Merge commit master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 of HEAD

* HEAD:
  [NET]: fix __sk_stream_mem_reclaim
  [Bluetooth] Fix deadlock in the L2CAP layer
  [Bluetooth] Let BT_HIDP depend on INPUT
  [Bluetooth] Avoid NULL pointer dereference with tty->driver
  [Bluetooth] Remaining transitions to use kzalloc()
  [WAN]: converting generic HDLC to use netif_dormant*()
  [IPV4]: Fix error handling for fib_insert_node call
  [NETROM] lockdep: fix false positive
  [ROSE] lockdep: fix false positive
  [AX.25]: Optimize AX.25 socket list lock
  [IPCOMP]: Fix truesize after decompression
  [IPV6]: Use ipv6_addr_src_scope for link address sorting.
  [TCP] tcp_highspeed: Fix AI updates.
  [MAINTAINERS]: Add proper entry for TC classifier
  [NETROM]: Drop lock before calling nr_destroy_socket
  [NETROM]: Fix locking order when establishing a NETROM circuit.
  [AX.25]: Fix locking of ax25 protocol function list.
  [IPV6]: order addresses by scope

23 files changed, 116 insertions, 86 deletions

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index f12be2acf9bc..000695c48583 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -145,7 +145,7 @@ struct sock *ax25_find_listener(ax25_address *addr, int digi,
         ax25_cb *s;
         struct hlist_node *node;
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(s, node, &ax25_list) {
                 if ((s->iamdigi && !digi) || (!s->iamdigi && digi))
                         continue;
@@ -154,12 +154,12 @@ struct sock *ax25_find_listener(ax25_address *addr, int digi,
                         /* If device is null we match any device */
                         if (s->ax25_dev == NULL || s->ax25_dev->dev == dev) {
                                 sock_hold(s->sk);
-                                spin_unlock_bh(&ax25_list_lock);
+                                spin_unlock(&ax25_list_lock);
                                 return s->sk;
                         }
                 }
         }
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 
         return NULL;
 }
@@ -174,7 +174,7 @@ struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
         ax25_cb *s;
         struct hlist_node *node;
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(s, node, &ax25_list) {
                 if (s->sk && !ax25cmp(&s->source_addr, my_addr) &&
                     !ax25cmp(&s->dest_addr, dest_addr) &&
@@ -185,7 +185,7 @@ struct sock *ax25_get_socket(ax25_address *my_addr, ax25_address *dest_addr,
                 }
         }
 
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 
         return sk;
 }
@@ -235,7 +235,7 @@ void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
         struct sk_buff *copy;
         struct hlist_node *node;
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(s, node, &ax25_list) {
                 if (s->sk != NULL && ax25cmp(&s->source_addr, addr) == 0 &&
                     s->sk->sk_type == SOCK_RAW &&
@@ -248,7 +248,7 @@ void ax25_send_to_raw(ax25_address *addr, struct sk_buff *skb, int proto)
                                 kfree_skb(copy);
                 }
         }
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 }
 
 /*
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index 1d4ab641f82b..4d22d4430ec8 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -80,7 +80,7 @@ void ax25_ds_enquiry_response(ax25_cb *ax25)
         ax25_start_t3timer(ax25);
         ax25_ds_set_timer(ax25->ax25_dev);
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(ax25o, node, &ax25_list) {
                 if (ax25o == ax25)
                         continue;
@@ -106,7 +106,7 @@ void ax25_ds_enquiry_response(ax25_cb *ax25)
                 if (ax25o->state != AX25_STATE_0)
                         ax25_start_t3timer(ax25o);
         }
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 }
 
 void ax25_ds_establish_data_link(ax25_cb *ax25)
@@ -162,13 +162,13 @@ static int ax25_check_dama_slave(ax25_dev *ax25_dev)
         int res = 0;
         struct hlist_node *node;
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(ax25, node, &ax25_list)
                 if (ax25->ax25_dev == ax25_dev && (ax25->condition & AX25_COND_DAMA_MODE) && ax25->state > AX25_STATE_1) {
                         res = 1;
                         break;
                 }
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 
         return res;
 }
diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
index 5961459935eb..4f44185955c7 100644
--- a/net/ax25/ax25_ds_timer.c
+++ b/net/ax25/ax25_ds_timer.c
@@ -85,7 +85,7 @@ static void ax25_ds_timeout(unsigned long arg)
                 return;
         }
 
-        spin_lock_bh(&ax25_list_lock);
+        spin_lock(&ax25_list_lock);
         ax25_for_each(ax25, node, &ax25_list) {
                 if (ax25->ax25_dev != ax25_dev || !(ax25->condition & AX25_COND_DAMA_MODE))
                         continue;
@@ -93,7 +93,7 @@ static void ax25_ds_timeout(unsigned long arg)
                 ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
                 ax25_disconnect(ax25, ETIMEDOUT);
         }
-        spin_unlock_bh(&ax25_list_lock);
+        spin_unlock(&ax25_list_lock);
 
         ax25_dev_dama_off(ax25_dev);
 }
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 77ba07c67682..07ac0207eb69 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -66,10 +66,10 @@ int ax25_protocol_register(unsigned int pid,
         protocol->pid  = pid;
         protocol->func = func;
 
-        write_lock(&protocol_list_lock);
+        write_lock_bh(&protocol_list_lock);
         protocol->next = protocol_list;
         protocol_list  = protocol;
-        write_unlock(&protocol_list_lock);
+        write_unlock_bh(&protocol_list_lock);
 
         return 1;
 }
@@ -80,16 +80,16 @@ void ax25_protocol_release(unsigned int pid)
 {
         struct protocol_struct *s, *protocol;
 
-        write_lock(&protocol_list_lock);
+        write_lock_bh(&protocol_list_lock);
         protocol = protocol_list;
         if (protocol == NULL) {
-                write_unlock(&protocol_list_lock);
+                write_unlock_bh(&protocol_list_lock);
                 return;
         }
 
         if (protocol->pid == pid) {
                 protocol_list = protocol->next;
-                write_unlock(&protocol_list_lock);
+                write_unlock_bh(&protocol_list_lock);
                 kfree(protocol);
                 return;
         }
@@ -98,14 +98,14 @@ void ax25_protocol_release(unsigned int pid)
                 if (protocol->next->pid == pid) {
                         s = protocol->next;
                         protocol->next = protocol->next->next;
-                        write_unlock(&protocol_list_lock);
+                        write_unlock_bh(&protocol_list_lock);
                         kfree(s);
                         return;
                 }
 
                 protocol = protocol->next;
         }
-        write_unlock(&protocol_list_lock);
+        write_unlock_bh(&protocol_list_lock);
 }
 
 EXPORT_SYMBOL(ax25_protocol_release);
@@ -266,13 +266,13 @@ int ax25_protocol_is_registered(unsigned int pid)
         struct protocol_struct *protocol;
         int res = 0;
 
-        read_lock(&protocol_list_lock);
+        read_lock_bh(&protocol_list_lock);
         for (protocol = protocol_list; protocol != NULL; protocol = protocol->next)
                 if (protocol->pid == pid) {
                         res = 1;
                         break;
                 }
-        read_unlock(&protocol_list_lock);
+        read_unlock_bh(&protocol_list_lock);
 
         return res;
 }
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 6fb47e00e188..be04e9fb11f6 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -75,15 +75,13 @@
 
 static struct cmtp_application *cmtp_application_add(struct cmtp_session *session, __u16 appl)
 {
-        struct cmtp_application *app = kmalloc(sizeof(*app), GFP_KERNEL);
+        struct cmtp_application *app = kzalloc(sizeof(*app), GFP_KERNEL);
 
         BT_DBG("session %p application %p appl %d", session, app, appl);
 
         if (!app)
                 return NULL;
 
-        memset(app, 0, sizeof(*app));
-
         app->state = BT_OPEN;
         app->appl = appl;
 
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 182254a580e2..b81a01c64aea 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -335,10 +335,9 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
         baswap(&src, &bt_sk(sock->sk)->src);
         baswap(&dst, &bt_sk(sock->sk)->dst);
 
-        session = kmalloc(sizeof(struct cmtp_session), GFP_KERNEL);
+        session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
         if (!session) 
                 return -ENOMEM;
-        memset(session, 0, sizeof(struct cmtp_session));
 
         down_write(&cmtp_session_sem);
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 54e8e5ea2154..5ed474277903 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -336,9 +336,8 @@ void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 
         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
                 /* Entry not in the cache. Add new one. */
-                if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
+                if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
                         return;
-                memset(e, 0, sizeof(struct inquiry_entry));
                 e->next     = cache->list;
                 cache->list = e;
         }
@@ -800,12 +799,10 @@ struct hci_dev *hci_alloc_dev(void)
 {
         struct hci_dev *hdev;
 
-        hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL);
+        hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
         if (!hdev)
                 return NULL;
 
-        memset(hdev, 0, sizeof(struct hci_dev));
-
         skb_queue_head_init(&hdev->driver_init);
 
         return hdev;
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index edfea772fb67..c6abf2a5a932 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,7 +1,6 @@
 config BT_HIDP
         tristate "HIDP protocol support"
-        depends on BT && BT_L2CAP && (BROKEN || !S390)
-        select INPUT
+        depends on BT && BT_L2CAP && INPUT
         help
           HIDP (Human Interface Device Protocol) is a transport layer
           for HID reports.  HIDP is required for the Bluetooth Human
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b9c24a55425c..c6e3a2c27c6e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -582,10 +582,9 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
                 return -ENOTUNIQ;
 
-        session = kmalloc(sizeof(struct hidp_session), GFP_KERNEL);
+        session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
         if (!session)
                 return -ENOMEM;
-        memset(session, 0, sizeof(struct hidp_session));
 
         session->input = input_allocate_device();
         if (!session->input) {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index eaaad658d11d..d56f60b392ac 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -185,7 +185,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 {
         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 
-        write_lock(&l->lock);
+        write_lock_bh(&l->lock);
         if (sk == l->head)
                 l->head = next;
 
@@ -193,7 +193,7 @@ static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
                 l2cap_pi(next)->prev_c = prev;
         if (prev)
                 l2cap_pi(prev)->next_c = next;
-        write_unlock(&l->lock);
+        write_unlock_bh(&l->lock);
 
         __sock_put(sk);
 }
@@ -313,9 +313,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 {
         struct l2cap_chan_list *l = &conn->chan_list;
-        write_lock(&l->lock);
+        write_lock_bh(&l->lock);
         __l2cap_chan_add(conn, sk, parent);
-        write_unlock(&l->lock);
+        write_unlock_bh(&l->lock);
 }
 
 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
@@ -328,14 +328,14 @@ static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
          *  200 - 254 are used by utilities like l2ping, etc.
          */
 
-        spin_lock(&conn->lock);
+        spin_lock_bh(&conn->lock);
 
         if (++conn->tx_ident > 128)
                 conn->tx_ident = 1;
 
         id = conn->tx_ident;
 
-        spin_unlock(&conn->lock);
+        spin_unlock_bh(&conn->lock);
 
         return id;
 }
@@ -1416,11 +1416,11 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         if (!sk)
                 goto response;
 
-        write_lock(&list->lock);
+        write_lock_bh(&list->lock);
 
         /* Check if we already have channel with that dcid */
         if (__l2cap_get_chan_by_dcid(list, scid)) {
-                write_unlock(&list->lock);
+                write_unlock_bh(&list->lock);
                 sock_set_flag(sk, SOCK_ZAPPED);
                 l2cap_sock_kill(sk);
                 goto response;
@@ -1458,7 +1458,7 @@ static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hd
         result = status = 0;
 
 done:
-        write_unlock(&list->lock);
+        write_unlock_bh(&list->lock);
 
 response:
         bh_unlock_sock(parent);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 155a2b93760e..77eab8f4c7fd 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -273,10 +273,10 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 
 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 {
-        struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
+        struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
+
         if (!d)
                 return NULL;
-        memset(d, 0, sizeof(*d));
 
         init_timer(&d->timer);
         d->timer.function = rfcomm_dlc_timeout;
@@ -289,6 +289,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
         rfcomm_dlc_clear_state(d);
         
         BT_DBG("%p", d);
+
         return d;
 }
 
@@ -522,10 +523,10 @@ int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 /* ---- RFCOMM sessions ---- */
 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 {
-        struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
+        struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
+
         if (!s)
                 return NULL;
-        memset(s, 0, sizeof(*s));
 
         BT_DBG("session %p sock %p", s, sock);
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 2ff2d5b87c93..bd8d671a0ba6 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -169,10 +169,9 @@ static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 
         BT_DBG("id %d channel %d", req->dev_id, req->channel);
         
-        dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
+        dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
         if (!dev)
                 return -ENOMEM;
-        memset(dev, 0, sizeof(struct rfcomm_dev));
 
         write_lock_bh(&rfcomm_dev_lock);
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 85defccc0287..7714a2ec3854 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -108,17 +108,14 @@ static void sco_sock_init_timer(struct sock *sk)
 static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
 {
         struct hci_dev *hdev = hcon->hdev;
-        struct sco_conn *conn;
-
-        if ((conn = hcon->sco_data))
-                return conn;
+        struct sco_conn *conn = hcon->sco_data;
 
-        if (status)
+        if (conn || status)
                 return conn;
 
-        if (!(conn = kmalloc(sizeof(struct sco_conn), GFP_ATOMIC)))
+        conn = kzalloc(sizeof(struct sco_conn), GFP_ATOMIC);
+        if (!conn)
                 return NULL;
-        memset(conn, 0, sizeof(struct sco_conn));
 
         spin_lock_init(&conn->lock);
 
@@ -134,6 +131,7 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
                 conn->mtu = 60;
 
         BT_DBG("hcon %p conn %p", hcon, conn);
+
         return conn;
 }
 
diff --git a/net/core/stream.c b/net/core/stream.c
index e9489696f694..d1d7decf70b0 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -196,15 +196,13 @@ EXPORT_SYMBOL(sk_stream_error);
 
 void __sk_stream_mem_reclaim(struct sock *sk)
 {
-        if (sk->sk_forward_alloc >= SK_STREAM_MEM_QUANTUM) {
-                atomic_sub(sk->sk_forward_alloc / SK_STREAM_MEM_QUANTUM,
-                           sk->sk_prot->memory_allocated);
-                sk->sk_forward_alloc &= SK_STREAM_MEM_QUANTUM - 1;
-                if (*sk->sk_prot->memory_pressure &&
-                    (atomic_read(sk->sk_prot->memory_allocated) <
-                     sk->sk_prot->sysctl_mem[0]))
-                        *sk->sk_prot->memory_pressure = 0;
-        }
+        atomic_sub(sk->sk_forward_alloc / SK_STREAM_MEM_QUANTUM,
+                   sk->sk_prot->memory_allocated);
+        sk->sk_forward_alloc &= SK_STREAM_MEM_QUANTUM - 1;
+        if (*sk->sk_prot->memory_pressure &&
+            (atomic_read(sk->sk_prot->memory_allocated) <
+             sk->sk_prot->sysctl_mem[0]))
+                *sk->sk_prot->memory_pressure = 0;
 }
 
 EXPORT_SYMBOL(__sk_stream_mem_reclaim);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 1cb65305e102..23fb9d9768e3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1252,8 +1252,8 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
          */
 
         if (!fa_head) {
-                fa_head = fib_insert_node(t, &err, key, plen);
                 err = 0;
+                fa_head = fib_insert_node(t, &err, key, plen);
                 if (err)
                         goto out_free_new_fa;
         }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 8e0374847532..8a8b5cf2f7fe 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -70,7 +70,8 @@ static int ipcomp_decompress(struct xfrm_state *x, struct sk_buff *skb)
         if (err)
                 goto out;
                 
-        skb_put(skb, dlen - plen);
+        skb->truesize += dlen - plen;
+        __skb_put(skb, dlen - plen);
         memcpy(skb->data, scratch, dlen);
 out:    
         put_cpu();
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index aaa1538c0692..fa3e1aad660c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -139,14 +139,19 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                                 tp->snd_cwnd++;
                 }
         } else {
-                /* Update AIMD parameters */
+                /* Update AIMD parameters.
+                 *
+                 * We want to guarantee that:
+                 *     hstcp_aimd_vals[ca->ai-1].cwnd <
+                 *     snd_cwnd <=
+                 *     hstcp_aimd_vals[ca->ai].cwnd
+                 */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
                                ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
-                } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
-                        while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai > 0)
+                } else if (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd) {
+                        while (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1].cwnd)
                                 ca->ai--;
                 }
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c250d0af10d7..2316a4315a18 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -508,6 +508,26 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
         kfree(ifp);
 }
 
+static void
+ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
+{
+        struct inet6_ifaddr *ifa, **ifap;
+        int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
+
+        /*
+         * Each device address list is sorted in order of scope -
+         * global before linklocal.
+         */
+        for (ifap = &idev->addr_list; (ifa = *ifap) != NULL;
+             ifap = &ifa->if_next) {
+                if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
+                        break;
+        }
+
+        ifp->if_next = *ifap;
+        *ifap = ifp;
+}
+
 /* On success it returns ifp with increased reference count */
 
 static struct inet6_ifaddr *
@@ -573,8 +593,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 
         write_lock(&idev->lock);
         /* Add to inet6_dev unicast addr list. */
-        ifa->if_next = idev->addr_list;
-        idev->addr_list = ifa;
+        ipv6_link_dev_addr(idev, ifa);
 
 #ifdef CONFIG_IPV6_PRIVACY
         if (ifa->flags&IFA_F_TEMPORARY) {
@@ -987,7 +1006,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                                         continue;
                         } else if (score.scope < hiscore.scope) {
                                 if (score.scope < daddr_scope)
-                                        continue;
+                                        break; /* addresses sorted by scope */
                                 else {
                                         score.rule = 2;
                                         goto record_it;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index b285b0357084..7e4d1c17bfbc 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -109,7 +109,8 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
                 goto out_put_cpu;
         }
 
-        skb_put(skb, dlen - plen);
+        skb->truesize += dlen - plen;
+        __skb_put(skb, dlen - plen);
         memcpy(skb->data, scratch, dlen);
         err = ipch->nexthdr;
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ecc796878f38..1d50f801f181 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -66,6 +66,14 @@ static DEFINE_SPINLOCK(nr_list_lock);
 static const struct proto_ops nr_proto_ops;
 
 /*
+ * NETROM network devices are virtual network devices encapsulating NETROM
+ * frames into AX.25 which will be sent through an AX.25 device, so form a
+ * special "super class" of normal net devices; split their locks off into a
+ * separate class since they always nest.
+ */
+static struct lock_class_key nr_netdev_xmit_lock_key;
+
+/*
  *      Socket removal during an interrupt is now safe.
  */
 static void nr_remove_socket(struct sock *sk)
@@ -986,18 +994,18 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
         nr_make->vl        = 0;
         nr_make->state     = NR_STATE_3;
         sk_acceptq_added(sk);
-
-        nr_insert_socket(make);
-
         skb_queue_head(&sk->sk_receive_queue, skb);
 
-        nr_start_heartbeat(make);
-        nr_start_idletimer(make);
-
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_data_ready(sk, skb->len);
 
         bh_unlock_sock(sk);
+
+        nr_insert_socket(make);
+
+        nr_start_heartbeat(make);
+        nr_start_idletimer(make);
+
         return 1;
 }
 
@@ -1405,6 +1413,7 @@ static int __init nr_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
+                lockdep_set_class(&dev->_xmit_lock, &nr_netdev_xmit_lock_key);
                 dev_nr[i] = dev;
         }
 
diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
index 75b72d389ba9..ddba1c144260 100644
--- a/net/netrom/nr_timer.c
+++ b/net/netrom/nr_timer.c
@@ -138,8 +138,8 @@ static void nr_heartbeat_expiry(unsigned long param)
                 if (sock_flag(sk, SOCK_DESTROY) ||
                     (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
                         sock_hold(sk);
-                        nr_destroy_socket(sk);
                         bh_unlock_sock(sk);
+                        nr_destroy_socket(sk);
                         sock_put(sk);
                         return;
                 }
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index c115295ab431..08a542855654 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -67,6 +67,14 @@ static struct proto_ops rose_proto_ops;
 ax25_address rose_callsign;
 
 /*
+ * ROSE network devices are virtual network devices encapsulating ROSE
+ * frames into AX.25 which will be sent through an AX.25 device, so form a
+ * special "super class" of normal net devices; split their locks off into a
+ * separate class since they always nest.
+ */
+static struct lock_class_key rose_netdev_xmit_lock_key;
+
+/*
  *      Convert a ROSE address into text.
  */
 const char *rose2asc(const rose_address *addr)
@@ -1515,6 +1523,7 @@ static int __init rose_proto_init(void)
                         free_netdev(dev);
                         goto fail;
                 }
+                lockdep_set_class(&dev->_xmit_lock, &rose_netdev_xmit_lock_key);
                 dev_rose[i] = dev;
         }
 
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 0972247a839c..9affeeedf107 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -884,8 +884,6 @@ static int __init tc_action_init(void)
                 link_p[RTM_GETACTION-RTM_BASE].dumpit = tc_dump_action;
         }
 
-        printk("TC classifier action (bugs to netdev@vger.kernel.org cc "
-               "hadi@cyberus.ca)\n");
         return 0;
 }