Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (26 commits)
  bonding: fix panic if initialization fails
  IXP4xx: complete Ethernet netdev setup before calling register_netdev().
  IXP4xx: use "ENODEV" instead of "ENOSYS" in module initialization.
  ipvs: Fix IPv4 FWMARK virtual services
  ipv4: Make INET_LRO a bool instead of tristate.
  net: remove stale reference to fastroute from Kconfig help text
  net: update skb_recycle_check() for hardware timestamping changes
  bnx2: Fix panic in bnx2_poll_work().
  net-sched: fix bfifo default limit
  igb: resolve panic on shutdown when SR-IOV is enabled
  wimax: oops: wimax_dev_add() is the only one that can initialize the state
  wimax: fix oops if netlink fails to add attribute
  Bluetooth: Move dev_set_name() to a context that can sleep
  netfilter: ctnetlink: fix wrong message type in user updates
  netfilter: xt_cluster: fix use of cluster match with 32 nodes
  netfilter: ip6t_ipv6header: fix match on packets ending with NEXTHDR_NONE
  netfilter: add missing linux/types.h include to xt_LED.h
  mac80211: pid, fix memory corruption
  mac80211: minstrel, fix memory corruption
  cfg80211: fix comment on regulatory hint processing
  ...

3 files changed, 41 insertions, 36 deletions

diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index 3824990d340b..70df3dcc3cf6 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -476,7 +476,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                 return NULL;
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
-                sband = hw->wiphy->bands[hw->conf.channel->band];
+                sband = hw->wiphy->bands[i];
                 if (sband->n_bitrates > max_rates)
                         max_rates = sband->n_bitrates;
         }
diff --git a/net/mac80211/rc80211_pid_algo.c b/net/mac80211/rc80211_pid_algo.c
index b16801cde06f..01d59a8e334c 100644
--- a/net/mac80211/rc80211_pid_algo.c
+++ b/net/mac80211/rc80211_pid_algo.c
@@ -317,13 +317,44 @@ rate_control_pid_rate_init(void *priv, struct ieee80211_supported_band *sband,
                            struct ieee80211_sta *sta, void *priv_sta)
 {
         struct rc_pid_sta_info *spinfo = priv_sta;
+        struct rc_pid_info *pinfo = priv;
+        struct rc_pid_rateinfo *rinfo = pinfo->rinfo;
         struct sta_info *si;
+        int i, j, tmp;
+        bool s;
 
         /* TODO: This routine should consider using RSSI from previous packets
          * as we need to have IEEE 802.1X auth succeed immediately after assoc..
          * Until that method is implemented, we will use the lowest supported
          * rate as a workaround. */
 
+        /* Sort the rates. This is optimized for the most common case (i.e.
+         * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
+         * mapping too. */
+        for (i = 0; i < sband->n_bitrates; i++) {
+                rinfo[i].index = i;
+                rinfo[i].rev_index = i;
+                if (RC_PID_FAST_START)
+                        rinfo[i].diff = 0;
+                else
+                        rinfo[i].diff = i * pinfo->norm_offset;
+        }
+        for (i = 1; i < sband->n_bitrates; i++) {
+                s = 0;
+                for (j = 0; j < sband->n_bitrates - i; j++)
+                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
+                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
+                                tmp = rinfo[j].index;
+                                rinfo[j].index = rinfo[j + 1].index;
+                                rinfo[j + 1].index = tmp;
+                                rinfo[rinfo[j].index].rev_index = j;
+                                rinfo[rinfo[j + 1].index].rev_index = j + 1;
+                                s = 1;
+                        }
+                if (!s)
+                        break;
+        }
+
         spinfo->txrate_idx = rate_lowest_index(sband, sta);
         /* HACK */
         si = container_of(sta, struct sta_info, sta);
@@ -336,21 +367,22 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
         struct rc_pid_info *pinfo;
         struct rc_pid_rateinfo *rinfo;
         struct ieee80211_supported_band *sband;
-        int i, j, tmp;
-        bool s;
+        int i, max_rates = 0;
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct rc_pid_debugfs_entries *de;
 #endif
 
-        sband = hw->wiphy->bands[hw->conf.channel->band];
-
         pinfo = kmalloc(sizeof(*pinfo), GFP_ATOMIC);
         if (!pinfo)
                 return NULL;
 
-        /* We can safely assume that sband won't change unless we get
-         * reinitialized. */
-        rinfo = kmalloc(sizeof(*rinfo) * sband->n_bitrates, GFP_ATOMIC);
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = hw->wiphy->bands[i];
+                if (sband->n_bitrates > max_rates)
+                        max_rates = sband->n_bitrates;
+        }
+
+        rinfo = kmalloc(sizeof(*rinfo) * max_rates, GFP_ATOMIC);
         if (!rinfo) {
                 kfree(pinfo);
                 return NULL;
@@ -368,33 +400,6 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
         pinfo->rinfo = rinfo;
         pinfo->oldrate = 0;
 
-        /* Sort the rates. This is optimized for the most common case (i.e.
-         * almost-sorted CCK+OFDM rates). Kind of bubble-sort with reversed
-         * mapping too. */
-        for (i = 0; i < sband->n_bitrates; i++) {
-                rinfo[i].index = i;
-                rinfo[i].rev_index = i;
-                if (RC_PID_FAST_START)
-                        rinfo[i].diff = 0;
-                else
-                        rinfo[i].diff = i * pinfo->norm_offset;
-        }
-        for (i = 1; i < sband->n_bitrates; i++) {
-                s = 0;
-                for (j = 0; j < sband->n_bitrates - i; j++)
-                        if (unlikely(sband->bitrates[rinfo[j].index].bitrate >
-                                     sband->bitrates[rinfo[j + 1].index].bitrate)) {
-                                tmp = rinfo[j].index;
-                                rinfo[j].index = rinfo[j + 1].index;
-                                rinfo[j + 1].index = tmp;
-                                rinfo[rinfo[j].index].rev_index = j;
-                                rinfo[rinfo[j + 1].index].rev_index = j + 1;
-                                s = 1;
-                        }
-                if (!s)
-                        break;
-        }
-
 #ifdef CONFIG_MAC80211_DEBUGFS
         de = &pinfo->dentries;
         de->target = debugfs_create_u32("target_pf", S_IRUSR | S_IWUSR,
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 3fb04a86444d..63656266d567 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -772,7 +772,7 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
 
         /* internal error, why is TX_FRAGMENTED set? */
-        if (WARN_ON(skb->len <= frag_threshold))
+        if (WARN_ON(skb->len + FCS_LEN <= frag_threshold))
                 return TX_DROP;
 
         /*