9 files changed, 55 insertions, 33 deletions

diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 9d38cf60a0db..88c3d8573869 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1967,13 +1967,14 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
         int ret;
 
         mutex_lock(&ar->mutex);
-        if ((param) && !(queue > __AR9170_NUM_TXQ)) {
+        if (queue < __AR9170_NUM_TXQ) {
                 memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
                        param, sizeof(*param));
 
                 ret = ar9170_set_qos(ar);
-        } else
+        } else {
                 ret = -EINVAL;
+        }
 
         mutex_unlock(&ar->mutex);
         return ret;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 754b1f8d8da9..007eb85fc67e 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -598,11 +598,15 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
 
         err = request_firmware(&aru->init_values, "ar9170-1.fw",
                                &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
 
         err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
         if (err) {
                 release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
                 return err;
         }
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f6728..6dcac73b4d29 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -6226,7 +6226,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                         };
 
                         u8 channel;
-                        while (channel_index < IPW_SCAN_CHANNELS) {
+                        while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                 channel =
                                     priv->speed_scan[priv->speed_scan_pos];
                                 if (channel == 0) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index d6997371c27e..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,7 +1,6 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -44,21 +43,21 @@ static int get_common_rates(struct lbs_private *priv,
         u16 *rates_size)
 {
         u8 *card_rates = lbs_bg_rates;
+        size_t num_card_rates = sizeof(lbs_bg_rates);
         int ret = 0, i, j;
-        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
+        u8 tmp[30];
         size_t tmp_size = 0;
 
         /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
-                for (j = 0; j < *rates_size && rates[j]; j++) {
+        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
+                for (j = 0; rates[j] && (j < *rates_size); j++) {
                         if (rates[j] == card_rates[i])
                                 tmp[tmp_size++] = card_rates[i];
                 }
         }
 
         lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
-                        ARRAY_SIZE(lbs_bg_rates));
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
         lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
         lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
 
@@ -70,7 +69,10 @@ static int get_common_rates(struct lbs_private *priv,
                 lbs_pr_alert("Previously set fixed data rate %#x isn't "
                        "compatible with the network.\n", priv->cur_rate);
                 ret = -1;
+                goto done;
         }
+        ret = 0;
+
 done:
         memset(rates, 0, *rates_size);
         *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +322,7 @@ static int lbs_associate(struct lbs_private *priv,
         rates = (struct mrvl_ie_rates_param_set *) pos;
         rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
         memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
+        tmplen = MAX_RATES;
         if (get_common_rates(priv, rates->rates, &tmplen)) {
                 ret = -1;
                 goto done;
@@ -596,7 +598,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
 
         /* Copy Data rates from the rates recorded in scan response */
         memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
         memcpy(cmd.bss.rates, bss->rates, ratesize);
         if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                 lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 0a2e29140add..c8a1998d4744 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -56,8 +56,8 @@ struct rxpd {
                         u8 bss_type;
                         /* BSS number */
                         u8 bss_num;
-                } bss;
-        } u;
+                } __attribute__ ((packed)) bss;
+        } __attribute__ ((packed)) u;
 
         /* SNR */
         u8 snr;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a263d5c84c08..83967afe0821 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -261,7 +261,7 @@ struct mwl8k_vif {
          */
 };
 
-#define MWL8K_VIF(_vif) (struct mwl8k_vif *)(&((_vif)->drv_priv))
+#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 
 static const struct ieee80211_channel mwl8k_channels[] = {
         { .center_freq = 2412, .hw_value = 1, },
@@ -1012,6 +1012,8 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                 rmb();
 
                 skb = rxq->rx_skb[rxq->rx_head];
+                if (skb == NULL)
+                        break;
                 rxq->rx_skb[rxq->rx_head] = NULL;
 
                 rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
@@ -1591,6 +1593,9 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
         timeout = wait_for_completion_timeout(&cmd_wait,
                                 msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
 
+        pci_unmap_single(priv->pdev, dma_addr, dma_size,
+                                        PCI_DMA_BIDIRECTIONAL);
+
         result = &cmd->result;
         if (!timeout) {
                 spin_lock_irq(&priv->fw_lock);
@@ -1610,8 +1615,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                                *result);
         }
 
-        pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                        PCI_DMA_BIDIRECTIONAL);
         return rc;
 }
 
@@ -1654,18 +1657,18 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
         memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
         cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
         cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
-        cmd->num_tx_queues = MWL8K_TX_QUEUES;
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
-        cmd->num_tx_desc_per_queue = MWL8K_TX_DESCS;
-        cmd->total_rx_desc = MWL8K_RX_DESCS;
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
+        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
 
         if (!rc) {
                 SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                 priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
-                priv->fw_rev = cmd->fw_rev;
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                 priv->hw_rev = cmd->hw_rev;
                 priv->region_code = le16_to_cpu(cmd->region_code);
         }
@@ -3216,15 +3219,19 @@ static int mwl8k_configure_filter_wt(struct work_struct *wt)
         struct dev_addr_list *mclist = worker->mclist;
 
         struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mv_vif;
         int rc = 0;
 
         if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
                 if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
                         rc = mwl8k_cmd_set_pre_scan(hw);
                 else {
-                        mv_vif = MWL8K_VIF(priv->vif);
-                        rc = mwl8k_cmd_set_post_scan(hw, mv_vif->bssid);
+                        u8 *bssid;
+
+                        bssid = "\x00\x00\x00\x00\x00\x00";
+                        if (priv->vif != NULL)
+                                bssid = MWL8K_VIF(priv->vif)->bssid;
+
+                        rc = mwl8k_cmd_set_post_scan(hw, bssid);
                 }
         }
 
@@ -3726,6 +3733,8 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
 
         ieee80211_stop_queues(hw);
 
+        ieee80211_unregister_hw(hw);
+
         /* Remove tx reclaim tasklet */
         tasklet_kill(&priv->tx_reclaim_task);
 
@@ -3739,8 +3748,6 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 mwl8k_txq_reclaim(hw, i, 1);
 
-        ieee80211_unregister_hw(hw);
-
         for (i = 0; i < MWL8K_TX_QUEUES; i++)
                 mwl8k_txq_deinit(hw, i);
 
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a308..b3946272c72e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
         int err = 0;
         u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
 
-        if ((key < 0) || (key > 4))
+        if ((key < 0) || (key >= 4))
                 return -EINVAL;
 
         err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index a498dde024e1..49c9e2c1433d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -849,13 +849,15 @@ struct rt2x00_dev {
 static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev,
                                   const unsigned int word, u32 *data)
 {
-        *data = rt2x00dev->rf[word];
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        *data = rt2x00dev->rf[word - 1];
 }
 
 static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
                                    const unsigned int word, u32 data)
 {
-        rt2x00dev->rf[word] = data;
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        rt2x00dev->rf[word - 1] = data;
 }
 
 /*
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 294250e294dd..87a95588a8e3 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -869,6 +869,9 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
         priv->aifsn[3] = 3; /* AIFSN[AC_BE] */
         rtl818x_iowrite8(priv, &priv->map->ACM_CONTROL, 0);
 
+        /* ENEDCA flag must always be set, transmit issues? */
+        rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_ENEDCA);
+
         return 0;
 }
 
@@ -1173,13 +1176,16 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                         rtl818x_iowrite8(priv, &priv->map->BSSID[i],
                                          info->bssid[i]);
 
+                if (priv->is_rtl8187b)
+                        reg = RTL818X_MSR_ENEDCA;
+                else
+                        reg = 0;
+
                 if (is_valid_ether_addr(info->bssid)) {
-                        reg = RTL818X_MSR_INFRA;
-                        if (priv->is_rtl8187b)
-                                reg |= RTL818X_MSR_ENEDCA;
+                        reg |= RTL818X_MSR_INFRA;
                         rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                 } else {
-                        reg = RTL818X_MSR_NO_LINK;
+                        reg |= RTL818X_MSR_NO_LINK;
                         rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                 }