17 files changed, 135 insertions, 53 deletions

diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 11f53589a3f3..d39b79f5e841 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -701,6 +701,54 @@ static int ar9550_hw_get_modes_txgain_index(struct ath_hw *ah,
         return ret;
 }
 
+static void ar9003_doubler_fix(struct ath_hw *ah)
+{
+        if (AR_SREV_9300(ah) || AR_SREV_9580(ah) || AR_SREV_9550(ah)) {
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S, 0);
+
+                udelay(200);
+
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH0_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH1_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+                REG_CLR_BIT(ah, AR_PHY_65NM_CH2_RXTX2,
+                            AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK);
+
+                udelay(1);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH1_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH2_RXTX2,
+                              AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK, 1);
+
+                udelay(200);
+
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_SYNTH12,
+                              AR_PHY_65NM_CH0_SYNTH12_VREFMUL3, 0xf);
+
+                REG_RMW(ah, AR_PHY_65NM_CH0_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH1_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+                REG_RMW(ah, AR_PHY_65NM_CH2_RXTX2, 0,
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S |
+                        1 << AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S);
+        }
+}
+
 static int ar9003_hw_process_ini(struct ath_hw *ah,
                                  struct ath9k_channel *chan)
 {
@@ -726,6 +774,8 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
                                            modesIndex);
         }
 
+        ar9003_doubler_fix(ah);
+
         /*
          * RXGAIN initvals.
          */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index fca624322dc8..2af667beb273 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -656,13 +656,24 @@
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x00000001 : 0x00000002)
 #define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S ((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0 : 1)
 #define AR_PHY_65NM_CH0_SYNTH7      0x16098
+#define AR_PHY_65NM_CH0_SYNTH12     0x160ac
 #define AR_PHY_65NM_CH0_BIAS1       0x160c0
 #define AR_PHY_65NM_CH0_BIAS2       0x160c4
 #define AR_PHY_65NM_CH0_BIAS4       0x160cc
+#define AR_PHY_65NM_CH0_RXTX2       0x16104
+#define AR_PHY_65NM_CH1_RXTX2       0x16504
+#define AR_PHY_65NM_CH2_RXTX2       0x16904
 #define AR_PHY_65NM_CH0_RXTX4       0x1610c
 #define AR_PHY_65NM_CH1_RXTX4       0x1650c
 #define AR_PHY_65NM_CH2_RXTX4       0x1690c
 
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3           0x00780000
+#define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3_S         19
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK         0x00000004
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK_S       2
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK        0x00000008
+#define AR_PHY_65NM_CH0_RXTX2_SYNTHOVR_MASK_S      3
+
 #define AR_CH0_TOP      (AR_SREV_9300(ah) ? 0x16288 : \
                          (((AR_SREV_9462(ah) || AR_SREV_9565(ah)) ? 0x1628c : 0x16280)))
 #define AR_CH0_TOP_XPABIASLVL (AR_SREV_9550(ah) ? 0x3c0 : 0x300)
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
index 4dbc294df7e3..57fc5f459d0a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
@@ -361,7 +361,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e20, 0x000003a5, 0x000003a5, 0x000003a5, 0x000003a5},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
@@ -400,7 +400,7 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x00100000},
         {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
-        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000ae20, 0x000001a6, 0x000001a6, 0x000001aa, 0x000001aa},
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
@@ -472,7 +472,7 @@ static const u32 ar9462_2p1_radio_postamble[][5] = {
 
 static const u32 ar9462_2p1_soc_preamble[][2] = {
         /* Addr      allmodes  */
-        {0x000040a4, 0x00a0c1c9},
+        {0x000040a4, 0x00a0c9c9},
         {0x00007020, 0x00000000},
         {0x00007034, 0x00000002},
         {0x00007038, 0x000004c2},
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index c00687e05688..1217c52ab28e 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -362,7 +362,8 @@ static int __ath_reg_dyn_country(struct wiphy *wiphy,
 {
         u16 country_code;
 
-        if (!ath_is_world_regd(reg))
+        if (request->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
+            !ath_is_world_regd(reg))
                 return -EINVAL;
 
         country_code = ath_regd_find_country_by_name(request->alpha2);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 5b5b952d47b1..4a2293041821 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -823,6 +823,7 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                 }
                 err = brcmf_p2p_escan(p2p, num_nodfs, chanspecs, search_state,
                                       action, P2PAPI_BSSCFG_DEVICE);
+                kfree(chanspecs);
         }
 exit:
         if (err)
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index fbad00a5abc8..aeaea0e3b4c4 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2210,8 +2210,10 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 priv->bss_started = 0;
                 priv->bss_num = 0;
 
-                if (mwifiex_cfg80211_init_p2p_client(priv))
-                        return ERR_PTR(-EFAULT);
+                if (mwifiex_cfg80211_init_p2p_client(priv)) {
+                        wdev = ERR_PTR(-EFAULT);
+                        goto done;
+                }
 
                 break;
         default:
@@ -2224,7 +2226,8 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         if (!dev) {
                 wiphy_err(wiphy, "no memory available for netdevice\n");
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-ENOMEM);
+                wdev = ERR_PTR(-ENOMEM);
+                goto done;
         }
 
         mwifiex_init_priv_params(priv, dev);
@@ -2264,7 +2267,9 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
                 wiphy_err(wiphy, "cannot register virtual network device\n");
                 free_netdev(dev);
                 priv->bss_mode = NL80211_IFTYPE_UNSPECIFIED;
-                return ERR_PTR(-EFAULT);
+                priv->netdev = NULL;
+                wdev = ERR_PTR(-EFAULT);
+                goto done;
         }
 
         sema_init(&priv->async_sem, 1);
@@ -2274,6 +2279,13 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
 #ifdef CONFIG_DEBUG_FS
         mwifiex_dev_debugfs_init(priv);
 #endif
+
+done:
+        if (IS_ERR(wdev)) {
+                kfree(priv->wdev);
+                priv->wdev = NULL;
+        }
+
         return wdev;
 }
 EXPORT_SYMBOL_GPL(mwifiex_add_virtual_intf);
@@ -2298,7 +2310,10 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
                 unregister_netdevice(wdev->netdev);
 
         /* Clear the priv in adapter */
+        priv->netdev->ieee80211_ptr = NULL;
         priv->netdev = NULL;
+        kfree(wdev);
+        priv->wdev = NULL;
 
         priv->media_connected = false;
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9d7c9d354d34..78e8a6666cc6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -411,13 +411,14 @@ static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)
  */
 static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 {
-        int ret, i;
+        int ret;
         char fmt[64];
         struct mwifiex_private *priv;
         struct mwifiex_adapter *adapter = context;
         struct mwifiex_fw_image fw;
         struct semaphore *sem = adapter->card_sem;
         bool init_failed = false;
+        struct wireless_dev *wdev;
 
         if (!firmware) {
                 dev_err(adapter->dev,
@@ -469,14 +470,16 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         priv = adapter->priv[MWIFIEX_BSS_ROLE_STA];
         if (mwifiex_register_cfg80211(adapter)) {
                 dev_err(adapter->dev, "cannot register with cfg80211\n");
-                goto err_register_cfg80211;
+                goto err_init_fw;
         }
 
         rtnl_lock();
         /* Create station interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
-                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
+        wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
+                                        NL80211_IFTYPE_STATION, NULL, NULL);
+        if (IS_ERR(wdev)) {
                 dev_err(adapter->dev, "cannot create default STA interface\n");
+                rtnl_unlock();
                 goto err_add_intf;
         }
         rtnl_unlock();
@@ -486,17 +489,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         goto done;
 
 err_add_intf:
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                if (!priv)
-                        continue;
-
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
-        }
-        rtnl_unlock();
-err_register_cfg80211:
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 err_init_fw:
@@ -1006,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         wiphy_unregister(priv->wdev->wiphy);
         wiphy_free(priv->wdev->wiphy);
 
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-                if (priv)
-                        kfree(priv->wdev);
-        }
-
         mwifiex_terminate_workqueue(adapter);
 
         /* Unregister device */
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 33fa9432b241..03688aa14e8a 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -232,7 +232,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 static void mwifiex_pcie_shutdown(struct pci_dev *pdev)
@@ -2313,6 +2312,7 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
                 pci_release_region(pdev, 0);
                 pci_set_drvdata(pdev, NULL);
         }
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 9bf8898743ab..b44a31523461 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -196,7 +196,6 @@ mwifiex_sdio_remove(struct sdio_func *func)
         }
 
         mwifiex_remove_card(card->adapter, &add_remove_card_sem);
-        kfree(card);
 }
 
 /*
@@ -1745,7 +1744,6 @@ mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
                 sdio_claim_host(card->func);
                 sdio_disable_func(card->func);
                 sdio_release_host(card->func);
-                sdio_set_drvdata(card->func, NULL);
         }
 }
 
@@ -1773,7 +1771,6 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
                 return ret;
         }
 
-        sdio_set_drvdata(func, card);
 
         adapter->dev = &func->dev;
 
@@ -1801,6 +1798,8 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         int ret;
         u8 sdio_ireg;
 
+        sdio_set_drvdata(card->func, card);
+
         /*
          * Read the HOST_INT_STATUS_REG for ACK the first interrupt got
          * from the bootloader. If we don't do this we get a interrupt
@@ -1883,6 +1882,8 @@ static void mwifiex_cleanup_sdio(struct mwifiex_adapter *adapter)
         kfree(card->mpa_rx.len_arr);
         kfree(card->mpa_tx.buf);
         kfree(card->mpa_rx.buf);
+        sdio_set_drvdata(card->func, NULL);
+        kfree(card);
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index 1c70b8d09227..edf5b7a24900 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -350,7 +350,6 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
 
         card->udev = udev;
         card->intf = intf;
-        usb_card = card;
 
         pr_debug("info: bcdUSB=%#x Device Class=%#x SubClass=%#x Protocol=%#x\n",
                  udev->descriptor.bcdUSB, udev->descriptor.bDeviceClass,
@@ -525,25 +524,28 @@ static int mwifiex_usb_resume(struct usb_interface *intf)
 static void mwifiex_usb_disconnect(struct usb_interface *intf)
 {
         struct usb_card_rec *card = usb_get_intfdata(intf);
-        struct mwifiex_adapter *adapter;
 
-        if (!card || !card->adapter) {
-                pr_err("%s: card or card->adapter is NULL\n", __func__);
+        if (!card) {
+                pr_err("%s: card is NULL\n", __func__);
                 return;
         }
 
-        adapter = card->adapter;
-        if (!adapter->priv_num)
-                return;
-
         mwifiex_usb_free(card);
 
-        dev_dbg(adapter->dev, "%s: removing card\n", __func__);
-        mwifiex_remove_card(adapter, &add_remove_card_sem);
+        if (card->adapter) {
+                struct mwifiex_adapter *adapter = card->adapter;
+
+                if (!adapter->priv_num)
+                        return;
+
+                dev_dbg(adapter->dev, "%s: removing card\n", __func__);
+                mwifiex_remove_card(adapter, &add_remove_card_sem);
+        }
 
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
         kfree(card);
+        usb_card = NULL;
 
         return;
 }
@@ -754,6 +756,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
         strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
+        usb_card = card;
 
         return 0;
 }
@@ -762,7 +765,7 @@ static void mwifiex_unregister_dev(struct mwifiex_adapter *adapter)
 {
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
-        usb_set_intfdata(card->intf, NULL);
+        card->adapter = NULL;
 }
 
 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
@@ -1004,7 +1007,7 @@ static void mwifiex_usb_cleanup_module(void)
         if (!down_interruptible(&add_remove_card_sem))
                 up(&add_remove_card_sem);
 
-        if (usb_card) {
+        if (usb_card && usb_card->adapter) {
                 struct mwifiex_adapter *adapter = usb_card->adapter;
                 int i;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 080b1fcae5fa..9dd92a700442 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -181,6 +181,7 @@ static void rt2x00lib_autowakeup(struct work_struct *work)
 static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
                                      struct ieee80211_vif *vif)
 {
+        struct ieee80211_tx_control control = {};
         struct rt2x00_dev *rt2x00dev = data;
         struct sk_buff *skb;
 
@@ -195,7 +196,7 @@ static void rt2x00lib_bc_buffer_iter(void *data, u8 *mac,
          */
         skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         while (skb) {
-                rt2x00mac_tx(rt2x00dev->hw, NULL, skb);
+                rt2x00mac_tx(rt2x00dev->hw, &control, skb);
                 skb = ieee80211_get_buffered_bc(rt2x00dev->hw, vif);
         }
 }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
index 393685390f3e..e26312fb4356 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
@@ -769,7 +769,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
 
 static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
                                       struct rtl_stats *pstats,
-                                      struct rx_desc_92c *pdesc,
+                                      struct rx_desc_92c *p_desc,
                                       struct rx_fwinfo_92c *p_drvinfo,
                                       bool packet_match_bssid,
                                       bool packet_toself,
@@ -784,11 +784,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
         u32 rssi, total_rssi = 0;
         bool in_powersavemode = false;
         bool is_cck_rate;
+        u8 *pdesc = (u8 *)p_desc;
 
-        is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
+        is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
         pstats->packet_matchbssid = packet_match_bssid;
         pstats->packet_toself = packet_toself;
-        pstats->is_cck = is_cck_rate;
         pstats->packet_beacon = packet_beacon;
         pstats->is_cck = is_cck_rate;
         pstats->RX_SIGQ[0] = -1;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index b0c346a9e4b8..1bc21ccfa71b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -303,10 +303,10 @@ out:
 bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
                            struct rtl_stats *stats,
                            struct ieee80211_rx_status *rx_status,
-                           u8 *p_desc, struct sk_buff *skb)
+                           u8 *pdesc, struct sk_buff *skb)
 {
         struct rx_fwinfo_92c *p_drvinfo;
-        struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
+        struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
         u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
 
         stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
@@ -345,7 +345,7 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
         if (phystatus) {
                 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
                                                      stats->rx_bufshift);
-                rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
+                rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
                                                  p_drvinfo);
         }
         /*rx_status->qual = stats->signal; */
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 0cef67707838..4af3821df880 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2439,6 +2439,9 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
         int err;
         struct sk_buff_head seg_queue;
 
+        if (!chan->conn)
+                return -ENOTCONN;
+
         /* Connectionless channel */
         if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
                 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 94d06cbfbc18..facd8a79c038 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -694,6 +694,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
@@ -719,6 +720,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
@@ -1983,6 +1985,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
         addr.l2_cid    = 0;
+        addr.l2_bdaddr_type = BDADDR_BREDR;
         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index c80766f892c3..3c2d3e4aa2f5 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -738,8 +738,9 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
+        struct sock *l2cap_sk;
+        struct l2cap_conn *conn;
         struct rfcomm_conninfo cinfo;
-        struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
         u32 opt;
 
@@ -782,6 +783,9 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
+                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                conn = l2cap_pi(l2cap_sk)->chan->conn;
+
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 85a2796cac61..4b07acb8293c 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -742,6 +742,9 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
         BT_DBG("conn %p", conn);
 
+        if (!(conn->hcon->link_mode & HCI_LM_MASTER))
+                return SMP_CMD_NOTSUPP;
+
         hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
 
         if (smp_ltk_encrypt(conn, hcon->pending_sec_level))