Merge commit master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 of HEAD

* HEAD:
  [NET]: fix __sk_stream_mem_reclaim
  [Bluetooth] Fix deadlock in the L2CAP layer
  [Bluetooth] Let BT_HIDP depend on INPUT
  [Bluetooth] Avoid NULL pointer dereference with tty->driver
  [Bluetooth] Remaining transitions to use kzalloc()
  [WAN]: converting generic HDLC to use netif_dormant*()
  [IPV4]: Fix error handling for fib_insert_node call
  [NETROM] lockdep: fix false positive
  [ROSE] lockdep: fix false positive
  [AX.25]: Optimize AX.25 socket list lock
  [IPCOMP]: Fix truesize after decompression
  [IPV6]: Use ipv6_addr_src_scope for link address sorting.
  [TCP] tcp_highspeed: Fix AI updates.
  [MAINTAINERS]: Add proper entry for TC classifier
  [NETROM]: Drop lock before calling nr_destroy_socket
  [NETROM]: Fix locking order when establishing a NETROM circuit.
  [AX.25]: Fix locking of ax25 protocol function list.
  [IPV6]: order addresses by scope

9 files changed, 26 insertions, 36 deletions

diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 6fb47e00e188..be04e9fb11f6 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -75,15 +75,13 @@
 
 static struct cmtp_application *cmtp_application_add(struct cmtp_session *session, __u16 appl)
 {
-        struct cmtp_application *app = kmalloc(sizeof(*app), GFP_KERNEL);
+        struct cmtp_application *app = kzalloc(sizeof(*app), GFP_KERNEL);
 
         BT_DBG("session %p application %p appl %d", session, app, appl);
 
         if (!app)
                 return NULL;
 
-        memset(app, 0, sizeof(*app));
-
         app->state = BT_OPEN;
         app->appl = appl;
 
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 182254a580e2..b81a01c64aea 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -335,10 +335,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
         baswap(&src, &bt_sk(sock->sk)->src);
         baswap(&dst, &bt_sk(sock->sk)->dst);
 
-        session = kmalloc(sizeof(struct cmtp_session), GFP_KERNEL);
+        session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
         if (!session) 
                 return -ENOMEM;
-        memset(session, 0, sizeof(struct cmtp_session));
 
         down_write(&cmtp_session_sem);
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 54e8e5ea2154..5ed474277903 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -336,9 +336,8 @@ void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 
         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
                 /* Entry not in the cache. Add new one. */
-                if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
+                if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
                         return;
-                memset(e, 0, sizeof(struct inquiry_entry));
                 e->next     = cache->list;
                 cache->list = e;
         }
@@ -800,12 +799,10 @@ struct hci_dev *hci_alloc_dev(void)
 {
         struct hci_dev *hdev;
 
-        hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL);
+        hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
         if (!hdev)
                 return NULL;
 
-        memset(hdev, 0, sizeof(struct hci_dev));
-
         skb_queue_head_init(&hdev->driver_init);
 
         return hdev;
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index edfea772fb67..c6abf2a5a932 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,7 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && (BROKEN || !S390)
-        select INPUT
+        depends on BT && BT_L2CAP && INPUT
         help
           HIDP (Human Interface Device Protocol) is a transport layer
           for HID reports.  HIDP is required for the Bluetooth Human
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b9c24a55425c..c6e3a2c27c6e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -582,10 +582,9 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
                 return -ENOTUNIQ;
 
-        session = kmalloc(sizeof(struct hidp_session), GFP_KERNEL);
+        session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
         if (!session)
                 return -ENOMEM;
-        memset(session, 0, sizeof(struct hidp_session));
 
         session->input = input_allocate_device();
         if (!session->input) {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index eaaad658d11d..d56f60b392ac 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -185,7 +185,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 {
         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 
-        write_lock(&l->lock);
+        write_lock_bh(&l->lock);
         if (sk == l->head)
                 l->head = next;
 
@@ -193,7 +193,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
                 l2cap_pi(next)->prev_c = prev;
         if (prev)
                 l2cap_pi(prev)->next_c = next;
-        write_unlock(&l->lock);
+        write_unlock_bh(&l->lock);
 
         __sock_put(sk);
 }
@@ -313,9 +313,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 {
         struct l2cap_chan_list *l = &conn->chan_list;
-        write_lock(&l->lock);
+        write_lock_bh(&l->lock);
         __l2cap_chan_add(conn, sk, parent);
-        write_unlock(&l->lock);
+        write_unlock_bh(&l->lock);
 }
 
 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
@@ -328,14 +328,14 @@ static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
          *  200 - 254 are used by utilities like l2ping, etc.
          */
 
-        spin_lock(&conn->lock);
+        spin_lock_bh(&conn->lock);
 
         if (++conn->tx_ident > 128)
                 conn->tx_ident = 1;
 
         id = conn->tx_ident;
 
-        spin_unlock(&conn->lock);
+        spin_unlock_bh(&conn->lock);
 
         return id;
 }
@@ -1416,11 +1416,11 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         if (!sk)
                 goto response;
 
-        write_lock(&list->lock);
+        write_lock_bh(&list->lock);
 
         /* Check if we already have channel with that dcid */
         if (__l2cap_get_chan_by_dcid(list, scid)) {
-                write_unlock(&list->lock);
+                write_unlock_bh(&list->lock);
                 sock_set_flag(sk, SOCK_ZAPPED);
                 l2cap_sock_kill(sk);
                 goto response;
@@ -1458,7 +1458,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         result = status = 0;
 
 done:
-        write_unlock(&list->lock);
+        write_unlock_bh(&list->lock);
 
 response:
         bh_unlock_sock(parent);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 155a2b93760e..77eab8f4c7fd 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -273,10 +273,10 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 
 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 {
-        struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
+        struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
+
         if (!d)
                 return NULL;
-        memset(d, 0, sizeof(*d));
 
         init_timer(&d->timer);
         d->timer.function = rfcomm_dlc_timeout;
@@ -289,6 +289,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
         rfcomm_dlc_clear_state(d);
         
         BT_DBG("%p", d);
+
         return d;
 }
 
@@ -522,10 +523,10 @@ int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 /* ---- RFCOMM sessions ---- */
 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 {
-        struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
+
         if (!s)
                 return NULL;
-        memset(s, 0, sizeof(*s));
 
         BT_DBG("session %p sock %p", s, sock);
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 2ff2d5b87c93..bd8d671a0ba6 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -169,10 +169,9 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 
         BT_DBG("id %d channel %d", req->dev_id, req->channel);
         
-        dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
         if (!dev)
                 return -ENOMEM;
-        memset(dev, 0, sizeof(struct rfcomm_dev));
 
         write_lock_bh(&rfcomm_dev_lock);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 85defccc0287..7714a2ec3854 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -108,17 +108,14 @@ static void sco_sock_init_timer(struct sock *sk)
 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
 {
         struct hci_dev *hdev = hcon->hdev;
-        struct sco_conn *conn;
-
-        if ((conn = hcon->sco_data))
-                return conn;
+        struct sco_conn *conn = hcon->sco_data;
 
-        if (status)
+        if (conn || status)
                 return conn;
 
-        if (!(conn = kmalloc(sizeof(struct sco_conn), GFP_ATOMIC)))
+        conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
+        if (!conn)
                 return NULL;
-        memset(conn, 0, sizeof(struct sco_conn));
 
         spin_lock_init(&conn->lock);
 
@@ -134,6 +131,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
                 conn->mtu = 60;
 
         BT_DBG("hcon %p conn %p", hcon, conn);
+
         return conn;
 }