Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (47 commits)
  ehea: Fix napi list corruption on ifconfig down
  igbvf: Allow VF driver to correctly recognize failure to set mac
  3c59x: Fix build failure with gcc 3.2
  sky2: Avoid transmits during sky2_down()
  iwlagn: do not send key clear commands when rfkill enabled
  libertas: Read buffer overflow
  drivers/net/wireless: introduce missing kfree
  drivers/net/wireless/iwlwifi: introduce missing kfree
  zd1211rw: fix unaligned access in zd_mac_rx
  cfg80211: fix regression on beacon world roaming feature
  cfg80211: add two missing NULL pointer checks
  ixgbe: Patch to modify 82598 PCIe completion timeout values
  bluetooth: rfcomm_init bug fix
  mlx4_en: Fix double pci unmapping.
  mISDN: Fix handling of receive buffer size in L1oIP
  pcnet32: VLB support fixes
  pcnet32: remove superfluous NULL pointer check in pcnet32_probe1()
  net: restore the original spinlock to protect unicast list
  netxen: fix coherent dma mask setting
  mISDN: Read buffer overflow
  ...

12 files changed, 79 insertions, 37 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
 {
+        int ret;
+
         l2cap_load();
 
         hci_register_cb(&rfcomm_cb);
 
         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
         if (IS_ERR(rfcomm_thread)) {
-                hci_unregister_cb(&rfcomm_cb);
-                return PTR_ERR(rfcomm_thread);
+                ret = PTR_ERR(rfcomm_thread);
+                goto out_thread;
         }
 
         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
                 BT_ERR("Failed to create RFCOMM info file");
 
-        rfcomm_init_sockets();
+        ret = rfcomm_init_ttys();
+        if (ret)
+                goto out_tty;
 
-#ifdef CONFIG_BT_RFCOMM_TTY
-        rfcomm_init_ttys();
-#endif
+        ret = rfcomm_init_sockets();
+        if (ret)
+                goto out_sock;
 
         BT_INFO("RFCOMM ver %s", VERSION);
 
         return 0;
+
+out_sock:
+        rfcomm_cleanup_ttys();
+out_tty:
+        kthread_stop(rfcomm_thread);
+out_thread:
+        hci_unregister_cb(&rfcomm_cb);
+
+        return ret;
 }
 
 static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
 
         kthread_stop(rfcomm_thread);
 
-#ifdef CONFIG_BT_RFCOMM_TTY
         rfcomm_cleanup_ttys();
-#endif
 
         rfcomm_cleanup_sockets();
 }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
         return err;
 }
 
-void __exit rfcomm_cleanup_sockets(void)
+void rfcomm_cleanup_sockets(void)
 {
         class_remove_file(bt_class, &class_attr_rfcomm);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..43e61ba7bd95 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3865,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_delete);
@@ -3889,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
 
         ASSERT_RTNL();
 
+        netif_addr_lock_bh(dev);
         err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
                             NETDEV_HW_ADDR_T_UNICAST);
         if (!err)
                 __dev_set_rx_mode(dev);
+        netif_addr_unlock_bh(dev);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_add);
@@ -3949,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
  *      @from: source device
  *
  *      Add newly added addresses to the destination device and release
- *      addresses that have no users left.
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
  *
  *      This function is intended to be called from the dev->set_rx_mode
  *      function of layered software devices.
@@ -3958,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
 {
         int err = 0;
 
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return -EINVAL;
 
+        netif_addr_lock_bh(to);
         err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
         if (!err)
                 __dev_set_rx_mode(to);
+        netif_addr_unlock_bh(to);
         return err;
 }
 EXPORT_SYMBOL(dev_unicast_sync);
@@ -3981,28 +3986,30 @@ EXPORT_SYMBOL(dev_unicast_sync);
  */
 void dev_unicast_unsync(struct net_device *to, struct net_device *from)
 {
-        ASSERT_RTNL();
-
         if (to->addr_len != from->addr_len)
                 return;
 
+        netif_addr_lock_bh(from);
+        netif_addr_lock(to);
         __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
         __dev_set_rx_mode(to);
+        netif_addr_unlock(to);
+        netif_addr_unlock_bh(from);
 }
 EXPORT_SYMBOL(dev_unicast_unsync);
 
 static void dev_unicast_flush(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
+        netif_addr_lock_bh(dev);
         __hw_addr_flush(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 
 static void dev_unicast_init(struct net_device *dev)
 {
-        /* rtnl_mutex must be held here */
-
+        netif_addr_lock_bh(dev);
         __hw_addr_init(&dev->uc);
+        netif_addr_unlock_bh(dev);
 }
 
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
          */
 
         ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len);
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
         call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                 hbuffer[k++] = hex_asc_lo(n->ha[j]);
                 hbuffer[k++] = ':';
         }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         }
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
 {
         struct ieee80211_local *local = (void *) data;
 
-        if (local->quiescing)
+        if (local->quiescing || local->suspended)
                 return;
 
         queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 
         rcu_read_unlock();
 
-        /* flush again, in case driver queued work */
-        flush_workqueue(local->hw.workqueue);
-
-        /* stop hardware - this must stop RX */
-        if (local->open_count) {
-                ieee80211_led_radio(local, false);
-                drv_stop(local);
-        }
-
         /* remove STAs */
         spin_lock_irqsave(&local->sta_lock, flags);
         list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                 drv_remove_interface(local, &conf);
         }
 
+        /* stop hardware - this must stop RX */
+        if (local->open_count) {
+                ieee80211_led_radio(local, false);
+                drv_stop(local);
+        }
+
+        /*
+         * flush again, in case driver queued work -- it
+         * shouldn't be doing (or cancel everything in the
+         * stop callback) that but better safe than sorry.
+         */
+        flush_workqueue(local->hw.workqueue);
+
         local->suspended = true;
+        /* need suspended to be visible before quiescing is false */
+        barrier();
         local->quiescing = false;
 
         return 0;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
                 return;
         }
 
+        /*
+         * If we're suspending, it is possible although not too likely
+         * that we'd be receiving frames after having already partially
+         * quiesced the stack. We can't process such frames then since
+         * that might, for example, cause stations to be added or other
+         * driver callbacks be invoked.
+         */
+        if (unlikely(local->quiescing || local->suspended)) {
+                kfree_skb(skb);
+                return;
+        }
+
         if (status->flag & RX_FLAG_HT) {
                 /* rate_idx is MCS index */
                 if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
                         addr6 = addr;
                         mask6 = mask;
                         map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
-                        if (map4 == NULL)
+                        if (map6 == NULL)
                                 goto cfg_unlbl_map_add_failure;
                         map6->type = NETLBL_NLTYPE_UNLABELED;
                         ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
 
         chan->beacon_found = true;
 
+        if (wiphy->disable_beacon_hints)
+                return;
+
         chan_before.center_freq = chan->center_freq;
         chan_before.flags = chan->flags;
 
-        if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
-            !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
+        if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
                 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
                 channel_changed = true;
         }
 
-        if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
-            !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
+        if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
                 chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
                 channel_changed = true;
         }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
  * non-radar 5 GHz channels.
  *
  * Drivers do not need to call this, cfg80211 will do it for after a scan
- * on a newly found BSS.
+ * on a newly found BSS. If you cannot make use of this feature you can
+ * set the wiphy->disable_beacon_hints to true.
  */
 int regulatory_hint_found_beacon(struct wiphy *wiphy,
                                         struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 9271118e1fc4..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -118,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 
         if (!ie1 && !ie2)
                 return 0;
-        if (!ie1)
+        if (!ie1 || !ie2)
                 return -1;
 
         r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -171,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
         ie = find_ie(WLAN_EID_MESH_CONFIG,
                      a->information_elements,
                      a->len_information_elements);
+        if (!ie)
+                return false;
         if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
                 return false;