Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wirel...

diff --combined drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1,ba0fdba..bdff565
--- 1/drivers/net/wireless/iwlwifi/iwl-agn.c
--- 2/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@@ -31,7 -31,6 +31,7 @@@
  #include <linux/module.h>
  #include <linux/init.h>
  #include <linux/pci.h>
 +#include <linux/slab.h>
  #include <linux/dma-mapping.h>
  #include <linux/delay.h>
  #include <linux/sched.h>
@@@ -3331,6 -3330,7 +3331,7 @@@ static void iwl_cancel_deferred_work(st
  
        cancel_delayed_work_sync(&priv->init_alive_start);
        cancel_delayed_work(&priv->scan_check);
+       cancel_work_sync(&priv->start_internal_scan);
        cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->beacon_update);
        del_timer_sync(&priv->statistics_periodic);

diff --combined drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f70,1459cdb..049b652
--- 1/drivers/net/wireless/iwlwifi/iwl-core.c
--- 2/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@@ -30,7 -30,6 +30,7 @@@
  #include <linux/module.h>
  #include <linux/etherdevice.h>
  #include <linux/sched.h>
 +#include <linux/slab.h>
  #include <net/mac80211.h>
  
  #include "iwl-eeprom.h"
@@@ -3358,7 -3357,6 +3358,6 @@@ static void iwl_force_rf_reset(struct i
         */
        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
        iwl_internal_short_hw_scan(priv);
-       return;
  }
  
  

diff --combined drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e41,5062f4e..12e455a
--- 1/drivers/net/wireless/iwlwifi/iwl-scan.c
--- 2/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@@ -25,7 -25,6 +25,7 @@@
   *  Intel Linux Wireless <ilw@linux.intel.com>
   * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
   *****************************************************************************/
 +#include <linux/slab.h>
  #include <linux/types.h>
  #include <linux/etherdevice.h>
  #include <net/mac80211.h>
@@@ -470,6 -469,8 +470,8 @@@ EXPORT_SYMBOL(iwl_init_scan_params)
  
  static int iwl_scan_initiate(struct iwl_priv *priv)
  {
+       WARN_ON(!mutex_is_locked(&priv->mutex));
+ 
        IWL_DEBUG_INFO(priv, "Starting scan...\n");
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = false;
@@@ -547,24 -548,31 +549,31 @@@ EXPORT_SYMBOL(iwl_mac_hw_scan)
   * internal short scan, this function should only been called while associated.
   * It will reset and tune the radio to prevent possible RF related problem
   */
- int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+ void iwl_internal_short_hw_scan(struct iwl_priv *priv)
  {
-       int ret = 0;
+       queue_work(priv->workqueue, &priv->start_internal_scan);
+ }
+ 
+ static void iwl_bg_start_internal_scan(struct work_struct *work)
+ {
+       struct iwl_priv *priv =
+               container_of(work, struct iwl_priv, start_internal_scan);
+ 
+       mutex_lock(&priv->mutex);
  
        if (!iwl_is_ready_rf(priv)) {
-               ret = -EIO;
                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-               goto out;
+               goto unlock;
        }
+ 
        if (test_bit(STATUS_SCANNING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-               ret = -EAGAIN;
-               goto out;
+               goto unlock;
        }
+ 
        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-               ret = -EAGAIN;
-               goto out;
+               goto unlock;
        }
  
        priv->scan_bands = 0;
@@@ -577,9 -585,8 +586,8 @@@
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = true;
        queue_work(priv->workqueue, &priv->request_scan);
- 
- out:
-       return ret;
+  unlock:
+       mutex_unlock(&priv->mutex);
  }
  EXPORT_SYMBOL(iwl_internal_short_hw_scan);
  
@@@ -965,6 -972,7 +973,7 @@@ void iwl_setup_scan_deferred_work(struc
        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
        INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
        INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+       INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
        INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
  }
  EXPORT_SYMBOL(iwl_setup_scan_deferred_work);

diff --combined net/mac80211/agg-tx.c
index 96d2534,944a8a9..87782a4
--- 1/net/mac80211/agg-tx.c
--- 2/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@@ -14,7 -14,6 +14,7 @@@
   */
  
  #include <linux/ieee80211.h>
 +#include <linux/slab.h>
  #include <net/mac80211.h>
  #include "ieee80211_i.h"
  #include "driver-ops.h"
@@@ -184,7 -183,6 +184,6 @@@ static void sta_addba_resp_timer_expire
                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                HT_ADDBA_REQUESTED_MSK) {
                spin_unlock_bh(&sta->lock);
-               *state = HT_AGG_STATE_IDLE;
  #ifdef CONFIG_MAC80211_HT_DEBUG
                printk(KERN_DEBUG "timer expired on tid %d but we are not "
                                "(or no longer) expecting addBA response there",

diff --combined net/mac80211/mlme.c
index c8cd169,8a96503..4aefa6d
--- 1/net/mac80211/mlme.c
--- 2/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@@ -19,7 -19,6 +19,7 @@@
  #include <linux/rtnetlink.h>
  #include <linux/pm_qos_params.h>
  #include <linux/crc32.h>
 +#include <linux/slab.h>
  #include <net/mac80211.h>
  #include <asm/unaligned.h>
  
@@@ -168,6 -167,8 +168,8 @@@ static u32 ieee80211_enable_ht(struct i
        ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
                     channel_type != local->hw.conf.channel_type;
  
+       if (local->tmp_channel)
+               local->tmp_channel_type = channel_type;
        local->oper_channel_type = channel_type;
  
        if (ht_changed) {