Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Provide device string properly for USB i2400m wimax devices, also
    don't OOPS when providing firmware string.  From Phil Sutter.

 2) Add support for sh_eth SH7734 chips, from Nobuhiro Iwamatsu.

 3) Add another device ID to USB zaurus driver, from Guan Xin.

 4) Loop index start in pool vector iterator is wrong causing MAC to not
    get configured in bnx2x driver, fix from Dmitry Kravkov.

 5) EQL driver assumes HZ=100, fix from Eric Dumazet.

 6) Now that skb_add_rx_frag() can specify the truesize increment
    separately, do so in f_phonet and cdc_phonet, also from Eric
    Dumazet.

 7) virtio_net accidently uses net_ratelimit() not only on the kernel
    warning but also the statistic bump, fix from Rick Jones.

 8) ip_route_input_mc() uses fixed init_net namespace, oops, use
    dev_net(dev) instead.  Fix from Benjamin LaHaise.

 9) dev_forward_skb() needs to clear the incoming interface index of the
    SKB so that it looks like a new incoming packet, also from Benjamin
    LaHaise.

10) iwlwifi mistakenly initializes a channel entry as 2GHZ instead of
    5GHZ, fix from Stanislav Yakovlev.

11) Missing kmalloc() return value checks in orinoco, from Santosh
    Nayak.

12) ath9k doesn't check for HT capabilities in the right way, it is
    checking ht_supported instead of the ATH9K_HW_CAP_HT flag.  Fix from
    Sujith Manoharan.

13) Fix x86 BPF JIT emission of 16-bit immediate field of AND
    instructions, from Feiran Zhuang.

14) Avoid infinite loop in GARP code when registering sysfs entries.
    From David Ward.

15) rose protocol uses memcpy instead of memcmp in a device address
    comparison, oops.  Fix from Daniel Borkmann.

16) Fix build of lpc_eth due to dev_hw_addr_rancom() interface being
    renamed to eth_hw_addr_random().  From Roland Stigge.

17) Make ipv6 RTM_GETROUTE interpret RTA_IIF attribute the same way
    that ipv4 does.  Fix from Shmulik Ladkani.

18) via-rhine has an inverted bit test, causing suspend/resume
    regressions.  Fix from Andreas Mohr.

19) RIONET assumes 4K page size, fix from Akinobu Mita.

20) Initialization of imask register in sky2 is buggy, because bits are
    "or'd" into an uninitialized local variable.  Fix from Lino
    Sanfilippo.

21) Fix FCOE checksum offload handling, from Yi Zou.

22) Fix VLAN processing regression in e1000, from Jiri Pirko.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits)
  sky2: dont overwrite settings for PHY Quick link
  tg3: Fix 5717 serdes powerdown problem
  net: usb: cdc_eem: fix mtu
  net: sh_eth: fix endian check for architecture independent
  usb/rtl8150 : Remove duplicated definitions
  rionet: fix page allocation order of rionet_active
  via-rhine: fix wait-bit inversion.
  ipv6: Fix RTM_GETROUTE's interpretation of RTA_IIF to be consistent with ipv4
  net: lpc_eth: Fix rename of dev_hw_addr_random
  net/netfilter/nfnetlink_acct.c: use linux/atomic.h
  rose_dev: fix memcpy-bug in rose_set_mac_address
  Fix non TBI PHY access; a bad merge undid bug fix in a previous commit.
  net/garp: avoid infinite loop if attribute already exists
  x86 bpf_jit: fix a bug in emitting the 16-bit immediate operand of AND
  bonding: emit event when bonding changes MAC
  mac80211: fix oper channel timestamp updation
  ath9k: Use HW HT capabilites properly
  MAINTAINERS: adding maintainer for ipw2x00
  net: orinoco: add error handling for failed kmalloc().
  net/wireless: ipw2x00: fix a typo in wiphy struct initilization
  ...

10 files changed, 64 insertions, 38 deletions

diff --git a/net/802/garp.c b/net/802/garp.c
index 8e21b6db3981..a5c224830439 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -167,7 +167,8 @@ static struct garp_attr *garp_attr_lookup(const struct garp_applicant *app,
         return NULL;
 }
 
-static void garp_attr_insert(struct garp_applicant *app, struct garp_attr *new)
+static struct garp_attr *garp_attr_create(struct garp_applicant *app,
+                                          const void *data, u8 len, u8 type)
 {
         struct rb_node *parent = NULL, **p = &app->gid.rb_node;
         struct garp_attr *attr;
@@ -176,21 +177,16 @@ static void garp_attr_insert(struct garp_applicant *app, struct garp_attr *new)
         while (*p) {
                 parent = *p;
                 attr = rb_entry(parent, struct garp_attr, node);
-                d = garp_attr_cmp(attr, new->data, new->dlen, new->type);
+                d = garp_attr_cmp(attr, data, len, type);
                 if (d < 0)
                         p = &parent->rb_left;
                 else if (d > 0)
                         p = &parent->rb_right;
+                else {
+                        /* The attribute already exists; re-use it. */
+                        return attr;
+                }
         }
-        rb_link_node(&new->node, parent, p);
-        rb_insert_color(&new->node, &app->gid);
-}
-
-static struct garp_attr *garp_attr_create(struct garp_applicant *app,
-                                          const void *data, u8 len, u8 type)
-{
-        struct garp_attr *attr;
-
         attr = kmalloc(sizeof(*attr) + len, GFP_ATOMIC);
         if (!attr)
                 return attr;
@@ -198,7 +194,9 @@ static struct garp_attr *garp_attr_create(struct garp_applicant *app,
         attr->type  = type;
         attr->dlen  = len;
         memcpy(attr->data, data, len);
-        garp_attr_insert(app, attr);
+
+        rb_link_node(&attr->node, parent, p);
+        rb_insert_color(&attr->node, &app->gid);
         return attr;
 }
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 5d59155adf2a..6c7dc9d78e10 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1596,6 +1596,7 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
+        skb->skb_iif = 0;
         skb_set_dev(skb, dev);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 4dc1c104c942..167ea10b521a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2041,7 +2041,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 if (err < 0)
                         goto e_err;
         }
-        rth = rt_dst_alloc(init_net.loopback_dev,
+        rth = rt_dst_alloc(dev_net(dev)->loopback_dev,
                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false);
         if (!rth)
                 goto e_nobufs;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 496b62712fe8..3992e26a6039 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -881,6 +881,16 @@ static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *
         return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
 }
 
+static struct dst_entry *ip6_route_input_lookup(struct net *net,
+                                                struct net_device *dev,
+                                                struct flowi6 *fl6, int flags)
+{
+        if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
+                flags |= RT6_LOOKUP_F_IFACE;
+
+        return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
+}
+
 void ip6_route_input(struct sk_buff *skb)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -895,10 +905,7 @@ void ip6_route_input(struct sk_buff *skb)
                 .flowi6_proto = iph->nexthdr,
         };
 
-        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
-                flags |= RT6_LOOKUP_F_IFACE;
-
-        skb_dst_set(skb, fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_input));
+        skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
 }
 
 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
@@ -2537,7 +2544,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         struct sk_buff *skb;
         struct rtmsg *rtm;
         struct flowi6 fl6;
-        int err, iif = 0;
+        int err, iif = 0, oif = 0;
 
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
         if (err < 0)
@@ -2564,15 +2571,29 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                 iif = nla_get_u32(tb[RTA_IIF]);
 
         if (tb[RTA_OIF])
-                fl6.flowi6_oif = nla_get_u32(tb[RTA_OIF]);
+                oif = nla_get_u32(tb[RTA_OIF]);
 
         if (iif) {
                 struct net_device *dev;
+                int flags = 0;
+
                 dev = __dev_get_by_index(net, iif);
                 if (!dev) {
                         err = -ENODEV;
                         goto errout;
                 }
+
+                fl6.flowi6_iif = iif;
+
+                if (!ipv6_addr_any(&fl6.saddr))
+                        flags |= RT6_LOOKUP_F_HAS_SADDR;
+
+                rt = (struct rt6_info *)ip6_route_input_lookup(net, dev, &fl6,
+                                                               flags);
+        } else {
+                fl6.flowi6_oif = oif;
+
+                rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
         }
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
@@ -2587,7 +2608,6 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         skb_reset_mac_header(skb);
         skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
 
-        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl6);
         skb_dst_set(skb, &rt->dst);
 
         err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 1068f668ac4e..64d3ce5ea1a0 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,6 +49,8 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
+        del_timer_sync(&tid_rx->reorder_timer);
+
         for (i = 0; i < tid_rx->buf_size; i++)
                 dev_kfree_skb(tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -91,7 +93,6 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                                      tid, WLAN_BACK_RECIPIENT, reason);
 
         del_timer_sync(&tid_rx->session_timer);
-        del_timer_sync(&tid_rx->reorder_timer);
 
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index b581a24fa15c..16336480c631 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -102,9 +102,6 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
 
         might_sleep();
 
-        /* If this off-channel logic ever changes,  ieee80211_on_oper_channel
-         * may need to change as well.
-         */
         offchannel_flag = local->hw.conf.flags & IEEE80211_CONF_OFFCHANNEL;
         if (local->scan_channel) {
                 chan = local->scan_channel;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 33cd16901378..c70e17677135 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -370,7 +370,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
          */
         drv_sw_scan_start(local);
 
-        local->leave_oper_channel_time = 0;
+        local->leave_oper_channel_time = jiffies;
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 3eb348bfc4fb..d98c868c148b 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
+#include <linux/atomic.h>
 #include <linux/netlink.h>
 #include <linux/rculist.h>
 #include <linux/slab.h>
@@ -17,7 +18,6 @@
 #include <linux/errno.h>
 #include <net/netlink.h>
 #include <net/sock.h>
-#include <asm/atomic.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter/nfnetlink.h>
diff --git a/net/rose/rose_dev.c b/net/rose/rose_dev.c
index 1ab8689726ec..906cc05bba63 100644
--- a/net/rose/rose_dev.c
+++ b/net/rose/rose_dev.c
@@ -95,11 +95,11 @@ static int rose_set_mac_address(struct net_device *dev, void *addr)
         struct sockaddr *sa = addr;
         int err;
 
-        if (!memcpy(dev->dev_addr, sa->sa_data, dev->addr_len))
+        if (!memcmp(dev->dev_addr, sa->sa_data, dev->addr_len))
                 return 0;
 
         if (dev->flags & IFF_UP) {
-                err = rose_add_loopback_node((rose_address *)dev->dev_addr);
+                err = rose_add_loopback_node((rose_address *)sa->sa_data);
                 if (err)
                         return err;
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4c1eb9472ddb..e49da2797022 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2386,7 +2386,9 @@ nla_put_failure:
 }
 
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
-                                int flags, struct net_device *dev,
+                                int flags,
+                                struct cfg80211_registered_device *rdev,
+                                struct net_device *dev,
                                 const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
@@ -2425,12 +2427,18 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         if (sinfo->filled & STATION_INFO_PLINK_STATE)
                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
                             sinfo->plink_state);
-        if (sinfo->filled & STATION_INFO_SIGNAL)
-                NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
-                           sinfo->signal);
-        if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
-                NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
-                           sinfo->signal_avg);
+        switch (rdev->wiphy.signal_type) {
+        case CFG80211_SIGNAL_TYPE_MBM:
+                if (sinfo->filled & STATION_INFO_SIGNAL)
+                        NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
+                                   sinfo->signal);
+                if (sinfo->filled & STATION_INFO_SIGNAL_AVG)
+                        NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL_AVG,
+                                   sinfo->signal_avg);
+                break;
+        default:
+                break;
+        }
         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
                                           NL80211_STA_INFO_TX_BITRATE))
@@ -2523,7 +2531,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
                 if (nl80211_send_station(skb,
                                 NETLINK_CB(cb->skb).pid,
                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                netdev, mac_addr,
+                                dev, netdev, mac_addr,
                                 &sinfo) < 0)
                         goto out;
 
@@ -2568,7 +2576,7 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
                 return -ENOMEM;
 
         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
-                                 dev, mac_addr, &sinfo) < 0) {
+                                 rdev, dev, mac_addr, &sinfo) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -7596,7 +7604,8 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
         if (!msg)
                 return;
 
-        if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
+        if (nl80211_send_station(msg, 0, 0, 0,
+                                 rdev, dev, mac_addr, sinfo) < 0) {
                 nlmsg_free(msg);
                 return;
         }