6 files changed, 37 insertions, 6 deletions

diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index 8596aba34f96..237d0cda1bcb 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -256,6 +256,7 @@ struct ar9170 {
         atomic_t rx_work_urbs;
         atomic_t rx_pool_urbs;
         kernel_ulong_t features;
+        bool usb_ep_cmd_is_bulk;
 
         /* firmware settings */
         struct completion fw_load_wait;
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index f35c7f30f9a6..c9f93310c0d6 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
                 goto err_free;
         }
 
-        usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
-                AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
-                carl9170_usb_cmd_complete, ar, 1);
+        if (ar->usb_ep_cmd_is_bulk)
+                usb_fill_bulk_urb(urb, ar->udev,
+                                  usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
+                                  cmd, cmd->hdr.len + 4,
+                                  carl9170_usb_cmd_complete, ar);
+        else
+                usb_fill_int_urb(urb, ar->udev,
+                                 usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
+                                 cmd, cmd->hdr.len + 4,
+                                 carl9170_usb_cmd_complete, ar, 1);
 
         if (free_buf)
                 urb->transfer_flags |= URB_FREE_BUFFER;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw,
 static int carl9170_usb_probe(struct usb_interface *intf,
                               const struct usb_device_id *id)
 {
+        struct usb_endpoint_descriptor *ep;
         struct ar9170 *ar;
         struct usb_device *udev;
-        int err;
+        int i, err;
 
         err = usb_reset_device(interface_to_usbdev(intf));
         if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb_interface *intf,
         ar->intf = intf;
         ar->features = id->driver_info;
 
+        /* We need to remember the type of endpoint 4 because it differs
+         * between high- and full-speed configuration. The high-speed
+         * configuration specifies it as interrupt and the full-speed
+         * configuration as bulk endpoint. This information is required
+         * later when sending urbs to that endpoint.
+         */
+        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
+                ep = &intf->cur_altsetting->endpoint[i].desc;
+
+                if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
+                    usb_endpoint_dir_out(ep) &&
+                    usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
+                        ar->usb_ep_cmd_is_bulk = true;
+        }
+
         usb_set_intfdata(intf, ar);
         SET_IEEE80211_DEV(ar->hw, &intf->dev);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
index 535c7eb01b3a..8f8b9373de95 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1318,6 +1318,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr)
         msgbuf->nrof_flowrings = if_msgbuf->nrof_flowrings;
         msgbuf->flowring_dma_handle = kzalloc(msgbuf->nrof_flowrings *
                 sizeof(*msgbuf->flowring_dma_handle), GFP_ATOMIC);
+        if (!msgbuf->flowring_dma_handle)
+                goto fail;
 
         msgbuf->rx_dataoffset = if_msgbuf->rx_dataoffset;
         msgbuf->max_rxbufpost = if_msgbuf->max_rxbufpost;
@@ -1362,6 +1364,7 @@ fail:
                 kfree(msgbuf->flow_map);
                 kfree(msgbuf->txstatus_done_map);
                 brcmf_msgbuf_release_pktids(msgbuf);
+                kfree(msgbuf->flowring_dma_handle);
                 if (msgbuf->ioctbuf)
                         dma_free_coherent(drvr->bus_if->dev,
                                           BRCMF_TX_IOCTL_MAX_MSG_SIZE,
@@ -1391,6 +1394,7 @@ void brcmf_proto_msgbuf_detach(struct brcmf_pub *drvr)
                                   BRCMF_TX_IOCTL_MAX_MSG_SIZE,
                                   msgbuf->ioctbuf, msgbuf->ioctbuf_handle);
                 brcmf_msgbuf_release_pktids(msgbuf);
+                kfree(msgbuf->flowring_dma_handle);
                 kfree(msgbuf);
                 drvr->proto->pd = NULL;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index bc972c0ba5f8..e5101b287e4e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -591,12 +591,13 @@ static void brcmf_pcie_handle_mb_data(struct brcmf_pciedev_info *devinfo)
         }
         if (dtoh_mb_data & BRCMF_D2H_DEV_DS_EXIT_NOTE)
                 brcmf_dbg(PCIE, "D2H_MB_DATA: DEEP SLEEP EXIT\n");
-        if (dtoh_mb_data & BRCMF_D2H_DEV_D3_ACK)
+        if (dtoh_mb_data & BRCMF_D2H_DEV_D3_ACK) {
                 brcmf_dbg(PCIE, "D2H_MB_DATA: D3 ACK\n");
                 if (waitqueue_active(&devinfo->mbdata_resp_wait)) {
                         devinfo->mbdata_completed = true;
                         wake_up(&devinfo->mbdata_resp_wait);
                 }
+        }
 }
 
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index c5aa404069f3..389656bd1a74 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -9853,6 +9853,7 @@ static int ipw_wx_get_wireless_mode(struct net_device *dev,
                 strncpy(extra, "unknown", MAX_WX_STRING);
                 break;
         }
+        extra[MAX_WX_STRING - 1] = '\0';
 
         IPW_DEBUG_WX("PRIV GET MODE: %s\n", extra);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 0d6a8b768a68..7c8796584c25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -396,7 +396,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         else
                 hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN;
+        /* TODO: enable that only for firmwares that don't crash */
+        /* hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_SCHED_SCAN; */
         hw->wiphy->max_sched_scan_ssids = PROBE_OPTION_MAX;
         hw->wiphy->max_match_sets = IWL_SCAN_MAX_PROFILES;
         /* we create the 802.11 header and zero length SSID IE. */