Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Conflicts:
	drivers/net/wireless/ath/ath5k/base.c
	net/mac80211/main.c

14 files changed, 52 insertions, 20 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index e9aec08e575a..6cb1c759eeaa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4555,7 +4555,7 @@ F:	include/linux/preempt.h
 PRISM54 WIRELESS DRIVER
 M:      "Luis R. Rodriguez" <mcgrof@gmail.com>
 L:      linux-wireless@vger.kernel.org
-W:      http://prism54.org
+W:      http://wireless.kernel.org/en/users/Drivers/p54
 S:      Obsolete
 F:      drivers/net/wireless/prism54/
 
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 504c6d648ecf..95072db0ec21 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -673,6 +673,10 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                         PCI_DMA_TODEVICE);
 
         rate = ieee80211_get_tx_rate(sc->hw, info);
+        if (!rate) {
+                ret = -EINVAL;
+                goto err_unmap;
+        }
 
         if (info->flags & IEEE80211_TX_CTL_NO_ACK)
                 flags |= AR5K_TXDESC_NOACK;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index e2ae98feb0be..c4182359bee4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -797,7 +797,7 @@ static bool ar9300_uncompress_block(struct ath_hw *ah,
                 length = block[it+1];
                 length &= 0xff;
 
-                if (length > 0 && spot >= 0 && spot+length < mdataSize) {
+                if (length > 0 && spot >= 0 && spot+length <= mdataSize) {
                         ath_print(common, ATH_DBG_EEPROM,
                                   "Restore at %d: spot=%d "
                                   "offset=%d length=%d\n",
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index e583421fcaa6..3030564a0f21 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -62,7 +62,7 @@
 
 #define SD_NO_CTL               0xE0
 #define NO_CTL                  0xff
-#define CTL_MODE_M              7
+#define CTL_MODE_M              0xf
 #define CTL_11A                 0
 #define CTL_11B                 1
 #define CTL_11G                 2
diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h
index a1c39526161a..345dd9721b41 100644
--- a/drivers/net/wireless/ath/regd.h
+++ b/drivers/net/wireless/ath/regd.h
@@ -31,7 +31,6 @@ enum ctl_group {
 #define NO_CTL 0xff
 #define SD_NO_CTL               0xE0
 #define NO_CTL                  0xff
-#define CTL_MODE_M              7
 #define CTL_11A                 0
 #define CTL_11B                 1
 #define CTL_11G                 2
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 393f02d94c4e..5c568933ce48 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2736,6 +2736,11 @@ int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return -EINVAL;
 
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_INFO(priv, "scan in progress.\n");
+                return -EINVAL;
+        }
+
         if (mode >= IWL_MAX_FORCE_RESET) {
                 IWL_DEBUG_INFO(priv, "invalid reset request.\n");
                 return -EINVAL;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 024e5ca7b7f3..0b3119d9c02c 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -122,7 +122,7 @@ struct if_sdio_card {
         const char              *helper;
         const char              *firmware;
 
-        u8                      buffer[65536];
+        u8                      buffer[65536] __attribute__((aligned(4)));
 
         spinlock_t              lock;
         struct if_sdio_packet   *packets;
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 8f67db487f57..76b2318a7dc7 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -446,7 +446,7 @@ static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb)
         }
 
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
-             (!payload->status))
+             !(payload->status & P54_TX_FAILED))
                 info->flags |= IEEE80211_TX_STAT_ACK;
         if (payload->status & P54_TX_PSM_CANCELLED)
                 info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 18fdeca43d98..7c8542627351 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -868,6 +868,12 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        /*
+         * Now all work items will be gone, but the
+         * timer might still be armed, so delete it
+         */
+        del_timer_sync(&local->work_timer);
+
         cancel_work_sync(&local->restart_work);
         cancel_work_sync(&local->reconfig_filter);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index c0368152b721..308e502a80eb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2286,9 +2286,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
-
         if (skb_headroom(skb) < sizeof(*rthdr) &&
             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                 goto out_free_skb;
@@ -2347,7 +2344,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         } else
                 goto out_free_skb;
 
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
         return;
 
  out_free_skb:
diff --git a/net/wireless/core.c b/net/wireless/core.c
index ff9615a7ee7a..9c21ebf9780e 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -480,12 +480,10 @@ int wiphy_register(struct wiphy *wiphy)
         mutex_lock(&cfg80211_mutex);
 
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                goto out_unlock;
-
-        res = rfkill_register(rdev->rfkill);
-        if (res)
-                goto out_rm_dev;
+        if (res) {
+                mutex_unlock(&cfg80211_mutex);
+                return res;
+        }
 
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
@@ -514,13 +512,18 @@ int wiphy_register(struct wiphy *wiphy)
         cfg80211_debugfs_rdev_add(rdev);
         mutex_unlock(&cfg80211_mutex);
 
+        /*
+         * due to a locking dependency this has to be outside of the
+         * cfg80211_mutex lock
+         */
+        res = rfkill_register(rdev->rfkill);
+        if (res)
+                goto out_rm_dev;
+
         return 0;
 
 out_rm_dev:
         device_del(&rdev->wiphy.dev);
-
-out_unlock:
-        mutex_unlock(&cfg80211_mutex);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index bb5e0a5ecfa1..7e5c3a45f811 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1420,6 +1420,9 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+        data->flags = 0;
+        data->length = 0;
+
         switch (wdev->iftype) {
         case NL80211_IFTYPE_ADHOC:
                 return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 40385936e286..dc675a3daa3d 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -782,6 +782,22 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                 }
         }
 
+        if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+                /*
+                 * If this is a GET, but not NOMAX, it means that the extra
+                 * data is not bounded by userspace, but by max_tokens. Thus
+                 * set the length to max_tokens. This matches the extra data
+                 * allocation.
+                 * The driver should fill it with the number of tokens it
+                 * provided, and it may check iwp->length rather than having
+                 * knowledge of max_tokens. If the driver doesn't change the
+                 * iwp->length, this ioctl just copies back max_token tokens
+                 * filled with zeroes. Hopefully the driver isn't claiming
+                 * them to be valid data.
+                 */
+                iwp->length = descr->max_tokens;
+        }
+
         err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
         iwp->length += essid_compat;
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
index 3feb28e41c53..674d426a9d24 100644
--- a/net/wireless/wext-priv.c
+++ b/net/wireless/wext-priv.c
@@ -152,7 +152,7 @@ static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
         } else if (!iwp->pointer)
                 return -EFAULT;
 
-        extra = kmalloc(extra_size, GFP_KERNEL);
+        extra = kzalloc(extra_size, GFP_KERNEL);
         if (!extra)
                 return -ENOMEM;