Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  [IRDA]: irda parameters warning fixes.
  [IRDA]: stir4200 fixes.
  [IRDA]: irlmp_unregister_link() needs to free lsaps.
  [IRDA]: mcs7780 needs to free allocated rx buffer.
  [IRDA]: Race between open and disconnect in irda-usb.
  [SCTP]: Flush fragment queue when exiting partial delivery.
  [AX25]: Locking dependencies fix in ax25_disconnect().
  [IPV4]: Make tcp_input_metrics() get minimum RTO via tcp_rto_min()
  [IPV6]: Fix the return value of ipv6_getsockopt
  [BRIDGE]: Assign random address.
  [IPV4]: Updates to nfsroot documentation
  [ATM]: Fix compiler warning noise with FORE200E driver
  [NETFILTER]: bridge: fix missing link layer headers on outgoing routed packets
  [SYNCPPP]: Endianness and 64bit fixes.
  [TIPC]: Fix semaphore handling.
  [NETFILTER]: xt_hashlimit should use time_after_eq()
  [XFRM]: Display the audited SPI value in host byte order.
  [NETFILTER]: ip_tables: fix compat copy race
  [NETFILTER]: ctnetlink: set expected bit for related conntracks

4 files changed, 30 insertions, 22 deletions

diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index c6355c00fd7a..9081234ab458 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1168,6 +1168,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
 static int irda_usb_net_open(struct net_device *netdev)
 {
 	struct irda_usb_cb *self;
+	unsigned long flags;
 	char	hwname[16];
 	int i;
 	
@@ -1177,13 +1178,16 @@ static int irda_usb_net_open(struct net_device *netdev)
 	self = (struct irda_usb_cb *) netdev->priv;
 	IRDA_ASSERT(self != NULL, return -1;);
 
+	spin_lock_irqsave(&self->lock, flags);
 	/* Can only open the device if it's there */
 	if(!self->present) {
+		spin_unlock_irqrestore(&self->lock, flags);
 		IRDA_WARNING("%s(), device not present!\n", __FUNCTION__);
 		return -1;
 	}
 
 	if(self->needspatch) {
+		spin_unlock_irqrestore(&self->lock, flags);
 		IRDA_WARNING("%s(), device needs patch\n", __FUNCTION__) ;
 		return -EIO ;
 	}
@@ -1198,6 +1202,7 @@ static int irda_usb_net_open(struct net_device *netdev)
 	/* To do *before* submitting Rx urbs and starting net Tx queue
 	 * Jean II */
 	self->netopen = 1;
+	spin_unlock_irqrestore(&self->lock, flags);
 
 	/* 
 	 * Now that everything should be initialized properly,
diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c
index 0b769192d4ce..93916cf33f29 100644
--- a/drivers/net/irda/mcs7780.c
+++ b/drivers/net/irda/mcs7780.c
@@ -677,6 +677,8 @@ static int mcs_net_close(struct net_device *netdev)
 	/* Stop transmit processing */
 	netif_stop_queue(netdev);
 
+	kfree_skb(mcs->rx_buff.skb);
+
 	/* kill and free the receive and transmit URBs */
 	usb_kill_urb(mcs->rx_urb);
 	usb_free_urb(mcs->rx_urb);
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index 042bc2f0417d..e59c485bc497 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -142,9 +142,6 @@ enum StirCtrl2Mask {
 };
 
 enum StirFifoCtlMask {
-	FIFOCTL_EOF = 0x80,
-	FIFOCTL_UNDER = 0x40,
-	FIFOCTL_OVER = 0x20,
 	FIFOCTL_DIR = 0x10,
 	FIFOCTL_CLR = 0x08,
 	FIFOCTL_EMPTY = 0x04,
@@ -594,9 +591,10 @@ static int fifo_txwait(struct stir_cb *stir, int space)
 {
 	int err;
 	unsigned long count, status;
+	unsigned long prev_count = 0x1fff;
 
 	/* Read FIFO status and count */
-	for(;;) {
+	for (;; prev_count = count) {
 		err = read_reg(stir, REG_FIFOCTL, stir->fifo_status, 
 				   FIFO_REGS_SIZE);
 		if (unlikely(err != FIFO_REGS_SIZE)) {
@@ -629,6 +627,10 @@ static int fifo_txwait(struct stir_cb *stir, int space)
 		if (space >= 0 && STIR_FIFO_SIZE - 4 > space + count)
 			return 0;
 
+		/* queue confused */
+		if (prev_count < count)
+			break;
+
 		/* estimate transfer time for remaining chars */
 		msleep((count * 8000) / stir->speed);
 	}
diff --git a/drivers/net/wan/syncppp.c b/drivers/net/wan/syncppp.c
index 232ecba5340f..61e24b7a45a3 100644
--- a/drivers/net/wan/syncppp.c
+++ b/drivers/net/wan/syncppp.c
@@ -107,24 +107,24 @@
 struct ppp_header {
 	u8 address;
 	u8 control;
-	u16 protocol;
+	__be16 protocol;
 };
 #define PPP_HEADER_LEN          sizeof (struct ppp_header)
 
 struct lcp_header {
 	u8 type;
 	u8 ident;
-	u16 len;
+	__be16 len;
 };
 #define LCP_HEADER_LEN          sizeof (struct lcp_header)
 
 struct cisco_packet {
-	u32 type;
-	u32 par1;
-	u32 par2;
-	u16 rel;
-	u16 time0;
-	u16 time1;
+	__be32 type;
+	__be32 par1;
+	__be32 par2;
+	__be16 rel;
+	__be16 time0;
+	__be16 time1;
 };
 #define CISCO_PACKET_LEN 18
 #define CISCO_BIG_PACKET_LEN 20
@@ -139,7 +139,7 @@ static struct sk_buff_head tx_queue;
 static void sppp_keepalive (unsigned long dummy);
 static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
 	u8 ident, u16 len, void *data);
-static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2);
+static void sppp_cisco_send (struct sppp *sp, int type, u32 par1, u32 par2);
 static void sppp_lcp_input (struct sppp *sp, struct sk_buff *m);
 static void sppp_cisco_input (struct sppp *sp, struct sk_buff *m);
 static void sppp_ipcp_input (struct sppp *sp, struct sk_buff *m);
@@ -447,7 +447,7 @@ static void sppp_keepalive (unsigned long dummy)
 			sppp_cisco_send (sp, CISCO_KEEPALIVE_REQ, ++sp->pp_seq,
 				sp->pp_rseq);
 		else if (sp->lcp.state == LCP_STATE_OPENED) {
-			long nmagic = htonl (sp->lcp.magic);
+			__be32 nmagic = htonl (sp->lcp.magic);
 			sp->lcp.echoid = ++sp->pp_seq;
 			sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REQ,
 				sp->lcp.echoid, 4, &nmagic);
@@ -667,7 +667,7 @@ badreq:
 					dev->name, len);
 			break;
 		}
-		if (ntohl (*(long*)(h+1)) == sp->lcp.magic) {
+		if (ntohl (*(__be32*)(h+1)) == sp->lcp.magic) {
 			/* Line loopback mode detected. */
 			printk (KERN_WARNING "%s: loopback\n", dev->name);
 			if_down (dev);
@@ -680,7 +680,7 @@ badreq:
 			sppp_lcp_open (sp);
 			break;
 		}
-		*(long*)(h+1) = htonl (sp->lcp.magic);
+		*(__be32 *)(h+1) = htonl (sp->lcp.magic);
 		sppp_cp_send (sp, PPP_LCP, LCP_ECHO_REPLY, h->ident, len-4, h+1);
 		break;
 	case LCP_ECHO_REPLY:
@@ -692,7 +692,7 @@ badreq:
 					dev->name, len);
 			break;
 		}
-		if (ntohl (*(long*)(h+1)) != sp->lcp.magic)
+		if (ntohl(*(__be32 *)(h+1)) != sp->lcp.magic)
 		sp->pp_alivecnt = 0;
 		break;
 	}
@@ -765,7 +765,7 @@ static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
 		{
 		struct in_device *in_dev;
 		struct in_ifaddr *ifa;
-		__be32 addr = 0, mask = ~0; /* FIXME: is the mask correct? */
+		__be32 addr = 0, mask = htonl(~0U); /* FIXME: is the mask correct? */
 #ifdef CONFIG_INET
 		rcu_read_lock();
 		if ((in_dev = __in_dev_get_rcu(dev)) != NULL)
@@ -782,8 +782,7 @@ static void sppp_cisco_input (struct sppp *sp, struct sk_buff *skb)
 		}
 		rcu_read_unlock();
 #endif		
-		/* I hope both addr and mask are in the net order */
-		sppp_cisco_send (sp, CISCO_ADDR_REPLY, addr, mask);
+		sppp_cisco_send (sp, CISCO_ADDR_REPLY, ntohl(addr), ntohl(mask));
 		break;
 		}
 	}
@@ -844,7 +843,7 @@ static void sppp_cp_send (struct sppp *sp, u16 proto, u8 type,
  * Send Cisco keepalive packet.
  */
 
-static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2)
+static void sppp_cisco_send (struct sppp *sp, int type, u32 par1, u32 par2)
 {
 	struct ppp_header *h;
 	struct cisco_packet *ch;
@@ -868,7 +867,7 @@ static void sppp_cisco_send (struct sppp *sp, int type, long par1, long par2)
 	ch->type = htonl (type);
 	ch->par1 = htonl (par1);
 	ch->par2 = htonl (par2);
-	ch->rel = -1;
+	ch->rel = htons(0xffff);
 	ch->time0 = htons ((u16) (t >> 16));
 	ch->time1 = htons ((u16) t);