Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Several bug fixes, some to new features appearing in this merge
  window, some that have been around for a while.

  I have a short list of known problems that need to be sorted out, but
  all of them can be solved easily during the run up to 3.6-final.

  I'll be offline until Sunday afternoon, but nothing need hold up
  3.6-rc1 and the close of the merge window, networking wise, at this
  point.

  1) Fix interface check in ipv4 TCP early demux, from Eric Dumazet.

  2) Fix a long standing bug in TCP DMA to userspace offload that can
     hang applications using MSG_TRUNC, from Jiri Kosina.

  3) Don't allow TCP_USER_TIMEOUT to be negative, from Hangbin Liu.

  4) Don't use GFP_KERNEL under spinlock in kaweth driver, from Dan
     Carpenter"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  tcp: perform DMA to userspace only if there is a task waiting for it
  Revert "openvswitch: potential NULL deref in sample()"
  ipv4: fix TCP early demux
  net: fix rtnetlink IFF_PROMISC and IFF_ALLMULTI handling
  USB: kaweth.c: use GFP_ATOMIC under spin_lock
  tcp: Add TCP_USER_TIMEOUT negative value check
  bcma: add missing iounmap on error path
  bcma: fix regression in interrupt assignment on mips
  mac80211_hwsim: fix possible race condition in usage of info->control.sta & control.vif

10 files changed, 36 insertions, 28 deletions

diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index b013b049476d..cc65b45b4368 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -131,7 +131,7 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                         /* backplane irq line is in use, find out who uses
                          * it and set user to irq 0
                          */
-                        list_for_each_entry_reverse(core, &bus->cores, list) {
+                        list_for_each_entry(core, &bus->cores, list) {
                                 if ((1 << bcma_core_mips_irqflag(core)) ==
                                     oldirqflag) {
                                         bcma_core_mips_set_irq(core, 0);
@@ -161,7 +161,7 @@ static void bcma_core_mips_dump_irq(struct bcma_bus *bus)
 {
         struct bcma_device *core;
 
-        list_for_each_entry_reverse(core, &bus->cores, list) {
+        list_for_each_entry(core, &bus->cores, list) {
                 bcma_core_mips_print_irq(core, bcma_core_mips_irq(core));
         }
 }
@@ -224,7 +224,7 @@ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
                 mcore->assigned_irqs = 1;
 
         /* Assign IRQs to all cores on the bus */
-        list_for_each_entry_reverse(core, &bus->cores, list) {
+        list_for_each_entry(core, &bus->cores, list) {
                 int mips_irq;
                 if (core->irq)
                         continue;
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 5672b13d0951..8d0b57164018 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -462,8 +462,10 @@ int bcma_bus_scan(struct bcma_bus *bus)
         while (eromptr < eromend) {
                 struct bcma_device *other_core;
                 struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
-                if (!core)
-                        return -ENOMEM;
+                if (!core) {
+                        err = -ENOMEM;
+                        goto out;
+                }
                 INIT_LIST_HEAD(&core->list);
                 core->bus = bus;
 
@@ -478,7 +480,7 @@ int bcma_bus_scan(struct bcma_bus *bus)
                         } else if (err == -ESPIPE) {
                                 break;
                         }
-                        return err;
+                        goto out;
                 }
 
                 core->core_index = core_num++;
@@ -494,10 +496,12 @@ int bcma_bus_scan(struct bcma_bus *bus)
                 list_add_tail(&core->list, &bus->cores);
         }
 
+        err = 0;
+out:
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 iounmap(eromptr);
 
-        return 0;
+        return err;
 }
 
 int __init bcma_bus_scan_early(struct bcma_bus *bus,
@@ -537,7 +541,7 @@ int __init bcma_bus_scan_early(struct bcma_bus *bus,
                 else if (err == -ESPIPE)
                         break;
                 else if (err < 0)
-                        return err;
+                        goto out;
 
                 core->core_index = core_num++;
                 bus->nr_cores++;
@@ -551,6 +555,7 @@ int __init bcma_bus_scan_early(struct bcma_bus *bus,
                 break;
         }
 
+out:
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 iounmap(eromptr);
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index d8ad55284389..c3d03490c97d 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1314,7 +1314,7 @@ static int kaweth_internal_control_msg(struct usb_device *usb_dev,
         int retv;
         int length = 0; /* shut up GCC */
 
-        urb = usb_alloc_urb(0, GFP_NOIO);
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
         if (!urb)
                 return -ENOMEM;
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 643f968b05ee..00838395778c 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -739,11 +739,6 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         txi = IEEE80211_SKB_CB(skb);
 
-        if (txi->control.vif)
-                hwsim_check_magic(txi->control.vif);
-        if (txi->control.sta)
-                hwsim_check_sta_magic(txi->control.sta);
-
         ieee80211_tx_info_clear_status(txi);
 
         /* frame was transmitted at most favorable rate at first attempt */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 334b930e0de3..bc9e380f0abf 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -659,6 +659,12 @@ static void set_operstate(struct net_device *dev, unsigned char transition)
         }
 }
 
+static unsigned int rtnl_dev_get_flags(const struct net_device *dev)
+{
+        return (dev->flags & ~(IFF_PROMISC | IFF_ALLMULTI)) |
+               (dev->gflags & (IFF_PROMISC | IFF_ALLMULTI));
+}
+
 static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
                                            const struct ifinfomsg *ifm)
 {
@@ -667,7 +673,7 @@ static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
         /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
         if (ifm->ifi_change)
                 flags = (flags & ifm->ifi_change) |
-                        (dev->flags & ~ifm->ifi_change);
+                        (rtnl_dev_get_flags(dev) & ~ifm->ifi_change);
 
         return flags;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 581ecf02c6b5..e7e6eeae49c0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2681,7 +2681,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Cap the max timeout in ms TCP will retry/retrans
                  * before giving up and aborting (ETIMEDOUT) a connection.
                  */
-                icsk->icsk_user_timeout = msecs_to_jiffies(val);
+                if (val < 0)
+                        err = -EINVAL;
+                else
+                        icsk->icsk_user_timeout = msecs_to_jiffies(val);