Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (24 commits)
  bridge: Partially disable netpoll support
  tcp: fix crash in tcp_xmit_retransmit_queue
  IPv6: fix CoA check in RH2 input handler (mip6_rthdr_input())
  ibmveth: lost IRQ while closing/opening device leads to service loss
  rt2x00: Fix lockdep warning in rt2x00lib_probe_dev()
  vhost: avoid pr_err on condition guest can trigger
  ipmr: Don't leak memory if fib lookup fails.
  vhost-net: avoid flush under lock
  net: fix problem in reading sock TX queue
  net/core: neighbour update Oops
  net: skb_tx_hash() fix relative to skb_orphan_try()
  rfs: call sock_rps_record_flow() in tcp_splice_read()
  xfrm: do not assume that template resolving always returns xfrms
  hostap_pci: set dev->base_addr during probe
  axnet_cs: use spin_lock_irqsave in ax_interrupt
  dsa: Fix Kconfig dependencies.
  act_nat: not all of the ICMP packets need an IP header payload
  r8169: incorrect identifier for a 8168dp
  Phonet: fix skb leak in pipe endpoint accept()
  Bluetooth: Update sec_level/auth_type for already existing connections
  ...

15 files changed, 67 insertions, 49 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b10e3cdb08f8..800b6b9fbbae 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -358,6 +358,11 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
                 acl->sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
+        } else {
+                if (acl->sec_level < sec_level)
+                        acl->sec_level = sec_level;
+                if (acl->auth_type < auth_type)
+                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 6c57fc71c7e2..786b5de0bac4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1049,6 +1049,8 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (conn) {
                 if (!ev->status)
                         conn->link_mode |= HCI_LM_AUTH;
+                else
+                        conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1b682a5aa061..cf3c4073a8a6 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -401,6 +401,11 @@ static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
         l2cap_send_sframe(pi, control);
 }
 
+static inline int __l2cap_no_conn_pending(struct sock *sk)
+{
+        return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
+}
+
 static void l2cap_do_start(struct sock *sk)
 {
         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
@@ -409,12 +414,13 @@ static void l2cap_do_start(struct sock *sk)
                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
                         return;
 
-                if (l2cap_check_security(sk)) {
+                if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
                         struct l2cap_conn_req req;
                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
                         req.psm  = l2cap_pi(sk)->psm;
 
                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
@@ -464,12 +470,14 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                 }
 
                 if (sk->sk_state == BT_CONNECT) {
-                        if (l2cap_check_security(sk)) {
+                        if (l2cap_check_security(sk) &&
+                                        __l2cap_no_conn_pending(sk)) {
                                 struct l2cap_conn_req req;
                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
                                 req.psm  = l2cap_pi(sk)->psm;
 
                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
@@ -2912,7 +2920,6 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 l2cap_pi(sk)->ident = 0;
                 l2cap_pi(sk)->dcid = dcid;
                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-
                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
 
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
@@ -4404,6 +4411,7 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 req.psm  = l2cap_pi(sk)->psm;
 
                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index eedf2c94820e..753fc4221f3c 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -217,14 +217,6 @@ static bool br_devices_support_netpoll(struct net_bridge *br)
         return count != 0 && ret;
 }
 
-static void br_poll_controller(struct net_device *br_dev)
-{
-        struct netpoll *np = br_dev->npinfo->netpoll;
-
-        if (np->real_dev != br_dev)
-                netpoll_poll_dev(np->real_dev);
-}
-
 void br_netpoll_cleanup(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -295,7 +287,6 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_do_ioctl            = br_dev_ioctl,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_cleanup     = br_netpoll_cleanup,
-        .ndo_poll_controller     = br_poll_controller,
 #endif
 };
 
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index a4e72a89e4ff..595da45f9088 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -50,14 +50,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                         kfree_skb(skb);
                 else {
                         skb_push(skb, ETH_HLEN);
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                        if (unlikely(skb->dev->priv_flags & IFF_IN_NETPOLL)) {
-                                netpoll_send_skb(skb->dev->npinfo->netpoll, skb);
-                                skb->dev->priv_flags &= ~IFF_IN_NETPOLL;
-                        } else
-#endif
-                                dev_queue_xmit(skb);
+                        dev_queue_xmit(skb);
                 }
         }
 
@@ -73,23 +66,9 @@ int br_forward_finish(struct sk_buff *skb)
 
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        struct net_bridge *br = to->br;
-        if (unlikely(br->dev->priv_flags & IFF_IN_NETPOLL)) {
-                struct netpoll *np;
-                to->dev->npinfo = skb->dev->npinfo;
-                np = skb->dev->npinfo->netpoll;
-                np->real_dev = np->dev = to->dev;
-                to->dev->priv_flags |= IFF_IN_NETPOLL;
-        }
-#endif
         skb->dev = to->dev;
         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                 br_forward_finish);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        if (skb->dev->npinfo)
-                skb->dev->npinfo->netpoll->dev = br->dev;
-#endif
 }
 
 static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
diff --git a/net/core/dev.c b/net/core/dev.c
index 723a34710ad4..0ea10f849be8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1911,8 +1911,16 @@ static int dev_gso_segment(struct sk_buff *skb)
  */
 static inline void skb_orphan_try(struct sk_buff *skb)
 {
-        if (!skb_tx(skb)->flags)
+        struct sock *sk = skb->sk;
+
+        if (sk && !skb_tx(skb)->flags) {
+                /* skb_tx_hash() wont be able to get sk.
+                 * We copy sk_hash into skb->rxhash
+                 */
+                if (!skb->rxhash)
+                        skb->rxhash = sk->sk_hash;
                 skb_orphan(skb);
+        }
 }
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -1998,8 +2006,7 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
         if (skb->sk && skb->sk->sk_hash)
                 hash = skb->sk->sk_hash;
         else
-                hash = (__force u16) skb->protocol;
-
+                hash = (__force u16) skb->protocol ^ skb->rxhash;
         hash = jhash_1word(hash, hashrnd);
 
         return (u16) (((u64) hash * dev->real_num_tx_queues) >> 32);
@@ -2022,12 +2029,11 @@ static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
-        u16 queue_index;
+        int queue_index;
         struct sock *sk = skb->sk;
 
-        if (sk_tx_queue_recorded(sk)) {
-                queue_index = sk_tx_queue_get(sk);
-        } else {
+        queue_index = sk_tx_queue_get(sk);
+        if (queue_index < 0) {
                 const struct net_device_ops *ops = dev->netdev_ops;
 
                 if (ops->ndo_select_queue) {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 6ba1c0eece03..a4e0a7482c2b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -949,7 +949,10 @@ static void neigh_update_hhs(struct neighbour *neigh)
 {
         struct hh_cache *hh;
         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
-                = neigh->dev->header_ops->cache_update;
+                = NULL;
+
+        if (neigh->dev->header_ops)
+                update = neigh->dev->header_ops->cache_update;
 
         if (update) {
                 for (hh = neigh->hh; hh; hh = hh->hh_next) {
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index c51b55400dc5..11201784d29a 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,7 +1,7 @@
 menuconfig NET_DSA
         bool "Distributed Switch Architecture support"
         default n
-        depends on EXPERIMENTAL && !S390
+        depends on EXPERIMENTAL && NET_ETHERNET && !S390
         select PHYLIB
         ---help---
           This allows you to use hardware switch chips that use
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 757f25eb9b4b..7f6273506eea 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -442,8 +442,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
         int err;
 
         err = ipmr_fib_lookup(net, &fl, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
@@ -1728,8 +1730,10 @@ int ip_mr_input(struct sk_buff *skb)
                 goto dont_forward;
 
         err = ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         if (!local) {
                     if (IPCB(skb)->opt.router_alert) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 6596b4feeddc..65afeaec15b7 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -608,6 +608,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
         ssize_t spliced;
         int ret;
 
+        sock_rps_record_flow(sk);
         /*
          * We can't seek on a socket input
          */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b4ed957f201a..7ed9dc1042d1 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2208,6 +2208,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
         int mib_idx;
         int fwd_rexmitting = 0;
 
+        if (!tp->packets_out)
+                return;
+
         if (!tp->lost_out)
                 tp->retransmit_high = tp->snd_una;
 
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 2794b6002836..d6e9599d0705 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -347,11 +347,12 @@ static const struct xfrm_type mip6_destopt_type =
 
 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        struct ipv6hdr *iph = ipv6_hdr(skb);
         struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
         int err = rt2->rt_hdr.nexthdr;
 
         spin_lock(&x->lock);
-        if (!ipv6_addr_equal(&rt2->addr, (struct in6_addr *)x->coaddr) &&
+        if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) &&
             !ipv6_addr_any((struct in6_addr *)x->coaddr))
                 err = -ENOENT;
         spin_unlock(&x->lock);
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 94d72e85a475..b2a3ae6cad78 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -698,6 +698,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
                 newsk = NULL;
                 goto out;
         }
+        kfree_skb(oskb);
 
         sock_hold(sk);
         pep_sk(newsk)->listener = sk;
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 570949417f38..724553e8ed7b 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -205,7 +205,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         {
                 struct icmphdr *icmph;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
                         goto drop;
 
                 icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,6 +215,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                     (icmph->type != ICMP_PARAMETERPROB))
                         break;
 
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+                        goto drop;
+
                 iph = (void *)(icmph + 1);
                 if (egress)
                         addr = iph->daddr;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index af1c173be4ad..a7ec5a8a2380 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1594,8 +1594,8 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
         /* Try to instantiate a bundle */
         err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
-        if (err < 0) {
-                if (err != -EAGAIN)
+        if (err <= 0) {
+                if (err != 0 && err != -EAGAIN)
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
                 return ERR_PTR(err);
         }
@@ -1678,6 +1678,13 @@ xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir,
                         goto make_dummy_bundle;
                 dst_hold(&xdst->u.dst);
                 return oldflo;
+        } else if (new_xdst == NULL) {
+                num_xfrms = 0;
+                if (oldflo == NULL)
+                        goto make_dummy_bundle;
+                xdst->num_xfrms = 0;
+                dst_hold(&xdst->u.dst);
+                return oldflo;
         }
 
         /* Kill the previous bundle */
@@ -1760,6 +1767,10 @@ restart:
                                 xfrm_pols_put(pols, num_pols);
                                 err = PTR_ERR(xdst);
                                 goto dropdst;
+                        } else if (xdst == NULL) {
+                                num_xfrms = 0;
+                                drop_pols = num_pols;
+                                goto no_transform;
                         }
 
                         spin_lock_bh(&xfrm_policy_sk_bundle_lock);