Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (43 commits)
  bnx2: Eliminate AER error messages on systems not supporting it
  cnic: Fix big endian bug
  xfrm6: Don't forget to propagate peer into ipsec route.
  tg3: Use new VLAN code
  bonding: update documentation - alternate configuration.
  TCP: fix a bug that triggers large number of TCP RST by mistake
  MAINTAINERS: remove Reinette Chatre as iwlwifi maintainer
  rt2x00: add device id for windy31 usb device
  mac80211: fix a crash in ieee80211_beacon_get_tim on change_interface
  ipv6: Revert 'administrative down' address handling changes.
  textsearch: doc - fix spelling in lib/textsearch.c.
  USB NET KL5KUSB101: Fix mem leak in error path of kaweth_download_firmware()
  pch_gbe: don't use flush_scheduled_work()
  bnx2: Always set ETH_FLAG_TXVLAN
  net: clear heap allocation for ethtool_get_regs()
  ipv6: Always clone offlink routes.
  dcbnl: make get_app handling symmetric for IEEE and CEE DCBx
  tcp: fix bug in listening_get_next()
  inetpeer: Use correct AVL tree base pointer in inet_getpeer().
  GRO: fix merging a paged skb after non-paged skbs
  ...

30 files changed, 146 insertions, 165 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6b90a4191734..99cd8d9d891b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -379,14 +379,10 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
         hci_conn_hold(acl);
 
         if (acl->state == BT_OPEN || acl->state == BT_CLOSED) {
-                acl->sec_level = sec_level;
+                acl->sec_level = BT_SECURITY_LOW;
+                acl->pending_sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
-        } else {
-                if (acl->sec_level < sec_level)
-                        acl->sec_level = sec_level;
-                if (acl->auth_type < auth_type)
-                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
@@ -442,11 +438,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 {
         BT_DBG("conn %p", conn);
 
+        if (conn->pending_sec_level > sec_level)
+                sec_level = conn->pending_sec_level;
+
         if (sec_level > conn->sec_level)
-                conn->sec_level = sec_level;
+                conn->pending_sec_level = sec_level;
         else if (conn->link_mode & HCI_LM_AUTH)
                 return 1;
 
+        /* Make sure we preserve an existing MITM requirement*/
+        auth_type |= (conn->auth_type & 0x01);
+
         conn->auth_type = auth_type;
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8b602d881fd7..9c4541bc488a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1011,6 +1011,10 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
         destroy_workqueue(hdev->workqueue);
 
+        hci_dev_lock_bh(hdev);
+        hci_blacklist_clear(hdev);
+        hci_dev_unlock_bh(hdev);
+
         __hci_dev_put(hdev);
 
         return 0;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 38100170d380..a290854fdaa6 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -692,13 +692,13 @@ static int hci_outgoing_auth_needed(struct hci_dev *hdev,
         if (conn->state != BT_CONFIG || !conn->out)
                 return 0;
 
-        if (conn->sec_level == BT_SECURITY_SDP)
+        if (conn->pending_sec_level == BT_SECURITY_SDP)
                 return 0;
 
         /* Only request authentication for SSP connections or non-SSP
          * devices with sec_level HIGH */
         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
-                                        conn->sec_level != BT_SECURITY_HIGH)
+                                conn->pending_sec_level != BT_SECURITY_HIGH)
                 return 0;
 
         return 1;
@@ -1095,9 +1095,10 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
         if (conn) {
-                if (!ev->status)
+                if (!ev->status) {
                         conn->link_mode |= HCI_LM_AUTH;
-                else
+                        conn->sec_level = conn->pending_sec_level;
+                } else
                         conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c791fcda7b2d..7550abb0c96a 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -305,33 +305,44 @@ static void l2cap_chan_del(struct sock *sk, int err)
         }
 }
 
-/* Service level security */
-static inline int l2cap_check_security(struct sock *sk)
+static inline u8 l2cap_get_auth_type(struct sock *sk)
 {
-        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
-        __u8 auth_type;
+        if (sk->sk_type == SOCK_RAW) {
+                switch (l2cap_pi(sk)->sec_level) {
+                case BT_SECURITY_HIGH:
+                        return HCI_AT_DEDICATED_BONDING_MITM;
+                case BT_SECURITY_MEDIUM:
+                        return HCI_AT_DEDICATED_BONDING;
+                default:
+                        return HCI_AT_NO_BONDING;
+                }
+        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
+                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
+                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 
-        if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
+                        return HCI_AT_NO_BONDING_MITM;
                 else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
+                        return HCI_AT_NO_BONDING;
         } else {
                 switch (l2cap_pi(sk)->sec_level) {
                 case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
+                        return HCI_AT_GENERAL_BONDING_MITM;
                 case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
+                        return HCI_AT_GENERAL_BONDING;
                 default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
+                        return HCI_AT_NO_BONDING;
                 }
         }
+}
+
+/* Service level security */
+static inline int l2cap_check_security(struct sock *sk)
+{
+        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
+        __u8 auth_type;
+
+        auth_type = l2cap_get_auth_type(sk);
 
         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
                                                                 auth_type);
@@ -1068,39 +1079,7 @@ static int l2cap_do_connect(struct sock *sk)
 
         err = -ENOMEM;
 
-        if (sk->sk_type == SOCK_RAW) {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_DEDICATED_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_DEDICATED_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
-                        auth_type = HCI_AT_NO_BONDING_MITM;
-                else
-                        auth_type = HCI_AT_NO_BONDING;
-
-                if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
-                        l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
-        } else {
-                switch (l2cap_pi(sk)->sec_level) {
-                case BT_SECURITY_HIGH:
-                        auth_type = HCI_AT_GENERAL_BONDING_MITM;
-                        break;
-                case BT_SECURITY_MEDIUM:
-                        auth_type = HCI_AT_GENERAL_BONDING;
-                        break;
-                default:
-                        auth_type = HCI_AT_NO_BONDING;
-                        break;
-                }
-        }
+        auth_type = l2cap_get_auth_type(sk);
 
         hcon = hci_connect(hdev, ACL_LINK, dst,
                                         l2cap_pi(sk)->sec_level, auth_type);
@@ -1127,7 +1106,8 @@ static int l2cap_do_connect(struct sock *sk)
                 if (sk->sk_type != SOCK_SEQPACKET &&
                                 sk->sk_type != SOCK_STREAM) {
                         l2cap_sock_clear_timer(sk);
-                        sk->sk_state = BT_CONNECTED;
+                        if (l2cap_check_security(sk))
+                                sk->sk_state = BT_CONNECTED;
                 } else
                         l2cap_do_start(sk);
         }
@@ -1893,8 +1873,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                 if (pi->mode == L2CAP_MODE_STREAMING) {
                         l2cap_streaming_send(sk);
                 } else {
-                        if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY &&
-                                        pi->conn_state && L2CAP_CONN_WAIT_F) {
+                        if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                        (pi->conn_state & L2CAP_CONN_WAIT_F)) {
                                 err = len;
                                 break;
                         }
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ff8aaa736650..6b83776534fb 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                          * initiator rfcomm_process_rx already calls
                          * rfcomm_session_put() */
                         if (s->sock->sk->sk_state != BT_CLOSED)
-                                rfcomm_session_put(s);
+                                if (list_empty(&s->dlcs))
+                                        rfcomm_session_put(s);
                         break;
                 }
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 7c6a46f80372..24ea2d71e7ea 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -749,7 +749,8 @@ EXPORT_SYMBOL(dev_get_by_index);
  *      @ha: hardware address
  *
  *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold RCU
+ *      is not found or a pointer to the device.
+ *      The caller must hold RCU or RTNL.
  *      The returned device has not had its ref count increased
  *      and the caller must therefore be careful about locking
  *
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 17741782a345..ff2302910b5e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d31bb36ae0dc..7cd1bc86d591 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2744,8 +2744,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 merge:
         if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                unsigned int eat = offset - headlen;
+
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                 offset = headlen;
         }
 
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index d900ab99814a..6b03f561caec 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -583,7 +583,7 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         u8 up, idtype;
         int ret = -EINVAL;
 
-        if (!tb[DCB_ATTR_APP] || !netdev->dcbnl_ops->getapp)
+        if (!tb[DCB_ATTR_APP])
                 goto out;
 
         ret = nla_parse_nested(app_tb, DCB_APP_ATTR_MAX, tb[DCB_ATTR_APP],
@@ -604,7 +604,16 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
                 goto out;
 
         id = nla_get_u16(app_tb[DCB_APP_ATTR_ID]);
-        up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+
+        if (netdev->dcbnl_ops->getapp) {
+                up = netdev->dcbnl_ops->getapp(netdev, idtype, id);
+        } else {
+                struct dcb_app app = {
+                                        .selector = idtype,
+                                        .protocol = id,
+                                     };
+                up = dcb_getapp(netdev, &app);
+        }
 
         /* send this back */
         dcbnl_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 04c8b69fd426..7927589813b5 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1017,14 +1017,13 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                 IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                 return 0;
         }
-        if (__in_dev_get_rcu(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
+        if (__in_dev_get_rtnl(dev)) {
+                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
                 return 0;
         }
         return -ENXIO;
 }
 
-/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -1233,10 +1232,10 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                            htonl(0xFFFFFFFFUL);
-        rcu_read_lock();
+        rtnl_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                dev = dev_get_by_name_rcu(net, r.arp_dev);
+                dev = __dev_get_by_name(net, r.arp_dev);
                 if (dev == NULL)
                         goto out;
 
@@ -1263,7 +1262,7 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
         }
 out:
-        rcu_read_unlock();
+        rtnl_unlock();
         if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
                 err = -EFAULT;
         return err;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d9bc85751c74..a96e65674ac3 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -475,7 +475,7 @@ static int cleanup_once(unsigned long ttl)
 struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
         struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
-        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer_base *base = family_to_base(daddr->family);
         struct inet_peer *p;
 
         /* Look up for the address quickly, lockless.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2549b29b062d..eb7f82ebf4a3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4399,7 +4399,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                         if (!skb_copy_datagram_iovec(skb, 0, tp->ucopy.iov, chunk)) {
                                 tp->ucopy.len -= chunk;
                                 tp->copied_seq += chunk;
-                                eaten = (chunk == skb->len && !th->fin);
+                                eaten = (chunk == skb->len);
                                 tcp_rcv_space_adjust(sk);
                         }
                         local_bh_disable();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 856f68466d49..02f583b3744a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1994,7 +1994,6 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                 }
                                 req = req->dl_next;
                         }
-                        st->offset = 0;
                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                 break;
 get_req:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 24a1cf110d80..fd6782e3a038 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2661,14 +2661,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         struct net *net = dev_net(dev);
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
-        int state;
+        int state, i;
 
         ASSERT_RTNL();
 
-        /* Flush routes if device is being removed or it is not loopback */
-        if (how || !(dev->flags & IFF_LOOPBACK))
-                rt6_ifdown(net, dev);
+        rt6_ifdown(net, dev);
+        neigh_ifdown(&nd_tbl, dev);
 
         idev = __in6_dev_get(dev);
         if (idev == NULL)
@@ -2689,6 +2687,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         }
 
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
+
         write_lock_bh(&idev->lock);
 
         /* Step 2: clear flags for stateless addrconf */
@@ -2722,52 +2737,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                        struct inet6_ifaddr, if_list);
                 addrconf_del_timer(ifa);
 
-                /* If just doing link down, and address is permanent
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
+                list_del(&ifa->if_list);
 
-                        /* If it was tentative already, no need to notify */
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
+                write_unlock_bh(&idev->lock);
 
-                        /* Flag it for later restoration when link comes up */
-                        ifa->flags |= IFA_F_TENTATIVE;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
-                } else {
-                        list_del(&ifa->if_list);
-
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-
-                        write_unlock_bh(&idev->lock);
-                        spin_lock_bh(&ifa->state_lock);
-                        state = ifa->state;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
-                        spin_unlock_bh(&ifa->state_lock);
-
-                        if (state != INET6_IFADDR_STATE_DEAD) {
-                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                                atomic_notifier_call_chain(&inet6addr_chain,
-                                                           NETDEV_DOWN, ifa);
-                        }
+                spin_lock_bh(&ifa->state_lock);
+                state = ifa->state;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
+                spin_unlock_bh(&ifa->state_lock);
 
-                        in6_ifa_put(ifa);
-                        write_lock_bh(&idev->lock);
+                if (state != INET6_IFADDR_STATE_DEAD) {
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                 }
-        }
+                in6_ifa_put(ifa);
 
-        list_splice(&keep_list, &idev->addr_list);
+                write_lock_bh(&idev->lock);
+        }
 
         write_unlock_bh(&idev->lock);
 
@@ -4156,8 +4142,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                 addrconf_leave_solict(ifp->idev, &ifp->addr);
                 dst_hold(&ifp->rt->dst);
 
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
-                    ip6_del_rt(ifp->rt))
+                if (ip6_del_rt(ifp->rt))
                         dst_free(&ifp->rt->dst);
                 break;
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 373bd0416f69..1534508f6c68 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,8 +72,6 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
 
-#define CLONE_OFFLINK_ROUTE 0
-
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
@@ -738,13 +736,8 @@ restart:
 
         if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
-        else {
-#if CLONE_OFFLINK_ROUTE
+        else
                 nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
-#else
-                goto out2;
-#endif
-        }
 
         dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 7e74023ea6e4..da87428681cc 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -98,6 +98,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
+
         /* Sheit... I remember I did this right. Apparently,
          * it was magically lost, so this code needs audit */
         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -216,6 +220,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
 }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 5950e3abead9..b64b42bc774b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2230,6 +2230,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 
         sdata = vif_to_sdata(vif);
 
+        if (!ieee80211_sdata_running(sdata))
+                goto out;
+
         if (tim_offset)
                 *tim_offset = 0;
         if (tim_length)
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index c80d1c210c5d..5f63ec58942c 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -390,7 +390,6 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         ret = qdisc_enqueue(skb, cl->q);
         if (ret == NET_XMIT_SUCCESS) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
                 cbq_mark_toplevel(q, cl);
                 if (!cl->next_alive)
                         cbq_activate_class(cl);
@@ -649,7 +648,6 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                 ret = qdisc_enqueue(skb, cl->q);
                 if (ret == NET_XMIT_SUCCESS) {
                         sch->q.qlen++;
-                        qdisc_bstats_update(sch, skb);
                         if (!cl->next_alive)
                                 cbq_activate_class(cl);
                         return 0;
@@ -971,6 +969,7 @@ cbq_dequeue(struct Qdisc *sch)
 
                 skb = cbq_dequeue_1(sch);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
                         return skb;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index de55e642eafc..6b7fe4a84f13 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -376,7 +376,6 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
 
         sch->q.qlen++;
         return err;
@@ -403,6 +402,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
                         skb = qdisc_dequeue_peeked(cl->qdisc);
                         if (cl->qdisc->q.qlen == 0)
                                 list_del(&cl->alist);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index 60f4bdd4408e..0f7bf3fdfea5 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -260,7 +260,6 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return err;
         }
 
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -283,6 +282,7 @@ static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
         if (skb == NULL)
                 return NULL;
 
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         index = skb->tc_index & (p->indices - 1);
diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
index aa4d6337e43c..d468b479aa93 100644
--- a/net/sched/sch_fifo.c
+++ b/net/sched/sch_fifo.c
@@ -46,17 +46,14 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 {
-        struct sk_buff *skb_head;
         struct fifo_sched_data *q = qdisc_priv(sch);
 
         if (likely(skb_queue_len(&sch->q) < q->limit))
                 return qdisc_enqueue_tail(skb, sch);
 
         /* queue full, remove one skb to fulfill the limit */
-        skb_head = qdisc_dequeue_head(sch);
+        __qdisc_queue_drop_head(sch, &sch->q);
         sch->qstats.drops++;
-        kfree_skb(skb_head);
-
         qdisc_enqueue_tail(skb, sch);
 
         return NET_XMIT_CN;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 2e45791d4f6c..14a799de1c35 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1600,7 +1600,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 set_active(cl, qdisc_pkt_len(skb));
 
         bstats_update(&cl->bstats, skb);
-        qdisc_bstats_update(sch, skb);
         sch->q.qlen++;
 
         return NET_XMIT_SUCCESS;
@@ -1666,6 +1665,7 @@ hfsc_dequeue(struct Qdisc *sch)
         }
 
         sch->flags &= ~TCQ_F_THROTTLED;
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
 
         return skb;
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 984c1b0c6836..fc12fe6f5597 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -574,7 +574,6 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -842,7 +841,7 @@ next:
 
 static struct sk_buff *htb_dequeue(struct Qdisc *sch)
 {
-        struct sk_buff *skb = NULL;
+        struct sk_buff *skb;
         struct htb_sched *q = qdisc_priv(sch);
         int level;
         psched_time_t next_event;
@@ -851,6 +850,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
         /* try to dequeue direct packets as high prio (!) to minimize cpu work */
         skb = __skb_dequeue(&q->direct_queue);
         if (skb != NULL) {
+ok:
+                qdisc_bstats_update(sch, skb);
                 sch->flags &= ~TCQ_F_THROTTLED;
                 sch->q.qlen--;
                 return skb;
@@ -884,11 +885,8 @@ static struct sk_buff *htb_dequeue(struct Qdisc *sch)
                         int prio = ffz(m);
                         m |= 1 << prio;
                         skb = htb_dequeue_tree(q, prio, level);
-                        if (likely(skb != NULL)) {
-                                sch->q.qlen--;
-                                sch->flags &= ~TCQ_F_THROTTLED;
-                                goto fin;
-                        }
+                        if (likely(skb != NULL))
+                                goto ok;
                 }
         }
         sch->qstats.overlimits++;
diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
index 21f13da24763..436a2e75b322 100644
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -83,7 +83,6 @@ multiq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -112,6 +111,7 @@ static struct sk_buff *multiq_dequeue(struct Qdisc *sch)
                         qdisc = q->queues[q->curband];
                         skb = qdisc->dequeue(qdisc);
                         if (skb) {
+                                qdisc_bstats_update(sch, skb);
                                 sch->q.qlen--;
                                 return skb;
                         }
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 1c4bce863479..6a3006b38dc5 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -240,7 +240,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         if (likely(ret == NET_XMIT_SUCCESS)) {
                 sch->q.qlen++;
-                qdisc_bstats_update(sch, skb);
         } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
         }
@@ -289,6 +288,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch)
                                 skb->tstamp.tv64 = 0;
 #endif
                         pr_debug("netem_dequeue: return skb=%p\n", skb);
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
@@ -476,7 +476,6 @@ static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
                 __skb_queue_after(list, skb, nskb);
 
                 sch->qstats.backlog += qdisc_pkt_len(nskb);
-                qdisc_bstats_update(sch, nskb);
 
                 return NET_XMIT_SUCCESS;
         }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index 966158d49dd1..fbd710d619bf 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -84,7 +84,6 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         ret = qdisc_enqueue(skb, qdisc);
         if (ret == NET_XMIT_SUCCESS) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
@@ -116,6 +115,7 @@ static struct sk_buff *prio_dequeue(struct Qdisc* sch)
                 struct Qdisc *qdisc = q->queues[prio];
                 struct sk_buff *skb = qdisc->dequeue(qdisc);
                 if (skb) {
+                        qdisc_bstats_update(sch, skb);
                         sch->q.qlen--;
                         return skb;
                 }
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index a6009c5a2c97..9f98dbd32d4c 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -94,7 +94,6 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         ret = qdisc_enqueue(skb, child);
         if (likely(ret == NET_XMIT_SUCCESS)) {
-                qdisc_bstats_update(sch, skb);
                 sch->q.qlen++;
         } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
@@ -114,11 +113,13 @@ static struct sk_buff * red_dequeue(struct Qdisc* sch)
         struct Qdisc *child = q->qdisc;
 
         skb = child->dequeue(child);
-        if (skb)
+        if (skb) {
+                qdisc_bstats_update(sch, skb);
                 sch->q.qlen--;
-        else if (!red_is_idling(&q->parms))
-                red_start_of_idle_period(&q->parms);
-
+        } else {
+                if (!red_is_idling(&q->parms))
+                        red_start_of_idle_period(&q->parms);
+        }
         return skb;
 }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 239ec53a634d..edea8cefec6c 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -402,10 +402,8 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 q->tail = slot;
                 slot->allot = q->scaled_quantum;
         }
-        if (++sch->q.qlen <= q->limit) {
-                qdisc_bstats_update(sch, skb);
+        if (++sch->q.qlen <= q->limit)
                 return NET_XMIT_SUCCESS;
-        }
 
         sfq_drop(sch);
         return NET_XMIT_CN;
@@ -445,6 +443,7 @@ next_slot:
         }
         skb = slot_dequeue_head(slot);
         sfq_dec(q, a);
+        qdisc_bstats_update(sch, skb);
         sch->q.qlen--;
         sch->qstats.backlog -= qdisc_pkt_len(skb);
 
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 77565e721811..e93165820c3f 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -134,7 +134,6 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
         }
 
         sch->q.qlen++;
-        qdisc_bstats_update(sch, skb);
         return NET_XMIT_SUCCESS;
 }
 
@@ -187,6 +186,7 @@ static struct sk_buff *tbf_dequeue(struct Qdisc* sch)
                         q->ptokens = ptoks;
                         sch->q.qlen--;
                         sch->flags &= ~TCQ_F_THROTTLED;
+                        qdisc_bstats_update(sch, skb);
                         return skb;
                 }
 
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 84ce48eadff4..d84e7329660f 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -87,7 +87,6 @@ teql_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         if (q->q.qlen < dev->tx_queue_len) {
                 __skb_queue_tail(&q->q, skb);
-                qdisc_bstats_update(sch, skb);
                 return NET_XMIT_SUCCESS;
         }
 
@@ -111,6 +110,8 @@ teql_dequeue(struct Qdisc* sch)
                         dat->m->slaves = sch;
                         netif_wake_queue(m);
                 }
+        } else {
+                qdisc_bstats_update(sch, skb);
         }
         sch->q.qlen = dat->q.qlen + dat_queue->qdisc->q.qlen;
         return skb;