Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

5 files changed, 20 insertions, 5 deletions

diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index 25a2722c8a98..1d9aed645723 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -891,7 +891,6 @@ void hostap_setup_dev(struct net_device *dev, local_info_t *local,
 
         SET_ETHTOOL_OPS(dev, &prism2_ethtool_ops);
 
-        netif_stop_queue(dev);
 }
 
 static int hostap_enable_hostapd(local_info_t *local, int rtnl_locked)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 5f11dc25a9bd..f13a83a7e62b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3280,9 +3280,10 @@ void iwlagn_mac_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(priv->workqueue);
 
-        /* enable interrupts again in order to receive rfkill changes */
+        /* User space software may expect getting rfkill changes
+         * even if interface is down */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
@@ -4191,14 +4192,14 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * 8. Enable interrupts and read RFKILL state
          *********************************************/
 
-        /* enable interrupts if needed: hw bug w/a */
+        /* enable rfkill interrupt: hw bug w/a */
         pci_read_config_word(priv->pci_dev, PCI_COMMAND, &pci_cmd);
         if (pci_cmd & PCI_COMMAND_INTX_DISABLE) {
                 pci_cmd &= ~PCI_COMMAND_INTX_DISABLE;
                 pci_write_config_word(priv->pci_dev, PCI_COMMAND, pci_cmd);
         }
 
-        iwl_enable_interrupts(priv);
+        iwl_enable_rfkill_int(priv);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         if (iwl_read32(priv, CSR_GP_CNTRL) & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 3f5bedd8875f..8821f088ba7f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -148,6 +148,12 @@ static inline void iwl_disable_interrupts(struct iwl_priv *priv)
         IWL_DEBUG_ISR(priv, "Disabled interrupts\n");
 }
 
+static inline void iwl_enable_rfkill_int(struct iwl_priv *priv)
+{
+        IWL_DEBUG_ISR(priv, "Enabling rfkill interrupt\n");
+        iwl_write32(priv, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+}
+
 static inline void iwl_enable_interrupts(struct iwl_priv *priv)
 {
         IWL_DEBUG_ISR(priv, "Enabling interrupts\n");
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 315ee301b75e..8c02469b7176 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -375,6 +375,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         if (!key)
                 return;
 
+        /*
+         * Synchronize so the TX path can no longer be using
+         * this key before we free/remove it.
+         */
+        synchronize_rcu();
+
         if (key->local)
                 ieee80211_key_disable_hw_accel(key);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9595e564badd..2b9db5ab9048 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1808,6 +1808,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
                                                    sdata->name);
+                        if (!fwd_skb)
+                                goto out;
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1845,6 +1847,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
+ out:
         if (is_multicast_ether_addr(hdr->addr1) ||
             sdata->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;