Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  ipv4: dont create routes on down devices
  epic100: hamachi: yellowfin: Fix skb allocation size
  sundance: Fix oopses with corrupted skb_shared_info
  Revert "ipv4: Allow configuring subnets as local addresses"
  USB: mcs7830: return negative if auto negotiate fails
  irda: prevent integer underflow in IRLMP_ENUMDEVICES
  tcp: fix listening_get_next()
  atl1c: Do not use legacy PCI power management
  mac80211: fix mesh forwarding
  MAINTAINERS: email address change
  net: Fix range checks in tcf_valid_offset().
  net_sched: sch_sfq: fix allot handling
  hostap: remove netif_stop_queue from init
  mac80211/rt2x00: add ieee80211_tx_status_ni()
  typhoon: memory corruption in typhoon_get_drvinfo()
  net: Add USB PID for new MOSCHIP USB ethernet controller MCS7832 variant
  net_sched: always clone skbs
  ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed.
  netlink: fix gcc -Wconversion compilation warning
  asix: add USB ID for Logitec LAN-GTJ U2A
  ...

diff --combined MAINTAINERS
index 239782e51f776d6aff7e72d9400ed458a8bd2a43,b0b118a546ae9c173ce1adc15b1b205224475755..71e40f9118df5d9d1f002a84f48e8600ac533176
--- 1/MAINTAINERS
--- 2/MAINTAINERS
+++ b/MAINTAINERS
@@@ -405,7 -405,7 +405,7 @@@ S: Supporte
  F:    drivers/usb/gadget/amd5536udc.*
  
  AMD GEODE PROCESSOR/CHIPSET SUPPORT
 -P:    Jordan Crouse
 +P:    Andres Salomon <dilinger@queued.net>
  L:    linux-geode@lists.infradead.org (moderated for non-subscribers)
  W:    http://www.amd.com/us-en/ConnectivitySolutions/TechnicalResources/0,,50_2334_2452_11363,00.html
  S:    Supported
@@@ -559,14 -559,14 +559,14 @@@ W:      http://maxim.org.za/at91_26.htm
  S:    Maintained
  
  ARM/BCMRING ARM ARCHITECTURE
 -M:    Leo Chen <leochen@broadcom.com>
 +M:    Jiandong Zheng <jdzheng@broadcom.com>
  M:    Scott Branden <sbranden@broadcom.com>
  L:    linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
  S:    Maintained
  F:    arch/arm/mach-bcmring
  
  ARM/BCMRING MTD NAND DRIVER
 -M:    Leo Chen <leochen@broadcom.com>
 +M:    Jiandong Zheng <jdzheng@broadcom.com>
  M:    Scott Branden <sbranden@broadcom.com>
  L:    linux-mtd@lists.infradead.org
  S:    Maintained
@@@ -815,7 -815,7 +815,7 @@@ F: drivers/mmc/host/msm_sdcc.
  F:    drivers/mmc/host/msm_sdcc.h
  F:    drivers/serial/msm_serial.h
  F:    drivers/serial/msm_serial.c
 -T:    git git://codeaurora.org/quic/kernel/dwalker/linux-msm.git
 +T:    git git://codeaurora.org/quic/kernel/davidb/linux-msm.git
  S:    Maintained
  
  ARM/TOSA MACHINE SUPPORT
@@@ -945,7 -945,7 +945,7 @@@ M: Magnus Damm <magnus.damm@gmail.com
  L:    linux-sh@vger.kernel.org
  W:    http://oss.renesas.com
  Q:    http://patchwork.kernel.org/project/linux-sh/list/
 -T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/genesis-2.6.git
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.git rmobile-latest
  S:    Supported
  F:    arch/arm/mach-shmobile/
  F:    drivers/sh/
@@@ -2015,7 -2015,6 +2015,7 @@@ F:      drivers/hwmon/dme1737.
  DOCBOOK FOR DOCUMENTATION
  M:    Randy Dunlap <rdunlap@xenotime.net>
  S:    Maintained
 +F:    scripts/kernel-doc
  
  DOCKING STATION DRIVER
  M:    Shaohua Li <shaohua.li@intel.com>
@@@ -2026,7 -2025,6 +2026,7 @@@ F:      drivers/acpi/dock.
  DOCUMENTATION
  M:    Randy Dunlap <rdunlap@xenotime.net>
  L:    linux-doc@vger.kernel.org
 +T:    quilt oss.oracle.com/~rdunlap/kernel-doc-patches/current/
  S:    Maintained
  F:    Documentation/
  
@@@ -2060,7 -2058,7 +2060,7 @@@ F:      Documentation/blockdev/drbd
  
  DRIVER CORE, KOBJECTS, DEBUGFS AND SYSFS
  M:    Greg Kroah-Hartman <gregkh@suse.de>
 -T:    quilt kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6.git
  S:    Supported
  F:    Documentation/kobject.txt
  F:    drivers/base/
@@@ -2080,7 -2078,7 +2080,7 @@@ F:      include/drm
  
  INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
  M:    Chris Wilson <chris@chris-wilson.co.uk>
 -L:    intel-gfx@lists.freedesktop.org
 +L:    intel-gfx@lists.freedesktop.org (subscribers-only)
  L:    dri-devel@lists.freedesktop.org
  T:    git git://git.kernel.org/pub/scm/linux/kernel/git/ickle/drm-intel.git
  S:    Supported
@@@ -2444,12 -2442,9 +2444,12 @@@ F:    drivers/net/wan/sdla.
  FRAMEBUFFER LAYER
  L:    linux-fbdev@vger.kernel.org
  W:    http://linux-fbdev.sourceforge.net/
 +Q:    http://patchwork.kernel.org/project/linux-fbdev/list/
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6.git
  S:    Orphan
  F:    Documentation/fb/
 -F:    drivers/video/fb*
 +F:    drivers/video/
 +F:    include/video/
  F:    include/linux/fb.h
  
  FREESCALE DMA DRIVER
@@@ -4064,8 -4059,9 +4064,8 @@@ F:      drivers/scsi/NCR_D700.
  
  NETEFFECT IWARP RNIC DRIVER (IW_NES)
  M:    Faisal Latif <faisal.latif@intel.com>
 -M:    Chien Tung <chien.tin.tung@intel.com>
  L:    linux-rdma@vger.kernel.org
 -W:    http://www.neteffect.com
 +W:    http://www.intel.com/Products/Server/Adapters/Server-Cluster/Server-Cluster-overview.htm
  S:    Supported
  F:    drivers/infiniband/hw/nes/
  
@@@ -4590,7 -4586,7 +4590,7 @@@ F:      drivers/pcmcia
  F:    include/pcmcia/
  
  PCNET32 NETWORK DRIVER
- M:    Don Fry <pcnet32@verizon.net>
+ M:    Don Fry <pcnet32@frontier.com>
  L:    netdev@vger.kernel.org
  S:    Maintained
  F:    drivers/net/pcnet32.c
@@@ -5716,7 -5712,7 +5716,7 @@@ M:      Paul Mundt <lethal@linux-sh.org
  L:    linux-sh@vger.kernel.org
  W:    http://www.linux-sh.org
  Q:    http://patchwork.kernel.org/project/linux-sh/list/
 -T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.git
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.git sh-latest
  S:    Supported
  F:    Documentation/sh/
  F:    arch/sh/
@@@ -5838,8 -5834,6 +5838,8 @@@ M:      Chris Metcalf <cmetcalf@tilera.com
  W:    http://www.tilera.com/scm/
  S:    Supported
  F:    arch/tile/
 +F:    drivers/char/hvc_tile.c
 +F:    drivers/net/tile/
  
  TLAN NETWORK DRIVER
  M:    Samuel Chessman <chessman@tux.org>
@@@ -6583,15 -6577,6 +6583,15 @@@ F:    include/linux/mfd/wm8400
  F:    include/sound/wm????.h
  F:    sound/soc/codecs/wm*
  
 +WORKQUEUE
 +M:    Tejun Heo <tj@kernel.org>
 +L:    linux-kernel@vger.kernel.org
 +T:    git git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq.git
 +S:    Maintained
 +F:    include/linux/workqueue.h
 +F:    kernel/workqueue.c
 +F:    Documentation/workqueue.txt
 +
  X.25 NETWORK LAYER
  M:    Andrew Hendry <andrew.hendry@gmail.com>
  L:    linux-x25@vger.kernel.org

diff --combined net/irda/af_irda.c
index a6de3059746ddd3f3039d564f20acf394225e3ad,5007541b6478d1b4a111edbec43e67151475656e..c9890e25cd4c9681b14f838976a97ed4db560ac7
--- 1/net/irda/af_irda.c
--- 2/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@@ -45,6 -45,7 +45,6 @@@
  #include <linux/capability.h>
  #include <linux/module.h>
  #include <linux/types.h>
 -#include <linux/smp_lock.h>
  #include <linux/socket.h>
  #include <linux/sockios.h>
  #include <linux/slab.h>
@@@ -2280,6 -2281,16 +2280,16 @@@ static int irda_getsockopt(struct socke
  
        switch (optname) {
        case IRLMP_ENUMDEVICES:
+ 
+               /* Offset to first device entry */
+               offset = sizeof(struct irda_device_list) -
+                       sizeof(struct irda_device_info);
+ 
+               if (len < offset) {
+                       err = -EINVAL;
+                       goto out;
+               }
+ 
                /* Ask lmp for the current discovery log */
                discoveries = irlmp_get_discoveries(&list.len, self->mask.word,
                                                    self->nslots);
@@@ -2290,15 -2301,9 +2300,9 @@@
                }
  
                /* Write total list length back to client */
-               if (copy_to_user(optval, &list,
-                                sizeof(struct irda_device_list) -
-                                sizeof(struct irda_device_info)))
+               if (copy_to_user(optval, &list, offset))
                        err = -EFAULT;
  
-               /* Offset to first device entry */
-               offset = sizeof(struct irda_device_list) -
-                       sizeof(struct irda_device_info);
- 
                /* Copy the list itself - watch for overflow */
                if (list.len > 2048) {
                        err = -EINVAL;