Merge tag 'mac80211-for-davem-2018-12-05' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

Johannes Berg:

====================
As it's been a while, we have various fixes for
 * hwsim
 * AP mode (client powersave related)
 * CSA/FTM interaction
 * a busy loop in IE handling
 * and similar
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

10 files changed, 33 insertions, 14 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 51622333d460..818aa0060349 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2891,7 +2891,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
 
         len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +
               beacon->proberesp_ies_len + beacon->assocresp_ies_len +
-              beacon->probe_resp_len;
+              beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;
 
         new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);
         if (!new_beacon)
@@ -2934,8 +2934,9 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
                 memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);
                 pos += beacon->probe_resp_len;
         }
-        if (beacon->ftm_responder)
-                new_beacon->ftm_responder = beacon->ftm_responder;
+
+        /* might copy -1, meaning no changes requested */
+        new_beacon->ftm_responder = beacon->ftm_responder;
         if (beacon->lci) {
                 new_beacon->lci_len = beacon->lci_len;
                 new_beacon->lci = pos;
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 5836ddeac9e3..5f3c81e705c7 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1015,6 +1015,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         if (local->open_count == 0)
                 ieee80211_clear_tx_pending(local);
 
+        sdata->vif.bss_conf.beacon_int = 0;
+
         /*
          * If the interface goes down while suspended, presumably because
          * the device was unplugged and that happens before our resume,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index d2bc8d57c87e..bcf5ffc1567a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2766,6 +2766,7 @@ static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct sta_info *sta;
+        bool result = true;
 
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
@@ -2778,15 +2779,18 @@ static bool ieee80211_mark_sta_auth(struct ieee80211_sub_if_data *sdata,
         sta = sta_info_get(sdata, bssid);
         if (!sta) {
                 WARN_ONCE(1, "%s: STA %pM not found", sdata->name, bssid);
-                return false;
+                result = false;
+                goto out;
         }
         if (sta_info_move_state(sta, IEEE80211_STA_AUTH)) {
                 sdata_info(sdata, "failed moving %pM to auth\n", bssid);
-                return false;
+                result = false;
+                goto out;
         }
-        mutex_unlock(&sdata->local->sta_mtx);
 
-        return true;
+out:
+        mutex_unlock(&sdata->local->sta_mtx);
+        return result;
 }
 
 static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 3bd3b5769797..428f7ad5f9b5 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1403,6 +1403,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
                 return RX_CONTINUE;
 
         if (ieee80211_is_ctl(hdr->frame_control) ||
+            ieee80211_is_nullfunc(hdr->frame_control) ||
             ieee80211_is_qos_nullfunc(hdr->frame_control) ||
             is_multicast_ether_addr(hdr->addr1))
                 return RX_CONTINUE;
@@ -3063,7 +3064,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         cfg80211_sta_opmode_change_notify(sdata->dev,
                                                           rx->sta->addr,
                                                           &sta_opmode,
-                                                          GFP_KERNEL);
+                                                          GFP_ATOMIC);
                         goto handled;
                 }
                 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
@@ -3100,7 +3101,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                         cfg80211_sta_opmode_change_notify(sdata->dev,
                                                           rx->sta->addr,
                                                           &sta_opmode,
-                                                          GFP_KERNEL);
+                                                          GFP_ATOMIC);
                         goto handled;
                 }
                 default:
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index aa4afbf0abaf..a794ca729000 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -964,6 +964,8 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw,
                         /* Track when last TDLS packet was ACKed */
                         if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
                                 sta->status_stats.last_tdls_pkt_time = jiffies;
+                } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
+                        return;
                 } else {
                         ieee80211_lost_packet(sta, info);
                 }
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e0ccee23fbcd..1f536ba573b4 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -439,8 +439,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
                 info->hw_queue = tx->sdata->vif.cab_queue;
 
-        /* no stations in PS mode */
-        if (!atomic_read(&ps->num_sta_ps))
+        /* no stations in PS mode and no buffered packets */
+        if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 12b3edf70a7b..1615e503f8e3 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -272,11 +272,11 @@ void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
 
         p1 = (u8*)(ht_capa);
         p2 = (u8*)(ht_capa_mask);
-        for (i = 0; i<sizeof(*ht_capa); i++)
+        for (i = 0; i < sizeof(*ht_capa); i++)
                 p1[i] &= p2[i];
 }
 
-/*  Do a logical ht_capa &= ht_capa_mask.  */
+/*  Do a logical vht_capa &= vht_capa_mask.  */
 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                                 const struct ieee80211_vht_cap *vht_capa_mask)
 {
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 744b5851bbf9..8d763725498c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7870,6 +7870,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         }
 
         memset(&params, 0, sizeof(params));
+        params.beacon_csa.ftm_responder = -1;
 
         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index d536b07582f8..f741d8376a46 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -642,11 +642,15 @@ static bool cfg80211_is_all_idle(void)
          * All devices must be idle as otherwise if you are actively
          * scanning some new beacon hints could be learned and would
          * count as new regulatory hints.
+         * Also if there is any other active beaconing interface we
+         * need not issue a disconnect hint and reset any info such
+         * as chan dfs state, etc.
          */
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
                         wdev_lock(wdev);
-                        if (wdev->conn || wdev->current_bss)
+                        if (wdev->conn || wdev->current_bss ||
+                            cfg80211_beaconing_iface_active(wdev))
                                 is_all_idle = false;
                         wdev_unlock(wdev);
                 }
@@ -1171,6 +1175,8 @@ int cfg80211_connect(struct cfg80211_registered_device *rdev,
 
         cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
                                   rdev->wiphy.ht_capa_mod_mask);
+        cfg80211_oper_and_vht_capa(&connect->vht_capa_mask,
+                                   rdev->wiphy.vht_capa_mod_mask);
 
         if (connkeys && connkeys->def >= 0) {
                 int idx;
diff --git a/net/wireless/util.c b/net/wireless/util.c
index ef14d80ca03e..d473bd135da8 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -1421,6 +1421,8 @@ size_t ieee80211_ie_split_ric(const u8 *ies, size_t ielen,
                                                           ies[pos + ext],
                                                           ext == 2))
                                         pos = skip_ie(ies, ielen, pos);
+                                else
+                                        break;
                         }
                 } else {
                         pos = skip_ie(ies, ielen, pos);