/bridge/br_stp_bpdu.c
-@@ -15,7 +15,6 @@
+@@ -15,6 +15,7 @@
  #include <linux/netfilter_bridge.h>
  #include <linux/etherdevice.h>
  #include <linux/llc.h>
--#include <linux/pkt_sched.h>
++#include <linux/pkt_sched.h>
  #include <net/net_namespace.h>
  #include <net/llc.h>
  #include <net/llc_pdu.h>
-@@ -40,7 +39,6 @@ static void br_send_bpdu(struct net_bridge_port *p,
+@@ -39,6 +40,7 @@ static void br_send_bpdu(struct net_bridge_port *p,
  
  	skb->dev = p->dev;
  	skb->protocol = htons(ETH_P_802_2);
--	skb->priority = TC_PRIO_CONTROL;
++	skb->priority = TC_PRIO_CONTROL;
  
  	skb_reserve(skb, LLC_RESERVE);
  	memcpy(__skb_put(skb, length), data, length);
 diff --git a/net/core/dev.c b/net/core/dev.c
-index d775563..46e2a29 100644
+index 46e2a29..d775563 100644
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -967,8 +967,6 @@ rollback:
+@@ -967,6 +967,8 @@ rollback:
   */
  int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
  {
--	char *new_ifalias;
--
++	char *new_ifalias;
++
  	ASSERT_RTNL();
  
  	if (len >= IFALIASZ)
-@@ -982,10 +980,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
+@@ -980,9 +982,10 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len)
  		return 0;
  	}
  
--	new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
--	if (!new_ifalias)
-+	dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
-+	if (!dev->ifalias)
+-	dev->ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
+-	if (!dev->ifalias)
++	new_ifalias = krealloc(dev->ifalias, len + 1, GFP_KERNEL);
++	if (!new_ifalias)
  		return -ENOMEM;
--	dev->ifalias = new_ifalias;
++	dev->ifalias = new_ifalias;
  
  	strlcpy(dev->ifalias, alias, len+1);
  	return len;
-@@ -2848,7 +2845,7 @@ static void net_rx_action(struct softirq_action *h)
+@@ -2845,7 +2848,7 @@ static void net_rx_action(struct softirq_action *h)
  		 * Allow this to run for 2 jiffies since which will allow
  		 * an average latency of 1.5/HZ.
  		 */
--		if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
-+		if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
+-		if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
++		if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
  			goto softnet_break;
  
  		local_irq_enable();
 diff --git a/net/core/sock.c b/net/core/sock.c
-index eafa660..4538a34 100644
+index 4538a34..eafa660 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -562,8 +562,7 @@ set_rcvbuf:
+@@ -562,7 +562,8 @@ set_rcvbuf:
  
  	case SO_KEEPALIVE:
  #ifdef CONFIG_INET
--		if (sk->sk_protocol == IPPROTO_TCP &&
--		    sk->sk_type == SOCK_STREAM)
-+		if (sk->sk_protocol == IPPROTO_TCP)
+-		if (sk->sk_protocol == IPPROTO_TCP)
++		if (sk->sk_protocol == IPPROTO_TCP &&
++		    sk->sk_type == SOCK_STREAM)
  			tcp_set_keepalive(sk, valbool);
  #endif
  		sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
 diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
-index 813fe4b..ac1205d 100644
+index ac1205d..813fe4b 100644
 --- a/net/dcb/dcbnl.c
 +++ b/net/dcb/dcbnl.c
-@@ -307,7 +307,6 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
+@@ -307,6 +307,7 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
  	dcb->dcb_family = AF_UNSPEC;
  	dcb->cmd = DCB_CMD_GPERM_HWADDR;
  
--	memset(perm_addr, 0, sizeof(perm_addr));
++	memset(perm_addr, 0, sizeof(perm_addr));
  	netdev->dcbnl_ops->getpermhwaddr(netdev, perm_addr);
  
  	ret = nla_put(dcbnl_skb, DCB_ATTR_PERM_HWADDR, sizeof(perm_addr),
 diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
-index cef3656..d14c0a3 100644
+index d14c0a3..cef3656 100644
 --- a/net/dccp/ipv4.c
 +++ b/net/dccp/ipv4.c
-@@ -47,7 +47,6 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -47,6 +47,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  	__be32 daddr, nexthop;
  	int tmp;
  	int err;
--	struct ip_options_rcu *inet_opt;
++	struct ip_options_rcu *inet_opt;
  
  	dp->dccps_role = DCCP_ROLE_CLIENT;
  
-@@ -58,12 +57,10 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -57,10 +58,12 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  		return -EAFNOSUPPORT;
  
  	nexthop = daddr = usin->sin_addr.s_addr;
--
--	inet_opt = inet->inet_opt;
--	if (inet_opt != NULL && inet_opt->opt.srr) {
-+	if (inet->opt != NULL && inet->opt->srr) {
+-	if (inet->opt != NULL && inet->opt->srr) {
++
++	inet_opt = inet->inet_opt;
++	if (inet_opt != NULL && inet_opt->opt.srr) {
  		if (daddr == 0)
  			return -EINVAL;
--		nexthop = inet_opt->opt.faddr;
-+		nexthop = inet->opt->faddr;
+-		nexthop = inet->opt->faddr;
++		nexthop = inet_opt->opt.faddr;
  	}
  
  	tmp = ip_route_connect(&rt, nexthop, inet->saddr,
-@@ -78,7 +75,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -75,7 +78,7 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  		return -ENETUNREACH;
  	}
  
--	if (inet_opt == NULL || !inet_opt->opt.srr)
-+	if (inet->opt == NULL || !inet->opt->srr)
+-	if (inet->opt == NULL || !inet->opt->srr)
++	if (inet_opt == NULL || !inet_opt->opt.srr)
  		daddr = rt->rt_dst;
  
  	if (inet->saddr == 0)
-@@ -89,8 +86,8 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -86,8 +89,8 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  	inet->daddr = daddr;
  
  	inet_csk(sk)->icsk_ext_hdr_len = 0;
--	if (inet_opt)
--		inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-+	if (inet->opt != NULL)
-+		inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
+-	if (inet->opt != NULL)
+-		inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
++	if (inet_opt)
++		inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
  	/*
  	 * Socket identity is still unknown (sport may be zero).
  	 * However we set state to DCCP_REQUESTING and not releasing socket
-@@ -400,7 +397,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
+@@ -397,7 +400,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
  	newinet->daddr	   = ireq->rmt_addr;
  	newinet->rcv_saddr = ireq->loc_addr;
  	newinet->saddr	   = ireq->loc_addr;
--	newinet->inet_opt	= ireq->opt;
-+	newinet->opt	   = ireq->opt;
+-	newinet->opt	   = ireq->opt;
++	newinet->inet_opt	= ireq->opt;
  	ireq->opt	   = NULL;
  	newinet->mc_index  = inet_iif(skb);
  	newinet->mc_ttl	   = ip_hdr(skb)->ttl;
 diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
-index 2f11de7..9ed1962 100644
+index 9ed1962..2f11de7 100644
 --- a/net/dccp/ipv6.c
 +++ b/net/dccp/ipv6.c
 @@ -600,7 +600,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
  
  	   First: no IPv4 options.
  	 */
--	newinet->inet_opt = NULL;
-+	newinet->opt = NULL;
+-	newinet->opt = NULL;
++	newinet->inet_opt = NULL;
  
  	/* Clone RX bits */
  	newnp->rxopt.all = np->rxopt.all;
 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index d1992a4..a289878 100644
+index a289878..d1992a4 100644
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
 @@ -152,7 +152,7 @@ void inet_sock_destruct(struct sock *sk)
  	WARN_ON(sk->sk_wmem_queued);
  	WARN_ON(sk->sk_forward_alloc);
  
--	kfree(inet->inet_opt);
-+	kfree(inet->opt);
+-	kfree(inet->opt);
++	kfree(inet->inet_opt);
  	dst_release(sk->sk_dst_cache);
  	sk_refcnt_debug_dec(sk);
  }
-@@ -1065,11 +1065,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
+@@ -1065,9 +1065,11 @@ static int inet_sk_reselect_saddr(struct sock *sk)
  	__be32 old_saddr = inet->saddr;
  	__be32 new_saddr;
  	__be32 daddr = inet->daddr;
--	struct ip_options_rcu *inet_opt;
++	struct ip_options_rcu *inet_opt;
  
--	inet_opt = inet->inet_opt;
--	if (inet_opt && inet_opt->opt.srr)
--		daddr = inet_opt->opt.faddr;
-+	if (inet->opt && inet->opt->srr)
-+		daddr = inet->opt->faddr;
+-	if (inet->opt && inet->opt->srr)
+-		daddr = inet->opt->faddr;
++	inet_opt = inet->inet_opt;
++	if (inet_opt && inet_opt->opt.srr)
++		daddr = inet_opt->opt.faddr;
  
  	/* Query new route. */
  	err = ip_route_connect(&rt, daddr, 0,
-@@ -1111,7 +1109,6 @@ int inet_sk_rebuild_header(struct sock *sk)
+@@ -1109,6 +1111,7 @@ int inet_sk_rebuild_header(struct sock *sk)
  	struct inet_sock *inet = inet_sk(sk);
  	struct rtable *rt = (struct rtable *)__sk_dst_check(sk, 0);
  	__be32 daddr;
--	struct ip_options_rcu *inet_opt;
++	struct ip_options_rcu *inet_opt;
  	int err;
  
  	/* Route is OK, nothing to do. */
-@@ -1119,12 +1116,9 @@ int inet_sk_rebuild_header(struct sock *sk)
+@@ -1116,9 +1119,12 @@ int inet_sk_rebuild_header(struct sock *sk)
  		return 0;
  
  	/* Reroute. */
--	rcu_read_lock();
--	inet_opt = rcu_dereference(inet->inet_opt);
++	rcu_read_lock();
++	inet_opt = rcu_dereference(inet->inet_opt);
  	daddr = inet->daddr;
--	if (inet_opt && inet_opt->opt.srr)
--		daddr = inet_opt->opt.faddr;
--	rcu_read_unlock();
-+	if (inet->opt && inet->opt->srr)
-+		daddr = inet->opt->faddr;
+-	if (inet->opt && inet->opt->srr)
+-		daddr = inet->opt->faddr;
++	if (inet_opt && inet_opt->opt.srr)
++		daddr = inet_opt->opt.faddr;
++	rcu_read_unlock();
  {
  	struct flowi fl = {
  		.oif = sk->sk_bound_dev_if,
 diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
-index b6d06d6..10f8f8d 100644
+index 10f8f8d..b6d06d6 100644
 --- a/net/ipv4/cipso_ipv4.c
 +++ b/net/ipv4/cipso_ipv4.c
-@@ -1860,11 +1860,6 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
+@@ -1860,6 +1860,11 @@ static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
  	return CIPSO_V4_HDR_LEN + ret_val;
  }
  
--static void opt_kfree_rcu(struct rcu_head *head)
--{
--	kfree(container_of(head, struct ip_options_rcu, rcu));
--}
--
++static void opt_kfree_rcu(struct rcu_head *head)
++{
++	kfree(container_of(head, struct ip_options_rcu, rcu));
++}
++
  /**
   * cipso_v4_sock_setattr - Add a CIPSO option to a socket
   * @sk: the socket
-@@ -1887,7 +1882,7 @@ int cipso_v4_sock_setattr(struct sock *sk,
+@@ -1882,7 +1887,7 @@ int cipso_v4_sock_setattr(struct sock *sk,
  	unsigned char *buf = NULL;
  	u32 buf_len;
  	u32 opt_len;
--	struct ip_options_rcu *old, *opt = NULL;
-+	struct ip_options *opt = NULL;
+-	struct ip_options *opt = NULL;
++	struct ip_options_rcu *old, *opt = NULL;
  	struct inet_sock *sk_inet;
  	struct inet_connection_sock *sk_conn;
  
-@@ -1923,25 +1918,22 @@ int cipso_v4_sock_setattr(struct sock *sk,
+@@ -1918,22 +1923,25 @@ int cipso_v4_sock_setattr(struct sock *sk,
  		ret_val = -ENOMEM;
  		goto socket_setattr_failure;
  	}
--	memcpy(opt->opt.__data, buf, buf_len);
--	opt->opt.optlen = opt_len;
--	opt->opt.cipso = sizeof(struct iphdr);
-+	memcpy(opt->__data, buf, buf_len);
-+	opt->optlen = opt_len;
-+	opt->cipso = sizeof(struct iphdr);
+-	memcpy(opt->__data, buf, buf_len);
+-	opt->optlen = opt_len;
+-	opt->cipso = sizeof(struct iphdr);
++	memcpy(opt->opt.__data, buf, buf_len);
++	opt->opt.optlen = opt_len;
++	opt->opt.cipso = sizeof(struct iphdr);
  	kfree(buf);
  	buf = NULL;
  
  	sk_inet = inet_sk(sk);
--
--	old = sk_inet->inet_opt;
++
++	old = sk_inet->inet_opt;
  	if (sk_inet->is_icsk) {
  		sk_conn = inet_csk(sk);
--		if (old)
--			sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
--		sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
-+		if (sk_inet->opt)
-+			sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
-+		sk_conn->icsk_ext_hdr_len += opt->optlen;
+-		if (sk_inet->opt)
+-			sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
+-		sk_conn->icsk_ext_hdr_len += opt->optlen;
++		if (old)
++			sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
++		sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
  		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
  	}
--	rcu_assign_pointer(sk_inet->inet_opt, opt);
--	if (old)
--		call_rcu(&old->rcu, opt_kfree_rcu);
-+	opt = xchg(&sk_inet->opt, opt);
-+	kfree(opt);
+-	opt = xchg(&sk_inet->opt, opt);
+-	kfree(opt);
++	rcu_assign_pointer(sk_inet->inet_opt, opt);
++	if (old)
++		call_rcu(&old->rcu, opt_kfree_rcu);
  
  	return 0;
  
-@@ -1971,7 +1963,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
+@@ -1963,7 +1971,7 @@ int cipso_v4_req_setattr(struct request_sock *req,
  	unsigned char *buf = NULL;
  	u32 buf_len;
  	u32 opt_len;
--	struct ip_options_rcu *opt = NULL;
-+	struct ip_options *opt = NULL;
+-	struct ip_options *opt = NULL;
++	struct ip_options_rcu *opt = NULL;
  	struct inet_request_sock *req_inet;
  
  	/* We allocate the maximum CIPSO option size here so we are probably
-@@ -1999,16 +1991,15 @@ int cipso_v4_req_setattr(struct request_sock *req,
+@@ -1991,15 +1999,16 @@ int cipso_v4_req_setattr(struct request_sock *req,
  		ret_val = -ENOMEM;
  		goto req_setattr_failure;
  	}
--	memcpy(opt->opt.__data, buf, buf_len);
--	opt->opt.optlen = opt_len;
--	opt->opt.cipso = sizeof(struct iphdr);
-+	memcpy(opt->__data, buf, buf_len);
-+	opt->optlen = opt_len;
-+	opt->cipso = sizeof(struct iphdr);
+-	memcpy(opt->__data, buf, buf_len);
+-	opt->optlen = opt_len;
+-	opt->cipso = sizeof(struct iphdr);
++	memcpy(opt->opt.__data, buf, buf_len);
++	opt->opt.optlen = opt_len;
++	opt->opt.cipso = sizeof(struct iphdr);
  	kfree(buf);
  	buf = NULL;
  
  	req_inet = inet_rsk(req);
  	opt = xchg(&req_inet->opt, opt);
--	if (opt)
--		call_rcu(&opt->rcu, opt_kfree_rcu);
-+	kfree(opt);
+-	kfree(opt);
++	if (opt)
++		call_rcu(&opt->rcu, opt_kfree_rcu);
  
  	return 0;
  
-@@ -2028,34 +2019,34 @@ req_setattr_failure:
+@@ -2019,34 +2028,34 @@ req_setattr_failure:
   * values on failure.
   *
   */
--int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
-+int cipso_v4_delopt(struct ip_options **opt_ptr)
+-int cipso_v4_delopt(struct ip_options **opt_ptr)
++int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
  {
  	int hdr_delta = 0;
--	struct ip_options_rcu *opt = *opt_ptr;
-+	struct ip_options *opt = *opt_ptr;
+-	struct ip_options *opt = *opt_ptr;
++	struct ip_options_rcu *opt = *opt_ptr;
  
--	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
-+	if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
+-	if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
++	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
  		u8 cipso_len;
  		u8 cipso_off;
  		unsigned char *cipso_ptr;
  		int iter;
  		int optlen_new;
  
--		cipso_off = opt->opt.cipso - sizeof(struct iphdr);
--		cipso_ptr = &opt->opt.__data[cipso_off];
-+		cipso_off = opt->cipso - sizeof(struct iphdr);
-+		cipso_ptr = &opt->__data[cipso_off];
+-		cipso_off = opt->cipso - sizeof(struct iphdr);
+-		cipso_ptr = &opt->__data[cipso_off];
++		cipso_off = opt->opt.cipso - sizeof(struct iphdr);
++		cipso_ptr = &opt->opt.__data[cipso_off];
  		cipso_len = cipso_ptr[1];
  
--		if (opt->opt.srr > opt->opt.cipso)
--			opt->opt.srr -= cipso_len;
--		if (opt->opt.rr > opt->opt.cipso)
--			opt->opt.rr -= cipso_len;
--		if (opt->opt.ts > opt->opt.cipso)
--			opt->opt.ts -= cipso_len;
--		if (opt->opt.router_alert > opt->opt.cipso)
--			opt->opt.router_alert -= cipso_len;
--		opt->opt.cipso = 0;
-+		if (opt->srr > opt->cipso)
-+			opt->srr -= cipso_len;
-+		if (opt->rr > opt->cipso)
-+			opt->rr -= cipso_len;
-+		if (opt->ts > opt->cipso)
-+			opt->ts -= cipso_len;
-+		if (opt->router_alert > opt->cipso)
-+			opt->router_alert -= cipso_len;
-+		opt->cipso = 0;
+-		if (opt->srr > opt->cipso)
+-			opt->srr -= cipso_len;
+-		if (opt->rr > opt->cipso)
+-			opt->rr -= cipso_len;
+-		if (opt->ts > opt->cipso)
+-			opt->ts -= cipso_len;
+-		if (opt->router_alert > opt->cipso)
+-			opt->router_alert -= cipso_len;
+-		opt->cipso = 0;
++		if (opt->opt.srr > opt->opt.cipso)
++			opt->opt.srr -= cipso_len;
++		if (opt->opt.rr > opt->opt.cipso)
++			opt->opt.rr -= cipso_len;
++		if (opt->opt.ts > opt->opt.cipso)
++			opt->opt.ts -= cipso_len;
++		if (opt->opt.router_alert > opt->opt.cipso)
++			opt->opt.router_alert -= cipso_len;
++		opt->opt.cipso = 0;
  
  		memmove(cipso_ptr, cipso_ptr + cipso_len,
--			opt->opt.optlen - cipso_off - cipso_len);
-+			opt->optlen - cipso_off - cipso_len);
+-			opt->optlen - cipso_off - cipso_len);
++			opt->opt.optlen - cipso_off - cipso_len);
  
  		/* determining the new total option length is tricky because of
  		 * the padding necessary, the only thing i can think to do at
-@@ -2064,21 +2055,21 @@ int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
+@@ -2055,21 +2064,21 @@ int cipso_v4_delopt(struct ip_options **opt_ptr)
  		 * from there we can determine the new total option length */
  		iter = 0;
  		optlen_new = 0;
--		while (iter < opt->opt.optlen)
--			if (opt->opt.__data[iter] != IPOPT_NOP) {
--				iter += opt->opt.__data[iter + 1];
-+		while (iter < opt->optlen)
-+			if (opt->__data[iter] != IPOPT_NOP) {
-+				iter += opt->__data[iter + 1];
+-		while (iter < opt->optlen)
+-			if (opt->__data[iter] != IPOPT_NOP) {
+-				iter += opt->__data[iter + 1];
++		while (iter < opt->opt.optlen)
++			if (opt->opt.__data[iter] != IPOPT_NOP) {
++				iter += opt->opt.__data[iter + 1];
  				optlen_new = iter;
  			} else
  				iter++;
--		hdr_delta = opt->opt.optlen;
--		opt->opt.optlen = (optlen_new + 3) & ~3;
--		hdr_delta -= opt->opt.optlen;
-+		hdr_delta = opt->optlen;
-+		opt->optlen = (optlen_new + 3) & ~3;
-+		hdr_delta -= opt->optlen;
+-		hdr_delta = opt->optlen;
+-		opt->optlen = (optlen_new + 3) & ~3;
+-		hdr_delta -= opt->optlen;
++		hdr_delta = opt->opt.optlen;
++		opt->opt.optlen = (optlen_new + 3) & ~3;
++		hdr_delta -= opt->opt.optlen;
  	} else {
  		/* only the cipso option was present on the socket so we can
  		 * remove the entire option struct */
  		*opt_ptr = NULL;
--		hdr_delta = opt->opt.optlen;
--		call_rcu(&opt->rcu, opt_kfree_rcu);
-+		hdr_delta = opt->optlen;
-+		kfree(opt);
+-		hdr_delta = opt->optlen;
+-		kfree(opt);
++		hdr_delta = opt->opt.optlen;
++		call_rcu(&opt->rcu, opt_kfree_rcu);
  	}
  
  	return hdr_delta;
-@@ -2095,15 +2086,15 @@ int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
+@@ -2086,15 +2095,15 @@ int cipso_v4_delopt(struct ip_options **opt_ptr)
  void cipso_v4_sock_delattr(struct sock *sk)
  {
  	int hdr_delta;
--	struct ip_options_rcu *opt;
-+	struct ip_options *opt;
+-	struct ip_options *opt;
++	struct ip_options_rcu *opt;
  	struct inet_sock *sk_inet;
  
  	sk_inet = inet_sk(sk);
--	opt = sk_inet->inet_opt;
--	if (opt == NULL || opt->opt.cipso == 0)
-+	opt = sk_inet->opt;
-+	if (opt == NULL || opt->cipso == 0)
+-	opt = sk_inet->opt;
+-	if (opt == NULL || opt->cipso == 0)
++	opt = sk_inet->inet_opt;
++	if (opt == NULL || opt->opt.cipso == 0)
  		return;
  
--	hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
-+	hdr_delta = cipso_v4_delopt(&sk_inet->opt);
+-	hdr_delta = cipso_v4_delopt(&sk_inet->opt);
++	hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
  	if (sk_inet->is_icsk && hdr_delta > 0) {
  		struct inet_connection_sock *sk_conn = inet_csk(sk);
  		sk_conn->icsk_ext_hdr_len -= hdr_delta;
-@@ -2121,12 +2112,12 @@ void cipso_v4_sock_delattr(struct sock *sk)
+@@ -2112,12 +2121,12 @@ void cipso_v4_sock_delattr(struct sock *sk)
   */
  void cipso_v4_req_delattr(struct request_sock *req)
  {
--	struct ip_options_rcu *opt;
-+	struct ip_options *opt;
+-	struct ip_options *opt;
++	struct ip_options_rcu *opt;
  	struct inet_request_sock *req_inet;
  
  	req_inet = inet_rsk(req);
  	opt = req_inet->opt;
--	if (opt == NULL || opt->opt.cipso == 0)
-+	if (opt == NULL || opt->cipso == 0)
+-	if (opt == NULL || opt->cipso == 0)
++	if (opt == NULL || opt->opt.cipso == 0)
  		return;
  
  	cipso_v4_delopt(&req_inet->opt);
-@@ -2196,18 +2187,14 @@ getattr_return:
+@@ -2187,14 +2196,18 @@ getattr_return:
   */
  int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
  {
--	struct ip_options_rcu *opt;
--	int res = -ENOMSG;
-+	struct ip_options *opt;
+-	struct ip_options *opt;
++	struct ip_options_rcu *opt;
++	int res = -ENOMSG;
  
--	rcu_read_lock();
--	opt = rcu_dereference(inet_sk(sk)->inet_opt);
--	if (opt && opt->opt.cipso)
--		res = cipso_v4_getattr(opt->opt.__data +
--						opt->opt.cipso -
--						sizeof(struct iphdr),
--				       secattr);
--	rcu_read_unlock();
--	return res;
-+	opt = inet_sk(sk)->opt;
-+	if (opt == NULL || opt->cipso == 0)
-+		return -ENOMSG;
-+
-+	return cipso_v4_getattr(opt->__data + opt->cipso - sizeof(struct iphdr),
-+				secattr);
+-	opt = inet_sk(sk)->opt;
+-	if (opt == NULL || opt->cipso == 0)
+-		return -ENOMSG;
+-
+-	return cipso_v4_getattr(opt->__data + opt->cipso - sizeof(struct iphdr),
+-				secattr);
++	rcu_read_lock();
++	opt = rcu_dereference(inet_sk(sk)->inet_opt);
++	if (opt && opt->opt.cipso)
++		res = cipso_v4_getattr(opt->opt.__data +
++						opt->opt.cipso -
++						sizeof(struct iphdr),
++				       secattr);
++	rcu_read_unlock();
++	return res;
  }
  
  /**
 diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
-index 859d781..5bc13fe 100644
+index 5bc13fe..859d781 100644
 --- a/net/ipv4/icmp.c
 +++ b/net/ipv4/icmp.c
-@@ -107,7 +107,8 @@ struct icmp_bxm {
+@@ -107,8 +107,7 @@ struct icmp_bxm {
  		__be32	       times[3];
  	} data;
  	int head_len;
--	struct ip_options_data replyopts;
-+	struct ip_options replyopts;
-+	unsigned char  optbuf[40];
+-	struct ip_options replyopts;
+-	unsigned char  optbuf[40];
++	struct ip_options_data replyopts;
  };
  
  /* An array of errno for error messages from dest unreach. */
-@@ -361,7 +362,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
+@@ -362,7 +361,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
  	struct inet_sock *inet;
  	__be32 daddr;
  
--	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
-+	if (ip_options_echo(&icmp_param->replyopts, skb))
+-	if (ip_options_echo(&icmp_param->replyopts, skb))
++	if (ip_options_echo(&icmp_param->replyopts.opt.opt, skb))
  		return;
  
  	sk = icmp_xmit_lock(net);
-@@ -375,10 +376,10 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
+@@ -376,10 +375,10 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
  	daddr = ipc.addr = rt->rt_src;
  	ipc.opt = NULL;
  	ipc.shtx.flags = 0;
--	if (icmp_param->replyopts.opt.opt.optlen) {
--		ipc.opt = &icmp_param->replyopts.opt;
--		if (ipc.opt->opt.srr)
--			daddr = icmp_param->replyopts.opt.opt.faddr;
-+	if (icmp_param->replyopts.optlen) {
-+		ipc.opt = &icmp_param->replyopts;
-+		if (ipc.opt->srr)
-+			daddr = icmp_param->replyopts.faddr;
+-	if (icmp_param->replyopts.optlen) {
+-		ipc.opt = &icmp_param->replyopts;
+-		if (ipc.opt->srr)
+-			daddr = icmp_param->replyopts.faddr;
++	if (icmp_param->replyopts.opt.opt.optlen) {
++		ipc.opt = &icmp_param->replyopts.opt;
++		if (ipc.opt->opt.srr)
++			daddr = icmp_param->replyopts.opt.opt.faddr;
  	}
  	{
  		struct flowi fl = { .nl_u = { .ip4_u =
-@@ -515,7 +516,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
+@@ -516,7 +515,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
  					   IPTOS_PREC_INTERNETCONTROL) :
  					  iph->tos;
  
--	if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
-+	if (ip_options_echo(&icmp_param.replyopts, skb_in))
+-	if (ip_options_echo(&icmp_param.replyopts, skb_in))
++	if (ip_options_echo(&icmp_param.replyopts.opt.opt, skb_in))
  		goto out_unlock;
  
  
-@@ -531,15 +532,15 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
+@@ -532,15 +531,15 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
  	icmp_param.offset = skb_network_offset(skb_in);
  	inet_sk(sk)->tos = tos;
  	ipc.addr = iph->saddr;
--	ipc.opt = &icmp_param.replyopts.opt;
-+	ipc.opt = &icmp_param.replyopts;
+-	ipc.opt = &icmp_param.replyopts;
++	ipc.opt = &icmp_param.replyopts.opt;
  	ipc.shtx.flags = 0;
  
  	{
  		struct flowi fl = {
  			.nl_u = {
  				.ip4_u = {
--					.daddr = icmp_param.replyopts.opt.opt.srr ?
--						icmp_param.replyopts.opt.opt.faddr :
-+					.daddr = icmp_param.replyopts.srr ?
-+						icmp_param.replyopts.faddr :
+-					.daddr = icmp_param.replyopts.srr ?
+-						icmp_param.replyopts.faddr :
++					.daddr = icmp_param.replyopts.opt.opt.srr ?
++						icmp_param.replyopts.opt.opt.faddr :
  						iph->saddr,
  					.saddr = saddr,
  					.tos = RT_TOS(tos)
-@@ -628,7 +629,7 @@ route_done:
+@@ -629,7 +628,7 @@ route_done:
  	room = dst_mtu(&rt->u.dst);
  	if (room > 576)
  		room = 576;
--	room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
-+	room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
+-	room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
++	room -= sizeof(struct iphdr) + icmp_param.replyopts.opt.opt.optlen;
  	room -= sizeof(struct icmphdr);
  
  	icmp_param.data_len = skb_in->len - icmp_param.offset;
 diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
-index a3bf986..537731b 100644
+index 537731b..a3bf986 100644
 --- a/net/ipv4/inet_connection_sock.c
 +++ b/net/ipv4/inet_connection_sock.c
 @@ -356,11 +356,11 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
  {
  	struct rtable *rt;
  	const struct inet_request_sock *ireq = inet_rsk(req);
--	struct ip_options_rcu *opt = inet_rsk(req)->opt;
-+	struct ip_options *opt = inet_rsk(req)->opt;
+-	struct ip_options *opt = inet_rsk(req)->opt;
++	struct ip_options_rcu *opt = inet_rsk(req)->opt;
  	struct flowi fl = { .oif = sk->sk_bound_dev_if,
  			    .nl_u = { .ip4_u =
--				      { .daddr = ((opt && opt->opt.srr) ?
--						  opt->opt.faddr :
-+				      { .daddr = ((opt && opt->srr) ?
-+						  opt->faddr :
+-				      { .daddr = ((opt && opt->srr) ?
+-						  opt->faddr :
++				      { .daddr = ((opt && opt->opt.srr) ?
++						  opt->opt.faddr :
  						  ireq->rmt_addr),
  					.saddr = ireq->loc_addr,
  					.tos = RT_CONN_FLAGS(sk) } },
@@ -4927,138 +4914,138 @@ index a3bf986..537731b 100644
  	security_req_classify_flow(req, &fl);
  	if (ip_route_output_flow(net, &rt, &fl, sk, 0))
  		goto no_route;
--	if (opt && opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
-+	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
+-	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
++	if (opt && opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
  		goto route_err;
  	return &rt->u.dst;
  
 diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
-index 8a95972..94bf105 100644
+index 94bf105..8a95972 100644
 --- a/net/ipv4/ip_options.c
 +++ b/net/ipv4/ip_options.c
 @@ -35,7 +35,7 @@
   * saddr is address of outgoing interface.
   */
  
--void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
-+void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
+-void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
++void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
  			    __be32 daddr, struct rtable *rt, int is_frag)
  {
  	unsigned char *iph = skb_network_header(skb);
-@@ -82,9 +82,9 @@ void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
+@@ -82,9 +82,9 @@ void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
   * NOTE: dopt cannot point to skb.
   */
  
--int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
-+int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
+-int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
++int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
  {
--	const struct ip_options *sopt;
-+	struct ip_options *sopt;
+-	struct ip_options *sopt;
++	const struct ip_options *sopt;
  	unsigned char *sptr, *dptr;
  	int soffset, doffset;
  	int	optlen;
-@@ -94,8 +94,10 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
+@@ -94,10 +94,8 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
  
  	sopt = &(IPCB(skb)->opt);
  
--	if (sopt->optlen == 0)
-+	if (sopt->optlen == 0) {
-+		dopt->optlen = 0;
+-	if (sopt->optlen == 0) {
+-		dopt->optlen = 0;
++	if (sopt->optlen == 0)
  		return 0;
-+	}
+-	}
  
  	sptr = skb_network_header(skb);
  	dptr = dopt->__data;
-@@ -154,7 +156,7 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
+@@ -156,7 +154,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
  		dopt->optlen += optlen;
  	}
  	if (sopt->srr) {
--		unsigned char *start = sptr+sopt->srr;
-+		unsigned char * start = sptr+sopt->srr;
+-		unsigned char * start = sptr+sopt->srr;
++		unsigned char *start = sptr+sopt->srr;
  		__be32 faddr;
  
  		optlen  = start[1];
-@@ -497,19 +499,19 @@ void ip_options_undo(struct ip_options * opt)
+@@ -499,19 +497,19 @@ void ip_options_undo(struct ip_options * opt)
  	}
  }
  
--static struct ip_options_rcu *ip_options_get_alloc(const int optlen)
-+static struct ip_options *ip_options_get_alloc(const int optlen)
+-static struct ip_options *ip_options_get_alloc(const int optlen)
++static struct ip_options_rcu *ip_options_get_alloc(const int optlen)
  {
--	return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3),
-+	return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3),
+-	return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3),
++	return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3),
  		       GFP_KERNEL);
  }
  
--static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
--				 struct ip_options_rcu *opt, int optlen)
-+static int ip_options_get_finish(struct net *net, struct ip_options **optp,
-+				 struct ip_options *opt, int optlen)
+-static int ip_options_get_finish(struct net *net, struct ip_options **optp,
+-				 struct ip_options *opt, int optlen)
++static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
++				 struct ip_options_rcu *opt, int optlen)
  {
  	while (optlen & 3)
--		opt->opt.__data[optlen++] = IPOPT_END;
--	opt->opt.optlen = optlen;
--	if (optlen && ip_options_compile(net, &opt->opt, NULL)) {
-+		opt->__data[optlen++] = IPOPT_END;
-+	opt->optlen = optlen;
-+	if (optlen && ip_options_compile(net, opt, NULL)) {
+-		opt->__data[optlen++] = IPOPT_END;
+-	opt->optlen = optlen;
+-	if (optlen && ip_options_compile(net, opt, NULL)) {
++		opt->opt.__data[optlen++] = IPOPT_END;
++	opt->opt.optlen = optlen;
++	if (optlen && ip_options_compile(net, &opt->opt, NULL)) {
  		kfree(opt);
  		return -EINVAL;
  	}
-@@ -518,29 +520,29 @@ static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
+@@ -520,29 +518,29 @@ static int ip_options_get_finish(struct net *net, struct ip_options **optp,
  	return 0;
  }
  
--int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
-+int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+-int ip_options_get_from_user(struct net *net, struct ip_options **optp,
++int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
  			     unsigned char __user *data, int optlen)
  {
--	struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
-+	struct ip_options *opt = ip_options_get_alloc(optlen);
+-	struct ip_options *opt = ip_options_get_alloc(optlen);
++	struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
  
  	if (!opt)
  		return -ENOMEM;
--	if (optlen && copy_from_user(opt->opt.__data, data, optlen)) {
-+	if (optlen && copy_from_user(opt->__data, data, optlen)) {
+-	if (optlen && copy_from_user(opt->__data, data, optlen)) {
++	if (optlen && copy_from_user(opt->opt.__data, data, optlen)) {
  		kfree(opt);
  		return -EFAULT;
  	}
  	return ip_options_get_finish(net, optp, opt, optlen);
  }
  
--int ip_options_get(struct net *net, struct ip_options_rcu **optp,
-+int ip_options_get(struct net *net, struct ip_options **optp,
+-int ip_options_get(struct net *net, struct ip_options **optp,
++int ip_options_get(struct net *net, struct ip_options_rcu **optp,
  		   unsigned char *data, int optlen)
  {
--	struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
-+	struct ip_options *opt = ip_options_get_alloc(optlen);
+-	struct ip_options *opt = ip_options_get_alloc(optlen);
++	struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
  
  	if (!opt)
  		return -ENOMEM;
  	if (optlen)
--		memcpy(opt->opt.__data, data, optlen);
-+		memcpy(opt->__data, data, optlen);
+-		memcpy(opt->__data, data, optlen);
++		memcpy(opt->opt.__data, data, optlen);
  	return ip_options_get_finish(net, optp, opt, optlen);
  }
  
 diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
-index 7dde039..44b7910 100644
+index 44b7910..7dde039 100644
 --- a/net/ipv4/ip_output.c
 +++ b/net/ipv4/ip_output.c
 @@ -137,14 +137,14 @@ static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
   *
   */
  int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
--			  __be32 saddr, __be32 daddr, struct ip_options_rcu *opt)
-+			  __be32 saddr, __be32 daddr, struct ip_options *opt)
+-			  __be32 saddr, __be32 daddr, struct ip_options *opt)
++			  __be32 saddr, __be32 daddr, struct ip_options_rcu *opt)
  {
  	struct inet_sock *inet = inet_sk(sk);
  	struct rtable *rt = skb_rtable(skb);
  	struct iphdr *iph;
  
  	/* Build the IP header. */
--	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->opt.optlen : 0));
-+	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
+-	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
++	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->opt.optlen : 0));
  	skb_reset_network_header(skb);
  	iph = ip_hdr(skb);
  	iph->version  = 4;
@@ -5066,290 +5053,290 @@ index 7dde039..44b7910 100644
  	iph->protocol = sk->sk_protocol;
  	ip_select_ident(iph, &rt->u.dst, sk);
  
--	if (opt && opt->opt.optlen) {
--		iph->ihl += opt->opt.optlen>>2;
--		ip_options_build(skb, &opt->opt, daddr, rt, 0);
-+	if (opt && opt->optlen) {
-+		iph->ihl += opt->optlen>>2;
-+		ip_options_build(skb, opt, daddr, rt, 0);
+-	if (opt && opt->optlen) {
+-		iph->ihl += opt->optlen>>2;
+-		ip_options_build(skb, opt, daddr, rt, 0);
++	if (opt && opt->opt.optlen) {
++		iph->ihl += opt->opt.optlen>>2;
++		ip_options_build(skb, &opt->opt, daddr, rt, 0);
  	}
  
  	skb->priority = sk->sk_priority;
-@@ -312,10 +312,9 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
+@@ -312,9 +312,10 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
  {
  	struct sock *sk = skb->sk;
  	struct inet_sock *inet = inet_sk(sk);
--	struct ip_options_rcu *inet_opt = NULL;
-+	struct ip_options *opt = inet->opt;
+-	struct ip_options *opt = inet->opt;
++	struct ip_options_rcu *inet_opt = NULL;
  	struct rtable *rt;
  	struct iphdr *iph;
--	int res;
++	int res;
  
  	/* Skip all of this if the packet is already routed,
  	 * f.e. by something like SCTP.
-@@ -326,15 +325,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
+@@ -325,13 +326,15 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
  
  	/* Make sure we can route this packet. */
  	rt = (struct rtable *)__sk_dst_check(sk, 0);
--	rcu_read_lock();
--	inet_opt = rcu_dereference(inet->inet_opt);
++	rcu_read_lock();
++	inet_opt = rcu_dereference(inet->inet_opt);
  	if (rt == NULL) {
  		__be32 daddr;
  
  		/* Use correct destination address if we have options. */
  		daddr = inet->daddr;
--		if (inet_opt && inet_opt->opt.srr)
--			daddr = inet_opt->opt.faddr;
-+		if(opt && opt->srr)
-+			daddr = opt->faddr;
+-		if(opt && opt->srr)
+-			daddr = opt->faddr;
++		if (inet_opt && inet_opt->opt.srr)
++			daddr = inet_opt->opt.faddr;
  
  		{
  			struct flowi fl = { .oif = sk->sk_bound_dev_if,
-@@ -362,11 +359,11 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
+@@ -359,11 +362,11 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
  	skb_dst_set(skb, dst_clone(&rt->u.dst));
  
  packet_routed:
--	if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
-+	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
+-	if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
++	if (inet_opt && inet_opt->opt.is_strictroute && rt->rt_dst != rt->rt_gateway)
  		goto no_route;
  
  	/* OK, we know where to send it, allocate and build IP header. */
--	skb_push(skb, sizeof(struct iphdr) + (inet_opt ? inet_opt->opt.optlen : 0));
-+	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
+-	skb_push(skb, sizeof(struct iphdr) + (opt ? opt->optlen : 0));
++	skb_push(skb, sizeof(struct iphdr) + (inet_opt ? inet_opt->opt.optlen : 0));
  	skb_reset_network_header(skb);
  	iph = ip_hdr(skb);
  	*((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (inet->tos & 0xff));
-@@ -380,9 +377,9 @@ packet_routed:
+@@ -377,9 +380,9 @@ packet_routed:
  	iph->daddr    = rt->rt_dst;
  	/* Transport layer set skb->h.foo itself. */
  
--	if (inet_opt && inet_opt->opt.optlen) {
--		iph->ihl += inet_opt->opt.optlen >> 2;
--		ip_options_build(skb, &inet_opt->opt, inet->daddr, rt, 0);
-+	if (opt && opt->optlen) {
-+		iph->ihl += opt->optlen >> 2;
-+		ip_options_build(skb, opt, inet->daddr, rt, 0);
+-	if (opt && opt->optlen) {
+-		iph->ihl += opt->optlen >> 2;
+-		ip_options_build(skb, opt, inet->daddr, rt, 0);
++	if (inet_opt && inet_opt->opt.optlen) {
++		iph->ihl += inet_opt->opt.optlen >> 2;
++		ip_options_build(skb, &inet_opt->opt, inet->daddr, rt, 0);
  	}
  
  	ip_select_ident_more(iph, &rt->u.dst, sk,
-@@ -390,12 +387,10 @@ packet_routed:
+@@ -387,10 +390,12 @@ packet_routed:
  
  	skb->priority = sk->sk_priority;
  	skb->mark = sk->sk_mark;
--	res = ip_local_out(skb);
--	rcu_read_unlock();
--	return res;
-+
-+	return ip_local_out(skb);
+-
+-	return ip_local_out(skb);
++	res = ip_local_out(skb);
++	rcu_read_unlock();
++	return res;
  
  no_route:
--	rcu_read_unlock();
++	rcu_read_unlock();
  	IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
  	kfree_skb(skb);
  	return -EHOSTUNREACH;
-@@ -814,7 +809,7 @@ int ip_append_data(struct sock *sk,
+@@ -809,7 +814,7 @@ int ip_append_data(struct sock *sk,
  		/*
  		 * setup for corking.
  		 */
--		opt = ipc->opt ? &ipc->opt->opt : NULL;
-+		opt = ipc->opt;
+-		opt = ipc->opt;
++		opt = ipc->opt ? &ipc->opt->opt : NULL;
  		if (opt) {
  			if (inet->cork.opt == NULL) {
  				inet->cork.opt = kmalloc(sizeof(struct ip_options) + 40, sk->sk_allocation);
-@@ -1372,23 +1367,26 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
+@@ -1367,26 +1372,23 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
  		   unsigned int len)
  {
  	struct inet_sock *inet = inet_sk(sk);
--	struct ip_options_data replyopts;
-+	struct {
-+		struct ip_options	opt;
-+		char			data[40];
-+	} replyopts;
+-	struct {
+-		struct ip_options	opt;
+-		char			data[40];
+-	} replyopts;
++	struct ip_options_data replyopts;
  	struct ipcm_cookie ipc;
  	__be32 daddr;
  	struct rtable *rt = skb_rtable(skb);
  
--	if (ip_options_echo(&replyopts.opt.opt, skb))
-+	if (ip_options_echo(&replyopts.opt, skb))
+-	if (ip_options_echo(&replyopts.opt, skb))
++	if (ip_options_echo(&replyopts.opt.opt, skb))
  		return;
  
  	daddr = ipc.addr = rt->rt_src;
  	ipc.opt = NULL;
  	ipc.shtx.flags = 0;
  
--	if (replyopts.opt.opt.optlen) {
-+	if (replyopts.opt.optlen) {
+-	if (replyopts.opt.optlen) {
++	if (replyopts.opt.opt.optlen) {
  		ipc.opt = &replyopts.opt;
  
--		if (replyopts.opt.opt.srr)
--			daddr = replyopts.opt.opt.faddr;
-+		if (ipc.opt->srr)
-+			daddr = replyopts.opt.faddr;
+-		if (ipc.opt->srr)
+-			daddr = replyopts.opt.faddr;
++		if (replyopts.opt.opt.srr)
++			daddr = replyopts.opt.opt.faddr;
  	}
  
  	{
 diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
-index 099e6c3..e982b5c 100644
+index e982b5c..099e6c3 100644
 --- a/net/ipv4/ip_sockglue.c
 +++ b/net/ipv4/ip_sockglue.c
-@@ -434,11 +434,6 @@ out:
+@@ -434,6 +434,11 @@ out:
  }
  
  
--static void opt_kfree_rcu(struct rcu_head *head)
--{
--	kfree(container_of(head, struct ip_options_rcu, rcu));
--}
--
++static void opt_kfree_rcu(struct rcu_head *head)
++{
++	kfree(container_of(head, struct ip_options_rcu, rcu));
++}
++
  /*
   *	Socket option code for IP. This is the end of the line after any
   *	TCP,UDP etc options on an IP socket.
-@@ -484,15 +479,13 @@ static int do_ip_setsockopt(struct sock *sk, int level,
+@@ -479,13 +484,15 @@ static int do_ip_setsockopt(struct sock *sk, int level,
  	switch (optname) {
  	case IP_OPTIONS:
  	{
--		struct ip_options_rcu *old, *opt = NULL;
--
-+		struct ip_options *opt = NULL;
+-		struct ip_options *opt = NULL;
++		struct ip_options_rcu *old, *opt = NULL;
++
  		if (optlen > 40 || optlen < 0)
  			goto e_inval;
  		err = ip_options_get_from_user(sock_net(sk), &opt,
  					       optval, optlen);
  		if (err)
  			break;
--		old = inet->inet_opt;
++		old = inet->inet_opt;
  		if (inet->is_icsk) {
  			struct inet_connection_sock *icsk = inet_csk(sk);
  #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-@@ -501,18 +494,17 @@ static int do_ip_setsockopt(struct sock *sk, int level,
+@@ -494,17 +501,18 @@ static int do_ip_setsockopt(struct sock *sk, int level,
  			       (TCPF_LISTEN | TCPF_CLOSE)) &&
  			     inet->daddr != LOOPBACK4_IPV6)) {
  #endif
--				if (old)
--					icsk->icsk_ext_hdr_len -= old->opt.optlen;
-+				if (inet->opt)
-+					icsk->icsk_ext_hdr_len -= inet->opt->optlen;
+-				if (inet->opt)
+-					icsk->icsk_ext_hdr_len -= inet->opt->optlen;
++				if (old)
++					icsk->icsk_ext_hdr_len -= old->opt.optlen;
  				if (opt)
--					icsk->icsk_ext_hdr_len += opt->opt.optlen;
-+					icsk->icsk_ext_hdr_len += opt->optlen;
+-					icsk->icsk_ext_hdr_len += opt->optlen;
++					icsk->icsk_ext_hdr_len += opt->opt.optlen;
  				icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
  #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
  			}
  #endif
  		}
--		rcu_assign_pointer(inet->inet_opt, opt);
--		if (old)
--			call_rcu(&old->rcu, opt_kfree_rcu);
-+		opt = xchg(&inet->opt, opt);
-+		kfree(opt);
+-		opt = xchg(&inet->opt, opt);
+-		kfree(opt);
++		rcu_assign_pointer(inet->inet_opt, opt);
++		if (old)
++			call_rcu(&old->rcu, opt_kfree_rcu);
  		break;
  	}
  	case IP_PKTINFO:
-@@ -571,7 +563,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
+@@ -563,7 +571,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
  	case IP_TTL:
  		if (optlen < 1)
  			goto e_inval;
--		if (val != -1 && (val < 1 || val > 255))
-+		if (val != -1 && (val < 0 || val > 255))
+-		if (val != -1 && (val < 0 || val > 255))
++		if (val != -1 && (val < 1 || val > 255))
  			goto e_inval;
  		inet->uc_ttl = val;
  		break;
-@@ -1040,15 +1032,12 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
+@@ -1032,12 +1040,15 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
  	case IP_OPTIONS:
  	{
  		unsigned char optbuf[sizeof(struct ip_options)+40];
--		struct ip_options *opt = (struct ip_options *)optbuf;
--		struct ip_options_rcu *inet_opt;
--
--		inet_opt = inet->inet_opt;
-+		struct ip_options * opt = (struct ip_options *)optbuf;
+-		struct ip_options * opt = (struct ip_options *)optbuf;
++		struct ip_options *opt = (struct ip_options *)optbuf;
++		struct ip_options_rcu *inet_opt;
++
++		inet_opt = inet->inet_opt;
  		opt->optlen = 0;
--		if (inet_opt)
--			memcpy(optbuf, &inet_opt->opt,
--			       sizeof(struct ip_options) +
--			       inet_opt->opt.optlen);
-+		if (inet->opt)
-+			memcpy(optbuf, inet->opt,
-+			       sizeof(struct ip_options)+
-+			       inet->opt->optlen);
+-		if (inet->opt)
+-			memcpy(optbuf, inet->opt,
+-			       sizeof(struct ip_options)+
+-			       inet->opt->optlen);
++		if (inet_opt)
++			memcpy(optbuf, &inet_opt->opt,
++			       sizeof(struct ip_options) +
++			       inet_opt->opt.optlen);
  		release_sock(sk);
  
  		if (opt->optlen == 0)
 diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-index c6437d5..1032a15 100644
+index 1032a15..c6437d5 100644
 --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
 +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
-@@ -83,14 +83,6 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
+@@ -83,6 +83,14 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
  	*dataoff = nhoff + (iph->ihl << 2);
  	*protonum = iph->protocol;
  
--	/* Check bogus IP headers */
--	if (*dataoff > skb->len) {
--		pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
--			 "nhoff %u, ihl %u, skblen %u\n",
--			 nhoff, iph->ihl << 2, skb->len);
--		return -NF_ACCEPT;
--	}
--
++	/* Check bogus IP headers */
++	if (*dataoff > skb->len) {
++		pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
++			 "nhoff %u, ihl %u, skblen %u\n",
++			 nhoff, iph->ihl << 2, skb->len);
++		return -NF_ACCEPT;
++	}
++
  	return NF_ACCEPT;
  }
  
 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index 07ab583..ab996f9 100644
+index ab996f9..07ab583 100644
 --- a/net/ipv4/raw.c
 +++ b/net/ipv4/raw.c
-@@ -459,7 +459,6 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -459,6 +459,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  	__be32 saddr;
  	u8  tos;
  	int err;
--	struct ip_options_data opt_copy;
++	struct ip_options_data opt_copy;
  
  	err = -EMSGSIZE;
  	if (len > 0xFFFF)
-@@ -520,18 +519,8 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -519,8 +520,18 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  	saddr = ipc.addr;
  	ipc.addr = daddr;
  
--	if (!ipc.opt) {
--		struct ip_options_rcu *inet_opt;
--
--		rcu_read_lock();
--		inet_opt = rcu_dereference(inet->inet_opt);
--		if (inet_opt) {
--			memcpy(&opt_copy, inet_opt,
--			       sizeof(*inet_opt) + inet_opt->opt.optlen);
--			ipc.opt = &opt_copy.opt;
--		}
--		rcu_read_unlock();
--	}
-+	if (!ipc.opt)
-+		ipc.opt = inet->opt;
+-	if (!ipc.opt)
+-		ipc.opt = inet->opt;
++	if (!ipc.opt) {
++		struct ip_options_rcu *inet_opt;
++
++		rcu_read_lock();
++		inet_opt = rcu_dereference(inet->inet_opt);
++		if (inet_opt) {
++			memcpy(&opt_copy, inet_opt,
++			       sizeof(*inet_opt) + inet_opt->opt.optlen);
++			ipc.opt = &opt_copy.opt;
++		}
++		rcu_read_unlock();
++	}
  
  	if (ipc.opt) {
  		err = -EINVAL;
-@@ -540,10 +529,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -529,10 +540,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  		 */
  		if (inet->hdrincl)
  			goto done;
--		if (ipc.opt->opt.srr) {
-+		if (ipc.opt->srr) {
+-		if (ipc.opt->srr) {
++		if (ipc.opt->opt.srr) {
  			if (!daddr)
  				goto done;
--			daddr = ipc.opt->opt.faddr;
-+			daddr = ipc.opt->faddr;
+-			daddr = ipc.opt->faddr;
++			daddr = ipc.opt->opt.faddr;
  		}
  	}
  	tos = RT_CONN_FLAGS(sk);
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index f16d19b..58f141b 100644
+index 58f141b..f16d19b 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -1412,7 +1412,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
  					dev_hold(rt->u.dst.dev);
  				if (rt->idev)
  					in_dev_hold(rt->idev);
--				rt->u.dst.obsolete	= -1;
-+				rt->u.dst.obsolete	= 0;
+-				rt->u.dst.obsolete	= 0;
++				rt->u.dst.obsolete	= -1;
  				rt->u.dst.lastuse	= jiffies;
  				rt->u.dst.path		= &rt->u.dst;
  				rt->u.dst.neighbour	= NULL;
@@ -5357,817 +5344,817 @@ index f16d19b..58f141b 100644
  	struct dst_entry *ret = dst;
  
  	if (rt) {
--		if (dst->obsolete > 0) {
-+		if (dst->obsolete) {
+-		if (dst->obsolete) {
++		if (dst->obsolete > 0) {
  			ip_rt_put(rt);
  			ret = NULL;
  		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-@@ -1700,9 +1700,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
+@@ -1700,7 +1700,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
  
  static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
  {
--	if (rt_is_expired((struct rtable *)dst))
--		return NULL;
--	return dst;
-+	return NULL;
+-	return NULL;
++	if (rt_is_expired((struct rtable *)dst))
++		return NULL;
++	return dst;
  }
  
  static void ipv4_dst_destroy(struct dst_entry *dst)
-@@ -1864,8 +1862,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+@@ -1862,7 +1864,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
  	if (!rth)
  		goto e_nobufs;
  
--	rth->u.dst.output = ip_rt_bug;
--	rth->u.dst.obsolete = -1;
-+	rth->u.dst.output= ip_rt_bug;
+-	rth->u.dst.output= ip_rt_bug;
++	rth->u.dst.output = ip_rt_bug;
++	rth->u.dst.obsolete = -1;
  
  	atomic_set(&rth->u.dst.__refcnt, 1);
  	rth->u.dst.flags= DST_HOST;
-@@ -2026,7 +2023,6 @@ static int __mkroute_input(struct sk_buff *skb,
+@@ -2023,6 +2026,7 @@ static int __mkroute_input(struct sk_buff *skb,
  	rth->fl.oif 	= 0;
  	rth->rt_spec_dst= spec_dst;
  
--	rth->u.dst.obsolete = -1;
++	rth->u.dst.obsolete = -1;
  	rth->u.dst.input = ip_forward;
  	rth->u.dst.output = ip_output;
  	rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
-@@ -2191,7 +2187,6 @@ local_input:
+@@ -2187,6 +2191,7 @@ local_input:
  		goto e_nobufs;
  
  	rth->u.dst.output= ip_rt_bug;
--	rth->u.dst.obsolete = -1;
++	rth->u.dst.obsolete = -1;
  	rth->rt_genid = rt_genid(net);
  
  	atomic_set(&rth->u.dst.__refcnt, 1);
-@@ -2416,8 +2411,7 @@ static int __mkroute_output(struct rtable **result,
+@@ -2411,7 +2416,8 @@ static int __mkroute_output(struct rtable **result,
  	rth->rt_gateway = fl->fl4_dst;
  	rth->rt_spec_dst= fl->fl4_src;
  
--	rth->u.dst.output = ip_output;
--	rth->u.dst.obsolete = -1;
-+	rth->u.dst.output=ip_output;
+-	rth->u.dst.output=ip_output;
++	rth->u.dst.output = ip_output;
++	rth->u.dst.obsolete = -1;
  	rth->rt_genid = rt_genid(dev_net(dev_out));
  
  	RT_CACHE_STAT_INC(out_slow_tot);
-@@ -2747,7 +2741,6 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
+@@ -2741,6 +2747,7 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
  	if (rt) {
  		struct dst_entry *new = &rt->u.dst;
  
--		new->obsolete = -1;
++		new->obsolete = -1;
  		atomic_set(&new->__refcnt, 1);
  		new->__use = 1;
  		new->input = dst_discard;
 diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
-index 0a94b64..a6e0e07 100644
+index a6e0e07..0a94b64 100644
 --- a/net/ipv4/syncookies.c
 +++ b/net/ipv4/syncookies.c
 @@ -309,10 +309,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
  	 * the ACK carries the same options again (see RFC1122 4.2.3.8)
  	 */
  	if (opt && opt->optlen) {
--		int opt_size = sizeof(struct ip_options_rcu) + opt->optlen;
-+		int opt_size = sizeof(struct ip_options) + opt->optlen;
+-		int opt_size = sizeof(struct ip_options) + opt->optlen;
++		int opt_size = sizeof(struct ip_options_rcu) + opt->optlen;
  
  		ireq->opt = kmalloc(opt_size, GFP_ATOMIC);
--		if (ireq->opt != NULL && ip_options_echo(&ireq->opt->opt, skb)) {
-+		if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
+-		if (ireq->opt != NULL && ip_options_echo(ireq->opt, skb)) {
++		if (ireq->opt != NULL && ip_options_echo(&ireq->opt->opt, skb)) {
  			kfree(ireq->opt);
  			ireq->opt = NULL;
  		}
 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 6232462..b9644d8 100644
+index b9644d8..6232462 100644
 --- a/net/ipv4/tcp.c
 +++ b/net/ipv4/tcp.c
 @@ -847,7 +847,7 @@ wait_for_memory:
  	}
  
  out:
--	if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
-+	if (copied)
+-	if (copied)
++	if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
  		tcp_push(sk, flags, mss_now, tp->nonagle);
  	return copied;
  
 diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
-index c35d91f..1eba160 100644
+index 1eba160..c35d91f 100644
 --- a/net/ipv4/tcp_illinois.c
 +++ b/net/ipv4/tcp_illinois.c
-@@ -313,13 +313,11 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
+@@ -313,11 +313,13 @@ static void tcp_illinois_info(struct sock *sk, u32 ext,
  			.tcpv_rttcnt = ca->cnt_rtt,
  			.tcpv_minrtt = ca->base_rtt,
  		};
-+		u64 t = ca->sum_rtt;
+-		u64 t = ca->sum_rtt;
  
--		if (info.tcpv_rttcnt > 0) {
--			u64 t = ca->sum_rtt;
-+		do_div(t, ca->cnt_rtt);
-+		info.tcpv_rtt = t;
+-		do_div(t, ca->cnt_rtt);
+-		info.tcpv_rtt = t;
++		if (info.tcpv_rttcnt > 0) {
++			u64 t = ca->sum_rtt;
  
--			do_div(t, info.tcpv_rttcnt);
--			info.tcpv_rtt = t;
--		}
++			do_div(t, info.tcpv_rttcnt);
++			info.tcpv_rtt = t;
++		}
  		nla_put(skb, INET_DIAG_VEGASINFO, sizeof(info), &info);
  	}
  }
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index d746d3b3..6a4e832 100644
+index 6a4e832..d746d3b3 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
-@@ -152,7 +152,6 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -152,6 +152,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  	__be32 daddr, nexthop;
  	int tmp;
  	int err;
--	struct ip_options_rcu *inet_opt;
++	struct ip_options_rcu *inet_opt;
  
  	if (addr_len < sizeof(struct sockaddr_in))
  		return -EINVAL;
-@@ -161,11 +160,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -160,10 +161,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  		return -EAFNOSUPPORT;
  
  	nexthop = daddr = usin->sin_addr.s_addr;
--	inet_opt = inet->inet_opt;
--	if (inet_opt && inet_opt->opt.srr) {
-+	if (inet->opt && inet->opt->srr) {
+-	if (inet->opt && inet->opt->srr) {
++	inet_opt = inet->inet_opt;
++	if (inet_opt && inet_opt->opt.srr) {
  		if (!daddr)
  			return -EINVAL;
--		nexthop = inet_opt->opt.faddr;
-+		nexthop = inet->opt->faddr;
+-		nexthop = inet->opt->faddr;
++		nexthop = inet_opt->opt.faddr;
  	}
  
  	tmp = ip_route_connect(&rt, nexthop, inet->saddr,
-@@ -183,7 +181,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -181,7 +183,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  		return -ENETUNREACH;
  	}
  
--	if (!inet_opt || !inet_opt->opt.srr)
-+	if (!inet->opt || !inet->opt->srr)
+-	if (!inet->opt || !inet->opt->srr)
++	if (!inet_opt || !inet_opt->opt.srr)
  		daddr = rt->rt_dst;
  
  	if (!inet->saddr)
-@@ -217,8 +215,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
+@@ -215,8 +217,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
  	inet->daddr = daddr;
  
  	inet_csk(sk)->icsk_ext_hdr_len = 0;
--	if (inet_opt)
--		inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-+	if (inet->opt)
-+		inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
+-	if (inet->opt)
+-		inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
++	if (inet_opt)
++		inet_csk(sk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
  
  	tp->rx_opt.mss_clamp = 536;
  
-@@ -804,18 +802,17 @@ static void syn_flood_warning(struct sk_buff *skb)
+@@ -802,17 +804,18 @@ static void syn_flood_warning(struct sk_buff *skb)
  /*
   * Save and compile IPv4 options into the request_sock if needed.
   */
--static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
--						  struct sk_buff *skb)
-+static struct ip_options *tcp_v4_save_options(struct sock *sk,
-+					      struct sk_buff *skb)
+-static struct ip_options *tcp_v4_save_options(struct sock *sk,
+-					      struct sk_buff *skb)
++static struct ip_options_rcu *tcp_v4_save_options(struct sock *sk,
++						  struct sk_buff *skb)
  {
--	const struct ip_options *opt = &(IPCB(skb)->opt);
--	struct ip_options_rcu *dopt = NULL;
-+	struct ip_options *opt = &(IPCB(skb)->opt);
-+	struct ip_options *dopt = NULL;
+-	struct ip_options *opt = &(IPCB(skb)->opt);
+-	struct ip_options *dopt = NULL;
++	const struct ip_options *opt = &(IPCB(skb)->opt);
++	struct ip_options_rcu *dopt = NULL;
  
  	if (opt && opt->optlen) {
--		int opt_size = sizeof(*dopt) + opt->optlen;
--
-+		int opt_size = optlength(opt);
+-		int opt_size = optlength(opt);
++		int opt_size = sizeof(*dopt) + opt->optlen;
++
  		dopt = kmalloc(opt_size, GFP_ATOMIC);
  		if (dopt) {
--			if (ip_options_echo(&dopt->opt, skb)) {
-+			if (ip_options_echo(dopt, skb)) {
+-			if (ip_options_echo(dopt, skb)) {
++			if (ip_options_echo(&dopt->opt, skb)) {
  				kfree(dopt);
  				dopt = NULL;
  			}
-@@ -1365,7 +1362,6 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+@@ -1362,6 +1365,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
  #ifdef CONFIG_TCP_MD5SIG
  	struct tcp_md5sig_key *key;
  #endif
--	struct ip_options_rcu *inet_opt;
++	struct ip_options_rcu *inet_opt;
  
  	if (sk_acceptq_is_full(sk))
  		goto exit_overflow;
-@@ -1386,14 +1382,13 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
+@@ -1382,13 +1386,14 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
  	newinet->daddr	      = ireq->rmt_addr;
  	newinet->rcv_saddr    = ireq->loc_addr;
  	newinet->saddr	      = ireq->loc_addr;
--	inet_opt	      = ireq->opt;
--	rcu_assign_pointer(newinet->inet_opt, inet_opt);
-+	newinet->opt	      = ireq->opt;
+-	newinet->opt	      = ireq->opt;
++	inet_opt	      = ireq->opt;
++	rcu_assign_pointer(newinet->inet_opt, inet_opt);
  	ireq->opt	      = NULL;
  	newinet->mc_index     = inet_iif(skb);
  	newinet->mc_ttl	      = ip_hdr(skb)->ttl;
  	inet_csk(newsk)->icsk_ext_hdr_len = 0;
--	if (inet_opt)
--		inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
-+	if (newinet->opt)
-+		inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
+-	if (newinet->opt)
+-		inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
++	if (inet_opt)
++		inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
  	newinet->id = newtp->write_seq ^ jiffies;
  
  	tcp_mtup_init(newsk);
 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 38a23e4..af83bdf 100644
+index af83bdf..38a23e4 100644
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -1391,11 +1391,8 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
+@@ -1391,8 +1391,11 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
  			goto send_now;
  	}
  
--	/* Ok, it looks like it is advisable to defer.
--	 * Do not rearm the timer if already set to not break TCP ACK clocking.
--	 */
--	if (!tp->tso_deferred)
--		tp->tso_deferred = 1 | (jiffies << 1);
-+	/* Ok, it looks like it is advisable to defer.  */
-+	tp->tso_deferred = 1 | (jiffies << 1);
+-	/* Ok, it looks like it is advisable to defer.  */
+-	tp->tso_deferred = 1 | (jiffies << 1);
++	/* Ok, it looks like it is advisable to defer.
++	 * Do not rearm the timer if already set to not break TCP ACK clocking.
++	 */
++	if (!tp->tso_deferred)
++		tp->tso_deferred = 1 | (jiffies << 1);
  
  	return 1;
  
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index af559e0..8e28770 100644
+index 8e28770..af559e0 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
-@@ -592,7 +592,6 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -592,6 +592,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  	int err, is_udplite = IS_UDPLITE(sk);
  	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
  	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
--	struct ip_options_data opt_copy;
++	struct ip_options_data opt_copy;
  
  	if (len > 0xFFFF)
  		return -EMSGSIZE;
-@@ -664,32 +663,22 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+@@ -663,22 +664,32 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
  			free = 1;
  		connected = 0;
  	}
--	if (!ipc.opt) {
--		struct ip_options_rcu *inet_opt;
--
--		rcu_read_lock();
--		inet_opt = rcu_dereference(inet->inet_opt);
--		if (inet_opt) {
--			memcpy(&opt_copy, inet_opt,
--			       sizeof(*inet_opt) + inet_opt->opt.optlen);
--			ipc.opt = &opt_copy.opt;
--		}
--		rcu_read_unlock();
--	}
-+	if (!ipc.opt)
-+		ipc.opt = inet->opt;
+-	if (!ipc.opt)
+-		ipc.opt = inet->opt;
++	if (!ipc.opt) {
++		struct ip_options_rcu *inet_opt;
++
++		rcu_read_lock();
++		inet_opt = rcu_dereference(inet->inet_opt);
++		if (inet_opt) {
++			memcpy(&opt_copy, inet_opt,
++			       sizeof(*inet_opt) + inet_opt->opt.optlen);
++			ipc.opt = &opt_copy.opt;
++		}
++		rcu_read_unlock();
++	}
  
  	saddr = ipc.addr;
  	ipc.addr = faddr = daddr;
  
--	if (ipc.opt && ipc.opt->opt.srr) {
-+	if (ipc.opt && ipc.opt->srr) {
+-	if (ipc.opt && ipc.opt->srr) {
++	if (ipc.opt && ipc.opt->opt.srr) {
  		if (!daddr)
  			return -EINVAL;
--		faddr = ipc.opt->opt.faddr;
-+		faddr = ipc.opt->faddr;
+-		faddr = ipc.opt->faddr;
++		faddr = ipc.opt->opt.faddr;
  		connected = 0;
  	}
  	tos = RT_TOS(inet->tos);
  	if (sock_flag(sk, SOCK_LOCALROUTE) ||
  	    (msg->msg_flags & MSG_DONTROUTE) ||
--	    (ipc.opt && ipc.opt->opt.is_strictroute)) {
-+	    (ipc.opt && ipc.opt->is_strictroute)) {
+-	    (ipc.opt && ipc.opt->is_strictroute)) {
++	    (ipc.opt && ipc.opt->opt.is_strictroute)) {
  		tos |= RTO_ONLINK;
  		connected = 0;
  	}
 diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
-index 835590d..e127a32 100644
+index e127a32..835590d 100644
 --- a/net/ipv6/af_inet6.c
 +++ b/net/ipv6/af_inet6.c
-@@ -1073,8 +1073,6 @@ static int __init inet6_init(void)
+@@ -1073,6 +1073,8 @@ static int __init inet6_init(void)
  		goto out;
  	}
  
--	initialize_hashidentrnd();
--
++	initialize_hashidentrnd();
++
  	err = proto_register(&tcpv6_prot, 1);
  	if (err)
  		goto out;
 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 6ba0fe2..9ad5792 100644
+index 9ad5792..6ba0fe2 100644
 --- a/net/ipv6/ip6_output.c
 +++ b/net/ipv6/ip6_output.c
-@@ -604,35 +604,6 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+@@ -604,6 +604,35 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
  	return offset;
  }
  
--static u32 hashidentrnd __read_mostly;
--#define FID_HASH_SZ 16
--static u32 ipv6_fragmentation_id[FID_HASH_SZ];
--
--void __init initialize_hashidentrnd(void)
--{
--	get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
--}
--
--static u32 __ipv6_select_ident(const struct in6_addr *addr)
--{
--	u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
--	u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
--
--	do {
--		oldid = *pid;
--		newid = oldid + 1;
--		if (!(hash + newid))
--			newid++;
--	} while (cmpxchg(pid, oldid, newid) != oldid);
--
--	return hash + newid;
--}
--
--void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
--{
--	fhdr->identification = htonl(__ipv6_select_ident(&rt->rt6i_dst.addr));
--}
--
++static u32 hashidentrnd __read_mostly;
++#define FID_HASH_SZ 16
++static u32 ipv6_fragmentation_id[FID_HASH_SZ];
++
++void __init initialize_hashidentrnd(void)
++{
++	get_random_bytes(&hashidentrnd, sizeof(hashidentrnd));
++}
++
++static u32 __ipv6_select_ident(const struct in6_addr *addr)
++{
++	u32 newid, oldid, hash = jhash2((u32 *)addr, 4, hashidentrnd);
++	u32 *pid = &ipv6_fragmentation_id[hash % FID_HASH_SZ];
++
++	do {
++		oldid = *pid;
++		newid = oldid + 1;
++		if (!(hash + newid))
++			newid++;
++	} while (cmpxchg(pid, oldid, newid) != oldid);
++
++	return hash + newid;
++}
++
++void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
++{
++	fhdr->identification = htonl(__ipv6_select_ident(&rt->rt6i_dst.addr));
++}
++
  static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
  {
  	struct sk_buff *frag;
-@@ -718,7 +689,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+@@ -689,7 +718,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
  		skb_reset_network_header(skb);
  		memcpy(skb_network_header(skb), tmp_hdr, hlen);
  
--		ipv6_select_ident(fh, rt);
-+		ipv6_select_ident(fh);
+-		ipv6_select_ident(fh);
++		ipv6_select_ident(fh, rt);
  		fh->nexthdr = nexthdr;
  		fh->reserved = 0;
  		fh->frag_off = htons(IP6_MF);
-@@ -864,7 +835,7 @@ slow_path:
+@@ -835,7 +864,7 @@ slow_path:
  		fh->nexthdr = nexthdr;
  		fh->reserved = 0;
  		if (!frag_id) {
--			ipv6_select_ident(fh, rt);
-+			ipv6_select_ident(fh);
+-			ipv6_select_ident(fh);
++			ipv6_select_ident(fh, rt);
  			frag_id = fh->identification;
  		} else
  			fh->identification = frag_id;
-@@ -1068,8 +1039,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+@@ -1039,7 +1068,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
  			int getfrag(void *from, char *to, int offset, int len,
  			int odd, struct sk_buff *skb),
  			void *from, int length, int hh_len, int fragheaderlen,
--			int transhdrlen, int mtu,unsigned int flags,
--			struct rt6_info *rt)
-+			int transhdrlen, int mtu,unsigned int flags)
+-			int transhdrlen, int mtu,unsigned int flags)
++			int transhdrlen, int mtu,unsigned int flags,
++			struct rt6_info *rt)
  
  {
  	struct sk_buff *skb;
-@@ -1114,7 +1084,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+@@ -1084,7 +1114,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
  		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
  					     sizeof(struct frag_hdr)) & ~7;
  		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
--		ipv6_select_ident(&fhdr, rt);
-+		ipv6_select_ident(&fhdr);
+-		ipv6_select_ident(&fhdr);
++		ipv6_select_ident(&fhdr, rt);
  		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
  		__skb_queue_tail(&sk->sk_write_queue, skb);
  
-@@ -1263,7 +1233,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+@@ -1233,7 +1263,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
  
  		err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
  					  fragheaderlen, transhdrlen, mtu,
--					  flags, rt);
-+					  flags);
+-					  flags);
++					  flags, rt);
  		if (err)
  			goto error;
  		return 0;
 diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
-index 105de22..4d18699 100644
+index 4d18699..105de22 100644
 --- a/net/ipv6/reassembly.c
 +++ b/net/ipv6/reassembly.c
-@@ -148,6 +148,16 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
+@@ -148,16 +148,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
  }
  EXPORT_SYMBOL(ip6_frag_match);
  
-+/* Memory Tracking Functions. */
-+static inline void frag_kfree_skb(struct netns_frags *nf,
-+		struct sk_buff *skb, int *work)
-+{
-+	if (work)
-+		*work -= skb->truesize;
-+	atomic_sub(skb->truesize, &nf->mem);
-+	kfree_skb(skb);
-+}
-+
+-/* Memory Tracking Functions. */
+-static inline void frag_kfree_skb(struct netns_frags *nf,
+-		struct sk_buff *skb, int *work)
+-{
+-	if (work)
+-		*work -= skb->truesize;
+-	atomic_sub(skb->truesize, &nf->mem);
+-	kfree_skb(skb);
+-}
+-
  void ip6_frag_init(struct inet_frag_queue *q, void *a)
  {
  	struct frag_queue *fq = container_of(q, struct frag_queue, q);
-@@ -338,22 +348,58 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+@@ -348,58 +338,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
  		prev = next;
  	}
  
--	/* RFC5722, Section 4:
--	 *                                  When reassembling an IPv6 datagram, if
--	 *   one or more its constituent fragments is determined to be an
--	 *   overlapping fragment, the entire datagram (and any constituent
--	 *   fragments, including those not yet received) MUST be silently
--	 *   discarded.
-+	/* We found where to put this one.  Check for overlap with
-+	 * preceding fragment, and, if needed, align things so that
-+	 * any overlaps are eliminated.
+-	/* We found where to put this one.  Check for overlap with
+-	 * preceding fragment, and, if needed, align things so that
+-	 * any overlaps are eliminated.
++	/* RFC5722, Section 4:
++	 *                                  When reassembling an IPv6 datagram, if
++	 *   one or more its constituent fragments is determined to be an
++	 *   overlapping fragment, the entire datagram (and any constituent
++	 *   fragments, including those not yet received) MUST be silently
++	 *   discarded.
  	 */
-+	if (prev) {
-+		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
- 
--	/* Check for overlap with preceding fragment. */
--	if (prev &&
--	    (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
--		goto discard_fq;
-+		if (i > 0) {
-+			offset += i;
-+			if (end <= offset)
-+				goto err;
-+			if (!pskb_pull(skb, i))
-+				goto err;
-+			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-+				skb->ip_summed = CHECKSUM_NONE;
-+		}
-+	}
+-	if (prev) {
+-		int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
+ 
+-		if (i > 0) {
+-			offset += i;
+-			if (end <= offset)
+-				goto err;
+-			if (!pskb_pull(skb, i))
+-				goto err;
+-			if (skb->ip_summed != CHECKSUM_UNNECESSARY)
+-				skb->ip_summed = CHECKSUM_NONE;
+-		}
+-	}
++	/* Check for overlap with preceding fragment. */
++	if (prev &&
++	    (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
++		goto discard_fq;
  
--	/* Look for overlap with succeeding segment. */
--	if (next && FRAG6_CB(next)->offset < end)
--		goto discard_fq;
-+	/* Look for overlap with succeeding segments.
-+	 * If we can merge fragments, do it.
-+	 */
-+	while (next && FRAG6_CB(next)->offset < end) {
-+		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
-+
-+		if (i < next->len) {
-+			/* Eat head of the next overlapped fragment
-+			 * and leave the loop. The next ones cannot overlap.
-+			 */
-+			if (!pskb_pull(next, i))
-+				goto err;
-+			FRAG6_CB(next)->offset += i;	/* next fragment */
-+			fq->q.meat -= i;
-+			if (next->ip_summed != CHECKSUM_UNNECESSARY)
-+				next->ip_summed = CHECKSUM_NONE;
-+			break;
-+		} else {
-+			struct sk_buff *free_it = next;
-+
-+			/* Old fragment is completely overridden with
-+			 * new one drop it.
-+			 */
-+			next = next->next;
-+
-+			if (prev)
-+				prev->next = next;
-+			else
-+				fq->q.fragments = next;
-+
-+			fq->q.meat -= free_it->len;
-+			frag_kfree_skb(fq->q.net, free_it, NULL);
-+		}
-+	}
+-	/* Look for overlap with succeeding segments.
+-	 * If we can merge fragments, do it.
+-	 */
+-	while (next && FRAG6_CB(next)->offset < end) {
+-		int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
+-
+-		if (i < next->len) {
+-			/* Eat head of the next overlapped fragment
+-			 * and leave the loop. The next ones cannot overlap.
+-			 */
+-			if (!pskb_pull(next, i))
+-				goto err;
+-			FRAG6_CB(next)->offset += i;	/* next fragment */
+-			fq->q.meat -= i;
+-			if (next->ip_summed != CHECKSUM_UNNECESSARY)
+-				next->ip_summed = CHECKSUM_NONE;
+-			break;
+-		} else {
+-			struct sk_buff *free_it = next;
+-
+-			/* Old fragment is completely overridden with
+-			 * new one drop it.
+-			 */
+-			next = next->next;
+-
+-			if (prev)
+-				prev->next = next;
+-			else
+-				fq->q.fragments = next;
+-
+-			fq->q.meat -= free_it->len;
+-			frag_kfree_skb(fq->q.net, free_it, NULL);
+-		}
+-	}
++	/* Look for overlap with succeeding segment. */
++	if (next && FRAG6_CB(next)->offset < end)
++		goto discard_fq;
  
  	FRAG6_CB(skb)->offset = offset;
  
-@@ -390,8 +436,6 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
+@@ -436,6 +390,8 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
  	write_unlock(&ip6_frags.lock);
  	return -1;
  
--discard_fq:
--	fq_kill(fq);
++discard_fq:
++	fq_kill(fq);
  err:
  	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
  		      IPSTATS_MIB_REASMFAILS);
 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 1b25191..faae6df 100644
+index faae6df..1b25191 100644
 --- a/net/ipv6/tcp_ipv6.c
 +++ b/net/ipv6/tcp_ipv6.c
 @@ -1391,7 +1391,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
  
  	   First: no IPv4 options.
  	 */
--	newinet->inet_opt = NULL;
-+	newinet->opt = NULL;
+-	newinet->opt = NULL;
++	newinet->inet_opt = NULL;
  	newnp->ipv6_fl_list = NULL;
  
  	/* Clone RX bits */
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d8c0374..9cc6289 100644
+index 9cc6289..d8c0374 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -1162,7 +1162,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
  	fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
  	fptr->nexthdr = nexthdr;
  	fptr->reserved = 0;
--	ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-+	ipv6_select_ident(fptr);
+-	ipv6_select_ident(fptr);
++	ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
  
  	/* Fragment the skb. ipv6 header and the remaining fields of the
  	 * fragment header are updated in ipv6_gso_segment()
 diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index bfb325d..476b24e 100644
+index 476b24e..bfb325d 100644
 --- a/net/irda/af_irda.c
 +++ b/net/irda/af_irda.c
-@@ -1338,8 +1338,6 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
+@@ -1338,6 +1338,8 @@ static int irda_recvmsg_dgram(struct kiocb *iocb, struct socket *sock,
  	if ((err = sock_error(sk)) < 0)
  		return err;
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
  				flags & MSG_DONTWAIT, &err);
  	if (!skb)
 diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
-index f605b23..bada1b9 100644
+index bada1b9..f605b23 100644
 --- a/net/iucv/af_iucv.c
 +++ b/net/iucv/af_iucv.c
-@@ -1160,8 +1160,6 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1160,6 +1160,8 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
  	struct sk_buff *skb, *rskb, *cskb;
  	int err = 0;
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	if ((sk->sk_state == IUCV_DISCONN || sk->sk_state == IUCV_SEVERED) &&
  	    skb_queue_empty(&iucv->backlog_skb_q) &&
  	    skb_queue_empty(&sk->sk_receive_queue) &&
 diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
-index 8a814a5..2da8d14 100644
+index 2da8d14..8a814a5 100644
 --- a/net/llc/af_llc.c
 +++ b/net/llc/af_llc.c
-@@ -674,8 +674,6 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -674,6 +674,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
  	int target;	/* Read at least this many bytes */
  	long timeo;
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	lock_sock(sk);
  	copied = -ENOTCONN;
  	if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
-@@ -914,13 +912,14 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
+@@ -912,14 +914,13 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
  	struct sockaddr_llc sllc;
  	struct sock *sk = sock->sk;
  	struct llc_sock *llc = llc_sk(sk);
--	int rc = -EBADF;
-+	int rc = 0;
+-	int rc = 0;
++	int rc = -EBADF;
  
  	memset(&sllc, 0, sizeof(sllc));
  	lock_sock(sk);
  	if (sock_flag(sk, SOCK_ZAPPED))
  		goto out;
  	*uaddrlen = sizeof(sllc);
-+	memset(uaddr, 0, *uaddrlen);
+-	memset(uaddr, 0, *uaddrlen);
  	if (peer) {
  		rc = -ENOTCONN;
  		if (sk->sk_state != TCP_ESTABLISHED)
 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 9bcd972..02b2610 100644
+index 02b2610..9bcd972 100644
 --- a/net/netfilter/ipvs/ip_vs_ctl.c
 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -2455,7 +2455,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+@@ -2455,6 +2455,7 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
  	{
  		struct ip_vs_timeout_user t;
  
--		memset(&t, 0, sizeof(t));
++		memset(&t, 0, sizeof(t));
  		__ip_vs_get_timeouts(&t);
  		if (copy_to_user(user, &t, sizeof(t)) != 0)
  			ret = -EFAULT;
 diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index 5be9140..30b3189 100644
+index 30b3189..5be9140 100644
 --- a/net/netfilter/ipvs/ip_vs_xmit.c
 +++ b/net/netfilter/ipvs/ip_vs_xmit.c
-@@ -64,15 +64,6 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos, u32 cookie)
+@@ -64,6 +64,15 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos, u32 cookie)
  	return dst;
  }
  
--static inline bool
--__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)
--{
--	if (skb->len > mtu && !skb_is_gso(skb)) {
--		return true; /* Packet size violate MTU size */
--	}
--	return false;
--}
--
++static inline bool
++__mtu_check_toobig_v6(const struct sk_buff *skb, u32 mtu)
++{
++	if (skb->len > mtu && !skb_is_gso(skb)) {
++		return true; /* Packet size violate MTU size */
++	}
++	return false;
++}
++
  static struct rtable *
  __ip_vs_get_out_rt(struct ip_vs_conn *cp, u32 rtos)
  {
-@@ -254,8 +245,7 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -245,7 +254,8 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
--	    !skb_is_gso(skb)) {
-+	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
+-	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
++	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) &&
++	    !skb_is_gso(skb)) {
  		ip_rt_put(rt);
  		icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -319,7 +309,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -309,7 +319,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if (__mtu_check_toobig_v6(skb, mtu)) {
-+	if (skb->len > mtu) {
+-	if (skb->len > mtu) {
++	if (__mtu_check_toobig_v6(skb, mtu)) {
  		dst_release(&rt->u.dst);
  		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -386,7 +376,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -376,7 +386,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
-+	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
+-	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF))) {
++	if ((skb->len > mtu) && (iph->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
  		ip_rt_put(rt);
  		icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
  		IP_VS_DBG_RL_PKT(0, pp, skb, 0, "ip_vs_nat_xmit(): frag needed for");
-@@ -462,7 +452,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -452,7 +462,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if (__mtu_check_toobig_v6(skb, mtu)) {
-+	if (skb->len > mtu) {
+-	if (skb->len > mtu) {
++	if (__mtu_check_toobig_v6(skb, mtu)) {
  		dst_release(&rt->u.dst);
  		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  		IP_VS_DBG_RL_PKT(0, pp, skb, 0,
-@@ -571,8 +561,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -561,8 +571,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	df |= (old_iph->frag_off & htons(IP_DF));
  
--	if ((old_iph->frag_off & htons(IP_DF) &&
--	    mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb))) {
-+	if ((old_iph->frag_off & htons(IP_DF))
-+	    && mtu < ntohs(old_iph->tot_len)) {
+-	if ((old_iph->frag_off & htons(IP_DF))
+-	    && mtu < ntohs(old_iph->tot_len)) {
++	if ((old_iph->frag_off & htons(IP_DF) &&
++	    mtu < ntohs(old_iph->tot_len) && !skb_is_gso(skb))) {
  		icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
  		ip_rt_put(rt);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -681,8 +671,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -671,7 +681,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
  	if (skb_dst(skb))
  		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
  
--	/* MTU checking: Notice that 'mtu' have been adjusted before hand */
--	if (__mtu_check_toobig_v6(skb, mtu)) {
-+	if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
+-	if (mtu < ntohs(old_iph->payload_len) + sizeof(struct ipv6hdr)) {
++	/* MTU checking: Notice that 'mtu' have been adjusted before hand */
++	if (__mtu_check_toobig_v6(skb, mtu)) {
  		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  		dst_release(&rt->u.dst);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -771,7 +760,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -760,7 +771,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu && !skb_is_gso(skb)) {
-+	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu) {
+-	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu) {
++	if ((iph->frag_off & htons(IP_DF)) && skb->len > mtu && !skb_is_gso(skb)) {
  		icmp_send(skb, ICMP_DEST_UNREACH,ICMP_FRAG_NEEDED, htonl(mtu));
  		ip_rt_put(rt);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -824,7 +813,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -813,7 +824,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if (__mtu_check_toobig_v6(skb, mtu)) {
-+	if (skb->len > mtu) {
+-	if (skb->len > mtu) {
++	if (__mtu_check_toobig_v6(skb, mtu)) {
  		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  		dst_release(&rt->u.dst);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -899,7 +888,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -888,7 +899,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
-+	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF))) {
+-	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF))) {
++	if ((skb->len > mtu) && (ip_hdr(skb)->frag_off & htons(IP_DF)) && !skb_is_gso(skb)) {
  		ip_rt_put(rt);
  		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
-@@ -974,7 +963,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
+@@ -963,7 +974,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
  
  	/* MTU checking */
  	mtu = dst_mtu(&rt->u.dst);
--	if (__mtu_check_toobig_v6(skb, mtu)) {
-+	if (skb->len > mtu) {
+-	if (skb->len > mtu) {
++	if (__mtu_check_toobig_v6(skb, mtu)) {
  		dst_release(&rt->u.dst);
  		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  		IP_VS_DBG_RL("%s(): frag needed\n", __func__);
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 728c080..35cfa79 100644
+index 35cfa79..728c080 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -828,6 +828,7 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
+@@ -828,7 +828,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
  
  	if (likely(po->tx_ring.pg_vec)) {
  		ph = skb_shinfo(skb)->destructor_arg;
-+		BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
+-		BUG_ON(__packet_get_status(po, ph) != TP_STATUS_SENDING);
  		BUG_ON(atomic_read(&po->tx_ring.pending) == 0);
  		atomic_dec(&po->tx_ring.pending);
  		__packet_set_status(po, ph, TP_STATUS_AVAILABLE);
 diff --git a/net/rds/recv.c b/net/rds/recv.c
-index c45a881c..6a2654a 100644
+index 6a2654a..c45a881c 100644
 --- a/net/rds/recv.c
 +++ b/net/rds/recv.c
-@@ -410,8 +410,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+@@ -410,6 +410,8 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
  
  	rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
  
--	msg->msg_namelen = 0;
--
++	msg->msg_namelen = 0;
++
  	if (msg_flags & MSG_OOB)
  		goto out;
  
-@@ -488,7 +486,6 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+@@ -486,6 +488,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
  			sin->sin_port = inc->i_hdr.h_sport;
  			sin->sin_addr.s_addr = inc->i_saddr;
  			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
--			msg->msg_namelen = sizeof(*sin);
++			msg->msg_namelen = sizeof(*sin);
  		}
  		break;
  	}
 diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
-index 2984999..523efbb 100644
+index 523efbb..2984999 100644
 --- a/net/rose/af_rose.c
 +++ b/net/rose/af_rose.c
-@@ -1275,7 +1275,6 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1275,6 +1275,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
  	skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
  
  	if (srose != NULL) {
--		memset(srose, 0, msg->msg_namelen);
++		memset(srose, 0, msg->msg_namelen);
  		srose->srose_family = AF_ROSE;
  		srose->srose_addr   = rose->dest_addr;
  		srose->srose_call   = rose->dest_call;
 diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
-index faebd8a..f9fc6ec 100644
+index f9fc6ec..faebd8a 100644
 --- a/net/sched/act_gact.c
 +++ b/net/sched/act_gact.c
-@@ -67,9 +67,6 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
+@@ -67,6 +67,9 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
  	struct tcf_common *pc;
  	int ret = 0;
  	int err;
--#ifdef CONFIG_GACT_PROB
--	struct tc_gact_p *p_parm = NULL;
--#endif
++#ifdef CONFIG_GACT_PROB
++	struct tc_gact_p *p_parm = NULL;
++#endif
  
  	if (nla == NULL)
  		return -EINVAL;
-@@ -85,12 +82,6 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
+@@ -82,6 +85,12 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
  #ifndef CONFIG_GACT_PROB
  	if (tb[TCA_GACT_PROB] != NULL)
  		return -EOPNOTSUPP;
--#else
--	if (tb[TCA_GACT_PROB]) {
--		p_parm = nla_data(tb[TCA_GACT_PROB]);
--		if (p_parm->ptype >= MAX_RAND)
--			return -EINVAL;
--	}
++#else
++	if (tb[TCA_GACT_PROB]) {
++		p_parm = nla_data(tb[TCA_GACT_PROB]);
++		if (p_parm->ptype >= MAX_RAND)
++			return -EINVAL;
++	}
  #endif
  
  	pc = tcf_hash_check(parm->index, a, bind, &gact_hash_info);
-@@ -112,7 +103,8 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
+@@ -103,8 +112,7 @@ static int tcf_gact_init(struct nlattr *nla, struct nlattr *est,
  	spin_lock_bh(&gact->tcf_lock);
  	gact->tcf_action = parm->action;
  #ifdef CONFIG_GACT_PROB
--	if (p_parm) {
-+	if (tb[TCA_GACT_PROB] != NULL) {
-+		struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
+-	if (tb[TCA_GACT_PROB] != NULL) {
+-		struct tc_gact_p *p_parm = nla_data(tb[TCA_GACT_PROB]);
++	if (p_parm) {
  		gact->tcfg_paction = p_parm->paction;
  		gact->tcfg_pval    = p_parm->pval;
  		gact->tcfg_ptype   = p_parm->ptype;
-@@ -140,7 +132,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
+@@ -132,7 +140,7 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
  
  	spin_lock(&gact->tcf_lock);
  #ifdef CONFIG_GACT_PROB
--	if (gact->tcfg_ptype)
-+	if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
+-	if (gact->tcfg_ptype && gact_rand[gact->tcfg_ptype] != NULL)
++	if (gact->tcfg_ptype)
  		action = gact_rand[gact->tcfg_ptype](gact);
  	else
  		action = gact->tcf_action;
 diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
-index 2f074d6..85acab9 100644
+index 85acab9..2f074d6 100644
 --- a/net/sched/sch_htb.c
 +++ b/net/sched/sch_htb.c
 @@ -865,7 +865,7 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
  	q->now = psched_get_time();
  	start_at = jiffies;
  
--	next_event = q->now + 5LLU * PSCHED_TICKS_PER_SEC;
-+	next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
+-	next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
++	next_event = q->now + 5LLU * PSCHED_TICKS_PER_SEC;
  
  	for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
  		/* common case optimization - skip event handler quickly */
 diff --git a/net/sctp/auth.c b/net/sctp/auth.c
-index 7363b9f..914c419 100644
+index 914c419..7363b9f 100644
 --- a/net/sctp/auth.c
 +++ b/net/sctp/auth.c
 @@ -70,7 +70,7 @@ void sctp_auth_key_put(struct sctp_auth_bytes *key)
  		return;
  
  	if (atomic_dec_and_test(&key->refcnt)) {
--		kzfree(key);
-+		kfree(key);
+-		kfree(key);
++		kzfree(key);
  		SCTP_DBG_OBJCNT_DEC(keys);
  	}
  }
 diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
-index b29621d..acf7c4d 100644
+index acf7c4d..b29621d 100644
 --- a/net/sctp/chunk.c
 +++ b/net/sctp/chunk.c
 @@ -272,7 +272,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
  			goto errout;
  		err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
  		if (err < 0)
--			goto errout_chunk_free;
-+			goto errout;
+-			goto errout;
++			goto errout_chunk_free;
  
  		offset += len;
  
@@ -6175,253 +6162,253 @@ index b29621d..acf7c4d 100644
  		__skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
  			   - (__u8 *)chunk->skb->data);
  		if (err < 0)
--			goto errout_chunk_free;
-+			goto errout;
+-			goto errout;
++			goto errout_chunk_free;
  
  		sctp_datamsg_assign(msg, chunk);
  		list_add_tail(&chunk->frag_list, &msg->chunks);
-@@ -316,9 +316,6 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
+@@ -316,6 +316,9 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
  
  	return msg;
  
--errout_chunk_free:
--	sctp_chunk_free(chunk);
--
++errout_chunk_free:
++	sctp_chunk_free(chunk);
++
  errout:
  	list_for_each_safe(pos, temp, &msg->chunks) {
  		list_del_init(pos);
 diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
-index ca48660..905fda5 100644
+index 905fda5..ca48660 100644
 --- a/net/sctp/endpointola.c
 +++ b/net/sctp/endpointola.c
-@@ -249,8 +249,6 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
+@@ -249,6 +249,8 @@ void sctp_endpoint_free(struct sctp_endpoint *ep)
  /* Final destructor for endpoint.  */
  static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
  {
--	int i;
--
++	int i;
++
  	SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
  
  	/* Free up the HMAC transform. */
-@@ -273,9 +271,6 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
+@@ -271,6 +273,9 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
  	sctp_inq_free(&ep->base.inqueue);
  	sctp_bind_addr_free(&ep->base.bind_addr);
  
--	for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
--		memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
--
++	for (i = 0; i < SCTP_HOW_MANY_SECRETS; ++i)
++		memset(&ep->secret_key[i], 0, SCTP_SECRET_SIZE);
++
  	/* Remove and free the port */
  	if (sctp_sk(ep->base.sk)->bind_hash)
  		sctp_put_port(ep->base.sk);
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 26ffae2..1f9843e 100644
+index 1f9843e..26ffae2 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
 @@ -3271,7 +3271,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
  
  	ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
  out:
--	kzfree(authkey);
-+	kfree(authkey);
+-	kfree(authkey);
++	kzfree(authkey);
  	return ret;
  }
  
 diff --git a/net/socket.c b/net/socket.c
-index bf9fc68..d449812 100644
+index d449812..bf9fc68 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -732,9 +732,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
  
  	sock = file->private_data;
  
--	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
--	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
--	flags |= more;
-+	flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
-+	if (more)
-+		flags |= MSG_MORE;
+-	flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
+-	if (more)
+-		flags |= MSG_MORE;
++	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
++	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
++	flags |= more;
  
  	return kernel_sendpage(sock, page, offset, size, flags);
  }
 diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
-index 43aa601..ea1e6de 100644
+index ea1e6de..43aa601 100644
 --- a/net/sunrpc/rpc_pipe.c
 +++ b/net/sunrpc/rpc_pipe.c
 @@ -459,7 +459,7 @@ static int __rpc_create_common(struct inode *dir, struct dentry *dentry,
  {
  	struct inode *inode;
  
--	d_drop(dentry);
-+	BUG_ON(!d_unhashed(dentry));
+-	BUG_ON(!d_unhashed(dentry));
++	d_drop(dentry);
  	inode = rpc_get_inode(dir->i_sb, mode);
  	if (!inode)
  		goto out_err;
 diff --git a/net/tipc/socket.c b/net/tipc/socket.c
-index eccb86b..8ebf4975 100644
+index 8ebf4975..eccb86b 100644
 --- a/net/tipc/socket.c
 +++ b/net/tipc/socket.c
-@@ -800,7 +800,6 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
+@@ -800,6 +800,7 @@ static void set_orig_addr(struct msghdr *m, struct tipc_msg *msg)
  	if (addr) {
  		addr->family = AF_TIPC;
  		addr->addrtype = TIPC_ADDR_ID;
--		memset(&addr->addr, 0, sizeof(addr->addr));
++		memset(&addr->addr, 0, sizeof(addr->addr));
  		addr->addr.id.ref = msg_origport(msg);
  		addr->addr.id.node = msg_orignode(msg);
  		addr->addr.name.domain = 0;   	/* could leave uninitialized */
-@@ -917,9 +916,6 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
+@@ -916,6 +917,9 @@ static int recv_msg(struct kiocb *iocb, struct socket *sock,
  		goto exit;
  	}
  
--	/* will be updated in set_orig_addr() if needed */
--	m->msg_namelen = 0;
--
++	/* will be updated in set_orig_addr() if needed */
++	m->msg_namelen = 0;
++
  restart:
  
  	/* Look for a message in receive queue; wait if necessary */
-@@ -1053,9 +1049,6 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
+@@ -1049,6 +1053,9 @@ static int recv_stream(struct kiocb *iocb, struct socket *sock,
  		goto exit;
  	}
  
--	/* will be updated in set_orig_addr() if needed */
--	m->msg_namelen = 0;
--
++	/* will be updated in set_orig_addr() if needed */
++	m->msg_namelen = 0;
++
  restart:
  
  	/* Look for a message in receive queue; wait if necessary */
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index d146b76..db8d51a 100644
+index db8d51a..d146b76 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -370,7 +370,7 @@ static void unix_sock_destructor(struct sock *sk)
  #endif
  }
  
--static void unix_release_sock(struct sock *sk, int embrion)
-+static int unix_release_sock(struct sock *sk, int embrion)
+-static int unix_release_sock(struct sock *sk, int embrion)
++static void unix_release_sock(struct sock *sk, int embrion)
  {
  	struct unix_sock *u = unix_sk(sk);
  	struct dentry *dentry;
-@@ -445,6 +445,8 @@ static void unix_release_sock(struct sock *sk, int embrion)
+@@ -445,8 +445,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
  
  	if (unix_tot_inflight)
  		unix_gc();		/* Garbage collect fds */
-+
-+	return 0;
+-
+-	return 0;
  }
  
  static int unix_listen(struct socket *sock, int backlog)
-@@ -658,10 +660,9 @@ static int unix_release(struct socket *sock)
+@@ -660,9 +658,10 @@ static int unix_release(struct socket *sock)
  	if (!sk)
  		return 0;
  
--	unix_release_sock(sk, 0);
++	unix_release_sock(sk, 0);
  	sock->sk = NULL;
  
--	return 0;
-+	return unix_release_sock(sk, 0);
+-	return unix_release_sock(sk, 0);
++	return 0;
  }
  
  static int unix_autobind(struct socket *sock)
 diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index 06f42f6..b95a2d6 100644
+index b95a2d6..06f42f6 100644
 --- a/net/xfrm/xfrm_user.c
 +++ b/net/xfrm/xfrm_user.c
-@@ -506,7 +506,6 @@ out:
+@@ -506,6 +506,7 @@ out:
  
  static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
  {
--	memset(p, 0, sizeof(*p));
++	memset(p, 0, sizeof(*p));
  	memcpy(&p->id, &x->id, sizeof(p->id));
  	memcpy(&p->sel, &x->sel, sizeof(p->sel));
  	memcpy(&p->lft, &x->lft, sizeof(p->lft));
-@@ -647,7 +646,6 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
+@@ -646,6 +647,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
  {
  	struct xfrm_dump_info info;
  	struct sk_buff *skb;
--	int err;
++	int err;
  
  	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
  	if (!skb)
-@@ -658,10 +656,9 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
+@@ -656,9 +658,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
  	info.nlmsg_seq = seq;
  	info.nlmsg_flags = 0;
  
--	err = dump_one_state(x, 0, &info);
--	if (err) {
-+	if (dump_one_state(x, 0, &info)) {
+-	if (dump_one_state(x, 0, &info)) {
++	err = dump_one_state(x, 0, &info);
++	if (err) {
  		kfree_skb(skb);
--		return ERR_PTR(err);
-+		return NULL;
+-		return NULL;
++		return ERR_PTR(err);
  	}
  
  	return skb;
-@@ -1078,7 +1075,6 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
+@@ -1075,6 +1078,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
  
  static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
  {
--	memset(p, 0, sizeof(*p));
++	memset(p, 0, sizeof(*p));
  	memcpy(&p->sel, &xp->selector, sizeof(p->sel));
  	memcpy(&p->lft, &xp->lft, sizeof(p->lft));
  	memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
-@@ -1180,7 +1176,6 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
+@@ -1176,6 +1180,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
  		struct xfrm_user_tmpl *up = &vec[i];
  		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
  
--		memset(up, 0, sizeof(*up));
++		memset(up, 0, sizeof(*up));
  		memcpy(&up->id, &kp->id, sizeof(up->id));
  		up->family = kp->encap_family;
  		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
-@@ -1306,7 +1301,6 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
+@@ -1301,6 +1306,7 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
  {
  	struct xfrm_dump_info info;
  	struct sk_buff *skb;
--	int err;
++	int err;
  
  	skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  	if (!skb)
-@@ -1317,10 +1311,9 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
+@@ -1311,9 +1317,10 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
  	info.nlmsg_seq = seq;
  	info.nlmsg_flags = 0;
  
--	err = dump_one_policy(xp, dir, 0, &info);
--	if (err) {
-+	if (dump_one_policy(xp, dir, 0, &info) < 0) {
+-	if (dump_one_policy(xp, dir, 0, &info) < 0) {
++	err = dump_one_policy(xp, dir, 0, &info);
++	if (err) {
  		kfree_skb(skb);
--		return ERR_PTR(err);
-+		return NULL;
+-		return NULL;
++		return ERR_PTR(err);
  	}
  
  	return skb;
 diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
-index 5405ff17..92b62a8 100644
+index 92b62a8..5405ff17 100644
 --- a/scripts/Kbuild.include
 +++ b/scripts/Kbuild.include
 @@ -94,24 +94,24 @@ try-run = $(shell set -e;		\
  # Usage: cflags-y += $(call as-option,-Wa$(comma)-isa=foo,)
  
  as-option = $(call try-run,\
--	$(CC) $(KBUILD_CFLAGS) $(1) -c -x assembler /dev/null -o "$$TMP",$(1),$(2))
-+	$(CC) $(KBUILD_CFLAGS) $(1) -c -xassembler /dev/null -o "$$TMP",$(1),$(2))
+-	$(CC) $(KBUILD_CFLAGS) $(1) -c -xassembler /dev/null -o "$$TMP",$(1),$(2))
++	$(CC) $(KBUILD_CFLAGS) $(1) -c -x assembler /dev/null -o "$$TMP",$(1),$(2))
  
  # as-instr
  # Usage: cflags-y += $(call as-instr,instr,option1,option2)
  
  as-instr = $(call try-run,\
--	/bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -x assembler -o "$$TMP" -,$(2),$(3))
-+	/bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -xassembler -o "$$TMP" -,$(2),$(3))
+-	/bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -xassembler -o "$$TMP" -,$(2),$(3))
++	/bin/echo -e "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -x assembler -o "$$TMP" -,$(2),$(3))
  
  # cc-option
  # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
  
  cc-option = $(call try-run,\
--	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
-+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
+-	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",$(1),$(2))
++	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
  
  # cc-option-yn
  # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
  cc-option-yn = $(call try-run,\
--	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
-+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
+-	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -xc /dev/null -o "$$TMP",y,n)
++	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
  
  # cc-option-align
  # Prefix align with either -falign or -malign
@@ -6429,8 +6416,8 @@ index 5405ff17..92b62a8 100644
  # cc-disable-warning
  # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
  cc-disable-warning = $(call try-run,\
--	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
-+	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+-	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -xc /dev/null -o "$$TMP",-Wno-$(strip $(1)))
++	$(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
  
  # cc-version
  # Usage gcc-ver := $(call cc-version)
@@ -6438,713 +6425,713 @@ index 5405ff17..92b62a8 100644
  # cc-ldoption
  # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
  cc-ldoption = $(call try-run,\
--	$(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
-+	$(CC) $(1) -nostdlib -xc /dev/null -o "$$TMP",$(1),$(2))
+-	$(CC) $(1) -nostdlib -xc /dev/null -o "$$TMP",$(1),$(2))
++	$(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
  
  # ld-option
  # Usage: LDFLAGS += $(call ld-option, -X)
 diff --git a/scripts/gcc-version.sh b/scripts/gcc-version.sh
-index 7f2126d..debecb5 100644
+index debecb5..7f2126d 100644
 --- a/scripts/gcc-version.sh
 +++ b/scripts/gcc-version.sh
 @@ -22,10 +22,10 @@ if [ ${#compiler} -eq 0 ]; then
  	exit 1
  fi
  
--MAJOR=$(echo __GNUC__ | $compiler -E -x c - | tail -n 1)
--MINOR=$(echo __GNUC_MINOR__ | $compiler -E -x c - | tail -n 1)
-+MAJOR=$(echo __GNUC__ | $compiler -E -xc - | tail -n 1)
-+MINOR=$(echo __GNUC_MINOR__ | $compiler -E -xc - | tail -n 1)
+-MAJOR=$(echo __GNUC__ | $compiler -E -xc - | tail -n 1)
+-MINOR=$(echo __GNUC_MINOR__ | $compiler -E -xc - | tail -n 1)
++MAJOR=$(echo __GNUC__ | $compiler -E -x c - | tail -n 1)
++MINOR=$(echo __GNUC_MINOR__ | $compiler -E -x c - | tail -n 1)
  if [ "x$with_patchlevel" != "x" ] ; then
--	PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -x c - | tail -n 1)
-+	PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -xc - | tail -n 1)
+-	PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -xc - | tail -n 1)
++	PATCHLEVEL=$(echo __GNUC_PATCHLEVEL__ | $compiler -E -x c - | tail -n 1)
  	printf "%02d%02d%02d\\n" $MAJOR $MINOR $PATCHLEVEL
  else
  	printf "%02d%02d\\n" $MAJOR $MINOR
 diff --git a/scripts/gcc-x86_32-has-stack-protector.sh b/scripts/gcc-x86_32-has-stack-protector.sh
-index 12dbd0b..29493dc 100644
+index 29493dc..12dbd0b 100644
 --- a/scripts/gcc-x86_32-has-stack-protector.sh
 +++ b/scripts/gcc-x86_32-has-stack-protector.sh
 @@ -1,6 +1,6 @@
  #!/bin/sh
  
--echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
-+echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+-echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
++echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
  if [ "$?" -eq "0" ] ; then
  	echo y
  else
 diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
-index 973e8c1..afaec61 100644
+index afaec61..973e8c1 100644
 --- a/scripts/gcc-x86_64-has-stack-protector.sh
 +++ b/scripts/gcc-x86_64-has-stack-protector.sh
 @@ -1,6 +1,6 @@
  #!/bin/sh
  
--echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
-+echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+-echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
++echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
  if [ "$?" -eq "0" ] ; then
  	echo y
  else
 diff --git a/scripts/kconfig/check.sh b/scripts/kconfig/check.sh
-index 854d9c7..fa59cbf 100755
+index fa59cbf..854d9c7 100755
 --- a/scripts/kconfig/check.sh
 +++ b/scripts/kconfig/check.sh
 @@ -1,6 +1,6 @@
  #!/bin/sh
  # Needed for systems without gettext
--$* -x c -o /dev/null - > /dev/null 2>&1 << EOF
-+$* -xc -o /dev/null - > /dev/null 2>&1 << EOF
+-$* -xc -o /dev/null - > /dev/null 2>&1 << EOF
++$* -x c -o /dev/null - > /dev/null 2>&1 << EOF
  #include <libintl.h>
  int main()
  {
 diff --git a/scripts/kconfig/lxdialog/check-lxdialog.sh b/scripts/kconfig/lxdialog/check-lxdialog.sh
-index 4bab9e2..fcef0f5 100644
+index fcef0f5..4bab9e2 100644
 --- a/scripts/kconfig/lxdialog/check-lxdialog.sh
 +++ b/scripts/kconfig/lxdialog/check-lxdialog.sh
 @@ -36,7 +36,7 @@ trap "rm -f $tmp" 0 1 2 3 15
  
  # Check if we can link to ncurses
  check() {
--        $cc -x c - -o $tmp 2>/dev/null <<'EOF'
-+        $cc -xc - -o $tmp 2>/dev/null <<'EOF'
+-        $cc -xc - -o $tmp 2>/dev/null <<'EOF'
++        $cc -x c - -o $tmp 2>/dev/null <<'EOF'
  #include CURSES_LOC
  main() {}
  EOF
 diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
-index 75fb18c..931cfda 100644
+index 931cfda..75fb18c 100644
 --- a/security/keys/process_keys.c
 +++ b/security/keys/process_keys.c
 @@ -56,7 +56,7 @@ int install_user_keyrings(void)
  
  	kenter("%p{%u}", user, user->uid);
  
--	if (user->uid_keyring && user->session_keyring) {
-+	if (user->uid_keyring) {
+-	if (user->uid_keyring) {
++	if (user->uid_keyring && user->session_keyring) {
  		kleave(" = 0 [exist]");
  		return 0;
  	}
 diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c
-index c2ec4ef..f745c31 100644
+index f745c31..c2ec4ef 100644
 --- a/sound/core/seq/seq_timer.c
 +++ b/sound/core/seq/seq_timer.c
 @@ -291,10 +291,10 @@ int snd_seq_timer_open(struct snd_seq_queue *q)
  			tid.device = SNDRV_TIMER_GLOBAL_SYSTEM;
  			err = snd_timer_open(&t, str, &tid, q->queue);
  		}
--	}
--	if (err < 0) {
--		snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
--		return err;
-+		if (err < 0) {
-+			snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
-+			return err;
-+		}
+-		if (err < 0) {
+-			snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
+-			return err;
+-		}
++	}
++	if (err < 0) {
++		snd_printk(KERN_ERR "seq fatal error: cannot create timer (%i)\n", err);
++		return err;
  	}
  	t->callback = snd_seq_timer_interrupt;
  	t->callback_data = q;
 diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
-index 5f295f7..78288db 100644
+index 78288db..5f295f7 100644
 --- a/sound/pci/ac97/ac97_codec.c
 +++ b/sound/pci/ac97/ac97_codec.c
-@@ -1252,8 +1252,6 @@ static int snd_ac97_cvol_new(struct snd_card *card, char *name, int reg, unsigne
+@@ -1252,6 +1252,8 @@ static int snd_ac97_cvol_new(struct snd_card *card, char *name, int reg, unsigne
  		tmp.index = ac97->num;
  		kctl = snd_ctl_new1(&tmp, ac97);
  	}
--	if (!kctl)
--		return -ENOMEM;
++	if (!kctl)
++		return -ENOMEM;
  	if (reg >= AC97_PHONE && reg <= AC97_PCM)
  		set_tlv_db_scale(kctl, db_scale_5bit_12db_max);
  	else
 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index d9b4453..6419095 100644
+index 6419095..d9b4453 100644
 --- a/sound/pci/hda/patch_realtek.c
 +++ b/sound/pci/hda/patch_realtek.c
 @@ -131,8 +131,8 @@ enum {
  enum {
  	ALC269_BASIC,
  	ALC269_QUANTA_FL1,
--	ALC269_ASUS_AMIC,
--	ALC269_ASUS_DMIC,
-+	ALC269_ASUS_EEEPC_P703,
-+	ALC269_ASUS_EEEPC_P901,
+-	ALC269_ASUS_EEEPC_P703,
+-	ALC269_ASUS_EEEPC_P901,
++	ALC269_ASUS_AMIC,
++	ALC269_ASUS_DMIC,
  	ALC269_FUJITSU,
  	ALC269_LIFEBOOK,
  	ALC269_AUTO,
-@@ -188,8 +188,6 @@ enum {
+@@ -188,6 +188,8 @@ enum {
  	ALC663_ASUS_MODE4,
  	ALC663_ASUS_MODE5,
  	ALC663_ASUS_MODE6,
--	ALC663_ASUS_MODE7,
--	ALC663_ASUS_MODE8,
++	ALC663_ASUS_MODE7,
++	ALC663_ASUS_MODE8,
  	ALC272_DELL,
  	ALC272_DELL_ZM1,
  	ALC272_SAMSUNG_NC10,
-@@ -13236,12 +13234,10 @@ static struct hda_verb alc269_eeepc_amic_init_verbs[] = {
+@@ -13234,10 +13236,12 @@ static struct hda_verb alc269_eeepc_amic_init_verbs[] = {
  /* toggle speaker-output according to the hp-jack state */
  static void alc269_speaker_automute(struct hda_codec *codec)
  {
--	struct alc_spec *spec = codec->spec;
--	unsigned int nid = spec->autocfg.hp_pins[0];
++	struct alc_spec *spec = codec->spec;
++	unsigned int nid = spec->autocfg.hp_pins[0];
  	unsigned int present;
  	unsigned char bits;
  
--	present = snd_hda_codec_read(codec, nid, 0,
-+	present = snd_hda_codec_read(codec, 0x15, 0,
+-	present = snd_hda_codec_read(codec, 0x15, 0,
++	present = snd_hda_codec_read(codec, nid, 0,
  				AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
  	bits = present ? AMP_IN_MUTE(0) : 0;
  	snd_hda_codec_amp_stereo(codec, 0x0c, HDA_INPUT, 0,
-@@ -13467,8 +13463,8 @@ static void alc269_auto_init(struct hda_codec *codec)
+@@ -13463,8 +13467,8 @@ static void alc269_auto_init(struct hda_codec *codec)
  static const char *alc269_models[ALC269_MODEL_LAST] = {
  	[ALC269_BASIC]			= "basic",
  	[ALC269_QUANTA_FL1]		= "quanta",
--	[ALC269_ASUS_AMIC]		= "asus-amic",
--	[ALC269_ASUS_DMIC]		= "asus-dmic",
-+	[ALC269_ASUS_EEEPC_P703]	= "eeepc-p703",
-+	[ALC269_ASUS_EEEPC_P901]	= "eeepc-p901",
+-	[ALC269_ASUS_EEEPC_P703]	= "eeepc-p703",
+-	[ALC269_ASUS_EEEPC_P901]	= "eeepc-p901",
++	[ALC269_ASUS_AMIC]		= "asus-amic",
++	[ALC269_ASUS_DMIC]		= "asus-dmic",
  	[ALC269_FUJITSU]		= "fujitsu",
  	[ALC269_LIFEBOOK]		= "lifebook",
  	[ALC269_AUTO]			= "auto",
-@@ -13477,41 +13473,18 @@ static const char *alc269_models[ALC269_MODEL_LAST] = {
+@@ -13473,18 +13477,41 @@ static const char *alc269_models[ALC269_MODEL_LAST] = {
  static struct snd_pci_quirk alc269_cfg_tbl[] = {
  	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_QUANTA_FL1),
  	SND_PCI_QUIRK(0x1043, 0x8330, "ASUS Eeepc P703 P900A",
--		      ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1133, "ASUS UJ20ft", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1273, "ASUS UL80JT", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1283, "ASUS U53Jc", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x12b3, "ASUS N82Jv", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x13a3, "ASUS UL30Vt", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1373, "ASUS G73JX", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1383, "ASUS UJ30Jc", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x13d3, "ASUS N61JA", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1413, "ASUS UL50", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1443, "ASUS UL30", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1453, "ASUS M60Jv", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1483, "ASUS UL80", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x14f3, "ASUS F83Vf", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS UL20", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1513, "ASUS UX30", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x15a3, "ASUS N60Jv", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x15b3, "ASUS N60Dp", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x15c3, "ASUS N70De", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x15e3, "ASUS F83T", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1643, "ASUS M60J", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1693, "ASUS F50N", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_DMIC),
--	SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_AMIC),
--	SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_AMIC),
-+		      ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_EEEPC_P703),
-+        SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_EEEPC_P703),
+-		      ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_EEEPC_P703),
+-        SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_EEEPC_P703),
++		      ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1133, "ASUS UJ20ft", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1273, "ASUS UL80JT", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1283, "ASUS U53Jc", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x12b3, "ASUS N82Jv", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x13a3, "ASUS UL30Vt", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1373, "ASUS G73JX", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1383, "ASUS UJ30Jc", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x13d3, "ASUS N61JA", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1413, "ASUS UL50", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1443, "ASUS UL30", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1453, "ASUS M60Jv", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1483, "ASUS UL80", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x14f3, "ASUS F83Vf", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x14e3, "ASUS UL20", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1513, "ASUS UX30", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x15a3, "ASUS N60Jv", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x15b3, "ASUS N60Dp", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x15c3, "ASUS N70De", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x15e3, "ASUS F83T", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1643, "ASUS M60J", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1653, "ASUS U50", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1693, "ASUS F50N", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x16a3, "ASUS F5Q", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_DMIC),
++	SND_PCI_QUIRK(0x1043, 0x1723, "ASUS P80", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1743, "ASUS U80", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1773, "ASUS U20A", ALC269_ASUS_AMIC),
++	SND_PCI_QUIRK(0x1043, 0x1883, "ASUS F81Se", ALC269_ASUS_AMIC),
  	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS Eeepc P901",
--		      ALC269_ASUS_DMIC),
-+		      ALC269_ASUS_EEEPC_P901),
+-		      ALC269_ASUS_EEEPC_P901),
++		      ALC269_ASUS_DMIC),
  	SND_PCI_QUIRK(0x1043, 0x834a, "ASUS Eeepc S101",
--		      ALC269_ASUS_DMIC),
--	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005HA", ALC269_ASUS_DMIC),
--	SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005HA", ALC269_ASUS_DMIC),
-+		      ALC269_ASUS_EEEPC_P901),
-+        SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_EEEPC_P901),
+-		      ALC269_ASUS_EEEPC_P901),
+-        SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_ASUS_EEEPC_P901),
++		      ALC269_ASUS_DMIC),
++	SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005HA", ALC269_ASUS_DMIC),
++	SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005HA", ALC269_ASUS_DMIC),
  	SND_PCI_QUIRK(0x1734, 0x115d, "FSC Amilo", ALC269_FUJITSU),
  	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook ICH9M-based", ALC269_LIFEBOOK),
  	{}
-@@ -13541,7 +13514,7 @@ static struct alc_config_preset alc269_presets[] = {
+@@ -13514,7 +13541,7 @@ static struct alc_config_preset alc269_presets[] = {
  		.setup = alc269_quanta_fl1_setup,
  		.init_hook = alc269_quanta_fl1_init_hook,
  	},
--	[ALC269_ASUS_AMIC] = {
-+	[ALC269_ASUS_EEEPC_P703] = {
+-	[ALC269_ASUS_EEEPC_P703] = {
++	[ALC269_ASUS_AMIC] = {
  		.mixers = { alc269_eeepc_mixer },
  		.cap_mixer = alc269_epc_capture_mixer,
  		.init_verbs = { alc269_init_verbs,
-@@ -13555,7 +13528,7 @@ static struct alc_config_preset alc269_presets[] = {
+@@ -13528,7 +13555,7 @@ static struct alc_config_preset alc269_presets[] = {
  		.setup = alc269_eeepc_amic_setup,
  		.init_hook = alc269_eeepc_inithook,
  	},
--	[ALC269_ASUS_DMIC] = {
-+	[ALC269_ASUS_EEEPC_P901] = {
+-	[ALC269_ASUS_EEEPC_P901] = {
++	[ALC269_ASUS_DMIC] = {
  		.mixers = { alc269_eeepc_mixer },
  		.cap_mixer = alc269_epc_capture_mixer,
  		.init_verbs = { alc269_init_verbs,
-@@ -14713,27 +14686,6 @@ static struct alc_config_preset alc861_presets[] = {
+@@ -14686,6 +14713,27 @@ static struct alc_config_preset alc861_presets[] = {
  	},
  };
  
--/* Pin config fixes */
--enum {
--	PINFIX_FSC_AMILO_PI1505,
--};
--
--static struct alc_pincfg alc861_fsc_amilo_pi1505_pinfix[] = {
--	{ 0x0b, 0x0221101f }, /* HP */
--	{ 0x0f, 0x90170310 }, /* speaker */
--	{ }
--};
--
--static const struct alc_fixup alc861_fixups[] = {
--	[PINFIX_FSC_AMILO_PI1505] = {
--		.pins = alc861_fsc_amilo_pi1505_pinfix
--	},
--};
--
--static struct snd_pci_quirk alc861_fixup_tbl[] = {
--	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
--	{}
--};
++/* Pin config fixes */
++enum {
++	PINFIX_FSC_AMILO_PI1505,
++};
++
++static struct alc_pincfg alc861_fsc_amilo_pi1505_pinfix[] = {
++	{ 0x0b, 0x0221101f }, /* HP */
++	{ 0x0f, 0x90170310 }, /* speaker */
++	{ }
++};
++
++static const struct alc_fixup alc861_fixups[] = {
++	[PINFIX_FSC_AMILO_PI1505] = {
++		.pins = alc861_fsc_amilo_pi1505_pinfix
++	},
++};
++
++static struct snd_pci_quirk alc861_fixup_tbl[] = {
++	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
++	{}
++};
  
  static int patch_alc861(struct hda_codec *codec)
  {
-@@ -14757,8 +14709,6 @@ static int patch_alc861(struct hda_codec *codec)
+@@ -14709,6 +14757,8 @@ static int patch_alc861(struct hda_codec *codec)
  		board_config = ALC861_AUTO;
  	}
  
--	alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups);
--
++	alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups);
++
  	if (board_config == ALC861_AUTO) {
  		/* automatic parse from the BIOS config */
  		err = alc861_parse_auto_config(codec);
-@@ -16194,52 +16144,6 @@ static struct snd_kcontrol_new alc663_g50v_mixer[] = {
+@@ -16144,6 +16194,52 @@ static struct snd_kcontrol_new alc663_g50v_mixer[] = {
  	{ } /* end */
  };
  
--static struct hda_bind_ctls alc663_asus_mode7_8_all_bind_switch = {
--	.ops = &snd_hda_bind_sw,
--	.values = {
--		HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
--		HDA_COMPOSE_AMP_VAL(0x15, 3, 0, HDA_OUTPUT),
--		HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
--		HDA_COMPOSE_AMP_VAL(0x1b, 3, 0, HDA_OUTPUT),
--		HDA_COMPOSE_AMP_VAL(0x21, 3, 0, HDA_OUTPUT),
--		0
--	},
--};
--
--static struct hda_bind_ctls alc663_asus_mode7_8_sp_bind_switch = {
--	.ops = &snd_hda_bind_sw,
--	.values = {
--		HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
--		HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
--		0
--	},
--};
--
--static struct snd_kcontrol_new alc663_mode7_mixer[] = {
--	HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
--	HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
--	HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
--	HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x1b, 0x0, HDA_OUTPUT),
--	HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
--	HDA_CODEC_VOLUME("IntMic Playback Volume", 0x0b, 0x0, HDA_INPUT),
--	HDA_CODEC_MUTE("IntMic Playback Switch", 0x0b, 0x0, HDA_INPUT),
--	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x1, HDA_INPUT),
--	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x1, HDA_INPUT),
--	{ } /* end */
--};
--
--static struct snd_kcontrol_new alc663_mode8_mixer[] = {
--	HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
--	HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
--	HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
--	HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x15, 0x0, HDA_OUTPUT),
--	HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
--	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
--	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),
--	{ } /* end */
--};
--
--
++static struct hda_bind_ctls alc663_asus_mode7_8_all_bind_switch = {
++	.ops = &snd_hda_bind_sw,
++	.values = {
++		HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
++		HDA_COMPOSE_AMP_VAL(0x15, 3, 0, HDA_OUTPUT),
++		HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
++		HDA_COMPOSE_AMP_VAL(0x1b, 3, 0, HDA_OUTPUT),
++		HDA_COMPOSE_AMP_VAL(0x21, 3, 0, HDA_OUTPUT),
++		0
++	},
++};
++
++static struct hda_bind_ctls alc663_asus_mode7_8_sp_bind_switch = {
++	.ops = &snd_hda_bind_sw,
++	.values = {
++		HDA_COMPOSE_AMP_VAL(0x14, 3, 0, HDA_OUTPUT),
++		HDA_COMPOSE_AMP_VAL(0x17, 3, 0, HDA_OUTPUT),
++		0
++	},
++};
++
++static struct snd_kcontrol_new alc663_mode7_mixer[] = {
++	HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
++	HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
++	HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
++	HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x1b, 0x0, HDA_OUTPUT),
++	HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
++	HDA_CODEC_VOLUME("IntMic Playback Volume", 0x0b, 0x0, HDA_INPUT),
++	HDA_CODEC_MUTE("IntMic Playback Switch", 0x0b, 0x0, HDA_INPUT),
++	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x1, HDA_INPUT),
++	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x1, HDA_INPUT),
++	{ } /* end */
++};
++
++static struct snd_kcontrol_new alc663_mode8_mixer[] = {
++	HDA_BIND_SW("Master Playback Switch", &alc663_asus_mode7_8_all_bind_switch),
++	HDA_BIND_VOL("Speaker Playback Volume", &alc663_asus_bind_master_vol),
++	HDA_BIND_SW("Speaker Playback Switch", &alc663_asus_mode7_8_sp_bind_switch),
++	HDA_CODEC_MUTE("Headphone1 Playback Switch", 0x15, 0x0, HDA_OUTPUT),
++	HDA_CODEC_MUTE("Headphone2 Playback Switch", 0x21, 0x0, HDA_OUTPUT),
++	HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
++	HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),
++	{ } /* end */
++};
++
++
  static struct snd_kcontrol_new alc662_chmode_mixer[] = {
  	{
  		.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
-@@ -16527,45 +16431,6 @@ static struct hda_verb alc272_dell_init_verbs[] = {
+@@ -16431,6 +16527,45 @@ static struct hda_verb alc272_dell_init_verbs[] = {
  	{}
  };
  
--static struct hda_verb alc663_mode7_init_verbs[] = {
--	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
--	{0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
--	{0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
--	{0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
--	{0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x1b, AC_VERB_SET_CONNECT_SEL, 0x01},
--	{0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
--	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x21, AC_VERB_SET_CONNECT_SEL, 0x01},	/* Headphone */
--	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
--	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
--	{0x19, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
--	{0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
--	{0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
--	{}
--};
--
--static struct hda_verb alc663_mode8_init_verbs[] = {
--	{0x12, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
--	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
--	{0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x15, AC_VERB_SET_CONNECT_SEL, 0x01},
--	{0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
--	{0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
--	{0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
--	{0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
--	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
--	{0x21, AC_VERB_SET_CONNECT_SEL, 0x01},	/* Headphone */
--	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
--	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
--	{0x15, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
--	{0x18, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
--	{0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
--	{}
--};
--
++static struct hda_verb alc663_mode7_init_verbs[] = {
++	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
++	{0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
++	{0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
++	{0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
++	{0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x1b, AC_VERB_SET_CONNECT_SEL, 0x01},
++	{0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
++	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x21, AC_VERB_SET_CONNECT_SEL, 0x01},	/* Headphone */
++	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
++	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
++	{0x19, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
++	{0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
++	{0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
++	{}
++};
++
++static struct hda_verb alc663_mode8_init_verbs[] = {
++	{0x12, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
++	{0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
++	{0x15, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x15, AC_VERB_SET_CONNECT_SEL, 0x01},
++	{0x16, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
++	{0x17, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT},
++	{0x17, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_IN},
++	{0x21, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
++	{0x21, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
++	{0x21, AC_VERB_SET_CONNECT_SEL, 0x01},	/* Headphone */
++	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
++	{0x22, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(9)},
++	{0x15, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
++	{0x18, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_MIC_EVENT},
++	{0x21, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | ALC880_HP_EVENT},
++	{}
++};
++
  static struct snd_kcontrol_new alc662_auto_capture_mixer[] = {
  	HDA_CODEC_VOLUME("Capture Volume", 0x09, 0x0, HDA_INPUT),
  	HDA_CODEC_MUTE("Capture Switch", 0x09, 0x0, HDA_INPUT),
-@@ -16761,54 +16626,6 @@ static void alc663_two_hp_m2_speaker_automute(struct hda_codec *codec)
+@@ -16626,6 +16761,54 @@ static void alc663_two_hp_m2_speaker_automute(struct hda_codec *codec)
  	}
  }
  
--static void alc663_two_hp_m7_speaker_automute(struct hda_codec *codec)
--{
--	unsigned int present1, present2;
--
--	present1 = snd_hda_codec_read(codec, 0x1b, 0,
--			AC_VERB_GET_PIN_SENSE, 0)
--			& AC_PINSENSE_PRESENCE;
--	present2 = snd_hda_codec_read(codec, 0x21, 0,
--			AC_VERB_GET_PIN_SENSE, 0)
--			& AC_PINSENSE_PRESENCE;
--
--	if (present1 || present2) {
--		snd_hda_codec_write_cache(codec, 0x14, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
--		snd_hda_codec_write_cache(codec, 0x17, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
--	} else {
--		snd_hda_codec_write_cache(codec, 0x14, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
--		snd_hda_codec_write_cache(codec, 0x17, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
--	}
--}
--
--static void alc663_two_hp_m8_speaker_automute(struct hda_codec *codec)
--{
--	unsigned int present1, present2;
--
--	present1 = snd_hda_codec_read(codec, 0x21, 0,
--			AC_VERB_GET_PIN_SENSE, 0)
--			& AC_PINSENSE_PRESENCE;
--	present2 = snd_hda_codec_read(codec, 0x15, 0,
--			AC_VERB_GET_PIN_SENSE, 0)
--			& AC_PINSENSE_PRESENCE;
--
--	if (present1 || present2) {
--		snd_hda_codec_write_cache(codec, 0x14, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
--		snd_hda_codec_write_cache(codec, 0x17, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
--	} else {
--		snd_hda_codec_write_cache(codec, 0x14, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
--		snd_hda_codec_write_cache(codec, 0x17, 0,
--			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
--	}
--}
--
++static void alc663_two_hp_m7_speaker_automute(struct hda_codec *codec)
++{
++	unsigned int present1, present2;
++
++	present1 = snd_hda_codec_read(codec, 0x1b, 0,
++			AC_VERB_GET_PIN_SENSE, 0)
++			& AC_PINSENSE_PRESENCE;
++	present2 = snd_hda_codec_read(codec, 0x21, 0,
++			AC_VERB_GET_PIN_SENSE, 0)
++			& AC_PINSENSE_PRESENCE;
++
++	if (present1 || present2) {
++		snd_hda_codec_write_cache(codec, 0x14, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
++		snd_hda_codec_write_cache(codec, 0x17, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
++	} else {
++		snd_hda_codec_write_cache(codec, 0x14, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++		snd_hda_codec_write_cache(codec, 0x17, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++	}
++}
++
++static void alc663_two_hp_m8_speaker_automute(struct hda_codec *codec)
++{
++	unsigned int present1, present2;
++
++	present1 = snd_hda_codec_read(codec, 0x21, 0,
++			AC_VERB_GET_PIN_SENSE, 0)
++			& AC_PINSENSE_PRESENCE;
++	present2 = snd_hda_codec_read(codec, 0x15, 0,
++			AC_VERB_GET_PIN_SENSE, 0)
++			& AC_PINSENSE_PRESENCE;
++
++	if (present1 || present2) {
++		snd_hda_codec_write_cache(codec, 0x14, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
++		snd_hda_codec_write_cache(codec, 0x17, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, 0);
++	} else {
++		snd_hda_codec_write_cache(codec, 0x14, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++		snd_hda_codec_write_cache(codec, 0x17, 0,
++			AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
++	}
++}
++
  static void alc663_m51va_unsol_event(struct hda_codec *codec,
  					   unsigned int res)
  {
-@@ -16828,7 +16645,7 @@ static void alc663_m51va_setup(struct hda_codec *codec)
+@@ -16645,7 +16828,7 @@ static void alc663_m51va_setup(struct hda_codec *codec)
  	spec->ext_mic.pin = 0x18;
  	spec->ext_mic.mux_idx = 0;
  	spec->int_mic.pin = 0x12;
--	spec->int_mic.mux_idx = 9;
-+	spec->int_mic.mux_idx = 1;
+-	spec->int_mic.mux_idx = 1;
++	spec->int_mic.mux_idx = 9;
  	spec->auto_mic = 1;
  }
  
-@@ -16840,17 +16657,7 @@ static void alc663_m51va_inithook(struct hda_codec *codec)
+@@ -16657,7 +16840,17 @@ static void alc663_m51va_inithook(struct hda_codec *codec)
  
  /* ***************** Mode1 ******************************/
  #define alc663_mode1_unsol_event	alc663_m51va_unsol_event
--
--static void alc663_mode1_setup(struct hda_codec *codec)
--{
--	struct alc_spec *spec = codec->spec;
--	spec->ext_mic.pin = 0x18;
--	spec->ext_mic.mux_idx = 0;
--	spec->int_mic.pin = 0x19;
--	spec->int_mic.mux_idx = 1;
--	spec->auto_mic = 1;
--}
--
-+#define alc663_mode1_setup		alc663_m51va_setup
+-#define alc663_mode1_setup		alc663_m51va_setup
++
++static void alc663_mode1_setup(struct hda_codec *codec)
++{
++	struct alc_spec *spec = codec->spec;
++	spec->ext_mic.pin = 0x18;
++	spec->ext_mic.mux_idx = 0;
++	spec->int_mic.pin = 0x19;
++	spec->int_mic.mux_idx = 1;
++	spec->auto_mic = 1;
++}
++
  #define alc663_mode1_inithook		alc663_m51va_inithook
  
  /* ***************** Mode2 ******************************/
-@@ -16867,7 +16674,7 @@ static void alc662_mode2_unsol_event(struct hda_codec *codec,
+@@ -16674,7 +16867,7 @@ static void alc662_mode2_unsol_event(struct hda_codec *codec,
  	}
  }
  
--#define alc662_mode2_setup	alc663_mode1_setup
-+#define alc662_mode2_setup	alc663_m51va_setup
+-#define alc662_mode2_setup	alc663_m51va_setup
++#define alc662_mode2_setup	alc663_mode1_setup
  
  static void alc662_mode2_inithook(struct hda_codec *codec)
  {
-@@ -16888,7 +16695,7 @@ static void alc663_mode3_unsol_event(struct hda_codec *codec,
+@@ -16695,7 +16888,7 @@ static void alc663_mode3_unsol_event(struct hda_codec *codec,
  	}
  }
  
--#define alc663_mode3_setup	alc663_mode1_setup
-+#define alc663_mode3_setup	alc663_m51va_setup
+-#define alc663_mode3_setup	alc663_m51va_setup
++#define alc663_mode3_setup	alc663_mode1_setup
  
  static void alc663_mode3_inithook(struct hda_codec *codec)
  {
-@@ -16909,7 +16716,7 @@ static void alc663_mode4_unsol_event(struct hda_codec *codec,
+@@ -16716,7 +16909,7 @@ static void alc663_mode4_unsol_event(struct hda_codec *codec,
  	}
  }
  
--#define alc663_mode4_setup	alc663_mode1_setup
-+#define alc663_mode4_setup	alc663_m51va_setup
+-#define alc663_mode4_setup	alc663_m51va_setup
++#define alc663_mode4_setup	alc663_mode1_setup
  
  static void alc663_mode4_inithook(struct hda_codec *codec)
  {
-@@ -16930,7 +16737,7 @@ static void alc663_mode5_unsol_event(struct hda_codec *codec,
+@@ -16737,7 +16930,7 @@ static void alc663_mode5_unsol_event(struct hda_codec *codec,
  	}
  }
  
--#define alc663_mode5_setup	alc663_mode1_setup
-+#define alc663_mode5_setup	alc663_m51va_setup
+-#define alc663_mode5_setup	alc663_m51va_setup
++#define alc663_mode5_setup	alc663_mode1_setup
  
  static void alc663_mode5_inithook(struct hda_codec *codec)
  {
-@@ -16951,7 +16758,7 @@ static void alc663_mode6_unsol_event(struct hda_codec *codec,
+@@ -16758,7 +16951,7 @@ static void alc663_mode6_unsol_event(struct hda_codec *codec,
  	}
  }
  
--#define alc663_mode6_setup	alc663_mode1_setup
-+#define alc663_mode6_setup	alc663_m51va_setup
+-#define alc663_mode6_setup	alc663_m51va_setup
++#define alc663_mode6_setup	alc663_mode1_setup
  
  static void alc663_mode6_inithook(struct hda_codec *codec)
  {
-@@ -16959,50 +16766,6 @@ static void alc663_mode6_inithook(struct hda_codec *codec)
+@@ -16766,6 +16959,50 @@ static void alc663_mode6_inithook(struct hda_codec *codec)
  	alc_mic_automute(codec);
  }
  
--/* ***************** Mode7 ******************************/
--static void alc663_mode7_unsol_event(struct hda_codec *codec,
--					   unsigned int res)
--{
--	switch (res >> 26) {
--	case ALC880_HP_EVENT:
--		alc663_two_hp_m7_speaker_automute(codec);
--		break;
--	case ALC880_MIC_EVENT:
--		alc_mic_automute(codec);
--		break;
--	}
--}
--
--#define alc663_mode7_setup	alc663_mode1_setup
--
--static void alc663_mode7_inithook(struct hda_codec *codec)
--{
--	alc663_two_hp_m7_speaker_automute(codec);
--	alc_mic_automute(codec);
--}
--
--/* ***************** Mode8 ******************************/
--static void alc663_mode8_unsol_event(struct hda_codec *codec,
--					   unsigned int res)
--{
--	switch (res >> 26) {
--	case ALC880_HP_EVENT:
--		alc663_two_hp_m8_speaker_automute(codec);
--		break;
--	case ALC880_MIC_EVENT:
--		alc_mic_automute(codec);
--		break;
--	}
--}
--
--#define alc663_mode8_setup	alc663_m51va_setup
--
--static void alc663_mode8_inithook(struct hda_codec *codec)
--{
--	alc663_two_hp_m8_speaker_automute(codec);
--	alc_mic_automute(codec);
--}
--
++/* ***************** Mode7 ******************************/
++static void alc663_mode7_unsol_event(struct hda_codec *codec,
++					   unsigned int res)
++{
++	switch (res >> 26) {
++	case ALC880_HP_EVENT:
++		alc663_two_hp_m7_speaker_automute(codec);
++		break;
++	case ALC880_MIC_EVENT:
++		alc_mic_automute(codec);
++		break;
++	}
++}
++
++#define alc663_mode7_setup	alc663_mode1_setup
++
++static void alc663_mode7_inithook(struct hda_codec *codec)
++{
++	alc663_two_hp_m7_speaker_automute(codec);
++	alc_mic_automute(codec);
++}
++
++/* ***************** Mode8 ******************************/
++static void alc663_mode8_unsol_event(struct hda_codec *codec,
++					   unsigned int res)
++{
++	switch (res >> 26) {
++	case ALC880_HP_EVENT:
++		alc663_two_hp_m8_speaker_automute(codec);
++		break;
++	case ALC880_MIC_EVENT:
++		alc_mic_automute(codec);
++		break;
++	}
++}
++
++#define alc663_mode8_setup	alc663_m51va_setup
++
++static void alc663_mode8_inithook(struct hda_codec *codec)
++{
++	alc663_two_hp_m8_speaker_automute(codec);
++	alc_mic_automute(codec);
++}
++
  static void alc663_g71v_hp_automute(struct hda_codec *codec)
  {
  	unsigned int present;
-@@ -17141,8 +16904,6 @@ static const char *alc662_models[ALC662_MODEL_LAST] = {
+@@ -16904,6 +17141,8 @@ static const char *alc662_models[ALC662_MODEL_LAST] = {
  	[ALC663_ASUS_MODE4] = "asus-mode4",
  	[ALC663_ASUS_MODE5] = "asus-mode5",
  	[ALC663_ASUS_MODE6] = "asus-mode6",
--	[ALC663_ASUS_MODE7] = "asus-mode7",
--	[ALC663_ASUS_MODE8] = "asus-mode8",
++	[ALC663_ASUS_MODE7] = "asus-mode7",
++	[ALC663_ASUS_MODE8] = "asus-mode8",
  	[ALC272_DELL]		= "dell",
  	[ALC272_DELL_ZM1]	= "dell-zm1",
  	[ALC272_SAMSUNG_NC10]	= "samsung-nc10",
-@@ -17159,22 +16920,12 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
+@@ -16920,12 +17159,22 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
  	SND_PCI_QUIRK(0x1043, 0x11d3, "ASUS NB", ALC663_ASUS_MODE1),
  	SND_PCI_QUIRK(0x1043, 0x11f3, "ASUS NB", ALC662_ASUS_MODE2),
  	SND_PCI_QUIRK(0x1043, 0x1203, "ASUS NB", ALC663_ASUS_MODE1),
--	SND_PCI_QUIRK(0x1043, 0x1303, "ASUS G60J", ALC663_ASUS_MODE1),
--	SND_PCI_QUIRK(0x1043, 0x1333, "ASUS G60Jx", ALC663_ASUS_MODE1),
++	SND_PCI_QUIRK(0x1043, 0x1303, "ASUS G60J", ALC663_ASUS_MODE1),
++	SND_PCI_QUIRK(0x1043, 0x1333, "ASUS G60Jx", ALC663_ASUS_MODE1),
  	SND_PCI_QUIRK(0x1043, 0x1339, "ASUS NB", ALC662_ASUS_MODE2),
--	SND_PCI_QUIRK(0x1043, 0x13e3, "ASUS N71JA", ALC663_ASUS_MODE7),
--	SND_PCI_QUIRK(0x1043, 0x1463, "ASUS N71", ALC663_ASUS_MODE7),
--	SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G72", ALC663_ASUS_MODE8),
--	SND_PCI_QUIRK(0x1043, 0x1563, "ASUS N90", ALC663_ASUS_MODE3),
--	SND_PCI_QUIRK(0x1043, 0x15d3, "ASUS N50SF F50SF", ALC663_ASUS_MODE1),
++	SND_PCI_QUIRK(0x1043, 0x13e3, "ASUS N71JA", ALC663_ASUS_MODE7),
++	SND_PCI_QUIRK(0x1043, 0x1463, "ASUS N71", ALC663_ASUS_MODE7),
++	SND_PCI_QUIRK(0x1043, 0x14d3, "ASUS G72", ALC663_ASUS_MODE8),
++	SND_PCI_QUIRK(0x1043, 0x1563, "ASUS N90", ALC663_ASUS_MODE3),
++	SND_PCI_QUIRK(0x1043, 0x15d3, "ASUS N50SF F50SF", ALC663_ASUS_MODE1),
  	SND_PCI_QUIRK(0x1043, 0x16c3, "ASUS NB", ALC662_ASUS_MODE2),
--	SND_PCI_QUIRK(0x1043, 0x16f3, "ASUS K40C K50C", ALC662_ASUS_MODE2),
--	SND_PCI_QUIRK(0x1043, 0x1733, "ASUS N81De", ALC663_ASUS_MODE1),
++	SND_PCI_QUIRK(0x1043, 0x16f3, "ASUS K40C K50C", ALC662_ASUS_MODE2),
++	SND_PCI_QUIRK(0x1043, 0x1733, "ASUS N81De", ALC663_ASUS_MODE1),
  	SND_PCI_QUIRK(0x1043, 0x1753, "ASUS NB", ALC662_ASUS_MODE2),
  	SND_PCI_QUIRK(0x1043, 0x1763, "ASUS NB", ALC663_ASUS_MODE6),
  	SND_PCI_QUIRK(0x1043, 0x1765, "ASUS NB", ALC663_ASUS_MODE6),
  	SND_PCI_QUIRK(0x1043, 0x1783, "ASUS NB", ALC662_ASUS_MODE2),
--	SND_PCI_QUIRK(0x1043, 0x1793, "ASUS F50GX", ALC663_ASUS_MODE1),
++	SND_PCI_QUIRK(0x1043, 0x1793, "ASUS F50GX", ALC663_ASUS_MODE1),
  	SND_PCI_QUIRK(0x1043, 0x17b3, "ASUS F70SL", ALC663_ASUS_MODE3),
  	SND_PCI_QUIRK(0x1043, 0x17c3, "ASUS UX20", ALC663_ASUS_M51VA),
  	SND_PCI_QUIRK(0x1043, 0x17f3, "ASUS X58LE", ALC662_ASUS_MODE2),
-@@ -17457,36 +17208,6 @@ static struct alc_config_preset alc662_presets[] = {
+@@ -17208,6 +17457,36 @@ static struct alc_config_preset alc662_presets[] = {
  		.setup = alc663_mode6_setup,
  		.init_hook = alc663_mode6_inithook,
  	},
--	[ALC663_ASUS_MODE7] = {
--		.mixers = { alc663_mode7_mixer },
--		.cap_mixer = alc662_auto_capture_mixer,
--		.init_verbs = { alc662_init_verbs,
--				alc663_mode7_init_verbs },
--		.num_dacs = ARRAY_SIZE(alc662_dac_nids),
--		.hp_nid = 0x03,
--		.dac_nids = alc662_dac_nids,
--		.dig_out_nid = ALC662_DIGOUT_NID,
--		.num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
--		.channel_mode = alc662_3ST_2ch_modes,
--		.unsol_event = alc663_mode7_unsol_event,
--		.setup = alc663_mode7_setup,
--		.init_hook = alc663_mode7_inithook,
--	},
--	[ALC663_ASUS_MODE8] = {
--		.mixers = { alc663_mode8_mixer },
--		.cap_mixer = alc662_auto_capture_mixer,
--		.init_verbs = { alc662_init_verbs,
--				alc663_mode8_init_verbs },
--		.num_dacs = ARRAY_SIZE(alc662_dac_nids),
--		.hp_nid = 0x03,
--		.dac_nids = alc662_dac_nids,
--		.dig_out_nid = ALC662_DIGOUT_NID,
--		.num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
--		.channel_mode = alc662_3ST_2ch_modes,
--		.unsol_event = alc663_mode8_unsol_event,
--		.setup = alc663_mode8_setup,
--		.init_hook = alc663_mode8_inithook,
--	},
++	[ALC663_ASUS_MODE7] = {
++		.mixers = { alc663_mode7_mixer },
++		.cap_mixer = alc662_auto_capture_mixer,
++		.init_verbs = { alc662_init_verbs,
++				alc663_mode7_init_verbs },
++		.num_dacs = ARRAY_SIZE(alc662_dac_nids),
++		.hp_nid = 0x03,
++		.dac_nids = alc662_dac_nids,
++		.dig_out_nid = ALC662_DIGOUT_NID,
++		.num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
++		.channel_mode = alc662_3ST_2ch_modes,
++		.unsol_event = alc663_mode7_unsol_event,
++		.setup = alc663_mode7_setup,
++		.init_hook = alc663_mode7_inithook,
++	},
++	[ALC663_ASUS_MODE8] = {
++		.mixers = { alc663_mode8_mixer },
++		.cap_mixer = alc662_auto_capture_mixer,
++		.init_verbs = { alc662_init_verbs,
++				alc663_mode8_init_verbs },
++		.num_dacs = ARRAY_SIZE(alc662_dac_nids),
++		.hp_nid = 0x03,
++		.dac_nids = alc662_dac_nids,
++		.dig_out_nid = ALC662_DIGOUT_NID,
++		.num_channel_mode = ARRAY_SIZE(alc662_3ST_2ch_modes),
++		.channel_mode = alc662_3ST_2ch_modes,
++		.unsol_event = alc663_mode8_unsol_event,
++		.setup = alc663_mode8_setup,
++		.init_hook = alc663_mode8_inithook,
++	},
  	[ALC272_DELL] = {
  		.mixers = { alc663_m51va_mixer },
  		.cap_mixer = alc272_auto_capture_mixer,
-@@ -17955,9 +17676,7 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
+@@ -17676,7 +17955,9 @@ static struct hda_codec_preset snd_hda_preset_realtek[] = {
  	{ .id = 0x10ec0267, .name = "ALC267", .patch = patch_alc268 },
  	{ .id = 0x10ec0268, .name = "ALC268", .patch = patch_alc268 },
  	{ .id = 0x10ec0269, .name = "ALC269", .patch = patch_alc269 },
--	{ .id = 0x10ec0270, .name = "ALC270", .patch = patch_alc269 },
++	{ .id = 0x10ec0270, .name = "ALC270", .patch = patch_alc269 },
  	{ .id = 0x10ec0272, .name = "ALC272", .patch = patch_alc662 },
--	{ .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 },
++	{ .id = 0x10ec0275, .name = "ALC275", .patch = patch_alc269 },
  	{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
  	  .patch = patch_alc861 },
  	{ .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
 diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c
-index 13cd679..83b3dde 100644
+index 83b3dde..13cd679 100644
 --- a/usr/gen_init_cpio.c
 +++ b/usr/gen_init_cpio.c
 @@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name, const char *location,
  	int retval;
  	int rc = -1;
  	int namesize;
--	unsigned int i;
-+	int i;
+-	int i;
++	unsigned int i;
  
  	mode |= S_IFREG;
  
-@@ -372,28 +372,25 @@ error:
+@@ -372,25 +372,28 @@ error:
  
  static char *cpio_replace_env(char *new_location)
  {
--	char expanded[PATH_MAX + 1];
--	char env_var[PATH_MAX + 1];
--	char *start;
--	char *end;
--
--	for (start = NULL; (start = strstr(new_location, "${")); ) {
--		end = strchr(start, '}');
--		if (start < end) {
--			*env_var = *expanded = '\0';
--			strncat(env_var, start + 2, end - start - 2);
--			strncat(expanded, new_location, start - new_location);
--			strncat(expanded, getenv(env_var),
--				PATH_MAX - strlen(expanded));
--			strncat(expanded, end + 1,
--				PATH_MAX - strlen(expanded));
--			strncpy(new_location, expanded, PATH_MAX);
--			new_location[PATH_MAX] = 0;
--		} else
--			break;
--	}
--
--	return new_location;
-+       char expanded[PATH_MAX + 1];
-+       char env_var[PATH_MAX + 1];
-+       char *start;
-+       char *end;
-+
-+       for (start = NULL; (start = strstr(new_location, "${")); ) {
-+               end = strchr(start, '}');
-+               if (start < end) {
-+                       *env_var = *expanded = '\0';
-+                       strncat(env_var, start + 2, end - start - 2);
-+                       strncat(expanded, new_location, start - new_location);
-+                       strncat(expanded, getenv(env_var), PATH_MAX);
-+                       strncat(expanded, end + 1, PATH_MAX);
-+                       strncpy(new_location, expanded, PATH_MAX);
-+               } else
-+                       break;
-+       }
-+
-+       return new_location;
+-       char expanded[PATH_MAX + 1];
+-       char env_var[PATH_MAX + 1];
+-       char *start;
+-       char *end;
+-
+-       for (start = NULL; (start = strstr(new_location, "${")); ) {
+-               end = strchr(start, '}');
+-               if (start < end) {
+-                       *env_var = *expanded = '\0';
+-                       strncat(env_var, start + 2, end - start - 2);
+-                       strncat(expanded, new_location, start - new_location);
+-                       strncat(expanded, getenv(env_var), PATH_MAX);
+-                       strncat(expanded, end + 1, PATH_MAX);
+-                       strncpy(new_location, expanded, PATH_MAX);
+-               } else
+-                       break;
+-       }
+-
+-       return new_location;
++	char expanded[PATH_MAX + 1];
++	char env_var[PATH_MAX + 1];
++	char *start;
++	char *end;
++
++	for (start = NULL; (start = strstr(new_location, "${")); ) {
++		end = strchr(start, '}');
++		if (start < end) {
++			*env_var = *expanded = '\0';
++			strncat(env_var, start + 2, end - start - 2);
++			strncat(expanded, new_location, start - new_location);
++			strncat(expanded, getenv(env_var),
++				PATH_MAX - strlen(expanded));
++			strncat(expanded, end + 1,
++				PATH_MAX - strlen(expanded));
++			strncpy(new_location, expanded, PATH_MAX);
++			new_location[PATH_MAX] = 0;
++		} else
++			break;
++	}
++
++	return new_location;
  }
  
  
 diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index 69969ae..9fe140b 100644
+index 9fe140b..69969ae 100644
 --- a/virt/kvm/ioapic.c
 +++ b/virt/kvm/ioapic.c
-@@ -71,12 +71,9 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+@@ -71,9 +71,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
  			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
  			u64 redir_content;
  
--			if (redir_index < IOAPIC_NUM_PINS)
--				redir_content =
--					ioapic->redirtbl[redir_index].bits;
--			else
--				redir_content = ~0ULL;
-+			ASSERT(redir_index < IOAPIC_NUM_PINS);
+-			ASSERT(redir_index < IOAPIC_NUM_PINS);
++			if (redir_index < IOAPIC_NUM_PINS)
++				redir_content =
++					ioapic->redirtbl[redir_index].bits;
++			else
++				redir_content = ~0ULL;
  
-+			redir_content = ioapic->redirtbl[redir_index].bits;
+-			redir_content = ioapic->redirtbl[redir_index].bits;
  			result = (ioapic->ioregsel & 0x1) ?
  			    (redir_content >> 32) & 0xffffffff :
  			    redir_content & 0xffffffff;
diff --git a/3.2.46/4427_force_XATTR_PAX_tmpfs.patch b/3.2.46/4427_force_XATTR_PAX_tmpfs.patch
new file mode 100644
index 0000000..8c7a533
--- /dev/null
+++ b/3.2.46/4427_force_XATTR_PAX_tmpfs.patch
@@ -0,0 +1,35 @@
+From: Anthony G. Basile <blueness@gentoo.org>
+
+For users that emerge without XATTR_PAX support enabled, we still want user.pax.flags
+namespace supported on tmpfs so that the PaX markings survive emerge.
+
+diff -Naur a/mm/shmem.c b/mm/shmem.c
+--- a/mm/shmem.c	2013-06-11 21:00:18.000000000 -0400
++++ b/mm/shmem.c	2013-06-11 21:08:18.000000000 -0400
+@@ -1809,11 +1809,7 @@
+ static int shmem_xattr_validate(const char *name)
+ {
+ 	struct { const char *prefix; size_t len; } arr[] = {
+-
+-#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
+ 		{ XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN},
+-#endif
+-
+ 		{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
+ 		{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
+ 	};
+@@ -1867,14 +1863,12 @@
+ 	if (err)
+ 		return err;
+ 
+-#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
+ 	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+ 		if (strcmp(name, XATTR_NAME_PAX_FLAGS))
+ 			return -EOPNOTSUPP;
+ 		if (size > 8)
+ 			return -EINVAL;
+ 	}
+-#endif
+ 
+ 	if (size == 0)
+ 		value = "";  /* empty EA, do not remove */
diff --git a/3.2.46/4450_grsec-kconfig-default-gids.patch b/3.2.46/4450_grsec-kconfig-default-gids.patch
index 6f5b79b..c882e28 100644
--- a/3.2.46/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.46/4450_grsec-kconfig-default-gids.patch
@@ -16,7 +16,7 @@ from shooting themselves in the foot.
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2012-10-13 09:51:35.000000000 -0400
 +++ b/grsecurity/Kconfig	2012-10-13 09:52:32.000000000 -0400
-@@ -588,7 +588,7 @@
+@@ -610,7 +610,7 @@
  config GRKERNSEC_AUDIT_GID
  	int "GID for auditing"
  	depends on GRKERNSEC_AUDIT_GROUP
@@ -25,7 +25,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  
  config GRKERNSEC_EXECLOG
  	bool "Exec logging"
-@@ -808,7 +808,7 @@
+@@ -830,7 +830,7 @@
  config GRKERNSEC_TPE_UNTRUSTED_GID
  	int "GID for TPE-untrusted users"
  	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -34,7 +34,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *enabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -817,7 +817,7 @@
+@@ -839,7 +839,7 @@
  config GRKERNSEC_TPE_TRUSTED_GID
  	int "GID for TPE-trusted users"
  	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *disabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -910,7 +910,7 @@
+@@ -932,7 +932,7 @@
  config GRKERNSEC_SOCKET_ALL_GID
  	int "GID to deny all sockets for"
  	depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable socket access for. Remember to
  	  add the users you want socket access disabled for to the GID
-@@ -931,7 +931,7 @@
+@@ -953,7 +953,7 @@
  config GRKERNSEC_SOCKET_CLIENT_GID
  	int "GID to deny client sockets for"
  	depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable client socket access for.
  	  Remember to add the users you want client socket access disabled for to
-@@ -949,7 +949,7 @@
+@@ -971,7 +971,7 @@
  config GRKERNSEC_SOCKET_SERVER_GID
  	int "GID to deny server sockets for"
  	depends on GRKERNSEC_SOCKET_SERVER
diff --git a/3.2.46/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.46/4465_selinux-avc_audit-log-curr_ip.patch
index 47a5787..5607ab4 100644
--- a/3.2.46/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.46/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-04-17 19:25:54.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-04-17 19:32:53.000000000 -0400
-@@ -1008,6 +1008,27 @@
+@@ -1030,6 +1030,27 @@
  menu "Logging Options"
  depends on GRKERNSEC
  
diff --git a/3.9.5/0000_README b/3.9.5/0000_README
index c01830f..39f1bd8 100644
--- a/3.9.5/0000_README
+++ b/3.9.5/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9.1-3.9.5-201306102218.patch
+Patch:	4420_grsecurity-2.9.1-3.9.5-201306111850.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.9.5/4420_grsecurity-2.9.1-3.9.5-201306102218.patch b/3.9.5/4420_grsecurity-2.9.1-3.9.5-201306111850.patch
index 49e438f..183d9f7 100644
--- a/3.9.5/4420_grsecurity-2.9.1-3.9.5-201306102218.patch
+++ b/3.9.5/4420_grsecurity-2.9.1-3.9.5-201306111850.patch
@@ -22507,7 +22507,7 @@ index 7a6f3b3..bed145d7 100644
  
  1:
 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
-index fae9134..b7d4a57 100644
+index fae9134..f8e4a47 100644
 --- a/arch/x86/kernel/setup.c
 +++ b/arch/x86/kernel/setup.c
 @@ -111,6 +111,7 @@
@@ -22536,6 +22536,15 @@ index fae9134..b7d4a57 100644
  
  	sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
  }
+@@ -782,7 +783,7 @@ static void __init trim_bios_range(void)
+ /* called before trim_bios_range() to spare extra sanitize */
+ static void __init e820_add_kernel_range(void)
+ {
+-	u64 start = __pa_symbol(_text);
++	u64 start = __pa_symbol(ktla_ktva(_text));
+ 	u64 size = __pa_symbol(_end) - start;
+ 
+ 	/*
 @@ -844,8 +845,12 @@ static void __init trim_low_memory_range(void)
  
  void __init setup_arch(char **cmdline_p)
diff --git a/3.9.5/4427_force_XATTR_PAX_tmpfs.patch b/3.9.5/4427_force_XATTR_PAX_tmpfs.patch
new file mode 100644
index 0000000..e2a9551
--- /dev/null
+++ b/3.9.5/4427_force_XATTR_PAX_tmpfs.patch
@@ -0,0 +1,35 @@
+From: Anthony G. Basile <blueness@gentoo.org>
+
+For users that emerge without XATTR_PAX support enabled, we still want user.pax.flags
+namespace supported on tmpfs so that the PaX markings survive emerge.
+
+diff -Naur a/mm/shmem.c b/mm/shmem.c
+--- a/mm/shmem.c	2013-06-11 21:00:18.000000000 -0400
++++ b/mm/shmem.c	2013-06-11 21:08:18.000000000 -0400
+@@ -2201,11 +2201,7 @@
+ static int shmem_xattr_validate(const char *name)
+ {
+ 	struct { const char *prefix; size_t len; } arr[] = {
+-
+-#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
+ 		{ XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN},
+-#endif
+-
+ 		{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
+ 		{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
+ 	};
+@@ -2261,14 +2257,12 @@
+ 	if (err)
+ 		return err;
+ 
+-#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
+ 	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
+ 		if (strcmp(name, XATTR_NAME_PAX_FLAGS))
+ 			return -EOPNOTSUPP;
+ 		if (size > 8)
+ 			return -EINVAL;
+ 	}
+-#endif
+ 
+ 	return simple_xattr_set(&info->xattrs, name, value, size, flags);
+ }
diff --git a/3.9.5/4450_grsec-kconfig-default-gids.patch b/3.9.5/4450_grsec-kconfig-default-gids.patch
index 190e85d..f144c0e 100644
--- a/3.9.5/4450_grsec-kconfig-default-gids.patch
+++ b/3.9.5/4450_grsec-kconfig-default-gids.patch
@@ -16,7 +16,7 @@ from shooting themselves in the foot.
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2012-10-13 09:51:35.000000000 -0400
 +++ b/grsecurity/Kconfig	2012-10-13 09:52:32.000000000 -0400
-@@ -588,7 +588,7 @@
+@@ -610,7 +610,7 @@
  config GRKERNSEC_AUDIT_GID
  	int "GID for auditing"
  	depends on GRKERNSEC_AUDIT_GROUP
@@ -25,7 +25,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  
  config GRKERNSEC_EXECLOG
  	bool "Exec logging"
-@@ -808,7 +808,7 @@
+@@ -830,7 +830,7 @@
  config GRKERNSEC_TPE_UNTRUSTED_GID
  	int "GID for TPE-untrusted users"
  	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -34,7 +34,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *enabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -817,7 +817,7 @@
+@@ -839,7 +839,7 @@
  config GRKERNSEC_TPE_TRUSTED_GID
  	int "GID for TPE-trusted users"
  	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Setting this GID determines what group TPE restrictions will be
  	  *disabled* for.  If the sysctl option is enabled, a sysctl option
-@@ -910,7 +910,7 @@
+@@ -932,7 +932,7 @@
  config GRKERNSEC_SOCKET_ALL_GID
  	int "GID to deny all sockets for"
  	depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable socket access for. Remember to
  	  add the users you want socket access disabled for to the GID
-@@ -931,7 +931,7 @@
+@@ -953,7 +953,7 @@
  config GRKERNSEC_SOCKET_CLIENT_GID
  	int "GID to deny client sockets for"
  	depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
  	help
  	  Here you can choose the GID to disable client socket access for.
  	  Remember to add the users you want client socket access disabled for to
-@@ -949,7 +949,7 @@
+@@ -971,7 +971,7 @@
  config GRKERNSEC_SOCKET_SERVER_GID
  	int "GID to deny server sockets for"
  	depends on GRKERNSEC_SOCKET_SERVER
diff --git a/3.9.5/4465_selinux-avc_audit-log-curr_ip.patch b/3.9.5/4465_selinux-avc_audit-log-curr_ip.patch
index b25a23f..b0786d4 100644
--- a/3.9.5/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.9.5/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
 diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
 --- a/grsecurity/Kconfig	2011-04-17 19:25:54.000000000 -0400
 +++ b/grsecurity/Kconfig	2011-04-17 19:32:53.000000000 -0400
-@@ -1008,6 +1008,27 @@
+@@ -1030,6 +1030,27 @@
  menu "Logging Options"
  depends on GRKERNSEC