diff --git a/[refs] b/[refs]
index c9d41f676559..80a1684e7633 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e734207fee61a76645ea3b3348180226ee4bc54e
+refs/heads/master: 476e44cb19f1fbf2d5883dddcc0ce31b33b45915
diff --git a/trunk/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/trunk/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index fa4d1b8cd9f6..ff8162d4c454 100644
--- a/trunk/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/trunk/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -521,7 +521,7 @@ static void iwlagn_mac_tx(struct ieee80211_hw *hw,
 		     ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
 
 	if (iwlagn_tx_skb(priv, control->sta, skb))
-		ieee80211_free_txskb(hw, skb);
+		dev_kfree_skb_any(skb);
 }
 
 static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
diff --git a/trunk/drivers/net/wireless/iwlwifi/dvm/main.c b/trunk/drivers/net/wireless/iwlwifi/dvm/main.c
index 408132cf83c1..7ff3f1430678 100644
--- a/trunk/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/trunk/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -2114,7 +2114,7 @@ static void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
 
 	info = IEEE80211_SKB_CB(skb);
 	iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
-	ieee80211_free_txskb(priv->hw, skb);
+	dev_kfree_skb_any(skb);
 }
 
 static void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
diff --git a/trunk/drivers/net/wireless/iwlwifi/pcie/rx.c b/trunk/drivers/net/wireless/iwlwifi/pcie/rx.c
index bb69f8f90b3b..17c8e5d82681 100644
--- a/trunk/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/trunk/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -321,14 +321,6 @@ static void iwl_rx_allocate(struct iwl_trans *trans, gfp_t priority)
 			dma_map_page(trans->dev, page, 0,
 				     PAGE_SIZE << trans_pcie->rx_page_order,
 				     DMA_FROM_DEVICE);
-		if (dma_mapping_error(trans->dev, rxb->page_dma)) {
-			rxb->page = NULL;
-			spin_lock_irqsave(&rxq->lock, flags);
-			list_add(&rxb->list, &rxq->rx_used);
-			spin_unlock_irqrestore(&rxq->lock, flags);
-			__free_pages(page, trans_pcie->rx_page_order);
-			return;
-		}
 		/* dma address must be no more than 36 bits */
 		BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
 		/* and also 256 byte aligned! */
@@ -496,19 +488,8 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
 			dma_map_page(trans->dev, rxb->page, 0,
 				     PAGE_SIZE << trans_pcie->rx_page_order,
 				     DMA_FROM_DEVICE);
-		if (dma_mapping_error(trans->dev, rxb->page_dma)) {
-			/*
-			 * free the page(s) as well to not break
-			 * the invariant that the items on the used
-			 * list have no page(s)
-			 */
-			__free_pages(rxb->page, trans_pcie->rx_page_order);
-			rxb->page = NULL;
-			list_add_tail(&rxb->list, &rxq->rx_used);
-		} else {
-			list_add_tail(&rxb->list, &rxq->rx_free);
-			rxq->free_count++;
-		}
+		list_add_tail(&rxb->list, &rxq->rx_free);
+		rxq->free_count++;
 	} else
 		list_add_tail(&rxb->list, &rxq->rx_used);
 	spin_unlock_irqrestore(&rxq->lock, flags);
diff --git a/trunk/net/bluetooth/mgmt.c b/trunk/net/bluetooth/mgmt.c
index aa2ea0a8142c..2cfabe27d3e0 100644
--- a/trunk/net/bluetooth/mgmt.c
+++ b/trunk/net/bluetooth/mgmt.c
@@ -326,7 +326,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 	struct hci_dev *d;
 	size_t rp_len;
 	u16 count;
-	int i, err;
+	int err;
 
 	BT_DBG("sock %p", sk);
 
@@ -347,9 +347,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 		return -ENOMEM;
 	}
 
-	rp->num_controllers = cpu_to_le16(count);
-
-	i = 0;
+	count = 0;
 	list_for_each_entry(d, &hci_dev_list, list) {
 		if (test_bit(HCI_SETUP, &d->dev_flags))
 			continue;
@@ -357,10 +355,13 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
 		if (!mgmt_valid_hdev(d))
 			continue;
 
-		rp->index[i++] = cpu_to_le16(d->id);
+		rp->index[count++] = cpu_to_le16(d->id);
 		BT_DBG("Added hci%u", d->id);
 	}
 
+	rp->num_controllers = cpu_to_le16(count);
+	rp_len = sizeof(*rp) + (2 * count);
+
 	read_unlock(&hci_dev_list_lock);
 
 	err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
diff --git a/trunk/net/mac80211/cfg.c b/trunk/net/mac80211/cfg.c
index 7371f676cf41..05f3a313db88 100644
--- a/trunk/net/mac80211/cfg.c
+++ b/trunk/net/mac80211/cfg.c
@@ -2594,9 +2594,6 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
 		else
 			local->probe_req_reg--;
 
-		if (!local->open_count)
-			break;
-
 		ieee80211_queue_work(&local->hw, &local->reconfig_filter);
 		break;
 	default:
diff --git a/trunk/net/mac80211/ieee80211_i.h b/trunk/net/mac80211/ieee80211_i.h
index 156e5835e37f..8c804550465b 100644
--- a/trunk/net/mac80211/ieee80211_i.h
+++ b/trunk/net/mac80211/ieee80211_i.h
@@ -1314,8 +1314,6 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 					 struct net_device *dev);
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 				       struct net_device *dev);
-void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
-			      struct sk_buff_head *skbs);
 
 /* HT */
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
diff --git a/trunk/net/mac80211/main.c b/trunk/net/mac80211/main.c
index f57f597972f8..c80c4490351c 100644
--- a/trunk/net/mac80211/main.c
+++ b/trunk/net/mac80211/main.c
@@ -871,10 +871,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 				local->hw.wiphy->cipher_suites,
 				sizeof(u32) * local->hw.wiphy->n_cipher_suites,
 				GFP_KERNEL);
-			if (!suites) {
-				result = -ENOMEM;
-				goto fail_wiphy_register;
-			}
+			if (!suites)
+				return -ENOMEM;
 			for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
 				u32 suite = local->hw.wiphy->cipher_suites[r];
 				if (suite == WLAN_CIPHER_SUITE_WEP40 ||
diff --git a/trunk/net/mac80211/scan.c b/trunk/net/mac80211/scan.c
index 43e60b5a7546..c4cdbde24fd3 100644
--- a/trunk/net/mac80211/scan.c
+++ b/trunk/net/mac80211/scan.c
@@ -917,7 +917,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 				       struct cfg80211_sched_scan_request *req)
 {
 	struct ieee80211_local *local = sdata->local;
-	struct ieee80211_sched_scan_ies sched_scan_ies = {};
+	struct ieee80211_sched_scan_ies sched_scan_ies;
 	int ret, i;
 
 	mutex_lock(&local->mtx);
diff --git a/trunk/net/mac80211/sta_info.c b/trunk/net/mac80211/sta_info.c
index d2eb64e12353..0a4e4c04db89 100644
--- a/trunk/net/mac80211/sta_info.c
+++ b/trunk/net/mac80211/sta_info.c
@@ -117,8 +117,8 @@ static void free_sta_work(struct work_struct *wk)
 
 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 		local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
-		ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
-		ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
+		__skb_queue_purge(&sta->ps_tx_buf[ac]);
+		__skb_queue_purge(&sta->tx_filtered[ac]);
 	}
 
 #ifdef CONFIG_MAC80211_MESH
@@ -141,7 +141,7 @@ static void free_sta_work(struct work_struct *wk)
 		tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
 		if (!tid_tx)
 			continue;
-		ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
+		__skb_queue_purge(&tid_tx->pending);
 		kfree(tid_tx);
 	}
 
@@ -961,7 +961,6 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 	struct ieee80211_local *local = sdata->local;
 	struct sk_buff_head pending;
 	int filtered = 0, buffered = 0, ac;
-	unsigned long flags;
 
 	clear_sta_flag(sta, WLAN_STA_SP);
 
@@ -977,16 +976,12 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
 		int count = skb_queue_len(&pending), tmp;
 
-		spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
 		skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
-		spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
 		tmp = skb_queue_len(&pending);
 		filtered += tmp - count;
 		count = tmp;
 
-		spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
 		skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
-		spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
 		tmp = skb_queue_len(&pending);
 		buffered += tmp - count;
 	}
diff --git a/trunk/net/mac80211/status.c b/trunk/net/mac80211/status.c
index 101eb88a2b78..3af0cc4130f1 100644
--- a/trunk/net/mac80211/status.c
+++ b/trunk/net/mac80211/status.c
@@ -668,12 +668,3 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
 	dev_kfree_skb_any(skb);
 }
 EXPORT_SYMBOL(ieee80211_free_txskb);
-
-void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
-			      struct sk_buff_head *skbs)
-{
-	struct sk_buff *skb;
-
-	while ((skb = __skb_dequeue(skbs)))
-		ieee80211_free_txskb(hw, skb);
-}
diff --git a/trunk/net/mac80211/tx.c b/trunk/net/mac80211/tx.c
index b858ebe41fda..c9bf83f36657 100644
--- a/trunk/net/mac80211/tx.c
+++ b/trunk/net/mac80211/tx.c
@@ -1358,7 +1358,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
 		if (tx->skb)
 			ieee80211_free_txskb(&tx->local->hw, tx->skb);
 		else
-			ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
+			__skb_queue_purge(&tx->skbs);
 		return -1;
 	} else if (unlikely(res == TX_QUEUED)) {
 		I802_DEBUG_INC(tx->local->tx_handlers_queued);
@@ -2120,13 +2120,10 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
  */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
-	struct sk_buff *skb;
 	int i;
 
-	for (i = 0; i < local->hw.queues; i++) {
-		while ((skb = skb_dequeue(&local->pending[i])) != NULL)
-			ieee80211_free_txskb(&local->hw, skb);
-	}
+	for (i = 0; i < local->hw.queues; i++)
+		skb_queue_purge(&local->pending[i]);
 }
 
 /*
diff --git a/trunk/net/mac80211/util.c b/trunk/net/mac80211/util.c
index 0151ae33c4cd..239391807ca9 100644
--- a/trunk/net/mac80211/util.c
+++ b/trunk/net/mac80211/util.c
@@ -1491,8 +1491,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 		list_for_each_entry(sdata, &local->interfaces, list) {
 			if (sdata->vif.type != NL80211_IFTYPE_STATION)
 				continue;
-			if (!sdata->u.mgd.associated)
-				continue;
 
 			ieee80211_send_nullfunc(local, sdata, 0);
 		}
diff --git a/trunk/net/wireless/reg.c b/trunk/net/wireless/reg.c
index b75756b05af7..bcc7d7ee5a51 100644
--- a/trunk/net/wireless/reg.c
+++ b/trunk/net/wireless/reg.c
@@ -141,8 +141,9 @@ static const struct ieee80211_regdomain world_regdom = {
 	.reg_rules = {
 		/* IEEE 802.11b/g, channels 1..11 */
 		REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
-		/* IEEE 802.11b/g, channels 12..13. */
-		REG_RULE(2467-10, 2472+10, 40, 6, 20,
+		/* IEEE 802.11b/g, channels 12..13. No HT40
+		 * channel fits here. */
+		REG_RULE(2467-10, 2472+10, 20, 6, 20,
 			NL80211_RRF_PASSIVE_SCAN |
 			NL80211_RRF_NO_IBSS),
 		/* IEEE 802.11 channel 14 - Only JP enables