diff --git a/[refs] b/[refs]
index 8af90b0cd712..b780538b5a1c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8a98d935c4b8b3515d1403d150e282f95b9f558d
+refs/heads/master: 3f97fae9482dac1dbdd870a25c89033d3a0b35dc
diff --git a/trunk/Documentation/networking/ip-sysctl.txt b/trunk/Documentation/networking/ip-sysctl.txt
index d3d653a5f9b9..bfe924217f24 100644
--- a/trunk/Documentation/networking/ip-sysctl.txt
+++ b/trunk/Documentation/networking/ip-sysctl.txt
@@ -346,7 +346,7 @@ tcp_orphan_retries - INTEGER
 	when RTO retransmissions remain unacknowledged.
 	See tcp_retries2 for more details.
 
-	The default value is 7.
+	The default value is 8.
 	If your machine is a loaded WEB server,
 	you should think about lowering this value, such sockets
 	may consume significant resources. Cf. tcp_max_orphans.
diff --git a/trunk/drivers/net/natsemi.c b/trunk/drivers/net/natsemi.c
index 8f8b65af9ed5..1f0a8333fd5c 100644
--- a/trunk/drivers/net/natsemi.c
+++ b/trunk/drivers/net/natsemi.c
@@ -140,7 +140,7 @@ MODULE_LICENSE("GPL");
 module_param(mtu, int, 0);
 module_param(debug, int, 0);
 module_param(rx_copybreak, int, 0);
-module_param(dspcfg_workaround, int, 1);
+module_param(dspcfg_workaround, int, 0);
 module_param_array(options, int, NULL, 0);
 module_param_array(full_duplex, int, NULL, 0);
 MODULE_PARM_DESC(mtu, "DP8381x MTU (all boards)");
diff --git a/trunk/drivers/net/usb/hso.c b/trunk/drivers/net/usb/hso.c
index 387ca43f26f4..304fe78ff60e 100644
--- a/trunk/drivers/net/usb/hso.c
+++ b/trunk/drivers/net/usb/hso.c
@@ -2421,10 +2421,8 @@ static void hso_free_net_device(struct hso_device *hso_dev)
 
 	remove_net_device(hso_net->parent);
 
-	if (hso_net->net) {
+	if (hso_net->net)
 		unregister_netdev(hso_net->net);
-		free_netdev(hso_net->net);
-	}
 
 	/* start freeing */
 	for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
@@ -2436,6 +2434,9 @@ static void hso_free_net_device(struct hso_device *hso_dev)
 	kfree(hso_net->mux_bulk_tx_buf);
 	hso_net->mux_bulk_tx_buf = NULL;
 
+	if (hso_net->net)
+		free_netdev(hso_net->net);
+
 	kfree(hso_dev);
 }
 
diff --git a/trunk/net/xfrm/xfrm_state.c b/trunk/net/xfrm/xfrm_state.c
index d70f85eb7864..9414b9c5b1e4 100644
--- a/trunk/net/xfrm/xfrm_state.c
+++ b/trunk/net/xfrm/xfrm_state.c
@@ -1345,6 +1345,8 @@ int xfrm_state_update(struct xfrm_state *x)
 			xfrm_state_check_expire(x1);
 
 		err = 0;
+		x->km.state = XFRM_STATE_DEAD;
+		__xfrm_state_put(x);
 	}
 	spin_unlock_bh(&x1->lock);