Merge branch 'master' of

git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.33.y

Conflicts:
	Makefile
	arch/x86/kernel/apic/io_apic.c
	drivers/staging/mimio/mimio.c

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

7 files changed, 24 insertions, 8 deletions

diff --git a/net/core/scm.c b/net/core/scm.c
index b7ba91b074b3..9b264634acfd 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -156,6 +156,8 @@ int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p)
                 switch (cmsg->cmsg_type)
                 {
                 case SCM_RIGHTS:
+                        if (!sock->ops || sock->ops->family != PF_UNIX)
+                                goto error;
                         err=scm_fp_copy(cmsg, &p->fp);
                         if (err<0)
                                 goto error;
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5e3a7eccef5a..304b0b65216d 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -179,7 +179,8 @@ static void sta_addba_resp_timer_expired(unsigned long data)
 
         /* check if the TID waits for addBA response */
         spin_lock_bh(&sta->lock);
-        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK)) !=
+        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK |
+                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
                 *state = HT_AGG_STATE_IDLE;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index e735c17ab096..3e1ea43d5be6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1788,6 +1788,7 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
+        struct ieee80211_local *local = rx->local;
         struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         __le16 fc = hdr->frame_control;
@@ -1819,6 +1820,13 @@ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += rx->skb->len;
 
+        if (ieee80211_is_data(hdr->frame_control) &&
+            !is_multicast_ether_addr(hdr->addr1) &&
+            local->hw.conf.dynamic_ps_timeout > 0 && local->ps_sdata) {
+                        mod_timer(&local->dynamic_ps_timer, jiffies +
+                         msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
+
         ieee80211_deliver_skb(rx);
 
         return RX_QUEUED;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ac210b586702..70c79c3013fa 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1052,8 +1052,11 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
+                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+                        return TX_DROP;
+        }
         if (!tx->sta)
                 tx->sta = sta_info_get(local, hdr->addr1);
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index fc70a49c0afd..43e83a44224d 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -173,10 +173,10 @@ recent_entry_init(struct recent_table *t, const union nf_inet_addr *addr,
 
 static void recent_entry_update(struct recent_table *t, struct recent_entry *e)
 {
+        e->index %= ip_pkt_list_tot;
         e->stamps[e->index++] = jiffies;
         if (e->index > e->nstamps)
                 e->nstamps = e->index;
-        e->index %= ip_pkt_list_tot;
         list_move_tail(&e->lru_list, &t->lru_list);
 }
 
@@ -260,7 +260,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 for (i = 0; i < e->nstamps; i++) {
                         if (info->seconds && time_after(time, e->stamps[i]))
                                 continue;
-                        if (++hits >= info->hit_count) {
+                        if (info->hit_count && ++hits >= info->hit_count) {
                                 ret = !ret;
                                 break;
                         }
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 7d1f9e928f69..4f303360b565 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -889,11 +889,8 @@ void svc_delete_xprt(struct svc_xprt *xprt)
         if (test_bit(XPT_TEMP, &xprt->xpt_flags))
                 serv->sv_tmpcnt--;
 
-        for (dr = svc_deferred_dequeue(xprt); dr;
-             dr = svc_deferred_dequeue(xprt)) {
-                svc_xprt_put(xprt);
+        while ((dr = svc_deferred_dequeue(xprt)) != NULL)
                 kfree(dr);
-        }
 
         svc_xprt_put(xprt);
         spin_unlock_bh(&serv->sv_lock);
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 3d739e5d15d8..4df801dc3488 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1912,6 +1912,11 @@ static void xs_tcp_setup_socket(struct rpc_xprt *xprt,
         case -EALREADY:
                 xprt_clear_connecting(xprt);
                 return;
+        case -EINVAL:
+                /* Happens, for instance, if the user specified a link
+                 * local IPv6 address without a scope-id.
+                 */
+                goto out;
         }
 out_eagain:
         status = -EAGAIN;