Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup
  e1000: add missing length check to e1000 receive routine
  forcedeth: add phy_power_down parameter, leave phy powered up by default (v2)
  Bluetooth: Remove useless flush_work() causing lockdep warnings

4 files changed, 33 insertions, 16 deletions

diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index b1419e21b46b..fffb006b7d95 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -4027,8 +4027,9 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                  PCI_DMA_FROMDEVICE);
 
                 length = le16_to_cpu(rx_desc->length);
-
-                if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
+                /* !EOP means multiple descriptors were used to store a single
+                 * packet, also make sure the frame isn't just CRC only */
+                if (unlikely(!(status & E1000_RXD_STAT_EOP) || (length <= 4))) {
                         /* All receives must fit into a single buffer */
                         E1000_DBG("%s: Receive packet consumed multiple"
                                   " buffers\n", netdev->name);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index f9a846b1b92f..9f6a68fb7b45 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -897,6 +897,12 @@ enum {
 };
 static int phy_cross = NV_CROSSOVER_DETECTION_DISABLED;
 
+/*
+ * Power down phy when interface is down (persists through reboot;
+ * older Linux and other OSes may not power it up again)
+ */
+static int phy_power_down = 0;
+
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
         return netdev_priv(dev);
@@ -1485,7 +1491,10 @@ static int phy_init(struct net_device *dev)
 
         /* restart auto negotiation, power down phy */
         mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
-        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE | BMCR_PDOWN);
+        mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE);
+        if (phy_power_down) {
+                mii_control |= BMCR_PDOWN;
+        }
         if (mii_rw(dev, np->phyaddr, MII_BMCR, mii_control)) {
                 return PHY_ERROR;
         }
@@ -5513,7 +5522,7 @@ static int nv_close(struct net_device *dev)
 
         nv_drain_rxtx(dev);
 
-        if (np->wolenabled) {
+        if (np->wolenabled || !phy_power_down) {
                 writel(NVREG_PFF_ALWAYS|NVREG_PFF_MYADDR, base + NvRegPacketFilterFlags);
                 nv_start_rx(dev);
         } else {
@@ -6367,6 +6376,8 @@ module_param(dma_64bit, int, 0);
 MODULE_PARM_DESC(dma_64bit, "High DMA is enabled by setting to 1 and disabled by setting to 0.");
 module_param(phy_cross, int, 0);
 MODULE_PARM_DESC(phy_cross, "Phy crossover detection for Realtek 8201 phy is enabled by setting to 1 and disabled by setting to 0.");
+module_param(phy_power_down, int, 0);
+MODULE_PARM_DESC(phy_power_down, "Power down phy and disable link when interface is down (1), or leave phy powered up (0).");
 
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 4cc3624bd22d..95f7a7a544b4 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -90,9 +90,6 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work_add);
         struct hci_dev *hdev = conn->hdev;
 
-        /* ensure previous del is complete */
-        flush_work(&conn->work_del);
-
         dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
         if (device_add(&conn->dev) < 0) {
@@ -118,9 +115,6 @@ static void del_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work_del);
         struct hci_dev *hdev = conn->hdev;
 
-        /* ensure previous add is complete */
-        flush_work(&conn->work_add);
-
         if (!device_is_registered(&conn->dev))
                 return;
 
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 0759f32e9dca..09cdcdfe7e91 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -135,6 +135,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n, void *arg)
         unsigned long cl;
         unsigned long fh;
         int err;
+        int tp_created = 0;
 
         if (net != &init_net)
                 return -EINVAL;
@@ -266,10 +267,7 @@ replay:
                         goto errout;
                 }
 
-                spin_lock_bh(root_lock);
-                tp->next = *back;
-                *back = tp;
-                spin_unlock_bh(root_lock);
+                tp_created = 1;
 
         } else if (tca[TCA_KIND] && nla_strcmp(tca[TCA_KIND], tp->ops->kind))
                 goto errout;
@@ -296,8 +294,11 @@ replay:
                 switch (n->nlmsg_type) {
                 case RTM_NEWTFILTER:
                         err = -EEXIST;
-                        if (n->nlmsg_flags & NLM_F_EXCL)
+                        if (n->nlmsg_flags & NLM_F_EXCL) {
+                                if (tp_created)
+                                        tcf_destroy(tp);
                                 goto errout;
+                        }
                         break;
                 case RTM_DELTFILTER:
                         err = tp->ops->delete(tp, fh);
@@ -314,8 +315,18 @@ replay:
         }
 
         err = tp->ops->change(tp, cl, t->tcm_handle, tca, &fh);
-        if (err == 0)
+        if (err == 0) {
+                if (tp_created) {
+                        spin_lock_bh(root_lock);
+                        tp->next = *back;
+                        *back = tp;
+                        spin_unlock_bh(root_lock);
+                }
                 tfilter_notify(skb, n, tp, fh, RTM_NEWTFILTER);
+        } else {
+                if (tp_created)
+                        tcf_destroy(tp);
+        }
 
 errout:
         if (cl)