diff --git a/[refs] b/[refs]
index 71de7d530634..76ea712269ee 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 392eaef2e9f8e6527043ad8422d9cfea59ee6fb0
+refs/heads/master: 8806048878fce541afe1d72cd2320f092519f90a
diff --git a/trunk/arch/mips/sibyte/swarm/platform.c b/trunk/arch/mips/sibyte/swarm/platform.c
index dd0e5b9b64e8..54847fe1e564 100644
--- a/trunk/arch/mips/sibyte/swarm/platform.c
+++ b/trunk/arch/mips/sibyte/swarm/platform.c
@@ -9,6 +9,8 @@
 #include <asm/sibyte/sb1250_genbus.h>
 #include <asm/sibyte/sb1250_regs.h>
 
+#if defined(CONFIG_SIBYTE_SWARM) || defined(CONFIG_SIBYTE_LITTLESUR)
+
 #define DRV_NAME	"pata-swarm"
 
 #define SWARM_IDE_SHIFT	5
@@ -79,3 +81,5 @@ static int __init swarm_pata_init(void)
 }
 
 device_initcall(swarm_pata_init);
+
+#endif /* defined(CONFIG_SIBYTE_SWARM) || defined(CONFIG_SIBYTE_LITTLESUR) */
diff --git a/trunk/drivers/bluetooth/bpa10x.c b/trunk/drivers/bluetooth/bpa10x.c
index 32f3a8ed8d3d..1e55a658e6ce 100644
--- a/trunk/drivers/bluetooth/bpa10x.c
+++ b/trunk/drivers/bluetooth/bpa10x.c
@@ -256,6 +256,7 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
 		BT_ERR("%s urb %p submission failed (%d)",
 						hdev->name, urb, -err);
 		usb_unanchor_urb(urb);
+		kfree(buf);
 	}
 
 	usb_free_urb(urb);
@@ -297,6 +298,7 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
 		BT_ERR("%s urb %p submission failed (%d)",
 						hdev->name, urb, -err);
 		usb_unanchor_urb(urb);
+		kfree(buf);
 	}
 
 	usb_free_urb(urb);
diff --git a/trunk/drivers/bluetooth/btusb.c b/trunk/drivers/bluetooth/btusb.c
index af472e052732..29ae99817c60 100644
--- a/trunk/drivers/bluetooth/btusb.c
+++ b/trunk/drivers/bluetooth/btusb.c
@@ -102,7 +102,6 @@ static struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
 
 	/* Broadcom BCM2046 */
-	{ USB_DEVICE(0x0a5c, 0x2146), .driver_info = BTUSB_RESET },
 	{ USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET },
 
 	/* Apple MacBook Pro with Broadcom chip */
@@ -114,7 +113,6 @@ static struct usb_device_id blacklist_table[] = {
 
 	/* Targus ACB10US */
 	{ USB_DEVICE(0x0a5c, 0x2100), .driver_info = BTUSB_RESET },
-	{ USB_DEVICE(0x0a5c, 0x2154), .driver_info = BTUSB_RESET },
 
 	/* ANYCOM Bluetooth USB-200 and USB-250 */
 	{ USB_DEVICE(0x0a5c, 0x2111), .driver_info = BTUSB_RESET },
@@ -152,9 +150,6 @@ static struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
 	{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU },
 
-	/* Belkin F8T016 device */
-	{ USB_DEVICE(0x050d, 0x016a), .driver_info = BTUSB_RESET },
-
 	/* Digianswer devices */
 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 	{ USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
@@ -276,6 +271,7 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev)
 		BT_ERR("%s urb %p submission failed (%d)",
 						hdev->name, urb, -err);
 		usb_unanchor_urb(urb);
+		kfree(buf);
 	}
 
 	usb_free_urb(urb);
@@ -358,6 +354,7 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev)
 		BT_ERR("%s urb %p submission failed (%d)",
 						hdev->name, urb, -err);
 		usb_unanchor_urb(urb);
+		kfree(buf);
 	}
 
 	usb_free_urb(urb);
@@ -478,6 +475,7 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev)
 		BT_ERR("%s urb %p submission failed (%d)",
 						hdev->name, urb, -err);
 		usb_unanchor_urb(urb);
+		kfree(buf);
 	}
 
 	usb_free_urb(urb);
diff --git a/trunk/net/ax25/af_ax25.c b/trunk/net/ax25/af_ax25.c
index 28c71574a781..01c83e2a4c19 100644
--- a/trunk/net/ax25/af_ax25.c
+++ b/trunk/net/ax25/af_ax25.c
@@ -317,9 +317,6 @@ void ax25_destroy_socket(ax25_cb *ax25)
 				/* Queue the unaccepted socket for death */
 				sock_orphan(skb->sk);
 
-				/* 9A4GL: hack to release unaccepted sockets */
-				skb->sk->sk_state = TCP_LISTEN;
-
 				ax25_start_heartbeat(sax25);
 				sax25->state = AX25_STATE_0;
 			}
diff --git a/trunk/net/ax25/ax25_std_timer.c b/trunk/net/ax25/ax25_std_timer.c
index 96e4b9273250..cdc7e751ef36 100644
--- a/trunk/net/ax25/ax25_std_timer.c
+++ b/trunk/net/ax25/ax25_std_timer.c
@@ -39,11 +39,9 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
 
 	switch (ax25->state) {
 	case AX25_STATE_0:
-		/* Magic here: If we listen() and a new link dies before it
-		   is accepted() it isn't 'dead' so doesn't get removed. */
-		if (!sk || sock_flag(sk, SOCK_DESTROY) ||
-		    (sk->sk_state == TCP_LISTEN &&
-		     sock_flag(sk, SOCK_DEAD))) {
+		if (!sk ||
+		    sock_flag(sk, SOCK_DESTROY) ||
+		    sock_flag(sk, SOCK_DEAD)) {
 			if (sk) {
 				sock_hold(sk);
 				ax25_destroy_socket(ax25);
diff --git a/trunk/net/core/dev.c b/trunk/net/core/dev.c
index 0ae08d3f57e7..e8eb2b478344 100644
--- a/trunk/net/core/dev.c
+++ b/trunk/net/core/dev.c
@@ -2918,12 +2918,6 @@ int netdev_set_master(struct net_device *slave, struct net_device *master)
 	return 0;
 }
 
-static void dev_change_rx_flags(struct net_device *dev, int flags)
-{
-	if (dev->flags & IFF_UP && dev->change_rx_flags)
-		dev->change_rx_flags(dev, flags);
-}
-
 static int __dev_set_promiscuity(struct net_device *dev, int inc)
 {
 	unsigned short old_flags = dev->flags;
@@ -2961,7 +2955,8 @@ static int __dev_set_promiscuity(struct net_device *dev, int inc)
 				current->uid, current->gid,
 				audit_get_sessionid(current));
 
-		dev_change_rx_flags(dev, IFF_PROMISC);
+		if (dev->change_rx_flags)
+			dev->change_rx_flags(dev, IFF_PROMISC);
 	}
 	return 0;
 }
@@ -3027,7 +3022,8 @@ int dev_set_allmulti(struct net_device *dev, int inc)
 		}
 	}
 	if (dev->flags ^ old_flags) {
-		dev_change_rx_flags(dev, IFF_ALLMULTI);
+		if (dev->change_rx_flags)
+			dev->change_rx_flags(dev, IFF_ALLMULTI);
 		dev_set_rx_mode(dev);
 	}
 	return 0;
@@ -3351,8 +3347,8 @@ int dev_change_flags(struct net_device *dev, unsigned flags)
 	 *	Load in the correct multicast list now the flags have changed.
 	 */
 
-	if ((old_flags ^ flags) & IFF_MULTICAST)
-		dev_change_rx_flags(dev, IFF_MULTICAST);
+	if (dev->change_rx_flags && (old_flags ^ flags) & IFF_MULTICAST)
+		dev->change_rx_flags(dev, IFF_MULTICAST);
 
 	dev_set_rx_mode(dev);
 
@@ -3812,11 +3808,14 @@ static int dev_new_index(struct net *net)
 }
 
 /* Delayed registration/unregisteration */
+static DEFINE_SPINLOCK(net_todo_list_lock);
 static LIST_HEAD(net_todo_list);
 
 static void net_set_todo(struct net_device *dev)
 {
+	spin_lock(&net_todo_list_lock);
 	list_add_tail(&dev->todo_list, &net_todo_list);
+	spin_unlock(&net_todo_list_lock);
 }
 
 static void rollback_registered(struct net_device *dev)
@@ -4143,24 +4142,33 @@ static void netdev_wait_allrefs(struct net_device *dev)
  *	free_netdev(y1);
  *	free_netdev(y2);
  *
- * We are invoked by rtnl_unlock().
+ * We are invoked by rtnl_unlock() after it drops the semaphore.
  * This allows us to deal with problems:
  * 1) We can delete sysfs objects which invoke hotplug
  *    without deadlocking with linkwatch via keventd.
  * 2) Since we run with the RTNL semaphore not held, we can sleep
  *    safely in order to wait for the netdev refcnt to drop to zero.
- *
- * We must not return until all unregister events added during
- * the interval the lock was held have been completed.
  */
+static DEFINE_MUTEX(net_todo_run_mutex);
 void netdev_run_todo(void)
 {
 	struct list_head list;
 
+	/* Need to guard against multiple cpu's getting out of order. */
+	mutex_lock(&net_todo_run_mutex);
+
+	/* Not safe to do outside the semaphore.  We must not return
+	 * until all unregister events invoked by the local processor
+	 * have been completed (either by this todo run, or one on
+	 * another cpu).
+	 */
+	if (list_empty(&net_todo_list))
+		goto out;
+
 	/* Snapshot list, allow later requests */
+	spin_lock(&net_todo_list_lock);
 	list_replace_init(&net_todo_list, &list);
-
-	__rtnl_unlock();
+	spin_unlock(&net_todo_list_lock);
 
 	while (!list_empty(&list)) {
 		struct net_device *dev
@@ -4192,6 +4200,9 @@ void netdev_run_todo(void)
 		/* Free network device */
 		kobject_put(&dev->dev.kobj);
 	}
+
+out:
+	mutex_unlock(&net_todo_run_mutex);
 }
 
 static struct net_device_stats *internal_stats(struct net_device *dev)
diff --git a/trunk/net/core/rtnetlink.c b/trunk/net/core/rtnetlink.c
index d6381c2a4693..71edb8b36341 100644
--- a/trunk/net/core/rtnetlink.c
+++ b/trunk/net/core/rtnetlink.c
@@ -73,7 +73,7 @@ void __rtnl_unlock(void)
 
 void rtnl_unlock(void)
 {
-	/* This fellow will unlock it for us. */
+	mutex_unlock(&rtnl_mutex);
 	netdev_run_todo();
 }
 
diff --git a/trunk/net/ipv4/tcp_hybla.c b/trunk/net/ipv4/tcp_hybla.c
index c209e054a634..bfcbd148a89d 100644
--- a/trunk/net/ipv4/tcp_hybla.c
+++ b/trunk/net/ipv4/tcp_hybla.c
@@ -150,11 +150,7 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 		ca->snd_cwnd_cents -= 128;
 		tp->snd_cwnd_cnt = 0;
 	}
-	/* check when cwnd has not been incremented for a while */
-	if (increment == 0 && odd == 0 && tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-		tp->snd_cwnd++;
-		tp->snd_cwnd_cnt = 0;
-	}
+
 	/* clamp down slowstart cwnd to ssthresh value. */
 	if (is_slowstart)
 		tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
diff --git a/trunk/net/ipv4/tcp_input.c b/trunk/net/ipv4/tcp_input.c
index 7abc6b80d47d..67ccce2a96bd 100644
--- a/trunk/net/ipv4/tcp_input.c
+++ b/trunk/net/ipv4/tcp_input.c
@@ -4879,8 +4879,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 					goto no_ack;
 			}
 
-			if (!copied_early || tp->rcv_nxt != tp->rcv_wup)
-				__tcp_ack_snd_check(sk, 0);
+			__tcp_ack_snd_check(sk, 0);
 no_ack:
 #ifdef CONFIG_NET_DMA
 			if (copied_early)
diff --git a/trunk/net/netrom/af_netrom.c b/trunk/net/netrom/af_netrom.c
index 9f1ea4a27b35..532e4faa29f7 100644
--- a/trunk/net/netrom/af_netrom.c
+++ b/trunk/net/netrom/af_netrom.c
@@ -525,7 +525,6 @@ static int nr_release(struct socket *sock)
 	if (sk == NULL) return 0;
 
 	sock_hold(sk);
-	sock_orphan(sk);
 	lock_sock(sk);
 	nr = nr_sk(sk);
 
@@ -549,6 +548,7 @@ static int nr_release(struct socket *sock)
 		sk->sk_state    = TCP_CLOSE;
 		sk->sk_shutdown |= SEND_SHUTDOWN;
 		sk->sk_state_change(sk);
+		sock_orphan(sk);
 		sock_set_flag(sk, SOCK_DESTROY);
 		break;