7 files changed, 27 insertions, 47 deletions

diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index dbda91e4dff5..1f0b83e18f68 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
         struct bcma_bus *bus = cc->core->bus;
 
         if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
-            cc->core->id.rev != 0x38) {
+            cc->core->id.rev != 38) {
                 bcma_err(bus, "NAND flash on unsupported board!\n");
                 return -ENOTSUPP;
         }
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 7992b3e05d3d..78ace59efd29 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1801,7 +1801,7 @@ static void rhine_tx(struct net_device *dev)
                                          rp->tx_skbuff[entry]->len,
                                          PCI_DMA_TODEVICE);
                 }
-                dev_kfree_skb_irq(rp->tx_skbuff[entry]);
+                dev_kfree_skb(rp->tx_skbuff[entry]);
                 rp->tx_skbuff[entry] = NULL;
                 entry = (++rp->dirty_tx) % TX_RING_SIZE;
         }
@@ -2010,11 +2010,7 @@ static void rhine_slow_event_task(struct work_struct *work)
         if (intr_status & IntrPCIErr)
                 netif_warn(rp, hw, dev, "PCI error\n");
 
-        napi_disable(&rp->napi);
-        rhine_irq_disable(rp);
-        /* Slow and safe. Consider __napi_schedule as a replacement ? */
-        napi_enable(&rp->napi);
-        napi_schedule(&rp->napi);
+        iowrite16(RHINE_EVENT & 0xffff, rp->base + IntrEnable);
 
 out_unlock:
         mutex_unlock(&rp->task_lock);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..9f3d7e9f3bb5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 static bool
 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 {
-        bool morepending = false;
         struct bcma_device *core;
         struct tx_status txstatus, *txs;
         u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
         txs = &txstatus;
         core = wlc_hw->d11core;
         *fatal = false;
-        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
-        while (!(*fatal)
-               && (s1 & TXS_V)) {
-                /* !give others some time to run! */
-                if (n >= max_tx_num) {
-                        morepending = true;
-                        break;
-                }
 
+        while (n < max_tx_num) {
+                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
                 if (s1 == 0xffffffff) {
                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                   __func__);
                         *fatal = true;
                         return false;
                 }
-                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
+                /* only process when valid */
+                if (!(s1 & TXS_V))
+                        break;
 
+                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
                 txs->status = s1 & TXS_STATUS_MASK;
                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
                 txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                 txs->lasttxtime = 0;
 
                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
-
-                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                if (*fatal == true)
+                        return false;
                 n++;
         }
 
-        if (*fatal)
-                return false;
-
-        return morepending;
+        return n >= max_tx_num;
 }
 
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 31534f7c0548..279796419ea0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1153,6 +1153,13 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         next_reclaimed = ssn;
                 }
 
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                                  next_reclaimed);
+                }
+
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1203,28 +1210,11 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
-                        /*
-                         * W/A for FW bug - the seq_ctl isn't updated when the
-                         * queues are flushed. Fetch it from the packet itself
-                         */
-                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
-                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
-                                next_reclaimed =
-                                        SEQ_TO_SN(next_reclaimed + 0x10);
-                        }
-
                         is_offchannel_skb =
                                 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
                 }
 
-                if (tid != IWL_TID_NON_QOS) {
-                        priv->tid_data[sta_id][tid].next_reclaimed =
-                                next_reclaimed;
-                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
-                                           next_reclaimed);
-                }
-
                 WARN_ON(!is_agg && freed != 1);
 
                 /*
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..973a9d90e9ea 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
                         scan_rsp->number_of_sets);
                 ret = -1;
-                goto done;
+                goto check_next_scan;
         }
 
         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 if (!beacon_size || beacon_size > bytes_left) {
                         bss_info += bytes_left;
                         bytes_left = 0;
-                        return -1;
+                        ret = -1;
+                        goto check_next_scan;
                 }
 
                 /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                 dev_err(priv->adapter->dev,
                                         "%s: bytes left < IE length\n",
                                         __func__);
-                                goto done;
+                                goto check_next_scan;
                         }
                         if (element_id == WLAN_EID_DS_PARAMS) {
                                 channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
+check_next_scan:
         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         if (list_empty(&adapter->scan_pending_q)) {
                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index f2ecdeb3a90d..1535efda3d52 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         WARN_ON(skb_queue_empty(&rx_queue));
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
+                ieee80211_rx_irqsafe(hw, _skb);
         }
 }
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 01592d7d4789..45f1618c8e23 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                                                   &iwe, IW_EV_UINT_LEN);
         }
 
-        buf = kmalloc(30, GFP_ATOMIC);
+        buf = kmalloc(31, GFP_ATOMIC);
         if (buf) {
                 memset(&iwe, 0, sizeof(iwe));
                 iwe.cmd = IWEVCUSTOM;