Merge git://github.com/davem330/net

* git://github.com/davem330/net:
  pch_gbe: Fixed the issue on which a network freezes
  pch_gbe: Fixed the issue on which PC was frozen when link was downed.
  make PACKET_STATISTICS getsockopt report consistently between ring and non-ring
  net: xen-netback: correctly restart Tx after a VM restore/migrate
  bonding: properly stop queuing work when requested
  can bcm: fix incomplete tx_setup fix
  RDSRDMA: Fix cleanup of rds_iw_mr_pool
  net: Documentation: Fix type of variables
  ibmveth: Fix oops on request_irq failure
  ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket
  cxgb4: Fix EEH on IBM P7IOC
  can bcm: fix tx_setup off-by-one errors
  MAINTAINERS: tehuti: Alexander Indenbaum's address bounces
  dp83640: reduce driver noise
  ptp: fix L2 event message recognition

4 files changed, 40 insertions, 34 deletions

diff --git a/net/can/bcm.c b/net/can/bcm.c
index d6c8ae5b2e6a..c84963d2dee6 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -344,6 +344,18 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
         }
 }
 
+static void bcm_tx_start_timer(struct bcm_op *op)
+{
+        if (op->kt_ival1.tv64 && op->count)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
+        else if (op->kt_ival2.tv64)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival2),
+                              HRTIMER_MODE_ABS);
+}
+
 static void bcm_tx_timeout_tsklet(unsigned long data)
 {
         struct bcm_op *op = (struct bcm_op *)data;
@@ -365,26 +377,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
 
                         bcm_send_to_user(op, &msg_head, NULL, 0);
                 }
-        }
-
-        if (op->kt_ival1.tv64 && (op->count > 0)) {
-
-                /* send (next) frame */
                 bcm_can_tx(op);
-                hrtimer_start(&op->timer,
-                              ktime_add(ktime_get(), op->kt_ival1),
-                              HRTIMER_MODE_ABS);
 
-        } else {
-                if (op->kt_ival2.tv64) {
+        } else if (op->kt_ival2.tv64)
+                bcm_can_tx(op);
 
-                        /* send (next) frame */
-                        bcm_can_tx(op);
-                        hrtimer_start(&op->timer,
-                                      ktime_add(ktime_get(), op->kt_ival2),
-                                      HRTIMER_MODE_ABS);
-                }
-        }
+        bcm_tx_start_timer(op);
 }
 
 /*
@@ -964,23 +962,20 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                         hrtimer_cancel(&op->timer);
         }
 
-        if ((op->flags & STARTTIMER) &&
-            ((op->kt_ival1.tv64 && op->count) || op->kt_ival2.tv64)) {
-
+        if (op->flags & STARTTIMER) {
+                hrtimer_cancel(&op->timer);
                 /* spec: send can_frame when starting timer */
                 op->flags |= TX_ANNOUNCE;
-
-                if (op->kt_ival1.tv64 && (op->count > 0)) {
-                        /* op->count-- is done in bcm_tx_timeout_handler */
-                        hrtimer_start(&op->timer, op->kt_ival1,
-                                      HRTIMER_MODE_REL);
-                } else
-                        hrtimer_start(&op->timer, op->kt_ival2,
-                                      HRTIMER_MODE_REL);
         }
 
-        if (op->flags & TX_ANNOUNCE)
+        if (op->flags & TX_ANNOUNCE) {
                 bcm_can_tx(op);
+                if (op->count)
+                        op->count--;
+        }
+
+        if (op->flags & STARTTIMER)
+                bcm_tx_start_timer(op);
 
         return msg_head->nframes * CFSIZ + MHSIZ;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3c9fa618b69d..79cc6469508d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1383,6 +1383,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
@@ -1447,6 +1449,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->inet_opt = NULL;
+        newnp->ipv6_ac_list = NULL;
         newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c698cec0a445..fabb4fafa281 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -961,7 +961,10 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         return 0;
 
 drop_n_acct:
-        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+        spin_lock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops++;
+        atomic_inc(&sk->sk_drops);
+        spin_unlock(&sk->sk_receive_queue.lock);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 8b77edbab272..4e1de171866c 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -84,7 +84,8 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                         struct list_head *unmap_list,
-                        struct list_head *kill_list);
+                        struct list_head *kill_list,
+                        int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 
 static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
@@ -499,7 +500,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
         LIST_HEAD(unmap_list);
         LIST_HEAD(kill_list);
         unsigned long flags;
-        unsigned int nfreed = 0, ncleaned = 0, free_goal;
+        unsigned int nfreed = 0, ncleaned = 0, unpinned = 0, free_goal;
         int ret = 0;
 
         rds_iw_stats_inc(s_iw_rdma_mr_pool_flush);
@@ -524,7 +525,8 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
          * will be destroyed by the unmap function.
          */
         if (!list_empty(&unmap_list)) {
-                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list, &kill_list);
+                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list,
+                                                     &kill_list, &unpinned);
                 /* If we've been asked to destroy all MRs, move those
                  * that were simply cleaned to the kill list */
                 if (free_all)
@@ -548,6 +550,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
                 spin_unlock_irqrestore(&pool->list_lock, flags);
         }
 
+        atomic_sub(unpinned, &pool->free_pinned);
         atomic_sub(ncleaned, &pool->dirty_count);
         atomic_sub(nfreed, &pool->item_count);
 
@@ -828,7 +831,8 @@ static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool,
 
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                                 struct list_head *unmap_list,
-                                struct list_head *kill_list)
+                                struct list_head *kill_list,
+                                int *unpinned)
 {
         struct rds_iw_mapping *mapping, *next;
         unsigned int ncleaned = 0;
@@ -855,6 +859,7 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
 
                 spin_lock_irqsave(&pool->list_lock, flags);
                 list_for_each_entry_safe(mapping, next, unmap_list, m_list) {
+                        *unpinned += mapping->m_sg.len;
                         list_move(&mapping->m_list, &laundered);
                         ncleaned++;
                 }