Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (46 commits)
  tcp: MD5: Fix IPv6 signatures
  skbuff: add missing kernel-doc for do_not_encrypt
  net/ipv4/route.c: fix build error
  tcp: MD5: Fix MD5 signatures on certain ACK packets
  ipv6: Fix ip6_xmit to send fragments if ipfragok is true
  ipvs: Move userspace definitions to include/linux/ip_vs.h
  netdev: Fix lockdep warnings in multiqueue configurations.
  netfilter: xt_hashlimit: fix race between htable_destroy and htable_gc
  netfilter: ipt_recent: fix race between recent_mt_destroy and proc manipulations
  netfilter: nf_conntrack_tcp: decrease timeouts while data in unacknowledged
  irda: replace __FUNCTION__ with __func__
  nsc-ircc: default to dongle type 9 on IBM hardware
  bluetooth: add quirks for a few hci_usb devices
  hysdn: remove the packed attribute from PofTimStamp_tag
  isdn: use the common ascii hex helpers
  tg3: adapt tg3 to use reworked PCI PM code
  atm: fix direct casts of pointers to u32 in the InterPhase driver
  atm: fix const assignment/discard warnings in the ATM networking driver
  net: use the common ascii hex helpers
  random32: seeding improvement
  ...

18 files changed, 119 insertions, 64 deletions

diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 4fccaa1e07b..11b16d16661 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -62,11 +62,13 @@ static void MPOA_cache_impos_rcvd(struct k_message *msg, struct mpoa_client *mpc
 static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
 static void set_mps_mac_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
 
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type);
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type);
 static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry);
 
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc);
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc);
 static void mpoad_close(struct atm_vcc *vcc);
 static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
 
@@ -351,12 +353,12 @@ static const char *mpoa_device_type_string(char type)
  * lec sees a TLV it uses the pointer to call this function.
  *
  */
-static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
-                            uint8_t *tlvs, uint32_t sizeoftlvs)
+static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
+                            const u8 *tlvs, u32 sizeoftlvs)
 {
         uint32_t type;
         uint8_t length, mpoa_device_type, number_of_mps_macs;
-        uint8_t *end_of_tlvs;
+        const uint8_t *end_of_tlvs;
         struct mpoa_client *mpc;
 
         mpoa_device_type = number_of_mps_macs = 0; /* silence gcc */
@@ -430,8 +432,10 @@ static void lane2_assoc_ind(struct net_device *dev, uint8_t *mac_addr,
  * plus the possible MAC address(es) to mpc->mps_macs.
  * For a freshly allocated MPOA client mpc->mps_macs == 0.
  */
-static uint8_t *copy_macs(struct mpoa_client *mpc, uint8_t *router_mac,
-                          uint8_t *tlvs, uint8_t mps_macs, uint8_t device_type)
+static const uint8_t *copy_macs(struct mpoa_client *mpc,
+                                const uint8_t *router_mac,
+                                const uint8_t *tlvs, uint8_t mps_macs,
+                                uint8_t device_type)
 {
         int num_macs;
         num_macs = (mps_macs > 1) ? mps_macs : 1;
@@ -811,7 +815,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
         return arg;
 }
 
-static void send_set_mps_ctrl_addr(char *addr, struct mpoa_client *mpc)
+static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc)
 {
         struct k_message mesg;
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index d9449df7cad..9b58d70b0e7 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -68,10 +68,17 @@ static int br_dev_stop(struct net_device *dev)
 
 static int br_change_mtu(struct net_device *dev, int new_mtu)
 {
-        if (new_mtu < 68 || new_mtu > br_min_mtu(netdev_priv(dev)))
+        struct net_bridge *br = netdev_priv(dev);
+        if (new_mtu < 68 || new_mtu > br_min_mtu(br))
                 return -EINVAL;
 
         dev->mtu = new_mtu;
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* remember the MTU in the rtable for PMTU */
+        br->fake_rtable.u.dst.metrics[RTAX_MTU - 1] = new_mtu;
+#endif
+
         return 0;
 }
 
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index a072ea5ca6f..63c18aacde8 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -202,6 +202,9 @@ static struct net_device *new_bridge_dev(const char *name)
         br->topology_change = 0;
         br->topology_change_detected = 0;
         br->ageing_time = 300 * HZ;
+
+        br_netfilter_rtable_init(br);
+
         INIT_LIST_HEAD(&br->age_list);
 
         br_stp_timer_init(br);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index bb90cd7bace..6e280a8a31e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,33 +101,30 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
          pppoe_proto(skb) == htons(PPP_IPV6) && \
          brnf_filter_pppoe_tagged)
 
-/* We need these fake structures to make netfilter happy --
- * lots of places assume that skb->dst != NULL, which isn't
- * all that unreasonable.
- *
+/*
+ * Initialize bogus route table used to keep netfilter happy.
  * Currently, we fill in the PMTU entry because netfilter
  * refragmentation needs it, and the rt_flags entry because
  * ipt_REJECT needs it.  Future netfilter modules might
- * require us to fill additional fields. */
-static struct net_device __fake_net_device = {
-        .hard_header_len        = ETH_HLEN,
-#ifdef CONFIG_NET_NS
-        .nd_net                 = &init_net,
-#endif
-};
+ * require us to fill additional fields.
+ */
+void br_netfilter_rtable_init(struct net_bridge *br)
+{
+        struct rtable *rt = &br->fake_rtable;
 
-static struct rtable __fake_rtable = {
-        .u = {
-                .dst = {
-                        .__refcnt               = ATOMIC_INIT(1),
-                        .dev                    = &__fake_net_device,
-                        .path                   = &__fake_rtable.u.dst,
-                        .metrics                = {[RTAX_MTU - 1] = 1500},
-                        .flags                  = DST_NOXFRM,
-                }
-        },
-        .rt_flags       = 0,
-};
+        atomic_set(&rt->u.dst.__refcnt, 1);
+        rt->u.dst.dev = &br->dev;
+        rt->u.dst.path = &rt->u.dst;
+        rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
+        rt->u.dst.flags = DST_NOXFRM;
+}
+
+static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
+{
+        struct net_bridge_port *port = rcu_dereference(dev->br_port);
+
+        return port ? &port->br->fake_rtable : NULL;
+}
 
 static inline struct net_device *bridge_parent(const struct net_device *dev)
 {
@@ -226,8 +223,12 @@ static int br_nf_pre_routing_finish_ipv6(struct sk_buff *skb)
         }
         nf_bridge->mask ^= BRNF_NF_BRIDGE_PREROUTING;
 
-        skb->rtable = &__fake_rtable;
-        dst_hold(&__fake_rtable.u.dst);
+        skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+        if (!skb->rtable) {
+                kfree_skb(skb);
+                return 0;
+        }
+        dst_hold(&skb->rtable->u.dst);
 
         skb->dev = nf_bridge->physindev;
         nf_bridge_push_encap_header(skb);
@@ -391,8 +392,12 @@ bridged_dnat:
                         skb->pkt_type = PACKET_HOST;
                 }
         } else {
-                skb->rtable = &__fake_rtable;
-                dst_hold(&__fake_rtable.u.dst);
+                skb->rtable = bridge_parent_rtable(nf_bridge->physindev);
+                if (!skb->rtable) {
+                        kfree_skb(skb);
+                        return 0;
+                }
+                dst_hold(&skb->rtable->u.dst);
         }
 
         skb->dev = nf_bridge->physindev;
@@ -611,8 +616,8 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        if (skb->rtable == &__fake_rtable) {
-                dst_release(&__fake_rtable.u.dst);
+        if (skb->rtable && skb->rtable == bridge_parent_rtable(in)) {
+                dst_release(&skb->rtable->u.dst);
                 skb->rtable = NULL;
         }
 
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 815ed38925b..c3dc18ddc04 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -15,6 +15,7 @@
 
 #include <linux/netdevice.h>
 #include <linux/if_bridge.h>
+#include <net/route.h>
 
 #define BR_HASH_BITS 8
 #define BR_HASH_SIZE (1 << BR_HASH_BITS)
@@ -92,6 +93,9 @@ struct net_bridge
         struct hlist_head               hash[BR_HASH_SIZE];
         struct list_head                age_list;
         unsigned long                   feature_mask;
+#ifdef CONFIG_BRIDGE_NETFILTER
+        struct rtable                   fake_rtable;
+#endif
         unsigned long                   flags;
 #define BR_SET_MAC_ADDR         0x00000001
 
@@ -197,9 +201,11 @@ extern int br_ioctl_deviceless_stub(struct net *net, unsigned int cmd, void __us
 #ifdef CONFIG_BRIDGE_NETFILTER
 extern int br_netfilter_init(void);
 extern void br_netfilter_fini(void);
+extern void br_netfilter_rtable_init(struct net_bridge *);
 #else
 #define br_netfilter_init()     (0)
 #define br_netfilter_fini()     do { } while(0)
+#define br_netfilter_rtable_init(x)
 #endif
 
 /* br_stp.c */
diff --git a/net/core/dev.c b/net/core/dev.c
index 63d6bcddbf4..69320a56a08 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4200,6 +4200,7 @@ static void netdev_init_queues(struct net_device *dev)
 {
         netdev_init_one_queue(dev, &dev->rx_queue, NULL);
         netdev_for_each_tx_queue(dev, netdev_init_one_queue, NULL);
+        spin_lock_init(&dev->tx_global_lock);
 }
 
 /**
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index c12720895ec..6c7af390be0 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -70,6 +70,7 @@ static void queue_process(struct work_struct *work)
                 local_irq_save(flags);
                 __netif_tx_lock(txq, smp_processor_id());
                 if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq) ||
                     dev->hard_start_xmit(skb, dev) != NETDEV_TX_OK) {
                         skb_queue_head(&npinfo->txq, skb);
                         __netif_tx_unlock(txq);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index c7d484f7e1c..3284605f2ec 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3305,6 +3305,7 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         txq = netdev_get_tx_queue(odev, queue_map);
         if (netif_tx_queue_stopped(txq) ||
+            netif_tx_queue_frozen(txq) ||
             need_resched()) {
                 idle_start = getCurUs();
 
@@ -3320,7 +3321,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
                 pkt_dev->idle_acc += getCurUs() - idle_start;
 
-                if (netif_tx_queue_stopped(txq)) {
+                if (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)) {
                         pkt_dev->next_tx_us = getCurUs();       /* TODO */
                         pkt_dev->next_tx_ns = 0;
                         goto out;       /* Try the next interface */
@@ -3352,7 +3354,8 @@ static __inline__ void pktgen_xmit(struct pktgen_dev *pkt_dev)
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        if (!netif_tx_queue_stopped(txq)) {
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq)) {
 
                 atomic_inc(&(pkt_dev->skb->users));
               retry_now:
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 1819ad7ab91..fafe8ebb4c5 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -475,11 +475,10 @@ static void arp_print(struct arp_payload *payload)
 #define HBUFFERLEN 30
         char hbuffer[HBUFFERLEN];
         int j,k;
-        const char hexbuf[]= "0123456789abcdef";
 
         for (k=0, j=0; k < HBUFFERLEN-3 && j < ETH_ALEN; j++) {
-                hbuffer[k++]=hexbuf[(payload->src_hw[j]>>4)&15];
-                hbuffer[k++]=hexbuf[payload->src_hw[j]&15];
+                hbuffer[k++] = hex_asc_hi(payload->src_hw[j]);
+                hbuffer[k++] = hex_asc_lo(payload->src_hw[j]);
                 hbuffer[k++]=':';
         }
         hbuffer[--k]='\0';
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 21cb053f5d7..3974d7cae5c 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -305,10 +305,10 @@ static void recent_mt_destroy(const struct xt_match *match, void *matchinfo)
                 spin_lock_bh(&recent_lock);
                 list_del(&t->list);
                 spin_unlock_bh(&recent_lock);
-                recent_table_flush(t);
 #ifdef CONFIG_PROC_FS
                 remove_proc_entry(t->name, proc_dir);
 #endif
+                recent_table_flush(t);
                 kfree(t);
         }
         mutex_unlock(&recent_mutex);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a72a5ad46ec..1bfa078ddbd 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3223,7 +3223,9 @@ int __init ip_rt_init(void)
  */
 void __init ip_static_sysctl_init(void)
 {
+#ifdef CONFIG_SYSCTL
         register_sysctl_paths(ipv4_route_path, ipv4_route_table);
+#endif
 }
 #endif
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b3875c0d83c..91a8cfddf1c 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -655,8 +655,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                 rep.th.doff = arg.iov[0].iov_len/4;
 
                 tcp_v4_md5_hash_hdr((__u8 *) &rep.opt[offset],
-                                    key, ip_hdr(skb)->daddr,
-                                    ip_hdr(skb)->saddr, &rep.th);
+                                    key, ip_hdr(skb)->saddr,
+                                    ip_hdr(skb)->daddr, &rep.th);
         }
 #endif
         arg.csum = csum_tcpudp_nofold(ip_hdr(skb)->daddr,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6811901e6b1..a027003d69a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -236,6 +236,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb_reset_network_header(skb);
         hdr = ipv6_hdr(skb);
 
+        /* Allow local fragmentation. */
+        if (ipfragok)
+                skb->local_df = 1;
+
         /*
          *      Fill in the IPv6 header
          */
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 1db45216b23..78185a40921 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -748,7 +748,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
         ipv6_addr_copy(&bp->saddr, saddr);
         ipv6_addr_copy(&bp->daddr, daddr);
         bp->protocol = cpu_to_be32(IPPROTO_TCP);
-        bp->len = cpu_to_be16(nbytes);
+        bp->len = cpu_to_be32(nbytes);
 
         sg_init_one(&sg, bp, sizeof(*bp));
         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
@@ -1094,8 +1094,8 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
-                                    &ipv6_hdr(skb)->daddr,
-                                    &ipv6_hdr(skb)->saddr, t1);
+                                    &ipv6_hdr(skb)->saddr,
+                                    &ipv6_hdr(skb)->daddr, t1);
         }
 #endif
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 420a10d8eb1..6f61261888e 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -67,7 +67,8 @@ static const char *const tcp_conntrack_names[] = {
 /* RFC1122 says the R2 limit should be at least 100 seconds.
    Linux uses 15 packets as limit, which corresponds
    to ~13-30min depending on RTO. */
-static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_max_retrans __read_mostly    =   5 MINS;
+static unsigned int nf_ct_tcp_timeout_unacknowledged __read_mostly =   5 MINS;
 
 static unsigned int tcp_timeouts[TCP_CONNTRACK_MAX] __read_mostly = {
         [TCP_CONNTRACK_SYN_SENT]        = 2 MINS,
@@ -625,8 +626,10 @@ static bool tcp_in_window(const struct nf_conn *ct,
                 swin = win + (sack - ack);
                 if (sender->td_maxwin < swin)
                         sender->td_maxwin = swin;
-                if (after(end, sender->td_end))
+                if (after(end, sender->td_end)) {
                         sender->td_end = end;
+                        sender->flags |= IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
+                }
                 /*
                  * Update receiver data.
                  */
@@ -637,6 +640,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         if (win == 0)
                                 receiver->td_maxend++;
                 }
+                if (ack == receiver->td_end)
+                        receiver->flags &= ~IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED;
 
                 /*
                  * Check retransmissions.
@@ -951,9 +956,16 @@ static int tcp_packet(struct nf_conn *ct,
         if (old_state != new_state
             && new_state == TCP_CONNTRACK_FIN_WAIT)
                 ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
-        timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
-                  && tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
-                  ? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
+
+        if (ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans &&
+            tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans)
+                timeout = nf_ct_tcp_timeout_max_retrans;
+        else if ((ct->proto.tcp.seen[0].flags | ct->proto.tcp.seen[1].flags) &
+                 IP_CT_TCP_FLAG_DATA_UNACKNOWLEDGED &&
+                 tcp_timeouts[new_state] > nf_ct_tcp_timeout_unacknowledged)
+                timeout = nf_ct_tcp_timeout_unacknowledged;
+        else
+                timeout = tcp_timeouts[new_state];
         write_unlock_bh(&tcp_lock);
 
         nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
@@ -1236,6 +1248,13 @@ static struct ctl_table tcp_sysctl_table[] = {
                 .proc_handler   = &proc_dointvec_jiffies,
         },
         {
+                .procname       = "nf_conntrack_tcp_timeout_unacknowledged",
+                .data           = &nf_ct_tcp_timeout_unacknowledged,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+        },
+        {
                 .ctl_name       = NET_NF_CONNTRACK_TCP_LOOSE,
                 .procname       = "nf_conntrack_tcp_loose",
                 .data           = &nf_ct_tcp_loose,
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 6809af542a2..d9418a26781 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -367,9 +367,7 @@ static void htable_gc(unsigned long htlong)
 
 static void htable_destroy(struct xt_hashlimit_htable *hinfo)
 {
-        /* remove timer, if it is pending */
-        if (timer_pending(&hinfo->timer))
-                del_timer(&hinfo->timer);
+        del_timer_sync(&hinfo->timer);
 
         /* remove proc entry */
         remove_proc_entry(hinfo->pde->name,
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 345838a2e36..9c9cd4d9489 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -135,7 +135,8 @@ static inline int qdisc_restart(struct Qdisc *q)
         txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
 
         HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_subqueue_stopped(dev, skb))
+        if (!netif_tx_queue_stopped(txq) &&
+            !netif_tx_queue_frozen(txq))
                 ret = dev_hard_start_xmit(skb, dev, txq);
         HARD_TX_UNLOCK(dev, txq);
 
@@ -162,7 +163,8 @@ static inline int qdisc_restart(struct Qdisc *q)
                 break;
         }
 
-        if (ret && netif_tx_queue_stopped(txq))
+        if (ret && (netif_tx_queue_stopped(txq) ||
+                    netif_tx_queue_frozen(txq)))
                 ret = 0;
 
         return ret;
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 537223642b6..2c35c678563 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -305,10 +305,11 @@ restart:
 
                 switch (teql_resolve(skb, skb_res, slave)) {
                 case 0:
-                        if (netif_tx_trylock(slave)) {
-                                if (!__netif_subqueue_stopped(slave, subq) &&
+                        if (__netif_tx_trylock(slave_txq)) {
+                                if (!netif_tx_queue_stopped(slave_txq) &&
+                                    !netif_tx_queue_frozen(slave_txq) &&
                                     slave->hard_start_xmit(skb, slave) == 0) {
-                                        netif_tx_unlock(slave);
+                                        __netif_tx_unlock(slave_txq);
                                         master->slaves = NEXT_SLAVE(q);
                                         netif_wake_queue(dev);
                                         master->stats.tx_packets++;
@@ -316,7 +317,7 @@ restart:
                                                 qdisc_pkt_len(skb);
                                         return 0;
                                 }
-                                netif_tx_unlock(slave);
+                                __netif_tx_unlock(slave_txq);
                         }
                         if (netif_queue_stopped(dev))
                                 busy = 1;