Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
  ipv6: Don't pass invalid dst_entry pointer to dst_release().
  mlx4: fix kfree on error path in new_steering_entry()
  tcp: len check is unnecessarily devastating, change to WARN_ON
  sctp: malloc enough room for asconf-ack chunk
  sctp: fix auth_hmacs field's length of struct sctp_cookie
  net: Fix dev dev_ethtool_get_rx_csum() for forced NETIF_F_RXCSUM
  usbnet: use eth%d name for known ethernet devices
  starfire: clean up dma_addr_t size test
  iwlegacy: fix bugs in change_interface
  carl9170: Fix tx aggregation problems with some clients
  iwl3945: disable hw scan by default
  wireless: rt2x00: rt2800usb.c add and identify ids
  iwl3945: do not deprecate software scan
  mac80211: fix aggregation frame release during timeout
  cfg80211: fix BSS double-unlinking (continued)
  cfg80211:: fix possible NULL pointer dereference
  mac80211: fix possible NULL pointer dereference
  mac80211: fix NULL pointer dereference in ieee80211_key_alloc()
  ath9k: fix a chip wakeup related crash in ath9k_start
  mac80211: fix a crash in minstrel_ht in HT mode with no supported MCS rates
  ...

36 files changed, 138 insertions, 60 deletions

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 866811428e20..762a5109c68a 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -71,6 +71,9 @@ static struct usb_device_id btusb_table[] = {
         /* Apple MacBookAir3,1, MacBookAir3,2 */
         { USB_DEVICE(0x05ac, 0x821b) },
 
+        /* Apple MacBookPro8,2 */
+        { USB_DEVICE(0x05ac, 0x821a) },
+
         /* AVM BlueFRITZ! USB v2.0 */
         { USB_DEVICE(0x057c, 0x3800) },
 
@@ -690,7 +693,8 @@ static int btusb_send_frame(struct sk_buff *skb)
                 break;
 
         case HCI_ACLDATA_PKT:
-                if (!data->bulk_tx_ep || hdev->conn_hash.acl_num < 1)
+                if (!data->bulk_tx_ep || (hdev->conn_hash.acl_num < 1 &&
+                                                hdev->conn_hash.le_num < 1))
                         return -ENODEV;
 
                 urb = usb_alloc_urb(0, GFP_ATOMIC);
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index 37150b2f6425..c6d336aed2d9 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -111,7 +111,7 @@ static int new_steering_entry(struct mlx4_dev *dev, u8 vep_num, u8 port,
         u32 members_count;
         struct mlx4_steer_index *new_entry;
         struct mlx4_promisc_qp *pqp;
-        struct mlx4_promisc_qp *dqp;
+        struct mlx4_promisc_qp *dqp = NULL;
         u32 prot;
         int err;
         u8 pf_num;
@@ -184,7 +184,7 @@ out_mailbox:
 out_alloc:
         if (dqp) {
                 list_del(&dqp->list);
-                kfree(&dqp);
+                kfree(dqp);
         }
         list_del(&new_entry->list);
         kfree(new_entry);
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index a4f2bd52e546..36045f3b0327 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -144,11 +144,7 @@ static int full_duplex[MAX_UNITS] = {0, };
 /* Time in jiffies before concluding the transmitter is hung. */
 #define TX_TIMEOUT      (2 * HZ)
 
-/*
- * This SUCKS.
- * We need a much better method to determine if dma_addr_t is 64-bit.
- */
-#if (defined(__i386__) && defined(CONFIG_HIGHMEM64G)) || defined(__x86_64__) || defined (__ia64__) || defined(__alpha__) || (defined(CONFIG_MIPS) && ((defined(CONFIG_HIGHMEM) && defined(CONFIG_64BIT_PHYS_ADDR)) || defined(CONFIG_64BIT))) || (defined(__powerpc64__) || defined(CONFIG_PHYS_64BIT))
+#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT
 /* 64-bit dma_addr_t */
 #define ADDR_64BITS     /* This chip uses 64 bit addresses. */
 #define netdrv_addr_t __le64
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index 5f3b97668e63..8f128541656d 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -340,7 +340,7 @@ next:
 
 static const struct driver_info eem_info = {
         .description =  "CDC EEM Device",
-        .flags =        FLAG_ETHER,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
         .bind =         eem_bind,
         .rx_fixup =     eem_rx_fixup,
         .tx_fixup =     eem_tx_fixup,
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 51c259b69278..341f7056a800 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -452,7 +452,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT,
         // .check_connect = cdc_check_connect,
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 7113168473cf..967371f04454 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1237,7 +1237,7 @@ static int cdc_ncm_manage_power(struct usbnet *dev, int status)
 
 static const struct driver_info cdc_ncm_info = {
         .description = "CDC NCM",
-        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET,
+        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET,
         .bind = cdc_ncm_bind,
         .unbind = cdc_ncm_unbind,
         .check_connect = cdc_ncm_check_connect,
diff --git a/drivers/net/usb/cdc_subset.c b/drivers/net/usb/cdc_subset.c
index ca39ace0b0eb..fc5f13d47ad9 100644
--- a/drivers/net/usb/cdc_subset.c
+++ b/drivers/net/usb/cdc_subset.c
@@ -89,6 +89,7 @@ static int always_connected (struct usbnet *dev)
 
 static const struct driver_info ali_m5632_info = {
         .description =  "ALi M5632",
+        .flags       = FLAG_POINTTOPOINT,
 };
 
 #endif
@@ -110,6 +111,7 @@ static const struct driver_info	ali_m5632_info = {
 
 static const struct driver_info an2720_info = {
         .description =  "AnchorChips/Cypress 2720",
+        .flags       = FLAG_POINTTOPOINT,
         // no reset available!
         // no check_connect available!
 
@@ -132,6 +134,7 @@ static const struct driver_info	an2720_info = {
 
 static const struct driver_info belkin_info = {
         .description =  "Belkin, eTEK, or compatible",
+        .flags       = FLAG_POINTTOPOINT,
 };
 
 #endif  /* CONFIG_USB_BELKIN */
@@ -157,6 +160,7 @@ static const struct driver_info	belkin_info = {
 static const struct driver_info epson2888_info = {
         .description =  "Epson USB Device",
         .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 
         .in = 4, .out = 3,
 };
@@ -173,6 +177,7 @@ static const struct driver_info	epson2888_info = {
 #define HAVE_HARDWARE
 static const struct driver_info kc2190_info = {
         .description =  "KC Technology KC-190",
+        .flags = FLAG_POINTTOPOINT,
 };
 #endif /* CONFIG_USB_KC2190 */
 
@@ -200,16 +205,19 @@ static const struct driver_info kc2190_info = {
 static const struct driver_info linuxdev_info = {
         .description =  "Linux Device",
         .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 
 static const struct driver_info yopy_info = {
         .description =  "Yopy",
         .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 
 static const struct driver_info blob_info = {
         .description =  "Boot Loader OBject",
         .check_connect = always_connected,
+        .flags = FLAG_POINTTOPOINT,
 };
 
 #endif  /* CONFIG_USB_ARMLINUX */
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index dcd57c37ef73..c4cfd1dea881 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -193,7 +193,7 @@ static int genelink_bind(struct usbnet *dev, struct usb_interface *intf)
 
 static const struct driver_info genelink_info = {
         .description =  "Genesys GeneLink",
-        .flags =        FLAG_FRAMING_GL | FLAG_NO_SETINT,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_GL | FLAG_NO_SETINT,
         .bind =         genelink_bind,
         .rx_fixup =     genelink_rx_fixup,
         .tx_fixup =     genelink_tx_fixup,
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index ba72a7281cb0..01db4602a39e 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -560,7 +560,7 @@ static int net1080_bind(struct usbnet *dev, struct usb_interface *intf)
 
 static const struct driver_info net1080_info = {
         .description =  "NetChip TurboCONNECT",
-        .flags =        FLAG_FRAMING_NC,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_NC,
         .bind =         net1080_bind,
         .reset =        net1080_reset,
         .check_connect = net1080_check_connect,
diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
index 08ad269f6b4e..823c53751307 100644
--- a/drivers/net/usb/plusb.c
+++ b/drivers/net/usb/plusb.c
@@ -96,7 +96,7 @@ static int pl_reset(struct usbnet *dev)
 
 static const struct driver_info prolific_info = {
         .description =  "Prolific PL-2301/PL-2302",
-        .flags =        FLAG_NO_SETINT,
+        .flags =        FLAG_POINTTOPOINT | FLAG_NO_SETINT,
                 /* some PL-2302 versions seem to fail usb_set_interface() */
         .reset =        pl_reset,
 };
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index dd8a4adf48ca..5994a25c56ac 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -573,7 +573,7 @@ EXPORT_SYMBOL_GPL(rndis_tx_fixup);
 
 static const struct driver_info rndis_info = {
         .description =  "RNDIS device",
-        .flags =        FLAG_ETHER | FLAG_FRAMING_RN | FLAG_NO_SETINT,
+        .flags =        FLAG_ETHER | FLAG_POINTTOPOINT | FLAG_FRAMING_RN | FLAG_NO_SETINT,
         .bind =         rndis_bind,
         .unbind =       rndis_unbind,
         .status =       rndis_status,
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index cf58b7682565..069c1cf0fdf7 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1380,7 +1380,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 // else "eth%d" when there's reasonable doubt.  userspace
                 // can rename the link if it knows better.
                 if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
-                    (net->dev_addr [0] & 0x02) == 0)
+                    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
+                     (net->dev_addr [0] & 0x02) == 0))
                         strcpy (net->name, "eth%d");
                 /* WLAN devices should always be named "wlan%d" */
                 if ((dev->driver_info->flags & FLAG_WLAN) != 0)
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index 3eb0b167b5b4..241756e0e86f 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -102,7 +102,7 @@ static int always_connected (struct usbnet *dev)
 
 static const struct driver_info zaurus_sl5x00_info = {
         .description =  "Sharp Zaurus SL-5x00",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
@@ -112,7 +112,7 @@ static const struct driver_info	zaurus_sl5x00_info = {
 
 static const struct driver_info zaurus_pxa_info = {
         .description =  "Sharp Zaurus, PXA-2xx based",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
@@ -122,7 +122,7 @@ static const struct driver_info	zaurus_pxa_info = {
 
 static const struct driver_info olympus_mxl_info = {
         .description =  "Olympus R1000",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
         .check_connect = always_connected,
         .bind =         zaurus_bind,
         .unbind =       usbnet_cdc_unbind,
@@ -258,7 +258,7 @@ bad_desc:
 
 static const struct driver_info bogus_mdlm_info = {
         .description =  "pseudo-MDLM (BLAN) device",
-        .flags =        FLAG_FRAMING_Z,
+        .flags =        FLAG_POINTTOPOINT | FLAG_FRAMING_Z,
         .check_connect = always_connected,
         .tx_fixup =     zaurus_tx_fixup,
         .bind =         blan_mdlm_bind,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 524825720a09..dddb85de622d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1048,6 +1048,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
                 "Starting driver with initial channel: %d MHz\n",
                 curchan->center_freq);
 
+        ath9k_ps_wakeup(sc);
+
         mutex_lock(&sc->mutex);
 
         /* setup initial channel */
@@ -1143,6 +1145,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
 mutex_unlock:
         mutex_unlock(&sc->mutex);
 
+        ath9k_ps_restore(sc);
+
         return r;
 }
 
diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
index c6a5fae634a0..9cad061cc1d2 100644
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -443,6 +443,7 @@ struct carl9170_ba_stats {
         u8 ampdu_len;
         u8 ampdu_ack_len;
         bool clear;
+        bool req;
 };
 
 struct carl9170_sta_info {
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index ede3d7e5a048..89fe60accf85 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1355,6 +1355,7 @@ static int carl9170_op_ampdu_action(struct ieee80211_hw *hw,
                 tid_info = rcu_dereference(sta_info->agg[tid]);
 
                 sta_info->stats[tid].clear = true;
+                sta_info->stats[tid].req = false;
 
                 if (tid_info) {
                         bitmap_zero(tid_info->bitmap, CARL9170_BAW_SIZE);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 0ef70b6fc512..cb70ed7ec5cc 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -383,6 +383,7 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
 
         if (sta_info->stats[tid].clear) {
                 sta_info->stats[tid].clear = false;
+                sta_info->stats[tid].req = false;
                 sta_info->stats[tid].ampdu_len = 0;
                 sta_info->stats[tid].ampdu_ack_len = 0;
         }
@@ -391,10 +392,16 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
         if (txinfo->status.rates[0].count == 1)
                 sta_info->stats[tid].ampdu_ack_len++;
 
+        if (!(txinfo->flags & IEEE80211_TX_STAT_ACK))
+                sta_info->stats[tid].req = true;
+
         if (super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_IMM_BA)) {
                 super->s.rix = sta_info->stats[tid].ampdu_len;
                 super->s.cnt = sta_info->stats[tid].ampdu_ack_len;
                 txinfo->flags |= IEEE80211_TX_STAT_AMPDU;
+                if (sta_info->stats[tid].req)
+                        txinfo->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+
                 sta_info->stats[tid].clear = true;
         }
         spin_unlock_bh(&tid_info->lock);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index d418b647be80..a209a0e76bf0 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -1805,6 +1805,15 @@ iwl_legacy_mac_change_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&priv->mutex);
 
+        if (!ctx->vif || !iwl_legacy_is_ready_rf(priv)) {
+                /*
+                 * Huh? But wait ... this can maybe happen when
+                 * we're in the middle of a firmware restart!
+                 */
+                err = -EBUSY;
+                goto out;
+        }
+
         interface_modes = ctx->interface_modes | ctx->exclusive_interface_modes;
 
         if (!(interface_modes & BIT(newtype))) {
@@ -1832,6 +1841,7 @@ iwl_legacy_mac_change_interface(struct ieee80211_hw *hw,
         /* success */
         iwl_legacy_teardown_interface(priv, vif, true);
         vif->type = newtype;
+        vif->p2p = newp2p;
         err = iwl_legacy_setup_interface(priv, ctx);
         WARN_ON(err);
         /*
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index ab87e1b73529..28eb3d885ba1 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -93,6 +93,7 @@ MODULE_LICENSE("GPL");
 struct iwl_mod_params iwl3945_mod_params = {
         .sw_crypto = 1,
         .restart_fw = 1,
+        .disable_hw_scan = 1,
         /* the rest are 0 by default */
 };
 
@@ -3960,8 +3961,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
          * "the hard way", rather than using device's scan.
          */
         if (iwl3945_mod_params.disable_hw_scan) {
-                dev_printk(KERN_DEBUG, &(pdev->dev),
-                        "sw scan support is deprecated\n");
+                IWL_DEBUG_INFO(priv, "Disabling hw_scan\n");
                 iwl3945_hw_ops.hw_scan = NULL;
         }
 
@@ -4280,8 +4280,7 @@ MODULE_PARM_DESC(swcrypto,
                 "using software crypto (default 1 [software])");
 module_param_named(disable_hw_scan, iwl3945_mod_params.disable_hw_scan,
                 int, S_IRUGO);
-MODULE_PARM_DESC(disable_hw_scan,
-                "disable hardware scanning (default 0) (deprecated)");
+MODULE_PARM_DESC(disable_hw_scan, "disable hardware scanning (default 1)");
 #ifdef CONFIG_IWLWIFI_LEGACY_DEBUG
 module_param_named(debug, iwlegacy_debug_level, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "debug output mask");
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 4e368657a83c..37509d019910 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -730,8 +730,12 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x8053), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x050d, 0x805c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x050d, 0x815c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x825b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x935a), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x050d, 0x935b), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Buffalo */
         { USB_DEVICE(0x0411, 0x00e8), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0411, 0x016f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Conceptronic */
         { USB_DEVICE(0x14b2, 0x3c06), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x14b2, 0x3c07), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -818,6 +822,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Pegatron */
         { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Philips */
         { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
@@ -899,6 +904,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sitecom */
         { USB_DEVICE(0x0df6, 0x0041), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Toshiba */
+        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0284), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
@@ -961,7 +968,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x05a6, 0x0101), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
         { USB_DEVICE(0x2019, 0x5201), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -975,8 +981,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Sweex */
         { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Toshiba */
-        { USB_DEVICE(0x0930, 0x0a07), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zyxel */
         { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 5eeb2cd3631c..0249fe7e3872 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2598,8 +2598,8 @@ static inline int dev_ethtool_get_settings(struct net_device *dev,
 
 static inline u32 dev_ethtool_get_rx_csum(struct net_device *dev)
 {
-        if (dev->hw_features & NETIF_F_RXCSUM)
-                return !!(dev->features & NETIF_F_RXCSUM);
+        if (dev->features & NETIF_F_RXCSUM)
+                return 1;
         if (!dev->ethtool_ops || !dev->ethtool_ops->get_rx_csum)
                 return 0;
         return dev->ethtool_ops->get_rx_csum(dev);
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 201f2228f731..3c7329b8ea0e 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -97,6 +97,8 @@ struct driver_info {
 
 #define FLAG_LINK_INTR  0x0800          /* updates link (carrier) status */
 
+#define FLAG_POINTTOPOINT 0x1000        /* possibly use "usb%d" names */
+
 /*
  * Indicates to usbnet, that USB driver accumulates multiple IP packets.
  * Affects statistic (counters) and short packet handling.
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ec6acf2f1c0b..2c0d309c7381 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -84,6 +84,8 @@ enum {
         HCI_SERVICE_CACHE,
         HCI_LINK_KEYS,
         HCI_DEBUG_KEYS,
+
+        HCI_RESET,
 };
 
 /* HCI ioctl defines */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index cc9185ca8fd1..0f6e60a9c308 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -422,7 +422,7 @@ struct sctp_cookie {
         __u32 adaptation_ind;
 
         __u8 auth_random[sizeof(sctp_paramhdr_t) + SCTP_AUTH_RANDOM_LENGTH];
-        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS + 2];
+        __u8 auth_hmacs[SCTP_AUTH_NUM_HMACS * sizeof(__u16) + 2];
         __u8 auth_chunks[sizeof(sctp_paramhdr_t) + SCTP_AUTH_MAX_CHUNKS];
 
         /* This is a shim for my peer's INIT packet, followed by
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b372fb8bcdcf..2216620ff296 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -186,6 +186,7 @@ static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
         BT_DBG("%s %ld", hdev->name, opt);
 
         /* Reset device */
+        set_bit(HCI_RESET, &hdev->flags);
         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 }
 
@@ -213,8 +214,10 @@ static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
         /* Mandatory initialization */
 
         /* Reset */
-        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
+        if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
+                        set_bit(HCI_RESET, &hdev->flags);
                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
+        }
 
         /* Read Local Supported Features */
         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
@@ -584,6 +587,9 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hci_req_cancel(hdev, ENODEV);
         hci_req_lock(hdev);
 
+        /* Stop timer, it might be running */
+        del_timer_sync(&hdev->cmd_timer);
+
         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
                 hci_req_unlock(hdev);
                 return 0;
@@ -623,7 +629,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         /* Drop last sent command */
         if (hdev->sent_cmd) {
-                del_timer_sync(&hdev->cmd_timer);
                 kfree_skb(hdev->sent_cmd);
                 hdev->sent_cmd = NULL;
         }
@@ -1074,6 +1079,7 @@ static void hci_cmd_timer(unsigned long arg)
 
         BT_ERR("%s command tx timeout", hdev->name);
         atomic_set(&hdev->cmd_cnt, 1);
+        clear_bit(HCI_RESET, &hdev->flags);
         tasklet_schedule(&hdev->cmd_task);
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 3fbfa50c2bff..cebe7588469f 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -183,6 +183,8 @@ static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 
         BT_DBG("%s status 0x%x", hdev->name, status);
 
+        clear_bit(HCI_RESET, &hdev->flags);
+
         hci_req_complete(hdev, HCI_OP_RESET, status);
 }
 
@@ -1847,7 +1849,7 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
         if (ev->opcode != HCI_OP_NOP)
                 del_timer(&hdev->cmd_timer);
 
-        if (ev->ncmd) {
+        if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
                 atomic_set(&hdev->cmd_cnt, 1);
                 if (!skb_queue_empty(&hdev->cmd_q))
                         tasklet_schedule(&hdev->cmd_task);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index c9f9cecca527..ca27f3a41536 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1116,7 +1116,9 @@ int l2cap_ertm_send(struct sock *sk)
                 bt_cb(skb)->tx_seq = pi->next_tx_seq;
                 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
 
-                pi->unacked_frames++;
+                if (bt_cb(skb)->retries == 1)
+                        pi->unacked_frames++;
+
                 pi->frames_sent++;
 
                 if (skb_queue_is_last(TX_QUEUE(sk), skb))
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index fc85e7ae33c7..f77308e63e58 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -923,8 +923,9 @@ void __l2cap_sock_close(struct sock *sk, int reason)
                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
-                } else
-                        l2cap_chan_del(sk, reason);
+                }
+
+                l2cap_chan_del(sk, reason);
                 break;
 
         case BT_CONNECT:
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0054c74e27b7..4476d8e3c0f2 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1230,6 +1230,8 @@ static int user_confirm_reply(struct sock *sk, u16 index, unsigned char *data,
         if (!hdev)
                 return cmd_status(sk, index, mgmt_op, ENODEV);
 
+        hci_dev_lock_bh(hdev);
+
         if (!test_bit(HCI_UP, &hdev->flags)) {
                 err = cmd_status(sk, index, mgmt_op, ENETDOWN);
                 goto failed;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dfa5beb0c1c8..8b0d0167e44a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1003,7 +1003,8 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
         int nlen;
         u8 flags;
 
-        BUG_ON(len > skb->len);
+        if (WARN_ON(len > skb->len))
+                return -EINVAL;
 
         nsize = skb_headlen(skb) - len;
         if (nsize < 0)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2b0c186862c8..56fa12538d45 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -503,6 +503,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
         if (IS_ERR(dst)) {
                 err = PTR_ERR(dst);
+                dst = NULL;
                 goto done;
         }
         skb = tcp_make_synack(sk, dst, req, rvp);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 8c02469b7176..af3c56482c80 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -342,7 +342,7 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 if (IS_ERR(key->u.ccmp.tfm)) {
                         err = PTR_ERR(key->u.ccmp.tfm);
                         kfree(key);
-                        key = ERR_PTR(err);
+                        return ERR_PTR(err);
                 }
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
@@ -360,7 +360,7 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 if (IS_ERR(key->u.aes_cmac.tfm)) {
                         err = PTR_ERR(key->u.aes_cmac.tfm);
                         kfree(key);
-                        key = ERR_PTR(err);
+                        return ERR_PTR(err);
                 }
                 break;
         }
@@ -400,11 +400,12 @@ int ieee80211_key_link(struct ieee80211_key *key,
 {
         struct ieee80211_key *old_key;
         int idx, ret;
-        bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+        bool pairwise;
 
         BUG_ON(!sdata);
         BUG_ON(!key);
 
+        pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
         idx = key->conf.keyidx;
         key->local = sdata->local;
         key->sdata = sdata;
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 8212a8bebf06..dbdebeda097f 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -659,18 +659,14 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
         struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
         struct ieee80211_local *local = hw_to_local(mp->hw);
         u16 sta_cap = sta->ht_cap.cap;
+        int n_supported = 0;
         int ack_dur;
         int stbc;
         int i;
 
         /* fall back to the old minstrel for legacy stations */
-        if (!sta->ht_cap.ht_supported) {
-                msp->is_ht = false;
-                memset(&msp->legacy, 0, sizeof(msp->legacy));
-                msp->legacy.r = msp->ratelist;
-                msp->legacy.sample_table = msp->sample_table;
-                return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
-        }
+        if (!sta->ht_cap.ht_supported)
+                goto use_legacy;
 
         BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) !=
                 MINSTREL_MAX_STREAMS * MINSTREL_STREAM_GROUPS);
@@ -725,7 +721,22 @@ minstrel_ht_update_caps(void *priv, struct ieee80211_supported_band *sband,
 
                 mi->groups[i].supported =
                         mcs->rx_mask[minstrel_mcs_groups[i].streams - 1];
+
+                if (mi->groups[i].supported)
+                        n_supported++;
         }
+
+        if (!n_supported)
+                goto use_legacy;
+
+        return;
+
+use_legacy:
+        msp->is_ht = false;
+        memset(&msp->legacy, 0, sizeof(msp->legacy));
+        msp->legacy.r = msp->ratelist;
+        msp->legacy.sample_table = msp->sample_table;
+        return mac80211_minstrel.rate_init(priv, sband, sta, &msp->legacy);
 }
 
 static void
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5c1930ba8ebe..aa5cc37b4921 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -612,7 +612,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
                                 skipped++;
                                 continue;
                         }
-                        if (!time_after(jiffies, tid_agg_rx->reorder_time[j] +
+                        if (skipped &&
+                            !time_after(jiffies, tid_agg_rx->reorder_time[j] +
                                         HT_RX_REORDER_BUF_TIMEOUT))
                                 goto set_release_timer;
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index de98665db524..b3434cc7d0cf 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3106,10 +3106,10 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
 
         /* create an ASCONF_ACK chunk.
          * Based on the definitions of parameters, we know that the size of
-         * ASCONF_ACK parameters are less than or equal to the twice of ASCONF
+         * ASCONF_ACK parameters are less than or equal to the fourfold of ASCONF
          * parameters.
          */
-        asconf_ack = sctp_make_asconf_ack(asoc, serial, chunk_len * 2);
+        asconf_ack = sctp_make_asconf_ack(asoc, serial, chunk_len * 4);
         if (!asconf_ack)
                 goto done;
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ea427f418f64..fbf6f33ae4d0 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -124,6 +124,15 @@ void cfg80211_bss_age(struct cfg80211_registered_device *dev,
 }
 
 /* must hold dev->bss_lock! */
+static void __cfg80211_unlink_bss(struct cfg80211_registered_device *dev,
+                                  struct cfg80211_internal_bss *bss)
+{
+        list_del_init(&bss->list);
+        rb_erase(&bss->rbn, &dev->bss_tree);
+        kref_put(&bss->ref, bss_release);
+}
+
+/* must hold dev->bss_lock! */
 void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
 {
         struct cfg80211_internal_bss *bss, *tmp;
@@ -134,9 +143,7 @@ void cfg80211_bss_expire(struct cfg80211_registered_device *dev)
                         continue;
                 if (!time_after(jiffies, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE))
                         continue;
-                list_del(&bss->list);
-                rb_erase(&bss->rbn, &dev->bss_tree);
-                kref_put(&bss->ref, bss_release);
+                __cfg80211_unlink_bss(dev, bss);
                 expired = true;
         }
 
@@ -585,16 +592,23 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         struct cfg80211_internal_bss *res;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
-        size_t privsz = wiphy->bss_priv_size;
+        size_t privsz;
+
+        if (WARN_ON(!mgmt))
+                return NULL;
+
+        if (WARN_ON(!wiphy))
+                return NULL;
 
         if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
                     (signal < 0 || signal > 100)))
                 return NULL;
 
-        if (WARN_ON(!mgmt || !wiphy ||
-                    len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
+        if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
                 return NULL;
 
+        privsz = wiphy->bss_priv_size;
+
         res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
         if (!res)
                 return NULL;
@@ -662,11 +676,8 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 
         spin_lock_bh(&dev->bss_lock);
         if (!list_empty(&bss->list)) {
-                list_del_init(&bss->list);
+                __cfg80211_unlink_bss(dev, bss);
                 dev->bss_generation++;
-                rb_erase(&bss->rbn, &dev->bss_tree);
-
-                kref_put(&bss->ref, bss_release);
         }
         spin_unlock_bh(&dev->bss_lock);
 }