Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (22 commits)
  [IPCONFIG]: The kernel gets no IP from some DHCP servers
  b43legacy: Fix module init message
  rndis_wlan: fix broken data copy
  libertas: compare the current command with response
  libertas: fix sanity check on sequence number in command response
  p54: fix eeprom parser length sanity checks
  p54: fix EEPROM structure endianness
  ssb: Add pcibios_enable_device() return value check
  rc80211-pid: fix rate adjustment
  [ESP]: Add select on AUTHENC
  [TCP]: Improve ipv4 established hash function.
  [NETPOLL]: Revert two bogus cleanups that broke netconsole.
  [PPPOL2TP]: Add missing sock_put() in pppol2tp_tunnel_closeall()
  Subject: [PPPOL2TP] add missing sock_put() in pppol2tp_recv_dequeue()
  [BLUETOOTH]: l2cap info_timer delete fix in hci_conn_del
  [NET]: Fix race in generic address resolution.
  iucv: fix build error on !SMP
  [TCP]: Must count fack_count also when skipping
  [TUN]: Fix RTNL-locking in tun/tap driver
  [SCTP]: Use proc_create to setup de->proc_fops.
  ...

7 files changed, 35 insertions, 25 deletions

diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index e0b072d9fdb7..86e5dba079fe 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -455,6 +455,7 @@ static void pppol2tp_recv_dequeue(struct pppol2tp_session *session)
                                skb_queue_len(&session->reorder_q));
                         __skb_unlink(skb, &session->reorder_q);
                         kfree_skb(skb);
+                        sock_put(session->sock);
                         continue;
                 }
 
@@ -1110,6 +1111,8 @@ static void pppol2tp_tunnel_closeall(struct pppol2tp_tunnel *tunnel)
         for (hash = 0; hash < PPPOL2TP_HASH_SIZE; hash++) {
 again:
                 hlist_for_each_safe(walk, tmp, &tunnel->session_hlist[hash]) {
+                        struct sk_buff *skb;
+
                         session = hlist_entry(walk, struct pppol2tp_session, hlist);
 
                         sk = session->sock;
@@ -1138,7 +1141,10 @@ again:
                         /* Purge any queued data */
                         skb_queue_purge(&sk->sk_receive_queue);
                         skb_queue_purge(&sk->sk_write_queue);
-                        skb_queue_purge(&session->reorder_q);
+                        while ((skb = skb_dequeue(&session->reorder_q))) {
+                                kfree_skb(skb);
+                                sock_put(sk);
+                        }
 
                         release_sock(sk);
                         sock_put(sk);
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 038c1ef94d2e..7b816a032957 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -663,7 +663,11 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
         case SIOCSIFHWADDR:
         {
                 /* try to set the actual net device's hw address */
-                int ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                int ret;
+
+                rtnl_lock();
+                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
+                rtnl_unlock();
 
                 if (ret == 0) {
                         /** Set the character device's hardware address. This is used when
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index c39de422e220..5f3f34e1dbfd 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3829,7 +3829,7 @@ static void b43legacy_print_driverinfo(void)
 #ifdef CONFIG_B43LEGACY_DMA
         feat_dma = "D";
 #endif
-        printk(KERN_INFO "Broadcom 43xx driver loaded "
+        printk(KERN_INFO "Broadcom 43xx-legacy driver loaded "
                "[ Features: %s%s%s%s%s, Firmware-ID: "
                B43legacy_SUPPORTED_FIRMWARE_ID " ]\n",
                feat_pci, feat_leds, feat_rfkill, feat_pio, feat_dma);
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 159216a91903..bdc6a1cc2103 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -562,9 +562,7 @@ int lbs_process_rx_command(struct lbs_private *priv)
         }
 
         resp = (void *)priv->upld_buf;
-
-        curcmd = le16_to_cpu(resp->command);
-
+        curcmd = le16_to_cpu(priv->cur_cmd->cmdbuf->command);
         respcmd = le16_to_cpu(resp->command);
         result = le16_to_cpu(resp->result);
 
@@ -572,9 +570,9 @@ int lbs_process_rx_command(struct lbs_private *priv)
                      respcmd, le16_to_cpu(resp->seqnum), priv->upld_len, jiffies);
         lbs_deb_hex(LBS_DEB_HOST, "CMD_RESP", (void *) resp, priv->upld_len);
 
-        if (resp->seqnum != resp->seqnum) {
+        if (resp->seqnum != priv->cur_cmd->cmdbuf->seqnum) {
                 lbs_pr_info("Received CMD_RESP with invalid sequence %d (expected %d)\n",
-                            le16_to_cpu(resp->seqnum), le16_to_cpu(resp->seqnum));
+                            le16_to_cpu(resp->seqnum), le16_to_cpu(priv->cur_cmd->cmdbuf->seqnum));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 ret = -1;
                 goto done;
diff --git a/drivers/net/wireless/p54common.c b/drivers/net/wireless/p54common.c
index 5cda49aff3a8..d191e055a788 100644
--- a/drivers/net/wireless/p54common.c
+++ b/drivers/net/wireless/p54common.c
@@ -166,18 +166,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
         struct p54_common *priv = dev->priv;
         struct eeprom_pda_wrap *wrap = NULL;
         struct pda_entry *entry;
-        int i = 0;
         unsigned int data_len, entry_len;
         void *tmp;
         int err;
+        u8 *end = (u8 *)eeprom + len;
 
         wrap = (struct eeprom_pda_wrap *) eeprom;
-        entry = (void *)wrap->data + wrap->len;
-        i += 2;
-        i += le16_to_cpu(entry->len)*2;
-        while (i < len) {
+        entry = (void *)wrap->data + le16_to_cpu(wrap->len);
+
+        /* verify that at least the entry length/code fits */
+        while ((u8 *)entry <= end - sizeof(*entry)) {
                 entry_len = le16_to_cpu(entry->len);
                 data_len = ((entry_len - 1) << 1);
+
+                /* abort if entry exceeds whole structure */
+                if ((u8 *)entry + sizeof(*entry) + data_len > end)
+                        break;
+
                 switch (le16_to_cpu(entry->code)) {
                 case PDR_MAC_ADDRESS:
                         SET_IEEE80211_PERM_ADDR(dev, entry->data);
@@ -249,13 +254,12 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
                         priv->version = *(u8 *)(entry->data + 1);
                         break;
                 case PDR_END:
-                        i = len;
+                        /* make it overrun */
+                        entry_len = len;
                         break;
                 }
 
                 entry = (void *)entry + (entry_len + 1)*2;
-                i += 2;
-                i += entry_len*2;
         }
 
         if (!priv->iq_autocal || !priv->output_limit || !priv->curve_data) {
diff --git a/drivers/net/wireless/p54common.h b/drivers/net/wireless/p54common.h
index a721334e20d9..b67ff34e26fe 100644
--- a/drivers/net/wireless/p54common.h
+++ b/drivers/net/wireless/p54common.h
@@ -53,10 +53,10 @@ struct pda_entry {
 } __attribute__ ((packed));
 
 struct eeprom_pda_wrap {
-        u32 magic;
-        u16 pad;
-        u16 len;
-        u32 arm_opcode;
+        __le32 magic;
+        __le16 pad;
+        __le16 len;
+        __le32 arm_opcode;
         u8 data[0];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index d9460aed1f22..10b776c1adc5 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -260,7 +260,7 @@ struct NDIS_802_11_KEY {
         __le32 KeyLength;
         u8 Bssid[6];
         u8 Padding[6];
-        __le64 KeyRSC;
+        u8 KeyRSC[8];
         u8 KeyMaterial[32];
 } __attribute__((packed));
 
@@ -1508,7 +1508,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         struct usbnet *usbdev = dev->priv;
         struct rndis_wext_private *priv = get_rndis_wext_priv(usbdev);
         struct NDIS_802_11_KEY ndis_key;
-        int i, keyidx, ret;
+        int keyidx, ret;
         u8 *addr;
 
         keyidx = wrqu->encoding.flags & IW_ENCODE_INDEX;
@@ -1543,9 +1543,7 @@ static int rndis_iw_set_encode_ext(struct net_device *dev,
         ndis_key.KeyIndex = cpu_to_le32(keyidx);
 
         if (ext->ext_flags & IW_ENCODE_EXT_RX_SEQ_VALID) {
-                for (i = 0; i < 6; i++)
-                        ndis_key.KeyRSC |=
-                                cpu_to_le64(ext->rx_seq[i] << (i * 8));
+                memcpy(ndis_key.KeyRSC, ext->rx_seq, 6);
                 ndis_key.KeyIndex |= cpu_to_le32(1 << 29);
         }