Merge branch 'for-davem' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

John W. Linville says:

====================
These fixes are intended for the 3.6 stream.

Hauke Mehrtens provides a pair of bcma fixes, one to fix a build
regression on mips and another to correct a pair of missing iounmap
calls.

Thomas Huehn offers a mac80211_hwsim fix to avoid a possible
use-after-free bug.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 13 insertions, 13 deletions

diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index b013b049476d..cc65b45b4368 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -131,7 +131,7 @@ static void bcma_core_mips_set_irq(struct bcma_device *dev, unsigned int irq)
                         /* backplane irq line is in use, find out who uses
                          * it and set user to irq 0
                          */
-                        list_for_each_entry_reverse(core, &bus->cores, list) {
+                        list_for_each_entry(core, &bus->cores, list) {
                                 if ((1 << bcma_core_mips_irqflag(core)) ==
                                     oldirqflag) {
                                         bcma_core_mips_set_irq(core, 0);
@@ -161,7 +161,7 @@ static void bcma_core_mips_dump_irq(struct bcma_bus *bus)
 {
         struct bcma_device *core;
 
-        list_for_each_entry_reverse(core, &bus->cores, list) {
+        list_for_each_entry(core, &bus->cores, list) {
                 bcma_core_mips_print_irq(core, bcma_core_mips_irq(core));
         }
 }
@@ -224,7 +224,7 @@ void bcma_core_mips_init(struct bcma_drv_mips *mcore)
                 mcore->assigned_irqs = 1;
 
         /* Assign IRQs to all cores on the bus */
-        list_for_each_entry_reverse(core, &bus->cores, list) {
+        list_for_each_entry(core, &bus->cores, list) {
                 int mips_irq;
                 if (core->irq)
                         continue;
diff --git a/drivers/bcma/scan.c b/drivers/bcma/scan.c
index 5672b13d0951..8d0b57164018 100644
--- a/drivers/bcma/scan.c
+++ b/drivers/bcma/scan.c
@@ -462,8 +462,10 @@ int bcma_bus_scan(struct bcma_bus *bus)
         while (eromptr < eromend) {
                 struct bcma_device *other_core;
                 struct bcma_device *core = kzalloc(sizeof(*core), GFP_KERNEL);
-                if (!core)
-                        return -ENOMEM;
+                if (!core) {
+                        err = -ENOMEM;
+                        goto out;
+                }
                 INIT_LIST_HEAD(&core->list);
                 core->bus = bus;
 
@@ -478,7 +480,7 @@ int bcma_bus_scan(struct bcma_bus *bus)
                         } else if (err == -ESPIPE) {
                                 break;
                         }
-                        return err;
+                        goto out;
                 }
 
                 core->core_index = core_num++;
@@ -494,10 +496,12 @@ int bcma_bus_scan(struct bcma_bus *bus)
                 list_add_tail(&core->list, &bus->cores);
         }
 
+        err = 0;
+out:
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 iounmap(eromptr);
 
-        return 0;
+        return err;
 }
 
 int __init bcma_bus_scan_early(struct bcma_bus *bus,
@@ -537,7 +541,7 @@ int __init bcma_bus_scan_early(struct bcma_bus *bus,
                 else if (err == -ESPIPE)
                         break;
                 else if (err < 0)
-                        return err;
+                        goto out;
 
                 core->core_index = core_num++;
                 bus->nr_cores++;
@@ -551,6 +555,7 @@ int __init bcma_bus_scan_early(struct bcma_bus *bus,
                 break;
         }
 
+out:
         if (bus->hosttype == BCMA_HOSTTYPE_SOC)
                 iounmap(eromptr);
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 643f968b05ee..00838395778c 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -739,11 +739,6 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         txi = IEEE80211_SKB_CB(skb);
 
-        if (txi->control.vif)
-                hwsim_check_magic(txi->control.vif);
-        if (txi->control.sta)
-                hwsim_check_sta_magic(txi->control.sta);
-
         ieee80211_tx_info_clear_status(txi);
 
         /* frame was transmitted at most favorable rate at first attempt */