6 files changed, 11 insertions, 4 deletions

diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 892573b27d50..f4e9695ec186 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -690,7 +690,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         }
 
         memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status));
+
+        local_bh_disable();
         ieee80211_rx(dev->wl->hw, skb);
+        local_bh_enable();
 
 #if B43_DEBUG
         dev->rx_count++;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index cdc07c477457..9b5ea8ba7216 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3105,8 +3105,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  out_pci_disable_device:
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
-        ieee80211_free_hw(priv->hw);
         iwl_free_traffic_mem(priv);
+        ieee80211_free_hw(priv->hw);
  out:
         return err;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index c390dbd877e4..837a193221cf 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -4096,8 +4096,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         pci_set_drvdata(pdev, NULL);
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
-        ieee80211_free_hw(priv->hw);
         iwl_free_traffic_mem(priv);
+        ieee80211_free_hw(priv->hw);
  out:
         return err;
 }
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 466859b285e1..c75b960c8ac8 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1669,6 +1669,8 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw);
  * to this function and ieee80211_rx_irqsafe() may not be mixed for a
  * single hardware.
  *
+ * Note that right now, this function must be called with softirqs disabled.
+ *
  * @hw: the hardware this frame came in on
  * @skb: the buffer to receive, owned by mac80211 after this call
  */
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 920ec8792f4b..6eaf69823439 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -544,7 +544,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                        "%pM\n", bss->cbss.bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
-        if (bss && memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
+        if (bss && !memcmp(ifibss->bssid, bss->cbss.bssid, ETH_ALEN)) {
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
                        sdata->dev->name, bss->cbss.bssid);
@@ -829,7 +829,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
                 if (!sdata->u.ibss.ssid_len)
                         continue;
                 sdata->u.ibss.last_scan_completed = jiffies;
-                ieee80211_sta_find_ibss(sdata);
+                mod_timer(&sdata->u.ibss.timer, 0);
         }
         mutex_unlock(&local->iflist_mtx);
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 865fbc09be1a..7170bf4565a8 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,8 @@ void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_supported_band *sband;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
+        WARN_ON_ONCE(softirq_count() == 0);
+
         if (WARN_ON(status->band < 0 ||
                     status->band >= IEEE80211_NUM_BANDS))
                 goto drop;