Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking update from David S. Miller:
 "I think Eric Dumazet and I have dealt with all of the known routing
  cache removal fallout.  Some other minor fixes all around.

  1) Fix RCU of cached routes, particular of output routes which require
     liberation via call_rcu() instead of call_rcu_bh().  From Eric
     Dumazet.

  2) Make sure we purge net device references in cached routes properly.

  3) TG3 driver bug fixes from Michael Chan.

  4) Fix reported 'expires' value in ipv6 routes, from Li Wei.

  5) TUN driver ioctl leaks kernel bytes to userspace, from Mathias
     Krause."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (22 commits)
  ipv4: Properly purge netdev references on uncached routes.
  ipv4: Cache routes in nexthop exception entries.
  ipv4: percpu nh_rth_output cache
  ipv4: Restore old dst_free() behavior.
  bridge: make port attributes const
  ipv4: remove rt_cache_rebuild_count
  net: ipv4: fix RCU races on dst refcounts
  net: TCP early demux cleanup
  tun: Fix formatting.
  net/tun: fix ioctl() based info leaks
  tg3: Update version to 3.124
  tg3: Fix race condition in tg3_get_stats64()
  tg3: Add New 5719 Read DMA workaround
  tg3: Fix Read DMA workaround for 5719 A0.
  tg3: Request APE_LOCK_PHY before PHY access
  ipv6: fix incorrect route 'expires' value passed to userspace
  mISDN: Bugfix only few bytes are transfered on a connection
  seeq: use PTR_RET at init_module of driver
  bnx2x: remove cast around the kmalloc in bnx2x_prev_mark_path
  ipv4: clean up put_child
  ...

26 files changed, 316 insertions, 145 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 406a5226220d..ca447b35b833 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -48,12 +48,6 @@ min_adv_mss - INTEGER
         The advertised MSS depends on the first hop route MTU, but will
         never be lower than this setting.
 
-rt_cache_rebuild_count - INTEGER
-        The per net-namespace route cache emergency rebuild threshold.
-        Any net-namespace having its route cache rebuilt due to
-        a hash bucket chain being too long more than this many times
-        will have its route caching disabled
-
 IP Fragmentation:
 
 ipfrag_high_thresh - INTEGER
diff --git a/drivers/isdn/hardware/mISDN/avmfritz.c b/drivers/isdn/hardware/mISDN/avmfritz.c
index c08fc605e56b..fa6ca4733725 100644
--- a/drivers/isdn/hardware/mISDN/avmfritz.c
+++ b/drivers/isdn/hardware/mISDN/avmfritz.c
@@ -449,7 +449,8 @@ hdlc_fill_fifo(struct bchannel *bch)
 {
         struct fritzcard *fc = bch->hw;
         struct hdlc_hw *hdlc;
-        int count, fs, cnt = 0, idx, fillempty = 0;
+        int count, fs, cnt = 0, idx;
+        bool fillempty = false;
         u8 *p;
         u32 *ptr, val, addr;
 
@@ -462,7 +463,7 @@ hdlc_fill_fifo(struct bchannel *bch)
                         return;
                 count = fs;
                 p = bch->fill;
-                fillempty = 1;
+                fillempty = true;
         } else {
                 count = bch->tx_skb->len - bch->tx_idx;
                 if (count <= 0)
@@ -477,7 +478,7 @@ hdlc_fill_fifo(struct bchannel *bch)
                         hdlc->ctrl.sr.cmd |= HDLC_CMD_XME;
         }
         ptr = (u32 *)p;
-        if (fillempty) {
+        if (!fillempty) {
                 pr_debug("%s.B%d: %d/%d/%d", fc->name, bch->nr, count,
                          bch->tx_idx, bch->tx_skb->len);
                 bch->tx_idx += count;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 9aaf863b4237..dd451c3dd83d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9360,8 +9360,7 @@ static int __devinit bnx2x_prev_mark_path(struct bnx2x *bp)
         struct bnx2x_prev_path_list *tmp_list;
         int rc;
 
-        tmp_list = (struct bnx2x_prev_path_list *)
-                    kmalloc(sizeof(struct bnx2x_prev_path_list), GFP_KERNEL);
+        tmp_list = kmalloc(sizeof(struct bnx2x_prev_path_list), GFP_KERNEL);
         if (!tmp_list) {
                 BNX2X_ERR("Failed to allocate 'bnx2x_prev_path_list'\n");
                 return -ENOMEM;
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 9a009fd6ea1b..bf906c51d82a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -92,7 +92,7 @@ static inline void _tg3_flag_clear(enum TG3_FLAGS flag, unsigned long *bits)
 
 #define DRV_MODULE_NAME         "tg3"
 #define TG3_MAJ_NUM                     3
-#define TG3_MIN_NUM                     123
+#define TG3_MIN_NUM                     124
 #define DRV_MODULE_VERSION      \
         __stringify(TG3_MAJ_NUM) "." __stringify(TG3_MIN_NUM)
 #define DRV_MODULE_RELDATE      "March 21, 2012"
@@ -672,6 +672,12 @@ static int tg3_ape_lock(struct tg3 *tp, int locknum)
                 else
                         bit = 1 << tp->pci_fn;
                 break;
+        case TG3_APE_LOCK_PHY0:
+        case TG3_APE_LOCK_PHY1:
+        case TG3_APE_LOCK_PHY2:
+        case TG3_APE_LOCK_PHY3:
+                bit = APE_LOCK_REQ_DRIVER;
+                break;
         default:
                 return -EINVAL;
         }
@@ -723,6 +729,12 @@ static void tg3_ape_unlock(struct tg3 *tp, int locknum)
                 else
                         bit = 1 << tp->pci_fn;
                 break;
+        case TG3_APE_LOCK_PHY0:
+        case TG3_APE_LOCK_PHY1:
+        case TG3_APE_LOCK_PHY2:
+        case TG3_APE_LOCK_PHY3:
+                bit = APE_LOCK_GRANT_DRIVER;
+                break;
         default:
                 return;
         }
@@ -1052,6 +1064,8 @@ static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
                 udelay(80);
         }
 
+        tg3_ape_lock(tp, tp->phy_ape_lock);
+
         *val = 0x0;
 
         frame_val  = ((tp->phy_addr << MI_COM_PHY_ADDR_SHIFT) &
@@ -1086,6 +1100,8 @@ static int tg3_readphy(struct tg3 *tp, int reg, u32 *val)
                 udelay(80);
         }
 
+        tg3_ape_unlock(tp, tp->phy_ape_lock);
+
         return ret;
 }
 
@@ -1105,6 +1121,8 @@ static int tg3_writephy(struct tg3 *tp, int reg, u32 val)
                 udelay(80);
         }
 
+        tg3_ape_lock(tp, tp->phy_ape_lock);