Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix memory leaks and other issues in mwifiex driver, from Amitkumar
    Karwar.

 2) skb_segment() can choke on packets using frag lists, fix from
    Herbert Xu with help from Eric Dumazet and others.

 3) IPv4 output cached route instantiation properly handles races
    involving two threads trying to install the same route, but we
    forgot to propagate this logic to input routes as well.  Fix from
    Alexei Starovoitov.

 4) Put protections in place to make sure that recvmsg() paths never
    accidently copy uninitialized memory back into userspace and also
    make sure that we never try to use more that sockaddr_storage for
    building the on-kernel-stack copy of a sockaddr.  Fixes from Hannes
    Frederic Sowa.

 5) R8152 driver transmit flow bug fixes from Hayes Wang.

 6) Fix some minor fallouts from genetlink changes, from Johannes Berg
    and Michael Opdenacker.

 7) AF_PACKET sendmsg path can race with netdevice unregister notifier,
    fix by using RCU to make sure the network device doesn't go away
    from under us.  Fix from Daniel Borkmann.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits)
  gso: handle new frag_list of frags GRO packets
  genetlink: fix genl_set_err() group ID
  genetlink: fix genlmsg_multicast() bug
  packet: fix use after free race in send path when dev is released
  xen-netback: stop the VIF thread before unbinding IRQs
  wimax: remove dead code
  net/phy: Add the autocross feature for forced links on VSC82x4
  net/phy: Add VSC8662 support
  net/phy: Add VSC8574 support
  net/phy: Add VSC8234 support
  net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage)
  net: rework recvmsg handler msg_name and msg_namelen logic
  bridge: flush br's address entry in fdb when remove the
  net: core: Always propagate flag changes to interfaces
  ipv4: fix race in concurrent ip_route_input_slow()
  r8152: fix incorrect type in assignment
  r8152: support stopping/waking tx queue
  r8152: modify the tx flow
  r8152: fix tx/rx memory overflow
  netfilter: ebt_ip6: fix source and destination matching
  ...

1 files changed, 7 insertions, 21 deletions

diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9d7c9d354d34..78e8a6666cc6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -411,13 +411,14 @@ static void mwifiex_terminate_workqueue(struct mwifiex_adapter *adapter)
  */
 static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 {
-        int ret, i;
+        int ret;
         char fmt[64];
         struct mwifiex_private *priv;
         struct mwifiex_adapter *adapter = context;
         struct mwifiex_fw_image fw;
         struct semaphore *sem = adapter->card_sem;
         bool init_failed = false;
+        struct wireless_dev *wdev;
 
         if (!firmware) {
                 dev_err(adapter->dev,
@@ -469,14 +470,16 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         priv = adapter->priv[MWIFIEX_BSS_ROLE_STA];
         if (mwifiex_register_cfg80211(adapter)) {
                 dev_err(adapter->dev, "cannot register with cfg80211\n");
-                goto err_register_cfg80211;
+                goto err_init_fw;
         }
 
         rtnl_lock();
         /* Create station interface by default */
-        if (!mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
-                                      NL80211_IFTYPE_STATION, NULL, NULL)) {
+        wdev = mwifiex_add_virtual_intf(adapter->wiphy, "mlan%d",
+                                        NL80211_IFTYPE_STATION, NULL, NULL);
+        if (IS_ERR(wdev)) {
                 dev_err(adapter->dev, "cannot create default STA interface\n");
+                rtnl_unlock();
                 goto err_add_intf;
         }
         rtnl_unlock();
@@ -486,17 +489,6 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
         goto done;
 
 err_add_intf:
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-
-                if (!priv)
-                        continue;
-
-                if (priv->wdev && priv->netdev)
-                        mwifiex_del_virtual_intf(adapter->wiphy, priv->wdev);
-        }
-        rtnl_unlock();
-err_register_cfg80211:
         wiphy_unregister(adapter->wiphy);
         wiphy_free(adapter->wiphy);
 err_init_fw:
@@ -1006,12 +998,6 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
         wiphy_unregister(priv->wdev->wiphy);
         wiphy_free(priv->wdev->wiphy);
 
-        for (i = 0; i < adapter->priv_num; i++) {
-                priv = adapter->priv[i];
-                if (priv)
-                        kfree(priv->wdev);
-        }
-
         mwifiex_terminate_workqueue(adapter);
 
         /* Unregister device */