diff --git a/[refs] b/[refs]
index df2968b2051e..5ada83140661 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e8e16b706e8406f1ab3bccab16932ebc513896d8
+refs/heads/master: 209261c019f56d77f6a0cc38048e9a6f25867589
diff --git a/trunk/drivers/atm/firestream.c b/trunk/drivers/atm/firestream.c
index 98099f526d82..47c57a4294b7 100644
--- a/trunk/drivers/atm/firestream.c
+++ b/trunk/drivers/atm/firestream.c
@@ -978,7 +978,6 @@ static int fs_open(struct atm_vcc *atm_vcc)
 		/* Docs are vague about this atm_hdr field. By the way, the FS
 		 * chip makes odd errors if lower bits are set.... -- REW */
 		tc->atm_hdr =  (vpi << 20) | (vci << 4); 
-		tmc0 = 0;
 		{
 			int pcr = atm_pcr_goal (txtp);
 
diff --git a/trunk/drivers/net/bonding/bond_sysfs.c b/trunk/drivers/net/bonding/bond_sysfs.c
index 979c2d05ff9c..90a1f31e8e63 100644
--- a/trunk/drivers/net/bonding/bond_sysfs.c
+++ b/trunk/drivers/net/bonding/bond_sysfs.c
@@ -341,7 +341,6 @@ static ssize_t bonding_store_slaves(struct device *d,
 
 	if (command[0] == '-') {
 		dev = NULL;
-		original_mtu = 0;
 		bond_for_each_slave(bond, slave, i)
 			if (strnicmp(slave->dev->name, ifname, IFNAMSIZ) == 0) {
 				dev = slave->dev;
diff --git a/trunk/drivers/net/tulip/eeprom.c b/trunk/drivers/net/tulip/eeprom.c
index 206918bad539..da2206f6021d 100644
--- a/trunk/drivers/net/tulip/eeprom.c
+++ b/trunk/drivers/net/tulip/eeprom.c
@@ -343,6 +343,12 @@ int __devinit tulip_read_eeprom(struct net_device *dev, int location, int addr_l
 	void __iomem *ee_addr = tp->base_addr + CSR9;
 	int read_cmd = location | (EE_READ_CMD << addr_len);
 
+	/* If location is past the end of what we can address, don't
+	 * read some other location (ie truncate). Just return zero.
+	 */
+	if (location > (1 << addr_len) - 1)
+		return 0;
+
 	iowrite32(EE_ENB & ~EE_CS, ee_addr);
 	iowrite32(EE_ENB, ee_addr);
 
diff --git a/trunk/drivers/net/tulip/tulip_core.c b/trunk/drivers/net/tulip/tulip_core.c
index ed600bf56e78..82f404b76d81 100644
--- a/trunk/drivers/net/tulip/tulip_core.c
+++ b/trunk/drivers/net/tulip/tulip_core.c
@@ -1437,6 +1437,7 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
 	   EEPROM.
 	   */
 	ee_data = tp->eeprom;
+	memset(ee_data, 0, sizeof(tp->eeprom));
 	sum = 0;
 	if (chip_idx == LC82C168) {
 		for (i = 0; i < 3; i++) {
@@ -1458,8 +1459,12 @@ static int __devinit tulip_init_one (struct pci_dev *pdev,
 		/* A serial EEPROM interface, we read now and sort it out later. */
 		int sa_offset = 0;
 		int ee_addr_size = tulip_read_eeprom(dev, 0xff, 8) & 0x40000 ? 8 : 6;
+		int ee_max_addr = ((1 << ee_addr_size) - 1) * sizeof(u16);
 
-		for (i = 0; i < sizeof(tp->eeprom); i+=2) {
+		if (ee_max_addr > sizeof(tp->eeprom))
+			ee_max_addr = sizeof(tp->eeprom);
+
+		for (i = 0; i < ee_max_addr ; i += sizeof(u16)) {
 			u16 data = tulip_read_eeprom(dev, i/2, ee_addr_size);
 			ee_data[i] = data & 0xff;
 			ee_data[i + 1] = data >> 8;
diff --git a/trunk/drivers/net/wan/lapbether.c b/trunk/drivers/net/wan/lapbether.c
index 824df3b5ea49..fb37b8095231 100644
--- a/trunk/drivers/net/wan/lapbether.c
+++ b/trunk/drivers/net/wan/lapbether.c
@@ -58,7 +58,7 @@ struct lapbethdev {
 	struct net_device_stats stats;		/* some statistics */
 };
 
-static LIST_HEAD(lapbeth_devices);
+static struct list_head lapbeth_devices = LIST_HEAD_INIT(lapbeth_devices);
 
 /* ------------------------------------------------------------------------ */
 
diff --git a/trunk/include/linux/netdevice.h b/trunk/include/linux/netdevice.h
index ee81906b5164..fae6a7ececdb 100644
--- a/trunk/include/linux/netdevice.h
+++ b/trunk/include/linux/netdevice.h
@@ -1074,14 +1074,12 @@ static inline int netif_is_multiqueue(const struct net_device *dev)
 }
 
 /* Use this variant when it is known for sure that it
- * is executing from hardware interrupt context or with hardware interrupts
- * disabled.
+ * is executing from interrupt context.
  */
 extern void dev_kfree_skb_irq(struct sk_buff *skb);
 
 /* Use this variant in places where it could be invoked
- * from either hardware interrupt or other context, with hardware interrupts
- * either disabled or enabled.
+ * either from interrupt or non-interrupt context.
  */
 extern void dev_kfree_skb_any(struct sk_buff *skb);
 
diff --git a/trunk/include/net/llc.h b/trunk/include/net/llc.h
index 7940da1606e7..f5024583fc8b 100644
--- a/trunk/include/net/llc.h
+++ b/trunk/include/net/llc.h
@@ -65,6 +65,7 @@ struct llc_sap {
 
 extern struct list_head llc_sap_list;
 extern rwlock_t llc_sap_list_lock;
+extern unsigned char llc_station_mac_sa[ETH_ALEN];
 
 extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
 		   struct packet_type *pt, struct net_device *orig_dev);
diff --git a/trunk/net/bluetooth/hci_sock.c b/trunk/net/bluetooth/hci_sock.c
index 1d36c093523b..b5d4019d3572 100644
--- a/trunk/net/bluetooth/hci_sock.c
+++ b/trunk/net/bluetooth/hci_sock.c
@@ -84,7 +84,7 @@ static struct hci_sec_filter hci_sec_filter = {
 };
 
 static struct bt_sock_list hci_sk_list = {
-	.lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
+	.lock = RW_LOCK_UNLOCKED
 };
 
 /* Send frame to RAW socket */
diff --git a/trunk/net/bluetooth/l2cap.c b/trunk/net/bluetooth/l2cap.c
index 2957df4b6c0b..34f8bf98bc05 100644
--- a/trunk/net/bluetooth/l2cap.c
+++ b/trunk/net/bluetooth/l2cap.c
@@ -62,7 +62,7 @@ static u32 l2cap_feat_mask = 0x0000;
 static const struct proto_ops l2cap_sock_ops;
 
 static struct bt_sock_list l2cap_sk_list = {
-	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
+	.lock = RW_LOCK_UNLOCKED
 };
 
 static void __l2cap_sock_close(struct sock *sk, int reason);
diff --git a/trunk/net/bluetooth/rfcomm/sock.c b/trunk/net/bluetooth/rfcomm/sock.c
index af4e3934ee84..c46d51035e77 100644
--- a/trunk/net/bluetooth/rfcomm/sock.c
+++ b/trunk/net/bluetooth/rfcomm/sock.c
@@ -60,7 +60,7 @@
 static const struct proto_ops rfcomm_sock_ops;
 
 static struct bt_sock_list rfcomm_sk_list = {
-	.lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
+	.lock = RW_LOCK_UNLOCKED
 };
 
 static void rfcomm_sock_close(struct sock *sk);
diff --git a/trunk/net/bluetooth/sco.c b/trunk/net/bluetooth/sco.c
index cd887cdca426..b91d3c81a73c 100644
--- a/trunk/net/bluetooth/sco.c
+++ b/trunk/net/bluetooth/sco.c
@@ -58,7 +58,7 @@
 static const struct proto_ops sco_sock_ops;
 
 static struct bt_sock_list sco_sk_list = {
-	.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
+	.lock = RW_LOCK_UNLOCKED
 };
 
 static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
diff --git a/trunk/net/ipv4/inet_fragment.c b/trunk/net/ipv4/inet_fragment.c
index a0a3c78cb5e0..724d69aed031 100644
--- a/trunk/net/ipv4/inet_fragment.c
+++ b/trunk/net/ipv4/inet_fragment.c
@@ -86,10 +86,7 @@ EXPORT_SYMBOL(inet_frags_fini);
 void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f)
 {
 	nf->low_thresh = 0;
-
-	local_bh_disable();
 	inet_frag_evictor(nf, f);
-	local_bh_enable();
 }
 EXPORT_SYMBOL(inet_frags_exit_net);
 
diff --git a/trunk/net/ipv4/ip_forward.c b/trunk/net/ipv4/ip_forward.c
index a4506c8cfef0..0b3b328d82db 100644
--- a/trunk/net/ipv4/ip_forward.c
+++ b/trunk/net/ipv4/ip_forward.c
@@ -85,7 +85,7 @@ int ip_forward(struct sk_buff *skb)
 	if (opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
 		goto sr_failed;
 
-	if (unlikely(skb->len > dst_mtu(&rt->u.dst) && !skb_is_gso(skb) &&
+	if (unlikely(skb->len > dst_mtu(&rt->u.dst) &&
 		     (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
 		IP_INC_STATS(IPSTATS_MIB_FRAGFAILS);
 		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
diff --git a/trunk/net/ipv6/netfilter/nf_conntrack_reasm.c b/trunk/net/ipv6/netfilter/nf_conntrack_reasm.c
index 24c0d03095bf..2a0d698b24d5 100644
--- a/trunk/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/trunk/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -171,9 +171,7 @@ static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 
 static void nf_ct_frag6_evictor(void)
 {
-	local_bh_disable();
 	inet_frag_evictor(&nf_init_frags, &nf_frags);
-	local_bh_enable();
 }
 
 static void nf_ct_frag6_expire(unsigned long data)
diff --git a/trunk/net/llc/llc_core.c b/trunk/net/llc/llc_core.c
index 00de27cef46b..248b5903bb13 100644
--- a/trunk/net/llc/llc_core.c
+++ b/trunk/net/llc/llc_core.c
@@ -25,6 +25,8 @@
 LIST_HEAD(llc_sap_list);
 DEFINE_RWLOCK(llc_sap_list_lock);
 
+unsigned char llc_station_mac_sa[ETH_ALEN];
+
 /**
  *	llc_sap_alloc - allocates and initializes sap.
  *
@@ -35,8 +37,8 @@ static struct llc_sap *llc_sap_alloc(void)
 	struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
 
 	if (sap) {
-		/* sap->laddr.mac - leave as a null, it's filled by bind */
 		sap->state = LLC_SAP_STATE_ACTIVE;
+		memcpy(sap->laddr.mac, llc_station_mac_sa, ETH_ALEN);
 		rwlock_init(&sap->sk_list.lock);
 		atomic_set(&sap->refcnt, 1);
 	}
@@ -165,6 +167,10 @@ static int __init llc_init(void)
 	if (dev != NULL)
 		dev = next_net_device(dev);
 
+	if (dev != NULL)
+		memcpy(llc_station_mac_sa, dev->dev_addr, ETH_ALEN);
+	else
+		memset(llc_station_mac_sa, 0, ETH_ALEN);
 	dev_add_pack(&llc_packet_type);
 	dev_add_pack(&llc_tr_packet_type);
 	return 0;
diff --git a/trunk/net/llc/llc_input.c b/trunk/net/llc/llc_input.c
index bfd2567dd365..c40c9b2a345a 100644
--- a/trunk/net/llc/llc_input.c
+++ b/trunk/net/llc/llc_input.c
@@ -117,12 +117,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
 	skb_pull(skb, llc_len);
 	if (skb->protocol == htons(ETH_P_802_2)) {
 		__be16 pdulen = eth_hdr(skb)->h_proto;
-		s32 data_size = ntohs(pdulen) - llc_len;
+		u16 data_size = ntohs(pdulen) - llc_len;
 
-		if (data_size < 0 ||
-		    ((skb_tail_pointer(skb) -
-		      (u8 *)pdu) - llc_len) < data_size)
-			return 0;
 		if (unlikely(pskb_trim_rcsum(skb, data_size)))
 			return 0;
 	}
diff --git a/trunk/net/llc/llc_station.c b/trunk/net/llc/llc_station.c
index 959e7f31833b..6f2ea2090322 100644
--- a/trunk/net/llc/llc_station.c
+++ b/trunk/net/llc/llc_station.c
@@ -259,7 +259,7 @@ static int llc_station_ac_send_null_dsap_xid_c(struct sk_buff *skb)
 		goto out;
 	llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, 0, LLC_PDU_CMD);
 	llc_pdu_init_as_xid_cmd(nskb, LLC_XID_NULL_CLASS_2, 127);
-	rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, skb->dev->dev_addr);
+	rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, llc_station_mac_sa);
 	if (unlikely(rc))
 		goto free;
 	llc_station_send_pdu(nskb);
@@ -283,7 +283,7 @@ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
 	llc_pdu_decode_ssap(skb, &dsap);
 	llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
 	llc_pdu_init_as_xid_rsp(nskb, LLC_XID_NULL_CLASS_2, 127);
-	rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
+	rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
 	if (unlikely(rc))
 		goto free;
 	llc_station_send_pdu(nskb);
@@ -307,7 +307,7 @@ static int llc_station_ac_send_test_r(struct sk_buff *skb)
 	llc_pdu_decode_ssap(skb, &dsap);
 	llc_pdu_header_init(nskb, LLC_PDU_TYPE_U, 0, dsap, LLC_PDU_RSP);
 	llc_pdu_init_as_test_rsp(nskb, skb);
-	rc = llc_mac_hdr_init(nskb, skb->dev->dev_addr, mac_da);
+	rc = llc_mac_hdr_init(nskb, llc_station_mac_sa, mac_da);
 	if (unlikely(rc))
 		goto free;
 	llc_station_send_pdu(nskb);
diff --git a/trunk/net/sched/sch_generic.c b/trunk/net/sched/sch_generic.c
index b741618e4d54..10b5c0887fff 100644
--- a/trunk/net/sched/sch_generic.c
+++ b/trunk/net/sched/sch_generic.c
@@ -184,22 +184,10 @@ static inline int qdisc_restart(struct net_device *dev)
 
 void __qdisc_run(struct net_device *dev)
 {
-	unsigned long start_time = jiffies;
-
-	while (qdisc_restart(dev)) {
-		if (netif_queue_stopped(dev))
-			break;
-
-		/*
-		 * Postpone processing if
-		 * 1. another process needs the CPU;
-		 * 2. we've been doing it for too long.
-		 */
-		if (need_resched() || jiffies != start_time) {
-			netif_schedule(dev);
+	do {
+		if (!qdisc_restart(dev))
 			break;
-		}
-	}
+	} while (!netif_queue_stopped(dev));
 
 	clear_bit(__LINK_STATE_QDISC_RUNNING, &dev->state);
 }