Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (56 commits)
  l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
  tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
  tcp: Increment OUTRSTS in tcp_send_active_reset()
  raw: Raw socket leak.
  lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
  USB ID for Philips CPWUA054/00 Wireless USB Adapter 11g
  ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
  libertas: fix command size for CMD_802_11_SUBSCRIBE_EVENT
  ipw2200: expire and use oldest BSS on adhoc create
  airo warning fix
  b43legacy: Fix controller restart crash
  sctp: Fix ECN markings for IPv6
  sctp: Flush the queue only once during fast retransmit.
  sctp: Start T3-RTX timer when fast retransmitting lowest TSN
  sctp: Correctly implement Fast Recovery cwnd manipulations.
  sctp: Move sctp_v4_dst_saddr out of loop
  sctp: retran_path update bug fix
  tcp: fix skb vs fack_count out-of-sync condition
  sunhme: Cleanup use of deprecated calls to save_and_cli and restore_flags.
  xfrm: xfrm_algo: correct usage of RIPEMD-160
  ...

1 files changed, 9 insertions, 8 deletions

diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 14a5eea2573e..204077c13870 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3039,7 +3039,6 @@ static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
 {
-        struct b43legacy_wl *wl = dev->wl;
         struct b43legacy_phy *phy = &dev->phy;
         u32 macctl;
 
@@ -3054,12 +3053,6 @@ static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
         macctl |= B43legacy_MACCTL_PSM_JMP0;
         b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
 
-        mutex_unlock(&wl->mutex);
-        /* Must unlock as it would otherwise deadlock. No races here.
-         * Cancel possibly pending workqueues. */
-        cancel_work_sync(&dev->restart_work);
-        mutex_lock(&wl->mutex);
-
         b43legacy_leds_exit(dev);
         b43legacy_rng_exit(dev->wl);
         b43legacy_pio_free(dev);
@@ -3486,6 +3479,8 @@ static void b43legacy_chip_reset(struct work_struct *work)
                 }
         }
 out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
         mutex_unlock(&wl->mutex);
         if (err)
                 b43legacyerr(wl, "Controller restart FAILED\n");
@@ -3618,9 +3613,11 @@ static void b43legacy_one_core_detach(struct ssb_device *dev)
         struct b43legacy_wldev *wldev;
         struct b43legacy_wl *wl;
 
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43legacy_remove(). */
+
         wldev = ssb_get_drvdata(dev);
         wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
         b43legacy_debugfs_remove_device(wldev);
         b43legacy_wireless_core_detach(wldev);
         list_del(&wldev->list);
@@ -3789,6 +3786,10 @@ static void b43legacy_remove(struct ssb_device *dev)
         struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
         struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
 
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
+
         B43legacy_WARN_ON(!wl);
         if (wl->current_dev == wldev)
                 ieee80211_unregister_hw(wl->hw);