31 files changed, 678 insertions, 59 deletions

diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a03d291de854..f0d23de32967 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                 netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                           __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                                DUMP_PREFIX_OFFSET, 16, 1,
                                &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50d9de8..12b280afdd51 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
         if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                 return -ENOMEM;
         }
 
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                 goto cleanup_candev;
         }
 
         dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
         if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                 goto cleanup_intr_urb;
         }
 
         dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                      sizeof(struct ems_cpc_msg), GFP_KERNEL);
         if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                 goto cleanup_intr_in_buffer;
         }
 
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                             int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                   SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                   "10GBASE-CX4");
         return 0;
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
         struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
 
         /*
          * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                 return &enet_regs->tbipa;
         } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
+                return of_iomap(np, 1);
         } else
                 return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         u32 __iomem *tbipa;
         struct mii_bus *new_bus;
         int tbiaddr = -1;
+        const u32 *addrp;
         u64 addr = 0, size = 0;
         int err = 0;
 
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         new_bus->priv = priv;
         fsl_pq_mdio_bus_name(new_bus->id, np);
 
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         map = ioremap(addr, size);
         if (!map) {
                 err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 080d1cea5b26..df49af382159 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -549,12 +549,8 @@ static int gfar_parse_group(struct device_node *np,
                 struct gfar_private *priv, const char *model)
 {
         u32 *queue_mask;
-        u64 addr, size;
-
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
 
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
         if (!priv->gfargrp[priv->num_grps].regs)
                 return -ENOMEM;
 
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 13cc1ca261d9..9e9f9b349766 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work)
                 txb = skb_dequeue(&ks->txq);
                 last = skb_queue_empty(&ks->txq);
 
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                if (txb != NULL) {
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                        ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
 
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
         }
 
         mutex_unlock(&ks->lock);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..757f87bb1db3 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -781,8 +781,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                   inw(ioaddr + EL3_STATUS));
 
         spin_lock_irqsave(&lp->window_lock, flags);
+
+        dev->stats.tx_bytes += skb->len;
+
+        /* Put out the doubleword header... */
         outw(skb->len, ioaddr + TX_FIFO);
         outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
         outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
 
         dev->trans_start = jiffies;
@@ -1021,8 +1026,6 @@ static void update_stats(struct net_device *dev)
         /* BadSSD */                               inb(ioaddr + 12);
         up                                       = inb(ioaddr + 13);
 
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
-
         EL3WINDOW(1);
 }
 
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..63be4caec70e 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,16 @@ config USB_CDC_PHONET
           cellular modem, as found on most Nokia handsets with the
           "PC suite" USB profile.
 
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..edb09c0ddf8e 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,5 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..fd1033130a81
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,568 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error;
+
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto error;
+
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto error;
+
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto error;
+
+
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+
+error:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, rx_buf,
+                        rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+        usb_free_urb(rx_urb);
+        usb_free_urb(tx_urb);
+        return -ENOMEM;
+}
+
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+
+        return retval;
+}
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+
+        usb_set_intfdata(intf, dev);
+
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+
+static int __init ipheth_init(void)
+{
+        int retval;
+
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                         EEPROM_5000_REG_BAND_3_CHANNELS,
                         EEPROM_5000_REG_BAND_4_CHANNELS,
                         EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f7086632..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -3358,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -506,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..12e455a4b90e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
         priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
         queue_work(priv->workqueue, &priv->request_scan);
-
-out:
-        return ret;
+ unlock:
+        mutex_unlock(&priv->mutex);
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
 
@@ -965,6 +973,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
         INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f29ada827a6a..386c15369d91 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -727,7 +727,7 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                 group = grec->grec_mca;
                 type = grec->grec_type;
 
-                len += grec->grec_nsrcs * 4;
+                len += ntohs(grec->grec_nsrcs) * 4;
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 92584bfef09b..f769098774b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1990,7 +1990,7 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                 queue_index = skb_tx_hash(dev, skb);
 
                         if (sk) {
-                                struct dst_entry *dst = rcu_dereference(sk->sk_dst_cache);
+                                struct dst_entry *dst = rcu_dereference_bh(sk->sk_dst_cache);
 
                                 if (dst && skb_dst(skb) == dst)
                                         sk_tx_queue_set(sk, queue_index);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 4568120d8533..fe776c9ddeca 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1270,10 +1270,11 @@ replay:
                         err = ops->newlink(net, dev, tb, data);
                 else
                         err = register_netdevice(dev);
-                if (err < 0 && !IS_ERR(dev)) {
+
+                if (err < 0 && !IS_ERR(dev))
                         free_netdev(dev);
+                if (err < 0)
                         goto out;
-                }
 
                 err = rtnl_configure_link(dev, ifm);
                 if (err < 0)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 8da6429269dd..14825eb09770 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -70,13 +70,17 @@ int inet_csk_bind_conflict(const struct sock *sk,
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
+                        const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+
                         if (!reuse || !sk2->sk_reuse ||
                             sk2->sk_state == TCP_LISTEN) {
-                                const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
                                 if (!sk2_rcv_saddr || !sk_rcv_saddr ||
                                     sk2_rcv_saddr == sk_rcv_saddr)
                                         break;
-                        }
+                        } else if (reuse && sk2->sk_reuse &&
+                                   sk2_rcv_saddr &&
+                                   sk2_rcv_saddr == sk_rcv_saddr)
+                                break;
                 }
         }
         return node != NULL;
@@ -120,9 +124,11 @@ again:
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
                                                 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                        spin_unlock(&head->lock);
-                                                        snum = smallest_rover;
-                                                        goto have_snum;
+                                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                                                spin_unlock(&head->lock);
+                                                                snum = smallest_rover;
+                                                                goto have_snum;
+                                                        }
                                                 }
                                         }
                                         goto next;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 628db24bcf22..b4b7d40a9c95 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -42,11 +42,16 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                 if (sk != sk2 &&
                     (!sk->sk_bound_dev_if ||
                      !sk2->sk_bound_dev_if ||
-                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if) &&
-                    (!sk->sk_reuse || !sk2->sk_reuse ||
-                     sk2->sk_state == TCP_LISTEN) &&
-                     ipv6_rcv_saddr_equal(sk, sk2))
-                        break;
+                     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
+                        if ((!sk->sk_reuse || !sk2->sk_reuse ||
+                             sk2->sk_state == TCP_LISTEN) &&
+                             ipv6_rcv_saddr_equal(sk, sk2))
+                                break;
+                        else if (sk->sk_reuse && sk2->sk_reuse &&
+                                !ipv6_addr_any(inet6_rcv_saddr(sk2)) &&
+                                ipv6_rcv_saddr_equal(sk, sk2))
+                                break;
+                }
         }
 
         return node != NULL;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 65f9c379df38..75d5ef830097 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -629,7 +629,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (!skb->local_df) {
+        if (!skb->local_df && skb->len > mtu) {
                 skb->dev = skb_dst(skb)->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c2438e8cb9d0..05ebd7833043 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -815,7 +815,7 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
         int flags = 0;
 
-        if (rt6_need_strict(&fl->fl6_dst))
+        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
         if (!ipv6_addr_any(&fl->fl6_src))
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c92ebe8f80d5..075f540ec197 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1015,7 +1015,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
         t1 = (struct tcphdr *) skb_push(buff, tot_len);
-        skb_reset_transport_header(skb);
+        skb_reset_transport_header(buff);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ae181651c75a..00bf7c962b7e 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -124,7 +124,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+        xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 96d25348aa59..87782a4bb541 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -184,7 +184,6 @@ static void sta_addba_resp_timer_expired(unsigned long data)
                        HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
                                 "(or no longer) expecting addBA response there",
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index c8cd169fc10e..4aefa6dc3091 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -168,6 +168,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
                      channel_type != local->hw.conf.channel_type;
 
+        if (local->tmp_channel)
+                local->tmp_channel_type = channel_type;
         local->oper_channel_type = channel_type;
 
         if (ht_changed) {
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 9ece910ea394..7b155081b4dc 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -134,7 +134,7 @@ static int __init rds_rdma_listen_init(void)
                 ret = PTR_ERR(cm_id);
                 printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_create_id() returned %d\n", ret);
-                goto out;
+                return ret;
         }
 
         sin.sin_family = AF_INET,
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index cbddd0cb83f1..36e84e13c6aa 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -402,6 +402,7 @@ static void __x25_destroy_socket(struct sock *sk)
                         /*
                          * Queue the unaccepted socket for death
                          */
+                        skb->sk->sk_state = TCP_LISTEN;
                         sock_set_flag(skb->sk, SOCK_DEAD);
                         x25_start_heartbeat(skb->sk);
                         x25_sk(skb->sk)->state = X25_STATE_0;