Merge ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

Conflicts:
	drivers/bluetooth/ath3k.c
	drivers/bluetooth/btusb.c

7 files changed, 20 insertions, 3 deletions

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 2575c2db6404..d7b9af4703d0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -727,7 +727,9 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
                         break;
                 }
 
+                tty_unlock();
                 schedule();
+                tty_lock();
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&dev->wait, &wait);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f7a1f08ec3e0..140503d4c97a 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1838,6 +1838,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct net_device *dev,
                 *cookie ^= 2;
                 IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_TX_OFFCHAN;
                 local->hw_roc_skb = skb;
+                local->hw_roc_skb_for_status = skb;
                 mutex_unlock(&local->mtx);
 
                 return 0;
@@ -1892,6 +1893,7 @@ static int ieee80211_mgmt_tx_cancel_wait(struct wiphy *wiphy,
                 if (ret == 0) {
                         kfree_skb(local->hw_roc_skb);
                         local->hw_roc_skb = NULL;
+                        local->hw_roc_skb_for_status = NULL;
                 }
 
                 mutex_unlock(&local->mtx);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index bb63878d865e..0a570a111a84 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -951,7 +951,7 @@ struct ieee80211_local {
 
         struct ieee80211_channel *hw_roc_channel;
         struct net_device *hw_roc_dev;
-        struct sk_buff *hw_roc_skb;
+        struct sk_buff *hw_roc_skb, *hw_roc_skb_for_status;
         struct work_struct hw_roc_start, hw_roc_done;
         enum nl80211_channel_type hw_roc_channel_type;
         unsigned int hw_roc_duration;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d89e87866e51..7b3f9df725bd 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1071,6 +1071,12 @@ void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
         if (is_multicast_ether_addr(hdr->addr1))
                 return;
 
+        /*
+         * In case we receive frames after disassociation.
+         */
+        if (!sdata->u.mgd.associated)
+                return;
+
         ieee80211_sta_reset_conn_monitor(sdata);
 }
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index ffb0de9bc2fa..010a559bd872 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -327,6 +327,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         if (info->flags & IEEE80211_TX_INTFL_NL80211_FRAME_TX) {
                 struct ieee80211_work *wk;
+                u64 cookie = (unsigned long)skb;
 
                 rcu_read_lock();
                 list_for_each_entry_rcu(wk, &local->work_list, list) {
@@ -338,8 +339,12 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         break;
                 }
                 rcu_read_unlock();
+                if (local->hw_roc_skb_for_status == skb) {
+                        cookie = local->hw_roc_cookie ^ 2;
+                        local->hw_roc_skb_for_status = NULL;
+                }
                 cfg80211_mgmt_tx_status(
-                        skb->dev, (unsigned long) skb, skb->data, skb->len,
+                        skb->dev, cookie, skb->data, skb->len,
                         !!(info->flags & IEEE80211_TX_STAT_ACK), GFP_ATOMIC);
         }
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d0f91d74eaf0..34edf7f22b0e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1550,7 +1550,7 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
                 skb_orphan(skb);
         }
 
-        if (skb_header_cloned(skb))
+        if (skb_cloned(skb))
                 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
         else if (head_need || tail_need)
                 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 26fd5d29af7f..556647a910ac 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1204,7 +1204,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC;
+                        mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
+                        mutex_unlock(&sdata->u.mgd.mtx);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;