14 files changed, 106 insertions, 95 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index cb429e783749..849ac88bcccc 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -35,6 +35,7 @@
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/bitops.h>
+#include <linux/scatterlist.h>
 #include <asm/io.h>
 #include <asm/system.h>
 
@@ -1590,11 +1591,9 @@ static void emmh32_setseed(emmh32_context *context, u8 *pkey, int keylen, struct
                 aes_counter[12] = (u8)(counter >> 24);
                 counter++;
                 memcpy (plain, aes_counter, 16);
-                sg[0].page = virt_to_page(plain);
-                sg[0].offset = ((long) plain & ~PAGE_MASK);
-                sg[0].length = 16;
+                sg_set_buf(sg, plain, 16);
                 crypto_cipher_encrypt(tfm, sg, sg, 16);
-                cipher = kmap(sg[0].page) + sg[0].offset;
+                cipher = kmap(sg->page) + sg->offset;
                 for (j=0; (j<16) && (i< (sizeof(context->coeff)/sizeof(context->coeff[0]))); ) {
                         context->coeff[i++] = ntohl(*(u32 *)&cipher[j]);
                         j += 4;
@@ -2041,7 +2040,7 @@ static int mpi_send_packet (struct net_device *dev)
         return 1;
 }
 
-static void get_tx_error(struct airo_info *ai, u32 fid)
+static void get_tx_error(struct airo_info *ai, s32 fid)
 {
         u16 status;
 
@@ -2381,14 +2380,10 @@ void stop_airo_card( struct net_device *dev, int freeres )
                         dev_kfree_skb(skb);
         }
 
-        if (ai->flash)
-                kfree(ai->flash);
-        if (ai->rssi)
-                kfree(ai->rssi);
-        if (ai->APList)
-                kfree(ai->APList);
-        if (ai->SSID)
-                kfree(ai->SSID);
+        kfree(ai->flash);
+        kfree(ai->rssi);
+        kfree(ai->APList);
+        kfree(ai->SSID);
         if (freeres) {
                 /* PCMCIA frees this stuff, so only for PCI and ISA */
                 release_region( dev->base_addr, 64 );
@@ -3626,10 +3621,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
         int rc;
 
         memset( &mySsid, 0, sizeof( mySsid ) );
-        if (ai->flash) {
-                kfree (ai->flash);
-                ai->flash = NULL;
-        }
+        kfree (ai->flash);
+        ai->flash = NULL;
 
         /* The NOP is the first step in getting the card going */
         cmd.cmd = NOP;
@@ -3666,14 +3659,10 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
                 tdsRssiRid rssi_rid;
                 CapabilityRid cap_rid;
 
-                if (ai->APList) {
-                        kfree(ai->APList);
-                        ai->APList = NULL;
-                }
-                if (ai->SSID) {
-                        kfree(ai->SSID);
-                        ai->SSID = NULL;
-                }
+                kfree(ai->APList);
+                ai->APList = NULL;
+                kfree(ai->SSID);
+                ai->SSID = NULL;
                 // general configuration (read/modify/write)
                 status = readConfigRid(ai, lock);
                 if ( status != SUCCESS ) return ERROR;
@@ -3687,10 +3676,8 @@ static u16 setup_card(struct airo_info *ai, u8 *mac, int lock)
                                 memcpy(ai->rssi, (u8*)&rssi_rid + 2, 512); /* Skip RID length member */
                 }
                 else {
-                        if (ai->rssi) {
-                                kfree(ai->rssi);
-                                ai->rssi = NULL;
-                        }
+                        kfree(ai->rssi);
+                        ai->rssi = NULL;
                         if (cap_rid.softCap & 8)
                                 ai->config.rmode |= RXMODE_NORMALIZED_RSSI;
                         else
@@ -5369,11 +5356,13 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) {
 
 static int proc_close( struct inode *inode, struct file *file )
 {
-        struct proc_data *data = (struct proc_data *)file->private_data;
-        if ( data->on_close != NULL ) data->on_close( inode, file );
-        if ( data->rbuffer ) kfree( data->rbuffer );
-        if ( data->wbuffer ) kfree( data->wbuffer );
-        kfree( data );
+        struct proc_data *data = file->private_data;
+
+        if (data->on_close != NULL)
+                data->on_close(inode, file);
+        kfree(data->rbuffer);
+        kfree(data->wbuffer);
+        kfree(data);
         return 0;
 }
 
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index bf25584d68d3..784de9109113 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -258,9 +258,7 @@ static void airo_detach(dev_link_t *link)
         
         /* Unlink device structure, free pieces */
         *linkp = link->next;
-        if (link->priv) {
-                kfree(link->priv);
-        }
+        kfree(link->priv);
         kfree(link);
         
 } /* airo_detach */
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index d57011028b72..1fbe027d26b6 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1653,8 +1653,7 @@ void stop_atmel_card(struct net_device *dev, int freeres)
         unregister_netdev(dev);
         remove_proc_entry("driver/atmel", NULL);
         free_irq(dev->irq, dev);
-        if (priv->firmware)
-                kfree(priv->firmware);
+        kfree(priv->firmware);
         if (freeres) {
                 /* PCMCIA frees this stuff, so only for PCI */
                 release_region(dev->base_addr, 64);
@@ -2450,8 +2449,7 @@ static int atmel_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                         break;
                 }
 
-                if (priv->firmware)
-                        kfree(priv->firmware);
+                kfree(priv->firmware);
                 
                 priv->firmware = new_firmware;
                 priv->firmware_length = com.len;
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index ff031a3985b3..195cb36619e8 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -259,8 +259,7 @@ static void atmel_detach(dev_link_t *link)
 
         /* Unlink device structure, free pieces */
         *linkp = link->next;
-        if (link->priv)
-                kfree(link->priv);
+        kfree(link->priv);
         kfree(link);
 }
 
diff --git a/drivers/net/wireless/hermes.c b/drivers/net/wireless/hermes.c
index eba0d9d2b7c5..579480dad374 100644
--- a/drivers/net/wireless/hermes.c
+++ b/drivers/net/wireless/hermes.c
@@ -444,6 +444,43 @@ int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,
         return err;
 }
 
+/* Write a block of data to the chip's buffer with padding if
+ * neccessary, via the BAP. Synchronization/serialization is the
+ * caller's problem. len must be even.
+ *
+ * Returns: < 0 on internal failure (errno), 0 on success, > 0 on error from firmware
+ */
+int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf, unsigned data_len, unsigned len,
+                      u16 id, u16 offset)
+{
+        int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
+        int err = 0;
+
+        if (len < 0 || len % 2 || data_len > len)
+                return -EINVAL;
+
+        err = hermes_bap_seek(hw, bap, id, offset);
+        if (err)
+                goto out;
+
+        /* Transfer all the complete words of data */
+        hermes_write_words(hw, dreg, buf, data_len/2);
+        /* If there is an odd byte left over pad and transfer it */
+        if (data_len & 1) {
+                u8 end[2];
+                end[1] = 0;
+                end[0] = ((unsigned char *)buf)[data_len - 1];
+                hermes_write_words(hw, dreg, end, 1);
+                data_len ++;
+        }
+        /* Now send zeros for the padding */
+        if (data_len < len)
+                hermes_clear_words(hw, dreg, (len - data_len) / 2);
+        /* Complete */
+ out:
+        return err;
+}
+
 /* Read a Length-Type-Value record from the card.
  *
  * If length is NULL, we ignore the length read from the card, and
@@ -531,6 +568,7 @@ EXPORT_SYMBOL(hermes_allocate);
 
 EXPORT_SYMBOL(hermes_bap_pread);
 EXPORT_SYMBOL(hermes_bap_pwrite);
+EXPORT_SYMBOL(hermes_bap_pwrite_pad);
 EXPORT_SYMBOL(hermes_read_ltv);
 EXPORT_SYMBOL(hermes_write_ltv);
 
diff --git a/drivers/net/wireless/hermes.h b/drivers/net/wireless/hermes.h
index ad28e3294360..a6bd472d75d4 100644
--- a/drivers/net/wireless/hermes.h
+++ b/drivers/net/wireless/hermes.h
@@ -376,6 +376,8 @@ int hermes_bap_pread(hermes_t *hw, int bap, void *buf, unsigned len,
                        u16 id, u16 offset);
 int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, unsigned len,
                         u16 id, u16 offset);
+int hermes_bap_pwrite_pad(hermes_t *hw, int bap, const void *buf,
+                        unsigned data_len, unsigned len, u16 id, u16 offset);
 int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
                     u16 *length, void *buf);
 int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 53f5246c40aa..2617d70bcda9 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -552,7 +552,6 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
 
         kfree(addr);
         kfree(qual);
-
         return 0;
 }
 
@@ -3081,9 +3080,7 @@ static int prism2_ioctl_priv_download(local_info_t *local, struct iw_point *p)
         ret = local->func->download(local, param);
 
  out:
-        if (param != NULL)
-                kfree(param);
-
+        kfree(param);
         return ret;
 }
 #endif /* PRISM2_DOWNLOAD_SUPPORT */
@@ -3890,9 +3887,7 @@ static int prism2_ioctl_priv_hostapd(local_info_t *local, struct iw_point *p)
         }
 
  out:
-        if (param != NULL)
-                kfree(param);
-
+        kfree(param);
         return ret;
 }
 
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index de4e6c23e4b8..3db0c32afe82 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -4030,6 +4030,10 @@ static struct ipw_rx_queue *ipw_rx_queue_alloc(struct ipw_priv *priv)
         int i;
 
         rxq = (struct ipw_rx_queue *)kmalloc(sizeof(*rxq), GFP_KERNEL);
+        if (unlikely(!rxq)) {
+                IPW_ERROR("memory allocation failed\n");
+                return NULL;
+        }
         memset(rxq, 0, sizeof(*rxq));
         spin_lock_init(&rxq->lock);
         INIT_LIST_HEAD(&rxq->rx_free);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index d3d4ec9e242e..488ab06fb79f 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -490,7 +490,8 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 return 0;
         }
 
-        /* Check packet length, pad short packets, round up odd length */
+        /* Length of the packet body */
+        /* FIXME: what if the skb is smaller than this? */
         len = max_t(int, ALIGN(skb->len, 2), ETH_ZLEN);
         skb = skb_padto(skb, len);
         if (skb == NULL)
@@ -541,13 +542,21 @@ static int orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                         stats->tx_errors++;
                         goto fail;
                 }
+                /* Actual xfer length - allow for padding */
+                len = ALIGN(data_len, 2);
+                if (len < ETH_ZLEN - ETH_HLEN)
+                        len = ETH_ZLEN - ETH_HLEN;
         } else { /* IEEE 802.3 frame */
                 data_len = len + ETH_HLEN;
                 data_off = HERMES_802_3_OFFSET;
                 p = skb->data;
+                /* Actual xfer length - round up for odd length packets */
+                len = ALIGN(data_len, 2);
+                if (len < ETH_ZLEN)
+                        len = ETH_ZLEN;
         }
 
-        err = hermes_bap_pwrite(hw, USER_BAP, p, data_len,
+        err = hermes_bap_pwrite_pad(hw, USER_BAP, p, data_len, len,
                                 txfid, data_off);
         if (err) {
                 printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index 6c9584a9f284..78bdb359835e 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -754,8 +754,7 @@ islpci_free_memory(islpci_private *priv)
                         pci_unmap_single(priv->pdev, buf->pci_addr,
                                          buf->size, PCI_DMA_FROMDEVICE);
                 buf->pci_addr = 0;
-                if (buf->mem)
-                        kfree(buf->mem);
+                kfree(buf->mem);
                 buf->size = 0;
                 buf->mem = NULL;
         }
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 5952e9960499..3b49efa37ee5 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -97,12 +97,6 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
         /* lock the driver code */
         spin_lock_irqsave(&priv->slock, flags);
 
-        /* determine the amount of fragments needed to store the frame */
-
-        frame_size = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
-        if (init_wds)
-                frame_size += 6;
-
         /* check whether the destination queue has enough fragments for the frame */
         curr_frag = le32_to_cpu(cb->driver_curr_frag[ISL38XX_CB_TX_DATA_LQ]);
         if (unlikely(curr_frag - priv->free_data_tx >= ISL38XX_CB_TX_QSIZE)) {
@@ -213,6 +207,7 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
         /* store the skb address for future freeing  */
         priv->data_low_tx[index] = skb;
         /* set the proper fragment start address and size information */
+        frame_size = skb->len;
         fragment->size = cpu_to_le16(frame_size);
         fragment->flags = cpu_to_le16(0);       /* set to 1 if more fragments */
         fragment->address = cpu_to_le32(pci_map_address);
@@ -246,12 +241,10 @@ islpci_eth_transmit(struct sk_buff *skb, struct net_device *ndev)
         return 0;
 
       drop_free:
-        /* free the skbuf structure before aborting */
-        dev_kfree_skb(skb);
-        skb = NULL;
-
         priv->statistics.tx_dropped++;
         spin_unlock_irqrestore(&priv->slock, flags);
+        dev_kfree_skb(skb);
+        skb = NULL;
         return err;
 }
 
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index 4937a5ad4b2c..6a60c5970cb5 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -137,7 +137,7 @@ islpci_mgmt_rx_fill(struct net_device *ndev)
                                                        PCI_DMA_FROMDEVICE);
                         if (!buf->pci_addr) {
                                 printk(KERN_WARNING
-                                       "Failed to make memory DMA'able\n.");
+                                       "Failed to make memory DMA'able.\n");
                                 return -ENOMEM;
                         }
                 }
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index 12123e24b113..eea2f04c8c6d 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -268,11 +268,10 @@ mgt_clean(islpci_private *priv)
 
         if (!priv->mib)
                 return;
-        for (i = 0; i < OID_NUM_LAST; i++)
-                if (priv->mib[i]) {
-                        kfree(priv->mib[i]);
-                        priv->mib[i] = NULL;
-                }
+        for (i = 0; i < OID_NUM_LAST; i++) {
+                kfree(priv->mib[i]);
+                priv->mib[i] = NULL;
+        }
         kfree(priv->mib);
         priv->mib = NULL;
 }
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 7bc7fc823128..d25264ba0c0e 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -860,12 +860,9 @@ static int allocate_buffers(struct strip *strip_info, int mtu)
                 strip_info->mtu = dev->mtu = mtu;
                 return (1);
         }
-        if (r)
-                kfree(r);
-        if (s)
-                kfree(s);
-        if (t)
-                kfree(t);
+        kfree(r);
+        kfree(s);
+        kfree(t);
         return (0);
 }
 
@@ -922,13 +919,9 @@ static int strip_change_mtu(struct net_device *dev, int new_mtu)
         printk(KERN_NOTICE "%s: strip MTU changed fom %d to %d.\n",
                strip_info->dev->name, old_mtu, strip_info->mtu);
 
-        if (orbuff)
-                kfree(orbuff);
-        if (osbuff)
-                kfree(osbuff);
-        if (otbuff)
-                kfree(otbuff);
-
+        kfree(orbuff);
+        kfree(osbuff);
+        kfree(otbuff);
         return 0;
 }
 
@@ -2498,18 +2491,13 @@ static int strip_close_low(struct net_device *dev)
         /*
          * Free all STRIP frame buffers.
          */
-        if (strip_info->rx_buff) {
-                kfree(strip_info->rx_buff);
-                strip_info->rx_buff = NULL;
-        }
-        if (strip_info->sx_buff) {
-                kfree(strip_info->sx_buff);
-                strip_info->sx_buff = NULL;
-        }
-        if (strip_info->tx_buff) {
-                kfree(strip_info->tx_buff);
-                strip_info->tx_buff = NULL;
-        }
+        kfree(strip_info->rx_buff);
+        strip_info->rx_buff = NULL;
+        kfree(strip_info->sx_buff);
+        strip_info->sx_buff = NULL;
+        kfree(strip_info->tx_buff);
+        strip_info->tx_buff = NULL;
+
         del_timer(&strip_info->idle_timer);
         return 0;
 }