Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (59 commits)
  igbvf.txt: Add igbvf Documentation
  igb.txt: Add igb documentation
  e100/e1000*/igb*/ixgb*: Add missing read memory barrier
  ixgbe: fix build error with FCOE_CONFIG without DCB_CONFIG
  netxen: protect tx timeout recovery by rtnl lock
  isdn: gigaset: use after free
  isdn: gigaset: add missing unlock
  solos-pci: Fix race condition in tasklet RX handling
  pkt_sched: Fix sch_sfq vs tcf_bind_filter oops
  net: disable preemption before call smp_processor_id()
  tcp: no md5sig option size check bug
  iwlwifi: fix locking assertions
  iwlwifi: fix TX tracer
  isdn: fix information leak
  net: Fix napi_gro_frags vs netpoll path
  usbnet: remove noisy and hardly useful printk
  rtl8180: avoid potential NULL deref in rtl8180_beacon_work
  ath9k: Remove myself from the MAINTAINERS list
  libertas: scan before assocation if no BSSID was given
  libertas: fix association with some APs by using extended rates
  ...

1 files changed, 6 insertions, 1 deletions

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 6174965d9a4d..f916ddf63938 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -781,7 +781,8 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
         sk_for_each(s, node, head) {
                 vcc = atm_sk(s);
                 if (vcc->dev == dev && vcc->vci == vci &&
-                    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE)
+                    vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
+                    test_bit(ATM_VF_READY, &vcc->flags))
                         goto out;
         }
         vcc = NULL;
@@ -907,6 +908,10 @@ static void pclose(struct atm_vcc *vcc)
         clear_bit(ATM_VF_ADDR, &vcc->flags);
         clear_bit(ATM_VF_READY, &vcc->flags);
 
+        /* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
+           tasklet has finished processing any incoming packets (and, more to
+           the point, using the vcc pointer). */
+        tasklet_unlock_wait(&card->tlet);
         return;
 }