Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (56 commits)
  l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
  tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
  tcp: Increment OUTRSTS in tcp_send_active_reset()
  raw: Raw socket leak.
  lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
  USB ID for Philips CPWUA054/00 Wireless USB Adapter 11g
  ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
  libertas: fix command size for CMD_802_11_SUBSCRIBE_EVENT
  ipw2200: expire and use oldest BSS on adhoc create
  airo warning fix
  b43legacy: Fix controller restart crash
  sctp: Fix ECN markings for IPv6
  sctp: Flush the queue only once during fast retransmit.
  sctp: Start T3-RTX timer when fast retransmitting lowest TSN
  sctp: Correctly implement Fast Recovery cwnd manipulations.
  sctp: Move sctp_v4_dst_saddr out of loop
  sctp: retran_path update bug fix
  tcp: fix skb vs fack_count out-of-sync condition
  sunhme: Cleanup use of deprecated calls to save_and_cli and restore_flags.
  xfrm: xfrm_algo: correct usage of RIPEMD-160
  ...

16 files changed, 182 insertions, 54 deletions

diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 6e4c80d41b08..6ddc911e7d15 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -2023,6 +2023,7 @@ rrd_ok:
                 /* Good Receive */
                 pci_unmap_page(adapter->pdev, buffer_info->dma,
                                buffer_info->length, PCI_DMA_FROMDEVICE);
+                buffer_info->dma = 0;
                 skb = buffer_info->skb;
                 length = le16_to_cpu(rrd->xsz.xsum_sz.pkt_size);
 
diff --git a/drivers/net/cs89x0.c b/drivers/net/cs89x0.c
index 348371fda597..fba87abe78ee 100644
--- a/drivers/net/cs89x0.c
+++ b/drivers/net/cs89x0.c
@@ -1394,7 +1394,11 @@ net_open(struct net_device *dev)
 #endif
         if (!result) {
                 printk(KERN_ERR "%s: EEPROM is configured for unavailable media\n", dev->name);
-        release_irq:
+release_dma:
+#if ALLOW_DMA
+                free_dma(dev->dma);
+#endif
+release_irq:
 #if ALLOW_DMA
                 release_dma_buff(lp);
 #endif
@@ -1442,12 +1446,12 @@ net_open(struct net_device *dev)
                         if ((result = detect_bnc(dev)) != DETECTED_NONE)
                                 break;
                 printk(KERN_ERR "%s: no media detected\n", dev->name);
-                goto release_irq;
+                goto release_dma;
         }
         switch(result) {
         case DETECTED_NONE:
                 printk(KERN_ERR "%s: no network cable attached to configured media\n", dev->name);
-                goto release_irq;
+                goto release_dma;
         case DETECTED_RJ45H:
                 printk(KERN_INFO "%s: using half-duplex 10Base-T (RJ-45)\n", dev->name);
                 break;
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index 36be6efc6398..e0d76c75aea0 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -75,7 +75,7 @@
 #include "myri10ge_mcp.h"
 #include "myri10ge_mcp_gen_header.h"
 
-#define MYRI10GE_VERSION_STR "1.3.2-1.287"
+#define MYRI10GE_VERSION_STR "1.3.99-1.347"
 
 MODULE_DESCRIPTION("Myricom 10G driver (10GbE)");
 MODULE_AUTHOR("Maintainer: help@myri.com");
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index 8db342f2fdc9..70cfdb46aa27 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -240,12 +240,15 @@ static inline struct pppol2tp_session *pppol2tp_sock_to_session(struct sock *sk)
         if (sk == NULL)
                 return NULL;
 
+        sock_hold(sk);
         session = (struct pppol2tp_session *)(sk->sk_user_data);
-        if (session == NULL)
-                return NULL;
+        if (session == NULL) {
+                sock_put(sk);
+                goto out;
+        }
 
         BUG_ON(session->magic != L2TP_SESSION_MAGIC);
-
+out:
         return session;
 }
 
@@ -256,12 +259,15 @@ static inline struct pppol2tp_tunnel *pppol2tp_sock_to_tunnel(struct sock *sk)
         if (sk == NULL)
                 return NULL;
 
+        sock_hold(sk);
         tunnel = (struct pppol2tp_tunnel *)(sk->sk_user_data);
-        if (tunnel == NULL)
-                return NULL;
+        if (tunnel == NULL) {
+                sock_put(sk);
+                goto out;
+        }
 
         BUG_ON(tunnel->magic != L2TP_TUNNEL_MAGIC);
-
+out:
         return tunnel;
 }
 
@@ -716,12 +722,14 @@ discard:
         session->stats.rx_errors++;
         kfree_skb(skb);
         sock_put(session->sock);
+        sock_put(sock);
 
         return 0;
 
 error:
         /* Put UDP header back */
         __skb_push(skb, sizeof(struct udphdr));
+        sock_put(sock);
 
 no_tunnel:
         return 1;
@@ -745,10 +753,13 @@ static int pppol2tp_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
                "%s: received %d bytes\n", tunnel->name, skb->len);
 
         if (pppol2tp_recv_core(sk, skb))
-                goto pass_up;
+                goto pass_up_put;
 
+        sock_put(sk);
         return 0;
 
+pass_up_put:
+        sock_put(sk);
 pass_up:
         return 1;
 }
@@ -858,7 +869,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
 
         tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
         if (tunnel == NULL)
-                goto error;
+                goto error_put_sess;
 
         /* What header length is configured for this session? */
         hdr_len = pppol2tp_l2tp_header_len(session);
@@ -870,7 +881,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                            sizeof(ppph) + total_len,
                            0, GFP_KERNEL);
         if (!skb)
-                goto error;
+                goto error_put_sess_tun;
 
         /* Reserve space for headers. */
         skb_reserve(skb, NET_SKB_PAD);
@@ -900,7 +911,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         error = memcpy_fromiovec(skb->data, m->msg_iov, total_len);
         if (error < 0) {
                 kfree_skb(skb);
-                goto error;
+                goto error_put_sess_tun;
         }
         skb_put(skb, total_len);
 
@@ -947,10 +958,33 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
                 session->stats.tx_errors++;
         }
 
+        return error;
+
+error_put_sess_tun:
+        sock_put(session->tunnel_sock);
+error_put_sess:
+        sock_put(sk);
 error:
         return error;
 }
 
+/* Automatically called when the skb is freed.
+ */
+static void pppol2tp_sock_wfree(struct sk_buff *skb)
+{
+        sock_put(skb->sk);
+}
+
+/* For data skbs that we transmit, we associate with the tunnel socket
+ * but don't do accounting.
+ */
+static inline void pppol2tp_skb_set_owner_w(struct sk_buff *skb, struct sock *sk)
+{
+        sock_hold(sk);
+        skb->sk = sk;
+        skb->destructor = pppol2tp_sock_wfree;
+}
+
 /* Transmit function called by generic PPP driver.  Sends PPP frame
  * over PPPoL2TP socket.
  *
@@ -993,10 +1027,10 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
 
         sk_tun = session->tunnel_sock;
         if (sk_tun == NULL)
-                goto abort;
+                goto abort_put_sess;
         tunnel = pppol2tp_sock_to_tunnel(sk_tun);
         if (tunnel == NULL)
-                goto abort;
+                goto abort_put_sess;
 
         /* What header length is configured for this session? */
         hdr_len = pppol2tp_l2tp_header_len(session);
@@ -1009,7 +1043,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                 sizeof(struct udphdr) + hdr_len + sizeof(ppph);
         old_headroom = skb_headroom(skb);
         if (skb_cow_head(skb, headroom))
-                goto abort;
+                goto abort_put_sess_tun;
 
         new_headroom = skb_headroom(skb);
         skb_orphan(skb);
@@ -1069,7 +1103,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         /* Get routing info from the tunnel socket */
         dst_release(skb->dst);
         skb->dst = dst_clone(__sk_dst_get(sk_tun));
-        skb->sk = sk_tun;
+        pppol2tp_skb_set_owner_w(skb, sk_tun);
 
         /* Queue the packet to IP for output */
         len = skb->len;
@@ -1086,8 +1120,14 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                 session->stats.tx_errors++;
         }
 
+        sock_put(sk_tun);
+        sock_put(sk);
         return 1;
 
+abort_put_sess_tun:
+        sock_put(sk_tun);
+abort_put_sess:
+        sock_put(sk);
 abort:
         /* Free the original skb */
         kfree_skb(skb);
@@ -1191,7 +1231,7 @@ static void pppol2tp_tunnel_destruct(struct sock *sk)
 {
         struct pppol2tp_tunnel *tunnel;
 
-        tunnel = pppol2tp_sock_to_tunnel(sk);
+        tunnel = sk->sk_user_data;
         if (tunnel == NULL)
                 goto end;
 
@@ -1230,10 +1270,12 @@ static void pppol2tp_session_destruct(struct sock *sk)
         if (sk->sk_user_data != NULL) {
                 struct pppol2tp_tunnel *tunnel;
 
-                session = pppol2tp_sock_to_session(sk);
+                session = sk->sk_user_data;
                 if (session == NULL)
                         goto out;
 
+                BUG_ON(session->magic != L2TP_SESSION_MAGIC);
+
                 /* Don't use pppol2tp_sock_to_tunnel() here to
                  * get the tunnel context because the tunnel
                  * socket might have already been closed (its
@@ -1279,6 +1321,7 @@ out:
 static int pppol2tp_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
+        struct pppol2tp_session *session;
         int error;
 
         if (!sk)
@@ -1296,9 +1339,18 @@ static int pppol2tp_release(struct socket *sock)
         sock_orphan(sk);
         sock->sk = NULL;
 
+        session = pppol2tp_sock_to_session(sk);
+
         /* Purge any queued data */
         skb_queue_purge(&sk->sk_receive_queue);
         skb_queue_purge(&sk->sk_write_queue);
+        if (session != NULL) {
+                struct sk_buff *skb;
+                while ((skb = skb_dequeue(&session->reorder_q))) {
+                        kfree_skb(skb);
+                        sock_put(sk);
+                }
+        }
 
         release_sock(sk);
 
@@ -1601,7 +1653,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
 
         error = ppp_register_channel(&po->chan);
         if (error)
-                goto end;
+                goto end_put_tun;
 
         /* This is how we get the session context from the socket. */
         sk->sk_user_data = session;
@@ -1621,6 +1673,8 @@ out_no_ppp:
         PRINTK(session->debug, PPPOL2TP_MSG_CONTROL, KERN_INFO,
                "%s: created\n", session->name);
 
+end_put_tun:
+        sock_put(tunnel_sock);
 end:
         release_sock(sk);
 
@@ -1668,6 +1722,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
         *usockaddr_len = len;
 
         error = 0;
+        sock_put(sock->sk);
 
 end:
         return error;
@@ -1906,14 +1961,17 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
                 err = -EBADF;
                 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                 if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
 
                 err = pppol2tp_tunnel_ioctl(tunnel, cmd, arg);
-                goto end;
+                sock_put(session->tunnel_sock);
+                goto end_put_sess;
         }
 
         err = pppol2tp_session_ioctl(session, cmd, arg);
 
+end_put_sess:
+        sock_put(sk);
 end:
         return err;
 }
@@ -2059,14 +2117,17 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
                 err = -EBADF;
                 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                 if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
 
                 err = pppol2tp_tunnel_setsockopt(sk, tunnel, optname, val);
+                sock_put(session->tunnel_sock);
         } else
                 err = pppol2tp_session_setsockopt(sk, session, optname, val);
 
         err = 0;
 
+end_put_sess:
+        sock_put(sk);
 end:
         return err;
 }
@@ -2181,20 +2242,24 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
                 err = -EBADF;
                 tunnel = pppol2tp_sock_to_tunnel(session->tunnel_sock);
                 if (tunnel == NULL)
-                        goto end;
+                        goto end_put_sess;
 
                 err = pppol2tp_tunnel_getsockopt(sk, tunnel, optname, &val);
+                sock_put(session->tunnel_sock);
         } else
                 err = pppol2tp_session_getsockopt(sk, session, optname, &val);
 
         err = -EFAULT;
         if (put_user(len, (int __user *) optlen))
-                goto end;
+                goto end_put_sess;
 
         if (copy_to_user((void __user *) optval, &val, len))
-                goto end;
+                goto end_put_sess;
 
         err = 0;
+
+end_put_sess:
+        sock_put(sk);
 end:
         return err;
 }
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index b4b63805ee8f..61955f8d8011 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -972,7 +972,7 @@ static int sc92031_start_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_copy_and_csum_dev(skb, priv->tx_bufs + entry * TX_BUF_SIZE);
 
         len = skb->len;
-        if (unlikely(len < ETH_ZLEN)) {
+        if (len < ETH_ZLEN) {
                 memset(priv->tx_bufs + entry * TX_BUF_SIZE + len,
                                 0, ETH_ZLEN - len);
                 len = ETH_ZLEN;
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index dbdcee4b0f8d..55c0d9760be8 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -459,7 +459,7 @@ static int falcon_check_xaui_link_up(struct efx_nic *efx)
                 tries--;
         }
 
-        EFX_ERR(efx, "Failed to bring XAUI link back up in %d tries!\n",
+        EFX_LOG(efx, "Failed to bring XAUI link back up in %d tries!\n",
                 max_tries);
         return 0;
 }
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index b4e7f30ea4e8..1aa425be3067 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -111,7 +111,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
         struct hme_tx_logent *tlp;
         unsigned long flags;
 
-        save_and_cli(flags);
+        local_irq_save(flags);
         tlp = &tx_log[txlog_cur_entry];
         tlp->tstamp = (unsigned int)jiffies;
         tlp->tx_new = hp->tx_new;
@@ -119,7 +119,7 @@ static __inline__ void tx_add_log(struct happy_meal *hp, unsigned int a, unsigne
         tlp->action = a;
         tlp->status = s;
         txlog_cur_entry = (txlog_cur_entry + 1) & (TX_LOG_LEN - 1);
-        restore_flags(flags);
+        local_irq_restore(flags);
 }
 static __inline__ void tx_dump_log(void)
 {
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index f9d13fa05d64..55670b5eb611 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -1729,12 +1729,15 @@ static int tulip_suspend (struct pci_dev *pdev, pm_message_t state)
         if (!dev)
                 return -EINVAL;
 
-        if (netif_running(dev))
-                tulip_down(dev);
+        if (!netif_running(dev))
+                goto save_state;
+
+        tulip_down(dev);
 
         netif_device_detach(dev);
         free_irq(dev->irq, dev);
 
+save_state:
         pci_save_state(pdev);
         pci_disable_device(pdev);
         pci_set_power_state(pdev, pci_choose_state(pdev, state));
@@ -1754,6 +1757,9 @@ static int tulip_resume(struct pci_dev *pdev)
         pci_set_power_state(pdev, PCI_D0);
         pci_restore_state(pdev);
 
+        if (!netif_running(dev))
+                return 0;
+
         if ((retval = pci_enable_device(pdev))) {
                 printk (KERN_ERR "tulip: pci_enable_device failed in resume\n");
                 return retval;
diff --git a/drivers/net/ucc_geth_ethtool.c b/drivers/net/ucc_geth_ethtool.c
index 299b7f176950..f5839c4a5cbd 100644
--- a/drivers/net/ucc_geth_ethtool.c
+++ b/drivers/net/ucc_geth_ethtool.c
@@ -73,6 +73,7 @@ static char tx_fw_stat_gstrings[][ETH_GSTRING_LEN] = {
         "tx-frames-ok",
         "tx-excessive-differ-frames",
         "tx-256-511-frames",
+        "tx-512-1023-frames",
         "tx-1024-1518-frames",
         "tx-jumbo-frames",
 };
@@ -308,7 +309,7 @@ static void uec_get_strings(struct net_device *netdev, u32 stringset, u8 *buf)
                 buf += UEC_TX_FW_STATS_LEN * ETH_GSTRING_LEN;
         }
         if (stats_mode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX)
-                memcpy(buf, tx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
+                memcpy(buf, rx_fw_stat_gstrings, UEC_RX_FW_STATS_LEN *
                                 ETH_GSTRING_LEN);
 }
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fe7cdf2a2a23..5450eac9e263 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -47,6 +47,9 @@ struct virtnet_info
         /* Number of input buffers, and max we've ever had. */
         unsigned int num, max;
 
+        /* For cleaning up after transmission. */
+        struct tasklet_struct tasklet;
+
         /* Receive & send queues. */
         struct sk_buff_head recv;
         struct sk_buff_head send;
@@ -68,8 +71,13 @@ static void skb_xmit_done(struct virtqueue *svq)
 
         /* Suppress further interrupts. */
         svq->vq_ops->disable_cb(svq);
+
         /* We were waiting for more output buffers. */
         netif_wake_queue(vi->dev);
+
+        /* Make sure we re-xmit last_xmit_skb: if there are no more packets
+         * queued, start_xmit won't be called. */
+        tasklet_schedule(&vi->tasklet);
 }
 
 static void receive_skb(struct net_device *dev, struct sk_buff *skb,
@@ -278,6 +286,18 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
         return vi->svq->vq_ops->add_buf(vi->svq, sg, num, 0, skb);
 }
 
+static void xmit_tasklet(unsigned long data)
+{
+        struct virtnet_info *vi = (void *)data;
+
+        netif_tx_lock_bh(vi->dev);
+        if (vi->last_xmit_skb && xmit_skb(vi, vi->last_xmit_skb) == 0) {
+                vi->svq->vq_ops->kick(vi->svq);
+                vi->last_xmit_skb = NULL;
+        }
+        netif_tx_unlock_bh(vi->dev);
+}
+
 static int start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct virtnet_info *vi = netdev_priv(dev);
@@ -287,21 +307,25 @@ again:
         free_old_xmit_skbs(vi);
 
         /* If we has a buffer left over from last time, send it now. */
-        if (vi->last_xmit_skb) {
+        if (unlikely(vi->last_xmit_skb)) {
                 if (xmit_skb(vi, vi->last_xmit_skb) != 0) {
                         /* Drop this skb: we only queue one. */
                         vi->dev->stats.tx_dropped++;
                         kfree_skb(skb);
+                        skb = NULL;
                         goto stop_queue;
                 }
                 vi->last_xmit_skb = NULL;
         }
 
         /* Put new one in send queue and do transmit */
-        __skb_queue_head(&vi->send, skb);
-        if (xmit_skb(vi, skb) != 0) {
-                vi->last_xmit_skb = skb;
-                goto stop_queue;
+        if (likely(skb)) {
+                __skb_queue_head(&vi->send, skb);
+                if (xmit_skb(vi, skb) != 0) {
+                        vi->last_xmit_skb = skb;
+                        skb = NULL;
+                        goto stop_queue;
+                }
         }
 done:
         vi->svq->vq_ops->kick(vi->svq);
@@ -428,6 +452,8 @@ static int virtnet_probe(struct virtio_device *vdev)
         skb_queue_head_init(&vi->recv);
         skb_queue_head_init(&vi->send);
 
+        tasklet_init(&vi->tasklet, xmit_tasklet, (unsigned long)vi);
+
         err = register_netdev(dev);
         if (err) {
                 pr_debug("virtio_net: registering device failed\n");
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 4e1c690ff45f..32019fb878d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2905,7 +2905,7 @@ EXPORT_SYMBOL(init_airo_card);
 
 static int waitbusy (struct airo_info *ai) {
         int delay = 0;
-        while ((IN4500 (ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
+        while ((IN4500(ai, COMMAND) & COMMAND_BUSY) && (delay < 10000)) {
                 udelay (10);
                 if ((++delay % 20) == 0)
                         OUT4500(ai, EVACK, EV_CLEARCOMMANDBUSY);
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 14a5eea2573e..204077c13870 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3039,7 +3039,6 @@ static void b43legacy_set_pretbtt(struct b43legacy_wldev *dev)
 /* Locking: wl->mutex */
 static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
 {
-        struct b43legacy_wl *wl = dev->wl;
         struct b43legacy_phy *phy = &dev->phy;
         u32 macctl;
 
@@ -3054,12 +3053,6 @@ static void b43legacy_wireless_core_exit(struct b43legacy_wldev *dev)
         macctl |= B43legacy_MACCTL_PSM_JMP0;
         b43legacy_write32(dev, B43legacy_MMIO_MACCTL, macctl);
 
-        mutex_unlock(&wl->mutex);
-        /* Must unlock as it would otherwise deadlock. No races here.
-         * Cancel possibly pending workqueues. */
-        cancel_work_sync(&dev->restart_work);
-        mutex_lock(&wl->mutex);
-
         b43legacy_leds_exit(dev);
         b43legacy_rng_exit(dev->wl);
         b43legacy_pio_free(dev);
@@ -3486,6 +3479,8 @@ static void b43legacy_chip_reset(struct work_struct *work)
                 }
         }
 out:
+        if (err)
+                wl->current_dev = NULL; /* Failed to init the dev. */
         mutex_unlock(&wl->mutex);
         if (err)
                 b43legacyerr(wl, "Controller restart FAILED\n");
@@ -3618,9 +3613,11 @@ static void b43legacy_one_core_detach(struct ssb_device *dev)
         struct b43legacy_wldev *wldev;
         struct b43legacy_wl *wl;
 
+        /* Do not cancel ieee80211-workqueue based work here.
+         * See comment in b43legacy_remove(). */
+
         wldev = ssb_get_drvdata(dev);
         wl = wldev->wl;
-        cancel_work_sync(&wldev->restart_work);
         b43legacy_debugfs_remove_device(wldev);
         b43legacy_wireless_core_detach(wldev);
         list_del(&wldev->list);
@@ -3789,6 +3786,10 @@ static void b43legacy_remove(struct ssb_device *dev)
         struct b43legacy_wl *wl = ssb_get_devtypedata(dev);
         struct b43legacy_wldev *wldev = ssb_get_drvdata(dev);
 
+        /* We must cancel any work here before unregistering from ieee80211,
+         * as the ieee80211 unreg will destroy the workqueue. */
+        cancel_work_sync(&wldev->restart_work);
+
         B43legacy_WARN_ON(!wl);
         if (wl->current_dev == wldev)
                 ieee80211_unregister_hw(wl->hw);
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index d74c061994ae..729336774828 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -7558,8 +7558,31 @@ static int ipw_associate(void *data)
             priv->ieee->iw_mode == IW_MODE_ADHOC &&
             priv->config & CFG_ADHOC_CREATE &&
             priv->config & CFG_STATIC_ESSID &&
-            priv->config & CFG_STATIC_CHANNEL &&
-            !list_empty(&priv->ieee->network_free_list)) {
+            priv->config & CFG_STATIC_CHANNEL) {
+                /* Use oldest network if the free list is empty */
+                if (list_empty(&priv->ieee->network_free_list)) {
+                        struct ieee80211_network *oldest = NULL;
+                        struct ieee80211_network *target;
+                        DECLARE_MAC_BUF(mac);
+
+                        list_for_each_entry(target, &priv->ieee->network_list, list) {
+                                if ((oldest == NULL) ||
+                                    (target->last_scanned < oldest->last_scanned))
+                                        oldest = target;
+                        }
+
+                        /* If there are no more slots, expire the oldest */
+                        list_del(&oldest->list);
+                        target = oldest;
+                        IPW_DEBUG_ASSOC("Expired '%s' (%s) from "
+                                        "network list.\n",
+                                        escape_essid(target->ssid,
+                                                     target->ssid_len),
+                                        print_mac(mac, target->bssid));
+                        list_add_tail(&target->list,
+                                      &priv->ieee->network_free_list);
+                }
+
                 element = priv->ieee->network_free_list.next;
                 network = list_entry(element, struct ieee80211_network, list);
                 ipw_adhoc_create(priv, network);
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index ad2fabca9116..0aa0ce3b2c42 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -312,8 +312,8 @@ static ssize_t lbs_threshold_write(uint16_t tlv_type, uint16_t event_mask,
         if (tlv_type != TLV_TYPE_BCNMISS)
                 tlv->freq = freq;
 
-        /* The command header, the event mask, and the one TLV */
-        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 2 + sizeof(*tlv));
+        /* The command header, the action, the event mask, and one TLV */
+        events->hdr.size = cpu_to_le16(sizeof(events->hdr) + 4 + sizeof(*tlv));
 
         ret = lbs_cmd_with_response(priv, CMD_802_11_SUBSCRIBE_EVENT, events);
 
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 98ddbb3b3273..1610a7308c1d 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -49,6 +49,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
         {USB_DEVICE(0x5041, 0x2235)},   /* Linksys WUSB54G Portable */
 
         /* Version 2 devices (3887) */
+        {USB_DEVICE(0x0471, 0x1230)},   /* Philips CPWUA054/00 */
         {USB_DEVICE(0x050d, 0x7050)},   /* Belkin F5D7050 ver 1000 */
         {USB_DEVICE(0x0572, 0x2000)},   /* Cohiba Proto board */
         {USB_DEVICE(0x0572, 0x2002)},   /* Cohiba Proto board */
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 75def13e797d..d28c53868093 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -537,12 +537,12 @@ int ssb_pcicore_dev_irqvecs_enable(struct ssb_pcicore *pc,
         int err = 0;
         u32 tmp;
 
-        might_sleep();
-
         if (!pdev)
                 goto out;
         bus = pdev->bus;
 
+        might_sleep_if(pdev->id.coreid != SSB_DEV_PCI);
+
         /* Enable interrupts for this device. */
         if (bus->host_pci &&
             ((pdev->id.revision >= 6) || (pdev->id.coreid == SSB_DEV_PCIE))) {