Merge commit master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 of HEAD

* HEAD:
  [NET]: fix __sk_stream_mem_reclaim
  [Bluetooth] Fix deadlock in the L2CAP layer
  [Bluetooth] Let BT_HIDP depend on INPUT
  [Bluetooth] Avoid NULL pointer dereference with tty->driver
  [Bluetooth] Remaining transitions to use kzalloc()
  [WAN]: converting generic HDLC to use netif_dormant*()
  [IPV4]: Fix error handling for fib_insert_node call
  [NETROM] lockdep: fix false positive
  [ROSE] lockdep: fix false positive
  [AX.25]: Optimize AX.25 socket list lock
  [IPCOMP]: Fix truesize after decompression
  [IPV6]: Use ipv6_addr_src_scope for link address sorting.
  [TCP] tcp_highspeed: Fix AI updates.
  [MAINTAINERS]: Add proper entry for TC classifier
  [NETROM]: Drop lock before calling nr_destroy_socket
  [NETROM]: Fix locking order when establishing a NETROM circuit.
  [AX.25]: Fix locking of ax25 protocol function list.
  [IPV6]: order addresses by scope

1 files changed, 9 insertions, 4 deletions

diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index aaa1538c0692..fa3e1aad660c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -139,14 +139,19 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                                 tp->snd_cwnd++;
                 }
         } else {
-                /* Update AIMD parameters */
+                /* Update AIMD parameters.
+                 *
+                 * We want to guarantee that:
+                 *     hstcp_aimd_vals[ca->ai-1].cwnd <
+                 *     snd_cwnd <=
+                 *     hstcp_aimd_vals[ca->ai].cwnd
+                 */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
                                ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
-                } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
-                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai > 0)
+                } else if (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd) {
+                        while (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd)
                                 ca->ai--;
                 }