Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-3945.h
	drivers/net/wireless/iwlwifi/iwl-tx.c
	drivers/net/wireless/iwlwifi/iwl3945-base.c

34 files changed, 185 insertions, 104 deletions

diff --git a/Documentation/DocBook/kernel-hacking.tmpl b/Documentation/DocBook/kernel-hacking.tmpl
index a50d6cd58573..992e67e6be7f 100644
--- a/Documentation/DocBook/kernel-hacking.tmpl
+++ b/Documentation/DocBook/kernel-hacking.tmpl
@@ -449,8 +449,8 @@ printk(KERN_INFO "i = %u\n", i);
    </para>
 
    <programlisting>
-__u32 ipaddress;
-printk(KERN_INFO "my ip: %d.%d.%d.%d\n", NIPQUAD(ipaddress));
+__be32 ipaddress;
+printk(KERN_INFO "my ip: %pI4\n", &amp;ipaddress);
    </programlisting>
 
    <para>
diff --git a/drivers/net/3c515.c b/drivers/net/3c515.c
index 85ffd132bada..3116410b3499 100644
--- a/drivers/net/3c515.c
+++ b/drivers/net/3c515.c
@@ -832,7 +832,9 @@ static int corkscrew_open(struct net_device *dev)
                         skb_reserve(skb, 2);    /* Align IP on 16 byte boundaries */
                         vp->rx_ring[i].addr = isa_virt_to_bus(skb->data);
                 }
-                vp->rx_ring[i - 1].next = isa_virt_to_bus(&vp->rx_ring[0]);     /* Wrap the ring. */
+                if (i != 0)
+                        vp->rx_ring[i - 1].next =
+                                isa_virt_to_bus(&vp->rx_ring[0]);       /* Wrap the ring. */
                 outl(isa_virt_to_bus(&vp->rx_ring[0]), ioaddr + UpListPtr);
         }
         if (vp->full_bus_master_tx) {   /* Boomerang bus master Tx. */
diff --git a/drivers/net/at1700.c b/drivers/net/at1700.c
index c2227d79673a..5349c58d1fae 100644
--- a/drivers/net/at1700.c
+++ b/drivers/net/at1700.c
@@ -318,7 +318,7 @@ static int __init at1700_probe1(struct net_device *dev, int ioaddr)
                                 pos3 = mca_read_stored_pos( slot, 3 );
                                 pos4 = mca_read_stored_pos( slot, 4 );
 
-                                for (l_i = 0; l_i < 0x09; l_i++)
+                                for (l_i = 0; l_i < 8; l_i++)
                                         if (( pos3 & 0x07) == at1700_ioaddr_pattern[l_i])
                                                 break;
                                 ioaddr = at1700_mca_probe_list[l_i];
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4d1515f45ba2..4869d77cbe91 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -227,7 +227,7 @@ static int cnic_send_nlmsg(struct cnic_local *cp, u32 type,
         }
 
         rcu_read_lock();
-        ulp_ops = rcu_dereference(cp->ulp_ops[CNIC_ULP_ISCSI]);
+        ulp_ops = rcu_dereference(cnic_ulp_tbl[CNIC_ULP_ISCSI]);
         if (ulp_ops)
                 ulp_ops->iscsi_nl_send_msg(cp->dev, msg_type, buf, len);
         rcu_read_unlock();
@@ -319,6 +319,20 @@ static int cnic_abort_prep(struct cnic_sock *csk)
         return 0;
 }
 
+static void cnic_uio_stop(void)
+{
+        struct cnic_dev *dev;
+
+        read_lock(&cnic_dev_lock);
+        list_for_each_entry(dev, &cnic_dev_list, list) {
+                struct cnic_local *cp = dev->cnic_priv;
+
+                if (cp->cnic_uinfo)
+                        cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+        }
+        read_unlock(&cnic_dev_lock);
+}
+
 int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 {
         struct cnic_dev *dev;
@@ -390,6 +404,9 @@ int cnic_unregister_driver(int ulp_type)
         }
         read_unlock(&cnic_dev_lock);
 
+        if (ulp_type == CNIC_ULP_ISCSI)
+                cnic_uio_stop();
+
         rcu_assign_pointer(cnic_ulp_tbl[ulp_type], NULL);
 
         mutex_unlock(&cnic_lock);
@@ -632,7 +649,6 @@ static void cnic_free_resc(struct cnic_dev *dev)
         int i = 0;
 
         if (cp->cnic_uinfo) {
-                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
                 while (cp->uio_dev != -1 && i < 15) {
                         msleep(100);
                         i++;
@@ -1057,6 +1073,9 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
         struct cnic_local *cp = dev->cnic_priv;
         int if_type;
 
+        if (cp->cnic_uinfo)
+                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
+
         rcu_read_lock();
         for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                 struct cnic_ulp_ops *ulp_ops;
diff --git a/drivers/net/eepro.c b/drivers/net/eepro.c
index 71605d63708c..53317a83857a 100644
--- a/drivers/net/eepro.c
+++ b/drivers/net/eepro.c
@@ -1784,7 +1784,7 @@ int __init init_module(void)
                 printk(KERN_INFO "eepro_init_module: Auto-detecting boards (May God protect us...)\n");
         }
 
-        for (i = 0; io[i] != -1 && i < MAX_EEPRO; i++) {
+        for (i = 0; i < MAX_EEPRO && io[i] != -1; i++) {
                 dev = alloc_etherdev(sizeof(struct eepro_local));
                 if (!dev)
                         break;
diff --git a/drivers/net/eexpress.c b/drivers/net/eexpress.c
index 8c44ef4ba357..d1b6368faacd 100644
--- a/drivers/net/eexpress.c
+++ b/drivers/net/eexpress.c
@@ -1474,13 +1474,13 @@ static void eexp_hw_init586(struct net_device *dev)
         outw(0x0000, ioaddr + 0x800c);
         outw(0x0000, ioaddr + 0x800e);
 
-        for (i = 0; i < (sizeof(start_code)); i+=32) {
+        for (i = 0; i < ARRAY_SIZE(start_code) * 2; i+=32) {
                 int j;
                 outw(i, ioaddr + SM_PTR);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j)/2 < ARRAY_SIZE(start_code); j+=2)
                         outw(start_code[(i+j)/2],
                              ioaddr+0x4000+j);
-                for (j = 0; j < 16; j+=2)
+                for (j = 0; j < 16 && (i+j+16)/2 < ARRAY_SIZE(start_code); j+=2)
                         outw(start_code[(i+j+16)/2],
                              ioaddr+0x8000+j);
         }
diff --git a/drivers/net/fealnx.c b/drivers/net/fealnx.c
index 75e5fe5153d9..b2d617206bd9 100644
--- a/drivers/net/fealnx.c
+++ b/drivers/net/fealnx.c
@@ -584,7 +584,8 @@ static int __devinit fealnx_init_one(struct pci_dev *pdev,
         if (np->flags == HAS_MII_XCVR) {
                 int phy, phy_idx = 0;
 
-                for (phy = 1; phy < 32 && phy_idx < 4; phy++) {
+                for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
+                               phy++) {
                         int mii_status = mdio_read(dev, phy, 1);
 
                         if (mii_status != 0xffff && mii_status != 0x0000) {
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index dbf06e9313cc..2234118eedbb 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -366,9 +366,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                 return -EINVAL;
         }
 
-        priv->rxic = mk_ic_value(
-                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs),
-                cvals->rx_max_coalesced_frames);
+        priv->rxic = mk_ic_value(cvals->rx_max_coalesced_frames,
+                gfar_usecs2ticks(priv, cvals->rx_coalesce_usecs));
 
         /* Set up tx coalescing */
         if ((cvals->tx_coalesce_usecs == 0) ||
@@ -390,9 +389,8 @@ static int gfar_scoalesce(struct net_device *dev, struct ethtool_coalesce *cvals
                 return -EINVAL;
         }
 
-        priv->txic = mk_ic_value(
-                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs),
-                cvals->tx_max_coalesced_frames);
+        priv->txic = mk_ic_value(cvals->tx_max_coalesced_frames,
+                gfar_usecs2ticks(priv, cvals->tx_coalesce_usecs));
 
         gfar_write(&priv->regs->rxic, 0);
         if (priv->rxcoalescing)
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index dc3cc4348d1d..62b6c028ae81 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -96,6 +96,8 @@
 #define IXGBE_TX_FLAGS_VLAN_PRIO_MASK   0x0000e000
 #define IXGBE_TX_FLAGS_VLAN_SHIFT       16
 
+#define IXGBE_MAX_RSC_INT_RATE          162760
+
 /* wrapper around a pointer to a socket buffer,
  * so a DMA handle can be stored along with the buffer */
 struct ixgbe_tx_buffer {
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 1464b33f1b8e..c6db9a04187d 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1980,7 +1980,10 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                  * any other value means disable eitr, which is best
                  * served by setting the interrupt rate very high
                  */
-                adapter->eitr_param = IXGBE_MAX_INT_RATE;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        adapter->eitr_param = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        adapter->eitr_param = IXGBE_MAX_INT_RATE;
                 adapter->itr_setting = 0;
         }
 
@@ -2004,13 +2007,13 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
 
         ethtool_op_set_flags(netdev, data);
 
-        if (!(adapter->flags & IXGBE_FLAG2_RSC_CAPABLE))
+        if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                 return 0;
 
         /* if state changes we need to update adapter->flags and reset */
         if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags ^= IXGBE_FLAG2_RSC_ENABLED;
+            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
+                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
                 if (netif_running(netdev))
                         ixgbe_reinit_locked(adapter);
                 else
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 50709da922c7..44adc9862826 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -513,8 +513,11 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
  * @skb: skb currently being received and modified
  **/
 static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
-                                     u32 status_err, struct sk_buff *skb)
+                                     union ixgbe_adv_rx_desc *rx_desc,
+                                     struct sk_buff *skb)
 {
+        u32 status_err = le32_to_cpu(rx_desc->wb.upper.status_error);
+
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Rx csum disabled */
@@ -532,6 +535,16 @@ static inline void ixgbe_rx_checksum(struct ixgbe_adapter *adapter,
                 return;
 
         if (status_err & IXGBE_RXDADV_ERR_TCPE) {
+                u16 pkt_info = rx_desc->wb.lower.lo_dword.hs_rss.pkt_info;
+
+                /*
+                 * 82599 errata, UDP frames with a 0 checksum can be marked as
+                 * checksum errors.
+                 */
+                if ((pkt_info & IXGBE_RXDADV_PKTTYPE_UDP) &&
+                    (adapter->hw.mac.type == ixgbe_mac_82599EB))
+                        return;
+
                 adapter->hw_csum_rx_error++;
                 return;
         }
@@ -769,7 +782,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                 prefetch(next_rxd);
                 cleaned_count++;
 
-                if (adapter->flags & IXGBE_FLAG2_RSC_CAPABLE)
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)
                         rsc_count = ixgbe_get_rsc_count(rx_desc);
 
                 if (rsc_count) {
@@ -805,7 +818,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         goto next_desc;
                 }
 
-                ixgbe_rx_checksum(adapter, staterr, skb);
+                ixgbe_rx_checksum(adapter, rx_desc, skb);
 
                 /* probably a little skewed due to removing CRC */
                 total_rx_bytes += skb->len;
@@ -2025,7 +2038,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                         IXGBE_WRITE_REG(hw, IXGBE_PSRTYPE(0), psrtype);
                 }
         } else {
-                if (!(adapter->flags & IXGBE_FLAG2_RSC_ENABLED) &&
+                if (!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) &&
                     (netdev->mtu <= ETH_DATA_LEN))
                         rx_buf_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                 else
@@ -2154,7 +2167,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_RDRXCTL, rdrxctl);
         }
 
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED) {
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                 /* Enable 82599 HW-RSC */
                 for (i = 0; i < adapter->num_rx_queues; i++) {
                         j = adapter->rx_ring[i].reg_idx;
@@ -3801,8 +3814,8 @@ static int __devinit ixgbe_sw_init(struct ixgbe_adapter *adapter)
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82598;
         } else if (hw->mac.type == ixgbe_mac_82599EB) {
                 adapter->max_msix_q_vectors = MAX_MSIX_Q_VECTORS_82599;
-                adapter->flags |= IXGBE_FLAG2_RSC_CAPABLE;
-                adapter->flags |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_CAPABLE;
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
                 adapter->flags |= IXGBE_FLAG_FDIR_HASH_CAPABLE;
                 adapter->ring_feature[RING_F_FDIR].indices =
                                                          IXGBE_MAX_FDIR_INDICES;
@@ -5349,12 +5362,19 @@ static int ixgbe_del_sanmac_netdev(struct net_device *dev)
 static void ixgbe_netpoll(struct net_device *netdev)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        int i;
 
-        disable_irq(adapter->pdev->irq);
         adapter->flags |= IXGBE_FLAG_IN_NETPOLL;
-        ixgbe_intr(adapter->pdev->irq, netdev);
+        if (adapter->flags & IXGBE_FLAG_MSIX_ENABLED) {
+                int num_q_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
+                for (i = 0; i < num_q_vectors; i++) {
+                        struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+                        ixgbe_msix_clean_many(0, q_vector);
+                }
+        } else {
+                ixgbe_intr(adapter->pdev->irq, netdev);
+        }
         adapter->flags &= ~IXGBE_FLAG_IN_NETPOLL;
-        enable_irq(adapter->pdev->irq);
 }
 #endif
 
@@ -5600,7 +5620,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (pci_using_dac)
                 netdev->features |= NETIF_F_HIGHDMA;
 
-        if (adapter->flags & IXGBE_FLAG2_RSC_ENABLED)
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
                 netdev->features |= NETIF_F_LRO;
 
         /* make sure the EEPROM is good */
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index a6b244a9f4a1..81253abbfa34 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,6 +184,13 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
         kfree(recv_ctx->rds_rings);
 
 skip_rds:
+        if (recv_ctx->sds_rings == NULL)
+                goto skip_sds;
+
+        for(ring = 0; ring < adapter->max_sds_rings; ring++)
+                recv_ctx->sds_rings[ring].consumer = 0;
+
+skip_sds:
         if (adapter->tx_ring == NULL)
                 return;
 
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index f0031f1f97e5..5f2090233d7b 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -1063,6 +1063,7 @@ static void *pppoe_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         else {
                 int hash = hash_item(po->pppoe_pa.sid, po->pppoe_pa.remote);
 
+                po = NULL;
                 while (++hash < PPPOE_HASH_SIZE) {
                         po = pn->hash_table[hash];
                         if (po)
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4b53b58d75fc..b82780d805f5 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2060,8 +2060,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 }
         }
 
-        pci_set_master(pdev);
-
         /* ioremap MMIO region */
         ioaddr = ioremap(pci_resource_start(pdev, region), R8169_REGS_SIZE);
         if (!ioaddr) {
@@ -2089,6 +2087,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         RTL_W16(IntrStatus, 0xffff);
 
+        pci_set_master(pdev);
+
         /* Identify chip attached to board */
         rtl8169_get_mac_version(tp, ioaddr);
 
@@ -3874,6 +3874,15 @@ static void rtl_shutdown(struct pci_dev *pdev)
         spin_unlock_irq(&tp->lock);
 
         if (system_state == SYSTEM_POWER_OFF) {
+                /* WoL fails with some 8168 when the receiver is disabled. */
+                if (tp->features & RTL_FEATURE_WOL) {
+                        pci_clear_master(pdev);
+
+                        RTL_W8(ChipCmd, CmdRxEnb);
+                        /* PCI commit */
+                        RTL_R8(ChipCmd);
+                }
+
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index f1f773b17fe1..57a159fac99f 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -186,7 +186,8 @@ static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 #define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, (l))
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
-#elif   defined(CONFIG_MACH_LOGICPD_PXA270)
+#elif   defined(CONFIG_MACH_LOGICPD_PXA270) \
+        || defined(CONFIG_MACH_NOMADIK_8815NHK)
 
 #define SMC_CAN_USE_8BIT        0
 #define SMC_CAN_USE_16BIT       1
diff --git a/drivers/net/tokenring/ibmtr.c b/drivers/net/tokenring/ibmtr.c
index 6472ba5cfc5e..96d00c8f8d3e 100644
--- a/drivers/net/tokenring/ibmtr.c
+++ b/drivers/net/tokenring/ibmtr.c
@@ -1912,7 +1912,7 @@ static int __init ibmtr_init(void)
 
         find_turbo_adapters(io);
 
-        for (i = 0; io[i] && (i < IBMTR_MAX_ADAPTERS); i++) {
+        for (i = 0; i < IBMTR_MAX_ADAPTERS && io[i]; i++) {
                 struct net_device *dev;
                 irq[i] = 0;
                 mem[i] = 0;
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 49f3139a3fe7..c150c4858576 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
         readSsidRid(local, &SSID_rid);
 
         /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                 /* Just send an empty SSID list */
                 memset(&SSID_rid, 0, sizeof(SSID_rid));
         } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
                 /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                         return -E2BIG ;
-                }
+
                 /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                         return -EINVAL;
-                }
 
                 /* Set the SSID */
                 memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                 return -EINVAL;
         }
         clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                 if (v == cap_rid.txPowerLevels[i]) {
                         readConfigRid(local, 1);
                         local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index df41ed5fd7c4..93e8ce0598a4 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                 integer = swab32(eep->modalHeader.antCtrlCommon);
                 eep->modalHeader.antCtrlCommon = integer;
 
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                         integer = swab32(eep->modalHeader.antCtrlChain[i]);
                         eep->modalHeader.antCtrlChain[i] = integer;
                 }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                         ctlMode, numCtlModes, isHt40CtlMode,
                         (pCtlMode[ctlMode] & EXT_ADDITIVE));
 
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                 pEepData->ctlIndex[i]; i++) {
                         DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                 "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 0912987af603..c7100b9dcede 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -724,8 +724,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 goto drop_unlock;
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find (or create) index into station table for destination station */
@@ -733,7 +731,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
-                goto drop;
+                goto drop_unlock;
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -751,14 +749,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 /* aggregation is on for this <sta,tid> */
                 if (info->flags & IEEE80211_TX_CTL_AMPDU)
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
         }
 
         txq = &priv->txq[txq_id];
         swq_id = txq->swq_id;
         q = &txq->q;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
 
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -903,7 +904,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
 drop_unlock:
         spin_unlock_irqrestore(&priv->lock, flags);
-drop:
         return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1172,6 +1172,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                 IWL_ERR(priv, "Start AGG on invalid station\n");
                 return -ENXIO;
         }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
 
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                 IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index 092d28ae56a0..93cc1b3e7f48 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -99,10 +99,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
         int ret = 0;
 
         wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
-                dev_err(dev, "no memory for wireless device instance\n");
-                return ERR_PTR(-ENOMEM);
-        }
+        if (IS_ERR(wdev))
+                return wdev;
 
         iwm = wdev_to_iwm(wdev);
         iwm->bus_ops = if_ops;
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 385b50f4b105..1902b6f0b78c 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
         u16 *rates_size)
 {
         u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
         int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
         size_t tmp_size = 0;
 
         /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                         if (rates[j] == card_rates[i])
                                 tmp[tmp_size++] = card_rates[i];
                 }
         }
 
         lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
         lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
         lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
 
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                 lbs_pr_alert("Previously set fixed data rate %#x isn't "
                        "compatible with the network.\n", priv->cur_rate);
                 ret = -1;
-                goto done;
         }
-        ret = 0;
-
 done:
         memset(rates, 0, *rates_size);
         *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +318,7 @@ static int lbs_associate(struct lbs_private *priv,
         rates = (struct mrvl_ie_rates_param_set *) pos;
         rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
         memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
         if (get_common_rates(priv, rates->rates, &tmplen)) {
                 ret = -1;
                 goto done;
@@ -594,7 +592,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
 
         /* Copy Data rates from the rates recorded in scan response */
         memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
         memcpy(cmd.bss.rates, bss->rates, ratesize);
         if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                 lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         iwe.u.bitrate.disabled = 0;
         iwe.u.bitrate.value = 0;
 
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                 /* Bit rate given in 500 kb/s units */
                 iwe.u.bitrate.value = bss->rates[j] * 500000;
                 current_val = iwe_stream_add_value(info, start, current_val,
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 783e33c65eb7..b47240ca4b19 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -990,7 +990,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
         struct iscsi_uevent *ev;
         int len = NLMSG_SPACE(sizeof(*ev) + data_size);
 
-        skb = alloc_skb(len, GFP_NOIO);
+        skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
                 printk(KERN_ERR "can not deliver iscsi offload message:OOM\n");
                 return -ENOMEM;
@@ -1012,7 +1012,7 @@ int iscsi_offload_mesg(struct Scsi_Host *shost,
 
         memcpy((char *)ev + sizeof(*ev), data, data_size);
 
-        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_NOIO);
+        return iscsi_multicast_skb(skb, ISCSI_NL_GRP_UIP, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(iscsi_offload_mesg);
 
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index acef2a770b6b..ad27c7da8798 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -82,7 +82,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
 
 #define IN_DEV_FORWARD(in_dev)          IN_DEV_CONF_GET((in_dev), FORWARDING)
 #define IN_DEV_MFORWARD(in_dev)         IN_DEV_ANDCONF((in_dev), MC_FORWARDING)
-#define IN_DEV_RPFILTER(in_dev)         IN_DEV_ANDCONF((in_dev), RP_FILTER)
+#define IN_DEV_RPFILTER(in_dev)         IN_DEV_MAXCONF((in_dev), RP_FILTER)
 #define IN_DEV_SOURCE_ROUTE(in_dev)     IN_DEV_ANDCONF((in_dev), \
                                                        ACCEPT_SOURCE_ROUTE)
 #define IN_DEV_BOOTP_RELAY(in_dev)      IN_DEV_ANDCONF((in_dev), BOOTP_RELAY)
diff --git a/include/net/rose.h b/include/net/rose.h
index cbd5364b2c8a..5ba9f02731eb 100644
--- a/include/net/rose.h
+++ b/include/net/rose.h
@@ -156,7 +156,7 @@ extern int  sysctl_rose_maximum_vcs;
 extern int  sysctl_rose_window_size;
 extern int  rosecmp(rose_address *, rose_address *);
 extern int  rosecmpm(rose_address *, rose_address *, unsigned short);
-extern const char *rose2asc(const rose_address *);
+extern char *rose2asc(char *buf, const rose_address *);
 extern struct sock *rose_find_socket(unsigned int, struct rose_neigh *);
 extern void rose_kill_by_neigh(struct rose_neigh *);
 extern unsigned int rose_new_lci(struct rose_neigh *);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
-        kobject_del(&p->kobj);
+        kobject_put(&p->kobj);
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                 hbuffer[k++] = hex_asc_lo(n->ha[j]);
                 hbuffer[k++] = ':';
         }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         }
 #endif
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
         }
         /* Dup */
         memcpy(new, orig, sizeof(struct tsap_cb));
+        spin_lock_init(&new->lock);
 
         /* We don't need the old instance any more */
         spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 523c0d994d15..0b3551da8f43 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -760,7 +760,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
 
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                 return;
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         rcu_read_unlock();
 
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
-
         /* remove STAs */
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 drv_remove_interface(local, &conf);
         }
 
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
+
         local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
         local->quiescing = false;
 
         return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 66c797cc85ce..b6ddde3848fb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2439,6 +2439,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
         }
 
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
+
         if (status->flag & RX_FLAG_HT) {
                 /* rate_idx is MCS index */
                 if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 3ff6f325be3f..6ce00205f342 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         addr6 = addr;
                         mask6 = mask;
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
                         map6->type = NETLBL_NLTYPE_UNLABELED;
                         ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..f0a76f6bca71 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
 /*
  *      Convert a ROSE address into text.
  */
-const char *rose2asc(const rose_address *addr)
+char *rose2asc(char *buf, const rose_address *addr)
 {
-        static char buffer[11];
-
         if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
             addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
             addr->rose_addr[4] == 0x00) {
-                strcpy(buffer, "*");
+                strcpy(buf, "*");
         } else {
-                sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
+                sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
                                                 addr->rose_addr[1] & 0xFF,
                                                 addr->rose_addr[2] & 0xFF,
                                                 addr->rose_addr[3] & 0xFF,
                                                 addr->rose_addr[4] & 0xFF);
         }
 
-        return buffer;
+        return buf;
 }
 
 /*
@@ -1437,7 +1435,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
 
 static int rose_info_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1455,8 +1453,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
                         devname = dev->name;
 
                 seq_printf(seq, "%-10s %-9s ",
-                        rose2asc(&rose->dest_addr),
-                        ax2asc(buf, &rose->dest_call));
+                           rose2asc(rsbuf, &rose->dest_addr),
+                           ax2asc(buf, &rose->dest_call));
 
                 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
                         callsign = "??????-?";
@@ -1465,7 +1463,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%-10s %-9s %-5s %3.3X %05d  %d  %d  %d  %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
-                        rose2asc(&rose->source_addr),
+                        rose2asc(rsbuf, &rose->source_addr),
                         callsign,
                         devname,
                         rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
 
 static int rose_node_show(struct seq_file *seq, void *v)
 {
+        char rsbuf[11];
         int i;
 
         if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
                 const struct rose_node *rose_node = v;
                 /* if (rose_node->loopback) {
                         seq_printf(seq, "%-10s %04d 1 loopback\n",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask);
                 } else { */
                         seq_printf(seq, "%-10s %04d %d",
-                                rose2asc(&rose_node->address),
-                                rose_node->mask,
-                                rose_node->count);
+                                   rose2asc(rsbuf, &rose_node->address),
+                                   rose_node->mask,
+                                   rose_node->count);
 
                         for (i = 0; i < rose_node->count; i++)
                                 seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
 
 static int rose_route_show(struct seq_file *seq, void *v)
 {
-        char buf[11];
+        char buf[11], rsbuf[11];
 
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d      ",
                                    rose_route->lci1,
-                                   rose2asc(&rose_route->src_addr),
+                                   rose2asc(rsbuf, &rose_route->src_addr),
                                    ax2asc(buf, &rose_route->src_call),
                                    rose_route->neigh1->number);
                 else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
                 if (rose_route->neigh2)
                         seq_printf(seq,
                                    "%3.3X  %-10s  %-9s  %05d\n",
-                                rose_route->lci2,
-                                rose2asc(&rose_route->dest_addr),
-                                ax2asc(buf, &rose_route->dest_call),
-                                rose_route->neigh2->number);
+                                   rose_route->lci2,
+                                   rose2asc(rsbuf, &rose_route->dest_addr),
+                                   ax2asc(buf, &rose_route->dest_call),
+                                   rose_route->neigh2->number);
                  else
                          seq_puts(seq,
                                   "000  *           *          00000\n");