Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-3945.h
	drivers/net/wireless/iwlwifi/iwl-tx.c
	drivers/net/wireless/iwlwifi/iwl3945-base.c

6 files changed, 28 insertions, 30 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 49f3139a3fe7..c150c4858576 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5918,20 +5918,19 @@ static int airo_set_essid(struct net_device *dev,
         readSsidRid(local, &SSID_rid);
 
         /* Check if we asked for `any' */
-        if(dwrq->flags == 0) {
+        if (dwrq->flags == 0) {
                 /* Just send an empty SSID list */
                 memset(&SSID_rid, 0, sizeof(SSID_rid));
         } else {
-                int     index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
+                unsigned index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
                 /* Check the size of the string */
-                if(dwrq->length > IW_ESSID_MAX_SIZE) {
+                if (dwrq->length > IW_ESSID_MAX_SIZE)
                         return -E2BIG ;
-                }
+
                 /* Check if index is valid */
-                if((index < 0) || (index >= 4)) {
+                if (index >= ARRAY_SIZE(SSID_rid.ssids))
                         return -EINVAL;
-                }
 
                 /* Set the SSID */
                 memset(SSID_rid.ssids[index].ssid, 0,
@@ -6819,7 +6818,7 @@ static int airo_set_txpow(struct net_device *dev,
                 return -EINVAL;
         }
         clear_bit (FLAG_RADIO_OFF, &local->flags);
-        for (i = 0; cap_rid.txPowerLevels[i] && (i < 8); i++)
+        for (i = 0; i < 8 && cap_rid.txPowerLevels[i]; i++)
                 if (v == cap_rid.txPowerLevels[i]) {
                         readConfigRid(local, 1);
                         local->config.txPower = v;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index df41ed5fd7c4..93e8ce0598a4 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -460,7 +460,7 @@ static int ath9k_hw_4k_check_eeprom(struct ath_hw *ah)
                 integer = swab32(eep->modalHeader.antCtrlCommon);
                 eep->modalHeader.antCtrlCommon = integer;
 
-                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                for (i = 0; i < AR5416_EEP4K_MAX_CHAINS; i++) {
                         integer = swab32(eep->modalHeader.antCtrlChain[i]);
                         eep->modalHeader.antCtrlChain[i] = integer;
                 }
@@ -914,7 +914,7 @@ static void ath9k_hw_set_4k_power_per_rate_table(struct ath_hw *ah,
                         ctlMode, numCtlModes, isHt40CtlMode,
                         (pCtlMode[ctlMode] & EXT_ADDITIVE));
 
-                for (i = 0; (i < AR5416_NUM_CTLS) &&
+                for (i = 0; (i < AR5416_EEP4K_NUM_CTLS) &&
                                 pEepData->ctlIndex[i]; i++) {
                         DPRINTF(ah->ah_sc, ATH_DBG_EEPROM,
                                 "  LOOP-Ctlidx %d: cfgCtl 0x%2.2x "
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 0912987af603..c7100b9dcede 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -724,8 +724,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 goto drop_unlock;
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
-
         hdr_len = ieee80211_hdrlen(fc);
 
         /* Find (or create) index into station table for destination station */
@@ -733,7 +731,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
                                hdr->addr1);
-                goto drop;
+                goto drop_unlock;
         }
 
         IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
@@ -751,14 +749,17 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
                 /* aggregation is on for this <sta,tid> */
                 if (info->flags & IEEE80211_TX_CTL_AMPDU)
                         txq_id = priv->stations[sta_id].tid[tid].agg.txq_id;
-                priv->stations[sta_id].tid[tid].tfds_in_queue++;
         }
 
         txq = &priv->txq[txq_id];
         swq_id = txq->swq_id;
         q = &txq->q;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        if (unlikely(iwl_queue_space(q) < q->high_mark))
+                goto drop_unlock;
+
+        if (ieee80211_is_data_qos(fc))
+                priv->stations[sta_id].tid[tid].tfds_in_queue++;
 
         /* Set up driver data for this TFD */
         memset(&(txq->txb[q->write_ptr]), 0, sizeof(struct iwl_tx_info));
@@ -903,7 +904,6 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
 
 drop_unlock:
         spin_unlock_irqrestore(&priv->lock, flags);
-drop:
         return -1;
 }
 EXPORT_SYMBOL(iwl_tx_skb);
@@ -1172,6 +1172,8 @@ int iwl_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
                 IWL_ERR(priv, "Start AGG on invalid station\n");
                 return -ENXIO;
         }
+        if (unlikely(tid >= MAX_TID_COUNT))
+                return -EINVAL;
 
         if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_OFF) {
                 IWL_ERR(priv, "Start AGG when state is not IWL_AGG_OFF !\n");
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index 092d28ae56a0..93cc1b3e7f48 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -99,10 +99,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
         int ret = 0;
 
         wdev = iwm_wdev_alloc(sizeof_bus, dev);
-        if (!wdev) {
-                dev_err(dev, "no memory for wireless device instance\n");
-                return ERR_PTR(-ENOMEM);
-        }
+        if (IS_ERR(wdev))
+                return wdev;
 
         iwm = wdev_to_iwm(wdev);
         iwm->bus_ops = if_ops;
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 385b50f4b105..1902b6f0b78c 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,6 +1,7 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -43,21 +44,21 @@ static int get_common_rates(struct lbs_private *priv,
         u16 *rates_size)
 {
         u8 *card_rates = lbs_bg_rates;
-        size_t num_card_rates = sizeof(lbs_bg_rates);
         int ret = 0, i, j;
-        u8 tmp[30];
+        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
         size_t tmp_size = 0;
 
         /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; rates[j] && (j < *rates_size); j++) {
+        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+                for (j = 0; j < *rates_size && rates[j]; j++) {
                         if (rates[j] == card_rates[i])
                                 tmp[tmp_size++] = card_rates[i];
                 }
         }
 
         lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+                        ARRAY_SIZE(lbs_bg_rates));
         lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
         lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
 
@@ -69,10 +70,7 @@ static int get_common_rates(struct lbs_private *priv,
                 lbs_pr_alert("Previously set fixed data rate %#x isn't "
                        "compatible with the network.\n", priv->cur_rate);
                 ret = -1;
-                goto done;
         }
-        ret = 0;
-
 done:
         memset(rates, 0, *rates_size);
         *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +318,7 @@ static int lbs_associate(struct lbs_private *priv,
         rates = (struct mrvl_ie_rates_param_set *) pos;
         rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
         memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
+        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
         if (get_common_rates(priv, rates->rates, &tmplen)) {
                 ret = -1;
                 goto done;
@@ -594,7 +592,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
 
         /* Copy Data rates from the rates recorded in scan response */
         memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
         memcpy(cmd.bss.rates, bss->rates, ratesize);
         if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                 lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 601b54249677..6c95af3023cc 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -5,6 +5,7 @@
   *  for sending scan commands to the firmware.
   */
 #include <linux/types.h>
+#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 #include <asm/unaligned.h>
@@ -876,7 +877,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         iwe.u.bitrate.disabled = 0;
         iwe.u.bitrate.value = 0;
 
-        for (j = 0; bss->rates[j] && (j < sizeof(bss->rates)); j++) {
+        for (j = 0; j < ARRAY_SIZE(bss->rates) && bss->rates[j]; j++) {
                 /* Bit rate given in 500 kb/s units */
                 iwe.u.bitrate.value = bss->rates[j] * 500000;
                 current_val = iwe_stream_add_value(info, start, current_val,