22 files changed, 117 insertions, 60 deletions

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5c1bc995e560..f10221f40803 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -123,7 +123,7 @@ static void ipoib_ud_skb_put_frags(struct ipoib_dev_priv *priv,
 
                 skb_frag_size_set(frag, size);
                 skb->data_len += size;
-                skb->truesize += size;
+                skb->truesize += PAGE_SIZE;
         } else
                 skb_put(skb, length);
 
@@ -156,14 +156,18 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct sk_buff *skb;
         int buf_size;
+        int tailroom;
         u64 *mapping;
 
-        if (ipoib_ud_need_sg(priv->max_ib_mtu))
+        if (ipoib_ud_need_sg(priv->max_ib_mtu)) {
                 buf_size = IPOIB_UD_HEAD_SIZE;
-        else
+                tailroom = 128; /* reserve some tailroom for IP/TCP headers */
+        } else {
                 buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
+                tailroom = 0;
+        }
 
-        skb = dev_alloc_skb(buf_size + 4);
+        skb = dev_alloc_skb(buf_size + tailroom + 4);
         if (unlikely(!skb))
                 return NULL;
 
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 1a0ae4445ff2..5f21f629b7ae 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -135,8 +135,8 @@ send_layer2(struct mISDNstack *st, struct sk_buff *skb)
                         skb = NULL;
                 else if (*debug & DEBUG_SEND_ERR)
                         printk(KERN_DEBUG
-                               "%s ch%d mgr prim(%x) addr(%x) err %d\n",
-                               __func__, ch->nr, hh->prim, ch->addr, ret);
+                               "%s mgr prim(%x) err %d\n",
+                               __func__, hh->prim, ret);
         }
 out:
         mutex_unlock(&st->lmutex);
diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
index 3680aa251dea..2cf084eb9d52 100644
--- a/drivers/net/bonding/bond_debugfs.c
+++ b/drivers/net/bonding/bond_debugfs.c
@@ -6,7 +6,7 @@
 #include "bonding.h"
 #include "bond_alb.h"
 
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) && !defined(CONFIG_NET_NS)
 
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b9c2ae62166d..2ee76993f052 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3227,6 +3227,12 @@ static int bond_master_netdev_event(unsigned long event,
         switch (event) {
         case NETDEV_CHANGENAME:
                 return bond_event_changename(event_bond);
+        case NETDEV_UNREGISTER:
+                bond_remove_proc_entry(event_bond);
+                break;
+        case NETDEV_REGISTER:
+                bond_create_proc_entry(event_bond);
+                break;
         default:
                 break;
         }
@@ -4411,8 +4417,6 @@ static void bond_uninit(struct net_device *bond_dev)
 
         bond_work_cancel_all(bond);
 
-        bond_remove_proc_entry(bond);
-
         bond_debug_unregister(bond);
 
         __hw_addr_flush(&bond->mc_list);
@@ -4814,7 +4818,6 @@ static int bond_init(struct net_device *bond_dev)
 
         bond_set_lockdep_class(bond_dev);
 
-        bond_create_proc_entry(bond);
         list_add_tail(&bond->bond_list, &bn->dev_list);
 
         bond_prepare_sysfs_group(bond);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 9cc15701101b..1f78b63d5efe 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -261,7 +261,6 @@ static void atl1c_check_link_status(struct atl1c_adapter *adapter)
         if ((phy_data & BMSR_LSTATUS) == 0) {
                 /* link down */
                 netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                 hw->hibernate = true;
                 if (atl1c_reset_mac(hw) != 0)
                         if (netif_msg_hw(adapter))
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 46b8b7d81633..d09c6b583d17 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -656,7 +656,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                         dma_unmap_single(bp->sdev->dma_dev, mapping,
                                              RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
                 dev_kfree_skb_any(skb);
-                skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
+                skb = alloc_skb(RX_PKT_BUF_SZ, GFP_ATOMIC | GFP_DMA);
                 if (skb == NULL)
                         return -ENOMEM;
                 mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
@@ -967,7 +967,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         dma_unmap_single(bp->sdev->dma_dev, mapping, len,
                                              DMA_TO_DEVICE);
 
-                bounce_skb = __netdev_alloc_skb(dev, len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb)
                         goto err_out;
 
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index ac7b74488531..1fa4927a45b1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -5372,7 +5372,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                         int k, last;
 
                         if (skb == NULL) {
-                                j++;
+                                j = NEXT_TX_BD(j);
                                 continue;
                         }
 
@@ -5384,8 +5384,8 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                         tx_buf->skb = NULL;
 
                         last = tx_buf->nr_frags;
-                        j++;
-                        for (k = 0; k < last; k++, j++) {
+                        j = NEXT_TX_BD(j);
+                        for (k = 0; k < last; k++, j = NEXT_TX_BD(j)) {
                                 tx_buf = &txr->tx_buf_ring[TX_RING_IDX(j)];
                                 dma_unmap_page(&bp->pdev->dev,
                                         dma_unmap_addr(tx_buf, mapping),
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index c95e7b5e2b85..2c89d17cbb29 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -534,7 +534,8 @@ int cnic_unregister_driver(int ulp_type)
         }
 
         if (atomic_read(&ulp_ops->ref_count) != 0)
-                netdev_warn(dev->netdev, "Failed waiting for ref count to go to zero\n");
+                pr_warn("%s: Failed waiting for ref count to go to zero\n",
+                        __func__);
         return 0;
 
 out_unlock:
@@ -1053,12 +1054,13 @@ static int cnic_init_uio(struct cnic_dev *dev)
 
         uinfo = &udev->cnic_uinfo;
 
-        uinfo->mem[0].addr = dev->netdev->base_addr;
+        uinfo->mem[0].addr = pci_resource_start(dev->pcidev, 0);
         uinfo->mem[0].internal_addr = dev->regview;
-        uinfo->mem[0].size = dev->netdev->mem_end - dev->netdev->mem_start;
         uinfo->mem[0].memtype = UIO_MEM_PHYS;
 
         if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
+                                                     TX_MAX_TSS_RINGS + 1);
                 uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
                                         PAGE_MASK;
                 if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
@@ -1068,6 +1070,8 @@ static int cnic_init_uio(struct cnic_dev *dev)
 
                 uinfo->name = "bnx2_cnic";
         } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
+
                 uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
                         PAGE_MASK;
                 uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index f2db8fca46a1..ab1d80ff0791 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2063,10 +2063,9 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                         return NETDEV_TX_OK;
                 }
 
-                /* Steal sock reference for processing TX time stamps */
-                swap(skb_new->sk, skb->sk);
-                swap(skb_new->destructor, skb->destructor);
-                kfree_skb(skb);
+                if (skb->sk)
+                        skb_set_owner_w(skb_new, skb->sk);
+                consume_skb(skb);
                 skb = skb_new;
         }
 
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 36db4df09aed..1f063dcd8f85 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -1572,6 +1572,9 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
         ctrl = er32(CTRL);
         status = er32(STATUS);
         rxcw = er32(RXCW);
+        /* SYNCH bit and IV bit are sticky */
+        udelay(10);
+        rxcw = er32(RXCW);
 
         if ((rxcw & E1000_RXCW_SYNCH) && !(rxcw & E1000_RXCW_IV)) {
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 238ab2f8a5e7..e3a7b07df629 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -325,24 +325,46 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
  **/
 static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
-        u16 phy_reg;
-        u32 phy_id;
+        u16 phy_reg = 0;
+        u32 phy_id = 0;
+        s32 ret_val;
+        u16 retry_count;
+
+        for (retry_count = 0; retry_count < 2; retry_count++) {
+                ret_val = e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF))
+                        continue;
+                phy_id = (u32)(phy_reg << 16);
 
-        e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
-        phy_id = (u32)(phy_reg << 16);
-        e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
-        phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                ret_val = e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF)) {
+                        phy_id = 0;
+                        continue;
+                }
+                phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                break;
+        }
 
         if (hw->phy.id) {
                 if (hw->phy.id == phy_id)
                         return true;
-        } else {
-                if ((phy_id != 0) && (phy_id != PHY_REVISION_MASK))
-                        hw->phy.id = phy_id;
+        } else if (phy_id) {
+                hw->phy.id = phy_id;
+                hw->phy.revision = (u32)(phy_reg & ~PHY_REVISION_MASK);
                 return true;
         }
 
-        return false;
+        /*
+         * In case the PHY needs to be in mdio slow mode,
+         * set slow mode and try to get the PHY id again.
+         */
+        hw->phy.ops.release(hw);
+        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+        if (!ret_val)
+                ret_val = e1000e_get_phy_id(hw);
+        hw->phy.ops.acquire(hw);
+
+        return !ret_val;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 18ca3bcadf0c..e242104ab471 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6647,6 +6647,11 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
                 return -EINVAL;
         }
 
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                e_err(drv, "Enable failed, SR-IOV enabled\n");
+                return -EINVAL;
+        }
+
         /* Hardware supports up to 8 traffic classes */
         if (tc > adapter->dcb_cfg.num_tcs.pg_tcs ||
             (hw->mac.type == ixgbe_mac_82598EB &&
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index f69ec4288b10..41e32257a4e8 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -201,6 +201,9 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
         unsigned int i, eop, count = 0;
         unsigned int total_bytes = 0, total_packets = 0;
 
+        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
+                return true;
+
         i = tx_ring->next_to_clean;
         eop = tx_ring->tx_buffer_info[i].next_to_watch;
         eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
@@ -969,8 +972,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
         r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
         for (i = 0; i < q_vector->txr_count; i++) {
                 tx_ring = &(adapter->tx_ring[r_idx]);
-                tx_ring->total_bytes = 0;
-                tx_ring->total_packets = 0;
                 ixgbevf_clean_tx_irq(adapter, tx_ring);
                 r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
                                       r_idx + 1);
@@ -994,16 +995,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
         struct ixgbe_hw *hw = &adapter->hw;
         struct ixgbevf_ring  *rx_ring;
         int r_idx;
-        int i;
-
-        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        for (i = 0; i < q_vector->rxr_count; i++) {
-                rx_ring = &(adapter->rx_ring[r_idx]);
-                rx_ring->total_bytes = 0;
-                rx_ring->total_packets = 0;
-                r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
-        }
 
         if (!q_vector->rxr_count)
                 return IRQ_HANDLED;
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index fb8377da1687..4b785e10f2ed 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -51,7 +51,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 1, bmax,
                                                 csum);
-
+                wmb();
                 entry = (++priv->cur_tx) % txsize;
                 desc = priv->dma_tx + entry;
 
@@ -59,6 +59,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                             len, DMA_TO_DEVICE);
                 desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum);
+                wmb();
                 priv->hw->desc->set_tx_owner(desc);
                 priv->tx_skbuff[entry] = NULL;
         } else {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 51b3b68528ee..ea3003edde18 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1212,6 +1212,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 priv->hw->desc->prepare_tx_desc(desc, 0, len, csum_insertion);
                 wmb();
                 priv->hw->desc->set_tx_owner(desc);
+                wmb();
         }
 
         /* Interrupt on completition only for the latest segment */
@@ -1227,6 +1228,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* To avoid raise condition */
         priv->hw->desc->set_tx_owner(first);
+        wmb();
 
         priv->cur_tx++;
 
@@ -1290,6 +1292,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                 }
                 wmb();
                 priv->hw->desc->set_rx_owner(p + entry);
+                wmb();
         }
 }
 
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 39ea0674dcde..5c120189ec86 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -46,7 +46,13 @@ static int mdio_mux_read(struct mii_bus *bus, int phy_id, int regnum)
         struct mdio_mux_parent_bus *pb = cb->parent;
         int r;
 
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        /* In theory multiple mdio_mux could be stacked, thus creating
+         * more than a single level of nesting.  But in practice,
+         * SINGLE_DEPTH_NESTING will cover the vast majority of use
+         * cases.  We use it, instead of trying to handle the general
+         * case.
+         */
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
         r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
         if (r)
                 goto out;
@@ -71,7 +77,7 @@ static int mdio_mux_write(struct mii_bus *bus, int phy_id,
 
         int r;
 
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
         r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
         if (r)
                 goto out;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b01960fcfbc9..a051cedd64bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -346,6 +346,15 @@ static const struct driver_info	qmi_wwan_force_int1 = {
         .data           = BIT(1), /* interface whitelist bitmap */
 };
 
+static const struct driver_info qmi_wwan_force_int2 = {
+        .description    = "Qualcomm WWAN/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_shared,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(2), /* interface whitelist bitmap */
+};
+
 static const struct driver_info qmi_wwan_force_int3 = {
         .description    = "Qualcomm WWAN/QMI device",
         .flags          = FLAG_WWAN,
@@ -498,6 +507,15 @@ static const struct usb_device_id products[] = {
                 .bInterfaceProtocol = 0xff,
                 .driver_info        = (unsigned long)&qmi_wwan_force_int4,
         },
+        {       /* ZTE MF60 */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1402,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int2,
+        },
         {       /* Sierra Wireless MC77xx in QMI mode */
                 .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
                 .idVendor           = 0x1199,
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index f1f8bd09bd87..c8baf020c20f 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1072,7 +1072,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
         meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
         /* create a bounce buffer in zone_dma on mapping failure. */
         if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                 if (!bounce_skb) {
                         ring->current_slot = old_top_slot;
                         ring->used_slots = old_used_slots;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..ff5d689e13f3 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -3405,7 +3405,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
                 return 0;
         }
 
-        if (il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
                 IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
                         key_flags);
                 spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -3420,7 +3420,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
         memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
         il->stations[sta_id].sta.key.key_flags =
             STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        il->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
         il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
         il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index cbf2dc18341f..5d4807c2b56d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4767,14 +4767,12 @@ il_bg_watchdog(unsigned long data)
                 return;
 
         /* monitor and check for other stuck queues */
-        if (il_is_any_associated(il)) {
-                for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
-                        /* skip as we already checked the command queue */
-                        if (cnt == il->cmd_queue)
-                                continue;
-                        if (il_check_stuck_queue(il, cnt))
-                                return;
-                }
+        for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
+                /* skip as we already checked the command queue */
+                if (cnt == il->cmd_queue)
+                        continue;
+                if (il_check_stuck_queue(il, cnt))
+                        return;
         }
 
         mod_timer(&il->watchdog,
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ce61b6fae1c9..5c7fd185373c 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -958,6 +958,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
         case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
                 /* firmware doesn't support this type of hidden SSID */
         default:
+                kfree(bss_cfg);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index d357d1ed92f6..74ecc33fdd90 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -436,8 +436,8 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
         case QID_RX:
                 if (!rt2x00queue_full(queue))
                         rt2x00queue_for_each_entry(queue,
-                                                   Q_INDEX_DONE,
                                                    Q_INDEX,
+                                                   Q_INDEX_DONE,
                                                    NULL,
                                                    rt2x00usb_kick_rx_entry);
                 break;