Merge commit master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 of HEAD

* HEAD:
  [NET]: fix __sk_stream_mem_reclaim
  [Bluetooth] Fix deadlock in the L2CAP layer
  [Bluetooth] Let BT_HIDP depend on INPUT
  [Bluetooth] Avoid NULL pointer dereference with tty->driver
  [Bluetooth] Remaining transitions to use kzalloc()
  [WAN]: converting generic HDLC to use netif_dormant*()
  [IPV4]: Fix error handling for fib_insert_node call
  [NETROM] lockdep: fix false positive
  [ROSE] lockdep: fix false positive
  [AX.25]: Optimize AX.25 socket list lock
  [IPCOMP]: Fix truesize after decompression
  [IPV6]: Use ipv6_addr_src_scope for link address sorting.
  [TCP] tcp_highspeed: Fix AI updates.
  [MAINTAINERS]: Add proper entry for TC classifier
  [NETROM]: Drop lock before calling nr_destroy_socket
  [NETROM]: Fix locking order when establishing a NETROM circuit.
  [AX.25]: Fix locking of ax25 protocol function list.
  [IPV6]: order addresses by scope

3 files changed, 12 insertions, 6 deletions

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 1cb65305e102..23fb9d9768e3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1252,8 +1252,8 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
          */
 
         if (!fa_head) {
-                fa_head = fib_insert_node(t, &err, key, plen);
                 err = 0;
+                fa_head = fib_insert_node(t, &err, key, plen);
                 if (err)
                         goto out_free_new_fa;
         }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 8e0374847532..8a8b5cf2f7fe 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -70,7 +70,8 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
         if (err)
                 goto out;
                 
-        skb_put(skb, dlen - plen);
+        skb->truesize += dlen - plen;
+        __skb_put(skb, dlen - plen);
         memcpy(skb->data, scratch, dlen);
 out:    
         put_cpu();
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index aaa1538c0692..fa3e1aad660c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -139,14 +139,19 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                                 tp->snd_cwnd++;
                 }
         } else {
-                /* Update AIMD parameters */
+                /* Update AIMD parameters.
+                 *
+                 * We want to guarantee that:
+                 *     hstcp_aimd_vals[ca->ai-1].cwnd <
+                 *     snd_cwnd <=
+                 *     hstcp_aimd_vals[ca->ai].cwnd
+                 */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
                                ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
-                } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
-                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai > 0)
+                } else if (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd) {
+                        while (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd)
                                 ca->ai--;
                 }