8 files changed, 29 insertions, 24 deletions

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 33d69ddc90a3..d4a3dac21dcf 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -547,9 +547,9 @@ bnx2_free_rx_mem(struct bnx2 *bp)
                 for (j = 0; j < bp->rx_max_pg_ring; j++) {
                         if (rxr->rx_pg_desc_ring[j])
                                 pci_free_consistent(bp->pdev, RXBD_RING_SIZE,
-                                                    rxr->rx_pg_desc_ring[i],
-                                                    rxr->rx_pg_desc_mapping[i]);
-                        rxr->rx_pg_desc_ring[i] = NULL;
+                                                    rxr->rx_pg_desc_ring[j],
+                                                    rxr->rx_pg_desc_mapping[j]);
+                        rxr->rx_pg_desc_ring[j] = NULL;
                 }
                 if (rxr->rx_pg_ring)
                         vfree(rxr->rx_pg_ring);
diff --git a/drivers/net/jme.h b/drivers/net/jme.h
index 2d6f30e638fc..5154411b5e6b 100644
--- a/drivers/net/jme.h
+++ b/drivers/net/jme.h
@@ -22,7 +22,7 @@
  */
 
 #ifndef __JME_H_INCLUDED__
-#define __JME_H_INCLUDEE__
+#define __JME_H_INCLUDED__
 
 #define DRV_NAME        "jme"
 #define DRV_VERSION     "1.0.3"
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 8755d8cd4166..7a333601fbe8 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -105,8 +105,6 @@ int mdiobus_register(struct mii_bus *bus)
                 return -EINVAL;
         }
 
-        bus->state = MDIOBUS_REGISTERED;
-
         mutex_init(&bus->mdio_lock);
 
         if (bus->reset)
@@ -123,6 +121,9 @@ int mdiobus_register(struct mii_bus *bus)
                 }
         }
 
+        if (!err)
+                bus->state = MDIOBUS_REGISTERED;
+
         pr_info("%s: probed\n", bus->name);
 
         return err;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index c832d600d1e8..06b448285eb5 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -117,6 +117,7 @@ struct ppp {
         unsigned long   last_xmit;      /* jiffies when last pkt sent 9c */
         unsigned long   last_recv;      /* jiffies when last pkt rcvd a0 */
         struct net_device *dev;         /* network interface device a4 */
+        int             closing;        /* is device closing down? a8 */
 #ifdef CONFIG_PPP_MULTILINK
         int             nxchan;         /* next channel to send something on */
         u32             nxseq;          /* next sequence number to send */
@@ -983,7 +984,7 @@ ppp_xmit_process(struct ppp *ppp)
         struct sk_buff *skb;
 
         ppp_xmit_lock(ppp);
-        if (ppp->dev) {
+        if (!ppp->closing) {
                 ppp_push(ppp);
                 while (!ppp->xmit_pending
                        && (skb = skb_dequeue(&ppp->file.xq)))
@@ -1451,8 +1452,7 @@ static inline void
 ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
         ppp_recv_lock(ppp);
-        /* ppp->dev == 0 means interface is closing down */
-        if (ppp->dev)
+        if (!ppp->closing)
                 ppp_receive_frame(ppp, skb, pch);
         else
                 kfree_skb(skb);
@@ -2484,18 +2484,16 @@ init_ppp_file(struct ppp_file *pf, int kind)
  */
 static void ppp_shutdown_interface(struct ppp *ppp)
 {
-        struct net_device *dev;
-
         mutex_lock(&all_ppp_mutex);
-        ppp_lock(ppp);
-        dev = ppp->dev;
-        ppp->dev = NULL;
-        ppp_unlock(ppp);
         /* This will call dev_close() for us. */
-        if (dev) {
-                unregister_netdev(dev);
-                free_netdev(dev);
-        }
+        ppp_lock(ppp);
+        if (!ppp->closing) {
+                ppp->closing = 1;
+                ppp_unlock(ppp);
+                unregister_netdev(ppp->dev);
+        } else
+                ppp_unlock(ppp);
+
         unit_put(&ppp_units_idr, ppp->file.index);
         ppp->file.dead = 1;
         ppp->owner = NULL;
@@ -2540,7 +2538,7 @@ static void ppp_destroy_interface(struct ppp *ppp)
         if (ppp->xmit_pending)
                 kfree_skb(ppp->xmit_pending);
 
-        kfree(ppp);
+        free_netdev(ppp->dev);
 }
 
 /*
@@ -2602,7 +2600,7 @@ ppp_connect_channel(struct channel *pch, int unit)
         if (pch->file.hdrlen > ppp->file.hdrlen)
                 ppp->file.hdrlen = pch->file.hdrlen;
         hdrlen = pch->file.hdrlen + 2;  /* for protocol bytes */
-        if (ppp->dev && hdrlen > ppp->dev->hard_header_len)
+        if (hdrlen > ppp->dev->hard_header_len)
                 ppp->dev->hard_header_len = hdrlen;
         list_add_tail(&pch->clist, &ppp->channels);
         ++ppp->n_channels;
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index d5b9dd842c61..1902f4fabde1 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1503,6 +1503,11 @@ static int __netdev_rx(struct net_device *dev, int *quota)
                 desc->status = 0;
                 np->rx_done = (np->rx_done + 1) % DONE_Q_SIZE;
         }
+
+        if (*quota == 0) {      /* out of rx quota */
+                retcode = 1;
+                goto out;
+        }
         writew(np->rx_done, np->base + CompletionQConsumerIdx);
 
  out:
diff --git a/include/net/irda/irda_device.h b/include/net/irda/irda_device.h
index 3025ae17ddbe..94c852d47d0f 100644
--- a/include/net/irda/irda_device.h
+++ b/include/net/irda/irda_device.h
@@ -135,9 +135,11 @@ struct dongle_reg {
 
 /* 
  * Per-packet information we need to hide inside sk_buff 
- * (must not exceed 48 bytes, check with struct sk_buff) 
+ * (must not exceed 48 bytes, check with struct sk_buff)
+ * The default_qdisc_pad field is a temporary hack.
  */
 struct irda_skb_cb {
+        unsigned int default_qdisc_pad;
         magic_t magic;       /* Be sure that we can trust the information */
         __u32   next_speed;  /* The Speed to be set *after* this frame */
         __u16   mtt;         /* Minimum turn around time */
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 37c640d1c3fd..acd84fd524b8 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1781,8 +1781,6 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
         if (err < 0)
                 return;
 
-        __module_get(nsock->ops->owner);
-
         /* Set our callbacks */
         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
         nsock->sk->sk_state_change = rfcomm_l2state_change;
diff --git a/net/socket.c b/net/socket.c
index e9d65ea2687e..43021f9463f3 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2306,6 +2306,7 @@ int kernel_accept(struct socket *sock, struct socket **newsock, int flags)
         }
 
         (*newsock)->ops = sock->ops;
+        __module_get((*newsock)->ops->owner);
 
 done:
         return err;