4 files changed, 23 insertions, 6 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 22a1a8fc6e02..7bef66def10c 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -514,9 +514,9 @@ EXPORT_SYMBOL_GPL(rt2800_write_tx_data);
 
 static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, u32 rxwi_w2)
 {
-        int rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0);
-        int rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1);
-        int rssi2 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI2);
+        s8 rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0);
+        s8 rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1);
+        s8 rssi2 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI2);
         u16 eeprom;
         u8 offset0;
         u8 offset1;
@@ -552,7 +552,7 @@ static int rt2800_agc_to_rssi(struct rt2x00_dev *rt2x00dev, u32 rxwi_w2)
          * which gives less energy...
          */
         rssi0 = max(rssi0, rssi1);
-        return max(rssi0, rssi2);
+        return (int)max(rssi0, rssi2);
 }
 
 void rt2800_process_rxwi(struct queue_entry *entry,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..fd356b7c0476 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -426,10 +426,14 @@ void rt2x00lib_txdone(struct queue_entry *entry,
         /*
          * If the data queue was below the threshold before the txdone
          * handler we must make sure the packet queue in the mac80211 stack
-         * is reenabled when the txdone handler has finished.
+         * is reenabled when the txdone handler has finished. This has to be
+         * serialized with rt2x00mac_tx(), otherwise we can wake up queue
+         * before it was stopped.
          */
+        spin_lock_bh(&entry->queue->tx_lock);
         if (!rt2x00queue_threshold(entry->queue))
                 rt2x00queue_unpause_queue(entry->queue);
+        spin_unlock_bh(&entry->queue->tx_lock);
 }
 EXPORT_SYMBOL_GPL(rt2x00lib_txdone);
 
@@ -1220,7 +1224,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                 cancel_work_sync(&rt2x00dev->rxdone_work);
                 cancel_work_sync(&rt2x00dev->txdone_work);
         }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
 
         /*
          * Free the tx status fifo.
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index ede3c58e6783..2df2eb6d3e06 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -152,13 +152,22 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
         if (unlikely(rt2x00queue_write_tx_frame(queue, skb, false)))
                 goto exit_fail;
 
+        /*
+         * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
+         * we should not use spin_lock_bh variant as bottom halve was already
+         * disabled before ieee80211_xmit() call.
+         */
+        spin_lock(&queue->tx_lock);
         if (rt2x00queue_threshold(queue))
                 rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
 
         return;
 
  exit_fail:
+        spin_lock(&queue->tx_lock);
         rt2x00queue_pause_queue(queue);
+        spin_unlock(&queue->tx_lock);
  exit_free_skb:
         ieee80211_free_txskb(hw, skb);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 5adfb3eab9cd..9b1b2b7a7807 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -619,6 +619,9 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
         else if (test_bit(REQUIRE_DMA, &queue->rt2x00dev->cap_flags))
                 rt2x00queue_align_frame(skb);
 
+        /*
+         * That function must be called with bh disabled.
+         */
         spin_lock(&queue->tx_lock);
 
         if (unlikely(rt2x00queue_full(queue))) {