Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6

Conflicts:
	net/bluetooth/l2cap_core.c
	net/bluetooth/l2cap_sock.c
	net/bluetooth/mgmt.c

diff --cc net/bluetooth/hci_core.c
index a80bc1c,e7dced9..98aa24b
--- 1/net/bluetooth/hci_core.c
--- 2/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@@ -586,10 -587,8 +586,11 @@@ static int hci_dev_do_close(struct hci_
        hci_req_cancel(hdev, ENODEV);
        hci_req_lock(hdev);
  
 +      /* Stop timer, it might be running */
 +      del_timer_sync(&hdev->cmd_timer);
 +
        if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
+               del_timer_sync(&hdev->cmd_timer);
                hci_req_unlock(hdev);
                return 0;
        }

diff --cc net/bluetooth/hci_event.c
Simple merge

diff --cc net/bluetooth/l2cap_core.c
index d47de2b,2c8dd44..9e8dc13
--- 1/net/bluetooth/l2cap_core.c
--- 2/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@@ -1079,13 -1051,14 +1079,14 @@@ static void l2cap_retransmit_one_frame(
        tx_skb = skb_clone(skb, GFP_ATOMIC);
        bt_cb(skb)->retries++;
        control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+       control &= L2CAP_CTRL_SAR;
  
 -      if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
 +      if (chan->conn_state & L2CAP_CONN_SEND_FBIT) {
                control |= L2CAP_CTRL_FINAL;
 -              pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
 +              chan->conn_state &= ~L2CAP_CONN_SEND_FBIT;
        }
  
 -      control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
 +      control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                        | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
  
        put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);