5 files changed, 39 insertions, 3 deletions

diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
index c05c2d69fbf..db1e31f9520 100644
--- a/drivers/net/dnet.c
+++ b/drivers/net/dnet.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 #include <linux/version.h>
+#include <linux/io.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
diff --git a/drivers/net/phy/smsc.c b/drivers/net/phy/smsc.c
index 1387187543e..5123bb954dd 100644
--- a/drivers/net/phy/smsc.c
+++ b/drivers/net/phy/smsc.c
@@ -159,6 +159,30 @@ static struct phy_driver lan911x_int_driver = {
         .driver         = { .owner = THIS_MODULE, }
 };
 
+static struct phy_driver lan8710_driver = {
+        .phy_id         = 0x0007c0f0, /* OUI=0x00800f, Model#=0x0f */
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "SMSC LAN8710/LAN8720",
+
+        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
+                                | SUPPORTED_Asym_Pause),
+        .flags          = PHY_HAS_INTERRUPT | PHY_HAS_MAGICANEG,
+
+        /* basic functions */
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .config_init    = smsc_phy_config_init,
+
+        /* IRQ related */
+        .ack_interrupt  = smsc_phy_ack_interrupt,
+        .config_intr    = smsc_phy_config_intr,
+
+        .suspend        = genphy_suspend,
+        .resume         = genphy_resume,
+
+        .driver         = { .owner = THIS_MODULE, }
+};
+
 static int __init smsc_init(void)
 {
         int ret;
@@ -179,8 +203,14 @@ static int __init smsc_init(void)
         if (ret)
                 goto err4;
 
+        ret = phy_driver_register (&lan8710_driver);
+        if (ret)
+                goto err5;
+
         return 0;
 
+err5:
+        phy_driver_unregister (&lan911x_int_driver);
 err4:
         phy_driver_unregister (&lan8700_driver);
 err3:
@@ -193,6 +223,7 @@ err1:
 
 static void __exit smsc_exit(void)
 {
+        phy_driver_unregister (&lan8710_driver);
         phy_driver_unregister (&lan911x_int_driver);
         phy_driver_unregister (&lan8700_driver);
         phy_driver_unregister (&lan8187_driver);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 727c5c510a6..8a96672e2c5 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -426,7 +426,6 @@ err2:
 err1:
         kobject_del(&p->kobj);
 err0:
-        kobject_put(&p->kobj);
         dev_set_promiscuity(dev, -1);
 put_back:
         dev_put(dev);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ace2ac8a42f..bda08a09357 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1618,7 +1618,8 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
+                if (state->bucket < UDP_HTABLE_SIZE)
+                        spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
         return sk;
@@ -1636,6 +1637,9 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
+        struct udp_iter_state *state = seq->private;
+        state->bucket = UDP_HTABLE_SIZE;
+
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index e46f3b79adb..0aeb8b09a1f 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -15,6 +15,7 @@
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <asm/unaligned.h>
 
 #include <net/tcp.h>
 
@@ -468,7 +469,7 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
                                 for (i = 0;
                                      i < (opsize - TCPOLEN_SACK_BASE);
                                      i += TCPOLEN_SACK_PERBLOCK) {
-                                        tmp = ntohl(*((__be32 *)(ptr+i)+1));
+                                        tmp = get_unaligned_be32((__be32 *)(ptr+i)+1);
 
                                         if (after(tmp, *sack))
                                                 *sack = tmp;