Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) IPVS oops'ers:
   a) Should not reset skb->nf_bridge in forwarding hook (Lin Ming)
   b) 3.4 commit can cause ip_vs_control_cleanup to be invoked after
      the ipvs_core_ops are unregistered during rmmod (Julian ANastasov)

 2) ixgbevf bringup failure can crash in TX descriptor cleanup
    (Alexander Duyck)

 3) AX25 switch missing break statement hoses ROSE sockets (Alan Cox)

 4) CAIF accesses freed per-net memory (Sjur Brandeland)

 5) Network cgroup code has out-or-bounds accesses (Eric DUmazet), and
    accesses freed memory (Gao Feng)

 6) Fix a crash in SCTP reported by Dave Jones caused by freeing an
    association still on a list (Neil HOrman)

 7) __netdev_alloc_skb() regresses on GFP_DMA using drivers because that
    GFP flag is not being retained for the allocation (Eric Dumazet).

 8) Missing NULL hceck in sch_sfb netlink message parsing (Alan Cox)

 9) bnx2 crashes because TX index iteration is not bounded correctly
    (Michael Chan)

10) IPoIB generates warnings in TCP queue collapsing (via
    skb_try_coalesce) because it does not set skb->truesize correctly
    (Eric Dumazet)

11) vlan_info objects leak for the implicit vlan with ID 0 (Amir
    Hanania)

12) A fix for TX time stamp handling in gianfar does not transfer socket
    ownership from one packet to another correctly, resulting in a
    socket write space imbalance (Eric Dumazet)

13) Julia Lawall found several cases where we do a list iteration, and
    then at the loop termination unconditionally assume we ended up with
    real list object, rather than the list head itself (CNIC, RXRPC,
    mISDN).

14) The bonding driver handles procfs moving incorrectly when a device
    it manages is moved from one namespace to another (Eric Biederman)

15) Missing memory barriers in stmmac descriptor accesses result in
    various crashes (Deepak Sikri)

16) Fix handling of broadcast packets in batman-adv (Simon Wunderlich)

17) Properly check the sanity of sendmsg() lengths in ieee802154's
    dgram_sendmsg().  Dave Jones and others have hit and reported this
    bug (Sasha Levin)

18) Some drivers (b44 and b43legacy) on 64-bit machines stopped working
    because of how netdev_alloc_skb() was adjusted.  Such drivers should
    now use alloc_skb() for obtaining bounce buffers.  (Eric Dumazet)

19) atl1c mis-managed it's link state in that it stops the queue by hand
    on link down.  The generic networking takes care of that and this
    double stop locks the queue down.  So simply removing the driver's
    queue stop call fixes the problem (Cloud Ren)

20) Fix out-of-memory due to mis-accounting in net_em packet scheduler
    (Eric Dumazet)

21) If DCB and SR-IOV are configured at the same time in IXGBE the chip
    will hang because this is not supported (Alexander Duyck)

22) A commit to stop drivers using netdev->base_addr broke the CNIC
    driver (Michael Chan)

23) Timeout regression in ipset caused by an attempt to fix an overflow
    bug (Jozsef Kadlecsik).

24) mac80211 minstrel code allocates memory using incorrect size
    (Thomas Huehn)

25) llcp_sock_getname() needs to check for a NULL device otherwise we
    OOPS (Sasha Levin)

26) mwifiex leaks memory (Bing Zhao)

27) Propagate iwlwifi fix to iwlegacy, even when we're not associated
    we need to monitor for stuck queues in the watchdog handler
    (Stanislaw Geuszka)

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
  ipvs: fix oops in ip_vs_dst_event on rmmod
  ipvs: fix oops on NAT reply in br_nf context
  ixgbevf: Fix panic when loading driver
  ax25: Fix missing break
  MAINTAINERS: reflect actual changes in IEEE 802.15.4 maintainership
  caif: Fix access to freed pernet memory
  net: cgroup: fix access the unallocated memory in netprio cgroup
  ixgbevf: Prevent RX/TX statistics getting reset to zero
  sctp: Fix list corruption resulting from freeing an association on a list
  net: respect GFP_DMA in __netdev_alloc_skb()
  e1000e: fix test for PHY being accessible on 82577/8/9 and I217
  e1000e: Correct link check logic for 82571 serdes
  sch_sfb: Fix missing NULL check
  bnx2: Fix bug in bnx2_free_tx_skbs().
  IPoIB: fix skb truesize underestimatiom
  net: Fix memory leak - vlan_info struct
  gianfar: fix potential sk_wmem_alloc imbalance
  drivers/net/ethernet/broadcom/cnic.c: remove invalid reference to list iterator variable
  net/rxrpc/ar-peer.c: remove invalid reference to list iterator variable
  drivers/isdn/mISDN/stack.c: remove invalid reference to list iterator variable
  ...

22 files changed, 117 insertions, 60 deletions

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5c1bc995e560..f10221f40803 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -123,7 +123,7 @@ static void ipoib_ud_skb_put_frags(struct ipoib_dev_priv *priv,
 
                 skb_frag_size_set(frag, size);
                 skb->data_len += size;
-                skb->truesize += size;
+                skb->truesize += PAGE_SIZE;
         } else
                 skb_put(skb, length);
 
@@ -156,14 +156,18 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct sk_buff *skb;
         int buf_size;
+        int tailroom;
         u64 *mapping;
 
-        if (ipoib_ud_need_sg(priv->max_ib_mtu))
+        if (ipoib_ud_need_sg(priv->max_ib_mtu)) {
                 buf_size = IPOIB_UD_HEAD_SIZE;
-        else
+                tailroom = 128; /* reserve some tailroom for IP/TCP headers */
+        } else {
                 buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
+                tailroom = 0;
+        }
 
-        skb = dev_alloc_skb(buf_size + 4);
+        skb = dev_alloc_skb(buf_size + tailroom + 4);
         if (unlikely(!skb))
                 return NULL;
 
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 1a0ae4445ff2..5f21f629b7ae 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -135,8 +135,8 @@ send_layer2(struct mISDNstack *st, struct sk_buff *skb)
                         skb = NULL;
                 else if (*debug & DEBUG_SEND_ERR)
                         printk(KERN_DEBUG
-                               "%s ch%d mgr prim(%x) addr(%x) err %d\n",
-                               __func__, ch->nr, hh->prim, ch->addr, ret);
+                               "%s mgr prim(%x) err %d\n",
+                               __func__, hh->prim, ret);
         }
 out:
         mutex_unlock(&st->lmutex);
diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
index 3680aa251dea..2cf084eb9d52 100644
--- a/drivers/net/bonding/bond_debugfs.c
+++ b/drivers/net/bonding/bond_debugfs.c
@@ -6,7 +6,7 @@
 #include "bonding.h"
 #include "bond_alb.h"
 
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) && !defined(CONFIG_NET_NS)
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b9c2ae62166d..2ee76993f052 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3227,6 +3227,12 @@ static int bond_master_netdev_event(unsigned long event,
         switch (event) {
         case NETDEV_CHANGENAME:
                 return bond_event_changename(event_bond);
+        case NETDEV_UNREGISTER:
+                bond_remove_proc_entry(event_bond);
+                break;
+        case NETDEV_REGISTER:
+                bond_create_proc_entry(event_bond);
+                break;
         default:
                 break;
         }
@@ -4411,8 +4417,6 @@ static void bond_uninit(struct net_device *bond_dev)
 
         bond_work_cancel_all(bond);
 
-        bond_remove_proc_entry(bond);
-
         bond_debug_unregister(bond);
 
         __hw_addr_flush(&bond->mc_list);
@@ -4814,7 +4818,6 @@ static int bond_init(struct net_device *bond_dev)
 
         bond_set_lockdep_class(bond_dev);
 
-        bond_create_proc_entry(bond);
         list_add_tail(&bond->bond_list, &bn->dev_list);
 
         bond_prepare_sysfs_group(bond);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 9cc15701101b..1f78b63d5efe 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -261,7 +261,6 @@ static void atl1c_check_link_status(struct atl1c_adapter *adapter)
         if ((phy_data & BMSR_LSTATUS) == 0) {
                 /* link down */
                 netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                 hw->hibernate = true;
                 if (atl1c_reset_mac(hw) != 0)
                         if (netif_msg_hw(adapter))
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 46b8b7d81633..d09c6b583d17 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -656,7 +656,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                         dma_unmap_single(bp->sdev->dma_dev, mapping,
                                              RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
-                skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
+                skb = alloc_skb(RX_PKT_BUF_SZ, GFP_ATOMIC | GFP_DMA);
                 if (skb == NULL)
                         return -ENOMEM;
                 mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
@@ -967,7 +967,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dma_unmap_single(bp->sdev->dma_dev, mapping, len,
                                              DMA_TO_DEVICE);
 
-                bounce_skb = __netdev_alloc_skb(dev, len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb)
                         goto err_out;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index ac7b74488531..1fa4927a45b1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -5372,7 +5372,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                         int k, last;
 
                         if (skb == NULL) {
-                                j++;
+                                j = NEXT_TX_BD(j);
                                 continue;
                         }
 
@@ -5384,8 +5384,8 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                         tx_buf->skb = NULL;
 
                         last = tx_buf->nr_frags;
-                        j++;
-                        for (k = 0; k < last; k++, j++) {
+                        j = NEXT_TX_BD(j);
+                        for (k = 0; k < last; k++, j = NEXT_TX_BD(j)) {
                                 tx_buf = &txr->tx_buf_ring[TX_RING_IDX(j)];
                                 dma_unmap_page(&bp->pdev->dev,
                                         dma_unmap_addr(tx_buf, mapping),
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index c95e7b5e2b85..2c89d17cbb29 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -534,7 +534,8 @@ int cnic_unregister_driver(int ulp_type)
         }
 
         if (atomic_read(&ulp_ops->ref_count) != 0)
-                netdev_warn(dev->netdev, "Failed waiting for ref count to go to zero\n");
+                pr_warn("%s: Failed waiting for ref count to go to zero\n",
+                        __func__);
         return 0;
 
 out_unlock:
@@ -1053,12 +1054,13 @@ static int cnic_init_uio(struct cnic_dev *dev)
 
         uinfo = &udev->cnic_uinfo;
 
-        uinfo->mem[0].addr = dev->netdev->base_addr;
+        uinfo->mem[0].addr = pci_resource_start(dev->pcidev, 0);
         uinfo->mem[0].internal_addr = dev->regview;
-        uinfo->mem[0].size = dev->netdev->mem_end - dev->netdev->mem_start;
         uinfo->mem[0].memtype = UIO_MEM_PHYS;
 
         if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
+                                                     TX_MAX_TSS_RINGS + 1);
                 uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
                                         PAGE_MASK;
                 if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
@@ -1068,6 +1070,8 @@ static int cnic_init_uio(struct cnic_dev *dev)
 
                 uinfo->name = "bnx2_cnic";
         } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
+
                 uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
                         PAGE_MASK;
                 uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index f2db8fca46a1..ab1d80ff0791 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2063,10 +2063,9 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         return NETDEV_TX_OK;
                 }
 
-                /* Steal sock reference for processing TX time stamps */
-                swap(skb_new->sk, skb->sk);
-                swap(skb_new->destructor, skb->destructor);
-                kfree_skb(skb);
+                if (skb->sk)
+                        skb_set_owner_w(skb_new, skb->sk);
+                consume_skb(skb);
                 skb = skb_new;
         }
 
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 36db4df09aed..1f063dcd8f85 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -1572,6 +1572,9 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
         ctrl = er32(CTRL);
         status = er32(STATUS);
         rxcw = er32(RXCW);
+        /* SYNCH bit and IV bit are sticky */
+        udelay(10);
+        rxcw = er32(RXCW);
 
         if ((rxcw & E1000_RXCW_SYNCH) && !(rxcw & E1000_RXCW_IV)) {
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 238ab2f8a5e7..e3a7b07df629 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -325,24 +325,46 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
  **/
 static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
-        u16 phy_reg;
-        u32 phy_id;
+        u16 phy_reg = 0;
+        u32 phy_id = 0;
+        s32 ret_val;
+        u16 retry_count;
+
+        for (retry_count = 0; retry_count < 2; retry_count++) {
+                ret_val = e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF))
+                        continue;
+                phy_id = (u32)(phy_reg << 16);
 
-        e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
-        phy_id = (u32)(phy_reg << 16);
-        e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
-        phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                ret_val = e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF)) {
+                        phy_id = 0;
+                        continue;
+                }
+                phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                break;
+        }
 
         if (hw->phy.id) {
                 if (hw->phy.id == phy_id)
                         return true;
-        } else {
-                if ((phy_id != 0) && (phy_id != PHY_REVISION_MASK))
-                        hw->phy.id = phy_id;
+        } else if (phy_id) {
+                hw->phy.id = phy_id;
+                hw->phy.revision = (u32)(phy_reg & ~PHY_REVISION_MASK);
                 return true;
         }
 
-        return false;
+        /*
+         * In case the PHY needs to be in mdio slow mode,
+         * set slow mode and try to get the PHY id again.
+         */
+        hw->phy.ops.release(hw);
+        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+        if (!ret_val)
+                ret_val = e1000e_get_phy_id(hw);
+        hw->phy.ops.acquire(hw);
+
+        return !ret_val;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 18ca3bcadf0c..e242104ab471 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6647,6 +6647,11 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
                 return -EINVAL;
         }
 
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                e_err(drv, "Enable failed, SR-IOV enabled\n");
+                return -EINVAL;
+        }
+
         /* Hardware supports up to 8 traffic classes */
         if (tc > adapter->dcb_cfg.num_tcs.pg_tcs ||
             (hw->mac.type == ixgbe_mac_82598EB &&
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index f69ec4288b10..41e32257a4e8 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -201,6 +201,9 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
         unsigned int i, eop, count = 0;
         unsigned int total_bytes = 0, total_packets = 0;
 
+        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
+                return true;
+
         i = tx_ring->next_to_clean;
         eop = tx_ring->tx_buffer_info[i].next_to_watch;
         eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
@@ -969,8 +972,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
         r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
         for (i = 0; i < q_vector->txr_count; i++) {
                 tx_ring = &(adapter->tx_ring[r_idx]);
-                tx_ring->total_bytes = 0;
-                tx_ring->total_packets = 0;
                 ixgbevf_clean_tx_irq(adapter, tx_ring);
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
                                       r_idx + 1);
@@ -994,16 +995,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
         struct ixgbe_hw *hw = &adapter->hw;
         struct ixgbevf_ring  *rx_ring;
         int r_idx;
-        int i;
-
-        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        for (i = 0; i < q_vector->rxr_count; i++) {
-                rx_ring = &(adapter->rx_ring[r_idx]);
-                rx_ring->total_bytes = 0;
-                rx_ring->total_packets = 0;
-                r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
-        }
 
         if (!q_vector->rxr_count)
                 return IRQ_HANDLED;
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index fb8377da1687..4b785e10f2ed 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -51,7 +51,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 1, bmax,
                                                 csum);
-
+                wmb();
                 entry = (++priv->cur_tx) % txsize;
                 desc = priv->dma_tx + entry;
 
@@ -59,6 +59,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                             len, DMA_TO_DEVICE);
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum);
+                wmb();
                 priv->hw->desc->set_tx_owner(desc);
                 priv->tx_skbuff[entry] = NULL;
         } else {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 51b3b68528ee..ea3003edde18 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1212,6 +1212,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum_insertion);
                 wmb();
                 priv->hw->desc->set_tx_owner(desc);
+                wmb();
         }
 
         /* Interrupt on completition only for the latest segment */
@@ -1227,6 +1228,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* To avoid raise condition */
         priv->hw->desc->set_tx_owner(first);
+        wmb();
 
         priv->cur_tx++;
 
@@ -1290,6 +1292,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                 }
                 wmb();
                 priv->hw->desc->set_rx_owner(p + entry);
+                wmb();
         }
 }
 
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 39ea0674dcde..5c120189ec86 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -46,7 +46,13 @@ static int mdio_mux_read(struct mii_bus *bus, int phy_id, int regnum)
         struct mdio_mux_parent_bus *pb = cb->parent;
         int r;
 
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        /* In theory multiple mdio_mux could be stacked, thus creating
+         * more than a single level of nesting.  But in practice,
+         * SINGLE_DEPTH_NESTING will cover the vast majority of use
+         * cases.  We use it, instead of trying to handle the general
+         * case.
+         */
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
         r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
         if (r)
                 goto out;
@@ -71,7 +77,7 @@ static int mdio_mux_write(struct mii_bus *bus, int phy_id,
 
         int r;
 
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
         r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
         if (r)
                 goto out;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b01960fcfbc9..a051cedd64bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -346,6 +346,15 @@ static const struct driver_info	qmi_wwan_force_int1 = {
         .data           = BIT(1), /* interface whitelist bitmap */
 };
 
+static const struct driver_info qmi_wwan_force_int2 = {
+        .description    = "Qualcomm WWAN/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_shared,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(2), /* interface whitelist bitmap */
+};
+
 static const struct driver_info qmi_wwan_force_int3 = {
         .description    = "Qualcomm WWAN/QMI device",
         .flags          = FLAG_WWAN,
@@ -498,6 +507,15 @@ static const struct usb_device_id products[] = {
                 .bInterfaceProtocol = 0xff,
                 .driver_info        = (unsigned long)&qmi_wwan_force_int4,
         },
+        {       /* ZTE MF60 */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1402,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int2,
+        },
         {       /* Sierra Wireless MC77xx in QMI mode */
                 .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
                 .idVendor           = 0x1199,
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index f1f8bd09bd87..c8baf020c20f 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1072,7 +1072,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
         meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
         /* create a bounce buffer in zone_dma on mapping failure. */
         if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb) {
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..ff5d689e13f3 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -3405,7 +3405,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
                 return 0;
         }
 
-        if (il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
                 IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
                         key_flags);
                 spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -3420,7 +3420,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
         memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
         il->stations[sta_id].sta.key.key_flags =
             STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        il->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
         il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index cbf2dc18341f..5d4807c2b56d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4767,14 +4767,12 @@ il_bg_watchdog(unsigned long data)
                 return;
 
         /* monitor and check for other stuck queues */
-        if (il_is_any_associated(il)) {
-                for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
-                        /* skip as we already checked the command queue */
-                        if (cnt == il->cmd_queue)
-                                continue;
-                        if (il_check_stuck_queue(il, cnt))
-                                return;
-                }
+        for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
+                /* skip as we already checked the command queue */
+                if (cnt == il->cmd_queue)
+                        continue;
+                if (il_check_stuck_queue(il, cnt))
+                        return;
         }
 
         mod_timer(&il->watchdog,
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ce61b6fae1c9..5c7fd185373c 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -958,6 +958,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
         case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
                 /* firmware doesn't support this type of hidden SSID */
         default:
+                kfree(bss_cfg);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index d357d1ed92f6..74ecc33fdd90 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -436,8 +436,8 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
         case QID_RX:
                 if (!rt2x00queue_full(queue))
                         rt2x00queue_for_each_entry(queue,
-                                                   Q_INDEX_DONE,
                                                    Q_INDEX,
+                                                   Q_INDEX_DONE,
                                                    NULL,
                                                    rt2x00usb_kick_rx_entry);
                 break;